From: Sasha Levin Date: Sun, 29 Aug 2021 21:45:52 +0000 (-0400) Subject: Fixes for 5.4 X-Git-Tag: v4.4.283~57 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f113a80929cd65ad6c5243338ad8b4b5e775fef3;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 5.4 Signed-off-by: Sasha Levin --- diff --git a/queue-5.4/drm-i915-fix-syncmap-memory-leak.patch b/queue-5.4/drm-i915-fix-syncmap-memory-leak.patch new file mode 100644 index 00000000000..2f99a60d2e8 --- /dev/null +++ b/queue-5.4/drm-i915-fix-syncmap-memory-leak.patch @@ -0,0 +1,67 @@ +From 8b185c1c9ac5f96d6d611dca276412654a0b4987 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 30 Jul 2021 12:53:42 -0700 +Subject: drm/i915: Fix syncmap memory leak + +From: Matthew Brost + +[ Upstream commit a63bcf08f0efb5348105bb8e0e1e8c6671077753 ] + +A small race exists between intel_gt_retire_requests_timeout and +intel_timeline_exit which could result in the syncmap not getting +free'd. Rather than work to hard to seal this race, simply cleanup the +syncmap on fini. + +unreferenced object 0xffff88813bc53b18 (size 96): + comm "gem_close_race", pid 5410, jiffies 4294917818 (age 1105.600s) + hex dump (first 32 bytes): + 01 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00 ................ + 00 00 00 00 00 00 00 00 6b 6b 6b 6b 06 00 00 00 ........kkkk.... + backtrace: + [<00000000120b863a>] __sync_alloc_leaf+0x1e/0x40 [i915] + [<00000000042f6959>] __sync_set+0x1bb/0x240 [i915] + [<0000000090f0e90f>] i915_request_await_dma_fence+0x1c7/0x400 [i915] + [<0000000056a48219>] i915_request_await_object+0x222/0x360 [i915] + [<00000000aaac4ee3>] i915_gem_do_execbuffer+0x1bd0/0x2250 [i915] + [<000000003c9d830f>] i915_gem_execbuffer2_ioctl+0x405/0xce0 [i915] + [<00000000fd7a8e68>] drm_ioctl_kernel+0xb0/0xf0 [drm] + [<00000000e721ee87>] drm_ioctl+0x305/0x3c0 [drm] + [<000000008b0d8986>] __x64_sys_ioctl+0x71/0xb0 + [<0000000076c362a4>] do_syscall_64+0x33/0x80 + [<00000000eb7a4831>] entry_SYSCALL_64_after_hwframe+0x44/0xa9 + +Signed-off-by: Matthew Brost +Fixes: 531958f6f357 ("drm/i915/gt: Track timeline activeness in enter/exit") +Cc: +Reviewed-by: John Harrison +Signed-off-by: John Harrison +Link: https://patchwork.freedesktop.org/patch/msgid/20210730195342.110234-1-matthew.brost@intel.com +(cherry picked from commit faf890985e30d5e88cc3a7c50c1bcad32f89ab7c) +Signed-off-by: Rodrigo Vivi +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/i915/gt/intel_timeline.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/gpu/drm/i915/gt/intel_timeline.c b/drivers/gpu/drm/i915/gt/intel_timeline.c +index 9cb01d9828f1..c970e3deb008 100644 +--- a/drivers/gpu/drm/i915/gt/intel_timeline.c ++++ b/drivers/gpu/drm/i915/gt/intel_timeline.c +@@ -289,6 +289,14 @@ void intel_timeline_fini(struct intel_timeline *timeline) + i915_gem_object_unpin_map(timeline->hwsp_ggtt->obj); + + i915_vma_put(timeline->hwsp_ggtt); ++ ++ /* ++ * A small race exists between intel_gt_retire_requests_timeout and ++ * intel_timeline_exit which could result in the syncmap not getting ++ * free'd. Rather than work to hard to seal this race, simply cleanup ++ * the syncmap on fini. ++ */ ++ i915_syncmap_free(&timeline->sync); + } + + struct intel_timeline * +-- +2.30.2 + diff --git a/queue-5.4/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch b/queue-5.4/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch new file mode 100644 index 00000000000..cfa9ce4c6cc --- /dev/null +++ b/queue-5.4/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch @@ -0,0 +1,76 @@ +From 