From 345f19f2df47f3b1f90012cb1bce42bc93fb8695 Mon Sep 17 00:00:00 2001 From: Sasha Levin Date: Sat, 17 Nov 2018 10:17:57 -0500 Subject: [PATCH] commits for 4.9 Signed-off-by: Sasha Levin --- ...ool-avoid-reading-past-end-of-buffer.patch | 40 ++++++++ ...-pointer-dereference-on-invalid-stat.patch | 63 +++++++++++++ ...ondition-between-e1000_down-and-e100.patch | 65 +++++++++++++ ...on-3-fix-bridge-irq-delivery-problem.patch | 82 ++++++++++++++++ ...-3-fix-cpu-uart-irq-delivery-problem.patch | 94 +++++++++++++++++++ ...-align-os_hpmc_size-on-word-boundary.patch | 33 +++++++ ...-exported-address-of-os_hpmc-handler.patch | 47 ++++++++++ ...handler-by-increasing-size-to-multip.patch | 50 ++++++++++ queue-4.9/series | 8 ++ 9 files changed, 482 insertions(+) create mode 100644 queue-4.9/bna-ethtool-avoid-reading-past-end-of-buffer.patch create mode 100644 queue-4.9/e1000-avoid-null-pointer-dereference-on-invalid-stat.patch create mode 100644 queue-4.9/e1000-fix-race-condition-between-e1000_down-and-e100.patch create mode 100644 queue-4.9/mips-loongson-3-fix-bridge-irq-delivery-problem.patch create mode 100644 queue-4.9/mips-loongson-3-fix-cpu-uart-irq-delivery-problem.patch create mode 100644 queue-4.9/parisc-align-os_hpmc_size-on-word-boundary.patch create mode 100644 queue-4.9/parisc-fix-exported-address-of-os_hpmc-handler.patch create mode 100644 queue-4.9/parisc-fix-hpmc-handler-by-increasing-size-to-multip.patch diff --git a/queue-4.9/bna-ethtool-avoid-reading-past-end-of-buffer.patch b/queue-4.9/bna-ethtool-avoid-reading-past-end-of-buffer.patch new file mode 100644 index 00000000000..223dbd1ce41 --- /dev/null +++ b/queue-4.9/bna-ethtool-avoid-reading-past-end-of-buffer.patch @@ -0,0 +1,40 @@ +From de159d334d779b343ac32c52ab02a43f57c80926 Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Fri, 5 May 2017 15:30:23 -0700 +Subject: bna: ethtool: Avoid reading past end of buffer + +[ Upstream commit 4dc69c1c1fff2f587f8e737e70b4a4e7565a5c94 ] + +Using memcpy() from a string that is shorter than the length copied means +the destination buffer is being filled with arbitrary data from the kernel +rodata segment. Instead, use strncpy() which will fill the trailing bytes +with zeros. + +This was found with the future CONFIG_FORTIFY_SOURCE feature. + +Cc: Daniel Micay +Signed-off-by: Kees Cook +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/brocade/bna/bnad_ethtool.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c +index 31f61a744d66..9473d12ce239 100644 +--- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c ++++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c +@@ -541,8 +541,8 @@ bnad_get_strings(struct net_device *netdev, u32 stringset, u8 *string) + for (i = 0; i < BNAD_ETHTOOL_STATS_NUM; i++) { + BUG_ON(!