Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0325-4.9.226-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0325-4.9.226-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3600 - (show annotations) (download)
    Thu Aug 13 10:21:40 2020 UTC (3 years, 8 months ago) by niro
    File size: 50089 byte(s) 
    linux-226
    1 diff --git a/Makefile b/Makefile
    2 index d17a2ad3cc4d..b0e1162fddfa 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 225
    9 +SUBLEVEL = 226
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/arm/boot/dts/imx6q-b450v3.dts b/arch/arm/boot/dts/imx6q-b450v3.dts
    14 index 78bfc1a307d6..ebc6e10f8624 100644
    15 --- a/arch/arm/boot/dts/imx6q-b450v3.dts
    16 +++ b/arch/arm/boot/dts/imx6q-b450v3.dts
    17 @@ -65,13 +65,6 @@
    18 };
    19 };
    20
    21 -&clks {
    22 - assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
    23 - <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
    24 - assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
    25 - <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
    26 -};
    27 -
    28 &ldb {
    29 status = "okay";
    30
    31 diff --git a/arch/arm/boot/dts/imx6q-b650v3.dts b/arch/arm/boot/dts/imx6q-b650v3.dts
    32 index d85388725426..681aa612e07f 100644
    33 --- a/arch/arm/boot/dts/imx6q-b650v3.dts
    34 +++ b/arch/arm/boot/dts/imx6q-b650v3.dts
    35 @@ -65,13 +65,6 @@
    36 };
    37 };
    38
    39 -&clks {
    40 - assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
    41 - <&clks IMX6QDL_CLK_LDB_DI1_SEL>;
    42 - assigned-clock-parents = <&clks IMX6QDL_CLK_PLL3_USB_OTG>,
    43 - <&clks IMX6QDL_CLK_PLL3_USB_OTG>;
    44 -};
    45 -
    46 &ldb {
    47 status = "okay";
    48
    49 diff --git a/arch/arm/boot/dts/imx6q-b850v3.dts b/arch/arm/boot/dts/imx6q-b850v3.dts
    50 index 167f7446722a..8596df4078e9 100644
    51 --- a/arch/arm/boot/dts/imx6q-b850v3.dts
    52 +++ b/arch/arm/boot/dts/imx6q-b850v3.dts
    53 @@ -53,17 +53,6 @@
    54 };
    55 };
    56
    57 -&clks {
    58 - assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
    59 - <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
    60 - <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
    61 - <&clks IMX6QDL_CLK_IPU1_DI1_PRE_SEL>;
    62 - assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
    63 - <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
    64 - <&clks IMX6QDL_CLK_PLL2_PFD2_396M>,
    65 - <&clks IMX6QDL_CLK_PLL2_PFD2_396M>;
    66 -};
    67 -
    68 &ldb {
    69 fsl,dual-channel;
    70 status = "okay";
    71 diff --git a/arch/arm/boot/dts/imx6q-bx50v3.dtsi b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
    72 index e4a415fd899b..cee0e19f180f 100644
    73 --- a/arch/arm/boot/dts/imx6q-bx50v3.dtsi
    74 +++ b/arch/arm/boot/dts/imx6q-bx50v3.dtsi
    75 @@ -92,6 +92,56 @@
    76 mux-int-port = <1>;
    77 mux-ext-port = <4>;
    78 };
    79 +
    80 + aliases {
    81 + mdio-gpio0 = &mdio0;
    82 + };
    83 +
    84 + mdio0: mdio-gpio {
    85 + compatible = "virtual,mdio-gpio";
    86 + gpios = <&gpio2 5 GPIO_ACTIVE_HIGH>, /* mdc */
    87 + <&gpio2 7 GPIO_ACTIVE_HIGH>; /* mdio */
    88 +
    89 + #address-cells = <1>;
    90 + #size-cells = <0>;
    91 +
    92 + switch@0 {
    93 + compatible = "marvell,mv88e6085"; /* 88e6240*/
    94 + #address-cells = <1>;
    95 + #size-cells = <0>;
    96 + reg = <0>;
    97 +
    98 + switch_ports: ports {
    99 + #address-cells = <1>;
    100 + #size-cells = <0>;
    101 + };
    102 +
    103 + mdio {
    104 + #address-cells = <1>;
    105 + #size-cells = <0>;
    106 +
    107 + switchphy0: switchphy@0 {
    108 + reg = <0>;
    109 + };
    110 +
    111 + switchphy1: switchphy@1 {
    112 + reg = <1>;
    113 + };
    114 +
    115 + switchphy2: switchphy@2 {
    116 + reg = <2>;
    117 + };
    118 +
    119 + switchphy3: switchphy@3 {
    120 + reg = <3>;
    121 + };
    122 +
    123 + switchphy4: switchphy@4 {
    124 + reg = <4>;
    125 + };
    126 + };
    127 + };
    128 + };
    129 };
    130
    131 &ecspi5 {
    132 @@ -299,3 +349,30 @@
    133 tcxo-clock-frequency = <26000000>;
    134 };
    135 };
    136 +
    137 +&pcie {
    138 + /* Synopsys, Inc. Device */
    139 + pci_root: root@0,0 {
    140 + compatible = "pci16c3,abcd";
    141 + reg = <0x00000000 0 0 0 0>;
    142 +
    143 + #address-cells = <3>;
    144 + #size-cells = <2>;
    145 + #interrupt-cells = <1>;
    146 + };
    147 +};
    148 +
    149 +&clks {
    150 + assigned-clocks = <&clks IMX6QDL_CLK_LDB_DI0_SEL>,
    151 + <&clks IMX6QDL_CLK_LDB_DI1_SEL>,
    152 + <&clks IMX6QDL_CLK_IPU1_DI0_PRE_SEL>,
    153 + <&clks IMX6QDL_CLK_IPU1_DI1_PRE_SEL>,
    154 + <&clks IMX6QDL_CLK_IPU2_DI0_PRE_SEL>,
    155 + <&clks IMX6QDL_CLK_IPU2_DI1_PRE_SEL>;
    156 + assigned-clock-parents = <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
    157 + <&clks IMX6QDL_CLK_PLL5_VIDEO_DIV>,
    158 + <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
    159 + <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
    160 + <&clks IMX6QDL_CLK_PLL2_PFD0_352M>,
    161 + <&clks IMX6QDL_CLK_PLL2_PFD0_352M>;
    162 +};
    163 diff --git a/arch/parisc/mm/init.c b/arch/parisc/mm/init.c
    164 index b9db8e529e4d..dbbe3932f833 100644
    165 --- a/arch/parisc/mm/init.c
    166 +++ b/arch/parisc/mm/init.c
    167 @@ -604,7 +604,7 @@ void __init mem_init(void)
    168 > BITS_PER_LONG);
    169
    170 high_memory = __va((max_pfn << PAGE_SHIFT));
    171 - set_max_mapnr(page_to_pfn(virt_to_page(high_memory - 1)) + 1);
    172 + set_max_mapnr(max_low_pfn);
    173 free_all_bootmem();
    174
    175 #ifdef CONFIG_PA11
    176 diff --git a/arch/x86/include/asm/dma.h b/arch/x86/include/asm/dma.h
    177 index fe884e18fa6e..c7854a098b6b 100644
    178 --- a/arch/x86/include/asm/dma.h
    179 +++ b/arch/x86/include/asm/dma.h
    180 @@ -73,7 +73,7 @@
    181 #define MAX_DMA_PFN ((16UL * 1024 * 1024) >> PAGE_SHIFT)
    182
    183 /* 4GB broken PCI/AGP hardware bus master zone */
    184 -#define MAX_DMA32_PFN ((4UL * 1024 * 1024 * 1024) >> PAGE_SHIFT)
    185 +#define MAX_DMA32_PFN (1UL << (32 - PAGE_SHIFT))
    186
    187 #ifdef CONFIG_X86_32
    188 /* The maximum address that we can perform a DMA transfer to on this platform */
    189 diff --git a/drivers/gpio/gpio-tegra.c b/drivers/gpio/gpio-tegra.c
    190 index 05d3241ad20b..9d763557a105 100644
    191 --- a/drivers/gpio/gpio-tegra.c
    192 +++ b/drivers/gpio/gpio-tegra.c
    193 @@ -341,6 +341,7 @@ static void tegra_gpio_irq_shutdown(struct irq_data *d)
    194 struct tegra_gpio_info *tgi = bank->tgi;
    195 int gpio = d->hwirq;
    196
    197 + tegra_gpio_irq_mask(d);
    198 gpiochip_unlock_as_irq(&tgi->gc, gpio);
    199 }
    200
    201 diff --git a/drivers/infiniband/hw/qib/qib_sysfs.c b/drivers/infiniband/hw/qib/qib_sysfs.c
    202 index 8ce0f6eef89e..b9d653afff8b 100644
    203 --- a/drivers/infiniband/hw/qib/qib_sysfs.c
    204 +++ b/drivers/infiniband/hw/qib/qib_sysfs.c
    205 @@ -756,7 +756,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
    206 qib_dev_err(dd,
    207 "Skipping linkcontrol sysfs info, (err %d) port %u\n",
    208 ret, port_num);
    209 - goto bail;
    210 + goto bail_link;
    211 }
    212 kobject_uevent(&ppd->pport_kobj, KOBJ_ADD);
    213
