From b3d7fbf6a4268402fd3a5675181bc397215c9355 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 15 Dec 2023 22:36:35 -0500 Subject: [PATCH] Fixes for 5.10 Signed-off-by: Sasha Levin --- ...lk-fix-use-after-free-in-atalk_ioctl.patch | 55 ++++ ...m-fix-use-after-free-in-do_vcc_ioctl.patch | 55 ++++ ...x-potential-deadlock-on-cli_queue_lo.patch | 55 ++++ ...x-potential-deadlock-on-tx_queue_loc.patch | 61 +++++ ...fix-double-free-in-ring-reinit-logic.patch | 56 ++++ ...correct-number-of-xdp-queues-upon-fa.patch | 71 +++++ .../net-ena-fix-xdp-redirection-error.patch | 43 +++ .../net-fec-correct-queue-selection.patch | 81 ++++++ ...-reporting-otherwise-unknown-prefix-.patch | 114 ++++++++ ...-syn-flag-from-packet-in-the-transmi.patch | 111 ++++++++ ...ose-fix-use-after-free-in-rose_ioctl.patch | 48 ++++ ...e-disabled-mdio-busses-from-devicetr.patch | 45 ++++ ...ev_err_probe-for-reporting-mdio-bus-.patch | 68 +++++ .../net-vlan-introduce-skb_vlan_eth_hdr.patch | 249 ++++++++++++++++++ ...ebug-fix-ethtool-g-iface-tx-behavior.patch | 80 ++++++ ...bug-prevent-crash-on-tx-ring-changes.patch | 86 ++++++ queue-5.10/qca_spi-fix-reset-behavior.patch | 51 ++++ ...ial-use-after-free-in-qed_cxt_tables.patch | 41 +++ queue-5.10/series | 20 ++ ...le-fix-incorrect-return-values-check.patch | 79 ++++++ ...-unsigned-integer-wrap-around-in-vir.patch | 41 +++ 21 files changed, 1510 insertions(+) create mode 100644 queue-5.10/appletalk-fix-use-after-free-in-atalk_ioctl.patch create mode 100644 queue-5.10/atm-fix-use-after-free-in-do_vcc_ioctl.patch create mode 100644 queue-5.10/atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch create mode 100644 queue-5.10/atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch create mode 100644 queue-5.10/net-atlantic-fix-double-free-in-ring-reinit-logic.patch create mode 100644 queue-5.10/net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch create mode 100644 queue-5.10/net-ena-fix-xdp-redirection-error.patch create mode 100644 queue-5.10/net-fec-correct-queue-selection.patch create mode 100644 queue-5.10/net-ipv6-support-reporting-otherwise-unknown-prefix-.patch create mode 100644 queue-5.10/net-remove-acked-syn-flag-from-packet-in-the-transmi.patch create mode 100644 queue-5.10/net-rose-fix-use-after-free-in-rose_ioctl.patch create mode 100644 queue-5.10/net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch create mode 100644 queue-5.10/net-stmmac-use-dev_err_probe-for-reporting-mdio-bus-.patch create mode 100644 queue-5.10/net-vlan-introduce-skb_vlan_eth_hdr.patch create mode 100644 queue-5.10/qca_debug-fix-ethtool-g-iface-tx-behavior.patch create mode 100644 queue-5.10/qca_debug-prevent-crash-on-tx-ring-changes.patch create mode 100644 queue-5.10/qca_spi-fix-reset-behavior.patch create mode 100644 queue-5.10/qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch create mode 100644 queue-5.10/sign-file-fix-incorrect-return-values-check.patch create mode 100644 queue-5.10/vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch diff --git a/queue-5.10/appletalk-fix-use-after-free-in-atalk_ioctl.patch b/queue-5.10/appletalk-fix-use-after-free-in-atalk_ioctl.patch new file mode 100644 index 00000000000..1af7f823172 --- /dev/null +++ b/queue-5.10/appletalk-fix-use-after-free-in-atalk_ioctl.patch @@ -0,0 +1,55 @@ +From 34f96d45e87f5f693c3bcbdd182a12e5a987371b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 23:10:56 -0500 +Subject: appletalk: Fix Use-After-Free in atalk_ioctl + +From: Hyunwoo Kim + +[ Upstream commit 189ff16722ee36ced4d2a2469d4ab65a8fee4198 ] + +Because atalk_ioctl() accesses sk->sk_receive_queue +without holding a sk->sk_receive_queue.lock, it can +cause a race with atalk_recvmsg(). +A use-after-free for skb occurs with the following flow. +``` +atalk_ioctl() -> skb_peek() +atalk_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() +``` +Add sk->sk_receive_queue.lock to atalk_ioctl() to fix this issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Hyunwoo Kim +Link: https://lore.kernel.org/r/20231213041056.GA519680@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/appletalk/ddp.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index c94b212d8e7ca..46adb8cefccf2 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -1811,15 +1811,14 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + break; + } + case TIOCINQ: { +- /* +- * These two are safe on a single CPU system as only +- * user tasks fiddle here +- */ +- struct sk_buff *skb = skb_peek(&sk->sk_receive_queue); ++ struct sk_buff *skb; + long amount = 0; + ++ spin_lock_irq(&sk->sk_receive_queue.lock); ++ skb = skb_peek(&sk->sk_receive_queue); + if (skb) + amount = skb->len - sizeof(struct ddpehdr); ++ spin_unlock_irq(&sk->sk_receive_queue.lock); + rc = put_user(amount, (int __user *)argp); + break; + } +-- +2.43.0 + diff --git a/queue-5.10/atm-fix-use-after-free-in-do_vcc_ioctl.patch b/queue-5.10/atm-fix-use-after-free-in-do_vcc_ioctl.patch new file mode 100644 index 00000000000..53c604e5f6d --- /dev/null +++ b/queue-5.10/atm-fix-use-after-free-in-do_vcc_ioctl.patch @@ -0,0 +1,55 @@ +From d513942ee9c96205a47fe94d2d036c02505a74fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 04:42:10 -0500 +Subject: atm: Fix Use-After-Free in do_vcc_ioctl + +From: Hyunwoo Kim + +[ Upstream commit 24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 ] + +Because do_vcc_ioctl() accesses sk->sk_receive_queue +without holding a sk->sk_receive_queue.lock, it can +cause a race with vcc_recvmsg(). +A use-after-free for skb occurs with the following flow. +``` +do_vcc_ioctl() -> skb_peek() +vcc_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() +``` +Add sk->sk_receive_queue.lock to do_vcc_ioctl() to fix this issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Hyunwoo Kim +Link: https://lore.kernel.org/r/20231209094210.GA403126@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/atm/ioctl.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c +index 838ebf0cabbfb..f81f8d56f5c0c 100644 +--- a/net/atm/ioctl.c ++++ b/net/atm/ioctl.c +@@ -73,14 +73,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, + case SIOCINQ: + { + struct sk_buff *skb; ++ int amount; + + if (sock->state != SS_CONNECTED) { + error = -EINVAL; + goto done; + } ++ spin_lock_irq(&sk->sk_receive_queue.lock); + skb = skb_peek(&sk->sk_receive_queue); +- error = put_user(skb ? skb->len : 0, +- (int __user *)argp) ? -EFAULT : 0; ++ amount = skb ? skb->len : 0; ++ spin_unlock_irq(&sk->sk_receive_queue.lock); ++ error = put_user(amount, (int __user *)argp) ? -EFAULT : 0; + goto done; + } + case ATM_SETSC: +-- +2.43.0 + diff --git a/queue-5.10/atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch b/queue-5.10/atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch new file mode 100644 index 00000000000..b8a71087026 --- /dev/null +++ b/queue-5.10/atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch @@ -0,0 +1,55 @@ +From 2a73f806eb127493412761d49372dfd2bf5454f5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 12:34:37 +0000 +Subject: atm: solos-pci: Fix potential deadlock on &cli_queue_lock + +From: Chengfeng Ye + +[ Upstream commit d5dba32b8f6cb39be708b726044ba30dbc088b30 ] + +As &card->cli_queue_lock is acquired under softirq context along the +following call chain from solos_bh(), other acquisition of the same +lock inside process context should disable at least bh to avoid double +lock. + + +console_show() +--> spin_lock(&card->cli_queue_lock) + + --> solos_bh() + --> spin_lock(&card->cli_queue_lock) + +This flaw was found by an experimental static analysis tool I am +developing for irq-related deadlock. + +To prevent the potential deadlock, the patch uses spin_lock_bh() +on the card->cli_queue_lock under process context code consistently +to prevent the possible deadlock scenario. + +Fixes: 9c54004ea717 ("atm: Driver for Solos PCI ADSL2+ card.") +Signed-off-by: Chengfeng Ye +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/solos-pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c +index 94fbc3abe60e6..95f768b28a5e6 100644 +--- a/drivers/atm/solos-pci.c ++++ b/drivers/atm/solos-pci.c +@@ -449,9 +449,9 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr, + struct sk_buff *skb; + unsigned int len; + +- spin_lock(&card->cli_queue_lock); ++ spin_lock_bh(&card->cli_queue_lock); + skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]); +- spin_unlock(&card->cli_queue_lock); ++ spin_unlock_bh(&card->cli_queue_lock); + if(skb == NULL) + return sprintf(buf, "No data.\n"); + +-- +2.43.0 + diff --git a/queue-5.10/atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch b/queue-5.10/atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch new file mode 100644 index 00000000000..5b628246751 --- /dev/null +++ b/queue-5.10/atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch @@ -0,0 +1,61 @@ +From 0376c20fa13802ecc43c1349bb4c3d3866ff4688 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 12:34:53 +0000 +Subject: atm: solos-pci: Fix potential deadlock on &tx_queue_lock + +From: Chengfeng Ye + +[ Upstream commit 15319a4e8ee4b098118591c6ccbd17237f841613 ] + +As &card->tx_queue_lock is acquired under softirq context along the +following call chain from solos_bh(), other acquisition of the same +lock inside process context should disable at least bh to avoid double +lock. + + +pclose() +--> spin_lock(&card->tx_queue_lock) + + --> solos_bh() + --> fpga_tx() + --> spin_lock(&card->tx_queue_lock) + +This flaw was found by an experimental static analysis tool I am +developing for irq-related deadlock. + +To prevent the potential deadlock, the patch uses spin_lock_bh() +on &card->tx_queue_lock under process context code consistently to +prevent the possible deadlock scenario. + +Fixes: 213e85d38912 ("solos-pci: clean up pclose() function") +Signed-off-by: Chengfeng Ye +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/solos-pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c +index 95f768b28a5e6..d3c30a28c410e 100644 +--- a/drivers/atm/solos-pci.c ++++ b/drivers/atm/solos-pci.c +@@ -956,14 +956,14 @@ static void pclose(struct atm_vcc *vcc) + struct pkt_hdr *header; + + /* Remove any yet-to-be-transmitted packets from the pending queue */ +- spin_lock(&card->tx_queue_lock); ++ spin_lock_bh(&card->tx_queue_lock); + skb_queue_walk_safe(&card->tx_queue[port], skb, tmpskb) { + if (SKB_CB(skb)->vcc == vcc) { + skb_unlink(skb, &card->tx_queue[port]); + solos_pop(vcc, skb); + } + } +- spin_unlock(&card->tx_queue_lock); ++ spin_unlock_bh(&card->tx_queue_lock); + + skb = alloc_skb(sizeof(*header), GFP_KERNEL); + if (!skb) { +-- +2.43.0 + diff --git a/queue-5.10/net-atlantic-fix-double-free-in-ring-reinit-logic.patch b/queue-5.10/net-atlantic-fix-double-free-in-ring-reinit-logic.patch new file mode 100644 index 00000000000..5e1209749c2 --- /dev/null +++ b/queue-5.10/net-atlantic-fix-double-free-in-ring-reinit-logic.patch @@ -0,0 +1,56 @@ +From 0da8d0bbb981ae19e3f21169fab2372730a96312 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 10:40:44 +0100 +Subject: net: atlantic: fix double free in ring reinit logic + +From: Igor Russkikh + +[ Upstream commit 7bb26ea74aa86fdf894b7dbd8c5712c5b4187da7 ] + +Driver has a logic leak in ring data allocation/free, +where double free may happen in aq_ring_free if system is under +stress and driver init/deinit is happening. + +The probability is higher to get this during suspend/resume cycle. + +Verification was done simulating same conditions with + + stress -m 2000 --vm-bytes 20M --vm-hang 10 --backoff 1000 + while true; do sudo ifconfig enp1s0 down; sudo ifconfig enp1s0 up; done + +Fixed by explicitly clearing pointers to NULL on deallocation + +Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") +Reported-by: Linus Torvalds +Closes: https://lore.kernel.org/netdev/CAHk-=wiZZi7FcvqVSUirHBjx0bBUZ4dFrMDVLc3+3HCrtq0rBA@mail.gmail.com/ +Signed-off-by: Igor Russkikh +Link: https://lore.kernel.org/r/20231213094044.22988-1-irusskikh@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index e9c6f1fa0b1a7..98e8997f80366 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -577,11 +577,14 @@ void aq_ring_free(struct aq_ring_s *self) + return; + + kfree(self->buff_ring); ++ self->buff_ring = NULL; + +- if (self->dx_ring) ++ if (self->dx_ring) { + dma_free_coherent(aq_nic_get_dev(self->aq_nic), + self->size * self->dx_size, self->dx_ring, + self->dx_ring_pa); ++ self->dx_ring = NULL; ++ } + } + + unsigned int aq_ring_fill_stats_data(struct aq_ring_s *self, u64 *data) +-- +2.43.0 + diff --git a/queue-5.10/net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch b/queue-5.10/net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch new file mode 100644 index 00000000000..dc074e6cae7 --- /dev/null +++ b/queue-5.10/net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch @@ -0,0 +1,71 @@ +From 7e0f6d7f25fb7ee4a3b1257c3a4cda6b945be09d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 06:27:58 +0000 +Subject: net: ena: Destroy correct number of xdp queues upon failure + +From: David Arinzon + +[ Upstream commit 41db6f99b5489a0d2ef26afe816ef0c6118d1d47 ] + +The ena_setup_and_create_all_xdp_queues() function freed all the +resources upon failure, after creating only xdp_num_queues queues, +instead of freeing just the created ones. + +In this patch, the only resources that are freed, are the ones +allocated right before the failure occurs. + +Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") +Signed-off-by: Shahar Itzko +Signed-off-by: David Arinzon +Link: https://lore.kernel.org/r/20231211062801.27891-2-darinzon@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 1722d4091ea3f..e13ae04d2f0fd 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -77,6 +77,8 @@ static void ena_unmap_tx_buff(struct ena_ring *tx_ring, + struct ena_tx_buffer *tx_info); + static int ena_create_io_tx_queues_in_range(struct ena_adapter *adapter, + int first_index, int count); ++static void ena_free_all_io_tx_resources_in_range(struct ena_adapter *adapter, ++ int first_index, int count); + + static void ena_tx_timeout(struct net_device *dev, unsigned int txqueue) + { +@@ -388,23 +390,22 @@ static void ena_init_all_xdp_queues(struct ena_adapter *adapter) + + static int ena_setup_and_create_all_xdp_queues(struct ena_adapter *adapter) + { ++ u32 xdp_first_ring = adapter->xdp_first_ring; ++ u32 xdp_num_queues = adapter->xdp_num_queues; + int rc = 0; + +- rc = ena_setup_tx_resources_in_range(adapter, adapter->xdp_first_ring, +- adapter->xdp_num_queues); ++ rc = ena_setup_tx_resources_in_range(adapter, xdp_first_ring, xdp_num_queues); + if (rc) + goto setup_err; + +- rc = ena_create_io_tx_queues_in_range(adapter, +- adapter->xdp_first_ring, +- adapter->xdp_num_queues); ++ rc = ena_create_io_tx_queues_in_range(adapter, xdp_first_ring, xdp_num_queues); + if (rc) + goto create_err; + + return 0; + + create_err: +- ena_free_all_io_tx_resources(adapter); ++ ena_free_all_io_tx_resources_in_range(adapter, xdp_first_ring, xdp_num_queues); + setup_err: + return rc; + } +-- +2.43.0 + diff --git a/queue-5.10/net-ena-fix-xdp-redirection-error.patch b/queue-5.10/net-ena-fix-xdp-redirection-error.patch new file mode 100644 index 00000000000..cb563f7d4b8 --- /dev/null +++ b/queue-5.10/net-ena-fix-xdp-redirection-error.patch @@ -0,0 +1,43 @@ +From 4f45227f62aa757c2877d8b2a3059aa3825defd5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 06:28:01 +0000 +Subject: net: ena: Fix XDP redirection error + +From: David Arinzon + +[ Upstream commit 4ab138ca0a340e6d6e7a6a9bd5004bd8f83127ca ] + +When sending TX packets, the meta descriptor can be all zeroes +as no meta information is required (as in XDP). + +This patch removes the validity check, as when +`disable_meta_caching` is enabled, such TX packets will be +dropped otherwise. + +Fixes: 0e3a3f6dacf0 ("net: ena: support new LLQ acceleration mode") +Signed-off-by: Shay Agroskin +Signed-off-by: David Arinzon +Link: https://lore.kernel.org/r/20231211062801.27891-5-darinzon@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_eth_com.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c +index 032ab9f204388..3af9dbf245f2a 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c +@@ -316,9 +316,6 @@ static int ena_com_create_and_store_tx_meta_desc(struct ena_com_io_sq *io_sq, + * compare it to the stored version, just create the meta + */ + if (io_sq->disable_meta_caching) { +- if (unlikely(!ena_tx_ctx->meta_valid)) +- return -EINVAL; +- + *have_meta = true; + return ena_com_create_meta(io_sq, ena_meta); + } +-- +2.43.0 + diff --git a/queue-5.10/net-fec-correct-queue-selection.patch b/queue-5.10/net-fec-correct-queue-selection.patch new file mode 100644 index 00000000000..2acc7443db2 --- /dev/null +++ b/queue-5.10/net-fec-correct-queue-selection.patch @@ -0,0 +1,81 @@ +From ac1a2bc1989f03458ce6cd39af6ceee96405e6bb Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 16:38:01 +0800 +Subject: net: fec: correct queue selection + +From: Radu Bulie + +[ Upstream commit 9fc95fe95c3e2a63ced8eeca4b256518ab204b63 ] + +The old implementation extracted VLAN TCI info from the payload +before the VLAN tag has been pushed in the payload. + +Another problem was that the VLAN TCI was extracted even if the +packet did not have VLAN protocol header. + +This resulted in invalid VLAN TCI and as a consequence a random +queue was computed. + +This patch fixes the above issues and use the VLAN TCI from the +skb if it is present or VLAN TCI from payload if present. If no +VLAN header is present queue 0 is selected. + +Fixes: 52c4a1a85f4b ("net: fec: add ndo_select_queue to fix TX bandwidth fluctuations") +Signed-off-by: Radu Bulie +Signed-off-by: Wei Fang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 27 +++++++++-------------- + 1 file changed, 11 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index e18b3b72fc0df..4ce913559c91d 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3266,31 +3266,26 @@ static int fec_set_features(struct net_device *netdev, + return 0; + } + +-static u16 fec_enet_get_raw_vlan_tci(struct sk_buff *skb) +-{ +- struct vlan_ethhdr *vhdr; +- unsigned short vlan_TCI = 0; +- +- if (skb->protocol == htons(ETH_P_ALL)) { +- vhdr = (struct vlan_ethhdr *)(skb->data); +- vlan_TCI = ntohs(vhdr->h_vlan_TCI); +- } +- +- return vlan_TCI; +-} +- + static u16 fec_enet_select_queue(struct net_device *ndev, struct sk_buff *skb, + struct net_device *sb_dev) + { + struct fec_enet_private *fep = netdev_priv(ndev); +- u16 vlan_tag; ++ u16 vlan_tag = 0; + + if (!(fep->quirks & FEC_QUIRK_HAS_AVB)) + return netdev_pick_tx(ndev, skb, NULL); + +- vlan_tag = fec_enet_get_raw_vlan_tci(skb); +- if (!vlan_tag) ++ /* VLAN is present in the payload.*/ ++ if (eth_type_vlan(skb->protocol)) { ++ struct vlan_ethhdr *vhdr = skb_vlan_eth_hdr(skb); ++ ++ vlan_tag = ntohs(vhdr->h_vlan_TCI); ++ /* VLAN is present in the skb but not yet pushed in the payload.*/ ++ } else if (skb_vlan_tag_present(skb)) { ++ vlan_tag = skb->vlan_tci; ++ } else { + return vlan_tag; ++ } + + return fec_enet_vlan_pri_to_queue[vlan_tag >> 13]; + } +-- +2.43.0 + diff --git a/queue-5.10/net-ipv6-support-reporting-otherwise-unknown-prefix-.patch b/queue-5.10/net-ipv6-support-reporting-otherwise-unknown-prefix-.patch new file mode 100644 index 00000000000..1d8b878a219 --- /dev/null +++ b/queue-5.10/net-ipv6-support-reporting-otherwise-unknown-prefix-.patch @@ -0,0 +1,114 @@ +From 0ef9fa020f6137c07c2a0ca1d30603fa805a61fa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 09:36:12 -0800 +Subject: net: ipv6: support reporting otherwise unknown prefix flags in + RTM_NEWPREFIX +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Żenczykowski + +[ Upstream commit bd4a816752bab609dd6d65ae021387beb9e2ddbd ] + +Lorenzo points out that we effectively clear all unknown +flags from PIO when copying them to userspace in the netlink +RTM_NEWPREFIX notification. + +We could fix this one at a time as new flags are defined, +or in one fell swoop - I choose the latter. + +We could either define 6 new reserved flags (reserved1..6) and handle +them individually (and rename them as new flags are defined), or we +could simply copy the entire unmodified byte over - I choose the latter. + +This unfortunately requires some anonymous union/struct magic, +so we add a static assert on the struct size for a little extra safety. + +Cc: David Ahern +Cc: Lorenzo Colitti +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Maciej Żenczykowski +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/addrconf.h | 12 ++++++++++-- + include/net/if_inet6.h | 4 ---- + net/ipv6/addrconf.c | 6 +----- + 3 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/include/net/addrconf.h b/include/net/addrconf.h +index edba74a536839..4d0c4cf1d4c88 100644 +--- a/include/net/addrconf.h ++++ b/include/net/addrconf.h +@@ -31,17 +31,22 @@ struct prefix_info { + __u8 length; + __u8 prefix_len; + ++ union __packed { ++ __u8 flags; ++ struct __packed { + #if defined(__BIG_ENDIAN_BITFIELD) +- __u8 onlink : 1, ++ __u8 onlink : 1, + autoconf : 1, + reserved : 6; + #elif defined(__LITTLE_ENDIAN_BITFIELD) +- __u8 reserved : 6, ++ __u8 reserved : 6, + autoconf : 1, + onlink : 1; + #else + #error "Please fix " + #endif ++ }; ++ }; + __be32 valid; + __be32 prefered; + __be32 reserved2; +@@ -49,6 +54,9 @@ struct prefix_info { + struct in6_addr prefix; + }; + ++/* rfc4861 4.6.2: IPv6 PIO is 32 bytes in size */ ++static_assert(sizeof(struct prefix_info) == 32); ++ + #include + #include + #include +diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h +index e03ba8e80781a..d4d7f4d52b152 100644 +--- a/include/net/if_inet6.h ++++ b/include/net/if_inet6.h +@@ -22,10 +22,6 @@ + #define IF_RS_SENT 0x10 + #define IF_READY 0x80000000 + +-/* prefix flags */ +-#define IF_PREFIX_ONLINK 0x01 +-#define IF_PREFIX_AUTOCONF 0x02 +- + enum { + INET6_IFADDR_STATE_PREDAD, + INET6_IFADDR_STATE_DAD, +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 193e5f2757330..79787a1f5ab34 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -6034,11 +6034,7 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev, + pmsg->prefix_len = pinfo->prefix_len; + pmsg->prefix_type = pinfo->type; + pmsg->prefix_pad3 = 0; +- pmsg->prefix_flags = 0; +- if (pinfo->onlink) +- pmsg->prefix_flags |= IF_PREFIX_ONLINK; +- if (pinfo->autoconf) +- pmsg->prefix_flags |= IF_PREFIX_AUTOCONF; ++ pmsg->prefix_flags = pinfo->flags; + + if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix)) + goto nla_put_failure; +-- +2.43.0 + diff --git a/queue-5.10/net-remove-acked-syn-flag-from-packet-in-the-transmi.patch b/queue-5.10/net-remove-acked-syn-flag-from-packet-in-the-transmi.patch new file mode 100644 index 00000000000..c51ac189d80 --- /dev/null +++ b/queue-5.10/net-remove-acked-syn-flag-from-packet-in-the-transmi.patch @@ -0,0 +1,111 @@ +From f045f48439024719f3f9167b55b347a0103b6cb8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Dec 2023 10:02:00 +0800 +Subject: net: Remove acked SYN flag from packet in the transmit queue + correctly + +From: Dong Chenchen + +[ Upstream commit f99cd56230f56c8b6b33713c5be4da5d6766be1f ] + +syzkaller report: + + kernel BUG at net/core/skbuff.c:3452! + invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI + CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.7.0-rc4-00009-gbee0e7762ad2-dirty #135 + RIP: 0010:skb_copy_and_csum_bits (net/core/skbuff.c:3452) + Call Trace: + icmp_glue_bits (net/ipv4/icmp.c:357) + __ip_append_data.isra.0 (net/ipv4/ip_output.c:1165) + ip_append_data (net/ipv4/ip_output.c:1362 net/ipv4/ip_output.c:1341) + icmp_push_reply (net/ipv4/icmp.c:370) + __icmp_send (./include/net/route.h:252 net/ipv4/icmp.c:772) + ip_fragment.constprop.0 (./include/linux/skbuff.h:1234 net/ipv4/ip_output.c:592 net/ipv4/ip_output.c:577) + __ip_finish_output (net/ipv4/ip_output.c:311 net/ipv4/ip_output.c:295) + ip_output (net/ipv4/ip_output.c:427) + __ip_queue_xmit (net/ipv4/ip_output.c:535) + __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) + __tcp_retransmit_skb (net/ipv4/tcp_output.c:3387) + tcp_retransmit_skb (net/ipv4/tcp_output.c:3404) + tcp_retransmit_timer (net/ipv4/tcp_timer.c:604) + tcp_write_timer (./include/linux/spinlock.h:391 net/ipv4/tcp_timer.c:716) + +The panic issue was trigered by tcp simultaneous initiation. +The initiation process is as follows: + + TCP A TCP B + + 1. CLOSED CLOSED + + 2. SYN-SENT --> ... + + 3. SYN-RECEIVED <-- <-- SYN-SENT + + 4. ... --> SYN-RECEIVED + + 5. SYN-RECEIVED --> ... + + // TCP B: not send challenge ack for ack limit or packet loss + // TCP A: close + tcp_close + tcp_send_fin + if (!tskb && tcp_under_memory_pressure(sk)) + tskb = skb_rb_last(&sk->tcp_rtx_queue); //pick SYN_ACK packet + TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN; // set FIN flag + + 6. FIN_WAIT_1 --> ... + + // TCP B: send challenge ack to SYN_FIN_ACK + + 7. ... <-- SYN-RECEIVED //challenge ack + + // TCP A: + + 8. FIN_WAIT_1 --> ... // retransmit panic + + __tcp_retransmit_skb //skb->len=0 + tcp_trim_head + len = tp->snd_una - TCP_SKB_CB(skb)->seq // len=101-100 + __pskb_trim_head + skb->data_len -= len // skb->len=-1, wrap around + ... ... + ip_fragment + icmp_glue_bits //BUG_ON + +If we use tcp_trim_head() to remove acked SYN from packet that contains data +or other flags, skb->len will be incorrectly decremented. We can remove SYN +flag that has been acked from rtx_queue earlier than tcp_trim_head(), which +can fix the problem mentioned above. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Co-developed-by: Eric Dumazet +Signed-off-by: Eric Dumazet +Signed-off-by: Dong Chenchen +Link: https://lore.kernel.org/r/20231210020200.1539875-1-dongchenchen2@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index f8ad8465f76cb..f0df14782ee01 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3171,7 +3171,13 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + if (skb_still_in_host_queue(sk, skb)) + return -EBUSY; + ++start: + if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) { ++ if (unlikely(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) { ++ TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN; ++ TCP_SKB_CB(skb)->seq++; ++ goto start; ++ } + if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) { + WARN_ON_ONCE(1); + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.10/net-rose-fix-use-after-free-in-rose_ioctl.patch b/queue-5.10/net-rose-fix-use-after-free-in-rose_ioctl.patch new file mode 100644 index 00000000000..92fcbe70dc4 --- /dev/null +++ b/queue-5.10/net-rose-fix-use-after-free-in-rose_ioctl.patch @@ -0,0 +1,48 @@ +From b27c0e3d405fa66bad997241fab3002d00278cc2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 05:05:38 -0500 +Subject: net/rose: Fix Use-After-Free in rose_ioctl + +From: Hyunwoo Kim + +[ Upstream commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 ] + +Because rose_ioctl() accesses sk->sk_receive_queue +without holding a sk->sk_receive_queue.lock, it can +cause a race with rose_accept(). +A use-after-free for skb occurs with the following flow. +``` +rose_ioctl() -> skb_peek() +rose_accept() -> skb_dequeue() -> kfree_skb() +``` +Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Hyunwoo Kim +Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/rose/af_rose.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index 86c93cf1744b0..b3e7a92f1ec19 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -1307,9 +1307,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + case TIOCINQ: { + struct sk_buff *skb; + long amount = 0L; +- /* These two are safe on a single CPU system as only user tasks fiddle here */ ++ ++ spin_lock_irq(&sk->sk_receive_queue.lock); + if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) + amount = skb->len; ++ spin_unlock_irq(&sk->sk_receive_queue.lock); + return put_user(amount, (unsigned int __user *) argp); + } + +-- +2.43.0 + diff --git a/queue-5.10/net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch b/queue-5.10/net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch new file mode 100644 index 00000000000..b3520799780 --- /dev/null +++ b/queue-5.10/net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch @@ -0,0 +1,45 @@ +From db98cd88d3a8f33000e013c9b28a18b2d7cab663 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 16:18:33 -0600 +Subject: net: stmmac: Handle disabled MDIO busses from devicetree + +From: Andrew Halaney + +[ Upstream commit e23c0d21ce9234fbc31ece35663ababbb83f9347 ] + +Many hardware configurations have the MDIO bus disabled, and are instead +using some other MDIO bus to talk to the MAC's phy. + +of_mdiobus_register() returns -ENODEV in this case. Let's handle it +gracefully instead of failing to probe the MAC. + +Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet controllers.") +Signed-off-by: Andrew Halaney +Reviewed-by: Serge Semin +Link: https://lore.kernel.org/r/20231212-b4-stmmac-handle-mdio-enodev-v2-1-600171acf79f@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +index ecc7f4842f849..d9b76e1e09493 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +@@ -459,7 +459,11 @@ int stmmac_mdio_register(struct net_device *ndev) + new_bus->parent = priv->device; + + err = of_mdiobus_register(new_bus, mdio_node); +- if (err != 0) { ++ if (err == -ENODEV) { ++ err = 0; ++ dev_info(dev, "MDIO bus is disabled\n"); ++ goto bus_register_fail; ++ } else if (err) { + dev_err_probe(dev, err, "Cannot register the MDIO bus\n"); + goto bus_register_fail; + } +-- +2.43.0 + diff --git a/queue-5.10/net-stmmac-use-dev_err_probe-for-reporting-mdio-bus-.patch b/queue-5.10/net-stmmac-use-dev_err_probe-for-reporting-mdio-bus-.patch new file mode 100644 index 00000000000..f51602ba38f --- /dev/null +++ b/queue-5.10/net-stmmac-use-dev_err_probe-for-reporting-mdio-bus-.patch @@ -0,0 +1,68 @@ +From 1f003ef62591745d3977d1857d8c641b6a93aede Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 2 Jun 2022 09:48:40 +0200 +Subject: net: stmmac: use dev_err_probe() for reporting mdio bus registration + failure + +From: Rasmus Villemoes + +[ Upstream commit 839612d23ffd933174db911ce56dc3f3ca883ec5 ] + +I have a board where these two lines are always printed during boot: + + imx-dwmac 30bf0000.ethernet: Cannot register the MDIO bus + imx-dwmac 30bf0000.ethernet: stmmac_dvr_probe: MDIO bus (id: 1) registration failed + +It's perfectly fine, and the device is successfully (and silently, as +far as the console goes) probed later. + +Use dev_err_probe() instead, which will demote these messages to debug +level (thus removing the alarming messages from the console) when the +error is -EPROBE_DEFER, and also has the advantage of including the +error code if/when it happens to be something other than -EPROBE_DEFER. + +While here, add the missing \n to one of the format strings. + +Signed-off-by: Rasmus Villemoes +Link: https://lore.kernel.org/r/20220602074840.1143360-1-linux@rasmusvillemoes.dk +Signed-off-by: Jakub Kicinski +Stable-dep-of: e23c0d21ce92 ("net: stmmac: Handle disabled MDIO busses from devicetree") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 6 +++--- + drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 2 +- + 2 files changed, 4 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 709bd81fde2a8..8416a186cd7f3 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -5187,9 +5187,9 @@ int stmmac_dvr_probe(struct device *device, + /* MDIO bus Registration */ + ret = stmmac_mdio_register(ndev); + if (ret < 0) { +- dev_err(priv->device, +- "%s: MDIO bus (id: %d) registration failed", +- __func__, priv->plat->bus_id); ++ dev_err_probe(priv->device, ret, ++ "%s: MDIO bus (id: %d) registration failed\n", ++ __func__, priv->plat->bus_id); + goto error_mdio_register; + } + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +index 7c1a14b256da3..ecc7f4842f849 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +@@ -460,7 +460,7 @@ int stmmac_mdio_register(struct net_device *ndev) + + err = of_mdiobus_register(new_bus, mdio_node); + if (err != 0) { +- dev_err(dev, "Cannot register the MDIO bus\n"); ++ dev_err_probe(dev, err, "Cannot register the MDIO bus\n"); + goto bus_register_fail; + } + +-- +2.43.0 + diff --git a/queue-5.10/net-vlan-introduce-skb_vlan_eth_hdr.patch b/queue-5.10/net-vlan-introduce-skb_vlan_eth_hdr.patch new file mode 100644 index 00000000000..ab51ad10e87 --- /dev/null +++ b/queue-5.10/net-vlan-introduce-skb_vlan_eth_hdr.patch @@ -0,0 +1,249 @@ +From 9d128aca7b0396bc311972a9cb9ce0f9435c1d38 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 01:55:54 +0300 +Subject: net: vlan: introduce skb_vlan_eth_hdr() + +From: Vladimir Oltean + +[ Upstream commit 1f5020acb33f926030f62563c86dffca35c7b701 ] + +Similar to skb_eth_hdr() introduced in commit 96cc4b69581d ("macvlan: do +not assume mac_header is set in macvlan_broadcast()"), let's introduce a +skb_vlan_eth_hdr() helper which can be used in TX-only code paths to get +to the VLAN header based on skb->data rather than based on the +skb_mac_header(skb). + +We also consolidate the drivers that dereference skb->data to go through +this helper. + +Signed-off-by: Vladimir Oltean +Reviewed-by: Eric Dumazet +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Stable-dep-of: 9fc95fe95c3e ("net: fec: correct queue selection") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +-- + drivers/net/ethernet/emulex/benet/be_main.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- + drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 2 +- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | 4 ++-- + drivers/net/ethernet/sfc/tx_tso.c | 2 +- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 ++----- + drivers/staging/gdm724x/gdm_lte.c | 4 ++-- + include/linux/if_vlan.h | 12 ++++++++++-- + net/batman-adv/soft-interface.c | 2 +- + 12 files changed, 24 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 4f669e7c75587..4509a29ff73f9 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -1924,8 +1924,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb, + + /* Skip VLAN tag if present */ + if (ether_type == ETH_P_8021Q) { +- struct vlan_ethhdr *vhdr = +- (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *vhdr = skb_vlan_eth_hdr(skb); + + ether_type = ntohs(vhdr->h_vlan_encapsulated_proto); + } +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index 52b399aa3213d..edd4dd73b3e32 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -1125,7 +1125,7 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter, + struct be_wrb_params + *wrb_params) + { +- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *veh = skb_vlan_eth_hdr(skb); + unsigned int eth_hdr_len; + struct iphdr *ip; + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 4df5e91e86ce7..a4ab3e7efa5e4 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1002,7 +1002,7 @@ static int hns3_handle_vtags(struct hns3_enet_ring *tx_ring, + if (unlikely(rc < 0)) + return rc; + +- vhdr = (struct vlan_ethhdr *)skb->data; ++ vhdr = skb_vlan_eth_hdr(skb); + vhdr->h_vlan_TCI |= cpu_to_be16((skb->priority << VLAN_PRIO_SHIFT) + & VLAN_PRIO_MASK); + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 88d8f17cefd8e..57667ccc28f54 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -2879,7 +2879,7 @@ static inline int i40e_tx_prepare_vlan_flags(struct sk_buff *skb, + rc = skb_cow_head(skb, 0); + if (rc < 0) + return rc; +- vhdr = (struct vlan_ethhdr *)skb->data; ++ vhdr = skb_vlan_eth_hdr(skb); + vhdr->h_vlan_TCI = htons(tx_flags >> + I40E_TX_FLAGS_VLAN_SHIFT); + } else { +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 2b100b7b325a5..5829d81f2cb11 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8707,7 +8707,7 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, + + if (skb_cow_head(skb, 0)) + goto out_drop; +- vhdr = (struct vlan_ethhdr *)skb->data; ++ vhdr = skb_vlan_eth_hdr(skb); + vhdr->h_vlan_TCI = htons(tx_flags >> + IXGBE_TX_FLAGS_VLAN_SHIFT); + } else { +diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +index e2046b6d65a30..2c54600835643 100644 +--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c ++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +@@ -1861,7 +1861,7 @@ netxen_tso_check(struct net_device *netdev, + + if (protocol == cpu_to_be16(ETH_P_8021Q)) { + +- vh = (struct vlan_ethhdr *)skb->data; ++ vh = skb_vlan_eth_hdr(skb); + protocol = vh->h_vlan_encapsulated_proto; + flags = FLAGS_VLAN_TAGGED; + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c +index bdf15d2a64313..7260e57d79f2e 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c +@@ -317,7 +317,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, + + if (adapter->flags & QLCNIC_VLAN_FILTERING) { + if (protocol == ETH_P_8021Q) { +- vh = (struct vlan_ethhdr *)skb->data; ++ vh = skb_vlan_eth_hdr(skb); + vlan_id = ntohs(vh->h_vlan_TCI); + } else if (skb_vlan_tag_present(skb)) { + vlan_id = skb_vlan_tag_get(skb); +@@ -467,7 +467,7 @@ static int qlcnic_tx_pkt(struct qlcnic_adapter *adapter, + u32 producer = tx_ring->producer; + + if (protocol == ETH_P_8021Q) { +- vh = (struct vlan_ethhdr *)skb->data; ++ vh = skb_vlan_eth_hdr(skb); + flags = QLCNIC_FLAGS_VLAN_TAGGED; + vlan_tci = ntohs(vh->h_vlan_TCI); + protocol = ntohs(vh->h_vlan_encapsulated_proto); +diff --git a/drivers/net/ethernet/sfc/tx_tso.c b/drivers/net/ethernet/sfc/tx_tso.c +index 898e5c61d9086..d381d8164f07c 100644 +--- a/drivers/net/ethernet/sfc/tx_tso.c ++++ b/drivers/net/ethernet/sfc/tx_tso.c +@@ -147,7 +147,7 @@ static __be16 efx_tso_check_protocol(struct sk_buff *skb) + EFX_WARN_ON_ONCE_PARANOID(((struct ethhdr *)skb->data)->h_proto != + protocol); + if (protocol == htons(ETH_P_8021Q)) { +- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *veh = skb_vlan_eth_hdr(skb); + + protocol = veh->h_vlan_encapsulated_proto; + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 59a07a01e80ca..709bd81fde2a8 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -3660,13 +3660,10 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + + static void stmmac_rx_vlan(struct net_device *dev, struct sk_buff *skb) + { +- struct vlan_ethhdr *veth; +- __be16 vlan_proto; ++ struct vlan_ethhdr *veth = skb_vlan_eth_hdr(skb); ++ __be16 vlan_proto = veth->h_vlan_proto; + u16 vlanid; + +- veth = (struct vlan_ethhdr *)skb->data; +- vlan_proto = veth->h_vlan_proto; +- + if ((vlan_proto == htons(ETH_P_8021Q) && + dev->features & NETIF_F_HW_VLAN_CTAG_RX) || + (vlan_proto == htons(ETH_P_8021AD) && +diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c +index de30262c3fae0..e0787647093d1 100644 +--- a/drivers/staging/gdm724x/gdm_lte.c ++++ b/drivers/staging/gdm724x/gdm_lte.c +@@ -350,7 +350,7 @@ static s32 gdm_lte_tx_nic_type(struct net_device *dev, struct sk_buff *skb) + /* Get ethernet protocol */ + eth = (struct ethhdr *)skb->data; + if (ntohs(eth->h_proto) == ETH_P_8021Q) { +- vlan_eth = (struct vlan_ethhdr *)skb->data; ++ vlan_eth = skb_vlan_eth_hdr(skb); + mac_proto = ntohs(vlan_eth->h_vlan_encapsulated_proto); + network_data = skb->data + VLAN_ETH_HLEN; + nic_type |= NIC_TYPE_F_VLAN; +@@ -436,7 +436,7 @@ static netdev_tx_t gdm_lte_tx(struct sk_buff *skb, struct net_device *dev) + * driver based on the NIC mac + */ + if (nic_type & NIC_TYPE_F_VLAN) { +- struct vlan_ethhdr *vlan_eth = (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *vlan_eth = skb_vlan_eth_hdr(skb); + + nic->vlan_id = ntohs(vlan_eth->h_vlan_TCI) & VLAN_VID_MASK; + data_buf = skb->data + (VLAN_ETH_HLEN - ETH_HLEN); +diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h +index 4e7e72f3da5bd..ce6714bec65fd 100644 +--- a/include/linux/if_vlan.h ++++ b/include/linux/if_vlan.h +@@ -60,6 +60,14 @@ static inline struct vlan_ethhdr *vlan_eth_hdr(const struct sk_buff *skb) + return (struct vlan_ethhdr *)skb_mac_header(skb); + } + ++/* Prefer this version in TX path, instead of ++ * skb_reset_mac_header() + vlan_eth_hdr() ++ */ ++static inline struct vlan_ethhdr *skb_vlan_eth_hdr(const struct sk_buff *skb) ++{ ++ return (struct vlan_ethhdr *)skb->data; ++} ++ + #define VLAN_PRIO_MASK 0xe000 /* Priority Code Point */ + #define VLAN_PRIO_SHIFT 13 + #define VLAN_CFI_MASK 0x1000 /* Canonical Format Indicator / Drop Eligible Indicator */ +@@ -526,7 +534,7 @@ static inline void __vlan_hwaccel_put_tag(struct sk_buff *skb, + */ + static inline int __vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci) + { +- struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *veth = skb_vlan_eth_hdr(skb); + + if (!eth_type_vlan(veth->h_vlan_proto)) + return -EINVAL; +@@ -727,7 +735,7 @@ static inline bool skb_vlan_tagged_multi(struct sk_buff *skb) + if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN))) + return false; + +- veh = (struct vlan_ethhdr *)skb->data; ++ veh = skb_vlan_eth_hdr(skb); + protocol = veh->h_vlan_encapsulated_proto; + } + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 7ac16d7b94a2f..0e6d0a5e68413 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -454,7 +454,7 @@ void batadv_interface_rx(struct net_device *soft_iface, + if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) + goto dropped; + +- vhdr = (struct vlan_ethhdr *)skb->data; ++ vhdr = skb_vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ + if (vhdr->h_vlan_encapsulated_proto != htons(ETH_P_BATMAN)) +-- +2.43.0 + diff --git a/queue-5.10/qca_debug-fix-ethtool-g-iface-tx-behavior.patch b/queue-5.10/qca_debug-fix-ethtool-g-iface-tx-behavior.patch new file mode 100644 index 00000000000..9251d68376b --- /dev/null +++ b/queue-5.10/qca_debug-fix-ethtool-g-iface-tx-behavior.patch @@ -0,0 +1,80 @@ +From a50af604d8b05e86b7b1159112a7e7b6e5add6f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:12:21 +0100 +Subject: qca_debug: Fix ethtool -G iface tx behavior + +From: Stefan Wahren + +[ Upstream commit 96a7e861d9e04d07febd3011c30cd84cd141d81f ] + +After calling ethtool -g it was not possible to adjust the TX ring +size again: + + # ethtool -g eth1 + Ring parameters for eth1: + Pre-set maximums: + RX: 4 + RX Mini: n/a + RX Jumbo: n/a + TX: 10 + Current hardware settings: + RX: 4 + RX Mini: n/a + RX Jumbo: n/a + TX: 10 + # ethtool -G eth1 tx 8 + netlink error: Invalid argument + +The reason for this is that the readonly setting rx_pending get +initialized and after that the range check in qcaspi_set_ringparam() +fails regardless of the provided parameter. So fix this by accepting +the exposed RX defaults. Instead of adding another magic number +better use a new define here. + +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Suggested-by: Paolo Abeni +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231206141222.52029-3-wahrenst@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_debug.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c b/drivers/net/ethernet/qualcomm/qca_debug.c +index 4c6c1792fdc77..66229b300c5a4 100644 +--- a/drivers/net/ethernet/qualcomm/qca_debug.c ++++ b/drivers/net/ethernet/qualcomm/qca_debug.c +@@ -30,6 +30,8 @@ + + #define QCASPI_MAX_REGS 0x20 + ++#define QCASPI_RX_MAX_FRAMES 4 ++ + static const u16 qcaspi_spi_regs[] = { + SPI_REG_BFR_SIZE, + SPI_REG_WRBUF_SPC_AVA, +@@ -249,9 +251,9 @@ qcaspi_get_ringparam(struct net_device *dev, struct ethtool_ringparam *ring) + { + struct qcaspi *qca = netdev_priv(dev); + +- ring->rx_max_pending = 4; ++ ring->rx_max_pending = QCASPI_RX_MAX_FRAMES; + ring->tx_max_pending = TX_RING_MAX_LEN; +- ring->rx_pending = 4; ++ ring->rx_pending = QCASPI_RX_MAX_FRAMES; + ring->tx_pending = qca->txr.count; + } + +@@ -260,7 +262,7 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring) + { + struct qcaspi *qca = netdev_priv(dev); + +- if ((ring->rx_pending) || ++ if (ring->rx_pending != QCASPI_RX_MAX_FRAMES || + (ring->rx_mini_pending) || + (ring->rx_jumbo_pending)) + return -EINVAL; +-- +2.43.0 + diff --git a/queue-5.10/qca_debug-prevent-crash-on-tx-ring-changes.patch b/queue-5.10/qca_debug-prevent-crash-on-tx-ring-changes.patch new file mode 100644 index 00000000000..b56f6f136aa --- /dev/null +++ b/queue-5.10/qca_debug-prevent-crash-on-tx-ring-changes.patch @@ -0,0 +1,86 @@ +From 222cb620fcaba296c996339e6a5a065e5264c5be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:12:20 +0100 +Subject: qca_debug: Prevent crash on TX ring changes + +From: Stefan Wahren + +[ Upstream commit f4e6064c97c050bd9904925ff7d53d0c9954fc7b ] + +The qca_spi driver stop and restart the SPI kernel thread +(via ndo_stop & ndo_open) in case of TX ring changes. This is +a big issue because it allows userspace to prevent restart of +the SPI kernel thread (via signals). A subsequent change of +TX ring wrongly assume a valid spi_thread pointer which result +in a crash. + +So prevent this by stopping the network traffic handling and +temporary park the SPI thread. + +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231206141222.52029-2-wahrenst@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_debug.c | 9 ++++----- + drivers/net/ethernet/qualcomm/qca_spi.c | 12 ++++++++++++ + 2 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c b/drivers/net/ethernet/qualcomm/qca_debug.c +index 702aa217a27ad..4c6c1792fdc77 100644 +--- a/drivers/net/ethernet/qualcomm/qca_debug.c ++++ b/drivers/net/ethernet/qualcomm/qca_debug.c +@@ -258,7 +258,6 @@ qcaspi_get_ringparam(struct net_device *dev, struct ethtool_ringparam *ring) + static int + qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring) + { +- const struct net_device_ops *ops = dev->netdev_ops; + struct qcaspi *qca = netdev_priv(dev); + + if ((ring->rx_pending) || +@@ -266,14 +265,14 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring) + (ring->rx_jumbo_pending)) + return -EINVAL; + +- if (netif_running(dev)) +- ops->ndo_stop(dev); ++ if (qca->spi_thread) ++ kthread_park(qca->spi_thread); + + qca->txr.count = max_t(u32, ring->tx_pending, TX_RING_MIN_LEN); + qca->txr.count = min_t(u16, qca->txr.count, TX_RING_MAX_LEN); + +- if (netif_running(dev)) +- ops->ndo_open(dev); ++ if (qca->spi_thread) ++ kthread_unpark(qca->spi_thread); + + return 0; + } +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 44fa959ebcaa5..b08a4b2a6a996 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -573,6 +573,18 @@ qcaspi_spi_thread(void *data) + netdev_info(qca->net_dev, "SPI thread created\n"); + while (!kthread_should_stop()) { + set_current_state(TASK_INTERRUPTIBLE); ++ if (kthread_should_park()) { ++ netif_tx_disable(qca->net_dev); ++ netif_carrier_off(qca->net_dev); ++ qcaspi_flush_tx_ring(qca); ++ kthread_parkme(); ++ if (qca->sync == QCASPI_SYNC_READY) { ++ netif_carrier_on(qca->net_dev); ++ netif_wake_queue(qca->net_dev); ++ } ++ continue; ++ } ++ + if ((qca->intr_req == qca->intr_svc) && + !qca->txr.skb[qca->txr.head]) + schedule(); +-- +2.43.0 + diff --git a/queue-5.10/qca_spi-fix-reset-behavior.patch b/queue-5.10/qca_spi-fix-reset-behavior.patch new file mode 100644 index 00000000000..460ccbffd1a --- /dev/null +++ b/queue-5.10/qca_spi-fix-reset-behavior.patch @@ -0,0 +1,51 @@ +From cedf9574e44402915c22ede13be33c0766b6ede8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:12:22 +0100 +Subject: qca_spi: Fix reset behavior + +From: Stefan Wahren + +[ Upstream commit 1057812d146dd658c9a9a96d869c2551150207b5 ] + +In case of a reset triggered by the QCA7000 itself, the behavior of the +qca_spi driver was not quite correct: +- in case of a pending RX frame decoding the drop counter must be + incremented and decoding state machine reseted +- also the reset counter must always be incremented regardless of sync + state + +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231206141222.52029-4-wahrenst@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index b08a4b2a6a996..ffa1846f5b4c4 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -613,11 +613,17 @@ qcaspi_spi_thread(void *data) + if (intr_cause & SPI_INT_CPU_ON) { + qcaspi_qca7k_sync(qca, QCASPI_EVENT_CPUON); + ++ /* Frame decoding in progress */ ++ if (qca->frm_handle.state != qca->frm_handle.init) ++ qca->net_dev->stats.rx_dropped++; ++ ++ qcafrm_fsm_init_spi(&qca->frm_handle); ++ qca->stats.device_reset++; ++ + /* not synced. */ + if (qca->sync != QCASPI_SYNC_READY) + continue; + +- qca->stats.device_reset++; + netif_wake_queue(qca->net_dev); + netif_carrier_on(qca->net_dev); + } +-- +2.43.0 + diff --git a/queue-5.10/qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch b/queue-5.10/qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch new file mode 100644 index 00000000000..84513edb30d --- /dev/null +++ b/queue-5.10/qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch @@ -0,0 +1,41 @@ +From b3ad2ccac6c407074f20d160381b9bffe228497c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Dec 2023 12:52:55 +0800 +Subject: qed: Fix a potential use-after-free in qed_cxt_tables_alloc + +From: Dinghao Liu + +[ Upstream commit b65d52ac9c085c0c52dee012a210d4e2f352611b ] + +qed_ilt_shadow_alloc() will call qed_ilt_shadow_free() to +free p_hwfn->p_cxt_mngr->ilt_shadow on error. However, +qed_cxt_tables_alloc() accesses the freed pointer on failure +of qed_ilt_shadow_alloc() through calling qed_cxt_mngr_free(), +which may lead to use-after-free. Fix this issue by setting +p_mngr->ilt_shadow to NULL in qed_ilt_shadow_free(). + +Fixes: fe56b9e6a8d9 ("qed: Add module with basic common support") +Reviewed-by: Przemek Kitszel +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20231210045255.21383-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +index 0a22f8ce9a2c3..1c3737921b6cf 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +@@ -933,6 +933,7 @@ static void qed_ilt_shadow_free(struct qed_hwfn *p_hwfn) + p_dma->virt_addr = NULL; + } + kfree(p_mngr->ilt_shadow); ++ p_mngr->ilt_shadow = NULL; + } + + static int qed_ilt_blk_alloc(struct qed_hwfn *p_hwfn, +-- +2.43.0 + diff --git a/queue-5.10/series b/queue-5.10/series index e60ee7b03f6..0aa04d4a971 100644 --- a/queue-5.10/series +++ b/queue-5.10/series @@ -11,3 +11,23 @@ ima-use-vfs_getattr_nosec-to-get-the-i_version.patch netfilter-nf_tables-fix-exist-matching-on-bigendian-.patch afs-fix-refcount-underflow-from-error-handling-race.patch hid-lenovo-restrict-detection-of-patched-firmware-on.patch +net-ipv6-support-reporting-otherwise-unknown-prefix-.patch +qca_debug-prevent-crash-on-tx-ring-changes.patch +qca_debug-fix-ethtool-g-iface-tx-behavior.patch +qca_spi-fix-reset-behavior.patch +atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch +atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch +net-vlan-introduce-skb_vlan_eth_hdr.patch +net-fec-correct-queue-selection.patch +atm-fix-use-after-free-in-do_vcc_ioctl.patch +net-rose-fix-use-after-free-in-rose_ioctl.patch +qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch +net-remove-acked-syn-flag-from-packet-in-the-transmi.patch +net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch +net-ena-fix-xdp-redirection-error.patch +sign-file-fix-incorrect-return-values-check.patch +vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch +net-stmmac-use-dev_err_probe-for-reporting-mdio-bus-.patch +net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch +appletalk-fix-use-after-free-in-atalk_ioctl.patch +net-atlantic-fix-double-free-in-ring-reinit-logic.patch diff --git a/queue-5.10/sign-file-fix-incorrect-return-values-check.patch b/queue-5.10/sign-file-fix-incorrect-return-values-check.patch new file mode 100644 index 00000000000..8eca2690b57 --- /dev/null +++ b/queue-5.10/sign-file-fix-incorrect-return-values-check.patch @@ -0,0 +1,79 @@ +From de4211fdec8e3e1ee4486b6704cbe9435affa0e0 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 10:31:10 +0000 +Subject: sign-file: Fix incorrect return values check + +From: Yusong Gao + +[ Upstream commit 829649443e78d85db0cff0c37cadb28fbb1a5f6f ] + +There are some wrong return values check in sign-file when call OpenSSL +API. The ERR() check cond is wrong because of the program only check the +return value is < 0 which ignored the return val is 0. For example: +1. CMS_final() return 1 for success or 0 for failure. +2. i2d_CMS_bio_stream() returns 1 for success or 0 for failure. +3. i2d_TYPEbio() return 1 for success and 0 for failure. +4. BIO_free() return 1 for success and 0 for failure. + +Link: https://www.openssl.org/docs/manmaster/man3/ +Fixes: e5a2e3c84782 ("scripts/sign-file.c: Add support for signing with a raw signature") +Signed-off-by: Yusong Gao +Reviewed-by: Juerg Haefliger +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20231213024405.624692-1-a869920004@gmail.com/ # v5 +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/sign-file.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/scripts/sign-file.c b/scripts/sign-file.c +index 7434e9ea926e2..12acc70e5a7a5 100644 +--- a/scripts/sign-file.c ++++ b/scripts/sign-file.c +@@ -322,7 +322,7 @@ int main(int argc, char **argv) + CMS_NOSMIMECAP | use_keyid | + use_signed_attrs), + "CMS_add1_signer"); +- ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) < 0, ++ ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) != 1, + "CMS_final"); + + #else +@@ -341,10 +341,10 @@ int main(int argc, char **argv) + b = BIO_new_file(sig_file_name, "wb"); + ERR(!b, "%s", sig_file_name); + #ifndef USE_PKCS7 +- ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0, ++ ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) != 1, + "%s", sig_file_name); + #else +- ERR(i2d_PKCS7_bio(b, pkcs7) < 0, ++ ERR(i2d_PKCS7_bio(b, pkcs7) != 1, + "%s", sig_file_name); + #endif + BIO_free(b); +@@ -374,9 +374,9 @@ int main(int argc, char **argv) + + if (!raw_sig) { + #ifndef USE_PKCS7 +- ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name); ++ ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) != 1, "%s", dest_name); + #else +- ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name); ++ ERR(i2d_PKCS7_bio(bd, pkcs7) != 1, "%s", dest_name); + #endif + } else { + BIO *b; +@@ -396,7 +396,7 @@ int main(int argc, char **argv) + ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, "%s", dest_name); + ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name); + +- ERR(BIO_free(bd) < 0, "%s", dest_name); ++ ERR(BIO_free(bd) != 1, "%s", dest_name); + + /* Finally, if we're signing in place, replace the original. */ + if (replace_orig) +-- +2.43.0 + diff --git a/queue-5.10/vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch b/queue-5.10/vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch new file mode 100644 index 00000000000..508ba1c9dab --- /dev/null +++ b/queue-5.10/vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch @@ -0,0 +1,41 @@ +From 3b4c3b487e3d7f804d2fb5ba090c80c72c90b820 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 19:23:17 +0300 +Subject: vsock/virtio: Fix unsigned integer wrap around in + virtio_transport_has_space() + +From: Nikolay Kuratov + +[ Upstream commit 60316d7f10b17a7ebb1ead0642fee8710e1560e0 ] + +We need to do signed arithmetic if we expect condition +`if (bytes < 0)` to be possible + +Found by Linux Verification Center (linuxtesting.org) with SVACE + +Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") +Signed-off-by: Nikolay Kuratov +Reviewed-by: Stefano Garzarella +Link: https://lore.kernel.org/r/20231211162317.4116625-1-kniv@yandex-team.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/virtio_transport_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index c9ee9259af48a..080e8f2bf9855 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -436,7 +436,7 @@ static s64 virtio_transport_has_space(struct vsock_sock *vsk) + struct virtio_vsock_sock *vvs = vsk->trans; + s64 bytes; + +- bytes = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); ++ bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); + if (bytes < 0) + bytes = 0; + +-- +2.43.0 + -- 2.47.3