Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0200-4.9.101-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0200-4.9.101-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3177 - (show annotations) (download)
    Wed Aug 8 14:17:30 2018 UTC (5 years, 8 months ago) by niro
    File size: 66199 byte(s) 
    -linux-4.9.101
    1 diff --git a/Makefile b/Makefile
    2 index 52a41396680c..7d7bda23db8f 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 100
    9 +SUBLEVEL = 101
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/alpha/include/asm/futex.h b/arch/alpha/include/asm/futex.h
    14 index f939794363ac..56474690e685 100644
    15 --- a/arch/alpha/include/asm/futex.h
    16 +++ b/arch/alpha/include/asm/futex.h
    17 @@ -29,18 +29,10 @@
    18 : "r" (uaddr), "r"(oparg) \
    19 : "memory")
    20
    21 -static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    22 +static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
    23 + u32 __user *uaddr)
    24 {
    25 - int op = (encoded_op >> 28) & 7;
    26 - int cmp = (encoded_op >> 24) & 15;
    27 - int oparg = (encoded_op << 8) >> 20;
    28 - int cmparg = (encoded_op << 20) >> 20;
    29 int oldval = 0, ret;
    30 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    31 - oparg = 1 << oparg;
    32 -
    33 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    34 - return -EFAULT;
    35
    36 pagefault_disable();
    37
    38 @@ -66,17 +58,9 @@ static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    39
    40 pagefault_enable();
    41
    42 - if (!ret) {
    43 - switch (cmp) {
    44 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    45 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    46 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    47 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    48 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    49 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    50 - default: ret = -ENOSYS;
    51 - }
    52 - }
    53 + if (!ret)
    54 + *oval = oldval;
    55 +
    56 return ret;
    57 }
    58
    59 diff --git a/arch/arc/include/asm/futex.h b/arch/arc/include/asm/futex.h
    60 index 11e1b1f3acda..eb887dd13e74 100644
    61 --- a/arch/arc/include/asm/futex.h
    62 +++ b/arch/arc/include/asm/futex.h
    63 @@ -73,20 +73,11 @@
    64
    65 #endif
    66
    67 -static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    68 +static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
    69 + u32 __user *uaddr)
    70 {
    71 - int op = (encoded_op >> 28) & 7;
    72 - int cmp = (encoded_op >> 24) & 15;
    73 - int oparg = (encoded_op << 8) >> 20;
    74 - int cmparg = (encoded_op << 20) >> 20;
    75 int oldval = 0, ret;
    76
    77 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    78 - oparg = 1 << oparg;
    79 -
    80 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
    81 - return -EFAULT;
    82 -
    83 #ifndef CONFIG_ARC_HAS_LLSC
    84 preempt_disable(); /* to guarantee atomic r-m-w of futex op */
    85 #endif
    86 @@ -118,30 +109,9 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    87 preempt_enable();
    88 #endif
    89
    90 - if (!ret) {
    91 - switch (cmp) {
    92 - case FUTEX_OP_CMP_EQ:
    93 - ret = (oldval == cmparg);
    94 - break;
    95 - case FUTEX_OP_CMP_NE:
    96 - ret = (oldval != cmparg);
    97 - break;
    98 - case FUTEX_OP_CMP_LT:
    99 - ret = (oldval < cmparg);
    100 - break;
    101 - case FUTEX_OP_CMP_GE:
    102 - ret = (oldval >= cmparg);
    103 - break;
    104 - case FUTEX_OP_CMP_LE:
    105 - ret = (oldval <= cmparg);
    106 - break;
    107 - case FUTEX_OP_CMP_GT:
    108 - ret = (oldval > cmparg);
    109 - break;
    110 - default:
    111 - ret = -ENOSYS;
    112 - }
    113 - }
    114 + if (!ret)
    115 + *oval = oldval;
    116 +
    117 return ret;
    118 }
    119
    120 diff --git a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
    121 index 47c955458a77..2b9c2be436f9 100644
    122 --- a/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
    123 +++ b/arch/arm/boot/dts/imx6qdl-wandboard.dtsi
    124 @@ -88,7 +88,6 @@
    125 clocks = <&clks IMX6QDL_CLK_CKO>;
    126 VDDA-supply = <&reg_2p5v>;
    127 VDDIO-supply = <&reg_3p3v>;
    128 - lrclk-strength = <3>;
    129 };
    130 };
    131
    132 diff --git a/arch/arm/include/asm/futex.h b/arch/arm/include/asm/futex.h
    133 index 6795368ad023..cc414382dab4 100644
    134 --- a/arch/arm/include/asm/futex.h
    135 +++ b/arch/arm/include/asm/futex.h
    136 @@ -128,20 +128,10 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
    137 #endif /* !SMP */
    138
    139 static inline int
    140 -futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    141 +arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
    142 {
    143 - int op = (encoded_op >> 28) & 7;
    144 - int cmp = (encoded_op >> 24) & 15;
    145 - int oparg = (encoded_op << 8) >> 20;
    146 - int cmparg = (encoded_op << 20) >> 20;
    147 int oldval = 0, ret, tmp;
    148
    149 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    150 - oparg = 1 << oparg;
    151 -
    152 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    153 - return -EFAULT;
    154 -
    155 #ifndef CONFIG_SMP
    156 preempt_disable();
    157 #endif
    158 @@ -172,17 +162,9 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    159 preempt_enable();
    160 #endif
    161
    162 - if (!ret) {
    163 - switch (cmp) {
    164 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    165 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    166 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    167 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    168 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    169 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    170 - default: ret = -ENOSYS;
    171 - }
    172 - }
    173 + if (!ret)
    174 + *oval = oldval;
    175 +
    176 return ret;
    177 }
    178
    179 diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
    180 index 4e5f36a804b4..2a5090fb9113 100644
    181 --- a/arch/arm64/include/asm/futex.h
    182 +++ b/arch/arm64/include/asm/futex.h
    183 @@ -51,20 +51,9 @@
    184 : "memory")
    185
    186 static inline int
    187 -futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *_uaddr)
    188 +arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
    189 {
    190 - int op = (encoded_op >> 28) & 7;
    191 - int cmp = (encoded_op >> 24) & 15;
    192 - int oparg = (int)(encoded_op << 8) >> 20;
    193 - int cmparg = (int)(encoded_op << 20) >> 20;
    194 int oldval = 0, ret, tmp;
    195 - u32 __user *uaddr = __uaccess_mask_ptr(_uaddr);
    196 -
    197 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    198 - oparg = 1U << (oparg & 0x1f);
    199 -
    200 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    201 - return -EFAULT;
    202
    203 pagefault_disable();
    204
    205 @@ -95,17 +84,9 @@ futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *_uaddr)
    206
    207 pagefault_enable();
    208
    209 - if (!ret) {
    210 - switch (cmp) {
    211 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    212 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    213 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    214 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    215 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    216 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    217 - default: ret = -ENOSYS;
    218 - }
    219 - }
    220 + if (!ret)
    221 + *oval = oldval;
    222 +
    223 return ret;
    224 }
    225
    226 diff --git a/arch/frv/include/asm/futex.h b/arch/frv/include/asm/futex.h
    227 index 4bea27f50a7a..2702bd802d44 100644
    228 --- a/arch/frv/include/asm/futex.h
    229 +++ b/arch/frv/include/asm/futex.h
    230 @@ -7,7 +7,8 @@
    231 #include <asm/errno.h>
    232 #include <asm/uaccess.h>
    233
    234 -extern int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr);
    235 +extern int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
    236 + u32 __user *uaddr);
    237
    238 static inline int
    239 futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
    240 diff --git a/arch/frv/kernel/futex.c b/arch/frv/kernel/futex.c
    241 index d155ca9e5098..37f7b2bf7f73 100644
    242 --- a/arch/frv/kernel/futex.c
    243 +++ b/arch/frv/kernel/futex.c
    244 @@ -186,20 +186,10 @@ static inline int atomic_futex_op_xchg_xor(int oparg, u32 __user *uaddr, int *_o
    245 /*
    246 * do the futex operations
    247 */
    248 -int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    249 +int arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
    250 {
    251 - int op = (encoded_op >> 28) & 7;
    252 - int cmp = (encoded_op >> 24) & 15;
    253 - int oparg = (encoded_op << 8) >> 20;
    254 - int cmparg = (encoded_op << 20) >> 20;
    255 int oldval = 0, ret;
    256
    257 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    258 - oparg = 1 << oparg;
    259 -
    260 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    261 - return -EFAULT;
    262 -
    263 pagefault_disable();
    264
    265 switch (op) {
    266 @@ -225,18 +215,9 @@ int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    267
    268 pagefault_enable();
    269
    270 - if (!ret) {
    271 - switch (cmp) {
    272 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    273 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    274 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    275 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    276 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    277 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    278 - default: ret = -ENOSYS; break;
    279 - }
    280 - }
    281 + if (!ret)
    282 + *oval = oldval;
    283
    284 return ret;
    285
    286 -} /* end futex_atomic_op_inuser() */
    287 +} /* end arch_futex_atomic_op_inuser() */
    288 diff --git a/arch/hexagon/include/asm/futex.h b/arch/hexagon/include/asm/futex.h
    289 index 7e597f8434da..c607b77c8215 100644
    290 --- a/arch/hexagon/include/asm/futex.h
    291 +++ b/arch/hexagon/include/asm/futex.h
    292 @@ -31,18 +31,9 @@
    293
    294
    295 static inline int
    296 -futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
    297 +arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
    298 {
    299 - int op = (encoded_op >> 28) & 7;
    300 - int cmp = (encoded_op >> 24) & 15;
    301 - int oparg = (encoded_op << 8) >> 20;
    302 - int cmparg = (encoded_op << 20) >> 20;
    303 int oldval = 0, ret;
    304 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    305 - oparg = 1 << oparg;
    306 -
    307 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
    308 - return -EFAULT;
    309
    310 pagefault_disable();
    311
    312 @@ -72,30 +63,9 @@ futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
    313
    314 pagefault_enable();
    315
    316 - if (!ret) {
    317 - switch (cmp) {
    318 - case FUTEX_OP_CMP_EQ:
    319 - ret = (oldval == cmparg);
    320 - break;
    321 - case FUTEX_OP_CMP_NE:
    322 - ret = (oldval != cmparg);
    323 - break;
    324 - case FUTEX_OP_CMP_LT:
    325 - ret = (oldval < cmparg);
