commit: b5b810b63ae2eef210cd178f28871681852474e3 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Jan 11 14:50:23 2022 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Jan 11 14:50:23 2022 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b5b810b6
Linuxpatch 5.10.91 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1090_linux-5.10.91.patch | 1279 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1283 insertions(+) diff --git a/0000_README b/0000_README index 46422e5d..9e878b9b 100644 --- a/0000_README +++ b/0000_README @@ -403,6 +403,10 @@ Patch: 1089_linux-5.10.90.patch From: http://www.kernel.org Desc: Linux 5.10.90 +Patch: 1090_linux-5.10.91.patch +From: http://www.kernel.org +Desc: Linux 5.10.91 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1090_linux-5.10.91.patch b/1090_linux-5.10.91.patch new file mode 100644 index 00000000..8527a5d8 --- /dev/null +++ b/1090_linux-5.10.91.patch @@ -0,0 +1,1279 @@ +diff --git a/Makefile b/Makefile +index 556241a10821f..c8d677c7eaa11 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 10 +-SUBLEVEL = 90 ++SUBLEVEL = 91 + EXTRAVERSION = + NAME = Dare mighty things + +diff --git a/arch/arm/boot/dts/bcm2711.dtsi b/arch/arm/boot/dts/bcm2711.dtsi +index 4ade854bdcdaf..55ec83bde5a61 100644 +--- a/arch/arm/boot/dts/bcm2711.dtsi ++++ b/arch/arm/boot/dts/bcm2711.dtsi +@@ -555,6 +555,8 @@ + <GIC_SPI 115 IRQ_TYPE_LEVEL_HIGH>, + <GIC_SPI 116 IRQ_TYPE_LEVEL_HIGH>; + ++ gpio-ranges = <&gpio 0 0 58>; ++ + gpclk0_gpio49: gpclk0_gpio49 { + pin-gpclk { + pins = "gpio49"; +diff --git a/arch/arm/boot/dts/bcm283x.dtsi b/arch/arm/boot/dts/bcm283x.dtsi +index 0f3be55201a5b..ffdf7c4fba465 100644 +--- a/arch/arm/boot/dts/bcm283x.dtsi ++++ b/arch/arm/boot/dts/bcm283x.dtsi +@@ -126,6 +126,8 @@ + interrupt-controller; + #interrupt-cells = <2>; + ++ gpio-ranges = <&gpio 0 0 54>; ++ + /* Defines common pin muxing groups + * + * While each pin can have its mux selected +diff --git a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c +index b24c8ae8b1ece..7e228c181b298 100644 +--- a/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c ++++ b/drivers/gpu/drm/amd/display/dc/dcn10/dcn10_init.c +@@ -77,6 +77,7 @@ static const struct hw_sequencer_funcs dcn10_funcs = { + .get_clock = dcn10_get_clock, + .get_vupdate_offset_from_vsync = dcn10_get_vupdate_offset_from_vsync, + .calc_vupdate_position = dcn10_calc_vupdate_position, ++ .power_down = dce110_power_down, + .set_backlight_level = dce110_set_backlight_level, + .set_abm_immediate_disable = dce110_set_abm_immediate_disable, + .set_pipe = dce110_set_pipe, +diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c +index b8d715c68ca44..11a0806469162 100644 +--- a/drivers/infiniband/core/uverbs_marshall.c ++++ b/drivers/infiniband/core/uverbs_marshall.c +@@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_device *device, + struct rdma_ah_attr *src = ah_attr; + struct rdma_ah_attr conv_ah; + +- memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved)); ++ memset(&dst->grh, 0, sizeof(dst->grh)); + + if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) && + (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) && +diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c +index 5addc8fae3f3b..91dbcb3c252d6 100644 +--- a/drivers/infiniband/core/uverbs_uapi.c ++++ b/drivers/infiniband/core/uverbs_uapi.c +@@ -450,6 +450,9 @@ static int uapi_finalize(struct uverbs_api *uapi) + uapi->num_write_ex = max_write_ex + 1; + data = kmalloc_array(uapi->num_write + uapi->num_write_ex, + sizeof(*uapi->write_methods), GFP_KERNEL); ++ if (!data) ++ return -ENOMEM; ++ + for (i = 0; i != uapi->num_write + uapi->num_write_ex; i++) + data[i] = &uapi->notsupp_method; + uapi->write_methods = data; +diff --git a/drivers/input/touchscreen/zinitix.c b/drivers/input/touchscreen/zinitix.c +index fd8b4e9f08a21..6df6f07f1ac66 100644 +--- a/drivers/input/touchscreen/zinitix.c ++++ b/drivers/input/touchscreen/zinitix.c +@@ -488,6 +488,15 @@ static int zinitix_ts_probe(struct i2c_client *client) + return error; + } + ++ error = devm_request_threaded_irq(&client->dev, client->irq, ++ NULL, zinitix_ts_irq_handler, ++ IRQF_ONESHOT, ++ client->name, bt541); ++ if (error) { ++ dev_err(&client->dev, "Failed to request IRQ: %d\n", error); ++ return error; ++ } ++ + error = zinitix_init_input_dev(bt541); + if (error) { + dev_err(&client->dev, +@@ -514,13 +523,6 @@ static int zinitix_ts_probe(struct i2c_client *client) + } + + irq_set_status_flags(client->irq, IRQ_NOAUTOEN); +- error = devm_request_threaded_irq(&client->dev, client->irq, +- NULL, zinitix_ts_irq_handler, +- IRQF_ONESHOT, client->name, bt541); +- if (error) { +- dev_err(&client->dev, "Failed to request IRQ: %d\n", error); +- return error; +- } + + return 0; + } +diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c +index 55891e4204460..a41b4b2645941 100644 +--- a/drivers/isdn/mISDN/core.c ++++ b/drivers/isdn/mISDN/core.c +@@ -381,7 +381,7 @@ mISDNInit(void) + err = mISDN_inittimer(&debug); + if (err) + goto error2; +- err = l1_init(&debug); ++ err = Isdnl1_Init(&debug); + if (err) + goto error3; + err = Isdnl2_Init(&debug); +@@ -395,7 +395,7 @@ mISDNInit(void) + error5: + Isdnl2_cleanup(); + error4: +- l1_cleanup(); ++ Isdnl1_cleanup(); + error3: + mISDN_timer_cleanup(); + error2: +@@ -408,7 +408,7 @@ static void