]> git.ipfire.org Git - thirdparty/kernel/stable-queue.git/commitdiff
4.4-stable patches
authorGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 11 Sep 2020 09:15:00 +0000 (11:15 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 11 Sep 2020 09:15:00 +0000 (11:15 +0200)
added patches:
bnxt-don-t-enable-napi-until-rings-are-ready.patch
bnxt_en-failure-to-update-phy-is-not-fatal-condition.patch
net-disable-netpoll-on-fresh-napis.patch
net-ethernet-mlx4-fix-memory-allocation-in-mlx4_buddy_init.patch
net-usb-dm9601-add-usb-id-of-keenetic-plus-dsl.patch
ravb-fixed-to-be-able-to-unload-modules.patch
sctp-not-disable-bh-in-the-whole-sctp_get_port_local.patch

queue-4.4/bnxt-don-t-enable-napi-until-rings-are-ready.patch [new file with mode: 0644]
queue-4.4/bnxt_en-failure-to-update-phy-is-not-fatal-condition.patch [new file with mode: 0644]
queue-4.4/net-disable-netpoll-on-fresh-napis.patch [new file with mode: 0644]
queue-4.4/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_buddy_init.patch [new file with mode: 0644]
queue-4.4/net-usb-dm9601-add-usb-id-of-keenetic-plus-dsl.patch [new file with mode: 0644]
queue-4.4/ravb-fixed-to-be-able-to-unload-modules.patch [new file with mode: 0644]
queue-4.4/sctp-not-disable-bh-in-the-whole-sctp_get_port_local.patch [new file with mode: 0644]
queue-4.4/series

diff --git a/queue-4.4/bnxt-don-t-enable-napi-until-rings-are-ready.patch b/queue-4.4/bnxt-don-t-enable-napi-until-rings-are-ready.patch
new file mode 100644 (file)
index 0000000..3d7099f
--- /dev/null
@@ -0,0 +1,79 @@
+From 96ecdcc992eb7f468b2cf829b0f5408a1fad4668 Mon Sep 17 00:00:00 2001
+From: Jakub Kicinski <kuba@kernel.org>
+Date: Wed, 26 Aug 2020 12:40:07 -0700
+Subject: bnxt: don't enable NAPI until rings are ready
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+commit 96ecdcc992eb7f468b2cf829b0f5408a1fad4668 upstream.
+
+Netpoll can try to poll napi as soon as napi_enable() is called.
+It crashes trying to access a doorbell which is still NULL:
+
+ BUG: kernel NULL pointer dereference, address: 0000000000000000
+ CPU: 59 PID: 6039 Comm: ethtool Kdump: loaded Tainted: G S                5.9.0-rc1-00469-g5fd99b5d9950-dirty #26
+ RIP: 0010:bnxt_poll+0x121/0x1c0
+ Code: c4 20 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 41 8b 86 a0 01 00 00 41 23 85 18 01 00 00 49 8b 96 a8 01 00 00 0d 00 00 00 24 <89> 02
+41 f6 45 77 02 74 cb 49 8b ae d8 01 00 00 31 c0 c7 44 24 1a
+  netpoll_poll_dev+0xbd/0x1a0
+  __netpoll_send_skb+0x1b2/0x210
+  netpoll_send_udp+0x2c9/0x406
+  write_ext_msg+0x1d7/0x1f0
+  console_unlock+0x23c/0x520
+  vprintk_emit+0xe0/0x1d0
+  printk+0x58/0x6f
+  x86_vector_activate.cold+0xf/0x46
+  __irq_domain_activate_irq+0x50/0x80
+  __irq_domain_activate_irq+0x32/0x80
+  __irq_domain_activate_irq+0x32/0x80
+  irq_domain_activate_irq+0x25/0x40
+  __setup_irq+0x2d2/0x700
+  request_threaded_irq+0xfb/0x160
+  __bnxt_open_nic+0x3b1/0x750
+  bnxt_open_nic+0x19/0x30
+  ethtool_set_channels+0x1ac/0x220
+  dev_ethtool+0x11ba/0x2240
