4.19-stable patches

added patches:
	mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch
	net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch

diff --git a/queue-4.19/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch b/queue-4.19/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch
new file mode 100644 (file)
index 0000000..774ae37
--- /dev/null
+++ b/queue-4.19/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch
@@ -0,0 +1,40 @@
+From 6ade20327dbb808882888ed8ccded71e93067cf9 Mon Sep 17 00:00:00 2001
+From: Liviu Dudau <liviu@dudau.co.uk>
+Date: Tue, 5 Mar 2019 15:42:54 -0800
+Subject: mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap()
+
+From: Liviu Dudau <liviu@dudau.co.uk>
+
+commit 6ade20327dbb808882888ed8ccded71e93067cf9 upstream.
+
+find_vmap_area() can return a NULL pointer and we're going to
+dereference it without checking it first.  Use the existing
+find_vm_area() function which does exactly what we want and checks for
+the NULL pointer.
+
+Link: http://lkml.kernel.org/r/20181228171009.22269-1-liviu@dudau.co.uk
+Fixes: f3c01d2f3ade ("mm: vmalloc: avoid racy handling of debugobjects in vunmap")
+Signed-off-by: Liviu Dudau <liviu@dudau.co.uk>
+Reviewed-by: Andrew Morton <akpm@linux-foundation.org>
+Cc: Chintan Pandya <cpandya@codeaurora.org>
+Cc: Andrey Ryabinin <aryabinin@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Guenter Roeck <linux@roeck-us.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmalloc.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1510,7 +1510,7 @@ static void __vunmap(const void *addr, i
+                       addr))
+               return;
+ 
+-      area = find_vmap_area((unsigned long)addr)->vm;
++      area = find_vm_area(addr);
+       if (unlikely(!area)) {
+               WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
+                               addr);

diff --git a/queue-4.19/net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch b/queue-4.19/net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch
new file mode 100644 (file)
index 0000000..c1ef832
--- /dev/null
+++ b/queue-4.19/net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch
@@ -0,0 +1,133 @@
+From ed4d81c4b3f28ccf624f11fd66f67aec5b58859c Mon Sep 17 00:00:00 2001
+From: Igor Russkikh <Igor.Russkikh@aquantia.com>
+Date: Fri, 11 Oct 2019 13:45:20 +0000
+Subject: net: aquantia: when cleaning hw cache it should be toggled
+
+From: Igor Russkikh <Igor.Russkikh@aquantia.com>
+
+commit ed4d81c4b3f28ccf624f11fd66f67aec5b58859c upstream.
+
+>From HW specification to correctly reset HW caches (this is a required
+workaround when stopping the device), register bit should actually
+be toggled.
+
+It was previosly always just set. Due to the way driver stops HW this
+never actually caused any issues, but it still may, so cleaning this up.
+
+Fixes: 7a1bb49461b1 ("net: aquantia: fix potential IOMMU fault after driver unbind")
+Signed-off-by: Igor Russkikh <igor.russkikh@aquantia.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c           |   16 +++++++-
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c          |   17 +++++++-
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h          |    7 ++-
+ drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h |   19 ++++++++++
+ 4 files changed, 53 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c
+@@ -917,14 +917,26 @@ static int hw_atl_b0_hw_interrupt_modera
+ 
+ static int hw_atl_b0_hw_stop(struct aq_hw_s *self)
+ {
++      int err;
++      u32 val;
++
+       hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK);
+ 
+       /* Invalidate Descriptor Cache to prevent writing to the cached
+        * descriptors and to the data pointer of those descriptors
+        */
+-      hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1);
++      hw_atl_rdm_rx_dma_desc_cache_init_tgl(self);
++
++      err = aq_hw_err_from_flags(self);
++
++      if (err)
++              goto err_exit;
++
++      readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get,
++                                self, val, val == 1, 1000U, 10000U);
+ 
+-      return aq_hw_err_from_flags(self);
++err_exit:
++      return err;
+ }
+ 
+ static int hw_atl_b0_hw_ring_tx_stop(struct aq_hw_s *self,
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c
+@@ -619,12 +619,25 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(str
+                           HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode);
+ }
+ 
+-void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init)
++void hw_atl_rdm_rx_dma_desc_cache_init_tgl(struct aq_hw_s *aq_hw)
+ {
++      u32 val;
++
++      val = aq_hw_read_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR,
++                               HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK,
++                               HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT);
++
+       aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR,
+                           HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK,
+                           HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT,
+-                          init);
++                          val ^ 1);
++}
++
++u32 hw_atl_rdm_rx_dma_desc_cache_init_done_get(struct aq_hw_s *aq_hw)
++{
++      return aq_hw_read_reg_bit(aq_hw, RDM_RX_DMA_DESC_CACHE_INIT_DONE_ADR,
++                                RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSK,
++                                RDM_RX_DMA_DESC_CACHE_INIT_DONE_SHIFT);
+ }
+ 
+ void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw,
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h
+@@ -325,8 +325,11 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_
+                                           u32 rx_pkt_buff_size_per_tc,
+                                           u32 buffer);
+ 
+-/* set rdm rx dma descriptor cache init */
+-void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init);
++/* toggle rdm rx dma descriptor cache init */
++void hw_atl_rdm_rx_dma_desc_cache_init_tgl(struct aq_hw_s *aq_hw);
++
++/* get rdm rx dma descriptor cache init done */
++u32 hw_atl_rdm_rx_dma_desc_cache_init_done_get(struct aq_hw_s *aq_hw);
+ 
+ /* set rx xoff enable (per tc) */
+ void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc,
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h
+@@ -311,6 +311,25 @@
+ /* default value of bitfield rdm_desc_init_i */
+ #define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0
+ 
++/* rdm_desc_init_done_i bitfield definitions
++ * preprocessor definitions for the bitfield rdm_desc_init_done_i.
++ * port="pif_rdm_desc_init_done_i"
++ */
++
++/* register address for bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_ADR 0x00005a10
++/* bitmask for bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSK 0x00000001U
++/* inverted bitmask for bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSKN 0xfffffffe
++/* lower bit position of bitfield  rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_SHIFT 0U
++/* width of bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_WIDTH 1
++/* default value of bitfield rdm_desc_init_done_i */
++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_DEFAULT 0x0
++
++
+ /* rx int_desc_wrb_en bitfield definitions
+  * preprocessor definitions for the bitfield "int_desc_wrb_en".
+  * port="pif_rdm_int_desc_wrb_en_i"

diff --git a/queue-4.19/series b/queue-4.19/series
index b8938a9acac8302e0e14334b5aa18b21de082fcb..be1475e5462b1df93edb87400e654491700297c8 100644 (file)
--- a/queue-4.19/series
+++ b/queue-4.19/series
@@ -92,3 +92,5 @@ crypto-chelsio-chtls-properly-set-tp-lsndtime.patch
 bonding-fix-reference-count-leak-in-bond_sysfs_slave_add.patch
 revert-input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch
 netfilter-nf_conntrack_pptp-fix-compilation-warning-with-w-1-build.patch
+mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch
+net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch