--- /dev/null
+From de159d334d779b343ac32c52ab02a43f57c80926 Mon Sep 17 00:00:00 2001
+From: Kees Cook <keescook@chromium.org>
+Date: Fri, 5 May 2017 15:30:23 -0700
+Subject: bna: ethtool: Avoid reading past end of buffer
+
+[ Upstream commit 4dc69c1c1fff2f587f8e737e70b4a4e7565a5c94 ]
+
+Using memcpy() from a string that is shorter than the length copied means
+the destination buffer is being filled with arbitrary data from the kernel
+rodata segment. Instead, use strncpy() which will fill the trailing bytes
+with zeros.
+
+This was found with the future CONFIG_FORTIFY_SOURCE feature.
+
+Cc: Daniel Micay <danielmicay@gmail.com>
+Signed-off-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/brocade/bna/bnad_ethtool.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
+index 31f61a744d66..9473d12ce239 100644
+--- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
++++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
+@@ -541,8 +541,8 @@ bnad_get_strings(struct net_device *netdev, u32 stringset, u8 *string)
+ for (i = 0; i < BNAD_ETHTOOL_STATS_NUM; i++) {
+ BUG_ON(!(strlen(bnad_net_stats_strings[i]) <
+ ETH_GSTRING_LEN));
+- memcpy(string, bnad_net_stats_strings[i],
+- ETH_GSTRING_LEN);
++ strncpy(string, bnad_net_stats_strings[i],
++ ETH_GSTRING_LEN);
+ string += ETH_GSTRING_LEN;
+ }
+ bmap = bna_tx_rid_mask(&bnad->bna);
+--
+2.17.1
+
--- /dev/null
+From 35e35fc3613f4f6e87f1cdeeb59a4ca37d036bd2 Mon Sep 17 00:00:00 2001
+From: Colin Ian King <colin.king@canonical.com>
+Date: Fri, 22 Sep 2017 18:13:48 +0100
+Subject: e1000: avoid null pointer dereference on invalid stat type
+
+[ Upstream commit 5983587c8c5ef00d6886477544ad67d495bc5479 ]
+
+Currently if the stat type is invalid then data[i] is being set
+either by dereferencing a null pointer p, or it is reading from
+an incorrect previous location if we had a valid stat type
+previously. Fix this by skipping over the read of p on an invalid
+stat type.
+
+Detected by CoverityScan, CID#113385 ("Explicit null dereferenced")
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Reviewed-by: Alexander Duyck <alexander.h.duyck@intel.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+index e84574b1eae7..2a81f6d72140 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c
+@@ -1826,11 +1826,12 @@ static void e1000_get_ethtool_stats(struct net_device *netdev,
+ {
+ struct e1000_adapter *adapter = netdev_priv(netdev);
+ int i;
+- char *p = NULL;
+ const struct e1000_stats *stat = e1000_gstrings_stats;
+
+ e1000_update_stats(adapter);
+- for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++) {
++ for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++, stat++) {
++ char *p;
++
+ switch (stat->type) {
+ case NETDEV_STATS:
+ p = (char *)netdev + stat->stat_offset;
+@@ -1841,15 +1842,13 @@ static void e1000_get_ethtool_stats(struct net_device *netdev,
+ default:
+ WARN_ONCE(1, "Invalid E1000 stat type: %u index %d\n",
+ stat->type, i);
+- break;
++ continue;
+ }
+
+ if (stat->sizeof_stat == sizeof(u64))
+ data[i] = *(u64 *)p;
+ else
+ data[i] = *(u32 *)p;
+-
+- stat++;
+ }
+ /* BUG_ON(i != E1000_STATS_LEN); */
+ }
+--
+2.17.1
+
--- /dev/null
+From b2690eacbac33fef0a79d3a81dc667b8ad93b1b8 Mon Sep 17 00:00:00 2001
+From: Vincenzo Maffione <v.maffione@gmail.com>
+Date: Sat, 16 Sep 2017 18:00:00 +0200
+Subject: e1000: fix race condition between e1000_down() and e1000_watchdog
+
+[ Upstream commit 44c445c3d1b4eacff23141fa7977c3b2ec3a45c9 ]
+
+This patch fixes a race condition that can result into the interface being
+up and carrier on, but with transmits disabled in the hardware.
+The bug may show up by repeatedly IFF_DOWN+IFF_UP the interface, which
+allows e1000_watchdog() interleave with e1000_down().
