Home Home > GIT Browse
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-03-21 12:37:53 +0100
committerTakashi Iwai <tiwai@suse.de>2019-03-21 12:38:39 +0100
commit112266d38f62ad8902a5d7c759dc7e4e05bf2421 (patch)
treeb99f0b48b58212314e5e01a4de56cf8f73ada3e8
parent2748115b858d54d25c6f4742f3db8f4861ce2320 (diff)
parentfb85ef51edefb8ac1c4de6a8dc72a5a91e8d5252 (diff)
Merge branch 'users/dkirjanov/SLE15/for-next' into SLE15
Pull net fixes from Denis Kirjanov
-rw-r--r--patches.fixes/0001-mlxsw-__mlxsw_sp_port_headroom_set-Fix-a-use-of-loca.patch55
-rw-r--r--patches.fixes/0001-net-mlx5-fix-uaccess-beyond-count-in-debugfs-read-wr.patch143
-rw-r--r--patches.fixes/0001-net-stmmac-Fix-a-race-in-EEE-enable-callback.patch65
-rw-r--r--patches.fixes/0001-net-stmmac-Use-mutex-instead-of-spinlock.patch226
-rw-r--r--patches.fixes/0001-net-stmmac-fix-broken-dma_interrupt-handling-for-mul.patch127
-rw-r--r--patches.fixes/0001-net-stmmac-handle-endianness-in-dwmac4_get_timestamp.patch42
-rw-r--r--patches.fixes/0001-net-thunderx-fix-NULL-pointer-dereference-in-nic_rem.patch76
-rw-r--r--series.conf7
8 files changed, 741 insertions, 0 deletions
diff --git a/patches.fixes/0001-mlxsw-__mlxsw_sp_port_headroom_set-Fix-a-use-of-loca.patch b/patches.fixes/0001-mlxsw-__mlxsw_sp_port_headroom_set-Fix-a-use-of-loca.patch
new file mode 100644
index 0000000000..21c1f1ce62
--- /dev/null
+++ b/patches.fixes/0001-mlxsw-__mlxsw_sp_port_headroom_set-Fix-a-use-of-loca.patch
@@ -0,0 +1,55 @@
+From: Petr Machata <petrm@mellanox.com>
+Subject: mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable
+Patch-mainline: v5.0-rc8
+Git-commit: 289460404f6947ef1c38e67d680be9a84161250b
+References: git-fixes
+
+The function-local variable "delay" enters the loop interpreted as delay
+in bits. However, inside the loop it gets overwritten by the result of
+mlxsw_sp_pg_buf_delay_get(), and thus leaves the loop as quantity in
+cells. Thus on second and further loop iterations, the headroom for a
+given priority is configured with a wrong size.
+
+Fix by introducing a loop-local variable, delay_cells. Rename thres to
+thres_cells for consistency.
+
+Fixes: f417f04da589 ("mlxsw: spectrum: Refactor port buffer configuration")
+Signed-off-by: Petr Machata <petrm@mellanox.com>
+Acked-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -867,8 +867,9 @@ int __mlxsw_sp_port_headroom_set(struct
+ for (i = 0; i < IEEE_8021QAZ_MAX_TCS; i++) {
+ bool configure = false;
+ bool pfc = false;
++ u16 thres_cells;
++ u16 delay_cells;
+ bool lossy;
+- u16 thres;
+
+ for (j = 0; j < IEEE_8021QAZ_MAX_TCS; j++) {
+ if (prio_tc[j] == i) {
+@@ -881,11 +882,11 @@ int __mlxsw_sp_port_headroom_set(struct
+ if (!configure)
+ continue;
+
+- lossy = !(pfc || pause_en);
+- thres = mlxsw_sp_pg_buf_threshold_get(mlxsw_sp, mtu);
+- delay = mlxsw_sp_pg_buf_delay_get(mlxsw_sp, mtu, delay, pfc,
+- pause_en);
+- mlxsw_sp_pg_buf_pack(pbmc_pl, i, thres + delay, thres, lossy);
++ thres_cells = mlxsw_sp_pg_buf_threshold_get(mlxsw_sp, mtu);
++ delay_cells = mlxsw_sp_pg_buf_delay_get(mlxsw_sp, mtu, delay,
++ pfc, pause_en);
++ mlxsw_sp_pg_buf_pack(pbmc_pl, i, thres_cells + delay_cells,
++ thres_cells, lossy);
+ }
+
+ return mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(pbmc), pbmc_pl);
diff --git a/patches.fixes/0001-net-mlx5-fix-uaccess-beyond-count-in-debugfs-read-wr.patch b/patches.fixes/0001-net-mlx5-fix-uaccess-beyond-count-in-debugfs-read-wr.patch
new file mode 100644
index 0000000000..78cf74756d
--- /dev/null
+++ b/patches.fixes/0001-net-mlx5-fix-uaccess-beyond-count-in-debugfs-read-wr.patch
@@ -0,0 +1,143 @@
+From: Jann Horn <jannh@google.com>
+Subject: net/mlx5: fix uaccess beyond "count" in debugfs read/write handlers
+Patch-mainline: v4.19-rc1
+Git-commit: 31e33a5b41bb158f27c30e13b12d6e5e6513ea05
+References: git-fixes
+
+In general, accessing userspace memory beyond the length of the supplied
+buffer in VFS read/write handlers can lead to both kernel memory corruption
+(via kernel_read()/kernel_write(), which can e.g. be triggered via
+sys_splice()) and privilege escalation inside userspace.
+
+In this case, the affected files are in debugfs (and should therefore only
+be accessible to root) and check that *pos is zero (which prevents the
+sys_splice() trick). Therefore, this is not a security fix, but rather a
+small cleanup.
+
+For the read handlers, fix it by using simple_read_from_buffer() instead of
+custom logic.
+For the write handler, add a check.
+
+changed in v2:
+ - also fix dbg_write()
+
+Fixes: e126ba97dba9 ("mlx5: Add driver for Mellanox Connect-IB adapters")
+Signed-off-by: Jann Horn <jannh@google.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 28 +++++-----------------
+ drivers/net/ethernet/mellanox/mlx5/core/debugfs.c | 21 +---------------
+ 2 files changed, 9 insertions(+), 40 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -1020,7 +1020,10 @@ static ssize_t dbg_write(struct file *fi
+ if (!dbg->in_msg || !dbg->out_msg)
+ return -ENOMEM;
+
+- if (copy_from_user(lbuf, buf, sizeof(lbuf)))
++ if (count < sizeof(lbuf) - 1)
++ return -EINVAL;
++
++ if (copy_from_user(lbuf, buf, sizeof(lbuf) - 1))
+ return -EFAULT;
+
+ lbuf[sizeof(lbuf) - 1] = 0;
+@@ -1224,21 +1227,12 @@ static ssize_t data_read(struct file *fi
+ {
+ struct mlx5_core_dev *dev = filp->private_data;
+ struct mlx5_cmd_debug *dbg = &dev->cmd.dbg;
+- int copy;
+-
+- if (*pos)
+- return 0;
+
+ if (!dbg->out_msg)
+ return -ENOMEM;
+
+- copy = min_t(int, count, dbg->outlen);
+- if (copy_to_user(buf, dbg->out_msg, copy))
+- return -EFAULT;
+-
+- *pos += copy;
+-
+- return copy;
++ return simple_read_from_buffer(buf, count, pos, dbg->out_msg,
++ dbg->outlen);
+ }
+
+ static const struct file_operations dfops = {
+@@ -1256,19 +1250,11 @@ static ssize_t outlen_read(struct file *
+ char outlen[8];
+ int err;
+
+- if (*pos)
+- return 0;
+-
+ err = snprintf(outlen, sizeof(outlen), "%d", dbg->outlen);
+ if (err < 0)
+ return err;
+
+- if (copy_to_user(buf, &outlen, err))
+- return -EFAULT;
+-
+- *pos += err;
+-
+- return err;
++ return simple_read_from_buffer(buf, count, pos, outlen, err);
+ }
+
+ static ssize_t outlen_write(struct file *filp, const char __user *buf,
+--- a/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/debugfs.c
+@@ -150,22 +150,14 @@ static ssize_t average_read(struct file
+ int ret;
+ char tbuf[22];
+
+- if (*pos)
+- return 0;
+-
+ stats = filp->private_data;
+ spin_lock_irq(&stats->lock);
+ if (stats->n)
+ field = div64_u64(stats->sum, stats->n);
+ spin_unlock_irq(&stats->lock);
+ ret = snprintf(tbuf, sizeof(tbuf), "%llu\n", field);
+- if (ret > 0) {
+- if (copy_to_user(buf, tbuf, ret))
+- return -EFAULT;
+- }
+
+- *pos += ret;
+- return ret;
++ return simple_read_from_buffer(buf, count, pos, tbuf, ret);
+ }
+
+ static ssize_t average_write(struct file *filp, const char __user *buf,
+@@ -442,9 +434,6 @@ static ssize_t dbg_read(struct file *fil
+ u64 field;
+ int ret;
+
+- if (*pos)
+- return 0;
+-
+ desc = filp->private_data;
+ d = (void *)(desc - desc->i) - sizeof(*d);
+ switch (d->type) {
+@@ -470,13 +459,7 @@ static ssize_t dbg_read(struct file *fil
+ else
+ ret = snprintf(tbuf, sizeof(tbuf), "0x%llx\n", field);
+
+- if (ret > 0) {
+- if (copy_to_user(buf, tbuf, ret))
+- return -EFAULT;
+- }
+-
+- *pos += ret;
+- return ret;
++ return simple_read_from_buffer(buf, count, pos, tbuf, ret);
+ }
+
+ static const struct file_operations fops = {
diff --git a/patches.fixes/0001-net-stmmac-Fix-a-race-in-EEE-enable-callback.patch b/patches.fixes/0001-net-stmmac-Fix-a-race-in-EEE-enable-callback.patch
new file mode 100644
index 0000000000..2626fa70e2
--- /dev/null
+++ b/patches.fixes/0001-net-stmmac-Fix-a-race-in-EEE-enable-callback.patch
@@ -0,0 +1,65 @@
+From: Jose Abreu <jose.abreu@synopsys.com>
+Subject: net: stmmac: Fix a race in EEE enable callback
+Patch-mainline: v5.0-rc8
+Git-commit: 8a7493e58ad688eb23b81e45461c5d314f4402f1
+References: git-fixes
+
+We are saving the status of EEE even before we try to enable it. This
+leads to a race with XMIT function that tries to arm EEE timer before we
+set it up.
