Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.4/0142-4.4.43-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.4/0142-4.4.43-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2878 - (show annotations) (download)
    Mon Mar 27 13:49:18 2017 UTC (7 years, 1 month ago) by niro
    File size: 21636 byte(s) 
    linux-4.4.43
    1 diff --git a/Makefile b/Makefile
    2 index b8a90f9a463d..04a2186a4276 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 4
    8 -SUBLEVEL = 42
    9 +SUBLEVEL = 43
    10 EXTRAVERSION =
    11 NAME = Blurry Fish Butt
    12
    13 diff --git a/arch/arm/mach-omap2/omap-mpuss-lowpower.c b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
    14 index 65024af169d3..d3c14da7d216 100644
    15 --- a/arch/arm/mach-omap2/omap-mpuss-lowpower.c
    16 +++ b/arch/arm/mach-omap2/omap-mpuss-lowpower.c
    17 @@ -243,10 +243,9 @@ int omap4_enter_lowpower(unsigned int cpu, unsigned int power_state)
    18 save_state = 1;
    19 break;
    20 case PWRDM_POWER_RET:
    21 - if (IS_PM44XX_ERRATUM(PM_OMAP4_CPU_OSWR_DISABLE)) {
    22 + if (IS_PM44XX_ERRATUM(PM_OMAP4_CPU_OSWR_DISABLE))
    23 save_state = 0;
    24 - break;
    25 - }
    26 + break;
    27 default:
    28 /*
    29 * CPUx CSWR is invalid hardware state. Also CPUx OSWR
    30 diff --git a/arch/arm/mach-zynq/common.c b/arch/arm/mach-zynq/common.c
    31 index 6f39d03cc27e..0a43143e9ceb 100644
    32 --- a/arch/arm/mach-zynq/common.c
    33 +++ b/arch/arm/mach-zynq/common.c
    34 @@ -59,7 +59,7 @@ void __iomem *zynq_scu_base;
    35 static void __init zynq_memory_init(void)
    36 {
    37 if (!__pa(PAGE_OFFSET))
    38 - memblock_reserve(__pa(PAGE_OFFSET), __pa(swapper_pg_dir));
    39 + memblock_reserve(__pa(PAGE_OFFSET), 0x80000);
    40 }
    41
    42 static struct platform_device zynq_cpuidle_device = {
    43 diff --git a/arch/powerpc/kernel/misc_32.S b/arch/powerpc/kernel/misc_32.S
    44 index ed3ab509faca..df4efa304b2c 100644
    45 --- a/arch/powerpc/kernel/misc_32.S
    46 +++ b/arch/powerpc/kernel/misc_32.S
    47 @@ -313,7 +313,7 @@ _GLOBAL(flush_instruction_cache)
    48 lis r3, KERNELBASE@h
    49 iccci 0,r3
    50 #endif
    51 -#elif CONFIG_FSL_BOOKE
    52 +#elif defined(CONFIG_FSL_BOOKE)
    53 BEGIN_FTR_SECTION
    54 mfspr r3,SPRN_L1CSR0
    55 ori r3,r3,L1CSR0_CFI|L1CSR0_CLFC
    56 diff --git a/drivers/hid/hid-cypress.c b/drivers/hid/hid-cypress.c
    57 index 1b764d1745f3..1689568b597d 100644
    58 --- a/drivers/hid/hid-cypress.c
    59 +++ b/drivers/hid/hid-cypress.c
    60 @@ -39,6 +39,9 @@ static __u8 *cp_report_fixup(struct hid_device *hdev, __u8 *rdesc,
    61 if (!(quirks & CP_RDESC_SWAPPED_MIN_MAX))
    62 return rdesc;
    63
    64 + if (*rsize < 4)
    65 + return rdesc;
    66 +
    67 for (i = 0; i < *rsize - 4; i++)
    68 if (rdesc[i] == 0x29 && rdesc[i + 2] == 0x19) {
    69 rdesc[i] = 0x19;
    70 diff --git a/drivers/isdn/gigaset/ser-gigaset.c b/drivers/isdn/gigaset/ser-gigaset.c
    71 index 2a506fe0c8a4..74bf1a17ae7c 100644
