commit: 0c71034458005ca3ca7c140cd80cafd8e68e314a Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Mar 18 14:20:50 2020 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Mar 18 14:20:50 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=0c710344
Linux patch 4.19.111 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1110_linux-4.19.111.patch | 2538 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2542 insertions(+) diff --git a/0000_README b/0000_README index 8e31d5f..7eab5d8 100644 --- a/0000_README +++ b/0000_README @@ -479,6 +479,10 @@ Patch: 1109_linux-4.19.110.patch From: https://www.kernel.org Desc: Linux 4.19.110 +Patch: 1110_linux-4.19.111.patch +From: https://www.kernel.org +Desc: Linux 4.19.111 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1110_linux-4.19.111.patch b/1110_linux-4.19.111.patch new file mode 100644 index 0000000..d0588c2 --- /dev/null +++ b/1110_linux-4.19.111.patch @@ -0,0 +1,2538 @@ +diff --git a/Documentation/filesystems/porting b/Documentation/filesystems/porting +index 32b5186be412..041b0ded8b44 100644 +--- a/Documentation/filesystems/porting ++++ b/Documentation/filesystems/porting +@@ -627,3 +627,10 @@ in your dentry operations instead. + DCACHE_RCUACCESS is gone; having an RCU delay on dentry freeing is the + default. DCACHE_NORCU opts out, and only d_alloc_pseudo() has any + business doing so. ++-- ++[mandatory] ++ ++ [should've been added in 2016] stale comment in finish_open() ++ nonwithstanding, failure exits in ->atomic_open() instances should ++ *NOT* fput() the file, no matter what. Everything is handled by the ++ caller. +diff --git a/Makefile b/Makefile +index ada958d1bc2b..fed04bdef0a3 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 110 ++SUBLEVEL = 111 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/arc/include/asm/linkage.h b/arch/arc/include/asm/linkage.h +index b29f1a9fd6f7..07c8e1a6c56e 100644 +--- a/arch/arc/include/asm/linkage.h ++++ b/arch/arc/include/asm/linkage.h +@@ -14,6 +14,8 @@ + #ifdef __ASSEMBLY__ + + #define ASM_NL ` /* use '`' to mark new line in macro */ ++#define __ALIGN .align 4 ++#define __ALIGN_STR __stringify(__ALIGN) + + /* annotation for data we want in DCCM - if enabled in .config */ + .macro ARCFP_DATA nm +diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel.c b/arch/x86/kernel/cpu/mcheck/mce_intel.c +index d05be307d081..1d87b85150db 100644 +--- a/arch/x86/kernel/cpu/mcheck/mce_intel.c ++++ b/arch/x86/kernel/cpu/mcheck/mce_intel.c +@@ -489,17 +489,18 @@ static void intel_ppin_init(struct cpuinfo_x86 *c) + return; + + if ((val & 3UL) == 1UL) { +- /* PPIN available but disabled: */ ++ /* PPIN locked in disabled mode */ + return; + } + +- /* If PPIN is disabled, but not locked, try to enable: */ +- if (!(val & 3UL)) { ++ /* If PPIN is disabled, try to enable */ ++ if (!(val & 2UL)) { + wrmsrl_safe(MSR_PPIN_CTL, val | 2UL); + rdmsrl_safe(MSR_PPIN_CTL, &val); + } + +- if ((val & 3UL) == 2UL) ++ /* Is the enable bit set? */ ++ if (val & 2UL) + set_cpu_cap(c, X86_FEATURE_INTEL_PPIN); + } + } +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index c91431bc476e..210eabd71ab2 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -5112,6 +5112,7 @@ int x86_decode_insn(struct x86_emulate_ctxt *ctxt, void *insn, int insn_len) + ctxt->fetch.ptr = ctxt->fetch.data; + ctxt->fetch.end = ctxt->fetch.data + insn_len; + ctxt->opcode_len = 1; ++ ctxt->intercept = x86_intercept_none; + if (insn_len > 0) + memcpy(ctxt->fetch.data, insn, insn_len); + else { +diff --git a/drivers/block/virtio_blk.c b/drivers/block/virtio_blk.c +index dd64f586679e..728c9a9609f0 100644 +--- a/drivers/block/virtio_blk.c ++++ b/drivers/block/virtio_blk.c +@@ -271,10 +271,12 @@ static blk_status_t virtio_queue_rq(struct blk_mq_hw_ctx *hctx, + err = virtblk_add_req(vblk->vqs[qid].vq, vbr, vbr->sg, num); + if (err) { + virtqueue_kick(vblk->vqs[qid].vq); +- blk_mq_stop_hw_queue(hctx); ++ /* Don't stop the queue if -ENOMEM: we may have failed to ++ * bounce the buffer due to global resource outage. ++ */ ++ if (err == -ENOSPC) ++ blk_mq_stop_hw_queue(hctx); + spin_unlock_irqrestore(&vblk->vqs[qid].lock, flags); +- /* Out of mem doesn't actually happen, since we fall back +- * to direct descriptors */ + if (err == -ENOMEM || err == -ENOSPC) + return BLK_STS_DEV_RESOURCE; + return BLK_STS_IOERR; +diff --git a/drivers/firmware/efi/efivars.c b/drivers/firmware/efi/efivars.c +index 3e626fd9bd4e..1c65f5ac4368 100644 +--- a/drivers/firmware/efi/efivars.c ++++ b/drivers/firmware/efi/efivars.c +@@ -139,13 +139,16 @@ static ssize_t + efivar_attr_read(struct efivar_entry *entry, char *buf) + { + struct efi_variable *var = &entry->var; ++ unsigned long size = sizeof(var->Data); + char *str = buf; ++ int ret; + + if (!entry || !buf) + return -EINVAL; + +- var->DataSize = 1024; +- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) ++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); ++ var->DataSize = size; ++ if (ret) + return -EIO; + + if (var->Attributes & EFI_VARIABLE_NON_VOLATILE) +@@ -172,13 +175,16 @@ static ssize_t + efivar_size_read(struct efivar_entry *entry, char *buf) + { + struct efi_variable *var = &entry->var; ++ unsigned long size = sizeof(var->Data); + char *str = buf; ++ int ret; + + if (!entry || !buf) + return -EINVAL; + +- var->DataSize = 1024; +- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) ++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); ++ var->DataSize = size; ++ if (ret) + return -EIO; + + str += sprintf(str, "0x%lx\n", var->DataSize); +@@ -189,12 +195,15 @@ static ssize_t + efivar_data_read(struct efivar_entry *entry, char *buf) + { + struct efi_variable *var = &entry->var; ++ unsigned long size = sizeof(var->Data); ++ int ret; + + if (!entry || !buf) + return -EINVAL; + +- var->DataSize = 1024; +- if (efivar_entry_get(entry, &var->Attributes, &var->DataSize, var->Data)) ++ ret = efivar_entry_get(entry, &var->Attributes, &size, var->Data); ++ var->DataSize = size; ++ if (ret) + return -EIO; + + memcpy(buf, var->Data, var->DataSize); +@@ -263,6 +272,9 @@ efivar_store_raw(struct efivar_entry *entry, const char *buf, size_t count) + u8 *data; + int err; + ++ if (!entry || !buf) ++ return -EINVAL; ++ + if (is_compat()) { + struct compat_efi_variable *compat; + +@@ -314,14 +326,16 @@ efivar_show_raw(struct efivar_entry *entry, char *buf) + { + struct efi_variable *var = &entry->var; + struct compat_efi_variable *compat; ++ unsigned long datasize = sizeof(var->Data); + size_t size; ++ int ret; + + if (!entry || !buf) + return 0; + +- var->DataSize = 1024; +- if (efivar_entry_get(entry, &entry->var.Attributes, +- &entry->var.DataSize, entry->var.Data)) ++ ret = efivar_entry_get(entry, &var->Attributes, &datasize, var->Data); ++ var->DataSize = datasize; ++ if (ret) + return -EIO; + + if (is_compat()) { +diff --git a/drivers/firmware/efi/runtime-wrappers.c b/drivers/firmware/efi/runtime-wrappers.c +index b0aeffd4e269..92e519d58618 100644 +--- a/drivers/firmware/efi/runtime-wrappers.c ++++ b/drivers/firmware/efi/runtime-wrappers.c +@@ -45,39 +45,7 @@ + #define __efi_call_virt(f, args...) \ + __efi_call_virt_pointer(efi.systab->runtime, f, args) + +-/* efi_runtime_service() function identifiers */ +-enum efi_rts_ids { +- GET_TIME, +- SET_TIME, +- GET_WAKEUP_TIME, +- SET_WAKEUP_TIME, +- GET_VARIABLE, +- GET_NEXT_VARIABLE, +- SET_VARIABLE, +- QUERY_VARIABLE_INFO, +- GET_NEXT_HIGH_MONO_COUNT, +- UPDATE_CAPSULE, +- QUERY_CAPSULE_CAPS, +-}; +- +-/* +- * efi_runtime_work: Details of EFI Runtime Service work +- * @arg<1-5>: EFI Runtime Service function arguments +- * @status: Status of executing EFI Runtime Service +- * @efi_rts_id: EFI Runtime Service function identifier +- * @efi_rts_comp: Struct used for handling completions +- */ +-struct efi_runtime_work { +- void *arg1; +- void *arg2; +- void *arg3; +- void *arg4; +- void *arg5; +- efi_status_t status; +- struct work_struct work; +- enum efi_rts_ids efi_rts_id; +- struct completion efi_rts_comp; +-}; ++struct efi_runtime_work efi_rts_work; + + /* + * efi_queue_work: Queue efi_runtime_service() and wait until it's done +@@ -91,7 +59,6 @@ struct efi_runtime_work { + */ + #define efi_queue_work(_rts, _arg1, _arg2, _arg3, _arg4, _arg5) \ + ({ \ +- struct efi_runtime_work efi_rts_work; \ + efi_rts_work.status = EFI_ABORTED; \ + \ + init_completion(&efi_rts_work.efi_rts_comp); \ +@@ -191,18 +158,16 @@ extern struct semaphore __efi_uv_runtime_lock __alias(efi_runtime_lock); + */ + static void efi_call_rts(struct work_struct *work) + { +- struct efi_runtime_work *efi_rts_work; + void *arg1, *arg2, *arg3, *arg4, *arg5; + efi_status_t status = EFI_NOT_FOUND; + +- efi_rts_work = container_of(work, struct efi_runtime_work, work); +- arg1 = efi_rts_work->arg1; +- arg2 = efi_rts_work->arg2; +- arg3 = efi_rts_work->arg3; +- arg4 = efi_rts_work->arg4; +- arg5 = efi_rts_work->arg5; ++ arg1 = efi_rts_work.arg1; ++ arg2 = efi_rts_work.arg2; ++ arg3 = efi_rts_work.arg3; ++ arg4 = efi_rts_work.arg4; ++ arg5 = efi_rts_work.arg5; + +- switch (efi_rts_work->efi_rts_id) { ++ switch (efi_rts_work.efi_rts_id) { + case GET_TIME: + status = efi_call_virt(get_time, (efi_time_t *)arg1, + (efi_time_cap_t *)arg2); +@@ -260,8 +225,8 @@ static void efi_call_rts(struct work_struct *work) + */ + pr_err("Requested executing invalid EFI Runtime Service.\n"); + } +- efi_rts_work->status = status; +- complete(&efi_rts_work->efi_rts_comp); ++ efi_rts_work.status = status; ++ complete(&efi_rts_work.efi_rts_comp); + } + + static efi_status_t virt_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc) +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +index d1fbaea91f58..95f7bb22402f 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_atombios.c +@@ -364,8 +364,7 @@ bool amdgpu_atombios_get_connector_info_from_object_table(struct amdgpu_device * + router.ddc_valid = false; + router.cd_valid = false; + for (j = 0; j < ((le16_to_cpu(path->usSize) - 8) / 2); j++) { +- uint8_t grph_obj_type= +- grph_obj_type = ++ uint8_t grph_obj_type = + (le16_to_cpu(path->usGraphicObjIds[j]) & + OBJECT_TYPE_MASK) >> OBJECT_TYPE_SHIFT; + +diff --git a/drivers/gpu/drm/i915/gvt/vgpu.c b/drivers/gpu/drm/i915/gvt/vgpu.c +index 69bba88906cd..9cf769f8ebb2 100644 +--- a/drivers/gpu/drm/i915/gvt/vgpu.c ++++ b/drivers/gpu/drm/i915/gvt/vgpu.c +@@ -272,10 +272,17 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu) + { + struct intel_gvt *gvt = vgpu->gvt; + +- mutex_lock(&vgpu->vgpu_lock); +- + WARN(vgpu->active, "vGPU is still active!\n"); + ++ /* ++ * remove idr first so later clean can judge if need to stop ++ * service if no active vgpu. ++ */ ++ mutex_lock(&gvt->lock); ++ idr_remove(&gvt->vgpu_idr, vgpu->id); ++ mutex_unlock(&gvt->lock); ++ ++ mutex_lock(&vgpu->vgpu_lock); + intel_gvt_debugfs_remove_vgpu(vgpu); + intel_vgpu_clean_sched_policy(vgpu); + intel_vgpu_clean_submission(vgpu); +@@ -290,7 +297,6 @@ void intel_gvt_destroy_vgpu(struct intel_vgpu *vgpu) + mutex_unlock(&vgpu->vgpu_lock); + + mutex_lock(&gvt->lock); +- idr_remove(&gvt->vgpu_idr, vgpu->id); + if (idr_is_empty(&gvt->vgpu_idr)) + intel_gvt_clean_irq(gvt); + intel_gvt_update_vgpu_types(gvt); +diff --git a/drivers/i2c/busses/i2c-gpio.c b/drivers/i2c/busses/i2c-gpio.c +index c008d209f0b8..87014d144ccd 100644 +--- a/drivers/i2c/busses/i2c-gpio.c ++++ b/drivers/i2c/busses/i2c-gpio.c +@@ -248,7 +248,7 @@ static struct gpio_desc *i2c_gpio_get_desc(struct device *dev, + if (ret == -ENOENT) + retdesc = ERR_PTR(-EPROBE_DEFER); + +- if (ret != -EPROBE_DEFER) ++ if (PTR_ERR(retdesc) != -EPROBE_DEFER) + dev_err(dev, "error trying to get descriptor: %d\n", ret); + + return retdesc; +diff --git a/drivers/i2c/i2c-core-acpi.c b/drivers/i2c/i2c-core-acpi.c +index 559c3b1284d7..eb0569359387 100644 +--- a/drivers/i2c/i2c-core-acpi.c ++++ b/drivers/i2c/i2c-core-acpi.c +@@ -352,10 +352,18 @@ static struct i2c_adapter *i2c_acpi_find_adapter_by_handle(acpi_handle handle) + static struct i2c_client *i2c_acpi_find_client_by_adev(struct acpi_device *adev) + { + struct device *dev; ++ struct i2c_client *client; + + dev = bus_find_device(&i2c_bus_type, NULL, adev, + i2c_acpi_find_match_device); +- return dev ? i2c_verify_client(dev) : NULL; ++ if (!dev) ++ return NULL; ++ ++ client = i2c_verify_client(dev); ++ if (!client) ++ put_device(dev); ++ ++ return client; + } + + static int i2c_acpi_notify(struct notifier_block *nb, unsigned long value, +diff --git a/drivers/iommu/dma-iommu.c b/drivers/iommu/dma-iommu.c +index f9dbb064f957..31ba8f92584a 100644 +--- a/drivers/iommu/dma-iommu.c ++++ b/drivers/iommu/dma-iommu.c +@@ -190,15 +190,15 @@ static int cookie_init_hw_msi_region(struct iommu_dma_cookie *cookie, + start -= iova_offset(iovad, start); + num_pages = iova_align(iovad, end - start) >> iova_shift(iovad); + +- msi_page = kcalloc(num_pages, sizeof(*msi_page), GFP_KERNEL); +- if (!msi_page) +- return -ENOMEM; +- + for (i = 0; i < num_pages; i++) { +- msi_page[i].phys = start; +- msi_page[i].iova = start; +- INIT_LIST_HEAD(&msi_page[i].list); +- list_add(&msi_page[i].list, &cookie->msi_page_list); ++ msi_page = kmalloc(sizeof(*msi_page), GFP_KERNEL); ++ if (!msi_page) ++ return -ENOMEM; ++ ++ msi_page->phys = start; ++ msi_page->iova = start; ++ INIT_LIST_HEAD(&msi_page->list); ++ list_add(&msi_page->list, &cookie->msi_page_list); + start += iovad->granule; + } + +diff --git a/drivers/iommu/dmar.c b/drivers/iommu/dmar.c +index 72994d67bc5b..d936ff765fe4 100644 +--- a/drivers/iommu/dmar.c ++++ b/drivers/iommu/dmar.c +@@ -39,6 +39,7 @@ + #include <linux/dmi.h> + #include <linux/slab.h> + #include <linux/iommu.h> ++#include <linux/limits.h> + #include <asm/irq_remapping.h> + #include <asm/iommu_table.h> + +@@ -139,6 +140,13 @@ dmar_alloc_pci_notify_info(struct pci_dev *dev, unsigned long event) + + BUG_ON(dev->is_virtfn); + ++ /* ++ * Ignore devices that have a domain number higher than what can ++ * be looked up in DMAR, e.g. VMD subdevices with domain 0x10000 ++ */ ++ if (pci_domain_nr(dev->bus) > U16_MAX) ++ return NULL; ++ + /* Only generate path[] for device addition event */ + if (event == BUS_NOTIFY_ADD_DEVICE) + for (tmp = dev; tmp; tmp = tmp->bus->self) +@@ -451,12 +459,13 @@ static int __init dmar_parse_one_andd(struct acpi_dmar_header *header, + + /* Check for NUL termination within the designated length */ + if (strnlen(andd->device_name, header->length - 8) == header->length - 8) { +- WARN_TAINT(1, TAINT_FIRMWARE_WORKAROUND, ++ pr_warn(FW_BUG + "Your BIOS is broken; ANDD object name is not NUL-terminated\n" + "BIOS vendor: %s; Ver: %s; Product Version: %s\n", + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + return -EINVAL; + } + pr_info("ANDD device: %x name: %s\n", andd->device_number, +@@ -482,14 +491,14 @@ static int dmar_parse_one_rhsa(struct acpi_dmar_header *header, void *arg) + return 0; + } + } +- WARN_TAINT( +- 1, TAINT_FIRMWARE_WORKAROUND, ++ pr_warn(FW_BUG + "Your BIOS is broken; RHSA refers to non-existent DMAR unit at %llx\n" + "BIOS vendor: %s; Ver: %s; Product Version: %s\n", +- drhd->reg_base_addr, ++ rhsa->base_address, + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + + return 0; + } +@@ -838,14 +847,14 @@ int __init dmar_table_init(void) + + static void warn_invalid_dmar(u64 addr, const char *message) + { +- WARN_TAINT_ONCE( +- 1, TAINT_FIRMWARE_WORKAROUND, ++ pr_warn_once(FW_BUG + "Your BIOS is broken; DMAR reported at address %llx%s!\n" + "BIOS vendor: %s; Ver: %s; Product Version: %s\n", + addr, message, + dmi_get_system_info(DMI_BIOS_VENDOR), + dmi_get_system_info(DMI_BIOS_VERSION), + dmi_get_system_info(DMI_PRODUCT_VERSION)); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + } + + static int __ref +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 9df3b8441227..2a83fc31dd47 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -3998,10 +3998,11 @@ static void quirk_ioat_snb_local_iommu(struct pci_dev *pdev) + + /* we know that the this iommu should be at offset 0xa000 from vtbar */ + drhd = dmar_find_matched_drhd_unit(pdev); +- if (WARN_TAINT_ONCE(!drhd || drhd->reg_base_addr - vtbar != 0xa000, +- TAINT_FIRMWARE_WORKAROUND, +- "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n")) ++ if (!drhd || drhd->reg_base_addr - vtbar != 0xa000) { ++ pr_warn_once(FW_BUG "BIOS assigned incorrect VT-d unit for Intel(R) QuickData Technology device\n"); ++ add_taint(TAINT_FIRMWARE_WORKAROUND, LOCKDEP_STILL_OK); + pdev->dev.archdata.iommu = DUMMY_DEVICE_DOMAIN_INFO; ++ } + } + DECLARE_PCI_FIXUP_ENABLE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_IOAT_SNB, quirk_ioat_snb_local_iommu); + +@@ -5143,8 +5144,10 @@ static phys_addr_t intel_iommu_iova_to_phys(struct iommu_domain *domain, + u64 phys = 0; + + pte = pfn_to_dma_pte(dmar_domain, iova >> VTD_PAGE_SHIFT, &level); +- if (pte) +- phys = dma_pte_addr(pte); ++ if (pte && dma_pte_present(pte)) ++ phys = dma_pte_addr(pte) + ++ (iova & (BIT_MASK(level_to_offset_bits(level) + ++ VTD_PAGE_SHIFT) - 1)); + + return phys; + } +diff --git a/drivers/macintosh/windfarm_ad7417_sensor.c b/drivers/macintosh/windfarm_ad7417_sensor.c +index 7c28b71246c9..781238d203c8 100644 +--- a/drivers/macintosh/windfarm_ad7417_sensor.c ++++ b/drivers/macintosh/windfarm_ad7417_sensor.c +@@ -313,9 +313,16 @@ static const struct i2c_device_id wf_ad7417_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, wf_ad7417_id); + ++static const struct of_device_id wf_ad7417_of_id[] = { ++ { .compatible = "ad7417", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, wf_ad7417_of_id); ++ + static struct i2c_driver wf_ad7417_driver = { + .driver = { + .name = "wf_ad7417", ++ .of_match_table = wf_ad7417_of_id, + }, + .probe = wf_ad7417_probe, + .remove = wf_ad7417_remove, +diff --git a/drivers/macintosh/windfarm_fcu_controls.c b/drivers/macintosh/windfarm_fcu_controls.c +index fab7a21e9577..177791ff8344 100644 +--- a/drivers/macintosh/windfarm_fcu_controls.c ++++ b/drivers/macintosh/windfarm_fcu_controls.c +@@ -583,9 +583,16 @@ static const struct i2c_device_id wf_fcu_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, wf_fcu_id); + ++static const struct of_device_id wf_fcu_of_id[] = { ++ { .compatible = "fcu", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, wf_fcu_of_id); ++ + static struct i2c_driver wf_fcu_driver = { + .driver = { + .name = "wf_fcu", ++ .of_match_table = wf_fcu_of_id, + }, + .probe = wf_fcu_probe, + .remove = wf_fcu_remove, +diff --git a/drivers/macintosh/windfarm_lm75_sensor.c b/drivers/macintosh/windfarm_lm75_sensor.c +index 6cdfe714901d..f48ad2445ed6 100644 +--- a/drivers/macintosh/windfarm_lm75_sensor.c ++++ b/drivers/macintosh/windfarm_lm75_sensor.c +@@ -15,6 +15,7 @@ + #include <linux/init.h> + #include <linux/wait.h> + #include <linux/i2c.h> ++#include <linux/of_device.h> + #include <asm/prom.h> + #include <asm/machdep.h> + #include <asm/io.h> +@@ -92,9 +93,14 @@ static int wf_lm75_probe(struct i2c_client *client, + const struct i2c_device_id *id) + { + struct wf_lm75_sensor *lm; +- int rc, ds1775 = id->driver_data; ++ int rc, ds1775; + const char *name, *loc; + ++ if (id) ++ ds1775 = id->driver_data; ++ else ++ ds1775 = !!of_device_get_match_data(&client->dev); ++ + DBG("wf_lm75: creating %s device at address 0x%02x\n", + ds1775 ? "ds1775" : "lm75", client->addr); + +@@ -165,9 +171,17 @@ static const struct i2c_device_id wf_lm75_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, wf_lm75_id); + ++static const struct of_device_id wf_lm75_of_id[] = { ++ { .compatible = "lm75", .data = (void *)0}, ++ { .compatible = "ds1775", .data = (void *)1 }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, wf_lm75_of_id); ++ + static struct i2c_driver wf_lm75_driver = { + .driver = { + .name = "wf_lm75", ++ .of_match_table = wf_lm75_of_id, + }, + .probe = wf_lm75_probe, + .remove = wf_lm75_remove, +diff --git a/drivers/macintosh/windfarm_lm87_sensor.c b/drivers/macintosh/windfarm_lm87_sensor.c +index 35aa571d498a..8b57a1fa6ae3 100644 +--- a/drivers/macintosh/windfarm_lm87_sensor.c ++++ b/drivers/macintosh/windfarm_lm87_sensor.c +@@ -168,9 +168,16 @@ static const struct i2c_device_id wf_lm87_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, wf_lm87_id); + ++static const struct of_device_id wf_lm87_of_id[] = { ++ { .compatible = "lm87cimt", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, wf_lm87_of_id); ++ + static struct i2c_driver wf_lm87_driver = { + .driver = { + .name = "wf_lm87", ++ .of_match_table = wf_lm87_of_id, + }, + .probe = wf_lm87_probe, + .remove = wf_lm87_remove, +diff --git a/drivers/macintosh/windfarm_max6690_sensor.c b/drivers/macintosh/windfarm_max6690_sensor.c +index 6ad035e13c08..d34a25a5a6d9 100644 +--- a/drivers/macintosh/windfarm_max6690_sensor.c ++++ b/drivers/macintosh/windfarm_max6690_sensor.c +@@ -121,9 +121,16 @@ static const struct i2c_device_id wf_max6690_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, wf_max6690_id); + ++static const struct of_device_id wf_max6690_of_id[] = { ++ { .compatible = "max6690", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, wf_max6690_of_id); ++ + static struct i2c_driver wf_max6690_driver = { + .driver = { + .name = "wf_max6690", ++ .of_match_table = wf_max6690_of_id, + }, + .probe = wf_max6690_probe, + .remove = wf_max6690_remove, +diff --git a/drivers/macintosh/windfarm_smu_sat.c b/drivers/macintosh/windfarm_smu_sat.c +index a0f61eb853c5..51ef77de4174 100644 +--- a/drivers/macintosh/windfarm_smu_sat.c ++++ b/drivers/macintosh/windfarm_smu_sat.c +@@ -343,9 +343,16 @@ static const struct i2c_device_id wf_sat_id[] = { + }; + MODULE_DEVICE_TABLE(i2c, wf_sat_id); + ++static const struct of_device_id wf_sat_of_id[] = { ++ { .compatible = "smu-sat", }, ++ { } ++}; ++MODULE_DEVICE_TABLE(of, wf_sat_of_id); ++ + static struct i2c_driver wf_sat_driver = { + .driver = { + .name = "wf_smu_sat", ++ .of_match_table = wf_sat_of_id, + }, + .probe = wf_sat_probe, + .remove = wf_sat_remove, +diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c +index 334e3f22d4f1..2ee046c81389 100644 +--- a/drivers/net/bonding/bond_alb.c ++++ b/drivers/net/bonding/bond_alb.c +@@ -66,11 +66,6 @@ struct arp_pkt { + }; + #pragma pack() + +-static inline struct arp_pkt *arp_pkt(const struct sk_buff *skb) +-{ +- return (struct arp_pkt *)skb_network_header(skb); +-} +- + /* Forward declaration */ + static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[], + bool strict_match); +@@ -568,10 +563,11 @@ static void rlb_req_update_subnet_clients(struct bonding *bond, __be32 src_ip) + spin_unlock(&bond->mode_lock); + } + +-static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bond) ++static struct slave *rlb_choose_channel(struct sk_buff *skb, ++ struct bonding *bond, ++ const struct arp_pkt *arp) + { + struct alb_bond_info *bond_info = &(BOND_ALB_INFO(bond)); +- struct arp_pkt *arp = arp_pkt(skb); + struct slave *assigned_slave, *curr_active_slave; + struct rlb_client_info *client_info; + u32 hash_index = 0; +@@ -668,8 +664,12 @@ static struct slave *rlb_choose_channel(struct sk_buff *skb, struct bonding *bon + */ + static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) + { +- struct arp_pkt *arp = arp_pkt(skb); + struct slave *tx_slave = NULL; ++ struct arp_pkt *arp; ++ ++ if (!pskb_network_may_pull(skb, sizeof(*arp))) ++ return NULL; ++ arp = (struct arp_pkt *)skb_network_header(skb); + + /* Don't modify or load balance ARPs that do not originate locally + * (e.g.,arrive via a bridge). +@@ -679,7 +679,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) + + if (arp->op_code == htons(ARPOP_REPLY)) { + /* the arp must be sent on the selected rx channel */ +- tx_slave = rlb_choose_channel(skb, bond); ++ tx_slave = rlb_choose_channel(skb, bond, arp); + if (tx_slave) + bond_hw_addr_copy(arp->mac_src, tx_slave->dev->dev_addr, + tx_slave->dev->addr_len); +@@ -690,7 +690,7 @@ static struct slave *rlb_arp_xmit(struct sk_buff *skb, struct bonding *bond) + * When the arp reply is received the entry will be updated + * with the correct unicast address of the client. + */ +- rlb_choose_channel(skb, bond); ++ rlb_choose_channel(skb, bond, arp); + + /* The ARP reply packets must be delayed so that + * they can cancel out the influence of the ARP request. +diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c +index 49b853f53f59..1545f2b299d0 100644 +--- a/drivers/net/can/dev.c ++++ b/drivers/net/can/dev.c +@@ -892,6 +892,7 @@ static const struct nla_policy can_policy[IFLA_CAN_MAX + 1] = { + = { .len = sizeof(struct can_bittiming) }, + [IFLA_CAN_DATA_BITTIMING_CONST] + = { .len = sizeof(struct can_bittiming_const) }, ++ [IFLA_CAN_TERMINATION] = { .type = NLA_U16 }, + }; + + static int can_validate(struct nlattr *tb[], struct nlattr *data[], +diff --git a/drivers/net/ethernet/broadcom/bcmsysport.c b/drivers/net/ethernet/broadcom/bcmsysport.c +index 6f8649376ff0..3fdf135bad56 100644 +--- a/drivers/net/ethernet/broadcom/bcmsysport.c ++++ b/drivers/net/ethernet/broadcom/bcmsysport.c +@@ -2168,7 +2168,7 @@ static int bcm_sysport_rule_set(struct bcm_sysport_priv *priv, + return -ENOSPC; + + index = find_first_zero_bit(priv->filters, RXCHK_BRCM_TAG_MAX); +- if (index > RXCHK_BRCM_TAG_MAX) ++ if (index >= RXCHK_BRCM_TAG_MAX) + return -ENOSPC; + + /* Location is the classification ID, and index is the position +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index c19d0eabeb52..911cea2e5aa5 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -8097,13 +8097,13 @@ static int bnxt_change_mtu(struct net_device *dev, int new_mtu) + struct bnxt *bp = netdev_priv(dev); + + if (netif_running(dev)) +- bnxt_close_nic(bp, false, false); ++ bnxt_close_nic(bp, true, false); + + dev->mtu = new_mtu; + bnxt_set_ring_params(bp); + + if (netif_running(dev)) +- return bnxt_open_nic(bp, false, false); ++ return bnxt_open_nic(bp, true, false); + + return 0; + } +diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c +index 296ae1e4c322..9142992ccd5a 100644 +--- a/drivers/net/ethernet/freescale/fec_main.c ++++ b/drivers/net/ethernet/freescale/fec_main.c +@@ -2476,15 +2476,15 @@ fec_enet_set_coalesce(struct net_device *ndev, struct ethtool_coalesce *ec) + return -EINVAL; + } + +- cycle = fec_enet_us_to_itr_clock(ndev, fep->rx_time_itr); ++ cycle = fec_enet_us_to_itr_clock(ndev, ec->rx_coalesce_usecs); + if (cycle > 0xFFFF) { + pr_err("Rx coalesced usec exceed hardware limitation\n"); + return -EINVAL; + } + +- cycle = fec_enet_us_to_itr_clock(ndev, fep->tx_time_itr); ++ cycle = fec_enet_us_to_itr_clock(ndev, ec->tx_coalesce_usecs); + if (cycle > 0xFFFF) { +- pr_err("Rx coalesced usec exceed hardware limitation\n"); ++ pr_err("Tx coalesced usec exceed hardware limitation\n"); + return -EINVAL; + } + +diff --git a/drivers/net/ethernet/sfc/efx.c b/drivers/net/ethernet/sfc/efx.c +index 3d0dd39c289e..f448e7d669cf 100644 +--- a/drivers/net/ethernet/sfc/efx.c ++++ b/drivers/net/ethernet/sfc/efx.c +@@ -522,6 +522,7 @@ efx_copy_channel(const struct efx_channel *old_channel) + if (tx_queue->channel) + tx_queue->channel = channel; + tx_queue->buffer = NULL; ++ tx_queue->cb_page = NULL; + memset(&tx_queue->txd, 0, sizeof(tx_queue->txd)); + } + +diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c +index 21d131347e2e..7b2a84320aab 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c ++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac1000_core.c +@@ -34,6 +34,7 @@ + static void dwmac1000_core_init(struct mac_device_info *hw, + struct net_device *dev) + { ++ struct stmmac_priv *priv = netdev_priv(dev); + void __iomem *ioaddr = hw->pcsr; + u32 value = readl(ioaddr + GMAC_CONTROL); + int mtu = dev->mtu; +@@ -45,7 +46,7 @@ static void dwmac1000_core_init(struct mac_device_info *hw, + * Broadcom tags can look like invalid LLC/SNAP packets and cause the + * hardware to truncate packets on reception. + */ +- if (netdev_uses_dsa(dev)) ++ if (netdev_uses_dsa(dev) || !priv->plat->enh_desc) + value &= ~GMAC_CONTROL_ACS; + + if (mtu > 1500) +diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c +index 1a8132eb2a3e..40ac60904c8d 100644 +--- a/drivers/net/ipvlan/ipvlan_core.c ++++ b/drivers/net/ipvlan/ipvlan_core.c +@@ -298,6 +298,7 @@ void ipvlan_process_multicast(struct work_struct *work) + } + if (dev) + dev_put(dev); ++ cond_resched(); + } + } + +@@ -504,19 +505,21 @@ static int ipvlan_process_outbound(struct sk_buff *skb) + struct ethhdr *ethh = eth_hdr(skb); + int ret = NET_XMIT_DROP; + +- /* In this mode we dont care about multicast and broadcast traffic */ +- if (is_multicast_ether_addr(ethh->h_dest)) { +- pr_debug_ratelimited("Dropped {multi|broad}cast of type=[%x]\n", +- ntohs(skb->protocol)); +- kfree_skb(skb); +- goto out; +- } +- + /* The ipvlan is a pseudo-L2 device, so the packets that we receive + * will have L2; which need to discarded and processed further + * in the net-ns of the main-device. + */ + if (skb_mac_header_was_set(skb)) { ++ /* In this mode we dont care about ++ * multicast and broadcast traffic */ ++ if (is_multicast_ether_addr(ethh->h_dest)) { ++ pr_debug_ratelimited( ++ "Dropped {multi|broad}cast of type=[%x]\n", ++ ntohs(skb->protocol)); ++ kfree_skb(skb); ++ goto out; ++ } ++ + skb_pull(skb, sizeof(*ethh)); + skb->mac_header = (typeof(skb->mac_header))~0U; + skb_reset_network_header(skb); +diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c +index 0115a2868933..87f605a33c37 100644 +--- a/drivers/net/ipvlan/ipvlan_main.c ++++ b/drivers/net/ipvlan/ipvlan_main.c +@@ -236,7 +236,6 @@ static void ipvlan_uninit(struct net_device *dev) + static int ipvlan_open(struct net_device *dev) + { + struct ipvl_dev *ipvlan = netdev_priv(dev); +- struct net_device *phy_dev = ipvlan->phy_dev; + struct ipvl_addr *addr; + + if (ipvlan->port->mode == IPVLAN_MODE_L3 || +@@ -250,7 +249,7 @@ static int ipvlan_open(struct net_device *dev) + ipvlan_ht_addr_add(ipvlan, addr); + rcu_read_unlock(); + +- return dev_uc_add(phy_dev, phy_dev->dev_addr); ++ return 0; + } + + static int ipvlan_stop(struct net_device *dev) +@@ -262,8 +261,6 @@ static int ipvlan_stop(struct net_device *dev) + dev_uc_unsync(phy_dev, dev); + dev_mc_unsync(phy_dev, dev); + +- dev_uc_del(phy_dev, phy_dev->dev_addr); +- + rcu_read_lock(); + list_for_each_entry_rcu(addr, &ipvlan->addrs, anode) + ipvlan_ht_addr_del(addr); +diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c +index 10a8ef2d025a..9a8ec94e8a44 100644 +--- a/drivers/net/macsec.c ++++ b/drivers/net/macsec.c +@@ -2886,6 +2886,11 @@ static void macsec_dev_set_rx_mode(struct net_device *dev) + dev_uc_sync(real_dev, dev); + } + ++static sci_t dev_to_sci(struct net_device *dev, __be16 port) ++{ ++ return make_sci(dev->dev_addr, port); ++} ++ + static int macsec_set_mac_address(struct net_device *dev, void *p) + { + struct macsec_dev *macsec = macsec_priv(dev); +@@ -2907,6 +2912,7 @@ static int macsec_set_mac_address(struct net_device *dev, void *p) + + out: + ether_addr_copy(dev->dev_addr, addr->sa_data); ++ macsec->secy.sci = dev_to_sci(dev, MACSEC_PORT_ES); + return 0; + } + +@@ -2989,6 +2995,7 @@ static const struct device_type macsec_type = { + + static const struct nla_policy macsec_rtnl_policy[IFLA_MACSEC_MAX + 1] = { + [IFLA_MACSEC_SCI] = { .type = NLA_U64 }, ++ [IFLA_MACSEC_PORT] = { .type = NLA_U16 }, + [IFLA_MACSEC_ICV_LEN] = { .type = NLA_U8 }, + [IFLA_MACSEC_CIPHER_SUITE] = { .type = NLA_U64 }, + [IFLA_MACSEC_WINDOW] = { .type = NLA_U32 }, +@@ -3188,11 +3195,6 @@ static bool sci_exists(struct net_device *dev, sci_t sci) + return false; + } + +-static sci_t dev_to_sci(struct net_device *dev, __be16 port) +-{ +- return make_sci(dev->dev_addr, port); +-} +- + static int macsec_add_dev(struct net_device *dev, sci_t sci, u8 icv_len) + { + struct macsec_dev *macsec = macsec_priv(dev); +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 277bbff53cff..a8f338dc0dfa 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -338,6 +338,8 @@ static void macvlan_process_broadcast(struct work_struct *w) + if (src) + dev_put(src->dev); + kfree_skb(skb); ++ ++ cond_resched(); + } + } + +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index ae40d8137fd2..302d183beb9e 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -76,7 +76,7 @@ static LIST_HEAD(phy_fixup_list); + static DEFINE_MUTEX(phy_fixup_lock); + + #ifdef CONFIG_PM +-static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) ++static bool mdio_bus_phy_may_suspend(struct phy_device *phydev) + { + struct device_driver *drv = phydev->mdio.dev.driver; + struct phy_driver *phydrv = to_phy_driver(drv); +@@ -88,11 +88,10 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) + /* PHY not attached? May suspend if the PHY has not already been + * suspended as part of a prior call to phy_disconnect() -> + * phy_detach() -> phy_suspend() because the parent netdev might be the +- * MDIO bus driver and clock gated at this point. Also may resume if +- * PHY is not attached. ++ * MDIO bus driver and clock gated at this point. + */ + if (!netdev) +- return suspend ? !phydev->suspended : phydev->suspended; ++ goto out; + + if (netdev->wol_enabled) + return false; +@@ -112,7 +111,8 @@ static bool mdio_bus_phy_may_suspend(struct phy_device *phydev, bool suspend) + if (device_may_wakeup(&netdev->dev)) + return false; + +- return true; ++out: ++ return !phydev->suspended; + } + + static int mdio_bus_phy_suspend(struct device *dev) +@@ -127,9 +127,11 @@ static int mdio_bus_phy_suspend(struct device *dev) + if (phydev->attached_dev && phydev->adjust_link) + phy_stop_machine(phydev); + +- if (!mdio_bus_phy_may_suspend(phydev, true)) ++ if (!mdio_bus_phy_may_suspend(phydev)) + return 0; + ++ phydev->suspended_by_mdio_bus = 1; ++ + return phy_suspend(phydev); + } + +@@ -138,9 +140,11 @@ static int mdio_bus_phy_resume(struct device *dev) + struct phy_device *phydev = to_phy_device(dev); + int ret; + +- if (!mdio_bus_phy_may_suspend(phydev, false)) ++ if (!phydev->suspended_by_mdio_bus) + goto no_resume; + ++ phydev->suspended_by_mdio_bus = 0; ++ + ret = phy_resume(phydev); + if (ret < 0) + return ret; +diff --git a/drivers/net/slip/slhc.c b/drivers/net/slip/slhc.c +index ea90db3c7705..01334aeac577 100644 +--- a/drivers/net/slip/slhc.c ++++ b/drivers/net/slip/slhc.c +@@ -232,7 +232,7 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, + register struct cstate *cs = lcs->next; + register unsigned long deltaS, deltaA; + register short changes = 0; +- int hlen; ++ int nlen, hlen; + unsigned char new_seq[16]; + register unsigned char *cp = new_seq; + struct iphdr *ip; +@@ -248,6 +248,8 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, + return isize; + + ip = (struct iphdr *) icp; ++ if (ip->version != 4 || ip->ihl < 5) ++ return isize; + + /* Bail if this packet isn't TCP, or is an IP fragment */ + if (ip->protocol != IPPROTO_TCP || (ntohs(ip->frag_off) & 0x3fff)) { +@@ -258,10 +260,14 @@ slhc_compress(struct slcompress *comp, unsigned char *icp, int isize, + comp->sls_o_tcp++; + return isize; + } +- /* Extract TCP header */ ++ nlen = ip->ihl * 4; ++ if (isize < nlen + sizeof(*th)) ++ return isize; + +- th = (struct tcphdr *)(((unsigned char *)ip) + ip->ihl*4); +- hlen = ip->ihl*4 + th->doff*4; ++ th = (struct tcphdr *)(icp + nlen); ++ if (th->doff < sizeof(struct tcphdr) / 4) ++ return isize; ++ hlen = nlen + th->doff * 4; + + /* Bail if the TCP packet isn't `compressible' (i.e., ACK isn't set or + * some other control bit is set). Also uncompressible if +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index 3feb49badda9..95524c06e64c 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -2215,6 +2215,8 @@ team_nl_option_policy[TEAM_ATTR_OPTION_MAX + 1] = { + [TEAM_ATTR_OPTION_CHANGED] = { .type = NLA_FLAG }, + [TEAM_ATTR_OPTION_TYPE] = { .type = NLA_U8 }, + [TEAM_ATTR_OPTION_DATA] = { .type = NLA_BINARY }, ++ [TEAM_ATTR_OPTION_PORT_IFINDEX] = { .type = NLA_U32 }, ++ [TEAM_ATTR_OPTION_ARRAY_INDEX] = { .type = NLA_U32 }, + }; + + static int team_nl_cmd_noop(struct sk_buff *skb, struct genl_info *info) +diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c +index c5c188dc6626..0639178cb009 100644 +--- a/drivers/net/usb/r8152.c ++++ b/drivers/net/usb/r8152.c +@@ -2701,6 +2701,8 @@ static u16 r8153_phy_status(struct r8152 *tp, u16 desired) + } + + msleep(20); ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; + } + + return data; +@@ -4062,7 +4064,10 @@ static void r8153_init(struct r8152 *tp) + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; ++ + msleep(20); ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; + } + + data = r8153_phy_status(tp, 0); +@@ -4180,7 +4185,10 @@ static void r8153b_init(struct r8152 *tp) + if (ocp_read_word(tp, MCU_TYPE_PLA, PLA_BOOT_CTRL) & + AUTOLOAD_DONE) + break; ++ + msleep(20); ++ if (test_bit(RTL8152_UNPLUG, &tp->flags)) ++ break; + } + + data = r8153_phy_status(tp, 0); +diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +index 3270faafe0bc..875557ce0d66 100644 +--- a/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c ++++ b/drivers/net/wireless/intel/iwlwifi/mvm/nvm.c +@@ -314,7 +314,8 @@ iwl_parse_nvm_sections(struct iwl_mvm *mvm) + } + + /* PHY_SKU section is mandatory in B0 */ +- if (!mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) { ++ if (mvm->trans->cfg->nvm_type == IWL_NVM_EXT && ++ !mvm->nvm_sections[NVM_SECTION_TYPE_PHY_SKU].data) { + IWL_ERR(mvm, + "Can't parse phy_sku in B0, empty sections\n"); + return NULL; +diff --git a/drivers/net/wireless/mediatek/mt76/dma.c b/drivers/net/wireless/mediatek/mt76/dma.c +index c51da2205b93..cc6840377bc2 100644 +--- a/drivers/net/wireless/mediatek/mt76/dma.c ++++ b/drivers/net/wireless/mediatek/mt76/dma.c +@@ -396,10 +396,13 @@ mt76_add_fragment(struct mt76_dev *dev, struct mt76_queue *q, void *data, + struct page *page = virt_to_head_page(data); + int offset = data - page_address(page); + struct sk_buff *skb = q->rx_head; ++ struct skb_shared_info *shinfo = skb_shinfo(skb); + +- offset += q->buf_offset; +- skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page, offset, len, +- q->buf_size); ++ if (shinfo->nr_frags < ARRAY_SIZE(shinfo->frags)) { ++ offset += q->buf_offset; ++ skb_add_rx_frag(skb, shinfo->nr_frags, page, offset, len, ++ q->buf_size); ++ } + + if (more) + return; +diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c +index c6ff4d5fa482..76638dee65d9 100644 +--- a/drivers/pinctrl/core.c ++++ b/drivers/pinctrl/core.c +@@ -2008,7 +2008,6 @@ static int pinctrl_claim_hogs(struct pinctrl_dev *pctldev) + return PTR_ERR(pctldev->p); + } + +- kref_get(&pctldev->p->users); + pctldev->hog_default = + pinctrl_lookup_state(pctldev->p, PINCTRL_STATE_DEFAULT); + if (IS_ERR(pctldev->hog_default)) { +diff --git a/drivers/pinctrl/meson/pinctrl-meson-gxl.c b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +index 0c0a5018102b..22ddb238e17c 100644 +--- a/drivers/pinctrl/meson/pinctrl-meson-gxl.c ++++ b/drivers/pinctrl/meson/pinctrl-meson-gxl.c +@@ -153,8 +153,8 @@ static const unsigned int sdio_d0_pins[] = { GPIOX_0 }; + static const unsigned int sdio_d1_pins[] = { GPIOX_1 }; + static const unsigned int sdio_d2_pins[] = { GPIOX_2 }; + static const unsigned int sdio_d3_pins[] = { GPIOX_3 }; +-static const unsigned int sdio_cmd_pins[] = { GPIOX_4 }; +-static const unsigned int sdio_clk_pins[] = { GPIOX_5 }; ++static const unsigned int sdio_clk_pins[] = { GPIOX_4 }; ++static const unsigned int sdio_cmd_pins[] = { GPIOX_5 }; + static const unsigned int sdio_irq_pins[] = { GPIOX_7 }; + + static const unsigned int nand_ce0_pins[] = { BOOT_8 }; +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index 2fb6fa51fd3c..f6e3c0089825 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -561,7 +561,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry, + if (server->ops->close) + server->ops->close(xid, tcon, &fid); + cifs_del_pending_open(&open); +- fput(file); + rc = -ENOMEM; + } + +diff --git a/fs/gfs2/inode.c b/fs/gfs2/inode.c +index 998051c4aea7..d968b5c5df21 100644 +--- a/fs/gfs2/inode.c ++++ b/fs/gfs2/inode.c +@@ -1251,7 +1251,7 @@ static int gfs2_atomic_open(struct inode *dir, struct dentry *dentry, + if (!(file->f_mode & FMODE_OPENED)) + return finish_no_open(file, d); + dput(d); +- return 0; ++ return excl && (flags & O_CREAT) ? -EEXIST : 0; + } + + BUG_ON(d != NULL); +diff --git a/fs/open.c b/fs/open.c +index 878478745924..76996f920ebf 100644 +--- a/fs/open.c ++++ b/fs/open.c +@@ -851,9 +851,6 @@ cleanup_file: + * the return value of d_splice_alias(), then the caller needs to perform dput() + * on it after finish_open(). + * +- * On successful return @file is a fully instantiated open file. After this, if +- * an error occurs in ->atomic_open(), it needs to clean up with fput(). +- * + * Returns zero on success or -errno if the open failed. + */ + int finish_open(struct file *file, struct dentry *dentry, +diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h +index b4854b48a4f3..5ed1a2b285cd 100644 +--- a/include/linux/cgroup.h ++++ b/include/linux/cgroup.h +@@ -62,6 +62,7 @@ struct css_task_iter { + struct list_head *mg_tasks_head; + struct list_head *dying_tasks_head; + ++ struct list_head *cur_tasks_head; + struct css_set *cur_cset; + struct css_set *cur_dcset; + struct task_struct *cur_task; +diff --git a/include/linux/efi.h b/include/linux/efi.h +index cc3391796c0b..6797811bf1e6 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -1664,6 +1664,42 @@ struct linux_efi_tpm_eventlog { + + extern int efi_tpm_eventlog_init(void); + ++/* efi_runtime_service() function identifiers */ ++enum efi_rts_ids { ++ GET_TIME, ++ SET_TIME, ++ GET_WAKEUP_TIME, ++ SET_WAKEUP_TIME, ++ GET_VARIABLE, ++ GET_NEXT_VARIABLE, ++ SET_VARIABLE, ++ QUERY_VARIABLE_INFO, ++ GET_NEXT_HIGH_MONO_COUNT, ++ UPDATE_CAPSULE, ++ QUERY_CAPSULE_CAPS, ++}; ++ ++/* ++ * efi_runtime_work: Details of EFI Runtime Service work ++ * @arg<1-5>: EFI Runtime Service function arguments ++ * @status: Status of executing EFI Runtime Service ++ * @efi_rts_id: EFI Runtime Service function identifier ++ * @efi_rts_comp: Struct used for handling completions ++ */ ++struct efi_runtime_work { ++ void *arg1; ++ void *arg2; ++ void *arg3; ++ void *arg4; ++ void *arg5; ++ efi_status_t status; ++ struct work_struct work; ++ enum efi_rts_ids efi_rts_id; ++ struct completion efi_rts_comp; ++}; ++ ++extern struct efi_runtime_work efi_rts_work; ++ + /* Workqueue to queue EFI Runtime Services */ + extern struct workqueue_struct *efi_rts_wq; + +diff --git a/include/linux/inet_diag.h b/include/linux/inet_diag.h +index 39faaaf843e1..c91cf2dee12a 100644 +--- a/include/linux/inet_diag.h ++++ b/include/linux/inet_diag.h +@@ -2,15 +2,10 @@ + #ifndef _INET_DIAG_H_ + #define _INET_DIAG_H_ 1 + ++#include <net/netlink.h> + #include <uapi/linux/inet_diag.h> + +-struct net; +-struct sock; + struct inet_hashinfo; +-struct nlattr; +-struct nlmsghdr; +-struct sk_buff; +-struct netlink_callback; + + struct inet_diag_handler { + void (*dump)(struct sk_buff *skb, +@@ -62,6 +57,17 @@ int inet_diag_bc_sk(const struct nlattr *_bc, struct sock *sk); + + void inet_diag_msg_common_fill(struct inet_diag_msg *r, struct sock *sk); + ++static inline size_t inet_diag_msg_attrs_size(void) ++{ ++ return nla_total_size(1) /* INET_DIAG_SHUTDOWN */ ++ + nla_total_size(1) /* INET_DIAG_TOS */ ++#if IS_ENABLED(CONFIG_IPV6) ++ + nla_total_size(1) /* INET_DIAG_TCLASS */ ++ + nla_total_size(1) /* INET_DIAG_SKV6ONLY */ ++#endif ++ + nla_total_size(4) /* INET_DIAG_MARK */ ++ + nla_total_size(4); /* INET_DIAG_CLASS_ID */ ++} + int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb, + struct inet_diag_msg *r, int ext, + struct user_namespace *user_ns, bool net_admin); +diff --git a/include/linux/phy.h b/include/linux/phy.h +index cd6f637cbbfb..42766e7179d3 100644 +--- a/include/linux/phy.h ++++ b/include/linux/phy.h +@@ -373,6 +373,7 @@ struct phy_c45_device_ids { + * is_pseudo_fixed_link: Set to true if this phy is an Ethernet switch, etc. + * has_fixups: Set to true if this phy has fixups/quirks. + * suspended: Set to true if this phy has been suspended successfully. ++ * suspended_by_mdio_bus: Set to true if this phy was suspended by MDIO bus. + * sysfs_links: Internal boolean tracking sysfs symbolic links setup/removal. + * loopback_enabled: Set true if this phy has been loopbacked successfully. + * state: state of the PHY for management purposes +@@ -411,6 +412,7 @@ struct phy_device { + unsigned is_pseudo_fixed_link:1; + unsigned has_fixups:1; + unsigned suspended:1; ++ unsigned suspended_by_mdio_bus:1; + unsigned sysfs_links:1; + unsigned loopback_enabled:1; + +diff --git a/include/net/fib_rules.h b/include/net/fib_rules.h +index b473df5b9512..10886c19cfc5 100644 +--- a/include/net/fib_rules.h ++++ b/include/net/fib_rules.h +@@ -107,6 +107,7 @@ struct fib_rule_notifier_info { + [FRA_OIFNAME] = { .type = NLA_STRING, .len = IFNAMSIZ - 1 }, \ + [FRA_PRIORITY] = { .type = NLA_U32 }, \ + [FRA_FWMARK] = { .type = NLA_U32 }, \ ++ [FRA_TUN_ID] = { .type = NLA_U64 }, \ + [FRA_FWMASK] = { .type = NLA_U32 }, \ + [FRA_TABLE] = { .type = NLA_U32 }, \ + [FRA_SUPPRESS_PREFIXLEN] = { .type = NLA_U32 }, \ +diff --git a/kernel/cgroup/cgroup.c b/kernel/cgroup/cgroup.c +index 08bd40d90066..877ba6dacca8 100644 +--- a/kernel/cgroup/cgroup.c ++++ b/kernel/cgroup/cgroup.c +@@ -4157,12 +4157,16 @@ static void css_task_iter_advance_css_set(struct css_task_iter *it) + } + } while (!css_set_populated(cset) && list_empty(&cset->dying_tasks)); + +- if (!list_empty(&cset->tasks)) ++ if (!list_empty(&cset->tasks)) { + it->task_pos = cset->tasks.next; +- else if (!list_empty(&cset->mg_tasks)) ++ it->cur_tasks_head = &cset->tasks; ++ } else if (!list_empty(&cset->mg_tasks)) { + it->task_pos = cset->mg_tasks.next; +- else ++ it->cur_tasks_head = &cset->mg_tasks; ++ } else { + it->task_pos = cset->dying_tasks.next; ++ it->cur_tasks_head = &cset->dying_tasks; ++ } + + it->tasks_head = &cset->tasks; + it->mg_tasks_head = &cset->mg_tasks; +@@ -4220,10 +4224,14 @@ repeat: + else + it->task_pos = it->task_pos->next; + +- if (it->task_pos == it->tasks_head) ++ if (it->task_pos == it->tasks_head) { + it->task_pos = it->mg_tasks_head->next; +- if (it->task_pos == it->mg_tasks_head) ++ it->cur_tasks_head = it->mg_tasks_head; ++ } ++ if (it->task_pos == it->mg_tasks_head) { + it->task_pos = it->dying_tasks_head->next; ++ it->cur_tasks_head = it->dying_tasks_head; ++ } + if (it->task_pos == it->dying_tasks_head) + css_task_iter_advance_css_set(it); + } else { +@@ -4242,11 +4250,12 @@ repeat: + goto repeat; + + /* and dying leaders w/o live member threads */ +- if (!atomic_read(&task->signal->live)) ++ if (it->cur_tasks_head == it->dying_tasks_head && ++ !atomic_read(&task->signal->live)) + goto repeat; + } else { + /* skip all dying ones */ +- if (task->flags & PF_EXITING) ++ if (it->cur_tasks_head == it->dying_tasks_head) + goto repeat; + } + } +@@ -4355,6 +4364,9 @@ static void *cgroup_procs_next(struct seq_file *s, void *v, loff_t *pos) + struct kernfs_open_file *of = s->private; + struct css_task_iter *it = of->priv; + ++ if (pos) ++ (*pos)++; ++ + return css_task_iter_next(it); + } + +@@ -4370,7 +4382,7 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, + * from position 0, so we can simply keep iterating on !0 *pos. + */ + if (!it) { +- if (WARN_ON_ONCE((*pos)++)) ++ if (WARN_ON_ONCE((*pos))) + return ERR_PTR(-EINVAL); + + it = kzalloc(sizeof(*it), GFP_KERNEL); +@@ -4378,10 +4390,11 @@ static void *__cgroup_procs_start(struct seq_file *s, loff_t *pos, + return ERR_PTR(-ENOMEM); + of->priv = it; + css_task_iter_start(&cgrp->self, iter_flags, it); +- } else if (!(*pos)++) { ++ } else if (!(*pos)) { + css_task_iter_end(it); + css_task_iter_start(&cgrp->self, iter_flags, it); +- } ++ } else ++ return it->cur_task; + + return cgroup_procs_next(s, NULL, NULL); + } +@@ -5929,6 +5942,10 @@ void cgroup_sk_alloc(struct sock_cgroup_data *skcd) + return; + } + ++ /* Don't associate the sock with unrelated interrupted task's cgroup. */ ++ if (in_interrupt()) ++ return; ++ + rcu_read_lock(); + + while (true) { +diff --git a/kernel/workqueue.c b/kernel/workqueue.c +index 493908464b9e..eef77c82d2e1 100644 +--- a/kernel/workqueue.c ++++ b/kernel/workqueue.c +@@ -1384,14 +1384,16 @@ static void __queue_work(int cpu, struct workqueue_struct *wq, + WARN_ON_ONCE(!is_chained_work(wq))) + return; + retry: +- if (req_cpu == WORK_CPU_UNBOUND) +- cpu = wq_select_unbound_cpu(raw_smp_processor_id()); +- + /* pwq which will be used unless @work is executing elsewhere */ +- if (!(wq->flags & WQ_UNBOUND)) +- pwq = per_cpu_ptr(wq->cpu_pwqs, cpu); +- else ++ if (wq->flags & WQ_UNBOUND) { ++ if (req_cpu == WORK_CPU_UNBOUND) ++ cpu = wq_select_unbound_cpu(raw_smp_processor_id()); + pwq = unbound_pwq_by_node(wq, cpu_to_node(cpu)); ++ } else { ++ if (req_cpu == WORK_CPU_UNBOUND) ++ cpu = raw_smp_processor_id(); ++ pwq = per_cpu_ptr(wq->cpu_pwqs, cpu); ++ } + + /* + * If @work was previously on a different pool, it might still be +diff --git a/mm/memcontrol.c b/mm/memcontrol.c +index 0f7ff204083e..6ecb47c08665 100644 +--- a/mm/memcontrol.c ++++ b/mm/memcontrol.c +@@ -6307,19 +6307,9 @@ void mem_cgroup_sk_alloc(struct sock *sk) + if (!mem_cgroup_sockets_enabled) + return; + +- /* +- * Socket cloning can throw us here with sk_memcg already +- * filled. It won't however, necessarily happen from +- * process context. So the test for root memcg given +- * the current task's memcg won't help us in this case. +- * +- * Respecting the original socket's memcg is a better +- * decision in this case. +- */ +- if (sk->sk_memcg) { +- css_get(&sk->sk_memcg->css); ++ /* Do not associate the sock with unrelated interrupted task's memcg. */ ++ if (in_interrupt()) + return; +- } + + rcu_read_lock(); + memcg = mem_cgroup_from_task(current); +diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c +index f5941837c3ad..0b052ff51bde 100644 +--- a/net/batman-adv/bat_iv_ogm.c ++++ b/net/batman-adv/bat_iv_ogm.c +@@ -970,6 +970,10 @@ static void batadv_iv_ogm_schedule_buff(struct batadv_hard_iface *hard_iface) + + lockdep_assert_held(&hard_iface->bat_iv.ogm_buff_mutex); + ++ /* interface already disabled by batadv_iv_ogm_iface_disable */ ++ if (!*ogm_buff) ++ return; ++ + /* the interface gets activated here to avoid race conditions between + * the moment of activating the interface in + * hardif_activate_interface() where the originator mac is set and +diff --git a/net/batman-adv/bat_v_ogm.c b/net/batman-adv/bat_v_ogm.c +index d241ccc0ca02..bf9ea404abe7 100644 +--- a/net/batman-adv/bat_v_ogm.c ++++ b/net/batman-adv/bat_v_ogm.c +@@ -29,6 +29,8 @@ + #include <linux/kernel.h> + #include <linux/kref.h> + #include <linux/list.h> ++#include <linux/lockdep.h> ++#include <linux/mutex.h> + #include <linux/netdevice.h> + #include <linux/random.h> + #include <linux/rculist.h> +@@ -128,14 +130,12 @@ static void batadv_v_ogm_send_to_if(struct sk_buff *skb, + } + + /** +- * batadv_v_ogm_send() - periodic worker broadcasting the own OGM +- * @work: work queue item ++ * batadv_v_ogm_send_softif() - periodic worker broadcasting the own OGM ++ * @bat_priv: the bat priv with all the soft interface information + */ +-static void batadv_v_ogm_send(struct work_struct *work) ++static void batadv_v_ogm_send_softif(struct batadv_priv *bat_priv) + { + struct batadv_hard_iface *hard_iface; +- struct batadv_priv_bat_v *bat_v; +- struct batadv_priv *bat_priv; + struct batadv_ogm2_packet *ogm_packet; + struct sk_buff *skb, *skb_tmp; + unsigned char *ogm_buff; +@@ -143,8 +143,7 @@ static void batadv_v_ogm_send(struct work_struct *work) + u16 tvlv_len = 0; + int ret; + +- bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); +- bat_priv = container_of(bat_v, struct batadv_priv, bat_v); ++ lockdep_assert_held(&bat_priv->bat_v.ogm_buff_mutex); + + if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_DEACTIVATING) + goto out; +@@ -235,6 +234,23 @@ out: + return; + } + ++/** ++ * batadv_v_ogm_send() - periodic worker broadcasting the own OGM ++ * @work: work queue item ++ */ ++static void batadv_v_ogm_send(struct work_struct *work) ++{ ++ struct batadv_priv_bat_v *bat_v; ++ struct batadv_priv *bat_priv; ++ ++ bat_v = container_of(work, struct batadv_priv_bat_v, ogm_wq.work); ++ bat_priv = container_of(bat_v, struct batadv_priv, bat_v); ++ ++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); ++ batadv_v_ogm_send_softif(bat_priv); ++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); ++} ++ + /** + * batadv_v_ogm_iface_enable() - prepare an interface for B.A.T.M.A.N. V + * @hard_iface: the interface to prepare +@@ -261,11 +277,15 @@ void batadv_v_ogm_primary_iface_set(struct batadv_hard_iface *primary_iface) + struct batadv_priv *bat_priv = netdev_priv(primary_iface->soft_iface); + struct batadv_ogm2_packet *ogm_packet; + ++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); + if (!bat_priv->bat_v.ogm_buff) +- return; ++ goto unlock; + + ogm_packet = (struct batadv_ogm2_packet *)bat_priv->bat_v.ogm_buff; + ether_addr_copy(ogm_packet->orig, primary_iface->net_dev->dev_addr); ++ ++unlock: ++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); + } + + /** +@@ -887,6 +907,8 @@ int batadv_v_ogm_init(struct batadv_priv *bat_priv) + atomic_set(&bat_priv->bat_v.ogm_seqno, random_seqno); + INIT_DELAYED_WORK(&bat_priv->bat_v.ogm_wq, batadv_v_ogm_send); + ++ mutex_init(&bat_priv->bat_v.ogm_buff_mutex); ++ + return 0; + } + +@@ -898,7 +920,11 @@ void batadv_v_ogm_free(struct batadv_priv *bat_priv) + { + cancel_delayed_work_sync(&bat_priv->bat_v.ogm_wq); + ++ mutex_lock(&bat_priv->bat_v.ogm_buff_mutex); ++ + kfree(bat_priv->bat_v.ogm_buff); + bat_priv->bat_v.ogm_buff = NULL; + bat_priv->bat_v.ogm_buff_len = 0; ++ ++ mutex_unlock(&bat_priv->bat_v.ogm_buff_mutex); + } +diff --git a/net/batman-adv/types.h b/net/batman-adv/types.h +index 87e54f8a3f83..37598ae1d3f7 100644 +--- a/net/batman-adv/types.h ++++ b/net/batman-adv/types.h +@@ -28,6 +28,7 @@ + #include <linux/compiler.h> + #include <linux/if_ether.h> + #include <linux/kref.h> ++#include <linux/mutex.h> + #include <linux/netdevice.h> + #include <linux/netlink.h> + #include <linux/sched.h> /* for linux/wait.h */ +@@ -1493,6 +1494,9 @@ struct batadv_priv_bat_v { + /** @ogm_seqno: OGM sequence number - used to identify each OGM */ + atomic_t ogm_seqno; + ++ /** @ogm_buff_mutex: lock protecting ogm_buff and ogm_buff_len */ ++ struct mutex ogm_buff_mutex; ++ + /** @ogm_wq: workqueue used to schedule OGM transmissions */ + struct delayed_work ogm_wq; + }; +diff --git a/net/core/devlink.c b/net/core/devlink.c +index 6bc42933be4a..a77e3777c8dd 100644 +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -2995,34 +2995,41 @@ devlink_param_value_get_from_info(const struct devlink_param *param, + struct genl_info *info, + union devlink_param_value *value) + { ++ struct nlattr *param_data; + int len; + +- if (param->type != DEVLINK_PARAM_TYPE_BOOL && +- !info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]) ++ param_data = info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]; ++ ++ if (param->type != DEVLINK_PARAM_TYPE_BOOL && !param_data) + return -EINVAL; + + switch (param->type) { + case DEVLINK_PARAM_TYPE_U8: +- value->vu8 = nla_get_u8(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]); ++ if (nla_len(param_data) != sizeof(u8)) ++ return -EINVAL; ++ value->vu8 = nla_get_u8(param_data); + break; + case DEVLINK_PARAM_TYPE_U16: +- value->vu16 = nla_get_u16(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]); ++ if (nla_len(param_data) != sizeof(u16)) ++ return -EINVAL; ++ value->vu16 = nla_get_u16(param_data); + break; + case DEVLINK_PARAM_TYPE_U32: +- value->vu32 = nla_get_u32(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]); ++ if (nla_len(param_data) != sizeof(u32)) ++ return -EINVAL; ++ value->vu32 = nla_get_u32(param_data); + break; + case DEVLINK_PARAM_TYPE_STRING: +- len = strnlen(nla_data(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]), +- nla_len(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA])); +- if (len == nla_len(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA]) || ++ len = strnlen(nla_data(param_data), nla_len(param_data)); ++ if (len == nla_len(param_data) || + len >= __DEVLINK_PARAM_MAX_STRING_VALUE) + return -EINVAL; +- strcpy(value->vstr, +- nla_data(info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA])); ++ strcpy(value->vstr, nla_data(param_data)); + break; + case DEVLINK_PARAM_TYPE_BOOL: +- value->vbool = info->attrs[DEVLINK_ATTR_PARAM_VALUE_DATA] ? +- true : false; ++ if (param_data && nla_len(param_data)) ++ return -EINVAL; ++ value->vbool = nla_get_flag(param_data); + break; + } + return 0; +@@ -3600,6 +3607,8 @@ static const struct nla_policy devlink_nl_policy[DEVLINK_ATTR_MAX + 1] = { + [DEVLINK_ATTR_PARAM_VALUE_CMODE] = { .type = NLA_U8 }, + [DEVLINK_ATTR_REGION_NAME] = { .type = NLA_NUL_STRING }, + [DEVLINK_ATTR_REGION_SNAPSHOT_ID] = { .type = NLA_U32 }, ++ [DEVLINK_ATTR_REGION_CHUNK_ADDR] = { .type = NLA_U64 }, ++ [DEVLINK_ATTR_REGION_CHUNK_LEN] = { .type = NLA_U64 }, + }; + + static const struct genl_ops devlink_nl_ops[] = { +diff --git a/net/core/netclassid_cgroup.c b/net/core/netclassid_cgroup.c +index 7bf833598615..67feeb207dad 100644 +--- a/net/core/netclassid_cgroup.c ++++ b/net/core/netclassid_cgroup.c +@@ -57,30 +57,60 @@ static void cgrp_css_free(struct cgroup_subsys_state *css) + kfree(css_cls_state(css)); + } + ++/* ++ * To avoid freezing of sockets creation for tasks with big number of threads ++ * and opened sockets lets release file_lock every 1000 iterated descriptors. ++ * New sockets will already have been created with new classid. ++ */ ++ ++struct update_classid_context { ++ u32 classid; ++ unsigned int batch; ++}; ++ ++#define UPDATE_CLASSID_BATCH 1000 ++ + static int update_classid_sock(const void *v, struct file *file, unsigned n) + { + int err; ++ struct update_classid_context *ctx = (void *)v; + struct socket *sock = sock_from_file(file, &err); + + if (sock) { + spin_lock(&cgroup_sk_update_lock); +- sock_cgroup_set_classid(&sock->sk->sk_cgrp_data, +- (unsigned long)v); ++ sock_cgroup_set_classid(&sock->sk->sk_cgrp_data, ctx->classid); + spin_unlock(&cgroup_sk_update_lock); + } ++ if (--ctx->batch == 0) { ++ ctx->batch = UPDATE_CLASSID_BATCH; ++ return n + 1; ++ } + return 0; + } + ++static void update_classid_task(struct task_struct *p, u32 classid) ++{ ++ struct update_classid_context ctx = { ++ .classid = classid, ++ .batch = UPDATE_CLASSID_BATCH ++ }; ++ unsigned int fd = 0; ++ ++ do { ++ task_lock(p); ++ fd = iterate_fd(p->files, fd, update_classid_sock, &ctx); ++ task_unlock(p); ++ cond_resched(); ++ } while (fd); ++} ++ + static void cgrp_attach(struct cgroup_taskset *tset) + { + struct cgroup_subsys_state *css; + struct task_struct *p; + + cgroup_taskset_for_each(p, css, tset) { +- task_lock(p); +- iterate_fd(p->files, 0, update_classid_sock, +- (void *)(unsigned long)css_cls_state(css)->classid); +- task_unlock(p); ++ update_classid_task(p, css_cls_state(css)->classid); + } + } + +@@ -102,10 +132,7 @@ static int write_classid(struct cgroup_subsys_state *css, struct cftype *cft, + + css_task_iter_start(css, 0, &it); + while ((p = css_task_iter_next(&it))) { +- task_lock(p); +- iterate_fd(p->files, 0, update_classid_sock, +- (void *)(unsigned long)cs->classid); +- task_unlock(p); ++ update_classid_task(p, cs->classid); + cond_resched(); + } + css_task_iter_end(&it); +diff --git a/net/core/sock.c b/net/core/sock.c +index b9ec14f2c729..8abfde0d28ee 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1689,7 +1689,10 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) + atomic_set(&newsk->sk_zckey, 0); + + sock_reset_flag(newsk, SOCK_DONE); +- mem_cgroup_sk_alloc(newsk); ++ ++ /* sk->sk_memcg will be populated at accept() time */ ++ newsk->sk_memcg = NULL; ++ + cgroup_sk_alloc(&newsk->sk_cgrp_data); + + rcu_read_lock(); +diff --git a/net/ieee802154/nl_policy.c b/net/ieee802154/nl_policy.c +index 78f6f1233194..0f8597ec07fc 100644 +--- a/net/ieee802154/nl_policy.c ++++ b/net/ieee802154/nl_policy.c +@@ -30,7 +30,13 @@ const struct nla_policy ieee802154_policy[IEEE802154_ATTR_MAX + 1] = { + [IEEE802154_ATTR_HW_ADDR] = { .type = NLA_HW_ADDR, }, + [IEEE802154_ATTR_PAN_ID] = { .type = NLA_U16, }, + [IEEE802154_ATTR_CHANNEL] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_BCN_ORD] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_SF_ORD] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_PAN_COORD] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_BAT_EXT] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_COORD_REALIGN] = { .type = NLA_U8, }, + [IEEE802154_ATTR_PAGE] = { .type = NLA_U8, }, ++ [IEEE802154_ATTR_DEV_TYPE] = { .type = NLA_U8, }, + [IEEE802154_ATTR_COORD_SHORT_ADDR] = { .type = NLA_U16, }, + [IEEE802154_ATTR_COORD_HW_ADDR] = { .type = NLA_HW_ADDR, }, + [IEEE802154_ATTR_COORD_PAN_ID] = { .type = NLA_U16, }, +diff --git a/net/ipv4/gre_demux.c b/net/ipv4/gre_demux.c +index 0eb4bfa2332c..ad9ea82daeb3 100644 +--- a/net/ipv4/gre_demux.c ++++ b/net/ipv4/gre_demux.c +@@ -61,7 +61,9 @@ int gre_del_protocol(const struct gre_protocol *proto, u8 version) + } + EXPORT_SYMBOL_GPL(gre_del_protocol); + +-/* Fills in tpi and returns header length to be pulled. */ ++/* Fills in tpi and returns header length to be pulled. ++ * Note that caller must use pskb_may_pull() before pulling GRE header. ++ */ + int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, + bool *csum_err, __be16 proto, int nhs) + { +@@ -115,8 +117,14 @@ int gre_parse_header(struct sk_buff *skb, struct tnl_ptk_info *tpi, + * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header + */ + if (greh->flags == 0 && tpi->proto == htons(ETH_P_WCCP)) { ++ u8 _val, *val; ++ ++ val = skb_header_pointer(skb, nhs + hdr_len, ++ sizeof(_val), &_val); ++ if (!val) ++ return -EINVAL; + tpi->proto = proto; +- if ((*(u8 *)options & 0xF0) != 0x40) ++ if ((*val & 0xF0) != 0x40) + hdr_len += 4; + } + tpi->hdr_len = hdr_len; +diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c +index 79320858e719..34bd6230e9f4 100644 +--- a/net/ipv4/inet_connection_sock.c ++++ b/net/ipv4/inet_connection_sock.c +@@ -479,8 +479,28 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern) + } + spin_unlock_bh(&queue->fastopenq.lock); + } ++ + out: + release_sock(sk); ++ if (newsk && mem_cgroup_sockets_enabled) { ++ int amt; ++ ++ /* atomically get the memory usage, set and charge the ++ * newsk->sk_memcg. ++ */ ++ lock_sock(newsk); ++ ++ /* The socket has not been accepted yet, no need to look at ++ * newsk->sk_wmem_queued. ++ */ ++ amt = sk_mem_pages(newsk->sk_forward_alloc + ++ atomic_read(&newsk->sk_rmem_alloc)); ++ mem_cgroup_sk_alloc(newsk); ++ if (newsk->sk_memcg && amt) ++ mem_cgroup_charge_skmem(newsk->sk_memcg, amt); ++ ++ release_sock(newsk); ++ } + if (req) + reqsk_put(req); + return newsk; +diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c +index 9742b37afe1d..f0957ebf82cf 100644 +--- a/net/ipv4/inet_diag.c ++++ b/net/ipv4/inet_diag.c +@@ -104,13 +104,9 @@ static size_t inet_sk_attr_size(struct sock *sk, + aux = handler->idiag_get_aux_size(sk, net_admin); + + return nla_total_size(sizeof(struct tcp_info)) +- + nla_total_size(1) /* INET_DIAG_SHUTDOWN */ +- + nla_total_size(1) /* INET_DIAG_TOS */ +- + nla_total_size(1) /* INET_DIAG_TCLASS */ +- + nla_total_size(4) /* INET_DIAG_MARK */ +- + nla_total_size(4) /* INET_DIAG_CLASS_ID */ +- + nla_total_size(sizeof(struct inet_diag_meminfo)) + + nla_total_size(sizeof(struct inet_diag_msg)) ++ + inet_diag_msg_attrs_size() ++ + nla_total_size(sizeof(struct inet_diag_meminfo)) + + nla_total_size(SK_MEMINFO_VARS * sizeof(u32)) + + nla_total_size(TCP_CA_NAME_MAX) + + nla_total_size(sizeof(struct tcpvegas_info)) +@@ -151,6 +147,24 @@ int inet_diag_msg_attrs_fill(struct sock *sk, struct sk_buff *skb, + if (net_admin && nla_put_u32(skb, INET_DIAG_MARK, sk->sk_mark)) + goto errout; + ++ if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) || ++ ext & (1 << (INET_DIAG_TCLASS - 1))) { ++ u32 classid = 0; ++ ++#ifdef CONFIG_SOCK_CGROUP_DATA ++ classid = sock_cgroup_classid(&sk->sk_cgrp_data); ++#endif ++ /* Fallback to socket priority if class id isn't set. ++ * Classful qdiscs use it as direct reference to class. ++ * For cgroup2 classid is always zero. ++ */ ++ if (!classid) ++ classid = sk->sk_priority; ++ ++ if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid)) ++ goto errout; ++ } ++ + r->idiag_uid = from_kuid_munged(user_ns, sock_i_uid(sk)); + r->idiag_inode = sock_i_ino(sk); + +@@ -288,24 +302,6 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk, + goto errout; + } + +- if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) || +- ext & (1 << (INET_DIAG_TCLASS - 1))) { +- u32 classid = 0; +- +-#ifdef CONFIG_SOCK_CGROUP_DATA +- classid = sock_cgroup_classid(&sk->sk_cgrp_data); +-#endif +- /* Fallback to socket priority if class id isn't set. +- * Classful qdiscs use it as direct reference to class. +- * For cgroup2 classid is always zero. +- */ +- if (!classid) +- classid = sk->sk_priority; +- +- if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid)) +- goto errout; +- } +- + out: + nlmsg_end(skb, nlh); + return 0; +diff --git a/net/ipv4/raw_diag.c b/net/ipv4/raw_diag.c +index 6367ecdf76c4..1d84b02ec765 100644 +--- a/net/ipv4/raw_diag.c ++++ b/net/ipv4/raw_diag.c +@@ -99,8 +99,9 @@ static int raw_diag_dump_one(struct sk_buff *in_skb, + if (IS_ERR(sk)) + return PTR_ERR(sk); + +- rep = nlmsg_new(sizeof(struct inet_diag_msg) + +- sizeof(struct inet_diag_meminfo) + 64, ++ rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) + ++ inet_diag_msg_attrs_size() + ++ nla_total_size(sizeof(struct inet_diag_meminfo)) + 64, + GFP_KERNEL); + if (!rep) { + sock_put(sk); +diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c +index d9ad986c7b2c..cc3f6da306c6 100644 +--- a/net/ipv4/udp_diag.c ++++ b/net/ipv4/udp_diag.c +@@ -67,8 +67,9 @@ static int udp_dump_one(struct udp_table *tbl, struct sk_buff *in_skb, + goto out; + + err = -ENOMEM; +- rep = nlmsg_new(sizeof(struct inet_diag_msg) + +- sizeof(struct inet_diag_meminfo) + 64, ++ rep = nlmsg_new(nla_total_size(sizeof(struct inet_diag_msg)) + ++ inet_diag_msg_attrs_size() + ++ nla_total_size(sizeof(struct inet_diag_meminfo)) + 64, + GFP_KERNEL); + if (!rep) + goto out; +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index ef309a26aba0..0c804716a2aa 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -1175,11 +1175,12 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires) + } + + static void +-cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, bool del_rt) ++cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long expires, ++ bool del_rt, bool del_peer) + { + struct fib6_info *f6i; + +- f6i = addrconf_get_prefix_route(&ifp->addr, ++ f6i = addrconf_get_prefix_route(del_peer ? &ifp->peer_addr : &ifp->addr, + ifp->prefix_len, + ifp->idev->dev, + 0, RTF_GATEWAY | RTF_DEFAULT); +@@ -1244,7 +1245,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp) + + if (action != CLEANUP_PREFIX_RT_NOP) { + cleanup_prefix_route(ifp, expires, +- action == CLEANUP_PREFIX_RT_DEL); ++ action == CLEANUP_PREFIX_RT_DEL, false); + } + + /* clean up prefsrc entries */ +@@ -3291,6 +3292,10 @@ static void addrconf_dev_config(struct net_device *dev) + (dev->type != ARPHRD_NONE) && + (dev->type != ARPHRD_RAWIP)) { + /* Alas, we support only Ethernet autoconfiguration. */ ++ idev = __in6_dev_get(dev); ++ if (!IS_ERR_OR_NULL(idev) && dev->flags & IFF_UP && ++ dev->flags & IFF_MULTICAST) ++ ipv6_mc_up(idev); + return; + } + +@@ -4531,12 +4536,13 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh, + } + + static int modify_prefix_route(struct inet6_ifaddr *ifp, +- unsigned long expires, u32 flags) ++ unsigned long expires, u32 flags, ++ bool modify_peer) + { + struct fib6_info *f6i; + u32 prio; + +- f6i = addrconf_get_prefix_route(&ifp->addr, ++ f6i = addrconf_get_prefix_route(modify_peer ? &ifp->peer_addr : &ifp->addr, + ifp->prefix_len, + ifp->idev->dev, + 0, RTF_GATEWAY | RTF_DEFAULT); +@@ -4549,7 +4555,8 @@ static int modify_prefix_route(struct inet6_ifaddr *ifp, + ip6_del_rt(dev_net(ifp->idev->dev), f6i); + + /* add new one */ +- addrconf_prefix_route(&ifp->addr, ifp->prefix_len, ++ addrconf_prefix_route(modify_peer ? &ifp->peer_addr : &ifp->addr, ++ ifp->prefix_len, + ifp->rt_priority, ifp->idev->dev, + expires, flags, GFP_KERNEL); + } else { +@@ -4571,6 +4578,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg) + unsigned long timeout; + bool was_managetempaddr; + bool had_prefixroute; ++ bool new_peer = false; + + ASSERT_RTNL(); + +@@ -4602,6 +4610,13 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg) + cfg->preferred_lft = timeout; + } + ++ if (cfg->peer_pfx && ++ memcmp(&ifp->peer_addr, cfg->peer_pfx, sizeof(struct in6_addr))) { ++ if (!ipv6_addr_any(&ifp->peer_addr)) ++ cleanup_prefix_route(ifp, expires, true, true); ++ new_peer = true; ++ } ++ + spin_lock_bh(&ifp->lock); + was_managetempaddr = ifp->flags & IFA_F_MANAGETEMPADDR; + had_prefixroute = ifp->flags & IFA_F_PERMANENT && +@@ -4617,6 +4632,9 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg) + if (cfg->rt_priority && cfg->rt_priority != ifp->rt_priority) + ifp->rt_priority = cfg->rt_priority; + ++ if (new_peer) ++ ifp->peer_addr = *cfg->peer_pfx; ++ + spin_unlock_bh(&ifp->lock); + if (!(ifp->flags&IFA_F_TENTATIVE)) + ipv6_ifa_notify(0, ifp); +@@ -4625,7 +4643,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg) + int rc = -ENOENT; + + if (had_prefixroute) +- rc = modify_prefix_route(ifp, expires, flags); ++ rc = modify_prefix_route(ifp, expires, flags, false); + + /* prefix route could have been deleted; if so restore it */ + if (rc == -ENOENT) { +@@ -4633,6 +4651,15 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg) + ifp->rt_priority, ifp->idev->dev, + expires, flags, GFP_KERNEL); + } ++ ++ if (had_prefixroute && !ipv6_addr_any(&ifp->peer_addr)) ++ rc = modify_prefix_route(ifp, expires, flags, true); ++ ++ if (rc == -ENOENT && !ipv6_addr_any(&ifp->peer_addr)) { ++ addrconf_prefix_route(&ifp->peer_addr, ifp->prefix_len, ++ ifp->rt_priority, ifp->idev->dev, ++ expires, flags, GFP_KERNEL); ++ } + } else if (had_prefixroute) { + enum cleanup_prefix_rt_t action; + unsigned long rt_expires; +@@ -4643,7 +4670,7 @@ static int inet6_addr_modify(struct inet6_ifaddr *ifp, struct ifa6_config *cfg) + + if (action != CLEANUP_PREFIX_RT_NOP) { + cleanup_prefix_route(ifp, rt_expires, +- action == CLEANUP_PREFIX_RT_DEL); ++ action == CLEANUP_PREFIX_RT_DEL, false); + } + } + +@@ -5702,9 +5729,9 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) + if (ifp->idev->cnf.forwarding) + addrconf_join_anycast(ifp); + if (!ipv6_addr_any(&ifp->peer_addr)) +- addrconf_prefix_route(&ifp->peer_addr, 128, 0, +- ifp->idev->dev, 0, 0, +- GFP_ATOMIC); ++ addrconf_prefix_route(&ifp->peer_addr, 128, ++ ifp->rt_priority, ifp->idev->dev, ++ 0, 0, GFP_ATOMIC); + break; + case RTM_DELADDR: + if (ifp->idev->cnf.forwarding) +diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c +index c0cac9cc3a28..a20be08f0e0b 100644 +--- a/net/ipv6/ipv6_sockglue.c ++++ b/net/ipv6/ipv6_sockglue.c +@@ -185,9 +185,15 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, + retv = -EBUSY; + break; + } +- } else if (sk->sk_protocol != IPPROTO_TCP) ++ } else if (sk->sk_protocol == IPPROTO_TCP) { ++ if (sk->sk_prot != &tcpv6_prot) { ++ retv = -EBUSY; ++ break; ++ } + break; +- ++ } else { ++ break; ++ } + if (sk->sk_state != TCP_ESTABLISHED) { + retv = -ENOTCONN; + break; +diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c +index 13279f683da9..4c94f3ba2ae4 100644 +--- a/net/netfilter/nf_conntrack_standalone.c ++++ b/net/netfilter/nf_conntrack_standalone.c +@@ -390,7 +390,7 @@ static void *ct_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos) + *pos = cpu + 1; + return per_cpu_ptr(net->ct.stat, cpu); + } +- ++ (*pos)++; + return NULL; + } + +diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c +index 8ff4d22f10b2..353a2aa80c3c 100644 +--- a/net/netfilter/nf_synproxy_core.c ++++ b/net/netfilter/nf_synproxy_core.c +@@ -273,7 +273,7 @@ static void *synproxy_cpu_seq_next(struct seq_file *seq, void *v, loff_t *pos) + *pos = cpu + 1; + return per_cpu_ptr(snet->stats, cpu); + } +- ++ (*pos)++; + return NULL; + } + +diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c +index e5d27b2e4eba..66154dafa305 100644 +--- a/net/netfilter/nfnetlink_cthelper.c ++++ b/net/netfilter/nfnetlink_cthelper.c +@@ -744,6 +744,8 @@ static const struct nla_policy nfnl_cthelper_policy[NFCTH_MAX+1] = { + [NFCTH_NAME] = { .type = NLA_NUL_STRING, + .len = NF_CT_HELPER_NAME_LEN-1 }, + [NFCTH_QUEUE_NUM] = { .type = NLA_U32, }, ++ [NFCTH_PRIV_DATA_LEN] = { .type = NLA_U32, }, ++ [NFCTH_STATUS] = { .type = NLA_U32, }, + }; + + static const struct nfnl_callback nfnl_cthelper_cb[NFNL_MSG_CTHELPER_MAX] = { +diff --git a/net/netfilter/nft_payload.c b/net/netfilter/nft_payload.c +index e110b0ebbf58..19446a89a2a8 100644 +--- a/net/netfilter/nft_payload.c ++++ b/net/netfilter/nft_payload.c +@@ -121,6 +121,7 @@ static const struct nla_policy nft_payload_policy[NFTA_PAYLOAD_MAX + 1] = { + [NFTA_PAYLOAD_LEN] = { .type = NLA_U32 }, + [NFTA_PAYLOAD_CSUM_TYPE] = { .type = NLA_U32 }, + [NFTA_PAYLOAD_CSUM_OFFSET] = { .type = NLA_U32 }, ++ [NFTA_PAYLOAD_CSUM_FLAGS] = { .type = NLA_U32 }, + }; + + static int nft_payload_init(const struct nft_ctx *ctx, +diff --git a/net/netfilter/nft_tunnel.c b/net/netfilter/nft_tunnel.c +index 1c6d15ea76d4..8ae948fd9dcf 100644 +--- a/net/netfilter/nft_tunnel.c ++++ b/net/netfilter/nft_tunnel.c +@@ -308,6 +308,8 @@ static const struct nla_policy nft_tunnel_key_policy[NFTA_TUNNEL_KEY_MAX + 1] = + [NFTA_TUNNEL_KEY_FLAGS] = { .type = NLA_U32, }, + [NFTA_TUNNEL_KEY_TOS] = { .type = NLA_U8, }, + [NFTA_TUNNEL_KEY_TTL] = { .type = NLA_U8, }, ++ [NFTA_TUNNEL_KEY_SPORT] = { .type = NLA_U16, }, ++ [NFTA_TUNNEL_KEY_DPORT] = { .type = NLA_U16, }, + [NFTA_TUNNEL_KEY_OPTS] = { .type = NLA_NESTED, }, + }; + +diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c +index 13e1ac333fa4..3bab89dbc371 100644 +--- a/net/netfilter/x_tables.c ++++ b/net/netfilter/x_tables.c +@@ -1556,6 +1556,9 @@ static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos, + uint8_t nfproto = (unsigned long)PDE_DATA(file_inode(seq->file)); + struct nf_mttg_trav *trav = seq->private; + ++ if (ppos != NULL) ++ ++(*ppos); ++ + switch (trav->class) { + case MTTG_TRAV_INIT: + trav->class = MTTG_TRAV_NFP_UNSPEC; +@@ -1581,9 +1584,6 @@ static void *xt_mttg_seq_next(struct seq_file *seq, void *v, loff_t *ppos, + default: + return NULL; + } +- +- if (ppos != NULL) +- ++*ppos; + return trav; + } + +diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c +index f44de4bc2100..570144507df1 100644 +--- a/net/netfilter/xt_recent.c ++++ b/net/netfilter/xt_recent.c +@@ -497,12 +497,12 @@ static void *recent_seq_next(struct seq_file *seq, void *v, loff_t *pos) + const struct recent_entry *e = v; + const struct list_head *head = e->list.next; + ++ (*pos)++; + while (head == &t->iphash[st->bucket]) { + if (++st->bucket >= ip_list_hash_size) + return NULL; + head = t->iphash[st->bucket].next; + } +- (*pos)++; + return list_entry(head, struct recent_entry, list); + } + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 4a1b1bb39b4b..1bb9f219f07d 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -2411,7 +2411,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err, + in_skb->len)) + WARN_ON(nla_put_u32(skb, NLMSGERR_ATTR_OFFS, + (u8 *)extack->bad_attr - +- in_skb->data)); ++ (u8 *)nlh)); + } else { + if (extack->cookie_len) + WARN_ON(nla_put(skb, NLMSGERR_ATTR_COOKIE, +diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c +index 19cb2e473ea6..4f5a09e3fd70 100644 +--- a/net/nfc/hci/core.c ++++ b/net/nfc/hci/core.c +@@ -193,13 +193,20 @@ exit: + void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, + struct sk_buff *skb) + { +- u8 gate = hdev->pipes[pipe].gate; + u8 status = NFC_HCI_ANY_OK; + struct hci_create_pipe_resp *create_info; + struct hci_delete_pipe_noti *delete_info; + struct hci_all_pipe_cleared_noti *cleared_info; ++ u8 gate; + +- pr_debug("from gate %x pipe %x cmd %x\n", gate, pipe, cmd); ++ pr_debug("from pipe %x cmd %x\n", pipe, cmd); ++ ++ if (pipe >= NFC_HCI_MAX_PIPES) { ++ status = NFC_HCI_ANY_E_NOK; ++ goto exit; ++ } ++ ++ gate = hdev->pipes[pipe].gate; + + switch (cmd) { + case NFC_HCI_ADM_NOTIFY_PIPE_CREATED: +@@ -387,8 +394,14 @@ void nfc_hci_event_received(struct nfc_hci_dev *hdev, u8 pipe, u8 event, + struct sk_buff *skb) + { + int r = 0; +- u8 gate = hdev->pipes[pipe].gate; ++ u8 gate; ++ ++ if (pipe >= NFC_HCI_MAX_PIPES) { ++ pr_err("Discarded event %x to invalid pipe %x\n", event, pipe); ++ goto exit; ++ } + ++ gate = hdev->pipes[pipe].gate; + if (gate == NFC_HCI_INVALID_GATE) { + pr_err("Discarded event %x to unopened pipe %x\n", event, pipe); + goto exit; +diff --git a/net/nfc/netlink.c b/net/nfc/netlink.c +index 30938854bb8d..a65a5a5f434b 100644 +--- a/net/nfc/netlink.c ++++ b/net/nfc/netlink.c +@@ -44,6 +44,7 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = { + [NFC_ATTR_DEVICE_NAME] = { .type = NLA_STRING, + .len = NFC_DEVICE_NAME_MAXSIZE }, + [NFC_ATTR_PROTOCOLS] = { .type = NLA_U32 }, ++ [NFC_ATTR_TARGET_INDEX] = { .type = NLA_U32 }, + [NFC_ATTR_COMM_MODE] = { .type = NLA_U8 }, + [NFC_ATTR_RF_MODE] = { .type = NLA_U8 }, + [NFC_ATTR_DEVICE_POWERED] = { .type = NLA_U8 }, +@@ -55,7 +56,10 @@ static const struct nla_policy nfc_genl_policy[NFC_ATTR_MAX + 1] = { + [NFC_ATTR_LLC_SDP] = { .type = NLA_NESTED }, + [NFC_ATTR_FIRMWARE_NAME] = { .type = NLA_STRING, + .len = NFC_FIRMWARE_NAME_MAXSIZE }, ++ [NFC_ATTR_SE_INDEX] = { .type = NLA_U32 }, + [NFC_ATTR_SE_APDU] = { .type = NLA_BINARY }, ++ [NFC_ATTR_VENDOR_ID] = { .type = NLA_U32 }, ++ [NFC_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 }, + [NFC_ATTR_VENDOR_DATA] = { .type = NLA_BINARY }, + + }; +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index ddf90e6fac51..ecea8edae61c 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -2260,6 +2260,13 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + TP_STATUS_KERNEL, (macoff+snaplen)); + if (!h.raw) + goto drop_n_account; ++ ++ if (do_vnet && ++ virtio_net_hdr_from_skb(skb, h.raw + macoff - ++ sizeof(struct virtio_net_hdr), ++ vio_le(), true, 0)) ++ goto drop_n_account; ++ + if (po->tp_version <= TPACKET_V2) { + packet_increment_rx_head(po, &po->rx_ring); + /* +@@ -2272,12 +2279,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + status |= TP_STATUS_LOSING; + } + +- if (do_vnet && +- virtio_net_hdr_from_skb(skb, h.raw + macoff - +- sizeof(struct virtio_net_hdr), +- vio_le(), true, 0)) +- goto drop_n_account; +- + po->stats.stats1.tp_packets++; + if (copy_skb) { + status |= TP_STATUS_COPY; +diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c +index 1ee2b77f607b..ba60a8dd5bb3 100644 +--- a/net/sched/sch_fq.c ++++ b/net/sched/sch_fq.c +@@ -695,6 +695,7 @@ static const struct nla_policy fq_policy[TCA_FQ_MAX + 1] = { + [TCA_FQ_FLOW_MAX_RATE] = { .type = NLA_U32 }, + [TCA_FQ_BUCKETS_LOG] = { .type = NLA_U32 }, + [TCA_FQ_FLOW_REFILL_DELAY] = { .type = NLA_U32 }, ++ [TCA_FQ_ORPHAN_MASK] = { .type = NLA_U32 }, + [TCA_FQ_LOW_RATE_THRESHOLD] = { .type = NLA_U32 }, + }; + +diff --git a/net/sctp/diag.c b/net/sctp/diag.c +index 435847d98b51..8767405de9fa 100644 +--- a/net/sctp/diag.c ++++ b/net/sctp/diag.c +@@ -252,15 +252,11 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc) + addrcnt++; + + return nla_total_size(sizeof(struct sctp_info)) +- + nla_total_size(1) /* INET_DIAG_SHUTDOWN */ +- + nla_total_size(1) /* INET_DIAG_TOS */ +- + nla_total_size(1) /* INET_DIAG_TCLASS */ +- + nla_total_size(4) /* INET_DIAG_MARK */ +- + nla_total_size(4) /* INET_DIAG_CLASS_ID */ + + nla_total_size(addrlen * asoc->peer.transport_count) + + nla_total_size(addrlen * addrcnt) +- + nla_total_size(sizeof(struct inet_diag_meminfo)) + + nla_total_size(sizeof(struct inet_diag_msg)) ++ + inet_diag_msg_attrs_size() ++ + nla_total_size(sizeof(struct inet_diag_meminfo)) + + 64; + } + +diff --git a/net/smc/smc_ib.c b/net/smc/smc_ib.c +index e519ef29c0ff..c974d7d9a2bb 100644 +--- a/net/smc/smc_ib.c ++++ b/net/smc/smc_ib.c +@@ -552,6 +552,8 @@ static void smc_ib_remove_dev(struct ib_device *ibdev, void *client_data) + struct smc_ib_device *smcibdev; + + smcibdev = ib_get_client_data(ibdev, &smc_ib_client); ++ if (!smcibdev || smcibdev->ibdev != ibdev) ++ return; + ib_set_client_data(ibdev, &smc_ib_client, NULL); + spin_lock(&smc_ib_devices.lock); + list_del_init(&smcibdev->list); /* remove from smc_ib_devices */ +@@ -559,6 +561,7 @@ static void smc_ib_remove_dev(struct ib_device *ibdev, void *client_data) + smc_pnet_remove_by_ibdev(smcibdev); + smc_ib_cleanup_per_ibdev(smcibdev); + ib_unregister_event_handler(&smcibdev->event_handler); ++ cancel_work_sync(&smcibdev->port_event_work); + kfree(smcibdev); + } + +diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c +index 99ee419210ba..9b36163d951e 100644 +--- a/net/tipc/netlink.c ++++ b/net/tipc/netlink.c +@@ -110,7 +110,8 @@ const struct nla_policy tipc_nl_prop_policy[TIPC_NLA_PROP_MAX + 1] = { + [TIPC_NLA_PROP_UNSPEC] = { .type = NLA_UNSPEC }, + [TIPC_NLA_PROP_PRIO] = { .type = NLA_U32 }, + [TIPC_NLA_PROP_TOL] = { .type = NLA_U32 }, +- [TIPC_NLA_PROP_WIN] = { .type = NLA_U32 } ++ [TIPC_NLA_PROP_WIN] = { .type = NLA_U32 }, ++ [TIPC_NLA_PROP_MTU] = { .type = NLA_U32 } + }; + + const struct nla_policy tipc_nl_bearer_policy[TIPC_NLA_BEARER_MAX + 1] = { +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index dfde06b8d25d..d502cc7a8ff7 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -349,6 +349,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { + [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED }, + [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED }, + [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 }, ++ [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 }, ++ [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG }, + [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 }, + [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED }, + [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED }, +@@ -397,6 +399,8 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { + [NL80211_ATTR_MDID] = { .type = NLA_U16 }, + [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY, + .len = IEEE80211_MAX_DATA_LEN }, ++ [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 }, ++ [NL80211_ATTR_MAX_CRIT_PROT_DURATION] = { .type = NLA_U16 }, + [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 }, + [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 }, + [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG }, +@@ -422,6 +426,7 @@ static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = { + [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 }, + [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 }, + [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 }, ++ [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 }, + [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN }, + [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG }, + [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 }, +diff --git a/tools/perf/bench/futex-wake.c b/tools/perf/bench/futex-wake.c +index e8181ad7d088..e62006342b18 100644 +--- a/tools/perf/bench/futex-wake.c ++++ b/tools/perf/bench/futex-wake.c +@@ -42,7 +42,7 @@ static bool done = false, silent = false, fshared = false; + static pthread_mutex_t thread_lock; + static pthread_cond_t thread_parent, thread_worker; + static struct stats waketime_stats, wakeup_stats; +-static unsigned int ncpus, threads_starting, nthreads = 0; ++static unsigned int threads_starting, nthreads = 0; + static int futex_flag = 0; + + static const struct option options[] = { +@@ -140,7 +140,7 @@ int bench_futex_wake(int argc, const char **argv) + sigaction(SIGINT, &act, NULL); + + if (!nthreads) +- nthreads = ncpus; ++ nthreads = cpu->nr; + + worker = calloc(nthreads, sizeof(*worker)); + if (!worker) +diff --git a/tools/testing/ktest/ktest.pl b/tools/testing/ktest/ktest.pl +index 87af8a68ab25..3118fc0d149b 100755 +--- a/tools/testing/ktest/ktest.pl ++++ b/tools/testing/ktest/ktest.pl +@@ -1372,7 +1372,7 @@ sub reboot { + + } else { + # Make sure everything has been written to disk +- run_ssh("sync"); ++ run_ssh("sync", 10); + + if (defined($time)) { + start_monitor; +diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh +index 7d1a7c0dc56a..67048f922ff2 100755 +--- a/tools/testing/selftests/net/fib_tests.sh ++++ b/tools/testing/selftests/net/fib_tests.sh +@@ -979,6 +979,27 @@ ipv6_addr_metric_test() + fi + log_test $rc 0 "Prefix route with metric on link up" + ++ # verify peer metric added correctly ++ set -e ++ run_cmd "$IP -6 addr flush dev dummy2" ++ run_cmd "$IP -6 addr add dev dummy2 2001:db8:104::1 peer 2001:db8:104::2 metric 260" ++ set +e ++ ++ check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 260" ++ log_test $? 0 "Set metric with peer route on local side" ++ log_test $? 0 "User specified metric on local address" ++ check_route6 "2001:db8:104::2 dev dummy2 proto kernel metric 260" ++ log_test $? 0 "Set metric with peer route on peer side" ++ ++ set -e ++ run_cmd "$IP -6 addr change dev dummy2 2001:db8:104::1 peer 2001:db8:104::3 metric 261" ++ set +e ++ ++ check_route6 "2001:db8:104::1 dev dummy2 proto kernel metric 261" ++ log_test $? 0 "Modify metric and peer address on local side" ++ check_route6 "2001:db8:104::3 dev dummy2 proto kernel metric 261" ++ log_test $? 0 "Modify metric and peer address on peer side" ++ + $IP li del dummy1 + $IP li del dummy2 + cleanup +@@ -1320,13 +1341,20 @@ ipv4_addr_metric_test() + + run_cmd "$IP addr flush dev dummy2" + run_cmd "$IP addr add dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 260" +- run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.2 metric 261" + rc=$? + if [ $rc -eq 0 ]; then +- check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261" ++ check_route "172.16.104.2 dev dummy2 proto kernel scope link src 172.16.104.1 metric 260" ++ rc=$? ++ fi ++ log_test $rc 0 "Set metric of address with peer route" ++ ++ run_cmd "$IP addr change dev dummy2 172.16.104.1/32 peer 172.16.104.3 metric 261" ++ rc=$? ++ if [ $rc -eq 0 ]; then ++ check_route "172.16.104.3 dev dummy2 proto kernel scope link src 172.16.104.1 metric 261" + rc=$? + fi +- log_test $rc 0 "Modify metric of address with peer route" ++ log_test $rc 0 "Modify metric and peer address for peer route" + + $IP li del dummy1 + $IP li del dummy2
