From 551f9c44963ad14fd5315e7aa2fa4db52da862bc Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Mon, 7 Jun 2021 21:13:08 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ....5-add-cancel_delayed_work_sync-befo.patch | 49 ++++ ...-add-cancel_delayed_work_sync-before.patch | 44 ++++ ...add-cancel_delayed_work_sync-before-.patch | 50 +++++ .../io_uring-fix-link-timeout-refs.patch | 54 +++++ ...io_uring-use-better-types-for-cflags.patch | 46 ++++ ...riscv-vdso-fix-and-clean-up-makefile.patch | 74 ++++++ ...tm32-fix-threaded-interrupt-handling.patch | 103 +++++++++ queue-5.10/series | 9 + ...ck-messages-for-bearer-media-failure.patch | 211 ++++++++++++++++++ ...fix-unique-bearer-names-sanity-check.patch | 99 ++++++++ 10 files changed, 739 insertions(+) create mode 100644 queue-5.10/drm-amdgpu-jpeg2.5-add-cancel_delayed_work_sync-befo.patch create mode 100644 queue-5.10/drm-amdgpu-jpeg3-add-cancel_delayed_work_sync-before.patch create mode 100644 queue-5.10/drm-amdgpu-vcn3-add-cancel_delayed_work_sync-before-.patch create mode 100644 queue-5.10/io_uring-fix-link-timeout-refs.patch create mode 100644 queue-5.10/io_uring-use-better-types-for-cflags.patch create mode 100644 queue-5.10/riscv-vdso-fix-and-clean-up-makefile.patch create mode 100644 queue-5.10/serial-stm32-fix-threaded-interrupt-handling.patch create mode 100644 queue-5.10/tipc-add-extack-messages-for-bearer-media-failure.patch create mode 100644 queue-5.10/tipc-fix-unique-bearer-names-sanity-check.patch diff --git a/queue-5.10/drm-amdgpu-jpeg2.5-add-cancel_delayed_work_sync-befo.patch b/queue-5.10/drm-amdgpu-jpeg2.5-add-cancel_delayed_work_sync-befo.patch new file mode 100644 index 00000000000..1da38ef68d6 --- /dev/null +++ b/queue-5.10/drm-amdgpu-jpeg2.5-add-cancel_delayed_work_sync-befo.patch @@ -0,0 +1,49 @@ +From 6a291acc42309ef92bab93fe75bb83b2aa420c1e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 12:04:38 -0400 +Subject: drm/amdgpu/jpeg2.5: add cancel_delayed_work_sync before power gate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Zhu + +[ Upstream commit 23f10a571da5eaa63b7845d16e2f49837e841ab9 ] + +Add cancel_delayed_work_sync before set power gating state +to avoid race condition issue when power gating. + +Signed-off-by: James Zhu +Reviewed-by: Leo Liu +Acked-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c +index 63b350182389..8c84e35c2719 100644 +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v2_5.c +@@ -187,14 +187,14 @@ static int jpeg_v2_5_hw_init(void *handle) + static int jpeg_v2_5_hw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +- struct amdgpu_ring *ring; + int i; + ++ cancel_delayed_work_sync(&adev->vcn.idle_work); ++ + for (i = 0; i < adev->jpeg.num_jpeg_inst; ++i) { + if (adev->jpeg.harvest_config & (1 << i)) + continue; + +- ring = &adev->jpeg.inst[i].ring_dec; + if (adev->jpeg.cur_state != AMD_PG_STATE_GATE && + RREG32_SOC15(JPEG, i, mmUVD_JRBC_STATUS)) + jpeg_v2_5_set_powergating_state(adev, AMD_PG_STATE_GATE); +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-jpeg3-add-cancel_delayed_work_sync-before.patch b/queue-5.10/drm-amdgpu-jpeg3-add-cancel_delayed_work_sync-before.patch new file mode 100644 index 00000000000..8ca1cc59a13 --- /dev/null +++ b/queue-5.10/drm-amdgpu-jpeg3-add-cancel_delayed_work_sync-before.patch @@ -0,0 +1,44 @@ +From 6bbb35068b37ebe24cafcace6067598a5f0be1ee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 