--- /dev/null
+From 6818eb5230cc6e02e3ca2aaf994a031fe2474148 Mon Sep 17 00:00:00 2001
+From: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Date: Mon, 10 Sep 2018 11:43:13 +0100
+Subject: can: rcar_can: Fix erroneous registration
+
+[ Upstream commit 68c8d209cd4337da4fa04c672f0b62bb735969bc ]
+
+Assigning 2 to "renesas,can-clock-select" tricks the driver into
+registering the CAN interface, even though we don't want that.
+This patch improves one of the checks to prevent that from happening.
+
+Fixes: 862e2b6af9413b43 ("can: rcar_can: support all input clocks")
+Signed-off-by: Fabrizio Castro <fabrizio.castro@bp.renesas.com>
+Signed-off-by: Chris Paterson <Chris.Paterson2@renesas.com>
+Reviewed-by: Simon Horman <horms+renesas@verge.net.au>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/can/rcar_can.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c
+index 9718248e55f1..16144e7d0c8f 100644
+--- a/drivers/net/can/rcar_can.c
++++ b/drivers/net/can/rcar_can.c
+@@ -24,6 +24,9 @@
+
+ #define RCAR_CAN_DRV_NAME "rcar_can"
+
++#define RCAR_SUPPORTED_CLOCKS (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \
++ BIT(CLKR_CLKEXT))
++
+ /* Mailbox configuration:
+ * mailbox 60 - 63 - Rx FIFO mailboxes
+ * mailbox 56 - 59 - Tx FIFO mailboxes
+@@ -785,7 +788,7 @@ static int rcar_can_probe(struct platform_device *pdev)
+ goto fail_clk;
+ }
+
+- if (clock_select >= ARRAY_SIZE(clock_names)) {
++ if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) {
+ err = -EINVAL;
+ dev_err(&pdev->dev, "invalid CAN clock selected\n");
+ goto fail_clk;
+--
+2.19.1
+
--- /dev/null
+From e69583db4235e7d3126267622b178bfacbddbe97 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Wed, 7 Nov 2018 14:18:50 +0100
+Subject: iommu/ipmmu-vmsa: Fix crash on early domain free
+
+[ Upstream commit e5b78f2e349eef5d4fca5dc1cf5a3b4b2cc27abd ]
+
+If iommu_ops.add_device() fails, iommu_ops.domain_free() is still
+called, leading to a crash, as the domain was only partially
+initialized:
+
+ ipmmu-vmsa e67b0000.mmu: Cannot accommodate DMA translation for IOMMU page tables
+ sata_rcar ee300000.sata: Unable to initialize IPMMU context
+ iommu: Failed to add device ee300000.sata to group 0: -22
+ Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038
+ ...
+ Call trace:
+ ipmmu_domain_free+0x1c/0xa0
+ iommu_group_release+0x48/0x68
+ kobject_put+0x74/0xe8
+ kobject_del.part.0+0x3c/0x50
+ kobject_put+0x60/0xe8
+ iommu_group_get_for_dev+0xa8/0x1f0
+ ipmmu_add_device+0x1c/0x40
+ of_iommu_configure+0x118/0x190
+
+Fix this by checking if the domain's context already exists, before
+trying to destroy it.
+
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Reviewed-by: Robin Murphy <robin.murphy@arm.com>
+Fixes: d25a2a16f0889 ('iommu: Add driver for Renesas VMSA-compatible IPMMU')
+Signed-off-by: Joerg Roedel <jroedel@suse.de>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/iommu/ipmmu-vmsa.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c
+index 7dab5cbcc775..47e8db51288b 100644
+--- a/drivers/iommu/ipmmu-vmsa.c
++++ b/drivers/iommu/ipmmu-vmsa.c
+@@ -383,6 +383,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain)
+
+ static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain)
+ {
++ if (!domain->mmu)
++ return;
++
+ /*
+ * Disable the context. Flush the TLB as required when modifying the
+ * context registers.
+--
+2.19.1
+
--- /dev/null
+From d7793798d572e1f2d15512d49164935e109c2973 Mon Sep 17 00:00:00 2001
+From: Yangtao Li <tiny.windzz@gmail.com>
+Date: Thu, 22 Nov 2018 07:34:41 -0500
+Subject: net: amd: add missing of_node_put()
+
+[ Upstream commit c44c749d3b6fdfca39002e7e48e03fe9f9fe37a3 ]
+
+of_find_node_by_path() acquires a reference to the node
+returned by it and that reference needs to be dropped by its caller.
+This place doesn't do that, so fix it.
