--- /dev/null
+From 43200a4480cbbe660309621817f54cbb93907108 Mon Sep 17 00:00:00 2001
+From: Wolfgang Grandegger <wg@grandegger.com>
+Date: Mon, 13 Jun 2016 15:44:19 +0200
+Subject: can: at91_can: RX queue could get stuck at high bus load
+
+From: Wolfgang Grandegger <wg@grandegger.com>
+
+commit 43200a4480cbbe660309621817f54cbb93907108 upstream.
+
+At high bus load it could happen that "at91_poll()" enters with all RX
+message boxes filled up. If then at the end the "quota" is exceeded as
+well, "rx_next" will not be reset to the first RX mailbox and hence the
+interrupts remain disabled.
+
+Signed-off-by: Wolfgang Grandegger <wg@grandegger.com>
+Tested-by: Amr Bekhit <amrbekhit@gmail.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/at91_can.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/can/at91_can.c
++++ b/drivers/net/can/at91_can.c
+@@ -712,9 +712,10 @@ static int at91_poll_rx(struct net_devic
+
+ /* upper group completed, look again in lower */
+ if (priv->rx_next > get_mb_rx_low_last(priv) &&
+- quota > 0 && mb > get_mb_rx_last(priv)) {
++ mb > get_mb_rx_last(priv)) {
+ priv->rx_next = get_mb_rx_first(priv);
+- goto again;
++ if (quota > 0)
++ goto again;
+ }
+
+ return received;
--- /dev/null
+From 427460c83cdf55069eee49799a0caef7dde8df69 Mon Sep 17 00:00:00 2001
+From: Thor Thayer <tthayer@opensource.altera.com>
+Date: Thu, 16 Jun 2016 11:10:19 -0500
+Subject: can: c_can: Update D_CAN TX and RX functions to 32 bit - fix Altera Cyclone access
+
+From: Thor Thayer <tthayer@opensource.altera.com>
+
+commit 427460c83cdf55069eee49799a0caef7dde8df69 upstream.
+
+When testing CAN write floods on Altera's CycloneV, the first 2 bytes
+are sometimes 0x00, 0x00 or corrupted instead of the values sent. Also
+observed bytes 4 & 5 were corrupted in some cases.
+
+The D_CAN Data registers are 32 bits and changing from 16 bit writes to
+32 bit writes fixes the problem.
+
+Testing performed on Altera CycloneV (D_CAN). Requesting tests on other
+C_CAN & D_CAN platforms.
+
+Reported-by: Richard Andrysek <richard.andrysek@gomtec.de>
+Signed-off-by: Thor Thayer <tthayer@opensource.altera.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/c_can/c_can.c | 38 +++++++++++++++++++++++++++++++-------
+ 1 file changed, 31 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/can/c_can/c_can.c
++++ b/drivers/net/can/c_can/c_can.c
+@@ -332,9 +332,23 @@ static void c_can_setup_tx_object(struct
+
+ priv->write_reg(priv, C_CAN_IFACE(MSGCTRL_REG, iface), ctrl);
+
+- for (i = 0; i < frame->can_dlc; i += 2) {
+- priv->write_reg(priv, C_CAN_IFACE(DATA1_REG, iface) + i / 2,
+- frame->data[i] | (frame->data[i + 1] << 8));
++ if (priv->type == BOSCH_D_CAN) {
++ u32 data = 0, dreg = C_CAN_IFACE(DATA1_REG, iface);
++
++ for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
++ data = (u32)frame->data[i];
++ data |= (u32)frame->data[i + 1] << 8;
++ data |= (u32)frame->data[i + 2] << 16;
++ data |= (u32)frame->data[i + 3] << 24;
++ priv->write_reg32(priv, dreg, data);
++ }
++ } else {
++ for (i = 0; i < frame->can_dlc; i += 2) {
++ priv->write_reg(priv,
++ C_CAN_IFACE(DATA1_REG, iface) + i / 2,
++ frame->data[i] |
++ (frame->data[i + 1] << 8));
++ }
+ }
+ }
+
+@@ -402,10 +416,20 @@ static int c_can_read_msg_object(struct
+ } else {
+ int i, dreg = C_CAN_IFACE(DATA1_REG, iface);
+
+- for (i = 0; i < frame->can_dlc; i += 2, dreg ++) {
+- data = priv->read_reg(priv, dreg);
