From 3a0738b51c47d248fdd7276f6b8deb30513bbb9b Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 23 Mar 2025 13:44:04 -0400 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...1-don-t-mark-timer-regs-unconfigured.patch | 44 ++++ ...cm2711-pl011-uarts-are-actually-r1p5.patch | 74 ++++++ ...omap1-select-config_generic_irq_chip.patch | 46 ++++ ...freescale-tqma8mpql-fix-vqmmc-supply.patch | 63 +++++ ...-fix-error-code-in-chan_alloc_skb_cb.patch | 45 ++++ ...e-imx-scu-fix-of-node-leak-in-.probe.patch | 36 +++ ...-of-nhc_pcpu_rth_output-in-fib_check.patch | 49 ++++ ...fter-ip_fib_metrics_init-in-ip6_rout.patch | 57 +++++ ...t-atm-fix-use-after-free-in-lec_send.patch | 46 ++++ .../net-lwtunnel-fix-recursion-loops.patch | 176 +++++++++++++ ...-missing-policy-for-ndtpa_queue_lenb.patch | 39 +++ ...-missing-paranthesis-in-map_qp_id_to.patch | 42 ++++ ...id-clearing-vlan_id-mask-in-modify-q.patch | 42 ++++ ...issing-rollback-in-error-path-of-hns.patch | 39 +++ ...fix-soft-lockup-during-bt-pages-loop.patch | 100 ++++++++ ...atched-condition-in-error-path-of-al.patch | 64 +++++ ...ma-hns-fix-wrong-value-of-max_sge_rd.patch | 38 +++ ...x-ipv6-link-local-address-generation.patch | 66 +++++ queue-6.1/series | 22 ++ .../soc-imx8m-remove-global-soc_uid.patch | 127 ++++++++++ ...ster-cpufreq-and-soc-dev-in-cleanup-.patch | 78 ++++++ ...vm_-to-simplify-probe-failure-handli.patch | 235 ++++++++++++++++++ ...rce-software-gso-only-in-tunnel-mode.patch | 77 ++++++ 23 files changed, 1605 insertions(+) create mode 100644 queue-6.1/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch create mode 100644 queue-6.1/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch create mode 100644 queue-6.1/arm-omap1-select-config_generic_irq_chip.patch create mode 100644 queue-6.1/arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch create mode 100644 queue-6.1/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch create mode 100644 queue-6.1/firmware-imx-scu-fix-of-node-leak-in-.probe.patch create mode 100644 queue-6.1/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch create mode 100644 queue-6.1/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch create mode 100644 queue-6.1/net-atm-fix-use-after-free-in-lec_send.patch create mode 100644 queue-6.1/net-lwtunnel-fix-recursion-loops.patch create mode 100644 queue-6.1/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch create mode 100644 queue-6.1/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch create mode 100644 queue-6.1/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch create mode 100644 queue-6.1/rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch create mode 100644 queue-6.1/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch create mode 100644 queue-6.1/rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch create mode 100644 queue-6.1/rdma-hns-fix-wrong-value-of-max_sge_rd.patch create mode 100644 queue-6.1/revert-gre-fix-ipv6-link-local-address-generation.patch create mode 100644 queue-6.1/soc-imx8m-remove-global-soc_uid.patch create mode 100644 queue-6.1/soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch create mode 100644 queue-6.1/soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch create mode 100644 queue-6.1/xfrm_output-force-software-gso-only-in-tunnel-mode.patch diff --git a/queue-6.1/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch b/queue-6.1/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch new file mode 100644 index 0000000000..675e1112b5 --- /dev/null +++ b/queue-6.1/arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch @@ -0,0 +1,44 @@ +From c4bed0851cad0ad33a036d842caeab5f7c19f222 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 22 Feb 2025 10:41:13 +0100 +Subject: ARM: dts: bcm2711: Don't mark timer regs unconfigured + +From: Phil Elwell + +[ Upstream commit c24f272ae751a9f54f8816430e7f2d56031892cc ] + +During upstream process of Raspberry Pi 4 back in 2019 the ARMv7 stubs +didn't configured the ARM architectural timer. This firmware issue has +been fixed in 2020, which gave users enough time to update their system. + +So drop this property to allow the use of the vDSO version of +clock_gettime. + +Link: https://github.com/raspberrypi/tools/pull/113 +Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Reviewed-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20250222094113.48198-1-wahrenst@gmx.net +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2711.dtsi | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi +index d94e70d36dcad..27b467219a402 100644 +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -451,8 +451,6 @@ IRQ_TYPE_LEVEL_LOW)>, + IRQ_TYPE_LEVEL_LOW)>, + ; +- /* This only applies to the ARMv7 stub */ +- arm,cpu-registers-not-fw-configured; + }; + + cpus: cpus { +-- +2.39.5 + diff --git a/queue-6.1/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch b/queue-6.1/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch new file mode 100644 index 0000000000..0866add3ed --- /dev/null +++ b/queue-6.1/arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch @@ -0,0 +1,74 @@ +From b11ad35b814af1336a4be8b9772d41eb969431e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Feb 2025 13:56:13 +0100 +Subject: ARM: dts: bcm2711: PL011 UARTs are actually r1p5 + +From: Phil Elwell + +[ Upstream commit 0de09025f161f67c07978c4742e221243d070d41 ] + +The ARM PL011 UART instances in BCM2711 are r1p5 spec, which means they +have 32-entry FIFOs. The correct periphid value for this is 0x00341011. +Thanks to N Buchwitz for pointing this out. + +Signed-off-by: Phil Elwell +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20250223125614.3592-2-wahrenst@gmx.net +Fixes: 7dbe8c62ceeb ("ARM: dts: Add minimal Raspberry Pi 4 support") +Signed-off-by: Florian Fainelli +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/bcm2711.dtsi | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi +index 941c4d16791b4..d94e70d36dcad 100644 +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -134,7 +134,7 @@ uart2: serial@7e201400 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -145,7 +145,7 @@ uart3: serial@7e201600 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -156,7 +156,7 @@ uart4: serial@7e201800 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -167,7 +167,7 @@ uart5: serial@7e201a00 { + clocks = <&clocks BCM2835_CLOCK_UART>, + <&clocks BCM2835_CLOCK_VPU>; + clock-names = "uartclk", "apb_pclk"; +- arm,primecell-periphid = <0x00241011>; ++ arm,primecell-periphid = <0x00341011>; + status = "disabled"; + }; + +@@ -1154,6 +1154,7 @@ &txp { + }; + + &uart0 { ++ arm,primecell-periphid = <0x00341011>; + interrupts = ; + }; + +-- +2.39.5 + diff --git a/queue-6.1/arm-omap1-select-config_generic_irq_chip.patch b/queue-6.1/arm-omap1-select-config_generic_irq_chip.patch new file mode 100644 index 0000000000..bad328c29a --- /dev/null +++ b/queue-6.1/arm-omap1-select-config_generic_irq_chip.patch @@ -0,0 +1,46 @@ +From e81355fa67fb097b247dab73dbf97fc154e717f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 5 Feb 2025 13:11:33 +0100 +Subject: ARM: OMAP1: select CONFIG_GENERIC_IRQ_CHIP + +From: Arnd Bergmann + +[ Upstream commit 98f3ab18a0a55aa1ff2cd6b74bd0c02c8f76f17e ] + +When GENERIC_IRQ_CHIP is disabled, OMAP1 kernels fail to link: + +arm-linux-gnueabi-ld: arch/arm/mach-omap1/irq.o: in function `omap1_init_irq': +irq.c:(.init.text+0x1e8): undefined reference to `irq_alloc_generic_chip' +arm-linux-gnueabi-ld: irq.c:(.init.text+0x228): undefined reference to `irq_setup_generic_chip' +arm-linux-gnueabi-ld: irq.c:(.init.text+0x2a8): undefined reference to `irq_gc_set_wake' +arm-linux-gnueabi-ld: irq.c:(.init.text+0x2b0): undefined reference to `irq_gc_mask_set_bit' +arm-linux-gnueabi-ld: irq.c:(.init.text+0x2b4): undefined reference to `irq_gc_mask_clr_bit' + +This has apparently been the case for many years, but I never caught it +in randconfig builds until now, as there are dozens of other drivers +that also 'select GENERIC_IRQ_CHIP' and statistically there is almost +always one of them enabled. + +Fixes: 55b447744389 ("ARM: OMAP1: Switch to use generic irqchip in preparation for sparse IRQ") +Link: https://lore.kernel.org/r/20250205121151.289535-1-arnd@kernel.org +Signed-off-by: Arnd Bergmann +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap1/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm/mach-omap1/Kconfig b/arch/arm/mach-omap1/Kconfig +index 7ec7ada287e05..16bf3bed38feb 100644 +--- a/arch/arm/mach-omap1/Kconfig ++++ b/arch/arm/mach-omap1/Kconfig +@@ -9,6 +9,7 @@ menuconfig ARCH_OMAP1 + select ARCH_OMAP + select CLKSRC_MMIO + select FORCE_PCI if PCCARD ++ select GENERIC_IRQ_CHIP + select GPIOLIB + help + Support for older TI OMAP1 (omap7xx, omap15xx or omap16xx) +-- +2.39.5 + diff --git a/queue-6.1/arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch b/queue-6.1/arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch new file mode 100644 index 0000000000..4ac8531440 --- /dev/null +++ b/queue-6.1/arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch @@ -0,0 +1,63 @@ +From 2ea0220f16d094a51bc63fbc12718c0a5165df89 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 7 Jan 2025 16:03:09 +0100 +Subject: arm64: dts: freescale: tqma8mpql: Fix vqmmc-supply + +From: Alexander Stein + +[ Upstream commit 38f59e0e8bd2b3e1319716e4aeaeb9a6223b006d ] + +eMMC is supplied by BUCK5 rail. Use the actual regulator instead of +a virtual fixed regulator. + +Fixes: 418d1d840e421 ("arm64: dts: freescale: add initial device tree for TQMa8MPQL with i.MX8MP") +Signed-off-by: Alexander Stein +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + .../boot/dts/freescale/imx8mp-tqma8mpql.dtsi | 16 ++++------------ + 1 file changed, 4 insertions(+), 12 deletions(-) + +diff --git a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +index 7bd680a926ce7..c63144f2456e3 100644 +--- a/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi ++++ b/arch/arm64/boot/dts/freescale/imx8mp-tqma8mpql.dtsi +@@ -1,7 +1,8 @@ + // SPDX-License-Identifier: GPL-2.0-or-later OR MIT + /* +- * Copyright 2021-2022 TQ-Systems GmbH +- * Author: Alexander Stein ++ * Copyright 2021-2025 TQ-Systems GmbH , ++ * D-82229 Seefeld, Germany. ++ * Author: Alexander Stein + */ + + #include "imx8mp.dtsi" +@@ -23,15 +24,6 @@ reg_vcc3v3: regulator-vcc3v3 { + regulator-max-microvolt = <3300000>; + regulator-always-on; + }; +- +- /* e-MMC IO, needed for HS modes */ +- reg_vcc1v8: regulator-vcc1v8 { +- compatible = "regulator-fixed"; +- regulator-name = "VCC1V8"; +- regulator-min-microvolt = <1800000>; +- regulator-max-microvolt = <1800000>; +- regulator-always-on; +- }; + }; + + &A53_0 { +@@ -194,7 +186,7 @@ &usdhc3 { + no-sd; + no-sdio; + vmmc-supply = <®_vcc3v3>; +- vqmmc-supply = <®_vcc1v8>; ++ vqmmc-supply = <&buck5_reg>; + status = "okay"; + }; + +-- +2.39.5 + diff --git a/queue-6.1/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch b/queue-6.1/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch new file mode 100644 index 0000000000..808c62eecb --- /dev/null +++ b/queue-6.1/bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch @@ -0,0 +1,45 @@ +From 01082c53b4ad6ab5e78b93012d40fc592acec5d7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 22:46:56 +0300 +Subject: Bluetooth: Fix error code in chan_alloc_skb_cb() + +From: Dan Carpenter + +[ Upstream commit 72d061ee630d0dbb45c2920d8d19b3861c413e54 ] + +The chan_alloc_skb_cb() function is supposed to return error pointers on +error. Returning NULL will lead to a NULL dereference. + +Fixes: 6b8d4a6a0314 ("Bluetooth: 6LoWPAN: Use connected oriented channel instead of fixed one") +Signed-off-by: Dan Carpenter +Signed-off-by: Luiz Augusto von Dentz +Signed-off-by: Sasha Levin +--- + net/bluetooth/6lowpan.c | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c +index 4eb1b3ced0d27..db119071a0ea0 100644 +--- a/net/bluetooth/6lowpan.c ++++ b/net/bluetooth/6lowpan.c +@@ -825,11 +825,16 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, + unsigned long hdr_len, + unsigned long len, int nb) + { ++ struct sk_buff *skb; ++ + /* Note that we must allocate using GFP_ATOMIC here as + * this function is called originally from netdev hard xmit + * function in atomic context. + */ +- return bt_skb_alloc(hdr_len + len, GFP_ATOMIC); ++ skb = bt_skb_alloc(hdr_len + len, GFP_ATOMIC); ++ if (!skb) ++ return ERR_PTR(-ENOMEM); ++ return skb; + } + + static void chan_suspend_cb(struct l2cap_chan *chan) +-- +2.39.5 + diff --git a/queue-6.1/firmware-imx-scu-fix-of-node-leak-in-.probe.patch b/queue-6.1/firmware-imx-scu-fix-of-node-leak-in-.probe.patch new file mode 100644 index 0000000000..a54f47dfd5 --- /dev/null +++ b/queue-6.1/firmware-imx-scu-fix-of-node-leak-in-.probe.patch @@ -0,0 +1,36 @@ +From 1eee67feb05678073b75304c35f3c2bffc0ec162 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 24 Dec 2024 12:34:56 +0900 +Subject: firmware: imx-scu: fix OF node leak in .probe() + +From: Joe Hattori + +[ Upstream commit fbf10b86f6057cf79300720da4ea4b77e6708b0d ] + +imx_scu_probe() calls of_parse_phandle_with_args(), but does not +release the OF node reference obtained by it. Add a of_node_put() call +after done with the node. + +Fixes: f25a066d1a07 ("firmware: imx-scu: Support one TX and one RX") +Signed-off-by: Joe Hattori +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/firmware/imx/imx-scu.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/firmware/imx/imx-scu.c b/drivers/firmware/imx/imx-scu.c +index dca79caccd01c..fa25c082109ac 100644 +--- a/drivers/firmware/imx/imx-scu.c ++++ b/drivers/firmware/imx/imx-scu.c +@@ -279,6 +279,7 @@ static int imx_scu_probe(struct platform_device *pdev) + return ret; + + sc_ipc->fast_ipc = of_device_is_compatible(args.np, "fsl,imx8-mu-scu"); ++ of_node_put(args.np); + + num_channel = sc_ipc->fast_ipc ? 2 : SCU_MU_CHAN_NUM; + for (i = 0; i < num_channel; i++) { +-- +2.39.5 + diff --git a/queue-6.1/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch b/queue-6.1/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch new file mode 100644 index 0000000000..7997e3d74f --- /dev/null +++ b/queue-6.1/ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch @@ -0,0 +1,49 @@ +From 471f90493ac8d1f8fe0af7ef64aad576da14db16 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 18:03:25 -0700 +Subject: ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw(). + +From: Kuniyuki Iwashima + +[ Upstream commit 9740890ee20e01f99ff1dde84c63dcf089fabb98 ] + +fib_check_nh_v6_gw() expects that fib6_nh_init() cleans up everything +when it fails. + +Commit 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") +moved fib_nh_common_init() before alloc_percpu_gfp() within fib6_nh_init() +but forgot to add cleanup for fib6_nh->nh_common.nhc_pcpu_rth_output in +case it fails to allocate fib6_nh->rt6i_pcpu, resulting in memleak. + +Let's call fib_nh_common_release() and clear nhc_pcpu_rth_output in the +error path. + +Note that we can remove