(strlen(bnad_net_stats_strings[i]) < + ETH_GSTRING_LEN)); +- memcpy(string, bnad_net_stats_strings[i], +- ETH_GSTRING_LEN); ++ strncpy(string, bnad_net_stats_strings[i], ++ ETH_GSTRING_LEN); + string += ETH_GSTRING_LEN; + } + bmap = bna_tx_rid_mask(&bnad->bna); +-- +2.17.1 + diff --git a/queue-4.9/e1000-avoid-null-pointer-dereference-on-invalid-stat.patch b/queue-4.9/e1000-avoid-null-pointer-dereference-on-invalid-stat.patch new file mode 100644 index 00000000000..c0da7304f6a --- /dev/null +++ b/queue-4.9/e1000-avoid-null-pointer-dereference-on-invalid-stat.patch @@ -0,0 +1,63 @@ +From 35e35fc3613f4f6e87f1cdeeb59a4ca37d036bd2 Mon Sep 17 00:00:00 2001 +From: Colin Ian King +Date: Fri, 22 Sep 2017 18:13:48 +0100 +Subject: e1000: avoid null pointer dereference on invalid stat type + +[ Upstream commit 5983587c8c5ef00d6886477544ad67d495bc5479 ] + +Currently if the stat type is invalid then data[i] is being set +either by dereferencing a null pointer p, or it is reading from +an incorrect previous location if we had a valid stat type +previously. Fix this by skipping over the read of p on an invalid +stat type. + +Detected by CoverityScan, CID#113385 ("Explicit null dereferenced") + +Signed-off-by: Colin Ian King +Reviewed-by: Alexander Duyck +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +index e84574b1eae7..2a81f6d72140 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_ethtool.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_ethtool.c +@@ -1826,11 +1826,12 @@ static void e1000_get_ethtool_stats(struct net_device *netdev, + { + struct e1000_adapter *adapter = netdev_priv(netdev); + int i; +- char *p = NULL; + const struct e1000_stats *stat = e1000_gstrings_stats; + + e1000_update_stats(adapter); +- for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++) { ++ for (i = 0; i < E1000_GLOBAL_STATS_LEN; i++, stat++) { ++ char *p; ++ + switch (stat->type) { + case NETDEV_STATS: + p = (char *)netdev + stat->stat_offset; +@@ -1841,15 +1842,13 @@ static void e1000_get_ethtool_stats(struct net_device *netdev, + default: + WARN_ONCE(1, "Invalid E1000 stat type: %u index %d\n", + stat->type, i); +- break; ++ continue; + } + + if (stat->sizeof_stat == sizeof(u64)) + data[i] = *(u64 *)p; + else + data[i] = *(u32 *)p; +- +- stat++; + } + /* BUG_ON(i != E1000_STATS_LEN); */ + } +-- +2.17.1 + diff --git a/queue-4.9/e1000-fix-race-condition-between-e1000_down-and-e100.patch b/queue-4.9/e1000-fix-race-condition-between-e1000_down-and-e100.patch new file mode 100644 index 00000000000..bcad8103ebf --- /dev/null +++ b/queue-4.9/e1000-fix-race-condition-between-e1000_down-and-e100.patch @@ -0,0 +1,65 @@ +From b2690eacbac33fef0a79d3a81dc667b8ad93b1b8 Mon Sep 17 00:00:00 2001 +From: Vincenzo Maffione +Date: Sat, 16 Sep 2017 18:00:00 +0200 +Subject: e1000: fix race condition between e1000_down() and e1000_watchdog + +[ Upstream commit 44c445c3d1b4eacff23141fa7977c3b2ec3a45c9 ] + +This patch fixes a race condition that can result into the interface being +up and carrier on, but with transmits disabled in the hardware. +The bug may show up by repeatedly IFF_DOWN+IFF_UP the interface, which +allows e1000_watchdog() interleave with e1000_down(). + + CPU x CPU y + -------------------------------------------------------------------- + e1000_down(): + netif_carrier_off() + e1000_watchdog(): + if (carrier == off) { + netif_carrier_on(); + enable_hw_transmit(); + } + disable_hw_transmit(); + e1000_watchdog(): + /* carrier on, do nothing */ + +Signed-off-by: Vincenzo Maffione +Tested-by: Aaron Brown +Signed-off-by: Jeff Kirsher +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/intel/e1000/e1000_main.c | 11 +++++++++-- + 1 file changed, 9 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index dd112aa5cebb..39a09e18c1b7 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -521,8 +521,6 @@ void e1000_down(struct e1000_adapter *adapter) + struct net_device *netdev = adapter->netdev; + u32 rctl, tctl; + +- netif_carrier_off(netdev); +- + /* disable receives in the hardware */ + rctl = er32(RCTL); + ew32(RCTL, rctl & ~E1000_RCTL_EN); +@@ -538,6 +536,15 @@ void e1000_down(struct e1000_adapter *adapter) + E1000_WRITE_FLUSH(); + msleep(10); + ++ /* Set the carrier off after transmits have been disabled in the ++ * hardware, to avoid race conditions with e1000_watchdog() (which ++ * may be running concurrently to us, checking for the carrier ++ * bit to decide whether it should enable transmits again). Such ++ * a race condition would result into transmission being disabled ++ * in the hardware until the next IFF_DOWN+IFF_UP cycle. ++ */ ++ netif_carrier_off(netdev); ++ + napi_disable(&adapter->napi); + + e1000_irq_disable(adapter); +-- +2.17.1 + diff --git a/queue-4.9/mips-loongson-3-fix-bridge-irq-delivery-problem.patch b/queue-4.9/mips-loongson-3-fix-bridge-irq-delivery-problem.patch new file mode 100644 index 00000000000..2d3d087430a --- /dev/null +++ b/queue-4.9/mips-loongson-3-fix-bridge-irq-delivery-problem.patch @@ -0,0 +1,82 @@ +From 0386ac4c0e21f505d6d4fef1df38d6e0388d9d06 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Wed, 5 Sep 2018 17:33:09 +0800 +Subject: MIPS: Loongson-3: Fix BRIDGE irq delivery problem + +[ Upstream commit 360fe725f8849aaddc53475fef5d4a0c439b05ae ] + +After commit e509bd7da149dc349160 ("genirq: Allow migration of chained +interrupts by installing default action") Loongson-3 fails at here: + +setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction); + +This is because both chained_action and cascade_irqaction don't have +IRQF_SHARED flag. This will cause Loongson-3 resume fails because HPET +timer interrupt can't be delivered during S3. So we set the irqchip of +the chained irq to loongson_irq_chip which doesn't disable the chained +irq in CP0.Status. + +Cc: stable@vger.kernel.org +Signed-off-by: Huacai Chen +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/20434/ +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@linux-mips.org +Cc: Fuxin Zhang +Cc: Zhangjin Wu +Cc: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/mips/include/asm/mach-loongson64/irq.h | 2 +- + arch/mips/loongson64/loongson-3/irq.c | 13 +++---------- + 2 files changed, 4 insertions(+), 11 deletions(-) + +diff --git a/arch/mips/include/asm/mach-loongson64/irq.h b/arch/mips/include/asm/mach-loongson64/irq.h +index d18c45c7c394..19ff9ce46c02 100644 +--- a/arch/mips/include/asm/mach-loongson64/irq.h ++++ b/arch/mips/include/asm/mach-loongson64/irq.h +@@ -9,7 +9,7 @@ + #define MIPS_CPU_IRQ_BASE 56 + + #define LOONGSON_UART_IRQ (MIPS_CPU_IRQ_BASE + 2) /* UART */ +-#define LOONGSON_HT1_IRQ (MIPS_CPU_IRQ_BASE + 3) /* HT1 */ ++#define LOONGSON_BRIDGE_IRQ (MIPS_CPU_IRQ_BASE + 3) /* CASCADE */ + #define LOONGSON_TIMER_IRQ (MIPS_CPU_IRQ_BASE + 7) /* CPU Timer */ + + #define LOONGSON_HT1_CFG_BASE loongson_sysconf.ht_control_base +diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c +index ec5f2b30646c..027f53e3bc81 100644 +--- a/arch/mips/loongson64/loongson-3/irq.c ++++ b/arch/mips/loongson64/loongson-3/irq.c +@@ -44,12 +44,6 @@ void mach_irq_dispatch(unsigned int pending) + } + } + +-static struct irqaction cascade_irqaction = { +- .handler = no_action, +- .flags = IRQF_NO_SUSPEND, +- .name = "cascade", +-}; +- + static inline void mask_loongson_irq(struct irq_data *d) { } + static inline void unmask_loongson_irq(struct irq_data *d) { } + +@@ -90,11 +84,10 @@ void __init mach_init_irq(void) + init_i8259_irqs(); + irq_set_chip_and_handler(LOONGSON_UART_IRQ, + &loongson_irq_chip, handle_percpu_irq); ++ irq_set_chip_and_handler(LOONGSON_BRIDGE_IRQ, ++ &loongson_irq_chip, handle_percpu_irq); + +- /* setup HT1 irq */ +- setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction); +- +- set_c0_status(STATUSF_IP2 | STATUSF_IP6); ++ set_c0_status(STATUSF_IP2 | STATUSF_IP3 | STATUSF_IP6); + } + + #ifdef CONFIG_HOTPLUG_CPU +-- +2.17.1 + diff --git a/queue-4.9/mips-loongson-3-fix-cpu-uart-irq-delivery-problem.patch b/queue-4.9/mips-loongson-3-fix-cpu-uart-irq-delivery-problem.patch new file mode 100644 index 00000000000..e9fdc6319ab --- /dev/null +++ b/queue-4.9/mips-loongson-3-fix-cpu-uart-irq-delivery-problem.patch @@ -0,0 +1,94 @@ +From b7d45d909ebf9f468103312c34eef5bba01cbb16 Mon Sep 17 00:00:00 2001 +From: Huacai Chen +Date: Wed, 5 Sep 2018 17:33:08 +0800 +Subject: MIPS: Loongson-3: Fix CPU UART irq delivery problem + +[ Upstream commit d06f8a2f1befb5a3d0aa660ab1c05e9b744456ea ] + +Masking/unmasking the CPU UART irq in CP0_Status (and redirecting it to +other CPUs) may cause interrupts be lost, especially in multi-package +machines (Package-0's UART irq cannot be delivered to others). So make +mask_loongson_irq() and unmask_loongson_irq() be no-ops. + +The original problem (UART IRQ may deliver to any core) is also because +of masking/unmasking the CPU UART irq in CP0_Status. So it is safe to +remove all of the stuff. + +Signed-off-by: Huacai Chen +Signed-off-by: Paul Burton +Patchwork: https://patchwork.linux-mips.org/patch/20433/ +Cc: Ralf Baechle +Cc: James Hogan +Cc: linux-mips@linux-mips.org +Cc: Fuxin Zhang +Cc: Zhangjin Wu +Cc: Huacai Chen +Signed-off-by: Sasha Levin +--- + arch/mips/loongson64/loongson-3/irq.c | 43 ++------------------------- + 1 file changed, 3 insertions(+), 40 deletions(-) + +diff --git a/arch/mips/loongson64/loongson-3/irq.c b/arch/mips/loongson64/loongson-3/irq.c +index 8e7649088353..ec5f2b30646c 100644 +--- a/arch/mips/loongson64/loongson-3/irq.c ++++ b/arch/mips/loongson64/loongson-3/irq.c +@@ -50,45 +50,8 @@ static struct irqaction cascade_irqaction = { + .name = "cascade", + }; + +-static inline void mask_loongson_irq(struct irq_data *d) +-{ +- clear_c0_status(0x100 << (d->irq - MIPS_CPU_IRQ_BASE)); +- irq_disable_hazard(); +- +- /* Workaround: UART IRQ may deliver to any core */ +- if (d->irq == LOONGSON_UART_IRQ) { +- int cpu = smp_processor_id(); +- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; +- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; +- u64 