    326 - break;
    327 - case FUTEX_OP_CMP_GE:
    328 - ret = (oldval >= cmparg);
    329 - break;
    330 - case FUTEX_OP_CMP_LE:
    331 - ret = (oldval <= cmparg);
    332 - break;
    333 - case FUTEX_OP_CMP_GT:
    334 - ret = (oldval > cmparg);
    335 - break;
    336 - default:
    337 - ret = -ENOSYS;
    338 - }
    339 - }
    340 + if (!ret)
    341 + *oval = oldval;
    342 +
    343 return ret;
    344 }
    345
    346 diff --git a/arch/ia64/include/asm/futex.h b/arch/ia64/include/asm/futex.h
    347 index 76acbcd5c060..6d67dc1eaf2b 100644
    348 --- a/arch/ia64/include/asm/futex.h
    349 +++ b/arch/ia64/include/asm/futex.h
    350 @@ -45,18 +45,9 @@ do { \
    351 } while (0)
    352
    353 static inline int
    354 -futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    355 +arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
    356 {
    357 - int op = (encoded_op >> 28) & 7;
    358 - int cmp = (encoded_op >> 24) & 15;
    359 - int oparg = (encoded_op << 8) >> 20;
    360 - int cmparg = (encoded_op << 20) >> 20;
    361 int oldval = 0, ret;
    362 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    363 - oparg = 1 << oparg;
    364 -
    365 - if (! access_ok (VERIFY_WRITE, uaddr, sizeof(u32)))
    366 - return -EFAULT;
    367
    368 pagefault_disable();
    369
    370 @@ -84,17 +75,9 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    371
    372 pagefault_enable();
    373
    374 - if (!ret) {
    375 - switch (cmp) {
    376 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    377 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    378 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    379 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    380 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    381 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    382 - default: ret = -ENOSYS;
    383 - }
    384 - }
    385 + if (!ret)
    386 + *oval = oldval;
    387 +
    388 return ret;
    389 }
    390
    391 diff --git a/arch/microblaze/include/asm/futex.h b/arch/microblaze/include/asm/futex.h
    392 index 01848f056f43..a9dad9e5e132 100644
    393 --- a/arch/microblaze/include/asm/futex.h
    394 +++ b/arch/microblaze/include/asm/futex.h
    395 @@ -29,18 +29,9 @@
    396 })
    397
    398 static inline int
    399 -futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    400 +arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
    401 {
    402 - int op = (encoded_op >> 28) & 7;
    403 - int cmp = (encoded_op >> 24) & 15;
    404 - int oparg = (encoded_op << 8) >> 20;
    405 - int cmparg = (encoded_op << 20) >> 20;
    406 int oldval = 0, ret;
    407 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    408 - oparg = 1 << oparg;
    409 -
    410 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    411 - return -EFAULT;
    412
    413 pagefault_disable();
    414
    415 @@ -66,30 +57,9 @@ futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    416
    417 pagefault_enable();
    418
    419 - if (!ret) {
    420 - switch (cmp) {
    421 - case FUTEX_OP_CMP_EQ:
    422 - ret = (oldval == cmparg);
    423 - break;
    424 - case FUTEX_OP_CMP_NE:
    425 - ret = (oldval != cmparg);
    426 - break;
    427 - case FUTEX_OP_CMP_LT:
    428 - ret = (oldval < cmparg);
    429 - break;
    430 - case FUTEX_OP_CMP_GE:
    431 - ret = (oldval >= cmparg);
    432 - break;
    433 - case FUTEX_OP_CMP_LE:
    434 - ret = (oldval <= cmparg);
    435 - break;
    436 - case FUTEX_OP_CMP_GT:
    437 - ret = (oldval > cmparg);
    438 - break;
    439 - default:
    440 - ret = -ENOSYS;
    441 - }
    442 - }
    443 + if (!ret)
    444 + *oval = oldval;
    445 +
    446 return ret;
    447 }
    448
    449 diff --git a/arch/mips/include/asm/futex.h b/arch/mips/include/asm/futex.h
    450 index 1de190bdfb9c..a9e61ea54ca9 100644
    451 --- a/arch/mips/include/asm/futex.h
    452 +++ b/arch/mips/include/asm/futex.h
    453 @@ -83,18 +83,9 @@
    454 }
    455
    456 static inline int
    457 -futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    458 +arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
    459 {
    460 - int op = (encoded_op >> 28) & 7;
    461 - int cmp = (encoded_op >> 24) & 15;
    462 - int oparg = (encoded_op << 8) >> 20;
    463 - int cmparg = (encoded_op << 20) >> 20;
    464 int oldval = 0, ret;
    465 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    466 - oparg = 1 << oparg;
    467 -
    468 - if (! access_ok (VERIFY_WRITE, uaddr, sizeof(u32)))
    469 - return -EFAULT;
    470
    471 pagefault_disable();
    472
    473 @@ -125,17 +116,9 @@ futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    474
    475 pagefault_enable();
    476
    477 - if (!ret) {
    478 - switch (cmp) {
    479 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    480 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    481 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    482 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    483 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    484 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    485 - default: ret = -ENOSYS;
    486 - }
    487 - }
    488 + if (!ret)
    489 + *oval = oldval;
    490 +
    491 return ret;
    492 }
    493
    494 diff --git a/arch/parisc/include/asm/futex.h b/arch/parisc/include/asm/futex.h
    495 index ac8bd586ace8..06a1a883c72f 100644
    496 --- a/arch/parisc/include/asm/futex.h
    497 +++ b/arch/parisc/include/asm/futex.h
    498 @@ -32,22 +32,12 @@ _futex_spin_unlock_irqrestore(u32 __user *uaddr, unsigned long int *flags)
    499 }
    500
    501 static inline int
    502 -futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    503 +arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
    504 {
    505 unsigned long int flags;
    506 - int op = (encoded_op >> 28) & 7;
    507 - int cmp = (encoded_op >> 24) & 15;
    508 - int oparg = (encoded_op << 8) >> 20;
    509 - int cmparg = (encoded_op << 20) >> 20;
    510 int oldval, ret;
    511 u32 tmp;
    512
    513 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    514 - oparg = 1 << oparg;
    515 -
    516 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(*uaddr)))
    517 - return -EFAULT;
    518 -
    519 _futex_spin_lock_irqsave(uaddr, &flags);
    520 pagefault_disable();
    521
    522 @@ -85,17 +75,9 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    523 pagefault_enable();
    524 _futex_spin_unlock_irqrestore(uaddr, &flags);
    525
    526 - if (ret == 0) {
    527 - switch (cmp) {
    528 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    529 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    530 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    531 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    532 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    533 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    534 - default: ret = -ENOSYS;
    535 - }
    536 - }
    537 + if (!ret)
    538 + *oval = oldval;
    539 +
    540 return ret;
    541 }
    542
    543 diff --git a/arch/powerpc/include/asm/futex.h b/arch/powerpc/include/asm/futex.h
    544 index 2a9cf845473b..f4c7467f7465 100644
    545 --- a/arch/powerpc/include/asm/futex.h
    546 +++ b/arch/powerpc/include/asm/futex.h
    547 @@ -31,18 +31,10 @@
    548 : "b" (uaddr), "i" (-EFAULT), "r" (oparg) \
    549 : "cr0", "memory")
    550
    551 -static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    552 +static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
    553 + u32 __user *uaddr)
    554 {
    555 - int op = (encoded_op >> 28) & 7;
    556 - int cmp = (encoded_op >> 24) & 15;
    557 - int oparg = (encoded_op << 8) >> 20;
    558 - int cmparg = (encoded_op << 20) >> 20;
    559 int oldval = 0, ret;
    560 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    561 - oparg = 1 << oparg;
    562 -
    563 - if (! access_ok (VERIFY_WRITE, uaddr, sizeof(u32)))
    564 - return -EFAULT;
    565
    566 pagefault_disable();
    567
    568 @@ -68,17 +60,9 @@ static inline int futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    569
    570 pagefault_enable();
    571
    572 - if (!ret) {
    573 - switch (cmp) {
    574 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    575 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    576 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    577 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    578 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    579 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    580 - default: ret = -ENOSYS;
    581 - }
    582 - }
    583 + if (!ret)
    584 + *oval = oldval;
    585 +
    586 return ret;
    587 }
    588
    589 diff --git a/arch/s390/include/asm/futex.h b/arch/s390/include/asm/futex.h
    590 index a4811aa0304d..8f8eec9e1198 100644
    591 --- a/arch/s390/include/asm/futex.h
    592 +++ b/arch/s390/include/asm/futex.h
    593 @@ -21,17 +21,12 @@
    594 : "0" (-EFAULT), "d" (oparg), "a" (uaddr), \
    595 "m" (*uaddr) : "cc");
    596
    597 -static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    598 +static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
    599 + u32 __user *uaddr)
    600 {
    601 - int op = (encoded_op >> 28) & 7;
    602 - int cmp = (encoded_op >> 24) & 15;
    603 - int oparg = (encoded_op << 8) >> 20;
    604 - int cmparg = (encoded_op << 20) >> 20;
    605 int oldval = 0, newval, ret;
    606
    607 load_kernel_asce();
    608 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    609 - oparg = 1 << oparg;
    610
    611 pagefault_disable();
    612 switch (op) {
    613 @@ -60,17 +55,9 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    614 }
    615 pagefault_enable();
    616
    617 - if (!ret) {
    618 - switch (cmp) {
    619 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    620 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    621 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    622 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    623 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    624 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    625 - default: ret = -ENOSYS;
    626 - }
    627 - }
    628 + if (!ret)
    629 + *oval = oldval;
    630 +
    631 return ret;
    632 }
    633
    634 diff --git a/arch/sh/include/asm/futex.h b/arch/sh/include/asm/futex.h
    635 index d0078747d308..8f8cf941a8cd 100644
    636 --- a/arch/sh/include/asm/futex.h
    637 +++ b/arch/sh/include/asm/futex.h
    638 @@ -27,21 +27,12 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
    639 return atomic_futex_op_cmpxchg_inatomic(uval, uaddr, oldval, newval);
    640 }
    641
    642 -static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    643 +static inline int arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval,
    644 + u32 __user *uaddr)
    645 {
    646 - int op = (encoded_op >> 28) & 7;
    647 - int cmp = (encoded_op >> 24) & 15;
    648 - u32 oparg = (encoded_op << 8) >> 20;
    649 - u32 cmparg = (encoded_op << 20) >> 20;
    650 u32 oldval, newval, prev;
    651 int ret;
    652
    653 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    654 - oparg = 1 << oparg;
    655 -
    656 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    657 - return -EFAULT;
    658 -
    659 pagefault_disable();
    660
    661 do {
    662 @@ -80,17 +71,8 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    663
    664 pagefault_enable();
    665
    666 - if (!ret) {
    667 - switch (cmp) {
    668 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    669 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    670 - case FUTEX_OP_CMP_LT: ret = ((int)oldval < (int)cmparg); break;
    671 - case FUTEX_OP_CMP_GE: ret = ((int)oldval >= (int)cmparg); break;
    672 - case FUTEX_OP_CMP_LE: ret = ((int)oldval <= (int)cmparg); break;
    673 - case FUTEX_OP_CMP_GT: ret = ((int)oldval > (int)cmparg); break;
    674 - default: ret = -ENOSYS;
    675 - }
    676 - }
    677 + if (!ret)
    678 + *oval = oldval;
    679
    680 return ret;
    681 }
    682 diff --git a/arch/sparc/include/asm/futex_64.h b/arch/sparc/include/asm/futex_64.h
    683 index 4e899b0dabf7..1cfd89d92208 100644
    684 --- a/arch/sparc/include/asm/futex_64.h
    685 +++ b/arch/sparc/include/asm/futex_64.h
    686 @@ -29,22 +29,14 @@
    687 : "r" (uaddr), "r" (oparg), "i" (-EFAULT) \
    688 : "memory")
    689
    690 -static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    691 +static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
    692 + u32 __user *uaddr)
    693 {
    694 - int op = (encoded_op >> 28) & 7;
    695 - int cmp = (encoded_op >> 24) & 15;
    696 - int oparg = (encoded_op << 8) >> 20;
    697 - int cmparg = (encoded_op << 20) >> 20;
    698 int oldval = 0, ret, tem;
    699
    700 - if (unlikely(!access_ok(VERIFY_WRITE, uaddr, sizeof(u32))))
    701 - return -EFAULT;
    702 if (unlikely((((unsigned long) uaddr) & 0x3UL)))
    703 return -EINVAL;
    704
    705 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    706 - oparg = 1 << oparg;
    707 -
    708 pagefault_disable();
    709
    710 switch (op) {
    711 @@ -69,17 +61,9 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    712
    713 pagefault_enable();
    714
    715 - if (!ret) {
    716 - switch (cmp) {
    717 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    718 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    719 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    720 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    721 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    722 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    723 - default: ret = -ENOSYS;
    724 - }
    725 - }
    726 + if (!ret)
    727 + *oval = oldval;
    728 +
    729 return ret;
    730 }
    731
    732 diff --git a/arch/tile/include/asm/futex.h b/arch/tile/include/asm/futex.h
    733 index e64a1b75fc38..83c1e639b411 100644
    734 --- a/arch/tile/include/asm/futex.h
    735 +++ b/arch/tile/include/asm/futex.h
    736 @@ -106,12 +106,9 @@
    737 lock = __atomic_hashed_lock((int __force *)uaddr)
    738 #endif
    739
    740 -static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    741 +static inline int arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval,
    742 + u32 __user *uaddr)
    743 {
    744 - int op = (encoded_op >> 28) & 7;
    745 - int cmp = (encoded_op >> 24) & 15;
    746 - int oparg = (encoded_op << 8) >> 20;
    747 - int cmparg = (encoded_op << 20) >> 20;
    748 int uninitialized_var(val), ret;
    749
    750 __futex_prolog();
    751 @@ -119,12 +116,6 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    752 /* The 32-bit futex code makes this assumption, so validate it here. */
    753 BUILD_BUG_ON(sizeof(atomic_t) != sizeof(int));
    754
    755 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    756 - oparg = 1 << oparg;
    757 -
    758 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    759 - return -EFAULT;
    760 -
    761 pagefault_disable();
    762 switch (op) {
    763 case FUTEX_OP_SET:
    764 @@ -148,30 +139,9 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    765 }
    766 pagefault_enable();
    767
    768 - if (!ret) {
    769 - switch (cmp) {
    770 - case FUTEX_OP_CMP_EQ:
    771 - ret = (val == cmparg);
    772 - break;
    773 - case FUTEX_OP_CMP_NE:
    774 - ret = (val != cmparg);
    775 - break;
    776 - case FUTEX_OP_CMP_LT:
    777 - ret = (val < cmparg);
    778 - break;
    779 - case FUTEX_OP_CMP_GE:
    780 - ret = (val >= cmparg);
    781 - break;
    782 - case FUTEX_OP_CMP_LE:
    783 - ret = (val <= cmparg);
    784 - break;
    785 - case FUTEX_OP_CMP_GT:
    786 - ret = (val > cmparg);
    787 - break;
    788 - default:
    789 - ret = -ENOSYS;
    790 - }
    791 - }
    792 + if (!ret)
    793 + *oval = val;
    794 +
    795 return ret;
    796 }
    797
    798 diff --git a/arch/x86/include/asm/futex.h b/arch/x86/include/asm/futex.h
    799 index b4c1f5453436..f4dc9b63bdda 100644
    800 --- a/arch/x86/include/asm/futex.h
    801 +++ b/arch/x86/include/asm/futex.h
    802 @@ -41,20 +41,11 @@
    803 "+m" (*uaddr), "=&r" (tem) \
    804 : "r" (oparg), "i" (-EFAULT), "1" (0))
    805
    806 -static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    807 +static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
    808 + u32 __user *uaddr)
    809 {
    810 - int op = (encoded_op >> 28) & 7;
    811 - int cmp = (encoded_op >> 24) & 15;
    812 - int oparg = (encoded_op << 8) >> 20;
    813 - int cmparg = (encoded_op << 20) >> 20;
    814 int oldval = 0, ret, tem;
    815
    816 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    817 - oparg = 1 << oparg;
    818 -
    819 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    820 - return -EFAULT;
    821 -
    822 pagefault_disable();
    823
    824 switch (op) {
    825 @@ -80,30 +71,9 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    826
    827 pagefault_enable();
    828
    829 - if (!ret) {
    830 - switch (cmp) {
    831 - case FUTEX_OP_CMP_EQ:
    832 - ret = (oldval == cmparg);
    833 - break;
    834 - case FUTEX_OP_CMP_NE:
    835 - ret = (oldval != cmparg);
    836 - break;
    837 - case FUTEX_OP_CMP_LT:
    838 - ret = (oldval < cmparg);
    839 - break;
    840 - case FUTEX_OP_CMP_GE:
    841 - ret = (oldval >= cmparg);
    842 - break;
    843 - case FUTEX_OP_CMP_LE:
    844 - ret = (oldval <= cmparg);
    845 - break;
    846 - case FUTEX_OP_CMP_GT:
    847 - ret = (oldval > cmparg);
    848 - break;
    849 - default:
    850 - ret = -ENOSYS;
    851 - }
    852 - }
    853 + if (!ret)
    854 + *oval = oldval;
    855 +
    856 return ret;
    857 }
    858
    859 diff --git a/arch/xtensa/include/asm/futex.h b/arch/xtensa/include/asm/futex.h
    860 index 72bfc1cbc2b5..5bfbc1c401d4 100644
    861 --- a/arch/xtensa/include/asm/futex.h
    862 +++ b/arch/xtensa/include/asm/futex.h
    863 @@ -44,18 +44,10 @@
    864 : "r" (uaddr), "I" (-EFAULT), "r" (oparg) \
    865 : "memory")
    866
    867 -static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    868 +static inline int arch_futex_atomic_op_inuser(int op, int oparg, int *oval,
    869 + u32 __user *uaddr)
    870 {
    871 - int op = (encoded_op >> 28) & 7;
    872 - int cmp = (encoded_op >> 24) & 15;
    873 - int oparg = (encoded_op << 8) >> 20;
    874 - int cmparg = (encoded_op << 20) >> 20;
    875 int oldval = 0, ret;
    876 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    877 - oparg = 1 << oparg;
    878 -
    879 - if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    880 - return -EFAULT;
    881
    882 #if !XCHAL_HAVE_S32C1I
    883 return -ENOSYS;
    884 @@ -89,19 +81,10 @@ static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    885
    886 pagefault_enable();
    887
    888 - if (ret)
    889 - return ret;
    890 + if (!ret)
    891 + *oval = oldval;
    892
    893 - switch (cmp) {
    894 - case FUTEX_OP_CMP_EQ: return (oldval == cmparg);
    895 - case FUTEX_OP_CMP_NE: return (oldval != cmparg);
    896 - case FUTEX_OP_CMP_LT: return (oldval < cmparg);
    897 - case FUTEX_OP_CMP_GE: return (oldval >= cmparg);
    898 - case FUTEX_OP_CMP_LE: return (oldval <= cmparg);
    899 - case FUTEX_OP_CMP_GT: return (oldval > cmparg);
    900 - }
    901 -
    902 - return -ENOSYS;
    903 + return ret;
    904 }
    905
    906 static inline int
    907 diff --git a/drivers/net/bonding/bond_alb.c b/drivers/net/bonding/bond_alb.c
    908 index 551f0f8dead3..91d8a48e53c3 100644
    909 --- a/drivers/net/bonding/bond_alb.c
    910 +++ b/drivers/net/bonding/bond_alb.c
    911 @@ -450,7 +450,7 @@ static void rlb_update_client(struct rlb_client_info *client_info)
    912 {
    913 int i;
    914
    915 - if (!client_info->slave)
    916 + if (!client_info->slave || !is_valid_ether_addr(client_info->mac_dst))
    917 return;
    918
    919 for (i = 0; i < RLB_ARP_BURST_SIZE; i++) {
    920 @@ -944,6 +944,10 @@ static void alb_send_lp_vid(struct slave *slave, u8 mac_addr[],
    921 skb->priority = TC_PRIO_CONTROL;
    922 skb->dev = slave->dev;
    923
    924 + netdev_dbg(slave->bond->dev,
    925 + "Send learning packet: dev %s mac %pM vlan %d\n",
    926 + slave->dev->name, mac_addr, vid);
    927 +
    928 if (vid)
    929 __vlan_hwaccel_put_tag(skb, vlan_proto, vid);
    930
    931 @@ -966,14 +970,13 @@ static void alb_send_learning_packets(struct slave *slave, u8 mac_addr[],
    932 */
    933 rcu_read_lock();
    934 netdev_for_each_all_upper_dev_rcu(bond->dev, upper, iter) {
    935 - if (is_vlan_dev(upper) && vlan_get_encap_level(upper) == 0) {
    936 - if (strict_match &&
    937 - ether_addr_equal_64bits(mac_addr,
    938 - upper->dev_addr)) {
    939 + if (is_vlan_dev(upper) &&
    940 + bond->nest_level == vlan_get_encap_level(upper) - 1) {
    941 + if (upper->addr_assign_type == NET_ADDR_STOLEN) {
    942 alb_send_lp_vid(slave, mac_addr,
    943 vlan_dev_vlan_proto(upper),
    944 vlan_dev_vlan_id(upper));
    945 - } else if (!strict_match) {
    946 + } else {
    947 alb_send_lp_vid(slave, upper->dev_addr,
    948 vlan_dev_vlan_proto(upper),
    949 vlan_dev_vlan_id(upper));
    950 diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
    951 index 13a015b8052b..1a139d0f2232 100644
    952 --- a/drivers/net/bonding/bond_main.c
    953 +++ b/drivers/net/bonding/bond_main.c
    954 @@ -1732,6 +1732,8 @@ int bond_enslave(struct net_device *bond_dev, struct net_device *slave_dev)
    955 if (bond_mode_uses_xmit_hash(bond))
    956 bond_update_slave_arr(bond, NULL);
    957
    958 + bond->nest_level = dev_get_nest_level(bond_dev);
    959 +
    960 netdev_info(bond_dev, "Enslaving %s as %s interface with %s link\n",
    961 slave_dev->name,
    962 bond_is_active_slave(new_slave) ? "an active" : "a backup",
    963 diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
    964 index 795a133fb074..4ffbe850d746 100644
    965 --- a/drivers/net/ethernet/broadcom/tg3.c
    966 +++ b/drivers/net/ethernet/broadcom/tg3.c
    967 @@ -8720,14 +8720,15 @@ static void tg3_free_consistent(struct tg3 *tp)
    968 tg3_mem_rx_release(tp);
    969 tg3_mem_tx_release(tp);
    970
    971 - /* Protect tg3_get_stats64() from reading freed tp->hw_stats. */
    972 - tg3_full_lock(tp, 0);
    973 + /* tp->hw_stats can be referenced safely:
    974 + * 1. under rtnl_lock
    975 + * 2. or under tp->lock if TG3_FLAG_INIT_COMPLETE is set.
    976 + */
    977 if (tp->hw_stats) {
    978 dma_free_coherent(&tp->pdev->dev, sizeof(struct tg3_hw_stats),
    979 tp->hw_stats, tp->stats_mapping);
    980 tp->hw_stats = NULL;
    981 }
    982 - tg3_full_unlock(tp);
    983 }
    984
    985 /*
    986 @@ -14161,7 +14162,7 @@ static struct rtnl_link_stats64 *tg3_get_stats64(struct net_device *dev,
    987 struct tg3 *tp = netdev_priv(dev);
    988
    989 spin_lock_bh(&tp->lock);
    990 - if (!tp->hw_stats) {
    991 + if (!tp->hw_stats || !tg3_flag(tp, INIT_COMPLETE)) {
    992 *stats = tp->net_stats_prev;
    993 spin_unlock_bh(&tp->lock);
    994 return stats;
    995 diff --git a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
    996 index 24977cc881d2..9a4c4f8281bd 100644
    997 --- a/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
    998 +++ b/drivers/net/ethernet/mellanox/mlx4/en_ethtool.c
    999 @@ -970,6 +970,22 @@ static int mlx4_en_set_coalesce(struct net_device *dev,
    1000 if (!coal->tx_max_coalesced_frames_irq)
    1001 return -EINVAL;
    1002
    1003 + if (coal->tx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME ||
    1004 + coal->rx_coalesce_usecs > MLX4_EN_MAX_COAL_TIME ||
    1005 + coal->rx_coalesce_usecs_low > MLX4_EN_MAX_COAL_TIME ||
    1006 + coal->rx_coalesce_usecs_high > MLX4_EN_MAX_COAL_TIME) {
    1007 + netdev_info(dev, "%s: maximum coalesce time supported is %d usecs\n",
    1008 + __func__, MLX4_EN_MAX_COAL_TIME);
    1009 + return -ERANGE;
    1010 + }
    1011 +
    1012 + if (coal->tx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS ||
    1013 + coal->rx_max_coalesced_frames > MLX4_EN_MAX_COAL_PKTS) {
    1014 + netdev_info(dev, "%s: maximum coalesced frames supported is %d\n",
    1015 + __func__, MLX4_EN_MAX_COAL_PKTS);
    1016 + return -ERANGE;
    1017 + }
    1018 +
    1019 priv->rx_frames = (coal->rx_max_coalesced_frames ==
    1020 MLX4_EN_AUTO_CONF) ?
    1021 MLX4_EN_RX_COAL_TARGET :
    1022 diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
    1023 index 18f221d8a04d..247d340be743 100644
    1024 --- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
    1025 +++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
    1026 @@ -141,6 +141,9 @@ enum {
    1027 #define MLX4_EN_TX_COAL_PKTS 16
    1028 #define MLX4_EN_TX_COAL_TIME 0x10
    1029
    1030 +#define MLX4_EN_MAX_COAL_PKTS U16_MAX
    1031 +#define MLX4_EN_MAX_COAL_TIME U16_MAX
    1032 +
    1033 #define MLX4_EN_RX_RATE_LOW 400000
    1034 #define MLX4_EN_RX_COAL_TIME_LOW 0
    1035 #define MLX4_EN_RX_RATE_HIGH 450000
    1036 @@ -543,8 +546,8 @@ struct mlx4_en_priv {
    1037 u16 rx_usecs_low;
    1038 u32 pkt_rate_high;
    1039 u16 rx_usecs_high;
    1040 - u16 sample_interval;
    1041 - u16 adaptive_rx_coal;
    1042 + u32 sample_interval;
    1043 + u32 adaptive_rx_coal;
    1044 u32 msg_enable;
    1045 u32 loopback_ok;
    1046 u32 validate_loopback;
    1047 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
    1048 index a8966e6dbe1b..5d6eab19a9d8 100644
    1049 --- a/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
    1050 +++ b/drivers/net/ethernet/mellanox/mlx5/core/eswitch.c
    1051 @@ -1924,26 +1924,35 @@ int mlx5_eswitch_get_vport_stats(struct mlx5_eswitch *esw,
    1052 memset(vf_stats, 0, sizeof(*vf_stats));
    1053 vf_stats->rx_packets =
    1054 MLX5_GET_CTR(out, received_eth_unicast.packets) +
    1055 + MLX5_GET_CTR(out, received_ib_unicast.packets) +
    1056 MLX5_GET_CTR(out, received_eth_multicast.packets) +
    1057 + MLX5_GET_CTR(out, received_ib_multicast.packets) +
    1058 MLX5_GET_CTR(out, received_eth_broadcast.packets);
    1059
    1060 vf_stats->rx_bytes =
    1061 MLX5_GET_CTR(out, received_eth_unicast.octets) +
    1062 + MLX5_GET_CTR(out, received_ib_unicast.octets) +
    1063 MLX5_GET_CTR(out, received_eth_multicast.octets) +
    1064 + MLX5_GET_CTR(out, received_ib_multicast.octets) +
    1065 MLX5_GET_CTR(out, received_eth_broadcast.octets);
    1066
    1067 vf_stats->tx_packets =
    1068 MLX5_GET_CTR(out, transmitted_eth_unicast.packets) +
    1069 + MLX5_GET_CTR(out, transmitted_ib_unicast.packets) +
    1070 MLX5_GET_CTR(out, transmitted_eth_multicast.packets) +
    1071 + MLX5_GET_CTR(out, transmitted_ib_multicast.packets) +
    1072 MLX5_GET_CTR(out, transmitted_eth_broadcast.packets);
    1073
    1074 vf_stats->tx_bytes =
    1075 MLX5_GET_CTR(out, transmitted_eth_unicast.octets) +
    1076 + MLX5_GET_CTR(out, transmitted_ib_unicast.octets) +
    1077 MLX5_GET_CTR(out, transmitted_eth_multicast.octets) +
    1078 + MLX5_GET_CTR(out, transmitted_ib_multicast.octets) +
    1079 MLX5_GET_CTR(out, transmitted_eth_broadcast.octets);
    1080
    1081 vf_stats->multicast =
    1082 - MLX5_GET_CTR(out, received_eth_multicast.packets);
    1083 + MLX5_GET_CTR(out, received_eth_multicast.packets) +
    1084 + MLX5_GET_CTR(out, received_ib_multicast.packets);
    1085
    1086 vf_stats->broadcast =
    1087 MLX5_GET_CTR(out, received_eth_broadcast.packets);
    1088 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
    1089 index 331a6ca4856d..5f3402ba9916 100644
    1090 --- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
    1091 +++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
    1092 @@ -153,6 +153,7 @@ static void del_rule(struct fs_node *node);
    1093 static void del_flow_table(struct fs_node *node);
    1094 static void del_flow_group(struct fs_node *node);
    1095 static void del_fte(struct fs_node *node);
    1096 +static void cleanup_root_ns(struct mlx5_flow_root_namespace *root_ns);
    1097
    1098 static void tree_init_node(struct fs_node *node,
    1099 unsigned int refcount,
    1100 @@ -1690,24 +1691,28 @@ static int create_anchor_flow_table(struct mlx5_flow_steering *steering)
    1101
    1102 static int init_root_ns(struct mlx5_flow_steering *steering)
    1103 {
    1104 + int err;
    1105
    1106 steering->root_ns = create_root_ns(steering, FS_FT_NIC_RX);
    1107 if (!steering->root_ns)
    1108 - goto cleanup;
    1109 + return -ENOMEM;
    1110
    1111 - if (init_root_tree(steering, &root_fs, &steering->root_ns->ns.node))
    1112 - goto cleanup;
    1113 + err = init_root_tree(steering, &root_fs, &steering->root_ns->ns.node);
    1114 + if (err)
    1115 + goto out_err;
    1116
    1117 set_prio_attrs(steering->root_ns);
    1118
    1119 - if (create_anchor_flow_table(steering))
    1120 - goto cleanup;
    1121 + err = create_anchor_flow_table(steering);
    1122 + if (err)
    1123 + goto out_err;
    1124
    1125 return 0;
    1126
    1127 -cleanup:
    1128 - mlx5_cleanup_fs(steering->dev);
    1129 - return -ENOMEM;
    1130 +out_err:
    1131 + cleanup_root_ns(steering->root_ns);
    1132 + steering->root_ns = NULL;
    1133 + return err;
    1134 }
    1135
    1136 static void clean_tree(struct fs_node *node)
    1137 diff --git a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
    1138 index 4ca82bd8c4f0..eee6e59e6cf3 100644
    1139 --- a/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
    1140 +++ b/drivers/net/ethernet/netronome/nfp/nfp_net_common.c
    1141 @@ -854,6 +854,8 @@ static int nfp_net_tx(struct sk_buff *skb, struct net_device *netdev)
    1142
    1143 netdev_tx_sent_queue(nd_q, txbuf->real_len);
    1144
    1145 + skb_tx_timestamp(skb);
    1146 +
    1147 tx_ring->wr_p += nr_frags + 1;
    1148 if (nfp_net_tx_ring_should_stop(tx_ring))
    1149 nfp_net_tx_ring_stop(nd_q, tx_ring);
    1150 @@ -866,8 +868,6 @@ static int nfp_net_tx(struct sk_buff *skb, struct net_device *netdev)
    1151 tx_ring->wr_ptr_add = 0;
    1152 }
    1153
    1154 - skb_tx_timestamp(skb);
    1155 -
    1156 return NETDEV_TX_OK;
    1157
    1158 err_unmap:
    1159 diff --git a/drivers/net/ethernet/realtek/8139too.c b/drivers/net/ethernet/realtek/8139too.c
    1160 index da4c2d8a4173..1420dfb56bac 100644
    1161 --- a/drivers/net/ethernet/realtek/8139too.c
    1162 +++ b/drivers/net/ethernet/realtek/8139too.c
    1163 @@ -2233,7 +2233,7 @@ static void rtl8139_poll_controller(struct net_device *dev)
    1164 struct rtl8139_private *tp = netdev_priv(dev);