the fib6_nh_release() call in nh_create_ipv6() +later in net-next.git. + +Fixes: 7dd73168e273 ("ipv6: Always allocate pcpu memory in a fib6_nh") +Signed-off-by: Kuniyuki Iwashima +Link: https://patch.msgid.link/20250312010333.56001-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 17918f411386a..c72b4117fc757 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3637,7 +3637,8 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh, + in6_dev_put(idev); + + if (err) { +- lwtstate_put(fib6_nh->fib_nh_lws); ++ fib_nh_common_release(&fib6_nh->nh_common); ++ fib6_nh->nh_common.nhc_pcpu_rth_output = NULL; + fib6_nh->fib_nh_lws = NULL; + dev_put(dev); + } +-- +2.39.5 + diff --git a/queue-6.1/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch b/queue-6.1/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch new file mode 100644 index 0000000000..08cbca58d7 --- /dev/null +++ b/queue-6.1/ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch @@ -0,0 +1,57 @@ +From 6b87c65ebf6eab16cc8cf3e47ed23b1ad6bc173d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 18:38:48 -0700 +Subject: ipv6: Set errno after ip_fib_metrics_init() in + ip6_route_info_create(). + +From: Kuniyuki Iwashima + +[ Upstream commit 9a81fc3480bf5dbe2bf80e278c440770f6ba2692 ] + +While creating a new IPv6, we could get a weird -ENOMEM when +RTA_NH_ID is set and either of the conditions below is true: + + 1) CONFIG_IPV6_SUBTREES is enabled and rtm_src_len is specified + 2) nexthop_get() fails + +e.g.) + + # strace ip -6 route add fe80::dead:beef:dead:beef nhid 1 from :: + recvmsg(3, {msg_iov=[{iov_base=[...[ + {error=-ENOMEM, msg=[... [...]]}, + [{nla_len=49, nla_type=NLMSGERR_ATTR_MSG}, "Nexthops can not be used with so"...] + ]], iov_len=32768}], msg_iovlen=1, msg_controllen=0, msg_flags=0}, 0) = 148 + +Let's set err explicitly after ip_fib_metrics_init() in +ip6_route_info_create(). + +Fixes: f88d8ea67fbd ("ipv6: Plumb support for nexthop object in a fib6_info") +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: David Ahern +Link: https://patch.msgid.link/20250312013854.61125-1-kuniyu@amazon.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/route.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index c72b4117fc757..5cf6e824c0dff 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -3798,10 +3798,12 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, + if (nh) { + if (rt->fib6_src.plen) { + NL_SET_ERR_MSG(extack, "Nexthops can not be used with source routing"); ++ err = -EINVAL; + goto out_free; + } + if (!nexthop_get(nh)) { + NL_SET_ERR_MSG(extack, "Nexthop has been deleted"); ++ err = -ENOENT; + goto out_free; + } + rt->nh = nh; +-- +2.39.5 + diff --git a/queue-6.1/net-atm-fix-use-after-free-in-lec_send.patch b/queue-6.1/net-atm-fix-use-after-free-in-lec_send.patch new file mode 100644 index 0000000000..c4596eeb80 --- /dev/null +++ b/queue-6.1/net-atm-fix-use-after-free-in-lec_send.patch @@ -0,0 +1,46 @@ +From 72fa39fa7065e34a14c7e65af56897bb2fe00009 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 13:10:57 +0300 +Subject: net: atm: fix use after free in lec_send() + +From: Dan Carpenter + +[ Upstream commit f3009d0d6ab78053117f8857b921a8237f4d17b3 ] + +The ->send() operation frees skb so save the length before calling +->send() to avoid a use after free. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Dan Carpenter +Reviewed-by: Simon Horman +Link: https://patch.msgid.link/c751531d-4af4-42fe-affe-6104b34b791d@stanley.mountain +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/atm/lec.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/atm/lec.c b/net/atm/lec.c +index 6257bf12e5a00..ac3cfc1ae5102 100644 +--- a/net/atm/lec.c ++++ b/net/atm/lec.c +@@ -181,6 +181,7 @@ static void + lec_send(struct atm_vcc *vcc, struct sk_buff *skb) + { + struct net_device *dev = skb->dev; ++ unsigned int len = skb->len; + + ATM_SKB(skb)->vcc = vcc; + atm_account_tx(vcc, skb); +@@ -191,7 +192,7 @@ lec_send(struct atm_vcc *vcc, struct sk_buff *skb) + } + + dev->stats.tx_packets++; +- dev->stats.tx_bytes += skb->len; ++ dev->stats.tx_bytes += len; + } + + static void lec_tx_timeout(struct net_device *dev, unsigned int txqueue) +-- +2.39.5 + diff --git a/queue-6.1/net-lwtunnel-fix-recursion-loops.patch b/queue-6.1/net-lwtunnel-fix-recursion-loops.patch new file mode 100644 index 0000000000..a569586850 --- /dev/null +++ b/queue-6.1/net-lwtunnel-fix-recursion-loops.patch @@ -0,0 +1,176 @@ +From 81472147d5a7842e797ecc8df6f50cfed72fa3ca Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Mar 2025 13:00:46 +0100 +Subject: net: lwtunnel: fix recursion loops + +From: Justin Iurman + +[ Upstream commit 986ffb3a57c5650fb8bf6d59a8f0f07046abfeb6 ] + +This patch acts as a parachute, catch all solution, by detecting +recursion loops in lwtunnel users and taking care of them (e.g., a loop +between routes, a loop within the same route, etc). In general, such +loops are the consequence of pathological configurations. Each lwtunnel +user is still free to catch such loops early and do whatever they want +with them. It will be the case in a separate patch for, e.g., seg6 and +seg6_local, in order to provide drop reasons and update statistics. +Another example of a lwtunnel user taking care of loops is ioam6, which +has valid use cases that include loops (e.g., inline mode), and which is +addressed by the next patch in this series. Overall, this patch acts as +a last resort to catch loops and drop packets, since we don't want to +leak something unintentionally because of a pathological configuration +in lwtunnels. + +The solution in this patch reuses dev_xmit_recursion(), +dev_xmit_recursion_inc(), and dev_xmit_recursion_dec(), which seems fine +considering the context. + +Closes: https://lore.kernel.org/netdev/2bc9e2079e864a9290561894d2a602d6@akamai.com/ +Closes: https://lore.kernel.org/netdev/Z7NKYMY7fJT5cYWu@shredder/ +Fixes: ffce41962ef6 ("lwtunnel: support dst output redirect function") +Fixes: 2536862311d2 ("lwt: Add support to redirect dst.input") +Fixes: 14972cbd34ff ("net: lwtunnel: Handle fragmentation") +Signed-off-by: Justin Iurman +Link: https://patch.msgid.link/20250314120048.12569-2-justin.iurman@uliege.be +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/lwtunnel.c | 65 ++++++++++++++++++++++++++++++++++++--------- + 1 file changed, 53 insertions(+), 12 deletions(-) + +diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c +index 711cd3b4347a7..4417a18b3e951 100644 +--- a/net/core/lwtunnel.c ++++ b/net/core/lwtunnel.c +@@ -23,6 +23,8 @@ + #include + #include + ++#include "dev.h" ++ + DEFINE_STATIC_KEY_FALSE(nf_hooks_lwtunnel_enabled); + EXPORT_SYMBOL_GPL(nf_hooks_lwtunnel_enabled); + +@@ -325,13 +327,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_cmp_encap); + + int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) + { +- struct dst_entry *dst = skb_dst(skb); + const struct lwtunnel_encap_ops *ops; + struct lwtunnel_state *lwtstate; +- int ret = -EINVAL; ++ struct dst_entry *dst; ++ int ret; ++ ++ if (dev_xmit_recursion()) { ++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", ++ __func__); ++ ret = -ENETDOWN; ++ goto drop; ++ } + +- if (!dst) ++ dst = skb_dst(skb); ++ if (!dst) { ++ ret = -EINVAL; + goto drop; ++ } + lwtstate = dst->lwtstate; + + if (lwtstate->type == LWTUNNEL_ENCAP_NONE || +@@ -341,8 +353,11 @@ int lwtunnel_output(struct net *net, struct sock *sk, struct sk_buff *skb) + ret = -EOPNOTSUPP; + rcu_read_lock(); + ops = rcu_dereference(lwtun_encaps[lwtstate->type]); +- if (likely(ops && ops->output)) ++ if (likely(ops && ops->output)) { ++ dev_xmit_recursion_inc(); + ret = ops->output(net, sk, skb); ++ dev_xmit_recursion_dec(); ++ } + rcu_read_unlock(); + + if (ret == -EOPNOTSUPP) +@@ -359,13 +374,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_output); + + int lwtunnel_xmit(struct sk_buff *skb) + { +- struct dst_entry *dst = skb_dst(skb); + const struct lwtunnel_encap_ops *ops; + struct lwtunnel_state *lwtstate; +- int ret = -EINVAL; ++ struct dst_entry *dst; ++ int ret; ++ ++ if (dev_xmit_recursion()) { ++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", ++ __func__); ++ ret = -ENETDOWN; ++ goto drop; ++ } + +- if (!dst) ++ dst = skb_dst(skb); ++ if (!dst) { ++ ret = -EINVAL; + goto drop; ++ } + + lwtstate = dst->lwtstate; + +@@ -376,8 +401,11 @@ int lwtunnel_xmit(struct sk_buff *skb) + ret = -EOPNOTSUPP; + rcu_read_lock(); + ops = rcu_dereference(lwtun_encaps[lwtstate->type]); +- if (likely(ops && ops->xmit)) ++ if (likely(ops && ops->xmit)) { ++ dev_xmit_recursion_inc(); + ret = ops->xmit(skb); ++ dev_xmit_recursion_dec(); ++ } + rcu_read_unlock(); + + if (ret == -EOPNOTSUPP) +@@ -394,13 +422,23 @@ EXPORT_SYMBOL_GPL(lwtunnel_xmit); + + int lwtunnel_input(struct sk_buff *skb) + { +- struct dst_entry *dst = skb_dst(skb); + const struct lwtunnel_encap_ops *ops; + struct lwtunnel_state *lwtstate; +- int ret = -EINVAL; ++ struct dst_entry *dst; ++ int ret; + +- if (!dst) ++ if (dev_xmit_recursion()) { ++ net_crit_ratelimited("%s(): recursion limit reached on datapath\n", ++ __func__); ++ ret = -ENETDOWN; + goto drop; ++ } ++ ++ dst = skb_dst(skb); ++ if (!dst) { ++ ret = -EINVAL; ++ goto drop; ++ } + lwtstate = dst->lwtstate; + + if (lwtstate->type == LWTUNNEL_ENCAP_NONE || +@@ -410,8 +448,11 @@ int lwtunnel_input(struct sk_buff *skb) + ret = -EOPNOTSUPP; + rcu_read_lock(); + ops = rcu_dereference(lwtun_encaps[lwtstate->type]); +- if (likely(ops && ops->input)) ++ if (likely(ops && ops->input)) { ++ dev_xmit_recursion_inc(); + ret = ops->input(skb); ++ dev_xmit_recursion_dec(); ++ } + rcu_read_unlock(); + + if (ret == -EOPNOTSUPP) +-- +2.39.5 + diff --git a/queue-6.1/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch b/queue-6.1/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch new file mode 100644 index 0000000000..1602e8522b --- /dev/null +++ b/queue-6.1/net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch @@ -0,0 +1,39 @@ +From 09edca178e2b308b1345a44ba079f0bc3466ed17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 16 Mar 2025 00:51:13 +0800 +Subject: net/neighbor: add missing policy for NDTPA_QUEUE_LENBYTES + +From: Lin Ma + +[ Upstream commit 90a7138619a0c55e2aefaad27b12ffc2ddbeed78 ] + +Previous commit 8b5c171bb3dc ("neigh: new unresolved queue limits") +introduces new netlink attribute NDTPA_QUEUE_LENBYTES to represent +approximative value for deprecated QUEUE_LEN. However, it forgot to add +the associated nla_policy in nl_ntbl_parm_policy array. Fix it with one +simple NLA_U32 type policy. + +Fixes: 8b5c171bb3dc ("neigh: new unresolved queue limits") +Signed-off-by: Lin Ma +Link: https://patch.msgid.link/20250315165113.37600-1-linma@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/core/neighbour.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 2e2c009b5a2db..bcc3950638b91 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -2283,6 +2283,7 @@ static const struct nla_policy nl_neightbl_policy[NDTA_MAX+1] = { + static const struct nla_policy nl_ntbl_parm_policy[NDTPA_MAX+1] = { + [NDTPA_IFINDEX] = { .type = NLA_U32 }, + [NDTPA_QUEUE_LEN] = { .type = NLA_U32 }, ++ [NDTPA_QUEUE_LENBYTES] = { .type = NLA_U32 }, + [NDTPA_PROXY_QLEN] = { .type = NLA_U32 }, + [NDTPA_APP_PROBES] = { .type = NLA_U32 }, + [NDTPA_UCAST_PROBES] = { .type = NLA_U32 }, +-- +2.39.5 + diff --git a/queue-6.1/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch b/queue-6.1/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch new file mode 100644 index 0000000000..890f7cbdc0 --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch @@ -0,0 +1,42 @@ +From 218e17f4fb94f7e12a105f9f0b25bd74d6321a88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 3 Mar 2025 08:59:37 -0800 +Subject: RDMA/bnxt_re: Add missing paranthesis in map_qp_id_to_tbl_indx + +From: Kashyap Desai + +[ Upstream commit 67ee8d496511ad8e1cb88f72944847e7b3e4e47c ] + +The modulo operation returns wrong result without the +paranthesis and that resulted in wrong QP table indexing. + +Fixes: 84cf229f4001 ("RDMA/bnxt_re: Fix the qp table indexing") +Reviewed-by: Kalesh AP +Signed-off-by: Kashyap Desai +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/1741021178-2569-3-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_rcfw.h | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +index 9c28f4625c920..9d4f744b001a9 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h ++++ b/drivers/infiniband/hw/bnxt_re/qplib_rcfw.h +@@ -220,9 +220,10 @@ int bnxt_qplib_deinit_rcfw(struct bnxt_qplib_rcfw *rcfw); + int bnxt_qplib_init_rcfw(struct bnxt_qplib_rcfw *rcfw, + struct bnxt_qplib_ctx *ctx, int is_virtfn); + void bnxt_qplib_mark_qp_error(void *qp_handle); ++ + static inline u32 map_qp_id_to_tbl_indx(u32 qid, struct bnxt_qplib_rcfw *rcfw) + { + /* Last index of the qp_tbl is for QP1 ie. qp_tbl_size - 1*/ +- return (qid == 1) ? rcfw->qp_tbl_size - 1 : qid % rcfw->qp_tbl_size - 2; ++ return (qid == 1) ? rcfw->qp_tbl_size - 1 : (qid % (rcfw->qp_tbl_size - 2)); + } + #endif /* __BNXT_QPLIB_RCFW_H__ */ +-- +2.39.5 + diff --git a/queue-6.1/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch b/queue-6.1/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch new file mode 100644 index 0000000000..3d39d59c4c --- /dev/null +++ b/queue-6.1/rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch @@ -0,0 +1,42 @@ +From 4a62c938feb1b73c164722a05e22c13637b029e5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 10 Mar 2025 22:16:36 -0700 +Subject: RDMA/bnxt_re: Avoid clearing VLAN_ID mask in modify qp path + +From: Saravanan Vajravel + +[ Upstream commit 81c0db302a674f8004ed805393d17fd76f552e83 ] + +Driver is always clearing the mask that sets the VLAN ID/Service Level +in the adapter. Recent change for supporting multiple traffic class +exposed this issue. + +Allow setting SL and VLAN_ID while QP is moved from INIT to RTR state. + +Fixes: 1ac5a4047975 ("RDMA/bnxt_re: Add bnxt_re RoCE driver") +Fixes: c64b16a37b6d ("RDMA/bnxt_re: Support different traffic class") +Signed-off-by: Saravanan Vajravel +Signed-off-by: Selvin Xavier +Link: https://patch.msgid.link/1741670196-2919-1-git-send-email-selvin.xavier@broadcom.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/bnxt_re/qplib_fp.