Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0263-4.9.164-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.9/0263-4.9.164-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3340 - (hide annotations) (download)
    Tue Jun 18 09:41:54 2019 UTC (4 years, 10 months ago) by niro
    File size: 28153 byte(s) 
    -linux-4.9.164
    1 niro 3340 diff --git a/Makefile b/Makefile
    2     index 8a5330e279ad..e1bcc76388dc 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 163
    9     +SUBLEVEL = 164
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/x86/events/perf_event.h b/arch/x86/events/perf_event.h
    14     index 1ce6ae35f6a2..c42c9d50c8ee 100644
    15     --- a/arch/x86/events/perf_event.h
    16     +++ b/arch/x86/events/perf_event.h
    17     @@ -996,12 +996,12 @@ static inline int intel_pmu_init(void)
    18     return 0;
    19     }
    20    
    21     -static inline int intel_cpuc_prepare(struct cpu_hw_event *cpuc, int cpu)
    22     +static inline int intel_cpuc_prepare(struct cpu_hw_events *cpuc, int cpu)
    23     {
    24     return 0;
    25     }
    26    
    27     -static inline void intel_cpuc_finish(struct cpu_hw_event *cpuc)
    28     +static inline void intel_cpuc_finish(struct cpu_hw_events *cpuc)
    29     {
    30     }
    31    
    32     diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c
    33     index b62e6ab66b31..67414616eb35 100644
    34     --- a/drivers/md/raid10.c
    35     +++ b/drivers/md/raid10.c
    36     @@ -4489,7 +4489,6 @@ bio_full:
    37     atomic_inc(&r10_bio->remaining);
    38     read_bio->bi_next = NULL;
    39     generic_make_request(read_bio);
    40     - sector_nr += nr_sectors;
    41     sectors_done += nr_sectors;
    42     if (sector_nr <= last)
    43     goto read_more;
    44     diff --git a/drivers/mmc/host/tmio_mmc_pio.c b/drivers/mmc/host/tmio_mmc_pio.c
    45     index 700567603107..0fc1f73b0d23 100644
    46     --- a/drivers/mmc/host/tmio_mmc_pio.c
    47     +++ b/drivers/mmc/host/tmio_mmc_pio.c
    48     @@ -675,7 +675,7 @@ static bool __tmio_mmc_sdcard_irq(struct tmio_mmc_host *host,
    49     return false;
    50     }
    51    
    52     -static void tmio_mmc_sdio_irq(int irq, void *devid)
    53     +static bool tmio_mmc_sdio_irq(int irq, void *devid)
    54     {
    55     struct tmio_mmc_host *host = devid;
    56     struct mmc_host *mmc = host->mmc;
    57     @@ -684,7 +684,7 @@ static void tmio_mmc_sdio_irq(int irq, void *devid)
    58     unsigned int sdio_status;
    59    
    60     if (!(pdata->flags & TMIO_MMC_SDIO_IRQ))
    61     - return;
    62     + return false;
    63    
    64     status = sd_ctrl_read16(host, CTL_SDIO_STATUS);
    65     ireg = status & TMIO_SDIO_MASK_ALL & ~host->sdcard_irq_mask;
    66     @@ -697,6 +697,8 @@ static void tmio_mmc_sdio_irq(int irq, void *devid)
    67    
    68     if (mmc->caps & MMC_CAP_SDIO_IRQ && ireg & TMIO_SDIO_STAT_IOIRQ)
    69     mmc_signal_sdio_irq(mmc);
    70     +
    71     + return ireg;
    72     }
    73    
    74     irqreturn_t tmio_mmc_irq(int irq, void *devid)
    75     @@ -718,9 +720,10 @@ irqreturn_t tmio_mmc_irq(int irq, void *devid)
    76     if (__tmio_mmc_sdcard_irq(host, ireg, status))
    77     return IRQ_HANDLED;
    78    
    79     - tmio_mmc_sdio_irq(irq, devid);
    80     + if (tmio_mmc_sdio_irq(irq, devid))
    81     + return IRQ_HANDLED;
    82    
    83     - return IRQ_HANDLED;
    84     + return IRQ_NONE;
    85     }
    86     EXPORT_SYMBOL(tmio_mmc_irq);
    87    
    88     diff --git a/drivers/net/ethernet/mellanox/mlx4/cmd.c b/drivers/net/ethernet/mellanox/mlx4/cmd.c
    89     index dae9dcfa8f36..e5283387097f 100644
    90     --- a/drivers/net/ethernet/mellanox/mlx4/cmd.c
    91     +++ b/drivers/net/ethernet/mellanox/mlx4/cmd.c
    92     @@ -2633,6 +2633,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
    93     if (!priv->cmd.context)
    94     return -ENOMEM;
    95    
    96     + if (mlx4_is_mfunc(dev))
    97     + mutex_lock(&priv->cmd.slave_cmd_mutex);
    98     down_write(&priv->cmd.switch_sem);
    99     for (i = 0; i < priv->cmd.max_cmds; ++i) {
    100     priv->cmd.context[i].token = i;
    101     @@ -2658,6 +2660,8 @@ int mlx4_cmd_use_events(struct mlx4_dev *dev)
    102     down(&priv->cmd.poll_sem);
    103     priv->cmd.use_events = 1;
