From: Sasha Levin Date: Sun, 29 Aug 2021 21:45:53 +0000 (-0400) Subject: Fixes for 4.19 X-Git-Tag: v4.4.283~56 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=f62373fc9711a1daf261c62ee9acdd94a0ec9129;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.19 Signed-off-by: Sasha Levin --- diff --git a/queue-4.19/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch b/queue-4.19/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch new file mode 100644 index 00000000000..2e8ef62d3de --- /dev/null +++ b/queue-4.19/e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch @@ -0,0 +1,76 @@ +From bac7a21dca01d3e62094922ec77508d00f594fcc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 4 Jul 2021 10:11:41 +0300 +Subject: e1000e: Fix the max snoop/no-snoop latency for 10M + +From: Sasha Neftin + +[ Upstream commit 44a13a5d99c71bf9e1676d9e51679daf4d7b3d73 ] + +We should decode the latency and the max_latency before directly compare. +The latency should be presented as lat_enc = scale x value: +lat_enc_d = (lat_enc & 0x0x3ff) x (1U << (5*((max_ltr_enc & 0x1c00) +>> 10))) + +Fixes: cf8fb73c23aa ("e1000e: add support for LTR on I217/I218") +Suggested-by: Yee Li +Signed-off-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000e/ich8lan.c | 14 +++++++++++++- + drivers/net/ethernet/intel/e1000e/ich8lan.h | 3 +++ + 2 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index 7998a73b6a0f..fbad77450725 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -995,6 +995,8 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + { + u32 reg = link << (E1000_LTRV_REQ_SHIFT + E1000_LTRV_NOSNOOP_SHIFT) | + link << E1000_LTRV_REQ_SHIFT | E1000_LTRV_SEND; ++ u16 max_ltr_enc_d = 0; /* maximum LTR decoded by platform */ ++ u16 lat_enc_d = 0; /* latency decoded */ + u16 lat_enc = 0; /* latency encoded */ + + if (link) { +@@ -1048,7 +1050,17 @@ static s32 e1000_platform_pm_pch_lpt(struct e1000_hw *hw, bool link) + E1000_PCI_LTR_CAP_LPT + 2, &max_nosnoop); + max_ltr_enc = max_t(u16, max_snoop, max_nosnoop); + +- if (lat_enc > max_ltr_enc) ++ lat_enc_d = (lat_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((lat_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ max_ltr_enc_d = (max_ltr_enc & E1000_LTRV_VALUE_MASK) * ++ (1U << (E1000_LTRV_SCALE_FACTOR * ++ ((max_ltr_enc & E1000_LTRV_SCALE_MASK) ++ >> E1000_LTRV_SCALE_SHIFT))); ++ ++ if (lat_enc_d > max_ltr_enc_d) + lat_enc = max_ltr_enc; + } + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index 1502895eb45d..e757896287eb 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -274,8 +274,11 @@ + + /* Latency Tolerance Reporting */ + #define E1000_LTRV 0x000F8 ++#define E1000_LTRV_VALUE_MASK 0x000003FF + #define E1000_LTRV_SCALE_MAX 5 + #define E1000_LTRV_SCALE_FACTOR 5 ++#define E1000_LTRV_SCALE_SHIFT 10 ++#define E1000_LTRV_SCALE_MASK 0x00001C00 + #define E1000_LTRV_REQ_SHIFT 15 + #define E1000_LTRV_NOSNOOP_SHIFT 16 + #define E1000_LTRV_SEND (1 << 30) +-- +2.30.2 + diff --git a/queue-4.19/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch b/queue-4.19/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch new file mode 100644 index 00000000000..0a652227039 --- /dev/null +++ b/queue-4.19/ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch @@ -0,0 +1,65 @@ +From e54921c5f400e5af3edb9aac8951fd392e8f12af Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 6 Aug 2021 06:30:29 -0700 +Subject: IB/hfi1: Fix possible null-pointer dereference in + _extend_sdma_tx_descs() + +From: Tuo Li + +[ Upstream commit cbe71c61992c38f72c2b625b2ef25916b9f0d060 ] + +kmalloc_array() is called to allocate memory for tx->descp. If it fails, +the function __sdma_txclean() is called: + __sdma_txclean(dd, tx); + +However, in