From: Greg Kroah-Hartman Date: Fri, 6 May 2016 16:32:46 +0000 (-0400) Subject: 4.4-stable patches X-Git-Tag: v3.14.69~29 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f55cc6ad93398f3120f8c071790143c4667b5393;p=thirdparty%2Fkernel%2Fstable-queue.git 4.4-stable patches added patches: ata-ahci_xgene-dereferencing-uninitialized-pointer-in-probe.patch clk-divider-make-sure-read-only-dividers-do-not-write-to-their-register.patch clk-meson-fix-meson_clk_register_clks-signature-type-mismatch.patch clk-qcom-msm8960-fix-ce3_core-clk-enable-register.patch clk-qcom-msm8960-fix-ce3_src-register-offset.patch clk-rockchip-free-memory-in-error-cases-when-registering-clock-branches.patch clk-versatile-sp810-support-reentrance.patch cns3xxx-fix-pci-cns3xxx_write_config.patch ipvs-correct-initial-offset-of-call-id-header-search-in-sip-persistence-engine.patch ipvs-drop-first-packet-to-redirect-conntrack.patch ipvs-handle-ip_vs_fill_iph_skb_off-failure.patch lpfc-fix-misleading-indentation.patch mfd-intel-lpss-remove-clock-tree-on-error-path.patch mwifiex-fix-corner-case-association-failure.patch nbd-ratelimit-error-msgs-after-socket-close.patch rdma-iw_cxgb4-fix-bar2-virt-addr-calculation-for-t4-chips.patch revert-powerpc-tm-check-for-already-reclaimed-tasks.patch soc-rockchip-power-domain-fix-err-handle-while-probing.patch --- diff --git a/queue-4.4/ata-ahci_xgene-dereferencing-uninitialized-pointer-in-probe.patch b/queue-4.4/ata-ahci_xgene-dereferencing-uninitialized-pointer-in-probe.patch new file mode 100644 index 00000000000..78147f06474 --- /dev/null +++ b/queue-4.4/ata-ahci_xgene-dereferencing-uninitialized-pointer-in-probe.patch @@ -0,0 +1,36 @@ +From 8134233e8d346aaa1c929dc510e75482ae318bce Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 10 Mar 2016 10:45:32 +0300 +Subject: ata: ahci_xgene: dereferencing uninitialized pointer in probe + +From: Dan Carpenter + +commit 8134233e8d346aaa1c929dc510e75482ae318bce upstream. + +If the call to acpi_get_object_info() fails then "info" hasn't been +initialized. In that situation, we already know that "version" should +be XGENE_AHCI_V1 so we don't actually need to dereference "info". + +Fixes: c9802a4be661 ('ata: ahci_xgene: Add AHCI Support for 2nd HW version of APM X-Gene SoC AHCI SATA Host controller.') +Signed-off-by: Dan Carpenter +Signed-off-by: Tejun Heo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/ata/ahci_xgene.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/ata/ahci_xgene.c ++++ b/drivers/ata/ahci_xgene.c +@@ -739,9 +739,9 @@ static int xgene_ahci_probe(struct platf + dev_warn(&pdev->dev, "%s: Error reading device info. Assume version1\n", + __func__); + version = XGENE_AHCI_V1; +- } +- if (info->valid & ACPI_VALID_CID) ++ } else if (info->valid & ACPI_VALID_CID) { + version = XGENE_AHCI_V2; ++ } + } + } + #endif diff --git a/queue-4.4/clk-divider-make-sure-read-only-dividers-do-not-write-to-their-register.patch b/queue-4.4/clk-divider-make-sure-read-only-dividers-do-not-write-to-their-register.patch new file mode 100644 index 00000000000..6afc63679ac --- /dev/null +++ b/queue-4.4/clk-divider-make-sure-read-only-dividers-do-not-write-to-their-register.patch @@ -0,0 +1,103 @@ +From 50359819794b4a16ae35051cd80f2dab025f6019 Mon Sep 17 00:00:00 2001 +From: Heiko Stuebner +Date: Thu, 21 Jan 2016 21:53:09 +0100 +Subject: clk-divider: make sure read-only dividers do not write to their register + +From: Heiko Stuebner + +commit 50359819794b4a16ae35051cd80f2dab025f6019 upstream. + +Commit e6d5e7d90be9 ("clk-divider: Fix READ_ONLY when divider > 1") removed +the special ops struct for read-only clocks and instead opted to handle +them inside the regular ops. + +On the rk3368 this results in breakage as aclkm now gets set a value. +While it is the same divider value, the A53 core still doesn't like it, +which can result in the cpu ending up in a hang. +The reason being that "ACLKENMasserts one clock cycle before the rising +edge of ACLKM" and the clock should only be touched when STANDBYWFIL2 +is asserted. + +To fix this, reintroduce the read-only ops but do include the round_rate +callback. That way no writes that may be unsafe are done to the divider +register in any case. + +The Rockchip use of the clk_divider_ops is adapted to this split again, +as is the nxp, lpc18xx-ccu driver that was included since the original +commit. On lpc18xx-ccu the divider seems to always be read-only +so only uses the new ops now. + +Fixes: e6d5e7d90be9 ("clk-divider: Fix READ_ONLY when divider > 1") +Reported-by: Zhang Qing +Signed-off-by: Heiko Stuebner +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/clk-divider.c | 11 ++++++++++- + drivers/clk/nxp/clk-lpc18xx-ccu.c | 2 +- + drivers/clk/rockchip/clk.c | 4 +++- + include/linux/clk-provider.h | 1 + + 4 files changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/clk/clk-divider.c ++++ b/drivers/clk/clk-divider.c +@@ -422,6 +422,12 @@ const struct clk_ops clk_divider_ops = { + }; + EXPORT_SYMBOL_GPL(clk_divider_ops); + ++const struct clk_ops clk_divider_ro_ops = { ++ .recalc_rate = clk_divider_recalc_rate, ++ .round_rate = clk_divider_round_rate, ++}; ++EXPORT_SYMBOL_GPL(clk_divider_ro_ops); ++ + static struct clk *_register_divider(struct device *dev, const char *name, + const char *parent_name, unsigned long flags, + void __iomem *reg, u8 shift, u8 width, +@@ -445,7 +451,10 @@ static struct clk *_register_divider(str + return ERR_PTR(-ENOMEM); + + init.name = name; +- init.ops = &clk_divider_ops; ++ if (clk_divider_flags & CLK_DIVIDER_READ_ONLY) ++ init.ops = &clk_divider_ro_ops; ++ else ++ init.ops = &clk_divider_ops; + init.flags = flags | CLK_IS_BASIC; + init.parent_names = (parent_name ? &parent_name: NULL); + init.num_parents = (parent_name ? 