diff options
| author | Sasha Levin <sashal@kernel.org> | 2024-04-28 07:06:23 -0400 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2024-04-28 07:06:23 -0400 |
| commit | 2e23751794112764350b107cbcbd2d2efc3e28c0 (patch) | |
| tree | 6f2f17a5f23933f5785caeadf39a755076849b06 | |
| parent | e598becba70ad69fd18546d308caa2e1e1ea9f96 (diff) | |
| download | stable-queue-2e23751794112764350b107cbcbd2d2efc3e28c0.tar.gz | |
Fixes for 5.15
Signed-off-by: Sasha Levin <sashal@kernel.org>
44 files changed, 3021 insertions, 0 deletions
diff --git a/queue-5.15/af_unix-suppress-false-positive-lockdep-splat-for-sp.patch b/queue-5.15/af_unix-suppress-false-positive-lockdep-splat-for-sp.patch new file mode 100644 index 0000000000..e7a174252e --- /dev/null +++ b/queue-5.15/af_unix-suppress-false-positive-lockdep-splat-for-sp.patch @@ -0,0 +1,171 @@ +From a081c4037b3740e9c1258520af5d85dfb1d39f34 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 24 Apr 2024 10:04:43 -0700 +Subject: af_unix: Suppress false-positive lockdep splat for spin_lock() in + __unix_gc(). + +From: Kuniyuki Iwashima <kuniyu@amazon.com> + +[ Upstream commit 1971d13ffa84a551d29a81fdf5b5ec5be166ac83 ] + +syzbot reported a lockdep splat regarding unix_gc_lock and +unix_state_lock(). + +One is called from recvmsg() for a connected socket, and another +is called from GC for TCP_LISTEN socket. + +So, the splat is false-positive. + +Let's add a dedicated lock class for the latter to suppress the splat. + +Note that this change is not necessary for net-next.git as the issue +is only applied to the old GC impl. + +[0]: +WARNING: possible circular locking dependency detected +6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 Not tainted + ----------------------------------------------------- +kworker/u8:1/11 is trying to acquire lock: +ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] +ffff88807cea4e70 (&u->lock){+.+.}-{2:2}, at: __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 + +but task is already holding lock: +ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] +ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261 + +which lock already depends on the new lock. + +the existing dependency chain (in reverse order) is: + + -> #1 (unix_gc_lock){+.+.}-{2:2}: + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] + _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 + spin_lock include/linux/spinlock.h:351 [inline] + unix_notinflight+0x13d/0x390 net/unix/garbage.c:140 + unix_detach_fds net/unix/af_unix.c:1819 [inline] + unix_destruct_scm+0x221/0x350 net/unix/af_unix.c:1876 + skb_release_head_state+0x100/0x250 net/core/skbuff.c:1188 + skb_release_all net/core/skbuff.c:1200 [inline] + __kfree_skb net/core/skbuff.c:1216 [inline] + kfree_skb_reason+0x16d/0x3b0 net/core/skbuff.c:1252 + kfree_skb include/linux/skbuff.h:1262 [inline] + manage_oob net/unix/af_unix.c:2672 [inline] + unix_stream_read_generic+0x1125/0x2700 net/unix/af_unix.c:2749 + unix_stream_splice_read+0x239/0x320 net/unix/af_unix.c:2981 + do_splice_read fs/splice.c:985 [inline] + splice_file_to_pipe+0x299/0x500 fs/splice.c:1295 + do_splice+0xf2d/0x1880 fs/splice.c:1379 + __do_splice fs/splice.c:1436 [inline] + __do_sys_splice fs/splice.c:1652 [inline] + __se_sys_splice+0x331/0x4a0 fs/splice.c:1634 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0xf5/0x240 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x77/0x7f + + -> #0 (&u->lock){+.+.}-{2:2}: + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] + _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 + spin_lock include/linux/spinlock.h:351 [inline] + __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 + process_one_work kernel/workqueue.c:3254 [inline] + process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 + worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 + kthread+0x2f0/0x390 kernel/kthread.c:388 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + +other info that might help us debug this: + + Possible unsafe locking scenario: + + CPU0 CPU1 + ---- ---- + lock(unix_gc_lock); + lock(&u->lock); + lock(unix_gc_lock); + lock(&u->lock); + + *** DEADLOCK *** + +3 locks held by kworker/u8:1/11: + #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3229 [inline] + #0: ffff888015089148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x8e0/0x17c0 kernel/workqueue.c:3335 + #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_one_work kernel/workqueue.c:3230 [inline] + #1: ffffc90000107d00 (unix_gc_work){+.+.}-{0:0}, at: process_scheduled_works+0x91b/0x17c0 kernel/workqueue.c:3335 + #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: spin_lock include/linux/spinlock.h:351 [inline] + #2: ffffffff8f6ab638 (unix_gc_lock){+.+.}-{2:2}, at: __unix_gc+0x117/0xf70 net/unix/garbage.c:261 + +stack backtrace: +CPU: 0 PID: 11 Comm: kworker/u8:1 Not tainted 6.9.0-rc5-syzkaller-00007-g4d2008430ce8 #0 +Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 +Workqueue: events_unbound __unix_gc +Call Trace: + <TASK> + __dump_stack lib/dump_stack.c:88 [inline] + dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 + check_noncircular+0x36a/0x4a0 kernel/locking/lockdep.c:2187 + check_prev_add kernel/locking/lockdep.c:3134 [inline] + check_prevs_add kernel/locking/lockdep.c:3253 [inline] + validate_chain+0x18cb/0x58e0 kernel/locking/lockdep.c:3869 + __lock_acquire+0x1346/0x1fd0 kernel/locking/lockdep.c:5137 + lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5754 + __raw_spin_lock include/linux/spinlock_api_smp.h:133 [inline] + _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:154 + spin_lock include/linux/spinlock.h:351 [inline] + __unix_gc+0x40e/0xf70 net/unix/garbage.c:302 + process_one_work kernel/workqueue.c:3254 [inline] + process_scheduled_works+0xa10/0x17c0 kernel/workqueue.c:3335 + worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 + kthread+0x2f0/0x390 kernel/kthread.c:388 + ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 + ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 + </TASK> + +Fixes: 47d8ac011fe1 ("af_unix: Fix garbage collector racing against connect()") +Reported-and-tested-by: syzbot+fa379358c28cc87cc307@syzkaller.appspotmail.com +Closes: https://syzkaller.appspot.com/bug?extid=fa379358c28cc87cc307 +Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> +Link: https://lore.kernel.org/r/20240424170443.9832-1-kuniyu@amazon.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + include/net/af_unix.h | 3 +++ + net/unix/garbage.c | 2 +- + 2 files changed, 4 insertions(+), 1 deletion(-) + +diff --git a/include/net/af_unix.h b/include/net/af_unix.h +index 094afdf7dea10..b2c79f18f6837 100644 +--- a/include/net/af_unix.h ++++ b/include/net/af_unix.h +@@ -80,6 +80,9 @@ enum unix_socket_lock_class { + U_LOCK_NORMAL, + U_LOCK_SECOND, /* for double locking, see unix_state_double_lock(). */ + U_LOCK_DIAG, /* used while dumping icons, see sk_diag_dump_icons(). */ ++ U_LOCK_GC_LISTENER, /* used for listening socket while determining gc ++ * candidates to close a small race window. ++ */ + }; + + static inline void unix_state_lock_nested(struct sock *sk, +diff --git a/net/unix/garbage.c b/net/unix/garbage.c +index 85c6f05c0fa3c..d2fc795394a52 100644 +--- a/net/unix/garbage.c ++++ b/net/unix/garbage.c +@@ -260,7 +260,7 @@ void unix_gc(void) + __set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags); + + if (sk->sk_state == TCP_LISTEN) { +- unix_state_lock(sk); ++ unix_state_lock_nested(sk, U_LOCK_GC_LISTENER); + unix_state_unlock(sk); + } + } +-- +2.43.0 + diff --git a/queue-5.15/arc-plat-hsdk-remove-misplaced-interrupt-cells-prope.patch b/queue-5.15/arc-plat-hsdk-remove-misplaced-interrupt-cells-prope.patch new file mode 100644 index 0000000000..97e8c5e64c --- /dev/null +++ b/queue-5.15/arc-plat-hsdk-remove-misplaced-interrupt-cells-prope.patch @@ -0,0 +1,44 @@ +From 91078328edb5e5b09dd37ac10b49861ba87b7d91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 29 Mar 2024 10:36:50 +0000 +Subject: ARC: [plat-hsdk]: Remove misplaced interrupt-cells property + +From: Alexey Brodkin <Alexey.Brodkin@synopsys.com> + +[ Upstream commit 61231eb8113ce47991f35024f9c20810b37996bf ] + +"gmac" node stands for just an ordinary Ethernet controller, +which is by no means a provider of interrupts, i.e. it doesn't serve +as an interrupt controller, thus "#interrupt-cells" property doesn't +belong to it and so we remove it. + +Fixes: +------------>8------------ + DTC arch/arc/boot/dts/hsdk.dtb +arch/arc/boot/dts/hsdk.dts:207.23-235.5: Warning (interrupt_provider): /soc/ethernet@8000: '#interrupt-cells' found, but node is not an interrupt provider +arch/arc/boot/dts/hsdk.dtb: Warning (interrupt_map): Failed prerequisite 'interrupt_provider' +------------>8------------ + +Reported-by: Vineet Gupta <vgupta@kernel.org> +Signed-off-by: Alexey Brodkin <abrodkin@synopsys.com> +Signed-off-by: Vineet Gupta <vgupta@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arc/boot/dts/hsdk.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts +index dcaa44e408ace..27f4194b376bb 100644 +--- a/arch/arc/boot/dts/hsdk.dts ++++ b/arch/arc/boot/dts/hsdk.dts +@@ -205,7 +205,6 @@ + }; + + gmac: ethernet@8000 { +- #interrupt-cells = <1>; + compatible = "snps,dwmac"; + reg = <0x8000 0x2000>; + interrupts = <10>; +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt2712-fix-validation-errors.patch b/queue-5.15/arm64-dts-mediatek-mt2712-fix-validation-errors.patch new file mode 100644 index 0000000000..41b515a5e8 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt2712-fix-validation-errors.patch @@ -0,0 +1,94 @@ +From c2f3984acdbe7512cd0a72dcd8c08f007d68b5a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 1 Mar 2024 08:47:41 +0100 +Subject: arm64: dts: mediatek: mt2712: fix validation errors +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki <rafal@milecki.pl> + +[ Upstream commit 3baac7291effb501c4d52df7019ebf52011e5772 ] + +1. Fixup infracfg clock controller binding + It also acts as reset controller so #reset-cells is required. +2. Use -pins suffix for pinctrl + +This fixes: +arch/arm64/boot/dts/mediatek/mt2712-evb.dtb: syscon@10001000: '#reset-cells' is a required property + from schema $id: http://devicetree.org/schemas/arm/mediatek/mediatek,infracfg.yaml# +arch/arm64/boot/dts/mediatek/mt2712-evb.dtb: pinctrl@1000b000: 'eth_default', 'eth_sleep', 'usb0_iddig', 'usb1_iddig' do not match any of the regexes: 'pinctrl-[0-9]+', 'pins$' + from schema $id: http://devicetree.org/schemas/pinctrl/mediatek,mt65xx-pinctrl.yaml# + +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Link: https://lore.kernel.org/r/20240301074741.8362-1-zajec5@gmail.com +[Angelo: Added Fixes tags] +Fixes: 5d4839709c8e ("arm64: dts: mt2712: Add clock controller device nodes") +Fixes: 1724f4cc5133 ("arm64: dts: Add USB3 related nodes for MT2712") +Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/mediatek/mt2712-evb.dts | 8 ++++---- + arch/arm64/boot/dts/mediatek/mt2712e.dtsi | 3 ++- + 2 files changed, 6 insertions(+), 5 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt2712-evb.dts b/arch/arm64/boot/dts/mediatek/mt2712-evb.dts +index 9d20cabf4f699..99515c13da3cf 100644 +--- a/arch/arm64/boot/dts/mediatek/mt2712-evb.dts ++++ b/arch/arm64/boot/dts/mediatek/mt2712-evb.dts +@@ -127,7 +127,7 @@ + }; + + &pio { +- eth_default: eth_default { ++ eth_default: eth-default-pins { + tx_pins { + pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GBE_TXD3>, + <MT2712_PIN_72_GBE_TXD2__FUNC_GBE_TXD2>, +@@ -154,7 +154,7 @@ + }; + }; + +- eth_sleep: eth_sleep { ++ eth_sleep: eth-sleep-pins { + tx_pins { + pinmux = <MT2712_PIN_71_GBE_TXD3__FUNC_GPIO71>, + <MT2712_PIN_72_GBE_TXD2__FUNC_GPIO72>, +@@ -180,14 +180,14 @@ + }; + }; + +- usb0_id_pins_float: usb0_iddig { ++ usb0_id_pins_float: usb0-iddig-pins { + pins_iddig { + pinmux = <MT2712_PIN_12_IDDIG_P0__FUNC_IDDIG_A>; + bias-pull-up; + }; + }; + +- usb1_id_pins_float: usb1_iddig { ++ usb1_id_pins_float: usb1-iddig-pins { + pins_iddig { + pinmux = <MT2712_PIN_14_IDDIG_P1__FUNC_IDDIG_B>; + bias-pull-up; +diff --git a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi +index 993a03d7fff14..57e9c39fabea4 100644 +--- a/arch/arm64/boot/dts/mediatek/mt2712e.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt2712e.dtsi +@@ -249,10 +249,11 @@ + #clock-cells = <1>; + }; + +- infracfg: syscon@10001000 { ++ infracfg: clock-controller@10001000 { + compatible = "mediatek,mt2712-infracfg", "syscon"; + reg = <0 0x10001000 0 0x1000>; + #clock-cells = <1>; ++ #reset-cells = <1>; + }; + + pericfg: syscon@10003000 { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt7622-add-support-for-coherent-d.patch b/queue-5.15/arm64-dts-mediatek-mt7622-add-support-for-coherent-d.patch new file mode 100644 index 0000000000..6557e827ea --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt7622-add-support-for-coherent-d.patch @@ -0,0 +1,44 @@ +From 1304c4e44df1eb5cee51499f224c05fd3413958e Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 5 Apr 2022 21:57:44 +0200 +Subject: arm64: dts: mediatek: mt7622: add support for coherent DMA + +From: Felix Fietkau <nbd@nbd.name> + +[ Upstream commit 3abd063019b6a01762f9fccc39505f29d029360a ] + +It improves performance by eliminating the need for a cache flush on rx and tx + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 3ba5a6159434 ("arm64: dts: mediatek: mt7622: fix clock controllers") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index a4c48b2abd209..8a332a3d3718a 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -357,7 +357,7 @@ + }; + + cci_control2: slave-if@5000 { +- compatible = "arm,cci-400-ctrl-if"; ++ compatible = "arm,cci-400-ctrl-if", "syscon"; + interface-type = "ace"; + reg = <0x5000 0x1000>; + }; +@@ -938,6 +938,8 @@ + power-domains = <&scpsys MT7622_POWER_DOMAIN_ETHSYS>; + mediatek,ethsys = <ðsys>; + mediatek,sgmiisys = <&sgmiisys>; ++ mediatek,cci-control = <&cci_control2>; ++ dma-coherent; + #address-cells = <1>; + #size-cells = <0>; + status = "disabled"; +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt7622-drop-reset-names-from-ther.patch b/queue-5.15/arm64-dts-mediatek-mt7622-drop-reset-names-from-ther.patch new file mode 100644 index 0000000000..338e62d15f --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt7622-drop-reset-names-from-ther.patch @@ -0,0 +1,44 @@ +From 9f57fc08c6d28bfad0b92d69418834465aff5691 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sun, 17 Mar 2024 23:10:50 +0100 +Subject: arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki <rafal@milecki.pl> + +[ Upstream commit ecb5b0034f5bcc35003b4b965cf50c6e98316e79 ] + +Binding doesn't specify "reset-names" property and Linux driver also +doesn't use it. + +Fix following validation error: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: thermal@1100b000: Unevaluated properties are not allowed ('reset-names' was unexpected) + from schema $id: http://devicetree.org/schemas/thermal/mediatek,thermal.yaml# + +Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes") +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Link: https://lore.kernel.org/r/20240317221050.18595-5-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 7a54af96e1d90..5f21f1e95d095 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -505,7 +505,6 @@ + <&pericfg CLK_PERI_AUXADC_PD>; + clock-names = "therm", "auxadc"; + resets = <&pericfg MT7622_PERI_THERM_SW_RST>; +- reset-names = "therm"; + mediatek,auxadc = <&auxadc>; + mediatek,apmixedsys = <&apmixedsys>; + nvmem-cells = <&thermal_calibration>; +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt7622-fix-clock-controllers.patch b/queue-5.15/arm64-dts-mediatek-mt7622-fix-clock-controllers.patch new file mode 100644 index 0000000000..b3a1962dde --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt7622-fix-clock-controllers.patch @@ -0,0 +1,96 @@ +From 6de8386fedf7a39812b837fd65fb686abcd573ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sun, 17 Mar 2024 23:10:47 +0100 +Subject: arm64: dts: mediatek: mt7622: fix clock controllers +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki <rafal@milecki.pl> + +[ Upstream commit 3ba5a61594347ab46e7c2cff6cd63ea0f1282efb ] + +1. Drop unneeded "syscon"s (bindings were updated recently) +2. Use "clock-controller" in nodenames +3. Add missing "#clock-cells" + +Fixes: d7167881e03e ("arm64: dts: mt7622: add clock controller device nodes") +Fixes: e9b65ecb7c30 ("arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet Dispatch") +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Link: https://lore.kernel.org/r/20240317221050.18595-2-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 27 +++++++++++------------- + 1 file changed, 12 insertions(+), 15 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 636783511779a..a5395d1d098c0 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -275,16 +275,14 @@ + }; + }; + +- apmixedsys: apmixedsys@10209000 { +- compatible = "mediatek,mt7622-apmixedsys", +- "syscon"; ++ apmixedsys: clock-controller@10209000 { ++ compatible = "mediatek,mt7622-apmixedsys"; + reg = <0 0x10209000 0 0x1000>; + #clock-cells = <1>; + }; + +- topckgen: topckgen@10210000 { +- compatible = "mediatek,mt7622-topckgen", +- "syscon"; ++ topckgen: clock-controller@10210000 { ++ compatible = "mediatek,mt7622-topckgen"; + reg = <0 0x10210000 0 0x1000>; + #clock-cells = <1>; + }; +@@ -715,9 +713,8 @@ + power-domains = <&scpsys MT7622_POWER_DOMAIN_WB>; + }; + +- ssusbsys: ssusbsys@1a000000 { +- compatible = "mediatek,mt7622-ssusbsys", +- "syscon"; ++ ssusbsys: clock-controller@1a000000 { ++ compatible = "mediatek,mt7622-ssusbsys"; + reg = <0 0x1a000000 0 0x1000>; + #clock-cells = <1>; + #reset-cells = <1>; +@@ -774,9 +771,8 @@ + }; + }; + +- pciesys: pciesys@1a100800 { +- compatible = "mediatek,mt7622-pciesys", +- "syscon"; ++ pciesys: clock-controller@1a100800 { ++ compatible = "mediatek,mt7622-pciesys"; + reg = <0 0x1a100800 0 0x1000>; + #clock-cells = <1>; + #reset-cells = <1>; +@@ -894,12 +890,13 @@ + }; + }; + +- hifsys: syscon@1af00000 { +- compatible = "mediatek,mt7622-hifsys", "syscon"; ++ hifsys: clock-controller@1af00000 { ++ compatible = "mediatek,mt7622-hifsys"; + reg = <0 0x1af00000 0 0x70>; ++ #clock-cells = <1>; + }; + +- ethsys: syscon@1b000000 { ++ ethsys: clock-controller@1b000000 { + compatible = "mediatek,mt7622-ethsys", + "syscon"; + reg = <0 0x1b000000 0 0x1000>; +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt7622-fix-ethernet-controller-co.patch b/queue-5.15/arm64-dts-mediatek-mt7622-fix-ethernet-controller-co.patch new file mode 100644 index 0000000000..768a6978f9 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt7622-fix-ethernet-controller-co.patch @@ -0,0 +1,45 @@ +From c492b87efdce9ccf81e9759cc747cbe12d921ea3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sun, 17 Mar 2024 23:10:49 +0100 +Subject: arm64: dts: mediatek: mt7622: fix ethernet controller "compatible" +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki <rafal@milecki.pl> + +[ Upstream commit 208add29ce5b7291f6c466e4dfd9cbf61c72888e ] + +Fix following validation error: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: ethernet@1b100000: compatible: ['mediatek,mt7622-eth', 'mediatek,mt2701-eth', 'syscon'] is too long + from schema $id: http://devicetree.org/schemas/net/mediatek,net.yaml# +(and other complains about wrong clocks). + +Fixes: 5f599b3a0bb8 ("arm64: dts: mt7622: add ethernet device nodes") +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Link: https://lore.kernel.org/r/20240317221050.18595-4-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index f3bc89ac0bef4..7a54af96e1d90 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -935,9 +935,7 @@ + }; + + eth: ethernet@1b100000 { +- compatible = "mediatek,mt7622-eth", +- "mediatek,mt2701-eth", +- "syscon"; ++ compatible = "mediatek,mt7622-eth"; + reg = <0 0x1b100000 0 0x20000>; + interrupts = <GIC_SPI 223 IRQ_TYPE_LEVEL_LOW>, + <GIC_SPI 224 IRQ_TYPE_LEVEL_LOW>, +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt7622-fix-ir-nodename.patch b/queue-5.15/arm64-dts-mediatek-mt7622-fix-ir-nodename.patch new file mode 100644 index 0000000000..4a7631a1e7 --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt7622-fix-ir-nodename.patch @@ -0,0 +1,42 @@ +From 352b902a793ea8af8709b7a03e348c7c48b3782c Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sun, 17 Mar 2024 23:10:48 +0100 +Subject: arm64: dts: mediatek: mt7622: fix IR nodename +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Rafał Miłecki <rafal@milecki.pl> + +[ Upstream commit 800dc93c3941e372c94278bf4059e6e82f60bd66 ] + +Fix following validation error: +arch/arm64/boot/dts/mediatek/mt7622-rfb1.dtb: cir@10009000: $nodename:0: 'cir@10009000' does not match '^ir(-receiver)?(@[a-f0-9]+)?$' + from schema $id: http://devicetree.org/schemas/media/mediatek,mt7622-cir.yaml# + +Fixes: ae457b7679c4 ("arm64: dts: mt7622: add SoC and peripheral related device nodes") +Signed-off-by: Rafał Miłecki <rafal@milecki.pl> +Reviewed-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Link: https://lore.kernel.org/r/20240317221050.18595-3-zajec5@gmail.com +Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index a5395d1d098c0..f3bc89ac0bef4 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -244,7 +244,7 @@ + clock-names = "hif_sel"; + }; + +- cir: cir@10009000 { ++ cir: ir-receiver@10009000 { + compatible = "mediatek,mt7622-cir"; + reg = <0 0x10009000 0 0x1000>; + interrupts = <GIC_SPI 175 IRQ_TYPE_LEVEL_LOW>; +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt7622-introduce-nodes-for-wirele.patch b/queue-5.15/arm64-dts-mediatek-mt7622-introduce-nodes-for-wirele.patch new file mode 100644 index 0000000000..d942e3fa8d --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt7622-introduce-nodes-for-wirele.patch @@ -0,0 +1,77 @@ +From 4314d3b4ccc43f5e6fbd56ba9e046e6abbf41b56 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 5 Apr 2022 21:57:49 +0200 +Subject: arm64: dts: mediatek: mt7622: introduce nodes for Wireless Ethernet + Dispatch + +From: Felix Fietkau <nbd@nbd.name> + +[ Upstream commit e9b65ecb7c3050dd34ee22ce17f1cf95e8405b15 ] + +Introduce wed0 and wed1 nodes in order to enable offloading forwarding +between ethernet and wireless devices on the mt7622 chipset. + +Signed-off-by: Felix Fietkau <nbd@nbd.name> +Signed-off-by: David S. Miller <davem@davemloft.net> +Stable-dep-of: 3ba5a6159434 ("arm64: dts: mediatek: mt7622: fix clock controllers") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/mediatek/mt7622.dtsi | 28 ++++++++++++++++++++++++ + 1 file changed, 28 insertions(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt7622.dtsi b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +index 8a332a3d3718a..636783511779a 100644 +--- a/arch/arm64/boot/dts/mediatek/mt7622.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt7622.dtsi +@@ -894,6 +894,11 @@ + }; + }; + ++ hifsys: syscon@1af00000 { ++ compatible = "mediatek,mt7622-hifsys", "syscon"; ++ reg = <0 0x1af00000 0 0x70>; ++ }; ++ + ethsys: syscon@1b000000 { + compatible = "mediatek,mt7622-ethsys", + "syscon"; +@@ -912,6 +917,26 @@ + #dma-cells = <1>; + }; + ++ pcie_mirror: pcie-mirror@10000400 { ++ compatible = "mediatek,mt7622-pcie-mirror", ++ "syscon"; ++ reg = <0 0x10000400 0 0x10>; ++ }; ++ ++ wed0: wed@1020a000 { ++ compatible = "mediatek,mt7622-wed", ++ "syscon"; ++ reg = <0 0x1020a000 0 0x1000>; ++ interrupts = <GIC_SPI 214 IRQ_TYPE_LEVEL_LOW>; ++ }; ++ ++ wed1: wed@1020b000 { ++ compatible = "mediatek,mt7622-wed", ++ "syscon"; ++ reg = <0 0x1020b000 0 0x1000>; ++ interrupts = <GIC_SPI 215 IRQ_TYPE_LEVEL_LOW>; ++ }; ++ + eth: ethernet@1b100000 { + compatible = "mediatek,mt7622-eth", + "mediatek,mt2701-eth", +@@ -939,6 +964,9 @@ + mediatek,ethsys = <ðsys>; + mediatek,sgmiisys = <&sgmiisys>; + mediatek,cci-control = <&cci_control2>; ++ mediatek,wed = <&wed0>, <&wed1>; ++ mediatek,pcie-mirror = <&pcie_mirror>; ++ mediatek,hifsys = <&hifsys>; + dma-coherent; + #address-cells = <1>; + #size-cells = <0>; +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-mediatek-mt8183-add-power-domains-properit.patch b/queue-5.15/arm64-dts-mediatek-mt8183-add-power-domains-properit.patch new file mode 100644 index 0000000000..06ead93a4c --- /dev/null +++ b/queue-5.15/arm64-dts-mediatek-mt8183-add-power-domains-properit.patch @@ -0,0 +1,39 @@ +From 40b205c679f4245befb80aebb14731f198a822fc Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 23 Feb 2024 17:11:21 +0800 +Subject: arm64: dts: mediatek: mt8183: Add power-domains properity to mfgcfg + +From: Ikjoon Jang <ikjn@chromium.org> + +[ Upstream commit 1781f2c461804c0123f59afc7350e520a88edffb ] + +mfgcfg clock is under MFG_ASYNC power domain. + +Fixes: e526c9bc11f8 ("arm64: dts: Add Mediatek SoC MT8183 and evaluation board dts and Makefile") +Fixes: 37fb78b9aeb7 ("arm64: dts: mediatek: Add mt8183 power domains controller") +Signed-off-by: Weiyi Lu <weiyi.lu@mediatek.com> +Signed-off-by: Ikjoon Jang <ikjn@chromium.org> +Reviewed-by: Enric Balletbo i Serra <enric.balletbo@collabora.com> +Signed-off-by: Chen-Yu Tsai <wenst@chromium.org> +Link: https://lore.kernel.org/r/20240223091122.2430037-1-wenst@chromium.org +Signed-off-by: AngeloGioacchino Del Regno <angelogioacchino.delregno@collabora.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/mediatek/mt8183.dtsi | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/arm64/boot/dts/mediatek/mt8183.dtsi b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +index 2d33f4a583b48..712ac1826d686 100644 +--- a/arch/arm64/boot/dts/mediatek/mt8183.dtsi ++++ b/arch/arm64/boot/dts/mediatek/mt8183.dtsi +@@ -1088,6 +1088,7 @@ + compatible = "mediatek,mt8183-mfgcfg", "syscon"; + reg = <0 0x13000000 0 0x1000>; + #clock-cells = <1>; ++ power-domains = <&spm MT8183_POWER_DOMAIN_MFG_ASYNC>; + }; + + gpu: gpu@13040000 { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-rockchip-enable-internal-pull-up-on-pcie_w.patch b/queue-5.15/arm64-dts-rockchip-enable-internal-pull-up-on-pcie_w.patch new file mode 100644 index 0000000000..d8e75e3d86 --- /dev/null +++ b/queue-5.15/arm64-dts-rockchip-enable-internal-pull-up-on-pcie_w.patch @@ -0,0 +1,44 @@ +From b60d5b9889634546d7f2d0ab20d33489e7074b1a Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 8 Mar 2024 16:46:08 +0100 +Subject: arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for + RK3399 Puma + +From: Quentin Schulz <quentin.schulz@theobroma-systems.com> + +[ Upstream commit 945a7c8570916650a415757d15d83e0fa856a686 ] + +The PCIE_WAKE# has a diode used as a level-shifter, and is used as an +input pin. While the SoC default is to enable the pull-up, the core +rk3399 pinconf for this pin opted for pull-none. So as to not disturb +the behaviour of other boards which may rely on pull-none instead of +pull-up, set the needed pull-up only for RK3399 Puma. + +Fixes: 60fd9f72ce8a ("arm64: dts: rockchip: add Haikou baseboard with RK3399-Q7 SoM") +Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> +Link: https://lore.kernel.org/r/20240308-puma-diode-pu-v2-2-309f83da110a@theobroma-systems.com +Signed-off-by: Heiko Stuebner <heiko@sntech.de> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index 14d343aae53f4..1c10baa25ffa3 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -390,6 +390,11 @@ + gpio1830-supply = <&vcc_1v8>; + }; + ++&pcie_clkreqn_cpm { ++ rockchip,pins = ++ <2 RK_PD2 RK_FUNC_GPIO &pcfg_pull_up>; ++}; ++ + &pinctrl { + i2c8 { + i2c8_xfer_a: i2c8-xfer { +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-rockchip-enable-internal-pull-up-on-q7_usb.patch b/queue-5.15/arm64-dts-rockchip-enable-internal-pull-up-on-q7_usb.patch new file mode 100644 index 0000000000..5395109527 --- /dev/null +++ b/queue-5.15/arm64-dts-rockchip-enable-internal-pull-up-on-q7_usb.patch @@ -0,0 +1,40 @@ +From 533c50f38fab348d43057097ae467d7647a44e9b Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 8 Mar 2024 16:46:07 +0100 +Subject: arm64: dts: rockchip: enable internal pull-up on Q7_USB_ID for RK3399 + Puma + +From: Quentin Schulz <quentin.schulz@theobroma-systems.com> + +[ Upstream commit e6b1168f37e3f86d9966276c5a3fff9eb0df3e5f ] + +The Q7_USB_ID has a diode used as a level-shifter, and is used as an +input pin. The SoC default for this pin is a pull-up, which is correct +but the pinconf in the introducing commit missed that, so let's fix this +oversight. + +Fixes: ed2c66a95c0c ("arm64: dts: rockchip: fix rk3399-puma-haikou USB OTG mode") +Signed-off-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> +Link: https://lore.kernel.org/r/20240308-puma-diode-pu-v2-1-309f83da110a@theobroma-systems.com +Signed-off-by: Heiko Stuebner <heiko@sntech.de> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index 7b27079fd6116..d9859fa4a7499 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -432,7 +432,7 @@ + usb3 { + usb3_id: usb3-id { + rockchip,pins = +- <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_none>; ++ <1 RK_PC2 RK_FUNC_GPIO &pcfg_pull_up>; + }; + }; + }; +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-rockchip-fix-alphabetical-ordering-rk3399-.patch b/queue-5.15/arm64-dts-rockchip-fix-alphabetical-ordering-rk3399-.patch new file mode 100644 index 0000000000..772837eec9 --- /dev/null +++ b/queue-5.15/arm64-dts-rockchip-fix-alphabetical-ordering-rk3399-.patch @@ -0,0 +1,62 @@ +From d4cf53515582d9cbbdbc66f9eb392130c347e970 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 8 Mar 2024 09:52:43 +0100 +Subject: arm64: dts: rockchip: fix alphabetical ordering RK3399 puma + +From: Iskander Amara <iskander.amara@theobroma-systems.com> + +[ Upstream commit f0abb4b2c7acf3c3e4130dc3f54cd90cf2ae62bc ] + +Nodes overridden by their reference should be ordered alphabetically to +make it easier to read the DTS. pinctrl node is defined in the wrong +location so let's reorder it. + +Signed-off-by: Iskander Amara <iskander.amara@theobroma-systems.com> +Reviewed-by: Quentin Schulz <quentin.schulz@theobroma-systems.com> +Link: https://lore.kernel.org/r/20240308085243.69903-2-iskander.amara@theobroma-systems.com +Signed-off-by: Heiko Stuebner <heiko@sntech.de> +Stable-dep-of: 945a7c857091 ("arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma") +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi | 18 +++++++++--------- + 1 file changed, 9 insertions(+), 9 deletions(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +index d9859fa4a7499..14d343aae53f4 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi ++++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi +@@ -390,15 +390,6 @@ + gpio1830-supply = <&vcc_1v8>; + }; + +-&pmu_io_domains { +- status = "okay"; +- pmu1830-supply = <&vcc_1v8>; +-}; +- +-&pwm2 { +- status = "okay"; +-}; +- + &pinctrl { + i2c8 { + i2c8_xfer_a: i2c8-xfer { +@@ -437,6 +428,15 @@ + }; + }; + ++&pmu_io_domains { ++ status = "okay"; ++ pmu1830-supply = <&vcc_1v8>; ++}; ++ ++&pwm2 { ++ status = "okay"; ++}; ++ + &sdhci { + /* + * Signal integrity isn't great at 200MHz but 100MHz has proven stable +-- +2.43.0 + diff --git a/queue-5.15/arm64-dts-rockchip-remove-unsupported-node-from-the-.patch b/queue-5.15/arm64-dts-rockchip-remove-unsupported-node-from-the-.patch new file mode 100644 index 0000000000..bbec191eeb --- /dev/null +++ b/queue-5.15/arm64-dts-rockchip-remove-unsupported-node-from-the-.patch @@ -0,0 +1,54 @@ +From 4fb8724900d8a2f0d8d9649891b4c5db08f67cc5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 1 Apr 2024 00:20:56 +0200 +Subject: arm64: dts: rockchip: Remove unsupported node from the Pinebook Pro + dts + +From: Dragan Simic <dsimic@manjaro.org> + +[ Upstream commit 43853e843aa6c3d47ff2b0cce898318839483d05 ] + +Remove a redundant node from the Pine64 Pinebook Pro dts, which is intended +to provide a value for the delay in PCI Express enumeration, but that isn't +supported without additional out-of-tree kernel patches. + +There were already efforts to upstream those kernel patches, because they +reportedly make some PCI Express cards (such as LSI SAS HBAs) usable in +Pine64 RockPro64 (which is also based on the RK3399); otherwise, those PCI +Express cards fail to enumerate. However, providing the required background +and explanations proved to be a tough nut to crack, which is the reason why +those patches remain outside of the kernel mainline for now. + +If those out-of-tree patches eventually become upstreamed, the resulting +device-tree changes will almost surely belong to the RK3399 SoC dtsi. Also, +the above-mentioned unusable-without-out-of-tree-patches PCI Express devices +are in all fairness not usable in a Pinebook Pro without some extensive +hardware modifications, which is another reason to delete this redundant +node. When it comes to the Pinebook Pro, only M.2 NVMe SSDs can be installed +out of the box (using an additional passive adapter PCB sold separately by +Pine64), which reportedly works fine with no additional patches. + +Fixes: 5a65505a6988 ("arm64: dts: rockchip: Add initial support for Pinebook Pro") +Signed-off-by: Dragan Simic <dsimic@manjaro.org> +Link: https://lore.kernel.org/r/0f82c3f97cb798d012270d13b34d8d15305ef293.1711923520.git.dsimic@manjaro.org +Signed-off-by: Heiko Stuebner <heiko@sntech.de> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts | 1 - + 1 file changed, 1 deletion(-) + +diff --git a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +index 9e5d07f5712e6..e5d057ef8160e 100644 +--- a/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts ++++ b/arch/arm64/boot/dts/rockchip/rk3399-pinebook-pro.dts +@@ -790,7 +790,6 @@ + }; + + &pcie0 { +- bus-scan-delay-ms = <1000>; + ep-gpios = <&gpio2 RK_PD4 GPIO_ACTIVE_HIGH>; + num-lanes = <4>; + pinctrl-names = "default"; +-- +2.43.0 + diff --git a/queue-5.15/bridge-br_netlink.c-no-need-to-return-void-function.patch b/queue-5.15/bridge-br_netlink.c-no-need-to-return-void-function.patch new file mode 100644 index 0000000000..3dfdcd9663 --- /dev/null +++ b/queue-5.15/bridge-br_netlink.c-no-need-to-return-void-function.patch @@ -0,0 +1,36 @@ +From 0c4a364157b7378f498ffe52e480632b5d56c4e4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 19 Apr 2024 16:02:00 +0800 +Subject: bridge/br_netlink.c: no need to return void function + +From: Hangbin Liu <liuhangbin@gmail.com> + +[ Upstream commit 4fd1edcdf13c0d234543ecf502092be65c5177db ] + +br_info_notify is a void function. There is no need to return. + +Fixes: b6d0425b816e ("bridge: cfm: Netlink Notifications.") +Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> +Acked-by: Nikolay Aleksandrov <razor@blackwall.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/bridge/br_netlink.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c +index e365cf82f0615..a1a703b7d5235 100644 +--- a/net/bridge/br_netlink.c ++++ b/net/bridge/br_netlink.c +@@ -619,7 +619,7 @@ void br_ifinfo_notify(int event, const struct net_bridge *br, + { + u32 filter = RTEXT_FILTER_BRVLAN_COMPRESSED; + +- return br_info_notify(event, br, port, filter); ++ br_info_notify(event, br, port, filter); + } + + /* +-- +2.43.0 + diff --git a/queue-5.15/cifs-reinstate-original-behavior-again-for-forceuid-.patch b/queue-5.15/cifs-reinstate-original-behavior-again-for-forceuid-.patch new file mode 100644 index 0000000000..6ed37d0ecc --- /dev/null +++ b/queue-5.15/cifs-reinstate-original-behavior-again-for-forceuid-.patch @@ -0,0 +1,82 @@ +From 5620a3689a496ecfee171c7f1c7f4c53955ac80f Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 15 Apr 2024 16:47:49 +0900 +Subject: cifs: reinstate original behavior again for forceuid/forcegid + +From: Takayuki Nagata <tnagata@redhat.com> + +[ Upstream commit 77d8aa79ecfb209308e0644c02f655122b31def7 ] + +forceuid/forcegid should be enabled by default when uid=/gid= options are +specified, but commit 24e0a1eff9e2 ("cifs: switch to new mount api") +changed the behavior. Due to the change, a mounted share does not show +intentional uid/gid for files and directories even though uid=/gid= +options are specified since forceuid/forcegid are not enabled. + +This patch reinstates original behavior that overrides uid/gid with +specified uid/gid by the options. + +Fixes: 24e0a1eff9e2 ("cifs: switch to new mount api") +Signed-off-by: Takayuki Nagata <tnagata@redhat.com> +Acked-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> +Acked-by: Ronnie Sahlberg <lsahlber@redhat.com> +Acked-by: Tom Talpey <tom@talpey.com> +Signed-off-by: Steve French <stfrench@microsoft.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + fs/cifs/fs_context.c | 12 ++++++++++++ + fs/cifs/fs_context.h | 2 ++ + 2 files changed, 14 insertions(+) + +diff --git a/fs/cifs/fs_context.c b/fs/cifs/fs_context.c +index 6347e759b5ccf..fb3651513f83a 100644 +--- a/fs/cifs/fs_context.c ++++ b/fs/cifs/fs_context.c +@@ -672,6 +672,16 @@ static int smb3_fs_context_validate(struct fs_context *fc) + /* set the port that we got earlier */ + cifs_set_port((struct sockaddr *)&ctx->dstaddr, ctx->port); + ++ if (ctx->uid_specified && !ctx->forceuid_specified) { ++ ctx->override_uid = 1; ++ pr_notice("enabling forceuid mount option implicitly because uid= option is specified\n"); ++ } ++ ++ if (ctx->gid_specified && !ctx->forcegid_specified) { ++ ctx->override_gid = 1; ++ pr_notice("enabling forcegid mount option implicitly because gid= option is specified\n"); ++ } ++ + if (ctx->override_uid && !ctx->uid_specified) { + ctx->override_uid = 0; + pr_notice("ignoring forceuid mount option specified with no uid= option\n"); +@@ -903,12 +913,14 @@ static int smb3_fs_context_parse_param(struct fs_context *fc, + ctx->override_uid = 0; + else + ctx->override_uid = 1; ++ ctx->forceuid_specified = true; + break; + case Opt_forcegid: + if (result.negated) + ctx->override_gid = 0; + else + ctx->override_gid = 1; ++ ctx->forcegid_specified = true; + break; + case Opt_perm: + if (result.negated) +diff --git a/fs/cifs/fs_context.h b/fs/cifs/fs_context.h +index 3cf8d6235162d..74bb19ec7c839 100644 +--- a/fs/cifs/fs_context.h ++++ b/fs/cifs/fs_context.h +@@ -152,6 +152,8 @@ enum cifs_param { + }; + + struct smb3_fs_context { ++ bool forceuid_specified; ++ bool forcegid_specified; + bool uid_specified; + bool cruid_specified; + bool gid_specified; +-- +2.43.0 + diff --git a/queue-5.15/hid-intel-ish-hid-ipc-fix-dev_err-usage-with-uniniti.patch b/queue-5.15/hid-intel-ish-hid-ipc-fix-dev_err-usage-with-uniniti.patch new file mode 100644 index 0000000000..0b547f969d --- /dev/null +++ b/queue-5.15/hid-intel-ish-hid-ipc-fix-dev_err-usage-with-uniniti.patch @@ -0,0 +1,49 @@ +From f84556d6dae8f7f010b6bf0b66870f270ba5e843 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 6 Mar 2024 00:44:04 +0000 +Subject: HID: intel-ish-hid: ipc: Fix dev_err usage with uninitialized + dev->devc + +From: Zhang Lixu <lixu.zhang@intel.com> + +[ Upstream commit 92826905ae340b7f2b25759a06c8c60bfc476b9f ] + +The variable dev->devc in ish_dev_init was utilized by dev_err before it +was properly assigned. To rectify this, the assignment of dev->devc has +been moved to immediately follow memory allocation. + +Without this change "(NULL device *)" is printed for device information. + +Fixes: 8ae2f2b0a284 ("HID: intel-ish-hid: ipc: Fix potential use-after-free in work function") +Fixes: ae02e5d40d5f ("HID: intel-ish-hid: ipc layer") +Signed-off-by: Zhang Lixu <lixu.zhang@intel.com> +Acked-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com> +Signed-off-by: Jiri Kosina <jkosina@suse.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/hid/intel-ish-hid/ipc/ipc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/hid/intel-ish-hid/ipc/ipc.c b/drivers/hid/intel-ish-hid/ipc/ipc.c +index 6c942dd1abca2..ba45605fc6b52 100644 +--- a/drivers/hid/intel-ish-hid/ipc/ipc.c ++++ b/drivers/hid/intel-ish-hid/ipc/ipc.c +@@ -944,6 +944,7 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) + if (!dev) + return NULL; + ++ dev->devc = &pdev->dev; + ishtp_device_init(dev); + + init_waitqueue_head(&dev->wait_hw_ready); +@@ -979,7 +980,6 @@ struct ishtp_device *ish_dev_init(struct pci_dev *pdev) + } + + dev->ops = &ish_hw_ops; +- dev->devc = &pdev->dev; + dev->mtu = IPC_PAYLOAD_SIZE - sizeof(struct ishtp_msg_hdr); + return dev; + } +-- +2.43.0 + diff --git a/queue-5.15/hid-logitech-dj-allow-mice-to-use-all-types-of-repor.patch b/queue-5.15/hid-logitech-dj-allow-mice-to-use-all-types-of-repor.patch new file mode 100644 index 0000000000..ad5c65d1dd --- /dev/null +++ b/queue-5.15/hid-logitech-dj-allow-mice-to-use-all-types-of-repor.patch @@ -0,0 +1,39 @@ +From dfcfd67c602e8b1b0a1900bcb7c4f0991346d4c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 3 Apr 2024 19:54:24 +0300 +Subject: HID: logitech-dj: allow mice to use all types of reports + +From: Yaraslau Furman <yaro330@gmail.com> + +[ Upstream commit 21f28a7eb78dea6c59be6b0a5e0b47bf3d25fcbb ] + +You can bind whatever action you want to the mouse's reprogrammable +buttons using Windows application. Allow Linux to receive multimedia keycodes. + +Fixes: 3ed224e273ac ("HID: logitech-dj: Fix 064d:c52f receiver support") +Signed-off-by: Yaraslau Furman <yaro330@gmail.com> +Reviewed-by: Hans de Goede <hdegoede@redhat.com> +Signed-off-by: Jiri Kosina <jkosina@suse.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/hid/hid-logitech-dj.c | 4 +--- + 1 file changed, 1 insertion(+), 3 deletions(-) + +diff --git a/drivers/hid/hid-logitech-dj.c b/drivers/hid/hid-logitech-dj.c +index 08768e5accedc..57697605b2e24 100644 +--- a/drivers/hid/hid-logitech-dj.c ++++ b/drivers/hid/hid-logitech-dj.c +@@ -965,9 +965,7 @@ static void logi_hidpp_dev_conn_notif_equad(struct hid_device *hdev, + } + break; + case REPORT_TYPE_MOUSE: +- workitem->reports_supported |= STD_MOUSE | HIDPP; +- if (djrcv_dev->type == recvr_type_mouse_only) +- workitem->reports_supported |= MULTIMEDIA; ++ workitem->reports_supported |= STD_MOUSE | HIDPP | MULTIMEDIA; + break; + } + } +-- +2.43.0 + diff --git a/queue-5.15/i40e-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch b/queue-5.15/i40e-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch new file mode 100644 index 0000000000..0a909ede23 --- /dev/null +++ b/queue-5.15/i40e-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch @@ -0,0 +1,125 @@ +From 84fc36338ffa90ed665d031ec1d61390e2ec2b91 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 23 Apr 2024 11:27:17 -0700 +Subject: i40e: Do not use WQ_MEM_RECLAIM flag for workqueue + +From: Sindhu Devale <sindhu.devale@intel.com> + +[ Upstream commit 2cc7d150550cc981aceedf008f5459193282425c ] + +Issue reported by customer during SRIOV testing, call trace: +When both i40e and the i40iw driver are loaded, a warning +in check_flush_dependency is being triggered. This seems +to be because of the i40e driver workqueue is allocated with +the WQ_MEM_RECLAIM flag, and the i40iw one is not. + +Similar error was encountered on ice too and it was fixed by +removing the flag. Do the same for i40e too. + +[Feb 9 09:08] ------------[ cut here ]------------ +[ +0.000004] workqueue: WQ_MEM_RECLAIM i40e:i40e_service_task [i40e] is +flushing !WQ_MEM_RECLAIM infiniband:0x0 +[ +0.000060] WARNING: CPU: 0 PID: 937 at kernel/workqueue.c:2966 +check_flush_dependency+0x10b/0x120 +[ +0.000007] Modules linked in: snd_seq_dummy snd_hrtimer snd_seq +snd_timer snd_seq_device snd soundcore nls_utf8 cifs cifs_arc4 +nls_ucs2_utils rdma_cm iw_cm ib_cm cifs_md4 dns_resolver netfs qrtr +rfkill sunrpc vfat fat intel_rapl_msr intel_rapl_common irdma +intel_uncore_frequency intel_uncore_frequency_common ice ipmi_ssif +isst_if_common skx_edac nfit libnvdimm x86_pkg_temp_thermal +intel_powerclamp gnss coretemp ib_uverbs rapl intel_cstate ib_core +iTCO_wdt iTCO_vendor_support acpi_ipmi mei_me ipmi_si intel_uncore +ioatdma i2c_i801 joydev pcspkr mei ipmi_devintf lpc_ich +intel_pch_thermal i2c_smbus ipmi_msghandler acpi_power_meter acpi_pad +xfs libcrc32c ast sd_mod drm_shmem_helper t10_pi drm_kms_helper sg ixgbe +drm i40e ahci crct10dif_pclmul libahci crc32_pclmul igb crc32c_intel +libata ghash_clmulni_intel i2c_algo_bit mdio dca wmi dm_mirror +dm_region_hash dm_log dm_mod fuse +[ +0.000050] CPU: 0 PID: 937 Comm: kworker/0:3 Kdump: loaded Not +tainted 6.8.0-rc2-Feb-net_dev-Qiueue-00279-gbd43c5687e05 #1 +[ +0.000003] Hardware name: Intel Corporation S2600BPB/S2600BPB, BIOS +SE5C620.86B.02.01.0013.121520200651 12/15/2020 +[ +0.000001] Workqueue: i40e i40e_service_task [i40e] +[ +0.000024] RIP: 0010:check_flush_dependency+0x10b/0x120 +[ +0.000003] Code: ff 49 8b 54 24 18 48 8d 8b b0 00 00 00 49 89 e8 48 +81 c6 b0 00 00 00 48 c7 c7 b0 97 fa 9f c6 05 8a cc 1f 02 01 e8 35 b3 fd +ff <0f> 0b e9 10 ff ff ff 80 3d 78 cc 1f 02 00 75 94 e9 46 ff ff ff 90 +[ +0.000002] RSP: 0018:ffffbd294976bcf8 EFLAGS: 00010282 +[ +0.000002] RAX: 0000000000000000 RBX: ffff94d4c483c000 RCX: +0000000000000027 +[ +0.000001] RDX: ffff94d47f620bc8 RSI: 0000000000000001 RDI: +ffff94d47f620bc0 +[ +0.000001] RBP: 0000000000000000 R08: 0000000000000000 R09: +00000000ffff7fff +[ +0.000001] R10: ffffbd294976bb98 R11: ffffffffa0be65e8 R12: +ffff94c5451ea180 +[ +0.000001] R13: ffff94c5ab5e8000 R14: ffff94c5c20b6e05 R15: +ffff94c5f1330ab0 +[ +0.000001] FS: 0000000000000000(0000) GS:ffff94d47f600000(0000) +knlGS:0000000000000000 +[ +0.000002] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[ +0.000001] CR2: 00007f9e6f1fca70 CR3: 0000000038e20004 CR4: +00000000007706f0 +[ +0.000000] DR0: 0000000000000000 DR1: 0000000000000000 DR2: +0000000000000000 +[ +0.000001] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: +0000000000000400 +[ +0.000001] PKRU: 55555554 +[ +0.000001] Call Trace: +[ +0.000001] <TASK> +[ +0.000002] ? __warn+0x80/0x130 +[ +0.000003] ? check_flush_dependency+0x10b/0x120 +[ +0.000002] ? report_bug+0x195/0x1a0 +[ +0.000005] ? handle_bug+0x3c/0x70 +[ +0.000003] ? exc_invalid_op+0x14/0x70 +[ +0.000002] ? asm_exc_invalid_op+0x16/0x20 +[ +0.000006] ? check_flush_dependency+0x10b/0x120 +[ +0.000002] ? check_flush_dependency+0x10b/0x120 +[ +0.000002] __flush_workqueue+0x126/0x3f0 +[ +0.000015] ib_cache_cleanup_one+0x1c/0xe0 [ib_core] +[ +0.000056] __ib_unregister_device+0x6a/0xb0 [ib_core] +[ +0.000023] ib_unregister_device_and_put+0x34/0x50 [ib_core] +[ +0.000020] i40iw_close+0x4b/0x90 [irdma] +[ +0.000022] i40e_notify_client_of_netdev_close+0x54/0xc0 [i40e] +[ +0.000035] i40e_service_task+0x126/0x190 [i40e] +[ +0.000024] process_one_work+0x174/0x340 +[ +0.000003] worker_thread+0x27e/0x390 +[ +0.000001] ? __pfx_worker_thread+0x10/0x10 +[ +0.000002] kthread+0xdf/0x110 +[ +0.000002] ? __pfx_kthread+0x10/0x10 +[ +0.000002] ret_from_fork+0x2d/0x50 +[ +0.000003] ? __pfx_kthread+0x10/0x10 +[ +0.000001] ret_from_fork_asm+0x1b/0x30 +[ +0.000004] </TASK> +[ +0.000001] ---[ end trace 0000000000000000 ]--- + +Fixes: 4d5957cbdecd ("i40e: remove WQ_UNBOUND and the task limit of our workqueue") +Signed-off-by: Sindhu Devale <sindhu.devale@intel.com> +Reviewed-by: Arkadiusz Kubalewski <arkadiusz.kubalewski@intel.com> +Reviewed-by: Mateusz Polchlopek <mateusz.polchlopek@intel.com> +Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com> +Tested-by: Robert Ganzynkowicz <robert.ganzynkowicz@intel.com> +Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> +Link: https://lore.kernel.org/r/20240423182723.740401-2-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 676ea7d4192f7..000c1d59ea062 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -16690,7 +16690,7 @@ static int __init i40e_init_module(void) + * since we need to be able to guarantee forward progress even under + * memory pressure. + */ +- i40e_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0, i40e_driver_name); ++ i40e_wq = alloc_workqueue("%s", 0, 0, i40e_driver_name); + if (!i40e_wq) { + pr_err("%s: Failed to create workqueue\n", i40e_driver_name); + return -ENOMEM; +-- +2.43.0 + diff --git a/queue-5.15/i40e-report-mfs-in-decimal-base-instead-of-hex.patch b/queue-5.15/i40e-report-mfs-in-decimal-base-instead-of-hex.patch new file mode 100644 index 0000000000..b0adfeb345 --- /dev/null +++ b/queue-5.15/i40e-report-mfs-in-decimal-base-instead-of-hex.patch @@ -0,0 +1,59 @@ +From 8f9a3d7ca409ffa24f3d8b63aa21c220e6522b0e Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 23 Apr 2024 11:27:18 -0700 +Subject: i40e: Report MFS in decimal base instead of hex + +From: Erwan Velu <e.velu@criteo.com> + +[ Upstream commit ef3c313119ea448c22da10366faa26b5b4b1a18e ] + +If the MFS is set below the default (0x2600), a warning message is +reported like the following : + + MFS for port 1 has been set below the default: 600 + +This message is a bit confusing as the number shown here (600) is in +fact an hexa number: 0x600 = 1536 + +Without any explicit "0x" prefix, this message is read like the MFS is +set to 600 bytes. + +MFS, as per MTUs, are usually expressed in decimal base. + +This commit reports both current and default MFS values in decimal +so it's less confusing for end-users. + +A typical warning message looks like the following : + + MFS for port 1 (1536) has been set below the default (9728) + +Signed-off-by: Erwan Velu <e.velu@criteo.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Tested-by: Tony Brelinski <tony.brelinski@intel.com> +Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> +Fixes: 3a2c6ced90e1 ("i40e: Add a check to see if MFS is set") +Link: https://lore.kernel.org/r/20240423182723.740401-3-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/intel/i40e/i40e_main.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 000c1d59ea062..991321b04084a 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -16147,8 +16147,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + val = (rd32(&pf->hw, I40E_PRTGL_SAH) & + I40E_PRTGL_SAH_MFS_MASK) >> I40E_PRTGL_SAH_MFS_SHIFT; + if (val < MAX_FRAME_SIZE_DEFAULT) +- dev_warn(&pdev->dev, "MFS for port %x has been set below the default: %x\n", +- pf->hw.port, val); ++ dev_warn(&pdev->dev, "MFS for port %x (%d) has been set below the default (%d)\n", ++ pf->hw.port, val, MAX_FRAME_SIZE_DEFAULT); + + /* Add a filter to drop all Flow control frames from any VSI from being + * transmitted. By doing so we stop a malicious VF from sending out +-- +2.43.0 + diff --git a/queue-5.15/iavf-fix-tc-config-comparison-with-existing-adapter-.patch b/queue-5.15/iavf-fix-tc-config-comparison-with-existing-adapter-.patch new file mode 100644 index 0000000000..8d1ba4489c --- /dev/null +++ b/queue-5.15/iavf-fix-tc-config-comparison-with-existing-adapter-.patch @@ -0,0 +1,76 @@ +From 733a364a03250d3df17544e4e8b94e255a246ec4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Tue, 23 Apr 2024 11:27:19 -0700 +Subject: iavf: Fix TC config comparison with existing adapter TC config + +From: Sudheer Mogilappagari <sudheer.mogilappagari@intel.com> + +[ Upstream commit 54976cf58d6168b8d15cebb395069f23b2f34b31 ] + +Same number of TCs doesn't imply that underlying TC configs are +same. The config could be different due to difference in number +of queues in each TC. Add utility function to determine if TC +configs are same. + +Fixes: d5b33d024496 ("i40evf: add ndo_setup_tc callback to i40evf") +Signed-off-by: Sudheer Mogilappagari <sudheer.mogilappagari@intel.com> +Tested-by: Mineri Bhange <minerix.bhange@intel.com> (A Contingent Worker at Intel) +Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com> +Link: https://lore.kernel.org/r/20240423182723.740401-4-anthony.l.nguyen@intel.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/intel/iavf/iavf_main.c | 30 ++++++++++++++++++++- + 1 file changed, 29 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 41b8ff0d4df5e..6073dcc414d6d 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2901,6 +2901,34 @@ static void iavf_del_all_cloud_filters(struct iavf_adapter *adapter) + spin_unlock_bh(&adapter->cloud_filter_list_lock); + } + ++/** ++ * iavf_is_tc_config_same - Compare the mqprio TC config with the ++ * TC config already configured on this adapter. ++ * @adapter: board private structure ++ * @mqprio_qopt: TC config received from kernel. ++ * ++ * This function compares the TC config received from the kernel ++ * with the config already configured on the adapter. ++ * ++ * Return: True if configuration is same, false otherwise. ++ **/ ++static bool iavf_is_tc_config_same(struct iavf_adapter *adapter, ++ struct tc_mqprio_qopt *mqprio_qopt) ++{ ++ struct virtchnl_channel_info *ch = &adapter->ch_config.ch_info[0]; ++ int i; ++ ++ if (adapter->num_tc != mqprio_qopt->num_tc) ++ return false; ++ ++ for (i = 0; i < adapter->num_tc; i++) { ++ if (ch[i].count != mqprio_qopt->count[i] || ++ ch[i].offset != mqprio_qopt->offset[i]) ++ return false; ++ } ++ return true; ++} ++ + /** + * __iavf_setup_tc - configure multiple traffic classes + * @netdev: network interface device structure +@@ -2958,7 +2986,7 @@ static int __iavf_setup_tc(struct net_device *netdev, void *type_data) + if (ret) + return ret; + /* Return if same TC config is requested */ +- if (adapter->num_tc == num_tc) ++ if (iavf_is_tc_config_same(adapter, &mqprio_qopt->qopt)) + return 0; + adapter->num_tc = num_tc; + +-- +2.43.0 + diff --git a/queue-5.15/icmp-prevent-possible-null-dereferences-from-icmp_bu.patch b/queue-5.15/icmp-prevent-possible-null-dereferences-from-icmp_bu.patch new file mode 100644 index 0000000000..e0b5a5bae8 --- /dev/null +++ b/queue-5.15/icmp-prevent-possible-null-dereferences-from-icmp_bu.patch @@ -0,0 +1,74 @@ +From 767801430f42060c3ffe28ac0ea6cd36157f135f Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sat, 20 Apr 2024 07:01:16 +0000 +Subject: icmp: prevent possible NULL dereferences from icmp_build_probe() + +From: Eric Dumazet <edumazet@google.com> + +[ Upstream commit c58e88d49097bd12dfcfef4f075b43f5d5830941 ] + +First problem is a double call to __in_dev_get_rcu(), because +the second one could return NULL. + +if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) + +Second problem is a read from dev->ip6_ptr with no NULL check: + +if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) + +Use the correct RCU API to fix these. + +v2: add missing include <net/addrconf.h> + +Fixes: d329ea5bd884 ("icmp: add response to RFC 8335 PROBE messages") +Signed-off-by: Eric Dumazet <edumazet@google.com> +Cc: Andreas Roeseler <andreas.a.roeseler@gmail.com> +Reviewed-by: David Ahern <dsahern@kernel.org> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/ipv4/icmp.c | 12 ++++++++++-- + 1 file changed, 10 insertions(+), 2 deletions(-) + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 7b749a98327c2..38b30f6790294 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -92,6 +92,7 @@ + #include <net/inet_common.h> + #include <net/ip_fib.h> + #include <net/l3mdev.h> ++#include <net/addrconf.h> + + /* + * Build xmit assembly blocks +@@ -1035,6 +1036,8 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr) + struct icmp_ext_hdr *ext_hdr, _ext_hdr; + struct icmp_ext_echo_iio *iio, _iio; + struct net *net = dev_net(skb->dev); ++ struct inet6_dev *in6_dev; ++ struct in_device *in_dev; + struct net_device *dev; + char buff[IFNAMSIZ]; + u16 ident_len; +@@ -1118,10 +1121,15 @@ bool icmp_build_probe(struct sk_buff *skb, struct icmphdr *icmphdr) + /* Fill bits in reply message */ + if (dev->flags & IFF_UP) + status |= ICMP_EXT_ECHOREPLY_ACTIVE; +- if (__in_dev_get_rcu(dev) && __in_dev_get_rcu(dev)->ifa_list) ++ ++ in_dev = __in_dev_get_rcu(dev); ++ if (in_dev && rcu_access_pointer(in_dev->ifa_list)) + status |= ICMP_EXT_ECHOREPLY_IPV4; +- if (!list_empty(&rcu_dereference(dev->ip6_ptr)->addr_list)) ++ ++ in6_dev = __in6_dev_get(dev); ++ if (in6_dev && !list_empty(&in6_dev->addr_list)) + status |= ICMP_EXT_ECHOREPLY_IPV6; ++ + dev_put(dev); + icmphdr->un.echo.sequence |= htons(status); + return true; +-- +2.43.0 + diff --git a/queue-5.15/ipv4-check-for-null-idev-in-ip_route_use_hint.patch b/queue-5.15/ipv4-check-for-null-idev-in-ip_route_use_hint.patch new file mode 100644 index 0000000000..d2801a2135 --- /dev/null +++ b/queue-5.15/ipv4-check-for-null-idev-in-ip_route_use_hint.patch @@ -0,0 +1,83 @@ +From 3f1c639c27b9034982538856a04517f45832e78b Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sun, 21 Apr 2024 18:43:26 +0000 +Subject: ipv4: check for NULL idev in ip_route_use_hint() + +From: Eric Dumazet <edumazet@google.com> + +[ Upstream commit 58a4c9b1e5a3e53c9148e80b90e1e43897ce77d1 ] + +syzbot was able to trigger a NULL deref in fib_validate_source() +in an old tree [1]. + +It appears the bug exists in latest trees. + +All calls to __in_dev_get_rcu() must be checked for a NULL result. + +[1] +general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN +KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] +CPU: 2 PID: 3257 Comm: syz-executor.3 Not tainted 5.10.0-syzkaller #0 +Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 + RIP: 0010:fib_validate_source+0xbf/0x15a0 net/ipv4/fib_frontend.c:425 +Code: 18 f2 f2 f2 f2 42 c7 44 20 23 f3 f3 f3 f3 48 89 44 24 78 42 c6 44 20 27 f3 e8 5d 88 48 fc 4c 89 e8 48 c1 e8 03 48 89 44 24 18 <42> 80 3c 20 00 74 08 4c 89 ef e8 d2 15 98 fc 48 89 5c 24 10 41 bf +RSP: 0018:ffffc900015fee40 EFLAGS: 00010246 +RAX: 0000000000000000 RBX: ffff88800f7a4000 RCX: ffff88800f4f90c0 +RDX: 0000000000000000 RSI: 0000000004001eac RDI: ffff8880160c64c0 +RBP: ffffc900015ff060 R08: 0000000000000000 R09: ffff88800f7a4000 +R10: 0000000000000002 R11: ffff88800f4f90c0 R12: dffffc0000000000 +R13: 0000000000000000 R14: 0000000000000000 R15: ffff88800f7a4000 +FS: 00007f938acfe6c0(0000) GS:ffff888058c00000(0000) knlGS:0000000000000000 +CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +CR2: 00007f938acddd58 CR3: 000000001248e000 CR4: 0000000000352ef0 +DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 +DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 +Call Trace: + ip_route_use_hint+0x410/0x9b0 net/ipv4/route.c:2231 + ip_rcv_finish_core+0x2c4/0x1a30 net/ipv4/ip_input.c:327 + ip_list_rcv_finish net/ipv4/ip_input.c:612 [inline] + ip_sublist_rcv+0x3ed/0xe50 net/ipv4/ip_input.c:638 + ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:673 + __netif_receive_skb_list_ptype net/core/dev.c:5572 [inline] + __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5620 + __netif_receive_skb_list net/core/dev.c:5672 [inline] + netif_receive_skb_list_internal+0x9f9/0xdc0 net/core/dev.c:5764 + netif_receive_skb_list+0x55/0x3e0 net/core/dev.c:5816 + xdp_recv_frames net/bpf/test_run.c:257 [inline] + xdp_test_run_batch net/bpf/test_run.c:335 [inline] + bpf_test_run_xdp_live+0x1818/0x1d00 net/bpf/test_run.c:363 + bpf_prog_test_run_xdp+0x81f/0x1170 net/bpf/test_run.c:1376 + bpf_prog_test_run+0x349/0x3c0 kernel/bpf/syscall.c:3736 + __sys_bpf+0x45c/0x710 kernel/bpf/syscall.c:5115 + __do_sys_bpf kernel/bpf/syscall.c:5201 [inline] + __se_sys_bpf kernel/bpf/syscall.c:5199 [inline] + __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5199 + +Fixes: 02b24941619f ("ipv4: use dst hint for ipv4 list receive") +Reported-by: syzbot <syzkaller@googlegroups.com> +Signed-off-by: Eric Dumazet <edumazet@google.com> +Acked-by: Paolo Abeni <pabeni@redhat.com> +Link: https://lore.kernel.org/r/20240421184326.1704930-1-edumazet@google.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/ipv4/route.