From 3debc7d2cd67cd74c9ba559a6f0ce500c0540f97 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Thu, 11 Aug 2022 15:53:58 +0200 Subject: [PATCH] 5.4-stable patches added patches: igc-remove-_i_phy_id-checking.patch wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch --- queue-5.4/igc-remove-_i_phy_id-checking.patch | 77 ++++++++++++++++ queue-5.4/series | 4 + ...im-add-back-erroneously-removed-cast.patch | 33 +++++++ ...fix-race-condition-in-pending-packet.patch | 88 +++++++++++++++++++ ...mac80211_hwsim-use-32-bit-skb-cookie.patch | 65 ++++++++++++++ 5 files changed, 267 insertions(+) create mode 100644 queue-5.4/igc-remove-_i_phy_id-checking.patch create mode 100644 queue-5.4/wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch create mode 100644 queue-5.4/wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch create mode 100644 queue-5.4/wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch diff --git a/queue-5.4/igc-remove-_i_phy_id-checking.patch b/queue-5.4/igc-remove-_i_phy_id-checking.patch new file mode 100644 index 00000000000..02b9b3c37d2 --- /dev/null +++ b/queue-5.4/igc-remove-_i_phy_id-checking.patch @@ -0,0 +1,77 @@ +From 7c496de538eebd8212dc2a3c9a468386b264d0d4 Mon Sep 17 00:00:00 2001 +From: Sasha Neftin +Date: Wed, 7 Jul 2021 08:14:40 +0300 +Subject: igc: Remove _I_PHY_ID checking + +From: Sasha Neftin + +commit 7c496de538eebd8212dc2a3c9a468386b264d0d4 upstream. + +i225 devices have only one PHY vendor. There is no point checking +_I_PHY_ID during the link establishment and auto-negotiation process. +This patch comes to clean up these pointless checkings. + +Signed-off-by: Sasha Neftin +Tested-by: Dvora Fuxbrumer +Signed-off-by: Tony Nguyen +Cc: Linjun Bao +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/ethernet/intel/igc/igc_base.c | 10 +--------- + drivers/net/ethernet/intel/igc/igc_main.c | 3 +-- + drivers/net/ethernet/intel/igc/igc_phy.c | 6 ++---- + 3 files changed, 4 insertions(+), 15 deletions(-) + +--- a/drivers/net/ethernet/intel/igc/igc_base.c ++++ b/drivers/net/ethernet/intel/igc/igc_base.c +@@ -187,15 +187,7 @@ static s32 igc_init_phy_params_base(stru + + igc_check_for_copper_link(hw); + +- /* Verify phy id and set remaining function pointers */ +- switch (phy->id) { +- case I225_I_PHY_ID: +- phy->type = igc_phy_i225; +- break; +- default: +- ret_val = -IGC_ERR_PHY; +- goto out; +- } ++ phy->type = igc_phy_i225; + + out: + return ret_val; +--- a/drivers/net/ethernet/intel/igc/igc_main.c ++++ b/drivers/net/ethernet/intel/igc/igc_main.c +@@ -2884,8 +2884,7 @@ bool igc_has_link(struct igc_adapter *ad + break; + } + +- if (hw->mac.type == igc_i225 && +- hw->phy.id == I225_I_PHY_ID) { ++ if (hw->mac.type == igc_i225) { + if (!netif_carrier_ok(adapter->netdev)) { + adapter->flags &= ~IGC_FLAG_NEED_LINK_UPDATE; + } else if (!(adapter->flags & IGC_FLAG_NEED_LINK_UPDATE)) { +--- a/drivers/net/ethernet/intel/igc/igc_phy.c ++++ b/drivers/net/ethernet/intel/igc/igc_phy.c +@@ -235,8 +235,7 @@ static s32 igc_phy_setup_autoneg(struct + return ret_val; + } + +- if ((phy->autoneg_mask & ADVERTISE_2500_FULL) && +- hw->phy.id == I225_I_PHY_ID) { ++ if (phy->autoneg_mask & ADVERTISE_2500_FULL) { + /* Read the MULTI GBT AN Control Register - reg 7.32 */ + ret_val = phy->ops.read_reg(hw, (STANDARD_AN_REG_MASK << + MMD_DEVADDR_SHIFT) | +@@ -376,8 +375,7 @@ static s32 igc_phy_setup_autoneg(struct + ret_val = phy->ops.write_reg(hw, PHY_1000T_CTRL, + mii_1000t_ctrl_reg); + +- if ((phy->autoneg_mask & ADVERTISE_2500_FULL) && +- hw->phy.id == I225_I_PHY_ID) ++ if (phy->autoneg_mask & ADVERTISE_2500_FULL) + ret_val = phy->ops.write_reg(hw, + (STANDARD_AN_REG_MASK << + MMD_DEVADDR_SHIFT) | diff --git a/queue-5.4/series b/queue-5.4/series index e6d012adcd4..4adc30ab038 