commit: dadcce23d781a274174c9b0651ea614a170cb057 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Oct 6 11:33:23 2021 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Oct 6 11:33:23 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=dadcce23
Linux patch 4.4.286 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1285_linux-4.4.286.patch | 1021 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1025 insertions(+) diff --git a/0000_README b/0000_README index bd19b36..9700d52 100644 --- a/0000_README +++ b/0000_README @@ -1183,6 +1183,10 @@ Patch: 1284_linux-4.4.285.patch From: http://www.kernel.org Desc: Linux 4.4.285 +Patch: 1285_linux-4.4.286.patch +From: http://www.kernel.org +Desc: Linux 4.4.286 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1285_linux-4.4.286.patch b/1285_linux-4.4.286.patch new file mode 100644 index 0000000..58f6c0f --- /dev/null +++ b/1285_linux-4.4.286.patch @@ -0,0 +1,1021 @@ +diff --git a/Makefile b/Makefile +index 96cb7da465043..34ad8ef93d409 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 285 ++SUBLEVEL = 286 + EXTRAVERSION = + NAME = Blurry Fish Butt + +diff --git a/arch/alpha/include/asm/io.h b/arch/alpha/include/asm/io.h +index 355aec0867f4d..e55a5e6ab4608 100644 +--- a/arch/alpha/include/asm/io.h ++++ b/arch/alpha/include/asm/io.h +@@ -60,7 +60,7 @@ extern inline void set_hae(unsigned long new_hae) + * Change virtual addresses to physical addresses and vv. + */ + #ifdef USE_48_BIT_KSEG +-static inline unsigned long virt_to_phys(void *address) ++static inline unsigned long virt_to_phys(volatile void *address) + { + return (unsigned long)address - IDENT_ADDR; + } +@@ -70,7 +70,7 @@ static inline void * phys_to_virt(unsigned long address) + return (void *) (address + IDENT_ADDR); + } + #else +-static inline unsigned long virt_to_phys(void *address) ++static inline unsigned long virt_to_phys(volatile void *address) + { + unsigned long phys = (unsigned long)address; + +@@ -111,7 +111,7 @@ static inline dma_addr_t __deprecated isa_page_to_bus(struct page *page) + extern unsigned long __direct_map_base; + extern unsigned long __direct_map_size; + +-static inline unsigned long __deprecated virt_to_bus(void *address) ++static inline unsigned long __deprecated virt_to_bus(volatile void *address) + { + unsigned long phys = virt_to_phys(address); + unsigned long bus = phys + __direct_map_base; +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index 644f4326b3e75..dee4d691bc585 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -381,7 +381,7 @@ config ARM64_ERRATUM_1024718 + help + This option adds work around for Arm Cortex-A55 Erratum 1024718. + +- Affected Cortex-A55 cores (r0p0, r0p1, r1p0) could cause incorrect ++ Affected Cortex-A55 cores (all revisions) could cause incorrect + update of the hardware dirty bit when the DBM/AP bits are updated + without a break-before-make. The work around is to disable the usage + of hardware DBM locally on the affected cores. CPUs not affected by +diff --git a/arch/arm64/kernel/process.c b/arch/arm64/kernel/process.c +index 10d6627673cbf..6cd79888944e6 100644 +--- a/arch/arm64/kernel/process.c ++++ b/arch/arm64/kernel/process.c +@@ -55,7 +55,7 @@ + + #ifdef CONFIG_CC_STACKPROTECTOR + #include <linux/stackprotector.h> +-unsigned long __stack_chk_guard __read_mostly; ++unsigned long __stack_chk_guard __ro_after_init; + EXPORT_SYMBOL(__stack_chk_guard); + #endif + +diff --git a/arch/arm64/mm/proc.S b/arch/arm64/mm/proc.S +index f096367380075..0b095b75abeb7 100644 +--- a/arch/arm64/mm/proc.S ++++ b/arch/arm64/mm/proc.S +@@ -222,8 +222,8 @@ ENTRY(__cpu_setup) + cmp x9, #2 + b.lt 1f + #ifdef CONFIG_ARM64_ERRATUM_1024718 +- /* Disable hardware DBM on Cortex-A55 r0p0, r0p1 & r1p0 */ +- cpu_midr_match MIDR_CORTEX_A55, MIDR_CPU_VAR_REV(0, 0), MIDR_CPU_VAR_REV(1, 0), x1, x2, x3, x4 ++ /* Disable hardware DBM on Cortex-A55 all versions */ ++ cpu_midr_match MIDR_CORTEX_A55, MIDR_CPU_VAR_REV(0, 0), MIDR_CPU_VAR_REV(0xf, 0xf), x1, x2, x3, x4 + cbnz x1, 1f + #endif + orr x10, x10, #TCR_HD // hardware Dirty flag update +diff --git a/arch/m68k/include/asm/raw_io.h b/arch/m68k/include/asm/raw_io.h +index 932faa35655b1..2238232c360e9 100644 +--- a/arch/m68k/include/asm/raw_io.h ++++ b/arch/m68k/include/asm/raw_io.h +@@ -30,21 +30,21 @@ extern void __iounmap(void *addr, unsigned long size); + * two accesses to memory, which may be undesirable for some devices. + */ + #define in_8(addr) \ +- ({ u8 __v = (*(__force volatile u8 *) (addr)); __v; }) ++ ({ u8 __v = (*(__force volatile u8 *) (unsigned long)(addr)); __v; }) + #define in_be16(addr) \ +- ({ u16 __v = (*(__force volatile u16 *) (addr)); __v; }) ++ ({ u16 __v = (*(__force volatile u16 *) (unsigned