+  dev_ioctl+0x1cf/0x390
+  sock_do_ioctl+0x95/0x130
+
+Reported-by: Rob Sherwood <rsher@fb.com>
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c |    9 +++------
+ 1 file changed, 3 insertions(+), 6 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -4612,14 +4612,14 @@ static int __bnxt_open_nic(struct bnxt *
+               }
+       }
+-      bnxt_enable_napi(bp);
+-
+       rc = bnxt_init_nic(bp, irq_re_init);
+       if (rc) {
+               netdev_err(bp->dev, "bnxt_init_nic err: %x\n", rc);
+-              goto open_err;
++              goto open_err_irq;
+       }
++      bnxt_enable_napi(bp);
++
+       if (link_re_init) {
+               rc = bnxt_update_phy_setting(bp);
+               if (rc)
+@@ -4644,9 +4644,6 @@ static int __bnxt_open_nic(struct bnxt *
+       return 0;
+-open_err:
+-      bnxt_disable_napi(bp);
+-
+ open_err_irq:
+       bnxt_del_napi(bp);
diff --git a/queue-4.4/bnxt_en-failure-to-update-phy-is-not-fatal-condition.patch b/queue-4.4/bnxt_en-failure-to-update-phy-is-not-fatal-condition.patch
new file mode 100644 (file)
index 0000000..397c535
--- /dev/null
@@ -0,0 +1,32 @@
+From ba41d46fe03223279054e58d570069fdc62fb768 Mon Sep 17 00:00:00 2001
+From: Michael Chan <mchan@broadcom.com>
+Date: Fri, 19 Feb 2016 19:43:21 -0500
+Subject: bnxt_en: Failure to update PHY is not fatal condition.
+
+From: Michael Chan <mchan@broadcom.com>
+
+commit ba41d46fe03223279054e58d570069fdc62fb768 upstream.
+
+If we fail to update the PHY, we should print a warning and continue.
+The current code to exit is buggy as it has not freed up the NIC
+resources yet.
+
+Signed-off-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -4623,7 +4623,7 @@ static int __bnxt_open_nic(struct bnxt *
+       if (link_re_init) {
+               rc = bnxt_update_phy_setting(bp);
+               if (rc)
+-                      goto open_err;
++                      netdev_warn(bp->dev, "failed to update phy settings\n");
+       }
+       if (irq_re_init) {
diff --git a/queue-4.4/net-disable-netpoll-on-fresh-napis.patch b/queue-4.4/net-disable-netpoll-on-fresh-napis.patch
new file mode 100644 (file)
index 0000000..32dfa18
--- /dev/null
@@ -0,0 +1,59 @@
+From foo@baz Fri Sep 11 09:55:51 AM CEST 2020
+From: Jakub Kicinski <kuba@kernel.org>
+Date: Wed, 26 Aug 2020 12:40:06 -0700
+Subject: net: disable netpoll on fresh napis
+
+From: Jakub Kicinski <kuba@kernel.org>
+
+[ Upstream commit 96e97bc07e90f175a8980a22827faf702ca4cb30 ]
+
+napi_disable() makes sure to set the NAPI_STATE_NPSVC bit to prevent
+netpoll from accessing rings before init is complete. However, the
+same is not done for fresh napi instances in netif_napi_add(),
+even though we expect NAPI instances to be added as disabled.
+
+This causes crashes during driver reconfiguration (enabling XDP,
+changing the channel count) - if there is any printk() after
+netif_napi_add() but before napi_enable().
+
+To ensure memory ordering is correct we need to use RCU accessors.
