--- /dev/null
+From foo@baz Wed Sep 21 12:45:10 CEST 2016
+From: Davide Caratti <dcaratti@redhat.com>
+Date: Wed, 31 Aug 2016 14:16:44 +0200
+Subject: bridge: re-introduce 'fix parsing of MLDv2 reports'
+
+From: Davide Caratti <dcaratti@redhat.com>
+
+
+[ Upstream commit 9264251ee2a55bce8fb93826b3f581fb9eb7e2c2 ]
+
+commit bc8c20acaea1 ("bridge: multicast: treat igmpv3 report with
+INCLUDE and no sources as a leave") seems to have accidentally reverted
+commit 47cc84ce0c2f ("bridge: fix parsing of MLDv2 reports"). This
+commit brings back a change to br_ip6_multicast_mld2_report() where
+parsing of MLDv2 reports stops when the first group is successfully
+added to the MDB cache.
+
+Fixes: bc8c20acaea1 ("bridge: multicast: treat igmpv3 report with INCLUDE and no sources as a leave")
+Signed-off-by: Davide Caratti <dcaratti@redhat.com>
+Acked-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_multicast.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1113,7 +1113,7 @@ static int br_ip6_multicast_mld2_report(
+ } else {
+ err = br_ip6_multicast_add_group(br, port,
+ &grec->grec_mca, vid);
+- if (!err)
++ if (err)
+ break;
+ }
+ }
--- /dev/null
+From foo@baz Wed Sep 21 12:45:10 CEST 2016
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Wed, 24 Aug 2016 11:01:20 -0700
+Subject: net: dsa: bcm_sf2: Fix race condition while unmasking interrupts
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+
+[ Upstream commit 4f101c47791cdcb831b3ef1f831b1cc51e4fe03c ]
+
+We kept shadow copies of which interrupt sources we have enabled and
+disabled, but due to an order bug in how intrl2_mask_clear was defined,
+we could run into the following scenario:
+
+CPU0 CPU1
+intrl2_1_mask_clear(..)
+sets INTRL2_CPU_MASK_CLEAR
+ bcm_sf2_switch_1_isr
+ read INTRL2_CPU_STATUS and masks with stale
+ irq1_mask value
+updates irq1_mask value
+
+Which would make us loop again and again trying to process and interrupt
+we are not clearing since our copy of whether it was enabled before
+still indicates it was not. Fix this by updating the shadow copy first,
+and then unasking at the HW level.
+
+Fixes: 246d7f773c13 ("net: dsa: add Broadcom SF2 switch driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/dsa/bcm_sf2.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/bcm_sf2.h
++++ b/drivers/net/dsa/bcm_sf2.h
+@@ -187,8 +187,8 @@ static inline void name##_writeq(struct
+ static inline void intrl2_##which##_mask_clear(struct bcm_sf2_priv *priv, \
+ u32 mask) \
+ { \
+- intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR); \
+ priv->irq##which##_mask &= ~(mask); \
++ intrl2_##which##_writel(priv, mask, INTRL2_CPU_MASK_CLEAR); \
+ } \
+ static inline void intrl2_##which##_mask_set(struct bcm_sf2_priv *priv, \
+ u32 mask) \
--- /dev/null
+From foo@baz Wed Sep 21 12:45:10 CEST 2016
+From: Vegard Nossum <vegard.nossum@oracle.com>
+Date: Fri, 12 Aug 2016 10:29:13 +0200
+Subject: net/irda: handle iriap_register_lsap() allocation failure
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+
+[ Upstream commit 5ba092efc7ddff040777ae7162f1d195f513571b ]
+
+If iriap_register_lsap() fails to allocate memory, self->lsap is
+set to NULL. However, none of the callers handle the failure and
+irlmp_connect_request() will happily dereference it:
+
+ iriap_register_lsap: Unable to allocated LSAP!
+ ================================================================================
+ UBSAN: Undefined behaviour in net/irda/irlmp.c:378:2
+ member access within null pointer of type 'struct lsap_cb'
+ CPU: 1 PID: 15403 Comm: trinity-c0 Not tainted 4.8.0-rc1+ #81
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.9.3-0-ge2fc41e-prebuilt.qemu-project.org
+ 04/01/2014
+ 0000000000000000 ffff88010c7e78a8 ffffffff82344f40 0000000041b58ab3
+ ffffffff84f98000 ffffffff82344e94 ffff88010c7e78d0 ffff88010c7e7880
+ ffff88010630ad00 ffffffff84a5fae0 ffffffff84d3f5c0 000000000000017a
+ Call Trace:
+ [<ffffffff82344f40>] dump_stack+0xac/0xfc
+ [<ffffffff8242f5a8>] ubsan_epilogue+0xd/0x8a
+ [<ffffffff824302bf>] __ubsan_handle_type_mismatch+0x157/0x411
+ [<ffffffff83b7bdbc>] irlmp_connect_request+0x7ac/0x970
+ [<ffffffff83b77cc0>] iriap_connect_request+0xa0/0x160
+ [<ffffffff83b77f48>] state_s_disconnect+0x88/0xd0
+ [<ffffffff83b78904>] iriap_do_client_event+0x94/0x120
+ [<ffffffff83b77710>] iriap_getvaluebyclass_request+0x3e0/0x6d0
+ [<ffffffff83ba6ebb>] irda_find_lsap_sel+0x1eb/0x630
+ [<ffffffff83ba90c8>] irda_connect+0x828/0x12d0
+ [<ffffffff833c0dfb>] SYSC_connect+0x22b/0x340
+ [<ffffffff833c7e09>] SyS_connect+0x9/0x10
+ [<ffffffff81007bd3>] do_syscall_64+0x1b3/0x4b0
+ [<ffffffff845f946a>] entry_SYSCALL64_slow_path+0x25/0x25
+ ================================================================================
+
+The bug seems to have been around since forever.
+
+There's more problems with missing error checks in iriap_init() (and
+indeed all of irda_init()), but that's a bigger problem that needs
+very careful review and testing. This patch will fix the most serious
+bug (as it's easily reached from unprivileged userspace).
+
+I have tested my patch with a reproducer.
+
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/irda/iriap.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/net/irda/iriap.c
++++ b/net/irda/iriap.c
+@@ -185,8 +185,12 @@ struct iriap_cb *iriap_open(__u8 slsap_s
+
+ self->magic = IAS_MAGIC;
+ self->mode = mode;
+- if (mode == IAS_CLIENT)
+- iriap_register_lsap(self, slsap_sel, mode);
++ if (mode == IAS_CLIENT) {
++ if (iriap_register_lsap(self, slsap_sel, mode)) {
++ kfree(self);
++ return NULL;
++ }
++ }
+
+ self->confirm = callback;
+ self->priv = priv;
--- /dev/null
+From foo@baz Wed Sep 21 12:45:10 CEST 2016
+From: Paul Blakey <paulb@mellanox.com>
+Date: Thu, 18 Aug 2016 21:09:05 +0300
+Subject: net/mlx5: Added missing check of msg length in verifying its signature
+
+From: Paul Blakey <paulb@mellanox.com>
+
+
+[ Upstream commit 2c0f8ce1b584a4d7b8ff53140d21dfed99834940 ]
+
+Set and verify signature calculates the signature for each of the
+mailbox nodes, even for those that are unused (from cache). Added
+a missing length check to set and verify only those which are used.
+
+While here, also moved the setting of msg's nodes token to where we
+already go over them. This saves a pass because checksum is disabled,
+and the only useful thing remaining that set signature does is setting
+the token.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB
+adapters')
+Signed-off-by: Paul Blakey <paulb@mellanox.com>
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx5/core/cmd.c | 83 ++++++++++++++++----------
+ 1 file changed, 53 insertions(+), 30 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
+@@ -143,13 +143,14 @@ static struct mlx5_cmd_layout *get_inst(
+ return cmd->cmd_buf + (idx << cmd->log_stride);
+ }
+
+-static u8 xor8_buf(void *buf, int len)
++static u8 xor8_buf(void *buf, size_t offset, int len)
+ {
+ u8 *ptr = buf;
+ u8 sum = 0;
+ int i;
++ int end = len + offset;
+
+- for (i = 0; i < len; i++)
++ for (i = offset; i < end; i++)
+ sum ^= ptr[i];
+
+ return sum;
+@@ -157,41 +158,49 @@ static u8 xor8_buf(void *buf, int len)
+
+ static int verify_block_sig(struct mlx5_cmd_prot_block *block)
+ {
+- if (xor8_buf(block->rsvd0, sizeof(*block) - sizeof(block->data) - 1) != 0xff)
++ size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
++ int xor_len = sizeof(*block) - sizeof(block->data) - 1;
++
++ if (xor8_buf(block, rsvd0_off, xor_len) != 0xff)
+ return -EINVAL;
+
+- if (xor8_buf(block, sizeof(*block)) != 0xff)
++ if (xor8_buf(block, 0, sizeof(*block)) != 0xff)
+ return -EINVAL;
+
+ return 0;
+ }
+
+-static void calc_block_sig(struct mlx5_cmd_prot_block *block, u8 token,
+- int csum)
++static void calc_block_sig(struct mlx5_cmd_prot_block *block)
+ {
+- block->token = token;
+- if (csum) {
+- block->ctrl_sig = ~xor8_buf(block->rsvd0, sizeof(*block) -
+- sizeof(block->data) - 2);
+- block->sig = ~xor8_buf(block, sizeof(*block) - 1);
+- }
++ int ctrl_xor_len = sizeof(*block) - sizeof(block->data) - 2;
++ size_t rsvd0_off = offsetof(struct mlx5_cmd_prot_block, rsvd0);
++
++ block->ctrl_sig = ~xor8_buf(block, rsvd0_off, ctrl_xor_len);
++ block->sig = ~xor8_buf(block, 0, sizeof(*block) - 1);
+ }
+
+-static void calc_chain_sig(struct mlx5_cmd_msg *msg, u8 token, int csum)
++static void calc_chain_sig(struct mlx5_cmd_msg *msg)
+ {
+ struct mlx5_cmd_mailbox *next = msg->next;
++ int size = msg->len;
++ int blen = size - min_t(int, sizeof(msg->first.data), size);
++ int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
++ / MLX5_CMD_DATA_BLOCK_SIZE;
++ int i = 0;
+
+- while (next) {
+- calc_block_sig(next->buf, token, csum);
++ for (i = 0; i < n && next; i++) {
++ calc_block_sig(next->buf);
+ next = next->next;
+ }
+ }
+
+ static void set_signature(struct mlx5_cmd_work_ent *ent, int csum)
+ {
