From: Sasha Levin Date: Sat, 8 Dec 2018 15:08:10 +0000 (-0500) Subject: patches for 4.9 X-Git-Tag: v4.19.9~34 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=efa471f5237dfa77926f3b83378c630f2d39caea;p=thirdparty%2Fkernel%2Fstable-queue.git patches for 4.9 Signed-off-by: Sasha Levin --- diff --git a/queue-4.9/batman-adv-expand-merged-fragment-buffer-for-full-pa.patch b/queue-4.9/batman-adv-expand-merged-fragment-buffer-for-full-pa.patch new file mode 100644 index 00000000000..9693ca5bf54 --- /dev/null +++ b/queue-4.9/batman-adv-expand-merged-fragment-buffer-for-full-pa.patch @@ -0,0 +1,53 @@ +From 87c5f8d9e9e5ebd3f5a0c3a3dcf92e6a812ee9de Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Wed, 7 Nov 2018 23:09:12 +0100 +Subject: batman-adv: Expand merged fragment buffer for full packet +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit d7d8bbb40a5b1f682ee6589e212934f4c6b8ad60 ] + +The complete size ("total_size") of the fragmented packet is stored in the +fragment header and in the size of the fragment chain. When the fragments +are ready for merge, the skbuff's tail of the first fragment is expanded to +have enough room after the data pointer for at least total_size. This means +that it gets expanded by total_size - first_skb->len. + +But this is ignoring the fact that after expanding the buffer, the fragment +header is pulled by from this buffer. Assuming that the tailroom of the +buffer was already 0, the buffer after the data pointer of the skbuff is +now only total_size - len(fragment_header) large. When the merge function +is then processing the remaining fragments, the code to copy the data over +to the merged skbuff will cause an skb_over_panic when it tries to actually +put enough data to fill the total_size bytes of the packet. + +The size of the skb_pull must therefore also be taken into account when the +buffer's tailroom is expanded. + +Fixes: 610bfc6bc99b ("batman-adv: Receive fragmented packets and merge") +Reported-by: Martin Weinelt +Co-authored-by: Linus Lüssing +Signed-off-by: Sven Eckelmann +Signed-off-by: Simon Wunderlich +Signed-off-by: Sasha Levin +--- + net/batman-adv/fragmentation.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index 57215e3fd1a0..a06b6041f3e0 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -264,7 +264,7 @@ batadv_frag_merge_packets(struct hlist_head *chain) + kfree(entry); + + packet = (struct batadv_frag_packet *)skb_out->data; +- size = ntohs(packet->total_size); ++ size = ntohs(packet->total_size) + hdr_size; + + /* Make room for the rest of the fragments. */ + if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) { +-- +2.19.1 + diff --git a/queue-4.9/bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch b/queue-4.9/bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch new file mode 100644 index 00000000000..ae48358593b --- /dev/null +++ b/queue-4.9/bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch @@ -0,0 +1,66 @@ +From f4e5a077049c331397831092c34d485eba7936d7 Mon Sep 17 00:00:00 2001 +From: Sudarsana Reddy Kalluru +Date: Sun, 11 Nov 2018 18:27:34 -0800 +Subject: bnx2x: Assign unique DMAE channel number for FW DMAE transactions. + +[ Upstream commit 77e461d14ed141253573eeeb4d34eccc51e38328 ] + +Driver assigns DMAE channel 0 for FW as part of START_RAMROD command. FW +uses this channel for DMAE operations (e.g., TIME_SYNC implementation). +Driver also uses the same channel 0 for DMAE operations for some of the PFs +(e.g., PF0 on Port0). This could lead to concurrent access to the DMAE +channel by FW and driver which is not legal. Hence need to assign unique +DMAE id for FW. +Currently following DMAE channels are used by the clients, + MFW - OCBB/OCSD functionality uses DMAE channel 14/15 + Driver 0-3 and 8-11 (for PF dmae operations) + 4 and 12 (for stats requests) +Assigning unique dmae_id '13' to the FW. + +Changes from previous version: +------------------------------ +v2: Incorporated the review comments. + +Signed-off-by: Sudarsana Reddy Kalluru +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller + +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 7 +++++++ + drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c | 1 + + 2 files changed, 8 insertions(+) + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +index f3f2d66432ab..d5e4c42662b6 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +@@ -2187,6 +2187,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id, + #define PMF_DMAE_C(bp) (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \ + E1HVN_MAX) + ++/* Following is the DMAE channel number allocation for the clients. ++ * MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively. ++ * Driver: 0-3 and 8-11 (for PF dmae operations) ++ * 4 and 12 (for stats requests) ++ */ ++#define BNX2X_FW_DMAE_C 13 /* Channel for FW DMAE operations */ ++ + /* PCIE link and speed */ + #define PCICFG_LINK_WIDTH 0x1f00000 + #define PCICFG_LINK_WIDTH_SHIFT 20 +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +index cea6bdcde33f..bf760c9cff6a 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +@@ -6149,6 +6149,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp, + rdata->sd_vlan_tag = cpu_to_le16(start_params->sd_vlan_tag); + rdata->path_id = BP_PATH(bp); + rdata->network_cos_mode = start_params->network_cos_mode; ++ rdata->dmae_cmd_id = BNX2X_FW_DMAE_C; + + rdata->vxlan_dst_port = cpu_to_le16(start_params->vxlan_dst_port); + rdata->geneve_dst_port = cpu_to_le16(start_params->geneve_dst_port); +-- +2.19.1 + diff --git a/queue-4.9/brcmutil-really-fix-decoding-channel-info-for-160-mh.patch b/queue-4.9/brcmutil-really-fix-decoding-channel-info-for-160-mh.patch new file mode 100644 index 00000000000..4484b0f568f --- /dev/null +++ b/queue-4.9/brcmutil-really-fix-decoding-channel-info-for-160-mh.patch @@ -0,0 +1,48 @@ +From 07d7a0ec04f5e5a10831e5836807ed9d30975abe Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Fri, 26 Oct 2018 12:50:39 +0200 +Subject: brcmutil: really fix decoding channel info for 160 MHz bandwidth +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +[ Upstream commit 3401d42c7ea2d064d15c66698ff8eb96553179ce ] + +Previous commit /adding/ support for 160 MHz chanspecs was incomplete. +It didn't set bandwidth info and didn't extract control channel info. As +the result it was also using uninitialized "sb" var. + +This change has been tested for two chanspecs found to be reported by +some devices/firmwares: +1) 60/160 (0xee32) + Before: chnum:50 control_ch_num:36 + After: chnum:50 control_ch_num:60 +2) 120/160 (0xed72) + Before: chnum:114 control_ch_num:100 + After: chnum:114 control_ch_num:120 + +Fixes: 330994e8e8ec ("brcmfmac: fix for proper support of 160MHz bandwidth") +Signed-off-by: Rafał Miłecki +Signed-off-by: Kalle Valo +Signed-off-by: Sasha Levin +--- + drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c +index e7584b842dce..eb5db94f5745 100644 +--- a/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c ++++ b/drivers/net/wireless/broadcom/brcm80211/brcmutil/d11.c +@@ -193,6 +193,9 @@ static void brcmu_d11ac_decchspec(struct brcmu_chan *ch) + } + break; + case BRCMU_CHSPEC_D11AC_BW_160: ++ ch->bw = BRCMU_CHAN_BW_160; ++ ch->sb = brcmu_maskget16(ch->chspec, BRCMU_CHSPEC_D11AC_SB_MASK, ++ BRCMU_CHSPEC_D11AC_SB_SHIFT); + switch (ch->sb) { + case BRCMU_CHAN_SB_LLL: + ch->control_ch_num -= CH_70MHZ_APART; +-- +2.19.1 + diff --git a/queue-4.9/can-rcar_can-fix-erroneous-registration.patch b/queue-4.9/can-rcar_can-fix-erroneous-registration.patch new file mode 100644 index 00000000000..fed3bdde4e1 --- /dev/null +++ b/queue-4.9/can-rcar_can-fix-erroneous-registration.patch @@ -0,0 +1,47 @@ +From a3bef4b54ea43cdb30256a678510c5ead2b7b1ce Mon Sep 17 00:00:00 2001 +From: Fabrizio Castro +Date: Mon, 10 Sep 2018 11:43:13 +0100 +Subject: can: rcar_can: Fix erroneous registration + +[ Upstream commit 68c8d209cd4337da4fa04c672f0b62bb735969bc ] + +Assigning 2 to "renesas,can-clock-select" tricks the driver into +registering the CAN interface, even though we don't want that. +This patch improves one of the checks to prevent that from happening. + +Fixes: 862e2b6af9413b43 ("can: rcar_can: support all input clocks") +Signed-off-by: Fabrizio Castro +Signed-off-by: Chris Paterson +Reviewed-by: Simon Horman +Signed-off-by: Marc Kleine-Budde +Signed-off-by: Sasha Levin +--- + drivers/net/can/rcar/rcar_can.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/can/rcar/rcar_can.c b/drivers/net/can/rcar/rcar_can.c +index 788459f6bf5c..9b2c3bd00f8b 100644 +--- a/drivers/net/can/rcar/rcar_can.c ++++ b/drivers/net/can/rcar/rcar_can.c +@@ -24,6 +24,9 @@ + + #define RCAR_CAN_DRV_NAME "rcar_can" + ++#define RCAR_SUPPORTED_CLOCKS (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \ ++ BIT(CLKR_CLKEXT)) ++ + /* Mailbox configuration: + * mailbox 60 - 63 - Rx FIFO mailboxes + * mailbox 56 - 59 - Tx FIFO mailboxes +@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev) + goto fail_clk; + } + +- if (clock_select >= ARRAY_SIZE(clock_names)) { ++ if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) { + err = -EINVAL; + dev_err(&pdev->dev, "invalid CAN clock selected\n"); + goto fail_clk; +-- +2.19.1 + diff --git a/queue-4.9/hid-input-ignore-battery-reported-by-symbol-ds4308.patch b/queue-4.9/hid-input-ignore-battery-reported-by-symbol-ds4308.patch new file mode 100644 index 00000000000..256f87e0b6a --- /dev/null +++ b/queue-4.9/hid-input-ignore-battery-reported-by-symbol-ds4308.patch @@ -0,0 +1,56 @@ +From bd0fc716878dcac5e9cc609183cb813984f552f2 Mon Sep 17 00:00:00 2001 +From: Benson Leung +Date: Thu, 8 Nov 2018 15:59:21 -0800 +Subject: HID: input: Ignore battery reported by Symbol DS4308 + +[ Upstream commit 0fd791841a6d67af1155a9c3de54dea51220721e ] + +The Motorola/Zebra Symbol DS4308-HD is a handheld USB barcode scanner +which does not have a battery, but reports one anyway that always has +capacity 2. + +Let's apply the IGNORE quirk to prevent it from being treated like a +power supply so that userspaces don't get confused that this +accessory is almost out of power and warn the user that they need to charge +their wired barcode scanner. + +Reported here: https://bugs.chromium.org/p/chromium/issues/detail?id=804720 + +Signed-off-by: Benson Leung +Reviewed-by: Benjamin Tissoires +Signed-off-by: Benjamin Tissoires +Signed-off-by: Sasha Levin +--- + drivers/hid/hid-ids.h | 1 + + drivers/hid/hid-input.c | 3 +++ + 2 files changed, 4 insertions(+) + +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 8913f357e78f..6f4c84d824e6 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -965,6 +965,7 @@ + #define USB_VENDOR_ID_SYMBOL 0x05e0 + #define USB_DEVICE_ID_SYMBOL_SCANNER_1 0x0800 + #define USB_DEVICE_ID_SYMBOL_SCANNER_2 0x1300 ++#define USB_DEVICE_ID_SYMBOL_SCANNER_3 0x1200 + + #define USB_VENDOR_ID_SYNAPTICS 0x06cb + #define