From 84f10c38ce381c8f8856959469b17fa5705e359a Mon Sep 17 00:00:00 2001 From: aakkll <94471752+aakkll@users.noreply.github.com> Date: Sat, 4 Mar 2023 10:07:21 +0800 Subject: [PATCH] kernel: bump to 5.4.234, 5.15.97, 6.1.15 (#10959) Signed-off-by: aakkll <94471752+aakkll@users.noreply.github.com> --- include/kernel-5.15 | 4 +- include/kernel-5.4 | 4 +- include/kernel-6.1 | 4 +- .../950-0064-Add-dwc_otg-driver.patch | 2 +- ...ce-quirks-for-Freeway-Airmouse-T3-an.patch | 2 +- ...ON_ONCE-sk-sk_forward_alloc-from-sk_.patch | 98 ----------------- ...ON_ONCE-sk-sk_forward_alloc-from-sk_.patch | 96 ---------------- ...bsolte-u64_stats_fetch_-_irq-users-d.patch | 6 +- ...ON_ONCE-sk-sk_forward_alloc-from-sk_.patch | 103 ------------------ .../780-usb-net-MeigLink_modem_support.patch | 2 +- .../780-usb-net-MeigLink_modem_support.patch | 2 +- .../970-export-efivarfs-function.patch | 31 ++---- ...ernel-XZ-compression-option-on-PPC_8.patch | 2 +- .../0600-5.15-qca-nss-ecm-support-CORE.patch | 10 +- .../999-03a-qca-nss-ecm-support.patch | 10 +- .../0600-5.15-qca-nss-ecm-support-CORE.patch | 10 +- ...ockchip-rk356x-Fix-PCIe-register-map.patch | 2 +- ...568-update-gicv3-its-and-pci-msi-map.patch | 2 +- 18 files changed, 42 insertions(+), 348 deletions(-) delete mode 100644 target/linux/generic/backport-5.15/883-0001-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch delete mode 100644 target/linux/generic/backport-5.4/904-v6.2-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch delete mode 100644 target/linux/generic/backport-6.1/990-v6.2-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch diff --git a/include/kernel-5.15 b/include/kernel-5.15 index 5c90c189c..61b5321e6 100644 --- a/include/kernel-5.15 +++ b/include/kernel-5.15 @@ -1,2 +1,2 @@ -LINUX_VERSION-5.15 = .96 -LINUX_KERNEL_HASH-5.15.96 = 348d974c143fdef8517ec703fdaa24bade12a49047848be92cb9e3253b19ef98 +LINUX_VERSION-5.15 = .97 +LINUX_KERNEL_HASH-5.15.97 = 2cddd6f4b1beaa2705b13022fb25a51f23f09faaa1a26cb859825f35080fb3b3 diff --git a/include/kernel-5.4 b/include/kernel-5.4 index bbdaa810c..aabcbf24e 100644 --- a/include/kernel-5.4 +++ b/include/kernel-5.4 @@ -1,2 +1,2 @@ -LINUX_VERSION-5.4 = .233 -LINUX_KERNEL_HASH-5.4.233 = 5a1e5754b4f2a4fe73b119d810ecda2ce07ecfb6f6cbbd16547c9ecd30b97627 +LINUX_VERSION-5.4 = .234 +LINUX_KERNEL_HASH-5.4.234 = acc79cb33f2e31bbd8267d4caa7e90bcc9ef5f1fdd060cd34117ad4dae950991 diff --git a/include/kernel-6.1 b/include/kernel-6.1 index a86b84fa0..b75518bca 100644 --- a/include/kernel-6.1 +++ b/include/kernel-6.1 @@ -1,2 +1,2 @@ -LINUX_VERSION-6.1 = .14 -LINUX_KERNEL_HASH-6.1.14 = a27076011efec7ad11e9ed0644f512c34cab4c5ed5ba42cfe71c83fabebe810d +LINUX_VERSION-6.1 = .15 +LINUX_KERNEL_HASH-6.1.15 = 2c16dfe2168a2e64ac0d55a12d625ebfb963818bb48b60c1868c7c460644c4fd diff --git a/target/linux/bcm27xx/patches-5.15/950-0064-Add-dwc_otg-driver.patch b/target/linux/bcm27xx/patches-5.15/950-0064-Add-dwc_otg-driver.patch index 33ff79847..46ae256c2 100644 --- a/target/linux/bcm27xx/patches-5.15/950-0064-Add-dwc_otg-driver.patch +++ b/target/linux/bcm27xx/patches-5.15/950-0064-Add-dwc_otg-driver.patch @@ -1123,7 +1123,7 @@ Signed-off-by: Jonathan Bell } --- a/drivers/usb/core/hub.c +++ b/drivers/usb/core/hub.c -@@ -5585,7 +5585,7 @@ static void port_event(struct usb_hub *h +@@ -5584,7 +5584,7 @@ static void port_event(struct usb_hub *h port_dev->over_current_count++; port_over_current_notify(port_dev); diff --git a/target/linux/bcm27xx/patches-5.15/950-0163-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch b/target/linux/bcm27xx/patches-5.15/950-0163-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch index 3cd85fe65..92c5eaacb 100644 --- a/target/linux/bcm27xx/patches-5.15/950-0163-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch +++ b/target/linux/bcm27xx/patches-5.15/950-0163-hid-usb-Add-device-quirks-for-Freeway-Airmouse-T3-an.patch @@ -33,7 +33,7 @@ Signed-off-by: Jonathan Bell #define USB_VENDOR_ID_BELKIN 0x050d #define USB_DEVICE_ID_FLIP_KVM 0x3201 -@@ -1315,6 +1318,9 @@ +@@ -1316,6 +1319,9 @@ #define