Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.1/0115-4.1.16-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.1/0115-4.1.16-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2757 - (show annotations) (download)
    Wed Jan 27 10:46:59 2016 UTC (8 years, 3 months ago) by niro
    File size: 45588 byte(s) 
    -linux-4.1.16
    1 diff --git a/Makefile b/Makefile
    2 index cf35f6bcffd8..7609f1dcdcb9 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 1
    8 -SUBLEVEL = 15
    9 +SUBLEVEL = 16
    10 EXTRAVERSION =
    11 NAME = Series 4800
    12
    13 diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
    14 index f8319a0860fd..39be5acc9c48 100644
    15 --- a/drivers/char/tpm/tpm.h
    16 +++ b/drivers/char/tpm/tpm.h
    17 @@ -115,6 +115,13 @@ enum tpm2_startup_types {
    18 TPM2_SU_STATE = 0x0001,
    19 };
    20
    21 +enum tpm2_start_method {
    22 + TPM2_START_ACPI = 2,
    23 + TPM2_START_FIFO = 6,
    24 + TPM2_START_CRB = 7,
    25 + TPM2_START_CRB_WITH_ACPI = 8,
    26 +};
    27 +
    28 struct tpm_chip;
    29
    30 struct tpm_vendor_specific {
    31 diff --git a/drivers/char/tpm/tpm_crb.c b/drivers/char/tpm/tpm_crb.c
    32 index 1267322595da..2b971b3e5c1c 100644
    33 --- a/drivers/char/tpm/tpm_crb.c
    34 +++ b/drivers/char/tpm/tpm_crb.c
    35 @@ -34,12 +34,6 @@ enum crb_defaults {
    36 CRB_ACPI_START_INDEX = 1,
    37 };
    38
    39 -enum crb_start_method {
    40 - CRB_SM_ACPI_START = 2,
    41 - CRB_SM_CRB = 7,
    42 - CRB_SM_CRB_WITH_ACPI_START = 8,
    43 -};
    44 -
    45 struct acpi_tpm2 {
    46 struct acpi_table_header hdr;
    47 u16 platform_class;
    48 @@ -220,12 +214,6 @@ static int crb_acpi_add(struct acpi_device *device)
    49 u64 pa;
    50 int rc;
    51
    52 - chip = tpmm_chip_alloc(dev, &tpm_crb);
    53 - if (IS_ERR(chip))
    54 - return PTR_ERR(chip);
    55 -
    56 - chip->flags = TPM_CHIP_FLAG_TPM2;
    57 -
    58 status = acpi_get_table(ACPI_SIG_TPM2, 1,
    59 (struct acpi_table_header **) &buf);
    60 if (ACPI_FAILURE(status)) {
    61 @@ -233,13 +221,15 @@ static int crb_acpi_add(struct acpi_device *device)
    62 return -ENODEV;
    63 }
    64
    65 - /* At least some versions of AMI BIOS have a bug that TPM2 table has
    66 - * zero address for the control area and therefore we must fail.
    67 - */
    68 - if (!buf->control_area_pa) {
    69 - dev_err(dev, "TPM2 ACPI table has a zero address for the control area\n");
    70 - return -EINVAL;
    71 - }
    72 + /* Should the FIFO driver handle this? */
    73 + if (buf->start_method == TPM2_START_FIFO)
    74 + return -ENODEV;
    75 +
    76 + chip = tpmm_chip_alloc(dev, &tpm_crb);
    77 + if (IS_ERR(chip))
    78 + return PTR_ERR(chip);
    79 +
    80 + chip->flags = TPM_CHIP_FLAG_TPM2;
    81
    82 if (buf->hdr.length < sizeof(struct acpi_tpm2)) {
    83 dev_err(dev, "TPM2 ACPI table has wrong size");
    84 @@ -259,11 +249,11 @@ static int crb_acpi_add(struct acpi_device *device)
    85 * report only ACPI start but in practice seems to require both
    86 * ACPI start and CRB start.
    87 */
    88 - if (sm == CRB_SM_CRB || sm == CRB_SM_CRB_WITH_ACPI_START ||
    89 + if (sm == TPM2_START_CRB || sm == TPM2_START_FIFO ||
    90 !strcmp(acpi_device_hid(device), "MSFT0101"))
    91 priv->flags |= CRB_FL_CRB_START;
    92
    93 - if (sm == CRB_SM_ACPI_START || sm == CRB_SM_CRB_WITH_ACPI_START)
    94 + if (sm == TPM2_START_ACPI || sm == TPM2_START_CRB_WITH_ACPI)
    95 priv->flags |= CRB_FL_ACPI_START;
    96
    97 priv->cca = (struct crb_control_area __iomem *)
    98 diff --git a/drivers/char/tpm/tpm_tis.c b/drivers/char/tpm/tpm_tis.c
    99 index f2dffa770b8e..696ef1d56b4f 100644
    100 --- a/drivers/char/tpm/tpm_tis.c
    101 +++ b/drivers/char/tpm/tpm_tis.c
    102 @@ -1,6 +1,6 @@
    103 /*
    104 * Copyright (C) 2005, 2006 IBM Corporation
    105 - * Copyright (C) 2014 Intel Corporation
    106 + * Copyright (C) 2014, 2015 Intel Corporation
    107 *
    108 * Authors:
    109 * Leendert van Doorn <leendert@watson.ibm.com>
    110 @@ -28,6 +28,7 @@
    111 #include <linux/wait.h>
    112 #include <linux/acpi.h>
    113 #include <linux/freezer.h>
    114 +#include <acpi/actbl2.h>
    115 #include "tpm.h"
    116
    117 enum tis_access {
    118 @@ -65,6 +66,17 @@ enum tis_defaults {
    119 TIS_LONG_TIMEOUT = 2000, /* 2 sec */
    120 };
    121
    122 +struct tpm_info {
    123 + unsigned long start;
    124 + unsigned long len;
    125 + unsigned int irq;
    126 +};
    127 +
    128 +static struct tpm_info tis_default_info = {
    129 + .start = TIS_MEM_BASE,
    130 + .len = TIS_MEM_LEN,
    131 + .irq = 0,
    132 +};
    133
    134 /* Some timeout values are needed before it is known whether the chip is
    135 * TPM 1.0 or TPM 2.0.
    136 @@ -91,26 +103,54 @@ struct priv_data {
    137 };
    138
    139 #if defined(CONFIG_PNP) && defined(CONFIG_ACPI)
    140 -static int is_itpm(struct pnp_dev *dev)
    141 +static int has_hid(struct acpi_device *dev, const char *hid)
    142 {
    143 - struct acpi_device *acpi = pnp_acpi_device(dev);
    144 struct acpi_hardware_id *id;
    145
    146 - if (!acpi)
    147 - return 0;
    148 -
    149 - list_for_each_entry(id, &acpi->pnp.ids, list) {
    150 - if (!strcmp("INTC0102", id->id))
    151 + list_for_each_entry(id, &dev->pnp.ids, list)
    152 + if (!strcmp(hid, id->id))
    153 return 1;
    154 - }
    155
    156 return 0;
    157 }
    158 +
    159 +static inline int is_itpm(struct acpi_device *dev)
    160 +{
    161 + return has_hid(dev, "INTC0102");
    162 +}
    163 +
    164 +static inline int is_fifo(struct acpi_device *dev)
    165 +{
    166 + struct acpi_table_tpm2 *tbl;
    167 + acpi_status st;
    168 +
    169 + /* TPM 1.2 FIFO */
    170 + if (!has_hid(dev, "MSFT0101"))
    171 + return 1;
    172 +
    173 + st = acpi_get_table(ACPI_SIG_TPM2, 1,
    174 + (struct acpi_table_header **) &tbl);
    175 + if (ACPI_FAILURE(st)) {
    176 + dev_err(&dev->dev, "failed to get TPM2 ACPI table\n");
    177 + return 0;
    178 + }
    179 +
    180 + if (le32_to_cpu(tbl->start_method) != TPM2_START_FIFO)
    181 + return 0;
    182 +
    183 + /* TPM 2.0 FIFO */
    184 + return 1;
    185 +}
    186 #else
    187 -static inline int is_itpm(struct pnp_dev *dev)
    188 +static inline int is_itpm(struct acpi_device *dev)
    189 {
    190 return 0;
    191 }
    192 +
    193 +static inline int is_fifo(struct acpi_device *dev)
    194 +{
    195 + return 1;
    196 +}
    197 #endif
    198
    199 /* Before we attempt to access the TPM we must see that the valid bit is set.
    200 @@ -600,9 +640,8 @@ static void tpm_tis_remove(struct tpm_chip *chip)
    201 release_locality(chip, chip->vendor.locality, 1);
    202 }
    203
    204 -static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle,
    205 - resource_size_t start, resource_size_t len,
    206 - unsigned int irq)
    207 +static int tpm_tis_init(struct device *dev, struct tpm_info *tpm_info,
    208 + acpi_handle acpi_dev_handle)
    209 {
    210 u32 vendor, intfcaps, intmask;
    211 int rc, i, irq_s, irq_e, probe;
    212 @@ -622,7 +661,7 @@ static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle,
    213 chip->acpi_dev_handle = acpi_dev_handle;
    214 #endif
    215
    216 - chip->vendor.iobase = devm_ioremap(dev, start, len);
    217 + chip->vendor.iobase = devm_ioremap(dev, tpm_info->start, tpm_info->len);
    218 if (!chip->vendor.iobase)
    219 return -EIO;
    220
    221 @@ -707,7 +746,7 @@ static int tpm_tis_init(struct device *dev, acpi_handle acpi_dev_handle,
    222 chip->vendor.iobase +
    223 TPM_INT_ENABLE(chip->vendor.locality));
    224 if (interrupts)
    225 - chip->vendor.irq = irq;
    226 + chip->vendor.irq = tpm_info->irq;
    227 if (interrupts && !chip->vendor.irq) {
    228 irq_s =
    229 ioread8(chip->vendor.iobase +
    230 @@ -890,27 +929,27 @@ static SIMPLE_DEV_PM_OPS(tpm_tis_pm, tpm_pm_suspend, tpm_tis_resume);
    231 static int tpm_tis_pnp_init(struct pnp_dev *pnp_dev,
    232 const struct pnp_device_id *pnp_id)
    233 {
    234 - resource_size_t start, len;
    235 - unsigned int irq = 0;
    236 + struct tpm_info tpm_info = tis_default_info;
    237 acpi_handle acpi_dev_handle = NULL;
    238
    239 - start = pnp_mem_start(pnp_dev, 0);
    240 - len = pnp_mem_len(pnp_dev, 0);
    241 + tpm_info.start = pnp_mem_start(pnp_dev, 0);
    242 + tpm_info.len = pnp_mem_len(pnp_dev, 0);
    243
    244 if (pnp_irq_valid(pnp_dev, 0))
    245 - irq = pnp_irq(pnp_dev, 0);
    246 + tpm_info.irq = pnp_irq(pnp_dev, 0);
    247 else
    248 interrupts = false;
    249
    250 - if (is_itpm(pnp_dev))
    251 - itpm = true;
    252 -
    253 #ifdef CONFIG_ACPI
    254 - if (pnp_acpi_device(pnp_dev))
    255 + if (pnp_acpi_device(pnp_dev)) {
    256 + if (is_itpm(pnp_acpi_device(pnp_dev)))
    257 + itpm = true;
    258 +
    259 acpi_dev_handle = pnp_acpi_device(pnp_dev)->handle;
    260 + }
    261 #endif
    262
    263 - return tpm_tis_init(&pnp_dev->dev, acpi_dev_handle, start, len, irq);
    264 + return tpm_tis_init(&pnp_dev->dev, &tpm_info, acpi_dev_handle);
    265 }
    266
    267 static struct pnp_device_id tpm_pnp_tbl[] = {
    268 @@ -930,6 +969,7 @@ MODULE_DEVICE_TABLE(pnp, tpm_pnp_tbl);
    269 static void tpm_tis_pnp_remove(struct pnp_dev *dev)
    270 {
    271 struct tpm_chip *chip = pnp_get_drvdata(dev);
    272 +
    273 tpm_chip_unregister(chip);
    274 tpm_tis_remove(chip);
    275 }
    276 @@ -950,6 +990,79 @@ module_param_string(hid, tpm_pnp_tbl[TIS_HID_USR_IDX].id,
    277 MODULE_PARM_DESC(hid, "Set additional specific HID for this driver to probe");
    278 #endif
    279
    280 +#ifdef CONFIG_ACPI
    281 +static int tpm_check_resource(struct acpi_resource *ares, void *data)
    282 +{
    283 + struct tpm_info *tpm_info = (struct tpm_info *) data;
    284 + struct resource res;
    285 +
    286 + if (acpi_dev_resource_interrupt(ares, 0, &res)) {
    287 + tpm_info->irq = res.start;
    288 + } else if (acpi_dev_resource_memory(ares, &res)) {
    289 + tpm_info->start = res.start;
    290 + tpm_info->len = resource_size(&res);
    291 + }
    292 +
    293 + return 1;
    294 +}
    295 +
    296 +static int tpm_tis_acpi_init(struct acpi_device *acpi_dev)
    297 +{
    298 + struct list_head resources;
    299 + struct tpm_info tpm_info = tis_default_info;
    300 + int ret;
    301 +
    302 + if (!is_fifo(acpi_dev))
    303 + return -ENODEV;
    304 +
    305 + INIT_LIST_HEAD(&resources);
    306 + ret = acpi_dev_get_resources(acpi_dev, &resources, tpm_check_resource,
    307 + &tpm_info);
    308 + if (ret < 0)
    309 + return ret;
    310 +
    311 + acpi_dev_free_resource_list(&resources);
    312 +
    313 + if (!tpm_info.irq)
    314 + interrupts = false;
    315 +
    316 + if (is_itpm(acpi_dev))
    317 + itpm = true;
    318 +
    319 + return tpm_tis_init(&acpi_dev->dev, &tpm_info, acpi_dev->handle);
    320 +}
    321 +
    322 +static int tpm_tis_acpi_remove(struct acpi_device *dev)
    323 +{
    324 + struct tpm_chip *chip = dev_get_drvdata(&dev->dev);
    325 +
    326 + tpm_chip_unregister(chip);
    327 + tpm_tis_remove(chip);
    328 +
    329 + return 0;
    330 +}
    331 +
    332 +static struct acpi_device_id tpm_acpi_tbl[] = {
    333 + {"MSFT0101", 0}, /* TPM 2.0 */
    334 + /* Add new here */
    335 + {"", 0}, /* User Specified */
    336 + {"", 0} /* Terminator */
    337 +};
    338 +MODULE_DEVICE_TABLE(acpi, tpm_acpi_tbl);
    339 +
    340 +static struct acpi_driver tis_acpi_driver = {
    341 + .name = "tpm_tis",
    342 + .ids = tpm_acpi_tbl,
    343 + .ops = {
    344 + .add = tpm_tis_acpi_init,
    345 + .remove = tpm_tis_acpi_remove,
    346 + },
    347 + .drv = {
    348 + .pm = &tpm_tis_pm,
    349 + },
    350 +};
    351 +#endif
    352 +
    353 static struct platform_driver tis_drv = {
    354 .driver = {
    355 .name = "tpm_tis",
    356 @@ -966,9 +1079,25 @@ static int __init init_tis(void)
    357 {
    358 int rc;
    359 #ifdef CONFIG_PNP
    360 - if (!force)
    361 - return pnp_register_driver(&tis_pnp_driver);
    362 + if (!force) {
    363 + rc = pnp_register_driver(&tis_pnp_driver);
    364 + if (rc)
    365 + return rc;
    366 + }
    367 +#endif
    368 +#ifdef CONFIG_ACPI
    369 + if (!force) {
    370 + rc = acpi_bus_register_driver(&tis_acpi_driver);
    371 + if (rc) {
    372 +#ifdef CONFIG_PNP
    373 + pnp_unregister_driver(&tis_pnp_driver);
    374 #endif
    375 + return rc;
    376 + }
    377 + }
    378 +#endif
    379 + if (!force)
    380 + return 0;
    381
    382 rc = platform_driver_register(&tis_drv);
    383 if (rc < 0)
    384 @@ -978,7 +1107,7 @@ static int __init init_tis(void)
    385 rc = PTR_ERR(pdev);
    386 goto err_dev;
    387 }
    388 - rc = tpm_tis_init(&pdev->dev, NULL, TIS_MEM_BASE, TIS_MEM_LEN, 0);
    389 + rc = tpm_tis_init(&pdev->dev, &tis_default_info, NULL);
    390 if (rc)
    391 goto err_init;
    392 return 0;
    393 @@ -992,9 +1121,14 @@ err_dev:
    394 static void __exit cleanup_tis(void)
    395 {
    396 struct tpm_chip *chip;
    397 -#ifdef CONFIG_PNP
    398 +#if defined(CONFIG_PNP) || defined(CONFIG_ACPI)
    399 if (!force) {
    400 +#ifdef CONFIG_ACPI
    401 + acpi_bus_unregister_driver(&tis_acpi_driver);
    402 +#endif
    403 +#ifdef CONFIG_PNP
    404 pnp_unregister_driver(&tis_pnp_driver);
    405 +#endif
    406 return;
    407 }
    408 #endif
    409 diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
    410 index 932bd1862f7a..6e9036a06515 100644
    411 --- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
    412 +++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
    413 @@ -1014,13 +1014,12 @@ static int atl1c_setup_ring_resources(struct atl1c_adapter *adapter)
    414 sizeof(struct atl1c_recv_ret_status) * rx_desc_count +
    415 8 * 4;
    416
    417 - ring_header->desc = pci_alloc_consistent(pdev, ring_header->size,
    418 - &ring_header->dma);
    419 + ring_header->desc = dma_zalloc_coherent(&pdev->dev, ring_header->size,
    420 + &ring_header->dma, GFP_KERNEL);
    421 if (unlikely(!ring_header->desc)) {
    422 - dev_err(&pdev->dev, "pci_alloc_consistend failed\n");
    423 + dev_err(&pdev->dev, "could not get memory for DMA buffer\n");
    424 goto err_nomem;
    425 }
    426 - memset(ring_header->desc, 0, ring_header->size);
    427 /* init TPD ring */
    428
    429 tpd_ring[0].dma = roundup(ring_header->dma, 8);
    430 diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
    431 index 6af028d5f9bc..97e4df9bf407 100644
    432 --- a/drivers/net/ethernet/qualcomm/qca_spi.c
    433 +++ b/drivers/net/ethernet/qualcomm/qca_spi.c
    434 @@ -736,9 +736,8 @@ qcaspi_netdev_tx_timeout(struct net_device *dev)
    435 netdev_info(qca->net_dev, "Transmit timeout at %ld, latency %ld\n",
    436 jiffies, jiffies - dev->trans_start);
    437 qca->net_dev->stats.tx_errors++;
    438 - /* wake the queue if there is room */
    439 - if (qcaspi_tx_ring_has_space(&qca->txr))
    440 - netif_wake_queue(dev);
    441 + /* Trigger tx queue flush and QCA7000 reset */
    442 + qca->sync = QCASPI_SYNC_UNKNOWN;
    443 }
    444
    445 static int
    446 diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
    447 index 7fb244f565b2..13463c4acc86 100644
    448 --- a/drivers/net/ethernet/renesas/sh_eth.c
    449 +++ b/drivers/net/ethernet/renesas/sh_eth.c
    450 @@ -1481,6 +1481,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
    451 if (mdp->cd->shift_rd0)
    452 desc_status >>= 16;
    453
    454 + skb = mdp->rx_skbuff[entry];
    455 if (desc_status & (RD_RFS1 | RD_RFS2 | RD_RFS3 | RD_RFS4 |
    456 RD_RFS5 | RD_RFS6 | RD_RFS10)) {
    457 ndev->stats.rx_errors++;
    458 @@ -1496,12 +1497,11 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
    459 ndev->stats.rx_missed_errors++;
    460 if (desc_status & RD_RFS10)
    461 ndev->stats.rx_over_errors++;
    462 - } else {
    463 + } else if (skb) {
    464 if (!mdp->cd->hw_swap)
    465 sh_eth_soft_swap(
    466 phys_to_virt(ALIGN(rxdesc->addr, 4)),
    467 pkt_len + 2);
    468 - skb = mdp->rx_skbuff[entry];
    469 mdp->rx_skbuff[entry] = NULL;
    470 if (mdp->cd->rpadir)
    471 skb_reserve(skb, NET_IP_ALIGN);
    472 diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
    473 index ab33262ed826..9c8fabed4444 100644
    474 --- a/drivers/net/ppp/pppoe.c
    475 +++ b/drivers/net/ppp/pppoe.c
    476 @@ -568,6 +568,9 @@ static int pppoe_create(struct net *net, struct socket *sock)
    477 sk->sk_family = PF_PPPOX;
    478 sk->sk_protocol = PX_PROTO_OE;
    479
    480 + INIT_WORK(&pppox_sk(sk)->proto.pppoe.padt_work,
    481 + pppoe_unbind_sock_work);
    482 +
    483 return 0;
    484 }
    485
    486 @@ -632,8 +635,6 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
    487
    488 lock_sock(sk);
    489
    490 - INIT_WORK(&po->proto.pppoe.padt_work, pppoe_unbind_sock_work);
    491 -
    492 error = -EINVAL;
    493 if (sp->sa_protocol != PX_PROTO_OE)
    494 goto end;
    495 @@ -663,8 +664,13 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr,
    496 po->pppoe_dev = NULL;
    497 }
    498
    499 - memset(sk_pppox(po) + 1, 0,
    500 - sizeof(struct pppox_sock) - sizeof(struct sock));
    501 + po->pppoe_ifindex = 0;
    502 + memset(&po->pppoe_pa, 0, sizeof(po->pppoe_pa));
    503 + memset(&po->pppoe_relay, 0, sizeof(po->pppoe_relay));
    504 + memset(&po->chan, 0, sizeof(po->chan));
    505 + po->next = NULL;
    506 + po->num = 0;
    507 +
    508 sk->sk_state = PPPOX_NONE;
    509 }
    510
    511 diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
    512 index e3bfbd4d0136..0bacabfa486e 100644
    513 --- a/drivers/net/ppp/pptp.c
    514 +++ b/drivers/net/ppp/pptp.c
    515 @@ -420,6 +420,9 @@ static int pptp_bind(struct socket *sock, struct sockaddr *uservaddr,
    516 struct pptp_opt *opt = &po->proto.pptp;
    517 int error = 0;
    518
    519 + if (sockaddr_len < sizeof(struct sockaddr_pppox))
    520 + return -EINVAL;
    521 +
    522 lock_sock(sk);
    523
    524 opt->src_addr = sp->sa_addr.pptp;
    525 @@ -441,6 +444,9 @@ static int pptp_connect(struct socket *sock, struct sockaddr *uservaddr,
    526 struct flowi4 fl4;
    527 int error = 0;
    528
    529 + if (sockaddr_len < sizeof(struct sockaddr_pppox))
    530 + return -EINVAL;
    531 +
    532 if (sp->sa_protocol != PX_PROTO_PPTP)
    533 return -EINVAL;
    534
    535 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
    536 index aafa1a1898e4..ce6fad1c43e6 100644
    537 --- a/drivers/net/usb/r8152.c
    538 +++ b/drivers/net/usb/r8152.c
    539 @@ -3006,17 +3006,6 @@ static int rtl8152_open(struct net_device *netdev)
    540
    541 mutex_lock(&tp->control);
    542
    543 - /* The WORK_ENABLE may be set when autoresume occurs */
    544 - if (test_bit(WORK_ENABLE, &tp->flags)) {
    545 - clear_bit(WORK_ENABLE, &tp->flags);
    546 - usb_kill_urb(tp->intr_urb);
    547 - cancel_delayed_work_sync(&tp->schedule);
    548 -
    549 - /* disable the tx/rx, if the workqueue has enabled them. */
    550 - if (netif_carrier_ok(netdev))
    551 - tp->rtl_ops.disable(tp);
    552 - }
    553 -
    554 tp->rtl_ops.up(tp);
    555
    556 rtl8152_set_speed(tp, AUTONEG_ENABLE,
    557 @@ -3063,12 +3052,6 @@ static int rtl8152_close(struct net_device *netdev)
    558 } else {
    559 mutex_lock(&tp->control);
    560
    561 - /* The autosuspend may have been enabled and wouldn't
    562 - * be disable when autoresume occurs, because the
    563 - * netif_running() would be false.
    564 - */
    565 - rtl_runtime_suspend_enable(tp, false);
    566 -
    567 tp->rtl_ops.down(tp);
    568
    569 mutex_unlock(&tp->control);
    570 @@ -3369,7 +3352,7 @@ static int rtl8152_resume(struct usb_interface *intf)
    571 netif_device_attach(tp->netdev);
    572 }
    573
    574 - if (netif_running(tp->netdev)) {
    575 + if (netif_running(tp->netdev) && tp->netdev->flags & IFF_UP) {
    576 if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
    577 rtl_runtime_suspend_enable(tp, false);
    578 clear_bit(SELECTIVE_SUSPEND, &tp->flags);
    579 @@ -3387,6 +3370,8 @@ static int rtl8152_resume(struct usb_interface *intf)
    580 }
    581 usb_submit_urb(tp->intr_urb, GFP_KERNEL);
    582 } else if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
    583 + if (tp->netdev->flags & IFF_UP)
    584 + rtl_runtime_suspend_enable(tp, false);
    585 clear_bit(SELECTIVE_SUSPEND, &tp->flags);
    586 }
    587
    588 diff --git a/drivers/platform/x86/toshiba_acpi.c b/drivers/platform/x86/toshiba_acpi.c
    589 index 93e54a0f471a..35882dd690a6 100644
    590 --- a/drivers/platform/x86/toshiba_acpi.c
    591 +++ b/drivers/platform/x86/toshiba_acpi.c
    592 @@ -2764,6 +2764,7 @@ static int toshiba_acpi_add(struct acpi_device *acpi_dev)
    593 ret = toshiba_function_keys_get(dev, &special_functions);
    594 dev->kbd_function_keys_supported = !ret;
    595
    596 + dev->hotkey_event_type = 0;
    597 if (toshiba_acpi_setup_keyboard(dev))
    598 pr_info("Unable to activate hotkeys\n");
    599
    600 diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
    601 index a086e1d69bc7..0fe15aec7ed0 100644
    602 --- a/drivers/usb/class/cdc-acm.c
    603 +++ b/drivers/usb/class/cdc-acm.c
    604 @@ -1848,6 +1848,11 @@ static const struct usb_device_id acm_ids[] = {
    605 },
    606 #endif
    607
    608 + /* Exclude Infineon Flash Loader utility */
    609 + { USB_DEVICE(0x058b, 0x0041),
    610 + .driver_info = IGNORE_DEVICE,
    611 + },
    612 +
    613 /* control interfaces without any protocol set */
    614 { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
    615 USB_CDC_PROTO_NONE) },
    616 diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
    617 index b9ddf0c1ffe5..894894f2ff93 100644
    618 --- a/drivers/usb/core/config.c
    619 +++ b/drivers/usb/core/config.c
    620 @@ -115,7 +115,8 @@ static void usb_parse_ss_endpoint_companion(struct device *ddev, int cfgno,
    621 USB_SS_MULT(desc->bmAttributes) > 3) {
    622 dev_warn(ddev, "Isoc endpoint has Mult of %d in "
    623 "config %d interface %d altsetting %d ep %d: "
    624 - "setting to 3\n", desc->bmAttributes + 1,
    625 + "setting to 3\n",
    626 + USB_SS_MULT(desc->bmAttributes),
    627 cfgno, inum, asnum, ep->desc.bEndpointAddress);
    628 ep->ss_ep_comp.bmAttributes = 2;
    629 }
    630 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
    631 index 1e9a8c9aa531..d68c4a4db682 100644
    632 --- a/drivers/usb/core/hub.c
    633 +++ b/drivers/usb/core/hub.c
    634 @@ -124,6 +124,10 @@ struct usb_hub *usb_hub_to_struct_hub(struct usb_device *hdev)
    635
    636 int usb_device_supports_lpm(struct usb_device *udev)
    637 {
    638 + /* Some devices have trouble with LPM */
    639 + if (udev->quirks & USB_QUIRK_NO_LPM)
    640 + return 0;
    641 +
    642 /* USB 2.1 (and greater) devices indicate LPM support through
    643 * their USB 2.0 Extended Capabilities BOS descriptor.
    644 */
    645 @@ -4493,6 +4497,8 @@ hub_port_init (struct usb_hub *hub, struct usb_device *udev, int port1,
    646 goto fail;
    647 }
    648
    649 + usb_detect_quirks(udev);
    650 +
    651 if (udev->wusb == 0 && le16_to_cpu(udev->descriptor.bcdUSB) >= 0x0201) {
    652 retval = usb_get_bos_descriptor(udev);
    653 if (!retval) {
    654 @@ -4691,7 +4697,6 @@ static void hub_port_connect(struct usb_hub *hub, int port1, u16 portstatus,
    655 if (status < 0)
    656 goto loop;
    657
    658 - usb_detect_quirks(udev);
    659 if (udev->quirks & USB_QUIRK_DELAY_INIT)
    660 msleep(1000);
    661
    662 @@ -5307,9 +5312,6 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
    663 if (udev->usb2_hw_lpm_enabled == 1)
    664 usb_set_usb2_hardware_lpm(udev, 0);
    665
    666 - bos = udev->bos;
    667 - udev->bos = NULL;
    668 -
    669 /* Disable LPM and LTM while we reset the device and reinstall the alt
    670 * settings. Device-initiated LPM settings, and system exit latency
    671 * settings are cleared when the device is reset, so we have to set
    672 @@ -5318,15 +5320,18 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
    673 ret = usb_unlocked_disable_lpm(udev);
    674 if (ret) {
    675 dev_err(&udev->dev, "%s Failed to disable LPM\n.", __func__);
    676 - goto re_enumerate;
    677 + goto re_enumerate_no_bos;
    678 }
    679 ret = usb_disable_ltm(udev);
    680 if (ret) {
    681 dev_err(&udev->dev, "%s Failed to disable LTM\n.",
    682 __func__);
    683 - goto re_enumerate;
    684 + goto re_enumerate_no_bos;
    685 }
    686
    687 + bos = udev->bos;
    688 + udev->bos = NULL;
    689 +
    690 for (i = 0; i < SET_CONFIG_TRIES; ++i) {
    691
    692 /* ep0 maxpacket size may change; let the HCD know about it.
    693 @@ -5423,10 +5428,11 @@ done:
    694 return 0;
    695
    696 re_enumerate:
    697 - /* LPM state doesn't matter when we're about to destroy the device. */
    698 - hub_port_logical_disconnect(parent_hub, port1);
    699 usb_release_bos_descriptor(udev);
    700 udev->bos = bos;
    701 +re_enumerate_no_bos:
    702 + /* LPM state doesn't matter when we're about to destroy the device. */
    703 + hub_port_logical_disconnect(parent_hub, port1);
    704 return -ENODEV;
    705 }
    706
    707 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    708 index f5a381945db2..017c1de53aa5 100644
    709 --- a/drivers/usb/core/quirks.c
    710 +++ b/drivers/usb/core/quirks.c
    711 @@ -199,6 +199,12 @@ static const struct usb_device_id usb_quirk_list[] = {
    712 { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
    713 USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
    714
    715 + /* Blackmagic Design Intensity Shuttle */
    716 + { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
    717 +
    718 + /* Blackmagic Design UltraStudio SDI */
    719 + { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
    720 +
    721 { } /* terminating entry must be last */
    722 };
    723
    724 diff --git a/drivers/usb/gadget/udc/pxa27x_udc.c b/drivers/usb/gadget/udc/pxa27x_udc.c
    725 index b51226abade6..7a454708e948 100644
    726 --- a/drivers/usb/gadget/udc/pxa27x_udc.c
    727 +++ b/drivers/usb/gadget/udc/pxa27x_udc.c
    728 @@ -2535,6 +2535,9 @@ static int pxa_udc_suspend(struct platform_device *_dev, pm_message_t state)
    729 udc->pullup_resume = udc->pullup_on;
    730 dplus_pullup(udc, 0);
    731
    732 + if (udc->driver)
    733 + udc->driver->disconnect(&udc->gadget);
    734 +
    735 return 0;
    736 }
    737
    738 diff --git a/drivers/usb/host/whci/qset.c b/drivers/usb/host/whci/qset.c
    739 index dc31c425ce01..9f1c0538b211 100644
    740 --- a/drivers/usb/host/whci/qset.c
    741 +++ b/drivers/usb/host/whci/qset.c
    742 @@ -377,6 +377,10 @@ static int qset_fill_page_list(struct whc *whc, struct whc_std *std, gfp_t mem_f
    743 if (std->pl_virt == NULL)
    744 return -ENOMEM;
    745 std->dma_addr = dma_map_single(whc->wusbhc.dev, std->pl_virt, pl_len, DMA_TO_DEVICE);
    746 + if (dma_mapping_error(whc->wusbhc.dev, std->dma_addr)) {
    747 + kfree(std->pl_virt);
    748 + return -EFAULT;
    749 + }
    750
    751 for (p = 0; p < std->num_pointers; p++) {
    752 std->pl_virt[p].buf_ptr = cpu_to_le64(dma_addr);
    753 diff --git a/drivers/usb/musb/Kconfig b/drivers/usb/musb/Kconfig
    754 index 39db8b603627..d1b9e0c7fb0d 100644
    755 --- a/drivers/usb/musb/Kconfig
    756 +++ b/drivers/usb/musb/Kconfig
    757 @@ -147,7 +147,7 @@ config USB_TI_CPPI_DMA
    758
    759 config USB_TI_CPPI41_DMA
    760 bool 'TI CPPI 4.1 (AM335x)'
    761 - depends on ARCH_OMAP
    762 + depends on ARCH_OMAP && DMADEVICES
    763 select TI_CPPI41
    764
    765 config USB_TUSB_OMAP_DMA
    766 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    767 index eac7ccaa3c85..7d4f51a32e66 100644
    768 --- a/drivers/usb/serial/cp210x.c
    769 +++ b/drivers/usb/serial/cp210x.c
    770 @@ -132,7 +132,6 @@ static const struct usb_device_id id_table[] = {
    771 { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
    772 { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
    773 { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
    774 - { USB_DEVICE(0x10C4, 0xEA80) }, /* Silicon Labs factory default */
    775 { USB_DEVICE(0x10C4, 0xEA71) }, /* Infinity GPS-MIC-1 Radio Monophone */
    776 { USB_DEVICE(0x10C4, 0xF001) }, /* Elan Digital Systems USBscope50 */
    777 { USB_DEVICE(0x10C4, 0xF002) }, /* Elan Digital Systems USBwave12 */
    778 diff --git a/drivers/usb/serial/usb-serial-simple.c b/drivers/usb/serial/usb-serial-simple.c
    779 index 3658662898fc..a204782ae530 100644
    780 --- a/drivers/usb/serial/usb-serial-simple.c
    781 +++ b/drivers/usb/serial/usb-serial-simple.c
    782 @@ -53,6 +53,7 @@ DEVICE(funsoft, FUNSOFT_IDS);
    783
    784 /* Infineon Flashloader driver */
    785 #define FLASHLOADER_IDS() \
    786 + { USB_DEVICE_INTERFACE_CLASS(0x058b, 0x0041, USB_CLASS_CDC_DATA) }, \
    787 { USB_DEVICE(0x8087, 0x0716) }
    788 DEVICE(flashloader, FLASHLOADER_IDS);
    789
    790 diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
    791 index 6d3122afeed3..75e4979e6c15 100644
    792 --- a/drivers/usb/storage/uas.c
    793 +++ b/drivers/usb/storage/uas.c
    794 @@ -796,6 +796,10 @@ static int uas_slave_configure(struct scsi_device *sdev)
    795 if (devinfo->flags & US_FL_NO_REPORT_OPCODES)
    796 sdev->no_report_opcodes = 1;
    797
    798 + /* A few buggy USB-ATA bridges don't understand FUA */
    799 + if (devinfo->flags & US_FL_BROKEN_FUA)
    800 + sdev->broken_fua = 1;
    801 +
    802 scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
    803 return 0;
    804 }
    805 diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    806 index 87898ca2ed17..4095824c8c6d 100644
    807 --- a/drivers/usb/storage/unusual_devs.h
    808 +++ b/drivers/usb/storage/unusual_devs.h
    809 @@ -1987,7 +1987,7 @@ UNUSUAL_DEV( 0x14cd, 0x6600, 0x0201, 0x0201,
    810 US_FL_IGNORE_RESIDUE ),
    811
    812 /* Reported by Michael Büsch <m@bues.ch> */
    813 -UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0114,
    814 +UNUSUAL_DEV( 0x152d, 0x0567, 0x0114, 0x0116,
    815 "JMicron",
    816 "USB to ATA/ATAPI Bridge",
    817 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    818 diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
    819 index c85ea530085f..ccc113e83d88 100644
    820 --- a/drivers/usb/storage/unusual_uas.h
    821 +++ b/drivers/usb/storage/unusual_uas.h
    822 @@ -132,7 +132,7 @@ UNUSUAL_DEV(0x152d, 0x0567, 0x0000, 0x9999,
    823 "JMicron",
    824 "JMS567",
    825 USB_SC_DEVICE, USB_PR_DEVICE, NULL,
    826 - US_FL_NO_REPORT_OPCODES),
    827 + US_FL_BROKEN_FUA | US_FL_NO_REPORT_OPCODES),
    828
    829 /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
    830 UNUSUAL_DEV(0x2109, 0x0711, 0x0000, 0x9999,
    831 diff --git a/include/linux/usb/quirks.h b/include/linux/usb/quirks.h
    832 index 9948c874e3f1..1d0043dc34e4 100644
    833 --- a/include/linux/usb/quirks.h
    834 +++ b/include/linux/usb/quirks.h
    835 @@ -47,4 +47,7 @@
    836 /* device generates spurious wakeup, ignore remote wakeup capability */
    837 #define USB_QUIRK_IGNORE_REMOTE_WAKEUP BIT(9)
    838
    839 +/* device can't handle Link Power Management */
    840 +#define USB_QUIRK_NO_LPM BIT(10)
    841 +
    842 #endif /* __LINUX_USB_QUIRKS_H */
    843 diff --git a/include/net/dst.h b/include/net/dst.h
    844 index 0fb99a26e973..182b812d45e1 100644
    845 --- a/include/net/dst.h
    846 +++ b/include/net/dst.h
    847 @@ -312,6 +312,39 @@ static inline void skb_dst_force(struct sk_buff *skb)
    848 }
    849 }
    850
    851 +/**
    852 + * dst_hold_safe - Take a reference on a dst if possible
    853 + * @dst: pointer to dst entry
    854 + *
    855 + * This helper returns false if it could not safely
    856 + * take a reference on a dst.
    857 + */
    858 +static inline bool dst_hold_safe(struct dst_entry *dst)
    859 +{
    860 + if (dst->flags & DST_NOCACHE)
    861 + return atomic_inc_not_zero(&dst->__refcnt);
    862 + dst_hold(dst);
    863 + return true;
    864 +}
    865 +
    866 +/**
    867 + * skb_dst_force_safe - makes sure skb dst is refcounted
    868 + * @skb: buffer
    869 + *
    870 + * If dst is not yet refcounted and not destroyed, grab a ref on it.
    871 + */
    872 +static inline void skb_dst_force_safe(struct sk_buff *skb)
    873 +{
    874 + if (skb_dst_is_noref(skb)) {
    875 + struct dst_entry *dst = skb_dst(skb);
    876 +
    877 + if (!dst_hold_safe(dst))
    878 + dst = NULL;
    879 +
    880 + skb->_skb_refdst = (unsigned long)dst;
    881 + }
    882 +}
    883 +
    884
    885 /**
    886 * __skb_tunnel_rx - prepare skb for rx reinsert
    887 diff --git a/include/net/sock.h b/include/net/sock.h
    888 index ed01a012f8d5..4c4b21c00828 100644
    889 --- a/include/net/sock.h
    890 +++ b/include/net/sock.h
    891 @@ -386,6 +386,7 @@ struct sock {
    892 sk_no_check_rx : 1,
    893 sk_userlocks : 4,
    894 sk_protocol : 8,
    895 +#define SK_PROTOCOL_MAX U8_MAX
    896 sk_type : 16;
    897 kmemcheck_bitfield_end(flags);
    898 int sk_wmem_queued;
    899 @@ -722,6 +723,8 @@ enum sock_flags {
    900 SOCK_SELECT_ERR_QUEUE, /* Wake select on error queue */
    901 };
    902
    903 +#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
    904 +
    905 static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
    906 {
    907 nsk->sk_flags = osk->sk_flags;
    908 @@ -796,7 +799,7 @@ void sk_stream_write_space(struct sock *sk);
    909 static inline void __sk_add_backlog(struct sock *sk, struct sk_buff *skb)
    910 {
    911 /* dont let skb dst not refcounted, we are going to leave rcu lock */
    912 - skb_dst_force(skb);
    913 + skb_dst_force_safe(skb);
    914
    915 if (!sk->sk_backlog.tail)
    916 sk->sk_backlog.head = skb;
    917 diff --git a/include/net/vxlan.h b/include/net/vxlan.h
    918 index 0082b5d33d7d..7ef9272a405a 100644
    919 --- a/include/net/vxlan.h
    920 +++ b/include/net/vxlan.h
    921 @@ -78,7 +78,7 @@ struct vxlanhdr {
    922 };
    923
    924 /* VXLAN header flags. */
    925 -#define VXLAN_HF_RCO BIT(24)
    926 +#define VXLAN_HF_RCO BIT(21)
    927 #define VXLAN_HF_VNI BIT(27)
    928 #define VXLAN_HF_GBP BIT(31)
    929
    930 diff --git a/lib/rhashtable.c b/lib/rhashtable.c
    931 index cf910e48f8f2..5b17447efa8b 100644
    932 --- a/lib/rhashtable.c
    933 +++ b/lib/rhashtable.c
    934 @@ -506,10 +506,11 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
    935 if (!iter->walker)
    936 return -ENOMEM;
    937
    938 - mutex_lock(&ht->mutex);
    939 - iter->walker->tbl = rht_dereference(ht->tbl, ht);
    940 + spin_lock(&ht->lock);
    941 + iter->walker->tbl =
    942 + rcu_dereference_protected(ht->tbl, lockdep_is_held(&ht->lock));
    943 list_add(&iter->walker->list, &iter->walker->tbl->walkers);
    944 - mutex_unlock(&ht->mutex);
    945 + spin_unlock(&ht->lock);
    946
    947 return 0;
    948 }
    949 @@ -523,10 +524,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
    950 */
    951 void rhashtable_walk_exit(struct rhashtable_iter *iter)
    952 {
    953 - mutex_lock(&iter->ht->mutex);
    954 + spin_lock(&iter->ht->lock);
    955 if (iter->walker->tbl)
    956 list_del(&iter->walker->list);
    957 - mutex_unlock(&iter->ht->mutex);
    958 + spin_unlock(&iter->ht->lock);
    959 kfree(iter->walker);
    960 }
    961 EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
    962 @@ -550,14 +551,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter)
    963 {
    964 struct rhashtable *ht = iter->ht;
    965
    966 - mutex_lock(&ht->mutex);
    967 + rcu_read_lock();
    968
    969 + spin_lock(&ht->lock);
    970 if (iter->walker->tbl)
    971 list_del(&iter->walker->list);
    972 -
    973 - rcu_read_lock();
    974 -
    975 - mutex_unlock(&ht->mutex);
    976 + spin_unlock(&ht->lock);
    977
    978 if (!iter->walker->tbl) {
    979 iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);
    980 @@ -730,9 +729,6 @@ int rhashtable_init(struct rhashtable *ht,
    981 if (params->nulls_base && params->nulls_base < (1U << RHT_BASE_SHIFT))
    982 return -EINVAL;
    983
    984 - if (params->nelem_hint)
    985 - size = rounded_hashtable_size(params);
    986 -
    987 memset(ht, 0, sizeof(*ht));
    988 mutex_init(&ht->mutex);
    989 spin_lock_init(&ht->lock);
    990 @@ -752,6 +748,9 @@ int rhashtable_init(struct rhashtable *ht,
    991
    992 ht->p.min_size = max(ht->p.min_size, HASH_MIN_SIZE);
    993
    994 + if (params->nelem_hint)
    995 + size = rounded_hashtable_size(&ht->p);
    996 +
    997 /* The maximum (not average) chain length grows with the
    998 * size of the hash table, at a rate of (log N)/(log log N).
    999 * The value of 16 is selected so that even if the hash
    1000 diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    1001 index 330c1f4a5a0b..a64884bbf0ce 100644
    1002 --- a/net/ax25/af_ax25.c
    1003 +++ b/net/ax25/af_ax25.c
    1004 @@ -806,6 +806,9 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
    1005 struct sock *sk;
    1006 ax25_cb *ax25;
    1007
    1008 + if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
    1009 + return -EINVAL;
    1010 +
    1011 if (!net_eq(net, &init_net))
    1012 return -EAFNOSUPPORT;
    1013
    1014 diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
    1015 index 4322c833e748..8611bc7bdd32 100644
    1016 --- a/net/bluetooth/sco.c
    1017 +++ b/net/bluetooth/sco.c
    1018 @@ -520,6 +520,9 @@ static int sco_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_le
    1019 if (!addr || addr->sa_family != AF_BLUETOOTH)
    1020 return -EINVAL;
    1021
    1022 + if (addr_len < sizeof(struct sockaddr_sco))
    1023 + return -EINVAL;
    1024 +
    1025 lock_sock(sk);
    1026
    1027 if (sk->sk_state != BT_OPEN) {
    1028 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    1029 index 075d2e78c87e..2e5fcda16570 100644
    1030 --- a/net/core/skbuff.c
    1031 +++ b/net/core/skbuff.c
    1032 @@ -3661,7 +3661,8 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
    1033 serr->ee.ee_info = tstype;
    1034 if (sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID) {
    1035 serr->ee.ee_data = skb_shinfo(skb)->tskey;
    1036 - if (sk->sk_protocol == IPPROTO_TCP)
    1037 + if (sk->sk_protocol == IPPROTO_TCP &&
    1038 + sk->sk_type == SOCK_STREAM)
    1039 serr->ee.ee_data -= sk->sk_tskey;
    1040 }
    1041
    1042 @@ -4200,7 +4201,8 @@ static struct sk_buff *skb_reorder_vlan_header(struct sk_buff *skb)
    1043 return NULL;
    1044 }
    1045
    1046 - memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN);
    1047 + memmove(skb->data - ETH_HLEN, skb->data - skb->mac_len - VLAN_HLEN,
    1048 + 2 * ETH_ALEN);
    1049 skb->mac_header += VLAN_HLEN;
    1050 return skb;
    1051 }
    1052 diff --git a/net/core/sock.c b/net/core/sock.c
    1053 index dc30dc5bb1b8..47fc8bb3b946 100644
    1054 --- a/net/core/sock.c
    1055 +++ b/net/core/sock.c
    1056 @@ -421,8 +421,6 @@ static void sock_warn_obsolete_bsdism(const char *name)
    1057 }
    1058 }
    1059
    1060 -#define SK_FLAGS_TIMESTAMP ((1UL << SOCK_TIMESTAMP) | (1UL << SOCK_TIMESTAMPING_RX_SOFTWARE))
    1061 -
    1062 static void sock_disable_timestamp(struct sock *sk, unsigned long flags)
    1063 {
    1064 if (sk->sk_flags & flags) {
    1065 @@ -861,7 +859,8 @@ set_rcvbuf:
    1066
    1067 if (val & SOF_TIMESTAMPING_OPT_ID &&
    1068 !(sk->sk_tsflags & SOF_TIMESTAMPING_OPT_ID)) {
    1069 - if (sk->sk_protocol == IPPROTO_TCP) {
    1070 + if (sk->sk_protocol == IPPROTO_TCP &&
    1071 + sk->sk_type == SOCK_STREAM) {
    1072 if (sk->sk_state != TCP_ESTABLISHED) {
    1073 ret = -EINVAL;
    1074 break;
    1075 diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
    1076 index 754484b3cd0e..2783c538ec19 100644
    1077 --- a/net/decnet/af_decnet.c
    1078 +++ b/net/decnet/af_decnet.c
    1079 @@ -678,6 +678,9 @@ static int dn_create(struct net *net, struct socket *sock, int protocol,
    1080 {
    1081 struct sock *sk;
    1082
    1083 + if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
    1084 + return -EINVAL;
    1085 +
    1086 if (!net_eq(net, &init_net))
    1087 return -EAFNOSUPPORT;
    1088
    1089 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
    1090 index a5aa54ea6533..0cc98b135b8f 100644
    1091 --- a/net/ipv4/af_inet.c
    1092 +++ b/net/ipv4/af_inet.c
    1093 @@ -259,6 +259,9 @@ static int inet_create(struct net *net, struct socket *sock, int protocol,
    1094 int try_loading_module = 0;
    1095 int err;
    1096
    1097 + if (protocol < 0 || protocol >= IPPROTO_MAX)
    1098 + return -EINVAL;
    1099 +
    1100 sock->state = SS_UNCONNECTED;
    1101
    1102 /* Look for the requested type/protocol pair. */
    1103 diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
    1104 index 34968cd5c146..4b67937692c9 100644
    1105 --- a/net/ipv4/fou.c
    1106 +++ b/net/ipv4/fou.c
    1107 @@ -24,6 +24,7 @@ struct fou {
    1108 u16 type;
    1109 struct udp_offload udp_offloads;
    1110 struct list_head list;
    1111 + struct rcu_head rcu;
    1112 };
    1113
    1114 #define FOU_F_REMCSUM_NOPARTIAL BIT(0)
    1115 @@ -421,7 +422,7 @@ static void fou_release(struct fou *fou)
    1116 list_del(&fou->list);
    1117 udp_tunnel_sock_release(sock);
    1118
    1119 - kfree(fou);
    1120 + kfree_rcu(fou, rcu);
    1121 }
    1122
    1123 static int fou_encap_init(struct sock *sk, struct fou *fou, struct fou_cfg *cfg)
    1124 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
    1125 index 88203e755af8..cd18c3d3251e 100644
    1126 --- a/net/ipv4/tcp_ipv4.c
    1127 +++ b/net/ipv4/tcp_ipv4.c
    1128 @@ -1509,7 +1509,7 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
    1129 if (likely(sk->sk_rx_dst))
    1130 skb_dst_drop(skb);
    1131 else
    1132 - skb_dst_force(skb);
    1133 + skb_dst_force_safe(skb);
    1134
    1135 __skb_queue_tail(&tp->ucopy.prequeue, skb);
    1136 tp->ucopy.memory += skb->truesize;
    1137 @@ -1714,8 +1714,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
    1138 {
    1139 struct dst_entry *dst = skb_dst(skb);
    1140
    1141 - if (dst) {
    1142 - dst_hold(dst);
    1143 + if (dst && dst_hold_safe(dst)) {
    1144 sk->sk_rx_dst = dst;
    1145 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
    1146 }
    1147 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    1148 index 986440b24978..1ea4322c3b0c 100644
    1149 --- a/net/ipv4/tcp_output.c
    1150 +++ b/net/ipv4/tcp_output.c
    1151 @@ -3143,7 +3143,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
    1152 {
    1153 struct tcp_sock *tp = tcp_sk(sk);
    1154 struct tcp_fastopen_request *fo = tp->fastopen_req;
    1155 - int syn_loss = 0, space, err = 0, copied;
    1156 + int syn_loss = 0, space, err = 0;
    1157 unsigned long last_syn_loss = 0;
    1158 struct sk_buff *syn_data;
    1159
    1160 @@ -3181,17 +3181,18 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
    1161 goto fallback;
    1162 syn_data->ip_summed = CHECKSUM_PARTIAL;
    1163 memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
    1164 - copied = copy_from_iter(skb_put(syn_data, space), space,
    1165 - &fo->data->msg_iter);
    1166 - if (unlikely(!copied)) {
    1167 - kfree_skb(syn_data);
    1168 - goto fallback;
    1169 - }
    1170 - if (copied != space) {
    1171 - skb_trim(syn_data, copied);
    1172 - space = copied;
    1173 + if (space) {
    1174 + int copied = copy_from_iter(skb_put(syn_data, space), space,
    1175 + &fo->data->msg_iter);
    1176 + if (unlikely(!copied)) {
    1177 + kfree_skb(syn_data);
    1178 + goto fallback;
    1179 + }
    1180 + if (copied != space) {
    1181 + skb_trim(syn_data, copied);
    1182 + space = copied;
    1183 + }
    1184 }
    1185 -
    1186 /* No more data pending in inet_wait_for_connect() */
    1187 if (space == fo->size)
    1188 fo->data = NULL;
    1189 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    1190 index fd3aa6148dd1..a2d685030a34 100644
    1191 --- a/net/ipv6/addrconf.c
    1192 +++ b/net/ipv6/addrconf.c
    1193 @@ -343,6 +343,12 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
    1194 setup_timer(&ndev->rs_timer, addrconf_rs_timer,
    1195 (unsigned long)ndev);
    1196 memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
    1197 +
    1198 + if (ndev->cnf.stable_secret.initialized)
    1199 + ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_STABLE_PRIVACY;
    1200 + else
    1201 + ndev->addr_gen_mode = IN6_ADDR_GEN_MODE_EUI64;
    1202 +
    1203 ndev->cnf.mtu6 = dev->mtu;
    1204 ndev->cnf.sysctl = NULL;
    1205 ndev->nd_parms = neigh_parms_alloc(dev, &nd_tbl);
    1206 @@ -2384,7 +2390,7 @@ ok:
    1207 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
    1208 if (in6_dev->cnf.optimistic_dad &&
    1209 !net->ipv6.devconf_all->forwarding && sllao)
    1210 - addr_flags = IFA_F_OPTIMISTIC;
    1211 + addr_flags |= IFA_F_OPTIMISTIC;
    1212 #endif
    1213
    1214 /* Do not allow to create too much of autoconfigured
    1215 diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
    1216 index 2d044d2a2ccf..bad62fa5e70f 100644
    1217 --- a/net/ipv6/af_inet6.c
    1218 +++ b/net/ipv6/af_inet6.c
    1219 @@ -109,6 +109,9 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
    1220 int try_loading_module = 0;
    1221 int err;
    1222
    1223 + if (protocol < 0 || protocol >= IPPROTO_MAX)
    1224 + return -EINVAL;
    1225 +
    1226 /* Look for the requested type/protocol pair. */
    1227 lookup_protocol:
    1228 err = -ESOCKTNOSUPPORT;
    1229 diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
    1230 index 69f4f689f06a..76be7d311cc4 100644
    1231 --- a/net/ipv6/ip6_gre.c
    1232 +++ b/net/ipv6/ip6_gre.c
    1233 @@ -1553,13 +1553,11 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
    1234 return -EEXIST;
    1235 } else {
    1236 t = nt;
    1237 -
    1238 - ip6gre_tunnel_unlink(ign, t);
    1239 - ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
    1240 - ip6gre_tunnel_link(ign, t);
    1241 - netdev_state_change(dev);
    1242 }
    1243
    1244 + ip6gre_tunnel_unlink(ign, t);
    1245 + ip6gre_tnl_change(t, &p, !tb[IFLA_MTU]);
    1246 + ip6gre_tunnel_link(ign, t);
    1247 return 0;
    1248 }
    1249
    1250 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    1251 index cfb27f56c62f..c1938ad39f8c 100644
    1252 --- a/net/ipv6/tcp_ipv6.c
    1253 +++ b/net/ipv6/tcp_ipv6.c
    1254 @@ -93,10 +93,9 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
    1255 {
    1256 struct dst_entry *dst = skb_dst(skb);
    1257
    1258 - if (dst) {
    1259 + if (dst && dst_hold_safe(dst)) {
    1260 const struct rt6_info *rt = (const struct rt6_info *)dst;
    1261
    1262 - dst_hold(dst);
    1263 sk->sk_rx_dst = dst;
    1264 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
    1265 if (rt->rt6i_node)
    1266 diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
    1267 index ee0ea25c8e7a..9a1edcde4ba5 100644
    1268 --- a/net/irda/af_irda.c
    1269 +++ b/net/irda/af_irda.c
    1270 @@ -1086,6 +1086,9 @@ static int irda_create(struct net *net, struct socket *sock, int protocol,
    1271 struct sock *sk;
    1272 struct irda_sock *self;
    1273
    1274 + if (protocol < 0 || protocol > SK_PROTOCOL_MAX)
    1275 + return -EINVAL;
    1276 +
    1277 if (net != &init_net)
    1278 return -EAFNOSUPPORT;
    1279
    1280 diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
    1281 index d4b6f3682c14..68c599a5e1d1 100644
    1282 --- a/net/sched/sch_api.c
    1283 +++ b/net/sched/sch_api.c
    1284 @@ -950,7 +950,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
    1285 }
    1286 lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
    1287 if (!netif_is_multiqueue(dev))
    1288 - sch->flags |= TCQ_F_ONETXQUEUE | TCQ_F_NOPARENT;
    1289 + sch->flags |= TCQ_F_ONETXQUEUE;
    1290 }
    1291
    1292 sch->handle = handle;
    1293 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
    1294 index 0e4198ee2370..3267a5cbb3e8 100644
    1295 --- a/net/sctp/ipv6.c
    1296 +++ b/net/sctp/ipv6.c
    1297 @@ -634,6 +634,7 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
    1298 struct sock *newsk;
    1299 struct ipv6_pinfo *newnp, *np = inet6_sk(sk);
    1300 struct sctp6_sock *newsctp6sk;
    1301 + struct ipv6_txoptions *opt;
    1302
    1303 newsk = sk_alloc(sock_net(sk), PF_INET6, GFP_KERNEL, sk->sk_prot);
    1304 if (!newsk)
    1305 @@ -653,6 +654,13 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
    1306
    1307 memcpy(newnp, np, sizeof(struct ipv6_pinfo));
    1308
    1309 + rcu_read_lock();
    1310 + opt = rcu_dereference(np->opt);
    1311 + if (opt)
    1312 + opt = ipv6_dup_options(newsk, opt);
    1313 + RCU_INIT_POINTER(newnp->opt, opt);
    1314 + rcu_read_unlock();
    1315 +
    1316 /* Initialize sk's sport, dport, rcv_saddr and daddr for getsockname()
    1317 * and getpeername().
    1318 */
    1319 diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
    1320 index 06320c8c1c86..83a07d468644 100644
    1321 --- a/net/sctp/sm_make_chunk.c
    1322 +++ b/net/sctp/sm_make_chunk.c
    1323 @@ -1652,7 +1652,7 @@ static sctp_cookie_param_t *sctp_pack_cookie(const struct sctp_endpoint *ep,
    1324
    1325 /* Set an expiration time for the cookie. */
    1326 cookie->c.expiration = ktime_add(asoc->cookie_life,
    1327 - ktime_get());
    1328 + ktime_get_real());
    1329
    1330 /* Copy the peer's init packet. */
    1331 memcpy(&cookie->c.peer_init[0], init_chunk->chunk_hdr,
    1332 @@ -1780,7 +1780,7 @@ no_hmac:
    1333 if (sock_flag(ep->base.sk, SOCK_TIMESTAMP))
    1334 kt = skb_get_ktime(skb);
    1335 else
    1336 - kt = ktime_get();
    1337 + kt = ktime_get_real();
    1338
    1339 if (!asoc && ktime_before(bear_cookie->expiration, kt)) {
    1340 /*
    1341 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
    1342 index 66d796075050..a63c2c87a0c6 100644
    1343 --- a/net/sctp/socket.c
    1344 +++ b/net/sctp/socket.c
    1345 @@ -7175,6 +7175,7 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
    1346 newsk->sk_type = sk->sk_type;
    1347 newsk->sk_bound_dev_if = sk->sk_bound_dev_if;
    1348 newsk->sk_flags = sk->sk_flags;
    1349 + newsk->sk_tsflags = sk->sk_tsflags;
    1350 newsk->sk_no_check_tx = sk->sk_no_check_tx;
    1351 newsk->sk_no_check_rx = sk->sk_no_check_rx;
    1352 newsk->sk_reuse = sk->sk_reuse;
    1353 @@ -7207,6 +7208,9 @@ void sctp_copy_sock(struct sock *newsk, struct sock *sk,
    1354 newinet->mc_ttl = 1;
    1355 newinet->mc_index = 0;
    1356 newinet->mc_list = NULL;
    1357 +
    1358 + if (newsk->sk_flags & SK_FLAGS_TIMESTAMP)
    1359 + net_enable_timestamp();
    1360 }
    1361
    1362 static inline void sctp_copy_descendant(struct sock *sk_to,
    1363 diff --git a/net/socket.c b/net/socket.c
    1364 index 884e32997698..dcbfa868e398 100644
    1365 --- a/net/socket.c
    1366 +++ b/net/socket.c
    1367 @@ -1705,6 +1705,7 @@ SYSCALL_DEFINE6(recvfrom, int, fd, void __user *, ubuf, size_t, size,
    1368 msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
    1369 /* We assume all kernel code knows the size of sockaddr_storage */
    1370 msg.msg_namelen = 0;
    1371 + msg.msg_iocb = NULL;
    1372 if (sock->file->f_flags & O_NONBLOCK)
    1373 flags |= MSG_DONTWAIT;
    1374 err = sock_recvmsg(sock, &msg, iov_iter_count(&msg.msg_iter), flags);
    1375 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
    1376 index 1975fd8d1c10..a398f624c28d 100644
    1377 --- a/net/unix/af_unix.c
    1378 +++ b/net/unix/af_unix.c
    1379 @@ -2072,14 +2072,7 @@ static int unix_stream_recvmsg(struct socket *sock, struct msghdr *msg,
    1380
    1381 memset(&scm, 0, sizeof(scm));
    1382
    1383 - err = mutex_lock_interruptible(&u->readlock);
    1384 - if (unlikely(err)) {
    1385 - /* recvmsg() in non blocking mode is supposed to return -EAGAIN
    1386 - * sk_rcvtimeo is not honored by mutex_lock_interruptible()
    1387 - */
    1388 - err = noblock ? -EAGAIN : -ERESTARTSYS;
    1389 - goto out;
    1390 - }
    1391 + mutex_lock(&u->readlock);
    1392
    1393 if (flags & MSG_PEEK)
    1394 skip = sk_peek_offset(sk, flags);
    1395 @@ -2120,12 +2113,12 @@ again:
    1396
    1397 timeo = unix_stream_data_wait(sk, timeo, last);
    1398
    1399 - if (signal_pending(current)
    1400 - || mutex_lock_interruptible(&u->readlock)) {
    1401 + if (signal_pending(current)) {
    1402 err = sock_intr_errno(timeo);
    1403 goto out;
    1404 }
    1405
    1406 + mutex_lock(&u->readlock);
    1407 continue;
    1408 unlock:
    1409 unix_state_unlock(sk);
    1410 diff --git a/security/keys/gc.c b/security/keys/gc.c
    1411 index c7952375ac53..addf060399e0 100644
    1412 --- a/security/keys/gc.c
    1413 +++ b/security/keys/gc.c
    1414 @@ -134,6 +134,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
    1415 kdebug("- %u", key->serial);
    1416 key_check(key);
    1417
    1418 + /* Throw away the key data if the key is instantiated */
    1419 + if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
    1420 + !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
    1421 + key->type->destroy)
    1422 + key->type->destroy(key);
    1423 +
    1424 security_key_free(key);
    1425
    1426 /* deal with the user's key tracking and quota */
    1427 @@ -148,10 +154,6 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
    1428 if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
    1429 atomic_dec(&key->user->nikeys);
    1430
    1431 - /* now throw away the key memory */
    1432 - if (key->type->destroy)
    1433 - key->type->destroy(key);
    1434 -
    1435 key_user_put(key->user);
    1436
    1437 kfree(key->description);
    1438 diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
    1439 index 0b9ec78a7a7a..26f0e0a11ed6 100644
    1440 --- a/security/keys/keyctl.c
    1441 +++ b/security/keys/keyctl.c
    1442 @@ -757,16 +757,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
    1443
    1444 /* the key is probably readable - now try to read it */
    1445 can_read_key:
    1446 - ret = key_validate(key);
    1447 - if (ret == 0) {
    1448 - ret = -EOPNOTSUPP;
    1449 - if (key->type->read) {
    1450 - /* read the data with the semaphore held (since we
    1451 - * might sleep) */
    1452 - down_read(&key->sem);
    1453 + ret = -EOPNOTSUPP;
    1454 + if (key->type->read) {
    1455 + /* Read the data with the semaphore held (since we might sleep)
    1456 + * to protect against the key being updated or revoked.
    1457 + */
    1458 + down_read(&key->sem);
    1459 + ret = key_validate(key);
    1460 + if (ret == 0)
    1461 ret = key->type->read(key, buffer, buflen);
    1462 - up_read(&key->sem);
    1463 - }
    1464 + up_read(&key->sem);
    1465 }
    1466
    1467 error2:
    1468 diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
    1469 index bd536cb221e2..db91639c81e3 100644
    1470 --- a/security/keys/process_keys.c
    1471 +++ b/security/keys/process_keys.c
    1472 @@ -794,6 +794,7 @@ long join_session_keyring(const char *name)
    1473 ret = PTR_ERR(keyring);
    1474 goto error2;
    1475 } else if (keyring == new->session_keyring) {
    1476 + key_put(keyring);
    1477 ret = 0;
    1478 goto error2;
    1479 }