    104     up_write(&priv->cmd.switch_sem);
    105     + if (mlx4_is_mfunc(dev))
    106     + mutex_unlock(&priv->cmd.slave_cmd_mutex);
    107    
    108     return err;
    109     }
    110     @@ -2670,6 +2674,8 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev)
    111     struct mlx4_priv *priv = mlx4_priv(dev);
    112     int i;
    113    
    114     + if (mlx4_is_mfunc(dev))
    115     + mutex_lock(&priv->cmd.slave_cmd_mutex);
    116     down_write(&priv->cmd.switch_sem);
    117     priv->cmd.use_events = 0;
    118    
    119     @@ -2677,9 +2683,12 @@ void mlx4_cmd_use_polling(struct mlx4_dev *dev)
    120     down(&priv->cmd.event_sem);
    121    
    122     kfree(priv->cmd.context);
    123     + priv->cmd.context = NULL;
    124    
    125     up(&priv->cmd.poll_sem);
    126     up_write(&priv->cmd.switch_sem);
    127     + if (mlx4_is_mfunc(dev))
    128     + mutex_unlock(&priv->cmd.slave_cmd_mutex);
    129     }
    130    
    131     struct mlx4_cmd_mailbox *mlx4_alloc_cmd_mailbox(struct mlx4_dev *dev)
    132     diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
    133     index 9d1a7d5ae835..79944302dd46 100644
    134     --- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
    135     +++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
    136     @@ -2677,13 +2677,13 @@ static int qp_get_mtt_size(struct mlx4_qp_context *qpc)
    137     int total_pages;
    138     int total_mem;
    139     int page_offset = (be32_to_cpu(qpc->params2) >> 6) & 0x3f;
    140     + int tot;
    141    
    142     sq_size = 1 << (log_sq_size + log_sq_sride + 4);
    143     rq_size = (srq|rss|xrc) ? 0 : (1 << (log_rq_size + log_rq_stride + 4));
    144     total_mem = sq_size + rq_size;
    145     - total_pages =
    146     - roundup_pow_of_two((total_mem + (page_offset << 6)) >>
    147     - page_shift);
    148     + tot = (total_mem + (page_offset << 6)) >> page_shift;
    149     + total_pages = !tot ? 1 : roundup_pow_of_two(tot);
    150    
    151     return total_pages;
    152     }
    153     diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
    154     index 71836a7f56b0..480883a7a3e5 100644
    155     --- a/drivers/net/ethernet/renesas/ravb_main.c
    156     +++ b/drivers/net/ethernet/renesas/ravb_main.c
    157     @@ -457,7 +457,7 @@ static int ravb_dmac_init(struct net_device *ndev)
    158     RCR_EFFS | RCR_ENCF | RCR_ETS0 | RCR_ESF | 0x18000000, RCR);
    159    
    160     /* Set FIFO size */
    161     - ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00222200, TGC);
    162     + ravb_write(ndev, TGC_TQP_AVBMODE1 | 0x00112200, TGC);
    163    
    164     /* Timestamp enable */
    165     ravb_write(ndev, TCCR_TFEN, TCCR);
    166     diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
    167     index 4a2609c4dd6e..72fb55ca27f3 100644
    168     --- a/drivers/net/ipvlan/ipvlan_main.c
    169     +++ b/drivers/net/ipvlan/ipvlan_main.c
    170     @@ -463,7 +463,12 @@ static int ipvlan_nl_changelink(struct net_device *dev,
    171     struct ipvl_port *port = ipvlan_port_get_rtnl(ipvlan->phy_dev);
    172     int err = 0;
    173    
    174     - if (data && data[IFLA_IPVLAN_MODE]) {
    175     + if (!data)
    176     + return 0;
    177     + if (!ns_capable(dev_net(ipvlan->phy_dev)->user_ns, CAP_NET_ADMIN))
    178     + return -EPERM;
    179     +
    180     + if (data[IFLA_IPVLAN_MODE]) {
    181     u16 nmode = nla_get_u16(data[IFLA_IPVLAN_MODE]);
    182    
    183     err = ipvlan_set_port_mode(port, nmode);
    184     @@ -530,6 +535,8 @@ static int ipvlan_link_new(struct net *src_net, struct net_device *dev,
    185     struct ipvl_dev *tmp = netdev_priv(phy_dev);
    186    
    187     phy_dev = tmp->phy_dev;
    188     + if (!ns_capable(dev_net(phy_dev)->user_ns, CAP_NET_ADMIN))
    189     + return -EPERM;
    190     } else if (!netif_is_ipvlan_port(phy_dev)) {
    191     err = ipvlan_port_create(phy_dev);
    192     if (err < 0)
    193     diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
    194     index 09deef4bed09..a9bbdcec0bad 100644
    195     --- a/drivers/net/phy/mdio_bus.c
    196     +++ b/drivers/net/phy/mdio_bus.c
    197     @@ -319,7 +319,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
    198     err = device_register(&bus->dev);