+- frame->data[i] = data;
+- frame->data[i + 1] = data >> 8;
++ if (priv->type == BOSCH_D_CAN) {
++ for (i = 0; i < frame->can_dlc; i += 4, dreg += 2) {
++ data = priv->read_reg32(priv, dreg);
++ frame->data[i] = data;
++ frame->data[i + 1] = data >> 8;
++ frame->data[i + 2] = data >> 16;
++ frame->data[i + 3] = data >> 24;
++ }
++ } else {
++ for (i = 0; i < frame->can_dlc; i += 2, dreg++) {
++ data = priv->read_reg(priv, dreg);
++ frame->data[i] = data;
++ frame->data[i + 1] = data >> 8;
++ }
+ }
+ }
+
--- /dev/null
+From bce271f255dae8335dc4d2ee2c4531e09cc67f5a Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Tue, 21 Jun 2016 12:14:07 +0200
+Subject: can: fix handling of unmodifiable configuration options fix
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit bce271f255dae8335dc4d2ee2c4531e09cc67f5a upstream.
+
+With upstream commit bb208f144cf3f59 (can: fix handling of unmodifiable
+configuration options) a new can_validate() function was introduced.
+
+When invoking 'ip link set can0 type can' without any configuration data
+can_validate() tries to validate the content without taking into account that
+there's totally no content. This patch adds a check for missing content.
+
+Reported-by: ajneu <ajneu1@gmail.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/dev.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -798,6 +798,9 @@ static int can_validate(struct nlattr *t
+ * - control mode with CAN_CTRLMODE_FD set
+ */
+
++ if (!data)
++ return 0;
++
+ if (data[IFLA_CAN_CTRLMODE]) {
+ struct can_ctrlmode *cm = nla_data(data[IFLA_CAN_CTRLMODE]);
+
--- /dev/null
+From 25e1ed6e64f52a692ba3191c4fde650aab3ecc07 Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Tue, 21 Jun 2016 15:45:47 +0200
+Subject: can: fix oops caused by wrong rtnl dellink usage
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+commit 25e1ed6e64f52a692ba3191c4fde650aab3ecc07 upstream.
+
+For 'real' hardware CAN devices the netlink interface is used to set CAN
+specific communication parameters. Real CAN hardware can not be created nor
+removed with the ip tool ...
+
+This patch adds a private dellink function for the CAN device driver interface
+that does just nothing.
+
+It's a follow up to commit 993e6f2fd ("can: fix oops caused by wrong rtnl
+newlink usage") but for dellink.
+
+Reported-by: ajneu <ajneu1@gmail.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/dev.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/net/can/dev.c
++++ b/drivers/net/can/dev.c
+@@ -1011,6 +1011,11 @@ static int can_newlink(struct net *src_n
+ return -EOPNOTSUPP;
+ }
+
++static void can_dellink(struct net_device *dev, struct list_head *head)
++{
++ return;
++}
++
+ static struct rtnl_link_ops can_link_ops __read_mostly = {
+ .kind = "can",
+ .maxtype = IFLA_CAN_MAX,
+@@ -1019,6 +1024,7 @@ static struct rtnl_link_ops can_link_ops
+ .validate = can_validate,
+ .newlink = can_newlink,
+ .changelink = can_changelink,
++ .dellink = can_dellink,
+ .get_size = can_get_size,
+ .fill_info = can_fill_info,
+ .get_xstats_size = can_get_xstats_size,
--- /dev/null
+From 54e430bbd490e18ab116afa4cd90dcc45787b3df Mon Sep 17 00:00:00 2001
+From: Brian King <brking@linux.vnet.ibm.com>
+Date: Mon, 27 Jun 2016 09:09:40 -0500
+Subject: ipr: Clear interrupt on croc/crocodile when running with LSI
+
+From: Brian King <brking@linux.vnet.ibm.com>
+
+commit 54e430bbd490e18ab116afa4cd90dcc45787b3df upstream.
