--- /dev/null
+From e3b1977d1f982a3f07d2fcbde552b3a07ac94dbc Mon Sep 17 00:00:00 2001
+From: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+Date: Mon, 4 Mar 2019 00:27:16 -0800
+Subject: net/mlx5: Avoid panic when setting vport rate
+
+[ Upstream commit 24319258660a84dd77f4be026a55b10a12524919 ]
+
+If we try to set VFs rate on a VF (not PF) net device, the kernel
+will be crash. The commands are show as below:
+
+$ echo 2 > /sys/class/net/$MLX_PF0/device/sriov_numvfs
+$ ip link set $MLX_VF0 vf 0 max_tx_rate 2 min_tx_rate 1
+
+If not applied the first patch ("net/mlx5: Avoid panic when setting
+vport mac, getting vport config"), the command:
+
+$ ip link set $MLX_VF0 vf 0 rate 100
+
+can also crash the kernel.
+
+[ 1650.006388] RIP: 0010:mlx5_eswitch_set_vport_rate+0x1f/0x260 [mlx5_core]
+[ 1650.007092] do_setlink+0x982/0xd20
+[ 1650.007129] __rtnl_newlink+0x528/0x7d0
+[ 1650.007374] rtnl_newlink+0x43/0x60
+[ 1650.007407] rtnetlink_rcv_msg+0x2a2/0x320
+[ 1650.007484] netlink_rcv_skb+0xcb/0x100
+[ 1650.007519] netlink_unicast+0x17f/0x230
+[ 1650.007554] netlink_sendmsg+0x2d2/0x3d0
+[ 1650.007592] sock_sendmsg+0x36/0x50
+[ 1650.007625] ___sys_sendmsg+0x280/0x2a0
+[ 1650.007963] __sys_sendmsg+0x58/0xa0
+[ 1650.007998] do_syscall_64+0x5b/0x180
+[ 1650.009438] entry_SYSCALL_64_after_hwframe+0x44/0xa9
+
+Fixes: c9497c98901c ("net/mlx5: Add support for setting VF min rate")
+Cc: Mohamad Haj Yahia <mohamad@mellanox.com>
+Signed-off-by: Tonghao Zhang <xiangxia.m.yue@gmail.com>
+Reviewed-by: Roi Dayan <roid@mellanox.com>
+Acked-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/eswitch.c | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+index 2f93e6e9dc9e..2aec0c021b6c 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
+@@ -1966,19 +1966,24 @@ static int normalize_vports_min_rate(struct mlx5_eswitch *esw, u32 divider)
+ int mlx5_eswitch_set_vport_rate(struct mlx5_eswitch *esw, int vport,
+ u32 max_rate, u32 min_rate)
+ {
+- u32 fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
+- bool min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) &&
+- fw_max_bw_share >= MLX5_MIN_BW_SHARE;
+- bool max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit);
+ struct mlx5_vport *evport;
++ u32 fw_max_bw_share;
+ u32 previous_min_rate;
+ u32 divider;
++ bool min_rate_supported;
++ bool max_rate_supported;
+ int err = 0;
+
+ if (!ESW_ALLOWED(esw))
+ return -EPERM;
+ if (!LEGAL_VPORT(esw, vport))
+ return -EINVAL;
++
++ fw_max_bw_share = MLX5_CAP_QOS(esw->dev, max_tsar_bw_share);
++ min_rate_supported = MLX5_CAP_QOS(esw->dev, esw_bw_share) &&
++ fw_max_bw_share >= MLX5_MIN_BW_SHARE;
++ max_rate_supported = MLX5_CAP_QOS(esw->dev, esw_rate_limit);
++
+ if ((min_rate && !min_rate_supported) || (max_rate && !max_rate_supported))
+ return -EOPNOTSUPP;
+
+--
+2.19.1
+