kernel: backport MTK ethernet/WLAN offload fixes

Fixes issues with offloading to WED, especially with VLAN bridges involved

Signed-off-by: Felix Fietkau <[email protected]>

Author: nbd168

target/linux/generic/backport-5.15/711-v6.0-01-net-ethernet-mtk_eth_soc-fix-off-by-one-check-of-ARR.patch

@@ -0,0 +1,31 @@
+From: Tom Rix <[email protected]>
+Date: Sat, 16 Jul 2022 17:46:54 -0400
+Subject: [PATCH] net: ethernet: mtk_eth_soc: fix off by one check of
+ ARRAY_SIZE
+
+In mtk_wed_tx_ring_setup(.., int idx, ..), idx is used as an index here
+  struct mtk_wed_ring *ring = &dev->tx_ring[idx];
+
+The bounds of idx are checked here
+  BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
+
+If idx is the size of the array, it will pass this check and overflow.
+So change the check to >= .
+
+Fixes: 804775dfc288 ("net: ethernet: mtk_eth_soc: add support for Wireless Ethernet Dispatch (WED)")
+Signed-off-by: Tom Rix <[email protected]>
+Link: https://lore.kernel.org/r/[email protected]
+Signed-off-by: Jakub Kicinski <[email protected]>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_wed.c
++++ b/drivers/net/ethernet/mediatek/mtk_wed.c
+@@ -651,7 +651,7 @@ mtk_wed_tx_ring_setup(struct mtk_wed_dev
+ 	 * WDMA RX.
+ 	 */
+ 
+-	BUG_ON(idx > ARRAY_SIZE(dev->tx_ring));
++	BUG_ON(idx >= ARRAY_SIZE(dev->tx_ring));
+ 
+ 	if (mtk_wed_ring_alloc(dev, ring, MTK_WED_TX_RING_SIZE))
+ 		return -ENOMEM;

target/linux/generic/backport-5.15/711-v6.0-02-net-ethernet-mtk_ppe-fix-possible-NULL-pointer-deref.patch

@@ -0,0 +1,27 @@
+From: Lorenzo Bianconi <[email protected]>
+Date: Mon, 18 Jul 2022 11:51:53 +0200
+Subject: [PATCH] net: ethernet: mtk_ppe: fix possible NULL pointer dereference
+ in mtk_flow_get_wdma_info
+
+odev pointer can be NULL in mtk_flow_offload_replace routine according
+to the flower action rules. Fix possible NULL pointer dereference in
+mtk_flow_get_wdma_info.
+
+Fixes: a333215e10cb5 ("net: ethernet: mtk_eth_soc: implement flow offloading to WED devices")
+Signed-off-by: Lorenzo Bianconi <[email protected]>
+Link: https://lore.kernel.org/r/4e1685bc4976e21e364055f6bee86261f8f9ee93.1658137753.git.lorenzo@kernel.org
+Signed-off-by: Jakub Kicinski <[email protected]>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -93,6 +93,9 @@ mtk_flow_get_wdma_info(struct net_device
+ 	};
+ 	struct net_device_path path = {};
+ 
++	if (!ctx.dev)
++		return -ENODEV;
++
+ 	memcpy(ctx.daddr, addr, sizeof(ctx.daddr));
+ 
+ 	if (!IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED))

target/linux/generic/backport-5.15/711-v6.0-03-net-ethernet-mtk-ppe-fix-traffic-offload-with-bridge.patch

@@ -0,0 +1,64 @@
+From: Lorenzo Bianconi <[email protected]>
+Date: Fri, 22 Jul 2022 09:06:19 +0200
+Subject: [PATCH] net: ethernet: mtk-ppe: fix traffic offload with bridged wlan
+
+A typical flow offload scenario for OpenWrt users is routed traffic
+received by the wan interface that is redirected to a wlan device
+belonging to the lan bridge. Current implementation fails to
+fill wdma offload info in mtk_flow_get_wdma_info() since odev device is
+the local bridge. Fix the issue running dev_fill_forward_path routine in
+mtk_flow_get_wdma_info in order to identify the wlan device.
+
+Tested-by: Paolo Valerio <[email protected]>
+Signed-off-by: Lorenzo Bianconi <[email protected]>
+Signed-off-by: David S. Miller <[email protected]>
+---
+
+--- a/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
++++ b/drivers/net/ethernet/mediatek/mtk_ppe_offload.c
+@@ -88,32 +88,28 @@ mtk_flow_offload_mangle_eth(const struct
+ static int
+ mtk_flow_get_wdma_info(struct net_device *dev, const u8 *addr, struct mtk_wdma_info *info)
+ {
+-	struct net_device_path_ctx ctx = {
+-		.dev = dev,
+-	};
+-	struct net_device_path path = {};
++	struct net_device_path_stack stack;
++	struct net_device_path *path;
++	int err;
+ 
+-	if (!ctx.dev)
++	if (!dev)
+ 		return -ENODEV;
+ 
+-	memcpy(ctx.daddr, addr, sizeof(ctx.daddr));
+-
+ 	if (!IS_ENABLED(CONFIG_NET_MEDIATEK_SOC_WED))
+ 		return -1;
+ 
+-	if (!dev->netdev_ops->ndo_fill_forward_path)
+-		return -1;
+-
+-	if (dev->netdev_ops->ndo_fill_forward_path(&ctx, &path))
+-		return -1;
++	err = dev_fill_forward_path(dev, addr, &stack);
++	if (err)
++		return err;
+ 
+-	if (path.type != DEV_PATH_MTK_WDMA)
++	path = &stack.path[stack.num_paths - 1];
++	if (path->type != DEV_PATH_MTK_WDMA)
+ 		return -1;
+ 
+-	info->wdma_idx = path.mtk_wdma.wdma_idx;
+-	info->queue = path.mtk_wdma.queue;
+-	info->bss = path.mtk_wdma.bss;
+-	info->wcid = path.mtk_wdma.wcid;
++	info->wdma_idx = path->mtk_wdma.wdma_idx;
++	info->queue = path->mtk_wdma.queue;
++	info->bss = path->mtk_wdma.bss;
++	info->wcid = path->mtk_wdma.wcid;
+ 
+ 	return 0;
+ }