Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0207-4.9.108-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.9/0207-4.9.108-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3184 - (hide annotations) (download)
    Wed Aug 8 14:17:35 2018 UTC (5 years, 10 months ago) by niro
    File size: 26963 byte(s) 
    -linux-4.9.108
    1 niro 3184 diff --git a/Documentation/networking/netdev-FAQ.txt b/Documentation/networking/netdev-FAQ.txt
    2     index a20b2fae942b..56af008e9258 100644
    3     --- a/Documentation/networking/netdev-FAQ.txt
    4     +++ b/Documentation/networking/netdev-FAQ.txt
    5     @@ -168,6 +168,15 @@ A: No. See above answer. In short, if you think it really belongs in
    6     dash marker line as described in Documentation/SubmittingPatches to
    7     temporarily embed that information into the patch that you send.
    8    
    9     +Q: Are all networking bug fixes backported to all stable releases?
    10     +
    11     +A: Due to capacity, Dave could only take care of the backports for the last
    12     + 2 stable releases. For earlier stable releases, each stable branch maintainer
    13     + is supposed to take care of them. If you find any patch is missing from an
    14     + earlier stable branch, please notify stable@vger.kernel.org with either a
    15     + commit ID or a formal patch backported, and CC Dave and other relevant
    16     + networking developers.
    17     +
    18     Q: Someone said that the comment style and coding convention is different
    19     for the networking content. Is this true?
    20    
    21     diff --git a/Makefile b/Makefile
    22     index ac30e448e0a5..1fa9daf219c4 100644
    23     --- a/Makefile
    24     +++ b/Makefile
    25     @@ -1,6 +1,6 @@
    26     VERSION = 4
    27     PATCHLEVEL = 9
    28     -SUBLEVEL = 107
    29     +SUBLEVEL = 108
    30     EXTRAVERSION =
    31     NAME = Roaring Lionus
    32    
    33     diff --git a/arch/x86/kernel/vmlinux.lds.S b/arch/x86/kernel/vmlinux.lds.S
    34     index 4ef267fb635a..e783a5daaab2 100644
    35     --- a/arch/x86/kernel/vmlinux.lds.S
    36     +++ b/arch/x86/kernel/vmlinux.lds.S
    37     @@ -352,8 +352,6 @@ SECTIONS
    38     DISCARDS
    39     /DISCARD/ : {
    40     *(.eh_frame)
    41     - *(__func_stack_frame_non_standard)
    42     - *(__unreachable)
    43     }
    44     }
    45    
    46     diff --git a/arch/x86/kvm/cpuid.h b/arch/x86/kvm/cpuid.h
    47     index c38369781239..8a841b9d8f84 100644
    48     --- a/arch/x86/kvm/cpuid.h
    49     +++ b/arch/x86/kvm/cpuid.h
    50     @@ -179,7 +179,7 @@ static inline bool guest_cpuid_has_spec_ctrl(struct kvm_vcpu *vcpu)
    51     if (best && (best->ebx & bit(X86_FEATURE_AMD_IBRS)))
    52     return true;
    53     best = kvm_find_cpuid_entry(vcpu, 7, 0);
    54     - return best && (best->edx & (bit(X86_FEATURE_SPEC_CTRL) | bit(X86_FEATURE_SSBD)));
    55     + return best && (best->edx & (bit(X86_FEATURE_SPEC_CTRL) | bit(X86_FEATURE_SPEC_CTRL_SSBD)));
    56     }
    57    
    58     static inline bool guest_cpuid_has_arch_capabilities(struct kvm_vcpu *vcpu)
    59     diff --git a/drivers/char/tpm/tpm-chip.c b/drivers/char/tpm/tpm-chip.c
    60     index 9ff853229957..8d097d10fd13 100644
    61     --- a/drivers/char/tpm/tpm-chip.c
    62     +++ b/drivers/char/tpm/tpm-chip.c
    63     @@ -26,6 +26,7 @@
    64     #include <linux/spinlock.h>
    65     #include <linux/freezer.h>
    66     #include <linux/major.h>
    67     +#include <linux/of.h>
    68     #include "tpm.h"
    69     #include "tpm_eventlog.h"
    70    
    71     @@ -388,8 +389,20 @@ static int tpm_add_legacy_sysfs(struct tpm_chip *chip)
    72     */
    73     int tpm_chip_register(struct tpm_chip *chip)
    74     {
    75     +#ifdef CONFIG_OF
    76     + struct device_node *np;
    77     +#endif
    78     int rc;
    79    
    80     +#ifdef CONFIG_OF
    81     + np = of_find_node_by_name(NULL, "vtpm");
    82     + if (np) {
    83     + if (of_property_read_bool(np, "powered-while-suspended"))
    84     + chip->flags |= TPM_CHIP_FLAG_ALWAYS_POWERED;
    85     + }
    86     + of_node_put(np);
    87     +#endif
    88     +
    89     if (chip->ops->flags & TPM_OPS_AUTO_STARTUP) {
    90     if (chip->flags & TPM_CHIP_FLAG_TPM2)
    91     rc = tpm2_auto_startup(chip);
    92     diff --git a/drivers/char/tpm/tpm-interface.c b/drivers/char/tpm/tpm-interface.c
    93     index 830d7e30e508..faf2db122ab9 100644