May 2021 12:08:20 -0400 +Subject: drm/amdgpu/jpeg3: add cancel_delayed_work_sync before power gate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Zhu + +[ Upstream commit 20ebbfd22f8115a1e4f60d3d289f66be4d47f1ec ] + +Add cancel_delayed_work_sync before set power gating state +to avoid race condition issue when power gating. + +Signed-off-by: James Zhu +Reviewed-by: Leo Liu +Acked-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c b/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c +index 9259e35f0f55..e00c88abeaed 100644 +--- a/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/jpeg_v3_0.c +@@ -159,9 +159,9 @@ static int jpeg_v3_0_hw_init(void *handle) + static int jpeg_v3_0_hw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +- struct amdgpu_ring *ring; + +- ring = &adev->jpeg.inst->ring_dec; ++ cancel_delayed_work_sync(&adev->vcn.idle_work); ++ + if (adev->jpeg.cur_state != AMD_PG_STATE_GATE && + RREG32_SOC15(JPEG, 0, mmUVD_JRBC_STATUS)) + jpeg_v3_0_set_powergating_state(adev, AMD_PG_STATE_GATE); +-- +2.30.2 + diff --git a/queue-5.10/drm-amdgpu-vcn3-add-cancel_delayed_work_sync-before-.patch b/queue-5.10/drm-amdgpu-vcn3-add-cancel_delayed_work_sync-before-.patch new file mode 100644 index 00000000000..45bddc46b61 --- /dev/null +++ b/queue-5.10/drm-amdgpu-vcn3-add-cancel_delayed_work_sync-before-.patch @@ -0,0 +1,50 @@ +From 65d6692bb2f103faa511a4159c6596bd469c1406 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 17 May 2021 16:39:17 -0400 +Subject: drm/amdgpu/vcn3: add cancel_delayed_work_sync before power gate +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: James Zhu + +[ Upstream commit 4a62542ae064e3b645d6bbf2295a6c05136956c6 ] + +Add cancel_delayed_work_sync before set power gating state +to avoid race condition issue when power gating. + +Signed-off-by: James Zhu +Reviewed-by: Leo Liu +Acked-by: Christian König +Signed-off-by: Alex Deucher +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c | 5 ++--- + 1 file changed, 2 insertions(+), 3 deletions(-) + +diff --git a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c +index 700621ddc02e..c9c888be1228 100644 +--- a/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c ++++ b/drivers/gpu/drm/amd/amdgpu/vcn_v3_0.c +@@ -345,15 +345,14 @@ done: + static int vcn_v3_0_hw_fini(void *handle) + { + struct amdgpu_device *adev = (struct amdgpu_device *)handle; +- struct amdgpu_ring *ring; + int i; + ++ cancel_delayed_work_sync(&adev->vcn.idle_work); ++ + for (i = 0; i < adev->vcn.num_vcn_inst; ++i) { + if (adev->vcn.harvest_config & (1 << i)) + continue; + +- ring = &adev->vcn.inst[i].ring_dec; +- + if (!amdgpu_sriov_vf(adev)) { + if ((adev->pg_flags & AMD_PG_SUPPORT_VCN_DPG) || + (adev->vcn.cur_state != AMD_PG_STATE_GATE && +-- +2.30.2 + diff --git a/queue-5.10/io_uring-fix-link-timeout-refs.patch b/queue-5.10/io_uring-fix-link-timeout-refs.patch new file mode 100644 index 00000000000..02293d2409e --- /dev/null +++ b/queue-5.10/io_uring-fix-link-timeout-refs.patch @@ -0,0 +1,54 @@ +From 8781b5ecd0aadae802855ba95ba5295e99622dfe Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 7 May 2021 21:06:38 +0100 +Subject: io_uring: fix link timeout refs + +From: Pavel Begunkov + +[ Upstream commit a298232ee6b9a1d5d732aa497ff8be0d45b5bd82 ] + +WARNING: CPU: 0 PID: 10242 at lib/refcount.c:28 refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28 +RIP: 0010:refcount_warn_saturate+0x15b/0x1a0 lib/refcount.c:28 +Call Trace: + __refcount_sub_and_test include/linux/refcount.h:283 [inline] + __refcount_dec_and_test include/linux/refcount.h:315 [inline] + refcount_dec_and_test include/linux/refcount.h:333 [inline] + io_put_req fs/io_uring.c:2140 [inline] + io_queue_linked_timeout fs/io_uring.c:6300 [inline] + __io_queue_sqe+0xbef/0xec0 fs/io_uring.c:6354 + io_submit_sqe fs/io_uring.c:6534 [inline] + io_submit_sqes+0x2bbd/0x7c50 fs/io_uring.c:6660 + __do_sys_io_uring_enter fs/io_uring.c:9240 [inline] + __se_sys_io_uring_enter+0x256/0x1d60 fs/io_uring.c:9182 + +io_link_timeout_fn() should put only one reference of the linked timeout +request, however in case of racing with the master request's completion +first io_req_complete() puts one and then io_put_req_deferred() is +called. + +Cc: stable@vger.kernel.org # 5.12+ +Fixes: 9ae1f8dd372e0 ("io_uring: fix inconsistent lock state") +Reported-by: syzbot+a2910119328ce8e7996f@syzkaller.appspotmail.com +Signed-off-by: Pavel Begunkov +Link: https://lore.kernel.org/r/ff51018ff29de5ffa76f09273ef48cb24c720368.1620417627.git.asml.silence@gmail.com +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 369ec81033d6..958c463c11eb 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -6266,6 +6266,7 @@ static enum hrtimer_restart io_link_timeout_fn(struct hrtimer *timer) + if (prev) { + io_async_find_and_cancel(ctx, req, prev->user_data, -ETIME); + io_put_req_deferred(prev, 1); ++ io_put_req_deferred(req, 1); + } else { + io_cqring_add_event(req, -ETIME, 0); + io_put_req_deferred(req, 1); +-- +2.30.2 + diff --git a/queue-5.10/io_uring-use-better-types-for-cflags.patch b/queue-5.10/io_uring-use-better-types-for-cflags.patch new file mode 100644 index 00000000000..7b23f78afb8 --- /dev/null +++ b/queue-5.10/io_uring-use-better-types-for-cflags.patch @@ -0,0 +1,46 @@ +From 23331b00bb0a24f1cf90f48b879cefd93448cc14 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 28 Feb 2021 22:35:15 +0000 +Subject: io_uring: use better types for cflags + +From: Pavel Begunkov + +[ Upstream commit 8c3f9cd1603d0e4af6c50ebc6d974ab7bdd03cf4 ] + +__io_cqring_fill_event() takes cflags as long to squeeze it into u32 in +an CQE, awhile all users pass int or unsigned. Replace it with unsigned +int and store it as u32 in struct io_completion to match CQE. + +Signed-off-by: Pavel Begunkov +Signed-off-by: Jens Axboe +Signed-off-by: Sasha Levin +--- + fs/io_uring.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/fs/io_uring.c b/fs/io_uring.c +index 958c463c11eb..fdbaaf579cc6 100644 +--- a/fs/io_uring.c ++++ b/fs/io_uring.c +@@ -545,7 +545,7 @@ struct io_statx { + struct io_completion { + struct file *file; + struct list_head list; +- int cflags; ++ u32 cflags; + }; + + struct io_async_connect { +@@ -1711,7 +1711,8 @@ static void io_cqring_overflow_flush(struct io_ring_ctx *ctx, bool force, + } + } + +-static void __io_cqring_fill_event(struct io_kiocb *req, long res, long cflags) ++static void __io_cqring_fill_event(struct io_kiocb *req, long res, ++ unsigned int cflags) + { + struct io_ring_ctx *ctx = req->ctx; + struct io_uring_cqe *cqe; +-- +2.30.2 + diff --git a/queue-5.10/riscv-vdso-fix-and-clean-up-makefile.patch b/queue-5.10/riscv-vdso-fix-and-clean-up-makefile.patch new file mode 100644 index 00000000000..bb9d57c0c34 --- /dev/null +++ b/queue-5.10/riscv-vdso-fix-and-clean-up-makefile.patch @@ -0,0 +1,74 @@ +From 8aafbd64da80c2d17994d435c0afc113cba4afa4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 2 Apr 2021 21:29:08 +0800 +Subject: riscv: vdso: fix and clean-up Makefile + +From: Jisheng Zhang + +[ Upstream commit 772d7891e8b3b0baae7bb88a294d61fd07ba6d15 ] + +Running "make" on an already compiled kernel tree will rebuild the +kernel even without any modifications: + + CALL linux/scripts/checksyscalls.sh + CALL linux/scripts/atomic/check-atomics.sh + CHK include/generated/compile.h + SO2S arch/riscv/kernel/vdso/vdso-syms.S + AS arch/riscv/kernel/vdso/vdso-syms.o + AR arch/riscv/kernel/vdso/built-in.a + AR arch/riscv/kernel/built-in.a + AR arch/riscv/built-in.a + GEN .version + CHK include/generated/compile.h + UPD include/generated/compile.h + CC init/version.o + AR init/built-in.a + LD vmlinux.o + +The reason is "Any target that utilizes if_changed must be listed in +$(targets), otherwise the command line check will fail, and the target +will always be built" as explained by Documentation/kbuild/makefiles.rst + +Fix this build bug by adding vdso-syms.S to $(targets) + +At the same time, there are two trivial clean up modifications: + +- the vdso-dummy.o is not needed any more after so remove it. + +- vdso.lds is a generated file, so it should be prefixed with + $(obj)/ instead of $(src)/ + +Fixes: c2c81bb2f691 ("RISC-V: Fix the VDSO symbol generaton for binutils-2.35+") +Cc: stable@vger.kernel.org +Signed-off-by: Jisheng Zhang +Signed-off-by: Palmer Dabbelt +Signed-off-by: Sasha Levin +--- + arch/riscv/kernel/vdso/Makefile | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/riscv/kernel/vdso/Makefile b/arch/riscv/kernel/vdso/Makefile +index ca2b40dfd24b..24d936c147cd 100644 +--- a/arch/riscv/kernel/vdso/Makefile ++++ b/arch/riscv/kernel/vdso/Makefile +@@ -23,7 +23,7 @@ ifneq ($(c-gettimeofday-y),) + endif + + # Build rules +-targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.lds vdso-dummy.o ++targets := $(obj-vdso) vdso.so vdso.so.dbg vdso.lds vdso-syms.S + obj-vdso := $(addprefix $(obj)/, $(obj-vdso)) + + obj-y += vdso.o vdso-syms.o +@@ -41,7 +41,7 @@ KASAN_SANITIZE := n + $(obj)/vdso.o: $(obj)/vdso.so + + # link rule for the .so file, .lds has to be first +-$(obj)/vdso.so.dbg: $(src)/vdso.lds $(obj-vdso) FORCE ++$(obj)/vdso.so.dbg: $(obj)/vdso.lds $(obj-vdso) FORCE + $(call if_changed,vdsold) + LDFLAGS_vdso.so.dbg = -shared -s -soname=linux-vdso.so.1 \ + --build-id=sha1 --hash-style=both --eh-frame-hdr +-- +2.30.2 + diff --git a/queue-5.10/serial-stm32-fix-threaded-interrupt-handling.patch b/queue-5.10/serial-stm32-fix-threaded-interrupt-handling.patch new file mode 100644 index 00000000000..7ad61f1599f --- /dev/null +++ b/queue-5.10/serial-stm32-fix-threaded-interrupt-handling.patch @@ -0,0 +1,103 @@ +From 737a62969d947084aa3355f46df58335bb16c1a2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 16 Apr 2021 16:05:56 +0200 +Subject: serial: stm32: fix threaded interrupt handling + +From: Johan Hovold + +[ Upstream commit e359b4411c2836cf87c8776682d1b594635570de ] + +When DMA is enabled the receive handler runs in a threaded handler, but +the primary handler up until very recently neither disabled interrupts +in the device or used IRQF_ONESHOT. This would lead to a deadlock if an +interrupt comes in while the threaded receive handler is running under +the port