From 346000be9e01844707b4b395e0d267597696ffd0 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Wed, 26 Oct 2022 21:36:30 -0400 Subject: [PATCH] Fixes for 6.0 Signed-off-by: Sasha Levin --- .../acpi-extlog-handle-multiple-records.patch | 93 ++++ ...pointer-dereference-in-blk_mq_clear_.patch | 68 +++ ..._en-fix-memory-leak-in-bnxt_nvm_test.patch | 62 +++ ...sing-of-delayed-data-refs-during-bac.patch | 249 ++++++++++ ...sing-of-delayed-tree-block-refs-duri.patch | 204 ++++++++ ...leak-when-build-ntlmssp-negotiate-bl.patch | 62 +++ ...fix-xid-leak-in-cifs_copy_file_range.patch | 42 ++ .../cifs-fix-xid-leak-in-cifs_create.patch | 41 ++ .../cifs-fix-xid-leak-in-cifs_flock.patch | 56 +++ ...fix-xid-leak-in-cifs_ses_add_channel.patch | 36 ++ ...ssary-assignment-statement-in-alloc_.patch | 32 ++ ...lone-bio-if-we-have-a-backing-device.patch | 72 +++ ...increase-frame-size-limit-for-displa.patch | 62 +++ ...-add-module-dependency-on-hdmi-codec.patch | 55 +++ ...orce-the-minimum-rate-at-runtime_res.patch | 64 +++ ...churn-the-mapping-page-for-duplicate.patch | 70 +++ .../ext4-factor-out-ext4_fc_get_tl.patch | 154 ++++++ ...al-out-of-bound-read-in-ext4_fc_repl.patch | 101 ++++ ...ntroduce-ext4_fc_tag_base_len-helper.patch | 200 ++++++++ ...o-not-set-btn_mouse-on-double-report.patch | 48 ++ queue-6.0/i40e-fix-dma-mappings-leak.patch | 323 +++++++++++++ ...ate-task_work-run-on-tif_notify_sign.patch | 56 +++ ...g-fix-null-pointer-dereference-in-io.patch | 72 +++ ...g-rw-remove-leftover-debug-statement.patch | 36 ++ ...-nvs-regions-in-arch_rmrr_sanity_che.patch | 79 +++ ...-up-si_domain-in-the-init_dmars-erro.patch | 56 +++ ...catch-null-pointer-issue-on-reconfig.patch | 56 +++ ...sue-in-ip6mr_sk_done-when-addrconf_i.patch | 124 +++++ ...ix-use-after-free-in-__kernfs_remove.patch | 202 ++++++++ ...roc_mpc_write-incorrect-return-value.patch | 41 ++ ...x-ethtool-autocast-mib-for-big-endia.patch | 92 ++++ ...x-inband-mgmt-for-big-endian-systems.patch | 168 +++++++ ..._eth_soc-fix-possible-memory-leak-in.patch | 82 ++++ ...-mtk_eth_wed-add-missing-of_node_put.patch | 53 +++ ..._eth_wed-add-missing-put_device-in-m.patch | 57 +++ ...alue-of-qdisc-ingress-handling-on-su.patch | 97 ++++ ...ible-memory-leak-in-hnae_ae_register.patch | 61 +++ ...oid-possible-null-deref-in-skb_clone.patch | 97 ++++ ...disable-mdi-crossover-status-change-.patch | 43 ++ ...extend-rx-strap-quirk-for-sgmii-mode.patch | 44 ++ ...mac_managed_pm-in-phylink_config-str.patch | 70 +++ ...ix-null-pointer-access-issue-when-ca.patch | 86 ++++ ...-duplicate-cleanup-of-backlog-and-ql.patch | 316 ++++++++++++ ...ed-fix-race-condition-in-qdisc_graft.patch | 265 +++++++++++ ...x-null-pointer-access-issue-when-sfb.patch | 77 +++ ...-fix-an-error-code-in-smc_lgr_create.patch | 38 ++ ...enable-mac_managed_pm-phylink-config.patch | 36 ++ ...les-relax-nfta_set_elem_key_end-set-.patch | 44 ++ ...ter-fib-populate-flowic_l3mdev-field.patch | 106 +++++ ...er-fib-set-flowic_uid-correctly-for-.patch | 90 ++++ ...stently-ignore-errors-from-nvme_hwmo.patch | 85 ++++ ...on-kmalloc-the-nvme-smart-log-buffer.patch | 144 ++++++ ...ueue-mem_reclaim-flushing-dependency.patch | 46 ++ ...t2c-make-automaton-definition-static.patch | 42 ++ ...-fix-memory-leak-in-lpfc_create_port.patch | 67 +++ queue-6.0/series | 66 +++ ...c-via-pf-as-first-preference-if-avai.patch | 128 +++++ ...ort_id-in-filter-spec-hash-and-equal.patch | 72 +++ ...sg-pass-gfp-argument-to-alloc_sk_msg.patch | 108 +++++ ...rmation-leak-in-tipc_topsrv_kern_sub.patch | 87 ++++ ...tipc-fix-recognition-of-trial-period.patch | 39 ++ ...re-the-tcp-skbs-do-not-have-overlapp.patch | 99 ++++ ...reuse-has_conns-under-reuseport_lock.patch | 193 ++++++++ ...sume-quirk-for-nvidia-jetson-devices.patch | 54 +++ ...-introduce-mt76_connac_reg_map-struc.patch | 449 ++++++++++++++++++ ...-mt7921e-fix-random-fw-download-fail.patch | 81 ++++ ...ossible-memory-leak-in-wwan_hwsim_de.patch | 53 +++ 67 files changed, 6551 insertions(+) create mode 100644 queue-6.0/acpi-extlog-handle-multiple-records.patch create mode 100644 queue-6.0/blk-mq-fix-null-pointer-dereference-in-blk_mq_clear_.patch create mode 100644 queue-6.0/bnxt_en-fix-memory-leak-in-bnxt_nvm_test.patch create mode 100644 queue-6.0/btrfs-fix-processing-of-delayed-data-refs-during-bac.patch create mode 100644 queue-6.0/btrfs-fix-processing-of-delayed-tree-block-refs-duri.patch create mode 100644 queue-6.0/cifs-fix-memory-leak-when-build-ntlmssp-negotiate-bl.patch create mode 100644 queue-6.0/cifs-fix-xid-leak-in-cifs_copy_file_range.patch create mode 100644 queue-6.0/cifs-fix-xid-leak-in-cifs_create.patch create mode 100644 queue-6.0/cifs-fix-xid-leak-in-cifs_flock.patch create mode 100644 queue-6.0/cifs-fix-xid-leak-in-cifs_ses_add_channel.patch create mode 100644 queue-6.0/dm-remove-unnecessary-assignment-statement-in-alloc_.patch create mode 100644 queue-6.0/drbd-only-clone-bio-if-we-have-a-backing-device.patch create mode 100644 queue-6.0/drm-amd-display-increase-frame-size-limit-for-displa.patch create mode 100644 queue-6.0/drm-vc4-add-module-dependency-on-hdmi-codec.patch create mode 100644 queue-6.0/drm-vc4-hdmi-enforce-the-minimum-rate-at-runtime_res.patch create mode 100644 queue-6.0/erofs-shouldn-t-churn-the-mapping-page-for-duplicate.patch create mode 100644 queue-6.0/ext4-factor-out-ext4_fc_get_tl.patch create mode 100644 queue-6.0/ext4-fix-potential-out-of-bound-read-in-ext4_fc_repl.patch create mode 100644 queue-6.0/ext4-introduce-ext4_fc_tag_base_len-helper.patch create mode 100644 queue-6.0/hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch create mode 100644 queue-6.0/i40e-fix-dma-mappings-leak.patch create mode 100644 queue-6.0/io_uring-don-t-gate-task_work-run-on-tif_notify_sign.patch create mode 100644 queue-6.0/io_uring-msg_ring-fix-null-pointer-dereference-in-io.patch create mode 100644 queue-6.0/io_uring-rw-remove-leftover-debug-statement.patch create mode 100644 queue-6.0/iommu-vt-d-allow-nvs-regions-in-arch_rmrr_sanity_che.patch create mode 100644 queue-6.0/iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch create mode 100644 queue-6.0/ionic-catch-null-pointer-issue-on-reconfig.patch create mode 100644 queue-6.0/ip6mr-fix-uaf-issue-in-ip6mr_sk_done-when-addrconf_i.patch create mode 100644 queue-6.0/kernfs-fix-use-after-free-in-__kernfs_remove.patch create mode 100644 queue-6.0/net-atm-fix-proc_mpc_write-incorrect-return-value.patch create mode 100644 queue-6.0/net-dsa-qca8k-fix-ethtool-autocast-mib-for-big-endia.patch create mode 100644 queue-6.0/net-dsa-qca8k-fix-inband-mgmt-for-big-endian-systems.patch create mode 100644 queue-6.0/net-ethernet-mtk_eth_soc-fix-possible-memory-leak-in.patch create mode 100644 queue-6.0/net-ethernet-mtk_eth_wed-add-missing-of_node_put.patch create mode 100644 queue-6.0/net-ethernet-mtk_eth_wed-add-missing-put_device-in-m.patch create mode 100644 queue-6.0/net-fix-return-value-of-qdisc-ingress-handling-on-su.patch create mode 100644 queue-6.0/net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch create mode 100644 queue-6.0/net-hsr-avoid-possible-null-deref-in-skb_clone.patch create mode 100644 queue-6.0/net-phy-dp83822-disable-mdi-crossover-status-change-.patch create mode 100644 queue-6.0/net-phy-dp83867-extend-rx-strap-quirk-for-sgmii-mode.patch create mode 100644 queue-6.0/net-phylink-add-mac_managed_pm-in-phylink_config-str.patch create mode 100644 queue-6.0/net-sched-cake-fix-null-pointer-access-issue-when-ca.patch create mode 100644 queue-6.0/net-sched-delete-duplicate-cleanup-of-backlog-and-ql.patch create mode 100644 queue-6.0/net-sched-fix-race-condition-in-qdisc_graft.patch create mode 100644 queue-6.0/net-sched-sfb-fix-null-pointer-access-issue-when-sfb.patch create mode 100644 queue-6.0/net-smc-fix-an-error-code-in-smc_lgr_create.patch create mode 100644 queue-6.0/net-stmmac-enable-mac_managed_pm-phylink-config.patch create mode 100644 queue-6.0/netfilter-nf_tables-relax-nfta_set_elem_key_end-set-.patch create mode 100644 queue-6.0/netfilter-rpfilter-fib-populate-flowic_l3mdev-field.patch create mode 100644 queue-6.0/netfilter-rpfilter-fib-set-flowic_uid-correctly-for-.patch create mode 100644 queue-6.0/nvme-hwmon-consistently-ignore-errors-from-nvme_hwmo.patch create mode 100644 queue-6.0/nvme-hwmon-kmalloc-the-nvme-smart-log-buffer.patch create mode 100644 queue-6.0/nvmet-fix-workqueue-mem_reclaim-flushing-dependency.patch create mode 100644 queue-6.0/rv-dot2c-make-automaton-definition-static.patch create mode 100644 queue-6.0/scsi-lpfc-fix-memory-leak-in-lpfc_create_port.patch create mode 100644 queue-6.0/sfc-change-vf-mac-via-pf-as-first-preference-if-avai.patch create mode 100644 queue-6.0/sfc-include-vport_id-in-filter-spec-hash-and-equal.patch create mode 100644 queue-6.0/skmsg-pass-gfp-argument-to-alloc_sk_msg.patch create mode 100644 queue-6.0/tipc-fix-an-information-leak-in-tipc_topsrv_kern_sub.patch create mode 100644 queue-6.0/tipc-fix-recognition-of-trial-period.patch create mode 100644 queue-6.0/tls-strp-make-sure-the-tcp-skbs-do-not-have-overlapp.patch create mode 100644 queue-6.0/udp-update-reuse-has_conns-under-reuseport_lock.patch create mode 100644 queue-6.0/usb-add-reset_resume-quirk-for-nvidia-jetson-devices.patch create mode 100644 queue-6.0/wifi-mt76-connac-introduce-mt76_connac_reg_map-struc.patch create mode 100644 queue-6.0/wifi-mt76-mt7921e-fix-random-fw-download-fail.patch create mode 100644 queue-6.0/wwan_hwsim-fix-possible-memory-leak-in-wwan_hwsim_de.patch diff --git a/queue-6.0/acpi-extlog-handle-multiple-records.patch b/queue-6.0/acpi-extlog-handle-multiple-records.patch new file mode 100644 index 00000000000..c7240591e45 --- /dev/null +++ b/queue-6.0/acpi-extlog-handle-multiple-records.patch @@ -0,0 +1,93 @@ +From c4373033ee661bd7fb467759a9735045be2f5460 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 13:34:23 -0700 +Subject: ACPI: extlog: Handle multiple records + +From: Tony Luck + +[ Upstream commit f6ec01da40e4139b41179f046044ee7c4f6370dc ] + +If there is no user space consumer of extlog_mem trace records, then +Linux properly handles multiple error records in an ELOG block + + extlog_print() + print_extlog_rcd() + __print_extlog_rcd() + cper_estatus_print() + apei_estatus_for_each_section() + +But the other code path hard codes looking for a single record to +output a trace record. + +Fix by using the same apei_estatus_for_each_section() iterator +to step over all records. + +Fixes: 2dfb7d51a61d ("trace, RAS: Add eMCA trace event interface") +Signed-off-by: Tony Luck +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Sasha Levin +--- + drivers/acpi/acpi_extlog.c | 33 ++++++++++++++++++++------------- + 1 file changed, 20 insertions(+), 13 deletions(-) + +diff --git a/drivers/acpi/acpi_extlog.c b/drivers/acpi/acpi_extlog.c +index 72f1fb77abcd..e648158368a7 100644 +--- a/drivers/acpi/acpi_extlog.c ++++ b/drivers/acpi/acpi_extlog.c +@@ -12,6 +12,7 @@ + #include + #include + #include ++#include + #include + #include + +@@ -138,8 +139,8 @@ static int extlog_print(struct notifier_block *nb, unsigned long val, + int cpu = mce->extcpu; + struct acpi_hest_generic_status *estatus, *tmp; + struct acpi_hest_generic_data *gdata; +- const guid_t *fru_id = &guid_null; +- char *fru_text = ""; ++ const guid_t *fru_id; ++ char *fru_text; + guid_t *sec_type; + static u32 err_seq; + +@@ -160,17 +161,23 @@ static int extlog_print(struct notifier_block *nb, unsigned long val, + + /* log event via trace */ + err_seq++; +- gdata = (struct acpi_hest_generic_data *)(tmp + 1); +- if (gdata->validation_bits & CPER_SEC_VALID_FRU_ID) +- fru_id = (guid_t *)gdata->fru_id; +- if (gdata->validation_bits & CPER_SEC_VALID_FRU_TEXT) +- fru_text = gdata->fru_text; +- sec_type = (guid_t *)gdata->section_type; +- if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) { +- struct cper_sec_mem_err *mem = (void *)(gdata + 1); +- if (gdata->error_data_length >= sizeof(*mem)) +- trace_extlog_mem_event(mem, err_seq, fru_id, fru_text, +- (u8)gdata->error_severity); ++ apei_estatus_for_each_section(tmp, gdata) { ++ if (gdata->validation_bits & CPER_SEC_VALID_FRU_ID) ++ fru_id = (guid_t *)gdata->fru_id; ++ else ++ fru_id = &guid_null; ++ if (gdata->validation_bits & CPER_SEC_VALID_FRU_TEXT) ++ fru_text = gdata->fru_text; ++ else ++ fru_text = ""; ++ sec_type = (guid_t *)gdata->section_type; ++ if (guid_equal(sec_type, &CPER_SEC_PLATFORM_MEM)) { ++ struct cper_sec_mem_err *mem = (void *)(gdata + 1); ++ ++ if (gdata->error_data_length >= sizeof(*mem)) ++ trace_extlog_mem_event(mem, err_seq, fru_id, fru_text, ++ (u8)gdata->error_severity); ++ } + } + + out: +-- +2.35.1 + diff --git a/queue-6.0/blk-mq-fix-null-pointer-dereference-in-blk_mq_clear_.patch b/queue-6.0/blk-mq-fix-null-pointer-dereference-in-blk_mq_clear_.patch new file mode 100644 index 00000000000..846aec7f941 --- /dev/null +++ b/queue-6.0/blk-mq-fix-null-pointer-dereference-in-blk_mq_clear_.patch @@ -0,0 +1,68 @@ +From 9225e1c36291de514ada76fb6088cfc4cd6b8846 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Oct 2022 22:22:53 +0800 +Subject: blk-mq: fix null pointer dereference in blk_mq_clear_rq_mapping() + +From: Yu Kuai + +[ Upstream commit 76dd298094f484c6250ebd076fa53287477b2328 ] + +Our syzkaller report a null pointer dereference, root cause is +following: + +__blk_mq_alloc_map_and_rqs + set->tags[hctx_idx] = blk_mq_alloc_map_and_rqs + blk_mq_alloc_map_and_rqs + blk_mq_alloc_rqs + // failed due to oom + alloc_pages_node + // set->tags[hctx_idx] is still NULL + blk_mq_free_rqs + drv_tags = set->tags[hctx_idx]; + // null pointer dereference is triggered + blk_mq_clear_rq_mapping(drv_tags, ...) + +This is because commit 63064be150e4 ("blk-mq: +Add blk_mq_alloc_map_and_rqs()") merged the two steps: + +1) set->tags[hctx_idx] = blk_mq_alloc_rq_map() +2) blk_mq_alloc_rqs(..., set->tags[hctx_idx]) + +into one step: + +set->tags[hctx_idx] = blk_mq_alloc_map_and_rqs() + +Since tags is not initialized yet in this case, fix the problem by +checking if tags is NULL pointer in blk_mq_clear_rq_mapping(). + +Fixes: 63064be150e4 ("blk-mq: Add blk_mq_alloc_map_and_rqs()") +Signed-off-by: Yu Kuai +Reviewed-by: John Garry +Link: https://lore.kernel.org/r/20221011142253.4015966-1-yukuai1@huaweicloud.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + block/blk-mq.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/block/blk-mq.c b/block/blk-mq.c +index 887b8682eb69..fe840536e6ac 100644 +--- a/block/blk-mq.c ++++ b/block/blk-mq.c +@@ -3028,8 +3028,11 @@ static void blk_mq_clear_rq_mapping(struct blk_mq_tags *drv_tags, + struct page *page; + unsigned long flags; + +- /* There is no need to clear a driver tags own mapping */ +- if (drv_tags == tags) ++ /* ++ * There is no need to clear mapping if driver tags is not initialized ++ * or the mapping belongs to the driver tags. ++ */ ++ if (!drv_tags || drv_tags == tags) + return; + + list_for_each_entry(page, &tags->page_list, lru) { +-- +2.35.1 + diff --git a/queue-6.0/bnxt_en-fix-memory-leak-in-bnxt_nvm_test.patch b/queue-6.0/bnxt_en-fix-memory-leak-in-bnxt_nvm_test.patch new file mode 100644 index 00000000000..2e181257265 --- /dev/null +++ b/queue-6.0/bnxt_en-fix-memory-leak-in-bnxt_nvm_test.patch @@ -0,0 +1,62 @@ +From eb629744ceab560f80502ff50ac28ac607543d5d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 11:32:22 -0400 +Subject: bnxt_en: fix memory leak in bnxt_nvm_test() + +From: Vikas Gupta + +[ Upstream commit ba077d683d45190afc993c1ce45bcdbfda741a40 ] + +Free the kzalloc'ed buffer before returning in the success path. + +Fixes: 5b6ff128fdf6 ("bnxt_en: implement callbacks for devlink selftests") +Signed-off-by: Vikas Gupta +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/1666020742-25834-1-git-send-email-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c | 11 ++++++----- + 1 file changed, 6 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index a36803e79e92..8a6f788f6294 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -613,6 +613,7 @@ static int bnxt_dl_reload_up(struct devlink *dl, enum devlink_reload_action acti + + static bool bnxt_nvm_test(struct bnxt *bp, struct netlink_ext_ack *extack) + { ++ bool rc = false; + u32 datalen; + u16 index; + u8 *buf; +@@ -632,20 +633,20 @@ static bool bnxt_nvm_test(struct bnxt *bp, struct netlink_ext_ack *extack) + + if (bnxt_get_nvram_item(bp->dev, index, 0, datalen, buf)) { + NL_SET_ERR_MSG_MOD(extack, "nvm test vpd read error"); +- goto err; ++ goto done; + } + + if (bnxt_flash_nvram(bp->dev, BNX_DIR_TYPE_VPD, BNX_DIR_ORDINAL_FIRST, + BNX_DIR_EXT_NONE, 0, 0, buf, datalen)) { + NL_SET_ERR_MSG_MOD(extack, "nvm test vpd write error"); +- goto err; ++ goto done; + } + +- return true; ++ rc = true; + +-err: ++done: + kfree(buf); +- return false; ++ return rc; + } + + static bool bnxt_dl_selftest_check(struct devlink *dl, unsigned int id, +-- +2.35.1 + diff --git a/queue-6.0/btrfs-fix-processing-of-delayed-data-refs-during-bac.patch b/queue-6.0/btrfs-fix-processing-of-delayed-data-refs-during-bac.patch new file mode 100644 index 00000000000..66935531a72 --- /dev/null +++ b/queue-6.0/btrfs-fix-processing-of-delayed-data-refs-during-bac.patch @@ -0,0 +1,249 @@ +From 47c38eb3a5e5c61b871145973bb2de816dcba806 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Oct 2022 13:16:51 +0100 +Subject: btrfs: fix processing of delayed data refs during backref walking + +From: Filipe Manana + +[ Upstream commit 4fc7b57228243d09c0d878873bf24fa64a90fa01 ] + +When processing delayed data references during backref walking and we are +using a share context (we are being called through fiemap), whenever we +find a delayed data reference for an inode different from the one we are +interested in, then we immediately exit and consider the data extent as +shared. This is wrong, because: + +1) This might be a DROP reference that will cancel out a reference in the + extent tree; + +2) Even if it's an ADD reference, it may be followed by a DROP reference + that cancels it out. + +In either case we should not exit immediately. + +Fix this by never exiting when we find a delayed data reference for +another inode - instead add the reference and if it does not cancel out +other delayed reference, we will exit early when we call +extent_is_shared() after processing all delayed references. If we find +a drop reference, then signal the code that processes references from +the extent tree (add_inline_refs() and add_keyed_refs()) to not exit +immediately if it finds there a reference for another inode, since we +have delayed drop references that may cancel it out. In this later case +we exit once we don't have references in the rb trees that cancel out +each other and have two references for different inodes. + +Example reproducer for case 1): + + $ cat test-1.sh + #!/bin/bash + + DEV=/dev/sdj + MNT=/mnt/sdj + + mkfs.btrfs -f $DEV + mount $DEV $MNT + + xfs_io -f -c "pwrite 0 64K" $MNT/foo + cp --reflink=always $MNT/foo $MNT/bar + + echo + echo "fiemap after cloning:" + xfs_io -c "fiemap -v" $MNT/foo + + rm -f $MNT/bar + echo + echo "fiemap after removing file bar:" + xfs_io -c "fiemap -v" $MNT/foo + + umount $MNT + +Running it before this patch, the extent is still listed as shared, it has +the flag 0x2000 (FIEMAP_EXTENT_SHARED) set: + + $ ./test-1.sh + fiemap after cloning: + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [0..127]: 26624..26751 128 0x2001 + + fiemap after removing file bar: + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [0..127]: 26624..26751 128 0x2001 + +Example reproducer for case 2): + + $ cat test-2.sh + #!/bin/bash + + DEV=/dev/sdj + MNT=/mnt/sdj + + mkfs.btrfs -f $DEV + mount $DEV $MNT + + xfs_io -f -c "pwrite 0 64K" $MNT/foo + cp --reflink=always $MNT/foo $MNT/bar + + # Flush delayed references to the extent tree and commit current + # transaction. + sync + + echo + echo "fiemap after cloning:" + xfs_io -c "fiemap -v" $MNT/foo + + rm -f $MNT/bar + echo + echo "fiemap after removing file bar:" + xfs_io -c "fiemap -v" $MNT/foo + + umount $MNT + +Running it before this patch, the extent is still listed as shared, it has +the flag 0x2000 (FIEMAP_EXTENT_SHARED) set: + + $ ./test-2.sh + fiemap after cloning: + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [0..127]: 26624..26751 128 0x2001 + + fiemap after removing file bar: + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [0..127]: 26624..26751 128 0x2001 + +After this patch, after deleting bar in both tests, the extent is not +reported with the 0x2000 flag anymore, it gets only the flag 0x1 +(which is FIEMAP_EXTENT_LAST): + + $ ./test-1.sh + fiemap after cloning: + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [0..127]: 26624..26751 128 0x2001 + + fiemap after removing file bar: + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [0..127]: 26624..26751 128 0x1 + + $ ./test-2.sh + fiemap after cloning: + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [0..127]: 26624..26751 128 0x2001 + + fiemap after removing file bar: + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [0..127]: 26624..26751 128 0x1 + +These tests will later be converted to a test case for fstests. + +Fixes: dc046b10c8b7d4 ("Btrfs: make fiemap not blow when you have lots of snapshots") +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/backref.c | 33 ++++++++++++++++++++++++--------- + 1 file changed, 24 insertions(+), 9 deletions(-) + +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index d385357e19b6..2aa9f58f4436 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -138,6 +138,7 @@ struct share_check { + u64 root_objectid; + u64 inum; + int share_count; ++ bool have_delayed_delete_refs; + }; + + static inline int extent_is_shared(struct share_check *sc) +@@ -884,13 +885,22 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info, + key.offset = ref->offset; + + /* +- * Found a inum that doesn't match our known inum, we +- * know it's shared. ++ * If we have a share check context and a reference for ++ * another inode, we can't exit immediately. This is ++ * because even if this is a BTRFS_ADD_DELAYED_REF ++ * reference we may find next a BTRFS_DROP_DELAYED_REF ++ * which cancels out this ADD reference. ++ * ++ * If this is a DROP reference and there was no previous ++ * ADD reference, then we need to signal that when we ++ * process references from the extent tree (through ++ * add_inline_refs() and add_keyed_refs()), we should ++ * not exit early if we find a reference for another ++ * inode, because one of the delayed DROP references ++ * may cancel that reference in the extent tree. + */ +- if (sc && sc->inum && ref->objectid != sc->inum) { +- ret = BACKREF_FOUND_SHARED; +- goto out; +- } ++ if (sc && count < 0) ++ sc->have_delayed_delete_refs = true; + + ret = add_indirect_ref(fs_info, preftrees, ref->root, + &key, 0, node->bytenr, count, sc, +@@ -920,7 +930,7 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info, + } + if (!ret) + ret = extent_is_shared(sc); +-out: ++ + spin_unlock(&head->lock); + return ret; + } +@@ -1023,7 +1033,8 @@ static int add_inline_refs(const struct btrfs_fs_info *fs_info, + key.type = BTRFS_EXTENT_DATA_KEY; + key.offset = btrfs_extent_data_ref_offset(leaf, dref); + +- if (sc && sc->inum && key.objectid != sc->inum) { ++ if (sc && sc->inum && key.objectid != sc->inum && ++ !sc->have_delayed_delete_refs) { + ret = BACKREF_FOUND_SHARED; + break; + } +@@ -1033,6 +1044,7 @@ static int add_inline_refs(const struct btrfs_fs_info *fs_info, + ret = add_indirect_ref(fs_info, preftrees, root, + &key, 0, bytenr, count, + sc, GFP_NOFS); ++ + break; + } + default: +@@ -1122,7 +1134,8 @@ static int add_keyed_refs(struct btrfs_root *extent_root, + key.type = BTRFS_EXTENT_DATA_KEY; + key.offset = btrfs_extent_data_ref_offset(leaf, dref); + +- if (sc && sc->inum && key.objectid != sc->inum) { ++ if (sc && sc->inum && key.objectid != sc->inum && ++ !sc->have_delayed_delete_refs) { + ret = BACKREF_FOUND_SHARED; + break; + } +@@ -1544,6 +1557,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr, + .root_objectid = root->root_key.objectid, + .inum = inum, + .share_count = 0, ++ .have_delayed_delete_refs = false, + }; + + ulist_init(roots); +@@ -1578,6 +1592,7 @@ int btrfs_check_shared(struct btrfs_root *root, u64 inum, u64 bytenr, + break; + bytenr = node->val; + shared.share_count = 0; ++ shared.have_delayed_delete_refs = false; + cond_resched(); + } + +-- +2.35.1 + diff --git a/queue-6.0/btrfs-fix-processing-of-delayed-tree-block-refs-duri.patch b/queue-6.0/btrfs-fix-processing-of-delayed-tree-block-refs-duri.patch new file mode 100644 index 00000000000..071e1e44bf6 --- /dev/null +++ b/queue-6.0/btrfs-fix-processing-of-delayed-tree-block-refs-duri.patch @@ -0,0 +1,204 @@ +From 4cab3584b28a6fa9a137253cc5502fa05f90b180 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Oct 2022 13:16:52 +0100 +Subject: btrfs: fix processing of delayed tree block refs during backref + walking + +From: Filipe Manana + +[ Upstream commit 943553ef9b51db303ab2b955c1025261abfdf6fb ] + +During backref walking, when processing a delayed reference with a type of +BTRFS_TREE_BLOCK_REF_KEY, we have two bugs there: + +1) We are accessing the delayed references extent_op, and its key, without + the protection of the delayed ref head's lock; + +2) If there's no extent op for the delayed ref head, we end up with an + uninitialized key in the stack, variable 'tmp_op_key', and then pass + it to add_indirect_ref(), which adds the reference to the indirect + refs rb tree. + + This is wrong, because indirect references should have a NULL key + when we don't have access to the key, and in that case they should be + added to the indirect_missing_keys rb tree and not to the indirect rb + tree. + + This means that if have BTRFS_TREE_BLOCK_REF_KEY delayed ref resulting + from freeing an extent buffer, therefore with a count of -1, it will + not cancel out the corresponding reference we have in the extent tree + (with a count of 1), since both references end up in different rb + trees. + + When using fiemap, where we often need to check if extents are shared + through shared subtrees resulting from snapshots, it means we can + incorrectly report an extent as shared when it's no longer shared. + However this is temporary because after the transaction is committed + the extent is no longer reported as shared, as running the delayed + reference results in deleting the tree block reference from the extent + tree. + + Outside the fiemap context, the result is unpredictable, as the key was + not initialized but it's used when navigating the rb trees to insert + and search for references (prelim_ref_compare()), and we expect all + references in the indirect rb tree to have valid keys. + +The following reproducer triggers the second bug: + + $ cat test.sh + #!/bin/bash + + DEV=/dev/sdj + MNT=/mnt/sdj + + mkfs.btrfs -f $DEV + mount -o compress $DEV $MNT + + # With a compressed 128M file we get a tree height of 2 (level 1 root). + xfs_io -f -c "pwrite -b 1M 0 128M" $MNT/foo + + btrfs subvolume snapshot $MNT $MNT/snap + + # Fiemap should output 0x2008 in the flags column. + # 0x2000 means shared extent + # 0x8 means encoded extent (because it's compressed) + echo + echo "fiemap after snapshot, range [120M, 120M + 128K):" + xfs_io -c "fiemap -v 120M 128K" $MNT/foo + echo + + # Overwrite one extent and fsync to flush delalloc and COW a new path + # in the snapshot's tree. + # + # After this we have a BTRFS_DROP_DELAYED_REF delayed ref of type + # BTRFS_TREE_BLOCK_REF_KEY with a count of -1 for every COWed extent + # buffer in the path. + # + # In the extent tree we have inline references of type + # BTRFS_TREE_BLOCK_REF_KEY, with a count of 1, for the same extent + # buffers, so they should cancel each other, and the extent buffers in + # the fs tree should no longer be considered as shared. + # + echo "Overwriting file range [120M, 120M + 128K)..." + xfs_io -c "pwrite -b 128K 120M 128K" $MNT/snap/foo + xfs_io -c "fsync" $MNT/snap/foo + + # Fiemap should output 0x8 in the flags column. The extent in the range + # [120M, 120M + 128K) is no longer shared, it's now exclusive to the fs + # tree. + echo + echo "fiemap after overwrite range [120M, 120M + 128K):" + xfs_io -c "fiemap -v 120M 128K" $MNT/foo + echo + + umount $MNT + +Running it before this patch: + + $ ./test.sh + (...) + wrote 134217728/134217728 bytes at offset 0 + 128 MiB, 128 ops; 0.1152 sec (1.085 GiB/sec and 1110.5809 ops/sec) + Create a snapshot of '/mnt/sdj' in '/mnt/sdj/snap' + + fiemap after snapshot, range [120M, 120M + 128K): + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [245760..246015]: 34304..34559 256 0x2008 + + Overwriting file range [120M, 120M + 128K)... + wrote 131072/131072 bytes at offset 125829120 + 128 KiB, 1 ops; 0.0001 sec (683.060 MiB/sec and 5464.4809 ops/sec) + + fiemap after overwrite range [120M, 120M + 128K): + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [245760..246015]: 34304..34559 256 0x2008 + +The extent in the range [120M, 120M + 128K) is still reported as shared +(0x2000 bit set) after overwriting that range and flushing delalloc, which +is not correct - an entire path was COWed in the snapshot's tree and the +extent is now only referenced by the original fs tree. + +Running it after this patch: + + $ ./test.sh + (...) + wrote 134217728/134217728 bytes at offset 0 + 128 MiB, 128 ops; 0.1198 sec (1.043 GiB/sec and 1068.2067 ops/sec) + Create a snapshot of '/mnt/sdj' in '/mnt/sdj/snap' + + fiemap after snapshot, range [120M, 120M + 128K): + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [245760..246015]: 34304..34559 256 0x2008 + + Overwriting file range [120M, 120M + 128K)... + wrote 131072/131072 bytes at offset 125829120 + 128 KiB, 1 ops; 0.0001 sec (694.444 MiB/sec and 5555.5556 ops/sec) + + fiemap after overwrite range [120M, 120M + 128K): + /mnt/sdj/foo: + EXT: FILE-OFFSET BLOCK-RANGE TOTAL FLAGS + 0: [245760..246015]: 34304..34559 256 0x8 + +Now the extent is not reported as shared anymore. + +So fix this by passing a NULL key pointer to add_indirect_ref() when +processing a delayed reference for a tree block if there's no extent op +for our delayed ref head with a defined key. Also access the extent op +only after locking the delayed ref head's lock. + +The reproducer will be converted later to a test case for fstests. + +Fixes: 86d5f994425252 ("btrfs: convert prelimary reference tracking to use rbtrees") +Fixes: a6dbceafb915e8 ("btrfs: Remove unused op_key var from add_delayed_refs") +Signed-off-by: Filipe Manana +Signed-off-by: David Sterba +Signed-off-by: Sasha Levin +--- + fs/btrfs/backref.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c +index 2aa9f58f4436..ccc818b40977 100644 +--- a/fs/btrfs/backref.c ++++ b/fs/btrfs/backref.c +@@ -821,16 +821,11 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info, + struct preftrees *preftrees, struct share_check *sc) + { + struct btrfs_delayed_ref_node *node; +- struct btrfs_delayed_extent_op *extent_op = head->extent_op; + struct btrfs_key key; +- struct btrfs_key tmp_op_key; + struct rb_node *n; + int count; + int ret = 0; + +- if (extent_op && extent_op->update_key) +- btrfs_disk_key_to_cpu(&tmp_op_key, &extent_op->key); +- + spin_lock(&head->lock); + for (n = rb_first_cached(&head->ref_tree); n; n = rb_next(n)) { + node = rb_entry(n, struct btrfs_delayed_ref_node, +@@ -856,10 +851,16 @@ static int add_delayed_refs(const struct btrfs_fs_info *fs_info, + case BTRFS_TREE_BLOCK_REF_KEY: { + /* NORMAL INDIRECT METADATA backref */ + struct btrfs_delayed_tree_ref *ref; ++ struct btrfs_key *key_ptr = NULL; ++ ++ if (head->extent_op && head->extent_op->update_key) { ++ btrfs_disk_key_to_cpu(&key, &head->extent_op->key); ++ key_ptr = &key; ++ } + + ref = btrfs_delayed_node_to_tree_ref(node); + ret = add_indirect_ref(fs_info, preftrees, ref->root, +- &tmp_op_key, ref->level + 1, ++ key_ptr, ref->level + 1, + node->bytenr, count, sc, + GFP_ATOMIC); + break; +-- +2.35.1 + diff --git a/queue-6.0/cifs-fix-memory-leak-when-build-ntlmssp-negotiate-bl.patch b/queue-6.0/cifs-fix-memory-leak-when-build-ntlmssp-negotiate-bl.patch new file mode 100644 index 00000000000..991e387407b --- /dev/null +++ b/queue-6.0/cifs-fix-memory-leak-when-build-ntlmssp-negotiate-bl.patch @@ -0,0 +1,62 @@ +From ff43a2bf9a80be07f9135e4769a6e5360228ffa0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 11:49:16 +0800 +Subject: cifs: Fix memory leak when build ntlmssp negotiate blob failed + +From: Zhang Xiaoxu + +[ Upstream commit 30b2d7f8f13664655480d6af45f60270b3eb6736 ] + +There is a memory leak when mount cifs: + unreferenced object 0xffff888166059600 (size 448): + comm "mount.cifs", pid 51391, jiffies 4295596373 (age 330.596s) + hex dump (first 32 bytes): + fe 53 4d 42 40 00 00 00 00 00 00 00 01 00 82 00 .SMB@........... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<0000000060609a61>] mempool_alloc+0xe1/0x260 + [<00000000adfa6c63>] cifs_small_buf_get+0x24/0x60 + [<00000000ebb404c7>] __smb2_plain_req_init+0x32/0x460 + [<00000000bcf875b4>] SMB2_sess_alloc_buffer+0xa4/0x3f0 + [<00000000753a2987>] SMB2_sess_auth_rawntlmssp_negotiate+0xf5/0x480 + [<00000000f0c1f4f9>] SMB2_sess_setup+0x253/0x410 + [<00000000a8b83303>] cifs_setup_session+0x18f/0x4c0 + [<00000000854bd16d>] cifs_get_smb_ses+0xae7/0x13c0 + [<000000006cbc43d9>] mount_get_conns+0x7a/0x730 + [<000000005922d816>] cifs_mount+0x103/0xd10 + [<00000000e33def3b>] cifs_smb3_do_mount+0x1dd/0xc90 + [<0000000078034979>] smb3_get_tree+0x1d5/0x300 + [<000000004371f980>] vfs_get_tree+0x41/0xf0 + [<00000000b670d8a7>] path_mount+0x9b3/0xdd0 + [<000000005e839a7d>] __x64_sys_mount+0x190/0x1d0 + [<000000009404c3b9>] do_syscall_64+0x35/0x80 + +When build ntlmssp negotiate blob failed, the session setup request +should be freed. + +Fixes: 49bd49f983b5 ("cifs: send workstation name during ntlmssp session setup") +Reviewed-by: Paulo Alcantara (SUSE) +Reviewed-by: Shyam Prasad N +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/smb2pdu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index 5016d742576d..92a1d0695ebd 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -1526,7 +1526,7 @@ SMB2_sess_auth_rawntlmssp_negotiate(struct SMB2_sess_data *sess_data) + &blob_length, ses, server, + sess_data->nls_cp); + if (rc) +- goto out_err; ++ goto out; + + if (use_spnego) { + /* BB eventually need to add this */ +-- +2.35.1 + diff --git a/queue-6.0/cifs-fix-xid-leak-in-cifs_copy_file_range.patch b/queue-6.0/cifs-fix-xid-leak-in-cifs_copy_file_range.patch new file mode 100644 index 00000000000..c3c7989f9c1 --- /dev/null +++ b/queue-6.0/cifs-fix-xid-leak-in-cifs_copy_file_range.patch @@ -0,0 +1,42 @@ +From 3b9c8ada85c0ed0de05accfb5526810226dc6b8a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 22:45:22 +0800 +Subject: cifs: Fix xid leak in cifs_copy_file_range() + +From: Zhang Xiaoxu + +[ Upstream commit 9a97df404a402fe1174d2d1119f87ff2a0ca2fe9 ] + +If the file is used by swap, before return -EOPNOTSUPP, should +free the xid, otherwise, the xid will be leaked. + +Fixes: 4e8aea30f775 ("smb3: enable swap on SMB3 mounts") +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/cifsfs.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 8042d7280dec..6bc8be9ed2a5 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -1297,8 +1297,11 @@ static ssize_t cifs_copy_file_range(struct file *src_file, loff_t off, + ssize_t rc; + struct cifsFileInfo *cfile = dst_file->private_data; + +- if (cfile->swapfile) +- return -EOPNOTSUPP; ++ if (cfile->swapfile) { ++ rc = -EOPNOTSUPP; ++ free_xid(xid); ++ return rc; ++ } + + rc = cifs_file_copychunk_range(xid, src_file, off, dst_file, destoff, + len, flags); +-- +2.35.1 + diff --git a/queue-6.0/cifs-fix-xid-leak-in-cifs_create.patch b/queue-6.0/cifs-fix-xid-leak-in-cifs_create.patch new file mode 100644 index 00000000000..ed2690cd961 --- /dev/null +++ b/queue-6.0/cifs-fix-xid-leak-in-cifs_create.patch @@ -0,0 +1,41 @@ +From 0f738e0748343276c2092758cc918b2d8d9ebc41 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 22:45:21 +0800 +Subject: cifs: Fix xid leak in cifs_create() + +From: Zhang Xiaoxu + +[ Upstream commit fee0fb1f15054bb6a0ede452acb42da5bef4d587 ] + +If the cifs already shutdown, we should free the xid before return, +otherwise, the xid will be leaked. + +Fixes: 087f757b0129 ("cifs: add shutdown support") +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/dir.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index 08f7392716e2..05c78a18ade0 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -551,8 +551,10 @@ int cifs_create(struct user_namespace *mnt_userns, struct inode *inode, + cifs_dbg(FYI, "cifs_create parent inode = 0x%p name is: %pd and dentry = 0x%p\n", + inode, direntry, direntry); + +- if (unlikely(cifs_forced_shutdown(CIFS_SB(inode->i_sb)))) +- return -EIO; ++ if (unlikely(cifs_forced_shutdown(CIFS_SB(inode->i_sb)))) { ++ rc = -EIO; ++ goto out_free_xid; ++ } + + tlink = cifs_sb_tlink(CIFS_SB(inode->i_sb)); + rc = PTR_ERR(tlink); +-- +2.35.1 + diff --git a/queue-6.0/cifs-fix-xid-leak-in-cifs_flock.patch b/queue-6.0/cifs-fix-xid-leak-in-cifs_flock.patch new file mode 100644 index 00000000000..19d4663c3c7 --- /dev/null +++ b/queue-6.0/cifs-fix-xid-leak-in-cifs_flock.patch @@ -0,0 +1,56 @@ +From ce68af4ea4503827572cc89d7ff5f0428c3c03ef Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 22:45:23 +0800 +Subject: cifs: Fix xid leak in cifs_flock() + +From: Zhang Xiaoxu + +[ Upstream commit 575e079c782b9862ec2626403922d041a42e6ed6 ] + +If not flock, before return -ENOLCK, should free the xid, +otherwise, the xid will be leaked. + +Fixes: d0677992d2af ("cifs: add support for flock") +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/file.c | 11 +++++++---- + 1 file changed, 7 insertions(+), 4 deletions(-) + +diff --git a/fs/cifs/file.c b/fs/cifs/file.c +index 7d756721e1a6..5c045dd69784 100644 +--- a/fs/cifs/file.c ++++ b/fs/cifs/file.c +@@ -1882,11 +1882,13 @@ int cifs_flock(struct file *file, int cmd, struct file_lock *fl) + struct cifsFileInfo *cfile; + __u32 type; + +- rc = -EACCES; + xid = get_xid(); + +- if (!(fl->fl_flags & FL_FLOCK)) +- return -ENOLCK; ++ if (!(fl->fl_flags & FL_FLOCK)) { ++ rc = -ENOLCK; ++ free_xid(xid); ++ return rc; ++ } + + cfile = (struct cifsFileInfo *)file->private_data; + tcon = tlink_tcon(cfile->tlink); +@@ -1905,8 +1907,9 @@ int cifs_flock(struct file *file, int cmd, struct file_lock *fl) + * if no lock or unlock then nothing to do since we do not + * know what it is + */ ++ rc = -EOPNOTSUPP; + free_xid(xid); +- return -EOPNOTSUPP; ++ return rc; + } + + rc = cifs_setlk(file, fl, type, wait_flag, posix_lck, lock, unlock, +-- +2.35.1 + diff --git a/queue-6.0/cifs-fix-xid-leak-in-cifs_ses_add_channel.patch b/queue-6.0/cifs-fix-xid-leak-in-cifs_ses_add_channel.patch new file mode 100644 index 00000000000..ee4498222dc --- /dev/null +++ b/queue-6.0/cifs-fix-xid-leak-in-cifs_ses_add_channel.patch @@ -0,0 +1,36 @@ +From fa8672285c43e8111445a0a53bf0e3908bf968be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 22:45:24 +0800 +Subject: cifs: Fix xid leak in cifs_ses_add_channel() + +From: Zhang Xiaoxu + +[ Upstream commit e909d054bdea75ef1ec48c18c5936affdaecbb2c ] + +Before return, should free the xid, otherwise, the +xid will be leaked. + +Fixes: d70e9fa55884 ("cifs: try opening channels after mounting") +Reviewed-by: Paulo Alcantara (SUSE) +Signed-off-by: Zhang Xiaoxu +Signed-off-by: Steve French +Signed-off-by: Sasha Levin +--- + fs/cifs/sess.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index 3af3b05b6c74..11cd06aa74f0 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -496,6 +496,7 @@ cifs_ses_add_channel(struct cifs_sb_info *cifs_sb, struct cifs_ses *ses, + cifs_put_tcp_session(chan->server, 0); + } + ++ free_xid(xid); + return rc; + } + +-- +2.35.1 + diff --git a/queue-6.0/dm-remove-unnecessary-assignment-statement-in-alloc_.patch b/queue-6.0/dm-remove-unnecessary-assignment-statement-in-alloc_.patch new file mode 100644 index 00000000000..56f095f431f --- /dev/null +++ b/queue-6.0/dm-remove-unnecessary-assignment-statement-in-alloc_.patch @@ -0,0 +1,32 @@ +From 2394d36dd4d89dff7510443876e611eb9b97a2bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 16:20:36 +0800 +Subject: dm: remove unnecessary assignment statement in alloc_dev() + +From: Genjian Zhang + +[ Upstream commit 99f4f5bcb975527508eb7a5e3e34bdb91d576746 ] + +Fixes: 74fe6ba923949 ("dm: convert to blk_alloc_disk/blk_cleanup_disk") +Signed-off-by: Genjian Zhang +Signed-off-by: Mike Snitzer +Signed-off-by: Sasha Levin +--- + drivers/md/dm.c | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/drivers/md/dm.c b/drivers/md/dm.c +index 60549b65c799..b4a2cb5333fc 100644 +--- a/drivers/md/dm.c ++++ b/drivers/md/dm.c +@@ -2065,7 +2065,6 @@ static struct mapped_device *alloc_dev(int minor) + md->disk->minors = 1; + md->disk->flags |= GENHD_FL_NO_PART; + md->disk->fops = &dm_blk_dops; +- md->disk->queue = md->queue; + md->disk->private_data = md; + sprintf(md->disk->disk_name, "dm-%d", minor); + +-- +2.35.1 + diff --git a/queue-6.0/drbd-only-clone-bio-if-we-have-a-backing-device.patch b/queue-6.0/drbd-only-clone-bio-if-we-have-a-backing-device.patch new file mode 100644 index 00000000000..a79d1b3aee2 --- /dev/null +++ b/queue-6.0/drbd-only-clone-bio-if-we-have-a-backing-device.patch @@ -0,0 +1,72 @@ +From 452ec9983151098eef95611cc32453de24b4600b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Oct 2022 10:52:05 +0200 +Subject: drbd: only clone bio if we have a backing device +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Christoph Böhmwalder + +[ Upstream commit 6d42ddf7f27b6723549ee6d4c8b1b418b59bf6b5 ] + +Commit c347a787e34cb (drbd: set ->bi_bdev in drbd_req_new) moved a +bio_set_dev call (which has since been removed) to "earlier", from +drbd_request_prepare to drbd_req_new. + +The problem is that this accesses device->ldev->backing_bdev, which is +not NULL-checked at this point. When we don't have an ldev (i.e. when +the DRBD device is diskless), this leads to a null pointer deref. + +So, only allocate the private_bio if we actually have a disk. This is +also a small optimization, since we don't clone the bio to only to +immediately free it again in the diskless case. + +Fixes: c347a787e34cb ("drbd: set ->bi_bdev in drbd_req_new") +Co-developed-by: Christoph Böhmwalder +Signed-off-by: Christoph Böhmwalder +Co-developed-by: Joel Colledge +Signed-off-by: Joel Colledge +Reviewed-by: Christoph Hellwig +Link: https://lore.kernel.org/r/20221020085205.129090-1-christoph.boehmwalder@linbit.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + drivers/block/drbd/drbd_req.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/block/drbd/drbd_req.c b/drivers/block/drbd/drbd_req.c +index 8f7f144e54f3..7f9bcc82fc9c 100644 +--- a/drivers/block/drbd/drbd_req.c ++++ b/drivers/block/drbd/drbd_req.c +@@ -30,11 +30,6 @@ static struct drbd_request *drbd_req_new(struct drbd_device *device, struct bio + return NULL; + memset(req, 0, sizeof(*req)); + +- req->private_bio = bio_alloc_clone(device->ldev->backing_bdev, bio_src, +- GFP_NOIO, &drbd_io_bio_set); +- req->private_bio->bi_private = req; +- req->private_bio->bi_end_io = drbd_request_endio; +- + req->rq_state = (bio_data_dir(bio_src) == WRITE ? RQ_WRITE : 0) + | (bio_op(bio_src) == REQ_OP_WRITE_ZEROES ? RQ_ZEROES : 0) + | (bio_op(bio_src) == REQ_OP_DISCARD ? RQ_UNMAP : 0); +@@ -1219,9 +1214,12 @@ drbd_request_prepare(struct drbd_device *device, struct bio *bio) + /* Update disk stats */ + req->start_jif = bio_start_io_acct(req->master_bio); + +- if (!get_ldev(device)) { +- bio_put(req->private_bio); +- req->private_bio = NULL; ++ if (get_ldev(device)) { ++ req->private_bio = bio_alloc_clone(device->ldev->backing_bdev, ++ bio, GFP_NOIO, ++ &drbd_io_bio_set); ++ req->private_bio->bi_private = req; ++ req->private_bio->bi_end_io = drbd_request_endio; + } + + /* process discards always from our submitter thread */ +-- +2.35.1 + diff --git a/queue-6.0/drm-amd-display-increase-frame-size-limit-for-displa.patch b/queue-6.0/drm-amd-display-increase-frame-size-limit-for-displa.patch new file mode 100644 index 00000000000..0ed94f1ecf9 --- /dev/null +++ b/queue-6.0/drm-amd-display-increase-frame-size-limit-for-displa.patch @@ -0,0 +1,62 @@ +From 9f89e36c886224b49c9336de375ac07940178a37 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 11:25:23 -0700 +Subject: drm/amd/display: Increase frame size limit for + display_mode_vba_util_32.o +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Guenter Roeck + +[ Upstream commit 8a70b2d89ea3f2dc1449f0634ca6befb41472f24 ] + +Building 32-bit images may fail with the following error. + +drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_util_32.c: + In function ‘dml32_UseMinimumDCFCLK’: +drivers/gpu/drm/amd/amdgpu/../display/dc/dml/dcn32/display_mode_vba_util_32.c:3142:1: + error: the frame size of 1096 bytes is larger than 1024 bytes + +This is seen when building i386:allmodconfig with any of the following +compilers. + + gcc (Debian 12.2.0-3) 12.2.0 + gcc (Ubuntu 9.4.0-1ubuntu1~20.04.1) 9.4.0 + +The problem is not seen if the compiler supports GCC_PLUGIN_LATENT_ENTROPY +because in that case CONFIG_FRAME_WARN is already set to 2048 even for +32-bit builds. + +dml32_UseMinimumDCFCLK() was introduced with commit dda4fb85e433 +("drm/amd/display: DML changes for DCN32/321"). It declares a large +number of local variables. Increase the frame size for the affected +file to 2048, similar to other files in the same directory, to enable +32-bit build tests with affected compilers. + +Fixes: dda4fb85e433 ("drm/amd/display: DML changes for DCN32/321") +Cc: Aurabindo Pillai +Reported-by: Łukasz Bartosik +Signed-off-by: Guenter Roeck +Signed-off-by: Alex Deucher +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/display/dc/dml/Makefile | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/gpu/drm/amd/display/dc/dml/Makefile b/drivers/gpu/drm/amd/display/dc/dml/Makefile +index cb81ed2fbd53..d0c6cf61c676 100644 +--- a/drivers/gpu/drm/amd/display/dc/dml/Makefile ++++ b/drivers/gpu/drm/amd/display/dc/dml/Makefile +@@ -77,7 +77,7 @@ CFLAGS_$(AMDDALPATH)/dc/dml/dcn30/dcn30_fpu.o := $(dml_ccflags) + CFLAGS_$(AMDDALPATH)/dc/dml/dcn32/dcn32_fpu.o := $(dml_ccflags) + CFLAGS_$(AMDDALPATH)/dc/dml/dcn32/display_mode_vba_32.o := $(dml_ccflags) $(frame_warn_flag) + CFLAGS_$(AMDDALPATH)/dc/dml/dcn32/display_rq_dlg_calc_32.o := $(dml_ccflags) +-CFLAGS_$(AMDDALPATH)/dc/dml/dcn32/display_mode_vba_util_32.o := $(dml_ccflags) ++CFLAGS_$(AMDDALPATH)/dc/dml/dcn32/display_mode_vba_util_32.o := $(dml_ccflags) $(frame_warn_flag) + CFLAGS_$(AMDDALPATH)/dc/dml/dcn321/dcn321_fpu.o := $(dml_ccflags) + CFLAGS_$(AMDDALPATH)/dc/dml/dcn31/dcn31_fpu.o := $(dml_ccflags) + CFLAGS_$(AMDDALPATH)/dc/dml/dcn301/dcn301_fpu.o := $(dml_ccflags) +-- +2.35.1 + diff --git a/queue-6.0/drm-vc4-add-module-dependency-on-hdmi-codec.patch b/queue-6.0/drm-vc4-add-module-dependency-on-hdmi-codec.patch new file mode 100644 index 00000000000..862b76b22cc --- /dev/null +++ b/queue-6.0/drm-vc4-add-module-dependency-on-hdmi-codec.patch @@ -0,0 +1,55 @@ +From 3bcb76d78809c19bbf3a970ce0bd3b7f777872c3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Sep 2022 16:41:11 +0200 +Subject: drm/vc4: Add module dependency on hdmi-codec + +From: Maxime Ripard + +[ Upstream commit d1c0b7de4dfa5505cf7a1d6220aa72aace4435d0 ] + +The VC4 HDMI controller driver relies on the HDMI codec ASoC driver. In +order to set it up properly, in vc4_hdmi_audio_init(), our HDMI driver +will register a device matching the HDMI codec driver, and then register +an ASoC card using that codec. + +However, if vc4 is compiled as a module, chances are that the hdmi-codec +driver will be too. In such a case, the module loader will have a very +narrow window to load the module between the device registration and the +card registration. + +If it fails to load the module in time, the card registration will fail +with EPROBE_DEFER, and we'll abort the audio initialisation, +unregistering the HDMI codec device in the process. + +The next time the bind callback will be run, it's likely that we end up +missing that window again, effectively preventing vc4 to probe entirely. + +In order to prevent this, we can create a soft dependency of the vc4 +driver on the HDMI codec one so that we're sure the HDMI codec will be +loaded before the VC4 module is, and thus we'll never end up in the +previous situation. + +Fixes: 91e99e113929 ("drm/vc4: hdmi: Register HDMI codec") +Reviewed-by: Javier Martinez Canillas +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220902144111.3424560-1-maxime@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_drv.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_drv.c b/drivers/gpu/drm/vc4/vc4_drv.c +index 6b8dfa1e7650..c186ace7f83b 100644 +--- a/drivers/gpu/drm/vc4/vc4_drv.c ++++ b/drivers/gpu/drm/vc4/vc4_drv.c +@@ -490,6 +490,7 @@ module_init(vc4_drm_register); + module_exit(vc4_drm_unregister); + + MODULE_ALIAS("platform:vc4-drm"); ++MODULE_SOFTDEP("pre: snd-soc-hdmi-codec"); + MODULE_DESCRIPTION("Broadcom VC4 DRM Driver"); + MODULE_AUTHOR("Eric Anholt "); + MODULE_LICENSE("GPL v2"); +-- +2.35.1 + diff --git a/queue-6.0/drm-vc4-hdmi-enforce-the-minimum-rate-at-runtime_res.patch b/queue-6.0/drm-vc4-hdmi-enforce-the-minimum-rate-at-runtime_res.patch new file mode 100644 index 00000000000..fb7e99f708f --- /dev/null +++ b/queue-6.0/drm-vc4-hdmi-enforce-the-minimum-rate-at-runtime_res.patch @@ -0,0 +1,64 @@ +From 968c8137daf867652fea8c0fb08207caa6b28fec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 11:21:17 +0200 +Subject: drm/vc4: hdmi: Enforce the minimum rate at runtime_resume + +From: Maxime Ripard + +[ Upstream commit ae71ab585c819f83aec84f91eb01157a90552ef2 ] + +This is a revert of commit fd5894fa2413 ("drm/vc4: hdmi: Remove clock +rate initialization"), with the code slightly moved around. + +It turns out that we can't downright remove that code from the driver, +since the Pi0-3 and Pi4 are in different cases, and it only works for +the Pi4. + +Indeed, the commit mentioned above was relying on the RaspberryPi +firmware clocks driver to initialize the rate if it wasn't done by the +firmware. However, the Pi0-3 are using the clk-bcm2835 clock driver that +wasn't doing this initialization. We therefore end up with the clock not +being assigned a rate, and the CPU stalling when trying to access a +register. + +We can't move that initialization in the clk-bcm2835 driver, since the +HSM clock we depend on is actually part of the HDMI power domain, so any +rate setup is only valid when the power domain is enabled. Thus, we +reinstated the minimum rate setup at runtime_suspend, which should +address both issues. + +Link: https://lore.kernel.org/dri-devel/20220922145448.w3xfywkn5ecak2et@pengutronix.de/ +Fixes: fd5894fa2413 ("drm/vc4: hdmi: Remove clock rate initialization") +Reported-by: Marc Kleine-Budde +Reviewed-by: Javier Martinez Canillas +Tested-by: Stefan Wahren +Signed-off-by: Maxime Ripard +Link: https://patchwork.freedesktop.org/patch/msgid/20220929-rpi-pi3-unplugged-fixes-v1-1-cd22e962296c@cerno.tech +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/vc4/vc4_hdmi.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/gpu/drm/vc4/vc4_hdmi.c b/drivers/gpu/drm/vc4/vc4_hdmi.c +index 1e5f68704d7d..780a19a75c3f 100644 +--- a/drivers/gpu/drm/vc4/vc4_hdmi.c ++++ b/drivers/gpu/drm/vc4/vc4_hdmi.c +@@ -2871,6 +2871,15 @@ static int vc4_hdmi_runtime_resume(struct device *dev) + u32 __maybe_unused value; + int ret; + ++ /* ++ * The HSM clock is in the HDMI power domain, so we need to set ++ * its frequency while the power domain is active so that it ++ * keeps its rate. ++ */ ++ ret = clk_set_min_rate(vc4_hdmi->hsm_clock, HSM_MIN_CLOCK_FREQ); ++ if (ret) ++ return ret; ++ + ret = clk_prepare_enable(vc4_hdmi->hsm_clock); + if (ret) + return ret; +-- +2.35.1 + diff --git a/queue-6.0/erofs-shouldn-t-churn-the-mapping-page-for-duplicate.patch b/queue-6.0/erofs-shouldn-t-churn-the-mapping-page-for-duplicate.patch new file mode 100644 index 00000000000..00cb724ab82 --- /dev/null +++ b/queue-6.0/erofs-shouldn-t-churn-the-mapping-page-for-duplicate.patch @@ -0,0 +1,70 @@ +From 04fef1dfae2602495fe640c370da97625329572d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 12:50:56 +0800 +Subject: erofs: shouldn't churn the mapping page for duplicated copies + +From: Gao Xiang + +[ Upstream commit 63bbb85658ea43dd35dbfde6d4150b47c407fc87 ] + +If other duplicated copies exist in one decompression shot, should +leave the old page as is rather than replace it with the new duplicated +one. Otherwise, the following cold path to deal with duplicated copies +will use the invalid bvec. It impacts compressed data deduplication. + +Also, shift the onlinepage EIO bit to avoid touching the signed bit. + +Fixes: 267f2492c8f7 ("erofs: introduce multi-reference pclusters (fully-referenced)") +Reviewed-by: Chao Yu +Signed-off-by: Gao Xiang +Link: https://lore.kernel.org/r/20221012045056.13421-1-hsiangkao@linux.alibaba.com +Signed-off-by: Sasha Levin +--- + fs/erofs/zdata.c | 8 +++----- + fs/erofs/zdata.h | 6 +++--- + 2 files changed, 6 insertions(+), 8 deletions(-) + +diff --git a/fs/erofs/zdata.c b/fs/erofs/zdata.c +index 5792ca9e0d5e..6e663275aeb1 100644 +--- a/fs/erofs/zdata.c ++++ b/fs/erofs/zdata.c +@@ -838,15 +838,13 @@ static void z_erofs_do_decompressed_bvec(struct z_erofs_decompress_backend *be, + + if (!((bvec->offset + be->pcl->pageofs_out) & ~PAGE_MASK)) { + unsigned int pgnr; +- struct page *oldpage; + + pgnr = (bvec->offset + be->pcl->pageofs_out) >> PAGE_SHIFT; + DBG_BUGON(pgnr >= be->nr_pages); +- oldpage = be->decompressed_pages[pgnr]; +- be->decompressed_pages[pgnr] = bvec->page; +- +- if (!oldpage) ++ if (!be->decompressed_pages[pgnr]) { ++ be->decompressed_pages[pgnr] = bvec->page; + return; ++ } + } + + /* (cold path) one pcluster is requested multiple times */ +diff --git a/fs/erofs/zdata.h b/fs/erofs/zdata.h +index e7f04c4fbb81..d98c95212985 100644 +--- a/fs/erofs/zdata.h ++++ b/fs/erofs/zdata.h +@@ -126,10 +126,10 @@ static inline unsigned int z_erofs_pclusterpages(struct z_erofs_pcluster *pcl) + } + + /* +- * bit 31: I/O error occurred on this page +- * bit 0 - 30: remaining parts to complete this page ++ * bit 30: I/O error occurred on this page ++ * bit 0 - 29: remaining parts to complete this page + */ +-#define Z_EROFS_PAGE_EIO (1 << 31) ++#define Z_EROFS_PAGE_EIO (1 << 30) + + static inline void z_erofs_onlinepage_init(struct page *page) + { +-- +2.35.1 + diff --git a/queue-6.0/ext4-factor-out-ext4_fc_get_tl.patch b/queue-6.0/ext4-factor-out-ext4_fc_get_tl.patch new file mode 100644 index 00000000000..f9f0ad0a476 --- /dev/null +++ b/queue-6.0/ext4-factor-out-ext4_fc_get_tl.patch @@ -0,0 +1,154 @@ +From 56ea0a36a71e54c6ddb825b631437ad0d4de76e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Sep 2022 15:52:32 +0800 +Subject: ext4: factor out ext4_fc_get_tl() + +From: Ye Bin + +[ Upstream commit dcc5827484d6e53ccda12334f8bbfafcc593ceda ] + +Factor out ext4_fc_get_tl() to fill 'tl' with host byte order. + +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20220924075233.2315259-3-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Stable-dep-of: 1b45cc5c7b92 ("ext4: fix potential out of bound read in ext4_fc_replay_scan()") +Signed-off-by: Sasha Levin +--- + fs/ext4/fast_commit.c | 46 +++++++++++++++++++++++-------------------- + 1 file changed, 25 insertions(+), 21 deletions(-) + +diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c +index 6c8b78ad0ff2..f518c6585a63 100644 +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -1346,7 +1346,7 @@ struct dentry_info_args { + }; + + static inline void tl_to_darg(struct dentry_info_args *darg, +- struct ext4_fc_tl *tl, u8 *val) ++ struct ext4_fc_tl *tl, u8 *val) + { + struct ext4_fc_dentry_info fcd; + +@@ -1355,8 +1355,14 @@ static inline void tl_to_darg(struct dentry_info_args *darg, + darg->parent_ino = le32_to_cpu(fcd.fc_parent_ino); + darg->ino = le32_to_cpu(fcd.fc_ino); + darg->dname = val + offsetof(struct ext4_fc_dentry_info, fc_dname); +- darg->dname_len = le16_to_cpu(tl->fc_len) - +- sizeof(struct ext4_fc_dentry_info); ++ darg->dname_len = tl->fc_len - sizeof(struct ext4_fc_dentry_info); ++} ++ ++static inline void ext4_fc_get_tl(struct ext4_fc_tl *tl, u8 *val) ++{ ++ memcpy(tl, val, EXT4_FC_TAG_BASE_LEN); ++ tl->fc_len = le16_to_cpu(tl->fc_len); ++ tl->fc_tag = le16_to_cpu(tl->fc_tag); + } + + /* Unlink replay function */ +@@ -1521,7 +1527,7 @@ static int ext4_fc_replay_inode(struct super_block *sb, struct ext4_fc_tl *tl, + struct ext4_inode *raw_fc_inode; + struct inode *inode = NULL; + struct ext4_iloc iloc; +- int inode_len, ino, ret, tag = le16_to_cpu(tl->fc_tag); ++ int inode_len, ino, ret, tag = tl->fc_tag; + struct ext4_extent_header *eh; + + memcpy(&fc_inode, val, sizeof(fc_inode)); +@@ -1546,7 +1552,7 @@ static int ext4_fc_replay_inode(struct super_block *sb, struct ext4_fc_tl *tl, + if (ret) + goto out; + +- inode_len = le16_to_cpu(tl->fc_len) - sizeof(struct ext4_fc_inode); ++ inode_len = tl->fc_len - sizeof(struct ext4_fc_inode); + raw_inode = ext4_raw_inode(&iloc); + + memcpy(raw_inode, raw_fc_inode, offsetof(struct ext4_inode, i_block)); +@@ -2037,12 +2043,12 @@ static int ext4_fc_replay_scan(journal_t *journal, + + state->fc_replay_expected_off++; + for (cur = start; cur < end; +- cur = cur + EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)) { +- memcpy(&tl, cur, EXT4_FC_TAG_BASE_LEN); ++ cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { ++ ext4_fc_get_tl(&tl, cur); + val = cur + EXT4_FC_TAG_BASE_LEN; + ext4_debug("Scan phase, tag:%s, blk %lld\n", +- tag2str(le16_to_cpu(tl.fc_tag)), bh->b_blocknr); +- switch (le16_to_cpu(tl.fc_tag)) { ++ tag2str(tl.fc_tag), bh->b_blocknr); ++ switch (tl.fc_tag) { + case EXT4_FC_TAG_ADD_RANGE: + memcpy(&ext, val, sizeof(ext)); + ex = (struct ext4_extent *)&ext.fc_ex; +@@ -2062,7 +2068,7 @@ static int ext4_fc_replay_scan(journal_t *journal, + case EXT4_FC_TAG_PAD: + state->fc_cur_tag++; + state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, +- EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)); ++ EXT4_FC_TAG_BASE_LEN + tl.fc_len); + break; + case EXT4_FC_TAG_TAIL: + state->fc_cur_tag++; +@@ -2095,7 +2101,7 @@ static int ext4_fc_replay_scan(journal_t *journal, + } + state->fc_cur_tag++; + state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, +- EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)); ++ EXT4_FC_TAG_BASE_LEN + tl.fc_len); + break; + default: + ret = state->fc_replay_num_tags ? +@@ -2151,8 +2157,8 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, + end = (__u8 *)bh->b_data + journal->j_blocksize - 1; + + for (cur = start; cur < end; +- cur = cur + EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)) { +- memcpy(&tl, cur, EXT4_FC_TAG_BASE_LEN); ++ cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { ++ ext4_fc_get_tl(&tl, cur); + val = cur + EXT4_FC_TAG_BASE_LEN; + + if (state->fc_replay_num_tags == 0) { +@@ -2160,10 +2166,9 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, + ext4_fc_set_bitmaps_and_counters(sb); + break; + } +- ext4_debug("Replay phase, tag:%s\n", +- tag2str(le16_to_cpu(tl.fc_tag))); ++ ext4_debug("Replay phase, tag:%s\n", tag2str(tl.fc_tag)); + state->fc_replay_num_tags--; +- switch (le16_to_cpu(tl.fc_tag)) { ++ switch (tl.fc_tag) { + case EXT4_FC_TAG_LINK: + ret = ext4_fc_replay_link(sb, &tl, val); + break; +@@ -2184,19 +2189,18 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, + break; + case EXT4_FC_TAG_PAD: + trace_ext4_fc_replay(sb, EXT4_FC_TAG_PAD, 0, +- le16_to_cpu(tl.fc_len), 0); ++ tl.fc_len, 0); + break; + case EXT4_FC_TAG_TAIL: +- trace_ext4_fc_replay(sb, EXT4_FC_TAG_TAIL, 0, +- le16_to_cpu(tl.fc_len), 0); ++ trace_ext4_fc_replay(sb, EXT4_FC_TAG_TAIL, ++ 0, tl.fc_len, 0); + memcpy(&tail, val, sizeof(tail)); + WARN_ON(le32_to_cpu(tail.fc_tid) != expected_tid); + break; + case EXT4_FC_TAG_HEAD: + break; + default: +- trace_ext4_fc_replay(sb, le16_to_cpu(tl.fc_tag), 0, +- le16_to_cpu(tl.fc_len), 0); ++ trace_ext4_fc_replay(sb, tl.fc_tag, 0, tl.fc_len, 0); + ret = -ECANCELED; + break; + } +-- +2.35.1 + diff --git a/queue-6.0/ext4-fix-potential-out-of-bound-read-in-ext4_fc_repl.patch b/queue-6.0/ext4-fix-potential-out-of-bound-read-in-ext4_fc_repl.patch new file mode 100644 index 00000000000..5b38d97e779 --- /dev/null +++ b/queue-6.0/ext4-fix-potential-out-of-bound-read-in-ext4_fc_repl.patch @@ -0,0 +1,101 @@ +From a33aef1ab93230ad2b3a8e731621e7a000bf40b3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Sep 2022 15:52:33 +0800 +Subject: ext4: fix potential out of bound read in ext4_fc_replay_scan() + +From: Ye Bin + +[ Upstream commit 1b45cc5c7b920fd8bf72e5a888ec7abeadf41e09 ] + +For scan loop must ensure that at least EXT4_FC_TAG_BASE_LEN space. If remain +space less than EXT4_FC_TAG_BASE_LEN which will lead to out of bound read +when mounting corrupt file system image. +ADD_RANGE/HEAD/TAIL is needed to add extra check when do journal scan, as this +three tags will read data during scan, tag length couldn't less than data length +which will read. + +Cc: stable@kernel.org +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20220924075233.2315259-4-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Signed-off-by: Sasha Levin +--- + fs/ext4/fast_commit.c | 38 ++++++++++++++++++++++++++++++++++++-- + 1 file changed, 36 insertions(+), 2 deletions(-) + +diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c +index f518c6585a63..e5d20da58528 100644 +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -1986,6 +1986,34 @@ void ext4_fc_replay_cleanup(struct super_block *sb) + kfree(sbi->s_fc_replay_state.fc_modified_inodes); + } + ++static inline bool ext4_fc_tag_len_isvalid(struct ext4_fc_tl *tl, ++ u8 *val, u8 *end) ++{ ++ if (val + tl->fc_len > end) ++ return false; ++ ++ /* Here only check ADD_RANGE/TAIL/HEAD which will read data when do ++ * journal rescan before do CRC check. Other tags length check will ++ * rely on CRC check. ++ */ ++ switch (tl->fc_tag) { ++ case EXT4_FC_TAG_ADD_RANGE: ++ return (sizeof(struct ext4_fc_add_range) == tl->fc_len); ++ case EXT4_FC_TAG_TAIL: ++ return (sizeof(struct ext4_fc_tail) <= tl->fc_len); ++ case EXT4_FC_TAG_HEAD: ++ return (sizeof(struct ext4_fc_head) == tl->fc_len); ++ case EXT4_FC_TAG_DEL_RANGE: ++ case EXT4_FC_TAG_LINK: ++ case EXT4_FC_TAG_UNLINK: ++ case EXT4_FC_TAG_CREAT: ++ case EXT4_FC_TAG_INODE: ++ case EXT4_FC_TAG_PAD: ++ default: ++ return true; ++ } ++} ++ + /* + * Recovery Scan phase handler + * +@@ -2042,10 +2070,15 @@ static int ext4_fc_replay_scan(journal_t *journal, + } + + state->fc_replay_expected_off++; +- for (cur = start; cur < end; ++ for (cur = start; cur < end - EXT4_FC_TAG_BASE_LEN; + cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { + ext4_fc_get_tl(&tl, cur); + val = cur + EXT4_FC_TAG_BASE_LEN; ++ if (!ext4_fc_tag_len_isvalid(&tl, val, end)) { ++ ret = state->fc_replay_num_tags ? ++ JBD2_FC_REPLAY_STOP : -ECANCELED; ++ goto out_err; ++ } + ext4_debug("Scan phase, tag:%s, blk %lld\n", + tag2str(tl.fc_tag), bh->b_blocknr); + switch (tl.fc_tag) { +@@ -2156,7 +2189,7 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, + start = (u8 *)bh->b_data; + end = (__u8 *)bh->b_data + journal->j_blocksize - 1; + +- for (cur = start; cur < end; ++ for (cur = start; cur < end - EXT4_FC_TAG_BASE_LEN; + cur = cur + EXT4_FC_TAG_BASE_LEN + tl.fc_len) { + ext4_fc_get_tl(&tl, cur); + val = cur + EXT4_FC_TAG_BASE_LEN; +@@ -2166,6 +2199,7 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, + ext4_fc_set_bitmaps_and_counters(sb); + break; + } ++ + ext4_debug("Replay phase, tag:%s\n", tag2str(tl.fc_tag)); + state->fc_replay_num_tags--; + switch (tl.fc_tag) { +-- +2.35.1 + diff --git a/queue-6.0/ext4-introduce-ext4_fc_tag_base_len-helper.patch b/queue-6.0/ext4-introduce-ext4_fc_tag_base_len-helper.patch new file mode 100644 index 00000000000..7618888883f --- /dev/null +++ b/queue-6.0/ext4-introduce-ext4_fc_tag_base_len-helper.patch @@ -0,0 +1,200 @@ +From cf7deb32663b4029baac1d39486e58a3bc17dd85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 24 Sep 2022 15:52:31 +0800 +Subject: ext4: introduce EXT4_FC_TAG_BASE_LEN helper + +From: Ye Bin + +[ Upstream commit fdc2a3c75dd8345c5b48718af90bad1a7811bedb ] + +Introduce EXT4_FC_TAG_BASE_LEN helper for calculate length of +struct ext4_fc_tl. + +Signed-off-by: Ye Bin +Link: https://lore.kernel.org/r/20220924075233.2315259-2-yebin10@huawei.com +Signed-off-by: Theodore Ts'o +Stable-dep-of: 1b45cc5c7b92 ("ext4: fix potential out of bound read in ext4_fc_replay_scan()") +Signed-off-by: Sasha Levin +--- + fs/ext4/fast_commit.c | 54 ++++++++++++++++++++++--------------------- + fs/ext4/fast_commit.h | 3 +++ + 2 files changed, 31 insertions(+), 26 deletions(-) + +diff --git a/fs/ext4/fast_commit.c b/fs/ext4/fast_commit.c +index b26f304baa52..6c8b78ad0ff2 100644 +--- a/fs/ext4/fast_commit.c ++++ b/fs/ext4/fast_commit.c +@@ -710,10 +710,10 @@ static u8 *ext4_fc_reserve_space(struct super_block *sb, int len, u32 *crc) + * After allocating len, we should have space at least for a 0 byte + * padding. + */ +- if (len + sizeof(struct ext4_fc_tl) > bsize) ++ if (len + EXT4_FC_TAG_BASE_LEN > bsize) + return NULL; + +- if (bsize - off - 1 > len + sizeof(struct ext4_fc_tl)) { ++ if (bsize - off - 1 > len + EXT4_FC_TAG_BASE_LEN) { + /* + * Only allocate from current buffer if we have enough space for + * this request AND we have space to add a zero byte padding. +@@ -730,10 +730,10 @@ static u8 *ext4_fc_reserve_space(struct super_block *sb, int len, u32 *crc) + /* Need to add PAD tag */ + tl = (struct ext4_fc_tl *)(sbi->s_fc_bh->b_data + off); + tl->fc_tag = cpu_to_le16(EXT4_FC_TAG_PAD); +- pad_len = bsize - off - 1 - sizeof(struct ext4_fc_tl); ++ pad_len = bsize - off - 1 - EXT4_FC_TAG_BASE_LEN; + tl->fc_len = cpu_to_le16(pad_len); + if (crc) +- *crc = ext4_chksum(sbi, *crc, tl, sizeof(*tl)); ++ *crc = ext4_chksum(sbi, *crc, tl, EXT4_FC_TAG_BASE_LEN); + if (pad_len > 0) + ext4_fc_memzero(sb, tl + 1, pad_len, crc); + ext4_fc_submit_bh(sb, false); +@@ -775,7 +775,7 @@ static int ext4_fc_write_tail(struct super_block *sb, u32 crc) + * ext4_fc_reserve_space takes care of allocating an extra block if + * there's no enough space on this block for accommodating this tail. + */ +- dst = ext4_fc_reserve_space(sb, sizeof(tl) + sizeof(tail), &crc); ++ dst = ext4_fc_reserve_space(sb, EXT4_FC_TAG_BASE_LEN + sizeof(tail), &crc); + if (!dst) + return -ENOSPC; + +@@ -785,8 +785,8 @@ static int ext4_fc_write_tail(struct super_block *sb, u32 crc) + tl.fc_len = cpu_to_le16(bsize - off - 1 + sizeof(struct ext4_fc_tail)); + sbi->s_fc_bytes = round_up(sbi->s_fc_bytes, bsize); + +- ext4_fc_memcpy(sb, dst, &tl, sizeof(tl), &crc); +- dst += sizeof(tl); ++ ext4_fc_memcpy(sb, dst, &tl, EXT4_FC_TAG_BASE_LEN, &crc); ++ dst += EXT4_FC_TAG_BASE_LEN; + tail.fc_tid = cpu_to_le32(sbi->s_journal->j_running_transaction->t_tid); + ext4_fc_memcpy(sb, dst, &tail.fc_tid, sizeof(tail.fc_tid), &crc); + dst += sizeof(tail.fc_tid); +@@ -808,15 +808,15 @@ static bool ext4_fc_add_tlv(struct super_block *sb, u16 tag, u16 len, u8 *val, + struct ext4_fc_tl tl; + u8 *dst; + +- dst = ext4_fc_reserve_space(sb, sizeof(tl) + len, crc); ++ dst = ext4_fc_reserve_space(sb, EXT4_FC_TAG_BASE_LEN + len, crc); + if (!dst) + return false; + + tl.fc_tag = cpu_to_le16(tag); + tl.fc_len = cpu_to_le16(len); + +- ext4_fc_memcpy(sb, dst, &tl, sizeof(tl), crc); +- ext4_fc_memcpy(sb, dst + sizeof(tl), val, len, crc); ++ ext4_fc_memcpy(sb, dst, &tl, EXT4_FC_TAG_BASE_LEN, crc); ++ ext4_fc_memcpy(sb, dst + EXT4_FC_TAG_BASE_LEN, val, len, crc); + + return true; + } +@@ -828,8 +828,8 @@ static bool ext4_fc_add_dentry_tlv(struct super_block *sb, u32 *crc, + struct ext4_fc_dentry_info fcd; + struct ext4_fc_tl tl; + int dlen = fc_dentry->fcd_name.len; +- u8 *dst = ext4_fc_reserve_space(sb, sizeof(tl) + sizeof(fcd) + dlen, +- crc); ++ u8 *dst = ext4_fc_reserve_space(sb, ++ EXT4_FC_TAG_BASE_LEN + sizeof(fcd) + dlen, crc); + + if (!dst) + return false; +@@ -838,8 +838,8 @@ static bool ext4_fc_add_dentry_tlv(struct super_block *sb, u32 *crc, + fcd.fc_ino = cpu_to_le32(fc_dentry->fcd_ino); + tl.fc_tag = cpu_to_le16(fc_dentry->fcd_op); + tl.fc_len = cpu_to_le16(sizeof(fcd) + dlen); +- ext4_fc_memcpy(sb, dst, &tl, sizeof(tl), crc); +- dst += sizeof(tl); ++ ext4_fc_memcpy(sb, dst, &tl, EXT4_FC_TAG_BASE_LEN, crc); ++ dst += EXT4_FC_TAG_BASE_LEN; + ext4_fc_memcpy(sb, dst, &fcd, sizeof(fcd), crc); + dst += sizeof(fcd); + ext4_fc_memcpy(sb, dst, fc_dentry->fcd_name.name, dlen, crc); +@@ -876,13 +876,13 @@ static int ext4_fc_write_inode(struct inode *inode, u32 *crc) + + ret = -ECANCELED; + dst = ext4_fc_reserve_space(inode->i_sb, +- sizeof(tl) + inode_len + sizeof(fc_inode.fc_ino), crc); ++ EXT4_FC_TAG_BASE_LEN + inode_len + sizeof(fc_inode.fc_ino), crc); + if (!dst) + goto err; + +- if (!ext4_fc_memcpy(inode->i_sb, dst, &tl, sizeof(tl), crc)) ++ if (!ext4_fc_memcpy(inode->i_sb, dst, &tl, EXT4_FC_TAG_BASE_LEN, crc)) + goto err; +- dst += sizeof(tl); ++ dst += EXT4_FC_TAG_BASE_LEN; + if (!ext4_fc_memcpy(inode->i_sb, dst, &fc_inode, sizeof(fc_inode), crc)) + goto err; + dst += sizeof(fc_inode); +@@ -2036,9 +2036,10 @@ static int ext4_fc_replay_scan(journal_t *journal, + } + + state->fc_replay_expected_off++; +- for (cur = start; cur < end; cur = cur + sizeof(tl) + le16_to_cpu(tl.fc_len)) { +- memcpy(&tl, cur, sizeof(tl)); +- val = cur + sizeof(tl); ++ for (cur = start; cur < end; ++ cur = cur + EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)) { ++ memcpy(&tl, cur, EXT4_FC_TAG_BASE_LEN); ++ val = cur + EXT4_FC_TAG_BASE_LEN; + ext4_debug("Scan phase, tag:%s, blk %lld\n", + tag2str(le16_to_cpu(tl.fc_tag)), bh->b_blocknr); + switch (le16_to_cpu(tl.fc_tag)) { +@@ -2061,13 +2062,13 @@ static int ext4_fc_replay_scan(journal_t *journal, + case EXT4_FC_TAG_PAD: + state->fc_cur_tag++; + state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, +- sizeof(tl) + le16_to_cpu(tl.fc_len)); ++ EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)); + break; + case EXT4_FC_TAG_TAIL: + state->fc_cur_tag++; + memcpy(&tail, val, sizeof(tail)); + state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, +- sizeof(tl) + ++ EXT4_FC_TAG_BASE_LEN + + offsetof(struct ext4_fc_tail, + fc_crc)); + if (le32_to_cpu(tail.fc_tid) == expected_tid && +@@ -2094,7 +2095,7 @@ static int ext4_fc_replay_scan(journal_t *journal, + } + state->fc_cur_tag++; + state->fc_crc = ext4_chksum(sbi, state->fc_crc, cur, +- sizeof(tl) + le16_to_cpu(tl.fc_len)); ++ EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)); + break; + default: + ret = state->fc_replay_num_tags ? +@@ -2149,9 +2150,10 @@ static int ext4_fc_replay(journal_t *journal, struct buffer_head *bh, + start = (u8 *)bh->b_data; + end = (__u8 *)bh->b_data + journal->j_blocksize - 1; + +- for (cur = start; cur < end; cur = cur + sizeof(tl) + le16_to_cpu(tl.fc_len)) { +- memcpy(&tl, cur, sizeof(tl)); +- val = cur + sizeof(tl); ++ for (cur = start; cur < end; ++ cur = cur + EXT4_FC_TAG_BASE_LEN + le16_to_cpu(tl.fc_len)) { ++ memcpy(&tl, cur, EXT4_FC_TAG_BASE_LEN); ++ val = cur + EXT4_FC_TAG_BASE_LEN; + + if (state->fc_replay_num_tags == 0) { + ret = JBD2_FC_REPLAY_STOP; +diff --git a/fs/ext4/fast_commit.h b/fs/ext4/fast_commit.h +index 1db12847a83b..a6154c3ed135 100644 +--- a/fs/ext4/fast_commit.h ++++ b/fs/ext4/fast_commit.h +@@ -70,6 +70,9 @@ struct ext4_fc_tail { + __le32 fc_crc; + }; + ++/* Tag base length */ ++#define EXT4_FC_TAG_BASE_LEN (sizeof(struct ext4_fc_tl)) ++ + /* + * Fast commit status codes + */ +-- +2.35.1 + diff --git a/queue-6.0/hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch b/queue-6.0/hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch new file mode 100644 index 00000000000..4c7f4f5e190 --- /dev/null +++ b/queue-6.0/hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch @@ -0,0 +1,48 @@ +From 184623f9f7aa65a2792526dd6f6de32d68884001 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 9 Oct 2022 20:27:47 +0200 +Subject: HID: magicmouse: Do not set BTN_MOUSE on double report +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: José Expósito + +[ Upstream commit bb5f0c855dcfc893ae5ed90e4c646bde9e4498bf ] + +Under certain conditions the Magic Trackpad can group 2 reports in a +single packet. The packet is split and the raw event function is +invoked recursively for each part. + +However, after processing each part, the BTN_MOUSE status is updated, +sending multiple click events. [1] + +Return after processing double reports to avoid this issue. + +Link: https://gitlab.freedesktop.org/libinput/libinput/-/issues/811 # [1] +Fixes: a462230e16ac ("HID: magicmouse: enable Magic Trackpad support") +Reported-by: Nulo +Signed-off-by: José Expósito +Signed-off-by: Benjamin Tissoires +Link: https://lore.kernel.org/r/20221009182747.90730-1-jose.exposito89@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-magicmouse.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/hid-magicmouse.c b/drivers/hid/hid-magicmouse.c +index 664a624a363d..c9c968d4b36a 100644 +--- a/drivers/hid/hid-magicmouse.c ++++ b/drivers/hid/hid-magicmouse.c +@@ -480,7 +480,7 @@ static int magicmouse_raw_event(struct hid_device *hdev, + magicmouse_raw_event(hdev, report, data + 2, data[1]); + magicmouse_raw_event(hdev, report, data + 2 + data[1], + size - 2 - data[1]); +- break; ++ return 0; + default: + return 0; + } +-- +2.35.1 + diff --git a/queue-6.0/i40e-fix-dma-mappings-leak.patch b/queue-6.0/i40e-fix-dma-mappings-leak.patch new file mode 100644 index 00000000000..cd9b583573e --- /dev/null +++ b/queue-6.0/i40e-fix-dma-mappings-leak.patch @@ -0,0 +1,323 @@ +From 54d0cafa35fefcbee66f21c0468ad965eb8bb1a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 13:54:40 -0700 +Subject: i40e: Fix DMA mappings leak + +From: Jan Sokolowski + +[ Upstream commit aae425efdfd1b1d8452260a3cb49344ebf20b1f5 ] + +During reallocation of RX buffers, new DMA mappings are created for +those buffers. + +steps for reproduction: +while : +do +for ((i=0; i<=8160; i=i+32)) +do +ethtool -G enp130s0f0 rx $i tx $i +sleep 0.5 +ethtool -g enp130s0f0 +done +done + +This resulted in crash: +i40e 0000:01:00.1: Unable to allocate memory for the Rx descriptor ring, size=65536 +Driver BUG +WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:141 xdp_rxq_info_unreg+0x43/0x50 +Call Trace: +i40e_free_rx_resources+0x70/0x80 [i40e] +i40e_set_ringparam+0x27c/0x800 [i40e] +ethnl_set_rings+0x1b2/0x290 +genl_family_rcv_msg_doit.isra.15+0x10f/0x150 +genl_family_rcv_msg+0xb3/0x160 +? rings_fill_reply+0x1a0/0x1a0 +genl_rcv_msg+0x47/0x90 +? genl_family_rcv_msg+0x160/0x160 +netlink_rcv_skb+0x4c/0x120 +genl_rcv+0x24/0x40 +netlink_unicast+0x196/0x230 +netlink_sendmsg+0x204/0x3d0 +sock_sendmsg+0x4c/0x50 +__sys_sendto+0xee/0x160 +? handle_mm_fault+0xbe/0x1e0 +? syscall_trace_enter+0x1d3/0x2c0 +__x64_sys_sendto+0x24/0x30 +do_syscall_64+0x5b/0x1a0 +entry_SYSCALL_64_after_hwframe+0x65/0xca +RIP: 0033:0x7f5eac8b035b +Missing register, driver bug +WARNING: CPU: 0 PID: 4300 at net/core/xdp.c:119 xdp_rxq_info_unreg_mem_model+0x69/0x140 +Call Trace: +xdp_rxq_info_unreg+0x1e/0x50 +i40e_free_rx_resources+0x70/0x80 [i40e] +i40e_set_ringparam+0x27c/0x800 [i40e] +ethnl_set_rings+0x1b2/0x290 +genl_family_rcv_msg_doit.isra.15+0x10f/0x150 +genl_family_rcv_msg+0xb3/0x160 +? rings_fill_reply+0x1a0/0x1a0 +genl_rcv_msg+0x47/0x90 +? genl_family_rcv_msg+0x160/0x160 +netlink_rcv_skb+0x4c/0x120 +genl_rcv+0x24/0x40 +netlink_unicast+0x196/0x230 +netlink_sendmsg+0x204/0x3d0 +sock_sendmsg+0x4c/0x50 +__sys_sendto+0xee/0x160 +? handle_mm_fault+0xbe/0x1e0 +? syscall_trace_enter+0x1d3/0x2c0 +__x64_sys_sendto+0x24/0x30 +do_syscall_64+0x5b/0x1a0 +entry_SYSCALL_64_after_hwframe+0x65/0xca +RIP: 0033:0x7f5eac8b035b + +This was caused because of new buffers with different RX ring count should +substitute older ones, but those buffers were freed in +i40e_configure_rx_ring and reallocated again with i40e_alloc_rx_bi, +thus kfree on rx_bi caused leak of already mapped DMA. + +Fix this by reallocating ZC with rx_bi_zc struct when BPF program loads. Additionally +reallocate back to rx_bi when BPF program unloads. + +If BPF program is loaded/unloaded and XSK pools are created, reallocate +RX queues accordingly in XSP_SETUP_XSK_POOL handler. + +Fixes: be1222b585fd ("i40e: Separate kernel allocated rx_bi rings from AF_XDP rings") +Signed-off-by: Jan Sokolowski +Signed-off-by: Mateusz Palczewski +Signed-off-by: Jacob Keller +Tested-by: Chandan (A Contingent Worker at Intel) +Tested-by: Gurucharan (A Contingent worker at Intel) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/i40e/i40e_ethtool.c | 3 - + drivers/net/ethernet/intel/i40e/i40e_main.c | 16 +++-- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 13 ++-- + drivers/net/ethernet/intel/i40e/i40e_txrx.h | 1 - + drivers/net/ethernet/intel/i40e/i40e_xsk.c | 67 ++++++++++++++++--- + drivers/net/ethernet/intel/i40e/i40e_xsk.h | 2 +- + 6 files changed, 74 insertions(+), 28 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +index e9cd0fa6a0d2..af5fe84db596 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_ethtool.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_ethtool.c +@@ -2181,9 +2181,6 @@ static int i40e_set_ringparam(struct net_device *netdev, + */ + rx_rings[i].tail = hw->hw_addr + I40E_PRTGEN_STATUS; + err = i40e_setup_rx_descriptors(&rx_rings[i]); +- if (err) +- goto rx_unwind; +- err = i40e_alloc_rx_bi(&rx_rings[i]); + if (err) + goto rx_unwind; + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index e3d9804aeb25..b3336d31f8a9 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -3565,12 +3565,8 @@ static int i40e_configure_rx_ring(struct i40e_ring *ring) + if (ring->vsi->type == I40E_VSI_MAIN) + xdp_rxq_info_unreg_mem_model(&ring->xdp_rxq); + +- kfree(ring->rx_bi); + ring->xsk_pool = i40e_xsk_pool(ring); + if (ring->xsk_pool) { +- ret = i40e_alloc_rx_bi_zc(ring); +- if (ret) +- return ret; + ring->rx_buf_len = + xsk_pool_get_rx_frame_size(ring->xsk_pool); + /* For AF_XDP ZC, we disallow packets to span on +@@ -3588,9 +3584,6 @@ static int i40e_configure_rx_ring(struct i40e_ring *ring) + ring->queue_index); + + } else { +- ret = i40e_alloc_rx_bi(ring); +- if (ret) +- return ret; + ring->rx_buf_len = vsi->rx_buf_len; + if (ring->vsi->type == I40E_VSI_MAIN) { + ret = xdp_rxq_info_reg_mem_model(&ring->xdp_rxq, +@@ -13304,6 +13297,14 @@ static int i40e_xdp_setup(struct i40e_vsi *vsi, struct bpf_prog *prog, + i40e_reset_and_rebuild(pf, true, true); + } + ++ if (!i40e_enabled_xdp_vsi(vsi) && prog) { ++ if (i40e_realloc_rx_bi_zc(vsi, true)) ++ return -ENOMEM; ++ } else if (i40e_enabled_xdp_vsi(vsi) && !prog) { ++ if (i40e_realloc_rx_bi_zc(vsi, false)) ++ return -ENOMEM; ++ } ++ + for (i = 0; i < vsi->num_queue_pairs; i++) + WRITE_ONCE(vsi->rx_rings[i]->xdp_prog, vsi->xdp_prog); + +@@ -13536,6 +13537,7 @@ int i40e_queue_pair_disable(struct i40e_vsi *vsi, int queue_pair) + + i40e_queue_pair_disable_irq(vsi, queue_pair); + err = i40e_queue_pair_toggle_rings(vsi, queue_pair, false /* off */); ++ i40e_clean_rx_ring(vsi->rx_rings[queue_pair]); + i40e_queue_pair_toggle_napi(vsi, queue_pair, false /* off */); + i40e_queue_pair_clean_rings(vsi, queue_pair); + i40e_queue_pair_reset_stats(vsi, queue_pair); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 69e67eb6aea7..b97c95f89fa0 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -1457,14 +1457,6 @@ int i40e_setup_tx_descriptors(struct i40e_ring *tx_ring) + return -ENOMEM; + } + +-int i40e_alloc_rx_bi(struct i40e_ring *rx_ring) +-{ +- unsigned long sz = sizeof(*rx_ring->rx_bi) * rx_ring->count; +- +- rx_ring->rx_bi = kzalloc(sz, GFP_KERNEL); +- return rx_ring->rx_bi ? 0 : -ENOMEM; +-} +- + static void i40e_clear_rx_bi(struct i40e_ring *rx_ring) + { + memset(rx_ring->rx_bi, 0, sizeof(*rx_ring->rx_bi) * rx_ring->count); +@@ -1593,6 +1585,11 @@ int i40e_setup_rx_descriptors(struct i40e_ring *rx_ring) + + rx_ring->xdp_prog = rx_ring->vsi->xdp_prog; + ++ rx_ring->rx_bi = ++ kcalloc(rx_ring->count, sizeof(*rx_ring->rx_bi), GFP_KERNEL); ++ if (!rx_ring->rx_bi) ++ return -ENOMEM; ++ + return 0; + } + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.h b/drivers/net/ethernet/intel/i40e/i40e_txrx.h +index 41f86e9535a0..768290dc6f48 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.h +@@ -469,7 +469,6 @@ int __i40e_maybe_stop_tx(struct i40e_ring *tx_ring, int size); + bool __i40e_chk_linearize(struct sk_buff *skb); + int i40e_xdp_xmit(struct net_device *dev, int n, struct xdp_frame **frames, + u32 flags); +-int i40e_alloc_rx_bi(struct i40e_ring *rx_ring); + + /** + * i40e_get_head - Retrieve head from head writeback +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.c b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +index 6d4009e0cbd6..cd7b52fb6b46 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.c +@@ -10,14 +10,6 @@ + #include "i40e_txrx_common.h" + #include "i40e_xsk.h" + +-int i40e_alloc_rx_bi_zc(struct i40e_ring *rx_ring) +-{ +- unsigned long sz = sizeof(*rx_ring->rx_bi_zc) * rx_ring->count; +- +- rx_ring->rx_bi_zc = kzalloc(sz, GFP_KERNEL); +- return rx_ring->rx_bi_zc ? 0 : -ENOMEM; +-} +- + void i40e_clear_rx_bi_zc(struct i40e_ring *rx_ring) + { + memset(rx_ring->rx_bi_zc, 0, +@@ -29,6 +21,58 @@ static struct xdp_buff **i40e_rx_bi(struct i40e_ring *rx_ring, u32 idx) + return &rx_ring->rx_bi_zc[idx]; + } + ++/** ++ * i40e_realloc_rx_xdp_bi - reallocate SW ring for either XSK or normal buffer ++ * @rx_ring: Current rx ring ++ * @pool_present: is pool for XSK present ++ * ++ * Try allocating memory and return ENOMEM, if failed to allocate. ++ * If allocation was successful, substitute buffer with allocated one. ++ * Returns 0 on success, negative on failure ++ */ ++static int i40e_realloc_rx_xdp_bi(struct i40e_ring *rx_ring, bool pool_present) ++{ ++ size_t elem_size = pool_present ? sizeof(*rx_ring->rx_bi_zc) : ++ sizeof(*rx_ring->rx_bi); ++ void *sw_ring = kcalloc(rx_ring->count, elem_size, GFP_KERNEL); ++ ++ if (!sw_ring) ++ return -ENOMEM; ++ ++ if (pool_present) { ++ kfree(rx_ring->rx_bi); ++ rx_ring->rx_bi = NULL; ++ rx_ring->rx_bi_zc = sw_ring; ++ } else { ++ kfree(rx_ring->rx_bi_zc); ++ rx_ring->rx_bi_zc = NULL; ++ rx_ring->rx_bi = sw_ring; ++ } ++ return 0; ++} ++ ++/** ++ * i40e_realloc_rx_bi_zc - reallocate rx SW rings ++ * @vsi: Current VSI ++ * @zc: is zero copy set ++ * ++ * Reallocate buffer for rx_rings that might be used by XSK. ++ * XDP requires more memory, than rx_buf provides. ++ * Returns 0 on success, negative on failure ++ */ ++int i40e_realloc_rx_bi_zc(struct i40e_vsi *vsi, bool zc) ++{ ++ struct i40e_ring *rx_ring; ++ unsigned long q; ++ ++ for_each_set_bit(q, vsi->af_xdp_zc_qps, vsi->alloc_queue_pairs) { ++ rx_ring = vsi->rx_rings[q]; ++ if (i40e_realloc_rx_xdp_bi(rx_ring, zc)) ++ return -ENOMEM; ++ } ++ return 0; ++} ++ + /** + * i40e_xsk_pool_enable - Enable/associate an AF_XDP buffer pool to a + * certain ring/qid +@@ -69,6 +113,10 @@ static int i40e_xsk_pool_enable(struct i40e_vsi *vsi, + if (err) + return err; + ++ err = i40e_realloc_rx_xdp_bi(vsi->rx_rings[qid], true); ++ if (err) ++ return err; ++ + err = i40e_queue_pair_enable(vsi, qid); + if (err) + return err; +@@ -113,6 +161,9 @@ static int i40e_xsk_pool_disable(struct i40e_vsi *vsi, u16 qid) + xsk_pool_dma_unmap(pool, I40E_RX_DMA_ATTR); + + if (if_running) { ++ err = i40e_realloc_rx_xdp_bi(vsi->rx_rings[qid], false); ++ if (err) ++ return err; + err = i40e_queue_pair_enable(vsi, qid); + if (err) + return err; +diff --git a/drivers/net/ethernet/intel/i40e/i40e_xsk.h b/drivers/net/ethernet/intel/i40e/i40e_xsk.h +index bb962987f300..821df248f8be 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_xsk.h ++++ b/drivers/net/ethernet/intel/i40e/i40e_xsk.h +@@ -32,7 +32,7 @@ int i40e_clean_rx_irq_zc(struct i40e_ring *rx_ring, int budget); + + bool i40e_clean_xdp_tx_irq(struct i40e_vsi *vsi, struct i40e_ring *tx_ring); + int i40e_xsk_wakeup(struct net_device *dev, u32 queue_id, u32 flags); +-int i40e_alloc_rx_bi_zc(struct i40e_ring *rx_ring); ++int i40e_realloc_rx_bi_zc(struct i40e_vsi *vsi, bool zc); + void i40e_clear_rx_bi_zc(struct i40e_ring *rx_ring); + + #endif /* _I40E_XSK_H_ */ +-- +2.35.1 + diff --git a/queue-6.0/io_uring-don-t-gate-task_work-run-on-tif_notify_sign.patch b/queue-6.0/io_uring-don-t-gate-task_work-run-on-tif_notify_sign.patch new file mode 100644 index 00000000000..4419bf0d889 --- /dev/null +++ b/queue-6.0/io_uring-don-t-gate-task_work-run-on-tif_notify_sign.patch @@ -0,0 +1,56 @@ +From cae906b2050cb549d1c47db5f24adfa64ab587c9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Sep 2022 15:29:13 -0600 +Subject: io_uring: don't gate task_work run on TIF_NOTIFY_SIGNAL + +From: Jens Axboe + +[ Upstream commit 46a525e199e4037516f7e498c18f065b09df32ac ] + +This isn't a reliable mechanism to tell if we have task_work pending, we +really should be looking at whether we have any items queued. This is +problematic if forward progress is gated on running said task_work. One +such example is reading from a pipe, where the write side has been closed +right before the read is started. The fput() of the file queues TWA_RESUME +task_work, and we need that task_work to be run before ->release() is +called for the pipe. If ->release() isn't called, then the read will sit +forever waiting on data that will never arise. + +Fix this by io_run_task_work() so it checks if we have task_work pending +rather than rely on TIF_NOTIFY_SIGNAL for that. The latter obviously +doesn't work for task_work that is queued without TWA_SIGNAL. + +Reported-by: Christiano Haesbaert +Cc: stable@vger.kernel.org +Link: https://github.com/axboe/liburing/issues/665 +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/io_uring.h | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +diff --git a/io_uring/io_uring.h b/io_uring/io_uring.h +index 45809ae6f64e..5121b20a9193 100644 +--- a/io_uring/io_uring.h ++++ b/io_uring/io_uring.h +@@ -229,12 +229,12 @@ static inline unsigned int io_sqring_entries(struct io_ring_ctx *ctx) + + static inline bool io_run_task_work(void) + { +- if (test_thread_flag(TIF_NOTIFY_SIGNAL)) { ++ if (task_work_pending(current)) { ++ if (test_thread_flag(TIF_NOTIFY_SIGNAL)) ++ clear_notify_signal(); + __set_current_state(TASK_RUNNING); +- clear_notify_signal(); +- if (task_work_pending(current)) +- task_work_run(); +- return true; ++ task_work_run(); ++ return 1; + } + + return false; +-- +2.35.1 + diff --git a/queue-6.0/io_uring-msg_ring-fix-null-pointer-dereference-in-io.patch b/queue-6.0/io_uring-msg_ring-fix-null-pointer-dereference-in-io.patch new file mode 100644 index 00000000000..322e94c2348 --- /dev/null +++ b/queue-6.0/io_uring-msg_ring-fix-null-pointer-dereference-in-io.patch @@ -0,0 +1,72 @@ +From ba0f0d84fe7b907900c88c664bce4e6c3542a52a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 10:12:18 -0700 +Subject: io_uring/msg_ring: Fix NULL pointer dereference in io_msg_send_fd() + +From: Harshit Mogalapalli + +[ Upstream commit 16bbdfe5fb0e78e0acb13e45fc127e9a296913f2 ] + +Syzkaller produced the below call trace: + + BUG: KASAN: null-ptr-deref in io_msg_ring+0x3cb/0x9f0 + Write of size 8 at addr 0000000000000070 by task repro/16399 + + CPU: 0 PID: 16399 Comm: repro Not tainted 6.1.0-rc1 #28 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 + Call Trace: + + dump_stack_lvl+0xcd/0x134 + ? io_msg_ring+0x3cb/0x9f0 + kasan_report+0xbc/0xf0 + ? io_msg_ring+0x3cb/0x9f0 + kasan_check_range+0x140/0x190 + io_msg_ring+0x3cb/0x9f0 + ? io_msg_ring_prep+0x300/0x300 + io_issue_sqe+0x698/0xca0 + io_submit_sqes+0x92f/0x1c30 + __do_sys_io_uring_enter+0xae4/0x24b0 +.... + RIP: 0033:0x7f2eaf8f8289 + RSP: 002b:00007fff40939718 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa + RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f2eaf8f8289 + RDX: 0000000000000000 RSI: 0000000000006f71 RDI: 0000000000000004 + RBP: 00007fff409397a0 R08: 0000000000000000 R09: 0000000000000039 + R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004006d0 + R13: 00007fff40939880 R14: 0000000000000000 R15: 0000000000000000 + + Kernel panic - not syncing: panic_on_warn set ... + +We don't have a NULL check on file_ptr in io_msg_send_fd() function, +so when file_ptr is NUL src_file is also NULL and get_file() +dereferences a NULL pointer and leads to above crash. + +Add a NULL check to fix this issue. + +Fixes: e6130eba8a84 ("io_uring: add support for passing fixed file descriptors") +Reported-by: syzkaller +Signed-off-by: Harshit Mogalapalli +Link: https://lore.kernel.org/r/20221019171218.1337614-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/msg_ring.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/io_uring/msg_ring.c b/io_uring/msg_ring.c +index 4a7e5d030c78..90d2fc6fd80e 100644 +--- a/io_uring/msg_ring.c ++++ b/io_uring/msg_ring.c +@@ -95,6 +95,9 @@ static int io_msg_send_fd(struct io_kiocb *req, unsigned int issue_flags) + + msg->src_fd = array_index_nospec(msg->src_fd, ctx->nr_user_files); + file_ptr = io_fixed_file_slot(&ctx->file_table, msg->src_fd)->file_ptr; ++ if (!file_ptr) ++ goto out_unlock; ++ + src_file = (struct file *) (file_ptr & FFS_MASK); + get_file(src_file); + +-- +2.35.1 + diff --git a/queue-6.0/io_uring-rw-remove-leftover-debug-statement.patch b/queue-6.0/io_uring-rw-remove-leftover-debug-statement.patch new file mode 100644 index 00000000000..4e7d80a9b06 --- /dev/null +++ b/queue-6.0/io_uring-rw-remove-leftover-debug-statement.patch @@ -0,0 +1,36 @@ +From 3a0987d68a7938b4e8a22d110ad883bcc5227be8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Oct 2022 17:24:10 -0600 +Subject: io_uring/rw: remove leftover debug statement + +From: Jens Axboe + +[ Upstream commit 5c61795ea97c170347c5c4af0c159bd877b8af71 ] + +This debug statement was never meant to go into the upstream release, +kill it off before it ends up in a release. It was just part of the +testing for the initial version of the patch. + +Fixes: 2ec33a6c3cca ("io_uring/rw: ensure kiocb_end_write() is always called") +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + io_uring/rw.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/io_uring/rw.c b/io_uring/rw.c +index 60c08a944e2f..93d7cb5eb9fe 100644 +--- a/io_uring/rw.c ++++ b/io_uring/rw.c +@@ -192,8 +192,6 @@ static void io_req_io_end(struct io_kiocb *req) + { + struct io_rw *rw = io_kiocb_to_cmd(req, struct io_rw); + +- WARN_ON(!in_task()); +- + if (rw->kiocb.ki_flags & IOCB_WRITE) { + kiocb_end_write(req); + fsnotify_modify(req->file); +-- +2.35.1 + diff --git a/queue-6.0/iommu-vt-d-allow-nvs-regions-in-arch_rmrr_sanity_che.patch b/queue-6.0/iommu-vt-d-allow-nvs-regions-in-arch_rmrr_sanity_che.patch new file mode 100644 index 00000000000..facdb5b68e8 --- /dev/null +++ b/queue-6.0/iommu-vt-d-allow-nvs-regions-in-arch_rmrr_sanity_che.patch @@ -0,0 +1,79 @@ +From baa4e283c92160893619edfdafd6e126f950027e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 08:44:46 +0800 +Subject: iommu/vt-d: Allow NVS regions in arch_rmrr_sanity_check() + +From: Charlotte Tan + +[ Upstream commit 5566e68d829f5d87670d5984c1c2ccb4c518405f ] + +arch_rmrr_sanity_check() warns if the RMRR is not covered by an ACPI +Reserved region, but it seems like it should accept an NVS region as +well. The ACPI spec +https://uefi.org/specs/ACPI/6.5/15_System_Address_Map_Interfaces.html +uses similar wording for "Reserved" and "NVS" region types; for NVS +regions it says "This range of addresses is in use or reserved by the +system and must not be used by the operating system." + +There is an old comment on this mailing list that also suggests NVS +regions should pass the arch_rmrr_sanity_check() test: + + The warnings come from arch_rmrr_sanity_check() since it checks whether + the region is E820_TYPE_RESERVED. However, if the purpose of the check + is to detect RMRR has regions that may be used by OS as free memory, + isn't E820_TYPE_NVS safe, too? + +This patch overlaps with another proposed patch that would add the region +type to the log since sometimes the bug reporter sees this log on the +console but doesn't know to include the kernel log: + +https://lore.kernel.org/lkml/20220611204859.234975-3-atomlin@redhat.com/ + +Here's an example of the "Firmware Bug" apparent false positive (wrapped +for line length): + + DMAR: [Firmware Bug]: No firmware reserved region can cover this RMRR + [0x000000006f760000-0x000000006f762fff], contact BIOS vendor for + fixes + DMAR: [Firmware Bug]: Your BIOS is broken; bad RMRR + [0x000000006f760000-0x000000006f762fff] + +This is the snippet from the e820 table: + + BIOS-e820: [mem 0x0000000068bff000-0x000000006ebfefff] reserved + BIOS-e820: [mem 0x000000006ebff000-0x000000006f9fefff] ACPI NVS + BIOS-e820: [mem 0x000000006f9ff000-0x000000006fffefff] ACPI data + +Fixes: f036c7fa0ab6 ("iommu/vt-d: Check VT-d RMRR region in BIOS is reported as reserved") +Cc: Will Mortensen +Link: https://lore.kernel.org/linux-iommu/64a5843d-850d-e58c-4fc2-0a0eeeb656dc@nec.com/ +Link: https://bugzilla.kernel.org/show_bug.cgi?id=216443 +Signed-off-by: Charlotte Tan +Reviewed-by: Aaron Tomlin +Link: https://lore.kernel.org/r/20220929044449.32515-1-charlotte@extrahop.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + arch/x86/include/asm/iommu.h | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/include/asm/iommu.h b/arch/x86/include/asm/iommu.h +index 0bef44d30a27..2fd52b65deac 100644 +--- a/arch/x86/include/asm/iommu.h ++++ b/arch/x86/include/asm/iommu.h +@@ -25,8 +25,10 @@ arch_rmrr_sanity_check(struct acpi_dmar_reserved_memory *rmrr) + { + u64 start = rmrr->base_address; + u64 end = rmrr->end_address + 1; ++ int entry_type; + +- if (e820__mapped_all(start, end, E820_TYPE_RESERVED)) ++ entry_type = e820__get_entry_type(start, end); ++ if (entry_type == E820_TYPE_RESERVED || entry_type == E820_TYPE_NVS) + return 0; + + pr_err(FW_BUG "No firmware reserved region can cover this RMRR [%#018Lx-%#018Lx], contact BIOS vendor for fixes\n", +-- +2.35.1 + diff --git a/queue-6.0/iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch b/queue-6.0/iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch new file mode 100644 index 00000000000..fc1e3e2d314 --- /dev/null +++ b/queue-6.0/iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch @@ -0,0 +1,56 @@ +From dd4d0b5b0d25cb61cc6b03969986bd0d9d8e72e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Oct 2022 08:44:47 +0800 +Subject: iommu/vt-d: Clean up si_domain in the init_dmars() error path + +From: Jerry Snitselaar + +[ Upstream commit 620bf9f981365c18cc2766c53d92bf8131c63f32 ] + +A splat from kmem_cache_destroy() was seen with a kernel prior to +commit ee2653bbe89d ("iommu/vt-d: Remove domain and devinfo mempool") +when there was a failure in init_dmars(), because the iommu_domain +cache still had objects. While the mempool code is now gone, there +still is a leak of the si_domain memory if init_dmars() fails. So +clean up si_domain in the init_dmars() error path. + +Cc: Lu Baolu +Cc: Joerg Roedel +Cc: Will Deacon +Cc: Robin Murphy +Fixes: 86080ccc223a ("iommu/vt-d: Allocate si_domain in init_dmars()") +Signed-off-by: Jerry Snitselaar +Link: https://lore.kernel.org/r/20221010144842.308890-1-jsnitsel@redhat.com +Signed-off-by: Lu Baolu +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel/iommu.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c +index 31bc50e538a3..ecc0b05b2796 100644 +--- a/drivers/iommu/intel/iommu.c ++++ b/drivers/iommu/intel/iommu.c +@@ -2400,6 +2400,7 @@ static int __init si_domain_init(int hw) + + if (md_domain_init(si_domain, DEFAULT_DOMAIN_ADDRESS_WIDTH)) { + domain_exit(si_domain); ++ si_domain = NULL; + return -EFAULT; + } + +@@ -3042,6 +3043,10 @@ static int __init init_dmars(void) + disable_dmar_iommu(iommu); + free_dmar_iommu(iommu); + } ++ if (si_domain) { ++ domain_exit(si_domain); ++ si_domain = NULL; ++ } + + return ret; + } +-- +2.35.1 + diff --git a/queue-6.0/ionic-catch-null-pointer-issue-on-reconfig.patch b/queue-6.0/ionic-catch-null-pointer-issue-on-reconfig.patch new file mode 100644 index 00000000000..64b6d22c924 --- /dev/null +++ b/queue-6.0/ionic-catch-null-pointer-issue-on-reconfig.patch @@ -0,0 +1,56 @@ +From 002fdd287a817b9cd9b02c1d5d7fa9e0d651b5cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 16:31:23 -0700 +Subject: ionic: catch NULL pointer issue on reconfig + +From: Brett Creeley + +[ Upstream commit aa1d7e1267c12e07d979aa34c613716a89029db2 ] + +It's possible that the driver will dereference a qcq that doesn't exist +when calling ionic_reconfigure_queues(), which causes a page fault BUG. + +If a reduction in the number of queues is followed by a different +reconfig such as changing the ring size, the driver can hit a NULL +pointer when trying to clean up non-existent queues. + +Fix this by checking to make sure both the qcqs array and qcq entry +exists bofore trying to use and free the entry. + +Fixes: 101b40a0171f ("ionic: change queue count with no reset") +Signed-off-by: Brett Creeley +Signed-off-by: Shannon Nelson +Link: https://lore.kernel.org/r/20221017233123.15869-1-snelson@pensando.io +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/pensando/ionic/ionic_lif.c | 12 ++++++++---- + 1 file changed, 8 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +index 0be79c516781..6ae6d79193a3 100644 +--- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c ++++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c +@@ -2820,11 +2820,15 @@ int ionic_reconfigure_queues(struct ionic_lif *lif, + * than the full array, but leave the qcq shells in place + */ + for (i = lif->nxqs; i < lif->ionic->ntxqs_per_lif; i++) { +- lif->txqcqs[i]->flags &= ~IONIC_QCQ_F_INTR; +- ionic_qcq_free(lif, lif->txqcqs[i]); ++ if (lif->txqcqs && lif->txqcqs[i]) { ++ lif->txqcqs[i]->flags &= ~IONIC_QCQ_F_INTR; ++ ionic_qcq_free(lif, lif->txqcqs[i]); ++ } + +- lif->rxqcqs[i]->flags &= ~IONIC_QCQ_F_INTR; +- ionic_qcq_free(lif, lif->rxqcqs[i]); ++ if (lif->rxqcqs && lif->rxqcqs[i]) { ++ lif->rxqcqs[i]->flags &= ~IONIC_QCQ_F_INTR; ++ ionic_qcq_free(lif, lif->rxqcqs[i]); ++ } + } + + if (err) +-- +2.35.1 + diff --git a/queue-6.0/ip6mr-fix-uaf-issue-in-ip6mr_sk_done-when-addrconf_i.patch b/queue-6.0/ip6mr-fix-uaf-issue-in-ip6mr_sk_done-when-addrconf_i.patch new file mode 100644 index 00000000000..1a05bae398a --- /dev/null +++ b/queue-6.0/ip6mr-fix-uaf-issue-in-ip6mr_sk_done-when-addrconf_i.patch @@ -0,0 +1,124 @@ +From 4ba656b77ee49b3a5e095ab41072c7fa82465edc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 16:03:31 +0800 +Subject: ip6mr: fix UAF issue in ip6mr_sk_done() when addrconf_init_net() + failed + +From: Zhengchao Shao + +[ Upstream commit 1ca695207ed2271ecbf8ee6c641970f621c157cc ] + +If the initialization fails in calling addrconf_init_net(), devconf_all is +the pointer that has been released. Then ip6mr_sk_done() is called to +release the net, accessing devconf->mc_forwarding directly causes invalid +pointer access. + +The process is as follows: +setup_net() + ops_init() + addrconf_init_net() + all = kmemdup(...) ---> alloc "all" + ... + net->ipv6.devconf_all = all; + __addrconf_sysctl_register() ---> failed + ... + kfree(all); ---> ipv6.devconf_all invalid + ... + ops_exit_list() + ... + ip6mr_sk_done() + devconf = net->ipv6.devconf_all; + //devconf is invalid pointer + if (!devconf || !atomic_read(&devconf->mc_forwarding)) + +The following is the Call Trace information: +BUG: KASAN: use-after-free in ip6mr_sk_done+0x112/0x3a0 +Read of size 4 at addr ffff888075508e88 by task ip/14554 +Call Trace: + +dump_stack_lvl+0x8e/0xd1 +print_report+0x155/0x454 +kasan_report+0xba/0x1f0 +kasan_check_range+0x35/0x1b0 +ip6mr_sk_done+0x112/0x3a0 +rawv6_close+0x48/0x70 +inet_release+0x109/0x230 +inet6_release+0x4c/0x70 +sock_release+0x87/0x1b0 +igmp6_net_exit+0x6b/0x170 +ops_exit_list+0xb0/0x170 +setup_net+0x7ac/0xbd0 +copy_net_ns+0x2e6/0x6b0 +create_new_namespaces+0x382/0xa50 +unshare_nsproxy_namespaces+0xa6/0x1c0 +ksys_unshare+0x3a4/0x7e0 +__x64_sys_unshare+0x2d/0x40 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 +RIP: 0033:0x7f7963322547 + + +Allocated by task 14554: +kasan_save_stack+0x1e/0x40 +kasan_set_track+0x21/0x30 +__kasan_kmalloc+0xa1/0xb0 +__kmalloc_node_track_caller+0x4a/0xb0 +kmemdup+0x28/0x60 +addrconf_init_net+0x1be/0x840 +ops_init+0xa5/0x410 +setup_net+0x5aa/0xbd0 +copy_net_ns+0x2e6/0x6b0 +create_new_namespaces+0x382/0xa50 +unshare_nsproxy_namespaces+0xa6/0x1c0 +ksys_unshare+0x3a4/0x7e0 +__x64_sys_unshare+0x2d/0x40 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Freed by task 14554: +kasan_save_stack+0x1e/0x40 +kasan_set_track+0x21/0x30 +kasan_save_free_info+0x2a/0x40 +____kasan_slab_free+0x155/0x1b0 +slab_free_freelist_hook+0x11b/0x220 +__kmem_cache_free+0xa4/0x360 +addrconf_init_net+0x623/0x840 +ops_init+0xa5/0x410 +setup_net+0x5aa/0xbd0 +copy_net_ns+0x2e6/0x6b0 +create_new_namespaces+0x382/0xa50 +unshare_nsproxy_namespaces+0xa6/0x1c0 +ksys_unshare+0x3a4/0x7e0 +__x64_sys_unshare+0x2d/0x40 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +Fixes: 7d9b1b578d67 ("ip6mr: fix use-after-free in ip6mr_sk_done()") +Signed-off-by: Zhengchao Shao +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20221017080331.16878-1-shaozhengchao@huawei.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 10ce86bf228e..d5967cba5b56 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -7214,9 +7214,11 @@ static int __net_init addrconf_init_net(struct net *net) + __addrconf_sysctl_unregister(net, all, NETCONFA_IFINDEX_ALL); + err_reg_all: + kfree(dflt); ++ net->ipv6.devconf_dflt = NULL; + #endif + err_alloc_dflt: + kfree(all); ++ net->ipv6.devconf_all = NULL; + err_alloc_all: + kfree(net->ipv6.inet6_addr_lst); + err_alloc_addr: +-- +2.35.1 + diff --git a/queue-6.0/kernfs-fix-use-after-free-in-__kernfs_remove.patch b/queue-6.0/kernfs-fix-use-after-free-in-__kernfs_remove.patch new file mode 100644 index 00000000000..03f9eaab265 --- /dev/null +++ b/queue-6.0/kernfs-fix-use-after-free-in-__kernfs_remove.patch @@ -0,0 +1,202 @@ +From 53a6798496cd9ca4a589646c7f8f44224a018c9e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Sep 2022 14:17:23 +0200 +Subject: kernfs: fix use-after-free in __kernfs_remove + +From: Christian A. Ehrhardt + +[ Upstream commit 4abc99652812a2ddf932f137515d5c5a04723538 ] + +Syzkaller managed to trigger concurrent calls to +kernfs_remove_by_name_ns() for the same file resulting in +a KASAN detected use-after-free. The race occurs when the root +node is freed during kernfs_drain(). + +To prevent this acquire an additional reference for the root +of the tree that is removed before calling __kernfs_remove(). + +Found by syzkaller with the following reproducer (slab_nomerge is +required): + +syz_mount_image$ext4(0x0, &(0x7f0000000100)='./file0\x00', 0x100000, 0x0, 0x0, 0x0, 0x0) +r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='/proc/self/exe\x00', 0x0, 0x0) +close(r0) +pipe2(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) +mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000000c0), 0x408, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r1}, 0x2c, {[{@cache_loose}, {@mmap}, {@loose}, {@loose}, {@mmap}], [{@mask={'mask', 0x3d, '^MAY_EXEC'}}, {@fsmagic={'fsmagic', 0x3d, 0x10001}}, {@dont_hash}]}}) + +Sample report: + +================================================================== +BUG: KASAN: use-after-free in kernfs_type include/linux/kernfs.h:335 [inline] +BUG: KASAN: use-after-free in kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] +BUG: KASAN: use-after-free in __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 +Read of size 2 at addr ffff8880088807f0 by task syz-executor.2/857 + +CPU: 0 PID: 857 Comm: syz-executor.2 Not tainted 6.0.0-rc3-00363-g7726d4c3e60b #5 +Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 +Call Trace: + + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x6e/0x91 lib/dump_stack.c:106 + print_address_description mm/kasan/report.c:317 [inline] + print_report.cold+0x5e/0x5e5 mm/kasan/report.c:433 + kasan_report+0xa3/0x130 mm/kasan/report.c:495 + kernfs_type include/linux/kernfs.h:335 [inline] + kernfs_leftmost_descendant fs/kernfs/dir.c:1261 [inline] + __kernfs_remove.part.0+0x843/0x960 fs/kernfs/dir.c:1369 + __kernfs_remove fs/kernfs/dir.c:1356 [inline] + kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 + sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943 + __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 + create_cache mm/slab_common.c:229 [inline] + kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 + p9_client_create+0xd4d/0x1190 net/9p/client.c:993 + v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 + v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 + legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 + vfs_get_tree+0x85/0x2e0 fs/super.c:1530 + do_new_mount fs/namespace.c:3040 [inline] + path_mount+0x675/0x1d00 fs/namespace.c:3370 + do_mount fs/namespace.c:3383 [inline] + __do_sys_mount fs/namespace.c:3591 [inline] + __se_sys_mount fs/namespace.c:3568 [inline] + __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f725f983aed +Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f725f0f7028 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 +RAX: ffffffffffffffda RBX: 00007f725faa3f80 RCX: 00007f725f983aed +RDX: 00000000200000c0 RSI: 0000000020000040 RDI: 0000000000000000 +RBP: 00007f725f9f419c R08: 0000000020000280 R09: 0000000000000000 +R10: 0000000000000408 R11: 0000000000000246 R12: 0000000000000000 +R13: 0000000000000006 R14: 00007f725faa3f80 R15: 00007f725f0d7000 + + +Allocated by task 855: + kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 + kasan_set_track mm/kasan/common.c:45 [inline] + set_alloc_info mm/kasan/common.c:437 [inline] + __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:470 + kasan_slab_alloc include/linux/kasan.h:224 [inline] + slab_post_alloc_hook mm/slab.h:727 [inline] + slab_alloc_node mm/slub.c:3243 [inline] + slab_alloc mm/slub.c:3251 [inline] + __kmem_cache_alloc_lru mm/slub.c:3258 [inline] + kmem_cache_alloc+0xbf/0x200 mm/slub.c:3268 + kmem_cache_zalloc include/linux/slab.h:723 [inline] + __kernfs_new_node+0xd4/0x680 fs/kernfs/dir.c:593 + kernfs_new_node fs/kernfs/dir.c:655 [inline] + kernfs_create_dir_ns+0x9c/0x220 fs/kernfs/dir.c:1010 + sysfs_create_dir_ns+0x127/0x290 fs/sysfs/dir.c:59 + create_dir lib/kobject.c:63 [inline] + kobject_add_internal+0x24a/0x8d0 lib/kobject.c:223 + kobject_add_varg lib/kobject.c:358 [inline] + kobject_init_and_add+0x101/0x160 lib/kobject.c:441 + sysfs_slab_add+0x156/0x1e0 mm/slub.c:5954 + __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 + create_cache mm/slab_common.c:229 [inline] + kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 + p9_client_create+0xd4d/0x1190 net/9p/client.c:993 + v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 + v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 + legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 + vfs_get_tree+0x85/0x2e0 fs/super.c:1530 + do_new_mount fs/namespace.c:3040 [inline] + path_mount+0x675/0x1d00 fs/namespace.c:3370 + do_mount fs/namespace.c:3383 [inline] + __do_sys_mount fs/namespace.c:3591 [inline] + __se_sys_mount fs/namespace.c:3568 [inline] + __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Freed by task 857: + kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 + kasan_set_track+0x21/0x30 mm/kasan/common.c:45 + kasan_set_free_info+0x20/0x40 mm/kasan/generic.c:370 + ____kasan_slab_free mm/kasan/common.c:367 [inline] + ____kasan_slab_free mm/kasan/common.c:329 [inline] + __kasan_slab_free+0x108/0x190 mm/kasan/common.c:375 + kasan_slab_free include/linux/kasan.h:200 [inline] + slab_free_hook mm/slub.c:1754 [inline] + slab_free_freelist_hook mm/slub.c:1780 [inline] + slab_free mm/slub.c:3534 [inline] + kmem_cache_free+0x9c/0x340 mm/slub.c:3551 + kernfs_put.part.0+0x2b2/0x520 fs/kernfs/dir.c:547 + kernfs_put+0x42/0x50 fs/kernfs/dir.c:521 + __kernfs_remove.part.0+0x72d/0x960 fs/kernfs/dir.c:1407 + __kernfs_remove fs/kernfs/dir.c:1356 [inline] + kernfs_remove_by_name_ns+0x108/0x190 fs/kernfs/dir.c:1589 + sysfs_slab_add+0x133/0x1e0 mm/slub.c:5943 + __kmem_cache_create+0x3e0/0x550 mm/slub.c:4899 + create_cache mm/slab_common.c:229 [inline] + kmem_cache_create_usercopy+0x167/0x2a0 mm/slab_common.c:335 + p9_client_create+0xd4d/0x1190 net/9p/client.c:993 + v9fs_session_init+0x1e6/0x13c0 fs/9p/v9fs.c:408 + v9fs_mount+0xb9/0xbd0 fs/9p/vfs_super.c:126 + legacy_get_tree+0xf1/0x200 fs/fs_context.c:610 + vfs_get_tree+0x85/0x2e0 fs/super.c:1530 + do_new_mount fs/namespace.c:3040 [inline] + path_mount+0x675/0x1d00 fs/namespace.c:3370 + do_mount fs/namespace.c:3383 [inline] + __do_sys_mount fs/namespace.c:3591 [inline] + __se_sys_mount fs/namespace.c:3568 [inline] + __x64_sys_mount+0x282/0x300 fs/namespace.c:3568 + do_syscall_x64 arch/x86/entry/common.c:50 [inline] + do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd + +The buggy address belongs to the object at ffff888008880780 + which belongs to the cache kernfs_node_cache of size 128 +The buggy address is located 112 bytes inside of + 128-byte region [ffff888008880780, ffff888008880800) + +The buggy address belongs to the physical page: +page:00000000732833f8 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8880 +flags: 0x100000000000200(slab|node=0|zone=1) +raw: 0100000000000200 0000000000000000 dead000000000122 ffff888001147280 +raw: 0000000000000000 0000000000150015 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected + +Memory state around the buggy address: + ffff888008880680: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb + ffff888008880700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +>ffff888008880780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb + ^ + ffff888008880800: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb + ffff888008880880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc +================================================================== + +Acked-by: Tejun Heo +Cc: stable # -rc3 +Signed-off-by: Christian A. Ehrhardt +Link: https://lore.kernel.org/r/20220913121723.691454-1-lk@c--e.de +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + fs/kernfs/dir.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/fs/kernfs/dir.c b/fs/kernfs/dir.c +index 1cc88ba6de90..2e9313988871 100644 +--- a/fs/kernfs/dir.c ++++ b/fs/kernfs/dir.c +@@ -1585,8 +1585,11 @@ int kernfs_remove_by_name_ns(struct kernfs_node *parent, const char *name, + down_write(&root->kernfs_rwsem); + + kn = kernfs_find_ns(parent, name, ns); +- if (kn) ++ if (kn) { ++ kernfs_get(kn); + __kernfs_remove(kn); ++ kernfs_put(kn); ++ } + + up_write(&root->kernfs_rwsem); + +-- +2.35.1 + diff --git a/queue-6.0/net-atm-fix-proc_mpc_write-incorrect-return-value.patch b/queue-6.0/net-atm-fix-proc_mpc_write-incorrect-return-value.patch new file mode 100644 index 00000000000..4f851b19f6b --- /dev/null +++ b/queue-6.0/net-atm-fix-proc_mpc_write-incorrect-return-value.patch @@ -0,0 +1,41 @@ +From af2a56c79c505bfceb26ae236ef2871c52ae44fd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 10:05:40 +0800 +Subject: net/atm: fix proc_mpc_write incorrect return value + +From: Xiaobo Liu + +[ Upstream commit d8bde3bf7f82dac5fc68a62c2816793a12cafa2a ] + +Then the input contains '\0' or '\n', proc_mpc_write has read them, +so the return value needs +1. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Xiaobo Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/atm/mpoa_proc.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/atm/mpoa_proc.c b/net/atm/mpoa_proc.c +index 829db9eba0cb..aaf64b953915 100644 +--- a/net/atm/mpoa_proc.c ++++ b/net/atm/mpoa_proc.c +@@ -219,11 +219,12 @@ static ssize_t proc_mpc_write(struct file *file, const char __user *buff, + if (!page) + return -ENOMEM; + +- for (p = page, len = 0; len < nbytes; p++, len++) { ++ for (p = page, len = 0; len < nbytes; p++) { + if (get_user(*p, buff++)) { + free_page((unsigned long)page); + return -EFAULT; + } ++ len += 1; + if (*p == '\0' || *p == '\n') + break; + } +-- +2.35.1 + diff --git a/queue-6.0/net-dsa-qca8k-fix-ethtool-autocast-mib-for-big-endia.patch b/queue-6.0/net-dsa-qca8k-fix-ethtool-autocast-mib-for-big-endia.patch new file mode 100644 index 00000000000..a12f64c7949 --- /dev/null +++ b/queue-6.0/net-dsa-qca8k-fix-ethtool-autocast-mib-for-big-endia.patch @@ -0,0 +1,92 @@ +From 0e9b70ccb42b7cf7bda624038c56322d3383d91b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 19:18:37 +0200 +Subject: net: dsa: qca8k: fix ethtool autocast mib for big-endian systems + +From: Christian Marangi + +[ Upstream commit 0d4636f7d72df3179b20a2d32b647881917a5e2a ] + +The switch sends autocast mib in little-endian. This is problematic for +big-endian system as the values needs to be converted. + +Fix this by converting each mib value to cpu byte order. + +Fixes: 5c957c7ca78c ("net: dsa: qca8k: add support for mib autocast in Ethernet packet") +Tested-by: Pawel Dembicki +Tested-by: Lech Perczak +Signed-off-by: Christian Marangi +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca/qca8k-8xxx.c | 20 ++++++++------------ + include/linux/dsa/tag_qca.h | 2 +- + 2 files changed, 9 insertions(+), 13 deletions(-) + +diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c +index c11d68185e7d..300c9345ee2b 100644 +--- a/drivers/net/dsa/qca/qca8k-8xxx.c ++++ b/drivers/net/dsa/qca/qca8k-8xxx.c +@@ -1518,9 +1518,9 @@ static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *sk + struct qca8k_priv *priv = ds->priv; + const struct qca8k_mib_desc *mib; + struct mib_ethhdr *mib_ethhdr; +- int i, mib_len, offset = 0; +- u64 *data; ++ __le32 *data2; + u8 port; ++ int i; + + mib_ethhdr = (struct mib_ethhdr *)skb_mac_header(skb); + mib_eth_data = &priv->mib_eth_data; +@@ -1532,28 +1532,24 @@ static void qca8k_mib_autocast_handler(struct dsa_switch *ds, struct sk_buff *sk + if (port != mib_eth_data->req_port) + goto exit; + +- data = mib_eth_data->data; ++ data2 = (__le32 *)skb->data; + + for (i = 0; i < priv->info->mib_count; i++) { + mib = &ar8327_mib[i]; + + /* First 3 mib are present in the skb head */ + if (i < 3) { +- data[i] = mib_ethhdr->data[i]; ++ mib_eth_data->data[i] = get_unaligned_le32(mib_ethhdr->data + i); + continue; + } + +- mib_len = sizeof(uint32_t); +- + /* Some mib are 64 bit wide */ + if (mib->size == 2) +- mib_len = sizeof(uint64_t); +- +- /* Copy the mib value from packet to the */ +- memcpy(data + i, skb->data + offset, mib_len); ++ mib_eth_data->data[i] = get_unaligned_le64((__le64 *)data2); ++ else ++ mib_eth_data->data[i] = get_unaligned_le32(data2); + +- /* Set the offset for the next mib */ +- offset += mib_len; ++ data2 += mib->size; + } + + exit: +diff --git a/include/linux/dsa/tag_qca.h b/include/linux/dsa/tag_qca.h +index 0e176da1e43f..b1b5720d89a5 100644 +--- a/include/linux/dsa/tag_qca.h ++++ b/include/linux/dsa/tag_qca.h +@@ -73,7 +73,7 @@ enum mdio_cmd { + }; + + struct mib_ethhdr { +- u32 data[3]; /* first 3 mib counter */ ++ __le32 data[3]; /* first 3 mib counter */ + __be16 hdr; /* qca hdr */ + } __packed; + +-- +2.35.1 + diff --git a/queue-6.0/net-dsa-qca8k-fix-inband-mgmt-for-big-endian-systems.patch b/queue-6.0/net-dsa-qca8k-fix-inband-mgmt-for-big-endian-systems.patch new file mode 100644 index 00000000000..7b225cd19c0 --- /dev/null +++ b/queue-6.0/net-dsa-qca8k-fix-inband-mgmt-for-big-endian-systems.patch @@ -0,0 +1,168 @@ +From 8220b712f37dd14437c170610ab5d3cc30dd22b6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 19:18:36 +0200 +Subject: net: dsa: qca8k: fix inband mgmt for big-endian systems + +From: Christian Marangi + +[ Upstream commit a2550d3ce53c68f54042bc5e468c4d07491ffe0e ] + +The header and the data of the skb for the inband mgmt requires +to be in little-endian. This is problematic for big-endian system +as the mgmt header is written in the cpu byte order. + +Fix this by converting each value for the mgmt header and data to +little-endian, and convert to cpu byte order the mgmt header and +data sent by the switch. + +Fixes: 5950c7c0a68c ("net: dsa: qca8k: add support for mgmt read/write in Ethernet packet") +Tested-by: Pawel Dembicki +Tested-by: Lech Perczak +Signed-off-by: Christian Marangi +Reviewed-by: Lech Perczak +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/dsa/qca/qca8k-8xxx.c | 63 ++++++++++++++++++++++++-------- + include/linux/dsa/tag_qca.h | 6 +-- + 2 files changed, 50 insertions(+), 19 deletions(-) + +diff --git a/drivers/net/dsa/qca/qca8k-8xxx.c b/drivers/net/dsa/qca/qca8k-8xxx.c +index c181346388a4..c11d68185e7d 100644 +--- a/drivers/net/dsa/qca/qca8k-8xxx.c ++++ b/drivers/net/dsa/qca/qca8k-8xxx.c +@@ -137,27 +137,42 @@ static void qca8k_rw_reg_ack_handler(struct dsa_switch *ds, struct sk_buff *skb) + struct qca8k_mgmt_eth_data *mgmt_eth_data; + struct qca8k_priv *priv = ds->priv; + struct qca_mgmt_ethhdr *mgmt_ethhdr; ++ u32 command; + u8 len, cmd; ++ int i; + + mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb_mac_header(skb); + mgmt_eth_data = &priv->mgmt_eth_data; + +- cmd = FIELD_GET(QCA_HDR_MGMT_CMD, mgmt_ethhdr->command); +- len = FIELD_GET(QCA_HDR_MGMT_LENGTH, mgmt_ethhdr->command); ++ command = get_unaligned_le32(&mgmt_ethhdr->command); ++ cmd = FIELD_GET(QCA_HDR_MGMT_CMD, command); ++ len = FIELD_GET(QCA_HDR_MGMT_LENGTH, command); + + /* Make sure the seq match the requested packet */ +- if (mgmt_ethhdr->seq == mgmt_eth_data->seq) ++ if (get_unaligned_le32(&mgmt_ethhdr->seq) == mgmt_eth_data->seq) + mgmt_eth_data->ack = true; + + if (cmd == MDIO_READ) { +- mgmt_eth_data->data[0] = mgmt_ethhdr->mdio_data; ++ u32 *val = mgmt_eth_data->data; ++ ++ *val = get_unaligned_le32(&mgmt_ethhdr->mdio_data); + + /* Get the rest of the 12 byte of data. + * The read/write function will extract the requested data. + */ +- if (len > QCA_HDR_MGMT_DATA1_LEN) +- memcpy(mgmt_eth_data->data + 1, skb->data, +- QCA_HDR_MGMT_DATA2_LEN); ++ if (len > QCA_HDR_MGMT_DATA1_LEN) { ++ __le32 *data2 = (__le32 *)skb->data; ++ int data_len = min_t(int, QCA_HDR_MGMT_DATA2_LEN, ++ len - QCA_HDR_MGMT_DATA1_LEN); ++ ++ val++; ++ ++ for (i = sizeof(u32); i <= data_len; i += sizeof(u32)) { ++ *val = get_unaligned_le32(data2); ++ val++; ++ data2++; ++ } ++ } + } + + complete(&mgmt_eth_data->rw_done); +@@ -169,8 +184,10 @@ static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 * + struct qca_mgmt_ethhdr *mgmt_ethhdr; + unsigned int real_len; + struct sk_buff *skb; +- u32 *data2; ++ __le32 *data2; ++ u32 command; + u16 hdr; ++ int i; + + skb = dev_alloc_skb(QCA_HDR_MGMT_PKT_LEN); + if (!skb) +@@ -199,20 +216,32 @@ static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 * + hdr |= FIELD_PREP(QCA_HDR_XMIT_DP_BIT, BIT(0)); + hdr |= FIELD_PREP(QCA_HDR_XMIT_CONTROL, QCA_HDR_XMIT_TYPE_RW_REG); + +- mgmt_ethhdr->command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg); +- mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len); +- mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd); +- mgmt_ethhdr->command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE, ++ command = FIELD_PREP(QCA_HDR_MGMT_ADDR, reg); ++ command |= FIELD_PREP(QCA_HDR_MGMT_LENGTH, real_len); ++ command |= FIELD_PREP(QCA_HDR_MGMT_CMD, cmd); ++ command |= FIELD_PREP(QCA_HDR_MGMT_CHECK_CODE, + QCA_HDR_MGMT_CHECK_CODE_VAL); + ++ put_unaligned_le32(command, &mgmt_ethhdr->command); ++ + if (cmd == MDIO_WRITE) +- mgmt_ethhdr->mdio_data = *val; ++ put_unaligned_le32(*val, &mgmt_ethhdr->mdio_data); + + mgmt_ethhdr->hdr = htons(hdr); + + data2 = skb_put_zero(skb, QCA_HDR_MGMT_DATA2_LEN + QCA_HDR_MGMT_PADDING_LEN); +- if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN) +- memcpy(data2, val + 1, len - QCA_HDR_MGMT_DATA1_LEN); ++ if (cmd == MDIO_WRITE && len > QCA_HDR_MGMT_DATA1_LEN) { ++ int data_len = min_t(int, QCA_HDR_MGMT_DATA2_LEN, ++ len - QCA_HDR_MGMT_DATA1_LEN); ++ ++ val++; ++ ++ for (i = sizeof(u32); i <= data_len; i += sizeof(u32)) { ++ put_unaligned_le32(*val, data2); ++ data2++; ++ val++; ++ } ++ } + + return skb; + } +@@ -220,9 +249,11 @@ static struct sk_buff *qca8k_alloc_mdio_header(enum mdio_cmd cmd, u32 reg, u32 * + static void qca8k_mdio_header_fill_seq_num(struct sk_buff *skb, u32 seq_num) + { + struct qca_mgmt_ethhdr *mgmt_ethhdr; ++ u32 seq; + ++ seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num); + mgmt_ethhdr = (struct qca_mgmt_ethhdr *)skb->data; +- mgmt_ethhdr->seq = FIELD_PREP(QCA_HDR_MGMT_SEQ_NUM, seq_num); ++ put_unaligned_le32(seq, &mgmt_ethhdr->seq); + } + + static int qca8k_read_eth(struct qca8k_priv *priv, u32 reg, u32 *val, int len) +diff --git a/include/linux/dsa/tag_qca.h b/include/linux/dsa/tag_qca.h +index 50be7cbd93a5..0e176da1e43f 100644 +--- a/include/linux/dsa/tag_qca.h ++++ b/include/linux/dsa/tag_qca.h +@@ -61,9 +61,9 @@ struct sk_buff; + + /* Special struct emulating a Ethernet header */ + struct qca_mgmt_ethhdr { +- u32 command; /* command bit 31:0 */ +- u32 seq; /* seq 63:32 */ +- u32 mdio_data; /* first 4byte mdio */ ++ __le32 command; /* command bit 31:0 */ ++ __le32 seq; /* seq 63:32 */ ++ __le32 mdio_data; /* first 4byte mdio */ + __be16 hdr; /* qca hdr */ + } __packed; + +-- +2.35.1 + diff --git a/queue-6.0/net-ethernet-mtk_eth_soc-fix-possible-memory-leak-in.patch b/queue-6.0/net-ethernet-mtk_eth_soc-fix-possible-memory-leak-in.patch new file mode 100644 index 00000000000..912f849daab --- /dev/null +++ b/queue-6.0/net-ethernet-mtk_eth_soc-fix-possible-memory-leak-in.patch @@ -0,0 +1,82 @@ +From e5d3017ae42f317382c5492887bc8cc38b4320a6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 11:51:54 +0800 +Subject: net: ethernet: mtk_eth_soc: fix possible memory leak in mtk_probe() + +From: Yang Yingliang + +[ Upstream commit b3d0d98179d62f9d55635a600679c4fa362baf8d ] + +If mtk_wed_add_hw() has been called, mtk_wed_exit() needs be called +in error path or removing module to free the memory allocated in +mtk_wed_add_hw(). + +Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_eth_soc.c | 17 ++++++++++++----- + 1 file changed, 12 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index b344632beadd..84433f3a3e22 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -4028,19 +4028,23 @@ static int mtk_probe(struct platform_device *pdev) + eth->irq[i] = platform_get_irq(pdev, i); + if (eth->irq[i] < 0) { + dev_err(&pdev->dev, "no IRQ%d resource found\n", i); +- return -ENXIO; ++ err = -ENXIO; ++ goto err_wed_exit; + } + } + for (i = 0; i < ARRAY_SIZE(eth->clks); i++) { + eth->clks[i] = devm_clk_get(eth->dev, + mtk_clks_source_name[i]); + if (IS_ERR(eth->clks[i])) { +- if (PTR_ERR(eth->clks[i]) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(eth->clks[i]) == -EPROBE_DEFER) { ++ err = -EPROBE_DEFER; ++ goto err_wed_exit; ++ } + if (eth->soc->required_clks & BIT(i)) { + dev_err(&pdev->dev, "clock %s not found\n", + mtk_clks_source_name[i]); +- return -EINVAL; ++ err = -EINVAL; ++ goto err_wed_exit; + } + eth->clks[i] = NULL; + } +@@ -4051,7 +4055,7 @@ static int mtk_probe(struct platform_device *pdev) + + err = mtk_hw_init(eth); + if (err) +- return err; ++ goto err_wed_exit; + + eth->hwlro = MTK_HAS_CAPS(eth->soc->caps, MTK_HWLRO); + +@@ -4140,6 +4144,8 @@ static int mtk_probe(struct platform_device *pdev) + mtk_free_dev(eth); + err_deinit_hw: + mtk_hw_deinit(eth); ++err_wed_exit: ++ mtk_wed_exit(); + + return err; + } +@@ -4159,6 +4165,7 @@ static int mtk_remove(struct platform_device *pdev) + phylink_disconnect_phy(mac->phylink); + } + ++ mtk_wed_exit(); + mtk_hw_deinit(eth); + + netif_napi_del(ð->tx_napi); +-- +2.35.1 + diff --git a/queue-6.0/net-ethernet-mtk_eth_wed-add-missing-of_node_put.patch b/queue-6.0/net-ethernet-mtk_eth_wed-add-missing-of_node_put.patch new file mode 100644 index 00000000000..e56d711388a --- /dev/null +++ b/queue-6.0/net-ethernet-mtk_eth_wed-add-missing-of_node_put.patch @@ -0,0 +1,53 @@ +From 2b0e638bbe886fdde4024f3976468083ad68fe9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 11:51:56 +0800 +Subject: net: ethernet: mtk_eth_wed: add missing of_node_put() + +From: Yang Yingliang + +[ Upstream commit e0bb4659e235770e6f53b3692e958591f49448f5 ] + +The device_node pointer returned by of_parse_phandle() with refcount +incremented, when finish using it, the refcount need be decreased. + +Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_wed.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c +index fff2b745587e..614147ad6116 100644 +--- a/drivers/net/ethernet/mediatek/mtk_wed.c ++++ b/drivers/net/ethernet/mediatek/mtk_wed.c +@@ -808,7 +808,7 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth, + + pdev = of_find_device_by_node(np); + if (!pdev) +- return; ++ goto err_of_node_put; + + get_device(&pdev->dev); + irq = platform_get_irq(pdev, 0); +@@ -861,6 +861,8 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth, + mutex_unlock(&hw_lock); + err_put_device: + put_device(&pdev->dev); ++err_of_node_put: ++ of_node_put(np); + } + + void mtk_wed_exit(void) +@@ -881,6 +883,7 @@ void mtk_wed_exit(void) + hw_list[i] = NULL; + debugfs_remove(hw->debugfs_dir); + put_device(hw->dev); ++ of_node_put(hw->node); + kfree(hw); + } + } +-- +2.35.1 + diff --git a/queue-6.0/net-ethernet-mtk_eth_wed-add-missing-put_device-in-m.patch b/queue-6.0/net-ethernet-mtk_eth_wed-add-missing-put_device-in-m.patch new file mode 100644 index 00000000000..4cef420f928 --- /dev/null +++ b/queue-6.0/net-ethernet-mtk_eth_wed-add-missing-put_device-in-m.patch @@ -0,0 +1,57 @@ +From 1d3080398af9d722669aa46d47ea6d55842b6bcb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 11:51:55 +0800 +Subject: net: ethernet: mtk_eth_wed: add missing put_device() in + mtk_wed_add_hw() + +From: Yang Yingliang + +[ Upstream commit 9d4f20a476ca57e4c9246eb1fa2a61bea2354720 ] + +After calling get_device() in mtk_wed_add_hw(), in error path, put_device() +needs be called. + +Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)") +Signed-off-by: Yang Yingliang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mediatek/mtk_wed.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c +index 29be2fcafea3..fff2b745587e 100644 +--- a/drivers/net/ethernet/mediatek/mtk_wed.c ++++ b/drivers/net/ethernet/mediatek/mtk_wed.c +@@ -813,11 +813,11 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth, + get_device(&pdev->dev); + irq = platform_get_irq(pdev, 0); + if (irq < 0) +- return; ++ goto err_put_device; + + regs = syscon_regmap_lookup_by_phandle(np, NULL); + if (IS_ERR(regs)) +- return; ++ goto err_put_device; + + rcu_assign_pointer(mtk_soc_wed_ops, &wed_ops); + +@@ -853,8 +853,14 @@ void mtk_wed_add_hw(struct device_node *np, struct mtk_eth *eth, + + hw_list[index] = hw; + ++ mutex_unlock(&hw_lock); ++ ++ return; ++ + unlock: + mutex_unlock(&hw_lock); ++err_put_device: ++ put_device(&pdev->dev); + } + + void mtk_wed_exit(void) +-- +2.35.1 + diff --git a/queue-6.0/net-fix-return-value-of-qdisc-ingress-handling-on-su.patch b/queue-6.0/net-fix-return-value-of-qdisc-ingress-handling-on-su.patch new file mode 100644 index 00000000000..1647e9beca8 --- /dev/null +++ b/queue-6.0/net-fix-return-value-of-qdisc-ingress-handling-on-su.patch @@ -0,0 +1,97 @@ +From 2d515bbb2d4ebd5575bb24e6fb554eee2012d9cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 10:34:38 +0300 +Subject: net: Fix return value of qdisc ingress handling on success + +From: Paul Blakey + +[ Upstream commit 672e97ef689a38cb20c2cc6a1814298fea34461e ] + +Currently qdisc ingress handling (sch_handle_ingress()) doesn't +set a return value and it is left to the old return value of +the caller (__netif_receive_skb_core()) which is RX drop, so if +the packet is consumed, caller will stop and return this value +as if the packet was dropped. + +This causes a problem in the kernel tcp stack when having a +egress tc rule forwarding to a ingress tc rule. +The tcp stack sending packets on the device having the egress rule +will see the packets as not successfully transmitted (although they +actually were), will not advance it's internal state of sent data, +and packets returning on such tcp stream will be dropped by the tcp +stack with reason ack-of-unsent-data. See reproduction in [0] below. + +Fix that by setting the return value to RX success if +the packet was handled successfully. + +[0] Reproduction steps: + $ ip link add veth1 type veth peer name peer1 + $ ip link add veth2 type veth peer name peer2 + $ ifconfig peer1 5.5.5.6/24 up + $ ip netns add ns0 + $ ip link set dev peer2 netns ns0 + $ ip netns exec ns0 ifconfig peer2 5.5.5.5/24 up + $ ifconfig veth2 0 up + $ ifconfig veth1 0 up + + #ingress forwarding veth1 <-> veth2 + $ tc qdisc add dev veth2 ingress + $ tc qdisc add dev veth1 ingress + $ tc filter add dev veth2 ingress prio 1 proto all flower \ + action mirred egress redirect dev veth1 + $ tc filter add dev veth1 ingress prio 1 proto all flower \ + action mirred egress redirect dev veth2 + + #steal packet from peer1 egress to veth2 ingress, bypassing the veth pipe + $ tc qdisc add dev peer1 clsact + $ tc filter add dev peer1 egress prio 20 proto ip flower \ + action mirred ingress redirect dev veth1 + + #run iperf and see connection not running + $ iperf3 -s& + $ ip netns exec ns0 iperf3 -c 5.5.5.6 -i 1 + + #delete egress rule, and run again, now should work + $ tc filter del dev peer1 egress + $ ip netns exec ns0 iperf3 -c 5.5.5.6 -i 1 + +Fixes: f697c3e8b35c ("[NET]: Avoid unnecessary cloning for ingress filtering") +Signed-off-by: Paul Blakey +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/dev.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/core/dev.c b/net/core/dev.c +index 56c8b0921c9f..2c14f48d2457 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -5136,11 +5136,13 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret, + case TC_ACT_SHOT: + mini_qdisc_qstats_cpu_drop(miniq); + kfree_skb_reason(skb, SKB_DROP_REASON_TC_INGRESS); ++ *ret = NET_RX_DROP; + return NULL; + case TC_ACT_STOLEN: + case TC_ACT_QUEUED: + case TC_ACT_TRAP: + consume_skb(skb); ++ *ret = NET_RX_SUCCESS; + return NULL; + case TC_ACT_REDIRECT: + /* skb_mac_header check was done by cls/act_bpf, so +@@ -5153,8 +5155,10 @@ sch_handle_ingress(struct sk_buff *skb, struct packet_type **pt_prev, int *ret, + *another = true; + break; + } ++ *ret = NET_RX_SUCCESS; + return NULL; + case TC_ACT_CONSUMED: ++ *ret = NET_RX_SUCCESS; + return NULL; + default: + break; +-- +2.35.1 + diff --git a/queue-6.0/net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch b/queue-6.0/net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch new file mode 100644 index 00000000000..51470efa072 --- /dev/null +++ b/queue-6.0/net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch @@ -0,0 +1,61 @@ +From 4319d1650cd63b5a02c927a98eb0688ad4336e0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 20:24:51 +0800 +Subject: net: hns: fix possible memory leak in hnae_ae_register() + +From: Yang Yingliang + +[ Upstream commit ff2f5ec5d009844ec28f171123f9e58750cef4bf ] + +Inject fault while probing module, if device_register() fails, +but the refcount of kobject is not decreased to 0, the name +allocated in dev_set_name() is leaked. Fix this by calling +put_device(), so that name can be freed in callback function +kobject_cleanup(). + +unreferenced object 0xffff00c01aba2100 (size 128): + comm "systemd-udevd", pid 1259, jiffies 4294903284 (age 294.152s) + hex dump (first 32 bytes): + 68 6e 61 65 30 00 00 00 18 21 ba 1a c0 00 ff ff hnae0....!...... + 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ + backtrace: + [<0000000034783f26>] slab_post_alloc_hook+0xa0/0x3e0 + [<00000000748188f2>] __kmem_cache_alloc_node+0x164/0x2b0 + [<00000000ab0743e8>] __kmalloc_node_track_caller+0x6c/0x390 + [<000000006c0ffb13>] kvasprintf+0x8c/0x118 + [<00000000fa27bfe1>] kvasprintf_const+0x60/0xc8 + [<0000000083e10ed7>] kobject_set_name_vargs+0x3c/0xc0 + [<000000000b87affc>] dev_set_name+0x7c/0xa0 + [<000000003fd8fe26>] hnae_ae_register+0xcc/0x190 [hnae] + [<00000000fe97edc9>] hns_dsaf_ae_init+0x9c/0x108 [hns_dsaf] + [<00000000c36ff1eb>] hns_dsaf_probe+0x548/0x748 [hns_dsaf] + +Fixes: 6fe6611ff275 ("net: add Hisilicon Network Subsystem hnae framework support") +Signed-off-by: Yang Yingliang +Reviewed-by: Leon Romanovsky +Link: https://lore.kernel.org/r/20221018122451.1749171-1-yangyingliang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns/hnae.