+- ent->lay->sig = ~xor8_buf(ent->lay, sizeof(*ent->lay));
+- calc_chain_sig(ent->in, ent->token, csum);
+- calc_chain_sig(ent->out, ent->token, csum);
++ ent->lay->sig = ~xor8_buf(ent->lay, 0, sizeof(*ent->lay));
++ if (csum) {
++ calc_chain_sig(ent->in);
++ calc_chain_sig(ent->out);
++ }
+ }
+
+ static void poll_timeout(struct mlx5_cmd_work_ent *ent)
+@@ -222,12 +231,17 @@ static int verify_signature(struct mlx5_
+ struct mlx5_cmd_mailbox *next = ent->out->next;
+ int err;
+ u8 sig;
++ int size = ent->out->len;
++ int blen = size - min_t(int, sizeof(ent->out->first.data), size);
++ int n = (blen + MLX5_CMD_DATA_BLOCK_SIZE - 1)
++ / MLX5_CMD_DATA_BLOCK_SIZE;
++ int i = 0;
+
+- sig = xor8_buf(ent->lay, sizeof(*ent->lay));
++ sig = xor8_buf(ent->lay, 0, sizeof(*ent->lay));
+ if (sig != 0xff)
+ return -EINVAL;
+
+- while (next) {
++ for (i = 0; i < n && next; i++) {
+ err = verify_block_sig(next->buf);
+ if (err)
+ return err;
+@@ -641,7 +655,6 @@ static void cmd_work_handler(struct work
+ spin_unlock_irqrestore(&cmd->alloc_lock, flags);
+ }
+
+- ent->token = alloc_token(cmd);
+ cmd->ent_arr[ent->idx] = ent;
+ lay = get_inst(cmd, ent->idx);
+ ent->lay = lay;
+@@ -755,7 +768,8 @@ static u8 *get_status_ptr(struct mlx5_ou
+ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
+ struct mlx5_cmd_msg *out, void *uout, int uout_size,
+ mlx5_cmd_cbk_t callback,
+- void *context, int page_queue, u8 *status)
++ void *context, int page_queue, u8 *status,
++ u8 token)
+ {
+ struct mlx5_cmd *cmd = &dev->cmd;
+ struct mlx5_cmd_work_ent *ent;
+@@ -772,6 +786,8 @@ static int mlx5_cmd_invoke(struct mlx5_c
+ if (IS_ERR(ent))
+ return PTR_ERR(ent);
+
++ ent->token = token;
++
+ if (!callback)
+ init_completion(&ent->done);
+
+@@ -844,7 +860,8 @@ static const struct file_operations fops
+ .write = dbg_write,
+ };
+
+-static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size)
++static int mlx5_copy_to_msg(struct mlx5_cmd_msg *to, void *from, int size,
++ u8 token)
+ {
+ struct mlx5_cmd_prot_block *block;
+ struct mlx5_cmd_mailbox *next;
+@@ -870,6 +887,7 @@ static int mlx5_copy_to_msg(struct mlx5_
+ memcpy(block->data, from, copy);
+ from += copy;
+ size -= copy;
++ block->token = token;
+ next = next->next;
+ }
+
+@@ -939,7 +957,8 @@ static void free_cmd_box(struct mlx5_cor
+ }
+
+ static struct mlx5_cmd_msg *mlx5_alloc_cmd_msg(struct mlx5_core_dev *dev,
+- gfp_t flags, int size)
++ gfp_t flags, int size,
++ u8 token)
+ {
+ struct mlx5_cmd_mailbox *tmp, *head = NULL;
+ struct mlx5_cmd_prot_block *block;
+@@ -968,6 +987,7 @@ static struct mlx5_cmd_msg *mlx5_alloc_c
+ tmp->next = head;
+ block->next = cpu_to_be64(tmp->next ? tmp->next->dma : 0);
+ block->block_num = cpu_to_be32(n - i - 1);
++ block->token = token;
+ head = tmp;
+ }
+ msg->next = head;
+@@ -1351,7 +1371,7 @@ static struct mlx5_cmd_msg *alloc_msg(st
+ }
+
+ if (IS_ERR(msg))
+- msg = mlx5_alloc_cmd_msg(dev, gfp, in_size);
++ msg = mlx5_alloc_cmd_msg(dev, gfp, in_size, 0);
+
+ return msg;
+ }
+@@ -1376,6 +1396,7 @@ static int cmd_exec(struct mlx5_core_dev
+ int err;
+ u8 status = 0;
+ u32 drv_synd;
++ u8 token;
+
+ if (pci_channel_offline(dev->pdev) ||
+ dev->state == MLX5_DEVICE_STATE_INTERNAL_ERROR) {
+@@ -1394,20 +1415,22 @@ static int cmd_exec(struct mlx5_core_dev
+ return err;
+ }
+
+- err = mlx5_copy_to_msg(inb, in, in_size);
++ token = alloc_token(&dev->cmd);
++
++ err = mlx5_copy_to_msg(inb, in, in_size, token);
+ if (err) {
+ mlx5_core_warn(dev, "err %d\n", err);
+ goto out_in;
+ }
+
+- outb = mlx5_alloc_cmd_msg(dev, gfp, out_size);
++ outb = mlx5_alloc_cmd_msg(dev, gfp, out_size, token);
+ if (IS_ERR(outb)) {
+ err = PTR_ERR(outb);
+ goto out_in;
+ }
+
+ err = mlx5_cmd_invoke(dev, inb, outb, out, out_size, callback, context,
+- pages_queue, &status);
++ pages_queue, &status, token);
+ if (err)
+ goto out_out;
+
+@@ -1475,7 +1498,7 @@ static int create_msg_cache(struct mlx5_
+ INIT_LIST_HEAD(&cmd->cache.med.head);
+
+ for (i = 0; i < NUM_LONG_LISTS; i++) {
+- msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE);
++ msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, LONG_LIST_SIZE, 0);
+ if (IS_ERR(msg)) {
+ err = PTR_ERR(msg);
+ goto ex_err;
+@@ -1485,7 +1508,7 @@ static int create_msg_cache(struct mlx5_
+ }
+
+ for (i = 0; i < NUM_MED_LISTS; i++) {
+- msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE);
++ msg = mlx5_alloc_cmd_msg(dev, GFP_KERNEL, MED_LIST_SIZE, 0);
+ if (IS_ERR(msg)) {
+ err = PTR_ERR(msg);
+ goto ex_err;
--- /dev/null
+From foo@baz Wed Sep 21 12:45:10 CEST 2016
+From: Russell King <rmk+kernel@armlinux.org.uk>
+Date: Sat, 27 Aug 2016 17:33:03 +0100
+Subject: net: smc91x: fix SMC accesses
+
+From: Russell King <rmk+kernel@armlinux.org.uk>
+
+
+[ Upstream commit 2fb04fdf30192ff1e2b5834e9b7745889ea8bbcb ]
+
+Commit b70661c70830 ("net: smc91x: use run-time configuration on all ARM
+machines") broke some ARM platforms through several mistakes. Firstly,
+the access size must correspond to the following rule:
+
+(a) at least one of 16-bit or 8-bit access size must be supported
+(b) 32-bit accesses are optional, and may be enabled in addition to
+ the above.
+
+Secondly, it provides no emulation of 16-bit accesses, instead blindly
+making 16-bit accesses even when the platform specifies that only 8-bit
+is supported.
+
+Reorganise smc91x.h so we can make use of the existing 16-bit access
+emulation already provided - if 16-bit accesses are supported, use
+16-bit accesses directly, otherwise if 8-bit accesses are supported,
+use the provided 16-bit access emulation. If neither, BUG(). This
+exactly reflects the driver behaviour prior to the commit being fixed.
+
+Since the conversion incorrectly cut down the available access sizes on
+several platforms, we also need to go through every platform and fix up
+the overly-restrictive access size: Arnd assumed that if a platform can
+perform 32-bit, 16-bit and 8-bit accesses, then only a 32-bit access
+size needed to be specified - not so, all available access sizes must
+be specified.
+
+This likely fixes some performance regressions in doing this: if a
+platform does not support 8-bit accesses, 8-bit accesses have been
+emulated by performing a 16-bit read-modify-write access.
+
+Tested on the Intel Assabet/Neponset platform, which supports only 8-bit
+accesses, which was broken by the original commit.
+
+Fixes: b70661c70830 ("net: smc91x: use run-time configuration on all ARM machines")
+Signed-off-by: Russell King <rmk+kernel@armlinux.org.uk>
+Tested-by: Robert Jarzmik <robert.jarzmik@free.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/arm/mach-pxa/idp.c | 3 -
+ arch/arm/mach-pxa/xcep.c | 3 -
+ arch/arm/mach-realview/core.c | 3 -
+ arch/arm/mach-sa1100/pleb.c | 2
+ arch/blackfin/mach-bf561/boards/cm_bf561.c | 3 -
+ arch/blackfin/mach-bf561/boards/ezkit.c | 3 -
+ drivers/net/ethernet/smsc/smc91x.c | 7 +++
+ drivers/net/ethernet/smsc/smc91x.h | 65 ++++++++++++++++++++---------
+ include/linux/smc91x.h | 10 ++++
+ 9 files changed, 73 insertions(+), 26 deletions(-)
+
+--- a/arch/arm/mach-pxa/idp.c
++++ b/arch/arm/mach-pxa/idp.c
+@@ -83,7 +83,8 @@ static struct resource smc91x_resources[
+ };
+
+ static struct smc91x_platdata smc91x_platdata = {
+- .flags = SMC91X_USE_32BIT | SMC91X_USE_DMA | SMC91X_NOWAIT,
++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
++ SMC91X_USE_DMA | SMC91X_NOWAIT,
+ };
+
+ static struct platform_device smc91x_device = {
+--- a/arch/arm/mach-pxa/xcep.c
++++ b/arch/arm/mach-pxa/xcep.c
+@@ -120,7 +120,8 @@ static struct resource smc91x_resources[
+ };
+
+ static struct smc91x_platdata xcep_smc91x_info = {
+- .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT | SMC91X_USE_DMA,
++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
++ SMC91X_NOWAIT | SMC91X_USE_DMA,
+ };
+
+ static struct platform_device smc91x_device = {
+--- a/arch/arm/mach-realview/core.c
++++ b/arch/arm/mach-realview/core.c
+@@ -95,7 +95,8 @@ static struct smsc911x_platform_config s
+ };
+
+ static struct smc91x_platdata smc91x_platdata = {
+- .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
++ SMC91X_NOWAIT,
+ };
+
+ static struct platform_device realview_eth_device = {