USB_VENDOR_ID_XAT 0x2505 #define USB_DEVICE_ID_XAT_CSR 0x0220 diff --git a/target/linux/generic/backport-5.15/883-0001-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch b/target/linux/generic/backport-5.15/883-0001-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch deleted file mode 100644 index 0d4fe819f..000000000 --- a/target/linux/generic/backport-5.15/883-0001-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch +++ /dev/null @@ -1,98 +0,0 @@ -From a621c4fdc7e1ef6b9aabe083d57bf6a637fdaf76 Mon Sep 17 00:00:00 2001 -From: Kuniyuki Iwashima -Date: Mon, 27 Feb 2023 13:15:48 -0800 -Subject: [PATCH] net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from - sk_stream_kill_queues(). - -commit 62ec33b44e0f7168ff2886520fec6fb62d03b5a3 upstream. - -Christoph Paasch reported that commit b5fc29233d28 ("inet6: Remove -inet6_destroy_sock() in sk->sk_prot->destroy().") started triggering -WARN_ON_ONCE(sk->sk_forward_alloc) in sk_stream_kill_queues(). [0 - 2] -Also, we can reproduce it by a program in [3]. - -In the commit, we delay freeing ipv6_pinfo.pktoptions from sk->destroy() -to sk->sk_destruct(), so sk->sk_forward_alloc is no longer zero in -inet_csk_destroy_sock(). - -The same check has been in inet_sock_destruct() from at least v2.6, -we can just remove the WARN_ON_ONCE(). However, among the users of -sk_stream_kill_queues(), only CAIF is not calling inet_sock_destruct(). -Thus, we add the same WARN_ON_ONCE() to caif_sock_destructor(). - -[0]: https://lore.kernel.org/netdev/39725AB4-88F1-41B3-B07F-949C5CAEFF4F@icloud.com/ -[1]: https://github.com/multipath-tcp/mptcp_net-next/issues/341 -[2]: -WARNING: CPU: 0 PID: 3232 at net/core/stream.c:212 sk_stream_kill_queues+0x2f9/0x3e0 -Modules linked in: -CPU: 0 PID: 3232 Comm: syz-executor.0 Not tainted 6.2.0-rc5ab24eb4698afbe147b424149c529e2a43ec24eb5 #2 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 -RIP: 0010:sk_stream_kill_queues+0x2f9/0x3e0 -Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ec 00 00 00 8b ab 08 01 00 00 e9 60 ff ff ff e8 d0 5f b6 fe 0f 0b eb 97 e8 c7 5f b6 fe <0f> 0b eb a0 e8 be 5f b6 fe 0f 0b e9 6a fe ff ff e8 02 07 e3 fe e9 -RSP: 0018:ffff88810570fc68 EFLAGS: 00010293 -RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 -RDX: ffff888101f38f40 RSI: ffffffff8285e529 RDI: 0000000000000005 -RBP: 0000000000000ce0 R08: 0000000000000005 R09: 0000000000000000 -R10: 0000000000000ce0 R11: 0000000000000001 R12: ffff8881009e9488 -R13: ffffffff84af2cc0 R14: 0000000000000000 R15: ffff8881009e9458 -FS: 00007f7fdfbd5800(0000) GS:ffff88811b600000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 0000001b32923000 CR3: 00000001062fc006 CR4: 0000000000170ef0 -Call Trace: - - inet_csk_destroy_sock+0x1a1/0x320 - __tcp_close+0xab6/0xe90 - tcp_close+0x30/0xc0 - inet_release+0xe9/0x1f0 - inet6_release+0x4c/0x70 - __sock_release+0xd2/0x280 - sock_close+0x15/0x20 - __fput+0x252/0xa20 - task_work_run+0x169/0x250 - exit_to_user_mode_prepare+0x113/0x120 - syscall_exit_to_user_mode+0x1d/0x40 - do_syscall_64+0x48/0x90 - entry_SYSCALL_64_after_hwframe+0x72/0xdc -RIP: 0033:0x7f7fdf7ae28d -Code: c1 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 -RSP: 002b:00000000007dfbb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 -RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7fdf7ae28d -RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 -RBP: 0000000000000000 R08: 000000007f338e0f R09: 0000000000000e0f -R10: 000000007f338e13 R11: 0000000000000293 R12: 00007f7fdefff000 -R13: 00007f7fdefffcd8 R14: 00007f7fdefffce0 R15: 00007f7fdefffcd8 - - -[3]: https://lore.kernel.org/netdev/20230208004245.83497-1-kuniyu@amazon.com/ - -Fixes: b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().") -Reported-by: syzbot -Reported-by: Christoph Paasch -Signed-off-by: Kuniyuki Iwashima -Reviewed-by: Eric Dumazet -Signed-off-by: Jakub Kicinski ---- - net/caif/caif_socket.c | 1 + - net/core/stream.c | 1 - - 2 files changed, 1 insertion(+), 1 deletion(-) - ---- a/net/caif/caif_socket.c -+++ b/net/caif/caif_socket.c -@@ -1020,6 +1020,7 @@ static void caif_sock_destructor(struct - return; - } - sk_stream_kill_queues(&cf_sk->sk); -+ WARN_ON(sk->sk_forward_alloc); - caif_free_client(&cf_sk->layer); - } - ---- a/net/core/stream.c -+++ b/net/core/stream.c -@@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock * - sk_mem_reclaim(sk); - - WARN_ON(sk->sk_wmem_queued); -- WARN_ON(sk->sk_forward_alloc); - - /* It is _impossible_ for the backlog to contain anything - * when we get here. All user references to this socket diff --git a/target/linux/generic/backport-5.4/904-v6.2-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch b/target/linux/generic/backport-5.4/904-v6.2-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch deleted file mode 100644 index 6c66fe54e..000000000 --- a/target/linux/generic/backport-5.4/904-v6.2-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch +++ /dev/null @@ -1,96 +0,0 @@ -From d8c9fd6fcdb9e0acec0cbefd3eedc19de83ea1b1 Mon Sep 17 00:00:00 2001 -From: Kuniyuki Iwashima -Date: Thu, 9 Feb 2023 16:22:02 -0800 -Subject: [PATCH] net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from - sk_stream_kill_queues(). - -Christoph Paasch reported that commit b5fc29233d28 ("inet6: Remove -inet6_destroy_sock() in sk->sk_prot->destroy().") started triggering -WARN_ON_ONCE(sk->sk_forward_alloc) in sk_stream_kill_queues(). [0 - 2] -Also, we can reproduce it by a program in [3]. - -In the commit, we delay freeing ipv6_pinfo.pktoptions from sk->destroy() -to sk->sk_destruct(), so sk->sk_forward_alloc is no longer zero in -inet_csk_destroy_sock(). - -The same check has been in inet_sock_destruct() from at least v2.6, -we can just remove the WARN_ON_ONCE(). However, among the users of -sk_stream_kill_queues(), only CAIF is not calling inet_sock_destruct(). -Thus, we add the same WARN_ON_ONCE() to caif_sock_destructor(). - -[0]: https://lore.kernel.org/netdev/39725AB4-88F1-41B3-B07F-949C5CAEFF4F@icloud.com/ -[1]: https://github.com/multipath-tcp/mptcp_net-next/issues/341 -[2]: -WARNING: CPU: 0 PID: 3232 at net/core/stream.c:212 sk_stream_kill_queues+0x2f9/0x3e0 -Modules linked in: -CPU: 0 PID: 3232 Comm: syz-executor.0 Not tainted 6.2.0-rc5ab24eb4698afbe147b424149c529e2a43ec24eb5 #2 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 -RIP: 0010:sk_stream_kill_queues+0x2f9/0x3e0 -Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ec 00 00 00 8b ab 08 01 00 00 e9 60 ff ff ff e8 d0 5f b6 fe 0f 0b eb 97 e8 c7 5f b6 fe <0f> 0b eb a0 e8 be 5f b6 fe 0f 0b e9 6a fe ff ff e8 02 07 e3 fe e9 -RSP: 0018:ffff88810570fc68 EFLAGS: 00010293 -RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 -RDX: ffff888101f38f40 RSI: ffffffff8285e529 RDI: 0000000000000005 -RBP: 0000000000000ce0 R08: 0000000000000005 R09: 0000000000000000 -R10: 0000000000000ce0 R11: 0000000000000001 R12: ffff8881009e9488 -R13: ffffffff84af2cc0 R14: 0000000000000000 R15: ffff8881009e9458 -FS: 00007f7fdfbd5800(0000) GS:ffff88811b600000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 0000001b32923000 CR3: 00000001062fc006 CR4: 0000000000170ef0 -Call Trace: - - inet_csk_destroy_sock+0x1a1/0x320 - __tcp_close+0xab6/0xe90 - tcp_close+0x30/0xc0 - inet_release+0xe9/0x1f0 - inet6_release+0x4c/0x70 - __sock_release+0xd2/0x280 - sock_close+0x15/0x20 - __fput+0x252/0xa20 - task_work_run+0x169/0x250 - exit_to_user_mode_prepare+0x113/0x120 - syscall_exit_to_user_mode+0x1d/0x40 - do_syscall_64+0x48/0x90 - entry_SYSCALL_64_after_hwframe+0x72/0xdc -RIP: 0033:0x7f7fdf7ae28d -Code: c1 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 -RSP: 002b:00000000007dfbb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 -RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7fdf7ae28d -RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 -RBP: 0000000000000000 R08: 000000007f338e0f R09: 0000000000000e0f -R10: 000000007f338e13 R11: 0000000000000293 R12: 00007f7fdefff000 -R13: 00007f7fdefffcd8 R14: 00007f7fdefffce0 R15: 00007f7fdefffcd8 - - -[3]: https://lore.kernel.org/netdev/20230208004245.83497-1-kuniyu@amazon.com/ - -Fixes: b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().") -Reported-by: syzbot -Reported-by: Christoph Paasch -Signed-off-by: Kuniyuki Iwashima -Reviewed-by: Eric Dumazet -Signed-off-by: Jakub Kicinski ---- - net/caif/caif_socket.c | 1 + - net/core/stream.c | 1 - - 2 files changed, 1 insertion(+), 1 deletion(-) - ---- a/net/caif/caif_socket.c -+++ b/net/caif/caif_socket.c -@@ -1022,6 +1022,7 @@ static void caif_sock_destructor(struct - return; - } - sk_stream_kill_queues(&cf_sk->sk); -+ WARN_ON(sk->sk_forward_alloc); - caif_free_client(&cf_sk->layer); - } - ---- a/net/core/stream.c -+++ b/net/core/stream.c -@@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock * - sk_mem_reclaim(sk); - - WARN_ON(sk->sk_wmem_queued); -- WARN_ON(sk->sk_forward_alloc); - - /* It is _impossible_ for the backlog to contain anything - * when we get here. All user references to this socket diff --git a/target/linux/generic/backport-6.1/101-net-Remove-the-obsolte-u64_stats_fetch_-_irq-users-d.patch b/target/linux/generic/backport-6.1/101-net-Remove-the-obsolte-u64_stats_fetch_-_irq-users-d.patch index 94366572c..351b9d0cf 100644 --- a/target/linux/generic/backport-6.1/101-net-Remove-the-obsolte-u64_stats_fetch_-_irq-users-d.patch +++ b/target/linux/generic/backport-6.1/101-net-Remove-the-obsolte-u64_stats_fetch_-_irq-users-d.patch @@ -1296,7 +1296,7 @@ Signed-off-by: Jakub Kicinski stats->tx_errors += data[2]; --- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c -@@ -686,7 +686,7 @@ static u64 *nfp_vnic_get_sw_stats(struct +@@ -881,7 +881,7 @@ static u64 *nfp_vnic_get_sw_stats(struct unsigned int start; do { @@ -1305,7 +1305,7 @@ Signed-off-by: Jakub Kicinski data[0] = nn->r_vecs[i].rx_pkts; tmp[0] = nn->r_vecs[i].hw_csum_rx_ok; tmp[1] = nn->r_vecs[i].hw_csum_rx_inner_ok; -@@ -694,10 +694,10 @@ static u64 *nfp_vnic_get_sw_stats(struct +@@ -889,10 +889,10 @@ static u64 *nfp_vnic_get_sw_stats(struct tmp[3] = nn->r_vecs[i].hw_csum_rx_error; tmp[4] = nn->r_vecs[i].rx_replace_buf_alloc_fail; tmp[5] = nn->r_vecs[i].hw_tls_rx; @@ -1318,7 +1318,7 @@ Signed-off-by: Jakub Kicinski data[1] = nn->r_vecs[i].tx_pkts; data[2] = nn->r_vecs[i].tx_busy; tmp[6] = nn->r_vecs[i].hw_csum_tx; -@@ -707,7 +707,7 @@ static u64 *nfp_vnic_get_sw_stats(struct +@@ -902,7 +902,7 @@ static u64 *nfp_vnic_get_sw_stats(struct tmp[10] = nn->r_vecs[i].hw_tls_tx; tmp[11] = nn->r_vecs[i].tls_tx_fallback; tmp[12] = nn->r_vecs[i].tls_tx_no_fallback; diff --git a/target/linux/generic/backport-6.1/990-v6.2-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch b/target/linux/generic/backport-6.1/990-v6.2-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch deleted file mode 100644 index a12ad0de0..000000000 --- a/target/linux/generic/backport-6.1/990-v6.2-net-Remove-WARN_ON_ONCE-sk-sk_forward_alloc-from-sk_.patch +++ /dev/null @@ -1,103 +0,0 @@ -From 5d410c67ac7bfdf3e2487bf7b0189f1b767385df Mon Sep 17 00:00:00 2001 -From: Kuniyuki Iwashima -Date: Thu, 9 Feb 2023 16:22:02 -0800 -Subject: [PATCH] net: Remove WARN_ON_ONCE(sk->sk_forward_alloc) from - sk_stream_kill_queues(). - -Christoph Paasch reported that commit b5fc29233d28 ("inet6: Remove -inet6_destroy_sock() in sk->sk_prot->destroy().") started triggering -WARN_ON_ONCE(sk->sk_forward_alloc) in sk_stream_kill_queues(). [0 - 2] -Also, we can reproduce it by a program in [3]. - -In the commit, we delay freeing ipv6_pinfo.pktoptions from sk->destroy() -to sk->sk_destruct(), so sk->sk_forward_alloc is no longer zero in -inet_csk_destroy_sock(). - -The same check has been in inet_sock_destruct() from at least v2.6, -we can just remove the WARN_ON_ONCE(). However, among the users of -sk_stream_kill_queues(), only CAIF is not calling inet_sock_destruct(). -Thus, we add the same WARN_ON_ONCE() to caif_sock_destructor(). - -[0]: https://lore.kernel.org/netdev/39725AB4-88F1-41B3-B07F-949C5CAEFF4F@icloud.com/ -[1]: https://github.com/multipath-tcp/mptcp_net-next/issues/341 -[2]: -WARNING: CPU: 0 PID: 3232 at net/core/stream.c:212 sk_stream_kill_queues+0x2f9/0x3e0 -Modules linked in: -CPU: 0 PID: 3232 Comm: syz-executor.0 Not tainted 