commit: de1ca00a7d2ca5589f537b73addb0c569d7821e5 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Sep 26 22:00:27 2020 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sat Sep 26 22:00:27 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=de1ca00a
Linux patch 4.19.148 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1147_linux-4.19.148.patch | 1529 +++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1533 insertions(+) diff --git a/0000_README b/0000_README index 4996714..9707ae7 100644 --- a/0000_README +++ b/0000_README @@ -627,6 +627,10 @@ Patch: 1146_linux-4.19.147.patch From: https://www.kernel.org Desc: Linux 4.19.147 +Patch: 1147_linux-4.19.148.patch +From: https://www.kernel.org +Desc: Linux 4.19.148 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1147_linux-4.19.148.patch b/1147_linux-4.19.148.patch new file mode 100644 index 0000000..30160d9 --- /dev/null +++ b/1147_linux-4.19.148.patch @@ -0,0 +1,1529 @@ +diff --git a/Documentation/kbuild/llvm.rst b/Documentation/kbuild/llvm.rst +new file mode 100644 +index 0000000000000..c776b6eee969f +--- /dev/null ++++ b/Documentation/kbuild/llvm.rst +@@ -0,0 +1,87 @@ ++============================== ++Building Linux with Clang/LLVM ++============================== ++ ++This document covers how to build the Linux kernel with Clang and LLVM ++utilities. ++ ++About ++----- ++ ++The Linux kernel has always traditionally been compiled with GNU toolchains ++such as GCC and binutils. Ongoing work has allowed for `Clang ++<https://clang.llvm.org/>`_ and `LLVM <https://llvm.org/>`_ utilities to be ++used as viable substitutes. Distributions such as `Android ++<https://www.android.com/>`_, `ChromeOS ++<https://www.chromium.org/chromium-os>`_, and `OpenMandriva ++<https://www.openmandriva.org/>`_ use Clang built kernels. `LLVM is a ++collection of toolchain components implemented in terms of C++ objects ++<https://www.aosabook.org/en/llvm.html>`_. Clang is a front-end to LLVM that ++supports C and the GNU C extensions required by the kernel, and is pronounced ++"klang," not "see-lang." ++ ++Clang ++----- ++ ++The compiler used can be swapped out via `CC=` command line argument to `make`. ++`CC=` should be set when selecting a config and during a build. ++ ++ make CC=clang defconfig ++ ++ make CC=clang ++ ++Cross Compiling ++--------------- ++ ++A single Clang compiler binary will typically contain all supported backends, ++which can help simplify cross compiling. ++ ++ ARCH=arm64 CROSS_COMPILE=aarch64-linux-gnu- make CC=clang ++ ++`CROSS_COMPILE` is not used to prefix the Clang compiler binary, instead ++`CROSS_COMPILE` is used to set a command line flag: `--target <triple>`. For ++example: ++ ++ clang --target aarch64-linux-gnu foo.c ++ ++LLVM Utilities ++-------------- ++ ++LLVM has substitutes for GNU binutils utilities. Kbuild supports `LLVM=1` ++to enable them. ++ ++ make LLVM=1 ++ ++They can be enabled individually. The full list of the parameters: ++ ++ make CC=clang LD=ld.lld AR=llvm-ar NM=llvm-nm STRIP=llvm-strip \\ ++ OBJCOPY=llvm-objcopy OBJDUMP=llvm-objdump OBJSIZE=llvm-size \\ ++ READELF=llvm-readelf HOSTCC=clang HOSTCXX=clang++ HOSTAR=llvm-ar \\ ++ HOSTLD=ld.lld ++ ++Currently, the integrated assembler is disabled by default. You can pass ++`LLVM_IAS=1` to enable it. ++ ++Getting Help ++------------ ++ ++- `Website <https://clangbuiltlinux.github.io/>`_ ++- `Mailing List <https://groups.google.com/forum/#!forum/clang-built-linux>`_: <[email protected]> ++- `Issue Tracker <https://github.com/ClangBuiltLinux/linux/issues>`_ ++- IRC: #clangbuiltlinux on chat.freenode.net ++- `Telegram <https://t.me/ClangBuiltLinux>`_: @ClangBuiltLinux ++- `Wiki <https://github.com/ClangBuiltLinux/linux/wiki>`_ ++- `Beginner Bugs <https://github.com/ClangBuiltLinux/linux/issues?q=is%3Aopen+is%3Aissue+label%3A%22good+first+issue%22>`_ ++ ++Getting LLVM ++------------- ++ ++- http://releases.llvm.org/download.html ++- https://github.com/llvm/llvm-project ++- https://llvm.org/docs/GettingStarted.html ++- https://llvm.org/docs/CMake.html ++- https://apt.llvm.org/ ++- https://www.archlinux.org/packages/extra/x86_64/llvm/ ++- https://github.com/ClangBuiltLinux/tc-build ++- https://github.com/ClangBuiltLinux/linux/wiki/Building-Clang-from-source ++- https://android.googlesource.com/platform/prebuilts/clang/host/linux-x86/ +diff --git a/MAINTAINERS b/MAINTAINERS +index b9f9da0b886f5..1061db6fbc326 100644 +--- a/MAINTAINERS ++++ b/MAINTAINERS +@@ -3613,6 +3613,15 @@ M: Miguel Ojeda <[email protected]> + S: Maintained + F: .clang-format + ++CLANG/LLVM BUILD SUPPORT ++L: [email protected] ++W: https://clangbuiltlinux.github.io/ ++B: https://github.com/ClangBuiltLinux/linux/issues ++C: irc://chat.freenode.net/clangbuiltlinux ++S: Supported ++K: \b(?i:clang|llvm)\b ++F: Documentation/kbuild/llvm.rst ++ + CLEANCACHE API + M: Konrad Rzeszutek Wilk <[email protected]> + L: [email protected] +diff --git a/Makefile b/Makefile +index ee648a902ce31..3ffd5b03e6ddf 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 147 ++SUBLEVEL = 148 + EXTRAVERSION = + NAME = "People's Front" + +@@ -358,8 +358,13 @@ HOST_LFS_CFLAGS := $(shell getconf LFS_CFLAGS 2>/dev/null) + HOST_LFS_LDFLAGS := $(shell getconf LFS_LDFLAGS 2>/dev/null) + HOST_LFS_LIBS := $(shell getconf LFS_LIBS 2>/dev/null) + +-HOSTCC = gcc +-HOSTCXX = g++ ++ifneq ($(LLVM),) ++HOSTCC = clang ++HOSTCXX = clang++ ++else ++HOSTCC = gcc ++HOSTCXX = g++ ++endif + KBUILD_HOSTCFLAGS := -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 \ + -fomit-frame-pointer -std=gnu89 $(HOST_LFS_CFLAGS) \ + $(HOSTCFLAGS) +@@ -368,15 +373,28 @@ KBUILD_HOSTLDFLAGS := $(HOST_LFS_LDFLAGS) $(HOSTLDFLAGS) + KBUILD_HOSTLDLIBS := $(HOST_LFS_LIBS) $(HOSTLDLIBS) + + # Make variables (CC, etc...) +-AS = $(CROSS_COMPILE)as +-LD = $(CROSS_COMPILE)ld +-CC = $(CROSS_COMPILE)gcc + CPP = $(CC) -E ++ifneq ($(LLVM),) ++CC = clang ++LD = ld.lld ++AR = llvm-ar ++NM = llvm-nm ++OBJCOPY = llvm-objcopy ++OBJDUMP = llvm-objdump ++READELF = llvm-readelf ++OBJSIZE = llvm-size ++STRIP = llvm-strip ++else ++CC = $(CROSS_COMPILE)gcc ++LD = $(CROSS_COMPILE)ld + AR = $(CROSS_COMPILE)ar + NM = $(CROSS_COMPILE)nm +-STRIP = $(CROSS_COMPILE)strip + OBJCOPY = $(CROSS_COMPILE)objcopy + OBJDUMP = $(CROSS_COMPILE)objdump ++READELF = $(CROSS_COMPILE)readelf ++OBJSIZE = $(CROSS_COMPILE)size ++STRIP = $(CROSS_COMPILE)strip ++endif + LEX = flex + YACC = bison + AWK = awk +@@ -432,8 +450,8 @@ KBUILD_LDFLAGS := + GCC_PLUGINS_CFLAGS := + CLANG_FLAGS := + +-export ARCH SRCARCH CONFIG_SHELL HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE AS LD CC +-export CPP AR NM STRIP OBJCOPY OBJDUMP KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS ++export ARCH SRCARCH CONFIG_SHELL HOSTCC KBUILD_HOSTCFLAGS CROSS_COMPILE LD CC ++export CPP AR NM STRIP OBJCOPY OBJDUMP OBJSIZE READELF KBUILD_HOSTLDFLAGS KBUILD_HOSTLDLIBS + export MAKE LEX YACC AWK GENKSYMS INSTALLKERNEL PERL PYTHON PYTHON2 PYTHON3 UTS_MACHINE + export HOSTCXX KBUILD_HOSTCXXFLAGS LDFLAGS_MODULE CHECK CHECKFLAGS + +@@ -491,7 +509,9 @@ endif + ifneq ($(GCC_TOOLCHAIN),) + CLANG_FLAGS += --gcc-toolchain=$(GCC_TOOLCHAIN) + endif ++ifneq ($(LLVM_IAS),1) + CLANG_FLAGS += -no-integrated-as ++endif + CLANG_FLAGS += -Werror=unknown-warning-option + KBUILD_CFLAGS += $(CLANG_FLAGS) + KBUILD_AFLAGS += $(CLANG_FLAGS) +diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile +index b337a0cd58ba4..5642f025b397c 100644 +--- a/arch/x86/boot/compressed/Makefile ++++ b/arch/x86/boot/compressed/Makefile +@@ -102,7 +102,7 @@ vmlinux-objs-$(CONFIG_EFI_MIXED) += $(obj)/efi_thunk_$(BITS).o + quiet_cmd_check_data_rel = DATAREL $@ + define cmd_check_data_rel + for obj in $(filter %.o,$^); do \ +- ${CROSS_COMPILE}readelf -S $$obj | grep -qF .rel.local && { \ ++ $(READELF) -S $$obj | grep -qF .rel.local && { \ + echo "error: $$obj has data relocations!" >&2; \ + exit 1; \ + } || true; \ +diff --git a/drivers/net/dsa/rtl8366.c b/drivers/net/dsa/rtl8366.c +index 7e27c9aff9b72..430988f797225 100644 +--- a/drivers/net/dsa/rtl8366.c ++++ b/drivers/net/dsa/rtl8366.c +@@ -452,13 +452,19 @@ int rtl8366_vlan_del(struct dsa_switch *ds, int port, + return ret; + + if (vid == vlanmc.vid) { +- /* clear VLAN member configurations */ +- vlanmc.vid = 0; +- vlanmc.priority = 0; +- vlanmc.member = 0; +- vlanmc.untag = 0; +- vlanmc.fid = 0; +- ++ /* Remove this port from the VLAN */ ++ vlanmc.member &= ~BIT(port); ++ vlanmc.untag &= ~BIT(port); ++ /* ++ * If no ports are members of this VLAN ++ * anymore then clear the whole member ++ * config so it can be reused. ++ */ ++ if (!vlanmc.member && vlanmc.untag) { ++ vlanmc.vid = 0; ++ vlanmc.priority = 0; ++ vlanmc.fid = 0; ++ } + ret = smi->ops->set_vlan_mc(smi, i, &vlanmc); + if (ret) { + dev_err(smi->dev, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt.c b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +index a267380b267d7..c3f04fb319556 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c +@@ -6837,18 +6837,16 @@ static ssize_t bnxt_show_temp(struct device *dev, + struct hwrm_temp_monitor_query_output *resp; + struct bnxt *bp = dev_get_drvdata(dev); + u32 len = 0; ++ int rc; + + resp = bp->hwrm_cmd_resp_addr; + bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1); + mutex_lock(&bp->hwrm_cmd_lock); +- if (!_hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT)) ++ rc = _hwrm_send_message(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ if (!rc) + len = sprintf(buf, "%u\n", resp->temp * 1000); /* display millidegree */ + mutex_unlock(&bp->hwrm_cmd_lock); +- +- if (len) +- return len; +- +- return sprintf(buf, "unknown\n"); ++ return rc ?: len; + } + static SENSOR_DEVICE_ATTR(temp1_input, 0444, bnxt_show_temp, NULL, 0); + +@@ -6868,7 +6866,16 @@ static void bnxt_hwmon_close(struct bnxt *bp) + + static void bnxt_hwmon_open(struct bnxt *bp) + { ++ struct hwrm_temp_monitor_query_input req = {0}; + struct pci_dev *pdev = bp->pdev; ++ int rc; ++ ++ bnxt_hwrm_cmd_hdr_init(bp, &req, HWRM_TEMP_MONITOR_QUERY, -1, -1); ++ rc = hwrm_send_message_silent(bp, &req, sizeof(req), HWRM_CMD_TIMEOUT); ++ if (rc == -EACCES || rc == -EOPNOTSUPP) { ++ bnxt_hwmon_close(bp); ++ return; ++ } + + bp->hwmon_dev = hwmon_device_register_with_groups(&pdev->dev, + DRV_MODULE_NAME, bp, +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +index a1cb99110092d..1ea81c23039f5 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c +@@ -1369,9 +1369,12 @@ static int bnxt_set_pauseparam(struct net_device *dev, + if (!BNXT_SINGLE_PF(bp)) + return -EOPNOTSUPP; + ++ mutex_lock(&bp->link_lock); + if (epause->autoneg) { +- if (!(link_info->autoneg & BNXT_AUTONEG_SPEED)) +- return -EINVAL; ++ if (!(link_info->autoneg & BNXT_AUTONEG_SPEED)) { ++ rc = -EINVAL; ++ goto pause_exit; ++ } + + link_info->autoneg |= BNXT_AUTONEG_FLOW_CTRL; + if (bp->hwrm_spec_code >= 0x10201) +@@ -1392,11 +1395,11 @@ static int bnxt_set_pauseparam(struct net_device *dev, + if (epause->tx_pause) + link_info->req_flow_ctrl |= BNXT_LINK_PAUSE_TX; + +- if (netif_running(dev)) { +- mutex_lock(&bp->link_lock); ++ if (netif_running(dev)) + rc = bnxt_hwrm_set_pause(bp); +- mutex_unlock(&bp->link_lock); +- } ++ ++pause_exit: ++ mutex_unlock(&bp->link_lock); + return rc; + } + +@@ -2113,8 +2116,7 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata) + struct bnxt *bp = netdev_priv(dev); + struct ethtool_eee *eee = &bp->eee; + struct bnxt_link_info *link_info = &bp->link_info; +- u32 advertising = +- _bnxt_fw_to_ethtool_adv_spds(link_info->advertising, 0); ++ u32 advertising; + int rc = 0; + + if (!BNXT_SINGLE_PF(bp)) +@@ -2123,19 +2125,23 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata) + if (!(bp->flags & BNXT_FLAG_EEE_CAP)) + return -EOPNOTSUPP; + ++ mutex_lock(&bp->link_lock); ++ advertising = _bnxt_fw_to_ethtool_adv_spds(link_info->advertising, 0); + if (!edata->eee_enabled) + goto eee_ok; + + if (!(link_info->autoneg & BNXT_AUTONEG_SPEED)) { + netdev_warn(dev, "EEE requires autoneg\n"); +- return -EINVAL; ++ rc = -EINVAL; ++ goto eee_exit; + } + if (edata->tx_lpi_enabled) { + if (bp->lpi_tmr_hi && (edata->tx_lpi_timer > bp->lpi_tmr_hi || + edata->tx_lpi_timer < bp->lpi_tmr_lo)) { + netdev_warn(dev, "Valid LPI timer range is %d and %d microsecs\n", + bp->lpi_tmr_lo, bp->lpi_tmr_hi); +- return -EINVAL; ++ rc = -EINVAL; ++ goto eee_exit; + } else if (!bp->lpi_tmr_hi) { + edata->tx_lpi_timer = eee->tx_lpi_timer; + } +@@ -2145,7 +2151,8 @@ static int bnxt_set_eee(struct net_device *dev, struct ethtool_eee *edata) + } else if (edata->advertised & ~advertising) { + netdev_warn(dev, "EEE advertised %x must be a subset of autoneg advertised speeds %x\n", + edata->advertised, advertising); +- return -EINVAL; ++ rc = -EINVAL; ++ goto eee_exit; + } + + eee->advertised = edata->advertised; +@@ -2157,6 +2164,8 @@ eee_ok: + if (netif_running(dev)) + rc = bnxt_hwrm_set_link_setting(bp, false, true); + ++eee_exit: ++ mutex_unlock(&bp->link_lock); + return rc; + } + +diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +index 97d97de9accc5..bb3ee55cb72cb 100644 +--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c ++++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_filter.c +@@ -1591,13 +1591,16 @@ out: + static int configure_filter_tcb(struct adapter *adap, unsigned int tid, + struct filter_entry *f) + { +- if (f->fs.hitcnts) ++ if (f->fs.hitcnts) { + set_tcb_field(adap, f, tid, TCB_TIMESTAMP_W, +- TCB_TIMESTAMP_V(TCB_TIMESTAMP_M) | ++ TCB_TIMESTAMP_V(TCB_TIMESTAMP_M), ++ TCB_TIMESTAMP_V(0ULL), ++ 1); ++ set_tcb_field(adap, f, tid, TCB_RTT_TS_RECENT_AGE_W, + TCB_RTT_TS_RECENT_AGE_V(TCB_RTT_TS_RECENT_AGE_M), +- TCB_TIMESTAMP_V(0ULL) | + TCB_RTT_TS_RECENT_AGE_V(0ULL), + 1); ++ } + + if (f->fs.newdmac) + set_tcb_tflag(adap, f, tid, TF_CCTRL_ECE_S, 1, +diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +index 6a79c8e4a7a40..9043d2cadd5de 100644 +--- a/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c ++++ b/drivers/net/ethernet/netronome/nfp/nfp_net_ethtool.c +@@ -744,8 +744,8 @@ nfp_port_get_fecparam(struct net_device *netdev, + struct nfp_eth_table_port *eth_port; + struct nfp_port *port; + +- param->active_fec = ETHTOOL_FEC_NONE_BIT; +- param->fec = ETHTOOL_FEC_NONE_BIT; ++ param->active_fec = ETHTOOL_FEC_NONE; ++ param->fec = ETHTOOL_FEC_NONE; + + port = nfp_port_from_netdev(netdev); + eth_port = nfp_port_get_eth_port(port); +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 817c290b78cd9..d0b5844c8a315 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -721,7 +721,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, + struct net_device *dev, + struct geneve_sock *gs4, + struct flowi4 *fl4, +- const struct ip_tunnel_info *info) ++ const struct ip_tunnel_info *info, ++ __be16 dport, __be16 sport) + { + bool use_cache = ip_tunnel_dst_cache_usable(skb, info); + struct geneve_dev *geneve = netdev_priv(dev); +@@ -737,6 +738,8 @@ static struct rtable *geneve_get_v4_rt(struct sk_buff *skb, + fl4->flowi4_proto = IPPROTO_UDP; + fl4->daddr = info->key.u.ipv4.dst; + fl4->saddr = info->key.u.ipv4.src; ++ fl4->fl4_dport = dport; ++ fl4->fl4_sport = sport; + + tos = info->key.tos; + if ((tos == 1) && !geneve->collect_md) { +@@ -771,7 +774,8 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, + struct net_device *dev, + struct geneve_sock *gs6, + struct flowi6 *fl6, +- const struct ip_tunnel_info *info) ++ const struct ip_tunnel_info *info, ++ __be16 dport, __be16 sport) + { + bool use_cache = ip_tunnel_dst_cache_usable(skb, info); + struct geneve_dev *geneve = netdev_priv(dev); +@@ -787,6 +791,9 @@ static struct dst_entry *geneve_get_v6_dst(struct sk_buff *skb, + fl6->flowi6_proto = IPPROTO_UDP; + fl6->daddr = info->key.u.ipv6.dst; + fl6->saddr = info->key.u.ipv6.src; ++ fl6->fl6_dport = dport; ++ fl6->fl6_sport = sport; ++ + prio = info->key.tos; + if ((prio == 1) && !geneve->collect_md) { + prio = ip_tunnel_get_dsfield(ip_hdr(skb), skb); +@@ -833,14 +840,15 @@ static int geneve_xmit_skb(struct sk_buff *skb, struct net_device *dev, + __be16 df; + int err; + +- rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info); ++ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); ++ rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info, ++ geneve->info.key.tp_dst, sport); + if (IS_ERR(rt)) + return PTR_ERR(rt); + + skb_tunnel_check_pmtu(skb, &rt->dst, + GENEVE_IPV4_HLEN + info->options_len); + +- sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); + if (geneve->collect_md) { + tos = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); + ttl = key->ttl; +@@ -875,13 +883,14 @@ static int geneve6_xmit_skb(struct sk_buff *skb, struct net_device *dev, + __be16 sport; + int err; + +- dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info); ++ sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); ++ dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info, ++ geneve->info.key.tp_dst, sport); + if (IS_ERR(dst)) + return PTR_ERR(dst); + + skb_tunnel_check_pmtu(skb, dst, GENEVE_IPV6_HLEN + info->options_len); + +- sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true); + if (geneve->collect_md) { + prio = ip_tunnel_ecn_encap(key->tos, ip_hdr(skb), skb); + ttl = key->ttl; +@@ -958,13 +967,18 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) + { + struct ip_tunnel_info *info = skb_tunnel_info(skb); + struct geneve_dev *geneve = netdev_priv(dev); ++ __be16 sport; + + if (ip_tunnel_info_af(info) == AF_INET) { + struct rtable *rt; + struct flowi4 fl4; ++ + struct geneve_sock *gs4 = rcu_dereference(geneve->sock4); ++ sport = udp_flow_src_port(geneve->net, skb, ++ 1, USHRT_MAX, true); + +- rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info); ++ rt = geneve_get_v4_rt(skb, dev, gs4, &fl4, info, ++ geneve->info.key.tp_dst, sport); + if (IS_ERR(rt)) + return PTR_ERR(rt); + +@@ -974,9 +988,13 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) + } else if (ip_tunnel_info_af(info) == AF_INET6) { + struct dst_entry *dst; + struct flowi6 fl6; ++ + struct geneve_sock *gs6 = rcu_dereference(geneve->sock6); ++ sport = udp_flow_src_port(geneve->net, skb, ++ 1, USHRT_MAX, true); + +- dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info); ++ dst = geneve_get_v6_dst(skb, dev, gs6, &fl6, info, ++ geneve->info.key.tp_dst, sport); + if (IS_ERR(dst)) + return PTR_ERR(dst); + +@@ -987,8 +1005,7 @@ static int geneve_fill_metadata_dst(struct net_device *dev, struct sk_buff *skb) + return -EINVAL; + } + +- info->key.tp_src = udp_flow_src_port(geneve->net, skb, +- 1, USHRT_MAX, true); ++ info->key.tp_src = sport; + info->key.tp_dst = geneve->info.key.tp_dst; + return 0; + } +diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c +index 54ac599cffb4d..b884b681d5c52 100644 +--- a/drivers/net/phy/phy_device.c ++++ b/drivers/net/phy/phy_device.c +@@ -1154,7 +1154,8 @@ void phy_detach(struct phy_device *phydev) + + phy_led_triggers_unregister(phydev); + +- module_put(phydev->mdio.dev.driver->owner); ++ if (phydev->mdio.dev.driver) ++ module_put(phydev->mdio.dev.driver->owner); + + /* If the device had no specific driver before (i.e. - it + * was using the generic driver), we unbind the device +diff --git a/drivers/net/wan/Kconfig b/drivers/net/wan/Kconfig +index 4e9fe75d70675..21190dfbabb16 100644 +--- a/drivers/net/wan/Kconfig ++++ b/drivers/net/wan/Kconfig +@@ -199,7 +199,7 @@ config WANXL_BUILD_FIRMWARE + depends on WANXL && !PREVENT_FIRMWARE_BUILD + help + Allows you to rebuild firmware run by the QUICC processor. +- It requires as68k, ld68k and hexdump programs. ++ It requires m68k toolchains and hexdump programs. + + You should never need this option, say N. + +diff --git