ARM: dts: msm: move battery node under /vendor for 8996

Move battery nodes under /vendor path. This will help in
overlaying this node from board overlay files.

Change-Id: I152c7c5e36ce7d7ec734ecdf020ddb9855b09221
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>

Merge "asoc: check payload length against structure size"

Merge "ARM: dts: msm: Mount system and vendor for MSM8996"

Merge "defconfig: msm: Enable Verity forward error correction flag"

Merge "usb: misc: Add support for 9902 and 9903 PIDs"

defconfig: msm: Enable Verity forward error correction flag

Enable CONFIG_DM_VERITY_FEC in msm8996 defconfig and perf_defconfig
build. This flag is required when FEC is passed from kernel command
line and adding some more Crypto dependency flags.

Change-Id: I05e37fe1044d130ca0da66395075d7723cf919a2
Signed-off-by: Vagdhan Kanukurthi <vagdhank@codeaurora.org>

Merge "dsp: asm: Add check for num_channels before calling q6asm_map_channels"

Merge "ASoC: msm: Add support for AVS version check"

usb: misc: Add support for 9902 and 9903 PIDs

Add support for creation of misc device, diag and IPC
traffic channels, when the connected device has 0x05C6
VID and 0x9902 or 0x9903 PID.
   0x9902 : WLAN + QMI + DIAG + Sahara
   0x9903 : BT ACL + BT SCO + WLAN + QMI + DIAG + Sahara

Change-Id: I7fa081abbb8860ff4d4c802522d4eb77cf573a18
Signed-off-by: Ajay Agarwal <ajaya@codeaurora.org>

dsp: asm: Add check for num_channels before calling q6asm_map_channels

Channel_mapping array size varies for different commands.
Add check for num_channels before calling q6asm_map_channels.

Change-Id: Iccbcfe82f716fc0ffe0a26b1779dcaa1c3cb805b
Signed-off-by: Rohit kumar <rohitkr@codeaurora.org>

ASoC: msm: Add support for AVS version check

Updating pcm and compress driver to use asm read and write
apis based on AVS version.

Change-Id: Iec75114fed3a18f054074348d060726f013359cd
Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>
Signed-off-by: Soumya Managoli <smanag@codeaurora.org>

Merge "power: qpnp-smb2: Reverse the sign of CURRENT_NOW"

power: qpnp-smb2: Reverse the sign of CURRENT_NOW

Userspace expects CURRENT_NOW to report positive value
when battery is charging and negative during discharge.

Change-Id: I3490ab34699035aea986910683e3244350def73e
Signed-off-by: Kavya Nunna <knunna@codeaurora.org>

ASoC: msm: qdsp6v2: Add support to query adsp version

Q6 core service provides API to query ADSP version.
Update the apr with get()/set() to use this adsp version
by platform/machine drivers.

Signed-off-by: Surendar karka <sukark@codeaurora.org>
Change-Id: I2466f4eba636ce41e5eb9a75e2e5e75a069fd0ee
Signed-off-by: Dhanalakshmi Siddani <dsiddani@codeaurora.org>

Merge "msm: ipa3: Fix to validate the buffer size"

Merge "ARM: dts: msm: Add glink_pkt devices for MSM8996"

Merge "cnss2: Disable PCIe bus master bit before save config space"

Merge "Documentation: bindings: Add node details for VB"

Merge "defconfig: msm: Enable SDCARDFS filesystem for msm8996"

Merge "defconfig: arm64: msm: Enable Security configurations"

Merge "iommu: iommu-debug: don't pass null character to copy_to_user"

Merge "ARM: dts: msm: Changes for PMIC support for 8996 on 4.4 kernel"

Merge "defconfig: Enable LEDS_QPNP_HAPTICS"

ARM: dts: msm: Changes for PMIC support for 8996 on 4.4 kernel

Appropriate changes for charger, fuel-gauge, haptics, leds and
regulator nodes have been done to support these PMIC modules
for MSM8996 on 4.4 kernel.

Change-Id: Iecd86d6da3661246cc100afa4e9f9c56703b6ace
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

defconfig: Enable LEDS_QPNP_HAPTICS

Enable the config CONFIG_LEDS_QPNP_HAPTICS.

Change-Id: Ic3c10b64cb88c90fd59f5a6dfdfd033dfc974a2c
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

drivers: qpnp-smbcharger.c : Bring in from 4.9

Bring in the qpnp-smbcharger.c file from 4.9 kernel to 4.4 kernel
branch.

Change-Id: I2ee8342a034e77b67b2c2a3851b2babb67081551
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

power: power_supply: Add property to limit pulses for HVDCP

Use the property POWER_SUPPLY_PROP_MAX_PULSE_ALLOWED to
specify the maximum pulses which can be supported for
HVDCP3. This is used to limit the VBUS to a max value.

CRs-Fixed: 1047232
Change-Id: I85677ba574ff3da2a38e06a2f25a43e80ae150d6
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
Signed-off-by: Vamshi Krishna B V <vbv@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

power_supply: add support to control hvdcp3 detection

Currently, HVDCP3 detection is enabled by default. Add support
to control it dynamically through a power supply property
"allow_hvdcp3".

CRs-Fixed: 991060
Change-Id: Id283b572cdb51094ad53d590e230104dc3e1beb7
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

leds: qpnp-haptics: Update auto mode configuration

Based on the hardware recommendation, update the LRA auto mode
configuration.

