From b30d496322d0839d3249f17dd5116395e2ad2cbf Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Wed, 6 May 2020 17:29:59 +0200 Subject: [PATCH] 4.4-stable patches added patches: batman-adv-fix-lockdep-annotation-of-batadv_tlv_container_remove.patch batman-adv-replace-warn-with-rate-limited-output-on-non-existing-vlan.patch btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch drivers-hv-utils-use-memdup_user-in-hvt_op_write.patch isa-call-isa_bus_init-before-dependent-isa-bus-drivers-register.patch mlxsw-spectrum-disable-learning-according-to-stp-state.patch mlxsw-spectrum-don-t-count-internal-tx-header-bytes-to-stats.patch mlxsw-spectrum-don-t-forward-packets-when-stp-state-is-disabled.patch mlxsw-spectrum-fix-misuse-of-hard_header_len.patch mlxsw-spectrum-indicate-support-for-autonegotiation.patch net-ipv6-tcp-reset-icmp-need-to-consider-l3-domain.patch net-tcp_memcontrol-properly-detect-ancestor-socket-pressure.patch rdma-cxgb3-device-driver-frees-dma-memory-with-different-size.patch rds-tcp-synchronize-rds_tcp_accept_one-with-rds_send_xmit-when-resetting-t_sock.patch serial-samsung-fix-possible-out-of-bounds-access-on-non-dt-platform.patch tcp-do-not-set-rtt_min-to-1.patch tty-serial-msm-support-more-bauds.patch xprtrdma-checking-for-null-instead-of-is_err.patch xprtrdma-fix-additional-uses-of-spin_lock_irqsave-rb_lock.patch xprtrdma-rpcrdma_bc_receive_call-should-init-rq_private_buf.len.patch xprtrdma-xprt_rdma_free-must-not-release-backchannel-reqs.patch --- ...ation-of-batadv_tlv_container_remove.patch | 33 +++ ...-limited-output-on-non-existing-vlan.patch | 46 ++++ ...-error-code-in-btrfs_init_space_info.patch | 33 +++ ...tils-use-memdup_user-in-hvt_op_write.patch | 39 ++++ ...e-dependent-isa-bus-drivers-register.patch | 33 +++ ...able-learning-according-to-stp-state.patch | 38 ++++ ...nt-internal-tx-header-bytes-to-stats.patch | 38 ++++ ...d-packets-when-stp-state-is-disabled.patch | 45 ++++ ...ectrum-fix-misuse-of-hard_header_len.patch | 38 ++++ ...indicate-support-for-autonegotiation.patch | 34 +++ ...eset-icmp-need-to-consider-l3-domain.patch | 64 ++++++ ...erly-detect-ancestor-socket-pressure.patch | 51 +++++ ...frees-dma-memory-with-different-size.patch | 72 +++++++ ...-rds_send_xmit-when-resetting-t_sock.patch | 108 ++++++++++ ...-of-bounds-access-on-non-dt-platform.patch | 48 +++++ queue-4.4/series | 21 ++ queue-4.4/tcp-do-not-set-rtt_min-to-1.patch | 43 ++++ .../tty-serial-msm-support-more-bauds.patch | 196 ++++++++++++++++++ ...-checking-for-null-instead-of-is_err.patch | 34 +++ ...al-uses-of-spin_lock_irqsave-rb_lock.patch | 83 ++++++++ ..._call-should-init-rq_private_buf.len.patch | 40 ++++ ...ee-must-not-release-backchannel-reqs.patch | 38 ++++ 22 files changed, 1175 insertions(+) create mode 100644 queue-4.4/batman-adv-fix-lockdep-annotation-of-batadv_tlv_container_remove.patch create mode 100644 queue-4.4/batman-adv-replace-warn-with-rate-limited-output-on-non-existing-vlan.patch create mode 100644 queue-4.4/btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch create mode 100644 queue-4.4/drivers-hv-utils-use-memdup_user-in-hvt_op_write.patch create mode 100644 queue-4.4/isa-call-isa_bus_init-before-dependent-isa-bus-drivers-register.patch create mode 100644 queue-4.4/mlxsw-spectrum-disable-learning-according-to-stp-state.patch create mode 100644 queue-4.4/mlxsw-spectrum-don-t-count-internal-tx-header-bytes-to-stats.patch create mode 100644 queue-4.4/mlxsw-spectrum-don-t-forward-packets-when-stp-state-is-disabled.patch create mode 100644 queue-4.4/mlxsw-spectrum-fix-misuse-of-hard_header_len.patch create mode 100644 queue-4.4/mlxsw-spectrum-indicate-support-for-autonegotiation.patch create mode 100644 queue-4.4/net-ipv6-tcp-reset-icmp-need-to-consider-l3-domain.patch create mode 100644 queue-4.4/net-tcp_memcontrol-properly-detect-ancestor-socket-pressure.patch create mode 100644 queue-4.4/rdma-cxgb3-device-driver-frees-dma-memory-with-different-size.patch create mode 100644 queue-4.4/rds-tcp-synchronize-rds_tcp_accept_one-with-rds_send_xmit-when-resetting-t_sock.patch create mode 100644 queue-4.4/serial-samsung-fix-possible-out-of-bounds-access-on-non-dt-platform.patch create mode 100644 queue-4.4/tcp-do-not-set-rtt_min-to-1.patch create mode 100644 queue-4.4/tty-serial-msm-support-more-bauds.patch create mode 100644 queue-4.4/xprtrdma-checking-for-null-instead-of-is_err.patch create mode 100644 queue-4.4/xprtrdma-fix-additional-uses-of-spin_lock_irqsave-rb_lock.patch create mode 100644 queue-4.4/xprtrdma-rpcrdma_bc_receive_call-should-init-rq_private_buf.len.patch create mode 100644 queue-4.4/xprtrdma-xprt_rdma_free-must-not-release-backchannel-reqs.patch diff --git a/queue-4.4/batman-adv-fix-lockdep-annotation-of-batadv_tlv_container_remove.patch b/queue-4.4/batman-adv-fix-lockdep-annotation-of-batadv_tlv_container_remove.patch new file mode 100644 index 00000000000..0bacd296d82 --- /dev/null +++ b/queue-4.4/batman-adv-fix-lockdep-annotation-of-batadv_tlv_container_remove.patch @@ -0,0 +1,33 @@ +From 008a374487070a391c12aa39288fd8511f822cab Mon Sep 17 00:00:00 2001 +From: Sven Eckelmann +Date: Tue, 3 Nov 2015 19:20:34 +0100 +Subject: batman-adv: Fix lockdep annotation of batadv_tlv_container_remove + +From: Sven Eckelmann + +commit 008a374487070a391c12aa39288fd8511f822cab upstream. + +The function handles tlv containers and not tlv handlers. Thus the +lockdep_assert_held has to check for the container_list lock. + +Fixes: 2c72d655b044 ("batman-adv: Annotate deleting functions with external lock via lockdep") +Signed-off-by: Sven Eckelmann +Signed-off-by: Marek Lindner +Signed-off-by: Antonio Quartulli +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/main.