+
+Fix this by only saving the EEE parameters after all operations are
+performed with success.
+
+Signed-off-by: Jose Abreu <joabreu@synopsys.com>
+Fixes: d765955d2ae0 ("stmmac: add the Energy Efficient Ethernet support")
+Cc: Joao Pinto <jpinto@synopsys.com>
+Cc: David S. Miller <davem@davemloft.net>
+Cc: Giuseppe Cavallaro <peppe.cavallaro@st.com>
+Cc: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 22 ++++++++++---------
+ 1 file changed, 12 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -670,25 +670,27 @@ static int stmmac_ethtool_op_set_eee(str
+ struct ethtool_eee *edata)
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
++ int ret;
+
+- priv->eee_enabled = edata->eee_enabled;
+-
+- if (!priv->eee_enabled)
++ if (!edata->eee_enabled) {
+ stmmac_disable_eee_mode(priv);
+- else {
++ } else {
+ /* We are asking for enabling the EEE but it is safe
+ * to verify all by invoking the eee_init function.
+ * In case of failure it will return an error.
+ */
+- priv->eee_enabled = stmmac_eee_init(priv);
+- if (!priv->eee_enabled)
++ edata->eee_enabled = stmmac_eee_init(priv);
++ if (!edata->eee_enabled)
+ return -EOPNOTSUPP;
+-
+- /* Do not change tx_lpi_timer in case of failure */
+- priv->tx_lpi_timer = edata->tx_lpi_timer;
+ }
+
+- return phy_ethtool_set_eee(dev->phydev, edata);
++ ret = phy_ethtool_set_eee(dev->phydev, edata);
++ if (ret)
++ return ret;
++
++ priv->eee_enabled = edata->eee_enabled;
++ priv->tx_lpi_timer = edata->tx_lpi_timer;
++ return 0;
+ }
+
+ static u32 stmmac_usec2riwt(u32 usec, struct stmmac_priv *priv)
diff --git a/patches.fixes/0001-net-stmmac-Use-mutex-instead-of-spinlock.patch b/patches.fixes/0001-net-stmmac-Use-mutex-instead-of-spinlock.patch
new file mode 100644
index 0000000000..4733effc10
--- /dev/null
+++ b/patches.fixes/0001-net-stmmac-Use-mutex-instead-of-spinlock.patch
@@ -0,0 +1,226 @@
+From: Thierry Reding <treding@nvidia.com>
+Subject: net: stmmac: Use mutex instead of spinlock
+Patch-mainline: v4.18-rc1
+Git-commit: 29555fa3de865630570b5f53c847b953413daf1a
+References: git-fixes
+
+Some drivers, such as DWC EQOS on Tegra, need to perform operations that
+can sleep under this lock (clk_set_rate() in tegra_eqos_fix_speed()) for
+proper operation. Since there is no need for this lock to be a spinlock,
+convert it to a mutex instead.