    94     --- a/drivers/char/tpm/tpm-interface.c
    95     +++ b/drivers/char/tpm/tpm-interface.c
    96     @@ -803,6 +803,10 @@ int tpm_do_selftest(struct tpm_chip *chip)
    97     loops = jiffies_to_msecs(duration) / delay_msec;
    98    
    99     rc = tpm_continue_selftest(chip);
    100     + if (rc == TPM_ERR_INVALID_POSTINIT) {
    101     + chip->flags |= TPM_CHIP_FLAG_ALWAYS_POWERED;
    102     + dev_info(&chip->dev, "TPM not ready (%d)\n", rc);
    103     + }
    104     /* This may fail if there was no TPM driver during a suspend/resume
    105     * cycle; some may return 10 (BAD_ORDINAL), others 28 (FAILEDSELFTEST)
    106     */
    107     @@ -969,6 +973,9 @@ int tpm_pm_suspend(struct device *dev)
    108     if (chip == NULL)
    109     return -ENODEV;
    110    
    111     + if (chip->flags & TPM_CHIP_FLAG_ALWAYS_POWERED)
    112     + return 0;
    113     +
    114     if (chip->flags & TPM_CHIP_FLAG_TPM2) {
    115     tpm2_shutdown(chip, TPM2_SU_STATE);
    116     return 0;
    117     diff --git a/drivers/char/tpm/tpm.h b/drivers/char/tpm/tpm.h
    118     index aa4299cf7e5a..a4fc2badf633 100644
    119     --- a/drivers/char/tpm/tpm.h
    120     +++ b/drivers/char/tpm/tpm.h
    121     @@ -143,6 +143,7 @@ enum tpm_chip_flags {
    122     TPM_CHIP_FLAG_TPM2 = BIT(1),
    123     TPM_CHIP_FLAG_IRQ = BIT(2),
    124     TPM_CHIP_FLAG_VIRTUAL = BIT(3),
    125     + TPM_CHIP_FLAG_ALWAYS_POWERED = BIT(5),
    126     };
    127    
    128     struct tpm_chip {
    129     diff --git a/drivers/gpu/drm/drm_fops.c b/drivers/gpu/drm/drm_fops.c
    130     index f5815e1a4390..c37b7b5f1dd3 100644
    131     --- a/drivers/gpu/drm/drm_fops.c
    132     +++ b/drivers/gpu/drm/drm_fops.c
    133     @@ -198,6 +198,7 @@ static int drm_open_helper(struct file *filp, struct drm_minor *minor)
    134     return -ENOMEM;
    135    
    136     filp->private_data = priv;
    137     + filp->f_mode |= FMODE_UNSIGNED_OFFSET;
    138     priv->filp = filp;
    139     priv->pid = get_pid(task_pid(current));
    140     priv->minor = minor;
    141     diff --git a/drivers/isdn/hardware/eicon/diva.c b/drivers/isdn/hardware/eicon/diva.c
    142     index d91dd580e978..37aaea88a6ad 100644
    143     --- a/drivers/isdn/hardware/eicon/diva.c
    144     +++ b/drivers/isdn/hardware/eicon/diva.c
    145     @@ -387,10 +387,10 @@ void divasa_xdi_driver_unload(void)
    146     ** Receive and process command from user mode utility
    147     */
    148     void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
    149     - int length,
    150     + int length, void *mptr,
    151     divas_xdi_copy_from_user_fn_t cp_fn)
    152     {
    153     - diva_xdi_um_cfg_cmd_t msg;
    154     + diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr;
    155     diva_os_xdi_adapter_t *a = NULL;
    156     diva_os_spin_lock_magic_t old_irql;
    157     struct list_head *tmp;
    158     @@ -400,21 +400,21 @@ void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
    159     length, sizeof(diva_xdi_um_cfg_cmd_t)))
    160     return NULL;
    161     }
    162     - if ((*cp_fn) (os_handle, &msg, src, sizeof(msg)) <= 0) {
    163     + if ((*cp_fn) (os_handle, msg, src, sizeof(*msg)) <= 0) {
    164     DBG_ERR(("A: A(?) open, write error"))
    165     return NULL;
    166     }
    167     diva_os_enter_spin_lock(&adapter_lock, &old_irql, "open_adapter");
    168     list_for_each(tmp, &adapter_queue) {
    169     a = list_entry(tmp, diva_os_xdi_adapter_t, link);
    170     - if (a->controller == (int)msg.adapter)
    171     + if (a->controller == (int)msg->adapter)
    172     break;
    173     a = NULL;
    174     }
    175     diva_os_leave_spin_lock(&adapter_lock, &old_irql, "open_adapter");
    176    
    177     if (!a) {
    178     - DBG_ERR(("A: A(%d) open, adapter not found", msg.adapter))
    179     + DBG_ERR(("A: A(%d) open, adapter not found", msg->adapter))
    180     }
    181    
    182     return (a);
    183     @@ -436,8 +436,10 @@ void diva_xdi_close_adapter(void *adapter, void *os_handle)
    184    
    185     int
    186     diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
    187     - int length, divas_xdi_copy_from_user_fn_t cp_fn)
    188     + int length, void *mptr,
    189     + divas_xdi_copy_from_user_fn_t cp_fn)
    190     {
    191     + diva_xdi_um_cfg_cmd_t *msg = (diva_xdi_um_cfg_cmd_t *)mptr;
    192     diva_os_xdi_adapter_t *a = (diva_os_xdi_adapter_t *) adapter;
    193     void *data;
    194    
    195     @@ -458,7 +460,13 @@ diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
    196     return (-2);
    197     }
    198    
    199     - length = (*cp_fn) (os_handle, data, src, length);
    200     + if (msg) {
    201     + *(diva_xdi_um_cfg_cmd_t *)data = *msg;
    202     + length = (*cp_fn) (os_handle, (char *)data + sizeof(*msg),
    203     + src + sizeof(*msg), length - sizeof(*msg));
    204     + } else {
    205     + length = (*cp_fn) (os_handle, data, src, length);
    206     + }
    207     if (length > 0) {
    208     if ((*(a->interface.cmd_proc))
    209     (a, (diva_xdi_um_cfg_cmd_t *) data, length)) {
    210     diff --git a/drivers/isdn/hardware/eicon/diva.h b/drivers/isdn/hardware/eicon/diva.h
    211     index e979085d1b89..a0a607c0c32e 100644
    212     --- a/drivers/isdn/hardware/eicon/diva.h
    213     +++ b/drivers/isdn/hardware/eicon/diva.h
    214     @@ -19,10 +19,11 @@ int diva_xdi_read(void *adapter, void *os_handle, void __user *dst,
    215     int max_length, divas_xdi_copy_to_user_fn_t cp_fn);
    216    
    217     int diva_xdi_write(void *adapter, void *os_handle, const void __user *src,
    218     - int length, divas_xdi_copy_from_user_fn_t cp_fn);
    219     + int length, void *msg,
    220     + divas_xdi_copy_from_user_fn_t cp_fn);
    221    
    222     void *diva_xdi_open_adapter(void *os_handle, const void __user *src,
    223     - int length,
    224     + int length, void *msg,
    225     divas_xdi_copy_from_user_fn_t cp_fn);
    226    
    227     void diva_xdi_close_adapter(void *adapter, void *os_handle);
    228     diff --git a/drivers/isdn/hardware/eicon/divasmain.c b/drivers/isdn/hardware/eicon/divasmain.c
    229     index 32f34511c416..1e8b9918bfce 100644
    230     --- a/drivers/isdn/hardware/eicon/divasmain.c
    231     +++ b/drivers/isdn/hardware/eicon/divasmain.c
    232     @@ -591,19 +591,22 @@ static int divas_release(struct inode *inode, struct file *file)
    233     static ssize_t divas_write(struct file *file, const char __user *buf,
    234     size_t count, loff_t *ppos)
    235     {
    236     + diva_xdi_um_cfg_cmd_t msg;
    237     int ret = -EINVAL;
    238    
    239     if (!file->private_data) {
    240     file->private_data = diva_xdi_open_adapter(file, buf,
    241     - count,
    242     + count, &msg,
    243     xdi_copy_from_user);
    244     - }
    245     - if (!file->private_data) {
    246     - return (-ENODEV);
    247     + if (!file->private_data)
    248     + return (-ENODEV);
    249     + ret = diva_xdi_write(file->private_data, file,
    250     + buf, count, &msg, xdi_copy_from_user);
    251     + } else {
    252     + ret = diva_xdi_write(file->private_data, file,
    253     + buf, count, NULL, xdi_copy_from_user);
    254     }
    255    
    256     - ret = diva_xdi_write(file->private_data, file,
    257     - buf, count, xdi_copy_from_user);
    258     switch (ret) {
    259     case -1: /* Message should be removed from rx mailbox first */
    260     ret = -EBUSY;
    261     @@ -622,11 +625,12 @@ static ssize_t divas_write(struct file *file, const char __user *buf,
    262     static ssize_t divas_read(struct file *file, char __user *buf,
    263     size_t count, loff_t *ppos)
    264     {
    265     + diva_xdi_um_cfg_cmd_t msg;
    266     int ret = -EINVAL;
    267    
    268     if (!file->private_data) {
    269     file->private_data = diva_xdi_open_adapter(file, buf,
    270     - count,
    271     + count, &msg,
    272     xdi_copy_from_user);
    273     }
    274     if (!file->private_data) {
    275     diff --git a/drivers/md/dm-bufio.c b/drivers/md/dm-bufio.c
    276     index 3ec647e8b9c6..35fd57fdeba9 100644
    277     --- a/drivers/md/dm-bufio.c
    278     +++ b/drivers/md/dm-bufio.c
    279     @@ -373,9 +373,6 @@ static void __cache_size_refresh(void)
    280     static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
    281     enum data_mode *data_mode)
    282     {
    283     - unsigned noio_flag;
    284     - void *ptr;
    285     -
    286     if (c->block_size <= DM_BUFIO_BLOCK_SIZE_SLAB_LIMIT) {
    287     *data_mode = DATA_MODE_SLAB;
    288     return kmem_cache_alloc(DM_BUFIO_CACHE(c), gfp_mask);
    289     @@ -399,16 +396,16 @@ static void *alloc_buffer_data(struct dm_bufio_client *c, gfp_t gfp_mask,
    290     * all allocations done by this process (including pagetables) are done
    291     * as if GFP_NOIO was specified.
    292     */
    293     + if (gfp_mask & __GFP_NORETRY) {
    294     + unsigned noio_flag = memalloc_noio_save();
    295     + void *ptr = __vmalloc(c->block_size, gfp_mask | __GFP_HIGHMEM,
    296     + PAGE_KERNEL);
    297    
    298     - if (gfp_mask & __GFP_NORETRY)
    299     - noio_flag = memalloc_noio_save();
    300     -
    301     - ptr = __vmalloc(c->block_size, gfp_mask | __GFP_HIGHMEM, PAGE_KERNEL);
    302     -
    303     - if (gfp_mask & __GFP_NORETRY)
    304     memalloc_noio_restore(noio_flag);
    305     + return ptr;
    306     + }
    307    
    308     - return ptr;
    309     + return __vmalloc(c->block_size, gfp_mask | __GFP_HIGHMEM, PAGE_KERNEL);
    310     }
    311    
    312     /*
    313     diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
    314     index 1fb80100e5e7..912900db935f 100644
    315     --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
    316     +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
    317     @@ -594,7 +594,7 @@ static void bnx2x_ets_e3b0_nig_disabled(const struct link_params *params,
    318     * slots for the highest priority.
    319     */
    320     REG_WR(bp, (port) ? NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS :
    321     - NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100);
    322     + NIG_REG_P0_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100);
    323     /* Mapping between the CREDIT_WEIGHT registers and actual client
    324     * numbers
    325     */
    326     diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
    327     index dda63b26e370..99f593be26e2 100644
    328     --- a/drivers/net/ethernet/cisco/enic/enic_main.c
    329     +++ b/drivers/net/ethernet/cisco/enic/enic_main.c
    330     @@ -2541,11 +2541,11 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
    331     pci_set_master(pdev);
    332    
    333     /* Query PCI controller on system for DMA addressing
    334     - * limitation for the device. Try 64-bit first, and
    335     + * limitation for the device. Try 47-bit first, and
    336     * fail to 32-bit.
    337     */
    338    
    339     - err = pci_set_dma_mask(pdev, DMA_BIT_MASK(64));
    340     + err = pci_set_dma_mask(pdev, DMA_BIT_MASK(47));
    341     if (err) {
    342     err = pci_set_dma_mask(pdev, DMA_BIT_MASK(32));
    343     if (err) {
    344     @@ -2559,10 +2559,10 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
    345     goto err_out_release_regions;
    346     }
    347     } else {
    348     - err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(64));
    349     + err = pci_set_consistent_dma_mask(pdev, DMA_BIT_MASK(47));
    350     if (err) {
    351     dev_err(dev, "Unable to obtain %u-bit DMA "
    352     - "for consistent allocations, aborting\n", 64);
    353     + "for consistent allocations, aborting\n", 47);
    354     goto err_out_release_regions;
    355     }
    356     using_dac = 1;
    357     diff --git a/drivers/net/ethernet/mellanox/mlx4/qp.c b/drivers/net/ethernet/mellanox/mlx4/qp.c
    358     index 474ff36b9755..71578d48efbc 100644
    359     --- a/drivers/net/ethernet/mellanox/mlx4/qp.c
    360     +++ b/drivers/net/ethernet/mellanox/mlx4/qp.c
    361     @@ -392,11 +392,11 @@ struct mlx4_qp *mlx4_qp_lookup(struct mlx4_dev *dev, u32 qpn)
    362     struct mlx4_qp_table *qp_table = &mlx4_priv(dev)->qp_table;
    363     struct mlx4_qp *qp;
    364    
    365     - spin_lock(&qp_table->lock);
    366     + spin_lock_irq(&qp_table->lock);
    367    
    368     qp = __mlx4_qp_lookup(dev, qpn);
    369    
    370     - spin_unlock(&qp_table->lock);
    371     + spin_unlock_irq(&qp_table->lock);
    372     return qp;
    373     }
    374    
    375     diff --git a/drivers/net/ethernet/qlogic/qed/qed_cxt.c b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
    376     index 457e30427535..f1956c4d02a0 100644
    377     --- a/drivers/net/ethernet/qlogic/qed/qed_cxt.c
    378     +++ b/drivers/net/ethernet/qlogic/qed/qed_cxt.c
    379     @@ -54,7 +54,7 @@
    380     #define ILT_CFG_REG(cli, reg) PSWRQ2_REG_ ## cli ## _ ## reg ## _RT_OFFSET
    381    
    382     /* ILT entry structure */
    383     -#define ILT_ENTRY_PHY_ADDR_MASK 0x000FFFFFFFFFFFULL
    384     +#define ILT_ENTRY_PHY_ADDR_MASK (~0ULL >> 12)
    385     #define ILT_ENTRY_PHY_ADDR_SHIFT 0
    386     #define ILT_ENTRY_VALID_MASK 0x1ULL
    387     #define ILT_ENTRY_VALID_SHIFT 52
    388     diff --git a/drivers/net/phy/bcm-cygnus.c b/drivers/net/phy/bcm-cygnus.c
    389     index 49bbc6826883..9a7dca2bb618 100644
    390     --- a/drivers/net/phy/bcm-cygnus.c
    391     +++ b/drivers/net/phy/bcm-cygnus.c
    392     @@ -61,17 +61,17 @@ static int bcm_cygnus_afe_config(struct phy_device *phydev)
    393     return rc;
    394    
    395     /* make rcal=100, since rdb default is 000 */
    396     - rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB1, 0x10);
    397     + rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB1, 0x10);
    398     if (rc < 0)
    399     return rc;
    400    
    401     /* CORE_EXPB0, Reset R_CAL/RC_CAL Engine */
    402     - rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x10);
    403     + rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x10);
    404     if (rc < 0)
    405     return rc;
    406    
    407     /* CORE_EXPB0, Disable Reset R_CAL/RC_CAL Engine */
    408     - rc = bcm_phy_write_exp(phydev, MII_BRCM_CORE_EXPB0, 0x00);
    409     + rc = bcm_phy_write_exp_sel(phydev, MII_BRCM_CORE_EXPB0, 0x00);
    410    
    411     return 0;
    412     }
    413     diff --git a/drivers/net/phy/bcm-phy-lib.h b/drivers/net/phy/bcm-phy-lib.h
    414     index b2091c88b44d..ce16b26d49ff 100644
    415     --- a/drivers/net/phy/bcm-phy-lib.h
    416     +++ b/drivers/net/phy/bcm-phy-lib.h
    417     @@ -14,11 +14,18 @@
    418     #ifndef _LINUX_BCM_PHY_LIB_H
    419     #define _LINUX_BCM_PHY_LIB_H
    420    
    421     +#include <linux/brcmphy.h>
    422     #include <linux/phy.h>
    423    
    424     int bcm_phy_write_exp(struct phy_device *phydev, u16 reg, u16 val);
    425     int bcm_phy_read_exp(struct phy_device *phydev, u16 reg);
    426    
    427     +static inline int bcm_phy_write_exp_sel(struct phy_device *phydev,
    428     + u16 reg, u16 val)
    429     +{
    430     + return bcm_phy_write_exp(phydev, reg | MII_BCM54XX_EXP_SEL_ER, val);
    431     +}
    432     +
    433     int bcm_phy_write_misc(struct phy_device *phydev,
    434     u16 reg, u16 chl, u16 value);
    435     int bcm_phy_read_misc(struct phy_device *phydev,
    436     diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c
    437     index 9636da0b6efc..caff474d2ee2 100644
    438     --- a/drivers/net/phy/bcm7xxx.c
    439     +++ b/drivers/net/phy/bcm7xxx.c
    440     @@ -48,10 +48,10 @@
    441     static void r_rc_cal_reset(struct phy_device *phydev)
    442     {
    443     /* Reset R_CAL/RC_CAL Engine */
    444     - bcm_phy_write_exp(phydev, 0x00b0, 0x0010);
    445     + bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0010);
    446    
    447     /* Disable Reset R_AL/RC_CAL Engine */
    448     - bcm_phy_write_exp(phydev, 0x00b0, 0x0000);
    449     + bcm_phy_write_exp_sel(phydev, 0x00b0, 0x0000);
    450     }
    451    
    452     static int bcm7xxx_28nm_b0_afe_config_init(struct phy_device *phydev)
    453     diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
    454     index 36963685d42a..f9ec00981b1e 100644
    455     --- a/drivers/net/team/team.c
    456     +++ b/drivers/net/team/team.c
    457     @@ -1004,7 +1004,8 @@ static void team_port_disable(struct team *team,
    458     static void ___team_compute_features(struct team *team)
    459     {
    460     struct team_port *port;
    461     - u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL;
    462     + netdev_features_t vlan_features = TEAM_VLAN_FEATURES &
    463     + NETIF_F_ALL_FOR_ALL;
    464     netdev_features_t enc_features = TEAM_ENC_FEATURES;
    465     unsigned short max_hard_header_len = ETH_HLEN;
    466     unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
    467     diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
    468     index 3a98f3762a4c..4c8baba72933 100644
    469     --- a/drivers/net/usb/cdc_mbim.c
    470     +++ b/drivers/net/usb/cdc_mbim.c
    471     @@ -608,7 +608,7 @@ static const struct driver_info cdc_mbim_info_ndp_to_end = {
    472     */
    473     static const struct driver_info cdc_mbim_info_avoid_altsetting_toggle = {
