--- /dev/null
+From 008a374487070a391c12aa39288fd8511f822cab Mon Sep 17 00:00:00 2001
+From: Sven Eckelmann <sven@open-mesh.com>
+Date: Tue, 3 Nov 2015 19:20:34 +0100
+Subject: batman-adv: Fix lockdep annotation of batadv_tlv_container_remove
+
+From: Sven Eckelmann <sven@open-mesh.com>
+
+commit 008a374487070a391c12aa39288fd8511f822cab upstream.
+
+The function handles tlv containers and not tlv handlers. Thus the
+lockdep_assert_held has to check for the container_list lock.
+
+Fixes: 2c72d655b044 ("batman-adv: Annotate deleting functions with external lock via lockdep")
+Signed-off-by: Sven Eckelmann <sven@open-mesh.com>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Antonio Quartulli <a@unstable.cc>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/batman-adv/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/batman-adv/main.c
++++ b/net/batman-adv/main.c
+@@ -747,7 +747,7 @@ static u16 batadv_tvlv_container_list_si
+ static void batadv_tvlv_container_remove(struct batadv_priv *bat_priv,
+ struct batadv_tvlv_container *tvlv)
+ {
+- lockdep_assert_held(&bat_priv->tvlv.handler_list_lock);
++ lockdep_assert_held(&bat_priv->tvlv.container_list_lock);
+
+ if (!tvlv)
+ return;
--- /dev/null
+From 0b3dd7dfb81ad8af53791ea2bb64b83bac1b7d32 Mon Sep 17 00:00:00 2001
+From: Simon Wunderlich <sw@simonwunderlich.de>
+Date: Sun, 26 Jun 2016 11:16:09 +0200
+Subject: batman-adv: replace WARN with rate limited output on non-existing VLAN
+
+From: Simon Wunderlich <sw@simonwunderlich.de>
+
+commit 0b3dd7dfb81ad8af53791ea2bb64b83bac1b7d32 upstream.
+
+If a VLAN tagged frame is received and the corresponding VLAN is not
+configured on the soft interface, it will splat a WARN on every packet
+received. This is a quite annoying behaviour for some scenarios, e.g. if
+bat0 is bridged with eth0, and there are arbitrary VLAN tagged frames
+from Ethernet coming in without having any VLAN configuration on bat0.
+
+The code should probably create vlan objects on the fly and
+transparently transport these VLAN-tagged Ethernet frames, but until
+this is done, at least the WARN splat should be replaced by a rate
+limited output.
+
+Fixes: 354136bcc3c4 ("batman-adv: fix kernel crash due to missing NULL checks")
+Signed-off-by: Simon Wunderlich <sw@simonwunderlich.de>
+Signed-off-by: Marek Lindner <mareklindner@neomailbox.ch>
+Signed-off-by: Sven Eckelmann <sven@narfation.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/batman-adv/translation-table.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/net/batman-adv/translation-table.c
++++ b/net/batman-adv/translation-table.c
+@@ -614,8 +614,10 @@ bool batadv_tt_local_add(struct net_devi
+
+ /* increase the refcounter of the related vlan */
+ vlan = batadv_softif_vlan_get(bat_priv, vid);
+- if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d",
+- addr, BATADV_PRINT_VID(vid))) {
++ if (!vlan) {
++ net_ratelimited_function(batadv_info, soft_iface,
++ "adding TT local entry %pM to non-existent VLAN %d\n",
++ addr, BATADV_PRINT_VID(vid));
+ kfree(tt_local);
+ tt_local = NULL;
+ goto out;
--- /dev/null
+From 0dc924c5f2a3c4d999e12feaccee5f970cea1315 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Wed, 13 Jan 2016 15:21:17 +0300
+Subject: Btrfs: clean up an error code in btrfs_init_space_info()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 0dc924c5f2a3c4d999e12feaccee5f970cea1315 upstream.
+
+If we return 1 here, then the caller treats it as an error and returns
+-EINVAL. It causes a static checker warning to treat positive returns
+as an error.
+
+Fixes: 1aba86d67f34 ('Btrfs: fix easily get into ENOSPC in mixed case')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/extent-tree.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10688,7 +10688,7 @@ int btrfs_init_space_info(struct btrfs_f
+
+ disk_super = fs_info->super_copy;
+ if (!btrfs_super_root(disk_super))
+- return 1;
++ return -EINVAL;
+
+ features = btrfs_super_incompat_flags(disk_super);
+ if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)
--- /dev/null
+From b00359642c2427da89dc8f77daa2c9e8a84e6d76 Mon Sep 17 00:00:00 2001
+From: Olaf Hering <olaf@aepfle.de>
+Date: Mon, 14 Dec 2015 16:01:37 -0800
+Subject: Drivers: hv: utils: use memdup_user in hvt_op_write
+
+From: Olaf Hering <olaf@aepfle.de>
+
+commit b00359642c2427da89dc8f77daa2c9e8a84e6d76 upstream.
+
+Use memdup_user to handle OOM.
+
+Fixes: 14b50f80c32d ('Drivers: hv: util: introduce hv_utils_transport abstraction')
+
+Signed-off-by: Olaf Hering <olaf@aepfle.de>
+Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/hv/hv_utils_transport.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/hv/hv_utils_transport.c
++++ b/drivers/hv/hv_utils_transport.c
+@@ -80,11 +80,10 @@ static ssize_t hvt_op_write(struct file
+
+ hvt = container_of(file->f_op, struct hvutil_transport, fops);
+
+- inmsg = kzalloc(count, GFP_KERNEL);
+- if (copy_from_user(inmsg, buf, count)) {
+- kfree(inmsg);
+- return -EFAULT;
+- }
++ inmsg = memdup_user(buf, count);
++ if (IS_ERR(inmsg))
++ return PTR_ERR(inmsg);
++
+ if (hvt->on_msg(inmsg, count))
+ return -EFAULT;
+ kfree(inmsg);
--- /dev/null
+From 32a5a0c047343b11f581f663a2309cf43d13466f Mon Sep 17 00:00:00 2001
+From: William Breathitt Gray <vilhelm.gray@gmail.com>
+Date: Wed, 11 May 2016 17:01:40 -0400
+Subject: isa: Call isa_bus_init before dependent ISA bus drivers register
+
+From: William Breathitt Gray <vilhelm.gray@gmail.com>
+
+commit 32a5a0c047343b11f581f663a2309cf43d13466f upstream.
+
+The isa_bus_init function must be called before drivers which utilize
+the ISA bus driver are registered. A race condition for initilization
+exists if device_initcall is used (the isa_bus_init callback is placed
+in the same initcall level as dependent drivers which use module_init).
+This patch ensures that isa_bus_init is called first by utilizing
+postcore_initcall in favor of device_initcall.
+
+Fixes: a5117ba7da37 ("[PATCH] Driver model: add ISA bus")
+Cc: Rene Herman <rene.herman@keyaccess.nl>
+Signed-off-by: William Breathitt Gray <vilhelm.gray@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/base/isa.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/base/isa.c
++++ b/drivers/base/isa.c
+@@ -180,4 +180,4 @@ static int __init isa_bus_init(void)
+ return error;
+ }
+
+-device_initcall(isa_bus_init);
++postcore_initcall(isa_bus_init);
--- /dev/null
+From 454911333b1d86e1d58a557be271bc6b7e9e7f10 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Wed, 27 Jan 2016 15:20:20 +0100
+Subject: mlxsw: spectrum: Disable learning according to STP state
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+commit 454911333b1d86e1d58a557be271bc6b7e9e7f10 upstream.
+
+When port is put into LISTENING state it shouldn't populate the FDB, so
+set the port's STP state in hardware to DISCARDING instead of LEARNING.
+It will therefore keep listening to BPDU packets, but discard other
+non-control packets and won't perform any learning.
+
+Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -90,10 +90,10 @@ static int mlxsw_sp_port_stp_state_set(s
+ case BR_STATE_FORWARDING:
+ spms_state = MLXSW_REG_SPMS_STATE_FORWARDING;
+ break;
+- case BR_STATE_LISTENING: /* fall-through */
+ case BR_STATE_LEARNING:
+ spms_state = MLXSW_REG_SPMS_STATE_LEARNING;
+ break;
++ case BR_STATE_LISTENING: /* fall-through */
+ case BR_STATE_DISABLED: /* fall-through */
+ case BR_STATE_BLOCKING:
+ spms_state = MLXSW_REG_SPMS_STATE_DISCARDING;
--- /dev/null
+From 63dcdd35c1552ca0c911e98ba3389a0729a457f4 Mon Sep 17 00:00:00 2001
+From: Nogah Frankel <nogahf@mellanox.com>
+Date: Fri, 17 Jun 2016 15:09:05 +0200
+Subject: mlxsw: spectrum: Don't count internal TX header bytes to stats
+
+From: Nogah Frankel <nogahf@mellanox.com>
+
+commit 63dcdd35c1552ca0c911e98ba3389a0729a457f4 upstream.
+
+Stop the SW TX counter from counting the TX header bytes
+since they are not being sent out.
+
+Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
+Reviewed-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: Nogah Frankel <nogahf@mellanox.com>
+Signed-off-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -399,7 +399,11 @@ static netdev_tx_t mlxsw_sp_port_xmit(st
+ }
+
+ mlxsw_sp_txhdr_construct(skb, &tx_info);
+- len = skb->len;
++ /* TX header is consumed by HW on the way so we shouldn't count its
++ * bytes as being sent.
++ */
++ len = skb->len - MLXSW_TXHDR_LEN;
++
+ /* Due to a race we might fail here because of a full queue. In that
+ * unlikely case we simply drop the packet.
+ */
--- /dev/null
+From 9cb026ebb8ab76829a8d8e4bbd057168ac38fb86 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Wed, 27 Jan 2016 15:20:19 +0100
+Subject: mlxsw: spectrum: Don't forward packets when STP state is DISABLED
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+commit 9cb026ebb8ab76829a8d8e4bbd057168ac38fb86 upstream.
+
+When STP state is set to DISABLED the port is assumed to be inactive, but
+currently we forward packets ingressing through it.
+
+Instead, set the port's STP state in hardware to DISCARDING, which means
+it doesn't forward packets or perform any learning, but it does trap
+control packets. However, these packets will be dropped by bridge code,
+which results in the expected behavior.
+
+Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -87,7 +87,6 @@ static int mlxsw_sp_port_stp_state_set(s
+ int err;
+
+ switch (state) {
+- case BR_STATE_DISABLED: /* fall-through */
+ case BR_STATE_FORWARDING:
+ spms_state = MLXSW_REG_SPMS_STATE_FORWARDING;
+ break;
+@@ -95,6 +94,7 @@ static int mlxsw_sp_port_stp_state_set(s
+ case BR_STATE_LEARNING:
+ spms_state = MLXSW_REG_SPMS_STATE_LEARNING;
+ break;
++ case BR_STATE_DISABLED: /* fall-through */
+ case BR_STATE_BLOCKING:
+ spms_state = MLXSW_REG_SPMS_STATE_DISCARDING;
+ break;
--- /dev/null
+From feb7d387a6cf6c1ec66d4a2b6d4b2cc52309876e Mon Sep 17 00:00:00 2001
+From: Yotam Gigi <yotamg@mellanox.com>
+Date: Tue, 4 Oct 2016 09:46:04 +0200
+Subject: mlxsw: spectrum: Fix misuse of hard_header_len
+
+From: Yotam Gigi <yotamg@mellanox.com>
+
+commit feb7d387a6cf6c1ec66d4a2b6d4b2cc52309876e upstream.
+
+In order to specify that the mlxsw spectrum driver needs additional
+headroom for packets, there have been use of the hard_header_len field of
+the netdevice struct.
+
+This commit changes that to use needed_headroom instead, as this is the
+correct way to do that.
+
+Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
+Signed-off-by: Yotam Gigi <yotamg@mellanox.com>
+Acked-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -1261,7 +1261,7 @@ static int mlxsw_sp_port_create(struct m
+ /* Each packet needs to have a Tx header (metadata) on top all other
+ * headers.
+ */
+- dev->hard_header_len += MLXSW_TXHDR_LEN;
++ dev->needed_headroom = MLXSW_TXHDR_LEN;
+
+ err = mlxsw_sp_port_module_check(mlxsw_sp_port, &usable);
+ if (err) {
--- /dev/null
+From c3f1576810affced47684e04a08c1ffa845144c9 Mon Sep 17 00:00:00 2001
+From: Ido Schimmel <idosch@mellanox.com>
+Date: Fri, 15 Jul 2016 11:14:59 +0200
+Subject: mlxsw: spectrum: Indicate support for autonegotiation
+
+From: Ido Schimmel <idosch@mellanox.com>
+
+commit c3f1576810affced47684e04a08c1ffa845144c9 upstream.
+
+The device supports link autonegotiation, so let the user know about it
+by indicating support via ethtool ops.
+
+Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
+Signed-off-by: Ido Schimmel <idosch@mellanox.com>
+Signed-off-by: Jiri Pirko <jiri@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+@@ -1104,7 +1104,8 @@ static int mlxsw_sp_port_get_settings(st
+
+ cmd->supported = mlxsw_sp_from_ptys_supported_port(eth_proto_cap) |
+ mlxsw_sp_from_ptys_supported_link(eth_proto_cap) |
+- SUPPORTED_Pause | SUPPORTED_Asym_Pause;
++ SUPPORTED_Pause | SUPPORTED_Asym_Pause |
++ SUPPORTED_Autoneg;
+ cmd->advertising = mlxsw_sp_from_ptys_advert_link(eth_proto_admin);
+ mlxsw_sp_from_ptys_speed_duplex(netif_carrier_ok(dev),
+ eth_proto_oper, cmd);
--- /dev/null
+From 1d2f7b2d956e242179aaf4a08f3545f99c81f9a3 Mon Sep 17 00:00:00 2001
+From: David Ahern <dsa@cumulusnetworks.com>
+Date: Wed, 4 May 2016 21:26:08 -0700
+Subject: net: ipv6: tcp reset, icmp need to consider L3 domain
+
+From: David Ahern <dsa@cumulusnetworks.com>
+
+commit 1d2f7b2d956e242179aaf4a08f3545f99c81f9a3 upstream.
+
+Responses for packets to unused ports are getting lost with L3 domains.
+
+IPv4 has ip_send_unicast_reply for sending TCP responses which accounts
+for L3 domains; update the IPv6 counterpart tcp_v6_send_response.
+For icmp the L3 master check needs to be moved up in icmp6_send
+to properly respond to UDP packets to a port with no listener.
+
+Fixes: ca254490c8df ("net: Add VRF support to IPv6 stack")
+Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/icmp.c | 5 ++---
+ net/ipv6/tcp_ipv6.c | 7 ++++++-
+ 2 files changed, 8 insertions(+), 4 deletions(-)
+
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -445,6 +445,8 @@ static void icmp6_send(struct sk_buff *s
+
+ if (__ipv6_addr_needs_scope_id(addr_type))
+ iif = skb->dev->ifindex;
++ else
++ iif = l3mdev_master_ifindex(skb->dev);
+
+ /*
+ * Must not send error if the source does not uniquely
+@@ -499,9 +501,6 @@ static void icmp6_send(struct sk_buff *s
+ else if (!fl6.flowi6_oif)
+ fl6.flowi6_oif = np->ucast_oif;
+
+- if (!fl6.flowi6_oif)
+- fl6.flowi6_oif = l3mdev_master_ifindex(skb->dev);
+-
+ dst = icmpv6_route_lookup(net, skb, sk, &fl6);
+ if (IS_ERR(dst))
+ goto out;
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -815,8 +815,13 @@ static void tcp_v6_send_response(const s
+ fl6.flowi6_proto = IPPROTO_TCP;
+ if (rt6_need_strict(&fl6.daddr) && !oif)
+ fl6.flowi6_oif = tcp_v6_iif(skb);
+- else
++ else {
++ if (!oif && netif_index_is_l3_master(net, skb->skb_iif))
++ oif = skb->skb_iif;
++
+ fl6.flowi6_oif = oif;
++ }
++
+ fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
+ fl6.fl6_dport = t1->dest;
+ fl6.fl6_sport = t1->source;
--- /dev/null
+From 8c2c2358b236530bc2c79b4c2a447cbdbc3d96d7 Mon Sep 17 00:00:00 2001
+From: Johannes Weiner <hannes@cmpxchg.org>
+Date: Thu, 14 Jan 2016 15:20:59 -0800
+Subject: net: tcp_memcontrol: properly detect ancestor socket pressure
+
+From: Johannes Weiner <hannes@cmpxchg.org>
+
+commit 8c2c2358b236530bc2c79b4c2a447cbdbc3d96d7 upstream.
+
+When charging socket memory, the code currently checks only the local
+page counter for excess to determine whether the memcg is under socket
+pressure. But even if the local counter is fine, one of the ancestors
+could have breached its limit, which should also force this child to
+enter socket pressure. This currently doesn't happen.
+
+Fix this by using page_counter_try_charge() first. If that fails, it
+means that either the local counter or one of the ancestors are in
+excess of their limit, and the child should enter socket pressure.
+
+Fixes: 3e32cb2e0a12 ("mm: memcontrol: lockless page counters")
+Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: David S. Miller <davem@davemloft.net>
+Reviewed-by: Vladimir Davydov <vdavydov@virtuozzo.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/sock.h | 10 ++++++----
+ 1 file changed, 6 insertions(+), 4 deletions(-)
+
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -1204,11 +1204,13 @@ static inline void memcg_memory_allocate
+ unsigned long amt,
+ int *parent_status)
+ {
+- page_counter_charge(&prot->memory_allocated, amt);
++ struct page_counter *counter;
++
++ if (page_counter_try_charge(&prot->memory_allocated, amt, &counter))
++ return;
+
+- if (page_counter_read(&prot->memory_allocated) >
+- prot->memory_allocated.limit)
+- *parent_status = OVER_LIMIT;
++ page_counter_charge(&prot->memory_allocated, amt);
++ *parent_status = OVER_LIMIT;
+ }
+
+ static inline void memcg_memory_allocated_sub(struct cg_proto *prot,
--- /dev/null
+From 0de4cbb3dddca35ecd06b95918f38439c9c6401f Mon Sep 17 00:00:00 2001
+From: Honggang Li <honli@redhat.com>
+Date: Mon, 23 May 2016 08:32:09 +0800
+Subject: RDMA/cxgb3: device driver frees DMA memory with different size
+
+From: Honggang Li <honli@redhat.com>
+
+commit 0de4cbb3dddca35ecd06b95918f38439c9c6401f upstream.
+
+[ 598.852037] ------------[ cut here ]------------
+[ 598.856698] WARNING: at lib/dma-debug.c:887 check_unmap+0xf8/0x920()
+[ 598.863079] cxgb3 0000:01:00.0: DMA-API: device driver frees DMA memory with different size [device address=0x0000000003310000] [map size=17 bytes] [unmap size=16 bytes]
+[ 598.878265] Modules linked in: xprtrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_sa ib_mad kvm_amd kvm ipmi_devintf ipmi_ssif dcdbas pcspkr ipmi_si sg ipmi_msghandler acpi_power_meter amd64_edac_mod shpchp edac_core sp5100_tco k10temp edac_mce_amd i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_common ata_generic iw_cxgb3 pata_acpi ib_core ib_addr mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm pata_atiixp drm ahci libahci serio_raw i2c_core cxgb3 libata bnx2 mdio dm_mirror dm_region_hash dm_log dm_mod
+[ 598.946822] CPU: 3 PID: 11820 Comm: cmtime Not tainted 3.10.0-327.el7.x86_64.debug #1
+[ 598.954681] Hardware name: Dell Inc. PowerEdge R415/0GXH08, BIOS 2.0.2 10/22/2012
+[ 598.962193] ffff8808077479a8 000000000381a432 ffff880807747960 ffffffff81700918
+[ 598.969663] ffff880807747998 ffffffff8108b6c0 ffff880807747a80 ffff8808063f55c0
+[ 598.977132] ffffffff833ca850 0000000000000282 ffff88080b1bb800 ffff880807747a00
+[ 598.984602] Call Trace:
+[ 598.987062] [<ffffffff81700918>] dump_stack+0x19/0x1b
+[ 598.992224] [<ffffffff8108b6c0>] warn_slowpath_common+0x70/0xb0
+[ 598.998254] [<ffffffff8108b75c>] warn_slowpath_fmt+0x5c/0x80
+[ 599.004033] [<ffffffff813903b8>] check_unmap+0xf8/0x920
+[ 599.009369] [<ffffffff81025959>] ? sched_clock+0x9/0x10
+[ 599.014702] [<ffffffff81390cee>] debug_dma_free_coherent+0x7e/0xa0
+[ 599.021008] [<ffffffffa01ece2c>] cxio_destroy_cq+0xcc/0x160 [iw_cxgb3]
+[ 599.027654] [<ffffffffa01e8da0>] iwch_destroy_cq+0xf0/0x140 [iw_cxgb3]
+[ 599.034307] [<ffffffffa01c4bfe>] ib_destroy_cq+0x1e/0x30 [ib_core]
+[ 599.040601] [<ffffffffa04ff2d2>] ib_uverbs_close+0x302/0x4d0 [ib_uverbs]
+[ 599.047417] [<ffffffff812335a2>] __fput+0x102/0x310
+[ 599.052401] [<ffffffff8123388e>] ____fput+0xe/0x10
+[ 599.057297] [<ffffffff810bbde4>] task_work_run+0xb4/0xe0
+[ 599.062719] [<ffffffff81092a84>] do_exit+0x304/0xc60
+[ 599.067789] [<ffffffff81025905>] ? native_sched_clock+0x35/0x80
+[ 599.073820] [<ffffffff81025959>] ? sched_clock+0x9/0x10
+[ 599.079153] [<ffffffff8170a49c>] ? _raw_spin_unlock_irq+0x2c/0x50
+[ 599.085358] [<ffffffff8109346c>] do_group_exit+0x4c/0xc0
+[ 599.090779] [<ffffffff810a8661>] get_signal_to_deliver+0x2e1/0x960
+[ 599.097071] [<ffffffff8101c497>] do_signal+0x57/0x6e0
+[ 599.102229] [<ffffffff81714bd1>] ? sysret_signal+0x5/0x4e
+[ 599.107738] [<ffffffff8101cb7f>] do_notify_resume+0x5f/0xb0
+[ 599.113418] [<ffffffff81714e7d>] int_signal+0x12/0x17
+[ 599.118576] ---[ end trace 1e4653102e7e7019 ]---
+[ 599.123211] Mapped at:
+[ 599.125577] [<ffffffff8138ed8b>] debug_dma_alloc_coherent+0x2b/0x80
+[ 599.131968] [<ffffffffa01ec862>] cxio_create_cq+0xf2/0x1f0 [iw_cxgb3]
+[ 599.139920] [<ffffffffa01e9c05>] iwch_create_cq+0x105/0x4e0 [iw_cxgb3]
+[ 599.147895] [<ffffffffa0500584>] create_cq.constprop.14+0x184/0x2e0 [ib_uverbs]
+[ 599.156649] [<ffffffffa05027fb>] ib_uverbs_create_cq+0x10b/0x140 [ib_uverbs]
+
+Fixes: b955150ea784 ('RDMA/cxgb3: When a user QP is marked in error, also mark the CQs in error')
+Signed-off-by: Honggang Li <honli@redhat.com>
+Reviewed-by: Leon Romanovsky <leonro@mellanox.com>
+Reviewed-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb3/cxio_hal.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c
++++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c
+@@ -327,7 +327,7 @@ int cxio_destroy_cq(struct cxio_rdev *rd
+ kfree(cq->sw_queue);
+ dma_free_coherent(&(rdev_p->rnic_info.pdev->dev),
+ (1UL << (cq->size_log2))
+- * sizeof(struct t3_cqe), cq->queue,
++ * sizeof(struct t3_cqe) + 1, cq->queue,
+ dma_unmap_addr(cq, mapping));
+ cxio_hal_put_cqid(rdev_p->rscp, cq->cqid);
+ return err;
--- /dev/null
+From eb192840266fab3e3da644018121eed30153355d Mon Sep 17 00:00:00 2001
+From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Date: Mon, 2 May 2016 11:24:51 -0700
+Subject: RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock
+
+From: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+
+commit eb192840266fab3e3da644018121eed30153355d upstream.
+
+There is a race condition between rds_send_xmit -> rds_tcp_xmit
+and the code that deals with resolution of duelling syns added
+by commit 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an
+outgoing socket in rds_tcp_accept_one()").
+
+Specifically, we may end up derefencing a null pointer in rds_send_xmit
+if we have the interleaving sequence:
+ rds_tcp_accept_one rds_send_xmit
+
+ conn is RDS_CONN_UP, so
+ invoke rds_tcp_xmit
+
+ tc = conn->c_transport_data
+ rds_tcp_restore_callbacks
+ /* reset t_sock */
+ null ptr deref from tc->t_sock
+
+The race condition can be avoided without adding the overhead of
+additional locking in the xmit path: have rds_tcp_accept_one wait
+for rds_tcp_xmit threads to complete before resetting callbacks.
+The synchronization can be done in the same manner as rds_conn_shutdown().
+First set the rds_conn_state to something other than RDS_CONN_UP
+(so that new threads cannot get into rds_tcp_xmit()), then wait for
+RDS_IN_XMIT to be cleared in the conn->c_flags indicating that any
+threads in rds_tcp_xmit are done.
+
+Fixes: 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an
+outgoing socket in rds_tcp_accept_one()")
+Signed-off-by: Sowmini Varadhan <sowmini.varadhan@oracle.com>
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/rds/tcp.c | 2 +-
+ net/rds/tcp_listen.c | 38 +++++++++++++++++++++++---------------
+ 2 files changed, 24 insertions(+), 16 deletions(-)
+
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -110,7 +110,7 @@ void rds_tcp_restore_callbacks(struct so
+
+ /*
+ * This is the only path that sets tc->t_sock. Send and receive trust that
+- * it is set. The RDS_CONN_CONNECTED bit protects those paths from being
++ * it is set. The RDS_CONN_UP bit protects those paths from being
+ * called while it isn't set.
+ */
+ void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn)
+--- a/net/rds/tcp_listen.c
++++ b/net/rds/tcp_listen.c
+@@ -115,24 +115,32 @@ int rds_tcp_accept_one(struct socket *so
+ * rds_tcp_state_change() will do that cleanup
+ */
+ rs_tcp = (struct rds_tcp_connection *)conn->c_transport_data;
+- if (rs_tcp->t_sock &&
+- ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) {
+- struct sock *nsk = new_sock->sk;
++ rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_CONNECTING);
++ if (rs_tcp->t_sock) {
++ /* Need to resolve a duelling SYN between peers.
++ * We have an outstanding SYN to this peer, which may
++ * potentially have transitioned to the RDS_CONN_UP state,
++ * so we must quiesce any send threads before resetting
++ * c_transport_data.
++ */
++ wait_event(conn->c_waitq,
++ !test_bit(RDS_IN_XMIT, &conn->c_flags));
++ if (ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) {
++ struct sock *nsk = new_sock->sk;
+
+- nsk->sk_user_data = NULL;
+- nsk->sk_prot->disconnect(nsk, 0);
+- tcp_done(nsk);
+- new_sock = NULL;
+- ret = 0;
+- goto out;
+- } else if (rs_tcp->t_sock) {
+- rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
+- conn->c_outgoing = 0;
++ nsk->sk_user_data = NULL;
++ nsk->sk_prot->disconnect(nsk, 0);
++ tcp_done(nsk);
++ new_sock = NULL;
++ ret = 0;
++ goto out;
++ } else if (rs_tcp->t_sock) {
++ rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
++ conn->c_outgoing = 0;
++ }
+ }
+-
+- rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_CONNECTING);
+ rds_tcp_set_callbacks(new_sock, conn);
+- rds_connect_complete(conn);
++ rds_connect_complete(conn); /* marks RDS_CONN_UP */
+ new_sock = NULL;
+ ret = 0;
+
--- /dev/null
+From 926b7b5122c96e1f18cd20e85a286c7ec8d18c97 Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Thu, 16 Jun 2016 08:27:36 +0200
+Subject: serial: samsung: Fix possible out of bounds access on non-DT platform
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 926b7b5122c96e1f18cd20e85a286c7ec8d18c97 upstream.
+
+On non-DeviceTree platforms, the index of serial device is a static
+variable incremented on each probe. It is incremented even if deferred
+probe happens when getting the clock in s3c24xx_serial_init_port().
+
+This index is used for referencing elements of statically allocated
+s3c24xx_serial_ports array. In case of re-probe, the index will point
+outside of this array leading to memory corruption.
+
+Increment the index only on successful probe.
+
+Reported-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
+Fixes: b497549a035c ("[ARM] S3C24XX: Split serial driver into core and per-cpu drivers")
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/samsung.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/tty/serial/samsung.c
++++ b/drivers/tty/serial/samsung.c
+@@ -1841,8 +1841,6 @@ static int s3c24xx_serial_probe(struct p
+ ourport->min_dma_size = max_t(int, ourport->port.fifosize,
+ dma_get_cache_alignment());
+
+- probe_index++;
+-
+ dbg("%s: initialising port %p...\n", __func__, ourport);
+
+ ret = s3c24xx_serial_init_port(ourport, pdev);
+@@ -1872,6 +1870,8 @@ static int s3c24xx_serial_probe(struct p
+ if (ret < 0)
+ dev_err(&pdev->dev, "failed to add cpufreq notifier\n");
+
++ probe_index++;
++
+ return 0;
+ }
+
bonding-prevent-out-of-bound-accesses.patch
mtd-nand-fix-onfi-parameter-page-layout.patch
ath10k-free-cached-fw-bin-contents-when-get-board-id-fails.patch
+xprtrdma-checking-for-null-instead-of-is_err.patch
+xprtrdma-fix-additional-uses-of-spin_lock_irqsave-rb_lock.patch
+xprtrdma-xprt_rdma_free-must-not-release-backchannel-reqs.patch
+xprtrdma-rpcrdma_bc_receive_call-should-init-rq_private_buf.len.patch
+rdma-cxgb3-device-driver-frees-dma-memory-with-different-size.patch
+mlxsw-spectrum-don-t-forward-packets-when-stp-state-is-disabled.patch
+mlxsw-spectrum-disable-learning-according-to-stp-state.patch
+mlxsw-spectrum-don-t-count-internal-tx-header-bytes-to-stats.patch
+mlxsw-spectrum-indicate-support-for-autonegotiation.patch
+mlxsw-spectrum-fix-misuse-of-hard_header_len.patch
+net-tcp_memcontrol-properly-detect-ancestor-socket-pressure.patch
+tcp-do-not-set-rtt_min-to-1.patch
+rds-tcp-synchronize-rds_tcp_accept_one-with-rds_send_xmit-when-resetting-t_sock.patch
+net-ipv6-tcp-reset-icmp-need-to-consider-l3-domain.patch
+batman-adv-fix-lockdep-annotation-of-batadv_tlv_container_remove.patch
+batman-adv-replace-warn-with-rate-limited-output-on-non-existing-vlan.patch
+tty-serial-msm-support-more-bauds.patch
+serial-samsung-fix-possible-out-of-bounds-access-on-non-dt-platform.patch
+drivers-hv-utils-use-memdup_user-in-hvt_op_write.patch
+isa-call-isa_bus_init-before-dependent-isa-bus-drivers-register.patch
+btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch
--- /dev/null
+From 372022830b06d9980c7e8b41fa0a4081cff883b0 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 11 Feb 2016 08:58:18 -0800
+Subject: tcp: do not set rtt_min to 1
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 372022830b06d9980c7e8b41fa0a4081cff883b0 upstream.
+
+There are some cases where rtt_us derives from deltas of jiffies,
+instead of using usec timestamps.
+
+Since we want to track minimal rtt, better to assume a delta of 0 jiffie
+might be in fact be very close to 1 jiffie.
+
+It is kind of sad jiffies_to_usecs(1) calls a function instead of simply
+using a constant.
+
+Fixes: f672258391b42 ("tcp: track min RTT using windowed min-filter")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Neal Cardwell <ncardwell@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/tcp_input.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2926,7 +2926,10 @@ static void tcp_update_rtt_min(struct so
+ {
+ const u32 now = tcp_time_stamp, wlen = sysctl_tcp_min_rtt_wlen * HZ;
+ struct rtt_meas *m = tcp_sk(sk)->rtt_min;
+- struct rtt_meas rttm = { .rtt = (rtt_us ? : 1), .ts = now };
++ struct rtt_meas rttm = {
++ .rtt = likely(rtt_us) ? rtt_us : jiffies_to_usecs(1),
++ .ts = now,
++ };
+ u32 elapsed;
+
+ /* Check if the new measurement updates the 1st, 2nd, or 3rd choices */
--- /dev/null
+From 98952bf510d0c7cdfc284f098bbf4682dc47bc61 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <stephen.boyd@linaro.org>
+Date: Fri, 25 Mar 2016 14:35:49 -0700
+Subject: tty: serial: msm: Support more bauds
+
+From: Stephen Boyd <stephen.boyd@linaro.org>
+
+commit 98952bf510d0c7cdfc284f098bbf4682dc47bc61 upstream.
+
+The msm_find_best_baud() function is written with the assumption
+that the port->uartclk rate is fixed to a particular rate at boot
+time, but now this driver changes that clk rate at runtime when
+the baud is changed.
+
+The way the hardware works is that an input clk rate comes from
+the clk controller into the uart hw block. That rate is typically
+1843200 or 3686400 Hz. That rate can then be divided by an
+internal divider in the hw block to achieve a particular baud on
+the serial wire. msm_find_best_baud() is looking for that divider
+value.
+
+A few things are wrong with the way the code is written. First,
+it assumes that the maximum baud that the uart can support if the
+clk rate is fixed at boot is 460800, which would correspond to an
+input clk rate of 230400 * 16 == 3686400 Hz. Except some devices
+have a boot rate of 1843200 Hz or max baud of 115200, so
+achieving 230400 on those devices doesn't work at all because we
+don't increase the clk rate unless max baud is 460800.
+
+Second, we can't achieve bauds higher than 460800 that require
+anything besides a divisor of 1, because we always call
+msm_find_best_baud() with a fixed port->uartclk rate that will
+eventually be changed after we calculate the divisor. So if we
+need to get a baud of 500000, we'll just multiply that by 16 and
+hope that the clk can give us 500000 * 16 == 8000000 Hz, which it
+typically can't do. To really achieve 500000 baud, we need to get
+an input clk rate of 24000000 Hz and then divide that by 3 inside
+the uart hardware.
+
+Finally, we return success for bauds even when we can't actually
+achieve them. This means that when the user asks for 500000 baud,
+we actually get 921600 right now, but the user doesn't know that.
+
+Fix all of this by searching through the divisor and clk rate
+space with a combination of clk_round_rate() and baud
+calculations, keeping track of the best clk rate and divisor we
+find if we can't get an exact match. Typically we can get an
+exact match with a divisor of 1, but sometimes we need to keep
+track and try more frequencies. On my msm8916 device, this
+results in all standard bauds in baud_table being supported
+except for 1800, 576000, 1152000, and 4000000.
+
+Fixes: 850b37a71bde ("tty: serial: msm: Remove 115.2 Kbps maximum baud rate limitation")
+Cc: "Ivan T. Ivanov" <iivanov.xz@gmail.com>
+Cc: Matthew McClintock <mmcclint@codeaurora.org>
+Signed-off-by: Stephen Boyd <stephen.boyd@linaro.org>
+Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Acked-by: Andy Gross <andy.gross@linaro.org>
+Acked-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Tested-by: Cristian Prundeanu <cprundea@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/tty/serial/msm_serial.c | 101 ++++++++++++++++++++++++++--------------
+ 1 file changed, 67 insertions(+), 34 deletions(-)
+
+--- a/drivers/tty/serial/msm_serial.c
++++ b/drivers/tty/serial/msm_serial.c
+@@ -872,37 +872,72 @@ struct msm_baud_map {
+ };
+
+ static const struct msm_baud_map *
+-msm_find_best_baud(struct uart_port *port, unsigned int baud)
++msm_find_best_baud(struct uart_port *port, unsigned int baud,
++ unsigned long *rate)
+ {
+- unsigned int i, divisor;
+- const struct msm_baud_map *entry;
++ struct msm_port *msm_port = UART_TO_MSM(port);
++ unsigned int divisor, result;
++ unsigned long target, old, best_rate = 0, diff, best_diff = ULONG_MAX;
++ const struct msm_baud_map *entry, *end, *best;
+ static const struct msm_baud_map table[] = {
+- { 1536, 0x00, 1 },
+- { 768, 0x11, 1 },
+- { 384, 0x22, 1 },
+- { 192, 0x33, 1 },
+- { 96, 0x44, 1 },
+- { 48, 0x55, 1 },
+- { 32, 0x66, 1 },
+- { 24, 0x77, 1 },
+- { 16, 0x88, 1 },
+- { 12, 0x99, 6 },
+- { 8, 0xaa, 6 },
+- { 6, 0xbb, 6 },
+- { 4, 0xcc, 6 },
+- { 3, 0xdd, 8 },
+- { 2, 0xee, 16 },
+ { 1, 0xff, 31 },
+- { 0, 0xff, 31 },
++ { 2, 0xee, 16 },
++ { 3, 0xdd, 8 },
++ { 4, 0xcc, 6 },
++ { 6, 0xbb, 6 },
++ { 8, 0xaa, 6 },
++ { 12, 0x99, 6 },
++ { 16, 0x88, 1 },
++ { 24, 0x77, 1 },
++ { 32, 0x66, 1 },
++ { 48, 0x55, 1 },
++ { 96, 0x44, 1 },
++ { 192, 0x33, 1 },
++ { 384, 0x22, 1 },
++ { 768, 0x11, 1 },
++ { 1536, 0x00, 1 },
+ };
+
+- divisor = uart_get_divisor(port, baud);
+-
+- for (i = 0, entry = table; i < ARRAY_SIZE(table); i++, entry++)
+- if (entry->divisor <= divisor)
+- break;
++ best = table; /* Default to smallest divider */
++ target = clk_round_rate(msm_port->clk, 16 * baud);
++ divisor = DIV_ROUND_CLOSEST(target, 16 * baud);
++
++ end = table + ARRAY_SIZE(table);
++ entry = table;
++ while (entry < end) {
++ if (entry->divisor <= divisor) {
++ result = target / entry->divisor / 16;
++ diff = abs(result - baud);
++
++ /* Keep track of best entry */
++ if (diff < best_diff) {
++ best_diff = diff;
++ best = entry;
++ best_rate = target;
++ }
++
++ if (result == baud)
++ break;
++ } else if (entry->divisor > divisor) {
++ old = target;
++ target = clk_round_rate(msm_port->clk, old + 1);
++ /*
++ * The rate didn't get any faster so we can't do
++ * better at dividing it down
++ */
++ if (target == old)
++ break;
++
++ /* Start the divisor search over at this new rate */
++ entry = table;
++ divisor = DIV_ROUND_CLOSEST(target, 16 * baud);
++ continue;
++ }
++ entry++;
++ }
+
+- return entry; /* Default to smallest divider */
++ *rate = best_rate;
++ return best;
+ }
+
+ static int msm_set_baud_rate(struct uart_port *port, unsigned int baud,
+@@ -911,22 +946,20 @@ static int msm_set_baud_rate(struct uart
+ unsigned int rxstale, watermark, mask;
+ struct msm_port *msm_port = UART_TO_MSM(port);
+ const struct msm_baud_map *entry;
+- unsigned long flags;
+-
+- entry = msm_find_best_baud(port, baud);
+-
+- msm_write(port, entry->code, UART_CSR);
+-
+- if (baud > 460800)
+- port->uartclk = baud * 16;
++ unsigned long flags, rate;
+
+ flags = *saved_flags;
+ spin_unlock_irqrestore(&port->lock, flags);
+
+- clk_set_rate(msm_port->clk, port->uartclk);
++ entry = msm_find_best_baud(port, baud, &rate);
++ clk_set_rate(msm_port->clk, rate);
++ baud = rate / 16 / entry->divisor;
+
+ spin_lock_irqsave(&port->lock, flags);
+ *saved_flags = flags;
++ port->uartclk = rate;
++
++ msm_write(port, entry->code, UART_CSR);
+
+ /* RX stale watermark */
+ rxstale = entry->rxstale;
--- /dev/null
+From abfb689711aaebd14d893236c6ea4bcdfb61e74c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 5 Nov 2015 11:39:52 +0300
+Subject: xprtrdma: checking for NULL instead of IS_ERR()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit abfb689711aaebd14d893236c6ea4bcdfb61e74c upstream.
+
+The rpcrdma_create_req() function returns error pointers or success. It
+never returns NULL.
+
+Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst and send/receive buffers')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/backchannel.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/sunrpc/xprtrdma/backchannel.c
++++ b/net/sunrpc/xprtrdma/backchannel.c
+@@ -42,8 +42,8 @@ static int rpcrdma_bc_setup_rqst(struct
+ size_t size;
+
+ req = rpcrdma_create_req(r_xprt);
+- if (!req)
+- return -ENOMEM;
++ if (IS_ERR(req))
++ return PTR_ERR(req);
+ req->rl_backchannel = true;
+
+ size = RPCRDMA_INLINE_WRITE_THRESHOLD(rqst);
--- /dev/null
+From 9b06688bc3b9f13f8de90f832c455fddec3d4e8a Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 16 Dec 2015 17:22:06 -0500
+Subject: xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock)
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 9b06688bc3b9f13f8de90f832c455fddec3d4e8a upstream.
+
+Clean up.
+
+rb_lock critical sections added in rpcrdma_ep_post_extra_recv()
+should have first been converted to use normal spin_lock now that
+the reply handler is a work queue.
+
+The backchannel set up code should use the appropriate helper
+instead of open-coding a rb_recv_bufs list add.
+
+Problem introduced by glib patch re-ordering on my part.
+
+Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst')
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Tested-by: Devesh Sharma <devesh.sharma@avagotech.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/backchannel.c | 6 +-----
+ net/sunrpc/xprtrdma/verbs.c | 7 +++----
+ 2 files changed, 4 insertions(+), 9 deletions(-)
+
+--- a/net/sunrpc/xprtrdma/backchannel.c
++++ b/net/sunrpc/xprtrdma/backchannel.c
+@@ -84,9 +84,7 @@ out_fail:
+ static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt,
+ unsigned int count)
+ {
+- struct rpcrdma_buffer *buffers = &r_xprt->rx_buf;
+ struct rpcrdma_rep *rep;
+- unsigned long flags;
+ int rc = 0;
+
+ while (count--) {
+@@ -98,9 +96,7 @@ static int rpcrdma_bc_setup_reps(struct
+ break;
+ }
+
+- spin_lock_irqsave(&buffers->rb_lock, flags);
+- list_add(&rep->rr_list, &buffers->rb_recv_bufs);
+- spin_unlock_irqrestore(&buffers->rb_lock, flags);
++ rpcrdma_recv_buffer_put(rep);
+ }
+
+ return rc;
+--- a/net/sunrpc/xprtrdma/verbs.c
++++ b/net/sunrpc/xprtrdma/verbs.c
+@@ -1337,15 +1337,14 @@ rpcrdma_ep_post_extra_recv(struct rpcrdm
+ struct rpcrdma_ia *ia = &r_xprt->rx_ia;
+ struct rpcrdma_ep *ep = &r_xprt->rx_ep;
+ struct rpcrdma_rep *rep;
+- unsigned long flags;
+ int rc;
+
+ while (count--) {
+- spin_lock_irqsave(&buffers->rb_lock, flags);
++ spin_lock(&buffers->rb_lock);
+ if (list_empty(&buffers->rb_recv_bufs))
+ goto out_reqbuf;
+ rep = rpcrdma_buffer_get_rep_locked(buffers);
+- spin_unlock_irqrestore(&buffers->rb_lock, flags);
++ spin_unlock(&buffers->rb_lock);
+
+ rc = rpcrdma_ep_post_recv(ia, ep, rep);
+ if (rc)
+@@ -1355,7 +1354,7 @@ rpcrdma_ep_post_extra_recv(struct rpcrdm
+ return 0;
+
+ out_reqbuf:
+- spin_unlock_irqrestore(&buffers->rb_lock, flags);
++ spin_unlock(&buffers->rb_lock);
+ pr_warn("%s: no extra receive buffers\n", __func__);
+ return -ENOMEM;
+
--- /dev/null
+From 9f74660bcf1e4cca577be99e54bc77b5df62b508 Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Mon, 15 Feb 2016 10:23:59 -0500
+Subject: xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit 9f74660bcf1e4cca577be99e54bc77b5df62b508 upstream.
+
+Some NFSv4.1 OPEN requests were hanging waiting for the NFS server
+to finish recalling delegations. Turns out that each NFSv4.1 CB
+request on RDMA gets a GARBAGE_ARGS reply from the Linux client.
+
+Commit 756b9b37cfb2e3dc added a line in bc_svc_process that
+overwrites the incoming rq_rcv_buf's length with the value in
+rq_private_buf.len. But rpcrdma_bc_receive_call() does not invoke
+xprt_complete_bc_request(), thus rq_private_buf.len is not
+initialized. svc_process_common() is invoked with a zero-length
+RPC message, and fails.
+
+Fixes: 756b9b37cfb2e3dc ('SUNRPC: Fix callback channel')
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/backchannel.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/sunrpc/xprtrdma/backchannel.c
++++ b/net/sunrpc/xprtrdma/backchannel.c
+@@ -337,6 +337,8 @@ void rpcrdma_bc_receive_call(struct rpcr
+ rqst->rq_reply_bytes_recvd = 0;
+ rqst->rq_bytes_sent = 0;
+ rqst->rq_xid = headerp->rm_xid;
++
++ rqst->rq_private_buf.len = size;
+ set_bit(RPC_BC_PA_IN_USE, &rqst->rq_bc_pa_state);
+
+ buf = &rqst->rq_rcv_buf;
--- /dev/null
+From ffc4d9b1596c34caa98962722e930e97912c8a9f Mon Sep 17 00:00:00 2001
+From: Chuck Lever <chuck.lever@oracle.com>
+Date: Wed, 16 Dec 2015 17:22:14 -0500
+Subject: xprtrdma: xprt_rdma_free() must not release backchannel reqs
+
+From: Chuck Lever <chuck.lever@oracle.com>
+
+commit ffc4d9b1596c34caa98962722e930e97912c8a9f upstream.
+
+Preserve any rpcrdma_req that is attached to rpc_rqst's allocated
+for the backchannel. Otherwise, after all the pre-allocated
+backchannel req's are consumed, incoming backward calls start
+writing on freed memory.
+
+Somehow this hunk got lost.
+
+Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst')
+Signed-off-by: Chuck Lever <chuck.lever@oracle.com>
+Tested-by: Devesh Sharma <devesh.sharma@avagotech.com>
+Signed-off-by: Anna Schumaker <Anna.Schumaker@Netapp.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sunrpc/xprtrdma/transport.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/sunrpc/xprtrdma/transport.c
++++ b/net/sunrpc/xprtrdma/transport.c
+@@ -576,6 +576,9 @@ xprt_rdma_free(void *buffer)
+
+ rb = container_of(buffer, struct rpcrdma_regbuf, rg_base[0]);
+ req = rb->rg_owner;
++ if (req->rl_backchannel)
++ return;
++
+ r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf);
+
+ dprintk("RPC: %s: called on 0x%p\n", __func__, req->rl_reply);
projects / thirdparty / kernel / stable-queue.git / commitdiff