+
+Fixes: e6ea2d16fc61 ("net: stmmac: dwc-qos: Add Tegra186 support")
+Reported-by: Jon Hunter <jonathanh@nvidia.com>
+Signed-off-by: Thierry Reding <treding@nvidia.com>
+Tested-by: Bhadram Varka <vbhadram@nvidia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac.h | 2 -
+ drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c | 12 +++----
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 31 ++++++++-----------
+ 3 files changed, 21 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac.h
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac.h
+@@ -96,7 +96,7 @@ struct stmmac_priv {
+ struct net_device *dev;
+ struct device *device;
+ struct mac_device_info *hw;
+- spinlock_t lock;
++ struct mutex lock;
+
+ /* RX Queue */
+ struct stmmac_rx_queue rx_queue[MTL_MAX_RX_QUEUES];
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -390,13 +390,13 @@ stmmac_ethtool_set_link_ksettings(struct
+ ADVERTISED_10baseT_Half |
+ ADVERTISED_10baseT_Full);
+
+- spin_lock(&priv->lock);
++ mutex_lock(&priv->lock);
+
+ if (priv->hw->mac->pcs_ctrl_ane)
+ priv->hw->mac->pcs_ctrl_ane(priv->ioaddr, 1,
+ priv->hw->ps, 0);
+
+- spin_unlock(&priv->lock);
++ mutex_unlock(&priv->lock);
+
+ return 0;
+ }
+@@ -610,12 +610,12 @@ static void stmmac_get_wol(struct net_de
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
+
+- spin_lock_irq(&priv->lock);
++ mutex_lock(&priv->lock);
+ if (device_can_wakeup(priv->device)) {
+ wol->supported = WAKE_MAGIC | WAKE_UCAST;
+ wol->wolopts = priv->wolopts;
+ }
+- spin_unlock_irq(&priv->lock);
++ mutex_unlock(&priv->lock);
+ }
+
+ static int stmmac_set_wol(struct net_device *dev, struct ethtool_wolinfo *wol)
+@@ -644,9 +644,9 @@ static int stmmac_set_wol(struct net_dev
+ disable_irq_wake(priv->wol_irq);
+ }
+
+- spin_lock_irq(&priv->lock);
++ mutex_lock(&priv->lock);
+ priv->wolopts = wol->wolopts;
+- spin_unlock_irq(&priv->lock);
++ mutex_unlock(&priv->lock);
+
+ return 0;
+ }
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -354,7 +354,6 @@ bool stmmac_eee_init(struct stmmac_priv
+ {
+ struct net_device *ndev = priv->dev;
+ int interface = priv->plat->interface;
+- unsigned long flags;
+ bool ret = false;
+
+ if ((interface != PHY_INTERFACE_MODE_MII) &&
+@@ -381,7 +380,7 @@ bool stmmac_eee_init(struct stmmac_priv
+ * changed).
+ * In that case the driver disable own timers.
+ */
+- spin_lock_irqsave(&priv->lock, flags);
++ mutex_lock(&priv->lock);
+ if (priv->eee_active) {
+ netdev_dbg(priv->dev, "disable EEE\n");
+ del_timer_sync(&priv->eee_ctrl_timer);
+@@ -389,11 +388,11 @@ bool stmmac_eee_init(struct stmmac_priv
+ tx_lpi_timer);
+ }
+ priv->eee_active = 0;
+- spin_unlock_irqrestore(&priv->lock, flags);
++ mutex_unlock(&priv->lock);
+ goto out;
+ }
+ /* Activate the EEE and start timers */
+- spin_lock_irqsave(&priv->lock, flags);
++ mutex_lock(&priv->lock);
+ if (!priv->eee_active) {
+ priv->eee_active = 1;
+ setup_timer(&priv->eee_ctrl_timer,
+@@ -410,7 +409,7 @@ bool stmmac_eee_init(struct stmmac_priv
+ priv->hw->mac->set_eee_pls(priv->hw, ndev->phydev->link);
+
+ ret = true;
+- spin_unlock_irqrestore(&priv->lock, flags);
++ mutex_unlock(&priv->lock);
+
+ netdev_dbg(priv->dev, "Energy-Efficient Ethernet initialized\n");
+ }
+@@ -789,13 +788,12 @@ static void stmmac_adjust_link(struct ne
+ {
+ struct stmmac_priv *priv = netdev_priv(dev);
+ struct phy_device *phydev = dev->phydev;
+- unsigned long flags;
+ int new_state = 0;
+
+ if (!phydev)
+ return;
+
+- spin_lock_irqsave(&priv->lock, flags);
++ mutex_lock(&priv->lock);
+
+ if (phydev->link) {
+ u32 ctrl = readl(priv->ioaddr + MAC_CTRL_REG);
+@@ -867,7 +865,7 @@ static void stmmac_adjust_link(struct ne
+ if (new_state && netif_msg_link(priv))
+ phy_print_status(phydev);
+
+- spin_unlock_irqrestore(&priv->lock, flags);
++ mutex_unlock(&priv->lock);
+
+ if (phydev->is_pseudo_fixed_link)
+ /* Stop PHY layer to call the hook to adjust the link in case
+@@ -4202,7 +4200,7 @@ int stmmac_dvr_probe(struct device *devi
+ (8 * priv->plat->rx_queues_to_use));
+ }
+
+- spin_lock_init(&priv->lock);
++ mutex_init(&priv->lock);
+
+ /* If a specific clk_csr value is passed from the platform
+ * this means that the CSR Clock Range selection cannot be
+@@ -4283,6 +4281,7 @@ int stmmac_dvr_remove(struct device *dev
+ priv->hw->pcs != STMMAC_PCS_TBI &&
+ priv->hw->pcs != STMMAC_PCS_RTBI)
+ stmmac_mdio_unregister(ndev);
++ mutex_destroy(&priv->lock);
+ free_netdev(ndev);
+
+ return 0;
+@@ -4300,7 +4299,6 @@ int stmmac_suspend(struct device *dev)
+ {
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct stmmac_priv *priv = netdev_priv(ndev);
+- unsigned long flags;
+
+ if (!ndev || !netif_running(ndev))
+ return 0;
+@@ -4308,7 +4306,7 @@ int stmmac_suspend(struct device *dev)
+ if (ndev->phydev)
+ phy_stop(ndev->phydev);
+
+- spin_lock_irqsave(&priv->lock, flags);
++ mutex_lock(&priv->lock);
+
+ netif_device_detach(ndev);
+ stmmac_stop_all_queues(priv);
+@@ -4329,7 +4327,7 @@ int stmmac_suspend(struct device *dev)
+ clk_disable(priv->plat->pclk);
+ clk_disable(priv->plat->stmmac_clk);
+ }
+- spin_unlock_irqrestore(&priv->lock, flags);
++ mutex_unlock(&priv->lock);
+
+ priv->oldlink = 0;
+ priv->speed = SPEED_UNKNOWN;
+@@ -4373,7 +4371,6 @@ int stmmac_resume(struct device *dev)
+ {
+ struct net_device *ndev = dev_get_drvdata(dev);
+ struct stmmac_priv *priv = netdev_priv(ndev);
+- unsigned long flags;
+
+ if (!netif_running(ndev))
+ return 0;
+@@ -4385,9 +4382,9 @@ int stmmac_resume(struct device *dev)
+ * from another devices (e.g. serial console).