Change-Id: I23e1fe0a232db1759294fc061fa8a08f2d3ae13f
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

regulator: qpnp-labibb: Don't handle LAB_VREG_OK in TTW mode for pmi8998

Currently for pmi8998, LAB_VREG_OK interrupt is handled to switch
from PWM to PFM mode after a certain delay to improve efficiency.
Also, PFM mode is kept disabled once the regulator is disabled.
As per the hardware recommendation, keeping LAB in PWM mode is
sufficient in particular when TTW mode is enabled. Hence do not
register for LAB_VREG_OK interrupt in TTW mode so that this
PWM <-> PFM mode transition will not be done.

CRs-Fixed: 2179209
Change-Id: I499740d014a45e02b802d350248f8044a5b6596b
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

regulator: qpnp-labibb: Add sysfs class to enable/disable the irq

LAB/IBB interrupts need to be disabled and enabled during the entry and
exit of the secure display use case respectively. Add sysfs property
to allow the userspace to perform this operation

To disable the interrupts:
 echo 1 > /sys/class/lcd_bias/secure_mode

To enable the interrupts:
 echo 0 > /sys/class/lcd_bias/secure_mode

Change-Id: Iddd5630c0ff6d3191f2cc0d45bd4e72b938728b0
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

regulator: qpnp-labibb: add TTW support for pmi8998

Add Tap To Wake (TTW) support for pmi8998 with the required
configuration per the hardware documentation.

CRs-Fixed: 2112943
Change-Id: Id733e16108d98efc6614e0f9eed3e11f677855e0
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

drivers: leds-qpnp-flash: fix issues raised by static analyser

Fix the below mentioned issues raised by static analyser:
1. use of uninitialized values in the function.
a) 'root' may be uninitialized when it reaches line:2599. Hence,
modify the error path accordingly.
b) 'j' may be uninitialized when it reaches the for loop in line:
2593 and may hold garbage value due to which the condition in the
for loop may become true and this may lead to erroneous results.
Hence, initialize it to -1 so that the error path will be handled
correctly.
2. Comparison of unsigned value against 0 is always false.

CRs-fixed: 2206448
Change-Id: I56950779d221acf3572cba70a64874299f127004
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

leds: qpnp-flash: Introduce a function pointer for qpnp_flash_led_prepare

Introduce a function pointer to avoid the compilation error
due the same function name used in the legacy and v2 flash
drivers. These two drivers need to be enabled in a single
defconfig that supports multiple hardware platforms to achieve
the binary compatibility.

Change-Id: I1ded3d4d9013c6f7f56e0a8952f4b45d20b07326
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

leds: qpnp-flash: Add snapshot of leds-qpnp-flash driver

This is snapshot of the leds-qpnp-flash driver as of msm-4.4
'commit d851b0621739 ("leds: qpnp-flash: Fix Use-after-free(UAF)
for debugfs")'.

Change-Id: I9753ab4e0fee03a957960003efc2941bc48616ac
Signed-off-by: Kiran Gunda <kgunda@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

msm: qpnp-haptic: Force disable haptics during shutdown

Force disable haptics during shutdown to avoid the device
from vibrating during TWM entry.

Change-Id: I6bfdf4d9a634dec1aa56a1fdc5553cefe4a94a73
Signed-off-by: Anirudh Ghayal <aghayal@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

leds: qpnp-haptic: Manage the state of PON regulator

Control the PON regulator (required to force MBG_ON) based on
the current state of haptic and maintain the regulator state
to avoid frequent enable/disable.

CRs-Fixed: 1111145
Change-Id: I7e5656808b04a52fe3cfd57ab0d23a8e4e0db5f2
Signed-off-by: Vamshi Krishna B V <vbv@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

leds: qpnp-haptics: Allow duration for buffer mode

Currently, duration is not allowed to be set while playing the
pattern in buffer mode. This works fine. However when playing
multiple sample sets, the last sample set might be stopped early
as the play interrupt fires immediately after configuring the
new sample set. Fix this by calculating the duration based on the
wave samples configured and the play rate.

Change-Id: I67b1741d435e07bf7332f7e36231fefa9129a9a6
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

drivers: fix 32bit compilation for QPNP drivers

Use div_s64() for signed 64bit division with 32bit divider
and div64_s64() for signed 64bit division with 64bit divider.

CRs-Fixed: 2170745
Change-Id: I1dcf9e83ba492559df2a8b6be9484196f53d6193
Signed-off-by: Tirupathi Reddy <tirupath@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

leds: qpnp-haptics: Add haptics driver

Existing haptics driver is coupled with timed_output class driver
which was existing under staging/android. Since the vibrator HAL
in AOSP had been modified to support vibrator device under LED
class and also the timed_output class driver had been dropped in
newer kernel versions, create a new haptics driver that registers
with LED class framework.

As before, haptics module supports multiple play modes, direct,
buffer, audio and PWM. It supports different actuators, ERM and
LRA.

Driver supports to play multiple set of wave samples (upto 32)
in buffer mode which can be configured by the user instead of
just based on the duration.

For example, to enable haptics for 30 ms,

echo 30 > /sys/class/leds/vibrator/duration
echo 1 > /sys/class/leds/vibrator/activate

Change-Id: I250089212c5da403531ae012c6e48e58bb1d18b3
Signed-off-by: Subbaraman Narayanamurthy <subbaram@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

power: qpnp-fg: Add snapshot of the FG driver

This is the snapshot of the fg driver as of msm-3.18 kernel
'commit d03fafd27cf9 ("qpnp-fg: fix integer overflow")'

Fix compilation errors on msm-4.9 by replacing deprecated
do_div() calls and replace spmi_dev with pdev.

Also fix checkpatch errors.

