From ba318eba773af3b295e8a2e7c30163dfebb2d53e Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 21 Nov 2016 17:27:22 +0100 Subject: [PATCH] 4.4-stable patches added patches: clk-mmp-mmp2-fix-return-value-check-in-mmp2_clk_init.patch clk-mmp-pxa168-fix-return-value-check-in-pxa168_clk_init.patch clk-mmp-pxa910-fix-return-value-check-in-pxa910_clk_init.patch ib-cm-mark-stale-cm-id-s-whenever-the-mad-agent-was-unregistered.patch ib-core-avoid-unsigned-int-overflow-in-sg_alloc_table.patch ib-mlx4-check-gid_index-return-value.patch ib-mlx4-fix-create-cq-error-flow.patch ib-mlx5-fix-fatal-error-dispatching.patch ib-mlx5-use-cache-line-size-to-select-cqe-stride.patch ib-uverbs-fix-leak-of-xrc-target-qps.patch iwlwifi-pcie-fix-splc-structure-parsing.patch mfd-core-fix-device-reference-leak-in-mfd_clone_cell.patch netfilter-nft_dynset-fix-element-timeout-for-hz-1000.patch pm-sleep-don-t-suspend-parent-when-async-child-suspend_-noirq-late-fails.patch pm-sleep-fix-device-reference-leak-in-test_suspend.patch rtc-omap-fix-selecting-external-osc.patch uwb-fix-device-reference-leaks.patch --- ...-return-value-check-in-mmp2_clk_init.patch | 32 ++ ...eturn-value-check-in-pxa168_clk_init.patch | 32 ++ ...eturn-value-check-in-pxa910_clk_init.patch | 41 ++ ...never-the-mad-agent-was-unregistered.patch | 359 ++++++++++++++++++ ...igned-int-overflow-in-sg_alloc_table.patch | 35 ++ ...ib-mlx4-check-gid_index-return-value.patch | 37 ++ .../ib-mlx4-fix-create-cq-error-flow.patch | 42 ++ .../ib-mlx5-fix-fatal-error-dispatching.patch | 53 +++ ...cache-line-size-to-select-cqe-stride.patch | 41 ++ ...ib-uverbs-fix-leak-of-xrc-target-qps.patch | 42 ++ ...wifi-pcie-fix-splc-structure-parsing.patch | 153 ++++++++ ...ice-reference-leak-in-mfd_clone_cell.patch | 32 ++ ...nset-fix-element-timeout-for-hz-1000.patch | 48 +++ ...sync-child-suspend_-noirq-late-fails.patch | 77 ++++ ...evice-reference-leak-in-test_suspend.patch | 35 ++ .../rtc-omap-fix-selecting-external-osc.patch | 67 ++++ queue-4.4/series | 17 + .../uwb-fix-device-reference-leaks.patch | 86 +++++ 18 files changed, 1229 insertions(+) create mode 100644 queue-4.4/clk-mmp-mmp2-fix-return-value-check-in-mmp2_clk_init.patch create mode 100644 queue-4.4/clk-mmp-pxa168-fix-return-value-check-in-pxa168_clk_init.patch create mode 100644 queue-4.4/clk-mmp-pxa910-fix-return-value-check-in-pxa910_clk_init.patch create mode 100644 queue-4.4/ib-cm-mark-stale-cm-id-s-whenever-the-mad-agent-was-unregistered.patch create mode 100644 queue-4.4/ib-core-avoid-unsigned-int-overflow-in-sg_alloc_table.patch create mode 100644 queue-4.4/ib-mlx4-check-gid_index-return-value.patch create mode 100644 queue-4.4/ib-mlx4-fix-create-cq-error-flow.patch create mode 100644 queue-4.4/ib-mlx5-fix-fatal-error-dispatching.patch create mode 100644 queue-4.4/ib-mlx5-use-cache-line-size-to-select-cqe-stride.patch create mode 100644 queue-4.4/ib-uverbs-fix-leak-of-xrc-target-qps.patch create mode 100644 queue-4.4/iwlwifi-pcie-fix-splc-structure-parsing.patch create mode 100644 queue-4.4/mfd-core-fix-device-reference-leak-in-mfd_clone_cell.patch create mode 100644 queue-4.4/netfilter-nft_dynset-fix-element-timeout-for-hz-1000.patch create mode 100644 queue-4.4/pm-sleep-don-t-suspend-parent-when-async-child-suspend_-noirq-late-fails.patch create mode 100644 queue-4.4/pm-sleep-fix-device-reference-leak-in-test_suspend.patch create mode 100644 queue-4.4/rtc-omap-fix-selecting-external-osc.patch create mode 100644 queue-4.4/uwb-fix-device-reference-leaks.patch diff --git a/queue-4.4/clk-mmp-mmp2-fix-return-value-check-in-mmp2_clk_init.patch b/queue-4.4/clk-mmp-mmp2-fix-return-value-check-in-mmp2_clk_init.patch new file mode 100644 index 00000000000..e89f3ecafd6 --- /dev/null +++ b/queue-4.4/clk-mmp-mmp2-fix-return-value-check-in-mmp2_clk_init.patch @@ -0,0 +1,32 @@ +From a29e52a6e66f4c0c895e7083e4bad2e7957f1fb5 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Sat, 17 Sep 2016 15:54:13 +0000 +Subject: clk: mmp: mmp2: fix return value check in mmp2_clk_init() + +From: Wei Yongjun + +commit a29e52a6e66f4c0c895e7083e4bad2e7957f1fb5 upstream. + +Fix the retrn value check which testing the wrong variable +in mmp2_clk_init(). + +Fixes: 1ec770d92a62 ("clk: mmp: add mmp2 DT support for clock driver") +Signed-off-by: Wei Yongjun +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/mmp/clk-of-mmp2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/mmp/clk-of-mmp2.c ++++ b/drivers/clk/mmp/clk-of-mmp2.c +@@ -313,7 +313,7 @@ static void __init mmp2_clk_init(struct + } + + pxa_unit->apmu_base = of_iomap(np, 1); +- if (!pxa_unit->mpmu_base) { ++ if (!pxa_unit->apmu_base) { + pr_err("failed to map apmu registers\n"); + return; + } diff --git a/queue-4.4/clk-mmp-pxa168-fix-return-value-check-in-pxa168_clk_init.patch b/queue-4.4/clk-mmp-pxa168-fix-return-value-check-in-pxa168_clk_init.patch new file mode 100644 index 00000000000..1c484c40c99 --- /dev/null +++ b/queue-4.4/clk-mmp-pxa168-fix-return-value-check-in-pxa168_clk_init.patch @@ -0,0 +1,32 @@ +From deab07261d54b4db7b627d38e0efac97f176c6d6 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Sat, 17 Sep 2016 15:54:28 +0000 +Subject: clk: mmp: pxa168: fix return value check in pxa168_clk_init() + +From: Wei Yongjun + +commit deab07261d54b4db7b627d38e0efac97f176c6d6 upstream. + +Fix the retrn value check which testing the wrong variable +in pxa168_clk_init(). + +Fixes: ab08aefcd12d ("clk: mmp: add pxa168 DT support for clock driver") +Signed-off-by: Wei Yongjun +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/mmp/clk-of-pxa168.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/clk/mmp/clk-of-pxa168.c ++++ b/drivers/clk/mmp/clk-of-pxa168.c +@@ -262,7 +262,7 @@ static void __init pxa168_clk_init(struc + } + + pxa_unit->apmu_base = of_iomap(np, 1); +- if (!pxa_unit->mpmu_base) { ++ if (!pxa_unit->apmu_base) { + pr_err("failed to map apmu registers\n"); + return; + } diff --git a/queue-4.4/clk-mmp-pxa910-fix-return-value-check-in-pxa910_clk_init.patch b/queue-4.4/clk-mmp-pxa910-fix-return-value-check-in-pxa910_clk_init.patch new file mode 100644 index 00000000000..271731d64ab --- /dev/null +++ b/queue-4.4/clk-mmp-pxa910-fix-return-value-check-in-pxa910_clk_init.patch @@ -0,0 +1,41 @@ +From 10f2bfb092e3b49000526c02cfe8b2abbbdbb752 Mon Sep 17 00:00:00 2001 +From: Wei Yongjun +Date: Sat, 17 Sep 2016 15:55:56 +0000 +Subject: clk: mmp: pxa910: fix return value check in pxa910_clk_init() + +From: Wei Yongjun + +commit 10f2bfb092e3b49000526c02cfe8b2abbbdbb752 upstream. + +Fix the retrn value check which testing the wrong variable +in pxa910_clk_init(). + +Fixes: 2bc61da9f7ff ("clk: mmp: add pxa910 DT support for clock driver") +Signed-off-by: Wei Yongjun +Signed-off-by: Stephen Boyd +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/clk/mmp/clk-of-pxa910.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/clk/mmp/clk-of-pxa910.c ++++ b/drivers/clk/mmp/clk-of-pxa910.c +@@ -282,7 +282,7 @@ static void __init pxa910_clk_init(struc + } + + pxa_unit->apmu_base = of_iomap(np, 1); +- if (!pxa_unit->mpmu_base) { ++ if (!pxa_unit->apmu_base) { + pr_err("failed to map apmu registers\n"); + return; + } +@@ -294,7 +294,7 @@ static void __init pxa910_clk_init(struc + } + + pxa_unit->apbcp_base = of_iomap(np, 3); +- if (!pxa_unit->mpmu_base) { ++ if (!pxa_unit->apbcp_base) { + pr_err("failed to map apbcp registers\n"); + return; + } diff --git a/queue-4.4/ib-cm-mark-stale-cm-id-s-whenever-the-mad-agent-was-unregistered.patch b/queue-4.4/ib-cm-mark-stale-cm-id-s-whenever-the-mad-agent-was-unregistered.patch new file mode 100644 index 00000000000..a7ad306f7a6 --- /dev/null +++ b/queue-4.4/ib-cm-mark-stale-cm-id-s-whenever-the-mad-agent-was-unregistered.patch @@ -0,0 +1,359 @@ +From 9db0ff53cb9b43ed75bacd42a89c1a0ab048b2b0 Mon Sep 17 00:00:00 2001 +From: Mark Bloch +Date: Thu, 27 Oct 2016 16:36:27 +0300 +Subject: IB/cm: Mark stale CM id's whenever the mad agent was unregistered + +From: Mark Bloch + +commit 9db0ff53cb9b43ed75bacd42a89c1a0ab048b2b0 upstream. + +When there is a CM id object that has port assigned to it, it means that +the cm-id asked for the specific port that it should go by it, but if +that port was removed (hot-unplug event) the cm-id was not updated. +In order to fix that the port keeps a list of all the cm-id's that are +planning to go by it, whenever the port is removed it marks all of them +as invalid. + +This commit fixes a kernel panic which happens when running traffic between +guests and we force reboot a guest mid traffic, it triggers a kernel panic: + + Call Trace: + [] ? panic+0xa7/0x16f + [] ? oops_end+0xe4/0x100 + [] ? no_context+0xfb/0x260 + [] ? del_timer_sync+0x22/0x30 + [] ? __bad_area_nosemaphore+0x125/0x1e0 + [] ? process_timeout+0x0/0x10 + [] ? bad_area_nosemaphore+0x13/0x20 + [] ? __do_page_fault+0x31f/0x480 + [] ? default_wake_function+0x0/0x20 + [] ? free_msg+0x55/0x70 [mlx5_core] + [] ? cmd_exec+0x124/0x840 [mlx5_core] + [] ? find_busiest_group+0x244/0x9f0 + [] ? do_page_fault+0x3e/0xa0 + [] ? page_fault+0x25/0x30 + [] ? cm_alloc_msg+0x35/0xc0 [ib_cm] + [] ? ib_send_cm_dreq+0xb1/0x1e0 [ib_cm] + [] ? cm_destroy_id+0x176/0x320 [ib_cm] + [] ? ib_destroy_cm_id+0x10/0x20 [ib_cm] + [] ? ipoib_cm_free_rx_reap_list+0xa7/0x110 [ib_ipoib] + [] ? ipoib_cm_rx_reap+0x0/0x20 [ib_ipoib] + [] ? ipoib_cm_rx_reap+0x15/0x20 [ib_ipoib] + [] ? worker_thread+0x170/0x2a0 + [] ? autoremove_wake_function+0x0/0x40 + [] ? worker_thread+0x0/0x2a0 + [] ? kthread+0x96/0xa0 + [] ? child_rip+0xa/0x20 + [] ? kthread+0x0/0xa0 + [] ? child_rip+0x0/0x20 + +Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation") +Signed-off-by: Mark Bloch +Signed-off-by: Erez Shitrit +Reviewed-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/cm.c | 126 +++++++++++++++++++++++++++++++++++++------ + 1 file changed, 110 insertions(+), 16 deletions(-) + +--- a/drivers/infiniband/core/cm.c ++++ b/drivers/infiniband/core/cm.c +@@ -80,6 +80,8 @@ static struct ib_cm { + __be32 random_id_operand; + struct list_head timewait_list; + struct workqueue_struct *wq; ++ /* Sync on cm change port state */ ++ spinlock_t state_lock; + } cm; + + /* Counter indexes ordered by attribute ID */ +@@ -161,6 +163,8 @@ struct cm_port { + struct ib_mad_agent *mad_agent; + struct kobject port_obj; + u8 port_num; ++ struct list_head cm_priv_prim_list; ++ struct list_head cm_priv_altr_list; + struct cm_counter_group counter_group[CM_COUNTER_GROUPS]; + }; + +@@ -241,6 +245,12 @@ struct cm_id_private { + u8 service_timeout; + u8 target_ack_delay; + ++ struct list_head prim_list; ++ struct list_head altr_list; ++ /* Indicates that the send port mad is registered and av is set */ ++ int prim_send_port_not_ready; ++ int altr_send_port_not_ready; ++ + struct list_head work_list; + atomic_t work_count; + }; +@@ -259,20 +269,47 @@ static int cm_alloc_msg(struct cm_id_pri + struct ib_mad_agent *mad_agent; + struct ib_mad_send_buf *m; + struct ib_ah *ah; ++ struct cm_av *av; ++ unsigned long flags, flags2; ++ int ret = 0; + ++ /* don't let the port to be released till the agent is down */ ++ spin_lock_irqsave(&cm.state_lock, flags2); ++ spin_lock_irqsave(&cm.lock, flags); ++ if (!cm_id_priv->prim_send_port_not_ready) ++ av = &cm_id_priv->av; ++ else if (!cm_id_priv->altr_send_port_not_ready && ++ (cm_id_priv->alt_av.port)) ++ av = &cm_id_priv->alt_av; ++ else { ++ pr_info("%s: not valid CM id\n", __func__); ++ ret = -ENODEV; ++ spin_unlock_irqrestore(&cm.lock, flags); ++ goto out; ++ } ++ spin_unlock_irqrestore(&cm.lock, flags); ++ /* Make sure the port haven't released the mad yet */ + mad_agent = cm_id_priv->av.port->mad_agent; +- ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr); +- if (IS_ERR(ah)) +- return PTR_ERR(ah); ++ if (!mad_agent) { ++ pr_info("%s: not a valid MAD agent\n", __func__); ++ ret = -ENODEV; ++ goto out; ++ } ++ ah = ib_create_ah(mad_agent->qp->pd, &av->ah_attr); ++ if (IS_ERR(ah)) { ++ ret = PTR_ERR(ah); ++ goto out; ++ } + + m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn, +- cm_id_priv->av.pkey_index, ++ av->pkey_index, + 0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA, + GFP_ATOMIC, + IB_MGMT_BASE_VERSION); + if (IS_ERR(m)) { + ib_destroy_ah(ah); +- return PTR_ERR(m); ++ ret = PTR_ERR(m); ++ goto out; + } + + /* Timeout set by caller if response is expected. */ +@@ -282,7 +319,10 @@ static int cm_alloc_msg(struct cm_id_pri + atomic_inc(&cm_id_priv->refcount); + m->context[0] = cm_id_priv; + *msg = m; +- return 0; ++ ++out: ++ spin_unlock_irqrestore(&cm.state_lock, flags2); ++ return ret; + } + + static int cm_alloc_response_msg(struct cm_port *port, +@@ -352,7 +392,8 @@ static void cm_init_av_for_response(stru + grh, &av->ah_attr); + } + +-static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av) ++static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av, ++ struct cm_id_private *cm_id_priv) + { + struct cm_device *cm_dev; + struct cm_port *port = NULL; +@@ -387,7 +428,17 @@ static int cm_init_av_by_path(struct ib_ + &av->ah_attr); + av->timeout = path->packet_life_time + 1; + +- return 0; ++ spin_lock_irqsave(&cm.lock, flags); ++ if (&cm_id_priv->av == av) ++ list_add_tail(&cm_id_priv->prim_list, &port->cm_priv_prim_list); ++ else if (&cm_id_priv->alt_av == av) ++ list_add_tail(&cm_id_priv->altr_list, &port->cm_priv_altr_list); ++ else ++ ret = -EINVAL; ++ ++ spin_unlock_irqrestore(&cm.lock, flags); ++ ++ return ret; + } + + static int cm_alloc_id(struct cm_id_private *cm_id_priv) +@@ -677,6 +728,8 @@ struct ib_cm_id *ib_create_cm_id(struct + spin_lock_init(&cm_id_priv->lock); + init_completion(&cm_id_priv->comp); + INIT_LIST_HEAD(&cm_id_priv->work_list); ++ INIT_LIST_HEAD(&cm_id_priv->prim_list); ++ INIT_LIST_HEAD(&cm_id_priv->altr_list); + atomic_set(&cm_id_priv->work_count, -1); + atomic_set(&cm_id_priv->refcount, 1); + return &cm_id_priv->id; +@@ -892,6 +945,15 @@ retest: + break; + } + ++ spin_lock_irq(&cm.lock); ++ if (!list_empty(&cm_id_priv->altr_list) && ++ (!cm_id_priv->altr_send_port_not_ready)) ++ list_del(&cm_id_priv->altr_list); ++ if (!list_empty(&cm_id_priv->prim_list) && ++ (!cm_id_priv->prim_send_port_not_ready)) ++ list_del(&cm_id_priv->prim_list); ++ spin_unlock_irq(&cm.lock); ++ + cm_free_id(cm_id->local_id); + cm_deref_id(cm_id_priv); + wait_for_completion(&cm_id_priv->comp); +@@ -1192,12 +1254,13 @@ int ib_send_cm_req(struct ib_cm_id *cm_i + goto out; + } + +- ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av); ++ ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av, ++ cm_id_priv); + if (ret) + goto error1; + if (param->alternate_path) { + ret = cm_init_av_by_path(param->alternate_path, +- &cm_id_priv->alt_av); ++ &cm_id_priv->alt_av, cm_id_priv); + if (ret) + goto error1; + } +@@ -1639,7 +1702,8 @@ static int cm_req_handler(struct cm_work + cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]); + + memcpy(work->path[0].dmac, cm_id_priv->av.ah_attr.dmac, ETH_ALEN); +- ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av); ++ ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av, ++ cm_id_priv); + if (ret) { + ib_get_cached_gid(work->port->cm_dev->ib_device, + work->port->port_num, 0, &work->path[0].sgid, +@@ -1650,7 +1714,8 @@ static int cm_req_handler(struct cm_work + goto rejected; + } + if (req_msg->alt_local_lid) { +- ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av); ++ ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av, ++ cm_id_priv); + if (ret) { + ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID, + &work->path[0].sgid, +@@ -2705,7 +2770,8 @@ int ib_send_cm_lap(struct ib_cm_id *cm_i + goto out; + } + +- ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av); ++ ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av, ++ cm_id_priv); + if (ret) + goto out; + cm_id_priv->alt_av.timeout = +@@ -2817,7 +2883,8 @@ static int cm_lap_handler(struct cm_work + cm_init_av_for_response(work->port, work->mad_recv_wc->wc, + work->mad_recv_wc->recv_buf.grh, + &cm_id_priv->av); +- cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av); ++ cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av, ++ cm_id_priv); + ret = atomic_inc_and_test(&cm_id_priv->work_count); + if (!ret) + list_add_tail(&work->list, &cm_id_priv->work_list); +@@ -3009,7 +3076,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id + return -EINVAL; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +- ret = cm_init_av_by_path(param->path, &cm_id_priv->av); ++ ret = cm_init_av_by_path(param->path, &cm_id_priv->av, cm_id_priv); + if (ret) + goto out; + +@@ -3446,7 +3513,9 @@ out: + static int cm_migrate(struct ib_cm_id *cm_id) + { + struct cm_id_private *cm_id_priv; ++ struct cm_av tmp_av; + unsigned long flags; ++ int tmp_send_port_not_ready; + int ret = 0; + + cm_id_priv = container_of(cm_id, struct cm_id_private, id); +@@ -3455,7 +3524,14 @@ static int cm_migrate(struct ib_cm_id *c + (cm_id->lap_state == IB_CM_LAP_UNINIT || + cm_id->lap_state == IB_CM_LAP_IDLE)) { + cm_id->lap_state = IB_CM_LAP_IDLE; ++ /* Swap address vector */ ++ tmp_av = cm_id_priv->av; + cm_id_priv->av = cm_id_priv->alt_av; ++ cm_id_priv->alt_av = tmp_av; ++ /* Swap port send ready state */ ++ tmp_send_port_not_ready = cm_id_priv->prim_send_port_not_ready; ++ cm_id_priv->prim_send_port_not_ready = cm_id_priv->altr_send_port_not_ready; ++ cm_id_priv->altr_send_port_not_ready = tmp_send_port_not_ready; + } else + ret = -EINVAL; + spin_unlock_irqrestore(&cm_id_priv->lock, flags); +@@ -3875,6 +3951,9 @@ static void cm_add_one(struct ib_device + port->cm_dev = cm_dev; + port->port_num = i; + ++ INIT_LIST_HEAD(&port->cm_priv_prim_list); ++ INIT_LIST_HEAD(&port->cm_priv_altr_list); ++ + ret = cm_create_port_fs(port); + if (ret) + goto error1; +@@ -3932,6 +4011,8 @@ static void cm_remove_one(struct ib_devi + { + struct cm_device *cm_dev = client_data; + struct cm_port *port; ++ struct cm_id_private *cm_id_priv; ++ struct ib_mad_agent *cur_mad_agent; + struct ib_port_modify port_modify = { + .clr_port_cap_mask = IB_PORT_CM_SUP + }; +@@ -3955,15 +4036,27 @@ static void cm_remove_one(struct ib_devi + + port = cm_dev->port[i-1]; + ib_modify_port(ib_device, port->port_num, 0, &port_modify); ++ /* Mark all the cm_id's as not valid */ ++ spin_lock_irq(&cm.lock); ++ list_for_each_entry(cm_id_priv, &port->cm_priv_altr_list, altr_list) ++ cm_id_priv->altr_send_port_not_ready = 1; ++ list_for_each_entry(cm_id_priv, &port->cm_priv_prim_list, prim_list) ++ cm_id_priv->prim_send_port_not_ready = 1; ++ spin_unlock_irq(&cm.lock); + /* + * We flush the queue here after the going_down set, this + * verify that no new works will be queued in the recv handler, + * after that we can call the unregister_mad_agent + */ + flush_workqueue(cm.wq); +- ib_unregister_mad_agent(port->mad_agent); ++ spin_lock_irq(&cm.state_lock); ++ cur_mad_agent = port->mad_agent; ++ port->mad_agent = NULL; ++ spin_unlock_irq(&cm.state_lock); ++ ib_unregister_mad_agent(cur_mad_agent); + cm_remove_port_fs(port); + } ++ + device_unregister(cm_dev->device); + kfree(cm_dev); + } +@@ -3976,6 +4069,7 @@ static int __init ib_cm_init(void) + INIT_LIST_HEAD(&cm.device_list); + rwlock_init(&cm.device_lock); + spin_lock_init(&cm.lock); ++ spin_lock_init(&cm.state_lock); + cm.listen_service_table = RB_ROOT; + cm.listen_service_id = be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID); + cm.remote_id_table = RB_ROOT; diff --git a/queue-4.4/ib-core-avoid-unsigned-int-overflow-in-sg_alloc_table.patch b/queue-4.4/ib-core-avoid-unsigned-int-overflow-in-sg_alloc_table.patch new file mode 100644 index 00000000000..fd4d9994444 --- /dev/null +++ b/queue-4.4/ib-core-avoid-unsigned-int-overflow-in-sg_alloc_table.patch @@ -0,0 +1,35 @@ +From 3c7ba5760ab8eedec01159b267bb9bfcffe522ac Mon Sep 17 00:00:00 2001 +From: Mark Bloch +Date: Thu, 27 Oct 2016 16:36:31 +0300 +Subject: IB/core: Avoid unsigned int overflow in sg_alloc_table + +From: Mark Bloch + +commit 3c7ba5760ab8eedec01159b267bb9bfcffe522ac upstream. + +sg_alloc_table gets unsigned int as parameter while the driver +returns it as size_t. Check npages isn't greater than maximum +unsigned int. + +Fixes: eeb8461e36c9 ("IB: Refactor umem to use linear SG table") +Signed-off-by: Mark Bloch +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/umem.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/core/umem.c ++++ b/drivers/infiniband/core/umem.c +@@ -175,7 +175,7 @@ struct ib_umem *ib_umem_get(struct ib_uc + + cur_base = addr & PAGE_MASK; + +- if (npages == 0) { ++ if (npages == 0 || npages > UINT_MAX) { + ret = -EINVAL; + goto out; + } diff --git a/queue-4.4/ib-mlx4-check-gid_index-return-value.patch b/queue-4.4/ib-mlx4-check-gid_index-return-value.patch new file mode 100644 index 00000000000..57830164e1e --- /dev/null +++ b/queue-4.4/ib-mlx4-check-gid_index-return-value.patch @@ -0,0 +1,37 @@ +From 37995116fecfce2b61ee3da6e73b3e394c6818f9 Mon Sep 17 00:00:00 2001 +From: Daniel Jurgens +Date: Thu, 10 Nov 2016 11:30:54 +0200 +Subject: IB/mlx4: Check gid_index return value + +From: Daniel Jurgens + +commit 37995116fecfce2b61ee3da6e73b3e394c6818f9 upstream. + +Check the returned GID index value and return an error if it is invalid. + +Fixes: 5070cd2239bd ('IB/mlx4: Replace mechanism for RoCE GID management') +Signed-off-by: Daniel Jurgens +Reviewed-by: Mark Bloch +Reviewed-by: Yuval Shaia +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx4/ah.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx4/ah.c ++++ b/drivers/infiniband/hw/mlx4/ah.c +@@ -102,7 +102,10 @@ static struct ib_ah *create_iboe_ah(stru + if (vlan_tag < 0x1000) + vlan_tag |= (ah_attr->sl & 7) << 13; + ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24)); +- ah->av.eth.gid_index = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index); ++ ret = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index); ++ if (ret < 0) ++ return ERR_PTR(ret); ++ ah->av.eth.gid_index = ret; + ah->av.eth.vlan = cpu_to_be16(vlan_tag); + if (ah_attr->static_rate) { + ah->av.eth.stat_rate = ah_attr->static_rate + MLX4_STAT_RATE_OFFSET; diff --git a/queue-4.4/ib-mlx4-fix-create-cq-error-flow.patch b/queue-4.4/ib-mlx4-fix-create-cq-error-flow.patch new file mode 100644 index 00000000000..e65527a02cd --- /dev/null +++ b/queue-4.4/ib-mlx4-fix-create-cq-error-flow.patch @@ -0,0 +1,42 @@ +From 593ff73bcfdc79f79a8a0df55504f75ad3e5d1a9 Mon Sep 17 00:00:00 2001 +From: Matan Barak +Date: Thu, 10 Nov 2016 11:30:55 +0200 +Subject: IB/mlx4: Fix create CQ error flow + +From: Matan Barak + +commit 593ff73bcfdc79f79a8a0df55504f75ad3e5d1a9 upstream. + +Currently, if ib_copy_to_udata fails, the CQ +won't be deleted from the radix tree and the HW (HW2SW). + +Fixes: 225c7b1feef1 ('IB/mlx4: Add a driver Mellanox ConnectX InfiniBand adapters') +Signed-off-by: Matan Barak +Signed-off-by: Daniel Jurgens +Reviewed-by: Mark Bloch +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx4/cq.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/mlx4/cq.c ++++ b/drivers/infiniband/hw/mlx4/cq.c +@@ -253,11 +253,14 @@ struct ib_cq *mlx4_ib_create_cq(struct i + if (context) + if (ib_copy_to_udata(udata, &cq->mcq.cqn, sizeof (__u32))) { + err = -EFAULT; +- goto err_dbmap; ++ goto err_cq_free; + } + + return &cq->ibcq; + ++err_cq_free: ++ mlx4_cq_free(dev->dev, &cq->mcq); ++ + err_dbmap: + if (context) + mlx4_ib_db_unmap_user(to_mucontext(context), &cq->db); diff --git a/queue-4.4/ib-mlx5-fix-fatal-error-dispatching.patch b/queue-4.4/ib-mlx5-fix-fatal-error-dispatching.patch new file mode 100644 index 00000000000..7ea08f96909 --- /dev/null +++ b/queue-4.4/ib-mlx5-fix-fatal-error-dispatching.patch @@ -0,0 +1,53 @@ +From dbaaff2a2caa03d472b5cc53a3fbfd415c97dc26 Mon Sep 17 00:00:00 2001 +From: Eli Cohen +Date: Thu, 27 Oct 2016 16:36:44 +0300 +Subject: IB/mlx5: Fix fatal error dispatching + +From: Eli Cohen + +commit dbaaff2a2caa03d472b5cc53a3fbfd415c97dc26 upstream. + +When an internal error condition is detected, make sure to set the +device inactive after dispatching the event so ULPs can get a +notification of this event. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Eli Cohen +Signed-off-by: Maor Gottlieb +Reviewed-by: Mohamad Haj Yahia +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/main.c | 7 +++++-- + 1 file changed, 5 insertions(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/main.c ++++ b/drivers/infiniband/hw/mlx5/main.c +@@ -947,13 +947,13 @@ static void mlx5_ib_event(struct mlx5_co + { + struct mlx5_ib_dev *ibdev = (struct mlx5_ib_dev *)context; + struct ib_event ibev; +- ++ bool fatal = false; + u8 port = 0; + + switch (event) { + case MLX5_DEV_EVENT_SYS_ERROR: +- ibdev->ib_active = false; + ibev.event = IB_EVENT_DEVICE_FATAL; ++ fatal = true; + break; + + case MLX5_DEV_EVENT_PORT_UP: +@@ -998,6 +998,9 @@ static void mlx5_ib_event(struct mlx5_co + + if (ibdev->ib_active) + ib_dispatch_event(&ibev); ++ ++ if (fatal) ++ ibdev->ib_active = false; + } + + static void get_ext_port_caps(struct mlx5_ib_dev *dev) diff --git a/queue-4.4/ib-mlx5-use-cache-line-size-to-select-cqe-stride.patch b/queue-4.4/ib-mlx5-use-cache-line-size-to-select-cqe-stride.patch new file mode 100644 index 00000000000..6020b38ac7d --- /dev/null +++ b/queue-4.4/ib-mlx5-use-cache-line-size-to-select-cqe-stride.patch @@ -0,0 +1,41 @@ +From 16b0e0695a73b68d8ca40288c8f9614ef208917b Mon Sep 17 00:00:00 2001 +From: Daniel Jurgens +Date: Thu, 27 Oct 2016 16:36:41 +0300 +Subject: IB/mlx5: Use cache line size to select CQE stride + +From: Daniel Jurgens + +commit 16b0e0695a73b68d8ca40288c8f9614ef208917b upstream. + +When creating kernel CQs use 128B CQE stride if the +cache line size is 128B, 64B otherwise. This prevents +multiple CQEs from residing in a 128B cache line, +which can cause retries when there are concurrent +read and writes in one cache line. + +Tested with IPoIB on PPC64, saw ~5% throughput +improvement. + +Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters') +Signed-off-by: Daniel Jurgens +Signed-off-by: Maor Gottlieb +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/mlx5/cq.c | 3 +-- + 1 file changed, 1 insertion(+), 2 deletions(-) + +--- a/drivers/infiniband/hw/mlx5/cq.c ++++ b/drivers/infiniband/hw/mlx5/cq.c +@@ -787,8 +787,7 @@ struct ib_cq *mlx5_ib_create_cq(struct i + if (err) + goto err_create; + } else { +- /* for now choose 64 bytes till we have a proper interface */ +- cqe_size = 64; ++ cqe_size = cache_line_size() == 128 ? 128 : 64; + err = create_cq_kernel(dev, cq, entries, cqe_size, &cqb, + &index, &inlen); + if (err) diff --git a/queue-4.4/ib-uverbs-fix-leak-of-xrc-target-qps.patch b/queue-4.4/ib-uverbs-fix-leak-of-xrc-target-qps.patch new file mode 100644 index 00000000000..8386131d950 --- /dev/null +++ b/queue-4.4/ib-uverbs-fix-leak-of-xrc-target-qps.patch @@ -0,0 +1,42 @@ +From 5b810a242c28e1d8d64d718cebe75b79d86a0b2d Mon Sep 17 00:00:00 2001 +From: Tariq Toukan +Date: Thu, 27 Oct 2016 16:36:26 +0300 +Subject: IB/uverbs: Fix leak of XRC target QPs + +From: Tariq Toukan + +commit 5b810a242c28e1d8d64d718cebe75b79d86a0b2d upstream. + +The real QP is destroyed in case of the ref count reaches zero, but +for XRC target QPs this call was missed and caused to QP leaks. + +Let's call to destroy for all flows. + +Fixes: 0e0ec7e0638e ('RDMA/core: Export ib_open_qp() to share XRC...') +Signed-off-by: Tariq Toukan +Signed-off-by: Noa Osherovich +Signed-off-by: Leon Romanovsky +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/core/uverbs_main.c | 7 ++----- + 1 file changed, 2 insertions(+), 5 deletions(-) + +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -244,12 +244,9 @@ static int ib_uverbs_cleanup_ucontext(st + container_of(uobj, struct ib_uqp_object, uevent.uobject); + + idr_remove_uobj(&ib_uverbs_qp_idr, uobj); +- if (qp != qp->real_qp) { +- ib_close_qp(qp); +- } else { ++ if (qp == qp->real_qp) + ib_uverbs_detach_umcast(qp, uqp); +- ib_destroy_qp(qp); +- } ++ ib_destroy_qp(qp); + ib_uverbs_release_uevent(file, &uqp->uevent); + kfree(uqp); + } diff --git a/queue-4.4/iwlwifi-pcie-fix-splc-structure-parsing.patch b/queue-4.4/iwlwifi-pcie-fix-splc-structure-parsing.patch new file mode 100644 index 00000000000..5a0b7e7cc7d --- /dev/null +++ b/queue-4.4/iwlwifi-pcie-fix-splc-structure-parsing.patch @@ -0,0 +1,153 @@ +From e0d9727c111a5917a1184c71c1a8e6f78c7fc41d Mon Sep 17 00:00:00 2001 +From: Luca Coelho +Date: Thu, 13 Oct 2016 10:07:07 +0300 +Subject: iwlwifi: pcie: fix SPLC structure parsing + +From: Luca Coelho + +commit e0d9727c111a5917a1184c71c1a8e6f78c7fc41d upstream. + +The SPLC data parsing is too restrictive and was not trying find the +correct element for WiFi. This causes problems with some BIOSes where +the SPLC method exists, but doesn't have a WiFi entry on the first +element of the list. The domain type values are also incorrect +according to the specification. + +Fix this by complying with the actual specification. + +Additionally, replace all occurrences of SPLX to SPLC, since SPLX is +only a structure internal to the ACPI tables, and may not even exist. + +Fixes: bcb079a14d75 ("iwlwifi: pcie: retrieve and parse ACPI power limitations") +Reported-by: Chris Rorvick +Tested-by: Paul Bolle +Tested-by: Chris Rorvick +Signed-off-by: Luca Coelho +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/wireless/iwlwifi/pcie/drv.c | 77 +++++++++++++++++++------------- + 1 file changed, 47 insertions(+), 30 deletions(-) + +--- a/drivers/net/wireless/iwlwifi/pcie/drv.c ++++ b/drivers/net/wireless/iwlwifi/pcie/drv.c +@@ -475,48 +475,64 @@ static const struct pci_device_id iwl_hw + MODULE_DEVICE_TABLE(pci, iwl_hw_card_ids); + + #ifdef CONFIG_ACPI +-#define SPL_METHOD "SPLC" +-#define SPL_DOMAINTYPE_MODULE BIT(0) +-#define SPL_DOMAINTYPE_WIFI BIT(1) +-#define SPL_DOMAINTYPE_WIGIG BIT(2) +-#define SPL_DOMAINTYPE_RFEM BIT(3) ++#define ACPI_SPLC_METHOD "SPLC" ++#define ACPI_SPLC_DOMAIN_WIFI (0x07) + +-static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx) ++static u64 splc_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splc) + { +- union acpi_object *limits, *domain_type, *power_limit; ++ union acpi_object *data_pkg, *dflt_pwr_limit; ++ int i; + +- if (splx->type != ACPI_TYPE_PACKAGE || +- splx->package.count != 2 || +- splx->package.elements[0].type != ACPI_TYPE_INTEGER || +- splx->package.elements[0].integer.value != 0) { +- IWL_ERR(trans, "Unsupported splx structure\n"); ++ /* We need at least two elements, one for the revision and one ++ * for the data itself. Also check that the revision is ++ * supported (currently only revision 0). ++ */ ++ if (splc->type != ACPI_TYPE_PACKAGE || ++ splc->package.count < 2 || ++ splc->package.elements[0].type != ACPI_TYPE_INTEGER || ++ splc->package.elements[0].integer.value != 0) { ++ IWL_DEBUG_INFO(trans, ++ "Unsupported structure returned by the SPLC method. Ignoring.\n"); + return 0; + } + +- limits = &splx->package.elements[1]; +- if (limits->type != ACPI_TYPE_PACKAGE || +- limits->package.count < 2 || +- limits->package.elements[0].type != ACPI_TYPE_INTEGER || +- limits->package.elements[1].type != ACPI_TYPE_INTEGER) { +- IWL_ERR(trans, "Invalid limits element\n"); +- return 0; ++ /* loop through all the packages to find the one for WiFi */ ++ for (i = 1; i < splc->package.count; i++) { ++ union acpi_object *domain; ++ ++ data_pkg = &splc->package.elements[i]; ++ ++ /* Skip anything that is not a package with the right ++ * amount of elements (i.e. at least 2 integers). ++ */ ++ if (data_pkg->type != ACPI_TYPE_PACKAGE || ++ data_pkg->package.count < 2 || ++ data_pkg->package.elements[0].type != ACPI_TYPE_INTEGER || ++ data_pkg->package.elements[1].type != ACPI_TYPE_INTEGER) ++ continue; ++ ++ domain = &data_pkg->package.elements[0]; ++ if (domain->integer.value == ACPI_SPLC_DOMAIN_WIFI) ++ break; ++ ++ data_pkg = NULL; + } + +- domain_type = &limits->package.elements[0]; +- power_limit = &limits->package.elements[1]; +- if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) { +- IWL_DEBUG_INFO(trans, "WiFi power is not limited\n"); ++ if (!data_pkg) { ++ IWL_DEBUG_INFO(trans, ++ "No element for the WiFi domain returned by the SPLC method.\n"); + return 0; + } + +- return power_limit->integer.value; ++ dflt_pwr_limit = &data_pkg->package.elements[1]; ++ return dflt_pwr_limit->integer.value; + } + + static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev) + { + acpi_handle pxsx_handle; + acpi_handle handle; +- struct acpi_buffer splx = {ACPI_ALLOCATE_BUFFER, NULL}; ++ struct acpi_buffer splc = {ACPI_ALLOCATE_BUFFER, NULL}; + acpi_status status; + + pxsx_handle = ACPI_HANDLE(&pdev->dev); +@@ -527,23 +543,24 @@ static void set_dflt_pwr_limit(struct iw + } + + /* Get the method's handle */ +- status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle); ++ status = acpi_get_handle(pxsx_handle, (acpi_string)ACPI_SPLC_METHOD, ++ &handle); + if (ACPI_FAILURE(status)) { +- IWL_DEBUG_INFO(trans, "SPL method not found\n"); ++ IWL_DEBUG_INFO(trans, "SPLC method not found\n"); + return; + } + + /* Call SPLC with no arguments */ +- status = acpi_evaluate_object(handle, NULL, NULL, &splx); ++ status = acpi_evaluate_object(handle, NULL, NULL, &splc); + if (ACPI_FAILURE(status)) { + IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status); + return; + } + +- trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer); ++ trans->dflt_pwr_limit = splc_get_pwr_limit(trans, splc.pointer); + IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n", + trans->dflt_pwr_limit); +- kfree(splx.pointer); ++ kfree(splc.pointer); + } + + #else /* CONFIG_ACPI */ diff --git a/queue-4.4/mfd-core-fix-device-reference-leak-in-mfd_clone_cell.patch b/queue-4.4/mfd-core-fix-device-reference-leak-in-mfd_clone_cell.patch new file mode 100644 index 00000000000..3f543e10273 --- /dev/null +++ b/queue-4.4/mfd-core-fix-device-reference-leak-in-mfd_clone_cell.patch @@ -0,0 +1,32 @@ +From 722f191080de641f023feaa7d5648caf377844f5 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 1 Nov 2016 11:38:18 +0100 +Subject: mfd: core: Fix device reference leak in mfd_clone_cell + +From: Johan Hovold + +commit 722f191080de641f023feaa7d5648caf377844f5 upstream. + +Make sure to drop the reference taken by bus_find_device_by_name() +before returning from mfd_clone_cell(). + +Fixes: a9bbba996302 ("mfd: add platform_device sharing support for mfd") +Signed-off-by: Johan Hovold +Signed-off-by: Lee Jones +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/mfd/mfd-core.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/drivers/mfd/mfd-core.c ++++ b/drivers/mfd/mfd-core.c +@@ -354,6 +354,8 @@ int mfd_clone_cell(const char *cell, con + clones[i]); + } + ++ put_device(dev); ++ + return 0; + } + EXPORT_SYMBOL(mfd_clone_cell); diff --git a/queue-4.4/netfilter-nft_dynset-fix-element-timeout-for-hz-1000.patch b/queue-4.4/netfilter-nft_dynset-fix-element-timeout-for-hz-1000.patch new file mode 100644 index 00000000000..33bbb1f6cfc --- /dev/null +++ b/queue-4.4/netfilter-nft_dynset-fix-element-timeout-for-hz-1000.patch @@ -0,0 +1,48 @@ +From a8b1e36d0d1d6f51490e7adce35367ed6adb10e7 Mon Sep 17 00:00:00 2001 +From: "Anders K. Pedersen" +Date: Sun, 9 Oct 2016 13:49:02 +0000 +Subject: netfilter: nft_dynset: fix element timeout for HZ != 1000 + +From: Anders K. Pedersen + +commit a8b1e36d0d1d6f51490e7adce35367ed6adb10e7 upstream. + +With HZ=100 element timeout in dynamic sets (i.e. flow tables) is 10 times +higher than configured. + +Add proper conversion to/from jiffies, when interacting with userspace. + +I tested this on Linux 4.8.1, and it applies cleanly to current nf and +nf-next trees. + +Fixes: 22fe54d5fefc ("netfilter: nf_tables: add support for dynamic set updates") +Signed-off-by: Anders K. Pedersen +Signed-off-by: Pablo Neira Ayuso +Signed-off-by: Greg Kroah-Hartman + +--- + net/netfilter/nft_dynset.