diff options
Diffstat (limited to 'target/linux/generic/backport-5.15')
11 files changed, 23 insertions, 177 deletions
diff --git a/target/linux/generic/backport-5.15/430-v6.3-ubi-Fix-failure-attaching-when-vid_hdr-offset-equals.patch b/target/linux/generic/backport-5.15/430-v6.3-ubi-Fix-failure-attaching-when-vid_hdr-offset-equals.patch deleted file mode 100644 index f9d2ef487d..0000000000 --- a/target/linux/generic/backport-5.15/430-v6.3-ubi-Fix-failure-attaching-when-vid_hdr-offset-equals.patch +++ /dev/null @@ -1,69 +0,0 @@ -From 1e020e1b96afdecd20680b5b5be2a6ffc3d27628 Mon Sep 17 00:00:00 2001 -From: Zhihao Cheng <chengzhihao1@huawei.com> -Date: Mon, 6 Mar 2023 09:33:08 +0800 -Subject: [PATCH] ubi: Fix failure attaching when vid_hdr offset equals to - (sub)page size - -Following process will make ubi attaching failed since commit -1b42b1a36fc946 ("ubi: ensure that VID header offset ... size"): - -ID="0xec,0xa1,0x00,0x15" # 128M 128KB 2KB -modprobe nandsim id_bytes=$ID -flash_eraseall /dev/mtd0 -modprobe ubi mtd="0,2048" # set vid_hdr offset as 2048 (one page) -(dmesg): - ubi0 error: ubi_attach_mtd_dev [ubi]: VID header offset 2048 too large. - UBI error: cannot attach mtd0 - UBI error: cannot initialize UBI, error -22 - -Rework original solution, the key point is making sure -'vid_hdr_shift + UBI_VID_HDR_SIZE < ubi->vid_hdr_alsize', -so we should check vid_hdr_shift rather not vid_hdr_offset. -Then, ubi still support (sub)page aligined VID header offset. - -Fixes: 1b42b1a36fc946 ("ubi: ensure that VID header offset ... size") -Signed-off-by: Zhihao Cheng <chengzhihao1@huawei.com> -Tested-by: Nicolas Schichan <nschichan@freebox.fr> -Tested-by: Miquel Raynal <miquel.raynal@bootlin.com> # v5.10, v4.19 -Signed-off-by: Richard Weinberger <richard@nod.at> ---- - drivers/mtd/ubi/build.c | 21 +++++++++++++++------ - 1 file changed, 15 insertions(+), 6 deletions(-) - ---- a/drivers/mtd/ubi/build.c -+++ b/drivers/mtd/ubi/build.c -@@ -664,12 +664,6 @@ static int io_init(struct ubi_device *ub - ubi->ec_hdr_alsize = ALIGN(UBI_EC_HDR_SIZE, ubi->hdrs_min_io_size); - ubi->vid_hdr_alsize = ALIGN(UBI_VID_HDR_SIZE, ubi->hdrs_min_io_size); - -- if (ubi->vid_hdr_offset && ((ubi->vid_hdr_offset + UBI_VID_HDR_SIZE) > -- ubi->vid_hdr_alsize)) { -- ubi_err(ubi, "VID header offset %d too large.", ubi->vid_hdr_offset); -- return -EINVAL; -- } -- - dbg_gen("min_io_size %d", ubi->min_io_size); - dbg_gen("max_write_size %d", ubi->max_write_size); - dbg_gen("hdrs_min_io_size %d", ubi->hdrs_min_io_size); -@@ -687,6 +681,21 @@ static int io_init(struct ubi_device *ub - ubi->vid_hdr_aloffset; - } - -+ /* -+ * Memory allocation for VID header is ubi->vid_hdr_alsize -+ * which is described in comments in io.c. -+ * Make sure VID header shift + UBI_VID_HDR_SIZE not exceeds -+ * ubi->vid_hdr_alsize, so that all vid header operations -+ * won't access memory out of bounds. -+ */ -+ if ((ubi->vid_hdr_shift + UBI_VID_HDR_SIZE) > ubi->vid_hdr_alsize) { -+ ubi_err(ubi, "Invalid VID header offset %d, VID header shift(%d)" -+ " + VID header size(%zu) > VID header aligned size(%d).", -+ ubi->vid_hdr_offset, ubi->vid_hdr_shift, -+ UBI_VID_HDR_SIZE, ubi->vid_hdr_alsize); -+ return -EINVAL; -+ } -+ - /* Similar for the data offset */ - ubi->leb_start = ubi->vid_hdr_offset + UBI_VID_HDR_SIZE; - ubi->leb_start = ALIGN(ubi->leb_start, ubi->min_io_size); diff --git a/target/linux/generic/backport-5.15/612-v6.3-skbuff-Fix-a-race-between-coalescing-and-releasing-S.patch b/target/linux/generic/backport-5.15/612-v6.3-skbuff-Fix-a-race-between-coalescing-and-releasing-S.patch deleted file mode 100644 index 7f1b1eebdc..0000000000 --- a/target/linux/generic/backport-5.15/612-v6.3-skbuff-Fix-a-race-between-coalescing-and-releasing-S.patch +++ /dev/null @@ -1,85 +0,0 @@ -From: Liang Chen <liangchen.linux@gmail.com> -Date: Thu, 13 Apr 2023 17:03:53 +0800 -Subject: [PATCH] skbuff: Fix a race between coalescing and releasing SKBs - -Commit 1effe8ca4e34 ("skbuff: fix coalescing for page_pool fragment -recycling") allowed coalescing to proceed with non page pool page and page -pool page when @from is cloned, i.e. - -to->pp_recycle --> false -from->pp_recycle --> true -skb_cloned(from) --> true - -However, it actually requires skb_cloned(@from) to hold true until -coalescing finishes in this situation. If the other cloned SKB is -released while the merging is in process, from_shinfo->nr_frags will be -set to 0 toward the end of the function, causing the increment of frag -page _refcount to be unexpectedly skipped resulting in inconsistent -reference counts. Later when SKB(@to) is released, it frees the page -directly even though the page pool page is still in use, leading to -use-after-free or double-free errors. So it should be prohibited. - -The double-free error message below prompted us to investigate: -BUG: Bad page state in process swapper/1 pfn:0e0d1 -page:00000000c6548b28 refcount:-1 mapcount:0 mapping:0000000000000000 -index:0x2 pfn:0xe0d1 -flags: 0xfffffc0000000(node=0|zone=1|lastcpupid=0x1fffff) -raw: 000fffffc0000000 0000000000000000 ffffffff00000101 0000000000000000 -raw: 0000000000000002 0000000000000000 ffffffffffffffff 0000000000000000 -page dumped because: nonzero _refcount - -CPU: 1 PID: 0 Comm: swapper/1 Tainted: G E 6.2.0+ -Call Trace: - <IRQ> -dump_stack_lvl+0x32/0x50 -bad_page+0x69/0xf0 -free_pcp_prepare+0x260/0x2f0 -free_unref_page+0x20/0x1c0 -skb_release_data+0x10b/0x1a0 -napi_consume_skb+0x56/0x150 -net_rx_action+0xf0/0x350 -? __napi_schedule+0x79/0x90 -__do_softirq+0xc8/0x2b1 -__irq_exit_rcu+0xb9/0xf0 -common_interrupt+0x82/0xa0 -</IRQ> -<TASK> -asm_common_interrupt+0x22/0x40 -RIP: 0010:default_idle+0xb/0x20 - -Fixes: 53e0961da1c7 ("page_pool: add frag page recycling support in page pool") -Signed-off-by: Liang Chen <liangchen.linux@gmail.com> -Reviewed-by: Eric Dumazet <edumazet@google.com> -Link: https://lore.kernel.org/r/20230413090353.14448-1-liangchen.linux@gmail.com -Signed-off-by: Jakub Kicinski <kuba@kernel.org> ---- - ---- a/net/core/skbuff.c -+++ b/net/core/skbuff.c -@@ -5397,18 +5397,18 @@ bool skb_try_coalesce(struct sk_buff *to - if (skb_cloned(to)) - return false; - -- /* In general, avoid mixing slab allocated and page_pool allocated -- * pages within the same SKB. However when @to is not pp_recycle and -- * @from is cloned, we can transition frag pages from page_pool to -- * reference counted. -- * -- * On the other hand, don't allow coalescing two pp_recycle SKBs if -- * @from is cloned, in case the SKB is using page_pool fragment -+ /* In general, avoid mixing page_pool and non-page_pool allocated -+ * pages within the same SKB. Additionally avoid dealing with clones -+ * with page_pool pages, in case the SKB is using page_pool fragment - * references (PP_FLAG_PAGE_FRAG). Since we only take full page - * references for cloned SKBs at the moment that would result in - * inconsistent reference counts. -+ * In theory we could take full references if @from is cloned and -+ * !