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hnae.c b/drivers/net/ethernet/hisilicon/hns/hnae.c +index 00fafc0f8512..430eccea8e5e 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hnae.c ++++ b/drivers/net/ethernet/hisilicon/hns/hnae.c +@@ -419,8 +419,10 @@ int hnae_ae_register(struct hnae_ae_dev *hdev, struct module *owner) + hdev->cls_dev.release = hnae_release; + (void)dev_set_name(&hdev->cls_dev, "hnae%d", hdev->id); + ret = device_register(&hdev->cls_dev); +- if (ret) ++ if (ret) { ++ put_device(&hdev->cls_dev); + return ret; ++ } + + __module_get(THIS_MODULE); + +-- +2.35.1 + diff --git a/queue-6.0/net-hsr-avoid-possible-null-deref-in-skb_clone.patch b/queue-6.0/net-hsr-avoid-possible-null-deref-in-skb_clone.patch new file mode 100644 index 00000000000..06ba4ccbfe5 --- /dev/null +++ b/queue-6.0/net-hsr-avoid-possible-null-deref-in-skb_clone.patch @@ -0,0 +1,97 @@ +From c940c71ff455e2e2ac0c405b45544e7fd1f00981 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 16:59:28 +0000 +Subject: net: hsr: avoid possible NULL deref in skb_clone() + +From: Eric Dumazet + +[ Upstream commit d8b57135fd9ffe9a5b445350a686442a531c5339 ] + +syzbot got a crash [1] in skb_clone(), caused by a bug +in hsr_get_untagged_frame(). + +When/if create_stripped_skb_hsr() returns NULL, we must +not attempt to call skb_clone(). + +While we are at it, replace a WARN_ONCE() by netdev_warn_once(). + +[1] +general protection fault, probably for non-canonical address 0xdffffc000000000f: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000078-0x000000000000007f] +CPU: 1 PID: 754 Comm: syz-executor.0 Not tainted 6.0.0-syzkaller-02734-g0326074ff465 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 +RIP: 0010:skb_clone+0x108/0x3c0 net/core/skbuff.c:1641 +Code: 93 02 00 00 49 83 7c 24 28 00 0f 85 e9 00 00 00 e8 5d 4a 29 fa 4c 8d 75 7e 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 <0f> b6 04 02 4c 89 f2 83 e2 07 38 d0 7f 08 84 c0 0f 85 9e 01 00 00 +RSP: 0018:ffffc90003ccf4e0 EFLAGS: 00010207 + +RAX: dffffc0000000000 RBX: ffffc90003ccf5f8 RCX: ffffc9000c24b000 +RDX: 000000000000000f RSI: ffffffff8751cb13 RDI: 0000000000000000 +RBP: 0000000000000000 R08: 00000000000000f0 R09: 0000000000000140 +R10: fffffbfff181d972 R11: 0000000000000000 R12: ffff888161fc3640 +R13: 0000000000000a20 R14: 000000000000007e R15: ffffffff8dc5f620 +FS: 00007feb621e4700(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007feb621e3ff8 CR3: 00000001643a9000 CR4: 00000000003506e0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + +hsr_get_untagged_frame+0x4e/0x610 net/hsr/hsr_forward.c:164 +hsr_forward_do net/hsr/hsr_forward.c:461 [inline] +hsr_forward_skb+0xcca/0x1d50 net/hsr/hsr_forward.c:623 +hsr_handle_frame+0x588/0x7c0 net/hsr/hsr_slave.c:69 +__netif_receive_skb_core+0x9fe/0x38f0 net/core/dev.c:5379 +__netif_receive_skb_one_core+0xae/0x180 net/core/dev.c:5483 +__netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5599 +netif_receive_skb_internal net/core/dev.c:5685 [inline] +netif_receive_skb+0x12f/0x8d0 net/core/dev.c:5744 +tun_rx_batched+0x4ab/0x7a0 drivers/net/tun.c:1544 +tun_get_user+0x2686/0x3a00 drivers/net/tun.c:1995 +tun_chr_write_iter+0xdb/0x200 drivers/net/tun.c:2025 +call_write_iter include/linux/fs.h:2187 [inline] +new_sync_write fs/read_write.c:491 [inline] +vfs_write+0x9e9/0xdd0 fs/read_write.c:584 +ksys_write+0x127/0x250 fs/read_write.c:637 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: f266a683a480 ("net/hsr: Better frame dispatch") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20221017165928.2150130-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/hsr/hsr_forward.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c +index 5bf357734b11..a50429a62f74 100644 +--- a/net/hsr/hsr_forward.c ++++ b/net/hsr/hsr_forward.c +@@ -150,15 +150,15 @@ struct sk_buff *hsr_get_untagged_frame(struct hsr_frame_info *frame, + struct hsr_port *port) + { + if (!frame->skb_std) { +- if (frame->skb_hsr) { ++ if (frame->skb_hsr) + frame->skb_std = + create_stripped_skb_hsr(frame->skb_hsr, frame); +- } else { +- /* Unexpected */ +- WARN_ONCE(1, "%s:%d: Unexpected frame received (port_src %s)\n", +- __FILE__, __LINE__, port->dev->name); ++ else ++ netdev_warn_once(port->dev, ++ "Unexpected frame received in hsr_get_untagged_frame()\n"); ++ ++ if (!frame->skb_std) + return NULL; +- } + } + + return skb_clone(frame->skb_std, GFP_ATOMIC); +-- +2.35.1 + diff --git a/queue-6.0/net-phy-dp83822-disable-mdi-crossover-status-change-.patch b/queue-6.0/net-phy-dp83822-disable-mdi-crossover-status-change-.patch new file mode 100644 index 00000000000..4e3f4e23243 --- /dev/null +++ b/queue-6.0/net-phy-dp83822-disable-mdi-crossover-status-change-.patch @@ -0,0 +1,43 @@ +From e3c17e552c487aca0e128702c8a6b81f1bf205ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 12:47:54 +0200 +Subject: net: phy: dp83822: disable MDI crossover status change interrupt + +From: Felix Riemann + +[ Upstream commit 7f378c03aa4952507521174fb0da7b24a9ad0be6 ] + +If the cable is disconnected the PHY seems to toggle between MDI and +MDI-X modes. With the MDI crossover status interrupt active this causes +roughly 10 interrupts per second. + +As the crossover status isn't checked by the driver, the interrupt can +be disabled to reduce the interrupt load. + +Fixes: 87461f7a58ab ("net: phy: DP83822 initial driver submission") +Signed-off-by: Felix Riemann +Reviewed-by: Andrew Lunn +Link: https://lore.kernel.org/r/20221018104755.30025-1-svc.sw.rte.linux@sma.de +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83822.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/net/phy/dp83822.c b/drivers/net/phy/dp83822.c +index 8549e0e356c9..b60db8b6f477 100644 +--- a/drivers/net/phy/dp83822.c ++++ b/drivers/net/phy/dp83822.c +@@ -254,8 +254,7 @@ static int dp83822_config_intr(struct phy_device *phydev) + DP83822_EEE_ERROR_CHANGE_INT_EN); + + if (!dp83822->fx_enabled) +- misr_status |= DP83822_MDI_XOVER_INT_EN | +- DP83822_ANEG_ERR_INT_EN | ++ misr_status |= DP83822_ANEG_ERR_INT_EN | + DP83822_WOL_PKT_INT_EN; + + err = phy_write(phydev, MII_DP83822_MISR2, misr_status); +-- +2.35.1 + diff --git a/queue-6.0/net-phy-dp83867-extend-rx-strap-quirk-for-sgmii-mode.patch b/queue-6.0/net-phy-dp83867-extend-rx-strap-quirk-for-sgmii-mode.patch new file mode 100644 index 00000000000..3bf44c189e0 --- /dev/null +++ b/queue-6.0/net-phy-dp83867-extend-rx-strap-quirk-for-sgmii-mode.patch @@ -0,0 +1,44 @@ +From 2a7a34828818a2a9b3f46d851c89c14f0b9d557d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 12:17:35 +0530 +Subject: net: phy: dp83867: Extend RX strap quirk for SGMII mode + +From: Harini Katakam + +[ Upstream commit 0c9efbd5c50c64ead434960a404c9c9a097b0403 ] + +When RX strap in HW is not set to MODE 3 or 4, bit 7 and 8 in CF4 +register should be set. The former is already handled in +dp83867_config_init; add the latter in SGMII specific initialization. + +Fixes: 2a10154abcb7 ("net: phy: dp83867: Add TI dp83867 phy") +Signed-off-by: Harini Katakam +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/dp83867.c | 8 ++++++++ + 1 file changed, 8 insertions(+) + +diff --git a/drivers/net/phy/dp83867.c b/drivers/net/phy/dp83867.c +index 6939563d3b7c..417527f8bbf5 100644 +--- a/drivers/net/phy/dp83867.c ++++ b/drivers/net/phy/dp83867.c +@@ -853,6 +853,14 @@ static int dp83867_config_init(struct phy_device *phydev) + else + val &= ~DP83867_SGMII_TYPE; + phy_write_mmd(phydev, DP83867_DEVADDR, DP83867_SGMIICTL, val); ++ ++ /* This is a SW workaround for link instability if RX_CTRL is ++ * not strapped to mode 3 or 4 in HW. This is required for SGMII ++ * in addition to clearing bit 7, handled above. ++ */ ++ if (dp83867->rxctrl_strap_quirk) ++ phy_set_bits_mmd(phydev, DP83867_DEVADDR, DP83867_CFG4, ++ BIT(8)); + } + + val = phy_read(phydev, DP83867_CFG3); +-- +2.35.1 + diff --git a/queue-6.0/net-phylink-add-mac_managed_pm-in-phylink_config-str.patch b/queue-6.0/net-phylink-add-mac_managed_pm-in-phylink_config-str.patch new file mode 100644 index 00000000000..670b05fc0f9 --- /dev/null +++ b/queue-6.0/net-phylink-add-mac_managed_pm-in-phylink_config-str.patch @@ -0,0 +1,70 @@ +From 871310fd855628d18945016771006ac095831e3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 09:47:28 -0500 +Subject: net: phylink: add mac_managed_pm in phylink_config structure + +From: Shenwei Wang + +[ Upstream commit 96de900ae78e7dbedc937fd91bafe2934579c65a ] + +The recent commit + +'commit 744d23c71af3 ("net: phy: Warn about incorrect +mdio_bus_phy_resume() state")' + +requires the MAC driver explicitly tell the phy driver who is +managing the PM, otherwise you will see warning during resume +stage. + +Add a boolean property in the phylink_config structure so that +the MAC driver can use it to tell the PHY driver if it wants to +manage the PM. + +Fixes: 744d23c71af3 ("net: phy: Warn about incorrect mdio_bus_phy_resume() state") +Signed-off-by: Shenwei Wang +Acked-by: Florian Fainelli +Reviewed-by: Russell King (Oracle) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/phylink.c | 3 +++ + include/linux/phylink.h | 2 ++ + 2 files changed, 5 insertions(+) + +diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c +index 9bd69328dc4d..7bbbe69a7b0a 100644 +--- a/drivers/net/phy/phylink.c ++++ b/drivers/net/phy/phylink.c +@@ -1431,6 +1431,9 @@ static int phylink_bringup_phy(struct phylink *pl, struct phy_device *phy, + if (phy_interrupt_is_valid(phy)) + phy_request_interrupt(phy); + ++ if (pl->config->mac_managed_pm) ++ phy->mac_managed_pm = true; ++ + return 0; + } + +diff --git a/include/linux/phylink.h b/include/linux/phylink.h +index 6d06896fc20d..a3adf7fe7eaf 100644 +--- a/include/linux/phylink.h ++++ b/include/linux/phylink.h +@@ -88,6 +88,7 @@ enum phylink_op_type { + * (See commit 7cceb599d15d ("net: phylink: avoid mac_config calls") + * @poll_fixed_state: if true, starts link_poll, + * if MAC link is at %MLO_AN_FIXED mode. ++ * @mac_managed_pm: if true, indicate the MAC driver is responsible for PHY PM. + * @ovr_an_inband: if true, override PCS to MLO_AN_INBAND + * @get_fixed_state: callback to execute to determine the fixed link state, + * if MAC link is at %MLO_AN_FIXED mode. +@@ -100,6 +101,7 @@ struct phylink_config { + enum phylink_op_type type; + bool legacy_pre_march2020; + bool poll_fixed_state; ++ bool mac_managed_pm; + bool ovr_an_inband; + void (*get_fixed_state)(struct phylink_config *config, + struct phylink_link_state *state); +-- +2.35.1 + diff --git a/queue-6.0/net-sched-cake-fix-null-pointer-access-issue-when-ca.patch b/queue-6.0/net-sched-cake-fix-null-pointer-access-issue-when-ca.patch new file mode 100644 index 00000000000..ed841c20423 --- /dev/null +++ b/queue-6.0/net-sched-cake-fix-null-pointer-access-issue-when-ca.patch @@ -0,0 +1,86 @@ +From 0541c9daf82a9a49d99197cd6fcf79864b19c692 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 14:31:59 +0800 +Subject: net: sched: cake: fix null pointer access issue when cake_init() + fails +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Zhengchao Shao + +[ Upstream commit 51f9a8921ceacd7bf0d3f47fa867a64988ba1dcb ] + +When the default qdisc is cake, if the qdisc of dev_queue fails to be +inited during mqprio_init(), cake_reset() is invoked to clear +resources. In this case, the tins is NULL, and it will cause gpf issue. + +The process is as follows: +qdisc_create_dflt() + cake_init() + q->tins = kvcalloc(...) --->failed, q->tins is NULL + ... + qdisc_put() + ... + cake_reset() + ... + cake_dequeue_one() + b = &q->tins[...] --->q->tins is NULL + +The following is the Call Trace information: +general protection fault, probably for non-canonical address +0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +RIP: 0010:cake_dequeue_one+0xc9/0x3c0 +Call Trace: + +cake_reset+0xb1/0x140 +qdisc_reset+0xed/0x6f0 +qdisc_destroy+0x82/0x4c0 +qdisc_put+0x9e/0xb0 +qdisc_create_dflt+0x2c3/0x4a0 +mqprio_init+0xa71/0x1760 +qdisc_create+0x3eb/0x1000 +tc_modify_qdisc+0x408/0x1720 +rtnetlink_rcv_msg+0x38e/0xac0 +netlink_rcv_skb+0x12d/0x3a0 +netlink_unicast+0x4a2/0x740 +netlink_sendmsg+0x826/0xcc0 +sock_sendmsg+0xc5/0x100 +____sys_sendmsg+0x583/0x690 +___sys_sendmsg+0xe8/0x160 +__sys_sendmsg+0xbf/0x160 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 +RIP: 0033:0x7f89e5122d04 + + +Fixes: 046f6fd5daef ("sched: Add Common Applications Kept Enhanced (cake) qdisc") +Signed-off-by: Zhengchao Shao +Acked-by: Toke Høiland-Jørgensen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_cake.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/sched/sch_cake.c b/net/sched/sch_cake.c +index a43a58a73d09..9530d65e6002 100644 +--- a/net/sched/sch_cake.c ++++ b/net/sched/sch_cake.c +@@ -2224,8 +2224,12 @@ static struct sk_buff *cake_dequeue(struct Qdisc *sch) + + static void cake_reset(struct Qdisc *sch) + { ++ struct cake_sched_data *q = qdisc_priv(sch); + u32 c; + ++ if (!q->tins) ++ return; ++ + for (c = 0; c < CAKE_MAX_TINS; c++) + cake_clear_tin(sch, c); + } +-- +2.35.1 + diff --git a/queue-6.0/net-sched-delete-duplicate-cleanup-of-backlog-and-ql.patch b/queue-6.0/net-sched-delete-duplicate-cleanup-of-backlog-and-ql.patch new file mode 100644 index 00000000000..3f73e8b6ff0 --- /dev/null +++ b/queue-6.0/net-sched-delete-duplicate-cleanup-of-backlog-and-ql.patch @@ -0,0 +1,316 @@ +From d8512eff3903612cd53c8f85fd51a9e34e3fc14d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 24 Aug 2022 08:52:31 +0800 +Subject: net: sched: delete duplicate cleanup of backlog and qlen + +From: Zhengchao Shao + +[ Upstream commit c19d893fbf3f2f8fa864ae39652c7fee939edde2 ] + +qdisc_reset() is clearing qdisc->q.qlen and qdisc->qstats.backlog +_after_ calling qdisc->ops->reset. There is no need to clear them +again in the specific reset function. + +Signed-off-by: Zhengchao Shao +Link: https://lore.kernel.org/r/20220824005231.345727-1-shaozhengchao@huawei.com +Signed-off-by: Paolo Abeni +Stable-dep-of: 2a3fc78210b9 ("net: sched: sfb: fix null pointer access issue when sfb_init() fails") +Signed-off-by: Sasha Levin +--- + include/net/sch_generic.h | 1 - + net/sched/sch_atm.c | 1 - + net/sched/sch_cbq.c | 1 - + net/sched/sch_choke.c | 2 -- + net/sched/sch_drr.c | 2 -- + net/sched/sch_dsmark.c | 2 -- + net/sched/sch_etf.c | 3 --- + net/sched/sch_ets.c | 2 -- + net/sched/sch_fq_codel.c | 2 -- + net/sched/sch_fq_pie.c | 3 --- + net/sched/sch_hfsc.c | 2 -- + net/sched/sch_htb.c | 2 -- + net/sched/sch_multiq.c | 1 - + net/sched/sch_prio.c | 2 -- + net/sched/sch_qfq.c | 2 -- + net/sched/sch_red.c | 2 -- + net/sched/sch_sfb.c | 2 -- + net/sched/sch_skbprio.c | 3 --- + net/sched/sch_taprio.c | 2 -- + net/sched/sch_tbf.c | 2 -- + net/sched/sch_teql.c | 1 - + 21 files changed, 40 deletions(-) + +diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h +index ec693fe7c553..f2958fb5ae08 100644 +--- a/include/net/sch_generic.h ++++ b/include/net/sch_generic.h +@@ -1137,7 +1137,6 @@ static inline void __qdisc_reset_queue(struct qdisc_skb_head *qh) + static inline void qdisc_reset_queue(struct Qdisc *sch) + { + __qdisc_reset_queue(&sch->q); +- sch->qstats.backlog = 0; + } + + static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new, +diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c +index 4c8e994cf0a5..816fd0d7ba38 100644 +--- a/net/sched/sch_atm.c ++++ b/net/sched/sch_atm.c +@@ -577,7 +577,6 @@ static void atm_tc_reset(struct Qdisc *sch) + pr_debug("atm_tc_reset(sch %p,[qdisc %p])\n", sch, p); + list_for_each_entry(flow, &p->flows, list) + qdisc_reset(flow->q); +- sch->q.qlen = 0; + } + + static void atm_tc_destroy(struct Qdisc *sch) +diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c +index 91a0dc463c48..ba99ce05cd52 100644 +--- a/net/sched/sch_cbq.c ++++ b/net/sched/sch_cbq.c +@@ -975,7 +975,6 @@ cbq_reset(struct Qdisc *sch) + cl->cpriority = cl->priority; + } + } +- sch->q.qlen = 0; + } + + +diff --git a/net/sched/sch_choke.c b/net/sched/sch_choke.c +index 2adbd945bf15..25d2daaa8122 100644 +--- a/net/sched/sch_choke.c ++++ b/net/sched/sch_choke.c +@@ -315,8 +315,6 @@ static void choke_reset(struct Qdisc *sch) + rtnl_qdisc_drop(skb, sch); + } + +- sch->q.qlen = 0; +- sch->qstats.backlog = 0; + if (q->tab) + memset(q->tab, 0, (q->tab_mask + 1) * sizeof(struct sk_buff *)); + q->head = q->tail = 0; +diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c +index 18e4f7a0b291..4e5b1cf11b85 100644 +--- a/net/sched/sch_drr.c ++++ b/net/sched/sch_drr.c +@@ -441,8 +441,6 @@ static void drr_reset_qdisc(struct Qdisc *sch) + qdisc_reset(cl->qdisc); + } + } +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + } + + static void drr_destroy_qdisc(struct Qdisc *sch) +diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c +index 4c100d105269..7da6dc38a382 100644 +--- a/net/sched/sch_dsmark.c ++++ b/net/sched/sch_dsmark.c +@@ -409,8 +409,6 @@ static void dsmark_reset(struct Qdisc *sch) + pr_debug("%s(sch %p,[qdisc %p])\n", __func__, sch, p); + if (p->q) + qdisc_reset(p->q); +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + } + + static void dsmark_destroy(struct Qdisc *sch) +diff --git a/net/sched/sch_etf.c b/net/sched/sch_etf.c +index c48f91075b5c..d96103b0e2bf 100644 +--- a/net/sched/sch_etf.c ++++ b/net/sched/sch_etf.c +@@ -445,9 +445,6 @@ static void etf_reset(struct Qdisc *sch) + timesortedlist_clear(sch); + __qdisc_reset_queue(&sch->q); + +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; +- + q->last = 0; + } + +diff --git a/net/sched/sch_ets.c b/net/sched/sch_ets.c +index d73393493553..8de4365886e8 100644 +--- a/net/sched/sch_ets.c ++++ b/net/sched/sch_ets.c +@@ -727,8 +727,6 @@ static void ets_qdisc_reset(struct Qdisc *sch) + } + for (band = 0; band < q->nbands; band++) + qdisc_reset(q->classes[band].qdisc); +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + } + + static void ets_qdisc_destroy(struct Qdisc *sch) +diff --git a/net/sched/sch_fq_codel.c b/net/sched/sch_fq_codel.c +index 839e1235db05..23a042adb74d 100644 +--- a/net/sched/sch_fq_codel.c ++++ b/net/sched/sch_fq_codel.c +@@ -347,8 +347,6 @@ static void fq_codel_reset(struct Qdisc *sch) + codel_vars_init(&flow->cvars); + } + memset(q->backlogs, 0, q->flows_cnt * sizeof(u32)); +- sch->q.qlen = 0; +- sch->qstats.backlog = 0; + q->memory_usage = 0; + } + +diff --git a/net/sched/sch_fq_pie.c b/net/sched/sch_fq_pie.c +index d6aba6edd16e..35c35465226b 100644 +--- a/net/sched/sch_fq_pie.c ++++ b/net/sched/sch_fq_pie.c +@@ -521,9 +521,6 @@ static void fq_pie_reset(struct Qdisc *sch) + INIT_LIST_HEAD(&flow->flowchain); + pie_vars_init(&flow->vars); + } +- +- sch->q.qlen = 0; +- sch->qstats.backlog = 0; + } + + static void fq_pie_destroy(struct Qdisc *sch) +diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c +index d3979a6000e7..03efc40e42fc 100644 +--- a/net/sched/sch_hfsc.c ++++ b/net/sched/sch_hfsc.c +@@ -1484,8 +1484,6 @@ hfsc_reset_qdisc(struct Qdisc *sch) + } + q->eligible = RB_ROOT; + qdisc_watchdog_cancel(&q->watchdog); +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + } + + static void +diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c +index 23a9d6242429..cb5872d22ecf 100644 +--- a/net/sched/sch_htb.c ++++ b/net/sched/sch_htb.c +@@ -1008,8 +1008,6 @@ static void htb_reset(struct Qdisc *sch) + } + qdisc_watchdog_cancel(&q->watchdog); + __qdisc_reset_queue(&q->direct_queue); +- sch->q.qlen = 0; +- sch->qstats.backlog = 0; + memset(q->hlevel, 0, sizeof(q->hlevel)); + memset(q->row_mask, 0, sizeof(q->row_mask)); + } +diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c +index cd8ab90c4765..f28050c7f12d 100644 +--- a/net/sched/sch_multiq.c ++++ b/net/sched/sch_multiq.c +@@ -152,7 +152,6 @@ multiq_reset(struct Qdisc *sch) + + for (band = 0; band < q->bands; band++) + qdisc_reset(q->queues[band]); +- sch->q.qlen = 0; + q->curband = 0; + } + +diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c +index 3b8d7197c06b..c03a11dd990f 100644 +--- a/net/sched/sch_prio.c ++++ b/net/sched/sch_prio.c +@@ -135,8 +135,6 @@ prio_reset(struct Qdisc *sch) + + for (prio = 0; prio < q->bands; prio++) + qdisc_reset(q->queues[prio]); +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + } + + static int prio_offload(struct Qdisc *sch, struct tc_prio_qopt *qopt) +diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c +index d4ce58c90f9f..13246a9dc5c1 100644 +--- a/net/sched/sch_qfq.c ++++ b/net/sched/sch_qfq.c +@@ -1458,8 +1458,6 @@ static void qfq_reset_qdisc(struct Qdisc *sch) + qdisc_reset(cl->qdisc); + } + } +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + } + + static void qfq_destroy_qdisc(struct Qdisc *sch) +diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c +index 40adf1f07a82..f1e013e3f04a 100644 +--- a/net/sched/sch_red.c ++++ b/net/sched/sch_red.c +@@ -176,8 +176,6 @@ static void red_reset(struct Qdisc *sch) + struct red_sched_data *q = qdisc_priv(sch); + + qdisc_reset(q->qdisc); +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + red_restart(&q->vars); + } + +diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c +index 2829455211f8..1be8d04d69dc 100644 +--- a/net/sched/sch_sfb.c ++++ b/net/sched/sch_sfb.c +@@ -456,8 +456,6 @@ static void sfb_reset(struct Qdisc *sch) + struct sfb_sched_data *q = qdisc_priv(sch); + + qdisc_reset(q->qdisc); +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + q->slot = 0; + q->double_buffering = false; + sfb_zero_all_buckets(q); +diff --git a/net/sched/sch_skbprio.c b/net/sched/sch_skbprio.c +index 7a5e4c454715..df72fb83d9c7 100644 +--- a/net/sched/sch_skbprio.c ++++ b/net/sched/sch_skbprio.c +@@ -213,9 +213,6 @@ static void skbprio_reset(struct Qdisc *sch) + struct skbprio_sched_data *q = qdisc_priv(sch); + int prio; + +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; +- + for (prio = 0; prio < SKBPRIO_MAX_PRIORITY; prio++) + __skb_queue_purge(&q->qdiscs[prio]); + +diff --git a/net/sched/sch_taprio.c b/net/sched/sch_taprio.c +index 86675a79da1e..5bffc37022e0 100644 +--- a/net/sched/sch_taprio.c ++++ b/net/sched/sch_taprio.c +@@ -1638,8 +1638,6 @@ static void taprio_reset(struct Qdisc *sch) + if (q->qdiscs[i]) + qdisc_reset(q->qdiscs[i]); + } +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + } + + static void taprio_destroy(struct Qdisc *sch) +diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c +index 36079fdde2cb..e031c1a41ea6 100644 +--- a/net/sched/sch_tbf.c ++++ b/net/sched/sch_tbf.c +@@ -330,8 +330,6 @@ static void tbf_reset(struct Qdisc *sch) + struct tbf_sched_data *q = qdisc_priv(sch); + + qdisc_reset(q->qdisc); +- sch->qstats.backlog = 0; +- sch->q.qlen = 0; + q->t_c = ktime_get_ns(); + q->tokens = q->buffer; + q->ptokens = q->mtu; +diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c +index 6af6b95bdb67..79aaab51cbf5 100644 +--- a/net/sched/sch_teql.c ++++ b/net/sched/sch_teql.c +@@ -124,7 +124,6 @@ teql_reset(struct Qdisc *sch) + struct teql_sched_data *dat = qdisc_priv(sch); + + skb_queue_purge(&dat->q); +- sch->q.qlen = 0; + } + + static void +-- +2.35.1 + diff --git a/queue-6.0/net-sched-fix-race-condition-in-qdisc_graft.patch b/queue-6.0/net-sched-fix-race-condition-in-qdisc_graft.patch new file mode 100644 index 00000000000..62e94c671e5 --- /dev/null +++ b/queue-6.0/net-sched-fix-race-condition-in-qdisc_graft.patch @@ -0,0 +1,265 @@ +From c397c09f228aedeb70a14fe25a1306a68598c5f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 20:32:58 +0000 +Subject: net: sched: fix race condition in qdisc_graft() + +From: Eric Dumazet + +[ Upstream commit ebda44da44f6f309d302522b049f43d6f829f7aa ] + +We had one syzbot report [1] in syzbot queue for a while. +I was waiting for more occurrences and/or a repro but +Dmitry Vyukov spotted the issue right away. + + +qdisc_graft() drops reference to qdisc in notify_and_destroy +while it's still assigned to dev->qdisc + + +Indeed, RCU rules are clear when replacing a data structure. +The visible pointer (dev->qdisc in this case) must be updated +to the new object _before_ RCU grace period is started +(qdisc_put(old) in this case). + +[1] +BUG: KASAN: use-after-free in __tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066 +Read of size 4 at addr ffff88802065e038 by task syz-executor.4/21027 + +CPU: 0 PID: 21027 Comm: syz-executor.4 Not tainted 6.0.0-rc3-syzkaller-00363-g7726d4c3e60b #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 +Call Trace: + +__dump_stack lib/dump_stack.c:88 [inline] +dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 +print_address_description mm/kasan/report.c:317 [inline] +print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 +kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 +__tcf_qdisc_find.part.0+0xa3a/0xac0 net/sched/cls_api.c:1066 +__tcf_qdisc_find net/sched/cls_api.c:1051 [inline] +tc_new_tfilter+0x34f/0x2200 net/sched/cls_api.c:2018 +rtnetlink_rcv_msg+0x955/0xca0 net/core/rtnetlink.c:6081 +netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 +netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] +netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 +netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 +sock_sendmsg_nosec net/socket.c:714 [inline] +sock_sendmsg+0xcf/0x120 net/socket.c:734 +____sys_sendmsg+0x6eb/0x810 net/socket.c:2482 +___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 +__sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd +RIP: 0033:0x7f5efaa89279 +Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 +RSP: 002b:00007f5efbc31168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e +RAX: ffffffffffffffda RBX: 00007f5efab9bf80 RCX: 00007f5efaa89279 +RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005 +RBP: 00007f5efaae32e9 R08: 0000000000000000 R09: 0000000000000000 +R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 +R13: 00007f5efb0cfb1f R14: 00007f5efbc31300 R15: 0000000000022000 + + +Allocated by task 21027: +kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 +kasan_set_track mm/kasan/common.c:45 [inline] +set_alloc_info mm/kasan/common.c:437 [inline] +____kasan_kmalloc mm/kasan/common.c:516 [inline] +____kasan_kmalloc mm/kasan/common.c:475 [inline] +__kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525 +kmalloc_node include/linux/slab.h:623 [inline] +kzalloc_node include/linux/slab.h:744 [inline] +qdisc_alloc+0xb0/0xc50 net/sched/sch_generic.c:938 +qdisc_create_dflt+0x71/0x4a0 net/sched/sch_generic.c:997 +attach_one_default_qdisc net/sched/sch_generic.c:1152 [inline] +netdev_for_each_tx_queue include/linux/netdevice.h:2437 [inline] +attach_default_qdiscs net/sched/sch_generic.c:1170 [inline] +dev_activate+0x760/0xcd0 net/sched/sch_generic.c:1229 +__dev_open+0x393/0x4d0 net/core/dev.c:1441 +__dev_change_flags+0x583/0x750 net/core/dev.c:8556 +rtnl_configure_link+0xee/0x240 net/core/rtnetlink.c:3189 +rtnl_newlink_create net/core/rtnetlink.c:3371 [inline] +__rtnl_newlink+0x10b8/0x17e0 net/core/rtnetlink.c:3580 +rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3593 +rtnetlink_rcv_msg+0x43a/0xca0 net/core/rtnetlink.c:6090 +netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 +netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] +netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 +netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 +sock_sendmsg_nosec net/socket.c:714 [inline] +sock_sendmsg+0xcf/0x120 net/socket.c:734 +____sys_sendmsg+0x6eb/0x810 net/socket.c:2482 +___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 +__sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Freed by task 21020: +kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 +kasan_set_track+0x21/0x30 mm/kasan/common.c:45 +kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 +____kasan_slab_free mm/kasan/common.c:367 [inline] +____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329 +kasan_slab_free include/linux/kasan.h:200 [inline] +slab_free_hook mm/slub.c:1754 [inline] +slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780 +slab_free mm/slub.c:3534 [inline] +kfree+0xe2/0x580 mm/slub.c:4562 +rcu_do_batch kernel/rcu/tree.c:2245 [inline] +rcu_core+0x7b5/0x1890 kernel/rcu/tree.c:2505 +__do_softirq+0x1d3/0x9c6 kernel/softirq.c:571 + +Last potentially related work creation: +kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 +__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 +call_rcu+0x99/0x790 kernel/rcu/tree.c:2793 +qdisc_put+0xcd/0xe0 net/sched/sch_generic.c:1083 +notify_and_destroy net/sched/sch_api.c:1012 [inline] +qdisc_graft+0xeb1/0x1270 net/sched/sch_api.c:1084 +tc_modify_qdisc+0xbb7/0x1a00 net/sched/sch_api.c:1671 +rtnetlink_rcv_msg+0x43a/0xca0 net/core/rtnetlink.c:6090 +netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 +netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] +netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 +netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 +sock_sendmsg_nosec net/socket.c:714 [inline] +sock_sendmsg+0xcf/0x120 net/socket.c:734 +____sys_sendmsg+0x6eb/0x810 net/socket.c:2482 +___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 +__sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Second to last potentially related work creation: +kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 +__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 +kvfree_call_rcu+0x74/0x940 kernel/rcu/tree.c:3322 +neigh_destroy+0x431/0x630 net/core/neighbour.c:912 +neigh_release include/net/neighbour.h:454 [inline] +neigh_cleanup_and_release+0x1f8/0x330 net/core/neighbour.c:103 +neigh_del net/core/neighbour.c:225 [inline] +neigh_remove_one+0x37d/0x460 net/core/neighbour.c:246 +neigh_forced_gc net/core/neighbour.c:276 [inline] +neigh_alloc net/core/neighbour.c:447 [inline] +___neigh_create+0x18b5/0x29a0 net/core/neighbour.c:642 +ip6_finish_output2+0xfb8/0x1520 net/ipv6/ip6_output.c:125 +__ip6_finish_output net/ipv6/ip6_output.c:195 [inline] +ip6_finish_output+0x690/0x1160 net/ipv6/ip6_output.c:206 +NF_HOOK_COND include/linux/netfilter.h:296 [inline] +ip6_output+0x1ed/0x540 net/ipv6/ip6_output.c:227 +dst_output include/net/dst.h:451 [inline] +NF_HOOK include/linux/netfilter.h:307 [inline] +NF_HOOK include/linux/netfilter.h:301 [inline] +mld_sendpack+0xa09/0xe70 net/ipv6/mcast.c:1820 +mld_send_cr net/ipv6/mcast.c:2121 [inline] +mld_ifc_work+0x71c/0xdc0 net/ipv6/mcast.c:2653 +process_one_work+0x991/0x1610 kernel/workqueue.c:2289 +worker_thread+0x665/0x1080 kernel/workqueue.c:2436 +kthread+0x2e4/0x3a0 kernel/kthread.c:376 +ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 + +The buggy address belongs to the object at ffff88802065e000 +which belongs to the cache kmalloc-1k of size 1024 +The buggy address is located 56 bytes inside of +1024-byte region [ffff88802065e000, ffff88802065e400) + +The buggy address belongs to the physical page: +page:ffffea0000819600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20658 +head:ffffea0000819600 order:3 compound_mapcount:0 compound_pincount:0 +flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) +raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888011841dc0 +raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 +page dumped because: kasan: bad access detected +page_owner tracks the page as allocated +page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3523, tgid 3523 (sshd), ts 41495190986, free_ts 41417713212 +prep_new_page mm/page_alloc.c:2532 [inline] +get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283 +__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5515 +alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270 +alloc_slab_page mm/slub.c:1824 [inline] +allocate_slab+0x27e/0x3d0 mm/slub.c:1969 +new_slab mm/slub.c:2029 [inline] +___slab_alloc+0x7f1/0xe10 mm/slub.c:3031 +__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118 +slab_alloc_node mm/slub.c:3209 [inline] +__kmalloc_node_track_caller+0x2f2/0x380 mm/slub.c:4955 +kmalloc_reserve net/core/skbuff.c:358 [inline] +__alloc_skb+0xd9/0x2f0 net/core/skbuff.c:430 +alloc_skb_fclone include/linux/skbuff.h:1307 [inline] +tcp_stream_alloc_skb+0x38/0x580 net/ipv4/tcp.c:861 +tcp_sendmsg_locked+0xc36/0x2f80 net/ipv4/tcp.c:1325 +tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1483 +inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 +sock_sendmsg_nosec net/socket.c:714 [inline] +sock_sendmsg+0xcf/0x120 net/socket.c:734 +sock_write_iter+0x291/0x3d0 net/socket.c:1108 +call_write_iter include/linux/fs.h:2187 [inline] +new_sync_write fs/read_write.c:491 [inline] +vfs_write+0x9e9/0xdd0 fs/read_write.c:578 +ksys_write+0x1e8/0x250 fs/read_write.c:631 +page last free stack trace: +reset_page_owner include/linux/page_owner.h:24 [inline] +free_pages_prepare mm/page_alloc.c:1449 [inline] +free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499 +free_unref_page_prepare mm/page_alloc.c:3380 [inline] +free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476 +__unfreeze_partials+0x17c/0x1a0 mm/slub.c:2548 +qlink_free mm/kasan/quarantine.c:168 [inline] +qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 +kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294 +__kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:447 +kasan_slab_alloc include/linux/kasan.h:224 [inline] +slab_post_alloc_hook mm/slab.h:727 [inline] +slab_alloc_node mm/slub.c:3243 [inline] +slab_alloc mm/slub.c:3251 [inline] +__kmem_cache_alloc_lru mm/slub.c:3258 [inline] +kmem_cache_alloc+0x267/0x3b0 mm/slub.c:3268 +kmem_cache_zalloc include/linux/slab.h:723 [inline] +alloc_buffer_head+0x20/0x140 fs/buffer.c:2974 +alloc_page_buffers+0x280/0x790 fs/buffer.c:829 +create_empty_buffers+0x2c/0xee0 fs/buffer.c:1558 +ext4_block_write_begin+0x1004/0x1530 fs/ext4/inode.c:1074 +ext4_da_write_begin+0x422/0xae0 fs/ext4/inode.c:2996 +generic_perform_write+0x246/0x560 mm/filemap.c:3738 +ext4_buffered_write_iter+0x15b/0x460 fs/ext4/file.c:270 +ext4_file_write_iter+0x44a/0x1660 fs/ext4/file.c:679 +call_write_iter include/linux/fs.h:2187 [inline] +new_sync_write fs/read_write.c:491 [inline] +vfs_write+0x9e9/0xdd0 fs/read_write.c:578 + +Fixes: af356afa010f ("net_sched: reintroduce dev->qdisc for use by sch_api") +Reported-by: syzbot +Diagnosed-by: Dmitry Vyukov +Signed-off-by: Eric Dumazet +Link: https://lore.kernel.org/r/20221018203258.2793282-1-edumazet@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_api.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index bf87b50837a8..67ee8ae3f310 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -1081,12 +1081,13 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent, + + skip: + if (!ingress) { +- notify_and_destroy(net, skb, n, classid, +- rtnl_dereference(dev->qdisc), new); ++ old = rtnl_dereference(dev->qdisc); + if (new && !new->ops->attach) + qdisc_refcount_inc(new); + rcu_assign_pointer(dev->qdisc, new ? : &noop_qdisc); + ++ notify_and_destroy(net, skb, n, classid, old, new); ++ + if (new && new->ops->attach) + new->ops->attach(new); + } else { +-- +2.35.1 + diff --git a/queue-6.0/net-sched-sfb-fix-null-pointer-access-issue-when-sfb.patch b/queue-6.0/net-sched-sfb-fix-null-pointer-access-issue-when-sfb.patch new file mode 100644 index 00000000000..e3aa3fbd269 --- /dev/null +++ b/queue-6.0/net-sched-sfb-fix-null-pointer-access-issue-when-sfb.patch @@ -0,0 +1,77 @@ +From c16088c75fec321d0ff4106e7230e96044d21c0d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 14:32:01 +0800 +Subject: net: sched: sfb: fix null pointer access issue when sfb_init() fails + +From: Zhengchao Shao + +[ Upstream commit 2a3fc78210b9f0e85372a2435368962009f480fc ] + +When the default qdisc is sfb, if the qdisc of dev_queue fails to be +inited during mqprio_init(), sfb_reset() is invoked to clear resources. +In this case, the q->qdisc is NULL, and it will cause gpf issue. + +The process is as follows: +qdisc_create_dflt() + sfb_init() + tcf_block_get() --->failed, q->qdisc is NULL + ... + qdisc_put() + ... + sfb_reset() + qdisc_reset(q->qdisc) --->q->qdisc is NULL + ops = qdisc->ops + +The following is the Call Trace information: +general protection fault, probably for non-canonical address +0xdffffc0000000003: 0000 [#1] PREEMPT SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f] +RIP: 0010:qdisc_reset+0x2b/0x6f0 +Call Trace: + +sfb_reset+0x37/0xd0 +qdisc_reset+0xed/0x6f0 +qdisc_destroy+0x82/0x4c0 +qdisc_put+0x9e/0xb0 +qdisc_create_dflt+0x2c3/0x4a0 +mqprio_init+0xa71/0x1760 +qdisc_create+0x3eb/0x1000 +tc_modify_qdisc+0x408/0x1720 +rtnetlink_rcv_msg+0x38e/0xac0 +netlink_rcv_skb+0x12d/0x3a0 +netlink_unicast+0x4a2/0x740 +netlink_sendmsg+0x826/0xcc0 +sock_sendmsg+0xc5/0x100 +____sys_sendmsg+0x583/0x690 +___sys_sendmsg+0xe8/0x160 +__sys_sendmsg+0xbf/0x160 +do_syscall_64+0x35/0x80 +entry_SYSCALL_64_after_hwframe+0x46/0xb0 +RIP: 0033:0x7f2164122d04 + + +Fixes: e13e02a3c68d ("net_sched: SFB flow scheduler") +Signed-off-by: Zhengchao Shao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/sched/sch_sfb.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c +index 1be8d04d69dc..0490eb5b98de 100644 +--- a/net/sched/sch_sfb.c ++++ b/net/sched/sch_sfb.c +@@ -455,7 +455,8 @@ static void sfb_reset(struct Qdisc *sch) + { + struct sfb_sched_data *q = qdisc_priv(sch); + +- qdisc_reset(q->qdisc); ++ if (likely(q->qdisc)) ++ qdisc_reset(q->qdisc); + q->slot = 0; + q->double_buffering = false; + sfb_zero_all_buckets(q); +-- +2.35.1 + diff --git a/queue-6.0/net-smc-fix-an-error-code-in-smc_lgr_create.patch b/queue-6.0/net-smc-fix-an-error-code-in-smc_lgr_create.patch new file mode 100644 index 00000000000..c5c76114a3e --- /dev/null +++ b/queue-6.0/net-smc-fix-an-error-code-in-smc_lgr_create.patch @@ -0,0 +1,38 @@ +From 02541ea7d59c708e568915a71bb382b0a9c78a83 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 12:34:36 +0300 +Subject: net/smc: Fix an error code in smc_lgr_create() + +From: Dan Carpenter + +[ Upstream commit bdee15e8c58b450ad736a2b62ef8c7a12548b704 ] + +If smc_wr_alloc_lgr_mem() fails then return an error code. Don't return +success. + +Fixes: 8799e310fb3f ("net/smc: add v2 support to the work request layer") +Signed-off-by: Dan Carpenter +Reviewed-by: Wenjia Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/smc/smc_core.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/smc/smc_core.c b/net/smc/smc_core.c +index df89c2e08cbf..828dd3a4126a 100644 +--- a/net/smc/smc_core.c ++++ b/net/smc/smc_core.c +@@ -896,7 +896,8 @@ static int smc_lgr_create(struct smc_sock *smc, struct smc_init_info *ini) + } + memcpy(lgr->pnet_id, ibdev->pnetid[ibport - 1], + SMC_MAX_PNETID_LEN); +- if (smc_wr_alloc_lgr_mem(lgr)) ++ rc = smc_wr_alloc_lgr_mem(lgr); ++ if (rc) + goto free_wq; + smc_llc_lgr_init(lgr, smc); + +-- +2.35.1 + diff --git a/queue-6.0/net-stmmac-enable-mac_managed_pm-phylink-config.patch b/queue-6.0/net-stmmac-enable-mac_managed_pm-phylink-config.patch new file mode 100644 index 00000000000..453e7999709 --- /dev/null +++ b/queue-6.0/net-stmmac-enable-mac_managed_pm-phylink-config.patch @@ -0,0 +1,36 @@ +From 5a58e52a575b7c542d0183cb6735cb38d77445c6 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 09:47:29 -0500 +Subject: net: stmmac: Enable mac_managed_pm phylink config + +From: Shenwei Wang + +[ Upstream commit f151c147b3afcf92dedff53f5f0e965414e4fd2c ] + +Enable the mac_managed_pm configuration in the phylink_config +structure to avoid the kernel warning during system resume. + +Fixes: 744d23c71af3 ("net: phy: Warn about incorrect mdio_bus_phy_resume() state") +Signed-off-by: Shenwei Wang +Acked-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 9083159b93f1..bc060ef558d3 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -1214,6 +1214,7 @@ static int stmmac_phy_setup(struct stmmac_priv *priv) + if (priv->plat->tx_queues_to_use > 1) + priv->phylink_config.mac_capabilities &= + ~(MAC_10HD | MAC_100HD | MAC_1000HD); ++ priv->phylink_config.mac_managed_pm = true; + + phylink = phylink_create(&priv->phylink_config, fwnode, + mode, &stmmac_phylink_mac_ops); +-- +2.35.1 + diff --git a/queue-6.0/netfilter-nf_tables-relax-nfta_set_elem_key_end-set-.patch b/queue-6.0/netfilter-nf_tables-relax-nfta_set_elem_key_end-set-.patch new file mode 100644 index 00000000000..dd592f4cfea --- /dev/null +++ b/queue-6.0/netfilter-nf_tables-relax-nfta_set_elem_key_end-set-.patch @@ -0,0 +1,44 @@ +From 64b8f0353c2fa874adbc023a3c2a25467f060825 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 Oct 2022 14:12:58 +0200 +Subject: netfilter: nf_tables: relax NFTA_SET_ELEM_KEY_END set flags + requirements + +From: Pablo Neira Ayuso + +[ Upstream commit 96df8360dbb435cc69f7c3c8db44bf8b1c24cd7b ] + +Otherwise EINVAL is bogusly reported to userspace when deleting a set +element. NFTA_SET_ELEM_KEY_END does not need to be set in case of: + +- insertion: if not present, start key is used as end key. +- deletion: only start key needs to be specified, end key is ignored. + +Hence, relax the sanity check. + +Fixes: 88cccd908d51 ("netfilter: nf_tables: NFTA_SET_ELEM_KEY_END requires concat and interval flags") +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 63c70141b3e5..5897afd12466 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -5865,8 +5865,9 @@ static bool nft_setelem_valid_key_end(const struct nft_set *set, + (NFT_SET_CONCAT | NFT_SET_INTERVAL)) { + if (flags & NFT_SET_ELEM_INTERVAL_END) + return false; +- if (!nla[NFTA_SET_ELEM_KEY_END] && +- !(flags & NFT_SET_ELEM_CATCHALL)) ++ ++ if (nla[NFTA_SET_ELEM_KEY_END] && ++ flags & NFT_SET_ELEM_CATCHALL) + return false; + } else { + if (nla[NFTA_SET_ELEM_KEY_END]) +-- +2.35.1 + diff --git a/queue-6.0/netfilter-rpfilter-fib-populate-flowic_l3mdev-field.patch b/queue-6.0/netfilter-rpfilter-fib-populate-flowic_l3mdev-field.patch new file mode 100644 index 00000000000..dbe706dbd64 --- /dev/null +++ b/queue-6.0/netfilter-rpfilter-fib-populate-flowic_l3mdev-field.patch @@ -0,0 +1,106 @@ +From 648e8eebd51f4458287af9f5eee7fc34932986ce Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Oct 2022 18:07:05 +0200 +Subject: netfilter: rpfilter/fib: Populate flowic_l3mdev field + +From: Phil Sutter + +[ Upstream commit acc641ab95b66b813c1ce856c377a2bbe71e7f52 ] + +Use the introduced field for correct operation with VRF devices instead +of conditionally overwriting flowic_oif. This is a partial revert of +commit b575b24b8eee3 ("netfilter: Fix rpfilter dropping vrf packets by +mistake"), implementing a simpler solution. + +Signed-off-by: Phil Sutter +Reviewed-by: David Ahern +Reviewed-by: Guillaume Nault +Signed-off-by: Florian Westphal +Stable-dep-of: 1fcc064b305a ("netfilter: rpfilter/fib: Set ->flowic_uid correctly for user namespaces.") +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/ipt_rpfilter.c | 2 +- + net/ipv4/netfilter/nft_fib_ipv4.c | 2 +- + net/ipv6/netfilter/ip6t_rpfilter.c | 9 +++------ + net/ipv6/netfilter/nft_fib_ipv6.c | 5 ++--- + 4 files changed, 7 insertions(+), 11 deletions(-) + +diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c +index 8cd3224d913e..63f3e8219dd5 100644 +--- a/net/ipv4/netfilter/ipt_rpfilter.c ++++ b/net/ipv4/netfilter/ipt_rpfilter.c +@@ -78,7 +78,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) + flow.flowi4_mark = info->flags & XT_RPFILTER_VALID_MARK ? skb->mark : 0; + flow.flowi4_tos = iph->tos & IPTOS_RT_MASK; + flow.flowi4_scope = RT_SCOPE_UNIVERSE; +- flow.flowi4_oif = l3mdev_master_ifindex_rcu(xt_in(par)); ++ flow.flowi4_l3mdev = l3mdev_master_ifindex_rcu(xt_in(par)); + + return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert; + } +diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c +index 7ade04ff972d..e886147eed11 100644 +--- a/net/ipv4/netfilter/nft_fib_ipv4.c ++++ b/net/ipv4/netfilter/nft_fib_ipv4.c +@@ -84,7 +84,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, + oif = NULL; + + if (priv->flags & NFTA_FIB_F_IIF) +- fl4.flowi4_oif = l3mdev_master_ifindex_rcu(oif); ++ fl4.flowi4_l3mdev = l3mdev_master_ifindex_rcu(oif); + + if (nft_hook(pkt) == NF_INET_PRE_ROUTING && + nft_fib_is_loopback(pkt->skb, nft_in(pkt))) { +diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c +index d800801a5dd2..69d86b040a6a 100644 +--- a/net/ipv6/netfilter/ip6t_rpfilter.c ++++ b/net/ipv6/netfilter/ip6t_rpfilter.c +@@ -37,6 +37,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + bool ret = false; + struct flowi6 fl6 = { + .flowi6_iif = LOOPBACK_IFINDEX, ++ .flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev), + .flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK, + .flowi6_proto = iph->nexthdr, + .daddr = iph->saddr, +@@ -55,9 +56,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + if (rpfilter_addr_linklocal(&iph->saddr)) { + lookup_flags |= RT6_LOOKUP_F_IFACE; + fl6.flowi6_oif = dev->ifindex; +- /* Set flowi6_oif for vrf devices to lookup route in l3mdev domain. */ +- } else if (netif_is_l3_master(dev) || netif_is_l3_slave(dev) || +- (flags & XT_RPFILTER_LOOSE) == 0) ++ } else if ((flags & XT_RPFILTER_LOOSE) == 0) + fl6.flowi6_oif = dev->ifindex; + + rt = (void *)ip6_route_lookup(net, &fl6, skb, lookup_flags); +@@ -72,9 +71,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + goto out; + } + +- if (rt->rt6i_idev->dev == dev || +- l3mdev_master_ifindex_rcu(rt->rt6i_idev->dev) == dev->ifindex || +- (flags & XT_RPFILTER_LOOSE)) ++ if (rt->rt6i_idev->dev == dev || (flags & XT_RPFILTER_LOOSE)) + ret = true; + out: + ip6_rt_put(rt); +diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c +index 1d7e520d9966..91faac610e03 100644 +--- a/net/ipv6/netfilter/nft_fib_ipv6.c ++++ b/net/ipv6/netfilter/nft_fib_ipv6.c +@@ -41,9 +41,8 @@ static int nft_fib6_flowi_init(struct flowi6 *fl6, const struct nft_fib *priv, + if (ipv6_addr_type(&fl6->daddr) & IPV6_ADDR_LINKLOCAL) { + lookup_flags |= RT6_LOOKUP_F_IFACE; + fl6->flowi6_oif = get_ifindex(dev ? dev : pkt->skb->dev); +- } else if ((priv->flags & NFTA_FIB_F_IIF) && +- (netif_is_l3_master(dev) || netif_is_l3_slave(dev))) { +- fl6->flowi6_oif = dev->ifindex; ++ } else if (priv->flags & NFTA_FIB_F_IIF) { ++ fl6->flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev); + } + + if (ipv6_addr_type(&fl6->saddr) & IPV6_ADDR_UNICAST) +-- +2.35.1 + diff --git a/queue-6.0/netfilter-rpfilter-fib-set-flowic_uid-correctly-for-.patch b/queue-6.0/netfilter-rpfilter-fib-set-flowic_uid-correctly-for-.patch new file mode 100644 index 00000000000..32c5bd86dd0 --- /dev/null +++ b/queue-6.0/netfilter-rpfilter-fib-set-flowic_uid-correctly-for-.patch @@ -0,0 +1,90 @@ +From 952583260d0a2d579c0f86b15b02e62020027479 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 16:37:47 +0200 +Subject: netfilter: rpfilter/fib: Set ->flowic_uid correctly for user + namespaces. + +From: Guillaume Nault + +[ Upstream commit 1fcc064b305a1aadeff0d4bff961094d27660acd ] + +Currently netfilter's rpfilter and fib modules implicitely initialise +->flowic_uid with 0. This is normally the root UID. However, this isn't +the case in user namespaces, where user ID 0 is mapped to a different +kernel UID. By initialising ->flowic_uid with sock_net_uid(), we get +the root UID of the user namespace, thus keeping the same behaviour +whether or not we're running in a user namepspace. + +Note, this is similar to commit 8bcfd0925ef1 ("ipv4: add missing +initialization for flowi4_uid"), which fixed the rp_filter sysctl. + +Fixes: 622ec2c9d524 ("net: core: add UID to flows, rules, and routes") +Signed-off-by: Guillaume Nault +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Sasha Levin +--- + net/ipv4/netfilter/ipt_rpfilter.c | 1 + + net/ipv4/netfilter/nft_fib_ipv4.c | 1 + + net/ipv6/netfilter/ip6t_rpfilter.c | 1 + + net/ipv6/netfilter/nft_fib_ipv6.c | 2 ++ + 4 files changed, 5 insertions(+) + +diff --git a/net/ipv4/netfilter/ipt_rpfilter.c b/net/ipv4/netfilter/ipt_rpfilter.c +index 63f3e8219dd5..26b3b0e2adcd 100644 +--- a/net/ipv4/netfilter/ipt_rpfilter.c ++++ b/net/ipv4/netfilter/ipt_rpfilter.c +@@ -79,6 +79,7 @@ static bool rpfilter_mt(const struct sk_buff *skb, struct xt_action_param *par) + flow.flowi4_tos = iph->tos & IPTOS_RT_MASK; + flow.flowi4_scope = RT_SCOPE_UNIVERSE; + flow.flowi4_l3mdev = l3mdev_master_ifindex_rcu(xt_in(par)); ++ flow.flowi4_uid = sock_net_uid(xt_net(par), NULL); + + return rpfilter_lookup_reverse(xt_net(par), &flow, xt_in(par), info->flags) ^ invert; + } +diff --git a/net/ipv4/netfilter/nft_fib_ipv4.c b/net/ipv4/netfilter/nft_fib_ipv4.c +index e886147eed11..fc65d69f23e1 100644 +--- a/net/ipv4/netfilter/nft_fib_ipv4.c ++++ b/net/ipv4/netfilter/nft_fib_ipv4.c +@@ -65,6 +65,7 @@ void nft_fib4_eval(const struct nft_expr *expr, struct nft_regs *regs, + struct flowi4 fl4 = { + .flowi4_scope = RT_SCOPE_UNIVERSE, + .flowi4_iif = LOOPBACK_IFINDEX, ++ .flowi4_uid = sock_net_uid(nft_net(pkt), NULL), + }; + const struct net_device *oif; + const struct net_device *found; +diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c +index 69d86b040a6a..a01d9b842bd0 100644 +--- a/net/ipv6/netfilter/ip6t_rpfilter.c ++++ b/net/ipv6/netfilter/ip6t_rpfilter.c +@@ -40,6 +40,7 @@ static bool rpfilter_lookup_reverse6(struct net *net, const struct sk_buff *skb, + .flowi6_l3mdev = l3mdev_master_ifindex_rcu(dev), + .flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK, + .flowi6_proto = iph->nexthdr, ++ .flowi6_uid = sock_net_uid(net, NULL), + .daddr = iph->saddr, + }; + int lookup_flags; +diff --git a/net/ipv6/netfilter/nft_fib_ipv6.c b/net/ipv6/netfilter/nft_fib_ipv6.c +index 91faac610e03..36dc14b34388 100644 +--- a/net/ipv6/netfilter/nft_fib_ipv6.c ++++ b/net/ipv6/netfilter/nft_fib_ipv6.c +@@ -66,6 +66,7 @@ static u32 __nft_fib6_eval_type(const struct nft_fib *priv, + struct flowi6 fl6 = { + .flowi6_iif = LOOPBACK_IFINDEX, + .flowi6_proto = pkt->tprot, ++ .flowi6_uid = sock_net_uid(nft_net(pkt), NULL), + }; + u32 ret = 0; + +@@ -163,6 +164,7 @@ void nft_fib6_eval(const struct nft_expr *expr, struct nft_regs *regs, + struct flowi6 fl6 = { + .flowi6_iif = LOOPBACK_IFINDEX, + .flowi6_proto = pkt->tprot, ++ .flowi6_uid = sock_net_uid(nft_net(pkt), NULL), + }; + struct rt6_info *rt; + int lookup_flags; +-- +2.35.1 + diff --git a/queue-6.0/nvme-hwmon-consistently-ignore-errors-from-nvme_hwmo.patch b/queue-6.0/nvme-hwmon-consistently-ignore-errors-from-nvme_hwmo.patch new file mode 100644 index 00000000000..57eff274322 --- /dev/null +++ b/queue-6.0/nvme-hwmon-consistently-ignore-errors-from-nvme_hwmo.patch @@ -0,0 +1,85 @@ +From 1e020c41ac318b8933657c2aa73edc86abb6bff1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 16:55:55 +0200 +Subject: nvme-hwmon: consistently ignore errors from nvme_hwmon_init + +From: Christoph Hellwig + +[ Upstream commit 6b8cf94005187952f794c0c4ed3920a1e8accfa3 ] + +An NVMe controller works perfectly fine even when the hwmon +initialization fails. Stop returning errors that do not come from a +controller reset from nvme_hwmon_init to handle this case consistently. + +Signed-off-by: Christoph Hellwig +Reviewed-by: Guenter Roeck +Reviewed-by: Serge Semin +Stable-dep-of: c94b7f9bab22 ("nvme-hwmon: kmalloc the NVME SMART log buffer") +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/core.c | 6 +++++- + drivers/nvme/host/hwmon.c | 13 ++++++++----- + 2 files changed, 13 insertions(+), 6 deletions(-) + +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 59e4b188fc71..ed47c256dbd2 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -3256,8 +3256,12 @@ int nvme_init_ctrl_finish(struct nvme_ctrl *ctrl) + return ret; + + if (!ctrl->identified && !nvme_discovery_ctrl(ctrl)) { ++ /* ++ * Do not return errors unless we are in a controller reset, ++ * the controller works perfectly fine without hwmon. ++ */ + ret = nvme_hwmon_init(ctrl); +- if (ret < 0) ++ if (ret == -EINTR) + return ret; + } + +diff --git a/drivers/nvme/host/hwmon.c b/drivers/nvme/host/hwmon.c +index 0a586d712920..23918bb7bdca 100644 +--- a/drivers/nvme/host/hwmon.c ++++ b/drivers/nvme/host/hwmon.c +@@ -230,7 +230,7 @@ int nvme_hwmon_init(struct nvme_ctrl *ctrl) + + data = kzalloc(sizeof(*data), GFP_KERNEL); + if (!data) +- return 0; ++ return -ENOMEM; + + data->ctrl = ctrl; + mutex_init(&data->read_lock); +@@ -238,8 +238,7 @@ int nvme_hwmon_init(struct nvme_ctrl *ctrl) + err = nvme_hwmon_get_smart_log(data); + if (err) { + dev_warn(dev, "Failed to read smart log (error %d)\n", err); +- kfree(data); +- return err; ++ goto err_free_data; + } + + hwmon = hwmon_device_register_with_info(dev, "nvme", +@@ -247,11 +246,15 @@ int nvme_hwmon_init(struct nvme_ctrl *ctrl) + NULL); + if (IS_ERR(hwmon)) { + dev_warn(dev, "Failed to instantiate hwmon device\n"); +- kfree(data); +- return PTR_ERR(hwmon); ++ err = PTR_ERR(hwmon); ++ goto err_free_data; + } + ctrl->hwmon_device = hwmon; + return 0; ++ ++err_free_data: ++ kfree(data); ++ return err; + } + + void nvme_hwmon_exit(struct nvme_ctrl *ctrl) +-- +2.35.1 + diff --git a/queue-6.0/nvme-hwmon-kmalloc-the-nvme-smart-log-buffer.patch b/queue-6.0/nvme-hwmon-kmalloc-the-nvme-smart-log-buffer.patch new file mode 100644 index 00000000000..dbe5b4b022a --- /dev/null +++ b/queue-6.0/nvme-hwmon-kmalloc-the-nvme-smart-log-buffer.patch @@ -0,0 +1,144 @@ +From 126eb767c837cce1b5f8d07d87cac5d3518184f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 17:33:52 +0200 +Subject: nvme-hwmon: kmalloc the NVME SMART log buffer + +From: Serge Semin + +[ Upstream commit c94b7f9bab22ac504f9153767676e659988575ad ] + +Recent commit 52fde2c07da6 ("nvme: set dma alignment to dword") has +caused a regression on our platform. + +It turned out that the nvme_get_log() method invocation caused the +nvme_hwmon_data structure instance corruption. In particular the +nvme_hwmon_data.ctrl pointer was overwritten either with zeros or with +garbage. After some research we discovered that the problem happened +even before the actual NVME DMA execution, but during the buffer mapping. +Since our platform is DMA-noncoherent, the mapping implied the cache-line +invalidations or write-backs depending on the DMA-direction parameter. +In case of the NVME SMART log getting the DMA was performed +from-device-to-memory, thus the cache-invalidation was activated during +the buffer mapping. Since the log-buffer isn't cache-line aligned, the +cache-invalidation caused the neighbour data to be discarded. The +neighbouring data turned to be the data surrounding the buffer in the +framework of the nvme_hwmon_data structure. + +In order to fix that we need to make sure that the whole log-buffer is +defined within the cache-line-aligned memory region so the +cache-invalidation procedure wouldn't involve the adjacent data. One of +the option to guarantee that is to kmalloc the DMA-buffer [1]. Seeing the +rest of the NVME core driver prefer that method it has been chosen to fix +this problem too. + +Note after a deeper researches we found out that the denoted commit wasn't +a root cause of the problem. It just revealed the invalidity by activating +the DMA-based NVME SMART log getting performed in the framework of the +NVME hwmon driver. The problem was here since the initial commit of the +driver. + +[1] Documentation/core-api/dma-api-howto.rst + +Fixes: 400b6a7b13a3 ("nvme: Add hardware monitoring support") +Signed-off-by: Serge Semin +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/host/hwmon.c | 23 ++++++++++++++++------- + 1 file changed, 16 insertions(+), 7 deletions(-) + +diff --git a/drivers/nvme/host/hwmon.c b/drivers/nvme/host/hwmon.c +index 23918bb7bdca..9e6e56c20ec9 100644 +--- a/drivers/nvme/host/hwmon.c ++++ b/drivers/nvme/host/hwmon.c +@@ -12,7 +12,7 @@ + + struct nvme_hwmon_data { + struct nvme_ctrl *ctrl; +- struct nvme_smart_log log; ++ struct nvme_smart_log *log; + struct mutex read_lock; + }; + +@@ -60,14 +60,14 @@ static int nvme_set_temp_thresh(struct nvme_ctrl *ctrl, int sensor, bool under, + static int nvme_hwmon_get_smart_log(struct nvme_hwmon_data *data) + { + return nvme_get_log(data->ctrl, NVME_NSID_ALL, NVME_LOG_SMART, 0, +- NVME_CSI_NVM, &data->log, sizeof(data->log), 0); ++ NVME_CSI_NVM, data->log, sizeof(*data->log), 0); + } + + static int nvme_hwmon_read(struct device *dev, enum hwmon_sensor_types type, + u32 attr, int channel, long *val) + { + struct nvme_hwmon_data *data = dev_get_drvdata(dev); +- struct nvme_smart_log *log = &data->log; ++ struct nvme_smart_log *log = data->log; + int temp; + int err; + +@@ -163,7 +163,7 @@ static umode_t nvme_hwmon_is_visible(const void *_data, + case hwmon_temp_max: + case hwmon_temp_min: + if ((!channel && data->ctrl->wctemp) || +- (channel && data->log.temp_sensor[channel - 1])) { ++ (channel && data->log->temp_sensor[channel - 1])) { + if (data->ctrl->quirks & + NVME_QUIRK_NO_TEMP_THRESH_CHANGE) + return 0444; +@@ -176,7 +176,7 @@ static umode_t nvme_hwmon_is_visible(const void *_data, + break; + case hwmon_temp_input: + case hwmon_temp_label: +- if (!channel || data->log.temp_sensor[channel - 1]) ++ if (!channel || data->log->temp_sensor[channel - 1]) + return 0444; + break; + default: +@@ -232,13 +232,19 @@ int nvme_hwmon_init(struct nvme_ctrl *ctrl) + if (!data) + return -ENOMEM; + ++ data->log = kzalloc(sizeof(*data->log), GFP_KERNEL); ++ if (!data->log) { ++ err = -ENOMEM; ++ goto err_free_data; ++ } ++ + data->ctrl = ctrl; + mutex_init(&data->read_lock); + + err = nvme_hwmon_get_smart_log(data); + if (err) { + dev_warn(dev, "Failed to read smart log (error %d)\n", err); +- goto err_free_data; ++ goto err_free_log; + } + + hwmon = hwmon_device_register_with_info(dev, "nvme", +@@ -247,11 +253,13 @@ int nvme_hwmon_init(struct nvme_ctrl *ctrl) + if (IS_ERR(hwmon)) { + dev_warn(dev, "Failed to instantiate hwmon device\n"); + err = PTR_ERR(hwmon); +- goto err_free_data; ++ goto err_free_log; + } + ctrl->hwmon_device = hwmon; + return 0; + ++err_free_log: ++ kfree(data->log); + err_free_data: + kfree(data); + return err; +@@ -265,6 +273,7 @@ void nvme_hwmon_exit(struct nvme_ctrl *ctrl) + + hwmon_device_unregister(ctrl->hwmon_device); + ctrl->hwmon_device = NULL; ++ kfree(data->log); + kfree(data); + } + } +-- +2.35.1 + diff --git a/queue-6.0/nvmet-fix-workqueue-mem_reclaim-flushing-dependency.patch b/queue-6.0/nvmet-fix-workqueue-mem_reclaim-flushing-dependency.patch new file mode 100644 index 00000000000..78c382a13c3 --- /dev/null +++ b/queue-6.0/nvmet-fix-workqueue-mem_reclaim-flushing-dependency.patch @@ -0,0 +1,46 @@ +From effb487005884640b39f1096bd4c5cce74b7052b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 28 Sep 2022 09:39:10 +0300 +Subject: nvmet: fix workqueue MEM_RECLAIM flushing dependency + +From: Sagi Grimberg + +[ Upstream commit ddd2b8de9f85b388925e7dc46b3890fc1a0d8d24 ] + +The keep alive timer needs to stay on nvmet_wq, and not +modified to reschedule on the system_wq. + +This fixes a warning: +------------[ cut here ]------------ +workqueue: WQ_MEM_RECLAIM +nvmet-wq:nvmet_rdma_release_queue_work [nvmet_rdma] is flushing +!WQ_MEM_RECLAIM events:nvmet_keep_alive_timer [nvmet] +WARNING: CPU: 3 PID: 1086 at kernel/workqueue.c:2628 +check_flush_dependency+0x16c/0x1e0 + +Reported-by: Yi Zhang +Fixes: 8832cf922151 ("nvmet: use a private workqueue instead of the system workqueue") +Signed-off-by: Sagi Grimberg +Reviewed-by: Chaitanya Kulkarni +Signed-off-by: Christoph Hellwig +Signed-off-by: Sasha Levin +--- + drivers/nvme/target/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/nvme/target/core.c b/drivers/nvme/target/core.c +index 14677145bbba..aecb5853f8da 100644 +--- a/drivers/nvme/target/core.c ++++ b/drivers/nvme/target/core.c +@@ -1176,7 +1176,7 @@ static void nvmet_start_ctrl(struct nvmet_ctrl *ctrl) + * reset the keep alive timer when the controller is enabled. + */ + if (ctrl->kato) +- mod_delayed_work(system_wq, &ctrl->ka_work, ctrl->kato * HZ); ++ mod_delayed_work(nvmet_wq, &ctrl->ka_work, ctrl->kato * HZ); + } + + static void nvmet_clear_ctrl(struct nvmet_ctrl *ctrl) +-- +2.35.1 + diff --git a/queue-6.0/rv-dot2c-make-automaton-definition-static.patch b/queue-6.0/rv-dot2c-make-automaton-definition-static.patch new file mode 100644 index 00000000000..d0cdbf5d727 --- /dev/null +++ b/queue-6.0/rv-dot2c-make-automaton-definition-static.patch @@ -0,0 +1,42 @@ +From 0174f562e0ab15929099338df3d5d768bea8caa1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 23 Aug 2022 17:20:28 +0200 +Subject: rv/dot2c: Make automaton definition static + +From: Daniel Bristot de Oliveira + +[ Upstream commit 21a1994b6492b12e55dbf39d15271430ef6839f0 ] + +Monitor's automata definition is only used locally, so make dot2c generate +a static definition. + +Link: https://lore.kernel.org/all/202208210332.gtHXje45-lkp@intel.com +Link: https://lore.kernel.org/all/202208210358.6HH3OrVs-lkp@intel.com +Link: https://lkml.kernel.org/r/ffbb92010f643307766c9307fd42f416e5b85fa0.1661266564.git.bristot@kernel.org + +Cc: Steven Rostedt +Fixes: e3c9fc78f096 ("tools/rv: Add dot2c") +Reported-by: kernel test robot +Signed-off-by: Daniel Bristot de Oliveira +Signed-off-by: Steven Rostedt (Google) +Signed-off-by: Sasha Levin +--- + tools/verification/dot2/dot2c.py | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/tools/verification/dot2/dot2c.py b/tools/verification/dot2/dot2c.py +index fa73353f7e56..be8a364a469b 100644 +--- a/tools/verification/dot2/dot2c.py ++++ b/tools/verification/dot2/dot2c.py +@@ -111,7 +111,7 @@ class Dot2c(Automata): + + def format_aut_init_header(self): + buff = [] +- buff.append("struct %s %s = {" % (self.struct_automaton_def, self.var_automaton_def)) ++ buff.append("static struct %s %s = {" % (self.struct_automaton_def, self.var_automaton_def)) + return buff + + def __get_string_vector_per_line_content(self, buff): +-- +2.35.1 + diff --git a/queue-6.0/scsi-lpfc-fix-memory-leak-in-lpfc_create_port.patch b/queue-6.0/scsi-lpfc-fix-memory-leak-in-lpfc_create_port.patch new file mode 100644 index 00000000000..190c12e58c3 --- /dev/null +++ b/queue-6.0/scsi-lpfc-fix-memory-leak-in-lpfc_create_port.patch @@ -0,0 +1,67 @@ +From 399aa54050416cdb805f4acac49ee1e79878bee4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Sep 2022 00:59:07 -0300 +Subject: scsi: lpfc: Fix memory leak in lpfc_create_port() + +From: Rafael Mendonca + +[ Upstream commit dc8e483f684a24cc06e1d5fa958b54db58855093 ] + +Commit 5e633302ace1 ("scsi: lpfc: vmid: Add support for VMID in mailbox +command") introduced allocations for the VMID resources in +lpfc_create_port() after the call to scsi_host_alloc(). Upon failure on the +VMID allocations, the new code would branch to the 'out' label, which +returns NULL without unwinding anything, thus skipping the call to +scsi_host_put(). + +Fix the problem by creating a separate label 'out_free_vmid' to unwind the +VMID resources and make the 'out_put_shost' label call only +scsi_host_put(), as was done before the introduction of allocations for +VMID. + +Fixes: 5e633302ace1 ("scsi: lpfc: vmid: Add support for VMID in mailbox command") +Signed-off-by: Rafael Mendonca +Link: https://lore.kernel.org/r/20220916035908.712799-1-rafaelmendsr@gmail.com +Reviewed-by: James Smart +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/lpfc/lpfc_init.