commit: 2ea3819200912d3ded82eadef8ba00aac2cf8148 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sun May 20 22:21:29 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sun May 20 22:21:29 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=2ea38192
Linux patch 4.14.42 0000_README | 4 + 1041_linux-4.14.42.patch | 1534 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1538 insertions(+) diff --git a/0000_README b/0000_README index 196f1c1..cace374 100644 --- a/0000_README +++ b/0000_README @@ -207,6 +207,10 @@ Patch: 1040_linux-4.14.41.patch From: http://www.kernel.org Desc: Linux 4.14.41 +Patch: 1041_linux-4.14.42.patch +From: http://www.kernel.org +Desc: Linux 4.14.42 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1041_linux-4.14.42.patch b/1041_linux-4.14.42.patch new file mode 100644 index 0000000..5d73cf3 --- /dev/null +++ b/1041_linux-4.14.42.patch @@ -0,0 +1,1534 @@ +diff --git a/Makefile b/Makefile +index c23d0b0c6c45..777f5685a36b 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 41 ++SUBLEVEL = 42 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c +index c02cc817a490..60666db31886 100644 +--- a/drivers/net/bonding/bond_alb.c ++++ b/drivers/net/bonding/bond_alb.c +@@ -450,7 +450,7 @@ static void rlb_update_client(struct rlb_client_info *client_info) + { + int i; + +- if (!client_info->slave) ++ if (!client_info->slave || !is_valid_ether_addr(client_info->mac_dst)) + return; + + for (i = 0; i < RLB_ARP_BURST_SIZE; i++) { +@@ -943,6 +943,10 @@ static void alb_send_lp_vid(struct slave *slave, u8 mac_addr[], + skb->priority = TC_PRIO_CONTROL; + skb->dev = slave->dev; + ++ netdev_dbg(slave->bond->dev, ++ "Send learning packet: dev %s mac %pM vlan %d\n", ++ slave->dev->name, mac_addr, vid); ++ + if (vid) + __vlan_hwaccel_put_tag(skb, vlan_proto, vid); + +@@ -965,14 +969,13 @@ static int alb_upper_dev_walk(struct net_device *upper, void *_data) + u8 *mac_addr = data->mac_addr; + struct bond_vlan_tag *tags; + +- if (is_vlan_dev(upper) && vlan_get_encap_level(upper) == 0) { +- if (strict_match && +- ether_addr_equal_64bits(mac_addr, +- upper->dev_addr)) { ++ if (is_vlan_dev(upper) && ++ bond->nest_level == vlan_get_encap_level(upper) - 1) { ++ if (upper->addr_assign_type == NET_ADDR_STOLEN) { + alb_send_lp_vid(slave, mac_addr, + vlan_dev_vlan_proto(upper), + vlan_dev_vlan_id(upper)); +- } else if (!strict_match) { ++ } else { + alb_send_lp_vid(slave, upper->dev_addr, + vlan_dev_vlan_proto(upper), + vlan_dev_vlan_id(upper)); +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c +index bf3be2e6d4a8..f0aa57222f17 100644 +--- a/drivers/net/bonding/bond_main.c ++++ b/drivers/net/bonding/bond_main.c +@@ -1734,6 +1734,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev) + if (bond_mode_uses_xmit_hash(bond)) + bond_update_slave_arr(bond, NULL); + ++ bond->nest_level = dev_get_nest_level(bond_dev); ++ + netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n", + slave_dev->name, + bond_is_active_slave(new_slave) ? "an active" : "a backup", +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index 48738eb27806..9a8ef630466f 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -8723,14 +8723,15 @@ static void tg3_free_consistent(struct tg3 *tp) + tg3_mem_rx_release(tp); + tg3_mem_tx_release(tp); + +- /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */ +- tg3_full_lock(tp, 0); ++ /* tp->hw_stats can be referenced safely: ++ * 1. under rtnl_lock ++ * 2. or under tp->lock if TG3_FLAG_INIT_COMPLETE is set. ++ */ + if (tp->hw_stats) { + dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats), + tp->hw_stats, tp->stats_mapping); + tp->hw_stats = NULL; + } +- tg3_full_unlock(tp); + } + + /* +@@ -14167,7 +14168,7 @@ static void tg3_get_stats64(struct net_device *dev, + struct tg3 *tp = netdev_priv(dev); + + spin_lock_bh(&tp->lock); +- if (!tp->hw_stats) { ++ if (!tp->hw_stats || !tg3_flag(tp, INIT_COMPLETE)) { + *stats = tp->net_stats_prev; + spin_unlock_bh(&tp->lock); + return; +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +index 67f74fcb265e..5fe56dc4cfae 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c +@@ -1013,6 +1013,22 @@ static int mlx4_en_set_coalesce(struct net_device *dev, + if (!coal->tx_max_coalesced_frames_irq) + return -EINVAL; + ++ if (coal->tx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME || ++ coal->rx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME || ++ coal->rx_coalesce_usecs_low > MLX4_EN_MAX_COAL_TIME || ++ coal->rx_coalesce_usecs_high > MLX4_EN_MAX_COAL_TIME) { ++ netdev_info(dev, "%s: maximum coalesce time supported is %d usecs\n", ++ __func__, MLX4_EN_MAX_COAL_TIME); ++ return -ERANGE; ++ } ++ ++ if (coal->tx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS || ++ coal->rx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS) { ++ netdev_info(dev, "%s: maximum coalesced frames supported is %d\n", ++ __func__, MLX4_EN_MAX_COAL_PKTS); ++ return -ERANGE; ++ } ++ + priv->rx_frames = (coal->rx_max_coalesced_frames == + MLX4_EN_AUTO_CONF) ? + MLX4_EN_RX_COAL_TARGET : +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index c097eef41a9c..faa4bd21f148 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -3318,12 +3318,11 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, + MAX_TX_RINGS, GFP_KERNEL); + if (!priv->tx_ring[t]) { + err = -ENOMEM; +- goto err_free_tx; ++ goto out; + } + priv->tx_cq[t] = kzalloc(sizeof(struct mlx4_en_cq *) * + MAX_TX_RINGS, GFP_KERNEL); + if (!priv->tx_cq[t]) { +- kfree(priv->tx_ring[t]); + err = -ENOMEM; + goto out; + } +@@ -3576,11 +3575,6 @@ int mlx4_en_init_netdev(struct mlx4_en_dev *mdev, int port, + + return 0; + +-err_free_tx: +- while (t--) { +- kfree(priv->tx_ring[t]); +- kfree(priv->tx_cq[t]); +- } + out: + mlx4_en_destroy_netdev(dev); + return err; +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +index 2c1a5ff6acfa..09f4764a3f39 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h +@@ -131,6 +131,9 @@ + #define MLX4_EN_TX_COAL_PKTS 16 + #define MLX4_EN_TX_COAL_TIME 0x10 + ++#define MLX4_EN_MAX_COAL_PKTS U16_MAX ++#define MLX4_EN_MAX_COAL_TIME U16_MAX ++ + #define MLX4_EN_RX_RATE_LOW 400000 + #define MLX4_EN_RX_COAL_TIME_LOW 0 + #define MLX4_EN_RX_RATE_HIGH 450000 +@@ -547,8 +550,8 @@ struct mlx4_en_priv { + u16 rx_usecs_low; + u32 pkt_rate_high; + u16 rx_usecs_high; +- u16 sample_interval; +- u16 adaptive_rx_coal; ++ u32 sample_interval; ++ u32 adaptive_rx_coal; + u32 msg_enable; + u32 loopback_ok; + u32 validate_loopback; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +index 42bab73a9f40..ede66e6af786 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c +@@ -780,6 +780,10 @@ static int __parse_cls_flower(struct mlx5e_priv *priv, + f->mask); + addr_type = key->addr_type; + ++ /* the HW doesn't support frag first/later */ ++ if (mask->flags & FLOW_DIS_FIRST_FRAG) ++ return -EOPNOTSUPP; ++ + if (mask->flags & FLOW_DIS_IS_FRAGMENT) { + MLX5_SET(fte_match_set_lyr_2_4, headers_c, frag, 1); + MLX5_SET(fte_match_set_lyr_2_4, headers_v, frag, +@@ -1383,7 +1387,8 @@ static bool modify_header_match_supported(struct mlx5_flow_spec *spec, + } + + ip_proto = MLX5_GET(fte_match_set_lyr_2_4, headers_v, ip_protocol); +- if (modify_ip_header && ip_proto != IPPROTO_TCP && ip_proto != IPPROTO_UDP) { ++ if (modify_ip_header && ip_proto != IPPROTO_TCP && ++ ip_proto != IPPROTO_UDP && ip_proto != IPPROTO_ICMP) { + pr_info("can't offload re-write of ip proto %d\n", ip_proto); + return false; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +index eea7f931cad3..d560047c0bf9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c +@@ -234,7 +234,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb, + dma_addr = dma_map_single(sq->pdev, skb_data, headlen, + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(sq->pdev, dma_addr))) +- return -ENOMEM; ++ goto dma_unmap_wqe_err; + + dseg->addr = cpu_to_be64(dma_addr); + dseg->lkey = sq->mkey_be; +@@ -252,7 +252,7 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb, + dma_addr = skb_frag_dma_map(sq->pdev, frag, 0, fsz, + DMA_TO_DEVICE); + if (unlikely(dma_mapping_error(sq->pdev, dma_addr))) +- return -ENOMEM; ++ goto dma_unmap_wqe_err; + + dseg->addr = cpu_to_be64(dma_addr); + dseg->lkey = sq->mkey_be; +@@ -264,6 +264,10 @@ mlx5e_txwqe_build_dsegs(struct mlx5e_txqsq *sq, struct sk_buff *skb, + } + + return num_dma; ++ ++dma_unmap_wqe_err: ++ mlx5e_dma_unmap_wqe_err(sq, num_dma); ++ return -ENOMEM; + } + + static inline void +@@ -355,17 +359,15 @@ static netdev_tx_t mlx5e_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb, + num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen, + (struct mlx5_wqe_data_seg *)cseg + ds_cnt); + if (unlikely(num_dma < 0)) +- goto dma_unmap_wqe_err; ++ goto err_drop; + + mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma, + num_bytes, num_dma, wi, cseg); + + return NETDEV_TX_OK; + +-dma_unmap_wqe_err: ++err_drop: + sq->stats.dropped++; +- mlx5e_dma_unmap_wqe_err(sq, wi->num_dma); +- + dev_kfree_skb_any(skb); + + return NETDEV_TX_OK; +@@ -594,17 +596,15 @@ netdev_tx_t mlx5i_sq_xmit(struct mlx5e_txqsq *sq, struct sk_buff *skb, + num_dma = mlx5e_txwqe_build_dsegs(sq, skb, skb_data, headlen, + (struct mlx5_wqe_data_seg *)cseg + ds_cnt); + if (unlikely(num_dma < 0)) +- goto dma_unmap_wqe_err; ++ goto err_drop; + + mlx5e_txwqe_complete(sq, skb, opcode, ds_cnt + num_dma, + num_bytes, num_dma, wi, cseg); + + return NETDEV_TX_OK; + +-dma_unmap_wqe_err: ++err_drop: + sq->stats.dropped++; +- mlx5e_dma_unmap_wqe_err(sq, wi->num_dma); +- + dev_kfree_skb_any(skb); + + return NETDEV_TX_OK; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +index c77f4c0c7769..82e37250ed01 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c +@@ -2054,26 +2054,35 @@ int mlx5_eswitch_get_vport_stats(struct mlx5_eswitch *esw, + memset(vf_stats, 0, sizeof(*vf_stats)); + vf_stats->rx_packets = + MLX5_GET_CTR(out, received_eth_unicast.packets) + ++ MLX5_GET_CTR(out, received_ib_unicast.packets) + + MLX5_GET_CTR(out, received_eth_multicast.packets) + ++ MLX5_GET_CTR(out, received_ib_multicast.packets) + + MLX5_GET_CTR(out, received_eth_broadcast.packets); + + vf_stats->rx_bytes = + MLX5_GET_CTR(out, received_eth_unicast.octets) + ++ MLX5_GET_CTR(out, received_ib_unicast.octets) + + MLX5_GET_CTR(out, received_eth_multicast.octets) + ++ MLX5_GET_CTR(out, received_ib_multicast.octets) + + MLX5_GET_CTR(out, received_eth_broadcast.octets); + + vf_stats->tx_packets = + MLX5_GET_CTR(out, transmitted_eth_unicast.packets) + ++ MLX5_GET_CTR(out, transmitted_ib_unicast.packets) + + MLX5_GET_CTR(out, transmitted_eth_multicast.packets) + ++ MLX5_GET_CTR(out, transmitted_ib_multicast.packets) + + MLX5_GET_CTR(out, transmitted_eth_broadcast.packets); + + vf_stats->tx_bytes = + MLX5_GET_CTR(out, transmitted_eth_unicast.octets) + ++ MLX5_GET_CTR(out, transmitted_ib_unicast.octets) + + MLX5_GET_CTR(out, transmitted_eth_multicast.octets) + ++ MLX5_GET_CTR(out, transmitted_ib_multicast.octets) + + MLX5_GET_CTR(out, transmitted_eth_broadcast.octets); + + vf_stats->multicast = +- MLX5_GET_CTR(out, received_eth_multicast.packets); ++ MLX5_GET_CTR(out, received_eth_multicast.packets) + ++ MLX5_GET_CTR(out, received_ib_multicast.packets); + + vf_stats->broadcast = + MLX5_GET_CTR(out, received_eth_broadcast.packets); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +index 5a7bea688ec8..33e5ff081e36 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c +@@ -174,6 +174,7 @@ static void del_flow_group(struct fs_node *node); + static void del_fte(struct fs_node *node); + static bool mlx5_flow_dests_cmp(struct mlx5_flow_destination *d1, + struct mlx5_flow_destination *d2); ++static void cleanup_root_ns(struct mlx5_flow_root_namespace *root_ns); + static struct mlx5_flow_rule * + find_flow_rule(struct fs_fte *fte, + struct mlx5_flow_destination *dest); +@@ -2041,23 +2042,27 @@ static int create_anchor_flow_table(struct mlx5_flow_steering *steering) + + static int init_root_ns(struct mlx5_flow_steering *steering) + { ++ int err; ++ + steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX); + if (!steering->root_ns) +- goto cleanup; ++ return -ENOMEM; + +- if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node)) +- goto cleanup; ++ err = init_root_tree(steering, &root_fs, &steering->root_ns->ns.node); ++ if (err) ++ goto out_err; + + set_prio_attrs(steering->root_ns); +- +- if (create_anchor_flow_table(steering)) +- goto cleanup; ++ err = create_anchor_flow_table(steering); ++ if (err) ++ goto out_err; + + return 0; + +-cleanup: +- mlx5_cleanup_fs(steering->dev); +- return -ENOMEM; ++out_err: ++ cleanup_root_ns(steering->root_ns); ++ steering->root_ns = NULL; ++ return err; + } + + static void clean_tree(struct fs_node *node) +diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c +index d24b47b8e0b2..d118da5a10a2 100644 +--- a/drivers/net/ethernet/realtek/8139too.c ++++ b/drivers/net/ethernet/realtek/8139too.c +@@ -2224,7 +2224,7 @@ static void rtl8139_poll_controller(struct net_device *dev) + struct rtl8139_private *tp = netdev_priv(dev); + const int irq = tp->pci_dev->irq; + +- disable_irq(irq); ++ disable_irq_nosync(irq); + rtl8139_interrupt(irq, dev); + enable_irq(irq); + } +diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c +index db553d4e8d22..b98fcc9e93e5 100644 +--- a/drivers/net/ethernet/realtek/r8169.c ++++ b/drivers/net/ethernet/realtek/r8169.c +@@ -4886,6 +4886,9 @@ static void rtl_pll_power_down(struct rtl8169_private *tp) + static void rtl_pll_power_up(struct rtl8169_private *tp) + { + rtl_generic_op(tp, tp->pll_power_ops.up); ++ ++ /* give MAC/PHY some time to resume */ ++ msleep(20); + } + + static void rtl_init_pll_power_ops(struct rtl8169_private *tp) +diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c +index 6a4e8e1bbd90..e92f41d20a2c 100644 +--- a/drivers/net/ethernet/sun/niu.c ++++ b/drivers/net/ethernet/sun/niu.c +@@ -3442,7 +3442,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np, + + len = (val & RCR_ENTRY_L2_LEN) >> + RCR_ENTRY_L2_LEN_SHIFT; +- len -= ETH_FCS_LEN; ++ append_size = len + ETH_HLEN + ETH_FCS_LEN; + + addr = (val & RCR_ENTRY_PKT_BUF_ADDR) << + RCR_ENTRY_PKT_BUF_ADDR_SHIFT; +@@ -3452,7 +3452,6 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np, + RCR_ENTRY_PKTBUFSZ_SHIFT]; + + off = addr & ~PAGE_MASK; +- append_size = rcr_size; + if (num_rcr == 1) { + int ptype; + +@@ -3465,7 +3464,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np, + else + skb_checksum_none_assert(skb); + } else if (!(val & RCR_ENTRY_MULTI)) +- append_size = len - skb->len; ++ append_size = append_size - skb->len; + + niu_rx_skb_append(skb, page, off, append_size, rcr_size); + if ((page->index + rp->rbr_block_size) - rcr_size == addr) { +diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c +index 992c43b1868f..8cb44eabc283 100644 +--- a/drivers/net/ethernet/ti/cpsw.c ++++ b/drivers/net/ethernet/ti/cpsw.c +@@ -1260,6 +1260,8 @@ static inline void cpsw_add_dual_emac_def_ale_entries( + cpsw_ale_add_ucast(cpsw->ale, priv->mac_addr, + HOST_PORT_NUM, ALE_VLAN | + ALE_SECURE, slave->port_vlan); ++ cpsw_ale_control_set(cpsw->ale, slave_port, ++ ALE_PORT_DROP_UNKNOWN_VLAN, 1); + } + + static void soft_reset_slave(struct cpsw_slave *slave) +diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c +index c849de3cb046..444e560d928b 100644 +--- a/drivers/net/hyperv/netvsc_drv.c ++++ b/drivers/net/hyperv/netvsc_drv.c +@@ -1742,7 +1742,8 @@ static int netvsc_vf_join(struct net_device *vf_netdev, + goto rx_handler_failed; + } + +- ret = netdev_upper_dev_link(vf_netdev, ndev); ++ ret = netdev_master_upper_dev_link(vf_netdev, ndev, ++ NULL, NULL); + if (ret != 0) { + netdev_err(vf_netdev, + "can not set master device %s (err = %d)\n", +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 1aad0568dcc6..2f828eb9ace6 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1338,6 +1338,18 @@ static int qmi_wwan_probe(struct usb_interface *intf, + id->driver_info = (unsigned long)&qmi_wwan_info; + } + ++ /* There are devices where the same interface number can be ++ * configured as different functions. We should only bind to ++ * vendor specific functions when matching on interface number ++ */ ++ if (id->match_flags & USB_DEVICE_ID_MATCH_INT_NUMBER && ++ desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) { ++ dev_dbg(&intf->dev, ++ "Rejecting interface number match for class %02x\n", ++ desc->bInterfaceClass); ++ return -ENODEV; ++ } ++ + /* Quectel EC20 quirk where we've QMI on interface 4 instead of 0 */ + if (quectel_ec20_detected(intf) && desc->bInterfaceNumber == 0) { + dev_dbg(&intf->dev, "Quectel EC20 quirk, skipping interface 0\n"); +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index c0a4fcb7fd0a..3696f9ded252 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -752,6 +752,8 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback, + int wait; + unsigned long flags = 0; + unsigned long mflags = 0; ++ struct aac_hba_cmd_req *hbacmd = (struct aac_hba_cmd_req *) ++ fibptr->hw_fib_va; + + fibptr->flags = (FIB_CONTEXT_FLAG | FIB_CONTEXT_FLAG_NATIVE_HBA); + if (callback) { +@@ -762,11 +764,9 @@ int aac_hba_send(u8 command, struct fib *fibptr, fib_callback callback, + wait = 1; + + +- if (command == HBA_IU_TYPE_SCSI_CMD_REQ) { +- struct aac_hba_cmd_req *hbacmd = +- (struct aac_hba_cmd_req *)fibptr->hw_fib_va; ++ hbacmd->iu_type = command; + +- hbacmd->iu_type = command; ++ if (command == HBA_IU_TYPE_SCSI_CMD_REQ) { + /* bit1 of request_id must be 0 */ + hbacmd->request_id = + cpu_to_le32((((u32)(fibptr - dev->fibs)) << 2) + 1); +diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c +index d227d8514b25..1bc62294fe6b 100644 +--- a/fs/btrfs/extent-tree.c ++++ b/fs/btrfs/extent-tree.c +@@ -3171,7 +3171,11 @@ static noinline int check_delayed_ref(struct btrfs_root *root, + struct btrfs_transaction *cur_trans; + int ret = 0; + ++ spin_lock(&root->fs_info->trans_lock); + cur_trans = root->fs_info->running_transaction; ++ if (cur_trans) ++ refcount_inc(&cur_trans->use_count); ++ spin_unlock(&root->fs_info->trans_lock); + if (!cur_trans) + return 0; + +@@ -3180,6 +3184,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, + head = btrfs_find_delayed_ref_head(delayed_refs, bytenr); + if (!head) { + spin_unlock(&delayed_refs->lock); ++ btrfs_put_transaction(cur_trans); + return 0; + } + +@@ -3196,6 +3201,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, + mutex_lock(&head->mutex); + mutex_unlock(&head->mutex); + btrfs_put_delayed_ref(&head->node); ++ btrfs_put_transaction(cur_trans); + return -EAGAIN; + } + spin_unlock(&delayed_refs->lock); +@@ -3223,6 +3229,7 @@ static noinline int check_delayed_ref(struct btrfs_root *root, + } + spin_unlock(&head->lock); + mutex_unlock(&head->mutex); ++ btrfs_put_transaction(cur_trans); + return ret; + } + +diff --git a/fs/proc/base.c b/fs/proc/base.c +index 2ff11a693360..dd9d4d3a2e39 100644 +--- a/fs/proc/base.c ++++ b/fs/proc/base.c +@@ -263,7 +263,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, + * Inherently racy -- command line shares address space + * with code and data. + */ +- rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0); ++ rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_ANON); + if (rv <= 0) + goto out_free_page; + +@@ -281,7 +281,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, + int nr_read; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -327,7 +327,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf, + bool final; + + _count = min3(count, len, PAGE_SIZE); +- nr_read = access_remote_vm(mm, p, page, _count, 0); ++ nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON); + if (nr_read < 0) + rv = nr_read; + if (nr_read <= 0) +@@ -946,7 +946,7 @@ static ssize_t environ_read(struct file *file, char __user *buf, + max_len = min_t(size_t, PAGE_SIZE, count); + this_len = min(max_len, this_len); + +- retval = access_remote_vm(mm, (env_start + src), page, this_len, 0); ++ retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON); + + if (retval <= 0) { + ret = retval; +diff --git a/include/linux/mm.h b/include/linux/mm.h +index f50deada0f5c..f23215854c80 100644 +--- a/include/linux/mm.h ++++ b/include/linux/mm.h +@@ -2383,6 +2383,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma, + #define FOLL_MLOCK 0x1000 /* lock present pages */ + #define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */ + #define FOLL_COW 0x4000 /* internal GUP flag */ ++#define FOLL_ANON 0x8000 /* don't do file mappings */ + + static inline int vm_fault_to_errno(int vm_fault, int foll_flags) + { +diff --git a/include/net/bonding.h b/include/net/bonding.h +index b2e68657a216..73799da57400 100644 +--- a/include/net/bonding.h ++++ b/include/net/bonding.h +@@ -198,6 +198,7 @@ struct bonding { + struct slave __rcu *primary_slave; + struct bond_up_slave __rcu *slave_arr; /* Array of usable slaves */ + bool force_primary; ++ u32 nest_level; + s32 slave_cnt; /* never change this value outside the attach/detach wrappers */ + int (*recv_probe)(const struct sk_buff *, struct bonding *, + struct slave *); +diff --git a/include/net/tls.h b/include/net/tls.h +index df950383b8c1..48940a883d9a 100644 +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -98,6 +98,7 @@ struct tls_context { + struct scatterlist *partially_sent_record; + u16 partially_sent_offset; + unsigned long flags; ++ bool in_tcp_sendpages; + + u16 pending_open_record_frags; + int (*push_pending_record)(struct sock *sk, int flags); +diff --git a/mm/gup.c b/mm/gup.c +index 8fc23a60487d..d2ba0be71441 100644 +--- a/mm/gup.c ++++ b/mm/gup.c +@@ -544,6 +544,9 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags) + if (vm_flags & (VM_IO | VM_PFNMAP)) + return -EFAULT; + ++ if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma)) ++ return -EFAULT; ++ + if (write) { + if (!(vm_flags & VM_WRITE)) { + if (!(gup_flags & FOLL_FORCE)) +diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c +index f3aef22931ab..55a73ef388bf 100644 +--- a/net/bridge/br_if.c ++++ b/net/bridge/br_if.c +@@ -503,8 +503,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev) + if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit) + return -ELOOP; + +- /* Device is already being bridged */ +- if (br_port_exists(dev)) ++ /* Device has master upper dev */ ++ if (netdev_master_upper_dev_get(dev)) + return -EBUSY; + + /* No bridging devices that dislike that (e.g. wireless) */ +diff --git a/net/compat.c b/net/compat.c +index 22381719718c..32ed993588d6 100644 +--- a/net/compat.c ++++ b/net/compat.c +@@ -377,7 +377,8 @@ static int compat_sock_setsockopt(struct socket *sock, int level, int optname, + optname == SO_ATTACH_REUSEPORT_CBPF) + return do_set_attach_filter(sock, level, optname, + optval, optlen); +- if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO) ++ if (!COMPAT_USE_64BIT_TIME && ++ (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)) + return do_set_sock_timeout(sock, level, optname, optval, optlen); + + return sock_setsockopt(sock, level, optname, optval, optlen); +@@ -442,7 +443,8 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname, + static int compat_sock_getsockopt(struct socket *sock, int level, int optname, + char __user *optval, int __user *optlen) + { +- if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO) ++ if (!COMPAT_USE_64BIT_TIME && ++ (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)) + return do_get_sock_timeout(sock, level, optname, optval, optlen); + return sock_getsockopt(sock, level, optname, optval, optlen); + } +diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c +index 97791b0b1b51..3887bc115762 100644 +--- a/net/dccp/ccids/ccid2.c ++++ b/net/dccp/ccids/ccid2.c +@@ -126,6 +126,16 @@ static void ccid2_change_l_seq_window(struct sock *sk, u64 val) + DCCPF_SEQ_WMAX)); + } + ++static void dccp_tasklet_schedule(struct sock *sk) ++{ ++ struct tasklet_struct *t = &dccp_sk(sk)->dccps_xmitlet; ++ ++ if (!test_and_set_bit(TASKLET_STATE_SCHED, &t->state)) { ++ sock_hold(sk); ++ __tasklet_schedule(t); ++ } ++} ++ + static void ccid2_hc_tx_rto_expire(unsigned long data) + { + struct sock *sk = (struct sock *)data; +@@ -166,7 +176,7 @@ static void ccid2_hc_tx_rto_expire(unsigned long data) + + /* if we were blocked before, we may now send cwnd=1 packet */ + if (sender_was_blocked) +- tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet); ++ dccp_tasklet_schedule(sk); + /* restart backed-off timer */ + sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto); + out: +@@ -706,7 +716,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb) + done: + /* check if incoming Acks allow pending packets to be sent */ + if (sender_was_blocked && !ccid2_cwnd_network_limited(hc)) +- tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet); ++ dccp_tasklet_schedule(sk); + dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks); + } + +diff --git a/net/dccp/timer.c b/net/dccp/timer.c +index 3a2c34027758..2a952cbd6efa 100644 +--- a/net/dccp/timer.c ++++ b/net/dccp/timer.c +@@ -230,12 +230,12 @@ static void dccp_write_xmitlet(unsigned long data) + else + dccp_write_xmit(sk); + bh_unlock_sock(sk); ++ sock_put(sk); + } + + static void dccp_write_xmit_timer(unsigned long data) + { + dccp_write_xmitlet(data); +- sock_put((struct sock *)data); + } + + void dccp_init_xmit_timers(struct sock *sk) +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index b8f0db54b197..16226d49263d 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -775,8 +775,10 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + ipc.addr = faddr = daddr; + + if (ipc.opt && ipc.opt->opt.srr) { +- if (!daddr) +- return -EINVAL; ++ if (!daddr) { ++ err = -EINVAL; ++ goto out_free; ++ } + faddr = ipc.opt->opt.faddr; + } + tos = get_rttos(&ipc, inet); +@@ -842,6 +844,7 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + out: + ip_rt_put(rt); ++out_free: + if (free) + kfree(ipc.opt); + if (!err) { +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 5ea559f8c456..28bc3a98adc7 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -711,7 +711,7 @@ static void update_or_create_fnhe(struct fib_nh *nh, __be32 daddr, __be32 gw, + fnhe->fnhe_daddr = daddr; + fnhe->fnhe_gw = gw; + fnhe->fnhe_pmtu = pmtu; +- fnhe->fnhe_expires = expires; ++ fnhe->fnhe_expires = max(1UL, expires); + + /* Exception created; mark the cached routes for the nexthop + * stale, so anyone caching it rechecks if this exception +@@ -1286,6 +1286,36 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst) + return mtu - lwtunnel_headroom(dst->lwtstate, mtu); + } + ++static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr) ++{ ++ struct fnhe_hash_bucket *hash; ++ struct fib_nh_exception *fnhe, __rcu **fnhe_p; ++ u32 hval = fnhe_hashfun(daddr); ++ ++ spin_lock_bh(&fnhe_lock); ++ ++ hash = rcu_dereference_protected(nh->nh_exceptions, ++ lockdep_is_held(&fnhe_lock)); ++ hash += hval; ++ ++ fnhe_p = &hash->chain; ++ fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock)); ++ while (fnhe) { ++ if (fnhe->fnhe_daddr == daddr) { ++ rcu_assign_pointer(*fnhe_p, rcu_dereference_protected( ++ fnhe->fnhe_next, lockdep_is_held(&fnhe_lock))); ++ fnhe_flush_routes(fnhe); ++ kfree_rcu(fnhe, rcu); ++ break; ++ } ++ fnhe_p = &fnhe->fnhe_next; ++ fnhe = rcu_dereference_protected(fnhe->fnhe_next, ++ lockdep_is_held(&fnhe_lock)); ++ } ++ ++ spin_unlock_bh(&fnhe_lock); ++} ++ + static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr) + { + struct fnhe_hash_bucket *hash = rcu_dereference(nh->nh_exceptions); +@@ -1299,8 +1329,14 @@ static struct fib_nh_exception *find_exception(struct fib_nh *nh, __be32 daddr) + + for (fnhe = rcu_dereference(hash[hval].chain); fnhe; + fnhe = rcu_dereference(fnhe->fnhe_next)) { +- if (fnhe->fnhe_daddr == daddr) ++ if (fnhe->fnhe_daddr == daddr) { ++ if (fnhe->fnhe_expires && ++ time_after(jiffies, fnhe->fnhe_expires)) { ++ ip_del_fnhe(nh, daddr); ++ break; ++ } + return fnhe; ++ } + } + return NULL; + } +@@ -1620,36 +1656,6 @@ static void ip_handle_martian_source(struct net_device *dev, + #endif + } + +-static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr) +-{ +- struct fnhe_hash_bucket *hash; +- struct fib_nh_exception *fnhe, __rcu **fnhe_p; +- u32 hval = fnhe_hashfun(daddr); +- +- spin_lock_bh(&fnhe_lock); +- +- hash = rcu_dereference_protected(nh->nh_exceptions, +- lockdep_is_held(&fnhe_lock)); +- hash += hval; +- +- fnhe_p = &hash->chain; +- fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock)); +- while (fnhe) { +- if (fnhe->fnhe_daddr == daddr) { +- rcu_assign_pointer(*fnhe_p, rcu_dereference_protected( +- fnhe->fnhe_next, lockdep_is_held(&fnhe_lock))); +- fnhe_flush_routes(fnhe); +- kfree_rcu(fnhe, rcu); +- break; +- } +- fnhe_p = &fnhe->fnhe_next; +- fnhe = rcu_dereference_protected(fnhe->fnhe_next, +- lockdep_is_held(&fnhe_lock)); +- } +- +- spin_unlock_bh(&fnhe_lock); +-} +- + static void set_lwt_redirect(struct rtable *rth) + { + if (lwtunnel_output_redirect(rth->dst.lwtstate)) { +@@ -1716,20 +1722,10 @@ static int __mkroute_input(struct sk_buff *skb, + + fnhe = find_exception(&FIB_RES_NH(*res), daddr); + if (do_cache) { +- if (fnhe) { ++ if (fnhe) + rth = rcu_dereference(fnhe->fnhe_rth_input); +- if (rth && rth->dst.expires && +- time_after(jiffies, rth->dst.expires)) { +- ip_del_fnhe(&FIB_RES_NH(*res), daddr); +- fnhe = NULL; +- } else { +- goto rt_cache; +- } +- } +- +- rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input); +- +-rt_cache: ++ else ++ rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input); + if (rt_cache_valid(rth)) { + skb_dst_set_noref(skb, &rth->dst); + goto out; +@@ -2206,39 +2202,31 @@ static struct rtable *__mkroute_output(const struct fib_result *res, + * the loopback interface and the IP_PKTINFO ipi_ifindex will + * be set to the loopback interface as well. + */ +- fi = NULL; ++ do_cache = false; + } + + fnhe = NULL; + do_cache &= fi != NULL; +- if (do_cache) { ++ if (fi) { + struct rtable __rcu **prth; + struct fib_nh *nh = &FIB_RES_NH(*res); + + fnhe = find_exception(nh, fl4->daddr); ++ if (!do_cache) ++ goto add; + if (fnhe) { + prth = &fnhe->fnhe_rth_output; +- rth = rcu_dereference(*prth); +- if (rth && rth->dst.expires && +- time_after(jiffies, rth->dst.expires)) { +- ip_del_fnhe(nh, fl4->daddr); +- fnhe = NULL; +- } else { +- goto rt_cache; ++ } else { ++ if (unlikely(fl4->flowi4_flags & ++ FLOWI_FLAG_KNOWN_NH && ++ !(nh->nh_gw && ++ nh->nh_scope == RT_SCOPE_LINK))) { ++ do_cache = false; ++ goto add; + } ++ prth = raw_cpu_ptr(nh->nh_pcpu_rth_output); + } +- +- if (unlikely(fl4->flowi4_flags & +- FLOWI_FLAG_KNOWN_NH && +- !(nh->nh_gw && +- nh->nh_scope == RT_SCOPE_LINK))) { +- do_cache = false; +- goto add; +- } +- prth = raw_cpu_ptr(nh->nh_pcpu_rth_output); + rth = rcu_dereference(*prth); +- +-rt_cache: + if (rt_cache_valid(rth) && dst_hold_safe(&rth->dst)) + return rth; + } +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index b694fbf44a35..e3ece12f0250 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1194,7 +1194,8 @@ int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size) + uarg->zerocopy = 0; + } + +- if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect)) { ++ if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect) && ++ !tp->repair) { + err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size); + if (err == -EINPROGRESS && copied_syn > 0) + goto out; +diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c +index 25c5a0b60cfc..9a0b952dd09b 100644 +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -802,7 +802,9 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs) + } + } + } +- bbr->idle_restart = 0; ++ /* Restart after idle ends only once we process a new S/ACK for data */ ++ if (rs->delivered > 0) ++ bbr->idle_restart = 0; + } + + static void bbr_update_model(struct sock *sk, const struct rate_sample *rs) +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index c79fa6f6b758..b0ad62bd38f7 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -413,9 +413,9 @@ static int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score += 4; + } + +@@ -978,8 +978,10 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + sock_tx_timestamp(sk, ipc.sockc.tsflags, &ipc.tx_flags); + + if (ipc.opt && ipc.opt->opt.srr) { +- if (!daddr) +- return -EINVAL; ++ if (!daddr) { ++ err = -EINVAL; ++ goto out_free; ++ } + faddr = ipc.opt->opt.faddr; + connected = 0; + } +@@ -1087,6 +1089,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) + + out: + ip_rt_put(rt); ++out_free: + if (free) + kfree(ipc.opt); + if (!err) +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index e04c534b573e..7d50d889ab6e 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1222,11 +1222,16 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb, + const struct ipv6hdr *inner_iph; + const struct icmp6hdr *icmph; + struct ipv6hdr _inner_iph; ++ struct icmp6hdr _icmph; + + if (likely(outer_iph->nexthdr != IPPROTO_ICMPV6)) + goto out; + +- icmph = icmp6_hdr(skb); ++ icmph = skb_header_pointer(skb, skb_transport_offset(skb), ++ sizeof(_icmph), &_icmph); ++ if (!icmph) ++ goto out; ++ + if (icmph->icmp6_type != ICMPV6_DEST_UNREACH && + icmph->icmp6_type != ICMPV6_PKT_TOOBIG && + icmph->icmp6_type != ICMPV6_TIME_EXCEED && +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 40d7234c27b9..0146dcdc5c40 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -164,9 +164,9 @@ static int compute_score(struct sock *sk, struct net *net, + bool dev_match = (sk->sk_bound_dev_if == dif || + sk->sk_bound_dev_if == sdif); + +- if (exact_dif && !dev_match) ++ if (!dev_match) + return -1; +- if (sk->sk_bound_dev_if && dev_match) ++ if (sk->sk_bound_dev_if) + score++; + } + +diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c +index fca69c3771f5..c28223d8092b 100644 +--- a/net/l2tp/l2tp_netlink.c ++++ b/net/l2tp/l2tp_netlink.c +@@ -765,8 +765,6 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl + + if ((session->ifname[0] && + nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) || +- (session->offset && +- nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) || + (session->cookie_len && + nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len, + &session->cookie[0])) || +diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c +index cf41d9b4a0b8..b49f5afab405 100644 +--- a/net/llc/af_llc.c ++++ b/net/llc/af_llc.c +@@ -930,6 +930,9 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len) + if (size > llc->dev->mtu) + size = llc->dev->mtu; + copied = size - hdrlen; ++ rc = -EINVAL; ++ if (copied < 0) ++ goto release; + release_sock(sk); + skb = sock_alloc_send_skb(sk, size, noblock, &rc); + lock_sock(sk); +diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c +index 58fb827439a8..6df6f58a8103 100644 +--- a/net/nsh/nsh.c ++++ b/net/nsh/nsh.c +@@ -30,6 +30,8 @@ static struct sk_buff *nsh_gso_segment(struct sk_buff *skb, + if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN))) + goto out; + nsh_len = nsh_hdr_len(nsh_hdr(skb)); ++ if (nsh_len < NSH_BASE_HDR_LEN) ++ goto out; + if (unlikely(!pskb_may_pull(skb, nsh_len))) + goto out; + +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index 0d9f6afa266c..4c9c9458374a 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -1404,13 +1404,10 @@ static void nlattr_set(struct nlattr *attr, u8 val, + + /* The nlattr stream should already have been validated */ + nla_for_each_nested(nla, attr, rem) { +- if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) { +- if (tbl[nla_type(nla)].next) +- tbl = tbl[nla_type(nla)].next; +- nlattr_set(nla, val, tbl); +- } else { ++ if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) ++ nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl); ++ else + memset(nla_data(nla), val, nla_len(nla)); +- } + + if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE) + *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK; +diff --git a/net/rds/recv.c b/net/rds/recv.c +index b25bcfe411ca..555f07ccf0dc 100644 +--- a/net/rds/recv.c ++++ b/net/rds/recv.c +@@ -558,6 +558,7 @@ static int rds_cmsg_recv(struct rds_incoming *inc, struct msghdr *msg, + struct rds_cmsg_rx_trace t; + int i, j; + ++ memset(&t, 0, sizeof(t)); + inc->i_rx_lat_trace[RDS_MSG_RX_CMSG] = local_clock(); + t.rx_traces = rs->rs_rx_traces; + for (i = 0; i < rs->rs_rx_traces; i++) { +diff --git a/net/sched/act_skbmod.c b/net/sched/act_skbmod.c +index 6d10b3af479b..821823b2518a 100644 +--- a/net/sched/act_skbmod.c ++++ b/net/sched/act_skbmod.c +@@ -131,8 +131,11 @@ static int tcf_skbmod_init(struct net *net, struct nlattr *nla, + if (exists && bind) + return 0; + +- if (!lflags) ++ if (!lflags) { ++ if (exists) ++ tcf_idr_release(*a, bind); + return -EINVAL; ++ } + + if (!exists) { + ret = tcf_idr_create(tn, parm->index, est, a, +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index c2fab4bcb8be..2f4e1483aced 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -151,8 +151,8 @@ static struct tcf_proto *tcf_proto_create(const char *kind, u32 protocol, + } else { + err = -ENOENT; + } +- goto errout; + #endif ++ goto errout; + } + tp->classify = tp->ops->classify; + tp->protocol = protocol; +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 263d16e3219e..f50eb87cfe79 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -128,6 +128,28 @@ static bool fq_flow_is_detached(const struct fq_flow *f) + return f->next == &detached; + } + ++static bool fq_flow_is_throttled(const struct fq_flow *f) ++{ ++ return f->next == &throttled; ++} ++ ++static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow) ++{ ++ if (head->first) ++ head->last->next = flow; ++ else ++ head->first = flow; ++ head->last = flow; ++ flow->next = NULL; ++} ++ ++static void fq_flow_unset_throttled(struct fq_sched_data *q, struct fq_flow *f) ++{ ++ rb_erase(&f->rate_node, &q->delayed); ++ q->throttled_flows--; ++ fq_flow_add_tail(&q->old_flows, f); ++} ++ + static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f) + { + struct rb_node **p = &q->delayed.rb_node, *parent = NULL; +@@ -155,15 +177,6 @@ static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f) + + static struct kmem_cache *fq_flow_cachep __read_mostly; + +-static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow) +-{ +- if (head->first) +- head->last->next = flow; +- else +- head->first = flow; +- head->last = flow; +- flow->next = NULL; +-} + + /* limit number of collected flows per round */ + #define FQ_GC_MAX 8 +@@ -267,6 +280,8 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q) + f->socket_hash != sk->sk_hash)) { + f->credit = q->initial_quantum; + f->socket_hash = sk->sk_hash; ++ if (fq_flow_is_throttled(f)) ++ fq_flow_unset_throttled(q, f); + f->time_next_packet = 0ULL; + } + return f; +@@ -438,9 +453,7 @@ static void fq_check_throttled(struct fq_sched_data *q, u64 now) + q->time_next_delayed_flow = f->time_next_packet; + break; + } +- rb_erase(p, &q->delayed); +- q->throttled_flows--; +- fq_flow_add_tail(&q->old_flows, f); ++ fq_flow_unset_throttled(q, f); + } + } + +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index dfb9651e818b..58f7d8cfd748 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -1025,8 +1025,9 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) + struct sctp_endpoint *ep; + struct sctp_chunk *chunk; + struct sctp_inq *inqueue; +- int state; ++ int first_time = 1; /* is this the first time through the loop */ + int error = 0; ++ int state; + + /* The association should be held so we should be safe. */ + ep = asoc->ep; +@@ -1037,6 +1038,30 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) + state = asoc->state; + subtype = SCTP_ST_CHUNK(chunk->chunk_hdr->type); + ++ /* If the first chunk in the packet is AUTH, do special ++ * processing specified in Section 6.3 of SCTP-AUTH spec ++ */ ++ if (first_time && subtype.chunk == SCTP_CID_AUTH) { ++ struct sctp_chunkhdr *next_hdr; ++ ++ next_hdr = sctp_inq_peek(inqueue); ++ if (!next_hdr) ++ goto normal; ++ ++ /* If the next chunk is COOKIE-ECHO, skip the AUTH ++ * chunk while saving a pointer to it so we can do ++ * Authentication later (during cookie-echo ++ * processing). ++ */ ++ if (next_hdr->type == SCTP_CID_COOKIE_ECHO) { ++ chunk->auth_chunk = skb_clone(chunk->skb, ++ GFP_ATOMIC); ++ chunk->auth = 1; ++ continue; ++ } ++ } ++ ++normal: + /* SCTP-AUTH, Section 6.3: + * The receiver has a list of chunk types which it expects + * to be received only after an AUTH-chunk. This list has +@@ -1075,6 +1100,9 @@ static void sctp_assoc_bh_rcv(struct work_struct *work) + /* If there is an error on chunk, discard this packet. */ + if (error && chunk) + chunk->pdiscard = 1; ++ ++ if (first_time) ++ first_time = 0; + } + sctp_association_put(asoc); + } +diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c +index 48392552ee7c..1aa89d4682f4 100644 +--- a/net/sctp/inqueue.c ++++ b/net/sctp/inqueue.c +@@ -217,7 +217,7 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue) + skb_pull(chunk->skb, sizeof(*ch)); + chunk->subh.v = NULL; /* Subheader is no longer valid. */ + +- if (chunk->chunk_end + sizeof(*ch) < skb_tail_pointer(chunk->skb)) { ++ if (chunk->chunk_end + sizeof(*ch) <= skb_tail_pointer(chunk->skb)) { + /* This is not a singleton */ + chunk->singleton = 0; + } else if (chunk->chunk_end > skb_tail_pointer(chunk->skb)) { +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 7219a1c041f7..853fecdf6374 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -865,6 +865,9 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1, + if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2)) + return 1; + ++ if (addr1->sa.sa_family == AF_INET && addr2->sa.sa_family == AF_INET) ++ return addr1->v4.sin_addr.s_addr == addr2->v4.sin_addr.s_addr; ++ + return __sctp_v6_cmp_addr(addr1, addr2); + } + +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c +index 8f8ccded13e4..01b078172306 100644 +--- a/net/sctp/sm_statefuns.c ++++ b/net/sctp/sm_statefuns.c +@@ -150,10 +150,7 @@ static enum sctp_disposition sctp_sf_violation_chunk( + struct sctp_cmd_seq *commands); + + static enum sctp_ierror sctp_sf_authenticate( +- struct net *net, +- const struct sctp_endpoint *ep, + const struct sctp_association *asoc, +- const union sctp_subtype type, + struct sctp_chunk *chunk); + + static enum sctp_disposition __sctp_sf_do_9_1_abort( +@@ -618,6 +615,38 @@ enum sctp_disposition sctp_sf_do_5_1C_ack(struct net *net, + return SCTP_DISPOSITION_CONSUME; + } + ++static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk, ++ const struct sctp_association *asoc) ++{ ++ struct sctp_chunk auth; ++ ++ if (!chunk->auth_chunk) ++ return true; ++ ++ /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo ++ * is supposed to be authenticated and we have to do delayed ++ * authentication. We've just recreated the association using ++ * the information in the cookie and now it's much easier to ++ * do the authentication. ++ */ ++ ++ /* Make sure that we and the peer are AUTH capable */ ++ if (!net->sctp.auth_enable || !asoc->peer.auth_capable) ++ return false; ++ ++ /* set-up our fake chunk so that we can process it */ ++ auth.skb = chunk->auth_chunk; ++ auth.asoc = chunk->asoc; ++ auth.sctp_hdr = chunk->sctp_hdr; ++ auth.chunk_hdr = (struct sctp_chunkhdr *) ++ skb_push(chunk->auth_chunk, ++ sizeof(struct sctp_chunkhdr)); ++ skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr)); ++ auth.transport = chunk->transport; ++ ++ return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR; ++} ++ + /* + * Respond to a normal COOKIE ECHO chunk. + * We are the side that is being asked for an association. +@@ -755,37 +784,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net, + if (error) + goto nomem_init; + +- /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo +- * is supposed to be authenticated and we have to do delayed +- * authentication. We've just recreated the association using +- * the information in the cookie and now it's much easier to +- * do the authentication. +- */ +- if (chunk->auth_chunk) { +- struct sctp_chunk auth; +- enum sctp_ierror ret; +- +- /* Make sure that we and the peer are AUTH capable */ +- if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) { +- sctp_association_free(new_asoc); +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); +- } +- +- /* set-up our fake chunk so that we can process it */ +- auth.skb = chunk->auth_chunk; +- auth.asoc = chunk->asoc; +- auth.sctp_hdr = chunk->sctp_hdr; +- auth.chunk_hdr = (struct sctp_chunkhdr *) +- skb_push(chunk->auth_chunk, +- sizeof(struct sctp_chunkhdr)); +- skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr)); +- auth.transport = chunk->transport; +- +- ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth); +- if (ret != SCTP_IERROR_NO_ERROR) { +- sctp_association_free(new_asoc); +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); +- } ++ if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) { ++ sctp_association_free(new_asoc); ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands); + } + + repl = sctp_make_cookie_ack(new_asoc, chunk); +@@ -1755,13 +1756,15 @@ static enum sctp_disposition sctp_sf_do_dupcook_a( + GFP_ATOMIC)) + goto nomem; + ++ if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) ++ return SCTP_DISPOSITION_DISCARD; ++ + /* Make sure no new addresses are being added during the + * restart. Though this is a pretty complicated attack + * since you'd have to get inside the cookie. + */ +- if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) { ++ if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) + return SCTP_DISPOSITION_CONSUME; +- } + + /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes + * the peer has restarted (Action A), it MUST NOT setup a new +@@ -1867,6 +1870,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_b( + GFP_ATOMIC)) + goto nomem; + ++ if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) ++ return SCTP_DISPOSITION_DISCARD; ++ + /* Update the content of current association. */ + sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc)); + sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE, +@@ -1961,6 +1967,9 @@ static enum sctp_disposition sctp_sf_do_dupcook_d( + * a COOKIE ACK. + */ + ++ if (!sctp_auth_chunk_verify(net, chunk, asoc)) ++ return SCTP_DISPOSITION_DISCARD; ++ + /* Don't accidentally move back into established state. */ + if (asoc->state < SCTP_STATE_ESTABLISHED) { + sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP, +@@ -2000,7 +2009,7 @@ static enum sctp_disposition sctp_sf_do_dupcook_d( + } + } + +- repl = sctp_make_cookie_ack(new_asoc, chunk); ++ repl = sctp_make_cookie_ack(asoc, chunk); + if (!repl) + goto nomem; + +@@ -4111,10 +4120,7 @@ enum sctp_disposition sctp_sf_eat_fwd_tsn_fast( + * The return value is the disposition of the chunk. + */ + static enum sctp_ierror sctp_sf_authenticate( +- struct net *net, +- const struct sctp_endpoint *ep, + const struct sctp_association *asoc, +- const union sctp_subtype type, + struct sctp_chunk *chunk) + { + struct sctp_authhdr *auth_hdr; +@@ -4212,7 +4218,7 @@ enum sctp_disposition sctp_sf_eat_auth(struct net *net, + commands); + + auth_hdr = (struct sctp_authhdr *)chunk->skb->data; +- error = sctp_sf_authenticate(net, ep, asoc, type, chunk); ++ error = sctp_sf_authenticate(asoc, chunk); + switch (error) { + case SCTP_IERROR_AUTH_BAD_HMAC: + /* Generate the ERROR chunk and discard the rest +diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c +index 5447228bf1a0..8538c96c96c1 100644 +--- a/net/sctp/ulpevent.c ++++ b/net/sctp/ulpevent.c +@@ -717,7 +717,6 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc, + return event; + + fail_mark: +- sctp_chunk_put(chunk); + kfree_skb(skb); + fail: + return NULL; +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 282361ac0263..dfef930d1e50 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -87,6 +87,7 @@ int tls_push_sg(struct sock *sk, + size = sg->length - offset; + offset += sg->offset; + ++ ctx->in_tcp_sendpages = true; + while (1) { + if (sg_is_last(sg)) + sendpage_flags = flags; +@@ -107,6 +108,7 @@ int tls_push_sg(struct sock *sk, + offset -= sg->offset; + ctx->partially_sent_offset = offset; + ctx->partially_sent_record = (void *)sg; ++ ctx->in_tcp_sendpages = false; + return ret; + } + +@@ -121,6 +123,8 @@ int tls_push_sg(struct sock *sk, + } + + clear_bit(TLS_PENDING_CLOSED_RECORD, &ctx->flags); ++ ctx->in_tcp_sendpages = false; ++ ctx->sk_write_space(sk); + + return 0; + } +@@ -190,6 +194,10 @@ static void tls_write_space(struct sock *sk) + { + struct tls_context *ctx = tls_get_ctx(sk); + ++ /* We are already sending pages, ignore notification */ ++ if (ctx->in_tcp_sendpages) ++ return; ++ + if (!sk->sk_write_pending && tls_is_pending_closed_record(ctx)) { + gfp_t sk_allocation = sk->sk_allocation; + int rc; +diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c +index 3f6f6f8c9fa5..5b2409746ae0 100644 +--- a/net/xfrm/xfrm_input.c ++++ b/net/xfrm/xfrm_input.c +@@ -518,7 +518,7 @@ int xfrm_trans_queue(struct sk_buff *skb, + return -ENOBUFS; + + XFRM_TRANS_SKB_CB(skb)->finish = finish; +- skb_queue_tail(&trans->queue, skb); ++ __skb_queue_tail(&trans->queue, skb); + tasklet_schedule(&trans->tasklet); + return 0; + } +diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c +index 8f13fb57eab5..6c4ec69e11a0 100644 +--- a/net/xfrm/xfrm_state.c ++++ b/net/xfrm/xfrm_state.c +@@ -1345,6 +1345,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig, + + if (orig->aead) { + x->aead = xfrm_algo_aead_clone(orig->aead); ++ x->geniv = orig->geniv; + if (!x->aead) + goto error; + }
