From: Sasha Levin Date: Sat, 23 Feb 2019 21:02:54 +0000 (-0500) Subject: patches for 4.9 X-Git-Tag: v4.9.161~38 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fe06405681216cc215760adc8ef283e650b72b9f;p=thirdparty%2Fkernel%2Fstable-queue.git patches for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/atm-he-fix-sign-extension-overflow-on-large-shift.patch b/queue-4.9/atm-he-fix-sign-extension-overflow-on-large-shift.patch new file mode 100644 index 00000000000..5a567b931b7 --- /dev/null +++ b/queue-4.9/atm-he-fix-sign-extension-overflow-on-large-shift.patch @@ -0,0 +1,38 @@ +From f2a53136e97b057bab374490631dccfeab729ca8 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Tue, 15 Jan 2019 18:03:38 +0000 +Subject: atm: he: fix sign-extension overflow on large shift + +[ Upstream commit cb12d72b27a6f41325ae23a11033cf5fedfa1b97 ] + +Shifting the 1 by exp by an int can lead to sign-extension overlow when +exp is 31 since 1 is an signed int and sign-extending this result to an +unsigned long long will set the upper 32 bits. Fix this by shifting an +unsigned long. + +Detected by cppcheck: +(warning) Shifting signed 32-bit value by 31 bits is undefined behaviour + +Signed-off-by: Colin Ian King +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/atm/he.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/atm/he.c b/drivers/atm/he.c +index 31b513a23ae0c..985a5800a6376 100644 +--- a/drivers/atm/he.c ++++ b/drivers/atm/he.c +@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev) + instead of '/ 512', use '>> 9' to prevent a call + to divdu3 on x86 platforms + */ +- rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9; ++ rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9; + + if (rate_cps < 10) + rate_cps = 10; /* 2.2.1 minimum payload rate is 10 cps */ +-- +2.19.1 + diff --git a/queue-4.9/isdn-avm-fix-string-plus-integer-warning-from-clang.patch b/queue-4.9/isdn-avm-fix-string-plus-integer-warning-from-clang.patch new file mode 100644 index 00000000000..b63ffdb08e9 --- /dev/null +++ b/queue-4.9/isdn-avm-fix-string-plus-integer-warning-from-clang.patch @@ -0,0 +1,48 @@ +From 6d4d46f8e92eaeb64c5f762fceaec6980d32332b Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 9 Jan 2019 22:41:08 -0700 +Subject: isdn: avm: Fix string plus integer warning from Clang + +[ Upstream commit 7afa81c55fca0cad589722cb4bce698b4803b0e1 ] + +A recent commit in Clang expanded the -Wstring-plus-int warning, showing +some odd behavior in this file. + +drivers/isdn/hardware/avm/b1.c:426:30: warning: adding 'int' to a string does not append to the string [-Wstring-plus-int] + cinfo->version[j] = "\0\0" + 1; + ~~~~~~~^~~ +drivers/isdn/hardware/avm/b1.c:426:30: note: use array indexing to silence this warning + cinfo->version[j] = "\0\0" + 1; + ^ + & [ ] +1 warning generated. + +This is equivalent to just "\0". Nick pointed out that it is smarter to +use "" instead of "\0" because "" is used elsewhere in the kernel and +can be deduplicated at the linking stage. + +Link: https://github.com/ClangBuiltLinux/linux/issues/309 +Suggested-by: Nick Desaulniers +Signed-off-by: Nathan Chancellor +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/hardware/avm/b1.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c +index 4d9b195547c5c..df2a10157720a 100644 +--- a/drivers/isdn/hardware/avm/b1.c ++++ b/drivers/isdn/hardware/avm/b1.c +@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo) + int i, j; + + for (j = 0; j < AVM_MAXVERSION; j++) +- cinfo->version[j] = "\0\0" + 1; ++ cinfo->version[j] = ""; + for (i = 0, j = 0; + j < AVM_MAXVERSION && i < cinfo->versionlen; + j++, i += cinfo->versionbuf[i] + 1) +-- +2.19.1 + diff --git a/queue-4.9/isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch b/queue-4.9/isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch new file mode 100644 index 00000000000..16cab9f8ad7 --- /dev/null +++ b/queue-4.9/isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch @@ -0,0 +1,67 @@ +From 0933f9ca1ccbada40fb779a2036790784332ff46 Mon Sep 17 00:00:00 2001 +From: Jia-Ju Bai +Date: Tue, 8 Jan 2019 21:04:48 +0800 +Subject: isdn: i4l: isdn_tty: Fix some concurrency double-free bugs + +[ Upstream commit 2ff33d6637393fe9348357285931811b76e1402f ] + +The functions isdn_tty_tiocmset() and isdn_tty_set_termios() may be +concurrently executed. + +isdn_tty_tiocmset + isdn_tty_modem_hup + line 719: kfree(info->dtmf_state); + line 721: kfree(info->silence_state); + line 723: kfree(info->adpcms); + line 725: kfree(info->adpcmr); + +isdn_tty_set_termios + isdn_tty_modem_hup + line 719: kfree(info->dtmf_state); + line 721: kfree(info->silence_state); + line 723: kfree(info->adpcms); + line 725: kfree(info->adpcmr); + +Thus, some concurrency double-free bugs may occur. + +These possible bugs are found by a static tool written by myself and +my manual code review. + +To fix these possible bugs, the mutex lock "modem_info_mutex" used in +isdn_tty_tiocmset() is added in isdn_tty_set_termios(). + +Signed-off-by: Jia-Ju Bai +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/isdn/i4l/isdn_tty.