+
+Signed-off-by: Yangtao Li <tiny.windzz@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/amd/sunlance.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c
+index 5e4273b7aa27..2bac37b9b4d3 100644
+--- a/drivers/net/ethernet/amd/sunlance.c
++++ b/drivers/net/ethernet/amd/sunlance.c
+@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op,
+
+ prop = of_get_property(nd, "tpe-link-test?", NULL);
+ if (!prop)
+- goto no_link_test;
++ goto node_put;
+
+ if (strcmp(prop, "true")) {
+ printk(KERN_NOTICE "SunLance: warning: overriding option "
+@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op,
+ "to ecd@skynet.be\n");
+ auxio_set_lte(AUXIO_LTE_ON);
+ }
++node_put:
++ of_node_put(nd);
+ no_link_test:
+ lp->auto_select = 1;
+ lp->tpe = 0;
+--
+2.19.1
+
--- /dev/null
+From 471d0d01f33b08a9aa3e6db54c8d172b8bcff7b3 Mon Sep 17 00:00:00 2001
+From: Vincent Chen <vincentc@andestech.com>
+Date: Wed, 21 Nov 2018 09:38:11 +0800
+Subject: net: faraday: ftmac100: remove netif_running(netdev) check before
+ disabling interrupts
+
+[ Upstream commit 426a593e641ebf0d9288f0a2fcab644a86820220 ]
+
+In the original ftmac100_interrupt(), the interrupts are only disabled when
+the condition "netif_running(netdev)" is true. However, this condition
+causes kerenl hang in the following case. When the user requests to
+disable the network device, kernel will clear the bit __LINK_STATE_START
+from the dev->state and then call the driver's ndo_stop function. Network
+device interrupts are not blocked during this process. If an interrupt
+occurs between clearing __LINK_STATE_START and stopping network device,
+kernel cannot disable the interrupts due to the condition
+"netif_running(netdev)" in the ISR. Hence, kernel will hang due to the
+continuous interruption of the network device.
+
+In order to solve the above problem, the interrupts of the network device
+should always be disabled in the ISR without being restricted by the
+condition "netif_running(netdev)".
+
+[V2]
+Remove unnecessary curly braces.
+
+Signed-off-by: Vincent Chen <vincentc@andestech.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/faraday/ftmac100.c | 7 +++----
+ 1 file changed, 3 insertions(+), 4 deletions(-)
+
+diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c
+index 4ff1adc6bfca..9a0703f2da9a 100644
+--- a/drivers/net/ethernet/faraday/ftmac100.c
++++ b/drivers/net/ethernet/faraday/ftmac100.c
+@@ -865,11 +865,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id)
+ struct net_device *netdev = dev_id;
+ struct ftmac100 *priv = netdev_priv(netdev);
+
+- if (likely(netif_running(netdev))) {
+- /* Disable interrupts for polling */
+- ftmac100_disable_all_int(priv);
++ /* Disable interrupts for polling */
++ ftmac100_disable_all_int(priv);
++ if (likely(netif_running(netdev)))
+ napi_schedule(&priv->napi);
+- }
+
+ return IRQ_HANDLED;
+ }
+--
+2.19.1
+
--- /dev/null
+From b7b517b182ddc52845a7e95ac5bf471f1fd2a1b2 Mon Sep 17 00:00:00 2001
+From: Aya Levin <ayal@mellanox.com>
+Date: Thu, 15 Nov 2018 18:05:15 +0200
+Subject: net/mlx4: Fix UBSAN warning of signed integer overflow
+
+[ Upstream commit a463146e67c848cbab5ce706d6528281b7cded08 ]
+
+UBSAN: Undefined behavior in
+drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:626:29
+signed integer overflow: 1802201963 + 1802201963 cannot be represented
+in type 'int'
+
+The union of res_reserved and res_port_rsvd[MLX4_MAX_PORTS] monitors
+granting of reserved resources. The grant operation is calculated and
+protected, thus both members of the union cannot be negative. Changed
+type of res_reserved and of res_port_rsvd[MLX4_MAX_PORTS] from signed
+int to unsigned int, allowing large value.
+
+Fixes: 5a0d0a6161ae ("mlx4: Structures and init/teardown for VF resource quotas")
+Signed-off-by: Aya Levin <ayal@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/mlx4.h | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+index de10dbb2e6ed..4f63915f14be 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h
+@@ -516,8 +516,8 @@ struct slave_list {
+ struct resource_allocator {
+ spinlock_t alloc_lock; /* protect quotas */
+ union {
+- int res_reserved;
+- int res_port_rsvd[MLX4_MAX_PORTS];
++ unsigned int res_reserved;
++ unsigned int res_port_rsvd[MLX4_MAX_PORTS];
+ };
+ union {
+ int res_free;
+--
+2.19.1
+
--- /dev/null
+From ff78bd6fd37efc57578fd0696f8176ade042a500 Mon Sep 17 00:00:00 2001
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Thu, 15 Nov 2018 18:05:13 +0200
+Subject: net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command
+
+[ Upstream commit bd85fbc2038a1bbe84990b23ff69b6fc81a32b2c ]
+
+When re-registering a user mr, the mpt information for the
+existing mr when running SRIOV is obtained via the QUERY_MPT
+fw command. The returned information includes the mpt's lkey.