intenclr_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_INTENCLR); +- u64 introuter_lpc_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_LPC); +- +- *(volatile u32 *)intenclr_addr = 1 << 10; +- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<irq == LOONGSON_UART_IRQ) { +- int cpu = smp_processor_id(); +- int node_id = cpu_logical_map(cpu) / loongson_sysconf.cores_per_node; +- int core_id = cpu_logical_map(cpu) % loongson_sysconf.cores_per_node; +- u64 intenset_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_INTENSET); +- u64 introuter_lpc_addr = smp_group[node_id] | +- (u64)(&LOONGSON_INT_ROUTER_LPC); +- +- *(volatile u32 *)intenset_addr = 1 << 10; +- *(volatile u8 *)introuter_lpc_addr = 0x10 + (1<irq - MIPS_CPU_IRQ_BASE)); +- irq_enable_hazard(); +-} ++static inline void mask_loongson_irq(struct irq_data *d) { } ++static inline void unmask_loongson_irq(struct irq_data *d) { } + + /* For MIPS IRQs which shared by all cores */ + static struct irq_chip loongson_irq_chip = { +@@ -126,7 +89,7 @@ void __init mach_init_irq(void) + mips_cpu_irq_init(); + init_i8259_irqs(); + irq_set_chip_and_handler(LOONGSON_UART_IRQ, +- &loongson_irq_chip, handle_level_irq); ++ &loongson_irq_chip, handle_percpu_irq); + + /* setup HT1 irq */ + setup_irq(LOONGSON_HT1_IRQ, &cascade_irqaction); +-- +2.17.1 + diff --git a/queue-4.9/parisc-align-os_hpmc_size-on-word-boundary.patch b/queue-4.9/parisc-align-os_hpmc_size-on-word-boundary.patch new file mode 100644 index 00000000000..00e126272ab --- /dev/null +++ b/queue-4.9/parisc-align-os_hpmc_size-on-word-boundary.patch @@ -0,0 +1,33 @@ +From 21addf295a3242a8fcfc073ca761bf6a380e9701 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Tue, 12 Dec 2017 21:25:41 +0100 +Subject: parisc: Align os_hpmc_size on word boundary + +[ Upstream commit 0ed9d3de5f8f97e6efd5ca0e3377cab5f0451ead ] + +The os_hpmc_size variable sometimes wasn't aligned at word boundary and thus +triggered the unaligned fault handler at startup. +Fix it by aligning it properly. + +Signed-off-by: Helge Deller +Cc: # v4.14+ +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/hpmc.S | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S +index 0fbd0a0e1cda..38d461aec46d 100644 +--- a/arch/parisc/kernel/hpmc.S ++++ b/arch/parisc/kernel/hpmc.S +@@ -304,6 +304,7 @@ ENDPROC_CFI(os_hpmc) + + + __INITRODATA ++ .align 4 + .export os_hpmc_size + os_hpmc_size: + .word .os_hpmc_end-.os_hpmc +-- +2.17.1 + diff --git a/queue-4.9/parisc-fix-exported-address-of-os_hpmc-handler.patch b/queue-4.9/parisc-fix-exported-address-of-os_hpmc-handler.patch new file mode 100644 index 00000000000..c42a0e4a717 --- /dev/null +++ b/queue-4.9/parisc-fix-exported-address-of-os_hpmc-handler.patch @@ -0,0 +1,47 @@ +From 535d869a571d7740f1509a24c3ab8ffc1e45029c Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sun, 14 Oct 2018 21:58:00 +0200 +Subject: parisc: Fix exported address of os_hpmc handler + +[ Upstream commit 99a3ae51d557d8e38a7aece65678a31f9db215ee ] + +In the C-code we need to put the physical address of the hpmc handler in +the interrupt vector table (IVA) in order to get HPMCs working. Since +on parisc64 function pointers are