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c +index 63eaa0a9f8a18..d4e0d1602c80f 100644 +--- a/drivers/isdn/i4l/isdn_tty.c ++++ b/drivers/isdn/i4l/isdn_tty.c +@@ -1455,15 +1455,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios) + { + modem_info *info = (modem_info *) tty->driver_data; + ++ mutex_lock(&modem_info_mutex); + if (!old_termios) + isdn_tty_change_speed(info); + else { + if (tty->termios.c_cflag == old_termios->c_cflag && + tty->termios.c_ispeed == old_termios->c_ispeed && +- tty->termios.c_ospeed == old_termios->c_ospeed) ++ tty->termios.c_ospeed == old_termios->c_ospeed) { ++ mutex_unlock(&modem_info_mutex); + return; ++ } + isdn_tty_change_speed(info); + } ++ mutex_unlock(&modem_info_mutex); + } + + /* +-- +2.19.1 + diff --git a/queue-4.9/leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch b/queue-4.9/leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch new file mode 100644 index 00000000000..080a87a1e80 --- /dev/null +++ b/queue-4.9/leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch @@ -0,0 +1,38 @@ +From aad22c605acc33b9478d68e11acb09551fd32fce Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Tue, 25 Dec 2018 22:18:23 -0600 +Subject: leds: lp5523: fix a missing check of return value of lp55xx_read + +[ Upstream commit 248b57015f35c94d4eae2fdd8c6febf5cd703900 ] + +When lp55xx_read() fails, "status" is an uninitialized variable and thus +may contain random value; using it leads to undefined behaviors. + +The fix inserts a check for the return value of lp55xx_read: if it +fails, returns with its error code. + +Signed-off-by: Kangjie Lu +Signed-off-by: Jacek Anaszewski +Signed-off-by: Sasha Levin +--- + drivers/leds/leds-lp5523.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c +index c5b30f06218a3..44ceed7ac3c5b 100644 +--- a/drivers/leds/leds-lp5523.c ++++ b/drivers/leds/leds-lp5523.c +@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip) + + /* Let the programs run for couple of ms and check the engine status */ + usleep_range(3000, 6000); +- lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ ret = lp55xx_read(chip, LP5523_REG_STATUS, &status); ++ if (ret) ++ return ret; + status &= LP5523_ENG_STATUS_MASK; + + if (status != LP5523_ENG_STATUS_MASK) { +-- +2.19.1 + diff --git a/queue-4.9/mfd-ab8500-core-return-zero-in-get_register_interrup.patch b/queue-4.9/mfd-ab8500-core-return-zero-in-get_register_interrup.patch new file mode 100644 index 00000000000..58c8acdc45b --- /dev/null +++ b/queue-4.9/mfd-ab8500-core-return-zero-in-get_register_interrup.patch @@ -0,0 +1,40 @@ +From de8dee377ca9b959846830004d62cd0e3cbc7bd0 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 25 Oct 2018 15:43:44 +0300 +Subject: mfd: ab8500-core: Return zero in get_register_interruptible() + +[ Upstream commit 10628e3ecf544fa2e4e24f8e112d95c37884dc98 ] + +This function is supposed to return zero on success or negative error +codes on error. Unfortunately, there is a bug so it sometimes returns +non-zero, positive numbers on success. + +I noticed this bug during review and I can't test it. It does appear +that the return is sometimes propogated back to _regmap_read() where all +non-zero returns are treated as failure so this may affect run time. + +Fixes: 47c1697508f2 ("mfd: Align ab8500 with the abx500 interface") +Signed-off-by: Dan Carpenter +Reviewed-by: Linus Walleij +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/ab8500-core.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c +index 589eebfc13df9..2f212bdc187a4 100644 +--- a/drivers/mfd/ab8500-core.c ++++ b/drivers/mfd/ab8500-core.c +@@ -257,7 +257,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank, + mutex_unlock(&ab8500->lock); + dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret); + +- return ret; ++ return (ret < 0) ? ret : 0; + } + + static int ab8500_get_register(struct device *dev, u8 bank, +-- +2.19.1 + diff --git a/queue-4.9/mfd-db8500-prcmu-fix-some-section-annotations.patch b/queue-4.9/mfd-db8500-prcmu-fix-some-section-annotations.patch new file mode 100644 index 00000000000..4e520de84fd --- /dev/null +++ b/queue-4.9/mfd-db8500-prcmu-fix-some-section-annotations.patch @@ -0,0 +1,61 @@ +From 2be8792ba4010e84e4ff20b623ad23411efaf102 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 17 Oct 2018 17:56:28 -0700 +Subject: mfd: db8500-prcmu: Fix some section annotations + +[ Upstream commit a3888f62fe66429fad3be7f2ba962e1e08c26fd6 ] + +When building the kernel with Clang, the following section mismatch +warnings appear: + +WARNING: vmlinux.o(.text+0x7239cc): Section mismatch in reference from +the function db8500_prcmu_probe() to the function +.init.text:init_prcm_registers() +The function db8500_prcmu_probe() references +the function __init init_prcm_registers(). +This is often because db8500_prcmu_probe lacks a __init +annotation or the annotation of init_prcm_registers is wrong. + +WARNING: vmlinux.o(.text+0x723e28): Section mismatch in reference from +the function db8500_prcmu_probe() to the function +.init.text:fw_project_name() +The function db8500_prcmu_probe() references +the function __init fw_project_name(). +This is often because db8500_prcmu_probe lacks a __init +annotation or the annotation of fw_project_name is wrong. + +db8500_prcmu_probe should not be marked as __init so remove the __init +annotation from fw_project_name and init_prcm_registers. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/db8500-prcmu.