From: Sasha Levin Date: Thu, 21 Feb 2019 05:43:05 +0000 (-0500) Subject: patches for 4.9 X-Git-Tag: v3.18.136~26 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=05ba98eef6000ce1215f0c18db952e0e728c7662;p=thirdparty%2Fkernel%2Fstable-queue.git patches for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch b/queue-4.9/hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch new file mode 100644 index 00000000000..7c477910d42 --- /dev/null +++ b/queue-4.9/hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch @@ -0,0 +1,37 @@ +From c10b194c3793821472004f97864760d9d2acf088 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Wed, 26 Dec 2018 11:28:24 +0000 +Subject: hwmon: (lm80) Fix missing unlock on error in set_fan_div() + +[ Upstream commit 07bd14ccc3049f9c0147a91a4227a571f981601a ] + +Add the missing unlock before return from function set_fan_div() +in the error handling case. + +Fixes: c9c63915519b ("hwmon: (lm80) fix a missing check of the status of SMBus read") +Signed-off-by: Wei Yongjun +Signed-off-by: Guenter Roeck +Signed-off-by: Sasha Levin +--- + drivers/hwmon/lm80.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/hwmon/lm80.c b/drivers/hwmon/lm80.c +index cb6606a0470d1..be60bd5bab783 100644 +--- a/drivers/hwmon/lm80.c ++++ b/drivers/hwmon/lm80.c +@@ -393,8 +393,10 @@ static ssize_t set_fan_div(struct device *dev, struct device_attribute *attr, + } + + rv = lm80_read_value(client, LM80_REG_FANDIV); +- if (rv < 0) ++ if (rv < 0) { ++ mutex_unlock(&data->update_lock); + return rv; ++ } + reg = (rv & ~(3 << (2 * (nr + 1)))) + | (data->fan_div[nr] << (2 * (nr + 1))); + lm80_write_value(client, LM80_REG_FANDIV, reg); +-- +2.19.1 + diff --git a/queue-4.9/net-fix-ipv6-prefix-route-residue.patch b/queue-4.9/net-fix-ipv6-prefix-route-residue.patch new file mode 100644 index 00000000000..7c67a02d8c5 --- /dev/null +++ b/queue-4.9/net-fix-ipv6-prefix-route-residue.patch @@ -0,0 +1,49 @@ +From 96b84557b6f63960bc6d5322fea22d02c606e1f1 Mon Sep 17 00:00:00 2001 +From: Zhiqiang Liu +Date: Mon, 11 Feb 2019 10:57:46 +0800 +Subject: net: fix IPv6 prefix route residue + +[ Upstream commit e75913c93f7cd5f338ab373c34c93a655bd309cb ] + +Follow those steps: + # ip addr add 2001:123::1/32 dev eth0 + # ip addr add 2001:123:456::2/64 dev eth0 + # ip addr del 2001:123::1/32 dev eth0 + # ip addr del 2001:123:456::2/64 dev eth0 +and then prefix route of 2001:123::1/32 will still exist. + +This is because ipv6_prefix_equal in check_cleanup_prefix_route +func does not check whether two IPv6 addresses have the same +prefix length. If the prefix of one address starts with another +shorter address prefix, even though their prefix lengths are +different, the return value of ipv6_prefix_equal is true. + +Here I add a check of whether two addresses have the same prefix +to decide whether their prefixes are equal. + +Fixes: 5b84efecb7d9 ("ipv6 addrconf: don't cleanup prefix route for IFA_F_NOPREFIXROUTE") +Signed-off-by: Zhiqiang Liu +Reported-by: Wenhao Zhang +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv6/addrconf.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 8f79f0414bc3f..4ce7f91951510 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -1074,7 +1074,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires) + list_for_each_entry(ifa, &idev->addr_list, if_list) { + if (ifa == ifp) + continue; +- if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr, ++ if (ifa->prefix_len != ifp->prefix_len || ++ !ipv6_prefix_equal(&ifa->addr, &ifp->addr, + ifp->prefix_len)) + continue; + if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE)) +-- +2.19.1 + diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..7fe92a7dfd9 --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,3 @@ +net-fix-ipv6-prefix-route-residue.patch +vsock-cope-with-memory-allocation-failure-at-socket-.patch +hwmon-lm80-fix-missing-unlock-on-error-in-set_fan_di.patch diff --git a/queue-4.9/vsock-cope-with-memory-allocation-failure-at-socket-.patch b/queue-4.9/vsock-cope-with-memory-allocation-failure-at-socket-.patch new file mode 100644 index 00000000000..b7fa3c7a5a7 --- /dev/null +++ b/queue-4.9/vsock-cope-with-memory-allocation-failure-at-socket-.patch @@ -0,0 +1,43 @@ +From 3e950c91d4b766ca21d7aa41f423fdf54f9cd85c Mon Sep 17 00:00:00 2001 +From: Paolo Abeni +Date: Thu, 7 Feb 2019 14:13:18 +0100 +Subject: vsock: cope with memory allocation failure at socket creation time + +[ Upstream commit 225d9464268599a5b4d094d02ec17808e44c7553 ] + +In the unlikely event that the kmalloc call in vmci_transport_socket_init() +fails, we end-up calling vmci_transport_destruct() with a NULL vmci_trans() +and oopsing. + +This change addresses the above explicitly checking for zero vmci_trans() +at destruction time. + +Reported-by: Xiumei Mu +Fixes: d021c344051a ("VSOCK: Introduce VM Sockets") +Signed-off-by: Paolo Abeni +Reviewed-by: Stefano Garzarella +Reviewed-by: Jorgen Hansen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/vmw_vsock/vmci_transport.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/net/vmw_vsock/vmci_transport.c b/net/vmw_vsock/vmci_transport.c +index 008f3424dcbce..102bf9194662c 100644 +--- a/net/vmw_vsock/vmci_transport.c ++++ b/net/vmw_vsock/vmci_transport.c +@@ -1656,6 +1656,10 @@ static void vmci_transport_cleanup(struct work_struct *work) + + static void vmci_transport_destruct(struct vsock_sock *vsk) + { ++ /* transport can be NULL if we hit a failure at init() time */ ++ if (!vmci_trans(vsk)) ++ return; ++ + /* Ensure that the detach callback doesn't use the sk/vsk + * we are about to destruct. + */ +-- +2.19.1 +