@to->pp_recycle but its tricky (due to potential race with -+ * the clone disappearing) and rare, so not worth dealing with. - */ -- if (to->pp_recycle != (from->pp_recycle && !skb_cloned(from))) -+ if (to->pp_recycle != from->pp_recycle || -+ (from->pp_recycle && skb_cloned(from))) - return false; - - if (len <= skb_tailroom(to)) { diff --git a/target/linux/generic/backport-5.15/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch b/target/linux/generic/backport-5.15/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch index 1f2a3ee140..9743a3f206 100644 --- a/target/linux/generic/backport-5.15/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch +++ b/target/linux/generic/backport-5.15/707-v6.3-net-pcs-add-driver-for-MediaTek-SGMII-PCS.patch @@ -32,7 +32,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- a/MAINTAINERS +++ b/MAINTAINERS -@@ -11790,6 +11790,14 @@ L: netdev@vger.kernel.org +@@ -11789,6 +11789,14 @@ L: netdev@vger.kernel.org S: Maintained F: drivers/net/ethernet/mediatek/ diff --git a/target/linux/generic/backport-5.15/783-v6.1-net-sfp-re-implement-soft-state-polling-setup.patch b/target/linux/generic/backport-5.15/783-v6.1-net-sfp-re-implement-soft-state-polling-setup.patch index 6f69b7ddfe..77cd336d36 100644 --- a/target/linux/generic/backport-5.15/783-v6.1-net-sfp-re-implement-soft-state-polling-setup.patch +++ b/target/linux/generic/backport-5.15/783-v6.1-net-sfp-re-implement-soft-state-polling-setup.patch @@ -20,7 +20,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c -@@ -234,6 +234,7 @@ struct sfp { +@@ -240,6 +240,7 @@ struct sfp { bool need_poll; struct mutex st_mutex; /* Protects state */ @@ -28,7 +28,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> unsigned int state_soft_mask; unsigned int state; struct delayed_work poll; -@@ -499,17 +500,18 @@ static void sfp_soft_set_state(struct sf +@@ -505,17 +506,18 @@ static void sfp_soft_set_state(struct sf static void sfp_soft_start_poll(struct sfp *sfp) { const struct sfp_eeprom_id *id = &sfp->id; @@ -56,7 +56,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> if (sfp->state_soft_mask & (SFP_F_LOS | SFP_F_TX_FAULT) && !sfp->need_poll) -@@ -523,10 +525,11 @@ static void sfp_soft_stop_poll(struct sf +@@ -529,10 +531,11 @@ static void sfp_soft_stop_poll(struct sf static unsigned int sfp_get_state(struct sfp *sfp) { @@ -71,7 +71,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> state |= sfp_soft_get_state(sfp); return state; -@@ -1940,6 +1943,15 @@ static int sfp_sm_mod_probe(struct sfp * +@@ -1942,6 +1945,15 @@ static int sfp_sm_mod_probe(struct sfp * if (ret < 0) return ret; @@ -87,7 +87,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> if (!memcmp(id.base.vendor_name, "ALCATELLUCENT ", 16) && !memcmp(id.base.vendor_pn, "3FE46541AA ", 16)) sfp->module_t_start_up = T_START_UP_BAD_GPON; -@@ -2565,6 +2577,8 @@ static int sfp_probe(struct platform_dev +@@ -2568,6 +2580,8 @@ static int sfp_probe(struct platform_dev return PTR_ERR(sfp->gpio[i]); } diff --git a/target/linux/generic/backport-5.15/784-v6.1-net-sfp-move-quirk-handling-into-sfp.c.patch b/target/linux/generic/backport-5.15/784-v6.1-net-sfp-move-quirk-handling-into-sfp.c.patch index e5f8031636..02fa28c5af 100644 --- a/target/linux/generic/backport-5.15/784-v6.1-net-sfp-move-quirk-handling-into-sfp.c.patch +++ b/target/linux/generic/backport-5.15/784-v6.1-net-sfp-move-quirk-handling-into-sfp.c.patch @@ -142,7 +142,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> ret = ops->module_insert(bus->upstream, id); --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c -@@ -253,6 +253,8 @@ struct sfp { +@@ -259,6 +259,8 @@ struct sfp { unsigned int module_t_start_up; bool tx_fault_ignore; @@ -151,7 +151,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> #if IS_ENABLED(CONFIG_HWMON) struct sfp_diag diag; struct delayed_work hwmon_probe; -@@ -309,6 +311,93 @@ static const struct of_device_id sfp_of_ +@@ -315,6 +317,93 @@ static const struct of_device_id sfp_of_ }; MODULE_DEVICE_TABLE(of, sfp_of_match); @@ -245,7 +245,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> static unsigned long poll_jiffies; static unsigned int sfp_gpio_get_state(struct sfp *sfp) -@@ -1964,6 +2053,8 @@ static int sfp_sm_mod_probe(struct sfp * +@@ -1966,6 +2055,8 @@ static int sfp_sm_mod_probe(struct sfp * else sfp->tx_fault_ignore = false; @@ -254,7 +254,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> return 0; } -@@ -2075,7 +2166,8 @@ static void sfp_sm_module(struct sfp *sf +@@ -2077,7 +2168,8 @@ static void sfp_sm_module(struct sfp *sf break; /* Report the module insertion to the upstream device */ diff --git a/target/linux/generic/backport-5.15/785-v6.1-net-sfp-move-Alcatel-Lucent-3FE46541AA-fixup.patch b/target/linux/generic/backport-5.15/785-v6.1-net-sfp-move-Alcatel-Lucent-3FE46541AA-fixup.patch index aa3112e585..b076676cff 100644 --- a/target/linux/generic/backport-5.15/785-v6.1-net-sfp-move-Alcatel-Lucent-3FE46541AA-fixup.patch +++ b/target/linux/generic/backport-5.15/785-v6.1-net-sfp-move-Alcatel-Lucent-3FE46541AA-fixup.patch @@ -15,7 +15,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c -@@ -311,6 +311,11 @@ static const struct of_device_id sfp_of_ +@@ -317,6 +317,11 @@ static const struct of_device_id sfp_of_ }; MODULE_DEVICE_TABLE(of, sfp_of_match); @@ -27,7 +27,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id, unsigned long *modes) { -@@ -341,6 +346,7 @@ static const struct sfp_quirk sfp_quirks +@@ -347,6 +352,7 @@ static const struct sfp_quirk sfp_quirks .vendor = "ALCATELLUCENT", .part = "3FE46541AA", .modes = sfp_quirk_2500basex, @@ -35,7 +35,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> }, { // Huawei MA5671A can operate at 2500base-X, but report 1.2GBd // NRZ in their EEPROM -@@ -2041,11 +2047,7 @@ static int sfp_sm_mod_probe(struct sfp * +@@ -2043,11 +2049,7 @@ static int sfp_sm_mod_probe(struct sfp * if (sfp->gpio[GPIO_LOS]) sfp->state_hw_mask |= SFP_F_LOS; @@ -48,7 +48,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> if (!memcmp(id.base.vendor_name, "HUAWEI ", 16) && !memcmp(id.base.vendor_pn, "MA5671A ", 16)) -@@ -2054,6 +2056,8 @@ static int sfp_sm_mod_probe(struct sfp * +@@ -2056,6 +2058,8 @@ static int sfp_sm_mod_probe(struct sfp * sfp->tx_fault_ignore = false; sfp->quirk = sfp_lookup_quirk(&id); diff --git a/target/linux/generic/backport-5.15/786-v6.1-net-sfp-move-Huawei-MA5671A-fixup.patch b/target/linux/generic/backport-5.15/786-v6.1-net-sfp-move-Huawei-MA5671A-fixup.patch index 14b0f9b8c3..7f856e5b5b 100644 --- a/target/linux/generic/backport-5.15/786-v6.1-net-sfp-move-Huawei-MA5671A-fixup.patch +++ b/target/linux/generic/backport-5.15/786-v6.1-net-sfp-move-Huawei-MA5671A-fixup.patch @@ -13,7 +13,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c -@@ -316,6 +316,11 @@ static void sfp_fixup_long_startup(struc +@@ -322,6 +322,11 @@ static void sfp_fixup_long_startup(struc sfp->module_t_start_up = T_START_UP_BAD_GPON; } @@ -25,7 +25,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id, unsigned long *modes) { -@@ -353,6 +358,7 @@ static const struct sfp_quirk sfp_quirks +@@ -359,6 +364,7 @@ static const struct sfp_quirk sfp_quirks .vendor = "HUAWEI", .part = "MA5671A", .modes = sfp_quirk_2500basex, @@ -33,7 +33,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> }, { // Lantech 8330-262D-E can operate at 2500base-X, but // incorrectly report 2500MBd NRZ in their EEPROM -@@ -2049,11 +2055,7 @@ static int sfp_sm_mod_probe(struct sfp * +@@ -2051,11 +2057,7 @@ static int sfp_sm_mod_probe(struct sfp * sfp->module_t_start_up = T_START_UP; diff --git