Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.12/0100-3.12.1-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-3.12/0100-3.12.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2423 - (show annotations) (download)
    Tue Mar 25 12:29:50 2014 UTC (10 years, 1 month ago) by niro
    File size: 20631 byte(s) 
    -added 3.12 branch
    1 diff --git a/Makefile b/Makefile
    2 index 67077ad6edbb..eb29ec754a9e 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 3
    7 PATCHLEVEL = 12
    8 -SUBLEVEL = 0
    9 +SUBLEVEL = 1
    10 EXTRAVERSION =
    11 NAME = One Giant Leap for Frogkind
    12
    13 diff --git a/drivers/misc/atmel_pwm.c b/drivers/misc/atmel_pwm.c
    14 index 494d0500bda6..a6dc56e1bc58 100644
    15 --- a/drivers/misc/atmel_pwm.c
    16 +++ b/drivers/misc/atmel_pwm.c
    17 @@ -90,8 +90,10 @@ int pwm_channel_alloc(int index, struct pwm_channel *ch)
    18 unsigned long flags;
    19 int status = 0;
    20
    21 - /* insist on PWM init, with this signal pinned out */
    22 - if (!pwm || !(pwm->mask & 1 << index))
    23 + if (!pwm)
    24 + return -EPROBE_DEFER;
    25 +
    26 + if (!(pwm->mask & 1 << index))
    27 return -ENODEV;
    28
    29 if (index < 0 || index >= PWM_NCHAN || !ch)
    30 diff --git a/drivers/net/ethernet/chelsio/cxgb3/sge.c b/drivers/net/ethernet/chelsio/cxgb3/sge.c
    31 index 9c89dc8fe105..632b318eb38a 100644
    32 --- a/drivers/net/ethernet/chelsio/cxgb3/sge.c
    33 +++ b/drivers/net/ethernet/chelsio/cxgb3/sge.c
    34 @@ -1599,7 +1599,8 @@ static void write_ofld_wr(struct adapter *adap, struct sk_buff *skb,
    35 flits = skb_transport_offset(skb) / 8;
    36 sgp = ndesc == 1 ? (struct sg_ent *)&d->flit[flits] : sgl;
    37 sgl_flits = make_sgl(skb, sgp, skb_transport_header(skb),
    38 - skb->tail - skb->transport_header,
    39 + skb_tail_pointer(skb) -
    40 + skb_transport_header(skb),
    41 adap->pdev);
    42 if (need_skb_unmap()) {
    43 setup_deferred_unmapping(skb, adap->pdev, sgp, sgl_flits);
    44 diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
    45 index ea20182c6969..bb11624a1f39 100644
    46 --- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
    47 +++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
    48 @@ -1691,7 +1691,7 @@ static void mlx4_master_deactivate_admin_state(struct mlx4_priv *priv, int slave
    49 vp_oper->vlan_idx = NO_INDX;
    50 }
    51 if (NO_INDX != vp_oper->mac_idx) {
    52 - __mlx4_unregister_mac(&priv->dev, port, vp_oper->mac_idx);
    53 + __mlx4_unregister_mac(&priv->dev, port, vp_oper->state.mac);
    54 vp_oper->mac_idx = NO_INDX;
    55 }
    56 }
    57 diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
    58 index 9fbdfcd1e1a0..bbc9cb84ec1f 100644
    59 --- a/drivers/net/virtio_net.c
    60 +++ b/drivers/net/virtio_net.c
    61 @@ -1118,11 +1118,6 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
    62 {
    63 struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb);
    64
    65 - mutex_lock(&vi->config_lock);
    66 -
    67 - if (!vi->config_enable)
    68 - goto done;
    69 -
    70 switch(action & ~CPU_TASKS_FROZEN) {
    71 case CPU_ONLINE:
    72 case CPU_DOWN_FAILED:
    73 @@ -1136,8 +1131,6 @@ static int virtnet_cpu_callback(struct notifier_block *nfb,
    74 break;
    75 }
    76
    77 -done:
    78 - mutex_unlock(&vi->config_lock);
    79 return NOTIFY_OK;
    80 }
    81
    82 @@ -1699,6 +1692,8 @@ static int virtnet_freeze(struct virtio_device *vdev)
    83 struct virtnet_info *vi = vdev->priv;
    84 int i;
    85
    86 + unregister_hotcpu_notifier(&vi->nb);
    87 +
    88 /* Prevent config work handler from accessing the device */
    89 mutex_lock(&vi->config_lock);
    90 vi->config_enable = false;
    91 @@ -1747,6 +1742,10 @@ static int virtnet_restore(struct virtio_device *vdev)
    92 virtnet_set_queues(vi, vi->curr_queue_pairs);