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/scsi/lpfc/lpfc_init.c b/drivers/scsi/lpfc/lpfc_init.c +index 1a02134438fc..47e210095315 100644 +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -4822,7 +4822,7 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev) + rc = lpfc_vmid_res_alloc(phba, vport); + + if (rc) +- goto out; ++ goto out_put_shost; + + /* Initialize all internally managed lists. */ + INIT_LIST_HEAD(&vport->fc_nodes); +@@ -4840,16 +4840,17 @@ lpfc_create_port(struct lpfc_hba *phba, int instance, struct device *dev) + + error = scsi_add_host_with_dma(shost, dev, &phba->pcidev->dev); + if (error) +- goto out_put_shost; ++ goto out_free_vmid; + + spin_lock_irq(&phba->port_list_lock); + list_add_tail(&vport->listentry, &phba->port_list); + spin_unlock_irq(&phba->port_list_lock); + return vport; + +-out_put_shost: ++out_free_vmid: + kfree(vport->vmid); + bitmap_free(vport->vmid_priority_range); ++out_put_shost: + scsi_host_put(shost); + out: + return NULL; +-- +2.35.1 + diff --git a/queue-6.0/series b/queue-6.0/series index 281a626949e..0699f71d9f3 100644 --- a/queue-6.0/series +++ b/queue-6.0/series @@ -27,3 +27,69 @@ x86-topology-fix-multiple-packages-shown-on-a-single-package-system.patch x86-topology-fix-duplicated-core-id-within-a-package.patch platform-x86-amd-pmc-read-smu-version-during-suspend-on-cezanne-systems.patch dm-bufio-use-the-acquire-memory-barrier-when-testing-for-b_reading.patch +btrfs-fix-processing-of-delayed-data-refs-during-bac.patch +btrfs-fix-processing-of-delayed-tree-block-refs-duri.patch +drm-vc4-add-module-dependency-on-hdmi-codec.patch +drm-vc4-hdmi-enforce-the-minimum-rate-at-runtime_res.patch +acpi-extlog-handle-multiple-records.patch +tipc-fix-recognition-of-trial-period.patch +tipc-fix-an-information-leak-in-tipc_topsrv_kern_sub.patch +net-dsa-qca8k-fix-inband-mgmt-for-big-endian-systems.patch +net-dsa-qca8k-fix-ethtool-autocast-mib-for-big-endia.patch +i40e-fix-dma-mappings-leak.patch +tls-strp-make-sure-the-tcp-skbs-do-not-have-overlapp.patch +hid-magicmouse-do-not-set-btn_mouse-on-double-report.patch +sfc-change-vf-mac-via-pf-as-first-preference-if-avai.patch +net-atm-fix-proc_mpc_write-incorrect-return-value.patch +net-phy-dp83867-extend-rx-strap-quirk-for-sgmii-mode.patch +net-smc-fix-an-error-code-in-smc_lgr_create.patch +net-phylink-add-mac_managed_pm-in-phylink_config-str.patch +net-stmmac-enable-mac_managed_pm-phylink-config.patch +skmsg-pass-gfp-argument-to-alloc_sk_msg.patch +erofs-shouldn-t-churn-the-mapping-page-for-duplicate.patch +blk-mq-fix-null-pointer-dereference-in-blk_mq_clear_.patch +io_uring-rw-remove-leftover-debug-statement.patch +net-ethernet-mtk_eth_soc-fix-possible-memory-leak-in.patch +net-ethernet-mtk_eth_wed-add-missing-put_device-in-m.patch +net-ethernet-mtk_eth_wed-add-missing-of_node_put.patch +scsi-lpfc-fix-memory-leak-in-lpfc_create_port.patch +udp-update-reuse-has_conns-under-reuseport_lock.patch +ip6mr-fix-uaf-issue-in-ip6mr_sk_done-when-addrconf_i.patch +cifs-fix-xid-leak-in-cifs_create.patch +cifs-fix-xid-leak-in-cifs_copy_file_range.patch +cifs-fix-xid-leak-in-cifs_flock.patch +cifs-fix-xid-leak-in-cifs_ses_add_channel.patch +cifs-fix-memory-leak-when-build-ntlmssp-negotiate-bl.patch +dm-remove-unnecessary-assignment-statement-in-alloc_.patch +drm-amd-display-increase-frame-size-limit-for-displa.patch +bnxt_en-fix-memory-leak-in-bnxt_nvm_test.patch +net-hsr-avoid-possible-null-deref-in-skb_clone.patch +ionic-catch-null-pointer-issue-on-reconfig.patch +netfilter-rpfilter-fib-populate-flowic_l3mdev-field.patch +netfilter-rpfilter-fib-set-flowic_uid-correctly-for-.patch +netfilter-nf_tables-relax-nfta_set_elem_key_end-set-.patch +nvme-hwmon-consistently-ignore-errors-from-nvme_hwmo.patch +nvme-hwmon-kmalloc-the-nvme-smart-log-buffer.patch +nvmet-fix-workqueue-mem_reclaim-flushing-dependency.patch +net-sched-cake-fix-null-pointer-access-issue-when-ca.patch +net-sched-delete-duplicate-cleanup-of-backlog-and-ql.patch +net-sched-sfb-fix-null-pointer-access-issue-when-sfb.patch +net-fix-return-value-of-qdisc-ingress-handling-on-su.patch +io_uring-msg_ring-fix-null-pointer-dereference-in-io.patch +sfc-include-vport_id-in-filter-spec-hash-and-equal.patch +wwan_hwsim-fix-possible-memory-leak-in-wwan_hwsim_de.patch +net-hns-fix-possible-memory-leak-in-hnae_ae_register.patch +net-sched-fix-race-condition-in-qdisc_graft.patch +net-phy-dp83822-disable-mdi-crossover-status-change-.patch +drbd-only-clone-bio-if-we-have-a-backing-device.patch +rv-dot2c-make-automaton-definition-static.patch +iommu-vt-d-allow-nvs-regions-in-arch_rmrr_sanity_che.patch +iommu-vt-d-clean-up-si_domain-in-the-init_dmars-erro.patch +wifi-mt76-connac-introduce-mt76_connac_reg_map-struc.patch +wifi-mt76-mt7921e-fix-random-fw-download-fail.patch +usb-add-reset_resume-quirk-for-nvidia-jetson-devices.patch +kernfs-fix-use-after-free-in-__kernfs_remove.patch +io_uring-don-t-gate-task_work-run-on-tif_notify_sign.patch +ext4-introduce-ext4_fc_tag_base_len-helper.patch +ext4-factor-out-ext4_fc_get_tl.patch +ext4-fix-potential-out-of-bound-read-in-ext4_fc_repl.patch diff --git a/queue-6.0/sfc-change-vf-mac-via-pf-as-first-preference-if-avai.patch b/queue-6.0/sfc-change-vf-mac-via-pf-as-first-preference-if-avai.patch new file mode 100644 index 00000000000..0a0f49acd3c --- /dev/null +++ b/queue-6.0/sfc-change-vf-mac-via-pf-as-first-preference-if-avai.patch @@ -0,0 +1,128 @@ +From f3d7231ce3d080133179627f2b0e211316f4172d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Oct 2022 10:55:53 +0100 +Subject: sfc: Change VF mac via PF as first preference if available. +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Jonathan Cooper + +[ Upstream commit a8aed7b35becfd21f22a77c7014029ea837b018f ] + +Changing a VF's mac address through the VF (rather than via the PF) +fails with EPERM because the latter part of efx_ef10_set_mac_address +attempts to change the vport mac address list as the VF. +Even with this fixed it still fails with EBUSY because the vadaptor +is still assigned on the VF - the vadaptor reassignment must be within +a section where the VF has torn down its state. + +A major reason this has broken is because we have two functions that +ostensibly do the same thing - have a PF and VF cooperate to change a +VF mac address. Rather than do this, if we are changing the mac of a VF +that has a link to the PF in the same VM then simply call +sriov_set_vf_mac instead, which is a proven working function that does +that. + +If there is no PF available, or that fails non-fatally, then attempt to +change the VF's mac address as we would a PF, without updating the PF's +data. + +Test case: +Create a VF: + echo 1 > /sys/class/net//device/sriov_numvfs +Set the mac address of the VF directly: + ip link set addr 00:11:22:33:44:55 +Set the MAC address of the VF via the PF: + ip link set vf 0 mac 00:11:22:33:44:66 +Without this patch the last command will fail with ENOENT. + +Signed-off-by: Jonathan Cooper +Reported-by: Íñigo Huguet +Fixes: 910c8789a777 ("set the MAC address using MC_CMD_VADAPTOR_SET_MAC") +Acked-by: Edward Cree +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/ef10.c | 58 ++++++++++++++------------------- + 1 file changed, 24 insertions(+), 34 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/ef10.c b/drivers/net/ethernet/sfc/ef10.c +index d1e1aa19a68e..7022fb2005a2 100644 +--- a/drivers/net/ethernet/sfc/ef10.c ++++ b/drivers/net/ethernet/sfc/ef10.c +@@ -3277,6 +3277,30 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx) + bool was_enabled = efx->port_enabled; + int rc; + ++#ifdef CONFIG_SFC_SRIOV ++ /* If this function is a VF and we have access to the parent PF, ++ * then use the PF control path to attempt to change the VF MAC address. ++ */ ++ if (efx->pci_dev->is_virtfn && efx->pci_dev->physfn) { ++ struct efx_nic *efx_pf = pci_get_drvdata(efx->pci_dev->physfn); ++ struct efx_ef10_nic_data *nic_data = efx->nic_data; ++ u8 mac[ETH_ALEN]; ++ ++ /* net_dev->dev_addr can be zeroed by efx_net_stop in ++ * efx_ef10_sriov_set_vf_mac, so pass in a copy. ++ */ ++ ether_addr_copy(mac, efx->net_dev->dev_addr); ++ ++ rc = efx_ef10_sriov_set_vf_mac(efx_pf, nic_data->vf_index, mac); ++ if (!rc) ++ return 0; ++ ++ netif_dbg(efx, drv, efx->net_dev, ++ "Updating VF mac via PF failed (%d), setting directly\n", ++ rc); ++ } ++#endif ++ + efx_device_detach_sync(efx); + efx_net_stop(efx->net_dev); + +@@ -3297,40 +3321,6 @@ static int efx_ef10_set_mac_address(struct efx_nic *efx) + efx_net_open(efx->net_dev); + efx_device_attach_if_not_resetting(efx); + +-#ifdef CONFIG_SFC_SRIOV +- if (efx->pci_dev->is_virtfn && efx->pci_dev->physfn) { +- struct efx_ef10_nic_data *nic_data = efx->nic_data; +- struct pci_dev *pci_dev_pf = efx->pci_dev->physfn; +- +- if (rc == -EPERM) { +- struct efx_nic *efx_pf; +- +- /* Switch to PF and change MAC address on vport */ +- efx_pf = pci_get_drvdata(pci_dev_pf); +- +- rc = efx_ef10_sriov_set_vf_mac(efx_pf, +- nic_data->vf_index, +- efx->net_dev->dev_addr); +- } else if (!rc) { +- struct efx_nic *efx_pf = pci_get_drvdata(pci_dev_pf); +- struct efx_ef10_nic_data *nic_data = efx_pf->nic_data; +- unsigned int i; +- +- /* MAC address successfully changed by VF (with MAC +- * spoofing) so update the parent PF if possible. +- */ +- for (i = 0; i < efx_pf->vf_count; ++i) { +- struct ef10_vf *vf = nic_data->vf + i; +- +- if (vf->efx == efx) { +- ether_addr_copy(vf->mac, +- efx->net_dev->dev_addr); +- return 0; +- } +- } +- } +- } else +-#endif + if (rc == -EPERM) { + netif_err(efx, drv, efx->net_dev, + "Cannot change MAC address; use sfboot to enable" +-- +2.35.1 + diff --git a/queue-6.0/sfc-include-vport_id-in-filter-spec-hash-and-equal.patch b/queue-6.0/sfc-include-vport_id-in-filter-spec-hash-and-equal.patch new file mode 100644 index 00000000000..6f0319e4e67 --- /dev/null +++ b/queue-6.0/sfc-include-vport_id-in-filter-spec-hash-and-equal.patch @@ -0,0 +1,72 @@ +From a0ea7b363e758f4b690aa14263790a7271f88e88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 10:28:41 +0100 +Subject: sfc: include vport_id in filter spec hash and equal() + +From: Pieter Jansen van Vuuren + +[ Upstream commit c2bf23e4a5af37a4d77901d9ff14c50a269f143d ] + +Filters on different vports are qualified by different implicit MACs and/or +VLANs, so shouldn't be considered equal even if their other match fields +are identical. + +Fixes: 7c460d9be610 ("sfc: Extend and abstract efx_filter_spec to cover Huntington/EF10") +Co-developed-by: Edward Cree +Signed-off-by: Edward Cree +Signed-off-by: Pieter Jansen van Vuuren +Reviewed-by: Martin Habets +Link: https://lore.kernel.org/r/20221018092841.32206-1-pieter.jansen-van-vuuren@amd.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/sfc/filter.h | 4 ++-- + drivers/net/ethernet/sfc/rx_common.c | 10 +++++----- + 2 files changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/sfc/filter.h b/drivers/net/ethernet/sfc/filter.h +index 4d928839d292..f569d07ef267 100644 +--- a/drivers/net/ethernet/sfc/filter.h ++++ b/drivers/net/ethernet/sfc/filter.h +@@ -161,9 +161,9 @@ struct efx_filter_spec { + u32 priority:2; + u32 flags:6; + u32 dmaq_id:12; +- u32 vport_id; + u32 rss_context; +- __be16 outer_vid __aligned(4); /* allow jhash2() of match values */ ++ u32 vport_id; ++ __be16 outer_vid; + __be16 inner_vid; + u8 loc_mac[ETH_ALEN]; + u8 rem_mac[ETH_ALEN]; +diff --git a/drivers/net/ethernet/sfc/rx_common.c b/drivers/net/ethernet/sfc/rx_common.c +index 4826e6a7e4ce..9220afeddee8 100644 +--- a/drivers/net/ethernet/sfc/rx_common.c ++++ b/drivers/net/ethernet/sfc/rx_common.c +@@ -660,17 +660,17 @@ bool efx_filter_spec_equal(const struct efx_filter_spec *left, + (EFX_FILTER_FLAG_RX | EFX_FILTER_FLAG_TX))) + return false; + +- return memcmp(&left->outer_vid, &right->outer_vid, ++ return memcmp(&left->vport_id, &right->vport_id, + sizeof(struct efx_filter_spec) - +- offsetof(struct efx_filter_spec, outer_vid)) == 0; ++ offsetof(struct efx_filter_spec, vport_id)) == 0; + } + + u32 efx_filter_spec_hash(const struct efx_filter_spec *spec) + { +- BUILD_BUG_ON(offsetof(struct efx_filter_spec, outer_vid) & 3); +- return jhash2((const u32 *)&spec->outer_vid, ++ BUILD_BUG_ON(offsetof(struct efx_filter_spec, vport_id) & 3); ++ return jhash2((const u32 *)&spec->vport_id, + (sizeof(struct efx_filter_spec) - +- offsetof(struct efx_filter_spec, outer_vid)) / 4, ++ offsetof(struct efx_filter_spec, vport_id)) / 4, + 0); + } + +-- +2.35.1 + diff --git a/queue-6.0/skmsg-pass-gfp-argument-to-alloc_sk_msg.patch b/queue-6.0/skmsg-pass-gfp-argument-to-alloc_sk_msg.patch new file mode 100644 index 00000000000..946f1393801 --- /dev/null +++ b/queue-6.0/skmsg-pass-gfp-argument-to-alloc_sk_msg.patch @@ -0,0 +1,108 @@ +From 91f681be008661cd98cca123f8c37ba4ab39ae7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 15 Oct 2022 21:24:41 +0000 +Subject: skmsg: pass gfp argument to alloc_sk_msg() + +From: Eric Dumazet + +[ Upstream commit 2d1f274b95c6e4ba6a813b3b8e7a1a38d54a0a08 ] + +syzbot found that alloc_sk_msg() could be called from a +non sleepable context. sk_psock_verdict_recv() uses +rcu_read_lock() protection. + +We need the callers to pass a gfp_t argument to avoid issues. + +syzbot report was: + +BUG: sleeping function called from invalid context at include/linux/sched/mm.h:274 +in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 3613, name: syz-executor414 +preempt_count: 0, expected: 0 +RCU nest depth: 1, expected: 0 +INFO: lockdep is turned off. +CPU: 0 PID: 3613 Comm: syz-executor414 Not tainted 6.0.0-syzkaller-09589-g55be6084c8e0 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/22/2022 +Call Trace: + +__dump_stack lib/dump_stack.c:88 [inline] +dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106 +__might_resched+0x538/0x6a0 kernel/sched/core.c:9877 +might_alloc include/linux/sched/mm.h:274 [inline] +slab_pre_alloc_hook mm/slab.h:700 [inline] +slab_alloc_node mm/slub.c:3162 [inline] +slab_alloc mm/slub.c:3256 [inline] +kmem_cache_alloc_trace+0x59/0x310 mm/slub.c:3287 +kmalloc include/linux/slab.h:600 [inline] +kzalloc include/linux/slab.h:733 [inline] +alloc_sk_msg net/core/skmsg.c:507 [inline] +sk_psock_skb_ingress_self+0x5c/0x330 net/core/skmsg.c:600 +sk_psock_verdict_apply+0x395/0x440 net/core/skmsg.c:1014 +sk_psock_verdict_recv+0x34d/0x560 net/core/skmsg.c:1201 +tcp_read_skb+0x4a1/0x790 net/ipv4/tcp.c:1770 +tcp_rcv_established+0x129d/0x1a10 net/ipv4/tcp_input.c:5971 +tcp_v4_do_rcv+0x479/0xac0 net/ipv4/tcp_ipv4.c:1681 +sk_backlog_rcv include/net/sock.h:1109 [inline] +__release_sock+0x1d8/0x4c0 net/core/sock.c:2906 +release_sock+0x5d/0x1c0 net/core/sock.c:3462 +tcp_sendmsg+0x36/0x40 net/ipv4/tcp.c:1483 +sock_sendmsg_nosec net/socket.c:714 [inline] +sock_sendmsg net/socket.c:734 [inline] +__sys_sendto+0x46d/0x5f0 net/socket.c:2117 +__do_sys_sendto net/socket.c:2129 [inline] +__se_sys_sendto net/socket.c:2125 [inline] +__x64_sys_sendto+0xda/0xf0 net/socket.c:2125 +do_syscall_x64 arch/x86/entry/common.c:50 [inline] +do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 +entry_SYSCALL_64_after_hwframe+0x63/0xcd + +Fixes: 43312915b5ba ("skmsg: Get rid of unncessary memset()") +Reported-by: syzbot +Signed-off-by: Eric Dumazet +Cc: Cong Wang +Cc: Daniel Borkmann +Cc: John Fastabend +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/core/skmsg.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/net/core/skmsg.c b/net/core/skmsg.c +index ca70525621c7..1efdc47a999b 100644 +--- a/net/core/skmsg.c ++++ b/net/core/skmsg.c +@@ -500,11 +500,11 @@ bool sk_msg_is_readable(struct sock *sk) + } + EXPORT_SYMBOL_GPL(sk_msg_is_readable); + +-static struct sk_msg *alloc_sk_msg(void) ++static struct sk_msg *alloc_sk_msg(gfp_t gfp) + { + struct sk_msg *msg; + +- msg = kzalloc(sizeof(*msg), __GFP_NOWARN | GFP_KERNEL); ++ msg = kzalloc(sizeof(*msg), gfp | __GFP_NOWARN); + if (unlikely(!msg)) + return NULL; + sg_init_marker(msg->sg.data, NR_MSG_FRAG_IDS); +@@ -520,7 +520,7 @@ static struct sk_msg *sk_psock_create_ingress_msg(struct sock *sk, + if (!sk_rmem_schedule(sk, skb, skb->truesize)) + return NULL; + +- return alloc_sk_msg(); ++ return alloc_sk_msg(GFP_KERNEL); + } + + static int sk_psock_skb_ingress_enqueue(struct sk_buff *skb, +@@ -597,7 +597,7 @@ static int sk_psock_skb_ingress(struct sk_psock *psock, struct sk_buff *skb, + static int sk_psock_skb_ingress_self(struct sk_psock *psock, struct sk_buff *skb, + u32 off, u32 len) + { +- struct sk_msg *msg = alloc_sk_msg(); ++ struct sk_msg *msg = alloc_sk_msg(GFP_ATOMIC); + struct sock *sk = psock->sk; + int err; + +-- +2.35.1 + diff --git a/queue-6.0/tipc-fix-an-information-leak-in-tipc_topsrv_kern_sub.patch b/queue-6.0/tipc-fix-an-information-leak-in-tipc_topsrv_kern_sub.patch new file mode 100644 index 00000000000..ae0628eb77a --- /dev/null +++ b/queue-6.0/tipc-fix-an-information-leak-in-tipc_topsrv_kern_sub.patch @@ -0,0 +1,87 @@ +From b457daf8131636061013f6b5bddb6b6acb9d81ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 17:25:14 +0200 +Subject: tipc: fix an information leak in tipc_topsrv_kern_subscr + +From: Alexander Potapenko + +[ Upstream commit 777ecaabd614d47c482a5c9031579e66da13989a ] + +Use a 8-byte write to initialize sub.usr_handle in +tipc_topsrv_kern_subscr(), otherwise four bytes remain uninitialized +when issuing setsockopt(..., SOL_TIPC, ...). +This resulted in an infoleak reported by KMSAN when the packet was +received: + + ===================================================== + BUG: KMSAN: kernel-infoleak in copyout+0xbc/0x100 lib/iov_iter.c:169 + instrument_copy_to_user ./include/linux/instrumented.h:121 + copyout+0xbc/0x100 lib/iov_iter.c:169 + _copy_to_iter+0x5c0/0x20a0 lib/iov_iter.c:527 + copy_to_iter ./include/linux/uio.h:176 + simple_copy_to_iter+0x64/0xa0 net/core/datagram.c:513 + __skb_datagram_iter+0x123/0xdc0 net/core/datagram.c:419 + skb_copy_datagram_iter+0x58/0x200 net/core/datagram.c:527 + skb_copy_datagram_msg ./include/linux/skbuff.h:3903 + packet_recvmsg+0x521/0x1e70 net/packet/af_packet.c:3469 + ____sys_recvmsg+0x2c4/0x810 net/socket.c:? + ___sys_recvmsg+0x217/0x840 net/socket.c:2743 + __sys_recvmsg net/socket.c:2773 + __do_sys_recvmsg net/socket.c:2783 + __se_sys_recvmsg net/socket.c:2780 + __x64_sys_recvmsg+0x364/0x540 net/socket.c:2780 + do_syscall_x64 arch/x86/entry/common.c:50 + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 + + ... + + Uninit was stored to memory at: + tipc_sub_subscribe+0x42d/0xb50 net/tipc/subscr.c:156 + tipc_conn_rcv_sub+0x246/0x620 net/tipc/topsrv.c:375 + tipc_topsrv_kern_subscr+0x2e8/0x400 net/tipc/topsrv.c:579 + tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 + tipc_sk_join+0x2a8/0x770 net/tipc/socket.c:3084 + tipc_setsockopt+0xae5/0xe40 net/tipc/socket.c:3201 + __sys_setsockopt+0x87f/0xdc0 net/socket.c:2252 + __do_sys_setsockopt net/socket.c:2263 + __se_sys_setsockopt net/socket.c:2260 + __x64_sys_setsockopt+0xe0/0x160 net/socket.c:2260 + do_syscall_x64 arch/x86/entry/common.c:50 + do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 + entry_SYSCALL_64_after_hwframe+0x63/0xcd arch/x86/entry/entry_64.S:120 + + Local variable sub created at: + tipc_topsrv_kern_subscr+0x57/0x400 net/tipc/topsrv.c:562 + tipc_group_create+0x4e7/0x7d0 net/tipc/group.c:190 + + Bytes 84-87 of 88 are uninitialized + Memory access of size 88 starts at ffff88801ed57cd0 + Data copied to user address 0000000020000400 + ... + ===================================================== + +Signed-off-by: Alexander Potapenko +Fixes: 026321c6d056a5 ("tipc: rename tipc_server to tipc_topsrv") +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/topsrv.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/topsrv.c b/net/tipc/topsrv.c +index 5522865deae9..14fd05fd6107 100644 +--- a/net/tipc/topsrv.c ++++ b/net/tipc/topsrv.c +@@ -568,7 +568,7 @@ bool tipc_topsrv_kern_subscr(struct net *net, u32 port, u32 type, u32 lower, + sub.seq.upper = upper; + sub.timeout = TIPC_WAIT_FOREVER; + sub.filter = filter; +- *(u32 *)&sub.usr_handle = port; ++ *(u64 *)&sub.usr_handle = (u64)port; + + con = tipc_conn_alloc(tipc_topsrv(net)); + if (IS_ERR(con)) +-- +2.35.1 + diff --git a/queue-6.0/tipc-fix-recognition-of-trial-period.patch b/queue-6.0/tipc-fix-recognition-of-trial-period.patch new file mode 100644 index 00000000000..ccbfd757bbe --- /dev/null +++ b/queue-6.0/tipc-fix-recognition-of-trial-period.patch @@ -0,0 +1,39 @@ +From 4c3988bc65462ed6f9f89d75b584cd2e07bbe9cc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Oct 2022 15:46:13 +1300 +Subject: tipc: Fix recognition of trial period + +From: Mark Tomlinson + +[ Upstream commit 28be7ca4fcfd69a2d52aaa331adbf9dbe91f9e6e ] + +The trial period exists until jiffies is after addr_trial_end. But as +jiffies will eventually overflow, just using time_after will eventually +give incorrect results. As the node address is set once the trial period +ends, this can be used to know that we are not in the trial period. + +Fixes: e415577f57f4 ("tipc: correct discovery message handling during address trial period") +Signed-off-by: Mark Tomlinson +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/discover.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/discover.c b/net/tipc/discover.c +index da69e1abf68f..e8630707901e 100644 +--- a/net/tipc/discover.c ++++ b/net/tipc/discover.c +@@ -148,8 +148,8 @@ static bool tipc_disc_addr_trial_msg(struct tipc_discoverer *d, + { + struct net *net = d->net; + struct tipc_net *tn = tipc_net(net); +- bool trial = time_before(jiffies, tn->addr_trial_end); + u32 self = tipc_own_addr(net); ++ bool trial = time_before(jiffies, tn->addr_trial_end) && !self; + + if (mtyp == DSC_TRIAL_FAIL_MSG) { + if (!trial) +-- +2.35.1 + diff --git a/queue-6.0/tls-strp-make-sure-the-tcp-skbs-do-not-have-overlapp.patch b/queue-6.0/tls-strp-make-sure-the-tcp-skbs-do-not-have-overlapp.patch new file mode 100644 index 00000000000..152a64c622b --- /dev/null +++ b/queue-6.0/tls-strp-make-sure-the-tcp-skbs-do-not-have-overlapp.patch @@ -0,0 +1,99 @@ +From 235d2ce4e14dc1aa99ba7742a85d458c677d6dfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 12 Oct 2022 15:55:20 -0700 +Subject: tls: strp: make sure the TCP skbs do not have overlapping data + +From: Jakub Kicinski + +[ Upstream commit 0d87bbd39d7fd1135ab9eca672d760470f6508e8 ] + +TLS tries to get away with using the TCP input queue directly. +This does not work if there is duplicated data (multiple skbs +holding bytes for the same seq number range due to retransmits). +Check for this condition and fall back to copy mode, it should +be rare. + +Fixes: 84c61fe1a75b ("tls: rx: do not use the standard strparser") +Signed-off-by: Jakub Kicinski +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tls/tls_strp.c | 32 ++++++++++++++++++++++++++++---- + 1 file changed, 28 insertions(+), 4 deletions(-) + +diff --git a/net/tls/tls_strp.c b/net/tls/tls_strp.c +index 9b79e334dbd9..955ac3e0bf4d 100644 +--- a/net/tls/tls_strp.c ++++ b/net/tls/tls_strp.c +@@ -273,7 +273,7 @@ static int tls_strp_read_copyin(struct tls_strparser *strp) + return desc.error; + } + +-static int tls_strp_read_short(struct tls_strparser *strp) ++static int tls_strp_read_copy(struct tls_strparser *strp, bool qshort) + { + struct skb_shared_info *shinfo; + struct page *page; +@@ -283,7 +283,7 @@ static int tls_strp_read_short(struct tls_strparser *strp) + * to read the data out. Otherwise the connection will stall. + * Without pressure threshold of INT_MAX will never be ready. + */ +- if (likely(!tcp_epollin_ready(strp->sk, INT_MAX))) ++ if (likely(qshort && !tcp_epollin_ready(strp->sk, INT_MAX))) + return 0; + + shinfo = skb_shinfo(strp->anchor); +@@ -315,6 +315,27 @@ static int tls_strp_read_short(struct tls_strparser *strp) + return 0; + } + ++static bool tls_strp_check_no_dup(struct tls_strparser *strp) ++{ ++ unsigned int len = strp->stm.offset + strp->stm.full_len; ++ struct sk_buff *skb; ++ u32 seq; ++ ++ skb = skb_shinfo(strp->anchor)->frag_list; ++ seq = TCP_SKB_CB(skb)->seq; ++ ++ while (skb->len < len) { ++ seq += skb->len; ++ len -= skb->len; ++ skb = skb->next; ++ ++ if (TCP_SKB_CB(skb)->seq != seq) ++ return false; ++ } ++ ++ return true; ++} ++ + static void tls_strp_load_anchor_with_queue(struct tls_strparser *strp, int len) + { + struct tcp_sock *tp = tcp_sk(strp->sk); +@@ -373,7 +394,7 @@ static int tls_strp_read_sock(struct tls_strparser *strp) + return tls_strp_read_copyin(strp); + + if (inq < strp->stm.full_len) +- return tls_strp_read_short(strp); ++ return tls_strp_read_copy(strp, true); + + if (!strp->stm.full_len) { + tls_strp_load_anchor_with_queue(strp, inq); +@@ -387,9 +408,12 @@ static int tls_strp_read_sock(struct tls_strparser *strp) + strp->stm.full_len = sz; + + if (!strp->stm.full_len || inq < strp->stm.full_len) +- return tls_strp_read_short(strp); ++ return tls_strp_read_copy(strp, true); + } + ++ if (!tls_strp_check_no_dup(strp)) ++ return tls_strp_read_copy(strp, false); ++ + strp->msg_ready = 1; + tls_rx_msg_ready(strp); + +-- +2.35.1 + diff --git a/queue-6.0/udp-update-reuse-has_conns-under-reuseport_lock.patch b/queue-6.0/udp-update-reuse-has_conns-under-reuseport_lock.patch new file mode 100644 index 00000000000..9aeb410dd9d --- /dev/null +++ b/queue-6.0/udp-update-reuse-has_conns-under-reuseport_lock.patch @@ -0,0 +1,193 @@ +From ef09f2dee7888e7b80409bc07bad59117c64fcea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Oct 2022 11:26:25 -0700 +Subject: udp: Update reuse->has_conns under reuseport_lock. + +From: Kuniyuki Iwashima + +[ Upstream commit 69421bf98482d089e50799f45e48b25ce4a8d154 ] + +When we call connect() for a UDP socket in a reuseport group, we have +to update sk->sk_reuseport_cb->has_conns to 1. Otherwise, the kernel +could select a unconnected socket wrongly for packets sent to the +connected socket. + +However, the current way to set has_conns is illegal and possible to +trigger that problem. reuseport_has_conns() changes has_conns under +rcu_read_lock(), which upgrades the RCU reader to the updater. Then, +it must do the update under the updater's lock, reuseport_lock, but +it doesn't for now. + +For this reason, there is a race below where we fail to set has_conns +resulting in the wrong socket selection. To avoid the race, let's split +the reader and updater with proper locking. + + cpu1 cpu2 ++----+ +----+ + +__ip[46]_datagram_connect() reuseport_grow() +. . +|- reuseport_has_conns(sk, true) |- more_reuse = __reuseport_alloc(more_socks_size) +| . | +| |- rcu_read_lock() +| |- reuse = rcu_dereference(sk->sk_reuseport_cb) +| | +| | | /* reuse->has_conns == 0 here */ +| | |- more_reuse->has_conns = reuse->has_conns +| |- reuse->has_conns = 1 | /* more_reuse->has_conns SHOULD BE 1 HERE */ +| | | +| | |- rcu_assign_pointer(reuse->socks[i]->sk_reuseport_cb, +| | | more_reuse) +| `- rcu_read_unlock() `- kfree_rcu(reuse, rcu) +| +|- sk->sk_state = TCP_ESTABLISHED + +Note the likely(reuse) in reuseport_has_conns_set() is always true, +but we put the test there for ease of review. [0] + +For the record, usually, sk_reuseport_cb is changed under lock_sock(). +The only exception is reuseport_grow() & TCP reqsk migration case. + + 1) shutdown() TCP listener, which is moved into the latter part of + reuse->socks[] to migrate reqsk. + + 2) New listen() overflows reuse->socks[] and call reuseport_grow(). + + 3) reuse->max_socks overflows u16 with the new listener. + + 4) reuseport_grow() pops the old shutdown()ed listener from the array + and update its sk->sk_reuseport_cb as NULL without lock_sock(). + +shutdown()ed TCP sk->sk_reuseport_cb can be changed without lock_sock(), +but, reuseport_has_conns_set() is called only for UDP under lock_sock(), +so likely(reuse) never be false in reuseport_has_conns_set(). + +[0]: https://lore.kernel.org/netdev/CANn89iLja=eQHbsM_Ta2sQF0tOGU8vAGrh_izRuuHjuO1ouUag@mail.gmail.com/ + +Fixes: acdcecc61285 ("udp: correct reuseport selection with connected sockets") +Signed-off-by: Kuniyuki Iwashima +Link: https://lore.kernel.org/r/20221014182625.89913-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + include/net/sock_reuseport.h | 11 +++++------ + net/core/sock_reuseport.c | 16 ++++++++++++++++ + net/ipv4/datagram.c | 2 +- + net/ipv4/udp.c | 2 +- + net/ipv6/datagram.c | 2 +- + net/ipv6/udp.c | 2 +- + 6 files changed, 25 insertions(+), 10 deletions(-) + +diff --git a/include/net/sock_reuseport.h b/include/net/sock_reuseport.h +index 473b0b0fa4ab..efc9085c6892 100644 +--- a/include/net/sock_reuseport.h ++++ b/include/net/sock_reuseport.h +@@ -43,21 +43,20 @@ struct sock *reuseport_migrate_sock(struct sock *sk, + extern int reuseport_attach_prog(struct sock *sk, struct bpf_prog *prog); + extern int reuseport_detach_prog(struct sock *sk); + +-static inline bool reuseport_has_conns(struct sock *sk, bool set) ++static inline bool reuseport_has_conns(struct sock *sk) + { + struct sock_reuseport *reuse; + bool ret = false; + + rcu_read_lock(); + reuse = rcu_dereference(sk->sk_reuseport_cb); +- if (reuse) { +- if (set) +- reuse->has_conns = 1; +- ret = reuse->has_conns; +- } ++ if (reuse && reuse->has_conns) ++ ret = true; + rcu_read_unlock(); + + return ret; + } + ++void reuseport_has_conns_set(struct sock *sk); ++ + #endif /* _SOCK_REUSEPORT_H */ +diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c +index 5daa1fa54249..fb90e1e00773 100644 +--- a/net/core/sock_reuseport.c ++++ b/net/core/sock_reuseport.c +@@ -21,6 +21,22 @@ static DEFINE_IDA(reuseport_ida); + static int reuseport_resurrect(struct sock *sk, struct sock_reuseport *old_reuse, + struct sock_reuseport *reuse, bool bind_inany); + ++void reuseport_has_conns_set(struct sock *sk) ++{ ++ struct sock_reuseport *reuse; ++ ++ if (!rcu_access_pointer(sk->sk_reuseport_cb)) ++ return; ++ ++ spin_lock_bh(&reuseport_lock); ++ reuse = rcu_dereference_protected(sk->sk_reuseport_cb, ++ lockdep_is_held(&reuseport_lock)); ++ if (likely(reuse)) ++ reuse->has_conns = 1; ++ spin_unlock_bh(&reuseport_lock); ++} ++EXPORT_SYMBOL(reuseport_has_conns_set); ++ + static int reuseport_sock_index(struct sock *sk, + const struct sock_reuseport *reuse, + bool closed) +diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c +index 405a8c2aea64..5e66add7befa 100644 +--- a/net/ipv4/datagram.c ++++ b/net/ipv4/datagram.c +@@ -70,7 +70,7 @@ int __ip4_datagram_connect(struct sock *sk, struct sockaddr *uaddr, int addr_len + } + inet->inet_daddr = fl4->daddr; + inet->inet_dport = usin->sin_port; +- reuseport_has_conns(sk, true); ++ reuseport_has_conns_set(sk); + sk->sk_state = TCP_ESTABLISHED; + sk_set_txhash(sk); + inet->inet_id = prandom_u32(); +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 516b11c136da..d9099754ac69 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -448,7 +448,7 @@ static struct sock *udp4_lib_lookup2(struct net *net, + result = lookup_reuseport(net, sk, skb, + saddr, sport, daddr, hnum); + /* Fall back to scoring if group has connections */ +- if (result && !reuseport_has_conns(sk, false)) ++ if (result && !reuseport_has_conns(sk)) + return result; + + result = result ? : sk; +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c +index df665d4e8f0f..5ecb56522f9d 100644 +--- a/net/ipv6/datagram.c ++++ b/net/ipv6/datagram.c +@@ -256,7 +256,7 @@ int __ip6_datagram_connect(struct sock *sk, struct sockaddr *uaddr, + goto out; + } + +- reuseport_has_conns(sk, true); ++ reuseport_has_conns_set(sk); + sk->sk_state = TCP_ESTABLISHED; + sk_set_txhash(sk); + out: +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 3366d6a77ff2..fb667e02e976 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -182,7 +182,7 @@ static struct sock *udp6_lib_lookup2(struct net *net, + result = lookup_reuseport(net, sk, skb, + saddr, sport, daddr, hnum); + /* Fall back to scoring if group has connections */ +- if (result && !reuseport_has_conns(sk, false)) ++ if (result && !reuseport_has_conns(sk)) + return result; + + result = result ? : sk; +-- +2.35.1 + diff --git a/queue-6.0/usb-add-reset_resume-quirk-for-nvidia-jetson-devices.patch b/queue-6.0/usb-add-reset_resume-quirk-for-nvidia-jetson-devices.patch new file mode 100644 index 00000000000..d0a42960b26 --- /dev/null +++ b/queue-6.0/usb-add-reset_resume-quirk-for-nvidia-jetson-devices.patch @@ -0,0 +1,54 @@ +From 82d197c70b3019f4a0354e50723da1e9b8bedfb0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 19 Sep 2022 20:16:10 +0300 +Subject: USB: add RESET_RESUME quirk for NVIDIA Jetson devices in RCM + +From: Hannu Hartikainen + +[ Upstream commit fc4ade55c617dc73c7e9756b57f3230b4ff24540 ] + +NVIDIA Jetson devices in Force Recovery mode (RCM) do not support +suspending, ie. flashing fails if the device has been suspended. The +devices are still visible in lsusb and seem to work otherwise, making +the issue hard to debug. This has been discovered in various forum +posts, eg. [1]. + +The patch has been tested on NVIDIA Jetson AGX Xavier, but I'm adding +all the Jetson models listed in [2] on the assumption that they all +behave similarly. + +[1]: https://forums.developer.nvidia.com/t/flashing-not-working/72365 +[2]: https://docs.nvidia.com/jetson/archives/l4t-archived/l4t-3271/index.html#page/Tegra%20Linux%20Driver%20Package%20Development%20Guide/quick_start.html + +Signed-off-by: Hannu Hartikainen +Cc: stable # after 6.1-rc3 +Link: https://lore.kernel.org/r/20220919171610.30484-1-hannu@hrtk.in +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/usb/core/quirks.