From: Sasha Levin Date: Mon, 2 May 2022 04:06:26 +0000 (-0400) Subject: Fixes for 4.9 X-Git-Tag: v5.4.192~44 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c479fafe523a4fa83a9c2a45f99c9dd5bfe7abcf;p=thirdparty%2Fkernel%2Fstable-queue.git Fixes for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/arm-dts-at91-map-mclk-for-wm8731-on-at91sam9g20ek.patch b/queue-4.9/arm-dts-at91-map-mclk-for-wm8731-on-at91sam9g20ek.patch new file mode 100644 index 00000000000..a0423b9c3cf --- /dev/null +++ b/queue-4.9/arm-dts-at91-map-mclk-for-wm8731-on-at91sam9g20ek.patch @@ -0,0 +1,45 @@ +From f304aae0f95a1ae9f4cdc0ab9c99084b998231a5 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Mon, 4 Apr 2022 11:28:05 +0100 +Subject: ARM: dts: at91: Map MCLK for wm8731 on at91sam9g20ek + +From: Mark Brown + +[ Upstream commit 0e486fe341fabd8e583f3d601a874cd394979c45 ] + +The MCLK of the WM8731 on the AT91SAM9G20-EK board is connected to the +PCK0 output of the SoC and is expected to be set to 12MHz. Previously +this was mapped using pre-common clock API calls in the audio machine +driver but the conversion to the common clock framework broke that so +describe things in the DT instead. + +Fixes: ff78a189b0ae55f ("ARM: at91: remove old at91-specific clock driver") +Signed-off-by: Mark Brown +Reviewed-by: Claudiu Beznea +Signed-off-by: Nicolas Ferre +Link: https://lore.kernel.org/r/20220404102806.581374-2-broonie@kernel.org +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/at91sam9g20ek_common.dtsi | 6 ++++++ + 1 file changed, 6 insertions(+) + +diff --git a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi +index 27847a47c108..a597b9b0cfb3 100644 +--- a/arch/arm/boot/dts/at91sam9g20ek_common.dtsi ++++ b/arch/arm/boot/dts/at91sam9g20ek_common.dtsi +@@ -187,6 +187,12 @@ i2c-gpio-0 { + wm8731: wm8731@1b { + compatible = "wm8731"; + reg = <0x1b>; ++ ++ /* PCK0 at 12MHz */ ++ clocks = <&pmc PMC_TYPE_SYSTEM 8>; ++ clock-names = "mclk"; ++ assigned-clocks = <&pmc PMC_TYPE_SYSTEM 8>; ++ assigned-clock-rates = <12000000>; + }; + }; + +-- +2.35.1 + diff --git a/queue-4.9/arm-dts-fix-mmc-order-for-omap3-gta04.patch b/queue-4.9/arm-dts-fix-mmc-order-for-omap3-gta04.patch new file mode 100644 index 00000000000..7f53fc43f45 --- /dev/null +++ b/queue-4.9/arm-dts-fix-mmc-order-for-omap3-gta04.patch @@ -0,0 +1,38 @@ +From dfb7335bbcbde7ea48985ebeb65345661fc1dc01 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 8 Mar 2022 14:00:20 +0100 +Subject: ARM: dts: Fix mmc order for omap3-gta04 + +From: H. Nikolaus Schaller + +[ Upstream commit 09269dd050094593fc747f2a5853d189fefcb6b5 ] + +Commit a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") +introduces general mmc aliases. Let's tailor them to the need +of the GTA04 board which does not make use of mmc2 and mmc3 interfaces. + +Fixes: a1ebdb374199 ("ARM: dts: Fix swapped mmc order for omap3") +Signed-off-by: H. Nikolaus Schaller +Message-Id: +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/omap3-gta04.dtsi | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/boot/dts/omap3-gta04.dtsi b/arch/arm/boot/dts/omap3-gta04.dtsi +index 338ee6bd0e0c..ced298d07338 100644 +--- a/arch/arm/boot/dts/omap3-gta04.dtsi ++++ b/arch/arm/boot/dts/omap3-gta04.dtsi +@@ -29,6 +29,8 @@ memory@80000000 { + aliases { + display0 = &lcd; + display1 = &tv0; ++ /delete-property/ mmc2; ++ /delete-property/ mmc3; + }; + + gpio-keys { +-- +2.35.1 + diff --git a/queue-4.9/arm-dts-imx6qdl-apalis-fix-sgtl5000-detection-issue.patch b/queue-4.9/arm-dts-imx6qdl-apalis-fix-sgtl5000-detection-issue.patch new file mode 100644 index 00000000000..249650ffb39 --- /dev/null +++ b/queue-4.9/arm-dts-imx6qdl-apalis-fix-sgtl5000-detection-issue.patch @@ -0,0 +1,71 @@ +From b0a61f5c155a80b891f3a7b1831ffe97e17eecee Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sat, 26 Mar 2022 12:14:55 -0300 +Subject: ARM: dts: imx6qdl-apalis: Fix sgtl5000 detection issue + +From: Fabio Estevam + +[ Upstream commit fa51e1dc4b91375bc18349663a52395ad585bd3c ] + +On a custom carrier board with a i.MX6Q Apalis SoM, the sgtl5000 codec +on the SoM is often not detected and the following error message is +seen when the sgtl5000 driver tries to read the ID register: + +sgtl5000 1-000a: Error reading chip id -6 + +The reason for the error is that the MCLK clock is not provided +early enough. + +Fix the problem by describing the MCLK pinctrl inside the codec +node instead of placing it inside the audmux pinctrl group. + +With this change applied the sgtl5000 is always detected on every boot. + +Fixes: 693e3ffaae5a ("ARM: dts: imx6: Add support for Toradex Apalis iMX6Q/D SoM") +Signed-off-by: Fabio Estevam +Reviewed-by: Tim Harvey +Acked-by: Max Krummenacher +Signed-off-by: Shawn Guo +Signed-off-by: Sasha Levin +--- + arch/arm/boot/dts/imx6qdl-apalis.dtsi | 10 ++++++++-- + 1 file changed, 8 insertions(+), 2 deletions(-) + +diff --git a/arch/arm/boot/dts/imx6qdl-apalis.dtsi