100644 --- a/queue-5.4/series +++ b/queue-5.4/series @@ -2,3 +2,7 @@ makefile-link-with-z-noexecstack-no-warn-rwx-segments.patch x86-link-vdso-and-boot-with-z-noexecstack-no-warn-rwx-segments.patch scsi-revert-scsi-qla2xxx-fix-disk-failure-to-rediscover.patch alsa-bcd2000-fix-a-uaf-bug-on-the-error-path-of-probing.patch +igc-remove-_i_phy_id-checking.patch +wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch +wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch +wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch diff --git a/queue-5.4/wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch b/queue-5.4/wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch new file mode 100644 index 00000000000..0494df94b6f --- /dev/null +++ b/queue-5.4/wifi-mac80211_hwsim-add-back-erroneously-removed-cast.patch @@ -0,0 +1,33 @@ +From 58b6259d820d63c2adf1c7541b54cce5a2ae6073 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Mon, 11 Jul 2022 13:14:24 +0200 +Subject: wifi: mac80211_hwsim: add back erroneously removed cast + +From: Johannes Berg + +commit 58b6259d820d63c2adf1c7541b54cce5a2ae6073 upstream. + +The robots report that we're now casting to a differently +sized integer, which is correct, and the previous patch +had erroneously removed it. + +Reported-by: kernel test robot +Fixes: 4ee186fa7e40 ("wifi: mac80211_hwsim: fix race condition in pending packet") +Signed-off-by: Johannes Berg +Cc: Jeongik Cha +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3289,7 +3289,7 @@ static int hwsim_tx_info_frame_received_ + u64 skb_cookie; + + txi = IEEE80211_SKB_CB(skb); +- skb_cookie = (u64)txi->rate_driver_data[0]; ++ skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0]; + + if (skb_cookie == ret_skb_cookie) { + __skb_unlink(skb, &data2->pending); diff --git a/queue-5.4/wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch b/queue-5.4/wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch new file mode 100644 index 00000000000..f30852b37cc --- /dev/null +++ b/queue-5.4/wifi-mac80211_hwsim-fix-race-condition-in-pending-packet.patch @@ -0,0 +1,88 @@ +From 4ee186fa7e40ae06ebbfbad77e249e3746e14114 Mon Sep 17 00:00:00 2001 +From: Jeongik Cha +Date: Mon, 4 Jul 2022 17:43:54 +0900 +Subject: wifi: mac80211_hwsim: fix race condition in pending packet + +From: Jeongik Cha + +commit 4ee186fa7e40ae06ebbfbad77e249e3746e14114 upstream. + +A pending packet uses a cookie as an unique key, but it can be duplicated +because it didn't use atomic operators. + +And also, a pending packet can be null in hwsim_tx_info_frame_received_nl +due to race condition with mac80211_hwsim_stop. + +For this, + * Use an atomic type and operator for a cookie + * Add a lock around the loop for pending packets + +Signed-off-by: Jeongik Cha +Link: https://lore.kernel.org/r/20220704084354.3556326-1-jeongik@google.com +Signed-off-by: Johannes Berg +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -527,7 +527,7 @@ struct mac80211_hwsim_data { + bool ps_poll_pending; + struct dentry *debugfs; + +- uintptr_t pending_cookie; ++ atomic64_t pending_cookie; + struct sk_buff_head pending; /* packets pending */ + /* + * Only radios in the same group can communicate together (the +@@ -1044,7 +1044,7 @@ static void mac80211_hwsim_tx_frame_nl(s + int i; + struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES]; + struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES]; +- uintptr_t cookie; ++ u64 cookie; + + if (data->ps != PS_DISABLED) + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); +@@ -1113,8 +1113,7 @@ static void mac80211_hwsim_tx_frame_nl(s + goto nla_put_failure; + + /* We create a cookie to identify this skb */ +- data->pending_cookie++; +- cookie = data->pending_cookie; ++ cookie = (u64)atomic64_inc_return(&data->pending_cookie); + info->rate_driver_data[0] = (void *)cookie; + if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD)) + goto nla_put_failure; +@@ -3260,6 +3259,7 @@ static int hwsim_tx_info_frame_received_ + const u8 *src; + unsigned int hwsim_flags; + int i; ++ unsigned long flags; + bool found = false; + + if (!info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER] || +@@ -3284,18 +3284,20 @@ static int hwsim_tx_info_frame_received_ + goto out; + + /* look for the skb matching the cookie passed back from user */ ++ spin_lock_irqsave(&data2->pending.lock, flags); + skb_queue_walk_safe(&data2->pending, skb, tmp) { + u64 skb_cookie; + + txi = IEEE80211_SKB_CB(skb); +- skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0]; ++ skb_cookie = (u64)txi->rate_driver_data[0]; + + if (skb_cookie == ret_skb_cookie) { +- skb_unlink(skb, &data2->pending); ++ __skb_unlink(skb, &data2->pending); + found = true; + break; + } + } ++ spin_unlock_irqrestore(&data2->pending.lock, flags); + + /* not found */ + if (!found) diff --git a/queue-5.4/wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch b/queue-5.4/wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch new file mode 100644 index 00000000000..3dd4694a750 --- /dev/null +++ b/queue-5.4/wifi-mac80211_hwsim-use-32-bit-skb-cookie.patch @@ -0,0 +1,65 @@ +From cc5250cdb43d444061412df7fae72d2b4acbdf97 Mon Sep 17 00:00:00 2001 +From: Johannes Berg +Date: Wed, 13 Jul 2022 21:16:45 +0200 +Subject: wifi: mac80211_hwsim: use 32-bit skb cookie + +From: Johannes Berg + +commit cc5250cdb43d444061412df7fae72d2b4acbdf97 upstream. + +We won't really have enough skbs to need a 64-bit cookie, +and on 32-bit platforms storing the 64-bit cookie into the +void *rate_driver_data doesn't work anyway. Switch back to +using just a 32-bit cookie and uintptr_t for the type to +avoid compiler warnings about all this. + +Fixes: 4ee186fa7e40 ("wifi: mac80211_hwsim: fix race condition in pending packet") +Signed-off-by: Johannes Berg +Cc: Jeongik Cha +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/mac80211_hwsim.c | 10 +++++----- + 1 file changed, 5 insertions(+), 5 deletions(-) + +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -527,7 +527,7 @@ struct mac80211_hwsim_data { + bool ps_poll_pending; + struct dentry *debugfs; + +- atomic64_t pending_cookie; ++ atomic_t pending_cookie; + struct sk_buff_head pending; /* packets pending */ + /* + * Only radios in the same group can communicate together (the +@@ -1044,7 +1044,7 @@ static void mac80211_hwsim_tx_frame_nl(s + int i; + struct hwsim_tx_rate tx_attempts[IEEE80211_TX_MAX_RATES]; + struct hwsim_tx_rate_flag tx_attempts_flags[IEEE80211_TX_MAX_RATES]; +- u64 cookie; ++ uintptr_t cookie; + + if (data->ps != PS_DISABLED) + hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PM); +@@ -1113,7 +1113,7 @@ static void mac80211_hwsim_tx_frame_nl(s + goto nla_put_failure; + + /* We create a cookie to identify this skb */ +- cookie = (u64)atomic64_inc_return(&data->pending_cookie); ++ cookie = atomic_inc_return(&data->pending_cookie); + info->rate_driver_data[0] = (void *)cookie; + if (nla_put_u64_64bit(skb, HWSIM_ATTR_COOKIE, cookie, HWSIM_ATTR_PAD)) + goto nla_put_failure; +@@ -3286,10 +3286,10 @@ static int hwsim_tx_info_frame_received_ + /* look for the skb matching the cookie passed back from user */ + spin_lock_irqsave(&data2->pending.lock, flags); + skb_queue_walk_safe(&data2->pending, skb, tmp) { +- u64 skb_cookie; ++ uintptr_t skb_cookie; + + txi = IEEE80211_SKB_CB(skb); +- skb_cookie = (u64)(uintptr_t)txi->rate_driver_data[0]; ++ skb_cookie = (uintptr_t)txi->rate_driver_data[0]; + + if (skb_cookie == ret_skb_cookie) { + __skb_unlink(skb, &data2->pending); -- 2.47.3