    93 rtnl_unlock();
    94
    95 + err = register_hotcpu_notifier(&vi->nb);
    96 + if (err)
    97 + return err;
    98 +
    99 return 0;
    100 }
    101 #endif
    102 diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h
    103 index 5715318d6bab..400fea1de080 100644
    104 --- a/drivers/net/xen-netback/common.h
    105 +++ b/drivers/net/xen-netback/common.h
    106 @@ -163,6 +163,7 @@ struct xenvif {
    107 unsigned long credit_usec;
    108 unsigned long remaining_credit;
    109 struct timer_list credit_timeout;
    110 + u64 credit_window_start;
    111
    112 /* Statistics */
    113 unsigned long rx_gso_checksum_fixup;
    114 diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
    115 index 01bb854c7f62..459935a6bfae 100644
    116 --- a/drivers/net/xen-netback/interface.c
    117 +++ b/drivers/net/xen-netback/interface.c
    118 @@ -312,8 +312,7 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid,
    119 vif->credit_bytes = vif->remaining_credit = ~0UL;
    120 vif->credit_usec = 0UL;
    121 init_timer(&vif->credit_timeout);
    122 - /* Initialize 'expires' now: it's used to track the credit window. */
    123 - vif->credit_timeout.expires = jiffies;
    124 + vif->credit_window_start = get_jiffies_64();
    125
    126 dev->netdev_ops = &xenvif_netdev_ops;
    127 dev->hw_features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
    128 diff --git a/drivers/net/xen-netback/netback.c b/drivers/net/xen-netback/netback.c
    129 index f3e591c611de..900da4b243ad 100644
    130 --- a/drivers/net/xen-netback/netback.c
    131 +++ b/drivers/net/xen-netback/netback.c
    132 @@ -1185,9 +1185,8 @@ out:
    133
    134 static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
    135 {
    136 - unsigned long now = jiffies;
    137 - unsigned long next_credit =
    138 - vif->credit_timeout.expires +
    139 + u64 now = get_jiffies_64();
    140 + u64 next_credit = vif->credit_window_start +
    141 msecs_to_jiffies(vif->credit_usec / 1000);
    142
    143 /* Timer could already be pending in rare cases. */
    144 @@ -1195,8 +1194,8 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
    145 return true;
    146
    147 /* Passed the point where we can replenish credit? */
    148 - if (time_after_eq(now, next_credit)) {
    149 - vif->credit_timeout.expires = now;
    150 + if (time_after_eq64(now, next_credit)) {
    151 + vif->credit_window_start = now;
    152 tx_add_credit(vif);
    153 }
    154
    155 @@ -1208,6 +1207,7 @@ static bool tx_credit_exceeded(struct xenvif *vif, unsigned size)
    156 tx_credit_callback;
    157 mod_timer(&vif->credit_timeout,
    158 next_credit);
    159 + vif->credit_window_start = next_credit;
    160
    161 return true;
    162 }
    163 diff --git a/drivers/usb/core/hcd.c b/drivers/usb/core/hcd.c
    164 index d6a8d23f047b..f20a04494e16 100644
    165 --- a/drivers/usb/core/hcd.c
    166 +++ b/drivers/usb/core/hcd.c
    167 @@ -1033,6 +1033,7 @@ static int register_root_hub(struct usb_hcd *hcd)
    168 dev_name(&usb_dev->dev), retval);
    169 return retval;
    170 }
    171 + usb_dev->lpm_capable = usb_device_supports_lpm(usb_dev);
    172 }
    173
    174 retval = usb_new_device (usb_dev);
    175 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    176 index e6b682c6c236..879651cb6b45 100644
    177 --- a/drivers/usb/core/hub.c
    178 +++ b/drivers/usb/core/hub.c
    179 @@ -135,7 +135,7 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
    180 return usb_get_intfdata(hdev->actconfig->interface[0]);
    181 }
    182
    183 -static int usb_device_supports_lpm(struct usb_device *udev)
    184 +int usb_device_supports_lpm(struct usb_device *udev)
    185 {
    186 /* USB 2.1 (and greater) devices indicate LPM support through
    187 * their USB 2.0 Extended Capabilities BOS descriptor.