+--- a/arch/arm/mach-sa1100/pleb.c
++++ b/arch/arm/mach-sa1100/pleb.c
+@@ -45,7 +45,7 @@ static struct resource smc91x_resources[
+ };
+
+ static struct smc91x_platdata smc91x_platdata = {
+- .flags = SMC91X_USE_16BIT | SMC91X_NOWAIT,
++ .flags = SMC91X_USE_16BIT | SMC91X_USE_8BIT | SMC91X_NOWAIT,
+ };
+
+ static struct platform_device smc91x_device = {
+--- a/arch/blackfin/mach-bf561/boards/cm_bf561.c
++++ b/arch/blackfin/mach-bf561/boards/cm_bf561.c
+@@ -146,7 +146,8 @@ static struct platform_device hitachi_fb
+ #include <linux/smc91x.h>
+
+ static struct smc91x_platdata smc91x_info = {
+- .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
++ SMC91X_NOWAIT,
+ .leda = RPC_LED_100_10,
+ .ledb = RPC_LED_TX_RX,
+ };
+--- a/arch/blackfin/mach-bf561/boards/ezkit.c
++++ b/arch/blackfin/mach-bf561/boards/ezkit.c
+@@ -134,7 +134,8 @@ static struct platform_device net2272_bf
+ #include <linux/smc91x.h>
+
+ static struct smc91x_platdata smc91x_info = {
+- .flags = SMC91X_USE_32BIT | SMC91X_NOWAIT,
++ .flags = SMC91X_USE_8BIT | SMC91X_USE_16BIT | SMC91X_USE_32BIT |
++ SMC91X_NOWAIT,
+ .leda = RPC_LED_100_10,
+ .ledb = RPC_LED_TX_RX,
+ };
+--- a/drivers/net/ethernet/smsc/smc91x.c
++++ b/drivers/net/ethernet/smsc/smc91x.c
+@@ -2269,6 +2269,13 @@ static int smc_drv_probe(struct platform
+ if (pd) {
+ memcpy(&lp->cfg, pd, sizeof(lp->cfg));
+ lp->io_shift = SMC91X_IO_SHIFT(lp->cfg.flags);
++
++ if (!SMC_8BIT(lp) && !SMC_16BIT(lp)) {
++ dev_err(&pdev->dev,
++ "at least one of 8-bit or 16-bit access support is required.\n");
++ ret = -ENXIO;
++ goto out_free_netdev;
++ }
+ }
+
+ #if IS_BUILTIN(CONFIG_OF)
+--- a/drivers/net/ethernet/smsc/smc91x.h
++++ b/drivers/net/ethernet/smsc/smc91x.h
+@@ -37,6 +37,27 @@
+ #include <linux/smc91x.h>
+
+ /*
++ * Any 16-bit access is performed with two 8-bit accesses if the hardware
++ * can't do it directly. Most registers are 16-bit so those are mandatory.
++ */
++#define SMC_outw_b(x, a, r) \
++ do { \
++ unsigned int __val16 = (x); \
++ unsigned int __reg = (r); \
++ SMC_outb(__val16, a, __reg); \
++ SMC_outb(__val16 >> 8, a, __reg + (1 << SMC_IO_SHIFT)); \
++ } while (0)
++
++#define SMC_inw_b(a, r) \
++ ({ \
++ unsigned int __val16; \
++ unsigned int __reg = r; \
++ __val16 = SMC_inb(a, __reg); \
++ __val16 |= SMC_inb(a, __reg + (1 << SMC_IO_SHIFT)) << 8; \
++ __val16; \
++ })
++
++/*
+ * Define your architecture specific bus configuration parameters here.
+ */
+
+@@ -55,10 +76,30 @@
+ #define SMC_IO_SHIFT (lp->io_shift)
+
+ #define SMC_inb(a, r) readb((a) + (r))
+-#define SMC_inw(a, r) readw((a) + (r))
++#define SMC_inw(a, r) \
++ ({ \
++ unsigned int __smc_r = r; \
++ SMC_16BIT(lp) ? readw((a) + __smc_r) : \
++ SMC_8BIT(lp) ? SMC_inw_b(a, __smc_r) : \
++ ({ BUG(); 0; }); \
++ })
++
+ #define SMC_inl(a, r) readl((a) + (r))
+ #define SMC_outb(v, a, r) writeb(v, (a) + (r))
++#define SMC_outw(v, a, r) \
++ do { \
++ unsigned int __v = v, __smc_r = r; \
++ if (SMC_16BIT(lp)) \
++ __SMC_outw(__v, a, __smc_r); \
++ else if (SMC_8BIT(lp)) \
++ SMC_outw_b(__v, a, __smc_r); \
++ else \
++ BUG(); \
++ } while (0)
++
+ #define SMC_outl(v, a, r) writel(v, (a) + (r))
++#define SMC_insb(a, r, p, l) readsb((a) + (r), p, l)
++#define SMC_outsb(a, r, p, l) writesb((a) + (r), p, l)
+ #define SMC_insw(a, r, p, l) readsw((a) + (r), p, l)
+ #define SMC_outsw(a, r, p, l) writesw((a) + (r), p, l)
+ #define SMC_insl(a, r, p, l) readsl((a) + (r), p, l)
+@@ -66,7 +107,7 @@
+ #define SMC_IRQ_FLAGS (-1) /* from resource */
+
+ /* We actually can't write halfwords properly if not word aligned */
+-static inline void SMC_outw(u16 val, void __iomem *ioaddr, int reg)
++static inline void __SMC_outw(u16 val, void __iomem *ioaddr, int reg)
+ {
+ if ((machine_is_mainstone() || machine_is_stargate2() ||
+ machine_is_pxa_idp()) && reg & 2) {
+@@ -405,24 +446,8 @@ smc_pxa_dma_insw(void __iomem *ioaddr, s
+
+ #if ! SMC_CAN_USE_16BIT
+
+-/*
+- * Any 16-bit access is performed with two 8-bit accesses if the hardware
+- * can't do it directly. Most registers are 16-bit so those are mandatory.
+- */
+-#define SMC_outw(x, ioaddr, reg) \
+- do { \
+- unsigned int __val16 = (x); \
+- SMC_outb( __val16, ioaddr, reg ); \
+- SMC_outb( __val16 >> 8, ioaddr, reg + (1 << SMC_IO_SHIFT));\
+- } while (0)
+-#define SMC_inw(ioaddr, reg) \
+- ({ \
+- unsigned int __val16; \
+- __val16 = SMC_inb( ioaddr, reg ); \
+- __val16 |= SMC_inb( ioaddr, reg + (1 << SMC_IO_SHIFT)) << 8; \
+- __val16; \
+- })
+-
++#define SMC_outw(x, ioaddr, reg) SMC_outw_b(x, ioaddr, reg)
++#define SMC_inw(ioaddr, reg) SMC_inw_b(ioaddr, reg)
+ #define SMC_insw(a, r, p, l) BUG()
+ #define SMC_outsw(a, r, p, l) BUG()
+
+--- a/include/linux/smc91x.h
++++ b/include/linux/smc91x.h
+@@ -1,6 +1,16 @@
+ #ifndef __SMC91X_H__
+ #define __SMC91X_H__
+
++/*
++ * These bits define which access sizes a platform can support, rather
++ * than the maximal access size. So, if your platform can do 16-bit
++ * and 32-bit accesses to the SMC91x device, but not 8-bit, set both
++ * SMC91X_USE_16BIT and SMC91X_USE_32BIT.
++ *
++ * The SMC91x driver requires at least one of SMC91X_USE_8BIT or
++ * SMC91X_USE_16BIT to be supported - just setting SMC91X_USE_32BIT is
++ * an invalid configuration.
++ */
+ #define SMC91X_USE_8BIT (1 << 0)
+ #define SMC91X_USE_16BIT (1 << 1)
+ #define SMC91X_USE_32BIT (1 << 2)
--- /dev/null
+From foo@baz Wed Sep 21 12:45:10 CEST 2016
+From: Xander Huff <xander.huff@ni.com>
+Date: Wed, 24 Aug 2016 16:47:53 -0500
+Subject: Revert "phy: IRQ cannot be shared"
+
+From: Xander Huff <xander.huff@ni.com>
+
+
+[ Upstream commit c3e70edd7c2eed6acd234627a6007627f5c76e8e ]
+
+This reverts:
+ commit 33c133cc7598 ("phy: IRQ cannot be shared")
+
+On hardware with multiple PHY devices hooked up to the same IRQ line, allow
+them to share it.
+
+Sergei Shtylyov says:
+ "I'm not sure now what was the reason I concluded that the IRQ sharing
+ was impossible... most probably I thought that the kernel IRQ handling
+ code exited the loop over the IRQ actions once IRQ_HANDLED was returned
+ -- which is obviously not so in reality..."
+
+Signed-off-by: Xander Huff <xander.huff@ni.com>
+Signed-off-by: Nathan Sullivan <nathan.sullivan@ni.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/phy.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/phy/phy.c
++++ b/drivers/net/phy/phy.c
+@@ -640,8 +640,10 @@ phy_err:
+ int phy_start_interrupts(struct phy_device *phydev)
+ {
+ atomic_set(&phydev->irq_disable, 0);
+- if (request_irq(phydev->irq, phy_interrupt, 0, "phy_interrupt",
+- phydev) < 0) {
++ if (request_irq(phydev->irq, phy_interrupt,
++ IRQF_SHARED,
++ "phy_interrupt",
++ phydev) < 0) {
+ pr_warn("%s: Can't get IRQ %d (PHY)\n",
+ phydev->bus->name, phydev->irq);
+ phydev->irq = PHY_POLL;
bonding-fix-bonding-crash.patch
revert-af_unix-fix-splice-bind-deadlock.patch
af_unix-split-u-readlock-into-two-iolock-and-bindlock.patch
+vti-flush-x-netns-xfrm-cache-when-vti-interface-is-removed.patch
+net-irda-handle-iriap_register_lsap-allocation-failure.patch
+tipc-fix-null-pointer-dereference-in-shutdown.patch
+net-mlx5-added-missing-check-of-msg-length-in-verifying-its-signature.patch
+net-dsa-bcm_sf2-fix-race-condition-while-unmasking-interrupts.patch
+revert-phy-irq-cannot-be-shared.patch
+net-smc91x-fix-smc-accesses.patch
+bridge-re-introduce-fix-parsing-of-mldv2-reports.patch
--- /dev/null
+From foo@baz Wed Sep 21 12:45:10 CEST 2016
+From: Vegard Nossum <vegard.nossum@oracle.com>
+Date: Sat, 23 Jul 2016 08:15:04 +0200
+Subject: tipc: fix NULL pointer dereference in shutdown()
+
+From: Vegard Nossum <vegard.nossum@oracle.com>
+
+
+[ Upstream commit d2fbdf76b85bcdfe57b8ef2ba09d20e8ada79abd ]
+
+tipc_msg_create() can return a NULL skb and if so, we shouldn't try to
+call tipc_node_xmit_skb() on it.