CRs-Fixed: 2246295
Change-Id: I8f946c8919321b9f0df2bc570dd191904f690dd7
Signed-off-by: Vamshi Krishna B V <vbv@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

msm: vidc: ensure codec count is in supported session range

Ensure the count of supported encoder and decoder returned
from firmware are within the range of supported sessions.

Change-Id: If3eae7bc82dc8302444e2e4104fb6ae3cfbfed5a
Signed-off-by: Dikshita Agarwal <dikshita@codeaurora.org>

iommu: iommu-debug: don't pass null character to copy_to_user

Doing a cat on pte,test_virt_addr from adb shell prints a null
character as well which is at the end of the string this is not
required so, don't pass this null character to copy_to_user.

Change-Id: I8d9120f64d1df84a704379eb00bd239fc7059e9e
Signed-off-by: Vijayanand Jitta <vjitta@codeaurora.org>

defconfig: msm: Enable SDCARDFS filesystem for msm8996

This enables SDCARDFS filesystem for msm8996.

Change-Id: I305a7c2ad76b7727b49d722557154be68bdb958e
Signed-off-by: Swetha Chikkaboraiah <schikk@codeaurora.org>

msm: ipa3: Fix to validate the buffer size

Adding code changes to validate buffer size.
While calling ipa_read verifying the kernel buffer
size in range or not.

Change-Id: I5c9a908b0500a5f0148ec7764425897570bdd713
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>

ARM: dts: msm: Add glink_pkt devices for MSM8996

Glink_pkt devices expose access to certain
SMD resources to userspace.

Change-Id: Iac2b24cec7f9c150a851f3574400615c467a5e2b
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

defconfig: arm64: msm: Enable Security configurations

Enabled following Security configs.
1. CONFIG_ARM64_PAN
2. CONFIG_CC_STACKPROTECTOR_STRONG.

Change-Id: Iddc1303e67b2c5f50c8bd8d4b381736581b21730
Signed-off-by: Venkata Rao Kakani <vkakani@codeaurora.org>

Merge "Merge android-4.4.174 (62872f9) into msm-4.4"

Merge "Merge android-4.4.173 (64b5644) into msm-4.4"

Merge "drm/msm/sde: set correct timeline at fence create"

cnss2: Disable PCIe bus master bit before save config space

There may be a issue if save PCIe config space with bus master
enabled. During resume, since the bit will be restored first,
device will think master is ready and then trigger MSI for some
events, but actually MSI config has not been restored yet which
will mask the MSI. To avoid this, clear the bus master bit before
save config space and the bit will be enabled at a later time.

Change-Id: I75b993dda602ab94da37e108f07dd0f996e1a071
Signed-off-by: Nirav Shah <nnshah@codeaurora.org>

Merge "cnss2: Provide sysfs control for vdd-wlan-en"

Merge "cnss2: Add support for bdf filename with bin prefix"

ARM: dts: msm: Mount system and vendor for MSM8996

Add avb flag when mounting vendor images for non-multislot.
When multislot is disabled system is not the root folder
hence early mounting to be done using dtsi.

Change-Id: Ib74874a07139f949c4592fd99b578c251da6cb5c
Signed-off-by: Monika Singh <monising@codeaurora.org>

Documentation: bindings: Add node details for VB

Add reference for Verified boot node to support
system properties.

Change-Id: Ibef29e92ded50ec34c1fb88a2c81d216b29f3c0f
Signed-off-by: Monika Singh <monising@codeaurora.org>

Merge "soc: qcom: Validate read and write index before calculating ptr"

Merge "msm: vidc: Ensure validity of shared Q indices"

Merge "msm: ekms: Change eDRM display in device tree"

cnss2: Provide sysfs control for vdd-wlan-en

For qcn7605 USB, firmware download and error
recovery are handled by entities in userspace.
cnss needs to provide access vdd-wlan-en to
the kickstart userspace via sysfs

Change-Id: I53da7f2f7ebb2ec55f98fc328a550181dccb5a18
Signed-off-by: Rajasekaran Kalidoss <rkalidos@codeaurora.org>

asoc: check payload length against structure size

Payload length must exceed structure size. Otherwise, it may
lead to out-of-boundary memory access.

Change-Id: I090de5116ab04a4ca2b9c485e17617fe9e861ad5
Signed-off-by: Xiaojun Sang <xsang@codeaurora.org>

Merge "msm: ipa: Fix to validate the buffer size"

Merge "msm: ice: check for crypto engine availability"

msm: ekms: Change eDRM display in device tree

Customer platform need eDRM running on HDMI.  Change DTSI setting to
default eDRM display to HDMI interface.

Change-Id: I6a319d1f5d0eea9e28e678c5e543496ee1c82029
Signed-off-by: Camus Wong <camusw@codeaurora.org>

Merge android-4.4.174 (62872f9) into msm-4.4

* refs/heads/tmp-62872f9
  Linux 4.4.174
  rcu: Force boolean subscript for expedited stall warnings
  net: ipv4: do not handle duplicate fragments as overlapping
  net: fix pskb_trim_rcsum_slow() with odd trim offset
  inet: frags: better deal with smp races
  ipv4: frags: precedence bug in ip_expire()
  ip: frags: fix crash in ip_do_fragment()
  ip: process in-order fragments efficiently
  ip: add helpers to process in-order fragments faster.
  ip: use rb trees for IP frag queue.
  net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends
  ipv6: defrag: drop non-last frags smaller than min mtu
  net: modify skb_rbtree_purge to return the truesize of all purged skbs.
  ip: discard IPv4 datagrams with overlapping segments.
  inet: frags: fix ip6frag_low_thresh boundary
  inet: frags: get rid of ipfrag_skb_cb/FRAG_CB
  inet: frags: reorganize struct netns_frags
  rhashtable: reorganize struct rhashtable layout
  ipv6: frags: rewrite ip6_expire_frag_queue()
  inet: frags: do not clone skb in ip_expire()
  inet: frags: break the 2GB limit for frags storage
  inet: frags: remove inet_frag_maybe_warn_overflow()
  inet: frags: get rif of inet_frag_evicting()
  inet: frags: remove some helpers
  ipfrag: really prevent allocation on netns exit
  net: ieee802154: 6lowpan: fix frag reassembly
  inet: frags: use rhashtables for reassembly units
  rhashtable: add schedule points
  rhashtable: Add rhashtable_lookup()
  rhashtable: add rhashtable_lookup_get_insert_key()
  inet: frags: refactor lowpan_net_frag_init()
  inet: frags: refactor ipv6_frag_init()
  inet: frags: refactor ipfrag_init()
  inet: frags: add a pointer to struct netns_frags
  inet: frags: change inet_frags_init_net() return value

Change-Id: I1f6e2fd6f7960509fa52b726458c74c9fb070b5b
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

msm: ipa: Fix to validate the buffer size

Adding code changes to validate buffer size.
While calling ipa_read verifying the kernel buffer
size in range or not.

Change-Id: Idc608c2cf0587a00f19ece38a4eb646f7fde68e3
Signed-off-by: Praveen Kurapati <pkurapat@codeaurora.org>

cnss2: Add support for bdf filename with bin prefix

Add support for bdf filename with the prefix suitable for
binary format.

Change-Id: I24cc19b24ab084a754ba28eb8b2fa459189990d9
Signed-off-by: Jayachandran Sreekumaran <jsreekum@codeaurora.org>

power: supply: Add battery info, jeita detection support

Add battery info, jeita detection and negative isense
properties to the power supply framework.

Crs-Fixed: 2246295
Change-Id: I7c8a107903160ef482f4b23c351f3c02892c6e7e
Signed-off-by: Vamshi Krishna B V <vbv@codeaurora.org>
Signed-off-by: Shilpa Suresh <sbsure@codeaurora.org>

msm: vidc: Ensure validity of shared Q indices

Video driver and firmware communicates over shared queue.
The queue header has the indices which synchronizes the read
and write between the driver and firmware modules.
This change ensures that the indices are within the valid
range before accessing them.

CRs-fixed: 2345481
Change-Id: I8da6bb4218a5b8ec0e2e2c7b87f6cc9eec21bd16
Signed-off-by: Vikash Garodia <vgarodia@codeaurora.org>
Signed-off-by: Paras Nagda <pnagda@codeaurora.org>

Merge 4.4.174 into android-4.4

Changes in 4.4.174
inet: frags: change inet_frags_init_net() return value
inet: frags: add a pointer to struct netns_frags
inet: frags: refactor ipfrag_init()
inet: frags: refactor ipv6_frag_init()
inet: frags: refactor lowpan_net_frag_init()
rhashtable: add rhashtable_lookup_get_insert_key()
rhashtable: Add rhashtable_lookup()
rhashtable: add schedule points
inet: frags: use rhashtables for reassembly units
net: ieee802154: 6lowpan: fix frag reassembly
ipfrag: really prevent allocation on netns exit
inet: frags: remove some helpers
inet: frags: get rif of inet_frag_evicting()
inet: frags: remove inet_frag_maybe_warn_overflow()
inet: frags: break the 2GB limit for frags storage
inet: frags: do not clone skb in ip_expire()
ipv6: frags: rewrite ip6_expire_frag_queue()
rhashtable: reorganize struct rhashtable layout
inet: frags: reorganize struct netns_frags
inet: frags: get rid of ipfrag_skb_cb/FRAG_CB
inet: frags: fix ip6frag_low_thresh boundary
ip: discard IPv4 datagrams with overlapping segments.
net: modify skb_rbtree_purge to return the truesize of all purged skbs.
ipv6: defrag: drop non-last frags smaller than min mtu
net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends
ip: use rb trees for IP frag queue.
ip: add helpers to process in-order fragments faster.
ip: process in-order fragments efficiently
ip: frags: fix crash in ip_do_fragment()
ipv4: frags: precedence bug in ip_expire()
inet: frags: better deal with smp races
net: fix pskb_trim_rcsum_slow() with odd trim offset
net: ipv4: do not handle duplicate fragments as overlapping
rcu: Force boolean subscript for expedited stall warnings
Linux 4.4.174

Change-Id: I47eace4f47ffe0bf16b29615d09ed903c40a272b
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

Linux 4.4.174

rcu: Force boolean subscript for expedited stall warnings

commit ec3833ed02ae6ef2a933ece9de7cbab0c64c699e upstream.

The cpu_online() function can return values other than 0 and 1, which
can result in subscript overflow when applied to a two-element array.
This commit allows for this behavior by using "!!" on the return value
from cpu_online() when used as a subscript.

Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Cc: "Rantala, Tommi" <tommi.t.rantala@nokia.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ipv4: do not handle duplicate fragments as overlapping

commit ade446403bfb79d3528d56071a84b15351a139ad upstream.

Since commit 7969e5c40dfd ("ip: discard IPv4 datagrams with overlapping
segments.") IPv4 reassembly code drops the whole queue whenever an
overlapping fragment is received. However, the test is written in a way
which detects duplicate fragments as overlapping so that in environments
with many duplicate packets, fragmented packets may be undeliverable.

