Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0191-5.4.92-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-5.4/0191-5.4.92-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3637 - (show annotations) (download)
    Mon Oct 24 12:40:44 2022 UTC (18 months ago) by niro
    File size: 25376 byte(s) 
    -add missing
    1 diff --git a/Makefile b/Makefile
    2 index a5edbd4f34145..5bae2206a35e7 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 5
    8 PATCHLEVEL = 4
    9 -SUBLEVEL = 91
    10 +SUBLEVEL = 92
    11 EXTRAVERSION =
    12 NAME = Kleptomaniac Octopus
    13
    14 diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
    15 index 6988bbf2576f5..9a77b70ad601b 100644
    16 --- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
    17 +++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
    18 @@ -4790,8 +4790,6 @@ static void mvpp2_phylink_validate(struct phylink_config *config,
    19
    20 phylink_set(mask, Autoneg);
    21 phylink_set_port_modes(mask);
    22 - phylink_set(mask, Pause);
    23 - phylink_set(mask, Asym_Pause);
    24
    25 switch (state->interface) {
    26 case PHY_INTERFACE_MODE_10GKR:
    27 diff --git a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
    28 index 71c90c8a9e943..c3fc1cc4bb2b9 100644
    29 --- a/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
    30 +++ b/drivers/net/ethernet/mellanox/mlxsw/core_thermal.c
    31 @@ -19,7 +19,7 @@
    32 #define MLXSW_THERMAL_ASIC_TEMP_NORM 75000 /* 75C */
    33 #define MLXSW_THERMAL_ASIC_TEMP_HIGH 85000 /* 85C */
    34 #define MLXSW_THERMAL_ASIC_TEMP_HOT 105000 /* 105C */
    35 -#define MLXSW_THERMAL_ASIC_TEMP_CRIT 110000 /* 110C */
    36 +#define MLXSW_THERMAL_ASIC_TEMP_CRIT 140000 /* 140C */
    37 #define MLXSW_THERMAL_HYSTERESIS_TEMP 5000 /* 5C */
    38 #define MLXSW_THERMAL_MODULE_TEMP_SHIFT (MLXSW_THERMAL_HYSTERESIS_TEMP * 2)
    39 #define MLXSW_THERMAL_ZONE_MAX_NAME 16
    40 @@ -177,6 +177,12 @@ mlxsw_thermal_module_trips_update(struct device *dev, struct mlxsw_core *core,
    41 if (err)
    42 return err;
    43
    44 + if (crit_temp > emerg_temp) {
    45 + dev_warn(dev, "%s : Critical threshold %d is above emergency threshold %d\n",
    46 + tz->tzdev->type, crit_temp, emerg_temp);
    47 + return 0;
    48 + }
    49 +
    50 /* According to the system thermal requirements, the thermal zones are
    51 * defined with four trip points. The critical and emergency
    52 * temperature thresholds, provided by QSFP module are set as "active"
    53 @@ -191,11 +197,8 @@ mlxsw_thermal_module_trips_update(struct device *dev, struct mlxsw_core *core,
    54 tz->trips[MLXSW_THERMAL_TEMP_TRIP_NORM].temp = crit_temp;
    55 tz->trips[MLXSW_THERMAL_TEMP_TRIP_HIGH].temp = crit_temp;
    56 tz->trips[MLXSW_THERMAL_TEMP_TRIP_HOT].temp = emerg_temp;
    57 - if (emerg_temp > crit_temp)
    58 - tz->trips[MLXSW_THERMAL_TEMP_TRIP_CRIT].temp = emerg_temp +
    59 + tz->trips[MLXSW_THERMAL_TEMP_TRIP_CRIT].temp = emerg_temp +
    60 MLXSW_THERMAL_MODULE_TEMP_SHIFT;
    61 - else
    62 - tz->trips[MLXSW_THERMAL_TEMP_TRIP_CRIT].temp = emerg_temp;
    63
    64 return 0;
    65 }
    66 diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
    67 index c692a41e45480..25b6f2ee2beb8 100644
    68 --- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
    69 +++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
    70 @@ -564,11 +564,6 @@ static const struct net_device_ops netxen_netdev_ops = {
    71 .ndo_set_features = netxen_set_features,
    72 };
    73
    74 -static inline bool netxen_function_zero(struct pci_dev *pdev)
    75 -{
    76 - return (PCI_FUNC(pdev->devfn) == 0) ? true : false;
    77 -}
    78 -
    79 static inline void netxen_set_interrupt_mode(struct netxen_adapter *adapter,
    80 u32 mode)
    81 {
    82 @@ -664,7 +659,7 @@ static int netxen_setup_intr(struct netxen_adapter *adapter)
    83 netxen_initialize_interrupt_registers(adapter);
    84 netxen_set_msix_bit(pdev, 0);
    85
    86 - if (netxen_function_zero(pdev)) {
    87 + if (adapter->portnum == 0) {
    88 if (!netxen_setup_msi_interrupts(adapter, num_msix))
    89 netxen_set_interrupt_mode(adapter, NETXEN_MSI_MODE);
    90 else
    91 diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    92 index 18c5a9bb6759c..ce5d3e9e5dff4 100644
    93 --- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    94 +++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
    95 @@ -3739,6 +3739,7 @@ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
    96 {
    97 struct stmmac_priv *priv = netdev_priv(dev);
    98 int txfifosz = priv->plat->tx_fifo_size;
    99 + const int mtu = new_mtu;
    100
    101 if (txfifosz == 0)
    102 txfifosz = priv->dma_cap.tx_fifo_size;
    103 @@ -3756,7 +3757,7 @@ static int stmmac_change_mtu(struct net_device *dev, int new_mtu)
    104 if ((txfifosz < new_mtu) || (new_mtu > BUF_SIZE_16KiB))
    105 return -EINVAL;
    106
    107 - dev->mtu = new_mtu;
    108 + dev->mtu = mtu;
    109
    110 netdev_update_features(dev);
    111
    112 diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
    113 index 6fa7a009a24a4..f9b359d4e2939 100644
    114 --- a/drivers/net/usb/rndis_host.c
    115 +++ b/drivers/net/usb/rndis_host.c
    116 @@ -387,7 +387,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
    117 reply_len = sizeof *phym;
    118 retval = rndis_query(dev, intf, u.buf,
    119 RNDIS_OID_GEN_PHYSICAL_MEDIUM,
    120 - 0, (void **) &phym, &reply_len);
    121 + reply_len, (void **)&phym, &reply_len);
    122 if (retval != 0 || !phym) {
    123 /* OID is optional so don't fail here. */
    124 phym_unspec = cpu_to_le32(RNDIS_PHYSICAL_MEDIUM_UNSPECIFIED);
    125 diff --git a/drivers/scsi/lpfc/lpfc_nportdisc.c b/drivers/scsi/lpfc/lpfc_nportdisc.c
    126 index 590a49e847626..418d62e945544 100644
    127 --- a/drivers/scsi/lpfc/lpfc_nportdisc.c
    128 +++ b/drivers/scsi/lpfc/lpfc_nportdisc.c
    129 @@ -286,7 +286,7 @@ lpfc_els_abort(struct lpfc_hba *phba, struct lpfc_nodelist *ndlp)
    130 * This routine is only called if we are SLI3, direct connect pt2pt
    131 * mode and the remote NPort issues the PLOGI after link up.
    132 */
    133 -void
    134 +static void
    135 lpfc_defer_pt2pt_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *link_mbox)
    136 {
    137 LPFC_MBOXQ_t *login_mbox;
    138 @@ -340,7 +340,7 @@ lpfc_defer_pt2pt_acc(struct lpfc_hba *phba, LPFC_MBOXQ_t *link_mbox)
    139 * This routine is only called if we are SLI4, acting in target
    140 * mode and the remote NPort issues the PLOGI after link up.