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c +index ca38a6a141100..26ccf3f4ade9c 100644 +--- a/drivers/mfd/db8500-prcmu.c ++++ b/drivers/mfd/db8500-prcmu.c +@@ -2588,7 +2588,7 @@ static struct irq_chip prcmu_irq_chip = { + .irq_unmask = prcmu_irq_unmask, + }; + +-static __init char *fw_project_name(u32 project) ++static char *fw_project_name(u32 project) + { + switch (project) { + case PRCMU_FW_PROJECT_U8500: +@@ -2736,7 +2736,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size) + INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work); + } + +-static void __init init_prcm_registers(void) ++static void init_prcm_registers(void) + { + u32 val; + +-- +2.19.1 + diff --git a/queue-4.9/mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch b/queue-4.9/mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch new file mode 100644 index 00000000000..cdb6b967eb5 --- /dev/null +++ b/queue-4.9/mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch @@ -0,0 +1,38 @@ +From 003fa5060979441ed0759db79fa6f2052ca33188 Mon Sep 17 00:00:00 2001 +From: Kangjie Lu +Date: Thu, 20 Dec 2018 15:12:11 -0600 +Subject: mfd: mc13xxx: Fix a missing check of a register-read failure + +[ Upstream commit 9e28989d41c0eab57ec0bb156617a8757406ff8a ] + +When mc13xxx_reg_read() fails, "old_adc0" is uninitialized and will +contain random value. Further execution uses "old_adc0" even when +mc13xxx_reg_read() fails. +The fix checks the return value of mc13xxx_reg_read(), and exits +the execution when it fails. + +Signed-off-by: Kangjie Lu +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/mc13xxx-core.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c +index d7f54e492aa61..6c16f170529f5 100644 +--- a/drivers/mfd/mc13xxx-core.c ++++ b/drivers/mfd/mc13xxx-core.c +@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode, + + mc13xxx->adcflags |= MC13XXX_ADC_WORKING; + +- mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0); ++ ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0); ++ if (ret) ++ goto out; + + adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2; + adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC; +-- +2.19.1 + diff --git a/queue-4.9/mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch b/queue-4.9/mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch new file mode 100644 index 00000000000..450627b50db --- /dev/null +++ b/queue-4.9/mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch @@ -0,0 +1,37 @@ +From 59fbf146d150fc4495b16623e99a0a98df2d58cc Mon Sep 17 00:00:00 2001 +From: Nicolas Boichat +Date: Mon, 22 Oct 2018 10:55:06 +0800 +Subject: mfd: mt6397: Do not call irq_domain_remove if PMIC unsupported + +[ Upstream commit a177276aa098aa47a100d51a13eaaef029604b6d ] + +If the PMIC ID is unknown, the current code would call +irq_domain_remove and panic, as pmic->irq_domain is only +initialized by mt6397_irq_init. + +Return immediately with an error, if the chip ID is unsupported. + +Signed-off-by: Nicolas Boichat +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/mt6397-core.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c +index e14d8b058f0c2..5d4c10f05450a 100644 +--- a/drivers/mfd/mt6397-core.c ++++ b/drivers/mfd/mt6397-core.c +@@ -306,8 +306,7 @@ static int mt6397_probe(struct platform_device *pdev) + + default: + dev_err(&pdev->dev, "unsupported chip: %d\n", id); +- ret = -ENODEV; +- break; ++ return -ENODEV; + } + + if (ret) { +-- +2.19.1 + diff --git a/queue-4.9/mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch b/queue-4.9/mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch new file mode 100644 index 00000000000..1e50fa309cb --- /dev/null +++ b/queue-4.9/mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch @@ -0,0 +1,37 @@ +From ac61111d3759cd4c68d87034be3e3176fd9d335c Mon Sep 17 00:00:00 2001 +From: Jonathan Marek +Date: Mon, 19 Nov 2018 14:53:17 -0500 +Subject: mfd: qcom_rpm: write fw_version to CTRL_REG + +[ Upstream commit 504e4175829c44328773b96ad9c538e4783a8d22 ] + +This is required as part of the initialization sequence on certain SoCs. + +If these registers are not initialized, the hardware can be unresponsive. +This fixes the driver on apq8060 (HP TouchPad device). + +Signed-off-by: Jonathan Marek +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/qcom_rpm.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c +index 52fafea06067e..8d420c37b2a61 100644 +--- a/drivers/mfd/qcom_rpm.c ++++ b/drivers/mfd/qcom_rpm.c +@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev) + return -EFAULT; + } + ++ writel(fw_version[0], RPM_CTRL_REG(rpm, 0)); ++ writel(fw_version[1], RPM_CTRL_REG(rpm, 1)); ++ writel(fw_version[2], RPM_CTRL_REG(rpm, 2)); ++ + dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0], + fw_version[1], + fw_version[2]); +-- +2.19.1 + diff --git a/queue-4.9/mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch b/queue-4.9/mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch new file mode 100644 index 00000000000..08757cd7bfa --- /dev/null +++ b/queue-4.9/mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch @@ -0,0 +1,38 @@ +From 0361cd5504a03798293447b199e1c742d720e926 Mon Sep 17 00:00:00 2001 +From: Vignesh R +Date: Mon, 3 Dec 2018 13:31:17 +0530 +Subject: mfd: ti_am335x_tscadc: Use PLATFORM_DEVID_AUTO while registering mfd + cells + +[ Upstream commit b40ee006fe6a8a25093434e5d394128c356a48f3 ] + +Use PLATFORM_DEVID_AUTO to number mfd cells while registering, so that +different instances are uniquely identified. This is required in order +to support registering of multiple instances of same ti_am335x_tscadc IP. + +Signed-off-by: Vignesh R +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/ti_am335x_tscadc.