    214 @@ -766,7 +766,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
    215 qib_dev_err(dd,
    216 "Skipping sl2vl sysfs info, (err %d) port %u\n",
    217 ret, port_num);
    218 - goto bail_link;
    219 + goto bail_sl;
    220 }
    221 kobject_uevent(&ppd->sl2vl_kobj, KOBJ_ADD);
    222
    223 @@ -776,7 +776,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
    224 qib_dev_err(dd,
    225 "Skipping diag_counters sysfs info, (err %d) port %u\n",
    226 ret, port_num);
    227 - goto bail_sl;
    228 + goto bail_diagc;
    229 }
    230 kobject_uevent(&ppd->diagc_kobj, KOBJ_ADD);
    231
    232 @@ -789,7 +789,7 @@ int qib_create_port_files(struct ib_device *ibdev, u8 port_num,
    233 qib_dev_err(dd,
    234 "Skipping Congestion Control sysfs info, (err %d) port %u\n",
    235 ret, port_num);
    236 - goto bail_diagc;
    237 + goto bail_cc;
    238 }
    239
    240 kobject_uevent(&ppd->pport_cc_kobj, KOBJ_ADD);
    241 @@ -871,6 +871,7 @@ void qib_verbs_unregister_sysfs(struct qib_devdata *dd)
    242 &cc_table_bin_attr);
    243 kobject_put(&ppd->pport_cc_kobj);
    244 }
    245 + kobject_put(&ppd->diagc_kobj);
    246 kobject_put(&ppd->sl2vl_kobj);
    247 kobject_put(&ppd->pport_kobj);
    248 }
    249 diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
    250 index e9ae3d500a55..700f018df668 100644
    251 --- a/drivers/input/evdev.c
    252 +++ b/drivers/input/evdev.c
    253 @@ -342,20 +342,6 @@ static int evdev_fasync(int fd, struct file *file, int on)
    254 return fasync_helper(fd, file, on, &client->fasync);
    255 }
    256
    257 -static int evdev_flush(struct file *file, fl_owner_t id)
    258 -{
    259 - struct evdev_client *client = file->private_data;
    260 - struct evdev *evdev = client->evdev;
    261 -
    262 - mutex_lock(&evdev->mutex);
    263 -
    264 - if (evdev->exist && !client->revoked)
    265 - input_flush_device(&evdev->handle, file);
    266 -
    267 - mutex_unlock(&evdev->mutex);
    268 - return 0;
    269 -}
    270 -
    271 static void evdev_free(struct device *dev)
    272 {
    273 struct evdev *evdev = container_of(dev, struct evdev, dev);
    274 @@ -469,6 +455,10 @@ static int evdev_release(struct inode *inode, struct file *file)
    275 unsigned int i;
    276
    277 mutex_lock(&evdev->mutex);
    278 +
    279 + if (evdev->exist && !client->revoked)
    280 + input_flush_device(&evdev->handle, file);
    281 +
    282 evdev_ungrab(evdev, client);
    283 mutex_unlock(&evdev->mutex);
    284
    285 @@ -1331,7 +1321,6 @@ static const struct file_operations evdev_fops = {
    286 .compat_ioctl = evdev_ioctl_compat,
    287 #endif
    288 .fasync = evdev_fasync,
    289 - .flush = evdev_flush,
    290 .llseek = no_llseek,
    291 };
    292
    293 diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
    294 index 26476a64e663..54a6691d7d87 100644
    295 --- a/drivers/input/joystick/xpad.c
    296 +++ b/drivers/input/joystick/xpad.c
    297 @@ -475,6 +475,16 @@ static const u8 xboxone_fw2015_init[] = {
    298 0x05, 0x20, 0x00, 0x01, 0x00
    299 };
    300
    301 +/*
    302 + * This packet is required for Xbox One S (0x045e:0x02ea)
    303 + * and Xbox One Elite Series 2 (0x045e:0x0b00) pads to
    304 + * initialize the controller that was previously used in
    305 + * Bluetooth mode.
    306 + */
    307 +static const u8 xboxone_s_init[] = {
    308 + 0x05, 0x20, 0x00, 0x0f, 0x06
    309 +};
    310 +
    311 /*
    312 * This packet is required for the Titanfall 2 Xbox One pads
    313 * (0x0e6f:0x0165) to finish initialization and for Hori pads
    314 @@ -533,6 +543,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
    315 XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
    316 XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
    317 XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
    318 + XBOXONE_INIT_PKT(0x045e, 0x02ea, xboxone_s_init),
    319 + XBOXONE_INIT_PKT(0x045e, 0x0b00, xboxone_s_init),
    320 XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
    321 XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
    322 XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
    323 diff --git a/drivers/input/rmi4/rmi_driver.c b/drivers/input/rmi4/rmi_driver.c
    324 index 65038dcc7613..677edbf870a7 100644
    325 --- a/drivers/input/rmi4/rmi_driver.c
    326 +++ b/drivers/input/rmi4/rmi_driver.c
    327 @@ -991,7 +991,8 @@ static int rmi_driver_probe(struct device *dev)
    328 if (data->input) {
    329 rmi_driver_set_input_name(rmi_dev, data->input);
    330 if (!rmi_dev->xport->input) {
    331 - if (input_register_device(data->input)) {
    332 + retval = input_register_device(data->input);
    333 + if (retval) {
    334 dev_err(dev, "%s: Failed to register input device.\n",
    335 __func__);
    336 goto err_destroy_functions;
    337 diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    338 index a4e76084a2af..fd1e79013cf8 100644
    339 --- a/drivers/input/serio/i8042-x86ia64io.h
    340 +++ b/drivers/input/serio/i8042-x86ia64io.h
    341 @@ -738,6 +738,13 @@ static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
    342 DMI_MATCH(DMI_PRODUCT_NAME, "P65xRP"),
    343 },
    344 },
    345 + {
    346 + /* Lenovo ThinkPad Twist S230u */
    347 + .matches = {
    348 + DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
    349 + DMI_MATCH(DMI_PRODUCT_NAME, "33474HU"),
    350 + },
    351 + },
    352 { }
    353 };
    354
    355 diff --git a/drivers/input/touchscreen/usbtouchscreen.c b/drivers/input/touchscreen/usbtouchscreen.c
    356 index 2c41107240de..499402a975b3 100644
    357 --- a/drivers/input/touchscreen/usbtouchscreen.c
    358 +++ b/drivers/input/touchscreen/usbtouchscreen.c
    359 @@ -197,6 +197,7 @@ static const struct usb_device_id usbtouch_devices[] = {
    360 #endif
    361
    362 #ifdef CONFIG_TOUCHSCREEN_USB_IRTOUCH
    363 + {USB_DEVICE(0x255e, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
    364 {USB_DEVICE(0x595a, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
    365 {USB_DEVICE(0x6615, 0x0001), .driver_info = DEVTYPE_IRTOUCH},
    366 {USB_DEVICE(0x6615, 0x0012), .driver_info = DEVTYPE_IRTOUCH_HIRES},
    367 diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
    368 index dbcc13efaf3c..d609e14bb904 100644
    369 --- a/drivers/iommu/iommu.c
    370 +++ b/drivers/iommu/iommu.c
    371 @@ -195,7 +195,7 @@ struct iommu_group *iommu_group_alloc(void)
    372 NULL, "%d", group->id);
    373 if (ret) {
    374 ida_simple_remove(&iommu_group_ida, group->id);
    375 - kfree(group);
    376 + kobject_put(&group->kobj);
    377 return ERR_PTR(ret);
    378 }
    379
    380 diff --git a/drivers/net/bonding/bond_sysfs_slave.c b/drivers/net/bonding/bond_sysfs_slave.c
    381 index 641a532b67cb..3f756fa2f603 100644
    382 --- a/drivers/net/bonding/bond_sysfs_slave.c
    383 +++ b/drivers/net/bonding/bond_sysfs_slave.c
    384 @@ -153,8 +153,10 @@ int bond_sysfs_slave_add(struct slave *slave)
    385
    386 err = kobject_init_and_add(&slave->kobj, &slave_ktype,
    387 &(slave->dev->dev.kobj), "bonding_slave");
    388 - if (err)
    389 + if (err) {
    390 + kobject_put(&slave->kobj);
    391 return err;
    392 + }
    393
    394 for (a = slave_attrs; *a; ++a) {
    395 err = sysfs_create_file(&slave->kobj, &((*a)->attr));
    396 diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