mISDN_cleanup(void) + { + misdn_sock_cleanup(); + Isdnl2_cleanup(); +- l1_cleanup(); ++ Isdnl1_cleanup(); + mISDN_timer_cleanup(); + class_unregister(&mISDN_class); + +diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h +index 23b44d3033279..42599f49c189d 100644 +--- a/drivers/isdn/mISDN/core.h ++++ b/drivers/isdn/mISDN/core.h +@@ -60,8 +60,8 @@ struct Bprotocol *get_Bprotocol4id(u_int); + extern int mISDN_inittimer(u_int *); + extern void mISDN_timer_cleanup(void); + +-extern int l1_init(u_int *); +-extern void l1_cleanup(void); ++extern int Isdnl1_Init(u_int *); ++extern void Isdnl1_cleanup(void); + extern int Isdnl2_Init(u_int *); + extern void Isdnl2_cleanup(void); + +diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c +index 98a3bc6c17009..7b31c25a550e3 100644 +--- a/drivers/isdn/mISDN/layer1.c ++++ b/drivers/isdn/mISDN/layer1.c +@@ -398,7 +398,7 @@ create_l1(struct dchannel *dch, dchannel_l1callback *dcb) { + EXPORT_SYMBOL(create_l1); + + int +-l1_init(u_int *deb) ++Isdnl1_Init(u_int *deb) + { + debug = deb; + l1fsm_s.state_count = L1S_STATE_COUNT; +@@ -409,7 +409,7 @@ l1_init(u_int *deb) + } + + void +-l1_cleanup(void) ++Isdnl1_cleanup(void) + { + mISDN_FsmFree(&l1fsm_s); + } +diff --git a/drivers/net/ethernet/amazon/ena/ena_netdev.c b/drivers/net/ethernet/amazon/ena/ena_netdev.c +index df1884d57d1a0..52414ac2c901a 100644 +--- a/drivers/net/ethernet/amazon/ena/ena_netdev.c ++++ b/drivers/net/ethernet/amazon/ena/ena_netdev.c +@@ -1199,26 +1199,22 @@ static int handle_invalid_req_id(struct ena_ring *ring, u16 req_id, + + static int validate_tx_req_id(struct ena_ring *tx_ring, u16 req_id) + { +- struct ena_tx_buffer *tx_info = NULL; ++ struct ena_tx_buffer *tx_info; + +- if (likely(req_id < tx_ring->ring_size)) { +- tx_info = &tx_ring->tx_buffer_info[req_id]; +- if (likely(tx_info->skb)) +- return 0; +- } ++ tx_info = &tx_ring->tx_buffer_info[req_id]; ++ if (likely(tx_info->skb)) ++ return 0; + + return handle_invalid_req_id(tx_ring, req_id, tx_info, false); + } + + static int validate_xdp_req_id(struct ena_ring *xdp_ring, u16 req_id) + { +- struct ena_tx_buffer *tx_info = NULL; ++ struct ena_tx_buffer *tx_info; + +- if (likely(req_id < xdp_ring->ring_size)) { +- tx_info = &xdp_ring->tx_buffer_info[req_id]; +- if (likely(tx_info->xdpf)) +- return 0; +- } ++ tx_info = &xdp_ring->tx_buffer_info[req_id]; ++ if (likely(tx_info->xdpf)) ++ return 0; + + return handle_invalid_req_id(xdp_ring, req_id, tx_info, true); + } +@@ -1243,9 +1239,14 @@ static int ena_clean_tx_irq(struct ena_ring *tx_ring, u32 budget) + + rc = ena_com_tx_comp_req_id_get(tx_ring->ena_com_io_cq, + &req_id); +- if (rc) ++ if (rc) { ++ if (unlikely(rc == -EINVAL)) ++ handle_invalid_req_id(tx_ring, req_id, NULL, ++ false); + break; ++ } + ++ /* validate that the request id points to a valid skb */ + rc = validate_tx_req_id(tx_ring, req_id); + if (rc) + break; +@@ -1801,9 +1802,14 @@ static int ena_clean_xdp_irq(struct ena_ring *xdp_ring, u32 budget) + + rc = ena_com_tx_comp_req_id_get(xdp_ring->ena_com_io_cq, + &req_id); +- if (rc) ++ if (rc) { ++ if (unlikely(rc == -EINVAL)) ++ handle_invalid_req_id(xdp_ring, req_id, NULL, ++ true); + break; ++ } + ++ /* validate that the request id points to a valid xdp_frame */ + rc = validate_xdp_req_id(xdp_ring, req_id); + if (rc) + break; +@@ -3921,10 +3927,6 @@ static u32 ena_calc_max_io_queue_num(struct pci_dev *pdev, + max_num_io_queues = min_t(u32, max_num_io_queues, io_tx_cq_num); + /* 1 IRQ for for mgmnt and 1 IRQs for each IO direction */ + max_num_io_queues = min_t(u32, max_num_io_queues, pci_msix_vec_count(pdev) - 1); +- if (unlikely(!max_num_io_queues)) { +- dev_err(&pdev->dev, "The device doesn't have io queues\n"); +- return -EFAULT; +- } + + return max_num_io_queues; + } +diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +index 24122ccda614c..72f8751784c31 100644 +--- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c ++++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c +@@ -365,6 +365,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + if (!buff->is_eop) { + buff_ = buff; + do { ++ if (buff_->next >= self->size) { ++ err = -EIO; ++ goto err_exit; ++ } + next_ = buff_->next, + buff_ = &self->buff_ring[next_]; + is_rsc_completed = +@@ -388,6 +392,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self, + (buff->is_lro && buff->is_cso_err)) { + buff_ = buff; + do { ++ if (buff_->next >= self->size) { ++ err = -EIO; ++ goto err_exit; ++ } + next_ = buff_->next, + buff_ = &self->buff_ring[next_]; + +diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c +index 583eae71cda4b..f888a443a067b 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_main.