    199     if (err) {
    200     pr_err("mii_bus %s failed to register\n", bus->id);
    201     - put_device(&bus->dev);
    202     return -EINVAL;
    203     }
    204    
    205     diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
    206     index 3045c9662ed6..5a8befdfa5e4 100644
    207     --- a/drivers/net/ppp/pptp.c
    208     +++ b/drivers/net/ppp/pptp.c
    209     @@ -541,6 +541,7 @@ static void pptp_sock_destruct(struct sock *sk)
    210     pppox_unbind_sock(sk);
    211     }
    212     skb_queue_purge(&sk->sk_receive_queue);
    213     + dst_release(rcu_dereference_protected(sk->sk_dst_cache, 1));
    214     }
    215    
    216     static int pptp_create(struct net *net, struct socket *sock, int kern)
    217     diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
    218     index 373713faa1f5..016f5da425ab 100644
    219     --- a/drivers/net/vxlan.c
    220     +++ b/drivers/net/vxlan.c
    221     @@ -1380,6 +1380,14 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
    222     goto drop;
    223     }
    224    
    225     + rcu_read_lock();
    226     +
    227     + if (unlikely(!(vxlan->dev->flags & IFF_UP))) {
    228     + rcu_read_unlock();
    229     + atomic_long_inc(&vxlan->dev->rx_dropped);
    230     + goto drop;
    231     + }
    232     +
    233     stats = this_cpu_ptr(vxlan->dev->tstats);
    234     u64_stats_update_begin(&stats->syncp);
    235     stats->rx_packets++;
    236     @@ -1387,6 +1395,9 @@ static int vxlan_rcv(struct sock *sk, struct sk_buff *skb)
    237     u64_stats_update_end(&stats->syncp);
    238    
    239     gro_cells_receive(&vxlan->gro_cells, skb);
    240     +
    241     + rcu_read_unlock();
    242     +
    243     return 0;
    244    
    245     drop:
    246     @@ -2362,6 +2373,8 @@ static void vxlan_uninit(struct net_device *dev)
    247     {
    248     struct vxlan_dev *vxlan = netdev_priv(dev);
    249    
    250     + gro_cells_destroy(&vxlan->gro_cells);
    251     +
    252     vxlan_fdb_delete_default(vxlan);
    253    
    254     free_percpu(dev->tstats);
    255     @@ -3112,7 +3125,6 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
    256     {
    257     struct vxlan_dev *vxlan = netdev_priv(dev);
    258    
    259     - gro_cells_destroy(&vxlan->gro_cells);
    260     list_del(&vxlan->next);
    261     unregister_netdevice_queue(dev, head);
    262     }
    263     diff --git a/drivers/vhost/vsock.c b/drivers/vhost/vsock.c
    264     index 72e914de473e..3cefd602b5b1 100644
    265     --- a/drivers/vhost/vsock.c
    266     +++ b/drivers/vhost/vsock.c
    267     @@ -640,7 +640,7 @@ static int vhost_vsock_set_cid(struct vhost_vsock *vsock, u64 guest_cid)
    268     hash_del_rcu(&vsock->hash);
    269    
    270     vsock->guest_cid = guest_cid;
    271     - hash_add_rcu(vhost_vsock_hash, &vsock->hash, guest_cid);
    272     + hash_add_rcu(vhost_vsock_hash, &vsock->hash, vsock->guest_cid);
    273     spin_unlock_bh(&vhost_vsock_lock);
    274    
    275     return 0;
    276     diff --git a/include/acpi/acconfig.h b/include/acpi/acconfig.h
    277     index 12c2882bf647..eef069616a2f 100644
    278     --- a/include/acpi/acconfig.h
    279     +++ b/include/acpi/acconfig.h
    280     @@ -122,7 +122,7 @@
    281    
    282     /* Maximum object reference count (detects object deletion issues) */
    283    
    284     -#define ACPI_MAX_REFERENCE_COUNT 0x1000
    285     +#define ACPI_MAX_REFERENCE_COUNT 0x4000
    286    
    287     /* Default page size for use in mapping memory for operation regions */
    288    
    289     diff --git a/include/linux/of.h b/include/linux/of.h
    290     index a19cc85b9373..aac3f09c5d90 100644
    291     --- a/include/linux/of.h
    292     +++ b/include/linux/of.h
    293     @@ -148,16 +148,20 @@ extern raw_spinlock_t devtree_lock;
    294     #ifdef CONFIG_OF
    295     void of_core_init(void);
    296    
    297     -static inline bool is_of_node(struct fwnode_handle *fwnode)
    298     +static inline bool is_of_node(const struct fwnode_handle *fwnode)
    299     {
    300     return !IS_ERR_OR_NULL(fwnode) && fwnode->type == FWNODE_OF;
    301     }
    302    
    303     -static inline struct device_node *to_of_node(struct fwnode_handle *fwnode)
    304     -{
    305     - return is_of_node(fwnode) ?