a/drivers/net/wan/Makefile b/drivers/net/wan/Makefile +index 9532e69fda878..0500282e176e0 100644 +--- a/drivers/net/wan/Makefile ++++ b/drivers/net/wan/Makefile +@@ -41,17 +41,17 @@ $(obj)/wanxl.o: $(obj)/wanxlfw.inc + + ifeq ($(CONFIG_WANXL_BUILD_FIRMWARE),y) + ifeq ($(ARCH),m68k) +- AS68K = $(AS) +- LD68K = $(LD) ++ M68KCC = $(CC) ++ M68KLD = $(LD) + else +- AS68K = as68k +- LD68K = ld68k ++ M68KCC = $(CROSS_COMPILE_M68K)gcc ++ M68KLD = $(CROSS_COMPILE_M68K)ld + endif + + quiet_cmd_build_wanxlfw = BLD FW $@ + cmd_build_wanxlfw = \ +- $(CPP) -D__ASSEMBLY__ -Wp,-MD,$(depfile) -I$(srctree)/include/uapi $< | $(AS68K) -m68360 -o $(obj)/wanxlfw.o; \ +- $(LD68K) --oformat binary -Ttext 0x1000 $(obj)/wanxlfw.o -o $(obj)/wanxlfw.bin; \ ++ $(M68KCC) -D__ASSEMBLY__ -Wp,-MD,$(depfile) -I$(srctree)/include/uapi -c -o $(obj)/wanxlfw.o $<; \ ++ $(M68KLD) --oformat binary -Ttext 0x1000 $(obj)/wanxlfw.o -o $(obj)/wanxlfw.bin; \ + hexdump -ve '"\n" 16/1 "0x%02X,"' $(obj)/wanxlfw.bin | sed 's/0x ,//g;1s/^/static const u8 firmware[]={/;$$s/,$$/\n};\n/' >$(obj)/wanxlfw.inc; \ + rm -f $(obj)/wanxlfw.bin $(obj)/wanxlfw.o + +diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c +index ab8b3cbbb205c..85844f26547dd 100644 +--- a/drivers/net/wan/hdlc_ppp.c ++++ b/drivers/net/wan/hdlc_ppp.c +@@ -386,11 +386,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id, + } + + for (opt = data; len; len -= opt[1], opt += opt[1]) { +- if (len < 2 || len < opt[1]) { +- dev->stats.rx_errors++; +- kfree(out); +- return; /* bad packet, drop silently */ +- } ++ if (len < 2 || opt[1] < 2 || len < opt[1]) ++ goto err_out; + + if (pid == PID_LCP) + switch (opt[0]) { +@@ -398,6 +395,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id, + continue; /* MRU always OK and > 1500 bytes? */ + + case LCP_OPTION_ACCM: /* async control character map */ ++ if (opt[1] < sizeof(valid_accm)) ++ goto err_out; + if (!memcmp(opt, valid_accm, + sizeof(valid_accm))) + continue; +@@ -409,6 +408,8 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id, + } + break; + case LCP_OPTION_MAGIC: ++ if (len < 6) ++ goto err_out; + if (opt[1] != 6 || (!opt[2] && !opt[3] && + !opt[4] && !opt[5])) + break; /* reject invalid magic number */ +@@ -427,6 +428,11 @@ static void ppp_cp_parse_cr(struct net_device *dev, u16 pid, u8 id, + ppp_cp_event(dev, pid, RCR_GOOD, CP_CONF_ACK, id, req_len, data); + + kfree(out); ++ return; ++ ++err_out: ++ dev->stats.rx_errors++; ++ kfree(out); + } + + static int ppp_rx(struct sk_buff *skb) +diff --git a/drivers/tty/serial/8250/8250_core.c b/drivers/tty/serial/8250/8250_core.c +index e1a5887b6d91d..d2df7d71d6667 100644 +--- a/drivers/tty/serial/8250/8250_core.c ++++ b/drivers/tty/serial/8250/8250_core.c +@@ -1062,8 +1062,10 @@ int serial8250_register_8250_port(struct uart_8250_port *up) + serial8250_apply_quirks(uart); + ret = uart_add_one_port(&serial8250_reg, + &uart->port); +- if (ret == 0) +- ret = uart->port.line; ++ if (ret) ++ goto err; ++ ++ ret = uart->port.line; + } else { + dev_info(uart->port.dev, + "skipping CIR port at 0x%lx / 0x%llx, IRQ %d\n", +@@ -1088,6 +1090,11 @@ int serial8250_register_8250_port(struct uart_8250_port *up) + mutex_unlock(&serial_mutex); + + return ret; ++ ++err: ++ uart->port.dev = NULL; ++ mutex_unlock(&serial_mutex); ++ return ret; + } + EXPORT_SYMBOL(serial8250_register_8250_port); + +diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h +index 25407c206e732..cbc0294f39899 100644 +--- a/include/linux/skbuff.h ++++ b/include/linux/skbuff.h +@@ -3014,8 +3014,9 @@ static inline int skb_padto(struct sk_buff *skb, unsigned int len) + * is untouched. Otherwise it is extended. Returns zero on + * success. The skb is freed on error if @free_on_error is true. + */ +-static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len, +- bool free_on_error) ++static inline int __must_check __skb_put_padto(struct sk_buff *skb, ++ unsigned int len, ++ bool free_on_error) + { + unsigned int size = skb->len; + +@@ -3038,7 +3039,7 @@ static inline int __skb_put_padto(struct sk_buff *skb, unsigned int len, + * is untouched. Otherwise it is extended. Returns zero on + * success. The skb is freed on error. + */ +-static inline int skb_put_padto(struct sk_buff *skb, unsigned int len) ++static inline int __must_check skb_put_padto(struct sk_buff *skb, unsigned int len) + { + return __skb_put_padto(skb, len, true); + } +diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h +index 2d5220ab0600b..fc9d6e37552d3 100644 +--- a/include/net/inet_connection_sock.h ++++ b/include/net/inet_connection_sock.h +@@ -139,8 +139,8 @@ struct inet_connection_sock { + } icsk_mtup; + u32 icsk_user_timeout; + +- u64 icsk_ca_priv[88 / sizeof(u64)]; +-#define ICSK_CA_PRIV_SIZE (11 * sizeof(u64)) ++ u64 icsk_ca_priv[104 / sizeof(u64)]; ++#define ICSK_CA_PRIV_SIZE (13 * sizeof(u64)) + }; + + #define ICSK_TIME_RETRANS 1 /* Retransmit timer */ +diff --git a/kernel/kprobes.c b/kernel/kprobes.c +index eb4bffe6d764d..230d9d599b5aa 100644 +--- a/kernel/kprobes.c ++++ b/kernel/kprobes.c +@@ -2061,6 +2061,9 @@ static void kill_kprobe(struct kprobe *p) + { + struct kprobe *kp; + ++ if (WARN_ON_ONCE(kprobe_gone(p))) ++ return; ++ + p->flags |= KPROBE_FLAG_GONE; + if (kprobe_aggrprobe(p)) { + /* +@@ -2243,7 +2246,10 @@ static int kprobes_module_callback(struct notifier_block *nb, + mutex_lock(&kprobe_mutex); + for (i = 0; i < KPROBE_TABLE_SIZE; i++) { + head = &kprobe_table[i]; +- hlist_for_each_entry_rcu(p, head, hlist) ++ hlist_for_each_entry_rcu(p, head, hlist) { ++ if (kprobe_gone(p)) ++ continue; ++ + if (within_module_init((unsigned long)p->addr, mod) || + (checkcore && + within_module_core((unsigned long)p->addr, mod))) { +@@ -2260,6 +2266,7 @@ static int kprobes_module_callback(struct notifier_block *nb, + */ + kill_kprobe(p); + } ++ } + } + mutex_unlock(&kprobe_mutex); + return NOTIFY_DONE; +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 1443ae6fee9bd..8b137248b146d 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -2145,7 +2145,7 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, + put_page(page); + add_mm_counter(mm, mm_counter_file(page), -HPAGE_PMD_NR); + return; +- } else if (is_huge_zero_pmd(*pmd)) { ++ } else if (pmd_trans_huge(*pmd) && is_huge_zero_pmd(*pmd)) { + /* + * FIXME: Do we want to invalidate secondary mmu by calling + * mmu_notifier_invalidate_range() see comments below inside +@@ -2233,27 +2233,33 @@ static void __split_huge_pmd_locked(struct vm_area_struct *vma, pmd_t *pmd, + pte = pte_offset_map(&_pmd, addr); + BUG_ON(!pte_none(*pte)); + set_pte_at(mm, addr, pte, entry); +- atomic_inc(&page[i]._mapcount); +- pte_unmap(pte); +- } +- +- /* +- * Set PG_double_map before dropping compound_mapcount to avoid +- * false-negative page_mapped(). +- */ +- if (compound_mapcount(page) > 1 && !TestSetPageDoubleMap(page)) { +- for (i = 0; i < HPAGE_PMD_NR; i++) ++ if (!pmd_migration) + atomic_inc(&page[i]._mapcount); ++ pte_unmap(pte); + } + +- if (atomic_add_negative(-1, compound_mapcount_ptr(page))) { +- /* Last compound_mapcount is gone. */ +- __dec_node_page_state(page, NR_ANON_THPS); +- if (TestClearPageDoubleMap(page)) { +- /* No need in mapcount reference anymore */ ++ if (!pmd_migration) { ++ /* ++ * Set PG_double_map before dropping compound_mapcount to avoid ++ * false-negative page_mapped(). ++ */ ++ if (compound_mapcount(page) > 1 && ++ !TestSetPageDoubleMap(page)) { + for (i = 0; i < HPAGE_PMD_NR; i++) +- atomic_dec(&page[i]._mapcount); ++ atomic_inc(&page[i]._mapcount); ++ } ++ ++ lock_page_memcg(page); ++ if (atomic_add_negative(-1, compound_mapcount_ptr(page))) { ++ /* Last compound_mapcount is gone. */ ++ __dec_lruvec_page_state(page, NR_ANON_THPS); ++ if (TestClearPageDoubleMap(page)) { ++ /* No need in mapcount reference anymore */ ++ for (i = 0; i < HPAGE_PMD_NR; i++) ++ atomic_dec(&page[i]._mapcount); ++ } + } ++ unlock_page_memcg(page); + } + + smp_wmb(); /* make pte visible before pmd */ +diff --git a/mm/vmscan.c b/mm/vmscan.c +index bc2ecd43251ad..b93dc8fc6007f 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -2708,6 +2708,14 @@ static bool shrink_node(pg_data_t *pgdat, struct scan_control *sc) + unsigned long reclaimed; + unsigned long scanned; + ++ /* ++ * This loop can become CPU-bound when target memcgs ++ * aren't eligible for reclaim - either because they ++ * don't have any reclaimable pages, or because their ++ * memory is explicitly protected. Avoid soft lockups. ++ */ ++ cond_resched(); ++ + switch (mem_cgroup_protected(root, memcg)) { + case MEMCG_PROT_MIN: + /* +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index a556cd708885a..5ee6b94131b23 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1421,6 +1421,7 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlmsghdr *nlh, + { + const struct dcbnl_rtnl_ops *ops = netdev->dcbnl_ops; + struct nlattr *ieee[DCB_ATTR_IEEE_MAX + 1]; ++ int prio; + int err; + + if (!ops) +@@ -1469,6 +1470,13 @@ static int dcbnl_ieee_set(struct net_device *netdev, struct nlmsghdr *nlh, + struct dcbnl_buffer *buffer = + nla_data(ieee[DCB_ATTR_DCB_BUFFER]); + ++ for (prio = 0; prio < ARRAY_SIZE(buffer->prio2buffer); prio++) { ++ if (buffer->prio2buffer[prio] >= DCBX_MAX_BUFFERS) { ++ err = -EINVAL; ++ goto err; ++ } ++ } ++ + err = ops->dcbnl_setbuffer(netdev, buffer); + if (err) + goto err; +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c +index fbf30122e8bf2..f0faf1193dd89 100644 +--- a/net/ipv4/ip_output.c ++++ b/net/ipv4/ip_output.c +@@ -73,6 +73,7 @@ + #include <net/icmp.h> + #include <net/checksum.h> + #include <net/inetpeer.h> ++#include <net/inet_ecn.h> + #include <net/lwtunnel.h> + #include <linux/bpf-cgroup.h> + #include <linux/igmp.h> +@@ -1582,7 +1583,7 @@ void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, + if (IS_ERR(rt)) + return; + +- inet_sk(sk)->tos = arg->tos; ++ inet_sk(sk)->tos = arg->tos & ~INET_ECN_MASK; + + sk->sk_priority = skb->priority; + sk->sk_protocol = ip_hdr(skb)->protocol; +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index f752d22cc8a59..84de87b7eedcd 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -777,8 +777,10 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow + neigh_event_send(n, NULL); + } else { + if (fib_lookup(net, fl4, &res, 0) == 0) { +- struct fib_nh *nh = &FIB_RES_NH(res); ++ struct fib_nh *nh; + ++ fib_select_path(net, &res, fl4, skb); ++ nh = &FIB_RES_NH(res); + update_or_create_fnhe(nh, fl4->daddr, new_gw, + 0, false, + jiffies + ip_rt_gc_timeout); +@@ -1004,6 +1006,7 @@ out: kfree_skb(skb); + static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) + { + struct dst_entry *dst = &rt->dst; ++ struct net *net = dev_net(dst->dev); + u32 old_mtu = ipv4_mtu(dst); + struct fib_result res; + bool lock = false; +@@ -1024,9 +1027,11 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu) + return; + + rcu_read_lock(); +- if (fib_lookup(dev_net(dst->dev), fl4, &res, 0) == 0) { +- struct fib_nh *nh = &FIB_RES_NH(res); ++ if (fib_lookup(net, fl4, &res, 0) == 0) { ++ struct fib_nh *nh; + ++ fib_select_path(net, &res, fl4, NULL); ++ nh = &FIB_RES_NH(res); + update_or_create_fnhe(nh, fl4->daddr, 0, mtu, lock, + jiffies + ip_rt_mtu_expires); + } +@@ -2536,8 +2541,6 @@ struct rtable *ip_route_output_key_hash_rcu(struct net *net, struct flowi4 *fl4, + fib_select_path(net, res, fl4, skb); + + dev_out = FIB_RES_DEV(*res); +- fl4->flowi4_oif = dev_out->ifindex; +- + + make_route: + rth = __mkroute_output(res, fl4, orig_oif, dev_out, flags); +diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c +index b371e66502c36..93f1763362977 100644 +--- a/net/ipv4/tcp_bbr.c ++++ b/net/ipv4/tcp_bbr.c +@@ -115,6 +115,14 @@ struct bbr { + unused_b:5; + u32 prior_cwnd; /* prior cwnd upon entering loss recovery */ + u32 full_bw; /* recent bw, to estimate if pipe is full */ ++ ++ /* For tracking ACK aggregation: */ ++ u64 ack_epoch_mstamp; /* start of ACK sampling epoch */ ++ u16 extra_acked[2]; /* max excess data ACKed in epoch */ ++ u32 ack_epoch_acked:20, /* packets (S)ACKed in sampling epoch */ ++ extra_acked_win_rtts:5, /* age of extra_acked, in round trips */ ++ extra_acked_win_idx:1, /* current index in extra_acked array */ ++ unused_c:6; + }; + + #define CYCLE_LEN 8 /* number of phases in a pacing gain cycle */ +@@ -174,6 +182,15 @@ static const u32 bbr_lt_bw_diff = 4000 / 8; + /* If we estimate we're policed, use lt_bw for this many round trips: */ + static const u32 bbr_lt_bw_max_rtts = 48; + ++/* Gain factor for adding extra_acked to target cwnd: */ ++static const int bbr_extra_acked_gain = BBR_UNIT; ++/* Window length of extra_acked window. */ ++static const u32 bbr_extra_acked_win_rtts = 5; ++/* Max allowed val for ack_epoch_acked, after which sampling epoch is reset */ ++static const u32 bbr_ack_epoch_acked_reset_thresh = 1U << 20; ++/* Time period for clamping cwnd increment due to ack aggregation */ ++static const u32 bbr_extra_acked_max_us = 100 * 1000; ++ + static void bbr_check_probe_rtt_done(struct sock *sk); + + /* Do we estimate that STARTUP filled the pipe? */ +@@ -200,6 +217,16 @@ static u32 bbr_bw(const struct