Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0276-4.9.177-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0276-4.9.177-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3353 - (show annotations) (download)
    Tue Jun 18 09:42:06 2019 UTC (4 years, 10 months ago) by niro
    File size: 55393 byte(s) 
    -linux-4.9.177
    1 diff --git a/Makefile b/Makefile
    2 index 92fe701e5582..ceb8f4bf6245 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 176
    9 +SUBLEVEL = 177
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/mips/ath79/setup.c b/arch/mips/ath79/setup.c
    14 index 26a058d58d37..c7c31e214813 100644
    15 --- a/arch/mips/ath79/setup.c
    16 +++ b/arch/mips/ath79/setup.c
    17 @@ -183,12 +183,6 @@ const char *get_system_type(void)
    18 return ath79_sys_type;
    19 }
    20
    21 -int get_c0_perfcount_int(void)
    22 -{
    23 - return ATH79_MISC_IRQ(5);
    24 -}
    25 -EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
    26 -
    27 unsigned int get_c0_compare_int(void)
    28 {
    29 return CP0_LEGACY_COMPARE_IRQ;
    30 diff --git a/arch/powerpc/include/asm/reg_booke.h b/arch/powerpc/include/asm/reg_booke.h
    31 index 737e012ef56e..319ed53e503f 100644
    32 --- a/arch/powerpc/include/asm/reg_booke.h
    33 +++ b/arch/powerpc/include/asm/reg_booke.h
    34 @@ -41,7 +41,7 @@
    35 #if defined(CONFIG_PPC_BOOK3E_64)
    36 #define MSR_64BIT MSR_CM
    37
    38 -#define MSR_ (MSR_ME | MSR_CE)
    39 +#define MSR_ (MSR_ME | MSR_RI | MSR_CE)
    40 #define MSR_KERNEL (MSR_ | MSR_64BIT)
    41 #define MSR_USER32 (MSR_ | MSR_PR | MSR_EE)
    42 #define MSR_USER64 (MSR_USER32 | MSR_64BIT)
    43 diff --git a/arch/powerpc/kernel/security.c b/arch/powerpc/kernel/security.c
    44 index 30542e833ebe..f4a98d9c5913 100644
    45 --- a/arch/powerpc/kernel/security.c
    46 +++ b/arch/powerpc/kernel/security.c
    47 @@ -4,6 +4,7 @@
    48 //
    49 // Copyright 2018, Michael Ellerman, IBM Corporation.
    50
    51 +#include <linux/cpu.h>
    52 #include <linux/kernel.h>
    53 #include <linux/debugfs.h>
    54 #include <linux/device.h>
    55 diff --git a/arch/powerpc/lib/code-patching.c b/arch/powerpc/lib/code-patching.c
    56 index 14535ad4cdd1..c312955977ce 100644
    57 --- a/arch/powerpc/lib/code-patching.c
    58 +++ b/arch/powerpc/lib/code-patching.c
    59 @@ -23,7 +23,7 @@ int patch_instruction(unsigned int *addr, unsigned int instr)
    60 int err;
    61
    62 /* Make sure we aren't patching a freed init section */
    63 - if (init_mem_is_free && init_section_contains(addr, 4)) {
    64 + if (*PTRRELOC(&init_mem_is_free) && init_section_contains(addr, 4)) {
    65 pr_debug("Skipping init section patching addr: 0x%px\n", addr);
    66 return 0;
    67 }
    68 diff --git a/arch/x86/entry/vdso/Makefile b/arch/x86/entry/vdso/Makefile
    69 index 756dc9432d15..0d3ebdfa0739 100644
    70 --- a/arch/x86/entry/vdso/Makefile
    71 +++ b/arch/x86/entry/vdso/Makefile
    72 @@ -167,7 +167,8 @@ quiet_cmd_vdso = VDSO $@
    73 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
    74
    75 VDSO_LDFLAGS = -shared $(call ld-option, --hash-style=both) \
    76 - $(call ld-option, --build-id) -Bsymbolic
    77 + $(call ld-option, --build-id) $(call ld-option, --eh-frame-hdr) \
    78 + -Bsymbolic
    79 GCOV_PROFILE := n
    80
    81 #
    82 diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
    83 index 4a12362a194a..c55b11fe8e9f 100644
    84 --- a/arch/x86/kernel/reboot.c
    85 +++ b/arch/x86/kernel/reboot.c
    86 @@ -82,6 +82,19 @@ static int __init set_bios_reboot(const struct dmi_system_id *d)
    87 return 0;
    88 }
    89
    90 +/*
    91 + * Some machines don't handle the default ACPI reboot method and
    92 + * require the EFI reboot method:
    93 + */
    94 +static int __init set_efi_reboot(const struct dmi_system_id *d)
    95 +{
    96 + if (reboot_type != BOOT_EFI && !efi_runtime_disabled()) {
    97 + reboot_type = BOOT_EFI;
    98 + pr_info("%s series board detected. Selecting EFI-method for reboot.\n", d->ident);
    99 + }
    100 + return 0;
    101 +}
    102 +
    103 void __noreturn machine_real_restart(unsigned int type)
    104 {
    105 local_irq_disable();
    106 @@ -167,6 +180,14 @@ static struct dmi_system_id __initdata reboot_dmi_table[] = {
    107 DMI_MATCH(DMI_PRODUCT_NAME, "AOA110"),
    108 },
    109 },
    110 + { /* Handle reboot issue on Acer TravelMate X514-51T */
    111 + .callback = set_efi_reboot,
    112 + .ident = "Acer TravelMate X514-51T",
    113 + .matches = {
    114 + DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
    115 + DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate X514-51T"),
    116 + },
    117 + },
    118
    119 /* Apple */
    120 { /* Handle problems with rebooting on Apple MacBook5 */
    121 diff --git a/arch/x86/kvm/trace.h b/arch/x86/kvm/trace.h
    122 index 0a6cc6754ec5..ea618b713b6f 100644
    123 --- a/arch/x86/kvm/trace.h
    124 +++ b/arch/x86/kvm/trace.h
    125 @@ -434,13 +434,13 @@ TRACE_EVENT(kvm_apic_ipi,
    126 );
    127
    128 TRACE_EVENT(kvm_apic_accept_irq,
    129 - TP_PROTO(__u32 apicid, __u16 dm, __u8 tm, __u8 vec),
    130 + TP_PROTO(__u32 apicid, __u16 dm, __u16 tm, __u8 vec),
    131 TP_ARGS(apicid, dm, tm, vec),
    132
    133 TP_STRUCT__entry(
    134 __field( __u32, apicid )
    135 __field( __u16, dm )
    136 - __field( __u8, tm )
    137 + __field( __u16, tm )
    138 __field( __u8, vec )
    139 ),
    140
    141 diff --git a/drivers/gpu/drm/sun4i/sun4i_drv.c b/drivers/gpu/drm/sun4i/sun4i_drv.c
    142 index 97828faf2a1f..d58991b06a47 100644
    143 --- a/drivers/gpu/drm/sun4i/sun4i_drv.c
    144 +++ b/drivers/gpu/drm/sun4i/sun4i_drv.c
    145 @@ -137,6 +137,8 @@ static int sun4i_drv_bind(struct device *dev)
    146 ret = -ENOMEM;
    147 goto free_drm;
    148 }
    149 +
    150 + dev_set_drvdata(dev, drm);
    151 drm->dev_private = drv;
    152
    153 drm_vblank_init(drm, 1);
    154 diff --git a/drivers/gpu/ipu-v3/ipu-dp.c b/drivers/gpu/ipu-v3/ipu-dp.c
    155 index 98686edbcdbb..33de3a1bac49 100644
    156 --- a/drivers/gpu/ipu-v3/ipu-dp.c
    157 +++ b/drivers/gpu/ipu-v3/ipu-dp.c
    158 @@ -195,7 +195,8 @@ int ipu_dp_setup_channel(struct ipu_dp *dp,
    159 ipu_dp_csc_init(flow, flow->foreground.in_cs, flow->out_cs,
    160 DP_COM_CONF_CSC_DEF_BOTH);
    161 } else {
    162 - if (flow->foreground.in_cs == flow->out_cs)
    163 + if (flow->foreground.in_cs == IPUV3_COLORSPACE_UNKNOWN ||
    164 + flow->foreground.in_cs == flow->out_cs)
    165 /*
    166 * foreground identical to output, apply color
    167 * conversion on background
    168 @@ -261,6 +262,8 @@ void ipu_dp_disable_channel(struct ipu_dp *dp)
    169 struct ipu_dp_priv *priv = flow->priv;
    170 u32 reg, csc;
    171
    172 + dp->in_cs = IPUV3_COLORSPACE_UNKNOWN;
    173 +
    174 if (!dp->foreground)
    175 return;
    176
    177 @@ -268,8 +271,9 @@ void ipu_dp_disable_channel(struct ipu_dp *dp)
    178
    179 reg = readl(flow->base + DP_COM_CONF);
    180 csc = reg & DP_COM_CONF_CSC_DEF_MASK;
    181 - if (csc == DP_COM_CONF_CSC_DEF_FG)
    182 - reg &= ~DP_COM_CONF_CSC_DEF_MASK;
    183 + reg &= ~DP_COM_CONF_CSC_DEF_MASK;
    184 + if (csc == DP_COM_CONF_CSC_DEF_BOTH || csc == DP_COM_CONF_CSC_DEF_BG)
    185 + reg |= DP_COM_CONF_CSC_DEF_BG;
    186
    187 reg &= ~DP_COM_CONF_FG_EN;
    188 writel(reg, flow->base + DP_COM_CONF);
    189 @@ -350,6 +354,8 @@ int ipu_dp_init(struct ipu_soc *ipu, struct device *dev, unsigned long base)
    190 mutex_init(&priv->mutex);
    191
    192 for (i = 0; i < IPUV3_NUM_FLOWS; i++) {
    193 + priv->flow[i].background.in_cs = IPUV3_COLORSPACE_UNKNOWN;
    194 + priv->flow[i].foreground.in_cs = IPUV3_COLORSPACE_UNKNOWN;
    195 priv->flow[i].foreground.foreground = true;
    196 priv->flow[i].base = priv->base + ipu_dp_flow_base[i];
    197 priv->flow[i].priv = priv;
    198 diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
    199 index fc7ada26457e..9f7b1cf726a8 100644
    200 --- a/drivers/hid/hid-input.c
    201 +++ b/drivers/hid/hid-input.c
    202 @@ -607,6 +607,14 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
    203 break;
    204 }
    205
    206 + if ((usage->hid & 0xf0) == 0xb0) { /* SC - Display */
    207 + switch (usage->hid & 0xf) {
    208 + case 0x05: map_key_clear(KEY_SWITCHVIDEOMODE); break;
    209 + default: goto ignore;
    210 + }
    211 + break;
    212 + }
    213 +
    214 /*
    215 * Some lazy vendors declare 255 usages for System Control,
    216 * leading to the creation of ABS_X|Y axis and too many others.
    217 @@ -802,6 +810,10 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
    218 case 0x074: map_key_clear(KEY_BRIGHTNESS_MAX); break;
    219 case 0x075: map_key_clear(KEY_BRIGHTNESS_AUTO); break;
    220
    221 + case 0x079: map_key_clear(KEY_KBDILLUMUP); break;
    222 + case 0x07a: map_key_clear(KEY_KBDILLUMDOWN); break;
    223 + case 0x07c: map_key_clear(KEY_KBDILLUMTOGGLE); break;
    224 +
    225 case 0x082: map_key_clear(KEY_VIDEO_NEXT); break;
    226 case 0x083: map_key_clear(KEY_LAST); break;
    227 case 0x084: map_key_clear(KEY_ENTER); break;
    228 @@ -932,6 +944,8 @@ static void hidinput_configure_usage(struct hid_input *hidinput, struct hid_fiel
    229 case 0x2cb: map_key_clear(KEY_KBDINPUTASSIST_ACCEPT); break;
    230 case 0x2cc: map_key_clear(KEY_KBDINPUTASSIST_CANCEL); break;
    231
    232 + case 0x29f: map_key_clear(KEY_SCALE); break;
    233 +
    234 default: map_key_clear(KEY_UNKNOWN);
    235 }
    236 break;
    237 diff --git a/drivers/iio/adc/xilinx-xadc-core.c b/drivers/iio/adc/xilinx-xadc-core.c
    238 index 56cf5907a5f0..143894a315d9 100644
    239 --- a/drivers/iio/adc/xilinx-xadc-core.c
    240 +++ b/drivers/iio/adc/xilinx-xadc-core.c
    241 @@ -1299,7 +1299,7 @@ static int xadc_remove(struct platform_device *pdev)
    242 }
    243 free_irq(irq, indio_dev);
    244 clk_disable_unprepare(xadc->clk);
    245 - cancel_delayed_work(&xadc->zynq_unmask_work);
    246 + cancel_delayed_work_sync(&xadc->zynq_unmask_work);
    247 kfree(xadc->data);
    248 kfree(indio_dev->channels);
    249
    250 diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
    251 index 4a88312fbd25..65038dcc7613 100644
    252 --- a/drivers/input/rmi4/rmi_driver.c
    253 +++ b/drivers/input/rmi4/rmi_driver.c
    254 @@ -772,7 +772,7 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
    255
    256 error = rmi_register_function(fn);
    257 if (error)
    258 - goto err_put_fn;
    259 + return error;
    260
    261 if (pdt->function_number == 0x01)
    262 data->f01_container = fn;
    263 @@ -780,10 +780,6 @@ static int rmi_create_function(struct rmi_device *rmi_dev,
    264 list_add_tail(&fn->node, &data->function_list);
    265
    266 return RMI_SCAN_CONTINUE;
    267 -
    268 -err_put_fn:
    269 - put_device(&fn->dev);
    270 - return error;
    271 }
    272
    273 int rmi_driver_suspend(struct rmi_device *rmi_dev)
    274 diff --git a/drivers/irqchip/irq-ath79-misc.c b/drivers/irqchip/irq-ath79-misc.c
    275 index aa7290784636..0390603170b4 100644
    276 --- a/drivers/irqchip/irq-ath79-misc.c
    277 +++ b/drivers/irqchip/irq-ath79-misc.c
    278 @@ -22,6 +22,15 @@
    279 #define AR71XX_RESET_REG_MISC_INT_ENABLE 4
    280
    281 #define ATH79_MISC_IRQ_COUNT 32
    282 +#define ATH79_MISC_PERF_IRQ 5
    283 +
    284 +static int ath79_perfcount_irq;
    285 +
    286 +int get_c0_perfcount_int(void)
    287 +{
    288 + return ath79_perfcount_irq;
    289 +}
    290 +EXPORT_SYMBOL_GPL(get_c0_perfcount_int);
    291
    292 static void ath79_misc_irq_handler(struct irq_desc *desc)
    293 {
    294 @@ -113,6 +122,8 @@ static void __init ath79_misc_intc_domain_init(
    295 {
    296 void __iomem *base = domain->host_data;
    297
    298 + ath79_perfcount_irq = irq_create_mapping(domain, ATH79_MISC_PERF_IRQ);
    299 +
    300 /* Disable and clear all interrupts */
    301 __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_ENABLE);
    302 __raw_writel(0, base + AR71XX_RESET_REG_MISC_INT_STATUS);
    303 diff --git a/drivers/isdn/mISDN/socket.c b/drivers/isdn/mISDN/socket.c
    304 index 99e5f9751e8b..f96b8f2bdf74 100644
    305 --- a/drivers/isdn/mISDN/socket.c
    306 +++ b/drivers/isdn/mISDN/socket.c
    307 @@ -712,10 +712,10 @@ base_sock_bind(struct socket *sock, struct sockaddr *addr, int addr_len)
    308 struct sock *sk = sock->sk;
    309 int err = 0;
    310
    311 - if (!maddr || maddr->family != AF_ISDN)
    312 + if (addr_len < sizeof(struct sockaddr_mISDN))
    313 return -EINVAL;
    314
    315 - if (addr_len < sizeof(struct sockaddr_mISDN))
    316 + if (!maddr || maddr->family != AF_ISDN)
    317 return -EINVAL;
    318
    319 lock_sock(sk);
    320 diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
    321 index 9ec74dfe94f4..2a403e5c31aa 100644
    322 --- a/drivers/md/raid5.c
    323 +++ b/drivers/md/raid5.c
    324 @@ -3914,26 +3914,15 @@ static void handle_parity_checks6(struct r5conf *conf, struct stripe_head *sh,
    325 case check_state_check_result:
    326 sh->check_state = check_state_idle;
    327
    328 + if (s->failed > 1)
    329 + break;
    330 /* handle a successful check operation, if parity is correct
    331 * we are done. Otherwise update the mismatch count and repair
    332 * parity if !MD_RECOVERY_CHECK
    333 */
    334 if (sh->ops.zero_sum_result == 0) {
    335 - /* both parities are correct */
    336 - if (!s->failed)
    337 - set_bit(STRIPE_INSYNC, &sh->state);
    338 - else {
    339 - /* in contrast to the raid5 case we can validate
    340 - * parity, but still have a failure to write
    341 - * back
    342 - */
    343 - sh->check_state = check_state_compute_result;
    344 - /* Returning at this point means that we may go
    345 - * off and bring p and/or q uptodate again so
    346 - * we make sure to check zero_sum_result again
    347 - * to verify if p or q need writeback
    348 - */
    349 - }
    350 + /* Any parity checked was correct */
    351 + set_bit(STRIPE_INSYNC, &sh->state);
    352 } else {
    353 atomic64_add(STRIPE_SECTORS, &conf->mddev->resync_mismatches);
    354 if (test_bit(MD_RECOVERY_CHECK, &conf->mddev->recovery))
    355 diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
    356 index 473da3bf10c6..258cb3999b0e 100644
    357 --- a/drivers/net/bonding/bond_options.c
    358 +++ b/drivers/net/bonding/bond_options.c
    359 @@ -1065,13 +1065,6 @@ static int bond_option_arp_validate_set(struct bonding *bond,
    360 {
    361 netdev_info(bond->dev, "Setting arp_validate to %s (%llu)\n",
    362 newval->string, newval->value);
    363 -
    364 - if (bond->dev->flags & IFF_UP) {
    365 - if (!newval->value)
    366 - bond->recv_probe = NULL;
    367 - else if (bond->params.arp_interval)
    368 - bond->recv_probe = bond_arp_rcv;
    369 - }
    370 bond->params.arp_validate = newval->value;
    371
    372 return 0;
    373 diff --git a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
    374 index 812a968a78e9..6aa4b50435da 100644
    375 --- a/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
    376 +++ b/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
    377 @@ -250,14 +250,12 @@ uec_set_ringparam(struct net_device *netdev,
    378 return -EINVAL;
    379 }
    380
    381 + if (netif_running(netdev))
    382 + return -EBUSY;
    383 +
    384 ug_info->bdRingLenRx[queue] = ring->rx_pending;
    385 ug_info->bdRingLenTx[queue] = ring->tx_pending;
    386
    387 - if (netif_running(netdev)) {
    388 - /* FIXME: restart automatically */
    389 - netdev_info(netdev, "Please re-open the interface\n");
    390 - }
    391 -
    392 return ret;
    393 }
    394
    395 diff --git a/drivers/net/phy/spi_ks8995.c b/drivers/net/phy/spi_ks8995.c
    396 index 1e2d4f1179da..45df03673e01 100644
    397 --- a/drivers/net/phy/spi_ks8995.c
    398 +++ b/drivers/net/phy/spi_ks8995.c
    399 @@ -162,6 +162,14 @@ static const struct spi_device_id ks8995_id[] = {
    400 };
    401 MODULE_DEVICE_TABLE(spi, ks8995_id);
    402
    403 +static const struct of_device_id ks8895_spi_of_match[] = {
    404 + { .compatible = "micrel,ks8995" },
    405 + { .compatible = "micrel,ksz8864" },
    406 + { .compatible = "micrel,ksz8795" },
    407 + { },
    408 + };
    409 +MODULE_DEVICE_TABLE(of, ks8895_spi_of_match);
    410 +
    411 static inline u8 get_chip_id(u8 val)
    412 {
    413 return (val >> ID1_CHIPID_S) & ID1_CHIPID_M;
    414 @@ -529,6 +537,7 @@ static int ks8995_remove(struct spi_device *spi)
    415 static struct spi_driver ks8995_driver = {
    416 .driver = {
    417 .name = "spi-ks8995",
    418 + .of_match_table = of_match_ptr(ks8895_spi_of_match),
    419 },
    420 .probe = ks8995_probe,
    421 .remove = ks8995_remove,
    422 diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
    423 index f8be0bd7e326..0741280b65a4 100644
    424 --- a/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
    425 +++ b/drivers/net/wireless/realtek/rtlwifi/rtl8723ae/hw.c
    426 @@ -1703,6 +1703,7 @@ static void _rtl8723e_read_adapter_info(struct ieee80211_hw *hw,
    427 rtlhal->oem_id = RT_CID_819X_LENOVO;
    428 break;
    429 }
    430 + break;
    431 case 0x1025:
    432 rtlhal->oem_id = RT_CID_819X_ACER;
    433 break;
    434 diff --git a/drivers/net/wireless/st/cw1200/scan.c b/drivers/net/wireless/st/cw1200/scan.c
    435 index c5492d792f43..b35f470b40ff 100644
    436 --- a/drivers/net/wireless/st/cw1200/scan.c
    437 +++ b/drivers/net/wireless/st/cw1200/scan.c
    438 @@ -84,8 +84,11 @@ int cw1200_hw_scan(struct ieee80211_hw *hw,
    439
    440 frame.skb = ieee80211_probereq_get(hw, priv->vif->addr, NULL, 0,
    441 req->ie_len);
    442 - if (!frame.skb)
    443 + if (!frame.skb) {
    444 + mutex_unlock(&priv->conf_mutex);
    445 + up(&priv->scan.lock);
    446 return -ENOMEM;
    447 + }
    448
    449 if (req->ie_len)
    450 memcpy(skb_put(frame.skb, req->ie_len), req->ie, req->ie_len);
    451 diff --git a/drivers/nfc/st95hf/core.c b/drivers/nfc/st95hf/core.c
    452 index c2840e412962..850e75571c8e 100644
    453 --- a/drivers/nfc/st95hf/core.c
    454 +++ b/drivers/nfc/st95hf/core.c
    455 @@ -1074,6 +1074,12 @@ static const struct spi_device_id st95hf_id[] = {
    456 };
    457 MODULE_DEVICE_TABLE(spi, st95hf_id);
    458
    459 +static const struct of_device_id st95hf_spi_of_match[] = {
    460 + { .compatible = "st,st95hf" },
    461 + { },
    462 +};
    463 +MODULE_DEVICE_TABLE(of, st95hf_spi_of_match);
    464 +
    465 static int st95hf_probe(struct spi_device *nfc_spi_dev)
    466 {
    467 int ret;
    468 @@ -1260,6 +1266,7 @@ static struct spi_driver st95hf_driver = {
    469 .driver = {
    470 .name = "st95hf",
    471 .owner = THIS_MODULE,
    472 + .of_match_table = of_match_ptr(st95hf_spi_of_match),
    473 },
    474 .id_table = st95hf_id,
    475 .probe = st95hf_probe,
    476 diff --git a/drivers/nvdimm/btt_devs.c b/drivers/nvdimm/btt_devs.c
    477 index 97dd2925ed6e..5d2c76682848 100644
    478 --- a/drivers/nvdimm/btt_devs.c
    479 +++ b/drivers/nvdimm/btt_devs.c
    480 @@ -190,14 +190,15 @@ static struct device *__nd_btt_create(struct nd_region *nd_region,
    481 return NULL;
    482
    483 nd_btt->id = ida_simple_get(&nd_region->btt_ida, 0, 0, GFP_KERNEL);
    484 - if (nd_btt->id < 0) {
    485 - kfree(nd_btt);
    486 - return NULL;
    487 - }
    488 + if (nd_btt->id < 0)
    489 + goto out_nd_btt;
    490
    491 nd_btt->lbasize = lbasize;
    492 - if (uuid)
    493 + if (uuid) {
    494 uuid = kmemdup(uuid, 16, GFP_KERNEL);
    495 + if (!uuid)
    496 + goto out_put_id;
    497 + }
    498 nd_btt->uuid = uuid;
    499 dev = &nd_btt->dev;
    500 dev_set_name(dev, "btt%d.%d", nd_region->id, nd_btt->id);
    501 @@ -212,6 +213,13 @@ static struct device *__nd_btt_create(struct nd_region *nd_region,
    502 return NULL;
    503 }
    504 return dev;
    505 +
    506 +out_put_id:
    507 + ida_simple_remove(&nd_region->btt_ida, nd_btt->id);
    508 +
    509 +out_nd_btt:
    510 + kfree(nd_btt);
    511 + return NULL;
    512 }
    513
    514 struct device *nd_btt_create(struct nd_region *nd_region)
    515 diff --git a/drivers/nvdimm/namespace_devs.c b/drivers/nvdimm/namespace_devs.c
    516 index 9bc5f555ee68..cf4a90b50f8b 100644
    517 --- a/drivers/nvdimm/namespace_devs.c
    518 +++ b/drivers/nvdimm/namespace_devs.c
    519 @@ -2028,9 +2028,12 @@ struct device *create_namespace_blk(struct nd_region *nd_region,
    520 if (!nsblk->uuid)
    521 goto blk_err;
    522 memcpy(name, nd_label->name, NSLABEL_NAME_LEN);
    523 - if (name[0])
    524 + if (name[0]) {
    525 nsblk->alt_name = kmemdup(name, NSLABEL_NAME_LEN,
    526 GFP_KERNEL);
    527 + if (!nsblk->alt_name)
    528 + goto blk_err;
    529 + }
    530 res = nsblk_add_resource(nd_region, ndd, nsblk,
    531 __le64_to_cpu(nd_label->dpa));
    532 if (!res)
    533 diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
    534 index c890a49587e4..f65558638bc8 100644
    535 --- a/drivers/platform/x86/sony-laptop.c
    536 +++ b/drivers/platform/x86/sony-laptop.c
    537 @@ -4422,14 +4422,16 @@ sony_pic_read_possible_resource(struct acpi_resource *resource, void *context)
    538 }
    539 return AE_OK;
    540 }
    541 +
    542 + case ACPI_RESOURCE_TYPE_END_TAG:
    543 + return AE_OK;
    544 +
    545 default:
    546 dprintk("Resource %d isn't an IRQ nor an IO port\n",
    547 resource->type);
    548 + return AE_CTRL_TERMINATE;
    549
    550 - case ACPI_RESOURCE_TYPE_END_TAG:
    551 - return AE_OK;
    552 }
    553 - return AE_CTRL_TERMINATE;
    554 }
    555
    556 static int sony_pic_possible_resources(struct acpi_device *device)
    557 diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
    558 index 11c6335b1951..9d772201e334 100644
    559 --- a/drivers/s390/block/dasd_eckd.c
    560 +++ b/drivers/s390/block/dasd_eckd.c
    561 @@ -2054,14 +2054,14 @@ static int dasd_eckd_end_analysis(struct dasd_block *block)
    562 blk_per_trk = recs_per_track(&private->rdc_data, 0, block->bp_block);
    563
    564 raw:
    565 - block->blocks = (private->real_cyl *
    566 + block->blocks = ((unsigned long) private->real_cyl *
    567 private->rdc_data.trk_per_cyl *
    568 blk_per_trk);
    569
    570 dev_info(&device->cdev->dev,
    571 - "DASD with %d KB/block, %d KB total size, %d KB/track, "
    572 + "DASD with %u KB/block, %lu KB total size, %u KB/track, "
    573 "%s\n", (block->bp_block >> 10),
    574 - ((private->real_cyl *
    575 + (((unsigned long) private->real_cyl *
    576 private->rdc_data.trk_per_cyl *
    577 blk_per_trk * (block->bp_block >> 9)) >> 1),
    578 ((blk_per_trk * block->bp_block) >> 10),
    579 diff --git a/drivers/s390/char/con3270.c b/drivers/s390/char/con3270.c
    580 index 285b4006f44b..5d5e78afde88 100644
    581 --- a/drivers/s390/char/con3270.c
    582 +++ b/drivers/s390/char/con3270.c
    583 @@ -628,7 +628,7 @@ con3270_init(void)
    584 (void (*)(unsigned long)) con3270_read_tasklet,
    585 (unsigned long) condev->read);
    586
    587 - raw3270_add_view(&condev->view, &con3270_fn, 1);
    588 + raw3270_add_view(&condev->view, &con3270_fn, 1, RAW3270_VIEW_LOCK_IRQ);
    589
    590 INIT_LIST_HEAD(&condev->freemem);
    591 for (i = 0; i < CON3270_STRING_PAGES; i++) {
    592 diff --git a/drivers/s390/char/fs3270.c b/drivers/s390/char/fs3270.c
    593 index 85eca1cef063..04a6810a4298 100644
    594 --- a/drivers/s390/char/fs3270.c
    595 +++ b/drivers/s390/char/fs3270.c
    596 @@ -462,7 +462,8 @@ fs3270_open(struct inode *inode, struct file *filp)
    597
    598 init_waitqueue_head(&fp->wait);
    599 fp->fs_pid = get_pid(task_pid(current));
    600 - rc = raw3270_add_view(&fp->view, &fs3270_fn, minor);
    601 + rc = raw3270_add_view(&fp->view, &fs3270_fn, minor,
    602 + RAW3270_VIEW_LOCK_BH);
    603 if (rc) {
    604 fs3270_free_view(&fp->view);
    605 goto out;
    606 diff --git a/drivers/s390/char/raw3270.c b/drivers/s390/char/raw3270.c
    607 index a2da898ce90f..1ebf632e327b 100644
    608 --- a/drivers/s390/char/raw3270.c
    609 +++ b/drivers/s390/char/raw3270.c
    610 @@ -919,7 +919,7 @@ raw3270_deactivate_view(struct raw3270_view *view)
    611 * Add view to device with minor "minor".
    612 */
    613 int
    614 -raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor)
    615 +raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor, int subclass)
    616 {
    617 unsigned long flags;
    618 struct raw3270 *rp;
    619 @@ -941,6 +941,7 @@ raw3270_add_view(struct raw3270_view *view, struct raw3270_fn *fn, int minor)
    620 view->cols = rp->cols;
    621 view->ascebc = rp->ascebc;
    622 spin_lock_init(&view->lock);
    623 + lockdep_set_subclass(&view->lock, subclass);
    624 list_add(&view->list, &rp->view_list);
    625 rc = 0;
    626 spin_unlock_irqrestore(get_ccwdev_lock(rp->cdev), flags);
    627 diff --git a/drivers/s390/char/raw3270.h b/drivers/s390/char/raw3270.h
    628 index 56519cbb165c..7577d7d0ad48 100644
    629 --- a/drivers/s390/char/raw3270.h
    630 +++ b/drivers/s390/char/raw3270.h
    631 @@ -149,6 +149,8 @@ struct raw3270_fn {
    632 struct raw3270_view {
    633 struct list_head list;
    634 spinlock_t lock;
    635 +#define RAW3270_VIEW_LOCK_IRQ 0
    636 +#define RAW3270_VIEW_LOCK_BH 1
    637 atomic_t ref_count;
    638 struct raw3270 *dev;
    639 struct raw3270_fn *fn;
    640 @@ -157,7 +159,7 @@ struct raw3270_view {
    641 unsigned char *ascebc; /* ascii -> ebcdic table */
    642 };
    643
    644 -int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int);
    645 +int raw3270_add_view(struct raw3270_view *, struct raw3270_fn *, int, int);
    646 int raw3270_activate_view(struct raw3270_view *);
    647 void raw3270_del_view(struct raw3270_view *);
    648 void raw3270_deactivate_view(struct raw3270_view *);
    649 diff --git a/drivers/s390/char/tty3270.c b/drivers/s390/char/tty3270.c
    650 index 272cb6cd1b2a..6dd6f9ff7de5 100644
    651 --- a/drivers/s390/char/tty3270.c
    652 +++ b/drivers/s390/char/tty3270.c
    653 @@ -978,7 +978,8 @@ static int tty3270_install(struct tty_driver *driver, struct tty_struct *tty)
    654 return PTR_ERR(tp);
    655
    656 rc = raw3270_add_view(&tp->view, &tty3270_fn,
    657 - tty->index + RAW3270_FIRSTMINOR);
    658 + tty->index + RAW3270_FIRSTMINOR,
    659 + RAW3270_VIEW_LOCK_BH);
    660 if (rc) {
    661 tty3270_free_view(tp);
    662 return rc;
    663 diff --git a/drivers/s390/net/ctcm_main.c b/drivers/s390/net/ctcm_main.c
    664 index ad17fc5883f6..e22b9ac3e564 100644
    665 --- a/drivers/s390/net/ctcm_main.c
    666 +++ b/drivers/s390/net/ctcm_main.c
    667 @@ -1595,6 +1595,7 @@ static int ctcm_new_device(struct ccwgroup_device *cgdev)
    668 if (priv->channel[direction] == NULL) {
    669 if (direction == CTCM_WRITE)
    670 channel_free(priv->channel[CTCM_READ]);
    671 + result = -ENODEV;
    672 goto out_dev;
    673 }
    674 priv->channel[direction]->netdev = dev;
    675 diff --git a/drivers/usb/serial/generic.c b/drivers/usb/serial/generic.c
    676 index 944de657a07a..f1e74f50642f 100644
    677 --- a/drivers/usb/serial/generic.c
    678 +++ b/drivers/usb/serial/generic.c
    679 @@ -350,6 +350,7 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
    680 struct usb_serial_port *port = urb->context;
    681 unsigned char *data = urb->transfer_buffer;
    682 unsigned long flags;
    683 + bool stopped = false;
    684 int status = urb->status;
    685 int i;
    686
    687 @@ -357,33 +358,51 @@ void usb_serial_generic_read_bulk_callback(struct urb *urb)
    688 if (urb == port->read_urbs[i])
    689 break;
    690 }
    691 - set_bit(i, &port->read_urbs_free);
    692
    693 dev_dbg(&port->dev, "%s - urb %d, len %d\n", __func__, i,
    694 urb->actual_length);
    695 switch (status) {
    696 case 0:
    697 + usb_serial_debug_data(&port->dev, __func__, urb->actual_length,
    698 + data);
    699 + port->serial->type->process_read_urb(urb);
    700 break;
    701 case -ENOENT:
    702 case -ECONNRESET:
    703 case -ESHUTDOWN:
    704 dev_dbg(&port->dev, "%s - urb stopped: %d\n",
    705 __func__, status);
    706 - return;
    707 + stopped = true;
    708 + break;
    709 case -EPIPE:
    710 dev_err(&port->dev, "%s - urb stopped: %d\n",
    711 __func__, status);
    712 - return;
    713 + stopped = true;
    714 + break;
    715 default:
    716 dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
    717 __func__, status);
    718 - goto resubmit;
    719 + break;
    720 }
    721
    722 - usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data);
    723 - port->serial->type->process_read_urb(urb);
    724 + /*
    725 + * Make sure URB processing is done before marking as free to avoid
    726 + * racing with unthrottle() on another CPU. Matches the barriers
    727 + * implied by the test_and_clear_bit() in
    728 + * usb_serial_generic_submit_read_urb().
    729 + */
    730 + smp_mb__before_atomic();
    731 + set_bit(i, &port->read_urbs_free);
    732 + /*
    733 + * Make sure URB is marked as free before checking the throttled flag
    734 + * to avoid racing with unthrottle() on another CPU. Matches the
    735 + * smp_mb() in unthrottle().
    736 + */
    737 + smp_mb__after_atomic();
    738 +
    739 + if (stopped)
    740 + return;
    741
    742 -resubmit:
    743 /* Throttle the device if requested by tty */
    744 spin_lock_irqsave(&port->lock, flags);
    745 port->throttled = port->throttle_req;
    746 @@ -458,6 +477,12 @@ void usb_serial_generic_unthrottle(struct tty_struct *tty)
    747 port->throttled = port->throttle_req = 0;
    748 spin_unlock_irq(&port->lock);
    749
    750 + /*
    751 + * Matches the smp_mb__after_atomic() in
    752 + * usb_serial_generic_read_bulk_callback().
    753 + */
    754 + smp_mb();
    755 +
    756 if (was_throttled)
    757 usb_serial_generic_submit_read_urbs(port, GFP_KERNEL);
    758 }
    759 diff --git a/drivers/virt/fsl_hypervisor.c b/drivers/virt/fsl_hypervisor.c
    760 index 150ce2abf6c8..732e9abdcf96 100644
    761 --- a/drivers/virt/fsl_hypervisor.c
    762 +++ b/drivers/virt/fsl_hypervisor.c
    763 @@ -215,6 +215,9 @@ static long ioctl_memcpy(struct fsl_hv_ioctl_memcpy __user *p)
    764 * hypervisor.
    765 */
    766 lb_offset = param.local_vaddr & (PAGE_SIZE - 1);
    767 + if (param.count == 0 ||
    768 + param.count > U64_MAX - lb_offset - PAGE_SIZE + 1)
    769 + return -EINVAL;
    770 num_pages = (param.count + lb_offset + PAGE_SIZE - 1) >> PAGE_SHIFT;
    771
    772 /* Allocate the buffers we need */
    773 @@ -334,8 +337,8 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
    774 struct fsl_hv_ioctl_prop param;
    775 char __user *upath, *upropname;
    776 void __user *upropval;
    777 - char *path = NULL, *propname = NULL;
    778 - void *propval = NULL;
    779 + char *path, *propname;
    780 + void *propval;
    781 int ret = 0;
    782
    783 /* Get the parameters from the user. */
    784 @@ -347,32 +350,30 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
    785 upropval = (void __user *)(uintptr_t)param.propval;
    786
    787 path = strndup_user(upath, FH_DTPROP_MAX_PATHLEN);
    788 - if (IS_ERR(path)) {
    789 - ret = PTR_ERR(path);
    790 - goto out;
    791 - }
    792 + if (IS_ERR(path))
    793 + return PTR_ERR(path);
    794
    795 propname = strndup_user(upropname, FH_DTPROP_MAX_PATHLEN);
    796 if (IS_ERR(propname)) {
    797 ret = PTR_ERR(propname);
    798 - goto out;
    799 + goto err_free_path;
    800 }
    801
    802 if (param.proplen > FH_DTPROP_MAX_PROPLEN) {
    803 ret = -EINVAL;
    804 - goto out;
    805 + goto err_free_propname;
    806 }
    807
    808 propval = kmalloc(param.proplen, GFP_KERNEL);
    809 if (!propval) {
    810 ret = -ENOMEM;
    811 - goto out;
    812 + goto err_free_propname;
    813 }
    814
    815 if (set) {
    816 if (copy_from_user(propval, upropval, param.proplen)) {
    817 ret = -EFAULT;
    818 - goto out;
    819 + goto err_free_propval;
    820 }
    821
    822 param.ret = fh_partition_set_dtprop(param.handle,
    823 @@ -391,7 +392,7 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
    824 if (copy_to_user(upropval, propval, param.proplen) ||
    825 put_user(param.proplen, &p->proplen)) {
    826 ret = -EFAULT;
    827 - goto out;
    828 + goto err_free_propval;
    829 }
    830 }
    831 }
    832 @@ -399,10 +400,12 @@ static long ioctl_dtprop(struct fsl_hv_ioctl_prop __user *p, int set)
    833 if (put_user(param.ret, &p->ret))
    834 ret = -EFAULT;
    835
    836 -out:
    837 - kfree(path);
    838 +err_free_propval:
    839 kfree(propval);
    840 +err_free_propname:
    841 kfree(propname);
    842 +err_free_path:
    843 + kfree(path);
    844
    845 return ret;
    846 }
    847 diff --git a/include/linux/efi.h b/include/linux/efi.h
    848 index 80b1b8faf503..e6711bf9f0d1 100644
    849 --- a/include/linux/efi.h
    850 +++ b/include/linux/efi.h
    851 @@ -1433,7 +1433,12 @@ efi_status_t efi_setup_gop(efi_system_table_t *sys_table_arg,
    852 struct screen_info *si, efi_guid_t *proto,
    853 unsigned long size);
    854
    855 -bool efi_runtime_disabled(void);
    856 +#ifdef CONFIG_EFI
    857 +extern bool efi_runtime_disabled(void);
    858 +#else
    859 +static inline bool efi_runtime_disabled(void) { return true; }
    860 +#endif
    861 +
    862 extern void efi_call_virt_check_flags(unsigned long flags, const char *call);
    863
    864 /*
    865 diff --git a/include/linux/list_nulls.h b/include/linux/list_nulls.h
    866 index b01fe1009084..87ff4f58a2f0 100644
    867 --- a/include/linux/list_nulls.h
    868 +++ b/include/linux/list_nulls.h
    869 @@ -29,6 +29,11 @@ struct hlist_nulls_node {
    870 ((ptr)->first = (struct hlist_nulls_node *) NULLS_MARKER(nulls))
    871
    872 #define hlist_nulls_entry(ptr, type, member) container_of(ptr,type,member)
    873 +
    874 +#define hlist_nulls_entry_safe(ptr, type, member) \
    875 + ({ typeof(ptr) ____ptr = (ptr); \
    876 + !is_a_nulls(____ptr) ? hlist_nulls_entry(____ptr, type, member) : NULL; \
    877 + })
    878 /**
    879 * ptr_is_a_nulls - Test if a ptr is a nulls
    880 * @ptr: ptr to be tested
    881 diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
    882 index 6224a0ab0b1e..2720b2fbfb86 100644
    883 --- a/include/linux/rculist_nulls.h
    884 +++ b/include/linux/rculist_nulls.h
    885 @@ -118,5 +118,19 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
    886 ({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member); 1; }); \
    887 pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)))
    888
    889 +/**
    890 + * hlist_nulls_for_each_entry_safe -
    891 + * iterate over list of given type safe against removal of list entry
    892 + * @tpos: the type * to use as a loop cursor.
    893 + * @pos: the &struct hlist_nulls_node to use as a loop cursor.
    894 + * @head: the head for your list.
    895 + * @member: the name of the hlist_nulls_node within the struct.
    896 + */
    897 +#define hlist_nulls_for_each_entry_safe(tpos, pos, head, member) \
    898 + for (({barrier();}), \
    899 + pos = rcu_dereference_raw(hlist_nulls_first_rcu(head)); \
    900 + (!is_a_nulls(pos)) && \
    901 + ({ tpos = hlist_nulls_entry(pos, typeof(*tpos), member); \
    902 + pos = rcu_dereference_raw(hlist_nulls_next_rcu(pos)); 1; });)
    903 #endif
    904 #endif
    905 diff --git a/include/sound/pcm.h b/include/sound/pcm.h
    906 index af1fb37c6b26..b1d3cce26ce2 100644
    907 --- a/include/sound/pcm.h
    908 +++ b/include/sound/pcm.h
    909 @@ -100,7 +100,7 @@ struct snd_pcm_ops {
    910 #endif
    911
    912 #define SNDRV_PCM_IOCTL1_RESET 0
    913 -#define SNDRV_PCM_IOCTL1_INFO 1
    914 +/* 1 is absent slot. */
    915 #define SNDRV_PCM_IOCTL1_CHANNEL_INFO 2
    916 #define SNDRV_PCM_IOCTL1_GSTATE 3
    917 #define SNDRV_PCM_IOCTL1_FIFO_SIZE 4
    918 diff --git a/init/main.c b/init/main.c
    919 index 3c7f71d8e704..148843e627a0 100644
    920 --- a/init/main.c
    921 +++ b/init/main.c
    922 @@ -516,6 +516,8 @@ asmlinkage __visible void __init start_kernel(void)
    923 page_alloc_init();
    924
    925 pr_notice("Kernel command line: %s\n", boot_command_line);
    926 + /* parameters may set static keys */
    927 + jump_label_init();
    928 parse_early_param();
    929 after_dashes = parse_args("Booting kernel",
    930 static_command_line, __start___param,
    931 @@ -525,8 +527,6 @@ asmlinkage __visible void __init start_kernel(void)
    932 parse_args("Setting init args", after_dashes, NULL, 0, -1, -1,
    933 NULL, set_init_arg);
    934
    935 - jump_label_init();
    936 -
    937 /*
    938 * These use large bootmem allocations and must precede
    939 * kmem_cache_init()
    940 diff --git a/kernel/bpf/hashtab.c b/kernel/bpf/hashtab.c
    941 index a36a532c056d..8648d7d29708 100644
    942 --- a/kernel/bpf/hashtab.c
    943 +++ b/kernel/bpf/hashtab.c
    944 @@ -13,10 +13,11 @@
    945 #include <linux/bpf.h>
    946 #include <linux/jhash.h>
    947 #include <linux/filter.h>
    948 +#include <linux/rculist_nulls.h>
    949 #include "percpu_freelist.h"
    950
    951 struct bucket {
    952 - struct hlist_head head;
    953 + struct hlist_nulls_head head;
    954 raw_spinlock_t lock;
    955 };
    956
    957 @@ -40,9 +41,14 @@ enum extra_elem_state {
    958 /* each htab element is struct htab_elem + key + value */
    959 struct htab_elem {
    960 union {
    961 - struct hlist_node hash_node;
    962 - struct bpf_htab *htab;
    963 - struct pcpu_freelist_node fnode;
    964 + struct hlist_nulls_node hash_node;
    965 + struct {
    966 + void *padding;
    967 + union {
    968 + struct bpf_htab *htab;
    969 + struct pcpu_freelist_node fnode;
    970 + };
    971 + };
    972 };
    973 union {
    974 struct rcu_head rcu;
    975 @@ -114,8 +120,10 @@ skip_percpu_elems:
    976 if (err)
    977 goto free_elems;
    978
    979 - pcpu_freelist_populate(&htab->freelist, htab->elems, htab->elem_size,
    980 - htab->map.max_entries);
    981 + pcpu_freelist_populate(&htab->freelist,
    982 + htab->elems + offsetof(struct htab_elem, fnode),
    983 + htab->elem_size, htab->map.max_entries);
    984 +
    985 return 0;
    986
    987 free_elems:
    988 @@ -148,6 +156,11 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
    989 int err, i;
    990 u64 cost;
    991
    992 + BUILD_BUG_ON(offsetof(struct htab_elem, htab) !=
    993 + offsetof(struct htab_elem, hash_node.pprev));
    994 + BUILD_BUG_ON(offsetof(struct htab_elem, fnode.next) !=
    995 + offsetof(struct htab_elem, hash_node.pprev));
    996 +
    997 if (attr->map_flags & ~BPF_F_NO_PREALLOC)
    998 /* reserved bits should not be used */
    999 return ERR_PTR(-EINVAL);
    1000 @@ -233,7 +246,7 @@ static struct bpf_map *htab_map_alloc(union bpf_attr *attr)
    1001 goto free_htab;
    1002
    1003 for (i = 0; i < htab->n_buckets; i++) {
    1004 - INIT_HLIST_HEAD(&htab->buckets[i].head);
    1005 + INIT_HLIST_NULLS_HEAD(&htab->buckets[i].head, i);
    1006 raw_spin_lock_init(&htab->buckets[i].lock);
    1007 }
    1008
    1009 @@ -270,20 +283,44 @@ static inline struct bucket *__select_bucket(struct bpf_htab *htab, u32 hash)
    1010 return &htab->buckets[hash & (htab->n_buckets - 1)];
    1011 }
    1012
    1013 -static inline struct hlist_head *select_bucket(struct bpf_htab *htab, u32 hash)
    1014 +static inline struct hlist_nulls_head *select_bucket(struct bpf_htab *htab, u32 hash)
    1015 {
    1016 return &__select_bucket(htab, hash)->head;
    1017 }
    1018
    1019 -static struct htab_elem *lookup_elem_raw(struct hlist_head *head, u32 hash,
    1020 +/* this lookup function can only be called with bucket lock taken */
    1021 +static struct htab_elem *lookup_elem_raw(struct hlist_nulls_head *head, u32 hash,
    1022 void *key, u32 key_size)
    1023 {
    1024 + struct hlist_nulls_node *n;
    1025 + struct htab_elem *l;
    1026 +
    1027 + hlist_nulls_for_each_entry_rcu(l, n, head, hash_node)
    1028 + if (l->hash == hash && !memcmp(&l->key, key, key_size))
    1029 + return l;
    1030 +
    1031 + return NULL;
    1032 +}
    1033 +
    1034 +/* can be called without bucket lock. it will repeat the loop in
    1035 + * the unlikely event when elements moved from one bucket into another
    1036 + * while link list is being walked
    1037 + */
    1038 +static struct htab_elem *lookup_nulls_elem_raw(struct hlist_nulls_head *head,
    1039 + u32 hash, void *key,
    1040 + u32 key_size, u32 n_buckets)
    1041 +{
    1042 + struct hlist_nulls_node *n;
    1043 struct htab_elem *l;
    1044
    1045 - hlist_for_each_entry_rcu(l, head, hash_node)
    1046 +again:
    1047 + hlist_nulls_for_each_entry_rcu(l, n, head, hash_node)
    1048 if (l->hash == hash && !memcmp(&l->key, key, key_size))
    1049 return l;
    1050
    1051 + if (unlikely(get_nulls_value(n) != (hash & (n_buckets - 1))))
    1052 + goto again;
    1053 +
    1054 return NULL;
    1055 }
    1056
    1057 @@ -291,7 +328,7 @@ static struct htab_elem *lookup_elem_raw(struct hlist_head *head, u32 hash,
    1058 static void *__htab_map_lookup_elem(struct bpf_map *map, void *key)
    1059 {
    1060 struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
    1061 - struct hlist_head *head;
    1062 + struct hlist_nulls_head *head;
    1063 struct htab_elem *l;
    1064 u32 hash, key_size;
    1065
    1066 @@ -304,7 +341,7 @@ static void *__htab_map_lookup_elem(struct bpf_map *map, void *key)
    1067
    1068 head = select_bucket(htab, hash);
    1069
    1070 - l = lookup_elem_raw(head, hash, key, key_size);
    1071 + l = lookup_nulls_elem_raw(head, hash, key, key_size, htab->n_buckets);
    1072
    1073 return l;
    1074 }
    1075 @@ -323,7 +360,7 @@ static void *htab_map_lookup_elem(struct bpf_map *map, void *key)
    1076 static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
    1077 {
    1078 struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
    1079 - struct hlist_head *head;
    1080 + struct hlist_nulls_head *head;
    1081 struct htab_elem *l, *next_l;
    1082 u32 hash, key_size;
    1083 int i = 0;
    1084 @@ -340,13 +377,13 @@ static int htab_map_get_next_key(struct bpf_map *map, void *key, void *next_key)
    1085 head = select_bucket(htab, hash);
    1086
    1087 /* lookup the key */
    1088 - l = lookup_elem_raw(head, hash, key, key_size);
    1089 + l = lookup_nulls_elem_raw(head, hash, key, key_size, htab->n_buckets);
    1090
    1091 if (!l)
    1092 goto find_first_elem;
    1093
    1094 /* key was found, get next key in the same bucket */
    1095 - next_l = hlist_entry_safe(rcu_dereference_raw(hlist_next_rcu(&l->hash_node)),
    1096 + next_l = hlist_nulls_entry_safe(rcu_dereference_raw(hlist_nulls_next_rcu(&l->hash_node)),
    1097 struct htab_elem, hash_node);
    1098
    1099 if (next_l) {
    1100 @@ -365,7 +402,7 @@ find_first_elem:
    1101 head = select_bucket(htab, i);
    1102
    1103 /* pick first element in the bucket */
    1104 - next_l = hlist_entry_safe(rcu_dereference_raw(hlist_first_rcu(head)),
    1105 + next_l = hlist_nulls_entry_safe(rcu_dereference_raw(hlist_nulls_first_rcu(head)),
    1106 struct htab_elem, hash_node);
    1107 if (next_l) {
    1108 /* if it's not empty, just return it */
    1109 @@ -429,9 +466,13 @@ static struct htab_elem *alloc_htab_elem(struct bpf_htab *htab, void *key,
    1110 int err = 0;
    1111
    1112 if (prealloc) {
    1113 - l_new = (struct htab_elem *)pcpu_freelist_pop(&htab->freelist);
    1114 - if (!l_new)
    1115 + struct pcpu_freelist_node *l;
    1116 +
    1117 + l = pcpu_freelist_pop(&htab->freelist);
    1118 + if (!l)
    1119 err = -E2BIG;
    1120 + else
    1121 + l_new = container_of(l, struct htab_elem, fnode);
    1122 } else {
    1123 if (atomic_inc_return(&htab->count) > htab->map.max_entries) {
    1124 atomic_dec(&htab->count);
    1125 @@ -518,7 +559,7 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
    1126 {
    1127 struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
    1128 struct htab_elem *l_new = NULL, *l_old;
    1129 - struct hlist_head *head;
    1130 + struct hlist_nulls_head *head;
    1131 unsigned long flags;
    1132 struct bucket *b;
    1133 u32 key_size, hash;
    1134 @@ -557,9 +598,9 @@ static int htab_map_update_elem(struct bpf_map *map, void *key, void *value,
    1135 /* add new element to the head of the list, so that
    1136 * concurrent search will find it before old elem
    1137 */
    1138 - hlist_add_head_rcu(&l_new->hash_node, head);
    1139 + hlist_nulls_add_head_rcu(&l_new->hash_node, head);
    1140 if (l_old) {
    1141 - hlist_del_rcu(&l_old->hash_node);
    1142 + hlist_nulls_del_rcu(&l_old->hash_node);
    1143 free_htab_elem(htab, l_old);
    1144 }
    1145 ret = 0;
    1146 @@ -574,7 +615,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
    1147 {
    1148 struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
    1149 struct htab_elem *l_new = NULL, *l_old;
    1150 - struct hlist_head *head;
    1151 + struct hlist_nulls_head *head;
    1152 unsigned long flags;
    1153 struct bucket *b;
    1154 u32 key_size, hash;
    1155 @@ -626,7 +667,7 @@ static int __htab_percpu_map_update_elem(struct bpf_map *map, void *key,
    1156 ret = PTR_ERR(l_new);
    1157 goto err;
    1158 }
    1159 - hlist_add_head_rcu(&l_new->hash_node, head);
    1160 + hlist_nulls_add_head_rcu(&l_new->hash_node, head);
    1161 }
    1162 ret = 0;
    1163 err:
    1164 @@ -644,7 +685,7 @@ static int htab_percpu_map_update_elem(struct bpf_map *map, void *key,
    1165 static int htab_map_delete_elem(struct bpf_map *map, void *key)
    1166 {
    1167 struct bpf_htab *htab = container_of(map, struct bpf_htab, map);
    1168 - struct hlist_head *head;
    1169 + struct hlist_nulls_head *head;
    1170 struct bucket *b;
    1171 struct htab_elem *l;
    1172 unsigned long flags;
    1173 @@ -664,7 +705,7 @@ static int htab_map_delete_elem(struct bpf_map *map, void *key)
    1174 l = lookup_elem_raw(head, hash, key, key_size);
    1175
    1176 if (l) {
    1177 - hlist_del_rcu(&l->hash_node);
    1178 + hlist_nulls_del_rcu(&l->hash_node);
    1179 free_htab_elem(htab, l);
    1180 ret = 0;
    1181 }
    1182 @@ -678,12 +719,12 @@ static void delete_all_elements(struct bpf_htab *htab)
    1183 int i;
    1184
    1185 for (i = 0; i < htab->n_buckets; i++) {
    1186 - struct hlist_head *head = select_bucket(htab, i);
    1187 - struct hlist_node *n;
    1188 + struct hlist_nulls_head *head = select_bucket(htab, i);
    1189 + struct hlist_nulls_node *n;
    1190 struct htab_elem *l;
    1191
    1192 - hlist_for_each_entry_safe(l, n, head, hash_node) {
    1193 - hlist_del_rcu(&l->hash_node);
    1194 + hlist_nulls_for_each_entry_safe(l, n, head, hash_node) {
    1195 + hlist_nulls_del_rcu(&l->hash_node);
    1196 if (l->state != HTAB_EXTRA_ELEM_USED)
    1197 htab_elem_free(htab, l);
    1198 }
    1199 diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
    1200 index fb3e2a50d76e..d06d15db3232 100644
    1201 --- a/net/8021q/vlan_dev.c
    1202 +++ b/net/8021q/vlan_dev.c
    1203 @@ -366,10 +366,12 @@ static int vlan_dev_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    1204 ifrr.ifr_ifru = ifr->ifr_ifru;
    1205
    1206 switch (cmd) {
    1207 + case SIOCSHWTSTAMP:
    1208 + if (!net_eq(dev_net(dev), &init_net))
    1209 + break;
    1210 case SIOCGMIIPHY:
    1211 case SIOCGMIIREG:
    1212 case SIOCSMIIREG:
    1213 - case SIOCSHWTSTAMP:
    1214 case SIOCGHWTSTAMP:
    1215 if (netif_device_present(real_dev) && ops->ndo_do_ioctl)
    1216 err = ops->ndo_do_ioctl(real_dev, &ifrr, cmd);
    1217 diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
    1218 index 8e173324693d..925818a05398 100644
    1219 --- a/net/bridge/br_if.c
    1220 +++ b/net/bridge/br_if.c
    1221 @@ -519,13 +519,15 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
    1222 call_netdevice_notifiers(NETDEV_JOIN, dev);
    1223
    1224 err = dev_set_allmulti(dev, 1);
    1225 - if (err)
    1226 - goto put_back;
    1227 + if (err) {
    1228 + kfree(p); /* kobject not yet init'd, manually free */
    1229 + goto err1;
    1230 + }
    1231
    1232 err = kobject_init_and_add(&p->kobj, &brport_ktype, &(dev->dev.kobj),
    1233 SYSFS_BRIDGE_PORT_ATTR);
    1234 if (err)
    1235 - goto err1;
    1236 + goto err2;
    1237
    1238 err = br_sysfs_addif(p);
    1239 if (err)
    1240 @@ -608,12 +610,9 @@ err3:
    1241 sysfs_remove_link(br->ifobj, p->dev->name);
    1242 err2:
    1243 kobject_put(&p->kobj);
    1244 - p = NULL; /* kobject_put frees */
    1245 -err1:
    1246 dev_set_allmulti(dev, -1);
    1247 -put_back:
    1248 +err1:
    1249 dev_put(dev);
    1250 - kfree(p);
    1251 return err;
    1252 }
    1253
    1254 diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
    1255 index be4629c344a6..bb26457e8c21 100644
    1256 --- a/net/core/fib_rules.c
    1257 +++ b/net/core/fib_rules.c
    1258 @@ -429,9 +429,9 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr *nlh)
    1259 if (rule->l3mdev && rule->table)
    1260 goto errout_free;
    1261
    1262 - if ((nlh->nlmsg_flags & NLM_F_EXCL) &&
    1263 - rule_exists(ops, frh, tb, rule)) {
    1264 - err = -EEXIST;
    1265 + if (rule_exists(ops, frh, tb, rule)) {
    1266 + if (nlh->nlmsg_flags & NLM_F_EXCL)
    1267 + err = -EEXIST;
    1268 goto errout_free;
    1269 }
    1270
    1271 diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
    1272 index 59d8770055ed..1d0e2284d8ad 100644
    1273 --- a/net/ipv4/raw.c
    1274 +++ b/net/ipv4/raw.c
    1275 @@ -169,6 +169,7 @@ static int icmp_filter(const struct sock *sk, const struct sk_buff *skb)
    1276 */
    1277 static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
    1278 {
    1279 + int dif = inet_iif(skb);
    1280 struct sock *sk;
    1281 struct hlist_head *head;
    1282 int delivered = 0;
    1283 @@ -181,8 +182,7 @@ static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
    1284
    1285 net = dev_net(skb->dev);
    1286 sk = __raw_v4_lookup(net, __sk_head(head), iph->protocol,
    1287 - iph->saddr, iph->daddr,
    1288 - skb->dev->ifindex);
    1289 + iph->saddr, iph->daddr, dif);
    1290
    1291 while (sk) {
    1292 delivered = 1;
    1293 diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    1294 index be74eee0e8ff..47ca2a2f1cf8 100644
    1295 --- a/net/ipv6/sit.c
    1296 +++ b/net/ipv6/sit.c
    1297 @@ -1069,7 +1069,7 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
    1298 if (!tdev && tunnel->parms.link)
    1299 tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
    1300
    1301 - if (tdev) {
    1302 + if (tdev && !netif_is_l3_master(tdev)) {
    1303 int t_hlen = tunnel->hlen + sizeof(struct iphdr);
    1304
    1305 dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
    1306 diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
    1307 index 197753ad50b4..8c17d498df30 100644
    1308 --- a/net/mac80211/mesh_pathtbl.c
    1309 +++ b/net/mac80211/mesh_pathtbl.c
    1310 @@ -23,7 +23,7 @@ static void mesh_path_free_rcu(struct mesh_table *tbl, struct mesh_path *mpath);
    1311 static u32 mesh_table_hash(const void *addr, u32 len, u32 seed)
    1312 {
    1313 /* Use last four bytes of hw addr as hash index */
    1314 - return jhash_1word(*(u32 *)(addr+2), seed);
    1315 + return jhash_1word(__get_unaligned_cpu32((u8 *)addr + 2), seed);
    1316 }
    1317
    1318 static const struct rhashtable_params mesh_rht_params = {
    1319 diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
    1320 index fd186b011a99..8475e8692ff0 100644
    1321 --- a/net/netfilter/ipvs/ip_vs_core.c
    1322 +++ b/net/netfilter/ipvs/ip_vs_core.c
    1323 @@ -1643,7 +1643,7 @@ ip_vs_in_icmp(struct netns_ipvs *ipvs, struct sk_buff *skb, int *related,
    1324 if (!cp) {
    1325 int v;
    1326
    1327 - if (!sysctl_schedule_icmp(ipvs))
    1328 + if (ipip || !sysctl_schedule_icmp(ipvs))
    1329 return NF_ACCEPT;
    1330
    1331 if (!ip_vs_try_to_schedule(ipvs, AF_INET, skb, pd, &v, &cp, &ciph))
    1332 diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
    1333 index 751fec729ffb..e065140d0c93 100644
    1334 --- a/net/netfilter/x_tables.c
    1335 +++ b/net/netfilter/x_tables.c
    1336 @@ -1728,7 +1728,7 @@ static int __init xt_init(void)
    1337 seqcount_init(&per_cpu(xt_recseq, i));
    1338 }
    1339
    1340 - xt = kmalloc(sizeof(struct xt_af) * NFPROTO_NUMPROTO, GFP_KERNEL);
    1341 + xt = kcalloc(NFPROTO_NUMPROTO, sizeof(struct xt_af), GFP_KERNEL);
    1342 if (!xt)
    1343 return -ENOMEM;
    1344
    1345 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    1346 index ea37160d5ae2..dcf033fea2d2 100644
    1347 --- a/net/packet/af_packet.c
    1348 +++ b/net/packet/af_packet.c
    1349 @@ -4624,14 +4624,29 @@ static void __exit packet_exit(void)
    1350
    1351 static int __init packet_init(void)
    1352 {
    1353 - int rc = proto_register(&packet_proto, 0);
    1354 + int rc;
    1355
    1356 - if (rc != 0)
    1357 + rc = proto_register(&packet_proto, 0);
    1358 + if (rc)
    1359 goto out;
    1360 + rc = sock_register(&packet_family_ops);
    1361 + if (rc)
    1362 + goto out_proto;
    1363 + rc = register_pernet_subsys(&packet_net_ops);
    1364 + if (rc)
    1365 + goto out_sock;
    1366 + rc = register_netdevice_notifier(&packet_netdev_notifier);
    1367 + if (rc)
    1368 + goto out_pernet;
    1369
    1370 - sock_register(&packet_family_ops);
    1371 - register_pernet_subsys(&packet_net_ops);
    1372 - register_netdevice_notifier(&packet_netdev_notifier);
    1373 + return 0;
    1374 +
    1375 +out_pernet:
    1376 + unregister_pernet_subsys(&packet_net_ops);
    1377 +out_sock:
    1378 + sock_unregister(PF_PACKET);
    1379 +out_proto:
    1380 + proto_unregister(&packet_proto);
    1381 out:
    1382 return rc;
    1383 }
    1384 diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
    1385 index f57a58ac7ae0..3acb373674c3 100644
    1386 --- a/sound/core/pcm_lib.c
    1387 +++ b/sound/core/pcm_lib.c
    1388 @@ -1849,8 +1849,6 @@ int snd_pcm_lib_ioctl(struct snd_pcm_substream *substream,
    1389 unsigned int cmd, void *arg)
    1390 {
    1391 switch (cmd) {
    1392 - case SNDRV_PCM_IOCTL1_INFO:
    1393 - return 0;
    1394 case SNDRV_PCM_IOCTL1_RESET:
    1395 return snd_pcm_lib_ioctl_reset(substream, arg);
    1396 case SNDRV_PCM_IOCTL1_CHANNEL_INFO:
    1397 diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
    1398 index f5eb10f8021c..b4809844bb1c 100644
    1399 --- a/sound/core/pcm_native.c
    1400 +++ b/sound/core/pcm_native.c
    1401 @@ -214,11 +214,7 @@ int snd_pcm_info(struct snd_pcm_substream *substream, struct snd_pcm_info *info)
    1402 info->subdevices_avail = pstr->substream_count - pstr->substream_opened;
    1403 strlcpy(info->subname, substream->name, sizeof(info->subname));
    1404 runtime = substream->runtime;
    1405 - /* AB: FIXME!!! This is definitely nonsense */
    1406 - if (runtime) {
    1407 - info->sync = runtime->sync;
    1408 - substream->ops->ioctl(substream, SNDRV_PCM_IOCTL1_INFO, info);
    1409 - }
    1410 +
    1411 return 0;
    1412 }
    1413
    1414 diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
    1415 index 700c74b0aed0..def61125ac36 100644
    1416 --- a/tools/lib/traceevent/event-parse.c
    1417 +++ b/tools/lib/traceevent/event-parse.c
    1418 @@ -2204,7 +2204,7 @@ eval_type_str(unsigned long long val, const char *type, int pointer)
    1419 return val & 0xffffffff;
    1420
    1421 if (strcmp(type, "u64") == 0 ||
    1422 - strcmp(type, "s64"))
    1423 + strcmp(type, "s64") == 0)
    1424 return val;
    1425
    1426 if (strcmp(type, "s8") == 0)
    1427 diff --git a/tools/testing/selftests/net/run_netsocktests b/tools/testing/selftests/net/run_netsocktests
    1428 index 16058bbea7a8..c195b4478662 100755
    1429 --- a/tools/testing/selftests/net/run_netsocktests
    1430 +++ b/tools/testing/selftests/net/run_netsocktests
    1431 @@ -6,7 +6,7 @@ echo "--------------------"
    1432 ./socket
    1433 if [ $? -ne 0 ]; then
    1434 echo "[FAIL]"
    1435 + exit 1
    1436 else
    1437 echo "[PASS]"
    1438 fi
    1439 -
    1440 diff --git a/tools/testing/selftests/netfilter/Makefile b/tools/testing/selftests/netfilter/Makefile
    1441 index c9ff2b47bd1c..a37cb1192c6a 100644
    1442 --- a/tools/testing/selftests/netfilter/Makefile
    1443 +++ b/tools/testing/selftests/netfilter/Makefile
    1444 @@ -1,6 +1,6 @@
    1445 # SPDX-License-Identifier: GPL-2.0
    1446 # Makefile for netfilter selftests
    1447
    1448 -TEST_PROGS := nft_trans_stress.sh nft_nat.sh
    1449 +TEST_PROGS := nft_trans_stress.sh nft_nat.sh conntrack_icmp_related.sh
    1450
    1451 include ../lib.mk
    1452 diff --git a/tools/testing/selftests/netfilter/conntrack_icmp_related.sh b/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
    1453 new file mode 100755
    1454 index 000000000000..b48e1833bc89
    1455 --- /dev/null
    1456 +++ b/tools/testing/selftests/netfilter/conntrack_icmp_related.sh
    1457 @@ -0,0 +1,283 @@
    1458 +#!/bin/bash
    1459 +#
    1460 +# check that ICMP df-needed/pkttoobig icmp are set are set as related
    1461 +# state
    1462 +#
    1463 +# Setup is:
    1464 +#
    1465 +# nsclient1 -> nsrouter1 -> nsrouter2 -> nsclient2
    1466 +# MTU 1500, except for nsrouter2 <-> nsclient2 link (1280).
    1467 +# ping nsclient2 from nsclient1, checking that conntrack did set RELATED
    1468 +# 'fragmentation needed' icmp packet.
    1469 +#
    1470 +# In addition, nsrouter1 will perform IP masquerading, i.e. also
    1471 +# check the icmp errors are propagated to the correct host as per
    1472 +# nat of "established" icmp-echo "connection".
    1473 +
    1474 +# Kselftest framework requirement - SKIP code is 4.
    1475 +ksft_skip=4
    1476 +ret=0
    1477 +
    1478 +nft --version > /dev/null 2>&1
    1479 +if [ $? -ne 0 ];then
    1480 + echo "SKIP: Could not run test without nft tool"
    1481 + exit $ksft_skip
    1482 +fi
    1483 +
    1484 +ip -Version > /dev/null 2>&1
    1485 +if [ $? -ne 0 ];then
    1486 + echo "SKIP: Could not run test without ip tool"
    1487 + exit $ksft_skip
    1488 +fi
    1489 +
    1490 +cleanup() {
    1491 + for i in 1 2;do ip netns del nsclient$i;done
    1492 + for i in 1 2;do ip netns del nsrouter$i;done
    1493 +}
    1494 +
    1495 +ipv4() {
    1496 + echo -n 192.168.$1.2
    1497 +}
    1498 +
    1499 +ipv6 () {
    1500 + echo -n dead:$1::2
    1501 +}
    1502 +
    1503 +check_counter()
    1504 +{
    1505 + ns=$1
    1506 + name=$2
    1507 + expect=$3
    1508 + local lret=0
    1509 +
    1510 + cnt=$(ip netns exec $ns nft list counter inet filter "$name" | grep -q "$expect")
    1511 + if [ $? -ne 0 ]; then
    1512 + echo "ERROR: counter $name in $ns has unexpected value (expected $expect)" 1>&2
    1513 + ip netns exec $ns nft list counter inet filter "$name" 1>&2
    1514 + lret=1
    1515 + fi
    1516 +
    1517 + return $lret
    1518 +}
    1519 +
    1520 +check_unknown()
    1521 +{
    1522 + expect="packets 0 bytes 0"
    1523 + for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
    1524 + check_counter $n "unknown" "$expect"
    1525 + if [ $? -ne 0 ] ;then
    1526 + return 1
    1527 + fi
    1528 + done
    1529 +
    1530 + return 0
    1531 +}
    1532 +
    1533 +for n in nsclient1 nsclient2 nsrouter1 nsrouter2; do
    1534 + ip netns add $n
    1535 + ip -net $n link set lo up
    1536 +done
    1537 +
    1538 +DEV=veth0
    1539 +ip link add $DEV netns nsclient1 type veth peer name eth1 netns nsrouter1
    1540 +DEV=veth0
    1541 +ip link add $DEV netns nsclient2 type veth peer name eth1 netns nsrouter2
    1542 +
    1543 +DEV=veth0
    1544 +ip link add $DEV netns nsrouter1 type veth peer name eth2 netns nsrouter2
    1545 +
    1546 +DEV=veth0
    1547 +for i in 1 2; do
    1548 + ip -net nsclient$i link set $DEV up
    1549 + ip -net nsclient$i addr add $(ipv4 $i)/24 dev $DEV
    1550 + ip -net nsclient$i addr add $(ipv6 $i)/64 dev $DEV
    1551 +done
    1552 +
    1553 +ip -net nsrouter1 link set eth1 up
    1554 +ip -net nsrouter1 link set veth0 up
    1555 +
    1556 +ip -net nsrouter2 link set eth1 up
    1557 +ip -net nsrouter2 link set eth2 up
    1558 +
    1559 +ip -net nsclient1 route add default via 192.168.1.1
    1560 +ip -net nsclient1 -6 route add default via dead:1::1
    1561 +
    1562 +ip -net nsclient2 route add default via 192.168.2.1
    1563 +ip -net nsclient2 route add default via dead:2::1
    1564 +
    1565 +i=3
    1566 +ip -net nsrouter1 addr add 192.168.1.1/24 dev eth1
    1567 +ip -net nsrouter1 addr add 192.168.3.1/24 dev veth0
    1568 +ip -net nsrouter1 addr add dead:1::1/64 dev eth1
    1569 +ip -net nsrouter1 addr add dead:3::1/64 dev veth0
    1570 +ip -net nsrouter1 route add default via 192.168.3.10
    1571 +ip -net nsrouter1 -6 route add default via dead:3::10
    1572 +
    1573 +ip -net nsrouter2 addr add 192.168.2.1/24 dev eth1
    1574 +ip -net nsrouter2 addr add 192.168.3.10/24 dev eth2
    1575 +ip -net nsrouter2 addr add dead:2::1/64 dev eth1
    1576 +ip -net nsrouter2 addr add dead:3::10/64 dev eth2
    1577 +ip -net nsrouter2 route add default via 192.168.3.1
    1578 +ip -net nsrouter2 route add default via dead:3::1
    1579 +
    1580 +sleep 2
    1581 +for i in 4 6; do
    1582 + ip netns exec nsrouter1 sysctl -q net.ipv$i.conf.all.forwarding=1
    1583 + ip netns exec nsrouter2 sysctl -q net.ipv$i.conf.all.forwarding=1
    1584 +done
    1585 +
    1586 +for netns in nsrouter1 nsrouter2; do
    1587 +ip netns exec $netns nft -f - <<EOF
    1588 +table inet filter {
    1589 + counter unknown { }
    1590 + counter related { }
    1591 + chain forward {
    1592 + type filter hook forward priority 0; policy accept;
    1593 + meta l4proto icmpv6 icmpv6 type "packet-too-big" ct state "related" counter name "related" accept
    1594 + meta l4proto icmp icmp type "destination-unreachable" ct state "related" counter name "related" accept
    1595 + meta l4proto { icmp, icmpv6 } ct state new,established accept
    1596 + counter name "unknown" drop
    1597 + }
    1598 +}
    1599 +EOF
    1600 +done
    1601 +
    1602 +ip netns exec nsclient1 nft -f - <<EOF
    1603 +table inet filter {
    1604 + counter unknown { }
    1605 + counter related { }
    1606 + chain input {
    1607 + type filter hook input priority 0; policy accept;
    1608 + meta l4proto { icmp, icmpv6 } ct state established,untracked accept
    1609 +
    1610 + meta l4proto { icmp, icmpv6 } ct state "related" counter name "related" accept
    1611 + counter name "unknown" drop
    1612 + }
    1613 +}
    1614 +EOF
    1615 +
    1616 +ip netns exec nsclient2 nft -f - <<EOF
    1617 +table inet filter {
    1618 + counter unknown { }
    1619 + counter new { }
    1620 + counter established { }
    1621 +
    1622 + chain input {
    1623 + type filter hook input priority 0; policy accept;
    1624 + meta l4proto { icmp, icmpv6 } ct state established,untracked accept
    1625 +
    1626 + meta l4proto { icmp, icmpv6 } ct state "new" counter name "new" accept
    1627 + meta l4proto { icmp, icmpv6 } ct state "established" counter name "established" accept
    1628 + counter name "unknown" drop
    1629 + }
    1630 + chain output {
    1631 + type filter hook output priority 0; policy accept;
    1632 + meta l4proto { icmp, icmpv6 } ct state established,untracked accept
    1633 +
    1634 + meta l4proto { icmp, icmpv6 } ct state "new" counter name "new"
    1635 + meta l4proto { icmp, icmpv6 } ct state "established" counter name "established"
    1636 + counter name "unknown" drop
    1637 + }
    1638 +}
    1639 +EOF
    1640 +
    1641 +
    1642 +# make sure NAT core rewrites adress of icmp error if nat is used according to
    1643 +# conntrack nat information (icmp error will be directed at nsrouter1 address,
    1644 +# but it needs to be routed to nsclient1 address).
    1645 +ip netns exec nsrouter1 nft -f - <<EOF
    1646 +table ip nat {
    1647 + chain postrouting {
    1648 + type nat hook postrouting priority 0; policy accept;
    1649 + ip protocol icmp oifname "veth0" counter masquerade
    1650 + }
    1651 +}
    1652 +table ip6 nat {
    1653 + chain postrouting {
    1654 + type nat hook postrouting priority 0; policy accept;
    1655 + ip6 nexthdr icmpv6 oifname "veth0" counter masquerade
    1656 + }
    1657 +}
    1658 +EOF
    1659 +
    1660 +ip netns exec nsrouter2 ip link set eth1 mtu 1280
    1661 +ip netns exec nsclient2 ip link set veth0 mtu 1280
    1662 +sleep 1
    1663 +
    1664 +ip netns exec nsclient1 ping -c 1 -s 1000 -q -M do 192.168.2.2 >/dev/null
    1665 +if [ $? -ne 0 ]; then
    1666 + echo "ERROR: netns ip routing/connectivity broken" 1>&2
    1667 + cleanup
    1668 + exit 1
    1669 +fi
    1670 +ip netns exec nsclient1 ping6 -q -c 1 -s 1000 dead:2::2 >/dev/null
    1671 +if [ $? -ne 0 ]; then
    1672 + echo "ERROR: netns ipv6 routing/connectivity broken" 1>&2
    1673 + cleanup
    1674 + exit 1
    1675 +fi
    1676 +
    1677 +check_unknown
    1678 +if [ $? -ne 0 ]; then
    1679 + ret=1
    1680 +fi
    1681 +
    1682 +expect="packets 0 bytes 0"
    1683 +for netns in nsrouter1 nsrouter2 nsclient1;do
    1684 + check_counter "$netns" "related" "$expect"
    1685 + if [ $? -ne 0 ]; then
    1686 + ret=1
    1687 + fi
    1688 +done
    1689 +
    1690 +expect="packets 2 bytes 2076"
    1691 +check_counter nsclient2 "new" "$expect"
    1692 +if [ $? -ne 0 ]; then
    1693 + ret=1
    1694 +fi
    1695 +
    1696 +ip netns exec nsclient1 ping -q -c 1 -s 1300 -M do 192.168.2.2 > /dev/null
    1697 +if [ $? -eq 0 ]; then
    1698 + echo "ERROR: ping should have failed with PMTU too big error" 1>&2
    1699 + ret=1
    1700 +fi
    1701 +
    1702 +# nsrouter2 should have generated the icmp error, so
    1703 +# related counter should be 0 (its in forward).
    1704 +expect="packets 0 bytes 0"
    1705 +check_counter "nsrouter2" "related" "$expect"
    1706 +if [ $? -ne 0 ]; then
    1707 + ret=1
    1708 +fi
    1709 +
    1710 +# but nsrouter1 should have seen it, same for nsclient1.
    1711 +expect="packets 1 bytes 576"
    1712 +for netns in nsrouter1 nsclient1;do
    1713 + check_counter "$netns" "related" "$expect"
    1714 + if [ $? -ne 0 ]; then
    1715 + ret=1
    1716 + fi
    1717 +done
    1718 +
    1719 +ip netns exec nsclient1 ping6 -c 1 -s 1300 dead:2::2 > /dev/null
    1720 +if [ $? -eq 0 ]; then
    1721 + echo "ERROR: ping6 should have failed with PMTU too big error" 1>&2
    1722 + ret=1
    1723 +fi
    1724 +
    1725 +expect="packets 2 bytes 1856"
    1726 +for netns in nsrouter1 nsclient1;do
    1727 + check_counter "$netns" "related" "$expect"
    1728 + if [ $? -ne 0 ]; then
    1729 + ret=1
    1730 + fi
    1731 +done
    1732 +
    1733 +if [ $ret -eq 0 ];then
    1734 + echo "PASS: icmp mtu error had RELATED state"
    1735 +else
    1736 + echo "ERROR: icmp error RELATED state test has failed"
    1737 +fi
    1738 +
    1739 +cleanup
    1740 +exit $ret