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_main.c +@@ -98,6 +98,24 @@ MODULE_LICENSE("GPL v2"); + + static struct workqueue_struct *i40e_wq; + ++static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f, ++ struct net_device *netdev, int delta) ++{ ++ struct netdev_hw_addr *ha; ++ ++ if (!f || !netdev) ++ return; ++ ++ netdev_for_each_mc_addr(ha, netdev) { ++ if (ether_addr_equal(ha->addr, f->macaddr)) { ++ ha->refcount += delta; ++ if (ha->refcount <= 0) ++ ha->refcount = 1; ++ break; ++ } ++ } ++} ++ + /** + * i40e_allocate_dma_mem_d - OS specific memory alloc for shared code + * @hw: pointer to the HW structure +@@ -2035,6 +2053,7 @@ static void i40e_undo_add_filter_entries(struct i40e_vsi *vsi, + hlist_for_each_entry_safe(new, h, from, hlist) { + /* We can simply free the wrapper structure */ + hlist_del(&new->hlist); ++ netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); + kfree(new); + } + } +@@ -2382,6 +2401,10 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) + &tmp_add_list, + &tmp_del_list, + vlan_filters); ++ ++ hlist_for_each_entry(new, &tmp_add_list, hlist) ++ netdev_hw_addr_refcnt(new->f, vsi->netdev, 1); ++ + if (retval) + goto err_no_memory_locked; + +@@ -2514,6 +2537,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi) + if (new->f->state == I40E_FILTER_NEW) + new->f->state = new->state; + hlist_del(&new->hlist); ++ netdev_hw_addr_refcnt(new->f, vsi->netdev, -1); + kfree(new); + } + spin_unlock_bh(&vsi->mac_filter_hash_lock); +@@ -8357,6 +8381,27 @@ int i40e_open(struct net_device *netdev) + return 0; + } + ++/** ++ * i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues ++ * @vsi: vsi structure ++ * ++ * This updates netdev's number of tx/rx queues ++ * ++ * Returns status of setting tx/rx queues ++ **/ ++static int i40e_netif_set_realnum_tx_rx_queues(struct i40e_vsi *vsi) ++{ ++ int ret; ++ ++ ret = netif_set_real_num_rx_queues(vsi->netdev, ++ vsi->num_queue_pairs); ++ if (ret) ++ return ret; ++ ++ return netif_set_real_num_tx_queues(vsi->netdev, ++ vsi->num_queue_pairs); ++} ++ + /** + * i40e_vsi_open - + * @vsi: the VSI to open +@@ -8393,13 +8438,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi) + goto err_setup_rx; + + /* Notify the stack of the actual queue counts. */ +- err = netif_set_real_num_tx_queues(vsi->netdev, +- vsi->num_queue_pairs); +- if (err) +- goto err_set_queues; +- +- err = netif_set_real_num_rx_queues(vsi->netdev, +- vsi->num_queue_pairs); ++ err = i40e_netif_set_realnum_tx_rx_queues(vsi); + if (err) + goto err_set_queues; + +@@ -13686,6 +13725,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *pf, u8 type, + case I40E_VSI_MAIN: + case I40E_VSI_VMDQ2: + ret = i40e_config_netdev(vsi); ++ if (ret) ++ goto err_netdev; ++ ret = i40e_netif_set_realnum_tx_rx_queues(vsi); + if (ret) + goto err_netdev; + ret = register_netdev(vsi->netdev); +@@ -14963,8 +15005,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + + if (hw->aq.api_maj_ver == I40E_FW_API_VERSION_MAJOR && + hw->aq.api_min_ver > I40E_FW_MINOR_VERSION(hw)) +- dev_info(&pdev->dev, +- "The driver for the device detected a newer version of the NVM image v%u.%u than expected v%u.%u. Please install the most recent version of the network driver.\n", ++ dev_dbg(&pdev->dev, ++ "The driver for the device detected a newer version of the NVM image v%u.%u than v%u.%u.\n", + hw->aq.api_maj_ver, + hw->aq.api_min_ver, + I40E_FW_API_VERSION_MAJOR, +diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +index 5a58edba4adfc..65c4c4fd359fa 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c +@@ -1824,17 +1824,19 @@ sriov_configure_out: + /***********************virtual channel routines******************/ + + /** +- * i40e_vc_send_msg_to_vf ++ * i40e_vc_send_msg_to_vf_ex + * @vf: pointer to the VF info + * @v_opcode: virtual channel opcode + * @v_retval: virtual channel return value + * @msg: pointer to the msg buffer + * @msglen: msg length ++ * @is_quiet: true for not printing unsuccessful return values, false otherwise + * + * send msg to VF + **/ +-static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, +- u32 v_retval, u8 *msg, u16 msglen) ++static int i40e_vc_send_msg_to_vf_ex(struct i40e_vf *vf, u32 v_opcode, ++ u32 v_retval, u8 *msg, u16 msglen, ++ bool is_quiet) + { + struct i40e_pf *pf; + struct i40e_hw *hw; +@@ -1850,7 +1852,7 @@ static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, + abs_vf_id = vf->vf_id + hw->func_caps.vf_base_id; + + /* single place to detect unsuccessful return values */ +- if (v_retval) { ++ if (v_retval && !is_quiet) { + vf->num_invalid_msgs++; + dev_info(&pf->pdev->dev, "VF %d failed opcode %d, retval: %d\n", + vf->vf_id, v_opcode, v_retval); +@@ -1880,6 +1882,23 @@ static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, + return 0; + } + ++/** ++ * i40e_vc_send_msg_to_vf ++ * @vf: pointer to the VF info ++ * @v_opcode: virtual channel opcode ++ * @v_retval: virtual channel return value ++ * @msg: pointer to the msg buffer ++ * @msglen: msg length ++ * ++ * send msg to VF ++ **/ ++static int i40e_vc_send_msg_to_vf(struct i40e_vf *vf, u32 v_opcode, ++ u32 v_retval, u8 *msg, u16 msglen) ++{ ++ return i40e_vc_send_msg_to_vf_ex(vf, v_opcode, v_retval, ++ msg, msglen, false); ++} ++ + /** + * i40e_vc_send_resp_to_vf + * @vf: pointer to the VF info +@@ -2641,6 +2660,7 @@ error_param: + * i40e_check_vf_permission + * @vf: pointer to the VF info + * @al: MAC address list from virtchnl ++ * @is_quiet: set true for printing msg without opcode info, false otherwise + * + * Check that the given list of MAC addresses is allowed. Will return -EPERM + * if any address in the list is not valid. Checks the following conditions: +@@ -2655,13 +2675,15 @@ error_param: + * addresses might not be accurate. + **/ + static inline int i40e_check_vf_permission(struct i40e_vf *vf, +- struct virtchnl_ether_addr_list *al) ++ struct virtchnl_ether_addr_list *al, ++ bool *is_quiet) + { + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi = pf->vsi[vf->lan_vsi_idx]; + int mac2add_cnt = 0; + int i; + ++ *is_quiet = false; + for (i = 0; i < al->num_elements; i++) { + struct i40e_mac_filter *f; + u8 *addr = al->list[i].addr; +@@ -2685,6 +2707,7 @@ static inline int i40e_check_vf_permission(struct i40e_vf *vf, + !ether_addr_equal(addr, vf->default_lan_addr.addr)) { + dev_err(&pf->pdev->dev, + "VF attempting to override administratively set MAC address, bring down and up the VF interface to resume normal operation\n"); ++ *is_quiet = true; + return -EPERM; + } + +@@ -2721,6 +2744,7 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + (struct virtchnl_ether_addr_list *)msg; + struct i40e_pf *pf = vf->pf; + struct i40e_vsi *vsi = NULL; ++ bool is_quiet = false; + i40e_status ret = 0; + int i; + +@@ -2737,7 +2761,7 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + */ + spin_lock_bh(&vsi->mac_filter_hash_lock); + +- ret = i40e_check_vf_permission(vf, al); ++ ret = i40e_check_vf_permission(vf, al, &is_quiet); + if (ret) { + spin_unlock_bh(&vsi->mac_filter_hash_lock); + goto error_param; +@@ -2775,8 +2799,8 @@ static int i40e_vc_add_mac_addr_msg(struct i40e_vf *vf, u8 *msg) + + error_param: + /* send the response to the VF */ +- return i40e_vc_send_resp_to_vf(vf, VIRTCHNL_OP_ADD_ETH_ADDR, +- ret); ++ return i40e_vc_send_msg_to_vf_ex(vf, VIRTCHNL_OP_ADD_ETH_ADDR, ++ ret, NULL, 0, is_quiet); + } + + /** +diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c +index 7aa49d4eaa87c..de7794ebc7e73 100644 +--- a/drivers/net/ethernet/intel/iavf/iavf_main.c ++++ b/drivers/net/ethernet/intel/iavf/iavf_main.c +@@ -2598,8 +2598,11 @@ static int iavf_validate_ch_config(struct iavf_adapter *adapter, + total_max_rate += tx_rate; + num_qps += mqprio_qopt->qopt.count[i]; + } +- if (num_qps > IAVF_MAX_REQ_QUEUES) ++ if (num_qps > adapter->num_active_queues) { ++ dev_err(&adapter->pdev->dev, ++ "Cannot support requested number of queues\n"); + return -EINVAL; ++ } + + ret = iavf_validate_tx_bandwidth(adapter, total_max_rate); + return ret; +diff --git a/drivers/net/ethernet/sfc/falcon/rx.c b/drivers/net/ethernet/sfc/falcon/rx.c +index 11a6aee852e92..0c6cc21913693 100644 +--- a/drivers/net/ethernet/sfc/falcon/rx.c ++++ b/drivers/net/ethernet/sfc/falcon/rx.c +@@ -110,6 +110,8 @@ static struct page *ef4_reuse_page(struct ef4_rx_queue *rx_queue) + struct ef4_rx_page_state *state; + unsigned index; + ++ if (unlikely(!rx_queue->page_ring)) ++ return NULL; + index = rx_queue->page_remove & rx_queue->page_ptr_mask; + page = rx_queue->page_ring[index]; + if (page == NULL) +@@ -293,6 +295,9 @@ static void ef4_recycle_rx_pages(struct ef4_channel *channel, + { + struct ef4_rx_queue *rx_queue = ef4_channel_get_rx_queue(channel); + ++ if (unlikely(!rx_queue->page_ring)) ++ return; ++ + do { + ef4_recycle_rx_page(channel, rx_buf); + rx_buf = ef4_rx_buf_next(rx_queue, rx_buf); +diff --git a/drivers/net/ethernet/sfc/rx_common.c b/drivers/net/ethernet/sfc/rx_common.c +index 8834bcb12fa97..e423b17e2a148 100644 +--- a/drivers/net/ethernet/sfc/rx_common.c ++++ b/drivers/net/ethernet/sfc/rx_common.c +@@ -45,6 +45,8 @@ static struct page *efx_reuse_page(struct efx_rx_queue *rx_queue) + unsigned int index; + struct page *page; + ++ if (unlikely(!rx_queue->page_ring)) ++ return NULL; + index = rx_queue->page_remove & rx_queue->page_ptr_mask; + page = rx_queue->page_ring[index]; + if (page == NULL) +@@ -114,6 +116,9 @@ void efx_recycle_rx_pages(struct efx_channel *channel, + { + struct efx_rx_queue *rx_queue = efx_channel_get_rx_queue(channel); + ++ if (unlikely(!rx_queue->page_ring)) ++ return; ++ + do { + efx_recycle_rx_page(channel, rx_buf); + rx_buf = efx_rx_buf_next(rx_queue, rx_buf); +diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c +index 23ee0b14cbfa1..2f5e7b31032aa 100644 +--- a/drivers/net/ieee802154/atusb.c ++++ b/drivers/net/ieee802154/atusb.c +@@ -93,7 +93,9 @@ static int atusb_control_msg(struct atusb *atusb, unsigned int pipe, + + ret = usb_control_msg(usb_dev, pipe, request, requesttype, + value, index, data, size, timeout); +- if (ret < 0) { ++ if (ret < size) { ++ ret = ret < 0 ? ret : -ENODATA; ++ + atusb->err = ret; + dev_err(&usb_dev->dev, + "%s: req 0x%02x val 0x%x idx 0x%x, error %d\n", +@@ -861,9 +863,9 @@ static int atusb_get_and_show_build(struct atusb *atusb) + if (!build) + return -ENOMEM; + +- ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0), +- ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0, +- build, ATUSB_BUILD_SIZE, 1000); ++ /* We cannot call atusb_control_msg() here, since this request may read various length data */ ++ ret = usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUSB_BUILD, ++ ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000); + if (ret >= 0) { + build[ret] = 0; + dev_info(&usb_dev->dev, "Firmware: build %s\n", build); +diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c +index f9b359d4e2939..1505fe3f87ed3 100644 +--- a/drivers/net/usb/rndis_host.c ++++ b/drivers/net/usb/rndis_host.c +@@ -608,6 +608,11 @@ static const struct usb_device_id products [] = { + USB_DEVICE_AND_INTERFACE_INFO(0x1630, 0x0042, + USB_CLASS_COMM, 2 /* ACM */, 0x0ff), + .driver_info = (unsigned long) &rndis_poll_status_info, ++}, { ++ /* Hytera Communications DMR radios' "Radio to PC Network" */ ++ USB_VENDOR_AND_INTERFACE_INFO(0x238b, ++ USB_CLASS_COMM, 2 /* ACM */, 0x0ff), ++ .driver_info = (unsigned long)&rndis_info, + }, { + /* RNDIS is MSFT's un-official variant of