+
+Reported-by: Rob Sherwood <rsher@fb.com>
+Fixes: 2d8bff12699a ("netpoll: Close race condition between poll_one_napi and napi_disable")
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/dev.c     |    3 ++-
+ net/core/netpoll.c |    2 +-
+ 2 files changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -4849,13 +4849,14 @@ void netif_napi_add(struct net_device *d
+               pr_err_once("netif_napi_add() called with weight %d on device %s\n",
+                           weight, dev->name);
+       napi->weight = weight;
+-      list_add(&napi->dev_list, &dev->napi_list);
+       napi->dev = dev;
+ #ifdef CONFIG_NETPOLL
+       spin_lock_init(&napi->poll_lock);
+       napi->poll_owner = -1;
+ #endif
+       set_bit(NAPI_STATE_SCHED, &napi->state);
++      set_bit(NAPI_STATE_NPSVC, &napi->state);
++      list_add_rcu(&napi->dev_list, &dev->napi_list);
+ }
+ EXPORT_SYMBOL(netif_napi_add);
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -178,7 +178,7 @@ static void poll_napi(struct net_device
+ {
+       struct napi_struct *napi;
+-      list_for_each_entry(napi, &dev->napi_list, dev_list) {
++      list_for_each_entry_rcu(napi, &dev->napi_list, dev_list) {
+               if (napi->poll_owner != smp_processor_id() &&
+                   spin_trylock(&napi->poll_lock)) {
+                       poll_one_napi(napi);
diff --git a/queue-4.4/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_buddy_init.patch b/queue-4.4/net-ethernet-mlx4-fix-memory-allocation-in-mlx4_buddy_init.patch
new file mode 100644 (file)
index 0000000..f32e6af
--- /dev/null
@@ -0,0 +1,40 @@
+From cbedcb044e9cc4e14bbe6658111224bb923094f4 Mon Sep 17 00:00:00 2001
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Date: Mon, 31 Aug 2020 22:37:09 +0800
+Subject: net: ethernet: mlx4: Fix memory allocation in mlx4_buddy_init()
+
+From: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+
+commit cbedcb044e9cc4e14bbe6658111224bb923094f4 upstream.
+
+On machines with much memory (> 2 TByte) and log_mtts_per_seg == 0, a
+max_order of 31 will be passed to mlx_buddy_init(), which results in
+s = BITS_TO_LONGS(1 << 31) becoming a negative value, leading to
+kvmalloc_array() failure when it is converted to size_t.
+
+  mlx4_core 0000:b1:00.0: Failed to initialize memory region table, aborting
+  mlx4_core: probe of 0000:b1:00.0 failed with error -12
+
+Fix this issue by changing the left shifting operand from a signed literal to
+an unsigned one.
+
+Fixes: 225c7b1feef1 ("IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters")
+Signed-off-by: Shung-Hsi Yu <shung-hsi.yu@suse.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlx4/mr.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/mr.c
++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c
+@@ -114,7 +114,7 @@ static int mlx4_buddy_init(struct mlx4_b
+               goto err_out;
+       for (i = 0; i <= buddy->max_order; ++i) {
+-              s = BITS_TO_LONGS(1 << (buddy->max_order - i));
++              s = BITS_TO_LONGS(1UL << (buddy->max_order - i));
+               buddy->bits[i] = kcalloc(s, sizeof (long), GFP_KERNEL | __GFP_NOWARN);
+               if (!buddy->bits[i]) {
+                       buddy->bits[i] = vzalloc(s * sizeof(long));
diff --git a/queue-4.4/net-usb-dm9601-add-usb-id-of-keenetic-plus-dsl.patch b/queue-4.4/net-usb-dm9601-add-usb-id-of-keenetic-plus-dsl.patch
new file mode 100644 (file)
index 0000000..27ee88d
--- /dev/null
@@ -0,0 +1,31 @@
+From foo@baz Fri Sep 11 09:56:05 AM CEST 2020
+From: Kamil Lorenc <kamil@re-ws.pl>
+Date: Tue, 1 Sep 2020 10:57:38 +0200
+Subject: net: usb: dm9601: Add USB ID of Keenetic Plus DSL
+
+From: Kamil Lorenc <kamil@re-ws.pl>
+
+[ Upstream commit a609d0259183a841621f252e067f40f8cc25d6f6 ]
+
+Keenetic Plus DSL is a xDSL modem that uses dm9620 as its USB interface.
