commit: 3cd7cdfe0a7bb77cf01ff2510dcb83492af581cb Author: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> AuthorDate: Mon Mar 5 02:37:54 2018 +0000 Commit: Alice Ferrazzi <alicef <AT> gentoo <DOT> org> CommitDate: Mon Mar 5 02:37:54 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=3cd7cdfe
linux kernel 4.9.86 0000_README | 4 + 1085_linux-4.9.86.patch | 1735 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1739 insertions(+) diff --git a/0000_README b/0000_README index bf6df96..f21a5fb 100644 --- a/0000_README +++ b/0000_README @@ -383,6 +383,10 @@ Patch: 1084_linux-4.9.85.patch From: http://www.kernel.org Desc: Linux 4.9.85 +Patch: 1085_linux-4.9.86.patch +From: http://www.kernel.org +Desc: Linux 4.9.86 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1085_linux-4.9.86.patch b/1085_linux-4.9.86.patch new file mode 100644 index 0000000..069a860 --- /dev/null +++ b/1085_linux-4.9.86.patch @@ -0,0 +1,1735 @@ +diff --git a/Makefile b/Makefile +index 77deaa395d69..e918d25e95bb 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 9 +-SUBLEVEL = 85 ++SUBLEVEL = 86 + EXTRAVERSION = + NAME = Roaring Lionus + +diff --git a/arch/arm/boot/dts/ls1021a-qds.dts b/arch/arm/boot/dts/ls1021a-qds.dts +index 940875316d0f..67b4de0e3439 100644 +--- a/arch/arm/boot/dts/ls1021a-qds.dts ++++ b/arch/arm/boot/dts/ls1021a-qds.dts +@@ -215,7 +215,7 @@ + reg = <0x2a>; + VDDA-supply = <®_3p3v>; + VDDIO-supply = <®_3p3v>; +- clocks = <&sys_mclk 1>; ++ clocks = <&sys_mclk>; + }; + }; + }; +diff --git a/arch/arm/boot/dts/ls1021a-twr.dts b/arch/arm/boot/dts/ls1021a-twr.dts +index a8b148ad1dd2..44715c8ef756 100644 +--- a/arch/arm/boot/dts/ls1021a-twr.dts ++++ b/arch/arm/boot/dts/ls1021a-twr.dts +@@ -187,7 +187,7 @@ + reg = <0x0a>; + VDDA-supply = <®_3p3v>; + VDDIO-supply = <®_3p3v>; +- clocks = <&sys_mclk 1>; ++ clocks = <&sys_mclk>; + }; + }; + +diff --git a/arch/arm/kvm/mmu.c b/arch/arm/kvm/mmu.c +index 2a35c1963f6d..7f868d9bb5ed 100644 +--- a/arch/arm/kvm/mmu.c ++++ b/arch/arm/kvm/mmu.c +@@ -1284,7 +1284,7 @@ static int user_mem_abort(struct kvm_vcpu *vcpu, phys_addr_t fault_ipa, + return -EFAULT; + } + +- if (vma_kernel_pagesize(vma) && !logging_active) { ++ if (vma_kernel_pagesize(vma) == PMD_SIZE && !logging_active) { + hugetlb = true; + gfn = (fault_ipa & PMD_MASK) >> PAGE_SHIFT; + } else { +diff --git a/arch/arm/lib/csumpartialcopyuser.S b/arch/arm/lib/csumpartialcopyuser.S +index 1712f132b80d..b83fdc06286a 100644 +--- a/arch/arm/lib/csumpartialcopyuser.S ++++ b/arch/arm/lib/csumpartialcopyuser.S +@@ -85,7 +85,11 @@ + .pushsection .text.fixup,"ax" + .align 4 + 9001: mov r4, #-EFAULT ++#ifdef CONFIG_CPU_SW_DOMAIN_PAN ++ ldr r5, [sp, #9*4] @ *err_ptr ++#else + ldr r5, [sp, #8*4] @ *err_ptr ++#endif + str r4, [r5] + ldmia sp, {r1, r2} @ retrieve dst, len + add r2, r2, r1 +diff --git a/arch/mips/lib/Makefile b/arch/mips/lib/Makefile +index 0344e575f522..fba4ca56e46a 100644 +--- a/arch/mips/lib/Makefile ++++ b/arch/mips/lib/Makefile +@@ -15,4 +15,5 @@ obj-$(CONFIG_CPU_R3000) += r3k_dump_tlb.o + obj-$(CONFIG_CPU_TX39XX) += r3k_dump_tlb.o + + # libgcc-style stuff needed in the kernel +-obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o ucmpdi2.o ++obj-y += ashldi3.o ashrdi3.o bswapsi.o bswapdi.o cmpdi2.o lshrdi3.o multi3.o \ ++ ucmpdi2.o +diff --git a/arch/mips/lib/libgcc.h b/arch/mips/lib/libgcc.h +index 05909d58e2fe..56ea0df60a44 100644 +--- a/arch/mips/lib/libgcc.h ++++ b/arch/mips/lib/libgcc.h +@@ -9,10 +9,18 @@ typedef int word_type __attribute__ ((mode (__word__))); + struct DWstruct { + int high, low; + }; ++ ++struct TWstruct { ++ long long high, low; ++}; + #elif defined(__LITTLE_ENDIAN) + struct DWstruct { + int low, high; + }; ++ ++struct TWstruct { ++ long long low, high; ++}; + #else + #error I feel sick. + #endif +@@ -22,4 +30,13 @@ typedef union { + long long ll; + } DWunion; + ++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) ++typedef int ti_type __attribute__((mode(TI))); ++ ++typedef union { ++ struct TWstruct s; ++ ti_type ti; ++} TWunion; ++#endif ++ + #endif /* __ASM_LIBGCC_H */ +diff --git a/arch/mips/lib/multi3.c b/arch/mips/lib/multi3.c +new file mode 100644 +index 000000000000..111ad475aa0c +--- /dev/null ++++ b/arch/mips/lib/multi3.c +@@ -0,0 +1,54 @@ ++// SPDX-License-Identifier: GPL-2.0 ++#include <linux/export.h> ++ ++#include "libgcc.h" ++ ++/* ++ * GCC 7 suboptimally generates __multi3 calls for mips64r6, so for that ++ * specific case only we'll implement it here. ++ * ++ * See https://gcc.gnu.org/bugzilla/show_bug.cgi?id=82981 ++ */ ++#if defined(CONFIG_64BIT) && defined(CONFIG_CPU_MIPSR6) && (__GNUC__ == 7) ++ ++/* multiply 64-bit values, low 64-bits returned */ ++static inline long long notrace dmulu(long long a, long long b) ++{ ++ long long res; ++ ++ asm ("dmulu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b)); ++ return res; ++} ++ ++/* multiply 64-bit unsigned values, high 64-bits of 128-bit result returned */ ++static inline long long notrace dmuhu(long long a, long long b) ++{ ++ long long res; ++ ++ asm ("dmuhu %0,%1,%2" : "=r" (res) : "r" (a), "r" (b)); ++ return res; ++} ++ ++/* multiply 128-bit values, low 128-bits returned */ ++ti_type notrace __multi3(ti_type a, ti_type b) ++{ ++ TWunion res, aa, bb; ++ ++ aa.ti = a; ++ bb.ti = b; ++ ++ /* ++ * a * b = (a.lo * b.lo) ++ * + 2^64 * (a.hi * b.lo + a.lo * b.hi) ++ * [+ 2^128 * (a.hi * b.hi)] ++ */ ++ res.s.low = dmulu(aa.s.low, bb.s.low); ++ res.s.high = dmuhu(aa.s.low, bb.s.low); ++ res.s.high += dmulu(aa.s.high, bb.s.low); ++ res.s.high += dmulu(aa.s.low, bb.s.high); ++ ++ return res.ti; ++} ++EXPORT_SYMBOL(__multi3); ++ ++#endif /* 64BIT && CPU_MIPSR6 && GCC7 */ +diff --git a/arch/sh/boards/mach-se/770x/setup.c b/arch/sh/boards/mach-se/770x/setup.c +index 658326f44df8..5e0267624d8d 100644 +--- a/arch/sh/boards/mach-se/770x/setup.c ++++ b/arch/sh/boards/mach-se/770x/setup.c +@@ -8,6 +8,7 @@ + */ + #include <linux/init.h> + #include <linux/platform_device.h> ++#include <linux/sh_eth.h> + #include <mach-se/mach/se.h> + #include <mach-se/mach/mrshpc.h> + #include <asm/machvec.h> +@@ -114,6 +115,11 @@ static struct platform_device heartbeat_device = { + #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\ + defined(CONFIG_CPU_SUBTYPE_SH7712) + /* SH771X Ethernet driver */ ++static struct sh_eth_plat_data sh_eth_plat = { ++ .phy = PHY_ID, ++ .phy_interface = PHY_INTERFACE_MODE_MII, ++}; ++ + static struct resource sh_eth0_resources[] = { + [0] = { + .start = SH_ETH0_BASE, +@@ -131,7 +137,7 @@ static struct platform_device sh_eth0_device = { + .name = "sh771x-ether", + .id = 0, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth0_resources), + .resource = sh_eth0_resources, +@@ -154,7 +160,7 @@ static struct platform_device sh_eth1_device = { + .name = "sh771x-ether", + .id = 1, + .dev = { +- .platform_data = PHY_ID, ++ .platform_data = &sh_eth_plat, + }, + .num_resources = ARRAY_SIZE(sh_eth1_resources), + .resource = sh_eth1_resources, +diff --git a/arch/x86/include/asm/asm.h b/arch/x86/include/asm/asm.h +index 7bb29a416b77..f35f246a26bf 100644 +--- a/arch/x86/include/asm/asm.h ++++ b/arch/x86/include/asm/asm.h +@@ -128,6 +128,7 @@ + #endif + + #ifndef __ASSEMBLY__ ++#ifndef __BPF__ + /* + * This output constraint should be used for any inline asm which has a "call" + * instruction. Otherwise the asm may be inserted before the frame pointer +@@ -137,5 +138,6 @@ + register unsigned long current_stack_pointer asm(_ASM_SP); + #define ASM_CALL_CONSTRAINT "+r" (current_stack_pointer) + #endif ++#endif + + #endif /* _ASM_X86_ASM_H */ +diff --git a/drivers/dma/fsl-edma.c b/drivers/dma/fsl-edma.c +index 6775f2c74e25..c7568869284e 100644 +--- a/drivers/dma/fsl-edma.c ++++ b/drivers/dma/fsl-edma.c +@@ -863,11 +863,11 @@ static void fsl_edma_irq_exit( + } + } + +-static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma) ++static void fsl_disable_clocks(struct fsl_edma_engine *fsl_edma, int nr_clocks) + { + int i; + +- for (i = 0; i < DMAMUX_NR; i++) ++ for (i = 0; i < nr_clocks; i++) + clk_disable_unprepare(fsl_edma->muxclk[i]); + } + +@@ -904,25 +904,25 @@ static int fsl_edma_probe(struct platform_device *pdev) + + res = platform_get_resource(pdev, IORESOURCE_MEM, 1 + i); + fsl_edma->muxbase[i] = devm_ioremap_resource(&pdev->dev, res); +- if (IS_ERR(fsl_edma->muxbase[i])) ++ if (IS_ERR(fsl_edma->muxbase[i])) { ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + return PTR_ERR(fsl_edma->muxbase[i]); ++ } + + sprintf(clkname, "dmamux%d", i); + fsl_edma->muxclk[i] = devm_clk_get(&pdev->dev, clkname); + if (IS_ERR(fsl_edma->muxclk[i])) { + dev_err(&pdev->dev, "Missing DMAMUX block clock.\n"); ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + return PTR_ERR(fsl_edma->muxclk[i]); + } + + ret = clk_prepare_enable(fsl_edma->muxclk[i]); +- if (ret) { +- /* disable only clks which were enabled on error */ +- for (; i >= 0; i--) +- clk_disable_unprepare(fsl_edma->muxclk[i]); +- +- dev_err(&pdev->dev, "DMAMUX clk block failed.\n"); +- return ret; +- } ++ if (ret) ++ /* on error: disable all previously enabled clks */ ++ fsl_disable_clocks(fsl_edma, i); + + } + +@@ -976,7 +976,7 @@ static int fsl_edma_probe(struct platform_device *pdev) + if (ret) { + dev_err(&pdev->dev, + "Can't register Freescale eDMA engine. (%d)\n", ret); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + return ret; + } + +@@ -985,7 +985,7 @@ static int fsl_edma_probe(struct platform_device *pdev) + dev_err(&pdev->dev, + "Can't register Freescale eDMA of_dma. (%d)\n", ret); + dma_async_device_unregister(&fsl_edma->dma_dev); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + return ret; + } + +@@ -1015,7 +1015,7 @@ static int fsl_edma_remove(struct platform_device *pdev) + fsl_edma_cleanup_vchan(&fsl_edma->dma_dev); + of_dma_controller_free(np); + dma_async_device_unregister(&fsl_edma->dma_dev); +- fsl_disable_clocks(fsl_edma); ++ fsl_disable_clocks(fsl_edma, DMAMUX_NR); + + return 0; + } +diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +index a4cb82495cee..245c946ea661 100644 +--- a/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c ++++ b/drivers/gpu/drm/nouveau/nvkm/subdev/pci/base.c +@@ -136,6 +136,13 @@ nvkm_pci_init(struct nvkm_subdev *subdev) + return ret; + + pci->irq = pdev->irq; ++ ++ /* Ensure MSI interrupts are armed, for the case where there are ++ * already interrupts pending (for whatever reason) at load time. ++ */ ++ if (pci->msi) ++ pci->func->msi_rearm(pci); ++ + return ret; + } + +diff --git a/drivers/gpu/drm/ttm/ttm_page_alloc.c b/drivers/gpu/drm/ttm/ttm_page_alloc.c +index ddd6badd0eee..c756b2b7f5dc 100644 +--- a/drivers/gpu/drm/ttm/ttm_page_alloc.c ++++ b/drivers/gpu/drm/ttm/ttm_page_alloc.c +@@ -818,6 +818,8 @@ int ttm_page_alloc_init(struct ttm_mem_global *glob, unsigned max_pages) + pr_info("Initializing pool allocator\n"); + + _manager = kzalloc(sizeof(*_manager), GFP_KERNEL); ++ if (!_manager) ++ return -ENOMEM; + + ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc"); + +diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c +index 809f4d4e93a0..340e037b3224 100644 +--- a/drivers/i2c/busses/i2c-designware-core.c ++++ b/drivers/i2c/busses/i2c-designware-core.c +@@ -507,7 +507,7 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev) + i2c_dw_disable_int(dev); + + /* Enable the adapter */ +- __i2c_dw_enable(dev, true); ++ __i2c_dw_enable_and_wait(dev, true); + + /* Clear and enable interrupts */ + dw_readl(dev, DW_IC_CLR_INTR); +diff --git a/drivers/infiniband/hw/mlx4/mr.c b/drivers/infiniband/hw/mlx4/mr.c +index 5d73989d9771..ae41623e0f13 100644 +--- a/drivers/infiniband/hw/mlx4/mr.c ++++ b/drivers/infiniband/hw/mlx4/mr.c +@@ -406,7 +406,6 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib_pd *pd, + goto err_free_mr; + + mr->max_pages = max_num_sg; +- + err = mlx4_mr_enable(dev->dev, &mr->mmr); + if (err) + goto err_free_pl; +@@ -417,6 +416,7 @@ struct ib_mr *mlx4_ib_alloc_mr(struct ib_pd *pd, + return &mr->ibmr; + + err_free_pl: ++ mr->ibmr.device = pd->device; + mlx4_free_priv_pages(mr); + err_free_mr: + (void) mlx4_mr_free(dev->dev, &mr->mmr); +diff --git a/drivers/infiniband/hw/mlx5/mr.c b/drivers/infiniband/hw/mlx5/mr.c +index 0a260a06876d..c7d5786d366b 100644 +--- a/drivers/infiniband/hw/mlx5/mr.c ++++ b/drivers/infiniband/hw/mlx5/mr.c +@@ -1648,6 +1648,7 @@ struct ib_mr *mlx5_ib_alloc_mr(struct ib_pd *pd, + MLX5_SET(mkc, mkc, access_mode, mr->access_mode); + MLX5_SET(mkc, mkc, umr_en, 1); + ++ mr->ibmr.device = pd->device; + err = mlx5_core_create_mkey(dev->mdev, &mr->mmkey, in, inlen); + if (err) + goto err_destroy_psv; +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c +index 183db0cd849e..e37e918cb935 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c +@@ -919,8 +919,8 @@ static int path_rec_start(struct net_device *dev, + return 0; + } + +-static void neigh_add_path(struct sk_buff *skb, u8 *daddr, +- struct net_device *dev) ++static struct ipoib_neigh *neigh_add_path(struct sk_buff *skb, u8 *daddr, ++ struct net_device *dev) + { + struct ipoib_dev_priv *priv = netdev_priv(dev); + struct ipoib_path *path; +@@ -933,7 +933,15 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + spin_unlock_irqrestore(&priv->lock, flags); + ++dev->stats.tx_dropped; + dev_kfree_skb_any(skb); +- return; ++ return NULL; ++ } ++ ++ /* To avoid race condition, make sure that the ++ * neigh will be added only once. ++ */ ++ if (unlikely(!list_empty(&neigh->list))) { ++ spin_unlock_irqrestore(&priv->lock, flags); ++ return neigh; + } + + path = __path_find(dev, daddr + 4); +@@ -971,7 +979,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_send(dev, skb, path->ah, IPOIB_QPN(daddr)); + ipoib_neigh_put(neigh); +- return; ++ return NULL; + } + } else { + neigh->ah = NULL; +@@ -988,7 +996,7 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_neigh_put(neigh); +- return; ++ return NULL; + + err_path: + ipoib_neigh_free(neigh); +@@ -998,6 +1006,8 @@ static void neigh_add_path(struct sk_buff *skb, u8 *daddr, + + spin_unlock_irqrestore(&priv->lock, flags); + ipoib_neigh_put(neigh); ++ ++ return NULL; + } + + static void unicast_arp_send(struct sk_buff *skb, struct net_device *dev, +@@ -1103,8 +1113,9 @@ static int ipoib_start_xmit(struct sk_buff *skb, struct net_device *dev) + case htons(ETH_P_TIPC): + neigh = ipoib_neigh_get(dev, phdr->hwaddr); + if (unlikely(!neigh)) { +- neigh_add_path(skb, phdr->hwaddr, dev); +- return NETDEV_TX_OK; ++ neigh = neigh_add_path(skb, phdr->hwaddr, dev); ++ if (likely(!neigh)) ++ return NETDEV_TX_OK; + } + break; + case htons(ETH_P_ARP): +diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +index fddff403d5d2..6b6826f3e446 100644 +--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c ++++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c +@@ -818,7 +818,10 @@ void ipoib_mcast_send(struct net_device *dev, u8 *daddr, struct sk_buff *skb) + spin_lock_irqsave(&priv->lock, flags); + if (!neigh) { + neigh = ipoib_neigh_alloc(daddr, dev); +- if (neigh) { ++ /* Make sure that the neigh will be added only ++ * once to mcast list. ++ */ ++ if (neigh && list_empty(&neigh->list)) { + kref_get(&mcast->ah->ref); + neigh->ah = mcast->ah; + list_add_tail(&neigh->list, &mcast->neigh_list); +diff --git a/drivers/leds/led-core.c b/drivers/leds/led-core.c +index 3bce44893021..d70d4a5273b8 100644 +--- a/drivers/leds/led-core.c ++++ b/drivers/leds/led-core.c +@@ -186,7 +186,7 @@ void led_blink_set(struct led_classdev *led_cdev, + unsigned long *delay_on, + unsigned long *delay_off) + { +- del_timer_sync(&led_cdev->blink_timer); ++ led_stop_software_blink(led_cdev); + + led_cdev->flags &= ~LED_BLINK_ONESHOT; + led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP; +diff --git a/drivers/mtd/nand/brcmnand/brcmnand.c b/drivers/mtd/nand/brcmnand/brcmnand.c +index 1a4a790054e4..ef9a6b22c9fa 100644 +--- a/drivers/mtd/nand/brcmnand/brcmnand.c ++++ b/drivers/mtd/nand/brcmnand/brcmnand.c +@@ -1763,7 +1763,7 @@ static int brcmnand_read(struct mtd_info *mtd, struct nand_chip *chip, + err = brcmstb_nand_verify_erased_page(mtd, chip, buf, + addr); + /* erased page bitflips corrected */ +- if (err > 0) ++ if (err >= 0) + return err; + } + +diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +index 6c062b8251d2..427039b77668 100644 +--- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c ++++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c +@@ -1059,9 +1059,6 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip, + return ret; + } + +- /* handle the block mark swapping */ +- block_mark_swapping(this, payload_virt, auxiliary_virt); +- + /* Loop over status bytes, accumulating ECC status. */ + status = auxiliary_virt + nfc_geo->auxiliary_status_offset; + +@@ -1150,6 +1147,9 @@ static int gpmi_ecc_read_page(struct mtd_info *mtd, struct nand_chip *chip, + max_bitflips = max_t(unsigned int, max_bitflips, *status); + } + ++ /* handle the block mark swapping */ ++ block_mark_swapping(this, buf, auxiliary_virt); ++ + if (oob_required) { + /* + * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob() +diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c +index 16f7cadda5c3..47f43bdecd51 100644 +--- a/drivers/net/can/flexcan.c ++++ b/drivers/net/can/flexcan.c +@@ -493,7 +493,7 @@ static int flexcan_start_xmit(struct sk_buff *skb, struct net_device *dev) + data = be32_to_cpup((__be32 *)&cf->data[0]); + flexcan_write(data, ®s->mb[FLEXCAN_TX_BUF_ID].data[0]); + } +- if (cf->can_dlc > 3) { ++ if (cf->can_dlc > 4) { + data = be32_to_cpup((__be32 *)&cf->data[4]); + flexcan_write(data, ®s->mb[FLEXCAN_TX_BUF_ID].data[1]); + } +diff --git a/drivers/net/ethernet/arc/emac_main.c b/drivers/net/ethernet/arc/emac_main.c +index be865b4dada2..aba4853e6b70 100644 +--- a/drivers/net/ethernet/arc/emac_main.c ++++ b/drivers/net/ethernet/arc/emac_main.c +@@ -210,39 +210,48 @@ static int arc_emac_rx(struct net_device *ndev, int budget) + continue; + } + +- pktlen = info & LEN_MASK; +- stats->rx_packets++; +- stats->rx_bytes += pktlen; +- skb = rx_buff->skb; +- skb_put(skb, pktlen); +- skb->dev = ndev; +- skb->protocol = eth_type_trans(skb, ndev); +- +- dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), +- dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); +- +- /* Prepare the BD for next cycle */ +- rx_buff->skb = netdev_alloc_skb_ip_align(ndev, +- EMAC_BUFFER_SIZE); +- if (unlikely(!rx_buff->skb)) { ++ /* Prepare the BD for next cycle. netif_receive_skb() ++ * only if new skb was allocated and mapped to avoid holes ++ * in the RX fifo. ++ */ ++ skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE); ++ if (unlikely(!skb)) { ++ if (net_ratelimit()) ++ netdev_err(ndev, "cannot allocate skb\n"); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; +- /* Because receive_skb is below, increment rx_dropped */ + stats->rx_dropped++; + continue; + } + +- /* receive_skb only if new skb was allocated to avoid holes */ +- netif_receive_skb(skb); +- +- addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data, ++ addr = dma_map_single(&ndev->dev, (void *)skb->data, + EMAC_BUFFER_SIZE, DMA_FROM_DEVICE); + if (dma_mapping_error(&ndev->dev, addr)) { + if (net_ratelimit()) +- netdev_err(ndev, "cannot dma map\n"); +- dev_kfree_skb(rx_buff->skb); ++ netdev_err(ndev, "cannot map dma buffer\n"); ++ dev_kfree_skb(skb); ++ /* Return ownership to EMAC */ ++ rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE); + stats->rx_errors++; ++ stats->rx_dropped++; + continue; + } ++ ++ /* unmap previosly mapped skb */ ++ dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr), ++ dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE); ++ ++ pktlen = info & LEN_MASK; ++ stats->rx_packets++; ++ stats->rx_bytes += pktlen; ++ skb_put(rx_buff->skb, pktlen); ++ rx_buff->skb->dev = ndev; ++ rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev); ++ ++ netif_receive_skb(rx_buff->skb); ++ ++ rx_buff->skb = skb; + dma_unmap_addr_set(rx_buff, addr, addr); + dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE); + +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 0a5ee1d973ac..596f88b693ef 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -3034,7 +3034,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link) + + del_timer_sync(&bp->timer); + +- if (IS_PF(bp)) { ++ if (IS_PF(bp) && !BP_NOMCP(bp)) { + /* Set ALWAYS_ALIVE bit in shmem */ + bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE; + bnx2x_drv_pulse(bp); +@@ -3120,7 +3120,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, int unload_mode, bool keep_link) + bp->cnic_loaded = false; + + /* Clear driver version indication in shmem */ +- if (IS_PF(bp)) ++ if (IS_PF(bp) && !BP_NOMCP(bp)) + bnx2x_update_mng_version(bp); + + /* Check if there are pending parity attentions. If there are - set +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +index 5d958b5bb8b1..554c4086b3c6 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c +@@ -9578,6 +9578,15 @@ static int bnx2x_init_shmem(struct bnx2x *bp) + + do { + bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR); ++ ++ /* If we read all 0xFFs, means we are in PCI error state and ++ * should bail out to avoid crashes on adapter's FW reads. ++ */ ++ if (bp->common.shmem_base == 0xFFFFFFFF) { ++ bp->flags |= NO_MCP_FLAG; ++ return -ENODEV; ++ } ++ + if (bp->common.shmem_base) { + val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]); + if (val & SHR_MEM_VALIDITY_MB) +@@ -14312,7 +14321,10 @@ static pci_ers_result_t bnx2x_io_slot_reset(struct pci_dev *pdev) + BNX2X_ERR("IO slot reset --> driver unload\n"); + + /* MCP should have been reset; Need to wait for validity */ +- bnx2x_init_shmem(bp); ++ if (bnx2x_init_shmem(bp)) { ++ rtnl_unlock(); ++ return PCI_ERS_RESULT_DISCONNECT; ++ } + + if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) { + u32 v; +diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +index 60e2af8678bd..393cce3bf2fc 100644 +--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c ++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_sriov.c +@@ -68,7 +68,7 @@ static int bnxt_vf_ndo_prep(struct bnxt *bp, int vf_id) + netdev_err(bp->dev, "vf ndo called though sriov is disabled\n"); + return -EINVAL; + } +- if (vf_id >= bp->pf.max_vfs) { ++ if (vf_id >= bp->pf.active_vfs) { + netdev_err(bp->dev, "Invalid VF id %d\n", vf_id); + return -EINVAL; + } +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c +index bb22d325e965..795a133fb074 100644 +--- a/drivers/net/ethernet/broadcom/tg3.c ++++ b/drivers/net/ethernet/broadcom/tg3.c +@@ -10049,6 +10049,16 @@ static int tg3_reset_hw(struct tg3 *tp, bool reset_phy) + + tw32(GRC_MODE, tp->grc_mode | val); + ++ /* On one of the AMD platform, MRRS is restricted to 4000 because of ++ * south bridge limitation. As a workaround, Driver is setting MRRS ++ * to 2048 instead of default 4096. ++ */ ++ if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL && ++ tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) { ++ val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK; ++ tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048); ++ } ++ + /* Setup the timer prescalar register. Clock is always 66Mhz. */ + val = tr32(GRC_MISC_CFG); + val &= ~0xff; +@@ -14228,7 +14238,8 @@ static int tg3_change_mtu(struct net_device *dev, int new_mtu) + */ + if (tg3_asic_rev(tp) == ASIC_REV_57766 || + tg3_asic_rev(tp) == ASIC_REV_5717 || +- tg3_asic_rev(tp) == ASIC_REV_5719) ++ tg3_asic_rev(tp) == ASIC_REV_5719 || ++ tg3_asic_rev(tp) == ASIC_REV_5720) + reset_phy = true; + + err = tg3_restart_hw(tp, reset_phy); +diff --git a/drivers/net/ethernet/broadcom/tg3.h b/drivers/net/ethernet/broadcom/tg3.h +index 3b5e98ecba00..6e51b793615c 100644 +--- a/drivers/net/ethernet/broadcom/tg3.h ++++ b/drivers/net/ethernet/broadcom/tg3.h +@@ -95,6 +95,7 @@ + #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR 0x0106 + #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT 0x0109 + #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT 0x010a ++#define TG3PCI_SUBDEVICE_ID_DELL_5762 0x07f0 + #define TG3PCI_SUBVENDOR_ID_COMPAQ PCI_VENDOR_ID_COMPAQ + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE 0x007c + #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2 0x009a +@@ -280,6 +281,9 @@ + #define TG3PCI_STD_RING_PROD_IDX 0x00000098 /* 64-bit */ + #define TG3PCI_RCV_RET_RING_CON_IDX 0x000000a0 /* 64-bit */ + /* 0xa8 --> 0xb8 unused */ ++#define TG3PCI_DEV_STATUS_CTRL 0x000000b4 ++#define MAX_READ_REQ_SIZE_2048 0x00004000 ++#define MAX_READ_REQ_MASK 0x00007000 + #define TG3PCI_DUAL_MAC_CTRL 0x000000b8 + #define DUAL_MAC_CTRL_CH_MASK 0x00000003 + #define DUAL_MAC_CTRL_ID 0x00000004 +diff --git a/drivers/net/ethernet/freescale/gianfar_ptp.c b/drivers/net/ethernet/freescale/gianfar_ptp.c +index 57798814160d..ec4b6997f24a 100644 +--- a/drivers/net/ethernet/freescale/gianfar_ptp.c ++++ b/drivers/net/ethernet/freescale/gianfar_ptp.c +@@ -314,11 +314,10 @@ static int ptp_gianfar_adjtime(struct ptp_clock_info *ptp, s64 delta) + now = tmr_cnt_read(etsects); + now += delta; + tmr_cnt_write(etsects, now); ++ set_fipers(etsects); + + spin_unlock_irqrestore(&etsects->lock, flags); + +- set_fipers(etsects); +- + return 0; + } + +diff --git a/drivers/net/ethernet/intel/e1000/e1000.h b/drivers/net/ethernet/intel/e1000/e1000.h +index d7bdea79e9fa..8fd2458060a0 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000.h ++++ b/drivers/net/ethernet/intel/e1000/e1000.h +@@ -331,7 +331,8 @@ struct e1000_adapter { + enum e1000_state_t { + __E1000_TESTING, + __E1000_RESETTING, +- __E1000_DOWN ++ __E1000_DOWN, ++ __E1000_DISABLED + }; + + #undef pr_fmt +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index f42129d09e2c..dd112aa5cebb 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -940,7 +940,7 @@ static int e1000_init_hw_struct(struct e1000_adapter *adapter, + static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + { + struct net_device *netdev; +- struct e1000_adapter *adapter; ++ struct e1000_adapter *adapter = NULL; + struct e1000_hw *hw; + + static int cards_found; +@@ -950,6 +950,7 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + u16 tmp = 0; + u16 eeprom_apme_mask = E1000_EEPROM_APME; + int bars, need_ioport; ++ bool disable_dev = false; + + /* do not allocate ioport bars when not needed */ + need_ioport = e1000_is_need_ioport(pdev); +@@ -1250,11 +1251,13 @@ static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent) + iounmap(hw->ce4100_gbe_mdio_base_virt); + iounmap(hw->hw_addr); + err_ioremap: ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + err_alloc_etherdev: + pci_release_selected_regions(pdev, bars); + err_pci_reg: +- pci_disable_device(pdev); ++ if (!adapter || disable_dev) ++ pci_disable_device(pdev); + return err; + } + +@@ -1272,6 +1275,7 @@ static void e1000_remove(struct pci_dev *pdev) + struct net_device *netdev = pci_get_drvdata(pdev); + struct e1000_adapter *adapter = netdev_priv(netdev); + struct e1000_hw *hw = &adapter->hw; ++ bool disable_dev; + + e1000_down_and_stop(adapter); + e1000_release_manageability(adapter); +@@ -1290,9 +1294,11 @@ static void e1000_remove(struct pci_dev *pdev) + iounmap(hw->flash_address); + pci_release_selected_regions(pdev, adapter->bars); + ++ disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags); + free_netdev(netdev); + +- pci_disable_device(pdev); ++ if (disable_dev) ++ pci_disable_device(pdev); + } + + /** +@@ -5166,7 +5172,8 @@ static int __e1000_shutdown(struct pci_dev *pdev, bool *enable_wake) + if (netif_running(netdev)) + e1000_free_irq(adapter); + +- pci_disable_device(pdev); ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + return 0; + } +@@ -5210,6 +5217,10 @@ static int e1000_resume(struct pci_dev *pdev) + pr_err("Cannot enable PCI device from suspend\n"); + return err; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); +@@ -5284,7 +5295,9 @@ static pci_ers_result_t e1000_io_error_detected(struct pci_dev *pdev, + + if (netif_running(netdev)) + e1000_down(adapter); +- pci_disable_device(pdev); ++ ++ if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags)) ++ pci_disable_device(pdev); + + /* Request a slot slot reset. */ + return PCI_ERS_RESULT_NEED_RESET; +@@ -5312,6 +5325,10 @@ static pci_ers_result_t e1000_io_slot_reset(struct pci_dev *pdev) + pr_err("Cannot re-enable PCI device after reset.