linux.git/drivers, branch v4.8.11

gpio: pca953x: Fix corruption of other gpios in set_multiple.

2016-11-26T08:56:59+00:00

commit 53f8d322234649b4d6f1515b20c127a577efd164 upstream.

gpiod_set_array_value_complex does not clear the bits field.
Therefore when the drivers set_multiple funciton is called bits outside
the mask are undefined and can be either set or not. So bank_val needs
to be masked with bank_mask before or with the reg_val cache.

Fixes: b4818afeacbd ("gpio: pca953x: Add set_multiple to allow multiple")
Signed-off-by: Phil Reid 
Signed-off-by: Linus Walleij 
Signed-off-by: Greg Kroah-Hartman

gpio: pca953x: Move memcpy into mutex lock for set multiple

2016-11-26T08:56:59+00:00

commit 386377b5473043c09b2de40bfe5abfb0fc87e1b4 upstream.

Need to ensure that reg_output is not updated while setting multiple
bits. This makes the mutex locking behaviour for the set_multiple call
consistent with that of the set_value call.

Fixes: b4818afeacbd ("gpio: pca953x: Add set_multiple to allow multiple")
Signed-off-by: Phil Reid 
Signed-off-by: Linus Walleij 
Signed-off-by: Greg Kroah-Hartman

IB/cm: Mark stale CM id's whenever the mad agent was unregistered

2016-11-26T08:56:58+00:00

commit 9db0ff53cb9b43ed75bacd42a89c1a0ab048b2b0 upstream.

When there is a CM id object that has port assigned to it, it means that
the cm-id asked for the specific port that it should go by it, but if
that port was removed (hot-unplug event) the cm-id was not updated.
In order to fix that the port keeps a list of all the cm-id's that are
planning to go by it, whenever the port is removed it marks all of them
as invalid.

This commit fixes a kernel panic which happens when running traffic between
guests and we force reboot a guest mid traffic, it triggers a kernel panic:

 Call Trace:
  [] ? panic+0xa7/0x16f
  [] ? oops_end+0xe4/0x100
  [] ? no_context+0xfb/0x260
  [] ? del_timer_sync+0x22/0x30
  [] ? __bad_area_nosemaphore+0x125/0x1e0
  [] ? process_timeout+0x0/0x10
  [] ? bad_area_nosemaphore+0x13/0x20
  [] ? __do_page_fault+0x31f/0x480
  [] ? default_wake_function+0x0/0x20
  [] ? free_msg+0x55/0x70 [mlx5_core]
  [] ? cmd_exec+0x124/0x840 [mlx5_core]
  [] ? find_busiest_group+0x244/0x9f0
  [] ? do_page_fault+0x3e/0xa0
  [] ? page_fault+0x25/0x30
  [] ? cm_alloc_msg+0x35/0xc0 [ib_cm]
  [] ? ib_send_cm_dreq+0xb1/0x1e0 [ib_cm]
  [] ? cm_destroy_id+0x176/0x320 [ib_cm]
  [] ? ib_destroy_cm_id+0x10/0x20 [ib_cm]
  [] ? ipoib_cm_free_rx_reap_list+0xa7/0x110 [ib_ipoib]
  [] ? ipoib_cm_rx_reap+0x0/0x20 [ib_ipoib]
  [] ? ipoib_cm_rx_reap+0x15/0x20 [ib_ipoib]
  [] ? worker_thread+0x170/0x2a0
  [] ? autoremove_wake_function+0x0/0x40
  [] ? worker_thread+0x0/0x2a0
  [] ? kthread+0x96/0xa0
  [] ? child_rip+0xa/0x20
  [] ? kthread+0x0/0xa0
  [] ? child_rip+0x0/0x20

Fixes: a977049dacde ("[PATCH] IB: Add the kernel CM implementation")
Signed-off-by: Mark Bloch 
Signed-off-by: Erez Shitrit 
Reviewed-by: Maor Gottlieb 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/uverbs: Fix leak of XRC target QPs

2016-11-26T08:56:58+00:00

commit 5b810a242c28e1d8d64d718cebe75b79d86a0b2d upstream.

The real QP is destroyed in case of the ref count reaches zero, but
for XRC target QPs this call was missed and caused to QP leaks.

Let's call to destroy for all flows.

Fixes: 0e0ec7e0638e ('RDMA/core: Export ib_open_qp() to share XRC...')
Signed-off-by: Tariq Toukan 
Signed-off-by: Noa Osherovich 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/hfi1: Remove incorrect IS_ERR check

2016-11-26T08:56:58+00:00

commit 2b16056f845207967a32497f41cf92b57849f934 upstream.

Remove IS_ERR check from caching code as the function being called does
not actually return error pointers.

Fixes: f19bd643dbde: "IB/hfi1: Prevent NULL pointer deferences in caching code"
Reported-by: Dan Carpenter 
Reviewed-by: Dean Luick 
Signed-off-by: Dennis Dalessandro 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/core: Avoid unsigned int overflow in sg_alloc_table

2016-11-26T08:56:58+00:00

commit 3c7ba5760ab8eedec01159b267bb9bfcffe522ac upstream.

sg_alloc_table gets unsigned int as parameter while the driver
returns it as size_t. Check npages isn't greater than maximum
unsigned int.

Fixes: eeb8461e36c9 ("IB: Refactor umem to use linear SG table")
Signed-off-by: Mark Bloch 
Signed-off-by: Maor Gottlieb 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/mlx5: Fix NULL pointer dereference on debug print

2016-11-26T08:56:58+00:00

commit a1ab8402d15d2305d2315d96ec3294bfdf16587e upstream.

For XRC QP CQs may not exist. Check before attempting dereference.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Eli Cohen 
Signed-off-by: Maor Gottlieb 
Reviewed-by: Yishai Hadas 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/mlx5: Fix fatal error dispatching

2016-11-26T08:56:58+00:00

commit dbaaff2a2caa03d472b5cc53a3fbfd415c97dc26 upstream.

When an internal error condition is detected, make sure to set the
device inactive after dispatching the event so ULPs can get a
notification of this event.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Eli Cohen 
Signed-off-by: Maor Gottlieb 
Reviewed-by: Mohamad Haj Yahia 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/mlx5: Fix memory leak in query device

2016-11-26T08:56:58+00:00

commit 90be7c8ab72853ff9fc407f01518a898df1f3045 upstream.

We need to free dev->port when we fail to enable RoCE or
initialize node data.

Fixes: 0837e86a7a34 ('IB/mlx5: Add per port counters')
Signed-off-by: Majd Dibbiny 
Signed-off-by: Maor Gottlieb 
Reviewed-by: Mark Bloch 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman

IB/mlx5: Use cache line size to select CQE stride

2016-11-26T08:56:58+00:00

commit 16b0e0695a73b68d8ca40288c8f9614ef208917b upstream.

When creating kernel CQs use 128B CQE stride if the
cache line size is 128B, 64B otherwise.  This prevents
multiple CQEs from residing in a 128B cache line,
which can cause retries when there are concurrent
read and writes in one cache line.

Tested with IPoIB on PPC64, saw ~5% throughput
improvement.

Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
Signed-off-by: Daniel Jurgens 
Signed-off-by: Maor Gottlieb 
Signed-off-by: Leon Romanovsky 
Signed-off-by: Doug Ledford 
Signed-off-by: Greg Kroah-Hartman