diff --git a/Makefile b/Makefile
index 1773c718074e..f0040b05df30 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 16
-SUBLEVEL = 1
+SUBLEVEL = 2
 EXTRAVERSION =
 NAME = Fearless Coyote
 
diff --git a/drivers/net/ethernet/marvell/sky2.c 
b/drivers/net/ethernet/marvell/sky2.c
index 9fe85300e7b6..5754116a6a4d 100644
--- a/drivers/net/ethernet/marvell/sky2.c
+++ b/drivers/net/ethernet/marvell/sky2.c
@@ -5087,7 +5087,7 @@ static int sky2_probe(struct pci_dev *pdev, const struct 
pci_device_id *ent)
        INIT_WORK(&hw->restart_work, sky2_restart);
 
        pci_set_drvdata(pdev, hw);
-       pdev->d3_delay = 150;
+       pdev->d3_delay = 200;
 
        return 0;
 
diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c 
b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c
index 39abac678b71..99bb679a9801 100644
--- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c
+++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp_nsp.c
@@ -71,10 +71,11 @@
 /* CPP address to retrieve the data from */
 #define NSP_BUFFER             0x10
 #define   NSP_BUFFER_CPP       GENMASK_ULL(63, 40)
-#define   NSP_BUFFER_PCIE      GENMASK_ULL(39, 38)
-#define   NSP_BUFFER_ADDRESS   GENMASK_ULL(37, 0)
+#define   NSP_BUFFER_ADDRESS   GENMASK_ULL(39, 0)
 
 #define NSP_DFLT_BUFFER                0x18
+#define   NSP_DFLT_BUFFER_CPP  GENMASK_ULL(63, 40)
+#define   NSP_DFLT_BUFFER_ADDRESS      GENMASK_ULL(39, 0)
 
 #define NSP_DFLT_BUFFER_CONFIG 0x20
 #define   NSP_DFLT_BUFFER_SIZE_MB      GENMASK_ULL(7, 0)
@@ -427,8 +428,8 @@ __nfp_nsp_command_buf(struct nfp_nsp *nsp, u16 code, u32 
option,
        if (err < 0)
                return err;
 
-       cpp_id = FIELD_GET(NSP_BUFFER_CPP, reg) << 8;
-       cpp_buf = FIELD_GET(NSP_BUFFER_ADDRESS, reg);
+       cpp_id = FIELD_GET(NSP_DFLT_BUFFER_CPP, reg) << 8;
+       cpp_buf = FIELD_GET(NSP_DFLT_BUFFER_ADDRESS, reg);
 
        if (in_buf && in_size) {
                err = nfp_cpp_write(cpp, cpp_id, cpp_buf, in_buf, in_size);
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index 6dde9a0cfe76..9b70a3af678e 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -464,7 +464,6 @@ static int pptp_connect(struct socket *sock, struct 
sockaddr *uservaddr,
        po->chan.mtu = dst_mtu(&rt->dst);
        if (!po->chan.mtu)
                po->chan.mtu = PPP_MRU;
-       ip_rt_put(rt);
        po->chan.mtu -= PPTP_HEADER_OVERHEAD;
 
        po->chan.hdrlen = 2 + sizeof(struct pptp_gre_header);
diff --git a/drivers/sbus/char/Kconfig b/drivers/sbus/char/Kconfig
index a785aa7660c3..bf3c5f735614 100644
--- a/drivers/sbus/char/Kconfig
+++ b/drivers/sbus/char/Kconfig
@@ -72,7 +72,8 @@ config DISPLAY7SEG
 
 config ORACLE_DAX
        tristate "Oracle Data Analytics Accelerator"
-       default m if SPARC64
+       depends on SPARC64
+       default m
        help
         Driver for Oracle Data Analytics Accelerator, which is
         a coprocessor that performs database operations in hardware.
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index f7e83f6d2e64..236452ebbd9e 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -29,6 +29,7 @@
 #include <linux/net_tstamp.h>
 #include <linux/etherdevice.h>
 #include <linux/ethtool.h>
+#include <linux/phy.h>
 #include <net/arp.h>
 #include <net/switchdev.h>
 
@@ -665,8 +666,11 @@ static int vlan_ethtool_get_ts_info(struct net_device *dev,
 {
        const struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
        const struct ethtool_ops *ops = vlan->real_dev->ethtool_ops;
+       struct phy_device *phydev = vlan->real_dev->phydev;
 