+ */
+ if (device_may_wakeup(priv->device)) {
+- spin_lock_irqsave(&priv->lock, flags);
++ mutex_lock(&priv->lock);
+ priv->hw->mac->pmt(priv->hw, 0);
+- spin_unlock_irqrestore(&priv->lock, flags);
++ mutex_unlock(&priv->lock);
+ priv->irq_wake = 0;
+ } else {
+ pinctrl_pm_select_default_state(priv->device);
+@@ -4401,7 +4398,7 @@ int stmmac_resume(struct device *dev)
+
+ netif_device_attach(ndev);
+
+- spin_lock_irqsave(&priv->lock, flags);
++ mutex_lock(&priv->lock);
+
+ stmmac_reset_queues_param(priv);
+
+@@ -4420,7 +4417,7 @@ int stmmac_resume(struct device *dev)
+
+ stmmac_start_all_queues(priv);
+
+- spin_unlock_irqrestore(&priv->lock, flags);
++ mutex_unlock(&priv->lock);
+
+ if (ndev->phydev)
+ phy_start(ndev->phydev);
diff --git a/patches.fixes/0001-net-stmmac-fix-broken-dma_interrupt-handling-for-mul.patch b/patches.fixes/0001-net-stmmac-fix-broken-dma_interrupt-handling-for-mul.patch
new file mode 100644
index 0000000000..df765e3a5a
--- /dev/null
+++ b/patches.fixes/0001-net-stmmac-fix-broken-dma_interrupt-handling-for-mul.patch
@@ -0,0 +1,127 @@
+From: Niklas Cassel <niklas.cassel@axis.com>
+Subject: net: stmmac: fix broken dma_interrupt handling for multi-queues
+Patch-mainline: v4.16-rc1
+Git-commit: 5a6a0445d1edb28fc89fd12b49cda2d5114e2665
+References: git-fixes
+
+There is nothing that says that number of TX queues == number of RX
+queues. E.g. the ARTPEC-6 SoC has 2 TX queues and 1 RX queue.
+
+This code is obviously wrong:
+for (chan = 0; chan < tx_channel_count; chan++) {
+ struct stmmac_rx_queue *rx_q = &priv->rx_queue[chan];
+
+priv->rx_queue has size MTL_MAX_RX_QUEUES, so this will send an
+uninitialized napi_struct to __napi_schedule(), causing us to
+crash in net_rx_action(), because napi_struct->poll is zero.
+
+[12846.759880] Unable to handle kernel NULL pointer dereference at virtual address 00000000
+[12846.768014] pgd = (ptrval)
+[12846.770742] [00000000] *pgd=39ec7831, *pte=00000000, *ppte=00000000
+[12846.777023] Internal error: Oops: 80000007 [#1] PREEMPT SMP ARM
+[12846.782942] Modules linked in:
+[12846.785998] CPU: 0 PID: 161 Comm: dropbear Not tainted 4.15.0-rc2-00285-gf5fb5f2f39a7 #36
+[12846.794177] Hardware name: Axis ARTPEC-6 Platform
+[12846.798879] task: (ptrval) task.stack: (ptrval)
+[12846.803407] PC is at 0x0
+[12846.805942] LR is at net_rx_action+0x274/0x43c
+[12846.810383] pc : [<00000000>] lr : [<80bff064>] psr: 200e0113
+[12846.816648] sp : b90d9ae8 ip : b90d9ae8 fp : b90d9b44
+[12846.821871] r10: 00000008 r9 : 0013250e r8 : 00000100
+[12846.827094] r7 : 0000012c r6 : 00000000 r5 : 00000001 r4 : bac84900
+[12846.833619] r3 : 00000000 r2 : b90d9b08 r1 : 00000000 r0 : bac84900
+
+Since each DMA channel can be used for rx and tx simultaneously,
+the current code should probably be rewritten so that napi_struct is
+embedded in a new struct stmmac_channel.