1 : 0); +--- a/drivers/clk/nxp/clk-lpc18xx-ccu.c ++++ b/drivers/clk/nxp/clk-lpc18xx-ccu.c +@@ -222,7 +222,7 @@ static void lpc18xx_ccu_register_branch_ + div->width = 1; + + div_hw = &div->hw; +- div_ops = &clk_divider_ops; ++ div_ops = &clk_divider_ro_ops; + } + + branch->gate.reg = branch->offset + reg_base; +--- a/drivers/clk/rockchip/clk.c ++++ b/drivers/clk/rockchip/clk.c +@@ -90,7 +90,9 @@ static struct clk *rockchip_clk_register + div->width = div_width; + div->lock = lock; + div->table = div_table; +- div_ops = &clk_divider_ops; ++ div_ops = (div_flags & CLK_DIVIDER_READ_ONLY) ++ ? &clk_divider_ro_ops ++ : &clk_divider_ops; + } + + clk = clk_register_composite(NULL, name, parent_names, num_parents, +--- a/include/linux/clk-provider.h ++++ b/include/linux/clk-provider.h +@@ -384,6 +384,7 @@ struct clk_divider { + #define CLK_DIVIDER_MAX_AT_ZERO BIT(6) + + extern const struct clk_ops clk_divider_ops; ++extern const struct clk_ops clk_divider_ro_ops; + + unsigned long divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate, + unsigned int val, const struct clk_div_table *table, diff --git a/queue-4.4/clk-meson-fix-meson_clk_register_clks-signature-type-mismatch.patch b/queue-4.4/clk-meson-fix-meson_clk_register_clks-signature-type-mismatch.patch new file mode 100644 index 00000000000..82f7fdf817f --- /dev/null +++ b/queue-4.4/clk-meson-fix-meson_clk_register_clks-signature-type-mismatch.patch @@ -0,0 +1,38 @@ +From bb473593c8099302bfd7befc23de67df907e3a99 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Andreas=20F=C3=A4rber?= +Date: Sun, 7 Feb 2016 22:13:03 +0100 +Subject: clk: meson: Fix meson_clk_register_clks() signature type mismatch +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Andreas Färber + +commit bb473593c8099302bfd7befc23de67df907e3a99 upstream. + +As preparation for arm64 based mesongxbb, which pulls in this code once +enabling ARCH_MESON, fix a size_t vs. unsigned int type mismatch. +The loop uses a local unsigned int variable, so adopt that type, +matching the header. + +Fixes: 7a29a869434e ("clk: meson: Add support for Meson clock controller") +Signed-off-by: Andreas Färber +Acked-by: Carlo Caione +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/meson/clkc.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/meson/clkc.c ++++ b/drivers/clk/meson/clkc.c +@@ -198,7 +198,7 @@ meson_clk_register_fixed_rate(const stru + } + + void __init meson_clk_register_clks(const struct clk_conf *clk_confs, +- size_t nr_confs, ++ unsigned int nr_confs, + void __iomem *clk_base) + { + unsigned int i; diff --git a/queue-4.4/clk-qcom-msm8960-fix-ce3_core-clk-enable-register.patch b/queue-4.4/clk-qcom-msm8960-fix-ce3_core-clk-enable-register.patch new file mode 100644 index 00000000000..09fe986ce5e --- /dev/null +++ b/queue-4.4/clk-qcom-msm8960-fix-ce3_core-clk-enable-register.patch @@ -0,0 +1,32 @@ +From 732d6913691848db9fabaa6a25b4d6fad10ddccf Mon Sep 17 00:00:00 2001 +From: Srinivas Kandagatla +Date: Mon, 22 Feb 2016 11:43:39 +0000 +Subject: clk: qcom: msm8960: fix ce3_core clk enable register + +From: Srinivas Kandagatla + +commit 732d6913691848db9fabaa6a25b4d6fad10ddccf upstream. + +This patch corrects the enable register offset which is actually 0x36cc +instead of 0x36c4 + +Signed-off-by: Srinivas Kandagatla +Fixes: 5f775498bdc4 ("clk: qcom: Fully support apq8064 global clock control") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/gcc-msm8960.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/qcom/gcc-msm8960.c ++++ b/drivers/clk/qcom/gcc-msm8960.c +@@ -2769,7 +2769,7 @@ static struct clk_branch ce3_core_clk = + .halt_reg = 0x2fdc, + .halt_bit = 5, + .clkr = { +- .enable_reg = 0x36c4, ++ .enable_reg = 0x36cc, + .enable_mask = BIT(4), + .hw.init = &(struct clk_init_data){ + .name = "ce3_core_clk", diff --git a/queue-4.4/clk-qcom-msm8960-fix-ce3_src-register-offset.patch b/queue-4.4/clk-qcom-msm8960-fix-ce3_src-register-offset.patch new file mode 100644 index 00000000000..91c0cfe7d43 --- /dev/null +++ b/queue-4.4/clk-qcom-msm8960-fix-ce3_src-register-offset.patch @@ -0,0 +1,33 @@ +From 0f75e1a370fd843c9e508fc1ccf0662833034827 Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Tue, 1 Mar 2016 17:26:48 -0800 +Subject: clk: qcom: msm8960: Fix ce3_src register offset + +From: Stephen Boyd + +commit 0f75e1a370fd843c9e508fc1ccf0662833034827 upstream. + +The offset seems to have been copied from the sata clk. Fix it so +that enabling the crypto engine source clk works. + +Tested-by: Srinivas Kandagatla +Tested-by: Bjorn Andersson +Fixes: 5f775498bdc4 ("clk: qcom: Fully support apq8064 global clock control") +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/qcom/gcc-msm8960.