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c +index 798f0a829637f..60286adbd6a1c 100644 +--- a/drivers/mfd/ti_am335x_tscadc.c ++++ b/drivers/mfd/ti_am335x_tscadc.c +@@ -264,8 +264,9 @@ static int ti_tscadc_probe(struct platform_device *pdev) + cell->pdata_size = sizeof(tscadc); + } + +- err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells, +- tscadc->used_cells, NULL, 0, NULL); ++ err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO, ++ tscadc->cells, tscadc->used_cells, NULL, ++ 0, NULL); + if (err < 0) + goto err_disable_clk; + +-- +2.19.1 + diff --git a/queue-4.9/mfd-twl-core-fix-section-annotations-on-un-protect_p.patch b/queue-4.9/mfd-twl-core-fix-section-annotations-on-un-protect_p.patch new file mode 100644 index 00000000000..2af67105581 --- /dev/null +++ b/queue-4.9/mfd-twl-core-fix-section-annotations-on-un-protect_p.patch @@ -0,0 +1,53 @@ +From fe8adb301056f66ad48df192667f157edbffa632 Mon Sep 17 00:00:00 2001 +From: Nathan Chancellor +Date: Wed, 17 Oct 2018 10:13:23 -0700 +Subject: mfd: twl-core: Fix section annotations on {,un}protect_pm_master + +[ Upstream commit 8838555089f0345b87f4277fe5a8dd647dc65589 ] + +When building the kernel with Clang, the following section mismatch +warning appears: + +WARNING: vmlinux.o(.text+0x3d84a3b): Section mismatch in reference from +the function twl_probe() to the function +.init.text:unprotect_pm_master() +The function twl_probe() references +the function __init unprotect_pm_master(). +This is often because twl_probe lacks a __init +annotation or the annotation of unprotect_pm_master is wrong. + +Remove the __init annotation on the *protect_pm_master functions so +there is no more mismatch. + +Signed-off-by: Nathan Chancellor +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/twl-core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c +index c64615dca2bd3..1d58df8565488 100644 +--- a/drivers/mfd/twl-core.c ++++ b/drivers/mfd/twl-core.c +@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base, + * letting it generate the right frequencies for USB, MADC, and + * other purposes. + */ +-static inline int __init protect_pm_master(void) ++static inline int protect_pm_master(void) + { + int e = 0; + +@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void) + return e; + } + +-static inline int __init unprotect_pm_master(void) ++static inline int unprotect_pm_master(void) + { + int e = 0; + +-- +2.19.1 + diff --git a/queue-4.9/mfd-wm5110-add-missing-asrc-rate-register.patch b/queue-4.9/mfd-wm5110-add-missing-asrc-rate-register.patch new file mode 100644 index 00000000000..df1b5de48a9 --- /dev/null +++ b/queue-4.9/mfd-wm5110-add-missing-asrc-rate-register.patch @@ -0,0 +1,37 @@ +From cd198802719db523333d9fed101317e54c7c7b76 Mon Sep 17 00:00:00 2001 +From: Charles Keepax +Date: Wed, 28 Nov 2018 10:04:22 +0000 +Subject: mfd: wm5110: Add missing ASRC rate register + +[ Upstream commit 04c801c18ded421845324255e660147a6f58dcd6 ] + +Signed-off-by: Charles Keepax +Signed-off-by: Lee Jones +Signed-off-by: Sasha Levin +--- + drivers/mfd/wm5110-tables.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c +index 1ee68bd440fbc..16c6e2accfaa5 100644 +--- a/drivers/mfd/wm5110-tables.c ++++ b/drivers/mfd/wm5110-tables.c +@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = { + { 0x00000ECD, 0x0000 }, /* R3789 - HPLPF4_2 */ + { 0x00000EE0, 0x0000 }, /* R3808 - ASRC_ENABLE */ + { 0x00000EE2, 0x0000 }, /* R3810 - ASRC_RATE1 */ ++ { 0x00000EE3, 0x4000 }, /* R3811 - ASRC_RATE2 */ + { 0x00000EF0, 0x0000 }, /* R3824 - ISRC 1 CTRL 1 */ + { 0x00000EF1, 0x0000 }, /* R3825 - ISRC 1 CTRL 2 */ + { 0x00000EF2, 0x0000 }, /* R3826 - ISRC 1 CTRL 3 */ +@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg) + case ARIZONA_ASRC_ENABLE: + case ARIZONA_ASRC_STATUS: + case ARIZONA_ASRC_RATE1: ++ case ARIZONA_ASRC_RATE2: + case ARIZONA_ISRC_1_CTRL_1: + case ARIZONA_ISRC_1_CTRL_2: + case ARIZONA_ISRC_1_CTRL_3: +-- +2.19.1 + diff --git a/queue-4.9/mips-ath79-enable-of-serial-ports-in-the-default-con.patch b/queue-4.9/mips-ath79-enable-of-serial-ports-in-the-default-con.patch new file mode 100644 index 00000000000..45a4e5a99a1 --- /dev/null +++ b/queue-4.9/mips-ath79-enable-of-serial-ports-in-the-default-con.patch @@ -0,0 +1,37 @@ +From c28354765540881b60e6060ac309bc83a788e620 Mon Sep 17 00:00:00 2001 +From: Alban Bedel +Date: Mon, 7 Jan 2019 20:45:15 +0100 +Subject: MIPS: ath79: Enable OF serial ports in the default config + +[ Upstream commit 565dc8a4f55e491935bfb04866068d21784ea9a4 ] + +CONFIG_SERIAL_OF_PLATFORM is needed to get a working console on the OF +boards, enable it in the default config to get a working setup out of +the box. + +Signed-off-by: Alban Bedel +Signed-off-by: Paul Burton +Cc: linux-mips@vger.kernel.org +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/configs/ath79_defconfig | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig +index 134879c1310a0..4ed369c0ec6a1 