From: Sasha Levin Date: Sat, 8 Dec 2018 15:08:10 +0000 (-0500) Subject: patches for 3.18 X-Git-Tag: v4.19.9~32 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=386cd1120b0254298b58476421160699e2e7d72b;p=thirdparty%2Fkernel%2Fstable-queue.git patches for 3.18 Signed-off-by: Sasha Levin --- diff --git a/queue-3.18/can-rcar_can-fix-erroneous-registration.patch b/queue-3.18/can-rcar_can-fix-erroneous-registration.patch new file mode 100644 index 00000000000..dd3b482515e --- /dev/null +++ b/queue-3.18/can-rcar_can-fix-erroneous-registration.patch @@ -0,0 +1,47 @@ +From 6818eb5230cc6e02e3ca2aaf994a031fe2474148 Mon Sep 17 00:00:00 2001 +From: Fabrizio Castro +Date: Mon, 10 Sep 2018 11:43:13 +0100 +Subject: can: rcar_can: Fix erroneous registration + +[ Upstream commit 68c8d209cd4337da4fa04c672f0b62bb735969bc ] + +Assigning 2 to "renesas,can-clock-select" tricks the driver into +registering the CAN interface, even though we don't want that. +This patch improves one of the checks to prevent that from happening. + +Fixes: 862e2b6af9413b43 ("can: rcar_can: support all input clocks") +Signed-off-by: Fabrizio Castro +Signed-off-by: Chris Paterson +Reviewed-by: Simon Horman +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar_can.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c +index 9718248e55f1..16144e7d0c8f 100644 +--- a/drivers/net/can/rcar_can.c ++++ b/drivers/net/can/rcar_can.c +@@ -24,6 +24,9 @@ + + #define RCAR_CAN_DRV_NAME "rcar_can" + ++#define RCAR_SUPPORTED_CLOCKS (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \ ++ BIT(CLKR_CLKEXT)) ++ + /* Mailbox configuration: + * mailbox 60 - 63 - Rx FIFO mailboxes + * mailbox 56 - 59 - Tx FIFO mailboxes +@@ -785,7 +788,7 @@ static int rcar_can_probe(struct platform_device *pdev) + goto fail_clk; + } + +- if (clock_select >= ARRAY_SIZE(clock_names)) { ++ if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) { + err = -EINVAL; + dev_err(&pdev->dev, "invalid CAN clock selected\n"); + goto fail_clk; +-- +2.19.1 + diff --git a/queue-3.18/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch b/queue-3.18/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch new file mode 100644 index 00000000000..d2290bce076 --- /dev/null +++ b/queue-3.18/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch @@ -0,0 +1,55 @@ +From e69583db4235e7d3126267622b178bfacbddbe97 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 7 Nov 2018 14:18:50 +0100 +Subject: iommu/ipmmu-vmsa: Fix crash on early domain free + +[ Upstream commit e5b78f2e349eef5d4fca5dc1cf5a3b4b2cc27abd ] + +If iommu_ops.add_device() fails, iommu_ops.domain_free() is still +called, leading to a crash, as the domain was only partially +initialized: + + ipmmu-vmsa e67b0000.mmu: Cannot accommodate DMA translation for IOMMU page tables + sata_rcar ee300000.sata: Unable to initialize IPMMU context + iommu: Failed to add device ee300000.sata to group 0: -22 + Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 + ... + Call trace: + ipmmu_domain_free+0x1c/0xa0 + iommu_group_release+0x48/0x68 + kobject_put+0x74/0xe8 + kobject_del.part.0+0x3c/0x50 + kobject_put+0x60/0xe8 + iommu_group_get_for_dev+0xa8/0x1f0 + ipmmu_add_device+0x1c/0x40 + of_iommu_configure+0x118/0x190 + +Fix this by checking if the domain's context already exists, before +trying to destroy it. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Robin Murphy +Fixes: d25a2a16f0889 ('iommu: Add driver for Renesas VMSA-compatible IPMMU') +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/ipmmu-vmsa.