7b1c4dbf33974608a9d84e650dd8d4fc7d6b8fa2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 10:11:41 +0300 +Subject: e1000e: Fix the max snoop/no-snoop latency for 10M + +From: Sasha Neftin + +[ Upstream commit 44a13a5d99c71bf9e1676d9e51679daf4d7b3d73 ] + +We should decode the latency and the max_latency before directly compare. +The latency should be presented as lat_enc = scale x value: +lat_enc_d = (lat_enc & 0x0x3ff) x (1U << (5*((max_ltr_enc & 0x1c00) +>> 10))) + +Fixes: cf8fb73c23aa ("e1000e: add support for LTR on I217/I218") +Suggested-by: Yee Li +Signed-off-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++- + drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++ + 2 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index a1fab77b2096..58ff747a42ae 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -995,6 +995,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + { + u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | + link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; ++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ ++ u16 lat_enc_d = 0; /* latency decoded */ + u16 lat_enc = 0; /* latency encoded */ + + if (link) { +@@ -1048,7 +1050,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop); + max_ltr_enc = max_t(u16, max_snoop, max_nosnoop); + +- if (lat_enc > max_ltr_enc) ++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((lat_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ if (lat_enc_d > max_ltr_enc_d) + lat_enc = max_ltr_enc; + } + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index 1502895eb45d..e757896287eb 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -274,8 +274,11 @@ + + /* Latency Tolerance Reporting */ + #define E1000_LTRV 0x000F8 ++#define E1000_LTRV_VALUE_MASK 0x000003FF + #define E1000_LTRV_SCALE_MAX 5 + #define E1000_LTRV_SCALE_FACTOR 5 ++#define E1000_LTRV_SCALE_SHIFT 10 ++#define E1000_LTRV_SCALE_MASK 0x00001C00 + #define E1000_LTRV_REQ_SHIFT 15 + #define E1000_LTRV_NOSNOOP_SHIFT 16 + #define E1000_LTRV_SEND (1 << 30) +-- +2.30.2 + diff --git a/queue-5.4/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch b/queue-5.4/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch new file mode 100644 index 00000000000..b0b21e6e414 --- /dev/null +++ b/queue-5.4/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch @@ -0,0 +1,65 @@ +From 2f6a9f8336ffbbfac18eb2ebe67914ccd3c32c8b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 06:30:29 -0700 +Subject: IB/hfi1: Fix possible null-pointer dereference in + _extend_sdma_tx_descs() + +From: Tuo Li + +[ Upstream commit cbe71c61992c38f72c2b625b2ef25916b9f0d060 ] + +kmalloc_array() is called to allocate memory for tx->descp. If it fails, +the function __sdma_txclean() is called: + __sdma_txclean(dd, tx); + +However, in the function __sdma_txclean(), tx-descp is dereferenced if +tx->num_desc is not zero: + sdma_unmap_desc(dd, &tx->descp[0]); + +To fix this possible null-pointer dereference, assign the return value of +kmalloc_array() to a local variable descp, and then assign it to tx->descp +if it is not NULL. Otherwise, go to enomem. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Link: https://lore.kernel.org/r/20210806133029.194964-1-islituo@gmail.com +Reported-by: TOTE Robot +Signed-off-by: Tuo Li +Tested-by: Mike Marciniszyn +Acked-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/sdma.