    72 --- a/drivers/isdn/gigaset/ser-gigaset.c
    73 +++ b/drivers/isdn/gigaset/ser-gigaset.c
    74 @@ -762,8 +762,10 @@ static int __init ser_gigaset_init(void)
    75 driver = gigaset_initdriver(GIGASET_MINOR, GIGASET_MINORS,
    76 GIGASET_MODULENAME, GIGASET_DEVNAME,
    77 &ops, THIS_MODULE);
    78 - if (!driver)
    79 + if (!driver) {
    80 + rc = -ENOMEM;
    81 goto error;
    82 + }
    83
    84 rc = tty_register_ldisc(N_GIGASET_M101, &gigaset_ldisc);
    85 if (rc != 0) {
    86 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c
    87 index 6cf6d93d8831..ba115ec7aa92 100644
    88 --- a/drivers/net/ethernet/mellanox/mlx5/core/main.c
    89 +++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c
    90 @@ -432,6 +432,13 @@ static int handle_hca_cap(struct mlx5_core_dev *dev)
    91 MLX5_SET(cmd_hca_cap, set_hca_cap, pkey_table_size,
    92 to_fw_pkey_sz(128));
    93
    94 + /* Check log_max_qp from HCA caps to set in current profile */
    95 + if (MLX5_CAP_GEN_MAX(dev, log_max_qp) < profile[prof_sel].log_max_qp) {
    96 + mlx5_core_warn(dev, "log_max_qp value in current profile is %d, changing it to HCA capability limit (%d)\n",
    97 + profile[prof_sel].log_max_qp,
    98 + MLX5_CAP_GEN_MAX(dev, log_max_qp));
    99 + profile[prof_sel].log_max_qp = MLX5_CAP_GEN_MAX(dev, log_max_qp);
    100 + }
    101 if (prof->mask & MLX5_PROF_MASK_QP_SIZE)
    102 MLX5_SET(cmd_hca_cap, set_hca_cap, log_max_qp,
    103 prof->log_max_qp);
    104 @@ -505,7 +512,6 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
    105 struct mlx5_priv *priv = &mdev->priv;
    106 struct msix_entry *msix = priv->msix_arr;
    107 int irq = msix[i + MLX5_EQ_VEC_COMP_BASE].vector;
    108 - int numa_node = priv->numa_node;
    109 int err;
    110
    111 if (!zalloc_cpumask_var(&priv->irq_info[i].mask, GFP_KERNEL)) {
    112 @@ -513,7 +519,7 @@ static int mlx5_irq_set_affinity_hint(struct mlx5_core_dev *mdev, int i)
    113 return -ENOMEM;
    114 }
    115
    116 - cpumask_set_cpu(cpumask_local_spread(i, numa_node),
    117 + cpumask_set_cpu(cpumask_local_spread(i, priv->numa_node),
    118 priv->irq_info[i].mask);
    119
    120 err = irq_set_affinity_hint(irq, priv->irq_info[i].mask);
    121 diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    122 index a5b869eb4678..4b100ef4af9f 100644
    123 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    124 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    125 @@ -2939,12 +2939,6 @@ int stmmac_dvr_probe(struct device *device,
    126 spin_lock_init(&priv->lock);
    127 spin_lock_init(&priv->tx_lock);
    128
    129 - ret = register_netdev(ndev);
    130 - if (ret) {
    131 - pr_err("%s: ERROR %i registering the device\n", __func__, ret);
    132 - goto error_netdev_register;
    133 - }
    134 -
    135 /* If a specific clk_csr value is passed from the platform
    136 * this means that the CSR Clock Range selection cannot be
    137 * changed at run-time and it is fixed. Viceversa the driver'll try to