-       if (ops->get_ts_info) {
+       if (phydev && phydev->drv && phydev->drv->ts_info) {
+                return phydev->drv->ts_info(phydev, info);
+       } else if (ops->get_ts_info) {
                return ops->get_ts_info(vlan->real_dev, info);
        } else {
                info->so_timestamping = SOF_TIMESTAMPING_RX_SOFTWARE |
diff --git a/net/core/dev.c b/net/core/dev.c
index ef0cc6ea5f8d..c4aa2941dbfd 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1027,7 +1027,7 @@ bool dev_valid_name(const char *name)
 {
        if (*name == '\0')
                return false;
-       if (strlen(name) >= IFNAMSIZ)
+       if (strnlen(name, IFNAMSIZ) == IFNAMSIZ)
                return false;
        if (!strcmp(name, ".") || !strcmp(name, ".."))
                return false;
diff --git a/net/dsa/dsa_priv.h b/net/dsa/dsa_priv.h
index 70de7895e5b8..053731473c99 100644
--- a/net/dsa/dsa_priv.h
+++ b/net/dsa/dsa_priv.h
@@ -126,6 +126,7 @@ static inline struct net_device 
*dsa_master_find_slave(struct net_device *dev,
        struct dsa_port *cpu_dp = dev->dsa_ptr;
        struct dsa_switch_tree *dst = cpu_dp->dst;
        struct dsa_switch *ds;
+       struct dsa_port *slave_port;
 
        if (device < 0 || device >= DSA_MAX_SWITCHES)
                return NULL;
@@ -137,7 +138,12 @@ static inline struct net_device 
*dsa_master_find_slave(struct net_device *dev,
        if (port < 0 || port >= ds->num_ports)
                return NULL;
 
-       return ds->ports[port].slave;
+       slave_port = &ds->ports[port];
+
+       if (unlikely(slave_port->type != DSA_PORT_TYPE_USER))
+               return NULL;
+
+       return slave_port->slave;
 }
 
 /* port.c */
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index f28f06c91ead..7333db17c581 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -437,7 +437,7 @@ static int arp_filter(__be32 sip, __be32 tip, struct 
net_device *dev)
        /*unsigned long now; */
        struct net *net = dev_net(dev);
 
-       rt = ip_route_output(net, sip, tip, 0, 0);
+       rt = ip_route_output(net, sip, tip, 0, l3mdev_master_ifindex_rcu(dev));
        if (IS_ERR(rt))
                return 1;
        if (rt->dst.dev != dev) {
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index a7fd1c5a2a14..57478d68248d 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -253,13 +253,14 @@ static struct net_device *__ip_tunnel_create(struct net 
*net,
        struct net_device *dev;
        char name[IFNAMSIZ];
 
-       if (parms->name[0])
+       err = -E2BIG;
+       if (parms->name[0]) {
+               if (!dev_valid_name(parms->name))
+                       goto failed;
                strlcpy(name, parms->name, IFNAMSIZ);
-       else {
-               if (strlen(ops->kind) > (IFNAMSIZ - 3)) {
-                       err = -E2BIG;
+       } else {
+               if (strlen(ops->kind) > (IFNAMSIZ - 3))
                        goto failed;
-               }
                strlcpy(name, ops->kind, IFNAMSIZ);
                strncat(name, "%d", 2);
        }
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 1bbd0930063e..197fcae855ca 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -335,11 +335,13 @@ static struct ip6_tnl *ip6gre_tunnel_locate(struct net 
*net,
        if (t || !create)
                return t;
 
-       if (parms->name[0])
+       if (parms->name[0]) {
+               if (!dev_valid_name(parms->name))
+                       return NULL;
                strlcpy(name, parms->name, IFNAMSIZ);
-       else
+       } else {
                strcpy(name, "ip6gre%d");
-
+       }
        dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
                           ip6gre_tunnel_setup);
        if (!dev)
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5cb18c8ba9b2..4065ae0c32a0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -375,6 +375,11 @@ static int ip6_forward_proxy_check(struct sk_buff *skb)
 static inline int ip6_forward_finish(struct net *net, struct sock *sk,
                                     struct sk_buff *skb)
 {
+       struct dst_entry *dst = skb_dst(skb);
+
+       __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
+       __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, 
skb->len);
+
        return dst_output(net, sk, skb);
 }
 
@@ -569,8 +574,6 @@ int ip6_forward(struct sk_buff *skb)
 
        hdr->hop_limit--;
 
-       __IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
-       __IP6_ADD_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, 
skb->len);
        return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD,
                       net, NULL, skb, skb->dev, dst->dev,
                       ip6_forward_finish);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 6e0f21eed88a..179313b0926c 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -297,13 +297,16 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, 
struct __ip6_tnl_parm *p)
        struct net_device *dev;
        struct ip6_tnl *t;
        char name[IFNAMSIZ];
-       int err = -ENOMEM;
+       int err = -E2BIG;
 
-       if (p->name[0])
+       if (p->name[0]) {
+               if (!dev_valid_name(p->name))
+                       goto failed;
                strlcpy(name, p->name, IFNAMSIZ);
-       else
+       } else {
                sprintf(name, "ip6tnl%%d");
-
+       }
+       err = -ENOMEM;
        dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
                           ip6_tnl_dev_setup);
        if (!dev)
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index ce18cd20389d..3726dc797847 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -212,10 +212,13 @@ static struct ip6_tnl *vti6_tnl_create(struct net *net, 
struct __ip6_tnl_parm *p
        char name[IFNAMSIZ];
        int err;
 
-       if (p->name[0])
+       if (p->name[0]) {
+               if (!dev_valid_name(p->name))
+                       goto failed;
                strlcpy(name, p->name, IFNAMSIZ);
-       else
+       } else {
                sprintf(name, "ip6_vti%%d");
+       }
 
        dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN, vti6_dev_setup);
        if (!dev)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 0195598f7bb5..e85791854c87 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -250,11 +250,13 @@ static struct ip_tunnel *ipip6_tunnel_locate(struct net 
*net,
        if (!create)
                goto failed;
 
-       if (parms->name[0])
+       if (parms->name[0]) {
+               if (!dev_valid_name(parms->name))
+                       goto failed;
                strlcpy(name, parms->name, IFNAMSIZ);
-       else
+       } else {
                strcpy(name, "sit%d");
-
+       }
        dev = alloc_netdev(sizeof(*t), name, NET_NAME_UNKNOWN,
                           ipip6_tunnel_setup);
        if (!dev)
diff --git a/net/sched/act_bpf.c b/net/sched/act_bpf.c
index 9d2cabf1dc7e..f3eee5326307 100644
--- a/net/sched/act_bpf.c
+++ b/net/sched/act_bpf.c
@@ -248,10 +248,14 @@ static int tcf_bpf_init_from_efd(struct nlattr **tb, 
struct tcf_bpf_cfg *cfg)
 
 static void tcf_bpf_cfg_cleanup(const struct tcf_bpf_cfg *cfg)
 {
-       if (cfg->is_ebpf)
-               bpf_prog_put(cfg->filter);
-       else
-               bpf_prog_destroy(cfg->filter);
+       struct bpf_prog *filter = cfg->filter;
+
+       if (filter) {
+               if (cfg->is_ebpf)
+                       bpf_prog_put(filter);
+               else
+                       bpf_prog_destroy(filter);
+       }
 
        kfree(cfg->bpf_ops);
        kfree(cfg->bpf_name);
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index ed8b6a24b9e9..bac47b5d18fd 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -489,6 +489,7 @@ static int u32_delete_key(struct tcf_proto *tp, struct 
tc_u_knode *key)
                                RCU_INIT_POINTER(*kp, key->next);
 
                                tcf_unbind_filter(tp, &key->res);
+                               idr_remove(&ht->handle_idr, key->handle);
                                tcf_exts_get_net(&key->exts);
                                call_rcu(&key->rcu, u32_delete_key_freepf_rcu);
                                return 0;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index e35d4f73d2df..f6d3d0c1e133 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -728,8 +728,10 @@ static int sctp_v6_addr_to_user(struct sctp_sock *sp, 
union sctp_addr *addr)
                        sctp_v6_map_v4(addr);
        }
 
-       if (addr->sa.sa_family == AF_INET)
+       if (addr->sa.sa_family == AF_INET) {
+               memset(addr->v4.sin_zero, 0, sizeof(addr->v4.sin_zero));
                return sizeof(struct sockaddr_in);
+       }
        return sizeof(struct sockaddr_in6);
 }
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index bf271f8c2dc9..7160c2e9b768 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -354,11 +354,14 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock 
*opt,
        if (!opt->pf->af_supported(addr->sa.sa_family, opt))
                return NULL;
 
-       /* V4 mapped address are really of AF_INET family */
-       if (addr->sa.sa_family == AF_INET6 &&
-           ipv6_addr_v4mapped(&addr->v6.sin6_addr) &&
-           !opt->pf->af_supported(AF_INET, opt))
-               return NULL;
+       if (addr->sa.sa_family == AF_INET6) {
+               if (len < SIN6_LEN_RFC2133)
+                       return NULL;
+               /* V4 mapped address are really of AF_INET family */
+               if (ipv6_addr_v4mapped(&addr->v6.sin6_addr) &&
+                   !opt->pf->af_supported(AF_INET, opt))
+                       return NULL;
+       }
 
        /* If we get this far, af is valid. */
        af = sctp_get_af_specific(addr->sa.sa_family);

Reply via email to