6.2.0-rc5ab24eb4698afbe147b424149c529e2a43ec24eb5 #2 -Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014 -RIP: 0010:sk_stream_kill_queues+0x2f9/0x3e0 -Code: 03 0f b6 04 02 84 c0 74 08 3c 03 0f 8e ec 00 00 00 8b ab 08 01 00 00 e9 60 ff ff ff e8 d0 5f b6 fe 0f 0b eb 97 e8 c7 5f b6 fe <0f> 0b eb a0 e8 be 5f b6 fe 0f 0b e9 6a fe ff ff e8 02 07 e3 fe e9 -RSP: 0018:ffff88810570fc68 EFLAGS: 00010293 -RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 -RDX: ffff888101f38f40 RSI: ffffffff8285e529 RDI: 0000000000000005 -RBP: 0000000000000ce0 R08: 0000000000000005 R09: 0000000000000000 -R10: 0000000000000ce0 R11: 0000000000000001 R12: ffff8881009e9488 -R13: ffffffff84af2cc0 R14: 0000000000000000 R15: ffff8881009e9458 -FS: 00007f7fdfbd5800(0000) GS:ffff88811b600000(0000) knlGS:0000000000000000 -CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 -CR2: 0000001b32923000 CR3: 00000001062fc006 CR4: 0000000000170ef0 -Call Trace: - - inet_csk_destroy_sock+0x1a1/0x320 - __tcp_close+0xab6/0xe90 - tcp_close+0x30/0xc0 - inet_release+0xe9/0x1f0 - inet6_release+0x4c/0x70 - __sock_release+0xd2/0x280 - sock_close+0x15/0x20 - __fput+0x252/0xa20 - task_work_run+0x169/0x250 - exit_to_user_mode_prepare+0x113/0x120 - syscall_exit_to_user_mode+0x1d/0x40 - do_syscall_64+0x48/0x90 - entry_SYSCALL_64_after_hwframe+0x72/0xdc -RIP: 0033:0x7f7fdf7ae28d -Code: c1 20 00 00 75 10 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 73 31 c3 48 83 ec 08 e8 ee fb ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 37 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01 -RSP: 002b:00000000007dfbb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 -RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00007f7fdf7ae28d -RDX: 0000000000000000 RSI: ffffffffffffffff RDI: 0000000000000003 -RBP: 0000000000000000 R08: 000000007f338e0f R09: 0000000000000e0f -R10: 000000007f338e13 R11: 0000000000000293 R12: 00007f7fdefff000 -R13: 00007f7fdefffcd8 R14: 00007f7fdefffce0 R15: 00007f7fdefffcd8 - - -[3]: https://lore.kernel.org/netdev/20230208004245.83497-1-kuniyu@amazon.com/ - -Fixes: b5fc29233d28 ("inet6: Remove inet6_destroy_sock() in sk->sk_prot->destroy().") -Reported-by: syzbot -Reported-by: Christoph Paasch -Signed-off-by: Kuniyuki Iwashima -Reviewed-by: Eric Dumazet -Signed-off-by: Jakub Kicinski ---- - net/caif/caif_socket.c | 1 + - net/core/stream.c | 1 - - 2 files changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c -index 748be7253248..78c9729a6057 100644 ---- a/net/caif/caif_socket.c -+++ b/net/caif/caif_socket.c -@@ -1015,6 +1015,7 @@ static void caif_sock_destructor(struct sock *sk) - return; - } - sk_stream_kill_queues(&cf_sk->sk); -+ WARN_ON_ONCE(sk->sk_forward_alloc); - caif_free_client(&cf_sk->layer); - } - -diff --git a/net/core/stream.c b/net/core/stream.c -index 516895f48235..cbb268c15251 100644 ---- a/net/core/stream.c -+++ b/net/core/stream.c -@@ -209,7 +209,6 @@ void sk_stream_kill_queues(struct sock *sk) - sk_mem_reclaim_final(sk); - - WARN_ON_ONCE(sk->sk_wmem_queued); -- WARN_ON_ONCE(sk->sk_forward_alloc); - - /* It is _impossible_ for the backlog to contain anything - * when we get here. All user references to this socket --- -2.34.1 - diff --git a/target/linux/generic/hack-5.15/780-usb-net-MeigLink_modem_support.patch b/target/linux/generic/hack-5.15/780-usb-net-MeigLink_modem_support.patch index e901deb8a..f8f91b226 100644 --- a/target/linux/generic/hack-5.15/780-usb-net-MeigLink_modem_support.patch +++ b/target/linux/generic/hack-5.15/780-usb-net-MeigLink_modem_support.patch @@ -29,7 +29,7 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support #define QUECTEL_VENDOR_ID 0x2c7c /* These Quectel products use Quectel's vendor ID */ -@@ -1162,6 +1164,11 @@ static const struct usb_device_id option +@@ -1164,6 +1166,11 @@ static const struct usb_device_id option .driver_info = ZLP }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), .driver_info = RSVD(4) }, diff --git a/target/linux/generic/hack-6.1/780-usb-net-MeigLink_modem_support.patch b/target/linux/generic/hack-6.1/780-usb-net-MeigLink_modem_support.patch