    188 @@ -156,6 +156,11 @@ static int usb_device_supports_lpm(struct usb_device *udev)
    189 "Power management will be impacted.\n");
    190 return 0;
    191 }
    192 +
    193 + /* udev is root hub */
    194 + if (!udev->parent)
    195 + return 1;
    196 +
    197 if (udev->parent->lpm_capable)
    198 return 1;
    199
    200 diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h
    201 index 823857767a16..c49383669cd8 100644
    202 --- a/drivers/usb/core/usb.h
    203 +++ b/drivers/usb/core/usb.h
    204 @@ -35,6 +35,7 @@ extern int usb_get_device_descriptor(struct usb_device *dev,
    205 unsigned int size);
    206 extern int usb_get_bos_descriptor(struct usb_device *dev);
    207 extern void usb_release_bos_descriptor(struct usb_device *dev);
    208 +extern int usb_device_supports_lpm(struct usb_device *udev);
    209 extern char *usb_cache_string(struct usb_device *udev, int index);
    210 extern int usb_set_configuration(struct usb_device *dev, int configuration);
    211 extern int usb_choose_configuration(struct usb_device *udev);
    212 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    213 index acaee066b99a..c3d94853b4ab 100644
    214 --- a/drivers/usb/serial/option.c
    215 +++ b/drivers/usb/serial/option.c
    216 @@ -1376,6 +1376,23 @@ static const struct usb_device_id option_ids[] = {
    217 .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    218 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff), /* ZTE MF91 */
    219 .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
    220 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1533, 0xff, 0xff, 0xff) },
    221 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1534, 0xff, 0xff, 0xff) },
    222 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1535, 0xff, 0xff, 0xff) },
    223 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1545, 0xff, 0xff, 0xff) },
    224 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1546, 0xff, 0xff, 0xff) },
    225 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1547, 0xff, 0xff, 0xff) },
    226 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1565, 0xff, 0xff, 0xff) },
    227 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1566, 0xff, 0xff, 0xff) },
    228 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1567, 0xff, 0xff, 0xff) },
    229 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1589, 0xff, 0xff, 0xff) },
    230 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1590, 0xff, 0xff, 0xff) },
    231 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1591, 0xff, 0xff, 0xff) },
    232 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1592, 0xff, 0xff, 0xff) },
    233 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1594, 0xff, 0xff, 0xff) },
    234 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1596, 0xff, 0xff, 0xff) },
    235 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1598, 0xff, 0xff, 0xff) },
    236 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1600, 0xff, 0xff, 0xff) },
    237 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff,
    238 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist },
    239 { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) },
    240 diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
    241 index 0393d827dd44..f7447f7004fb 100644
    242 --- a/drivers/video/backlight/atmel-pwm-bl.c
    243 +++ b/drivers/video/backlight/atmel-pwm-bl.c
    244 @@ -118,7 +118,7 @@ static const struct backlight_ops atmel_pwm_bl_ops = {
    245 .update_status = atmel_pwm_bl_set_intensity,
    246 };
    247
    248 -static int __init atmel_pwm_bl_probe(struct platform_device *pdev)
    249 +static int atmel_pwm_bl_probe(struct platform_device *pdev)
    250 {
    251 struct backlight_properties props;
    252 const struct atmel_pwm_bl_platform_data *pdata;
    253 @@ -202,7 +202,7 @@ err_free_mem:
    254 return retval;
    255 }
    256
    257 -static int __exit atmel_pwm_bl_remove(struct platform_device *pdev)
    258 +static int atmel_pwm_bl_remove(struct platform_device *pdev)
    259 {
    260 struct atmel_pwm_bl *pwmbl = platform_get_drvdata(pdev);
    261
    262 @@ -220,10 +220,11 @@ static struct platform_driver atmel_pwm_bl_driver = {
    263 .name = "atmel-pwm-bl",
    264 },
    265 /* REVISIT add suspend() and resume() */
    266 - .remove = __exit_p(atmel_pwm_bl_remove),
    267 + .probe = atmel_pwm_bl_probe,
    268 + .remove = atmel_pwm_bl_remove,
    269 };
    270
    271 -module_platform_driver_probe(atmel_pwm_bl_driver, atmel_pwm_bl_probe);
    272 +module_platform_driver(atmel_pwm_bl_driver);
    273
    274 MODULE_AUTHOR("Hans-Christian egtvedt <hans-christian.egtvedt@atmel.com>");
    275 MODULE_DESCRIPTION("Atmel PWM backlight driver");
    276 diff --git a/drivers/video/hyperv_fb.c b/drivers/video/hyperv_fb.c
    277 index 8ac99b87c07e..8d456dc449b8 100644
    278 --- a/drivers/video/hyperv_fb.c
    279 +++ b/drivers/video/hyperv_fb.c
    280 @@ -795,12 +795,21 @@ static int hvfb_remove(struct hv_device *hdev)
    281 }
    282
    283
    284 +static DEFINE_PCI_DEVICE_TABLE(pci_stub_id_table) = {
    285 + {
    286 + .vendor = PCI_VENDOR_ID_MICROSOFT,
    287 + .device = PCI_DEVICE_ID_HYPERV_VIDEO,
    288 + },
    289 + { /* end of list */ }
    290 +};
    291 +
    292 static const struct hv_vmbus_device_id id_table[] = {
    293 /* Synthetic Video Device GUID */
    294 {HV_SYNTHVID_GUID},
    295 {}
    296 };
    297
    298 +MODULE_DEVICE_TABLE(pci, pci_stub_id_table);
    299 MODULE_DEVICE_TABLE(vmbus, id_table);
    300
    301 static struct hv_driver hvfb_drv = {
    302 @@ -810,14 +819,43 @@ static struct hv_driver hvfb_drv = {
    303 .remove = hvfb_remove,
    304 };
    305
    306 +static int hvfb_pci_stub_probe(struct pci_dev *pdev,
    307 + const struct pci_device_id *ent)
    308 +{
    309 + return 0;
    310 +}
    311 +
    312 +static void hvfb_pci_stub_remove(struct pci_dev *pdev)
    313 +{
    314 +}
    315 +
    316 +static struct pci_driver hvfb_pci_stub_driver = {
    317 + .name = KBUILD_MODNAME,
    318 + .id_table = pci_stub_id_table,
    319 + .probe = hvfb_pci_stub_probe,
    320 + .remove = hvfb_pci_stub_remove,
    321 +};
    322
    323 static int __init hvfb_drv_init(void)
    324 {
    325 - return vmbus_driver_register(&hvfb_drv);
    326 + int ret;
    327 +
    328 + ret = vmbus_driver_register(&hvfb_drv);
    329 + if (ret != 0)
    330 + return ret;
    331 +
    332 + ret = pci_register_driver(&hvfb_pci_stub_driver);
    333 + if (ret != 0) {
    334 + vmbus_driver_unregister(&hvfb_drv);
    335 + return ret;
    336 + }
    337 +
    338 + return 0;
    339 }
    340
    341 static void __exit hvfb_drv_exit(void)
    342 {
    343 + pci_unregister_driver(&hvfb_pci_stub_driver);
    344 vmbus_driver_unregister(&hvfb_drv);
    345 }
    346
    347 diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
    348 index 48ec25a7fcb6..5e661a979694 100644
    349 --- a/include/net/ip6_fib.h
    350 +++ b/include/net/ip6_fib.h
    351 @@ -165,6 +165,7 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
    352 static inline void rt6_clean_expires(struct rt6_info *rt)
    353 {
    354 rt->rt6i_flags &= ~RTF_EXPIRES;
    355 + rt->dst.expires = 0;
    356 }
    357
    358 static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
    359 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
    360 index 7974ba20557d..b778e96e02a1 100644
    361 --- a/kernel/trace/trace.c
    362 +++ b/kernel/trace/trace.c
    363 @@ -843,9 +843,12 @@ int trace_get_user(struct trace_parser *parser, const char __user *ubuf,
    364 if (isspace(ch)) {
    365 parser->buffer[parser->idx] = 0;
    366 parser->cont = false;
    367 - } else {
    368 + } else if (parser->idx < parser->size - 1) {
    369 parser->cont = true;
    370 parser->buffer[parser->idx++] = ch;
    371 + } else {
    372 + ret = -EINVAL;
    373 + goto out;
    374 }
    375
    376 *ppos += read;
    377 diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
    378 index 8d7d0dd72db2..143b6fdb9647 100644
    379 --- a/net/core/flow_dissector.c
    380 +++ b/net/core/flow_dissector.c
    381 @@ -40,7 +40,7 @@ again:
    382 struct iphdr _iph;
    383 ip:
    384 iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
    385 - if (!iph)
    386 + if (!iph || iph->ihl < 5)
    387 return false;
    388
    389 if (ip_is_fragment(iph))
    390 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    391 index a16b01b537ba..068c8fb0d158 100644
    392 --- a/net/ipv4/tcp_input.c
    393 +++ b/net/ipv4/tcp_input.c
    394 @@ -2856,7 +2856,8 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
    395 * left edge of the send window.
    396 * See draft-ietf-tcplw-high-performance-00, section 3.3.
    397 */
    398 - if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr)
    399 + if (seq_rtt < 0 && tp->rx_opt.saw_tstamp && tp->rx_opt.rcv_tsecr &&
    400 + flag & FLAG_ACKED)
    401 seq_rtt = tcp_time_stamp - tp->rx_opt.rcv_tsecr;
    402
    403 if (seq_rtt < 0)
    404 @@ -2871,14 +2872,19 @@ static inline bool tcp_ack_update_rtt(struct sock *sk, const int flag,
    405 }
    406
    407 /* Compute time elapsed between (last) SYNACK and the ACK completing 3WHS. */
    408 -static void tcp_synack_rtt_meas(struct sock *sk, struct request_sock *req)
    409 +static void tcp_synack_rtt_meas(struct sock *sk, const u32 synack_stamp)
    410 {
    411 struct tcp_sock *tp = tcp_sk(sk);
    412 s32 seq_rtt = -1;
    413
    414 - if (tp->lsndtime && !tp->total_retrans)
    415 - seq_rtt = tcp_time_stamp - tp->lsndtime;
    416 - tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
    417 + if (synack_stamp && !tp->total_retrans)
    418 + seq_rtt = tcp_time_stamp - synack_stamp;
    419 +
    420 + /* If the ACK acks both the SYNACK and the (Fast Open'd) data packets
    421 + * sent in SYN_RECV, SYNACK RTT is the smooth RTT computed in tcp_ack()
    422 + */
    423 + if (!tp->srtt)
    424 + tcp_ack_update_rtt(sk, FLAG_SYN_ACKED, seq_rtt, -1);
    425 }
    426
    427 static void tcp_cong_avoid(struct sock *sk, u32 ack, u32 in_flight)
    428 @@ -2981,6 +2987,7 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
    429 s32 seq_rtt = -1;
    430 s32 ca_seq_rtt = -1;
    431 ktime_t last_ackt = net_invalid_timestamp();