+
+ general protection fault: 0000 [#1] PREEMPT SMP KASAN
+ CPU: 3 PID: 30298 Comm: trinity-c0 Not tainted 4.7.0-rc7+ #19
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
+ task: ffff8800baf09980 ti: ffff8800595b8000 task.ti: ffff8800595b8000
+ RIP: 0010:[<ffffffff830bb46b>] [<ffffffff830bb46b>] tipc_node_xmit_skb+0x6b/0x140
+ RSP: 0018:ffff8800595bfce8 EFLAGS: 00010246
+ RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000003023b0e0
+ RDX: 0000000000000000 RSI: dffffc0000000000 RDI: ffffffff83d12580
+ RBP: ffff8800595bfd78 R08: ffffed000b2b7f32 R09: 0000000000000000
+ R10: fffffbfff0759725 R11: 0000000000000000 R12: 1ffff1000b2b7f9f
+ R13: ffff8800595bfd58 R14: ffffffff83d12580 R15: dffffc0000000000
+ FS: 00007fcdde242700(0000) GS:ffff88011af80000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00007fcddde1db10 CR3: 000000006874b000 CR4: 00000000000006e0
+ DR0: 00007fcdde248000 DR1: 00007fcddd73d000 DR2: 00007fcdde248000
+ DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000090602
+ Stack:
+ 0000000000000018 0000000000000018 0000000041b58ab3 ffffffff83954208
+ ffffffff830bb400 ffff8800595bfd30 ffffffff8309d767 0000000000000018
+ 0000000000000018 ffff8800595bfd78 ffffffff8309da1a 00000000810ee611
+ Call Trace:
+ [<ffffffff830c84a3>] tipc_shutdown+0x553/0x880
+ [<ffffffff825b4a3b>] SyS_shutdown+0x14b/0x170
+ [<ffffffff8100334c>] do_syscall_64+0x19c/0x410
+ [<ffffffff83295ca5>] entry_SYSCALL64_slow_path+0x25/0x25
+ Code: 90 00 b4 0b 83 c7 00 f1 f1 f1 f1 4c 8d 6d e0 c7 40 04 00 00 00 f4 c7 40 08 f3 f3 f3 f3 48 89 d8 48 c1 e8 03 c7 45 b4 00 00 00 00 <80> 3c 30 00 75 78 48 8d 7b 08 49 8d 75 c0 48 b8 00 00 00 00 00
+ RIP [<ffffffff830bb46b>] tipc_node_xmit_skb+0x6b/0x140
+ RSP <ffff8800595bfce8>
+ ---[ end trace 57b0484e351e71f1 ]---
+
+I feel like we should maybe return -ENOMEM or -ENOBUFS, but I'm not sure
+userspace is equipped to handle that. Anyway, this is better than a GPF
+and looks somewhat consistent with other tipc_msg_create() callers.
+
+Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Acked-by: Jon Maloy <jon.maloy@ericsson.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/socket.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -2111,7 +2111,8 @@ restart:
+ TIPC_CONN_MSG, SHORT_H_SIZE,
+ 0, dnode, onode, dport, oport,
+ TIPC_CONN_SHUTDOWN);
+- tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
++ if (skb)
++ tipc_node_xmit_skb(net, skb, dnode, tsk->portid);
+ }
+ tsk->connected = 0;
+ sock->state = SS_DISCONNECTING;
--- /dev/null
+From foo@baz Wed Sep 21 12:45:10 CEST 2016
+From: Lance Richardson <lrichard@redhat.com>
+Date: Tue, 9 Aug 2016 15:29:42 -0400
+Subject: vti: flush x-netns xfrm cache when vti interface is removed
+
+From: Lance Richardson <lrichard@redhat.com>
+
+
+[ Upstream commit a5d0dc810abf3d6b241777467ee1d6efb02575fc ]
+
+When executing the script included below, the netns delete operation
+hangs with the following message (repeated at 10 second intervals):
+
+ kernel:unregister_netdevice: waiting for lo to become free. Usage count = 1
+
+This occurs because a reference to the lo interface in the "secure" netns
+is still held by a dst entry in the xfrm bundle cache in the init netns.
+
+Address this problem by garbage collecting the tunnel netns flow cache
+when a cross-namespace vti interface receives a NETDEV_DOWN notification.
+
+A more detailed description of the problem scenario (referencing commands
+in the script below):
+
+(1) ip link add vti_test type vti local 1.1.1.1 remote 1.1.1.2 key 1
+
+ The vti_test interface is created in the init namespace. vti_tunnel_init()
+ attaches a struct ip_tunnel to the vti interface's netdev_priv(dev),
+ setting the tunnel net to &init_net.
+
+(2) ip link set vti_test netns secure
+
+ The vti_test interface is moved to the "secure" netns. Note that
+ the associated struct ip_tunnel still has tunnel->net set to &init_net.