USB_DEVICE_ID_SYNAPTICS_TP 0x0001 +diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c +index 5ff6dd8147b6..fc7ada26457e 100644 +--- a/drivers/hid/hid-input.c ++++ b/drivers/hid/hid-input.c +@@ -324,6 +324,9 @@ static const struct hid_device_id hid_battery_quirks[] = { + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, + USB_DEVICE_ID_ELECOM_BM084), + HID_BATTERY_QUIRK_IGNORE }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_SYMBOL, ++ USB_DEVICE_ID_SYMBOL_SCANNER_3), ++ HID_BATTERY_QUIRK_IGNORE }, + {} + }; + +-- +2.19.1 + diff --git a/queue-4.9/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch b/queue-4.9/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch new file mode 100644 index 00000000000..c693ae5a9c9 --- /dev/null +++ b/queue-4.9/iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch @@ -0,0 +1,55 @@ +From a275417a91e73b556752a599a1ba46be0b44e8e3 Mon Sep 17 00:00:00 2001 +From: Geert Uytterhoeven +Date: Wed, 7 Nov 2018 14:18:50 +0100 +Subject: iommu/ipmmu-vmsa: Fix crash on early domain free + +[ Upstream commit e5b78f2e349eef5d4fca5dc1cf5a3b4b2cc27abd ] + +If iommu_ops.add_device() fails, iommu_ops.domain_free() is still +called, leading to a crash, as the domain was only partially +initialized: + + ipmmu-vmsa e67b0000.mmu: Cannot accommodate DMA translation for IOMMU page tables + sata_rcar ee300000.sata: Unable to initialize IPMMU context + iommu: Failed to add device ee300000.sata to group 0: -22 + Unable to handle kernel NULL pointer dereference at virtual address 0000000000000038 + ... + Call trace: + ipmmu_domain_free+0x1c/0xa0 + iommu_group_release+0x48/0x68 + kobject_put+0x74/0xe8 + kobject_del.part.0+0x3c/0x50 + kobject_put+0x60/0xe8 + iommu_group_get_for_dev+0xa8/0x1f0 + ipmmu_add_device+0x1c/0x40 + of_iommu_configure+0x118/0x190 + +Fix this by checking if the domain's context already exists, before +trying to destroy it. + +Signed-off-by: Geert Uytterhoeven +Reviewed-by: Robin Murphy +Fixes: d25a2a16f0889 ('iommu: Add driver for Renesas VMSA-compatible IPMMU') +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/ipmmu-vmsa.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 85b5e75c7faa..3d2e9ca78f02 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -372,6 +372,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain) + + static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain) + { ++ if (!domain->mmu) ++ return; ++ + /* + * Disable the context. Flush the TLB as required when modifying the + * context registers. +-- +2.19.1 + diff --git a/queue-4.9/iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch b/queue-4.9/iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch new file mode 100644 index 00000000000..54cbd5eb453 --- /dev/null +++ b/queue-4.9/iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch @@ -0,0 +1,38 @@ +From 0d08564bfdade181fae9913e4aacbd8704262ca0 Mon Sep 17 00:00:00 2001 +From: Lu Baolu +Date: Mon, 5 Nov 2018 10:18:58 +0800 +Subject: iommu/vt-d: Fix NULL pointer dereference in prq_event_thread() + +[ Upstream commit 19ed3e2dd8549c1a34914e8dad01b64e7837645a ] + +When handling page request without pasid event, go to "no_pasid" +branch instead of "bad_req". Otherwise, a NULL pointer deference +will happen there. + +Cc: Ashok Raj +Cc: Jacob Pan +Cc: Sohil Mehta +Signed-off-by: Lu Baolu +Fixes: a222a7f0bb6c9 'iommu/vt-d: Implement page request handling' +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-svm.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index f846f0140a9d..7dc2f8d415b6 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -558,7 +558,7 @@ static irqreturn_t prq_event_thread(int irq, void *d) + pr_err("%s: Page request without PASID: %08llx %08llx\n", + iommu->name, ((unsigned long long *)req)[0], + ((unsigned long long *)req)[1]); +- goto bad_req; ++ goto no_pasid; + } + + if (!svm || svm->pasid != req->pasid) { +-- +2.19.1 + diff --git a/queue-4.9/iommu-vt-d-use-memunmap-to-free-memremap.patch b/queue-4.9/iommu-vt-d-use-memunmap-to-free-memremap.patch new file mode 100644 index 00000000000..1a906519f1e --- /dev/null +++ b/queue-4.9/iommu-vt-d-use-memunmap-to-free-memremap.patch @@ -0,0 +1,34 @@ +From e39e96db94dbb207e418c121765db116f66b8d0b Mon Sep 17 00:00:00 2001 +From: Pan Bian +Date: Wed, 21 Nov 2018 17:53:47 +0800 +Subject: iommu/vt-d: Use memunmap to free memremap + +[ Upstream commit 829383e183728dec7ed9150b949cd6de64127809 ] + +memunmap() should be used to free the return of memremap(), not +iounmap(). + +Fixes: dfddb969edf0 ('iommu/vt-d: Switch from ioremap_cache to memremap') +Signed-off-by: Pan Bian +Signed-off-by: Joerg Roedel +Signed-off-by: Sasha Levin +--- + drivers/iommu/intel-iommu.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 2558a381e118..f8c8537f0587 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -3054,7 +3054,7 @@ static int copy_context_table(struct intel_iommu *iommu, + } + + if (old_ce) +- iounmap(old_ce); ++ memunmap(old_ce); + + ret = 0; + if (devfn < 0x80) +-- +2.19.1 + diff --git a/queue-4.9/media-omap3isp-unregister-media-device-as-first.patch b/queue-4.9/media-omap3isp-unregister-media-device-as-first.patch new file mode 100644 index 00000000000..39a0c019f73 --- /dev/null +++ b/queue-4.9/media-omap3isp-unregister-media-device-as-first.patch @@ -0,0 +1,43 @@ +From 6718b8f3ea082a06ec874e42da48c82440948fee Mon Sep 17 00:00:00 2001 +From: Sakari Ailus +Date: Tue, 9 Oct 2018 07:49:49 -0400 +Subject: media: omap3isp: Unregister media device as first + +[ Upstream commit 30efae3d789cd0714ef795545a46749236e29558 ] + +While there are issues related to object lifetime management, unregister the +media device first when the driver is being unbound. This is slightly +safer. + +Signed-off-by: Sakari Ailus +Reviewed-by: Laurent Pinchart +Signed-off-by: Mauro Carvalho Chehab +Signed-off-by: Sasha Levin +--- + drivers/media/platform/omap3isp/isp.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/drivers/media/platform/omap3isp/isp.c b/drivers/media/platform/omap3isp/isp.c +index 1e98b4845ea1..a21b12c5c085 100644 +--- a/drivers/media/platform/omap3isp/isp.c ++++ b/drivers/media/platform/omap3isp/isp.c +@@ -1591,6 +1591,8 @@ static void isp_pm_complete(struct device *dev) + + static void isp_unregister_entities(struct isp_device *isp) + { ++ media_device_unregister(&isp->media_dev); ++ + omap3isp_csi2_unregister_entities(&isp->isp_csi2a); + omap3isp_ccp2_unregister_entities(&isp->isp_ccp2); + omap3isp_ccdc_unregister_entities(&isp->isp_ccdc); +@@ -1601,7 +1603,6 @@ static void isp_unregister_entities(struct isp_device *isp) + omap3isp_stat_unregister_entities(&isp->isp_hist); + + v4l2_device_unregister(&isp->v4l2_dev); +- media_device_unregister(&isp->media_dev); + media_device_cleanup(&isp->media_dev); + } + +-- +2.19.1 + diff --git a/queue-4.9/mm-don-t-warn-about-allocations-which-stall-for-too-.patch b/queue-4.9/mm-don-t-warn-about-allocations-which-stall-for-too-.patch new file mode 100644 index 00000000000..81510ba2dc3 --- /dev/null +++ b/queue-4.9/mm-don-t-warn-about-allocations-which-stall-for-too-.patch @@ -0,0 +1,189 @@ +From e37fde4c2a4ad649d6a0be878a70856a87f3ce55 Mon Sep 17 00:00:00 2001 +From: Tetsuo Handa +Date: Fri, 7 Dec 2018 12:33:56 -0800 +Subject: mm: don't warn about allocations which stall for too long + +commit 400e22499dd92613821374c8c6c88c7225359980 upstream. + +Commit 63f53dea0c98 ("mm: warn about allocations which stall for too +long") was a great step for reducing possibility of silent hang up +problem caused by memory allocation stalls. But this commit reverts it, +for it is possible to trigger OOM lockup and/or soft lockups when many +threads concurrently called warn_alloc() (in order to warn about memory +allocation stalls) due to current implementation of printk(), and it is +difficult to obtain useful information due to limitation of synchronous +warning approach. + +Current printk() implementation flushes all pending logs using the +context of a thread which called console_unlock(). printk() should be +able to flush all pending logs eventually unless somebody continues +appending to printk() buffer. + +Since warn_alloc() started appending to printk() buffer while waiting +for oom_kill_process() to make forward progress when oom_kill_process() +is processing pending logs, it became possible for warn_alloc() to force +oom_kill_process() loop inside printk(). As a result, warn_alloc() +significantly increased possibility of preventing oom_kill_process() +from making forward progress. + +---------- Pseudo code start ---------- +Before warn_alloc() was introduced: + + retry: + if (mutex_trylock(&oom_lock)) { + while (atomic_read(&printk_pending_logs) > 0) { + atomic_dec(&printk_pending_logs); + print_one_log(); + } + // Send SIGKILL here. + mutex_unlock(&oom_lock) + } + goto retry; + +After warn_alloc() was introduced: + + retry: + if (mutex_trylock(&oom_lock)) { + while (atomic_read(&printk_pending_logs) > 0) { + atomic_dec(&printk_pending_logs); + print_one_log(); + } + // Send SIGKILL here. + mutex_unlock(&oom_lock) + } else if (waited_for_10seconds()) { + atomic_inc(&printk_pending_logs); + } + goto retry; +---------- Pseudo code end ---------- + +Although waited_for_10seconds() becomes true once per 10 seconds, +unbounded number of threads can call waited_for_10seconds() at the same +time. Also, since threads doing waited_for_10seconds() keep doing +almost busy loop, the thread doing print_one_log() can use little CPU +resource. Therefore, this situation can be simplified like + +---------- Pseudo code start ---------- + retry: + if (mutex_trylock(&oom_lock)) { + while (atomic_read(&printk_pending_logs) > 0) { + atomic_dec(&printk_pending_logs); + print_one_log(); + } + // Send SIGKILL here. + mutex_unlock(&oom_lock) + } else { + atomic_inc(&printk_pending_logs); + } + goto retry; +---------- Pseudo code end ---------- + +when printk() is called faster than print_one_log() can process a log. + +One of possible mitigation would be to introduce a new lock in order to +make sure that no other series of printk() (either oom_kill_process() or +warn_alloc()) can append to printk() buffer when one series of printk() +(either oom_kill_process() or warn_alloc()) is already in progress. + +Such serialization will also help obtaining kernel messages in readable +form. + +---------- Pseudo code start ---------- + retry: + if (mutex_trylock(&oom_lock)) { + mutex_lock(&oom_printk_lock); + while (atomic_read(&printk_pending_logs) > 0) { + atomic_dec(&printk_pending_logs); + print_one_log(); + } + // Send SIGKILL here. + mutex_unlock(&oom_printk_lock); + mutex_unlock(&oom_lock) + } else { + if (mutex_trylock(&oom_printk_lock)) { + atomic_inc(&printk_pending_logs); + mutex_unlock(&oom_printk_lock); + } + } + goto retry; +---------- Pseudo code end ---------- + +But this commit does