    474     .description = "CDC MBIM",
    475     - .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
    476     + .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
    477     .bind = cdc_mbim_bind,
    478     .unbind = cdc_mbim_unbind,
    479     .manage_power = cdc_mbim_manage_power,
    480     diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
    481     index fce49ebc575d..c81bc4efe1a6 100644
    482     --- a/drivers/vhost/vhost.c
    483     +++ b/drivers/vhost/vhost.c
    484     @@ -938,6 +938,7 @@ int vhost_process_iotlb_msg(struct vhost_dev *dev,
    485     {
    486     int ret = 0;
    487    
    488     + mutex_lock(&dev->mutex);
    489     vhost_dev_lock_vqs(dev);
    490     switch (msg->type) {
    491     case VHOST_IOTLB_UPDATE:
    492     @@ -967,6 +968,8 @@ int vhost_process_iotlb_msg(struct vhost_dev *dev,
    493     }
    494    
    495     vhost_dev_unlock_vqs(dev);
    496     + mutex_unlock(&dev->mutex);
    497     +
    498     return ret;
    499     }
    500     ssize_t vhost_chr_write_iter(struct vhost_dev *dev,
    501     diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
    502     index c5eafcdb3664..92f3b231d5a2 100644
    503     --- a/fs/btrfs/disk-io.c
    504     +++ b/fs/btrfs/disk-io.c
    505     @@ -59,7 +59,8 @@
    506     BTRFS_HEADER_FLAG_RELOC |\
    507     BTRFS_SUPER_FLAG_ERROR |\
    508     BTRFS_SUPER_FLAG_SEEDING |\
    509     - BTRFS_SUPER_FLAG_METADUMP)
    510     + BTRFS_SUPER_FLAG_METADUMP |\
    511     + BTRFS_SUPER_FLAG_METADUMP_V2)
    512    
    513     static const struct extent_io_ops btree_extent_io_ops;
    514     static void end_workqueue_fn(struct btrfs_work *work);
    515     diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
    516     index 2214b2f9c73c..ad793c69cc46 100644
    517     --- a/include/linux/compiler-gcc.h
    518     +++ b/include/linux/compiler-gcc.h
    519     @@ -206,7 +206,7 @@
    520     #ifdef CONFIG_STACK_VALIDATION
    521     #define annotate_unreachable() ({ \
    522     asm("1:\t\n" \
    523     - ".pushsection __unreachable, \"a\"\t\n" \
    524     + ".pushsection .discard.unreachable\t\n" \
    525     ".long 1b\t\n" \
    526     ".popsection\t\n"); \
    527     })
    528     diff --git a/include/uapi/linux/btrfs_tree.h b/include/uapi/linux/btrfs_tree.h
    529     index d5ad15a106a7..c794c9af6c0f 100644
    530     --- a/include/uapi/linux/btrfs_tree.h
    531     +++ b/include/uapi/linux/btrfs_tree.h
    532     @@ -452,6 +452,7 @@ struct btrfs_free_space_header {
    533    
    534     #define BTRFS_SUPER_FLAG_SEEDING (1ULL << 32)
    535     #define BTRFS_SUPER_FLAG_METADUMP (1ULL << 33)
    536     +#define BTRFS_SUPER_FLAG_METADUMP_V2 (1ULL << 34)
    537    
    538    
    539     /*
    540     diff --git a/mm/mmap.c b/mm/mmap.c
    541     index 45ac5b973459..aa97074a4a99 100644
    542     --- a/mm/mmap.c
    543     +++ b/mm/mmap.c
    544     @@ -1312,6 +1312,35 @@ static inline int mlock_future_check(struct mm_struct *mm,
    545     return 0;
    546     }
    547    
    548     +static inline u64 file_mmap_size_max(struct file *file, struct inode *inode)
    549     +{
    550     + if (S_ISREG(inode->i_mode))
    551     + return MAX_LFS_FILESIZE;
    552     +
    553     + if (S_ISBLK(inode->i_mode))
    554     + return MAX_LFS_FILESIZE;
    555     +
    556     + /* Special "we do even unsigned file positions" case */
    557     + if (file->f_mode & FMODE_UNSIGNED_OFFSET)
    558     + return 0;
    559     +
    560     + /* Yes, random drivers might want more. But I'm tired of buggy drivers */
    561     + return ULONG_MAX;
    562     +}
    563     +
    564     +static inline bool file_mmap_ok(struct file *file, struct inode *inode,
    565     + unsigned long pgoff, unsigned long len)
    566     +{
    567     + u64 maxsize = file_mmap_size_max(file, inode);
    568     +
    569     + if (maxsize && len > maxsize)
    570     + return false;
    571     + maxsize -= len;
    572     + if (pgoff > maxsize >> PAGE_SHIFT)
    573     + return false;
    574     + return true;
    575     +}
    576     +
    577     /*
    578     * The caller must hold down_write(&current->mm->mmap_sem).