indirect (in fact they are function +descriptors) we instead export the address as variable and not as +function. + +This reverts a small part of commit f39cce654f9a ("parisc: Add +cfi_startproc and cfi_endproc to assembly code"). + +Signed-off-by: Helge Deller +Cc: [4.9+] +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/hpmc.S | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S +index 407b3aa5aa07..e88f4e7f39f3 100644 +--- a/arch/parisc/kernel/hpmc.S ++++ b/arch/parisc/kernel/hpmc.S +@@ -84,7 +84,7 @@ END(hpmc_pim_data) + + .import intr_save, code + .align 16 +-ENTRY_CFI(os_hpmc) ++ENTRY(os_hpmc) + .os_hpmc: + + /* +@@ -301,7 +301,6 @@ os_hpmc_6: + b . + nop + .align 16 /* make function length multiple of 16 bytes */ +-ENDPROC_CFI(os_hpmc) + .os_hpmc_end: + + +-- +2.17.1 + diff --git a/queue-4.9/parisc-fix-hpmc-handler-by-increasing-size-to-multip.patch b/queue-4.9/parisc-fix-hpmc-handler-by-increasing-size-to-multip.patch new file mode 100644 index 00000000000..713ad8f40e8 --- /dev/null +++ b/queue-4.9/parisc-fix-hpmc-handler-by-increasing-size-to-multip.patch @@ -0,0 +1,50 @@ +From 213ede17663c2356a4ece9d28406338982ea6533 Mon Sep 17 00:00:00 2001 +From: Helge Deller +Date: Sat, 24 Mar 2018 21:18:25 +0100 +Subject: parisc: Fix HPMC handler by increasing size to multiple of 16 bytes + +[ Upstream commit d5654e156bc4d68a87bbaa6d7e020baceddf6e68 ] + +Make sure that the HPMC (High Priority Machine Check) handler is 16-byte +aligned and that it's length in the IVT is a multiple of 16 bytes. +Otherwise PDC may decide not to call the HPMC crash handler. + +Signed-off-by: Helge Deller +Cc: stable@vger.kernel.org +Signed-off-by: Sasha Levin +--- + arch/parisc/kernel/hpmc.S | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +diff --git a/arch/parisc/kernel/hpmc.S b/arch/parisc/kernel/hpmc.S +index 38d461aec46d..407b3aa5aa07 100644 +--- a/arch/parisc/kernel/hpmc.S ++++ b/arch/parisc/kernel/hpmc.S +@@ -83,6 +83,7 @@ END(hpmc_pim_data) + .text + + .import intr_save, code ++ .align 16 + ENTRY_CFI(os_hpmc) + .os_hpmc: + +@@ -299,12 +300,15 @@ os_hpmc_6: + + b . + nop ++ .align 16 /* make function length multiple of 16 bytes */ + ENDPROC_CFI(os_hpmc) + .os_hpmc_end: + + + __INITRODATA ++.globl os_hpmc_size + .align 4 +- .export os_hpmc_size ++ .type os_hpmc_size, @object ++ .size os_hpmc_size, 4 + os_hpmc_size: + .word .os_hpmc_end-.os_hpmc +-- +2.17.1 + diff --git a/queue-4.9/series b/queue-4.9/series index fb7cc36bcc7..2c3efd2c8ac 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -20,3 +20,11 @@ fuse-fix-use-after-free-in-fuse_dev_do_write.patch fuse-fix-blocked_waitq-wakeup.patch fuse-set-fr_sent-while-locked.patch mm-do-not-bug_on-on-incorrect-length-in-__mm_populat.patch +e1000-avoid-null-pointer-dereference-on-invalid-stat.patch +e1000-fix-race-condition-between-e1000_down-and-e100.patch +bna-ethtool-avoid-reading-past-end-of-buffer.patch +parisc-align-os_hpmc_size-on-word-boundary.patch +parisc-fix-hpmc-handler-by-increasing-size-to-multip.patch +parisc-fix-exported-address-of-os_hpmc-handler.patch +mips-loongson-3-fix-cpu-uart-irq-delivery-problem.patch +mips-loongson-3-fix-bridge-irq-delivery-problem.patch -- 2.47.2