100644 +--- a/arch/mips/configs/ath79_defconfig ++++ b/arch/mips/configs/ath79_defconfig +@@ -74,6 +74,7 @@ CONFIG_SERIAL_8250_CONSOLE=y + # CONFIG_SERIAL_8250_PCI is not set + CONFIG_SERIAL_8250_NR_UARTS=1 + CONFIG_SERIAL_8250_RUNTIME_UARTS=1 ++CONFIG_SERIAL_OF_PLATFORM=y + CONFIG_SERIAL_AR933X=y + CONFIG_SERIAL_AR933X_CONSOLE=y + # CONFIG_HW_RANDOM is not set +-- +2.19.1 + diff --git a/queue-4.9/mips-jazz-fix-64bit-build.patch b/queue-4.9/mips-jazz-fix-64bit-build.patch new file mode 100644 index 00000000000..9c811b1a846 --- /dev/null +++ b/queue-4.9/mips-jazz-fix-64bit-build.patch @@ -0,0 +1,75 @@ +From 6a43039271ac90a50cd9190f6533ddc3c6c9d2a5 Mon Sep 17 00:00:00 2001 +From: Thomas Bogendoerfer +Date: Wed, 9 Jan 2019 18:12:16 +0100 +Subject: MIPS: jazz: fix 64bit build + +[ Upstream commit 41af167fbc0032f9d7562854f58114eaa9270336 ] + +64bit JAZZ builds failed with + + linux-next/arch/mips/jazz/jazzdma.c: In function `vdma_init`: + /linux-next/arch/mips/jazz/jazzdma.c:77:30: error: implicit declaration + of function `KSEG1ADDR`; did you mean `CKSEG1ADDR`? + [-Werror=implicit-function-declaration] + pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); + ^~~~~~~~~ + CKSEG1ADDR + /linux-next/arch/mips/jazz/jazzdma.c:77:10: error: cast to pointer from + integer of different size [-Werror=int-to-pointer-cast] + pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); + ^ + In file included from /linux-next/arch/mips/include/asm/barrier.h:11:0, + from /linux-next/include/linux/compiler.h:248, + from /linux-next/include/linux/kernel.h:10, + from /linux-next/arch/mips/jazz/jazzdma.c:11: + /linux-next/arch/mips/include/asm/addrspace.h:41:29: error: cast from + pointer to integer of different size [-Werror=pointer-to-int-cast] + #define _ACAST32_ (_ATYPE_)(_ATYPE32_) /* widen if necessary */ + ^ + /linux-next/arch/mips/include/asm/addrspace.h:53:25: note: in + expansion of macro `_ACAST32_` + #define CPHYSADDR(a) ((_ACAST32_(a)) & 0x1fffffff) + ^~~~~~~~~ + /linux-next/arch/mips/jazz/jazzdma.c:84:44: note: in expansion of + macro `CPHYSADDR` + r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl)); + +Using correct casts and CKSEG1ADDR when dealing with the pgtbl setup +fixes this. + +Signed-off-by: Thomas Bogendoerfer +Signed-off-by: Paul Burton +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@vger.kernel.org +Cc: linux-kernel@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/mips/jazz/jazzdma.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c +index db6f5afff4ff1..ea897912bc712 100644 +--- a/arch/mips/jazz/jazzdma.c ++++ b/arch/mips/jazz/jazzdma.c +@@ -71,14 +71,15 @@ static int __init vdma_init(void) + get_order(VDMA_PGTBL_SIZE)); + BUG_ON(!pgtbl); + dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE); +- pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl); ++ pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl); + + /* + * Clear the R4030 translation table + */ + vdma_pgtbl_init(); + +- r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl)); ++ r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, ++ CPHYSADDR((unsigned long)pgtbl)); + r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE); + r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0); + +-- +2.19.1 + diff --git a/queue-4.9/mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch b/queue-4.9/mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch new file mode 100644 index 00000000000..8726eb7f5b3 --- /dev/null +++ b/queue-4.9/mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch @@ -0,0 +1,81 @@ +From 47712de69722c86acf57e4e72e89299788b9b7b7 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Fri, 18 Jan 2019 15:58:01 +0000 +Subject: mlxsw: spectrum_switchdev: Do not treat static FDB entries as sticky + +[ Upstream commit 64254a2054611205798e6bde634639bc704573ac ] + +The driver currently treats static FDB entries as both static and +sticky. This is incorrect and prevents such entries from being roamed to +a different port via learning. + +Fix this by configuring static entries with ageing disabled and roaming +enabled. + +In net-next we can add proper support for the newly introduced 'sticky' +flag. + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Signed-off-by: Ido Schimmel +Reported-by: Alexander Petrovskiy +Reviewed-by: Petr Machata +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + .../net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 12 ++++++------ + 1 file changed, 6 insertions(+), 6 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +index 60e1edcbe5734..7ca1ab5c19366 100644 +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -794,7 +794,7 @@ static int mlxsw_sp_port_vlans_add(struct mlxsw_sp_port *mlxsw_sp_port, + static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic) + { + return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS : +- MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY; ++ MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG; + } + + static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding) +@@ -806,7 +806,7 @@ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding) + static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + const char *mac, u16 fid, bool adding, + enum mlxsw_reg_sfd_rec_action action, +- bool