Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0386-4.9.287-all-fixes.patch

    Annotation of /trunk/kernel-alx-legacy/patches-4.9/0386-4.9.287-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3688 - (hide annotations) (download)
    Mon Oct 24 14:08:03 2022 UTC (18 months, 2 weeks ago) by niro
    File size: 19039 byte(s) 
    -linux-4.9.287
    1 niro 3688 diff --git a/Makefile b/Makefile
    2     index 68f2c6f3869e2..76eff0f592346 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 286
    9     +SUBLEVEL = 287
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/arm/boot/dts/omap3430-sdp.dts b/arch/arm/boot/dts/omap3430-sdp.dts
    14     index abd6921143beb..e0ba97bd41b79 100644
    15     --- a/arch/arm/boot/dts/omap3430-sdp.dts
    16     +++ b/arch/arm/boot/dts/omap3430-sdp.dts
    17     @@ -104,7 +104,7 @@
    18    
    19     nand@1,0 {
    20     compatible = "ti,omap2-nand";
    21     - reg = <0 0 4>; /* CS0, offset 0, IO size 4 */
    22     + reg = <1 0 4>; /* CS1, offset 0, IO size 4 */
    23     interrupt-parent = <&gpmc>;
    24     interrupts = <0 IRQ_TYPE_NONE>, /* fifoevent */
    25     <1 IRQ_TYPE_NONE>; /* termcount */
    26     diff --git a/arch/arm/mach-imx/pm-imx6.c b/arch/arm/mach-imx/pm-imx6.c
    27     index 6da26692f2fde..950c9f2ffe005 100644
    28     --- a/arch/arm/mach-imx/pm-imx6.c
    29     +++ b/arch/arm/mach-imx/pm-imx6.c
    30     @@ -15,6 +15,7 @@
    31     #include <linux/io.h>
    32     #include <linux/irq.h>
    33     #include <linux/genalloc.h>
    34     +#include <linux/irqchip/arm-gic.h>
    35     #include <linux/mfd/syscon.h>
    36     #include <linux/mfd/syscon/imx6q-iomuxc-gpr.h>
    37     #include <linux/of.h>
    38     @@ -606,6 +607,7 @@ static void __init imx6_pm_common_init(const struct imx6_pm_socdata
    39    
    40     static void imx6_pm_stby_poweroff(void)
    41     {
    42     + gic_cpu_if_down(0);
    43     imx6_set_lpm(STOP_POWER_OFF);
    44     imx6q_suspend_finish(0);
    45    
    46     diff --git a/arch/powerpc/boot/dts/fsl/t1023rdb.dts b/arch/powerpc/boot/dts/fsl/t1023rdb.dts
    47     index 29757623e5baf..f5f8f969dd586 100644
    48     --- a/arch/powerpc/boot/dts/fsl/t1023rdb.dts
    49     +++ b/arch/powerpc/boot/dts/fsl/t1023rdb.dts
    50     @@ -125,7 +125,7 @@
    51    
    52     fm1mac3: ethernet@e4000 {
    53     phy-handle = <&sgmii_aqr_phy3>;
    54     - phy-connection-type = "sgmii-2500";
    55     + phy-connection-type = "2500base-x";
    56     sleep = <&rcpm 0x20000000>;
    57     };
    58    
    59     diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
    60     index c26cca506f646..c20df6a3540c2 100644
    61     --- a/arch/x86/events/core.c
    62     +++ b/arch/x86/events/core.c
    63     @@ -2075,6 +2075,7 @@ static int x86_pmu_event_init(struct perf_event *event)
    64     if (err) {
    65     if (event->destroy)
    66     event->destroy(event);
    67     + event->destroy = NULL;
    68     }
    69    
    70     if (ACCESS_ONCE(x86_pmu.attr_rdpmc))
    71     diff --git a/arch/xtensa/kernel/irq.c b/arch/xtensa/kernel/irq.c
    72     index 441694464b1e4..fbbc24b914e30 100644
    73     --- a/arch/xtensa/kernel/irq.c
    74     +++ b/arch/xtensa/kernel/irq.c
    75     @@ -144,7 +144,7 @@ unsigned xtensa_get_ext_irq_no(unsigned irq)
    76    
    77     void __init init_IRQ(void)
    78     {
    79     -#ifdef CONFIG_OF
    80     +#ifdef CONFIG_USE_OF
    81     irqchip_init();
    82     #else
    83     #ifdef CONFIG_HAVE_SMP
    84     diff --git a/drivers/gpu/drm/nouveau/nouveau_debugfs.c b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
    85     index 411c12cdb2499..bb516eb124213 100644
    86     --- a/drivers/gpu/drm/nouveau/nouveau_debugfs.c
    87     +++ b/drivers/gpu/drm/nouveau/nouveau_debugfs.c
    88     @@ -178,6 +178,7 @@ static const struct file_operations nouveau_pstate_fops = {
    89     .open = nouveau_debugfs_pstate_open,
    90     .read = seq_read,
    91     .write = nouveau_debugfs_pstate_set,
    92     + .release = single_release,
    93     };
    94    
    95     static struct drm_info_list nouveau_debugfs_list[] = {
    96     diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
    97     index 959a9e38b4f54..149902619cbc8 100644
    98     --- a/drivers/hid/hid-apple.c
    99     +++ b/drivers/hid/hid-apple.c
    100     @@ -302,12 +302,19 @@ static int apple_event(struct hid_device *hdev, struct hid_field *field,
    101    
    102     /*
    103     * MacBook JIS keyboard has wrong logical maximum
    104     + * Magic Keyboard JIS has wrong logical maximum
    105     */
    106     static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc,
    107     unsigned int *rsize)
    108     {
    109     struct apple_sc *asc = hid_get_drvdata(hdev);
    110    
    111     + if(*rsize >=71 && rdesc[70] == 0x65 && rdesc[64] == 0x65) {
    112     + hid_info(hdev,
    113     + "fixing up Magic Keyboard JIS report descriptor\n");
    114     + rdesc[64] = rdesc[70] = 0xe7;
    115     + }
    116     +
    117     if ((asc->quirks & APPLE_RDESC_JIS) && *rsize >= 60 &&
    118     rdesc[53] == 0x65 && rdesc[59] == 0x65) {
    119     hid_info(hdev,
    120     diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
    121     index 832fffed4a1fa..e7585f6c4665b 100644
    122     --- a/drivers/net/ethernet/intel/i40e/i40e_main.c
    123     +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
    124     @@ -6646,7 +6646,7 @@ static int i40e_get_capabilities(struct i40e_pf *pf)
    125     if (pf->hw.aq.asq_last_status == I40E_AQ_RC_ENOMEM) {
    126     /* retry with a larger buffer */
    127     buf_len = data_size;
    128     - } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK) {
    129     + } else if (pf->hw.aq.asq_last_status != I40E_AQ_RC_OK || err) {
    130     dev_info(&pf->pdev->dev,
    131     "capability discovery failed, err %s aq_err %s\n",
    132     i40e_stat_str(&pf->hw, err),
    133     diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
    134     index 8cc7563ab103b..92fb664b56fbb 100644
    135     --- a/drivers/net/phy/mdio_bus.c
    136     +++ b/drivers/net/phy/mdio_bus.c
    137     @@ -316,6 +316,13 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
    138     bus->dev.groups = NULL;
    139     dev_set_name(&bus->dev, "%s", bus->id);
    140    
    141     + /* We need to set state to MDIOBUS_UNREGISTERED to correctly release
    142     + * the device in mdiobus_free()
    143     + *
    144     + * State will be updated later in this function in case of success
    145     + */
    146     + bus->state = MDIOBUS_UNREGISTERED;
    147     +
    148     err = device_register(&bus->dev);
    149     if (err) {
    150     pr_err("mii_bus %s failed to register\n", bus->id);
    151     diff --git a/drivers/ptp/ptp_pch.c b/drivers/ptp/ptp_pch.c
    152     index 3aa22ae4d94c0..a911325fc0b4f 100644
    153     --- a/drivers/ptp/ptp_pch.c
    154     +++ b/drivers/ptp/ptp_pch.c
    155     @@ -698,6 +698,7 @@ static const struct pci_device_id pch_ieee1588_pcidev_id[] = {
    156     },
    157     {0}
    158     };
    159     +MODULE_DEVICE_TABLE(pci, pch_ieee1588_pcidev_id);
    160    
    161     static struct pci_driver pch_driver = {
    162     .name = KBUILD_MODNAME,
    163     diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c
    164     index 69046d342bc5d..39396548f9b55 100644
    165     --- a/drivers/scsi/ses.c
    166     +++ b/drivers/scsi/ses.c
    167     @@ -120,7 +120,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code,
    168     static int ses_send_diag(struct scsi_device *sdev, int page_code,
    169     void *buf, int bufflen)
    170     {
    171     - u32 result;
    172     + int result;
    173    
    174     unsigned char cmd[] = {
    175     SEND_DIAGNOSTIC,
    176     diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c
    177     index 7ba0031d3a738..d5575869a25c7 100644
    178     --- a/drivers/scsi/virtio_scsi.c
    179     +++ b/drivers/scsi/virtio_scsi.c
    180     @@ -343,7 +343,7 @@ static void virtscsi_handle_transport_reset(struct virtio_scsi *vscsi,
    181     }
    182     break;
    183     default:
    184     - pr_info("Unsupport virtio scsi event reason %x\n", event->reason);
    185     + pr_info("Unsupported virtio scsi event reason %x\n", event->reason);
    186     }
    187     }
    188    
    189     @@ -396,7 +396,7 @@ static void virtscsi_handle_event(struct work_struct *work)
    190     virtscsi_handle_param_change(vscsi, event);
    191     break;
    192     default:
    193     - pr_err("Unsupport virtio scsi event %x\n", event->event);
    194     + pr_err("Unsupported virtio scsi event %x\n", event->event);
    195     }
    196     virtscsi_kick_event(vscsi, event_node);
    197     }
    198     diff --git a/drivers/usb/Kconfig b/drivers/usb/Kconfig
    199     index 0103f777b97ad..bff5a15e59c00 100644
    200     --- a/drivers/usb/Kconfig
    201     +++ b/drivers/usb/Kconfig
    202     @@ -160,8 +160,7 @@ source "drivers/usb/gadget/Kconfig"
    203    
    204     config USB_LED_TRIG
    205     bool "USB LED Triggers"
    206     - depends on LEDS_CLASS && LEDS_TRIGGERS
    207     - select USB_COMMON
    208     + depends on LEDS_CLASS && USB_COMMON && LEDS_TRIGGERS
    209     help
    210     This option adds LED triggers for USB host and/or gadget activity.
    211    
    212     diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    213     index 23df1549eb0d8..b7b83ca83ba0d 100644
    214     --- a/drivers/usb/class/cdc-acm.c
    215     +++ b/drivers/usb/class/cdc-acm.c
    216     @@ -349,6 +349,9 @@ static void acm_ctrl_irq(struct urb *urb)
    217     acm->iocount.overrun++;
    218     spin_unlock(&acm->read_lock);
    219    
    220     + if (newctrl & ACM_CTRL_BRK)
    221     + tty_flip_buffer_push(&acm->port);
    222     +
    223     if (difference)
    224     wake_up_all(&acm->wioctl);
    225    
    226     @@ -408,11 +411,16 @@ static int acm_submit_read_urbs(struct acm *acm, gfp_t mem_flags)
    227    
    228     static void acm_process_read_urb(struct acm *acm, struct urb *urb)
    229     {
    230     + unsigned long flags;
    231     +
    232     if (!urb->actual_length)
    233     return;
    234    
    235     + spin_lock_irqsave(&acm->read_lock, flags);
    236     tty_insert_flip_string(&acm->port, urb->transfer_buffer,
    237     urb->actual_length);
    238     + spin_unlock_irqrestore(&acm->read_lock, flags);
    239     +
    240     tty_flip_buffer_push(&acm->port);
    241     }
    242    
    243     diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
    244     index b16a6c0363527..dc51011d670df 100644
    245     --- a/fs/nfsd/nfs4xdr.c
    246     +++ b/fs/nfsd/nfs4xdr.c
    247     @@ -3028,15 +3028,18 @@ nfsd4_encode_dirent(void *ccdv, const char *name, int namlen,
    248     goto fail;
    249     cd->rd_maxcount -= entry_bytes;
    250     /*
    251     - * RFC 3530 14.2.24 describes rd_dircount as only a "hint", so
    252     - * let's always let through the first entry, at least:
    253     + * RFC 3530 14.2.24 describes rd_dircount as only a "hint", and
    254     + * notes that it could be zero. If it is zero, then the server
    255     + * should enforce only the rd_maxcount value.
    256     */
    257     - if (!cd->rd_dircount)
    258     - goto fail;
    259     - name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
    260     - if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
    261     - goto fail;
    262     - cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
    263     + if (cd->rd_dircount) {
    264     + name_and_cookie = 4 + 4 * XDR_QUADLEN(namlen) + 8;
    265     + if (name_and_cookie > cd->rd_dircount && cd->cookie_offset)
    266     + goto fail;
    267     + cd->rd_dircount -= min(cd->rd_dircount, name_and_cookie);
    268     + if (!cd->rd_dircount)
    269     + cd->rd_maxcount = 0;
    270     + }
    271    
    272     cd->cookie_offset = cookie_offset;
    273     skip_entry:
    274     diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
    275     index 8546384a5fdfd..edd5979aca4f6 100644
    276     --- a/fs/overlayfs/dir.c
    277     +++ b/fs/overlayfs/dir.c
    278     @@ -926,9 +926,13 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old,
    279     goto out_dput;
    280     }
    281     } else {
    282     - if (!d_is_negative(newdentry) &&
    283     - (!new_opaque || !ovl_is_whiteout(newdentry)))
    284     - goto out_dput;
    285     + if (!d_is_negative(newdentry)) {
    286     + if (!new_opaque || !ovl_is_whiteout(newdentry))
    287     + goto out_dput;
    288     + } else {
    289     + if (flags & RENAME_EXCHANGE)
    290     + goto out_dput;
    291     + }
    292     }
    293    
    294     if (olddentry == trap)
    295     diff --git a/kernel/bpf/stackmap.c b/kernel/bpf/stackmap.c
    296     index 2fdf6f96f9762..6f09728cd1dd3 100644
    297     --- a/kernel/bpf/stackmap.c
    298     +++ b/kernel/bpf/stackmap.c
    299     @@ -28,7 +28,8 @@ struct bpf_stack_map {
    300    
    301     static int prealloc_elems_and_freelist(struct bpf_stack_map *smap)
    302     {
    303     - u32 elem_size = sizeof(struct stack_map_bucket) + smap->map.value_size;
    304     + u64 elem_size = sizeof(struct stack_map_bucket) +
    305     + (u64)smap->map.value_size;
    306     int err;
    307    
    308     smap->elems = bpf_map_area_alloc(elem_size * smap->map.max_entries);
    309     diff --git a/mm/gup.c b/mm/gup.c
    310     index 6bb7a8eb7f820..301dd96ef176c 100644
    311     --- a/mm/gup.c
    312     +++ b/mm/gup.c
    313     @@ -61,13 +61,22 @@ static int follow_pfn_pte(struct vm_area_struct *vma, unsigned long address,
    314     }
    315    
    316     /*
    317     - * FOLL_FORCE can write to even unwritable pte's, but only
    318     - * after we've gone through a COW cycle and they are dirty.
    319     + * FOLL_FORCE or a forced COW break can write even to unwritable pte's,
    320     + * but only after we've gone through a COW cycle and they are dirty.
    321     */
    322     static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
    323     {
    324     - return pte_write(pte) ||
    325     - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
    326     + return pte_write(pte) || ((flags & FOLL_COW) && pte_dirty(pte));
    327     +}
    328     +
    329     +/*
    330     + * A (separate) COW fault might break the page the other way and
    331     + * get_user_pages() would return the page from what is now the wrong
    332     + * VM. So we need to force a COW break at GUP time even for reads.
    333     + */
    334     +static inline bool should_force_cow_break(struct vm_area_struct *vma, unsigned int flags)
    335     +{
    336     + return is_cow_mapping(vma->vm_flags) && (flags & FOLL_GET);
    337     }
    338    
    339     static struct page *follow_page_pte(struct vm_area_struct *vma,
    340     @@ -577,12 +586,18 @@ static long __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
    341     if (!vma || check_vma_flags(vma, gup_flags))
    342     return i ? : -EFAULT;
    343     if (is_vm_hugetlb_page(vma)) {
    344     + if (should_force_cow_break(vma, foll_flags))
    345     + foll_flags |= FOLL_WRITE;
    346     i = follow_hugetlb_page(mm, vma, pages, vmas,
    347     &start, &nr_pages, i,
    348     - gup_flags);
    349     + foll_flags);
    350     continue;
    351     }
    352     }
    353     +
    354     + if (should_force_cow_break(vma, foll_flags))
    355     + foll_flags |= FOLL_WRITE;
    356     +
    357     retry:
    358     /*
    359     * If we have a pending SIGKILL, don't keep faulting pages and
    360     @@ -1503,6 +1518,10 @@ static int gup_pud_range(pgd_t pgd, unsigned long addr, unsigned long end,
    361     /*
    362     * Like get_user_pages_fast() except it's IRQ-safe in that it won't fall back to
    363     * the regular GUP. It will only return non-negative values.