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 4ff94596f8cd5..895754439393e 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -2173,6 +2173,9 @@ int ip_route_use_hint(struct sk_buff *skb, __be32 daddr, __be32 saddr, + int err = -EINVAL; + u32 tag = 0; + ++ if (!in_dev) ++ return -EINVAL; ++ + if (ipv4_is_multicast(saddr) || ipv4_is_lbcast(saddr)) + goto martian_source; + +-- +2.43.0 + diff --git a/queue-5.15/ipvs-fix-checksumming-on-gso-of-sctp-packets.patch b/queue-5.15/ipvs-fix-checksumming-on-gso-of-sctp-packets.patch new file mode 100644 index 0000000000..2d703ffd1f --- /dev/null +++ b/queue-5.15/ipvs-fix-checksumming-on-gso-of-sctp-packets.patch @@ -0,0 +1,53 @@ +From fb944e70fa9cffd385876013d2aeced34ffaeb85 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sun, 21 Apr 2024 16:22:32 +0200 +Subject: ipvs: Fix checksumming on GSO of SCTP packets + +From: Ismael Luceno <iluceno@suse.de> + +[ Upstream commit e10d3ba4d434ed172914617ed8d74bd411421193 ] + +It was observed in the wild that pairs of consecutive packets would leave +the IPVS with the same wrong checksum, and the issue only went away when +disabling GSO. + +IPVS needs to avoid computing the SCTP checksum when using GSO. + +Fixes: 90017accff61 ("sctp: Add GSO support") +Co-developed-by: Firo Yang <firo.yang@suse.com> +Signed-off-by: Ismael Luceno <iluceno@suse.de> +Tested-by: Andreas Taschner <andreas.taschner@suse.com> +Acked-by: Julian Anastasov <ja@ssi.bg> +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/netfilter/ipvs/ip_vs_proto_sctp.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c +index a0921adc31a9f..1e689c7141271 100644 +--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c ++++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c +@@ -126,7 +126,8 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + if (sctph->source != cp->vport || payload_csum || + skb->ip_summed == CHECKSUM_PARTIAL) { + sctph->source = cp->vport; +- sctp_nat_csum(skb, sctph, sctphoff); ++ if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ sctp_nat_csum(skb, sctph, sctphoff); + } else { + skb->ip_summed = CHECKSUM_UNNECESSARY; + } +@@ -174,7 +175,8 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp, + (skb->ip_summed == CHECKSUM_PARTIAL && + !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) { + sctph->dest = cp->dport; +- sctp_nat_csum(skb, sctph, sctphoff); ++ if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb)) ++ sctp_nat_csum(skb, sctph, sctphoff); + } else if (skb->ip_summed != CHECKSUM_PARTIAL) { + skb->ip_summed = CHECKSUM_UNNECESSARY; + } +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-core-unregister-emad-trap-using-forward-action.patch b/queue-5.15/mlxsw-core-unregister-emad-trap-using-forward-action.patch new file mode 100644 index 0000000000..a75524c9df --- /dev/null +++ b/queue-5.15/mlxsw-core-unregister-emad-trap-using-forward-action.patch @@ -0,0 +1,57 @@ +From f740641362178d9fd4070c9707b56026da84d360 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Thu, 18 Apr 2024 15:46:06 +0200 +Subject: mlxsw: core: Unregister EMAD trap using FORWARD action + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit 976c44af48141cd8595601c0af2a19a43c5b228b ] + +The device's manual (PRM - Programmer's Reference Manual) classifies the +trap that is used to deliver EMAD responses as an "event trap". Among +other things, it means that the only actions that can be associated with +the trap are TRAP and FORWARD (NOP). + +Currently, during driver de-initialization the driver unregisters the +trap by setting its action to DISCARD, which violates the above +guideline. Future firmware versions will prevent such misuses by +returning an error. This does not prevent the driver from working, but +an error will be printed to the kernel log during module removal / +devlink reload: + +mlxsw_spectrum 0000:03:00.0: Reg cmd access status failed (status=7(bad parameter)) +mlxsw_spectrum 0000:03:00.0: Reg cmd access failed (reg_id=7003(hpkt),type=write) + +Suppress the error message by aligning the driver to the manual and use +a FORWARD (NOP) action when unregistering the trap. + +Fixes: 4ec14b7634b2 ("mlxsw: Add interface to access registers and process events") +Cc: Jiri Pirko <jiri@resnulli.us> +Cc: Amit Cohen <amcohen@nvidia.com> +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Reviewed-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Link: https://lore.kernel.org/r/753a89e14008fde08cb4a2c1e5f537b81d8eb2d6.1713446092.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/mellanox/mlxsw/core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c +index f080fab3de2b5..d1102d5613dff 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/core.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/core.c +@@ -746,7 +746,7 @@ static void mlxsw_emad_rx_listener_func(struct sk_buff *skb, u8 local_port, + + static const struct mlxsw_listener mlxsw_emad_rx_listener = + MLXSW_RXL(mlxsw_emad_rx_listener_func, ETHEMAD, TRAP_TO_CPU, false, +- EMAD, DISCARD); ++ EMAD, FORWARD); + + static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core) + { +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-spectrum_acl_tcam-fix-incorrect-list-api-usage.patch b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-incorrect-list-api-usage.patch new file mode 100644 index 0000000000..154a3a9e9c --- /dev/null +++ b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-incorrect-list-api-usage.patch @@ -0,0 +1,84 @@ +From 9eaf54f0e58d2c65457b93aebc7d12148eb944c2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 17:26:01 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix incorrect list API usage + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit b377add0f0117409c418ddd6504bd682ebe0bf79 ] + +Both the function that migrates all the chunks within a region and the +function that migrates all the entries within a chunk call +list_first_entry() on the respective lists without checking that the +lists are not empty. This is incorrect usage of the API, which leads to +the following warning [1]. + +Fix by returning if the lists are empty as there is nothing to migrate +in this case. + +[1] +WARNING: CPU: 0 PID: 6437 at drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c:1266 mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0> +Modules linked in: +CPU: 0 PID: 6437 Comm: kworker/0:37 Not tainted 6.9.0-rc3-custom-00883-g94a65f079ef6 #39 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:mlxsw_sp_acl_tcam_vchunk_migrate_all+0x1f1/0x2c0 +[...] +Call Trace: + <TASK> + mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x4a0 + process_one_work+0x151/0x370 + worker_thread+0x2cb/0x3e0 + kthread+0xd0/0x100 + ret_from_fork+0x34/0x50 + ret_from_fork_asm+0x1a/0x30 + </TASK> + +Fixes: 6f9579d4e302 ("mlxsw: spectrum_acl: Remember where to continue rehash migration") +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Tested-by: Alexander Zubkov <green@qrator.net> +Reviewed-by: Petr Machata <petrm@nvidia.com> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/4628e9a22d1d84818e28310abbbc498e7bc31bc9.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 7 +++++++ + 1 file changed, 7 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 8c1e97d463eb7..e0e7f630801a9 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1284,6 +1284,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, + return 0; + } + ++ if (list_empty(&vchunk->ventry_list)) ++ goto out; ++ + /* If the migration got interrupted, we have the ventry to start from + * stored in context. + */ +@@ -1335,6 +1338,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, + } + } + ++out: + mlxsw_sp_acl_tcam_vchunk_migrate_end(mlxsw_sp, vchunk, ctx); + return 0; + } +@@ -1348,6 +1352,9 @@ mlxsw_sp_acl_tcam_vchunk_migrate_all(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_tcam_vchunk *vchunk; + int err; + ++ if (list_empty(&vregion->vchunk_list)) ++ return 0; ++ + /* If the migration got interrupted, we have the vchunk + * we are working on stored in context. + */ +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-spectrum_acl_tcam-fix-memory-leak-during-rehas.patch b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-memory-leak-during-rehas.patch new file mode 100644 index 0000000000..c2806481a1 --- /dev/null +++ b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-memory-leak-during-rehas.patch @@ -0,0 +1,91 @@ +From 6984443e3185cdab67035943d6ca71029534a9f8 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 17:25:59 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix memory leak during rehash + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit 8ca3f7a7b61393804c46f170743c3b839df13977 ] + +The rehash delayed work migrates filters from one region to another. +This is done by iterating over all chunks (all the filters with the same +priority) in the region and in each chunk iterating over all the +filters. + +If the migration fails, the code tries to migrate the filters back to +the old region. However, the rollback itself can also fail in which case +another migration will be erroneously performed. Besides the fact that +this ping pong is not a very good idea, it also creates a problem. + +Each virtual chunk references two chunks: The currently used one +('vchunk->chunk') and a backup ('vchunk->chunk2'). During migration the +first holds the chunk we want to migrate filters to and the second holds +the chunk we are migrating filters from. + +The code currently assumes - but does not verify - that the backup chunk +does not exist (NULL) if the currently used chunk does not reference the +target region. This assumption breaks when we are trying to rollback a +rollback, resulting in the backup chunk being overwritten and leaked +[1]. + +Fix by not rolling back a failed rollback and add a warning to avoid +future cases. + +[1] +WARNING: CPU: 5 PID: 1063 at lib/parman.c:291 parman_destroy+0x17/0x20 +Modules linked in: +CPU: 5 PID: 1063 Comm: kworker/5:11 Tainted: G W 6.9.0-rc2-custom-00784-gc6a05c468a0b #14 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:parman_destroy+0x17/0x20 +[...] +Call Trace: + <TASK> + mlxsw_sp_acl_atcam_region_fini+0x19/0x60 + mlxsw_sp_acl_tcam_region_destroy+0x49/0xf0 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x1f1/0x470 + process_one_work+0x151/0x370 + worker_thread+0x2cb/0x3e0 + kthread+0xd0/0x100 + ret_from_fork+0x34/0x50 + ret_from_fork_asm+0x1a/0x30 + </TASK> + +Fixes: 843500518509 ("mlxsw: spectrum_acl: Do rollback as another call to mlxsw_sp_acl_tcam_vchunk_migrate_all()") +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Tested-by: Alexander Zubkov <green@qrator.net> +Reviewed-by: Petr Machata <petrm@nvidia.com> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/d5edd4f4503934186ae5cfe268503b16345b4e0f.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index cdad4772b60a0..b63b4a3ee7c42 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1230,6 +1230,8 @@ mlxsw_sp_acl_tcam_vchunk_migrate_start(struct mlxsw_sp *mlxsw_sp, + { + struct mlxsw_sp_acl_tcam_chunk *new_chunk; + ++ WARN_ON(vchunk->chunk2); ++ + new_chunk = mlxsw_sp_acl_tcam_chunk_create(mlxsw_sp, vchunk, region); + if (IS_ERR(new_chunk)) + return PTR_ERR(new_chunk); +@@ -1364,6 +1366,8 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, + err = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion, + ctx, credits); + if (err) { ++ if (ctx->this_is_rollback) ++ return err; + /* In case migration was not successful, we need to swap + * so the original region pointer is assigned again + * to vregion->region. +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-spectrum_acl_tcam-fix-memory-leak-when-canceli.patch b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-memory-leak-when-canceli.patch new file mode 100644 index 0000000000..730a2f1383 --- /dev/null +++ b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-memory-leak-when-canceli.patch @@ -0,0 +1,82 @@ +From 392a076482c3750350af27c3416544f5408d3927 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 17:26:02 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit fb4e2b70a7194b209fc7320bbf33b375f7114bd5 ] + +The rehash delayed work is rescheduled with a delay if the number of +credits at end of the work is not negative as supposedly it means that +the migration ended. Otherwise, it is rescheduled immediately. + +After "mlxsw: spectrum_acl_tcam: Fix possible use-after-free during +rehash" the above is no longer accurate as a non-negative number of +credits is no longer indicative of the migration being done. It can also +happen if the work encountered an error in which case the migration will +resume the next time the work is scheduled. + +The significance of the above is that it is possible for the work to be +pending and associated with hints that were allocated when the migration +started. This leads to the hints being leaked [1] when the work is +canceled while pending as part of ACL region dismantle. + +Fix by freeing the hints if hints are associated with a work that was +canceled while pending. + +Blame the original commit since the reliance on not having a pending +work associated with hints is fragile. + +[1] +unreferenced object 0xffff88810e7c3000 (size 256): + comm "kworker/0:16", pid 176, jiffies 4295460353 + hex dump (first 32 bytes): + 00 30 95 11 81 88 ff ff 61 00 00 00 00 00 00 80 .0......a....... + 00 00 61 00 40 00 00 00 00 00 00 00 04 00 00 00 ..a.@........... + backtrace (crc 2544ddb9): + [<00000000cf8cfab3>] kmalloc_trace+0x23f/0x2a0 + [<000000004d9a1ad9>] objagg_hints_get+0x42/0x390 + [<000000000b143cf3>] mlxsw_sp_acl_erp_rehash_hints_get+0xca/0x400 + [<0000000059bdb60a>] mlxsw_sp_acl_tcam_vregion_rehash_work+0x868/0x1160 + [<00000000e81fd734>] process_one_work+0x59c/0xf20 + [<00000000ceee9e81>] worker_thread+0x799/0x12c0 + [<00000000bda6fe39>] kthread+0x246/0x300 + [<0000000070056d23>] ret_from_fork+0x34/0x70 + [<00000000dea2b93e>] ret_from_fork_asm+0x1a/0x30 + +Fixes: c9c9af91f1d9 ("mlxsw: spectrum_acl: Allow to interrupt/continue rehash work") +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Tested-by: Alexander Zubkov <green@qrator.net> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/0cc12ebb07c4d4c41a1265ee2c28b392ff997a86.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index e0e7f630801a9..46b1120a8151e 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -831,10 +831,14 @@ mlxsw_sp_acl_tcam_vregion_destroy(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_tcam *tcam = vregion->tcam; + + if (vgroup->vregion_rehash_enabled && ops->region_rehash_hints_get) { ++ struct mlxsw_sp_acl_tcam_rehash_ctx *ctx = &vregion->rehash.ctx; ++ + mutex_lock(&tcam->lock); + list_del(&vregion->tlist); + mutex_unlock(&tcam->lock); +- cancel_delayed_work_sync(&vregion->rehash.dw); ++ if (cancel_delayed_work_sync(&vregion->rehash.dw) && ++ ctx->hints_priv) ++ ops->region_rehash_hints_put(ctx->hints_priv); + } + mlxsw_sp_acl_tcam_vgroup_vregion_detach(mlxsw_sp, vregion); + if (vregion->region2) +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch new file mode 100644 index 0000000000..6c0a376bcb --- /dev/null +++ b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch @@ -0,0 +1,107 @@ +From eb38597ef18580d23ab6103e0db2da0cf3224856 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 17:25:56 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity + update + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit 79b5b4b18bc85b19d3a518483f9abbbe6d7b3ba4 ] + +The rule activity update delayed work periodically traverses the list of +configured rules and queries their activity from the device. + +As part of this task it accesses the entry pointed by 'ventry->entry', +but this entry can be changed concurrently by the rehash delayed work, +leading to a use-after-free [1]. + +Fix by closing the race and perform the activity query under the +'vregion->lock' mutex. + +[1] +BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 +Read of size 8 at addr ffff8881054ed808 by task kworker/0:18/181 + +CPU: 0 PID: 181 Comm: kworker/0:18 Not tainted 6.9.0-rc2-custom-00781-gd5ab772d32f7 #2 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_rule_activity_update_work +Call Trace: + <TASK> + dump_stack_lvl+0xc6/0x120 + print_report+0xce/0x670 + kasan_report+0xd7/0x110 + mlxsw_sp_acl_tcam_flower_rule_activity_get+0x121/0x140 + mlxsw_sp_acl_rule_activity_update_work+0x219/0x400 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + </TASK> + +Allocated by task 1039: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + __kasan_kmalloc+0x8f/0xa0 + __kmalloc+0x19c/0x360 + mlxsw_sp_acl_tcam_entry_create+0x7b/0x1f0 + mlxsw_sp_acl_tcam_vchunk_migrate_all+0x30d/0xb50 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + +Freed by task 1039: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + kasan_save_free_info+0x3b/0x60 + poison_slab_object+0x102/0x170 + __kasan_slab_free+0x14/0x30 + kfree+0xc1/0x290 + mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3d7/0xb50 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + +Fixes: 2bffc5322fd8 ("mlxsw: spectrum_acl: Don't take mutex in mlxsw_sp_acl_tcam_vregion_rehash_work()") +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Tested-by: Alexander Zubkov <green@qrator.net> +Reviewed-by: Petr Machata <petrm@nvidia.com> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/1fcce0a60b231ebeb2515d91022284ba7b4ffe7a.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + .../net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 1dce4e9958c90..f663cb0fd19a3 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1189,8 +1189,14 @@ mlxsw_sp_acl_tcam_ventry_activity_get(struct mlxsw_sp *mlxsw_sp, + struct mlxsw_sp_acl_tcam_ventry *ventry, + bool *activity) + { +- return mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp, +- ventry->entry, activity); ++ struct mlxsw_sp_acl_tcam_vregion *vregion = ventry->vchunk->vregion; ++ int err; ++ ++ mutex_lock(&vregion->lock); ++ err = mlxsw_sp_acl_tcam_entry_activity_get(mlxsw_sp, ventry->entry, ++ activity); ++ mutex_unlock(&vregion->lock); ++ return err; + } + + static int +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch-29620 b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch-29620 new file mode 100644 index 0000000000..0f3933007e --- /dev/null +++ b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch-29620 @@ -0,0 +1,103 @@ +From 308fb2ba47aa3f14891463f9a5304c38582e56d5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 17:25:57 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit 54225988889931467a9b55fdbef534079b665519 ] + +The rehash delayed work migrates filters from one region to another +according to the number of available credits. + +The migrated from region is destroyed at the end of the work if the +number of credits is non-negative as the assumption is that this is +indicative of migration being complete. This assumption is incorrect as +a non-negative number of credits can also be the result of a failed +migration. + +The destruction of a region that still has filters referencing it can +result in a use-after-free [1]. + +Fix by not destroying the region if migration failed. + +[1] +BUG: KASAN: slab-use-after-free in mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 +Read of size 8 at addr ffff8881735319e8 by task kworker/0:31/3858 + +CPU: 0 PID: 3858 Comm: kworker/0:31 Tainted: G W 6.9.0-rc2-custom-00782-gf2275c2157d8 #5 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +Call Trace: + <TASK> + dump_stack_lvl+0xc6/0x120 + print_report+0xce/0x670 + kasan_report+0xd7/0x110 + mlxsw_sp_acl_ctcam_region_entry_remove+0x21d/0x230 + mlxsw_sp_acl_ctcam_entry_del+0x2e/0x70 + mlxsw_sp_acl_atcam_entry_del+0x81/0x210 + mlxsw_sp_acl_tcam_vchunk_migrate_all+0x3cd/0xb50 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x157/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + </TASK> + +Allocated by task 174: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + __kasan_kmalloc+0x8f/0xa0 + __kmalloc+0x19c/0x360 + mlxsw_sp_acl_tcam_region_create+0xdf/0x9c0 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x954/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + +Freed by task 7: + kasan_save_stack+0x33/0x60 + kasan_save_track+0x14/0x30 + kasan_save_free_info+0x3b/0x60 + poison_slab_object+0x102/0x170 + __kasan_slab_free+0x14/0x30 + kfree+0xc1/0x290 + mlxsw_sp_acl_tcam_region_destroy+0x272/0x310 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x731/0x1300 + process_one_work+0x8eb/0x19b0 + worker_thread+0x6c9/0xf70 + kthread+0x2c9/0x3b0 + ret_from_fork+0x4d/0x80 + ret_from_fork_asm+0x1a/0x30 + +Fixes: c9c9af91f1d9 ("mlxsw: spectrum_acl: Allow to interrupt/continue rehash work") +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Tested-by: Alexander Zubkov <green@qrator.net> +Reviewed-by: Petr Machata <petrm@nvidia.com> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/3e412b5659ec2310c5c615760dfe5eac18dd7ebd.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index f663cb0fd19a3..a60d511f00eaa 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1481,6 +1481,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, + ctx, credits); + if (err) { + dev_err(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n"); ++ return; + } + + if (*credits >= 0) +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch new file mode 100644 index 0000000000..87f78ca4a0 --- /dev/null +++ b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch @@ -0,0 +1,80 @@ +From 47efda1d62d0c5032d6b205857d731081d314fc3 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 17:25:55 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix race during rehash delayed work + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit d90cfe20562407d9f080d24123078d666d730707 ] + +The purpose of the rehash delayed work is to reduce the number of masks +(eRPs) used by an ACL region as the eRP bank is a global and limited +resource. + +This is done in three steps: + +1. Creating a new set of masks and a new ACL region which will use the + new masks and to which the existing filters will be migrated to. The + new region is assigned to 'vregion->region' and the region from which + the filters are migrated from is assigned to 'vregion->region2'. + +2. Migrating all the filters from the old region to the new region. + +3. Destroying the old region and setting 'vregion->region2' to NULL. + +Only the second steps is performed under the 'vregion->lock' mutex +although its comments says that among other things it "Protects +consistency of region, region2 pointers". + +This is problematic as the first step can race with filter insertion +from user space that uses 'vregion->region', but under the mutex. + +Fix by holding the mutex across the entirety of the delayed work and not +only during the second step. + +Fixes: 2bffc5322fd8 ("mlxsw: spectrum_acl: Don't take mutex in mlxsw_sp_acl_tcam_vregion_rehash_work()") +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Tested-by: Alexander Zubkov <green@qrator.net> +Reviewed-by: Petr Machata <petrm@nvidia.com> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/1ec1d54edf2bad0a369e6b4fa030aba64e1f124b.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index 483c8b75bebb8..1dce4e9958c90 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -713,7 +713,9 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work) + rehash.dw.work); + int credits = MLXSW_SP_ACL_TCAM_VREGION_REHASH_CREDITS; + ++ mutex_lock(&vregion->lock); + mlxsw_sp_acl_tcam_vregion_rehash(vregion->mlxsw_sp, vregion, &credits); ++ mutex_unlock(&vregion->lock); + if (credits < 0) + /* Rehash gone out of credits so it was interrupted. + * Schedule the work as soon as possible to continue. +@@ -1353,7 +1355,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, + int err, err2; + + trace_mlxsw_sp_acl_tcam_vregion_migrate(mlxsw_sp, vregion); +- mutex_lock(&vregion->lock); + err = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion, + ctx, credits); + if (err) { +@@ -1373,7 +1374,6 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, + /* Let the rollback to be continued later on. */ + } + } +- mutex_unlock(&vregion->lock); + trace_mlxsw_sp_acl_tcam_vregion_migrate_end(mlxsw_sp, vregion); + return err; + } +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-spectrum_acl_tcam-fix-warning-during-rehash.patch b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-warning-during-rehash.patch new file mode 100644 index 0000000000..de487d0bfd --- /dev/null +++ b/queue-5.15/mlxsw-spectrum_acl_tcam-fix-warning-during-rehash.patch @@ -0,0 +1,133 @@ +From e4f75a27fe9951c00907d0bf5f5bc139084690b4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 17:26:00 +0200 +Subject: mlxsw: spectrum_acl_tcam: Fix warning during rehash + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit 743edc8547a92b6192aa1f1b6bb78233fa21dc9b ] + +As previously explained, the rehash delayed work migrates filters from +one region to another. This is done by iterating over all chunks (all +the filters with the same priority) in the region and in each chunk +iterating over all the filters. + +When the work runs out of credits it stores the current chunk and entry +as markers in the per-work context so that it would know where to resume +the migration from the next time the work is scheduled. + +Upon error, the chunk marker is reset to NULL, but without resetting the +entry markers despite being relative to it. This can result in migration +being resumed from an entry that does not belong to the chunk being +migrated. In turn, this will eventually lead to a chunk being iterated +over as if it is an entry. Because of how the two structures happen to +be defined, this does not lead to KASAN splats, but to warnings such as +[1]. + +Fix by creating a helper that resets all the markers and call it from +all the places the currently only reset the chunk marker. For good +measures also call it when starting a completely new rehash. Add a +warning to avoid future cases. + +[1] +WARNING: CPU: 7 PID: 1076 at drivers/net/ethernet/mellanox/mlxsw/core_acl_flex_keys.c:407 mlxsw_afk_encode+0x242/0x2f0 +Modules linked in: +CPU: 7 PID: 1076 Comm: kworker/7:24 Tainted: G W 6.9.0-rc3-custom-00880-g29e61d91b77b #29 +Hardware name: Mellanox Technologies Ltd. MSN3700/VMOD0005, BIOS 5.11 01/06/2019 +Workqueue: mlxsw_core mlxsw_sp_acl_tcam_vregion_rehash_work +RIP: 0010:mlxsw_afk_encode+0x242/0x2f0 +[...] +Call Trace: + <TASK> + mlxsw_sp_acl_atcam_entry_add+0xd9/0x3c0 + mlxsw_sp_acl_tcam_entry_create+0x5e/0xa0 + mlxsw_sp_acl_tcam_vchunk_migrate_all+0x109/0x290 + mlxsw_sp_acl_tcam_vregion_rehash_work+0x6c/0x470 + process_one_work+0x151/0x370 + worker_thread+0x2cb/0x3e0 + kthread+0xd0/0x100 + ret_from_fork+0x34/0x50 + </TASK> + +Fixes: 6f9579d4e302 ("mlxsw: spectrum_acl: Remember where to continue rehash migration") +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Tested-by: Alexander Zubkov <green@qrator.net> +Reviewed-by: Petr Machata <petrm@nvidia.com> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/cc17eed86b41dd829d39b07906fec074a9ce580e.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + .../mellanox/mlxsw/spectrum_acl_tcam.c | 20 ++++++++++++++++--- + 1 file changed, 17 insertions(+), 3 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index b63b4a3ee7c42..8c1e97d463eb7 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -725,6 +725,17 @@ static void mlxsw_sp_acl_tcam_vregion_rehash_work(struct work_struct *work) + mlxsw_sp_acl_tcam_vregion_rehash_work_schedule(vregion); + } + ++static void ++mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(struct mlxsw_sp_acl_tcam_rehash_ctx *ctx) ++{ ++ /* The entry markers are relative to the current chunk and therefore ++ * needs to be reset together with the chunk marker. ++ */ ++ ctx->current_vchunk = NULL; ++ ctx->start_ventry = NULL; ++ ctx->stop_ventry = NULL; ++} ++ + static void + mlxsw_sp_acl_tcam_rehash_ctx_vchunk_changed(struct mlxsw_sp_acl_tcam_vchunk *vchunk) + { +@@ -747,7 +758,7 @@ mlxsw_sp_acl_tcam_rehash_ctx_vregion_changed(struct mlxsw_sp_acl_tcam_vregion *v + * the current chunk pointer to make sure all chunks + * are properly migrated. + */ +- vregion->rehash.ctx.current_vchunk = NULL; ++ mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(&vregion->rehash.ctx); + } + + static struct mlxsw_sp_acl_tcam_vregion * +@@ -1250,7 +1261,7 @@ mlxsw_sp_acl_tcam_vchunk_migrate_end(struct mlxsw_sp *mlxsw_sp, + { + mlxsw_sp_acl_tcam_chunk_destroy(mlxsw_sp, vchunk->chunk2); + vchunk->chunk2 = NULL; +- ctx->current_vchunk = NULL; ++ mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx); + } + + static int +@@ -1282,6 +1293,8 @@ mlxsw_sp_acl_tcam_vchunk_migrate_one(struct mlxsw_sp *mlxsw_sp, + ventry = list_first_entry(&vchunk->ventry_list, + typeof(*ventry), list); + ++ WARN_ON(ventry->vchunk != vchunk); ++ + list_for_each_entry_from(ventry, &vchunk->ventry_list, list) { + /* During rollback, once we reach the ventry that failed + * to migrate, we are done. +@@ -1373,7 +1386,7 @@ mlxsw_sp_acl_tcam_vregion_migrate(struct mlxsw_sp *mlxsw_sp, + * to vregion->region. + */ + swap(vregion->region, vregion->region2); +- ctx->current_vchunk = NULL; ++ mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx); + ctx->this_is_rollback = true; + err2 = mlxsw_sp_acl_tcam_vchunk_migrate_all(mlxsw_sp, vregion, + ctx, credits); +@@ -1432,6 +1445,7 @@ mlxsw_sp_acl_tcam_vregion_rehash_start(struct mlxsw_sp *mlxsw_sp, + + ctx->hints_priv = hints_priv; + ctx->this_is_rollback = false; ++ mlxsw_sp_acl_tcam_rehash_ctx_vchunk_reset(ctx); + + return 0; + +-- +2.43.0 + diff --git a/queue-5.15/mlxsw-spectrum_acl_tcam-rate-limit-error-message.patch b/queue-5.15/mlxsw-spectrum_acl_tcam-rate-limit-error-message.patch new file mode 100644 index 0000000000..0b4fbe9f2d --- /dev/null +++ b/queue-5.15/mlxsw-spectrum_acl_tcam-rate-limit-error-message.patch @@ -0,0 +1,45 @@ +From f2ee6bdf9363ad0cfeb05193d83b0725f0e395bf Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 17:25:58 +0200 +Subject: mlxsw: spectrum_acl_tcam: Rate limit error message + +From: Ido Schimmel <idosch@nvidia.com> + +[ Upstream commit 5bcf925587e9b5d36420d572a0b4d131c90fb306 ] + +In the rare cases when the device resources are exhausted it is likely +that the rehash delayed work will fail. An error message will be printed +whenever this happens which can be overwhelming considering the fact +that the work is per-region and that there can be hundreds of regions. + +Fix by rate limiting the error message. + +Fixes: e5e7962ee5c2 ("mlxsw: spectrum_acl: Implement region migration according to hints") +Signed-off-by: Ido Schimmel <idosch@nvidia.com> +Tested-by: Alexander Zubkov <green@qrator.net> +Reviewed-by: Petr Machata <petrm@nvidia.com> +Signed-off-by: Petr Machata <petrm@nvidia.