sock *sk) + return bbr->lt_use_bw ? bbr->lt_bw : bbr_max_bw(sk); + } + ++/* Return maximum extra acked in past k-2k round trips, ++ * where k = bbr_extra_acked_win_rtts. ++ */ ++static u16 bbr_extra_acked(const struct sock *sk) ++{ ++ struct bbr *bbr = inet_csk_ca(sk); ++ ++ return max(bbr->extra_acked[0], bbr->extra_acked[1]); ++} ++ + /* Return rate in bytes per second, optionally with a gain. + * The order here is chosen carefully to avoid overflow of u64. This should + * work for input rates of up to 2.9Tbit/sec and gain of 2.89x. +@@ -305,6 +332,8 @@ static void bbr_cwnd_event(struct sock *sk, enum tcp_ca_event event) + + if (event == CA_EVENT_TX_START && tp->app_limited) { + bbr->idle_restart = 1; ++ bbr->ack_epoch_mstamp = tp->tcp_mstamp; ++ bbr->ack_epoch_acked = 0; + /* Avoid pointless buffer overflows: pace at est. bw if we don't + * need more speed (we're restarting from idle and app-limited). + */ +@@ -315,30 +344,19 @@ static void bbr_cwnd_event(struct sock *sk, enum tcp_ca_event event) + } + } + +-/* Find target cwnd. Right-size the cwnd based on min RTT and the +- * estimated bottleneck bandwidth: ++/* Calculate bdp based on min RTT and the estimated bottleneck bandwidth: + * +- * cwnd = bw * min_rtt * gain = BDP * gain ++ * bdp = bw * min_rtt * gain + * + * The key factor, gain, controls the amount of queue. While a small gain + * builds a smaller queue, it becomes more vulnerable to noise in RTT + * measurements (e.g., delayed ACKs or other ACK compression effects). This + * noise may cause BBR to under-estimate the rate. +- * +- * To achieve full performance in high-speed paths, we budget enough cwnd to +- * fit full-sized skbs in-flight on both end hosts to fully utilize the path: +- * - one skb in sending host Qdisc, +- * - one skb in sending host TSO/GSO engine +- * - one skb being received by receiver host LRO/GRO/delayed-ACK engine +- * Don't worry, at low rates (bbr_min_tso_rate) this won't bloat cwnd because +- * in such cases tso_segs_goal is 1. The minimum cwnd is 4 packets, +- * which allows 2 outstanding 2-packet sequences, to try to keep pipe +- * full even with ACK-every-other-packet delayed ACKs. + */ +-static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain) ++static u32 bbr_bdp(struct sock *sk, u32 bw, int gain) + { + struct bbr *bbr = inet_csk_ca(sk); +- u32 cwnd; ++ u32 bdp; + u64 w; + + /* If we've never had a valid RTT sample, cap cwnd at the initial +@@ -353,7 +371,24 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain) + w = (u64)bw * bbr->min_rtt_us; + + /* Apply a gain to the given value, then remove the BW_SCALE shift. */ +- cwnd = (((w * gain) >> BBR_SCALE) + BW_UNIT - 1) / BW_UNIT; ++ bdp = (((w * gain) >> BBR_SCALE) + BW_UNIT - 1) / BW_UNIT; ++ ++ return bdp; ++} ++ ++/* To achieve full performance in high-speed paths, we budget enough cwnd to ++ * fit full-sized skbs in-flight on both end hosts to fully utilize the path: ++ * - one skb in sending host Qdisc, ++ * - one skb in sending host TSO/GSO engine ++ * - one skb being received by receiver host LRO/GRO/delayed-ACK engine ++ * Don't worry, at low rates (bbr_min_tso_rate) this won't bloat cwnd because ++ * in such cases tso_segs_goal is 1. The minimum cwnd is 4 packets, ++ * which allows 2 outstanding 2-packet sequences, to try to keep pipe ++ * full even with ACK-every-other-packet delayed ACKs. ++ */ ++static u32 bbr_quantization_budget(struct sock *sk, u32 cwnd, int gain) ++{ ++ struct bbr *bbr = inet_csk_ca(sk); + + /* Allow enough full-sized skbs in flight to utilize end systems. */ + cwnd += 3 * bbr_tso_segs_goal(sk); +@@ -368,6 +403,33 @@ static u32 bbr_target_cwnd(struct sock *sk, u32 bw, int gain) + return cwnd; + } + ++/* Find inflight based on min RTT and the estimated bottleneck bandwidth. */ ++static u32 bbr_inflight(struct sock *sk, u32 bw, int gain) ++{ ++ u32 inflight; ++ ++ inflight = bbr_bdp(sk, bw, gain); ++ inflight = bbr_quantization_budget(sk, inflight, gain); ++ ++ return inflight; ++} ++ ++/* Find the cwnd increment based on estimate of ack aggregation */ ++static u32 bbr_ack_aggregation_cwnd(struct sock *sk) ++{ ++ u32 max_aggr_cwnd, aggr_cwnd = 0; ++ ++ if (bbr_extra_acked_gain && bbr_full_bw_reached(sk)) { ++ max_aggr_cwnd = ((u64)bbr_bw(sk) * bbr_extra_acked_max_us) ++ / BW_UNIT; ++ aggr_cwnd = (bbr_extra_acked_gain * bbr_extra_acked(sk)) ++ >> BBR_SCALE; ++ aggr_cwnd = min(aggr_cwnd, max_aggr_cwnd); ++ } ++ ++ return aggr_cwnd; ++} ++ + /* An optimization in BBR to reduce losses: On the first round of recovery, we + * follow the packet conservation principle: send P packets per P packets acked. + * After that, we slow-start and send at most 2*P packets per P packets acked. +@@ -428,8 +490,15 @@ static void bbr_set_cwnd(struct sock *sk, const struct rate_sample *rs, + if (bbr_set_cwnd_to_recover_or_restore(sk, rs, acked, &cwnd)) + goto done; + ++ target_cwnd = bbr_bdp(sk, bw, gain); ++ ++ /* Increment the cwnd to account for excess ACKed data that seems ++ * due to aggregation (of data and/or ACKs) visible in the ACK stream. ++ */ ++ target_cwnd += bbr_ack_aggregation_cwnd(sk); ++ target_cwnd = bbr_quantization_budget(sk, target_cwnd, gain); ++ + /* If we're below target cwnd, slow start cwnd toward target cwnd. */ +- target_cwnd = bbr_target_cwnd(sk, bw, gain); + if (bbr_full_bw_reached(sk)) /* only cut cwnd if we filled the pipe */ + cwnd = min(cwnd + acked, target_cwnd); + else if (cwnd < target_cwnd || tp->delivered < TCP_INIT_CWND) +@@ -470,14 +539,14 @@ static bool bbr_is_next_cycle_phase(struct sock *sk, + if (bbr->pacing_gain > BBR_UNIT) + return is_full_length && + (rs->losses || /* perhaps pacing_gain*BDP won't fit */ +- inflight >= bbr_target_cwnd(sk, bw, bbr->pacing_gain)); ++ inflight >= bbr_inflight(sk, bw, bbr->pacing_gain)); + + /* A pacing_gain < 1.0 tries to drain extra queue we added if bw + * probing didn't find more bw. If inflight falls to match BDP then we + * estimate queue is drained; persisting would underutilize the pipe. + */ + return is_full_length || +- inflight <= bbr_target_cwnd(sk, bw, BBR_UNIT); ++ inflight <= bbr_inflight(sk, bw, BBR_UNIT); + } + + static void bbr_advance_cycle_phase(struct sock *sk) +@@ -699,6 +768,67 @@ static void bbr_update_bw(struct sock *sk, const struct rate_sample *rs) + } + } + ++/* Estimates the windowed max degree of ack aggregation. ++ * This is used to provision extra in-flight data to keep sending during ++ * inter-ACK silences. ++ * ++ * Degree of ack aggregation is estimated as extra data acked beyond expected. ++ * ++ * max_extra_acked = "maximum recent excess data ACKed beyond max_bw * interval" ++ * cwnd += max_extra_acked ++ * ++ * Max extra_acked is clamped by cwnd and bw * bbr_extra_acked_max_us (100 ms). ++ * Max filter is an approximate sliding window of 5-10 (packet timed) round ++ * trips. ++ */ ++static void bbr_update_ack_aggregation(struct sock *sk, ++ const struct rate_sample *rs) ++{ ++ u32 epoch_us, expected_acked, extra_acked; ++ struct bbr *bbr = inet_csk_ca(sk); ++ struct tcp_sock *tp = tcp_sk(sk); ++ ++ if (!bbr_extra_acked_gain || rs->acked_sacked <= 0 || ++ rs->delivered < 0 || rs->interval_us <= 0) ++ return; ++ ++ if (bbr->round_start) { ++ bbr->extra_acked_win_rtts = min(0x1F, ++ bbr->extra_acked_win_rtts + 1); ++ if (bbr->extra_acked_win_rtts >= bbr_extra_acked_win_rtts) { ++ bbr->extra_acked_win_rtts = 0; ++ bbr->extra_acked_win_idx = bbr->extra_acked_win_idx ? ++ 0 : 1; ++ bbr->extra_acked[bbr->extra_acked_win_idx] = 0; ++ } ++ } ++ ++ /* Compute how many packets we expected to be delivered over epoch. */ ++ epoch_us = tcp_stamp_us_delta(tp->delivered_mstamp, ++ bbr->ack_epoch_mstamp); ++ expected_acked = ((u64)bbr_bw(sk) * epoch_us) / BW_UNIT; ++ ++ /* Reset the aggregation epoch if ACK rate is below expected rate or ++ * significantly large no. of ack received since epoch (potentially ++ * quite old epoch). ++ */ ++ if (bbr->ack_epoch_acked <= expected_acked || ++ (bbr->ack_epoch_acked + rs->acked_sacked >= ++ bbr_ack_epoch_acked_reset_thresh)) { ++ bbr->ack_epoch_acked = 0; ++ bbr->ack_epoch_mstamp = tp->delivered_mstamp; ++ expected_acked = 0; ++ } ++ ++ /* Compute excess data delivered, beyond what was expected. */ ++ bbr->ack_epoch_acked = min_t(u32, 0xFFFFF, ++ bbr->ack_epoch_acked + rs->acked_sacked); ++ extra_acked = bbr->ack_epoch_acked - expected_acked; ++ extra_acked = min(extra_acked, tp->snd_cwnd); ++ if (extra_acked > bbr->extra_acked[bbr->extra_acked_win_idx]) ++ bbr->extra_acked[bbr->extra_acked_win_idx] = extra_acked; ++} ++ + /* Estimate when the pipe is full, using the change in delivery rate: BBR + * estimates that STARTUP filled the pipe if the estimated bw hasn't changed by + * at least bbr_full_bw_thresh (25%) after bbr_full_bw_cnt (3) non-app-limited +@@ -736,11 +866,11 @@ static void bbr_check_drain(struct sock *sk, const struct rate_sample *rs) + bbr->pacing_gain = bbr_drain_gain; /* pace slow to drain */ + bbr->cwnd_gain = bbr_high_gain; /* maintain cwnd */ + tcp_sk(sk)->snd_ssthresh = +- bbr_target_cwnd(sk, bbr_max_bw(sk), BBR_UNIT); ++ bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT); + } /* fall through to check if in-flight is already small: */ + if (bbr->mode == BBR_DRAIN && + tcp_packets_in_flight(tcp_sk(sk)) <= +- bbr_target_cwnd(sk, bbr_max_bw(sk), BBR_UNIT)) ++ bbr_inflight(sk, bbr_max_bw(sk), BBR_UNIT)) + bbr_reset_probe_bw_mode(sk); /* we estimate queue is drained */ + } + +@@ -828,6 +958,7 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs) + static void bbr_update_model(struct sock *sk, const struct rate_sample *rs) + { + bbr_update_bw(sk, rs); ++ bbr_update_ack_aggregation(sk, rs); + bbr_update_cycle_phase(sk, rs); + bbr_check_full_bw_reached(sk, rs); + bbr_check_drain(sk, rs); +@@ -878,6 +1009,13 @@ static void bbr_init(struct sock *sk) + bbr_reset_lt_bw_sampling(sk); + bbr_reset_startup_mode(sk); + ++ bbr->ack_epoch_mstamp = tp->tcp_mstamp; ++ bbr->ack_epoch_acked = 0; ++ bbr->extra_acked_win_rtts = 0; ++ bbr->extra_acked_win_idx = 0; ++ bbr->extra_acked[0] = 0; ++ bbr->extra_acked[1] = 0; ++ + cmpxchg(&sk->sk_pacing_status, SK_PACING_NONE, SK_PACING_NEEDED); + } + +diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig +index 613282c65a107..a32cf50c237d8 100644 +--- a/net/ipv6/Kconfig ++++ b/net/ipv6/Kconfig +@@ -321,6 +321,7 @@ config IPV6_SEG6_LWTUNNEL + config IPV6_SEG6_HMAC + bool "IPv6: Segment Routing HMAC support" + depends on IPV6 ++ select CRYPTO + select CRYPTO_HMAC + select CRYPTO_SHA1 + select CRYPTO_SHA256 +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 5e8979c1f76d8..05a206202e23d 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -1811,14 +1811,19 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn, + /* Need to own table->tb6_lock */ + int fib6_del(struct fib6_info *rt, struct nl_info *info) + { +- struct fib6_node *fn = rcu_dereference_protected(rt->fib6_node, +- lockdep_is_held(&rt->fib6_table->tb6_lock)); +- struct fib6_table *table = rt->fib6_table; + struct net *net = info->nl_net; + struct fib6_info __rcu **rtp; + struct fib6_info __rcu **rtp_next; ++ struct fib6_table *table; ++ struct fib6_node *fn; ++ ++ if (rt == net->ipv6.fib6_null_entry) ++ return -ENOENT; + +- if (!fn || rt == net->ipv6.fib6_null_entry) ++ table = rt->fib6_table; ++ fn = rcu_dereference_protected(rt->fib6_node, ++ lockdep_is_held(&table->tb6_lock)); ++ if (!fn) + return -ENOENT; + + WARN_ON(!(fn->fn_flags & RTN_RTINFO)); +diff --git a/net/key/af_key.c b/net/key/af_key.c +index 1982f9f31debb..e340e97224c3a 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -1855,6 +1855,13 @@ static int pfkey_dump(struct sock *sk, struct sk_buff *skb, const struct sadb_ms + if (ext_hdrs[SADB_X_EXT_FILTER - 1]) { + struct sadb_x_filter *xfilter = ext_hdrs[SADB_X_EXT_FILTER - 1]; + ++ if ((xfilter->sadb_x_filter_splen >= ++ (sizeof(xfrm_address_t) << 3)) || ++ (xfilter->sadb_x_filter_dplen >= ++ (sizeof(xfrm_address_t) << 3))) { ++ mutex_unlock(&pfk->dump_lock); ++ return -EINVAL; ++ } + filter = kmalloc(sizeof(*filter), GFP_KERNEL); + if (filter == NULL) { + mutex_unlock(&pfk->dump_lock); +diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c +index 42bd1e74f78c1..a05c5cb3429c0 100644 +--- a/net/qrtr/qrtr.c ++++ b/net/qrtr/qrtr.c +@@ -185,7 +185,7 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb, + { + struct qrtr_hdr_v1 *hdr; + size_t len = skb->len; +- int rc = -ENODEV; ++ int rc; + + hdr = skb_push(skb, sizeof(*hdr)); + hdr->version = cpu_to_le32(QRTR_PROTO_VER_1); +@@ -203,15 +203,17 @@ static int qrtr_node_enqueue(struct qrtr_node *node, struct sk_buff *skb, + hdr->size = cpu_to_le32(len); + hdr->confirm_rx = 0; + +- skb_put_padto(skb, ALIGN(len, 4) + sizeof(*hdr)); +- +- mutex_lock(&node->ep_lock); +- if (node->ep) +- rc = node->ep->xmit(node->ep, skb); +- else +- kfree_skb(skb); +- mutex_unlock(&node->ep_lock); ++ rc = skb_put_padto(skb, ALIGN(len, 4) + sizeof(*hdr)); + ++ if (!rc) { ++ mutex_lock(&node->ep_lock); ++ rc = -ENODEV; ++ if (node->ep) ++ rc = node->ep->xmit(node->ep, skb); ++ else ++ kfree_skb(skb); ++ mutex_unlock(&node->ep_lock); ++ } + return rc; + } + +diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c +index 119e20cad662b..bd96fd261dba3 100644 +--- a/net/sched/sch_generic.c ++++ b/net/sched/sch_generic.c +@@ -1115,27 +1115,36 @@ static void dev_deactivate_queue(struct net_device *dev, + struct netdev_queue *dev_queue, + void *_qdisc_default) + { +- struct Qdisc *qdisc_default = _qdisc_default; +- struct Qdisc *qdisc; ++ struct Qdisc *qdisc = rtnl_dereference(dev_queue->qdisc); + +- qdisc = rtnl_dereference(dev_queue->qdisc); + if (qdisc) { +- bool nolock = qdisc->flags & TCQ_F_NOLOCK; +- +- if (nolock) +- spin_lock_bh(&qdisc->seqlock); +- spin_lock_bh(qdisc_lock(qdisc)); +- + if (!(qdisc->flags & TCQ_F_BUILTIN)) + set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state); ++ } ++} + +- rcu_assign_pointer(dev_queue->qdisc, qdisc_default); +- qdisc_reset(qdisc); ++static void dev_reset_queue(struct net_device *dev, ++ struct netdev_queue *dev_queue, ++ void *_unused) ++{ ++ struct Qdisc *qdisc; ++ bool nolock; + +- spin_unlock_bh(qdisc_lock(qdisc)); +- if (nolock) +- spin_unlock_bh(&qdisc->seqlock); +- } ++ qdisc = dev_queue->qdisc_sleeping; ++ if (!qdisc) ++ return; ++ ++ nolock = qdisc->flags & TCQ_F_NOLOCK; ++ ++ if (nolock) ++ spin_lock_bh(&qdisc->seqlock); ++ spin_lock_bh(qdisc_lock(qdisc)); ++ ++ qdisc_reset(qdisc); ++ ++ spin_unlock_bh(qdisc_lock(qdisc)); ++ if (nolock) ++ spin_unlock_bh(&qdisc->seqlock); + } + + static bool some_qdisc_is_busy(struct net_device *dev) +@@ -1196,12 +1205,20 @@ void dev_deactivate_many(struct list_head *head) + dev_watchdog_down(dev); + } + +- /* Wait for outstanding qdisc-less dev_queue_xmit calls. ++ /* Wait for outstanding qdisc-less dev_queue_xmit calls or ++ * outstanding qdisc enqueuing calls. + * This is avoided if all devices are in dismantle phase : + * Caller will call synchronize_net() for us + */ + synchronize_net(); + ++ list_for_each_entry(dev, head, close_list) { ++ netdev_for_each_tx_queue(dev, dev_reset_queue, NULL); ++ ++ if (dev_ingress_queue(dev)) ++ dev_reset_queue(dev, dev_ingress_queue(dev), NULL); ++ } ++ + /* Wait for outstanding qdisc_run calls. */ + list_for_each_entry(dev, head, close_list) { + while (some_qdisc_is_busy(dev)) +diff --git a/net/tipc/group.c b/net/tipc/group.c +index 9a9138de4eca5..b656385efad65 100644 +--- a/net/tipc/group.c ++++ b/net/tipc/group.c +@@ -273,8 +273,8 @@ static struct tipc_member *tipc_group_find_node(struct tipc_group *grp, + return NULL; + } + +-static void tipc_group_add_to_tree(struct tipc_group *grp, +- struct tipc_member *m) ++static int tipc_group_add_to_tree(struct tipc_group *grp, ++ struct tipc_member *m) + { + u64 nkey, key = (u64)m->node << 32 | m->port; + struct rb_node **n, *parent = NULL; +@@ -291,10 +291,11 @@ static void tipc_group_add_to_tree(struct tipc_group *grp, + else if (key > nkey) + n = &(*n)->rb_right; + else +- return; ++ return -EEXIST; + } + rb_link_node(&m->tree_node, parent, n); + rb_insert_color(&m->tree_node, &grp->members); ++ return 0; + } + + static struct tipc_member *tipc_group_create_member(struct tipc_group *grp, +@@ -302,6 +303,7 @@ static struct tipc_member *tipc_group_create_member(struct tipc_group *grp, + u32 instance, int state) + { + struct tipc_member *m; ++ int ret; + + m = kzalloc(sizeof(*m), GFP_ATOMIC); + if (!m) +@@ -314,8 +316,12 @@ static struct tipc_member *tipc_group_create_member(struct tipc_group *grp, + m->port = port; + m->instance = instance; + m->bc_acked = grp->bc_snd_nxt - 1; ++ ret = tipc_group_add_to_tree(grp, m); ++ if (ret < 0) { ++ kfree(m); ++ return NULL; ++ } + grp->member_cnt++; +- tipc_group_add_to_tree(grp, m); + tipc_nlist_add(&grp->dests, m->node); + m->state = state; + return m; +diff --git a/net/tipc/msg.c b/net/tipc/msg.c +index cbccf1791d3c5..b078b77620f18 100644 +--- a/net/tipc/msg.c ++++ b/net/tipc/msg.c +@@ -140,7 +140,8 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) + if (fragid == FIRST_FRAGMENT) { + if (unlikely(head)) + goto err; +- if (unlikely(skb_unclone(frag, GFP_ATOMIC))) ++ frag = skb_unshare(frag, GFP_ATOMIC); ++ if (unlikely(!frag)) + goto err; + head = *headbuf = frag; + *buf = NULL; +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index d0cf7169f08c8..16e2af3a00ccb 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2565,10 +2565,7 @@ static int tipc_shutdown(struct socket *sock, int how) + lock_sock(sk); + + __tipc_shutdown(sock, TIPC_CONN_SHUTDOWN); +- if (tipc_sk_type_connectionless(sk)) +- sk->sk_shutdown = SHUTDOWN_MASK; +- else +- sk->sk_shutdown = SEND_SHUTDOWN; ++ sk->sk_shutdown = SHUTDOWN_MASK; + + if (sk->sk_state == TIPC_DISCONNECTING) { + /* Discard any unreceived messages */ +diff --git a/tools/objtool/Makefile b/tools/objtool/Makefile +index 20f67fcf378d5..baa92279c137e 100644 +--- a/tools/objtool/Makefile ++++ b/tools/objtool/Makefile +@@ -7,9 +7,15 @@ ARCH := x86 + endif + + # always use the host compiler ++ifneq ($(LLVM),) ++HOSTAR ?= llvm-ar ++HOSTCC ?= clang ++HOSTLD ?= ld.lld ++else + HOSTAR ?= ar + HOSTCC ?= gcc + HOSTLD ?= ld ++endif + AR = $(HOSTAR) + CC = $(HOSTCC) + LD = $(HOSTLD) +diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c +index 2155b52b17eca..6bd01d12df2ec 100644 +--- a/virt/kvm/kvm_main.c ++++ b/virt/kvm/kvm_main.c +@@ -3844,7 +3844,7 @@ int kvm_io_bus_register_dev(struct kvm *kvm, enum kvm_bus bus_idx, gpa_t addr, + void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, + struct kvm_io_device *dev) + { +- int i; ++ int i, j; + struct kvm_io_bus *new_bus, *bus; + + bus = kvm_get_bus(kvm, bus_idx); +@@ -3861,17 +3861,20 @@ void kvm_io_bus_unregister_dev(struct kvm *kvm, enum kvm_bus bus_idx, + + new_bus = kmalloc(sizeof(*bus) + ((bus->dev_count - 1) * + sizeof(struct kvm_io_range)), GFP_KERNEL); +- if (!new_bus) { ++ if (new_bus) { ++ memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range)); ++ new_bus->dev_count--; ++ memcpy(new_bus->range + i, bus->range + i + 1, ++ (new_bus->dev_count - i) * sizeof(struct kvm_io_range)); ++ } else { + pr_err("kvm: failed to shrink bus, removing it completely\n"); +- goto broken; ++ for (j = 0; j < bus->dev_count; j++) { ++ if (j == i) ++ continue; ++ kvm_iodevice_destructor(bus->range[j].dev); ++ } + } + +- memcpy(new_bus, bus, sizeof(*bus) + i * sizeof(struct kvm_io_range)); +- new_bus->dev_count--; +- memcpy(new_bus->range + i, bus->range + i + 1, +- (new_bus->dev_count - i) * sizeof(struct kvm_io_range)); +- +-broken: + rcu_assign_pointer(kvm->buses[bus_idx], new_bus); + synchronize_srcu_expedited(&kvm->srcu); + kfree(bus);