    138 @@ -2969,11 +2963,21 @@ int stmmac_dvr_probe(struct device *device,
    139 }
    140 }
    141
    142 - return 0;
    143 + ret = register_netdev(ndev);
    144 + if (ret) {
    145 + netdev_err(priv->dev, "%s: ERROR %i registering the device\n",
    146 + __func__, ret);
    147 + goto error_netdev_register;
    148 + }
    149 +
    150 + return ret;
    151
    152 -error_mdio_register:
    153 - unregister_netdev(ndev);
    154 error_netdev_register:
    155 + if (priv->pcs != STMMAC_PCS_RGMII &&
    156 + priv->pcs != STMMAC_PCS_TBI &&
    157 + priv->pcs != STMMAC_PCS_RTBI)
    158 + stmmac_mdio_unregister(ndev);
    159 +error_mdio_register:
    160 netif_napi_del(&priv->napi);
    161 error_hw_init:
    162 clk_disable_unprepare(priv->pclk);
    163 diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
    164 index 409b48e1e589..7a601d8c615e 100644
    165 --- a/drivers/net/hyperv/netvsc_drv.c
    166 +++ b/drivers/net/hyperv/netvsc_drv.c
    167 @@ -40,6 +40,8 @@
    168
    169 #include "hyperv_net.h"
    170
    171 +/* Restrict GSO size to account for NVGRE */
    172 +#define NETVSC_GSO_MAX_SIZE 62768
    173
    174 #define RING_SIZE_MIN 64
    175 static int ring_size = 128;
    176 @@ -852,6 +854,7 @@ static int netvsc_set_channels(struct net_device *net,
    177 }
    178 goto recover;
    179 }
    180 + netif_set_gso_max_size(net, NETVSC_GSO_MAX_SIZE);
    181
    182 out:
    183 netvsc_open(net);
    184 diff --git a/drivers/net/usb/r8152.c b/drivers/net/usb/r8152.c
    185 index 2fb637ad594a..32b7ec976dcc 100644
    186 --- a/drivers/net/usb/r8152.c
    187 +++ b/drivers/net/usb/r8152.c
    188 @@ -3446,39 +3446,87 @@ static bool delay_autosuspend(struct r8152 *tp)
    189 return false;
    190 }
    191
    192 -static int rtl8152_suspend(struct usb_interface *intf, pm_message_t message)
    193 +static int rtl8152_rumtime_suspend(struct r8152 *tp)
    194 {
    195 - struct r8152 *tp = usb_get_intfdata(intf);
    196 struct net_device *netdev = tp->netdev;
    197 int ret = 0;
    198
    199 - mutex_lock(&tp->control);
    200 + if (netif_running(netdev) && test_bit(WORK_ENABLE, &tp->flags)) {
    201 + u32 rcr = 0;
    202
    203 - if (PMSG_IS_AUTO(message)) {
    204 - if (netif_running(netdev) && delay_autosuspend(tp)) {
    205 + if (delay_autosuspend(tp)) {
    206 ret = -EBUSY;
    207 goto out1;
    208 }
    209
    210 - set_bit(SELECTIVE_SUSPEND, &tp->flags);
    211 - } else {
    212 - netif_device_detach(netdev);
    213 + if (netif_carrier_ok(netdev)) {
    214 + u32 ocp_data;
    215 +
    216 + rcr = ocp_read_dword(tp, MCU_TYPE_PLA, PLA_RCR);
    217 + ocp_data = rcr & ~RCR_ACPT_ALL;
    218 + ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, ocp_data);
    219 + rxdy_gated_en(tp, true);
    220 + ocp_data = ocp_read_byte(tp, MCU_TYPE_PLA,
    221 + PLA_OOB_CTRL);
    222 + if (!(ocp_data & RXFIFO_EMPTY)) {
    223 + rxdy_gated_en(tp, false);
    224 + ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, rcr);
    225 + ret = -EBUSY;
    226 + goto out1;
    227 + }
    228 + }
    229 +
    230 + clear_bit(WORK_ENABLE, &tp->flags);
    231 + usb_kill_urb(tp->intr_urb);
    232 +
    233 + rtl_runtime_suspend_enable(tp, true);
    234 +
    235 + if (netif_carrier_ok(netdev)) {
    236 + napi_disable(&tp->napi);
    237 + rtl_stop_rx(tp);
    238 + rxdy_gated_en(tp, false);
    239 + ocp_write_dword(tp, MCU_TYPE_PLA, PLA_RCR, rcr);
    240 + napi_enable(&tp->napi);
    241 + }
    242 }
    243
    244 + set_bit(SELECTIVE_SUSPEND, &tp->flags);
    245 +
    246 +out1:
    247 + return ret;
    248 +}
    249 +
    250 +static int rtl8152_system_suspend(struct r8152 *tp)
    251 +{
    252 + struct net_device *netdev = tp->netdev;
    253 + int ret = 0;
    254 +
    255 + netif_device_detach(netdev);
    256 +
    257 if (netif_running(netdev) && test_bit(WORK_ENABLE, &tp->flags)) {
    258 clear_bit(WORK_ENABLE, &tp->flags);
    259 usb_kill_urb(tp->intr_urb);
    260 napi_disable(&tp->napi);
    261 - if (test_bit(SELECTIVE_SUSPEND, &tp->flags)) {
    262 - rtl_stop_rx(tp);
    263 - rtl_runtime_suspend_enable(tp, true);
    264 - } else {
    265 - cancel_delayed_work_sync(&tp->schedule);
    266 - tp->rtl_ops.down(tp);
    267 - }
    268 + cancel_delayed_work_sync(&tp->schedule);
    269 + tp->rtl_ops.down(tp);
    270 napi_enable(&tp->napi);
    271 }
    272 -out1:
    273 +
    274 + return ret;
    275 +}
    276 +
    277 +static int rtl8152_suspend(struct usb_interface *intf, pm_message_t message)
    278 +{
    279 + struct r8152 *tp = usb_get_intfdata(intf);
    280 + int ret;
    281 +
    282 + mutex_lock(&tp->control);
    283 +
    284 + if (PMSG_IS_AUTO(message))
    285 + ret = rtl8152_rumtime_suspend(tp);
    286 + else
    287 + ret = rtl8152_system_suspend(tp);
    288 +
    289 mutex_unlock(&tp->control);
    290
    291 return ret;
    292 diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
    293 index 903bda437839..d6b619667f1a 100644
    294 --- a/drivers/net/vrf.c
    295 +++ b/drivers/net/vrf.c
    296 @@ -301,7 +301,9 @@ static netdev_tx_t vrf_process_v4_outbound(struct sk_buff *skb,
    297 .flowi4_tos = RT_TOS(ip4h->tos),
    298 .flowi4_flags = FLOWI_FLAG_ANYSRC | FLOWI_FLAG_L3MDEV_SRC |
    299 FLOWI_FLAG_SKIP_NH_OIF,
    300 + .flowi4_proto = ip4h->protocol,
    301 .daddr = ip4h->daddr,
    302 + .saddr = ip4h->saddr,
    303 };
    304
    305 if (vrf_send_v4_prep(skb, &fl4, vrf_dev))
    306 @@ -410,6 +412,8 @@ static int vrf_finish_output6(struct net *net, struct sock *sk,
    307 struct in6_addr *nexthop;
    308 int ret;
    309
    310 + nf_reset(skb);
    311 +
    312 skb->protocol = htons(ETH_P_IPV6);
    313 skb->dev = dev;
    314
    315 @@ -521,6 +525,8 @@ static int vrf_finish_output(struct net *net, struct sock *sk, struct sk_buff *s
    316 u32 nexthop;
    317 int ret = -EINVAL;
    318
    319 + nf_reset(skb);
    320 +
    321 /* Be paranoid, rather than too clever. */
    322 if (unlikely(skb_headroom(skb) < hh_len && dev->header_ops)) {
    323 struct sk_buff *skb2;
    324 @@ -919,6 +925,8 @@ static int vrf_newlink(struct net *src_net, struct net_device *dev,
    325 return -EINVAL;
    326
    327 vrf->tb_id = nla_get_u32(data[IFLA_VRF_TABLE]);
    328 + if (vrf->tb_id == RT_TABLE_UNSPEC)
    329 + return -EINVAL;
    330
    331 dev->priv_flags |= IFF_L3MDEV_MASTER;
    332
    333 diff --git a/drivers/spi/spi-orion.c b/drivers/spi/spi-orion.c
    334 index a87cfd4ba17b..61a86d391599 100644
    335 --- a/drivers/spi/spi-orion.c
    336 +++ b/drivers/spi/spi-orion.c
    337 @@ -127,37 +127,62 @@ static int orion_spi_baudrate_set(struct spi_device *spi, unsigned int speed)
    338 tclk_hz = clk_get_rate(orion_spi->clk);
    339
    340 if (devdata->typ == ARMADA_SPI) {
    341 - unsigned int clk, spr, sppr, sppr2, err;
    342 - unsigned int best_spr, best_sppr, best_err;
    343 -
    344 - best_err = speed;
    345 - best_spr = 0;
    346 - best_sppr = 0;
    347 -
    348 - /* Iterate over the valid range looking for best fit */
    349 - for (sppr = 0; sppr < 8; sppr++) {
    350 - sppr2 = 0x1 << sppr;
    351 -
    352 - spr = tclk_hz / sppr2;
    353 - spr = DIV_ROUND_UP(spr, speed);
    354 - if ((spr == 0) || (spr > 15))
    355 - continue;
    356 -
    357 - clk = tclk_hz / (spr * sppr2);
    358 - err = speed - clk;
    359 -
    360 - if (err < best_err) {
    361 - best_spr = spr;
    362 - best_sppr = sppr;
    363 - best_err = err;
    364 - }
    365 - }
    366 + /*
    367 + * Given the core_clk (tclk_hz) and the target rate (speed) we
    368 + * determine the best values for SPR (in [0 .. 15]) and SPPR (in
    369 + * [0..7]) such that
    370 + *
    371 + * core_clk / (SPR * 2 ** SPPR)
    372 + *
    373 + * is as big as possible but not bigger than speed.
    374 + */
    375
    376 - if ((best_sppr == 0) && (best_spr == 0))
    377 - return -EINVAL;
    378 + /* best integer divider: */
    379 + unsigned divider = DIV_ROUND_UP(tclk_hz, speed);
    380 + unsigned spr, sppr;
    381 +
    382 + if (divider < 16) {
    383 + /* This is the easy case, divider is less than 16 */
    384 + spr = divider;
    385 + sppr = 0;
    386 +
    387 + } else {
    388 + unsigned two_pow_sppr;
    389 + /*
    390 + * Find the highest bit set in divider. This and the
    391 + * three next bits define SPR (apart from rounding).
    392 + * SPPR is then the number of zero bits that must be
    393 + * appended:
    394 + */
    395 + sppr = fls(divider) - 4;
    396 +
    397 + /*
    398 + * As SPR only has 4 bits, we have to round divider up
    399 + * to the next multiple of 2 ** sppr.
    400 + */
    401 + two_pow_sppr = 1 << sppr;
    402 + divider = (divider + two_pow_sppr - 1) & -two_pow_sppr;
    403 +
    404 + /*
    405 + * recalculate sppr as rounding up divider might have
    406 + * increased it enough to change the position of the
    407 + * highest set bit. In this case the bit that now
    408 + * doesn't make it into SPR is 0, so there is no need to
    409 + * round again.
    410 + */
    411 + sppr = fls(divider) - 4;
    412 + spr = divider >> sppr;
    413 +
    414 + /*
    415 + * Now do range checking. SPR is constructed to have a
    416 + * width of 4 bits, so this is fine for sure. So we
    417 + * still need to check for sppr to fit into 3 bits:
    418 + */
    419 + if (sppr > 7)
    420 + return -EINVAL;
    421 + }
    422
    423 - prescale = ((best_sppr & 0x6) << 5) |
    424 - ((best_sppr & 0x1) << 4) | best_spr;
    425 + prescale = ((sppr & 0x6) << 5) | ((sppr & 0x1) << 4) | spr;
    426 } else {
    427 /*
    428 * the supported rates are: 4,6,8...30
    429 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
    430 index 9d6025703f73..93a6a2c66d15 100644
    431 --- a/include/linux/netdevice.h
    432 +++ b/include/linux/netdevice.h
    433 @@ -2325,14 +2325,19 @@ static inline int skb_gro_header_hard(struct sk_buff *skb, unsigned int hlen)
    434 return NAPI_GRO_CB(skb)->frag0_len < hlen;
    435 }
    436
    437 +static inline void skb_gro_frag0_invalidate(struct sk_buff *skb)
    438 +{
    439 + NAPI_GRO_CB(skb)->frag0 = NULL;
    440 + NAPI_GRO_CB(skb)->frag0_len = 0;
    441 +}
    442 +
    443 static inline void *skb_gro_header_slow(struct sk_buff *skb, unsigned int hlen,
    444 unsigned int offset)
    445 {
    446 if (!pskb_may_pull(skb, hlen))
    447 return NULL;
    448
    449 - NAPI_GRO_CB(skb)->frag0 = NULL;
    450 - NAPI_GRO_CB(skb)->frag0_len = 0;
    451 + skb_gro_frag0_invalidate(skb);
    452 return skb->data + offset;
    453 }
    454
    455 diff --git a/mm/page_alloc.c b/mm/page_alloc.c
    456 index 2bcdfbf8c36d..6a117213feb8 100644
    457 --- a/mm/page_alloc.c
    458 +++ b/mm/page_alloc.c
    459 @@ -5696,15 +5696,18 @@ void __init free_area_init_nodes(unsigned long *max_zone_pfn)
    460 sizeof(arch_zone_lowest_possible_pfn));
    461 memset(arch_zone_highest_possible_pfn, 0,
    462 sizeof(arch_zone_highest_possible_pfn));
    463 - arch_zone_lowest_possible_pfn[0] = find_min_pfn_with_active_regions();
    464 - arch_zone_highest_possible_pfn[0] = max_zone_pfn[0];
    465 - for (i = 1; i < MAX_NR_ZONES; i++) {
    466 +
    467 + start_pfn = find_min_pfn_with_active_regions();
    468 +
    469 + for (i = 0; i < MAX_NR_ZONES; i++) {
    470 if (i == ZONE_MOVABLE)
    471 continue;
    472 - arch_zone_lowest_possible_pfn[i] =
    473 - arch_zone_highest_possible_pfn[i-1];
    474 - arch_zone_highest_possible_pfn[i] =
    475 - max(max_zone_pfn[i], arch_zone_lowest_possible_pfn[i]);
    476 +
    477 + end_pfn = max(max_zone_pfn[i], start_pfn);
    478 + arch_zone_lowest_possible_pfn[i] = start_pfn;
    479 + arch_zone_highest_possible_pfn[i] = end_pfn;
    480 +
    481 + start_pfn = end_pfn;
    482 }
    483 arch_zone_lowest_possible_pfn[ZONE_MOVABLE] = 0;
    484 arch_zone_highest_possible_pfn[ZONE_MOVABLE] = 0;
    485 diff --git a/net/core/dev.c b/net/core/dev.c
    486 index 9ca749c81b6c..6f203c7fb166 100644
    487 --- a/net/core/dev.c
    488 +++ b/net/core/dev.c
    489 @@ -4187,7 +4187,9 @@ static void skb_gro_reset_offset(struct sk_buff *skb)
    490 pinfo->nr_frags &&
    491 !PageHighMem(skb_frag_page(frag0))) {
    492 NAPI_GRO_CB(skb)->frag0 = skb_frag_address(frag0);
    493 - NAPI_GRO_CB(skb)->frag0_len = skb_frag_size(frag0);
    494 + NAPI_GRO_CB(skb)->frag0_len = min_t(unsigned int,
    495 + skb_frag_size(frag0),
    496 + skb->end - skb->tail);
    497 }
    498 }
    499
    500 diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
    501 index 252e155c837b..a2270188b864 100644
    502 --- a/net/core/drop_monitor.c
    503 +++ b/net/core/drop_monitor.c
    504 @@ -80,6 +80,7 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