    397 index 551b2a9ebf0f..4a4e86000192 100644
    398 --- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
    399 +++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_main.c
    400 @@ -2867,6 +2867,9 @@ int hns_dsaf_roce_reset(struct fwnode_handle *dsaf_fwnode, bool dereset)
    401 dsaf_set_bit(credit, DSAF_SBM_ROCEE_CFG_CRD_EN_B, 1);
    402 dsaf_write_dev(dsaf_dev, DSAF_SBM_ROCEE_CFG_REG_REG, credit);
    403 }
    404 +
    405 + put_device(&pdev->dev);
    406 +
    407 return 0;
    408 }
    409 EXPORT_SYMBOL(hns_dsaf_roce_reset);
    410 diff --git a/drivers/net/ethernet/mellanox/mlx4/fw.c b/drivers/net/ethernet/mellanox/mlx4/fw.c
    411 index 9af0887c8a29..fe9dc1b3078c 100644
    412 --- a/drivers/net/ethernet/mellanox/mlx4/fw.c
    413 +++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
    414 @@ -2704,7 +2704,7 @@ void mlx4_opreq_action(struct work_struct *work)
    415 if (err) {
    416 mlx4_err(dev, "Failed to retrieve required operation: %d\n",
    417 err);
    418 - return;
    419 + goto out;
    420 }
    421 MLX4_GET(modifier, outbox, GET_OP_REQ_MODIFIER_OFFSET);
    422 MLX4_GET(token, outbox, GET_OP_REQ_TOKEN_OFFSET);
    423 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
    424 index bb142a13d9f2..b6113620cb1a 100644
    425 --- a/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
    426 +++ b/drivers/net/ethernet/mellanox/mlx5/core/cmd.c
    427 @@ -786,6 +786,7 @@ static void cmd_work_handler(struct work_struct *work)
    428 int alloc_ret;
    429 int cmd_mode;
    430
    431 + complete(&ent->handling);
    432 sem = ent->page_queue ? &cmd->pages_sem : &cmd->sem;
    433 down(sem);
    434 if (!ent->page_queue) {
    435 @@ -904,6 +905,12 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
    436 struct mlx5_cmd *cmd = &dev->cmd;
    437 int err;
    438
    439 + if (!wait_for_completion_timeout(&ent->handling, timeout) &&
    440 + cancel_work_sync(&ent->work)) {
    441 + ent->ret = -ECANCELED;
    442 + goto out_err;
    443 + }
    444 +
    445 if (cmd->mode == CMD_MODE_POLLING) {
    446 wait_for_completion(&ent->done);
    447 } else if (!wait_for_completion_timeout(&ent->done, timeout)) {
    448 @@ -911,12 +918,17 @@ static int wait_func(struct mlx5_core_dev *dev, struct mlx5_cmd_work_ent *ent)
    449 mlx5_cmd_comp_handler(dev, 1UL << ent->idx, true);
    450 }
    451
    452 +out_err:
    453 err = ent->ret;
    454
    455 if (err == -ETIMEDOUT) {
    456 mlx5_core_warn(dev, "%s(0x%x) timeout. Will cause a leak of a command resource\n",
    457 mlx5_command_str(msg_to_opcode(ent->in)),
    458 msg_to_opcode(ent->in));
    459 + } else if (err == -ECANCELED) {
    460 + mlx5_core_warn(dev, "%s(0x%x) canceled on out of queue timeout.\n",
    461 + mlx5_command_str(msg_to_opcode(ent->in)),
    462 + msg_to_opcode(ent->in));
    463 }
    464 mlx5_core_dbg(dev, "err %d, delivery status %s(%d)\n",
    465 err, deliv_status_to_str(ent->status), ent->status);
    466 @@ -951,6 +963,7 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
    467
    468 ent->token = token;
    469
    470 + init_completion(&ent->handling);
    471 if (!callback)
    472 init_completion(&ent->done);
    473
    474 @@ -970,6 +983,8 @@ static int mlx5_cmd_invoke(struct mlx5_core_dev *dev, struct mlx5_cmd_msg *in,
    475 err = wait_func(dev, ent);
    476 if (err == -ETIMEDOUT)
    477 goto out;
    478 + if (err == -ECANCELED)
    479 + goto out_free;
    480
    481 ds = ent->ts2 - ent->ts1;
    482 op = MLX5_GET(mbox_in, in->first.data, opcode);
    483 diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
    484 index 574311018e6f..f0a6b72497da 100644
    485 --- a/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
    486 +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tx.c
    487 @@ -499,8 +499,9 @@ bool mlx5e_poll_tx_cq(struct mlx5e_cq *cq, int napi_budget)
    488 static void mlx5e_free_txq_sq_descs(struct mlx5e_sq *sq)
    489 {
    490 struct mlx5e_tx_wqe_info *wi;
    491 + u32 nbytes = 0;
    492 + u16 ci, npkts = 0;
    493 struct sk_buff *skb;
    494 - u16 ci;
    495 int i;
    496
    497 while (sq->cc != sq->pc) {
    498 @@ -521,8 +522,11 @@ static void mlx5e_free_txq_sq_descs(struct mlx5e_sq *sq)
    499 }
    500
    501 dev_kfree_skb_any(skb);
    502 + npkts++;
    503 + nbytes += wi->num_bytes;
    504 sq->cc += wi->num_wqebbs;
    505 }
    506 + netdev_tx_completed_queue(sq->txq, npkts, nbytes);
    507 }
    508
    509 static void mlx5e_free_xdp_sq_descs(struct mlx5e_sq *sq)
    510 diff --git a/drivers/net/ethernet/microchip/encx24j600.c b/drivers/net/ethernet/microchip/encx24j600.c
    511 index b14f0305aa31..ad661d1979c7 100644
    512 --- a/drivers/net/ethernet/microchip/encx24j600.c
    513 +++ b/drivers/net/ethernet/microchip/encx24j600.c
    514 @@ -1058,7 +1058,7 @@ static int encx24j600_spi_probe(struct spi_device *spi)
    515 if (unlikely(ret)) {
    516 netif_err(priv, probe, ndev, "Error %d initializing card encx24j600 card\n",
    517 ret);
    518 - goto out_free;
    519 + goto out_stop;
    520 }
    521
    522 eidled = encx24j600_read_reg(priv, EIDLED);
    523 @@ -1076,6 +1076,8 @@ static int encx24j600_spi_probe(struct spi_device *spi)
    524
    525 out_unregister:
    526 unregister_netdev(priv->ndev);
    527 +out_stop:
    528 + kthread_stop(priv->kworker_task);
    529 out_free:
    530 free_netdev(ndev);
    531
    532 @@ -1088,6 +1090,7 @@ static int encx24j600_spi_remove(struct spi_device *spi)
    533 struct encx24j600_priv *priv = dev_get_drvdata(&spi->dev);
    534
    535 unregister_netdev(priv->ndev);
    536 + kthread_stop(priv->kworker_task);
    537
    538 free_netdev(priv->ndev);
    539
    540 diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
    541 index 35c5ac41c0a1..5d2de48b77a0 100644
    542 --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
    543 +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
    544 @@ -3610,7 +3610,7 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
    545 ahw->diag_cnt = 0;
    546 ret = qlcnic_alloc_mbx_args(&cmd, adapter, QLCNIC_CMD_INTRPT_TEST);
    547 if (ret)
    548 - goto fail_diag_irq;
    549 + goto fail_mbx_args;
    550
    551 if (adapter->flags & QLCNIC_MSIX_ENABLED)
    552 intrpt_id = ahw->intr_tbl[0].id;
    553 @@ -3640,6 +3640,8 @@ int qlcnic_83xx_interrupt_test(struct net_device *netdev)
    554
    555 done:
    556 qlcnic_free_mbx_args(&cmd);
    557 +
    558 +fail_mbx_args:
    559 qlcnic_83xx_diag_free_res(netdev, drv_sds_rings);
    560
    561 fail_diag_irq:
    562 diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
    563 index 062bce9acde6..bfe7b55f9714 100644
    564 --- a/drivers/net/ethernet/sun/cassini.c
    565 +++ b/drivers/net/ethernet/sun/cassini.c
    566 @@ -4980,7 +4980,7 @@ static int cas_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
    567 cas_cacheline_size)) {
    568 dev_err(&pdev->dev, "Could not set PCI cache "
    569 "line size\n");
    570 - goto err_write_cacheline;
    571 + goto err_out_free_res;
    572 }
    573 }
    574 #endif
    575 @@ -5151,7 +5151,6 @@ err_out_iounmap:
    576 err_out_free_res:
    577 pci_release_regions(pdev);
    578
    579 -err_write_cacheline:
    580 /* Try to restore it in case the error occurred after we
    581 * set it.
