From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 16 Aug 2018 15:55:33 +0000 (+0200)
Subject: 3.18-stable patches
X-Git-Tag: v3.18.119~12
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=35272a83c09c4018edea22e61c0fac3ea2d259b2;p=thirdparty%2Fkernel%2Fstable-queue.git

3.18-stable patches

added patches:
	i2c-ismt-fix-wrong-device-address-when-unmap-the-data-buffer.patch
---

diff --git a/queue-3.18/i2c-ismt-fix-wrong-device-address-when-unmap-the-data-buffer.patch b/queue-3.18/i2c-ismt-fix-wrong-device-address-when-unmap-the-data-buffer.patch
new file mode 100644
index 00000000000..bb8282c1819
--- /dev/null
+++ b/queue-3.18/i2c-ismt-fix-wrong-device-address-when-unmap-the-data-buffer.patch
@@ -0,0 +1,78 @@
+From 17e83549e199d89aace7788a9f11c108671eecf5 Mon Sep 17 00:00:00 2001
+From: Liwei Song <liwei.song@windriver.com>
+Date: Tue, 13 Jun 2017 00:59:53 -0400
+Subject: i2c: ismt: fix wrong device address when unmap the data buffer
+
+From: Liwei Song <liwei.song@windriver.com>
+
+commit 17e83549e199d89aace7788a9f11c108671eecf5 upstream.
+
+Fix the following kernel bug:
+
+kernel BUG at drivers/iommu/intel-iommu.c:3260!
+invalid opcode: 0000 [#5] PREEMPT SMP
+Hardware name: Intel Corp. Harcuvar/Server, BIOS HAVLCRB0.X64.0013.D39.1608311820 08/31/2016
+task: ffff880175389950 ti: ffff880176bec000 task.ti: ffff880176bec000
+RIP: 0010:[<ffffffff8150a83b>]  [<ffffffff8150a83b>] intel_unmap+0x25b/0x260
+RSP: 0018:ffff880176bef5e8  EFLAGS: 00010296
+RAX: 0000000000000024 RBX: ffff8800773c7c88 RCX: 000000000000ce04
+RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000009
+RBP: ffff880176bef638 R08: 0000000000000010 R09: 0000000000000004
+R10: ffff880175389c78 R11: 0000000000000a4f R12: ffff8800773c7868
+R13: 00000000ffffac88 R14: ffff8800773c7818 R15: 0000000000000001
+FS:  00007fef21258700(0000) GS:ffff88017b5c0000(0000) knlGS:0000000000000000
+CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: 000000000066d6d8 CR3: 000000007118c000 CR4: 00000000003406e0
+Stack:
+ 00000000ffffac88 ffffffff8199867f ffff880176bef5f8 ffff880100000030
+ ffff880176bef668 ffff8800773c7c88 ffff880178288098 ffff8800772c0010
+ ffff8800773c7818 0000000000000001 ffff880176bef648 ffffffff8150a86e
+Call Trace:
+ [<ffffffff8199867f>] ? printk+0x46/0x48
+ [<ffffffff8150a86e>] intel_unmap_page+0xe/0x10
+ [<ffffffffa039d99b>] ismt_access+0x27b/0x8fa [i2c_ismt]
+ [<ffffffff81554420>] ? __pm_runtime_suspend+0xa0/0xa0
+ [<ffffffff815544a0>] ? pm_suspend_timer_fn+0x80/0x80
+ [<ffffffff81554420>] ? __pm_runtime_suspend+0xa0/0xa0
+ [<ffffffff815544a0>] ? pm_suspend_timer_fn+0x80/0x80
+ [<ffffffff8143dfd0>] ? pci_bus_read_dev_vendor_id+0xf0/0xf0
+ [<ffffffff8172b36c>] i2c_smbus_xfer+0xec/0x4b0
+ [<ffffffff810aa4d5>] ? vprintk_emit+0x345/0x530
+ [<ffffffffa038936b>] i2cdev_ioctl_smbus+0x12b/0x240 [i2c_dev]
+ [<ffffffff810aa829>] ? vprintk_default+0x29/0x40
+ [<ffffffffa0389b33>] i2cdev_ioctl+0x63/0x1ec [i2c_dev]
+ [<ffffffff811b04c8>] do_vfs_ioctl+0x328/0x5d0
+ [<ffffffff8119d8ec>] ? vfs_write+0x11c/0x190
+ [<ffffffff8109d449>] ? rt_up_read+0x19/0x20
+ [<ffffffff811b07f1>] SyS_ioctl+0x81/0xa0
+ [<ffffffff819a351b>] system_call_fastpath+0x16/0x6e
+
+This happen When run "i2cdetect -y 0" detect SMBus iSMT adapter.
+
+After finished I2C block read/write, when unmap the data buffer,
+a wrong device address was pass to dma_unmap_single().
+
+To fix this, give dma_unmap_single() the "dev" parameter, just like
+what dma_map_single() does, then unmap can find the right devices.
+
+Fixes: 13f35ac14cd0 ("i2c: Adding support for Intel iSMT SMBus 2.0 host controller")
+Signed-off-by: Liwei Song <liwei.song@windriver.com>
+Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-ismt.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/i2c/busses/i2c-ismt.c
++++ b/drivers/i2c/busses/i2c-ismt.c
+@@ -587,7 +587,7 @@ static int ismt_access(struct i2c_adapte
+ 
+ 	/* unmap the data buffer */
+ 	if (dma_size != 0)
+-		dma_unmap_single(&adap->dev, dma_addr, dma_size, dma_direction);
++		dma_unmap_single(dev, dma_addr, dma_size, dma_direction);
+ 
+ 	if (unlikely(!ret)) {
+ 		dev_err(dev, "completion wait timed out\n");
diff --git a/queue-3.18/series b/queue-3.18/series
index 7f96c69cc6f..40d4282d462 100644
--- a/queue-3.18/series
+++ b/queue-3.18/series
@@ -6,3 +6,4 @@ arm-dts-imx6sx-fix-irq-for-pcie-bridge.patch
 kprobes-x86-fix-p-uses-in-error-messages.patch
 alsa-info-check-for-integer-overflow-in-snd_info_entry_write.patch
 mm-slub-fix-format-mismatches-in-slab_err-callers.patch
+i2c-ismt-fix-wrong-device-address-when-unmap-the-data-buffer.patch