the function __sdma_txclean(), tx-descp is dereferenced if +tx->num_desc is not zero: + sdma_unmap_desc(dd, &tx->descp[0]); + +To fix this possible null-pointer dereference, assign the return value of +kmalloc_array() to a local variable descp, and then assign it to tx->descp +if it is not NULL. Otherwise, go to enomem. + +Fixes: 7724105686e7 ("IB/hfi1: add driver files") +Link: https://lore.kernel.org/r/20210806133029.194964-1-islituo@gmail.com +Reported-by: TOTE Robot +Signed-off-by: Tuo Li +Tested-by: Mike Marciniszyn +Acked-by: Mike Marciniszyn +Signed-off-by: Jason Gunthorpe +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hfi1/sdma.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/infiniband/hw/hfi1/sdma.c b/drivers/infiniband/hw/hfi1/sdma.c +index 291c12f588b5..38258de75a94 100644 +--- a/drivers/infiniband/hw/hfi1/sdma.c ++++ b/drivers/infiniband/hw/hfi1/sdma.c +@@ -3055,6 +3055,7 @@ static void __sdma_process_event(struct sdma_engine *sde, + static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + { + int i; ++ struct sdma_desc *descp; + + /* Handle last descriptor */ + if (unlikely((tx->num_desc == (MAX_DESC - 1)))) { +@@ -3075,12 +3076,10 @@ static int _extend_sdma_tx_descs(struct hfi1_devdata *dd, struct sdma_txreq *tx) + if (unlikely(tx->num_desc == MAX_DESC)) + goto enomem; + +- tx->descp = kmalloc_array( +- MAX_DESC, +- sizeof(struct sdma_desc), +- GFP_ATOMIC); +- if (!tx->descp) ++ descp = kmalloc_array(MAX_DESC, sizeof(struct sdma_desc), GFP_ATOMIC); ++ if (!descp) + goto enomem; ++ tx->descp = descp; + + /* reserve last descriptor for coalescing */ + tx->desc_limit = MAX_DESC - 1; +-- +2.30.2 + diff --git a/queue-4.19/ip_gre-add-validation-for-csum_start.patch b/queue-4.19/ip_gre-add-validation-for-csum_start.patch new file mode 100644 index 00000000000..2e3858aca80 --- /dev/null +++ b/queue-4.19/ip_gre-add-validation-for-csum_start.patch @@ -0,0 +1,41 @@ +From 3beedccb2f44f32f547584fabc84a2714816d828 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 12:44:24 +0530 +Subject: ip_gre: add validation for csum_start + +From: Shreyansh Chouhan + +[ Upstream commit 1d011c4803c72f3907eccfc1ec63caefb852fcbf ] + +Validate csum_start in gre_handle_offloads before we call _gre_xmit so +that we do not crash later when the csum_start value is used in the +lco_csum function call. + +This patch deals with ipv4 code. + +Fixes: c54419321455 ("GRE: Refactor GRE tunneling code.") +Reported-by: syzbot+ff8e1b9f2f36481e2efc@syzkaller.appspotmail.com +Signed-off-by: Shreyansh Chouhan +Reviewed-by: Willem de Bruijn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index de6f89511a21..a8a37d112820 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -449,6 +449,8 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + + static int gre_handle_offloads(struct sk_buff *skb, bool csum) + { ++ if (csum && skb_checksum_start(skb) < skb->data) ++ return -EINVAL; + return iptunnel_handle_offloads(skb, csum ? SKB_GSO_GRE_CSUM : SKB_GSO_GRE); + } + +-- +2.30.2 + diff --git a/queue-4.19/net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch b/queue-4.19/net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch new file mode 100644 index 00000000000..72f3bfff147 --- /dev/null +++ b/queue-4.19/net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch @@ -0,0 +1,66 @@ +From e46fe9d0d30c3954e6f16aa97820987077b2d750 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 26 Aug 2021 19:22:01 +0800 +Subject: net: hns3: fix get wrong pfc_en when query PFC configuration + +From: Guangbin Huang + +[ Upstream commit 8c1671e0d13d4a0ba4fb3a0da932bf3736d7ff73 ] + +Currently, when query PFC configuration by dcbtool, driver