    306     - container_of(fwnode, struct device_node, fwnode) : NULL;
    307     -}
    308     +#define to_of_node(__fwnode) \
    309     + ({ \
    310     + typeof(__fwnode) __to_of_node_fwnode = (__fwnode); \
    311     + \
    312     + is_of_node(__to_of_node_fwnode) ? \
    313     + container_of(__to_of_node_fwnode, \
    314     + struct device_node, fwnode) : \
    315     + NULL; \
    316     + })
    317    
    318     static inline bool of_have_populated_dt(void)
    319     {
    320     @@ -529,12 +533,12 @@ static inline void of_core_init(void)
    321     {
    322     }
    323    
    324     -static inline bool is_of_node(struct fwnode_handle *fwnode)
    325     +static inline bool is_of_node(const struct fwnode_handle *fwnode)
    326     {
    327     return false;
    328     }
    329    
    330     -static inline struct device_node *to_of_node(struct fwnode_handle *fwnode)
    331     +static inline struct device_node *to_of_node(const struct fwnode_handle *fwnode)
    332     {
    333     return NULL;
    334     }
    335     diff --git a/include/net/gro_cells.h b/include/net/gro_cells.h
    336     index 95f33eeee984..6db0e8534127 100644
    337     --- a/include/net/gro_cells.h
    338     +++ b/include/net/gro_cells.h
    339     @@ -18,22 +18,36 @@ static inline int gro_cells_receive(struct gro_cells *gcells, struct sk_buff *sk
    340     {
    341     struct gro_cell *cell;
    342     struct net_device *dev = skb->dev;
    343     + int res;
    344    
    345     - if (!gcells->cells || skb_cloned(skb) || !(dev->features & NETIF_F_GRO))
    346     - return netif_rx(skb);
    347     + rcu_read_lock();
    348     + if (unlikely(!(dev->flags & IFF_UP)))
    349     + goto drop;
    350     +
    351     + if (!gcells->cells || skb_cloned(skb) || !(dev->features & NETIF_F_GRO)) {
    352     + res = netif_rx(skb);
    353     + goto unlock;
    354     + }
    355    
    356     cell = this_cpu_ptr(gcells->cells);
    357    
    358     if (skb_queue_len(&cell->napi_skbs) > netdev_max_backlog) {
    359     +drop:
    360     atomic_long_inc(&dev->rx_dropped);
    361     kfree_skb(skb);
    362     - return NET_RX_DROP;
    363     + res = NET_RX_DROP;
    364     + goto unlock;
    365     }
    366    
    367     __skb_queue_tail(&cell->napi_skbs, skb);
    368     if (skb_queue_len(&cell->napi_skbs) == 1)
    369     napi_schedule(&cell->napi);
    370     - return NET_RX_SUCCESS;
    371     +
    372     + res = NET_RX_SUCCESS;
    373     +
    374     +unlock:
    375     + rcu_read_unlock();
    376     + return res;
    377     }
    378    
    379     /* called under BH context */
    380     diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
    381     index 16737cd8dae8..52694cb759b0 100644
    382     --- a/net/hsr/hsr_device.c
    383     +++ b/net/hsr/hsr_device.c
    384     @@ -94,9 +94,8 @@ static void hsr_check_announce(struct net_device *hsr_dev,
    385     && (old_operstate != IF_OPER_UP)) {
    386     /* Went up */
    387     hsr->announce_count = 0;
    388     - hsr->announce_timer.expires = jiffies +
    389     - msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
    390     - add_timer(&hsr->announce_timer);
    391     + mod_timer(&hsr->announce_timer,
    392     + jiffies + msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL));
    393     }
    394    
    395     if ((hsr_dev->operstate != IF_OPER_UP) && (old_operstate == IF_OPER_UP))
    396     @@ -331,6 +330,7 @@ static void hsr_announce(unsigned long data)
    397     {
    398     struct hsr_priv *hsr;
    399     struct hsr_port *master;
    400     + unsigned long interval;
    401    
    402     hsr = (struct hsr_priv *) data;
    403    
    404     @@ -342,18 +342,16 @@ static void hsr_announce(unsigned long data)
    405     hsr->protVersion);
    406     hsr->announce_count++;
    407    
    408     - hsr->announce_timer.expires = jiffies +
    409     - msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
    410     + interval = msecs_to_jiffies(HSR_ANNOUNCE_INTERVAL);
    411     } else {
    412     send_hsr_supervision_frame(master, HSR_TLV_LIFE_CHECK,
    413     hsr->protVersion);
    414    
    415     - hsr->announce_timer.expires = jiffies +
    416     - msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL);
    417     + interval = msecs_to_jiffies(HSR_LIFE_CHECK_INTERVAL);
    418     }
    419    
    420     if (is_admin_up(master->dev))
    421     - add_timer(&hsr->announce_timer);
    422     + mod_timer(&hsr->announce_timer, jiffies + interval);
    423    
    424     rcu_read_unlock();
    425     }
    426     @@ -485,7 +483,7 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
    427    
    428     res = hsr_add_port(hsr, hsr_dev, HSR_PT_MASTER);
    429     if (res)
    430     - return res;
    431     + goto err_add_port;
    432    
    433     res = register_netdevice(hsr_dev);
    434     if (res)
    435     @@ -505,6 +503,8 @@ int hsr_dev_finalize(struct net_device *hsr_dev, struct net_device *slave[2],
    436     fail:
    437     hsr_for_each_port(hsr, port)
    438     hsr_del_port(port);
    439     +err_add_port:
    440     + hsr_del_node(&hsr->self_node_db);
    441    
    442     return res;
    443     }
    444     diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
    445     index 284a9b820df8..6705420b3111 100644
    446     --- a/net/hsr/hsr_framereg.c
    447     +++ b/net/hsr/hsr_framereg.c
    448     @@ -124,6 +124,18 @@ int hsr_create_self_node(struct list_head *self_node_db,
    449     return 0;
    450     }
    451    
    452     +void hsr_del_node(struct list_head *self_node_db)
    453     +{
    454     + struct hsr_node *node;
    455     +
    456     + rcu_read_lock();
    457     + node = list_first_or_null_rcu(self_node_db, struct hsr_node, mac_list);
    458     + rcu_read_unlock();
    459     + if (node) {
    460     + list_del_rcu(&node->mac_list);
    461     + kfree(node);
    462     + }
    463     +}
    464    
    465     /* Allocate an hsr_node and add it to node_db. 'addr' is the node's AddressA;
    466     * seq_out is used to initialize filtering of outgoing duplicate frames
    467     diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
    468     index 4e04f0e868e9..43958a338095 100644
    469     --- a/net/hsr/hsr_framereg.h
    470     +++ b/net/hsr/hsr_framereg.h
    471     @@ -16,6 +16,7 @@
    472    
    473     struct hsr_node;
    474    
    475     +void hsr_del_node(struct list_head *self_node_db);
    476     struct hsr_node *hsr_add_node(struct list_head *node_db, unsigned char addr[],
    477     u16 seq_out);
    478     struct hsr_node *hsr_get_node(struct hsr_port *port, struct sk_buff *skb,
    479     diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
    480     index 528a6777cda0..1bcbb7399fe6 100644
    481     --- a/net/ipv4/inet_connection_sock.c
    482     +++ b/net/ipv4/inet_connection_sock.c
    483     @@ -790,7 +790,6 @@ static void inet_child_forget(struct sock *sk, struct request_sock *req,
    484     tcp_sk(child)->fastopen_rsk = NULL;
    485     }
    486     inet_csk_destroy_sock(child);
    487     - reqsk_put(req);
    488     }
    489    
    490     struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
    491     @@ -861,6 +860,7 @@ void inet_csk_listen_stop(struct sock *sk)
    492     sock_hold(child);
    493    
    494     inet_child_forget(sk, req, child);
    495     + reqsk_put(req);
    496     bh_unlock_sock(child);
    497     local_bh_enable();
    498     sock_put(child);
    499     diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    500     index d606de65e2d0..c42fb2330b45 100644
    501     --- a/net/ipv4/route.c
    502     +++ b/net/ipv4/route.c
    503     @@ -1613,6 +1613,10 @@ static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
    504     if (fnhe->fnhe_daddr == daddr) {
    505     rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
    506     fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
    507     + /* set fnhe_daddr to 0 to ensure it won't bind with
    508     + * new dsts in rt_bind_exception().
    509     + */
    510     + fnhe->fnhe_daddr = 0;
    511     fnhe_flush_routes(fnhe);
    512     kfree_rcu(fnhe, rcu);
    513     break;
    514     diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
    515     index 0597ad73a1fa..b596c413d297 100644
    516     --- a/net/ipv4/syncookies.c
    517     +++ b/net/ipv4/syncookies.c
    518     @@ -225,7 +225,12 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
    519     if (child) {
    520     atomic_set(&req->rsk_refcnt, 1);
    521     sock_rps_save_rxhash(child, skb);
    522     - inet_csk_reqsk_queue_add(sk, req, child);
    523     + if (!inet_csk_reqsk_queue_add(sk, req, child)) {
    524     + bh_unlock_sock(child);
    525     + sock_put(child);
    526     + child = NULL;
    527     + reqsk_put(req);
    528     + }
    529     } else {
    530     reqsk_free(req);
    531     }
    532     diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    533     index dbb153c6b21a..48fe63c4fe24 100644
    534     --- a/net/ipv4/tcp_input.c
    535     +++ b/net/ipv4/tcp_input.c
    536     @@ -6479,7 +6479,13 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
    537     af_ops->send_synack(fastopen_sk, dst, &fl, req,
    538     &foc, TCP_SYNACK_FASTOPEN);
    539     /* Add the child socket directly into the accept queue */
    540     - inet_csk_reqsk_queue_add(sk, req, fastopen_sk);
    541     + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
    542     + reqsk_fastopen_remove(fastopen_sk, req, false);
    543     + bh_unlock_sock(fastopen_sk);
    544     + sock_put(fastopen_sk);
    545     + reqsk_put(req);
    546     + goto drop;
    547     + }
    548     sk->sk_data_ready(sk);
    549     bh_unlock_sock(fastopen_sk);
    550     sock_put(fastopen_sk);
    551     diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    552     index b0a72677b7e5..27c93baed708 100644