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/qcom/gcc-msm8960.c ++++ b/drivers/clk/qcom/gcc-msm8960.c +@@ -2753,7 +2753,7 @@ static struct clk_rcg ce3_src = { + }, + .freq_tbl = clk_tbl_ce3, + .clkr = { +- .enable_reg = 0x2c08, ++ .enable_reg = 0x36c0, + .enable_mask = BIT(7), + .hw.init = &(struct clk_init_data){ + .name = "ce3_src", diff --git a/queue-4.4/clk-rockchip-free-memory-in-error-cases-when-registering-clock-branches.patch b/queue-4.4/clk-rockchip-free-memory-in-error-cases-when-registering-clock-branches.patch new file mode 100644 index 00000000000..aaf25452806 --- /dev/null +++ b/queue-4.4/clk-rockchip-free-memory-in-error-cases-when-registering-clock-branches.patch @@ -0,0 +1,52 @@ +From 2467b6745e0ae9c6cdccff24c4cceeb14b1cce3f Mon Sep 17 00:00:00 2001 +From: Shawn Lin +Date: Tue, 2 Feb 2016 11:37:50 +0800 +Subject: clk: rockchip: free memory in error cases when registering clock branches + +From: Shawn Lin + +commit 2467b6745e0ae9c6cdccff24c4cceeb14b1cce3f upstream. + +Add free memeory if rockchip_clk_register_branch fails. + +Fixes: a245fecbb806 ("clk: rockchip: add basic infrastructure...") +Signed-off-by: Shawn Lin +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/rockchip/clk.c | 9 +++++++-- + 1 file changed, 7 insertions(+), 2 deletions(-) + +--- a/drivers/clk/rockchip/clk.c ++++ b/drivers/clk/rockchip/clk.c +@@ -70,7 +70,7 @@ static struct clk *rockchip_clk_register + if (gate_offset >= 0) { + gate = kzalloc(sizeof(*gate), GFP_KERNEL); + if (!gate) +- return ERR_PTR(-ENOMEM); ++ goto err_gate; + + gate->flags = gate_flags; + gate->reg = base + gate_offset; +@@ -82,7 +82,7 @@ static struct clk *rockchip_clk_register + if (div_width > 0) { + div = kzalloc(sizeof(*div), GFP_KERNEL); + if (!div) +- return ERR_PTR(-ENOMEM); ++ goto err_div; + + div->flags = div_flags; + div->reg = base + muxdiv_offset; +@@ -102,6 +102,11 @@ static struct clk *rockchip_clk_register + flags); + + return clk; ++err_div: ++ kfree(gate); ++err_gate: ++ kfree(mux); ++ return ERR_PTR(-ENOMEM); + } + + static struct clk *rockchip_clk_register_frac_branch(const char *name, diff --git a/queue-4.4/clk-versatile-sp810-support-reentrance.patch b/queue-4.4/clk-versatile-sp810-support-reentrance.patch new file mode 100644 index 00000000000..d5d59cb40ad --- /dev/null +++ b/queue-4.4/clk-versatile-sp810-support-reentrance.patch @@ -0,0 +1,85 @@ +From ec7957a6aa0aaf981fb8356dc47a2cdd01cde03c Mon Sep 17 00:00:00 2001 +From: Linus Walleij +Date: Wed, 24 Feb 2016 09:39:11 +0100 +Subject: clk: versatile: sp810: support reentrance + +From: Linus Walleij + +commit ec7957a6aa0aaf981fb8356dc47a2cdd01cde03c upstream. + +Despite care take to allocate clocks state containers the +SP810 driver actually just supports creating one instance: +all clocks registered for every instance will end up with the +exact same name and __clk_init() will fail. + +Rename the timclken<0> .. timclken to sp810__ +so every clock on every instance gets a unique name. + +This is necessary for the RealView PBA8 which has two SP810 +blocks: the second block will not register its clocks unless +every clock on every instance is unique and results in boot +logs like this: + +------------[ cut here ]------------ +WARNING: CPU: 0 PID: 0 at ../drivers/clk/versatile/clk-sp810.c:137 + clk_sp810_of_setup+0x110/0x154() +Modules linked in: +CPU: 0 PID: 0 Comm: swapper/0 Not tainted +4.5.0-rc2-00030-g352718fc39f6-dirty #225 +Hardware name: ARM RealView Machine (Device Tree Support) +[] (unwind_backtrace) from [] + (show_stack+0x10/0x14) +[] (show_stack) from [] + (dump_stack+0x84/0x9c) +[] (dump_stack) from [] + (warn_slowpath_common+0x74/0xb0) +[] (warn_slowpath_common) from [] + (warn_slowpath_null+0x1c/0x24) +[] (warn_slowpath_null) from [] + (clk_sp810_of_setup+0x110/0x154) +[] (clk_sp810_of_setup) from [] + (of_clk_init+0x12c/0x1c8) +[] (of_clk_init) from [] + (time_init+0x20/0x2c) +[] (time_init) from [] + (start_kernel+0x244/0x3c4) +[] (start_kernel) from [<7000807c>] (0x7000807c) +---[ end trace cb88537fdc8fa200 ]--- + +Cc: Michael Turquette +Cc: Pawel Moll +Fixes: 6e973d2c4385 "clk: vexpress: Add separate SP810 driver" +Signed-off-by: Linus Walleij +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/versatile/clk-sp810.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/clk/versatile/clk-sp810.c ++++ b/drivers/clk/versatile/clk-sp810.c +@@ -92,6 +92,7 @@ static void __init clk_sp810_of_setup(st + int num = ARRAY_SIZE(parent_names); + char name[12]; + struct clk_init_data init; ++ static int instance; + int i; + bool deprecated; + +@@ -118,7 +119,7 @@ static void __init clk_sp810_of_setup(st + deprecated = !of_find_property(node, "assigned-clock-parents", NULL); + + for (i = 0; i < ARRAY_SIZE(sp810->timerclken); i++) { +- snprintf(name, ARRAY_SIZE(name), "timerclken%d", i); ++ snprintf(name, sizeof(name), "sp810_%d_%d", instance, i); + + sp810->timerclken[i].sp810 = sp810; + sp810->timerclken[i].channel = i; +@@ -139,5 +140,6 @@ static void __init clk_sp810_of_setup(st + } + + of_clk_add_provider(node, clk_sp810_timerclken_of_get, sp810); ++ instance++; + } + CLK_OF_DECLARE(sp810, "arm,sp810", clk_sp810_of_setup); diff --git a/queue-4.4/cns3xxx-fix-pci-cns3xxx_write_config.patch b/queue-4.4/cns3xxx-fix-pci-cns3xxx_write_config.patch new file mode 100644 index 00000000000..5e46c4be634 --- /dev/null +++ b/queue-4.4/cns3xxx-fix-pci-cns3xxx_write_config.patch @@ -0,0 +1,42 @@ +From 88e9da9a2a70b6f1a171fbf30a681d6bc4031c4d Mon Sep 17 00:00:00 2001 +From: Krzysztof Halasa +Date: Fri, 11 Mar 2016 12:32:14 +0100 +Subject: CNS3xxx: Fix PCI cns3xxx_write_config() +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +From: Krzysztof Halasa + +commit 88e9da9a2a70b6f1a171fbf30a681d6bc4031c4d upstream. + +The "where" offset was added twice, fix it. + +Signed-off-by: Krzysztof Hałasa +Fixes: 498a92d42596 ("ARM: cns3xxx: pci: avoid potential stack overflow") +Signed-off-by: Olof Johansson +Signed-off-by: Greg Kroah-Hartman + +--- + arch/arm/mach-cns3xxx/pcie.c | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +--- a/arch/arm/mach-cns3xxx/pcie.c ++++ b/arch/arm/mach-cns3xxx/pcie.c +@@ -220,13 +220,13 @@ static void cns3xxx_write_config(struct + u32 mask = (0x1ull << (size * 8)) - 1; + int shift = (where % 4) * 8; + +- v = readl_relaxed(base + (where & 0xffc)); ++ v = readl_relaxed(base); + + v &= ~(mask << shift); + v |= (val & mask) << shift; + +- writel_relaxed(v, base + (where & 0xffc)); +- readl_relaxed(base + (where & 0xffc)); ++ writel_relaxed(v, base); ++ readl_relaxed(base); + } + + static void __init cns3xxx_pcie_hw_init(struct cns3xxx_pcie *cnspci) diff --git a/queue-4.4/ipvs-correct-initial-offset-of-call-id-header-search-in-sip-persistence-engine.patch b/queue-4.4/ipvs-correct-initial-offset-of-call-id-header-search-in-sip-persistence-engine.patch new file mode 100644 index 00000000000..365c81cf1e6 --- /dev/null +++ b/queue-4.4/ipvs-correct-initial-offset-of-call-id-header-search-in-sip-persistence-engine.patch @@ -0,0 +1,55 @@ +From 7617a24f83b5d67f4dab1844956be1cebc44aec8 Mon Sep 17 00:00:00 2001 +From: Marco Angaroni +Date: Sat, 5 Mar 2016 12:10:02 +0100 +Subject: ipvs: correct initial offset of Call-ID header search in SIP persistence engine + +From: Marco Angaroni + +commit 7617a24f83b5d67f4dab1844956be1cebc44aec8 upstream. + +The IPVS SIP persistence engine is not able to parse the SIP header +"Call-ID" when such header is inserted in the first positions of +the SIP message. + +When IPVS is configured with "--pe sip" option, like for example: +ipvsadm -A -u 1.2.3.4:5060 -s rr --pe sip -p 120 -o +some particular messages (see below for details) do not create entries +in the connection template table, which can be listed with: +ipvsadm -Lcn --persistent-conn + +Problematic SIP messages are SIP responses having "Call-ID" header +positioned just after message first line: +SIP/2.0 200 OK +[Call-ID header here] +[rest of the headers] + +When "Call-ID" header is positioned down (after a few other headers) +it is correctly recognized. + +This is due to the data offset used in get_callid function call inside +ip_vs_pe_sip.c file: since dptr already points to the start of the +SIP message, the value of dataoff should be initially 0. +Otherwise the header is searched starting from some bytes after the +first character of the SIP message. + +Fixes: 758ff0338722 ("IPVS: sip persistence engine") +Signed-off-by: Marco Angaroni +Acked-by: Julian Anastasov +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/ipvs/ip_vs_pe_sip.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/netfilter/ipvs/ip_vs_pe_sip.c ++++ b/net/netfilter/ipvs/ip_vs_pe_sip.c +@@ -88,7 +88,7 @@ ip_vs_sip_fill_param(struct ip_vs_conn_p + dptr = skb->data + dataoff; + datalen = skb->len - dataoff; + +- if (get_callid(dptr, dataoff, datalen, &matchoff, &matchlen)) ++ if (get_callid(dptr, 0, datalen, &matchoff, &matchlen)) + return -EINVAL; + + /* N.B: pe_data is only set on success, diff --git a/queue-4.4/ipvs-drop-first-packet-to-redirect-conntrack.patch b/queue-4.4/ipvs-drop-first-packet-to-redirect-conntrack.patch new file mode 100644 index 00000000000..d5e1c98fb29 --- /dev/null +++ b/queue-4.4/ipvs-drop-first-packet-to-redirect-conntrack.patch @@ -0,0 +1,129 @@ +From f719e3754ee2f7275437e61a6afd520181fdd43b Mon Sep 17 00:00:00 2001 +From: Julian Anastasov +Date: Sat, 5 Mar 2016 15:03:22 +0200 +Subject: ipvs: drop first packet to redirect conntrack + +From: Julian Anastasov + +commit f719e3754ee2f7275437e61a6afd520181fdd43b upstream. + +Jiri Bohac is reporting for a problem where the attempt +to reschedule existing connection to another real server +needs proper redirect for the conntrack used by the IPVS +connection. For example, when IPVS connection is created +to NAT-ed real server we alter the reply direction of +conntrack. If we later decide to select different real +server we can not alter again the conntrack. And if we +expire the old connection, the new connection is left +without conntrack. + +So, the only way to redirect both the IPVS connection and +the Netfilter's conntrack is to drop the SYN packet that +hits existing connection, to wait for the next jiffie +to expire the old connection and its conntrack and to rely +on client's retransmission to create new connection as +usually. + +Jiri Bohac provided a fix that drops all SYNs on rescheduling, +I extended his patch to do such drops only for connections +that use conntrack. Here is the original report from Jiri Bohac: + +Since commit dc7b3eb900aa ("ipvs: Fix reuse connection if real server +is dead"), new connections to dead servers are redistributed +immediately to new servers. The old connection is expired using +ip_vs_conn_expire_now() which sets the connection timer to expire +immediately. + +However, before the timer callback, ip_vs_conn_expire(), is run +to clean the connection's conntrack entry, the new redistributed +connection may already be established and its conntrack removed +instead. + +Fix this by dropping the first packet of the new connection +instead, like we do when the destination server is not available. +The timer will have deleted the old conntrack entry long before +the first packet of the new connection is retransmitted. + +Fixes: dc7b3eb900aa ("ipvs: Fix reuse connection if real server is dead") +Signed-off-by: Jiri Bohac +Signed-off-by: Julian Anastasov +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/ip_vs.h | 17 +++++++++++++++++ + net/netfilter/ipvs/ip_vs_core.c | 37 ++++++++++++++++++++++++++++--------- + 2 files changed, 45 insertions(+), 9 deletions(-) + +--- a/include/net/ip_vs.h ++++ b/include/net/ip_vs.h +@@ -1588,6 +1588,23 @@ static inline void ip_vs_conn_drop_connt + } + #endif /* CONFIG_IP_VS_NFCT */ + ++/* Really using conntrack? */ ++static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp, ++ struct sk_buff *skb) ++{ ++#ifdef CONFIG_IP_VS_NFCT ++ enum ip_conntrack_info ctinfo; ++ struct nf_conn *ct; ++ ++ if (!(cp->flags & IP_VS_CONN_F_NFCT)) ++ return false; ++ ct = nf_ct_get(skb, &ctinfo); ++ if (ct && !nf_ct_is_untracked(ct)) ++ return true; ++#endif ++ return false; ++} ++ + static inline int + ip_vs_dest_conn_overhead(struct ip_vs_dest *dest) + { +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1757,15 +1757,34 @@ ip_vs_in(struct netns_ipvs *ipvs, unsign + cp = pp->conn_in_get(ipvs, af, skb, &iph); + + conn_reuse_mode = sysctl_conn_reuse_mode(ipvs); +- if (conn_reuse_mode && !iph.fragoffs && +- is_new_conn(skb, &iph) && cp && +- ((unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && +- unlikely(!atomic_read(&cp->dest->weight))) || +- unlikely(is_new_conn_expected(cp, conn_reuse_mode)))) { +- if (!atomic_read(&cp->n_control)) +- ip_vs_conn_expire_now(cp); +- __ip_vs_conn_put(cp); +- cp = NULL; ++ if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) { ++ bool uses_ct = false, resched = false; ++ ++ if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest && ++ unlikely(!atomic_read(&cp->dest->weight))) { ++ resched = true; ++ uses_ct = ip_vs_conn_uses_conntrack(cp, skb); ++ } else if (is_new_conn_expected(cp, conn_reuse_mode)) { ++ uses_ct = ip_vs_conn_uses_conntrack(cp, skb); ++ if (!atomic_read(&cp->n_control)) { ++ resched = true; ++ } else { ++ /* Do not reschedule controlling connection ++ * that uses conntrack while it is still ++ * referenced by controlled connection(s). ++ */ ++ resched = !uses_ct; ++ } ++ } ++ ++ if (resched) { ++ if (!atomic_read(&cp->n_control)) ++ ip_vs_conn_expire_now(cp); ++ __ip_vs_conn_put(cp); ++ if (uses_ct) ++ return NF_DROP; ++ cp = NULL; ++ } + } + + if (unlikely(!cp)) { diff --git a/queue-4.4/ipvs-handle-ip_vs_fill_iph_skb_off-failure.patch b/queue-4.4/ipvs-handle-ip_vs_fill_iph_skb_off-failure.patch new file mode 100644 index 00000000000..e0310ff711c --- /dev/null +++ b/queue-4.4/ipvs-handle-ip_vs_fill_iph_skb_off-failure.patch @@ -0,0 +1,49 @@ +From 3f20efba41916ee17ce82f0fdd02581ada2872b2 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Wed, 27 Jan 2016 14:52:02 +0100 +Subject: ipvs: handle ip_vs_fill_iph_skb_off failure + +From: Arnd Bergmann + +commit 3f20efba41916ee17ce82f0fdd02581ada2872b2 upstream. + +ip_vs_fill_iph_skb_off() may not find an IP header, and gcc has +determined that ip_vs_sip_fill_param() then incorrectly accesses +the protocol fields: + +net/netfilter/ipvs/ip_vs_pe_sip.c: In function 'ip_vs_sip_fill_param': +net/netfilter/ipvs/ip_vs_pe_sip.c:76:5: error: 'iph.protocol' may be used uninitialized in this function [-Werror=maybe-uninitialized] + if (iph.protocol != IPPROTO_UDP) + ^ +net/netfilter/ipvs/ip_vs_pe_sip.c:81:10: error: 'iph.len' may be used uninitialized in this function [-Werror=maybe-uninitialized] + dataoff = iph.len + sizeof(struct udphdr); + ^ + +This adds a check for the ip_vs_fill_iph_skb_off() return code +before looking at the ip header data returned from it. + +Signed-off-by: Arnd Bergmann +Fixes: b0e010c527de ("ipvs: replace ip_vs_fill_ip4hdr with ip_vs_fill_iph_skb_off") +Acked-by: Julian Anastasov +Signed-off-by: Simon Horman +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/ipvs/ip_vs_pe_sip.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/netfilter/ipvs/ip_vs_pe_sip.c ++++ b/net/netfilter/ipvs/ip_vs_pe_sip.c +@@ -70,10 +70,10 @@ ip_vs_sip_fill_param(struct ip_vs_conn_p + const char *dptr; + int retc; + +- ip_vs_fill_iph_skb(p->af, skb, false, &iph); ++ retc = ip_vs_fill_iph_skb(p->af, skb, false, &iph); + + /* Only useful with UDP */ +- if (iph.protocol != IPPROTO_UDP) ++ if (!retc || iph.protocol != IPPROTO_UDP) + return -EINVAL; + /* todo: IPv6 fragments: + * I think this only should be done for the first fragment. /HS diff --git a/queue-4.4/lpfc-fix-misleading-indentation.patch b/queue-4.4/lpfc-fix-misleading-indentation.patch new file mode 100644 index 00000000000..ce4ca87d4e2 --- /dev/null +++ b/queue-4.4/lpfc-fix-misleading-indentation.patch @@ -0,0 +1,60 @@ +From aeb6641f8ebdd61939f462a8255b316f9bfab707 Mon Sep 17 00:00:00 2001 +From: Arnd