Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.4/0138-4.4.39-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.4/0138-4.4.39-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2874 - (hide annotations) (download)
    Mon Mar 27 13:49:15 2017 UTC (7 years, 1 month ago) by niro
    File size: 16674 byte(s) 
    linux-4.4.39
    1 niro 2874 diff --git a/Makefile b/Makefile
    2     index 6876efe0d735..88d26a632bef 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 4
    8     -SUBLEVEL = 38
    9     +SUBLEVEL = 39
    10     EXTRAVERSION =
    11     NAME = Blurry Fish Butt
    12    
    13     diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
    14     index 007a69fc4f40..5f3ab8c1db55 100644
    15     --- a/arch/arm64/include/asm/futex.h
    16     +++ b/arch/arm64/include/asm/futex.h
    17     @@ -121,6 +121,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
    18     return -EFAULT;
    19    
    20     asm volatile("// futex_atomic_cmpxchg_inatomic\n"
    21     +ALTERNATIVE("nop", SET_PSTATE_PAN(0), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
    22     " prfm pstl1strm, %2\n"
    23     "1: ldxr %w1, %2\n"
    24     " sub %w3, %w1, %w4\n"
    25     @@ -137,6 +138,7 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
    26     " .align 3\n"
    27     " .quad 1b, 4b, 2b, 4b\n"
    28     " .popsection\n"
    29     +ALTERNATIVE("nop", SET_PSTATE_PAN(1), ARM64_HAS_PAN, CONFIG_ARM64_PAN)
    30     : "+r" (ret), "=&r" (val), "+Q" (*uaddr), "=&r" (tmp)
    31     : "r" (oldval), "r" (newval), "Ir" (-EFAULT)
    32     : "memory");
    33     diff --git a/arch/m68k/include/asm/delay.h b/arch/m68k/include/asm/delay.h
    34     index d28fa8fe26fe..c598d847d56b 100644
    35     --- a/arch/m68k/include/asm/delay.h
    36     +++ b/arch/m68k/include/asm/delay.h
    37     @@ -114,6 +114,6 @@ static inline void __udelay(unsigned long usecs)
    38     */
    39     #define HZSCALE (268435456 / (1000000 / HZ))
    40    
    41     -#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000));
    42     +#define ndelay(n) __delay(DIV_ROUND_UP((n) * ((((HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6), 1000))
    43    
    44     #endif /* defined(_M68K_DELAY_H) */
    45     diff --git a/arch/parisc/include/asm/pgtable.h b/arch/parisc/include/asm/pgtable.h
    46     index c2c43f714684..3a4ed9f91d57 100644
    47     --- a/arch/parisc/include/asm/pgtable.h
    48     +++ b/arch/parisc/include/asm/pgtable.h
    49     @@ -65,9 +65,9 @@ static inline void purge_tlb_entries(struct mm_struct *mm, unsigned long addr)
    50     unsigned long flags; \
    51     spin_lock_irqsave(&pa_tlb_lock, flags); \
    52     old_pte = *ptep; \
    53     - set_pte(ptep, pteval); \
    54     if (pte_inserted(old_pte)) \
    55     purge_tlb_entries(mm, addr); \
    56     + set_pte(ptep, pteval); \
    57     spin_unlock_irqrestore(&pa_tlb_lock, flags); \
    58     } while (0)
    59    
    60     @@ -478,8 +478,8 @@ static inline int ptep_test_and_clear_young(struct vm_area_struct *vma, unsigned
    61     spin_unlock_irqrestore(&pa_tlb_lock, flags);
    62     return 0;
    63     }
    64     - set_pte(ptep, pte_mkold(pte));
    65     purge_tlb_entries(vma->vm_mm, addr);
    66     + set_pte(ptep, pte_mkold(pte));
    67     spin_unlock_irqrestore(&pa_tlb_lock, flags);
    68     return 1;
    69     }
    70     @@ -492,9 +492,9 @@ static inline pte_t ptep_get_and_clear(struct mm_struct *mm, unsigned long addr,
    71    
    72     spin_lock_irqsave(&pa_tlb_lock, flags);
    73     old_pte = *ptep;
    74     - set_pte(ptep, __pte(0));
    75     if (pte_inserted(old_pte))
    76     purge_tlb_entries(mm, addr);
    77     + set_pte(ptep, __pte(0));
    78     spin_unlock_irqrestore(&pa_tlb_lock, flags);
    79    
    80     return old_pte;
    81     @@ -504,8 +504,8 @@ static inline void ptep_set_wrprotect(struct mm_struct *mm, unsigned long addr,
    82     {
    83     unsigned long flags;
    84     spin_lock_irqsave(&pa_tlb_lock, flags);
    85     - set_pte(ptep, pte_wrprotect(*ptep));
    86     purge_tlb_entries(mm, addr);
    87     + set_pte(ptep, pte_wrprotect(*ptep));
    88     spin_unlock_irqrestore(&pa_tlb_lock, flags);
    89     }
    90    
    91     diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
    92     index fd5979f28ada..6857a104b2f9 100644
    93     --- a/arch/parisc/kernel/cache.c
    94     +++ b/arch/parisc/kernel/cache.c
    95     @@ -375,6 +375,15 @@ void __init parisc_setup_cache_timing(void)
    96    
    97     /* calculate TLB flush threshold */
    98    
    99     + /* On SMP machines, skip the TLB measure of kernel text which
    100     + * has been mapped as huge pages. */
    101     + if (num_online_cpus() > 1 && !parisc_requires_coherency()) {
    102     + threshold = max(cache_info.it_size, cache_info.dt_size);
    103     + threshold *= PAGE_SIZE;
    104     + threshold /= num_online_cpus();
    105     + goto set_tlb_threshold;
    106     + }
    107     +
    108     alltime = mfctl(16);
    109     flush_tlb_all();
    110     alltime = mfctl(16) - alltime;
    111     @@ -393,6 +402,8 @@ void __init parisc_setup_cache_timing(void)
    112     alltime, size, rangetime);
    113    
    114     threshold = PAGE_ALIGN(num_online_cpus() * size * alltime / rangetime);
    115     +
    116     +set_tlb_threshold:
    117     if (threshold)
    118     parisc_tlb_flush_threshold = threshold;
    119     printk(KERN_INFO "TLB flush threshold set to %lu KiB\n",
    120     diff --git a/arch/parisc/kernel/pacache.S b/arch/parisc/kernel/pacache.S
    121     index 675521919229..a4761b772406 100644
    122     --- a/arch/parisc/kernel/pacache.S
    123     +++ b/arch/parisc/kernel/pacache.S
    124     @@ -886,19 +886,10 @@ ENTRY(flush_dcache_page_asm)
    125     fdc,m r31(%r28)
    126     fdc,m r31(%r28)
    127     fdc,m r31(%r28)
    128     - cmpb,COND(<<) %r28, %r25,1b
    129     + cmpb,COND(<<) %r28, %r25,1b
    130     fdc,m r31(%r28)
    131    
    132     sync
    133     -
    134     -#ifdef CONFIG_PA20
    135     - pdtlb,l %r0(%r25)
    136     -#else
    137     - tlb_lock %r20,%r21,%r22
    138     - pdtlb %r0(%r25)
    139     - tlb_unlock %r20,%r21,%r22
    140     -#endif
    141     -
    142     bv %r0(%r2)
    143     nop
    144     .exit
    145     @@ -973,17 +964,6 @@ ENTRY(flush_icache_page_asm)
    146     fic,m %r31(%sr4,%r28)
    147    
    148     sync
    149     -
    150     -#ifdef CONFIG_PA20
    151     - pdtlb,l %r0(%r28)
    152     - pitlb,l %r0(%sr4,%r25)
    153     -#else
    154     - tlb_lock %r20,%r21,%r22
    155     - pdtlb %r0(%r28)
    156     - pitlb %r0(%sr4,%r25)
    157     - tlb_unlock %r20,%r21,%r22
    158     -#endif
    159     -
    160     bv %r0(%r2)
    161     nop
    162     .exit
    163     diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c
    164     index c07bfb52275e..300382e5a2cc 100644
    165     --- a/arch/powerpc/kernel/eeh_driver.c
    166     +++ b/arch/powerpc/kernel/eeh_driver.c
    167     @@ -612,8 +612,10 @@ static int eeh_reset_device(struct eeh_pe *pe, struct pci_bus *bus)
    168    
    169     /* Clear frozen state */
    170     rc = eeh_clear_pe_frozen_state(pe, false);
    171     - if (rc)
    172     + if (rc) {
    173     + pci_unlock_rescan_remove();
    174     return rc;
    175     + }
    176    
    177     /* Give the system 5 seconds to finish running the user-space
    178     * hotplug shutdown scripts, e.g. ifdown for ethernet. Yes,
    179     diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
    180     index a3aeb2cc361e..1a8256dd6729 100644
    181     --- a/arch/x86/kernel/cpu/perf_event.c
    182     +++ b/arch/x86/kernel/cpu/perf_event.c
    183     @@ -67,7 +67,7 @@ u64 x86_perf_event_update(struct perf_event *event)
    184     int shift = 64 - x86_pmu.cntval_bits;
    185     u64 prev_raw_count, new_raw_count;
    186     int idx = hwc->idx;
    187     - s64 delta;
    188     + u64 delta;
    189    
    190     if (idx == INTEL_PMC_IDX_FIXED_BTS)
    191     return 0;
    192     diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c
    193     index 5f82cd59f0e5..5cc2242d77c6 100644
    194     --- a/arch/x86/kernel/cpu/perf_event_intel.c
    195     +++ b/arch/x86/kernel/cpu/perf_event_intel.c
    196     @@ -3636,7 +3636,7 @@ __init int intel_pmu_init(void)
    197    
    198     /* Support full width counters using alternative MSR range */
    199     if (x86_pmu.intel_cap.full_width_write) {
    200     - x86_pmu.max_period = x86_pmu.cntval_mask;
    201     + x86_pmu.max_period = x86_pmu.cntval_mask >> 1;
    202     x86_pmu.perfctr = MSR_IA32_PMC0;
    203     pr_cont("full-width counters, ");
    204     }
    205     diff --git a/crypto/Makefile b/crypto/Makefile
    206     index f7aba923458d..82fbff180ad3 100644
    207     --- a/crypto/Makefile
    208     +++ b/crypto/Makefile
    209     @@ -33,6 +33,7 @@ obj-$(CONFIG_CRYPTO_AKCIPHER2) += akcipher.o
    210    
    211     $(obj)/rsapubkey-asn1.o: $(obj)/rsapubkey-asn1.c $(obj)/rsapubkey-asn1.h
    212     $(obj)/rsaprivkey-asn1.o: $(obj)/rsaprivkey-asn1.c $(obj)/rsaprivkey-asn1.h
    213     +$(obj)/rsa_helper.o: $(obj)/rsapubkey-asn1.h $(obj)/rsaprivkey-asn1.h
    214     clean-files += rsapubkey-asn1.c rsapubkey-asn1.h
    215     clean-files += rsaprivkey-asn1.c rsaprivkey-asn1.h
    216    
    217     diff --git a/crypto/mcryptd.c b/crypto/mcryptd.c
    218     index fe5b495a434d..a0ceb41d5ccc 100644
    219     --- a/crypto/mcryptd.c
    220     +++ b/crypto/mcryptd.c
    221     @@ -258,18 +258,22 @@ out_free_inst:
    222     goto out;
    223     }
    224    
    225     -static inline void mcryptd_check_internal(struct rtattr **tb, u32 *type,
    226     +static inline bool mcryptd_check_internal(struct rtattr **tb, u32 *type,
    227     u32 *mask)
    228     {
    229     struct crypto_attr_type *algt;
    230    
    231     algt = crypto_get_attr_type(tb);
    232     if (IS_ERR(algt))
    233     - return;
    234     - if ((algt->type & CRYPTO_ALG_INTERNAL))
    235     - *type |= CRYPTO_ALG_INTERNAL;
    236     - if ((algt->mask & CRYPTO_ALG_INTERNAL))
    237     - *mask |= CRYPTO_ALG_INTERNAL;
    238     + return false;
    239     +
    240     + *type |= algt->type & CRYPTO_ALG_INTERNAL;
    241     + *mask |= algt->mask & CRYPTO_ALG_INTERNAL;
    242     +
    243     + if (*type & *mask & CRYPTO_ALG_INTERNAL)
    244     + return true;
    245     + else
    246     + return false;
    247     }
    248    
    249     static int mcryptd_hash_init_tfm(struct crypto_tfm *tfm)
    250     @@ -498,7 +502,8 @@ static int mcryptd_create_hash(struct crypto_template *tmpl, struct rtattr **tb,
    251     u32 mask = 0;
    252     int err;
    253    
    254     - mcryptd_check_internal(tb, &type, &mask);
    255     + if (!mcryptd_check_internal(tb, &type, &mask))