    582 */
    583 diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
    584 index a3aaef4c53a3..0d2bcb33697f 100644
    585 --- a/drivers/s390/scsi/zfcp_fsf.c
    586 +++ b/drivers/s390/scsi/zfcp_fsf.c
    587 @@ -1594,6 +1594,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
    588 {
    589 struct zfcp_qdio *qdio = wka_port->adapter->qdio;
    590 struct zfcp_fsf_req *req;
    591 + unsigned long req_id = 0;
    592 int retval = -EIO;
    593
    594 spin_lock_irq(&qdio->req_q_lock);
    595 @@ -1616,6 +1617,8 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
    596 hton24(req->qtcb->bottom.support.d_id, wka_port->d_id);
    597 req->data = wka_port;
    598
    599 + req_id = req->req_id;
    600 +
    601 zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
    602 retval = zfcp_fsf_req_send(req);
    603 if (retval)
    604 @@ -1623,7 +1626,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port)
    605 out:
    606 spin_unlock_irq(&qdio->req_q_lock);
    607 if (!retval)
    608 - zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id);
    609 + zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req_id);
    610 return retval;
    611 }
    612
    613 @@ -1649,6 +1652,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
    614 {
    615 struct zfcp_qdio *qdio = wka_port->adapter->qdio;
    616 struct zfcp_fsf_req *req;
    617 + unsigned long req_id = 0;
    618 int retval = -EIO;
    619
    620 spin_lock_irq(&qdio->req_q_lock);
    621 @@ -1671,6 +1675,8 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
    622 req->data = wka_port;
    623 req->qtcb->header.port_handle = wka_port->handle;
    624
    625 + req_id = req->req_id;
    626 +
    627 zfcp_fsf_start_timer(req, ZFCP_FSF_REQUEST_TIMEOUT);
    628 retval = zfcp_fsf_req_send(req);
    629 if (retval)
    630 @@ -1678,7 +1684,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port)
    631 out:
    632 spin_unlock_irq(&qdio->req_q_lock);
    633 if (!retval)
    634 - zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id);
    635 + zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req_id);
    636 return retval;
    637 }
    638
    639 diff --git a/drivers/tty/serial/sc16is7xx.c b/drivers/tty/serial/sc16is7xx.c
    640 index f80a88d107d7..d8843657d787 100644
    641 --- a/drivers/tty/serial/sc16is7xx.c
    642 +++ b/drivers/tty/serial/sc16is7xx.c
    643 @@ -1523,10 +1523,12 @@ static int __init sc16is7xx_init(void)
    644 #endif
    645 return ret;
    646
    647 +#ifdef CONFIG_SERIAL_SC16IS7XX_SPI
    648 err_spi:
    649 #ifdef CONFIG_SERIAL_SC16IS7XX_I2C
    650 i2c_del_driver(&sc16is7xx_i2c_uart_driver);
    651 #endif
    652 +#endif
    653 err_i2c:
    654 uart_unregister_driver(&sc16is7xx_uart);
    655 return ret;
    656 diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
    657 index b8534d3f8bb0..cb02e9ecd8e7 100644
    658 --- a/drivers/usb/gadget/legacy/inode.c
    659 +++ b/drivers/usb/gadget/legacy/inode.c
    660 @@ -1364,7 +1364,6 @@ gadgetfs_setup (struct usb_gadget *gadget, const struct usb_ctrlrequest *ctrl)
    661
    662 req->buf = dev->rbuf;
    663 req->context = NULL;
    664 - value = -EOPNOTSUPP;
    665 switch (ctrl->bRequest) {
    666
    667 case USB_REQ_GET_DESCRIPTOR:
    668 @@ -1788,7 +1787,7 @@ static ssize_t
    669 dev_config (struct file *fd, const char __user *buf, size_t len, loff_t *ptr)
    670 {
    671 struct dev_data *dev = fd->private_data;
    672 - ssize_t value = len, length = len;
    673 + ssize_t value, length = len;
    674 unsigned total;
    675 u32 tag;
    676 char *kbuf;
    677 diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
    678 index e78553d51837..73cd7482c1fa 100644
    679 --- a/fs/binfmt_elf.c
    680 +++ b/fs/binfmt_elf.c
    681 @@ -1721,7 +1721,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t,
    682 (!regset->active || regset->active(t->task, regset) > 0)) {
    683 int ret;
    684 size_t size = regset->n * regset->size;
    685 - void *data = kmalloc(size, GFP_KERNEL);
    686 + void *data = kzalloc(size, GFP_KERNEL);
    687 if (unlikely(!data))
    688 return 0;
    689 ret = regset->get(t->task, regset,
    690 diff --git a/fs/cachefiles/rdwr.c b/fs/cachefiles/rdwr.c
    691 index 799b59d96fe2..7dba96d5fef1 100644
    692 --- a/fs/cachefiles/rdwr.c
    693 +++ b/fs/cachefiles/rdwr.c
    694 @@ -64,9 +64,9 @@ static int cachefiles_read_waiter(wait_queue_t *wait, unsigned mode,
    695 object = container_of(op->op.object, struct cachefiles_object, fscache);
    696 spin_lock(&object->work_lock);
    697 list_add_tail(&monitor->op_link, &op->to_do);
    698 + fscache_enqueue_retrieval(op);
    699 spin_unlock(&object->work_lock);
    700
    701 - fscache_enqueue_retrieval(op);
    702 fscache_put_retrieval(op);
    703 return 0;
    704 }
    705 diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    706 index 09d83275c20b..b2919166855f 100644
    707 --- a/fs/cifs/file.c
    708 +++ b/fs/cifs/file.c
    709 @@ -3293,7 +3293,7 @@ cifs_read(struct file *file, char *read_data, size_t read_size, loff_t *offset)
    710 * than it negotiated since it will refuse the read
    711 * then.
    712 */
    713 - if ((tcon->ses) && !(tcon->ses->capabilities &
    714 + if (!(tcon->ses->capabilities &
    715 tcon->ses->server->vals->cap_large_files)) {
    716 current_read_size = min_t(uint,
    717 current_read_size, CIFSMaxBufSize);
    718 diff --git a/fs/gfs2/quota.c b/fs/gfs2/quota.c
    719 index c2ca9566b764..fb9b1d702351 100644
    720 --- a/fs/gfs2/quota.c
    721 +++ b/fs/gfs2/quota.c
    722 @@ -1039,8 +1039,7 @@ int gfs2_quota_lock(struct gfs2_inode *ip, kuid_t uid, kgid_t gid)
    723 u32 x;
    724 int error = 0;
    725
    726 - if (capable(CAP_SYS_RESOURCE) ||
    727 - sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
    728 + if (sdp->sd_args.ar_quota != GFS2_QUOTA_ON)
    729 return 0;
    730
    731 error = gfs2_quota_hold(ip, uid, gid);
    732 diff --git a/fs/gfs2/quota.h b/fs/gfs2/quota.h
    733 index 836f29480be6..e3a6e2404d11 100644
    734 --- a/fs/gfs2/quota.h
    735 +++ b/fs/gfs2/quota.h
    736 @@ -47,7 +47,8 @@ static inline int gfs2_quota_lock_check(struct gfs2_inode *ip,
    737 int ret;
    738
    739 ap->allowed = UINT_MAX; /* Assume we are permitted a whole lot */
    740 - if (sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
    741 + if (capable(CAP_SYS_RESOURCE) ||
    742 + sdp->sd_args.ar_quota == GFS2_QUOTA_OFF)
    743 return 0;
    744 ret = gfs2_quota_lock(ip, NO_UID_QUOTA_CHANGE, NO_GID_QUOTA_CHANGE);
    745 if (ret)
    746 diff --git a/include/asm-generic/topology.h b/include/asm-generic/topology.h
    747 index 5d2add1a6c96..864fcfa1df41 100644
    748 --- a/include/asm-generic/topology.h
    749 +++ b/include/asm-generic/topology.h
    750 @@ -51,7 +51,7 @@
    751 #ifdef CONFIG_NEED_MULTIPLE_NODES
    752 #define cpumask_of_node(node) ((node) == 0 ? cpu_online_mask : cpu_none_mask)
    753 #else
    754 - #define cpumask_of_node(node) ((void)node, cpu_online_mask)
    755 + #define cpumask_of_node(node) ((void)(node), cpu_online_mask)
    756 #endif
    757 #endif
    758 #ifndef pcibus_to_node
    759 diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
    760 index 509e99076c57..6094e4a3a0a4 100644
    761 --- a/include/linux/mlx5/driver.h
    762 +++ b/include/linux/mlx5/driver.h
    763 @@ -656,6 +656,7 @@ struct mlx5_cmd_work_ent {
    764 struct delayed_work cb_timeout_work;
    765 void *context;
    766 int idx;
    767 + struct completion handling;
    768 struct completion done;
    769 struct mlx5_cmd *cmd;
    770 struct work_struct work;
    771 diff --git a/include/linux/mm.h b/include/linux/mm.h
    772 index ca6f213fa4f0..7a4c035b187f 100644
    773 --- a/include/linux/mm.h
    774 +++ b/include/linux/mm.h
    775 @@ -504,6 +504,11 @@ static inline int is_vmalloc_or_module_addr(const void *x)
    776
    777 extern void kvfree(const void *addr);
    778
    779 +/*
    780 + * Mapcount of compound page as a whole, does not include mapped sub-pages.
    781 + *
    782 + * Must be called only for compound pages or any their tail sub-pages.
    783 + */
    784 static inline int compound_mapcount(struct page *page)
    785 {
    786 VM_BUG_ON_PAGE(!PageCompound(page), page);
    787 @@ -523,10 +528,16 @@ static inline void page_mapcount_reset(struct page *page)
    788
    789 int __page_mapcount(struct page *page);
    790
    791 +/*
    792 + * Mapcount of 0-order page; when compound sub-page, includes
    793 + * compound_mapcount().
    794 + *
    795 + * Result is undefined for pages which cannot be mapped into userspace.
    796 + * For example SLAB or special types of pages. See function page_has_type().
    797 + * They use this place in struct page differently.