long)(addr)); __v; }) + #define in_be32(addr) \ +- ({ u32 __v = (*(__force volatile u32 *) (addr)); __v; }) ++ ({ u32 __v = (*(__force volatile u32 *) (unsigned long)(addr)); __v; }) + #define in_le16(addr) \ +- ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (addr)); __v; }) ++ ({ u16 __v = le16_to_cpu(*(__force volatile __le16 *) (unsigned long)(addr)); __v; }) + #define in_le32(addr) \ +- ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (addr)); __v; }) ++ ({ u32 __v = le32_to_cpu(*(__force volatile __le32 *) (unsigned long)(addr)); __v; }) + +-#define out_8(addr,b) (void)((*(__force volatile u8 *) (addr)) = (b)) +-#define out_be16(addr,w) (void)((*(__force volatile u16 *) (addr)) = (w)) +-#define out_be32(addr,l) (void)((*(__force volatile u32 *) (addr)) = (l)) +-#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (addr)) = cpu_to_le16(w)) +-#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (addr)) = cpu_to_le32(l)) ++#define out_8(addr,b) (void)((*(__force volatile u8 *) (unsigned long)(addr)) = (b)) ++#define out_be16(addr,w) (void)((*(__force volatile u16 *) (unsigned long)(addr)) = (w)) ++#define out_be32(addr,l) (void)((*(__force volatile u32 *) (unsigned long)(addr)) = (l)) ++#define out_le16(addr,w) (void)((*(__force volatile __le16 *) (unsigned long)(addr)) = cpu_to_le16(w)) ++#define out_le32(addr,l) (void)((*(__force volatile __le32 *) (unsigned long)(addr)) = cpu_to_le32(l)) + + #define raw_inb in_8 + #define raw_inw in_be16 +diff --git a/arch/parisc/include/asm/page.h b/arch/parisc/include/asm/page.h +index 80e742a1c162f..088888fcf8df3 100644 +--- a/arch/parisc/include/asm/page.h ++++ b/arch/parisc/include/asm/page.h +@@ -174,7 +174,7 @@ extern int npmem_ranges; + #include <asm-generic/getorder.h> + #include <asm/pdc.h> + +-#define PAGE0 ((struct zeropage *)__PAGE_OFFSET) ++#define PAGE0 ((struct zeropage *)absolute_pointer(__PAGE_OFFSET)) + + /* DEFINITION OF THE ZERO-PAGE (PAG0) */ + /* based on work by Jason Eckhardt ([email protected]) */ +diff --git a/arch/sparc/kernel/mdesc.c b/arch/sparc/kernel/mdesc.c +index 6f80936e0eea4..75445ba7e237c 100644 +--- a/arch/sparc/kernel/mdesc.c ++++ b/arch/sparc/kernel/mdesc.c +@@ -37,6 +37,7 @@ struct mdesc_hdr { + u32 node_sz; /* node block size */ + u32 name_sz; /* name block size */ + u32 data_sz; /* data block size */ ++ char data[]; + } __attribute__((aligned(16))); + + struct mdesc_elem { +@@ -369,7 +370,7 @@ out: + + static struct mdesc_elem *node_block(struct mdesc_hdr *mdesc) + { +- return (struct mdesc_elem *) (mdesc + 1); ++ return (struct mdesc_elem *) mdesc->data; + } + + static void *name_block(struct mdesc_hdr *mdesc) +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index 79aff24eed653..28725a6ed5de0 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -861,8 +861,8 @@ static void xen_write_idt_entry(gate_desc *dt, int entrynum, const gate_desc *g) + preempt_enable(); + } + +-static void xen_convert_trap_info(const struct desc_ptr *desc, +- struct trap_info *traps) ++static unsigned xen_convert_trap_info(const struct desc_ptr *desc, ++ struct trap_info *traps, bool full) + { + unsigned in, out, count; + +@@ -872,17 +872,18 @@ static void xen_convert_trap_info(const struct desc_ptr *desc, + for (in = out = 0; in < count; in++) { + gate_desc *entry = (gate_desc*)(desc->address) + in; + +- if (cvt_gate_to_trap(in, entry, &traps[out])) ++ if (cvt_gate_to_trap(in, entry, &traps[out]) || full) + out++; + } +- traps[out].address = 0; ++ ++ return out; + } + + void xen_copy_trap_info(struct trap_info *traps) + { + const struct desc_ptr *desc = this_cpu_ptr(&idt_desc); + +- xen_convert_trap_info(desc, traps); ++ xen_convert_trap_info(desc, traps, true); + } + + /* Load a new IDT into Xen. In principle this can be per-CPU, so we +@@ -892,6 +893,7 @@ static void xen_load_idt(const struct desc_ptr *desc) + { + static DEFINE_SPINLOCK(lock); + static struct trap_info traps[257]; ++ unsigned out; + + trace_xen_cpu_load_idt(desc); + +@@ -899,7 +901,8 @@ static void xen_load_idt(const struct desc_ptr *desc) + + memcpy(this_cpu_ptr(&idt_desc), desc, sizeof(idt_desc)); + +- xen_convert_trap_info(desc, traps); ++ out = xen_convert_trap_info(desc, traps, false); ++ memset(&traps[out], 0, sizeof(traps[0])); + + xen_mc_flush(); + if (HYPERVISOR_set_trap_table(traps)) +diff --git a/drivers/edac/synopsys_edac.c b/drivers/edac/synopsys_edac.c +index fc153aea2f6cf..091f03852dcac 100644 +--- a/drivers/edac/synopsys_edac.c ++++ b/drivers/edac/synopsys_edac.c +@@ -371,7 +371,7 @@ static int synps_edac_init_csrows(struct mem_ctl_info *mci) + + for (j = 0; j < csi->nr_channels; j++) { + dimm = csi->channels[j]->dimm; +- dimm->edac_mode = EDAC_FLAG_SECDED; ++ dimm->edac_mode = EDAC_SECDED; + dimm->mtype = synps_edac_get_mtype(priv->baseaddr); + dimm->nr_pages = (size >> PAGE_SHIFT) / csi->nr_channels; + dimm->grain = SYNPS_EDAC_ERR_GRAIN; +diff --git a/drivers/hid/hid-betopff.c b/drivers/hid/hid-betopff.c +index 69cfc8dc6af1e..9b60efe6ec441 100644 +--- a/drivers/hid/hid-betopff.c ++++ b/drivers/hid/hid-betopff.c +@@ -59,15 +59,22 @@ static int betopff_init(struct hid_device *hid) + { + struct betopff_device *betopff; + struct hid_report *report; +- struct hid_input *hidinput = +- list_first_entry(&hid->inputs, struct hid_input, list); ++ struct hid_input *hidinput; + struct list_head *report_list = + &hid->report_enum[HID_OUTPUT_REPORT].report_list; +- struct input_dev *dev = hidinput->input; ++ struct input_dev *dev; + int field_count = 0; + int error; + int i, j; + ++ if (list_empty(&hid->inputs)) { ++ hid_err(hid, "no inputs found\n"); ++ return -ENODEV; ++ } ++ ++ hidinput = list_first_entry(&hid->inputs, struct hid_input, list); ++ dev = hidinput->input; ++ + if (list_empty(report_list)) { + hid_err(hid, "no output reports found\n"); + return -ENODEV; +diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c +index d51fc2be0e10c..c7da6ec4d923d 100644 +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -500,7 +500,7 @@ static void hid_ctrl(struct urb *urb) + + if (unplug) { + usbhid->ctrltail = usbhid->ctrlhead; +- } else { ++ } else if (usbhid->ctrlhead != usbhid->ctrltail) { + usbhid->ctrltail = (usbhid->ctrltail + 1) & (HID_CONTROL_FIFO_SIZE - 1); + + if (usbhid->ctrlhead != usbhid->ctrltail && +@@ -1185,9 +1185,20 @@ static void usbhid_stop(struct hid_device *hid) + usbhid->intf->needs_remote_wakeup = 0; + + clear_bit(HID_STARTED, &usbhid->iofl); ++ + spin_lock_irq(&usbhid->lock); /* Sync with error and led handlers */ + set_bit(HID_DISCONNECTED, &usbhid->iofl); ++ while (usbhid->ctrltail != usbhid->ctrlhead) { ++ if (usbhid->ctrl[usbhid->ctrltail].dir == USB_DIR_OUT) { ++ kfree(usbhid->ctrl[usbhid->ctrltail].raw_report); ++ usbhid->ctrl[usbhid->ctrltail].raw_report = NULL; ++ } ++ ++ usbhid->ctrltail = (usbhid->ctrltail + 1) & ++ (HID_CONTROL_FIFO_SIZE - 1); ++ } + spin_unlock_irq(&usbhid->lock); ++ + usb_kill_urb(usbhid->urbin); + usb_kill_urb(usbhid->urbout); + usb_kill_urb(usbhid->urbctrl); +diff --git a/drivers/ipack/devices/ipoctal.c b/drivers/ipack/devices/ipoctal.c +index 035d5449227e5..c1175464064be 100644 +--- a/drivers/ipack/devices/ipoctal.c ++++ b/drivers/ipack/devices/ipoctal.c +@@ -38,6 +38,7 @@ struct ipoctal_channel { + unsigned int pointer_read; + unsigned int pointer_write; + struct tty_port tty_port; ++ bool tty_registered; + union scc2698_channel __iomem *regs; + union scc2698_block __iomem *block_regs; + unsigned int board_id; +@@ -86,22 +87,34 @@ static int ipoctal_port_activate(struct tty_port *port, struct tty_struct *tty) + return 0; + } + +-static int ipoctal_open(struct tty_struct *tty, struct file *file) ++static int ipoctal_install(struct tty_driver *driver, struct tty_struct *tty) + { + struct ipoctal_channel *channel = dev_get_drvdata(tty->dev); + struct ipoctal *ipoctal = chan_to_ipoctal(channel, tty->index); +- int err; +- +- tty->driver_data = channel; ++ int res; + + if (!ipack_get_carrier(ipoctal->dev)) + return -EBUSY; + +- err = tty_port_open(&channel->tty_port, tty, file); +- if (err) +- ipack_put_carrier(ipoctal->dev); ++ res = tty_standard_install(driver, tty); ++ if (res) ++ goto err_put_carrier; ++ ++ tty->driver_data = channel; ++ ++ return 0; ++ ++err_put_carrier: ++ ipack_put_carrier(ipoctal->dev); ++ ++ return res; ++} ++ ++static int ipoctal_open(struct tty_struct *tty, struct file *file) ++{ ++ struct ipoctal_channel *channel = tty->driver_data; + +- return err; ++ return tty_port_open(&channel->tty_port, tty, file); + } + + static void ipoctal_reset_stats(struct ipoctal_stats *stats) +@@ -269,7 +282,6 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + int res; + int i; + struct tty_driver *tty; +- char name[20]; + struct ipoctal_channel *channel; + struct ipack_region *region; + void __iomem *addr; +@@ -360,8 +372,11 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + /* Fill struct tty_driver with ipoctal data */ + tty->owner = THIS_MODULE; + tty->driver_name = KBUILD_MODNAME; +- sprintf(name, KBUILD_MODNAME ".%d.%d.", bus_nr, slot); +- tty->name = name; ++ tty->name = kasprintf(GFP_KERNEL, KBUILD_MODNAME ".%d.%d.", bus_nr, slot); ++ if (!tty->name) { ++ res = -ENOMEM; ++ goto err_put_driver; ++ } + tty->major = 0; + + tty->minor_start = 0; +@@ -377,8 +392,7 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + res = tty_register_driver(tty); + if (res) { + dev_err(&ipoctal->dev->dev, "Can't register tty driver.