+
+If we fall back to using LSI on the Croc or Crocodile chip we need to
+clear the interrupt so we don't hang the system.
+
+Tested-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
+Signed-off-by: Brian King <brking@linux.vnet.ibm.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/ipr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/ipr.c
++++ b/drivers/scsi/ipr.c
+@@ -10095,6 +10095,7 @@ static int ipr_probe_ioa(struct pci_dev
+ ioa_cfg->intr_flag = IPR_USE_MSI;
+ else {
+ ioa_cfg->intr_flag = IPR_USE_LSI;
++ ioa_cfg->clear_isr = 1;
+ ioa_cfg->nvectors = 1;
+ dev_info(&pdev->dev, "Cannot enable MSI.\n");
+ }
--- /dev/null
+From 1424a09a9e1839285e948d4ea9fdfca26c9a2086 Mon Sep 17 00:00:00 2001
+From: Stephane Eranian <eranian@google.com>
+Date: Thu, 3 Dec 2015 23:33:18 +0100
+Subject: perf/x86: fix PEBS issues on Intel Atom/Core2
+
+From: Stephane Eranian <eranian@google.com>
+
+commit 1424a09a9e1839285e948d4ea9fdfca26c9a2086 upstream.
+
+This patch fixes broken PEBS support on Intel Atom and Core2
+due to wrong pointer arithmetic in intel_pmu_drain_pebs_core().
+
+The get_next_pebs_record_by_bit() was called on PEBS format fmt0
+which does not use the pebs_record_nhm layout.
+
+Signed-off-by: Stephane Eranian <eranian@google.com>
+Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
+Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
+Cc: Jiri Olsa <jolsa@redhat.com>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Cc: Vince Weaver <vincent.weaver@maine.edu>
+Cc: kan.liang@intel.com
+Fixes: 21509084f999 ("perf/x86/intel: Handle multiple records in the PEBS buffer")
+Link: http://lkml.kernel.org/r/1449182000-31524-3-git-send-email-eranian@google.com
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/cpu/perf_event_intel_ds.c | 9 ++++++++-
+ 1 file changed, 8 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
++++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
+@@ -1110,6 +1110,13 @@ get_next_pebs_record_by_bit(void *base,
+ void *at;
+ u64 pebs_status;
+
++ /*
++ * fmt0 does not have a status bitfield (does not use
++ * perf_record_nhm format)
++ */
++ if (x86_pmu.intel_cap.pebs_format < 1)
++ return base;
++
+ if (base == NULL)
+ return NULL;
+
+@@ -1195,7 +1202,7 @@ static void intel_pmu_drain_pebs_core(st
+ if (!event->attr.precise_ip)
+ return;
+
+- n = (top - at) / x86_pmu.pebs_record_size;
++ n = top - at;
+ if (n <= 0)
+ return;
+
--- /dev/null
+From 3dad5424adfb346c871847d467f97dcdca64ea97 Mon Sep 17 00:00:00 2001
+From: Vegard Nossum <vegard.nossum@oracle.com>
+Date: Sun, 3 Jul 2016 10:54:54 +0200
+Subject: RDS: fix rds_tcp_init() error path
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+commit 3dad5424adfb346c871847d467f97dcdca64ea97 upstream.
+
+If register_pernet_subsys() fails, we shouldn't try to call
+unregister_pernet_subsys().
+
+Fixes: 467fa15356 ("RDS-TCP: Support multiple RDS-TCP listen endpoints, one per netns.")
+Cc: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Cc: David S. Miller <davem@davemloft.net>
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Acked-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/rds/tcp.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -421,7 +421,7 @@ static int rds_tcp_init(void)
+
+ ret = rds_tcp_recv_init();
+ if (ret)
+- goto out_slab;
++ goto out_pernet;
+
+ ret = rds_trans_register(&rds_tcp_transport);
+ if (ret)
+@@ -433,8 +433,9 @@ static int rds_tcp_init(void)
+
+ out_recv:
+ rds_tcp_recv_exit();
+-out_slab:
++out_pernet:
+ unregister_pernet_subsys(&rds_tcp_net_ops);
++out_slab:
+ kmem_cache_destroy(rds_tcp_conn_slab);
+ out:
+ return ret;
--- /dev/null
+From 5e7ff2ca7f2da55fe777167849d0c93403bd0dc8 Mon Sep 17 00:00:00 2001
+From: Alan Stern <stern@rowland.harvard.edu>
+Date: Thu, 23 Jun 2016 15:05:26 -0400
+Subject: SCSI: fix new bug in scsi_dev_info_list string matching
+
+From: Alan Stern <stern@rowland.harvard.edu>
+
+commit 5e7ff2ca7f2da55fe777167849d0c93403bd0dc8 upstream.
+
+Commit b704f70ce200 ("SCSI: fix bug in scsi_dev_info_list matching")
+changed the way vendor- and model-string matching was carried out in the
+routine that looks up entries in a SCSI devinfo list. The new matching
+code failed to take into account the case of a maximum-length string; in
+such cases it could end up testing for a terminating '\0' byte beyond
+the end of the memory allocated to the string. This out-of-bounds bug
+was detected by UBSAN.
+
+I don't know if anybody has actually encountered this bug. The symptom
+would be that a device entry in the blacklist might not be matched
+properly if it contained an 8-character vendor name or a 16-character
+model name. Such entries certainly exist in scsi_static_device_list.
+
+This patch fixes the problem by adding a check for a maximum-length
+string before the '\0' test.
+
+Signed-off-by: Alan Stern <stern@rowland.harvard.edu>
+Fixes: b704f70ce200 ("SCSI: fix bug in scsi_dev_info_list matching")
+Tested-by: Wilfried Klaebe <linux-kernel@lebenslange-mailadresse.de>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/scsi_devinfo.c | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -426,7 +426,7 @@ static struct scsi_dev_info_list *scsi_d
+ * here, and we don't know what device it is
+ * trying to work with, leave it as-is.
+ */
+- vmax = 8; /* max length of vendor */
++ vmax = sizeof(devinfo->vendor);
+ vskip = vendor;
+ while (vmax > 0 && *vskip == ' ') {
+ vmax--;
+@@ -436,7 +436,7 @@ static struct scsi_dev_info_list *scsi_d
+ while (vmax > 0 && vskip[vmax - 1] == ' ')
+ --vmax;
+
+- mmax = 16; /* max length of model */
++ mmax = sizeof(devinfo->model);
+ mskip = model;
+ while (mmax > 0 && *mskip == ' ') {
+ mmax--;
+@@ -452,10 +452,12 @@ static struct scsi_dev_info_list *scsi_d
+ * Behave like the older version of get_device_flags.
+ */
+ if (memcmp(devinfo->vendor, vskip, vmax) ||
+- devinfo->vendor[vmax])
++ (vmax < sizeof(devinfo->vendor) &&
++ devinfo->vendor[vmax]))
+ continue;
+ if (memcmp(devinfo->model, mskip, mmax) ||
+- devinfo->model[mmax])
++ (mmax < sizeof(devinfo->model) &&
++ devinfo->model[mmax]))
+ continue;
+ return devinfo;
+ } else {
mmc-block-fix-packed-command-header-endianness.patch
sched-fair-fix-effective_load-to-consistently-use-smoothed-load.patch
ovl-handle-attr_kill.patch
+perf-x86-fix-pebs-issues-on-intel-atom-core2.patch
+can-at91_can-rx-queue-could-get-stuck-at-high-bus-load.patch
+can-c_can-update-d_can-tx-and-rx-functions-to-32-bit-fix-altera-cyclone-access.patch
+can-fix-handling-of-unmodifiable-configuration-options-fix.patch
+can-fix-oops-caused-by-wrong-rtnl-dellink-usage.patch
+rds-fix-rds_tcp_init-error-path.patch
+scsi-fix-new-bug-in-scsi_dev_info_list-string-matching.patch
+ipr-clear-interrupt-on-croc-crocodile-when-running-with-lsi.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
