-LINUX_VERSION-6.6 = .34
-LINUX_KERNEL_HASH-6.6.34 = c4e0ec8f593aa3717e85abad940466e7d7cbc362989426eb37f499330a461ba0
+LINUX_VERSION-6.6 = .35
+LINUX_KERNEL_HASH-6.6.35 = fce3ee728712ed063aa8c14a8756c8ff8c7a46ba3827f61d2b04a73c7cf5dd9e
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
-@@ -479,8 +479,10 @@ static void xhci_pci_quirks(struct devic
+@@ -486,8 +486,10 @@ static void xhci_pci_quirks(struct devic
pdev->device == 0x3432)
xhci->quirks |= XHCI_BROKEN_STREAMS;
erst_base = xhci_read_64(xhci, &ir->ir_set->erst_base);
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
-@@ -1679,8 +1679,9 @@ struct urb_priv {
+@@ -1680,8 +1680,9 @@ struct urb_priv {
* Each segment table entry is 4*32bits long. 1K seems like an ok size:
* (1K bytes * 8bytes/bit) / (4*32 bits) = 64 segment entries in the table,
* meaning 64 ring segments.
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
-@@ -482,6 +482,7 @@ static void xhci_pci_quirks(struct devic
+@@ -489,6 +489,7 @@ static void xhci_pci_quirks(struct devic
if (pdev->vendor == PCI_VENDOR_ID_VIA && pdev->device == 0x3483) {
xhci->quirks |= XHCI_LPM_SUPPORT;
xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
addr = xhci_trb_virt_to_dma(new_seg, new_deq);
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
-@@ -1914,6 +1914,9 @@ struct xhci_hcd {
+@@ -1915,6 +1915,9 @@ struct xhci_hcd {
#define XHCI_ZHAOXIN_TRB_FETCH BIT_ULL(45)
#define XHCI_ZHAOXIN_HOST BIT_ULL(46)
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
-@@ -483,6 +483,7 @@ static void xhci_pci_quirks(struct devic
+@@ -490,6 +490,7 @@ static void xhci_pci_quirks(struct devic
xhci->quirks |= XHCI_LPM_SUPPORT;
xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
/* Allow 3 retries for everything but isoc, set CErr = 3 */
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
-@@ -484,6 +484,7 @@ static void xhci_pci_quirks(struct devic
+@@ -491,6 +491,7 @@ static void xhci_pci_quirks(struct devic
xhci->quirks |= XHCI_EP_CTX_BROKEN_DCS;
xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
-@@ -1916,6 +1916,7 @@ struct xhci_hcd {
+@@ -1917,6 +1917,7 @@ struct xhci_hcd {
/* Downstream VLI fixes */
#define XHCI_AVOID_DQ_ON_LINK BIT_ULL(56)
/* Device for a quirk */
#define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
#define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000
-@@ -290,6 +292,16 @@ static int xhci_pci_reinit(struct xhci_h
+@@ -291,6 +293,16 @@ static int xhci_pci_reinit(struct xhci_h
return 0;
}
static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
{
struct pci_dev *pdev = to_pci_dev(dev);
-@@ -485,6 +497,8 @@ static void xhci_pci_quirks(struct devic
+@@ -492,6 +504,8 @@ static void xhci_pci_quirks(struct devic
xhci->quirks |= XHCI_AVOID_DQ_ON_LINK;
xhci->quirks |= XHCI_ZHAOXIN_TRB_FETCH;
xhci->quirks |= XHCI_VLI_SS_BULK_OUT_BUG;
if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
--- a/drivers/usb/host/xhci-ring.c
+++ b/drivers/usb/host/xhci-ring.c
-@@ -3626,6 +3626,48 @@ static int xhci_align_td(struct xhci_hcd
+@@ -3657,6 +3657,48 @@ static int xhci_align_td(struct xhci_hcd
return 1;
}
/* This is very similar to what ehci-q.c qtd_fill() does */
int xhci_queue_bulk_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
struct urb *urb, int slot_id, unsigned int ep_index)
-@@ -3782,6 +3824,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
+@@ -3813,6 +3855,8 @@ int xhci_queue_bulk_tx(struct xhci_hcd *
}
check_trb_math(urb, enqd_len);
giveback_first_trb(xhci, slot_id, ep_index, urb->stream_id,
start_cycle, start_trb);
return 0;
-@@ -3917,6 +3961,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
+@@ -3948,6 +3992,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *
/* Event on completion */
field | TRB_IOC | TRB_TYPE(TRB_STATUS) | ep_ring->cycle_state);
return 0;
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
-@@ -1917,6 +1917,7 @@ struct xhci_hcd {
+@@ -1918,6 +1918,7 @@ struct xhci_hcd {
/* Downstream VLI fixes */
#define XHCI_AVOID_DQ_ON_LINK BIT_ULL(56)
#define XHCI_VLI_SS_BULK_OUT_BUG BIT_ULL(57)
+++ /dev/null
-From 333b34fa4845022d563e83f01a60af0abd080679 Mon Sep 17 00:00:00 2001
-From: Lars Kellogg-Stedman <lars@oddbit.com>
-Date: Wed, 29 May 2024 17:02:43 -0400
-Subject: [PATCH 1135/1135] ax25: Fix refcount imbalance on inbound connections
-
-commit 3c34fb0bd4a4237592c5ecb5b2e2531900c55774 upstream.
-
-When releasing a socket in ax25_release(), we call netdev_put() to
-decrease the refcount on the associated ax.25 device. However, the
-execution path for accepting an incoming connection never calls
-netdev_hold(). This imbalance leads to refcount errors, and ultimately
-to kernel crashes.
-
-A typical call trace for the above situation will start with one of the
-following errors:
-
- refcount_t: decrement hit 0; leaking memory.
- refcount_t: underflow; use-after-free.
-
-And will then have a trace like:
-
- Call Trace:
- <TASK>
- ? show_regs+0x64/0x70
- ? __warn+0x83/0x120
- ? refcount_warn_saturate+0xb2/0x100
- ? report_bug+0x158/0x190
- ? prb_read_valid+0x20/0x30
- ? handle_bug+0x3e/0x70
- ? exc_invalid_op+0x1c/0x70
- ? asm_exc_invalid_op+0x1f/0x30
- ? refcount_warn_saturate+0xb2/0x100
- ? refcount_warn_saturate+0xb2/0x100
- ax25_release+0x2ad/0x360
- __sock_release+0x35/0xa0
- sock_close+0x19/0x20
- [...]
-
-On reboot (or any attempt to remove the interface), the kernel gets
-stuck in an infinite loop:
-
- unregister_netdevice: waiting for ax0 to become free. Usage count = 0
-
-This patch corrects these issues by ensuring that we call netdev_hold()
-and ax25_dev_hold() for new connections in ax25_accept(). This makes the
-logic leading to ax25_accept() match the logic for ax25_bind(): in both
-cases we increment the refcount, which is ultimately decremented in
-ax25_release().
-
-Fixes: 9fd75b66b8f6 ("ax25: Fix refcount leaks caused by ax25_cb_del()")
-Signed-off-by: Lars Kellogg-Stedman <lars@oddbit.com>
-Tested-by: Duoming Zhou <duoming@zju.edu.cn>
-Tested-by: Dan Cross <crossd@gmail.com>
-Tested-by: Chris Maness <christopher.maness@gmail.com>
-Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
-Link: https://lore.kernel.org/r/20240529210242.3346844-2-lars@oddbit.com
-Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----
- net/ax25/af_ax25.c | 6 ++++++
- 1 file changed, 6 insertions(+)
-
---- a/net/ax25/af_ax25.c
-+++ b/net/ax25/af_ax25.c
-@@ -1378,8 +1378,10 @@ static int ax25_accept(struct socket *so
- {
- struct sk_buff *skb;
- struct sock *newsk;
-+ ax25_dev *ax25_dev;
- DEFINE_WAIT(wait);
- struct sock *sk;
-+ ax25_cb *ax25;
- int err = 0;
-
- if (sock->state != SS_UNCONNECTED)
-@@ -1434,6 +1436,10 @@ static int ax25_accept(struct socket *so
- kfree_skb(skb);
- sk_acceptq_removed(sk);
- newsock->state = SS_CONNECTED;
-+ ax25 = sk_to_ax25(newsk);
-+ ax25_dev = ax25->ax25_dev;
-+ netdev_hold(ax25_dev->dev, &ax25->dev_tracker, GFP_ATOMIC);
-+ ax25_dev_hold(ax25_dev);
-
- out:
- release_sock(sk);
if (xhci->quirks & XHCI_NEC_HOST)
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
-@@ -1912,6 +1912,7 @@ struct xhci_hcd {
+@@ -1913,6 +1913,7 @@ struct xhci_hcd {
#define XHCI_RESET_TO_DEFAULT BIT_ULL(44)
#define XHCI_ZHAOXIN_TRB_FETCH BIT_ULL(45)
#define XHCI_ZHAOXIN_HOST BIT_ULL(46)
if (err)
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
-@@ -1692,7 +1692,9 @@ static void read_symbols(const char *mod
+@@ -1693,7 +1693,9 @@ static void read_symbols(const char *mod
symname = remove_dot(info.strtab + sym->st_name);
handle_symbol(mod, &info, sym, symname);
}
check_sec_ref(mod, &info);
-@@ -1865,8 +1867,10 @@ static void add_header(struct buffer *b,
+@@ -1866,8 +1868,10 @@ static void add_header(struct buffer *b,
buf_printf(b, "BUILD_SALT;\n");
buf_printf(b, "BUILD_LTO_INFO;\n");
buf_printf(b, "\n");
buf_printf(b, "\n");
buf_printf(b, "__visible struct module __this_module\n");
buf_printf(b, "__section(\".gnu.linkonce.this_module\") = {\n");
-@@ -1880,8 +1884,10 @@ static void add_header(struct buffer *b,
+@@ -1881,8 +1885,10 @@ static void add_header(struct buffer *b,
buf_printf(b, "\t.arch = MODULE_ARCH_INIT,\n");
buf_printf(b, "};\n");
buf_printf(b,
"\n"
-@@ -1889,8 +1895,10 @@ static void add_header(struct buffer *b,
+@@ -1890,8 +1896,10 @@ static void add_header(struct buffer *b,
"MODULE_INFO(retpoline, \"Y\");\n"
"#endif\n");
if (strstarts(mod->name, "tools/testing"))
buf_printf(b, "\nMODULE_INFO(test, \"Y\");\n");
-@@ -2000,11 +2008,13 @@ static void add_depends(struct buffer *b
+@@ -2001,11 +2009,13 @@ static void add_depends(struct buffer *b
static void add_srcversion(struct buffer *b, struct module *mod)
{
}
static void write_buf(struct buffer *b, const char *fname)
-@@ -2087,7 +2097,9 @@ static void write_mod_c_file(struct modu
+@@ -2088,7 +2098,9 @@ static void write_mod_c_file(struct modu
add_exported_symbols(&buf, mod);
add_versions(&buf, mod);
add_depends(&buf, mod);
// Lantech 8330-262D-E can operate at 2500base-X, but incorrectly report
// 2500MBd NRZ in their EEPROM
SFP_QUIRK_M("Lantech", "8330-262D-E", sfp_quirk_2500basex),
-@@ -2587,7 +2590,8 @@ static void sfp_sm_main(struct sfp *sfp,
+@@ -2586,7 +2589,8 @@ static void sfp_sm_main(struct sfp *sfp,
* or t_start_up, so assume there is a fault.
*/
sfp_sm_fault(sfp, SFP_S_INIT_TX_FAULT,
} else if (event == SFP_E_TIMEOUT || event == SFP_E_TX_CLEAR) {
init_done:
/* Create mdiobus and start trying for PHY */
-@@ -2841,10 +2845,12 @@ static void sfp_check_state(struct sfp *
+@@ -2840,10 +2844,12 @@ static void sfp_check_state(struct sfp *
mutex_lock(&sfp->st_mutex);
state = sfp_get_state(sfp);
changed = state ^ sfp->state;
case RTN_THROW:
case RTN_UNREACHABLE:
default:
-@@ -4543,6 +4562,17 @@ static int ip6_pkt_prohibit_out(struct n
+@@ -4544,6 +4563,17 @@ static int ip6_pkt_prohibit_out(struct n
return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
}
/*
* Allocate a dst for local (unicast / anycast) address.
