From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) by finch.gentoo.org (Postfix) with ESMTP id 7F8AE1392EF for ; Fri, 27 Jun 2014 15:01:12 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id B1885E09D7; Fri, 27 Jun 2014 15:00:42 +0000 (UTC) Received: from smtp.gentoo.org (smtp.gentoo.org [140.211.166.183]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id DAE99E09D7 for ; Fri, 27 Jun 2014 15:00:26 +0000 (UTC) Received: from spoonbill.gentoo.org (spoonbill.gentoo.org [81.93.255.5]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id 83286340192 for ; Fri, 27 Jun 2014 15:00:04 +0000 (UTC) Received: from localhost.localdomain (localhost [127.0.0.1]) by spoonbill.gentoo.org (Postfix) with ESMTP id 8933D19144 for ; Fri, 27 Jun 2014 15:00:02 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1403881196.6594b9d62b8be3c01b3fdd0cb2befdfb3ea6d67c.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:3.14 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1008_linux-3.14.9.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: 6594b9d62b8be3c01b3fdd0cb2befdfb3ea6d67c X-VCS-Branch: 3.14 Date: Fri, 27 Jun 2014 15:00:02 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Archives-Salt: 414ee66b-a5c0-4805-b427-5ca7b45cd599 X-Archives-Hash: 57df273fe1b39bc14c4b3e6d86820e21 commit: 6594b9d62b8be3c01b3fdd0cb2befdfb3ea6d67c Author: Mike Pagano gentoo org> AuthorDate: Fri Jun 27 14:59:56 2014 +0000 Commit: Mike Pagano gentoo org> CommitDate: Fri Jun 27 14:59:56 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=6594b9d6 Linux patch 3.14.9 --- 0000_README | 4 + 1008_linux-3.14.9.patch | 3272 +++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3276 insertions(+) diff --git a/0000_README b/0000_README index 4c8b812..d0fbbbf 100644 --- a/0000_README +++ b/0000_README @@ -74,6 +74,10 @@ Patch: 1007_linux-3.14.8.patch From: http://www.kernel.org Desc: Linux 3.14.8 +Patch: 1008_linux-3.14.9.patch +From: http://www.kernel.org +Desc: Linux 3.14.9 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1008_linux-3.14.9.patch b/1008_linux-3.14.9.patch new file mode 100644 index 0000000..696e263 --- /dev/null +++ b/1008_linux-3.14.9.patch @@ -0,0 +1,3272 @@ +diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy +index f1c5cc9d17a8..4c3efe434806 100644 +--- a/Documentation/ABI/testing/ima_policy ++++ b/Documentation/ABI/testing/ima_policy +@@ -23,7 +23,7 @@ Description: + [fowner]] + lsm: [[subj_user=] [subj_role=] [subj_type=] + [obj_user=] [obj_role=] [obj_type=]] +- option: [[appraise_type=]] ++ option: [[appraise_type=]] [permit_directio] + + base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] + mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] +diff --git a/Makefile b/Makefile +index ef1d59b750ea..ee247656432f 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 14 +-SUBLEVEL = 8 ++SUBLEVEL = 9 + EXTRAVERSION = + NAME = Remembering Coco + +diff --git a/arch/arm/mach-at91/sysirq_mask.c b/arch/arm/mach-at91/sysirq_mask.c +index 2ba694f9626b..f8bc3511a8c8 100644 +--- a/arch/arm/mach-at91/sysirq_mask.c ++++ b/arch/arm/mach-at91/sysirq_mask.c +@@ -25,24 +25,28 @@ + + #include "generic.h" + +-#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */ +-#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */ ++#define AT91_RTC_IDR 0x24 /* Interrupt Disable Register */ ++#define AT91_RTC_IMR 0x28 /* Interrupt Mask Register */ ++#define AT91_RTC_IRQ_MASK 0x1f /* Available IRQs mask */ + + void __init at91_sysirq_mask_rtc(u32 rtc_base) + { + void __iomem *base; +- u32 mask; + + base = ioremap(rtc_base, 64); + if (!base) + return; + +- mask = readl_relaxed(base + AT91_RTC_IMR); +- if (mask) { +- pr_info("AT91: Disabling rtc irq\n"); +- writel_relaxed(mask, base + AT91_RTC_IDR); +- (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */ +- } ++ /* ++ * sam9x5 SoCs have the following errata: ++ * "RTC: Interrupt Mask Register cannot be used ++ * Interrupt Mask Register read always returns 0." ++ * ++ * Hence we're not relying on IMR values to disable ++ * interrupts. ++ */ ++ writel_relaxed(AT91_RTC_IRQ_MASK, base + AT91_RTC_IDR); ++ (void)readl_relaxed(base + AT91_RTC_IMR); /* flush */ + + iounmap(base); + } +diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c +index da5186fbd77a..5efce56f0df0 100644 +--- a/arch/mips/kvm/kvm_mips.c ++++ b/arch/mips/kvm/kvm_mips.c +@@ -304,7 +304,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id) + if (cpu_has_veic || cpu_has_vint) { + size = 0x200 + VECTORSPACING * 64; + } else { +- size = 0x200; ++ size = 0x4000; + } + + /* Save Linux EBASE */ +diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c +index 01fe9946d388..44d258da0a1b 100644 +--- a/arch/sparc/net/bpf_jit_comp.c ++++ b/arch/sparc/net/bpf_jit_comp.c +@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start_, void *end_) + #define BNE (F2(0, 2) | CONDNE) + + #ifdef CONFIG_SPARC64 +-#define BNE_PTR (F2(0, 1) | CONDNE | (2 << 20)) ++#define BE_PTR (F2(0, 1) | CONDE | (2 << 20)) + #else +-#define BNE_PTR BNE ++#define BE_PTR BE + #endif + + #define SETHI(K, REG) \ +@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *fp) + case BPF_S_ANC_IFINDEX: + emit_skb_loadptr(dev, r_A); + emit_cmpi(r_A, 0); +- emit_branch(BNE_PTR, cleanup_addr + 4); ++ emit_branch(BE_PTR, cleanup_addr + 4); + emit_nop(); + emit_load32(r_A, struct net_device, ifindex, r_A); + break; +@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *fp) + case BPF_S_ANC_HATYPE: + emit_skb_loadptr(dev, r_A); + emit_cmpi(r_A, 0); +- emit_branch(BNE_PTR, cleanup_addr + 4); ++ emit_branch(BE_PTR, cleanup_addr + 4); + emit_nop(); + emit_load16(r_A, struct net_device, type, r_A); + break; +diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c +index 9736529ade08..006911858174 100644 +--- a/arch/x86/kvm/lapic.c ++++ b/arch/x86/kvm/lapic.c +@@ -360,6 +360,8 @@ static inline void apic_clear_irr(int vec, struct kvm_lapic *apic) + + static inline void apic_set_isr(int vec, struct kvm_lapic *apic) + { ++ /* Note that we never get here with APIC virtualization enabled. */ ++ + if (!__apic_test_and_set_vector(vec, apic->regs + APIC_ISR)) + ++apic->isr_count; + BUG_ON(apic->isr_count > MAX_APIC_VECTOR); +@@ -371,12 +373,48 @@ static inline void apic_set_isr(int vec, struct kvm_lapic *apic) + apic->highest_isr_cache = vec; + } + ++static inline int apic_find_highest_isr(struct kvm_lapic *apic) ++{ ++ int result; ++ ++ /* ++ * Note that isr_count is always 1, and highest_isr_cache ++ * is always -1, with APIC virtualization enabled. ++ */ ++ if (!apic->isr_count) ++ return -1; ++ if (likely(apic->highest_isr_cache != -1)) ++ return apic->highest_isr_cache; ++ ++ result = find_highest_vector(apic->regs + APIC_ISR); ++ ASSERT(result == -1 || result >= 16); ++ ++ return result; ++} ++ + static inline void apic_clear_isr(int vec, struct kvm_lapic *apic) + { +- if (__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR)) ++ struct kvm_vcpu *vcpu; ++ if (!__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR)) ++ return; ++ ++ vcpu = apic->vcpu; ++ ++ /* ++ * We do get here for APIC virtualization enabled if the guest ++ * uses the Hyper-V APIC enlightenment. In this case we may need ++ * to trigger a new interrupt delivery by writing the SVI field; ++ * on the other hand isr_count and highest_isr_cache are unused ++ * and must be left alone. ++ */ ++ if (unlikely(kvm_apic_vid_enabled(vcpu->kvm))) ++ kvm_x86_ops->hwapic_isr_update(vcpu->kvm, ++ apic_find_highest_isr(apic)); ++ else { + --apic->isr_count; +- BUG_ON(apic->isr_count < 0); +- apic->highest_isr_cache = -1; ++ BUG_ON(apic->isr_count < 0); ++ apic->highest_isr_cache = -1; ++ } + } + + int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu) +@@ -456,22 +494,6 @@ static void pv_eoi_clr_pending(struct kvm_vcpu *vcpu) + __clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention); + } + +-static inline int apic_find_highest_isr(struct kvm_lapic *apic) +-{ +- int result; +- +- /* Note that isr_count is always 1 with vid enabled */ +- if (!apic->isr_count) +- return -1; +- if (likely(apic->highest_isr_cache != -1)) +- return apic->highest_isr_cache; +- +- result = find_highest_vector(apic->regs + APIC_ISR); +- ASSERT(result == -1 || result >= 16); +- +- return result; +-} +- + void kvm_apic_update_tmr(struct kvm_vcpu *vcpu, u32 *tmr) + { + struct kvm_lapic *apic = vcpu->arch.apic; +@@ -1605,6 +1627,8 @@ int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu) + int vector = kvm_apic_has_interrupt(vcpu); + struct kvm_lapic *apic = vcpu->arch.apic; + ++ /* Note that we never get here with APIC virtualization enabled. */ ++ + if (vector == -1) + return -1; + +diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c +index 1512e41cd93d..43665d0d0905 100644 +--- a/crypto/crypto_user.c ++++ b/crypto/crypto_user.c +@@ -466,7 +466,7 @@ static int crypto_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + type -= CRYPTO_MSG_BASE; + link = &crypto_dispatch[type]; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if ((type == (CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE) && +diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c +index 18c5b9b16645..3165811e2407 100644 +--- a/drivers/connector/cn_proc.c ++++ b/drivers/connector/cn_proc.c +@@ -369,7 +369,7 @@ static void cn_proc_mcast_ctl(struct cn_msg *msg, + return; + + /* Can only change if privileged. */ +- if (!capable(CAP_NET_ADMIN)) { ++ if (!__netlink_ns_capable(nsp, &init_user_ns, CAP_NET_ADMIN)) { + err = EPERM; + goto out; + } +diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c +index 2e7801af466e..05827eccc53a 100644 +--- a/drivers/hv/connection.c ++++ b/drivers/hv/connection.c +@@ -224,8 +224,8 @@ cleanup: + vmbus_connection.int_page = NULL; + } + +- free_pages((unsigned long)vmbus_connection.monitor_pages[0], 1); +- free_pages((unsigned long)vmbus_connection.monitor_pages[1], 1); ++ free_pages((unsigned long)vmbus_connection.monitor_pages[0], 0); ++ free_pages((unsigned long)vmbus_connection.monitor_pages[1], 0); + vmbus_connection.monitor_pages[0] = NULL; + vmbus_connection.monitor_pages[1] = NULL; + +diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c +index 7e17a5495e02..393fd8a98735 100644 +--- a/drivers/hv/hv_balloon.c ++++ b/drivers/hv/hv_balloon.c +@@ -19,6 +19,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include ++#include + #include + #include + #include +@@ -459,6 +460,11 @@ static bool do_hot_add; + */ + static uint pressure_report_delay = 45; + ++/* ++ * The last time we posted a pressure report to host. ++ */ ++static unsigned long last_post_time; ++ + module_param(hot_add, bool, (S_IRUGO | S_IWUSR)); + MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add"); + +@@ -542,6 +548,7 @@ struct hv_dynmem_device { + + static struct hv_dynmem_device dm_device; + ++static void post_status(struct hv_dynmem_device *dm); + #ifdef CONFIG_MEMORY_HOTPLUG + + static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size) +@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size, + * have not been "onlined" within the allowed time. + */ + wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ); +- ++ post_status(&dm_device); + } + + return; +@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem_device *dm) + { + struct dm_status status; + struct sysinfo val; ++ unsigned long now = jiffies; ++ unsigned long last_post = last_post_time; + + if (pressure_report_delay > 0) { + --pressure_report_delay; + return; + } ++ ++ if (!time_after(now, (last_post_time + HZ))) ++ return; ++ + si_meminfo(&val); + memset(&status, 0, sizeof(struct dm_status)); + status.hdr.type = DM_STATUS_REPORT; +@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem_device *dm) + if (status.hdr.trans_id != atomic_read(&trans_id)) + return; + ++ /* ++ * If the last post time that we sampled has changed, ++ * we have raced, don't post the status. ++ */ ++ if (last_post != last_post_time) ++ return; ++ ++ last_post_time = jiffies; + vmbus_sendpacket(dm->dev->channel, &status, + sizeof(struct dm_status), + (unsigned long)NULL, +@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struct *dummy) + + if (ret == -EAGAIN) + msleep(20); +- ++ post_status(&dm_device); + } while (ret == -EAGAIN); + + if (ret) { +@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynmem_device *dm, + struct dm_unballoon_response resp; + int i; + +- for (i = 0; i < range_count; i++) ++ for (i = 0; i < range_count; i++) { + free_balloon_pages(dm, &range_array[i]); ++ post_status(&dm_device); ++ } + + if (req->more_pages == 1) + return; +diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c +index bbba014c9939..e6bf77d1ec08 100644 +--- a/drivers/iio/adc/at91_adc.c ++++ b/drivers/iio/adc/at91_adc.c +@@ -322,12 +322,11 @@ static int at91_adc_channel_init(struct iio_dev *idev) + return idev->num_channels; + } + +-static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev, ++static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev, + struct at91_adc_trigger *triggers, + const char *trigger_name) + { + struct at91_adc_state *st = iio_priv(idev); +- u8 value = 0; + int i; + + for (i = 0; i < st->trigger_number; i++) { +@@ -340,15 +339,16 @@ static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev, + return -ENOMEM; + + if (strcmp(trigger_name, name) == 0) { +- value = triggers[i].value; + kfree(name); +- break; ++ if (triggers[i].value == 0) ++ return -EINVAL; ++ return triggers[i].value; + } + + kfree(name); + } + +- return value; ++ return -EINVAL; + } + + static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) +@@ -358,14 +358,14 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state) + struct iio_buffer *buffer = idev->buffer; + struct at91_adc_reg_desc *reg = st->registers; + u32 status = at91_adc_readl(st, reg->trigger_register); +- u8 value; ++ int value; + u8 bit; + + value = at91_adc_get_trigger_value_by_name(idev, + st->trigger_list, + idev->trig->name); +- if (value == 0) +- return -EINVAL; ++ if (value < 0) ++ return value; + + if (state) { + st->buffer = kmalloc(idev->scan_bytes, GFP_KERNEL); +diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c +index 360259266d4f..ef5ffc0c37a4 100644 +--- a/drivers/iio/adc/max1363.c ++++ b/drivers/iio/adc/max1363.c +@@ -1258,8 +1258,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1038_channels, ++ .num_channels = ARRAY_SIZE(max1038_channels), + }, + [max11605] = { + .bits = 8, +@@ -1268,8 +1268,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1038_channels, ++ .num_channels = ARRAY_SIZE(max1038_channels), + }, + [max11606] = { + .bits = 10, +@@ -1318,8 +1318,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1138_channels, ++ .num_channels = ARRAY_SIZE(max1138_channels), + }, + [max11611] = { + .bits = 10, +@@ -1328,8 +1328,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = { + .num_modes = ARRAY_SIZE(max1238_mode_list), + .default_mode = s0to11, + .info = &max1238_info, +- .channels = max1238_channels, +- .num_channels = ARRAY_SIZE(max1238_channels), ++ .channels = max1138_channels, ++ .num_channels = ARRAY_SIZE(max1138_channels), + }, + [max11612] = { + .bits = 12, +diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c +index 05423543f89d..053117c02bbc 100644 +--- a/drivers/iio/magnetometer/ak8975.c ++++ b/drivers/iio/magnetometer/ak8975.c +@@ -352,8 +352,6 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val) + { + struct ak8975_data *data = iio_priv(indio_dev); + struct i2c_client *client = data->client; +- u16 meas_reg; +- s16 raw; + int ret; + + mutex_lock(&data->lock); +@@ -401,16 +399,11 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val) + dev_err(&client->dev, "Read axis data fails\n"); + goto exit; + } +- meas_reg = ret; + + mutex_unlock(&data->lock); + +- /* Endian conversion of the measured values. */ +- raw = (s16) (le16_to_cpu(meas_reg)); +- + /* Clamp to valid range. */ +- raw = clamp_t(s16, raw, -4096, 4095); +- *val = raw; ++ *val = clamp_t(s16, ret, -4096, 4095); + return IIO_VAL_INT; + + exit: +diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c +index ac8c8ab723e5..fe53669eeeeb 100644 +--- a/drivers/iio/pressure/mpl3115.c ++++ b/drivers/iio/pressure/mpl3115.c +@@ -98,7 +98,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev, + mutex_unlock(&data->lock); + if (ret < 0) + return ret; +- *val = sign_extend32(be32_to_cpu(tmp) >> 12, 23); ++ *val = be32_to_cpu(tmp) >> 12; + return IIO_VAL_INT; + case IIO_TEMP: /* in 0.0625 celsius / LSB */ + mutex_lock(&data->lock); +@@ -112,7 +112,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev, + mutex_unlock(&data->lock); + if (ret < 0) + return ret; +- *val = sign_extend32(be32_to_cpu(tmp) >> 20, 15); ++ *val = sign_extend32(be32_to_cpu(tmp) >> 20, 11); + return IIO_VAL_INT; + default: + return -EINVAL; +@@ -185,7 +185,7 @@ static const struct iio_chan_spec mpl3115_channels[] = { + BIT(IIO_CHAN_INFO_SCALE), + .scan_index = 0, + .scan_type = { +- .sign = 's', ++ .sign = 'u', + .realbits = 20, + .storagebits = 32, + .shift = 12, +diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c +index 95c316bb7a42..4a13b0001471 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/main.c ++++ b/drivers/net/ethernet/mellanox/mlx4/main.c +@@ -2275,13 +2275,8 @@ static int __mlx4_init_one(struct pci_dev *pdev, int pci_dev_data) + /* Allow large DMA segments, up to the firmware limit of 1 GB */ + dma_set_max_seg_size(&pdev->dev, 1024 * 1024 * 1024); + +- priv = kzalloc(sizeof(*priv), GFP_KERNEL); +- if (!priv) { +- err = -ENOMEM; +- goto err_release_regions; +- } +- +- dev = &priv->dev; ++ dev = pci_get_drvdata(pdev); ++ priv = mlx4_priv(dev); + dev->pdev = pdev; + INIT_LIST_HEAD(&priv->ctx_list); + spin_lock_init(&priv->ctx_lock); +@@ -2465,8 +2460,7 @@ slave_start: + mlx4_sense_init(dev); + mlx4_start_sense(dev); + +- priv->pci_dev_data = pci_dev_data; +- pci_set_drvdata(pdev, dev); ++ priv->removed = 0; + + return 0; + +@@ -2532,84 +2526,108 @@ err_disable_pdev: + + static int mlx4_init_one(struct pci_dev *pdev, const struct pci_device_id *id) + { ++ struct mlx4_priv *priv; ++ struct mlx4_dev *dev; ++ + printk_once(KERN_INFO "%s", mlx4_version); + ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; ++ ++ dev = &priv->dev; ++ pci_set_drvdata(pdev, dev); ++ priv->pci_dev_data = id->driver_data; ++ + return __mlx4_init_one(pdev, id->driver_data); + } + +-static void mlx4_remove_one(struct pci_dev *pdev) ++static void __mlx4_remove_one(struct pci_dev *pdev) + { + struct mlx4_dev *dev = pci_get_drvdata(pdev); + struct mlx4_priv *priv = mlx4_priv(dev); ++ int pci_dev_data; + int p; + +- if (dev) { +- /* in SRIOV it is not allowed to unload the pf's +- * driver while there are alive vf's */ +- if (mlx4_is_master(dev)) { +- if (mlx4_how_many_lives_vf(dev)) +- printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n"); +- } +- mlx4_stop_sense(dev); +- mlx4_unregister_device(dev); ++ if (priv->removed) ++ return; + +- for (p = 1; p <= dev->caps.num_ports; p++) { +- mlx4_cleanup_port_info(&priv->port[p]); +- mlx4_CLOSE_PORT(dev, p); +- } ++ pci_dev_data = priv->pci_dev_data; + +- if (mlx4_is_master(dev)) +- mlx4_free_resource_tracker(dev, +- RES_TR_FREE_SLAVES_ONLY); +- +- mlx4_cleanup_counters_table(dev); +- mlx4_cleanup_qp_table(dev); +- mlx4_cleanup_srq_table(dev); +- mlx4_cleanup_cq_table(dev); +- mlx4_cmd_use_polling(dev); +- mlx4_cleanup_eq_table(dev); +- mlx4_cleanup_mcg_table(dev); +- mlx4_cleanup_mr_table(dev); +- mlx4_cleanup_xrcd_table(dev); +- mlx4_cleanup_pd_table(dev); ++ /* in SRIOV it is not allowed to unload the pf's ++ * driver while there are alive vf's */ ++ if (mlx4_is_master(dev) && mlx4_how_many_lives_vf(dev)) ++ printk(KERN_ERR "Removing PF when there are assigned VF's !!!\n"); ++ mlx4_stop_sense(dev); ++ mlx4_unregister_device(dev); + +- if (mlx4_is_master(dev)) +- mlx4_free_resource_tracker(dev, +- RES_TR_FREE_STRUCTS_ONLY); +- +- iounmap(priv->kar); +- mlx4_uar_free(dev, &priv->driver_uar); +- mlx4_cleanup_uar_table(dev); +- if (!mlx4_is_slave(dev)) +- mlx4_clear_steering(dev); +- mlx4_free_eq_table(dev); +- if (mlx4_is_master(dev)) +- mlx4_multi_func_cleanup(dev); +- mlx4_close_hca(dev); +- if (mlx4_is_slave(dev)) +- mlx4_multi_func_cleanup(dev); +- mlx4_cmd_cleanup(dev); +- +- if (dev->flags & MLX4_FLAG_MSI_X) +- pci_disable_msix(pdev); +- if (dev->flags & MLX4_FLAG_SRIOV) { +- mlx4_warn(dev, "Disabling SR-IOV\n"); +- pci_disable_sriov(pdev); +- } ++ for (p = 1; p <= dev->caps.num_ports; p++) { ++ mlx4_cleanup_port_info(&priv->port[p]); ++ mlx4_CLOSE_PORT(dev, p); ++ } + +- if (!mlx4_is_slave(dev)) +- mlx4_free_ownership(dev); ++ if (mlx4_is_master(dev)) ++ mlx4_free_resource_tracker(dev, ++ RES_TR_FREE_SLAVES_ONLY); ++ ++ mlx4_cleanup_counters_table(dev); ++ mlx4_cleanup_qp_table(dev); ++ mlx4_cleanup_srq_table(dev); ++ mlx4_cleanup_cq_table(dev); ++ mlx4_cmd_use_polling(dev); ++ mlx4_cleanup_eq_table(dev); ++ mlx4_cleanup_mcg_table(dev); ++ mlx4_cleanup_mr_table(dev); ++ mlx4_cleanup_xrcd_table(dev); ++ mlx4_cleanup_pd_table(dev); + +- kfree(dev->caps.qp0_tunnel); +- kfree(dev->caps.qp0_proxy); +- kfree(dev->caps.qp1_tunnel); +- kfree(dev->caps.qp1_proxy); ++ if (mlx4_is_master(dev)) ++ mlx4_free_resource_tracker(dev, ++ RES_TR_FREE_STRUCTS_ONLY); + +- kfree(priv); +- pci_release_regions(pdev); +- pci_disable_device(pdev); +- pci_set_drvdata(pdev, NULL); ++ iounmap(priv->kar); ++ mlx4_uar_free(dev, &priv->driver_uar); ++ mlx4_cleanup_uar_table(dev); ++ if (!mlx4_is_slave(dev)) ++ mlx4_clear_steering(dev); ++ mlx4_free_eq_table(dev); ++ if (mlx4_is_master(dev)) ++ mlx4_multi_func_cleanup(dev); ++ mlx4_close_hca(dev); ++ if (mlx4_is_slave(dev)) ++ mlx4_multi_func_cleanup(dev); ++ mlx4_cmd_cleanup(dev); ++ ++ if (dev->flags & MLX4_FLAG_MSI_X) ++ pci_disable_msix(pdev); ++ if (dev->flags & MLX4_FLAG_SRIOV) { ++ mlx4_warn(dev, "Disabling SR-IOV\n"); ++ pci_disable_sriov(pdev); + } ++ ++ if (!mlx4_is_slave(dev)) ++ mlx4_free_ownership(dev); ++ ++ kfree(dev->caps.qp0_tunnel); ++ kfree(dev->caps.qp0_proxy); ++ kfree(dev->caps.qp1_tunnel); ++ kfree(dev->caps.qp1_proxy); ++ ++ pci_release_regions(pdev); ++ pci_disable_device(pdev); ++ memset(priv, 0, sizeof(*priv)); ++ priv->pci_dev_data = pci_dev_data; ++ priv->removed = 1; ++} ++ ++static void mlx4_remove_one(struct pci_dev *pdev) ++{ ++ struct mlx4_dev *dev = pci_get_drvdata(pdev); ++ struct mlx4_priv *priv = mlx4_priv(dev); ++ ++ __mlx4_remove_one(pdev); ++ kfree(priv); ++ pci_set_drvdata(pdev, NULL); + } + + int mlx4_restart_one(struct pci_dev *pdev) +@@ -2619,7 +2637,7 @@ int mlx4_restart_one(struct pci_dev *pdev) + int pci_dev_data; + + pci_dev_data = priv->pci_dev_data; +- mlx4_remove_one(pdev); ++ __mlx4_remove_one(pdev); + return __mlx4_init_one(pdev, pci_dev_data); + } + +@@ -2674,7 +2692,7 @@ MODULE_DEVICE_TABLE(pci, mlx4_pci_table); + static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev, + pci_channel_state_t state) + { +- mlx4_remove_one(pdev); ++ __mlx4_remove_one(pdev); + + return state == pci_channel_io_perm_failure ? + PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_NEED_RESET; +@@ -2682,11 +2700,11 @@ static pci_ers_result_t mlx4_pci_err_detected(struct pci_dev *pdev, + + static pci_ers_result_t mlx4_pci_slot_reset(struct pci_dev *pdev) + { +- const struct pci_device_id *id; +- int ret; ++ struct mlx4_dev *dev = pci_get_drvdata(pdev); ++ struct mlx4_priv *priv = mlx4_priv(dev); ++ int ret; + +- id = pci_match_id(mlx4_pci_table, pdev); +- ret = __mlx4_init_one(pdev, id->driver_data); ++ ret = __mlx4_init_one(pdev, priv->pci_dev_data); + + return ret ? PCI_ERS_RESULT_DISCONNECT : PCI_ERS_RESULT_RECOVERED; + } +@@ -2700,7 +2718,7 @@ static struct pci_driver mlx4_driver = { + .name = DRV_NAME, + .id_table = mlx4_pci_table, + .probe = mlx4_init_one, +- .shutdown = mlx4_remove_one, ++ .shutdown = __mlx4_remove_one, + .remove = mlx4_remove_one, + .err_handler = &mlx4_err_handler, + }; +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +index 7aec6c833973..99d7a28a2ada 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +@@ -796,6 +796,7 @@ struct mlx4_priv { + spinlock_t ctx_lock; + + int pci_dev_data; ++ int removed; + + struct list_head pgdir_list; + struct mutex pgdir_mutex; +diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c +index 7d4f54912bad..3e46c894a107 100644 +--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c ++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_dcb.c +@@ -1022,6 +1022,7 @@ static int qlcnic_dcb_peer_app_info(struct net_device *netdev, + struct qlcnic_dcb_cee *peer; + int i; + ++ memset(info, 0, sizeof(*info)); + *app_count = 0; + + if (!test_bit(QLCNIC_DCB_STATE, &adapter->dcb->state)) +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 040cb94e8219..957f0ffe31c4 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -301,6 +301,27 @@ static const u16 sh_eth_offset_fast_sh4[SH_ETH_MAX_REGISTER_OFFSET] = { + }; + + static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = { ++ [EDMR] = 0x0000, ++ [EDTRR] = 0x0004, ++ [EDRRR] = 0x0008, ++ [TDLAR] = 0x000c, ++ [RDLAR] = 0x0010, ++ [EESR] = 0x0014, ++ [EESIPR] = 0x0018, ++ [TRSCER] = 0x001c, ++ [RMFCR] = 0x0020, ++ [TFTR] = 0x0024, ++ [FDR] = 0x0028, ++ [RMCR] = 0x002c, ++ [EDOCR] = 0x0030, ++ [FCFTR] = 0x0034, ++ [RPADIR] = 0x0038, ++ [TRIMD] = 0x003c, ++ [RBWAR] = 0x0040, ++ [RDFAR] = 0x0044, ++ [TBRAR] = 0x004c, ++ [TDFAR] = 0x0050, ++ + [ECMR] = 0x0160, + [ECSR] = 0x0164, + [ECSIPR] = 0x0168, +@@ -539,7 +560,6 @@ static struct sh_eth_cpu_data sh7757_data = { + .register_type = SH_ETH_REG_FAST_SH4, + + .eesipr_value = DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff, +- .rmcr_value = RMCR_RNC, + + .tx_check = EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO, + .eesr_err_check = EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE | +@@ -617,7 +637,6 @@ static struct sh_eth_cpu_data sh7757_data_giga = { + EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | + EESR_TDE | EESR_ECI, + .fdr_value = 0x0000072f, +- .rmcr_value = RMCR_RNC, + + .irq_flags = IRQF_SHARED, + .apr = 1, +@@ -745,7 +764,6 @@ static struct sh_eth_cpu_data r8a7740_data = { + EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | + EESR_TDE | EESR_ECI, + .fdr_value = 0x0000070f, +- .rmcr_value = RMCR_RNC, + + .apr = 1, + .mpr = 1, +@@ -777,7 +795,6 @@ static struct sh_eth_cpu_data r7s72100_data = { + EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE | + EESR_TDE | EESR_ECI, + .fdr_value = 0x0000070f, +- .rmcr_value = RMCR_RNC, + + .no_psr = 1, + .apr = 1, +@@ -826,9 +843,6 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd) + if (!cd->fdr_value) + cd->fdr_value = DEFAULT_FDR_INIT; + +- if (!cd->rmcr_value) +- cd->rmcr_value = DEFAULT_RMCR_VALUE; +- + if (!cd->tx_check) + cd->tx_check = DEFAULT_TX_CHECK; + +@@ -1281,8 +1295,8 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start) + sh_eth_write(ndev, mdp->cd->fdr_value, FDR); + sh_eth_write(ndev, 0, TFTR); + +- /* Frame recv control */ +- sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR); ++ /* Frame recv control (enable multiple-packets per rx irq) */ ++ sh_eth_write(ndev, RMCR_RNC, RMCR); + + sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER); + +diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h +index 6075915b88ec..a096b4bf9799 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.h ++++ b/drivers/net/ethernet/renesas/sh_eth.h +@@ -320,7 +320,6 @@ enum TD_STS_BIT { + enum RMCR_BIT { + RMCR_RNC = 0x00000001, + }; +-#define DEFAULT_RMCR_VALUE 0x00000000 + + /* ECMR */ + enum FELIC_MODE_BIT { +@@ -467,7 +466,6 @@ struct sh_eth_cpu_data { + unsigned long fdr_value; + unsigned long fcftr_value; + unsigned long rpadir_value; +- unsigned long rmcr_value; + + /* interrupt checking mask */ + unsigned long tx_check; +diff --git a/drivers/net/ethernet/sfc/io.h b/drivers/net/ethernet/sfc/io.h +index 4d3f119b67b3..afb94aa2c15e 100644 +--- a/drivers/net/ethernet/sfc/io.h ++++ b/drivers/net/ethernet/sfc/io.h +@@ -66,10 +66,17 @@ + #define EFX_USE_QWORD_IO 1 + #endif + ++/* Hardware issue requires that only 64-bit naturally aligned writes ++ * are seen by hardware. Its not strictly necessary to restrict to ++ * x86_64 arch, but done for safety since unusual write combining behaviour ++ * can break PIO. ++ */ ++#ifdef CONFIG_X86_64 + /* PIO is a win only if write-combining is possible */ + #ifdef ARCH_HAS_IOREMAP_WC + #define EFX_USE_PIO 1 + #endif ++#endif + + #ifdef EFX_USE_QWORD_IO + static inline void _efx_writeq(struct efx_nic *efx, __le64 value, +diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c +index 75d11fa4eb0a..d79c842680a5 100644 +--- a/drivers/net/ethernet/sfc/tx.c ++++ b/drivers/net/ethernet/sfc/tx.c +@@ -189,6 +189,18 @@ struct efx_short_copy_buffer { + u8 buf[L1_CACHE_BYTES]; + }; + ++/* Copy in explicit 64-bit writes. */ ++static void efx_memcpy_64(void __iomem *dest, void *src, size_t len) ++{ ++ u64 *src64 = src; ++ u64 __iomem *dest64 = dest; ++ size_t l64 = len / 8; ++ size_t i; ++ ++ for (i = 0; i < l64; i++) ++ writeq(src64[i], &dest64[i]); ++} ++ + /* Copy to PIO, respecting that writes to PIO buffers must be dword aligned. + * Advances piobuf pointer. Leaves additional data in the copy buffer. + */ +@@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(struct efx_nic *efx, u8 __iomem **piobuf, + { + int block_len = len & ~(sizeof(copy_buf->buf) - 1); + +- memcpy_toio(*piobuf, data, block_len); ++ efx_memcpy_64(*piobuf, data, block_len); + *piobuf += block_len; + len -= block_len; + +@@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(struct efx_nic *efx, u8 __iomem **piobuf, + if (copy_buf->used < sizeof(copy_buf->buf)) + return; + +- memcpy_toio(*piobuf, copy_buf->buf, sizeof(copy_buf->buf)); ++ efx_memcpy_64(*piobuf, copy_buf->buf, sizeof(copy_buf->buf)); + *piobuf += sizeof(copy_buf->buf); + data += copy_to_buf; + len -= copy_to_buf; +@@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct efx_nic *efx, u8 __iomem *piobuf, + { + /* if there's anything in it, write the whole buffer, including junk */ + if (copy_buf->used) +- memcpy_toio(piobuf, copy_buf->buf, sizeof(copy_buf->buf)); ++ efx_memcpy_64(piobuf, copy_buf->buf, sizeof(copy_buf->buf)); + } + + /* Traverse skb structure and copy fragments in to PIO buffer. +@@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue *tx_queue, struct sk_buff *skb) + */ + BUILD_BUG_ON(L1_CACHE_BYTES > + SKB_DATA_ALIGN(sizeof(struct skb_shared_info))); +- memcpy_toio(tx_queue->piobuf, skb->data, +- ALIGN(skb->len, L1_CACHE_BYTES)); ++ efx_memcpy_64(tx_queue->piobuf, skb->data, ++ ALIGN(skb->len, L1_CACHE_BYTES)); + } + + EFX_POPULATE_QWORD_5(buffer->option, +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c +index 20bb66944c4a..5adecc5f52b7 100644 +--- a/drivers/net/macvlan.c ++++ b/drivers/net/macvlan.c +@@ -1043,7 +1043,6 @@ static int macvlan_device_event(struct notifier_block *unused, + list_for_each_entry_safe(vlan, next, &port->vlans, list) + vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill); + unregister_netdevice_many(&list_kill); +- list_del(&list_kill); + break; + case NETDEV_PRE_TYPE_CHANGE: + /* Forbid underlaying device to change its type. */ +diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c +index c8624a8235ab..26d8c29b59de 100644 +--- a/drivers/net/team/team.c ++++ b/drivers/net/team/team.c +@@ -1732,6 +1732,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) + * to traverse list in reverse under rcu_read_lock + */ + mutex_lock(&team->lock); ++ team->port_mtu_change_allowed = true; + list_for_each_entry(port, &team->port_list, list) { + err = dev_set_mtu(port->dev, new_mtu); + if (err) { +@@ -1740,6 +1741,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) + goto unwind; + } + } ++ team->port_mtu_change_allowed = false; + mutex_unlock(&team->lock); + + dev->mtu = new_mtu; +@@ -1749,6 +1751,7 @@ static int team_change_mtu(struct net_device *dev, int new_mtu) + unwind: + list_for_each_entry_continue_reverse(port, &team->port_list, list) + dev_set_mtu(port->dev, dev->mtu); ++ team->port_mtu_change_allowed = false; + mutex_unlock(&team->lock); + + return err; +@@ -2857,7 +2860,9 @@ static int team_device_event(struct notifier_block *unused, + break; + case NETDEV_PRECHANGEMTU: + /* Forbid to change mtu of underlaying device */ +- return NOTIFY_BAD; ++ if (!port->team->port_mtu_change_allowed) ++ return NOTIFY_BAD; ++ break; + case NETDEV_PRE_TYPE_CHANGE: + /* Forbid to change type of underlaying device */ + return NOTIFY_BAD; +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 48c4902c0d62..b71120842c4f 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -752,7 +752,12 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */ + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */ + {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */ +- {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc000, 4)}, /* Olivetti Olicard 100 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc001, 4)}, /* Olivetti Olicard 120 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc002, 4)}, /* Olivetti Olicard 140 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc004, 6)}, /* Olivetti Olicard 155 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */ ++ {QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)}, /* Olivetti Olicard 160 */ + {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */ + {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */ + {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */ +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index d091e52b00e1..40ad25d7f28b 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2282,9 +2282,9 @@ static void vxlan_setup(struct net_device *dev) + eth_hw_addr_random(dev); + ether_setup(dev); + if (vxlan->default_dst.remote_ip.sa.sa_family == AF_INET6) +- dev->hard_header_len = ETH_HLEN + VXLAN6_HEADROOM; ++ dev->needed_headroom = ETH_HLEN + VXLAN6_HEADROOM; + else +- dev->hard_header_len = ETH_HLEN + VXLAN_HEADROOM; ++ dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM; + + dev->netdev_ops = &vxlan_netdev_ops; + dev->destructor = free_netdev; +@@ -2667,8 +2667,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev, + if (!tb[IFLA_MTU]) + dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM); + +- /* update header length based on lower device */ +- dev->hard_header_len = lowerdev->hard_header_len + ++ dev->needed_headroom = lowerdev->hard_header_len + + (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM); + } else if (use_ipv6) + vxlan->flags |= VXLAN_F_IPV6; +diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c +index 3281c90691c3..44fe83ee9bee 100644 +--- a/drivers/rtc/rtc-at91rm9200.c ++++ b/drivers/rtc/rtc-at91rm9200.c +@@ -48,6 +48,7 @@ struct at91_rtc_config { + + static const struct at91_rtc_config *at91_rtc_config; + static DECLARE_COMPLETION(at91_rtc_updated); ++static DECLARE_COMPLETION(at91_rtc_upd_rdy); + static unsigned int at91_alarm_year = AT91_RTC_EPOCH; + static void __iomem *at91_rtc_regs; + static int irq; +@@ -161,6 +162,8 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm) + 1900 + tm->tm_year, tm->tm_mon, tm->tm_mday, + tm->tm_hour, tm->tm_min, tm->tm_sec); + ++ wait_for_completion(&at91_rtc_upd_rdy); ++ + /* Stop Time/Calendar from counting */ + cr = at91_rtc_read(AT91_RTC_CR); + at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM); +@@ -183,7 +186,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm) + + /* Restart Time/Calendar */ + cr = at91_rtc_read(AT91_RTC_CR); ++ at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_SECEV); + at91_rtc_write(AT91_RTC_CR, cr & ~(AT91_RTC_UPDCAL | AT91_RTC_UPDTIM)); ++ at91_rtc_write_ier(AT91_RTC_SECEV); + + return 0; + } +@@ -290,8 +295,10 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id) + if (rtsr) { /* this interrupt is shared! Is it ours? */ + if (rtsr & AT91_RTC_ALARM) + events |= (RTC_AF | RTC_IRQF); +- if (rtsr & AT91_RTC_SECEV) +- events |= (RTC_UF | RTC_IRQF); ++ if (rtsr & AT91_RTC_SECEV) { ++ complete(&at91_rtc_upd_rdy); ++ at91_rtc_write_idr(AT91_RTC_SECEV); ++ } + if (rtsr & AT91_RTC_ACKUPD) + complete(&at91_rtc_updated); + +@@ -413,6 +420,11 @@ static int __init at91_rtc_probe(struct platform_device *pdev) + return PTR_ERR(rtc); + platform_set_drvdata(pdev, rtc); + ++ /* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy ++ * completion. ++ */ ++ at91_rtc_write_ier(AT91_RTC_SECEV); ++ + dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n"); + return 0; + } +diff --git a/drivers/scsi/scsi_netlink.c b/drivers/scsi/scsi_netlink.c +index fe30ea94ffe6..109802f776ed 100644 +--- a/drivers/scsi/scsi_netlink.c ++++ b/drivers/scsi/scsi_netlink.c +@@ -77,7 +77,7 @@ scsi_nl_rcv_msg(struct sk_buff *skb) + goto next_msg; + } + +- if (!capable(CAP_SYS_ADMIN)) { ++ if (!netlink_capable(skb, CAP_SYS_ADMIN)) { + err = -EPERM; + goto next_msg; + } +diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c +index 514844efac75..9ec1df9cff95 100644 +--- a/drivers/staging/iio/adc/mxs-lradc.c ++++ b/drivers/staging/iio/adc/mxs-lradc.c +@@ -846,6 +846,14 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val) + LRADC_CTRL1); + mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0); + ++ /* Enable / disable the divider per requirement */ ++ if (test_bit(chan, &lradc->is_divided)) ++ mxs_lradc_reg_set(lradc, 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, ++ LRADC_CTRL2); ++ else ++ mxs_lradc_reg_clear(lradc, ++ 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, LRADC_CTRL2); ++ + /* Clean the slot's previous content, then set new one. */ + mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(0), LRADC_CTRL4); + mxs_lradc_reg_set(lradc, chan, LRADC_CTRL4); +@@ -964,15 +972,11 @@ static int mxs_lradc_write_raw(struct iio_dev *iio_dev, + if (val == scale_avail[MXS_LRADC_DIV_DISABLED].integer && + val2 == scale_avail[MXS_LRADC_DIV_DISABLED].nano) { + /* divider by two disabled */ +- writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, +- lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_CLR); + clear_bit(chan->channel, &lradc->is_divided); + ret = 0; + } else if (val == scale_avail[MXS_LRADC_DIV_ENABLED].integer && + val2 == scale_avail[MXS_LRADC_DIV_ENABLED].nano) { + /* divider by two enabled */ +- writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, +- lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_SET); + set_bit(chan->channel, &lradc->is_divided); + ret = 0; + } +diff --git a/drivers/staging/iio/light/tsl2x7x_core.c b/drivers/staging/iio/light/tsl2x7x_core.c +index 1e538086d48b..ce1e74e000bb 100644 +--- a/drivers/staging/iio/light/tsl2x7x_core.c ++++ b/drivers/staging/iio/light/tsl2x7x_core.c +@@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_dev *indio_dev) + chip->tsl2x7x_config[TSL2X7X_PRX_COUNT] = + chip->tsl2x7x_settings.prox_pulse_count; + chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] = +- chip->tsl2x7x_settings.prox_thres_low; ++ (chip->tsl2x7x_settings.prox_thres_low) & 0xFF; ++ chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] = ++ (chip->tsl2x7x_settings.prox_thres_low >> 8) & 0xFF; + chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] = +- chip->tsl2x7x_settings.prox_thres_high; ++ (chip->tsl2x7x_settings.prox_thres_high) & 0xFF; ++ chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] = ++ (chip->tsl2x7x_settings.prox_thres_high >> 8) & 0xFF; + + /* and make sure we're not already on */ + if (chip->tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) { +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c +index de77d9aa22c6..6689de6c5591 100644 +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -314,6 +314,16 @@ static int chap_server_compute_md5( + goto out; + } + /* ++ * During mutual authentication, the CHAP_C generated by the ++ * initiator must not match the original CHAP_C generated by ++ * the target. ++ */ ++ if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) { ++ pr_err("initiator CHAP_C matches target CHAP_C, failing" ++ " login attempt\n"); ++ goto out; ++ } ++ /* + * Generate CHAP_N and CHAP_R for mutual authentication. + */ + tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC); +diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c +index 98b48d400a3a..c39cf37800d3 100644 +--- a/drivers/target/target_core_transport.c ++++ b/drivers/target/target_core_transport.c +@@ -2342,6 +2342,10 @@ static void target_release_cmd_kref(struct kref *kref) + */ + int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd) + { ++ if (!se_sess) { ++ se_cmd->se_tfo->release_cmd(se_cmd); ++ return 1; ++ } + return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref, + &se_sess->sess_cmd_lock); + } +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index 7783acabe443..eabccd45f4e8 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -122,13 +122,23 @@ static void acm_release_minor(struct acm *acm) + static int acm_ctrl_msg(struct acm *acm, int request, int value, + void *buf, int len) + { +- int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0), ++ int retval; ++ ++ retval = usb_autopm_get_interface(acm->control); ++ if (retval) ++ return retval; ++ ++ retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0), + request, USB_RT_ACM, value, + acm->control->altsetting[0].desc.bInterfaceNumber, + buf, len, 5000); ++ + dev_dbg(&acm->control->dev, + "%s - rq 0x%02x, val %#x, len %#x, result %d\n", + __func__, request, value, len, retval); ++ ++ usb_autopm_put_interface(acm->control); ++ + return retval < 0 ? retval : 0; + } + +@@ -496,6 +506,7 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + { + struct acm *acm = container_of(port, struct acm, port); + int retval = -ENODEV; ++ int i; + + dev_dbg(&acm->control->dev, "%s\n", __func__); + +@@ -544,6 +555,8 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + return 0; + + error_submit_read_urbs: ++ for (i = 0; i < acm->rx_buflimit; i++) ++ usb_kill_urb(acm->read_urbs[i]); + acm->ctrlout = 0; + acm_set_control(acm, acm->ctrlout); + error_set_control: +@@ -571,21 +584,35 @@ static void acm_port_destruct(struct tty_port *port) + static void acm_port_shutdown(struct tty_port *port) + { + struct acm *acm = container_of(port, struct acm, port); ++ struct urb *urb; ++ struct acm_wb *wb; + int i; ++ int pm_err; + + dev_dbg(&acm->control->dev, "%s\n", __func__); + + mutex_lock(&acm->mutex); + if (!acm->disconnected) { +- usb_autopm_get_interface(acm->control); ++ pm_err = usb_autopm_get_interface(acm->control); + acm_set_control(acm, acm->ctrlout = 0); ++ ++ for (;;) { ++ urb = usb_get_from_anchor(&acm->delayed); ++ if (!urb) ++ break; ++ wb = urb->context; ++ wb->use = 0; ++ usb_autopm_put_interface_async(acm->control); ++ } ++ + usb_kill_urb(acm->ctrlurb); + for (i = 0; i < ACM_NW; i++) + usb_kill_urb(acm->wb[i].urb); + for (i = 0; i < acm->rx_buflimit; i++) + usb_kill_urb(acm->read_urbs[i]); + acm->control->needs_remote_wakeup = 0; +- usb_autopm_put_interface(acm->control); ++ if (!pm_err) ++ usb_autopm_put_interface(acm->control); + } + mutex_unlock(&acm->mutex); + } +@@ -644,14 +671,17 @@ static int acm_tty_write(struct tty_struct *tty, + memcpy(wb->buf, buf, count); + wb->len = count; + +- usb_autopm_get_interface_async(acm->control); ++ stat = usb_autopm_get_interface_async(acm->control); ++ if (stat) { ++ wb->use = 0; ++ spin_unlock_irqrestore(&acm->write_lock, flags); ++ return stat; ++ } ++ + if (acm->susp_count) { +- if (!acm->delayed_wb) +- acm->delayed_wb = wb; +- else +- usb_autopm_put_interface_async(acm->control); ++ usb_anchor_urb(wb->urb, &acm->delayed); + spin_unlock_irqrestore(&acm->write_lock, flags); +- return count; /* A white lie */ ++ return count; + } + usb_mark_last_busy(acm->dev); + +@@ -1267,6 +1297,7 @@ made_compressed_probe: + acm->bInterval = epread->bInterval; + tty_port_init(&acm->port); + acm->port.ops = &acm_port_ops; ++ init_usb_anchor(&acm->delayed); + + buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma); + if (!buf) { +@@ -1512,18 +1543,15 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + struct acm *acm = usb_get_intfdata(intf); + int cnt; + ++ spin_lock_irq(&acm->read_lock); ++ spin_lock(&acm->write_lock); + if (PMSG_IS_AUTO(message)) { +- int b; +- +- spin_lock_irq(&acm->write_lock); +- b = acm->transmitting; +- spin_unlock_irq(&acm->write_lock); +- if (b) ++ if (acm->transmitting) { ++ spin_unlock(&acm->write_lock); ++ spin_unlock_irq(&acm->read_lock); + return -EBUSY; ++ } + } +- +- spin_lock_irq(&acm->read_lock); +- spin_lock(&acm->write_lock); + cnt = acm->susp_count++; + spin_unlock(&acm->write_lock); + spin_unlock_irq(&acm->read_lock); +@@ -1531,8 +1559,7 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + if (cnt) + return 0; + +- if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) +- stop_data_traffic(acm); ++ stop_data_traffic(acm); + + return 0; + } +@@ -1540,29 +1567,24 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message) + static int acm_resume(struct usb_interface *intf) + { + struct acm *acm = usb_get_intfdata(intf); +- struct acm_wb *wb; ++ struct urb *urb; + int rv = 0; +- int cnt; + + spin_lock_irq(&acm->read_lock); +- acm->susp_count -= 1; +- cnt = acm->susp_count; +- spin_unlock_irq(&acm->read_lock); ++ spin_lock(&acm->write_lock); + +- if (cnt) +- return 0; ++ if (--acm->susp_count) ++ goto out; + + if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) { +- rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO); +- +- spin_lock_irq(&acm->write_lock); +- if (acm->delayed_wb) { +- wb = acm->delayed_wb; +- acm->delayed_wb = NULL; +- spin_unlock_irq(&acm->write_lock); +- acm_start_wb(acm, wb); +- } else { +- spin_unlock_irq(&acm->write_lock); ++ rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC); ++ ++ for (;;) { ++ urb = usb_get_from_anchor(&acm->delayed); ++ if (!urb) ++ break; ++ ++ acm_start_wb(acm, urb->context); + } + + /* +@@ -1570,12 +1592,14 @@ static int acm_resume(struct usb_interface *intf) + * do the write path at all cost + */ + if (rv < 0) +- goto err_out; ++ goto out; + +- rv = acm_submit_read_urbs(acm, GFP_NOIO); ++ rv = acm_submit_read_urbs(acm, GFP_ATOMIC); + } ++out: ++ spin_unlock(&acm->write_lock); ++ spin_unlock_irq(&acm->read_lock); + +-err_out: + return rv; + } + +diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h +index e38dc785808f..80826f843e04 100644 +--- a/drivers/usb/class/cdc-acm.h ++++ b/drivers/usb/class/cdc-acm.h +@@ -120,7 +120,7 @@ struct acm { + unsigned int throttled:1; /* actually throttled */ + unsigned int throttle_req:1; /* throttle requested */ + u8 bInterval; +- struct acm_wb *delayed_wb; /* write queued for a device about to be woken */ ++ struct usb_anchor delayed; /* writes queued for a device about to be woken */ + }; + + #define CDC_DATA_INTERFACE_TYPE 0x0a +diff --git a/include/linux/if_team.h b/include/linux/if_team.h +index a899dc24be15..a6aa970758a2 100644 +--- a/include/linux/if_team.h ++++ b/include/linux/if_team.h +@@ -194,6 +194,7 @@ struct team { + bool user_carrier_enabled; + bool queue_override_enabled; + struct list_head *qom_lists; /* array of queue override mapping lists */ ++ bool port_mtu_change_allowed; + struct { + unsigned int count; + unsigned int interval; /* in ms */ +diff --git a/include/linux/netlink.h b/include/linux/netlink.h +index aad8eeaf416d..034cda789a15 100644 +--- a/include/linux/netlink.h ++++ b/include/linux/netlink.h +@@ -16,9 +16,10 @@ static inline struct nlmsghdr *nlmsg_hdr(const struct sk_buff *skb) + } + + enum netlink_skb_flags { +- NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */ +- NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */ +- NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */ ++ NETLINK_SKB_MMAPED = 0x1, /* Packet data is mmaped */ ++ NETLINK_SKB_TX = 0x2, /* Packet was sent by userspace */ ++ NETLINK_SKB_DELIVERED = 0x4, /* Packet was delivered */ ++ NETLINK_SKB_DST = 0x8, /* Dst set in sendto or sendmsg */ + }; + + struct netlink_skb_parms { +@@ -169,4 +170,11 @@ struct netlink_tap { + extern int netlink_add_tap(struct netlink_tap *nt); + extern int netlink_remove_tap(struct netlink_tap *nt); + ++bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, ++ struct user_namespace *ns, int cap); ++bool netlink_ns_capable(const struct sk_buff *skb, ++ struct user_namespace *ns, int cap); ++bool netlink_capable(const struct sk_buff *skb, int cap); ++bool netlink_net_capable(const struct sk_buff *skb, int cap); ++ + #endif /* __LINUX_NETLINK_H */ +diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h +index 302ab805b0bb..46cca4c06848 100644 +--- a/include/linux/sock_diag.h ++++ b/include/linux/sock_diag.h +@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie); + void sock_diag_save_cookie(void *sk, __u32 *cookie); + + int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr); +-int sock_diag_put_filterinfo(struct sock *sk, ++int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk, + struct sk_buff *skb, int attrtype); + + #endif +diff --git a/include/net/inetpeer.h b/include/net/inetpeer.h +index 6efe73c79c52..058271bde27a 100644 +--- a/include/net/inetpeer.h ++++ b/include/net/inetpeer.h +@@ -177,16 +177,9 @@ static inline void inet_peer_refcheck(const struct inet_peer *p) + /* can be called with or without local BH being disabled */ + static inline int inet_getid(struct inet_peer *p, int more) + { +- int old, new; + more++; + inet_peer_refcheck(p); +- do { +- old = atomic_read(&p->ip_id_count); +- new = old + more; +- if (!new) +- new = 1; +- } while (atomic_cmpxchg(&p->ip_id_count, old, new) != old); +- return new; ++ return atomic_add_return(more, &p->ip_id_count) - more; + } + + #endif /* _NET_INETPEER_H */ +diff --git a/include/net/sock.h b/include/net/sock.h +index b9586a137cad..57c31dd15e64 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -2278,6 +2278,11 @@ int sock_get_timestampns(struct sock *, struct timespec __user *); + int sock_recv_errqueue(struct sock *sk, struct msghdr *msg, int len, int level, + int type); + ++bool sk_ns_capable(const struct sock *sk, ++ struct user_namespace *user_ns, int cap); ++bool sk_capable(const struct sock *sk, int cap); ++bool sk_net_capable(const struct sock *sk, int cap); ++ + /* + * Enable debug/info messages + */ +diff --git a/include/sound/core.h b/include/sound/core.h +index 2a14f1f02d4f..d6bc9616058b 100644 +--- a/include/sound/core.h ++++ b/include/sound/core.h +@@ -121,6 +121,8 @@ struct snd_card { + int user_ctl_count; /* count of all user controls */ + struct list_head controls; /* all controls for this card */ + struct list_head ctl_files; /* active control files */ ++ struct mutex user_ctl_lock; /* protects user controls against ++ concurrent access */ + + struct snd_info_entry *proc_root; /* root for soundcard specific files */ + struct snd_info_entry *proc_id; /* the card id */ +diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h +index 5759810e1c1b..21eed488783f 100644 +--- a/include/uapi/sound/compress_offload.h ++++ b/include/uapi/sound/compress_offload.h +@@ -80,7 +80,7 @@ struct snd_compr_tstamp { + struct snd_compr_avail { + __u64 avail; + struct snd_compr_tstamp tstamp; +-}; ++} __attribute__((packed)); + + enum snd_compr_direction { + SND_COMPRESS_PLAYBACK = 0, +diff --git a/kernel/audit.c b/kernel/audit.c +index d5f31c17813a..0c9dc860cc15 100644 +--- a/kernel/audit.c ++++ b/kernel/audit.c +@@ -639,13 +639,13 @@ static int audit_netlink_ok(struct sk_buff *skb, u16 msg_type) + case AUDIT_TTY_SET: + case AUDIT_TRIM: + case AUDIT_MAKE_EQUIV: +- if (!capable(CAP_AUDIT_CONTROL)) ++ if (!netlink_capable(skb, CAP_AUDIT_CONTROL)) + err = -EPERM; + break; + case AUDIT_USER: + case AUDIT_FIRST_USER_MSG ... AUDIT_LAST_USER_MSG: + case AUDIT_FIRST_USER_MSG2 ... AUDIT_LAST_USER_MSG2: +- if (!capable(CAP_AUDIT_WRITE)) ++ if (!netlink_capable(skb, CAP_AUDIT_WRITE)) + err = -EPERM; + break; + default: /* bad msg */ +diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c +index df6839e3ce08..99a03acb7d47 100644 +--- a/lib/lz4/lz4_decompress.c ++++ b/lib/lz4/lz4_decompress.c +@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize) + len = *ip++; + for (; len == 255; length += 255) + len = *ip++; ++ if (unlikely(length > (size_t)(length + len))) ++ goto _output_error; + length += len; + } + +diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c +index 569985d522d5..8563081e8da3 100644 +--- a/lib/lzo/lzo1x_decompress_safe.c ++++ b/lib/lzo/lzo1x_decompress_safe.c +@@ -19,11 +19,31 @@ + #include + #include "lzodefs.h" + +-#define HAVE_IP(x) ((size_t)(ip_end - ip) >= (size_t)(x)) +-#define HAVE_OP(x) ((size_t)(op_end - op) >= (size_t)(x)) +-#define NEED_IP(x) if (!HAVE_IP(x)) goto input_overrun +-#define NEED_OP(x) if (!HAVE_OP(x)) goto output_overrun +-#define TEST_LB(m_pos) if ((m_pos) < out) goto lookbehind_overrun ++#define HAVE_IP(t, x) \ ++ (((size_t)(ip_end - ip) >= (size_t)(t + x)) && \ ++ (((t + x) >= t) && ((t + x) >= x))) ++ ++#define HAVE_OP(t, x) \ ++ (((size_t)(op_end - op) >= (size_t)(t + x)) && \ ++ (((t + x) >= t) && ((t + x) >= x))) ++ ++#define NEED_IP(t, x) \ ++ do { \ ++ if (!HAVE_IP(t, x)) \ ++ goto input_overrun; \ ++ } while (0) ++ ++#define NEED_OP(t, x) \ ++ do { \ ++ if (!HAVE_OP(t, x)) \ ++ goto output_overrun; \ ++ } while (0) ++ ++#define TEST_LB(m_pos) \ ++ do { \ ++ if ((m_pos) < out) \ ++ goto lookbehind_overrun; \ ++ } while (0) + + int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, + unsigned char *out, size_t *out_len) +@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len, + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 15 + *ip++; + } + t += 3; + copy_literal_run: + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) +- if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) { ++ if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) { + const unsigned char *ie = ip + t; + unsigned char *oe = op + t; + do { +@@ -81,8 +101,8 @@ copy_literal_run: + } else + #endif + { +- NEED_OP(t); +- NEED_IP(t + 3); ++ NEED_OP(t, 0); ++ NEED_IP(t, 3); + do { + *op++ = *ip++; + } while (--t > 0); +@@ -95,7 +115,7 @@ copy_literal_run: + m_pos -= t >> 2; + m_pos -= *ip++ << 2; + TEST_LB(m_pos); +- NEED_OP(2); ++ NEED_OP(2, 0); + op[0] = m_pos[0]; + op[1] = m_pos[1]; + op += 2; +@@ -119,10 +139,10 @@ copy_literal_run: + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 31 + *ip++; +- NEED_IP(2); ++ NEED_IP(2, 0); + } + m_pos = op - 1; + next = get_unaligned_le16(ip); +@@ -137,10 +157,10 @@ copy_literal_run: + while (unlikely(*ip == 0)) { + t += 255; + ip++; +- NEED_IP(1); ++ NEED_IP(1, 0); + } + t += 7 + *ip++; +- NEED_IP(2); ++ NEED_IP(2, 0); + } + next = get_unaligned_le16(ip); + ip += 2; +@@ -154,7 +174,7 @@ copy_literal_run: + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) + if (op - m_pos >= 8) { + unsigned char *oe = op + t; +- if (likely(HAVE_OP(t + 15))) { ++ if (likely(HAVE_OP(t, 15))) { + do { + COPY8(op, m_pos); + op += 8; +@@ -164,7 +184,7 @@ copy_literal_run: + m_pos += 8; + } while (op < oe); + op = oe; +- if (HAVE_IP(6)) { ++ if (HAVE_IP(6, 0)) { + state = next; + COPY4(op, ip); + op += next; +@@ -172,7 +192,7 @@ copy_literal_run: + continue; + } + } else { +- NEED_OP(t); ++ NEED_OP(t, 0); + do { + *op++ = *m_pos++; + } while (op < oe); +@@ -181,7 +201,7 @@ copy_literal_run: + #endif + { + unsigned char *oe = op + t; +- NEED_OP(t); ++ NEED_OP(t, 0); + op[0] = m_pos[0]; + op[1] = m_pos[1]; + op += 2; +@@ -194,15 +214,15 @@ match_next: + state = next; + t = next; + #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) +- if (likely(HAVE_IP(6) && HAVE_OP(4))) { ++ if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) { + COPY4(op, ip); + op += t; + ip += t; + } else + #endif + { +- NEED_IP(t + 3); +- NEED_OP(t); ++ NEED_IP(t, 3); ++ NEED_OP(t, 0); + while (t > 0) { + *op++ = *ip++; + t--; +diff --git a/lib/nlattr.c b/lib/nlattr.c +index fc6754720ced..10ad042d01be 100644 +--- a/lib/nlattr.c ++++ b/lib/nlattr.c +@@ -201,8 +201,8 @@ int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head, + } + + if (unlikely(rem > 0)) +- printk(KERN_WARNING "netlink: %d bytes leftover after parsing " +- "attributes.\n", rem); ++ pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n", ++ rem, current->comm); + + err = 0; + errout: +diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c +index 7985deaff52f..04d6348fd530 100644 +--- a/net/bridge/br_input.c ++++ b/net/bridge/br_input.c +@@ -147,8 +147,8 @@ static int br_handle_local_finish(struct sk_buff *skb) + struct net_bridge_port *p = br_port_get_rcu(skb->dev); + u16 vid = 0; + +- br_vlan_get_tag(skb, &vid); +- if (p->flags & BR_LEARNING) ++ /* check if vlan is allowed, to avoid spoofing */ ++ if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid)) + br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false); + return 0; /* process further */ + } +diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h +index 3ba11bc99b65..f2d254b69353 100644 +--- a/net/bridge/br_private.h ++++ b/net/bridge/br_private.h +@@ -581,6 +581,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v, + struct sk_buff *skb, u16 *vid); + bool br_allowed_egress(struct net_bridge *br, const struct net_port_vlans *v, + const struct sk_buff *skb); ++bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid); + struct sk_buff *br_handle_vlan(struct net_bridge *br, + const struct net_port_vlans *v, + struct sk_buff *skb); +@@ -648,6 +649,12 @@ static inline bool br_allowed_egress(struct net_bridge *br, + return true; + } + ++static inline bool br_should_learn(struct net_bridge_port *p, ++ struct sk_buff *skb, u16 *vid) ++{ ++ return true; ++} ++ + static inline struct sk_buff *br_handle_vlan(struct net_bridge *br, + const struct net_port_vlans *v, + struct sk_buff *skb) +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c +index ba7757b7737d..b1c637208497 100644 +--- a/net/bridge/br_vlan.c ++++ b/net/bridge/br_vlan.c +@@ -241,6 +241,34 @@ bool br_allowed_egress(struct net_bridge *br, + return false; + } + ++/* Called under RCU */ ++bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid) ++{ ++ struct net_bridge *br = p->br; ++ struct net_port_vlans *v; ++ ++ if (!br->vlan_enabled) ++ return true; ++ ++ v = rcu_dereference(p->vlan_info); ++ if (!v) ++ return false; ++ ++ br_vlan_get_tag(skb, vid); ++ if (!*vid) { ++ *vid = br_get_pvid(v); ++ if (*vid == VLAN_N_VID) ++ return false; ++ ++ return true; ++ } ++ ++ if (test_bit(*vid, v->vlan_bitmap)) ++ return true; ++ ++ return false; ++} ++ + /* Must be protected by RTNL. + * Must be called with vid in range from 1 to 4094 inclusive. + */ +diff --git a/net/can/gw.c b/net/can/gw.c +index ac31891967da..050a2110d43f 100644 +--- a/net/can/gw.c ++++ b/net/can/gw.c +@@ -804,7 +804,7 @@ static int cgw_create_job(struct sk_buff *skb, struct nlmsghdr *nlh) + u8 limhops = 0; + int err = 0; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (nlmsg_len(nlh) < sizeof(*r)) +@@ -893,7 +893,7 @@ static int cgw_remove_job(struct sk_buff *skb, struct nlmsghdr *nlh) + u8 limhops = 0; + int err = 0; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (nlmsg_len(nlh) < sizeof(*r)) +diff --git a/net/core/dev.c b/net/core/dev.c +index fccc195e0fc8..4c1b483f7c07 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -6548,6 +6548,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue); + /** + * unregister_netdevice_many - unregister many devices + * @head: list of devices ++ * ++ * Note: As most callers use a stack allocated list_head, ++ * we force a list_del() to make sure stack wont be corrupted later. + */ + void unregister_netdevice_many(struct list_head *head) + { +@@ -6557,6 +6560,7 @@ void unregister_netdevice_many(struct list_head *head) + rollback_registered_many(head); + list_for_each_entry(dev, head, unreg_list) + net_set_todo(dev); ++ list_del(head); + } + } + EXPORT_SYMBOL(unregister_netdevice_many); +@@ -7012,7 +7016,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) + } + } + unregister_netdevice_many(&dev_kill_list); +- list_del(&dev_kill_list); + rtnl_unlock(); + } + +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index 83b9d6ae5119..aef1500ebc05 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -1166,6 +1166,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) + struct nlattr *tb[IFLA_MAX+1]; + u32 ext_filter_mask = 0; + int err; ++ int hdrlen; + + s_h = cb->args[0]; + s_idx = cb->args[1]; +@@ -1173,8 +1174,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb) + rcu_read_lock(); + cb->seq = net->dev_base_seq; + +- if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX, +- ifla_policy) >= 0) { ++ /* A hack to preserve kernel<->userspace interface. ++ * The correct header is ifinfomsg. It is consistent with rtnl_getlink. ++ * However, before Linux v3.9 the code here assumed rtgenmsg and that's ++ * what iproute2 < v3.9.0 used. ++ * We can detect the old iproute2. Even including the IFLA_EXT_MASK ++ * attribute, its netlink message is shorter than struct ifinfomsg. ++ */ ++ hdrlen = nlmsg_len(cb->nlh) < sizeof(struct ifinfomsg) ? ++ sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg); ++ ++ if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) { + + if (tb[IFLA_EXT_MASK]) + ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]); +@@ -1428,7 +1438,8 @@ static int do_set_master(struct net_device *dev, int ifindex) + return 0; + } + +-static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, ++static int do_setlink(const struct sk_buff *skb, ++ struct net_device *dev, struct ifinfomsg *ifm, + struct nlattr **tb, char *ifname, int modified) + { + const struct net_device_ops *ops = dev->netdev_ops; +@@ -1440,7 +1451,7 @@ static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, + err = PTR_ERR(net); + goto errout; + } +- if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { ++ if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) { + err = -EPERM; + goto errout; + } +@@ -1694,7 +1705,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh) + if (err < 0) + goto errout; + +- err = do_setlink(dev, ifm, tb, ifname, 0); ++ err = do_setlink(skb, dev, ifm, tb, ifname, 0); + errout: + return err; + } +@@ -1734,7 +1745,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh) + + ops->dellink(dev, &list_kill); + unregister_netdevice_many(&list_kill); +- list_del(&list_kill); + return 0; + } + +@@ -1811,7 +1821,8 @@ err: + } + EXPORT_SYMBOL(rtnl_create_link); + +-static int rtnl_group_changelink(struct net *net, int group, ++static int rtnl_group_changelink(const struct sk_buff *skb, ++ struct net *net, int group, + struct ifinfomsg *ifm, + struct nlattr **tb) + { +@@ -1820,7 +1831,7 @@ static int rtnl_group_changelink(struct net *net, int group, + + for_each_netdev(net, dev) { + if (dev->group == group) { +- err = do_setlink(dev, ifm, tb, NULL, 0); ++ err = do_setlink(skb, dev, ifm, tb, NULL, 0); + if (err < 0) + return err; + } +@@ -1962,12 +1973,12 @@ replay: + modified = 1; + } + +- return do_setlink(dev, ifm, tb, ifname, modified); ++ return do_setlink(skb, dev, ifm, tb, ifname, modified); + } + + if (!(nlh->nlmsg_flags & NLM_F_CREATE)) { + if (ifm->ifi_index == 0 && tb[IFLA_GROUP]) +- return rtnl_group_changelink(net, ++ return rtnl_group_changelink(skb, net, + nla_get_u32(tb[IFLA_GROUP]), + ifm, tb); + return -ENODEV; +@@ -2084,9 +2095,13 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlattr *tb[IFLA_MAX+1]; + u32 ext_filter_mask = 0; + u16 min_ifinfo_dump_size = 0; ++ int hdrlen; ++ ++ /* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */ ++ hdrlen = nlmsg_len(nlh) < sizeof(struct ifinfomsg) ? ++ sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg); + +- if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX, +- ifla_policy) >= 0) { ++ if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) { + if (tb[IFLA_EXT_MASK]) + ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]); + } +@@ -2354,7 +2369,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh) + int err = -EINVAL; + __u8 *addr; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + err = nlmsg_parse(nlh, sizeof(*ndm), tb, NDA_MAX, NULL); +@@ -2806,7 +2821,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + sz_idx = type>>2; + kind = type&3; + +- if (kind != 2 && !ns_capable(net->user_ns, CAP_NET_ADMIN)) ++ if (kind != 2 && !netlink_net_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) { +diff --git a/net/core/sock.c b/net/core/sock.c +index c0fc6bdad1e3..c8069561bdb7 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -145,6 +145,55 @@ + static DEFINE_MUTEX(proto_list_mutex); + static LIST_HEAD(proto_list); + ++/** ++ * sk_ns_capable - General socket capability test ++ * @sk: Socket to use a capability on or through ++ * @user_ns: The user namespace of the capability to use ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket had when the socket was ++ * created and the current process has the capability @cap in the user ++ * namespace @user_ns. ++ */ ++bool sk_ns_capable(const struct sock *sk, ++ struct user_namespace *user_ns, int cap) ++{ ++ return file_ns_capable(sk->sk_socket->file, user_ns, cap) && ++ ns_capable(user_ns, cap); ++} ++EXPORT_SYMBOL(sk_ns_capable); ++ ++/** ++ * sk_capable - Socket global capability test ++ * @sk: Socket to use a capability on or through ++ * @cap: The global capbility to use ++ * ++ * Test to see if the opener of the socket had when the socket was ++ * created and the current process has the capability @cap in all user ++ * namespaces. ++ */ ++bool sk_capable(const struct sock *sk, int cap) ++{ ++ return sk_ns_capable(sk, &init_user_ns, cap); ++} ++EXPORT_SYMBOL(sk_capable); ++ ++/** ++ * sk_net_capable - Network namespace socket capability test ++ * @sk: Socket to use a capability on or through ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket had when the socke was created ++ * and the current process has the capability @cap over the network namespace ++ * the socket is a member of. ++ */ ++bool sk_net_capable(const struct sock *sk, int cap) ++{ ++ return sk_ns_capable(sk, sock_net(sk)->user_ns, cap); ++} ++EXPORT_SYMBOL(sk_net_capable); ++ ++ + #ifdef CONFIG_MEMCG_KMEM + int mem_cgroup_sockets_init(struct mem_cgroup *memcg, struct cgroup_subsys *ss) + { +diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c +index 6a7fae228634..c38e7a2b5a8e 100644 +--- a/net/core/sock_diag.c ++++ b/net/core/sock_diag.c +@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype) + } + EXPORT_SYMBOL_GPL(sock_diag_put_meminfo); + +-int sock_diag_put_filterinfo(struct sock *sk, ++int sock_diag_put_filterinfo(bool may_report_filterinfo, struct sock *sk, + struct sk_buff *skb, int attrtype) + { + struct nlattr *attr; +@@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct sock *sk, + unsigned int len; + int err = 0; + +- if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) { ++ if (!may_report_filterinfo) { + nla_reserve(skb, attrtype, 0); + return 0; + } +diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c +index 553644402670..f8b98d89c285 100644 +--- a/net/dcb/dcbnl.c ++++ b/net/dcb/dcbnl.c +@@ -1669,7 +1669,7 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlmsghdr *reply_nlh = NULL; + const struct reply_func *fn; + +- if ((nlh->nlmsg_type == RTM_SETDCB) && !capable(CAP_NET_ADMIN)) ++ if ((nlh->nlmsg_type == RTM_SETDCB) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + ret = nlmsg_parse(nlh, sizeof(*dcb), tb, DCB_ATTR_MAX, +diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c +index a603823a3e27..3b726f31c64c 100644 +--- a/net/decnet/dn_dev.c ++++ b/net/decnet/dn_dev.c +@@ -574,7 +574,7 @@ static int dn_nl_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh) + struct dn_ifaddr __rcu **ifap; + int err = -EINVAL; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (!net_eq(net, &init_net)) +@@ -618,7 +618,7 @@ static int dn_nl_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh) + struct dn_ifaddr *ifa; + int err; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (!net_eq(net, &init_net)) +diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c +index 57dc159245ec..d332aefb0846 100644 +--- a/net/decnet/dn_fib.c ++++ b/net/decnet/dn_fib.c +@@ -505,7 +505,7 @@ static int dn_fib_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlattr *attrs[RTA_MAX+1]; + int err; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (!net_eq(net, &init_net)) +@@ -530,7 +530,7 @@ static int dn_fib_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh) + struct nlattr *attrs[RTA_MAX+1]; + int err; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if (!net_eq(net, &init_net)) +diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c +index e83015cecfa7..e4d9560a910b 100644 +--- a/net/decnet/netfilter/dn_rtmsg.c ++++ b/net/decnet/netfilter/dn_rtmsg.c +@@ -107,7 +107,7 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb) + if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) + return; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + RCV_SKB_FAIL(-EPERM); + + /* Eventually we might send routing messages too */ +diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c +index 8b5134c582f1..a3095fdefbed 100644 +--- a/net/ipv4/datagram.c ++++ b/net/ipv4/datagram.c +@@ -86,18 +86,26 @@ out: + } + EXPORT_SYMBOL(ip4_datagram_connect); + ++/* Because UDP xmit path can manipulate sk_dst_cache without holding ++ * socket lock, we need to use sk_dst_set() here, ++ * even if we own the socket lock. ++ */ + void ip4_datagram_release_cb(struct sock *sk) + { + const struct inet_sock *inet = inet_sk(sk); + const struct ip_options_rcu *inet_opt; + __be32 daddr = inet->inet_daddr; ++ struct dst_entry *dst; + struct flowi4 fl4; + struct rtable *rt; + +- if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0)) +- return; +- + rcu_read_lock(); ++ ++ dst = __sk_dst_get(sk); ++ if (!dst || !dst->obsolete || dst->ops->check(dst, 0)) { ++ rcu_read_unlock(); ++ return; ++ } + inet_opt = rcu_dereference(inet->inet_opt); + if (inet_opt && inet_opt->opt.srr) + daddr = inet_opt->opt.faddr; +@@ -105,8 +113,10 @@ void ip4_datagram_release_cb(struct sock *sk) + inet->inet_saddr, inet->inet_dport, + inet->inet_sport, sk->sk_protocol, + RT_CONN_FLAGS(sk), sk->sk_bound_dev_if); +- if (!IS_ERR(rt)) +- __sk_dst_set(sk, &rt->dst); ++ ++ dst = !IS_ERR(rt) ? &rt->dst : NULL; ++ sk_dst_set(sk, dst); ++ + rcu_read_unlock(); + } + EXPORT_SYMBOL_GPL(ip4_datagram_release_cb); +diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c +index 812b18351462..62eaa005e146 100644 +--- a/net/ipv4/ipip.c ++++ b/net/ipv4/ipip.c +@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb, u32 info) + + if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { + ipv4_update_pmtu(skb, dev_net(skb->dev), info, +- t->dev->ifindex, 0, IPPROTO_IPIP, 0); ++ t->parms.link, 0, IPPROTO_IPIP, 0); + err = 0; + goto out; + } + + if (type == ICMP_REDIRECT) { +- ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0, ++ ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, + IPPROTO_IPIP, 0); + err = 0; + goto out; +@@ -486,4 +486,5 @@ static void __exit ipip_fini(void) + module_init(ipip_init); + module_exit(ipip_fini); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("ipip"); + MODULE_ALIAS_NETDEV("tunl0"); +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index eeaac399420d..e3647465138b 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -2683,13 +2683,12 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack) + bool recovered = !before(tp->snd_una, tp->high_seq); + + if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */ +- if (flag & FLAG_ORIG_SACK_ACKED) { +- /* Step 3.b. A timeout is spurious if not all data are +- * lost, i.e., never-retransmitted data are (s)acked. +- */ +- tcp_try_undo_loss(sk, true); ++ /* Step 3.b. A timeout is spurious if not all data are ++ * lost, i.e., never-retransmitted data are (s)acked. ++ */ ++ if (tcp_try_undo_loss(sk, flag & FLAG_ORIG_SACK_ACKED)) + return; +- } ++ + if (after(tp->snd_nxt, tp->high_seq) && + (flag & FLAG_DATA_SACKED || is_dupack)) { + tp->frto = 0; /* Loss was real: 2nd part of step 3.a */ +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 77bd16fa9f34..b25e852625d8 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1833,6 +1833,10 @@ static struct sock *__udp4_lib_mcast_demux_lookup(struct net *net, + unsigned int count, slot = udp_hashfn(net, hnum, udp_table.mask); + struct udp_hslot *hslot = &udp_table.hash[slot]; + ++ /* Do not bother scanning a too big list */ ++ if (hslot->count > 10) ++ return NULL; ++ + rcu_read_lock(); + begin: + count = 0; +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 0e51f68ab163..912033957ad3 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -61,6 +61,7 @@ + MODULE_AUTHOR("Ville Nuorvala"); + MODULE_DESCRIPTION("IPv6 tunneling device"); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("ip6tnl"); + MODULE_ALIAS_NETDEV("ip6tnl0"); + + #ifdef IP6_TNL_DEBUG +diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c +index 827f795209cf..b31a01263185 100644 +--- a/net/ipv6/output_core.c ++++ b/net/ipv6/output_core.c +@@ -10,7 +10,7 @@ + void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) + { + static atomic_t ipv6_fragmentation_id; +- int old, new; ++ int ident; + + #if IS_ENABLED(CONFIG_IPV6) + if (rt && !(rt->dst.flags & DST_NOPEER)) { +@@ -26,13 +26,8 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt) + } + } + #endif +- do { +- old = atomic_read(&ipv6_fragmentation_id); +- new = old + 1; +- if (!new) +- new = 1; +- } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old); +- fhdr->identification = htonl(new); ++ ident = atomic_inc_return(&ipv6_fragmentation_id); ++ fhdr->identification = htonl(ident); + } + EXPORT_SYMBOL(ipv6_select_ident); + +diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c +index b4d74c86586c..fe548ba72687 100644 +--- a/net/ipv6/sit.c ++++ b/net/ipv6/sit.c +@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb, u32 info) + + if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) { + ipv4_update_pmtu(skb, dev_net(skb->dev), info, +- t->dev->ifindex, 0, IPPROTO_IPV6, 0); ++ t->parms.link, 0, IPPROTO_IPV6, 0); + err = 0; + goto out; + } + if (type == ICMP_REDIRECT) { +- ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0, ++ ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0, + IPPROTO_IPV6, 0); + err = 0; + goto out; +@@ -1850,4 +1850,5 @@ xfrm_tunnel_failed: + module_init(sit_init); + module_exit(sit_cleanup); + MODULE_LICENSE("GPL"); ++MODULE_ALIAS_RTNL_LINK("sit"); + MODULE_ALIAS_NETDEV("sit0"); +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 1e586d92260e..20b63d2ab70f 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk, + if (inet->inet_dport != rmt_port) + continue; + } +- if (!ipv6_addr_any(&sk->sk_v6_daddr) && +- !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr)) ++ if (!ipv6_addr_any(&s->sk_v6_daddr) && ++ !ipv6_addr_equal(&s->sk_v6_daddr, rmt_addr)) + continue; + + if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif) + continue; + +- if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) { +- if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr)) ++ if (!ipv6_addr_any(&s->sk_v6_rcv_saddr)) { ++ if (!ipv6_addr_equal(&s->sk_v6_rcv_saddr, loc_addr)) + continue; + } + if (!inet6_mc_check(s, loc_addr, rmt_addr)) +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index ce1c44370610..8f7fabc46c97 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -1761,7 +1761,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local) + } + mutex_unlock(&local->iflist_mtx); + unregister_netdevice_many(&unreg_list); +- list_del(&unreg_list); + + list_for_each_entry_safe(sdata, tmp, &wdev_list, list) { + list_del(&sdata->list); +diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c +index 880418d3ee50..bf8a108b46e2 100644 +--- a/net/netfilter/nfnetlink.c ++++ b/net/netfilter/nfnetlink.c +@@ -367,7 +367,7 @@ static void nfnetlink_rcv(struct sk_buff *skb) + skb->len < nlh->nlmsg_len) + return; + +- if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) { ++ if (!netlink_net_capable(skb, CAP_NET_ADMIN)) { + netlink_ack(skb, nlh, -EPERM); + return; + } +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index 04748ab649c2..7f40fd25acae 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -1360,7 +1360,74 @@ retry: + return err; + } + +-static inline int netlink_capable(const struct socket *sock, unsigned int flag) ++/** ++ * __netlink_ns_capable - General netlink message capability test ++ * @nsp: NETLINK_CB of the socket buffer holding a netlink command from userspace. ++ * @user_ns: The user namespace of the capability to use ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket we received the message ++ * from had when the netlink socket was created and the sender of the ++ * message has has the capability @cap in the user namespace @user_ns. ++ */ ++bool __netlink_ns_capable(const struct netlink_skb_parms *nsp, ++ struct user_namespace *user_ns, int cap) ++{ ++ return ((nsp->flags & NETLINK_SKB_DST) || ++ file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) && ++ ns_capable(user_ns, cap); ++} ++EXPORT_SYMBOL(__netlink_ns_capable); ++ ++/** ++ * netlink_ns_capable - General netlink message capability test ++ * @skb: socket buffer holding a netlink command from userspace ++ * @user_ns: The user namespace of the capability to use ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket we received the message ++ * from had when the netlink socket was created and the sender of the ++ * message has has the capability @cap in the user namespace @user_ns. ++ */ ++bool netlink_ns_capable(const struct sk_buff *skb, ++ struct user_namespace *user_ns, int cap) ++{ ++ return __netlink_ns_capable(&NETLINK_CB(skb), user_ns, cap); ++} ++EXPORT_SYMBOL(netlink_ns_capable); ++ ++/** ++ * netlink_capable - Netlink global message capability test ++ * @skb: socket buffer holding a netlink command from userspace ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket we received the message ++ * from had when the netlink socket was created and the sender of the ++ * message has has the capability @cap in all user namespaces. ++ */ ++bool netlink_capable(const struct sk_buff *skb, int cap) ++{ ++ return netlink_ns_capable(skb, &init_user_ns, cap); ++} ++EXPORT_SYMBOL(netlink_capable); ++ ++/** ++ * netlink_net_capable - Netlink network namespace message capability test ++ * @skb: socket buffer holding a netlink command from userspace ++ * @cap: The capability to use ++ * ++ * Test to see if the opener of the socket we received the message ++ * from had when the netlink socket was created and the sender of the ++ * message has has the capability @cap over the network namespace of ++ * the socket we received the message from. ++ */ ++bool netlink_net_capable(const struct sk_buff *skb, int cap) ++{ ++ return netlink_ns_capable(skb, sock_net(skb->sk)->user_ns, cap); ++} ++EXPORT_SYMBOL(netlink_net_capable); ++ ++static inline int netlink_allowed(const struct socket *sock, unsigned int flag) + { + return (nl_table[sock->sk->sk_protocol].flags & flag) || + ns_capable(sock_net(sock->sk)->user_ns, CAP_NET_ADMIN); +@@ -1428,7 +1495,7 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr, + + /* Only superuser is allowed to listen multicasts */ + if (nladdr->nl_groups) { +- if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV)) ++ if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) + return -EPERM; + err = netlink_realloc_groups(sk); + if (err) +@@ -1490,7 +1557,7 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr, + return -EINVAL; + + if ((nladdr->nl_groups || nladdr->nl_pid) && +- !netlink_capable(sock, NL_CFG_F_NONROOT_SEND)) ++ !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) + return -EPERM; + + if (!nlk->portid) +@@ -2096,7 +2163,7 @@ static int netlink_setsockopt(struct socket *sock, int level, int optname, + break; + case NETLINK_ADD_MEMBERSHIP: + case NETLINK_DROP_MEMBERSHIP: { +- if (!netlink_capable(sock, NL_CFG_F_NONROOT_RECV)) ++ if (!netlink_allowed(sock, NL_CFG_F_NONROOT_RECV)) + return -EPERM; + err = netlink_realloc_groups(sk); + if (err) +@@ -2228,6 +2295,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, + struct sk_buff *skb; + int err; + struct scm_cookie scm; ++ u32 netlink_skb_flags = 0; + + if (msg->msg_flags&MSG_OOB) + return -EOPNOTSUPP; +@@ -2247,8 +2315,9 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, + dst_group = ffs(addr->nl_groups); + err = -EPERM; + if ((dst_group || dst_portid) && +- !netlink_capable(sock, NL_CFG_F_NONROOT_SEND)) ++ !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND)) + goto out; ++ netlink_skb_flags |= NETLINK_SKB_DST; + } else { + dst_portid = nlk->dst_portid; + dst_group = nlk->dst_group; +@@ -2278,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock, + NETLINK_CB(skb).portid = nlk->portid; + NETLINK_CB(skb).dst_group = dst_group; + NETLINK_CB(skb).creds = siocb->scm->creds; ++ NETLINK_CB(skb).flags = netlink_skb_flags; + + err = -EFAULT; + if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) { +diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c +index b1dcdb932a86..a3ba3ca0ff92 100644 +--- a/net/netlink/genetlink.c ++++ b/net/netlink/genetlink.c +@@ -561,7 +561,7 @@ static int genl_family_rcv_msg(struct genl_family *family, + return -EOPNOTSUPP; + + if ((ops->flags & GENL_ADMIN_PERM) && +- !capable(CAP_NET_ADMIN)) ++ !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if ((nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) { +diff --git a/net/packet/diag.c b/net/packet/diag.c +index 435ff99ba8c7..92f2c7107eec 100644 +--- a/net/packet/diag.c ++++ b/net/packet/diag.c +@@ -128,6 +128,7 @@ static int pdiag_put_fanout(struct packet_sock *po, struct sk_buff *nlskb) + + static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, + struct packet_diag_req *req, ++ bool may_report_filterinfo, + struct user_namespace *user_ns, + u32 portid, u32 seq, u32 flags, int sk_ino) + { +@@ -172,7 +173,8 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, + goto out_nlmsg_trim; + + if ((req->pdiag_show & PACKET_SHOW_FILTER) && +- sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER)) ++ sock_diag_put_filterinfo(may_report_filterinfo, sk, skb, ++ PACKET_DIAG_FILTER)) + goto out_nlmsg_trim; + + return nlmsg_end(skb, nlh); +@@ -188,9 +190,11 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) + struct packet_diag_req *req; + struct net *net; + struct sock *sk; ++ bool may_report_filterinfo; + + net = sock_net(skb->sk); + req = nlmsg_data(cb->nlh); ++ may_report_filterinfo = netlink_net_capable(cb->skb, CAP_NET_ADMIN); + + mutex_lock(&net->packet.sklist_lock); + sk_for_each(sk, &net->packet.sklist) { +@@ -200,6 +204,7 @@ static int packet_diag_dump(struct sk_buff *skb, struct netlink_callback *cb) + goto next; + + if (sk_diag_fill(sk, skb, req, ++ may_report_filterinfo, + sk_user_ns(NETLINK_CB(cb->skb).sk), + NETLINK_CB(cb->skb).portid, + cb->nlh->nlmsg_seq, NLM_F_MULTI, +diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c +index dc15f4300808..b64151ade6b3 100644 +--- a/net/phonet/pn_netlink.c ++++ b/net/phonet/pn_netlink.c +@@ -70,10 +70,10 @@ static int addr_doit(struct sk_buff *skb, struct nlmsghdr *nlh) + int err; + u8 pnaddr; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + +- if (!capable(CAP_SYS_ADMIN)) ++ if (!netlink_capable(skb, CAP_SYS_ADMIN)) + return -EPERM; + + ASSERT_RTNL(); +@@ -233,10 +233,10 @@ static int route_doit(struct sk_buff *skb, struct nlmsghdr *nlh) + int err; + u8 dst; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + +- if (!capable(CAP_SYS_ADMIN)) ++ if (!netlink_capable(skb, CAP_SYS_ADMIN)) + return -EPERM; + + ASSERT_RTNL(); +diff --git a/net/sched/act_api.c b/net/sched/act_api.c +index 72bdc7166345..3b2265523552 100644 +--- a/net/sched/act_api.c ++++ b/net/sched/act_api.c +@@ -908,7 +908,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n) + u32 portid = skb ? NETLINK_CB(skb).portid : 0; + int ret = 0, ovr = 0; + +- if ((n->nlmsg_type != RTM_GETACTION) && !capable(CAP_NET_ADMIN)) ++ if ((n->nlmsg_type != RTM_GETACTION) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + ret = nlmsg_parse(n, sizeof(struct tcamsg), tca, TCA_ACT_MAX, NULL); +diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c +index 29a30a14c315..bdbdb1a7920a 100644 +--- a/net/sched/cls_api.c ++++ b/net/sched/cls_api.c +@@ -134,7 +134,7 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n) + int err; + int tp_created = 0; + +- if ((n->nlmsg_type != RTM_GETTFILTER) && !capable(CAP_NET_ADMIN)) ++ if ((n->nlmsg_type != RTM_GETTFILTER) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + replay: +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index a07d55e75698..98532cfa7823 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -1084,7 +1084,7 @@ static int tc_get_qdisc(struct sk_buff *skb, struct nlmsghdr *n) + struct Qdisc *p = NULL; + int err; + +- if ((n->nlmsg_type != RTM_GETQDISC) && !capable(CAP_NET_ADMIN)) ++ if ((n->nlmsg_type != RTM_GETQDISC) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL); +@@ -1151,7 +1151,7 @@ static int tc_modify_qdisc(struct sk_buff *skb, struct nlmsghdr *n) + struct Qdisc *q, *p; + int err; + +- if (!capable(CAP_NET_ADMIN)) ++ if (!netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + replay: +@@ -1491,7 +1491,7 @@ static int tc_ctl_tclass(struct sk_buff *skb, struct nlmsghdr *n) + u32 qid; + int err; + +- if ((n->nlmsg_type != RTM_GETTCLASS) && !capable(CAP_NET_ADMIN)) ++ if ((n->nlmsg_type != RTM_GETTCLASS) && !netlink_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + err = nlmsg_parse(n, sizeof(*tcm), tca, TCA_MAX, NULL); +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index 878e17aafbe5..a4d570126f5d 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_association *asoc) + /* Only real associations count against the endpoint, so + * don't bother for if this is a temporary association. + */ +- if (!asoc->temp) { ++ if (!list_empty(&asoc->asocs)) { + list_del(&asoc->asocs); + + /* Decrement the backlog value for a TCP-style listening +diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c +index 3aaf73de9e2d..ad844d365340 100644 +--- a/net/tipc/netlink.c ++++ b/net/tipc/netlink.c +@@ -47,7 +47,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info) + int hdr_space = nlmsg_total_size(GENL_HDRLEN + TIPC_GENL_HDRLEN); + u16 cmd; + +- if ((req_userhdr->cmd & 0xC000) && (!capable(CAP_NET_ADMIN))) ++ if ((req_userhdr->cmd & 0xC000) && (!netlink_capable(skb, CAP_NET_ADMIN))) + cmd = TIPC_CMD_NOT_NET_ADMIN; + else + cmd = req_userhdr->cmd; +diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c +index 2f7ddc3a59b4..b10d04fa3933 100644 +--- a/net/xfrm/xfrm_user.c ++++ b/net/xfrm/xfrm_user.c +@@ -2350,7 +2350,7 @@ static int xfrm_user_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + link = &xfrm_dispatch[type]; + + /* All operations require privileges, even GET */ +- if (!ns_capable(net->user_ns, CAP_NET_ADMIN)) ++ if (!netlink_net_capable(skb, CAP_NET_ADMIN)) + return -EPERM; + + if ((type == (XFRM_MSG_GETSA - XFRM_MSG_BASE) || +diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c +index 336b3ddfe63f..3c5cbb977254 100644 +--- a/security/integrity/evm/evm_main.c ++++ b/security/integrity/evm/evm_main.c +@@ -285,12 +285,20 @@ out: + * @xattr_value: pointer to the new extended attribute value + * @xattr_value_len: pointer to the new extended attribute value length + * +- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that +- * the current value is valid. ++ * Before allowing the 'security.evm' protected xattr to be updated, ++ * verify the existing value is valid. As only the kernel should have ++ * access to the EVM encrypted key needed to calculate the HMAC, prevent ++ * userspace from writing HMAC value. Writing 'security.evm' requires ++ * requires CAP_SYS_ADMIN privileges. + */ + int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name, + const void *xattr_value, size_t xattr_value_len) + { ++ const struct evm_ima_xattr_data *xattr_data = xattr_value; ++ ++ if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0) ++ && (xattr_data->type == EVM_XATTR_HMAC)) ++ return -EPERM; + return evm_protect_xattr(dentry, xattr_name, xattr_value, + xattr_value_len); + } +diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c +index c38bbce8c6a6..025824af08e0 100644 +--- a/security/integrity/ima/ima_api.c ++++ b/security/integrity/ima/ima_api.c +@@ -199,6 +199,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, + struct evm_ima_xattr_data **xattr_value, + int *xattr_len) + { ++ const char *audit_cause = "failed"; + struct inode *inode = file_inode(file); + const char *filename = file->f_dentry->d_name.name; + int result = 0; +@@ -213,6 +214,12 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, + if (!(iint->flags & IMA_COLLECTED)) { + u64 i_version = file_inode(file)->i_version; + ++ if (file->f_flags & O_DIRECT) { ++ audit_cause = "failed(directio)"; ++ result = -EACCES; ++ goto out; ++ } ++ + /* use default hash algorithm */ + hash.hdr.algo = ima_hash_algo; + +@@ -233,9 +240,10 @@ int ima_collect_measurement(struct integrity_iint_cache *iint, + result = -ENOMEM; + } + } ++out: + if (result) + integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode, +- filename, "collect_data", "failed", ++ filename, "collect_data", audit_cause, + result, 0); + return result; + } +diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c +index fdf60def52e9..b5c126fe0bd9 100644 +--- a/security/integrity/ima/ima_crypto.c ++++ b/security/integrity/ima/ima_crypto.c +@@ -25,6 +25,36 @@ + + static struct crypto_shash *ima_shash_tfm; + ++/** ++ * ima_kernel_read - read file content ++ * ++ * This is a function for reading file content instead of kernel_read(). ++ * It does not perform locking checks to ensure it cannot be blocked. ++ * It does not perform security checks because it is irrelevant for IMA. ++ * ++ */ ++static int ima_kernel_read(struct file *file, loff_t offset, ++ char *addr, unsigned long count) ++{ ++ mm_segment_t old_fs; ++ char __user *buf = addr; ++ ssize_t ret; ++ ++ if (!(file->f_mode & FMODE_READ)) ++ return -EBADF; ++ if (!file->f_op->read && !file->f_op->aio_read) ++ return -EINVAL; ++ ++ old_fs = get_fs(); ++ set_fs(get_ds()); ++ if (file->f_op->read) ++ ret = file->f_op->read(file, buf, count, &offset); ++ else ++ ret = do_sync_read(file, buf, count, &offset); ++ set_fs(old_fs); ++ return ret; ++} ++ + int ima_init_crypto(void) + { + long rc; +@@ -98,7 +128,7 @@ static int ima_calc_file_hash_tfm(struct file *file, + while (offset < i_size) { + int rbuf_len; + +- rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE); ++ rbuf_len = ima_kernel_read(file, offset, rbuf, PAGE_SIZE); + if (rbuf_len < 0) { + rc = rbuf_len; + break; +diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c +index 149ee1119f87..76d8aad146a8 100644 +--- a/security/integrity/ima/ima_main.c ++++ b/security/integrity/ima/ima_main.c +@@ -217,8 +217,11 @@ static int process_measurement(struct file *file, const char *filename, + xattr_ptr = &xattr_value; + + rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len); +- if (rc != 0) ++ if (rc != 0) { ++ if (file->f_flags & O_DIRECT) ++ rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES; + goto out_digsig; ++ } + + pathname = !filename ? ima_d_path(&file->f_path, &pathbuf) : filename; + if (!pathname) +diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c +index a9c3d3cd1990..085c4964be99 100644 +--- a/security/integrity/ima/ima_policy.c ++++ b/security/integrity/ima/ima_policy.c +@@ -351,7 +351,7 @@ enum { + Opt_obj_user, Opt_obj_role, Opt_obj_type, + Opt_subj_user, Opt_subj_role, Opt_subj_type, + Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner, +- Opt_appraise_type, Opt_fsuuid ++ Opt_appraise_type, Opt_fsuuid, Opt_permit_directio + }; + + static match_table_t policy_tokens = { +@@ -373,6 +373,7 @@ static match_table_t policy_tokens = { + {Opt_uid, "uid=%s"}, + {Opt_fowner, "fowner=%s"}, + {Opt_appraise_type, "appraise_type=%s"}, ++ {Opt_permit_directio, "permit_directio"}, + {Opt_err, NULL} + }; + +@@ -621,6 +622,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) + else + result = -EINVAL; + break; ++ case Opt_permit_directio: ++ entry->flags |= IMA_PERMIT_DIRECTIO; ++ break; + case Opt_err: + ima_log_string(ab, "UNKNOWN", p); + result = -EINVAL; +diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h +index 2fb5e53e927f..33c0a70f6b15 100644 +--- a/security/integrity/integrity.h ++++ b/security/integrity/integrity.h +@@ -30,6 +30,7 @@ + #define IMA_ACTION_FLAGS 0xff000000 + #define IMA_DIGSIG 0x01000000 + #define IMA_DIGSIG_REQUIRED 0x02000000 ++#define IMA_PERMIT_DIRECTIO 0x04000000 + + #define IMA_DO_MASK (IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \ + IMA_APPRAISE_SUBMASK) +diff --git a/sound/core/control.c b/sound/core/control.c +index d8aa206e8bde..98a29b26c5f4 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -289,6 +289,10 @@ static bool snd_ctl_remove_numid_conflict(struct snd_card *card, + { + struct snd_kcontrol *kctl; + ++ /* Make sure that the ids assigned to the control do not wrap around */ ++ if (card->last_numid >= UINT_MAX - count) ++ card->last_numid = 0; ++ + list_for_each_entry(kctl, &card->controls, list) { + if (kctl->id.numid < card->last_numid + 1 + count && + kctl->id.numid + kctl->count > card->last_numid + 1) { +@@ -331,6 +335,7 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + { + struct snd_ctl_elem_id id; + unsigned int idx; ++ unsigned int count; + int err = -EINVAL; + + if (! kcontrol) +@@ -338,6 +343,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + if (snd_BUG_ON(!card || !kcontrol->info)) + goto error; + id = kcontrol->id; ++ if (id.index > UINT_MAX - kcontrol->count) ++ goto error; ++ + down_write(&card->controls_rwsem); + if (snd_ctl_find_id(card, &id)) { + up_write(&card->controls_rwsem); +@@ -359,8 +367,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + card->controls_count += kcontrol->count; + kcontrol->id.numid = card->last_numid + 1; + card->last_numid += kcontrol->count; ++ count = kcontrol->count; + up_write(&card->controls_rwsem); +- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++) ++ for (idx = 0; idx < count; idx++, id.index++, id.numid++) + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); + return 0; + +@@ -389,6 +398,7 @@ int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol, + bool add_on_replace) + { + struct snd_ctl_elem_id id; ++ unsigned int count; + unsigned int idx; + struct snd_kcontrol *old; + int ret; +@@ -424,8 +434,9 @@ add: + card->controls_count += kcontrol->count; + kcontrol->id.numid = card->last_numid + 1; + card->last_numid += kcontrol->count; ++ count = kcontrol->count; + up_write(&card->controls_rwsem); +- for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++) ++ for (idx = 0; idx < count; idx++, id.index++, id.numid++) + snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); + return 0; + +@@ -898,9 +909,9 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file, + result = kctl->put(kctl, control); + } + if (result > 0) { ++ struct snd_ctl_elem_id id = control->id; + up_read(&card->controls_rwsem); +- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, +- &control->id); ++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id); + return 0; + } + } +@@ -992,6 +1003,7 @@ static int snd_ctl_elem_unlock(struct snd_ctl_file *file, + + struct user_element { + struct snd_ctl_elem_info info; ++ struct snd_card *card; + void *elem_data; /* element data */ + unsigned long elem_data_size; /* size of element data in bytes */ + void *tlv_data; /* TLV data */ +@@ -1035,7 +1047,9 @@ static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol, + { + struct user_element *ue = kcontrol->private_data; + ++ mutex_lock(&ue->card->user_ctl_lock); + memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size); ++ mutex_unlock(&ue->card->user_ctl_lock); + return 0; + } + +@@ -1044,10 +1058,12 @@ static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol, + { + int change; + struct user_element *ue = kcontrol->private_data; +- ++ ++ mutex_lock(&ue->card->user_ctl_lock); + change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0; + if (change) + memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size); ++ mutex_unlock(&ue->card->user_ctl_lock); + return change; + } + +@@ -1067,19 +1083,32 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol, + new_data = memdup_user(tlv, size); + if (IS_ERR(new_data)) + return PTR_ERR(new_data); ++ mutex_lock(&ue->card->user_ctl_lock); + change = ue->tlv_data_size != size; + if (!change) + change = memcmp(ue->tlv_data, new_data, size); + kfree(ue->tlv_data); + ue->tlv_data = new_data; + ue->tlv_data_size = size; ++ mutex_unlock(&ue->card->user_ctl_lock); + } else { +- if (! ue->tlv_data_size || ! ue->tlv_data) +- return -ENXIO; +- if (size < ue->tlv_data_size) +- return -ENOSPC; ++ int ret = 0; ++ ++ mutex_lock(&ue->card->user_ctl_lock); ++ if (!ue->tlv_data_size || !ue->tlv_data) { ++ ret = -ENXIO; ++ goto err_unlock; ++ } ++ if (size < ue->tlv_data_size) { ++ ret = -ENOSPC; ++ goto err_unlock; ++ } + if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size)) +- return -EFAULT; ++ ret = -EFAULT; ++err_unlock: ++ mutex_unlock(&ue->card->user_ctl_lock); ++ if (ret) ++ return ret; + } + return change; + } +@@ -1137,8 +1166,6 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + struct user_element *ue; + int idx, err; + +- if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS) +- return -ENOMEM; + if (info->count < 1) + return -EINVAL; + access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE : +@@ -1147,21 +1174,16 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE)); + info->id.numid = 0; + memset(&kctl, 0, sizeof(kctl)); +- down_write(&card->controls_rwsem); +- _kctl = snd_ctl_find_id(card, &info->id); +- err = 0; +- if (_kctl) { +- if (replace) +- err = snd_ctl_remove(card, _kctl); +- else +- err = -EBUSY; +- } else { +- if (replace) +- err = -ENOENT; ++ ++ if (replace) { ++ err = snd_ctl_remove_user_ctl(file, &info->id); ++ if (err) ++ return err; + } +- up_write(&card->controls_rwsem); +- if (err < 0) +- return err; ++ ++ if (card->user_ctl_count >= MAX_USER_CONTROLS) ++ return -ENOMEM; ++ + memcpy(&kctl.id, &info->id, sizeof(info->id)); + kctl.count = info->owner ? info->owner : 1; + access |= SNDRV_CTL_ELEM_ACCESS_USER; +@@ -1211,6 +1233,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL); + if (ue == NULL) + return -ENOMEM; ++ ue->card = card; + ue->info = *info; + ue->info.access = 0; + ue->elem_data = (char *)ue + sizeof(*ue); +@@ -1322,8 +1345,9 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file, + } + err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv); + if (err > 0) { ++ struct snd_ctl_elem_id id = kctl->id; + up_read(&card->controls_rwsem); +- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &kctl->id); ++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id); + return 0; + } + } else { +diff --git a/sound/core/init.c b/sound/core/init.c +index 0d42fcda0de2..39c25167add8 100644 +--- a/sound/core/init.c ++++ b/sound/core/init.c +@@ -218,6 +218,7 @@ int snd_card_create(int idx, const char *xid, + INIT_LIST_HEAD(&card->devices); + init_rwsem(&card->controls_rwsem); + rwlock_init(&card->ctl_files_rwlock); ++ mutex_init(&card->user_ctl_lock); + INIT_LIST_HEAD(&card->controls); + INIT_LIST_HEAD(&card->ctl_files); + spin_lock_init(&card->files_lock); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 0b6ee2b37bdb..2a16a90fd952 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -3932,6 +3932,7 @@ enum { + ALC269_FIXUP_HEADSET_MIC, + ALC269_FIXUP_QUANTA_MUTE, + ALC269_FIXUP_LIFEBOOK, ++ ALC269_FIXUP_LIFEBOOK_EXTMIC, + ALC269_FIXUP_AMIC, + ALC269_FIXUP_DMIC, + ALC269VB_FIXUP_AMIC, +@@ -4059,6 +4060,13 @@ static const struct hda_fixup alc269_fixups[] = { + .chained = true, + .chain_id = ALC269_FIXUP_QUANTA_MUTE + }, ++ [ALC269_FIXUP_LIFEBOOK_EXTMIC] = { ++ .type = HDA_FIXUP_PINS, ++ .v.pins = (const struct hda_pintbl[]) { ++ { 0x19, 0x01a1903c }, /* headset mic, with jack detect */ ++ { } ++ }, ++ }, + [ALC269_FIXUP_AMIC] = { + .type = HDA_FIXUP_PINS, + .v.pins = (const struct hda_pintbl[]) { +@@ -4427,14 +4435,24 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x1983, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED), + /* ALC282 */ ++ SND_PCI_QUIRK(0x103c, 0x220d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x220e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x220f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2211, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2212, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2213, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2266, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2267, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x2269, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x226c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x226d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x226f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x227a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x227b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), +@@ -4474,6 +4492,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x22c3, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2334, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), ++ SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1), + SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED), + SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300), + SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST), +@@ -4496,6 +4518,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ), + SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO), + SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK), ++ SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC), + SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE), +@@ -5536,6 +5559,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = { + { .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 }, + { .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 }, + { .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 }, ++ { .id = 0x10ec0867, .name = "ALC891", .patch = patch_alc882 }, + { .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 }, + { .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 }, + { .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc882 }, +diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c +index 9f714ea86613..b3f7c9026a29 100644 +--- a/sound/soc/codecs/max98090.c ++++ b/sound/soc/codecs/max98090.c +@@ -255,6 +255,7 @@ static struct reg_default max98090_reg[] = { + static bool max98090_volatile_register(struct device *dev, unsigned int reg) + { + switch (reg) { ++ case M98090_REG_SOFTWARE_RESET: + case M98090_REG_DEVICE_STATUS: + case M98090_REG_JACK_STATUS: + case M98090_REG_REVISION_ID: +@@ -2360,6 +2361,8 @@ static int max98090_runtime_resume(struct device *dev) + + regcache_cache_only(max98090->regmap, false); + ++ max98090_reset(max98090); ++ + regcache_sync(max98090->regmap); + + return 0; +diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c +index 470fbfb4b386..eb241c6571a9 100644 +--- a/sound/soc/codecs/tlv320aic3x.c ++++ b/sound/soc/codecs/tlv320aic3x.c +@@ -169,7 +169,7 @@ static int snd_soc_dapm_put_volsw_aic3x(struct snd_kcontrol *kcontrol, + mask <<= shift; + val <<= shift; + +- change = snd_soc_test_bits(codec, val, mask, reg); ++ change = snd_soc_test_bits(codec, reg, mask, val); + if (change) { + update.kcontrol = kcontrol; + update.reg = reg; +diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c +index c1369c3ad643..731d47b64daa 100644 +--- a/sound/soc/soc-dapm.c ++++ b/sound/soc/soc-dapm.c +@@ -2888,22 +2888,19 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol, + mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME); + + change = dapm_kcontrol_set_value(kcontrol, val); +- +- if (reg != SND_SOC_NOPM) { +- mask = mask << shift; +- val = val << shift; +- +- change = snd_soc_test_bits(codec, reg, mask, val); +- } +- + if (change) { + if (reg != SND_SOC_NOPM) { +- update.kcontrol = kcontrol; +- update.reg = reg; +- update.mask = mask; +- update.val = val; ++ mask = mask << shift; ++ val = val << shift; ++ ++ if (snd_soc_test_bits(codec, reg, mask, val)) { ++ update.kcontrol = kcontrol; ++ update.reg = reg; ++ update.mask = mask; ++ update.val = val; ++ card->update = &update; ++ } + +- card->update = &update; + } + + ret = soc_dapm_mixer_update_power(card, kcontrol, connect);