    141 **/
    142 -void
    143 +static void
    144 lpfc_defer_acc_rsp(struct lpfc_hba *phba, LPFC_MBOXQ_t *pmb)
    145 {
    146 struct lpfc_vport *vport = pmb->vport;
    147 diff --git a/drivers/spi/spi-cadence.c b/drivers/spi/spi-cadence.c
    148 index 82a0ee09cbe14..1d0c335b0bf88 100644
    149 --- a/drivers/spi/spi-cadence.c
    150 +++ b/drivers/spi/spi-cadence.c
    151 @@ -115,6 +115,7 @@ struct cdns_spi {
    152 void __iomem *regs;
    153 struct clk *ref_clk;
    154 struct clk *pclk;
    155 + unsigned int clk_rate;
    156 u32 speed_hz;
    157 const u8 *txbuf;
    158 u8 *rxbuf;
    159 @@ -250,7 +251,7 @@ static void cdns_spi_config_clock_freq(struct spi_device *spi,
    160 u32 ctrl_reg, baud_rate_val;
    161 unsigned long frequency;
    162
    163 - frequency = clk_get_rate(xspi->ref_clk);
    164 + frequency = xspi->clk_rate;
    165
    166 ctrl_reg = cdns_spi_read(xspi, CDNS_SPI_CR);
    167
    168 @@ -558,8 +559,9 @@ static int cdns_spi_probe(struct platform_device *pdev)
    169 master->auto_runtime_pm = true;
    170 master->mode_bits = SPI_CPOL | SPI_CPHA;
    171
    172 + xspi->clk_rate = clk_get_rate(xspi->ref_clk);
    173 /* Set to default valid value */
    174 - master->max_speed_hz = clk_get_rate(xspi->ref_clk) / 4;
    175 + master->max_speed_hz = xspi->clk_rate / 4;
    176 xspi->speed_hz = master->max_speed_hz;
    177
    178 master->bits_per_word_mask = SPI_BPW_MASK(8);
    179 diff --git a/drivers/spi/spi-npcm-fiu.c b/drivers/spi/spi-npcm-fiu.c
    180 index 5ed7c9e017fb1..1e770d6739050 100644
    181 --- a/drivers/spi/spi-npcm-fiu.c
    182 +++ b/drivers/spi/spi-npcm-fiu.c
    183 @@ -677,8 +677,7 @@ static int npcm_fiu_probe(struct platform_device *pdev)
    184 struct npcm_fiu_spi *fiu;
    185 void __iomem *regbase;
    186 struct resource *res;
    187 - int ret;
    188 - int id;
    189 + int id, ret;
    190
    191 ctrl = devm_spi_alloc_master(dev, sizeof(*fiu));
    192 if (!ctrl)
    193 @@ -738,9 +737,9 @@ static int npcm_fiu_probe(struct platform_device *pdev)
    194
    195 ret = devm_spi_register_master(dev, ctrl);
    196 if (ret)
    197 - return ret;
    198 + clk_disable_unprepare(fiu->clk);
    199
    200 - return 0;
    201 + return ret;
    202 }
    203
    204 static int npcm_fiu_remove(struct platform_device *pdev)
    205 diff --git a/drivers/usb/host/ohci-hcd.c b/drivers/usb/host/ohci-hcd.c
    206 index 5eb62240c7f87..833f51282accc 100644
    207 --- a/drivers/usb/host/ohci-hcd.c
    208 +++ b/drivers/usb/host/ohci-hcd.c
    209 @@ -102,7 +102,7 @@ static void io_watchdog_func(struct timer_list *t);
    210
    211
    212 /* Some boards misreport power switching/overcurrent */
    213 -static bool distrust_firmware = true;
    214 +static bool distrust_firmware;
    215 module_param (distrust_firmware, bool, 0);
    216 MODULE_PARM_DESC (distrust_firmware,
    217 "true to distrust firmware power/overcurrent setup");
    218 diff --git a/drivers/xen/privcmd.c b/drivers/xen/privcmd.c
    219 index c6070e70dd73d..9c9422e9fac4d 100644
    220 --- a/drivers/xen/privcmd.c
    221 +++ b/drivers/xen/privcmd.c
    222 @@ -724,14 +724,15 @@ static long privcmd_ioctl_restrict(struct file *file, void __user *udata)
    223 return 0;
    224 }
    225
    226 -static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
    227 +static long privcmd_ioctl_mmap_resource(struct file *file,
    228 + struct privcmd_mmap_resource __user *udata)
    229 {
    230 struct privcmd_data *data = file->private_data;
    231 struct mm_struct *mm = current->mm;
    232 struct vm_area_struct *vma;
    233 struct privcmd_mmap_resource kdata;
    234 xen_pfn_t *pfns = NULL;
    235 - struct xen_mem_acquire_resource xdata;
    236 + struct xen_mem_acquire_resource xdata = { };
    237 int rc;
    238
    239 if (copy_from_user(&kdata, udata, sizeof(kdata)))
    240 @@ -741,6 +742,22 @@ static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
    241 if (data->domid != DOMID_INVALID && data->domid != kdata.dom)
    242 return -EPERM;
    243
    244 + /* Both fields must be set or unset */
    245 + if (!!kdata.addr != !!kdata.num)
    246 + return -EINVAL;