Bergmann +Date: Mon, 14 Mar 2016 15:29:44 +0100 +Subject: lpfc: fix misleading indentation + +From: Arnd Bergmann + +commit aeb6641f8ebdd61939f462a8255b316f9bfab707 upstream. + +gcc-6 complains about the indentation of the lpfc_destroy_vport_work_array() +call in lpfc_online(), which clearly doesn't look right: + +drivers/scsi/lpfc/lpfc_init.c: In function 'lpfc_online': +drivers/scsi/lpfc/lpfc_init.c:2880:3: warning: statement is indented as if it were guarded by... [-Wmisleading-indentation] + lpfc_destroy_vport_work_array(phba, vports); + ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +drivers/scsi/lpfc/lpfc_init.c:2863:2: note: ...this 'if' clause, but it is not + if (vports != NULL) + ^~ + +Looking at the patch that introduced this code, it's clear that the +behavior is correct and the indentation is wrong. + +This fixes the indentation and adds curly braces around the previous +if() block for clarity, as that is most likely what caused the code +to be misindented in the first place. + +Signed-off-by: Arnd Bergmann +Fixes: 549e55cd2a1b ("[SCSI] lpfc 8.2.2 : Fix locking around HBA's port_list") +Reviewed-by: Sebastian Herbszt +Reviewed-by: Hannes Reinecke +Reviewed-by: Ewan D. Milne +Signed-off-by: Martin K. Petersen +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/scsi/lpfc/lpfc_init.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +--- a/drivers/scsi/lpfc/lpfc_init.c ++++ b/drivers/scsi/lpfc/lpfc_init.c +@@ -2855,7 +2855,7 @@ lpfc_online(struct lpfc_hba *phba) + } + + vports = lpfc_create_vport_work_array(phba); +- if (vports != NULL) ++ if (vports != NULL) { + for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) { + struct Scsi_Host *shost; + shost = lpfc_shost_from_vport(vports[i]); +@@ -2872,7 +2872,8 @@ lpfc_online(struct lpfc_hba *phba) + } + spin_unlock_irq(shost->host_lock); + } +- lpfc_destroy_vport_work_array(phba, vports); ++ } ++ lpfc_destroy_vport_work_array(phba, vports); + + lpfc_unblock_mgmt_io(phba); + return 0; diff --git a/queue-4.4/mfd-intel-lpss-remove-clock-tree-on-error-path.patch b/queue-4.4/mfd-intel-lpss-remove-clock-tree-on-error-path.patch new file mode 100644 index 00000000000..01ed3bb5385 --- /dev/null +++ b/queue-4.4/mfd-intel-lpss-remove-clock-tree-on-error-path.patch @@ -0,0 +1,33 @@ +From 84cb36cac581c915ef4e8b70abb73e084325df92 Mon Sep 17 00:00:00 2001 +From: Andy Shevchenko +Date: Fri, 22 Jan 2016 16:48:46 +0200 +Subject: mfd: intel-lpss: Remove clock tree on error path + +From: Andy Shevchenko + +commit 84cb36cac581c915ef4e8b70abb73e084325df92 upstream. + +We forgot to remove the clock tree if something goes wrong in ->probe(). Add a +call to intel_lpss_unregister_clock() on error path in ->probe() to fix the +potential issue. + +Fixes: 4b45efe85263 (mfd: Add support for Intel Sunrisepoint LPSS devices) +Signed-off-by: Andy Shevchenko +Acked-by: Mika Westerberg +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/intel-lpss.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/mfd/intel-lpss.c ++++ b/drivers/mfd/intel-lpss.c +@@ -445,6 +445,7 @@ int intel_lpss_probe(struct device *dev, + err_remove_ltr: + intel_lpss_debugfs_remove(lpss); + intel_lpss_ltr_hide(lpss); ++ intel_lpss_unregister_clock(lpss); + + err_clk_register: + ida_simple_remove(&intel_lpss_devid_ida, lpss->devid); diff --git a/queue-4.4/mwifiex-fix-corner-case-association-failure.patch b/queue-4.4/mwifiex-fix-corner-case-association-failure.patch new file mode 100644 index 00000000000..917eafdbdc6 --- /dev/null +++ b/queue-4.4/mwifiex-fix-corner-case-association-failure.patch @@ -0,0 +1,33 @@ +From a6139b6271f9f95377fe3486aed6120c9142779b Mon Sep 17 00:00:00 2001 +From: Amitkumar Karwar +Date: Tue, 23 Feb 2016 05:16:17 -0800 +Subject: mwifiex: fix corner case association failure + +From: Amitkumar Karwar + +commit a6139b6271f9f95377fe3486aed6120c9142779b upstream. + +This patch corrects the error case in association path by returning +-1. Earlier "media_connected" used to remain on in this error case +causing failure for further association attempts. + +Signed-off-by: Amitkumar Karwar +Fixes: b887664d882ee4 ('mwifiex: channel switch handling for station') +Signed-off-by: Cathy Luo +Signed-off-by: Kalle Valo +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/mwifiex/sta_ioctl.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/net/wireless/mwifiex/sta_ioctl.c ++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c +@@ -313,6 +313,7 @@ int mwifiex_bss_start(struct mwifiex_pri + mwifiex_dbg(adapter, ERROR, + "Attempt to reconnect on csa closed chan(%d)\n", + bss_desc->channel); ++ ret = -1; + goto done; + } + diff --git a/queue-4.4/nbd-ratelimit-error-msgs-after-socket-close.patch b/queue-4.4/nbd-ratelimit-error-msgs-after-socket-close.patch new file mode 100644 index 00000000000..4ab85ff0459 --- /dev/null +++ b/queue-4.4/nbd-ratelimit-error-msgs-after-socket-close.patch @@ -0,0 +1,43 @@ +From da6ccaaa79caca4f38b540b651238f87215217a2 Mon Sep 17 00:00:00 2001 +From: Dan Streetman +Date: Thu, 14 Jan 2016 13:42:32 -0500 +Subject: nbd: ratelimit error msgs after socket close + +From: Dan Streetman + +commit da6ccaaa79caca4f38b540b651238f87215217a2 upstream. + +Make the "Attempted send on closed socket" error messages generated in +nbd_request_handler() ratelimited. + +When the nbd socket is shutdown, the nbd_request_handler() function emits +an error message for every request remaining in its queue. If the queue +is large, this will spam a large amount of messages to the log. There's +no need for a separate error message for each request, so this patch +ratelimits it. + +In the specific case this was found, the system was virtual and the error +messages were logged to the serial port, which overwhelmed it. + +Fixes: 4d48a542b427 ("nbd: fix I/O hang on disconnected nbds") +Signed-off-by: Dan Streetman +Signed-off-by: Markus Pargmann +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/block/nbd.