+
+ CPU x CPU y
+ --------------------------------------------------------------------
+ e1000_down():
+ netif_carrier_off()
+ e1000_watchdog():
+ if (carrier == off) {
+ netif_carrier_on();
+ enable_hw_transmit();
+ }
+ disable_hw_transmit();
+ e1000_watchdog():
+ /* carrier on, do nothing */
+
+Signed-off-by: Vincenzo Maffione <v.maffione@gmail.com>
+Tested-by: Aaron Brown <aaron.f.brown@intel.com>
+Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/intel/e1000/e1000_main.c | 11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c
+index dd112aa5cebb..39a09e18c1b7 100644
+--- a/drivers/net/ethernet/intel/e1000/e1000_main.c
++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c
+@@ -521,8 +521,6 @@ void e1000_down(struct e1000_adapter *adapter)
+ struct net_device *netdev = adapter->netdev;
+ u32 rctl, tctl;
+
+- netif_carrier_off(netdev);
+-
+ /* disable receives in the hardware */
+ rctl = er32(RCTL);
+ ew32(RCTL, rctl & ~E1000_RCTL_EN);
+@@ -538,6 +536,15 @@ void e1000_down(struct e1000_adapter *adapter)
+ E1000_WRITE_FLUSH();
+ msleep(10);
+
++ /* Set the carrier off after transmits have been disabled in the
++ * hardware, to avoid race conditions with e1000_watchdog() (which
++ * may be running concurrently to us, checking for the carrier
++ * bit to decide whether it should enable transmits again). Such
++ * a race condition would result into transmission being disabled
++ * in the hardware until the next IFF_DOWN+IFF_UP cycle.
++ */
++ netif_carrier_off(netdev);
++
+ napi_disable(&adapter->napi);
+
+ e1000_irq_disable(adapter);
+--
+2.17.1
+
--- /dev/null
+From 0386ac4c0e21f505d6d4fef1df38d6e0388d9d06 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Wed, 5 Sep 2018 17:33:09 +0800
+Subject: MIPS: Loongson-3: Fix BRIDGE irq delivery problem
+
+[ Upstream commit 360fe725f8849aaddc53475fef5d4a0c439b05ae ]
+
+After commit e509bd7da149dc349160 ("genirq: Allow migration of chained
+interrupts by installing default action") Loongson-3 fails at here:
+
+setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction);
+
+This is because both chained_action and cascade_irqaction don't have
+IRQF_SHARED flag. This will cause Loongson-3 resume fails because HPET
+timer interrupt can't be delivered during S3. So we set the irqchip of
+the chained irq to loongson_irq_chip which doesn't disable the chained
+irq in CP0.Status.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20434/
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: Fuxin Zhang <zhangfx@lemote.com>
+Cc: Zhangjin Wu <wuzhangjin@gmail.com>
+Cc: Huacai Chen <chenhuacai@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/include/asm/mach-loongson64/irq.h | 2 +-
+ arch/mips/loongson64/loongson-3/irq.c | 13 +++----------
+ 2 files changed, 4 insertions(+), 11 deletions(-)
+
+diff --git a/arch/mips/include/asm/mach-loongson64/irq.h b/arch/mips/include/asm/mach-loongson64/irq.h
+index d18c45c7c394..19ff9ce46c02 100644
+--- a/arch/mips/include/asm/mach-loongson64/irq.h
++++ b/arch/mips/include/asm/mach-loongson64/irq.h
+@@ -9,7 +9,7 @@
+ #define MIPS_CPU_IRQ_BASE 56
+
+ #define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2) /* UART */
+-#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3) /* HT1 */
++#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3) /* CASCADE */
+ #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7) /* CPU Timer */
+
+ #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base
+diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c
+index ec5f2b30646c..027f53e3bc81 100644
+--- a/arch/mips/loongson64/loongson-3/irq.c
++++ b/arch/mips/loongson64/loongson-3/irq.c
+@@ -44,12 +44,6 @@ void mach_irq_dispatch(unsigned int pending)
+ }
+ }
+
+-static struct irqaction cascade_irqaction = {
+- .handler = no_action,
+- .flags = IRQF_NO_SUSPEND,
+- .name = "cascade",
+-};
+-
+ static inline void mask_loongson_irq(struct irq_data *d) { }
+ static inline void unmask_loongson_irq(struct irq_data *d) { }
+
+@@ -90,11 +84,10 @@ void __init mach_init_irq(void)
+ init_i8259_irqs();
+ irq_set_chip_and_handler(LOONGSON_UART_IRQ,
+ &loongson_irq_chip, handle_percpu_irq);
++ irq_set_chip_and_handler(LOONGSON_BRIDGE_IRQ,
++ &loongson_irq_chip, handle_percpu_irq);
+
+- /* setup HT1 irq */
+- setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction);
+-
+- set_c0_status(STATUSF_IP2 | STATUSF_IP6);
++ set_c0_status(STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP6);
+ }
+
+ #ifdef CONFIG_HOTPLUG_CPU
+--
+2.17.1
+
--- /dev/null
+From b7d45d909ebf9f468103312c34eef5bba01cbb16 Mon Sep 17 00:00:00 2001
+From: Huacai Chen <chenhc@lemote.com>
+Date: Wed, 5 Sep 2018 17:33:08 +0800
+Subject: MIPS: Loongson-3: Fix CPU UART irq delivery problem
+
+[ Upstream commit d06f8a2f1befb5a3d0aa660ab1c05e9b744456ea ]
+
+Masking/unmasking the CPU UART irq in CP0_Status (and redirecting it to
+other CPUs) may cause interrupts be lost, especially in multi-package
+machines (Package-0's UART irq cannot be delivered to others). So make
+mask_loongson_irq() and unmask_loongson_irq() be no-ops.
