Merge branch 'mlx4-fixes'

Tariq Toukan says:

====================
mlx4_core misc fixes

This patchset by Jack contains misc fixes to the mlx4 Core driver.

Patch 1 fixes a use-after-free situation by marking (nullifying) the pointer,
  please queue for -stable >= v4.0.
Patch 2 adds a missing lock acquire and release in SRIOV command interface,
  please queue for -stable >= v4.9.
Patch 3 avoids calling roundup_pow_of_two when argument is zero,
  please queue for -stable >= v3.3.

Series generated against net commit:
a3b1933d34d5 Merge tag 'mlx5-fixes-2019-03-11' of
git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 12 insertions, 3 deletions

diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
index c19e74e6ac94..a5d5d6fc1da0 100644
--- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
+++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
@@ -2645,6 +2645,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
         if (!priv->cmd.context)
                 return -ENOMEM;
 
+        if (mlx4_is_mfunc(dev))
+                mutex_lock(&priv->cmd.slave_cmd_mutex);
         down_write(&priv->cmd.switch_sem);
         for (i = 0; i < priv->cmd.max_cmds; ++i) {
                 priv->cmd.context[i].token = i;
@@ -2670,6 +2672,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
         down(&priv->cmd.poll_sem);
         priv->cmd.use_events = 1;
         up_write(&priv->cmd.switch_sem);
+        if (mlx4_is_mfunc(dev))
+                mutex_unlock(&priv->cmd.slave_cmd_mutex);
 
         return err;
 }
@@ -2682,6 +2686,8 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev)
         struct mlx4_priv *priv = mlx4_priv(dev);
         int i;
 
+        if (mlx4_is_mfunc(dev))
+                mutex_lock(&priv->cmd.slave_cmd_mutex);
         down_write(&priv->cmd.switch_sem);
         priv->cmd.use_events = 0;
 
@@ -2689,9 +2695,12 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev)
                 down(&priv->cmd.event_sem);
 
         kfree(priv->cmd.context);
+        priv->cmd.context = NULL;
 
         up(&priv->cmd.poll_sem);
         up_write(&priv->cmd.switch_sem);
+        if (mlx4_is_mfunc(dev))
+                mutex_unlock(&priv->cmd.slave_cmd_mutex);
 }
 
 struct mlx4_cmd_mailbox *mlx4_alloc_cmd_mailbox(struct mlx4_dev *dev)
diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
index eb13d3618162..4356f3a58002 100644
--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
@@ -2719,13 +2719,13 @@ static int qp_get_mtt_size(struct mlx4_qp_context *qpc)
         int total_pages;
         int total_mem;
         int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f;
+        int tot;
 
         sq_size = 1 << (log_sq_size + log_sq_sride + 4);
         rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4));
         total_mem = sq_size + rq_size;
-        total_pages =
-                roundup_pow_of_two((total_mem + (page_offset << 6)) >>
-                                   page_shift);
+        tot = (total_mem + (page_offset << 6)) >> page_shift;
+        total_pages = !tot ? 1 : roundup_pow_of_two(tot);
 
         return total_pages;
 }