dynamic) ++ enum mlxsw_reg_sfd_rec_policy policy) + { + char *sfd_pl; + u8 num_rec; +@@ -817,8 +817,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + return -ENOMEM; + + mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0); +- mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic), +- mac, fid, action, local_port); ++ mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port); + num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl); + err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl); + if (err) +@@ -837,7 +836,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port, + bool dynamic) + { + return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding, +- MLXSW_REG_SFD_REC_ACTION_NOP, dynamic); ++ MLXSW_REG_SFD_REC_ACTION_NOP, ++ mlxsw_sp_sfd_rec_policy(dynamic)); + } + + int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid, +@@ -845,7 +845,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid, + { + return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding, + MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER, +- false); ++ MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY); + } + + static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id, +-- +2.19.1 + diff --git a/queue-4.9/net-hns-fix-use-after-free-identified-by-slub-debug.patch b/queue-4.9/net-hns-fix-use-after-free-identified-by-slub-debug.patch new file mode 100644 index 00000000000..2ae45578a0b --- /dev/null +++ b/queue-4.9/net-hns-fix-use-after-free-identified-by-slub-debug.patch @@ -0,0 +1,93 @@ +From 1c5a0196bff396861540474cf17bab5c47b75c81 Mon Sep 17 00:00:00 2001 +From: Yonglong Liu +Date: Fri, 4 Jan 2019 20:18:11 +0800 +Subject: net: hns: Fix use after free identified by SLUB debug + +[ Upstream commit bb989501abcafa0de5f18b0ec0ec459b5b817908 ] + +When enable SLUB debug, than remove hns_enet_drv module, SLUB debug will +identify a use after free bug: + +[134.189505] Unable to handle kernel paging request at virtual address + 006b6b6b6b6b6b6b +[134.197553] Mem abort info: +[134.200381] ESR = 0x96000004 +[134.203487] Exception class = DABT (current EL), IL = 32 bits +[134.209497] SET = 0, FnV = 0 +[134.212596] EA = 0, S1PTW = 0 +[134.215777] Data abort info: +[134.218701] ISV = 0, ISS = 0x00000004 +[134.222596] CM = 0, WnR = 0 +[134.225606] [006b6b6b6b6b6b6b] address between user and kernel address ranges +[134.232851] Internal error: Oops: 96000004 [#1] SMP +[134.237798] CPU: 21 PID: 27834 Comm: rmmod Kdump: loaded Tainted: G + OE 4.19.5-1.2.34.aarch64 #1 +[134.247856] Hardware name: Huawei TaiShan 2280 /BC11SPCD, BIOS 1.58 10/24/2018 +[134.255181] pstate: 20000005 (nzCv daif -PAN -UAO) +[134.260044] pc : hns_ae_put_handle+0x38/0x60 +[134.264372] lr : hns_ae_put_handle+0x24/0x60 +[134.268700] sp : ffff00001be93c50 +[134.272054] x29: ffff00001be93c50 x28: ffff802faaec8040 +[134.277442] x27: 0000000000000000 x26: 0000000000000000 +[134.282830] x25: 0000000056000000 x24: 0000000000000015 +[134.288284] x23: ffff0000096fe098 x22: ffff000001050070 +[134.293671] x21: ffff801fb3c044a0 x20: ffff80afb75ec098 +[134.303287] x19: ffff80afb75ec098 x18: 0000000000000000 +[134.312945] x17: 0000000000000000 x16: 0000000000000000 +[134.322517] x15: 0000000000000002 x14: 0000000000000000 +[134.332030] x13: dead000000000100 x12: ffff7e02bea3c988 +[134.341487] x11: ffff80affbee9e68 x10: 0000000000000000 +[134.351033] x9 : 6fffff8000008101 x8 : 0000000000000000 +[134.360569] x7 : dead000000000100 x6 : ffff000009579748 +[134.370059] x5 : 0000000000210d00 x4 : 0000000000000000 +[134.379550] x3 : 0000000000000001 x2 : 0000000000000000 +[134.388813] x1 : 6b6b6b6b6b6b6b6b x0 : 0000000000000000 +[134.397993] Process rmmod (pid: 27834, stack limit = 0x00000000d474b7fd) +[134.408498] Call trace: +[134.414611] hns_ae_put_handle+0x38/0x60 +[134.422208] hnae_put_handle+0xd4/0x108 +[134.429563] hns_nic_dev_remove+0x60/0xc0 [hns_enet_drv] +[134.438342] platform_drv_remove+0x2c/0x70 +[134.445958] device_release_driver_internal+0x174/0x208 +[134.454810] driver_detach+0x70/0xd8 +[134.461913] bus_remove_driver+0x64/0xe8 +[134.469396] driver_unregister+0x34/0x60 +[134.476822] platform_driver_unregister+0x20/0x30 +[134.485130] hns_nic_dev_driver_exit+0x14/0x6e4 [hns_enet_drv] +[134.494634] __arm64_sys_delete_module+0x238/0x290 + +struct hnae_handle is a member of struct hnae_vf_cb, so when vf_cb is +freed, than use hnae_handle will cause use after free panic. + +This patch frees vf_cb after hnae_handle used. + +Signed-off-by: Yonglong Liu +Signed-off-by: Huazhong Tan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c | 6 ++---- + 1 file changed, 2 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +index 0b4d90ceea7a6..864f107ed48fa 100644 +--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c ++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c +@@ -149,12 +149,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle) + struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle); + int i; + +- vf_cb->mac_cb = NULL; +- +- kfree(vf_cb); +- + for (i = 0; i < handle->q_num; i++) + hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0; ++ ++ kfree(vf_cb); + } + + static void hns_ae_ring_enable_all(struct hnae_handle *handle, int val) +-- +2.19.1 + diff --git a/queue-4.9/net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch b/queue-4.9/net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch new file mode 100644 index 00000000000..95616486ea6 --- /dev/null +++ b/queue-4.9/net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch @@ -0,0 +1,33 @@ +From d3c8dbf2976b3d470b5773c227b0c869658e87dc Mon Sep 17 00:00:00 2001 +From: Tariq Toukan +Date: Thu, 8 Nov 2018 12:06:53 +0200 +Subject: net/mlx5e: Fix wrong (zero) TX drop counter indication for + representor + +[ Upstream commit 7fdc1adc52d3975740547a78c2df329bb207f15d ] + +For representors, the TX dropped counter is not folded from the +per-ring counters. Fix it. + +Signed-off-by: Tariq Toukan +Signed-off-by: Saeed Mahameed +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx5/core/en_rep.