commit: b95093691e9aa7e1e3bd3dbd27b2bd2cb875542c Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Dec 8 12:08:10 2020 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Dec 8 12:08:10 2020 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b9509369
Linux patch 5.9.13 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1012_linux-5.9.13.patch | 1245 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1249 insertions(+) diff --git a/0000_README b/0000_README index 22fb04b..9f59546 100644 --- a/0000_README +++ b/0000_README @@ -91,6 +91,10 @@ Patch: 1011_linux-5.9.12.patch From: http://www.kernel.org Desc: Linux 5.9.12 +Patch: 1012_linux-5.9.13.patch +From: http://www.kernel.org +Desc: Linux 5.9.13 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1012_linux-5.9.13.patch b/1012_linux-5.9.13.patch new file mode 100644 index 0000000..bc10343 --- /dev/null +++ b/1012_linux-5.9.13.patch @@ -0,0 +1,1245 @@ +diff --git a/Documentation/devicetree/bindings/net/can/tcan4x5x.txt b/Documentation/devicetree/bindings/net/can/tcan4x5x.txt +index 3613c2c8f75d7..0968b40aef1e8 100644 +--- a/Documentation/devicetree/bindings/net/can/tcan4x5x.txt ++++ b/Documentation/devicetree/bindings/net/can/tcan4x5x.txt +@@ -33,7 +33,7 @@ tcan4x5x: tcan4x5x@0 { + spi-max-frequency = <10000000>; + bosch,mram-cfg = <0x0 0 0 32 0 0 1 1>; + interrupt-parent = <&gpio1>; +- interrupts = <14 GPIO_ACTIVE_LOW>; ++ interrupts = <14 IRQ_TYPE_LEVEL_LOW>; + device-state-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>; + device-wake-gpios = <&gpio1 15 GPIO_ACTIVE_HIGH>; + reset-gpios = <&gpio1 27 GPIO_ACTIVE_HIGH>; +diff --git a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt +index cfaf889989187..9e4dc510a40aa 100644 +--- a/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt ++++ b/Documentation/devicetree/bindings/net/nfc/nxp-nci.txt +@@ -25,7 +25,7 @@ Example (for ARM-based BeagleBone with NPC100 NFC controller on I2C2): + clock-frequency = <100000>; + + interrupt-parent = <&gpio1>; +- interrupts = <29 GPIO_ACTIVE_HIGH>; ++ interrupts = <29 IRQ_TYPE_LEVEL_HIGH>; + + enable-gpios = <&gpio0 30 GPIO_ACTIVE_HIGH>; + firmware-gpios = <&gpio0 31 GPIO_ACTIVE_HIGH>; +diff --git a/Documentation/devicetree/bindings/net/nfc/pn544.txt b/Documentation/devicetree/bindings/net/nfc/pn544.txt +index 92f399ec22b87..2bd82562ce8e9 100644 +--- a/Documentation/devicetree/bindings/net/nfc/pn544.txt ++++ b/Documentation/devicetree/bindings/net/nfc/pn544.txt +@@ -25,7 +25,7 @@ Example (for ARM-based BeagleBone with PN544 on I2C2): + clock-frequency = <400000>; + + interrupt-parent = <&gpio1>; +- interrupts = <17 GPIO_ACTIVE_HIGH>; ++ interrupts = <17 IRQ_TYPE_LEVEL_HIGH>; + + enable-gpios = <&gpio3 21 GPIO_ACTIVE_HIGH>; + firmware-gpios = <&gpio3 19 GPIO_ACTIVE_HIGH>; +diff --git a/Makefile b/Makefile +index 1dd088b0ac993..b98b54758b203 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 5 + PATCHLEVEL = 9 +-SUBLEVEL = 12 ++SUBLEVEL = 13 + EXTRAVERSION = + NAME = Kleptomaniac Octopus + +diff --git a/drivers/crypto/chelsio/chtls/chtls_cm.c b/drivers/crypto/chelsio/chtls/chtls_cm.c +index 96d5616534963..50e3a70e5a290 100644 +--- a/drivers/crypto/chelsio/chtls/chtls_cm.c ++++ b/drivers/crypto/chelsio/chtls/chtls_cm.c +@@ -1206,6 +1206,7 @@ static struct sock *chtls_recv_sock(struct sock *lsk, + sk_setup_caps(newsk, dst); + ctx = tls_get_ctx(lsk); + newsk->sk_destruct = ctx->sk_destruct; ++ newsk->sk_prot_creator = lsk->sk_prot_creator; + csk->sk = newsk; + csk->passive_reap_next = oreq; + csk->tx_chan = cxgb4_port_chan(ndev); +diff --git a/drivers/crypto/chelsio/chtls/chtls_hw.c b/drivers/crypto/chelsio/chtls/chtls_hw.c +index 62c829023da56..a4fb463af22ac 100644 +--- a/drivers/crypto/chelsio/chtls/chtls_hw.c ++++ b/drivers/crypto/chelsio/chtls/chtls_hw.c +@@ -391,6 +391,7 @@ int chtls_setkey(struct chtls_sock *csk, u32 keylen, + csk->wr_unacked += DIV_ROUND_UP(len, 16); + enqueue_wr(csk, skb); + cxgb4_ofld_send(csk->egress_dev, skb); ++ skb = NULL; + + chtls_set_scmd(csk); + /* Clear quiesce for Rx key */ +diff --git a/drivers/gpu/drm/i915/gt/intel_mocs.c b/drivers/gpu/drm/i915/gt/intel_mocs.c +index b8f56e62158e2..313e51e7d4f76 100644 +--- a/drivers/gpu/drm/i915/gt/intel_mocs.c ++++ b/drivers/gpu/drm/i915/gt/intel_mocs.c +@@ -243,8 +243,9 @@ static const struct drm_i915_mocs_entry tgl_mocs_table[] = { + * only, __init_mocs_table() take care to program unused index with + * this entry. + */ +- MOCS_ENTRY(1, LE_3_WB | LE_TC_1_LLC | LE_LRUM(3), +- L3_3_WB), ++ MOCS_ENTRY(I915_MOCS_PTE, ++ LE_0_PAGETABLE | LE_TC_0_PAGETABLE, ++ L3_1_UC), + GEN11_MOCS_ENTRIES, + + /* Implicitly enable L1 - HDC:L1 + L3 + LLC */ +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index c77cdb3b62b5b..8c73377ac82ca 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -241,6 +241,7 @@ static const struct xpad_device { + { 0x1038, 0x1430, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, + { 0x1038, 0x1431, "SteelSeries Stratus Duo", 0, XTYPE_XBOX360 }, + { 0x11c9, 0x55f0, "Nacon GC-100XF", 0, XTYPE_XBOX360 }, ++ { 0x1209, 0x2882, "Ardwiino Controller", 0, XTYPE_XBOX360 }, + { 0x12ab, 0x0004, "Honey Bee Xbox360 dancepad", MAP_DPAD_TO_BUTTONS, XTYPE_XBOX360 }, + { 0x12ab, 0x0301, "PDP AFTERGLOW AX.1", 0, XTYPE_XBOX360 }, + { 0x12ab, 0x0303, "Mortal Kombat Klassic FightStick", MAP_TRIGGERS_TO_BUTTONS, XTYPE_XBOX360 }, +@@ -418,6 +419,7 @@ static const struct usb_device_id xpad_table[] = { + XPAD_XBOXONE_VENDOR(0x0f0d), /* Hori Controllers */ + XPAD_XBOX360_VENDOR(0x1038), /* SteelSeries Controllers */ + XPAD_XBOX360_VENDOR(0x11c9), /* Nacon GC100XF */ ++ XPAD_XBOX360_VENDOR(0x1209), /* Ardwiino Controllers */ + XPAD_XBOX360_VENDOR(0x12ab), /* X-Box 360 dance pads */ + XPAD_XBOX360_VENDOR(0x1430), /* RedOctane X-Box 360 controllers */ + XPAD_XBOX360_VENDOR(0x146b), /* BigBen Interactive Controllers */ +diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h +index a4c9b9652560a..7ecb65176c1aa 100644 +--- a/drivers/input/serio/i8042-x86ia64io.h ++++ b/drivers/input/serio/i8042-x86ia64io.h +@@ -219,6 +219,10 @@ static const struct dmi_system_id __initconst i8042_dmi_noloop_table[] = { + DMI_MATCH(DMI_SYS_VENDOR, "PEGATRON CORPORATION"), + DMI_MATCH(DMI_PRODUCT_NAME, "C15B"), + }, ++ .matches = { ++ DMI_MATCH(DMI_SYS_VENDOR, "ByteSpeed LLC"), ++ DMI_MATCH(DMI_PRODUCT_NAME, "ByteSpeed Laptop C15B"), ++ }, + }, + { } + }; +diff --git a/drivers/input/touchscreen/atmel_mxt_ts.c b/drivers/input/touchscreen/atmel_mxt_ts.c +index 98f17fa3a8926..b6f75367a284a 100644 +--- a/drivers/input/touchscreen/atmel_mxt_ts.c ++++ b/drivers/input/touchscreen/atmel_mxt_ts.c +@@ -2183,11 +2183,11 @@ static int mxt_initialize(struct mxt_data *data) + msleep(MXT_FW_RESET_TIME); + } + +- error = mxt_acquire_irq(data); ++ error = mxt_check_retrigen(data); + if (error) + return error; + +- error = mxt_check_retrigen(data); ++ error = mxt_acquire_irq(data); + if (error) + return error; + +diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c +index 6dabbf1502c71..c0e96bf5dd1a0 100644 +--- a/drivers/net/ethernet/chelsio/cxgb3/sge.c ++++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c +@@ -3176,6 +3176,7 @@ int t3_sge_alloc_qset(struct adapter *adapter, unsigned int id, int nports, + GFP_KERNEL | __GFP_COMP); + if (!avail) { + CH_ALERT(adapter, "free list queue 0 initialization failed\n"); ++ ret = -ENOMEM; + goto err; + } + if (avail < q->fl[0].size) +diff --git a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +index 39ad01bf5ee70..f19695763c605 100644 +--- a/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c ++++ b/drivers/net/ethernet/freescale/dpaa/dpaa_eth.c +@@ -2120,6 +2120,15 @@ workaround: + skb_copy_header(new_skb, skb); + new_skb->dev = skb->dev; + ++ /* Copy relevant timestamp info from the old skb to the new */ ++ if (priv->tx_tstamp) { ++ skb_shinfo(new_skb)->tx_flags = skb_shinfo(skb)->tx_flags; ++ skb_shinfo(new_skb)->hwtstamps = skb_shinfo(skb)->hwtstamps; ++ skb_shinfo(new_skb)->tskey = skb_shinfo(skb)->tskey; ++ if (skb->sk) ++ skb_set_owner_w(new_skb, skb->sk); ++ } ++ + /* We move the headroom when we align it so we have to reset the + * network and transport header offsets relative to the new data + * pointer. The checksum offload relies on these offsets. +@@ -2127,7 +2136,6 @@ workaround: + skb_set_network_header(new_skb, skb_network_offset(skb)); + skb_set_transport_header(new_skb, skb_transport_offset(skb)); + +- /* TODO: does timestamping need the result in the old skb? */ + dev_kfree_skb(skb); + *s = new_skb; + +diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c +index 81ec233926acb..3654be5772c85 100644 +--- a/drivers/net/ethernet/ibm/ibmvnic.c ++++ b/drivers/net/ethernet/ibm/ibmvnic.c +@@ -2409,6 +2409,12 @@ restart_poll: + + if (!pending_scrq(adapter, adapter->rx_scrq[scrq_num])) + break; ++ /* The queue entry at the current index is peeked at above ++ * to determine that there is a valid descriptor awaiting ++ * processing. We want to be sure that the current slot ++ * holds a valid descriptor before reading its contents. ++ */ ++ dma_rmb(); + next = ibmvnic_next_scrq(adapter, adapter->rx_scrq[scrq_num]); + rx_buff = + (struct ibmvnic_rx_buff *)be64_to_cpu(next-> +@@ -3107,13 +3113,18 @@ restart_loop: + unsigned int pool = scrq->pool_index; + int num_entries = 0; + ++ /* The queue entry at the current index is peeked at above ++ * to determine that there is a valid descriptor awaiting ++ * processing. We want to be sure that the current slot ++ * holds a valid descriptor before reading its contents. ++ */ ++ dma_rmb(); ++ + next = ibmvnic_next_scrq(adapter, scrq); + for (i = 0; i < next->tx_comp.num_comps; i++) { +- if (next->tx_comp.rcs[i]) { ++ if (next->tx_comp.rcs[i]) + dev_err(dev, "tx error %x\n", + next->tx_comp.rcs[i]); +- continue; +- } + index = be32_to_cpu(next->tx_comp.correlators[i]); + if (index & IBMVNIC_TSO_POOL_MASK) { + tx_pool = &adapter->tso_pool[pool]; +@@ -3507,6 +3518,11 @@ static union sub_crq *ibmvnic_next_scrq(struct ibmvnic_adapter *adapter, + } + spin_unlock_irqrestore(&scrq->lock, flags); + ++ /* Ensure that the entire buffer descriptor has been ++ * loaded before reading its contents ++ */ ++ dma_rmb(); ++ + return entry; + } + +diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +index 6e140d1b8967c..c0bee2f3224e1 100644 +--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c ++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c +@@ -4249,6 +4249,7 @@ static int mvpp2_open(struct net_device *dev) + if (!valid) { + netdev_err(port->dev, + "invalid configuration: no dt or link IRQ"); ++ err = -ENOENT; + goto err_free_irq; + } + +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c +index 4cdd9eac647d8..bbdf51cb0b7e0 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_accel/fs_tcp.c +@@ -44,6 +44,7 @@ static void accel_fs_tcp_set_ipv4_flow(struct