\n"); +- put_tty_driver(tty); +- return res; ++ goto err_free_name; + } + + /* Save struct tty_driver for use it when uninstalling the device */ +@@ -389,7 +403,9 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + + channel = &ipoctal->channel[i]; + tty_port_init(&channel->tty_port); +- tty_port_alloc_xmit_buf(&channel->tty_port); ++ res = tty_port_alloc_xmit_buf(&channel->tty_port); ++ if (res) ++ continue; + channel->tty_port.ops = &ipoctal_tty_port_ops; + + ipoctal_reset_stats(&channel->stats); +@@ -397,13 +413,15 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + spin_lock_init(&channel->lock); + channel->pointer_read = 0; + channel->pointer_write = 0; +- tty_dev = tty_port_register_device(&channel->tty_port, tty, i, NULL); ++ tty_dev = tty_port_register_device_attr(&channel->tty_port, tty, ++ i, NULL, channel, NULL); + if (IS_ERR(tty_dev)) { + dev_err(&ipoctal->dev->dev, "Failed to register tty device.\n"); ++ tty_port_free_xmit_buf(&channel->tty_port); + tty_port_destroy(&channel->tty_port); + continue; + } +- dev_set_drvdata(tty_dev, channel); ++ channel->tty_registered = true; + } + + /* +@@ -415,6 +433,13 @@ static int ipoctal_inst_slot(struct ipoctal *ipoctal, unsigned int bus_nr, + ipoctal_irq_handler, ipoctal); + + return 0; ++ ++err_free_name: ++ kfree(tty->name); ++err_put_driver: ++ put_tty_driver(tty); ++ ++ return res; + } + + static inline int ipoctal_copy_write_buffer(struct ipoctal_channel *channel, +@@ -656,6 +681,7 @@ static void ipoctal_cleanup(struct tty_struct *tty) + + static const struct tty_operations ipoctal_fops = { + .ioctl = NULL, ++ .install = ipoctal_install, + .open = ipoctal_open, + .close = ipoctal_close, + .write = ipoctal_write_tty, +@@ -698,12 +724,17 @@ static void __ipoctal_remove(struct ipoctal *ipoctal) + + for (i = 0; i < NR_CHANNELS; i++) { + struct ipoctal_channel *channel = &ipoctal->channel[i]; ++ ++ if (!channel->tty_registered) ++ continue; ++ + tty_unregister_device(ipoctal->tty_drv, i); + tty_port_free_xmit_buf(&channel->tty_port); + tty_port_destroy(&channel->tty_port); + } + + tty_unregister_driver(ipoctal->tty_drv); ++ kfree(ipoctal->tty_drv->name); + put_tty_driver(ipoctal->tty_drv); + kfree(ipoctal); + } +diff --git a/drivers/net/ethernet/i825xx/82596.c b/drivers/net/ethernet/i825xx/82596.c +index 7ce6379fd1a36..1500027ae18b8 100644 +--- a/drivers/net/ethernet/i825xx/82596.c ++++ b/drivers/net/ethernet/i825xx/82596.c +@@ -1155,7 +1155,7 @@ struct net_device * __init i82596_probe(int unit) + err = -ENODEV; + goto out; + } +- memcpy(eth_addr, (void *) 0xfffc1f2c, ETH_ALEN); /* YUCK! Get addr from NOVRAM */ ++ memcpy(eth_addr, absolute_pointer(0xfffc1f2c), ETH_ALEN); /* YUCK! Get addr from NOVRAM */ + dev->base_addr = MVME_I596_BASE; + dev->irq = (unsigned) MVME16x_IRQ_I596; + goto found; +diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c +index 9035cb5fc70d3..aa556e4f9051e 100644 +--- a/drivers/net/ethernet/intel/e100.c ++++ b/drivers/net/ethernet/intel/e100.c +@@ -2462,11 +2462,15 @@ static void e100_get_drvinfo(struct net_device *netdev, + sizeof(info->bus_info)); + } + +-#define E100_PHY_REGS 0x1C ++#define E100_PHY_REGS 0x1D + static int e100_get_regs_len(struct net_device *netdev) + { + struct nic *nic = netdev_priv(netdev); +- return 1 + E100_PHY_REGS + sizeof(nic->mem->dump_buf); ++ ++ /* We know the number of registers, and the size of the dump buffer. ++ * Calculate the total size in bytes. ++ */ ++ return (1 + E100_PHY_REGS) * sizeof(u32) + sizeof(nic->mem->dump_buf); + } + + static void e100_get_regs(struct net_device *netdev, +@@ -2480,14 +2484,18 @@ static void e100_get_regs(struct net_device *netdev, + buff[0] = ioread8(&nic->csr->scb.cmd_hi) << 24 | + ioread8(&nic->csr->scb.cmd_lo) << 16 | + ioread16(&nic->csr->scb.status); +- for (i = E100_PHY_REGS; i >= 0; i--) +- buff[1 + E100_PHY_REGS - i] = +- mdio_read(netdev, nic->mii.phy_id, i); ++ for (i = 0; i < E100_PHY_REGS; i++) ++ /* Note that we read the registers in reverse order. This ++ * ordering is the ABI apparently used by ethtool and other ++ * applications. ++ */ ++ buff[1 + i] = mdio_read(netdev, nic->mii.phy_id, ++ E100_PHY_REGS - 1 - i); + memset(nic->mem->dump_buf, 0, sizeof(nic->mem->dump_buf)); + e100_exec_cb(nic, NULL, e100_dump); + msleep(10); +- memcpy(&buff[2 + E100_PHY_REGS], nic->mem->dump_buf, +- sizeof(nic->mem->dump_buf)); ++ memcpy(&buff[1 + E100_PHY_REGS], nic->mem->dump_buf, ++ sizeof(nic->mem->dump_buf)); + } + + static void e100_get_wol(struct net_device *netdev, struct ethtool_wolinfo *wol) +diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +index 112ce16717cda..b9014ec73b67c 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c ++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c +@@ -311,6 +311,9 @@ mlx4_en_filter_rfs(struct net_device *net_dev, const struct sk_buff *skb, + int nhoff = skb_network_offset(skb); + int ret = 0; + ++ if (skb->encapsulation) ++ return -EPROTONOSUPPORT; ++ + if (skb->protocol != htons(ETH_P_IP)) + return -EPROTONOSUPPORT; + +diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c +index cce901add6542..908de9e453944 100644 +--- a/drivers/net/hamradio/6pack.c ++++ b/drivers/net/hamradio/6pack.c +@@ -68,9 +68,9 @@ + #define SIXP_DAMA_OFF 0 + + /* default level 2 parameters */ +-#define SIXP_TXDELAY (HZ/4) /* in 1 s */ ++#define SIXP_TXDELAY 25 /* 250 ms */ + #define SIXP_PERSIST 50 /* in 256ths */ +-#define SIXP_SLOTTIME (HZ/10) /* in 1 s */ ++#define SIXP_SLOTTIME 10 /* 100 ms */ + #define SIXP_INIT_RESYNC_TIMEOUT (3*HZ/2) /* in 1 s */ + #define SIXP_RESYNC_TIMEOUT 5*HZ /* in 1 s */ + +diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c +index 5d988829f7d52..e6f272019da0d 100644 +--- a/drivers/net/usb/hso.c ++++ b/drivers/net/usb/hso.c +@@ -2729,14 +2729,14 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, + + serial = kzalloc(sizeof(*serial), GFP_KERNEL); + if (!serial) +- goto exit; ++ goto err_free_dev; + + hso_dev->port_data.dev_serial = serial; + serial->parent = hso_dev; + + if (hso_serial_common_create + (serial, 1, CTRL_URB_RX_SIZE, CTRL_URB_TX_SIZE)) +- goto exit; ++ goto err_free_serial; + + serial->tx_data_length--; + serial->write_data = hso_mux_serial_write_data; +@@ -2752,11 +2752,9 @@ struct hso_device *hso_create_mux_serial_device(struct usb_interface *interface, + /* done, return it */ + return hso_dev; + +-exit: +- if (serial) { +- tty_unregister_device(tty_drv, serial->minor); +- kfree(serial); +- } ++err_free_serial: ++ kfree(serial); ++err_free_dev: + kfree(hso_dev); + return NULL; + +diff --git a/drivers/scsi/scsi_transport_iscsi.c b/drivers/scsi/scsi_transport_iscsi.c +index 39d03300d3d9a..9906a3b562e93 100644 +--- a/drivers/scsi/scsi_transport_iscsi.c ++++ b/drivers/scsi/scsi_transport_iscsi.c +@@ -429,9 +429,7 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, + struct iscsi_transport *t = iface->transport; + int param = -1; + +- if (attr == &dev_attr_iface_enabled.attr) +- param = ISCSI_NET_PARAM_IFACE_ENABLE; +- else if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) ++ if (attr == &dev_attr_iface_def_taskmgmt_tmo.attr) + param = ISCSI_IFACE_PARAM_DEF_TASKMGMT_TMO; + else if (attr == &dev_attr_iface_header_digest.attr) + param = ISCSI_IFACE_PARAM_HDRDGST_EN; +@@ -471,7 +469,9 @@ static umode_t iscsi_iface_attr_is_visible(struct kobject *kobj, + if (param != -1) + return t->attr_is_visible(ISCSI_IFACE_PARAM, param); + +- if (attr == &dev_attr_iface_vlan_id.attr) ++ if (attr == &dev_attr_iface_enabled.attr) ++ param = ISCSI_NET_PARAM_IFACE_ENABLE; ++ else if (attr == &dev_attr_iface_vlan_id.attr) + param = ISCSI_NET_PARAM_VLAN_ID; + else if (attr == &dev_attr_iface_vlan_priority.attr) + param = ISCSI_NET_PARAM_VLAN_PRIORITY; +diff --git a/drivers/spi/spi-tegra20-slink.c b/drivers/spi/spi-tegra20-slink.c +index 9f14560686b68..88bfe7682a9eb 100644 +--- a/drivers/spi/spi-tegra20-slink.c ++++ b/drivers/spi/spi-tegra20-slink.c +@@ -1210,7 +1210,7 @@ static int tegra_slink_resume(struct device *dev) + } + #endif + +-static int tegra_slink_runtime_suspend(struct device *dev) ++static int __maybe_unused tegra_slink_runtime_suspend(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); + struct tegra_slink_data *tspi = spi_master_get_devdata(master); +@@ -1222,7 +1222,7 @@ static int tegra_slink_runtime_suspend(struct device *dev) + return 0; + } + +-static int tegra_slink_runtime_resume(struct device *dev) ++static int __maybe_unused tegra_slink_runtime_resume(struct device *dev) + { + struct spi_master *master = dev_get_drvdata(dev); + struct tegra_slink_data *tspi = spi_master_get_devdata(master); +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index 9f479b4c64919..0fab196a1d90b 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -882,8 +882,25 @@ static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, + new_row_size = new_cols << 1; + new_screen_size = new_row_size * new_rows; + +- if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) +- return 0; ++ if (new_cols == vc->vc_cols && new_rows == vc->vc_rows) { ++ /* ++ * This function is being called here to cover the case ++ * where the userspace calls the FBIOPUT_VSCREENINFO twice, ++ * passing the same fb_var_screeninfo containing the fields ++ * yres/xres equal to a number non-multiple of vc_font.height ++ * and yres_virtual/xres_virtual equal to number lesser than the ++ * vc_font.height and yres/xres. ++ * In the second call, the struct fb_var_screeninfo isn't ++ * being modified by the underlying driver because of the ++ * if above, and this causes the fbcon_display->vrows to become ++ * negative and it eventually leads to out-of-bound ++ * access by the imageblit function. ++ * To give the correct values to the struct and to not have ++ * to deal with possible errors from the code below, we call ++ * the resize_screen here as well. ++ */ ++ return resize_screen(vc, new_cols, new_rows, user); ++ } + + if (new_screen_size > (4 << 20)) + return -EINVAL; +diff --git a/drivers/usb/gadget/udc/r8a66597-udc.c b/drivers/usb/gadget/udc/r8a66597-udc.c +index 4eb8e181763d1..ffe6cb4c78ffb 100644 +--- a/drivers/usb/gadget/udc/r8a66597-udc.c ++++ b/drivers/usb/gadget/udc/r8a66597-udc.c +@@ -1253,7 +1253,7 @@ static void set_feature(struct r8a66597 *r8a66597, struct usb_ctrlrequest *ctrl) + do { + tmp = r8a66597_read(r8a66597, INTSTS0) & CTSQ; + udelay(1); +- } while (tmp != CS_IDST || timeout-- > 0); ++ } while (tmp != CS_IDST && timeout-- > 0); + + if (tmp == CS_IDST) + r8a66597_bset(r8a66597, +diff --git a/drivers/usb/musb/tusb6010.c b/drivers/usb/musb/tusb6010.c +index df7c9f46be548..85a57385958fd 100644 +--- a/drivers/usb/musb/tusb6010.c ++++ b/drivers/usb/musb/tusb6010.c +@@ -193,6 +193,7 @@ tusb_fifo_write_unaligned(void __iomem *fifo, const u8 *buf, u16 len) + } + if (len > 0) { + /* Write the rest 1 - 3 bytes to FIFO */ ++ val = 0; + memcpy(&val, buf, len); + musb_writel(fifo, 0, val); + } +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index f039b85d5f57f..0fbdfea7ec2c1 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -230,6 +230,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1FB9, 0x0602) }, /* Lake Shore Model 648 Magnet Power Supply */ + { USB_DEVICE(0x1FB9, 0x0700) }, /* Lake Shore Model 737 VSM Controller */ + { USB_DEVICE(0x1FB9, 0x0701) }, /* Lake Shore Model 776 Hall Matrix */ ++ { USB_DEVICE(0x2184, 0x0030) }, /* GW Instek GDM-834x Digital Multimeter */ + { USB_DEVICE(0x2626, 0xEA60) }, /* Aruba Networks 7xxx USB Serial Console */ + { USB_DEVICE(0x3195, 0xF190) }, /* Link Instruments MSO-19 */ + { USB_DEVICE(0x3195, 0xF280) }, /* Link Instruments MSO-28 */ +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index 7a9b9542882fd..8a94c85428d9e 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -126,7 +126,6 @@ + #define BANDB_DEVICE_ID_USOPTL4_2P 0xBC02 + #define BANDB_DEVICE_ID_USOPTL4_4 0xAC44 + #define BANDB_DEVICE_ID_USOPTL4_4P 0xBC03 +-#define BANDB_DEVICE_ID_USOPTL2_4 0xAC24 + + /* This driver also supports + * ATEN UC2324 device using Moschip MCS7840 +@@ -207,7 +206,6 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_2P)}, + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4)}, + {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL4_4P)}, +- {USB_DEVICE(USB_VENDOR_ID_BANDB, BANDB_DEVICE_ID_USOPTL2_4)}, + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2324)}, + {USB_DEVICE(USB_VENDOR_ID_ATENINTL, ATENINTL_DEVICE_ID_UC2322)}, + {USB_DEVICE(USB_VENDOR_ID_MOXA, MOXA_DEVICE_ID_2210)}, +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 02ded56bcbc6b..ec8ad931f41e3 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -1187,6 +1187,14 @@ static const struct usb_device_id option_ids[] = { + .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1056, 0xff), /* Telit FD980 */ + .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1060, 0xff), /* Telit LN920 (rmnet) */ ++ .driver_info = NCTRL(0) | RSVD(1) | RSVD(2) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1061, 0xff), /* Telit LN920 (MBIM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1062, 0xff), /* Telit LN920 (RNDIS) */ ++ .driver_info = NCTRL(2) | RSVD(3) }, ++ { USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1063, 0xff), /* Telit LN920 (ECM) */ ++ .driver_info = NCTRL(0) | RSVD(1) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910), + .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) }, + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM), +@@ -1632,7 +1640,6 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0060, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff), + .driver_info = RSVD(1) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff), +@@ -2052,6 +2059,8 @@ static const struct usb_device_id option_ids[] = { + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, + { USB_DEVICE(0x0489, 0xe0b5), /* Foxconn T77W968 ESIM */ + .driver_info = RSVD(0) | RSVD(1) | RSVD(6) }, ++ { USB_DEVICE_INTERFACE_CLASS(0x0489, 0xe0db, 0xff), /* Foxconn T99W265 MBIM */ ++ .driver_info = RSVD(3) }, + { USB_DEVICE(0x1508, 0x1001), /* Fibocom NL668 (IOT version) */ + .driver_info = RSVD(4) | RSVD(5) | RSVD(6) }, + { USB_DEVICE(0x2cb7, 0x0104), /* Fibocom NL678 series */ +diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c +index 71c9ed70aa683..cda22b312a4c1 100644 +--- a/fs/cifs/connect.c ++++ b/fs/cifs/connect.c +@@ -2961,9 +2961,10 @@ cifs_match_super(struct super_block *sb, void *data) + spin_lock(&cifs_tcp_ses_lock); + cifs_sb = CIFS_SB(sb); + tlink = cifs_get_tlink(cifs_sb_master_tlink(cifs_sb)); +- if (IS_ERR(tlink)) { ++ if (tlink == NULL) { ++ /* can not match superblock if tlink were ever null */ + spin_unlock(&cifs_tcp_ses_lock); +- return rc; ++ return 0; + } + tcon = tlink_tcon(tlink); + ses = tcon->ses; +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c +index 7b626e942987f..96dc313d6251b 100644 +--- a/fs/ext4/dir.c ++++ b/fs/ext4/dir.c +@@ -521,7 +521,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + struct dir_private_info *info = file->private_data; + struct inode *inode = file_inode(file); + struct fname *fname; +- int ret; ++ int ret = 0; + + if (!info) { + info = ext4_htree_create_dir_info(file, ctx->pos); +@@ -569,7 +569,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + info->curr_minor_hash, + &info->next_hash); + if (ret < 0) +- return ret; ++ goto finished; + if (ret == 0) { + ctx->pos = ext4_get_htree_eof(file); + break; +@@ -600,7 +600,7 @@ static int ext4_dx_readdir(struct file *file, struct dir_context *ctx) + } + finished: + info->last_pos = ctx->pos; +- return 0; ++ return ret < 0 ? ret : 0; + } + + static int ext4_dir_open(struct inode * inode, struct file * filp) +diff --git a/fs/qnx4/dir.c b/fs/qnx4/dir.c +index b218f965817bf..613cc38c9efad 100644 +--- a/fs/qnx4/dir.c ++++ b/fs/qnx4/dir.c +@@ -14,13 +14,48 @@ + #include <linux/buffer_head.h> + #include "qnx4.h" + ++/* ++ * A qnx4 directory entry is an inode entry or link info ++ * depending on the status field in the last byte. The ++ * first byte is where the name start either way, and a ++ * zero means it's empty. ++ * ++ * Also, due to a bug in gcc, we don't want to use the ++ * real (differently sized) name arrays in the inode and ++ * link entries, but always the 'de_name[]' one in the ++ * fake struct entry. ++ * ++ * See ++ * ++ * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99578#c6 ++ * ++ * for details, but basically gcc will take the size of the ++ * 'name' array from one of the used union entries randomly. ++ * ++ * This use of 'de_name[]' (48 bytes) avoids the false positive ++ * warnings that would happen if gcc decides to use 'inode.di_name' ++ * (16 bytes) even when the pointer and size were to come from ++ * 'link.dl_name' (48 bytes). ++ * ++ * In all cases the actual name pointer itself is the same, it's ++ * only the gcc internal 'what is the size of this field' logic ++ * that can get confused. ++ */ ++union qnx4_directory_entry { ++ struct { ++ const char de_name[48]; ++ u8 de_pad[15]; ++ u8 de_status; ++ }; ++ struct qnx4_inode_entry inode; ++ struct qnx4_link_info link; ++}; ++ + static int qnx4_readdir(struct file *file, struct dir_context *ctx) + { + struct inode *inode = file_inode(file); + unsigned int offset; + struct buffer_head *bh; +- struct qnx4_inode_entry *de; +- struct qnx4_link_info *le; + unsigned long blknum; + int ix, ino; + int size; +@@ -37,27 +72,27 @@ static int qnx4_readdir(struct file *file, struct dir_context *ctx) + } + ix = (ctx->pos >> QNX4_DIR_ENTRY_SIZE_BITS) % QNX4_INODES_PER_BLOCK; + for (; ix < QNX4_INODES_PER_BLOCK; ix++, ctx->pos += QNX4_DIR_ENTRY_SIZE) { ++ union qnx4_directory_entry *de; ++ + offset = ix * QNX4_DIR_ENTRY_SIZE; +- de = (struct qnx4_inode_entry *) (bh->b_data + offset); +- if (!de->di_fname[0]) ++ de = (union qnx4_directory_entry *) (bh->b_data + offset); ++ ++ if (!de->de_name[0]) + continue; +- if (!(de->di_status & (QNX4_FILE_USED|QNX4_FILE_LINK))) ++ if (!(de->de_status & (QNX4_FILE_USED|QNX4_FILE_LINK))) + continue; +- if (!(de->di_status & QNX4_FILE_LINK)) +- size = QNX4_SHORT_NAME_MAX; +- else +- size = QNX4_NAME_MAX; +- size = strnlen(de->di_fname, size); +- QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, de->di_fname)); +- if (!(de->di_status & QNX4_FILE_LINK)) ++ if (!(de->de_status & QNX4_FILE_LINK)) { ++ size = sizeof(de->inode.di_fname); + ino = blknum * QNX4_INODES_PER_BLOCK + ix - 1; +- else { +- le = (struct qnx4_link_info*)de; +- ino = ( le32_to_cpu(le->dl_inode_blk) - 1 ) * ++ } else { ++ size = sizeof(de->link.dl_fname); ++ ino = ( le32_to_cpu(de->link.dl_inode_blk) - 1 ) * + QNX4_INODES_PER_BLOCK + +- le->dl_inode_ndx; ++ de->link.dl_inode_ndx; + } +- if (!dir_emit(ctx, de->di_fname, size, ino, DT_UNKNOWN)) { ++ size = strnlen(de->de_name, size); ++ QNX4DEBUG((KERN_INFO "qnx4_readdir:%.