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +index bf1c09ca73c03..b210c171a3806 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c +@@ -91,6 +91,7 @@ static void mlx5e_update_sw_rep_counters(struct mlx5e_priv *priv) + + s->tx_packets += sq_stats->packets; + s->tx_bytes += sq_stats->bytes; ++ s->tx_queue_dropped += sq_stats->dropped; + } + } + } +-- +2.19.1 + diff --git a/queue-4.9/net-stmmac-fix-pci-module-removal-leak.patch b/queue-4.9/net-stmmac-fix-pci-module-removal-leak.patch new file mode 100644 index 00000000000..4cd93640127 --- /dev/null +++ b/queue-4.9/net-stmmac-fix-pci-module-removal-leak.patch @@ -0,0 +1,54 @@ +From 2d1d880f6045f78d83632e5ce56ad2e4b728e0e0 Mon Sep 17 00:00:00 2001 +From: Jose Abreu +Date: Wed, 9 Jan 2019 10:05:56 +0100 +Subject: net: stmmac: Fix PCI module removal leak + +[ Upstream commit 6dea7e1881fd86b80da64e476ac398008daed857 ] + +Since commit b7d0f08e9129, the enable / disable of PCI device is not +managed which will result in IO regions not being automatically unmapped. +As regions continue mapped it is currently not possible to remove and +then probe again the PCI module of stmmac. + +Fix this by manually unmapping regions on remove callback. + +Changes from v1: +- Fix build error + +Cc: Joao Pinto +Cc: David S. Miller +Cc: Giuseppe Cavallaro +Cc: Alexandre Torgue +Fixes: b7d0f08e9129 ("net: stmmac: Fix WoL for PCI-based setups") +Signed-off-by: Jose Abreu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c | 10 ++++++++++ + 1 file changed, 10 insertions(+) + +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +index eafc28142cd21..49eaede34eea6 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c +@@ -231,7 +231,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev, + */ + static void stmmac_pci_remove(struct pci_dev *pdev) + { ++ int i; ++ + stmmac_dvr_remove(&pdev->dev); ++ ++ for (i = 0; i <= PCI_STD_RESOURCE_END; i++) { ++ if (pci_resource_len(pdev, i) == 0) ++ continue; ++ pcim_iounmap_regions(pdev, BIT(i)); ++ break; ++ } ++ + pci_disable_device(pdev); + } + +-- +2.19.1 + diff --git a/queue-4.9/qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch b/queue-4.9/qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch new file mode 100644 index 00000000000..05a474d72b8 --- /dev/null +++ b/queue-4.9/qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch @@ -0,0 +1,36 @@ +From 5532966414d5b2d86c9d6e307dfc17e1a2f0e5ea Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Thu, 3 Jan 2019 12:02:40 +0200 +Subject: qed: Fix qed_ll2_post_rx_buffer_notify_fw() by adding a write memory + barrier + +[ Upstream commit 46721c3d9e273aea880e9ff835b0e1271e1cd2fb ] + +Make sure chain element is updated before ringing the doorbell. + +Signed-off-by: Denis Bolotin +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_ll2.c | 4 ++++ + 1 file changed, 4 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +index a3360cbdb30bd..5b968e6a0a7fb 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c +@@ -1013,6 +1013,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn, + cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain); + rx_prod.bd_prod = cpu_to_le16(bd_prod); + rx_prod.cqe_prod = cpu_to_le16(cq_prod); ++ ++ /* Make sure chain element is updated before ringing the doorbell */ ++ dma_wmb(); ++ + DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod)); + } + +-- +2.19.1 + diff --git a/queue-4.9/scsi-isci-initialize-shost-fully-before-calling-scsi.patch b/queue-4.9/scsi-isci-initialize-shost-fully-before-calling-scsi.patch new file mode 100644 index 00000000000..ae4a9d82c6d --- /dev/null +++ b/queue-4.9/scsi-isci-initialize-shost-fully-before-calling-scsi.patch @@ -0,0 +1,97 @@ +From 886b7c6dc6a9f6b79bb3cebe1920d7346e481cd8 Mon Sep 17 00:00:00 2001 +From: Logan Gunthorpe +Date: Tue, 8 Jan 2019 13:50:43 -0700 +Subject: scsi: isci: initialize shost fully before calling scsi_add_host() + +[ Upstream commit cc29a1b0a3f2597ce887d339222fa85b9307706d ] + +scsi_mq_setup_tags(), which is called by scsi_add_host(), calculates the +command size to allocate based on the prot_capabilities. In the isci +driver, scsi_host_set_prot() is called after scsi_add_host() so the command +size gets calculated to be smaller than it needs to be. Eventually, +scsi_mq_init_request() locates the 'prot_sdb' after the command assuming it +was sized correctly and a buffer overrun may occur. + +However, seeing blk_mq_alloc_rqs() rounds up to the nearest cache line +size, the mistake can go unnoticed. + +The bug was noticed after the struct request size was reduced by commit +9d037ad707ed ("block: remove req->timeout_list") + +Which likely reduced the allocated space for the request by an entire cache +line, enough that the overflow could be hit and it caused a panic, on boot, +at: + + RIP: 0010:t10_pi_complete+0x77/0x1c0 + Call Trace: + + sd_done+0xf5/0x340 + scsi_finish_command+0xc3/0x120 + blk_done_softirq+0x83/0xb0 + __do_softirq+0xa1/0x2e6 + irq_exit+0xbc/0xd0 + call_function_single_interrupt+0xf/0x20 + + +sd_done() would call scsi_prot_sg_count() which reads the number of +entities in 'prot_sdb', but seeing 'prot_sdb' is located after the end of +the allocated space it reads a garbage number and erroneously calls +t10_pi_complete(). + +To prevent this, the calls to scsi_host_set_prot() are moved into +isci_host_alloc() before the call to scsi_add_host(). Out of caution, also +move the similar call to scsi_host_set_guard(). + +Fixes: 3d2d75254915 ("[SCSI] isci: T10 DIF support") +Link: http://lkml.kernel.org/r/da851333-eadd-163a-8c78-e1f4ec5ec857@deltatee.com +Signed-off-by: Logan Gunthorpe +Cc: Intel SCU Linux support +Cc: Artur Paszkiewicz +Cc: "James E.J. Bottomley" +Cc: "Martin K. Petersen" +Cc: Christoph Hellwig +Cc: Jens Axboe +Cc: Jeff Moyer +Reviewed-by: Jeff Moyer +Reviewed-by: Jens Axboe +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/isci/init.c | 14 +++++++------- + 1 file changed, 7 insertions(+), 7 deletions(-) + +diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c +index 77128d680e3bc..6f38fa1f468a7 100644 +--- a/drivers/scsi/isci/init.c ++++ b/drivers/scsi/isci/init.c +@@ -595,6 +595,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id) + shost->max_lun = ~0; + shost->max_cmd_len = MAX_COMMAND_SIZE; + ++ /* turn on DIF support */ ++ scsi_host_set_prot(shost, ++ SHOST_DIF_TYPE1_PROTECTION | ++ SHOST_DIF_TYPE2_PROTECTION | ++ SHOST_DIF_TYPE3_PROTECTION); ++ scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC); ++ + err = scsi_add_host(shost, &pdev->dev); + if (err) + goto err_shost; +@@ -682,13 +689,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id) + goto err_host_alloc; + } + pci_info->hosts[i] = h; +- +- /* turn on DIF support */ +- scsi_host_set_prot(to_shost(h), +- SHOST_DIF_TYPE1_PROTECTION | +- SHOST_DIF_TYPE2_PROTECTION | +- SHOST_DIF_TYPE3_PROTECTION); +- scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC); + } + + err = isci_setup_interrupts(pdev); +-- +2.19.1 + diff --git a/queue-4.9/scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch b/queue-4.9/scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch new file mode 100644 index 00000000000..0380c437fc5 --- /dev/null +++ b/queue-4.9/scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch @@ -0,0 +1,33 @@ +From dc629aee0c965acccb6bf67e636fbf26c504577c Mon Sep 17 00:00:00 2001 +From: YueHaibing +Date: Thu, 20 Dec 2018 11:16:07 +0800 +Subject: scsi: qla4xxx: check return code of qla4xxx_copy_from_fwddb_param + +[ Upstream commit 72b4a0465f995175a2e22cf4a636bf781f1f28a7 ] + +The return code should be check while qla4xxx_copy_from_fwddb_param fails. + +Signed-off-by: YueHaibing +Acked-by: Manish Rangankar +Signed-off-by: Martin K. Petersen +Signed-off-by: Sasha Levin +--- + drivers/scsi/qla4xxx/ql4_os.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c +index d8c03431d0aa8..f9f899ec94270 100644 +--- a/drivers/scsi/qla4xxx/ql4_os.c ++++ b/drivers/scsi/qla4xxx/ql4_os.c +@@ -7245,6 +7245,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha, + + rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn, + fw_ddb_entry); ++ if (rc) ++ goto free_sess; + + ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n", + __func__, fnode_sess->dev.kobj.name); +-- +2.19.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 11acaed6424..0ae07903f4c 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -4,3 +4,24 @@ ceph-avoid-repeatedly-adding-inode-to-mdsc-snap_flush_list.patch numa-change-get_mempolicy-to-use-nr_node_ids-instead-of-max_numnodes.patch proc-oom-do-not-report-alien-mms-when-setting-oom_score_adj.patch keys-allow-reaching-the-keys-quotas-exactly.patch +mfd-ti_am335x_tscadc-use-platform_devid_auto-while-r.patch +mfd-twl-core-fix-section-annotations-on-un-protect_p.patch +mfd-db8500-prcmu-fix-some-section-annotations.patch +mfd-mt6397-do-not-call-irq_domain_remove-if-pmic-uns.patch +mfd-ab8500-core-return-zero-in-get_register_interrup.patch +mfd-qcom_rpm-write-fw_version-to-ctrl_reg.patch +mfd-wm5110-add-missing-asrc-rate-register.patch +mfd-mc13xxx-fix-a-missing-check-of-a-register-read-f.patch +qed-fix-qed_ll2_post_rx_buffer_notify_fw-by-adding-a.patch +net-hns-fix-use-after-free-identified-by-slub-debug.patch +mips-ath79-enable-of-serial-ports-in-the-default-con.patch +scsi-qla4xxx-check-return-code-of-qla4xxx_copy_from_.patch +scsi-isci-initialize-shost-fully-before-calling-scsi.patch +mips-jazz-fix-64bit-build.patch +net-stmmac-fix-pci-module-removal-leak.patch +isdn-i4l-isdn_tty-fix-some-concurrency-double-free-b.patch +atm-he-fix-sign-extension-overflow-on-large-shift.patch +leds-lp5523-fix-a-missing-check-of-return-value-of-l.patch +mlxsw-spectrum_switchdev-do-not-treat-static-fdb-ent.patch +net-mlx5e-fix-wrong-zero-tx-drop-counter-indication-.patch +isdn-avm-fix-string-plus-integer-warning-from-clang.patch