patches for 4.4

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-4.4/hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch b/queue-4.4/hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch
new file mode 100644 (file)
index 0000000..f372cd0
--- /dev/null
+++ b/queue-4.4/hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch
@@ -0,0 +1,37 @@
+From 04cdeb414531d79ec75666b5e93202e3723db053 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Wed, 26 Dec 2018 11:28:24 +0000
+Subject: hwmon: (lm80) Fix missing unlock on error in set_fan_div()
+
+[ Upstream commit 07bd14ccc3049f9c0147a91a4227a571f981601a ]
+
+Add the missing unlock before return from function set_fan_div()
+in the error handling case.
+
+Fixes: c9c63915519b ("hwmon: (lm80) fix a missing check of the status of SMBus read")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/hwmon/lm80.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c
+index cb6606a0470d1..be60bd5bab783 100644
+--- a/drivers/hwmon/lm80.c
++++ b/drivers/hwmon/lm80.c
+@@ -393,8 +393,10 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr,
+       }
+ 
+       rv = lm80_read_value(client, LM80_REG_FANDIV);
+-      if (rv < 0)
++      if (rv < 0) {
++              mutex_unlock(&data->update_lock);
+               return rv;
++      }
+       reg = (rv & ~(3 << (2 * (nr + 1))))
+           | (data->fan_div[nr] << (2 * (nr + 1)));
+       lm80_write_value(client, LM80_REG_FANDIV, reg);
+-- 
+2.19.1
+

diff --git a/queue-4.4/net-fix-ipv6-prefix-route-residue.patch b/queue-4.4/net-fix-ipv6-prefix-route-residue.patch
new file mode 100644 (file)
index 0000000..15032d6
--- /dev/null
+++ b/queue-4.4/net-fix-ipv6-prefix-route-residue.patch
@@ -0,0 +1,49 @@
+From be5ecf5074b3119f03adabf3f4c576a01d7cca03 Mon Sep 17 00:00:00 2001
+From: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Date: Mon, 11 Feb 2019 10:57:46 +0800
+Subject: net: fix IPv6 prefix route residue
+
+[ Upstream commit e75913c93f7cd5f338ab373c34c93a655bd309cb ]
+
+Follow those steps:
+ # ip addr add 2001:123::1/32 dev eth0
+ # ip addr add 2001:123:456::2/64 dev eth0
+ # ip addr del 2001:123::1/32 dev eth0
+ # ip addr del 2001:123:456::2/64 dev eth0
+and then prefix route of 2001:123::1/32 will still exist.
+
+This is because ipv6_prefix_equal in check_cleanup_prefix_route
+func does not check whether two IPv6 addresses have the same
+prefix length. If the prefix of one address starts with another
+shorter address prefix, even though their prefix lengths are
+different, the return value of ipv6_prefix_equal is true.
+
+Here I add a check of whether two addresses have the same prefix
+to decide whether their prefixes are equal.
+
+Fixes: 5b84efecb7d9 ("ipv6 addrconf: don't cleanup prefix route for IFA_F_NOPREFIXROUTE")
+Signed-off-by: Zhiqiang Liu <liuzhiqiang26@huawei.com>
+Reported-by: Wenhao Zhang <zhangwenhao8@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/ipv6/addrconf.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
+index 4dde1e0e7d379..086cdf9f05013 100644
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -1043,7 +1043,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
+       list_for_each_entry(ifa, &idev->addr_list, if_list) {
+               if (ifa == ifp)
+                       continue;
+-              if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
++              if (ifa->prefix_len != ifp->prefix_len ||
++                  !ipv6_prefix_equal(&ifa->addr, &ifp->addr,
+                                      ifp->prefix_len))
+                       continue;
+               if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
+-- 
+2.19.1
+

diff --git a/queue-4.4/series b/queue-4.4/series
new file mode 100644 (file)
index 0000000..7fe92a7
--- /dev/null
+++ b/queue-4.4/series
@@ -0,0 +1,3 @@
+net-fix-ipv6-prefix-route-residue.patch
+vsock-cope-with-memory-allocation-failure-at-socket-.patch
+hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch

diff --git a/queue-4.4/vsock-cope-with-memory-allocation-failure-at-socket-.patch b/queue-4.4/vsock-cope-with-memory-allocation-failure-at-socket-.patch
new file mode 100644 (file)
index 0000000..f606740
--- /dev/null
+++ b/queue-4.4/vsock-cope-with-memory-allocation-failure-at-socket-.patch
@@ -0,0 +1,43 @@
+From 1b567b6830dc9ff59101bbc586961791adf1592b Mon Sep 17 00:00:00 2001
+From: Paolo Abeni <pabeni@redhat.com>
+Date: Thu, 7 Feb 2019 14:13:18 +0100
+Subject: vsock: cope with memory allocation failure at socket creation time
+
+[ Upstream commit 225d9464268599a5b4d094d02ec17808e44c7553 ]
+
+In the unlikely event that the kmalloc call in vmci_transport_socket_init()
+fails, we end-up calling vmci_transport_destruct() with a NULL vmci_trans()
+and oopsing.
+
+This change addresses the above explicitly checking for zero vmci_trans()
+at destruction time.
+
+Reported-by: Xiumei Mu <xmu@redhat.com>
+Fixes: d021c344051a ("VSOCK: Introduce VM Sockets")
+Signed-off-by: Paolo Abeni <pabeni@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Jorgen Hansen <jhansen@vmware.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ net/vmw_vsock/vmci_transport.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c
+index d24773552b641..217810674c358 100644
+--- a/net/vmw_vsock/vmci_transport.c
++++ b/net/vmw_vsock/vmci_transport.c
+@@ -1656,6 +1656,10 @@ static void vmci_transport_cleanup(struct work_struct *work)
+ 
+ static void vmci_transport_destruct(struct vsock_sock *vsk)
+ {
++      /* transport can be NULL if we hit a failure at init() time */
++      if (!vmci_trans(vsk))
++              return;
++
+       /* Ensure that the detach callback doesn't use the sk/vsk
+        * we are about to destruct.
+        */
+-- 
+2.19.1
+