+
+(3) ip netns exec secure ping -c 4 -i 0.02 -I 192.168.100.1 192.168.200.1
+
+ The first packet sent using the vti device causes xfrm_lookup() to be
+ called as follows:
+
+ dst = xfrm_lookup(tunnel->net, skb_dst(skb), fl, NULL, 0);
+
+ Note that tunnel->net is the init namespace, while skb_dst(skb) references
+ the vti_test interface in the "secure" namespace. The returned dst
+ references an interface in the init namespace.
+
+ Also note that the first parameter to xfrm_lookup() determines which flow
+ cache is used to store the computed xfrm bundle, so after xfrm_lookup()
+ returns there will be a cached bundle in the init namespace flow cache
+ with a dst referencing a device in the "secure" namespace.
+
+(4) ip netns del secure
+
+ Kernel begins to delete the "secure" namespace. At some point the
+ vti_test interface is deleted, at which point dst_ifdown() changes
+ the dst->dev in the cached xfrm bundle flow from vti_test to lo (still
+ in the "secure" namespace however).
+ Since nothing has happened to cause the init namespace's flow cache
+ to be garbage collected, this dst remains attached to the flow cache,
+ so the kernel loops waiting for the last reference to lo to go away.
+
+<Begin script>
+ip link add br1 type bridge
+ip link set dev br1 up
+ip addr add dev br1 1.1.1.1/8
+
+ip netns add secure
+ip link add vti_test type vti local 1.1.1.1 remote 1.1.1.2 key 1
+ip link set vti_test netns secure
+ip netns exec secure ip link set vti_test up
+ip netns exec secure ip link s lo up
+ip netns exec secure ip addr add dev lo 192.168.100.1/24
+ip netns exec secure ip route add 192.168.200.0/24 dev vti_test
+ip xfrm policy flush
+ip xfrm state flush
+ip xfrm policy add dir out tmpl src 1.1.1.1 dst 1.1.1.2 \
+ proto esp mode tunnel mark 1
+ip xfrm policy add dir in tmpl src 1.1.1.2 dst 1.1.1.1 \
+ proto esp mode tunnel mark 1
+ip xfrm state add src 1.1.1.1 dst 1.1.1.2 proto esp spi 1 \
+ mode tunnel enc des3_ede 0x112233445566778811223344556677881122334455667788
+ip xfrm state add src 1.1.1.2 dst 1.1.1.1 proto esp spi 1 \
+ mode tunnel enc des3_ede 0x112233445566778811223344556677881122334455667788
+
+ip netns exec secure ping -c 4 -i 0.02 -I 192.168.100.1 192.168.200.1
+
+ip netns del secure
+<End script>
+
+Reported-by: Hangbin Liu <haliu@redhat.com>
+Reported-by: Jan Tluka <jtluka@redhat.com>
+Signed-off-by: Lance Richardson <lrichard@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/ip_vti.c | 31 +++++++++++++++++++++++++++++++
+ 1 file changed, 31 insertions(+)
+
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -540,6 +540,33 @@ static struct rtnl_link_ops vti_link_ops
+ .get_link_net = ip_tunnel_get_link_net,
+ };
+
++static bool is_vti_tunnel(const struct net_device *dev)
++{
++ return dev->netdev_ops == &vti_netdev_ops;
++}
++
++static int vti_device_event(struct notifier_block *unused,
++ unsigned long event, void *ptr)
++{
++ struct net_device *dev = netdev_notifier_info_to_dev(ptr);
++ struct ip_tunnel *tunnel = netdev_priv(dev);
++
++ if (!is_vti_tunnel(dev))
++ return NOTIFY_DONE;
++
++ switch (event) {
++ case NETDEV_DOWN:
++ if (!net_eq(tunnel->net, dev_net(dev)))
++ xfrm_garbage_collect(tunnel->net);
++ break;
++ }
++ return NOTIFY_DONE;
++}
++
++static struct notifier_block vti_notifier_block __read_mostly = {
++ .notifier_call = vti_device_event,
++};
++
+ static int __init vti_init(void)
+ {
+ const char *msg;
+@@ -547,6 +574,8 @@ static int __init vti_init(void)
+
+ pr_info("IPv4 over IPsec tunneling driver\n");
+
++ register_netdevice_notifier(&vti_notifier_block);
++
+ msg = "tunnel device";
+ err = register_pernet_device(&vti_net_ops);
+ if (err < 0)
+@@ -579,6 +608,7 @@ xfrm_proto_ah_failed:
+ xfrm_proto_esp_failed:
+ unregister_pernet_device(&vti_net_ops);
+ pernet_dev_failed:
++ unregister_netdevice_notifier(&vti_notifier_block);
+ pr_err("vti init: failed to register %s\n", msg);
+ return err;
+ }
+@@ -590,6 +620,7 @@ static void __exit vti_fini(void)
+ xfrm4_protocol_deregister(&vti_ah4_protocol, IPPROTO_AH);
+ xfrm4_protocol_deregister(&vti_esp4_protocol, IPPROTO_ESP);
+ unregister_pernet_device(&vti_net_ops);
++ unregister_netdevice_notifier(&vti_notifier_block);
+ }
+
+ module_init(vti_init);
projects / thirdparty / kernel / stable-queue.git / commitdiff
