--- /dev/null
+From 9c86b846ce02f7e35d7234cf090b80553eba5389 Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jonas.gorski@gmail.com>
+Date: Sun, 1 Oct 2017 13:02:15 +0200
+Subject: bcm63xx_enet: correct clock usage
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+commit 9c86b846ce02f7e35d7234cf090b80553eba5389 upstream.
+
+Check the return code of prepare_enable and change one last instance of
+enable only to prepare_enable. Also properly disable and release the
+clock in error paths and on remove for enetsw.
+
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/bcm63xx_enet.c | 31 ++++++++++++++++++++-------
+ 1 file changed, 23 insertions(+), 8 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+@@ -1787,7 +1787,9 @@ static int bcm_enet_probe(struct platfor
+ ret = PTR_ERR(priv->mac_clk);
+ goto out;
+ }
+- clk_prepare_enable(priv->mac_clk);
++ ret = clk_prepare_enable(priv->mac_clk);
++ if (ret)
++ goto out_put_clk_mac;
+
+ /* initialize default and fetch platform data */
+ priv->rx_ring_size = BCMENET_DEF_RX_DESC;
+@@ -1819,9 +1821,11 @@ static int bcm_enet_probe(struct platfor
+ if (IS_ERR(priv->phy_clk)) {
+ ret = PTR_ERR(priv->phy_clk);
+ priv->phy_clk = NULL;
+- goto out_put_clk_mac;
++ goto out_disable_clk_mac;
+ }
+- clk_prepare_enable(priv->phy_clk);
++ ret = clk_prepare_enable(priv->phy_clk);
++ if (ret)
++ goto out_put_clk_phy;
+ }
+
+ /* do minimal hardware init to be able to probe mii bus */
+@@ -1921,13 +1925,16 @@ out_free_mdio:
+ out_uninit_hw:
+ /* turn off mdc clock */
+ enet_writel(priv, 0, ENET_MIISC_REG);
+- if (priv->phy_clk) {
++ if (priv->phy_clk)
+ clk_disable_unprepare(priv->phy_clk);
++
++out_put_clk_phy:
++ if (priv->phy_clk)
+ clk_put(priv->phy_clk);
+- }
+
+-out_put_clk_mac:
++out_disable_clk_mac:
+ clk_disable_unprepare(priv->mac_clk);
++out_put_clk_mac:
+ clk_put(priv->mac_clk);
+ out:
+ free_netdev(dev);
+@@ -2772,7 +2779,9 @@ static int bcm_enetsw_probe(struct platf
+ ret = PTR_ERR(priv->mac_clk);
+ goto out_unmap;
+ }
+- clk_enable(priv->mac_clk);
++ ret = clk_prepare_enable(priv->mac_clk);
++ if (ret)
++ goto out_put_clk;
+
+ priv->rx_chan = 0;
+ priv->tx_chan = 1;
+@@ -2793,7 +2802,7 @@ static int bcm_enetsw_probe(struct platf
+
+ ret = register_netdev(dev);
+ if (ret)
+- goto out_put_clk;
++ goto out_disable_clk;
+
+ netif_carrier_off(dev);
+ platform_set_drvdata(pdev, dev);
+@@ -2802,6 +2811,9 @@ static int bcm_enetsw_probe(struct platf
+
+ return 0;
+
++out_disable_clk:
++ clk_disable_unprepare(priv->mac_clk);
++
+ out_put_clk:
+ clk_put(priv->mac_clk);
+
+@@ -2833,6 +2845,9 @@ static int bcm_enetsw_remove(struct plat
+ res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+ release_mem_region(res->start, resource_size(res));
+
++ clk_disable_unprepare(priv->mac_clk);
++ clk_put(priv->mac_clk);
++
+ free_netdev(dev);
+ return 0;
+ }
--- /dev/null
+From d6213c1f2ad54a964b77471690264ed685718928 Mon Sep 17 00:00:00 2001
+From: Jonas Gorski <jonas.gorski@gmail.com>
+Date: Sun, 1 Oct 2017 13:02:16 +0200
+Subject: bcm63xx_enet: do not write to random DMA channel on BCM6345
+
+From: Jonas Gorski <jonas.gorski@gmail.com>
+
+commit d6213c1f2ad54a964b77471690264ed685718928 upstream.