    798 + */
    799 static inline int page_mapcount(struct page *page)
    800 {
    801 - VM_BUG_ON_PAGE(PageSlab(page), page);
    802 -
    803 if (unlikely(PageCompound(page)))
    804 return __page_mapcount(page);
    805 return atomic_read(&page->_mapcount) + 1;
    806 diff --git a/include/linux/netfilter/nf_conntrack_pptp.h b/include/linux/netfilter/nf_conntrack_pptp.h
    807 index 2ab2830316b7..aca42a2e79cf 100644
    808 --- a/include/linux/netfilter/nf_conntrack_pptp.h
    809 +++ b/include/linux/netfilter/nf_conntrack_pptp.h
    810 @@ -4,7 +4,7 @@
    811
    812 #include <linux/netfilter/nf_conntrack_common.h>
    813
    814 -extern const char *const pptp_msg_name[];
    815 +const char *pptp_msg_name(u_int16_t msg);
    816
    817 /* state of the control session */
    818 enum pptp_ctrlsess_state {
    819 diff --git a/include/net/act_api.h b/include/net/act_api.h
    820 index 82f3c912a5b1..051b90779708 100644
    821 --- a/include/net/act_api.h
    822 +++ b/include/net/act_api.h
    823 @@ -94,7 +94,8 @@ static inline void tcf_tm_dump(struct tcf_t *dtm, const struct tcf_t *stm)
    824 {
    825 dtm->install = jiffies_to_clock_t(jiffies - stm->install);
    826 dtm->lastuse = jiffies_to_clock_t(jiffies - stm->lastuse);
    827 - dtm->firstuse = jiffies_to_clock_t(jiffies - stm->firstuse);
    828 + dtm->firstuse = stm->firstuse ?
    829 + jiffies_to_clock_t(jiffies - stm->firstuse) : 0;
    830 dtm->expires = jiffies_to_clock_t(stm->expires);
    831 }
    832
    833 diff --git a/include/rdma/ib_addr.h b/include/rdma/ib_addr.h
    834 index f888263fd757..f4205f935331 100644
    835 --- a/include/rdma/ib_addr.h
    836 +++ b/include/rdma/ib_addr.h
    837 @@ -208,11 +208,13 @@ static inline void iboe_addr_get_sgid(struct rdma_dev_addr *dev_addr,
    838 dev = dev_get_by_index(&init_net, dev_addr->bound_dev_if);
    839 if (dev) {
    840 ip4 = in_dev_get(dev);
    841 - if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address) {
    842 + if (ip4 && ip4->ifa_list && ip4->ifa_list->ifa_address)
    843 ipv6_addr_set_v4mapped(ip4->ifa_list->ifa_address,
    844 (struct in6_addr *)gid);
    845 +
    846 + if (ip4)
    847 in_dev_put(ip4);
    848 - }
    849 +
    850 dev_put(dev);
    851 }
    852 }
    853 diff --git a/include/uapi/linux/l2tp.h b/include/uapi/linux/l2tp.h
    854 index bb2d62037037..80d85053fb06 100644
    855 --- a/include/uapi/linux/l2tp.h
    856 +++ b/include/uapi/linux/l2tp.h
    857 @@ -9,9 +9,8 @@
    858
    859 #include <linux/types.h>
    860 #include <linux/socket.h>
    861 -#ifndef __KERNEL__
    862 -#include <netinet/in.h>
    863 -#endif
    864 +#include <linux/in.h>
    865 +#include <linux/in6.h>
    866
    867 #define IPPROTO_L2TP 115
    868
    869 @@ -31,7 +30,7 @@ struct sockaddr_l2tpip {
    870 __u32 l2tp_conn_id; /* Connection ID of tunnel */
    871
    872 /* Pad to size of `struct sockaddr'. */
    873 - unsigned char __pad[sizeof(struct sockaddr) -
    874 + unsigned char __pad[__SOCK_SIZE__ -
    875 sizeof(__kernel_sa_family_t) -
    876 sizeof(__be16) - sizeof(struct in_addr) -
    877 sizeof(__u32)];
    878 diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
    879 index 37ddb7bda651..ec7c7eda0774 100644
    880 --- a/kernel/irq/migration.c
    881 +++ b/kernel/irq/migration.c
    882 @@ -7,17 +7,18 @@
    883 void irq_move_masked_irq(struct irq_data *idata)
    884 {
    885 struct irq_desc *desc = irq_data_to_desc(idata);
    886 - struct irq_chip *chip = desc->irq_data.chip;
    887 + struct irq_data *data = &desc->irq_data;
    888 + struct irq_chip *chip = data->chip;
    889
    890 - if (likely(!irqd_is_setaffinity_pending(&desc->irq_data)))
    891 + if (likely(!irqd_is_setaffinity_pending(data)))
    892 return;
    893
    894 - irqd_clr_move_pending(&desc->irq_data);
    895 + irqd_clr_move_pending(data);
    896
    897 /*
    898 * Paranoia: cpu-local interrupts shouldn't be calling in here anyway.
    899 */
    900 - if (irqd_is_per_cpu(&desc->irq_data)) {
    901 + if (irqd_is_per_cpu(data)) {
    902 WARN_ON(1);
    903 return;
    904 }
    905 @@ -42,9 +43,20 @@ void irq_move_masked_irq(struct irq_data *idata)
    906 * For correct operation this depends on the caller
    907 * masking the irqs.
    908 */
    909 - if (cpumask_any_and(desc->pending_mask, cpu_online_mask) < nr_cpu_ids)
    910 - irq_do_set_affinity(&desc->irq_data, desc->pending_mask, false);
    911 -
    912 + if (cpumask_any_and(desc->pending_mask, cpu_online_mask) < nr_cpu_ids) {
    913 + int ret;
    914 +
    915 + ret = irq_do_set_affinity(data, desc->pending_mask, false);
    916 + /*
    917 + * If the there is a cleanup pending in the underlying
    918 + * vector management, reschedule the move for the next
    919 + * interrupt. Leave desc->pending_mask intact.
    920 + */
    921 + if (ret == -EBUSY) {
    922 + irqd_set_move_pending(data);
    923 + return;
    924 + }
    925 + }
    926 cpumask_clear(desc->pending_mask);
    927 }
    928
    929 diff --git a/mm/vmalloc.c b/mm/vmalloc.c
    930 index c74a087fcb7d..5d11aeceb7f8 100644
    931 --- a/mm/vmalloc.c
    932 +++ b/mm/vmalloc.c
    933 @@ -1499,7 +1499,7 @@ static void __vunmap(const void *addr, int deallocate_pages)
    934 addr))
    935 return;
    936
    937 - area = find_vmap_area((unsigned long)addr)->vm;
    938 + area = find_vm_area(addr);
    939 if (unlikely(!area)) {
    940 WARN(1, KERN_ERR "Trying to vfree() nonexistent vm area (%p)\n",
    941 addr);
    942 diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    943 index de55a3f001dc..02be8ee23271 100644
    944 --- a/net/ax25/af_ax25.c
    945 +++ b/net/ax25/af_ax25.c
    946 @@ -639,8 +639,10 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
    947 break;
    948
    949 case SO_BINDTODEVICE:
    950 - if (optlen > IFNAMSIZ)
    951 - optlen = IFNAMSIZ;
    952 + if (optlen > IFNAMSIZ - 1)
    953 + optlen = IFNAMSIZ - 1;
    954 +
    955 + memset(devname, 0, sizeof(devname));
    956
    957 if (copy_from_user(devname, optval, optlen)) {
    958 res = -EFAULT;
    959 diff --git a/net/bridge/netfilter/nft_reject_bridge.c b/net/bridge/netfilter/nft_reject_bridge.c
    960 index d94aaf7c7685..4b5e1a661317 100644
    961 --- a/net/bridge/netfilter/nft_reject_bridge.c
    962 +++ b/net/bridge/netfilter/nft_reject_bridge.c
    963 @@ -34,6 +34,12 @@ static void nft_reject_br_push_etherhdr(struct sk_buff *oldskb,
    964 ether_addr_copy(eth->h_dest, eth_hdr(oldskb)->h_source);
    965 eth->h_proto = eth_hdr(oldskb)->h_proto;
    966 skb_pull(nskb, ETH_HLEN);
    967 +
    968 + if (skb_vlan_tag_present(oldskb)) {
    969 + u16 vid = skb_vlan_tag_get(oldskb);
    970 +
    971 + __vlan_hwaccel_put_tag(nskb, oldskb->vlan_proto, vid);
    972 + }
    973 }
    974
    975 static int nft_bridge_iphdr_validate(struct sk_buff *skb)
    976 diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
    977 index 70ccb0716fc5..4fd679b30b19 100644
    978 --- a/net/ceph/osd_client.c
    979 +++ b/net/ceph/osd_client.c
    980 @@ -2879,7 +2879,9 @@ static void handle_reply(struct ceph_osd *osd, struct ceph_msg *msg)
    981 * supported.