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/netfilter/nft_dynset.c ++++ b/net/netfilter/nft_dynset.c +@@ -140,7 +140,8 @@ static int nft_dynset_init(const struct + if (tb[NFTA_DYNSET_TIMEOUT] != NULL) { + if (!(set->flags & NFT_SET_TIMEOUT)) + return -EINVAL; +- timeout = be64_to_cpu(nla_get_be64(tb[NFTA_DYNSET_TIMEOUT])); ++ timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64( ++ tb[NFTA_DYNSET_TIMEOUT]))); + } + + priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]); +@@ -227,7 +228,8 @@ static int nft_dynset_dump(struct sk_buf + goto nla_put_failure; + if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name)) + goto nla_put_failure; +- if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, cpu_to_be64(priv->timeout))) ++ if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, ++ cpu_to_be64(jiffies_to_msecs(priv->timeout)))) + goto nla_put_failure; + if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr)) + goto nla_put_failure; diff --git a/queue-4.4/pm-sleep-don-t-suspend-parent-when-async-child-suspend_-noirq-late-fails.patch b/queue-4.4/pm-sleep-don-t-suspend-parent-when-async-child-suspend_-noirq-late-fails.patch new file mode 100644 index 00000000000..19027ababf9 --- /dev/null +++ b/queue-4.4/pm-sleep-don-t-suspend-parent-when-async-child-suspend_-noirq-late-fails.patch @@ -0,0 +1,77 @@ +From 6f75c3fd56daf547d684127a7f83c283c3c160d1 Mon Sep 17 00:00:00 2001 +From: Brian Norris +Date: Wed, 9 Nov 2016 17:21:08 -0800 +Subject: PM / sleep: don't suspend parent when async child suspend_{noirq, late} fails + +From: Brian Norris + +commit 6f75c3fd56daf547d684127a7f83c283c3c160d1 upstream. + +Consider two devices, A and B, where B is a child of A, and B utilizes +asynchronous suspend (it does not matter whether A is sync or async). If +B fails to suspend_noirq() or suspend_late(), or is interrupted by a +wakeup (pm_wakeup_pending()), then it aborts and sets the async_error +variable. However, device A does not (immediately) check the async_error +variable; it may continue to run its own suspend_noirq()/suspend_late() +callback. This is bad. + +We can resolve this problem by doing our error and wakeup checking +(particularly, for the async_error flag) after waiting for children to +suspend, instead of before. This also helps align the logic for the noirq and +late suspend cases with the logic in __device_suspend(). + +It's easy to observe this erroneous behavior by, for example, forcing a +device to sleep a bit in its suspend_noirq() (to ensure the parent is +waiting for the child to complete), then return an error, and watch the +parent suspend_noirq() still get called. (Or similarly, fake a wakeup +event at the right (or is it wrong?) time.) + +Fixes: de377b397272 (PM / sleep: Asynchronous threads for suspend_late) +Fixes: 28b6fd6e3779 (PM / sleep: Asynchronous threads for suspend_noirq) +Reported-by: Jeffy Chen +Signed-off-by: Brian Norris +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/power/main.c | 8 ++++---- + 1 file changed, 4 insertions(+), 4 deletions(-) + +--- a/drivers/base/power/main.c ++++ b/drivers/base/power/main.c +@@ -1022,6 +1022,8 @@ static int __device_suspend_noirq(struct + TRACE_DEVICE(dev); + TRACE_SUSPEND(0); + ++ dpm_wait_for_children(dev, async); ++ + if (async_error) + goto Complete; + +@@ -1033,8 +1035,6 @@ static int __device_suspend_noirq(struct + if (dev->power.syscore || dev->power.direct_complete) + goto Complete; + +- dpm_wait_for_children(dev, async); +- + if (dev->pm_domain) { + info = "noirq power domain "; + callback = pm_noirq_op(&dev->pm_domain->ops, state); +@@ -1169,6 +1169,8 @@ static int __device_suspend_late(struct + + __pm_runtime_disable(dev, false); + ++ dpm_wait_for_children(dev, async); ++ + if (async_error) + goto Complete; + +@@ -1180,8 +1182,6 @@ static int __device_suspend_late(struct + if (dev->power.syscore || dev->power.direct_complete) + goto Complete; + +- dpm_wait_for_children(dev, async); +- + if (dev->pm_domain) { + info = "late power domain "; + callback = pm_late_early_op(&dev->pm_domain->ops, state); diff --git a/queue-4.4/pm-sleep-fix-device-reference-leak-in-test_suspend.patch b/queue-4.4/pm-sleep-fix-device-reference-leak-in-test_suspend.patch new file mode 100644 index 00000000000..d96b53facd0 --- /dev/null +++ b/queue-4.4/pm-sleep-fix-device-reference-leak-in-test_suspend.patch @@ -0,0 +1,35 @@ +From ceb75787bc75d0a7b88519ab8a68067ac690f55a Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 1 Nov 2016 11:49:56 +0100 +Subject: PM / sleep: fix device reference leak in test_suspend + +From: Johan Hovold + +commit ceb75787bc75d0a7b88519ab8a68067ac690f55a upstream. + +Make sure to drop the reference taken by class_find_device() after +opening the RTC device. + +Fixes: 77437fd4e61f (pm: boot time suspend selftest) +Signed-off-by: Johan Hovold +Signed-off-by: Rafael J. Wysocki +Signed-off-by: Greg Kroah-Hartman + +--- + kernel/power/suspend_test.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/kernel/power/suspend_test.c ++++ b/kernel/power/suspend_test.c +@@ -203,8 +203,10 @@ static int __init test_suspend(void) + + /* RTCs have initialized by now too ... can we use one? */ + dev = class_find_device(rtc_class, NULL, NULL, has_wakealarm); +- if (dev) ++ if (dev) { + rtc = rtc_class_open(dev_name(dev)); ++ put_device(dev); ++ } + if (!rtc) { + printk(warn_no_rtc); + return 0; diff --git a/queue-4.4/rtc-omap-fix-selecting-external-osc.patch b/queue-4.4/rtc-omap-fix-selecting-external-osc.patch new file mode 100644 index 00000000000..367fed2901a --- /dev/null +++ b/queue-4.4/rtc-omap-fix-selecting-external-osc.patch @@ -0,0 +1,67 @@ +From 3984903a2e3906d3def220e688040ce93368200a Mon Sep 17 00:00:00 2001 +From: Lokesh Vutla +Date: Thu, 27 Oct 2016 11:27:25 +0530 +Subject: rtc: omap: Fix selecting external osc + +From: Lokesh Vutla + +commit 3984903a2e3906d3def220e688040ce93368200a upstream. + +RTC can be clocked from an external 32KHz oscillator, or from the +Peripheral PLL. The RTC has an internal oscillator buffer to support +direct operation with a crystal. + + ---------------------------------------- + | Device --------- | + | | | | + | | RTCSS | | + | --------- | | | + OSC |<------| RTC | | | | + |------>| OSC |--- | | | + | -------- | | | | + | ----|clk | | + | -------- | | | | + | | PRCM |--- | | | + | -------- -------- | + ---------------------------------------- + +The RTC functional clock is sourced by default from the clock derived +from the Peripheral PLL. In order to select source as external osc clk +the following changes needs to be done: +- Enable the RTC OSC (RTC_OSC_REG[4]OSC32K_GZ = 0) +- Enable the clock mux(RTC_OSC_REG[6]K32CLK_EN = 1) +- Select the external clock source (RTC_OSC_REG[3]32KCLK_SEL = 1) + +Fixes: 399cf0f63f6f2 ("rtc: omap: Add external clock enabling support") +Signed-off-by: Keerthy +Signed-off-by: Lokesh Vutla +Signed-off-by: Dave Gerlach +Signed-off-by: Alexandre Belloni +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/rtc/rtc-omap.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/drivers/rtc/rtc-omap.c ++++ b/drivers/rtc/rtc-omap.c +@@ -109,6 +109,7 @@ + /* OMAP_RTC_OSC_REG bit fields: */ + #define OMAP_RTC_OSC_32KCLK_EN BIT(6) + #define OMAP_RTC_OSC_SEL_32KCLK_SRC BIT(3) ++#define OMAP_RTC_OSC_OSC32K_GZ_DISABLE BIT(4) + + /* OMAP_RTC_IRQWAKEEN bit fields: */ + #define OMAP_RTC_IRQWAKEEN_ALARM_WAKEEN BIT(1) +@@ -646,8 +647,9 @@ static int omap_rtc_probe(struct platfor + */ + if (rtc->has_ext_clk) { + reg = rtc_read(rtc, OMAP_RTC_OSC_REG); +- rtc_write(rtc, OMAP_RTC_OSC_REG, +- reg | OMAP_RTC_OSC_SEL_32KCLK_SRC); ++ reg &= ~OMAP_RTC_OSC_OSC32K_GZ_DISABLE; ++ reg |= OMAP_RTC_OSC_32KCLK_EN | OMAP_RTC_OSC_SEL_32KCLK_SRC; ++ rtc_writel(rtc, OMAP_RTC_OSC_REG, reg); + } + + rtc->type->lock(rtc); diff --git a/queue-4.4/series b/queue-4.4/series index e3c81e859c1..646d440d39e 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -12,3 +12,20 @@ kbuild-steal-gcc-s-pie-from-the-very-beginning.patch ext4-sanity-check-the-block-and-cluster-size-at-mount-time.patch crypto-caam-do-not-register-aes-xts-mode-on-lp-units.patch drm-amdgpu-attach-exclusive-fence-to-prime-exported-bo-s.-v5.patch +clk-mmp-pxa910-fix-return-value-check-in-pxa910_clk_init.patch +clk-mmp-pxa168-fix-return-value-check-in-pxa168_clk_init.patch +clk-mmp-mmp2-fix-return-value-check-in-mmp2_clk_init.patch +rtc-omap-fix-selecting-external-osc.patch +iwlwifi-pcie-fix-splc-structure-parsing.patch +mfd-core-fix-device-reference-leak-in-mfd_clone_cell.patch +uwb-fix-device-reference-leaks.patch +pm-sleep-fix-device-reference-leak-in-test_suspend.patch +pm-sleep-don-t-suspend-parent-when-async-child-suspend_-noirq-late-fails.patch +ib-mlx4-check-gid_index-return-value.patch +ib-mlx4-fix-create-cq-error-flow.patch +ib-mlx5-use-cache-line-size-to-select-cqe-stride.patch +ib-mlx5-fix-fatal-error-dispatching.patch +ib-core-avoid-unsigned-int-overflow-in-sg_alloc_table.patch +ib-uverbs-fix-leak-of-xrc-target-qps.patch +ib-cm-mark-stale-cm-id-s-whenever-the-mad-agent-was-unregistered.patch +netfilter-nft_dynset-fix-element-timeout-for-hz-1000.patch diff --git a/queue-4.4/uwb-fix-device-reference-leaks.patch b/queue-4.4/uwb-fix-device-reference-leaks.patch new file mode 100644 index 00000000000..55b137c9d89 --- /dev/null +++ b/queue-4.4/uwb-fix-device-reference-leaks.patch @@ -0,0 +1,86 @@ +From d6124b409ca33c100170ffde51cd8dff761454a1 Mon Sep 17 00:00:00 2001 +From: Johan Hovold +Date: Tue, 1 Nov 2016 12:13:31 +0100 +Subject: uwb: fix device reference leaks + +From: Johan Hovold + +commit d6124b409ca33c100170ffde51cd8dff761454a1 upstream. + +This subsystem consistently fails to drop the device reference taken by +class_find_device(). + +Note that some of these lookup functions already take a reference to the +returned data, while others claim no reference is needed (or does not +seem need one). + +Fixes: 183b9b592a62 ("uwb: add the UWB stack (core files)") +Signed-off-by: Johan Hovold +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/uwb/lc-rc.c | 16 +++++++++++++--- + drivers/uwb/pal.c | 2 ++ + 2 files changed, 15 insertions(+), 3 deletions(-) + +--- a/drivers/uwb/lc-rc.c ++++ b/drivers/uwb/lc-rc.c +@@ -56,8 +56,11 @@ static struct uwb_rc *uwb_rc_find_by_ind + struct uwb_rc *rc = NULL; + + dev = class_find_device(&uwb_rc_class, NULL, &index, uwb_rc_index_match); +- if (dev) ++ if (dev) { + rc = dev_get_drvdata(dev); ++ put_device(dev); ++ } ++ + return rc; + } + +@@ -467,7 +470,9 @@ struct uwb_rc *__uwb_rc_try_get(struct u + if (dev) { + rc = dev_get_drvdata(dev); + __uwb_rc_get(rc); ++ put_device(dev); + } ++ + return rc; + } + EXPORT_SYMBOL_GPL(__uwb_rc_try_get); +@@ -520,8 +525,11 @@ struct uwb_rc *uwb_rc_get_by_grandpa(con + + dev = class_find_device(&uwb_rc_class, NULL, grandpa_dev, + find_rc_grandpa); +- if (dev) ++ if (dev) { + rc = dev_get_drvdata(dev); ++ put_device(dev); ++ } ++ + return rc; + } + EXPORT_SYMBOL_GPL(uwb_rc_get_by_grandpa); +@@ -553,8 +561,10 @@ struct uwb_rc *uwb_rc_get_by_dev(const s + struct uwb_rc *rc = NULL; + + dev = class_find_device(&uwb_rc_class, NULL, addr, find_rc_dev); +- if (dev) ++ if (dev) { + rc = dev_get_drvdata(dev); ++ put_device(dev); ++ } + + return rc; + } +--- a/drivers/uwb/pal.c ++++ b/drivers/uwb/pal.c +@@ -97,6 +97,8 @@ static bool uwb_rc_class_device_exists(s + + dev = class_find_device(&uwb_rc_class, NULL, target_rc, find_rc); + ++ put_device(dev); ++ + return (dev != NULL); + } + -- 2.47.3