+
+The DMA controller regs actually point to DMA channel 0, so the write to
+ENETDMA_CFG_REG will actually modify a random DMA channel.
+
+Since DMA controller registers do not exist on BCM6345, guard the write
+with the usual check for dma_has_sram.
+
+Signed-off-by: Jonas Gorski <jonas.gorski@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/bcm63xx_enet.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bcm63xx_enet.c
++++ b/drivers/net/ethernet/broadcom/bcm63xx_enet.c
+@@ -1063,7 +1063,8 @@ static int bcm_enet_open(struct net_devi
+ val = enet_readl(priv, ENET_CTL_REG);
+ val |= ENET_CTL_ENABLE_MASK;
+ enet_writel(priv, val, ENET_CTL_REG);
+- enet_dma_writel(priv, ENETDMA_CFG_EN_MASK, ENETDMA_CFG_REG);
++ if (priv->dma_has_sram)
++ enet_dma_writel(priv, ENETDMA_CFG_EN_MASK, ENETDMA_CFG_REG);
+ enet_dmac_writel(priv, priv->dma_chan_en_mask,
+ ENETDMAC_CHANCFG, priv->rx_chan);
+
--- /dev/null
+From 5d59ad6eea82ef8df92b4109615a0dde9d8093e9 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Fri, 25 Aug 2017 15:47:24 +0200
+Subject: crypto: crypto4xx - fix crypto4xx_build_pdr, crypto4xx_build_sdr leak
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit 5d59ad6eea82ef8df92b4109615a0dde9d8093e9 upstream.
+
+If one of the later memory allocations in rypto4xx_build_pdr()
+fails: dev->pdr (and/or) dev->pdr_uinfo wouldn't be freed.
+
+crypto4xx_build_sdr() has the same issue with dev->sdr.
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/amcc/crypto4xx_core.c | 17 +++++++++--------
+ 1 file changed, 9 insertions(+), 8 deletions(-)
+
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -207,7 +207,7 @@ static u32 crypto4xx_build_pdr(struct cr
+ dev->pdr_pa);
+ return -ENOMEM;
+ }
+- memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD);
++ memset(dev->pdr, 0, sizeof(struct ce_pd) * PPC4XX_NUM_PD);
+ dev->shadow_sa_pool = dma_alloc_coherent(dev->core_dev->device,
+ 256 * PPC4XX_NUM_PD,
+ &dev->shadow_sa_pool_pa,
+@@ -240,13 +240,15 @@ static u32 crypto4xx_build_pdr(struct cr
+
+ static void crypto4xx_destroy_pdr(struct crypto4xx_device *dev)
+ {
+- if (dev->pdr != NULL)
++ if (dev->pdr)
+ dma_free_coherent(dev->core_dev->device,
+ sizeof(struct ce_pd) * PPC4XX_NUM_PD,
+ dev->pdr, dev->pdr_pa);
++
+ if (dev->shadow_sa_pool)
+ dma_free_coherent(dev->core_dev->device, 256 * PPC4XX_NUM_PD,
+ dev->shadow_sa_pool, dev->shadow_sa_pool_pa);
++
+ if (dev->shadow_sr_pool)
+ dma_free_coherent(dev->core_dev->device,
+ sizeof(struct sa_state_record) * PPC4XX_NUM_PD,
+@@ -416,12 +418,12 @@ static u32 crypto4xx_build_sdr(struct cr
+
+ static void crypto4xx_destroy_sdr(struct crypto4xx_device *dev)
+ {
+- if (dev->sdr != NULL)
++ if (dev->sdr)
+ dma_free_coherent(dev->core_dev->device,
+ sizeof(struct ce_sd) * PPC4XX_NUM_SD,
+ dev->sdr, dev->sdr_pa);
+
+- if (dev->scatter_buffer_va != NULL)
++ if (dev->scatter_buffer_va)
+ dma_free_coherent(dev->core_dev->device,
+ dev->scatter_buffer_size * PPC4XX_NUM_SD,
+ dev->scatter_buffer_va,
+@@ -1186,7 +1188,7 @@ static int crypto4xx_probe(struct platfo
+
+ rc = crypto4xx_build_gdr(core_dev->dev);
+ if (rc)
+- goto err_build_gdr;
++ goto err_build_pdr;
+
+ rc = crypto4xx_build_sdr(core_dev->dev);
+ if (rc)
+@@ -1228,12 +1230,11 @@ err_iomap:
+ err_request_irq:
+ irq_dispose_mapping(core_dev->irq);
+ tasklet_kill(&core_dev->tasklet);
+- crypto4xx_destroy_sdr(core_dev->dev);
+ err_build_sdr:
++ crypto4xx_destroy_sdr(core_dev->dev);
+ crypto4xx_destroy_gdr(core_dev->dev);
+-err_build_gdr:
+- crypto4xx_destroy_pdr(core_dev->dev);
+ err_build_pdr:
++ crypto4xx_destroy_pdr(core_dev->dev);
+ kfree(core_dev->dev);
+ err_alloc_dev:
+ kfree(core_dev);
--- /dev/null
+From a728a196d253530f17da5c86dc7dfbe58c5f7094 Mon Sep 17 00:00:00 2001
+From: Christian Lamparter <chunkeey@googlemail.com>
+Date: Fri, 25 Aug 2017 15:47:14 +0200
+Subject: crypto: crypto4xx - remove bad list_del
+
+From: Christian Lamparter <chunkeey@googlemail.com>
+
+commit a728a196d253530f17da5c86dc7dfbe58c5f7094 upstream.
+
+alg entries are only added to the list, after the registration
+was successful. If the registration failed, it was never added
+to the list in the first place.
+
+Signed-off-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/amcc/crypto4xx_core.c | 6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -1029,12 +1029,10 @@ int crypto4xx_register_alg(struct crypto
+ break;
+ }
+
+- if (rc) {
+- list_del(&alg->entry);
++ if (rc)
+ kfree(alg);
+- } else {
++ else
+ list_add_tail(&alg->entry, &sec_dev->alg_list);
+- }
+ }
+
+ return 0;
--- /dev/null
+From 853bc26a7ea39e354b9f8889ae7ad1492ffa28d2 Mon Sep 17 00:00:00 2001
+From: alex chen <alex.chen@huawei.com>
+Date: Wed, 15 Nov 2017 17:31:48 -0800
+Subject: ocfs2: subsystem.su_mutex is required while accessing the item->ci_parent
+
+From: alex chen <alex.chen@huawei.com>
+
+commit 853bc26a7ea39e354b9f8889ae7ad1492ffa28d2 upstream.
+
+The subsystem.su_mutex is required while accessing the item->ci_parent,
+otherwise, NULL pointer dereference to the item->ci_parent will be
+triggered in the following situation:
+
+add node delete node
+sys_write
+ vfs_write
+ configfs_write_file
+ o2nm_node_store
+ o2nm_node_local_write
+ do_rmdir
+ vfs_rmdir
+ configfs_rmdir
+ mutex_lock(&subsys->su_mutex);
+ unlink_obj
+ item->ci_group = NULL;
+ item->ci_parent = NULL;
+ to_o2nm_cluster_from_node
+ node->nd_item.ci_parent->ci_parent
+ BUG since of NULL pointer dereference to nd_item.ci_parent
+
+Moreover, the o2nm_cluster also should be protected by the
+subsystem.su_mutex.