    505 struct nlattr *nla;
    506 struct sk_buff *skb;
    507 unsigned long flags;
    508 + void *msg_header;
    509
    510 al = sizeof(struct net_dm_alert_msg);
    511 al += dm_hit_limit * sizeof(struct net_dm_drop_point);
    512 @@ -87,21 +88,41 @@ static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
    513
    514 skb = genlmsg_new(al, GFP_KERNEL);
    515
    516 - if (skb) {
    517 - genlmsg_put(skb, 0, 0, &net_drop_monitor_family,
    518 - 0, NET_DM_CMD_ALERT);
    519 - nla = nla_reserve(skb, NLA_UNSPEC,
    520 - sizeof(struct net_dm_alert_msg));
    521 - msg = nla_data(nla);
    522 - memset(msg, 0, al);
    523 - } else {
    524 - mod_timer(&data->send_timer, jiffies + HZ / 10);
    525 + if (!skb)
    526 + goto err;
    527 +
    528 + msg_header = genlmsg_put(skb, 0, 0, &net_drop_monitor_family,
    529 + 0, NET_DM_CMD_ALERT);
    530 + if (!msg_header) {
    531 + nlmsg_free(skb);
    532 + skb = NULL;
    533 + goto err;
    534 + }
    535 + nla = nla_reserve(skb, NLA_UNSPEC,
    536 + sizeof(struct net_dm_alert_msg));
    537 + if (!nla) {
    538 + nlmsg_free(skb);
    539 + skb = NULL;
    540 + goto err;
    541 }
    542 + msg = nla_data(nla);
    543 + memset(msg, 0, al);
    544 + goto out;
    545
    546 +err:
    547 + mod_timer(&data->send_timer, jiffies + HZ / 10);
    548 +out:
    549 spin_lock_irqsave(&data->lock, flags);
    550 swap(data->skb, skb);
    551 spin_unlock_irqrestore(&data->lock, flags);
    552
    553 + if (skb) {
    554 + struct nlmsghdr *nlh = (struct nlmsghdr *)skb->data;
    555 + struct genlmsghdr *gnlh = (struct genlmsghdr *)nlmsg_data(nlh);
    556 +
    557 + genlmsg_end(skb, genlmsg_data(gnlh));
    558 + }
    559 +
    560 return skb;
    561 }
    562
    563 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
    564 index 63566ec54794..4e60dae86df5 100644
    565 --- a/net/ipv4/fib_frontend.c
    566 +++ b/net/ipv4/fib_frontend.c
    567 @@ -85,7 +85,7 @@ struct fib_table *fib_new_table(struct net *net, u32 id)
    568 if (tb)
    569 return tb;
    570
    571 - if (id == RT_TABLE_LOCAL)
    572 + if (id == RT_TABLE_LOCAL && !net->ipv4.fib_has_custom_rules)
    573 alias = fib_new_table(net, RT_TABLE_MAIN);
    574
    575 tb = fib_trie_table(id, alias);
    576 diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
    577 index ffe95d954007..840b450aab46 100644
    578 --- a/net/ipv4/fib_semantics.c
    579 +++ b/net/ipv4/fib_semantics.c
    580 @@ -1588,8 +1588,13 @@ void fib_select_multipath(struct fib_result *res, int hash)
    581 void fib_select_path(struct net *net, struct fib_result *res,
    582 struct flowi4 *fl4, int mp_hash)
    583 {
    584 + bool oif_check;
    585 +
    586 + oif_check = (fl4->flowi4_oif == 0 ||
    587 + fl4->flowi4_flags & FLOWI_FLAG_SKIP_NH_OIF);
    588 +
    589 #ifdef CONFIG_IP_ROUTE_MULTIPATH
    590 - if (res->fi->fib_nhs > 1 && fl4->flowi4_oif == 0) {
    591 + if (res->fi->fib_nhs > 1 && oif_check) {
    592 if (mp_hash < 0)
    593 mp_hash = get_hash_from_flowi4(fl4) >> 1;
    594
    595 @@ -1599,7 +1604,7 @@ void fib_select_path(struct net *net, struct fib_result *res,
    596 #endif
    597 if (!res->prefixlen &&
    598 res->table->tb_num_default > 1 &&
    599 - res->type == RTN_UNICAST && !fl4->flowi4_oif)
    600 + res->type == RTN_UNICAST && oif_check)
    601 fib_select_default(fl4, res);
    602
    603 if (!fl4->saddr)
    604 diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
    605 index b3086cf27027..17adfdaf5795 100644
    606 --- a/net/ipv4/igmp.c
    607 +++ b/net/ipv4/igmp.c
    608 @@ -225,9 +225,14 @@ static void igmp_start_timer(struct ip_mc_list *im, int max_delay)