+That way, stmmac_poll() can call stmmac_tx_clean() on just the tx queue
+where we got the IRQ, instead of looping through all tx queues.
+This is also how the xgbe driver does it (another driver for this IP).
+
+Fixes: c22a3f48ef99 ("net: stmmac: adding multiple napi mechanism")
+Signed-off-by: Niklas Cassel <niklas.cassel@axis.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 54 ++++++++++++++++++----
+ 1 file changed, 46 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1987,22 +1987,60 @@ static void stmmac_set_dma_operation_mod
+ static void stmmac_dma_interrupt(struct stmmac_priv *priv)
+ {
+ u32 tx_channel_count = priv->plat->tx_queues_to_use;
+- int status;
++ u32 rx_channel_count = priv->plat->rx_queues_to_use;
++ u32 channels_to_check = tx_channel_count > rx_channel_count ?
++ tx_channel_count : rx_channel_count;
+ u32 chan;
++ bool poll_scheduled = false;
++ int status[channels_to_check];
+
+- for (chan = 0; chan < tx_channel_count; chan++) {
+- struct stmmac_rx_queue *rx_q = &priv->rx_queue[chan];
++ /* Each DMA channel can be used for rx and tx simultaneously, yet
++ * napi_struct is embedded in struct stmmac_rx_queue rather than in a
++ * stmmac_channel struct.
++ * Because of this, stmmac_poll currently checks (and possibly wakes)
++ * all tx queues rather than just a single tx queue.
++ */
++ for (chan = 0; chan < channels_to_check; chan++)
++ status[chan] = priv->hw->dma->dma_interrupt(priv->ioaddr,
++ &priv->xstats,
++ chan);
++
++ for (chan = 0; chan < rx_channel_count; chan++) {
++ if (likely(status[chan] & handle_rx)) {
++ struct stmmac_rx_queue *rx_q = &priv->rx_queue[chan];
+
+- status = priv->hw->dma->dma_interrupt(priv->ioaddr,
+- &priv->xstats, chan);
+- if (likely((status & handle_rx)) || (status & handle_tx)) {
+ if (likely(napi_schedule_prep(&rx_q->napi))) {
+ stmmac_disable_dma_irq(priv, chan);
+ __napi_schedule(&rx_q->napi);
++ poll_scheduled = true;
+ }
+ }
++ }
+
+- if (unlikely(status & tx_hard_error_bump_tc)) {
++ /* If we scheduled poll, we already know that tx queues will be checked.
++ * If we didn't schedule poll, see if any DMA channel (used by tx) has a
++ * completed transmission, if so, call stmmac_poll (once).
++ */
++ if (!poll_scheduled) {
++ for (chan = 0; chan < tx_channel_count; chan++) {
++ if (status[chan] & handle_tx) {
++ /* It doesn't matter what rx queue we choose
++ * here. We use 0 since it always exists.
++ */
++ struct stmmac_rx_queue *rx_q =
++ &priv->rx_queue[0];
++
++ if (likely(napi_schedule_prep(&rx_q->napi))) {
++ stmmac_disable_dma_irq(priv, chan);
++ __napi_schedule(&rx_q->napi);
++ }
++ break;
++ }
++ }
++ }
++
++ for (chan = 0; chan < tx_channel_count; chan++) {
++ if (unlikely(status[chan] & tx_hard_error_bump_tc)) {
+ /* Try to bump up the dma threshold on this failure */
+ if (unlikely(priv->xstats.threshold != SF_DMA_MODE) &&
+ (tc <= 256)) {
+@@ -2019,7 +2057,7 @@ static void stmmac_dma_interrupt(struct
+ chan);
+ priv->xstats.threshold = tc;
+ }
+- } else if (unlikely(status == tx_hard_error)) {
++ } else if (unlikely(status[chan] == tx_hard_error)) {
+ stmmac_tx_err(priv, chan);
+ }
+ }
diff --git a/patches.fixes/0001-net-stmmac-handle-endianness-in-dwmac4_get_timestamp.patch b/patches.fixes/0001-net-stmmac-handle-endianness-in-dwmac4_get_timestamp.patch
new file mode 100644
index 0000000000..5f4da7f27d
--- /dev/null
+++ b/patches.fixes/0001-net-stmmac-handle-endianness-in-dwmac4_get_timestamp.patch
@@ -0,0 +1,42 @@
+From: Alexandre Torgue <alexandre.torgue@st.com>
+Subject: net: stmmac: handle endianness in dwmac4_get_timestamp
+Patch-mainline: v5.0-rc8
+Git-commit: 4012e7d09d99b62d80046790657c0b0e32310d50
+References: git-fixes
+
+GMAC IP is little-endian and used on several kind of CPU (big or little
+endian). Main callbacks functions of the stmmac drivers take care about
+it. It was not the case for dwmac4_get_timestamp function.