*/
-@@ -5034,7 +5064,8 @@ static int rtm_to_fib6_config(struct sk_
+@@ -5035,7 +5065,8 @@ static int rtm_to_fib6_config(struct sk_
if (rtm->rtm_type == RTN_UNREACHABLE ||
rtm->rtm_type == RTN_BLACKHOLE ||
rtm->rtm_type == RTN_PROHIBIT ||
cfg->fc_flags |= RTF_REJECT;
if (rtm->rtm_type == RTN_LOCAL)
-@@ -6281,6 +6312,8 @@ static int ip6_route_dev_notify(struct n
+@@ -6282,6 +6313,8 @@ static int ip6_route_dev_notify(struct n
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
net->ipv6.ip6_prohibit_entry->dst.dev = dev;
net->ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(dev);
net->ipv6.ip6_blk_hole_entry->dst.dev = dev;
net->ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(dev);
#endif
-@@ -6292,6 +6325,7 @@ static int ip6_route_dev_notify(struct n
+@@ -6293,6 +6326,7 @@ static int ip6_route_dev_notify(struct n
in6_dev_put_clear(&net->ipv6.ip6_null_entry->rt6i_idev);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
in6_dev_put_clear(&net->ipv6.ip6_prohibit_entry->rt6i_idev);
in6_dev_put_clear(&net->ipv6.ip6_blk_hole_entry->rt6i_idev);
#endif
}
-@@ -6492,6 +6526,8 @@ static int __net_init ip6_route_net_init
+@@ -6493,6 +6527,8 @@ static int __net_init ip6_route_net_init
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
net->ipv6.fib6_has_custom_rules = false;
net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
sizeof(*net->ipv6.ip6_prohibit_entry),
GFP_KERNEL);
-@@ -6502,11 +6538,21 @@ static int __net_init ip6_route_net_init
+@@ -6503,11 +6539,21 @@ static int __net_init ip6_route_net_init
ip6_template_metrics, true);
INIT_LIST_HEAD(&net->ipv6.ip6_prohibit_entry->dst.rt_uncached);
net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
ip6_template_metrics, true);
-@@ -6533,6 +6579,8 @@ out:
+@@ -6534,6 +6580,8 @@ out:
return ret;
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
out_ip6_prohibit_entry:
kfree(net->ipv6.ip6_prohibit_entry);
out_ip6_null_entry:
-@@ -6552,6 +6600,7 @@ static void __net_exit ip6_route_net_exi
+@@ -6553,6 +6601,7 @@ static void __net_exit ip6_route_net_exi
kfree(net->ipv6.ip6_null_entry);
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
kfree(net->ipv6.ip6_prohibit_entry);
kfree(net->ipv6.ip6_blk_hole_entry);
#endif
dst_entries_destroy(&net->ipv6.ip6_dst_ops);
-@@ -6635,6 +6684,9 @@ void __init ip6_route_init_special_entri
+@@ -6636,6 +6685,9 @@ void __init ip6_route_init_special_entri
init_net.ipv6.ip6_prohibit_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
init_net.ipv6.ip6_blk_hole_entry->dst.dev = init_net.loopback_dev;
init_net.ipv6.ip6_blk_hole_entry->rt6i_idev = in6_dev_get(init_net.loopback_dev);
+++ /dev/null
-From 3f1a227cb071f65f6ecc4db9f399649869735a7c Mon Sep 17 00:00:00 2001
-From: David Bauer <mail@david-bauer.net>
-Date: Sat, 17 Feb 2024 22:34:59 +0100
-Subject: [PATCH] net vxlan: don't learn non-unicast L2 destinations
-
-This patch avoids learning non-unicast targets in the vxlan FDB.
-They are non-unicast and thus should be sent to the broadcast-IPv6
-instead of a unicast address.
-
-Link: https://lore.kernel.org/netdev/15ee0cc7-9252-466b-8ce7-5225d605dde8@david-bauer.net/
-Link: https://github.com/freifunk-gluon/gluon/issues/3191
-
-Signed-off-by: David Bauer <mail@david-bauer.net>
----
- drivers/net/vxlan.c | 4 ++++
- 1 file changed, 4 insertions(+)
-
---- a/drivers/net/vxlan/vxlan_core.c
-+++ b/drivers/net/vxlan/vxlan_core.c
-@@ -1446,6 +1446,10 @@ static bool vxlan_snoop(struct net_devic
- struct vxlan_fdb *f;
- u32 ifindex = 0;
-
-+ /* Don't learn broadcast packets */
-+ if (is_multicast_ether_addr(src_mac) || is_zero_ether_addr(src_mac))
-+ return false;
-+
- #if IS_ENABLED(CONFIG_IPV6)
- if (src_ip->sa.sa_family == AF_INET6 &&
- (ipv6_addr_type(&src_ip->sin6.sin6_addr) & IPV6_ADDR_LINKLOCAL))
static int __qcom_scm_set_dload_mode(struct device *dev, bool enable)
{
struct qcom_scm_desc desc = {
-@@ -1467,6 +1490,13 @@ static int qcom_scm_probe(struct platfor
+@@ -1473,6 +1496,13 @@ static int qcom_scm_probe(struct platfor
__get_convention();
--- a/drivers/firmware/qcom_scm.c
+++ b/drivers/firmware/qcom_scm.c
-@@ -1522,7 +1522,8 @@ static int qcom_scm_probe(struct platfor
+@@ -1528,7 +1528,8 @@ static int qcom_scm_probe(struct platfor
static void qcom_scm_shutdown(struct platform_device *pdev)
{
/* Clean shutdown, disable download mode to allow normal restart */
projects / openwrt / staging / stintel.git / commitdiff