    247 +
    248 + xdata.domid = kdata.dom;
    249 + xdata.type = kdata.type;
    250 + xdata.id = kdata.id;
    251 +
    252 + if (!kdata.addr && !kdata.num) {
    253 + /* Query the size of the resource. */
    254 + rc = HYPERVISOR_memory_op(XENMEM_acquire_resource, &xdata);
    255 + if (rc)
    256 + return rc;
    257 + return __put_user(xdata.nr_frames, &udata->num);
    258 + }
    259 +
    260 down_write(&mm->mmap_sem);
    261
    262 vma = find_vma(mm, kdata.addr);
    263 @@ -775,10 +792,6 @@ static long privcmd_ioctl_mmap_resource(struct file *file, void __user *udata)
    264 } else
    265 vma->vm_private_data = PRIV_VMA_LOCKED;
    266
    267 - memset(&xdata, 0, sizeof(xdata));
    268 - xdata.domid = kdata.dom;
    269 - xdata.type = kdata.type;
    270 - xdata.id = kdata.id;
    271 xdata.frame = kdata.idx;
    272 xdata.nr_frames = kdata.num;
    273 set_xen_guest_handle(xdata.frame_list, pfns);
    274 diff --git a/fs/nfsd/nfs3xdr.c b/fs/nfsd/nfs3xdr.c
    275 index 86e5658651f10..8f077e66e613f 100644
    276 --- a/fs/nfsd/nfs3xdr.c
    277 +++ b/fs/nfsd/nfs3xdr.c
    278 @@ -857,9 +857,14 @@ compose_entry_fh(struct nfsd3_readdirres *cd, struct svc_fh *fhp,
    279 if (isdotent(name, namlen)) {
    280 if (namlen == 2) {
    281 dchild = dget_parent(dparent);
    282 - /* filesystem root - cannot return filehandle for ".." */
    283 + /*
    284 + * Don't return filehandle for ".." if we're at
    285 + * the filesystem or export root:
    286 + */
    287 if (dchild == dparent)
    288 goto out;
    289 + if (dparent == exp->ex_path.dentry)
    290 + goto out;
    291 } else
    292 dchild = dget(dparent);
    293 } else
    294 diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
    295 index d8fab3ecf5120..180b52419136f 100644
    296 --- a/include/linux/compiler-gcc.h
    297 +++ b/include/linux/compiler-gcc.h
    298 @@ -12,6 +12,12 @@
    299
    300 #if GCC_VERSION < 40600
    301 # error Sorry, your compiler is too old - please upgrade it.
    302 +#elif defined(CONFIG_ARM64) && GCC_VERSION < 50100
    303 +/*
    304 + * https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63293
    305 + * https://lore.kernel.org/r/20210107111841.GN1551@shell.armlinux.org.uk
    306 + */
    307 +# error Sorry, your version of GCC is too old - please use 5.1 or newer.
    308 #endif
    309
    310 /*
    311 diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
    312 index 4cad0e784b286..b81f9e1d74b0a 100644
    313 --- a/include/linux/elfcore.h
    314 +++ b/include/linux/elfcore.h
    315 @@ -58,6 +58,7 @@ static inline int elf_core_copy_task_xfpregs(struct task_struct *t, elf_fpxregse
    316 }
    317 #endif
    318
    319 +#if defined(CONFIG_UM) || defined(CONFIG_IA64)
    320 /*
    321 * These functions parameterize elf_core_dump in fs/binfmt_elf.c to write out
    322 * extra segments containing the gate DSO contents. Dumping its
    323 @@ -72,5 +73,26 @@ elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset);
    324 extern int
    325 elf_core_write_extra_data(struct coredump_params *cprm);
    326 extern size_t elf_core_extra_data_size(void);
    327 +#else
    328 +static inline Elf_Half elf_core_extra_phdrs(void)
    329 +{
    330 + return 0;
    331 +}
    332 +
    333 +static inline int elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
    334 +{
    335 + return 1;
    336 +}
    337 +
    338 +static inline int elf_core_write_extra_data(struct coredump_params *cprm)
    339 +{
    340 + return 1;
    341 +}
    342 +
    343 +static inline size_t elf_core_extra_data_size(void)
    344 +{
    345 + return 0;
    346 +}
    347 +#endif
    348
    349 #endif /* _LINUX_ELFCORE_H */
    350 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
    351 index 68139cc2f3ca3..6493c98c86317 100644
    352 --- a/include/linux/skbuff.h
    353 +++ b/include/linux/skbuff.h
    354 @@ -1480,6 +1480,11 @@ static inline void skb_mark_not_on_list(struct sk_buff *skb)
    355 skb->next = NULL;
    356 }
    357
    358 +/* Iterate through singly-linked GSO fragments of an skb. */
    359 +#define skb_list_walk_safe(first, skb, next_skb) \
    360 + for ((skb) = (first), (next_skb) = (skb) ? (skb)->next : NULL; (skb); \
    361 + (skb) = (next_skb), (next_skb) = (skb) ? (skb)->next : NULL)
    362 +
    363 static inline void skb_list_del_init(struct sk_buff *skb)
    364 {
    365 __list_del_entry(&skb->list);
    366 diff --git a/kernel/Makefile b/kernel/Makefile
    367 index f2cc0d118a0bc..6aef13053a5c4 100644
    368 --- a/kernel/Makefile
    369 +++ b/kernel/Makefile
    370 @@ -93,7 +93,6 @@ obj-$(CONFIG_TASK_DELAY_ACCT) += delayacct.o
    371 obj-$(CONFIG_TASKSTATS) += taskstats.o tsacct.o
    372 obj-$(CONFIG_TRACEPOINTS) += tracepoint.o
    373 obj-$(CONFIG_LATENCYTOP) += latencytop.o
    374 -obj-$(CONFIG_ELFCORE) += elfcore.o
    375 obj-$(CONFIG_FUNCTION_TRACER) += trace/
    376 obj-$(CONFIG_TRACING) += trace/
    377 obj-$(CONFIG_TRACE_CLOCK) += trace/
    378 diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
    379 index b701af27a7799..5a8b4dfdb1419 100644
    380 --- a/kernel/bpf/cgroup.c
    381 +++ b/kernel/bpf/cgroup.c
    382 @@ -1057,12 +1057,13 @@ int __cgroup_bpf_run_filter_setsockopt(struct sock *sk, int *level,
    383 if (ctx.optlen != 0) {
    384 *optlen = ctx.optlen;
    385 *kernel_optval = ctx.optval;
    386 + /* export and don't free sockopt buf */
    387 + return 0;
    388 }
    389 }
    390
    391 out:
    392 - if (ret)
    393 - sockopt_free_buf(&ctx);
    394 + sockopt_free_buf(&ctx);
    395 return ret;
    396 }
    397 EXPORT_SYMBOL(__cgroup_bpf_run_filter_setsockopt);
    398 diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
    399 index 5e28718928cad..a77d2814cac5d 100644
    400 --- a/kernel/bpf/helpers.c
    401 +++ b/kernel/bpf/helpers.c
    402 @@ -105,7 +105,7 @@ BPF_CALL_2(bpf_map_peek_elem, struct bpf_map *, map, void *, value)
    403 }
    404
    405 const struct bpf_func_proto bpf_map_peek_elem_proto = {
    406 - .func = bpf_map_pop_elem,
    407 + .func = bpf_map_peek_elem,
    408 .gpl_only = false,
    409 .ret_type = RET_INTEGER,
    410 .arg1_type = ARG_CONST_MAP_PTR,
    411 diff --git a/kernel/elfcore.c b/kernel/elfcore.c
    412 deleted file mode 100644
    413 index 57fb4dcff4349..0000000000000
    414 --- a/kernel/elfcore.c
    415 +++ /dev/null
    416 @@ -1,26 +0,0 @@
    417 -// SPDX-License-Identifier: GPL-2.0
    418 -#include <linux/elf.h>
    419 -#include <linux/fs.h>
    420 -#include <linux/mm.h>
    421 -#include <linux/binfmts.h>
    422 -#include <linux/elfcore.h>
    423 -
    424 -Elf_Half __weak elf_core_extra_phdrs(void)
    425 -{
    426 - return 0;
    427 -}
    428 -
    429 -int __weak elf_core_write_extra_phdrs(struct coredump_params *cprm, loff_t offset)
    430 -{
    431 - return 1;
    432 -}
    433 -
    434 -int __weak elf_core_write_extra_data(struct coredump_params *cprm)
    435 -{
    436 - return 1;
    437 -}
    438 -
    439 -size_t __weak elf_core_extra_data_size(void)
    440 -{
    441 - return 0;
    442 -}
    443 diff --git a/net/core/filter.c b/net/core/filter.c
    444 index b040b7bf28582..2fa10fdcf6b1d 100644
    445 --- a/net/core/filter.c
    446 +++ b/net/core/filter.c
    447 @@ -1475,7 +1475,7 @@ struct bpf_prog *__get_filter(struct sock_fprog *fprog, struct sock *sk)
    448
    449 if (copy_from_user(prog->insns, fprog->filter, fsize)) {
    450 __bpf_prog_free(prog);
    451 - return ERR_PTR(-EFAULT);
    452 + return ERR_PTR(-EINVAL);
    453 }
    454
    455 prog->len = fprog->len;
    456 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    457 index 49d923c227a21..961cb5a88c958 100644
    458 --- a/net/core/skbuff.c
    459 +++ b/net/core/skbuff.c
    460 @@ -496,13 +496,17 @@ EXPORT_SYMBOL(__netdev_alloc_skb);
    461 struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
    462 gfp_t gfp_mask)
    463 {
    464 - struct napi_alloc_cache *nc = this_cpu_ptr(&napi_alloc_cache);
    465 + struct napi_alloc_cache *nc;
    466 struct sk_buff *skb;
    467 void *data;
    468
    469 len += NET_SKB_PAD + NET_IP_ALIGN;
    470
    471 - if ((len > SKB_WITH_OVERHEAD(PAGE_SIZE)) ||
    472 + /* If requested length is either too small or too big,
    473 + * we use kmalloc() for skb->head allocation.