    364     + *
    365     + * Careful, careful! COW breaking can go either way, so a non-write
    366     + * access can get ambiguous page results. If you call this function without
    367     + * 'write' set, you'd better be sure that you're ok with that ambiguity.
    368     */
    369     int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
    370     struct page **pages)
    371     @@ -1532,6 +1551,12 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
    372     *
    373     * We do not adopt an rcu_read_lock(.) here as we also want to
    374     * block IPIs that come from THPs splitting.
    375     + *
    376     + * NOTE! We allow read-only gup_fast() here, but you'd better be
    377     + * careful about possible COW pages. You'll get _a_ COW page, but
    378     + * not necessarily the one you intended to get depending on what
    379     + * COW event happens after this. COW may break the page copy in a
    380     + * random direction.
    381     */
    382    
    383     local_irq_save(flags);
    384     @@ -1542,15 +1567,22 @@ int __get_user_pages_fast(unsigned long start, int nr_pages, int write,
    385     next = pgd_addr_end(addr, end);
    386     if (pgd_none(pgd))
    387     break;
    388     + /*
    389     + * The FAST_GUP case requires FOLL_WRITE even for pure reads,
    390     + * because get_user_pages() may need to cause an early COW in
    391     + * order to avoid confusing the normal COW routines. So only
    392     + * targets that are already writable are safe to do by just
    393     + * looking at the page tables.
    394     + */
    395     if (unlikely(pgd_huge(pgd))) {
    396     - if (!gup_huge_pgd(pgd, pgdp, addr, next, write,
    397     + if (!gup_huge_pgd(pgd, pgdp, addr, next, 1,
    398     pages, &nr))
    399     break;
    400     } else if (unlikely(is_hugepd(__hugepd(pgd_val(pgd))))) {
    401     if (!gup_huge_pd(__hugepd(pgd_val(pgd)), addr,
    402     - PGDIR_SHIFT, next, write, pages, &nr))
    403     + PGDIR_SHIFT, next, 1, pages, &nr))
    404     break;
    405     - } else if (!gup_pud_range(pgd, addr, next, write, pages, &nr))
    406     + } else if (!gup_pud_range(pgd, addr, next, 1, pages, &nr))
    407     break;
    408     } while (pgdp++, addr = next, addr != end);
    409     local_irq_restore(flags);
    410     diff --git a/mm/huge_memory.c b/mm/huge_memory.c
    411     index 91f33bb43f178..3f3a86cc62b68 100644
    412     --- a/mm/huge_memory.c
    413     +++ b/mm/huge_memory.c
    414     @@ -1135,13 +1135,12 @@ out_unlock:
    415     }
    416    
    417     /*
    418     - * FOLL_FORCE can write to even unwritable pmd's, but only
    419     - * after we've gone through a COW cycle and they are dirty.
    420     + * FOLL_FORCE or a forced COW break can write even to unwritable pmd's,
    421     + * but only after we've gone through a COW cycle and they are dirty.
    422     */
    423     static inline bool can_follow_write_pmd(pmd_t pmd, unsigned int flags)
    424     {
    425     - return pmd_write(pmd) ||
    426     - ((flags & FOLL_FORCE) && (flags & FOLL_COW) && pmd_dirty(pmd));
    427     + return pmd_write(pmd) || ((flags & FOLL_COW) && pmd_dirty(pmd));
    428     }
    429    
    430     struct page *follow_trans_huge_pmd(struct vm_area_struct *vma,
    431     diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
    432     index 4f831225d34f4..ca8757090ae35 100644
    433     --- a/net/bridge/br_netlink.c
    434     +++ b/net/bridge/br_netlink.c
    435     @@ -1298,7 +1298,7 @@ static size_t br_get_linkxstats_size(const struct net_device *dev, int attr)
    436     }
    437    
    438     return numvls * nla_total_size(sizeof(struct bridge_vlan_xstats)) +
    439     - nla_total_size(sizeof(struct br_mcast_stats)) +
    440     + nla_total_size_64bit(sizeof(struct br_mcast_stats)) +
    441     nla_total_size(0);
    442     }
    443    
    444     diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    445     index 911752e8a3e64..012143f313a87 100644
    446     --- a/net/core/rtnetlink.c
    447     +++ b/net/core/rtnetlink.c
    448     @@ -3900,7 +3900,7 @@ nla_put_failure:
    449     static size_t if_nlmsg_stats_size(const struct net_device *dev,