CDC ACM */ + USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff), +diff --git a/drivers/power/reset/ltc2952-poweroff.c b/drivers/power/reset/ltc2952-poweroff.c +index 318927938b05b..d3844ae9eca4a 100644 +--- a/drivers/power/reset/ltc2952-poweroff.c ++++ b/drivers/power/reset/ltc2952-poweroff.c +@@ -159,8 +159,8 @@ static void ltc2952_poweroff_kill(void) + + static void ltc2952_poweroff_default(struct ltc2952_poweroff *data) + { +- data->wde_interval = 300L * 1E6L; +- data->trigger_delay = ktime_set(2, 500L*1E6L); ++ data->wde_interval = 300L * NSEC_PER_MSEC; ++ data->trigger_delay = ktime_set(2, 500L * NSEC_PER_MSEC); + + hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL); + data->timer_trigger.function = ltc2952_poweroff_timer_trigger; +diff --git a/drivers/power/supply/bq25890_charger.c b/drivers/power/supply/bq25890_charger.c +index 945c3257ca931..fe814805c68b5 100644 +--- a/drivers/power/supply/bq25890_charger.c ++++ b/drivers/power/supply/bq25890_charger.c +@@ -581,12 +581,12 @@ static irqreturn_t __bq25890_handle_irq(struct bq25890_device *bq) + + if (!new_state.online && bq->state.online) { /* power removed */ + /* disable ADC */ +- ret = bq25890_field_write(bq, F_CONV_START, 0); ++ ret = bq25890_field_write(bq, F_CONV_RATE, 0); + if (ret < 0) + goto error; + } else if (new_state.online && !bq->state.online) { /* power inserted */ + /* enable ADC, to have control of charge current/voltage */ +- ret = bq25890_field_write(bq, F_CONV_START, 1); ++ ret = bq25890_field_write(bq, F_CONV_RATE, 1); + if (ret < 0) + goto error; + } +diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c +index 38e3aa642131d..280c54c23e37e 100644 +--- a/drivers/power/supply/power_supply_core.c ++++ b/drivers/power/supply/power_supply_core.c +@@ -834,6 +834,10 @@ power_supply_find_ocv2cap_table(struct power_supply_battery_info *info, + return NULL; + + for (i = 0; i < POWER_SUPPLY_OCV_TEMP_MAX; i++) { ++ /* Out of capacity tables */ ++ if (!info->ocv_table[i]) ++ break; ++ + temp_diff = abs(info->ocv_temp[i] - temp); + + if (temp_diff < best_temp_diff) { +diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c +index 30d27b6706746..d4e66c595eb87 100644 +--- a/drivers/scsi/libiscsi.c ++++ b/drivers/scsi/libiscsi.c +@@ -2950,6 +2950,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) + { + struct iscsi_conn *conn = cls_conn->dd_data; + struct iscsi_session *session = conn->session; ++ char *tmp_persistent_address = conn->persistent_address; ++ char *tmp_local_ipaddr = conn->local_ipaddr; + + del_timer_sync(&conn->transport_timer); + +@@ -2971,8 +2973,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) + spin_lock_bh(&session->frwd_lock); + free_pages((unsigned long) conn->data, + get_order(ISCSI_DEF_MAX_RECV_SEG_LEN)); +- kfree(conn->persistent_address); +- kfree(conn->local_ipaddr); + /* regular RX path uses back_lock */ + spin_lock_bh(&session->back_lock); + kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task, +@@ -2984,6 +2984,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn) + mutex_unlock(&session->eh_mutex); + + iscsi_destroy_conn(cls_conn); ++ kfree(tmp_persistent_address); ++ kfree(tmp_local_ipaddr); + } + EXPORT_SYMBOL_GPL(iscsi_conn_teardown); + +diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c +index a3e1105c5c662..b7a6363f387aa 100644 +--- a/drivers/usb/mtu3/mtu3_gadget.c ++++ b/drivers/usb/mtu3/mtu3_gadget.c +@@ -77,7 +77,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) + if (usb_endpoint_xfer_int(desc) || + usb_endpoint_xfer_isoc(desc)) { + interval = desc->bInterval; +- interval = clamp_val(interval, 1, 16) - 1; ++ interval = clamp_val(interval, 1, 16); + if (usb_endpoint_xfer_isoc(desc) && comp_desc) + mult = comp_desc->bmAttributes; + } +@@ -89,7 +89,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep) + if (usb_endpoint_xfer_isoc(desc) || + usb_endpoint_xfer_int(desc)) { + interval = desc->bInterval; +- interval = clamp_val(interval, 1, 16) - 1; ++ interval = clamp_val(interval, 1, 16); + mult = usb_endpoint_maxp_mult(desc) - 1; + } + break; +diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c +index b39bf416d5114..9bcd77db980df 100644 +--- a/fs/f2fs/checkpoint.c ++++ b/fs/f2fs/checkpoint.c +@@ -1147,7 +1147,8 @@ static bool __need_flush_quota(struct f2fs_sb_info *sbi) + if (!is_journalled_quota(sbi)) + return false; + +- down_write(&sbi->quota_sem); ++ if (!down_write_trylock(&sbi->quota_sem)) ++ return true; + if (is_sbi_flag_set(sbi, SBI_QUOTA_SKIP_FLUSH)) { + ret = false; + } else if (is_sbi_flag_set(sbi, SBI_QUOTA_NEED_REPAIR)) { +diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c +index 3fbd98f61ea5c..646735aad45df 100644 +--- a/fs/xfs/xfs_ioctl.c ++++ b/fs/xfs/xfs_ioctl.c +@@ -686,7 +686,8 @@ xfs_ioc_space( + + if (bf->l_start > XFS_ISIZE(ip)) { + error = xfs_alloc_file_space(ip, XFS_ISIZE(ip), +- bf->l_start - XFS_ISIZE(ip), 0); ++ bf->l_start - XFS_ISIZE(ip), ++ XFS_BMAPI_PREALLOC); + if (error) + goto out_unlock; + } +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index e4f154119e52c..cd2d094b9f820 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3134,7 +3134,7 @@ struct trace_buffer_struct { + char buffer[4][TRACE_BUF_SIZE]; + }; + +-static struct trace_buffer_struct *trace_percpu_buffer; ++static struct trace_buffer_struct __percpu *trace_percpu_buffer; + + /* + * Thise allows for lockless recording. If we're nested too deeply, then +@@ -3144,7 +3144,7 @@ static char *get_trace_buf(void) + { + struct trace_buffer_struct *buffer = this_cpu_ptr(trace_percpu_buffer); + +- if (!buffer || buffer->nesting >= 4) ++ if (!trace_percpu_buffer || buffer->nesting >= 4) + return NULL; + + buffer->nesting++; +@@ -3163,7 +3163,7 @@ static void put_trace_buf(void) + + static int alloc_percpu_trace_buffer(void) + { +- struct trace_buffer_struct *buffers; ++ struct trace_buffer_struct __percpu *buffers; + + if (trace_percpu_buffer) + return 0; +diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c +index 9af99c39b9fd9..139894ca788b9 100644 +--- a/net/batman-adv/multicast.c ++++ b/net/batman-adv/multicast.c +@@ -1373,6 +1373,7 @@ batadv_mcast_forw_rtr_node_get(struct batadv_priv *bat_priv, + * @bat_priv: the bat priv with all the soft interface information + * @skb: The multicast packet to check + * @orig: an originator to be set to forward the skb to ++ * @is_routable: stores whether the destination is routable + * + * Return: the forwarding mode as enum batadv_forw_mode and in case of + * BATADV_FORW_SINGLE set the orig to the single originator the skb +@@ -1380,17 +1381,16 @@ batadv_mcast_forw_rtr_node_get(struct batadv_priv *bat_priv, + */ + enum batadv_forw_mode + batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, +- struct batadv_orig_node **orig) ++ struct batadv_orig_node **orig, int *is_routable) + { + int ret, tt_count, ip_count, unsnoop_count, total_count; + bool is_unsnoopable = false; + unsigned int mcast_fanout; + struct ethhdr *ethhdr; +- int is_routable = 0; + int rtr_count = 0; + + ret = batadv_mcast_forw_mode_check(bat_priv, skb, &is_unsnoopable, +- &is_routable); ++ is_routable); + if (ret == -ENOMEM) + return BATADV_FORW_NONE; + else if (ret < 0) +@@ -1403,7 +1403,7 @@ batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, + ip_count = batadv_mcast_forw_want_all_ip_count(bat_priv, ethhdr); + unsnoop_count = !is_unsnoopable ? 0 : + atomic_read(&bat_priv->mcast.num_want_all_unsnoopables); +- rtr_count = batadv_mcast_forw_rtr_count(bat_priv, is_routable); ++ rtr_count = batadv_mcast_forw_rtr_count(bat_priv, *is_routable); + + total_count = tt_count + ip_count + unsnoop_count + rtr_count; + +@@ -1723,6 +1723,7 @@ batadv_mcast_forw_want_rtr(struct batadv_priv *bat_priv, + * @bat_priv: the bat priv with all the soft interface information + * @skb: the multicast packet to transmit + * @vid: the vlan identifier ++ * @is_routable: stores whether the destination is routable + * + * Sends copies of a frame with multicast destination to any node that signaled + * interest in it, that is either via the translation table or the according +@@ -1735,7 +1736,7 @@ batadv_mcast_forw_want_rtr(struct batadv_priv *bat_priv, + * is neither IPv4 nor IPv6. NET_XMIT_SUCCESS otherwise. + */ + int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, +- unsigned short vid) ++ unsigned short vid, int is_routable) + { + int ret; + +@@ -1751,12 +1752,16 @@ int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, + return ret; + } + ++ if (!is_routable) ++ goto skip_mc_router; ++ + ret = batadv_mcast_forw_want_rtr(bat_priv, skb, vid); + if (ret != NET_XMIT_SUCCESS) { + kfree_skb(skb); + return ret; + } + ++skip_mc_router: + consume_skb(skb); + return ret; + } +diff --git a/net/batman-adv/multicast.h b/net/batman-adv/multicast.h +index 3e114bc5ca3bb..1e787b522e69c 100644 +--- a/net/batman-adv/multicast.h ++++ b/net/batman-adv/multicast.h +@@ -44,7 +44,8 @@ enum batadv_forw_mode { + + enum batadv_forw_mode + batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, +- struct batadv_orig_node **mcast_single_orig); ++ struct batadv_orig_node **mcast_single_orig, ++ int *is_routable); + + int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, + struct sk_buff *skb, +@@ -52,7 +53,7 @@ int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, + struct batadv_orig_node *orig_node); + + int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, +- unsigned short vid); ++ unsigned short vid, int is_routable); + + void batadv_mcast_init(struct batadv_priv *bat_priv); + +@@ -71,7 +72,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig_node); + + static inline enum batadv_forw_mode + batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb, +- struct batadv_orig_node **mcast_single_orig) ++ struct batadv_orig_node **mcast_single_orig, ++ int *is_routable) + { + return BATADV_FORW_ALL; + } +@@ -88,7 +90,7 @@ batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv, + + static inline int + batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb, +- unsigned short vid) ++ unsigned short vid, int is_routable) + { + kfree_skb(skb); + return NET_XMIT_DROP; +diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c +index 82e7ca886605a..7496047b318a4 100644 +--- a/net/batman-adv/soft-interface.c ++++ b/net/batman-adv/soft-interface.c +@@ -200,6 +200,7 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, + int gw_mode; + enum batadv_forw_mode forw_mode = BATADV_FORW_SINGLE; + struct batadv_orig_node *mcast_single_orig = NULL; ++ int mcast_is_routable = 0; + int network_offset = ETH_HLEN; + __be16 proto; + +@@ -302,7 +303,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb, + send: + if (do_bcast && !is_broadcast_ether_addr(ethhdr->h_dest)) { + forw_mode = batadv_mcast_forw_mode(bat_priv, skb, +- &mcast_single_orig); ++ &mcast_single_orig, ++ &mcast_is_routable); + if (forw_mode == BATADV_FORW_NONE) + goto dropped; + +@@ -367,7 +369,8 @@ send: + ret = batadv_mcast_forw_send_orig(bat_priv, skb, vid, + mcast_single_orig); + } else if (forw_mode == BATADV_FORW_SOME) { +- ret = batadv_mcast_forw_send(bat_priv, skb, vid); ++ ret = batadv_mcast_forw_send(bat_priv, skb, vid, ++ mcast_is_routable); + } else { + if (batadv_dat_snoop_outgoing_arp_request(bat_priv, + skb)) +diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c +index 8ec7d13d28608..f590b0e672a9b 100644 +--- a/net/core/lwtunnel.c ++++ b/net/core/lwtunnel.c +@@ -192,6 +192,10 @@ int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining, + nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE); + + if (nla_entype) { ++ if (nla_len(nla_entype) < sizeof(u16)) { ++ NL_SET_ERR_MSG(extack, "Invalid RTA_ENCAP_TYPE"); ++ return -EINVAL; ++ } + encap_type = nla_get_u16(nla_entype); + + if (lwtunnel_valid_encap_type(encap_type, +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c +index 36f34977dda19..ab6a8f35d369d 100644 +--- a/net/ipv4/fib_semantics.c ++++ b/net/ipv4/fib_semantics.c +@@ -663,6 +663,19 @@ static int fib_count_nexthops(struct rtnexthop *rtnh, int remaining, + return nhs; + } + ++static int fib_gw_from_attr(__be32 *gw, struct nlattr *nla, ++ struct netlink_ext_ack *extack) ++{ ++ if (nla_len(nla) < sizeof(*gw)) { ++ NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY"); ++ return -EINVAL; ++ } ++ ++ *gw = nla_get_in_addr(nla); ++ ++ return 0; ++} ++ + /* only called when fib_nh is integrated into fib_info */ + static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, + int remaining, struct fib_config *cfg, +@@ -705,7 +718,11 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, + return -EINVAL; + } + if (nla) { +- fib_cfg.fc_gw4 = nla_get_in_addr(nla); ++ ret = fib_gw_from_attr(&fib_cfg.fc_gw4, nla, ++ extack); ++ if (ret) ++ goto errout; ++ + if (fib_cfg.fc_gw4) + fib_cfg.fc_gw_family = AF_INET; + } else if (nlav) { +@@ -715,10 +732,18 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh, + } + + nla = nla_find(attrs, attrlen, RTA_FLOW); +- if (nla) ++ if (nla) { ++ if (nla_len(nla) < sizeof(u32)) { ++ NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW"); ++ return -EINVAL; ++ } + fib_cfg.fc_flow = nla_get_u32(nla); ++ } + + fib_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP); ++ /* RTA_ENCAP_TYPE length checked in ++ * lwtunnel_valid_encap_type_attr ++ */ + nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE); + if (nla) + fib_cfg.fc_encap_type = nla_get_u16(nla); +@@ -903,6 +928,7 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi, + attrlen = rtnh_attrlen(rtnh); + if (attrlen > 0) { + struct nlattr *nla, *nlav, *attrs = rtnh_attrs(rtnh); ++ int err; + + nla = nla_find(attrs, attrlen, RTA_GATEWAY); + nlav = nla_find(attrs, attrlen, RTA_VIA); +@@ -913,12 +939,17 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi, + } + + if (nla) { ++ __be32 gw; ++ ++ err = fib_gw_from_attr(&gw, nla, extack); ++ if (err) ++ return err; ++ + if (nh->fib_nh_gw_family != AF_INET || +- nla_get_in_addr(nla) != nh->fib_nh_gw4) ++ gw != nh->fib_nh_gw4) + return 1; + } else if (nlav) { + struct fib_config cfg2; +- int err; + + err = fib_gw_from_via(&cfg2, nlav, extack); + if (err) +@@ -941,8 +972,14 @@ int fib_nh_match(struct net *net, struct fib_config *cfg, struct fib_info *fi, + + #ifdef CONFIG_IP_ROUTE_CLASSID + nla = nla_find(attrs, attrlen, RTA_FLOW); +- if (nla && nla_get_u32(nla) != nh->nh_tclassid) +- return 1; ++ if (nla) { ++ if (nla_len(nla) < sizeof(u32)) { ++ NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW"); ++ return -EINVAL; ++ } ++ if (nla_get_u32(nla) != nh->nh_tclassid) ++ return 1; ++ } + #endif + } + +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 86ed2afbee302..ef2068a60d4ad 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -3006,7 +3006,7 @@ int udp4_seq_show(struct seq_file *seq, void *v) + { + seq_setwidth(seq, 127); + if (v == SEQ_START_TOKEN) +- seq_puts(seq, " sl local_address rem_address st tx_queue " ++ seq_puts(seq, " sl local_address rem_address st tx_queue " + "rx_queue tr tm->when retrnsmt uid timeout " + "inode ref pointer drops"); + else { +diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c +index 23aeeb46f99fc..99f2dc802e366 100644 +--- a/net/ipv6/ip6_vti.c ++++ b/net/ipv6/ip6_vti.c +@@ -804,6 +804,8 @@ vti6_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + struct net *net = dev_net(dev); + struct vti6_net *ip6n = net_generic(net, vti6_net_id); + ++ memset(&p1, 0, sizeof(p1)); ++ + switch (cmd) { + case SIOCGETTUNNEL: + if (dev == ip6n->fb_tnl_dev) { +diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c +index 00f133a55ef7c..38349054e361e 100644 +--- a/net/ipv6/raw.c ++++ b/net/ipv6/raw.c +@@ -1020,6 +1020,9 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname, + struct raw6_sock *rp = raw6_sk(sk); + int val; + ++ if (optlen < sizeof(val)) ++ return -EINVAL; ++ + if (copy_from_sockptr(&val, optval, sizeof(val))) + return -EFAULT; + +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 6fef0d7586bf6..654bf4ca61260 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -5113,6 +5113,19 @@ out: + return should_notify; + } + ++static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla, ++ struct netlink_ext_ack *extack) ++{ ++ if (nla_len(nla) < sizeof(*gw)) { ++ NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY"); ++ return -EINVAL; ++ } ++ ++ *gw = nla_get_in6_addr(nla); ++ ++ return 0; ++} ++ + static int ip6_route_multipath_add(struct fib6_config *cfg, + struct netlink_ext_ack *extack) + { +@@ -5153,10 +5166,18 @@ static int ip6_route_multipath_add(struct fib6_config *cfg, + + nla = nla_find(attrs, attrlen, RTA_GATEWAY); + if (nla) { +- r_cfg.fc_gateway = nla_get_in6_addr(nla); ++ err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, ++ extack); ++ if (err) ++ goto cleanup; ++ + r_cfg.fc_flags |= RTF_GATEWAY; + } + r_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP); ++ ++ /* RTA_ENCAP_TYPE length checked in ++ * lwtunnel_valid_encap_type_attr ++ */ + nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE); + if (nla) + r_cfg.fc_encap_type = nla_get_u16(nla); +@@ -5323,7 +5344,13 @@ static int ip6_route_multipath_del(struct fib6_config *cfg, + + nla = nla_find(attrs, attrlen, RTA_GATEWAY); + if (nla) { +- nla_memcpy(&r_cfg.fc_gateway, nla, 16); ++ err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla, ++ extack); ++ if (err) { ++ last_err = err; ++ goto next_rtnh; ++ } ++ + r_cfg.fc_flags |= RTF_GATEWAY; + } + } +@@ -5331,6 +5358,7 @@ static int ip6_route_multipath_del(struct fib6_config *cfg, + if (err) + last_err = err; + ++next_rtnh: + rtnh = rtnh_next(rtnh, &remaining); + } + +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index 7bd42827540ae..778bf262418b5 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -5194,7 +5194,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, + */ + if (new_sta) { + u32 rates = 0, basic_rates = 0; +- bool have_higher_than_11mbit; ++ bool have_higher_than_11mbit = false; + int min_rate = INT_MAX, min_rate_index = -1; + const struct cfg80211_bss_ies *ies; + int shift = ieee80211_vif_get_shift(&sdata->vif); +diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c +index 6d16e1ab1a8ab..eef0e3f2f25b0 100644 +--- a/net/netrom/af_netrom.c ++++ b/net/netrom/af_netrom.c +@@ -306,7 +306,7 @@ static int nr_setsockopt(struct socket *sock, int level, int optname, + if (optlen < sizeof(unsigned int)) + return -EINVAL; + +- if (copy_from_sockptr(&opt, optval, sizeof(unsigned int))) ++ if (copy_from_sockptr(&opt, optval, sizeof(unsigned long))) + return -EFAULT; + + switch (optname) { +diff --git a/net/phonet/pep.c b/net/phonet/pep.c +index 72018e5e4d8ef..65d463ad87707 100644 +--- a/net/phonet/pep.c ++++ b/net/phonet/pep.c +@@ -868,6 +868,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp, + + err = pep_accept_conn(newsk, skb); + if (err) { ++ __sock_put(sk); + sock_put(newsk); + newsk = NULL; + goto drop; +diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c +index ade2d6ddc9148..af8c63a9ec18c 100644 +--- a/net/sched/sch_qfq.c ++++ b/net/sched/sch_qfq.c +@@ -1421,10 +1421,8 @@ static int qfq_init_qdisc(struct Qdisc *sch, struct nlattr *opt, + if (err < 0) + return err; + +- if (qdisc_dev(sch)->tx_queue_len + 1 > QFQ_MAX_AGG_CLASSES) +- max_classes = QFQ_MAX_AGG_CLASSES; +- else +- max_classes = qdisc_dev(sch)->tx_queue_len + 1; ++ max_classes = min_t(u64, (u64)qdisc_dev(sch)->tx_queue_len + 1, ++ QFQ_MAX_AGG_CLASSES); + /* max_cl_shift = floor(log_2(max_classes)) */ + max_cl_shift = __fls(max_classes); + q->max_agg_classes = 1<<max_cl_shift; +diff --git a/samples/ftrace/ftrace-direct-modify.c b/samples/ftrace/ftrace-direct-modify.c +index 5b9a09957c6e0..89e6bf27cd9f6 100644 +--- a/samples/ftrace/ftrace-direct-modify.c ++++ b/samples/ftrace/ftrace-direct-modify.c +@@ -3,6 +3,9 @@ + #include <linux/kthread.h> + #include <linux/ftrace.h> + ++extern void my_direct_func1(void); ++extern void my_direct_func2(void); ++ + void my_direct_func1(void) + { + trace_printk("my direct func1\n"); +diff --git a/samples/ftrace/ftrace-direct-too.c b/samples/ftrace/ftrace-direct-too.c +index 3f0079c9bd6fa..11b99325f3dbf 100644 +--- a/samples/ftrace/ftrace-direct-too.c ++++ b/samples/ftrace/ftrace-direct-too.c +@@ -4,6 +4,9 @@ + #include <linux/mm.h> /* for handle_mm_fault() */ + #include <linux/ftrace.h> + ++extern void my_direct_func(struct vm_area_struct *vma, ++ unsigned long address, unsigned int flags); ++ + void my_direct_func(struct vm_area_struct *vma, + unsigned long address, unsigned int flags) + { +diff --git a/samples/ftrace/ftrace-direct.c b/samples/ftrace/ftrace-direct.c +index a2729d1ef17f5..642c50b5f7166 100644 +--- a/samples/ftrace/ftrace-direct.c ++++ b/samples/ftrace/ftrace-direct.c +@@ -4,6 +4,8 @@ + #include <linux/sched.h> /* for wake_up_process() */ + #include <linux/ftrace.h> + ++extern void my_direct_func(struct task_struct *p); ++ + void my_direct_func(struct task_struct *p) + { + trace_printk("waking up %s-%d\n", p->comm, p->pid); +diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c +index 65c141ebfbbde..5b45e6986aeab 100644 +--- a/tools/testing/selftests/x86/test_vsyscall.c ++++ b/tools/testing/selftests/x86/test_vsyscall.c +@@ -497,7 +497,7 @@ static int test_process_vm_readv(void) + } + + if (vsyscall_map_r) { +- if (!memcmp(buf, (const void *)0xffffffffff600000, 4096)) { ++ if (!memcmp(buf, remote.iov_base, sizeof(buf))) { + printf("[OK]\tIt worked and read correct data\n"); + } else { + printf("[FAIL]\tIt worked but returned incorrect data\n");
