From 96a2b35c972962004a7f96dda0799f1977c4ec86 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sun, 30 Jul 2023 09:27:51 -0400 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...-value-check-in-be_lancer_xmit_worka.patch | 38 ++++ ...nd-s-flags-when-down-link-is-p2p-dev.patch | 61 ++++++ ...-fix-return-value-check-in-atl1e_tso.patch | 44 +++++ ...-vs-is_err-bug-for-debugfs_create_di.patch | 40 ++++ ...ory-management-in-ice_ethtool_fdir.c.patch | 103 +++++++++++ ...x-bug-where-deleting-a-mngtmpaddr-ca.patch | 96 ++++++++++ ...a-staging-atomisp-select-v4l2_fwnode.patch | 37 ++++ ...wrong-bw-weight-of-disabled-tc-issue.patch | 98 ++++++++++ ...onstruct-function-hclge_ets_validate.patch | 97 ++++++++++ ...-phy-marvell10g-fix-88x3310-power-up.patch | 45 +++++ ...io-add-extack-to-mqprio_parse_nlattr.patch | 110 +++++++++++ ...-add-length-check-for-tca_mqprio_-ma.patch | 63 +++++++ ...-refactor-nlattr-parsing-to-a-separa.patch | 165 +++++++++++++++++ ...les-disallow-rule-addition-to-bound-.patch | 53 ++++++ ...les-skip-immediate-deactivate-in-_pr.patch | 89 +++++++++ ...t_rbtree-fix-overlap-expiration-walk.patch | 88 +++++++++ ...es-add-helper-function-to-validate-s.patch | 56 ++++++ ...x-an-out-of-bounds-check-in-hisi_inn.patch | 44 +++++ ...rrect-struct-qcom_snps_hsphy-kerneld.patch | 43 +++++ ...mto-v2-keep-cfg_ahb_clk-enabled-duri.patch | 96 ++++++++++ ...s-femto-v2-properly-enable-ref-clock.patch | 173 ++++++++++++++++++ ...s-use-dev_err_probe-to-simplify-code.patch | 64 +++++++ ...-laptop-fix-rfkill-out-of-sync-on-ms.patch | 79 ++++++++ queue-5.10/series | 29 +++ ...chance-of-collisions-in-inet6_hashfn.patch | 75 ++++++++ ...s-flags-when-down-link-is-p2p-device.patch | 52 ++++++ ...tipc-check-return-value-of-pskb_trim.patch | 39 ++++ ...rypto-on-failure-in-tipc_node_create.patch | 46 +++++ ...culate-correct-header-length-for-gpe.patch | 164 +++++++++++++++++ .../vxlan-move-to-its-own-directory.patch | 58 ++++++ 30 files changed, 2245 insertions(+) create mode 100644 queue-5.10/benet-fix-return-value-check-in-be_lancer_xmit_worka.patch create mode 100644 queue-5.10/bonding-reset-bond-s-flags-when-down-link-is-p2p-dev.patch create mode 100644 queue-5.10/ethernet-atheros-fix-return-value-check-in-atl1e_tso.patch create mode 100644 queue-5.10/i40e-fix-an-null-vs-is_err-bug-for-debugfs_create_di.patch create mode 100644 queue-5.10/ice-fix-memory-management-in-ice_ethtool_fdir.c.patch create mode 100644 queue-5.10/ipv6-addrconf-fix-bug-where-deleting-a-mngtmpaddr-ca.patch create mode 100644 queue-5.10/media-staging-atomisp-select-v4l2_fwnode.patch create mode 100644 queue-5.10/net-hns3-fix-wrong-bw-weight-of-disabled-tc-issue.patch create mode 100644 queue-5.10/net-hns3-reconstruct-function-hclge_ets_validate.patch create mode 100644 queue-5.10/net-phy-marvell10g-fix-88x3310-power-up.patch create mode 100644 queue-5.10/net-sched-mqprio-add-extack-to-mqprio_parse_nlattr.patch create mode 100644 queue-5.10/net-sched-mqprio-add-length-check-for-tca_mqprio_-ma.patch create mode 100644 queue-5.10/net-sched-mqprio-refactor-nlattr-parsing-to-a-separa.patch create mode 100644 queue-5.10/netfilter-nf_tables-disallow-rule-addition-to-bound-.patch create mode 100644 queue-5.10/netfilter-nf_tables-skip-immediate-deactivate-in-_pr.patch create mode 100644 queue-5.10/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch create mode 100644 queue-5.10/netfilter-nftables-add-helper-function-to-validate-s.patch create mode 100644 queue-5.10/phy-hisilicon-fix-an-out-of-bounds-check-in-hisi_inn.patch create mode 100644 queue-5.10/phy-qcom-snps-correct-struct-qcom_snps_hsphy-kerneld.patch create mode 100644 queue-5.10/phy-qcom-snps-femto-v2-keep-cfg_ahb_clk-enabled-duri.patch create mode 100644 queue-5.10/phy-qcom-snps-femto-v2-properly-enable-ref-clock.patch create mode 100644 queue-5.10/phy-qcom-snps-use-dev_err_probe-to-simplify-code.patch create mode 100644 queue-5.10/platform-x86-msi-laptop-fix-rfkill-out-of-sync-on-ms.patch create mode 100644 queue-5.10/tcp-reduce-chance-of-collisions-in-inet6_hashfn.patch create mode 100644 queue-5.10/team-reset-team-s-flags-when-down-link-is-p2p-device.patch create mode 100644 queue-5.10/tipc-check-return-value-of-pskb_trim.patch create mode 100644 queue-5.10/tipc-stop-tipc-crypto-on-failure-in-tipc_node_create.patch create mode 100644 queue-5.10/vxlan-calculate-correct-header-length-for-gpe.patch create mode 100644 queue-5.10/vxlan-move-to-its-own-directory.patch diff --git a/queue-5.10/benet-fix-return-value-check-in-be_lancer_xmit_worka.patch b/queue-5.10/benet-fix-return-value-check-in-be_lancer_xmit_worka.patch new file mode 100644 index 00000000000..37f6f744a79 --- /dev/null +++ b/queue-5.10/benet-fix-return-value-check-in-be_lancer_xmit_worka.patch @@ -0,0 +1,38 @@ +From c5b32a8db9798e32923b5e3463b9a3e8d6386951 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 11:27:26 +0800 +Subject: benet: fix return value check in be_lancer_xmit_workarounds() + +From: Yuanjun Gong + +[ Upstream commit 5c85f7065718a949902b238a6abd8fc907c5d3e0 ] + +in be_lancer_xmit_workarounds(), it should go to label 'tx_drop' +if an unexpected value is returned by pskb_trim(). + +Fixes: 93040ae5cc8d ("be2net: Fix to trim skb for padded vlan packets to workaround an ASIC Bug") +Signed-off-by: Yuanjun Gong +Link: https://lore.kernel.org/r/20230725032726.15002-1-ruc_gongyuanjun@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/emulex/benet/be_main.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index 81be560a26431..52b399aa3213d 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -1139,7 +1139,8 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter, + (lancer_chip(adapter) || BE3_chip(adapter) || + skb_vlan_tag_present(skb)) && is_ipv4_pkt(skb)) { + ip = (struct iphdr *)ip_hdr(skb); +- pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len)); ++ if (unlikely(pskb_trim(skb, eth_hdr_len + ntohs(ip->tot_len)))) ++ goto tx_drop; + } + + /* If vlan tag is already inlined in the packet, skip HW VLAN +-- +2.39.2 + diff --git a/queue-5.10/bonding-reset-bond-s-flags-when-down-link-is-p2p-dev.patch b/queue-5.10/bonding-reset-bond-s-flags-when-down-link-is-p2p-dev.patch new file mode 100644 index 00000000000..04b6992d535 --- /dev/null +++ b/queue-5.10/bonding-reset-bond-s-flags-when-down-link-is-p2p-dev.patch @@ -0,0 +1,61 @@ +From 5d086b88e489b8b5049f5269ef8a85adf8336ee8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 12:03:55 +0800 +Subject: bonding: reset bond's flags when down link is P2P device + +From: Hangbin Liu + +[ Upstream commit da19a2b967cf1e2c426f50d28550d1915214a81d ] + +When adding a point to point downlink to the bond, we neglected to reset +the bond's flags, which were still using flags like BROADCAST and +MULTICAST. Consequently, this would initiate ARP/DAD for P2P downlink +interfaces, such as when adding a GRE device to the bonding. + +To address this issue, let's reset the bond's flags for P2P interfaces. + +Before fix: +7: gre0@NONE: mtu 1500 qdisc noqueue master bond0 state UNKNOWN group default qlen 1000 + link/gre6 2006:70:10::1 peer 2006:70:10::2 permaddr 167f:18:f188:: +8: bond0: mtu 1500 qdisc noqueue state UP group default qlen 1000 + link/gre6 2006:70:10::1 brd 2006:70:10::2 + inet6 fe80::200:ff:fe00:0/64 scope link + valid_lft forever preferred_lft forever + +After fix: +7: gre0@NONE: mtu 1500 qdisc noqueue master bond2 state UNKNOWN group default qlen 1000 + link/gre6 2006:70:10::1 peer 2006:70:10::2 permaddr c29e:557a:e9d9:: +8: bond0: mtu 1500 qdisc noqueue state UP group default qlen 1000 + link/gre6 2006:70:10::1 peer 2006:70:10::2 + inet6 fe80::1/64 scope link + valid_lft forever preferred_lft forever + +Reported-by: Liang Li +Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2221438 +Fixes: 872254dd6b1f ("net/bonding: Enable bonding to enslave non ARPHRD_ETHER") +Signed-off-by: Hangbin Liu +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/bonding/bond_main.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index 381e6cdd603a1..a260740269e9f 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1442,6 +1442,11 @@ static void bond_setup_by_slave(struct net_device *bond_dev, + + memcpy(bond_dev->broadcast, slave_dev->broadcast, + slave_dev->addr_len); ++ ++ if (slave_dev->flags & IFF_POINTOPOINT) { ++ bond_dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST); ++ bond_dev->flags |= (IFF_POINTOPOINT | IFF_NOARP); ++ } + } + + /* On bonding slaves other than the currently active slave, suppress +-- +2.39.2 + diff --git a/queue-5.10/ethernet-atheros-fix-return-value-check-in-atl1e_tso.patch b/queue-5.10/ethernet-atheros-fix-return-value-check-in-atl1e_tso.patch new file mode 100644 index 00000000000..e62dceab308 --- /dev/null +++ b/queue-5.10/ethernet-atheros-fix-return-value-check-in-atl1e_tso.patch @@ -0,0 +1,44 @@ +From 87d60698100e9938b4de1149dae273009f61261e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 22:42:19 +0800 +Subject: ethernet: atheros: fix return value check in atl1e_tso_csum() + +From: Yuanjun Gong + +[ Upstream commit 69a184f7a372aac588babfb0bd681aaed9779f5b ] + +in atl1e_tso_csum, it should check the return value of pskb_trim(), +and return an error code if an unexpected value is returned +by pskb_trim(). + +Fixes: a6a5325239c2 ("atl1e: Atheros L1E Gigabit Ethernet driver") +Signed-off-by: Yuanjun Gong +Reviewed-by: Simon Horman +Link: https://lore.kernel.org/r/20230720144219.39285-1-ruc_gongyuanjun@163.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/atheros/atl1e/atl1e_main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +index ff9f96de74b81..696ce3c5a8ba3 100644 +--- a/drivers/net/ethernet/atheros/atl1e/atl1e_main.c ++++ b/drivers/net/ethernet/atheros/atl1e/atl1e_main.c +@@ -1642,8 +1642,11 @@ static int atl1e_tso_csum(struct atl1e_adapter *adapter, + real_len = (((unsigned char *)ip_hdr(skb) - skb->data) + + ntohs(ip_hdr(skb)->tot_len)); + +- if (real_len < skb->len) +- pskb_trim(skb, real_len); ++ if (real_len < skb->len) { ++ err = pskb_trim(skb, real_len); ++ if (err) ++ return err; ++ } + + hdr_len = (skb_transport_offset(skb) + tcp_hdrlen(skb)); + if (unlikely(skb->len == hdr_len)) { +-- +2.39.2 + diff --git a/queue-5.10/i40e-fix-an-null-vs-is_err-bug-for-debugfs_create_di.patch b/queue-5.10/i40e-fix-an-null-vs-is_err-bug-for-debugfs_create_di.patch new file mode 100644 index 00000000000..e728e2a02fb --- /dev/null +++ b/queue-5.10/i40e-fix-an-null-vs-is_err-bug-for-debugfs_create_di.patch @@ -0,0 +1,40 @@ +From d6c0bd8c32a955266e88aa5a4ba54e4d497c2f11 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 13 Jul 2023 09:42:39 +0800 +Subject: i40e: Fix an NULL vs IS_ERR() bug for debugfs_create_dir() + +From: Wang Ming + +[ Upstream commit 043b1f185fb0f3939b7427f634787706f45411c4 ] + +The debugfs_create_dir() function returns error pointers. +It never returns NULL. Most incorrect error checks were fixed, +but the one in i40e_dbg_init() was forgotten. + +Fix the remaining error check. + +Fixes: 02e9c290814c ("i40e: debugfs interface") +Signed-off-by: Wang Ming +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/i40e/i40e_debugfs.