    256     + return -EINVAL;
    257    
    258     salg = shash_attr_alg(tb[1], type, mask);
    259     if (IS_ERR(salg))
    260     diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
    261     index 1770c455dfdd..1648de80e230 100644
    262     --- a/drivers/block/zram/zram_drv.c
    263     +++ b/drivers/block/zram/zram_drv.c
    264     @@ -1378,8 +1378,14 @@ static ssize_t hot_remove_store(struct class *class,
    265     return ret ? ret : count;
    266     }
    267    
    268     +/*
    269     + * NOTE: hot_add attribute is not the usual read-only sysfs attribute. In a
    270     + * sense that reading from this file does alter the state of your system -- it
    271     + * creates a new un-initialized zram device and returns back this device's
    272     + * device_id (or an error code if it fails to create a new device).
    273     + */
    274     static struct class_attribute zram_control_class_attrs[] = {
    275     - __ATTR_RO(hot_add),
    276     + __ATTR(hot_add, 0400, hot_add_show, NULL),
    277     __ATTR_WO(hot_remove),
    278     __ATTR_NULL,
    279     };
    280     diff --git a/drivers/net/can/usb/peak_usb/pcan_usb_core.c b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    281     index 5a2e341a6d1e..91be4575b524 100644
    282     --- a/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    283     +++ b/drivers/net/can/usb/peak_usb/pcan_usb_core.c
    284     @@ -872,23 +872,25 @@ lbl_free_candev:
    285     static void peak_usb_disconnect(struct usb_interface *intf)
    286     {
    287     struct peak_usb_device *dev;
    288     + struct peak_usb_device *dev_prev_siblings;
    289    
    290     /* unregister as many netdev devices as siblings */
    291     - for (dev = usb_get_intfdata(intf); dev; dev = dev->prev_siblings) {
    292     + for (dev = usb_get_intfdata(intf); dev; dev = dev_prev_siblings) {
    293     struct net_device *netdev = dev->netdev;
    294     char name[IFNAMSIZ];
    295    
    296     + dev_prev_siblings = dev->prev_siblings;
    297     dev->state &= ~PCAN_USB_STATE_CONNECTED;
    298     strncpy(name, netdev->name, IFNAMSIZ);
    299    
    300     unregister_netdev(netdev);
    301     - free_candev(netdev);
    302    
    303     kfree(dev->cmd_buf);
    304     dev->next_siblings = NULL;
    305     if (dev->adapter->dev_free)
    306     dev->adapter->dev_free(dev);
    307    
    308     + free_candev(netdev);
    309     dev_info(&intf->dev, "%s removed\n", name);
    310     }
    311    
    312     diff --git a/include/linux/cpu.h b/include/linux/cpu.h
    313     index d2ca8c38f9c4..3ea9aae2387d 100644
    314     --- a/include/linux/cpu.h
    315     +++ b/include/linux/cpu.h
    316     @@ -131,22 +131,16 @@ enum {
    317     { .notifier_call = fn, .priority = pri }; \
    318     __register_cpu_notifier(&fn##_nb); \
    319     }
    320     -#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
    321     -#define cpu_notifier(fn, pri) do { (void)(fn); } while (0)
    322     -#define __cpu_notifier(fn, pri) do { (void)(fn); } while (0)
    323     -#endif /* #else #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
    324    
    325     -#ifdef CONFIG_HOTPLUG_CPU
    326     extern int register_cpu_notifier(struct notifier_block *nb);
    327     extern int __register_cpu_notifier(struct notifier_block *nb);
    328     extern void unregister_cpu_notifier(struct notifier_block *nb);
    329     extern void __unregister_cpu_notifier(struct notifier_block *nb);
    330     -#else
    331    
    332     -#ifndef MODULE
    333     -extern int register_cpu_notifier(struct notifier_block *nb);
    334     -extern int __register_cpu_notifier(struct notifier_block *nb);
    335     -#else
    336     +#else /* #if defined(CONFIG_HOTPLUG_CPU) || !defined(MODULE) */
    337     +#define cpu_notifier(fn, pri) do { (void)(fn); } while (0)
    338     +#define __cpu_notifier(fn, pri) do { (void)(fn); } while (0)
    339     +
    340     static inline int register_cpu_notifier(struct notifier_block *nb)
    341     {
    342     return 0;
    343     @@ -156,7 +150,6 @@ static inline int __register_cpu_notifier(struct notifier_block *nb)
    344     {
    345     return 0;
    346     }
    347     -#endif
    348    
    349     static inline void unregister_cpu_notifier(struct notifier_block *nb)
    350     {
    351     diff --git a/include/uapi/linux/can.h b/include/uapi/linux/can.h
    352     index 9692cda5f8fc..c48d93a28d1a 100644
    353     --- a/include/uapi/linux/can.h
    354     +++ b/include/uapi/linux/can.h
    355     @@ -196,5 +196,6 @@ struct can_filter {
    356     };
    357    
    358     #define CAN_INV_FILTER 0x20000000U /* to be set in can_filter.can_id */
    359     +#define CAN_RAW_FILTER_MAX 512 /* maximum number of can_filter set via setsockopt() */
    360    
    361     #endif /* !_UAPI_CAN_H */
    362     diff --git a/kernel/cpu.c b/kernel/cpu.c
    363     index 85ff5e26e23b..cd6d1258554e 100644
    364     --- a/kernel/cpu.c
    365     +++ b/kernel/cpu.c
    366     @@ -223,8 +223,6 @@ static int cpu_notify(unsigned long val, void *v)
    367     return __cpu_notify(val, v, -1, NULL);
    368     }
    369    
    370     -#ifdef CONFIG_HOTPLUG_CPU
    371     -
    372     static void cpu_notify_nofail(unsigned long val, void *v)
    373     {
    374     BUG_ON(cpu_notify(val, v));
    375     @@ -246,6 +244,7 @@ void __unregister_cpu_notifier(struct notifier_block *nb)
    376     }
    377     EXPORT_SYMBOL(__unregister_cpu_notifier);
    378    
    379     +#ifdef CONFIG_HOTPLUG_CPU
    380     /**
    381     * clear_tasks_mm_cpumask - Safely clear tasks' mm_cpumask for a CPU
    382     * @cpu: a CPU id
    383     diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c
    384     index 8251e75dd9c0..b066724d7a5b 100644
    385     --- a/kernel/locking/rtmutex.c
    386     +++ b/kernel/locking/rtmutex.c
    387     @@ -65,8 +65,72 @@ static inline void clear_rt_mutex_waiters(struct rt_mutex *lock)
    388    
    389     static void fixup_rt_mutex_waiters(struct rt_mutex *lock)
    390     {
    391     - if (!rt_mutex_has_waiters(lock))
    392     - clear_rt_mutex_waiters(lock);
    393     + unsigned long owner, *p = (unsigned long *) &lock->owner;
    394     +
    395     + if (rt_mutex_has_waiters(lock))
    396     + return;
    397     +
    398     + /*
    399     + * The rbtree has no waiters enqueued, now make sure that the
    400     + * lock->owner still has the waiters bit set, otherwise the
    401     + * following can happen:
    402     + *
    403     + * CPU 0 CPU 1 CPU2
    404     + * l->owner=T1
    405     + * rt_mutex_lock(l)
    406     + * lock(l->lock)
    407     + * l->owner = T1 | HAS_WAITERS;
    408     + * enqueue(T2)
    409     + * boost()
    410     + * unlock(l->lock)
    411     + * block()
    412     + *
    413     + * rt_mutex_lock(l)
    414     + * lock(l->lock)
    415     + * l->owner = T1 | HAS_WAITERS;
    416     + * enqueue(T3)
    417     + * boost()
    418     + * unlock(l->lock)
    419     + * block()
    420     + * signal(->T2) signal(->T3)
    421     + * lock(l->lock)
    422     + * dequeue(T2)
    423     + * deboost()
    424     + * unlock(l->lock)
    425     + * lock(l->lock)