    1165 const int irq = tp->pci_dev->irq;
    1166
    1167 - disable_irq(irq);
    1168 + disable_irq_nosync(irq);
    1169 rtl8139_interrupt(irq, dev);
    1170 enable_irq(irq);
    1171 }
    1172 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
    1173 index dbb63640bc6e..59b932db0d42 100644
    1174 --- a/drivers/net/ethernet/realtek/r8169.c
    1175 +++ b/drivers/net/ethernet/realtek/r8169.c
    1176 @@ -4861,6 +4861,9 @@ static void rtl_pll_power_down(struct rtl8169_private *tp)
    1177 static void rtl_pll_power_up(struct rtl8169_private *tp)
    1178 {
    1179 rtl_generic_op(tp, tp->pll_power_ops.up);
    1180 +
    1181 + /* give MAC/PHY some time to resume */
    1182 + msleep(20);
    1183 }
    1184
    1185 static void rtl_init_pll_power_ops(struct rtl8169_private *tp)
    1186 diff --git a/drivers/net/ethernet/sun/niu.c b/drivers/net/ethernet/sun/niu.c
    1187 index a2371aa14a49..e45e2f14fb94 100644
    1188 --- a/drivers/net/ethernet/sun/niu.c
    1189 +++ b/drivers/net/ethernet/sun/niu.c
    1190 @@ -3442,7 +3442,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
    1191
    1192 len = (val & RCR_ENTRY_L2_LEN) >>
    1193 RCR_ENTRY_L2_LEN_SHIFT;
    1194 - len -= ETH_FCS_LEN;
    1195 + append_size = len + ETH_HLEN + ETH_FCS_LEN;
    1196
    1197 addr = (val & RCR_ENTRY_PKT_BUF_ADDR) <<
    1198 RCR_ENTRY_PKT_BUF_ADDR_SHIFT;
    1199 @@ -3452,7 +3452,6 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
    1200 RCR_ENTRY_PKTBUFSZ_SHIFT];
    1201
    1202 off = addr & ~PAGE_MASK;
    1203 - append_size = rcr_size;
    1204 if (num_rcr == 1) {
    1205 int ptype;
    1206
    1207 @@ -3465,7 +3464,7 @@ static int niu_process_rx_pkt(struct napi_struct *napi, struct niu *np,
    1208 else
    1209 skb_checksum_none_assert(skb);
    1210 } else if (!(val & RCR_ENTRY_MULTI))
    1211 - append_size = len - skb->len;
    1212 + append_size = append_size - skb->len;
    1213
    1214 niu_rx_skb_append(skb, page, off, append_size, rcr_size);
    1215 if ((page->index + rp->rbr_block_size) - rcr_size == addr) {
    1216 diff --git a/drivers/net/ethernet/ti/cpsw.c b/drivers/net/ethernet/ti/cpsw.c
    1217 index de336897a28a..d7cb205fe7e2 100644
    1218 --- a/drivers/net/ethernet/ti/cpsw.c
    1219 +++ b/drivers/net/ethernet/ti/cpsw.c
    1220 @@ -1141,6 +1141,8 @@ static inline void cpsw_add_dual_emac_def_ale_entries(
    1221 cpsw_ale_add_ucast(cpsw->ale, priv->mac_addr,
    1222 HOST_PORT_NUM, ALE_VLAN |
    1223 ALE_SECURE, slave->port_vlan);
    1224 + cpsw_ale_control_set(cpsw->ale, slave_port,
    1225 + ALE_PORT_DROP_UNKNOWN_VLAN, 1);
    1226 }
    1227
    1228 static void soft_reset_slave(struct cpsw_slave *slave)
    1229 diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    1230 index 1029bd234c22..3e893fe890a0 100644
    1231 --- a/drivers/net/usb/qmi_wwan.c
    1232 +++ b/drivers/net/usb/qmi_wwan.c
    1233 @@ -1039,6 +1039,18 @@ static int qmi_wwan_probe(struct usb_interface *intf,
    1234 id->driver_info = (unsigned long)&qmi_wwan_info;
    1235 }
    1236
    1237 + /* There are devices where the same interface number can be
    1238 + * configured as different functions. We should only bind to
    1239 + * vendor specific functions when matching on interface number
    1240 + */
    1241 + if (id->match_flags & USB_DEVICE_ID_MATCH_INT_NUMBER &&
    1242 + desc->bInterfaceClass != USB_CLASS_VENDOR_SPEC) {
    1243 + dev_dbg(&intf->dev,
    1244 + "Rejecting interface number match for class %02x\n",
    1245 + desc->bInterfaceClass);
    1246 + return -ENODEV;
    1247 + }
    1248 +
    1249 /* Quectel EC20 quirk where we've QMI on interface 4 instead of 0 */
    1250 if (quectel_ec20_detected(intf) && desc->bInterfaceNumber == 0) {
    1251 dev_dbg(&intf->dev, "Quectel EC20 quirk, skipping interface 0\n");
    1252 diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
    1253 index cdd2f942317c..b9c7a904c1ea 100644
    1254 --- a/drivers/tty/serial/sccnxp.c
    1255 +++ b/drivers/tty/serial/sccnxp.c
    1256 @@ -889,7 +889,16 @@ static int sccnxp_probe(struct platform_device *pdev)
    1257 goto err_out;
    1258 uartclk = 0;
    1259 } else {
    1260 - clk_prepare_enable(clk);
    1261 + ret = clk_prepare_enable(clk);
    1262 + if (ret)
    1263 + goto err_out;
    1264 +
    1265 + ret = devm_add_action_or_reset(&pdev->dev,
    1266 + (void(*)(void *))clk_disable_unprepare,
    1267 + clk);
    1268 + if (ret)
    1269 + goto err_out;
    1270 +
    1271 uartclk = clk_get_rate(clk);
    1272 }
    1273
    1274 @@ -988,7 +997,7 @@ static int sccnxp_probe(struct platform_device *pdev)
    1275 uart_unregister_driver(&s->uart);
    1276 err_out:
    1277 if (!IS_ERR(s->regulator))
    1278 - return regulator_disable(s->regulator);
    1279 + regulator_disable(s->regulator);
    1280
    1281 return ret;
    1282 }
    1283 diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
    1284 index 85135df0eb34..c19123dcd1a4 100644
    1285 --- a/fs/lockd/svc.c
    1286 +++ b/fs/lockd/svc.c
    1287 @@ -274,6 +274,8 @@ static void lockd_down_net(struct svc_serv *serv, struct net *net)
    1288 if (ln->nlmsvc_users) {
    1289 if (--ln->nlmsvc_users == 0) {
    1290 nlm_shutdown_hosts_net(net);
    1291 + cancel_delayed_work_sync(&ln->grace_period_end);
    1292 + locks_end_grace(&ln->lockd_manager);
    1293 svc_shutdown_net(serv, net);
    1294 dprintk("lockd_down_net: per-net data destroyed; net=%p\n", net);
    1295 }
    1296 diff --git a/fs/proc/base.c b/fs/proc/base.c
    1297 index e67fec3c9856..3fec83ba75fa 100644
    1298 --- a/fs/proc/base.c
    1299 +++ b/fs/proc/base.c
    1300 @@ -252,7 +252,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
    1301 * Inherently racy -- command line shares address space
    1302 * with code and data.
    1303 */
    1304 - rv = access_remote_vm(mm, arg_end - 1, &c, 1, 0);
    1305 + rv = access_remote_vm(mm, arg_end - 1, &c, 1, FOLL_ANON);
    1306 if (rv <= 0)
    1307 goto out_free_page;
    1308
    1309 @@ -270,7 +270,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
    1310 int nr_read;
    1311
    1312 _count = min3(count, len, PAGE_SIZE);
    1313 - nr_read = access_remote_vm(mm, p, page, _count, 0);
    1314 + nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON);
    1315 if (nr_read < 0)
    1316 rv = nr_read;
    1317 if (nr_read <= 0)
    1318 @@ -305,7 +305,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
    1319 bool final;
    1320
    1321 _count = min3(count, len, PAGE_SIZE);
    1322 - nr_read = access_remote_vm(mm, p, page, _count, 0);
    1323 + nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON);
    1324 if (nr_read < 0)
    1325 rv = nr_read;
    1326 if (nr_read <= 0)
    1327 @@ -354,7 +354,7 @@ static ssize_t proc_pid_cmdline_read(struct file *file, char __user *buf,
    1328 bool final;
    1329
    1330 _count = min3(count, len, PAGE_SIZE);
    1331 - nr_read = access_remote_vm(mm, p, page, _count, 0);
    1332 + nr_read = access_remote_vm(mm, p, page, _count, FOLL_ANON);
    1333 if (nr_read < 0)
    1334 rv = nr_read;
    1335 if (nr_read <= 0)
    1336 @@ -970,7 +970,7 @@ static ssize_t environ_read(struct file *file, char __user *buf,
    1337 max_len = min_t(size_t, PAGE_SIZE, count);
    1338 this_len = min(max_len, this_len);
    1339
    1340 - retval = access_remote_vm(mm, (env_start + src), page, this_len, 0);
    1341 + retval = access_remote_vm(mm, (env_start + src), page, this_len, FOLL_ANON);
    1342
    1343 if (retval <= 0) {
    1344 ret = retval;
    1345 diff --git a/include/asm-generic/futex.h b/include/asm-generic/futex.h
    1346 index bf2d34c9d804..f0d8b1c51343 100644
    1347 --- a/include/asm-generic/futex.h
    1348 +++ b/include/asm-generic/futex.h
    1349 @@ -13,7 +13,7 @@
    1350 */
    1351
    1352 /**
    1353 - * futex_atomic_op_inuser() - Atomic arithmetic operation with constant
    1354 + * arch_futex_atomic_op_inuser() - Atomic arithmetic operation with constant
    1355 * argument and comparison of the previous
    1356 * futex value with another constant.
    1357 *
    1358 @@ -25,18 +25,11 @@
    1359 * <0 - On error
    1360 */
    1361 static inline int
    1362 -futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    1363 +arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval, u32 __user *uaddr)
    1364 {
    1365 - int op = (encoded_op >> 28) & 7;
    1366 - int cmp = (encoded_op >> 24) & 15;
    1367 - int oparg = (encoded_op << 8) >> 20;
    1368 - int cmparg = (encoded_op << 20) >> 20;
    1369 int oldval, ret;
    1370 u32 tmp;
    1371
    1372 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    1373 - oparg = 1 << oparg;
    1374 -
    1375 preempt_disable();
    1376 pagefault_disable();
    1377
    1378 @@ -74,17 +67,9 @@ futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
    1379 pagefault_enable();
    1380 preempt_enable();
    1381
    1382 - if (ret == 0) {
    1383 - switch (cmp) {
    1384 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    1385 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    1386 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    1387 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    1388 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    1389 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    1390 - default: ret = -ENOSYS;
    1391 - }
    1392 - }
    1393 + if (ret == 0)
    1394 + *oval = oldval;
    1395 +
    1396 return ret;
    1397 }
    1398
    1399 @@ -126,18 +111,9 @@ futex_atomic_cmpxchg_inatomic(u32 *uval, u32 __user *uaddr,
    1400
    1401 #else
    1402 static inline int
    1403 -futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    1404 +arch_futex_atomic_op_inuser(int op, u32 oparg, int *oval, u32 __user *uaddr)
    1405 {
    1406 - int op = (encoded_op >> 28) & 7;
    1407 - int cmp = (encoded_op >> 24) & 15;
    1408 - int oparg = (encoded_op << 8) >> 20;
    1409 - int cmparg = (encoded_op << 20) >> 20;
    1410 int oldval = 0, ret;
    1411 - if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28))
    1412 - oparg = 1 << oparg;
    1413 -
    1414 - if (! access_ok (VERIFY_WRITE, uaddr, sizeof(u32)))
    1415 - return -EFAULT;
    1416
    1417 pagefault_disable();
    1418
    1419 @@ -153,17 +129,9 @@ futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
    1420
    1421 pagefault_enable();
    1422
    1423 - if (!ret) {
    1424 - switch (cmp) {
    1425 - case FUTEX_OP_CMP_EQ: ret = (oldval == cmparg); break;
    1426 - case FUTEX_OP_CMP_NE: ret = (oldval != cmparg); break;
    1427 - case FUTEX_OP_CMP_LT: ret = (oldval < cmparg); break;
    1428 - case FUTEX_OP_CMP_GE: ret = (oldval >= cmparg); break;
    1429 - case FUTEX_OP_CMP_LE: ret = (oldval <= cmparg); break;
    1430 - case FUTEX_OP_CMP_GT: ret = (oldval > cmparg); break;
    1431 - default: ret = -ENOSYS;
    1432 - }
    1433 - }
    1434 + if (!ret)
    1435 + *oval = oldval;
    1436 +
    1437 return ret;
    1438 }
    1439
    1440 diff --git a/include/linux/mm.h b/include/linux/mm.h
    1441 index 4a07ff4f38e1..493d07931ea5 100644
    1442 --- a/include/linux/mm.h
    1443 +++ b/include/linux/mm.h
    1444 @@ -2246,6 +2246,7 @@ static inline struct page *follow_page(struct vm_area_struct *vma,
    1445 #define FOLL_MLOCK 0x1000 /* lock present pages */
    1446 #define FOLL_REMOTE 0x2000 /* we are working on non-current tsk/mm */
    1447 #define FOLL_COW 0x4000 /* internal GUP flag */
    1448 +#define FOLL_ANON 0x8000 /* don't do file mappings */
    1449
    1450 typedef int (*pte_fn_t)(pte_t *pte, pgtable_t token, unsigned long addr,
    1451 void *data);
    1452 diff --git a/include/net/bonding.h b/include/net/bonding.h
    1453 index f32f7ef8a23a..7734cc9c7d29 100644
    1454 --- a/include/net/bonding.h
    1455 +++ b/include/net/bonding.h
    1456 @@ -197,6 +197,7 @@ struct bonding {
    1457 struct slave __rcu *primary_slave;
    1458 struct bond_up_slave __rcu *slave_arr; /* Array of usable slaves */
    1459 bool force_primary;
    1460 + u32 nest_level;
    1461 s32 slave_cnt; /* never change this value outside the attach/detach wrappers */
    1462 int (*recv_probe)(const struct sk_buff *, struct bonding *,
    1463 struct slave *);
    1464 diff --git a/kernel/exit.c b/kernel/exit.c
    1465 index 3076f3089919..6dd7ff4b337a 100644
    1466 --- a/kernel/exit.c
    1467 +++ b/kernel/exit.c
    1468 @@ -1662,6 +1662,10 @@ SYSCALL_DEFINE4(wait4, pid_t, upid, int __user *, stat_addr,
    1469 __WNOTHREAD|__WCLONE|__WALL))
    1470 return -EINVAL;
    1471
    1472 + /* -INT_MIN is not defined */
    1473 + if (upid == INT_MIN)
    1474 + return -ESRCH;
    1475 +
    1476 if (upid == -1)
    1477 type = PIDTYPE_MAX;
    1478 else if (upid < 0) {
    1479 diff --git a/kernel/futex.c b/kernel/futex.c
    1480 index bb2265ae5cbc..c3ea6f2a6997 100644
    1481 --- a/kernel/futex.c
    1482 +++ b/kernel/futex.c
    1483 @@ -1458,6 +1458,45 @@ futex_wake(u32 __user *uaddr, unsigned int flags, int nr_wake, u32 bitset)
    1484 return ret;
    1485 }
    1486
    1487 +static int futex_atomic_op_inuser(unsigned int encoded_op, u32 __user *uaddr)
    1488 +{
    1489 + unsigned int op = (encoded_op & 0x70000000) >> 28;
    1490 + unsigned int cmp = (encoded_op & 0x0f000000) >> 24;
    1491 + int oparg = sign_extend32((encoded_op & 0x00fff000) >> 12, 11);
    1492 + int cmparg = sign_extend32(encoded_op & 0x00000fff, 11);
    1493 + int oldval, ret;
    1494 +
    1495 + if (encoded_op & (FUTEX_OP_OPARG_SHIFT << 28)) {
    1496 + if (oparg < 0 || oparg > 31)
    1497 + return -EINVAL;
    1498 + oparg = 1 << oparg;
    1499 + }
    1500 +
    1501 + if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
    1502 + return -EFAULT;
    1503 +
    1504 + ret = arch_futex_atomic_op_inuser(op, oparg, &oldval, uaddr);
    1505 + if (ret)
    1506 + return ret;
    1507 +
    1508 + switch (cmp) {
    1509 + case FUTEX_OP_CMP_EQ:
    1510 + return oldval == cmparg;
    1511 + case FUTEX_OP_CMP_NE:
    1512 + return oldval != cmparg;
    1513 + case FUTEX_OP_CMP_LT:
    1514 + return oldval < cmparg;
    1515 + case FUTEX_OP_CMP_GE:
    1516 + return oldval >= cmparg;
    1517 + case FUTEX_OP_CMP_LE:
    1518 + return oldval <= cmparg;
    1519 + case FUTEX_OP_CMP_GT:
    1520 + return oldval > cmparg;
    1521 + default:
    1522 + return -ENOSYS;
    1523 + }
    1524 +}
    1525 +
    1526 /*
    1527 * Wake up all waiters hashed on the physical page that is mapped
    1528 * to this virtual address:
    1529 diff --git a/mm/gup.c b/mm/gup.c
    1530 index 6c3b4e822946..be4ccddac26f 100644
    1531 --- a/mm/gup.c
    1532 +++ b/mm/gup.c
    1533 @@ -430,6 +430,9 @@ static int check_vma_flags(struct vm_area_struct *vma, unsigned long gup_flags)
    1534 if (vm_flags & (VM_IO | VM_PFNMAP))
    1535 return -EFAULT;
    1536
    1537 + if (gup_flags & FOLL_ANON && !vma_is_anonymous(vma))
    1538 + return -EFAULT;
    1539 +
    1540 if (write) {
    1541 if (!(vm_flags & VM_WRITE)) {
    1542 if (!(gup_flags & FOLL_FORCE))
    1543 diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
    1544 index ed0dd3340084..8e173324693d 100644
    1545 --- a/net/bridge/br_if.c
    1546 +++ b/net/bridge/br_if.c
    1547 @@ -504,8 +504,8 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
    1548 if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit)
    1549 return -ELOOP;
    1550
    1551 - /* Device is already being bridged */
    1552 - if (br_port_exists(dev))
    1553 + /* Device has master upper dev */
    1554 + if (netdev_master_upper_dev_get(dev))
    1555 return -EBUSY;
    1556
    1557 /* No bridging devices that dislike that (e.g. wireless) */
    1558 diff --git a/net/compat.c b/net/compat.c
    1559 index a96fd2f3507b..73671e6ec6eb 100644
    1560 --- a/net/compat.c
    1561 +++ b/net/compat.c
    1562 @@ -372,7 +372,8 @@ static int compat_sock_setsockopt(struct socket *sock, int level, int optname,
    1563 optname == SO_ATTACH_REUSEPORT_CBPF)
    1564 return do_set_attach_filter(sock, level, optname,
    1565 optval, optlen);
    1566 - if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
    1567 + if (!COMPAT_USE_64BIT_TIME &&
    1568 + (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
    1569 return do_set_sock_timeout(sock, level, optname, optval, optlen);
    1570
    1571 return sock_setsockopt(sock, level, optname, optval, optlen);
    1572 @@ -437,7 +438,8 @@ static int do_get_sock_timeout(struct socket *sock, int level, int optname,
    1573 static int compat_sock_getsockopt(struct socket *sock, int level, int optname,
    1574 char __user *optval, int __user *optlen)
    1575 {
    1576 - if (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO)
    1577 + if (!COMPAT_USE_64BIT_TIME &&
    1578 + (optname == SO_RCVTIMEO || optname == SO_SNDTIMEO))
    1579 return do_get_sock_timeout(sock, level, optname, optval, optlen);
    1580 return sock_getsockopt(sock, level, optname, optval, optlen);
    1581 }
    1582 diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
    1583 index 7753681195c1..86a2ed0fb219 100644
    1584 --- a/net/dccp/ccids/ccid2.c
    1585 +++ b/net/dccp/ccids/ccid2.c
    1586 @@ -126,6 +126,16 @@ static void ccid2_change_l_seq_window(struct sock *sk, u64 val)
    1587 DCCPF_SEQ_WMAX));
    1588 }
    1589
    1590 +static void dccp_tasklet_schedule(struct sock *sk)
    1591 +{
    1592 + struct tasklet_struct *t = &dccp_sk(sk)->dccps_xmitlet;
    1593 +
    1594 + if (!test_and_set_bit(TASKLET_STATE_SCHED, &t->state)) {
    1595 + sock_hold(sk);
    1596 + __tasklet_schedule(t);
    1597 + }
    1598 +}
    1599 +
    1600 static void ccid2_hc_tx_rto_expire(unsigned long data)
    1601 {
    1602 struct sock *sk = (struct sock *)data;
    1603 @@ -166,7 +176,7 @@ static void ccid2_hc_tx_rto_expire(unsigned long data)
    1604
    1605 /* if we were blocked before, we may now send cwnd=1 packet */
    1606 if (sender_was_blocked)
    1607 - tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
    1608 + dccp_tasklet_schedule(sk);
    1609 /* restart backed-off timer */
    1610 sk_reset_timer(sk, &hc->tx_rtotimer, jiffies + hc->tx_rto);
    1611 out:
    1612 @@ -706,7 +716,7 @@ static void ccid2_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
    1613 done:
    1614 /* check if incoming Acks allow pending packets to be sent */
    1615 if (sender_was_blocked && !ccid2_cwnd_network_limited(hc))
    1616 - tasklet_schedule(&dccp_sk(sk)->dccps_xmitlet);
    1617 + dccp_tasklet_schedule(sk);
    1618 dccp_ackvec_parsed_cleanup(&hc->tx_av_chunks);
    1619 }
    1620
    1621 diff --git a/net/dccp/timer.c b/net/dccp/timer.c
    1622 index 3a2c34027758..2a952cbd6efa 100644
    1623 --- a/net/dccp/timer.c
    1624 +++ b/net/dccp/timer.c
    1625 @@ -230,12 +230,12 @@ static void dccp_write_xmitlet(unsigned long data)
    1626 else
    1627 dccp_write_xmit(sk);
    1628 bh_unlock_sock(sk);
    1629 + sock_put(sk);
    1630 }
    1631
    1632 static void dccp_write_xmit_timer(unsigned long data)
    1633 {
    1634 dccp_write_xmitlet(data);
    1635 - sock_put((struct sock *)data);
    1636 }
    1637
    1638 void dccp_init_xmit_timers(struct sock *sk)
    1639 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
    1640 index e612991c9185..9adcd4b1b3fd 100644
    1641 --- a/net/ipv4/ping.c
    1642 +++ b/net/ipv4/ping.c
    1643 @@ -775,8 +775,10 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
    1644 ipc.addr = faddr = daddr;
    1645
    1646 if (ipc.opt && ipc.opt->opt.srr) {
    1647 - if (!daddr)
    1648 - return -EINVAL;
    1649 + if (!daddr) {
    1650 + err = -EINVAL;
    1651 + goto out_free;
    1652 + }
    1653 faddr = ipc.opt->opt.faddr;
    1654 }
    1655 tos = get_rttos(&ipc, inet);
    1656 @@ -841,6 +843,7 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
    1657
    1658 out:
    1659 ip_rt_put(rt);
    1660 +out_free:
    1661 if (free)
    1662 kfree(ipc.opt);
    1663 if (!err) {
    1664 diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
    1665 index 6f501c9deaae..84ffebf0192d 100644
    1666 --- a/net/ipv4/tcp.c
    1667 +++ b/net/ipv4/tcp.c
    1668 @@ -1118,7 +1118,7 @@ int tcp_sendmsg(struct sock *sk, struct msghdr *msg, size_t size)
    1669 lock_sock(sk);
    1670
    1671 flags = msg->msg_flags;
    1672 - if (flags & MSG_FASTOPEN) {
    1673 + if ((flags & MSG_FASTOPEN) && !tp->repair) {
    1674 err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);
    1675 if (err == -EINPROGRESS && copied_syn > 0)
    1676 goto out;
    1677 diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c
    1678 index 8ec60532be2b..9169859506b7 100644
    1679 --- a/net/ipv4/tcp_bbr.c
    1680 +++ b/net/ipv4/tcp_bbr.c
    1681 @@ -773,7 +773,9 @@ static void bbr_update_min_rtt(struct sock *sk, const struct rate_sample *rs)
    1682 }
    1683 }
    1684 }
    1685 - bbr->idle_restart = 0;
    1686 + /* Restart after idle ends only once we process a new S/ACK for data */
    1687 + if (rs->delivered > 0)
    1688 + bbr->idle_restart = 0;
    1689 }
    1690
    1691 static void bbr_update_model(struct sock *sk, const struct rate_sample *rs)
    1692 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1693 index 4cd943096afa..aa2a20e918fd 100644
    1694 --- a/net/ipv4/udp.c
    1695 +++ b/net/ipv4/udp.c
    1696 @@ -982,8 +982,10 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
    1697 sock_tx_timestamp(sk, ipc.sockc.tsflags, &ipc.tx_flags);
    1698
    1699 if (ipc.opt && ipc.opt->opt.srr) {
    1700 - if (!daddr)
    1701 - return -EINVAL;
    1702 + if (!daddr) {
    1703 + err = -EINVAL;
    1704 + goto out_free;
    1705 + }
    1706 faddr = ipc.opt->opt.faddr;
    1707 connected = 0;
    1708 }
    1709 @@ -1090,6 +1092,7 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
    1710
    1711 out:
    1712 ip_rt_put(rt);
    1713 +out_free:
    1714 if (free)
    1715 kfree(ipc.opt);
    1716 if (!err)
    1717 diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
    1718 index ce1238492c0f..ee03bc866d1b 100644
    1719 --- a/net/l2tp/l2tp_netlink.c
    1720 +++ b/net/l2tp/l2tp_netlink.c
    1721 @@ -750,8 +750,6 @@ static int l2tp_nl_session_send(struct sk_buff *skb, u32 portid, u32 seq, int fl
    1722
    1723 if ((session->ifname[0] &&
    1724 nla_put_string(skb, L2TP_ATTR_IFNAME, session->ifname)) ||
    1725 - (session->offset &&
    1726 - nla_put_u16(skb, L2TP_ATTR_OFFSET, session->offset)) ||
    1727 (session->cookie_len &&
    1728 nla_put(skb, L2TP_ATTR_COOKIE, session->cookie_len,
    1729 &session->cookie[0])) ||
    1730 diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
    1731 index d6bc5f2a1175..85aae8c84aeb 100644
    1732 --- a/net/llc/af_llc.c
    1733 +++ b/net/llc/af_llc.c
    1734 @@ -926,6 +926,9 @@ static int llc_ui_sendmsg(struct socket *sock, struct msghdr *msg, size_t len)
    1735 if (size > llc->dev->mtu)
    1736 size = llc->dev->mtu;
    1737 copied = size - hdrlen;
    1738 + rc = -EINVAL;
    1739 + if (copied < 0)
    1740 + goto release;
    1741 release_sock(sk);
    1742 skb = sock_alloc_send_skb(sk, size, noblock, &rc);
    1743 lock_sock(sk);
    1744 diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
    1745 index 1668916bdbde..326945d9be5f 100644
    1746 --- a/net/openvswitch/flow_netlink.c
    1747 +++ b/net/openvswitch/flow_netlink.c
    1748 @@ -1296,13 +1296,10 @@ static void nlattr_set(struct nlattr *attr, u8 val,
    1749
    1750 /* The nlattr stream should already have been validated */
    1751 nla_for_each_nested(nla, attr, rem) {
    1752 - if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED) {
    1753 - if (tbl[nla_type(nla)].next)
    1754 - tbl = tbl[nla_type(nla)].next;
    1755 - nlattr_set(nla, val, tbl);
    1756 - } else {
    1757 + if (tbl[nla_type(nla)].len == OVS_ATTR_NESTED)
    1758 + nlattr_set(nla, val, tbl[nla_type(nla)].next ? : tbl);
    1759 + else
    1760 memset(nla_data(nla), val, nla_len(nla));
    1761 - }
    1762
    1763 if (nla_type(nla) == OVS_KEY_ATTR_CT_STATE)
    1764 *(u32 *)nla_data(nla) &= CT_SUPPORTED_MASK;
    1765 diff --git a/net/sched/sch_fq.c b/net/sched/sch_fq.c
    1766 index 18e752439f6f..b57b4de73038 100644
    1767 --- a/net/sched/sch_fq.c
    1768 +++ b/net/sched/sch_fq.c
    1769 @@ -128,6 +128,28 @@ static bool fq_flow_is_detached(const struct fq_flow *f)
    1770 return f->next == &detached;
    1771 }
    1772
    1773 +static bool fq_flow_is_throttled(const struct fq_flow *f)
    1774 +{
    1775 + return f->next == &throttled;
    1776 +}
    1777 +
    1778 +static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
    1779 +{
    1780 + if (head->first)
    1781 + head->last->next = flow;
    1782 + else
    1783 + head->first = flow;
    1784 + head->last = flow;
    1785 + flow->next = NULL;
    1786 +}
    1787 +
    1788 +static void fq_flow_unset_throttled(struct fq_sched_data *q, struct fq_flow *f)
    1789 +{
    1790 + rb_erase(&f->rate_node, &q->delayed);
    1791 + q->throttled_flows--;
    1792 + fq_flow_add_tail(&q->old_flows, f);
    1793 +}
    1794 +
    1795 static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
    1796 {
    1797 struct rb_node **p = &q->delayed.rb_node, *parent = NULL;
    1798 @@ -155,15 +177,6 @@ static void fq_flow_set_throttled(struct fq_sched_data *q, struct fq_flow *f)
    1799
    1800 static struct kmem_cache *fq_flow_cachep __read_mostly;
    1801
    1802 -static void fq_flow_add_tail(struct fq_flow_head *head, struct fq_flow *flow)
    1803 -{
    1804 - if (head->first)
    1805 - head->last->next = flow;
    1806 - else
    1807 - head->first = flow;
    1808 - head->last = flow;
    1809 - flow->next = NULL;
    1810 -}
    1811
    1812 /* limit number of collected flows per round */
    1813 #define FQ_GC_MAX 8
    1814 @@ -267,6 +280,8 @@ static struct fq_flow *fq_classify(struct sk_buff *skb, struct fq_sched_data *q)
    1815 f->socket_hash != sk->sk_hash)) {
    1816 f->credit = q->initial_quantum;
    1817 f->socket_hash = sk->sk_hash;
    1818 + if (fq_flow_is_throttled(f))
    1819 + fq_flow_unset_throttled(q, f);
    1820 f->time_next_packet = 0ULL;
    1821 }
    1822 return f;
    1823 @@ -430,9 +445,7 @@ static void fq_check_throttled(struct fq_sched_data *q, u64 now)
    1824 q->time_next_delayed_flow = f->time_next_packet;
    1825 break;
    1826 }
    1827 - rb_erase(p, &q->delayed);
    1828 - q->throttled_flows--;
    1829 - fq_flow_add_tail(&q->old_flows, f);
    1830 + fq_flow_unset_throttled(q, f);
    1831 }
    1832 }
    1833
    1834 diff --git a/net/sctp/associola.c b/net/sctp/associola.c
    1835 index f10d3397f917..738c55e994c4 100644
    1836 --- a/net/sctp/associola.c
    1837 +++ b/net/sctp/associola.c
    1838 @@ -1006,9 +1006,10 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
    1839 struct sctp_endpoint *ep;
    1840 struct sctp_chunk *chunk;
    1841 struct sctp_inq *inqueue;
    1842 - int state;
    1843 sctp_subtype_t subtype;
    1844 + int first_time = 1; /* is this the first time through the loop */
    1845 int error = 0;
    1846 + int state;
    1847
    1848 /* The association should be held so we should be safe. */
    1849 ep = asoc->ep;
    1850 @@ -1019,6 +1020,30 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
    1851 state = asoc->state;
    1852 subtype = SCTP_ST_CHUNK(chunk->chunk_hdr->type);
    1853
    1854 + /* If the first chunk in the packet is AUTH, do special
    1855 + * processing specified in Section 6.3 of SCTP-AUTH spec
    1856 + */
    1857 + if (first_time && subtype.chunk == SCTP_CID_AUTH) {
    1858 + struct sctp_chunkhdr *next_hdr;
    1859 +
    1860 + next_hdr = sctp_inq_peek(inqueue);
    1861 + if (!next_hdr)
    1862 + goto normal;
    1863 +
    1864 + /* If the next chunk is COOKIE-ECHO, skip the AUTH
    1865 + * chunk while saving a pointer to it so we can do
    1866 + * Authentication later (during cookie-echo
    1867 + * processing).
    1868 + */
    1869 + if (next_hdr->type == SCTP_CID_COOKIE_ECHO) {
    1870 + chunk->auth_chunk = skb_clone(chunk->skb,
    1871 + GFP_ATOMIC);
    1872 + chunk->auth = 1;
    1873 + continue;
    1874 + }
    1875 + }
    1876 +
    1877 +normal:
    1878 /* SCTP-AUTH, Section 6.3:
    1879 * The receiver has a list of chunk types which it expects
    1880 * to be received only after an AUTH-chunk. This list has
    1881 @@ -1057,6 +1082,9 @@ static void sctp_assoc_bh_rcv(struct work_struct *work)
    1882 /* If there is an error on chunk, discard this packet. */
    1883 if (error && chunk)
    1884 chunk->pdiscard = 1;
    1885 +
    1886 + if (first_time)
    1887 + first_time = 0;
    1888 }
    1889 sctp_association_put(asoc);
    1890 }
    1891 diff --git a/net/sctp/inqueue.c b/net/sctp/inqueue.c
    1892 index f731de3e8428..e06083c53f57 100644
    1893 --- a/net/sctp/inqueue.c
    1894 +++ b/net/sctp/inqueue.c
    1895 @@ -217,7 +217,7 @@ struct sctp_chunk *sctp_inq_pop(struct sctp_inq *queue)
    1896 skb_pull(chunk->skb, sizeof(sctp_chunkhdr_t));
    1897 chunk->subh.v = NULL; /* Subheader is no longer valid. */
    1898
    1899 - if (chunk->chunk_end + sizeof(sctp_chunkhdr_t) <
    1900 + if (chunk->chunk_end + sizeof(sctp_chunkhdr_t) <=
    1901 skb_tail_pointer(chunk->skb)) {
    1902 /* This is not a singleton */
    1903 chunk->singleton = 0;
    1904 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
    1905 index e031797ad311..f4d5efb1d231 100644
    1906 --- a/net/sctp/ipv6.c
    1907 +++ b/net/sctp/ipv6.c
    1908 @@ -864,6 +864,9 @@ static int sctp_inet6_cmp_addr(const union sctp_addr *addr1,
    1909 if (sctp_is_any(sk, addr1) || sctp_is_any(sk, addr2))
    1910 return 1;
    1911
    1912 + if (addr1->sa.sa_family == AF_INET && addr2->sa.sa_family == AF_INET)
    1913 + return addr1->v4.sin_addr.s_addr == addr2->v4.sin_addr.s_addr;
    1914 +
    1915 return __sctp_v6_cmp_addr(addr1, addr2);
    1916 }
    1917
    1918 diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
    1919 index 8ec20a64a3f8..bfd068679710 100644
    1920 --- a/net/sctp/sm_statefuns.c
    1921 +++ b/net/sctp/sm_statefuns.c
    1922 @@ -144,10 +144,8 @@ static sctp_disposition_t sctp_sf_violation_chunk(
    1923 void *arg,
    1924 sctp_cmd_seq_t *commands);
    1925
    1926 -static sctp_ierror_t sctp_sf_authenticate(struct net *net,
    1927 - const struct sctp_endpoint *ep,
    1928 +static sctp_ierror_t sctp_sf_authenticate(
    1929 const struct sctp_association *asoc,
    1930 - const sctp_subtype_t type,
    1931 struct sctp_chunk *chunk);
    1932
    1933 static sctp_disposition_t __sctp_sf_do_9_1_abort(struct net *net,
    1934 @@ -615,6 +613,38 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(struct net *net,
    1935 return SCTP_DISPOSITION_CONSUME;
    1936 }
    1937
    1938 +static bool sctp_auth_chunk_verify(struct net *net, struct sctp_chunk *chunk,
    1939 + const struct sctp_association *asoc)
    1940 +{
    1941 + struct sctp_chunk auth;
    1942 +
    1943 + if (!chunk->auth_chunk)
    1944 + return true;
    1945 +
    1946 + /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo
    1947 + * is supposed to be authenticated and we have to do delayed
    1948 + * authentication. We've just recreated the association using
    1949 + * the information in the cookie and now it's much easier to
    1950 + * do the authentication.
    1951 + */
    1952 +
    1953 + /* Make sure that we and the peer are AUTH capable */
    1954 + if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
    1955 + return false;
    1956 +
    1957 + /* set-up our fake chunk so that we can process it */
    1958 + auth.skb = chunk->auth_chunk;
    1959 + auth.asoc = chunk->asoc;
    1960 + auth.sctp_hdr = chunk->sctp_hdr;
    1961 + auth.chunk_hdr = (struct sctp_chunkhdr *)
    1962 + skb_push(chunk->auth_chunk,
    1963 + sizeof(struct sctp_chunkhdr));
    1964 + skb_pull(chunk->auth_chunk, sizeof(struct sctp_chunkhdr));
    1965 + auth.transport = chunk->transport;
    1966 +
    1967 + return sctp_sf_authenticate(asoc, &auth) == SCTP_IERROR_NO_ERROR;
    1968 +}
    1969 +
    1970 /*
    1971 * Respond to a normal COOKIE ECHO chunk.
    1972 * We are the side that is being asked for an association.
    1973 @@ -751,36 +781,9 @@ sctp_disposition_t sctp_sf_do_5_1D_ce(struct net *net,
    1974 if (error)
    1975 goto nomem_init;
    1976
    1977 - /* SCTP-AUTH: auth_chunk pointer is only set when the cookie-echo
    1978 - * is supposed to be authenticated and we have to do delayed
    1979 - * authentication. We've just recreated the association using
    1980 - * the information in the cookie and now it's much easier to
    1981 - * do the authentication.
    1982 - */
    1983 - if (chunk->auth_chunk) {
    1984 - struct sctp_chunk auth;
    1985 - sctp_ierror_t ret;
    1986 -
    1987 - /* Make sure that we and the peer are AUTH capable */
    1988 - if (!net->sctp.auth_enable || !new_asoc->peer.auth_capable) {
    1989 - sctp_association_free(new_asoc);
    1990 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1991 - }
    1992 -
    1993 - /* set-up our fake chunk so that we can process it */
    1994 - auth.skb = chunk->auth_chunk;
    1995 - auth.asoc = chunk->asoc;
    1996 - auth.sctp_hdr = chunk->sctp_hdr;
    1997 - auth.chunk_hdr = (sctp_chunkhdr_t *)skb_push(chunk->auth_chunk,
    1998 - sizeof(sctp_chunkhdr_t));
    1999 - skb_pull(chunk->auth_chunk, sizeof(sctp_chunkhdr_t));
    2000 - auth.transport = chunk->transport;
    2001 -
    2002 - ret = sctp_sf_authenticate(net, ep, new_asoc, type, &auth);
    2003 - if (ret != SCTP_IERROR_NO_ERROR) {
    2004 - sctp_association_free(new_asoc);
    2005 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    2006 - }
    2007 + if (!sctp_auth_chunk_verify(net, chunk, new_asoc)) {
    2008 + sctp_association_free(new_asoc);
    2009 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    2010 }
    2011
    2012 repl = sctp_make_cookie_ack(new_asoc, chunk);
    2013 @@ -1717,13 +1720,15 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
    2014 GFP_ATOMIC))
    2015 goto nomem;
    2016
    2017 + if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
    2018 + return SCTP_DISPOSITION_DISCARD;
    2019 +
    2020 /* Make sure no new addresses are being added during the
    2021 * restart. Though this is a pretty complicated attack
    2022 * since you'd have to get inside the cookie.
    2023 */
    2024 - if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands)) {
    2025 + if (!sctp_sf_check_restart_addrs(new_asoc, asoc, chunk, commands))
    2026 return SCTP_DISPOSITION_CONSUME;
    2027 - }
    2028
    2029 /* If the endpoint is in the SHUTDOWN-ACK-SENT state and recognizes
    2030 * the peer has restarted (Action A), it MUST NOT setup a new
    2031 @@ -1828,6 +1833,9 @@ static sctp_disposition_t sctp_sf_do_dupcook_b(struct net *net,
    2032 GFP_ATOMIC))
    2033 goto nomem;
    2034
    2035 + if (!sctp_auth_chunk_verify(net, chunk, new_asoc))
    2036 + return SCTP_DISPOSITION_DISCARD;
    2037 +
    2038 /* Update the content of current association. */
    2039 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
    2040 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
    2041 @@ -1920,6 +1928,9 @@ static sctp_disposition_t sctp_sf_do_dupcook_d(struct net *net,
    2042 * a COOKIE ACK.
    2043 */
    2044
    2045 + if (!sctp_auth_chunk_verify(net, chunk, asoc))
    2046 + return SCTP_DISPOSITION_DISCARD;
    2047 +
    2048 /* Don't accidentally move back into established state. */
    2049 if (asoc->state < SCTP_STATE_ESTABLISHED) {
    2050 sctp_add_cmd_sf(commands, SCTP_CMD_TIMER_STOP,
    2051 @@ -1959,7 +1970,7 @@ static sctp_disposition_t sctp_sf_do_dupcook_d(struct net *net,
    2052 }
    2053 }
    2054
    2055 - repl = sctp_make_cookie_ack(new_asoc, chunk);
    2056 + repl = sctp_make_cookie_ack(asoc, chunk);
    2057 if (!repl)
    2058 goto nomem;
    2059
    2060 @@ -3981,10 +3992,8 @@ sctp_disposition_t sctp_sf_eat_fwd_tsn_fast(
    2061 *
    2062 * The return value is the disposition of the chunk.
    2063 */
    2064 -static sctp_ierror_t sctp_sf_authenticate(struct net *net,
    2065 - const struct sctp_endpoint *ep,
    2066 +static sctp_ierror_t sctp_sf_authenticate(
    2067 const struct sctp_association *asoc,
    2068 - const sctp_subtype_t type,
    2069 struct sctp_chunk *chunk)
    2070 {
    2071 struct sctp_authhdr *auth_hdr;
    2072 @@ -4083,7 +4092,7 @@ sctp_disposition_t sctp_sf_eat_auth(struct net *net,
    2073 commands);
    2074
    2075 auth_hdr = (struct sctp_authhdr *)chunk->skb->data;
    2076 - error = sctp_sf_authenticate(net, ep, asoc, type, chunk);
    2077 + error = sctp_sf_authenticate(asoc, chunk);
    2078 switch (error) {
    2079 case SCTP_IERROR_AUTH_BAD_HMAC:
    2080 /* Generate the ERROR chunk and discard the rest
    2081 diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
    2082 index bea00058ce35..6825e05a68b2 100644
    2083 --- a/net/sctp/ulpevent.c
    2084 +++ b/net/sctp/ulpevent.c
    2085 @@ -723,7 +723,6 @@ struct sctp_ulpevent *sctp_ulpevent_make_rcvmsg(struct sctp_association *asoc,
    2086 return event;
    2087
    2088 fail_mark:
    2089 - sctp_chunk_put(chunk);
    2090 kfree_skb(skb);
    2091 fail:
    2092 return NULL;
    2093 diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
    2094 index 6f5635770d6a..71a94e549301 100644
    2095 --- a/net/xfrm/xfrm_state.c
    2096 +++ b/net/xfrm/xfrm_state.c
    2097 @@ -1197,6 +1197,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
    2098
    2099 if (orig->aead) {
    2100 x->aead = xfrm_algo_aead_clone(orig->aead);
    2101 + x->geniv = orig->geniv;
    2102 if (!x->aead)
    2103 goto error;
    2104 }