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 999b7c9697fc..0722d2131305 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -388,6 +388,15 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Kingston DataTraveler 3.0 */ + { USB_DEVICE(0x0951, 0x1666), .driver_info = USB_QUIRK_NO_LPM }, + ++ /* NVIDIA Jetson devices in Force Recovery mode */ ++ { USB_DEVICE(0x0955, 0x7018), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7019), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7418), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7721), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7c18), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7e19), .driver_info = USB_QUIRK_RESET_RESUME }, ++ { USB_DEVICE(0x0955, 0x7f21), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* X-Rite/Gretag-Macbeth Eye-One Pro display colorimeter */ + { USB_DEVICE(0x0971, 0x2000), .driver_info = USB_QUIRK_NO_SET_INTF }, + +-- +2.35.1 + diff --git a/queue-6.0/wifi-mt76-connac-introduce-mt76_connac_reg_map-struc.patch b/queue-6.0/wifi-mt76-connac-introduce-mt76_connac_reg_map-struc.patch new file mode 100644 index 00000000000..e4e6aa395f1 --- /dev/null +++ b/queue-6.0/wifi-mt76-connac-introduce-mt76_connac_reg_map-struc.patch @@ -0,0 +1,449 @@ +From 6fb6d69c07a1a0387168ac640dbc62251d1d21a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 24 Jun 2022 23:14:33 +0200 +Subject: wifi: mt76: connac: introduce mt76_connac_reg_map structure + +From: Lorenzo Bianconi + +[ Upstream commit e351f4f0465484115a64eebab238445b4a21b219 ] + +Introduce mt76_connac_reg_map structure in mt76-connac module since it +is used by all connac2 chipset. Align structure definitions. +This is a preliminary patch to add mt7990 chipset support. + +Signed-off-by: Lorenzo Bianconi +Signed-off-by: Felix Fietkau +Stable-dep-of: 29e247ece5d3 ("wifi: mt76: mt7921e: fix random fw download fail") +Signed-off-by: Sasha Levin +--- + .../net/wireless/mediatek/mt76/mt76_connac.h | 6 + + .../net/wireless/mediatek/mt76/mt7915/mmio.c | 254 +++++++++--------- + .../net/wireless/mediatek/mt76/mt7915/regs.h | 8 +- + .../net/wireless/mediatek/mt76/mt7921/pci.c | 76 +++--- + 4 files changed, 170 insertions(+), 174 deletions(-) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac.h b/drivers/net/wireless/mediatek/mt76/mt76_connac.h +index 75afcb469d3c..d03365530ac1 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt76_connac.h ++++ b/drivers/net/wireless/mediatek/mt76/mt76_connac.h +@@ -63,6 +63,12 @@ enum { + REPEATER_BSSID_MAX = 0x3f, + }; + ++struct mt76_connac_reg_map { ++ u32 phys; ++ u32 maps; ++ u32 size; ++}; ++ + struct mt76_connac_pm { + bool enable:1; + bool enable_user:1; +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +index 4499a630e8f1..c1256defbea3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/mmio.c +@@ -204,147 +204,147 @@ static const u32 mt7916_offs[] = { + [ETBF_PAR_RPT0] = 0x100, + }; + +-static const struct __map mt7915_reg_map[] = { ++static const struct mt76_connac_reg_map mt7915_reg_map[] = { + { 0x00400000, 0x80000, 0x10000 }, /* WF_MCU_SYSRAM */ + { 0x00410000, 0x90000, 0x10000 }, /* WF_MCU_SYSRAM (configure regs) */ + { 0x40000000, 0x70000, 0x10000 }, /* WF_UMAC_SYSRAM */ +- { 0x54000000, 0x02000, 0x1000 }, /* WFDMA PCIE0 MCU DMA0 */ +- { 0x55000000, 0x03000, 0x1000 }, /* WFDMA PCIE0 MCU DMA1 */ +- { 0x58000000, 0x06000, 0x1000 }, /* WFDMA PCIE1 MCU DMA0 (MEM_DMA) */ +- { 0x59000000, 0x07000, 0x1000 }, /* WFDMA PCIE1 MCU DMA1 */ ++ { 0x54000000, 0x02000, 0x01000 }, /* WFDMA PCIE0 MCU DMA0 */ ++ { 0x55000000, 0x03000, 0x01000 }, /* WFDMA PCIE0 MCU DMA1 */ ++ { 0x58000000, 0x06000, 0x01000 }, /* WFDMA PCIE1 MCU DMA0 (MEM_DMA) */ ++ { 0x59000000, 0x07000, 0x01000 }, /* WFDMA PCIE1 MCU DMA1 */ + { 0x7c000000, 0xf0000, 0x10000 }, /* CONN_INFRA */ + { 0x7c020000, 0xd0000, 0x10000 }, /* CONN_INFRA, WFDMA */ + { 0x80020000, 0xb0000, 0x10000 }, /* WF_TOP_MISC_OFF */ + { 0x81020000, 0xc0000, 0x10000 }, /* WF_TOP_MISC_ON */ +- { 0x820c0000, 0x08000, 0x4000 }, /* WF_UMAC_TOP (PLE) */ +- { 0x820c8000, 0x0c000, 0x2000 }, /* WF_UMAC_TOP (PSE) */ +- { 0x820cc000, 0x0e000, 0x2000 }, /* WF_UMAC_TOP (PP) */ +- { 0x820ce000, 0x21c00, 0x0200 }, /* WF_LMAC_TOP (WF_SEC) */ +- { 0x820cf000, 0x22000, 0x1000 }, /* WF_LMAC_TOP (WF_PF) */ ++ { 0x820c0000, 0x08000, 0x04000 }, /* WF_UMAC_TOP (PLE) */ ++ { 0x820c8000, 0x0c000, 0x02000 }, /* WF_UMAC_TOP (PSE) */ ++ { 0x820cc000, 0x0e000, 0x02000 }, /* WF_UMAC_TOP (PP) */ ++ { 0x820ce000, 0x21c00, 0x00200 }, /* WF_LMAC_TOP (WF_SEC) */ ++ { 0x820cf000, 0x22000, 0x01000 }, /* WF_LMAC_TOP (WF_PF) */ + { 0x820d0000, 0x30000, 0x10000 }, /* WF_LMAC_TOP (WF_WTBLON) */ +- { 0x820e0000, 0x20000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ +- { 0x820e1000, 0x20400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */ +- { 0x820e2000, 0x20800, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */ +- { 0x820e3000, 0x20c00, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */ +- { 0x820e4000, 0x21000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */ +- { 0x820e5000, 0x21400, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */ +- { 0x820e7000, 0x21e00, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */ +- { 0x820e9000, 0x23400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */ +- { 0x820ea000, 0x24000, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */ +- { 0x820eb000, 0x24200, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */ +- { 0x820ec000, 0x24600, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_INT) */ +- { 0x820ed000, 0x24800, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */ +- { 0x820f0000, 0xa0000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */ +- { 0x820f1000, 0xa0600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */ +- { 0x820f2000, 0xa0800, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */ +- { 0x820f3000, 0xa0c00, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */ +- { 0x820f4000, 0xa1000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */ +- { 0x820f5000, 0xa1400, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */ +- { 0x820f7000, 0xa1e00, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */ +- { 0x820f9000, 0xa3400, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */ +- { 0x820fa000, 0xa4000, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */ +- { 0x820fb000, 0xa4200, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */ +- { 0x820fc000, 0xa4600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_INT) */ +- { 0x820fd000, 0xa4800, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */ ++ { 0x820e0000, 0x20000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ ++ { 0x820e1000, 0x20400, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */ ++ { 0x820e2000, 0x20800, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */ ++ { 0x820e3000, 0x20c00, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */ ++ { 0x820e4000, 0x21000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */ ++ { 0x820e5000, 0x21400, 0x00800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */ ++ { 0x820e7000, 0x21e00, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */ ++ { 0x820e9000, 0x23400, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */ ++ { 0x820ea000, 0x24000, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */ ++ { 0x820eb000, 0x24200, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */ ++ { 0x820ec000, 0x24600, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_INT) */ ++ { 0x820ed000, 0x24800, 0x00800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */ ++ { 0x820f0000, 0xa0000, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */ ++ { 0x820f1000, 0xa0600, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */ ++ { 0x820f2000, 0xa0800, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */ ++ { 0x820f3000, 0xa0c00, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */ ++ { 0x820f4000, 0xa1000, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */ ++ { 0x820f5000, 0xa1400, 0x00800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */ ++ { 0x820f7000, 0xa1e00, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */ ++ { 0x820f9000, 0xa3400, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */ ++ { 0x820fa000, 0xa4000, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */ ++ { 0x820fb000, 0xa4200, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */ ++ { 0x820fc000, 0xa4600, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_INT) */ ++ { 0x820fd000, 0xa4800, 0x00800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */ + { 0x0, 0x0, 0x0 }, /* imply end of search */ + }; + +-static const struct __map mt7916_reg_map[] = { +- { 0x54000000, 0x02000, 0x1000 }, /* WFDMA_0 (PCIE0 MCU DMA0) */ +- { 0x55000000, 0x03000, 0x1000 }, /* WFDMA_1 (PCIE0 MCU DMA1) */ +- { 0x56000000, 0x04000, 0x1000 }, /* WFDMA_2 (Reserved) */ +- { 0x57000000, 0x05000, 0x1000 }, /* WFDMA_3 (MCU wrap CR) */ +- { 0x58000000, 0x06000, 0x1000 }, /* WFDMA_4 (PCIE1 MCU DMA0) */ +- { 0x59000000, 0x07000, 0x1000 }, /* WFDMA_5 (PCIE1 MCU DMA1) */ +- { 0x820c0000, 0x08000, 0x4000 }, /* WF_UMAC_TOP (PLE) */ +- { 0x820c8000, 0x0c000, 0x2000 }, /* WF_UMAC_TOP (PSE) */ +- { 0x820cc000, 0x0e000, 0x2000 }, /* WF_UMAC_TOP (PP) */ +- { 0x820e0000, 0x20000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ +- { 0x820e1000, 0x20400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */ +- { 0x820e2000, 0x20800, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */ +- { 0x820e3000, 0x20c00, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */ +- { 0x820e4000, 0x21000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */ +- { 0x820e5000, 0x21400, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */ +- { 0x820ce000, 0x21c00, 0x0200 }, /* WF_LMAC_TOP (WF_SEC) */ +- { 0x820e7000, 0x21e00, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */ +- { 0x820cf000, 0x22000, 0x1000 }, /* WF_LMAC_TOP (WF_PF) */ +- { 0x820e9000, 0x23400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */ +- { 0x820ea000, 0x24000, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */ +- { 0x820eb000, 0x24200, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */ +- { 0x820ec000, 0x24600, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_INT) */ +- { 0x820ed000, 0x24800, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */ +- { 0x820ca000, 0x26000, 0x2000 }, /* WF_LMAC_TOP BN0 (WF_MUCOP) */ +- { 0x820d0000, 0x30000, 0x10000}, /* WF_LMAC_TOP (WF_WTBLON) */ +- { 0x00400000, 0x80000, 0x10000}, /* WF_MCU_SYSRAM */ +- { 0x00410000, 0x90000, 0x10000}, /* WF_MCU_SYSRAM (configure cr) */ +- { 0x820f0000, 0xa0000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */ +- { 0x820f1000, 0xa0600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */ +- { 0x820f2000, 0xa0800, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */ +- { 0x820f3000, 0xa0c00, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */ +- { 0x820f4000, 0xa1000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */ +- { 0x820f5000, 0xa1400, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */ +- { 0x820f7000, 0xa1e00, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */ +- { 0x820f9000, 0xa3400, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */ +- { 0x820fa000, 0xa4000, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */ +- { 0x820fb000, 0xa4200, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */ +- { 0x820fc000, 0xa4600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_INT) */ +- { 0x820fd000, 0xa4800, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */ +- { 0x820c4000, 0xa8000, 0x1000 }, /* WF_LMAC_TOP (WF_UWTBL ) */ +- { 0x820b0000, 0xae000, 0x1000 }, /* [APB2] WFSYS_ON */ +- { 0x80020000, 0xb0000, 0x10000}, /* WF_TOP_MISC_OFF */ +- { 0x81020000, 0xc0000, 0x10000}, /* WF_TOP_MISC_ON */ ++static const struct mt76_connac_reg_map mt7916_reg_map[] = { ++ { 0x54000000, 0x02000, 0x01000 }, /* WFDMA_0 (PCIE0 MCU DMA0) */ ++ { 0x55000000, 0x03000, 0x01000 }, /* WFDMA_1 (PCIE0 MCU DMA1) */ ++ { 0x56000000, 0x04000, 0x01000 }, /* WFDMA_2 (Reserved) */ ++ { 0x57000000, 0x05000, 0x01000 }, /* WFDMA_3 (MCU wrap CR) */ ++ { 0x58000000, 0x06000, 0x01000 }, /* WFDMA_4 (PCIE1 MCU DMA0) */ ++ { 0x59000000, 0x07000, 0x01000 }, /* WFDMA_5 (PCIE1 MCU DMA1) */ ++ { 0x820c0000, 0x08000, 0x04000 }, /* WF_UMAC_TOP (PLE) */ ++ { 0x820c8000, 0x0c000, 0x02000 }, /* WF_UMAC_TOP (PSE) */ ++ { 0x820cc000, 0x0e000, 0x02000 }, /* WF_UMAC_TOP (PP) */ ++ { 0x820e0000, 0x20000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ ++ { 0x820e1000, 0x20400, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */ ++ { 0x820e2000, 0x20800, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */ ++ { 0x820e3000, 0x20c00, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */ ++ { 0x820e4000, 0x21000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */ ++ { 0x820e5000, 0x21400, 0x00800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */ ++ { 0x820ce000, 0x21c00, 0x00200 }, /* WF_LMAC_TOP (WF_SEC) */ ++ { 0x820e7000, 0x21e00, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */ ++ { 0x820cf000, 0x22000, 0x01000 }, /* WF_LMAC_TOP (WF_PF) */ ++ { 0x820e9000, 0x23400, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */ ++ { 0x820ea000, 0x24000, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */ ++ { 0x820eb000, 0x24200, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */ ++ { 0x820ec000, 0x24600, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_INT) */ ++ { 0x820ed000, 0x24800, 0x00800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */ ++ { 0x820ca000, 0x26000, 0x02000 }, /* WF_LMAC_TOP BN0 (WF_MUCOP) */ ++ { 0x820d0000, 0x30000, 0x10000 }, /* WF_LMAC_TOP (WF_WTBLON) */ ++ { 0x00400000, 0x80000, 0x10000 }, /* WF_MCU_SYSRAM */ ++ { 0x00410000, 0x90000, 0x10000 }, /* WF_MCU_SYSRAM (configure cr) */ ++ { 0x820f0000, 0xa0000, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */ ++ { 0x820f1000, 0xa0600, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */ ++ { 0x820f2000, 0xa0800, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */ ++ { 0x820f3000, 0xa0c00, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */ ++ { 0x820f4000, 0xa1000, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */ ++ { 0x820f5000, 0xa1400, 0x00800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */ ++ { 0x820f7000, 0xa1e00, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */ ++ { 0x820f9000, 0xa3400, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */ ++ { 0x820fa000, 0xa4000, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */ ++ { 0x820fb000, 0xa4200, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */ ++ { 0x820fc000, 0xa4600, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_INT) */ ++ { 0x820fd000, 0xa4800, 0x00800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */ ++ { 0x820c4000, 0xa8000, 0x01000 }, /* WF_LMAC_TOP (WF_UWTBL ) */ ++ { 0x820b0000, 0xae000, 0x01000 }, /* [APB2] WFSYS_ON */ ++ { 0x80020000, 0xb0000, 0x10000 }, /* WF_TOP_MISC_OFF */ ++ { 0x81020000, 0xc0000, 0x10000 }, /* WF_TOP_MISC_ON */ + { 0x0, 0x0, 0x0 }, /* imply end of search */ + }; + +-static const struct __map mt7986_reg_map[] = { +- { 0x54000000, 0x402000, 0x1000 }, /* WFDMA_0 (PCIE0 MCU DMA0) */ +- { 0x55000000, 0x403000, 0x1000 }, /* WFDMA_1 (PCIE0 MCU DMA1) */ +- { 0x56000000, 0x404000, 0x1000 }, /* WFDMA_2 (Reserved) */ +- { 0x57000000, 0x405000, 0x1000 }, /* WFDMA_3 (MCU wrap CR) */ +- { 0x58000000, 0x406000, 0x1000 }, /* WFDMA_4 (PCIE1 MCU DMA0) */ +- { 0x59000000, 0x407000, 0x1000 }, /* WFDMA_5 (PCIE1 MCU DMA1) */ +- { 0x820c0000, 0x408000, 0x4000 }, /* WF_UMAC_TOP (PLE) */ +- { 0x820c8000, 0x40c000, 0x2000 }, /* WF_UMAC_TOP (PSE) */ +- { 0x820cc000, 0x40e000, 0x2000 }, /* WF_UMAC_TOP (PP) */ +- { 0x820e0000, 0x420000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ +- { 0x820e1000, 0x420400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */ +- { 0x820e2000, 0x420800, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */ +- { 0x820e3000, 0x420c00, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */ +- { 0x820e4000, 0x421000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */ +- { 0x820e5000, 0x421400, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */ +- { 0x820ce000, 0x421c00, 0x0200 }, /* WF_LMAC_TOP (WF_SEC) */ +- { 0x820e7000, 0x421e00, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */ +- { 0x820cf000, 0x422000, 0x1000 }, /* WF_LMAC_TOP (WF_PF) */ +- { 0x820e9000, 0x423400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */ +- { 0x820ea000, 0x424000, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */ +- { 0x820eb000, 0x424200, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */ +- { 0x820ec000, 0x424600, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_INT) */ +- { 0x820ed000, 0x424800, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */ +- { 0x820ca000, 0x426000, 0x2000 }, /* WF_LMAC_TOP BN0 (WF_MUCOP) */ +- { 0x820d0000, 0x430000, 0x10000}, /* WF_LMAC_TOP (WF_WTBLON) */ +- { 0x00400000, 0x480000, 0x10000}, /* WF_MCU_SYSRAM */ +- { 0x00410000, 0x490000, 0x10000}, /* WF_MCU_SYSRAM */ +- { 0x820f0000, 0x4a0000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */ +- { 0x820f1000, 0x4a0600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */ +- { 0x820f2000, 0x4a0800, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */ +- { 0x820f3000, 0x4a0c00, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */ +- { 0x820f4000, 0x4a1000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */ +- { 0x820f5000, 0x4a1400, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */ +- { 0x820f7000, 0x4a1e00, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */ +- { 0x820f9000, 0x4a3400, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */ +- { 0x820fa000, 0x4a4000, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */ +- { 0x820fb000, 0x4a4200, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */ +- { 0x820fc000, 0x4a4600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_INT) */ +- { 0x820fd000, 0x4a4800, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */ +- { 0x820c4000, 0x4a8000, 0x1000 }, /* WF_LMAC_TOP (WF_UWTBL ) */ +- { 0x820b0000, 0x4ae000, 0x1000 }, /* [APB2] WFSYS_ON */ +- { 0x80020000, 0x4b0000, 0x10000}, /* WF_TOP_MISC_OFF */ +- { 0x81020000, 0x4c0000, 0x10000}, /* WF_TOP_MISC_ON */ +- { 0x89000000, 0x4d0000, 0x1000 }, /* WF_MCU_CFG_ON */ +- { 0x89010000, 0x4d1000, 0x1000 }, /* WF_MCU_CIRQ */ +- { 0x89020000, 0x4d2000, 0x1000 }, /* WF_MCU_GPT */ +- { 0x89030000, 0x4d3000, 0x1000 }, /* WF_MCU_WDT */ +- { 0x80010000, 0x4d4000, 0x1000 }, /* WF_AXIDMA */ ++static const struct mt76_connac_reg_map mt7986_reg_map[] = { ++ { 0x54000000, 0x402000, 0x01000 }, /* WFDMA_0 (PCIE0 MCU DMA0) */ ++ { 0x55000000, 0x403000, 0x01000 }, /* WFDMA_1 (PCIE0 MCU DMA1) */ ++ { 0x56000000, 0x404000, 0x01000 }, /* WFDMA_2 (Reserved) */ ++ { 0x57000000, 0x405000, 0x01000 }, /* WFDMA_3 (MCU wrap CR) */ ++ { 0x58000000, 0x406000, 0x01000 }, /* WFDMA_4 (PCIE1 MCU DMA0) */ ++ { 0x59000000, 0x407000, 0x01000 }, /* WFDMA_5 (PCIE1 MCU DMA1) */ ++ { 0x820c0000, 0x408000, 0x04000 }, /* WF_UMAC_TOP (PLE) */ ++ { 0x820c8000, 0x40c000, 0x02000 }, /* WF_UMAC_TOP (PSE) */ ++ { 0x820cc000, 0x40e000, 0x02000 }, /* WF_UMAC_TOP (PP) */ ++ { 0x820e0000, 0x420000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ ++ { 0x820e1000, 0x420400, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */ ++ { 0x820e2000, 0x420800, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */ ++ { 0x820e3000, 0x420c00, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */ ++ { 0x820e4000, 0x421000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */ ++ { 0x820e5000, 0x421400, 0x00800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */ ++ { 0x820ce000, 0x421c00, 0x00200 }, /* WF_LMAC_TOP (WF_SEC) */ ++ { 0x820e7000, 0x421e00, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */ ++ { 0x820cf000, 0x422000, 0x01000 }, /* WF_LMAC_TOP (WF_PF) */ ++ { 0x820e9000, 0x423400, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */ ++ { 0x820ea000, 0x424000, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */ ++ { 0x820eb000, 0x424200, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */ ++ { 0x820ec000, 0x424600, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_INT) */ ++ { 0x820ed000, 0x424800, 0x00800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */ ++ { 0x820ca000, 0x426000, 0x02000 }, /* WF_LMAC_TOP BN0 (WF_MUCOP) */ ++ { 0x820d0000, 0x430000, 0x10000 }, /* WF_LMAC_TOP (WF_WTBLON) */ ++ { 0x00400000, 0x480000, 0x10000 }, /* WF_MCU_SYSRAM */ ++ { 0x00410000, 0x490000, 0x10000 }, /* WF_MCU_SYSRAM */ ++ { 0x820f0000, 0x4a0000, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */ ++ { 0x820f1000, 0x4a0600, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */ ++ { 0x820f2000, 0x4a0800, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */ ++ { 0x820f3000, 0x4a0c00, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */ ++ { 0x820f4000, 0x4a1000, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */ ++ { 0x820f5000, 0x4a1400, 0x00800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */ ++ { 0x820f7000, 0x4a1e00, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */ ++ { 0x820f9000, 0x4a3400, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */ ++ { 0x820fa000, 0x4a4000, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */ ++ { 0x820fb000, 0x4a4200, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */ ++ { 0x820fc000, 0x4a4600, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_INT) */ ++ { 0x820fd000, 0x4a4800, 0x00800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */ ++ { 0x820c4000, 0x4a8000, 0x01000 }, /* WF_LMAC_TOP (WF_UWTBL ) */ ++ { 0x820b0000, 0x4ae000, 0x01000 }, /* [APB2] WFSYS_ON */ ++ { 0x80020000, 0x4b0000, 0x10000 }, /* WF_TOP_MISC_OFF */ ++ { 0x81020000, 0x4c0000, 0x10000 }, /* WF_TOP_MISC_ON */ ++ { 0x89000000, 0x4d0000, 0x01000 }, /* WF_MCU_CFG_ON */ ++ { 0x89010000, 0x4d1000, 0x01000 }, /* WF_MCU_CIRQ */ ++ { 0x89020000, 0x4d2000, 0x01000 }, /* WF_MCU_GPT */ ++ { 0x89030000, 0x4d3000, 0x01000 }, /* WF_MCU_WDT */ ++ { 0x80010000, 0x4d4000, 0x01000 }, /* WF_AXIDMA */ + { 0x0, 0x0, 0x0 }, /* imply end of search */ + }; + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h +index 2493c3ad3c56..53061aa727e9 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7915/regs.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7915/regs.h +@@ -4,17 +4,11 @@ + #ifndef __MT7915_REGS_H + #define __MT7915_REGS_H + +-struct __map { +- u32 phys; +- u32 maps; +- u32 size; +-}; +- + /* used to differentiate between generations */ + struct mt7915_reg_desc { + const u32 *reg_rev; + const u32 *offs_rev; +- const struct __map *map; ++ const struct mt76_connac_reg_map *map; + u32 map_size; + }; + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +index e5b1f6249763..421dd831580e 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +@@ -123,54 +123,50 @@ static void mt7921e_unregister_device(struct mt7921_dev *dev) + + static u32 __mt7921_reg_addr(struct mt7921_dev *dev, u32 addr) + { +- static const struct { +- u32 phys; +- u32 mapped; +- u32 size; +- } fixed_map[] = { ++ static const struct mt76_connac_reg_map fixed_map[] = { + { 0x820d0000, 0x30000, 0x10000 }, /* WF_LMAC_TOP (WF_WTBLON) */ +- { 0x820ed000, 0x24800, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */ +- { 0x820e4000, 0x21000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */ +- { 0x820e7000, 0x21e00, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */ +- { 0x820eb000, 0x24200, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */ +- { 0x820e2000, 0x20800, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */ +- { 0x820e3000, 0x20c00, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */ +- { 0x820e5000, 0x21400, 0x0800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */ ++ { 0x820ed000, 0x24800, 0x00800 }, /* WF_LMAC_TOP BN0 (WF_MIB) */ ++ { 0x820e4000, 0x21000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_TMAC) */ ++ { 0x820e7000, 0x21e00, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_DMA) */ ++ { 0x820eb000, 0x24200, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_LPON) */ ++ { 0x820e2000, 0x20800, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_AGG) */ ++ { 0x820e3000, 0x20c00, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_ARB) */ ++ { 0x820e5000, 0x21400, 0x00800 }, /* WF_LMAC_TOP BN0 (WF_RMAC) */ + { 0x00400000, 0x80000, 0x10000 }, /* WF_MCU_SYSRAM */ + { 0x00410000, 0x90000, 0x10000 }, /* WF_MCU_SYSRAM (configure register) */ + { 0x40000000, 0x70000, 0x10000 }, /* WF_UMAC_SYSRAM */ +- { 0x54000000, 0x02000, 0x1000 }, /* WFDMA PCIE0 MCU DMA0 */ +- { 0x55000000, 0x03000, 0x1000 }, /* WFDMA PCIE0 MCU DMA1 */ +- { 0x58000000, 0x06000, 0x1000 }, /* WFDMA PCIE1 MCU DMA0 (MEM_DMA) */ +- { 0x59000000, 0x07000, 0x1000 }, /* WFDMA PCIE1 MCU DMA1 */ ++ { 0x54000000, 0x02000, 0x01000 }, /* WFDMA PCIE0 MCU DMA0 */ ++ { 0x55000000, 0x03000, 0x01000 }, /* WFDMA PCIE0 MCU DMA1 */ ++ { 0x58000000, 0x06000, 0x01000 }, /* WFDMA PCIE1 MCU DMA0 (MEM_DMA) */ ++ { 0x59000000, 0x07000, 0x01000 }, /* WFDMA PCIE1 MCU DMA1 */ + { 0x7c000000, 0xf0000, 0x10000 }, /* CONN_INFRA */ + { 0x7c020000, 0xd0000, 0x10000 }, /* CONN_INFRA, WFDMA */ + { 0x7c060000, 0xe0000, 0x10000 }, /* CONN_INFRA, conn_host_csr_top */ + { 0x80020000, 0xb0000, 0x10000 }, /* WF_TOP_MISC_OFF */ + { 0x81020000, 0xc0000, 0x10000 }, /* WF_TOP_MISC_ON */ +- { 0x820c0000, 0x08000, 0x4000 }, /* WF_UMAC_TOP (PLE) */ +- { 0x820c8000, 0x0c000, 0x2000 }, /* WF_UMAC_TOP (PSE) */ +- { 0x820cc000, 0x0e000, 0x1000 }, /* WF_UMAC_TOP (PP) */ +- { 0x820cd000, 0x0f000, 0x1000 }, /* WF_MDP_TOP */ +- { 0x820ce000, 0x21c00, 0x0200 }, /* WF_LMAC_TOP (WF_SEC) */ +- { 0x820cf000, 0x22000, 0x1000 }, /* WF_LMAC_TOP (WF_PF) */ +- { 0x820e0000, 0x20000, 0x0400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ +- { 0x820e1000, 0x20400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */ +- { 0x820e9000, 0x23400, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */ +- { 0x820ea000, 0x24000, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */ +- { 0x820ec000, 0x24600, 0x0200 }, /* WF_LMAC_TOP BN0 (WF_INT) */ +- { 0x820f0000, 0xa0000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */ +- { 0x820f1000, 0xa0600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */ +- { 0x820f2000, 0xa0800, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */ +- { 0x820f3000, 0xa0c00, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */ +- { 0x820f4000, 0xa1000, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */ +- { 0x820f5000, 0xa1400, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */ +- { 0x820f7000, 0xa1e00, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */ +- { 0x820f9000, 0xa3400, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */ +- { 0x820fa000, 0xa4000, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */ +- { 0x820fb000, 0xa4200, 0x0400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */ +- { 0x820fc000, 0xa4600, 0x0200 }, /* WF_LMAC_TOP BN1 (WF_INT) */ +- { 0x820fd000, 0xa4800, 0x0800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */ ++ { 0x820c0000, 0x08000, 0x04000 }, /* WF_UMAC_TOP (PLE) */ ++ { 0x820c8000, 0x0c000, 0x02000 }, /* WF_UMAC_TOP (PSE) */ ++ { 0x820cc000, 0x0e000, 0x01000 }, /* WF_UMAC_TOP (PP) */ ++ { 0x820cd000, 0x0f000, 0x01000 }, /* WF_MDP_TOP */ ++ { 0x820ce000, 0x21c00, 0x00200 }, /* WF_LMAC_TOP (WF_SEC) */ ++ { 0x820cf000, 0x22000, 0x01000 }, /* WF_LMAC_TOP (WF_PF) */ ++ { 0x820e0000, 0x20000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ ++ { 0x820e1000, 0x20400, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_TRB) */ ++ { 0x820e9000, 0x23400, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_WTBLOFF) */ ++ { 0x820ea000, 0x24000, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_ETBF) */ ++ { 0x820ec000, 0x24600, 0x00200 }, /* WF_LMAC_TOP BN0 (WF_INT) */ ++ { 0x820f0000, 0xa0000, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_CFG) */ ++ { 0x820f1000, 0xa0600, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_TRB) */ ++ { 0x820f2000, 0xa0800, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_AGG) */ ++ { 0x820f3000, 0xa0c00, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_ARB) */ ++ { 0x820f4000, 0xa1000, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_TMAC) */ ++ { 0x820f5000, 0xa1400, 0x00800 }, /* WF_LMAC_TOP BN1 (WF_RMAC) */ ++ { 0x820f7000, 0xa1e00, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_DMA) */ ++ { 0x820f9000, 0xa3400, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_WTBLOFF) */ ++ { 0x820fa000, 0xa4000, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_ETBF) */ ++ { 0x820fb000, 0xa4200, 0x00400 }, /* WF_LMAC_TOP BN1 (WF_LPON) */ ++ { 0x820fc000, 0xa4600, 0x00200 }, /* WF_LMAC_TOP BN1 (WF_INT) */ ++ { 0x820fd000, 0xa4800, 0x00800 }, /* WF_LMAC_TOP BN1 (WF_MIB) */ + }; + int i; + +@@ -187,7 +183,7 @@ static u32 __mt7921_reg_addr(struct mt7921_dev *dev, u32 addr) + if (ofs > fixed_map[i].size) + continue; + +- return fixed_map[i].mapped + ofs; ++ return fixed_map[i].maps + ofs; + } + + if ((addr >= 0x18000000 && addr < 0x18c00000) || +-- +2.35.1 + diff --git a/queue-6.0/wifi-mt76-mt7921e-fix-random-fw-download-fail.patch b/queue-6.0/wifi-mt76-mt7921e-fix-random-fw-download-fail.patch new file mode 100644 index 00000000000..19237d5ee52 --- /dev/null +++ b/queue-6.0/wifi-mt76-mt7921e-fix-random-fw-download-fail.patch @@ -0,0 +1,81 @@ +From 9eb9f0995dd4c62bf7ed49b60e3fb11df8d99819 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 12 Sep 2022 16:45:52 +0800 +Subject: wifi: mt76: mt7921e: fix random fw download fail + +From: Deren Wu + +[ Upstream commit 29e247ece5d3edfa71495768a9ab5fc7bba76bd4 ] + +In case of PCIe interoperability problem shows up, the firmware +payload may be corrupted in download stage. Turn off L0s to keep +fw download process accurately. + +[ 1093.528363] mt7921e 0000:3b:00.0: Message 00000007 (seq 7) timeout +[ 1093.528414] mt7921e 0000:3b:00.0: Failed to start patch +[ 1096.600156] mt7921e 0000:3b:00.0: Message 00000010 (seq 8) timeout +[ 1096.600207] mt7921e 0000:3b:00.0: Failed to release patch semaphore +[ 1097.699031] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1098.758427] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1099.834408] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1100.915264] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1101.990625] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1103.077587] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1104.173258] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1105.248466] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1106.336969] mt7921e 0000:3b:00.0: Timeout for driver own +[ 1106.397542] mt7921e 0000:3b:00.0: hardware init failed + +Cc: stable@vger.kernel.org +Fixes: bf3747ae2e25 ("mt76: mt7921: enable aspm by default") +Signed-off-by: Deren Wu +Tested-by: AngeloGioacchino Del Regno +Signed-off-by: Felix Fietkau +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/mediatek/mt76/mt7921/pci.c | 1 + + drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c | 2 ++ + drivers/net/wireless/mediatek/mt76/mt7921/regs.h | 2 ++ + 3 files changed, 5 insertions(+) + +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +index 421dd831580e..41f483f9f1c3 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci.c +@@ -148,6 +148,7 @@ static u32 __mt7921_reg_addr(struct mt7921_dev *dev, u32 addr) + { 0x820c8000, 0x0c000, 0x02000 }, /* WF_UMAC_TOP (PSE) */ + { 0x820cc000, 0x0e000, 0x01000 }, /* WF_UMAC_TOP (PP) */ + { 0x820cd000, 0x0f000, 0x01000 }, /* WF_MDP_TOP */ ++ { 0x74030000, 0x10000, 0x10000 }, /* PCIE_MAC_IREG */ + { 0x820ce000, 0x21c00, 0x00200 }, /* WF_LMAC_TOP (WF_SEC) */ + { 0x820cf000, 0x22000, 0x01000 }, /* WF_LMAC_TOP (WF_PF) */ + { 0x820e0000, 0x20000, 0x00400 }, /* WF_LMAC_TOP BN0 (WF_CFG) */ +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c b/drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c +index 5efda694fb9d..19facf31e4e1 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/pci_mcu.c +@@ -59,6 +59,8 @@ int mt7921e_mcu_init(struct mt7921_dev *dev) + if (err) + return err; + ++ mt76_rmw_field(dev, MT_PCIE_MAC_PM, MT_PCIE_MAC_PM_L0S_DIS, 1); ++ + err = mt7921_run_firmware(dev); + + mt76_queue_tx_cleanup(dev, dev->mt76.q_mcu[MT_MCUQ_FWDL], false); +diff --git a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h +index ea643260ceb6..c65582acfa55 100644 +--- a/drivers/net/wireless/mediatek/mt76/mt7921/regs.h ++++ b/drivers/net/wireless/mediatek/mt76/mt7921/regs.h +@@ -440,6 +440,8 @@ + #define MT_PCIE_MAC_BASE 0x10000 + #define MT_PCIE_MAC(ofs) (MT_PCIE_MAC_BASE + (ofs)) + #define MT_PCIE_MAC_INT_ENABLE MT_PCIE_MAC(0x188) ++#define MT_PCIE_MAC_PM MT_PCIE_MAC(0x194) ++#define MT_PCIE_MAC_PM_L0S_DIS BIT(8) + + #define MT_DMA_SHDL(ofs) (0x7c026000 + (ofs)) + #define MT_DMASHDL_SW_CONTROL MT_DMA_SHDL(0x004) +-- +2.35.1 + diff --git a/queue-6.0/wwan_hwsim-fix-possible-memory-leak-in-wwan_hwsim_de.patch b/queue-6.0/wwan_hwsim-fix-possible-memory-leak-in-wwan_hwsim_de.patch new file mode 100644 index 00000000000..cba8c424bc4 --- /dev/null +++ b/queue-6.0/wwan_hwsim-fix-possible-memory-leak-in-wwan_hwsim_de.patch @@ -0,0 +1,53 @@ +From 8fed97e111c2c9bef17647515e146558e06bdd7f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 18 Oct 2022 21:16:07 +0800 +Subject: wwan_hwsim: fix possible memory leak in wwan_hwsim_dev_new() + +From: Yang Yingliang + +[ Upstream commit 258ad2fe5ede773625adfda88b173f4123e59f45 ] + +Inject fault while probing module, if device_register() fails, +but the refcount of kobject is not decreased to 0, the name +allocated in dev_set_name() is leaked. Fix this by calling +put_device(), so that name can be freed in callback function +kobject_cleanup(). + +unreferenced object 0xffff88810152ad20 (size 8): + comm "modprobe", pid 252, jiffies 4294849206 (age 22.713s) + hex dump (first 8 bytes): + 68 77 73 69 6d 30 00 ff hwsim0.. + backtrace: + [<000000009c3504ed>] __kmalloc_node_track_caller+0x44/0x1b0 + [<00000000c0228a5e>] kvasprintf+0xb5/0x140 + [<00000000cff8c21f>] kvasprintf_const+0x55/0x180 + [<0000000055a1e073>] kobject_set_name_vargs+0x56/0x150 + [<000000000a80b139>] dev_set_name+0xab/0xe0 + +Fixes: f36a111a74e7 ("wwan_hwsim: WWAN device simulator") +Signed-off-by: Yang Yingliang +Reviewed-by: Loic Poulain +Acked-by: Sergey Ryazanov +Link: https://lore.kernel.org/r/20221018131607.1901641-1-yangyingliang@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/wwan/wwan_hwsim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/wwan/wwan_hwsim.c b/drivers/net/wwan/wwan_hwsim.c +index fad642f9ffd8..857a55b625fe 100644 +--- a/drivers/net/wwan/wwan_hwsim.c ++++ b/drivers/net/wwan/wwan_hwsim.c +@@ -311,7 +311,7 @@ static struct wwan_hwsim_dev *wwan_hwsim_dev_new(void) + return ERR_PTR(err); + + err_free_dev: +- kfree(dev); ++ put_device(&dev->dev); + + return ERR_PTR(err); + } +-- +2.35.1 + -- 2.47.3