    553     --- a/net/ipv6/route.c
    554     +++ b/net/ipv6/route.c
    555     @@ -3211,7 +3211,7 @@ static int rt6_fill_node(struct net *net,
    556     table = rt->rt6i_table->tb6_id;
    557     else
    558     table = RT6_TABLE_UNSPEC;
    559     - rtm->rtm_table = table;
    560     + rtm->rtm_table = table < 256 ? table : RT_TABLE_COMPAT;
    561     if (nla_put_u32(skb, RTA_TABLE, table))
    562     goto nla_put_failure;
    563     if (rt->rt6i_flags & RTF_REJECT) {
    564     diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    565     index 75de3dd8b862..c9c6a5e829ab 100644
    566     --- a/net/ipv6/sit.c
    567     +++ b/net/ipv6/sit.c
    568     @@ -767,8 +767,9 @@ static bool check_6rd(struct ip_tunnel *tunnel, const struct in6_addr *v6dst,
    569     pbw0 = tunnel->ip6rd.prefixlen >> 5;
    570     pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
    571    
    572     - d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
    573     - tunnel->ip6rd.relay_prefixlen;
    574     + d = tunnel->ip6rd.relay_prefixlen < 32 ?
    575     + (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
    576     + tunnel->ip6rd.relay_prefixlen : 0;
    577    
    578     pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
    579     if (pbi1 > 0)
    580     diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
    581     index 5e6d09863480..8d412b9b0214 100644
    582     --- a/net/l2tp/l2tp_ip6.c
    583     +++ b/net/l2tp/l2tp_ip6.c
    584     @@ -680,9 +680,6 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
    585     if (flags & MSG_OOB)
    586     goto out;
    587    
    588     - if (addr_len)
    589     - *addr_len = sizeof(*lsa);
    590     -
    591     if (flags & MSG_ERRQUEUE)
    592     return ipv6_recv_error(sk, msg, len, addr_len);
    593    
    594     @@ -712,6 +709,7 @@ static int l2tp_ip6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
    595     lsa->l2tp_conn_id = 0;
    596     if (ipv6_addr_type(&lsa->l2tp_addr) & IPV6_ADDR_LINKLOCAL)
    597     lsa->l2tp_scope_id = inet6_iif(skb);
    598     + *addr_len = sizeof(*lsa);
    599     }
    600    
    601     if (np->rxopt.all)
    602     diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
    603     index 60ef9605167e..0fce919bf47d 100644
    604     --- a/net/rxrpc/conn_client.c
    605     +++ b/net/rxrpc/conn_client.c
    606     @@ -355,7 +355,7 @@ static int rxrpc_get_client_conn(struct rxrpc_call *call,
    607     * normally have to take channel_lock but we do this before anyone else
    608     * can see the connection.
    609     */
    610     - list_add_tail(&call->chan_wait_link, &candidate->waiting_calls);
    611     + list_add(&call->chan_wait_link, &candidate->waiting_calls);
    612    
    613     if (cp->exclusive) {
    614     call->conn = candidate;
    615     @@ -430,7 +430,7 @@ found_extant_conn:
    616     spin_lock(&conn->channel_lock);
    617     call->conn = conn;
    618     call->security_ix = conn->security_ix;
    619     - list_add(&call->chan_wait_link, &conn->waiting_calls);
    620     + list_add_tail(&call->chan_wait_link, &conn->waiting_calls);
    621     spin_unlock(&conn->channel_lock);
    622     _leave(" = 0 [extant %d]", conn->debug_id);
    623     return 0;
    624     diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
    625     index 915abe98174e..cecf51a5aec4 100644
    626     --- a/net/unix/af_unix.c
    627     +++ b/net/unix/af_unix.c
    628     @@ -891,7 +891,7 @@ retry:
    629     addr->hash ^= sk->sk_type;
    630    
    631     __unix_remove_socket(sk);
    632     - u->addr = addr;
    633     + smp_store_release(&u->addr, addr);
    634     __unix_insert_socket(&unix_socket_table[addr->hash], sk);
    635     spin_unlock(&unix_table_lock);
    636     err = 0;
    637     @@ -1061,7 +1061,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
    638    
    639     err = 0;
    640     __unix_remove_socket(sk);
    641     - u->addr = addr;
    642     + smp_store_release(&u->addr, addr);
    643     __unix_insert_socket(list, sk);
    644    
    645     out_unlock:
    646     @@ -1332,15 +1332,29 @@ restart:
    647     RCU_INIT_POINTER(newsk->sk_wq, &newu->peer_wq);
    648     otheru = unix_sk(other);
    649    
    650     - /* copy address information from listening to new sock*/
    651     - if (otheru->addr) {
    652     - atomic_inc(&otheru->addr->refcnt);
    653     - newu->addr = otheru->addr;
    654     - }
    655     + /* copy address information from listening to new sock
    656     + *
    657     + * The contents of *(otheru->addr) and otheru->path
    658     + * are seen fully set up here, since we have found
    659     + * otheru in hash under unix_table_lock. Insertion
    660     + * into the hash chain we'd found it in had been done
    661     + * in an earlier critical area protected by unix_table_lock,
    662     + * the same one where we'd set *(otheru->addr) contents,
    663     + * as well as otheru->path and otheru->addr itself.