Add an extra test and for (potentially) duplicate fragment, only drop the
new fragment rather than the whole queue. Only starting offset and length
are checked, not the contents of the fragments as that would be too
expensive. For similar reason, linear list ("run") of a rbtree node is not
iterated, we only check if the new fragment is a subset of the interval
covered by existing consecutive fragments.

v2: instead of an exact check iterating through linear list of an rbtree
node, only check if the new fragment is subset of the "run" (suggested
by Eric Dumazet)

Fixes: 7969e5c40dfd ("ip: discard IPv4 datagrams with overlapping segments.")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
[bwh: Backported to 4.4:
 - goto discard_qp, not err, in case of overlap
 - Set err earlier variable, as done upstream in commit 0ff89efb5246
   "ip: fail fast on IP defrag errors"]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: fix pskb_trim_rcsum_slow() with odd trim offset

commit d55bef5059dd057bd077155375c581b49d25be7e upstream.

We've been getting checksum errors involving small UDP packets, usually
59B packets with 1 extra non-zero padding byte. netdev_rx_csum_fault()
has been complaining that HW is providing bad checksums. Turns out the
problem is in pskb_trim_rcsum_slow(), introduced in commit 88078d98d1bb
("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends").

The source of the problem is that when the bytes we are trimming start
at an odd address, as in the case of the 1 padding byte above,
skb_checksum() returns a byte-swapped value. We cannot just combine this
with skb->csum using csum_sub(). We need to use csum_block_sub() here
that takes into account the parity of the start address and handles the
swapping.

Matches existing code in __skb_postpull_rcsum() and esp_remove_trailer().

Fixes: 88078d98d1bb ("net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends")
Signed-off-by: Dimitris Michailidis <dmichail@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: better deal with smp races

commit 0d5b9311baf27bb545f187f12ecfd558220c607d upstream.

Multiple cpus might attempt to insert a new fragment in rhashtable,
if for example RPS is buggy, as reported by 배석진 in
https://patchwork.ozlabs.org/patch/994601/

We use rhashtable_lookup_get_insert_key() instead of
rhashtable_insert_fast() to let cpus losing the race
free their own inet_frag_queue and use the one that
was inserted by another cpu.

Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: 배석진 <soukjin.bae@samsung.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipv4: frags: precedence bug in ip_expire()

commit 70837ffe3085c9a91488b52ca13ac84424da1042 upstream.

We accidentally removed the parentheses here, but they are required
because '!' has higher precedence than '&'.

Fixes: fa0f527358bd ("ip: use rb trees for IP frag queue.")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ip: frags: fix crash in ip_do_fragment()

commit 5d407b071dc369c26a38398326ee2be53651cfe4 upstream.

A kernel crash occurrs when defragmented packet is fragmented
in ip_do_fragment().
In defragment routine, skb_orphan() is called and
skb->ip_defrag_offset is set. but skb->sk and
skb->ip_defrag_offset are same union member. so that
frag->sk is not NULL.
Hence crash occurrs in skb->sk check routine in ip_do_fragment() when
defragmented packet is fragmented.

test commands:
   %iptables -t nat -I POSTROUTING -j MASQUERADE
   %hping3 192.168.4.2 -s 1000 -p 2000 -d 60000

splat looks like:
[  261.069429] kernel BUG at net/ipv4/ip_output.c:636!
[  261.075753] invalid opcode: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[  261.083854] CPU: 1 PID: 1349 Comm: hping3 Not tainted 4.19.0-rc2+ #3
[  261.100977] RIP: 0010:ip_do_fragment+0x1613/0x2600
[  261.106945] Code: e8 e2 38 e3 fe 4c 8b 44 24 18 48 8b 74 24 08 e9 92 f6 ff ff 80 3c 02 00 0f 85 da 07 00 00 48 8b b5 d0 00 00 00 e9 25 f6 ff ff <0f> 0b 0f 0b 44 8b 54 24 58 4c 8b 4c 24 18 4c 8b 5c 24 60 4c 8b 6c
[  261.127015] RSP: 0018:ffff8801031cf2c0 EFLAGS: 00010202
[  261.134156] RAX: 1ffff1002297537b RBX: ffffed0020639e6e RCX: 0000000000000004
[  261.142156] RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff880114ba9bd8
[  261.150157] RBP: ffff880114ba8a40 R08: ffffed0022975395 R09: ffffed0022975395
[  261.158157] R10: 0000000000000001 R11: ffffed0022975394 R12: ffff880114ba9ca4
[  261.166159] R13: 0000000000000010 R14: ffff880114ba9bc0 R15: dffffc0000000000
[  261.174169] FS:  00007fbae2199700(0000) GS:ffff88011b400000(0000) knlGS:0000000000000000
[  261.183012] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  261.189013] CR2: 00005579244fe000 CR3: 0000000119bf4000 CR4: 00000000001006e0
[  261.198158] Call Trace:
[  261.199018]  ? dst_output+0x180/0x180
[  261.205011]  ? save_trace+0x300/0x300
[  261.209018]  ? ip_copy_metadata+0xb00/0xb00
[  261.213034]  ? sched_clock_local+0xd4/0x140
[  261.218158]  ? kill_l4proto+0x120/0x120 [nf_conntrack]
[  261.223014]  ? rt_cpu_seq_stop+0x10/0x10
[  261.227014]  ? find_held_lock+0x39/0x1c0
[  261.233008]  ip_finish_output+0x51d/0xb50
[  261.237006]  ? ip_fragment.constprop.56+0x220/0x220
[  261.243011]  ? nf_ct_l4proto_register_one+0x5b0/0x5b0 [nf_conntrack]
[  261.250152]  ? rcu_is_watching+0x77/0x120
[  261.255010]  ? nf_nat_ipv4_out+0x1e/0x2b0 [nf_nat_ipv4]
[  261.261033]  ? nf_hook_slow+0xb1/0x160
[  261.265007]  ip_output+0x1c7/0x710
[  261.269005]  ? ip_mc_output+0x13f0/0x13f0
[  261.273002]  ? __local_bh_enable_ip+0xe9/0x1b0
[  261.278152]  ? ip_fragment.constprop.56+0x220/0x220
[  261.282996]  ? nf_hook_slow+0xb1/0x160
[  261.287007]  raw_sendmsg+0x21f9/0x4420
[  261.291008]  ? dst_output+0x180/0x180
[  261.297003]  ? sched_clock_cpu+0x126/0x170
[  261.301003]  ? find_held_lock+0x39/0x1c0
[  261.306155]  ? stop_critical_timings+0x420/0x420
[  261.311004]  ? check_flags.part.36+0x450/0x450
[  261.315005]  ? _raw_spin_unlock_irq+0x29/0x40
[  261.320995]  ? _raw_spin_unlock_irq+0x29/0x40
[  261.326142]  ? cyc2ns_read_end+0x10/0x10
[  261.330139]  ? raw_bind+0x280/0x280
[  261.334138]  ? sched_clock_cpu+0x126/0x170
[  261.338995]  ? check_flags.part.36+0x450/0x450
[  261.342991]  ? __lock_acquire+0x4500/0x4500
[  261.348994]  ? inet_sendmsg+0x11c/0x500
[  261.352989]  ? dst_output+0x180/0x180
[  261.357012]  inet_sendmsg+0x11c/0x500
[ ... ]

v2:
 - clear skb->sk at reassembly routine.(Eric Dumarzet)

Fixes: fa0f527358bd ("ip: use rb trees for IP frag queue.")
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ip: process in-order fragments efficiently

commit a4fd284a1f8fd4b6c59aa59db2185b1e17c5c11c upstream.

This patch changes the runtime behavior of IP defrag queue:
incoming in-order fragments are added to the end of the current
list/"run" of in-order fragments at the tail.

On some workloads, UDP stream performance is substantially improved:

RX: ./udp_stream -F 10 -T 2 -l 60
TX: ./udp_stream -c -H <host> -F 10 -T 5 -l 60

with this patchset applied on a 10Gbps receiver:

  throughput=9524.18
  throughput_units=Mbit/s

upstream (net-next):

  throughput=4608.93
  throughput_units=Mbit/s

Reported-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Peter Oskolkov <posk@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ip: add helpers to process in-order fragments faster.

commit 353c9cb360874e737fb000545f783df756c06f9a upstream.

This patch introduces several helper functions/macros that will be
used in the follow-up patch. No runtime changes yet.

The new logic (fully implemented in the second patch) is as follows:

* Nodes in the rb-tree will now contain not single fragments, but lists
  of consecutive fragments ("runs").

* At each point in time, the current "active" run at the tail is
  maintained/tracked. Fragments that arrive in-order, adjacent
  to the previous tail fragment, are added to this tail run without
  triggering the re-balancing of the rb-tree.

* If a fragment arrives out of order with the offset _before_ the tail run,
  it is inserted into the rb-tree as a single fragment.

* If a fragment arrives after the current tail fragment (with a gap),
  it starts a new "tail" run, as is inserted into the rb-tree
  at the end as the head of the new run.

skb->cb is used to store additional information
needed here (suggested by Eric Dumazet).

Reported-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Peter Oskolkov <posk@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ip: use rb trees for IP frag queue.

commit fa0f527358bd900ef92f925878ed6bfbd51305cc upstream.

Similar to TCP OOO RX queue, it makes sense to use rb trees to store
IP fragments, so that OOO fragments are inserted faster.

Tested:

- a follow-up patch contains a rather comprehensive ip defrag
  self-test (functional)
- ran neper `udp_stream -c -H <host> -F 100 -l 300 -T 20`:
    netstat --statistics
    Ip:
        282078937 total packets received
        0 forwarded
        0 incoming packets discarded
        946760 incoming packets delivered
        18743456 requests sent out
        101 fragments dropped after timeout
        282077129 reassemblies required
        944952 packets reassembled ok
        262734239 packet reassembles failed
   (The numbers/stats above are somewhat better re:
    reassemblies vs a kernel without this patchset. More
    comprehensive performance testing TBD).

Reported-by: Jann Horn <jannh@google.com>
Reported-by: Juha-Matti Tilli <juha-matti.tilli@iki.fi>
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Peter Oskolkov <posk@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
[bwh: Backported to 4.4:
 - Keep using frag_kfree_skb() in inet_frag_destroy()
 - Adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: pskb_trim_rcsum() and CHECKSUM_COMPLETE are friends

commit 88078d98d1bb085d72af8437707279e203524fa5 upstream.

After working on IP defragmentation lately, I found that some large
packets defeat CHECKSUM_COMPLETE optimization because of NIC adding
zero paddings on the last (small) fragment.

While removing the padding with pskb_trim_rcsum(), we set skb->ip_summed
to CHECKSUM_NONE, forcing a full csum validation, even if all prior
fragments had CHECKSUM_COMPLETE set.