+
+Signed-off-by: Kamil Lorenc <kamil@re-ws.pl>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/dm9601.c |    4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/usb/dm9601.c
++++ b/drivers/net/usb/dm9601.c
+@@ -624,6 +624,10 @@ static const struct usb_device_id produc
+        USB_DEVICE(0x0a46, 0x1269),    /* DM9621A USB to Fast Ethernet Adapter */
+        .driver_info = (unsigned long)&dm9601_info,
+       },
++      {
++       USB_DEVICE(0x0586, 0x3427),    /* ZyXEL Keenetic Plus DSL xDSL modem */
++       .driver_info = (unsigned long)&dm9601_info,
++      },
+       {},                     // END
+ };
diff --git a/queue-4.4/ravb-fixed-to-be-able-to-unload-modules.patch b/queue-4.4/ravb-fixed-to-be-able-to-unload-modules.patch
new file mode 100644 (file)
index 0000000..602c847
--- /dev/null
@@ -0,0 +1,203 @@
+From 1838d6c62f57836639bd3d83e7855e0ee4f6defc Mon Sep 17 00:00:00 2001
+From: Yuusuke Ashizuka <ashiduka@fujitsu.com>
+Date: Thu, 20 Aug 2020 18:43:07 +0900
+Subject: ravb: Fixed to be able to unload modules
+
+From: Yuusuke Ashizuka <ashiduka@fujitsu.com>
+
+commit 1838d6c62f57836639bd3d83e7855e0ee4f6defc upstream.
+
+When this driver is built as a module, I cannot rmmod it after insmoding
+it.
+This is because that this driver calls ravb_mdio_init() at the time of
+probe, and module->refcnt is incremented by alloc_mdio_bitbang() called
+after that.
+Therefore, even if ifup is not performed, the driver is in use and rmmod
+cannot be performed.
+
+$ lsmod
+Module                  Size  Used by
+ravb                   40960  1
+$ rmmod ravb
+rmmod: ERROR: Module ravb is in use
+
+Call ravb_mdio_init() at open and free_mdio_bitbang() at close, thereby
+rmmod is possible in the ifdown state.
+
+Fixes: c156633f1353 ("Renesas Ethernet AVB driver proper")
+Signed-off-by: Yuusuke Ashizuka <ashiduka@fujitsu.com>
+Reviewed-by: Sergei Shtylyov <sergei.shtylyov@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/renesas/ravb_main.c |  110 +++++++++++++++----------------
+ 1 file changed, 55 insertions(+), 55 deletions(-)
+
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1214,12 +1214,64 @@ static const struct ethtool_ops ravb_eth
+       .get_ts_info            = ravb_get_ts_info,
+ };
++/* MDIO bus init function */
++static int ravb_mdio_init(struct ravb_private *priv)
++{
++      struct platform_device *pdev = priv->pdev;
++      struct device *dev = &pdev->dev;
++      int error;
++
++      /* Bitbang init */
++      priv->mdiobb.ops = &bb_ops;
++
++      /* MII controller setting */
++      priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
++      if (!priv->mii_bus)
++              return -ENOMEM;
++
++      /* Hook up MII support for ethtool */
++      priv->mii_bus->name = "ravb_mii";
++      priv->mii_bus->parent = dev;
++      snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
++               pdev->name, pdev->id);
++
++      /* Register MDIO bus */
++      error = of_mdiobus_register(priv->mii_bus, dev->of_node);
++      if (error)
++              goto out_free_bus;
++
++      return 0;
++
++out_free_bus:
++      free_mdio_bitbang(priv->mii_bus);
++      return error;
++}
++
++/* MDIO bus release function */
++static int ravb_mdio_release(struct ravb_private *priv)
++{
++      /* Unregister mdio bus */
++      mdiobus_unregister(priv->mii_bus);
++
++      /* Free bitbang info */
++      free_mdio_bitbang(priv->mii_bus);
++
++      return 0;
++}
++
+ /* Network device open function for Ethernet AVB */
+ static int ravb_open(struct net_device *ndev)
+ {
+       struct ravb_private *priv = netdev_priv(ndev);
+       int error;
++      /* MDIO bus init */
++      error = ravb_mdio_init(priv);
++      if (error) {
++              netdev_err(ndev, "failed to initialize MDIO\n");
++              return error;
++      }
++
+       napi_enable(&priv->napi[RAVB_BE]);
+       napi_enable(&priv->napi[RAVB_NC]);
+@@ -1268,6 +1320,7 @@ out_free_irq:
+ out_napi_off:
+       napi_disable(&priv->napi[RAVB_NC]);
+       napi_disable(&priv->napi[RAVB_BE]);
++      ravb_mdio_release(priv);
+       return error;
+ }
+@@ -1561,6 +1614,8 @@ static int ravb_close(struct net_device
+       ravb_ring_free(ndev, RAVB_BE);
+       ravb_ring_free(ndev, RAVB_NC);
++      ravb_mdio_release(priv);
++
+       return 0;
+ }
+@@ -1664,51 +1719,6 @@ static const struct net_device_ops ravb_
+       .ndo_change_mtu         = eth_change_mtu,
+ };
+-/* MDIO bus init function */
+-static int ravb_mdio_init(struct ravb_private *priv)
+-{
+-      struct platform_device *pdev = priv->pdev;
+-      struct device *dev = &pdev->dev;
+-      int error;
+-
+-      /* Bitbang init */
+-      priv->mdiobb.ops = &bb_ops;
+-
+-      /* MII controller setting */
+-      priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+-      if (!priv->mii_bus)
+-              return -ENOMEM;
+-
+-      /* Hook up MII support for ethtool */
+-      priv->mii_bus->name = "ravb_mii";
+-      priv->mii_bus->parent = dev;
+-      snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+-               pdev->name, pdev->id);
+-
+-      /* Register MDIO bus */
+-      error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+-      if (error)
+-              goto out_free_bus;
+-
+-      return 0;
+-
+-out_free_bus:
+-      free_mdio_bitbang(priv->mii_bus);
+-      return error;
+-}
+-
+-/* MDIO bus release function */
+-static int ravb_mdio_release(struct ravb_private *priv)
+-{
+-      /* Unregister mdio bus */
+-      mdiobus_unregister(priv->mii_bus);
+-
+-      /* Free bitbang info */
+-      free_mdio_bitbang(priv->mii_bus);
+-
+-      return 0;
+-}
+-
+ static const struct of_device_id ravb_match_table[] = {
+       { .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
+       { .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
+@@ -1847,13 +1857,6 @@ static int ravb_probe(struct platform_de
+               eth_hw_addr_random(ndev);
+       }
+-      /* MDIO bus init */
+-      error = ravb_mdio_init(priv);
+-      if (error) {
+-              dev_err(&pdev->dev, "failed to initialize MDIO\n");
+-              goto out_dma_free;
+-      }
+-
+       netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
+       netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
+@@ -1873,8 +1876,6 @@ static int ravb_probe(struct platform_de
+ out_napi_del:
+       netif_napi_del(&priv->napi[RAVB_NC]);
+       netif_napi_del(&priv->napi[RAVB_BE]);
+-      ravb_mdio_release(priv);
+-out_dma_free:
+       dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+                         priv->desc_bat_dma);
+ out_release:
+@@ -1899,7 +1900,6 @@ static int ravb_remove(struct platform_d
+       unregister_netdev(ndev);
+       netif_napi_del(&priv->napi[RAVB_NC]);
+       netif_napi_del(&priv->napi[RAVB_BE]);
+-      ravb_mdio_release(priv);
+       pm_runtime_disable(&pdev->dev);
+       free_netdev(ndev);
+       platform_set_drvdata(pdev, NULL);
diff --git a/queue-4.4/sctp-not-disable-bh-in-the-whole-sctp_get_port_local.patch b/queue-4.4/sctp-not-disable-bh-in-the-whole-sctp_get_port_local.patch
new file mode 100644 (file)
index 0000000..d000643
--- /dev/null
@@ -0,0 +1,105 @@
+From foo@baz Fri Sep 11 09:56:05 AM CEST 2020
+From: Xin Long <lucien.xin@gmail.com>
+Date: Fri, 21 Aug 2020 14:59:38 +0800
+Subject: sctp: not disable bh in the whole sctp_get_port_local()
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 3106ecb43a05dc3e009779764b9da245a5d082de ]
+
+With disabling bh in the whole sctp_get_port_local(), when
+snum == 0 and too many ports have been used, the do-while
+loop will take the cpu for a long time and cause cpu stuck:
+
+  [ ] watchdog: BUG: soft lockup - CPU#11 stuck for 22s!
+  [ ] RIP: 0010:native_queued_spin_lock_slowpath+0x4de/0x940
+  [ ] Call Trace:
+  [ ]  _raw_spin_lock+0xc1/0xd0
+  [ ]  sctp_get_port_local+0x527/0x650 [sctp]
+  [ ]  sctp_do_bind+0x208/0x5e0 [sctp]
+  [ ]  sctp_autobind+0x165/0x1e0 [sctp]
+  [ ]  sctp_connect_new_asoc+0x355/0x480 [sctp]
+  [ ]  __sctp_connect+0x360/0xb10 [sctp]
+
+There's no need to disable bh in the whole function of
+sctp_get_port_local. So fix this cpu stuck by removing
+local_bh_disable() called at the beginning, and using
+spin_lock_bh() instead.
+
+The same thing was actually done for inet_csk_get_port() in
+Commit ea8add2b1903 ("tcp/dccp: better use of ephemeral
+ports in bind()").
+
+Thanks to Marcelo for pointing the buggy code out.
+
+v1->v2:
+  - use cond_resched() to yield cpu to other tasks if needed,
+    as Eric noticed.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Ying Xu <yinxu@redhat.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/socket.c |   16 ++++++----------
+ 1 file changed, 6 insertions(+), 10 deletions(-)
+
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -6206,8 +6206,6 @@ static long sctp_get_port_local(struct s
+       pr_debug("%s: begins, snum:%d\n", __func__, snum);
+-      local_bh_disable();
+-
+       if (snum == 0) {
+               /* Search for an available port. */
+               int low, high, remaining, index;
+@@ -6226,20 +6224,21 @@ static long sctp_get_port_local(struct s
+                               continue;
+                       index = sctp_phashfn(sock_net(sk), rover);
+                       head = &sctp_port_hashtable[index];
+-                      spin_lock(&head->lock);
++                      spin_lock_bh(&head->lock);
+                       sctp_for_each_hentry(pp, &head->chain)
+                               if ((pp->port == rover) &&
+                                   net_eq(sock_net(sk), pp->net))
+                                       goto next;
+                       break;
+               next:
+-                      spin_unlock(&head->lock);
++                      spin_unlock_bh(&head->lock);
++                      cond_resched();
+               } while (--remaining > 0);
+               /* Exhausted local port range during search? */
+               ret = 1;
+               if (remaining <= 0)
+-                      goto fail;
++                      return ret;
+               /* OK, here is the one we will use.  HEAD (the port
+                * hash table list entry) is non-NULL and we hold it's
+@@ -6254,7 +6253,7 @@ static long sctp_get_port_local(struct s
+                * port iterator, pp being NULL.
+                */
+               head = &sctp_port_hashtable[sctp_phashfn(sock_net(sk), snum)];
+-              spin_lock(&head->lock);
++              spin_lock_bh(&head->lock);
+               sctp_for_each_hentry(pp, &head->chain) {
+                       if ((pp->port == snum) && net_eq(pp->net, sock_net(sk)))
+                               goto pp_found;
+@@ -6338,10 +6337,7 @@ success:
+       ret = 0;
+ fail_unlock:
+-      spin_unlock(&head->lock);
+-
+-fail:
+-      local_bh_enable();
++      spin_unlock_bh(&head->lock);
+       return ret;
+ }
index 51ad6f3e41e46fe3bfae185dde5e2e55a929ad11..432ba0464344e111988356630c86a6ec43c58e46 100644 (file)
@@ -53,3 +53,10 @@ alsa-firewire-digi00x-exclude-avid-adrenaline-from-d.patch
 alsa-firewire-tascam-exclude-tascam-fe-8-from-detect.patch
 fs-affs-use-octal-for-permissions.patch
 affs-fix-basic-permission-bits-to-actually-work.patch
+ravb-fixed-to-be-able-to-unload-modules.patch
+net-ethernet-mlx4-fix-memory-allocation-in-mlx4_buddy_init.patch
+bnxt_en-failure-to-update-phy-is-not-fatal-condition.patch
+bnxt-don-t-enable-napi-until-rings-are-ready.patch
+net-usb-dm9601-add-usb-id-of-keenetic-plus-dsl.patch
+sctp-not-disable-bh-in-the-whole-sctp_get_port_local.patch
+net-disable-netpoll-on-fresh-napis.patch