*s\n", size, name)); ++ if (!dir_emit(ctx, de->de_name, size, ino, DT_UNKNOWN)) { + brelse(bh); + return 0; + } +diff --git a/include/linux/compiler.h b/include/linux/compiler.h +index 7cabe0cc86651..bc8077e5e688e 100644 +--- a/include/linux/compiler.h ++++ b/include/linux/compiler.h +@@ -208,6 +208,8 @@ void ftrace_likely_update(struct ftrace_branch_data *f, int val, int expect); + (typeof(ptr)) (__ptr + (off)); }) + #endif + ++#define absolute_pointer(val) RELOC_HIDE((void *)(val), 0) ++ + #ifndef OPTIMIZER_HIDE_VAR + #define OPTIMIZER_HIDE_VAR(var) barrier() + #endif +diff --git a/include/linux/cred.h b/include/linux/cred.h +index d2db1da3036c4..ee2b36cdb80d8 100644 +--- a/include/linux/cred.h ++++ b/include/linux/cred.h +@@ -243,7 +243,7 @@ static inline struct cred *get_new_cred(struct cred *cred) + * @cred: The credentials to reference + * + * Get a reference on the specified set of credentials. The caller must +- * release the reference. ++ * release the reference. If %NULL is passed, it is returned with no action. + * + * This is used to deal with a committed set of credentials. Although the + * pointer is const, this will temporarily discard the const and increment the +@@ -254,6 +254,8 @@ static inline struct cred *get_new_cred(struct cred *cred) + static inline const struct cred *get_cred(const struct cred *cred) + { + struct cred *nonconst_cred = (struct cred *) cred; ++ if (!cred) ++ return cred; + validate_creds(cred); + nonconst_cred->non_rcu = 0; + return get_new_cred(nonconst_cred); +@@ -264,7 +266,7 @@ static inline const struct cred *get_cred(const struct cred *cred) + * @cred: The credentials to release + * + * Release a reference to a set of credentials, deleting them when the last ref +- * is released. ++ * is released. If %NULL is passed, nothing is done. + * + * This takes a const pointer to a set of credentials because the credentials + * on task_struct are attached by const pointers to prevent accidental +@@ -274,9 +276,11 @@ static inline void put_cred(const struct cred *_cred) + { + struct cred *cred = (struct cred *) _cred; + +- validate_creds(cred); +- if (atomic_dec_and_test(&(cred)->usage)) +- __put_cred(cred); ++ if (cred) { ++ validate_creds(cred); ++ if (atomic_dec_and_test(&(cred)->usage)) ++ __put_cred(cred); ++ } + } + + /** +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c +index 8ac3663e0012d..c142e100840e4 100644 +--- a/kernel/trace/blktrace.c ++++ b/kernel/trace/blktrace.c +@@ -1581,6 +1581,14 @@ static int blk_trace_remove_queue(struct request_queue *q) + if (bt == NULL) + return -EINVAL; + ++ if (bt->trace_state == Blktrace_running) { ++ bt->trace_state = Blktrace_stopped; ++ spin_lock_irq(&running_trace_lock); ++ list_del_init(&bt->running_list); ++ spin_unlock_irq(&running_trace_lock); ++ relay_flush(bt->rchan); ++ } ++ + put_probe_ref(); + synchronize_rcu(); + blk_trace_free(bt); +diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c +index 921115327ec8f..3884bb1a59dd0 100644 +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -519,6 +519,9 @@ ieee80211_crypto_ccmp_decrypt(struct ieee80211_rx_data *rx, + return RX_DROP_UNUSABLE; + } + ++ /* reload hdr - skb might have been reallocated */ ++ hdr = (void *)rx->skb->data; ++ + data_len = skb->len - hdrlen - IEEE80211_CCMP_HDR_LEN - mic_len; + if (!rx->sta || data_len < 0) + return RX_DROP_UNUSABLE; +@@ -751,6 +754,9 @@ ieee80211_crypto_gcmp_decrypt(struct ieee80211_rx_data *rx) + return RX_DROP_UNUSABLE; + } + ++ /* reload hdr - skb might have been reallocated */ ++ hdr = (void *)rx->skb->data; ++ + data_len = skb->len - hdrlen - IEEE80211_GCMP_HDR_LEN - mic_len; + if (!rx->sta || data_len < 0) + return RX_DROP_UNUSABLE; +diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h +index da0aa720da6fd..7b69d1ad8f3eb 100644 +--- a/net/netfilter/ipset/ip_set_hash_gen.h ++++ b/net/netfilter/ipset/ip_set_hash_gen.h +@@ -102,11 +102,11 @@ htable_size(u8 hbits) + { + size_t hsize; + +- /* We must fit both into u32 in jhash and size_t */ ++ /* We must fit both into u32 in jhash and INT_MAX in kvmalloc_node() */ + if (hbits > 31) + return 0; + hsize = jhash_size(hbits); +- if ((((size_t)-1) - sizeof(struct htable)) / sizeof(struct hbucket *) ++ if ((INT_MAX - sizeof(struct htable)) / sizeof(struct hbucket *) + < hsize) + return 0; + +diff --git a/net/netfilter/ipvs/ip_vs_conn.c b/net/netfilter/ipvs/ip_vs_conn.c +index 85ca189bdc3d2..de196dd95dcdf 100644 +--- a/net/netfilter/ipvs/ip_vs_conn.c ++++ b/net/netfilter/ipvs/ip_vs_conn.c +@@ -1368,6 +1368,10 @@ int __init ip_vs_conn_init(void) + int idx; + + /* Compute size and mask */ ++ if (ip_vs_conn_tab_bits < 8 || ip_vs_conn_tab_bits > 20) { ++ pr_info("conn_tab_bits not in [8, 20]. Using default value\n"); ++ ip_vs_conn_tab_bits = CONFIG_IP_VS_TAB_BITS; ++ } + ip_vs_conn_tab_size = 1 << ip_vs_conn_tab_bits; + ip_vs_conn_tab_mask = ip_vs_conn_tab_size - 1; +