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 7dab5cbcc775..47e8db51288b 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -383,6 +383,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain) + + static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain) + { ++ if (!domain->mmu) ++ return; ++ + /* + * Disable the context. Flush the TLB as required when modifying the + * context registers. +-- +2.19.1 + diff --git a/queue-3.18/net-amd-add-missing-of_node_put.patch b/queue-3.18/net-amd-add-missing-of_node_put.patch new file mode 100644 index 00000000000..e8688d2662d --- /dev/null +++ b/queue-3.18/net-amd-add-missing-of_node_put.patch @@ -0,0 +1,43 @@ +From d7793798d572e1f2d15512d49164935e109c2973 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Thu, 22 Nov 2018 07:34:41 -0500 +Subject: net: amd: add missing of_node_put() + +[ Upstream commit c44c749d3b6fdfca39002e7e48e03fe9f9fe37a3 ] + +of_find_node_by_path() acquires a reference to the node +returned by it and that reference needs to be dropped by its caller. +This place doesn't do that, so fix it. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/sunlance.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c +index 5e4273b7aa27..2bac37b9b4d3 100644 +--- a/drivers/net/ethernet/amd/sunlance.c ++++ b/drivers/net/ethernet/amd/sunlance.c +@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op, + + prop = of_get_property(nd, "tpe-link-test?", NULL); + if (!prop) +- goto no_link_test; ++ goto node_put; + + if (strcmp(prop, "true")) { + printk(KERN_NOTICE "SunLance: warning: overriding option " +@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op, + "to ecd@skynet.be\n"); + auxio_set_lte(AUXIO_LTE_ON); + } ++node_put: ++ of_node_put(nd); + no_link_test: + lp->auto_select = 1; + lp->tpe = 0; +-- +2.19.1 + diff --git a/queue-3.18/net-faraday-ftmac100-remove-netif_running-netdev-che.patch b/queue-3.18/net-faraday-ftmac100-remove-netif_running-netdev-che.patch new file mode 100644 index 00000000000..fac251eab3b --- /dev/null +++ b/queue-3.18/net-faraday-ftmac100-remove-netif_running-netdev-che.patch @@ -0,0 +1,55 @@ +From 471d0d01f33b08a9aa3e6db54c8d172b8bcff7b3 Mon Sep 17 00:00:00 2001 +From: Vincent Chen +Date: Wed, 21 Nov 2018 09:38:11 +0800 +Subject: net: faraday: ftmac100: remove netif_running(netdev) check before + disabling interrupts + +[ Upstream commit 426a593e641ebf0d9288f0a2fcab644a86820220 ] + +In the original ftmac100_interrupt(), the interrupts are only disabled when +the condition "netif_running(netdev)" is true. However, this condition +causes kerenl hang in the following case. When the user requests to +disable the network device, kernel will clear the bit __LINK_STATE_START +from the dev->state and then call the driver's ndo_stop function. Network +device interrupts are not blocked during this process. If an interrupt +occurs between clearing __LINK_STATE_START and stopping network device, +kernel cannot disable the interrupts due to the condition +"netif_running(netdev)" in the ISR. Hence, kernel will hang due to the +continuous interruption of the network device. + +In order to solve the above problem, the interrupts of the network device +should always be disabled in the ISR without being restricted by the +condition "netif_running(netdev)". + +[V2] +Remove unnecessary curly braces. + +Signed-off-by: Vincent Chen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftmac100.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c +index 4ff1adc6bfca..9a0703f2da9a 100644 +--- a/drivers/net/ethernet/faraday/ftmac100.c ++++ b/drivers/net/ethernet/faraday/ftmac100.c +@@ -865,11 +865,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id) + struct net_device *netdev = dev_id; + struct ftmac100 *priv = netdev_priv(netdev); + +- if (likely(netif_running(netdev))) { +- /* Disable interrupts for polling */ +- ftmac100_disable_all_int(priv); ++ /* Disable interrupts for polling */ ++ ftmac100_disable_all_int(priv); ++ if (likely(netif_running(netdev))) + napi_schedule(&priv->napi); +- } + + return IRQ_HANDLED; + } +-- +2.19.1 + diff --git a/queue-3.18/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch b/queue-3.18/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch new file mode 100644 index 00000000000..48f226da289 --- /dev/null +++ b/queue-3.18/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch @@ -0,0 +1,45 @@ +From b7b517b182ddc52845a7e95ac5bf471f1fd2a1b2 Mon Sep 17 00:00:00 2001 +From: Aya Levin +Date: Thu, 15 Nov 2018 18:05:15 +0200 +Subject: net/mlx4: Fix UBSAN warning of signed integer overflow + +[ Upstream commit a463146e67c848cbab5ce706d6528281b7cded08 ] + +UBSAN: Undefined behavior in +drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:626:29 +signed integer overflow: 1802201963 + 1802201963 cannot be represented +in type 'int' + +The union of res_reserved and res_port_rsvd[MLX4_MAX_PORTS] monitors +granting of reserved resources. The grant operation is calculated and +protected, thus both members of the union cannot be negative. Changed +type of res_reserved and of res_port_rsvd[MLX4_MAX_PORTS] from signed +int to unsigned int, allowing large value. + +Fixes: 5a0d0a6161ae ("mlx4: Structures and init/teardown for VF resource quotas") +Signed-off-by: Aya Levin +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/mlx4.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +index de10dbb2e6ed..4f63915f14be 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +@@ -516,8 +516,8 @@ struct slave_list { + struct resource_allocator { + spinlock_t alloc_lock; /* protect quotas */ + union { +- int res_reserved; +- int res_port_rsvd[MLX4_MAX_PORTS]; ++ unsigned int res_reserved; ++ unsigned int res_port_rsvd[MLX4_MAX_PORTS]; + }; + union { + int res_free; +-- +2.19.1 + diff --git a/queue-3.18/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch b/queue-3.18/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch new file mode 100644 index 00000000000..2001dea737e --- /dev/null +++ b/queue-3.18/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch @@ -0,0 +1,47 @@ +From ff78bd6fd37efc57578fd0696f8176ade042a500 Mon Sep 17 00:00:00 2001 +From: Jack Morgenstein +Date: Thu, 15 Nov 2018 18:05:13 +0200 +Subject: net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command + +[ Upstream commit bd85fbc2038a1bbe84990b23ff69b6fc81a32b2c ] + +When re-registering a user mr, the mpt information for the +existing mr when running SRIOV is obtained via the QUERY_MPT +fw command. The returned information includes the mpt's lkey. + +This retrieved mpt information is used to move the mpt back +to hardware ownership in the rereg flow (via the SW2HW_MPT +fw command when running SRIOV). + +The fw API spec states that for SW2HW_MPT, the lkey field +must be zero. Any ConnectX-3 PF driver which checks for strict spec +adherence will return failure for SW2HW_MPT if the lkey field is not +zero (although the fw in practice ignores this field for SW2HW_MPT). + +Thus, in order to conform to the fw API spec, set the lkey field to zero +before invoking SW2HW_MPT when running SRIOV. + +Fixes: e630664c8383 ("mlx4_core: Add helper functions to support MR re-registration") +Signed-off-by: Jack Morgenstein +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/mr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c +index b7cdef0aebd6..47c2f7c5703d 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mr.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c +@@ -372,6 +372,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr, + container_of((void *)mpt_entry, struct mlx4_cmd_mailbox, + buf); + ++ (*mpt_entry)->lkey = 0; + err = mlx4_SW2HW_MPT(dev, mailbox, key); + } + +-- +2.19.1 + diff --git a/queue-3.18/powerpc-vdso64-use-double-word-compare-on-pointers.patch b/queue-3.18/powerpc-vdso64-use-double-word-compare-on-pointers.patch new file mode 100644 index 00000000000..36c9bf75a46 --- /dev/null +++ b/queue-3.18/powerpc-vdso64-use-double-word-compare-on-pointers.patch @@ -0,0 +1,70 @@ +From 82282a2fc32357e3a22a100e080646f22079fbd1 Mon Sep 17 00:00:00 2001 +From: Anton Blanchard +Date: Sun, 25 Sep 2016 17:16:53 +1000 +Subject: powerpc/vdso64: Use double word compare on pointers + +[ Upstream commit 5045ea37377ce8cca6890d32b127ad6770e6dce5 ] + +__kernel_get_syscall_map() and __kernel_clock_getres() use cmpli to +check if the passed in pointer is non zero. cmpli maps to a 32 bit +compare on binutils, so we ignore the top 32 bits. + +A simple test case can be created by passing in a bogus pointer with +the bottom 32 bits clear. Using a clk_id that is handled by the VDSO, +then one that is handled by the kernel shows the problem: + + printf("%d\n", clock_getres(CLOCK_REALTIME, (void *)0x100000000)); + printf("%d\n", clock_getres(CLOCK_BOOTTIME, (void *)0x100000000)); + +And we get: + + 0 + -1 + +The bigger issue is if we pass a valid pointer with the bottom 32 bits +clear, in this case we will return success but won't write any data +to the pointer. + +I stumbled across this issue because the LLVM integrated assembler +doesn't accept cmpli with 3 arguments. Fix this by converting them to +cmpldi. + +Fixes: a7f290dad32e ("[PATCH] powerpc: Merge vdso's and add vdso support to 32 bits kernel") +Cc: stable@vger.kernel.org # v2.6.15+ +Signed-off-by: Anton Blanchard +Signed-off-by: Michael Ellerman +Signed-off-by: Sasha Levin +--- + arch/powerpc/kernel/vdso64/datapage.S | 2 +- + arch/powerpc/kernel/vdso64/gettimeofday.S | 2 +- + 2 files changed, 2 insertions(+), 2 deletions(-) + +diff --git a/arch/powerpc/kernel/vdso64/datapage.S b/arch/powerpc/kernel/vdso64/datapage.S +index 79796de11737..3263ee23170d 100644 +--- a/arch/powerpc/kernel/vdso64/datapage.S ++++ b/arch/powerpc/kernel/vdso64/datapage.S +@@ -57,7 +57,7 @@ V_FUNCTION_BEGIN(__kernel_get_syscall_map) + bl V_LOCAL_FUNC(__get_datapage) + mtlr r12 + addi r3,r3,CFG_SYSCALL_MAP64 +- cmpli cr0,r4,0 ++ cmpldi cr0,r4,0 + crclr cr0*4+so + beqlr + li r0,__NR_syscalls +diff --git a/arch/powerpc/kernel/vdso64/gettimeofday.S b/arch/powerpc/kernel/vdso64/gettimeofday.S +index a76b4af37ef2..382021324883 100644 +--- a/arch/powerpc/kernel/vdso64/gettimeofday.S ++++ b/arch/powerpc/kernel/vdso64/gettimeofday.S +@@ -145,7 +145,7 @@ V_FUNCTION_BEGIN(__kernel_clock_getres) + bne cr0,99f + + li r3,0 +- cmpli cr0,r4,0 ++ cmpldi cr0,r4,0 + crclr cr0*4+so + beqlr + lis r5,CLOCK_REALTIME_RES@h +-- +2.19.1 + diff --git a/queue-3.18/series b/queue-3.18/series index 814c542f8cc..b46ca2aa851 100644 --- a/queue-3.18/series +++ b/queue-3.18/series @@ -31,3 +31,10 @@ kgdboc-fix-warning-with-module-build.patch input-xpad-quirk-all-pdp-xbox-one-gamepads.patch mm-cleancache-fix-corruption-on-missed-inode-invalidation.patch usb-gadget-dummy-fix-nonsensical-comparisons.patch +iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch +can-rcar_can-fix-erroneous-registration.patch +net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch +net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch +net-faraday-ftmac100-remove-netif_running-netdev-che.patch +net-amd-add-missing-of_node_put.patch +powerpc-vdso64-use-double-word-compare-on-pointers.patch