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index c61b6022575e..248be21acdbe 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -3056,6 +3056,7 @@ static void __sdma_process_event(struct sdma_engine *sde, + static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + { + int i; ++ struct sdma_desc *descp; + + /* Handle last descriptor */ + if (unlikely((tx->num_desc == (MAX_DESC - 1)))) { +@@ -3076,12 +3077,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + if (unlikely(tx->num_desc == MAX_DESC)) + goto enomem; + +- tx->descp = kmalloc_array( +- MAX_DESC, +- sizeof(struct sdma_desc), +- GFP_ATOMIC); +- if (!tx->descp) ++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC); ++ if (!descp) + goto enomem; ++ tx->descp = descp; + + /* reserve last descriptor for coalescing */ + tx->desc_limit = MAX_DESC - 1; +-- +2.30.2 + diff --git a/queue-5.4/ip_gre-add-validation-for-csum_start.patch b/queue-5.4/ip_gre-add-validation-for-csum_start.patch new file mode 100644 index 00000000000..5944084a637 --- /dev/null +++ b/queue-5.4/ip_gre-add-validation-for-csum_start.patch @@ -0,0 +1,41 @@ +From f2ce1a45700ef476a637dba6681cd0a21268ed66 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 12:44:24 +0530 +Subject: ip_gre: add validation for csum_start + +From: Shreyansh Chouhan + +[ Upstream commit 1d011c4803c72f3907eccfc1ec63caefb852fcbf ] + +Validate csum_start in gre_handle_offloads before we call _gre_xmit so +that we do not crash later when the csum_start value is used in the +lco_csum function call. + +This patch deals with ipv4 code. + +Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") +Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com +Signed-off-by: Shreyansh Chouhan +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index fedad3a3e61b..fd8298b8b1c5 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -446,6 +446,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + + static int gre_handle_offloads(struct sk_buff *skb, bool csum) + { ++ if (csum && skb_checksum_start(skb) < skb->data) ++ return -EINVAL; + return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); + } + +-- +2.30.2 + diff --git a/queue-5.4/net-hns3-clear-hardware-resource-when-loading-driver.patch b/queue-5.4/net-hns3-clear-hardware-resource-when-loading-driver.patch new file mode 100644 index 00000000000..e739e69dd94 --- /dev/null +++ b/queue-5.4/net-hns3-clear-hardware-resource-when-loading-driver.patch @@ -0,0 +1,86 @@ +From 9d79666334789797ac64c5b4cdf22e637ae6150c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 19:21:55 +0800 +Subject: net: hns3: clear hardware resource when loading driver + +From: Yufeng Mo + +[ Upstream commit 1a6d281946c330cee2855f6d0cd796616e54601f ] + +If a PF is bonded to a virtual machine and the virtual machine exits +unexpectedly, some hardware resource cannot be cleared. In this case, +loading driver may cause exceptions. Therefore, the hardware resource +needs to be cleared when the driver is loaded. + +Fixes: 46a3df9f9718 ("net: hns3: Add HNS3 Acceleration Engine & Compatibility Layer Support") +Signed-off-by: Yufeng Mo +Signed-off-by: Salil Mehta +Signed-off-by: Guangbin Huang +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../hisilicon/hns3/hns3pf/hclge_cmd.h | 3 +++ + .../hisilicon/hns3/hns3pf/hclge_main.c | 26 +++++++++++++++++++ + 2 files changed, 29 insertions(+) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +index e34e0854635c..d64cded30eeb 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_cmd.h +@@ -257,6 +257,9 @@ enum hclge_opcode_type { + /* Led command */ + HCLGE_OPC_LED_STATUS_CFG = 0xB000, + ++ /* clear hardware resource command */ ++ HCLGE_OPC_CLEAR_HW_RESOURCE = 0x700B, ++ + /* NCL config command */ + HCLGE_OPC_QUERY_NCL_CONFIG = 0x7011, + /* M7 stats command */ +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 93f3865b679b..28e260439196 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -9165,6 +9165,28 @@ static void hclge_clear_resetting_state(struct hclge_dev *hdev) + } + } + ++static int hclge_clear_hw_resource(struct hclge_dev *hdev) ++{ ++ struct hclge_desc desc; ++ int ret; ++ ++ hclge_cmd_setup_basic_desc(&desc, HCLGE_OPC_CLEAR_HW_RESOURCE, false); ++ ++ ret = hclge_cmd_send(&hdev->hw, &desc, 1); ++ /* This new command is only supported by new firmware, it will ++ * fail with older firmware. Error value -EOPNOSUPP can only be ++ * returned by older firmware running this command, to keep code ++ * backward compatible we will override this value and return ++ * success. ++ */ ++ if (ret && ret != -EOPNOTSUPP) { ++ dev_err(&hdev->pdev->dev, ++ "failed to clear hw resource, ret = %d\n", ret); ++ return ret; ++ } ++ return 0; ++} ++ + static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) + { + struct pci_dev *pdev = ae_dev->pdev; +@@ -9206,6 +9228,10 @@ static int hclge_init_ae_dev(struct hnae3_ae_dev *ae_dev) + if (ret) + goto err_cmd_uninit; + ++ ret = hclge_clear_hw_resource(hdev); ++ if (ret) ++ goto err_cmd_uninit; ++ + ret = hclge_get_cap(hdev); + if (ret) { + dev_err(&pdev->dev, "get hw capability error, ret = %d.\n", +-- +2.30.2 + diff --git a/queue-5.4/net-hns3-fix-duplicate-node-in-vlan-list.patch b/queue-5.4/net-hns3-fix-duplicate-node-in-vlan-list.patch new file mode 100644 index 00000000000..8c28249c67b --- /dev/null +++ b/queue-5.4/net-hns3-fix-duplicate-node-in-vlan-list.patch @@ -0,0 +1,42 @@ +From 9e746a7fbab0546f824aacdce7bc42021157f265 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 19:21:58 +0800 +Subject: net: hns3: fix duplicate node in VLAN list + +From: Guojia Liao + +[ Upstream commit 94391fae82f71c98ecc7716a32611fcca73c74eb ] + +VLAN list should not be added duplicate VLAN node, otherwise it would +cause "add failed" when restore VLAN from VLAN list, so this patch adds +VLAN ID check before adding node into VLAN list. + +Fixes: c6075b193462 ("net: hns3: Record VF vlan tables") +Signed-off-by: Guojia Liao +Signed-off-by: Guangbin Huang +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +index 28e260439196..aa402e267121 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_main.c +@@ -8006,7 +8006,11 @@ static int hclge_init_vlan_config(struct hclge_dev *hdev) + static void hclge_add_vport_vlan_table(struct hclge_vport *vport, u16 vlan_id, + bool writen_to_tbl) + { +- struct hclge_vport_vlan_cfg *vlan; ++ struct hclge_vport_vlan_cfg *vlan, *tmp; ++ ++ list_for_each_entry_safe(vlan, tmp, &vport->vlan_list, node) ++ if (vlan->vlan_id == vlan_id) ++ return; + + vlan = kzalloc(sizeof(*vlan), GFP_KERNEL); + if (!vlan) +-- +2.30.2 + diff --git a/queue-5.4/net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch b/queue-5.4/net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch new file mode 100644 index 00000000000..105c32940a9 --- /dev/null +++ b/queue-5.4/net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch @@ -0,0 +1,66 @@ +From 4b6d335fcee0fd8cf211d6b554b41701313416fe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 19:22:01 +0800 +Subject: net: hns3: fix get wrong pfc_en when query PFC configuration + +From: Guangbin Huang + +[ Upstream commit 8c1671e0d13d4a0ba4fb3a0da932bf3736d7ff73 ] + +Currently, when query PFC configuration by dcbtool, driver will return +PFC enable status based on TC. As all priorities are mapped to TC0 by +default, if TC0 is enabled, then all priorities mapped to TC0 will be +shown as enabled status when query PFC setting, even though some +priorities have never been set. + +for example: +$ dcb pfc show dev eth0 +pfc-cap 4 macsec-bypass off delay 0 +prio-pfc 0:off 1:off 2:off 3:off 4:off 5:off 6:off 7:off +$ dcb pfc set dev eth0 prio-pfc 0:on 1:on 2:on 3:on +$ dcb pfc show dev eth0 +pfc-cap 4 macsec-bypass off delay 0 +prio-pfc 0:on 1:on 2:on 3:on 4:on 5:on 6:on 7:on + +To fix this problem, just returns user's PFC config parameter saved in +driver. + +Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature") +Signed-off-by: Guangbin Huang +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +index a1790af73096..d16488bab86f 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -281,21 +281,12 @@ static int hclge_ieee_getpfc(struct hnae3_handle *h, struct ieee_pfc *pfc) + u64 requests[HNAE3_MAX_TC], indications[HNAE3_MAX_TC]; + struct hclge_vport *vport = hclge_get_vport(h); + struct hclge_dev *hdev = vport->back; +- u8 i, j, pfc_map, *prio_tc; + int ret; ++ u8 i; + + memset(pfc, 0, sizeof(*pfc)); + pfc->pfc_cap = hdev->pfc_max; +- prio_tc = hdev->tm_info.prio_tc; +- pfc_map = hdev->tm_info.hw_pfc_map; +- +- /* Pfc setting is based on TC */ +- for (i = 0; i < hdev->tm_info.num_tc; i++) { +- for (j = 0; j < HNAE3_MAX_USER_PRIO; j++) { +- if ((prio_tc[j] == i) && (pfc_map & BIT(i))) +- pfc->pfc_en |= BIT(j); +- } +- } ++ pfc->pfc_en = hdev->tm_info.pfc_en; + + ret = hclge_pfc_tx_stats_get(hdev, requests); + if (ret) +-- +2.30.2 + diff --git a/queue-5.4/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch b/queue-5.4/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch new file mode 100644 index 00000000000..8cca9afe0a9 --- /dev/null +++ b/queue-5.4/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch @@ -0,0 +1,36 @@ +From b301c97e027f04e306b79a4c38ce1b5d41581fbf Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 18:39:51 +0300 +Subject: net: marvell: fix MVNETA_TX_IN_PRGRS bit number + +From: Maxim Kiselev + +[ Upstream commit 359f4cdd7d78fdf8c098713b05fee950a730f131 ] + +According to Armada XP datasheet bit at 0 position is corresponding for +TxInProg indication. + +Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit") +Signed-off-by: Maxim Kiselev +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 7b0543056b10..64aa5510e61a 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -101,7 +101,7 @@ + #define MVNETA_DESC_SWAP BIT(6) + #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22) + #define MVNETA_PORT_STATUS 0x2444 +-#define MVNETA_TX_IN_PRGRS BIT(1) ++#define MVNETA_TX_IN_PRGRS BIT(0) + #define MVNETA_TX_FIFO_EMPTY BIT(8) + #define MVNETA_RX_MIN_FRAME_SIZE 0x247c + /* Only exists on Armada XP and Armada 370 */ +-- +2.30.2 + diff --git a/queue-5.4/rdma-bnxt_re-add-missing-spin-lock-initialization.patch b/queue-5.4/rdma-bnxt_re-add-missing-spin-lock-initialization.patch new file mode 100644 index 00000000000..d9cb318d196 --- /dev/null +++ b/queue-5.4/rdma-bnxt_re-add-missing-spin-lock-initialization.patch @@ -0,0 +1,36 @@ +From b560dabbe6399934562fb6f46f7f8dbb3e1eab4f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 18 Aug 2021 20:25:52 -0700 +Subject: RDMA/bnxt_re: Add missing spin lock initialization + +From: Naresh Kumar PBS + +[ Upstream commit 17f2569dce1848080825b8336e6b7c6900193b44 ] + +Add the missing initialization of srq lock. + +Fixes: 37cb11acf1f7 ("RDMA/bnxt_re: Add SRQ support for Broadcom adapters") +Link: https://lore.kernel.org/r/1629343553-5843-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Naresh Kumar PBS +Signed-off-by: Selvin Xavier +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/ib_verbs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/bnxt_re/ib_verbs.c b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +index 58c021648b7c..a96f9142fe08 100644 +--- a/drivers/infiniband/hw/bnxt_re/ib_verbs.c ++++ b/drivers/infiniband/hw/bnxt_re/ib_verbs.c +@@ -1404,6 +1404,7 @@ int bnxt_re_create_srq(struct ib_srq *ib_srq, + if (nq) + nq->budget++; + atomic_inc(&rdev->srq_count); ++ spin_lock_init(&srq->lock); + + return 0; + +-- +2.30.2 + diff --git a/queue-5.4/rdma-efa-free-irq-vectors-on-error-flow.patch b/queue-5.4/rdma-efa-free-irq-vectors-on-error-flow.patch new file mode 100644 index 00000000000..25e3672c2d1 --- /dev/null +++ b/queue-5.4/rdma-efa-free-irq-vectors-on-error-flow.patch @@ -0,0 +1,38 @@ +From 21d51cf931c1d9a8020a6604c420b076ae12fdfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 11 Aug 2021 18:11:28 +0300 +Subject: RDMA/efa: Free IRQ vectors on error flow + +From: Gal Pressman + +[ Upstream commit dbe986bdfd6dfe6ef24b833767fff4151e024357 ] + +Make sure to free the IRQ vectors in case the allocation doesn't return +the expected number of IRQs. + +Fixes: b7f5e880f377 ("RDMA/efa: Add the efa module") +Link: https://lore.kernel.org/r/20210811151131.39138-2-galpress@amazon.com +Reviewed-by: Firas JahJah +Reviewed-by: Yossi Leybovich +Signed-off-by: Gal Pressman +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/efa/efa_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/infiniband/hw/efa/efa_main.c b/drivers/infiniband/hw/efa/efa_main.c +index 83858f7e83d0..75dfe9d1564c 100644 +--- a/drivers/infiniband/hw/efa/efa_main.c ++++ b/drivers/infiniband/hw/efa/efa_main.c +@@ -340,6 +340,7 @@ static int efa_enable_msix(struct efa_dev *dev) + } + + if (irq_num != msix_vecs) { ++ efa_disable_msix(dev); + dev_err(&dev->pdev->dev, + "Allocated %d MSI-X (out of %d requested)\n", + irq_num, msix_vecs); +-- +2.30.2 + diff --git a/queue-5.4/rtnetlink-return-correct-error-on-changing-device-ne.patch b/queue-5.4/rtnetlink-return-correct-error-on-changing-device-ne.patch new file mode 100644 index 00000000000..ccab3b67043 --- /dev/null +++ b/queue-5.4/rtnetlink-return-correct-error-on-changing-device-ne.patch @@ -0,0 +1,121 @@ +From 51c0214a88c75f5c7d3f0add8719f6a2f40fc0e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 25 Aug 2021 17:25:40 -0700 +Subject: rtnetlink: Return correct error on changing device netns + +From: Andrey Ignatov + +[ Upstream commit 96a6b93b69880b2c978e1b2be9cae6970b605008 ] + +Currently when device is moved between network namespaces using +RTM_NEWLINK message type and one of netns attributes (FLA_NET_NS_PID, +IFLA_NET_NS_FD, IFLA_TARGET_NETNSID) but w/o specifying IFLA_IFNAME, and +target namespace already has device with same name, userspace will get +EINVAL what is confusing and makes debugging harder. + +Fix it so that userspace gets more appropriate EEXIST instead what makes +debugging much easier. + +Before: + + # ./ifname.sh + + ip netns add ns0 + + ip netns exec ns0 ip link add l0 type dummy + + ip netns exec ns0 ip link show l0 + 8: l0: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 + link/ether 66:90:b5:d5:78:69 brd ff:ff:ff:ff:ff:ff + + ip link add l0 type dummy + + ip link show l0 + 10: l0: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 + link/ether 6e:c6:1f:15:20:8d brd ff:ff:ff:ff:ff:ff + + ip link set l0 netns ns0 + RTNETLINK answers: Invalid argument + +After: + + # ./ifname.sh + + ip netns add ns0 + + ip netns exec ns0 ip link add l0 type dummy + + ip netns exec ns0 ip link show l0 + 8: l0: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 + link/ether 1e:4a:72:e3:e3:8f brd ff:ff:ff:ff:ff:ff + + ip link add l0 type dummy + + ip link show l0 + 10: l0: mtu 1500 qdisc noop state DOWN mode DEFAULT group default qlen 1000 + link/ether f2:fc:fe:2b:7d:a6 brd ff:ff:ff:ff:ff:ff + + ip link set l0 netns ns0 + RTNETLINK answers: File exists + +The problem is that do_setlink() passes its `char *ifname` argument, +that it gets from a caller, to __dev_change_net_namespace() as is (as +`const char *pat`), but semantics of ifname and pat can be different. + +For example, __rtnl_newlink() does this: + +net/core/rtnetlink.c + 3270 char ifname[IFNAMSIZ]; + ... + 3286 if (tb[IFLA_IFNAME]) + 3287 nla_strscpy(ifname, tb[IFLA_IFNAME], IFNAMSIZ); + 3288 else + 3289 ifname[0] = '\0'; + ... + 3364 if (dev) { + ... + 3394 return do_setlink(skb, dev, ifm, extack, tb, ifname, status); + 3395 } + +, i.e. do_setlink() gets ifname pointer that is always valid no matter +if user specified IFLA_IFNAME or not and then do_setlink() passes this +ifname pointer as is to __dev_change_net_namespace() as pat argument. + +But the pat (pattern) in __dev_change_net_namespace() is used as: + +net/core/dev.c + 11198 err = -EEXIST; + 11199 if (__dev_get_by_name(net, dev->name)) { + 11200 /* We get here if we can't use the current device name */ + 11201 if (!pat) + 11202 goto out; + 11203 err = dev_get_valid_name(net, dev, pat); + 11204 if (err < 0) + 11205 goto out; + 11206 } + +As the result the `goto out` path on line 11202 is neven taken and +instead of returning EEXIST defined on line 11198, +__dev_change_net_namespace() returns an error from dev_get_valid_name() +and this, in turn, will be EINVAL for ifname[0] = '\0' set earlier. + +Fixes: d8a5ec672768 ("[NET]: netlink support for moving devices between network namespaces.") +Signed-off-by: Andrey Ignatov +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/rtnetlink.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 0bad5db23129..6fbc9cb09dc0 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -2414,6 +2414,7 @@ static int do_setlink(const struct sk_buff *skb, + return err; + + if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD] || tb[IFLA_TARGET_NETNSID]) { ++ const char *pat = ifname && ifname[0] ? ifname : NULL; + struct net *net = rtnl_link_get_net_capable(skb, dev_net(dev), + tb, CAP_NET_ADMIN); + if (IS_ERR(net)) { +@@ -2421,7 +2422,7 @@ static int do_setlink(const struct sk_buff *skb, + goto errout; + } + +- err = dev_change_net_namespace(dev, net, ifname); ++ err = dev_change_net_namespace(dev, net, pat); + put_net(net); + if (err) + goto errout; +-- +2.30.2 + diff --git a/queue-5.4/series b/queue-5.4/series index f71cc7177ac..8ef92e36156 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -11,3 +11,16 @@ usb-serial-option-add-new-vid-pid-to-support-fibocom-fg150.patch usb-dwc3-gadget-fix-dwc3_calc_trbs_left.patch usb-dwc3-gadget-stop-ep0-transfers-during-pullup-disable.patch scsi-core-fix-hang-of-freezing-queue-between-blocking-and-running-device.patch +rdma-bnxt_re-add-missing-spin-lock-initialization.patch +ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch +e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch +rdma-efa-free-irq-vectors-on-error-flow.patch +ip_gre-add-validation-for-csum_start.patch +xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch +net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch +rtnetlink-return-correct-error-on-changing-device-ne.patch +net-hns3-clear-hardware-resource-when-loading-driver.patch +net-hns3-fix-duplicate-node-in-vlan-list.patch +net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch +drm-i915-fix-syncmap-memory-leak.patch +usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch diff --git a/queue-5.4/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch b/queue-5.4/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch new file mode 100644 index 00000000000..4a29720c8ec --- /dev/null +++ b/queue-5.4/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch @@ -0,0 +1,57 @@ +From b0391f93f02a09a41f775c58f1e91ea981578771 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Aug 2021 11:29:27 +0200 +Subject: usb: gadget: u_audio: fix race condition on endpoint stop + +From: Jerome Brunet + +[ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ] + +If the endpoint completion callback is call right after the ep_enabled flag +is cleared and before usb_ep_dequeue() is call, we could do a double free +on the request and the associated buffer. + +Fix this by clearing ep_enabled after all the endpoint requests have been +dequeued. + +Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback") +Cc: stable +Reported-by: Thinh Nguyen +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_audio.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c +index 223029fa8445..4e01ba0ab8ec 100644 +--- a/drivers/usb/gadget/function/u_audio.c ++++ b/drivers/usb/gadget/function/u_audio.c +@@ -349,8 +349,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + if (!prm->ep_enabled) + return; + +- prm->ep_enabled = false; +- + audio_dev = uac->audio_dev; + params = &audio_dev->params; + +@@ -368,11 +366,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + } + } + ++ prm->ep_enabled = false; ++ + if (usb_ep_disable(ep)) + dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__); + } + +- + int u_audio_start_capture(struct g_audio *audio_dev) + { + struct snd_uac_chip *uac = audio_dev->uac; +-- +2.30.2 + diff --git a/queue-5.4/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch b/queue-5.4/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch new file mode 100644 index 00000000000..590a8673700 --- /dev/null +++ b/queue-5.4/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch @@ -0,0 +1,46 @@ +From 711d918fab11cfe94253eb22916ac2467c8e77c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 09:35:23 +0200 +Subject: xgene-v2: Fix a resource leak in the error handling path of + 'xge_probe()' + +From: Christophe JAILLET + +[ Upstream commit 5ed74b03eb4d08f5dd281dcb5f1c9bb92b363a8d ] + +A successful 'xge_mdio_config()' call should be balanced by a corresponding +'xge_mdio_remove()' call in the error handling path of the probe, as +already done in the remove function. + +Update the error handling path accordingly. + +Fixes: ea8ab16ab225 ("drivers: net: xgene-v2: Add MDIO support") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/apm/xgene-v2/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c +index 02b4f3af02b5..848be6bf2fd1 100644 +--- a/drivers/net/ethernet/apm/xgene-v2/main.c ++++ b/drivers/net/ethernet/apm/xgene-v2/main.c +@@ -677,11 +677,13 @@ static int xge_probe(struct platform_device *pdev) + ret = register_netdev(ndev); + if (ret) { + netdev_err(ndev, "Failed to register netdev\n"); +- goto err; ++ goto err_mdio_remove; + } + + return 0; + ++err_mdio_remove: ++ xge_mdio_remove(ndev); + err: + free_netdev(ndev); + +-- +2.30.2 +