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/block/nbd.c ++++ b/drivers/block/nbd.c +@@ -618,8 +618,8 @@ static void nbd_request_handler(struct r + req, req->cmd_type); + + if (unlikely(!nbd->sock)) { +- dev_err(disk_to_dev(nbd->disk), +- "Attempted send on closed socket\n"); ++ dev_err_ratelimited(disk_to_dev(nbd->disk), ++ "Attempted send on closed socket\n"); + req->errors++; + nbd_end_request(nbd, req); + spin_lock_irq(q->queue_lock); diff --git a/queue-4.4/rdma-iw_cxgb4-fix-bar2-virt-addr-calculation-for-t4-chips.patch b/queue-4.4/rdma-iw_cxgb4-fix-bar2-virt-addr-calculation-for-t4-chips.patch new file mode 100644 index 00000000000..0368f5bd149 --- /dev/null +++ b/queue-4.4/rdma-iw_cxgb4-fix-bar2-virt-addr-calculation-for-t4-chips.patch @@ -0,0 +1,125 @@ +From 32cc92c7b5e52357a0a24010bae9eb257fa75d3e Mon Sep 17 00:00:00 2001 +From: Hariprasad S +Date: Tue, 5 Apr 2016 10:23:48 +0530 +Subject: RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips + +From: Hariprasad S + +commit 32cc92c7b5e52357a0a24010bae9eb257fa75d3e upstream. + +For T4, kernel mode qps don't use the user doorbell. User mode qps during +flow control db ringing are forced into kernel, where user doorbell is +treated as kernel doorbell and proper bar2 offset in bar2 virtual space is +calculated, which incase of T4 is a bogus address, causing a kernel panic +due to illegal write during doorbell ringing. +In case of T4, kernel mode qp bar2 virtual address should be 0. Added T4 +check during bar2 virtual address calculation to return 0. Fixed Bar2 +range checks based on bar2 physical address. + +The below oops will be fixed + + <1>BUG: unable to handle kernel paging request at 000000000002aa08 + <1>IP: [] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4] + <4>PGD 1416a8067 PUD 15bf35067 PMD 0 + <4>Oops: 0002 [#1] SMP + <4>last sysfs file: + /sys/devices/pci0000:00/0000:00:03.0/0000:02:00.4/infiniband/cxgb4_0/node_guid + <4>CPU 5 + <4>Modules linked in: rdma_ucm rdma_cm ib_cm ib_sa ib_mad ib_uverbs + ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE + iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack + ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge autofs4 + target_core_iblock target_core_file target_core_pscsi target_core_mod + configfs bnx2fc cnic uio fcoe libfcoe libfc scsi_transport_fc scsi_tgt 8021q + garp stp llc cpufreq_ondemand acpi_cpufreq freq_table mperf vhost_net macvtap + macvlan tun kvm uinput microcode iTCO_wdt iTCO_vendor_support sg joydev + serio_raw i2c_i801 i2c_core lpc_ich mfd_core e1000e ptp pps_core ioatdma dca + i7core_edac edac_core shpchp ext3 jbd mbcache sd_mod crc_t10dif pata_acpi + ata_generic ata_piix iw_cxgb4 iw_cm ib_core ib_addr cxgb4 ipv6 dm_mirror + dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan] + <4> + Supermicro X8ST3/X8ST3 + <4>RIP: 0010:[] [] + c4iw_uld_control+0x4e0/0x880 [iw_cxgb4] + <4>RSP: 0000:ffff880155a03db0 EFLAGS: 00010006 + <4>RAX: 000000000000001d RBX: ffff88013ae5fc00 RCX: ffff880155adb180 + <4>RDX: 000000000002aa00 RSI: 0000000000000001 RDI: ffff88013ae5fdf8 + <4>RBP: ffff880155a03e10 R08: 0000000000000000 R09: 0000000000000001 + <4>R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 + <4>R13: 000000000000001d R14: ffff880156414ab0 R15: ffffe8ffffc05b88 + <4>FS: 0000000000000000(0000) GS:ffff8800282a0000(0000) knlGS:0000000000000000 + <4>CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b + <4>CR2: 000000000002aa08 CR3: 000000015bd0e000 CR4: 00000000000007e0 + <4>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 + <4>DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 + <4>Process cxgb4 (pid: 394, threadinfo ffff880155a00000, task ffff880156414ab0) + <4>Stack: + <4> ffff880156415068 ffff880155adb180 ffff880155a03df0 ffffffffa00a344b + <4> 00000000000003e8 ffff880155920000 0000000000000004 ffff880155920000 + <4> ffff88015592d438 ffffffffa00a3860 ffff880155a03fd8 ffffe8ffffc05b88 + <4>Call Trace: + <4> [] ? enable_txq_db+0x2b/0x80 [cxgb4] + <4> [] ? process_db_full+0x0/0xa0 [cxgb4] + <4> [] process_db_full+0x46/0xa0 [cxgb4] + <4> [] worker_thread+0x170/0x2a0 + <4> [] ? autoremove_wake_function+0x0/0x40 + <4> [] ? worker_thread+0x0/0x2a0 + <4> [] kthread+0x9e/0xc0 + <4> [] child_rip+0xa/0x20 + <4> [] ? kthread+0x0/0xc0 + <4> [] ? child_rip+0x0/0x20 + <4>Code: e9 ba 00 00 00 66 0f 1f 44 00 00 44 8b 05 29 07 02 00 45 85 c0 0f 85 + 71 02 00 00 8b 83 70 01 00 00 45 0f b7 ed c1 e0 0f 44 09 e8 <89> 42 08 0f ae f8 + 66 c7 83 82 01 00 00 00 00 44 0f b7 ab dc 01 + <1>RIP [] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4] + <4> RSP + <4>CR2: 000000000002aa08` + +Based on original work by Bharat Potnuri + +Fixes: 74217d4c6a4fb0d8 ("iw_cxgb4: support for bar2 qid densities exceeding the page size") + +Signed-off-by: Steve Wise +Signed-off-by: Hariprasad Shenai +Reviewed-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/cxgb4/cq.c | 2 +- + drivers/infiniband/hw/cxgb4/qp.c | 6 +++++- + 2 files changed, 6 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/cxgb4/cq.c ++++ b/drivers/infiniband/hw/cxgb4/cq.c +@@ -162,7 +162,7 @@ static int create_cq(struct c4iw_rdev *r + cq->bar2_va = c4iw_bar2_addrs(rdev, cq->cqid, T4_BAR2_QTYPE_INGRESS, + &cq->bar2_qid, + user ? &cq->bar2_pa : NULL); +- if (user && !cq->bar2_va) { ++ if (user && !cq->bar2_pa) { + pr_warn(MOD "%s: cqid %u not in BAR2 range.\n", + pci_name(rdev->lldi.pdev), cq->cqid); + ret = -EINVAL; +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -185,6 +185,10 @@ void __iomem *c4iw_bar2_addrs(struct c4i + + if (pbar2_pa) + *pbar2_pa = (rdev->bar2_pa + bar2_qoffset) & PAGE_MASK; ++ ++ if (is_t4(rdev->lldi.adapter_type)) ++ return NULL; ++ + return rdev->bar2_kva + bar2_qoffset; + } + +@@ -270,7 +274,7 @@ static int create_qp(struct c4iw_rdev *r + /* + * User mode must have bar2 access. + */ +- if (user && (!wq->sq.bar2_va || !wq->rq.bar2_va)) { ++ if (user && (!wq->sq.bar2_pa || !wq->rq.bar2_pa)) { + pr_warn(MOD "%s: sqid %u or rqid %u not in BAR2 range.\n", + pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid); + goto free_dma; diff --git a/queue-4.4/revert-powerpc-tm-check-for-already-reclaimed-tasks.patch b/queue-4.4/revert-powerpc-tm-check-for-already-reclaimed-tasks.patch new file mode 100644 index 00000000000..650cf045876 --- /dev/null +++ b/queue-4.4/revert-powerpc-tm-check-for-already-reclaimed-tasks.patch @@ -0,0 +1,47 @@ +From foo@baz Fri May 6 12:03:29 EDT 2016 +Date: Fri, 06 May 2016 12:03:29 -0400 +To: Greg KH +From: Greg Kroah-Hartman +Subject: Revert: "powerpc/tm: Check for already reclaimed tasks" + +This reverts commit e924c60db1b4891e45d15a33474ac5fab62cf029 which was +commit 7f821fc9c77a9b01fe7b1d6e72717b33d8d64142 upstream. + +It shouldn't have been applied as the original was already in 4.4. + +Reported-by: Jiri Slaby +Cc: Michael Neuling +Cc: Michael Ellerman +Signed-off-by: Greg Kroah-Hartman + +--- + arch/powerpc/kernel/process.c | 18 ------------------ + 1 file changed, 18 deletions(-) + +--- a/arch/powerpc/kernel/process.c ++++ b/arch/powerpc/kernel/process.c +@@ -569,24 +569,6 @@ static void tm_reclaim_thread(struct thr + if (!MSR_TM_SUSPENDED(mfmsr())) + return; + +- /* +- * Use the current MSR TM suspended bit to track if we have +- * checkpointed state outstanding. +- * On signal delivery, we'd normally reclaim the checkpointed +- * state to obtain stack pointer (see:get_tm_stackpointer()). +- * This will then directly return to userspace without going +- * through __switch_to(). However, if the stack frame is bad, +- * we need to exit this thread which calls __switch_to() which +- * will again attempt to reclaim the already saved tm state. +- * Hence we need to check that we've not already reclaimed +- * this state. +- * We do this using the current MSR, rather tracking it in +- * some specific thread_struct bit, as it has the additional +- * benifit of checking for a potential TM bad thing exception. +- */ +- if (!MSR_TM_SUSPENDED(mfmsr())) +- return; +- + tm_reclaim(thr, thr->regs->msr, cause); + + /* Having done the reclaim, we now have the checkpointed diff --git a/queue-4.4/series b/queue-4.4/series index 98e8f6c7995..abc2cd40070 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -1,6 +1,5 @@ revert-powerpc-tm-check-for-already-reclaimed-tasks.patch rdma-iw_cxgb4-fix-bar2-virt-addr-calculation-for-t4-chips.patch -xprtrdma-clean-up-unused-rpcrdma_inline_pad_thresh-macro.patch ipvs-handle-ip_vs_fill_iph_skb_off-failure.patch ipvs-correct-initial-offset-of-call-id-header-search-in-sip-persistence-engine.patch ipvs-drop-first-packet-to-redirect-conntrack.patch diff --git a/queue-4.4/soc-rockchip-power-domain-fix-err-handle-while-probing.patch b/queue-4.4/soc-rockchip-power-domain-fix-err-handle-while-probing.patch new file mode 100644 index 00000000000..e87015a9bb4 --- /dev/null +++ b/queue-4.4/soc-rockchip-power-domain-fix-err-handle-while-probing.patch @@ -0,0 +1,33 @@ +From 1d961f11a108af9f7fbe89cc950a8d16ddbdbb28 Mon Sep 17 00:00:00 2001 +From: Shawn Lin +Date: Mon, 1 Feb 2016 16:18:40 +0800 +Subject: soc: rockchip: power-domain: fix err handle while probing + +From: Shawn Lin + +commit 1d961f11a108af9f7fbe89cc950a8d16ddbdbb28 upstream. + +If we fail to probe the driver, we should not directly break +from the for_each_available_child_of_node since it calls of_node_get +while iterating. This patch add of_node_put to fix the unbalanced +call pair. + +Fixes: 7c696693a4f5 ("soc: rockchip: power-domain: Add power domain driver") +Signed-off-by: Shawn Lin +Signed-off-by: Heiko Stuebner +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/soc/rockchip/pm_domains.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/drivers/soc/rockchip/pm_domains.c ++++ b/drivers/soc/rockchip/pm_domains.c +@@ -419,6 +419,7 @@ static int rockchip_pm_domain_probe(stru + if (error) { + dev_err(dev, "failed to handle node %s: %d\n", + node->name, error); ++ of_node_put(node); + goto err_out; + } + }