+
+Fixes: ba1ffd74df74 ("stmmac: fix PTP support for GMAC4")
+Signed-off-by: Alexandre Torgue <alexandre.torgue@st.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c | 9 ++++++---
+ 1 file changed, 6 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+@@ -238,15 +238,18 @@ static inline u64 dwmac4_get_timestamp(v
+ static int dwmac4_rx_check_timestamp(void *desc)
+ {
+ struct dma_desc *p = (struct dma_desc *)desc;
++ unsigned int rdes0 = le32_to_cpu(p->des0);
++ unsigned int rdes1 = le32_to_cpu(p->des1);
++ unsigned int rdes3 = le32_to_cpu(p->des3);
+ u32 own, ctxt;
+ int ret = 1;
+
+- own = p->des3 & RDES3_OWN;
+- ctxt = ((p->des3 & RDES3_CONTEXT_DESCRIPTOR)
++ own = rdes3 & RDES3_OWN;
++ ctxt = ((rdes3 & RDES3_CONTEXT_DESCRIPTOR)
+ >> RDES3_CONTEXT_DESCRIPTOR_SHIFT);
+
+ if (likely(!own && ctxt)) {
+- if ((p->des0 == 0xffffffff) && (p->des1 == 0xffffffff))
++ if ((rdes0 == 0xffffffff) && (rdes1 == 0xffffffff))
+ /* Corrupted value */
+ ret = -EINVAL;
+ else
diff --git a/patches.fixes/0001-net-thunderx-fix-NULL-pointer-dereference-in-nic_rem.patch b/patches.fixes/0001-net-thunderx-fix-NULL-pointer-dereference-in-nic_rem.patch
new file mode 100644
index 0000000000..0d1d3fb08f
--- /dev/null
+++ b/patches.fixes/0001-net-thunderx-fix-NULL-pointer-dereference-in-nic_rem.patch
@@ -0,0 +1,76 @@
+From: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Subject: net: thunderx: fix NULL pointer dereference in nic_remove
+Patch-mainline: v4.20-rc5
+Git-commit: 24a6d2dd263bc910de018c78d1148b3e33b94512
+References: git-fixes
+
+Fix a possible NULL pointer dereference in nic_remove routine
+removing the nicpf module if nic_probe fails.
+The issue can be triggered with the following reproducer:
+
+$rmmod nicvf
+$rmmod nicpf
+
+[ 521.412008] Unable to handle kernel access to user memory outside uaccess routines at virtual address 0000000000000014
+[ 521.422777] Mem abort info:
+[ 521.425561] ESR = 0x96000004
+[ 521.428624] Exception class = DABT (current EL), IL = 32 bits
+[ 521.434535] SET = 0, FnV = 0
+[ 521.437579] EA = 0, S1PTW = 0
+[ 521.440730] Data abort info:
+[ 521.443603] ISV = 0, ISS = 0x00000004
+[ 521.447431] CM = 0, WnR = 0
+[ 521.450417] user pgtable: 4k pages, 48-bit VAs, pgdp = 0000000072a3da42
+[ 521.457022] [0000000000000014] pgd=0000000000000000
+[ 521.461916] Internal error: Oops: 96000004 [#1] SMP
+[ 521.511801] Hardware name: GIGABYTE H270-T70/MT70-HD0, BIOS T49 02/02/2018
+[ 521.518664] pstate: 80400005 (Nzcv daif +PAN -UAO)
+[ 521.523451] pc : nic_remove+0x24/0x88 [nicpf]
+[ 521.527808] lr : pci_device_remove+0x48/0xd8
+[ 521.532066] sp : ffff000013433cc0
+[ 521.535370] x29: ffff000013433cc0 x28: ffff810f6ac50000
+[ 521.540672] x27: 0000000000000000 x26: 0000000000000000
+[ 521.545974] x25: 0000000056000000 x24: 0000000000000015
+[ 521.551274] x23: ffff8007ff89a110 x22: ffff000001667070
+[ 521.556576] x21: ffff8007ffb170b0 x20: ffff8007ffb17000
+[ 521.561877] x19: 0000000000000000 x18: 0000000000000025
+[ 521.567178] x17: 0000000000000000 x16: 000000000000010ffc33ff98 x8 : 0000000000000000
+[ 521.593683] x7 : 0000000000000000 x6 : 0000000000000001
+[ 521.598983] x5 : 0000000000000002 x4 : 0000000000000003
+[ 521.604284] x3 : ffff8007ffb17184 x2 : ffff8007ffb17184
+[ 521.609585] x1 : ffff000001662118 x0 : ffff000008557be0
+[ 521.614887] Process rmmod (pid: 1897, stack limit = 0x00000000859535c3)
+[ 521.621490] Call trace:
+[ 521.623928] nic_remove+0x24/0x88 [nicpf]
+[ 521.627927] pci_device_remove+0x48/0xd8
+[ 521.631847] device_release_driver_internal+0x1b0/0x248
+[ 521.637062] driver_detach+0x50/0xc0
+[ 521.640628] bus_remove_driver+0x60/0x100
+[ 521.644627] driver_unregister+0x34/0x60
+[ 521.648538] pci_unregister_driver+0x24/0xd8