    982 */
    983 req->r_t.target_oloc.pool = m.redirect.oloc.pool;
    984 - req->r_flags |= CEPH_OSD_FLAG_REDIRECTED;
    985 + req->r_flags |= CEPH_OSD_FLAG_REDIRECTED |
    986 + CEPH_OSD_FLAG_IGNORE_OVERLAY |
    987 + CEPH_OSD_FLAG_IGNORE_CACHE;
    988 req->r_tid = 0;
    989 __submit_request(req, false);
    990 goto out_unlock_osdc;
    991 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    992 index ead1a32c68f7..e652e376fb30 100644
    993 --- a/net/core/rtnetlink.c
    994 +++ b/net/core/rtnetlink.c
    995 @@ -2361,7 +2361,7 @@ int rtnl_configure_link(struct net_device *dev, const struct ifinfomsg *ifm)
    996 }
    997
    998 if (dev->rtnl_link_state == RTNL_LINK_INITIALIZED) {
    999 - __dev_notify_flags(dev, old_flags, 0U);
    1000 + __dev_notify_flags(dev, old_flags, (old_flags ^ dev->flags));
    1001 } else {
    1002 dev->rtnl_link_state = RTNL_LINK_INITIALIZED;
    1003 __dev_notify_flags(dev, old_flags, ~0U);
    1004 diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
    1005 index 8afb67a48409..dc3b36ca9f30 100644
    1006 --- a/net/ipv4/ip_vti.c
    1007 +++ b/net/ipv4/ip_vti.c
    1008 @@ -50,7 +50,7 @@ static int vti_net_id __read_mostly;
    1009 static int vti_tunnel_init(struct net_device *dev);
    1010
    1011 static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
    1012 - int encap_type)
    1013 + int encap_type, bool update_skb_dev)
    1014 {
    1015 struct ip_tunnel *tunnel;
    1016 const struct iphdr *iph = ip_hdr(skb);
    1017 @@ -65,6 +65,9 @@ static int vti_input(struct sk_buff *skb, int nexthdr, __be32 spi,
    1018
    1019 XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
    1020
    1021 + if (update_skb_dev)
    1022 + skb->dev = tunnel->dev;
    1023 +
    1024 return xfrm_input(skb, nexthdr, spi, encap_type);
    1025 }
    1026
    1027 @@ -74,25 +77,43 @@ drop:
    1028 return 0;
    1029 }
    1030
    1031 -static int vti_input_ipip(struct sk_buff *skb, int nexthdr, __be32 spi,
    1032 - int encap_type)
    1033 +static int vti_input_proto(struct sk_buff *skb, int nexthdr, __be32 spi,
    1034 + int encap_type)
    1035 {
    1036 - struct ip_tunnel *tunnel;
    1037 + return vti_input(skb, nexthdr, spi, encap_type, false);
    1038 +}
    1039 +
    1040 +static int vti_rcv(struct sk_buff *skb, __be32 spi, bool update_skb_dev)
    1041 +{
    1042 + XFRM_SPI_SKB_CB(skb)->family = AF_INET;
    1043 + XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
    1044 +
    1045 + return vti_input(skb, ip_hdr(skb)->protocol, spi, 0, update_skb_dev);
    1046 +}
    1047 +
    1048 +static int vti_rcv_proto(struct sk_buff *skb)
    1049 +{
    1050 + return vti_rcv(skb, 0, false);
    1051 +}
    1052 +
    1053 +static int vti_rcv_tunnel(struct sk_buff *skb)
    1054 +{
    1055 + struct ip_tunnel_net *itn = net_generic(dev_net(skb->dev), vti_net_id);
    1056 const struct iphdr *iph = ip_hdr(skb);
    1057 - struct net *net = dev_net(skb->dev);
    1058 - struct ip_tunnel_net *itn = net_generic(net, vti_net_id);
    1059 + struct ip_tunnel *tunnel;
    1060
    1061 tunnel = ip_tunnel_lookup(itn, skb->dev->ifindex, TUNNEL_NO_KEY,
    1062 iph->saddr, iph->daddr, 0);
    1063 if (tunnel) {
    1064 + struct tnl_ptk_info tpi = {
    1065 + .proto = htons(ETH_P_IP),
    1066 + };
    1067 +
    1068 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
    1069 goto drop;
    1070 -
    1071 - XFRM_TUNNEL_SKB_CB(skb)->tunnel.ip4 = tunnel;
    1072 -
    1073 - skb->dev = tunnel->dev;
    1074 -
    1075 - return xfrm_input(skb, nexthdr, spi, encap_type);
    1076 + if (iptunnel_pull_header(skb, 0, tpi.proto, false))
    1077 + goto drop;
    1078 + return ip_tunnel_rcv(tunnel, skb, &tpi, NULL, false);
    1079 }
    1080
    1081 return -EINVAL;
    1082 @@ -101,22 +122,6 @@ drop:
    1083 return 0;
    1084 }
    1085
    1086 -static int vti_rcv(struct sk_buff *skb)
    1087 -{
    1088 - XFRM_SPI_SKB_CB(skb)->family = AF_INET;
    1089 - XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
    1090 -
    1091 - return vti_input(skb, ip_hdr(skb)->protocol, 0, 0);
    1092 -}
    1093 -
    1094 -static int vti_rcv_ipip(struct sk_buff *skb)
    1095 -{
    1096 - XFRM_SPI_SKB_CB(skb)->family = AF_INET;
    1097 - XFRM_SPI_SKB_CB(skb)->daddroff = offsetof(struct iphdr, daddr);
    1098 -
    1099 - return vti_input_ipip(skb, ip_hdr(skb)->protocol, ip_hdr(skb)->saddr, 0);
    1100 -}
    1101 -
    1102 static int vti_rcv_cb(struct sk_buff *skb, int err)
    1103 {
    1104 unsigned short family;
    1105 @@ -482,31 +487,31 @@ static void __net_init vti_fb_tunnel_init(struct net_device *dev)
    1106 }
    1107
    1108 static struct xfrm4_protocol vti_esp4_protocol __read_mostly = {
    1109 - .handler = vti_rcv,
    1110 - .input_handler = vti_input,
    1111 + .handler = vti_rcv_proto,
    1112 + .input_handler = vti_input_proto,
    1113 .cb_handler = vti_rcv_cb,
    1114 .err_handler = vti4_err,
    1115 .priority = 100,
    1116 };
    1117
    1118 static struct xfrm4_protocol vti_ah4_protocol __read_mostly = {
    1119 - .handler = vti_rcv,
    1120 - .input_handler = vti_input,
    1121 + .handler = vti_rcv_proto,
    1122 + .input_handler = vti_input_proto,
    1123 .cb_handler = vti_rcv_cb,
    1124 .err_handler = vti4_err,
    1125 .priority = 100,
    1126 };
    1127
    1128 static struct xfrm4_protocol vti_ipcomp4_protocol __read_mostly = {
    1129 - .handler = vti_rcv,
    1130 - .input_handler = vti_input,
    1131 + .handler = vti_rcv_proto,
    1132 + .input_handler = vti_input_proto,
    1133 .cb_handler = vti_rcv_cb,
    1134 .err_handler = vti4_err,
    1135 .priority = 100,
    1136 };
    1137
    1138 static struct xfrm_tunnel ipip_handler __read_mostly = {
    1139 - .handler = vti_rcv_ipip,
    1140 + .handler = vti_rcv_tunnel,
    1141 .err_handler = vti4_err,
    1142 .priority = 0,
    1143 };
    1144 diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
    1145 index 56d71a004dce..bd23a2d01b6c 100644
    1146 --- a/net/ipv4/ipip.c
    1147 +++ b/net/ipv4/ipip.c
    1148 @@ -689,7 +689,7 @@ out:
    1149
    1150 rtnl_link_failed:
    1151 #if IS_ENABLED(CONFIG_MPLS)
    1152 - xfrm4_tunnel_deregister(&mplsip_handler, AF_INET);
    1153 + xfrm4_tunnel_deregister(&mplsip_handler, AF_MPLS);
    1154 xfrm_tunnel_mplsip_failed:
    1155
    1156 #endif
    1157 diff --git a/net/ipv4/netfilter/nf_nat_pptp.c b/net/ipv4/netfilter/nf_nat_pptp.c
    1158 index b3ca21b2ba9b..ddbf93e70069 100644
    1159 --- a/net/ipv4/netfilter/nf_nat_pptp.c
    1160 +++ b/net/ipv4/netfilter/nf_nat_pptp.c
    1161 @@ -156,8 +156,7 @@ pptp_outbound_pkt(struct sk_buff *skb,
    1162 break;
    1163 default:
    1164 pr_debug("unknown outbound packet 0x%04x:%s\n", msg,
    1165 - msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] :
    1166 - pptp_msg_name[0]);
    1167 + pptp_msg_name(msg));
    1168 /* fall through */
    1169 case PPTP_SET_LINK_INFO:
    1170 /* only need to NAT in case PAC is behind NAT box */
    1171 @@ -250,9 +249,7 @@ pptp_inbound_pkt(struct sk_buff *skb,
    1172 pcid_off = offsetof(union pptp_ctrl_union, setlink.peersCallID);
    1173 break;
    1174 default:
    1175 - pr_debug("unknown inbound packet %s\n",
    1176 - msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] :
    1177 - pptp_msg_name[0]);
    1178 + pr_debug("unknown inbound packet %s\n", pptp_msg_name(msg));
    1179 /* fall through */
    1180 case PPTP_START_SESSION_REQUEST:
    1181 case PPTP_START_SESSION_REPLY:
    1182 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    1183 index 81efd2d3998d..c8c51bd2d695 100644
    1184 --- a/net/ipv4/route.c
    1185 +++ b/net/ipv4/route.c
    1186 @@ -477,18 +477,16 @@ u32 ip_idents_reserve(u32 hash, int segs)
    1187 atomic_t *p_id = ip_idents + hash % IP_IDENTS_SZ;
    1188 u32 old = ACCESS_ONCE(*p_tstamp);
    1189 u32 now = (u32)jiffies;
    1190 - u32 new, delta = 0;
    1191 + u32 delta = 0;
    1192
    1193 if (old != now && cmpxchg(p_tstamp, old, now) == old)
    1194 delta = prandom_u32_max(now - old);
    1195
    1196 - /* Do not use atomic_add_return() as it makes UBSAN unhappy */
    1197 - do {
    1198 - old = (u32)atomic_read(p_id);
    1199 - new = old + delta + segs;
    1200 - } while (atomic_cmpxchg(p_id, old, new) != old);
    1201 -
    1202 - return new - segs;
    1203 + /* If UBSAN reports an error there, please make sure your compiler
    1204 + * supports -fno-strict-overflow before reporting it that was a bug
    1205 + * in UBSAN, and it has been fixed in GCC-8.
