From: "Mike Pagano" <mpagano@gentoo.org>
To: gentoo-commits@lists.gentoo.org
Subject: [gentoo-commits] proj/linux-patches:4.16 commit in: /
Date: Mon, 30 Apr 2018 10:30:43 +0000 (UTC) [thread overview]
Message-ID: <1525084235.54039fa3feac7ed37530054550520d924419b496.mpagano@gentoo> (raw)
commit: 54039fa3feac7ed37530054550520d924419b496
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Mon Apr 30 10:30:35 2018 +0000
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Mon Apr 30 10:30:35 2018 +0000
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=54039fa3
Linux patch 4.16.6
0000_README | 4 +
1005_linux-4.16.6.patch | 3759 +++++++++++++++++++++++++++++++++++++++++++++++
2 files changed, 3763 insertions(+)
diff --git a/0000_README b/0000_README
index 344c387..d4182dc 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch: 1004_linux-4.16.5.patch
From: http://www.kernel.org
Desc: Linux 4.16.5
+Patch: 1005_linux-4.16.6.patch
+From: http://www.kernel.org
+Desc: Linux 4.16.6
+
Patch: 1500_XATTR_USER_PREFIX.patch
From: https://bugs.gentoo.org/show_bug.cgi?id=470644
Desc: Support for namespace user.pax.* on tmpfs.
diff --git a/1005_linux-4.16.6.patch b/1005_linux-4.16.6.patch
new file mode 100644
index 0000000..e5b7089
--- /dev/null
+++ b/1005_linux-4.16.6.patch
@@ -0,0 +1,3759 @@
+diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
+index a553d4e4a0fb..f778901c4297 100644
+--- a/Documentation/networking/ip-sysctl.txt
++++ b/Documentation/networking/ip-sysctl.txt
+@@ -1386,26 +1386,26 @@ mld_qrv - INTEGER
+ Default: 2 (as specified by RFC3810 9.1)
+ Minimum: 1 (as specified by RFC6636 4.5)
+
+-max_dst_opts_cnt - INTEGER
++max_dst_opts_number - INTEGER
+ Maximum number of non-padding TLVs allowed in a Destination
+ options extension header. If this value is less than zero
+ then unknown options are disallowed and the number of known
+ TLVs allowed is the absolute value of this number.
+ Default: 8
+
+-max_hbh_opts_cnt - INTEGER
++max_hbh_opts_number - INTEGER
+ Maximum number of non-padding TLVs allowed in a Hop-by-Hop
+ options extension header. If this value is less than zero
+ then unknown options are disallowed and the number of known
+ TLVs allowed is the absolute value of this number.
+ Default: 8
+
+-max dst_opts_len - INTEGER
++max_dst_opts_length - INTEGER
+ Maximum length allowed for a Destination options extension
+ header.
+ Default: INT_MAX (unlimited)
+
+-max hbh_opts_len - INTEGER
++max_hbh_length - INTEGER
+ Maximum length allowed for a Hop-by-Hop options extension
+ header.
+ Default: INT_MAX (unlimited)
+diff --git a/Makefile b/Makefile
+index 6678a90f355b..41f07b2b7905 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 16
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+
+diff --git a/arch/s390/kernel/perf_cpum_cf_events.c b/arch/s390/kernel/perf_cpum_cf_events.c
+index 5ee27dc9a10c..feebb2944882 100644
+--- a/arch/s390/kernel/perf_cpum_cf_events.c
++++ b/arch/s390/kernel/perf_cpum_cf_events.c
+@@ -123,7 +123,7 @@ CPUMF_EVENT_ATTR(cf_zec12, L1I_OFFBOOK_L3_SOURCED_WRITES_IV, 0x00a1);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_NC_TABORT, 0x00b1);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_NO_SPECIAL, 0x00b2);
+ CPUMF_EVENT_ATTR(cf_zec12, TX_C_TABORT_SPECIAL, 0x00b3);
+-CPUMF_EVENT_ATTR(cf_z13, L1D_WRITES_RO_EXCL, 0x0080);
++CPUMF_EVENT_ATTR(cf_z13, L1D_RO_EXCL_WRITES, 0x0080);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_WRITES, 0x0081);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_MISSES, 0x0082);
+ CPUMF_EVENT_ATTR(cf_z13, DTLB1_HPAGE_WRITES, 0x0083);
+@@ -179,7 +179,7 @@ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_NO_SPECIAL, 0x00db);
+ CPUMF_EVENT_ATTR(cf_z13, TX_C_TABORT_SPECIAL, 0x00dc);
+ CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_ONE_THR_ACTIVE, 0x01c0);
+ CPUMF_EVENT_ATTR(cf_z13, MT_DIAG_CYCLES_TWO_THR_ACTIVE, 0x01c1);
+-CPUMF_EVENT_ATTR(cf_z14, L1D_WRITES_RO_EXCL, 0x0080);
++CPUMF_EVENT_ATTR(cf_z14, L1D_RO_EXCL_WRITES, 0x0080);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_WRITES, 0x0081);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_MISSES, 0x0082);
+ CPUMF_EVENT_ATTR(cf_z14, DTLB2_HPAGE_WRITES, 0x0083);
+@@ -371,7 +371,7 @@ static struct attribute *cpumcf_zec12_pmu_event_attr[] __initdata = {
+ };
+
+ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
+- CPUMF_EVENT_PTR(cf_z13, L1D_WRITES_RO_EXCL),
++ CPUMF_EVENT_PTR(cf_z13, L1D_RO_EXCL_WRITES),
+ CPUMF_EVENT_PTR(cf_z13, DTLB1_WRITES),
+ CPUMF_EVENT_PTR(cf_z13, DTLB1_MISSES),
+ CPUMF_EVENT_PTR(cf_z13, DTLB1_HPAGE_WRITES),
+@@ -431,7 +431,7 @@ static struct attribute *cpumcf_z13_pmu_event_attr[] __initdata = {
+ };
+
+ static struct attribute *cpumcf_z14_pmu_event_attr[] __initdata = {
+- CPUMF_EVENT_PTR(cf_z14, L1D_WRITES_RO_EXCL),
++ CPUMF_EVENT_PTR(cf_z14, L1D_RO_EXCL_WRITES),
+ CPUMF_EVENT_PTR(cf_z14, DTLB2_WRITES),
+ CPUMF_EVENT_PTR(cf_z14, DTLB2_MISSES),
+ CPUMF_EVENT_PTR(cf_z14, DTLB2_HPAGE_WRITES),
+diff --git a/arch/s390/kernel/uprobes.c b/arch/s390/kernel/uprobes.c
+index d9d1f512f019..5007fac01bb5 100644
+--- a/arch/s390/kernel/uprobes.c
++++ b/arch/s390/kernel/uprobes.c
+@@ -150,6 +150,15 @@ unsigned long arch_uretprobe_hijack_return_addr(unsigned long trampoline,
+ return orig;
+ }
+
++bool arch_uretprobe_is_alive(struct return_instance *ret, enum rp_check ctx,
++ struct pt_regs *regs)
++{
++ if (ctx == RP_CHECK_CHAIN_CALL)
++ return user_stack_pointer(regs) <= ret->stack;
++ else
++ return user_stack_pointer(regs) < ret->stack;
++}
++
+ /* Instruction Emulation */
+
+ static void adjust_psw_addr(psw_t *psw, unsigned long len)
+diff --git a/drivers/acpi/acpi_video.c b/drivers/acpi/acpi_video.c
+index 76fb96966f7b..2f2e737be0f8 100644
+--- a/drivers/acpi/acpi_video.c
++++ b/drivers/acpi/acpi_video.c
+@@ -2123,6 +2123,25 @@ static int __init intel_opregion_present(void)
+ return opregion;
+ }
+
++static bool dmi_is_desktop(void)
++{
++ const char *chassis_type;
++
++ chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
++ if (!chassis_type)
++ return false;
++
++ if (!strcmp(chassis_type, "3") || /* 3: Desktop */
++ !strcmp(chassis_type, "4") || /* 4: Low Profile Desktop */
++ !strcmp(chassis_type, "5") || /* 5: Pizza Box */
++ !strcmp(chassis_type, "6") || /* 6: Mini Tower */
++ !strcmp(chassis_type, "7") || /* 7: Tower */
++ !strcmp(chassis_type, "11")) /* 11: Main Server Chassis */
++ return true;
++
++ return false;
++}
++
+ int acpi_video_register(void)
+ {
+ int ret = 0;
+@@ -2143,8 +2162,12 @@ int acpi_video_register(void)
+ * win8 ready (where we also prefer the native backlight driver, so
+ * normally the acpi_video code should not register there anyways).
+ */
+- if (only_lcd == -1)
+- only_lcd = acpi_osi_is_win8();
++ if (only_lcd == -1) {
++ if (dmi_is_desktop() && acpi_osi_is_win8())
++ only_lcd = true;
++ else
++ only_lcd = false;
++ }
+
+ dmi_check_system(video_dmi_table);
+
+diff --git a/drivers/block/swim.c b/drivers/block/swim.c
+index 64e066eba72e..0e31884a9519 100644
+--- a/drivers/block/swim.c
++++ b/drivers/block/swim.c
+@@ -110,7 +110,7 @@ struct iwm {
+ /* Select values for swim_select and swim_readbit */
+
+ #define READ_DATA_0 0x074
+-#define TWOMEG_DRIVE 0x075
++#define ONEMEG_DRIVE 0x075
+ #define SINGLE_SIDED 0x076
+ #define DRIVE_PRESENT 0x077
+ #define DISK_IN 0x170
+@@ -118,9 +118,9 @@ struct iwm {
+ #define TRACK_ZERO 0x172
+ #define TACHO 0x173
+ #define READ_DATA_1 0x174
+-#define MFM_MODE 0x175
++#define GCR_MODE 0x175
+ #define SEEK_COMPLETE 0x176
+-#define ONEMEG_MEDIA 0x177
++#define TWOMEG_MEDIA 0x177
+
+ /* Bits in handshake register */
+
+@@ -612,7 +612,6 @@ static void setup_medium(struct floppy_state *fs)
+ struct floppy_struct *g;
+ fs->disk_in = 1;
+ fs->write_protected = swim_readbit(base, WRITE_PROT);
+- fs->type = swim_readbit(base, ONEMEG_MEDIA);
+
+ if (swim_track00(base))
+ printk(KERN_ERR
+@@ -620,6 +619,9 @@ static void setup_medium(struct floppy_state *fs)
+
+ swim_track00(base);
+
++ fs->type = swim_readbit(base, TWOMEG_MEDIA) ?
++ HD_MEDIA : DD_MEDIA;
++ fs->head_number = swim_readbit(base, SINGLE_SIDED) ? 1 : 2;
+ get_floppy_geometry(fs, 0, &g);
+ fs->total_secs = g->size;
+ fs->secpercyl = g->head * g->sect;
+@@ -646,7 +648,7 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+
+ swim_write(base, setup, S_IBM_DRIVE | S_FCLK_DIV2);
+ udelay(10);
+- swim_drive(base, INTERNAL_DRIVE);
++ swim_drive(base, fs->location);
+ swim_motor(base, ON);
+ swim_action(base, SETMFM);
+ if (fs->ejected)
+@@ -656,6 +658,8 @@ static int floppy_open(struct block_device *bdev, fmode_t mode)
+ goto out;
+ }
+
++ set_capacity(fs->disk, fs->total_secs);
++
+ if (mode & FMODE_NDELAY)
+ return 0;
+
+@@ -727,14 +731,9 @@ static int floppy_ioctl(struct block_device *bdev, fmode_t mode,
+ if (copy_to_user((void __user *) param, (void *) &floppy_type,
+ sizeof(struct floppy_struct)))
+ return -EFAULT;
+- break;
+-
+- default:
+- printk(KERN_DEBUG "SWIM floppy_ioctl: unknown cmd %d\n",
+- cmd);
+- return -ENOSYS;
++ return 0;
+ }
+- return 0;
++ return -ENOTTY;
+ }
+
+ static int floppy_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+@@ -795,7 +794,7 @@ static struct kobject *floppy_find(dev_t dev, int *part, void *data)
+ struct swim_priv *swd = data;
+ int drive = (*part & 3);
+
+- if (drive > swd->floppy_count)
++ if (drive >= swd->floppy_count)
+ return NULL;
+
+ *part = 0;
+@@ -813,10 +812,9 @@ static int swim_add_floppy(struct swim_priv *swd, enum drive_location location)
+
+ swim_motor(base, OFF);
+
+- if (swim_readbit(base, SINGLE_SIDED))
+- fs->head_number = 1;
+- else
+- fs->head_number = 2;
++ fs->type = HD_MEDIA;
++ fs->head_number = 2;
++
+ fs->ref_count = 0;
+ fs->ejected = 1;
+
+@@ -834,10 +832,12 @@ static int swim_floppy_init(struct swim_priv *swd)
+ /* scan floppy drives */
+
+ swim_drive(base, INTERNAL_DRIVE);
+- if (swim_readbit(base, DRIVE_PRESENT))
++ if (swim_readbit(base, DRIVE_PRESENT) &&
++ !swim_readbit(base, ONEMEG_DRIVE))
+ swim_add_floppy(swd, INTERNAL_DRIVE);
+ swim_drive(base, EXTERNAL_DRIVE);
+- if (swim_readbit(base, DRIVE_PRESENT))
++ if (swim_readbit(base, DRIVE_PRESENT) &&
++ !swim_readbit(base, ONEMEG_DRIVE))
+ swim_add_floppy(swd, EXTERNAL_DRIVE);
+
+ /* register floppy drives */
+@@ -861,7 +861,6 @@ static int swim_floppy_init(struct swim_priv *swd)
+ &swd->lock);
+ if (!swd->unit[drive].disk->queue) {
+ err = -ENOMEM;
+- put_disk(swd->unit[drive].disk);
+ goto exit_put_disks;
+ }
+ blk_queue_bounce_limit(swd->unit[drive].disk->queue,
+@@ -911,7 +910,7 @@ static int swim_probe(struct platform_device *dev)
+ goto out;
+ }
+
+- swim_base = ioremap(res->start, resource_size(res));
++ swim_base = (struct swim __iomem *)res->start;
+ if (!swim_base) {
+ ret = -ENOMEM;
+ goto out_release_io;
+@@ -923,7 +922,7 @@ static int swim_probe(struct platform_device *dev)
+ if (!get_swim_mode(swim_base)) {
+ printk(KERN_INFO "SWIM device not found !\n");
+ ret = -ENODEV;
+- goto out_iounmap;
++ goto out_release_io;
+ }
+
+ /* set platform driver data */
+@@ -931,7 +930,7 @@ static int swim_probe(struct platform_device *dev)
+ swd = kzalloc(sizeof(struct swim_priv), GFP_KERNEL);
+ if (!swd) {
+ ret = -ENOMEM;
+- goto out_iounmap;
++ goto out_release_io;
+ }
+ platform_set_drvdata(dev, swd);
+
+@@ -945,8 +944,6 @@ static int swim_probe(struct platform_device *dev)
+
+ out_kfree:
+ kfree(swd);
+-out_iounmap:
+- iounmap(swim_base);
+ out_release_io:
+ release_mem_region(res->start, resource_size(res));
+ out:
+@@ -974,8 +971,6 @@ static int swim_remove(struct platform_device *dev)
+ for (drive = 0; drive < swd->floppy_count; drive++)
+ floppy_eject(&swd->unit[drive]);
+
+- iounmap(swd->base);
+-
+ res = platform_get_resource(dev, IORESOURCE_MEM, 0);
+ if (res)
+ release_mem_region(res->start, resource_size(res));
+diff --git a/drivers/block/swim3.c b/drivers/block/swim3.c
+index af51015d056e..469541c1e51e 100644
+--- a/drivers/block/swim3.c
++++ b/drivers/block/swim3.c
+@@ -148,7 +148,7 @@ struct swim3 {
+ #define MOTOR_ON 2
+ #define RELAX 3 /* also eject in progress */
+ #define READ_DATA_0 4
+-#define TWOMEG_DRIVE 5
++#define ONEMEG_DRIVE 5
+ #define SINGLE_SIDED 6 /* drive or diskette is 4MB type? */
+ #define DRIVE_PRESENT 7
+ #define DISK_IN 8
+@@ -156,9 +156,9 @@ struct swim3 {
+ #define TRACK_ZERO 10
+ #define TACHO 11
+ #define READ_DATA_1 12
+-#define MFM_MODE 13
++#define GCR_MODE 13
+ #define SEEK_COMPLETE 14
+-#define ONEMEG_MEDIA 15
++#define TWOMEG_MEDIA 15
+
+ /* Definitions of values used in writing and formatting */
+ #define DATA_ESCAPE 0x99
+diff --git a/drivers/cdrom/cdrom.c b/drivers/cdrom/cdrom.c
+index e36d160c458f..5f7d86509f2f 100644
+--- a/drivers/cdrom/cdrom.c
++++ b/drivers/cdrom/cdrom.c
+@@ -2374,7 +2374,7 @@ static int cdrom_ioctl_media_changed(struct cdrom_device_info *cdi,
+ if (!CDROM_CAN(CDC_SELECT_DISC) || arg == CDSL_CURRENT)
+ return media_changed(cdi, 1);
+
+- if ((unsigned int)arg >= cdi->capacity)
++ if (arg >= cdi->capacity)
+ return -EINVAL;
+
+ info = kmalloc(sizeof(*info), GFP_KERNEL);
+diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
+index 248c04090dea..255db6fe15c8 100644
+--- a/drivers/char/tpm/tpm-interface.c
++++ b/drivers/char/tpm/tpm-interface.c
+@@ -369,20 +369,40 @@ static int tpm_validate_command(struct tpm_chip *chip,
+ return -EINVAL;
+ }
+
+-/**
+- * tmp_transmit - Internal kernel interface to transmit TPM commands.
+- *
+- * @chip: TPM chip to use
+- * @buf: TPM command buffer
+- * @bufsiz: length of the TPM command buffer
+- * @flags: tpm transmit flags - bitmap
+- *
+- * Return:
+- * 0 when the operation is successful.
+- * A negative number for system errors (errno).
+- */
+-ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+- u8 *buf, size_t bufsiz, unsigned int flags)
++static int tpm_request_locality(struct tpm_chip *chip)
++{
++ int rc;
++
++ if (!chip->ops->request_locality)
++ return 0;
++
++ rc = chip->ops->request_locality(chip, 0);
++ if (rc < 0)
++ return rc;
++
++ chip->locality = rc;
++
++ return 0;
++}
++
++static void tpm_relinquish_locality(struct tpm_chip *chip)
++{
++ int rc;
++
++ if (!chip->ops->relinquish_locality)
++ return;
++
++ rc = chip->ops->relinquish_locality(chip, chip->locality);
++ if (rc)
++ dev_err(&chip->dev, "%s: : error %d\n", __func__, rc);
++
++ chip->locality = -1;
++}
++
++static ssize_t tpm_try_transmit(struct tpm_chip *chip,
++ struct tpm_space *space,
++ u8 *buf, size_t bufsiz,
++ unsigned int flags)
+ {
+ struct tpm_output_header *header = (void *)buf;
+ int rc;
+@@ -422,8 +442,6 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ if (!(flags & TPM_TRANSMIT_UNLOCKED))
+ mutex_lock(&chip->tpm_mutex);
+
+- if (chip->dev.parent)
+- pm_runtime_get_sync(chip->dev.parent);
+
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, true);
+@@ -431,14 +449,15 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ /* Store the decision as chip->locality will be changed. */
+ need_locality = chip->locality == -1;
+
+- if (!(flags & TPM_TRANSMIT_RAW) &&
+- need_locality && chip->ops->request_locality) {
+- rc = chip->ops->request_locality(chip, 0);
++ if (!(flags & TPM_TRANSMIT_RAW) && need_locality) {
++ rc = tpm_request_locality(chip);
+ if (rc < 0)
+ goto out_no_locality;
+- chip->locality = rc;
+ }
+
++ if (chip->dev.parent)
++ pm_runtime_get_sync(chip->dev.parent);
++
+ rc = tpm2_prepare_space(chip, space, ordinal, buf);
+ if (rc)
+ goto out;
+@@ -499,27 +518,83 @@ ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
+ rc = tpm2_commit_space(chip, space, ordinal, buf, &len);
+
+ out:
+- if (need_locality && chip->ops->relinquish_locality) {
+- chip->ops->relinquish_locality(chip, chip->locality);
+- chip->locality = -1;
+- }
++ if (chip->dev.parent)
++ pm_runtime_put_sync(chip->dev.parent);
++
++ if (need_locality)
++ tpm_relinquish_locality(chip);
++
+ out_no_locality:
+ if (chip->ops->clk_enable != NULL)
+ chip->ops->clk_enable(chip, false);
+
+- if (chip->dev.parent)
+- pm_runtime_put_sync(chip->dev.parent);
+-
+ if (!(flags & TPM_TRANSMIT_UNLOCKED))
+ mutex_unlock(&chip->tpm_mutex);
+ return rc ? rc : len;
+ }
+
+ /**
+- * tmp_transmit_cmd - send a tpm command to the device
++ * tpm_transmit - Internal kernel interface to transmit TPM commands.
++ *
++ * @chip: TPM chip to use
++ * @space: tpm space
++ * @buf: TPM command buffer
++ * @bufsiz: length of the TPM command buffer
++ * @flags: tpm transmit flags - bitmap
++ *
++ * A wrapper around tpm_try_transmit that handles TPM2_RC_RETRY
++ * returns from the TPM and retransmits the command after a delay up
++ * to a maximum wait of TPM2_DURATION_LONG.
++ *
++ * Note: TPM1 never returns TPM2_RC_RETRY so the retry logic is TPM2
++ * only
++ *
++ * Return:
++ * the length of the return when the operation is successful.
++ * A negative number for system errors (errno).
++ */
++ssize_t tpm_transmit(struct tpm_chip *chip, struct tpm_space *space,
++ u8 *buf, size_t bufsiz, unsigned int flags)
++{
++ struct tpm_output_header *header = (struct tpm_output_header *)buf;
++ /* space for header and handles */
++ u8 save[TPM_HEADER_SIZE + 3*sizeof(u32)];
++ unsigned int delay_msec = TPM2_DURATION_SHORT;
++ u32 rc = 0;
++ ssize_t ret;
++ const size_t save_size = min(space ? sizeof(save) : TPM_HEADER_SIZE,
++ bufsiz);
++
++ /*
++ * Subtlety here: if we have a space, the handles will be
++ * transformed, so when we restore the header we also have to
++ * restore the handles.
++ */
++ memcpy(save, buf, save_size);
++
++ for (;;) {
++ ret = tpm_try_transmit(chip, space, buf, bufsiz, flags);
++ if (ret < 0)
++ break;
++ rc = be32_to_cpu(header->return_code);
++ if (rc != TPM2_RC_RETRY)
++ break;
++ delay_msec *= 2;
++ if (delay_msec > TPM2_DURATION_LONG) {
++ dev_err(&chip->dev, "TPM is in retry loop\n");
++ break;
++ }
++ tpm_msleep(delay_msec);
++ memcpy(buf, save, save_size);
++ }
++ return ret;
++}
++/**
++ * tpm_transmit_cmd - send a tpm command to the device
+ * The function extracts tpm out header return code
+ *
+ * @chip: TPM chip to use
++ * @space: tpm space
+ * @buf: TPM command buffer
+ * @bufsiz: length of the buffer
+ * @min_rsp_body_length: minimum expected length of response body
+diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
+index f895fba4e20d..d73f3fb81b42 100644
+--- a/drivers/char/tpm/tpm.h
++++ b/drivers/char/tpm/tpm.h
+@@ -108,6 +108,7 @@ enum tpm2_return_codes {
+ TPM2_RC_COMMAND_CODE = 0x0143,
+ TPM2_RC_TESTING = 0x090A, /* RC_WARN */
+ TPM2_RC_REFERENCE_H0 = 0x0910,
++ TPM2_RC_RETRY = 0x0922,
+ };
+
+ enum tpm2_algorithms {
+diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
+index 7b3c2a8aa9de..497edd9848cd 100644
+--- a/drivers/char/tpm/tpm_crb.c
++++ b/drivers/char/tpm/tpm_crb.c
+@@ -112,6 +112,25 @@ struct tpm2_crb_smc {
+ u32 smc_func_id;
+ };
+
++static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
++ unsigned long timeout)
++{
++ ktime_t start;
++ ktime_t stop;
++
++ start = ktime_get();
++ stop = ktime_add(start, ms_to_ktime(timeout));
++
++ do {
++ if ((ioread32(reg) & mask) == value)
++ return true;
++
++ usleep_range(50, 100);
++ } while (ktime_before(ktime_get(), stop));
++
++ return ((ioread32(reg) & mask) == value);
++}
++
+ /**
+ * crb_go_idle - request tpm crb device to go the idle state
+ *
+@@ -128,7 +147,7 @@ struct tpm2_crb_smc {
+ *
+ * Return: 0 always
+ */
+-static int __maybe_unused crb_go_idle(struct device *dev, struct crb_priv *priv)
++static int crb_go_idle(struct device *dev, struct crb_priv *priv)
+ {
+ if ((priv->sm == ACPI_TPM2_START_METHOD) ||
+ (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) ||
+@@ -136,30 +155,17 @@ static int __maybe_unused crb_go_idle(struct device *dev, struct crb_priv *priv)
+ return 0;
+
+ iowrite32(CRB_CTRL_REQ_GO_IDLE, &priv->regs_t->ctrl_req);
+- /* we don't really care when this settles */
+
++ if (!crb_wait_for_reg_32(&priv->regs_t->ctrl_req,
++ CRB_CTRL_REQ_GO_IDLE/* mask */,
++ 0, /* value */
++ TPM2_TIMEOUT_C)) {
++ dev_warn(dev, "goIdle timed out\n");
++ return -ETIME;
++ }
+ return 0;
+ }
+
+-static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
+- unsigned long timeout)
+-{
+- ktime_t start;
+- ktime_t stop;
+-
+- start = ktime_get();
+- stop = ktime_add(start, ms_to_ktime(timeout));
+-
+- do {
+- if ((ioread32(reg) & mask) == value)
+- return true;
+-
+- usleep_range(50, 100);
+- } while (ktime_before(ktime_get(), stop));
+-
+- return false;
+-}
+-
+ /**
+ * crb_cmd_ready - request tpm crb device to enter ready state
+ *
+@@ -175,8 +181,7 @@ static bool crb_wait_for_reg_32(u32 __iomem *reg, u32 mask, u32 value,
+ *
+ * Return: 0 on success -ETIME on timeout;
+ */
+-static int __maybe_unused crb_cmd_ready(struct device *dev,
+- struct crb_priv *priv)
++static int crb_cmd_ready(struct device *dev, struct crb_priv *priv)
+ {
+ if ((priv->sm == ACPI_TPM2_START_METHOD) ||
+ (priv->sm == ACPI_TPM2_COMMAND_BUFFER_WITH_START_METHOD) ||
+@@ -195,11 +200,11 @@ static int __maybe_unused crb_cmd_ready(struct device *dev,
+ return 0;
+ }
+
+-static int crb_request_locality(struct tpm_chip *chip, int loc)
++static int __crb_request_locality(struct device *dev,
++ struct crb_priv *priv, int loc)
+ {
+- struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+ u32 value = CRB_LOC_STATE_LOC_ASSIGNED |
+- CRB_LOC_STATE_TPM_REG_VALID_STS;
++ CRB_LOC_STATE_TPM_REG_VALID_STS;
+
+ if (!priv->regs_h)
+ return 0;
+@@ -207,21 +212,45 @@ static int crb_request_locality(struct tpm_chip *chip, int loc)
+ iowrite32(CRB_LOC_CTRL_REQUEST_ACCESS, &priv->regs_h->loc_ctrl);
+ if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, value, value,
+ TPM2_TIMEOUT_C)) {
+- dev_warn(&chip->dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++ dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
+ return -ETIME;
+ }
+
+ return 0;
+ }
+
+-static void crb_relinquish_locality(struct tpm_chip *chip, int loc)
++static int crb_request_locality(struct tpm_chip *chip, int loc)
+ {
+ struct crb_priv *priv = dev_get_drvdata(&chip->dev);
+
++ return __crb_request_locality(&chip->dev, priv, loc);
++}
++
++static int __crb_relinquish_locality(struct device *dev,
++ struct crb_priv *priv, int loc)
++{
++ u32 mask = CRB_LOC_STATE_LOC_ASSIGNED |
++ CRB_LOC_STATE_TPM_REG_VALID_STS;
++ u32 value = CRB_LOC_STATE_TPM_REG_VALID_STS;
++
+ if (!priv->regs_h)
+- return;
++ return 0;
+
+ iowrite32(CRB_LOC_CTRL_RELINQUISH, &priv->regs_h->loc_ctrl);
++ if (!crb_wait_for_reg_32(&priv->regs_h->loc_state, mask, value,
++ TPM2_TIMEOUT_C)) {
++ dev_warn(dev, "TPM_LOC_STATE_x.requestAccess timed out\n");
++ return -ETIME;
++ }
++
++ return 0;
++}
++
++static int crb_relinquish_locality(struct tpm_chip *chip, int loc)
++{
++ struct crb_priv *priv = dev_get_drvdata(&chip->dev);
++
++ return __crb_relinquish_locality(&chip->dev, priv, loc);
+ }
+
+ static u8 crb_status(struct tpm_chip *chip)
+@@ -475,6 +504,10 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+ dev_warn(dev, FW_BUG "Bad ACPI memory layout");
+ }
+
++ ret = __crb_request_locality(dev, priv, 0);
++ if (ret)
++ return ret;
++
+ priv->regs_t = crb_map_res(dev, priv, &io_res, buf->control_address,
+ sizeof(struct crb_regs_tail));
+ if (IS_ERR(priv->regs_t))
+@@ -531,6 +564,8 @@ static int crb_map_io(struct acpi_device *device, struct crb_priv *priv,
+
+ crb_go_idle(dev, priv);
+
++ __crb_relinquish_locality(dev, priv, 0);
++
+ return ret;
+ }
+
+@@ -588,10 +623,14 @@ static int crb_acpi_add(struct acpi_device *device)
+ chip->acpi_dev_handle = device->handle;
+ chip->flags = TPM_CHIP_FLAG_TPM2;
+
+- rc = crb_cmd_ready(dev, priv);
++ rc = __crb_request_locality(dev, priv, 0);
+ if (rc)
+ return rc;
+
++ rc = crb_cmd_ready(dev, priv);
++ if (rc)
++ goto out;
++
+ pm_runtime_get_noresume(dev);
+ pm_runtime_set_active(dev);
+ pm_runtime_enable(dev);
+@@ -601,12 +640,15 @@ static int crb_acpi_add(struct acpi_device *device)
+ crb_go_idle(dev, priv);
+ pm_runtime_put_noidle(dev);
+ pm_runtime_disable(dev);
+- return rc;
++ goto out;
+ }
+
+- pm_runtime_put(dev);
++ pm_runtime_put_sync(dev);
+
+- return 0;
++out:
++ __crb_relinquish_locality(dev, priv, 0);
++
++ return rc;
+ }
+
+ static int crb_acpi_remove(struct acpi_device *device)
+diff --git a/drivers/char/tpm/tpm_tis_core.c b/drivers/char/tpm/tpm_tis_core.c
+index da074e3db19b..5a1f47b43947 100644
+--- a/drivers/char/tpm/tpm_tis_core.c
++++ b/drivers/char/tpm/tpm_tis_core.c
+@@ -143,11 +143,13 @@ static bool check_locality(struct tpm_chip *chip, int l)
+ return false;
+ }
+
+-static void release_locality(struct tpm_chip *chip, int l)
++static int release_locality(struct tpm_chip *chip, int l)
+ {
+ struct tpm_tis_data *priv = dev_get_drvdata(&chip->dev);
+
+ tpm_tis_write8(priv, TPM_ACCESS(l), TPM_ACCESS_ACTIVE_LOCALITY);
++
++ return 0;
+ }
+
+ static int request_locality(struct tpm_chip *chip, int l)
+diff --git a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+index a38db40ce990..b2447ee3b245 100644
+--- a/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
++++ b/drivers/gpu/drm/bridge/synopsys/dw-hdmi.c
+@@ -1637,6 +1637,8 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
+ * (and possibly on the platform). So far only i.MX6Q (v1.30a) and
+ * i.MX6DL (v1.31a) have been identified as needing the workaround, with
+ * 4 and 1 iterations respectively.
++ * The Amlogic Meson GX SoCs (v2.01a) have been identified as needing
++ * the workaround with a single iteration.
+ */
+
+ switch (hdmi->version) {
+@@ -1644,6 +1646,7 @@ static void dw_hdmi_clear_overflow(struct dw_hdmi *hdmi)
+ count = 4;
+ break;
+ case 0x131a:
++ case 0x201a:
+ count = 1;
+ break;
+ default:
+diff --git a/drivers/hwmon/k10temp.c b/drivers/hwmon/k10temp.c
+index 051a72eecb24..d2cc55e21374 100644
+--- a/drivers/hwmon/k10temp.c
++++ b/drivers/hwmon/k10temp.c
+@@ -40,6 +40,10 @@ static DEFINE_MUTEX(nb_smu_ind_mutex);
+ #define PCI_DEVICE_ID_AMD_17H_DF_F3 0x1463
+ #endif
+
++#ifndef PCI_DEVICE_ID_AMD_17H_RR_NB
++#define PCI_DEVICE_ID_AMD_17H_RR_NB 0x15d0
++#endif
++
+ /* CPUID function 0x80000001, ebx */
+ #define CPUID_PKGTYPE_MASK 0xf0000000
+ #define CPUID_PKGTYPE_F 0x00000000
+@@ -72,6 +76,7 @@ struct k10temp_data {
+ struct pci_dev *pdev;
+ void (*read_tempreg)(struct pci_dev *pdev, u32 *regval);
+ int temp_offset;
++ u32 temp_adjust_mask;
+ };
+
+ struct tctl_offset {
+@@ -84,6 +89,7 @@ static const struct tctl_offset tctl_offset_table[] = {
+ { 0x17, "AMD Ryzen 5 1600X", 20000 },
+ { 0x17, "AMD Ryzen 7 1700X", 20000 },
+ { 0x17, "AMD Ryzen 7 1800X", 20000 },
++ { 0x17, "AMD Ryzen 7 2700X", 10000 },
+ { 0x17, "AMD Ryzen Threadripper 1950X", 27000 },
+ { 0x17, "AMD Ryzen Threadripper 1920X", 27000 },
+ { 0x17, "AMD Ryzen Threadripper 1900X", 27000 },
+@@ -129,6 +135,8 @@ static ssize_t temp1_input_show(struct device *dev,
+
+ data->read_tempreg(data->pdev, ®val);
+ temp = (regval >> 21) * 125;
++ if (regval & data->temp_adjust_mask)
++ temp -= 49000;
+ if (temp > data->temp_offset)
+ temp -= data->temp_offset;
+ else
+@@ -259,12 +267,14 @@ static int k10temp_probe(struct pci_dev *pdev,
+ data->pdev = pdev;
+
+ if (boot_cpu_data.x86 == 0x15 && (boot_cpu_data.x86_model == 0x60 ||
+- boot_cpu_data.x86_model == 0x70))
++ boot_cpu_data.x86_model == 0x70)) {
+ data->read_tempreg = read_tempreg_nb_f15;
+- else if (boot_cpu_data.x86 == 0x17)
++ } else if (boot_cpu_data.x86 == 0x17) {
++ data->temp_adjust_mask = 0x80000;
+ data->read_tempreg = read_tempreg_nb_f17;
+- else
++ } else {
+ data->read_tempreg = read_tempreg_pci;
++ }
+
+ for (i = 0; i < ARRAY_SIZE(tctl_offset_table); i++) {
+ const struct tctl_offset *entry = &tctl_offset_table[i];
+@@ -292,6 +302,7 @@ static const struct pci_device_id k10temp_id_table[] = {
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_16H_M30H_NB_F3) },
+ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_DF_F3) },
++ { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_17H_RR_NB) },
+ {}
+ };
+ MODULE_DEVICE_TABLE(pci, k10temp_id_table);
+diff --git a/drivers/message/fusion/mptsas.c b/drivers/message/fusion/mptsas.c
+index 439ee9c5f535..c59b5da85321 100644
+--- a/drivers/message/fusion/mptsas.c
++++ b/drivers/message/fusion/mptsas.c
+@@ -1994,6 +1994,7 @@ static struct scsi_host_template mptsas_driver_template = {
+ .cmd_per_lun = 7,
+ .use_clustering = ENABLE_CLUSTERING,
+ .shost_attrs = mptscsih_host_attrs,
++ .no_write_same = 1,
+ };
+
+ static int mptsas_get_linkerrors(struct sas_phy *phy)
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index b7b113018853..718e4914e3a0 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1660,8 +1660,7 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev,
+ } /* switch(bond_mode) */
+
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+- slave_dev->npinfo = bond->dev->npinfo;
+- if (slave_dev->npinfo) {
++ if (bond->dev->npinfo) {
+ if (slave_enable_netpoll(new_slave)) {
+ netdev_info(bond_dev, "master_dev is using netpoll, but new slave device does not support netpoll\n");
+ res = -EBUSY;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-common.h b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+index 7ea72ef11a55..d272dc6984ac 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-common.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-common.h
+@@ -1321,6 +1321,10 @@
+ #define MDIO_VEND2_AN_STAT 0x8002
+ #endif
+
++#ifndef MDIO_VEND2_PMA_CDR_CONTROL
++#define MDIO_VEND2_PMA_CDR_CONTROL 0x8056
++#endif
++
+ #ifndef MDIO_CTRL1_SPEED1G
+ #define MDIO_CTRL1_SPEED1G (MDIO_CTRL1_SPEED10G & ~BMCR_SPEED100)
+ #endif