    432 + bool rtt_update;
    433
    434 while ((skb = tcp_write_queue_head(sk)) && skb != tcp_send_head(sk)) {
    435 struct tcp_skb_cb *scb = TCP_SKB_CB(skb);
    436 @@ -3057,14 +3064,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
    437 if (skb && (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
    438 flag |= FLAG_SACK_RENEGING;
    439
    440 - if (tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt) ||
    441 - (flag & FLAG_ACKED))
    442 - tcp_rearm_rto(sk);
    443 + rtt_update = tcp_ack_update_rtt(sk, flag, seq_rtt, sack_rtt);
    444
    445 if (flag & FLAG_ACKED) {
    446 const struct tcp_congestion_ops *ca_ops
    447 = inet_csk(sk)->icsk_ca_ops;
    448
    449 + tcp_rearm_rto(sk);
    450 if (unlikely(icsk->icsk_mtup.probe_size &&
    451 !after(tp->mtu_probe.probe_seq_end, tp->snd_una))) {
    452 tcp_mtup_probe_success(sk);
    453 @@ -3103,6 +3109,13 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
    454
    455 ca_ops->pkts_acked(sk, pkts_acked, rtt_us);
    456 }
    457 + } else if (skb && rtt_update && sack_rtt >= 0 &&
    458 + sack_rtt > (s32)(now - TCP_SKB_CB(skb)->when)) {
    459 + /* Do not re-arm RTO if the sack RTT is measured from data sent
    460 + * after when the head was last (re)transmitted. Otherwise the
    461 + * timeout may continue to extend in loss recovery.
    462 + */
    463 + tcp_rearm_rto(sk);
    464 }
    465
    466 #if FASTRETRANS_DEBUG > 0
    467 @@ -5587,6 +5600,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
    468 struct request_sock *req;
    469 int queued = 0;
    470 bool acceptable;
    471 + u32 synack_stamp;
    472
    473 tp->rx_opt.saw_tstamp = 0;
    474
    475 @@ -5669,9 +5683,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
    476 * so release it.
    477 */
    478 if (req) {
    479 + synack_stamp = tcp_rsk(req)->snt_synack;
    480 tp->total_retrans = req->num_retrans;
    481 reqsk_fastopen_remove(sk, req, false);
    482 } else {
    483 + synack_stamp = tp->lsndtime;
    484 /* Make sure socket is routed, for correct metrics. */
    485 icsk->icsk_af_ops->rebuild_header(sk);
    486 tcp_init_congestion_control(sk);
    487 @@ -5694,7 +5710,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
    488 tp->snd_una = TCP_SKB_CB(skb)->ack_seq;
    489 tp->snd_wnd = ntohs(th->window) << tp->rx_opt.snd_wscale;
    490 tcp_init_wl(tp, TCP_SKB_CB(skb)->seq);
    491 - tcp_synack_rtt_meas(sk, req);
    492 + tcp_synack_rtt_meas(sk, synack_stamp);
    493
    494 if (tp->rx_opt.tstamp_ok)
    495 tp->advmss -= TCPOLEN_TSTAMP_ALIGNED;
    496 diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
    497 index 3a7525e6c086..533c58a5cfb7 100644
    498 --- a/net/ipv4/tcp_offload.c
    499 +++ b/net/ipv4/tcp_offload.c
    500 @@ -18,6 +18,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
    501 netdev_features_t features)
    502 {
    503 struct sk_buff *segs = ERR_PTR(-EINVAL);
    504 + unsigned int sum_truesize = 0;
    505 struct tcphdr *th;
    506 unsigned int thlen;
    507 unsigned int seq;
    508 @@ -102,13 +103,7 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
    509 if (copy_destructor) {
    510 skb->destructor = gso_skb->destructor;
    511 skb->sk = gso_skb->sk;
    512 - /* {tcp|sock}_wfree() use exact truesize accounting :
    513 - * sum(skb->truesize) MUST be exactly be gso_skb->truesize
    514 - * So we account mss bytes of 'true size' for each segment.