+
+[alex.chen@huawei.com: v2]
+ Link: http://lkml.kernel.org/r/59EEAA69.9080703@huawei.com
+Link: http://lkml.kernel.org/r/59E9B36A.10700@huawei.com
+Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Jun Piao <piaojun@huawei.com>
+Reviewed-by: Joseph Qi <jiangqi903@gmail.com>
+Cc: Mark Fasheh <mfasheh@versity.com>
+Cc: Joel Becker <jlbec@evilplan.org>
+Cc: Junxiao Bi <junxiao.bi@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Salvatore Bonaccorso <carnil@debian.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/ocfs2/cluster/nodemanager.c | 63 +++++++++++++++++++++++++++++++++++------
+ 1 file changed, 55 insertions(+), 8 deletions(-)
+
+--- a/fs/ocfs2/cluster/nodemanager.c
++++ b/fs/ocfs2/cluster/nodemanager.c
+@@ -40,6 +40,9 @@ char *o2nm_fence_method_desc[O2NM_FENCE_
+ "panic", /* O2NM_FENCE_PANIC */
+ };
+
++static inline void o2nm_lock_subsystem(void);
++static inline void o2nm_unlock_subsystem(void);
++
+ struct o2nm_node *o2nm_get_node_by_num(u8 node_num)
+ {
+ struct o2nm_node *node = NULL;
+@@ -181,7 +184,10 @@ static struct o2nm_cluster *to_o2nm_clus
+ {
+ /* through the first node_set .parent
+ * mycluster/nodes/mynode == o2nm_cluster->o2nm_node_group->o2nm_node */
+- return to_o2nm_cluster(node->nd_item.ci_parent->ci_parent);
++ if (node->nd_item.ci_parent)
++ return to_o2nm_cluster(node->nd_item.ci_parent->ci_parent);
++ else
++ return NULL;
+ }
+
+ enum {
+@@ -194,7 +200,7 @@ static ssize_t o2nm_node_num_store(struc
+ size_t count)
+ {
+ struct o2nm_node *node = to_o2nm_node(item);
+- struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node);
++ struct o2nm_cluster *cluster;
+ unsigned long tmp;
+ char *p = (char *)page;
+ int ret = 0;
+@@ -214,6 +220,13 @@ static ssize_t o2nm_node_num_store(struc
+ !test_bit(O2NM_NODE_ATTR_PORT, &node->nd_set_attributes))
+ return -EINVAL; /* XXX */
+
++ o2nm_lock_subsystem();
++ cluster = to_o2nm_cluster_from_node(node);
++ if (!cluster) {
++ o2nm_unlock_subsystem();
++ return -EINVAL;
++ }
++
+ write_lock(&cluster->cl_nodes_lock);
+ if (cluster->cl_nodes[tmp])
+ ret = -EEXIST;
+@@ -226,6 +239,8 @@ static ssize_t o2nm_node_num_store(struc
+ set_bit(tmp, cluster->cl_nodes_bitmap);
+ }
+ write_unlock(&cluster->cl_nodes_lock);
++ o2nm_unlock_subsystem();
++
+ if (ret)
+ return ret;
+
+@@ -269,7 +284,7 @@ static ssize_t o2nm_node_ipv4_address_st
+ size_t count)
+ {
+ struct o2nm_node *node = to_o2nm_node(item);
+- struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node);
++ struct o2nm_cluster *cluster;
+ int ret, i;
+ struct rb_node **p, *parent;
+ unsigned int octets[4];
+@@ -286,6 +301,13 @@ static ssize_t o2nm_node_ipv4_address_st
+ be32_add_cpu(&ipv4_addr, octets[i] << (i * 8));
+ }
+
++ o2nm_lock_subsystem();
++ cluster = to_o2nm_cluster_from_node(node);
++ if (!cluster) {
++ o2nm_unlock_subsystem();
++ return -EINVAL;
++ }
++
+ ret = 0;
+ write_lock(&cluster->cl_nodes_lock);
+ if (o2nm_node_ip_tree_lookup(cluster, ipv4_addr, &p, &parent))
+@@ -298,6 +320,8 @@ static ssize_t o2nm_node_ipv4_address_st
+ rb_insert_color(&node->nd_ip_node, &cluster->cl_node_ip_tree);
+ }
+ write_unlock(&cluster->cl_nodes_lock);
++ o2nm_unlock_subsystem();
++
+ if (ret)
+ return ret;
+
+@@ -315,7 +339,7 @@ static ssize_t o2nm_node_local_store(str