a/target/linux/generic/backport-5.15/787-v6.1-net-sfp-add-support-for-HALNy-GPON-SFP.patch b/target/linux/generic/backport-5.15/787-v6.1-net-sfp-add-support-for-HALNy-GPON-SFP.patch index 0c65de5ab8..81108e19c1 100644 --- a/target/linux/generic/backport-5.15/787-v6.1-net-sfp-add-support-for-HALNy-GPON-SFP.patch +++ b/target/linux/generic/backport-5.15/787-v6.1-net-sfp-add-support-for-HALNy-GPON-SFP.patch @@ -28,7 +28,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> linkmode_or(support, support, modes); --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c -@@ -321,6 +321,15 @@ static void sfp_fixup_ignore_tx_fault(st +@@ -327,6 +327,15 @@ static void sfp_fixup_ignore_tx_fault(st sfp->tx_fault_ignore = true; } @@ -44,7 +44,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> static void sfp_quirk_2500basex(const struct sfp_eeprom_id *id, unsigned long *modes) { -@@ -353,6 +362,10 @@ static const struct sfp_quirk sfp_quirks +@@ -359,6 +368,10 @@ static const struct sfp_quirk sfp_quirks .modes = sfp_quirk_2500basex, .fixup = sfp_fixup_long_startup, }, { @@ -55,7 +55,7 @@ Signed-off-by: Jakub Kicinski <kuba@kernel.org> // Huawei MA5671A can operate at 2500base-X, but report 1.2GBd // NRZ in their EEPROM .vendor = "HUAWEI", -@@ -369,16 +382,18 @@ static const struct sfp_quirk sfp_quirks +@@ -375,16 +388,18 @@ static const struct sfp_quirk sfp_quirks .vendor = "UBNT", .part = "UF-INSTANT", .modes = sfp_quirk_ubnt_uf_instant, diff --git a/target/linux/generic/backport-5.15/789-v6.3-net-sfp-add-quirk-enabling-2500Base-x-for-HG-MXPD-48.patch b/target/linux/generic/backport-5.15/789-v6.3-net-sfp-add-quirk-enabling-2500Base-x-for-HG-MXPD-48.patch index a5a53bbc6e..413c73f547 100644 --- a/target/linux/generic/backport-5.15/789-v6.3-net-sfp-add-quirk-enabling-2500Base-x-for-HG-MXPD-48.patch +++ b/target/linux/generic/backport-5.15/789-v6.3-net-sfp-add-quirk-enabling-2500Base-x-for-HG-MXPD-48.patch @@ -24,7 +24,7 @@ Signed-off-by: David S. Miller <davem@davemloft.net> --- a/drivers/net/phy/sfp.c +++ b/drivers/net/phy/sfp.c -@@ -366,6 +366,10 @@ static const struct sfp_quirk sfp_quirks +@@ -372,6 +372,10 @@ static const struct sfp_quirk sfp_quirks .part = "HL-GSFP", .fixup = sfp_fixup_halny_gsfp, }, { diff --git a/target/linux/generic/backport-5.15/804-v5.18-0009-nvmem-Add-driver-for-OCOTP-in-Sunplus-SP7021.patch b/target/linux/generic/backport-5.15/804-v5.18-0009-nvmem-Add-driver-for-OCOTP-in-Sunplus-SP7021.patch index 2a9dc74947..95929b7fe3 100644 --- a/target/linux/generic/backport-5.15/804-v5.18-0009-nvmem-Add-driver-for-OCOTP-in-Sunplus-SP7021.patch +++ b/target/linux/generic/backport-5.15/804-v5.18-0009-nvmem-Add-driver-for-OCOTP-in-Sunplus-SP7021.patch @@ -19,7 +19,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- a/MAINTAINERS +++ b/MAINTAINERS -@@ -17962,6 +17962,11 @@ L: netdev@vger.kernel.org +@@ -17961,6 +17961,11 @@ L: netdev@vger.kernel.org S: Maintained F: drivers/net/ethernet/dlink/sundance.c diff --git a/target/linux/generic/backport-5.15/806-v6.0-0001-nvmem-microchip-otpc-add-support.patch b/target/linux/generic/backport-5.15/806-v6.0-0001-nvmem-microchip-otpc-add-support.patch index cec66ec383..b1855d1f2f 100644 --- a/target/linux/generic/backport-5.15/806-v6.0-0001-nvmem-microchip-otpc-add-support.patch +++ b/target/linux/generic/backport-5.15/806-v6.0-0001-nvmem-microchip-otpc-add-support.patch @@ -57,7 +57,7 @@ Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> --- a/MAINTAINERS +++ b/MAINTAINERS -@@ -12362,6 +12362,14 @@ S: Supported +@@ -12361,6 +12361,14 @@ S: Supported F: Documentation/devicetree/bindings/mtd/atmel-nand.txt F: drivers/mtd/nand/raw/atmel/* |