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +index 989d5c7263d7c..8bcf5902babf7 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_debugfs.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_debugfs.c +@@ -1839,7 +1839,7 @@ void i40e_dbg_pf_exit(struct i40e_pf *pf) + void i40e_dbg_init(void) + { + i40e_dbg_root = debugfs_create_dir(i40e_driver_name, NULL); +- if (!i40e_dbg_root) ++ if (IS_ERR(i40e_dbg_root)) + pr_info("init of debugfs failed\n"); + } + +-- +2.39.2 + diff --git a/queue-5.10/ice-fix-memory-management-in-ice_ethtool_fdir.c.patch b/queue-5.10/ice-fix-memory-management-in-ice_ethtool_fdir.c.patch new file mode 100644 index 00000000000..9b5d07966a6 --- /dev/null +++ b/queue-5.10/ice-fix-memory-management-in-ice_ethtool_fdir.c.patch @@ -0,0 +1,103 @@ +From d87e533e03767db24166ad7b50495f1425fab26d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 08:58:54 -0700 +Subject: ice: Fix memory management in ice_ethtool_fdir.c + +From: Jedrzej Jagielski + +[ Upstream commit a3336056504d780590ac6d6ac94fbba829994594 ] + +Fix ethtool FDIR logic to not use memory after its release. +In the ice_ethtool_fdir.c file there are 2 spots where code can +refer to pointers which may be missing. + +In the ice_cfg_fdir_xtrct_seq() function seg may be freed but +even then may be still used by memcpy(&tun_seg[1], seg, sizeof(*seg)). + +In the ice_add_fdir_ethtool() function struct ice_fdir_fltr *input +may first fail to be added via ice_fdir_update_list_entry() but then +may be deleted by ice_fdir_update_list_entry. + +Terminate in both cases when the returned value of the previous +operation is other than 0, free memory and don't use it anymore. + +Reported-by: Michal Schmidt +Link: https://bugzilla.redhat.com/show_bug.cgi?id=2208423 +Fixes: cac2a27cd9ab ("ice: Support IPv4 Flow Director filters") +Reviewed-by: Przemek Kitszel +Signed-off-by: Jedrzej Jagielski +Reviewed-by: Leon Romanovsky +Tested-by: Pucha Himasekhar Reddy (A Contingent worker at Intel) +Signed-off-by: Tony Nguyen +Link: https://lore.kernel.org/r/20230721155854.1292805-1-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + .../net/ethernet/intel/ice/ice_ethtool_fdir.c | 26 ++++++++++--------- + 1 file changed, 14 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c +index 192729546bbfc..a122a267ede53 100644 +--- a/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c ++++ b/drivers/net/ethernet/intel/ice/ice_ethtool_fdir.c +@@ -1135,16 +1135,21 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp, + ICE_FLOW_FLD_OFF_INVAL); + } + +- /* add filter for outer headers */ + fltr_idx = ice_ethtool_flow_to_fltr(fsp->flow_type & ~FLOW_EXT); ++ ++ assign_bit(fltr_idx, hw->fdir_perfect_fltr, perfect_filter); ++ ++ /* add filter for outer headers */ + ret = ice_fdir_set_hw_fltr_rule(pf, seg, fltr_idx, + ICE_FD_HW_SEG_NON_TUN); +- if (ret == -EEXIST) +- /* Rule already exists, free memory and continue */ +- devm_kfree(dev, seg); +- else if (ret) ++ if (ret == -EEXIST) { ++ /* Rule already exists, free memory and count as success */ ++ ret = 0; ++ goto err_exit; ++ } else if (ret) { + /* could not write filter, free memory */ + goto err_exit; ++ } + + /* make tunneled filter HW entries if possible */ + memcpy(&tun_seg[1], seg, sizeof(*seg)); +@@ -1159,18 +1164,13 @@ ice_cfg_fdir_xtrct_seq(struct ice_pf *pf, struct ethtool_rx_flow_spec *fsp, + devm_kfree(dev, tun_seg); + } + +- if (perfect_filter) +- set_bit(fltr_idx, hw->fdir_perfect_fltr); +- else +- clear_bit(fltr_idx, hw->fdir_perfect_fltr); +- + return ret; + + err_exit: + devm_kfree(dev, tun_seg); + devm_kfree(dev, seg); + +- return -EOPNOTSUPP; ++ return ret; + } + + /** +@@ -1680,7 +1680,9 @@ int ice_add_fdir_ethtool(struct ice_vsi *vsi, struct ethtool_rxnfc *cmd) + } + + /* input struct is added to the HW filter list */ +- ice_fdir_update_list_entry(pf, input, fsp->location); ++ ret = ice_fdir_update_list_entry(pf, input, fsp->location); ++ if (ret) ++ goto release_lock; + + ret = ice_fdir_write_all_fltr(pf, input, true); + if (ret) +-- +2.39.2 + diff --git a/queue-5.10/ipv6-addrconf-fix-bug-where-deleting-a-mngtmpaddr-ca.patch b/queue-5.10/ipv6-addrconf-fix-bug-where-deleting-a-mngtmpaddr-ca.patch new file mode 100644 index 00000000000..6632c8ad5a7 --- /dev/null +++ b/queue-5.10/ipv6-addrconf-fix-bug-where-deleting-a-mngtmpaddr-ca.patch @@ -0,0 +1,96 @@ +From 55bd7e2915259122eecff86bf72a780185e63a0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 09:00:22 -0700 +Subject: ipv6 addrconf: fix bug where deleting a mngtmpaddr can create a new + temporary address +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Żenczykowski + +[ Upstream commit 69172f0bcb6a09110c5d2a6d792627f5095a9018 ] + +currently on 6.4 net/main: + + # ip link add dummy1 type dummy + # echo 1 > /proc/sys/net/ipv6/conf/dummy1/use_tempaddr + # ip link set dummy1 up + # ip -6 addr add 2000::1/64 mngtmpaddr dev dummy1 + # ip -6 addr show dev dummy1 + + 11: dummy1: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 + inet6 2000::44f3:581c:8ca:3983/64 scope global temporary dynamic + valid_lft 604800sec preferred_lft 86172sec + inet6 2000::1/64 scope global mngtmpaddr + valid_lft forever preferred_lft forever + inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link + valid_lft forever preferred_lft forever + + # ip -6 addr del 2000::44f3:581c:8ca:3983/64 dev dummy1 + + (can wait a few seconds if you want to, the above delete isn't [directly] the problem) + + # ip -6 addr show dev dummy1 + + 11: dummy1: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 + inet6 2000::1/64 scope global mngtmpaddr + valid_lft forever preferred_lft forever + inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link + valid_lft forever preferred_lft forever + + # ip -6 addr del 2000::1/64 mngtmpaddr dev dummy1 + # ip -6 addr show dev dummy1 + + 11: dummy1: mtu 1500 qdisc noqueue state UNKNOWN group default qlen 1000 + inet6 2000::81c9:56b7:f51a:b98f/64 scope global temporary dynamic + valid_lft 604797sec preferred_lft 86169sec + inet6 fe80::e8a8:a6ff:fed5:56d4/64 scope link + valid_lft forever preferred_lft forever + +This patch prevents this new 'global temporary dynamic' address from being +created by the deletion of the related (same subnet prefix) 'mngtmpaddr' +(which is triggered by there already being no temporary addresses). + +Cc: Jiri Pirko +Fixes: 53bd67491537 ("ipv6 addrconf: introduce IFA_F_MANAGETEMPADDR to tell kernel to manage temporary addresses") +Reported-by: Xiao Ma +Signed-off-by: Maciej Żenczykowski +Reviewed-by: David Ahern +Link: https://lore.kernel.org/r/20230720160022.1887942-1-maze@google.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 14 ++++++++++---- + 1 file changed, 10 insertions(+), 4 deletions(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index d5d10496b4aef..9b414681500a5 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -2555,12 +2555,18 @@ static void manage_tempaddrs(struct inet6_dev *idev, + ipv6_ifa_notify(0, ift); + } + +- if ((create || list_empty(&idev->tempaddr_list)) && +- idev->cnf.use_tempaddr > 0) { ++ /* Also create a temporary address if it's enabled but no temporary ++ * address currently exists. ++ * However, we get called with valid_lft == 0, prefered_lft == 0, create == false ++ * as part of cleanup (ie. deleting the mngtmpaddr). ++ * We don't want that to result in creating a new temporary ip address. ++ */ ++ if (list_empty(&idev->tempaddr_list) && (valid_lft || prefered_lft)) ++ create = true; ++ ++ if (create && idev->cnf.use_tempaddr > 0) { + /* When a new public address is created as described + * in [ADDRCONF], also create a new temporary address. +- * Also create a temporary address if it's enabled but +- * no temporary address currently exists. + */ + read_unlock_bh(&idev->lock); + ipv6_create_tempaddr(ifp, false); +-- +2.39.2 + diff --git a/queue-5.10/media-staging-atomisp-select-v4l2_fwnode.patch b/queue-5.10/media-staging-atomisp-select-v4l2_fwnode.patch new file mode 100644 index 00000000000..cc67edac6f7 --- /dev/null +++ b/queue-5.10/media-staging-atomisp-select-v4l2_fwnode.patch @@ -0,0 +1,37 @@ +From c0ddab82e5cf1745de61d9e1e35fbcf596d8991f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 13 Jun 2023 18:47:53 +0200 +Subject: media: staging: atomisp: select V4L2_FWNODE + +From: Sakari Ailus + +[ Upstream commit bf4c985707d3168ebb7d87d15830de66949d979c ] + +Select V4L2_FWNODE as the driver depends on it. + +Reported-by: Andy Shevchenko +Fixes: aa31f6514047 ("media: atomisp: allow building the driver again") +Signed-off-by: Sakari Ailus +Tested-by: Andy Shevchenko +Reviewed-by: Hans de Goede +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/staging/media/atomisp/Kconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/staging/media/atomisp/Kconfig b/drivers/staging/media/atomisp/Kconfig +index 37577bb729980..1a0b958f1aa06 100644 +--- a/drivers/staging/media/atomisp/Kconfig ++++ b/drivers/staging/media/atomisp/Kconfig +@@ -13,6 +13,7 @@ config VIDEO_ATOMISP + tristate "Intel Atom Image Signal Processor Driver" + depends on VIDEO_V4L2 && INTEL_ATOMISP + depends on PMIC_OPREGION ++ select V4L2_FWNODE + select IOSF_MBI + select VIDEOBUF_VMALLOC + help +-- +2.39.2 + diff --git a/queue-5.10/net-hns3-fix-wrong-bw-weight-of-disabled-tc-issue.patch b/queue-5.10/net-hns3-fix-wrong-bw-weight-of-disabled-tc-issue.patch new file mode 100644 index 00000000000..1c55bfd2ea9 --- /dev/null +++ b/queue-5.10/net-hns3-fix-wrong-bw-weight-of-disabled-tc-issue.patch @@ -0,0 +1,98 @@ +From 02e8c5181d2eb68ea9bbaaf0ec0060a513152144 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 10:05:10 +0800 +Subject: net: hns3: fix wrong bw weight of disabled tc issue + +From: Jijie Shao + +[ Upstream commit 882481b1c55fc44861d7e2d54b4e0936b1b39f2c ] + +In dwrr mode, the default bandwidth weight of disabled tc is set to 0. +If the bandwidth weight is 0, the mode will change to sp. +Therefore, disabled tc default bandwidth weight need changed to 1, +and 0 is returned when query the bandwidth weight of disabled tc. +In addition, driver need stop configure bandwidth weight if tc is disabled. + +Fixes: 848440544b41 ("net: hns3: Add support of TX Scheduler & Shaper to HNS3 driver") +Signed-off-by: Jie Wang +Signed-off-by: Jijie Shao +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c | 17 ++++++++++++++--- + .../ethernet/hisilicon/hns3/hns3pf/hclge_tm.c | 3 ++- + 2 files changed, 16 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +index c75794552a1a7..d60b8dfe38727 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -53,7 +53,10 @@ static void hclge_tm_info_to_ieee_ets(struct hclge_dev *hdev, + + for (i = 0; i < HNAE3_MAX_TC; i++) { + ets->prio_tc[i] = hdev->tm_info.prio_tc[i]; +- ets->tc_tx_bw[i] = hdev->tm_info.pg_info[0].tc_dwrr[i]; ++ if (i < hdev->tm_info.num_tc) ++ ets->tc_tx_bw[i] = hdev->tm_info.pg_info[0].tc_dwrr[i]; ++ else ++ ets->tc_tx_bw[i] = 0; + + if (hdev->tm_info.tc_info[i].tc_sch_mode == + HCLGE_SCH_MODE_SP) +@@ -124,7 +127,8 @@ static u8 hclge_ets_tc_changed(struct hclge_dev *hdev, struct ieee_ets *ets, + } + + static int hclge_ets_sch_mode_validate(struct hclge_dev *hdev, +- struct ieee_ets *ets, bool *changed) ++ struct ieee_ets *ets, bool *changed, ++ u8 tc_num) + { + bool has_ets_tc = false; + u32 total_ets_bw = 0; +@@ -138,6 +142,13 @@ static int hclge_ets_sch_mode_validate(struct hclge_dev *hdev, + *changed = true; + break; + case IEEE_8021QAZ_TSA_ETS: ++ if (i >= tc_num) { ++ dev_err(&hdev->pdev->dev, ++ "tc%u is disabled, cannot set ets bw\n", ++ i); ++ return -EINVAL; ++ } ++ + /* The hardware will switch to sp mode if bandwidth is + * 0, so limit ets bandwidth must be greater than 0. + */ +@@ -177,7 +188,7 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets, + if (ret) + return ret; + +- ret = hclge_ets_sch_mode_validate(hdev, ets, changed); ++ ret = hclge_ets_sch_mode_validate(hdev, ets, changed, tc_num); + if (ret) + return ret; + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +index b3ceaaaeacaeb..8c5c5562c0a73 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_tm.c +@@ -651,6 +651,7 @@ static void hclge_tm_tc_info_init(struct hclge_dev *hdev) + static void hclge_tm_pg_info_init(struct hclge_dev *hdev) + { + #define BW_PERCENT 100 ++#define DEFAULT_BW_WEIGHT 1 + + u8 i; + +@@ -672,7 +673,7 @@ static void hclge_tm_pg_info_init(struct hclge_dev *hdev) + for (k = 0; k < hdev->tm_info.num_tc; k++) + hdev->tm_info.pg_info[i].tc_dwrr[k] = BW_PERCENT; + for (; k < HNAE3_MAX_TC; k++) +- hdev->tm_info.pg_info[i].tc_dwrr[k] = 0; ++ hdev->tm_info.pg_info[i].tc_dwrr[k] = DEFAULT_BW_WEIGHT; + } + } + +-- +2.39.2 + diff --git a/queue-5.10/net-hns3-reconstruct-function-hclge_ets_validate.patch b/queue-5.10/net-hns3-reconstruct-function-hclge_ets_validate.patch new file mode 100644 index 00000000000..7d2d8ef44be --- /dev/null +++ b/queue-5.10/net-hns3-reconstruct-function-hclge_ets_validate.patch @@ -0,0 +1,97 @@ +From 1ff9d68f5b92e7d47051082c001a2a43c4862509 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 30 Aug 2021 14:06:38 +0800 +Subject: net: hns3: reconstruct function hclge_ets_validate() + +From: Guangbin Huang + +[ Upstream commit 161ad669e6c23529415bffed5cb3bfa012e46cb4 ] + +This patch reconstructs function hclge_ets_validate() to reduce the code +cycle complexity and make code more concise. + +Signed-off-by: Guangbin Huang +Signed-off-by: David S. Miller +Stable-dep-of: 882481b1c55f ("net: hns3: fix wrong bw weight of disabled tc issue") +Signed-off-by: Sasha Levin +--- + .../hisilicon/hns3/hns3pf/hclge_dcb.c | 47 ++++++++++++++----- + 1 file changed, 35 insertions(+), 12 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +index 5bab885744fc8..c75794552a1a7 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3pf/hclge_dcb.c +@@ -105,26 +105,30 @@ static int hclge_dcb_common_validate(struct hclge_dev *hdev, u8 num_tc, + return 0; + } + +-static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets, +- u8 *tc, bool *changed) ++static u8 hclge_ets_tc_changed(struct hclge_dev *hdev, struct ieee_ets *ets, ++ bool *changed) + { +- bool has_ets_tc = false; +- u32 total_ets_bw = 0; +- u8 max_tc = 0; +- int ret; ++ u8 max_tc_id = 0; + u8 i; + + for (i = 0; i < HNAE3_MAX_USER_PRIO; i++) { + if (ets->prio_tc[i] != hdev->tm_info.prio_tc[i]) + *changed = true; + +- if (ets->prio_tc[i] > max_tc) +- max_tc = ets->prio_tc[i]; ++ if (ets->prio_tc[i] > max_tc_id) ++ max_tc_id = ets->prio_tc[i]; + } + +- ret = hclge_dcb_common_validate(hdev, max_tc + 1, ets->prio_tc); +- if (ret) +- return ret; ++ /* return max tc number, max tc id need to plus 1 */ ++ return max_tc_id + 1; ++} ++ ++static int hclge_ets_sch_mode_validate(struct hclge_dev *hdev, ++ struct ieee_ets *ets, bool *changed) ++{ ++ bool has_ets_tc = false; ++ u32 total_ets_bw = 0; ++ u8 i; + + for (i = 0; i < HNAE3_MAX_TC; i++) { + switch (ets->tc_tsa[i]) { +@@ -158,7 +162,26 @@ static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets, + if (has_ets_tc && total_ets_bw != BW_PERCENT) + return -EINVAL; + +- *tc = max_tc + 1; ++ return 0; ++} ++ ++static int hclge_ets_validate(struct hclge_dev *hdev, struct ieee_ets *ets, ++ u8 *tc, bool *changed) ++{ ++ u8 tc_num; ++ int ret; ++ ++ tc_num = hclge_ets_tc_changed(hdev, ets, changed); ++ ++ ret = hclge_dcb_common_validate(hdev, tc_num, ets->prio_tc); ++ if (ret) ++ return ret; ++ ++ ret = hclge_ets_sch_mode_validate(hdev, ets, changed); ++ if (ret) ++ return ret; ++ ++ *tc = tc_num; + if (*tc != hdev->tm_info.num_tc) + *changed = true; + +-- +2.39.2 + diff --git a/queue-5.10/net-phy-marvell10g-fix-88x3310-power-up.patch b/queue-5.10/net-phy-marvell10g-fix-88x3310-power-up.patch new file mode 100644 index 00000000000..14a53c35f41 --- /dev/null +++ b/queue-5.10/net-phy-marvell10g-fix-88x3310-power-up.patch @@ -0,0 +1,45 @@ +From 619c9956b88c968d91cdeb46ab9173b55c53d89c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 19 Jul 2023 17:22:33 +0800 +Subject: net: phy: marvell10g: fix 88x3310 power up + +From: Jiawen Wu + +[ Upstream commit c7b75bea853daeb64fc831dbf39a6bbabcc402ac ] + +Clear MV_V2_PORT_CTRL_PWRDOWN bit to set power up for 88x3310 PHY, +it sometimes does not take effect immediately. And a read of this +register causes the bit not to clear. This will cause mv3310_reset() +to time out, which will fail the config initialization. So add a delay +before the next access. + +Fixes: c9cc1c815d36 ("net: phy: marvell10g: place in powersave mode at probe") +Signed-off-by: Jiawen Wu +Reviewed-by: Russell King (Oracle) +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/phy/marvell10g.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/phy/marvell10g.c b/drivers/net/phy/marvell10g.c +index 2b64318efdba6..42b48d0d0c4ed 100644 +--- a/drivers/net/phy/marvell10g.c ++++ b/drivers/net/phy/marvell10g.c +@@ -263,6 +263,13 @@ static int mv3310_power_up(struct phy_device *phydev) + ret = phy_clear_bits_mmd(phydev, MDIO_MMD_VEND2, MV_V2_PORT_CTRL, + MV_V2_PORT_CTRL_PWRDOWN); + ++ /* Sometimes, the power down bit doesn't clear immediately, and ++ * a read of this register causes the bit not to clear. Delay ++ * 100us to allow the PHY to come out of power down mode before ++ * the next access. ++ */ ++ udelay(100); ++ + if (phydev->drv->phy_id != MARVELL_PHY_ID_88X3310 || + priv->firmware_ver < 0x00030000) + return ret; +-- +2.39.2 + diff --git a/queue-5.10/net-sched-mqprio-add-extack-to-mqprio_parse_nlattr.patch b/queue-5.10/net-sched-mqprio-add-extack-to-mqprio_parse_nlattr.patch new file mode 100644 index 00000000000..2ce6995d46b --- /dev/null +++ b/queue-5.10/net-sched-mqprio-add-extack-to-mqprio_parse_nlattr.patch @@ -0,0 +1,110 @@ +From 904bdc93ea0ead491cfedb7fad8b0c90b69d232e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 11 Apr 2023 21:01:51 +0300 +Subject: net/sched: mqprio: add extack to mqprio_parse_nlattr() + +From: Vladimir Oltean + +[ Upstream commit 57f21bf85400abadac0cb2a4db5de1d663f8863f ] + +Netlink attribute parsing in mqprio is a minesweeper game, with many +options having the possibility of being passed incorrectly and the user +being none the wiser. + +Try to make errors less sour by giving user space some information +regarding what went wrong. + +Signed-off-by: Vladimir Oltean +Reviewed-by: Ferenc Fejes +Reviewed-by: Simon Horman +Acked-by: Jamal Hadi Salim +Signed-off-by: Jakub Kicinski +Stable-dep-of: 6c58c8816abb ("net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64") +Signed-off-by: Sasha Levin +--- + net/sched/sch_mqprio.c | 30 +++++++++++++++++++++++------- + 1 file changed, 23 insertions(+), 7 deletions(-) + +diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c +index a5df5604e0150..4ec222a5530d1 100644 +--- a/net/sched/sch_mqprio.c ++++ b/net/sched/sch_mqprio.c +@@ -131,7 +131,8 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla, + } + + static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, +- struct nlattr *opt) ++ struct nlattr *opt, ++ struct netlink_ext_ack *extack) + { + struct mqprio_sched *priv = qdisc_priv(sch); + struct nlattr *tb[TCA_MQPRIO_MAX + 1]; +@@ -143,8 +144,11 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, + if (err < 0) + return err; + +- if (!qopt->hw) ++ if (!qopt->hw) { ++ NL_SET_ERR_MSG(extack, ++ "mqprio TCA_OPTIONS can only contain netlink attributes in hardware mode"); + return -EINVAL; ++ } + + if (tb[TCA_MQPRIO_MODE]) { + priv->flags |= TC_MQPRIO_F_MODE; +@@ -157,13 +161,19 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, + } + + if (tb[TCA_MQPRIO_MIN_RATE64]) { +- if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) ++ if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) { ++ NL_SET_ERR_MSG_ATTR(extack, tb[TCA_MQPRIO_MIN_RATE64], ++ "min_rate accepted only when shaper is in bw_rlimit mode"); + return -EINVAL; ++ } + i = 0; + nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64], + rem) { +- if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64) ++ if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64) { ++ NL_SET_ERR_MSG_ATTR(extack, attr, ++ "Attribute type expected to be TCA_MQPRIO_MIN_RATE64"); + return -EINVAL; ++ } + if (i >= qopt->num_tc) + break; + priv->min_rate[i] = *(u64 *)nla_data(attr); +@@ -173,13 +183,19 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, + } + + if (tb[TCA_MQPRIO_MAX_RATE64]) { +- if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) ++ if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) { ++ NL_SET_ERR_MSG_ATTR(extack, tb[TCA_MQPRIO_MAX_RATE64], ++ "max_rate accepted only when shaper is in bw_rlimit mode"); + return -EINVAL; ++ } + i = 0; + nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64], + rem) { +- if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64) ++ if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64) { ++ NL_SET_ERR_MSG_ATTR(extack, attr, ++ "Attribute type expected to be TCA_MQPRIO_MAX_RATE64"); + return -EINVAL; ++ } + if (i >= qopt->num_tc) + break; + priv->max_rate[i] = *(u64 *)nla_data(attr); +@@ -224,7 +240,7 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, + + len = nla_len(opt) - NLA_ALIGN(sizeof(*qopt)); + if (len > 0) { +- err = mqprio_parse_nlattr(sch, qopt, opt); ++ err = mqprio_parse_nlattr(sch, qopt, opt, extack); + if (err) + return err; + } +-- +2.39.2 + diff --git a/queue-5.10/net-sched-mqprio-add-length-check-for-tca_mqprio_-ma.patch b/queue-5.10/net-sched-mqprio-add-length-check-for-tca_mqprio_-ma.patch new file mode 100644 index 00000000000..4d98509eb50 --- /dev/null +++ b/queue-5.10/net-sched-mqprio-add-length-check-for-tca_mqprio_-ma.patch @@ -0,0 +1,63 @@ +From d5a1167399905cc1ad910a101d2dcda6c75f9001 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 10:42:27 +0800 +Subject: net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64 + +From: Lin Ma + +[ Upstream commit 6c58c8816abb7b93b21fa3b1d0c1726402e5e568 ] + +The nla_for_each_nested parsing in function mqprio_parse_nlattr() does +not check the length of the nested attribute. This can lead to an +out-of-attribute read and allow a malformed nlattr (e.g., length 0) to +be viewed as 8 byte integer and passed to priv->max_rate/min_rate. + +This patch adds the check based on nla_len() when check the nla_type(), +which ensures that the length of these two attribute must equals +sizeof(u64). + +Fixes: 4e8b86c06269 ("mqprio: Introduce new hardware offload mode and shaper in mqprio") +Reviewed-by: Victor Nogueira +Signed-off-by: Lin Ma +Link: https://lore.kernel.org/r/20230725024227.426561-1-linma@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/sched/sch_mqprio.c | 14 ++++++++++++++ + 1 file changed, 14 insertions(+) + +diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c +index 4ec222a5530d1..56d3dc5e95c7c 100644 +--- a/net/sched/sch_mqprio.c ++++ b/net/sched/sch_mqprio.c +@@ -174,6 +174,13 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, + "Attribute type expected to be TCA_MQPRIO_MIN_RATE64"); + return -EINVAL; + } ++ ++ if (nla_len(attr) != sizeof(u64)) { ++ NL_SET_ERR_MSG_ATTR(extack, attr, ++ "Attribute TCA_MQPRIO_MIN_RATE64 expected to have 8 bytes length"); ++ return -EINVAL; ++ } ++ + if (i >= qopt->num_tc) + break; + priv->min_rate[i] = *(u64 *)nla_data(attr); +@@ -196,6 +203,13 @@ static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, + "Attribute type expected to be TCA_MQPRIO_MAX_RATE64"); + return -EINVAL; + } ++ ++ if (nla_len(attr) != sizeof(u64)) { ++ NL_SET_ERR_MSG_ATTR(extack, attr, ++ "Attribute TCA_MQPRIO_MAX_RATE64 expected to have 8 bytes length"); ++ return -EINVAL; ++ } ++ + if (i >= qopt->num_tc) + break; + priv->max_rate[i] = *(u64 *)nla_data(attr); +-- +2.39.2 + diff --git a/queue-5.10/net-sched-mqprio-refactor-nlattr-parsing-to-a-separa.patch b/queue-5.10/net-sched-mqprio-refactor-nlattr-parsing-to-a-separa.patch new file mode 100644 index 00000000000..fd32744504b --- /dev/null +++ b/queue-5.10/net-sched-mqprio-refactor-nlattr-parsing-to-a-separa.patch @@ -0,0 +1,165 @@ +From 19a5ce117b48356ffdea53451cf712f28a93123b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 4 Feb 2023 15:52:55 +0200 +Subject: net/sched: mqprio: refactor nlattr parsing to a separate function + +From: Vladimir Oltean + +[ Upstream commit feb2cf3dcfb930aec2ca65c66d1365543d5ba943 ] + +mqprio_init() is quite large and unwieldy to add more code to. +Split the netlink attribute parsing to a dedicated function. + +Signed-off-by: Vladimir Oltean +Reviewed-by: Jacob Keller +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Stable-dep-of: 6c58c8816abb ("net/sched: mqprio: Add length check for TCA_MQPRIO_{MAX/MIN}_RATE64") +Signed-off-by: Sasha Levin +--- + net/sched/sch_mqprio.c | 114 +++++++++++++++++++++++------------------ + 1 file changed, 63 insertions(+), 51 deletions(-) + +diff --git a/net/sched/sch_mqprio.c b/net/sched/sch_mqprio.c +index 50e15add6068f..a5df5604e0150 100644 +--- a/net/sched/sch_mqprio.c ++++ b/net/sched/sch_mqprio.c +@@ -130,6 +130,67 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla, + return 0; + } + ++static int mqprio_parse_nlattr(struct Qdisc *sch, struct tc_mqprio_qopt *qopt, ++ struct nlattr *opt) ++{ ++ struct mqprio_sched *priv = qdisc_priv(sch); ++ struct nlattr *tb[TCA_MQPRIO_MAX + 1]; ++ struct nlattr *attr; ++ int i, rem, err; ++ ++ err = parse_attr(tb, TCA_MQPRIO_MAX, opt, mqprio_policy, ++ sizeof(*qopt)); ++ if (err < 0) ++ return err; ++ ++ if (!qopt->hw) ++ return -EINVAL; ++ ++ if (tb[TCA_MQPRIO_MODE]) { ++ priv->flags |= TC_MQPRIO_F_MODE; ++ priv->mode = *(u16 *)nla_data(tb[TCA_MQPRIO_MODE]); ++ } ++ ++ if (tb[TCA_MQPRIO_SHAPER]) { ++ priv->flags |= TC_MQPRIO_F_SHAPER; ++ priv->shaper = *(u16 *)nla_data(tb[TCA_MQPRIO_SHAPER]); ++ } ++ ++ if (tb[TCA_MQPRIO_MIN_RATE64]) { ++ if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) ++ return -EINVAL; ++ i = 0; ++ nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64], ++ rem) { ++ if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64) ++ return -EINVAL; ++ if (i >= qopt->num_tc) ++ break; ++ priv->min_rate[i] = *(u64 *)nla_data(attr); ++ i++; ++ } ++ priv->flags |= TC_MQPRIO_F_MIN_RATE; ++ } ++ ++ if (tb[TCA_MQPRIO_MAX_RATE64]) { ++ if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) ++ return -EINVAL; ++ i = 0; ++ nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64], ++ rem) { ++ if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64) ++ return -EINVAL; ++ if (i >= qopt->num_tc) ++ break; ++ priv->max_rate[i] = *(u64 *)nla_data(attr); ++ i++; ++ } ++ priv->flags |= TC_MQPRIO_F_MAX_RATE; ++ } ++ ++ return 0; ++} ++ + static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, + struct netlink_ext_ack *extack) + { +@@ -139,9 +200,6 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, + struct Qdisc *qdisc; + int i, err = -EOPNOTSUPP; + struct tc_mqprio_qopt *qopt = NULL; +- struct nlattr *tb[TCA_MQPRIO_MAX + 1]; +- struct nlattr *attr; +- int rem; + int len; + + BUILD_BUG_ON(TC_MAX_QUEUE != TC_QOPT_MAX_QUEUE); +@@ -166,55 +224,9 @@ static int mqprio_init(struct Qdisc *sch, struct nlattr *opt, + + len = nla_len(opt) - NLA_ALIGN(sizeof(*qopt)); + if (len > 0) { +- err = parse_attr(tb, TCA_MQPRIO_MAX, opt, mqprio_policy, +- sizeof(*qopt)); +- if (err < 0) ++ err = mqprio_parse_nlattr(sch, qopt, opt); ++ if (err) + return err; +- +- if (!qopt->hw) +- return -EINVAL; +- +- if (tb[TCA_MQPRIO_MODE]) { +- priv->flags |= TC_MQPRIO_F_MODE; +- priv->mode = *(u16 *)nla_data(tb[TCA_MQPRIO_MODE]); +- } +- +- if (tb[TCA_MQPRIO_SHAPER]) { +- priv->flags |= TC_MQPRIO_F_SHAPER; +- priv->shaper = *(u16 *)nla_data(tb[TCA_MQPRIO_SHAPER]); +- } +- +- if (tb[TCA_MQPRIO_MIN_RATE64]) { +- if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) +- return -EINVAL; +- i = 0; +- nla_for_each_nested(attr, tb[TCA_MQPRIO_MIN_RATE64], +- rem) { +- if (nla_type(attr) != TCA_MQPRIO_MIN_RATE64) +- return -EINVAL; +- if (i >= qopt->num_tc) +- break; +- priv->min_rate[i] = *(u64 *)nla_data(attr); +- i++; +- } +- priv->flags |= TC_MQPRIO_F_MIN_RATE; +- } +- +- if (tb[TCA_MQPRIO_MAX_RATE64]) { +- if (priv->shaper != TC_MQPRIO_SHAPER_BW_RATE) +- return -EINVAL; +- i = 0; +- nla_for_each_nested(attr, tb[TCA_MQPRIO_MAX_RATE64], +- rem) { +- if (nla_type(attr) != TCA_MQPRIO_MAX_RATE64) +- return -EINVAL; +- if (i >= qopt->num_tc) +- break; +- priv->max_rate[i] = *(u64 *)nla_data(attr); +- i++; +- } +- priv->flags |= TC_MQPRIO_F_MAX_RATE; +- } + } + + /* pre-allocate qdisc, attachment can't fail */ +-- +2.39.2 + diff --git a/queue-5.10/netfilter-nf_tables-disallow-rule-addition-to-bound-.patch b/queue-5.10/netfilter-nf_tables-disallow-rule-addition-to-bound-.patch new file mode 100644 index 00000000000..b49a7815889 --- /dev/null +++ b/queue-5.10/netfilter-nf_tables-disallow-rule-addition-to-bound-.patch @@ -0,0 +1,53 @@ +From ae31564dba507e1d51f6346bf0e0c1c2ce703930 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 16:41:48 +0200 +Subject: netfilter: nf_tables: disallow rule addition to bound chain via + NFTA_RULE_CHAIN_ID + +From: Pablo Neira Ayuso + +[ Upstream commit 0ebc1064e4874d5987722a2ddbc18f94aa53b211 ] + +Bail out with EOPNOTSUPP when adding rule to bound chain via +NFTA_RULE_CHAIN_ID. The following warning splat is shown when +adding a rule to a deleted bound chain: + + WARNING: CPU: 2 PID: 13692 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] + CPU: 2 PID: 13692 Comm: chain-bound-rul Not tainted 6.1.39 #1 + RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] + +Fixes: d0e2c7de92c7 ("netfilter: nf_tables: add NFT_CHAIN_BINDING") +Reported-by: Kevin Rich +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 5ef9acba7c171..19653b8784bbc 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -3350,8 +3350,6 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, + NL_SET_BAD_ATTR(extack, nla[NFTA_RULE_CHAIN]); + return PTR_ERR(chain); + } +- if (nft_chain_is_bound(chain)) +- return -EOPNOTSUPP; + + } else if (nla[NFTA_RULE_CHAIN_ID]) { + chain = nft_chain_lookup_byid(net, table, nla[NFTA_RULE_CHAIN_ID], +@@ -3364,6 +3362,9 @@ static int nf_tables_newrule(struct net *net, struct sock *nlsk, + return -EINVAL; + } + ++ if (nft_chain_is_bound(chain)) ++ return -EOPNOTSUPP; ++ + if (nla[NFTA_RULE_HANDLE]) { + handle = be64_to_cpu(nla_get_be64(nla[NFTA_RULE_HANDLE])); + rule = __nft_rule_lookup(chain, handle); +-- +2.39.2 + diff --git a/queue-5.10/netfilter-nf_tables-skip-immediate-deactivate-in-_pr.patch b/queue-5.10/netfilter-nf_tables-skip-immediate-deactivate-in-_pr.patch new file mode 100644 index 00000000000..84c63985671 --- /dev/null +++ b/queue-5.10/netfilter-nf_tables-skip-immediate-deactivate-in-_pr.patch @@ -0,0 +1,89 @@ +From ef6588d688d374325d1f2db911189fc230e62c5a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 23 Jul 2023 16:24:46 +0200 +Subject: netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR + +From: Pablo Neira Ayuso + +[ Upstream commit 0a771f7b266b02d262900c75f1e175c7fe76fec2 ] + +On error when building the rule, the immediate expression unbinds the +chain, hence objects can be deactivated by the transaction records. + +Otherwise, it is possible to trigger the following warning: + + WARNING: CPU: 3 PID: 915 at net/netfilter/nf_tables_api.c:2013 nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] + CPU: 3 PID: 915 Comm: chain-bind-err- Not tainted 6.1.39 #1 + RIP: 0010:nf_tables_chain_destroy+0x1f7/0x210 [nf_tables] + +Fixes: 4bedf9eee016 ("netfilter: nf_tables: fix chain binding transaction logic") +Reported-by: Kevin Rich +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_immediate.c | 27 ++++++++++++++++++--------- + 1 file changed, 18 insertions(+), 9 deletions(-) + +diff --git a/net/netfilter/nft_immediate.c b/net/netfilter/nft_immediate.c +index 6b0efab4fad09..6bf1c852e8eaa 100644 +--- a/net/netfilter/nft_immediate.c ++++ b/net/netfilter/nft_immediate.c +@@ -125,15 +125,27 @@ static void nft_immediate_activate(const struct nft_ctx *ctx, + return nft_data_hold(&priv->data, nft_dreg_to_type(priv->dreg)); + } + ++static void nft_immediate_chain_deactivate(const struct nft_ctx *ctx, ++ struct nft_chain *chain, ++ enum nft_trans_phase phase) ++{ ++ struct nft_ctx chain_ctx; ++ struct nft_rule *rule; ++ ++ chain_ctx = *ctx; ++ chain_ctx.chain = chain; ++ ++ list_for_each_entry(rule, &chain->rules, list) ++ nft_rule_expr_deactivate(&chain_ctx, rule, phase); ++} ++ + static void nft_immediate_deactivate(const struct nft_ctx *ctx, + const struct nft_expr *expr, + enum nft_trans_phase phase) + { + const struct nft_immediate_expr *priv = nft_expr_priv(expr); + const struct nft_data *data = &priv->data; +- struct nft_ctx chain_ctx; + struct nft_chain *chain; +- struct nft_rule *rule; + + if (priv->dreg == NFT_REG_VERDICT) { + switch (data->verdict.code) { +@@ -143,20 +155,17 @@ static void nft_immediate_deactivate(const struct nft_ctx *ctx, + if (!nft_chain_binding(chain)) + break; + +- chain_ctx = *ctx; +- chain_ctx.chain = chain; +- +- list_for_each_entry(rule, &chain->rules, list) +- nft_rule_expr_deactivate(&chain_ctx, rule, phase); +- + switch (phase) { + case NFT_TRANS_PREPARE_ERROR: + nf_tables_unbind_chain(ctx, chain); +- fallthrough; ++ nft_deactivate_next(ctx->net, chain); ++ break; + case NFT_TRANS_PREPARE: ++ nft_immediate_chain_deactivate(ctx, chain, phase); + nft_deactivate_next(ctx->net, chain); + break; + default: ++ nft_immediate_chain_deactivate(ctx, chain, phase); + nft_chain_del(chain); + chain->bound = false; + chain->table->use--; +-- +2.39.2 + diff --git a/queue-5.10/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch b/queue-5.10/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch new file mode 100644 index 00000000000..d68889fa3a0 --- /dev/null +++ b/queue-5.10/netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch @@ -0,0 +1,88 @@ +From 49de9baeb7314eaf9205cd8676f8fb8d9340b675 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 21:30:05 +0200 +Subject: netfilter: nft_set_rbtree: fix overlap expiration walk + +From: Florian Westphal + +[ Upstream commit f718863aca469a109895cb855e6b81fff4827d71 ] + +The lazy gc on insert that should remove timed-out entries fails to release +the other half of the interval, if any. + +Can be reproduced with tests/shell/testcases/sets/0044interval_overlap_0 +in nftables.git and kmemleak enabled kernel. + +Second bug is the use of rbe_prev vs. prev pointer. +If rbe_prev() returns NULL after at least one iteration, rbe_prev points +to element that is not an end interval, hence it should not be removed. + +Lastly, check the genmask of the end interval if this is active in the +current generation. + +Fixes: c9e6978e2725 ("netfilter: nft_set_rbtree: Switch to node list walk for overlap detection") +Signed-off-by: Florian Westphal +Signed-off-by: Sasha Levin +--- + net/netfilter/nft_set_rbtree.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c +index 172b994790a06..eae760adae4d5 100644 +--- a/net/netfilter/nft_set_rbtree.c ++++ b/net/netfilter/nft_set_rbtree.c +@@ -216,29 +216,37 @@ static void *nft_rbtree_get(const struct net *net, const struct nft_set *set, + + static int nft_rbtree_gc_elem(const struct nft_set *__set, + struct nft_rbtree *priv, +- struct nft_rbtree_elem *rbe) ++ struct nft_rbtree_elem *rbe, ++ u8 genmask) + { + struct nft_set *set = (struct nft_set *)__set; + struct rb_node *prev = rb_prev(&rbe->node); +- struct nft_rbtree_elem *rbe_prev = NULL; ++ struct nft_rbtree_elem *rbe_prev; + struct nft_set_gc_batch *gcb; + + gcb = nft_set_gc_batch_check(set, NULL, GFP_ATOMIC); + if (!gcb) + return -ENOMEM; + +- /* search for expired end interval coming before this element. */ ++ /* search for end interval coming before this element. ++ * end intervals don't carry a timeout extension, they ++ * are coupled with the interval start element. ++ */ + while (prev) { + rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node); +- if (nft_rbtree_interval_end(rbe_prev)) ++ if (nft_rbtree_interval_end(rbe_prev) && ++ nft_set_elem_active(&rbe_prev->ext, genmask)) + break; + + prev = rb_prev(prev); + } + +- if (rbe_prev) { ++ if (prev) { ++ rbe_prev = rb_entry(prev, struct nft_rbtree_elem, node); ++ + rb_erase(&rbe_prev->node, &priv->root); + atomic_dec(&set->nelems); ++ nft_set_gc_batch_add(gcb, rbe_prev); + } + + rb_erase(&rbe->node, &priv->root); +@@ -320,7 +328,7 @@ static int __nft_rbtree_insert(const struct net *net, const struct nft_set *set, + + /* perform garbage collection to avoid bogus overlap reports. */ + if (nft_set_elem_expired(&rbe->ext)) { +- err = nft_rbtree_gc_elem(set, priv, rbe); ++ err = nft_rbtree_gc_elem(set, priv, rbe, genmask); + if (err < 0) + return err; + +-- +2.39.2 + diff --git a/queue-5.10/netfilter-nftables-add-helper-function-to-validate-s.patch b/queue-5.10/netfilter-nftables-add-helper-function-to-validate-s.patch new file mode 100644 index 00000000000..5ac77783d63 --- /dev/null +++ b/queue-5.10/netfilter-nftables-add-helper-function-to-validate-s.patch @@ -0,0 +1,56 @@ +From 0107a606e7c11981292ea6412485141d95ca21a4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 27 Apr 2021 18:05:48 +0200 +Subject: netfilter: nftables: add helper function to validate set element data + +From: Pablo Neira Ayuso + +[ Upstream commit 97c976d662fb9080a6a5d1e1a108c7a1f5c9484d ] + +When binding sets to rule, validate set element data according to +set definition. This patch adds a helper function to be reused by +the catch-all set element support. + +Signed-off-by: Pablo Neira Ayuso +Stable-dep-of: 0a771f7b266b ("netfilter: nf_tables: skip immediate deactivate in _PREPARE_ERROR") +Signed-off-by: Sasha Levin +--- + net/netfilter/nf_tables_api.c | 15 +++++++++++---- + 1 file changed, 11 insertions(+), 4 deletions(-) + +diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c +index 356416564d9f4..5ef9acba7c171 100644 +--- a/net/netfilter/nf_tables_api.c ++++ b/net/netfilter/nf_tables_api.c +@@ -4576,10 +4576,9 @@ static int nft_validate_register_store(const struct nft_ctx *ctx, + enum nft_data_types type, + unsigned int len); + +-static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, +- struct nft_set *set, +- const struct nft_set_iter *iter, +- struct nft_set_elem *elem) ++static int nft_setelem_data_validate(const struct nft_ctx *ctx, ++ struct nft_set *set, ++ struct nft_set_elem *elem) + { + const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv); + enum nft_registers dreg; +@@ -4591,6 +4590,14 @@ static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, + set->dlen); + } + ++static int nf_tables_bind_check_setelem(const struct nft_ctx *ctx, ++ struct nft_set *set, ++ const struct nft_set_iter *iter, ++ struct nft_set_elem *elem) ++{ ++ return nft_setelem_data_validate(ctx, set, elem); ++} ++ + int nf_tables_bind_set(const struct nft_ctx *ctx, struct nft_set *set, + struct nft_set_binding *binding) + { +-- +2.39.2 + diff --git a/queue-5.10/phy-hisilicon-fix-an-out-of-bounds-check-in-hisi_inn.patch b/queue-5.10/phy-hisilicon-fix-an-out-of-bounds-check-in-hisi_inn.patch new file mode 100644 index 00000000000..5280e73140c --- /dev/null +++ b/queue-5.10/phy-hisilicon-fix-an-out-of-bounds-check-in-hisi_inn.patch @@ -0,0 +1,44 @@ +From 5e15d237c5ac4f0543b2f2863ff4388c41dda859 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 02:05:55 -0700 +Subject: phy: hisilicon: Fix an out of bounds check in hisi_inno_phy_probe() + +From: Harshit Mogalapalli + +[ Upstream commit 13c088cf3657d70893d75cf116be937f1509cc0f ] + +The size of array 'priv->ports[]' is INNO_PHY_PORT_NUM. + +In the for loop, 'i' is used as the index for array 'priv->ports[]' +with a check (i > INNO_PHY_PORT_NUM) which indicates that +INNO_PHY_PORT_NUM is allowed value for 'i' in the same loop. + +This > comparison needs to be changed to >=, otherwise it potentially leads +to an out of bounds write on the next iteration through the loop + +Fixes: ba8b0ee81fbb ("phy: add inno-usb2-phy driver for hi3798cv200 SoC") +Reported-by: Dan Carpenter +Signed-off-by: Harshit Mogalapalli +Link: https://lore.kernel.org/r/20230721090558.3588613-1-harshit.m.mogalapalli@oracle.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/hisilicon/phy-hisi-inno-usb2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/hisilicon/phy-hisi-inno-usb2.c b/drivers/phy/hisilicon/phy-hisi-inno-usb2.c +index 34a6a9a1ceb25..897c6bb4cbb8c 100644 +--- a/drivers/phy/hisilicon/phy-hisi-inno-usb2.c ++++ b/drivers/phy/hisilicon/phy-hisi-inno-usb2.c +@@ -153,7 +153,7 @@ static int hisi_inno_phy_probe(struct platform_device *pdev) + phy_set_drvdata(phy, &priv->ports[i]); + i++; + +- if (i > INNO_PHY_PORT_NUM) { ++ if (i >= INNO_PHY_PORT_NUM) { + dev_warn(dev, "Support %d ports in maximum\n", i); + break; + } +-- +2.39.2 + diff --git a/queue-5.10/phy-qcom-snps-correct-struct-qcom_snps_hsphy-kerneld.patch b/queue-5.10/phy-qcom-snps-correct-struct-qcom_snps_hsphy-kerneld.patch new file mode 100644 index 00000000000..7563fe08df7 --- /dev/null +++ b/queue-5.10/phy-qcom-snps-correct-struct-qcom_snps_hsphy-kerneld.patch @@ -0,0 +1,43 @@ +From 5ca6fa6d762b8ddee2fdf5634b1b7543277b3ce3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 7 May 2023 16:48:18 +0200 +Subject: phy: qcom-snps: correct struct qcom_snps_hsphy kerneldoc + +From: Krzysztof Kozlowski + +[ Upstream commit 2a881183dc5ab2474ef602e48fe7af34db460d95 ] + +Update kerneldoc of struct qcom_snps_hsphy to fix: + + drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c:135: warning: Function parameter or member 'update_seq_cfg' not described in 'qcom_snps_hsphy' + +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Konrad Dybcio +Link: https://lore.kernel.org/r/20230507144818.193039-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Stable-dep-of: 8a0eb8f9b9a0 ("phy: qcom-snps-femto-v2: properly enable ref clock") +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +index 54846259405a9..136b45903c798 100644 +--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c ++++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +@@ -73,11 +73,11 @@ static const char * const qcom_snps_hsphy_vreg_names[] = { + * + * @cfg_ahb_clk: AHB2PHY interface clock + * @ref_clk: phy reference clock +- * @iface_clk: phy interface clock + * @phy_reset: phy reset control + * @vregs: regulator supplies bulk data + * @phy_initialized: if PHY has been initialized correctly + * @mode: contains the current mode the PHY is in ++ * @update_seq_cfg: tuning parameters for phy init + */ + struct qcom_snps_hsphy { + struct phy *phy; +-- +2.39.2 + diff --git a/queue-5.10/phy-qcom-snps-femto-v2-keep-cfg_ahb_clk-enabled-duri.patch b/queue-5.10/phy-qcom-snps-femto-v2-keep-cfg_ahb_clk-enabled-duri.patch new file mode 100644 index 00000000000..a5ac1a6b30d --- /dev/null +++ b/queue-5.10/phy-qcom-snps-femto-v2-keep-cfg_ahb_clk-enabled-duri.patch @@ -0,0 +1,96 @@ +From dda071745be9ddb554824853181b41c09a409881 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 10:45:38 -0400 +Subject: phy: qcom-snps-femto-v2: keep cfg_ahb_clk enabled during runtime + suspend + +From: Adrien Thierry + +[ Upstream commit 45d89a344eb46db9dce851c28e14f5e3c635c251 ] + +In the dwc3 core, both system and runtime suspend end up calling +dwc3_suspend_common(). From there, what happens for the PHYs depends on +the USB mode and whether the controller is entering system or runtime +suspend. + +HOST mode: + (1) system suspend on a non-wakeup-capable controller + + The [1] if branch is taken. dwc3_core_exit() is called, which ends up + calling phy_power_off() and phy_exit(). Those two functions decrease the + PM runtime count at some point, so they will trigger the PHY runtime + sleep (assuming the count is right). + + (2) runtime suspend / system suspend on a wakeup-capable controller + + The [1] branch is not taken. dwc3_suspend_common() calls + phy_pm_runtime_put_sync(). Assuming the ref count is right, the PHY + runtime suspend op is called. + +DEVICE mode: + dwc3_core_exit() is called on both runtime and system sleep + unless the controller is already runtime suspended. + +OTG mode: + (1) system suspend : dwc3_core_exit() is called + + (2) runtime suspend : do nothing + +In host mode, the code seems to make a distinction between 1) runtime +sleep / system sleep for wakeup-capable controller, and 2) system sleep +for non-wakeup-capable controller, where phy_power_off() and phy_exit() +are only called for the latter. This suggests the PHY is not supposed to +be in a fully powered-off state for runtime sleep and system sleep for +wakeup-capable controller. + +Moreover, downstream, cfg_ahb_clk only gets disabled for system suspend. +The clocks are disabled by phy->set_suspend() [2] which is only called +in the system sleep path through dwc3_core_exit() [3]. + +With that in mind, don't disable the clocks during the femto PHY runtime +suspend callback. The clocks will only be disabled during system suspend +for non-wakeup-capable controllers, through dwc3_core_exit(). + +[1] https://elixir.bootlin.com/linux/v6.4/source/drivers/usb/dwc3/core.c#L1988 +[2] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-05300-gen3meta.0/drivers/usb/phy/phy-msm-snps-hs.c#L524 +[3] https://git.codelinaro.org/clo/la/kernel/msm-5.4/-/blob/LV.AU.1.2.1.r2-05300-gen3meta.0/drivers/usb/dwc3/core.c#L1915 + +Signed-off-by: Adrien Thierry +Link: https://lore.kernel.org/r/20230629144542.14906-2-athierry@redhat.com +Signed-off-by: Vinod Koul +Stable-dep-of: 8a0eb8f9b9a0 ("phy: qcom-snps-femto-v2: properly enable ref clock") +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 9 --------- + 1 file changed, 9 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +index 136b45903c798..dfe5f09449100 100644 +--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c ++++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +@@ -122,22 +122,13 @@ static int qcom_snps_hsphy_suspend(struct qcom_snps_hsphy *hsphy) + 0, USB2_AUTO_RESUME); + } + +- clk_disable_unprepare(hsphy->cfg_ahb_clk); + return 0; + } + + static int qcom_snps_hsphy_resume(struct qcom_snps_hsphy *hsphy) + { +- int ret; +- + dev_dbg(&hsphy->phy->dev, "Resume QCOM SNPS PHY, mode\n"); + +- ret = clk_prepare_enable(hsphy->cfg_ahb_clk); +- if (ret) { +- dev_err(&hsphy->phy->dev, "failed to enable cfg ahb clock\n"); +- return ret; +- } +- + return 0; + } + +-- +2.39.2 + diff --git a/queue-5.10/phy-qcom-snps-femto-v2-properly-enable-ref-clock.patch b/queue-5.10/phy-qcom-snps-femto-v2-properly-enable-ref-clock.patch new file mode 100644 index 00000000000..6bcb8792ae2 --- /dev/null +++ b/queue-5.10/phy-qcom-snps-femto-v2-properly-enable-ref-clock.patch @@ -0,0 +1,173 @@ +From ed8e52d6f71ff9500b9bd48865de96bee1596d3e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 29 Jun 2023 10:45:39 -0400 +Subject: phy: qcom-snps-femto-v2: properly enable ref clock + +From: Adrien Thierry + +[ Upstream commit 8a0eb8f9b9a002291a3934acfd913660b905249e ] + +The driver is not enabling the ref clock, which thus gets disabled by +the clk_disable_unused() initcall. This leads to the dwc3 controller +failing to initialize if probed after clk_disable_unused() is called, +for instance when the driver is built as a module. + +To fix this, switch to the clk_bulk API to handle both cfg_ahb and ref +clocks at the proper places. + +Note that the cfg_ahb clock is currently not used by any device tree +instantiation of the PHY. Work needs to be done separately to fix this. + +Link: https://lore.kernel.org/linux-arm-msm/ZEqvy+khHeTkC2hf@fedora/ +Fixes: 51e8114f80d0 ("phy: qcom-snps: Add SNPS USB PHY driver for QCOM based SOCs") +Signed-off-by: Adrien Thierry +Link: https://lore.kernel.org/r/20230629144542.14906-3-athierry@redhat.com +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 63 ++++++++++++++----- + 1 file changed, 48 insertions(+), 15 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +index dfe5f09449100..abb9264569336 100644 +--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c ++++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +@@ -68,11 +68,13 @@ static const char * const qcom_snps_hsphy_vreg_names[] = { + /** + * struct qcom_snps_hsphy - snps hs phy attributes + * ++ * @dev: device structure ++ * + * @phy: generic phy + * @base: iomapped memory space for snps hs phy + * +- * @cfg_ahb_clk: AHB2PHY interface clock +- * @ref_clk: phy reference clock ++ * @num_clks: number of clocks ++ * @clks: array of clocks + * @phy_reset: phy reset control + * @vregs: regulator supplies bulk data + * @phy_initialized: if PHY has been initialized correctly +@@ -80,11 +82,13 @@ static const char * const qcom_snps_hsphy_vreg_names[] = { + * @update_seq_cfg: tuning parameters for phy init + */ + struct qcom_snps_hsphy { ++ struct device *dev; ++ + struct phy *phy; + void __iomem *base; + +- struct clk *cfg_ahb_clk; +- struct clk *ref_clk; ++ int num_clks; ++ struct clk_bulk_data *clks; + struct reset_control *phy_reset; + struct regulator_bulk_data vregs[SNPS_HS_NUM_VREGS]; + +@@ -92,6 +96,34 @@ struct qcom_snps_hsphy { + enum phy_mode mode; + }; + ++static int qcom_snps_hsphy_clk_init(struct qcom_snps_hsphy *hsphy) ++{ ++ struct device *dev = hsphy->dev; ++ ++ hsphy->num_clks = 2; ++ hsphy->clks = devm_kcalloc(dev, hsphy->num_clks, sizeof(*hsphy->clks), GFP_KERNEL); ++ if (!hsphy->clks) ++ return -ENOMEM; ++ ++ /* ++ * TODO: Currently no device tree instantiation of the PHY is using the clock. ++ * This needs to be fixed in order for this code to be able to use devm_clk_bulk_get(). ++ */ ++ hsphy->clks[0].id = "cfg_ahb"; ++ hsphy->clks[0].clk = devm_clk_get_optional(dev, "cfg_ahb"); ++ if (IS_ERR(hsphy->clks[0].clk)) ++ return dev_err_probe(dev, PTR_ERR(hsphy->clks[0].clk), ++ "failed to get cfg_ahb clk\n"); ++ ++ hsphy->clks[1].id = "ref"; ++ hsphy->clks[1].clk = devm_clk_get(dev, "ref"); ++ if (IS_ERR(hsphy->clks[1].clk)) ++ return dev_err_probe(dev, PTR_ERR(hsphy->clks[1].clk), ++ "failed to get ref clk\n"); ++ ++ return 0; ++} ++ + static inline void qcom_snps_hsphy_write_mask(void __iomem *base, u32 offset, + u32 mask, u32 val) + { +@@ -174,16 +206,16 @@ static int qcom_snps_hsphy_init(struct phy *phy) + if (ret) + return ret; + +- ret = clk_prepare_enable(hsphy->cfg_ahb_clk); ++ ret = clk_bulk_prepare_enable(hsphy->num_clks, hsphy->clks); + if (ret) { +- dev_err(&phy->dev, "failed to enable cfg ahb clock, %d\n", ret); ++ dev_err(&phy->dev, "failed to enable clocks, %d\n", ret); + goto poweroff_phy; + } + + ret = reset_control_assert(hsphy->phy_reset); + if (ret) { + dev_err(&phy->dev, "failed to assert phy_reset, %d\n", ret); +- goto disable_ahb_clk; ++ goto disable_clks; + } + + usleep_range(100, 150); +@@ -191,7 +223,7 @@ static int qcom_snps_hsphy_init(struct phy *phy) + ret = reset_control_deassert(hsphy->phy_reset); + if (ret) { + dev_err(&phy->dev, "failed to de-assert phy_reset, %d\n", ret); +- goto disable_ahb_clk; ++ goto disable_clks; + } + + qcom_snps_hsphy_write_mask(hsphy->base, USB2_PHY_USB_PHY_CFG0, +@@ -237,8 +269,8 @@ static int qcom_snps_hsphy_init(struct phy *phy) + + return 0; + +-disable_ahb_clk: +- clk_disable_unprepare(hsphy->cfg_ahb_clk); ++disable_clks: ++ clk_bulk_disable_unprepare(hsphy->num_clks, hsphy->clks); + poweroff_phy: + regulator_bulk_disable(ARRAY_SIZE(hsphy->vregs), hsphy->vregs); + +@@ -250,7 +282,7 @@ static int qcom_snps_hsphy_exit(struct phy *phy) + struct qcom_snps_hsphy *hsphy = phy_get_drvdata(phy); + + reset_control_assert(hsphy->phy_reset); +- clk_disable_unprepare(hsphy->cfg_ahb_clk); ++ clk_bulk_disable_unprepare(hsphy->num_clks, hsphy->clks); + regulator_bulk_disable(ARRAY_SIZE(hsphy->vregs), hsphy->vregs); + hsphy->phy_initialized = false; + +@@ -290,14 +322,15 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) + if (!hsphy) + return -ENOMEM; + ++ hsphy->dev = dev; ++ + hsphy->base = devm_platform_ioremap_resource(pdev, 0); + if (IS_ERR(hsphy->base)) + return PTR_ERR(hsphy->base); + +- hsphy->ref_clk = devm_clk_get(dev, "ref"); +- if (IS_ERR(hsphy->ref_clk)) +- return dev_err_probe(dev, PTR_ERR(hsphy->ref_clk), +- "failed to get ref clk\n"); ++ ret = qcom_snps_hsphy_clk_init(hsphy); ++ if (ret) ++ return dev_err_probe(dev, ret, "failed to initialize clocks\n"); + + hsphy->phy_reset = devm_reset_control_get_exclusive(&pdev->dev, NULL); + if (IS_ERR(hsphy->phy_reset)) { +-- +2.39.2 + diff --git a/queue-5.10/phy-qcom-snps-use-dev_err_probe-to-simplify-code.patch b/queue-5.10/phy-qcom-snps-use-dev_err_probe-to-simplify-code.patch new file mode 100644 index 00000000000..d12fa4ffbd1 --- /dev/null +++ b/queue-5.10/phy-qcom-snps-use-dev_err_probe-to-simplify-code.patch @@ -0,0 +1,64 @@ +From 7b64414f12a4098951acf0a4c47c7a43099cad23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 22 Sep 2022 11:12:28 +0000 +Subject: phy: qcom-snps: Use dev_err_probe() to simplify code + +From: Yuan Can + +[ Upstream commit 668dc8afce43d4bc01feb3e929d6d5ffcb14f899 ] + +In the probe path, dev_err() can be replaced with dev_err_probe() +which will check if error code is -EPROBE_DEFER and prints the +error name. It also sets the defer probe reason which can be +checked later through debugfs. + +Signed-off-by: Yuan Can +Reviewed-by: Dmitry Baryshkov +Reviewed-by: Andrew Halaney +Link: https://lore.kernel.org/r/20220922111228.36355-8-yuancan@huawei.com +Signed-off-by: Vinod Koul +Stable-dep-of: 8a0eb8f9b9a0 ("phy: qcom-snps-femto-v2: properly enable ref clock") +Signed-off-by: Sasha Levin +--- + drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c | 18 ++++++------------ + 1 file changed, 6 insertions(+), 12 deletions(-) + +diff --git a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +index 7e61202aa234e..54846259405a9 100644 +--- a/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c ++++ b/drivers/phy/qualcomm/phy-qcom-snps-femto-v2.c +@@ -304,12 +304,9 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) + return PTR_ERR(hsphy->base); + + hsphy->ref_clk = devm_clk_get(dev, "ref"); +- if (IS_ERR(hsphy->ref_clk)) { +- ret = PTR_ERR(hsphy->ref_clk); +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "failed to get ref clk, %d\n", ret); +- return ret; +- } ++ if (IS_ERR(hsphy->ref_clk)) ++ return dev_err_probe(dev, PTR_ERR(hsphy->ref_clk), ++ "failed to get ref clk\n"); + + hsphy->phy_reset = devm_reset_control_get_exclusive(&pdev->dev, NULL); + if (IS_ERR(hsphy->phy_reset)) { +@@ -322,12 +319,9 @@ static int qcom_snps_hsphy_probe(struct platform_device *pdev) + hsphy->vregs[i].supply = qcom_snps_hsphy_vreg_names[i]; + + ret = devm_regulator_bulk_get(dev, num, hsphy->vregs); +- if (ret) { +- if (ret != -EPROBE_DEFER) +- dev_err(dev, "failed to get regulator supplies: %d\n", +- ret); +- return ret; +- } ++ if (ret) ++ return dev_err_probe(dev, ret, ++ "failed to get regulator supplies\n"); + + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +-- +2.39.2 + diff --git a/queue-5.10/platform-x86-msi-laptop-fix-rfkill-out-of-sync-on-ms.patch b/queue-5.10/platform-x86-msi-laptop-fix-rfkill-out-of-sync-on-ms.patch new file mode 100644 index 00000000000..55ef4673133 --- /dev/null +++ b/queue-5.10/platform-x86-msi-laptop-fix-rfkill-out-of-sync-on-ms.patch @@ -0,0 +1,79 @@ +From 1c67e1ec829df72195208b36f9a03f50eafb69f3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 17:54:23 +0300 +Subject: platform/x86: msi-laptop: Fix rfkill out-of-sync on MSI Wind U100 + +From: Maxim Mikityanskiy + +[ Upstream commit ad084a6d99bc182bf109c190c808e2ea073ec57b ] + +Only the HW rfkill state is toggled on laptops with quirks->ec_read_only +(so far only MSI Wind U90/U100). There are, however, a few issues with +the implementation: + +1. The initial HW state is always unblocked, regardless of the actual + state on boot, because msi_init_rfkill only sets the SW state, + regardless of ec_read_only. + +2. The initial SW state corresponds to the actual state on boot, but it + can't be changed afterwards, because set_device_state returns + -EOPNOTSUPP. It confuses the userspace, making Wi-Fi and/or Bluetooth + unusable if it was blocked on boot, and breaking the airplane mode if + the rfkill was unblocked on boot. + +Address the above issues by properly initializing the HW state on +ec_read_only laptops and by allowing the userspace to toggle the SW +state. Don't set the SW state ourselves and let the userspace fully +control it. Toggling the SW state is a no-op, however, it allows the +userspace to properly toggle the airplane mode. The actual SW radio +disablement is handled by the corresponding rtl818x_pci and btusb +drivers that have their own rfkills. + +Tested on MSI Wind U100 Plus, BIOS ver 1.0G, EC ver 130. + +Fixes: 0816392b97d4 ("msi-laptop: merge quirk tables to one") +Fixes: 0de6575ad0a8 ("msi-laptop: Add MSI Wind U90/U100 support") +Signed-off-by: Maxim Mikityanskiy +Link: https://lore.kernel.org/r/20230721145423.161057-1-maxtram95@gmail.com +Reviewed-by: Hans de Goede +Signed-off-by: Hans de Goede +Signed-off-by: Sasha Levin +--- + drivers/platform/x86/msi-laptop.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/platform/x86/msi-laptop.c b/drivers/platform/x86/msi-laptop.c +index 0e804b6c2d242..dfb4af759aa75 100644 +--- a/drivers/platform/x86/msi-laptop.c ++++ b/drivers/platform/x86/msi-laptop.c +@@ -210,7 +210,7 @@ static ssize_t set_device_state(const char *buf, size_t count, u8 mask) + return -EINVAL; + + if (quirks->ec_read_only) +- return -EOPNOTSUPP; ++ return 0; + + /* read current device state */ + result = ec_read(MSI_STANDARD_EC_COMMAND_ADDRESS, &rdata); +@@ -841,15 +841,15 @@ static bool msi_laptop_i8042_filter(unsigned char data, unsigned char str, + static void msi_init_rfkill(struct work_struct *ignored) + { + if (rfk_wlan) { +- rfkill_set_sw_state(rfk_wlan, !wlan_s); ++ msi_rfkill_set_state(rfk_wlan, !wlan_s); + rfkill_wlan_set(NULL, !wlan_s); + } + if (rfk_bluetooth) { +- rfkill_set_sw_state(rfk_bluetooth, !bluetooth_s); ++ msi_rfkill_set_state(rfk_bluetooth, !bluetooth_s); + rfkill_bluetooth_set(NULL, !bluetooth_s); + } + if (rfk_threeg) { +- rfkill_set_sw_state(rfk_threeg, !threeg_s); ++ msi_rfkill_set_state(rfk_threeg, !threeg_s); + rfkill_threeg_set(NULL, !threeg_s); + } + } +-- +2.39.2 + diff --git a/queue-5.10/series b/queue-5.10/series index 8f57e14721a..f438b14584d 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -20,3 +20,32 @@ tracing-show-real-address-for-trace-event-arguments.patch pwm-meson-simplify-duplicated-per-channel-tracking.patch pwm-meson-fix-handling-of-period-duty-if-greater-tha.patch ext4-fix-to-check-return-value-of-freeze_bdev-in-ext.patch +phy-qcom-snps-use-dev_err_probe-to-simplify-code.patch +phy-qcom-snps-correct-struct-qcom_snps_hsphy-kerneld.patch +phy-qcom-snps-femto-v2-keep-cfg_ahb_clk-enabled-duri.patch +phy-qcom-snps-femto-v2-properly-enable-ref-clock.patch +media-staging-atomisp-select-v4l2_fwnode.patch +i40e-fix-an-null-vs-is_err-bug-for-debugfs_create_di.patch +net-phy-marvell10g-fix-88x3310-power-up.patch +net-hns3-reconstruct-function-hclge_ets_validate.patch +net-hns3-fix-wrong-bw-weight-of-disabled-tc-issue.patch +vxlan-move-to-its-own-directory.patch +vxlan-calculate-correct-header-length-for-gpe.patch +phy-hisilicon-fix-an-out-of-bounds-check-in-hisi_inn.patch +ethernet-atheros-fix-return-value-check-in-atl1e_tso.patch +ipv6-addrconf-fix-bug-where-deleting-a-mngtmpaddr-ca.patch +tcp-reduce-chance-of-collisions-in-inet6_hashfn.patch +ice-fix-memory-management-in-ice_ethtool_fdir.c.patch +bonding-reset-bond-s-flags-when-down-link-is-p2p-dev.patch +team-reset-team-s-flags-when-down-link-is-p2p-device.patch +platform-x86-msi-laptop-fix-rfkill-out-of-sync-on-ms.patch +netfilter-nft_set_rbtree-fix-overlap-expiration-walk.patch +netfilter-nftables-add-helper-function-to-validate-s.patch +netfilter-nf_tables-skip-immediate-deactivate-in-_pr.patch +netfilter-nf_tables-disallow-rule-addition-to-bound-.patch +net-sched-mqprio-refactor-nlattr-parsing-to-a-separa.patch +net-sched-mqprio-add-extack-to-mqprio_parse_nlattr.patch +net-sched-mqprio-add-length-check-for-tca_mqprio_-ma.patch +benet-fix-return-value-check-in-be_lancer_xmit_worka.patch +tipc-check-return-value-of-pskb_trim.patch +tipc-stop-tipc-crypto-on-failure-in-tipc_node_create.patch diff --git a/queue-5.10/tcp-reduce-chance-of-collisions-in-inet6_hashfn.patch b/queue-5.10/tcp-reduce-chance-of-collisions-in-inet6_hashfn.patch new file mode 100644 index 00000000000..a1c912fa6f2 --- /dev/null +++ b/queue-5.10/tcp-reduce-chance-of-collisions-in-inet6_hashfn.patch @@ -0,0 +1,75 @@ +From 07dcea507ac3fe39e9eb28d58e383062edbbe7ab Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 15:24:10 -0700 +Subject: tcp: Reduce chance of collisions in inet6_hashfn(). + +From: Stewart Smith + +[ Upstream commit d11b0df7ddf1831f3e170972f43186dad520bfcc ] + +For both IPv4 and IPv6 incoming TCP connections are tracked in a hash +table with a hash over the source & destination addresses and ports. +However, the IPv6 hash is insufficient and can lead to a high rate of +collisions. + +The IPv6 hash used an XOR to fit everything into the 96 bits for the +fast jenkins hash, meaning it is possible for an external entity to +ensure the hash collides, thus falling back to a linear search in the +bucket, which is slow. + +We take the approach of hash the full length of IPv6 address in +__ipv6_addr_jhash() so that all users can benefit from a more secure +version. + +While this may look like it adds overhead, the reality of modern CPUs +means that this is unmeasurable in real world scenarios. + +In simulating with llvm-mca, the increase in cycles for the hashing +code was ~16 cycles on Skylake (from a base of ~155), and an extra ~9 +on Nehalem (base of ~173). + +In commit dd6d2910c5e0 ("netfilter: conntrack: switch to siphash") +netfilter switched from a jenkins hash to a siphash, but even the faster +hsiphash is a more significant overhead (~20-30%) in some preliminary +testing. So, in this patch, we keep to the more conservative approach to +ensure we don't add much overhead per SYN. + +In testing, this results in a consistently even spread across the +connection buckets. In both testing and real-world scenarios, we have +not found any measurable performance impact. + +Fixes: 08dcdbf6a7b9 ("ipv6: use a stronger hash for tcp") +Signed-off-by: Stewart Smith +Signed-off-by: Samuel Mendoza-Jonas +Suggested-by: Eric Dumazet +Signed-off-by: Kuniyuki Iwashima +Reviewed-by: Eric Dumazet +Link: https://lore.kernel.org/r/20230721222410.17914-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + include/net/ipv6.h | 8 ++------ + 1 file changed, 2 insertions(+), 6 deletions(-) + +diff --git a/include/net/ipv6.h b/include/net/ipv6.h +index 8879c0ab0b89d..4c8f97a6da5a7 100644 +--- a/include/net/ipv6.h ++++ b/include/net/ipv6.h +@@ -663,12 +663,8 @@ static inline u32 ipv6_addr_hash(const struct in6_addr *a) + /* more secured version of ipv6_addr_hash() */ + static inline u32 __ipv6_addr_jhash(const struct in6_addr *a, const u32 initval) + { +- u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1]; +- +- return jhash_3words(v, +- (__force u32)a->s6_addr32[2], +- (__force u32)a->s6_addr32[3], +- initval); ++ return jhash2((__force const u32 *)a->s6_addr32, ++ ARRAY_SIZE(a->s6_addr32), initval); + } + + static inline bool ipv6_addr_loopback(const struct in6_addr *a) +-- +2.39.2 + diff --git a/queue-5.10/team-reset-team-s-flags-when-down-link-is-p2p-device.patch b/queue-5.10/team-reset-team-s-flags-when-down-link-is-p2p-device.patch new file mode 100644 index 00000000000..56c7aa21cce --- /dev/null +++ b/queue-5.10/team-reset-team-s-flags-when-down-link-is-p2p-device.patch @@ -0,0 +1,52 @@ +From 606907b40ecb9e8ccc959b051674c8983ced42e2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Jul 2023 12:03:56 +0800 +Subject: team: reset team's flags when down link is P2P device + +From: Hangbin Liu + +[ Upstream commit fa532bee17d15acf8bba4bc8e2062b7a093ba801 ] + +When adding a point to point downlink to team device, we neglected to reset +the team's flags, which were still using flags like BROADCAST and +MULTICAST. Consequently, this would initiate ARP/DAD for P2P downlink +interfaces, such as when adding a GRE device to team device. Fix this by +remove multicast/broadcast flags and add p2p and noarp flags. + +After removing the none ethernet interface and adding an ethernet interface +to team, we need to reset team interface flags. Unlike bonding interface, +team do not need restore IFF_MASTER, IFF_SLAVE flags. + +Reported-by: Liang Li +Closes: https://bugzilla.redhat.com/show_bug.cgi?id=2221438 +Fixes: 1d76efe1577b ("team: add support for non-ethernet devices") +Signed-off-by: Hangbin Liu +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/team/team.c | 9 +++++++++ + 1 file changed, 9 insertions(+) + +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 8a1619695421b..36c7eae776d44 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2130,6 +2130,15 @@ static void team_setup_by_port(struct net_device *dev, + dev->mtu = port_dev->mtu; + memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len); + eth_hw_addr_inherit(dev, port_dev); ++ ++ if (port_dev->flags & IFF_POINTOPOINT) { ++ dev->flags &= ~(IFF_BROADCAST | IFF_MULTICAST); ++ dev->flags |= (IFF_POINTOPOINT | IFF_NOARP); ++ } else if ((port_dev->flags & (IFF_BROADCAST | IFF_MULTICAST)) == ++ (IFF_BROADCAST | IFF_MULTICAST)) { ++ dev->flags |= (IFF_BROADCAST | IFF_MULTICAST); ++ dev->flags &= ~(IFF_POINTOPOINT | IFF_NOARP); ++ } + } + + static int team_dev_type_check_change(struct net_device *dev, +-- +2.39.2 + diff --git a/queue-5.10/tipc-check-return-value-of-pskb_trim.patch b/queue-5.10/tipc-check-return-value-of-pskb_trim.patch new file mode 100644 index 00000000000..5d1fd5e3b28 --- /dev/null +++ b/queue-5.10/tipc-check-return-value-of-pskb_trim.patch @@ -0,0 +1,39 @@ +From 3c251311fbcf45251dfe4e957b43ca4c37670d24 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 25 Jul 2023 14:48:10 +0800 +Subject: tipc: check return value of pskb_trim() + +From: Yuanjun Gong + +[ Upstream commit e46e06ffc6d667a89b979701288e2264f45e6a7b ] + +goto free_skb if an unexpected result is returned by pskb_tirm() +in tipc_crypto_rcv_complete(). + +Fixes: fc1b6d6de220 ("tipc: introduce TIPC encryption & authentication") +Signed-off-by: Yuanjun Gong +Reviewed-by: Tung Nguyen +Link: https://lore.kernel.org/r/20230725064810.5820-1-ruc_gongyuanjun@163.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/tipc/crypto.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/tipc/crypto.c b/net/tipc/crypto.c +index de63d6d41645c..2784d69892117 100644 +--- a/net/tipc/crypto.c ++++ b/net/tipc/crypto.c +@@ -1964,7 +1964,8 @@ static void tipc_crypto_rcv_complete(struct net *net, struct tipc_aead *aead, + + skb_reset_network_header(*skb); + skb_pull(*skb, tipc_ehdr_size(ehdr)); +- pskb_trim(*skb, (*skb)->len - aead->authsize); ++ if (pskb_trim(*skb, (*skb)->len - aead->authsize)) ++ goto free_skb; + + /* Validate TIPCv2 message */ + if (unlikely(!tipc_msg_validate(skb))) { +-- +2.39.2 + diff --git a/queue-5.10/tipc-stop-tipc-crypto-on-failure-in-tipc_node_create.patch b/queue-5.10/tipc-stop-tipc-crypto-on-failure-in-tipc_node_create.patch new file mode 100644 index 00000000000..5405d894a6f --- /dev/null +++ b/queue-5.10/tipc-stop-tipc-crypto-on-failure-in-tipc_node_create.patch @@ -0,0 +1,46 @@ +From 492552cefb7ee125b5a046c493a54a463f8be72a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 26 Jul 2023 00:46:25 +0300 +Subject: tipc: stop tipc crypto on failure in tipc_node_create + +From: Fedor Pchelkin + +[ Upstream commit de52e17326c3e9a719c9ead4adb03467b8fae0ef ] + +If tipc_link_bc_create() fails inside tipc_node_create() for a newly +allocated tipc node then we should stop its tipc crypto and free the +resources allocated with a call to tipc_crypto_start(). + +As the node ref is initialized to one to that point, just put the ref on +tipc_link_bc_create() error case that would lead to tipc_node_free() be +eventually executed and properly clean the node and its crypto resources. + +Found by Linux Verification Center (linuxtesting.org). + +Fixes: cb8092d70a6f ("tipc: move bc link creation back to tipc_node_create") +Suggested-by: Xin Long +Signed-off-by: Fedor Pchelkin +Reviewed-by: Xin Long +Link: https://lore.kernel.org/r/20230725214628.25246-1-pchelkin@ispras.ru +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/tipc/node.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/tipc/node.c b/net/tipc/node.c +index 38f61dccb8552..9e3cfeb82a23d 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -567,7 +567,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id, + n->capabilities, &n->bc_entry.inputq1, + &n->bc_entry.namedq, snd_l, &n->bc_entry.link)) { + pr_warn("Broadcast rcv link creation failed, no memory\n"); +- kfree(n); ++ tipc_node_put(n); + n = NULL; + goto exit; + } +-- +2.39.2 + diff --git a/queue-5.10/vxlan-calculate-correct-header-length-for-gpe.patch b/queue-5.10/vxlan-calculate-correct-header-length-for-gpe.patch new file mode 100644 index 00000000000..c812975f669 --- /dev/null +++ b/queue-5.10/vxlan-calculate-correct-header-length-for-gpe.patch @@ -0,0 +1,164 @@ +From 37701fdf9627837e3b52a3fd052ec9f398680cc8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 20 Jul 2023 11:05:56 +0200 +Subject: vxlan: calculate correct header length for GPE + +From: Jiri Benc + +[ Upstream commit 94d166c5318c6edd1e079df8552233443e909c33 ] + +VXLAN-GPE does not add an extra inner Ethernet header. Take that into +account when calculating header length. + +This causes problems in skb_tunnel_check_pmtu, where incorrect PMTU is +cached. + +In the collect_md mode (which is the only mode that VXLAN-GPE +supports), there's no magic auto-setting of the tunnel interface MTU. +It can't be, since the destination and thus the underlying interface +may be different for each packet. + +So, the administrator is responsible for setting the correct tunnel +interface MTU. Apparently, the administrators are capable enough to +calculate that the maximum MTU for VXLAN-GPE is (their_lower_MTU - 36). +They set the tunnel interface MTU to 1464. If you run a TCP stream over +such interface, it's then segmented according to the MTU 1464, i.e. +producing 1514 bytes frames. Which is okay, this still fits the lower +MTU. + +However, skb_tunnel_check_pmtu (called from vxlan_xmit_one) uses 50 as +the header size and thus incorrectly calculates the frame size to be +1528. This leads to ICMP too big message being generated (locally), +PMTU of 1450 to be cached and the TCP stream to be resegmented. + +The fix is to use the correct actual header size, especially for +skb_tunnel_check_pmtu calculation. + +Fixes: e1e5314de08ba ("vxlan: implement GPE") +Signed-off-by: Jiri Benc +Reviewed-by: Simon Horman +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- + drivers/net/vxlan/vxlan_core.c | 23 ++++++++----------- + include/net/vxlan.h | 13 +++++++---- + 3 files changed, 20 insertions(+), 18 deletions(-) + +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 5c542f5d2b20d..2b100b7b325a5 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8409,7 +8409,7 @@ static void ixgbe_atr(struct ixgbe_ring *ring, + struct ixgbe_adapter *adapter = q_vector->adapter; + + if (unlikely(skb_tail_pointer(skb) < hdr.network + +- VXLAN_HEADROOM)) ++ vxlan_headroom(0))) + return; + + /* verify the port is recognized as VXLAN */ +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index 72d670667f64f..1ac9de69bde65 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -2720,7 +2720,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + } + + ndst = &rt->dst; +- err = skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM, ++ err = skb_tunnel_check_pmtu(skb, ndst, vxlan_headroom(flags & VXLAN_F_GPE), + netif_is_any_bridge_port(dev)); + if (err < 0) { + goto tx_error; +@@ -2781,7 +2781,8 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev, + goto out_unlock; + } + +- err = skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM, ++ err = skb_tunnel_check_pmtu(skb, ndst, ++ vxlan_headroom((flags & VXLAN_F_GPE) | VXLAN_F_IPV6), + netif_is_any_bridge_port(dev)); + if (err < 0) { + goto tx_error; +@@ -3158,14 +3159,12 @@ static int vxlan_change_mtu(struct net_device *dev, int new_mtu) + struct vxlan_rdst *dst = &vxlan->default_dst; + struct net_device *lowerdev = __dev_get_by_index(vxlan->net, + dst->remote_ifindex); +- bool use_ipv6 = !!(vxlan->cfg.flags & VXLAN_F_IPV6); + + /* This check is different than dev->max_mtu, because it looks at + * the lowerdev->mtu, rather than the static dev->max_mtu + */ + if (lowerdev) { +- int max_mtu = lowerdev->mtu - +- (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM); ++ int max_mtu = lowerdev->mtu - vxlan_headroom(vxlan->cfg.flags); + if (new_mtu > max_mtu) + return -EINVAL; + } +@@ -3784,11 +3783,11 @@ static void vxlan_config_apply(struct net_device *dev, + struct vxlan_dev *vxlan = netdev_priv(dev); + struct vxlan_rdst *dst = &vxlan->default_dst; + unsigned short needed_headroom = ETH_HLEN; +- bool use_ipv6 = !!(conf->flags & VXLAN_F_IPV6); + int max_mtu = ETH_MAX_MTU; ++ u32 flags = conf->flags; + + if (!changelink) { +- if (conf->flags & VXLAN_F_GPE) ++ if (flags & VXLAN_F_GPE) + vxlan_raw_setup(dev); + else + vxlan_ether_setup(dev); +@@ -3814,8 +3813,7 @@ static void vxlan_config_apply(struct net_device *dev, + + dev->needed_tailroom = lowerdev->needed_tailroom; + +- max_mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : +- VXLAN_HEADROOM); ++ max_mtu = lowerdev->mtu - vxlan_headroom(flags); + if (max_mtu < ETH_MIN_MTU) + max_mtu = ETH_MIN_MTU; + +@@ -3826,10 +3824,9 @@ static void vxlan_config_apply(struct net_device *dev, + if (dev->mtu > max_mtu) + dev->mtu = max_mtu; + +- if (use_ipv6 || conf->flags & VXLAN_F_COLLECT_METADATA) +- needed_headroom += VXLAN6_HEADROOM; +- else +- needed_headroom += VXLAN_HEADROOM; ++ if (flags & VXLAN_F_COLLECT_METADATA) ++ flags |= VXLAN_F_IPV6; ++ needed_headroom += vxlan_headroom(flags); + dev->needed_headroom = needed_headroom; + + memcpy(&vxlan->cfg, conf, sizeof(*conf)); +diff --git a/include/net/vxlan.h b/include/net/vxlan.h +index 08537aa14f7c3..cf1d870f7b9a8 100644 +--- a/include/net/vxlan.h ++++ b/include/net/vxlan.h +@@ -327,10 +327,15 @@ static inline netdev_features_t vxlan_features_check(struct sk_buff *skb, + return features; + } + +-/* IP header + UDP + VXLAN + Ethernet header */ +-#define VXLAN_HEADROOM (20 + 8 + 8 + 14) +-/* IPv6 header + UDP + VXLAN + Ethernet header */ +-#define VXLAN6_HEADROOM (40 + 8 + 8 + 14) ++static inline int vxlan_headroom(u32 flags) ++{ ++ /* VXLAN: IP4/6 header + UDP + VXLAN + Ethernet header */ ++ /* VXLAN-GPE: IP4/6 header + UDP + VXLAN */ ++ return (flags & VXLAN_F_IPV6 ? sizeof(struct ipv6hdr) : ++ sizeof(struct iphdr)) + ++ sizeof(struct udphdr) + sizeof(struct vxlanhdr) + ++ (flags & VXLAN_F_GPE ? 0 : ETH_HLEN); ++} + + static inline struct vxlanhdr *vxlan_hdr(struct sk_buff *skb) + { +-- +2.39.2 + diff --git a/queue-5.10/vxlan-move-to-its-own-directory.patch b/queue-5.10/vxlan-move-to-its-own-directory.patch new file mode 100644 index 00000000000..1beb2a8c6cb --- /dev/null +++ b/queue-5.10/vxlan-move-to-its-own-directory.patch @@ -0,0 +1,58 @@ +From b591dffc15b14317de1aedf64df3cec1472baec4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 1 Mar 2022 05:04:28 +0000 +Subject: vxlan: move to its own directory + +From: Roopa Prabhu + +[ Upstream commit 6765393614ea8e2c0a7b953063513823f87c9115 ] + +vxlan.c has grown too long. This patch moves +it to its own directory. subsequent patches add new +functionality in new files. + +Signed-off-by: Roopa Prabhu +Signed-off-by: David S. Miller +Stable-dep-of: 94d166c5318c ("vxlan: calculate correct header length for GPE") +Signed-off-by: Sasha Levin +--- + drivers/net/Makefile | 2 +- + drivers/net/vxlan/Makefile | 7 +++++++ + drivers/net/{vxlan.c => vxlan/vxlan_core.c} | 0 + 3 files changed, 8 insertions(+), 1 deletion(-) + create mode 100644 drivers/net/vxlan/Makefile + rename drivers/net/{vxlan.c => vxlan/vxlan_core.c} (100%) + +diff --git a/drivers/net/Makefile b/drivers/net/Makefile +index 72e18d505d1ac..64430440c580c 100644 +--- a/drivers/net/Makefile ++++ b/drivers/net/Makefile +@@ -29,7 +29,7 @@ obj-$(CONFIG_TUN) += tun.o + obj-$(CONFIG_TAP) += tap.o + obj-$(CONFIG_VETH) += veth.o + obj-$(CONFIG_VIRTIO_NET) += virtio_net.o +-obj-$(CONFIG_VXLAN) += vxlan.o ++obj-$(CONFIG_VXLAN) += vxlan/ + obj-$(CONFIG_GENEVE) += geneve.o + obj-$(CONFIG_BAREUDP) += bareudp.o + obj-$(CONFIG_GTP) += gtp.o +diff --git a/drivers/net/vxlan/Makefile b/drivers/net/vxlan/Makefile +new file mode 100644 +index 0000000000000..5672661335933 +--- /dev/null ++++ b/drivers/net/vxlan/Makefile +@@ -0,0 +1,7 @@ ++# ++# Makefile for the vxlan driver ++# ++ ++obj-$(CONFIG_VXLAN) += vxlan.o ++ ++vxlan-objs := vxlan_core.o +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan/vxlan_core.c +similarity index 100% +rename from drivers/net/vxlan.c +rename to drivers/net/vxlan/vxlan_core.c +-- +2.39.2 + -- 2.47.3