not go that direction, for we don't want to +introduce a new lock dependency, and we unlikely be able to obtain +useful information even if we serialized oom_kill_process() and +warn_alloc(). + +Synchronous approach is prone to unexpected results (e.g. too late [1], +too frequent [2], overlooked [3]). As far as I know, warn_alloc() never +helped with providing information other than "something is going wrong". +I want to consider asynchronous approach which can obtain information +during stalls with possibly relevant threads (e.g. the owner of +oom_lock and kswapd-like threads) and serve as a trigger for actions +(e.g. turn on/off tracepoints, ask libvirt daemon to take a memory dump +of stalling KVM guest for diagnostic purpose). + +This commit temporarily loses ability to report e.g. OOM lockup due to +unable to invoke the OOM killer due to !__GFP_FS allocation request. +But asynchronous approach will be able to detect such situation and emit +warning. Thus, let's remove warn_alloc(). + +[1] https://bugzilla.kernel.org/show_bug.cgi?id=192981 +[2] http://lkml.kernel.org/r/CAM_iQpWuPVGc2ky8M-9yukECtS+zKjiDasNymX7rMcBjBFyM_A@mail.gmail.com +[3] commit db73ee0d46379922 ("mm, vmscan: do not loop on too_many_isolated for ever")) + +Link: http://lkml.kernel.org/r/1509017339-4802-1-git-send-email-penguin-kernel@I-love.SAKURA.ne.jp +Signed-off-by: Tetsuo Handa +Reported-by: Cong Wang +Reported-by: yuwang.yuwang +Reported-by: Johannes Weiner +Acked-by: Michal Hocko +Acked-by: Johannes Weiner +Cc: Vlastimil Babka +Cc: Mel Gorman +Cc: Dave Hansen +Cc: Sergey Senozhatsky +Cc: Petr Mladek +Cc: Steven Rostedt +Signed-off-by: Andrew Morton + +Signed-off-by: Linus Torvalds + +[Resolved backport conflict due to missing 8225196, a8e9925, 9e80c71 and + 9a67f64 in 4.9 -- all of which modified this hunk being removed.] +Signed-off-by: Amit Shah + +Signed-off-by: Sasha Levin +--- + mm/page_alloc.c | 10 ---------- + 1 file changed, 10 deletions(-) + +diff --git a/mm/page_alloc.c b/mm/page_alloc.c +index 28240ce475d6..3af727d95c17 100644 +--- a/mm/page_alloc.c ++++ b/mm/page_alloc.c +@@ -3530,8 +3530,6 @@ __alloc_pages_slowpath(gfp_t gfp_mask, unsigned int order, + enum compact_result compact_result; + int compaction_retries; + int no_progress_loops; +- unsigned long alloc_start = jiffies; +- unsigned int stall_timeout = 10 * HZ; + unsigned int cpuset_mems_cookie; + + /* +@@ -3704,14 +3702,6 @@ retry: + if (order > PAGE_ALLOC_COSTLY_ORDER && !(gfp_mask & __GFP_REPEAT)) + goto nopage; + +- /* Make sure we know about allocations which stall for too long */ +- if (time_after(jiffies, alloc_start + stall_timeout)) { +- warn_alloc(gfp_mask, +- "page allocation stalls for %ums, order:%u", +- jiffies_to_msecs(jiffies-alloc_start), order); +- stall_timeout += 10 * HZ; +- } +- + if (should_reclaim_retry(gfp_mask, order, ac, alloc_flags, + did_some_progress > 0, &no_progress_loops)) + goto retry; +-- +2.19.1 + diff --git a/queue-4.9/mtd-rawnand-qcom-namespace-prefix-some-commands.patch b/queue-4.9/mtd-rawnand-qcom-namespace-prefix-some-commands.patch new file mode 100644 index 00000000000..9f1e8531050 --- /dev/null +++ b/queue-4.9/mtd-rawnand-qcom-namespace-prefix-some-commands.patch @@ -0,0 +1,112 @@ +From e1459b81229c3a07c59da1609a7aeb7ca9cd1da9 Mon Sep 17 00:00:00 2001 +From: Olof Johansson +Date: Fri, 16 Nov 2018 19:43:27 -0800 +Subject: mtd: rawnand: qcom: Namespace prefix some commands + +[ Upstream commit 33bf5519ae5dd356b182a94e3622f42860274a38 ] + +PAGE_READ is used by RISC-V arch code included through mm headers, +and it makes sense to bring in a prefix on these in the driver. + +drivers/mtd/nand/raw/qcom_nandc.c:153: warning: "PAGE_READ" redefined + #define PAGE_READ 0x2 +In file included from include/linux/memremap.h:7, + from include/linux/mm.h:27, + from include/linux/scatterlist.h:8, + from include/linux/dma-mapping.h:11, + from drivers/mtd/nand/raw/qcom_nandc.c:17: +arch/riscv/include/asm/pgtable.h:48: note: this is the location of the previous definition + +Caught by riscv allmodconfig. + +Signed-off-by: Olof Johansson +Reviewed-by: Miquel Raynal +Signed-off-by: Boris Brezillon +Signed-off-by: Sasha Levin +--- + drivers/mtd/nand/qcom_nandc.c | 32 ++++++++++++++++---------------- + 1 file changed, 16 insertions(+), 16 deletions(-) + +diff --git a/drivers/mtd/nand/qcom_nandc.c b/drivers/mtd/nand/qcom_nandc.c +index dc4943134649..9f6c9a34b9eb 100644 +--- a/drivers/mtd/nand/qcom_nandc.c ++++ b/drivers/mtd/nand/qcom_nandc.c +@@ -142,15 +142,15 @@ + #define NAND_VERSION_MINOR_SHIFT 16 + + /* NAND OP_CMDs */ +-#define PAGE_READ 0x2 +-#define PAGE_READ_WITH_ECC 0x3 +-#define PAGE_READ_WITH_ECC_SPARE 0x4 +-#define PROGRAM_PAGE 0x6 +-#define PAGE_PROGRAM_WITH_ECC 0x7 +-#define PROGRAM_PAGE_SPARE 0x9 +-#define BLOCK_ERASE 0xa +-#define FETCH_ID 0xb +-#define RESET_DEVICE 0xd ++#define OP_PAGE_READ 0x2 ++#define OP_PAGE_READ_WITH_ECC 0x3 ++#define OP_PAGE_READ_WITH_ECC_SPARE 0x4 ++#define OP_PROGRAM_PAGE 0x6 ++#define OP_PAGE_PROGRAM_WITH_ECC 0x7 ++#define OP_PROGRAM_PAGE_SPARE 0x9 ++#define OP_BLOCK_ERASE 0xa ++#define OP_FETCH_ID 0xb ++#define OP_RESET_DEVICE 0xd + + /* Default Value for NAND_DEV_CMD_VLD */ + #define NAND_DEV_CMD_VLD_VAL (READ_START_VLD | WRITE_START_VLD | \ +@@ -425,11 +425,11 @@ static void update_rw_regs(struct qcom_nand_host *host, int num_cw, bool read) + + if (read) { + if (host->use_ecc) +- cmd = PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE; ++ cmd = OP_PAGE_READ_WITH_ECC | PAGE_ACC | LAST_PAGE; + else +- cmd = PAGE_READ | PAGE_ACC | LAST_PAGE; ++ cmd = OP_PAGE_READ | PAGE_ACC | LAST_PAGE; + } else { +- cmd = PROGRAM_PAGE | PAGE_ACC | LAST_PAGE; ++ cmd = OP_PROGRAM_PAGE | PAGE_ACC | LAST_PAGE; + } + + if (host->use_ecc) { +@@ -662,7 +662,7 @@ static int nandc_param(struct qcom_nand_host *host) + * in use. we configure the controller to perform a raw read of 512 + * bytes to read onfi params + */ +- nandc_set_reg(nandc, NAND_FLASH_CMD, PAGE_READ | PAGE_ACC | LAST_PAGE); ++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_PAGE_READ | PAGE_ACC | LAST_PAGE); + nandc_set_reg(nandc, NAND_ADDR0, 0); + nandc_set_reg(nandc, NAND_ADDR1, 0); + nandc_set_reg(nandc, NAND_DEV0_CFG0, 0 << CW_PER_PAGE +@@ -715,7 +715,7 @@ static int erase_block(struct qcom_nand_host *host, int page_addr) + struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); + + nandc_set_reg(nandc, NAND_FLASH_CMD, +- BLOCK_ERASE | PAGE_ACC | LAST_PAGE); ++ OP_BLOCK_ERASE | PAGE_ACC | LAST_PAGE); + nandc_set_reg(nandc, NAND_ADDR0, page_addr); + nandc_set_reg(nandc, NAND_ADDR1, 0); + nandc_set_reg(nandc, NAND_DEV0_CFG0, +@@ -746,7 +746,7 @@ static int read_id(struct qcom_nand_host *host, int column) + if (column == -1) + return 0; + +- nandc_set_reg(nandc, NAND_FLASH_CMD, FETCH_ID); ++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_FETCH_ID); + nandc_set_reg(nandc, NAND_ADDR0, column); + nandc_set_reg(nandc, NAND_ADDR1, 0); + nandc_set_reg(nandc, NAND_FLASH_CHIP_SELECT, DM_EN); +@@ -766,7 +766,7 @@ static int reset(struct qcom_nand_host *host) + struct nand_chip *chip = &host->chip; + struct qcom_nand_controller *nandc = get_qcom_nand_controller(chip); + +- nandc_set_reg(nandc, NAND_FLASH_CMD, RESET_DEVICE); ++ nandc_set_reg(nandc, NAND_FLASH_CMD, OP_RESET_DEVICE); + nandc_set_reg(nandc, NAND_EXEC_CMD, 1); + + write_reg_dma(nandc, NAND_FLASH_CMD, 1); +-- +2.19.1 + diff --git a/queue-4.9/net-amd-add-missing-of_node_put.patch b/queue-4.9/net-amd-add-missing-of_node_put.patch new file mode 100644 index 00000000000..2de95e1a586 --- /dev/null +++ b/queue-4.9/net-amd-add-missing-of_node_put.patch @@ -0,0 +1,43 @@ +From 868a598f02d3681febd940c89e6d49ae5ca5a1e5 Mon Sep 17 00:00:00 2001 +From: Yangtao Li +Date: Thu, 22 Nov 2018 07:34:41 -0500 +Subject: net: amd: add missing of_node_put() + +[ Upstream commit c44c749d3b6fdfca39002e7e48e03fe9f9fe37a3 ] + +of_find_node_by_path() acquires a reference to the node +returned by it and that reference needs to be dropped by its caller. +This place doesn't do that, so fix it. + +Signed-off-by: Yangtao Li +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/amd/sunlance.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c +index 9b56b40259dc..3153465d4d02 100644 +--- a/drivers/net/ethernet/amd/sunlance.c ++++ b/drivers/net/ethernet/amd/sunlance.c +@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op, + + prop = of_get_property(nd, "tpe-link-test?", NULL); + if (!prop) +- goto no_link_test; ++ goto node_put; + + if (strcmp(prop, "true")) { + printk(KERN_NOTICE "SunLance: warning: overriding option " +@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op, + "to ecd@skynet.be\n"); + auxio_set_lte(AUXIO_LTE_ON); + } ++node_put: ++ of_node_put(nd); + no_link_test: + lp->auto_select = 1; + lp->tpe = 0; +-- +2.19.1 + diff --git a/queue-4.9/net-faraday-ftmac100-remove-netif_running-netdev-che.patch b/queue-4.9/net-faraday-ftmac100-remove-netif_running-netdev-che.patch new file mode 100644 index 00000000000..ed33a3eafb8 --- /dev/null +++ b/queue-4.9/net-faraday-ftmac100-remove-netif_running-netdev-che.patch @@ -0,0 +1,55 @@ +From cc3b58550994d6b5f5fda863747578e5349e031b Mon Sep 17 00:00:00 2001 +From: Vincent Chen +Date: Wed, 21 Nov 2018 09:38:11 +0800 +Subject: net: faraday: ftmac100: remove netif_running(netdev) check before + disabling interrupts + +[ Upstream commit 426a593e641ebf0d9288f0a2fcab644a86820220 ] + +In the original ftmac100_interrupt(), the interrupts are only disabled when +the condition "netif_running(netdev)" is true. However, this condition +causes kerenl hang in the following case. When the user requests to +disable the network device, kernel will clear the bit __LINK_STATE_START +from the dev->state and then call the driver's ndo_stop function. Network +device interrupts are not blocked during this process. If an interrupt +occurs between clearing __LINK_STATE_START and stopping network device, +kernel cannot disable the interrupts due to the condition +"netif_running(netdev)" in the ISR. Hence, kernel will hang due to the +continuous interruption of the network device. + +In order to solve the above problem, the interrupts of the network device +should always be disabled in the ISR without being restricted by the +condition "netif_running(netdev)". + +[V2] +Remove unnecessary curly braces. + +Signed-off-by: Vincent Chen +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/faraday/ftmac100.c | 7 +++---- + 1 file changed, 3 insertions(+), 4 deletions(-) + +diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c +index dce5f7b7f772..05e1f923f49e 100644 +--- a/drivers/net/ethernet/faraday/ftmac100.c ++++ b/drivers/net/ethernet/faraday/ftmac100.c +@@ -865,11 +865,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id) + struct net_device *netdev = dev_id; + struct ftmac100 *priv = netdev_priv(netdev); + +- if (likely(netif_running(netdev))) { +- /* Disable interrupts for polling */ +- ftmac100_disable_all_int(priv); ++ /* Disable interrupts for polling */ ++ ftmac100_disable_all_int(priv); ++ if (likely(netif_running(netdev))) + napi_schedule(&priv->napi); +- } + + return IRQ_HANDLED; + } +-- +2.19.1 + diff --git a/queue-4.9/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch b/queue-4.9/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch new file mode 100644 index 00000000000..14a28522f8e --- /dev/null +++ b/queue-4.9/net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch @@ -0,0 +1,45 @@ +From ea68da14fd3180b273f464d2621cb45b0b7818a0 Mon Sep 17 00:00:00 2001 +From: Aya Levin +Date: Thu, 15 Nov 2018 18:05:15 +0200 +Subject: net/mlx4: Fix UBSAN warning of signed integer overflow + +[ Upstream commit a463146e67c848cbab5ce706d6528281b7cded08 ] + +UBSAN: Undefined behavior in +drivers/net/ethernet/mellanox/mlx4/resource_tracker.c:626:29 +signed integer overflow: 1802201963 + 1802201963 cannot be represented +in type 'int' + +The union of res_reserved and res_port_rsvd[MLX4_MAX_PORTS] monitors +granting of reserved resources. The grant operation is calculated and +protected, thus both members of the union cannot be negative. Changed +type of res_reserved and of res_port_rsvd[MLX4_MAX_PORTS] from signed +int to unsigned int, allowing large value. + +Fixes: 5a0d0a6161ae ("mlx4: Structures and init/teardown for VF resource quotas") +Signed-off-by: Aya Levin +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/mlx4.h | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +index 086920b615af..df5d86fa0a92 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +@@ -542,8 +542,8 @@ struct slave_list { + struct resource_allocator { + spinlock_t alloc_lock; /* protect quotas */ + union { +- int res_reserved; +- int res_port_rsvd[MLX4_MAX_PORTS]; ++ unsigned int res_reserved; ++ unsigned int res_port_rsvd[MLX4_MAX_PORTS]; + }; + union { + int res_free; +-- +2.19.1 + diff --git a/queue-4.9/net-mlx4_core-fix-uninitialized-variable-compilation.patch b/queue-4.9/net-mlx4_core-fix-uninitialized-variable-compilation.patch new file mode 100644 index 00000000000..139d89caa88 --- /dev/null +++ b/queue-4.9/net-mlx4_core-fix-uninitialized-variable-compilation.patch @@ -0,0 +1,33 @@ +From d4bcc4bf7cef884bebfd5f6533199cccb46fe510 Mon Sep 17 00:00:00 2001 +From: Tariq Toukan +Date: Thu, 15 Nov 2018 18:05:14 +0200 +Subject: net/mlx4_core: Fix uninitialized variable compilation warning + +[ Upstream commit 3ea7e7ea53c9f6ee41cb69a29c375fe9dd9a56a7 ] + +Initialize the uid variable to zero to avoid the compilation warning. + +Fixes: 7a89399ffad7 ("net/mlx4: Add mlx4_bitmap zone allocator") +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/alloc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c +index 249a4584401a..b89a34fa3601 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c ++++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c +@@ -339,7 +339,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc) + static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count, + int align, u32 skip_mask, u32 *puid) + { +- u32 uid; ++ u32 uid = 0; + u32 res; + struct mlx4_zone_allocator *zone_alloc = zone->allocator; + struct mlx4_zone_entry *curr_node; +-- +2.19.1 + diff --git a/queue-4.9/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch b/queue-4.9/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch new file mode 100644 index 00000000000..dec3bc50a43 --- /dev/null +++ b/queue-4.9/net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch @@ -0,0 +1,47 @@ +From 537f61508556d4a9b45a2f65c33d14e3bd88effe Mon Sep 17 00:00:00 2001 +From: Jack Morgenstein +Date: Thu, 15 Nov 2018 18:05:13 +0200 +Subject: net/mlx4_core: Zero out lkey field in SW2HW_MPT fw command + +[ Upstream commit bd85fbc2038a1bbe84990b23ff69b6fc81a32b2c ] + +When re-registering a user mr, the mpt information for the +existing mr when running SRIOV is obtained via the QUERY_MPT +fw command. The returned information includes the mpt's lkey. + +This retrieved mpt information is used to move the mpt back +to hardware ownership in the rereg flow (via the SW2HW_MPT +fw command when running SRIOV). + +The fw API spec states that for SW2HW_MPT, the lkey field +must be zero. Any ConnectX-3 PF driver which checks for strict spec +adherence will return failure for SW2HW_MPT if the lkey field is not +zero (although the fw in practice ignores this field for SW2HW_MPT). + +Thus, in order to conform to the fw API spec, set the lkey field to zero +before invoking SW2HW_MPT when running SRIOV. + +Fixes: e630664c8383 ("mlx4_core: Add helper functions to support MR re-registration") +Signed-off-by: Jack Morgenstein +Signed-off-by: Tariq Toukan +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/mellanox/mlx4/mr.c | 1 + + 1 file changed, 1 insertion(+) + +diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c +index 395b5463cfd9..3637474cab8a 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mr.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c +@@ -366,6 +366,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr, + container_of((void *)mpt_entry, struct mlx4_cmd_mailbox, + buf); + ++ (*mpt_entry)->lkey = 0; + err = mlx4_SW2HW_MPT(dev, mailbox, key); + } + +-- +2.19.1 + diff --git a/queue-4.9/qed-fix-ptt-leak-in-qed_drain.patch b/queue-4.9/qed-fix-ptt-leak-in-qed_drain.patch new file mode 100644 index 00000000000..9dbb6113c8e --- /dev/null +++ b/queue-4.9/qed-fix-ptt-leak-in-qed_drain.patch @@ -0,0 +1,35 @@ +From 39d080c97cc4f0c4598dbc23f00ee5a3ccfedb6b Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Mon, 12 Nov 2018 12:50:20 +0200 +Subject: qed: Fix PTT leak in qed_drain() + +[ Upstream commit 9aaa4e8ba12972d674caeefbc5f88d83235dd697 ] + +Release PTT before entering error flow. + +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index 1ed13a165e58..a769196628d9 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -1395,9 +1395,9 @@ static int qed_drain(struct qed_dev *cdev) + return -EBUSY; + } + rc = qed_mcp_drain(hwfn, ptt); ++ qed_ptt_release(hwfn, ptt); + if (rc) + return rc; +- qed_ptt_release(hwfn, ptt); + } + + return 0; +-- +2.19.1 + diff --git a/queue-4.9/qed-fix-reading-wrong-value-in-loop-condition.patch b/queue-4.9/qed-fix-reading-wrong-value-in-loop-condition.patch new file mode 100644 index 00000000000..0483de380ec --- /dev/null +++ b/queue-4.9/qed-fix-reading-wrong-value-in-loop-condition.patch @@ -0,0 +1,34 @@ +From 1a819f3d831d3c105dfe23cb7442a19285f203c4 Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Mon, 12 Nov 2018 12:50:23 +0200 +Subject: qed: Fix reading wrong value in loop condition + +[ Upstream commit ed4eac20dcffdad47709422e0cb925981b056668 ] + +The value of "sb_index" is written by the hardware. Reading its value and +writing it to "index" must finish before checking the loop condition. + +Signed-off-by: Denis Bolotin +Signed-off-by: Michal Kalderon +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/ethernet/qlogic/qed/qed_int.c | 2 ++ + 1 file changed, 2 insertions(+) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c +index 2adedc6fb6cf..fd19372db2f8 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_int.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c +@@ -2135,6 +2135,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn) + */ + do { + index = p_sb_attn->sb_index; ++ /* finish reading index before the loop condition */ ++ dma_rmb(); + attn_bits = le32_to_cpu(p_sb_attn->atten_bits); + attn_acks = le32_to_cpu(p_sb_attn->atten_ack); + } while (index != p_sb_attn->sb_index); +-- +2.19.1 + diff --git a/queue-4.9/series b/queue-4.9/series new file mode 100644 index 00000000000..17ee9064aa1 --- /dev/null +++ b/queue-4.9/series @@ -0,0 +1,19 @@ +media-omap3isp-unregister-media-device-as-first.patch +iommu-vt-d-fix-null-pointer-dereference-in-prq_event.patch +brcmutil-really-fix-decoding-channel-info-for-160-mh.patch +iommu-ipmmu-vmsa-fix-crash-on-early-domain-free.patch +can-rcar_can-fix-erroneous-registration.patch +hid-input-ignore-battery-reported-by-symbol-ds4308.patch +batman-adv-expand-merged-fragment-buffer-for-full-pa.patch +bnx2x-assign-unique-dmae-channel-number-for-fw-dmae-.patch +qed-fix-ptt-leak-in-qed_drain.patch +qed-fix-reading-wrong-value-in-loop-condition.patch +net-mlx4_core-zero-out-lkey-field-in-sw2hw_mpt-fw-co.patch +net-mlx4_core-fix-uninitialized-variable-compilation.patch +net-mlx4-fix-ubsan-warning-of-signed-integer-overflo.patch +mtd-rawnand-qcom-namespace-prefix-some-commands.patch +net-faraday-ftmac100-remove-netif_running-netdev-che.patch +iommu-vt-d-use-memunmap-to-free-memremap.patch +team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch +net-amd-add-missing-of_node_put.patch +mm-don-t-warn-about-allocations-which-stall-for-too-.patch diff --git a/queue-4.9/team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch b/queue-4.9/team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch new file mode 100644 index 00000000000..76f754089fb --- /dev/null +++ b/queue-4.9/team-no-need-to-do-team_notify_peers-or-team_mcast_r.patch @@ -0,0 +1,48 @@ +From ee2f688d393f60830f8b524d4efcdfba3eb873b2 Mon Sep 17 00:00:00 2001 +From: Hangbin Liu +Date: Thu, 22 Nov 2018 16:15:28 +0800 +Subject: team: no need to do team_notify_peers or team_mcast_rejoin when + disabling port + +[ Upstream commit 5ed9dc99107144f83b6c1bb52a69b58875baf540 ] + +team_notify_peers() will send ARP and NA to notify peers. team_mcast_rejoin() +will send multicast join group message to notify peers. We should do this when +enabling/changed to a new port. But it doesn't make sense to do it when a port +is disabled. + +On the other hand, when we set mcast_rejoin_count to 2, and do a failover, +team_port_disable() will increase mcast_rejoin.count_pending to 2 and then +team_port_enable() will increase mcast_rejoin.count_pending to 4. We will send +4 mcast rejoin messages at latest, which will make user confused. The same +with notify_peers.count. + +Fix it by deleting team_notify_peers() and team_mcast_rejoin() in +team_port_disable(). + +Reported-by: Liang Li +Fixes: fc423ff00df3a ("team: add peer notification") +Fixes: 492b200efdd20 ("team: add support for sending multicast rejoins") +Signed-off-by: Hangbin Liu +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +--- + drivers/net/team/team.c | 2 -- + 1 file changed, 2 deletions(-) + +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 9670aa23ffb9..94b05dd827af 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -989,8 +989,6 @@ static void team_port_disable(struct team *team, + team->en_port_count--; + team_queue_override_port_del(team, port); + team_adjust_ops(team); +- team_notify_peers(team); +- team_mcast_rejoin(team); + team_lower_state_changed(port); + } + +-- +2.19.1 +