    426     + * dequeue(T3)
    427     + * ==> wait list is empty
    428     + * deboost()
    429     + * unlock(l->lock)
    430     + * lock(l->lock)
    431     + * fixup_rt_mutex_waiters()
    432     + * if (wait_list_empty(l) {
    433     + * l->owner = owner
    434     + * owner = l->owner & ~HAS_WAITERS;
    435     + * ==> l->owner = T1
    436     + * }
    437     + * lock(l->lock)
    438     + * rt_mutex_unlock(l) fixup_rt_mutex_waiters()
    439     + * if (wait_list_empty(l) {
    440     + * owner = l->owner & ~HAS_WAITERS;
    441     + * cmpxchg(l->owner, T1, NULL)
    442     + * ===> Success (l->owner = NULL)
    443     + *
    444     + * l->owner = owner
    445     + * ==> l->owner = T1
    446     + * }
    447     + *
    448     + * With the check for the waiter bit in place T3 on CPU2 will not
    449     + * overwrite. All tasks fiddling with the waiters bit are
    450     + * serialized by l->lock, so nothing else can modify the waiters
    451     + * bit. If the bit is set then nothing can change l->owner either
    452     + * so the simple RMW is safe. The cmpxchg() will simply fail if it
    453     + * happens in the middle of the RMW because the waiters bit is
    454     + * still set.
    455     + */
    456     + owner = READ_ONCE(*p);
    457     + if (owner & RT_MUTEX_HAS_WAITERS)
    458     + WRITE_ONCE(*p, owner & ~RT_MUTEX_HAS_WAITERS);
    459     }
    460    
    461     /*
    462     diff --git a/kernel/locking/rtmutex_common.h b/kernel/locking/rtmutex_common.h
    463     index 4f5f83c7d2d3..e317e1cbb3eb 100644
    464     --- a/kernel/locking/rtmutex_common.h
    465     +++ b/kernel/locking/rtmutex_common.h
    466     @@ -75,8 +75,9 @@ task_top_pi_waiter(struct task_struct *p)
    467    
    468     static inline struct task_struct *rt_mutex_owner(struct rt_mutex *lock)
    469     {
    470     - return (struct task_struct *)
    471     - ((unsigned long)lock->owner & ~RT_MUTEX_OWNER_MASKALL);
    472     + unsigned long owner = (unsigned long) READ_ONCE(lock->owner);
    473     +
    474     + return (struct task_struct *) (owner & ~RT_MUTEX_OWNER_MASKALL);
    475     }
    476    
    477     /*
    478     diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
    479     index 83b0ca27a45e..f2079acb555d 100644
    480     --- a/net/batman-adv/translation-table.c
    481     +++ b/net/batman-adv/translation-table.c
    482     @@ -2764,7 +2764,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
    483     &tvlv_tt_data,
    484     &tt_change,
    485     &tt_len);
    486     - if (!tt_len)
    487     + if (!tt_len || !tvlv_len)
    488     goto unlock;
    489    
    490     /* Copy the last orig_node's OGM buffer */
    491     @@ -2782,7 +2782,7 @@ static bool batadv_send_my_tt_response(struct batadv_priv *bat_priv,
    492     &tvlv_tt_data,
    493     &tt_change,
    494     &tt_len);
    495     - if (!tt_len)
    496     + if (!tt_len || !tvlv_len)
    497     goto out;
    498    
    499     /* fill the rest of the tvlv with the real TT entries */
    500     diff --git a/net/can/raw.c b/net/can/raw.c
    501     index 2e67b1423cd3..56af689ca999 100644
    502     --- a/net/can/raw.c
    503     +++ b/net/can/raw.c
    504     @@ -499,6 +499,9 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
    505     if (optlen % sizeof(struct can_filter) != 0)
    506     return -EINVAL;
    507    
    508     + if (optlen > CAN_RAW_FILTER_MAX * sizeof(struct can_filter))
    509     + return -EINVAL;
    510     +
    511     count = optlen / sizeof(struct can_filter);
    512    
    513     if (count > 1) {