    664     + *
    665     + * Using smp_store_release() here to set newu->addr
    666     + * is enough to make those stores, as well as stores
    667     + * to newu->path visible to anyone who gets newu->addr
    668     + * by smp_load_acquire(). IOW, the same warranties
    669     + * as for unix_sock instances bound in unix_bind() or
    670     + * in unix_autobind().
    671     + */
    672     if (otheru->path.dentry) {
    673     path_get(&otheru->path);
    674     newu->path = otheru->path;
    675     }
    676     + atomic_inc(&otheru->addr->refcnt);
    677     + smp_store_release(&newu->addr, otheru->addr);
    678    
    679     /* Set credentials */
    680     copy_peercred(sk, other);
    681     @@ -1453,7 +1467,7 @@ out:
    682     static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_len, int peer)
    683     {
    684     struct sock *sk = sock->sk;
    685     - struct unix_sock *u;
    686     + struct unix_address *addr;
    687     DECLARE_SOCKADDR(struct sockaddr_un *, sunaddr, uaddr);
    688     int err = 0;
    689    
    690     @@ -1468,19 +1482,15 @@ static int unix_getname(struct socket *sock, struct sockaddr *uaddr, int *uaddr_
    691     sock_hold(sk);
    692     }
    693    
    694     - u = unix_sk(sk);
    695     - unix_state_lock(sk);
    696     - if (!u->addr) {
    697     + addr = smp_load_acquire(&unix_sk(sk)->addr);
    698     + if (!addr) {
    699     sunaddr->sun_family = AF_UNIX;
    700     sunaddr->sun_path[0] = 0;
    701     *uaddr_len = sizeof(short);
    702     } else {
    703     - struct unix_address *addr = u->addr;
    704     -
    705     *uaddr_len = addr->len;
    706     memcpy(sunaddr, addr->name, *uaddr_len);
    707     }
    708     - unix_state_unlock(sk);
    709     sock_put(sk);
    710     out:
    711     return err;
    712     @@ -2094,11 +2104,11 @@ static int unix_seqpacket_recvmsg(struct socket *sock, struct msghdr *msg,
    713    
    714     static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
    715     {
    716     - struct unix_sock *u = unix_sk(sk);
    717     + struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr);
    718    
    719     - if (u->addr) {
    720     - msg->msg_namelen = u->addr->len;
    721     - memcpy(msg->msg_name, u->addr->name, u->addr->len);
    722     + if (addr) {
    723     + msg->msg_namelen = addr->len;
    724     + memcpy(msg->msg_name, addr->name, addr->len);
    725     }
    726     }
    727    
    728     @@ -2814,7 +2824,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
    729     (s->sk_state == TCP_ESTABLISHED ? SS_CONNECTING : SS_DISCONNECTING),
    730     sock_i_ino(s));
    731    
    732     - if (u->addr) {
    733     + if (u->addr) { // under unix_table_lock here
    734     int i, len;
    735     seq_putc(seq, ' ');
    736    
    737     diff --git a/net/unix/diag.c b/net/unix/diag.c
    738     index 384c84e83462..3183d9b8ab33 100644
    739     --- a/net/unix/diag.c
    740     +++ b/net/unix/diag.c
    741     @@ -10,7 +10,8 @@
    742    
    743     static int sk_diag_dump_name(struct sock *sk, struct sk_buff *nlskb)
    744     {
    745     - struct unix_address *addr = unix_sk(sk)->addr;
    746     + /* might or might not have unix_table_lock */
    747     + struct unix_address *addr = smp_load_acquire(&unix_sk(sk)->addr);
    748    
    749     if (!addr)
    750     return 0;
    751     diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
    752     index 0a7e5d992bba..770ababb8f92 100644
    753     --- a/net/x25/af_x25.c
    754     +++ b/net/x25/af_x25.c
    755     @@ -678,8 +678,7 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
    756     struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
    757     int len, i, rc = 0;
    758    
    759     - if (!sock_flag(sk, SOCK_ZAPPED) ||
    760     - addr_len != sizeof(struct sockaddr_x25) ||
    761     + if (addr_len != sizeof(struct sockaddr_x25) ||
    762     addr->sx25_family != AF_X25) {
    763     rc = -EINVAL;
    764     goto out;
    765     @@ -694,9 +693,13 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
    766     }
    767    
    768     lock_sock(sk);
    769     - x25_sk(sk)->source_addr = addr->sx25_addr;
    770     - x25_insert_socket(sk);
    771     - sock_reset_flag(sk, SOCK_ZAPPED);
    772     + if (sock_flag(sk, SOCK_ZAPPED)) {
    773     + x25_sk(sk)->source_addr = addr->sx25_addr;
    774     + x25_insert_socket(sk);
    775     + sock_reset_flag(sk, SOCK_ZAPPED);
    776     + } else {
    777     + rc = -EINVAL;
    778     + }
    779     release_sock(sk);
    780     SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
    781     out:
    782     @@ -812,8 +815,13 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
    783     sock->state = SS_CONNECTED;
    784     rc = 0;
    785     out_put_neigh:
    786     - if (rc)
    787     + if (rc) {
    788     + read_lock_bh(&x25_list_lock);
    789     x25_neigh_put(x25->neighbour);
    790     + x25->neighbour = NULL;
    791     + read_unlock_bh(&x25_list_lock);
    792     + x25->state = X25_STATE_0;
    793     + }
    794     out_put_route:
    795     x25_route_put(rt);
    796     out:
    797     diff --git a/security/keys/proc.c b/security/keys/proc.c
    798     index ec493ddadd11..f2c7e090a66d 100644
    799     --- a/security/keys/proc.c
    800     +++ b/security/keys/proc.c
    801     @@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
    802    
    803     struct keyring_search_context ctx = {
    804     .index_key = key->index_key,
    805     - .cred = current_cred(),
    806     + .cred = m->file->f_cred,
    807     .match_data.cmp = lookup_user_key_possessed,
    808     .match_data.raw_data = key,
    809     .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
    810     @@ -207,11 +207,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
    811     }
    812     }
    813    
    814     - /* check whether the current task is allowed to view the key (assuming
    815     - * non-possession)
    816     - * - the caller holds a spinlock, and thus the RCU read lock, making our
    817     - * access to __current_cred() safe
    818     - */
    819     + /* check whether the current task is allowed to view the key */
    820     rc = key_task_permission(key_ref, ctx.cred, KEY_NEED_VIEW);
    821     if (rc < 0)
    822     return 0;
    823     diff --git a/security/lsm_audit.c b/security/lsm_audit.c
    824     index 37f04dadc8d6..44a20c218409 100644
    825     --- a/security/lsm_audit.c
    826     +++ b/security/lsm_audit.c
    827     @@ -321,6 +321,7 @@ static void dump_common_audit_data(struct audit_buffer *ab,
    828     if (a->u.net->sk) {
    829     struct sock *sk = a->u.net->sk;
    830     struct unix_sock *u;
    831     + struct unix_address *addr;
    832     int len = 0;
    833     char *p = NULL;
    834    
    835     @@ -351,14 +352,15 @@ static void dump_common_audit_data(struct audit_buffer *ab,
    836     #endif
    837     case AF_UNIX:
    838     u = unix_sk(sk);
    839     + addr = smp_load_acquire(&u->addr);
    840     + if (!addr)
    841     + break;
    842     if (u->path.dentry) {
    843     audit_log_d_path(ab, " path=", &u->path);
    844     break;
    845     }
    846     - if (!u->addr)
    847     - break;
    848     - len = u->addr->len-sizeof(short);
    849     - p = &u->addr->name->sun_path[0];
    850     + len = addr->len-sizeof(short);
    851     + p = &addr->name->sun_path[0];
    852     audit_log_format(ab, " path=");
    853     if (*p)
    854     audit_log_untrustedstring(ab, p);
    855     diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
    856     index 3b4eaffe4a7f..a205b93fd9ac 100644
    857     --- a/sound/firewire/bebob/bebob.c
    858     +++ b/sound/firewire/bebob/bebob.c
    859     @@ -474,7 +474,19 @@ static const struct ieee1394_device_id bebob_id_table[] = {
    860     /* Focusrite, SaffirePro 26 I/O */
    861     SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000003, &saffirepro_26_spec),
    862     /* Focusrite, SaffirePro 10 I/O */
    863     - SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, 0x00000006, &saffirepro_10_spec),
    864     + {
    865     + // The combination of vendor_id and model_id is the same as the
    866     + // same as the one of Liquid Saffire 56.
    867     + .match_flags = IEEE1394_MATCH_VENDOR_ID |
    868     + IEEE1394_MATCH_MODEL_ID |
    869     + IEEE1394_MATCH_SPECIFIER_ID |
    870     + IEEE1394_MATCH_VERSION,
    871     + .vendor_id = VEN_FOCUSRITE,
    872     + .model_id = 0x000006,
    873     + .specifier_id = 0x00a02d,
    874     + .version = 0x010001,
    875     + .driver_data = (kernel_ulong_t)&saffirepro_10_spec,
    876     + },
    877     /* Focusrite, Saffire(no label and LE) */
    878     SND_BEBOB_DEV_ENTRY(VEN_FOCUSRITE, MODEL_FOCUSRITE_SAFFIRE_BOTH,
    879     &saffire_spec),