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/net/batman-adv/main.c ++++ b/net/batman-adv/main.c +@@ -747,7 +747,7 @@ static u16 batadv_tvlv_container_list_si + static void batadv_tvlv_container_remove(struct batadv_priv *bat_priv, + struct batadv_tvlv_container *tvlv) + { +- lockdep_assert_held(&bat_priv->tvlv.handler_list_lock); ++ lockdep_assert_held(&bat_priv->tvlv.container_list_lock); + + if (!tvlv) + return; diff --git a/queue-4.4/batman-adv-replace-warn-with-rate-limited-output-on-non-existing-vlan.patch b/queue-4.4/batman-adv-replace-warn-with-rate-limited-output-on-non-existing-vlan.patch new file mode 100644 index 00000000000..cbe6ec3c30c --- /dev/null +++ b/queue-4.4/batman-adv-replace-warn-with-rate-limited-output-on-non-existing-vlan.patch @@ -0,0 +1,46 @@ +From 0b3dd7dfb81ad8af53791ea2bb64b83bac1b7d32 Mon Sep 17 00:00:00 2001 +From: Simon Wunderlich +Date: Sun, 26 Jun 2016 11:16:09 +0200 +Subject: batman-adv: replace WARN with rate limited output on non-existing VLAN + +From: Simon Wunderlich + +commit 0b3dd7dfb81ad8af53791ea2bb64b83bac1b7d32 upstream. + +If a VLAN tagged frame is received and the corresponding VLAN is not +configured on the soft interface, it will splat a WARN on every packet +received. This is a quite annoying behaviour for some scenarios, e.g. if +bat0 is bridged with eth0, and there are arbitrary VLAN tagged frames +from Ethernet coming in without having any VLAN configuration on bat0. + +The code should probably create vlan objects on the fly and +transparently transport these VLAN-tagged Ethernet frames, but until +this is done, at least the WARN splat should be replaced by a rate +limited output. + +Fixes: 354136bcc3c4 ("batman-adv: fix kernel crash due to missing NULL checks") +Signed-off-by: Simon Wunderlich +Signed-off-by: Marek Lindner +Signed-off-by: Sven Eckelmann +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/batman-adv/translation-table.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +--- a/net/batman-adv/translation-table.c ++++ b/net/batman-adv/translation-table.c +@@ -614,8 +614,10 @@ bool batadv_tt_local_add(struct net_devi + + /* increase the refcounter of the related vlan */ + vlan = batadv_softif_vlan_get(bat_priv, vid); +- if (WARN(!vlan, "adding TT local entry %pM to non-existent VLAN %d", +- addr, BATADV_PRINT_VID(vid))) { ++ if (!vlan) { ++ net_ratelimited_function(batadv_info, soft_iface, ++ "adding TT local entry %pM to non-existent VLAN %d\n", ++ addr, BATADV_PRINT_VID(vid)); + kfree(tt_local); + tt_local = NULL; + goto out; diff --git a/queue-4.4/btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch b/queue-4.4/btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch new file mode 100644 index 00000000000..3bccbe7f636 --- /dev/null +++ b/queue-4.4/btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch @@ -0,0 +1,33 @@ +From 0dc924c5f2a3c4d999e12feaccee5f970cea1315 Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Wed, 13 Jan 2016 15:21:17 +0300 +Subject: Btrfs: clean up an error code in btrfs_init_space_info() + +From: Dan Carpenter + +commit 0dc924c5f2a3c4d999e12feaccee5f970cea1315 upstream. + +If we return 1 here, then the caller treats it as an error and returns +-EINVAL. It causes a static checker warning to treat positive returns +as an error. + +Fixes: 1aba86d67f34 ('Btrfs: fix easily get into ENOSPC in mixed case') +Signed-off-by: Dan Carpenter +Signed-off-by: David Sterba +Signed-off-by: Greg Kroah-Hartman + +--- + fs/btrfs/extent-tree.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -10688,7 +10688,7 @@ int btrfs_init_space_info(struct btrfs_f + + disk_super = fs_info->super_copy; + if (!btrfs_super_root(disk_super)) +- return 1; ++ return -EINVAL; + + features = btrfs_super_incompat_flags(disk_super); + if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS) diff --git a/queue-4.4/drivers-hv-utils-use-memdup_user-in-hvt_op_write.patch b/queue-4.4/drivers-hv-utils-use-memdup_user-in-hvt_op_write.patch new file mode 100644 index 00000000000..e89846afb31 --- /dev/null +++ b/queue-4.4/drivers-hv-utils-use-memdup_user-in-hvt_op_write.patch @@ -0,0 +1,39 @@ +From b00359642c2427da89dc8f77daa2c9e8a84e6d76 Mon Sep 17 00:00:00 2001 +From: Olaf Hering +Date: Mon, 14 Dec 2015 16:01:37 -0800 +Subject: Drivers: hv: utils: use memdup_user in hvt_op_write + +From: Olaf Hering + +commit b00359642c2427da89dc8f77daa2c9e8a84e6d76 upstream. + +Use memdup_user to handle OOM. + +Fixes: 14b50f80c32d ('Drivers: hv: util: introduce hv_utils_transport abstraction') + +Signed-off-by: Olaf Hering +Signed-off-by: K. Y. Srinivasan +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/hv/hv_utils_transport.c | 9 ++++----- + 1 file changed, 4 insertions(+), 5 deletions(-) + +--- a/drivers/hv/hv_utils_transport.c ++++ b/drivers/hv/hv_utils_transport.c +@@ -80,11 +80,10 @@ static ssize_t hvt_op_write(struct file + + hvt = container_of(file->f_op, struct hvutil_transport, fops); + +- inmsg = kzalloc(count, GFP_KERNEL); +- if (copy_from_user(inmsg, buf, count)) { +- kfree(inmsg); +- return -EFAULT; +- } ++ inmsg = memdup_user(buf, count); ++ if (IS_ERR(inmsg)) ++ return PTR_ERR(inmsg); ++ + if (hvt->on_msg(inmsg, count)) + return -EFAULT; + kfree(inmsg); diff --git a/queue-4.4/isa-call-isa_bus_init-before-dependent-isa-bus-drivers-register.patch b/queue-4.4/isa-call-isa_bus_init-before-dependent-isa-bus-drivers-register.patch new file mode 100644 index 00000000000..9b765d0f17e --- /dev/null +++ b/queue-4.4/isa-call-isa_bus_init-before-dependent-isa-bus-drivers-register.patch @@ -0,0 +1,33 @@ +From 32a5a0c047343b11f581f663a2309cf43d13466f Mon Sep 17 00:00:00 2001 +From: William Breathitt Gray +Date: Wed, 11 May 2016 17:01:40 -0400 +Subject: isa: Call isa_bus_init before dependent ISA bus drivers register + +From: William Breathitt Gray + +commit 32a5a0c047343b11f581f663a2309cf43d13466f upstream. + +The isa_bus_init function must be called before drivers which utilize +the ISA bus driver are registered. A race condition for initilization +exists if device_initcall is used (the isa_bus_init callback is placed +in the same initcall level as dependent drivers which use module_init). +This patch ensures that isa_bus_init is called first by utilizing +postcore_initcall in favor of device_initcall. + +Fixes: a5117ba7da37 ("[PATCH] Driver model: add ISA bus") +Cc: Rene Herman +Signed-off-by: William Breathitt Gray +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/base/isa.