    474 + */
    475 + if (len <= SKB_WITH_OVERHEAD(1024) ||
    476 + len > SKB_WITH_OVERHEAD(PAGE_SIZE) ||
    477 (gfp_mask & (__GFP_DIRECT_RECLAIM | GFP_DMA))) {
    478 skb = __alloc_skb(len, gfp_mask, SKB_ALLOC_RX, NUMA_NO_NODE);
    479 if (!skb)
    480 @@ -510,6 +514,7 @@ struct sk_buff *__napi_alloc_skb(struct napi_struct *napi, unsigned int len,
    481 goto skb_success;
    482 }
    483
    484 + nc = this_cpu_ptr(&napi_alloc_cache);
    485 len += SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
    486 len = SKB_DATA_ALIGN(len);
    487
    488 diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c
    489 index 40829111fe00c..273c921751e49 100644
    490 --- a/net/core/sock_reuseport.c
    491 +++ b/net/core/sock_reuseport.c
    492 @@ -302,7 +302,7 @@ select_by_hash:
    493 i = j = reciprocal_scale(hash, socks);
    494 while (reuse->socks[i]->sk_state == TCP_ESTABLISHED) {
    495 i++;
    496 - if (i >= reuse->num_socks)
    497 + if (i >= socks)
    498 i = 0;
    499 if (i == j)
    500 goto out;
    501 diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
    502 index 0fd1c2aa13615..e9ecbb57df455 100644
    503 --- a/net/dcb/dcbnl.c
    504 +++ b/net/dcb/dcbnl.c
    505 @@ -1765,6 +1765,8 @@ static int dcb_doit(struct sk_buff *skb, struct nlmsghdr *nlh,
    506 fn = &reply_funcs[dcb->cmd];
    507 if (!fn->cb)
    508 return -EOPNOTSUPP;
    509 + if (fn->type == RTM_SETDCB && !netlink_capable(skb, CAP_NET_ADMIN))
    510 + return -EPERM;
    511
    512 if (!tb[DCB_ATTR_IFNAME])
    513 return -EINVAL;
    514 diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
    515 index 5c967764041f4..00210e55b4cd1 100644
    516 --- a/net/ipv4/esp4.c
    517 +++ b/net/ipv4/esp4.c
    518 @@ -272,7 +272,6 @@ static int esp_output_udp_encap(struct xfrm_state *x, struct sk_buff *skb, struc
    519 int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp)
    520 {
    521 u8 *tail;
    522 - u8 *vaddr;
    523 int nfrags;
    524 int esph_offset;
    525 struct page *page;
    526 @@ -314,14 +313,10 @@ int esp_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *
    527 page = pfrag->page;
    528 get_page(page);
    529
    530 - vaddr = kmap_atomic(page);
    531 -
    532 - tail = vaddr + pfrag->offset;
    533 + tail = page_address(page) + pfrag->offset;
    534
    535 esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
    536
    537 - kunmap_atomic(vaddr);
    538 -
    539 nfrags = skb_shinfo(skb)->nr_frags;
    540
    541 __skb_fill_page_desc(skb, nfrags, page, pfrag->offset,
    542 diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
    543 index a3b403ba8f8f0..7a739f16d82b2 100644
    544 --- a/net/ipv6/esp6.c
    545 +++ b/net/ipv6/esp6.c
    546 @@ -226,7 +226,6 @@ static void esp_output_fill_trailer(u8 *tail, int tfclen, int plen, __u8 proto)
    547 int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info *esp)
    548 {
    549 u8 *tail;
    550 - u8 *vaddr;
    551 int nfrags;
    552 struct page *page;
    553 struct sk_buff *trailer;
    554 @@ -259,14 +258,10 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
    555 page = pfrag->page;
    556 get_page(page);
    557
    558 - vaddr = kmap_atomic(page);
    559 -
    560 - tail = vaddr + pfrag->offset;
    561 + tail = page_address(page) + pfrag->offset;
    562
    563 esp_output_fill_trailer(tail, esp->tfclen, esp->plen, esp->proto);
    564
    565 - kunmap_atomic(vaddr);
    566 -
    567 nfrags = skb_shinfo(skb)->nr_frags;
    568
    569 __skb_fill_page_desc(skb, nfrags, page, pfrag->offset,
    570 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    571 index 78d495581d696..7a80c42fcce2f 100644
    572 --- a/net/ipv6/ip6_output.c
    573 +++ b/net/ipv6/ip6_output.c
    574 @@ -124,8 +124,43 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
    575 return -EINVAL;
    576 }
    577
    578 +static int
    579 +ip6_finish_output_gso_slowpath_drop(struct net *net, struct sock *sk,
    580 + struct sk_buff *skb, unsigned int mtu)
    581 +{
    582 + struct sk_buff *segs, *nskb;
    583 + netdev_features_t features;
    584 + int ret = 0;
    585 +
    586 + /* Please see corresponding comment in ip_finish_output_gso
    587 + * describing the cases where GSO segment length exceeds the
    588 + * egress MTU.