b/arch/arm/boot/dts/imx6qdl-apalis.dtsi +index 99e323b57261..cbe7b0dcb6eb 100644 +--- a/arch/arm/boot/dts/imx6qdl-apalis.dtsi ++++ b/arch/arm/boot/dts/imx6qdl-apalis.dtsi +@@ -324,6 +324,8 @@ vgen6_reg: vgen6 { + codec: sgtl5000@0a { + compatible = "fsl,sgtl5000"; + reg = <0x0a>; ++ pinctrl-names = "default"; ++ pinctrl-0 = <&pinctrl_sgtl5000>; + clocks = <&clks IMX6QDL_CLK_CKO>; + VDDA-supply = <®_2p5v>; + VDDIO-supply = <®_3p3v>; +@@ -550,8 +552,6 @@ MX6QDL_PAD_DISP0_DAT20__AUD4_TXC 0x130b0 + MX6QDL_PAD_DISP0_DAT21__AUD4_TXD 0x130b0 + MX6QDL_PAD_DISP0_DAT22__AUD4_TXFS 0x130b0 + MX6QDL_PAD_DISP0_DAT23__AUD4_RXD 0x130b0 +- /* SGTL5000 sys_mclk */ +- MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 + >; + }; + +@@ -812,6 +812,12 @@ MX6QDL_PAD_NANDF_CS1__GPIO6_IO14 0x000b0 + >; + }; + ++ pinctrl_sgtl5000: sgtl5000grp { ++ fsl,pins = < ++ MX6QDL_PAD_GPIO_5__CCM_CLKO1 0x130b0 ++ >; ++ }; ++ + pinctrl_spdif: spdifgrp { + fsl,pins = < + MX6QDL_PAD_GPIO_16__SPDIF_IN 0x1b0b0 +-- +2.35.1 + diff --git a/queue-4.9/arm-omap2-fix-refcount-leak-in-omap_gic_of_init.patch b/queue-4.9/arm-omap2-fix-refcount-leak-in-omap_gic_of_init.patch new file mode 100644 index 00000000000..6a4a45afcd9 --- /dev/null +++ b/queue-4.9/arm-omap2-fix-refcount-leak-in-omap_gic_of_init.patch @@ -0,0 +1,42 @@ +From 509baf3a65df240f0dd17d7189693d1f3e2063ec Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Wed, 9 Mar 2022 10:43:01 +0000 +Subject: ARM: OMAP2+: Fix refcount leak in omap_gic_of_init + +From: Miaoqian Lin + +[ Upstream commit 0f83e6b4161617014017a694888dd8743f46f071 ] + +The of_find_compatible_node() function returns a node pointer with +refcount incremented, We should use of_node_put() on it when done +Add the missing of_node_put() to release the refcount. + +Fixes: fd1c07861491 ("ARM: OMAP4: Fix the init code to have OMAP4460 errata available in DT build") +Signed-off-by: Miaoqian Lin +Message-Id: <20220309104302.18398-1-linmq006@gmail.com> +Signed-off-by: Tony Lindgren +Signed-off-by: Sasha Levin +--- + arch/arm/mach-omap2/omap4-common.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/arch/arm/mach-omap2/omap4-common.c b/arch/arm/mach-omap2/omap4-common.c +index e5dcbda20129..7fff67ea7bcd 100644 +--- a/arch/arm/mach-omap2/omap4-common.c ++++ b/arch/arm/mach-omap2/omap4-common.c +@@ -342,10 +342,12 @@ void __init omap_gic_of_init(void) + + np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-gic"); + gic_dist_base_addr = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!gic_dist_base_addr); + + np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-twd-timer"); + twd_base = of_iomap(np, 0); ++ of_node_put(np); + WARN_ON(!twd_base); + + skip_errata_init: +-- +2.35.1 + diff --git a/queue-4.9/asoc-wm8731-disable-the-regulator-when-probing-fails.patch b/queue-4.9/asoc-wm8731-disable-the-regulator-when-probing-fails.patch new file mode 100644 index 00000000000..88b8aa450c5 --- /dev/null +++ b/queue-4.9/asoc-wm8731-disable-the-regulator-when-probing-fails.patch @@ -0,0 +1,90 @@ +From a0bb6f8e1f9d4e43a94bf600eddb2a1356155b2f Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 5 Apr 2022 20:10:38 +0800 +Subject: ASoC: wm8731: Disable the regulator when probing fails + +From: Zheyu Ma + +[ Upstream commit 92ccbf17eeacf510cf1eed9c252d9332ca24f02d ] + +When the driver fails during probing, the driver should disable the +regulator, not just handle it in wm8731_hw_init(). + +The following log reveals it: + +[ 17.812483] WARNING: CPU: 1 PID: 364 at drivers/regulator/core.c:2257 _regulator_put+0x3ec/0x4e0 +[ 17.815958] RIP: 0010:_regulator_put+0x3ec/0x4e0 +[ 17.824467] Call Trace: +[ 17.824774] +[ 17.825040] regulator_bulk_free+0x82/0xe0 +[ 17.825514] devres_release_group+0x319/0x3d0 +[ 17.825882] i2c_device_probe+0x766/0x940 +[ 17.829198] i2c_register_driver+0xb5/0x130 + +Signed-off-by: Zheyu Ma +Link: https://lore.kernel.org/r/20220405121038.4094051-1-zheyuma97@gmail.com +Signed-off-by: Mark Brown +Signed-off-by: Sasha Levin +--- + sound/soc/codecs/wm8731.c | 19 +++++++++++-------- + 1 file changed, 11 insertions(+), 8 deletions(-) + +diff --git a/sound/soc/codecs/wm8731.c b/sound/soc/codecs/wm8731.c +index 4f9a1eb28120..abe5e77ba171 100644 +--- a/sound/soc/codecs/wm8731.c ++++ b/sound/soc/codecs/wm8731.c +@@ -604,7 +604,7 @@ static int wm8731_hw_init(struct device *dev, struct wm8731_priv *wm8731) + ret = wm8731_reset(wm8731->regmap); + if (ret < 0) { + dev_err(dev, "Failed to issue reset: %d\n", ret); +- goto err_regulator_enable; ++ goto err; + } + + /* Clear POWEROFF, keep everything else disabled */ +@@ -621,10 +621,7 @@ static int wm8731_hw_init(struct device *dev, struct wm8731_priv *wm8731) + + regcache_mark_dirty(wm8731->regmap); + +-err_regulator_enable: +- /* Regulators will be enabled by bias management */ +- regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); +- ++err: + return ret; + } + +@@ -768,21 +765,27 @@ static int wm8731_i2c_probe(struct i2c_client *i2c, + ret = PTR_ERR(wm8731->regmap); + dev_err(&i2c->dev, "Failed to allocate register map: %d\n", + ret); +- return ret; ++ goto err_regulator_enable; + } + + ret = wm8731_hw_init(&i2c->dev, wm8731); + if (ret != 0) +- return ret; ++ goto err_regulator_enable; + + ret = snd_soc_register_codec(&i2c->dev, + &soc_codec_dev_wm8731, &wm8731_dai, 1); + if (ret != 0) { + dev_err(&i2c->dev, "Failed to register CODEC: %d\n", ret); +- return ret; ++ goto err_regulator_enable; + } + + return 0; ++ ++err_regulator_enable: ++ /* Regulators will be enabled by bias management */ ++ regulator_bulk_disable(ARRAY_SIZE(wm8731->supplies), wm8731->supplies); ++ ++ return ret; + } + + static int wm8731_i2c_remove(struct i2c_client *client) +-- +2.35.1 + diff --git a/queue-4.9/bnx2x-fix-napi-api-usage-sequence.patch b/queue-4.9/bnx2x-fix-napi-api-usage-sequence.patch new file mode 100644 index 00000000000..244c4a489bc --- /dev/null +++ b/queue-4.9/bnx2x-fix-napi-api-usage-sequence.patch @@ -0,0 +1,152 @@ +From 06fa89cc86e9084769c7e149f756a0bc15cc361c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 26 Apr 2022 08:39:13 -0700 +Subject: bnx2x: fix napi API usage sequence + +From: Manish Chopra + +[ Upstream commit af68656d66eda219b7f55ce8313a1da0312c79e1 ] + +While handling PCI errors (AER flow) driver tries to +disable NAPI [napi_disable()] after NAPI is deleted +[__netif_napi_del()] which causes unexpected system +hang/crash. + +System message log shows the following: +======================================= +[ 3222.537510] EEH: Detected PCI bus error on PHB#384-PE#800000 [ 3222.537511] EEH: This PCI device has failed 2 times in the last hour and will be permanently disabled after 5 failures. +[ 3222.537512] EEH: Notify device drivers to shutdown [ 3222.537513] EEH: Beginning: 'error_detected(IO frozen)' +[ 3222.537514] EEH: PE#800000 (PCI 0384:80:00.0): Invoking +bnx2x->error_detected(IO frozen) +[ 3222.537516] bnx2x: [bnx2x_io_error_detected:14236(eth14)]IO error detected [ 3222.537650] EEH: PE#800000 (PCI 0384:80:00.0): bnx2x driver reports: +'need reset' +[ 3222.537651] EEH: PE#800000 (PCI 0384:80:00.1): Invoking +bnx2x->error_detected(IO frozen) +[ 3222.537651] bnx2x: [bnx2x_io_error_detected:14236(eth13)]IO error detected [ 3222.537729] EEH: PE#800000 (PCI 0384:80:00.1): bnx2x driver reports: +'need reset' +[ 3222.537729] EEH: Finished:'error_detected(IO frozen)' with aggregate recovery state:'need reset' +[ 3222.537890] EEH: Collect temporary log [ 3222.583481] EEH: of node=0384:80:00.0 [ 3222.583519] EEH: PCI device/vendor: 168e14e4 [ 3222.583557] EEH: PCI cmd/status register: 00100140 [ 3222.583557] EEH: PCI-E capabilities and status follow: +[ 3222.583744] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.583892] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.583893] EEH: PCI-E 20: 00000000 [ 3222.583893] EEH: PCI-E AER capability register set follows: +[ 3222.584079] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 3222.584230] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.584378] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.584416] EEH: PCI-E AER 30: 00000000 00000000 [ 3222.584416] EEH: of node=0384:80:00.1 [ 3222.584454] EEH: PCI device/vendor: 168e14e4 [ 3222.584491] EEH: PCI cmd/status register: 00100140 [ 3222.584492] EEH: PCI-E capabilities and status follow: +[ 3222.584677] EEH: PCI-E 00: 00020010 012c8da2 00095d5e 00455c82 [ 3222.584825] EEH: PCI-E 10: 10820000 00000000 00000000 00000000 [ 3222.584826] EEH: PCI-E 20: 00000000 [ 3222.584826] EEH: PCI-E AER capability register set follows: +[ 3222.585011] EEH: PCI-E AER 00: 13c10001 00000000 00000000 00062030 [ 3222.585160] EEH: PCI-E AER 10: 00002000 000031c0 000001e0 00000000 [ 3222.585309] EEH: PCI-E AER 20: 00000000 00000000 00000000 00000000 [ 3222.585347] EEH: PCI-E AER 30: 00000000 00000000 [ 3222.586872] RTAS: event: 5, Type: Platform Error (224), Severity: 2 [ 3222.586873] EEH: Reset without hotplug activity [ 3224.762767] EEH: Beginning: 'slot_reset' +[ 3224.762770] EEH: PE#800000 (PCI 0384:80:00.0): Invoking +bnx2x->slot_reset() +[ 3224.762771] bnx2x: [bnx2x_io_slot_reset:14271(eth14)]IO slot reset initializing... +[ 3224.762887] bnx2x 0384:80:00.0: enabling device (0140 -> 0142) [ 3224.768157] bnx2x: [bnx2x_io_slot_reset:14287(eth14)]IO slot reset +--> driver unload + +Uninterruptible tasks +===================== +crash> ps | grep UN + 213 2 11 c000000004c89e00 UN 0.0 0 0 [eehd] + 215 2 0 c000000004c80000 UN 0.0 0 0 +[kworker/0:2] + 2196 1 28 c000000004504f00 UN 0.1 15936 11136 wickedd + 4287 1 9 c00000020d076800 UN 0.0 4032 3008 agetty + 4289 1 20 c00000020d056680 UN 0.0 7232 3840 agetty + 32423 2 26 c00000020038c580 UN 0.0 0 0 +[kworker/26:3] + 32871 4241 27 c0000002609ddd00 UN 0.1 18624 11648 sshd + 32920 10130 16 c00000027284a100 UN 0.1 48512 12608 sendmail + 33092 32987 0 c000000205218b00 UN 0.1 48512 12608 sendmail + 33154 4567 16 c000000260e51780 UN 0.1 48832 