mlx5_flow_spec *spec, struct sock + outer_headers.dst_ipv4_dst_ipv6.ipv4_layout.ipv4); + } + ++#if IS_ENABLED(CONFIG_IPV6) + static void accel_fs_tcp_set_ipv6_flow(struct mlx5_flow_spec *spec, struct sock *sk) + { + MLX5_SET_TO_ONES(fte_match_param, spec->match_criteria, outer_headers.ip_protocol); +@@ -63,6 +64,7 @@ static void accel_fs_tcp_set_ipv6_flow(struct mlx5_flow_spec *spec, struct sock + outer_headers.dst_ipv4_dst_ipv6.ipv6_layout.ipv6), + 0xff, 16); + } ++#endif + + void mlx5e_accel_fs_del_sk(struct mlx5_flow_handle *rule) + { +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +index c0e18f2ade996..3080514ad801b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/pagealloc.c +@@ -422,6 +422,24 @@ static void release_all_pages(struct mlx5_core_dev *dev, u32 func_id, + npages, ec_function, func_id); + } + ++static u32 fwp_fill_manage_pages_out(struct fw_page *fwp, u32 *out, u32 index, ++ u32 npages) ++{ ++ u32 pages_set = 0; ++ unsigned int n; ++ ++ for_each_clear_bit(n, &fwp->bitmask, MLX5_NUM_4K_IN_PAGE) { ++ MLX5_ARRAY_SET64(manage_pages_out, out, pas, index + pages_set, ++ fwp->addr + (n * MLX5_ADAPTER_PAGE_SIZE)); ++ pages_set++; ++ ++ if (!--npages) ++ break; ++ } ++ ++ return pages_set; ++} ++ + static int reclaim_pages_cmd(struct mlx5_core_dev *dev, + u32 *in, int in_size, u32 *out, int out_size) + { +@@ -448,8 +466,7 @@ static int reclaim_pages_cmd(struct mlx5_core_dev *dev, + fwp = rb_entry(p, struct fw_page, rb_node); + p = rb_next(p); + +- MLX5_ARRAY_SET64(manage_pages_out, out, pas, i, fwp->addr); +- i++; ++ i += fwp_fill_manage_pages_out(fwp, out, i, npages - i); + } + + MLX5_SET(manage_pages_out, out, output_num_entries, i); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c +index 6bd34b2930071..51bbd88ff021c 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_cmd.c +@@ -92,6 +92,7 @@ int mlx5dr_cmd_query_device(struct mlx5_core_dev *mdev, + caps->eswitch_manager = MLX5_CAP_GEN(mdev, eswitch_manager); + caps->gvmi = MLX5_CAP_GEN(mdev, vhca_id); + caps->flex_protocols = MLX5_CAP_GEN(mdev, flex_parser_protocols); ++ caps->sw_format_ver = MLX5_CAP_GEN(mdev, steering_format_version); + + if (mlx5dr_matcher_supp_flex_parser_icmp_v4(caps)) { + caps->flex_parser_id_icmp_dw0 = MLX5_CAP_GEN(mdev, flex_parser_id_icmp_dw0); +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c +index 890767a2a7cb2..aa2c2d6c44e6b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_domain.c +@@ -223,6 +223,11 @@ static int dr_domain_caps_init(struct mlx5_core_dev *mdev, + if (ret) + return ret; + ++ if (dmn->info.caps.sw_format_ver != MLX5_STEERING_FORMAT_CONNECTX_5) { ++ mlx5dr_err(dmn, "SW steering is not supported on this device\n"); ++ return -EOPNOTSUPP; ++ } ++ + ret = dr_domain_query_fdb_caps(mdev, dmn); + if (ret) + return ret; +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +index 0883956c58c0a..23e705a0abff9 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h ++++ b/drivers/net/ethernet/mellanox/mlx5/core/steering/dr_types.h +@@ -621,6 +621,7 @@ struct mlx5dr_cmd_caps { + u8 max_ft_level; + u16 roce_min_src_udp; + u8 num_esw_ports; ++ u8 sw_format_ver; + bool eswitch_manager; + bool rx_sw_owner; + bool tx_sw_owner; +diff --git a/drivers/net/ethernet/pasemi/pasemi_mac.c b/drivers/net/ethernet/pasemi/pasemi_mac.c +index be6660128b556..040a15a828b41 100644 +--- a/drivers/net/ethernet/pasemi/pasemi_mac.c ++++ b/drivers/net/ethernet/pasemi/pasemi_mac.c +@@ -1078,16 +1078,20 @@ static int pasemi_mac_open(struct net_device *dev) + + mac->tx = pasemi_mac_setup_tx_resources(dev); + +- if (!mac->tx) ++ if (!mac->tx) { ++ ret = -ENOMEM; + goto out_tx_ring; ++ } + + /* We might already have allocated rings in case mtu was changed + * before interface was brought up. + */ + if (dev->mtu > 1500 && !mac->num_cs) { + pasemi_mac_setup_csrings(mac); +- if (!mac->num_cs) ++ if (!mac->num_cs) { ++ ret = -ENOMEM; + goto out_tx_ring; ++ } + } + + /* Zero out rmon counters */ +diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c +index 67c86ebfa7da2..3ee8a1a6d0840 100644 +--- a/drivers/net/geneve.c ++++ b/drivers/net/geneve.c +@@ -258,11 +258,21 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, + skb_dst_set(skb, &tun_dst->dst); + + /* Ignore packet loops (and multicast echo) */ +- if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr)) { +- geneve->dev->stats.rx_errors++; +- goto drop; +- } ++ if (ether_addr_equal(eth_hdr(skb)->h_source, geneve->dev->dev_addr)) ++ goto rx_error; + ++ switch (skb_protocol(skb, true)) { ++ case htons(ETH_P_IP): ++ if (pskb_may_pull(skb, sizeof(struct iphdr))) ++ goto rx_error; ++ break; ++ case htons(ETH_P_IPV6): ++ if (pskb_may_pull(skb, sizeof(struct ipv6hdr))) ++ goto rx_error; ++ break; ++ default: ++ goto rx_error; ++ } + oiph = skb_network_header(skb); + skb_reset_network_header(skb); + +@@ -303,6 +313,8 @@ static void geneve_rx(struct geneve_dev *geneve, struct geneve_sock *gs, + u64_stats_update_end(&stats->syncp); + } + return; ++rx_error: ++ geneve->dev->stats.rx_errors++; + drop: + /* Consume bad packet */ + kfree_skb(skb); +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 7959b5c2d11f1..b5f47d37ea1be 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -1979,12 +1979,15 @@ static ssize_t tun_chr_write_iter(struct kiocb *iocb, struct iov_iter *from) + struct tun_file *tfile = file->private_data; + struct tun_struct *tun = tun_get(tfile); + ssize_t result; ++ int noblock = 0; + + if (!tun) + return -EBADFD; + +- result = tun_get_user(tun, tfile, NULL, from, +- file->f_flags & O_NONBLOCK, false); ++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT)) ++ noblock = 1; ++ ++ result = tun_get_user(tun, tfile, NULL, from, noblock, false); + + tun_put(tun); + return result; +@@ -2203,10 +2206,15 @@ static ssize_t tun_chr_read_iter(struct kiocb *iocb, struct iov_iter *to) + struct tun_file *tfile = file->private_data; + struct tun_struct *tun = tun_get(tfile); + ssize_t len = iov_iter_count(to), ret; ++ int noblock = 0; + + if (!tun) + return -EBADFD; +- ret = tun_do_read(tun, tfile, to, file->f_flags & O_NONBLOCK, NULL); ++ ++ if ((file->f_flags & O_NONBLOCK) || (iocb->ki_flags & IOCB_NOWAIT)) ++ noblock = 1; ++ ++ ret = tun_do_read(tun, tfile, to, noblock, NULL); + ret = min_t(ssize_t, ret, len); + if (ret > 0) + iocb->ki_pos = ret; +diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c +index b09b45382faf5..207e59e74935a 100644 +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -59,7 +59,7 @@ + #define IPHETH_USBINTF_SUBCLASS 253 + #define IPHETH_USBINTF_PROTO 1 + +-#define IPHETH_BUF_SIZE 1516 ++#define IPHETH_BUF_SIZE 1514 + #define IPHETH_IP_ALIGN 2 /* padding at front of URB */ + #define IPHETH_TX_TIMEOUT (5 * HZ) + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index b9fefe27e3e89..b248d9e694254 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -3881,8 +3881,10 @@ static int __vxlan_dev_create(struct net *net, struct net_device *dev, + + if (dst->remote_ifindex) { + remote_dev = __dev_get_by_index(net, dst->remote_ifindex); +- if (!remote_dev) ++ if (!remote_dev) { ++ err = -ENODEV; + goto errout; ++ } + + err = netdev_upper_dev_link(remote_dev, dev, extack); + if (err) +diff --git a/include/linux/mlx5/mlx5_ifc.h b/include/linux/mlx5/mlx5_ifc.h +index de1ffb4804d6b..3822fcc43aba5 100644 +--- a/include/linux/mlx5/mlx5_ifc.h ++++ b/include/linux/mlx5/mlx5_ifc.h +@@ -1222,6 +1222,11 @@ enum mlx5_fc_bulk_alloc_bitmask { + + #define MLX5_FC_BULK_NUM_FCS(fc_enum) (MLX5_FC_BULK_SIZE_FACTOR * (fc_enum)) + ++enum { ++ MLX5_STEERING_FORMAT_CONNECTX_5 = 0, ++ MLX5_STEERING_FORMAT_CONNECTX_6DX = 1, ++}; ++ + struct mlx5_ifc_cmd_hca_cap_bits { + u8 reserved_at_0[0x30]; + u8 vhca_id[0x10]; +@@ -1519,7 +1524,9 @@ struct mlx5_ifc_cmd_hca_cap_bits { + + u8 general_obj_types[0x40]; + +- u8 reserved_at_440[0x20]; ++ u8 reserved_at_440[0x4]; ++ u8 steering_format_version[0x4]; ++ u8 create_qp_start_hint[0x18]; + + u8 reserved_at_460[0x3]; + u8 log_max_uctx[0x5]; +diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h +index 18dec08439f96..8fbdfae2c8c02 100644 +--- a/include/linux/netdevice.h ++++ b/include/linux/netdevice.h +@@ -3103,6 +3103,11 @@ static inline bool dev_validate_header(const struct net_device *dev, + return false; + } + ++static inline bool dev_has_header(const struct net_device *dev) ++{ ++ return dev->header_ops && dev->header_ops->create; ++} ++ + typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, + int len, int size); + int register_gifconf(unsigned int family, gifconf_func_t *gifconf); +diff --git a/include/net/inet_ecn.h b/include/net/inet_ecn.h +index e1eaf17802889..563457fec557e 100644 +--- a/include/net/inet_ecn.h ++++ b/include/net/inet_ecn.h +@@ -107,7 +107,7 @@ static inline int IP_ECN_set_ect1(struct iphdr *iph) + if ((iph->tos & INET_ECN_MASK) != INET_ECN_ECT_0) + return 0; + +- check += (__force u16)htons(0x100); ++ check += (__force u16)htons(0x1); + + iph->check = (__force __sum16)(check + (check>=0xFFFF)); + iph->tos ^= INET_ECN_MASK; +diff --git a/include/net/tls.h b/include/net/tls.h +index a12146139c71f..246337b861dc1 100644 +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -199,6 +199,12 @@ enum tls_context_flags { + * to be atomic. + */ + TLS_TX_SYNC_SCHED = 1, ++ /* tls_dev_del was called for the RX side, device state was released, ++ * but tls_ctx->netdev might still be kept, because TX-side driver ++ * resources might not be released yet. Used to prevent the second ++ * tls_dev_del call in tls_device_down if it happens simultaneously. ++ */ ++ TLS_RX_DEV_CLOSED = 2, + }; + + struct cipher_context { +diff --git a/include/uapi/linux/openvswitch.h b/include/uapi/linux/openvswitch.h +index 8300cc29dec8a..8d16744edc313 100644 +--- a/include/uapi/linux/openvswitch.h ++++ b/include/uapi/linux/openvswitch.h +@@ -1058,4 +1058,6 @@ enum ovs_dec_ttl_attr { + __OVS_DEC_TTL_ATTR_MAX + }; + ++#define OVS_DEC_TTL_ATTR_MAX (__OVS_DEC_TTL_ATTR_MAX - 1) ++ + #endif /* _LINUX_OPENVSWITCH_H */ +diff --git a/include/uapi/linux/stat.h b/include/uapi/linux/stat.h +index 82cc58fe93681..1500a0f58041a 100644 +--- a/include/uapi/linux/stat.h ++++ b/include/uapi/linux/stat.h +@@ -171,9 +171,12 @@ struct statx { + * be of use to ordinary userspace programs such as GUIs or ls rather than + * specialised tools. + * +- * Note that the flags marked [I] correspond to generic FS_IOC_FLAGS ++ * Note that the flags marked [I] correspond to the FS_IOC_SETFLAGS flags + * semantically. Where possible, the numerical value is picked to correspond +- * also. ++ * also. Note that the DAX attribute indicates that the file is in the CPU ++ * direct access state. It does not correspond to the per-inode flag that ++ * some filesystems support. ++ * + */ + #define STATX_ATTR_COMPRESSED 0x00000004 /* [I] File is compressed by the fs */ + #define STATX_ATTR_IMMUTABLE 0x00000010 /* [I] File is marked immutable */ +@@ -183,7 +186,7 @@ struct statx { + #define STATX_ATTR_AUTOMOUNT 0x00001000 /* Dir: Automount trigger */ + #define STATX_ATTR_MOUNT_ROOT 0x00002000 /* Root of a mount */ + #define STATX_ATTR_VERITY 0x00100000 /* [I] Verity protected file */ +-#define STATX_ATTR_DAX 0x00002000 /* [I] File is DAX */ ++#define STATX_ATTR_DAX 0x00200000 /* File is currently in DAX state */ + + + #endif /* _UAPI_LINUX_STAT_H */ +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 1c76a0faf3cd1..f15df890bfd45 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -3516,7 +3516,7 @@ __find_next_entry(struct trace_iterator *iter, int *ent_cpu, + } + + #define STATIC_TEMP_BUF_SIZE 128 +-static char static_temp_buf[STATIC_TEMP_BUF_SIZE]; ++static char static_temp_buf[STATIC_TEMP_BUF_SIZE] __aligned(4); + + /* Find the next real entry, without updating the iterator itself */ + struct trace_entry *trace_find_next_entry(struct trace_iterator *iter, +diff --git a/kernel/trace/trace_hwlat.c b/kernel/trace/trace_hwlat.c +index 17873e5d03531..075f60035b4c7 100644 +--- a/kernel/trace/trace_hwlat.c ++++ b/kernel/trace/trace_hwlat.c +@@ -368,7 +368,7 @@ static int start_kthread(struct trace_array *tr) + struct task_struct *kthread; + int next_cpu; + +- if (WARN_ON(hwlat_kthread)) ++ if (hwlat_kthread) + return 0; + + /* Just pick the first CPU on first iteration */ +diff --git a/net/bridge/br_netfilter_hooks.c b/net/bridge/br_netfilter_hooks.c +index 04c3f9a82650d..8edfb98ae1d58 100644 +--- a/net/bridge/br_netfilter_hooks.c ++++ b/net/bridge/br_netfilter_hooks.c +@@ -735,6 +735,11 @@ static int br_nf_dev_queue_xmit(struct net *net, struct sock *sk, struct sk_buff + mtu_reserved = nf_bridge_mtu_reduction(skb); + mtu = skb->dev->mtu; + ++ if (nf_bridge->pkt_otherhost) { ++ skb->pkt_type = PACKET_OTHERHOST; ++ nf_bridge->pkt_otherhost = false; ++ } ++ + if (nf_bridge->frag_max_size && nf_bridge->frag_max_size < mtu) + mtu = nf_bridge->frag_max_size; + +@@ -835,8 +840,6 @@ static unsigned int br_nf_post_routing(void *priv, + else + return NF_ACCEPT; + +- /* We assume any code from br_dev_queue_push_xmit onwards doesn't care +- * about the value of skb->pkt_type. */ + if (skb->pkt_type == PACKET_OTHERHOST) { + skb->pkt_type = PACKET_HOST; + nf_bridge->pkt_otherhost = true; +diff --git a/net/core/devlink.c b/net/core/devlink.c +index 55dd9546b183f..333148d4e8f70 100644 +--- a/net/core/devlink.c ++++ b/net/core/devlink.c +@@ -616,6 +616,8 @@ static int devlink_nl_port_fill(struct sk_buff *msg, struct devlink *devlink, + if (nla_put_u32(msg, DEVLINK_ATTR_PORT_INDEX, devlink_port->index)) + goto nla_put_failure; + ++ /* Hold rtnl lock while accessing port's netdev attributes. */ ++ rtnl_lock(); + spin_lock_bh(&devlink_port->type_lock); + if (nla_put_u16(msg, DEVLINK_ATTR_PORT_TYPE, devlink_port->type)) + goto nla_put_failure_type_locked; +@@ -624,9 +626,10 @@ static int devlink_nl_port_fill(struct sk_buff *msg, struct devlink *devlink, + devlink_port->desired_type)) + goto nla_put_failure_type_locked; + if (devlink_port->type == DEVLINK_PORT_TYPE_ETH) { ++ struct net *net = devlink_net(devlink_port->devlink); + struct net_device *netdev = devlink_port->type_dev; + +- if (netdev && ++ if (netdev && net_eq(net, dev_net(netdev)) && + (nla_put_u32(msg, DEVLINK_ATTR_PORT_NETDEV_IFINDEX, + netdev->ifindex) || + nla_put_string(msg, DEVLINK_ATTR_PORT_NETDEV_NAME, +@@ -642,6 +645,7 @@ static int devlink_nl_port_fill(struct sk_buff *msg, struct devlink *devlink, + goto nla_put_failure_type_locked; + } + spin_unlock_bh(&devlink_port->type_lock); ++ rtnl_unlock(); + if (devlink_nl_port_attrs_put(msg, devlink_port)) + goto nla_put_failure; + if (devlink_nl_port_function_attrs_put(msg, devlink_port, extack)) +@@ -652,6 +656,7 @@ static int devlink_nl_port_fill(struct sk_buff *msg, struct devlink *devlink, + + nla_put_failure_type_locked: + spin_unlock_bh(&devlink_port->type_lock); ++ rtnl_unlock(); + nla_put_failure: + genlmsg_cancel(msg, hdr); + return -EMSGSIZE; +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 2b48cb0cc684d..092c3265d7205 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -4555,7 +4555,7 @@ struct sk_buff *sock_dequeue_err_skb(struct sock *sk) + if (skb && (skb_next = skb_peek(q))) { + icmp_next = is_icmp_err_skb(skb_next); + if (icmp_next) +- sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_origin; ++ sk->sk_err = SKB_EXT_ERR(skb_next)->ee.ee_errno; + } + spin_unlock_irqrestore(&q->lock, flags); + +@@ -5725,6 +5725,9 @@ int skb_mpls_dec_ttl(struct sk_buff *skb) + if (unlikely(!eth_p_mpls(skb->protocol))) + return -EINVAL; + ++ if (!pskb_may_pull(skb, skb_network_offset(skb) + MPLS_HLEN)) ++ return -ENOMEM; ++ + lse = be32_to_cpu(mpls_hdr(skb)->label_stack_entry); + ttl = (lse & MPLS_LS_TTL_MASK) >> MPLS_LS_TTL_SHIFT; + if (!