    589 + */
    590 + features = netif_skb_features(skb);
    591 + segs = skb_gso_segment(skb, features & ~NETIF_F_GSO_MASK);
    592 + if (IS_ERR_OR_NULL(segs)) {
    593 + kfree_skb(skb);
    594 + return -ENOMEM;
    595 + }
    596 +
    597 + consume_skb(skb);
    598 +
    599 + skb_list_walk_safe(segs, segs, nskb) {
    600 + int err;
    601 +
    602 + skb_mark_not_on_list(segs);
    603 + err = ip6_fragment(net, sk, segs, ip6_finish_output2);
    604 + if (err && ret == 0)
    605 + ret = err;
    606 + }
    607 +
    608 + return ret;
    609 +}
    610 +
    611 static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff *skb)
    612 {
    613 + unsigned int mtu;
    614 +
    615 #if defined(CONFIG_NETFILTER) && defined(CONFIG_XFRM)
    616 /* Policy lookup after SNAT yielded a new policy */
    617 if (skb_dst(skb)->xfrm) {
    618 @@ -134,7 +169,11 @@ static int __ip6_finish_output(struct net *net, struct sock *sk, struct sk_buff
    619 }
    620 #endif
    621
    622 - if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
    623 + mtu = ip6_skb_dst_mtu(skb);
    624 + if (skb_is_gso(skb) && !skb_gso_validate_network_len(skb, mtu))
    625 + return ip6_finish_output_gso_slowpath_drop(net, sk, skb, mtu);
    626 +
    627 + if ((skb->len > mtu && !skb_is_gso(skb)) ||
    628 dst_allfrag(skb_dst(skb)) ||
    629 (IP6CB(skb)->frag_max_size && skb->len > IP6CB(skb)->frag_max_size))
    630 return ip6_fragment(net, sk, skb, ip6_finish_output2);
    631 diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    632 index 2872f7a00e863..de4c871787e2f 100644
    633 --- a/net/ipv6/sit.c
    634 +++ b/net/ipv6/sit.c
    635 @@ -1597,8 +1597,11 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
    636 }
    637
    638 #ifdef CONFIG_IPV6_SIT_6RD
    639 - if (ipip6_netlink_6rd_parms(data, &ip6rd))
    640 + if (ipip6_netlink_6rd_parms(data, &ip6rd)) {
    641 err = ipip6_tunnel_update_6rd(nt, &ip6rd);
    642 + if (err < 0)
    643 + unregister_netdevice_queue(dev, NULL);
    644 + }
    645 #endif
    646
    647 return err;
    648 diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
    649 index 30a0c7c6224b3..da0e285302f9d 100644
    650 --- a/net/mac80211/tx.c
    651 +++ b/net/mac80211/tx.c
    652 @@ -657,7 +657,7 @@ ieee80211_tx_h_select_key(struct ieee80211_tx_data *tx)
    653 if (!skip_hw && tx->key &&
    654 tx->key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)
    655 info->control.hw_key = &tx->key->conf;
    656 - } else if (!ieee80211_is_mgmt(hdr->frame_control) && tx->sta &&
    657 + } else if (ieee80211_is_data_present(hdr->frame_control) && tx->sta &&
    658 test_sta_flag(tx->sta, WLAN_STA_USES_ENCRYPTION)) {
    659 return TX_DROP;
    660 }
    661 @@ -3773,7 +3773,7 @@ void __ieee80211_schedule_txq(struct ieee80211_hw *hw,
    662 * get immediately moved to the back of the list on the next
    663 * call to ieee80211_next_txq().