+@@ -1369,6 +1373,10 @@
+ #define XGBE_AN_CL37_TX_CONFIG_MASK 0x08
+ #define XGBE_AN_CL37_MII_CTRL_8BIT 0x0100
+
++#define XGBE_PMA_CDR_TRACK_EN_MASK 0x01
++#define XGBE_PMA_CDR_TRACK_EN_OFF 0x00
++#define XGBE_PMA_CDR_TRACK_EN_ON 0x01
++
+ /* Bit setting and getting macros
+ * The get macro will extract the current bit field value from within
+ * the variable
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+index 7d128be61310..b91143947ed2 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-debugfs.c
+@@ -519,6 +519,22 @@ void xgbe_debugfs_init(struct xgbe_prv_data *pdata)
+ "debugfs_create_file failed\n");
+ }
+
++ if (pdata->vdata->an_cdr_workaround) {
++ pfile = debugfs_create_bool("an_cdr_workaround", 0600,
++ pdata->xgbe_debugfs,
++ &pdata->debugfs_an_cdr_workaround);
++ if (!pfile)
++ netdev_err(pdata->netdev,
++ "debugfs_create_bool failed\n");
++
++ pfile = debugfs_create_bool("an_cdr_track_early", 0600,
++ pdata->xgbe_debugfs,
++ &pdata->debugfs_an_cdr_track_early);
++ if (!pfile)
++ netdev_err(pdata->netdev,
++ "debugfs_create_bool failed\n");
++ }
++
+ kfree(buf);
+ }
+
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-main.c b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+index d91fa595be98..e31d9d1fb6a6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-main.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-main.c
+@@ -349,6 +349,7 @@ int xgbe_config_netdev(struct xgbe_prv_data *pdata)
+ XGMAC_SET_BITS(pdata->rss_options, MAC_RSSCR, UDP4TE, 1);
+
+ /* Call MDIO/PHY initialization routine */
++ pdata->debugfs_an_cdr_workaround = pdata->vdata->an_cdr_workaround;
+ ret = pdata->phy_if.phy_init(pdata);
+ if (ret)
+ return ret;
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+index 072b9f664597..1b45cd73a258 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
+@@ -432,11 +432,16 @@ static void xgbe_an73_disable(struct xgbe_prv_data *pdata)
+ xgbe_an73_set(pdata, false, false);
+ xgbe_an73_disable_interrupts(pdata);
+
++ pdata->an_start = 0;
++
+ netif_dbg(pdata, link, pdata->netdev, "CL73 AN disabled\n");
+ }
+
+ static void xgbe_an_restart(struct xgbe_prv_data *pdata)
+ {
++ if (pdata->phy_if.phy_impl.an_pre)
++ pdata->phy_if.phy_impl.an_pre(pdata);
++
+ switch (pdata->an_mode) {
+ case XGBE_AN_MODE_CL73:
+ case XGBE_AN_MODE_CL73_REDRV:
+@@ -453,6 +458,9 @@ static void xgbe_an_restart(struct xgbe_prv_data *pdata)
+
+ static void xgbe_an_disable(struct xgbe_prv_data *pdata)
+ {
++ if (pdata->phy_if.phy_impl.an_post)
++ pdata->phy_if.phy_impl.an_post(pdata);
++
+ switch (pdata->an_mode) {
+ case XGBE_AN_MODE_CL73:
+ case XGBE_AN_MODE_CL73_REDRV:
+@@ -505,11 +513,11 @@ static enum xgbe_an xgbe_an73_tx_training(struct xgbe_prv_data *pdata,
+ XMDIO_WRITE(pdata, MDIO_MMD_PMAPMD, MDIO_PMA_10GBR_PMD_CTRL,
+ reg);
+
+- if (pdata->phy_if.phy_impl.kr_training_post)
+- pdata->phy_if.phy_impl.kr_training_post(pdata);
+-
+ netif_dbg(pdata, link, pdata->netdev,
+ "KR training initiated\n");
++
++ if (pdata->phy_if.phy_impl.kr_training_post)
++ pdata->phy_if.phy_impl.kr_training_post(pdata);
+ }
+
+ return XGBE_AN_PAGE_RECEIVED;
+@@ -637,11 +645,11 @@ static enum xgbe_an xgbe_an73_incompat_link(struct xgbe_prv_data *pdata)
+ return XGBE_AN_NO_LINK;
+ }
+
+- xgbe_an73_disable(pdata);
++ xgbe_an_disable(pdata);
+
+ xgbe_switch_mode(pdata);
+
+- xgbe_an73_restart(pdata);
++ xgbe_an_restart(pdata);
+
+ return XGBE_AN_INCOMPAT_LINK;
+ }
+@@ -820,6 +828,9 @@ static void xgbe_an37_state_machine(struct xgbe_prv_data *pdata)
+ pdata->an_result = pdata->an_state;
+ pdata->an_state = XGBE_AN_READY;
+
++ if (pdata->phy_if.phy_impl.an_post)
++ pdata->phy_if.phy_impl.an_post(pdata);
++
+ netif_dbg(pdata, link, pdata->netdev, "CL37 AN result: %s\n",
+ xgbe_state_as_string(pdata->an_result));
+ }
+@@ -903,6 +914,9 @@ static void xgbe_an73_state_machine(struct xgbe_prv_data *pdata)
+ pdata->kx_state = XGBE_RX_BPA;
+ pdata->an_start = 0;
+
++ if (pdata->phy_if.phy_impl.an_post)
++ pdata->phy_if.phy_impl.an_post(pdata);
++
+ netif_dbg(pdata, link, pdata->netdev, "CL73 AN result: %s\n",
+ xgbe_state_as_string(pdata->an_result));
+ }
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+index eb23f9ba1a9a..82d1f416ee2a 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-pci.c
+@@ -456,6 +456,7 @@ static const struct xgbe_version_data xgbe_v2a = {
+ .irq_reissue_support = 1,
+ .tx_desc_prefetch = 5,
+ .rx_desc_prefetch = 5,
++ .an_cdr_workaround = 1,
+ };
+
+ static const struct xgbe_version_data xgbe_v2b = {
+@@ -470,6 +471,7 @@ static const struct xgbe_version_data xgbe_v2b = {
+ .irq_reissue_support = 1,
+ .tx_desc_prefetch = 5,
+ .rx_desc_prefetch = 5,
++ .an_cdr_workaround = 1,
+ };
+
+ static const struct pci_device_id xgbe_pci_table[] = {
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+index 3304a291aa96..aac884314000 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
++++ b/drivers/net/ethernet/amd/xgbe/xgbe-phy-v2.c
+@@ -147,6 +147,14 @@
+ /* Rate-change complete wait/retry count */
+ #define XGBE_RATECHANGE_COUNT 500
+
++/* CDR delay values for KR support (in usec) */
++#define XGBE_CDR_DELAY_INIT 10000
++#define XGBE_CDR_DELAY_INC 10000
++#define XGBE_CDR_DELAY_MAX 100000
++
++/* RRC frequency during link status check */
++#define XGBE_RRC_FREQUENCY 10
++
+ enum xgbe_port_mode {
+ XGBE_PORT_MODE_RSVD = 0,
+ XGBE_PORT_MODE_BACKPLANE,
+@@ -245,6 +253,10 @@ enum xgbe_sfp_speed {
+ #define XGBE_SFP_BASE_VENDOR_SN 4
+ #define XGBE_SFP_BASE_VENDOR_SN_LEN 16
+
++#define XGBE_SFP_EXTD_OPT1 1
++#define XGBE_SFP_EXTD_OPT1_RX_LOS BIT(1)
++#define XGBE_SFP_EXTD_OPT1_TX_FAULT BIT(3)
++
+ #define XGBE_SFP_EXTD_DIAG 28
+ #define XGBE_SFP_EXTD_DIAG_ADDR_CHANGE BIT(2)
+
+@@ -324,6 +336,7 @@ struct xgbe_phy_data {
+
+ unsigned int sfp_gpio_address;
+ unsigned int sfp_gpio_mask;
++ unsigned int sfp_gpio_inputs;
+ unsigned int sfp_gpio_rx_los;
+ unsigned int sfp_gpio_tx_fault;
+ unsigned int sfp_gpio_mod_absent;
+@@ -355,6 +368,10 @@ struct xgbe_phy_data {
+ unsigned int redrv_addr;
+ unsigned int redrv_lane;
+ unsigned int redrv_model;
++
++ /* KR AN support */
++ unsigned int phy_cdr_notrack;
++ unsigned int phy_cdr_delay;
+ };
+
+ /* I2C, MDIO and GPIO lines are muxed, so only one device at a time */
+@@ -974,6 +991,49 @@ static void xgbe_phy_sfp_external_phy(struct xgbe_prv_data *pdata)
+ phy_data->sfp_phy_avail = 1;
+ }
+
++static bool xgbe_phy_check_sfp_rx_los(struct xgbe_phy_data *phy_data)
++{
++ u8 *sfp_extd = phy_data->sfp_eeprom.extd;
++
++ if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_RX_LOS))
++ return false;
++
++ if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS)
++ return false;
++
++ if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_rx_los))
++ return true;
++
++ return false;
++}
++
++static bool xgbe_phy_check_sfp_tx_fault(struct xgbe_phy_data *phy_data)
++{
++ u8 *sfp_extd = phy_data->sfp_eeprom.extd;
++
++ if (!(sfp_extd[XGBE_SFP_EXTD_OPT1] & XGBE_SFP_EXTD_OPT1_TX_FAULT))
++ return false;
++
++ if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT)
++ return false;
++
++ if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_tx_fault))
++ return true;
++
++ return false;
++}
++
++static bool xgbe_phy_check_sfp_mod_absent(struct xgbe_phy_data *phy_data)
++{
++ if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT)
++ return false;
++
++ if (phy_data->sfp_gpio_inputs & (1 << phy_data->sfp_gpio_mod_absent))
++ return true;
++
++ return false;
++}
++
+ static bool xgbe_phy_belfuse_parse_quirks(struct xgbe_prv_data *pdata)
+ {
+ struct xgbe_phy_data *phy_data = pdata->phy_data;
+@@ -1019,6 +1079,10 @@ static void xgbe_phy_sfp_parse_eeprom(struct xgbe_prv_data *pdata)
+ if (sfp_base[XGBE_SFP_BASE_EXT_ID] != XGBE_SFP_EXT_ID_SFP)
+ return;
+
++ /* Update transceiver signals (eeprom extd/options) */
++ phy_data->sfp_tx_fault = xgbe_phy_check_sfp_tx_fault(phy_data);
++ phy_data->sfp_rx_los = xgbe_phy_check_sfp_rx_los(phy_data);
++
+ if (xgbe_phy_sfp_parse_quirks(pdata))
+ return;
+
+@@ -1184,7 +1248,6 @@ static int xgbe_phy_sfp_read_eeprom(struct xgbe_prv_data *pdata)
+ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
+ {
+ struct xgbe_phy_data *phy_data = pdata->phy_data;
+- unsigned int gpio_input;
+ u8 gpio_reg, gpio_ports[2];
+ int ret;
+
+@@ -1199,23 +1262,9 @@ static void xgbe_phy_sfp_signals(struct xgbe_prv_data *pdata)
+ return;
+ }
+
+- gpio_input = (gpio_ports[1] << 8) | gpio_ports[0];
+-
+- if (phy_data->sfp_gpio_mask & XGBE_GPIO_NO_MOD_ABSENT) {
+- /* No GPIO, just assume the module is present for now */
+- phy_data->sfp_mod_absent = 0;
+- } else {
+- if (!(gpio_input & (1 << phy_data->sfp_gpio_mod_absent)))
+- phy_data->sfp_mod_absent = 0;
+- }
+-
+- if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_RX_LOS) &&
+- (gpio_input & (1 << phy_data->sfp_gpio_rx_los)))
+- phy_data->sfp_rx_los = 1;
++ phy_data->sfp_gpio_inputs = (gpio_ports[1] << 8) | gpio_ports[0];
+
+- if (!(phy_data->sfp_gpio_mask & XGBE_GPIO_NO_TX_FAULT) &&
+- (gpio_input & (1 << phy_data->sfp_gpio_tx_fault)))
+- phy_data->sfp_tx_fault = 1;
++ phy_data->sfp_mod_absent = xgbe_phy_check_sfp_mod_absent(phy_data);
+ }
+
+ static void xgbe_phy_sfp_mod_absent(struct xgbe_prv_data *pdata)
+@@ -2361,7 +2410,7 @@ static int xgbe_phy_link_status(struct xgbe_prv_data *pdata, int *an_restart)
+ return 1;
+
+ /* No link, attempt a receiver reset cycle */
+- if (phy_data->rrc_count++) {
++ if (phy_data->rrc_count++ > XGBE_RRC_FREQUENCY) {
+ phy_data->rrc_count = 0;
+ xgbe_phy_rrc(pdata);
+ }
+@@ -2669,6 +2718,103 @@ static bool xgbe_phy_port_enabled(struct xgbe_prv_data *pdata)
+ return true;
+ }
+
++static void xgbe_phy_cdr_track(struct xgbe_prv_data *pdata)
++{
++ struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++ if (!pdata->debugfs_an_cdr_workaround)
++ return;
++
++ if (!phy_data->phy_cdr_notrack)
++ return;
++
++ usleep_range(phy_data->phy_cdr_delay,
++ phy_data->phy_cdr_delay + 500);
++
++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
++ XGBE_PMA_CDR_TRACK_EN_MASK,
++ XGBE_PMA_CDR_TRACK_EN_ON);
++
++ phy_data->phy_cdr_notrack = 0;
++}
++
++static void xgbe_phy_cdr_notrack(struct xgbe_prv_data *pdata)
++{
++ struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++ if (!pdata->debugfs_an_cdr_workaround)
++ return;
++
++ if (phy_data->phy_cdr_notrack)
++ return;
++
++ XMDIO_WRITE_BITS(pdata, MDIO_MMD_PMAPMD, MDIO_VEND2_PMA_CDR_CONTROL,
++ XGBE_PMA_CDR_TRACK_EN_MASK,
++ XGBE_PMA_CDR_TRACK_EN_OFF);
++
++ xgbe_phy_rrc(pdata);
++
++ phy_data->phy_cdr_notrack = 1;
++}
++
++static void xgbe_phy_kr_training_post(struct xgbe_prv_data *pdata)
++{
++ if (!pdata->debugfs_an_cdr_track_early)
++ xgbe_phy_cdr_track(pdata);
++}
++
++static void xgbe_phy_kr_training_pre(struct xgbe_prv_data *pdata)
++{
++ if (pdata->debugfs_an_cdr_track_early)
++ xgbe_phy_cdr_track(pdata);
++}
++
++static void xgbe_phy_an_post(struct xgbe_prv_data *pdata)
++{
++ struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++ switch (pdata->an_mode) {
++ case XGBE_AN_MODE_CL73:
++ case XGBE_AN_MODE_CL73_REDRV:
++ if (phy_data->cur_mode != XGBE_MODE_KR)
++ break;
++
++ xgbe_phy_cdr_track(pdata);
++
++ switch (pdata->an_result) {
++ case XGBE_AN_READY:
++ case XGBE_AN_COMPLETE:
++ break;
++ default:
++ if (phy_data->phy_cdr_delay < XGBE_CDR_DELAY_MAX)
++ phy_data->phy_cdr_delay += XGBE_CDR_DELAY_INC;
++ else
++ phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
++ break;
++ }
++ break;
++ default:
++ break;
++ }
++}
++
++static void xgbe_phy_an_pre(struct xgbe_prv_data *pdata)
++{
++ struct xgbe_phy_data *phy_data = pdata->phy_data;
++
++ switch (pdata->an_mode) {
++ case XGBE_AN_MODE_CL73:
++ case XGBE_AN_MODE_CL73_REDRV:
++ if (phy_data->cur_mode != XGBE_MODE_KR)
++ break;
++
++ xgbe_phy_cdr_notrack(pdata);
++ break;
++ default:
++ break;
++ }
++}
++
+ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ {
+ struct xgbe_phy_data *phy_data = pdata->phy_data;
+@@ -2680,6 +2826,9 @@ static void xgbe_phy_stop(struct xgbe_prv_data *pdata)
+ xgbe_phy_sfp_reset(phy_data);
+ xgbe_phy_sfp_mod_absent(pdata);
+
++ /* Reset CDR support */
++ xgbe_phy_cdr_track(pdata);
++
+ /* Power off the PHY */
+ xgbe_phy_power_off(pdata);
+
+@@ -2712,6 +2861,9 @@ static int xgbe_phy_start(struct xgbe_prv_data *pdata)
+ /* Start in highest supported mode */
+ xgbe_phy_set_mode(pdata, phy_data->start_mode);
+
++ /* Reset CDR support */
++ xgbe_phy_cdr_track(pdata);
++
+ /* After starting the I2C controller, we can check for an SFP */
+ switch (phy_data->port_mode) {
+ case XGBE_PORT_MODE_SFP:
+@@ -3019,6 +3171,8 @@ static int xgbe_phy_init(struct xgbe_prv_data *pdata)
+ }
+ }
+
++ phy_data->phy_cdr_delay = XGBE_CDR_DELAY_INIT;
++
+ /* Register for driving external PHYs */
+ mii = devm_mdiobus_alloc(pdata->dev);
+ if (!mii) {
+@@ -3071,4 +3225,10 @@ void xgbe_init_function_ptrs_phy_v2(struct xgbe_phy_if *phy_if)
+ phy_impl->an_advertising = xgbe_phy_an_advertising;
+
+ phy_impl->an_outcome = xgbe_phy_an_outcome;
++
++ phy_impl->an_pre = xgbe_phy_an_pre;
++ phy_impl->an_post = xgbe_phy_an_post;
++
++ phy_impl->kr_training_pre = xgbe_phy_kr_training_pre;
++ phy_impl->kr_training_post = xgbe_phy_kr_training_post;
+ }
+diff --git a/drivers/net/ethernet/amd/xgbe/xgbe.h b/drivers/net/ethernet/amd/xgbe/xgbe.h
+index ad102c8bac7b..95d4b56448c6 100644
+--- a/drivers/net/ethernet/amd/xgbe/xgbe.h
++++ b/drivers/net/ethernet/amd/xgbe/xgbe.h
+@@ -833,6 +833,7 @@ struct xgbe_hw_if {
+ /* This structure represents implementation specific routines for an
+ * implementation of a PHY. All routines are required unless noted below.
+ * Optional routines:
++ * an_pre, an_post
+ * kr_training_pre, kr_training_post
+ */
+ struct xgbe_phy_impl_if {
+@@ -875,6 +876,10 @@ struct xgbe_phy_impl_if {
+ /* Process results of auto-negotiation */
+ enum xgbe_mode (*an_outcome)(struct xgbe_prv_data *);
+
++ /* Pre/Post auto-negotiation support */
++ void (*an_pre)(struct xgbe_prv_data *);
++ void (*an_post)(struct xgbe_prv_data *);
++
+ /* Pre/Post KR training enablement support */
+ void (*kr_training_pre)(struct xgbe_prv_data *);
+ void (*kr_training_post)(struct xgbe_prv_data *);
+@@ -989,6 +994,7 @@ struct xgbe_version_data {
+ unsigned int irq_reissue_support;
+ unsigned int tx_desc_prefetch;
+ unsigned int rx_desc_prefetch;
++ unsigned int an_cdr_workaround;
+ };
+
+ struct xgbe_vxlan_data {
+@@ -1257,6 +1263,9 @@ struct xgbe_prv_data {
+ unsigned int debugfs_xprop_reg;
+
+ unsigned int debugfs_xi2c_reg;
++
++ bool debugfs_an_cdr_workaround;
++ bool debugfs_an_cdr_track_early;
+ };
+
+ /* Function prototypes*/
+diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+index c96a92118b8b..32f6d2e24d66 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
++++ b/drivers/net/ethernet/aquantia/atlantic/aq_nic.c
+@@ -951,9 +951,11 @@ void aq_nic_shutdown(struct aq_nic_s *self)
+
+ netif_device_detach(self->ndev);
+
+- err = aq_nic_stop(self);
+- if (err < 0)
+- goto err_exit;
++ if (netif_running(self->ndev)) {
++ err = aq_nic_stop(self);
++ if (err < 0)
++ goto err_exit;
++ }
+ aq_nic_deinit(self);
+
+ err_exit:
+diff --git a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+index d3b847ec7465..c58b2c227260 100644
+--- a/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
++++ b/drivers/net/ethernet/aquantia/atlantic/hw_atl/hw_atl_utils.c
+@@ -48,6 +48,8 @@
+ #define FORCE_FLASHLESS 0
+
+ static int hw_atl_utils_ver_match(u32 ver_expected, u32 ver_actual);
++static int hw_atl_utils_mpi_set_state(struct aq_hw_s *self,
++ enum hal_atl_utils_fw_state_e state);
+
+ int hw_atl_utils_initfw(struct aq_hw_s *self, const struct aq_fw_ops **fw_ops)
+ {
+@@ -247,6 +249,20 @@ int hw_atl_utils_soft_reset(struct aq_hw_s *self)
+
+ self->rbl_enabled = (boot_exit_code != 0);
+
++ /* FW 1.x may bootup in an invalid POWER state (WOL feature).