    515 - * The last segment will contain the remaining.
    516 - */
    517 - skb->truesize = mss;
    518 - gso_skb->truesize -= mss;
    519 + sum_truesize += skb->truesize;
    520 }
    521 skb = skb->next;
    522 th = tcp_hdr(skb);
    523 @@ -125,7 +120,9 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb,
    524 if (copy_destructor) {
    525 swap(gso_skb->sk, skb->sk);
    526 swap(gso_skb->destructor, skb->destructor);
    527 - swap(gso_skb->truesize, skb->truesize);
    528 + sum_truesize += skb->truesize;
    529 + atomic_add(sum_truesize - gso_skb->truesize,
    530 + &skb->sk->sk_wmem_alloc);
    531 }
    532
    533 delta = htonl(oldlen + (skb_tail_pointer(skb) -
    534 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    535 index f54e3a101098..04e17b3309fb 100644
    536 --- a/net/ipv6/route.c
    537 +++ b/net/ipv6/route.c
    538 @@ -1087,10 +1087,13 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
    539 if (rt->rt6i_genid != rt_genid_ipv6(dev_net(rt->dst.dev)))
    540 return NULL;
    541
    542 - if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
    543 - return dst;
    544 + if (!rt->rt6i_node || (rt->rt6i_node->fn_sernum != cookie))
    545 + return NULL;
    546
    547 - return NULL;
    548 + if (rt6_check_expired(rt))
    549 + return NULL;
    550 +
    551 + return dst;
    552 }
    553
    554 static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
    555 diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
    556 index 666c66842799..1a6eef39ab2f 100644
    557 --- a/net/sctp/sm_sideeffect.c
    558 +++ b/net/sctp/sm_sideeffect.c
    559 @@ -860,7 +860,6 @@ static void sctp_cmd_delete_tcb(sctp_cmd_seq_t *cmds,
    560 (!asoc->temp) && (sk->sk_shutdown != SHUTDOWN_MASK))
    561 return;
    562
    563 - BUG_ON(asoc->peer.primary_path == NULL);
    564 sctp_unhash_established(asoc);
    565 sctp_association_free(asoc);
    566 }
    567 diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
    568 index 50173d412ac5..8d2d01b0cf86 100644
    569 --- a/sound/pci/hda/patch_hdmi.c
    570 +++ b/sound/pci/hda/patch_hdmi.c
    571 @@ -740,9 +740,10 @@ static int hdmi_manual_setup_channel_mapping(struct hda_codec *codec,
    572 static void hdmi_setup_fake_chmap(unsigned char *map, int ca)
    573 {
    574 int i;
    575 + int ordered_ca = get_channel_allocation_order(ca);
    576 for (i = 0; i < 8; i++) {
    577 - if (i < channel_allocations[ca].channels)
    578 - map[i] = from_cea_slot((hdmi_channel_mapping[ca][i] >> 4) & 0x0f);
    579 + if (i < channel_allocations[ordered_ca].channels)
    580 + map[i] = from_cea_slot(hdmi_channel_mapping[ca][i] & 0x0f);
    581 else
    582 map[i] = 0;
    583 }