lock. + +Commit ad7676812437 ("serial: stm32: fix a deadlock condition with +wakeup event") claimed to fix an unrelated deadlock, but unfortunately +also disabled interrupts in the threaded handler. While this prevents +the deadlock mentioned in the previous paragraph it also defeats the +purpose of using a threaded handler in the first place. + +Fix this by making the interrupt one-shot and not disabling interrupts +in the threaded handler. + +Note that (receive) DMA must not be used for a console port as the +threaded handler could be interrupted while holding the port lock, +something which could lead to a deadlock in case an interrupt handler +ends up calling printk. + +Fixes: ad7676812437 ("serial: stm32: fix a deadlock condition with wakeup event") +Fixes: 3489187204eb ("serial: stm32: adding dma support") +Cc: stable@vger.kernel.org # 4.9 +Cc: Alexandre TORGUE +Cc: Gerald Baeza +Reviewed-by: Valentin Caron +Signed-off-by: Johan Hovold +Link: https://lore.kernel.org/r/20210416140557.25177-3-johan@kernel.org +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Sasha Levin +--- + drivers/tty/serial/stm32-usart.c | 22 ++++++++++++---------- + 1 file changed, 12 insertions(+), 10 deletions(-) + +diff --git a/drivers/tty/serial/stm32-usart.c b/drivers/tty/serial/stm32-usart.c +index 2cf9fc915510..844059861f9e 100644 +--- a/drivers/tty/serial/stm32-usart.c ++++ b/drivers/tty/serial/stm32-usart.c +@@ -213,14 +213,11 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) + struct tty_port *tport = &port->state->port; + struct stm32_port *stm32_port = to_stm32_port(port); + const struct stm32_usart_offsets *ofs = &stm32_port->info->ofs; +- unsigned long c, flags; ++ unsigned long c; + u32 sr; + char flag; + +- if (threaded) +- spin_lock_irqsave(&port->lock, flags); +- else +- spin_lock(&port->lock); ++ spin_lock(&port->lock); + + while (stm32_usart_pending_rx(port, &sr, &stm32_port->last_res, + threaded)) { +@@ -277,10 +274,7 @@ static void stm32_usart_receive_chars(struct uart_port *port, bool threaded) + uart_insert_char(port, sr, USART_SR_ORE, c, flag); + } + +- if (threaded) +- spin_unlock_irqrestore(&port->lock, flags); +- else +- spin_unlock(&port->lock); ++ spin_unlock(&port->lock); + + tty_flip_buffer_push(tport); + } +@@ -653,7 +647,8 @@ static int stm32_usart_startup(struct uart_port *port) + + ret = request_threaded_irq(port->irq, stm32_usart_interrupt, + stm32_usart_threaded_interrupt, +- IRQF_NO_SUSPEND, name, port); ++ IRQF_ONESHOT | IRQF_NO_SUSPEND, ++ name, port); + if (ret) + return ret; + +@@ -1126,6 +1121,13 @@ static int stm32_usart_of_dma_rx_probe(struct stm32_port *stm32port, + struct dma_async_tx_descriptor *desc = NULL; + int ret; + ++ /* ++ * Using DMA and threaded handler for the console could lead to ++ * deadlocks. ++ */ ++ if (uart_console(port)) ++ return -ENODEV; ++ + /* Request DMA RX channel */ + stm32port->rx_ch = dma_request_slave_channel(dev, "rx"); + if (!stm32port->rx_ch) { +-- +2.30.2 + diff --git a/queue-5.10/series b/queue-5.10/series index 328deebe236..9c6452c5f54 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -66,3 +66,12 @@ arm-dts-imx7d-meerkat96-fix-the-tuning-step-property.patch arm-dts-imx7d-pico-fix-the-tuning-step-property.patch arm-dts-imx-emcon-avari-fix-nxp-pca8574-gpio-cells.patch bus-ti-sysc-fix-flakey-idling-of-uarts-and-stop-usin.patch +tipc-add-extack-messages-for-bearer-media-failure.patch +tipc-fix-unique-bearer-names-sanity-check.patch +serial-stm32-fix-threaded-interrupt-handling.patch +riscv-vdso-fix-and-clean-up-makefile.patch +io_uring-fix-link-timeout-refs.patch +io_uring-use-better-types-for-cflags.patch +drm-amdgpu-vcn3-add-cancel_delayed_work_sync-before-.patch +drm-amdgpu-jpeg2.5-add-cancel_delayed_work_sync-befo.patch +drm-amdgpu-jpeg3-add-cancel_delayed_work_sync-before.patch diff --git a/queue-5.10/tipc-add-extack-messages-for-bearer-media-failure.patch b/queue-5.10/tipc-add-extack-messages-for-bearer-media-failure.patch new file mode 100644 index 00000000000..265c83e5412 --- /dev/null +++ b/queue-5.10/tipc-add-extack-messages-for-bearer-media-failure.patch @@ -0,0 +1,211 @@ +From 1a16342ed867acf0bd281d3ad77080e645b7b35a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 25 Mar 2021 08:56:41 +0700 +Subject: tipc: add extack messages for bearer/media failure + +From: Hoang Le + +[ Upstream commit b83e214b2e04204f1fc674574362061492c37245 ] + +Add extack error messages for -EINVAL errors when enabling bearer, +getting/setting properties for a media/bearer + +Acked-by: Jon Maloy +Signed-off-by: Hoang Le +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/bearer.c | 50 +++++++++++++++++++++++++++++++++++++---------- + 1 file changed, 40 insertions(+), 10 deletions(-) + +diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c +index 650414110452..4d0e11623e5c 100644 +--- a/net/tipc/bearer.c ++++ b/net/tipc/bearer.c +@@ -234,7 +234,8 @@ void tipc_bearer_remove_dest(struct net *net, u32 bearer_id, u32 dest) + */ + static int tipc_enable_bearer(struct net *net, const char *name, + u32 disc_domain, u32 prio, +- struct nlattr *attr[]) ++ struct nlattr *attr[], ++ struct netlink_ext_ack *extack) + { + struct tipc_net *tn = tipc_net(net); + struct tipc_bearer_names b_names; +@@ -248,17 +249,20 @@ static int tipc_enable_bearer(struct net *net, const char *name, + + if (!bearer_name_validate(name, &b_names)) { + errstr = "illegal name"; ++ NL_SET_ERR_MSG(extack, "Illegal name"); + goto rejected; + } + + if (prio > TIPC_MAX_LINK_PRI && prio != TIPC_MEDIA_LINK_PRI) { + errstr = "illegal priority"; ++ NL_SET_ERR_MSG(extack, "Illegal priority"); + goto rejected; + } + + m = tipc_media_find(b_names.media_name); + if (!m) { + errstr = "media not registered"; ++ NL_SET_ERR_MSG(extack, "Media not registered"); + goto rejected; + } + +@@ -272,6 +276,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, + break; + if (!strcmp(name, b->name)) { + errstr = "already enabled"; ++ NL_SET_ERR_MSG(extack, "Already enabled"); + goto rejected; + } + bearer_id++; +@@ -283,6 +288,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, + name, prio); + if (prio == TIPC_MIN_LINK_PRI) { + errstr = "cannot adjust to lower"; ++ NL_SET_ERR_MSG(extack, "Cannot adjust to lower"); + goto rejected; + } + pr_warn("Bearer <%s>: trying with adjusted priority\n", name); +@@ -293,6 +299,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, + + if (bearer_id >= MAX_BEARERS) { + errstr = "max 3 bearers permitted"; ++ NL_SET_ERR_MSG(extack, "Max 3 bearers permitted"); + goto rejected; + } + +@@ -306,6 +313,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, + if (res) { + kfree(b); + errstr = "failed to enable media"; ++ NL_SET_ERR_MSG(extack, "Failed to enable media"); + goto rejected; + } + +@@ -322,6 +330,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, + if (res) { + bearer_disable(net, b); + errstr = "failed to create discoverer"; ++ NL_SET_ERR_MSG(extack, "Failed to create discoverer"); + goto rejected; + } + +@@ -894,6 +903,7 @@ int tipc_nl_bearer_get(struct sk_buff *skb, struct genl_info *info) + bearer = tipc_bearer_find(net, name); + if (!bearer) { + err = -EINVAL; ++ NL_SET_ERR_MSG(info->extack, "Bearer not found"); + goto err_out; + } + +@@ -933,8 +943,10 @@ int __tipc_nl_bearer_disable(struct sk_buff *skb, struct genl_info *info) + name = nla_data(attrs[TIPC_NLA_BEARER_NAME]); + + bearer = tipc_bearer_find(net, name); +- if (!bearer) ++ if (!bearer) { ++ NL_SET_ERR_MSG(info->extack, "Bearer not found"); + return -EINVAL; ++ } + + bearer_disable(net, bearer); + +@@ -992,7 +1004,8 @@ int __tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info) + prio = nla_get_u32(props[TIPC_NLA_PROP_PRIO]); + } + +- return tipc_enable_bearer(net, bearer, domain, prio, attrs); ++ return tipc_enable_bearer(net, bearer, domain, prio, attrs, ++ info->extack); + } + + int tipc_nl_bearer_enable(struct sk_buff *skb, struct genl_info *info) +@@ -1031,6 +1044,7 @@ int tipc_nl_bearer_add(struct sk_buff *skb, struct genl_info *info) + b = tipc_bearer_find(net, name); + if (!b) { + rtnl_unlock(); ++ NL_SET_ERR_MSG(info->extack, "Bearer not found"); + return -EINVAL; + } + +@@ -1071,8 +1085,10 @@ int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info) + name = nla_data(attrs[TIPC_NLA_BEARER_NAME]); + + b = tipc_bearer_find(net, name); +- if (!b) ++ if (!b) { ++ NL_SET_ERR_MSG(info->extack, "Bearer not found"); + return -EINVAL; ++ } + + if (attrs[TIPC_NLA_BEARER_PROP]) { + struct nlattr *props[TIPC_NLA_PROP_MAX + 1]; +@@ -1091,12 +1107,18 @@ int __tipc_nl_bearer_set(struct sk_buff *skb, struct genl_info *info) + if (props[TIPC_NLA_PROP_WIN]) + b->max_win = nla_get_u32(props[TIPC_NLA_PROP_WIN]); + if (props[TIPC_NLA_PROP_MTU]) { +- if (b->media->type_id != TIPC_MEDIA_TYPE_UDP) ++ if (b->media->type_id != TIPC_MEDIA_TYPE_UDP) { ++ NL_SET_ERR_MSG(info->extack, ++ "MTU property is unsupported"); + return -EINVAL; ++ } + #ifdef CONFIG_TIPC_MEDIA_UDP + if (tipc_udp_mtu_bad(nla_get_u32 +- (props[TIPC_NLA_PROP_MTU]))) ++ (props[TIPC_NLA_PROP_MTU]))) { ++ NL_SET_ERR_MSG(info->extack, ++ "MTU value is out-of-range"); + return -EINVAL; ++ } + b->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]); + tipc_node_apply_property(net, b, TIPC_NLA_PROP_MTU); + #endif +@@ -1224,6 +1246,7 @@ int tipc_nl_media_get(struct sk_buff *skb, struct genl_info *info) + rtnl_lock(); + media = tipc_media_find(name); + if (!media) { ++ NL_SET_ERR_MSG(info->extack, "Media not found"); + err = -EINVAL; + goto err_out; + } +@@ -1260,9 +1283,10 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info) + name = nla_data(attrs[TIPC_NLA_MEDIA_NAME]); + + m = tipc_media_find(name); +- if (!m) ++ if (!m) { ++ NL_SET_ERR_MSG(info->extack, "Media not found"); + return -EINVAL; +- ++ } + if (attrs[TIPC_NLA_MEDIA_PROP]) { + struct nlattr *props[TIPC_NLA_PROP_MAX + 1]; + +@@ -1278,12 +1302,18 @@ int __tipc_nl_media_set(struct sk_buff *skb, struct genl_info *info) + if (props[TIPC_NLA_PROP_WIN]) + m->max_win = nla_get_u32(props[TIPC_NLA_PROP_WIN]); + if (props[TIPC_NLA_PROP_MTU]) { +- if (m->type_id != TIPC_MEDIA_TYPE_UDP) ++ if (m->type_id != TIPC_MEDIA_TYPE_UDP) { ++ NL_SET_ERR_MSG(info->extack, ++ "MTU property is unsupported"); + return -EINVAL; ++ } + #ifdef CONFIG_TIPC_MEDIA_UDP + if (tipc_udp_mtu_bad(nla_get_u32 +- (props[TIPC_NLA_PROP_MTU]))) ++ (props[TIPC_NLA_PROP_MTU]))) { ++ NL_SET_ERR_MSG(info->extack, ++ "MTU value is out-of-range"); + return -EINVAL; ++ } + m->mtu = nla_get_u32(props[TIPC_NLA_PROP_MTU]); + #endif + } +-- +2.30.2 + diff --git a/queue-5.10/tipc-fix-unique-bearer-names-sanity-check.patch b/queue-5.10/tipc-fix-unique-bearer-names-sanity-check.patch new file mode 100644 index 00000000000..1496a41b20e --- /dev/null +++ b/queue-5.10/tipc-fix-unique-bearer-names-sanity-check.patch @@ -0,0 +1,99 @@ +From e6bc25f6c3302c20f9fa8e983fa808c0aaa88285 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 1 Apr 2021 09:30:48 +0700 +Subject: tipc: fix unique bearer names sanity check + +From: Hoang Le + +[ Upstream commit f20a46c3044c3f75232b3d0e2d09af9b25efaf45 ] + +When enabling a bearer by name, we don't sanity check its name with +higher slot in bearer list. This may have the effect that the name +of an already enabled bearer bypasses the check. + +To fix the above issue, we just perform an extra checking with all +existing bearers. + +Fixes: cb30a63384bc9 ("tipc: refactor function tipc_enable_bearer()") +Cc: stable@vger.kernel.org +Acked-by: Jon Maloy +Signed-off-by: Hoang Le +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/tipc/bearer.c | 46 +++++++++++++++++++++++++++------------------- + 1 file changed, 27 insertions(+), 19 deletions(-) + +diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c +index 4d0e11623e5c..12e535b43d88 100644 +--- a/net/tipc/bearer.c ++++ b/net/tipc/bearer.c +@@ -246,6 +246,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, + int bearer_id = 0; + int res = -EINVAL; + char *errstr = ""; ++ u32 i; + + if (!bearer_name_validate(name, &b_names)) { + errstr = "illegal name"; +@@ -270,31 +271,38 @@ static int tipc_enable_bearer(struct net *net, const char *name, + prio = m->priority; + + /* Check new bearer vs existing ones and find free bearer id if any */ +- while (bearer_id < MAX_BEARERS) { +- b = rtnl_dereference(tn->bearer_list[bearer_id]); +- if (!b) +- break; ++ bearer_id = MAX_BEARERS; ++ i = MAX_BEARERS; ++ while (i-- != 0) { ++ b = rtnl_dereference(tn->bearer_list[i]); ++ if (!b) { ++ bearer_id = i; ++ continue; ++ } + if (!strcmp(name, b->name)) { + errstr = "already enabled"; + NL_SET_ERR_MSG(extack, "Already enabled"); + goto rejected; + } +- bearer_id++; +- if (b->priority != prio) +- continue; +- if (++with_this_prio <= 2) +- continue; +- pr_warn("Bearer <%s>: already 2 bearers with priority %u\n", +- name, prio); +- if (prio == TIPC_MIN_LINK_PRI) { +- errstr = "cannot adjust to lower"; +- NL_SET_ERR_MSG(extack, "Cannot adjust to lower"); +- goto rejected; ++ ++ if (b->priority == prio && ++ (++with_this_prio > 2)) { ++ pr_warn("Bearer <%s>: already 2 bearers with priority %u\n", ++ name, prio); ++ ++ if (prio == TIPC_MIN_LINK_PRI) { ++ errstr = "cannot adjust to lower"; ++ NL_SET_ERR_MSG(extack, "Cannot adjust to lower"); ++ goto rejected; ++ } ++ ++ pr_warn("Bearer <%s>: trying with adjusted priority\n", ++ name); ++ prio--; ++ bearer_id = MAX_BEARERS; ++ i = MAX_BEARERS; ++ with_this_prio = 1; + } +- pr_warn("Bearer <%s>: trying with adjusted priority\n", name); +- prio--; +- bearer_id = 0; +- with_this_prio = 1; + } + + if (bearer_id >= MAX_BEARERS) { +-- +2.30.2 + -- 2.47.3