12864 pickup + 33209 4241 36 c000000270cb6500 UN 0.1 18624 11712 sshd + 33473 33283 0 c000000205211480 UN 0.1 48512 12672 sendmail + 33531 4241 37 c00000023c902780 UN 0.1 18624 11648 sshd + +EEH handler hung while bnx2x sleeping and holding RTNL lock +=========================================================== +crash> bt 213 +PID: 213 TASK: c000000004c89e00 CPU: 11 COMMAND: "eehd" + #0 [c000000004d477e0] __schedule at c000000000c70808 + #1 [c000000004d478b0] schedule at c000000000c70ee0 + #2 [c000000004d478e0] schedule_timeout at c000000000c76dec + #3 [c000000004d479c0] msleep at c0000000002120cc + #4 [c000000004d479f0] napi_disable at c000000000a06448 + ^^^^^^^^^^^^^^^^ + #5 [c000000004d47a30] bnx2x_netif_stop at c0080000018dba94 [bnx2x] + #6 [c000000004d47a60] bnx2x_io_slot_reset at c0080000018a551c [bnx2x] + #7 [c000000004d47b20] eeh_report_reset at c00000000004c9bc + #8 [c000000004d47b90] eeh_pe_report at c00000000004d1a8 + #9 [c000000004d47c40] eeh_handle_normal_event at c00000000004da64 + +And the sleeping source code +============================ +crash> dis -ls c000000000a06448 +FILE: ../net/core/dev.c +LINE: 6702 + + 6697 { + 6698 might_sleep(); + 6699 set_bit(NAPI_STATE_DISABLE, &n->state); + 6700 + 6701 while (test_and_set_bit(NAPI_STATE_SCHED, &n->state)) +* 6702 msleep(1); + 6703 while (test_and_set_bit(NAPI_STATE_NPSVC, &n->state)) + 6704 msleep(1); + 6705 + 6706 hrtimer_cancel(&n->timer); + 6707 + 6708 clear_bit(NAPI_STATE_DISABLE, &n->state); + 6709 } + +EEH calls into bnx2x twice based on the system log above, first through +bnx2x_io_error_detected() and then bnx2x_io_slot_reset(), and executes +the following call chains: + +bnx2x_io_error_detected() + +-> bnx2x_eeh_nic_unload() + +-> bnx2x_del_all_napi() + +-> __netif_napi_del() + +bnx2x_io_slot_reset() + +-> bnx2x_netif_stop() + +-> bnx2x_napi_disable() + +->napi_disable() + +Fix this by correcting the sequence of NAPI APIs usage, +that is delete the NAPI after disabling it. + +Fixes: 7fa6f34081f1 ("bnx2x: AER revised") +Reported-by: David Christensen +Tested-by: David Christensen +Signed-off-by: Manish Chopra +Signed-off-by: Ariel Elior +Link: https://lore.kernel.org/r/20220426153913.6966-1-manishc@marvell.com +Signed-off-by: Jakub Kicinski +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 8d17d464c067..398928642a97 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -14314,10 +14314,6 @@ static int bnx2x_eeh_nic_unload(struct bnx2x *bp) + + /* Stop Tx */ + bnx2x_tx_disable(bp); +- /* Delete all NAPI objects */ +- bnx2x_del_all_napi(bp); +- if (CNIC_LOADED(bp)) +- bnx2x_del_all_napi_cnic(bp); + netdev_reset_tc(bp->dev); + + del_timer_sync(&bp->timer); +@@ -14422,6 +14418,11 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev) + bnx2x_drain_tx_queues(bp); + bnx2x_send_unload_req(bp, UNLOAD_RECOVERY); + bnx2x_netif_stop(bp, 1); ++ bnx2x_del_all_napi(bp); ++ ++ if (CNIC_LOADED(bp)) ++ bnx2x_del_all_napi_cnic(bp); ++ + bnx2x_free_irq(bp); + + /* Report UNLOAD_DONE to MCP */ +-- +2.35.1 + diff --git a/queue-4.9/bus-sunxi-rsb-fix-the-return-value-of-sunxi_rsb_devi.patch b/queue-4.9/bus-sunxi-rsb-fix-the-return-value-of-sunxi_rsb_devi.patch new file mode 100644 index 00000000000..59cba0eefeb --- /dev/null +++ b/queue-4.9/bus-sunxi-rsb-fix-the-return-value-of-sunxi_rsb_devi.patch @@ -0,0 +1,43 @@ +From 563ecdb1b811d694ecc46d2e00beab3f7dd0c58b Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 16:35:49 +0200 +Subject: bus: sunxi-rsb: Fix the return value of sunxi_rsb_device_create() + +From: Christophe JAILLET + +[ Upstream commit fff8c10368e64e7f8960f149375c12ca5f3b30af ] + +This code is really spurious. +It always returns an ERR_PTR, even when err is known to be 0 and calls +put_device() after a successful device_register() call. + +It is likely that the return statement in the normal path is missing. +Add 'return rdev;' to fix it. + +Fixes: d787dcdb9c8f ("bus: sunxi-rsb: Add driver for Allwinner Reduced Serial Bus") +Signed-off-by: Christophe JAILLET +Reviewed-by: Samuel Holland +Tested-by: Samuel Holland +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/ef2b9576350bba4c8e05e669e9535e9e2a415763.1650551719.git.christophe.jaillet@wanadoo.fr +Signed-off-by: Sasha Levin +--- + drivers/bus/sunxi-rsb.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/bus/sunxi-rsb.c b/drivers/bus/sunxi-rsb.c +index 4f3d988210b0..ce5b976a8856 100644 +--- a/drivers/bus/sunxi-rsb.c ++++ b/drivers/bus/sunxi-rsb.c +@@ -224,6 +224,8 @@ static struct sunxi_rsb_device *sunxi_rsb_device_create(struct sunxi_rsb *rsb, + + dev_dbg(&rdev->dev, "device %s registered\n", dev_name(&rdev->dev)); + ++ return rdev; ++ + err_device_add: + put_device(&rdev->dev); + +-- +2.35.1 + diff --git a/queue-4.9/clk-sunxi-sun9i-mmc-check-return-value-after-calling.patch b/queue-4.9/clk-sunxi-sun9i-mmc-check-return-value-after-calling.patch new file mode 100644 index 00000000000..0a263f7e391 --- /dev/null +++ b/queue-4.9/clk-sunxi-sun9i-mmc-check-return-value-after-calling.patch @@ -0,0 +1,39 @@ +From d04a169683958e425560d9e1bd6e9e9e8f293cfc Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 21:43:08 +0800 +Subject: clk: sunxi: sun9i-mmc: check return value after calling + platform_get_resource() + +From: Yang Yingliang + +[ Upstream commit f58ca215cda1975f77b2b762903684a3c101bec9 ] + +It will cause null-ptr-deref if platform_get_resource() returns NULL, +we need check the return value. + +Fixes: 7a6fca879f59 ("clk: sunxi: Add driver for A80 MMC config clocks/resets") +Signed-off-by: Yang Yingliang +Reviewed-by: Samuel Holland +Signed-off-by: Jernej Skrabec +Link: https://lore.kernel.org/r/20220421134308.2885094-1-yangyingliang@huawei.com +Signed-off-by: Sasha Levin +--- + drivers/clk/sunxi/clk-sun9i-mmc.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/clk/sunxi/clk-sun9i-mmc.c b/drivers/clk/sunxi/clk-sun9i-mmc.c +index f69f9e8c6f38..7e9d1624032f 100644 +--- a/drivers/clk/sunxi/clk-sun9i-mmc.c ++++ b/drivers/clk/sunxi/clk-sun9i-mmc.c +@@ -117,6 +117,8 @@ static int sun9i_a80_mmc_config_clk_probe(struct platform_device *pdev) + spin_lock_init(&data->lock); + + r = platform_get_resource(pdev, IORESOURCE_MEM, 0); ++ if (!r) ++ return -EINVAL; + /* one clock/reset pair per word */ + count = DIV_ROUND_UP((resource_size(r)), SUN9I_MMC_WIDTH); + data->membase = devm_ioremap_resource(&pdev->dev, r); +-- +2.35.1 + diff --git a/queue-4.9/drivers-net-hippi-fix-deadlock-in-rr_close.patch b/queue-4.9/drivers-net-hippi-fix-deadlock-in-rr_close.patch new file mode 100644 index 00000000000..e485b6e0a99 --- /dev/null +++ b/queue-4.9/drivers-net-hippi-fix-deadlock-in-rr_close.patch @@ -0,0 +1,53 @@ +From 5e42ebeedfb42205d25cd7f29f96070fbe918afa Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 17 Apr 2022 20:55:19 +0800 +Subject: drivers: net: hippi: Fix deadlock in rr_close() + +From: Duoming Zhou + +[ Upstream commit bc6de2878429e85c1f1afaa566f7b5abb2243eef ] + +There is a deadlock in rr_close(), which is shown below: + + (Thread 1) | (Thread 2) + | rr_open() +rr_close() | add_timer() + spin_lock_irqsave() //(1) | (wait a time) + ... | rr_timer() + del_timer_sync() | spin_lock_irqsave() //(2) + (wait timer to stop) | ... + +We hold rrpriv->lock in position (1) of thread 1 and +use del_timer_sync() to wait timer to stop, but timer handler +also need rrpriv->lock in position (2) of thread 2. +As a result, rr_close() will block forever. + +This patch extracts del_timer_sync() from the protection of +spin_lock_irqsave(), which could let timer handler to obtain +the needed lock. + +Signed-off-by: Duoming Zhou +Link: https://lore.kernel.org/r/20220417125519.82618-1-duoming@zju.edu.cn +Signed-off-by: Paolo Abeni +Signed-off-by: Sasha Levin +--- + drivers/net/hippi/rrunner.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/hippi/rrunner.c b/drivers/net/hippi/rrunner.c +index 6f3519123eb6..0e1a422d9567 100644 +--- a/drivers/net/hippi/rrunner.c ++++ b/drivers/net/hippi/rrunner.c +@@ -1354,7 +1354,9 @@ static int rr_close(struct net_device *dev) + + rrpriv->fw_running = 0; + ++ spin_unlock_irqrestore(&rrpriv->lock, flags); + del_timer_sync(&rrpriv->timer); ++ spin_lock_irqsave(&rrpriv->lock, flags); + + writel(0, ®s->TxPi); + writel(0, ®s->IpRxPi); +-- +2.35.1 + diff --git a/queue-4.9/ip_gre-make-o_seqno-start-from-0-in-native-mode.patch b/queue-4.9/ip_gre-make-o_seqno-start-from-0-in-native-mode.patch new file mode 100644 index 00000000000..b8debe26d98 --- /dev/null +++ b/queue-4.9/ip_gre-make-o_seqno-start-from-0-in-native-mode.patch @@ -0,0 +1,51 @@ +From 615d08d90524444c7b89ce45a4df1568a4b80723 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 21 Apr 2022 15:07:57 -0700 +Subject: ip_gre: Make o_seqno start from 0 in native mode + +From: Peilin Ye + +[ Upstream commit ff827beb706ed719c766acf36449801ded0c17fc ] + +For GRE and GRETAP devices, currently o_seqno starts from 1 in native +mode. According to RFC 2890 2.2., "The first datagram is sent with a +sequence number of 0." Fix it. + +It is worth mentioning that o_seqno already starts from 0 in collect_md +mode, see gre_fb_xmit(), where tunnel->o_seqno is passed to +gre_build_header() before getting incremented. + +Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") +Signed-off-by: Peilin Ye +Acked-by: William Tu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + net/ipv4/ip_gre.c | 8 +++----- + 1 file changed, 3 insertions(+), 5 deletions(-) + +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c +index fe1801d9f059..eec225c637f0 100644 +--- a/net/ipv4/ip_gre.c ++++ b/net/ipv4/ip_gre.c +@@ -339,14 +339,12 @@ static void __gre_xmit(struct sk_buff *skb, struct net_device *dev, + __be16 proto) + { + struct ip_tunnel *tunnel = netdev_priv(dev); +- +- if (tunnel->parms.o_flags & TUNNEL_SEQ) +- tunnel->o_seqno++; ++ __be16 flags = tunnel->parms.o_flags; + + /* Push GRE header. */ + gre_build_header(skb, tunnel->tun_hlen, +- tunnel->parms.o_flags, proto, tunnel->parms.o_key, +- htonl(tunnel->o_seqno)); ++ flags, proto, tunnel->parms.o_key, ++ (flags & TUNNEL_SEQ) ? htonl(tunnel->o_seqno++) : 0); + + ip_tunnel_xmit(skb, dev, tnl_params, tnl_params->protocol); + } +-- +2.35.1 + diff --git a/queue-4.9/mtd-rawnand-fix-return-value-check-of-wait_for_compl.patch b/queue-4.9/mtd-rawnand-fix-return-value-check-of-wait_for_compl.patch new file mode 100644 index 00000000000..86371c91d4f --- /dev/null +++ b/queue-4.9/mtd-rawnand-fix-return-value-check-of-wait_for_compl.patch @@ -0,0 +1,84 @@ +From 79fd4a189e7fc0da6eb0ef0139d7712fb99251de Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Tue, 12 Apr 2022 08:34:31 +0000 +Subject: mtd: rawnand: Fix return value check of wait_for_completion_timeout + +From: Miaoqian Lin + +[ Upstream commit 084c16ab423a8890121b902b405823bfec5b4365 ] + +wait_for_completion_timeout() returns unsigned long not int. +It returns 0 if timed out, and positive if completed. +The check for <= 0 is ambiguous and should be == 0 here +indicating timeout which is the only error case. + +Fixes: 83738d87e3a0 ("mtd: sh_flctl: Add DMA capabilty") +Signed-off-by: Miaoqian Lin +Signed-off-by: Miquel Raynal +Link: https://lore.kernel.org/linux-mtd/20220412083435.29254-1-linmq006@gmail.com +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/sh_flctl.c | 14 ++++++++------ + 1 file changed, 8 insertions(+), 6 deletions(-) + +diff --git a/drivers/mtd/nand/sh_flctl.c b/drivers/mtd/nand/sh_flctl.c +index 31f98acdba07..17e15bd05442 100644 +--- a/drivers/mtd/nand/sh_flctl.c ++++ b/drivers/mtd/nand/sh_flctl.c +@@ -399,7 +399,8 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, + dma_addr_t dma_addr; + dma_cookie_t cookie; + uint32_t reg; +- int ret; ++ int ret = 0; ++ unsigned long time_left; + + if (dir == DMA_FROM_DEVICE) { + chan = flctl->chan_fifo0_rx; +@@ -440,13 +441,14 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, + goto out; + } + +- ret = ++ time_left = + wait_for_completion_timeout(&flctl->dma_complete, + msecs_to_jiffies(3000)); + +- if (ret <= 0) { ++ if (time_left == 0) { + dmaengine_terminate_all(chan); + dev_err(&flctl->pdev->dev, "wait_for_completion_timeout\n"); ++ ret = -ETIMEDOUT; + } + + out: +@@ -456,7 +458,7 @@ static int flctl_dma_fifo0_transfer(struct sh_flctl *flctl, unsigned long *buf, + + dma_unmap_single(chan->device->dev, dma_addr, len, dir); + +- /* ret > 0 is success */ ++ /* ret == 0 is success */ + return ret; + } + +@@ -480,7 +482,7 @@ static void read_fiforeg(struct sh_flctl *flctl, int rlen, int offset) + + /* initiate DMA transfer */ + if (flctl->chan_fifo0_rx && rlen >= 32 && +- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE) > 0) ++ !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_FROM_DEVICE)) + goto convert; /* DMA success */ + + /* do polling transfer */ +@@ -539,7 +541,7 @@ static void write_ec_fiforeg(struct sh_flctl *flctl, int rlen, + + /* initiate DMA transfer */ + if (flctl->chan_fifo0_tx && rlen >= 32 && +- flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE) > 0) ++ !flctl_dma_fifo0_transfer(flctl, buf, rlen, DMA_TO_DEVICE)) + return; /* DMA success */ + + /* do polling transfer */ +-- +2.35.1 + diff --git a/queue-4.9/phy-samsung-exynos5250-sata-fix-missing-device-put-i.patch b/queue-4.9/phy-samsung-exynos5250-sata-fix-missing-device-put-i.patch new file mode 100644 index 00000000000..e46d7d900bb --- /dev/null +++ b/queue-4.9/phy-samsung-exynos5250-sata-fix-missing-device-put-i.patch @@ -0,0 +1,77 @@ +From 881bbc300dea71cced48744806e2d8a71a4fd1f2 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 11:18:57 +0200 +Subject: phy: samsung: exynos5250-sata: fix missing device put in probe error + paths + +From: Krzysztof Kozlowski + +[ Upstream commit 5c8402c4db45dd55c2c93c8d730f5dfa7c78a702 ] + +The actions of of_find_i2c_device_by_node() in probe function should be +reversed in error paths by putting the reference to obtained device. + +Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") +Signed-off-by: Krzysztof Kozlowski +Reviewed-by: Alim Akhtar +Link: https://lore.kernel.org/r/20220407091857.230386-2-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/phy-exynos5250-sata.c | 20 ++++++++++++++------ + 1 file changed, 14 insertions(+), 6 deletions(-) + +diff --git a/drivers/phy/phy-exynos5250-sata.c b/drivers/phy/phy-exynos5250-sata.c +index 7960c69d09a6..2c39d2fd3cd8 100644 +--- a/drivers/phy/phy-exynos5250-sata.c ++++ b/drivers/phy/phy-exynos5250-sata.c +@@ -202,20 +202,21 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) + sata_phy->phyclk = devm_clk_get(dev, "sata_phyctrl"); + if (IS_ERR(sata_phy->phyclk)) { + dev_err(dev, "failed to get clk for PHY\n"); +- return PTR_ERR(sata_phy->phyclk); ++ ret = PTR_ERR(sata_phy->phyclk); ++ goto put_dev; + } + + ret = clk_prepare_enable(sata_phy->phyclk); + if (ret < 0) { + dev_err(dev, "failed to enable source clk\n"); +- return ret; ++ goto put_dev; + } + + sata_phy->phy = devm_phy_create(dev, NULL, &exynos_sata_phy_ops); + if (IS_ERR(sata_phy->phy)) { +- clk_disable_unprepare(sata_phy->phyclk); + dev_err(dev, "failed to create PHY\n"); +- return PTR_ERR(sata_phy->phy); ++ ret = PTR_ERR(sata_phy->phy); ++ goto clk_disable; + } + + phy_set_drvdata(sata_phy->phy, sata_phy); +@@ -223,11 +224,18 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) + phy_provider = devm_of_phy_provider_register(dev, + of_phy_simple_xlate); + if (IS_ERR(phy_provider)) { +- clk_disable_unprepare(sata_phy->phyclk); +- return PTR_ERR(phy_provider); ++ ret = PTR_ERR(phy_provider); ++ goto clk_disable; + } + + return 0; ++ ++clk_disable: ++ clk_disable_unprepare(sata_phy->phyclk); ++put_dev: ++ put_device(&sata_phy->client->dev); ++ ++ return ret; + } + + static const struct of_device_id exynos_sata_phy_of_match[] = { +-- +2.35.1 + diff --git a/queue-4.9/phy-samsung-fix-missing-of_node_put-in-exynos_sata_p.patch b/queue-4.9/phy-samsung-fix-missing-of_node_put-in-exynos_sata_p.patch new file mode 100644 index 00000000000..1865885bd56 --- /dev/null +++ b/queue-4.9/phy-samsung-fix-missing-of_node_put-in-exynos_sata_p.patch @@ -0,0 +1,38 @@ +From 10d6d3e4254701ce5ac1bd9f4c2bc58bc9e18133 Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Thu, 7 Apr 2022 11:18:56 +0200 +Subject: phy: samsung: Fix missing of_node_put() in exynos_sata_phy_probe + +From: Miaoqian Lin + +[ Upstream commit 388ec8f079f2f20d5cd183c3bc6f33cbc3ffd3ef ] + +The device_node pointer is returned by of_parse_phandle() with refcount +incremented. We should use of_node_put() on it when done. + +Fixes: bcff4cba41bc ("PHY: Exynos: Add Exynos5250 SATA PHY driver") +Signed-off-by: Miaoqian Lin +Reviewed-by: Krzysztof Kozlowski +Signed-off-by: Krzysztof Kozlowski +Link: https://lore.kernel.org/r/20220407091857.230386-1-krzysztof.kozlowski@linaro.org +Signed-off-by: Vinod Koul +Signed-off-by: Sasha Levin +--- + drivers/phy/phy-exynos5250-sata.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/phy/phy-exynos5250-sata.c b/drivers/phy/phy-exynos5250-sata.c +index 60e13afcd9b8..7960c69d09a6 100644 +--- a/drivers/phy/phy-exynos5250-sata.c ++++ b/drivers/phy/phy-exynos5250-sata.c +@@ -193,6 +193,7 @@ static int exynos_sata_phy_probe(struct platform_device *pdev) + return -EINVAL; + + sata_phy->client = of_find_i2c_device_by_node(node); ++ of_node_put(node); + if (!sata_phy->client) + return -EPROBE_DEFER; + +-- +2.35.1 + diff --git a/queue-4.9/pinctrl-pistachio-fix-use-of-irq_of_parse_and_map.patch b/queue-4.9/pinctrl-pistachio-fix-use-of-irq_of_parse_and_map.patch new file mode 100644 index 00000000000..25b30a31c25 --- /dev/null +++ b/queue-4.9/pinctrl-pistachio-fix-use-of-irq_of_parse_and_map.patch @@ -0,0 +1,43 @@ +From c93a48ab834923d050ee0508a07e30a7fc81f1be Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 03:14:30 +0000 +Subject: pinctrl: pistachio: fix use of irq_of_parse_and_map() + +From: Lv Ruyi + +[ Upstream commit 0c9843a74a85224a89daa81fa66891dae2f930e1 ] + +The irq_of_parse_and_map() function returns 0 on failure, and does not +return an negative value. + +Fixes: cefc03e5995e ("pinctrl: Add Pistachio SoC pin control driver") +Reported-by: Zeal Robot +Signed-off-by: Lv Ruyi +Link: https://lore.kernel.org/r/20220424031430.3170759-1-lv.ruyi@zte.com.cn +Signed-off-by: Linus Walleij +Signed-off-by: Sasha Levin +--- + drivers/pinctrl/pinctrl-pistachio.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c +index b2b7e238bda9..fc8c57527fb7 100644 +--- a/drivers/pinctrl/pinctrl-pistachio.c ++++ b/drivers/pinctrl/pinctrl-pistachio.c +@@ -1374,10 +1374,10 @@ static int pistachio_gpio_register(struct pistachio_pinctrl *pctl) + } + + irq = irq_of_parse_and_map(child, 0); +- if (irq < 0) { +- dev_err(pctl->dev, "No IRQ for bank %u: %d\n", i, irq); ++ if (!irq) { ++ dev_err(pctl->dev, "No IRQ for bank %u\n", i); + of_node_put(child); +- ret = irq; ++ ret = -EINVAL; + goto err; + } + +-- +2.35.1 + diff --git a/queue-4.9/series b/queue-4.9/series index 25f81a8e4a3..33a6b54ba26 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -18,3 +18,18 @@ serial-8250-also-set-sticky-mcr-bits-in-console-restoration.patch serial-8250-correct-the-clock-for-endrun-ptp-1588-pcie-device.patch hex2bin-make-the-function-hex_to_bin-constant-time.patch hex2bin-fix-access-beyond-string-end.patch +arm-dts-imx6qdl-apalis-fix-sgtl5000-detection-issue.patch +phy-samsung-fix-missing-of_node_put-in-exynos_sata_p.patch +phy-samsung-exynos5250-sata-fix-missing-device-put-i.patch +arm-omap2-fix-refcount-leak-in-omap_gic_of_init.patch +arm-dts-at91-map-mclk-for-wm8731-on-at91sam9g20ek.patch +arm-dts-fix-mmc-order-for-omap3-gta04.patch +mtd-rawnand-fix-return-value-check-of-wait_for_compl.patch +pinctrl-pistachio-fix-use-of-irq_of_parse_and_map.patch +ip_gre-make-o_seqno-start-from-0-in-native-mode.patch +tcp-fix-potential-xmit-stalls-caused-by-tcp_notsent_.patch +bus-sunxi-rsb-fix-the-return-value-of-sunxi_rsb_devi.patch +clk-sunxi-sun9i-mmc-check-return-value-after-calling.patch +bnx2x-fix-napi-api-usage-sequence.patch +asoc-wm8731-disable-the-regulator-when-probing-fails.patch +drivers-net-hippi-fix-deadlock-in-rr_close.patch diff --git a/queue-4.9/tcp-fix-potential-xmit-stalls-caused-by-tcp_notsent_.patch b/queue-4.9/tcp-fix-potential-xmit-stalls-caused-by-tcp_notsent_.patch new file mode 100644 index 00000000000..9ad6a1d7150 --- /dev/null +++ b/queue-4.9/tcp-fix-potential-xmit-stalls-caused-by-tcp_notsent_.patch @@ -0,0 +1,145 @@ +From bb324456dd79eb19f9ddef2e0d51fc4e63b6f46c Mon Sep 17 00:00:00 2001 +From: Sasha Levin +Date: Sun, 24 Apr 2022 17:34:07 -0700 +Subject: tcp: fix potential xmit stalls caused by TCP_NOTSENT_LOWAT + +From: Eric Dumazet + +[ Upstream commit 4bfe744ff1644fbc0a991a2677dc874475dd6776 ] + +I had this bug sitting for too long in my pile, it is time to fix it. + +Thanks to Doug Porter for reminding me of it! + +We had various attempts in the past, including commit +0cbe6a8f089e ("tcp: remove SOCK_QUEUE_SHRUNK"), +but the issue is that TCP stack currently only generates +EPOLLOUT from input path, when tp->snd_una has advanced +and skb(s) cleaned from rtx queue. + +If a flow has a big RTT, and/or receives SACKs, it is possible +that the notsent part (tp->write_seq - tp->snd_nxt) reaches 0 +and no more data can be sent until tp->snd_una finally advances. + +What is needed is to also check if POLLOUT needs to be generated +whenever tp->snd_nxt is advanced, from output path. + +This bug triggers more often after an idle period, as +we do not receive ACK for at least one RTT. tcp_notsent_lowat +could be a fraction of what CWND and pacing rate would allow to +send during this RTT. + +In a followup patch, I will remove the bogus call +to tcp_chrono_stop(sk, TCP_CHRONO_SNDBUF_LIMITED) +from tcp_check_space(). Fact that we have decided to generate +an EPOLLOUT does not mean the application has immediately +refilled the transmit queue. This optimistic call +might have been the reason the bug seemed not too serious. + +Tested: + +200 ms rtt, 1% packet loss, 32 MB tcp_rmem[2] and tcp_wmem[2] + +$ echo 500000 >/proc/sys/net/ipv4/tcp_notsent_lowat +$ cat bench_rr.sh +SUM=0 +for i in {1..10} +do + V=`netperf -H remote_host -l30 -t TCP_RR -- -r 10000000,10000 -o LOCAL_BYTES_SENT | egrep -v "MIGRATED|Bytes"` + echo $V + SUM=$(($SUM + $V)) +done +echo SUM=$SUM + +Before patch: +$ bench_rr.sh +130000000 +80000000 +140000000 +140000000 +140000000 +140000000 +130000000 +40000000 +90000000 +110000000 +SUM=1140000000 + +After patch: +$ bench_rr.sh +430000000 +590000000 +530000000 +450000000 +450000000 +350000000 +450000000 +490000000 +480000000 +460000000 +SUM=4680000000 # This is 410 % of the value before patch. + +Fixes: c9bee3b7fdec ("tcp: TCP_NOTSENT_LOWAT socket option") +Signed-off-by: Eric Dumazet +Reported-by: Doug Porter +Cc: Soheil Hassas Yeganeh +Cc: Neal Cardwell +Acked-by: Soheil Hassas Yeganeh +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + include/net/tcp.h | 1 + + net/ipv4/tcp_input.c | 12 +++++++++++- + net/ipv4/tcp_output.c | 1 + + 3 files changed, 13 insertions(+), 1 deletion(-) + +diff --git a/include/net/tcp.h b/include/net/tcp.h +index f26f075250b4..97df2f6fcbd7 100644 +--- a/include/net/tcp.h ++++ b/include/net/tcp.h +@@ -579,6 +579,7 @@ void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req); + void tcp_reset(struct sock *sk); + void tcp_skb_mark_lost_uncond_verify(struct tcp_sock *tp, struct sk_buff *skb); + void tcp_fin(struct sock *sk); ++void tcp_check_space(struct sock *sk); + + /* tcp_timer.c */ + void tcp_init_xmit_timers(struct sock *); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 01c73775ed00..7f48f8504284 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -5159,7 +5159,17 @@ static void tcp_new_space(struct sock *sk) + sk->sk_write_space(sk); + } + +-static void tcp_check_space(struct sock *sk) ++/* Caller made space either from: ++ * 1) Freeing skbs in rtx queues (after tp->snd_una has advanced) ++ * 2) Sent skbs from output queue (and thus advancing tp->snd_nxt) ++ * ++ * We might be able to generate EPOLLOUT to the application if: ++ * 1) Space consumed in output/rtx queues is below sk->sk_sndbuf/2 ++ * 2) notsent amount (tp->write_seq - tp->snd_nxt) became ++ * small enough that tcp_stream_memory_free() decides it ++ * is time to generate EPOLLOUT. ++ */ ++void tcp_check_space(struct sock *sk) + { + if (sock_flag(sk, SOCK_QUEUE_SHRUNK)) { + sock_reset_flag(sk, SOCK_QUEUE_SHRUNK); +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index aafea53c7c06..95b0f486cb10 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -83,6 +83,7 @@ static void tcp_event_new_data_sent(struct sock *sk, const struct sk_buff *skb) + + NET_ADD_STATS(sock_net(sk), LINUX_MIB_TCPORIGDATASENT, + tcp_skb_pcount(skb)); ++ tcp_check_space(sk); + } + + /* SND.NXT, if window was not shrunk. +-- +2.35.1 +