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/c510763b2ebd25e7990d80183feff91cde593145.1713797103.git.petrm@nvidia.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +index a60d511f00eaa..cdad4772b60a0 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c +@@ -1480,7 +1480,7 @@ mlxsw_sp_acl_tcam_vregion_rehash(struct mlxsw_sp *mlxsw_sp, + err = mlxsw_sp_acl_tcam_vregion_migrate(mlxsw_sp, vregion, + ctx, credits); + if (err) { +- dev_err(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n"); ++ dev_err_ratelimited(mlxsw_sp->bus_info->dev, "Failed to migrate vregion\n"); + return; + } + +-- +2.43.0 + diff --git a/queue-5.15/net-ethernet-ti-am65-cpts-fix-ptpv1-message-type-on-.patch b/queue-5.15/net-ethernet-ti-am65-cpts-fix-ptpv1-message-type-on-.patch new file mode 100644 index 0000000000..08c82ee224 --- /dev/null +++ b/queue-5.15/net-ethernet-ti-am65-cpts-fix-ptpv1-message-type-on-.patch @@ -0,0 +1,58 @@ +From e858193172cda7cf951aeea5d38e2febeb9dcc0b Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 24 Apr 2024 12:46:26 +0530 +Subject: net: ethernet: ti: am65-cpts: Fix PTPv1 message type on TX packets + +From: Jason Reeder <jreeder@ti.com> + +[ Upstream commit 1b9e743e923b256e353a9a644195372285e5a6c0 ] + +The CPTS, by design, captures the messageType (Sync, Delay_Req, etc.) +field from the second nibble of the PTP header which is defined in the +PTPv2 (1588-2008) specification. In the PTPv1 (1588-2002) specification +the first two bytes of the PTP header are defined as the versionType +which is always 0x0001. This means that any PTPv1 packets that are +tagged for TX timestamping by the CPTS will have their messageType set +to 0x0 which corresponds to a Sync message type. This causes issues +when a PTPv1 stack is expecting a Delay_Req (messageType: 0x1) +timestamp that never appears. + +Fix this by checking if the ptp_class of the timestamped TX packet is +PTP_CLASS_V1 and then matching the PTP sequence ID to the stored +sequence ID in the skb->cb data structure. If the sequence IDs match +and the packet is of type PTPv1 then there is a chance that the +messageType has been incorrectly stored by the CPTS so overwrite the +messageType stored by the CPTS with the messageType from the skb->cb +data structure. This allows the PTPv1 stack to receive TX timestamps +for Delay_Req packets which are necessary to lock onto a PTP Leader. + +Signed-off-by: Jason Reeder <jreeder@ti.com> +Signed-off-by: Ravi Gunasekaran <r-gunasekaran@ti.com> +Tested-by: Ed Trexel <ed.trexel@hp.com> +Fixes: f6bd59526ca5 ("net: ethernet: ti: introduce am654 common platform time sync driver") +Link: https://lore.kernel.org/r/20240424071626.32558-1-r-gunasekaran@ti.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/ethernet/ti/am65-cpts.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/drivers/net/ethernet/ti/am65-cpts.c b/drivers/net/ethernet/ti/am65-cpts.c +index c30a6e510aa32..1552dfee4e626 100644 +--- a/drivers/net/ethernet/ti/am65-cpts.c ++++ b/drivers/net/ethernet/ti/am65-cpts.c +@@ -649,6 +649,11 @@ static bool am65_cpts_match_tx_ts(struct am65_cpts *cpts, + struct am65_cpts_skb_cb_data *skb_cb = + (struct am65_cpts_skb_cb_data *)skb->cb; + ++ if ((ptp_classify_raw(skb) & PTP_CLASS_V1) && ++ ((mtype_seqid & AM65_CPTS_EVENT_1_SEQUENCE_ID_MASK) == ++ (skb_cb->skb_mtype_seqid & AM65_CPTS_EVENT_1_SEQUENCE_ID_MASK))) ++ mtype_seqid = skb_cb->skb_mtype_seqid; ++ + if (mtype_seqid == skb_cb->skb_mtype_seqid) { + u64 ns = event->timestamp; + +-- +2.43.0 + diff --git a/queue-5.15/net-gtp-fix-use-after-free-in-gtp_dellink.patch b/queue-5.15/net-gtp-fix-use-after-free-in-gtp_dellink.patch new file mode 100644 index 0000000000..febab2b5b8 --- /dev/null +++ b/queue-5.15/net-gtp-fix-use-after-free-in-gtp_dellink.patch @@ -0,0 +1,46 @@ +From e2d26b6b503ac186ae7940556e182eea22437feb Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 05:39:30 -0400 +Subject: net: gtp: Fix Use-After-Free in gtp_dellink + +From: Hyunwoo Kim <v4bel@theori.io> + +[ Upstream commit f2a904107ee2b647bb7794a1a82b67740d7c8a64 ] + +Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal +of gtp_dellink, is not part of the RCU read critical section, it +is possible that the RCU grace period will pass during the traversal and +the key will be free. + +To prevent this, it should be changed to hlist_for_each_entry_safe. + +Fixes: 94dc550a5062 ("gtp: fix an use-after-free in ipv4_pdp_find()") +Signed-off-by: Hyunwoo Kim <v4bel@theori.io> +Reviewed-by: Eric Dumazet <edumazet@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/gtp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c +index ce93316f5f116..3271428e64b8c 100644 +--- a/drivers/net/gtp.c ++++ b/drivers/net/gtp.c +@@ -713,11 +713,12 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev, + static void gtp_dellink(struct net_device *dev, struct list_head *head) + { + struct gtp_dev *gtp = netdev_priv(dev); ++ struct hlist_node *next; + struct pdp_ctx *pctx; + int i; + + for (i = 0; i < gtp->hash_size; i++) +- hlist_for_each_entry_rcu(pctx, >p->tid_hash[i], hlist_tid) ++ hlist_for_each_entry_safe(pctx, next, >p->tid_hash[i], hlist_tid) + pdp_context_delete(pctx); + + list_del_rcu(>p->list); +-- +2.43.0 + diff --git a/queue-5.15/net-openvswitch-fix-use-after-free-in-ovs_ct_exit.patch b/queue-5.15/net-openvswitch-fix-use-after-free-in-ovs_ct_exit.patch new file mode 100644 index 0000000000..f75397e02b --- /dev/null +++ b/queue-5.15/net-openvswitch-fix-use-after-free-in-ovs_ct_exit.patch @@ -0,0 +1,46 @@ +From 22e785ec2459c44f26bab754cfef7c1cbb25761d Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 22 Apr 2024 05:37:17 -0400 +Subject: net: openvswitch: Fix Use-After-Free in ovs_ct_exit + +From: Hyunwoo Kim <v4bel@theori.io> + +[ Upstream commit 5ea7b72d4fac2fdbc0425cd8f2ea33abe95235b2 ] + +Since kfree_rcu, which is called in the hlist_for_each_entry_rcu traversal +of ovs_ct_limit_exit, is not part of the RCU read critical section, it +is possible that the RCU grace period will pass during the traversal and +the key will be free. + +To prevent this, it should be changed to hlist_for_each_entry_safe. + +Fixes: 11efd5cb04a1 ("openvswitch: Support conntrack zone limit") +Signed-off-by: Hyunwoo Kim <v4bel@theori.io> +Reviewed-by: Eric Dumazet <edumazet@google.com> +Reviewed-by: Aaron Conole <aconole@redhat.com> +Link: https://lore.kernel.org/r/ZiYvzQN/Ry5oeFQW@v4bel-B760M-AORUS-ELITE-AX +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/openvswitch/conntrack.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c +index 60dd6f32d520e..85a338b681780 100644 +--- a/net/openvswitch/conntrack.c ++++ b/net/openvswitch/conntrack.c +@@ -1913,9 +1913,9 @@ static void ovs_ct_limit_exit(struct net *net, struct ovs_net *ovs_net) + for (i = 0; i < CT_LIMIT_HASH_BUCKETS; ++i) { + struct hlist_head *head = &info->limits[i]; + struct ovs_ct_limit *ct_limit; ++ struct hlist_node *next; + +- hlist_for_each_entry_rcu(ct_limit, head, hlist_node, +- lockdep_ovsl_is_held()) ++ hlist_for_each_entry_safe(ct_limit, next, head, hlist_node) + kfree_rcu(ct_limit, rcu); + } + kfree(info->limits); +-- +2.43.0 + diff --git a/queue-5.15/net-usb-ax88179_178a-stop-lying-about-skb-truesize.patch b/queue-5.15/net-usb-ax88179_178a-stop-lying-about-skb-truesize.patch new file mode 100644 index 0000000000..7c91db65bd --- /dev/null +++ b/queue-5.15/net-usb-ax88179_178a-stop-lying-about-skb-truesize.patch @@ -0,0 +1,64 @@ +From ff955b66ee449f604af45eabd4e66042b39f43a9 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Sun, 21 Apr 2024 19:38:28 +0000 +Subject: net: usb: ax88179_178a: stop lying about skb->truesize + +From: Eric Dumazet <edumazet@google.com> + +[ Upstream commit 4ce62d5b2f7aecd4900e7d6115588ad7f9acccca ] + +Some usb drivers try to set small skb->truesize and break +core networking stacks. + +In this patch, I removed one of the skb->truesize overide. + +I also replaced one skb_clone() by an allocation of a fresh +and small skb, to get minimally sized skbs, like we did +in commit 1e2c61172342 ("net: cdc_ncm: reduce skb truesize +in rx path") + +Fixes: f8ebb3ac881b ("net: usb: ax88179_178a: Fix packet receiving") +Reported-by: shironeko <shironeko@tesaguri.club> +Closes: https://lore.kernel.org/netdev/c110f41a0d2776b525930f213ca9715c@tesaguri.club/ +Signed-off-by: Eric Dumazet <edumazet@google.com> +Cc: Jose Alonso <joalonsof@gmail.com> +Reviewed-by: Simon Horman <horms@kernel.org> +Link: https://lore.kernel.org/r/20240421193828.1966195-1-edumazet@google.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/usb/ax88179_178a.c | 11 +++-------- + 1 file changed, 3 insertions(+), 8 deletions(-) + +diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c +index f11748cc5b228..868fad2f8c78a 100644 +--- a/drivers/net/usb/ax88179_178a.c ++++ b/drivers/net/usb/ax88179_178a.c +@@ -1478,21 +1478,16 @@ static int ax88179_rx_fixup(struct usbnet *dev, struct sk_buff *skb) + /* Skip IP alignment pseudo header */ + skb_pull(skb, 2); + +- skb->truesize = SKB_TRUESIZE(pkt_len_plus_padd); + ax88179_rx_checksum(skb, pkt_hdr); + return 1; + } + +- ax_skb = skb_clone(skb, GFP_ATOMIC); ++ ax_skb = netdev_alloc_skb_ip_align(dev->net, pkt_len); + if (!ax_skb) + return 0; +- skb_trim(ax_skb, pkt_len); ++ skb_put(ax_skb, pkt_len); ++ memcpy(ax_skb->data, skb->data + 2, pkt_len); + +- /* Skip IP alignment pseudo header */ +- skb_pull(ax_skb, 2); +- +- skb->truesize = pkt_len_plus_padd + +- SKB_DATA_ALIGN(sizeof(struct sk_buff)); + ax88179_rx_checksum(ax_skb, pkt_hdr); + usbnet_skb_return(dev, ax_skb); + +-- +2.43.0 + diff --git a/queue-5.15/netfilter-nf_tables-honor-table-dormant-flag-from-ne.patch b/queue-5.15/netfilter-nf_tables-honor-table-dormant-flag-from-ne.patch new file mode 100644 index 0000000000..b86b8218e3 --- /dev/null +++ b/queue-5.15/netfilter-nf_tables-honor-table-dormant-flag-from-ne.patch @@ -0,0 +1,73 @@ +From 36f2c6ff01f760a8932fba7aca30fa4c2a8b658b Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Wed, 24 Apr 2024 20:45:01 +0200 +Subject: netfilter: nf_tables: honor table dormant flag from netdev release + event path + +From: Pablo Neira Ayuso <pablo@netfilter.org> + +[ Upstream commit 8e30abc9ace4f0add4cd761dfdbfaebae5632dd2 ] + +Check for table dormant flag otherwise netdev release event path tries +to unregister an already unregistered hook. + +[524854.857999] ------------[ cut here ]------------ +[524854.858010] WARNING: CPU: 0 PID: 3386599 at net/netfilter/core.c:501 __nf_unregister_net_hook+0x21a/0x260 +[...] +[524854.858848] CPU: 0 PID: 3386599 Comm: kworker/u32:2 Not tainted 6.9.0-rc3+ #365 +[524854.858869] Workqueue: netns cleanup_net +[524854.858886] RIP: 0010:__nf_unregister_net_hook+0x21a/0x260 +[524854.858903] Code: 24 e8 aa 73 83 ff 48 63 43 1c 83 f8 01 0f 85 3d ff ff ff e8 98 d1 f0 ff 48 8b 3c 24 e8 8f 73 83 ff 48 63 43 1c e9 26 ff ff ff <0f> 0b 48 83 c4 18 48 c7 c7 00 68 e9 82 5b 5d 41 5c 41 5d 41 5e 41 +[524854.858914] RSP: 0018:ffff8881e36d79e0 EFLAGS: 00010246 +[524854.858926] RAX: 0000000000000000 RBX: ffff8881339ae790 RCX: ffffffff81ba524a +[524854.858936] RDX: dffffc0000000000 RSI: 0000000000000008 RDI: ffff8881c8a16438 +[524854.858945] RBP: ffff8881c8a16438 R08: 0000000000000001 R09: ffffed103c6daf34 +[524854.858954] R10: ffff8881e36d79a7 R11: 0000000000000000 R12: 0000000000000005 +[524854.858962] R13: ffff8881c8a16000 R14: 0000000000000000 R15: ffff8881351b5a00 +[524854.858971] FS: 0000000000000000(0000) GS:ffff888390800000(0000) knlGS:0000000000000000 +[524854.858982] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 +[524854.858991] CR2: 00007fc9be0f16f4 CR3: 00000001437cc004 CR4: 00000000001706f0 +[524854.859000] Call Trace: +[524854.859006] <TASK> +[524854.859013] ? __warn+0x9f/0x1a0 +[524854.859027] ? __nf_unregister_net_hook+0x21a/0x260 +[524854.859044] ? report_bug+0x1b1/0x1e0 +[524854.859060] ? handle_bug+0x3c/0x70 +[524854.859071] ? exc_invalid_op+0x17/0x40 +[524854.859083] ? asm_exc_invalid_op+0x1a/0x20 +[524854.859100] ? __nf_unregister_net_hook+0x6a/0x260 +[524854.859116] ? __nf_unregister_net_hook+0x21a/0x260 +[524854.859135] nf_tables_netdev_event+0x337/0x390 [nf_tables] +[524854.859304] ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables] +[524854.859461] ? packet_notifier+0xb3/0x360 +[524854.859476] ? _raw_spin_unlock_irqrestore+0x11/0x40 +[524854.859489] ? dcbnl_netdevice_event+0x35/0x140 +[524854.859507] ? __pfx_nf_tables_netdev_event+0x10/0x10 [nf_tables] +[524854.859661] notifier_call_chain+0x7d/0x140 +[524854.859677] unregister_netdevice_many_notify+0x5e1/0xae0 + +Fixes: d54725cd11a5 ("netfilter: nf_tables: support for multiple devices per netdev hook") +Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + net/netfilter/nft_chain_filter.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/net/netfilter/nft_chain_filter.c b/net/netfilter/nft_chain_filter.c +index 35aa4ea942051..8c76ca4d86a8a 100644 +--- a/net/netfilter/nft_chain_filter.c ++++ b/net/netfilter/nft_chain_filter.c +@@ -336,7 +336,9 @@ static void nft_netdev_event(unsigned long event, struct net_device *dev, + return; + + if (n > 1) { +- nf_unregister_net_hook(ctx->net, &found->ops); ++ if (!(ctx->chain->table->flags & NFT_TABLE_F_DORMANT)) ++ nf_unregister_net_hook(ctx->net, &found->ops); ++ + list_del_rcu(&found->list); + kfree_rcu(found, rcu); + return; +-- +2.43.0 + diff --git a/queue-5.15/nfc-trf7970a-disable-all-regulators-on-removal.patch b/queue-5.15/nfc-trf7970a-disable-all-regulators-on-removal.patch new file mode 100644 index 0000000000..862a884a1a --- /dev/null +++ b/queue-5.15/nfc-trf7970a-disable-all-regulators-on-removal.patch @@ -0,0 +1,145 @@ +From adb8716d02eb6b74c798e497aa503223e839cc23 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Thu, 18 Apr 2024 21:25:38 +0200 +Subject: NFC: trf7970a: disable all regulators on removal + +From: Paul Geurts <paul_geurts@live.nl> + +[ Upstream commit 6bea4f03c6a4e973ef369e15aac88f37981db49e ] + +During module probe, regulator 'vin' and 'vdd-io' are used and enabled, +but the vdd-io regulator overwrites the 'vin' regulator pointer. During +remove, only the vdd-io is disabled, as the vin regulator pointer is not +available anymore. When regulator_put() is called during resource +cleanup a kernel warning is given, as the regulator is still enabled. + +Store the two regulators in separate pointers and disable both the +regulators on module remove. + +Fixes: 49d22c70aaf0 ("NFC: trf7970a: Add device tree option of 1.8 Volt IO voltage") +Signed-off-by: Paul Geurts <paul_geurts@live.nl> +Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@linaro.org> +Link: https://lore.kernel.org/r/DB7PR09MB26847A4EBF88D9EDFEB1DA0F950E2@DB7PR09MB2684.eurprd09.prod.outlook.com +Signed-off-by: Jakub Kicinski <kuba@kernel.org> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/nfc/trf7970a.c | 42 +++++++++++++++++++++++------------------- + 1 file changed, 23 insertions(+), 19 deletions(-) + +diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c +index 8890fcd59c39e..cfc2a7e652719 100644 +--- a/drivers/nfc/trf7970a.c ++++ b/drivers/nfc/trf7970a.c +@@ -424,7 +424,8 @@ struct trf7970a { + enum trf7970a_state state; + struct device *dev; + struct spi_device *spi; +- struct regulator *regulator; ++ struct regulator *vin_regulator; ++ struct regulator *vddio_regulator; + struct nfc_digital_dev *ddev; + u32 quirks; + bool is_initiator; +@@ -1883,7 +1884,7 @@ static int trf7970a_power_up(struct trf7970a *trf) + if (trf->state != TRF7970A_ST_PWR_OFF) + return 0; + +- ret = regulator_enable(trf->regulator); ++ ret = regulator_enable(trf->vin_regulator); + if (ret) { + dev_err(trf->dev, "%s - Can't enable VIN: %d\n", __func__, ret); + return ret; +@@ -1926,7 +1927,7 @@ static int trf7970a_power_down(struct trf7970a *trf) + if (trf->en2_gpiod && !(trf->quirks & TRF7970A_QUIRK_EN2_MUST_STAY_LOW)) + gpiod_set_value_cansleep(trf->en2_gpiod, 0); + +- ret = regulator_disable(trf->regulator); ++ ret = regulator_disable(trf->vin_regulator); + if (ret) + dev_err(trf->dev, "%s - Can't disable VIN: %d\n", __func__, + ret); +@@ -2065,37 +2066,37 @@ static int trf7970a_probe(struct spi_device *spi) + mutex_init(&trf->lock); + INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler); + +- trf->regulator = devm_regulator_get(&spi->dev, "vin"); +- if (IS_ERR(trf->regulator)) { +- ret = PTR_ERR(trf->regulator); ++ trf->vin_regulator = devm_regulator_get(&spi->dev, "vin"); ++ if (IS_ERR(trf->vin_regulator)) { ++ ret = PTR_ERR(trf->vin_regulator); + dev_err(trf->dev, "Can't get VIN regulator: %d\n", ret); + goto err_destroy_lock; + } + +- ret = regulator_enable(trf->regulator); ++ ret = regulator_enable(trf->vin_regulator); + if (ret) { + dev_err(trf->dev, "Can't enable VIN: %d\n", ret); + goto err_destroy_lock; + } + +- uvolts = regulator_get_voltage(trf->regulator); ++ uvolts = regulator_get_voltage(trf->vin_regulator); + if (uvolts > 4000000) + trf->chip_status_ctrl = TRF7970A_CHIP_STATUS_VRS5_3; + +- trf->regulator = devm_regulator_get(&spi->dev, "vdd-io"); +- if (IS_ERR(trf->regulator)) { +- ret = PTR_ERR(trf->regulator); ++ trf->vddio_regulator = devm_regulator_get(&spi->dev, "vdd-io"); ++ if (IS_ERR(trf->vddio_regulator)) { ++ ret = PTR_ERR(trf->vddio_regulator); + dev_err(trf->dev, "Can't get VDD_IO regulator: %d\n", ret); +- goto err_destroy_lock; ++ goto err_disable_vin_regulator; + } + +- ret = regulator_enable(trf->regulator); ++ ret = regulator_enable(trf->vddio_regulator); + if (ret) { + dev_err(trf->dev, "Can't enable VDD_IO: %d\n", ret); +- goto err_destroy_lock; ++ goto err_disable_vin_regulator; + } + +- if (regulator_get_voltage(trf->regulator) == 1800000) { ++ if (regulator_get_voltage(trf->vddio_regulator) == 1800000) { + trf->io_ctrl = TRF7970A_REG_IO_CTRL_IO_LOW; + dev_dbg(trf->dev, "trf7970a config vdd_io to 1.8V\n"); + } +@@ -2108,7 +2109,7 @@ static int trf7970a_probe(struct spi_device *spi) + if (!trf->ddev) { + dev_err(trf->dev, "Can't allocate NFC digital device\n"); + ret = -ENOMEM; +- goto err_disable_regulator; ++ goto err_disable_vddio_regulator; + } + + nfc_digital_set_parent_dev(trf->ddev, trf->dev); +@@ -2137,8 +2138,10 @@ static int trf7970a_probe(struct spi_device *spi) + trf7970a_shutdown(trf); + err_free_ddev: + nfc_digital_free_device(trf->ddev); +-err_disable_regulator: +- regulator_disable(trf->regulator); ++err_disable_vddio_regulator: ++ regulator_disable(trf->vddio_regulator); ++err_disable_vin_regulator: ++ regulator_disable(trf->vin_regulator); + err_destroy_lock: + mutex_destroy(&trf->lock); + return ret; +@@ -2157,7 +2160,8 @@ static int trf7970a_remove(struct spi_device *spi) + nfc_digital_unregister_device(trf->ddev); + nfc_digital_free_device(trf->ddev); + +- regulator_disable(trf->regulator); ++ regulator_disable(trf->vddio_regulator); ++ regulator_disable(trf->vin_regulator); + + mutex_destroy(&trf->lock); + +-- +2.43.0 + diff --git a/queue-5.15/series b/queue-5.15/series new file mode 100644 index 0000000000..78f2bfc703 --- /dev/null +++ b/queue-5.15/series @@ -0,0 +1,43 @@ +smb-client-fix-rename-2-regression-against-samba.patch +cifs-reinstate-original-behavior-again-for-forceuid-.patch +hid-intel-ish-hid-ipc-fix-dev_err-usage-with-uniniti.patch +hid-logitech-dj-allow-mice-to-use-all-types-of-repor.patch +arm64-dts-rockchip-enable-internal-pull-up-on-q7_usb.patch +arm64-dts-rockchip-fix-alphabetical-ordering-rk3399-.patch +arm64-dts-rockchip-enable-internal-pull-up-on-pcie_w.patch +arm64-dts-rockchip-remove-unsupported-node-from-the-.patch +arm64-dts-mediatek-mt8183-add-power-domains-properit.patch +arm64-dts-mediatek-mt7622-add-support-for-coherent-d.patch +arm64-dts-mediatek-mt7622-introduce-nodes-for-wirele.patch +arm64-dts-mediatek-mt7622-fix-clock-controllers.patch +arm64-dts-mediatek-mt7622-fix-ir-nodename.patch +arm64-dts-mediatek-mt7622-fix-ethernet-controller-co.patch +arm64-dts-mediatek-mt7622-drop-reset-names-from-ther.patch +arm64-dts-mediatek-mt2712-fix-validation-errors.patch +arc-plat-hsdk-remove-misplaced-interrupt-cells-prope.patch +wifi-iwlwifi-mvm-remove-old-pasn-station-when-adding.patch +wifi-iwlwifi-mvm-return-uid-from-iwl_mvm_build_scan_.patch +vxlan-drop-packets-from-invalid-src-address.patch +mlxsw-core-unregister-emad-trap-using-forward-action.patch +icmp-prevent-possible-null-dereferences-from-icmp_bu.patch +bridge-br_netlink.c-no-need-to-return-void-function.patch +nfc-trf7970a-disable-all-regulators-on-removal.patch +ipv4-check-for-null-idev-in-ip_route_use_hint.patch +net-usb-ax88179_178a-stop-lying-about-skb-truesize.patch +net-gtp-fix-use-after-free-in-gtp_dellink.patch +ipvs-fix-checksumming-on-gso-of-sctp-packets.patch +net-openvswitch-fix-use-after-free-in-ovs_ct_exit.patch +mlxsw-spectrum_acl_tcam-fix-race-during-rehash-delay.patch +mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch +mlxsw-spectrum_acl_tcam-fix-possible-use-after-free-.patch-29620 +mlxsw-spectrum_acl_tcam-rate-limit-error-message.patch +mlxsw-spectrum_acl_tcam-fix-memory-leak-during-rehas.patch +mlxsw-spectrum_acl_tcam-fix-warning-during-rehash.patch +mlxsw-spectrum_acl_tcam-fix-incorrect-list-api-usage.patch +mlxsw-spectrum_acl_tcam-fix-memory-leak-when-canceli.patch +netfilter-nf_tables-honor-table-dormant-flag-from-ne.patch +i40e-do-not-use-wq_mem_reclaim-flag-for-workqueue.patch +i40e-report-mfs-in-decimal-base-instead-of-hex.patch +iavf-fix-tc-config-comparison-with-existing-adapter-.patch +net-ethernet-ti-am65-cpts-fix-ptpv1-message-type-on-.patch +af_unix-suppress-false-positive-lockdep-splat-for-sp.patch diff --git a/queue-5.15/smb-client-fix-rename-2-regression-against-samba.patch b/queue-5.15/smb-client-fix-rename-2-regression-against-samba.patch new file mode 100644 index 0000000000..8b5742d356 --- /dev/null +++ b/queue-5.15/smb-client-fix-rename-2-regression-against-samba.patch @@ -0,0 +1,56 @@ +From a47d829cd76682523dfee185637a5353f146e1f4 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Fri, 19 Apr 2024 12:05:07 -0300 +Subject: smb: client: fix rename(2) regression against samba + +From: Paulo Alcantara <pc@manguebit.com> + +[ Upstream commit 18d86965e31f9be4d477da0744a7cdc9815858de ] + +After commit 2c7d399e551c ("smb: client: reuse file lease key in +compound operations") the client started reusing lease keys for +rename, unlink and set path size operations to prevent it from +breaking its own leases and thus causing unnecessary lease breaks to +same connection. + +The implementation relies on positive dentries and +cifsInodeInfo::lease_granted to decide whether reusing lease keys for +the compound requests. cifsInodeInfo::lease_granted was introduced by +commit 0ab95c2510b6 ("Defer close only when lease is enabled.") to +indicate whether lease caching is granted for a specific file, but +that can only happen until file is open, so +cifsInodeInfo::lease_granted was left uninitialised in ->alloc_inode +and then client started sending random lease keys for files that +hadn't any leases. + +This fixes the following test case against samba: + +mount.cifs //srv/share /mnt/1 -o ...,nosharesock +mount.cifs //srv/share /mnt/2 -o ...,nosharesock +touch /mnt/1/foo; tail -f /mnt/1/foo & pid=$! +mv /mnt/2/foo /mnt/2/bar # fails with -EIO +kill $pid + +Fixes: 0ab95c2510b6 ("Defer close only when lease is enabled.") +Signed-off-by: Paulo Alcantara (Red Hat) <pc@manguebit.com> +Signed-off-by: Steve French <stfrench@microsoft.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + fs/cifs/cifsfs.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c +index 9bbead15a0287..d3adcb9e70a66 100644 +--- a/fs/cifs/cifsfs.c ++++ b/fs/cifs/cifsfs.c +@@ -374,6 +374,7 @@ cifs_alloc_inode(struct super_block *sb) + * server, can not assume caching of file data or metadata. + */ + cifs_set_oplock_level(cifs_inode, 0); ++ cifs_inode->lease_granted = false; + cifs_inode->flags = 0; + spin_lock_init(&cifs_inode->writers_lock); + cifs_inode->writers = 0; +-- +2.43.0 + diff --git a/queue-5.15/vxlan-drop-packets-from-invalid-src-address.patch b/queue-5.15/vxlan-drop-packets-from-invalid-src-address.patch new file mode 100644 index 0000000000..9d126fa163 --- /dev/null +++ b/queue-5.15/vxlan-drop-packets-from-invalid-src-address.patch @@ -0,0 +1,52 @@ +From 09c3d9374a7db49c4dbdb8246d01a784e22e4b52 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Thu, 18 Apr 2024 15:29:08 +0200 +Subject: vxlan: drop packets from invalid src-address + +From: David Bauer <mail@david-bauer.net> + +[ Upstream commit f58f45c1e5b92975e91754f5407250085a6ae7cf ] + +The VXLAN driver currently does not check if the inner layer2 +source-address is valid. + +In case source-address snooping/learning is enabled, a entry in the FDB +for the invalid address is created with the layer3 address of the tunnel +endpoint. + +If the frame happens to have a non-unicast address set, all this +non-unicast traffic is subsequently not flooded to the tunnel network +but sent to the learnt host in the FDB. To make matters worse, this FDB +entry does not expire. + +Apply the same filtering for packets as it is done for bridges. This not +only drops these invalid packets but avoids them from being learnt into +the FDB. + +Fixes: d342894c5d2f ("vxlan: virtual extensible lan") +Suggested-by: Ido Schimmel <idosch@nvidia.com> +Signed-off-by: David Bauer <mail@david-bauer.net> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/vxlan/vxlan_core.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c +index 41b1b23fdd3e9..2e61041a11131 100644 +--- a/drivers/net/vxlan/vxlan_core.c ++++ b/drivers/net/vxlan/vxlan_core.c +@@ -1779,6 +1779,10 @@ static bool vxlan_set_mac(struct vxlan_dev *vxlan, + if (ether_addr_equal(eth_hdr(skb)->h_source, vxlan->dev->dev_addr)) + return false; + ++ /* Ignore packets from invalid src-address */ ++ if (!is_valid_ether_addr(eth_hdr(skb)->h_source)) ++ return false; ++ + /* Get address from the outer IP header */ + if (vxlan_get_sk_family(vs) == AF_INET) { + saddr.sin.sin_addr.s_addr = ip_hdr(skb)->saddr; +-- +2.43.0 + diff --git a/queue-5.15/wifi-iwlwifi-mvm-remove-old-pasn-station-when-adding.patch b/queue-5.15/wifi-iwlwifi-mvm-remove-old-pasn-station-when-adding.patch new file mode 100644 index 0000000000..d213f2e802 --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-mvm-remove-old-pasn-station-when-adding.patch @@ -0,0 +1,40 @@ +From 0788f7c4ee63474e0890be6e338f1099d007f5de Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 15 Apr 2024 11:54:43 +0300 +Subject: wifi: iwlwifi: mvm: remove old PASN station when adding a new one + +From: Avraham Stern <avraham.stern@intel.com> + +[ Upstream commit dbfff5bf9292714f02ace002fea8ce6599ea1145 ] + +If a PASN station is added, and an old PASN station already exists +for the same mac address, remove the old station before adding the +new one. Keeping the old station caueses old security context to +be used in measurements. + +Fixes: 0739a7d70e00 ("iwlwifi: mvm: initiator: add option for adding a PASN responder") +Signed-off-by: Avraham Stern <avraham.stern@intel.com> +Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> +Link: https://msgid.link/20240415114847.ef3544a416f2.I4e8c7c8ca22737f4f908ae5cd4fc0b920c703dd3@changeid +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c +index bb5fff8174435..2dcf5a827b361 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/ftm-initiator.c +@@ -48,6 +48,8 @@ int iwl_mvm_ftm_add_pasn_sta(struct iwl_mvm *mvm, struct ieee80211_vif *vif, + if (!pasn) + return -ENOBUFS; + ++ iwl_mvm_ftm_remove_pasn_sta(mvm, addr); ++ + pasn->cipher = iwl_mvm_cipher_to_location_cipher(cipher); + + switch (pasn->cipher) { +-- +2.43.0 + diff --git a/queue-5.15/wifi-iwlwifi-mvm-return-uid-from-iwl_mvm_build_scan_.patch b/queue-5.15/wifi-iwlwifi-mvm-return-uid-from-iwl_mvm_build_scan_.patch new file mode 100644 index 0000000000..ee99e1a5d7 --- /dev/null +++ b/queue-5.15/wifi-iwlwifi-mvm-return-uid-from-iwl_mvm_build_scan_.patch @@ -0,0 +1,44 @@ +From b1826c2d9c3ed8435edd97bd10f9e7699fc7fb17 Mon Sep 17 00:00:00 2001 +From: Sasha Levin <sashal@kernel.org> +Date: Mon, 15 Apr 2024 11:54:44 +0300 +Subject: wifi: iwlwifi: mvm: return uid from iwl_mvm_build_scan_cmd + +From: Miri Korenblit <miriam.rachel.korenblit@intel.com> + +[ Upstream commit bada85a3f584763deadd201147778c3e791d279c ] + +This function is supposed to return a uid on success, and an errno in +failure. +But it currently returns the return value of the specific cmd version +handler, which in turn returns 0 on success and errno otherwise. +This means that on success, iwl_mvm_build_scan_cmd will return 0 +regardless if the actual uid. +Fix this by returning the uid if the handler succeeded. + +Fixes: 687db6ff5b70 ("iwlwifi: scan: make new scan req versioning flow") +Signed-off-by: Miri Korenblit <miriam.rachel.korenblit@intel.com> +Reviewed-by: Ilan Peer <ilan.peer@intel.com> +Link: https://msgid.link/20240415114847.5e2d602b3190.I4c4931021be74a67a869384c8f8ee7463e0c7857@changeid +Signed-off-by: Johannes Berg <johannes.berg@intel.com> +Signed-off-by: Sasha Levin <sashal@kernel.org> +--- + drivers/net/wireless/intel/iwlwifi/mvm/scan.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +index e4fd58f043ce2..c0ffa26bc5aaa 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/scan.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/scan.c +@@ -2571,7 +2571,8 @@ static int iwl_mvm_build_scan_cmd(struct iwl_mvm *mvm, + if (ver_handler->version != scan_ver) + continue; + +- return ver_handler->handler(mvm, vif, params, type, uid); ++ err = ver_handler->handler(mvm, vif, params, type, uid); ++ return err ? : uid; + } + + err = iwl_mvm_scan_umac(mvm, vif, params, type, uid); +-- +2.43.0 + |