+
+The original problem (UART IRQ may deliver to any core) is also because
+of masking/unmasking the CPU UART irq in CP0_Status. So it is safe to
+remove all of the stuff.
+
+Signed-off-by: Huacai Chen <chenhc@lemote.com>
+Signed-off-by: Paul Burton <paul.burton@mips.com>
+Patchwork: https://patchwork.linux-mips.org/patch/20433/
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: James Hogan <jhogan@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: Fuxin Zhang <zhangfx@lemote.com>
+Cc: Zhangjin Wu <wuzhangjin@gmail.com>
+Cc: Huacai Chen <chenhuacai@gmail.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/mips/loongson64/loongson-3/irq.c | 43 ++-------------------------
+ 1 file changed, 3 insertions(+), 40 deletions(-)
+
+diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c
+index 8e7649088353..ec5f2b30646c 100644
+--- a/arch/mips/loongson64/loongson-3/irq.c
++++ b/arch/mips/loongson64/loongson-3/irq.c
+@@ -50,45 +50,8 @@ static struct irqaction cascade_irqaction = {
+ .name = "cascade",
+ };
+
+-static inline void mask_loongson_irq(struct irq_data *d)
+-{
+- clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE));
+- irq_disable_hazard();
+-
+- /* Workaround: UART IRQ may deliver to any core */
+- if (d->irq == LOONGSON_UART_IRQ) {
+- int cpu = smp_processor_id();
+- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node;
+- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node;
+- u64 intenclr_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_INTENCLR);
+- u64 introuter_lpc_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_LPC);
+-
+- *(volatile u32 *)intenclr_addr = 1 << 10;
+- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id);
+- }
+-}
+-
+-static inline void unmask_loongson_irq(struct irq_data *d)
+-{
+- /* Workaround: UART IRQ may deliver to any core */
+- if (d->irq == LOONGSON_UART_IRQ) {
+- int cpu = smp_processor_id();
+- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node;
+- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node;
+- u64 intenset_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_INTENSET);
+- u64 introuter_lpc_addr = smp_group[node_id] |
+- (u64)(&LOONGSON_INT_ROUTER_LPC);
+-
+- *(volatile u32 *)intenset_addr = 1 << 10;
+- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<<core_id);
+- }
+-
+- set_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE));
+- irq_enable_hazard();
+-}
++static inline void mask_loongson_irq(struct irq_data *d) { }
++static inline void unmask_loongson_irq(struct irq_data *d) { }
+
+ /* For MIPS IRQs which shared by all cores */
+ static struct irq_chip loongson_irq_chip = {
+@@ -126,7 +89,7 @@ void __init mach_init_irq(void)
+ mips_cpu_irq_init();
+ init_i8259_irqs();
+ irq_set_chip_and_handler(LOONGSON_UART_IRQ,
+- &loongson_irq_chip, handle_level_irq);
++ &loongson_irq_chip, handle_percpu_irq);
+
+ /* setup HT1 irq */
+ setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction);
+--
+2.17.1
+
--- /dev/null
+From 21addf295a3242a8fcfc073ca761bf6a380e9701 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Tue, 12 Dec 2017 21:25:41 +0100
+Subject: parisc: Align os_hpmc_size on word boundary
+
+[ Upstream commit 0ed9d3de5f8f97e6efd5ca0e3377cab5f0451ead ]
+
+The os_hpmc_size variable sometimes wasn't aligned at word boundary and thus
+triggered the unaligned fault handler at startup.