    664 */
    665 - if (txqi->txq.sta &&
    666 + if (txqi->txq.sta && local->airtime_flags &&
    667 wiphy_ext_feature_isset(local->hw.wiphy,
    668 NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
    669 list_add(&txqi->schedule_order,
    670 diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
    671 index 6cace43b217ee..916d1f455b218 100644
    672 --- a/net/rxrpc/input.c
    673 +++ b/net/rxrpc/input.c
    674 @@ -431,7 +431,7 @@ static void rxrpc_input_data(struct rxrpc_call *call, struct sk_buff *skb)
    675 return;
    676 }
    677
    678 - if (call->state == RXRPC_CALL_SERVER_RECV_REQUEST) {
    679 + if (state == RXRPC_CALL_SERVER_RECV_REQUEST) {
    680 unsigned long timo = READ_ONCE(call->next_req_timo);
    681 unsigned long now, expect_req_by;
    682
    683 diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
    684 index 85a9ff8cd236a..2b26c4d229a5a 100644
    685 --- a/net/rxrpc/key.c
    686 +++ b/net/rxrpc/key.c
    687 @@ -1110,7 +1110,7 @@ static long rxrpc_read(const struct key *key,
    688 default: /* we have a ticket we can't encode */
    689 pr_err("Unsupported key token type (%u)\n",
    690 token->security_index);
    691 - continue;
    692 + return -ENOPKG;
    693 }
    694
    695 _debug("token[%u]: toksize=%u", ntoks, toksize);
    696 @@ -1225,7 +1225,9 @@ static long rxrpc_read(const struct key *key,
    697 break;
    698
    699 default:
    700 - break;
    701 + pr_err("Unsupported key token type (%u)\n",
    702 + token->security_index);
    703 + return -ENOPKG;
    704 }
    705
    706 ASSERTCMP((unsigned long)xdr - (unsigned long)oldxdr, ==,
    707 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
    708 index 1fcc13f6073ef..41abfff6a6a3d 100644
    709 --- a/net/sctp/socket.c
    710 +++ b/net/sctp/socket.c
    711 @@ -1319,7 +1319,7 @@ static int __sctp_setsockopt_connectx(struct sock *sk,
    712
    713 kaddrs = memdup_user(addrs, addrs_size);
    714 if (IS_ERR(kaddrs))
    715 - return PTR_ERR(kaddrs);
    716 + return PTR_ERR(kaddrs) == -EFAULT ? -EINVAL : PTR_ERR(kaddrs);
    717
    718 /* Allow security module to validate connectx addresses. */
    719 err = security_sctp_bind_connect(sk, SCTP_SOCKOPT_CONNECTX,
    720 diff --git a/net/tipc/link.c b/net/tipc/link.c
    721 index a9d8a81e80cfd..f25010261a9e0 100644
    722 --- a/net/tipc/link.c
    723 +++ b/net/tipc/link.c
    724 @@ -939,9 +939,7 @@ void tipc_link_reset(struct tipc_link *l)
    725 int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
    726 struct sk_buff_head *xmitq)
    727 {
    728 - struct tipc_msg *hdr = buf_msg(skb_peek(list));
    729 unsigned int maxwin = l->window;
    730 - int imp = msg_importance(hdr);
    731 unsigned int mtu = l->mtu;
    732 u16 ack = l->rcv_nxt - 1;
    733 u16 seqno = l->snd_nxt;
    734 @@ -950,8 +948,14 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
    735 struct sk_buff_head *backlogq = &l->backlogq;
    736 struct sk_buff *skb, *_skb, **tskb;
    737 int pkt_cnt = skb_queue_len(list);
    738 + struct tipc_msg *hdr;
    739 int rc = 0;
    740 + int imp;
    741 +
    742 + if (pkt_cnt <= 0)
    743 + return 0;
    744
    745 + hdr = buf_msg(skb_peek(list));
    746 if (unlikely(msg_size(hdr) > mtu)) {
    747 pr_warn("Too large msg, purging xmit list %d %d %d %d %d!\n",
    748 skb_queue_len(list), msg_user(hdr),
    749 @@ -960,6 +964,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
    750 return -EMSGSIZE;
    751 }
    752
    753 + imp = msg_importance(hdr);
    754 /* Allow oversubscription of one data msg per source at congestion */
    755 if (unlikely(l->backlog[imp].len >= l->backlog[imp].limit)) {
    756 if (imp == TIPC_SYSTEM_IMPORTANCE) {