++ * We should work around this by forcing its state back to DEINIT
++ */
++ if (!hw_atl_utils_ver_match(HW_ATL_FW_VER_1X,
++ aq_hw_read_reg(self,
++ HW_ATL_MPI_FW_VERSION))) {
++ int err = 0;
++
++ hw_atl_utils_mpi_set_state(self, MPI_DEINIT);
++ AQ_HW_WAIT_FOR((aq_hw_read_reg(self, HW_ATL_MPI_STATE_ADR) &
++ HW_ATL_MPI_STATE_MSK) == MPI_DEINIT,
++ 10, 1000U);
++ }
++
+ if (self->rbl_enabled)
+ return hw_atl_utils_soft_reset_rbl(self);
+ else
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+index 1801582076be..9442605f4fd4 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_ethtool.c
+@@ -1874,22 +1874,39 @@ static char *bnxt_parse_pkglog(int desired_field, u8 *data, size_t datalen)
+ return retval;
+ }
+
+-static char *bnxt_get_pkgver(struct net_device *dev, char *buf, size_t buflen)
++static void bnxt_get_pkgver(struct net_device *dev)
+ {
++ struct bnxt *bp = netdev_priv(dev);
+ u16 index = 0;
+- u32 datalen;
++ char *pkgver;
++ u32 pkglen;
++ u8 *pkgbuf;
++ int len;
+
+ if (bnxt_find_nvram_item(dev, BNX_DIR_TYPE_PKG_LOG,
+ BNX_DIR_ORDINAL_FIRST, BNX_DIR_EXT_NONE,
+- &index, NULL, &datalen) != 0)
+- return NULL;
++ &index, NULL, &pkglen) != 0)
++ return;
+
+- memset(buf, 0, buflen);
+- if (bnxt_get_nvram_item(dev, index, 0, datalen, buf) != 0)
+- return NULL;
++ pkgbuf = kzalloc(pkglen, GFP_KERNEL);
++ if (!pkgbuf) {
++ dev_err(&bp->pdev->dev, "Unable to allocate memory for pkg version, length = %u\n",
++ pkglen);
++ return;
++ }
++
++ if (bnxt_get_nvram_item(dev, index, 0, pkglen, pkgbuf))
++ goto err;
+
+- return bnxt_parse_pkglog(BNX_PKG_LOG_FIELD_IDX_PKG_VERSION, buf,
+- datalen);
++ pkgver = bnxt_parse_pkglog(BNX_PKG_LOG_FIELD_IDX_PKG_VERSION, pkgbuf,
++ pkglen);
++ if (pkgver && *pkgver != 0 && isdigit(*pkgver)) {
++ len = strlen(bp->fw_ver_str);
++ snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
++ "/pkg %s", pkgver);
++ }
++err:
++ kfree(pkgbuf);
+ }
+
+ static int bnxt_get_eeprom(struct net_device *dev,
+@@ -2558,22 +2575,10 @@ void bnxt_ethtool_init(struct bnxt *bp)
+ struct hwrm_selftest_qlist_input req = {0};
+ struct bnxt_test_info *test_info;
+ struct net_device *dev = bp->dev;
+- char *pkglog;
+ int i, rc;
+
+- pkglog = kzalloc(BNX_PKG_LOG_MAX_LENGTH, GFP_KERNEL);
+- if (pkglog) {
+- char *pkgver;
+- int len;
++ bnxt_get_pkgver(dev);
+
+- pkgver = bnxt_get_pkgver(dev, pkglog, BNX_PKG_LOG_MAX_LENGTH);
+- if (pkgver && *pkgver != 0 && isdigit(*pkgver)) {
+- len = strlen(bp->fw_ver_str);
+- snprintf(bp->fw_ver_str + len, FW_VER_STR_LEN - len - 1,
+- "/pkg %s", pkgver);
+- }
+- kfree(pkglog);
+- }
+ if (bp->hwrm_spec_code < 0x10704 || !BNXT_SINGLE_PF(bp))
+ return;
+
+diff --git a/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h b/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
+index 73f2249555b5..83444811d3c6 100644
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt_nvm_defs.h
+@@ -59,8 +59,6 @@ enum bnxt_nvm_directory_type {
+ #define BNX_DIR_ATTR_NO_CHKSUM (1 << 0)
+ #define BNX_DIR_ATTR_PROP_STREAM (1 << 1)
+
+-#define BNX_PKG_LOG_MAX_LENGTH 4096
+-
+ enum bnxnvm_pkglog_field_index {
+ BNX_PKG_LOG_FIELD_IDX_INSTALLED_TIMESTAMP = 0,
+ BNX_PKG_LOG_FIELD_IDX_PKG_DESCRIPTION = 1,
+diff --git a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+index e9309fb9084b..21a21934e5bf 100644
+--- a/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
++++ b/drivers/net/ethernet/intel/i40e/i40e_virtchnl_pf.c
+@@ -2889,6 +2889,7 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+ int ret = 0;
+ struct hlist_node *h;
+ int bkt;
++ u8 i;
+
+ /* validate the request */
+ if (vf_id >= pf->num_alloc_vfs) {
+@@ -2900,6 +2901,16 @@ int i40e_ndo_set_vf_mac(struct net_device *netdev, int vf_id, u8 *mac)
+
+ vf = &(pf->vf[vf_id]);
+ vsi = pf->vsi[vf->lan_vsi_idx];
++
++ /* When the VF is resetting wait until it is done.
++ * It can take up to 200 milliseconds,
++ * but wait for up to 300 milliseconds to be safe.
++ */
++ for (i = 0; i < 15; i++) {
++ if (test_bit(I40E_VF_STATE_INIT, &vf->vf_states))
++ break;
++ msleep(20);
++ }
+ if (!test_bit(I40E_VF_STATE_INIT, &vf->vf_states)) {
+ dev_err(&pf->pdev->dev, "VF %d still in reset. Try again.\n",
+ vf_id);
+diff --git a/drivers/net/ethernet/marvell/mvpp2.c b/drivers/net/ethernet/marvell/mvpp2.c
+index 5a1668cdb461..7f1083ce23da 100644
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -838,6 +838,8 @@ enum mvpp2_bm_type {
+
+ #define MVPP2_MIB_COUNTERS_STATS_DELAY (1 * HZ)
+
++#define MVPP2_DESC_DMA_MASK DMA_BIT_MASK(40)
++
+ /* Definitions */
+
+ /* Shared Packet Processor resources */
+@@ -1336,7 +1338,7 @@ static dma_addr_t mvpp2_txdesc_dma_addr_get(struct mvpp2_port *port,
+ if (port->priv->hw_version == MVPP21)
+ return tx_desc->pp21.buf_dma_addr;
+ else
+- return tx_desc->pp22.buf_dma_addr_ptp & GENMASK_ULL(40, 0);
++ return tx_desc->pp22.buf_dma_addr_ptp & MVPP2_DESC_DMA_MASK;
+ }
+
+ static void mvpp2_txdesc_dma_addr_set(struct mvpp2_port *port,
+@@ -1354,7 +1356,7 @@ static void mvpp2_txdesc_dma_addr_set(struct mvpp2_port *port,
+ } else {
+ u64 val = (u64)addr;
+
+- tx_desc->pp22.buf_dma_addr_ptp &= ~GENMASK_ULL(40, 0);
++ tx_desc->pp22.buf_dma_addr_ptp &= ~MVPP2_DESC_DMA_MASK;
+ tx_desc->pp22.buf_dma_addr_ptp |= val;
+ tx_desc->pp22.packet_offset = offset;
+ }
+@@ -1414,7 +1416,7 @@ static dma_addr_t mvpp2_rxdesc_dma_addr_get(struct mvpp2_port *port,
+ if (port->priv->hw_version == MVPP21)
+ return rx_desc->pp21.buf_dma_addr;
+ else
+- return rx_desc->pp22.buf_dma_addr_key_hash & GENMASK_ULL(40, 0);
++ return rx_desc->pp22.buf_dma_addr_key_hash & MVPP2_DESC_DMA_MASK;
+ }
+
+ static unsigned long mvpp2_rxdesc_cookie_get(struct mvpp2_port *port,
+@@ -1423,7 +1425,7 @@ static unsigned long mvpp2_rxdesc_cookie_get(struct mvpp2_port *port,
+ if (port->priv->hw_version == MVPP21)
+ return rx_desc->pp21.buf_cookie;
+ else
+- return rx_desc->pp22.buf_cookie_misc & GENMASK_ULL(40, 0);
++ return rx_desc->pp22.buf_cookie_misc & MVPP2_DESC_DMA_MASK;
+ }
+
+ static size_t mvpp2_rxdesc_size_get(struct mvpp2_port *port,
+@@ -8347,7 +8349,7 @@ static int mvpp2_probe(struct platform_device *pdev)
+ }
+
+ if (priv->hw_version == MVPP22) {
+- err = dma_set_mask(&pdev->dev, DMA_BIT_MASK(40));
++ err = dma_set_mask(&pdev->dev, MVPP2_DESC_DMA_MASK);
+ if (err)
+ goto err_mg_clk;
+ /* Sadly, the BM pools all share the same register to
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+index 7761a26ec9c5..e7565416639b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4.h
+@@ -343,7 +343,7 @@ enum power_event {
+ #define MTL_RX_OVERFLOW_INT BIT(16)
+
+ /* Default operating mode of the MAC */
+-#define GMAC_CORE_INIT (GMAC_CONFIG_JD | GMAC_CONFIG_PS | GMAC_CONFIG_ACS | \
++#define GMAC_CORE_INIT (GMAC_CONFIG_JD | GMAC_CONFIG_PS | \
+ GMAC_CONFIG_BE | GMAC_CONFIG_DCRS)
+
+ /* To dump the core regs excluding the Address Registers */
+diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+index 63795ecafc8d..26dfb75e927a 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_core.c
+@@ -30,13 +30,6 @@ static void dwmac4_core_init(struct mac_device_info *hw,
+
+ value |= GMAC_CORE_INIT;
+
+- /* Clear ACS bit because Ethernet switch tagging formats such as
+- * Broadcom tags can look like invalid LLC/SNAP packets and cause the
+- * hardware to truncate packets on reception.
+- */
+- if (netdev_uses_dsa(dev))
+- value &= ~GMAC_CONFIG_ACS;
+-
+ if (mtu > 1500)
+ value |= GMAC_CONFIG_2K;
+ if (mtu > 2000)
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index 7ad841434ec8..3ea343b45d93 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -3435,8 +3435,13 @@ static int stmmac_rx(struct stmmac_priv *priv, int limit, u32 queue)
+
+ /* ACS is set; GMAC core strips PAD/FCS for IEEE 802.3
+ * Type frames (LLC/LLC-SNAP)
++ *
++ * llc_snap is never checked in GMAC >= 4, so this ACS
++ * feature is always disabled and packets need to be
++ * stripped manually.
+ */
+- if (unlikely(status != llc_snap))
++ if (unlikely(priv->synopsys_id >= DWMAC_CORE_4_00) ||
++ unlikely(status != llc_snap))
+ frame_len -= ETH_FCS_LEN;
+
+ if (netif_msg_rx_status(priv)) {
+diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
+index b2b30c9df037..33c35b2df7d5 100644
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -125,7 +125,7 @@ do { \
+
+ #define RX_PRIORITY_MAPPING 0x76543210
+ #define TX_PRIORITY_MAPPING 0x33221100
+-#define CPDMA_TX_PRIORITY_MAP 0x01234567
++#define CPDMA_TX_PRIORITY_MAP 0x76543210
+
+ #define CPSW_VLAN_AWARE BIT(1)
+ #define CPSW_ALE_VLAN_AWARE 1
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 9cbb0c8a896a..7de88b33d5b9 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -3277,7 +3277,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+
+ err = netdev_upper_dev_link(real_dev, dev, extack);
+ if (err < 0)
+- goto put_dev;
++ goto unregister;
+
+ /* need to be already registered so that ->init has run and
+ * the MAC addr is set
+@@ -3316,8 +3316,7 @@ static int macsec_newlink(struct net *net, struct net_device *dev,
+ macsec_del_dev(macsec);
+ unlink:
+ netdev_upper_dev_unlink(real_dev, dev);
+-put_dev:
+- dev_put(real_dev);
++unregister:
+ unregister_netdevice(dev);
+ return err;
+ }
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index 5aa59f41bf8c..71e2aef6b7a1 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -620,6 +620,10 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
+ lock_sock(sk);
+
+ error = -EINVAL;
++
++ if (sockaddr_len != sizeof(struct sockaddr_pppox))
++ goto end;
++
+ if (sp->sa_protocol != PX_PROTO_OE)
+ goto end;
+
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index befed2d22bf4..3175f7410baf 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -261,6 +261,17 @@ static void __team_option_inst_mark_removed_port(struct team *team,
+ }
+ }
+
++static bool __team_option_inst_tmp_find(const struct list_head *opts,
++ const struct team_option_inst *needle)
++{
++ struct team_option_inst *opt_inst;
++
++ list_for_each_entry(opt_inst, opts, tmp_list)
++ if (opt_inst == needle)
++ return true;
++ return false;
++}
++
+ static int __team_options_register(struct team *team,
+ const struct team_option *option,
+ size_t option_count)
+@@ -1061,14 +1072,11 @@ static void team_port_leave(struct team *team, struct team_port *port)
+ }
+
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
++static int __team_port_enable_netpoll(struct team_port *port)
+ {
+ struct netpoll *np;
+ int err;
+
+- if (!team->dev->npinfo)
+- return 0;
+-
+ np = kzalloc(sizeof(*np), GFP_KERNEL);
+ if (!np)
+ return -ENOMEM;
+@@ -1082,6 +1090,14 @@ static int team_port_enable_netpoll(struct team *team, struct team_port *port)
+ return err;
+ }
+
++static int team_port_enable_netpoll(struct team_port *port)
++{
++ if (!port->team->dev->npinfo)
++ return 0;
++
++ return __team_port_enable_netpoll(port);
++}
++
+ static void team_port_disable_netpoll(struct team_port *port)
+ {
+ struct netpoll *np = port->np;
+@@ -1096,7 +1112,7 @@ static void team_port_disable_netpoll(struct team_port *port)
+ kfree(np);
+ }
+ #else
+-static int team_port_enable_netpoll(struct team *team, struct team_port *port)
++static int team_port_enable_netpoll(struct team_port *port)
+ {
+ return 0;
+ }
+@@ -1204,7 +1220,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
+ goto err_vids_add;
+ }
+
+- err = team_port_enable_netpoll(team, port);
++ err = team_port_enable_netpoll(port);
+ if (err) {
+ netdev_err(dev, "Failed to enable netpoll on device %s\n",
+ portname);
+@@ -1901,7 +1917,7 @@ static int team_netpoll_setup(struct net_device *dev,
+
+ mutex_lock(&team->lock);
+ list_for_each_entry(port, &team->port_list, list) {
+- err = team_port_enable_netpoll(team, port);
++ err = __team_port_enable_netpoll(port);
+ if (err) {
+ __team_netpoll_cleanup(team);
+ break;
+@@ -2562,6 +2578,14 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ if (err)
+ goto team_put;
+ opt_inst->changed = true;
++
++ /* dumb/evil user-space can send us duplicate opt,
++ * keep only the last one
++ */
++ if (__team_option_inst_tmp_find(&opt_inst_list,
++ opt_inst))
++ continue;
++
+ list_add(&opt_inst->tmp_list, &opt_inst_list);
+ }
+ if (!opt_found) {
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index 28cfa642e39a..6c7bdd0c361a 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1094,12 +1094,7 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
+ goto drop;
+
+ len = run_ebpf_filter(tun, skb, len);
+-
+- /* Trim extra bytes since we may insert vlan proto & TCI
+- * in tun_put_user().
+- */
+- len -= skb_vlan_tag_present(skb) ? sizeof(struct veth) : 0;
+- if (len <= 0 || pskb_trim(skb, len))
++ if (len == 0 || pskb_trim(skb, len))
+ goto drop;
+
+ if (unlikely(skb_orphan_frags_rx(skb, GFP_ATOMIC)))
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index ca066b785e9f..c853e7410f5a 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1107,6 +1107,7 @@ static const struct usb_device_id products[] = {
+ {QMI_FIXED_INTF(0x1435, 0xd181, 3)}, /* Wistron NeWeb D18Q1 */
+ {QMI_FIXED_INTF(0x1435, 0xd181, 4)}, /* Wistron NeWeb D18Q1 */
+ {QMI_FIXED_INTF(0x1435, 0xd181, 5)}, /* Wistron NeWeb D18Q1 */
++ {QMI_FIXED_INTF(0x1435, 0xd191, 4)}, /* Wistron NeWeb D19Q1 */
+ {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */
+ {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */
+ {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */
+diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
+index 23374603e4d9..aa21b2225679 100644
+--- a/drivers/net/virtio_net.c
++++ b/drivers/net/virtio_net.c
+@@ -147,6 +147,17 @@ struct receive_queue {
+ struct xdp_rxq_info xdp_rxq;
+ };
+
++/* Control VQ buffers: protected by the rtnl lock */
++struct control_buf {
++ struct virtio_net_ctrl_hdr hdr;
++ virtio_net_ctrl_ack status;
++ struct virtio_net_ctrl_mq mq;
++ u8 promisc;
++ u8 allmulti;
++ __virtio16 vid;
++ u64 offloads;
++};
++
+ struct virtnet_info {
+ struct virtio_device *vdev;
+ struct virtqueue *cvq;
+@@ -192,14 +203,7 @@ struct virtnet_info {
+ struct hlist_node node;
+ struct hlist_node node_dead;
+
+- /* Control VQ buffers: protected by the rtnl lock */
+- struct virtio_net_ctrl_hdr ctrl_hdr;
+- virtio_net_ctrl_ack ctrl_status;
+- struct virtio_net_ctrl_mq ctrl_mq;
+- u8 ctrl_promisc;
+- u8 ctrl_allmulti;
+- u16 ctrl_vid;
+- u64 ctrl_offloads;
++ struct control_buf *ctrl;
+
+ /* Ethtool settings */
+ u8 duplex;
+@@ -1269,7 +1273,9 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ {
+ struct receive_queue *rq =
+ container_of(napi, struct receive_queue, napi);
+- unsigned int received;
++ struct virtnet_info *vi = rq->vq->vdev->priv;
++ struct send_queue *sq;
++ unsigned int received, qp;
+ bool xdp_xmit = false;
+
+ virtnet_poll_cleantx(rq);
+@@ -1280,8 +1286,13 @@ static int virtnet_poll(struct napi_struct *napi, int budget)
+ if (received < budget)
+ virtqueue_napi_complete(napi, rq->vq, received);
+
+- if (xdp_xmit)
++ if (xdp_xmit) {
++ qp = vi->curr_queue_pairs - vi->xdp_queue_pairs +
++ smp_processor_id();
++ sq = &vi->sq[qp];
++ virtqueue_kick(sq->vq);
+ xdp_do_flush_map();
++ }
+
+ return received;
+ }
+@@ -1454,25 +1465,25 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
+ /* Caller should know better */
+ BUG_ON(!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_VQ));
+
+- vi->ctrl_status = ~0;
+- vi->ctrl_hdr.class = class;
+- vi->ctrl_hdr.cmd = cmd;
++ vi->ctrl->status = ~0;
++ vi->ctrl->hdr.class = class;
++ vi->ctrl->hdr.cmd = cmd;
+ /* Add header */
+- sg_init_one(&hdr, &vi->ctrl_hdr, sizeof(vi->ctrl_hdr));
++ sg_init_one(&hdr, &vi->ctrl->hdr, sizeof(vi->ctrl->hdr));
+ sgs[out_num++] = &hdr;
+
+ if (out)
+ sgs[out_num++] = out;
+
+ /* Add return status. */
+- sg_init_one(&stat, &vi->ctrl_status, sizeof(vi->ctrl_status));
++ sg_init_one(&stat, &vi->ctrl->status, sizeof(vi->ctrl->status));
+ sgs[out_num] = &stat;
+
+ BUG_ON(out_num + 1 > ARRAY_SIZE(sgs));
+ virtqueue_add_sgs(vi->cvq, sgs, out_num, 1, vi, GFP_ATOMIC);
+
+ if (unlikely(!virtqueue_kick(vi->cvq)))
+- return vi->ctrl_status == VIRTIO_NET_OK;
++ return vi->ctrl->status == VIRTIO_NET_OK;
+
+ /* Spin for a response, the kick causes an ioport write, trapping
+ * into the hypervisor, so the request should be handled immediately.
+@@ -1481,7 +1492,7 @@ static bool virtnet_send_command(struct virtnet_info *vi, u8 class, u8 cmd,
+ !virtqueue_is_broken(vi->cvq))
+ cpu_relax();
+
+- return vi->ctrl_status == VIRTIO_NET_OK;
++ return vi->ctrl->status == VIRTIO_NET_OK;
+ }
+
+ static int virtnet_set_mac_address(struct net_device *dev, void *p)
+@@ -1593,8 +1604,8 @@ static int _virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs)
+ if (!vi->has_cvq || !virtio_has_feature(vi->vdev, VIRTIO_NET_F_MQ))
+ return 0;
+
+- vi->ctrl_mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs);
+- sg_init_one(&sg, &vi->ctrl_mq, sizeof(vi->ctrl_mq));
++ vi->ctrl->mq.virtqueue_pairs = cpu_to_virtio16(vi->vdev, queue_pairs);
++ sg_init_one(&sg, &vi->ctrl->mq, sizeof(vi->ctrl->mq));
+
+ if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MQ,
+ VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET, &sg)) {
+@@ -1653,22 +1664,22 @@ static void virtnet_set_rx_mode(struct net_device *dev)
+ if (!virtio_has_feature(vi->vdev, VIRTIO_NET_F_CTRL_RX))
+ return;
+
+- vi->ctrl_promisc = ((dev->flags & IFF_PROMISC) != 0);
+- vi->ctrl_allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
++ vi->ctrl->promisc = ((dev->flags & IFF_PROMISC) != 0);
++ vi->ctrl->allmulti = ((dev->flags & IFF_ALLMULTI) != 0);
+
+- sg_init_one(sg, &vi->ctrl_promisc, sizeof(vi->ctrl_promisc));
++ sg_init_one(sg, &vi->ctrl->promisc, sizeof(vi->ctrl->promisc));
+
+ if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
+ VIRTIO_NET_CTRL_RX_PROMISC, sg))
+ dev_warn(&dev->dev, "Failed to %sable promisc mode.\n",
+- vi->ctrl_promisc ? "en" : "dis");
++ vi->ctrl->promisc ? "en" : "dis");
+
+- sg_init_one(sg, &vi->ctrl_allmulti, sizeof(vi->ctrl_allmulti));
++ sg_init_one(sg, &vi->ctrl->allmulti, sizeof(vi->ctrl->allmulti));
+
+ if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_RX,
+ VIRTIO_NET_CTRL_RX_ALLMULTI, sg))
+ dev_warn(&dev->dev, "Failed to %sable allmulti mode.\n",
+- vi->ctrl_allmulti ? "en" : "dis");
++ vi->ctrl->allmulti ? "en" : "dis");
+
+ uc_count = netdev_uc_count(dev);
+ mc_count = netdev_mc_count(dev);
+@@ -1714,8 +1725,8 @@ static int virtnet_vlan_rx_add_vid(struct net_device *dev,
+ struct virtnet_info *vi = netdev_priv(dev);
+ struct scatterlist sg;
+
+- vi->ctrl_vid = vid;
+- sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid));
++ vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid);
++ sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid));
+
+ if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
+ VIRTIO_NET_CTRL_VLAN_ADD, &sg))
+@@ -1729,8 +1740,8 @@ static int virtnet_vlan_rx_kill_vid(struct net_device *dev,
+ struct virtnet_info *vi = netdev_priv(dev);
+ struct scatterlist sg;
+
+- vi->ctrl_vid = vid;
+- sg_init_one(&sg, &vi->ctrl_vid, sizeof(vi->ctrl_vid));
++ vi->ctrl->vid = cpu_to_virtio16(vi->vdev, vid);
++ sg_init_one(&sg, &vi->ctrl->vid, sizeof(vi->ctrl->vid));
+
+ if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_VLAN,
+ VIRTIO_NET_CTRL_VLAN_DEL, &sg))
+@@ -2126,9 +2137,9 @@ static int virtnet_restore_up(struct virtio_device *vdev)
+ static int virtnet_set_guest_offloads(struct virtnet_info *vi, u64 offloads)
+ {
+ struct scatterlist sg;
+- vi->ctrl_offloads = cpu_to_virtio64(vi->vdev, offloads);
++ vi->ctrl->offloads = cpu_to_virtio64(vi->vdev, offloads);
+
+- sg_init_one(&sg, &vi->ctrl_offloads, sizeof(vi->ctrl_offloads));
++ sg_init_one(&sg, &vi->ctrl->offloads, sizeof(vi->ctrl->offloads));
+
+ if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_GUEST_OFFLOADS,
+ VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET, &sg)) {
+@@ -2351,6 +2362,7 @@ static void virtnet_free_queues(struct virtnet_info *vi)
+
+ kfree(vi->rq);
+ kfree(vi->sq);
++ kfree(vi->ctrl);
+ }
+
+ static void _free_receive_bufs(struct virtnet_info *vi)
+@@ -2543,6 +2555,9 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
+ {
+ int i;
+
++ vi->ctrl = kzalloc(sizeof(*vi->ctrl), GFP_KERNEL);
++ if (!vi->ctrl)
++ goto err_ctrl;
+ vi->sq = kzalloc(sizeof(*vi->sq) * vi->max_queue_pairs, GFP_KERNEL);
+ if (!vi->sq)
+ goto err_sq;
+@@ -2571,6 +2586,8 @@ static int virtnet_alloc_queues(struct virtnet_info *vi)
+ err_rq:
+ kfree(vi->sq);
+ err_sq:
++ kfree(vi->ctrl);
++err_ctrl:
+ return -ENOMEM;
+ }
+
+diff --git a/drivers/net/vmxnet3/vmxnet3_drv.c b/drivers/net/vmxnet3/vmxnet3_drv.c
+index e04937f44f33..9ebe2a689966 100644
+--- a/drivers/net/vmxnet3/vmxnet3_drv.c
++++ b/drivers/net/vmxnet3/vmxnet3_drv.c
+@@ -1218,6 +1218,7 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
+ union {
+ void *ptr;
+ struct ethhdr *eth;
++ struct vlan_ethhdr *veth;
+ struct iphdr *ipv4;
+ struct ipv6hdr *ipv6;
+ struct tcphdr *tcp;
+@@ -1228,16 +1229,24 @@ vmxnet3_get_hdr_len(struct vmxnet3_adapter *adapter, struct sk_buff *skb,
+ if (unlikely(sizeof(struct iphdr) + sizeof(struct tcphdr) > maplen))
+ return 0;
+
++ if (skb->protocol == cpu_to_be16(ETH_P_8021Q) ||
++ skb->protocol == cpu_to_be16(ETH_P_8021AD))
++ hlen = sizeof(struct vlan_ethhdr);
++ else
++ hlen = sizeof(struct ethhdr);
++
+ hdr.eth = eth_hdr(skb);
+ if (gdesc->rcd.v4) {
+- BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP));
+- hdr.ptr += sizeof(struct ethhdr);
++ BUG_ON(hdr.eth->h_proto != htons(ETH_P_IP) &&
++ hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IP));
++ hdr.ptr += hlen;
+ BUG_ON(hdr.ipv4->protocol != IPPROTO_TCP);
+ hlen = hdr.ipv4->ihl << 2;
+ hdr.ptr += hdr.ipv4->ihl << 2;
+ } else if (gdesc->rcd.v6) {
+- BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6));
+- hdr.ptr += sizeof(struct ethhdr);
++ BUG_ON(hdr.eth->h_proto != htons(ETH_P_IPV6) &&
++ hdr.veth->h_vlan_encapsulated_proto != htons(ETH_P_IPV6));
++ hdr.ptr += hlen;
+ /* Use an estimated value, since we also need to handle
+ * TSO case.
+ */
+diff --git a/drivers/net/vmxnet3/vmxnet3_int.h b/drivers/net/vmxnet3/vmxnet3_int.h
+index 59ec34052a65..a3326463b71f 100644
+--- a/drivers/net/vmxnet3/vmxnet3_int.h
++++ b/drivers/net/vmxnet3/vmxnet3_int.h
+@@ -69,10 +69,10 @@
+ /*
+ * Version numbers
+ */
+-#define VMXNET3_DRIVER_VERSION_STRING "1.4.13.0-k"
++#define VMXNET3_DRIVER_VERSION_STRING "1.4.14.0-k"
+
+ /* a 32-bit int, each byte encode a verion number in VMXNET3_DRIVER_VERSION */
+-#define VMXNET3_DRIVER_VERSION_NUM 0x01040d00
++#define VMXNET3_DRIVER_VERSION_NUM 0x01040e00
+
+ #if defined(CONFIG_PCI_MSI)
+ /* RSS only makes sense if MSI-X is supported. */
+diff --git a/drivers/net/wireless/ath/ath10k/mac.c b/drivers/net/wireless/ath/ath10k/mac.c
+index ebb3f1b046f3..800a86e2d671 100644
+--- a/drivers/net/wireless/ath/ath10k/mac.c
++++ b/drivers/net/wireless/ath/ath10k/mac.c
+@@ -6028,9 +6028,8 @@ static void ath10k_sta_rc_update_wk(struct work_struct *wk)
+ sta->addr, smps, err);
+ }
+
+- if (changed & IEEE80211_RC_SUPP_RATES_CHANGED ||
+- changed & IEEE80211_RC_NSS_CHANGED) {
+- ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates/nss\n",
++ if (changed & IEEE80211_RC_SUPP_RATES_CHANGED) {
++ ath10k_dbg(ar, ATH10K_DBG_MAC, "mac update sta %pM supp rates\n",
+ sta->addr);
+
+ err = ath10k_station_assoc(ar, arvif->vif, sta, true);
+diff --git a/drivers/pinctrl/intel/pinctrl-intel.c b/drivers/pinctrl/intel/pinctrl-intel.c
+index 96e73e30204e..5f111f0ee7ca 100644
+--- a/drivers/pinctrl/intel/pinctrl-intel.c
++++ b/drivers/pinctrl/intel/pinctrl-intel.c
+@@ -425,18 +425,6 @@ static void __intel_gpio_set_direction(void __iomem *padcfg0, bool input)
+ writel(value, padcfg0);
+ }
+
+-static void intel_gpio_set_gpio_mode(void __iomem *padcfg0)
+-{
+- u32 value;
+-
+- /* Put the pad into GPIO mode */
+- value = readl(padcfg0) & ~PADCFG0_PMODE_MASK;
+- /* Disable SCI/SMI/NMI generation */
+- value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
+- value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI);
+- writel(value, padcfg0);
+-}
+-
+ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ struct pinctrl_gpio_range *range,
+ unsigned pin)
+@@ -444,6 +432,7 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ struct intel_pinctrl *pctrl = pinctrl_dev_get_drvdata(pctldev);
+ void __iomem *padcfg0;
+ unsigned long flags;
++ u32 value;
+
+ raw_spin_lock_irqsave(&pctrl->lock, flags);
+
+@@ -453,7 +442,13 @@ static int intel_gpio_request_enable(struct pinctrl_dev *pctldev,
+ }
+
+ padcfg0 = intel_get_padcfg(pctrl, pin, PADCFG0);
+- intel_gpio_set_gpio_mode(padcfg0);
++ /* Put the pad into GPIO mode */
++ value = readl(padcfg0) & ~PADCFG0_PMODE_MASK;
++ /* Disable SCI/SMI/NMI generation */
++ value &= ~(PADCFG0_GPIROUTIOXAPIC | PADCFG0_GPIROUTSCI);
++ value &= ~(PADCFG0_GPIROUTSMI | PADCFG0_GPIROUTNMI);
++ writel(value, padcfg0);
++
+ /* Disable TX buffer and enable RX (this will be input) */
+ __intel_gpio_set_direction(padcfg0, true);
+
+@@ -973,8 +968,6 @@ static int intel_gpio_irq_type(struct irq_data *d, unsigned type)
+
+ raw_spin_lock_irqsave(&pctrl->lock, flags);
+
+- intel_gpio_set_gpio_mode(reg);
+-
+ value = readl(reg);
+
+ value &= ~(PADCFG0_RXEVCFG_MASK | PADCFG0_RXINV);
+diff --git a/drivers/s390/block/dasd_alias.c b/drivers/s390/block/dasd_alias.c
+index 62f5f04d8f61..5e963fe0e38d 100644
+--- a/drivers/s390/block/dasd_alias.c
++++ b/drivers/s390/block/dasd_alias.c
+@@ -592,13 +592,22 @@ static int _schedule_lcu_update(struct alias_lcu *lcu,
+ int dasd_alias_add_device(struct dasd_device *device)
+ {
+ struct dasd_eckd_private *private = device->private;
+- struct alias_lcu *lcu;
++ __u8 uaddr = private->uid.real_unit_addr;
++ struct alias_lcu *lcu = private->lcu;
+ unsigned long flags;
+ int rc;
+
+- lcu = private->lcu;
+ rc = 0;
+ spin_lock_irqsave(&lcu->lock, flags);
++ /*
++ * Check if device and lcu type differ. If so, the uac data may be
++ * outdated and needs to be updated.