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/infiniband/hw/bnxt_re/qplib_fp.c b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +index 23f9a48828dca..15a62d0d243ce 100644 +--- a/drivers/infiniband/hw/bnxt_re/qplib_fp.c ++++ b/drivers/infiniband/hw/bnxt_re/qplib_fp.c +@@ -1186,8 +1186,6 @@ static void __modify_flags_from_init_state(struct bnxt_qplib_qp *qp) + qp->path_mtu = + CMDQ_MODIFY_QP_PATH_MTU_MTU_2048; + } +- qp->modify_flags &= +- ~CMDQ_MODIFY_QP_MODIFY_MASK_VLAN_ID; + /* Bono FW require the max_dest_rd_atomic to be >= 1 */ + if (qp->max_dest_rd_atomic < 1) + qp->max_dest_rd_atomic = 1; +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch b/queue-6.1/rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch new file mode 100644 index 0000000000..ff1961580d --- /dev/null +++ b/queue-6.1/rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch @@ -0,0 +1,39 @@ +From c9769cb089775b45511c087e639f85c82e4f2ad0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:55 +0800 +Subject: RDMA/hns: Fix a missing rollback in error path of + hns_roce_create_qp_common() + +From: Junxian Huang + +[ Upstream commit 444907dd45cbe62fd69398805b6e2c626fab5b3a ] + +When ib_copy_to_udata() fails in hns_roce_create_qp_common(), +hns_roce_qp_remove() should be called in the error path to +clean up resources in hns_roce_qp_store(). + +Fixes: 0f00571f9433 ("RDMA/hns: Use new SQ doorbell register for HIP09") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-6-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 86a48ca127862..0f0351abe9b46 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -1213,7 +1213,7 @@ static int hns_roce_create_qp_common(struct hns_roce_dev *hr_dev, + min(udata->outlen, sizeof(resp))); + if (ret) { + ibdev_err(ibdev, "copy qp resp failed!\n"); +- goto err_store; ++ goto err_flow_ctrl; + } + } + +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch b/queue-6.1/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch new file mode 100644 index 0000000000..6f50b6d6a9 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch @@ -0,0 +1,100 @@ +From ac3ff2551fbd43a1a1ef62dd0c0182e1d00363fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:52 +0800 +Subject: RDMA/hns: Fix soft lockup during bt pages loop + +From: Junxian Huang + +[ Upstream commit 25655580136de59ec89f09089dd28008ea440fc9 ] + +Driver runs a for-loop when allocating bt pages and mapping them with +buffer pages. When a large buffer (e.g. MR over 100GB) is being allocated, +it may require a considerable loop count. This will lead to soft lockup: + + watchdog: BUG: soft lockup - CPU#27 stuck for 22s! + ... + Call trace: + hem_list_alloc_mid_bt+0x124/0x394 [hns_roce_hw_v2] + hns_roce_hem_list_request+0xf8/0x160 [hns_roce_hw_v2] + hns_roce_mtr_create+0x2e4/0x360 [hns_roce_hw_v2] + alloc_mr_pbl+0xd4/0x17c [hns_roce_hw_v2] + hns_roce_reg_user_mr+0xf8/0x190 [hns_roce_hw_v2] + ib_uverbs_reg_mr+0x118/0x290 + + watchdog: BUG: soft lockup - CPU#35 stuck for 23s! + ... + Call trace: + hns_roce_hem_list_find_mtt+0x7c/0xb0 [hns_roce_hw_v2] + mtr_map_bufs+0xc4/0x204 [hns_roce_hw_v2] + hns_roce_mtr_create+0x31c/0x3c4 [hns_roce_hw_v2] + alloc_mr_pbl+0xb0/0x160 [hns_roce_hw_v2] + hns_roce_reg_user_mr+0x108/0x1c0 [hns_roce_hw_v2] + ib_uverbs_reg_mr+0x120/0x2bc + +Add a cond_resched() to fix soft lockup during these loops. In order not +to affect the allocation performance of normal-size buffer, set the loop +count of a 100GB MR as the threshold to call cond_resched(). + +Fixes: 38389eaa4db1 ("RDMA/hns: Add mtr support for mixed multihop addressing") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-3-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_hem.c | 16 +++++++++++++++- + 1 file changed, 15 insertions(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_hem.c b/drivers/infiniband/hw/hns/hns_roce_hem.c +index f1de497fc977c..173ab794fa780 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_hem.c ++++ b/drivers/infiniband/hw/hns/hns_roce_hem.c +@@ -1416,6 +1416,11 @@ static int hem_list_alloc_root_bt(struct hns_roce_dev *hr_dev, + return ret; + } + ++/* This is the bottom bt pages number of a 100G MR on 4K OS, assuming ++ * the bt page size is not expanded by cal_best_bt_pg_sz() ++ */ ++#define RESCHED_LOOP_CNT_THRESHOLD_ON_4K 12800 ++ + /* construct the base address table and link them by address hop config */ + int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + struct hns_roce_hem_list *hem_list, +@@ -1424,6 +1429,7 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + { + const struct hns_roce_buf_region *r; + int ofs, end; ++ int loop; + int unit; + int ret; + int i; +@@ -1441,7 +1447,10 @@ int hns_roce_hem_list_request(struct hns_roce_dev *hr_dev, + continue; + + end = r->offset + r->count; +- for (ofs = r->offset; ofs < end; ofs += unit) { ++ for (ofs = r->offset, loop = 1; ofs < end; ofs += unit, loop++) { ++ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K)) ++ cond_resched(); ++ + ret = hem_list_alloc_mid_bt(hr_dev, r, unit, ofs, + hem_list->mid_bt[i], + &hem_list->btm_bt); +@@ -1498,9 +1507,14 @@ void *hns_roce_hem_list_find_mtt(struct hns_roce_dev *hr_dev, + struct list_head *head = &hem_list->btm_bt; + struct hns_roce_hem_item *hem, *temp_hem; + void *cpu_base = NULL; ++ int loop = 1; + int nr = 0; + + list_for_each_entry_safe(hem, temp_hem, head, sibling) { ++ if (!(loop % RESCHED_LOOP_CNT_THRESHOLD_ON_4K)) ++ cond_resched(); ++ loop++; ++ + if (hem_list_page_is_in_range(hem, offset)) { + nr = offset - hem->start; + cpu_base = hem->addr + nr * BA_BYTE_LEN; +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch b/queue-6.1/rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch new file mode 100644 index 0000000000..5a3e32ead5 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch @@ -0,0 +1,64 @@ +From cd7ca33d642a315f5168f8113fe45186b602ac6d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:53 +0800 +Subject: RDMA/hns: Fix unmatched condition in error path of alloc_user_qp_db() + +From: Junxian Huang + +[ Upstream commit b9f59a24ba35a7d955a9f8e148dd9f85b7b40a01 ] + +Currently the condition of unmapping sdb in error path is not exactly +the same as the condition of mapping in alloc_user_qp_db(). This may +cause a problem of unmapping an unmapped db in some case, such as +when the QP is XRC TGT. Unified the two conditions. + +Fixes: 90ae0b57e4a5 ("RDMA/hns: Combine enable flags of qp") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-4-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_qp.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_qp.c b/drivers/infiniband/hw/hns/hns_roce_qp.c +index 19136cb169600..86a48ca127862 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_qp.c ++++ b/drivers/infiniband/hw/hns/hns_roce_qp.c +@@ -924,12 +924,14 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, + struct hns_roce_ib_create_qp *ucmd, + struct hns_roce_ib_create_qp_resp *resp) + { ++ bool has_sdb = user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd); + struct hns_roce_ucontext *uctx = rdma_udata_to_drv_context(udata, + struct hns_roce_ucontext, ibucontext); ++ bool has_rdb = user_qp_has_rdb(hr_dev, init_attr, udata, resp); + struct ib_device *ibdev = &hr_dev->ib_dev; + int ret; + +- if (user_qp_has_sdb(hr_dev, init_attr, udata, resp, ucmd)) { ++ if (has_sdb) { + ret = hns_roce_db_map_user(uctx, ucmd->sdb_addr, &hr_qp->sdb); + if (ret) { + ibdev_err(ibdev, +@@ -940,7 +942,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, + hr_qp->en_flags |= HNS_ROCE_QP_CAP_SQ_RECORD_DB; + } + +- if (user_qp_has_rdb(hr_dev, init_attr, udata, resp)) { ++ if (has_rdb) { + ret = hns_roce_db_map_user(uctx, ucmd->db_addr, &hr_qp->rdb); + if (ret) { + ibdev_err(ibdev, +@@ -954,7 +956,7 @@ static int alloc_user_qp_db(struct hns_roce_dev *hr_dev, + return 0; + + err_sdb: +- if (hr_qp->en_flags & HNS_ROCE_QP_CAP_SQ_RECORD_DB) ++ if (has_sdb) + hns_roce_db_unmap_user(uctx, &hr_qp->sdb); + err_out: + return ret; +-- +2.39.5 + diff --git a/queue-6.1/rdma-hns-fix-wrong-value-of-max_sge_rd.patch b/queue-6.1/rdma-hns-fix-wrong-value-of-max_sge_rd.patch new file mode 100644 index 0000000000..45a339fe62 --- /dev/null +++ b/queue-6.1/rdma-hns-fix-wrong-value-of-max_sge_rd.patch @@ -0,0 +1,38 @@ +From 9f7b6b1ad3384bd20cdf4d72a59898920f687ef5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Mar 2025 16:48:57 +0800 +Subject: RDMA/hns: Fix wrong value of max_sge_rd + +From: Junxian Huang + +[ Upstream commit 6b5e41a8b51fce520bb09bd651a29ef495e990de ] + +There is no difference between the sge of READ and non-READ +operations in hns RoCE. Set max_sge_rd to the same value as +max_send_sge. + +Fixes: 9a4435375cd1 ("IB/hns: Add driver files for hns RoCE driver") +Signed-off-by: Junxian Huang +Link: https://patch.msgid.link/20250311084857.3803665-8-huangjunxian6@hisilicon.com +Signed-off-by: Leon Romanovsky +Signed-off-by: Sasha Levin +--- + drivers/infiniband/hw/hns/hns_roce_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/infiniband/hw/hns/hns_roce_main.c b/drivers/infiniband/hw/hns/hns_roce_main.c +index afe7523eca909..5106b3ce89f08 100644 +--- a/drivers/infiniband/hw/hns/hns_roce_main.c ++++ b/drivers/infiniband/hw/hns/hns_roce_main.c +@@ -182,7 +182,7 @@ static int hns_roce_query_device(struct ib_device *ib_dev, + IB_DEVICE_RC_RNR_NAK_GEN; + props->max_send_sge = hr_dev->caps.max_sq_sg; + props->max_recv_sge = hr_dev->caps.max_rq_sg; +- props->max_sge_rd = 1; ++ props->max_sge_rd = hr_dev->caps.max_sq_sg; + props->max_cq = hr_dev->caps.num_cqs; + props->max_cqe = hr_dev->caps.max_cqes; + props->max_mr = hr_dev->caps.num_mtpts; +-- +2.39.5 + diff --git a/queue-6.1/revert-gre-fix-ipv6-link-local-address-generation.patch b/queue-6.1/revert-gre-fix-ipv6-link-local-address-generation.patch new file mode 100644 index 0000000000..97290bcd90 --- /dev/null +++ b/queue-6.1/revert-gre-fix-ipv6-link-local-address-generation.patch @@ -0,0 +1,66 @@ +From f4351b0948b9b1aba8788ddfe77c0a266cbcf350 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Mar 2025 22:26:50 +0100 +Subject: Revert "gre: Fix IPv6 link-local address generation." + +From: Guillaume Nault + +[ Upstream commit fc486c2d060f67d672ddad81724f7c8a4d329570 ] + +This reverts commit 183185a18ff96751db52a46ccf93fff3a1f42815. + +This patch broke net/forwarding/ip6gre_custom_multipath_hash.sh in some +circumstances (https://lore.kernel.org/netdev/Z9RIyKZDNoka53EO@mini-arch/). +Let's revert it while the problem is being investigated. + +Fixes: 183185a18ff9 ("gre: Fix IPv6 link-local address generation.") +Signed-off-by: Guillaume Nault +Link: https://patch.msgid.link/8b1ce738eb15dd841aab9ef888640cab4f6ccfea.1742418408.git.gnault@redhat.com +Acked-by: Stanislav Fomichev +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 15 ++++++--------- + 1 file changed, 6 insertions(+), 9 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 69fb4d7c9c98e..f52527c86e71c 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3162,13 +3162,16 @@ static void add_v4_addrs(struct inet6_dev *idev) + struct in6_addr addr; + struct net_device *dev; + struct net *net = dev_net(idev->dev); +- int scope, plen; ++ int scope, plen, offset = 0; + u32 pflags = 0; + + ASSERT_RTNL(); + + memset(&addr, 0, sizeof(struct in6_addr)); +- memcpy(&addr.s6_addr32[3], idev->dev->dev_addr, 4); ++ /* in case of IP6GRE the dev_addr is an IPv6 and therefore we use only the last 4 bytes */ ++ if (idev->dev->addr_len == sizeof(struct in6_addr)) ++ offset = sizeof(struct in6_addr) - 4; ++ memcpy(&addr.s6_addr32[3], idev->dev->dev_addr + offset, 4); + + if (!(idev->dev->flags & IFF_POINTOPOINT) && idev->dev->type == ARPHRD_SIT) { + scope = IPV6_ADDR_COMPATv4; +@@ -3478,13 +3481,7 @@ static void addrconf_gre_config(struct net_device *dev) + return; + } + +- /* Generate the IPv6 link-local address using addrconf_addr_gen(), +- * unless we have an IPv4 GRE device not bound to an IP address and +- * which is in EUI64 mode (as __ipv6_isatap_ifid() would fail in this +- * case). Such devices fall back to add_v4_addrs() instead. +- */ +- if (!(dev->type == ARPHRD_IPGRE && *(__be32 *)dev->dev_addr == 0 && +- idev->cnf.addr_gen_mode == IN6_ADDR_GEN_MODE_EUI64)) { ++ if (dev->type == ARPHRD_ETHER) { + addrconf_addr_gen(idev, true); + return; + } +-- +2.39.5 + diff --git a/queue-6.1/series b/queue-6.1/series index f13b43a4f8..b43699a236 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -146,3 +146,25 @@ smb-client-fix-match_session-bug-preventing-session-.patch hid-apple-disable-fn-key-handling-on-the-omoton-kb066.patch nvme-tcp-fix-a-c2htermreq-error-message.patch smb-client-fix-potential-uaf-in-cifs_dump_full_key.patch +firmware-imx-scu-fix-of-node-leak-in-.probe.patch +arm64-dts-freescale-tqma8mpql-fix-vqmmc-supply.patch +xfrm_output-force-software-gso-only-in-tunnel-mode.patch +soc-imx8m-remove-global-soc_uid.patch +soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch +soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch +arm-dts-bcm2711-pl011-uarts-are-actually-r1p5.patch +rdma-bnxt_re-add-missing-paranthesis-in-map_qp_id_to.patch +arm-omap1-select-config_generic_irq_chip.patch +arm-dts-bcm2711-don-t-mark-timer-regs-unconfigured.patch +rdma-bnxt_re-avoid-clearing-vlan_id-mask-in-modify-q.patch +rdma-hns-fix-soft-lockup-during-bt-pages-loop.patch +rdma-hns-fix-unmatched-condition-in-error-path-of-al.patch +rdma-hns-fix-a-missing-rollback-in-error-path-of-hns.patch +rdma-hns-fix-wrong-value-of-max_sge_rd.patch +bluetooth-fix-error-code-in-chan_alloc_skb_cb.patch +ipv6-fix-memleak-of-nhc_pcpu_rth_output-in-fib_check.patch +ipv6-set-errno-after-ip_fib_metrics_init-in-ip6_rout.patch +net-atm-fix-use-after-free-in-lec_send.patch +net-lwtunnel-fix-recursion-loops.patch +net-neighbor-add-missing-policy-for-ndtpa_queue_lenb.patch +revert-gre-fix-ipv6-link-local-address-generation.patch diff --git a/queue-6.1/soc-imx8m-remove-global-soc_uid.patch b/queue-6.1/soc-imx8m-remove-global-soc_uid.patch new file mode 100644 index 0000000000..ddf8e7240e --- /dev/null +++ b/queue-6.1/soc-imx8m-remove-global-soc_uid.patch @@ -0,0 +1,127 @@ +From 6f8b9dc534f9de1d54febf2f15be4cd7cc0b3aed Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2024 20:49:17 +0200 +Subject: soc: imx8m: Remove global soc_uid + +From: Marek Vasut + +[ Upstream commit 9c1c02fe8d7f33c18547b79c41f3fa41ef7bae8f ] + +The static global soc_uid is only ever used as kasprintf() parameter in +imx8m_soc_probe(). Pass pointer to local u64 variable to .soc_revision() +callback instead and let the .soc_revision() callback fill in the content. +Remove the unnecessary static global variable. + +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Stable-dep-of: cf7139aac463 ("soc: imx8m: Unregister cpufreq and soc dev in cleanup path") +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 31 +++++++++++++++---------------- + 1 file changed, 15 insertions(+), 16 deletions(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index a160854a19178..9587641e0c4f9 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -30,11 +30,9 @@ + + struct imx8_soc_data { + char *name; +- int (*soc_revision)(u32 *socrev); ++ int (*soc_revision)(u32 *socrev, u64 *socuid); + }; + +-static u64 soc_uid; +- + #ifdef CONFIG_HAVE_ARM_SMCCC + static u32 imx8mq_soc_revision_from_atf(void) + { +@@ -51,7 +49,7 @@ static u32 imx8mq_soc_revision_from_atf(void) + static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; }; + #endif + +-static int imx8mq_soc_revision(u32 *socrev) ++static int imx8mq_soc_revision(u32 *socrev, u64 *socuid) + { + struct device_node *np; + void __iomem *ocotp_base; +@@ -89,9 +87,9 @@ static int imx8mq_soc_revision(u32 *socrev) + rev = REV_B1; + } + +- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH); +- soc_uid <<= 32; +- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); ++ *socuid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH); ++ *socuid <<= 32; ++ *socuid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW); + + *socrev = rev; + +@@ -109,7 +107,7 @@ static int imx8mq_soc_revision(u32 *socrev) + return ret; + } + +-static int imx8mm_soc_uid(void) ++static int imx8mm_soc_uid(u64 *socuid) + { + void __iomem *ocotp_base; + struct device_node *np; +@@ -136,9 +134,9 @@ static int imx8mm_soc_uid(void) + + clk_prepare_enable(clk); + +- soc_uid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH + offset); +- soc_uid <<= 32; +- soc_uid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW + offset); ++ *socuid = readl_relaxed(ocotp_base + OCOTP_UID_HIGH + offset); ++ *socuid <<= 32; ++ *socuid |= readl_relaxed(ocotp_base + OCOTP_UID_LOW + offset); + + clk_disable_unprepare(clk); + clk_put(clk); +@@ -151,7 +149,7 @@ static int imx8mm_soc_uid(void) + return ret; + } + +-static int imx8mm_soc_revision(u32 *socrev) ++static int imx8mm_soc_revision(u32 *socrev, u64 *socuid) + { + struct device_node *np; + void __iomem *anatop_base; +@@ -172,7 +170,7 @@ static int imx8mm_soc_revision(u32 *socrev) + iounmap(anatop_base); + of_node_put(np); + +- return imx8mm_soc_uid(); ++ return imx8mm_soc_uid(socuid); + + err_iomap: + of_node_put(np); +@@ -215,10 +213,11 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { + static int imx8m_soc_probe(struct platform_device *pdev) + { + struct soc_device_attribute *soc_dev_attr; +- struct soc_device *soc_dev; ++ const struct imx8_soc_data *data; + const struct of_device_id *id; ++ struct soc_device *soc_dev; + u32 soc_rev = 0; +- const struct imx8_soc_data *data; ++ u64 soc_uid = 0; + int ret; + + soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL); +@@ -241,7 +240,7 @@ static int imx8m_soc_probe(struct platform_device *pdev) + if (data) { + soc_dev_attr->soc_id = data->name; + if (data->soc_revision) { +- ret = data->soc_revision(&soc_rev); ++ ret = data->soc_revision(&soc_rev, &soc_uid); + if (ret) + goto free_soc; + } +-- +2.39.5 + diff --git a/queue-6.1/soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch b/queue-6.1/soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch new file mode 100644 index 0000000000..fa6b02501c --- /dev/null +++ b/queue-6.1/soc-imx8m-unregister-cpufreq-and-soc-dev-in-cleanup-.patch @@ -0,0 +1,78 @@ +From 91d8500f500f61413ff1bd10fed6b8eb025c84cd Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 14 Feb 2025 16:47:51 +0800 +Subject: soc: imx8m: Unregister cpufreq and soc dev in cleanup path + +From: Peng Fan + +[ Upstream commit cf7139aac463880cbd5c5e999c118fbe91631411 ] + +Unregister the cpufreq device and soc device when resource unwinding, +otherwise there will be warning when do removing test: +sysfs: cannot create duplicate filename '/devices/platform/imx-cpufreq-dt' +CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted 6.13.0-rc1-next-20241204 +Hardware name: NXP i.MX8MPlus EVK board (DT) + +Fixes: 9cc832d37799 ("soc: imx8m: Probe the SoC driver as platform driver") +Cc: Marco Felsch +Signed-off-by: Peng Fan +Reviewed-by: Marco Felsch +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 26 ++++++++++++++++++++++++-- + 1 file changed, 24 insertions(+), 2 deletions(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index bd62ccb935a1a..006cad061a32b 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -192,9 +192,20 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { + devm_kasprintf((dev), GFP_KERNEL, "%d.%d", ((soc_rev) >> 4) & 0xf, (soc_rev) & 0xf) : \ + "unknown" + ++static void imx8m_unregister_soc(void *data) ++{ ++ soc_device_unregister(data); ++} ++ ++static void imx8m_unregister_cpufreq(void *data) ++{ ++ platform_device_unregister(data); ++} ++ + static int imx8m_soc_probe(struct platform_device *pdev) + { + struct soc_device_attribute *soc_dev_attr; ++ struct platform_device *cpufreq_dev; + const struct imx8_soc_data *data; + struct device *dev = &pdev->dev; + const struct of_device_id *id; +@@ -239,11 +250,22 @@ static int imx8m_soc_probe(struct platform_device *pdev) + if (IS_ERR(soc_dev)) + return PTR_ERR(soc_dev); + ++ ret = devm_add_action(dev, imx8m_unregister_soc, soc_dev); ++ if (ret) ++ return ret; ++ + pr_info("SoC: %s revision %s\n", soc_dev_attr->soc_id, + soc_dev_attr->revision); + +- if (IS_ENABLED(CONFIG_ARM_IMX_CPUFREQ_DT)) +- platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0); ++ if (IS_ENABLED(CONFIG_ARM_IMX_CPUFREQ_DT)) { ++ cpufreq_dev = platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0); ++ if (IS_ERR(cpufreq_dev)) ++ return dev_err_probe(dev, PTR_ERR(cpufreq_dev), ++ "Failed to register imx-cpufreq-dev device\n"); ++ ret = devm_add_action(dev, imx8m_unregister_cpufreq, cpufreq_dev); ++ if (ret) ++ return ret; ++ } + + return 0; + } +-- +2.39.5 + diff --git a/queue-6.1/soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch b/queue-6.1/soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch new file mode 100644 index 0000000000..8709ad94ef --- /dev/null +++ b/queue-6.1/soc-imx8m-use-devm_-to-simplify-probe-failure-handli.patch @@ -0,0 +1,235 @@ +From 82175971797a8f6b2db360082213bf1432c317f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 29 Sep 2024 20:49:18 +0200 +Subject: soc: imx8m: Use devm_* to simplify probe failure handling + +From: Marek Vasut + +[ Upstream commit 22b03a4e957e462b380a982759ccf0f6554735d3 ] + +Use device managed functions to simplify handling of failures during +probe. Remove fail paths which are no longer necessary. + +Signed-off-by: Marek Vasut +Signed-off-by: Shawn Guo +Stable-dep-of: cf7139aac463 ("soc: imx8m: Unregister cpufreq and soc dev in cleanup path") +Signed-off-by: Sasha Levin +--- + drivers/soc/imx/soc-imx8m.c | 92 ++++++++++++------------------------- + 1 file changed, 29 insertions(+), 63 deletions(-) + +diff --git a/drivers/soc/imx/soc-imx8m.c b/drivers/soc/imx/soc-imx8m.c +index 9587641e0c4f9..bd62ccb935a1a 100644 +--- a/drivers/soc/imx/soc-imx8m.c ++++ b/drivers/soc/imx/soc-imx8m.c +@@ -51,22 +51,20 @@ static inline u32 imx8mq_soc_revision_from_atf(void) { return 0; }; + + static int imx8mq_soc_revision(u32 *socrev, u64 *socuid) + { +- struct device_node *np; ++ struct device_node *np __free(device_node) = ++ of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); + void __iomem *ocotp_base; + u32 magic; + u32 rev; + struct clk *clk; + int ret; + +- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mq-ocotp"); + if (!np) + return -EINVAL; + + ocotp_base = of_iomap(np, 0); +- if (!ocotp_base) { +- ret = -EINVAL; +- goto err_iomap; +- } ++ if (!ocotp_base) ++ return -EINVAL; + + clk = of_clk_get_by_name(np, NULL); + if (IS_ERR(clk)) { +@@ -96,35 +94,30 @@ static int imx8mq_soc_revision(u32 *socrev, u64 *socuid) + clk_disable_unprepare(clk); + clk_put(clk); + iounmap(ocotp_base); +- of_node_put(np); + + return 0; + + err_clk: + iounmap(ocotp_base); +-err_iomap: +- of_node_put(np); + return ret; + } + + static int imx8mm_soc_uid(u64 *socuid) + { ++ struct device_node *np __free(device_node) = ++ of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp"); + void __iomem *ocotp_base; +- struct device_node *np; + struct clk *clk; + int ret = 0; + u32 offset = of_machine_is_compatible("fsl,imx8mp") ? + IMX8MP_OCOTP_UID_OFFSET : 0; + +- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-ocotp"); + if (!np) + return -EINVAL; + + ocotp_base = of_iomap(np, 0); +- if (!ocotp_base) { +- ret = -EINVAL; +- goto err_iomap; +- } ++ if (!ocotp_base) ++ return -EINVAL; + + clk = of_clk_get_by_name(np, NULL); + if (IS_ERR(clk)) { +@@ -143,38 +136,27 @@ static int imx8mm_soc_uid(u64 *socuid) + + err_clk: + iounmap(ocotp_base); +-err_iomap: +- of_node_put(np); +- + return ret; + } + + static int imx8mm_soc_revision(u32 *socrev, u64 *socuid) + { +- struct device_node *np; ++ struct device_node *np __free(device_node) = ++ of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop"); + void __iomem *anatop_base; +- int ret; + +- np = of_find_compatible_node(NULL, NULL, "fsl,imx8mm-anatop"); + if (!np) + return -EINVAL; + + anatop_base = of_iomap(np, 0); +- if (!anatop_base) { +- ret = -EINVAL; +- goto err_iomap; +- } ++ if (!anatop_base) ++ return -EINVAL; + + *socrev = readl_relaxed(anatop_base + ANADIG_DIGPROG_IMX8MM); + + iounmap(anatop_base); +- of_node_put(np); + + return imx8mm_soc_uid(socuid); +- +-err_iomap: +- of_node_put(np); +- return ret; + } + + static const struct imx8_soc_data imx8mq_soc_data = { +@@ -205,22 +187,23 @@ static __maybe_unused const struct of_device_id imx8_soc_match[] = { + { } + }; + +-#define imx8_revision(soc_rev) \ +- soc_rev ? \ +- kasprintf(GFP_KERNEL, "%d.%d", (soc_rev >> 4) & 0xf, soc_rev & 0xf) : \ ++#define imx8_revision(dev, soc_rev) \ ++ (soc_rev) ? \ ++ devm_kasprintf((dev), GFP_KERNEL, "%d.%d", ((soc_rev) >> 4) & 0xf, (soc_rev) & 0xf) : \ + "unknown" + + static int imx8m_soc_probe(struct platform_device *pdev) + { + struct soc_device_attribute *soc_dev_attr; + const struct imx8_soc_data *data; ++ struct device *dev = &pdev->dev; + const struct of_device_id *id; + struct soc_device *soc_dev; + u32 soc_rev = 0; + u64 soc_uid = 0; + int ret; + +- soc_dev_attr = kzalloc(sizeof(*soc_dev_attr), GFP_KERNEL); ++ soc_dev_attr = devm_kzalloc(dev, sizeof(*soc_dev_attr), GFP_KERNEL); + if (!soc_dev_attr) + return -ENOMEM; + +@@ -228,13 +211,11 @@ static int imx8m_soc_probe(struct platform_device *pdev) + + ret = of_property_read_string(of_root, "model", &soc_dev_attr->machine); + if (ret) +- goto free_soc; ++ return ret; + + id = of_match_node(imx8_soc_match, of_root); +- if (!id) { +- ret = -ENODEV; +- goto free_soc; +- } ++ if (!id) ++ return -ENODEV; + + data = id->data; + if (data) { +@@ -242,27 +223,21 @@ static int imx8m_soc_probe(struct platform_device *pdev) + if (data->soc_revision) { + ret = data->soc_revision(&soc_rev, &soc_uid); + if (ret) +- goto free_soc; ++ return ret; + } + } + +- soc_dev_attr->revision = imx8_revision(soc_rev); +- if (!soc_dev_attr->revision) { +- ret = -ENOMEM; +- goto free_soc; +- } ++ soc_dev_attr->revision = imx8_revision(dev, soc_rev); ++ if (!soc_dev_attr->revision) ++ return -ENOMEM; + +- soc_dev_attr->serial_number = kasprintf(GFP_KERNEL, "%016llX", soc_uid); +- if (!soc_dev_attr->serial_number) { +- ret = -ENOMEM; +- goto free_rev; +- } ++ soc_dev_attr->serial_number = devm_kasprintf(dev, GFP_KERNEL, "%016llX", soc_uid); ++ if (!soc_dev_attr->serial_number) ++ return -ENOMEM; + + soc_dev = soc_device_register(soc_dev_attr); +- if (IS_ERR(soc_dev)) { +- ret = PTR_ERR(soc_dev); +- goto free_serial_number; +- } ++ if (IS_ERR(soc_dev)) ++ return PTR_ERR(soc_dev); + + pr_info("SoC: %s revision %s\n", soc_dev_attr->soc_id, + soc_dev_attr->revision); +@@ -271,15 +246,6 @@ static int imx8m_soc_probe(struct platform_device *pdev) + platform_device_register_simple("imx-cpufreq-dt", -1, NULL, 0); + + return 0; +- +-free_serial_number: +- kfree(soc_dev_attr->serial_number); +-free_rev: +- if (strcmp(soc_dev_attr->revision, "unknown")) +- kfree(soc_dev_attr->revision); +-free_soc: +- kfree(soc_dev_attr); +- return ret; + } + + static struct platform_driver imx8m_soc_driver = { +-- +2.39.5 + diff --git a/queue-6.1/xfrm_output-force-software-gso-only-in-tunnel-mode.patch b/queue-6.1/xfrm_output-force-software-gso-only-in-tunnel-mode.patch new file mode 100644 index 0000000000..85aab7e631 --- /dev/null +++ b/queue-6.1/xfrm_output-force-software-gso-only-in-tunnel-mode.patch @@ -0,0 +1,77 @@ +From ee9b5278f7e94735fa2ce7216740e9a6f8ec0519 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Feb 2025 12:52:48 +0200 +Subject: xfrm_output: Force software GSO only in tunnel mode + +From: Cosmin Ratiu + +[ Upstream commit 0aae2867aa6067f73d066bc98385e23c8454a1d7 ] + +The cited commit fixed a software GSO bug with VXLAN + IPSec in tunnel +mode. Unfortunately, it is slightly broader than necessary, as it also +severely affects performance for Geneve + IPSec transport mode over a +device capable of both HW GSO and IPSec crypto offload. In this case, +xfrm_output unnecessarily triggers software GSO instead of letting the +HW do it. In simple iperf3 tests over Geneve + IPSec transport mode over +a back-2-back pair of NICs with MTU 1500, the performance was observed +to be up to 6x worse when doing software GSO compared to leaving it to +the hardware. + +This commit makes xfrm_output only trigger software GSO in crypto +offload cases for already encapsulated packets in tunnel mode, as not +doing so would then cause the inner tunnel skb->inner_networking_header +to be overwritten and break software GSO for that packet later if the +device turns out to not be capable of HW GSO. + +Taking a closer look at the conditions for the original bug, to better +understand the reasons for this change: +- vxlan_build_skb -> iptunnel_handle_offloads sets inner_protocol and + inner network header. +- then, udp_tunnel_xmit_skb -> ip_tunnel_xmit adds outer transport and + network headers. +- later in the xmit path, xfrm_output -> xfrm_outer_mode_output -> + xfrm4_prepare_output -> xfrm4_tunnel_encap_add overwrites the inner + network header with the one set in ip_tunnel_xmit before adding the + second outer header. +- __dev_queue_xmit -> validate_xmit_skb checks whether GSO segmentation + needs to happen based on dev features. In the original bug, the hw + couldn't segment the packets, so skb_gso_segment was invoked. +- deep in the .gso_segment callback machinery, __skb_udp_tunnel_segment + tries to use the wrong inner network header, expecting the one set in + iptunnel_handle_offloads but getting the one set by xfrm instead. +- a bit later, ipv6_gso_segment accesses the wrong memory based on that + wrong inner network header. + +With the new change, the original bug (or similar ones) cannot happen +again, as xfrm will now trigger software GSO before applying a tunnel. +This concern doesn't exist in packet offload mode, when the HW adds +encapsulation headers. For the non-offloaded packets (crypto in SW), +software GSO is still done unconditionally in the else branch. + +Reviewed-by: Dragos Tatulea +Reviewed-by: Yael Chemla +Reviewed-by: Leon Romanovsky +Fixes: a204aef9fd77 ("xfrm: call xfrm_output_gso when inner_protocol is set in xfrm_output") +Signed-off-by: Cosmin Ratiu +Signed-off-by: Steffen Klassert +Signed-off-by: Sasha Levin +--- + net/xfrm/xfrm_output.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c +index 07a7ee43b8ae2..c59c548d8fc10 100644 +--- a/net/xfrm/xfrm_output.c ++++ b/net/xfrm/xfrm_output.c +@@ -738,7 +738,7 @@ int xfrm_output(struct sock *sk, struct sk_buff *skb) + skb->encapsulation = 1; + + if (skb_is_gso(skb)) { +- if (skb->inner_protocol) ++ if (skb->inner_protocol && x->props.mode == XFRM_MODE_TUNNEL) + return xfrm_output_gso(net, sk, skb); + + skb_shinfo(skb)->gso_type |= SKB_GSO_ESP; +-- +2.39.5 + -- 2.47.3