\n"); + return PCI_ERS_RESULT_DISCONNECT; + } ++ ++ /* flush memory to make sure state is correct */ ++ smp_mb__before_atomic(); ++ clear_bit(__E1000_DISABLED, &adapter->flags); + pci_set_master(pdev); + + pci_enable_wake(pdev, PCI_D3hot, 0); +diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +index c5430394fac9..28b640fa2e35 100644 +--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c +@@ -2670,10 +2670,30 @@ bool __i40e_chk_linearize(struct sk_buff *skb) + /* Walk through fragments adding latest fragment, testing it, and + * then removing stale fragments from the sum. + */ +- stale = &skb_shinfo(skb)->frags[0]; +- for (;;) { ++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) { ++ int stale_size = skb_frag_size(stale); ++ + sum += skb_frag_size(frag++); + ++ /* The stale fragment may present us with a smaller ++ * descriptor than the actual fragment size. To account ++ * for that we need to remove all the data on the front and ++ * figure out what the remainder would be in the last ++ * descriptor associated with the fragment. ++ */ ++ if (stale_size > I40E_MAX_DATA_PER_TXD) { ++ int align_pad = -(stale->page_offset) & ++ (I40E_MAX_READ_REQ_SIZE - 1); ++ ++ sum -= align_pad; ++ stale_size -= align_pad; ++ ++ do { ++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ } while (stale_size > I40E_MAX_DATA_PER_TXD); ++ } ++ + /* if sum is negative we failed to make sufficient progress */ + if (sum < 0) + return true; +@@ -2681,7 +2701,7 @@ bool __i40e_chk_linearize(struct sk_buff *skb) + if (!nr_frags--) + break; + +- sum -= skb_frag_size(stale++); ++ sum -= stale_size; + } + + return false; +diff --git a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c +index c03800d1000a..90ebc5ac16fd 100644 +--- a/drivers/net/ethernet/intel/i40evf/i40e_txrx.c ++++ b/drivers/net/ethernet/intel/i40evf/i40e_txrx.c +@@ -1872,10 +1872,30 @@ bool __i40evf_chk_linearize(struct sk_buff *skb) + /* Walk through fragments adding latest fragment, testing it, and + * then removing stale fragments from the sum. + */ +- stale = &skb_shinfo(skb)->frags[0]; +- for (;;) { ++ for (stale = &skb_shinfo(skb)->frags[0];; stale++) { ++ int stale_size = skb_frag_size(stale); ++ + sum += skb_frag_size(frag++); + ++ /* The stale fragment may present us with a smaller ++ * descriptor than the actual fragment size. To account ++ * for that we need to remove all the data on the front and ++ * figure out what the remainder would be in the last ++ * descriptor associated with the fragment. ++ */ ++ if (stale_size > I40E_MAX_DATA_PER_TXD) { ++ int align_pad = -(stale->page_offset) & ++ (I40E_MAX_READ_REQ_SIZE - 1); ++ ++ sum -= align_pad; ++ stale_size -= align_pad; ++ ++ do { ++ sum -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ stale_size -= I40E_MAX_DATA_PER_TXD_ALIGNED; ++ } while (stale_size > I40E_MAX_DATA_PER_TXD); ++ } ++ + /* if sum is negative we failed to make sufficient progress */ + if (sum < 0) + return true; +@@ -1883,7 +1903,7 @@ bool __i40evf_chk_linearize(struct sk_buff *skb) + if (!nr_frags--) + break; + +- sum -= skb_frag_size(stale++); ++ sum -= stale_size; + } + + return false; +diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +index 4832223f1500..20de37a414fe 100644 +--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c ++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c +@@ -1842,11 +1842,12 @@ static int mtk_hw_init(struct mtk_eth *eth) + /* set GE2 TUNE */ + regmap_write(eth->pctl, GPIO_BIAS_CTRL, 0x0); + +- /* GE1, Force 1000M/FD, FC ON */ +- mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(0)); +- +- /* GE2, Force 1000M/FD, FC ON */ +- mtk_w32(eth, MAC_MCR_FIXED_LINK, MTK_MAC_MCR(1)); ++ /* Set linkdown as the default for each GMAC. Its own MCR would be set ++ * up with the more appropriate value when mtk_phy_link_adjust call is ++ * being invoked. ++ */ ++ for (i = 0; i < MTK_MAC_COUNT; i++) ++ mtk_w32(eth, 0, MTK_MAC_MCR(i)); + + /* Enable RX VLan Offloading */ + mtk_w32(eth, 1, MTK_CDMP_EG_CTRL); +diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +index 10d6059b2f26..f4074e25fb71 100644 +--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c ++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_hwtstamp.c +@@ -38,6 +38,7 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr, + { + u32 value = readl(ioaddr + PTP_TCR); + unsigned long data; ++ u32 reg_value; + + /* For GMAC3.x, 4.x versions, convert the ptp_clock to nano second + * formula = (1/ptp_clock) * 1000000000 +@@ -54,10 +55,11 @@ static u32 stmmac_config_sub_second_increment(void __iomem *ioaddr, + + data &= PTP_SSIR_SSINC_MASK; + ++ reg_value = data; + if (gmac4) +- data = data << GMAC4_PTP_SSIR_SSINC_SHIFT; ++ reg_value <<= GMAC4_PTP_SSIR_SSINC_SHIFT; + +- writel(data, ioaddr + PTP_SSIR); ++ writel(reg_value, ioaddr + PTP_SSIR); + + return data; + } +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 6d55049cd3dc..e8ad4d060da7 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1377,9 +1377,14 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev, + return 0; + + unregister_netdev: ++ /* macvlan_uninit would free the macvlan port */ + unregister_netdevice(dev); ++ return err; + destroy_macvlan_port: +- if (create) ++ /* the macvlan port may be freed by macvlan_uninit when fail to register. ++ * so we destroy the macvlan port only when it's valid. ++ */ ++ if (create && macvlan_port_get_rtnl(dev)) + macvlan_port_destroy(port->dev); + return err; + } +diff --git a/drivers/net/phy/mdio-sun4i.c b/drivers/net/phy/mdio-sun4i.c +index 135296508a7e..6425ce04d3f9 100644 +--- a/drivers/net/phy/mdio-sun4i.c ++++ b/drivers/net/phy/mdio-sun4i.c +@@ -118,8 +118,10 @@ static int sun4i_mdio_probe(struct platform_device *pdev) + + data->regulator = devm_regulator_get(&pdev->dev, "phy"); + if (IS_ERR(data->regulator)) { +- if (PTR_ERR(data->regulator) == -EPROBE_DEFER) +- return -EPROBE_DEFER; ++ if (PTR_ERR(data->regulator) == -EPROBE_DEFER) { ++ ret = -EPROBE_DEFER; ++ goto err_out_free_mdiobus; ++ } + + dev_info(&pdev->dev, "no regulator found\n"); + data->regulator = NULL; +diff --git a/drivers/net/phy/mdio-xgene.c b/drivers/net/phy/mdio-xgene.c +index 92af182951be..8eb077b677f6 100644 +--- a/drivers/net/phy/mdio-xgene.c ++++ b/drivers/net/phy/mdio-xgene.c +@@ -197,8 +197,11 @@ static int xgene_mdio_reset(struct xgene_mdio_pdata *pdata) + } + + ret = xgene_enet_ecc_init(pdata); +- if (ret) ++ if (ret) { ++ if (pdata->dev->of_node) ++ clk_disable_unprepare(pdata->clk); + return ret; ++ } + xgene_gmac_reset(pdata); + + return 0; +@@ -364,8 +367,10 @@ static int xgene_mdio_probe(struct platform_device *pdev) + return ret; + + mdio_bus = mdiobus_alloc(); +- if (!mdio_bus) +- return -ENOMEM; ++ if (!mdio_bus) { ++ ret = -ENOMEM; ++ goto out_clk; ++ } + + mdio_bus->name = "APM X-Gene MDIO bus"; + +@@ -394,7 +399,7 @@ static int xgene_mdio_probe(struct platform_device *pdev) + mdio_bus->phy_mask = ~0; + ret = mdiobus_register(mdio_bus); + if (ret) +- goto out; ++ goto out_mdiobus; + + acpi_walk_namespace(ACPI_TYPE_DEVICE, ACPI_HANDLE(dev), 1, + acpi_register_phy, NULL, mdio_bus, NULL); +@@ -402,16 +407,20 @@ static int xgene_mdio_probe(struct platform_device *pdev) + } + + if (ret) +- goto out; ++ goto out_mdiobus; + + pdata->mdio_bus = mdio_bus; + xgene_mdio_status = true; + + return 0; + +-out: ++out_mdiobus: + mdiobus_free(mdio_bus); + ++out_clk: ++ if (dev->of_node) ++ clk_disable_unprepare(pdata->clk); ++ + return ret; + } + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index e1e5e8438457..a30d6a6dbd95 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -805,6 +805,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, ++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */ + {QMI_FIXED_INTF(0x0846, 0x68a2, 8)}, + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */ + {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */ +@@ -914,6 +915,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_QUIRK_SET_DTR(0x1bc7, 0x1040, 2)}, /* Telit LE922A */ + {QMI_FIXED_INTF(0x1bc7, 0x1100, 3)}, /* Telit ME910 */ ++ {QMI_FIXED_INTF(0x1bc7, 0x1101, 3)}, /* Telit ME910 dual modem */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ + {QMI_FIXED_INTF(0x1c9e, 0x9b01, 3)}, /* XS Stick W100-2 from 4G Systems */ +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 4b462dc21c41..61e85eac706a 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -3154,7 +3154,7 @@ static int hwsim_get_radio_nl(struct sk_buff *msg, struct genl_info *info) + if (!net_eq(wiphy_net(data->hw->wiphy), genl_info_net(info))) + continue; + +- skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL); ++ skb = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC); + if (!skb) { + res = -ENOMEM; + goto out_err; +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 1a9dadf7b3cc..b09c81e882b4 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -1345,6 +1345,7 @@ static struct net_device *xennet_create_dev(struct xenbus_device *dev) + + netif_carrier_off(netdev); + ++ xenbus_switch_state(dev, XenbusStateInitialising); + return netdev; + + exit: +diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c +index 719ee5fb2626..ad9d82eb2aed 100644 +--- a/drivers/nvme/host/core.c ++++ b/drivers/nvme/host/core.c +@@ -1204,7 +1204,8 @@ static void nvme_set_queue_limits(struct nvme_ctrl *ctrl, + blk_queue_max_hw_sectors(q, ctrl->max_hw_sectors); + blk_queue_max_segments(q, min_t(u32, max_segments, USHRT_MAX)); + } +- if (ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) ++ if ((ctrl->quirks & NVME_QUIRK_STRIPE_SIZE) && ++ is_power_of_2(ctrl->max_hw_sectors)) + blk_queue_chunk_sectors(q, ctrl->max_hw_sectors); + blk_queue_virt_boundary(q, ctrl->page_size - 1); + if (ctrl->vwc & NVME_CTRL_VWC_PRESENT) +diff --git a/drivers/s390/block/dasd_3990_erp.c b/drivers/s390/block/dasd_3990_erp.c +index 8305ab688d57..a20dc2940d2d 100644 +--- a/drivers/s390/block/dasd_3990_erp.c ++++ b/drivers/s390/block/dasd_3990_erp.c +@@ -2755,6 +2755,16 @@ dasd_3990_erp_action(struct dasd_ccw_req * cqr) + erp = dasd_3990_erp_handle_match_erp(cqr, erp); + } + ++ ++ /* ++ * For path verification work we need to stick with the path that was ++ * originally chosen so that the per path configuration data is ++ * assigned correctly. ++ */ ++ if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) { ++ erp->lpm = cqr->lpm; ++ } ++ + if (device->features & DASD_FEATURE_ERPLOG) { + /* print current erp_chain */ + dev_err(&device->cdev->dev, +diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c +index 2bf96d33428a..0dd1984e381e 100644 +--- a/drivers/scsi/storvsc_drv.c ++++ b/drivers/scsi/storvsc_drv.c +@@ -915,10 +915,11 @@ static void storvsc_handle_error(struct vmscsi_request *vm_srb, + case TEST_UNIT_READY: + break; + default: +- set_host_byte(scmnd, DID_TARGET_FAILURE); ++ set_host_byte(scmnd, DID_ERROR); + } + break; + case SRB_STATUS_INVALID_LUN: ++ set_host_byte(scmnd, DID_NO_CONNECT); + do_work = true; + process_err_fn = storvsc_remove_lun; + break; +diff --git a/drivers/spi/spi-atmel.c b/drivers/spi/spi-atmel.c +index 8feac599e9ab..44be6b593b30 100644 +--- a/drivers/spi/spi-atmel.c ++++ b/drivers/spi/spi-atmel.c +@@ -1669,12 +1669,12 @@ static int atmel_spi_remove(struct platform_device *pdev) + pm_runtime_get_sync(&pdev->dev); + + /* reset the hardware and block queue progress */ +- spin_lock_irq(&as->lock); + if (as->use_dma) { + atmel_spi_stop_dma(as); + atmel_spi_release_dma(as); + } + ++ spin_lock_irq(&as->lock); + spi_writel(as, CR, SPI_BIT(SWRST)); + spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */ + spi_readl(as, SR); +diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c +index 79b8ab4c6663..910b5d40c6e9 100644 +--- a/drivers/xen/gntdev.c ++++ b/drivers/xen/gntdev.c +@@ -378,10 +378,8 @@ static int unmap_grant_pages(struct grant_map *map, int offset, int pages) + } + range = 0; + while (range < pages) { +- if (map->unmap_ops[offset+range].handle == -1) { +- range--; ++ if (map->unmap_ops[offset+range].handle == -1) + break; +- } + range++; + } + err = __unmap_grant_pages(map, offset, range); +@@ -1079,8 +1077,10 @@ static int gntdev_mmap(struct file *flip, struct vm_area_struct *vma) + out_unlock_put: + mutex_unlock(&priv->lock); + out_put_map: +- if (use_ptemod) ++ if (use_ptemod) { + map->vma = NULL; ++ unmap_grant_pages(map, 0, map->count); ++ } + gntdev_put_map(priv, map); + return err; + } +diff --git a/fs/f2fs/extent_cache.c b/fs/f2fs/extent_cache.c +index 7b32ce979fe1..63e519658d73 100644 +--- a/fs/f2fs/extent_cache.c ++++ b/fs/f2fs/extent_cache.c +@@ -177,7 +177,7 @@ static void __drop_largest_extent(struct inode *inode, + } + + /* return true, if inode page is changed */ +-bool f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext) ++static bool __f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext) + { + struct f2fs_sb_info *sbi = F2FS_I_SB(inode); + struct extent_tree *et; +@@ -215,6 +215,16 @@ bool f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext) + return false; + } + ++bool f2fs_init_extent_tree(struct inode *inode, struct f2fs_extent *i_ext) ++{ ++ bool ret = __f2fs_init_extent_tree(inode, i_ext); ++ ++ if (!F2FS_I(inode)->extent_tree) ++ set_inode_flag(inode, FI_NO_EXTENT); ++ ++ return ret; ++} ++ + static bool f2fs_lookup_extent_tree(struct inode *inode, pgoff_t pgofs, + struct extent_info *ei) + { +diff --git a/fs/super.c b/fs/super.c +index 1058bf3e8724..7e9beab77259 100644 +--- a/fs/super.c ++++ b/fs/super.c +@@ -519,7 +519,11 @@ struct super_block *sget_userns(struct file_system_type *type, + hlist_add_head(&s->s_instances, &type->fs_supers); + spin_unlock(&sb_lock); + get_filesystem(type); +- register_shrinker(&s->s_shrink); ++ err = register_shrinker(&s->s_shrink); ++ if (err) { ++ deactivate_locked_super(s); ++ s = ERR_PTR(err); ++ } + return s; + } + +diff --git a/fs/xfs/xfs_qm.c b/fs/xfs/xfs_qm.c +index 1fdd3face2d9..e3edaa547216 100644 +--- a/fs/xfs/xfs_qm.c ++++ b/fs/xfs/xfs_qm.c +@@ -47,7 +47,7 @@ + STATIC int xfs_qm_init_quotainos(xfs_mount_t *); + STATIC int xfs_qm_init_quotainfo(xfs_mount_t *); + +- ++STATIC void xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi); + STATIC void xfs_qm_dqfree_one(struct xfs_dquot *dqp); + /* + * We use the batch lookup interface to iterate over the dquots as it +@@ -694,9 +694,17 @@ xfs_qm_init_quotainfo( + qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan; + qinf->qi_shrinker.seeks = DEFAULT_SEEKS; + qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE; +- register_shrinker(&qinf->qi_shrinker); ++ ++ error = register_shrinker(&qinf->qi_shrinker); ++ if (error) ++ goto out_free_inos; ++ + return 0; + ++out_free_inos: ++ mutex_destroy(&qinf->qi_quotaofflock); ++ mutex_destroy(&qinf->qi_tree_lock); ++ xfs_qm_destroy_quotainos(qinf); + out_free_lru: + list_lru_destroy(&qinf->qi_lru); + out_free_qinf: +@@ -705,7 +713,6 @@ xfs_qm_init_quotainfo( + return error; + } + +- + /* + * Gets called when unmounting a filesystem or when all quotas get + * turned off. +@@ -722,19 +729,8 @@ xfs_qm_destroy_quotainfo( + + unregister_shrinker(&qi->qi_shrinker); + list_lru_destroy(&qi->qi_lru); +- +- if (qi->qi_uquotaip) { +- IRELE(qi->qi_uquotaip); +- qi->qi_uquotaip = NULL; /* paranoia */ +- } +- if (qi->qi_gquotaip) { +- IRELE(qi->qi_gquotaip); +- qi->qi_gquotaip = NULL; +- } +- if (qi->qi_pquotaip) { +- IRELE(qi->qi_pquotaip); +- qi->qi_pquotaip = NULL; +- } ++ xfs_qm_destroy_quotainos(qi); ++ mutex_destroy(&qi->qi_tree_lock); + mutex_destroy(&qi->qi_quotaofflock); + kmem_free(qi); + mp->m_quotainfo = NULL; +@@ -1619,6 +1615,24 @@ xfs_qm_init_quotainos( + return error; + } + ++STATIC void ++xfs_qm_destroy_quotainos( ++ xfs_quotainfo_t *qi) ++{ ++ if (qi->qi_uquotaip) { ++ IRELE(qi->qi_uquotaip); ++ qi->qi_uquotaip = NULL; /* paranoia */ ++ } ++ if (qi->qi_gquotaip) { ++ IRELE(qi->qi_gquotaip); ++ qi->qi_gquotaip = NULL; ++ } ++ if (qi->qi_pquotaip) { ++ IRELE(qi->qi_pquotaip); ++ qi->qi_pquotaip = NULL; ++ } ++} ++ + STATIC void + xfs_qm_dqfree_one( + struct xfs_dquot *dqp) +diff --git a/include/uapi/linux/libc-compat.h b/include/uapi/linux/libc-compat.h +index 44b8a6bd5fe1..774cb2db1b89 100644 +--- a/include/uapi/linux/libc-compat.h ++++ b/include/uapi/linux/libc-compat.h +@@ -167,46 +167,99 @@ + + /* If we did not see any headers from any supported C libraries, + * or we are being included in the kernel, then define everything +- * that we need. */ ++ * that we need. Check for previous __UAPI_* definitions to give ++ * unsupported C libraries a way to opt out of any kernel definition. */ + #else /* !defined(__GLIBC__) */ + + /* Definitions for if.h */ ++#ifndef __UAPI_DEF_IF_IFCONF + #define __UAPI_DEF_IF_IFCONF 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFMAP + #define __UAPI_DEF_IF_IFMAP 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFNAMSIZ + #define __UAPI_DEF_IF_IFNAMSIZ 1 ++#endif ++#ifndef __UAPI_DEF_IF_IFREQ + #define __UAPI_DEF_IF_IFREQ 1 ++#endif + /* Everything up to IFF_DYNAMIC, matches net/if.h until glibc 2.23 */ ++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS + #define __UAPI_DEF_IF_NET_DEVICE_FLAGS 1 ++#endif + /* For the future if glibc adds IFF_LOWER_UP, IFF_DORMANT and IFF_ECHO */ ++#ifndef __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO + #define __UAPI_DEF_IF_NET_DEVICE_FLAGS_LOWER_UP_DORMANT_ECHO 1 ++#endif + + /* Definitions for in.h */ ++#ifndef __UAPI_DEF_IN_ADDR + #define __UAPI_DEF_IN_ADDR 1 ++#endif ++#ifndef __UAPI_DEF_IN_IPPROTO + #define __UAPI_DEF_IN_IPPROTO 1 ++#endif ++#ifndef __UAPI_DEF_IN_PKTINFO + #define __UAPI_DEF_IN_PKTINFO 1 ++#endif ++#ifndef __UAPI_DEF_IP_MREQ + #define __UAPI_DEF_IP_MREQ 1 ++#endif ++#ifndef __UAPI_DEF_SOCKADDR_IN + #define __UAPI_DEF_SOCKADDR_IN 1 ++#endif ++#ifndef __UAPI_DEF_IN_CLASS + #define __UAPI_DEF_IN_CLASS 1 ++#endif + + /* Definitions for in6.h */ ++#ifndef __UAPI_DEF_IN6_ADDR + #define __UAPI_DEF_IN6_ADDR 1 ++#endif ++#ifndef __UAPI_DEF_IN6_ADDR_ALT + #define __UAPI_DEF_IN6_ADDR_ALT 1 ++#endif ++#ifndef __UAPI_DEF_SOCKADDR_IN6 + #define __UAPI_DEF_SOCKADDR_IN6 1 ++#endif ++#ifndef __UAPI_DEF_IPV6_MREQ + #define __UAPI_DEF_IPV6_MREQ 1 ++#endif ++#ifndef __UAPI_DEF_IPPROTO_V6 + #define __UAPI_DEF_IPPROTO_V6 1 ++#endif ++#ifndef __UAPI_DEF_IPV6_OPTIONS + #define __UAPI_DEF_IPV6_OPTIONS 1 ++#endif ++#ifndef __UAPI_DEF_IN6_PKTINFO + #define __UAPI_DEF_IN6_PKTINFO 1 ++#endif ++#ifndef __UAPI_DEF_IP6_MTUINFO + #define __UAPI_DEF_IP6_MTUINFO 1 ++#endif + + /* Definitions for ipx.h */ ++#ifndef __UAPI_DEF_SOCKADDR_IPX + #define __UAPI_DEF_SOCKADDR_IPX 1 ++#endif ++#ifndef __UAPI_DEF_IPX_ROUTE_DEFINITION + #define __UAPI_DEF_IPX_ROUTE_DEFINITION 1 ++#endif ++#ifndef __UAPI_DEF_IPX_INTERFACE_DEFINITION + #define __UAPI_DEF_IPX_INTERFACE_DEFINITION 1 ++#endif ++#ifndef __UAPI_DEF_IPX_CONFIG_DATA + #define __UAPI_DEF_IPX_CONFIG_DATA 1 ++#endif ++#ifndef __UAPI_DEF_IPX_ROUTE_DEF + #define __UAPI_DEF_IPX_ROUTE_DEF 1 ++#endif + + /* Definitions for xattr.h */ ++#ifndef __UAPI_DEF_XATTR + #define __UAPI_DEF_XATTR 1 ++#endif + + #endif /* __GLIBC__ */ + +diff --git a/kernel/irq/debug.h b/kernel/irq/debug.h +index e75e29e4434a..3514d955af94 100644 +--- a/kernel/irq/debug.h ++++ b/kernel/irq/debug.h +@@ -11,6 +11,11 @@ + + static inline void print_irq_desc(unsigned int irq, struct irq_desc *desc) + { ++ static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5); ++ ++ if (!