will return +PFC enable status based on TC. As all priorities are mapped to TC0 by +default, if TC0 is enabled, then all priorities mapped to TC0 will be +shown as enabled status when query PFC setting, even though some +priorities have never been set. + +for example: +$ dcb pfc show dev eth0 +pfc-cap 4 macsec-bypass off delay 0 +prio-pfc 0:off 1:off 2:off 3:off 4:off 5:off 6:off 7:off +$ dcb pfc set dev eth0 prio-pfc 0:on 1:on 2:on 3:on +$ dcb pfc show dev eth0 +pfc-cap 4 macsec-bypass off delay 0 +prio-pfc 0:on 1:on 2:on 3:on 4:on 5:on 6:on 7:on + +To fix this problem, just returns user's PFC config parameter saved in +driver. + +Fixes: cacde272dd00 ("net: hns3: Add hclge_dcb module for the support of DCB feature") +Signed-off-by: Guangbin Huang +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 13 ++----------- + 1 file changed, 2 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +index a75d7c826fc2..dd935cd1fb44 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -204,21 +204,12 @@ static int hclge_ieee_getpfc(struct hnae3_handle *h, struct ieee_pfc *pfc) + u64 requests[HNAE3_MAX_TC], indications[HNAE3_MAX_TC]; + struct hclge_vport *vport = hclge_get_vport(h); + struct hclge_dev *hdev = vport->back; +- u8 i, j, pfc_map, *prio_tc; + int ret; ++ u8 i; + + memset(pfc, 0, sizeof(*pfc)); + pfc->pfc_cap = hdev->pfc_max; +- prio_tc = hdev->tm_info.prio_tc; +- pfc_map = hdev->tm_info.hw_pfc_map; +- +- /* Pfc setting is based on TC */ +- for (i = 0; i < hdev->tm_info.num_tc; i++) { +- for (j = 0; j < HNAE3_MAX_USER_PRIO; j++) { +- if ((prio_tc[j] == i) && (pfc_map & BIT(i))) +- pfc->pfc_en |= BIT(j); +- } +- } ++ pfc->pfc_en = hdev->tm_info.pfc_en; + + ret = hclge_pfc_tx_stats_get(hdev, requests); + if (ret) +-- +2.30.2 + diff --git a/queue-4.19/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch b/queue-4.19/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch new file mode 100644 index 00000000000..f83984dbcc9 --- /dev/null +++ b/queue-4.19/net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch @@ -0,0 +1,36 @@ +From 814e7f66c3033abb24e5c75dc82049835e911ac8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 20 Aug 2021 18:39:51 +0300 +Subject: net: marvell: fix MVNETA_TX_IN_PRGRS bit number + +From: Maxim Kiselev + +[ Upstream commit 359f4cdd7d78fdf8c098713b05fee950a730f131 ] + +According to Armada XP datasheet bit at 0 position is corresponding for +TxInProg indication. + +Fixes: c5aff18204da ("net: mvneta: driver for Marvell Armada 370/XP network unit") +Signed-off-by: Maxim Kiselev +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/mvneta.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index fda5dd8c71eb..382d010e1294 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -100,7 +100,7 @@ + #define MVNETA_DESC_SWAP BIT(6) + #define MVNETA_TX_BRST_SZ_MASK(burst) ((burst) << 22) + #define MVNETA_PORT_STATUS 0x2444 +-#define MVNETA_TX_IN_PRGRS BIT(1) ++#define MVNETA_TX_IN_PRGRS BIT(0) + #define MVNETA_TX_FIFO_EMPTY BIT(8) + #define MVNETA_RX_MIN_FRAME_SIZE 0x247c + #define MVNETA_SERDES_CFG 0x24A0 +-- +2.30.2 + diff --git a/queue-4.19/series b/queue-4.19/series index a8ed99cf197..3ee9be35404 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -10,3 +10,10 @@ revert-usb-serial-ch341-fix-character-loss-at-high-transfer-rates.patch usb-serial-option-add-new-vid-pid-to-support-fibocom-fg150.patch usb-dwc3-gadget-fix-dwc3_calc_trbs_left.patch usb-dwc3-gadget-stop-ep0-transfers-during-pullup-disable.patch +ib-hfi1-fix-possible-null-pointer-dereference-in-_ex.patch +e1000e-fix-the-max-snoop-no-snoop-latency-for-10m.patch +ip_gre-add-validation-for-csum_start.patch +xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch +net-marvell-fix-mvneta_tx_in_prgrs-bit-number.patch +net-hns3-fix-get-wrong-pfc_en-when-query-pfc-configu.patch +usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch diff --git a/queue-4.19/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch b/queue-4.19/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch new file mode 100644 index 00000000000..298dc5909cb --- /dev/null +++ b/queue-4.19/usb-gadget-u_audio-fix-race-condition-on-endpoint-st.patch @@ -0,0 +1,57 @@ +From 4cbf6a1792be7c99a2ea81e4aa8c4cef38b844c7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 27 Aug 2021 11:29:27 +0200 +Subject: usb: gadget: u_audio: fix race condition on endpoint stop + +From: Jerome Brunet + +[ Upstream commit 068fdad20454f815e61e6f6eb9f051a8b3120e88 ] + +If the endpoint completion callback is call right after the ep_enabled flag +is cleared and before usb_ep_dequeue() is call, we could do a double free +on the request and the associated buffer. + +Fix this by clearing ep_enabled after all the endpoint requests have been +dequeued. + +Fixes: 7de8681be2cd ("usb: gadget: u_audio: Free requests only after callback") +Cc: stable +Reported-by: Thinh Nguyen +Signed-off-by: Jerome Brunet +Link: https://lore.kernel.org/r/20210827092927.366482-1-jbrunet@baylibre.com +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/gadget/function/u_audio.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c +index 0cb0c638fd13..168303f21bf4 100644 +--- a/drivers/usb/gadget/function/u_audio.c ++++ b/drivers/usb/gadget/function/u_audio.c +@@ -349,8 +349,6 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + if (!prm->ep_enabled) + return; + +- prm->ep_enabled = false; +- + audio_dev = uac->audio_dev; + params = &audio_dev->params; + +@@ -368,11 +366,12 @@ static inline void free_ep(struct uac_rtd_params *prm, struct usb_ep *ep) + } + } + ++ prm->ep_enabled = false; ++ + if (usb_ep_disable(ep)) + dev_err(uac->card->dev, "%s:%d Error!\n", __func__, __LINE__); + } + +- + int u_audio_start_capture(struct g_audio *audio_dev) + { + struct snd_uac_chip *uac = audio_dev->uac; +-- +2.30.2 + diff --git a/queue-4.19/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch b/queue-4.19/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch new file mode 100644 index 00000000000..167aabcf40f --- /dev/null +++ b/queue-4.19/xgene-v2-fix-a-resource-leak-in-the-error-handling-p.patch @@ -0,0 +1,46 @@ +From 08486964e805d6783b92f7716a099e09439df97f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 21 Aug 2021 09:35:23 +0200 +Subject: xgene-v2: Fix a resource leak in the error handling path of + 'xge_probe()' + +From: Christophe JAILLET + +[ Upstream commit 5ed74b03eb4d08f5dd281dcb5f1c9bb92b363a8d ] + +A successful 'xge_mdio_config()' call should be balanced by a corresponding +'xge_mdio_remove()' call in the error handling path of the probe, as +already done in the remove function. + +Update the error handling path accordingly. + +Fixes: ea8ab16ab225 ("drivers: net: xgene-v2: Add MDIO support") +Signed-off-by: Christophe JAILLET +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/apm/xgene-v2/main.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/apm/xgene-v2/main.c b/drivers/net/ethernet/apm/xgene-v2/main.c +index 0f2ad50f3bd7..7f37e7cb687e 100644 +--- a/drivers/net/ethernet/apm/xgene-v2/main.c ++++ b/drivers/net/ethernet/apm/xgene-v2/main.c +@@ -691,11 +691,13 @@ static int xge_probe(struct platform_device *pdev) + ret = register_netdev(ndev); + if (ret) { + netdev_err(ndev, "Failed to register netdev\n"); +- goto err; ++ goto err_mdio_remove; + } + + return 0; + ++err_mdio_remove: ++ xge_mdio_remove(ndev); + err: + free_netdev(ndev); + +-- +2.30.2 +