    1206 + */
    1207 + return atomic_add_return(segs + delta, p_id) - segs;
    1208 }
    1209 EXPORT_SYMBOL(ip_idents_reserve);
    1210
    1211 diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
    1212 index f7eaa1051b5b..2fbd100b9e73 100644
    1213 --- a/net/mac80211/mesh_hwmp.c
    1214 +++ b/net/mac80211/mesh_hwmp.c
    1215 @@ -1082,7 +1082,14 @@ void mesh_path_start_discovery(struct ieee80211_sub_if_data *sdata)
    1216 mesh_path_sel_frame_tx(MPATH_PREQ, 0, sdata->vif.addr, ifmsh->sn,
    1217 target_flags, mpath->dst, mpath->sn, da, 0,
    1218 ttl, lifetime, 0, ifmsh->preq_id++, sdata);
    1219 +
    1220 + spin_lock_bh(&mpath->state_lock);
    1221 + if (mpath->flags & MESH_PATH_DELETED) {
    1222 + spin_unlock_bh(&mpath->state_lock);
    1223 + goto enddiscovery;
    1224 + }
    1225 mod_timer(&mpath->timer, jiffies + mpath->discovery_timeout);
    1226 + spin_unlock_bh(&mpath->state_lock);
    1227
    1228 enddiscovery:
    1229 rcu_read_unlock();
    1230 diff --git a/net/netfilter/ipset/ip_set_list_set.c b/net/netfilter/ipset/ip_set_list_set.c
    1231 index e82157285d34..f13d40402f7e 100644
    1232 --- a/net/netfilter/ipset/ip_set_list_set.c
    1233 +++ b/net/netfilter/ipset/ip_set_list_set.c
    1234 @@ -61,7 +61,7 @@ list_set_ktest(struct ip_set *set, const struct sk_buff *skb,
    1235 /* Don't lookup sub-counters at all */
    1236 opt->cmdflags &= ~IPSET_FLAG_MATCH_COUNTERS;
    1237 if (opt->cmdflags & IPSET_FLAG_SKIP_SUBCOUNTER_UPDATE)
    1238 - opt->cmdflags &= ~IPSET_FLAG_SKIP_COUNTER_UPDATE;
    1239 + opt->cmdflags |= IPSET_FLAG_SKIP_COUNTER_UPDATE;
    1240 list_for_each_entry_rcu(e, &map->members, list) {
    1241 if (SET_WITH_TIMEOUT(set) &&
    1242 ip_set_timeout_expired(ext_timeout(e, set)))
    1243 diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
    1244 index f60a4755d71e..1b2fa9d8575f 100644
    1245 --- a/net/netfilter/nf_conntrack_pptp.c
    1246 +++ b/net/netfilter/nf_conntrack_pptp.c
    1247 @@ -71,24 +71,32 @@ EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_expectfn);
    1248
    1249 #if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
    1250 /* PptpControlMessageType names */
    1251 -const char *const pptp_msg_name[] = {
    1252 - "UNKNOWN_MESSAGE",
    1253 - "START_SESSION_REQUEST",
    1254 - "START_SESSION_REPLY",
    1255 - "STOP_SESSION_REQUEST",
    1256 - "STOP_SESSION_REPLY",
    1257 - "ECHO_REQUEST",
    1258 - "ECHO_REPLY",
    1259 - "OUT_CALL_REQUEST",
    1260 - "OUT_CALL_REPLY",
    1261 - "IN_CALL_REQUEST",
    1262 - "IN_CALL_REPLY",
    1263 - "IN_CALL_CONNECT",
    1264 - "CALL_CLEAR_REQUEST",
    1265 - "CALL_DISCONNECT_NOTIFY",
    1266 - "WAN_ERROR_NOTIFY",
    1267 - "SET_LINK_INFO"
    1268 +static const char *const pptp_msg_name_array[PPTP_MSG_MAX + 1] = {
    1269 + [0] = "UNKNOWN_MESSAGE",
    1270 + [PPTP_START_SESSION_REQUEST] = "START_SESSION_REQUEST",
    1271 + [PPTP_START_SESSION_REPLY] = "START_SESSION_REPLY",
    1272 + [PPTP_STOP_SESSION_REQUEST] = "STOP_SESSION_REQUEST",
    1273 + [PPTP_STOP_SESSION_REPLY] = "STOP_SESSION_REPLY",
    1274 + [PPTP_ECHO_REQUEST] = "ECHO_REQUEST",
    1275 + [PPTP_ECHO_REPLY] = "ECHO_REPLY",
    1276 + [PPTP_OUT_CALL_REQUEST] = "OUT_CALL_REQUEST",
    1277 + [PPTP_OUT_CALL_REPLY] = "OUT_CALL_REPLY",
    1278 + [PPTP_IN_CALL_REQUEST] = "IN_CALL_REQUEST",
    1279 + [PPTP_IN_CALL_REPLY] = "IN_CALL_REPLY",
    1280 + [PPTP_IN_CALL_CONNECT] = "IN_CALL_CONNECT",
    1281 + [PPTP_CALL_CLEAR_REQUEST] = "CALL_CLEAR_REQUEST",
    1282 + [PPTP_CALL_DISCONNECT_NOTIFY] = "CALL_DISCONNECT_NOTIFY",
    1283 + [PPTP_WAN_ERROR_NOTIFY] = "WAN_ERROR_NOTIFY",
    1284 + [PPTP_SET_LINK_INFO] = "SET_LINK_INFO"
    1285 };
    1286 +
    1287 +const char *pptp_msg_name(u_int16_t msg)
    1288 +{
    1289 + if (msg > PPTP_MSG_MAX)
    1290 + return pptp_msg_name_array[0];
    1291 +
    1292 + return pptp_msg_name_array[msg];
    1293 +}
    1294 EXPORT_SYMBOL(pptp_msg_name);
    1295 #endif
    1296
    1297 @@ -277,7 +285,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1298 typeof(nf_nat_pptp_hook_inbound) nf_nat_pptp_inbound;
    1299
    1300 msg = ntohs(ctlh->messageType);
    1301 - pr_debug("inbound control message %s\n", pptp_msg_name[msg]);
    1302 + pr_debug("inbound control message %s\n", pptp_msg_name(msg));
    1303
    1304 switch (msg) {
    1305 case PPTP_START_SESSION_REPLY:
    1306 @@ -312,7 +320,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1307 pcid = pptpReq->ocack.peersCallID;
    1308 if (info->pns_call_id != pcid)
    1309 goto invalid;
    1310 - pr_debug("%s, CID=%X, PCID=%X\n", pptp_msg_name[msg],
    1311 + pr_debug("%s, CID=%X, PCID=%X\n", pptp_msg_name(msg),
    1312 ntohs(cid), ntohs(pcid));
    1313
    1314 if (pptpReq->ocack.resultCode == PPTP_OUTCALL_CONNECT) {
    1315 @@ -329,7 +337,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1316 goto invalid;
    1317
    1318 cid = pptpReq->icreq.callID;
    1319 - pr_debug("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
    1320 + pr_debug("%s, CID=%X\n", pptp_msg_name(msg), ntohs(cid));
    1321 info->cstate = PPTP_CALL_IN_REQ;
    1322 info->pac_call_id = cid;
    1323 break;
    1324 @@ -348,7 +356,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1325 if (info->pns_call_id != pcid)
    1326 goto invalid;
    1327
    1328 - pr_debug("%s, PCID=%X\n", pptp_msg_name[msg], ntohs(pcid));
    1329 + pr_debug("%s, PCID=%X\n", pptp_msg_name(msg), ntohs(pcid));
    1330 info->cstate = PPTP_CALL_IN_CONF;
    1331
    1332 /* we expect a GRE connection from PAC to PNS */
    1333 @@ -358,7 +366,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1334 case PPTP_CALL_DISCONNECT_NOTIFY:
    1335 /* server confirms disconnect */
    1336 cid = pptpReq->disc.callID;
    1337 - pr_debug("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
    1338 + pr_debug("%s, CID=%X\n", pptp_msg_name(msg), ntohs(cid));
    1339 info->cstate = PPTP_CALL_NONE;
    1340
    1341 /* untrack this call id, unexpect GRE packets */
    1342 @@ -385,7 +393,7 @@ pptp_inbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1343 invalid:
    1344 pr_debug("invalid %s: type=%d cid=%u pcid=%u "
    1345 "cstate=%d sstate=%d pns_cid=%u pac_cid=%u\n",
    1346 - msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : pptp_msg_name[0],
    1347 + pptp_msg_name(msg),
    1348 msg, ntohs(cid), ntohs(pcid), info->cstate, info->sstate,
    1349 ntohs(info->pns_call_id), ntohs(info->pac_call_id));
    1350 return NF_ACCEPT;
    1351 @@ -405,7 +413,7 @@ pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1352 typeof(nf_nat_pptp_hook_outbound) nf_nat_pptp_outbound;
    1353
    1354 msg = ntohs(ctlh->messageType);
    1355 - pr_debug("outbound control message %s\n", pptp_msg_name[msg]);
    1356 + pr_debug("outbound control message %s\n", pptp_msg_name(msg));
    1357
    1358 switch (msg) {
    1359 case PPTP_START_SESSION_REQUEST:
    1360 @@ -427,7 +435,7 @@ pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1361 info->cstate = PPTP_CALL_OUT_REQ;
    1362 /* track PNS call id */
    1363 cid = pptpReq->ocreq.callID;
    1364 - pr_debug("%s, CID=%X\n", pptp_msg_name[msg], ntohs(cid));
    1365 + pr_debug("%s, CID=%X\n", pptp_msg_name(msg), ntohs(cid));
    1366 info->pns_call_id = cid;
    1367 break;
    1368
    1369 @@ -441,7 +449,7 @@ pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1370 pcid = pptpReq->icack.peersCallID;
    1371 if (info->pac_call_id != pcid)
    1372 goto invalid;
    1373 - pr_debug("%s, CID=%X PCID=%X\n", pptp_msg_name[msg],
    1374 + pr_debug("%s, CID=%X PCID=%X\n", pptp_msg_name(msg),
    1375 ntohs(cid), ntohs(pcid));
    1376
    1377 if (pptpReq->icack.resultCode == PPTP_INCALL_ACCEPT) {
    1378 @@ -481,7 +489,7 @@ pptp_outbound_pkt(struct sk_buff *skb, unsigned int protoff,
    1379 invalid:
    1380 pr_debug("invalid %s: type=%d cid=%u pcid=%u "
    1381 "cstate=%d sstate=%d pns_cid=%u pac_cid=%u\n",
    1382 - msg <= PPTP_MSG_MAX ? pptp_msg_name[msg] : pptp_msg_name[0],
    1383 + pptp_msg_name(msg),
    1384 msg, ntohs(cid), ntohs(pcid), info->cstate, info->sstate,
    1385 ntohs(info->pns_call_id), ntohs(info->pac_call_id));
    1386 return NF_ACCEPT;
    1387 diff --git a/net/qrtr/qrtr.c b/net/qrtr/qrtr.c
    1388 index 41547c6e496a..a8253079902f 100644
    1389 --- a/net/qrtr/qrtr.c
    1390 +++ b/net/qrtr/qrtr.c
    1391 @@ -571,7 +571,7 @@ static int qrtr_bcast_enqueue(struct qrtr_node *node, struct sk_buff *skb)
    1392 }
    1393 mutex_unlock(&qrtr_node_lock);
    1394
    1395 - qrtr_local_enqueue(node, skb);
    1396 + qrtr_local_enqueue(NULL, skb);
    1397
    1398 return 0;
    1399 }
    1400 diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
    1401 index 1a3c75347f48..146b568962e0 100644
    1402 --- a/net/sctp/sm_statefuns.c
    1403 +++ b/net/sctp/sm_statefuns.c
    1404 @@ -1793,12 +1793,13 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
    1405 /* Update the content of current association. */
    1406 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
    1407 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
    1408 - if (sctp_state(asoc, SHUTDOWN_PENDING) &&
    1409 + if ((sctp_state(asoc, SHUTDOWN_PENDING) ||
    1410 + sctp_state(asoc, SHUTDOWN_SENT)) &&
    1411 (sctp_sstate(asoc->base.sk, CLOSING) ||
    1412 sock_flag(asoc->base.sk, SOCK_DEAD))) {
    1413 - /* if were currently in SHUTDOWN_PENDING, but the socket
    1414 - * has been closed by user, don't transition to ESTABLISHED.
    1415 - * Instead trigger SHUTDOWN bundled with COOKIE_ACK.
    1416 + /* If the socket has been closed by user, don't
    1417 + * transition to ESTABLISHED. Instead trigger SHUTDOWN
    1418 + * bundled with COOKIE_ACK.
    1419 */
    1420 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
    1421 return sctp_sf_do_9_2_start_shutdown(net, ep, asoc,
    1422 diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
    1423 index 6e3f0254d8a1..1e87639f2c27 100644
    1424 --- a/net/xfrm/xfrm_input.c
    1425 +++ b/net/xfrm/xfrm_input.c
    1426 @@ -302,7 +302,7 @@ resume:
    1427 dev_put(skb->dev);
    1428
    1429 spin_lock(&x->lock);
    1430 - if (nexthdr <= 0) {
    1431 + if (nexthdr < 0) {
    1432 if (nexthdr == -EBADMSG) {
    1433 xfrm_audit_state_icvfail(x, skb,
    1434 x->type->proto);
    1435 diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
    1436 index 637387bbaaea..2c4aa7b5ccd5 100644
    1437 --- a/net/xfrm/xfrm_output.c
    1438 +++ b/net/xfrm/xfrm_output.c
    1439 @@ -240,7 +240,8 @@ void xfrm_local_error(struct sk_buff *skb, int mtu)
    1440
    1441 if (skb->protocol == htons(ETH_P_IP))
    1442 proto = AF_INET;
    1443 - else if (skb->protocol == htons(ETH_P_IPV6))
    1444 + else if (skb->protocol == htons(ETH_P_IPV6) &&
    1445 + skb->sk->sk_family == AF_INET6)
    1446 proto = AF_INET6;
    1447 else
    1448 return;
    1449 diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
    1450 index 69d061d4ed4f..b00ed36b9aac 100644
    1451 --- a/net/xfrm/xfrm_policy.c
    1452 +++ b/net/xfrm/xfrm_policy.c
    1453 @@ -757,12 +757,7 @@ static void xfrm_policy_requeue(struct xfrm_policy *old,
    1454 static bool xfrm_policy_mark_match(struct xfrm_policy *policy,
    1455 struct xfrm_policy *pol)
    1456 {
    1457 - u32 mark = policy->mark.v & policy->mark.m;
    1458 -
    1459 - if (policy->mark.v == pol->mark.v && policy->mark.m == pol->mark.m)
    1460 - return true;
    1461 -
    1462 - if ((mark & pol->mark.m) == pol->mark.v &&
    1463 + if (policy->mark.v == pol->mark.v &&
    1464 policy->priority == pol->priority)
    1465 return true;
    1466
    1467 diff --git a/security/commoncap.c b/security/commoncap.c
    1468 index 8df676fbd393..b86aca8d6798 100644
    1469 --- a/security/commoncap.c
    1470 +++ b/security/commoncap.c
    1471 @@ -497,6 +497,7 @@ int cap_bprm_set_creds(struct linux_binprm *bprm)
    1472 int ret;
    1473 kuid_t root_uid;
    1474
    1475 + new->cap_ambient = old->cap_ambient;
    1476 if (WARN_ON(!cap_ambient_invariant_ok(old)))
    1477 return -EPERM;
    1478
    1479 diff --git a/sound/core/hwdep.c b/sound/core/hwdep.c
    1480 index 36d2416f90d9..96b737adf4d2 100644
    1481 --- a/sound/core/hwdep.c
    1482 +++ b/sound/core/hwdep.c
    1483 @@ -228,14 +228,14 @@ static int snd_hwdep_dsp_load(struct snd_hwdep *hw,
    1484 if (copy_from_user(&info, _info, sizeof(info)))
    1485 return -EFAULT;
    1486 /* check whether the dsp was already loaded */
    1487 - if (hw->dsp_loaded & (1 << info.index))
    1488 + if (hw->dsp_loaded & (1u << info.index))
    1489 return -EBUSY;
    1490 if (!access_ok(VERIFY_READ, info.image, info.length))
    1491 return -EFAULT;
    1492 err = hw->ops.dsp_load(hw, &info);
    1493 if (err < 0)
    1494 return err;
    1495 - hw->dsp_loaded |= (1 << info.index);
    1496 + hw->dsp_loaded |= (1u << info.index);
    1497 return 0;
    1498 }
    1499
    1500 diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
    1501 index e2f62362a0b0..024864ce3f76 100644
    1502 --- a/sound/usb/mixer.c
    1503 +++ b/sound/usb/mixer.c
    1504 @@ -980,6 +980,14 @@ static void volume_control_quirks(struct usb_mixer_elem_info *cval,
    1505 cval->res = 384;
    1506 }
    1507 break;
    1508 + case USB_ID(0x0495, 0x3042): /* ESS Technology Asus USB DAC */
    1509 + if ((strstr(kctl->id.name, "Playback Volume") != NULL) ||
    1510 + strstr(kctl->id.name, "Capture Volume") != NULL) {
    1511 + cval->min >>= 8;
    1512 + cval->max = 0;
    1513 + cval->res = 1;
    1514 + }
    1515 + break;
    1516 }
    1517 }
    1518