+Fix it by aligning it properly.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> # v4.14+
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/hpmc.S | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S
+index 0fbd0a0e1cda..38d461aec46d 100644
+--- a/arch/parisc/kernel/hpmc.S
++++ b/arch/parisc/kernel/hpmc.S
+@@ -304,6 +304,7 @@ ENDPROC_CFI(os_hpmc)
+
+
+ __INITRODATA
++ .align 4
+ .export os_hpmc_size
+ os_hpmc_size:
+ .word .os_hpmc_end-.os_hpmc
+--
+2.17.1
+
--- /dev/null
+From 535d869a571d7740f1509a24c3ab8ffc1e45029c Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sun, 14 Oct 2018 21:58:00 +0200
+Subject: parisc: Fix exported address of os_hpmc handler
+
+[ Upstream commit 99a3ae51d557d8e38a7aece65678a31f9db215ee ]
+
+In the C-code we need to put the physical address of the hpmc handler in
+the interrupt vector table (IVA) in order to get HPMCs working. Since
+on parisc64 function pointers are indirect (in fact they are function
+descriptors) we instead export the address as variable and not as
+function.
+
+This reverts a small part of commit f39cce654f9a ("parisc: Add
+cfi_startproc and cfi_endproc to assembly code").
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: <stable@vger.kernel.org> [4.9+]
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/hpmc.S | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S
+index 407b3aa5aa07..e88f4e7f39f3 100644
+--- a/arch/parisc/kernel/hpmc.S
++++ b/arch/parisc/kernel/hpmc.S
+@@ -84,7 +84,7 @@ END(hpmc_pim_data)
+
+ .import intr_save, code
+ .align 16
+-ENTRY_CFI(os_hpmc)
++ENTRY(os_hpmc)
+ .os_hpmc:
+
+ /*
+@@ -301,7 +301,6 @@ os_hpmc_6:
+ b .
+ nop
+ .align 16 /* make function length multiple of 16 bytes */
+-ENDPROC_CFI(os_hpmc)
+ .os_hpmc_end:
+
+
+--
+2.17.1
+
--- /dev/null
+From 213ede17663c2356a4ece9d28406338982ea6533 Mon Sep 17 00:00:00 2001
+From: Helge Deller <deller@gmx.de>
+Date: Sat, 24 Mar 2018 21:18:25 +0100
+Subject: parisc: Fix HPMC handler by increasing size to multiple of 16 bytes
+
+[ Upstream commit d5654e156bc4d68a87bbaa6d7e020baceddf6e68 ]
+
+Make sure that the HPMC (High Priority Machine Check) handler is 16-byte
+aligned and that it's length in the IVT is a multiple of 16 bytes.
+Otherwise PDC may decide not to call the HPMC crash handler.
+
+Signed-off-by: Helge Deller <deller@gmx.de>
+Cc: stable@vger.kernel.org
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/parisc/kernel/hpmc.S | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S
+index 38d461aec46d..407b3aa5aa07 100644
+--- a/arch/parisc/kernel/hpmc.S
++++ b/arch/parisc/kernel/hpmc.S
+@@ -83,6 +83,7 @@ END(hpmc_pim_data)
+ .text
+
+ .import intr_save, code
++ .align 16
+ ENTRY_CFI(os_hpmc)
+ .os_hpmc:
+
+@@ -299,12 +300,15 @@ os_hpmc_6:
+
+ b .
+ nop
++ .align 16 /* make function length multiple of 16 bytes */
+ ENDPROC_CFI(os_hpmc)
+ .os_hpmc_end:
+
+
+ __INITRODATA
++.globl os_hpmc_size
+ .align 4
+- .export os_hpmc_size
++ .type os_hpmc_size, @object
++ .size os_hpmc_size, 4
+ os_hpmc_size:
+ .word .os_hpmc_end-.os_hpmc
+--
+2.17.1
+
fuse-fix-blocked_waitq-wakeup.patch
fuse-set-fr_sent-while-locked.patch
mm-do-not-bug_on-on-incorrect-length-in-__mm_populat.patch
+e1000-avoid-null-pointer-dereference-on-invalid-stat.patch
+e1000-fix-race-condition-between-e1000_down-and-e100.patch
+bna-ethtool-avoid-reading-past-end-of-buffer.patch
+parisc-align-os_hpmc_size-on-word-boundary.patch
+parisc-fix-hpmc-handler-by-increasing-size-to-multip.patch
+parisc-fix-exported-address-of-os_hpmc-handler.patch
+mips-loongson-3-fix-cpu-uart-irq-delivery-problem.patch
+mips-loongson-3-fix-bridge-irq-delivery-problem.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