__ratelimit(&ratelimit)) ++ return; ++ + printk("irq %d, desc: %p, depth: %d, count: %d, unhandled: %d\n", + irq, desc, desc->depth, desc->irq_count, desc->irqs_unhandled); + printk("->handle_irq(): %p, ", desc->handle_irq); +diff --git a/kernel/time/hrtimer.c b/kernel/time/hrtimer.c +index 54fd2fed36e9..c93729661be0 100644 +--- a/kernel/time/hrtimer.c ++++ b/kernel/time/hrtimer.c +@@ -1134,7 +1134,12 @@ static void __hrtimer_init(struct hrtimer *timer, clockid_t clock_id, + + cpu_base = raw_cpu_ptr(&hrtimer_bases); + +- if (clock_id == CLOCK_REALTIME && mode != HRTIMER_MODE_ABS) ++ /* ++ * POSIX magic: Relative CLOCK_REALTIME timers are not affected by ++ * clock modifications, so they needs to become CLOCK_MONOTONIC to ++ * ensure POSIX compliance. ++ */ ++ if (clock_id == CLOCK_REALTIME && mode & HRTIMER_MODE_REL) + clock_id = CLOCK_MONOTONIC; + + base = hrtimer_clockid_to_base(clock_id); +diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h +index 93336502af08..0f64fcee4ccd 100644 +--- a/lib/mpi/longlong.h ++++ b/lib/mpi/longlong.h +@@ -671,7 +671,23 @@ do { \ + ************** MIPS/64 ************** + ***************************************/ + #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64 +-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4) ++#if defined(__mips_isa_rev) && __mips_isa_rev >= 6 ++/* ++ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C ++ * code below, so we special case MIPS64r6 until the compiler can do better. ++ */ ++#define umul_ppmm(w1, w0, u, v) \ ++do { \ ++ __asm__ ("dmulu %0,%1,%2" \ ++ : "=d" ((UDItype)(w0)) \ ++ : "d" ((UDItype)(u)), \ ++ "d" ((UDItype)(v))); \ ++ __asm__ ("dmuhu %0,%1,%2" \ ++ : "=d" ((UDItype)(w1)) \ ++ : "d" ((UDItype)(u)), \ ++ "d" ((UDItype)(v))); \ ++} while (0) ++#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4) + #define umul_ppmm(w1, w0, u, v) \ + do { \ + typedef unsigned int __ll_UTItype __attribute__((mode(TI))); \ +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 131e6aa954bc..a2fcf7bdb597 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -1127,8 +1127,13 @@ int ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev, __u8 dsfield, + max_headroom += 8; + mtu -= 8; + } +- if (mtu < IPV6_MIN_MTU) +- mtu = IPV6_MIN_MTU; ++ if (skb->protocol == htons(ETH_P_IPV6)) { ++ if (mtu < IPV6_MIN_MTU) ++ mtu = IPV6_MIN_MTU; ++ } else if (mtu < 576) { ++ mtu = 576; ++ } ++ + if (skb_dst(skb) && !t->parms.collect_md) + skb_dst(skb)->ops->update_pmtu(skb_dst(skb), NULL, skb, mtu); + if (skb->len - t->tun_hlen - eth_hlen > mtu && !skb_is_gso(skb)) { +diff --git a/net/ipv6/route.c b/net/ipv6/route.c +index 6e8bacb0b458..a8f80bd20c55 100644 +--- a/net/ipv6/route.c ++++ b/net/ipv6/route.c +@@ -1651,6 +1651,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev, + } + + rt->dst.flags |= DST_HOST; ++ rt->dst.input = ip6_input; + rt->dst.output = ip6_output; + atomic_set(&rt->dst.__refcnt, 1); + rt->rt6i_gateway = fl6->daddr; +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 439e597fd374..404284a14d75 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3611,6 +3611,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + } + return true; + case NL80211_IFTYPE_MESH_POINT: ++ if (ether_addr_equal(sdata->vif.addr, hdr->addr2)) ++ return false; + if (multicast) + return true; + return ether_addr_equal(sdata->vif.addr, hdr->addr1); +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index fd5b9d573b38..8cdd6bbe2efa 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -4765,7 +4765,7 @@ static int sctp_getsockopt_autoclose(struct sock *sk, int len, char __user *optv + len = sizeof(int); + if (put_user(len, optlen)) + return -EFAULT; +- if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int))) ++ if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len)) + return -EFAULT; + return 0; + } +@@ -5342,6 +5342,9 @@ static int sctp_getsockopt_local_addrs(struct sock *sk, int len, + err = -EFAULT; + goto out; + } ++ /* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too, ++ * but we can't change it anymore. ++ */ + if (put_user(bytes_copied, optlen)) + err = -EFAULT; + out: +@@ -5778,7 +5781,7 @@ static int sctp_getsockopt_maxseg(struct sock *sk, int len, + params.assoc_id = 0; + } else if (len >= sizeof(struct sctp_assoc_value)) { + len = sizeof(struct sctp_assoc_value); +- if (copy_from_user(¶ms, optval, sizeof(params))) ++ if (copy_from_user(¶ms, optval, len)) + return -EFAULT; + } else + return -EINVAL; +@@ -5947,7 +5950,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, + + if (len < sizeof(struct sctp_authkeyid)) + return -EINVAL; +- if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) ++ ++ len = sizeof(struct sctp_authkeyid); ++ if (copy_from_user(&val, optval, len)) + return -EFAULT; + + asoc = sctp_id2assoc(sk, val.scact_assoc_id); +@@ -5959,7 +5964,6 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len, + else + val.scact_keynumber = ep->active_key_id; + +- len = sizeof(struct sctp_authkeyid); + if (put_user(len, optlen)) + return -EFAULT; + if (copy_to_user(optval, &val, len)) +@@ -5985,7 +5989,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len, + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; +@@ -6030,7 +6034,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len, + if (len < sizeof(struct sctp_authchunks)) + return -EINVAL; + +- if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks))) ++ if (copy_from_user(&val, optval, sizeof(val))) + return -EFAULT; + + to = p->gauth_chunks; +diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c +index 52d74760fb68..ca68db207965 100644 +--- a/net/tipc/bearer.c ++++ b/net/tipc/bearer.c +@@ -322,6 +322,7 @@ static int tipc_enable_bearer(struct net *net, const char *name, + if (res) { + pr_warn("Bearer <%s> rejected, enable failure (%d)\n", + name, -res); ++ kfree(b); + return -EINVAL; + } + +@@ -345,8 +346,10 @@ static int tipc_enable_bearer(struct net *net, const char *name, + if (skb) + tipc_bearer_xmit_skb(net, bearer_id, skb, &b->bcast_addr); + +- if (tipc_mon_create(net, bearer_id)) ++ if (tipc_mon_create(net, bearer_id)) { ++ bearer_disable(net, b); + return -ENOMEM; ++ } + + pr_info("Enabled bearer <%s>, discovery domain %s, priority %u\n", + name, +diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c +index 9e109bb1a207..0fcfb3916dcf 100644 +--- a/net/tipc/monitor.c ++++ b/net/tipc/monitor.c +@@ -633,9 +633,13 @@ void tipc_mon_delete(struct net *net, int bearer_id) + { + struct tipc_net *tn = tipc_net(net); + struct tipc_monitor *mon = tipc_monitor(net, bearer_id); +- struct tipc_peer *self = get_self(net, bearer_id); ++ struct tipc_peer *self; + struct tipc_peer *peer, *tmp; + ++ if (!mon) ++ return; ++ ++ self = get_self(net, bearer_id); + write_lock_bh(&mon->lock); + tn->monitors[bearer_id] = NULL; + list_for_each_entry_safe(peer, tmp, &self->list, list) { +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c +index 91722e97cdd5..a89061d59c74 100644 +--- a/net/wireless/nl80211.c ++++ b/net/wireless/nl80211.c +@@ -10777,7 +10777,8 @@ static int nl80211_nan_add_func(struct sk_buff *skb, + break; + case NL80211_NAN_FUNC_FOLLOW_UP: + if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] || +- !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) { ++ !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] || ++ !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) { + err = -EINVAL; + goto out; + } +diff --git a/sound/soc/codecs/nau8825.c b/sound/soc/codecs/nau8825.c +index f9f2737c4ad2..a4871c4adcb0 100644 +--- a/sound/soc/codecs/nau8825.c ++++ b/sound/soc/codecs/nau8825.c +@@ -882,6 +882,7 @@ static int nau8825_adc_event(struct snd_soc_dapm_widget *w, + + switch (event) { + case SND_SOC_DAPM_POST_PMU: ++ msleep(125); + regmap_update_bits(nau8825->regmap, NAU8825_REG_ENA_CTRL, + NAU8825_ENABLE_ADC, NAU8825_ENABLE_ADC); + break;