index 99a7e3603..f9a3a48c0 100644 --- a/target/linux/generic/hack-6.1/780-usb-net-MeigLink_modem_support.patch +++ b/target/linux/generic/hack-6.1/780-usb-net-MeigLink_modem_support.patch @@ -29,7 +29,7 @@ Subject: [PATCH] net/usb/qmi_wwan: add MeigLink modem support #define QUECTEL_VENDOR_ID 0x2c7c /* These Quectel products use Quectel's vendor ID */ -@@ -1162,6 +1164,11 @@ static const struct usb_device_id option +@@ -1164,6 +1166,11 @@ static const struct usb_device_id option .driver_info = ZLP }, { USB_DEVICE(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_BG96), .driver_info = RSVD(4) }, diff --git a/target/linux/generic/hack-6.1/970-export-efivarfs-function.patch b/target/linux/generic/hack-6.1/970-export-efivarfs-function.patch index c3beb6f87..5ef545743 100644 --- a/target/linux/generic/hack-6.1/970-export-efivarfs-function.patch +++ b/target/linux/generic/hack-6.1/970-export-efivarfs-function.patch @@ -10,8 +10,6 @@ Subject: [PATCH] export efivarfs function fs/efivarfs/vars.c | 20 +++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) -diff --git a/fs/efivarfs/internal.h b/fs/efivarfs/internal.h -index 8ebf3a6..9231bd4 100644 --- a/fs/efivarfs/internal.h +++ b/fs/efivarfs/internal.h @@ -9,45 +9,6 @@ @@ -60,8 +58,6 @@ index 8ebf3a6..9231bd4 100644 extern const struct file_operations efivarfs_file_operations; extern const struct inode_operations efivarfs_dir_inode_operations; extern bool efivarfs_valid_name(const char *str, int len); -diff --git a/include/linux/efi.h b/include/linux/efi.h -index 4e1bfee..8ec2678 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h @@ -1062,6 +1062,45 @@ struct efivars { @@ -110,11 +106,9 @@ index 4e1bfee..8ec2678 100644 int efivars_register(struct efivars *efivars, const struct efivar_operations *ops, struct kobject *kobject); -diff --git a/fs/efivarfs/vars.c b/fs/efivarfs/vars.c -index 9e4f478..5026987 100644 --- a/fs/efivarfs/vars.c +++ b/fs/efivarfs/vars.c -@@ -259,6 +259,7 @@ efivar_validate(efi_guid_t vendor, efi_char16_t *var_name, u8 *data, +@@ -259,6 +259,7 @@ efivar_validate(efi_guid_t vendor, efi_c kfree(utf8_name); return true; } @@ -122,7 +116,7 @@ index 9e4f478..5026987 100644 bool efivar_variable_is_removable(efi_guid_t vendor, const char *var_name, -@@ -287,7 +288,7 @@ efivar_variable_is_removable(efi_guid_t vendor, const char *var_name, +@@ -287,7 +288,7 @@ efivar_variable_is_removable(efi_guid_t */ return found; } @@ -131,7 +125,7 @@ index 9e4f478..5026987 100644 static bool variable_is_present(efi_char16_t *variable_name, efi_guid_t *vendor, struct list_head *head) { -@@ -446,7 +447,7 @@ int efivar_init(int (*func)(efi_char16_t *, efi_guid_t, unsigned long, void *), +@@ -446,7 +447,7 @@ free: return err; } @@ -140,7 +134,7 @@ index 9e4f478..5026987 100644 /** * efivar_entry_add - add entry to variable list * @entry: entry to add to list -@@ -466,7 +467,7 @@ int efivar_entry_add(struct efivar_entry *entry, struct list_head *head) +@@ -466,7 +467,7 @@ int efivar_entry_add(struct efivar_entry return 0; } @@ -149,7 +143,7 @@ index 9e4f478..5026987 100644 /** * __efivar_entry_add - add entry to variable list * @entry: entry to add to list -@@ -487,7 +488,7 @@ void efivar_entry_remove(struct efivar_entry *entry) +@@ -487,7 +488,7 @@ void efivar_entry_remove(struct efivar_e { list_del(&entry->list); } @@ -158,7 +152,7 @@ index 9e4f478..5026987 100644 /* * efivar_entry_list_del_unlock - remove entry from variable list * @entry: entry to remove -@@ -536,7 +537,7 @@ int efivar_entry_delete(struct efivar_entry *entry) +@@ -536,7 +537,7 @@ int efivar_entry_delete(struct efivar_en efivar_entry_list_del_unlock(entry); return 0; } @@ -167,7 +161,7 @@ index 9e4f478..5026987 100644 /** * efivar_entry_size - obtain the size of a variable * @entry: entry for this variable -@@ -562,7 +563,7 @@ int efivar_entry_size(struct efivar_entry *entry, unsigned long *size) +@@ -562,7 +563,7 @@ int efivar_entry_size(struct efivar_entr return 0; } @@ -176,7 +170,7 @@ index 9e4f478..5026987 100644 /** * __efivar_entry_get - call get_variable() * @entry: read data for this variable -@@ -585,7 +586,7 @@ int __efivar_entry_get(struct efivar_entry *entry, u32 *attributes, +@@ -585,7 +586,7 @@ int __efivar_entry_get(struct efivar_ent return efi_status_to_err(status); } @@ -185,7 +179,7 @@ index 9e4f478..5026987 100644 /** * efivar_entry_get - call get_variable() * @entry: read data for this variable -@@ -606,7 +607,7 @@ int efivar_entry_get(struct efivar_entry *entry, u32 *attributes, +@@ -606,7 +607,7 @@ int efivar_entry_get(struct efivar_entry return 0; } @@ -194,7 +188,7 @@ index 9e4f478..5026987 100644 /** * efivar_entry_set_get_size - call set_variable() and get new size (atomic) * @entry: entry containing variable to set and get -@@ -686,7 +687,7 @@ int efivar_entry_set_get_size(struct efivar_entry *entry, u32 attributes, +@@ -686,7 +687,7 @@ out: return err; } @@ -203,12 +197,9 @@ index 9e4f478..5026987 100644 /** * efivar_entry_iter - iterate over variable list * @func: callback function -@@ -720,3 +721,4 @@ int efivar_entry_iter(int (*func)(struct efivar_entry *, void *), +@@ -720,3 +721,4 @@ int efivar_entry_iter(int (*func)(struct return err; } +EXPORT_SYMBOL_GPL(efivar_entry_iter); \ No newline at end of file --- -2.17.1 - diff --git a/target/linux/generic/pending-6.1/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch b/target/linux/generic/pending-6.1/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch index 7a68c4088..e9b47d185 100644 --- a/target/linux/generic/pending-6.1/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch +++ b/target/linux/generic/pending-6.1/342-powerpc-Enable-kernel-XZ-compression-option-on-PPC_8.patch @@ -14,7 +14,7 @@ Signed-off-by: Pawel Dembicki --- a/arch/powerpc/Kconfig +++ b/arch/powerpc/Kconfig -@@ -230,7 +230,7 @@ config PPC +@@ -229,7 +229,7 @@ config PPC select HAVE_KERNEL_GZIP select HAVE_KERNEL_LZMA if DEFAULT_UIMAGE select HAVE_KERNEL_LZO if DEFAULT_UIMAGE diff --git a/target/linux/ipq60xx/patches-5.15/0600-5.15-qca-nss-ecm-support-CORE.patch b/target/linux/ipq60xx/patches-5.15/0600-5.15-qca-nss-ecm-support-CORE.patch index 194b781dc..912d20987 100644 --- a/target/linux/ipq60xx/patches-5.15/0600-5.15-qca-nss-ecm-support-CORE.patch +++ b/target/linux/ipq60xx/patches-5.15/0600-5.15-qca-nss-ecm-support-CORE.patch @@ -430,7 +430,7 @@ #endif --- a/net/core/neighbour.c +++ b/net/core/neighbour.c -@@ -1219,7 +1219,21 @@ static void neigh_update_hhs(struct neig +@@ -1231,7 +1231,21 @@ static void neigh_update_hhs(struct neig } } @@ -452,7 +452,7 @@ /* Generic update routine. -- lladdr is new lladdr or NULL, if it is not supplied. -@@ -1250,6 +1264,7 @@ static int __neigh_update(struct neighbo +@@ -1262,6 +1276,7 @@ static int __neigh_update(struct neighbo int notify = 0; struct net_device *dev; int update_isrouter = 0; @@ -460,7 +460,7 @@ trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid); -@@ -1264,6 +1279,8 @@ static int __neigh_update(struct neighbo +@@ -1276,6 +1291,8 @@ static int __neigh_update(struct neighbo new = old; goto out; } @@ -469,7 +469,7 @@ if (!(flags & NEIGH_UPDATE_F_ADMIN) && (old & (NUD_NOARP | NUD_PERMANENT))) goto out; -@@ -1301,6 +1318,11 @@ static int __neigh_update(struct neighbo +@@ -1313,6 +1330,11 @@ static int __neigh_update(struct neighbo - compare new & old - if they are different, check override flag */ @@ -481,7 +481,7 @@ if ((old & NUD_VALID) && !memcmp(lladdr, neigh->ha, dev->addr_len)) lladdr = neigh->ha; -@@ -1423,8 +1445,11 @@ out: +@@ -1435,8 +1457,11 @@ out: if (((new ^ old) & NUD_PERMANENT) || ext_learn_change) neigh_update_gc_list(neigh); diff --git a/target/linux/ipq806x/patches-5.4/999-03a-qca-nss-ecm-support.patch b/target/linux/ipq806x/patches-5.4/999-03a-qca-nss-ecm-support.patch index 05ffb8b0d..7ebe41a15 100644 --- a/target/linux/ipq806x/patches-5.4/999-03a-qca-nss-ecm-support.patch +++ b/target/linux/ipq806x/patches-5.4/999-03a-qca-nss-ecm-support.patch @@ -1164,7 +1164,7 @@ #endif --- a/net/core/neighbour.c +++ b/net/core/neighbour.c -@@ -1223,7 +1223,21 @@ static void neigh_update_hhs(struct neig +@@ -1235,7 +1235,21 @@ static void neigh_update_hhs(struct neig } } @@ -1186,7 +1186,7 @@ /* Generic update routine. -- lladdr is new lladdr or NULL, if it is not supplied. -@@ -1254,6 +1268,7 @@ static int __neigh_update(struct neighbo +@@ -1266,6 +1280,7 @@ static int __neigh_update(struct neighbo int notify = 0; struct net_device *dev; int update_isrouter = 0; @@ -1194,7 +1194,7 @@ trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid); -@@ -1263,6 +1278,8 @@ static int __neigh_update(struct neighbo +@@ -1275,6 +1290,8 @@ static int __neigh_update(struct neighbo old = neigh->nud_state; err = -EPERM; @@ -1203,7 +1203,7 @@ if (neigh->dead) { NL_SET_ERR_MSG(extack, "Neighbor entry is now dead"); new = old; -@@ -1305,6 +1322,11 @@ static int __neigh_update(struct neighbo +@@ -1317,6 +1334,11 @@ static int __neigh_update(struct neighbo - compare new & old - if they are different, check override flag */ @@ -1215,7 +1215,7 @@ if ((old & NUD_VALID) && !memcmp(lladdr, neigh->ha, dev->addr_len)) lladdr = neigh->ha; -@@ -1427,8 +1449,11 @@ out: +@@ -1439,8 +1461,11 @@ out: if (((new ^ old) & NUD_PERMANENT) || ext_learn_change) neigh_update_gc_list(neigh); diff --git a/target/linux/ipq807x/patches-5.15/0600-5.15-qca-nss-ecm-support-CORE.patch b/target/linux/ipq807x/patches-5.15/0600-5.15-qca-nss-ecm-support-CORE.patch index 194b781dc..912d20987 100644 --- a/target/linux/ipq807x/patches-5.15/0600-5.15-qca-nss-ecm-support-CORE.patch +++ b/target/linux/ipq807x/patches-5.15/0600-5.15-qca-nss-ecm-support-CORE.patch @@ -430,7 +430,7 @@ #endif --- a/net/core/neighbour.c +++ b/net/core/neighbour.c -@@ -1219,7 +1219,21 @@ static void neigh_update_hhs(struct neig +@@ -1231,7 +1231,21 @@ static void neigh_update_hhs(struct neig } } @@ -452,7 +452,7 @@ /* Generic update routine. -- lladdr is new lladdr or NULL, if it is not supplied. -@@ -1250,6 +1264,7 @@ static int __neigh_update(struct neighbo +@@ -1262,6 +1276,7 @@ static int __neigh_update(struct neighbo int notify = 0; struct net_device *dev; int update_isrouter = 0; @@ -460,7 +460,7 @@ trace_neigh_update(neigh, lladdr, new, flags, nlmsg_pid); -@@ -1264,6 +1279,8 @@ static int __neigh_update(struct neighbo +@@ -1276,6 +1291,8 @@ static int __neigh_update(struct neighbo new = old; goto out; } @@ -469,7 +469,7 @@ if (!(flags & NEIGH_UPDATE_F_ADMIN) && (old & (NUD_NOARP | NUD_PERMANENT))) goto out; -@@ -1301,6 +1318,11 @@ static int __neigh_update(struct neighbo +@@ -1313,6 +1330,11 @@ static int __neigh_update(struct neighbo - compare new & old - if they are different, check override flag */ @@ -481,7 +481,7 @@ if ((old & NUD_VALID) && !memcmp(lladdr, neigh->ha, dev->addr_len)) lladdr = neigh->ha; -@@ -1423,8 +1445,11 @@ out: +@@ -1435,8 +1457,11 @@ out: if (((new ^ old) & NUD_PERMANENT) || ext_learn_change) neigh_update_gc_list(neigh); diff --git a/target/linux/rockchip/patches-6.1/109-arm64-dts-rockchip-rk356x-Fix-PCIe-register-map.patch b/target/linux/rockchip/patches-6.1/109-arm64-dts-rockchip-rk356x-Fix-PCIe-register-map.patch index f06ead724..1312612e5 100644 --- a/target/linux/rockchip/patches-6.1/109-arm64-dts-rockchip-rk356x-Fix-PCIe-register-map.patch +++ b/target/linux/rockchip/patches-6.1/109-arm64-dts-rockchip-rk356x-Fix-PCIe-register-map.patch @@ -26,7 +26,7 @@ Signed-off-by: Andrew Powers-Holmes reg-names = "dbi", "apb", "config"; interrupts = , , -@@ -980,8 +980,9 @@ +@@ -981,8 +981,9 @@ phys = <&combphy2 PHY_TYPE_PCIE>; phy-names = "pcie-phy"; power-domains = <&power RK3568_PD_PIPE>; diff --git a/target/linux/rockchip/patches-6.1/110-arm64-rk3568-update-gicv3-its-and-pci-msi-map.patch b/target/linux/rockchip/patches-6.1/110-arm64-rk3568-update-gicv3-its-and-pci-msi-map.patch index d26c92859..839a08dcf 100644 --- a/target/linux/rockchip/patches-6.1/110-arm64-rk3568-update-gicv3-its-and-pci-msi-map.patch +++ b/target/linux/rockchip/patches-6.1/110-arm64-rk3568-update-gicv3-its-and-pci-msi-map.patch @@ -83,7 +83,7 @@ }; usb_host0_ehci: usb@fd800000 { -@@ -975,7 +982,7 @@ +@@ -976,7 +983,7 @@ num-ib-windows = <6>; num-ob-windows = <2>; max-link-speed = <2>;