++ */
++ if (private->uid.type != lcu->uac->unit[uaddr].ua_type) {
++ lcu->flags |= UPDATE_PENDING;
++ DBF_DEV_EVENT(DBF_WARNING, device, "%s",
++ "uid type mismatch - trigger rescan");
++ }
+ if (!(lcu->flags & UPDATE_PENDING)) {
+ rc = _add_device_to_lcu(lcu, device, device);
+ if (rc)
+diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
+index c08fc5a8df0c..aea0b25eff29 100644
+--- a/drivers/s390/cio/chsc.c
++++ b/drivers/s390/cio/chsc.c
+@@ -452,6 +452,7 @@ static void chsc_process_sei_link_incident(struct chsc_sei_nt0_area *sei_area)
+
+ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
+ {
++ struct channel_path *chp;
+ struct chp_link link;
+ struct chp_id chpid;
+ int status;
+@@ -464,10 +465,17 @@ static void chsc_process_sei_res_acc(struct chsc_sei_nt0_area *sei_area)
+ chpid.id = sei_area->rsid;
+ /* allocate a new channel path structure, if needed */
+ status = chp_get_status(chpid);
+- if (status < 0)
+- chp_new(chpid);
+- else if (!status)
++ if (!status)
+ return;
++
++ if (status < 0) {
++ chp_new(chpid);
++ } else {
++ chp = chpid_to_chp(chpid);
++ mutex_lock(&chp->lock);
++ chp_update_desc(chp);
++ mutex_unlock(&chp->lock);
++ }
+ memset(&link, 0, sizeof(struct chp_link));
+ link.chpid = chpid;
+ if ((sei_area->vf & 0xc0) != 0) {
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index 959c65cf75d9..e338ce823c44 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -565,7 +565,6 @@ enum qeth_ip_types {
+ enum qeth_cmd_buffer_state {
+ BUF_STATE_FREE,
+ BUF_STATE_LOCKED,
+- BUF_STATE_PROCESSED,
+ };
+
+ enum qeth_cq {
+@@ -609,7 +608,6 @@ struct qeth_channel {
+ struct qeth_cmd_buffer iob[QETH_CMD_BUFFER_NO];
+ atomic_t irq_pending;
+ int io_buf_no;
+- int buf_no;
+ };
+
+ /**
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 3653bea38470..c11a083cd956 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -821,7 +821,6 @@ void qeth_clear_cmd_buffers(struct qeth_channel *channel)
+
+ for (cnt = 0; cnt < QETH_CMD_BUFFER_NO; cnt++)
+ qeth_release_buffer(channel, &channel->iob[cnt]);
+- channel->buf_no = 0;
+ channel->io_buf_no = 0;
+ }
+ EXPORT_SYMBOL_GPL(qeth_clear_cmd_buffers);
+@@ -927,7 +926,6 @@ static int qeth_setup_channel(struct qeth_channel *channel)
+ kfree(channel->iob[cnt].data);
+ return -ENOMEM;
+ }
+- channel->buf_no = 0;
+ channel->io_buf_no = 0;
+ atomic_set(&channel->irq_pending, 0);
+ spin_lock_init(&channel->iob_lock);
+@@ -1103,11 +1101,9 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ {
+ int rc;
+ int cstat, dstat;
+- struct qeth_cmd_buffer *buffer;
+ struct qeth_channel *channel;
+ struct qeth_card *card;
+ struct qeth_cmd_buffer *iob;
+- __u8 index;
+
+ if (__qeth_check_irb_error(cdev, intparm, irb))
+ return;
+@@ -1185,25 +1181,18 @@ static void qeth_irq(struct ccw_device *cdev, unsigned long intparm,
+ channel->state = CH_STATE_RCD_DONE;
+ goto out;
+ }
+- if (intparm) {
+- buffer = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
+- buffer->state = BUF_STATE_PROCESSED;
+- }
+ if (channel == &card->data)
+ return;
+ if (channel == &card->read &&
+ channel->state == CH_STATE_UP)
+ __qeth_issue_next_read(card);
+
+- iob = channel->iob;
+- index = channel->buf_no;
+- while (iob[index].state == BUF_STATE_PROCESSED) {
+- if (iob[index].callback != NULL)
+- iob[index].callback(channel, iob + index);
+-
+- index = (index + 1) % QETH_CMD_BUFFER_NO;
++ if (intparm) {
++ iob = (struct qeth_cmd_buffer *) __va((addr_t)intparm);
++ if (iob->callback)
++ iob->callback(iob->channel, iob);
+ }
+- channel->buf_no = index;
++
+ out:
+ wake_up(&card->wait_q);
+ return;
+@@ -2217,7 +2206,6 @@ int qeth_send_control_data(struct qeth_card *card, int len,
+ error:
+ atomic_set(&card->write.irq_pending, 0);
+ qeth_release_buffer(iob->channel, iob);
+- card->write.buf_no = (card->write.buf_no + 1) % QETH_CMD_BUFFER_NO;
+ rc = reply->rc;
+ qeth_put_reply(reply);
+ return rc;
+@@ -3037,28 +3025,23 @@ static int qeth_send_startlan(struct qeth_card *card)
+ return rc;
+ }
+
+-static int qeth_default_setadapterparms_cb(struct qeth_card *card,
+- struct qeth_reply *reply, unsigned long data)
++static int qeth_setadpparms_inspect_rc(struct qeth_ipa_cmd *cmd)
+ {
+- struct qeth_ipa_cmd *cmd;
+-
+- QETH_CARD_TEXT(card, 4, "defadpcb");
+-
+- cmd = (struct qeth_ipa_cmd *) data;
+- if (cmd->hdr.return_code == 0)
++ if (!cmd->hdr.return_code)
+ cmd->hdr.return_code =
+ cmd->data.setadapterparms.hdr.return_code;
+- return 0;
++ return cmd->hdr.return_code;
+ }
+
+ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
+ struct qeth_reply *reply, unsigned long data)
+ {
+- struct qeth_ipa_cmd *cmd;
++ struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+
+ QETH_CARD_TEXT(card, 3, "quyadpcb");
++ if (qeth_setadpparms_inspect_rc(cmd))
++ return 0;
+
+- cmd = (struct qeth_ipa_cmd *) data;
+ if (cmd->data.setadapterparms.data.query_cmds_supp.lan_type & 0x7f) {
+ card->info.link_type =
+ cmd->data.setadapterparms.data.query_cmds_supp.lan_type;
+@@ -3066,7 +3049,7 @@ static int qeth_query_setadapterparms_cb(struct qeth_card *card,
+ }
+ card->options.adp.supported_funcs =
+ cmd->data.setadapterparms.data.query_cmds_supp.supported_cmds;
+- return qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
++ return 0;
+ }
+
+ static struct qeth_cmd_buffer *qeth_get_adapter_cmd(struct qeth_card *card,
+@@ -3158,22 +3141,20 @@ EXPORT_SYMBOL_GPL(qeth_query_ipassists);
+ static int qeth_query_switch_attributes_cb(struct qeth_card *card,
+ struct qeth_reply *reply, unsigned long data)
+ {
+- struct qeth_ipa_cmd *cmd;
+- struct qeth_switch_info *sw_info;
++ struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ struct qeth_query_switch_attributes *attrs;
++ struct qeth_switch_info *sw_info;
+
+ QETH_CARD_TEXT(card, 2, "qswiatcb");
+- cmd = (struct qeth_ipa_cmd *) data;
+- sw_info = (struct qeth_switch_info *)reply->param;
+- if (cmd->data.setadapterparms.hdr.return_code == 0) {
+- attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
+- sw_info->capabilities = attrs->capabilities;
+- sw_info->settings = attrs->settings;
+- QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
+- sw_info->settings);
+- }
+- qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
++ if (qeth_setadpparms_inspect_rc(cmd))
++ return 0;
+
++ sw_info = (struct qeth_switch_info *)reply->param;
++ attrs = &cmd->data.setadapterparms.data.query_switch_attributes;
++ sw_info->capabilities = attrs->capabilities;
++ sw_info->settings = attrs->settings;
++ QETH_CARD_TEXT_(card, 2, "%04x%04x", sw_info->capabilities,
++ sw_info->settings);
+ return 0;
+ }
+
+@@ -4211,16 +4192,13 @@ EXPORT_SYMBOL_GPL(qeth_do_send_packet);
+ static int qeth_setadp_promisc_mode_cb(struct qeth_card *card,
+ struct qeth_reply *reply, unsigned long data)
+ {
+- struct qeth_ipa_cmd *cmd;
++ struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ struct qeth_ipacmd_setadpparms *setparms;
+
+ QETH_CARD_TEXT(card, 4, "prmadpcb");
+
+- cmd = (struct qeth_ipa_cmd *) data;
+ setparms = &(cmd->data.setadapterparms);
+-
+- qeth_default_setadapterparms_cb(card, reply, (unsigned long)cmd);
+- if (cmd->hdr.return_code) {
++ if (qeth_setadpparms_inspect_rc(cmd)) {
+ QETH_CARD_TEXT_(card, 4, "prmrc%x", cmd->hdr.return_code);
+ setparms->data.mode = SET_PROMISC_MODE_OFF;
+ }
+@@ -4290,18 +4268,18 @@ EXPORT_SYMBOL_GPL(qeth_get_stats);
+ static int qeth_setadpparms_change_macaddr_cb(struct qeth_card *card,
+ struct qeth_reply *reply, unsigned long data)
+ {
+- struct qeth_ipa_cmd *cmd;
++ struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+
+ QETH_CARD_TEXT(card, 4, "chgmaccb");
++ if (qeth_setadpparms_inspect_rc(cmd))
++ return 0;
+
+- cmd = (struct qeth_ipa_cmd *) data;
+ if (!card->options.layer2 ||
+ !(card->info.mac_bits & QETH_LAYER2_MAC_READ)) {
+ ether_addr_copy(card->dev->dev_addr,
+ cmd->data.setadapterparms.data.change_addr.addr);
+ card->info.mac_bits |= QETH_LAYER2_MAC_READ;
+ }
+- qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+ return 0;
+ }
+
+@@ -4332,13 +4310,15 @@ EXPORT_SYMBOL_GPL(qeth_setadpparms_change_macaddr);
+ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
+ struct qeth_reply *reply, unsigned long data)
+ {
+- struct qeth_ipa_cmd *cmd;
++ struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *) data;
+ struct qeth_set_access_ctrl *access_ctrl_req;
+ int fallback = *(int *)reply->param;
+
+ QETH_CARD_TEXT(card, 4, "setaccb");
++ if (cmd->hdr.return_code)
++ return 0;
++ qeth_setadpparms_inspect_rc(cmd);
+
+- cmd = (struct qeth_ipa_cmd *) data;
+ access_ctrl_req = &cmd->data.setadapterparms.data.set_access_ctrl;
+ QETH_DBF_TEXT_(SETUP, 2, "setaccb");
+ QETH_DBF_TEXT_(SETUP, 2, "%s", card->gdev->dev.kobj.name);
+@@ -4411,7 +4391,6 @@ static int qeth_setadpparms_set_access_ctrl_cb(struct qeth_card *card,
+ card->options.isolation = card->options.prev_isolation;
+ break;
+ }
+- qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
+ return 0;
+ }
+
+@@ -4699,14 +4678,15 @@ static int qeth_snmp_command(struct qeth_card *card, char __user *udata)
+ static int qeth_setadpparms_query_oat_cb(struct qeth_card *card,
+ struct qeth_reply *reply, unsigned long data)
+ {
+- struct qeth_ipa_cmd *cmd;
++ struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
+ struct qeth_qoat_priv *priv;
+ char *resdata;
+ int resdatalen;
+
+ QETH_CARD_TEXT(card, 3, "qoatcb");
++ if (qeth_setadpparms_inspect_rc(cmd))
++ return 0;
+
+- cmd = (struct qeth_ipa_cmd *)data;
+ priv = (struct qeth_qoat_priv *)reply->param;
+ resdatalen = cmd->data.setadapterparms.hdr.cmdlength;
+ resdata = (char *)data + 28;
+@@ -4800,21 +4780,18 @@ static int qeth_query_oat_command(struct qeth_card *card, char __user *udata)
+ static int qeth_query_card_info_cb(struct qeth_card *card,
+ struct qeth_reply *reply, unsigned long data)
+ {
+- struct qeth_ipa_cmd *cmd;
++ struct carrier_info *carrier_info = (struct carrier_info *)reply->param;
++ struct qeth_ipa_cmd *cmd = (struct qeth_ipa_cmd *)data;
+ struct qeth_query_card_info *card_info;
+- struct carrier_info *carrier_info;
+
+ QETH_CARD_TEXT(card, 2, "qcrdincb");
+- carrier_info = (struct carrier_info *)reply->param;
+- cmd = (struct qeth_ipa_cmd *)data;
+- card_info = &cmd->data.setadapterparms.data.card_info;
+- if (cmd->data.setadapterparms.hdr.return_code == 0) {
+- carrier_info->card_type = card_info->card_type;
+- carrier_info->port_mode = card_info->port_mode;
+- carrier_info->port_speed = card_info->port_speed;
+- }
++ if (qeth_setadpparms_inspect_rc(cmd))
++ return 0;
+
+- qeth_default_setadapterparms_cb(card, reply, (unsigned long) cmd);
++ card_info = &cmd->data.setadapterparms.data.card_info;
++ carrier_info->card_type = card_info->card_type;
++ carrier_info->port_mode = card_info->port_mode;
++ carrier_info->port_speed = card_info->port_speed;
+ return 0;
+ }
+
+@@ -6567,10 +6544,14 @@ static int __init qeth_core_init(void)
+ mutex_init(&qeth_mod_mutex);
+
+ qeth_wq = create_singlethread_workqueue("qeth_wq");
++ if (!qeth_wq) {
++ rc = -ENOMEM;
++ goto out_err;
++ }
+
+ rc = qeth_register_dbf_views();
+ if (rc)
+- goto out_err;
++ goto dbf_err;
+ qeth_core_root_dev = root_device_register("qeth");
+ rc = PTR_ERR_OR_ZERO(qeth_core_root_dev);
+ if (rc)
+@@ -6607,6 +6588,8 @@ static int __init qeth_core_init(void)
+ root_device_unregister(qeth_core_root_dev);
+ register_err:
+ qeth_unregister_dbf_views();
++dbf_err:
++ destroy_workqueue(qeth_wq);
+ out_err:
+ pr_err("Initializing the qeth device driver failed\n");
+ return rc;
+diff --git a/include/linux/fsnotify_backend.h b/include/linux/fsnotify_backend.h
+index 067d52e95f02..d7191943ecb8 100644
+--- a/include/linux/fsnotify_backend.h
++++ b/include/linux/fsnotify_backend.h
+@@ -217,12 +217,10 @@ struct fsnotify_mark_connector {
+ union { /* Object pointer [lock] */
+ struct inode *inode;
+ struct vfsmount *mnt;
+- };
+- union {
+- struct hlist_head list;
+ /* Used listing heads to free after srcu period expires */
+ struct fsnotify_mark_connector *destroy_next;
+ };
++ struct hlist_head list;
+ };
+
+ /*
+diff --git a/include/linux/hmm.h b/include/linux/hmm.h
+index 36dd21fe5caf..325017ad9311 100644
+--- a/include/linux/hmm.h
++++ b/include/linux/hmm.h
+@@ -498,16 +498,23 @@ struct hmm_device {
+ struct hmm_device *hmm_device_new(void *drvdata);
+ void hmm_device_put(struct hmm_device *hmm_device);
+ #endif /* CONFIG_DEVICE_PRIVATE || CONFIG_DEVICE_PUBLIC */
++#endif /* IS_ENABLED(CONFIG_HMM) */
+
+ /* Below are for HMM internal use only! Not to be used by device driver! */
++#if IS_ENABLED(CONFIG_HMM_MIRROR)
+ void hmm_mm_destroy(struct mm_struct *mm);
+
+ static inline void hmm_mm_init(struct mm_struct *mm)
+ {
+ mm->hmm = NULL;
+ }
++#else /* IS_ENABLED(CONFIG_HMM_MIRROR) */
++static inline void hmm_mm_destroy(struct mm_struct *mm) {}
++static inline void hmm_mm_init(struct mm_struct *mm) {}
++#endif /* IS_ENABLED(CONFIG_HMM_MIRROR) */
++
++
+ #else /* IS_ENABLED(CONFIG_HMM) */
+ static inline void hmm_mm_destroy(struct mm_struct *mm) {}
+ static inline void hmm_mm_init(struct mm_struct *mm) {}
+-#endif /* IS_ENABLED(CONFIG_HMM) */
+ #endif /* LINUX_HMM_H */
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index 7d30892da064..87b8c20d5b27 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -639,7 +639,7 @@ static inline bool skb_vlan_tagged(const struct sk_buff *skb)
+ * Returns true if the skb is tagged with multiple vlan headers, regardless
+ * of whether it is hardware accelerated or not.
+ */
+-static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
++static inline bool skb_vlan_tagged_multi(struct sk_buff *skb)
+ {
+ __be16 protocol = skb->protocol;
+
+@@ -649,6 +649,9 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
+ if (likely(!eth_type_vlan(protocol)))
+ return false;
+
++ if (unlikely(!pskb_may_pull(skb, VLAN_ETH_HLEN)))
++ return false;
++
+ veh = (struct vlan_ethhdr *)skb->data;
+ protocol = veh->h_vlan_encapsulated_proto;
+ }
+@@ -666,7 +669,7 @@ static inline bool skb_vlan_tagged_multi(const struct sk_buff *skb)
+ *
+ * Returns features without unsafe ones if the skb has multiple tags.
+ */
+-static inline netdev_features_t vlan_features_check(const struct sk_buff *skb,
++static inline netdev_features_t vlan_features_check(struct sk_buff *skb,
+ netdev_features_t features)
+ {
+ if (skb_vlan_tagged_multi(skb)) {
+diff --git a/include/linux/tpm.h b/include/linux/tpm.h
+index bcdd3790e94d..06639fb6ab85 100644
+--- a/include/linux/tpm.h
++++ b/include/linux/tpm.h
+@@ -44,7 +44,7 @@ struct tpm_class_ops {
+ bool (*update_timeouts)(struct tpm_chip *chip,
+ unsigned long *timeout_cap);
+ int (*request_locality)(struct tpm_chip *chip, int loc);
+- void (*relinquish_locality)(struct tpm_chip *chip, int loc);
++ int (*relinquish_locality)(struct tpm_chip *chip, int loc);
+ void (*clk_enable)(struct tpm_chip *chip, bool value);
+ };
+
+diff --git a/include/net/ife.h b/include/net/ife.h
+index 44b9c00f7223..e117617e3c34 100644
+--- a/include/net/ife.h
++++ b/include/net/ife.h
+@@ -12,7 +12,8 @@
+ void *ife_encode(struct sk_buff *skb, u16 metalen);
+ void *ife_decode(struct sk_buff *skb, u16 *metalen);
+
+-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen);
++void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype,
++ u16 *dlen, u16 *totlen);
+ int ife_tlv_meta_encode(void *skbdata, u16 attrtype, u16 dlen,
+ const void *dval);
+
+diff --git a/include/net/llc_conn.h b/include/net/llc_conn.h
+index 5c40f118c0fa..df528a623548 100644
+--- a/include/net/llc_conn.h
++++ b/include/net/llc_conn.h
+@@ -97,6 +97,7 @@ static __inline__ char llc_backlog_type(struct sk_buff *skb)
+
+ struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority,
+ struct proto *prot, int kern);
++void llc_sk_stop_all_timers(struct sock *sk, bool sync);
+ void llc_sk_free(struct sock *sk);
+
+ void llc_sk_reset(struct sock *sk);
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index 102160ff5c66..ea619021d901 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -2428,7 +2428,7 @@ static int kprobe_blacklist_seq_show(struct seq_file *m, void *v)
+ struct kprobe_blacklist_entry *ent =
+ list_entry(v, struct kprobe_blacklist_entry, list);
+
+- seq_printf(m, "0x%p-0x%p\t%ps\n", (void *)ent->start_addr,
++ seq_printf(m, "0x%px-0x%px\t%ps\n", (void *)ent->start_addr,
+ (void *)ent->end_addr, (void *)ent->start_addr);
+ return 0;
+ }
+diff --git a/kernel/trace/trace_entries.h b/kernel/trace/trace_entries.h
+index e954ae3d82c0..e3a658bac10f 100644
+--- a/kernel/trace/trace_entries.h
++++ b/kernel/trace/trace_entries.h
+@@ -356,7 +356,7 @@ FTRACE_ENTRY(hwlat, hwlat_entry,
+ __field( unsigned int, seqnum )
+ ),
+
+- F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llunmi-ts:%llu\tnmi-count:%u\n",
++ F_printk("cnt:%u\tts:%010llu.%010lu\tinner:%llu\touter:%llu\tnmi-ts:%llu\tnmi-count:%u\n",
+ __entry->seqnum,
+ __entry->tv_sec,
+ __entry->tv_nsec,
+diff --git a/net/core/dev.c b/net/core/dev.c
+index c4aa2941dbfd..3e550507e9f0 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2942,7 +2942,7 @@ netdev_features_t passthru_features_check(struct sk_buff *skb,
+ }
+ EXPORT_SYMBOL(passthru_features_check);
+
+-static netdev_features_t dflt_features_check(const struct sk_buff *skb,
++static netdev_features_t dflt_features_check(struct sk_buff *skb,
+ struct net_device *dev,
+ netdev_features_t features)
+ {
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 7b7a14abba28..ce519861be59 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -55,7 +55,8 @@ static void neigh_timer_handler(struct timer_list *t);
+ static void __neigh_notify(struct neighbour *n, int type, int flags,
+ u32 pid);
+ static void neigh_update_notify(struct neighbour *neigh, u32 nlmsg_pid);
+-static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev);
++static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