    609 static void igmp_gq_start_timer(struct in_device *in_dev)
    610 {
    611 int tv = prandom_u32() % in_dev->mr_maxdelay;
    612 + unsigned long exp = jiffies + tv + 2;
    613 +
    614 + if (in_dev->mr_gq_running &&
    615 + time_after_eq(exp, (in_dev->mr_gq_timer).expires))
    616 + return;
    617
    618 in_dev->mr_gq_running = 1;
    619 - if (!mod_timer(&in_dev->mr_gq_timer, jiffies+tv+2))
    620 + if (!mod_timer(&in_dev->mr_gq_timer, exp))
    621 in_dev_hold(in_dev);
    622 }
    623
    624 diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
    625 index efe6268b8bc3..225f5f7f26ba 100644
    626 --- a/net/ipv6/ip6_offload.c
    627 +++ b/net/ipv6/ip6_offload.c
    628 @@ -196,6 +196,7 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
    629 ops = rcu_dereference(inet6_offloads[proto]);
    630 if (!ops || !ops->callbacks.gro_receive) {
    631 __pskb_pull(skb, skb_gro_offset(skb));
    632 + skb_gro_frag0_invalidate(skb);
    633 proto = ipv6_gso_pull_exthdrs(skb, proto);
    634 skb_gro_pull(skb, -skb_transport_offset(skb));
    635 skb_reset_transport_header(skb);
    636 diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
    637 index 99140986e887..8bca90d6d915 100644
    638 --- a/net/ipv6/raw.c
    639 +++ b/net/ipv6/raw.c
    640 @@ -589,7 +589,11 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
    641 }
    642
    643 offset += skb_transport_offset(skb);
    644 - BUG_ON(skb_copy_bits(skb, offset, &csum, 2));
    645 + err = skb_copy_bits(skb, offset, &csum, 2);
    646 + if (err < 0) {
    647 + ip6_flush_pending_frames(sk);
    648 + goto out;
    649 + }
    650
    651 /* in case cksum was not initialized */
    652 if (unlikely(csum))
    653 diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
    654 index ecc1904e454f..20b2f867c5a1 100644
    655 --- a/net/sched/cls_api.c
    656 +++ b/net/sched/cls_api.c
    657 @@ -137,13 +137,15 @@ static int tc_ctl_tfilter(struct sk_buff *skb, struct nlmsghdr *n)
    658 unsigned long cl;
    659 unsigned long fh;
    660 int err;
    661 - int tp_created = 0;
    662 + int tp_created;
    663
    664 if ((n->nlmsg_type != RTM_GETTFILTER) &&
    665 !netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN))
    666 return -EPERM;
    667
    668 replay:
    669 + tp_created = 0;
    670 +
    671 err = nlmsg_parse(n, sizeof(*t), tca, TCA_MAX, NULL);
    672 if (err < 0)
    673 return err;
    674 diff --git a/sound/firewire/tascam/tascam-stream.c b/sound/firewire/tascam/tascam-stream.c
    675 index 0e6dd5c61f53..e4c306398b35 100644
    676 --- a/sound/firewire/tascam/tascam-stream.c
    677 +++ b/sound/firewire/tascam/tascam-stream.c
    678 @@ -343,7 +343,7 @@ int snd_tscm_stream_init_duplex(struct snd_tscm *tscm)
    679 if (err < 0)
    680 amdtp_stream_destroy(&tscm->rx_stream);
    681
    682 - return 0;
    683 + return err;
    684 }
    685
    686 /* At bus reset, streaming is stopped and some registers are clear. */
    687 diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
    688 index 3039e907f1f8..29f38e2b4ca9 100644
    689 --- a/sound/usb/quirks.c
    690 +++ b/sound/usb/quirks.c
    691 @@ -1136,6 +1136,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
    692 case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
    693 case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
    694 case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
    695 + case USB_ID(0x047F, 0x02F7): /* Plantronics BT-600 */
    696 case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
    697 case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
    698 case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */