From b890ad4a98256e1597369e2232c78e7e1944c75d Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Fri, 15 Dec 2023 22:36:33 -0500 Subject: [PATCH] Fixes for 6.1 Signed-off-by: Sasha Levin --- ...lk-fix-use-after-free-in-atalk_ioctl.patch | 55 +++ ...m-fix-use-after-free-in-do_vcc_ioctl.patch | 55 +++ ...x-potential-deadlock-on-cli_queue_lo.patch | 55 +++ ...x-potential-deadlock-on-tx_queue_loc.patch | 61 +++ ...r-resource-reservation-during-resume.patch | 46 ++ ...tamp_filter_all-packet-timestamp-log.patch | 107 +++++ ...g-return-value-check-in-bnxt_close_n.patch | 177 ++++++++ ...ave-ring-error-counters-across-reset.patch | 126 ++++++ ...-not-ask-for-mdb-vlan-and-fdb-replay.patch | 85 ++++ ...aa2-switch-fix-size-of-the-dma_unmap.patch | 50 +++ ...le-on-off-based-on-new-state-machine.patch | 131 ++++++ ...new-state-machines-for-flow-director.patch | 407 ++++++++++++++++++ ...fix-double-free-in-ring-reinit-logic.patch | 56 +++ ...correct-number-of-xdp-queues-upon-fa.patch | 71 +++ ...drops-handling-due-to-multibuf-packe.patch | 77 ++++ .../net-ena-fix-xdp-redirection-error.patch | 43 ++ .../net-fec-correct-queue-selection.patch | 81 ++++ ...-reporting-otherwise-unknown-prefix-.patch | 114 +++++ ...ssible-deadlock-on-mlx5e_tx_timeout_.patch | 243 +++++++++++ ...-syn-flag-from-packet-in-the-transmi.patch | 111 +++++ ...ose-fix-use-after-free-in-rose_ioctl.patch | 48 +++ ...e-disabled-mdio-busses-from-devicetr.patch | 45 ++ .../net-vlan-introduce-skb_vlan_eth_hdr.patch | 249 +++++++++++ ...-a-use-after-free-in-rvu_nix_registe.patch | 63 +++ ...eontx2-af-update-rss-algorithm-index.patch | 147 +++++++ ...tx2-pf-fix-promisc-mcam-entry-action.patch | 83 ++++ ...ebug-fix-ethtool-g-iface-tx-behavior.patch | 80 ++++ ...bug-prevent-crash-on-tx-ring-changes.patch | 86 ++++ queue-6.1/qca_spi-fix-reset-behavior.patch | 51 +++ ...ial-use-after-free-in-qed_cxt_tables.patch | 41 ++ queue-6.1/series | 33 ++ ...le-fix-incorrect-return-values-check.patch | 79 ++++ ...ngson-make-sure-mdio-is-initialized-.patch | 53 +++ ...-unsigned-integer-wrap-around-in-vir.patch | 41 ++ 34 files changed, 3250 insertions(+) create mode 100644 queue-6.1/appletalk-fix-use-after-free-in-atalk_ioctl.patch create mode 100644 queue-6.1/atm-fix-use-after-free-in-do_vcc_ioctl.patch create mode 100644 queue-6.1/atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch create mode 100644 queue-6.1/atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch create mode 100644 queue-6.1/bnxt_en-clear-resource-reservation-during-resume.patch create mode 100644 queue-6.1/bnxt_en-fix-hwtstamp_filter_all-packet-timestamp-log.patch create mode 100644 queue-6.1/bnxt_en-fix-wrong-return-value-check-in-bnxt_close_n.patch create mode 100644 queue-6.1/bnxt_en-save-ring-error-counters-across-reset.patch create mode 100644 queue-6.1/dpaa2-switch-do-not-ask-for-mdb-vlan-and-fdb-replay.patch create mode 100644 queue-6.1/dpaa2-switch-fix-size-of-the-dma_unmap.patch create mode 100644 queue-6.1/iavf-handle-ntuple-on-off-based-on-new-state-machine.patch create mode 100644 queue-6.1/iavf-introduce-new-state-machines-for-flow-director.patch create mode 100644 queue-6.1/net-atlantic-fix-double-free-in-ring-reinit-logic.patch create mode 100644 queue-6.1/net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch create mode 100644 queue-6.1/net-ena-fix-xdp-drops-handling-due-to-multibuf-packe.patch create mode 100644 queue-6.1/net-ena-fix-xdp-redirection-error.patch create mode 100644 queue-6.1/net-fec-correct-queue-selection.patch create mode 100644 queue-6.1/net-ipv6-support-reporting-otherwise-unknown-prefix-.patch create mode 100644 queue-6.1/net-mlx5e-fix-possible-deadlock-on-mlx5e_tx_timeout_.patch create mode 100644 queue-6.1/net-remove-acked-syn-flag-from-packet-in-the-transmi.patch create mode 100644 queue-6.1/net-rose-fix-use-after-free-in-rose_ioctl.patch create mode 100644 queue-6.1/net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch create mode 100644 queue-6.1/net-vlan-introduce-skb_vlan_eth_hdr.patch create mode 100644 queue-6.1/octeontx2-af-fix-a-use-after-free-in-rvu_nix_registe.patch create mode 100644 queue-6.1/octeontx2-af-update-rss-algorithm-index.patch create mode 100644 queue-6.1/octeontx2-pf-fix-promisc-mcam-entry-action.patch create mode 100644 queue-6.1/qca_debug-fix-ethtool-g-iface-tx-behavior.patch create mode 100644 queue-6.1/qca_debug-prevent-crash-on-tx-ring-changes.patch create mode 100644 queue-6.1/qca_spi-fix-reset-behavior.patch create mode 100644 queue-6.1/qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch create mode 100644 queue-6.1/sign-file-fix-incorrect-return-values-check.patch create mode 100644 queue-6.1/stmmac-dwmac-loongson-make-sure-mdio-is-initialized-.patch create mode 100644 queue-6.1/vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch diff --git a/queue-6.1/appletalk-fix-use-after-free-in-atalk_ioctl.patch b/queue-6.1/appletalk-fix-use-after-free-in-atalk_ioctl.patch new file mode 100644 index 00000000000..357906610af --- /dev/null +++ b/queue-6.1/appletalk-fix-use-after-free-in-atalk_ioctl.patch @@ -0,0 +1,55 @@ +From b8c4eccc7a411888c96f80ab258d4dc7eef49b26 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 23:10:56 -0500 +Subject: appletalk: Fix Use-After-Free in atalk_ioctl + +From: Hyunwoo Kim + +[ Upstream commit 189ff16722ee36ced4d2a2469d4ab65a8fee4198 ] + +Because atalk_ioctl() accesses sk->sk_receive_queue +without holding a sk->sk_receive_queue.lock, it can +cause a race with atalk_recvmsg(). +A use-after-free for skb occurs with the following flow. +``` +atalk_ioctl() -> skb_peek() +atalk_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() +``` +Add sk->sk_receive_queue.lock to atalk_ioctl() to fix this issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Hyunwoo Kim +Link: https://lore.kernel.org/r/20231213041056.GA519680@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/appletalk/ddp.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index a06f4d4a6f476..f67f14db16334 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -1811,15 +1811,14 @@ static int atalk_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + break; + } + case TIOCINQ: { +- /* +- * These two are safe on a single CPU system as only +- * user tasks fiddle here +- */ +- struct sk_buff *skb = skb_peek(&sk->sk_receive_queue); ++ struct sk_buff *skb; + long amount = 0; + ++ spin_lock_irq(&sk->sk_receive_queue.lock); ++ skb = skb_peek(&sk->sk_receive_queue); + if (skb) + amount = skb->len - sizeof(struct ddpehdr); ++ spin_unlock_irq(&sk->sk_receive_queue.lock); + rc = put_user(amount, (int __user *)argp); + break; + } +-- +2.43.0 + diff --git a/queue-6.1/atm-fix-use-after-free-in-do_vcc_ioctl.patch b/queue-6.1/atm-fix-use-after-free-in-do_vcc_ioctl.patch new file mode 100644 index 00000000000..09baf63228a --- /dev/null +++ b/queue-6.1/atm-fix-use-after-free-in-do_vcc_ioctl.patch @@ -0,0 +1,55 @@ +From cd3d718c5aaf4a33cd390ada6587e0cfcfdc66a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 04:42:10 -0500 +Subject: atm: Fix Use-After-Free in do_vcc_ioctl + +From: Hyunwoo Kim + +[ Upstream commit 24e90b9e34f9e039f56b5f25f6e6eb92cdd8f4b3 ] + +Because do_vcc_ioctl() accesses sk->sk_receive_queue +without holding a sk->sk_receive_queue.lock, it can +cause a race with vcc_recvmsg(). +A use-after-free for skb occurs with the following flow. +``` +do_vcc_ioctl() -> skb_peek() +vcc_recvmsg() -> skb_recv_datagram() -> skb_free_datagram() +``` +Add sk->sk_receive_queue.lock to do_vcc_ioctl() to fix this issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Hyunwoo Kim +Link: https://lore.kernel.org/r/20231209094210.GA403126@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/atm/ioctl.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c +index 838ebf0cabbfb..f81f8d56f5c0c 100644 +--- a/net/atm/ioctl.c ++++ b/net/atm/ioctl.c +@@ -73,14 +73,17 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, + case SIOCINQ: + { + struct sk_buff *skb; ++ int amount; + + if (sock->state != SS_CONNECTED) { + error = -EINVAL; + goto done; + } ++ spin_lock_irq(&sk->sk_receive_queue.lock); + skb = skb_peek(&sk->sk_receive_queue); +- error = put_user(skb ? skb->len : 0, +- (int __user *)argp) ? -EFAULT : 0; ++ amount = skb ? skb->len : 0; ++ spin_unlock_irq(&sk->sk_receive_queue.lock); ++ error = put_user(amount, (int __user *)argp) ? -EFAULT : 0; + goto done; + } + case ATM_SETSC: +-- +2.43.0 + diff --git a/queue-6.1/atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch b/queue-6.1/atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch new file mode 100644 index 00000000000..1f3ada191ac --- /dev/null +++ b/queue-6.1/atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch @@ -0,0 +1,55 @@ +From 7ce33e636473d39609906f5993323c36d15ad0f7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 12:34:37 +0000 +Subject: atm: solos-pci: Fix potential deadlock on &cli_queue_lock + +From: Chengfeng Ye + +[ Upstream commit d5dba32b8f6cb39be708b726044ba30dbc088b30 ] + +As &card->cli_queue_lock is acquired under softirq context along the +following call chain from solos_bh(), other acquisition of the same +lock inside process context should disable at least bh to avoid double +lock. + + +console_show() +--> spin_lock(&card->cli_queue_lock) + + --> solos_bh() + --> spin_lock(&card->cli_queue_lock) + +This flaw was found by an experimental static analysis tool I am +developing for irq-related deadlock. + +To prevent the potential deadlock, the patch uses spin_lock_bh() +on the card->cli_queue_lock under process context code consistently +to prevent the possible deadlock scenario. + +Fixes: 9c54004ea717 ("atm: Driver for Solos PCI ADSL2+ card.") +Signed-off-by: Chengfeng Ye +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/solos-pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c +index 94fbc3abe60e6..95f768b28a5e6 100644 +--- a/drivers/atm/solos-pci.c ++++ b/drivers/atm/solos-pci.c +@@ -449,9 +449,9 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr, + struct sk_buff *skb; + unsigned int len; + +- spin_lock(&card->cli_queue_lock); ++ spin_lock_bh(&card->cli_queue_lock); + skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]); +- spin_unlock(&card->cli_queue_lock); ++ spin_unlock_bh(&card->cli_queue_lock); + if(skb == NULL) + return sprintf(buf, "No data.\n"); + +-- +2.43.0 + diff --git a/queue-6.1/atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch b/queue-6.1/atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch new file mode 100644 index 00000000000..34117a9b4f7 --- /dev/null +++ b/queue-6.1/atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch @@ -0,0 +1,61 @@ +From 327d45905411aafead74ea165e1a507dc988f037 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 12:34:53 +0000 +Subject: atm: solos-pci: Fix potential deadlock on &tx_queue_lock + +From: Chengfeng Ye + +[ Upstream commit 15319a4e8ee4b098118591c6ccbd17237f841613 ] + +As &card->tx_queue_lock is acquired under softirq context along the +following call chain from solos_bh(), other acquisition of the same +lock inside process context should disable at least bh to avoid double +lock. + + +pclose() +--> spin_lock(&card->tx_queue_lock) + + --> solos_bh() + --> fpga_tx() + --> spin_lock(&card->tx_queue_lock) + +This flaw was found by an experimental static analysis tool I am +developing for irq-related deadlock. + +To prevent the potential deadlock, the patch uses spin_lock_bh() +on &card->tx_queue_lock under process context code consistently to +prevent the possible deadlock scenario. + +Fixes: 213e85d38912 ("solos-pci: clean up pclose() function") +Signed-off-by: Chengfeng Ye +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/solos-pci.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c +index 95f768b28a5e6..d3c30a28c410e 100644 +--- a/drivers/atm/solos-pci.c ++++ b/drivers/atm/solos-pci.c +@@ -956,14 +956,14 @@ static void pclose(struct atm_vcc *vcc) + struct pkt_hdr *header; + + /* Remove any yet-to-be-transmitted packets from the pending queue */ +- spin_lock(&card->tx_queue_lock); ++ spin_lock_bh(&card->tx_queue_lock); + skb_queue_walk_safe(&card->tx_queue[port], skb, tmpskb) { + if (SKB_CB(skb)->vcc == vcc) { + skb_unlink(skb, &card->tx_queue[port]); + solos_pop(vcc, skb); + } + } +- spin_unlock(&card->tx_queue_lock); ++ spin_unlock_bh(&card->tx_queue_lock); + + skb = alloc_skb(sizeof(*header), GFP_KERNEL); + if (!skb) { +-- +2.43.0 + diff --git a/queue-6.1/bnxt_en-clear-resource-reservation-during-resume.patch b/queue-6.1/bnxt_en-clear-resource-reservation-during-resume.patch new file mode 100644 index 00000000000..4182c299183 --- /dev/null +++ b/queue-6.1/bnxt_en-clear-resource-reservation-during-resume.patch @@ -0,0 +1,46 @@ +From 51ad3e99a4852ce39bf87a11920a660e501984b9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 16:16:55 -0800 +Subject: bnxt_en: Clear resource reservation during resume + +From: Somnath Kotur + +[ Upstream commit 9ef7c58f5abe41e6d91f37f28fe2d851ffedd92a ] + +We are issuing HWRM_FUNC_RESET cmd to reset the device including +all reserved resources, but not clearing the reservations +within the driver struct. As a result, when the driver re-initializes +as part of resume, it believes that there is no need to do any +resource reservation and goes ahead and tries to allocate rings +which will eventually fail beyond a certain number pre-reserved by +the firmware. + +Fixes: 674f50a5b026 ("bnxt_en: Implement new method to reserve rings.") +Reviewed-by: Kalesh AP +Reviewed-by: Ajit Khaparde +Reviewed-by: Andy Gospodarek +Signed-off-by: Somnath Kotur +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/20231208001658.14230-2-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index e81cb825dff4c..44d88bc1fcbd6 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -13882,6 +13882,8 @@ static int bnxt_resume(struct device *device) + if (rc) + goto resume_exit; + ++ bnxt_clear_reservations(bp, true); ++ + if (bnxt_hwrm_func_drv_rgtr(bp, NULL, 0, false)) { + rc = -ENODEV; + goto resume_exit; +-- +2.43.0 + diff --git a/queue-6.1/bnxt_en-fix-hwtstamp_filter_all-packet-timestamp-log.patch b/queue-6.1/bnxt_en-fix-hwtstamp_filter_all-packet-timestamp-log.patch new file mode 100644 index 00000000000..28f189616e6 --- /dev/null +++ b/queue-6.1/bnxt_en-fix-hwtstamp_filter_all-packet-timestamp-log.patch @@ -0,0 +1,107 @@ +From 53356a6a09a7bb2773ec209cb364004373d6b47d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 16:16:58 -0800 +Subject: bnxt_en: Fix HWTSTAMP_FILTER_ALL packet timestamp logic + +From: Michael Chan + +[ Upstream commit c13e268c0768659cdaae4bfe2fb24860bcc8ddb4 ] + +When the chip is configured to timestamp all receive packets, the +timestamp in the RX completion is only valid if the metadata +present flag is not set for packets received on the wire. In +addition, internal loopback packets will never have a valid timestamp +and the timestamp field will always be zero. We must exclude +any 0 value in the timestamp field because there is no way to +determine if it is a loopback packet or not. + +Add a new function bnxt_rx_ts_valid() to check for all timestamp +valid conditions. + +Fixes: 66ed81dcedc6 ("bnxt_en: Enable packet timestamping for all RX packets") +Reviewed-by: Andy Gospodarek +Reviewed-by: Pavan Chebbi +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/20231208001658.14230-5-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 20 +++++++++++++++++--- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 8 +++++++- + 2 files changed, 24 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 29cdc305af130..623cdeb29ed90 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -1796,6 +1796,21 @@ static void bnxt_deliver_skb(struct bnxt *bp, struct bnxt_napi *bnapi, + napi_gro_receive(&bnapi->napi, skb); + } + ++static bool bnxt_rx_ts_valid(struct bnxt *bp, u32 flags, ++ struct rx_cmp_ext *rxcmp1, u32 *cmpl_ts) ++{ ++ u32 ts = le32_to_cpu(rxcmp1->rx_cmp_timestamp); ++ ++ if (BNXT_PTP_RX_TS_VALID(flags)) ++ goto ts_valid; ++ if (!bp->ptp_all_rx_tstamp || !ts || !BNXT_ALL_RX_TS_VALID(flags)) ++ return false; ++ ++ts_valid: ++ *cmpl_ts = ts; ++ return true; ++} ++ + /* returns the following: + * 1 - 1 packet successfully received + * 0 - successful TPA_START, packet not completed yet +@@ -1821,6 +1836,7 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + struct sk_buff *skb; + struct xdp_buff xdp; + u32 flags, misc; ++ u32 cmpl_ts; + void *data; + int rc = 0; + +@@ -2043,10 +2059,8 @@ static int bnxt_rx_pkt(struct bnxt *bp, struct bnxt_cp_ring_info *cpr, + } + } + +- if (unlikely((flags & RX_CMP_FLAGS_ITYPES_MASK) == +- RX_CMP_FLAGS_ITYPE_PTP_W_TS) || bp->ptp_all_rx_tstamp) { ++ if (bnxt_rx_ts_valid(bp, flags, rxcmp1, &cmpl_ts)) { + if (bp->flags & BNXT_FLAG_CHIP_P5) { +- u32 cmpl_ts = le32_to_cpu(rxcmp1->rx_cmp_timestamp); + u64 ns, ts; + + if (!bnxt_get_rx_ts_p5(bp, &ts, cmpl_ts)) { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 4f80ae084eb1c..111098b4b6062 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -160,7 +160,7 @@ struct rx_cmp { + #define RX_CMP_FLAGS_ERROR (1 << 6) + #define RX_CMP_FLAGS_PLACEMENT (7 << 7) + #define RX_CMP_FLAGS_RSS_VALID (1 << 10) +- #define RX_CMP_FLAGS_UNUSED (1 << 11) ++ #define RX_CMP_FLAGS_PKT_METADATA_PRESENT (1 << 11) + #define RX_CMP_FLAGS_ITYPES_SHIFT 12 + #define RX_CMP_FLAGS_ITYPES_MASK 0xf000 + #define RX_CMP_FLAGS_ITYPE_UNKNOWN (0 << 12) +@@ -187,6 +187,12 @@ struct rx_cmp { + __le32 rx_cmp_rss_hash; + }; + ++#define BNXT_PTP_RX_TS_VALID(flags) \ ++ (((flags) & RX_CMP_FLAGS_ITYPES_MASK) == RX_CMP_FLAGS_ITYPE_PTP_W_TS) ++ ++#define BNXT_ALL_RX_TS_VALID(flags) \ ++ !((flags) & RX_CMP_FLAGS_PKT_METADATA_PRESENT) ++ + #define RX_CMP_HASH_VALID(rxcmp) \ + ((rxcmp)->rx_cmp_len_flags_type & cpu_to_le32(RX_CMP_FLAGS_RSS_VALID)) + +-- +2.43.0 + diff --git a/queue-6.1/bnxt_en-fix-wrong-return-value-check-in-bnxt_close_n.patch b/queue-6.1/bnxt_en-fix-wrong-return-value-check-in-bnxt_close_n.patch new file mode 100644 index 00000000000..3a4fdba983e --- /dev/null +++ b/queue-6.1/bnxt_en-fix-wrong-return-value-check-in-bnxt_close_n.patch @@ -0,0 +1,177 @@ +From 381bcd77d99458ab895ff4db712c14fa23838bee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 16:16:57 -0800 +Subject: bnxt_en: Fix wrong return value check in bnxt_close_nic() + +From: Kalesh AP + +[ Upstream commit bd6781c18cb5b5e5d8c5873fa9a51668e89ec76e ] + +The wait_event_interruptible_timeout() function returns 0 +if the timeout elapsed, -ERESTARTSYS if it was interrupted +by a signal, and the remaining jiffies otherwise if the +condition evaluated to true before the timeout elapsed. + +Driver should have checked for zero return value instead of +a positive value. + +MChan: Print a warning for -ERESTARTSYS. The close operation +will proceed anyway when wait_event_interruptible_timeout() +returns for any reason. Since we do the close no matter what, +we should not return this error code to the caller. Change +bnxt_close_nic() to a void function and remove all error +handling from some of the callers. + +Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.") +Reviewed-by: Andy Gospodarek +Reviewed-by: Vikas Gupta +Reviewed-by: Somnath Kotur +Signed-off-by: Kalesh AP +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/20231208001658.14230-4-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 13 +++++++------ + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 2 +- + .../net/ethernet/broadcom/bnxt/bnxt_devlink.c | 11 ++--------- + .../net/ethernet/broadcom/bnxt/bnxt_ethtool.c | 19 ++++--------------- + drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c | 5 ++--- + 5 files changed, 16 insertions(+), 34 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 1d2836373df97..29cdc305af130 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10719,10 +10719,8 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init, + bnxt_free_mem(bp, irq_re_init); + } + +-int bnxt_close_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) ++void bnxt_close_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + { +- int rc = 0; +- + if (test_bit(BNXT_STATE_IN_FW_RESET, &bp->state)) { + /* If we get here, it means firmware reset is in progress + * while we are trying to close. We can safely proceed with +@@ -10737,15 +10735,18 @@ int bnxt_close_nic(struct bnxt *bp, bool irq_re_init, bool link_re_init) + + #ifdef CONFIG_BNXT_SRIOV + if (bp->sriov_cfg) { ++ int rc; ++ + rc = wait_event_interruptible_timeout(bp->sriov_cfg_wait, + !bp->sriov_cfg, + BNXT_SRIOV_CFG_WAIT_TMO); +- if (rc) +- netdev_warn(bp->dev, "timeout waiting for SRIOV config operation to complete!\n"); ++ if (!rc) ++ netdev_warn(bp->dev, "timeout waiting for SRIOV config operation to complete, proceeding to close!\n"); ++ else if (rc < 0) ++ netdev_warn(bp->dev, "SRIOV config operation interrupted, proceeding to close!\n"); + } + #endif + __bnxt_close_nic(bp, irq_re_init, link_re_init); +- return rc; + } + + static int bnxt_close(struct net_device *dev) +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index c872cf1bc8783..4f80ae084eb1c 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -2343,7 +2343,7 @@ int bnxt_open_nic(struct bnxt *, bool, bool); + int bnxt_half_open_nic(struct bnxt *bp); + void bnxt_half_close_nic(struct bnxt *bp); + void bnxt_reenable_sriov(struct bnxt *bp); +-int bnxt_close_nic(struct bnxt *, bool, bool); ++void bnxt_close_nic(struct bnxt *, bool, bool); + void bnxt_get_ring_err_stats(struct bnxt *bp, + struct bnxt_total_ring_err_stats *stats); + int bnxt_dbg_hwrm_rd_reg(struct bnxt *bp, u32 reg_off, u16 num_words, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +index 8a6f788f62944..2bdebd9c069d8 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_devlink.c +@@ -478,15 +478,8 @@ static int bnxt_dl_reload_down(struct devlink *dl, bool netns_change, + return -ENODEV; + } + bnxt_ulp_stop(bp); +- if (netif_running(bp->dev)) { +- rc = bnxt_close_nic(bp, true, true); +- if (rc) { +- NL_SET_ERR_MSG_MOD(extack, "Failed to close"); +- dev_close(bp->dev); +- rtnl_unlock(); +- break; +- } +- } ++ if (netif_running(bp->dev)) ++ bnxt_close_nic(bp, true, true); + bnxt_vf_reps_free(bp); + rc = bnxt_hwrm_func_drv_unrgtr(bp); + if (rc) { +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index 89f046ce1373c..7260b4671ecca 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -164,9 +164,8 @@ static int bnxt_set_coalesce(struct net_device *dev, + reset_coalesce: + if (test_bit(BNXT_STATE_OPEN, &bp->state)) { + if (update_stats) { +- rc = bnxt_close_nic(bp, true, false); +- if (!rc) +- rc = bnxt_open_nic(bp, true, false); ++ bnxt_close_nic(bp, true, false); ++ rc = bnxt_open_nic(bp, true, false); + } else { + rc = bnxt_hwrm_set_coal(bp); + } +@@ -956,12 +955,7 @@ static int bnxt_set_channels(struct net_device *dev, + * before PF unload + */ + } +- rc = bnxt_close_nic(bp, true, false); +- if (rc) { +- netdev_err(bp->dev, "Set channel failure rc :%x\n", +- rc); +- return rc; +- } ++ bnxt_close_nic(bp, true, false); + } + + if (sh) { +@@ -3634,12 +3628,7 @@ static void bnxt_self_test(struct net_device *dev, struct ethtool_test *etest, + bnxt_run_fw_tests(bp, test_mask, &test_results); + } else { + bnxt_ulp_stop(bp); +- rc = bnxt_close_nic(bp, true, false); +- if (rc) { +- etest->flags |= ETH_TEST_FL_FAILED; +- bnxt_ulp_start(bp, rc); +- return; +- } ++ bnxt_close_nic(bp, true, false); + bnxt_run_fw_tests(bp, test_mask, &test_results); + + buf[BNXT_MACLPBK_TEST_IDX] = 1; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +index 4faaa9a50f4bc..ae734314f8de5 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ptp.c +@@ -506,9 +506,8 @@ static int bnxt_hwrm_ptp_cfg(struct bnxt *bp) + + if (netif_running(bp->dev)) { + if (ptp->rx_filter == HWTSTAMP_FILTER_ALL) { +- rc = bnxt_close_nic(bp, false, false); +- if (!rc) +- rc = bnxt_open_nic(bp, false, false); ++ bnxt_close_nic(bp, false, false); ++ rc = bnxt_open_nic(bp, false, false); + } else { + bnxt_ptp_cfg_tstamp_filters(bp); + } +-- +2.43.0 + diff --git a/queue-6.1/bnxt_en-save-ring-error-counters-across-reset.patch b/queue-6.1/bnxt_en-save-ring-error-counters-across-reset.patch new file mode 100644 index 00000000000..e3cbaf50252 --- /dev/null +++ b/queue-6.1/bnxt_en-save-ring-error-counters-across-reset.patch @@ -0,0 +1,126 @@ +From 5d7be8ff6c570ea81ff8bf714f99026705d45b88 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 17 Aug 2023 16:19:09 -0700 +Subject: bnxt_en: Save ring error counters across reset + +From: Michael Chan + +[ Upstream commit 4c70dbe3c0087b439b9e5015057e3e378cf5d8b1 ] + +Currently, the ring counters are stored in the per ring datastructure. +During reset, all the rings are freed together with the associated +datastructures. As a result, all the ring error counters will be reset +to zero. + +Add logic to keep track of the total error counts of all the rings +and save them before reset (including ifdown). The next patch will +display these total ring error counters under ethtool -S. + +Link: https://lore.kernel.org/netdev/CACKFLimD-bKmJ1tGZOLYRjWzEwxkri-Mw7iFme1x2Dr0twdCeg@mail.gmail.com/ +Reviewed-by: Ajit Khaparde +Reviewed-by: Andy Gospodarek +Reviewed-by: Somnath Kotur +Signed-off-by: Michael Chan +Link: https://lore.kernel.org/r/20230817231911.165035-5-michael.chan@broadcom.com +Signed-off-by: Jakub Kicinski +Stable-dep-of: bd6781c18cb5 ("bnxt_en: Fix wrong return value check in bnxt_close_nic()") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnxt/bnxt.c | 32 ++++++++++++++++++++++- + drivers/net/ethernet/broadcom/bnxt/bnxt.h | 15 +++++++++++ + 2 files changed, 46 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index 44d88bc1fcbd6..1d2836373df97 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -10708,8 +10708,10 @@ static void __bnxt_close_nic(struct bnxt *bp, bool irq_re_init, + bnxt_free_skbs(bp); + + /* Save ring stats before shutdown */ +- if (bp->bnapi && irq_re_init) ++ if (bp->bnapi && irq_re_init) { + bnxt_get_ring_stats(bp, &bp->net_stats_prev); ++ bnxt_get_ring_err_stats(bp, &bp->ring_err_stats_prev); ++ } + if (irq_re_init) { + bnxt_free_irq(bp); + bnxt_del_napi(bp); +@@ -10958,6 +10960,34 @@ bnxt_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats) + clear_bit(BNXT_STATE_READ_STATS, &bp->state); + } + ++static void bnxt_get_one_ring_err_stats(struct bnxt *bp, ++ struct bnxt_total_ring_err_stats *stats, ++ struct bnxt_cp_ring_info *cpr) ++{ ++ struct bnxt_sw_stats *sw_stats = &cpr->sw_stats; ++ u64 *hw_stats = cpr->stats.sw_stats; ++ ++ stats->rx_total_l4_csum_errors += sw_stats->rx.rx_l4_csum_errors; ++ stats->rx_total_resets += sw_stats->rx.rx_resets; ++ stats->rx_total_buf_errors += sw_stats->rx.rx_buf_errors; ++ stats->rx_total_oom_discards += sw_stats->rx.rx_oom_discards; ++ stats->rx_total_netpoll_discards += sw_stats->rx.rx_netpoll_discards; ++ stats->rx_total_ring_discards += ++ BNXT_GET_RING_STATS64(hw_stats, rx_discard_pkts); ++ stats->tx_total_ring_discards += ++ BNXT_GET_RING_STATS64(hw_stats, tx_discard_pkts); ++ stats->total_missed_irqs += sw_stats->cmn.missed_irqs; ++} ++ ++void bnxt_get_ring_err_stats(struct bnxt *bp, ++ struct bnxt_total_ring_err_stats *stats) ++{ ++ int i; ++ ++ for (i = 0; i < bp->cp_nr_rings; i++) ++ bnxt_get_one_ring_err_stats(bp, stats, &bp->bnapi[i]->cp_ring); ++} ++ + static bool bnxt_mc_list_updated(struct bnxt *bp, u32 *rx_mask) + { + struct net_device *dev = bp->dev; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.h b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +index 1d2588c92977e..c872cf1bc8783 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.h ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.h +@@ -950,6 +950,17 @@ struct bnxt_sw_stats { + struct bnxt_cmn_sw_stats cmn; + }; + ++struct bnxt_total_ring_err_stats { ++ u64 rx_total_l4_csum_errors; ++ u64 rx_total_resets; ++ u64 rx_total_buf_errors; ++ u64 rx_total_oom_discards; ++ u64 rx_total_netpoll_discards; ++ u64 rx_total_ring_discards; ++ u64 tx_total_ring_discards; ++ u64 total_missed_irqs; ++}; ++ + struct bnxt_stats_mem { + u64 *sw_stats; + u64 *hw_masks; +@@ -2007,6 +2018,8 @@ struct bnxt { + u8 pri2cos_idx[8]; + u8 pri2cos_valid; + ++ struct bnxt_total_ring_err_stats ring_err_stats_prev; ++ + u16 hwrm_max_req_len; + u16 hwrm_max_ext_req_len; + unsigned int hwrm_cmd_timeout; +@@ -2331,6 +2344,8 @@ int bnxt_half_open_nic(struct bnxt *bp); + void bnxt_half_close_nic(struct bnxt *bp); + void bnxt_reenable_sriov(struct bnxt *bp); + int bnxt_close_nic(struct bnxt *, bool, bool); ++void bnxt_get_ring_err_stats(struct bnxt *bp, ++ struct bnxt_total_ring_err_stats *stats); + int bnxt_dbg_hwrm_rd_reg(struct bnxt *bp, u32 reg_off, u16 num_words, + u32 *reg_buf); + void bnxt_fw_exception(struct bnxt *bp); +-- +2.43.0 + diff --git a/queue-6.1/dpaa2-switch-do-not-ask-for-mdb-vlan-and-fdb-replay.patch b/queue-6.1/dpaa2-switch-do-not-ask-for-mdb-vlan-and-fdb-replay.patch new file mode 100644 index 00000000000..aa50451a1b9 --- /dev/null +++ b/queue-6.1/dpaa2-switch-do-not-ask-for-mdb-vlan-and-fdb-replay.patch @@ -0,0 +1,85 @@ +From bd46e611186b73470f1716e29cda063061dfba85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 18:43:26 +0200 +Subject: dpaa2-switch: do not ask for MDB, VLAN and FDB replay + +From: Ioana Ciornei + +[ Upstream commit f24a49a375f65e8e75ee1b19d806f46dbaae57fd ] + +Starting with commit 4e51bf44a03a ("net: bridge: move the switchdev +object replay helpers to "push" mode") the switchdev_bridge_port_offload() +helper was extended with the intention to provide switchdev drivers easy +access to object addition and deletion replays. This works by calling +the replay helpers with non-NULL notifier blocks. + +In the same commit, the dpaa2-switch driver was updated so that it +passes valid notifier blocks to the helper. At that moment, no +regression was identified through testing. + +In the meantime, the blamed commit changed the behavior in terms of +which ports get hit by the replay. Before this commit, only the initial +port which identified itself as offloaded through +switchdev_bridge_port_offload() got a replay of all port objects and +FDBs. After this, the newly joining port will trigger a replay of +objects on all bridge ports and on the bridge itself. + +This behavior leads to errors in dpaa2_switch_port_vlans_add() when a +VLAN gets installed on the same interface multiple times. + +The intended mechanism to address this is to pass a non-NULL ctx to the +switchdev_bridge_port_offload() helper and then check it against the +port's private structure. But since the driver does not have any use for +the replayed port objects and FDBs until it gains support for LAG +offload, it's better to fix the issue by reverting the dpaa2-switch +driver to not ask for replay. The pointers will be added back when we +are prepared to ignore replays on unrelated ports. + +Fixes: b28d580e2939 ("net: bridge: switchdev: replay all VLAN groups") +Signed-off-by: Ioana Ciornei +Link: https://lore.kernel.org/r/20231212164326.2753457-3-ioana.ciornei@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c | 11 ++--------- + 1 file changed, 2 insertions(+), 9 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +index 2b5909fa93cfa..b98ef4ba172f6 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch.c +@@ -1978,9 +1978,6 @@ static int dpaa2_switch_port_attr_set_event(struct net_device *netdev, + return notifier_from_errno(err); + } + +-static struct notifier_block dpaa2_switch_port_switchdev_nb; +-static struct notifier_block dpaa2_switch_port_switchdev_blocking_nb; +- + static int dpaa2_switch_port_bridge_join(struct net_device *netdev, + struct net_device *upper_dev, + struct netlink_ext_ack *extack) +@@ -2023,9 +2020,7 @@ static int dpaa2_switch_port_bridge_join(struct net_device *netdev, + goto err_egress_flood; + + err = switchdev_bridge_port_offload(netdev, netdev, NULL, +- &dpaa2_switch_port_switchdev_nb, +- &dpaa2_switch_port_switchdev_blocking_nb, +- false, extack); ++ NULL, NULL, false, extack); + if (err) + goto err_switchdev_offload; + +@@ -2059,9 +2054,7 @@ static int dpaa2_switch_port_restore_rxvlan(struct net_device *vdev, int vid, vo + + static void dpaa2_switch_port_pre_bridge_leave(struct net_device *netdev) + { +- switchdev_bridge_port_unoffload(netdev, NULL, +- &dpaa2_switch_port_switchdev_nb, +- &dpaa2_switch_port_switchdev_blocking_nb); ++ switchdev_bridge_port_unoffload(netdev, NULL, NULL, NULL); + } + + static int dpaa2_switch_port_bridge_leave(struct net_device *netdev) +-- +2.43.0 + diff --git a/queue-6.1/dpaa2-switch-fix-size-of-the-dma_unmap.patch b/queue-6.1/dpaa2-switch-fix-size-of-the-dma_unmap.patch new file mode 100644 index 00000000000..b7fc110acc6 --- /dev/null +++ b/queue-6.1/dpaa2-switch-fix-size-of-the-dma_unmap.patch @@ -0,0 +1,50 @@ +From a356504a4a1b313fc4982b66a0fcdb8d68027f7a Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 18:43:25 +0200 +Subject: dpaa2-switch: fix size of the dma_unmap + +From: Ioana Ciornei + +[ Upstream commit 2aad7d4189a923b24efa8ea6ad09059882b1bfe4 ] + +The size of the DMA unmap was wrongly put as a sizeof of a pointer. +Change the value of the DMA unmap to be the actual macro used for the +allocation and the DMA map. + +Fixes: 1110318d83e8 ("dpaa2-switch: add tc flower hardware offload on ingress traffic") +Signed-off-by: Ioana Ciornei +Link: https://lore.kernel.org/r/20231212164326.2753457-2-ioana.ciornei@nxp.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c | 7 ++++--- + 1 file changed, 4 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c +index c39b866e2582d..16d3c3610720b 100644 +--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c ++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-switch-flower.c +@@ -139,7 +139,8 @@ int dpaa2_switch_acl_entry_add(struct dpaa2_switch_filter_block *filter_block, + err = dpsw_acl_add_entry(ethsw->mc_io, 0, ethsw->dpsw_handle, + filter_block->acl_id, acl_entry_cfg); + +- dma_unmap_single(dev, acl_entry_cfg->key_iova, sizeof(cmd_buff), ++ dma_unmap_single(dev, acl_entry_cfg->key_iova, ++ DPAA2_ETHSW_PORT_ACL_CMD_BUF_SIZE, + DMA_TO_DEVICE); + if (err) { + dev_err(dev, "dpsw_acl_add_entry() failed %d\n", err); +@@ -181,8 +182,8 @@ dpaa2_switch_acl_entry_remove(struct dpaa2_switch_filter_block *block, + err = dpsw_acl_remove_entry(ethsw->mc_io, 0, ethsw->dpsw_handle, + block->acl_id, acl_entry_cfg); + +- dma_unmap_single(dev, acl_entry_cfg->key_iova, sizeof(cmd_buff), +- DMA_TO_DEVICE); ++ dma_unmap_single(dev, acl_entry_cfg->key_iova, ++ DPAA2_ETHSW_PORT_ACL_CMD_BUF_SIZE, DMA_TO_DEVICE); + if (err) { + dev_err(dev, "dpsw_acl_remove_entry() failed %d\n", err); + kfree(cmd_buff); +-- +2.43.0 + diff --git a/queue-6.1/iavf-handle-ntuple-on-off-based-on-new-state-machine.patch b/queue-6.1/iavf-handle-ntuple-on-off-based-on-new-state-machine.patch new file mode 100644 index 00000000000..b1cfd1dd955 --- /dev/null +++ b/queue-6.1/iavf-handle-ntuple-on-off-based-on-new-state-machine.patch @@ -0,0 +1,131 @@ +From 0f73e1894870188b01645950ef079bd9d5e88cbc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 22:47:16 -0500 +Subject: iavf: Handle ntuple on/off based on new state machines for flow + director + +From: Piotr Gardocki + +[ Upstream commit 09d23b8918f9ab0f8114f6b94f2faf8bde3fb52a ] + +ntuple-filter feature on/off: +Default is on. If turned off, the filters will be removed from both +PF and iavf list. The removal is irrespective of current filter state. + +Steps to reproduce: +------------------- + +1. Ensure ntuple is on. + +ethtool -K enp8s0 ntuple-filters on + +2. Create a filter to receive the traffic into non-default rx-queue like 15 +and ensure traffic is flowing into queue into 15. +Now, turn off ntuple. Traffic should not flow to configured queue 15. +It should flow to default RX queue. + +Fixes: 0dbfbabb840d ("iavf: Add framework to enable ethtool ntuple filters") +Signed-off-by: Piotr Gardocki +Reviewed-by: Larysa Zaremba +Signed-off-by: Ranganatha Rao +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 59 +++++++++++++++++++++ + 1 file changed, 59 insertions(+) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 3a155026d9a5f..b9c4b311cd625 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -4445,6 +4445,49 @@ static int iavf_change_mtu(struct net_device *netdev, int new_mtu) + return ret; + } + ++/** ++ * iavf_disable_fdir - disable Flow Director and clear existing filters ++ * @adapter: board private structure ++ **/ ++static void iavf_disable_fdir(struct iavf_adapter *adapter) ++{ ++ struct iavf_fdir_fltr *fdir, *fdirtmp; ++ bool del_filters = false; ++ ++ adapter->flags &= ~IAVF_FLAG_FDIR_ENABLED; ++ ++ /* remove all Flow Director filters */ ++ spin_lock_bh(&adapter->fdir_fltr_lock); ++ list_for_each_entry_safe(fdir, fdirtmp, &adapter->fdir_list_head, ++ list) { ++ if (fdir->state == IAVF_FDIR_FLTR_ADD_REQUEST || ++ fdir->state == IAVF_FDIR_FLTR_INACTIVE) { ++ /* Delete filters not registered in PF */ ++ list_del(&fdir->list); ++ kfree(fdir); ++ adapter->fdir_active_fltr--; ++ } else if (fdir->state == IAVF_FDIR_FLTR_ADD_PENDING || ++ fdir->state == IAVF_FDIR_FLTR_DIS_REQUEST || ++ fdir->state == IAVF_FDIR_FLTR_ACTIVE) { ++ /* Filters registered in PF, schedule their deletion */ ++ fdir->state = IAVF_FDIR_FLTR_DEL_REQUEST; ++ del_filters = true; ++ } else if (fdir->state == IAVF_FDIR_FLTR_DIS_PENDING) { ++ /* Request to delete filter already sent to PF, change ++ * state to DEL_PENDING to delete filter after PF's ++ * response, not set as INACTIVE ++ */ ++ fdir->state = IAVF_FDIR_FLTR_DEL_PENDING; ++ } ++ } ++ spin_unlock_bh(&adapter->fdir_fltr_lock); ++ ++ if (del_filters) { ++ adapter->aq_required |= IAVF_FLAG_AQ_DEL_FDIR_FILTER; ++ mod_delayed_work(adapter->wq, &adapter->watchdog_task, 0); ++ } ++} ++ + #define NETIF_VLAN_OFFLOAD_FEATURES (NETIF_F_HW_VLAN_CTAG_RX | \ + NETIF_F_HW_VLAN_CTAG_TX | \ + NETIF_F_HW_VLAN_STAG_RX | \ +@@ -4467,6 +4510,13 @@ static int iavf_set_features(struct net_device *netdev, + iavf_set_vlan_offload_features(adapter, netdev->features, + features); + ++ if ((netdev->features & NETIF_F_NTUPLE) ^ (features & NETIF_F_NTUPLE)) { ++ if (features & NETIF_F_NTUPLE) ++ adapter->flags |= IAVF_FLAG_FDIR_ENABLED; ++ else ++ iavf_disable_fdir(adapter); ++ } ++ + return 0; + } + +@@ -4762,6 +4812,9 @@ static netdev_features_t iavf_fix_features(struct net_device *netdev, + { + struct iavf_adapter *adapter = netdev_priv(netdev); + ++ if (!FDIR_FLTR_SUPPORT(adapter)) ++ features &= ~NETIF_F_NTUPLE; ++ + return iavf_fix_netdev_vlan_features(adapter, features); + } + +@@ -4879,6 +4932,12 @@ int iavf_process_config(struct iavf_adapter *adapter) + if (vfres->vf_cap_flags & VIRTCHNL_VF_OFFLOAD_VLAN) + netdev->features |= NETIF_F_HW_VLAN_CTAG_FILTER; + ++ if (FDIR_FLTR_SUPPORT(adapter)) { ++ netdev->hw_features |= NETIF_F_NTUPLE; ++ netdev->features |= NETIF_F_NTUPLE; ++ adapter->flags |= IAVF_FLAG_FDIR_ENABLED; ++ } ++ + netdev->priv_flags |= IFF_UNICAST_FLT; + + /* Do not turn on offloads when they are requested to be turned off. +-- +2.43.0 + diff --git a/queue-6.1/iavf-introduce-new-state-machines-for-flow-director.patch b/queue-6.1/iavf-introduce-new-state-machines-for-flow-director.patch new file mode 100644 index 00000000000..48f3e04385a --- /dev/null +++ b/queue-6.1/iavf-introduce-new-state-machines-for-flow-director.patch @@ -0,0 +1,407 @@ +From 227ea2c33ee22e533742619ffddf30a317511501 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 21 Nov 2023 22:47:15 -0500 +Subject: iavf: Introduce new state machines for flow director + +From: Piotr Gardocki + +[ Upstream commit 3a0b5a2929fdeda63fc921c2dbed237059acf732 ] + +New states introduced: + + IAVF_FDIR_FLTR_DIS_REQUEST + IAVF_FDIR_FLTR_DIS_PENDING + IAVF_FDIR_FLTR_INACTIVE + +Current FDIR state machines (SM) are not adequate to handle a few +scenarios in the link DOWN/UP event, reset event and ntuple-feature. + +For example, when VF link goes DOWN and comes back UP administratively, +the expectation is that previously installed filters should also be +restored. But with current SM, filters are not restored. +So with new SM, during link DOWN filters are marked as INACTIVE in +the iavf list but removed from PF. After link UP, SM will transition +from INACTIVE to ADD_REQUEST to restore the filter. + +Similarly, with VF reset, filters will be removed from the PF, but +marked as INACTIVE in the iavf list. Filters will be restored after +reset completion. + +Steps to reproduce: +------------------- + +1. Create a VF. Here VF is enp8s0. + +2. Assign IP addresses to VF and link partner and ping continuously +from remote. Here remote IP is 1.1.1.1. + +3. Check default RX Queue of traffic. + +ethtool -S enp8s0 | grep -E "rx-[[:digit:]]+\.packets" + +4. Add filter - change default RX Queue (to 15 here) + +ethtool -U ens8s0 flow-type ip4 src-ip 1.1.1.1 action 15 loc 5 + +5. Ensure filter gets added and traffic is received on RX queue 15 now. + +Link event testing: +------------------- +6. Bring VF link down and up. If traffic flows to configured queue 15, +test is success, otherwise it is a failure. + +Reset event testing: +-------------------- +7. Reset the VF. If traffic flows to configured queue 15, test is success, +otherwise it is a failure. + +Fixes: 0dbfbabb840d ("iavf: Add framework to enable ethtool ntuple filters") +Signed-off-by: Piotr Gardocki +Reviewed-by: Larysa Zaremba +Signed-off-by: Ranganatha Rao +Tested-by: Rafal Romanowski +Signed-off-by: Tony Nguyen +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/iavf/iavf.h | 1 + + .../net/ethernet/intel/iavf/iavf_ethtool.c | 27 ++++--- + drivers/net/ethernet/intel/iavf/iavf_fdir.h | 15 +++- + drivers/net/ethernet/intel/iavf/iavf_main.c | 48 ++++++++++--- + .../net/ethernet/intel/iavf/iavf_virtchnl.c | 71 +++++++++++++++++-- + 5 files changed, 139 insertions(+), 23 deletions(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf.h b/drivers/net/ethernet/intel/iavf/iavf.h +index 7389855fa307a..ee0871d929302 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf.h ++++ b/drivers/net/ethernet/intel/iavf/iavf.h +@@ -303,6 +303,7 @@ struct iavf_adapter { + #define IAVF_FLAG_QUEUES_DISABLED BIT(17) + #define IAVF_FLAG_SETUP_NETDEV_FEATURES BIT(18) + #define IAVF_FLAG_REINIT_MSIX_NEEDED BIT(20) ++#define IAVF_FLAG_FDIR_ENABLED BIT(21) + /* duplicates for common code */ + #define IAVF_FLAG_DCB_ENABLED 0 + /* flags for admin queue service task */ +diff --git a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +index 31e02624aca48..f4ac2b164b3e9 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_ethtool.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_ethtool.c +@@ -1063,7 +1063,7 @@ iavf_get_ethtool_fdir_entry(struct iavf_adapter *adapter, + struct iavf_fdir_fltr *rule = NULL; + int ret = 0; + +- if (!FDIR_FLTR_SUPPORT(adapter)) ++ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) + return -EOPNOTSUPP; + + spin_lock_bh(&adapter->fdir_fltr_lock); +@@ -1205,7 +1205,7 @@ iavf_get_fdir_fltr_ids(struct iavf_adapter *adapter, struct ethtool_rxnfc *cmd, + unsigned int cnt = 0; + int val = 0; + +- if (!FDIR_FLTR_SUPPORT(adapter)) ++ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) + return -EOPNOTSUPP; + + cmd->data = IAVF_MAX_FDIR_FILTERS; +@@ -1397,7 +1397,7 @@ static int iavf_add_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx + int count = 50; + int err; + +- if (!FDIR_FLTR_SUPPORT(adapter)) ++ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) + return -EOPNOTSUPP; + + if (fsp->flow_type & FLOW_MAC_EXT) +@@ -1438,12 +1438,16 @@ static int iavf_add_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx + spin_lock_bh(&adapter->fdir_fltr_lock); + iavf_fdir_list_add_fltr(adapter, fltr); + adapter->fdir_active_fltr++; +- fltr->state = IAVF_FDIR_FLTR_ADD_REQUEST; +- adapter->aq_required |= IAVF_FLAG_AQ_ADD_FDIR_FILTER; ++ if (adapter->link_up) { ++ fltr->state = IAVF_FDIR_FLTR_ADD_REQUEST; ++ adapter->aq_required |= IAVF_FLAG_AQ_ADD_FDIR_FILTER; ++ } else { ++ fltr->state = IAVF_FDIR_FLTR_INACTIVE; ++ } + spin_unlock_bh(&adapter->fdir_fltr_lock); + +- mod_delayed_work(adapter->wq, &adapter->watchdog_task, 0); +- ++ if (adapter->link_up) ++ mod_delayed_work(adapter->wq, &adapter->watchdog_task, 0); + ret: + if (err && fltr) + kfree(fltr); +@@ -1465,7 +1469,7 @@ static int iavf_del_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx + struct iavf_fdir_fltr *fltr = NULL; + int err = 0; + +- if (!FDIR_FLTR_SUPPORT(adapter)) ++ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) + return -EOPNOTSUPP; + + spin_lock_bh(&adapter->fdir_fltr_lock); +@@ -1474,6 +1478,11 @@ static int iavf_del_fdir_ethtool(struct iavf_adapter *adapter, struct ethtool_rx + if (fltr->state == IAVF_FDIR_FLTR_ACTIVE) { + fltr->state = IAVF_FDIR_FLTR_DEL_REQUEST; + adapter->aq_required |= IAVF_FLAG_AQ_DEL_FDIR_FILTER; ++ } else if (fltr->state == IAVF_FDIR_FLTR_INACTIVE) { ++ list_del(&fltr->list); ++ kfree(fltr); ++ adapter->fdir_active_fltr--; ++ fltr = NULL; + } else { + err = -EBUSY; + } +@@ -1782,7 +1791,7 @@ static int iavf_get_rxnfc(struct net_device *netdev, struct ethtool_rxnfc *cmd, + ret = 0; + break; + case ETHTOOL_GRXCLSRLCNT: +- if (!FDIR_FLTR_SUPPORT(adapter)) ++ if (!(adapter->flags & IAVF_FLAG_FDIR_ENABLED)) + break; + spin_lock_bh(&adapter->fdir_fltr_lock); + cmd->rule_cnt = adapter->fdir_active_fltr; +diff --git a/drivers/net/ethernet/intel/iavf/iavf_fdir.h b/drivers/net/ethernet/intel/iavf/iavf_fdir.h +index 9eb9f73f6adf3..d31bd923ba8cb 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_fdir.h ++++ b/drivers/net/ethernet/intel/iavf/iavf_fdir.h +@@ -6,12 +6,25 @@ + + struct iavf_adapter; + +-/* State of Flow Director filter */ ++/* State of Flow Director filter ++ * ++ * *_REQUEST states are used to mark filter to be sent to PF driver to perform ++ * an action (either add or delete filter). *_PENDING states are an indication ++ * that request was sent to PF and the driver is waiting for response. ++ * ++ * Both DELETE and DISABLE states are being used to delete a filter in PF. ++ * The difference is that after a successful response filter in DEL_PENDING ++ * state is being deleted from VF driver as well and filter in DIS_PENDING state ++ * is being changed to INACTIVE state. ++ */ + enum iavf_fdir_fltr_state_t { + IAVF_FDIR_FLTR_ADD_REQUEST, /* User requests to add filter */ + IAVF_FDIR_FLTR_ADD_PENDING, /* Filter pending add by the PF */ + IAVF_FDIR_FLTR_DEL_REQUEST, /* User requests to delete filter */ + IAVF_FDIR_FLTR_DEL_PENDING, /* Filter pending delete by the PF */ ++ IAVF_FDIR_FLTR_DIS_REQUEST, /* Filter scheduled to be disabled */ ++ IAVF_FDIR_FLTR_DIS_PENDING, /* Filter pending disable by the PF */ ++ IAVF_FDIR_FLTR_INACTIVE, /* Filter inactive on link down */ + IAVF_FDIR_FLTR_ACTIVE, /* Filter is active */ + }; + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 4836bac2bd09d..3a155026d9a5f 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -1368,18 +1368,20 @@ static void iavf_clear_cloud_filters(struct iavf_adapter *adapter) + **/ + static void iavf_clear_fdir_filters(struct iavf_adapter *adapter) + { +- struct iavf_fdir_fltr *fdir, *fdirtmp; ++ struct iavf_fdir_fltr *fdir; + + /* remove all Flow Director filters */ + spin_lock_bh(&adapter->fdir_fltr_lock); +- list_for_each_entry_safe(fdir, fdirtmp, &adapter->fdir_list_head, +- list) { ++ list_for_each_entry(fdir, &adapter->fdir_list_head, list) { + if (fdir->state == IAVF_FDIR_FLTR_ADD_REQUEST) { +- list_del(&fdir->list); +- kfree(fdir); +- adapter->fdir_active_fltr--; +- } else { +- fdir->state = IAVF_FDIR_FLTR_DEL_REQUEST; ++ /* Cancel a request, keep filter as inactive */ ++ fdir->state = IAVF_FDIR_FLTR_INACTIVE; ++ } else if (fdir->state == IAVF_FDIR_FLTR_ADD_PENDING || ++ fdir->state == IAVF_FDIR_FLTR_ACTIVE) { ++ /* Disable filters which are active or have a pending ++ * request to PF to be added ++ */ ++ fdir->state = IAVF_FDIR_FLTR_DIS_REQUEST; + } + } + spin_unlock_bh(&adapter->fdir_fltr_lock); +@@ -4210,6 +4212,33 @@ static int iavf_setup_tc(struct net_device *netdev, enum tc_setup_type type, + } + } + ++/** ++ * iavf_restore_fdir_filters ++ * @adapter: board private structure ++ * ++ * Restore existing FDIR filters when VF netdev comes back up. ++ **/ ++static void iavf_restore_fdir_filters(struct iavf_adapter *adapter) ++{ ++ struct iavf_fdir_fltr *f; ++ ++ spin_lock_bh(&adapter->fdir_fltr_lock); ++ list_for_each_entry(f, &adapter->fdir_list_head, list) { ++ if (f->state == IAVF_FDIR_FLTR_DIS_REQUEST) { ++ /* Cancel a request, keep filter as active */ ++ f->state = IAVF_FDIR_FLTR_ACTIVE; ++ } else if (f->state == IAVF_FDIR_FLTR_DIS_PENDING || ++ f->state == IAVF_FDIR_FLTR_INACTIVE) { ++ /* Add filters which are inactive or have a pending ++ * request to PF to be deleted ++ */ ++ f->state = IAVF_FDIR_FLTR_ADD_REQUEST; ++ adapter->aq_required |= IAVF_FLAG_AQ_ADD_FDIR_FILTER; ++ } ++ } ++ spin_unlock_bh(&adapter->fdir_fltr_lock); ++} ++ + /** + * iavf_open - Called when a network interface is made active + * @netdev: network interface device structure +@@ -4277,8 +4306,9 @@ static int iavf_open(struct net_device *netdev) + + spin_unlock_bh(&adapter->mac_vlan_list_lock); + +- /* Restore VLAN filters that were removed with IFF_DOWN */ ++ /* Restore filters that were removed with IFF_DOWN */ + iavf_restore_filters(adapter); ++ iavf_restore_fdir_filters(adapter); + + iavf_configure(adapter); + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +index 5a66b05c03222..951ef350323a2 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c +@@ -1752,8 +1752,8 @@ void iavf_add_fdir_filter(struct iavf_adapter *adapter) + **/ + void iavf_del_fdir_filter(struct iavf_adapter *adapter) + { ++ struct virtchnl_fdir_del f = {}; + struct iavf_fdir_fltr *fdir; +- struct virtchnl_fdir_del f; + bool process_fltr = false; + int len; + +@@ -1770,11 +1770,16 @@ void iavf_del_fdir_filter(struct iavf_adapter *adapter) + list_for_each_entry(fdir, &adapter->fdir_list_head, list) { + if (fdir->state == IAVF_FDIR_FLTR_DEL_REQUEST) { + process_fltr = true; +- memset(&f, 0, len); + f.vsi_id = fdir->vc_add_msg.vsi_id; + f.flow_id = fdir->flow_id; + fdir->state = IAVF_FDIR_FLTR_DEL_PENDING; + break; ++ } else if (fdir->state == IAVF_FDIR_FLTR_DIS_REQUEST) { ++ process_fltr = true; ++ f.vsi_id = fdir->vc_add_msg.vsi_id; ++ f.flow_id = fdir->flow_id; ++ fdir->state = IAVF_FDIR_FLTR_DIS_PENDING; ++ break; + } + } + spin_unlock_bh(&adapter->fdir_fltr_lock); +@@ -1918,6 +1923,48 @@ static void iavf_netdev_features_vlan_strip_set(struct net_device *netdev, + netdev->features &= ~NETIF_F_HW_VLAN_CTAG_RX; + } + ++/** ++ * iavf_activate_fdir_filters - Reactivate all FDIR filters after a reset ++ * @adapter: private adapter structure ++ * ++ * Called after a reset to re-add all FDIR filters and delete some of them ++ * if they were pending to be deleted. ++ */ ++static void iavf_activate_fdir_filters(struct iavf_adapter *adapter) ++{ ++ struct iavf_fdir_fltr *f, *ftmp; ++ bool add_filters = false; ++ ++ spin_lock_bh(&adapter->fdir_fltr_lock); ++ list_for_each_entry_safe(f, ftmp, &adapter->fdir_list_head, list) { ++ if (f->state == IAVF_FDIR_FLTR_ADD_REQUEST || ++ f->state == IAVF_FDIR_FLTR_ADD_PENDING || ++ f->state == IAVF_FDIR_FLTR_ACTIVE) { ++ /* All filters and requests have been removed in PF, ++ * restore them ++ */ ++ f->state = IAVF_FDIR_FLTR_ADD_REQUEST; ++ add_filters = true; ++ } else if (f->state == IAVF_FDIR_FLTR_DIS_REQUEST || ++ f->state == IAVF_FDIR_FLTR_DIS_PENDING) { ++ /* Link down state, leave filters as inactive */ ++ f->state = IAVF_FDIR_FLTR_INACTIVE; ++ } else if (f->state == IAVF_FDIR_FLTR_DEL_REQUEST || ++ f->state == IAVF_FDIR_FLTR_DEL_PENDING) { ++ /* Delete filters that were pending to be deleted, the ++ * list on PF is already cleared after a reset ++ */ ++ list_del(&f->list); ++ kfree(f); ++ adapter->fdir_active_fltr--; ++ } ++ } ++ spin_unlock_bh(&adapter->fdir_fltr_lock); ++ ++ if (add_filters) ++ adapter->aq_required |= IAVF_FLAG_AQ_ADD_FDIR_FILTER; ++} ++ + /** + * iavf_virtchnl_completion + * @adapter: adapter structure +@@ -2095,7 +2142,8 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + spin_lock_bh(&adapter->fdir_fltr_lock); + list_for_each_entry(fdir, &adapter->fdir_list_head, + list) { +- if (fdir->state == IAVF_FDIR_FLTR_DEL_PENDING) { ++ if (fdir->state == IAVF_FDIR_FLTR_DEL_PENDING || ++ fdir->state == IAVF_FDIR_FLTR_DIS_PENDING) { + fdir->state = IAVF_FDIR_FLTR_ACTIVE; + dev_info(&adapter->pdev->dev, "Failed to del Flow Director filter, error %s\n", + iavf_stat_str(&adapter->hw, +@@ -2232,6 +2280,8 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + + spin_unlock_bh(&adapter->mac_vlan_list_lock); + ++ iavf_activate_fdir_filters(adapter); ++ + iavf_parse_vf_resource_msg(adapter); + + /* negotiated VIRTCHNL_VF_OFFLOAD_VLAN_V2, so wait for the +@@ -2421,7 +2471,9 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + list_for_each_entry_safe(fdir, fdir_tmp, &adapter->fdir_list_head, + list) { + if (fdir->state == IAVF_FDIR_FLTR_DEL_PENDING) { +- if (del_fltr->status == VIRTCHNL_FDIR_SUCCESS) { ++ if (del_fltr->status == VIRTCHNL_FDIR_SUCCESS || ++ del_fltr->status == ++ VIRTCHNL_FDIR_FAILURE_RULE_NONEXIST) { + dev_info(&adapter->pdev->dev, "Flow Director filter with location %u is deleted\n", + fdir->loc); + list_del(&fdir->list); +@@ -2433,6 +2485,17 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter, + del_fltr->status); + iavf_print_fdir_fltr(adapter, fdir); + } ++ } else if (fdir->state == IAVF_FDIR_FLTR_DIS_PENDING) { ++ if (del_fltr->status == VIRTCHNL_FDIR_SUCCESS || ++ del_fltr->status == ++ VIRTCHNL_FDIR_FAILURE_RULE_NONEXIST) { ++ fdir->state = IAVF_FDIR_FLTR_INACTIVE; ++ } else { ++ fdir->state = IAVF_FDIR_FLTR_ACTIVE; ++ dev_info(&adapter->pdev->dev, "Failed to disable Flow Director filter with status: %d\n", ++ del_fltr->status); ++ iavf_print_fdir_fltr(adapter, fdir); ++ } + } + } + spin_unlock_bh(&adapter->fdir_fltr_lock); +-- +2.43.0 + diff --git a/queue-6.1/net-atlantic-fix-double-free-in-ring-reinit-logic.patch b/queue-6.1/net-atlantic-fix-double-free-in-ring-reinit-logic.patch new file mode 100644 index 00000000000..a7b6bdca817 --- /dev/null +++ b/queue-6.1/net-atlantic-fix-double-free-in-ring-reinit-logic.patch @@ -0,0 +1,56 @@ +From a4c60de09efdbced729a6aa1c10b05a66d977be1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 10:40:44 +0100 +Subject: net: atlantic: fix double free in ring reinit logic + +From: Igor Russkikh + +[ Upstream commit 7bb26ea74aa86fdf894b7dbd8c5712c5b4187da7 ] + +Driver has a logic leak in ring data allocation/free, +where double free may happen in aq_ring_free if system is under +stress and driver init/deinit is happening. + +The probability is higher to get this during suspend/resume cycle. + +Verification was done simulating same conditions with + + stress -m 2000 --vm-bytes 20M --vm-hang 10 --backoff 1000 + while true; do sudo ifconfig enp1s0 down; sudo ifconfig enp1s0 up; done + +Fixed by explicitly clearing pointers to NULL on deallocation + +Fixes: 018423e90bee ("net: ethernet: aquantia: Add ring support code") +Reported-by: Linus Torvalds +Closes: https://lore.kernel.org/netdev/CAHk-=wiZZi7FcvqVSUirHBjx0bBUZ4dFrMDVLc3+3HCrtq0rBA@mail.gmail.com/ +Signed-off-by: Igor Russkikh +Link: https://lore.kernel.org/r/20231213094044.22988-1-irusskikh@marvell.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/aquantia/atlantic/aq_ring.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index b5a49166fa972..4d9d7d1edb9b3 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -938,11 +938,14 @@ void aq_ring_free(struct aq_ring_s *self) + return; + + kfree(self->buff_ring); ++ self->buff_ring = NULL; + +- if (self->dx_ring) ++ if (self->dx_ring) { + dma_free_coherent(aq_nic_get_dev(self->aq_nic), + self->size * self->dx_size, self->dx_ring, + self->dx_ring_pa); ++ self->dx_ring = NULL; ++ } + } + + unsigned int aq_ring_fill_stats_data(struct aq_ring_s *self, u64 *data) +-- +2.43.0 + diff --git a/queue-6.1/net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch b/queue-6.1/net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch new file mode 100644 index 00000000000..2e429f8f3ac --- /dev/null +++ b/queue-6.1/net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch @@ -0,0 +1,71 @@ +From 54b1ef854d1185b560dd5adcf7feb804f7181a46 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 06:27:58 +0000 +Subject: net: ena: Destroy correct number of xdp queues upon failure + +From: David Arinzon + +[ Upstream commit 41db6f99b5489a0d2ef26afe816ef0c6118d1d47 ] + +The ena_setup_and_create_all_xdp_queues() function freed all the +resources upon failure, after creating only xdp_num_queues queues, +instead of freeing just the created ones. + +In this patch, the only resources that are freed, are the ones +allocated right before the failure occurs. + +Fixes: 548c4940b9f1 ("net: ena: Implement XDP_TX action") +Signed-off-by: Shahar Itzko +Signed-off-by: David Arinzon +Link: https://lore.kernel.org/r/20231211062801.27891-2-darinzon@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 13 +++++++------ + 1 file changed, 7 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index 42a66b74c1e5b..d7392dabde1e3 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -74,6 +74,8 @@ static void ena_unmap_tx_buff(struct ena_ring *tx_ring, + struct ena_tx_buffer *tx_info); + static int ena_create_io_tx_queues_in_range(struct ena_adapter *adapter, + int first_index, int count); ++static void ena_free_all_io_tx_resources_in_range(struct ena_adapter *adapter, ++ int first_index, int count); + + /* Increase a stat by cnt while holding syncp seqlock on 32bit machines */ + static void ena_increase_stat(u64 *statp, u64 cnt, +@@ -457,23 +459,22 @@ static void ena_init_all_xdp_queues(struct ena_adapter *adapter) + + static int ena_setup_and_create_all_xdp_queues(struct ena_adapter *adapter) + { ++ u32 xdp_first_ring = adapter->xdp_first_ring; ++ u32 xdp_num_queues = adapter->xdp_num_queues; + int rc = 0; + +- rc = ena_setup_tx_resources_in_range(adapter, adapter->xdp_first_ring, +- adapter->xdp_num_queues); ++ rc = ena_setup_tx_resources_in_range(adapter, xdp_first_ring, xdp_num_queues); + if (rc) + goto setup_err; + +- rc = ena_create_io_tx_queues_in_range(adapter, +- adapter->xdp_first_ring, +- adapter->xdp_num_queues); ++ rc = ena_create_io_tx_queues_in_range(adapter, xdp_first_ring, xdp_num_queues); + if (rc) + goto create_err; + + return 0; + + create_err: +- ena_free_all_io_tx_resources(adapter); ++ ena_free_all_io_tx_resources_in_range(adapter, xdp_first_ring, xdp_num_queues); + setup_err: + return rc; + } +-- +2.43.0 + diff --git a/queue-6.1/net-ena-fix-xdp-drops-handling-due-to-multibuf-packe.patch b/queue-6.1/net-ena-fix-xdp-drops-handling-due-to-multibuf-packe.patch new file mode 100644 index 00000000000..5719e980ff3 --- /dev/null +++ b/queue-6.1/net-ena-fix-xdp-drops-handling-due-to-multibuf-packe.patch @@ -0,0 +1,77 @@ +From 2abc26be81f15381fd28ddb092cd43c3b5f3ce05 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 06:27:59 +0000 +Subject: net: ena: Fix xdp drops handling due to multibuf packets + +From: David Arinzon + +[ Upstream commit 505b1a88d311ff6f8c44a34f94e3be21745cce6f ] + +Current xdp code drops packets larger than ENA_XDP_MAX_MTU. +This is an incorrect condition since the problem is not the +size of the packet, rather the number of buffers it contains. + +This commit: + +1. Identifies and drops XDP multi-buffer packets at the + beginning of the function. +2. Increases the xdp drop statistic when this drop occurs. +3. Adds a one-time print that such drops are happening to + give better indication to the user. + +Fixes: 838c93dc5449 ("net: ena: implement XDP drop support") +Signed-off-by: Arthur Kiyanovski +Signed-off-by: David Arinzon +Link: https://lore.kernel.org/r/20231211062801.27891-3-darinzon@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_netdev.c | 17 ++++++++++------- + 1 file changed, 10 insertions(+), 7 deletions(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index d7392dabde1e3..044b8afde69a0 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1618,20 +1618,23 @@ static void ena_set_rx_hash(struct ena_ring *rx_ring, + } + } + +-static int ena_xdp_handle_buff(struct ena_ring *rx_ring, struct xdp_buff *xdp) ++static int ena_xdp_handle_buff(struct ena_ring *rx_ring, struct xdp_buff *xdp, u16 num_descs) + { + struct ena_rx_buffer *rx_info; + int ret; + ++ /* XDP multi-buffer packets not supported */ ++ if (unlikely(num_descs > 1)) { ++ netdev_err_once(rx_ring->adapter->netdev, ++ "xdp: dropped unsupported multi-buffer packets\n"); ++ ena_increase_stat(&rx_ring->rx_stats.xdp_drop, 1, &rx_ring->syncp); ++ return ENA_XDP_DROP; ++ } ++ + rx_info = &rx_ring->rx_buffer_info[rx_ring->ena_bufs[0].req_id]; + xdp_prepare_buff(xdp, page_address(rx_info->page), + rx_info->page_offset, + rx_ring->ena_bufs[0].len, false); +- /* If for some reason we received a bigger packet than +- * we expect, then we simply drop it +- */ +- if (unlikely(rx_ring->ena_bufs[0].len > ENA_XDP_MAX_MTU)) +- return ENA_XDP_DROP; + + ret = ena_xdp_execute(rx_ring, xdp); + +@@ -1700,7 +1703,7 @@ static int ena_clean_rx_irq(struct ena_ring *rx_ring, struct napi_struct *napi, + ena_rx_ctx.l4_proto, ena_rx_ctx.hash); + + if (ena_xdp_present_ring(rx_ring)) +- xdp_verdict = ena_xdp_handle_buff(rx_ring, &xdp); ++ xdp_verdict = ena_xdp_handle_buff(rx_ring, &xdp, ena_rx_ctx.descs); + + /* allocate skb and fill it */ + if (xdp_verdict == ENA_XDP_PASS) +-- +2.43.0 + diff --git a/queue-6.1/net-ena-fix-xdp-redirection-error.patch b/queue-6.1/net-ena-fix-xdp-redirection-error.patch new file mode 100644 index 00000000000..7686057a2dd --- /dev/null +++ b/queue-6.1/net-ena-fix-xdp-redirection-error.patch @@ -0,0 +1,43 @@ +From 23fda32db46d544505e250c536f2c74078905355 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 06:28:01 +0000 +Subject: net: ena: Fix XDP redirection error + +From: David Arinzon + +[ Upstream commit 4ab138ca0a340e6d6e7a6a9bd5004bd8f83127ca ] + +When sending TX packets, the meta descriptor can be all zeroes +as no meta information is required (as in XDP). + +This patch removes the validity check, as when +`disable_meta_caching` is enabled, such TX packets will be +dropped otherwise. + +Fixes: 0e3a3f6dacf0 ("net: ena: support new LLQ acceleration mode") +Signed-off-by: Shay Agroskin +Signed-off-by: David Arinzon +Link: https://lore.kernel.org/r/20231211062801.27891-5-darinzon@amazon.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amazon/ena/ena_eth_com.c | 3 --- + 1 file changed, 3 deletions(-) + +diff --git a/drivers/net/ethernet/amazon/ena/ena_eth_com.c b/drivers/net/ethernet/amazon/ena/ena_eth_com.c +index 3d6f0a466a9ed..f9f886289b970 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_eth_com.c ++++ b/drivers/net/ethernet/amazon/ena/ena_eth_com.c +@@ -328,9 +328,6 @@ static int ena_com_create_and_store_tx_meta_desc(struct ena_com_io_sq *io_sq, + * compare it to the stored version, just create the meta + */ + if (io_sq->disable_meta_caching) { +- if (unlikely(!ena_tx_ctx->meta_valid)) +- return -EINVAL; +- + *have_meta = true; + return ena_com_create_meta(io_sq, ena_meta); + } +-- +2.43.0 + diff --git a/queue-6.1/net-fec-correct-queue-selection.patch b/queue-6.1/net-fec-correct-queue-selection.patch new file mode 100644 index 00000000000..75d379e8352 --- /dev/null +++ b/queue-6.1/net-fec-correct-queue-selection.patch @@ -0,0 +1,81 @@ +From 7ca2856483bab5985bb8ee057c988557d4eae1b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 16:38:01 +0800 +Subject: net: fec: correct queue selection + +From: Radu Bulie + +[ Upstream commit 9fc95fe95c3e2a63ced8eeca4b256518ab204b63 ] + +The old implementation extracted VLAN TCI info from the payload +before the VLAN tag has been pushed in the payload. + +Another problem was that the VLAN TCI was extracted even if the +packet did not have VLAN protocol header. + +This resulted in invalid VLAN TCI and as a consequence a random +queue was computed. + +This patch fixes the above issues and use the VLAN TCI from the +skb if it is present or VLAN TCI from payload if present. If no +VLAN header is present queue 0 is selected. + +Fixes: 52c4a1a85f4b ("net: fec: add ndo_select_queue to fix TX bandwidth fluctuations") +Signed-off-by: Radu Bulie +Signed-off-by: Wei Fang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/freescale/fec_main.c | 27 +++++++++-------------- + 1 file changed, 11 insertions(+), 16 deletions(-) + +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 33226a22d8a4a..6d1b760022821 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -3541,31 +3541,26 @@ static int fec_set_features(struct net_device *netdev, + return 0; + } + +-static u16 fec_enet_get_raw_vlan_tci(struct sk_buff *skb) +-{ +- struct vlan_ethhdr *vhdr; +- unsigned short vlan_TCI = 0; +- +- if (skb->protocol == htons(ETH_P_ALL)) { +- vhdr = (struct vlan_ethhdr *)(skb->data); +- vlan_TCI = ntohs(vhdr->h_vlan_TCI); +- } +- +- return vlan_TCI; +-} +- + static u16 fec_enet_select_queue(struct net_device *ndev, struct sk_buff *skb, + struct net_device *sb_dev) + { + struct fec_enet_private *fep = netdev_priv(ndev); +- u16 vlan_tag; ++ u16 vlan_tag = 0; + + if (!(fep->quirks & FEC_QUIRK_HAS_AVB)) + return netdev_pick_tx(ndev, skb, NULL); + +- vlan_tag = fec_enet_get_raw_vlan_tci(skb); +- if (!vlan_tag) ++ /* VLAN is present in the payload.*/ ++ if (eth_type_vlan(skb->protocol)) { ++ struct vlan_ethhdr *vhdr = skb_vlan_eth_hdr(skb); ++ ++ vlan_tag = ntohs(vhdr->h_vlan_TCI); ++ /* VLAN is present in the skb but not yet pushed in the payload.*/ ++ } else if (skb_vlan_tag_present(skb)) { ++ vlan_tag = skb->vlan_tci; ++ } else { + return vlan_tag; ++ } + + return fec_enet_vlan_pri_to_queue[vlan_tag >> 13]; + } +-- +2.43.0 + diff --git a/queue-6.1/net-ipv6-support-reporting-otherwise-unknown-prefix-.patch b/queue-6.1/net-ipv6-support-reporting-otherwise-unknown-prefix-.patch new file mode 100644 index 00000000000..a7fe2f3d44e --- /dev/null +++ b/queue-6.1/net-ipv6-support-reporting-otherwise-unknown-prefix-.patch @@ -0,0 +1,114 @@ +From e7aa6216fc2e8b01f0fbcea424b4fb698837ca35 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 09:36:12 -0800 +Subject: net: ipv6: support reporting otherwise unknown prefix flags in + RTM_NEWPREFIX +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Maciej Żenczykowski + +[ Upstream commit bd4a816752bab609dd6d65ae021387beb9e2ddbd ] + +Lorenzo points out that we effectively clear all unknown +flags from PIO when copying them to userspace in the netlink +RTM_NEWPREFIX notification. + +We could fix this one at a time as new flags are defined, +or in one fell swoop - I choose the latter. + +We could either define 6 new reserved flags (reserved1..6) and handle +them individually (and rename them as new flags are defined), or we +could simply copy the entire unmodified byte over - I choose the latter. + +This unfortunately requires some anonymous union/struct magic, +so we add a static assert on the struct size for a little extra safety. + +Cc: David Ahern +Cc: Lorenzo Colitti +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Maciej Żenczykowski +Reviewed-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/addrconf.h | 12 ++++++++++-- + include/net/if_inet6.h | 4 ---- + net/ipv6/addrconf.c | 6 +----- + 3 files changed, 11 insertions(+), 11 deletions(-) + +diff --git a/include/net/addrconf.h b/include/net/addrconf.h +index c04f359655b86..86eb2aba1479c 100644 +--- a/include/net/addrconf.h ++++ b/include/net/addrconf.h +@@ -31,17 +31,22 @@ struct prefix_info { + __u8 length; + __u8 prefix_len; + ++ union __packed { ++ __u8 flags; ++ struct __packed { + #if defined(__BIG_ENDIAN_BITFIELD) +- __u8 onlink : 1, ++ __u8 onlink : 1, + autoconf : 1, + reserved : 6; + #elif defined(__LITTLE_ENDIAN_BITFIELD) +- __u8 reserved : 6, ++ __u8 reserved : 6, + autoconf : 1, + onlink : 1; + #else + #error "Please fix " + #endif ++ }; ++ }; + __be32 valid; + __be32 prefered; + __be32 reserved2; +@@ -49,6 +54,9 @@ struct prefix_info { + struct in6_addr prefix; + }; + ++/* rfc4861 4.6.2: IPv6 PIO is 32 bytes in size */ ++static_assert(sizeof(struct prefix_info) == 32); ++ + #include + #include + #include +diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h +index c8490729b4aea..31bf475eca762 100644 +--- a/include/net/if_inet6.h ++++ b/include/net/if_inet6.h +@@ -22,10 +22,6 @@ + #define IF_RS_SENT 0x10 + #define IF_READY 0x80000000 + +-/* prefix flags */ +-#define IF_PREFIX_ONLINK 0x01 +-#define IF_PREFIX_AUTOCONF 0x02 +- + enum { + INET6_IFADDR_STATE_PREDAD, + INET6_IFADDR_STATE_DAD, +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index c63ccd39fc552..b8dc20fe7a4e2 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -6105,11 +6105,7 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev, + pmsg->prefix_len = pinfo->prefix_len; + pmsg->prefix_type = pinfo->type; + pmsg->prefix_pad3 = 0; +- pmsg->prefix_flags = 0; +- if (pinfo->onlink) +- pmsg->prefix_flags |= IF_PREFIX_ONLINK; +- if (pinfo->autoconf) +- pmsg->prefix_flags |= IF_PREFIX_AUTOCONF; ++ pmsg->prefix_flags = pinfo->flags; + + if (nla_put(skb, PREFIX_ADDRESS, sizeof(pinfo->prefix), &pinfo->prefix)) + goto nla_put_failure; +-- +2.43.0 + diff --git a/queue-6.1/net-mlx5e-fix-possible-deadlock-on-mlx5e_tx_timeout_.patch b/queue-6.1/net-mlx5e-fix-possible-deadlock-on-mlx5e_tx_timeout_.patch new file mode 100644 index 00000000000..5aa51637aa6 --- /dev/null +++ b/queue-6.1/net-mlx5e-fix-possible-deadlock-on-mlx5e_tx_timeout_.patch @@ -0,0 +1,243 @@ +From 7b37b802bc47c406fbcc8f22765052a9d1a5e4c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 21 Sep 2022 18:45:11 +0300 +Subject: net/mlx5e: Fix possible deadlock on mlx5e_tx_timeout_work + +From: Moshe Shemesh + +[ Upstream commit eab0da38912ebdad922ed0388209f7eb0a5163cd ] + +Due to the cited patch, devlink health commands take devlink lock and +this may result in deadlock for mlx5e_tx_reporter as it takes local +state_lock before calling devlink health report and on the other hand +devlink health commands such as diagnose for same reporter take local +state_lock after taking devlink lock (see kernel log below). + +To fix it, remove local state_lock from mlx5e_tx_timeout_work() before +calling devlink_health_report() and take care to cancel the work before +any call to close channels, which may free the SQs that should be +handled by the work. Before cancel_work_sync(), use current_work() to +check we are not calling it from within the work, as +mlx5e_tx_timeout_work() itself may close the channels and reopen as part +of recovery flow. + +While removing state_lock from mlx5e_tx_timeout_work() keep rtnl_lock to +ensure no change in netdev->real_num_tx_queues, but use rtnl_trylock() +and a flag to avoid deadlock by calling cancel_work_sync() before +closing the channels while holding rtnl_lock too. + +Kernel log: +====================================================== +WARNING: possible circular locking dependency detected +6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1 Not tainted +------------------------------------------------------ +kworker/u16:2/65 is trying to acquire lock: +ffff888122f6c2f8 (&devlink->lock_key#2){+.+.}-{3:3}, at: devlink_health_report+0x2f1/0x7e0 + +but task is already holding lock: +ffff888121d20be0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_tx_timeout_work+0x70/0x280 [mlx5_core] + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + +-> #1 (&priv->state_lock){+.+.}-{3:3}: + __mutex_lock+0x12c/0x14b0 + mlx5e_rx_reporter_diagnose+0x71/0x700 [mlx5_core] + devlink_nl_cmd_health_reporter_diagnose_doit+0x212/0xa50 + genl_family_rcv_msg_doit+0x1e9/0x2f0 + genl_rcv_msg+0x2e9/0x530 + netlink_rcv_skb+0x11d/0x340 + genl_rcv+0x24/0x40 + netlink_unicast+0x438/0x710 + netlink_sendmsg+0x788/0xc40 + sock_sendmsg+0xb0/0xe0 + __sys_sendto+0x1c1/0x290 + __x64_sys_sendto+0xdd/0x1b0 + do_syscall_64+0x3d/0x90 + entry_SYSCALL_64_after_hwframe+0x46/0xb0 + +-> #0 (&devlink->lock_key#2){+.+.}-{3:3}: + __lock_acquire+0x2c8a/0x6200 + lock_acquire+0x1c1/0x550 + __mutex_lock+0x12c/0x14b0 + devlink_health_report+0x2f1/0x7e0 + mlx5e_health_report+0xc9/0xd7 [mlx5_core] + mlx5e_reporter_tx_timeout+0x2ab/0x3d0 [mlx5_core] + mlx5e_tx_timeout_work+0x1c1/0x280 [mlx5_core] + process_one_work+0x7c2/0x1340 + worker_thread+0x59d/0xec0 + kthread+0x28f/0x330 + ret_from_fork+0x1f/0x30 + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(&priv->state_lock); + lock(&devlink->lock_key#2); + lock(&priv->state_lock); + lock(&devlink->lock_key#2); + + *** DEADLOCK *** + +4 locks held by kworker/u16:2/65: + #0: ffff88811a55b138 ((wq_completion)mlx5e#2){+.+.}-{0:0}, at: process_one_work+0x6e2/0x1340 + #1: ffff888101de7db8 ((work_completion)(&priv->tx_timeout_work)){+.+.}-{0:0}, at: process_one_work+0x70f/0x1340 + #2: ffffffff84ce8328 (rtnl_mutex){+.+.}-{3:3}, at: mlx5e_tx_timeout_work+0x53/0x280 [mlx5_core] + #3: ffff888121d20be0 (&priv->state_lock){+.+.}-{3:3}, at: mlx5e_tx_timeout_work+0x70/0x280 [mlx5_core] + +stack backtrace: +CPU: 1 PID: 65 Comm: kworker/u16:2 Not tainted 6.0.0-rc3_for_upstream_debug_2022_08_30_13_10 #1 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 +Workqueue: mlx5e mlx5e_tx_timeout_work [mlx5_core] +Call Trace: + + dump_stack_lvl+0x57/0x7d + check_noncircular+0x278/0x300 + ? print_circular_bug+0x460/0x460 + ? find_held_lock+0x2d/0x110 + ? __stack_depot_save+0x24c/0x520 + ? alloc_chain_hlocks+0x228/0x700 + __lock_acquire+0x2c8a/0x6200 + ? register_lock_class+0x1860/0x1860 + ? kasan_save_stack+0x1e/0x40 + ? kasan_set_free_info+0x20/0x30 + ? ____kasan_slab_free+0x11d/0x1b0 + ? kfree+0x1ba/0x520 + ? devlink_health_do_dump.part.0+0x171/0x3a0 + ? devlink_health_report+0x3d5/0x7e0 + lock_acquire+0x1c1/0x550 + ? devlink_health_report+0x2f1/0x7e0 + ? lockdep_hardirqs_on_prepare+0x400/0x400 + ? find_held_lock+0x2d/0x110 + __mutex_lock+0x12c/0x14b0 + ? devlink_health_report+0x2f1/0x7e0 + ? devlink_health_report+0x2f1/0x7e0 + ? mutex_lock_io_nested+0x1320/0x1320 + ? trace_hardirqs_on+0x2d/0x100 + ? bit_wait_io_timeout+0x170/0x170 + ? devlink_health_do_dump.part.0+0x171/0x3a0 + ? kfree+0x1ba/0x520 + ? devlink_health_do_dump.part.0+0x171/0x3a0 + devlink_health_report+0x2f1/0x7e0 + mlx5e_health_report+0xc9/0xd7 [mlx5_core] + mlx5e_reporter_tx_timeout+0x2ab/0x3d0 [mlx5_core] + ? lockdep_hardirqs_on_prepare+0x400/0x400 + ? mlx5e_reporter_tx_err_cqe+0x1b0/0x1b0 [mlx5_core] + ? mlx5e_tx_reporter_timeout_dump+0x70/0x70 [mlx5_core] + ? mlx5e_tx_reporter_dump_sq+0x320/0x320 [mlx5_core] + ? mlx5e_tx_timeout_work+0x70/0x280 [mlx5_core] + ? mutex_lock_io_nested+0x1320/0x1320 + ? process_one_work+0x70f/0x1340 + ? lockdep_hardirqs_on_prepare+0x400/0x400 + ? lock_downgrade+0x6e0/0x6e0 + mlx5e_tx_timeout_work+0x1c1/0x280 [mlx5_core] + process_one_work+0x7c2/0x1340 + ? lockdep_hardirqs_on_prepare+0x400/0x400 + ? pwq_dec_nr_in_flight+0x230/0x230 + ? rwlock_bug.part.0+0x90/0x90 + worker_thread+0x59d/0xec0 + ? process_one_work+0x1340/0x1340 + kthread+0x28f/0x330 + ? kthread_complete_and_exit+0x20/0x20 + ret_from_fork+0x1f/0x30 + + +Fixes: c90005b5f75c ("devlink: Hold the instance lock in health callbacks") +Signed-off-by: Moshe Shemesh +Reviewed-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en.h | 1 + + .../net/ethernet/mellanox/mlx5/core/en_main.c | 27 ++++++++++++++++--- + 2 files changed, 25 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en.h b/drivers/net/ethernet/mellanox/mlx5/core/en.h +index bc76fe6b06230..0ee456480a488 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en.h +@@ -847,6 +847,7 @@ enum { + MLX5E_STATE_DESTROYING, + MLX5E_STATE_XDP_TX_ENABLED, + MLX5E_STATE_XDP_ACTIVE, ++ MLX5E_STATE_CHANNELS_ACTIVE, + }; + + struct mlx5e_modify_sq_param { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +index 42e6f2fcf5f59..9910a0480f589 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c +@@ -2586,6 +2586,7 @@ void mlx5e_close_channels(struct mlx5e_channels *chs) + { + int i; + ++ ASSERT_RTNL(); + if (chs->ptp) { + mlx5e_ptp_close(chs->ptp); + chs->ptp = NULL; +@@ -2865,17 +2866,29 @@ void mlx5e_activate_priv_channels(struct mlx5e_priv *priv) + if (mlx5e_is_vport_rep(priv)) + mlx5e_rep_activate_channels(priv); + ++ set_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state); ++ + mlx5e_wait_channels_min_rx_wqes(&priv->channels); + + if (priv->rx_res) + mlx5e_rx_res_channels_activate(priv->rx_res, &priv->channels); + } + ++static void mlx5e_cancel_tx_timeout_work(struct mlx5e_priv *priv) ++{ ++ WARN_ON_ONCE(test_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state)); ++ if (current_work() != &priv->tx_timeout_work) ++ cancel_work_sync(&priv->tx_timeout_work); ++} ++ + void mlx5e_deactivate_priv_channels(struct mlx5e_priv *priv) + { + if (priv->rx_res) + mlx5e_rx_res_channels_deactivate(priv->rx_res); + ++ clear_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state); ++ mlx5e_cancel_tx_timeout_work(priv); ++ + if (mlx5e_is_vport_rep(priv)) + mlx5e_rep_deactivate_channels(priv); + +@@ -4617,8 +4630,17 @@ static void mlx5e_tx_timeout_work(struct work_struct *work) + struct net_device *netdev = priv->netdev; + int i; + +- rtnl_lock(); +- mutex_lock(&priv->state_lock); ++ /* Take rtnl_lock to ensure no change in netdev->real_num_tx_queues ++ * through this flow. However, channel closing flows have to wait for ++ * this work to finish while holding rtnl lock too. So either get the ++ * lock or find that channels are being closed for other reason and ++ * this work is not relevant anymore. ++ */ ++ while (!rtnl_trylock()) { ++ if (!test_bit(MLX5E_STATE_CHANNELS_ACTIVE, &priv->state)) ++ return; ++ msleep(20); ++ } + + if (!test_bit(MLX5E_STATE_OPENED, &priv->state)) + goto unlock; +@@ -4637,7 +4659,6 @@ static void mlx5e_tx_timeout_work(struct work_struct *work) + } + + unlock: +- mutex_unlock(&priv->state_lock); + rtnl_unlock(); + } + +-- +2.43.0 + diff --git a/queue-6.1/net-remove-acked-syn-flag-from-packet-in-the-transmi.patch b/queue-6.1/net-remove-acked-syn-flag-from-packet-in-the-transmi.patch new file mode 100644 index 00000000000..ed04c50ab9d --- /dev/null +++ b/queue-6.1/net-remove-acked-syn-flag-from-packet-in-the-transmi.patch @@ -0,0 +1,111 @@ +From 56c22a23292ea4430f4a899951fd301455d3d7ea Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Dec 2023 10:02:00 +0800 +Subject: net: Remove acked SYN flag from packet in the transmit queue + correctly + +From: Dong Chenchen + +[ Upstream commit f99cd56230f56c8b6b33713c5be4da5d6766be1f ] + +syzkaller report: + + kernel BUG at net/core/skbuff.c:3452! + invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI + CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.7.0-rc4-00009-gbee0e7762ad2-dirty #135 + RIP: 0010:skb_copy_and_csum_bits (net/core/skbuff.c:3452) + Call Trace: + icmp_glue_bits (net/ipv4/icmp.c:357) + __ip_append_data.isra.0 (net/ipv4/ip_output.c:1165) + ip_append_data (net/ipv4/ip_output.c:1362 net/ipv4/ip_output.c:1341) + icmp_push_reply (net/ipv4/icmp.c:370) + __icmp_send (./include/net/route.h:252 net/ipv4/icmp.c:772) + ip_fragment.constprop.0 (./include/linux/skbuff.h:1234 net/ipv4/ip_output.c:592 net/ipv4/ip_output.c:577) + __ip_finish_output (net/ipv4/ip_output.c:311 net/ipv4/ip_output.c:295) + ip_output (net/ipv4/ip_output.c:427) + __ip_queue_xmit (net/ipv4/ip_output.c:535) + __tcp_transmit_skb (net/ipv4/tcp_output.c:1462) + __tcp_retransmit_skb (net/ipv4/tcp_output.c:3387) + tcp_retransmit_skb (net/ipv4/tcp_output.c:3404) + tcp_retransmit_timer (net/ipv4/tcp_timer.c:604) + tcp_write_timer (./include/linux/spinlock.h:391 net/ipv4/tcp_timer.c:716) + +The panic issue was trigered by tcp simultaneous initiation. +The initiation process is as follows: + + TCP A TCP B + + 1. CLOSED CLOSED + + 2. SYN-SENT --> ... + + 3. SYN-RECEIVED <-- <-- SYN-SENT + + 4. ... --> SYN-RECEIVED + + 5. SYN-RECEIVED --> ... + + // TCP B: not send challenge ack for ack limit or packet loss + // TCP A: close + tcp_close + tcp_send_fin + if (!tskb && tcp_under_memory_pressure(sk)) + tskb = skb_rb_last(&sk->tcp_rtx_queue); //pick SYN_ACK packet + TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN; // set FIN flag + + 6. FIN_WAIT_1 --> ... + + // TCP B: send challenge ack to SYN_FIN_ACK + + 7. ... <-- SYN-RECEIVED //challenge ack + + // TCP A: + + 8. FIN_WAIT_1 --> ... // retransmit panic + + __tcp_retransmit_skb //skb->len=0 + tcp_trim_head + len = tp->snd_una - TCP_SKB_CB(skb)->seq // len=101-100 + __pskb_trim_head + skb->data_len -= len // skb->len=-1, wrap around + ... ... + ip_fragment + icmp_glue_bits //BUG_ON + +If we use tcp_trim_head() to remove acked SYN from packet that contains data +or other flags, skb->len will be incorrectly decremented. We can remove SYN +flag that has been acked from rtx_queue earlier than tcp_trim_head(), which +can fix the problem mentioned above. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Co-developed-by: Eric Dumazet +Signed-off-by: Eric Dumazet +Signed-off-by: Dong Chenchen +Link: https://lore.kernel.org/r/20231210020200.1539875-1-dongchenchen2@huawei.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/ipv4/tcp_output.c | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 5b93d1ed1ed19..67087da45a1f7 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -3210,7 +3210,13 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb, int segs) + if (skb_still_in_host_queue(sk, skb)) + return -EBUSY; + ++start: + if (before(TCP_SKB_CB(skb)->seq, tp->snd_una)) { ++ if (unlikely(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_SYN)) { ++ TCP_SKB_CB(skb)->tcp_flags &= ~TCPHDR_SYN; ++ TCP_SKB_CB(skb)->seq++; ++ goto start; ++ } + if (unlikely(before(TCP_SKB_CB(skb)->end_seq, tp->snd_una))) { + WARN_ON_ONCE(1); + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.1/net-rose-fix-use-after-free-in-rose_ioctl.patch b/queue-6.1/net-rose-fix-use-after-free-in-rose_ioctl.patch new file mode 100644 index 00000000000..86751b886d1 --- /dev/null +++ b/queue-6.1/net-rose-fix-use-after-free-in-rose_ioctl.patch @@ -0,0 +1,48 @@ +From 177d7073b5ea4351c1e6092b8d54c32e21f13469 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 9 Dec 2023 05:05:38 -0500 +Subject: net/rose: Fix Use-After-Free in rose_ioctl + +From: Hyunwoo Kim + +[ Upstream commit 810c38a369a0a0ce625b5c12169abce1dd9ccd53 ] + +Because rose_ioctl() accesses sk->sk_receive_queue +without holding a sk->sk_receive_queue.lock, it can +cause a race with rose_accept(). +A use-after-free for skb occurs with the following flow. +``` +rose_ioctl() -> skb_peek() +rose_accept() -> skb_dequeue() -> kfree_skb() +``` +Add sk->sk_receive_queue.lock to rose_ioctl() to fix this issue. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Hyunwoo Kim +Link: https://lore.kernel.org/r/20231209100538.GA407321@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + net/rose/af_rose.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c +index ca2b17f32670d..674937284b8d2 100644 +--- a/net/rose/af_rose.c ++++ b/net/rose/af_rose.c +@@ -1315,9 +1315,11 @@ static int rose_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg) + case TIOCINQ: { + struct sk_buff *skb; + long amount = 0L; +- /* These two are safe on a single CPU system as only user tasks fiddle here */ ++ ++ spin_lock_irq(&sk->sk_receive_queue.lock); + if ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) + amount = skb->len; ++ spin_unlock_irq(&sk->sk_receive_queue.lock); + return put_user(amount, (unsigned int __user *) argp); + } + +-- +2.43.0 + diff --git a/queue-6.1/net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch b/queue-6.1/net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch new file mode 100644 index 00000000000..62e7f2eb844 --- /dev/null +++ b/queue-6.1/net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch @@ -0,0 +1,45 @@ +From e1ac86d70023128fe1510ebb27e03925325be0d4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Dec 2023 16:18:33 -0600 +Subject: net: stmmac: Handle disabled MDIO busses from devicetree + +From: Andrew Halaney + +[ Upstream commit e23c0d21ce9234fbc31ece35663ababbb83f9347 ] + +Many hardware configurations have the MDIO bus disabled, and are instead +using some other MDIO bus to talk to the MAC's phy. + +of_mdiobus_register() returns -ENODEV in this case. Let's handle it +gracefully instead of failing to probe the MAC. + +Fixes: 47dd7a540b8a ("net: add support for STMicroelectronics Ethernet controllers.") +Signed-off-by: Andrew Halaney +Reviewed-by: Serge Semin +Link: https://lore.kernel.org/r/20231212-b4-stmmac-handle-mdio-enodev-v2-1-600171acf79f@redhat.com +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +index 5f177ea807258..379fc887ddf46 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_mdio.c +@@ -483,7 +483,11 @@ int stmmac_mdio_register(struct net_device *ndev) + new_bus->parent = priv->device; + + err = of_mdiobus_register(new_bus, mdio_node); +- if (err != 0) { ++ if (err == -ENODEV) { ++ err = 0; ++ dev_info(dev, "MDIO bus is disabled\n"); ++ goto bus_register_fail; ++ } else if (err) { + dev_err_probe(dev, err, "Cannot register the MDIO bus\n"); + goto bus_register_fail; + } +-- +2.43.0 + diff --git a/queue-6.1/net-vlan-introduce-skb_vlan_eth_hdr.patch b/queue-6.1/net-vlan-introduce-skb_vlan_eth_hdr.patch new file mode 100644 index 00000000000..8be620da90b --- /dev/null +++ b/queue-6.1/net-vlan-introduce-skb_vlan_eth_hdr.patch @@ -0,0 +1,249 @@ +From 51f98f1d566d470d3ed9ee8fce3f1f529a5919a1 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 21 Apr 2023 01:55:54 +0300 +Subject: net: vlan: introduce skb_vlan_eth_hdr() + +From: Vladimir Oltean + +[ Upstream commit 1f5020acb33f926030f62563c86dffca35c7b701 ] + +Similar to skb_eth_hdr() introduced in commit 96cc4b69581d ("macvlan: do +not assume mac_header is set in macvlan_broadcast()"), let's introduce a +skb_vlan_eth_hdr() helper which can be used in TX-only code paths to get +to the VLAN header based on skb->data rather than based on the +skb_mac_header(skb). + +We also consolidate the drivers that dereference skb->data to go through +this helper. + +Signed-off-by: Vladimir Oltean +Reviewed-by: Eric Dumazet +Reviewed-by: Simon Horman +Reviewed-by: Florian Fainelli +Signed-off-by: David S. Miller +Stable-dep-of: 9fc95fe95c3e ("net: fec: correct queue selection") +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | 3 +-- + drivers/net/ethernet/emulex/benet/be_main.c | 2 +- + drivers/net/ethernet/hisilicon/hns3/hns3_enet.c | 2 +- + drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +- + drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 2 +- + drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c | 2 +- + drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c | 4 ++-- + drivers/net/ethernet/sfc/tx_tso.c | 2 +- + drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 7 ++----- + drivers/staging/gdm724x/gdm_lte.c | 4 ++-- + include/linux/if_vlan.h | 12 ++++++++++-- + net/batman-adv/soft-interface.c | 2 +- + 12 files changed, 24 insertions(+), 20 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 16c490692f422..4950fde82d175 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -1923,8 +1923,7 @@ u16 bnx2x_select_queue(struct net_device *dev, struct sk_buff *skb, + + /* Skip VLAN tag if present */ + if (ether_type == ETH_P_8021Q) { +- struct vlan_ethhdr *vhdr = +- (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *vhdr = skb_vlan_eth_hdr(skb); + + ether_type = ntohs(vhdr->h_vlan_encapsulated_proto); + } +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index b12152e2fca0a..a9e4e6464a04c 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -1125,7 +1125,7 @@ static struct sk_buff *be_lancer_xmit_workarounds(struct be_adapter *adapter, + struct be_wrb_params + *wrb_params) + { +- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *veh = skb_vlan_eth_hdr(skb); + unsigned int eth_hdr_len; + struct iphdr *ip; + +diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +index 5ad22b815b2f0..78d6752fe0519 100644 +--- a/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c ++++ b/drivers/net/ethernet/hisilicon/hns3/hns3_enet.c +@@ -1532,7 +1532,7 @@ static int hns3_handle_vtags(struct hns3_enet_ring *tx_ring, + if (unlikely(rc < 0)) + return rc; + +- vhdr = (struct vlan_ethhdr *)skb->data; ++ vhdr = skb_vlan_eth_hdr(skb); + vhdr->h_vlan_TCI |= cpu_to_be16((skb->priority << VLAN_PRIO_SHIFT) + & VLAN_PRIO_MASK); + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index 6d26ee8eefae9..94cf82668efaa 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -2986,7 +2986,7 @@ static inline int i40e_tx_prepare_vlan_flags(struct sk_buff *skb, + rc = skb_cow_head(skb, 0); + if (rc < 0) + return rc; +- vhdr = (struct vlan_ethhdr *)skb->data; ++ vhdr = skb_vlan_eth_hdr(skb); + vhdr->h_vlan_TCI = htons(tx_flags >> + I40E_TX_FLAGS_VLAN_SHIFT); + } else { +diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +index 6105419ae2d5f..9e0e13638c463 100644 +--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c ++++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +@@ -8822,7 +8822,7 @@ netdev_tx_t ixgbe_xmit_frame_ring(struct sk_buff *skb, + + if (skb_cow_head(skb, 0)) + goto out_drop; +- vhdr = (struct vlan_ethhdr *)skb->data; ++ vhdr = skb_vlan_eth_hdr(skb); + vhdr->h_vlan_TCI = htons(tx_flags >> + IXGBE_TX_FLAGS_VLAN_SHIFT); + } else { +diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +index de8d54b23f738..c005a9df59d1c 100644 +--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c ++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c +@@ -1862,7 +1862,7 @@ netxen_tso_check(struct net_device *netdev, + + if (protocol == cpu_to_be16(ETH_P_8021Q)) { + +- vh = (struct vlan_ethhdr *)skb->data; ++ vh = skb_vlan_eth_hdr(skb); + protocol = vh->h_vlan_encapsulated_proto; + flags = FLAGS_VLAN_TAGGED; + +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c +index 92930a055cbcc..41894d154013b 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_io.c +@@ -318,7 +318,7 @@ static void qlcnic_send_filter(struct qlcnic_adapter *adapter, + + if (adapter->flags & QLCNIC_VLAN_FILTERING) { + if (protocol == ETH_P_8021Q) { +- vh = (struct vlan_ethhdr *)skb->data; ++ vh = skb_vlan_eth_hdr(skb); + vlan_id = ntohs(vh->h_vlan_TCI); + } else if (skb_vlan_tag_present(skb)) { + vlan_id = skb_vlan_tag_get(skb); +@@ -468,7 +468,7 @@ static int qlcnic_tx_pkt(struct qlcnic_adapter *adapter, + u32 producer = tx_ring->producer; + + if (protocol == ETH_P_8021Q) { +- vh = (struct vlan_ethhdr *)skb->data; ++ vh = skb_vlan_eth_hdr(skb); + flags = QLCNIC_FLAGS_VLAN_TAGGED; + vlan_tci = ntohs(vh->h_vlan_TCI); + protocol = ntohs(vh->h_vlan_encapsulated_proto); +diff --git a/drivers/net/ethernet/sfc/tx_tso.c b/drivers/net/ethernet/sfc/tx_tso.c +index 898e5c61d9086..d381d8164f07c 100644 +--- a/drivers/net/ethernet/sfc/tx_tso.c ++++ b/drivers/net/ethernet/sfc/tx_tso.c +@@ -147,7 +147,7 @@ static __be16 efx_tso_check_protocol(struct sk_buff *skb) + EFX_WARN_ON_ONCE_PARANOID(((struct ethhdr *)skb->data)->h_proto != + protocol); + if (protocol == htons(ETH_P_8021Q)) { +- struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *veh = skb_vlan_eth_hdr(skb); + + protocol = veh->h_vlan_encapsulated_proto; + } +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +index 69aac8ed84f67..deb6e95a1bca6 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c +@@ -4566,13 +4566,10 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev) + + static void stmmac_rx_vlan(struct net_device *dev, struct sk_buff *skb) + { +- struct vlan_ethhdr *veth; +- __be16 vlan_proto; ++ struct vlan_ethhdr *veth = skb_vlan_eth_hdr(skb); ++ __be16 vlan_proto = veth->h_vlan_proto; + u16 vlanid; + +- veth = (struct vlan_ethhdr *)skb->data; +- vlan_proto = veth->h_vlan_proto; +- + if ((vlan_proto == htons(ETH_P_8021Q) && + dev->features & NETIF_F_HW_VLAN_CTAG_RX) || + (vlan_proto == htons(ETH_P_8021AD) && +diff --git a/drivers/staging/gdm724x/gdm_lte.c b/drivers/staging/gdm724x/gdm_lte.c +index 671ee8843c889..5703a9ddb6d0d 100644 +--- a/drivers/staging/gdm724x/gdm_lte.c ++++ b/drivers/staging/gdm724x/gdm_lte.c +@@ -349,7 +349,7 @@ static s32 gdm_lte_tx_nic_type(struct net_device *dev, struct sk_buff *skb) + /* Get ethernet protocol */ + eth = (struct ethhdr *)skb->data; + if (ntohs(eth->h_proto) == ETH_P_8021Q) { +- vlan_eth = (struct vlan_ethhdr *)skb->data; ++ vlan_eth = skb_vlan_eth_hdr(skb); + mac_proto = ntohs(vlan_eth->h_vlan_encapsulated_proto); + network_data = skb->data + VLAN_ETH_HLEN; + nic_type |= NIC_TYPE_F_VLAN; +@@ -435,7 +435,7 @@ static netdev_tx_t gdm_lte_tx(struct sk_buff *skb, struct net_device *dev) + * driver based on the NIC mac + */ + if (nic_type & NIC_TYPE_F_VLAN) { +- struct vlan_ethhdr *vlan_eth = (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *vlan_eth = skb_vlan_eth_hdr(skb); + + nic->vlan_id = ntohs(vlan_eth->h_vlan_TCI) & VLAN_VID_MASK; + data_buf = skb->data + (VLAN_ETH_HLEN - ETH_HLEN); +diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h +index 68b1c41332984..e0d0a645be7cf 100644 +--- a/include/linux/if_vlan.h ++++ b/include/linux/if_vlan.h +@@ -62,6 +62,14 @@ static inline struct vlan_ethhdr *vlan_eth_hdr(const struct sk_buff *skb) + return (struct vlan_ethhdr *)skb_mac_header(skb); + } + ++/* Prefer this version in TX path, instead of ++ * skb_reset_mac_header() + vlan_eth_hdr() ++ */ ++static inline struct vlan_ethhdr *skb_vlan_eth_hdr(const struct sk_buff *skb) ++{ ++ return (struct vlan_ethhdr *)skb->data; ++} ++ + #define VLAN_PRIO_MASK 0xe000 /* Priority Code Point */ + #define VLAN_PRIO_SHIFT 13 + #define VLAN_CFI_MASK 0x1000 /* Canonical Format Indicator / Drop Eligible Indicator */ +@@ -531,7 +539,7 @@ static inline void __vlan_hwaccel_put_tag(struct sk_buff *skb, + */ + static inline int __vlan_get_tag(const struct sk_buff *skb, u16 *vlan_tci) + { +- struct vlan_ethhdr *veth = (struct vlan_ethhdr *)skb->data; ++ struct vlan_ethhdr *veth = skb_vlan_eth_hdr(skb); + + if (!eth_type_vlan(veth->h_vlan_proto)) + return -EINVAL; +@@ -732,7 +740,7 @@ static inline bool skb_vlan_tagged_multi(struct sk_buff *skb) + if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN))) + return false; + +- veh = (struct vlan_ethhdr *)skb->data; ++ veh = skb_vlan_eth_hdr(skb); + protocol = veh->h_vlan_encapsulated_proto; + } + +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 38d411a52f331..d7b525a495e45 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -444,7 +444,7 @@ void batadv_interface_rx(struct net_device *soft_iface, + if (!pskb_may_pull(skb, VLAN_ETH_HLEN)) + goto dropped; + +- vhdr = (struct vlan_ethhdr *)skb->data; ++ vhdr = skb_vlan_eth_hdr(skb); + + /* drop batman-in-batman packets to prevent loops */ + if (vhdr->h_vlan_encapsulated_proto != htons(ETH_P_BATMAN)) +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-fix-a-use-after-free-in-rvu_nix_registe.patch b/queue-6.1/octeontx2-af-fix-a-use-after-free-in-rvu_nix_registe.patch new file mode 100644 index 00000000000..5c2bc4fd912 --- /dev/null +++ b/queue-6.1/octeontx2-af-fix-a-use-after-free-in-rvu_nix_registe.patch @@ -0,0 +1,63 @@ +From 2d06b5a134c59e9627f5fe8e6a8938afc628572e Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Dec 2023 17:49:16 +0800 +Subject: octeontx2-af: fix a use-after-free in rvu_nix_register_reporters + +From: Zhipeng Lu + +[ Upstream commit 28a7cb045ab700de5554193a1642917602787784 ] + +The rvu_dl will be freed in rvu_nix_health_reporters_destroy(rvu_dl) +after the create_workqueue fails, and after that free, the rvu_dl will +be translate back through the following call chain: + +rvu_nix_health_reporters_destroy + |-> rvu_nix_health_reporters_create + |-> rvu_health_reporters_create + |-> rvu_register_dl (label err_dl_health) + +Finally. in the err_dl_health label, rvu_dl being freed again in +rvu_health_reporters_destroy(rvu) by rvu_nix_health_reporters_destroy. +In the second calls of rvu_nix_health_reporters_destroy, however, +it uses rvu_dl->rvu_nix_health_reporter, which is already freed at +the end of rvu_nix_health_reporters_destroy in the first call. + +So this patch prevents the first destroy by instantly returning -ENONMEN +when create_workqueue fails. In addition, since the failure of +create_workqueue is the only entrence of label err, it has been +integrated into the error-handling path of create_workqueue. + +Fixes: 5ed66306eab6 ("octeontx2-af: Add devlink health reporters for NIX") +Signed-off-by: Zhipeng Lu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c | 5 +---- + 1 file changed, 1 insertion(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +index d609512998992..b9a4efb955333 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_devlink.c +@@ -642,7 +642,7 @@ static int rvu_nix_register_reporters(struct rvu_devlink *rvu_dl) + + rvu_dl->devlink_wq = create_workqueue("rvu_devlink_wq"); + if (!rvu_dl->devlink_wq) +- goto err; ++ return -ENOMEM; + + INIT_WORK(&rvu_reporters->intr_work, rvu_nix_intr_work); + INIT_WORK(&rvu_reporters->gen_work, rvu_nix_gen_work); +@@ -650,9 +650,6 @@ static int rvu_nix_register_reporters(struct rvu_devlink *rvu_dl) + INIT_WORK(&rvu_reporters->ras_work, rvu_nix_ras_work); + + return 0; +-err: +- rvu_nix_health_reporters_destroy(rvu_dl); +- return -ENOMEM; + } + + static int rvu_nix_health_reporters_create(struct rvu_devlink *rvu_dl) +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-af-update-rss-algorithm-index.patch b/queue-6.1/octeontx2-af-update-rss-algorithm-index.patch new file mode 100644 index 00000000000..f1e01e8a9a9 --- /dev/null +++ b/queue-6.1/octeontx2-af-update-rss-algorithm-index.patch @@ -0,0 +1,147 @@ +From 1bffe0344f239c467c621a2a0c893db2817bdb81 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 12:26:10 +0530 +Subject: octeontx2-af: Update RSS algorithm index + +From: Hariprasad Kelam + +[ Upstream commit 570ba37898ecd9069beb58bf0b6cf84daba6e0fe ] + +The RSS flow algorithm is not set up correctly for promiscuous or all +multi MCAM entries. This has an impact on flow distribution. + +This patch fixes the issue by updating flow algorithm index in above +mentioned MCAM entries. + +Fixes: 967db3529eca ("octeontx2-af: add support for multicast/promisc packet replication feature") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/af/rvu_npc.c | 55 +++++++++++++++---- + 1 file changed, 44 insertions(+), 11 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +index f65805860c8d4..0bcf3e5592806 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c ++++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_npc.c +@@ -671,6 +671,7 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc, + int blkaddr, ucast_idx, index; + struct nix_rx_action action = { 0 }; + u64 relaxed_mask; ++ u8 flow_key_alg; + + if (!hw->cap.nix_rx_multicast && is_cgx_vf(rvu, pcifunc)) + return; +@@ -701,6 +702,8 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc, + action.op = NIX_RX_ACTIONOP_UCAST; + } + ++ flow_key_alg = action.flow_key_alg; ++ + /* RX_ACTION set to MCAST for CGX PF's */ + if (hw->cap.nix_rx_multicast && pfvf->use_mce_list && + is_pf_cgxmapped(rvu, rvu_get_pf(pcifunc))) { +@@ -740,7 +743,7 @@ void rvu_npc_install_promisc_entry(struct rvu *rvu, u16 pcifunc, + req.vf = pcifunc; + req.index = action.index; + req.match_id = action.match_id; +- req.flow_key_alg = action.flow_key_alg; ++ req.flow_key_alg = flow_key_alg; + + rvu_mbox_handler_npc_install_flow(rvu, &req, &rsp); + } +@@ -854,6 +857,7 @@ void rvu_npc_install_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf, + u8 mac_addr[ETH_ALEN] = { 0 }; + struct nix_rx_action action = { 0 }; + struct rvu_pfvf *pfvf; ++ u8 flow_key_alg; + u16 vf_func; + + /* Only CGX PF/VF can add allmulticast entry */ +@@ -888,6 +892,7 @@ void rvu_npc_install_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf, + *(u64 *)&action = npc_get_mcam_action(rvu, mcam, + blkaddr, ucast_idx); + ++ flow_key_alg = action.flow_key_alg; + if (action.op != NIX_RX_ACTIONOP_RSS) { + *(u64 *)&action = 0; + action.op = NIX_RX_ACTIONOP_UCAST; +@@ -924,7 +929,7 @@ void rvu_npc_install_allmulti_entry(struct rvu *rvu, u16 pcifunc, int nixlf, + req.vf = pcifunc | vf_func; + req.index = action.index; + req.match_id = action.match_id; +- req.flow_key_alg = action.flow_key_alg; ++ req.flow_key_alg = flow_key_alg; + + rvu_mbox_handler_npc_install_flow(rvu, &req, &rsp); + } +@@ -990,11 +995,38 @@ static void npc_update_vf_flow_entry(struct rvu *rvu, struct npc_mcam *mcam, + mutex_unlock(&mcam->lock); + } + ++static void npc_update_rx_action_with_alg_idx(struct rvu *rvu, struct nix_rx_action action, ++ struct rvu_pfvf *pfvf, int mcam_index, int blkaddr, ++ int alg_idx) ++ ++{ ++ struct npc_mcam *mcam = &rvu->hw->mcam; ++ struct rvu_hwinfo *hw = rvu->hw; ++ int bank, op_rss; ++ ++ if (!is_mcam_entry_enabled(rvu, mcam, blkaddr, mcam_index)) ++ return; ++ ++ op_rss = (!hw->cap.nix_rx_multicast || !pfvf->use_mce_list); ++ ++ bank = npc_get_bank(mcam, mcam_index); ++ mcam_index &= (mcam->banksize - 1); ++ ++ /* If Rx action is MCAST update only RSS algorithm index */ ++ if (!op_rss) { ++ *(u64 *)&action = rvu_read64(rvu, blkaddr, ++ NPC_AF_MCAMEX_BANKX_ACTION(mcam_index, bank)); ++ ++ action.flow_key_alg = alg_idx; ++ } ++ rvu_write64(rvu, blkaddr, ++ NPC_AF_MCAMEX_BANKX_ACTION(mcam_index, bank), *(u64 *)&action); ++} ++ + void rvu_npc_update_flowkey_alg_idx(struct rvu *rvu, u16 pcifunc, int nixlf, + int group, int alg_idx, int mcam_index) + { + struct npc_mcam *mcam = &rvu->hw->mcam; +- struct rvu_hwinfo *hw = rvu->hw; + struct nix_rx_action action; + int blkaddr, index, bank; + struct rvu_pfvf *pfvf; +@@ -1050,15 +1082,16 @@ void rvu_npc_update_flowkey_alg_idx(struct rvu *rvu, u16 pcifunc, int nixlf, + /* If PF's promiscuous entry is enabled, + * Set RSS action for that entry as well + */ +- if ((!hw->cap.nix_rx_multicast || !pfvf->use_mce_list) && +- is_mcam_entry_enabled(rvu, mcam, blkaddr, index)) { +- bank = npc_get_bank(mcam, index); +- index &= (mcam->banksize - 1); ++ npc_update_rx_action_with_alg_idx(rvu, action, pfvf, index, blkaddr, ++ alg_idx); + +- rvu_write64(rvu, blkaddr, +- NPC_AF_MCAMEX_BANKX_ACTION(index, bank), +- *(u64 *)&action); +- } ++ index = npc_get_nixlf_mcam_index(mcam, pcifunc, ++ nixlf, NIXLF_ALLMULTI_ENTRY); ++ /* If PF's allmulti entry is enabled, ++ * Set RSS action for that entry as well ++ */ ++ npc_update_rx_action_with_alg_idx(rvu, action, pfvf, index, blkaddr, ++ alg_idx); + } + + void npc_enadis_default_mce_entry(struct rvu *rvu, u16 pcifunc, +-- +2.43.0 + diff --git a/queue-6.1/octeontx2-pf-fix-promisc-mcam-entry-action.patch b/queue-6.1/octeontx2-pf-fix-promisc-mcam-entry-action.patch new file mode 100644 index 00000000000..5e25c474f95 --- /dev/null +++ b/queue-6.1/octeontx2-pf-fix-promisc-mcam-entry-action.patch @@ -0,0 +1,83 @@ +From 13a2abb592945c5c5e18f56020b5e41f429270d3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Fri, 8 Dec 2023 12:26:09 +0530 +Subject: octeontx2-pf: Fix promisc mcam entry action + +From: Hariprasad Kelam + +[ Upstream commit dbda436824ded8ef6a05bb82cd9baa8d42377a49 ] + +Current implementation is such that, promisc mcam entry action +is set as multicast even when there are no trusted VFs. multicast +action causes the hardware to copy packet data, which reduces +the performance. + +This patch fixes this issue by setting the promisc mcam entry action to +unicast instead of multicast when there are no trusted VFs. The same +change is made for the 'allmulti' mcam entry action. + +Fixes: ffd2f89ad05c ("octeontx2-pf: Enable promisc/allmulti match MCAM entries.") +Signed-off-by: Hariprasad Kelam +Signed-off-by: Sunil Kovvuri Goutham +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../ethernet/marvell/octeontx2/nic/otx2_pf.c | 25 ++++++++++++++++--- + 1 file changed, 22 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +index 55807e2043edf..a2d8ac6204054 100644 +--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c ++++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_pf.c +@@ -1638,6 +1638,21 @@ static void otx2_free_hw_resources(struct otx2_nic *pf) + mutex_unlock(&mbox->lock); + } + ++static bool otx2_promisc_use_mce_list(struct otx2_nic *pfvf) ++{ ++ int vf; ++ ++ /* The AF driver will determine whether to allow the VF netdev or not */ ++ if (is_otx2_vf(pfvf->pcifunc)) ++ return true; ++ ++ /* check if there are any trusted VFs associated with the PF netdev */ ++ for (vf = 0; vf < pci_num_vf(pfvf->pdev); vf++) ++ if (pfvf->vf_configs[vf].trusted) ++ return true; ++ return false; ++} ++ + static void otx2_do_set_rx_mode(struct otx2_nic *pf) + { + struct net_device *netdev = pf->netdev; +@@ -1670,7 +1685,8 @@ static void otx2_do_set_rx_mode(struct otx2_nic *pf) + if (netdev->flags & (IFF_ALLMULTI | IFF_MULTICAST)) + req->mode |= NIX_RX_MODE_ALLMULTI; + +- req->mode |= NIX_RX_MODE_USE_MCE; ++ if (otx2_promisc_use_mce_list(pf)) ++ req->mode |= NIX_RX_MODE_USE_MCE; + + otx2_sync_mbox_msg(&pf->mbox); + mutex_unlock(&pf->mbox.lock); +@@ -2634,11 +2650,14 @@ static int otx2_ndo_set_vf_trust(struct net_device *netdev, int vf, + pf->vf_configs[vf].trusted = enable; + rc = otx2_set_vf_permissions(pf, vf, OTX2_TRUSTED_VF); + +- if (rc) ++ if (rc) { + pf->vf_configs[vf].trusted = !enable; +- else ++ } else { + netdev_info(pf->netdev, "VF %d is %strusted\n", + vf, enable ? "" : "not "); ++ otx2_set_rx_mode(netdev); ++ } ++ + return rc; + } + +-- +2.43.0 + diff --git a/queue-6.1/qca_debug-fix-ethtool-g-iface-tx-behavior.patch b/queue-6.1/qca_debug-fix-ethtool-g-iface-tx-behavior.patch new file mode 100644 index 00000000000..aa53da21a6b --- /dev/null +++ b/queue-6.1/qca_debug-fix-ethtool-g-iface-tx-behavior.patch @@ -0,0 +1,80 @@ +From 4b70af97bea33b7f08f381f9e92716569502df54 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:12:21 +0100 +Subject: qca_debug: Fix ethtool -G iface tx behavior + +From: Stefan Wahren + +[ Upstream commit 96a7e861d9e04d07febd3011c30cd84cd141d81f ] + +After calling ethtool -g it was not possible to adjust the TX ring +size again: + + # ethtool -g eth1 + Ring parameters for eth1: + Pre-set maximums: + RX: 4 + RX Mini: n/a + RX Jumbo: n/a + TX: 10 + Current hardware settings: + RX: 4 + RX Mini: n/a + RX Jumbo: n/a + TX: 10 + # ethtool -G eth1 tx 8 + netlink error: Invalid argument + +The reason for this is that the readonly setting rx_pending get +initialized and after that the range check in qcaspi_set_ringparam() +fails regardless of the provided parameter. So fix this by accepting +the exposed RX defaults. Instead of adding another magic number +better use a new define here. + +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Suggested-by: Paolo Abeni +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231206141222.52029-3-wahrenst@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_debug.c | 8 +++++--- + 1 file changed, 5 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c b/drivers/net/ethernet/qualcomm/qca_debug.c +index 250a4f91a7a84..a739c06ede4e7 100644 +--- a/drivers/net/ethernet/qualcomm/qca_debug.c ++++ b/drivers/net/ethernet/qualcomm/qca_debug.c +@@ -30,6 +30,8 @@ + + #define QCASPI_MAX_REGS 0x20 + ++#define QCASPI_RX_MAX_FRAMES 4 ++ + static const u16 qcaspi_spi_regs[] = { + SPI_REG_BFR_SIZE, + SPI_REG_WRBUF_SPC_AVA, +@@ -252,9 +254,9 @@ qcaspi_get_ringparam(struct net_device *dev, struct ethtool_ringparam *ring, + { + struct qcaspi *qca = netdev_priv(dev); + +- ring->rx_max_pending = 4; ++ ring->rx_max_pending = QCASPI_RX_MAX_FRAMES; + ring->tx_max_pending = TX_RING_MAX_LEN; +- ring->rx_pending = 4; ++ ring->rx_pending = QCASPI_RX_MAX_FRAMES; + ring->tx_pending = qca->txr.count; + } + +@@ -265,7 +267,7 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring, + { + struct qcaspi *qca = netdev_priv(dev); + +- if ((ring->rx_pending) || ++ if (ring->rx_pending != QCASPI_RX_MAX_FRAMES || + (ring->rx_mini_pending) || + (ring->rx_jumbo_pending)) + return -EINVAL; +-- +2.43.0 + diff --git a/queue-6.1/qca_debug-prevent-crash-on-tx-ring-changes.patch b/queue-6.1/qca_debug-prevent-crash-on-tx-ring-changes.patch new file mode 100644 index 00000000000..ef2f1bd7c6a --- /dev/null +++ b/queue-6.1/qca_debug-prevent-crash-on-tx-ring-changes.patch @@ -0,0 +1,86 @@ +From a7c8687ba20d36eb7498fc0c526cdd1e1476349d Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:12:20 +0100 +Subject: qca_debug: Prevent crash on TX ring changes + +From: Stefan Wahren + +[ Upstream commit f4e6064c97c050bd9904925ff7d53d0c9954fc7b ] + +The qca_spi driver stop and restart the SPI kernel thread +(via ndo_stop & ndo_open) in case of TX ring changes. This is +a big issue because it allows userspace to prevent restart of +the SPI kernel thread (via signals). A subsequent change of +TX ring wrongly assume a valid spi_thread pointer which result +in a crash. + +So prevent this by stopping the network traffic handling and +temporary park the SPI thread. + +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231206141222.52029-2-wahrenst@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_debug.c | 9 ++++----- + drivers/net/ethernet/qualcomm/qca_spi.c | 12 ++++++++++++ + 2 files changed, 16 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_debug.c b/drivers/net/ethernet/qualcomm/qca_debug.c +index f62c39544e086..250a4f91a7a84 100644 +--- a/drivers/net/ethernet/qualcomm/qca_debug.c ++++ b/drivers/net/ethernet/qualcomm/qca_debug.c +@@ -263,7 +263,6 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring, + struct kernel_ethtool_ringparam *kernel_ring, + struct netlink_ext_ack *extack) + { +- const struct net_device_ops *ops = dev->netdev_ops; + struct qcaspi *qca = netdev_priv(dev); + + if ((ring->rx_pending) || +@@ -271,14 +270,14 @@ qcaspi_set_ringparam(struct net_device *dev, struct ethtool_ringparam *ring, + (ring->rx_jumbo_pending)) + return -EINVAL; + +- if (netif_running(dev)) +- ops->ndo_stop(dev); ++ if (qca->spi_thread) ++ kthread_park(qca->spi_thread); + + qca->txr.count = max_t(u32, ring->tx_pending, TX_RING_MIN_LEN); + qca->txr.count = min_t(u16, qca->txr.count, TX_RING_MAX_LEN); + +- if (netif_running(dev)) +- ops->ndo_open(dev); ++ if (qca->spi_thread) ++ kthread_unpark(qca->spi_thread); + + return 0; + } +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 4a1b94e5a8ea9..604da32d5e42f 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -581,6 +581,18 @@ qcaspi_spi_thread(void *data) + netdev_info(qca->net_dev, "SPI thread created\n"); + while (!kthread_should_stop()) { + set_current_state(TASK_INTERRUPTIBLE); ++ if (kthread_should_park()) { ++ netif_tx_disable(qca->net_dev); ++ netif_carrier_off(qca->net_dev); ++ qcaspi_flush_tx_ring(qca); ++ kthread_parkme(); ++ if (qca->sync == QCASPI_SYNC_READY) { ++ netif_carrier_on(qca->net_dev); ++ netif_wake_queue(qca->net_dev); ++ } ++ continue; ++ } ++ + if ((qca->intr_req == qca->intr_svc) && + !qca->txr.skb[qca->txr.head]) + schedule(); +-- +2.43.0 + diff --git a/queue-6.1/qca_spi-fix-reset-behavior.patch b/queue-6.1/qca_spi-fix-reset-behavior.patch new file mode 100644 index 00000000000..5bbbf7223b4 --- /dev/null +++ b/queue-6.1/qca_spi-fix-reset-behavior.patch @@ -0,0 +1,51 @@ +From b3df8612cace0396049b029baa773ad2eed78752 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 6 Dec 2023 15:12:22 +0100 +Subject: qca_spi: Fix reset behavior + +From: Stefan Wahren + +[ Upstream commit 1057812d146dd658c9a9a96d869c2551150207b5 ] + +In case of a reset triggered by the QCA7000 itself, the behavior of the +qca_spi driver was not quite correct: +- in case of a pending RX frame decoding the drop counter must be + incremented and decoding state machine reseted +- also the reset counter must always be incremented regardless of sync + state + +Fixes: 291ab06ecf67 ("net: qualcomm: new Ethernet over SPI driver for QCA7000") +Signed-off-by: Stefan Wahren +Link: https://lore.kernel.org/r/20231206141222.52029-4-wahrenst@gmx.net +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qualcomm/qca_spi.c | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c +index 604da32d5e42f..82f5173a2cfd5 100644 +--- a/drivers/net/ethernet/qualcomm/qca_spi.c ++++ b/drivers/net/ethernet/qualcomm/qca_spi.c +@@ -621,11 +621,17 @@ qcaspi_spi_thread(void *data) + if (intr_cause & SPI_INT_CPU_ON) { + qcaspi_qca7k_sync(qca, QCASPI_EVENT_CPUON); + ++ /* Frame decoding in progress */ ++ if (qca->frm_handle.state != qca->frm_handle.init) ++ qca->net_dev->stats.rx_dropped++; ++ ++ qcafrm_fsm_init_spi(&qca->frm_handle); ++ qca->stats.device_reset++; ++ + /* not synced. */ + if (qca->sync != QCASPI_SYNC_READY) + continue; + +- qca->stats.device_reset++; + netif_wake_queue(qca->net_dev); + netif_carrier_on(qca->net_dev); + } +-- +2.43.0 + diff --git a/queue-6.1/qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch b/queue-6.1/qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch new file mode 100644 index 00000000000..8e692bf376e --- /dev/null +++ b/queue-6.1/qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch @@ -0,0 +1,41 @@ +From 90522b5eba1e5257e11bd0f4fa627fb934234cad Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 10 Dec 2023 12:52:55 +0800 +Subject: qed: Fix a potential use-after-free in qed_cxt_tables_alloc + +From: Dinghao Liu + +[ Upstream commit b65d52ac9c085c0c52dee012a210d4e2f352611b ] + +qed_ilt_shadow_alloc() will call qed_ilt_shadow_free() to +free p_hwfn->p_cxt_mngr->ilt_shadow on error. However, +qed_cxt_tables_alloc() accesses the freed pointer on failure +of qed_ilt_shadow_alloc() through calling qed_cxt_mngr_free(), +which may lead to use-after-free. Fix this issue by setting +p_mngr->ilt_shadow to NULL in qed_ilt_shadow_free(). + +Fixes: fe56b9e6a8d9 ("qed: Add module with basic common support") +Reviewed-by: Przemek Kitszel +Signed-off-by: Dinghao Liu +Link: https://lore.kernel.org/r/20231210045255.21383-1-dinghao.liu@zju.edu.cn +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_cxt.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +index 65e20693c549e..33f4f58ee51c6 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c +@@ -933,6 +933,7 @@ static void qed_ilt_shadow_free(struct qed_hwfn *p_hwfn) + p_dma->virt_addr = NULL; + } + kfree(p_mngr->ilt_shadow); ++ p_mngr->ilt_shadow = NULL; + } + + static int qed_ilt_blk_alloc(struct qed_hwfn *p_hwfn, +-- +2.43.0 + diff --git a/queue-6.1/series b/queue-6.1/series index 7ab5ab23d9e..ca6842bf5a6 100644 --- a/queue-6.1/series +++ b/queue-6.1/series @@ -9,3 +9,36 @@ ext4-fix-warning-in-ext4_dio_write_end_io.patch ksmbd-fix-memory-leak-in-smb2_lock.patch afs-fix-refcount-underflow-from-error-handling-race.patch hid-lenovo-restrict-detection-of-patched-firmware-on.patch +net-mlx5e-fix-possible-deadlock-on-mlx5e_tx_timeout_.patch +net-ipv6-support-reporting-otherwise-unknown-prefix-.patch +qca_debug-prevent-crash-on-tx-ring-changes.patch +qca_debug-fix-ethtool-g-iface-tx-behavior.patch +qca_spi-fix-reset-behavior.patch +bnxt_en-clear-resource-reservation-during-resume.patch +bnxt_en-save-ring-error-counters-across-reset.patch +bnxt_en-fix-wrong-return-value-check-in-bnxt_close_n.patch +bnxt_en-fix-hwtstamp_filter_all-packet-timestamp-log.patch +atm-solos-pci-fix-potential-deadlock-on-cli_queue_lo.patch +atm-solos-pci-fix-potential-deadlock-on-tx_queue_loc.patch +net-vlan-introduce-skb_vlan_eth_hdr.patch +net-fec-correct-queue-selection.patch +octeontx2-af-fix-a-use-after-free-in-rvu_nix_registe.patch +octeontx2-pf-fix-promisc-mcam-entry-action.patch +octeontx2-af-update-rss-algorithm-index.patch +atm-fix-use-after-free-in-do_vcc_ioctl.patch +net-rose-fix-use-after-free-in-rose_ioctl.patch +iavf-introduce-new-state-machines-for-flow-director.patch +iavf-handle-ntuple-on-off-based-on-new-state-machine.patch +qed-fix-a-potential-use-after-free-in-qed_cxt_tables.patch +net-remove-acked-syn-flag-from-packet-in-the-transmi.patch +net-ena-destroy-correct-number-of-xdp-queues-upon-fa.patch +net-ena-fix-xdp-drops-handling-due-to-multibuf-packe.patch +net-ena-fix-xdp-redirection-error.patch +stmmac-dwmac-loongson-make-sure-mdio-is-initialized-.patch +sign-file-fix-incorrect-return-values-check.patch +vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch +dpaa2-switch-fix-size-of-the-dma_unmap.patch +dpaa2-switch-do-not-ask-for-mdb-vlan-and-fdb-replay.patch +net-stmmac-handle-disabled-mdio-busses-from-devicetr.patch +appletalk-fix-use-after-free-in-atalk_ioctl.patch +net-atlantic-fix-double-free-in-ring-reinit-logic.patch diff --git a/queue-6.1/sign-file-fix-incorrect-return-values-check.patch b/queue-6.1/sign-file-fix-incorrect-return-values-check.patch new file mode 100644 index 00000000000..75492d750f6 --- /dev/null +++ b/queue-6.1/sign-file-fix-incorrect-return-values-check.patch @@ -0,0 +1,79 @@ +From d83918d8fb705cf8116b33211c025c5d2ec92143 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 13 Dec 2023 10:31:10 +0000 +Subject: sign-file: Fix incorrect return values check + +From: Yusong Gao + +[ Upstream commit 829649443e78d85db0cff0c37cadb28fbb1a5f6f ] + +There are some wrong return values check in sign-file when call OpenSSL +API. The ERR() check cond is wrong because of the program only check the +return value is < 0 which ignored the return val is 0. For example: +1. CMS_final() return 1 for success or 0 for failure. +2. i2d_CMS_bio_stream() returns 1 for success or 0 for failure. +3. i2d_TYPEbio() return 1 for success and 0 for failure. +4. BIO_free() return 1 for success and 0 for failure. + +Link: https://www.openssl.org/docs/manmaster/man3/ +Fixes: e5a2e3c84782 ("scripts/sign-file.c: Add support for signing with a raw signature") +Signed-off-by: Yusong Gao +Reviewed-by: Juerg Haefliger +Signed-off-by: David Howells +Link: https://lore.kernel.org/r/20231213024405.624692-1-a869920004@gmail.com/ # v5 +Signed-off-by: Linus Torvalds +Signed-off-by: Sasha Levin +--- + scripts/sign-file.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/scripts/sign-file.c b/scripts/sign-file.c +index 598ef5465f825..3edb156ae52c3 100644 +--- a/scripts/sign-file.c ++++ b/scripts/sign-file.c +@@ -322,7 +322,7 @@ int main(int argc, char **argv) + CMS_NOSMIMECAP | use_keyid | + use_signed_attrs), + "CMS_add1_signer"); +- ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) < 0, ++ ERR(CMS_final(cms, bm, NULL, CMS_NOCERTS | CMS_BINARY) != 1, + "CMS_final"); + + #else +@@ -341,10 +341,10 @@ int main(int argc, char **argv) + b = BIO_new_file(sig_file_name, "wb"); + ERR(!b, "%s", sig_file_name); + #ifndef USE_PKCS7 +- ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) < 0, ++ ERR(i2d_CMS_bio_stream(b, cms, NULL, 0) != 1, + "%s", sig_file_name); + #else +- ERR(i2d_PKCS7_bio(b, pkcs7) < 0, ++ ERR(i2d_PKCS7_bio(b, pkcs7) != 1, + "%s", sig_file_name); + #endif + BIO_free(b); +@@ -374,9 +374,9 @@ int main(int argc, char **argv) + + if (!raw_sig) { + #ifndef USE_PKCS7 +- ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) < 0, "%s", dest_name); ++ ERR(i2d_CMS_bio_stream(bd, cms, NULL, 0) != 1, "%s", dest_name); + #else +- ERR(i2d_PKCS7_bio(bd, pkcs7) < 0, "%s", dest_name); ++ ERR(i2d_PKCS7_bio(bd, pkcs7) != 1, "%s", dest_name); + #endif + } else { + BIO *b; +@@ -396,7 +396,7 @@ int main(int argc, char **argv) + ERR(BIO_write(bd, &sig_info, sizeof(sig_info)) < 0, "%s", dest_name); + ERR(BIO_write(bd, magic_number, sizeof(magic_number) - 1) < 0, "%s", dest_name); + +- ERR(BIO_free(bd) < 0, "%s", dest_name); ++ ERR(BIO_free(bd) != 1, "%s", dest_name); + + /* Finally, if we're signing in place, replace the original. */ + if (replace_orig) +-- +2.43.0 + diff --git a/queue-6.1/stmmac-dwmac-loongson-make-sure-mdio-is-initialized-.patch b/queue-6.1/stmmac-dwmac-loongson-make-sure-mdio-is-initialized-.patch new file mode 100644 index 00000000000..1106680bffa --- /dev/null +++ b/queue-6.1/stmmac-dwmac-loongson-make-sure-mdio-is-initialized-.patch @@ -0,0 +1,53 @@ +From 61a783c75539205c58dd0fc00686eb08588484ba Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 18:33:11 +0800 +Subject: stmmac: dwmac-loongson: Make sure MDIO is initialized before use + +From: Yanteng Si + +[ Upstream commit e87d3a1370ce9f04770d789bcf7cce44865d2e8d ] + +Generic code will use mdio. If it is not initialized before use, +the kernel will Oops. + +Fixes: 30bba69d7db4 ("stmmac: pci: Add dwmac support for Loongson") +Signed-off-by: Yanteng Si +Signed-off-by: Feiyang Chen +Reviewed-by: Andrew Lunn +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/stmicro/stmmac/dwmac-loongson.c | 14 ++++++-------- + 1 file changed, 6 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +index a25c187d31853..49c7aa86faaa8 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-loongson.c +@@ -68,17 +68,15 @@ static int loongson_dwmac_probe(struct pci_dev *pdev, const struct pci_device_id + if (!plat) + return -ENOMEM; + ++ plat->mdio_bus_data = devm_kzalloc(&pdev->dev, ++ sizeof(*plat->mdio_bus_data), ++ GFP_KERNEL); ++ if (!plat->mdio_bus_data) ++ return -ENOMEM; ++ + plat->mdio_node = of_get_child_by_name(np, "mdio"); + if (plat->mdio_node) { + dev_info(&pdev->dev, "Found MDIO subnode\n"); +- +- plat->mdio_bus_data = devm_kzalloc(&pdev->dev, +- sizeof(*plat->mdio_bus_data), +- GFP_KERNEL); +- if (!plat->mdio_bus_data) { +- ret = -ENOMEM; +- goto err_put_node; +- } + plat->mdio_bus_data->needs_reset = true; + } + +-- +2.43.0 + diff --git a/queue-6.1/vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch b/queue-6.1/vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch new file mode 100644 index 00000000000..3c96ab5c65f --- /dev/null +++ b/queue-6.1/vsock-virtio-fix-unsigned-integer-wrap-around-in-vir.patch @@ -0,0 +1,41 @@ +From b51855f23f313f4529ce95a96b68383ce3c75ce7 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 11 Dec 2023 19:23:17 +0300 +Subject: vsock/virtio: Fix unsigned integer wrap around in + virtio_transport_has_space() + +From: Nikolay Kuratov + +[ Upstream commit 60316d7f10b17a7ebb1ead0642fee8710e1560e0 ] + +We need to do signed arithmetic if we expect condition +`if (bytes < 0)` to be possible + +Found by Linux Verification Center (linuxtesting.org) with SVACE + +Fixes: 06a8fc78367d ("VSOCK: Introduce virtio_vsock_common.ko") +Signed-off-by: Nikolay Kuratov +Reviewed-by: Stefano Garzarella +Link: https://lore.kernel.org/r/20231211162317.4116625-1-kniv@yandex-team.ru +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/virtio_transport_common.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index 79e79fd6efd19..2e25890ca52d1 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -583,7 +583,7 @@ static s64 virtio_transport_has_space(struct vsock_sock *vsk) + struct virtio_vsock_sock *vvs = vsk->trans; + s64 bytes; + +- bytes = vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); ++ bytes = (s64)vvs->peer_buf_alloc - (vvs->tx_cnt - vvs->peer_fwd_cnt); + if (bytes < 0) + bytes = 0; + +-- +2.43.0 + -- 2.47.3