    579     */
    580     @@ -1384,6 +1413,9 @@ unsigned long do_mmap(struct file *file, unsigned long addr,
    581     if (file) {
    582     struct inode *inode = file_inode(file);
    583    
    584     + if (!file_mmap_ok(file, inode, pgoff, len))
    585     + return -EOVERFLOW;
    586     +
    587     switch (flags & MAP_TYPE) {
    588     case MAP_SHARED:
    589     if ((prot&PROT_WRITE) && !(file->f_mode&FMODE_WRITE))
    590     diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    591     index c2339b865164..f3a0ad14b454 100644
    592     --- a/net/core/rtnetlink.c
    593     +++ b/net/core/rtnetlink.c
    594     @@ -1914,6 +1914,10 @@ static int do_setlink(const struct sk_buff *skb,
    595     const struct net_device_ops *ops = dev->netdev_ops;
    596     int err;
    597    
    598     + err = validate_linkmsg(dev, tb);
    599     + if (err < 0)
    600     + return err;
    601     +
    602     if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD]) {
    603     struct net *net = rtnl_link_get_net(dev_net(dev), tb);
    604     if (IS_ERR(net)) {
    605     @@ -2234,10 +2238,6 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)
    606     goto errout;
    607     }
    608    
    609     - err = validate_linkmsg(dev, tb);
    610     - if (err < 0)
    611     - goto errout;
    612     -
    613     err = do_setlink(skb, dev, ifm, tb, ifname, 0);
    614     errout:
    615     return err;
    616     diff --git a/net/dccp/proto.c b/net/dccp/proto.c
    617     index ff3b058cf58c..936dab12f99f 100644
    618     --- a/net/dccp/proto.c
    619     +++ b/net/dccp/proto.c
    620     @@ -280,9 +280,7 @@ int dccp_disconnect(struct sock *sk, int flags)
    621    
    622     dccp_clear_xmit_timers(sk);
    623     ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
    624     - ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
    625     dp->dccps_hc_rx_ccid = NULL;
    626     - dp->dccps_hc_tx_ccid = NULL;
    627    
    628     __skb_queue_purge(&sk->sk_receive_queue);
    629     __skb_queue_purge(&sk->sk_write_queue);
    630     diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
    631     index e1be24416c0e..d476b7950adf 100644
    632     --- a/net/ipv4/fib_semantics.c
    633     +++ b/net/ipv4/fib_semantics.c
    634     @@ -979,6 +979,8 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
    635     if (val == TCP_CA_UNSPEC)
    636     return -EINVAL;
    637     } else {
    638     + if (nla_len(nla) != sizeof(u32))
    639     + return false;
    640     val = nla_get_u32(nla);
    641     }
    642     if (type == RTAX_ADVMSS && val > 65535 - 40)
    643     diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
    644     index 5ddd64995e73..dd80276a8205 100644
    645     --- a/net/ipv4/ip_sockglue.c
    646     +++ b/net/ipv4/ip_sockglue.c
    647     @@ -503,8 +503,6 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
    648     int err;
    649     int copied;
    650    
    651     - WARN_ON_ONCE(sk->sk_family == AF_INET6);
    652     -
    653     err = -EAGAIN;
    654     skb = sock_dequeue_err_skb(sk);
    655     if (!skb)
    656     diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    657     index e8560031a0be..eb9046eae581 100644
    658     --- a/net/ipv6/ip6_output.c
    659     +++ b/net/ipv6/ip6_output.c
    660     @@ -487,7 +487,8 @@ int ip6_forward(struct sk_buff *skb)
    661     send redirects to source routed frames.
    662     We don't send redirects to frames decapsulated from IPsec.
    663     */
    664     - if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
    665     + if (IP6CB(skb)->iif == dst->dev->ifindex &&
    666     + opt->srcrt == 0 && !skb_sec_path(skb)) {
    667     struct in6_addr *target = NULL;
    668     struct inet_peer *peer;
    669     struct rt6_info *rt;
    670     diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
    671     index a30e7e925c9b..4b93ad4fe6d8 100644
    672     --- a/net/ipv6/ip6mr.c
    673     +++ b/net/ipv6/ip6mr.c
    674     @@ -1789,7 +1789,8 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
    675     ret = 0;
    676     if (!ip6mr_new_table(net, v))
    677     ret = -ENOMEM;
    678     - raw6_sk(sk)->ip6mr_table = v;
    679     + else
    680     + raw6_sk(sk)->ip6mr_table = v;
    681     rtnl_unlock();
    682     return ret;
    683     }
    684     diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
    685     index 3fe80e104b58..21f3bf2125f4 100644
    686     --- a/net/ipv6/ndisc.c
    687     +++ b/net/ipv6/ndisc.c
    688     @@ -1538,6 +1538,12 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
    689     ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
    690     bool ret;
    691    
    692     + if (netif_is_l3_master(skb->dev)) {
    693     + dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
    694     + if (!dev)
    695     + return;
    696     + }
    697     +
    698     if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
    699     ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
    700     dev->name);
    701     diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
    702     index cc306defcc19..553d0ad4a2fa 100644
    703     --- a/net/kcm/kcmsock.c
    704     +++ b/net/kcm/kcmsock.c
    705     @@ -1671,7 +1671,7 @@ static struct file *kcm_clone(struct socket *osock)
    706     __module_get(newsock->ops->owner);
    707    
    708     newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
    709     - &kcm_proto, true);
    710     + &kcm_proto, false);
    711     if (!newsk) {
    712     sock_release(newsock);
    713     return ERR_PTR(-ENOMEM);
    714     diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    715     index b2b50756263b..2c4a47f29f36 100644
    716     --- a/net/packet/af_packet.c
    717     +++ b/net/packet/af_packet.c
    718     @@ -2918,7 +2918,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
    719     if (unlikely(offset < 0))
    720     goto out_free;
    721     } else if (reserve) {
    722     - skb_push(skb, reserve);
    723     + skb_reserve(skb, -reserve);
    724     }
    725    
    726     /* Returns -EFAULT on error */
    727     @@ -4299,7 +4299,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
    728     goto out;
    729     if (po->tp_version >= TPACKET_V3 &&
    730     req->tp_block_size <=
    731     - BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
    732     + BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
    733     goto out;
    734     if (unlikely(req->tp_frame_size < po->tp_hdrlen +
    735     po->tp_reserve))
    736     diff --git a/net/sctp/transport.c b/net/sctp/transport.c
    737     index ce54dce13ddb..03d71cd97ec0 100644
    738     --- a/net/sctp/transport.c
    739     +++ b/net/sctp/transport.c
    740     @@ -608,7 +608,7 @@ unsigned long sctp_transport_timeout(struct sctp_transport *trans)
    741     trans->state != SCTP_PF)
    742     timeout += trans->hbinterval;
    743    
    744     - return timeout;
    745     + return max_t(unsigned long, timeout, HZ / 5);
    746     }
    747    
    748     /* Reset transport variables to their initial values */
    749     diff --git a/scripts/Makefile.build b/scripts/Makefile.build
    750     index 7675d11ee65e..abfd4f4b66dd 100644
    751     --- a/scripts/Makefile.build
    752     +++ b/scripts/Makefile.build
    753     @@ -253,6 +253,9 @@ objtool_args = check
    754     ifndef CONFIG_FRAME_POINTER
    755     objtool_args += --no-fp
    756     endif
    757     +ifdef CONFIG_GCOV_KERNEL
    758     +objtool_args += --no-unreachable
    759     +endif
    760    
    761     # 'OBJECT_FILES_NON_STANDARD := y': skip objtool checking for a directory
    762     # 'OBJECT_FILES_NON_STANDARD_foo.o := 'y': skip objtool checking for a file
    763     diff --git a/scripts/kconfig/confdata.c b/scripts/kconfig/confdata.c
    764     index 297b079ae4d9..27aac273205b 100644
    765     --- a/scripts/kconfig/confdata.c
    766     +++ b/scripts/kconfig/confdata.c
    767     @@ -745,7 +745,7 @@ int conf_write(const char *name)
    768     struct menu *menu;
    769     const char *basename;
    770     const char *str;
    771     - char dirname[PATH_MAX+1], tmpname[PATH_MAX+1], newname[PATH_MAX+1];
    772     + char dirname[PATH_MAX+1], tmpname[PATH_MAX+22], newname[PATH_MAX+8];
    773     char *env;
    774    
    775     dirname[0] = 0;