    450     u32 filter_mask)
    451     {
    452     - size_t size = 0;
    453     + size_t size = NLMSG_ALIGN(sizeof(struct if_stats_msg));
    454    
    455     if (stats_attr_valid(filter_mask, IFLA_STATS_LINK_64, 0))
    456     size += nla_total_size_64bit(sizeof(struct rtnl_link_stats64));
    457     diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
    458     index 579fda1bc45df..ce54e66b47a03 100644
    459     --- a/net/ipv6/netfilter/ip6_tables.c
    460     +++ b/net/ipv6/netfilter/ip6_tables.c
    461     @@ -290,6 +290,7 @@ ip6t_do_table(struct sk_buff *skb,
    462     * things we don't know, ie. tcp syn flag or ports). If the
    463     * rule is also a fragment-specific rule, non-fragments won't
    464     * match it. */
    465     + acpar.fragoff = 0;
    466     acpar.hotdrop = false;
    467     acpar.net = state->net;
    468     acpar.in = state->in;
    469     diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    470     index b40e71a5d7957..3dc370ad23bf6 100644
    471     --- a/net/mac80211/rx.c
    472     +++ b/net/mac80211/rx.c
    473     @@ -3692,7 +3692,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx)
    474     if (!bssid)
    475     return false;
    476     if (ether_addr_equal(sdata->vif.addr, hdr->addr2) ||
    477     - ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2))
    478     + ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) ||
    479     + !is_valid_ether_addr(hdr->addr2))
    480     return false;
    481     if (ieee80211_is_beacon(hdr->frame_control))
    482     return true;
    483     diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
    484     index 453b0efdc0d71..1b70de5898c42 100644
    485     --- a/net/netlink/af_netlink.c
    486     +++ b/net/netlink/af_netlink.c
    487     @@ -574,7 +574,10 @@ static int netlink_insert(struct sock *sk, u32 portid)
    488    
    489     /* We need to ensure that the socket is hashed and visible. */
    490     smp_wmb();
    491     - nlk_sk(sk)->bound = portid;
    492     + /* Paired with lockless reads from netlink_bind(),
    493     + * netlink_connect() and netlink_sendmsg().
    494     + */
    495     + WRITE_ONCE(nlk_sk(sk)->bound, portid);
    496    
    497     err:
    498     release_sock(sk);
    499     @@ -993,7 +996,8 @@ static int netlink_bind(struct socket *sock, struct sockaddr *addr,
    500     else if (nlk->ngroups < 8*sizeof(groups))
    501     groups &= (1UL << nlk->ngroups) - 1;
    502    
    503     - bound = nlk->bound;
    504     + /* Paired with WRITE_ONCE() in netlink_insert() */
    505     + bound = READ_ONCE(nlk->bound);
    506     if (bound) {
    507     /* Ensure nlk->portid is up-to-date. */
    508     smp_rmb();
    509     @@ -1073,8 +1077,9 @@ static int netlink_connect(struct socket *sock, struct sockaddr *addr,
    510    
    511     /* No need for barriers here as we return to user-space without
    512     * using any of the bound attributes.
    513     + * Paired with WRITE_ONCE() in netlink_insert().
    514     */
    515     - if (!nlk->bound)
    516     + if (!READ_ONCE(nlk->bound))
    517     err = netlink_autobind(sock);
    518    
    519     if (err == 0) {
    520     @@ -1821,7 +1826,8 @@ static int netlink_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
    521     dst_group = nlk->dst_group;
    522     }
    523    
    524     - if (!nlk->bound) {
    525     + /* Paired with WRITE_ONCE() in netlink_insert() */
    526     + if (!READ_ONCE(nlk->bound)) {
    527     err = netlink_autobind(sock);
    528     if (err)
    529     goto out;
    530     diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
    531     index 1e37247656f80..8b7110cbcce4c 100644
    532     --- a/net/sched/sch_fifo.c
    533     +++ b/net/sched/sch_fifo.c
    534     @@ -151,6 +151,9 @@ int fifo_set_limit(struct Qdisc *q, unsigned int limit)
    535     if (strncmp(q->ops->id + 1, "fifo", 4) != 0)
    536     return 0;
    537    
    538     + if (!q->ops->change)
    539     + return 0;
    540     +
    541     nla = kmalloc(nla_attr_size(sizeof(struct tc_fifo_qopt)), GFP_KERNEL);
    542     if (nla) {
    543     nla->nla_type = RTM_NEWQDISC;