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/base/isa.c ++++ b/drivers/base/isa.c +@@ -180,4 +180,4 @@ static int __init isa_bus_init(void) + return error; + } + +-device_initcall(isa_bus_init); ++postcore_initcall(isa_bus_init); diff --git a/queue-4.4/mlxsw-spectrum-disable-learning-according-to-stp-state.patch b/queue-4.4/mlxsw-spectrum-disable-learning-according-to-stp-state.patch new file mode 100644 index 00000000000..75c5340c706 --- /dev/null +++ b/queue-4.4/mlxsw-spectrum-disable-learning-according-to-stp-state.patch @@ -0,0 +1,38 @@ +From 454911333b1d86e1d58a557be271bc6b7e9e7f10 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Wed, 27 Jan 2016 15:20:20 +0100 +Subject: mlxsw: spectrum: Disable learning according to STP state + +From: Ido Schimmel + +commit 454911333b1d86e1d58a557be271bc6b7e9e7f10 upstream. + +When port is put into LISTENING state it shouldn't populate the FDB, so +set the port's STP state in hardware to DISCARDING instead of LEARNING. +It will therefore keep listening to BPDU packets, but discard other +non-control packets and won't perform any learning. + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Signed-off-by: Ido Schimmel +Signed-off-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -90,10 +90,10 @@ static int mlxsw_sp_port_stp_state_set(s + case BR_STATE_FORWARDING: + spms_state = MLXSW_REG_SPMS_STATE_FORWARDING; + break; +- case BR_STATE_LISTENING: /* fall-through */ + case BR_STATE_LEARNING: + spms_state = MLXSW_REG_SPMS_STATE_LEARNING; + break; ++ case BR_STATE_LISTENING: /* fall-through */ + case BR_STATE_DISABLED: /* fall-through */ + case BR_STATE_BLOCKING: + spms_state = MLXSW_REG_SPMS_STATE_DISCARDING; diff --git a/queue-4.4/mlxsw-spectrum-don-t-count-internal-tx-header-bytes-to-stats.patch b/queue-4.4/mlxsw-spectrum-don-t-count-internal-tx-header-bytes-to-stats.patch new file mode 100644 index 00000000000..3589aa55040 --- /dev/null +++ b/queue-4.4/mlxsw-spectrum-don-t-count-internal-tx-header-bytes-to-stats.patch @@ -0,0 +1,38 @@ +From 63dcdd35c1552ca0c911e98ba3389a0729a457f4 Mon Sep 17 00:00:00 2001 +From: Nogah Frankel +Date: Fri, 17 Jun 2016 15:09:05 +0200 +Subject: mlxsw: spectrum: Don't count internal TX header bytes to stats + +From: Nogah Frankel + +commit 63dcdd35c1552ca0c911e98ba3389a0729a457f4 upstream. + +Stop the SW TX counter from counting the TX header bytes +since they are not being sent out. + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Reviewed-by: Ido Schimmel +Signed-off-by: Nogah Frankel +Signed-off-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 6 +++++- + 1 file changed, 5 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -399,7 +399,11 @@ static netdev_tx_t mlxsw_sp_port_xmit(st + } + + mlxsw_sp_txhdr_construct(skb, &tx_info); +- len = skb->len; ++ /* TX header is consumed by HW on the way so we shouldn't count its ++ * bytes as being sent. ++ */ ++ len = skb->len - MLXSW_TXHDR_LEN; ++ + /* Due to a race we might fail here because of a full queue. In that + * unlikely case we simply drop the packet. + */ diff --git a/queue-4.4/mlxsw-spectrum-don-t-forward-packets-when-stp-state-is-disabled.patch b/queue-4.4/mlxsw-spectrum-don-t-forward-packets-when-stp-state-is-disabled.patch new file mode 100644 index 00000000000..d8f994e9fc6 --- /dev/null +++ b/queue-4.4/mlxsw-spectrum-don-t-forward-packets-when-stp-state-is-disabled.patch @@ -0,0 +1,45 @@ +From 9cb026ebb8ab76829a8d8e4bbd057168ac38fb86 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Wed, 27 Jan 2016 15:20:19 +0100 +Subject: mlxsw: spectrum: Don't forward packets when STP state is DISABLED + +From: Ido Schimmel + +commit 9cb026ebb8ab76829a8d8e4bbd057168ac38fb86 upstream. + +When STP state is set to DISABLED the port is assumed to be inactive, but +currently we forward packets ingressing through it. + +Instead, set the port's STP state in hardware to DISCARDING, which means +it doesn't forward packets or perform any learning, but it does trap +control packets. However, these packets will be dropped by bridge code, +which results in the expected behavior. + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Signed-off-by: Ido Schimmel +Signed-off-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c +@@ -87,7 +87,6 @@ static int mlxsw_sp_port_stp_state_set(s + int err; + + switch (state) { +- case BR_STATE_DISABLED: /* fall-through */ + case BR_STATE_FORWARDING: + spms_state = MLXSW_REG_SPMS_STATE_FORWARDING; + break; +@@ -95,6 +94,7 @@ static int mlxsw_sp_port_stp_state_set(s + case BR_STATE_LEARNING: + spms_state = MLXSW_REG_SPMS_STATE_LEARNING; + break; ++ case BR_STATE_DISABLED: /* fall-through */ + case BR_STATE_BLOCKING: + spms_state = MLXSW_REG_SPMS_STATE_DISCARDING; + break; diff --git a/queue-4.4/mlxsw-spectrum-fix-misuse-of-hard_header_len.patch b/queue-4.4/mlxsw-spectrum-fix-misuse-of-hard_header_len.patch new file mode 100644 index 00000000000..3b15b442456 --- /dev/null +++ b/queue-4.4/mlxsw-spectrum-fix-misuse-of-hard_header_len.patch @@ -0,0 +1,38 @@ +From feb7d387a6cf6c1ec66d4a2b6d4b2cc52309876e Mon Sep 17 00:00:00 2001 +From: Yotam Gigi +Date: Tue, 4 Oct 2016 09:46:04 +0200 +Subject: mlxsw: spectrum: Fix misuse of hard_header_len + +From: Yotam Gigi + +commit feb7d387a6cf6c1ec66d4a2b6d4b2cc52309876e upstream. + +In order to specify that the mlxsw spectrum driver needs additional +headroom for packets, there have been use of the hard_header_len field of +the netdevice struct. + +This commit changes that to use needed_headroom instead, as this is the +correct way to do that. + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Signed-off-by: Yotam Gigi +Acked-by: Ido Schimmel +Signed-off-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -1261,7 +1261,7 @@ static int mlxsw_sp_port_create(struct m + /* Each packet needs to have a Tx header (metadata) on top all other + * headers. + */ +- dev->hard_header_len += MLXSW_TXHDR_LEN; ++ dev->needed_headroom = MLXSW_TXHDR_LEN; + + err = mlxsw_sp_port_module_check(mlxsw_sp_port, &usable); + if (err) { diff --git a/queue-4.4/mlxsw-spectrum-indicate-support-for-autonegotiation.patch b/queue-4.4/mlxsw-spectrum-indicate-support-for-autonegotiation.patch new file mode 100644 index 00000000000..2182919aa1c --- /dev/null +++ b/queue-4.4/mlxsw-spectrum-indicate-support-for-autonegotiation.patch @@ -0,0 +1,34 @@ +From c3f1576810affced47684e04a08c1ffa845144c9 Mon Sep 17 00:00:00 2001 +From: Ido Schimmel +Date: Fri, 15 Jul 2016 11:14:59 +0200 +Subject: mlxsw: spectrum: Indicate support for autonegotiation + +From: Ido Schimmel + +commit c3f1576810affced47684e04a08c1ffa845144c9 upstream. + +The device supports link autonegotiation, so let the user know about it +by indicating support via ethtool ops. + +Fixes: 56ade8fe3fe1 ("mlxsw: spectrum: Add initial support for Spectrum ASIC") +Signed-off-by: Ido Schimmel +Signed-off-by: Jiri Pirko +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/net/ethernet/mellanox/mlxsw/spectrum.c | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c ++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c +@@ -1104,7 +1104,8 @@ static int mlxsw_sp_port_get_settings(st + + cmd->supported = mlxsw_sp_from_ptys_supported_port(eth_proto_cap) | + mlxsw_sp_from_ptys_supported_link(eth_proto_cap) | +- SUPPORTED_Pause | SUPPORTED_Asym_Pause; ++ SUPPORTED_Pause | SUPPORTED_Asym_Pause | ++ SUPPORTED_Autoneg; + cmd->advertising = mlxsw_sp_from_ptys_advert_link(eth_proto_admin); + mlxsw_sp_from_ptys_speed_duplex(netif_carrier_ok(dev), + eth_proto_oper, cmd); diff --git a/queue-4.4/net-ipv6-tcp-reset-icmp-need-to-consider-l3-domain.patch b/queue-4.4/net-ipv6-tcp-reset-icmp-need-to-consider-l3-domain.patch new file mode 100644 index 00000000000..e6c0c0ba9d7 --- /dev/null +++ b/queue-4.4/net-ipv6-tcp-reset-icmp-need-to-consider-l3-domain.patch @@ -0,0 +1,64 @@ +From 1d2f7b2d956e242179aaf4a08f3545f99c81f9a3 Mon Sep 17 00:00:00 2001 +From: David Ahern +Date: Wed, 4 May 2016 21:26:08 -0700 +Subject: net: ipv6: tcp reset, icmp need to consider L3 domain + +From: David Ahern + +commit 1d2f7b2d956e242179aaf4a08f3545f99c81f9a3 upstream. + +Responses for packets to unused ports are getting lost with L3 domains. + +IPv4 has ip_send_unicast_reply for sending TCP responses which accounts +for L3 domains; update the IPv6 counterpart tcp_v6_send_response. +For icmp the L3 master check needs to be moved up in icmp6_send +to properly respond to UDP packets to a port with no listener. + +Fixes: ca254490c8df ("net: Add VRF support to IPv6 stack") +Signed-off-by: David Ahern +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv6/icmp.c | 5 ++--- + net/ipv6/tcp_ipv6.c | 7 ++++++- + 2 files changed, 8 insertions(+), 4 deletions(-) + +--- a/net/ipv6/icmp.c ++++ b/net/ipv6/icmp.c +@@ -445,6 +445,8 @@ static void icmp6_send(struct sk_buff *s + + if (__ipv6_addr_needs_scope_id(addr_type)) + iif = skb->dev->ifindex; ++ else ++ iif = l3mdev_master_ifindex(skb->dev); + + /* + * Must not send error if the source does not uniquely +@@ -499,9 +501,6 @@ static void icmp6_send(struct sk_buff *s + else if (!fl6.flowi6_oif) + fl6.flowi6_oif = np->ucast_oif; + +- if (!fl6.flowi6_oif) +- fl6.flowi6_oif = l3mdev_master_ifindex(skb->dev); +- + dst = icmpv6_route_lookup(net, skb, sk, &fl6); + if (IS_ERR(dst)) + goto out; +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -815,8 +815,13 @@ static void tcp_v6_send_response(const s + fl6.flowi6_proto = IPPROTO_TCP; + if (rt6_need_strict(&fl6.daddr) && !oif) + fl6.flowi6_oif = tcp_v6_iif(skb); +- else ++ else { ++ if (!oif && netif_index_is_l3_master(net, skb->skb_iif)) ++ oif = skb->skb_iif; ++ + fl6.flowi6_oif = oif; ++ } ++ + fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark); + fl6.fl6_dport = t1->dest; + fl6.fl6_sport = t1->source; diff --git a/queue-4.4/net-tcp_memcontrol-properly-detect-ancestor-socket-pressure.patch b/queue-4.4/net-tcp_memcontrol-properly-detect-ancestor-socket-pressure.patch new file mode 100644 index 00000000000..16e6bf05337 --- /dev/null +++ b/queue-4.4/net-tcp_memcontrol-properly-detect-ancestor-socket-pressure.patch @@ -0,0 +1,51 @@ +From 8c2c2358b236530bc2c79b4c2a447cbdbc3d96d7 Mon Sep 17 00:00:00 2001 +From: Johannes Weiner +Date: Thu, 14 Jan 2016 15:20:59 -0800 +Subject: net: tcp_memcontrol: properly detect ancestor socket pressure + +From: Johannes Weiner + +commit 8c2c2358b236530bc2c79b4c2a447cbdbc3d96d7 upstream. + +When charging socket memory, the code currently checks only the local +page counter for excess to determine whether the memcg is under socket +pressure. But even if the local counter is fine, one of the ancestors +could have breached its limit, which should also force this child to +enter socket pressure. This currently doesn't happen. + +Fix this by using page_counter_try_charge() first. If that fails, it +means that either the local counter or one of the ancestors are in +excess of their limit, and the child should enter socket pressure. + +Fixes: 3e32cb2e0a12 ("mm: memcontrol: lockless page counters") +Signed-off-by: Johannes Weiner +Acked-by: David S. Miller +Reviewed-by: Vladimir Davydov +Signed-off-by: Andrew Morton +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman + +--- + include/net/sock.h | 10 ++++++---- + 1 file changed, 6 insertions(+), 4 deletions(-) + +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1204,11 +1204,13 @@ static inline void memcg_memory_allocate + unsigned long amt, + int *parent_status) + { +- page_counter_charge(&prot->memory_allocated, amt); ++ struct page_counter *counter; ++ ++ if (page_counter_try_charge(&prot->memory_allocated, amt, &counter)) ++ return; + +- if (page_counter_read(&prot->memory_allocated) > +- prot->memory_allocated.limit) +- *parent_status = OVER_LIMIT; ++ page_counter_charge(&prot->memory_allocated, amt); ++ *parent_status = OVER_LIMIT; + } + + static inline void memcg_memory_allocated_sub(struct cg_proto *prot, diff --git a/queue-4.4/rdma-cxgb3-device-driver-frees-dma-memory-with-different-size.patch b/queue-4.4/rdma-cxgb3-device-driver-frees-dma-memory-with-different-size.patch new file mode 100644 index 00000000000..b6e5e253587 --- /dev/null +++ b/queue-4.4/rdma-cxgb3-device-driver-frees-dma-memory-with-different-size.patch @@ -0,0 +1,72 @@ +From 0de4cbb3dddca35ecd06b95918f38439c9c6401f Mon Sep 17 00:00:00 2001 +From: Honggang Li +Date: Mon, 23 May 2016 08:32:09 +0800 +Subject: RDMA/cxgb3: device driver frees DMA memory with different size + +From: Honggang Li + +commit 0de4cbb3dddca35ecd06b95918f38439c9c6401f upstream. + +[ 598.852037] ------------[ cut here ]------------ +[ 598.856698] WARNING: at lib/dma-debug.c:887 check_unmap+0xf8/0x920() +[ 598.863079] cxgb3 0000:01:00.0: DMA-API: device driver frees DMA memory with different size [device address=0x0000000003310000] [map size=17 bytes] [unmap size=16 bytes] +[ 598.878265] Modules linked in: xprtrdma ib_isert iscsi_target_mod ib_iser libiscsi scsi_transport_iscsi ib_srpt target_core_mod ib_srp scsi_transport_srp scsi_tgt ib_ipoib rdma_ucm ib_ucm ib_uverbs ib_umad rdma_cm ib_cm iw_cm ib_sa ib_mad kvm_amd kvm ipmi_devintf ipmi_ssif dcdbas pcspkr ipmi_si sg ipmi_msghandler acpi_power_meter amd64_edac_mod shpchp edac_core sp5100_tco k10temp edac_mce_amd i2c_piix4 acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod crc_t10dif crct10dif_generic crct10dif_common ata_generic iw_cxgb3 pata_acpi ib_core ib_addr mgag200 syscopyarea sysfillrect sysimgblt i2c_algo_bit drm_kms_helper ttm pata_atiixp drm ahci libahci serio_raw i2c_core cxgb3 libata bnx2 mdio dm_mirror dm_region_hash dm_log dm_mod +[ 598.946822] CPU: 3 PID: 11820 Comm: cmtime Not tainted 3.10.0-327.el7.x86_64.debug #1 +[ 598.954681] Hardware name: Dell Inc. PowerEdge R415/0GXH08, BIOS 2.0.2 10/22/2012 +[ 598.962193] ffff8808077479a8 000000000381a432 ffff880807747960 ffffffff81700918 +[ 598.969663] ffff880807747998 ffffffff8108b6c0 ffff880807747a80 ffff8808063f55c0 +[ 598.977132] ffffffff833ca850 0000000000000282 ffff88080b1bb800 ffff880807747a00 +[ 598.984602] Call Trace: +[ 598.987062] [] dump_stack+0x19/0x1b +[ 598.992224] [] warn_slowpath_common+0x70/0xb0 +[ 598.998254] [] warn_slowpath_fmt+0x5c/0x80 +[ 599.004033] [] check_unmap+0xf8/0x920 +[ 599.009369] [] ? sched_clock+0x9/0x10 +[ 599.014702] [] debug_dma_free_coherent+0x7e/0xa0 +[ 599.021008] [] cxio_destroy_cq+0xcc/0x160 [iw_cxgb3] +[ 599.027654] [] iwch_destroy_cq+0xf0/0x140 [iw_cxgb3] +[ 599.034307] [] ib_destroy_cq+0x1e/0x30 [ib_core] +[ 599.040601] [] ib_uverbs_close+0x302/0x4d0 [ib_uverbs] +[ 599.047417] [] __fput+0x102/0x310 +[ 599.052401] [] ____fput+0xe/0x10 +[ 599.057297] [] task_work_run+0xb4/0xe0 +[ 599.062719] [] do_exit+0x304/0xc60 +[ 599.067789] [] ? native_sched_clock+0x35/0x80 +[ 599.073820] [] ? sched_clock+0x9/0x10 +[ 599.079153] [] ? _raw_spin_unlock_irq+0x2c/0x50 +[ 599.085358] [] do_group_exit+0x4c/0xc0 +[ 599.090779] [] get_signal_to_deliver+0x2e1/0x960 +[ 599.097071] [] do_signal+0x57/0x6e0 +[ 599.102229] [] ? sysret_signal+0x5/0x4e +[ 599.107738] [] do_notify_resume+0x5f/0xb0 +[ 599.113418] [] int_signal+0x12/0x17 +[ 599.118576] ---[ end trace 1e4653102e7e7019 ]--- +[ 599.123211] Mapped at: +[ 599.125577] [] debug_dma_alloc_coherent+0x2b/0x80 +[ 599.131968] [] cxio_create_cq+0xf2/0x1f0 [iw_cxgb3] +[ 599.139920] [] iwch_create_cq+0x105/0x4e0 [iw_cxgb3] +[ 599.147895] [] create_cq.constprop.14+0x184/0x2e0 [ib_uverbs] +[ 599.156649] [] ib_uverbs_create_cq+0x10b/0x140 [ib_uverbs] + +Fixes: b955150ea784 ('RDMA/cxgb3: When a user QP is marked in error, also mark the CQs in error') +Signed-off-by: Honggang Li +Reviewed-by: Leon Romanovsky +Reviewed-by: Steve Wise +Signed-off-by: Doug Ledford +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/infiniband/hw/cxgb3/cxio_hal.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +--- a/drivers/infiniband/hw/cxgb3/cxio_hal.c ++++ b/drivers/infiniband/hw/cxgb3/cxio_hal.c +@@ -327,7 +327,7 @@ int cxio_destroy_cq(struct cxio_rdev *rd + kfree(cq->sw_queue); + dma_free_coherent(&(rdev_p->rnic_info.pdev->dev), + (1UL << (cq->size_log2)) +- * sizeof(struct t3_cqe), cq->queue, ++ * sizeof(struct t3_cqe) + 1, cq->queue, + dma_unmap_addr(cq, mapping)); + cxio_hal_put_cqid(rdev_p->rscp, cq->cqid); + return err; diff --git a/queue-4.4/rds-tcp-synchronize-rds_tcp_accept_one-with-rds_send_xmit-when-resetting-t_sock.patch b/queue-4.4/rds-tcp-synchronize-rds_tcp_accept_one-with-rds_send_xmit-when-resetting-t_sock.patch new file mode 100644 index 00000000000..79a16bf1985 --- /dev/null +++ b/queue-4.4/rds-tcp-synchronize-rds_tcp_accept_one-with-rds_send_xmit-when-resetting-t_sock.patch @@ -0,0 +1,108 @@ +From eb192840266fab3e3da644018121eed30153355d Mon Sep 17 00:00:00 2001 +From: Sowmini Varadhan +Date: Mon, 2 May 2016 11:24:51 -0700 +Subject: RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock + +From: Sowmini Varadhan + +commit eb192840266fab3e3da644018121eed30153355d upstream. + +There is a race condition between rds_send_xmit -> rds_tcp_xmit +and the code that deals with resolution of duelling syns added +by commit 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an +outgoing socket in rds_tcp_accept_one()"). + +Specifically, we may end up derefencing a null pointer in rds_send_xmit +if we have the interleaving sequence: + rds_tcp_accept_one rds_send_xmit + + conn is RDS_CONN_UP, so + invoke rds_tcp_xmit + + tc = conn->c_transport_data + rds_tcp_restore_callbacks + /* reset t_sock */ + null ptr deref from tc->t_sock + +The race condition can be avoided without adding the overhead of +additional locking in the xmit path: have rds_tcp_accept_one wait +for rds_tcp_xmit threads to complete before resetting callbacks. +The synchronization can be done in the same manner as rds_conn_shutdown(). +First set the rds_conn_state to something other than RDS_CONN_UP +(so that new threads cannot get into rds_tcp_xmit()), then wait for +RDS_IN_XMIT to be cleared in the conn->c_flags indicating that any +threads in rds_tcp_xmit are done. + +Fixes: 241b271952eb ("RDS-TCP: Reset tcp callbacks if re-using an +outgoing socket in rds_tcp_accept_one()") +Signed-off-by: Sowmini Varadhan +Acked-by: Santosh Shilimkar +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/rds/tcp.c | 2 +- + net/rds/tcp_listen.c | 38 +++++++++++++++++++++++--------------- + 2 files changed, 24 insertions(+), 16 deletions(-) + +--- a/net/rds/tcp.c ++++ b/net/rds/tcp.c +@@ -110,7 +110,7 @@ void rds_tcp_restore_callbacks(struct so + + /* + * This is the only path that sets tc->t_sock. Send and receive trust that +- * it is set. The RDS_CONN_CONNECTED bit protects those paths from being ++ * it is set. The RDS_CONN_UP bit protects those paths from being + * called while it isn't set. + */ + void rds_tcp_set_callbacks(struct socket *sock, struct rds_connection *conn) +--- a/net/rds/tcp_listen.c ++++ b/net/rds/tcp_listen.c +@@ -115,24 +115,32 @@ int rds_tcp_accept_one(struct socket *so + * rds_tcp_state_change() will do that cleanup + */ + rs_tcp = (struct rds_tcp_connection *)conn->c_transport_data; +- if (rs_tcp->t_sock && +- ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) { +- struct sock *nsk = new_sock->sk; ++ rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_CONNECTING); ++ if (rs_tcp->t_sock) { ++ /* Need to resolve a duelling SYN between peers. ++ * We have an outstanding SYN to this peer, which may ++ * potentially have transitioned to the RDS_CONN_UP state, ++ * so we must quiesce any send threads before resetting ++ * c_transport_data. ++ */ ++ wait_event(conn->c_waitq, ++ !test_bit(RDS_IN_XMIT, &conn->c_flags)); ++ if (ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) { ++ struct sock *nsk = new_sock->sk; + +- nsk->sk_user_data = NULL; +- nsk->sk_prot->disconnect(nsk, 0); +- tcp_done(nsk); +- new_sock = NULL; +- ret = 0; +- goto out; +- } else if (rs_tcp->t_sock) { +- rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp); +- conn->c_outgoing = 0; ++ nsk->sk_user_data = NULL; ++ nsk->sk_prot->disconnect(nsk, 0); ++ tcp_done(nsk); ++ new_sock = NULL; ++ ret = 0; ++ goto out; ++ } else if (rs_tcp->t_sock) { ++ rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp); ++ conn->c_outgoing = 0; ++ } + } +- +- rds_conn_transition(conn, RDS_CONN_DOWN, RDS_CONN_CONNECTING); + rds_tcp_set_callbacks(new_sock, conn); +- rds_connect_complete(conn); ++ rds_connect_complete(conn); /* marks RDS_CONN_UP */ + new_sock = NULL; + ret = 0; + diff --git a/queue-4.4/serial-samsung-fix-possible-out-of-bounds-access-on-non-dt-platform.patch b/queue-4.4/serial-samsung-fix-possible-out-of-bounds-access-on-non-dt-platform.patch new file mode 100644 index 00000000000..0cb55feeb2c --- /dev/null +++ b/queue-4.4/serial-samsung-fix-possible-out-of-bounds-access-on-non-dt-platform.patch @@ -0,0 +1,48 @@ +From 926b7b5122c96e1f18cd20e85a286c7ec8d18c97 Mon Sep 17 00:00:00 2001 +From: Krzysztof Kozlowski +Date: Thu, 16 Jun 2016 08:27:36 +0200 +Subject: serial: samsung: Fix possible out of bounds access on non-DT platform + +From: Krzysztof Kozlowski + +commit 926b7b5122c96e1f18cd20e85a286c7ec8d18c97 upstream. + +On non-DeviceTree platforms, the index of serial device is a static +variable incremented on each probe. It is incremented even if deferred +probe happens when getting the clock in s3c24xx_serial_init_port(). + +This index is used for referencing elements of statically allocated +s3c24xx_serial_ports array. In case of re-probe, the index will point +outside of this array leading to memory corruption. + +Increment the index only on successful probe. + +Reported-by: Bartlomiej Zolnierkiewicz +Fixes: b497549a035c ("[ARM] S3C24XX: Split serial driver into core and per-cpu drivers") +Signed-off-by: Krzysztof Kozlowski +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/samsung.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -1841,8 +1841,6 @@ static int s3c24xx_serial_probe(struct p + ourport->min_dma_size = max_t(int, ourport->port.fifosize, + dma_get_cache_alignment()); + +- probe_index++; +- + dbg("%s: initialising port %p...\n", __func__, ourport); + + ret = s3c24xx_serial_init_port(ourport, pdev); +@@ -1872,6 +1870,8 @@ static int s3c24xx_serial_probe(struct p + if (ret < 0) + dev_err(&pdev->dev, "failed to add cpufreq notifier\n"); + ++ probe_index++; ++ + return 0; + } + diff --git a/queue-4.4/series b/queue-4.4/series index ad33d563c7d..3a137c9e635 100644 --- a/queue-4.4/series +++ b/queue-4.4/series @@ -97,3 +97,24 @@ phy-fix-device-reference-leaks.patch bonding-prevent-out-of-bound-accesses.patch mtd-nand-fix-onfi-parameter-page-layout.patch ath10k-free-cached-fw-bin-contents-when-get-board-id-fails.patch +xprtrdma-checking-for-null-instead-of-is_err.patch +xprtrdma-fix-additional-uses-of-spin_lock_irqsave-rb_lock.patch +xprtrdma-xprt_rdma_free-must-not-release-backchannel-reqs.patch +xprtrdma-rpcrdma_bc_receive_call-should-init-rq_private_buf.len.patch +rdma-cxgb3-device-driver-frees-dma-memory-with-different-size.patch +mlxsw-spectrum-don-t-forward-packets-when-stp-state-is-disabled.patch +mlxsw-spectrum-disable-learning-according-to-stp-state.patch +mlxsw-spectrum-don-t-count-internal-tx-header-bytes-to-stats.patch +mlxsw-spectrum-indicate-support-for-autonegotiation.patch +mlxsw-spectrum-fix-misuse-of-hard_header_len.patch +net-tcp_memcontrol-properly-detect-ancestor-socket-pressure.patch +tcp-do-not-set-rtt_min-to-1.patch +rds-tcp-synchronize-rds_tcp_accept_one-with-rds_send_xmit-when-resetting-t_sock.patch +net-ipv6-tcp-reset-icmp-need-to-consider-l3-domain.patch +batman-adv-fix-lockdep-annotation-of-batadv_tlv_container_remove.patch +batman-adv-replace-warn-with-rate-limited-output-on-non-existing-vlan.patch +tty-serial-msm-support-more-bauds.patch +serial-samsung-fix-possible-out-of-bounds-access-on-non-dt-platform.patch +drivers-hv-utils-use-memdup_user-in-hvt_op_write.patch +isa-call-isa_bus_init-before-dependent-isa-bus-drivers-register.patch +btrfs-clean-up-an-error-code-in-btrfs_init_space_info.patch diff --git a/queue-4.4/tcp-do-not-set-rtt_min-to-1.patch b/queue-4.4/tcp-do-not-set-rtt_min-to-1.patch new file mode 100644 index 00000000000..98579612540 --- /dev/null +++ b/queue-4.4/tcp-do-not-set-rtt_min-to-1.patch @@ -0,0 +1,43 @@ +From 372022830b06d9980c7e8b41fa0a4081cff883b0 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet +Date: Thu, 11 Feb 2016 08:58:18 -0800 +Subject: tcp: do not set rtt_min to 1 + +From: Eric Dumazet + +commit 372022830b06d9980c7e8b41fa0a4081cff883b0 upstream. + +There are some cases where rtt_us derives from deltas of jiffies, +instead of using usec timestamps. + +Since we want to track minimal rtt, better to assume a delta of 0 jiffie +might be in fact be very close to 1 jiffie. + +It is kind of sad jiffies_to_usecs(1) calls a function instead of simply +using a constant. + +Fixes: f672258391b42 ("tcp: track min RTT using windowed min-filter") +Signed-off-by: Eric Dumazet +Signed-off-by: Neal Cardwell +Cc: Yuchung Cheng +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman + +--- + net/ipv4/tcp_input.c | 5 ++++- + 1 file changed, 4 insertions(+), 1 deletion(-) + +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2926,7 +2926,10 @@ static void tcp_update_rtt_min(struct so + { + const u32 now = tcp_time_stamp, wlen = sysctl_tcp_min_rtt_wlen * HZ; + struct rtt_meas *m = tcp_sk(sk)->rtt_min; +- struct rtt_meas rttm = { .rtt = (rtt_us ? : 1), .ts = now }; ++ struct rtt_meas rttm = { ++ .rtt = likely(rtt_us) ? rtt_us : jiffies_to_usecs(1), ++ .ts = now, ++ }; + u32 elapsed; + + /* Check if the new measurement updates the 1st, 2nd, or 3rd choices */ diff --git a/queue-4.4/tty-serial-msm-support-more-bauds.patch b/queue-4.4/tty-serial-msm-support-more-bauds.patch new file mode 100644 index 00000000000..39755916a40 --- /dev/null +++ b/queue-4.4/tty-serial-msm-support-more-bauds.patch @@ -0,0 +1,196 @@ +From 98952bf510d0c7cdfc284f098bbf4682dc47bc61 Mon Sep 17 00:00:00 2001 +From: Stephen Boyd +Date: Fri, 25 Mar 2016 14:35:49 -0700 +Subject: tty: serial: msm: Support more bauds + +From: Stephen Boyd + +commit 98952bf510d0c7cdfc284f098bbf4682dc47bc61 upstream. + +The msm_find_best_baud() function is written with the assumption +that the port->uartclk rate is fixed to a particular rate at boot +time, but now this driver changes that clk rate at runtime when +the baud is changed. + +The way the hardware works is that an input clk rate comes from +the clk controller into the uart hw block. That rate is typically +1843200 or 3686400 Hz. That rate can then be divided by an +internal divider in the hw block to achieve a particular baud on +the serial wire. msm_find_best_baud() is looking for that divider +value. + +A few things are wrong with the way the code is written. First, +it assumes that the maximum baud that the uart can support if the +clk rate is fixed at boot is 460800, which would correspond to an +input clk rate of 230400 * 16 == 3686400 Hz. Except some devices +have a boot rate of 1843200 Hz or max baud of 115200, so +achieving 230400 on those devices doesn't work at all because we +don't increase the clk rate unless max baud is 460800. + +Second, we can't achieve bauds higher than 460800 that require +anything besides a divisor of 1, because we always call +msm_find_best_baud() with a fixed port->uartclk rate that will +eventually be changed after we calculate the divisor. So if we +need to get a baud of 500000, we'll just multiply that by 16 and +hope that the clk can give us 500000 * 16 == 8000000 Hz, which it +typically can't do. To really achieve 500000 baud, we need to get +an input clk rate of 24000000 Hz and then divide that by 3 inside +the uart hardware. + +Finally, we return success for bauds even when we can't actually +achieve them. This means that when the user asks for 500000 baud, +we actually get 921600 right now, but the user doesn't know that. + +Fix all of this by searching through the divisor and clk rate +space with a combination of clk_round_rate() and baud +calculations, keeping track of the best clk rate and divisor we +find if we can't get an exact match. Typically we can get an +exact match with a divisor of 1, but sometimes we need to keep +track and try more frequencies. On my msm8916 device, this +results in all standard bauds in baud_table being supported +except for 1800, 576000, 1152000, and 4000000. + +Fixes: 850b37a71bde ("tty: serial: msm: Remove 115.2 Kbps maximum baud rate limitation") +Cc: "Ivan T. Ivanov" +Cc: Matthew McClintock +Signed-off-by: Stephen Boyd +Tested-by: Srinivas Kandagatla +Acked-by: Andy Gross +Acked-by: Bjorn Andersson +Tested-by: Cristian Prundeanu +Signed-off-by: Greg Kroah-Hartman + +--- + drivers/tty/serial/msm_serial.c | 101 ++++++++++++++++++++++++++-------------- + 1 file changed, 67 insertions(+), 34 deletions(-) + +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -872,37 +872,72 @@ struct msm_baud_map { + }; + + static const struct msm_baud_map * +-msm_find_best_baud(struct uart_port *port, unsigned int baud) ++msm_find_best_baud(struct uart_port *port, unsigned int baud, ++ unsigned long *rate) + { +- unsigned int i, divisor; +- const struct msm_baud_map *entry; ++ struct msm_port *msm_port = UART_TO_MSM(port); ++ unsigned int divisor, result; ++ unsigned long target, old, best_rate = 0, diff, best_diff = ULONG_MAX; ++ const struct msm_baud_map *entry, *end, *best; + static const struct msm_baud_map table[] = { +- { 1536, 0x00, 1 }, +- { 768, 0x11, 1 }, +- { 384, 0x22, 1 }, +- { 192, 0x33, 1 }, +- { 96, 0x44, 1 }, +- { 48, 0x55, 1 }, +- { 32, 0x66, 1 }, +- { 24, 0x77, 1 }, +- { 16, 0x88, 1 }, +- { 12, 0x99, 6 }, +- { 8, 0xaa, 6 }, +- { 6, 0xbb, 6 }, +- { 4, 0xcc, 6 }, +- { 3, 0xdd, 8 }, +- { 2, 0xee, 16 }, + { 1, 0xff, 31 }, +- { 0, 0xff, 31 }, ++ { 2, 0xee, 16 }, ++ { 3, 0xdd, 8 }, ++ { 4, 0xcc, 6 }, ++ { 6, 0xbb, 6 }, ++ { 8, 0xaa, 6 }, ++ { 12, 0x99, 6 }, ++ { 16, 0x88, 1 }, ++ { 24, 0x77, 1 }, ++ { 32, 0x66, 1 }, ++ { 48, 0x55, 1 }, ++ { 96, 0x44, 1 }, ++ { 192, 0x33, 1 }, ++ { 384, 0x22, 1 }, ++ { 768, 0x11, 1 }, ++ { 1536, 0x00, 1 }, + }; + +- divisor = uart_get_divisor(port, baud); +- +- for (i = 0, entry = table; i < ARRAY_SIZE(table); i++, entry++) +- if (entry->divisor <= divisor) +- break; ++ best = table; /* Default to smallest divider */ ++ target = clk_round_rate(msm_port->clk, 16 * baud); ++ divisor = DIV_ROUND_CLOSEST(target, 16 * baud); ++ ++ end = table + ARRAY_SIZE(table); ++ entry = table; ++ while (entry < end) { ++ if (entry->divisor <= divisor) { ++ result = target / entry->divisor / 16; ++ diff = abs(result - baud); ++ ++ /* Keep track of best entry */ ++ if (diff < best_diff) { ++ best_diff = diff; ++ best = entry; ++ best_rate = target; ++ } ++ ++ if (result == baud) ++ break; ++ } else if (entry->divisor > divisor) { ++ old = target; ++ target = clk_round_rate(msm_port->clk, old + 1); ++ /* ++ * The rate didn't get any faster so we can't do ++ * better at dividing it down ++ */ ++ if (target == old) ++ break; ++ ++ /* Start the divisor search over at this new rate */ ++ entry = table; ++ divisor = DIV_ROUND_CLOSEST(target, 16 * baud); ++ continue; ++ } ++ entry++; ++ } + +- return entry; /* Default to smallest divider */ ++ *rate = best_rate; ++ return best; + } + + static int msm_set_baud_rate(struct uart_port *port, unsigned int baud, +@@ -911,22 +946,20 @@ static int msm_set_baud_rate(struct uart + unsigned int rxstale, watermark, mask; + struct msm_port *msm_port = UART_TO_MSM(port); + const struct msm_baud_map *entry; +- unsigned long flags; +- +- entry = msm_find_best_baud(port, baud); +- +- msm_write(port, entry->code, UART_CSR); +- +- if (baud > 460800) +- port->uartclk = baud * 16; ++ unsigned long flags, rate; + + flags = *saved_flags; + spin_unlock_irqrestore(&port->lock, flags); + +- clk_set_rate(msm_port->clk, port->uartclk); ++ entry = msm_find_best_baud(port, baud, &rate); ++ clk_set_rate(msm_port->clk, rate); ++ baud = rate / 16 / entry->divisor; + + spin_lock_irqsave(&port->lock, flags); + *saved_flags = flags; ++ port->uartclk = rate; ++ ++ msm_write(port, entry->code, UART_CSR); + + /* RX stale watermark */ + rxstale = entry->rxstale; diff --git a/queue-4.4/xprtrdma-checking-for-null-instead-of-is_err.patch b/queue-4.4/xprtrdma-checking-for-null-instead-of-is_err.patch new file mode 100644 index 00000000000..80ff958b8cb --- /dev/null +++ b/queue-4.4/xprtrdma-checking-for-null-instead-of-is_err.patch @@ -0,0 +1,34 @@ +From abfb689711aaebd14d893236c6ea4bcdfb61e74c Mon Sep 17 00:00:00 2001 +From: Dan Carpenter +Date: Thu, 5 Nov 2015 11:39:52 +0300 +Subject: xprtrdma: checking for NULL instead of IS_ERR() + +From: Dan Carpenter + +commit abfb689711aaebd14d893236c6ea4bcdfb61e74c upstream. + +The rpcrdma_create_req() function returns error pointers or success. It +never returns NULL. + +Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst and send/receive buffers') +Signed-off-by: Dan Carpenter +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtrdma/backchannel.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/net/sunrpc/xprtrdma/backchannel.c ++++ b/net/sunrpc/xprtrdma/backchannel.c +@@ -42,8 +42,8 @@ static int rpcrdma_bc_setup_rqst(struct + size_t size; + + req = rpcrdma_create_req(r_xprt); +- if (!req) +- return -ENOMEM; ++ if (IS_ERR(req)) ++ return PTR_ERR(req); + req->rl_backchannel = true; + + size = RPCRDMA_INLINE_WRITE_THRESHOLD(rqst); diff --git a/queue-4.4/xprtrdma-fix-additional-uses-of-spin_lock_irqsave-rb_lock.patch b/queue-4.4/xprtrdma-fix-additional-uses-of-spin_lock_irqsave-rb_lock.patch new file mode 100644 index 00000000000..f6b8e7e2d4f --- /dev/null +++ b/queue-4.4/xprtrdma-fix-additional-uses-of-spin_lock_irqsave-rb_lock.patch @@ -0,0 +1,83 @@ +From 9b06688bc3b9f13f8de90f832c455fddec3d4e8a Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 16 Dec 2015 17:22:06 -0500 +Subject: xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock) + +From: Chuck Lever + +commit 9b06688bc3b9f13f8de90f832c455fddec3d4e8a upstream. + +Clean up. + +rb_lock critical sections added in rpcrdma_ep_post_extra_recv() +should have first been converted to use normal spin_lock now that +the reply handler is a work queue. + +The backchannel set up code should use the appropriate helper +instead of open-coding a rb_recv_bufs list add. + +Problem introduced by glib patch re-ordering on my part. + +Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst') +Signed-off-by: Chuck Lever +Tested-by: Devesh Sharma +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtrdma/backchannel.c | 6 +----- + net/sunrpc/xprtrdma/verbs.c | 7 +++---- + 2 files changed, 4 insertions(+), 9 deletions(-) + +--- a/net/sunrpc/xprtrdma/backchannel.c ++++ b/net/sunrpc/xprtrdma/backchannel.c +@@ -84,9 +84,7 @@ out_fail: + static int rpcrdma_bc_setup_reps(struct rpcrdma_xprt *r_xprt, + unsigned int count) + { +- struct rpcrdma_buffer *buffers = &r_xprt->rx_buf; + struct rpcrdma_rep *rep; +- unsigned long flags; + int rc = 0; + + while (count--) { +@@ -98,9 +96,7 @@ static int rpcrdma_bc_setup_reps(struct + break; + } + +- spin_lock_irqsave(&buffers->rb_lock, flags); +- list_add(&rep->rr_list, &buffers->rb_recv_bufs); +- spin_unlock_irqrestore(&buffers->rb_lock, flags); ++ rpcrdma_recv_buffer_put(rep); + } + + return rc; +--- a/net/sunrpc/xprtrdma/verbs.c ++++ b/net/sunrpc/xprtrdma/verbs.c +@@ -1337,15 +1337,14 @@ rpcrdma_ep_post_extra_recv(struct rpcrdm + struct rpcrdma_ia *ia = &r_xprt->rx_ia; + struct rpcrdma_ep *ep = &r_xprt->rx_ep; + struct rpcrdma_rep *rep; +- unsigned long flags; + int rc; + + while (count--) { +- spin_lock_irqsave(&buffers->rb_lock, flags); ++ spin_lock(&buffers->rb_lock); + if (list_empty(&buffers->rb_recv_bufs)) + goto out_reqbuf; + rep = rpcrdma_buffer_get_rep_locked(buffers); +- spin_unlock_irqrestore(&buffers->rb_lock, flags); ++ spin_unlock(&buffers->rb_lock); + + rc = rpcrdma_ep_post_recv(ia, ep, rep); + if (rc) +@@ -1355,7 +1354,7 @@ rpcrdma_ep_post_extra_recv(struct rpcrdm + return 0; + + out_reqbuf: +- spin_unlock_irqrestore(&buffers->rb_lock, flags); ++ spin_unlock(&buffers->rb_lock); + pr_warn("%s: no extra receive buffers\n", __func__); + return -ENOMEM; + diff --git a/queue-4.4/xprtrdma-rpcrdma_bc_receive_call-should-init-rq_private_buf.len.patch b/queue-4.4/xprtrdma-rpcrdma_bc_receive_call-should-init-rq_private_buf.len.patch new file mode 100644 index 00000000000..cdaab220288 --- /dev/null +++ b/queue-4.4/xprtrdma-rpcrdma_bc_receive_call-should-init-rq_private_buf.len.patch @@ -0,0 +1,40 @@ +From 9f74660bcf1e4cca577be99e54bc77b5df62b508 Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Mon, 15 Feb 2016 10:23:59 -0500 +Subject: xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len + +From: Chuck Lever + +commit 9f74660bcf1e4cca577be99e54bc77b5df62b508 upstream. + +Some NFSv4.1 OPEN requests were hanging waiting for the NFS server +to finish recalling delegations. Turns out that each NFSv4.1 CB +request on RDMA gets a GARBAGE_ARGS reply from the Linux client. + +Commit 756b9b37cfb2e3dc added a line in bc_svc_process that +overwrites the incoming rq_rcv_buf's length with the value in +rq_private_buf.len. But rpcrdma_bc_receive_call() does not invoke +xprt_complete_bc_request(), thus rq_private_buf.len is not +initialized. svc_process_common() is invoked with a zero-length +RPC message, and fails. + +Fixes: 756b9b37cfb2e3dc ('SUNRPC: Fix callback channel') +Signed-off-by: Chuck Lever +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtrdma/backchannel.c | 2 ++ + 1 file changed, 2 insertions(+) + +--- a/net/sunrpc/xprtrdma/backchannel.c ++++ b/net/sunrpc/xprtrdma/backchannel.c +@@ -337,6 +337,8 @@ void rpcrdma_bc_receive_call(struct rpcr + rqst->rq_reply_bytes_recvd = 0; + rqst->rq_bytes_sent = 0; + rqst->rq_xid = headerp->rm_xid; ++ ++ rqst->rq_private_buf.len = size; + set_bit(RPC_BC_PA_IN_USE, &rqst->rq_bc_pa_state); + + buf = &rqst->rq_rcv_buf; diff --git a/queue-4.4/xprtrdma-xprt_rdma_free-must-not-release-backchannel-reqs.patch b/queue-4.4/xprtrdma-xprt_rdma_free-must-not-release-backchannel-reqs.patch new file mode 100644 index 00000000000..d3ad21b9970 --- /dev/null +++ b/queue-4.4/xprtrdma-xprt_rdma_free-must-not-release-backchannel-reqs.patch @@ -0,0 +1,38 @@ +From ffc4d9b1596c34caa98962722e930e97912c8a9f Mon Sep 17 00:00:00 2001 +From: Chuck Lever +Date: Wed, 16 Dec 2015 17:22:14 -0500 +Subject: xprtrdma: xprt_rdma_free() must not release backchannel reqs + +From: Chuck Lever + +commit ffc4d9b1596c34caa98962722e930e97912c8a9f upstream. + +Preserve any rpcrdma_req that is attached to rpc_rqst's allocated +for the backchannel. Otherwise, after all the pre-allocated +backchannel req's are consumed, incoming backward calls start +writing on freed memory. + +Somehow this hunk got lost. + +Fixes: f531a5dbc451 ('xprtrdma: Pre-allocate backward rpc_rqst') +Signed-off-by: Chuck Lever +Tested-by: Devesh Sharma +Signed-off-by: Anna Schumaker +Signed-off-by: Greg Kroah-Hartman + +--- + net/sunrpc/xprtrdma/transport.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/sunrpc/xprtrdma/transport.c ++++ b/net/sunrpc/xprtrdma/transport.c +@@ -576,6 +576,9 @@ xprt_rdma_free(void *buffer) + + rb = container_of(buffer, struct rpcrdma_regbuf, rg_base[0]); + req = rb->rg_owner; ++ if (req->rl_backchannel) ++ return; ++ + r_xprt = container_of(req->rl_buffer, struct rpcrdma_xprt, rx_buf); + + dprintk("RPC: %s: called on 0x%p\n", __func__, req->rl_reply); -- 2.47.3