--ttl) +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 9bd30fd4de4b4..64243e0acbdb1 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -3221,7 +3221,7 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + + fl4.daddr = dst; + fl4.saddr = src; +- fl4.flowi4_tos = rtm->rtm_tos; ++ fl4.flowi4_tos = rtm->rtm_tos & IPTOS_RT_MASK; + fl4.flowi4_oif = tb[RTA_OIF] ? nla_get_u32(tb[RTA_OIF]) : 0; + fl4.flowi4_mark = mark; + fl4.flowi4_uid = uid; +@@ -3245,8 +3245,9 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh, + fl4.flowi4_iif = iif; /* for rt_fill_info */ + skb->dev = dev; + skb->mark = mark; +- err = ip_route_input_rcu(skb, dst, src, rtm->rtm_tos, +- dev, &res); ++ err = ip_route_input_rcu(skb, dst, src, ++ rtm->rtm_tos & IPTOS_RT_MASK, dev, ++ &res); + + rt = skb_rtable(skb); + if (err == 0 && rt->dst.error) +diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c +index 62878cf26d9cc..8f2ec6227338b 100644 +--- a/net/ipv4/tcp_cong.c ++++ b/net/ipv4/tcp_cong.c +@@ -197,6 +197,11 @@ static void tcp_reinit_congestion_control(struct sock *sk, + icsk->icsk_ca_setsockopt = 1; + memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv)); + ++ if (ca->flags & TCP_CONG_NEEDS_ECN) ++ INET_ECN_xmit(sk); ++ else ++ INET_ECN_dontxmit(sk); ++ + if (!((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) + tcp_init_congestion_control(sk); + } +diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c +index 642fc6ac13d22..8a22486cf2702 100644 +--- a/net/ipv6/addrlabel.c ++++ b/net/ipv6/addrlabel.c +@@ -306,7 +306,9 @@ static int ip6addrlbl_del(struct net *net, + /* add default label */ + static int __net_init ip6addrlbl_net_init(struct net *net) + { +- int err = 0; ++ struct ip6addrlbl_entry *p = NULL; ++ struct hlist_node *n; ++ int err; + int i; + + ADDRLABEL(KERN_DEBUG "%s\n", __func__); +@@ -315,14 +317,20 @@ static int __net_init ip6addrlbl_net_init(struct net *net) + INIT_HLIST_HEAD(&net->ipv6.ip6addrlbl_table.head); + + for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) { +- int ret = ip6addrlbl_add(net, +- ip6addrlbl_init_table[i].prefix, +- ip6addrlbl_init_table[i].prefixlen, +- 0, +- ip6addrlbl_init_table[i].label, 0); +- /* XXX: should we free all rules when we catch an error? */ +- if (ret && (!err || err != -ENOMEM)) +- err = ret; ++ err = ip6addrlbl_add(net, ++ ip6addrlbl_init_table[i].prefix, ++ ip6addrlbl_init_table[i].prefixlen, ++ 0, ++ ip6addrlbl_init_table[i].label, 0); ++ if (err) ++ goto err_ip6addrlbl_add; ++ } ++ return 0; ++ ++err_ip6addrlbl_add: ++ hlist_for_each_entry_safe(p, n, &net->ipv6.ip6addrlbl_table.head, list) { ++ hlist_del_rcu(&p->list); ++ kfree_rcu(p, rcu); + } + return err; + } +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 3a57fb9ce0494..64fd3fea12ff2 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -1122,8 +1122,13 @@ static void ip6gre_tnl_link_config_route(struct ip6_tnl *t, int set_mtu, + return; + + if (rt->dst.dev) { +- dev->needed_headroom = rt->dst.dev->hard_header_len + +- t_hlen; ++ unsigned short dst_len = rt->dst.dev->hard_header_len + ++ t_hlen; ++ ++ if (t->dev->header_ops) ++ dev->hard_header_len = dst_len; ++ else ++ dev->needed_headroom = dst_len; + + if (set_mtu) { + dev->mtu = rt->dst.dev->mtu - t_hlen; +@@ -1148,7 +1153,12 @@ static int ip6gre_calc_hlen(struct ip6_tnl *tunnel) + tunnel->hlen = tunnel->tun_hlen + tunnel->encap_hlen; + + t_hlen = tunnel->hlen + sizeof(struct ipv6hdr); +- tunnel->dev->needed_headroom = LL_MAX_HEADER + t_hlen; ++ ++ if (tunnel->dev->header_ops) ++ tunnel->dev->hard_header_len = LL_MAX_HEADER + t_hlen; ++ else ++ tunnel->dev->needed_headroom = LL_MAX_HEADER + t_hlen; ++ + return t_hlen; + } + +diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c +index 6214d083279bc..1a3b193e02057 100644 +--- a/net/iucv/af_iucv.c ++++ b/net/iucv/af_iucv.c +@@ -1645,7 +1645,7 @@ static int iucv_callback_connreq(struct iucv_path *path, + } + + /* Create the new socket */ +- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0); ++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0); + if (!nsk) { + err = pr_iucv->path_sever(path, user_data); + iucv_path_free(path); +@@ -1851,7 +1851,7 @@ static int afiucv_hs_callback_syn(struct sock *sk, struct sk_buff *skb) + goto out; + } + +- nsk = iucv_sock_alloc(NULL, sk->sk_type, GFP_ATOMIC, 0); ++ nsk = iucv_sock_alloc(NULL, sk->sk_protocol, GFP_ATOMIC, 0); + bh_lock_sock(sk); + if ((sk->sk_state != IUCV_LISTEN) || + sk_acceptq_is_full(sk) || +diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c +index 559f5bbd96229..364b9d4cb487c 100644 +--- a/net/mptcp/subflow.c ++++ b/net/mptcp/subflow.c +@@ -542,9 +542,8 @@ create_msk: + fallback = true; + } else if (subflow_req->mp_join) { + mptcp_get_options(skb, &mp_opt); +- if (!mp_opt.mp_join || +- !mptcp_can_accept_new_subflow(subflow_req->msk) || +- !subflow_hmac_valid(req, &mp_opt)) { ++ if (!mp_opt.mp_join || !subflow_hmac_valid(req, &mp_opt) || ++ !mptcp_can_accept_new_subflow(subflow_req->msk)) { + SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC); + fallback = true; + } +diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c +index 2611657f40cac..90bebf685aaa3 100644 +--- a/net/openvswitch/actions.c ++++ b/net/openvswitch/actions.c +@@ -200,6 +200,9 @@ static int set_mpls(struct sk_buff *skb, struct sw_flow_key *flow_key, + __be32 lse; + int err; + ++ if (!pskb_may_pull(skb, skb_network_offset(skb) + MPLS_HLEN)) ++ return -ENOMEM; ++ + stack = mpls_hdr(skb); + lse = OVS_MASKED(stack->label_stack_entry, *mpls_lse, *mask); + err = skb_mpls_update_lse(skb, lse); +@@ -970,14 +973,13 @@ static int dec_ttl_exception_handler(struct datapath *dp, struct sk_buff *skb, + { + /* The first action is always 'OVS_DEC_TTL_ATTR_ARG'. */ + struct nlattr *dec_ttl_arg = nla_data(attr); +- int rem = nla_len(attr); + + if (nla_len(dec_ttl_arg)) { +- struct nlattr *actions = nla_next(dec_ttl_arg, &rem); ++ struct nlattr *actions = nla_data(dec_ttl_arg); + + if (actions) +- return clone_execute(dp, skb, key, 0, actions, rem, +- last, false); ++ return clone_execute(dp, skb, key, 0, nla_data(actions), ++ nla_len(actions), last, false); + } + consume_skb(skb); + return 0; +diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c +index 9d3e50c4d29f9..ec0689ddc6356 100644 +--- a/net/openvswitch/flow_netlink.c ++++ b/net/openvswitch/flow_netlink.c +@@ -2503,28 +2503,42 @@ static int validate_and_copy_dec_ttl(struct net *net, + __be16 eth_type, __be16 vlan_tci, + u32 mpls_label_count, bool log) + { +- int start, err; +- u32 nested = true; ++ const struct nlattr *attrs[OVS_DEC_TTL_ATTR_MAX + 1]; ++ int start, action_start, err, rem; ++ const struct nlattr *a, *actions; ++ ++ memset(attrs, 0, sizeof(attrs)); ++ nla_for_each_nested(a, attr, rem) { ++ int type = nla_type(a); + +- if (!nla_len(attr)) +- return ovs_nla_add_action(sfa, OVS_ACTION_ATTR_DEC_TTL, +- NULL, 0, log); ++ /* Ignore unknown attributes to be future proof. */ ++ if (type > OVS_DEC_TTL_ATTR_MAX) ++ continue; ++ ++ if (!type || attrs[type]) ++ return -EINVAL; ++ ++ attrs[type] = a; ++ } ++ ++ actions = attrs[OVS_DEC_TTL_ATTR_ACTION]; ++ if (rem || !actions || (nla_len(actions) && nla_len(actions) < NLA_HDRLEN)) ++ return -EINVAL; + + start = add_nested_action_start(sfa, OVS_ACTION_ATTR_DEC_TTL, log); + if (start < 0) + return start; + +- err = ovs_nla_add_action(sfa, OVS_DEC_TTL_ATTR_ACTION, &nested, +- sizeof(nested), log); +- +- if (err) +- return err; ++ action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log); ++ if (action_start < 0) ++ return start; + +- err = __ovs_nla_copy_actions(net, attr, key, sfa, eth_type, ++ err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type, + vlan_tci, mpls_label_count, log); + if (err) + return err; + ++ add_nested_action_end(*sfa, action_start); + add_nested_action_end(*sfa, start); + return 0; + } +@@ -3487,20 +3501,42 @@ out: + static int dec_ttl_action_to_attr(const struct nlattr *attr, + struct sk_buff *skb) + { +- int err = 0, rem = nla_len(attr); +- struct nlattr *start; ++ struct nlattr *start, *action_start; ++ const struct nlattr *a; ++ int err = 0, rem; + + start = nla_nest_start_noflag(skb, OVS_ACTION_ATTR_DEC_TTL); +- + if (!start) + return -EMSGSIZE; + +- err = ovs_nla_put_actions(nla_data(attr), rem, skb); +- if (err) +- nla_nest_cancel(skb, start); +- else +- nla_nest_end(skb, start); ++ nla_for_each_attr(a, nla_data(attr), nla_len(attr), rem) { ++ switch (nla_type(a)) { ++ case OVS_DEC_TTL_ATTR_ACTION: ++ ++ action_start = nla_nest_start_noflag(skb, OVS_DEC_TTL_ATTR_ACTION); ++ if (!action_start) { ++ err = -EMSGSIZE; ++ goto out; ++ } ++ ++ err = ovs_nla_put_actions(nla_data(a), nla_len(a), skb); ++ if (err) ++ goto out; ++ ++ nla_nest_end(skb, action_start); ++ break; + ++ default: ++ /* Ignore all other option to be future compatible */ ++ break; ++ } ++ } ++ ++ nla_nest_end(skb, start); ++ return 0; ++ ++out: ++ nla_nest_cancel(skb, start); + return err; + } + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 2b33e977a9059..bedc12fd35f45 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -93,38 +93,42 @@ + + /* + Assumptions: +- - if device has no dev->hard_header routine, it adds and removes ll header +- inside itself. In this case ll header is invisible outside of device, +- but higher levels still should reserve dev->hard_header_len. +- Some devices are enough clever to reallocate skb, when header +- will not fit to reserved space (tunnel), another ones are silly +- (PPP). ++ - If the device has no dev->header_ops->create, there is no LL header ++ visible above the device. In this case, its hard_header_len should be 0. ++ The device may prepend its own header internally. In this case, its ++ needed_headroom should be set to the space needed for it to add its ++ internal header. ++ For example, a WiFi driver pretending to be an Ethernet driver should ++ set its hard_header_len to be the Ethernet header length, and set its ++ needed_headroom to be (the real WiFi header length - the fake Ethernet ++ header length). + - packet socket receives packets with pulled ll header, + so that SOCK_RAW should push it back. + + On receive: + ----------- + +-Incoming, dev->hard_header!=NULL ++Incoming, dev_has_header(dev) == true + mac_header -> ll header + data -> data + +-Outgoing, dev->hard_header!=NULL ++Outgoing, dev_has_header(dev) == true + mac_header -> ll header + data -> ll header + +-Incoming, dev->hard_header==NULL +- mac_header -> UNKNOWN position. It is very likely, that it points to ll +- header. PPP makes it, that is wrong, because introduce +- assymetry between rx and tx paths. ++Incoming, dev_has_header(dev) == false ++ mac_header -> data ++ However drivers often make it point to the ll header. ++ This is incorrect because the ll header should be invisible to us. + data -> data + +-Outgoing, dev->hard_header==NULL +- mac_header -> data. ll header is still not built! ++Outgoing, dev_has_header(dev) == false ++ mac_header -> data. ll header is invisible to us. + data -> data + + Resume +- If dev->hard_header==NULL we are unlikely to restore sensible ll header. ++ If dev_has_header(dev) == false we are unable to restore the ll header, ++ because it is invisible to us. + + + On transmit: +@@ -2066,7 +2070,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, + + skb->dev = dev; + +- if (dev->header_ops) { ++ if (dev_has_header(dev)) { + /* The device has an explicit notion of ll header, + * exported to higher levels. + * +@@ -2195,7 +2199,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, + if (!net_eq(dev_net(dev), sock_net(sk))) + goto drop; + +- if (dev->header_ops) { ++ if (dev_has_header(dev)) { + if (sk->sk_type != SOCK_DGRAM) + skb_push(skb, skb->data - skb_mac_header(skb)); + else if (skb->pkt_type == PACKET_OUTGOING) { +diff --git a/net/rose/rose_loopback.c b/net/rose/rose_loopback.c +index 7b094275ea8b4..11c45c8c6c164 100644 +--- a/net/rose/rose_loopback.c ++++ b/net/rose/rose_loopback.c +@@ -96,10 +96,19 @@ static void rose_loopback_timer(struct timer_list *unused) + } + + if (frametype == ROSE_CALL_REQUEST) { +- if ((dev = rose_dev_get(dest)) != NULL) { +- if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) +- kfree_skb(skb); +- } else { ++ if (!rose_loopback_neigh->dev) { ++ kfree_skb(skb); ++ continue; ++ } ++ ++ dev = rose_dev_get(dest); ++ if (!dev) { ++ kfree_skb(skb); ++ continue; ++ } ++ ++ if (rose_rx_call_request(skb, dev, rose_loopback_neigh, lci_o) == 0) { ++ dev_put(dev); + kfree_skb(skb); + } + } else { +diff --git a/net/sched/act_mpls.c b/net/sched/act_mpls.c +index ca026e2bf8d27..2701017a3a04d 100644 +--- a/net/sched/act_mpls.c ++++ b/net/sched/act_mpls.c +@@ -88,6 +88,9 @@ static int tcf_mpls_act(struct sk_buff *skb, const struct tc_action *a, + goto drop; + break; + case TCA_MPLS_ACT_MODIFY: ++ if (!pskb_may_pull(skb, ++ skb_network_offset(skb) + MPLS_HLEN)) ++ goto drop; + new_lse = tcf_mpls_get_lse(mpls_hdr(skb), p, false); + if (skb_mpls_update_lse(skb, new_lse)) + goto drop; +diff --git a/net/tipc/node.c b/net/tipc/node.c +index e4cf515e323f3..8c9c12072a784 100644 +--- a/net/tipc/node.c ++++ b/net/tipc/node.c +@@ -2171,6 +2171,8 @@ void tipc_node_apply_property(struct net *net, struct tipc_bearer *b, + else if (prop == TIPC_NLA_PROP_MTU) + tipc_link_set_mtu(e->link, b->mtu); + } ++ /* Update MTU for node link entry */ ++ e->mtu = tipc_link_mss(e->link); + tipc_node_write_unlock(n); + tipc_bearer_xmit(net, bearer_id, &xmitq, &e->maddr, NULL); + } +diff --git a/net/tls/tls_device.c b/net/tls/tls_device.c +index 54d3e161d1985..a3ab2d3d4e4ea 100644 +--- a/net/tls/tls_device.c ++++ b/net/tls/tls_device.c +@@ -1262,6 +1262,8 @@ void tls_device_offload_cleanup_rx(struct sock *sk) + if (tls_ctx->tx_conf != TLS_HW) { + dev_put(netdev); + tls_ctx->netdev = NULL; ++ } else { ++ set_bit(TLS_RX_DEV_CLOSED, &tls_ctx->flags); + } + out: + up_read(&device_offload_lock); +@@ -1291,7 +1293,8 @@ static int tls_device_down(struct net_device *netdev) + if (ctx->tx_conf == TLS_HW) + netdev->tlsdev_ops->tls_dev_del(netdev, ctx, + TLS_OFFLOAD_CTX_DIR_TX); +- if (ctx->rx_conf == TLS_HW) ++ if (ctx->rx_conf == TLS_HW && ++ !test_bit(TLS_RX_DEV_CLOSED, &ctx->flags)) + netdev->tlsdev_ops->tls_dev_del(netdev, ctx, + TLS_OFFLOAD_CTX_DIR_RX); + WRITE_ONCE(ctx->netdev, NULL); +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index 2fe9e2cf86599..845c628ac1b27 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -1295,6 +1295,12 @@ static struct sk_buff *tls_wait_data(struct sock *sk, struct sk_psock *psock, + return NULL; + } + ++ if (!skb_queue_empty(&sk->sk_receive_queue)) { ++ __strp_unpause(&ctx->strp); ++ if (ctx->recv_pkt) ++ return ctx->recv_pkt; ++ } ++ + if (sk->sk_shutdown & RCV_SHUTDOWN) + return NULL; + +diff --git a/net/vmw_vsock/virtio_transport_common.c b/net/vmw_vsock/virtio_transport_common.c +index 0edda1edf9882..5956939eebb78 100644 +--- a/net/vmw_vsock/virtio_transport_common.c ++++ b/net/vmw_vsock/virtio_transport_common.c +@@ -841,8 +841,10 @@ void virtio_transport_release(struct vsock_sock *vsk) + virtio_transport_free_pkt(pkt); + } + +- if (remove_sock) ++ if (remove_sock) { ++ sock_set_flag(sk, SOCK_DONE); + vsock_remove_sock(vsk); ++ } + } + EXPORT_SYMBOL_GPL(virtio_transport_release); + +@@ -1132,8 +1134,8 @@ void virtio_transport_recv_pkt(struct virtio_transport *t, + + lock_sock(sk); + +- /* Check if sk has been released before lock_sock */ +- if (sk->sk_shutdown == SHUTDOWN_MASK) { ++ /* Check if sk has been closed before lock_sock */ ++ if (sock_flag(sk, SOCK_DONE)) { + (void)virtio_transport_reset_no_sock(t, pkt); + release_sock(sk); + sock_put(sk); +diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c +index a10487e7574c2..e65a50192432c 100644 +--- a/net/x25/af_x25.c ++++ b/net/x25/af_x25.c +@@ -681,7 +681,8 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + int len, i, rc = 0; + + if (addr_len != sizeof(struct sockaddr_x25) || +- addr->sx25_family != AF_X25) { ++ addr->sx25_family != AF_X25 || ++ strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN) { + rc = -EINVAL; + goto out; + } +@@ -775,7 +776,8 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr, + + rc = -EINVAL; + if (addr_len != sizeof(struct sockaddr_x25) || +- addr->sx25_family != AF_X25) ++ addr->sx25_family != AF_X25 || ++ strnlen(addr->sx25_addr.x25_addr, X25_ADDR_LEN) == X25_ADDR_LEN) + goto out; + + rc = -ENETUNREACH; +diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c +index a4d4d71db55b2..bd94d7fc5bafe 100644 +--- a/sound/usb/mixer_us16x08.c ++++ b/sound/usb/mixer_us16x08.c +@@ -607,7 +607,7 @@ static int snd_us16x08_eq_put(struct snd_kcontrol *kcontrol, + static int snd_us16x08_meter_info(struct snd_kcontrol *kcontrol, + struct snd_ctl_elem_info *uinfo) + { +- uinfo->count = 1; ++ uinfo->count = 34; + uinfo->type = SNDRV_CTL_ELEM_TYPE_INTEGER; + uinfo->value.integer.max = 0x7FFF; + uinfo->value.integer.min = 0;