+
+This retrieved mpt information is used to move the mpt back
+to hardware ownership in the rereg flow (via the SW2HW_MPT
+fw command when running SRIOV).
+
+The fw API spec states that for SW2HW_MPT, the lkey field
+must be zero. Any ConnectX-3 PF driver which checks for strict spec
+adherence will return failure for SW2HW_MPT if the lkey field is not
+zero (although the fw in practice ignores this field for SW2HW_MPT).
+
+Thus, in order to conform to the fw API spec, set the lkey field to zero
+before invoking SW2HW_MPT when running SRIOV.
+
+Fixes: e630664c8383 ("mlx4_core: Add helper functions to support MR re-registration")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/mr.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c
+index b7cdef0aebd6..47c2f7c5703d 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -372,6 +372,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr,
+ container_of((void *)mpt_entry, struct mlx4_cmd_mailbox,
+ buf);
+
++ (*mpt_entry)->lkey = 0;
+ err = mlx4_SW2HW_MPT(dev, mailbox, key);
+ }
+
+--
+2.19.1
+
--- /dev/null
+From 82282a2fc32357e3a22a100e080646f22079fbd1 Mon Sep 17 00:00:00 2001
+From: Anton Blanchard <anton@samba.org>
+Date: Sun, 25 Sep 2016 17:16:53 +1000
+Subject: powerpc/vdso64: Use double word compare on pointers
+
+[ Upstream commit 5045ea37377ce8cca6890d32b127ad6770e6dce5 ]
+
+__kernel_get_syscall_map() and __kernel_clock_getres() use cmpli to
+check if the passed in pointer is non zero. cmpli maps to a 32 bit
+compare on binutils, so we ignore the top 32 bits.
+
+A simple test case can be created by passing in a bogus pointer with
+the bottom 32 bits clear. Using a clk_id that is handled by the VDSO,
+then one that is handled by the kernel shows the problem:
+
+ printf("%d\n", clock_getres(CLOCK_REALTIME, (void *)0x100000000));
+ printf("%d\n", clock_getres(CLOCK_BOOTTIME, (void *)0x100000000));
+
+And we get:
+
+ 0
+ -1
+
+The bigger issue is if we pass a valid pointer with the bottom 32 bits
+clear, in this case we will return success but won't write any data
+to the pointer.
+
+I stumbled across this issue because the LLVM integrated assembler
+doesn't accept cmpli with 3 arguments. Fix this by converting them to
+cmpldi.
+
+Fixes: a7f290dad32e ("[PATCH] powerpc: Merge vdso's and add vdso support to 32 bits kernel")
+Cc: stable@vger.kernel.org # v2.6.15+
+Signed-off-by: Anton Blanchard <anton@samba.org>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ arch/powerpc/kernel/vdso64/datapage.S | 2 +-
+ arch/powerpc/kernel/vdso64/gettimeofday.S | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S
+index 79796de11737..3263ee23170d 100644
+--- a/arch/powerpc/kernel/vdso64/datapage.S
++++ b/arch/powerpc/kernel/vdso64/datapage.S
+@@ -57,7 +57,7 @@ V_FUNCTION_BEGIN(__kernel_get_syscall_map)
+ bl V_LOCAL_FUNC(__get_datapage)
+ mtlr r12
+ addi r3,r3,CFG_SYSCALL_MAP64
+- cmpli cr0,r4,0
++ cmpldi cr0,r4,0
+ crclr cr0*4+so
+ beqlr
+ li r0,__NR_syscalls
+diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S
+index a76b4af37ef2..382021324883 100644
+--- a/arch/powerpc/kernel/vdso64/gettimeofday.S
++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S
+@@ -145,7 +145,7 @@ V_FUNCTION_BEGIN(__kernel_clock_getres)
+ bne cr0,99f
+
+ li r3,0
+- cmpli cr0,r4,0
++ cmpldi cr0,r4,0
+ crclr cr0*4+so
+ beqlr
+ lis r5,CLOCK_REALTIME_RES@h
+--
+2.19.1
+
input-xpad-quirk-all-pdp-xbox-one-gamepads.patch
mm-cleancache-fix-corruption-on-missed-inode-invalidation.patch
usb-gadget-dummy-fix-nonsensical-comparisons.patch
+iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch
+can-rcar_can-fix-erroneous-registration.patch
+net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch
+net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch
+net-faraday-ftmac100-remove-netif_running-netdev-che.patch
+net-amd-add-missing-of_node_put.patch
+powerpc-vdso64-use-double-word-compare-on-pointers.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