+[ 521.652798] nic_cleanup_module+0x14/0x111c [nicpf]
+[ 521.657672] __arm64_sys_delete_module+0x150/0x218
+[ 521.662460] el0_svc_handler+0x94/0x110
+[ 521.666287] el0_svc+0x8/0xc
+[ 521.669160] Code: aa1e03e0 9102c295 d503201f f9404eb3 (b9401660)
+
+Fixes: 4863dea3fab0 ("net: Adding support for Cavium ThunderX network controller")
+Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Acked-by: Denis Kirjanov <dkirjanov@suse.com>
+---
+ drivers/net/ethernet/cavium/thunder/nic_main.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/cavium/thunder/nic_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nic_main.c
+@@ -1441,6 +1441,9 @@ static void nic_remove(struct pci_dev *p
+ {
+ struct nicpf *nic = pci_get_drvdata(pdev);
+
++ if (!nic)
++ return;
++
+ if (nic->flags & NIC_SRIOV_ENABLED)
+ pci_disable_sriov(pdev);
+
diff --git a/series.conf b/series.conf
index 9d8b738f52..b7877479e2 100644
--- a/series.conf
+++ b/series.conf
@@ -12246,6 +12246,7 @@
patches.drivers/bnxt_en-Uninitialized-variable-in-bnxt_tc_parse_acti.patch
patches.drivers/bnxt_en-Don-t-print-Link-speed-1-no-longer-supported.patch
patches.drivers/virtio_net-Disable-interrupts-if-napi_complete_done-
+ patches.fixes/0001-net-stmmac-fix-broken-dma_interrupt-handling-for-mul.patch
patches.fixes/veth-set-peer-GSO-values.patch
patches.drivers/cxgb4-collect-on-chip-memory-information.patch
patches.drivers/cxgb4-collect-MC-memory-dump.patch
@@ -16695,6 +16696,7 @@
patches.drivers/qede-Support-flow-classification-to-the-VFs.patch
patches.drivers/qed-Support-drop-action-classification.patch
patches.drivers/bnx2x-Collect-the-device-debug-information-during-Tx.patch
+ patches.fixes/0001-net-stmmac-Use-mutex-instead-of-spinlock.patch
patches.drivers/qmi_wwan-apply-SET_DTR-quirk-to-the-SIMCOM-shared-de.patch
patches.drivers/net-hns3-Updates-RX-packet-info-fetch-in-case-of-mul.patch
patches.drivers/net-hns3-Add-support-for-tx_accept_tag2-and-tx_accep.patch
@@ -18086,6 +18088,7 @@
patches.drivers/net-hns3-Standardize-the-handle-of-return-value.patch
patches.fixes/xen-netfront-fix-queue-name-setting.patch
patches.fixes/wan-fsl_ucc_hdlc-use-IS_ERR_VALUE-to-check-return-va.patch
+ patches.fixes/0001-net-mlx5-fix-uaccess-beyond-count-in-debugfs-read-wr.patch
patches.drivers/brcmsmac-fix-wrap-around-in-conversion-from-constant
patches.drivers/rndis_wlan-potential-buffer-overflow-in-rndis_wlan_a
patches.drivers/libertas-fix-suspend-and-resume-for-SDIO-connected-c
@@ -19799,6 +19802,7 @@
patches.suse/0003-Btrfs-send-fix-infinite-loop-due-to-directory-rename.patch
patches.fixes/bpf-fix-check-of-allowed-specifiers-in-bpf_trace_pri.patch
patches.suse/usbnet-ipheth-fix-potential-recvmsg-bug-and-recvmsg-.patch
+ patches.fixes/0001-net-thunderx-fix-NULL-pointer-dereference-in-nic_rem.patch
patches.suse/rapidio-rionet-do-not-free-skb-before-reading-its-le.patch
patches.arch/s390-sles15-17-03-s390-qeth-fix-length-check-in-SNMP-processing.patch
patches.fixes/ixgbe-recognize-1000BaseLX-SFP-modules-as-1Gbps.patch
@@ -20705,7 +20709,10 @@
patches.fixes/mailbox-bcm-flexrm-mailbox-Fix-FlexRM-ring-flush-tim.patch
patches.fixes/mac80211-Free-mpath-object-when-rhashtable-insertion.patch
patches.fixes/mac80211-Restore-vif-beacon-interval-if-start-ap-fai.patch
+ patches.fixes/0001-mlxsw-__mlxsw_sp_port_headroom_set-Fix-a-use-of-loca.patch
+ patches.fixes/0001-net-stmmac-handle-endianness-in-dwmac4_get_timestamp.patch
patches.fixes/net-crypto-set-sk-to-NULL-when-af_alg_release.patch
+ patches.fixes/0001-net-stmmac-Fix-a-race-in-EEE-enable-callback.patch
patches.fixes/vhost-correctly-check-the-return-value-of-translate_.patch
patches.fixes/sky2-Increase-D3-delay-again.patch
patches.fixes/KEYS-allow-reaching-the-keys-quotas-exactly.patch