+ size_t count)
+ {
+ struct o2nm_node *node = to_o2nm_node(item);
+- struct o2nm_cluster *cluster = to_o2nm_cluster_from_node(node);
++ struct o2nm_cluster *cluster;
+ unsigned long tmp;
+ char *p = (char *)page;
+ ssize_t ret;
+@@ -333,17 +357,26 @@ static ssize_t o2nm_node_local_store(str
+ !test_bit(O2NM_NODE_ATTR_PORT, &node->nd_set_attributes))
+ return -EINVAL; /* XXX */
+
++ o2nm_lock_subsystem();
++ cluster = to_o2nm_cluster_from_node(node);
++ if (!cluster) {
++ ret = -EINVAL;
++ goto out;
++ }
++
+ /* the only failure case is trying to set a new local node
+ * when a different one is already set */
+ if (tmp && tmp == cluster->cl_has_local &&
+- cluster->cl_local_node != node->nd_num)
+- return -EBUSY;
++ cluster->cl_local_node != node->nd_num) {
++ ret = -EBUSY;
++ goto out;
++ }
+
+ /* bring up the rx thread if we're setting the new local node. */
+ if (tmp && !cluster->cl_has_local) {
+ ret = o2net_start_listening(node);
+ if (ret)
+- return ret;
++ goto out;
+ }
+
+ if (!tmp && cluster->cl_has_local &&
+@@ -358,7 +391,11 @@ static ssize_t o2nm_node_local_store(str
+ cluster->cl_local_node = node->nd_num;
+ }
+
+- return count;
++ ret = count;
++
++out:
++ o2nm_unlock_subsystem();
++ return ret;
+ }
+
+ CONFIGFS_ATTR(o2nm_node_, num);
+@@ -750,6 +787,16 @@ static struct o2nm_cluster_group o2nm_cl
+ },
+ };
+
++static inline void o2nm_lock_subsystem(void)
++{
++ mutex_lock(&o2nm_cluster_group.cs_subsys.su_mutex);
++}
++
++static inline void o2nm_unlock_subsystem(void)
++{
++ mutex_unlock(&o2nm_cluster_group.cs_subsys.su_mutex);
++}
++
+ int o2nm_depend_item(struct config_item *item)
+ {
+ return configfs_depend_item(&o2nm_cluster_group.cs_subsys, item);
--- /dev/null
+From f4eb17e1efe538d4da7d574bedb00a8dafcc26b7 Mon Sep 17 00:00:00 2001
+From: "David S. Miller" <davem@davemloft.net>
+Date: Tue, 6 Jun 2017 11:34:06 -0400
+Subject: Revert "sit: reload iphdr in ipip6_rcv"
+
+From: David S. Miller <davem@davemloft.net>
+
+commit f4eb17e1efe538d4da7d574bedb00a8dafcc26b7 upstream.
+
+This reverts commit b699d0035836f6712917a41e7ae58d84359b8ff9.
+
+As per Eric Dumazet, the pskb_may_pull() is a NOP in this
+particular case, so the 'iph' reload is unnecessary.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: Dmitry Tunin <hanipouspilot@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/sit.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -692,7 +692,6 @@ static int ipip6_rcv(struct sk_buff *skb
+
+ if (iptunnel_pull_header(skb, 0, htons(ETH_P_IPV6)))
+ goto out;
+- iph = ip_hdr(skb);
+
+ err = IP_ECN_decapsulate(iph, skb);
+ if (unlikely(err)) {
compiler-clang-always-inline-when-config_optimize_inlining-is-disabled.patch
compiler-gcc.h-add-__attribute__-gnu_inline-to-all-inline-declarations.patch
x86-asm-add-_asm_arg-constants-for-argument-registers-to-asm-asm.h.patch
+revert-sit-reload-iphdr-in-ipip6_rcv.patch
+ocfs2-subsystem.su_mutex-is-required-while-accessing-the-item-ci_parent.patch
+bcm63xx_enet-correct-clock-usage.patch
+bcm63xx_enet-do-not-write-to-random-dma-channel-on-bcm6345.patch
+crypto-crypto4xx-remove-bad-list_del.patch
+crypto-crypto4xx-fix-crypto4xx_build_pdr-crypto4xx_build_sdr-leak.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
