From: Greg Kroah-Hartman Date: Mon, 1 Jun 2020 17:01:46 +0000 (+0200) Subject: 4.19-stable patches X-Git-Tag: v4.4.226~13 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=5e114c75371165be4a2cce30aab47110e9d079f2;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch --- diff --git a/queue-4.19/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch b/queue-4.19/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch new file mode 100644 index 00000000000..774ae377027 --- /dev/null +++ b/queue-4.19/mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch @@ -0,0 +1,40 @@ +From 6ade20327dbb808882888ed8ccded71e93067cf9 Mon Sep 17 00:00:00 2001 +From: Liviu Dudau +Date: Tue, 5 Mar 2019 15:42:54 -0800 +Subject: mm/vmalloc.c: don't dereference possible NULL pointer in __vunmap() + +From: Liviu Dudau + +commit 6ade20327dbb808882888ed8ccded71e93067cf9 upstream. + +find_vmap_area() can return a NULL pointer and we're going to +dereference it without checking it first. Use the existing +find_vm_area() function which does exactly what we want and checks for +the NULL pointer. + +Link: http://lkml.kernel.org/r/20181228171009.22269-1-liviu@dudau.co.uk +Fixes: f3c01d2f3ade ("mm: vmalloc: avoid racy handling of debugobjects in vunmap") +Signed-off-by: Liviu Dudau +Reviewed-by: Andrew Morton +Cc: Chintan Pandya +Cc: Andrey Ryabinin +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Cc: Guenter Roeck +Signed-off-by: Greg Kroah-Hartman + +--- + mm/vmalloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -1510,7 +1510,7 @@ static void __vunmap(const void *addr, i + addr)) + return; + +- area = find_vmap_area((unsigned long)addr)->vm; ++ area = find_vm_area(addr); + if (unlikely(!area)) { + WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n", + addr); diff --git a/queue-4.19/net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch b/queue-4.19/net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch new file mode 100644 index 00000000000..c1ef832bc11 --- /dev/null +++ b/queue-4.19/net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch @@ -0,0 +1,133 @@ +From ed4d81c4b3f28ccf624f11fd66f67aec5b58859c Mon Sep 17 00:00:00 2001 +From: Igor Russkikh +Date: Fri, 11 Oct 2019 13:45:20 +0000 +Subject: net: aquantia: when cleaning hw cache it should be toggled + +From: Igor Russkikh + +commit ed4d81c4b3f28ccf624f11fd66f67aec5b58859c upstream. + +>From HW specification to correctly reset HW caches (this is a required +workaround when stopping the device), register bit should actually +be toggled. + +It was previosly always just set. Due to the way driver stops HW this +never actually caused any issues, but it still may, so cleaning this up. + +Fixes: 7a1bb49461b1 ("net: aquantia: fix potential IOMMU fault after driver unbind") +Signed-off-by: Igor Russkikh +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c | 16 +++++++- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c | 17 +++++++- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h | 7 ++- + drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h | 19 ++++++++++ + 4 files changed, 53 insertions(+), 6 deletions(-) + +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_b0.c +@@ -917,14 +917,26 @@ static int hw_atl_b0_hw_interrupt_modera + + static int hw_atl_b0_hw_stop(struct aq_hw_s *self) + { ++ int err; ++ u32 val; ++ + hw_atl_b0_hw_irq_disable(self, HW_ATL_B0_INT_MASK); + + /* Invalidate Descriptor Cache to prevent writing to the cached + * descriptors and to the data pointer of those descriptors + */ +- hw_atl_rdm_rx_dma_desc_cache_init_set(self, 1); ++ hw_atl_rdm_rx_dma_desc_cache_init_tgl(self); ++ ++ err = aq_hw_err_from_flags(self); ++ ++ if (err) ++ goto err_exit; ++ ++ readx_poll_timeout_atomic(hw_atl_rdm_rx_dma_desc_cache_init_done_get, ++ self, val, val == 1, 1000U, 10000U); + +- return aq_hw_err_from_flags(self); ++err_exit: ++ return err; + } + + static int hw_atl_b0_hw_ring_tx_stop(struct aq_hw_s *self, +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.c +@@ -619,12 +619,25 @@ void hw_atl_rpb_rx_flow_ctl_mode_set(str + HW_ATL_RPB_RX_FC_MODE_SHIFT, rx_flow_ctl_mode); + } + +-void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init) ++void hw_atl_rdm_rx_dma_desc_cache_init_tgl(struct aq_hw_s *aq_hw) + { ++ u32 val; ++ ++ val = aq_hw_read_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR, ++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK, ++ HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT); ++ + aq_hw_write_reg_bit(aq_hw, HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_ADR, + HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_MSK, + HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_SHIFT, +- init); ++ val ^ 1); ++} ++ ++u32 hw_atl_rdm_rx_dma_desc_cache_init_done_get(struct aq_hw_s *aq_hw) ++{ ++ return aq_hw_read_reg_bit(aq_hw, RDM_RX_DMA_DESC_CACHE_INIT_DONE_ADR, ++ RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSK, ++ RDM_RX_DMA_DESC_CACHE_INIT_DONE_SHIFT); + } + + void hw_atl_rpb_rx_pkt_buff_size_per_tc_set(struct aq_hw_s *aq_hw, +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh.h +@@ -325,8 +325,11 @@ void hw_atl_rpb_rx_pkt_buff_size_per_tc_ + u32 rx_pkt_buff_size_per_tc, + u32 buffer); + +-/* set rdm rx dma descriptor cache init */ +-void hw_atl_rdm_rx_dma_desc_cache_init_set(struct aq_hw_s *aq_hw, u32 init); ++/* toggle rdm rx dma descriptor cache init */ ++void hw_atl_rdm_rx_dma_desc_cache_init_tgl(struct aq_hw_s *aq_hw); ++ ++/* get rdm rx dma descriptor cache init done */ ++u32 hw_atl_rdm_rx_dma_desc_cache_init_done_get(struct aq_hw_s *aq_hw); + + /* set rx xoff enable (per tc) */ + void hw_atl_rpb_rx_xoff_en_per_tc_set(struct aq_hw_s *aq_hw, u32 rx_xoff_en_per_tc, +--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h ++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_llh_internal.h +@@ -311,6 +311,25 @@ + /* default value of bitfield rdm_desc_init_i */ + #define HW_ATL_RDM_RX_DMA_DESC_CACHE_INIT_DEFAULT 0x0 + ++/* rdm_desc_init_done_i bitfield definitions ++ * preprocessor definitions for the bitfield rdm_desc_init_done_i. ++ * port="pif_rdm_desc_init_done_i" ++ */ ++ ++/* register address for bitfield rdm_desc_init_done_i */ ++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_ADR 0x00005a10 ++/* bitmask for bitfield rdm_desc_init_done_i */ ++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSK 0x00000001U ++/* inverted bitmask for bitfield rdm_desc_init_done_i */ ++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_MSKN 0xfffffffe ++/* lower bit position of bitfield rdm_desc_init_done_i */ ++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_SHIFT 0U ++/* width of bitfield rdm_desc_init_done_i */ ++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_WIDTH 1 ++/* default value of bitfield rdm_desc_init_done_i */ ++#define RDM_RX_DMA_DESC_CACHE_INIT_DONE_DEFAULT 0x0 ++ ++ + /* rx int_desc_wrb_en bitfield definitions + * preprocessor definitions for the bitfield "int_desc_wrb_en". + * port="pif_rdm_int_desc_wrb_en_i" diff --git a/queue-4.19/series b/queue-4.19/series index b8938a9acac..be1475e5462 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -92,3 +92,5 @@ crypto-chelsio-chtls-properly-set-tp-lsndtime.patch bonding-fix-reference-count-leak-in-bond_sysfs_slave_add.patch revert-input-i8042-add-thinkpad-s230u-to-i8042-nomux-list.patch netfilter-nf_conntrack_pptp-fix-compilation-warning-with-w-1-build.patch +mm-vmalloc.c-don-t-dereference-possible-null-pointer-in-__vunmap.patch +net-aquantia-when-cleaning-hw-cache-it-should-be-toggled.patch