We can instead compute the checksum of the part we are trimming,
usually smaller than the part we keep.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipv6: defrag: drop non-last frags smaller than min mtu

commit 0ed4229b08c13c84a3c301a08defdc9e7f4467e6 upstream.

don't bother with pathological cases, they only waste cycles.
IPv6 requires a minimum MTU of 1280 so we should never see fragments
smaller than this (except last frag).

v3: don't use awkward "-offset + len"
v2: drop IPv4 part, which added same check w. IPV4_MIN_MTU (68).
    There were concerns that there could be even smaller frags
    generated by intermediate nodes, e.g. on radio networks.

Cc: Peter Oskolkov <posk@google.com>
Cc: Eric Dumazet <edumazet@google.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
[bwh: Backported to 4.4: In nf_ct_frag6_gather() use clone instead of skb,
 and goto ret_orig in case of error]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: modify skb_rbtree_purge to return the truesize of all purged skbs.

commit 385114dec8a49b5e5945e77ba7de6356106713f4 upstream.

Tested: see the next patch is the series.

Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Peter Oskolkov <posk@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ip: discard IPv4 datagrams with overlapping segments.

commit 7969e5c40dfd04799d4341f1b7cd266b6e47f227 upstream.

This behavior is required in IPv6, and there is little need
to tolerate overlapping fragments in IPv4. This change
simplifies the code and eliminates potential DDoS attack vectors.

Tested: ran ip_defrag selftest (not yet available uptream).

Suggested-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Peter Oskolkov <posk@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Florian Westphal <fw@strlen.de>
Acked-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
[bwh: Backported to 4.4:
 - s/__IP_INC_STATS/IP_INC_STATS_BH/
 - Deleted code is slightly different]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: fix ip6frag_low_thresh boundary

commit 3d23401283e80ceb03f765842787e0e79ff598b7 upstream.

Giving an integer to proc_doulongvec_minmax() is dangerous on 64bit arches,
since linker might place next to it a non zero value preventing a change
to ip6frag_low_thresh.

ip6frag_low_thresh is not used anymore in the kernel, but we do not
want to prematuraly break user scripts wanting to change it.

Since specifying a minimal value of 0 for proc_doulongvec_minmax()
is moot, let's remove these zero values in all defrag units.

Fixes: 6e00f7dd5e4e ("ipv6: frags: fix /proc/sys/net/ipv6/ip6frag_low_thresh")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Maciej Żenczykowski <maze@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: get rid of ipfrag_skb_cb/FRAG_CB

commit bf66337140c64c27fa37222b7abca7e49d63fb57 upstream.

ip_defrag uses skb->cb[] to store the fragment offset, and unfortunately
this integer is currently in a different cache line than skb->next,
meaning that we use two cache lines per skb when finding the insertion point.

By aliasing skb->ip_defrag_offset and skb->dev, we pack all the fields
in a single cache line and save precious memory bandwidth.

Note that after the fast path added by Changli Gao in commit
d6bebca92c66 ("fragment: add fast path for in-order fragments")
this change wont help the fast path, since we still need
to access prev->len (2nd cache line), but will show great
benefits when slow path is entered, since we perform
a linear scan of a potentially long list.

Also, note that this potential long list is an attack vector,
we might consider also using an rb-tree there eventually.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: reorganize struct netns_frags

commit c2615cf5a761b32bf74e85bddc223dfff3d9b9f0 upstream.

Put the read-mostly fields in a separate cache line
at the beginning of struct netns_frags, to reduce
false sharing noticed in inet_frag_kill()

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 4.4: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rhashtable: reorganize struct rhashtable layout

commit e5d672a0780d9e7118caad4c171ec88b8299398d upstream.

While under frags DDOS I noticed unfortunate false sharing between
@nelems and @params.automatic_shrinking

Move @nelems at the end of struct rhashtable so that first cache line
is shared between all cpus, because almost never dirtied.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipv6: frags: rewrite ip6_expire_frag_queue()

commit 05c0b86b9696802fd0ce5676a92a63f1b455bdf3 upstream.

Make it similar to IPv4 ip_expire(), and release the lock
before calling icmp functions.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 4.4: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: do not clone skb in ip_expire()

commit 1eec5d5670084ee644597bd26c25e22c69b9f748 upstream.

An skb_clone() was added in commit ec4fbd64751d ("inet: frag: release
spinlock before calling icmp_send()")

While fixing the bug at that time, it also added a very high cost
for DDOS frags, as the ICMP rate limit is applied after this
expensive operation (skb_clone() + consume_skb(), implying memory
allocations, copy, and freeing)

We can use skb_get(head) here, all we want is to make sure skb wont
be freed by another cpu.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: break the 2GB limit for frags storage

commit 3e67f106f619dcfaf6f4e2039599bdb69848c714 upstream.

Some users are willing to provision huge amounts of memory to be able
to perform reassembly reasonnably well under pressure.

Current memory tracking is using one atomic_t and integers.

Switch to atomic_long_t so that 64bit arches can use more than 2GB,
without any cost for 32bit arches.

Note that this patch avoids an overflow error, if high_thresh was set
to ~2GB, since this test in inet_frag_alloc() was never true :

if (... || frag_mem_limit(nf) > nf->high_thresh)

Tested:

$ echo 16000000000 >/proc/sys/net/ipv4/ipfrag_high_thresh

<frag DDOS>

$ grep FRAG /proc/net/sockstat
FRAG: inuse 14705885 memory 16000002880

$ nstat -n ; sleep 1 ; nstat | grep Reas
IpReasmReqds                    3317150            0.0
IpReasmFails                    3317112            0.0

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: remove inet_frag_maybe_warn_overflow()

commit 2d44ed22e607f9a285b049de2263e3840673a260 upstream.

This function is obsolete, after rhashtable addition to inet defrag.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: get rif of inet_frag_evicting()

commit 399d1404be660d355192ff4df5ccc3f4159ec1e4 upstream.

This refactors ip_expire() since one indentation level is removed.

Note: in the future, we should try hard to avoid the skb_clone()
since this is a serious performance cost.
Under DDOS, the ICMP message wont be sent because of rate limits.

Fact that ip6_expire_frag_queue() does not use skb_clone() is
disturbing too. Presumably IPv6 should have the same
issue than the one we fixed in commit ec4fbd64751d
("inet: frag: release spinlock before calling icmp_send()")

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Mao Wenan <maowenan@huawei.com>
[bwh: Backported to 4.4: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: remove some helpers

commit 6befe4a78b1553edb6eed3a78b4bcd9748526672 upstream.

Remove sum_frag_mem_limit(), ip_frag_mem() & ip6_frag_mem()

Also since we use rhashtable we can bring back the number of fragments
in "grep FRAG /proc/net/sockstat /proc/net/sockstat6" that was
removed in commit 434d305405ab ("inet: frag: don't account number
of fragment queues")

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipfrag: really prevent allocation on netns exit

commit f6f2a4a2eb92bc73671204198bb2f8ab53ff59fb upstream.

Setting the low threshold to 0 has no effect on frags allocation,
we need to clear high_thresh instead.

The code was pre-existent to commit 648700f76b03 ("inet: frags:
use rhashtables for reassembly units"), but before the above,
such assignment had a different role: prevent concurrent eviction
from the worker and the netns cleanup helper.

Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

net: ieee802154: 6lowpan: fix frag reassembly

commit f18fa5de5ba7f1d6650951502bb96a6e4715a948 upstream.

This patch initialize stack variables which are used in
frag_lowpan_compare_key to zero. In my case there are padding bytes in the
structures ieee802154_addr as well in frag_lowpan_compare_key. Otherwise
the key variable contains random bytes. The result is that a compare of
two keys by memcmp works incorrect.

Fixes: 648700f76b03 ("inet: frags: use rhashtables for reassembly units")
Signed-off-by: Alexander Aring <aring@mojatatu.com>
Reported-by: Stefan Schmidt <stefan@osg.samsung.com>
Signed-off-by: Stefan Schmidt <stefan@osg.samsung.com>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: use rhashtables for reassembly units

commit 648700f76b03b7e8149d13cc2bdb3355035258a9 upstream.

Some applications still rely on IP fragmentation, and to be fair linux
reassembly unit is not working under any serious load.

It uses static hash tables of 1024 buckets, and up to 128 items per bucket (!!!)

A work queue is supposed to garbage collect items when host is under memory
pressure, and doing a hash rebuild, changing seed used in hash computations.

This work queue blocks softirqs for up to 25 ms when doing a hash rebuild,
occurring every 5 seconds if host is under fire.

Then there is the problem of sharing this hash table for all netns.

It is time to switch to rhashtables, and allocate one of them per netns
to speedup netns dismantle, since this is a critical metric these days.

Lookup is now using RCU. A followup patch will even remove
the refcount hold/release left from prior implementation and save
a couple of atomic operations.

Before this patch, 16 cpus (16 RX queue NIC) could not handle more
than 1 Mpps frags DDOS.

After the patch, I reach 9 Mpps without any tuning, and can use up to 2GB
of storage for the fragments (exact number depends on frags being evicted
after timeout)

$ grep FRAG /proc/net/sockstat
FRAG: inuse 1966916 memory 2140004608

A followup patch will change the limits for 64bit arches.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Kirill Tkhai <ktkhai@virtuozzo.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Florian Westphal <fw@strlen.de>
Cc: Jesper Dangaard Brouer <brouer@redhat.com>
Cc: Alexander Aring <alex.aring@gmail.com>
Cc: Stefan Schmidt <stefan@osg.samsung.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
[bwh: Backported to 4.4: adjust context]
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rhashtable: add schedule points

commit ae6da1f503abb5a5081f9f6c4a6881de97830f3e upstream.

Rehashing and destroying large hash table takes a lot of time,
and happens in process context. It is safe to add cond_resched()
in rhashtable_rehash_table() and rhashtable_free_and_destroy()

Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rhashtable: Add rhashtable_lookup()

Extracted from commit ca26893f05e8 "rhashtable: Add rhlist interface".

Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

rhashtable: add rhashtable_lookup_get_insert_key()

commit 5ca8cc5bf11faed257c762018aea9106d529232f upstream.

This patch modifies __rhashtable_insert_fast() so it returns the
existing object that clashes with the one that you want to insert.
In case the object is successfully inserted, NULL is returned.
Otherwise, you get an error via ERR_PTR().

This patch adapts the existing callers of __rhashtable_insert_fast()
so they handle this new logic, and it adds a new
rhashtable_lookup_get_insert_key() interface to fetch this existing
object.

nf_tables needs this change to improve handling of EEXIST cases via
honoring the NLM_F_EXCL flag and by checking if the data part of the
mapping matches what we have.

Cc: Herbert Xu <herbert@gondor.apana.org.au>
Cc: Thomas Graf <tgraf@suug.ch>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

inet: frags: refactor lowpan_net_frag_init()

commit 807f1844df4ac23594268fa9f41902d0549e92aa upstream.

We want to call lowpan_net_frag_init() earlier.
Similar to commit "inet: frags: refactor ipv6_frag_init()"

This is a prereq to "inet: frags: use rhashtables for reassembly units"

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben.hutchings@codethink.co.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>