From 4e977dfd20541d4d3a64cfeeaefa0bafc2af91f2 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Fri, 5 Jun 2020 15:54:01 +0200 Subject: [PATCH] 5.7-stable patches added patches: airo-fix-read-overflows-sending-packets.patch net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch --- ...o-fix-read-overflows-sending-packets.patch | 62 ++++++++++++++++ ...mt7530-set-cpu-port-to-fallback-mode.patch | 71 +++++++++++++++++++ queue-5.7/series | 2 + 3 files changed, 135 insertions(+) create mode 100644 queue-5.7/airo-fix-read-overflows-sending-packets.patch create mode 100644 queue-5.7/net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch diff --git a/queue-5.7/airo-fix-read-overflows-sending-packets.patch b/queue-5.7/airo-fix-read-overflows-sending-packets.patch new file mode 100644 index 00000000000..e7ba4224f65 --- /dev/null +++ b/queue-5.7/airo-fix-read-overflows-sending-packets.patch @@ -0,0 +1,62 @@ +From 11e7a91994c29da96d847f676be023da6a2c1359 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 27 May 2020 21:48:30 +0300 +Subject: airo: Fix read overflows sending packets + +From: Dan Carpenter + +commit 11e7a91994c29da96d847f676be023da6a2c1359 upstream. + +The problem is that we always copy a minimum of ETH_ZLEN (60) bytes from +skb->data even when skb->len is less than ETH_ZLEN so it leads to a read +overflow. + +The fix is to pad skb->data to at least ETH_ZLEN bytes. + +Cc: +Reported-by: Hu Jiahui +Signed-off-by: Dan Carpenter +Reviewed-by: Eric Dumazet +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20200527184830.GA1164846@mwanda +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/cisco/airo.c | 12 ++++++++++++ + 1 file changed, 12 insertions(+) + +--- a/drivers/net/wireless/cisco/airo.c ++++ b/drivers/net/wireless/cisco/airo.c +@@ -1925,6 +1925,10 @@ static netdev_tx_t mpi_start_xmit(struct + airo_print_err(dev->name, "%s: skb == NULL!",__func__); + return NETDEV_TX_OK; + } ++ if (skb_padto(skb, ETH_ZLEN)) { ++ dev->stats.tx_dropped++; ++ return NETDEV_TX_OK; ++ } + npacks = skb_queue_len (&ai->txq); + + if (npacks >= MAXTXQ - 1) { +@@ -2127,6 +2131,10 @@ static netdev_tx_t airo_start_xmit(struc + airo_print_err(dev->name, "%s: skb == NULL!", __func__); + return NETDEV_TX_OK; + } ++ if (skb_padto(skb, ETH_ZLEN)) { ++ dev->stats.tx_dropped++; ++ return NETDEV_TX_OK; ++ } + + /* Find a vacant FID */ + for( i = 0; i < MAX_FIDS / 2 && (fids[i] & 0xffff0000); i++ ); +@@ -2201,6 +2209,10 @@ static netdev_tx_t airo_start_xmit11(str + airo_print_err(dev->name, "%s: skb == NULL!", __func__); + return NETDEV_TX_OK; + } ++ if (skb_padto(skb, ETH_ZLEN)) { ++ dev->stats.tx_dropped++; ++ return NETDEV_TX_OK; ++ } + + /* Find a vacant FID */ + for( i = MAX_FIDS / 2; i < MAX_FIDS && (fids[i] & 0xffff0000); i++ ); diff --git a/queue-5.7/net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch b/queue-5.7/net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch new file mode 100644 index 00000000000..b3b46aee3e0 --- /dev/null +++ b/queue-5.7/net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch @@ -0,0 +1,71 @@ +From 38152ea37d8bdaffa22603e0a5b5b86cfa8714c9 Mon Sep 17 00:00:00 2001 +From: DENG Qingfang +Date: Wed, 13 May 2020 23:37:17 +0800 +Subject: net: dsa: mt7530: set CPU port to fallback mode + +From: DENG Qingfang + +commit 38152ea37d8bdaffa22603e0a5b5b86cfa8714c9 upstream. + +Currently, setting a bridge's self PVID to other value and deleting +the default VID 1 renders untagged ports of that VLAN unable to talk to +the CPU port: + + bridge vlan add dev br0 vid 2 pvid untagged self + bridge vlan del dev br0 vid 1 self + bridge vlan add dev sw0p0 vid 2 pvid untagged + bridge vlan del dev sw0p0 vid 1 + # br0 cannot send untagged frames out of sw0p0 anymore + +That is because the CPU port is set to security mode and its PVID is +still 1, and untagged frames are dropped due to VLAN member violation. + +Set the CPU port to fallback mode so untagged frames can pass through. + +Fixes: 83163f7dca56 ("net: dsa: mediatek: add VLAN support for MT7530") +Signed-off-by: DENG Qingfang +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/dsa/mt7530.c | 11 ++++++++--- + drivers/net/dsa/mt7530.h | 6 ++++++ + 2 files changed, 14 insertions(+), 3 deletions(-) + +--- a/drivers/net/dsa/mt7530.c ++++ b/drivers/net/dsa/mt7530.c +@@ -807,10 +807,15 @@ mt7530_port_set_vlan_aware(struct dsa_sw + PCR_MATRIX_MASK, PCR_MATRIX(MT7530_ALL_MEMBERS)); + + /* Trapped into security mode allows packet forwarding through VLAN +- * table lookup. ++ * table lookup. CPU port is set to fallback mode to let untagged ++ * frames pass through. + */ +- mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK, +- MT7530_PORT_SECURITY_MODE); ++ if (dsa_is_cpu_port(ds, port)) ++ mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK, ++ MT7530_PORT_FALLBACK_MODE); ++ else ++ mt7530_rmw(priv, MT7530_PCR_P(port), PCR_PORT_VLAN_MASK, ++ MT7530_PORT_SECURITY_MODE); + + /* Set the port as a user port which is to be able to recognize VID + * from incoming packets before fetching entry within the VLAN table. +--- a/drivers/net/dsa/mt7530.h ++++ b/drivers/net/dsa/mt7530.h +@@ -153,6 +153,12 @@ enum mt7530_port_mode { + /* Port Matrix Mode: Frames are forwarded by the PCR_MATRIX members. */ + MT7530_PORT_MATRIX_MODE = PORT_VLAN(0), + ++ /* Fallback Mode: Forward received frames with ingress ports that do ++ * not belong to the VLAN member. Frames whose VID is not listed on ++ * the VLAN table are forwarded by the PCR_MATRIX members. ++ */ ++ MT7530_PORT_FALLBACK_MODE = PORT_VLAN(1), ++ + /* Security Mode: Discard any frame due to ingress membership + * violation or VID missed on the VLAN table. + */ diff --git a/queue-5.7/series b/queue-5.7/series index 379ec69a870..ca052e83182 100644 --- a/queue-5.7/series +++ b/queue-5.7/series @@ -10,3 +10,5 @@ kernel-relay.c-handle-alloc_percpu-returning-null-in-relay_open.patch mmc-fix-compilation-of-user-api.patch media-revert-staging-imgu-address-a-compiler-warning-on-alignment.patch media-staging-ipu3-imgu-move-alignment-attribute-to-field.patch +net-dsa-mt7530-set-cpu-port-to-fallback-mode.patch +airo-fix-read-overflows-sending-packets.patch -- 2.47.3