++ struct net_device *dev);
+
+ #ifdef CONFIG_PROC_FS
+ static const struct file_operations neigh_stat_seq_fops;
+@@ -291,8 +292,7 @@ int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
+ {
+ write_lock_bh(&tbl->lock);
+ neigh_flush_dev(tbl, dev);
+- pneigh_ifdown(tbl, dev);
+- write_unlock_bh(&tbl->lock);
++ pneigh_ifdown_and_unlock(tbl, dev);
+
+ del_timer_sync(&tbl->proxy_timer);
+ pneigh_queue_purge(&tbl->proxy_queue);
+@@ -681,9 +681,10 @@ int pneigh_delete(struct neigh_table *tbl, struct net *net, const void *pkey,
+ return -ENOENT;
+ }
+
+-static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
++static int pneigh_ifdown_and_unlock(struct neigh_table *tbl,
++ struct net_device *dev)
+ {
+- struct pneigh_entry *n, **np;
++ struct pneigh_entry *n, **np, *freelist = NULL;
+ u32 h;
+
+ for (h = 0; h <= PNEIGH_HASHMASK; h++) {
+@@ -691,16 +692,23 @@ static int pneigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
+ while ((n = *np) != NULL) {
+ if (!dev || n->dev == dev) {
+ *np = n->next;
+- if (tbl->pdestructor)
+- tbl->pdestructor(n);
+- if (n->dev)
+- dev_put(n->dev);
+- kfree(n);
++ n->next = freelist;
++ freelist = n;
+ continue;
+ }
+ np = &n->next;
+ }
+ }
++ write_unlock_bh(&tbl->lock);
++ while ((n = freelist)) {
++ freelist = n->next;
++ n->next = NULL;
++ if (tbl->pdestructor)
++ tbl->pdestructor(n);
++ if (n->dev)
++ dev_put(n->dev);
++ kfree(n);
++ }
+ return -ENOENT;
+ }
+
+@@ -2323,12 +2331,16 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
+
+ err = nlmsg_parse(nlh, sizeof(struct ndmsg), tb, NDA_MAX, NULL, NULL);
+ if (!err) {
+- if (tb[NDA_IFINDEX])
++ if (tb[NDA_IFINDEX]) {
++ if (nla_len(tb[NDA_IFINDEX]) != sizeof(u32))
++ return -EINVAL;
+ filter_idx = nla_get_u32(tb[NDA_IFINDEX]);
+-
+- if (tb[NDA_MASTER])
++ }
++ if (tb[NDA_MASTER]) {
++ if (nla_len(tb[NDA_MASTER]) != sizeof(u32))
++ return -EINVAL;
+ filter_master_idx = nla_get_u32(tb[NDA_MASTER]);
+-
++ }
+ if (filter_idx || filter_master_idx)
+ flags |= NLM_F_DUMP_FILTERED;
+ }
+diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
+index e1d4d898a007..ed372d550137 100644
+--- a/net/dns_resolver/dns_key.c
++++ b/net/dns_resolver/dns_key.c
+@@ -91,9 +91,9 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
+
+ next_opt = memchr(opt, '#', end - opt) ?: end;
+ opt_len = next_opt - opt;
+- if (!opt_len) {
+- printk(KERN_WARNING
+- "Empty option to dns_resolver key\n");
++ if (opt_len <= 0 || opt_len > 128) {
++ pr_warn_ratelimited("Invalid option length (%d) for dns_resolver key\n",
++ opt_len);
+ return -EINVAL;
+ }
+
+@@ -127,10 +127,8 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
+ }
+
+ bad_option_value:
+- printk(KERN_WARNING
+- "Option '%*.*s' to dns_resolver key:"
+- " bad/missing value\n",
+- opt_nlen, opt_nlen, opt);
++ pr_warn_ratelimited("Option '%*.*s' to dns_resolver key: bad/missing value\n",
++ opt_nlen, opt_nlen, opt);
+ return -EINVAL;
+ } while (opt = next_opt + 1, opt < end);
+ }
+diff --git a/net/ife/ife.c b/net/ife/ife.c
+index 7d1ec76e7f43..13bbf8cb6a39 100644
+--- a/net/ife/ife.c
++++ b/net/ife/ife.c
+@@ -69,6 +69,9 @@ void *ife_decode(struct sk_buff *skb, u16 *metalen)
+ int total_pull;
+ u16 ifehdrln;
+
++ if (!pskb_may_pull(skb, skb->dev->hard_header_len + IFE_METAHDRLEN))
++ return NULL;
++
+ ifehdr = (struct ifeheadr *) (skb->data + skb->dev->hard_header_len);
+ ifehdrln = ntohs(ifehdr->metalen);
+ total_pull = skb->dev->hard_header_len + ifehdrln;
+@@ -92,12 +95,43 @@ struct meta_tlvhdr {
+ __be16 len;
+ };
+
++static bool __ife_tlv_meta_valid(const unsigned char *skbdata,
++ const unsigned char *ifehdr_end)
++{
++ const struct meta_tlvhdr *tlv;
++ u16 tlvlen;
++
++ if (unlikely(skbdata + sizeof(*tlv) > ifehdr_end))
++ return false;
++
++ tlv = (const struct meta_tlvhdr *)skbdata;
++ tlvlen = ntohs(tlv->len);
++
++ /* tlv length field is inc header, check on minimum */
++ if (tlvlen < NLA_HDRLEN)
++ return false;
++
++ /* overflow by NLA_ALIGN check */
++ if (NLA_ALIGN(tlvlen) < tlvlen)
++ return false;
++
++ if (unlikely(skbdata + NLA_ALIGN(tlvlen) > ifehdr_end))
++ return false;
++
++ return true;
++}
++
+ /* Caller takes care of presenting data in network order
+ */
+-void *ife_tlv_meta_decode(void *skbdata, u16 *attrtype, u16 *dlen, u16 *totlen)
++void *ife_tlv_meta_decode(void *skbdata, const void *ifehdr_end, u16 *attrtype,
++ u16 *dlen, u16 *totlen)
+ {
+- struct meta_tlvhdr *tlv = (struct meta_tlvhdr *) skbdata;
++ struct meta_tlvhdr *tlv;
++
++ if (!__ife_tlv_meta_valid(skbdata, ifehdr_end))
++ return NULL;
+
++ tlv = (struct meta_tlvhdr *)skbdata;
+ *dlen = ntohs(tlv->len) - NLA_HDRLEN;
+ *attrtype = ntohs(tlv->type);
+
+diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
+index 8b8059b7af4d..1ab8733dac5f 100644
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -2385,6 +2385,7 @@ void tcp_write_queue_purge(struct sock *sk)
+ INIT_LIST_HEAD(&tcp_sk(sk)->tsorted_sent_queue);
+ sk_mem_reclaim(sk);
+ tcp_clear_all_retrans_hints(tcp_sk(sk));
++ tcp_sk(sk)->packets_out = 0;
+ }
+
+ int tcp_disconnect(struct sock *sk, int flags)
+@@ -2434,7 +2435,6 @@ int tcp_disconnect(struct sock *sk, int flags)
+ icsk->icsk_backoff = 0;
+ tp->snd_cwnd = 2;
+ icsk->icsk_probes_out = 0;
+- tp->packets_out = 0;
+ tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
+ tp->snd_cwnd_cnt = 0;
+ tp->window_clamp = 0;
+@@ -2830,8 +2830,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
+ #ifdef CONFIG_TCP_MD5SIG
+ case TCP_MD5SIG:
+ case TCP_MD5SIG_EXT:
+- /* Read the IP->Key mappings from userspace */
+- err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
++ if ((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))
++ err = tp->af_specific->md5_parse(sk, optname, optval, optlen);
++ else
++ err = -EINVAL;
+ break;
+ #endif
+ case TCP_USER_TIMEOUT:
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index ff6cd98ce8d5..31ca27fdde66 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3871,11 +3871,8 @@ const u8 *tcp_parse_md5sig_option(const struct tcphdr *th)
+ int length = (th->doff << 2) - sizeof(*th);
+ const u8 *ptr = (const u8 *)(th + 1);
+
+- /* If the TCP option is too short, we can short cut */
+- if (length < TCPOLEN_MD5SIG)
+- return NULL;
+-
+- while (length > 0) {
++ /* If not enough data remaining, we can short cut */
++ while (length >= TCPOLEN_MD5SIG) {
+ int opcode = *ptr++;
+ int opsize;
+
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index fc74352fac12..74a2e37412b2 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -3862,6 +3862,7 @@ void rt6_mtu_change(struct net_device *dev, unsigned int mtu)
+
+ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
+ [RTA_GATEWAY] = { .len = sizeof(struct in6_addr) },
++ [RTA_PREFSRC] = { .len = sizeof(struct in6_addr) },
+ [RTA_OIF] = { .type = NLA_U32 },
+ [RTA_IIF] = { .type = NLA_U32 },
+ [RTA_PRIORITY] = { .type = NLA_U32 },
+@@ -3873,6 +3874,7 @@ static const struct nla_policy rtm_ipv6_policy[RTA_MAX+1] = {
+ [RTA_EXPIRES] = { .type = NLA_U32 },
+ [RTA_UID] = { .type = NLA_U32 },
+ [RTA_MARK] = { .type = NLA_U32 },
++ [RTA_TABLE] = { .type = NLA_U32 },
+ };
+
+ static int rtm_to_fib6_config(struct sk_buff *skb, struct nlmsghdr *nlh,
+diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
+index f343e6f0fc95..5fe139484919 100644
+--- a/net/ipv6/seg6_iptunnel.c
++++ b/net/ipv6/seg6_iptunnel.c
+@@ -136,7 +136,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
+ isrh->nexthdr = proto;
+
+ hdr->daddr = isrh->segments[isrh->first_segment];
+- set_tun_src(net, ip6_dst_idev(dst)->dev, &hdr->daddr, &hdr->saddr);
++ set_tun_src(net, dst->dev, &hdr->daddr, &hdr->saddr);
+
+ #ifdef CONFIG_IPV6_SEG6_HMAC
+ if (sr_has_hmac(isrh)) {
+diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
+index 0fbd3ee26165..40261cb68e83 100644
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -183,6 +183,26 @@ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id)
+ }
+ EXPORT_SYMBOL_GPL(l2tp_tunnel_get);
+
++struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth)
++{
++ const struct l2tp_net *pn = l2tp_pernet(net);
++ struct l2tp_tunnel *tunnel;
++ int count = 0;
++
++ rcu_read_lock_bh();
++ list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
++ if (++count > nth) {
++ l2tp_tunnel_inc_refcount(tunnel);
++ rcu_read_unlock_bh();
++ return tunnel;
++ }
++ }
++ rcu_read_unlock_bh();
++
++ return NULL;
++}
++EXPORT_SYMBOL_GPL(l2tp_tunnel_get_nth);
++
+ /* Lookup a session. A new reference is held on the returned session. */
+ struct l2tp_session *l2tp_session_get(const struct net *net,
+ struct l2tp_tunnel *tunnel,
+@@ -335,26 +355,6 @@ int l2tp_session_register(struct l2tp_session *session,
+ }
+ EXPORT_SYMBOL_GPL(l2tp_session_register);
+
+-struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth)
+-{
+- struct l2tp_net *pn = l2tp_pernet(net);
+- struct l2tp_tunnel *tunnel;
+- int count = 0;
+-
+- rcu_read_lock_bh();
+- list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
+- if (++count > nth) {
+- rcu_read_unlock_bh();
+- return tunnel;
+- }
+- }
+-
+- rcu_read_unlock_bh();
+-
+- return NULL;
+-}
+-EXPORT_SYMBOL_GPL(l2tp_tunnel_find_nth);
+-
+ /*****************************************************************************
+ * Receive data handling
+ *****************************************************************************/
+diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
+index ba33cbec71eb..c199020f8a8a 100644
+--- a/net/l2tp/l2tp_core.h
++++ b/net/l2tp/l2tp_core.h
+@@ -212,6 +212,8 @@ static inline void *l2tp_session_priv(struct l2tp_session *session)
+ }
+
+ struct l2tp_tunnel *l2tp_tunnel_get(const struct net *net, u32 tunnel_id);
++struct l2tp_tunnel *l2tp_tunnel_get_nth(const struct net *net, int nth);
++
+ void l2tp_tunnel_free(struct l2tp_tunnel *tunnel);
+
+ struct l2tp_session *l2tp_session_get(const struct net *net,
+@@ -220,7 +222,6 @@ struct l2tp_session *l2tp_session_get(const struct net *net,
+ struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth);
+ struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
+ const char *ifname);
+-struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth);
+
+ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id,
+ u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg,
+diff --git a/net/l2tp/l2tp_debugfs.c b/net/l2tp/l2tp_debugfs.c
+index 72e713da4733..7f1e842ef05a 100644
+--- a/net/l2tp/l2tp_debugfs.c
++++ b/net/l2tp/l2tp_debugfs.c
+@@ -47,7 +47,11 @@ struct l2tp_dfs_seq_data {
+
+ static void l2tp_dfs_next_tunnel(struct l2tp_dfs_seq_data *pd)
+ {
+- pd->tunnel = l2tp_tunnel_find_nth(pd->net, pd->tunnel_idx);
++ /* Drop reference taken during previous invocation */
++ if (pd->tunnel)
++ l2tp_tunnel_dec_refcount(pd->tunnel);
++
++ pd->tunnel = l2tp_tunnel_get_nth(pd->net, pd->tunnel_idx);
+ pd->tunnel_idx++;
+ }
+
+@@ -96,7 +100,17 @@ static void *l2tp_dfs_seq_next(struct seq_file *m, void *v, loff_t *pos)
+
+ static void l2tp_dfs_seq_stop(struct seq_file *p, void *v)
+ {
+- /* nothing to do */
++ struct l2tp_dfs_seq_data *pd = v;
++
++ if (!pd || pd == SEQ_START_TOKEN)
++ return;
++
++ /* Drop reference taken by last invocation of l2tp_dfs_next_tunnel() */
++ if (pd->tunnel) {
++ l2tp_tunnel_dec_refcount(pd->tunnel);
++ pd->tunnel = NULL;
++ pd->session = NULL;
++ }
+ }
+
+ static void l2tp_dfs_seq_tunnel_show(struct seq_file *m, void *v)
+diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
+index b05dbd9ffcb2..6616c9fd292f 100644
+--- a/net/l2tp/l2tp_netlink.c
++++ b/net/l2tp/l2tp_netlink.c
+@@ -487,14 +487,17 @@ static int l2tp_nl_cmd_tunnel_dump(struct sk_buff *skb, struct netlink_callback
+ struct net *net = sock_net(skb->sk);
+
+ for (;;) {
+- tunnel = l2tp_tunnel_find_nth(net, ti);
++ tunnel = l2tp_tunnel_get_nth(net, ti);
+ if (tunnel == NULL)
+ goto out;
+
+ if (l2tp_nl_tunnel_send(skb, NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, NLM_F_MULTI,
+- tunnel, L2TP_CMD_TUNNEL_GET) < 0)
++ tunnel, L2TP_CMD_TUNNEL_GET) < 0) {
++ l2tp_tunnel_dec_refcount(tunnel);
+ goto out;
++ }
++ l2tp_tunnel_dec_refcount(tunnel);
+
+ ti++;
+ }
+@@ -848,7 +851,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
+
+ for (;;) {
+ if (tunnel == NULL) {
+- tunnel = l2tp_tunnel_find_nth(net, ti);
++ tunnel = l2tp_tunnel_get_nth(net, ti);
+ if (tunnel == NULL)
+ goto out;
+ }
+@@ -856,6 +859,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
+ session = l2tp_session_get_nth(tunnel, si);
+ if (session == NULL) {
+ ti++;
++ l2tp_tunnel_dec_refcount(tunnel);
+ tunnel = NULL;
+ si = 0;
+ continue;
+@@ -865,6 +869,7 @@ static int l2tp_nl_cmd_session_dump(struct sk_buff *skb, struct netlink_callback
+ cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ session, L2TP_CMD_SESSION_GET) < 0) {
+ l2tp_session_dec_refcount(session);
++ l2tp_tunnel_dec_refcount(tunnel);
+ break;
+ }
+ l2tp_session_dec_refcount(session);
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 3d7887cc599b..0c4530ad74be 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -619,6 +619,13 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ lock_sock(sk);
+
+ error = -EINVAL;
++
++ if (sockaddr_len != sizeof(struct sockaddr_pppol2tp) &&
++ sockaddr_len != sizeof(struct sockaddr_pppol2tpv3) &&
++ sockaddr_len != sizeof(struct sockaddr_pppol2tpin6) &&
++ sockaddr_len != sizeof(struct sockaddr_pppol2tpv3in6))
++ goto end;
++
+ if (sp->sa_protocol != PX_PROTO_OL2TP)
+ goto end;
+
+@@ -1552,16 +1559,19 @@ struct pppol2tp_seq_data {
+
+ static void pppol2tp_next_tunnel(struct net *net, struct pppol2tp_seq_data *pd)
+ {
++ /* Drop reference taken during previous invocation */
++ if (pd->tunnel)
++ l2tp_tunnel_dec_refcount(pd->tunnel);
++
+ for (;;) {
+- pd->tunnel = l2tp_tunnel_find_nth(net, pd->tunnel_idx);
++ pd->tunnel = l2tp_tunnel_get_nth(net, pd->tunnel_idx);
+ pd->tunnel_idx++;
+
+- if (pd->tunnel == NULL)
+- break;
++ /* Only accept L2TPv2 tunnels */
++ if (!pd->tunnel || pd->tunnel->version == 2)
++ return;
+
+- /* Ignore L2TPv3 tunnels */
+- if (pd->tunnel->version < 3)
+- break;
++ l2tp_tunnel_dec_refcount(pd->tunnel);
+ }
+ }
+
+@@ -1610,7 +1620,17 @@ static void *pppol2tp_seq_next(struct seq_file *m, void *v, loff_t *pos)
+
+ static void pppol2tp_seq_stop(struct seq_file *p, void *v)
+ {
+- /* nothing to do */
++ struct pppol2tp_seq_data *pd = v;
++
++ if (!pd || pd == SEQ_START_TOKEN)
++ return;
++
++ /* Drop reference taken by last invocation of pppol2tp_next_tunnel() */
++ if (pd->tunnel) {
++ l2tp_tunnel_dec_refcount(pd->tunnel);
++ pd->tunnel = NULL;
++ pd->session = NULL;
++ }
+ }
+
+ static void pppol2tp_seq_tunnel_show(struct seq_file *m, void *v)
+diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
+index c38d16f22d2a..cf41d9b4a0b8 100644
+--- a/net/llc/af_llc.c
++++ b/net/llc/af_llc.c
+@@ -199,9 +199,19 @@ static int llc_ui_release(struct socket *sock)
+ llc->laddr.lsap, llc->daddr.lsap);
+ if (!llc_send_disc(sk))
+ llc_ui_wait_for_disc(sk, sk->sk_rcvtimeo);
+- if (!sock_flag(sk, SOCK_ZAPPED))
++ if (!sock_flag(sk, SOCK_ZAPPED)) {
++ struct llc_sap *sap = llc->sap;
++
++ /* Hold this for release_sock(), so that llc_backlog_rcv()
++ * could still use it.
++ */
++ llc_sap_hold(sap);
+ llc_sap_remove_socket(llc->sap, sk);
+- release_sock(sk);
++ release_sock(sk);
++ llc_sap_put(sap);
++ } else {
++ release_sock(sk);
++ }
+ if (llc->dev)
+ dev_put(llc->dev);
+ sock_put(sk);
+diff --git a/net/llc/llc_c_ac.c b/net/llc/llc_c_ac.c
+index 163121192aca..4d78375f9872 100644
+--- a/net/llc/llc_c_ac.c
++++ b/net/llc/llc_c_ac.c
+@@ -1099,14 +1099,7 @@ int llc_conn_ac_inc_tx_win_size(struct sock *sk, struct sk_buff *skb)
+
+ int llc_conn_ac_stop_all_timers(struct sock *sk, struct sk_buff *skb)
+ {
+- struct llc_sock *llc = llc_sk(sk);
+-
+- del_timer(&llc->pf_cycle_timer.timer);
+- del_timer(&llc->ack_timer.timer);
+- del_timer(&llc->rej_sent_timer.timer);
+- del_timer(&llc->busy_state_timer.timer);
+- llc->ack_must_be_send = 0;
+- llc->ack_pf = 0;
++ llc_sk_stop_all_timers(sk, false);
+ return 0;
+ }
+
+diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c
+index 110e32bcb399..c0ac522b48a1 100644
+--- a/net/llc/llc_conn.c
++++ b/net/llc/llc_conn.c
+@@ -961,6 +961,26 @@ struct sock *llc_sk_alloc(struct net *net, int family, gfp_t priority, struct pr
+ return sk;
+ }
+
++void llc_sk_stop_all_timers(struct sock *sk, bool sync)
++{
++ struct llc_sock *llc = llc_sk(sk);
++
++ if (sync) {
++ del_timer_sync(&llc->pf_cycle_timer.timer);
++ del_timer_sync(&llc->ack_timer.timer);
++ del_timer_sync(&llc->rej_sent_timer.timer);
++ del_timer_sync(&llc->busy_state_timer.timer);
++ } else {
++ del_timer(&llc->pf_cycle_timer.timer);
++ del_timer(&llc->ack_timer.timer);
++ del_timer(&llc->rej_sent_timer.timer);
++ del_timer(&llc->busy_state_timer.timer);
++ }
++
++ llc->ack_must_be_send = 0;
++ llc->ack_pf = 0;
++}
++
+ /**
+ * llc_sk_free - Frees a LLC socket
+ * @sk - socket to free
+@@ -973,7 +993,7 @@ void llc_sk_free(struct sock *sk)
+
+ llc->state = LLC_CONN_OUT_OF_SVC;
+ /* Stop all (possibly) running timers */
+- llc_conn_ac_stop_all_timers(sk, NULL);
++ llc_sk_stop_all_timers(sk, true);
+ #ifdef DEBUG_LLC_CONN_ALLOC
+ printk(KERN_INFO "%s: unackq=%d, txq=%d\n", __func__,
+ skb_queue_len(&llc->pdu_unack_q),
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index e0f3f4aeeb4f..3b43b1fcd618 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -329,11 +329,11 @@ static void packet_pick_tx_queue(struct net_device *dev, struct sk_buff *skb)
+ skb_set_queue_mapping(skb, queue_index);
+ }
+
+-/* register_prot_hook must be invoked with the po->bind_lock held,
++/* __register_prot_hook must be invoked through register_prot_hook
+ * or from a context in which asynchronous accesses to the packet
+ * socket is not possible (packet_create()).
+ */
+-static void register_prot_hook(struct sock *sk)
++static void __register_prot_hook(struct sock *sk)
+ {
+ struct packet_sock *po = pkt_sk(sk);
+
+@@ -348,8 +348,13 @@ static void register_prot_hook(struct sock *sk)
+ }
+ }
+
+-/* {,__}unregister_prot_hook() must be invoked with the po->bind_lock
+- * held. If the sync parameter is true, we will temporarily drop
++static void register_prot_hook(struct sock *sk)
++{
++ lockdep_assert_held_once(&pkt_sk(sk)->bind_lock);
++ __register_prot_hook(sk);
++}
++
++/* If the sync parameter is true, we will temporarily drop
+ * the po->bind_lock and do a synchronize_net to make sure no
+ * asynchronous packet processing paths still refer to the elements
+ * of po->prot_hook. If the sync parameter is false, it is the
+@@ -359,6 +364,8 @@ static void __unregister_prot_hook(struct sock *sk, bool sync)
+ {
+ struct packet_sock *po = pkt_sk(sk);
+
++ lockdep_assert_held_once(&po->bind_lock);
++
+ po->running = 0;
+
+ if (po->fanout)
+@@ -3008,6 +3015,7 @@ static int packet_release(struct socket *sock)
+
+ packet_flush_mclist(sk);
+
++ lock_sock(sk);
+ if (po->rx_ring.pg_vec) {
+ memset(&req_u, 0, sizeof(req_u));
+ packet_set_ring(sk, &req_u, 1, 0);
+@@ -3017,6 +3025,7 @@ static int packet_release(struct socket *sock)
+ memset(&req_u, 0, sizeof(req_u));
+ packet_set_ring(sk, &req_u, 1, 1);
+ }
++ release_sock(sk);
+
+ f = fanout_release(sk);
+
+@@ -3250,7 +3259,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol,
+
+ if (proto) {
+ po->prot_hook.type = proto;
+- register_prot_hook(sk);
++ __register_prot_hook(sk);
+ }
+
+ mutex_lock(&net->packet.sklist_lock);
+@@ -3645,6 +3654,7 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ union tpacket_req_u req_u;
+ int len;
+
++ lock_sock(sk);
+ switch (po->tp_version) {
+ case TPACKET_V1:
+ case TPACKET_V2:
+@@ -3655,12 +3665,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ len = sizeof(req_u.req3);
+ break;
+ }
+- if (optlen < len)
+- return -EINVAL;
+- if (copy_from_user(&req_u.req, optval, len))
+- return -EFAULT;
+- return packet_set_ring(sk, &req_u, 0,
+- optname == PACKET_TX_RING);
++ if (optlen < len) {
++ ret = -EINVAL;
++ } else {
++ if (copy_from_user(&req_u.req, optval, len))
++ ret = -EFAULT;
++ else
++ ret = packet_set_ring(sk, &req_u, 0,
++ optname == PACKET_TX_RING);
++ }
++ release_sock(sk);
++ return ret;
+ }
+ case PACKET_COPY_THRESH:
+ {
+@@ -3726,12 +3741,18 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+
+ if (optlen != sizeof(val))
+ return -EINVAL;
+- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+- return -EBUSY;
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+- po->tp_loss = !!val;
+- return 0;
++
++ lock_sock(sk);
++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++ ret = -EBUSY;
++ } else {
++ po->tp_loss = !!val;
++ ret = 0;
++ }
++ release_sock(sk);
++ return ret;
+ }
+ case PACKET_AUXDATA:
+ {
+@@ -3742,7 +3763,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
++ lock_sock(sk);
+ po->auxdata = !!val;
++ release_sock(sk);
+ return 0;
+ }
+ case PACKET_ORIGDEV:
+@@ -3754,7 +3777,9 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
++ lock_sock(sk);
+ po->origdev = !!val;
++ release_sock(sk);
+ return 0;
+ }
+ case PACKET_VNET_HDR:
+@@ -3763,15 +3788,20 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+
+ if (sock->type != SOCK_RAW)
+ return -EINVAL;
+- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+- return -EBUSY;
+ if (optlen < sizeof(val))
+ return -EINVAL;
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+
+- po->has_vnet_hdr = !!val;
+- return 0;
++ lock_sock(sk);
++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++ ret = -EBUSY;
++ } else {
++ po->has_vnet_hdr = !!val;
++ ret = 0;
++ }
++ release_sock(sk);
++ return ret;
+ }
+ case PACKET_TIMESTAMP:
+ {
+@@ -3809,11 +3839,17 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
+
+ if (optlen != sizeof(val))
+ return -EINVAL;
+- if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+- return -EBUSY;
+ if (copy_from_user(&val, optval, sizeof(val)))
+ return -EFAULT;
+- po->tp_tx_has_off = !!val;
++
++ lock_sock(sk);
++ if (po->rx_ring.pg_vec || po->tx_ring.pg_vec) {
++ ret = -EBUSY;
++ } else {
++ po->tp_tx_has_off = !!val;
++ ret = 0;
++ }
++ release_sock(sk);
+ return 0;
+ }
+ case PACKET_QDISC_BYPASS:
+@@ -4210,8 +4246,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ /* Added to avoid minimal code churn */
+ struct tpacket_req *req = &req_u->req;
+
+- lock_sock(sk);
+-
+ rb = tx_ring ? &po->tx_ring : &po->rx_ring;
+ rb_queue = tx_ring ? &sk->sk_write_queue : &sk->sk_receive_queue;
+
+@@ -4349,7 +4383,6 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ if (pg_vec)
+ free_pg_vec(pg_vec, order, req->tp_block_nr);
+ out:
+- release_sock(sk);
+ return err;
+ }
+
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index a1d2b2319ae9..3bb7c5fb3bff 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -112,10 +112,12 @@ struct packet_sock {
+ int copy_thresh;
+ spinlock_t bind_lock;
+ struct mutex pg_vec_lock;
+- unsigned int running:1, /* prot_hook is attached*/
+- auxdata:1,
++ unsigned int running; /* bind_lock must be held */
++ unsigned int auxdata:1, /* writer must hold sock lock */
+ origdev:1,
+- has_vnet_hdr:1;
++ has_vnet_hdr:1,
++ tp_loss:1,
++ tp_tx_has_off:1;
+ int pressure;
+ int ifindex; /* bound device */
+ __be16 num;
+@@ -125,8 +127,6 @@ struct packet_sock {
+ enum tpacket_versions tp_version;
+ unsigned int tp_hdrlen;
+ unsigned int tp_reserve;
+- unsigned int tp_loss:1;
+- unsigned int tp_tx_has_off:1;
+ unsigned int tp_tstamp;
+ struct net_device __rcu *cached_dev;
+ int (*xmit)(struct sk_buff *skb);
+diff --git a/net/sched/act_ife.c b/net/sched/act_ife.c
+index 5954e992685a..1d477b054f2e 100644
+--- a/net/sched/act_ife.c
++++ b/net/sched/act_ife.c
+@@ -652,7 +652,7 @@ static int find_decode_metaid(struct sk_buff *skb, struct tcf_ife_info *ife,
+ }
+ }
+
+- return 0;
++ return -ENOENT;
+ }
+
+ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
+@@ -682,7 +682,12 @@ static int tcf_ife_decode(struct sk_buff *skb, const struct tc_action *a,
+ u16 mtype;
+ u16 dlen;
+
+- curr_data = ife_tlv_meta_decode(tlv_data, &mtype, &dlen, NULL);
++ curr_data = ife_tlv_meta_decode(tlv_data, ifehdr_end, &mtype,
++ &dlen, NULL);
++ if (!curr_data) {
++ qstats_drop_inc(this_cpu_ptr(ife->common.cpu_qstats));
++ return TC_ACT_SHOT;
++ }
+
+ if (find_decode_metaid(skb, ife, mtype, dlen, curr_data)) {
+ /* abuse overlimits to count when we receive metadata
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index f6d3d0c1e133..07b64719d1bc 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -521,46 +521,49 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
+ addr->v6.sin6_scope_id = 0;
+ }
+
+-/* Compare addresses exactly.
+- * v4-mapped-v6 is also in consideration.
+- */
+-static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
+- const union sctp_addr *addr2)
++static int __sctp_v6_cmp_addr(const union sctp_addr *addr1,
++ const union sctp_addr *addr2)
+ {
+ if (addr1->sa.sa_family != addr2->sa.sa_family) {
+ if (addr1->sa.sa_family == AF_INET &&
+ addr2->sa.sa_family == AF_INET6 &&
+- ipv6_addr_v4mapped(&addr2->v6.sin6_addr)) {
+- if (addr2->v6.sin6_port == addr1->v4.sin_port &&
+- addr2->v6.sin6_addr.s6_addr32[3] ==
+- addr1->v4.sin_addr.s_addr)
+- return 1;
+- }
++ ipv6_addr_v4mapped(&addr2->v6.sin6_addr) &&
++ addr2->v6.sin6_addr.s6_addr32[3] ==
++ addr1->v4.sin_addr.s_addr)
++ return 1;
++
+ if (addr2->sa.sa_family == AF_INET &&
+ addr1->sa.sa_family == AF_INET6 &&
+- ipv6_addr_v4mapped(&addr1->v6.sin6_addr)) {
+- if (addr1->v6.sin6_port == addr2->v4.sin_port &&
+- addr1->v6.sin6_addr.s6_addr32[3] ==
+- addr2->v4.sin_addr.s_addr)
+- return 1;
+- }
++ ipv6_addr_v4mapped(&addr1->v6.sin6_addr) &&
++ addr1->v6.sin6_addr.s6_addr32[3] ==
++ addr2->v4.sin_addr.s_addr)
++ return 1;
++
+ return 0;
+ }
+- if (addr1->v6.sin6_port != addr2->v6.sin6_port)
+- return 0;
++
+ if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
+ return 0;
++
+ /* If this is a linklocal address, compare the scope_id. */
+- if (ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) {
+- if (addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id &&
+- (addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)) {
+- return 0;
+- }
+- }
++ if ((ipv6_addr_type(&addr1->v6.sin6_addr) & IPV6_ADDR_LINKLOCAL) &&
++ addr1->v6.sin6_scope_id && addr2->v6.sin6_scope_id &&
++ addr1->v6.sin6_scope_id != addr2->v6.sin6_scope_id)
++ return 0;
+
+ return 1;
+ }
+
++/* Compare addresses exactly.
++ * v4-mapped-v6 is also in consideration.
++ */
++static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
++ const union sctp_addr *addr2)
++{
++ return __sctp_v6_cmp_addr(addr1, addr2) &&
++ addr1->v6.sin6_port == addr2->v6.sin6_port;
++}
++
+ /* Initialize addr struct to INADDR_ANY. */
+ static void sctp_v6_inaddr_any(union sctp_addr *addr, __be16 port)
+ {
+@@ -846,8 +849,8 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
+ const union sctp_addr *addr2,
+ struct sctp_sock *opt)
+ {
+- struct sctp_af *af1, *af2;
+ struct sock *sk = sctp_opt2sk(opt);
++ struct sctp_af *af1, *af2;
+
+ af1 = sctp_get_af_specific(addr1->sa.sa_family);
+ af2 = sctp_get_af_specific(addr2->sa.sa_family);
+@@ -863,10 +866,7 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
+ if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
+ return 1;
+
+- if (addr1->sa.sa_family != addr2->sa.sa_family)
+- return 0;
+-
+- return af1->cmp_addr(addr1, addr2);
++ return __sctp_v6_cmp_addr(addr1, addr2);
+ }
+
+ /* Verify that the provided sockaddr looks bindable. Common verification,
+diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
+index 1e0d780855c3..afd5a935bbcb 100644
+--- a/net/smc/af_smc.c
++++ b/net/smc/af_smc.c
+@@ -1254,14 +1254,12 @@ static int smc_shutdown(struct socket *sock, int how)
+ rc = smc_close_shutdown_write(smc);
+ break;
+ case SHUT_RD:
+- if (sk->sk_state == SMC_LISTEN)
+- rc = smc_close_active(smc);
+- else
+- rc = 0;
+- /* nothing more to do because peer is not involved */
++ rc = 0;
++ /* nothing more to do because peer is not involved */
+ break;
+ }
+- rc1 = kernel_sock_shutdown(smc->clcsock, how);
++ if (smc->clcsock)
++ rc1 = kernel_sock_shutdown(smc->clcsock, how);
+ /* map sock_shutdown_cmd constants to sk_shutdown value range */
+ sk->sk_shutdown |= how + 1;
+
+diff --git a/net/strparser/strparser.c b/net/strparser/strparser.c
+index b9283ce5cd85..092bebc70048 100644
+--- a/net/strparser/strparser.c
++++ b/net/strparser/strparser.c
+@@ -67,7 +67,7 @@ static void strp_abort_strp(struct strparser *strp, int err)
+
+ static void strp_start_timer(struct strparser *strp, long timeo)
+ {
+- if (timeo)
++ if (timeo && timeo != LONG_MAX)
+ mod_delayed_work(strp_wq, &strp->msg_timer_work, timeo);
+ }
+
+@@ -296,9 +296,9 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
+ strp_start_timer(strp, timeo);
+ }
+
++ stm->accum_len += cand_len;
+ strp->need_bytes = stm->strp.full_len -
+ stm->accum_len;
+- stm->accum_len += cand_len;
+ stm->early_eaten = cand_len;
+ STRP_STATS_ADD(strp->stats.bytes, cand_len);
+ desc->count = 0; /* Stop reading socket */
+@@ -321,6 +321,7 @@ static int __strp_recv(read_descriptor_t *desc, struct sk_buff *orig_skb,
+ /* Hurray, we have a new message! */
+ cancel_delayed_work(&strp->msg_timer_work);
+ strp->skb_head = NULL;
++ strp->need_bytes = 0;
+ STRP_STATS_INCR(strp->stats.msgs);
+
+ /* Give skb to upper layer */
+@@ -410,9 +411,7 @@ void strp_data_ready(struct strparser *strp)
+ return;
+
+ if (strp->need_bytes) {
+- if (strp_peek_len(strp) >= strp->need_bytes)
+- strp->need_bytes = 0;
+- else
++ if (strp_peek_len(strp) < strp->need_bytes)
+ return;
+ }
+
+diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
+index b76f13f6fea1..d4e0bbeee727 100644
+--- a/net/tipc/netlink.c
++++ b/net/tipc/netlink.c
+@@ -79,7 +79,8 @@ const struct nla_policy tipc_nl_sock_policy[TIPC_NLA_SOCK_MAX + 1] = {
+
+ const struct nla_policy tipc_nl_net_policy[TIPC_NLA_NET_MAX + 1] = {
+ [TIPC_NLA_NET_UNSPEC] = { .type = NLA_UNSPEC },
+- [TIPC_NLA_NET_ID] = { .type = NLA_U32 }
++ [TIPC_NLA_NET_ID] = { .type = NLA_U32 },
++ [TIPC_NLA_NET_ADDR] = { .type = NLA_U32 },
+ };
+
+ const struct nla_policy tipc_nl_link_policy[TIPC_NLA_LINK_MAX + 1] = {
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index e0fc84daed94..ad17a985f74e 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -2018,7 +2018,13 @@ const struct vsock_transport *vsock_core_get_transport(void)
+ }
+ EXPORT_SYMBOL_GPL(vsock_core_get_transport);
+
++static void __exit vsock_exit(void)
++{
++ /* Do nothing. This function makes this module removable. */
++}
++
+ module_init(vsock_init_tables);
++module_exit(vsock_exit);
+
+ MODULE_AUTHOR("VMware, Inc.");
+ MODULE_DESCRIPTION("VMware Virtual Socket Family");
+diff --git a/security/commoncap.c b/security/commoncap.c
+index 48620c93d697..1ce701fcb3f3 100644
+--- a/security/commoncap.c
++++ b/security/commoncap.c
+@@ -449,6 +449,8 @@ int cap_inode_getsecurity(struct inode *inode, const char *name, void **buffer,
+ magic |= VFS_CAP_FLAGS_EFFECTIVE;
+ memcpy(&cap->data, &nscap->data, sizeof(__le32) * 2 * VFS_CAP_U32);
+ cap->magic_etc = cpu_to_le32(magic);
++ } else {
++ size = -ENOMEM;
+ }
+ }
+ kfree(tmpbuf);
next reply other threads:[~2018-04-30 10:30 UTC|newest]
Thread overview: 20+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-04-30 10:30 Mike Pagano [this message]
-- strict thread matches above, loose matches on Subject: below --
2018-06-26 16:13 [gentoo-commits] proj/linux-patches:4.16 commit in: / Alice Ferrazzi
2018-06-20 19:44 Mike Pagano
2018-06-16 15:45 Mike Pagano
2018-06-11 21:48 Mike Pagano
2018-06-05 11:23 Mike Pagano
2018-05-30 11:44 Mike Pagano
2018-05-25 15:37 Mike Pagano
2018-05-22 19:13 Mike Pagano
2018-05-20 22:22 Mike Pagano
2018-05-16 10:25 Mike Pagano
2018-05-09 10:57 Mike Pagano
2018-05-02 16:15 Mike Pagano
2018-04-26 10:22 Mike Pagano
2018-04-24 11:31 Mike Pagano
2018-04-19 10:45 Mike Pagano
2018-04-12 12:21 Mike Pagano
2018-04-08 14:33 Mike Pagano
2018-03-09 19:24 Mike Pagano
2018-02-12 20:46 Mike Pagano
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1525084235.54039fa3feac7ed37530054550520d924419b496.mpagano@gentoo \
--to=mpagano@gentoo.org \
--cc=gentoo-commits@lists.gentoo.org \
--cc=gentoo-dev@lists.gentoo.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox