Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0256-5.4.157-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-5.4/0256-5.4.157-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (hide annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (19 months, 1 week ago) by niro
    File size: 54691 byte(s) 
    -sync kernel patches
    1 niro 3635 diff --git a/Makefile b/Makefile
    2     index ced1f0fd48dc6..49d639fe5a801 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,7 +1,7 @@
    6     # SPDX-License-Identifier: GPL-2.0
    7     VERSION = 5
    8     PATCHLEVEL = 4
    9     -SUBLEVEL = 156
    10     +SUBLEVEL = 157
    11     EXTRAVERSION =
    12     NAME = Kleptomaniac Octopus
    13    
    14     diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c
    15     index aa075d8372ea2..74255e8198314 100644
    16     --- a/arch/arm/boot/compressed/decompress.c
    17     +++ b/arch/arm/boot/compressed/decompress.c
    18     @@ -47,7 +47,10 @@ extern char * strchrnul(const char *, int);
    19     #endif
    20    
    21     #ifdef CONFIG_KERNEL_XZ
    22     +/* Prevent KASAN override of string helpers in decompressor */
    23     +#undef memmove
    24     #define memmove memmove
    25     +#undef memcpy
    26     #define memcpy memcpy
    27     #include "../../../../lib/decompress_unxz.c"
    28     #endif
    29     diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
    30     index 8c74037ade229..b1f366df620b0 100644
    31     --- a/arch/arm/kernel/vmlinux-xip.lds.S
    32     +++ b/arch/arm/kernel/vmlinux-xip.lds.S
    33     @@ -180,7 +180,7 @@ ASSERT(__hyp_idmap_text_end - (__hyp_idmap_text_start & PAGE_MASK) <= PAGE_SIZE,
    34     ASSERT((_end - __bss_start) >= 12288, ".bss too small for CONFIG_XIP_DEFLATED_DATA")
    35     #endif
    36    
    37     -#ifdef CONFIG_ARM_MPU
    38     +#if defined(CONFIG_ARM_MPU) && !defined(CONFIG_COMPILE_TEST)
    39     /*
    40     * Due to PMSAv7 restriction on base address and size we have to
    41     * enforce minimal alignment restrictions. It was seen that weaker
    42     diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
    43     index 60ac7c5999a98..86e54447dc916 100644
    44     --- a/arch/arm/mm/proc-macros.S
    45     +++ b/arch/arm/mm/proc-macros.S
    46     @@ -342,6 +342,7 @@ ENTRY(\name\()_cache_fns)
    47    
    48     .macro define_tlb_functions name:req, flags_up:req, flags_smp
    49     .type \name\()_tlb_fns, #object
    50     + .align 2
    51     ENTRY(\name\()_tlb_fns)
    52     .long \name\()_flush_user_tlb_range
    53     .long \name\()_flush_kern_tlb_range
    54     diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
    55     index 90b5bc723c83f..0a783bd4641c5 100644
    56     --- a/arch/arm/probes/kprobes/core.c
    57     +++ b/arch/arm/probes/kprobes/core.c
    58     @@ -534,7 +534,7 @@ static struct undef_hook kprobes_arm_break_hook = {
    59    
    60     #endif /* !CONFIG_THUMB2_KERNEL */
    61    
    62     -int __init arch_init_kprobes()
    63     +int __init arch_init_kprobes(void)
    64     {
    65     arm_probes_decode_init();
    66     #ifdef CONFIG_THUMB2_KERNEL
    67     diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
    68     index 57a6f45036c1f..d7177465b0968 100644
    69     --- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
    70     +++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
    71     @@ -114,7 +114,7 @@
    72     pinctrl-0 = <&emac_rgmii_pins>;
    73     phy-supply = <&reg_gmac_3v3>;
    74     phy-handle = <&ext_rgmii_phy>;
    75     - phy-mode = "rgmii";
    76     + phy-mode = "rgmii-id";
    77     status = "okay";
    78     };
    79    
    80     diff --git a/arch/nios2/platform/Kconfig.platform b/arch/nios2/platform/Kconfig.platform
    81     index 9e32fb7f3d4ce..e849daff6fd16 100644
    82     --- a/arch/nios2/platform/Kconfig.platform
    83     +++ b/arch/nios2/platform/Kconfig.platform
    84     @@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR
    85    
    86     config NIOS2_DTB_SOURCE_BOOL
    87     bool "Compile and link device tree into kernel image"
    88     + depends on !COMPILE_TEST
    89     help
    90     This allows you to specify a dts (device tree source) file
    91     which will be compiled and linked into the kernel image.
    92     diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
    93     index 20bfd753bcba6..81e6279c9874f 100644
    94     --- a/arch/powerpc/net/bpf_jit_comp64.c
    95     +++ b/arch/powerpc/net/bpf_jit_comp64.c
    96     @@ -408,8 +408,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
    97     case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */
    98     if (imm == 0)
    99     return -EINVAL;
    100     - else if (imm == 1)
    101     - goto bpf_alu32_trunc;
    102     + if (imm == 1) {
    103     + if (BPF_OP(code) == BPF_DIV) {
    104     + goto bpf_alu32_trunc;
    105     + } else {
    106     + PPC_LI(dst_reg, 0);
    107     + break;
    108     + }
    109     + }
    110    
    111     PPC_LI32(b2p[TMP_REG_1], imm);
    112     switch (BPF_CLASS(code)) {
    113     diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
    114     index fa9483aa4f575..fd73a8aa89d23 100644
    115     --- a/arch/s390/kvm/interrupt.c
    116     +++ b/arch/s390/kvm/interrupt.c
    117     @@ -2987,13 +2987,14 @@ static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask)
    118     int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus);
    119     struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
    120     struct kvm_vcpu *vcpu;
    121     + u8 vcpu_isc_mask;
    122    
    123     for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) {
    124     vcpu = kvm_get_vcpu(kvm, vcpu_idx);
    125     if (psw_ioint_disabled(vcpu))
    126     continue;
    127     - deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
    128     - if (deliverable_mask) {
    129     + vcpu_isc_mask = (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
    130     + if (deliverable_mask & vcpu_isc_mask) {
    131     /* lately kicked but not yet running */
    132     if (test_and_set_bit(vcpu_idx, gi->kicked_mask))
    133     return;
    134     diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
    135     index 9ed2fee612297..b286818d8d54d 100644
    136     --- a/arch/s390/kvm/kvm-s390.c
    137     +++ b/arch/s390/kvm/kvm-s390.c
    138     @@ -3092,6 +3092,7 @@ out:
    139    
    140     int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
    141     {
    142     + clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.gisa_int.kicked_mask);
    143     return kvm_s390_vcpu_has_irq(vcpu, 0);
    144     }
    145    
    146     diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
    147     index d1ed9679c7177..3fca3e13ed6ae 100644
    148     --- a/drivers/ata/sata_mv.c
    149     +++ b/drivers/ata/sata_mv.c
    150     @@ -3892,8 +3892,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
    151     break;
    152    
    153     default:
    154     - dev_err(host->dev, "BUG: invalid board index %u\n", board_idx);
    155     - return 1;
    156     + dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx);
    157     + return -EINVAL;
    158     }
    159    
    160     hpriv->hp_flags = hp_flags;
    161     diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
    162     index cfa29dc89bbff..fabf87058d80b 100644
    163     --- a/drivers/base/regmap/regcache-rbtree.c
    164     +++ b/drivers/base/regmap/regcache-rbtree.c
    165     @@ -281,14 +281,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
    166     if (!blk)
    167     return -ENOMEM;
    168    
    169     + rbnode->block = blk;
    170     +
    171     if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
    172     present = krealloc(rbnode->cache_present,
    173     BITS_TO_LONGS(blklen) * sizeof(*present),
    174     GFP_KERNEL);
    175     - if (!present) {
    176     - kfree(blk);
    177     + if (!present)
    178     return -ENOMEM;
    179     - }
    180    
    181     memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
    182     (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
    183     @@ -305,7 +305,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
    184     }
    185    
    186     /* update the rbnode block, its size and the base register */
    187     - rbnode->block = blk;
    188     rbnode->blklen = blklen;
    189     rbnode->base_reg = base_reg;
    190     rbnode->cache_present = present;
    191     diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
    192     index fe81c565e7ef8..a7b88ca8b97b3 100644
    193     --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
    194     +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
    195     @@ -463,6 +463,7 @@ static void ttm_transfered_destroy(struct ttm_buffer_object *bo)
    196     struct ttm_transfer_obj *fbo;
    197    
    198     fbo = container_of(bo, struct ttm_transfer_obj, base);
    199     + dma_resv_fini(&fbo->base.base._resv);
    200     ttm_bo_put(fbo->bo);
    201     kfree(fbo);
    202     }
    203     diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
    204     index d2d70c89193ff..11ab6390eda4d 100644
    205     --- a/drivers/infiniband/core/sa_query.c
    206     +++ b/drivers/infiniband/core/sa_query.c
    207     @@ -760,8 +760,9 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb,
    208    
    209     /* Construct the family header first */
    210     header = skb_put(skb, NLMSG_ALIGN(sizeof(*header)));
    211     - memcpy(header->device_name, dev_name(&query->port->agent->device->dev),
    212     - LS_DEVICE_NAME_MAX);
    213     + strscpy_pad(header->device_name,
    214     + dev_name(&query->port->agent->device->dev),
    215     + LS_DEVICE_NAME_MAX);
    216     header->port_num = query->port->port_num;
    217    
    218     if ((comp_mask & IB_SA_PATH_REC_REVERSIBLE) &&
    219     diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
    220     index 79126b2b14ab0..1a82ea73a0fc2 100644
    221     --- a/drivers/infiniband/hw/hfi1/pio.c
    222     +++ b/drivers/infiniband/hw/hfi1/pio.c
    223     @@ -920,6 +920,7 @@ void sc_disable(struct send_context *sc)
    224     {
    225     u64 reg;
    226     struct pio_buf *pbuf;
    227     + LIST_HEAD(wake_list);
    228    
    229     if (!sc)
    230     return;
    231     @@ -954,19 +955,21 @@ void sc_disable(struct send_context *sc)
    232     spin_unlock(&sc->release_lock);
    233    
    234     write_seqlock(&sc->waitlock);
    235     - while (!list_empty(&sc->piowait)) {
    236     + if (!list_empty(&sc->piowait))
    237     + list_move(&sc->piowait, &wake_list);
    238     + write_sequnlock(&sc->waitlock);
    239     + while (!list_empty(&wake_list)) {
    240     struct iowait *wait;
    241     struct rvt_qp *qp;
    242     struct hfi1_qp_priv *priv;
    243    
    244     - wait = list_first_entry(&sc->piowait, struct iowait, list);
    245     + wait = list_first_entry(&wake_list, struct iowait, list);
    246     qp = iowait_to_qp(wait);
    247     priv = qp->priv;
    248     list_del_init(&priv->s_iowait.list);
    249     priv->s_iowait.lock = NULL;
    250     hfi1_qp_wakeup(qp, RVT_S_WAIT_PIO | HFI1_S_WAIT_PIO_DRAIN);
    251     }
    252     - write_sequnlock(&sc->waitlock);
    253    
    254     spin_unlock_irq(&sc->alloc_lock);
    255     }
    256     diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
    257     index 4540835e05bda..634f29cb7395c 100644
    258     --- a/drivers/infiniband/hw/mlx5/qp.c
    259     +++ b/drivers/infiniband/hw/mlx5/qp.c
    260     @@ -3865,6 +3865,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
    261     MLX5_SET(dctc, dctc, mtu, attr->path_mtu);
    262     MLX5_SET(dctc, dctc, my_addr_index, attr->ah_attr.grh.sgid_index);
    263     MLX5_SET(dctc, dctc, hop_limit, attr->ah_attr.grh.hop_limit);
    264     + if (attr->ah_attr.type == RDMA_AH_ATTR_TYPE_ROCE)
    265     + MLX5_SET(dctc, dctc, eth_prio, attr->ah_attr.sl & 0x7);
    266    
    267     err = mlx5_core_create_dct(dev->mdev, &qp->dct.mdct, qp->dct.in,
    268     MLX5_ST_SZ_BYTES(create_dct_in), out,
    269     diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
    270     index 05190edc2611e..5fd28574124fb 100644
    271     --- a/drivers/infiniband/hw/qib/qib_user_sdma.c
    272     +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
    273     @@ -602,7 +602,7 @@ done:
    274     /*
    275     * How many pages in this iovec element?
    276     */
    277     -static int qib_user_sdma_num_pages(const struct iovec *iov)
    278     +static size_t qib_user_sdma_num_pages(const struct iovec *iov)
    279     {
    280     const unsigned long addr = (unsigned long) iov->iov_base;
    281     const unsigned long len = iov->iov_len;
    282     @@ -658,7 +658,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev,
    283     static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,
    284     struct qib_user_sdma_queue *pq,
    285     struct qib_user_sdma_pkt *pkt,
    286     - unsigned long addr, int tlen, int npages)
    287     + unsigned long addr, int tlen, size_t npages)
    288     {
    289     struct page *pages[8];
    290     int i, j;
    291     @@ -722,7 +722,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd,
    292     unsigned long idx;
    293    
    294     for (idx = 0; idx < niov; idx++) {
    295     - const int npages = qib_user_sdma_num_pages(iov + idx);
    296     + const size_t npages = qib_user_sdma_num_pages(iov + idx);
    297     const unsigned long addr = (unsigned long) iov[idx].iov_base;
    298    
    299     ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr,
    300     @@ -824,8 +824,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    301     unsigned pktnw;
    302     unsigned pktnwc;
    303     int nfrags = 0;
    304     - int npages = 0;
    305     - int bytes_togo = 0;
    306     + size_t npages = 0;
    307     + size_t bytes_togo = 0;
    308     int tiddma = 0;
    309     int cfur;
    310    
    311     @@ -885,7 +885,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    312    
    313     npages += qib_user_sdma_num_pages(&iov[idx]);
    314    
    315     - bytes_togo += slen;
    316     + if (check_add_overflow(bytes_togo, slen, &bytes_togo) ||
    317     + bytes_togo > type_max(typeof(pkt->bytes_togo))) {
    318     + ret = -EINVAL;
    319     + goto free_pbc;
    320     + }
    321     pktnwc += slen >> 2;
    322     idx++;
    323     nfrags++;
    324     @@ -904,8 +908,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    325     }
    326    
    327     if (frag_size) {
    328     - int tidsmsize, n;
    329     - size_t pktsize;
    330     + size_t tidsmsize, n, pktsize, sz, addrlimit;
    331    
    332     n = npages*((2*PAGE_SIZE/frag_size)+1);
    333     pktsize = struct_size(pkt, addr, n);
    334     @@ -923,14 +926,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    335     else
    336     tidsmsize = 0;
    337    
    338     - pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL);
    339     + if (check_add_overflow(pktsize, tidsmsize, &sz)) {
    340     + ret = -EINVAL;
    341     + goto free_pbc;
    342     + }
    343     + pkt = kmalloc(sz, GFP_KERNEL);
    344     if (!pkt) {
    345     ret = -ENOMEM;
    346     goto free_pbc;
    347     }
    348     pkt->largepkt = 1;
    349     pkt->frag_size = frag_size;
    350     - pkt->addrlimit = n + ARRAY_SIZE(pkt->addr);
    351     + if (check_add_overflow(n, ARRAY_SIZE(pkt->addr),
    352     + &addrlimit) ||
    353     + addrlimit > type_max(typeof(pkt->addrlimit))) {
    354     + ret = -EINVAL;
    355     + goto free_pbc;
    356     + }
    357     + pkt->addrlimit = addrlimit;
    358    
    359     if (tiddma) {
    360     char *tidsm = (char *)pkt + pktsize;
    361     diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
    362     index 2d65b32d205a5..ec56464eaf23e 100644
    363     --- a/drivers/mmc/host/cqhci.c
    364     +++ b/drivers/mmc/host/cqhci.c
    365     @@ -273,6 +273,9 @@ static void __cqhci_enable(struct cqhci_host *cq_host)
    366    
    367     cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
    368    
    369     + if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT)
    370     + cqhci_writel(cq_host, 0, CQHCI_CTL);
    371     +
    372     mmc->cqe_on = true;
    373    
    374     if (cq_host->ops->enable)
    375     diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
    376     index 5e3d95b636769..ae2c74186e1d2 100644
    377     --- a/drivers/mmc/host/dw_mmc-exynos.c
    378     +++ b/drivers/mmc/host/dw_mmc-exynos.c
    379     @@ -462,6 +462,18 @@ static s8 dw_mci_exynos_get_best_clksmpl(u8 candiates)
    380     }
    381     }
    382    
    383     + /*
    384     + * If there is no cadiates value, then it needs to return -EIO.
    385     + * If there are candiates values and don't find bset clk sample value,
    386     + * then use a first candiates clock sample value.
    387     + */
    388     + for (i = 0; i < iter; i++) {
    389     + __c = ror8(candiates, i);
    390     + if ((__c & 0x1) == 0x1) {
    391     + loc = i;
    392     + goto out;
    393     + }
    394     + }
    395     out:
    396     return loc;
    397     }
    398     @@ -492,6 +504,8 @@ static int dw_mci_exynos_execute_tuning(struct dw_mci_slot *slot, u32 opcode)
    399     priv->tuned_sample = found;
    400     } else {
    401     ret = -EIO;
    402     + dev_warn(&mmc->class_dev,
    403     + "There is no candiates value about clksmpl!\n");
    404     }
    405    
    406     return ret;
    407     diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
    408     index 771676209005b..2c01e2ebef7aa 100644
    409     --- a/drivers/mmc/host/sdhci-esdhc-imx.c
    410     +++ b/drivers/mmc/host/sdhci-esdhc-imx.c
    411     @@ -24,6 +24,7 @@
    412     #include <linux/pinctrl/consumer.h>
    413     #include <linux/platform_data/mmc-esdhc-imx.h>
    414     #include <linux/pm_runtime.h>
    415     +#include <linux/iopoll.h>
    416     #include "sdhci-pltfm.h"
    417     #include "sdhci-esdhc.h"
    418     #include "cqhci.h"
    419     @@ -1022,6 +1023,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
    420     struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
    421     struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
    422     u32 ctrl;
    423     + int ret;
    424    
    425     /* Reset the tuning circuit */
    426     if (esdhc_is_usdhc(imx_data)) {
    427     @@ -1034,7 +1036,22 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
    428     } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
    429     ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
    430     ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
    431     + ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE;
    432     writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
    433     + /* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */
    434     + ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS,
    435     + ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50);
    436     + if (ret == -ETIMEDOUT)
    437     + dev_warn(mmc_dev(host->mmc),
    438     + "Warning! clear execute tuning bit failed\n");
    439     + /*
    440     + * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the
    441     + * usdhc IP internal logic flag execute_tuning_with_clr_buf, which
    442     + * will finally make sure the normal data transfer logic correct.
    443     + */
    444     + ctrl = readl(host->ioaddr + SDHCI_INT_STATUS);
    445     + ctrl |= SDHCI_INT_DATA_AVAIL;
    446     + writel(ctrl, host->ioaddr + SDHCI_INT_STATUS);
    447     }
    448     }
    449     }
    450     diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
    451     index 2ecd9acebb2f0..cb54fa2120d72 100644
    452     --- a/drivers/mmc/host/sdhci.c
    453     +++ b/drivers/mmc/host/sdhci.c
    454     @@ -1741,6 +1741,12 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode,
    455     break;
    456     case MMC_VDD_32_33:
    457     case MMC_VDD_33_34:
    458     + /*
    459     + * 3.4 ~ 3.6V are valid only for those platforms where it's
    460     + * known that the voltage range is supported by hardware.
    461     + */
    462     + case MMC_VDD_34_35:
    463     + case MMC_VDD_35_36:
    464     pwr = SDHCI_POWER_330;
    465     break;
    466     default:
    467     diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
    468     index 156046e56a584..5e1d7025dbf78 100644
    469     --- a/drivers/mmc/host/vub300.c
    470     +++ b/drivers/mmc/host/vub300.c
    471     @@ -576,7 +576,7 @@ static void check_vub300_port_status(struct vub300_mmc_host *vub300)
    472     GET_SYSTEM_PORT_STATUS,
    473     USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    474     0x0000, 0x0000, &vub300->system_port_status,
    475     - sizeof(vub300->system_port_status), HZ);
    476     + sizeof(vub300->system_port_status), 1000);
    477     if (sizeof(vub300->system_port_status) == retval)
    478     new_system_port_status(vub300);
    479     }
    480     @@ -1241,7 +1241,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
    481     SET_INTERRUPT_PSEUDOCODE,
    482     USB_DIR_OUT | USB_TYPE_VENDOR |
    483     USB_RECIP_DEVICE, 0x0000, 0x0000,
    484     - xfer_buffer, xfer_length, HZ);
    485     + xfer_buffer, xfer_length, 1000);
    486     kfree(xfer_buffer);
    487     if (retval < 0)
    488     goto copy_error_message;
    489     @@ -1284,7 +1284,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
    490     SET_TRANSFER_PSEUDOCODE,
    491     USB_DIR_OUT | USB_TYPE_VENDOR |
    492     USB_RECIP_DEVICE, 0x0000, 0x0000,
    493     - xfer_buffer, xfer_length, HZ);
    494     + xfer_buffer, xfer_length, 1000);
    495     kfree(xfer_buffer);
    496     if (retval < 0)
    497     goto copy_error_message;
    498     @@ -1991,7 +1991,7 @@ static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
    499     usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
    500     SET_CLOCK_SPEED,
    501     USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    502     - 0x00, 0x00, buf, buf_array_size, HZ);
    503     + 0x00, 0x00, buf, buf_array_size, 1000);
    504     if (retval != 8) {
    505     dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
    506     " %dkHz failed with retval=%d\n", kHzClock, retval);
    507     @@ -2013,14 +2013,14 @@ static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
    508     usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
    509     SET_SD_POWER,
    510     USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    511     - 0x0000, 0x0000, NULL, 0, HZ);
    512     + 0x0000, 0x0000, NULL, 0, 1000);
    513     /* must wait for the VUB300 u-proc to boot up */
    514     msleep(600);
    515     } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
    516     usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
    517     SET_SD_POWER,
    518     USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    519     - 0x0001, 0x0000, NULL, 0, HZ);
    520     + 0x0001, 0x0000, NULL, 0, 1000);
    521     msleep(600);
    522     vub300->card_powered = 1;
    523     } else if (ios->power_mode == MMC_POWER_ON) {
    524     @@ -2282,14 +2282,14 @@ static int vub300_probe(struct usb_interface *interface,
    525     GET_HC_INF0,
    526     USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    527     0x0000, 0x0000, &vub300->hc_info,
    528     - sizeof(vub300->hc_info), HZ);
    529     + sizeof(vub300->hc_info), 1000);
    530     if (retval < 0)
    531     goto error5;
    532     retval =
    533     usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
    534     SET_ROM_WAIT_STATES,
    535     USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    536     - firmware_rom_wait_states, 0x0000, NULL, 0, HZ);
    537     + firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
    538     if (retval < 0)
    539     goto error5;
    540     dev_info(&vub300->udev->dev,
    541     @@ -2304,7 +2304,7 @@ static int vub300_probe(struct usb_interface *interface,
    542     GET_SYSTEM_PORT_STATUS,
    543     USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    544     0x0000, 0x0000, &vub300->system_port_status,
    545     - sizeof(vub300->system_port_status), HZ);
    546     + sizeof(vub300->system_port_status), 1000);
    547     if (retval < 0) {
    548     goto error4;
    549     } else if (sizeof(vub300->system_port_status) == retval) {
    550     diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
    551     index 1949f631e1bc5..a7eaf80f500c0 100644
    552     --- a/drivers/net/bonding/bond_main.c
    553     +++ b/drivers/net/bonding/bond_main.c
    554     @@ -1219,7 +1219,7 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
    555     skb->dev = bond->dev;
    556    
    557     if (BOND_MODE(bond) == BOND_MODE_ALB &&
    558     - bond->dev->priv_flags & IFF_BRIDGE_PORT &&
    559     + netif_is_bridge_port(bond->dev) &&
    560     skb->pkt_type == PACKET_HOST) {
    561    
    562     if (unlikely(skb_cow_head(skb,
    563     diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
    564     index 7dc451fdaf35e..2431723bc2fb4 100644
    565     --- a/drivers/net/ethernet/micrel/ksz884x.c
    566     +++ b/drivers/net/ethernet/micrel/ksz884x.c
    567     @@ -5693,7 +5693,7 @@ static void dev_set_promiscuous(struct net_device *dev, struct dev_priv *priv,
    568     * from the bridge.
    569     */
    570     if ((hw->features & STP_SUPPORT) && !promiscuous &&
    571     - (dev->priv_flags & IFF_BRIDGE_PORT)) {
    572     + netif_is_bridge_port(dev)) {
    573     struct ksz_switch *sw = hw->ksz_switch;
    574     int port = priv->port.first_port;
    575    
    576     diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
    577     index dfa0ded169ee9..a109120da0e7c 100644
    578     --- a/drivers/net/ethernet/microchip/lan743x_main.c
    579     +++ b/drivers/net/ethernet/microchip/lan743x_main.c
    580     @@ -1706,6 +1706,16 @@ static int lan743x_tx_ring_init(struct lan743x_tx *tx)
    581     ret = -EINVAL;
    582     goto cleanup;
    583     }
    584     + if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
    585     + DMA_BIT_MASK(64))) {
    586     + if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
    587     + DMA_BIT_MASK(32))) {
    588     + dev_warn(&tx->adapter->pdev->dev,
    589     + "lan743x_: No suitable DMA available\n");
    590     + ret = -ENOMEM;
    591     + goto cleanup;
    592     + }
    593     + }
    594     ring_allocation_size = ALIGN(tx->ring_size *
    595     sizeof(struct lan743x_tx_descriptor),
    596     PAGE_SIZE);
    597     @@ -2256,6 +2266,16 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx)
    598     ret = -EINVAL;
    599     goto cleanup;
    600     }
    601     + if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
    602     + DMA_BIT_MASK(64))) {
    603     + if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
    604     + DMA_BIT_MASK(32))) {
    605     + dev_warn(&rx->adapter->pdev->dev,
    606     + "lan743x_: No suitable DMA available\n");
    607     + ret = -ENOMEM;
    608     + goto cleanup;
    609     + }
    610     + }
    611     ring_allocation_size = ALIGN(rx->ring_size *
    612     sizeof(struct lan743x_rx_descriptor),
    613     PAGE_SIZE);
    614     @@ -3001,6 +3021,8 @@ static int lan743x_pm_resume(struct device *dev)
    615     if (ret) {
    616     netif_err(adapter, probe, adapter->netdev,
    617     "lan743x_hardware_init returned %d\n", ret);
    618     + lan743x_pci_cleanup(adapter);
    619     + return ret;
    620     }
    621    
    622     /* open netdev when netdev is at running state while resume.
    623     diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
    624     index 1d59ef367a85c..3b177421651f1 100644
    625     --- a/drivers/net/ethernet/nxp/lpc_eth.c
    626     +++ b/drivers/net/ethernet/nxp/lpc_eth.c
    627     @@ -1007,9 +1007,6 @@ static int lpc_eth_close(struct net_device *ndev)
    628     napi_disable(&pldat->napi);
    629     netif_stop_queue(ndev);
    630    
    631     - if (ndev->phydev)
    632     - phy_stop(ndev->phydev);
    633     -
    634     spin_lock_irqsave(&pldat->lock, flags);
    635     __lpc_eth_reset(pldat);
    636     netif_carrier_off(ndev);
    637     @@ -1017,6 +1014,8 @@ static int lpc_eth_close(struct net_device *ndev)
    638     writel(0, LPC_ENET_MAC2(pldat->net_base));
    639     spin_unlock_irqrestore(&pldat->lock, flags);
    640    
    641     + if (ndev->phydev)
    642     + phy_stop(ndev->phydev);
    643     clk_disable_unprepare(pldat->clk);
    644    
    645     return 0;
    646     diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
    647     index 8377ff229a303..bec73f0640d03 100644
    648     --- a/drivers/net/phy/mdio_bus.c
    649     +++ b/drivers/net/phy/mdio_bus.c
    650     @@ -395,7 +395,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
    651     err = device_register(&bus->dev);
    652     if (err) {
    653     pr_err("mii_bus %s failed to register\n", bus->id);
    654     - put_device(&bus->dev);
    655     return -EINVAL;
    656     }
    657    
    658     diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
    659     index b0b8a3ce82b68..6c52ff8c0d2eb 100644
    660     --- a/drivers/net/phy/phy.c
    661     +++ b/drivers/net/phy/phy.c
    662     @@ -367,6 +367,7 @@ EXPORT_SYMBOL(phy_ethtool_ksettings_set);
    663     void phy_ethtool_ksettings_get(struct phy_device *phydev,
    664     struct ethtool_link_ksettings *cmd)
    665     {
    666     + mutex_lock(&phydev->lock);
    667     linkmode_copy(cmd->link_modes.supported, phydev->supported);
    668     linkmode_copy(cmd->link_modes.advertising, phydev->advertising);
    669     linkmode_copy(cmd->link_modes.lp_advertising, phydev->lp_advertising);
    670     @@ -383,6 +384,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev,
    671     cmd->base.autoneg = phydev->autoneg;
    672     cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl;
    673     cmd->base.eth_tp_mdix = phydev->mdix;
    674     + mutex_unlock(&phydev->lock);
    675     }
    676     EXPORT_SYMBOL(phy_ethtool_ksettings_get);
    677    
    678     @@ -553,7 +555,7 @@ static int phy_check_link_status(struct phy_device *phydev)
    679     }
    680    
    681     /**
    682     - * phy_start_aneg - start auto-negotiation for this PHY device
    683     + * _phy_start_aneg - start auto-negotiation for this PHY device
    684     * @phydev: the phy_device struct
    685     *
    686     * Description: Sanitizes the settings (if we're not autonegotiating
    687     @@ -561,25 +563,43 @@ static int phy_check_link_status(struct phy_device *phydev)
    688     * If the PHYCONTROL Layer is operating, we change the state to
    689     * reflect the beginning of Auto-negotiation or forcing.
    690     */
    691     -int phy_start_aneg(struct phy_device *phydev)
    692     +static int _phy_start_aneg(struct phy_device *phydev)
    693     {
    694     int err;
    695    
    696     + lockdep_assert_held(&phydev->lock);
    697     +
    698     if (!phydev->drv)
    699     return -EIO;
    700    
    701     - mutex_lock(&phydev->lock);
    702     -
    703     if (AUTONEG_DISABLE == phydev->autoneg)
    704     phy_sanitize_settings(phydev);
    705    
    706     err = phy_config_aneg(phydev);
    707     if (err < 0)
    708     - goto out_unlock;
    709     + return err;
    710    
    711     if (phy_is_started(phydev))
    712     err = phy_check_link_status(phydev);
    713     -out_unlock:
    714     +
    715     + return err;
    716     +}
    717     +
    718     +/**
    719     + * phy_start_aneg - start auto-negotiation for this PHY device
    720     + * @phydev: the phy_device struct
    721     + *
    722     + * Description: Sanitizes the settings (if we're not autonegotiating
    723     + * them), and then calls the driver's config_aneg function.
    724     + * If the PHYCONTROL Layer is operating, we change the state to
    725     + * reflect the beginning of Auto-negotiation or forcing.
    726     + */
    727     +int phy_start_aneg(struct phy_device *phydev)
    728     +{
    729     + int err;
    730     +
    731     + mutex_lock(&phydev->lock);
    732     + err = _phy_start_aneg(phydev);
    733     mutex_unlock(&phydev->lock);
    734    
    735     return err;
    736     diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
    737     index 92d9d3407b79b..fe830b72c3b0f 100644
    738     --- a/drivers/net/usb/lan78xx.c
    739     +++ b/drivers/net/usb/lan78xx.c
    740     @@ -3753,6 +3753,12 @@ static int lan78xx_probe(struct usb_interface *intf,
    741    
    742     dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1);
    743    
    744     + /* Reject broken descriptors. */
    745     + if (dev->maxpacket == 0) {
    746     + ret = -ENODEV;
    747     + goto out4;
    748     + }
    749     +
    750     /* driver requires remote-wakeup capability during autosuspend. */
    751     intf->needs_remote_wakeup = 1;
    752    
    753     diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
    754     index dde05e2fdc3e6..b8b9df82f51ef 100644
    755     --- a/drivers/net/usb/usbnet.c
    756     +++ b/drivers/net/usb/usbnet.c
    757     @@ -1773,6 +1773,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
    758     if (!dev->rx_urb_size)
    759     dev->rx_urb_size = dev->hard_mtu;
    760     dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
    761     + if (dev->maxpacket == 0) {
    762     + /* that is a broken device */
    763     + status = -ENODEV;
    764     + goto out4;
    765     + }
    766    
    767     /* let userspace know we have a random address */
    768     if (ether_addr_equal(net->dev_addr, node_id))
    769     diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
    770     index 8e4d355dc3aec..1caebefb25ff1 100644
    771     --- a/drivers/nfc/port100.c
    772     +++ b/drivers/nfc/port100.c
    773     @@ -1003,11 +1003,11 @@ static u64 port100_get_command_type_mask(struct port100 *dev)
    774    
    775     skb = port100_alloc_skb(dev, 0);
    776     if (!skb)
    777     - return -ENOMEM;
    778     + return 0;
    779    
    780     resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb);
    781     if (IS_ERR(resp))
    782     - return PTR_ERR(resp);
    783     + return 0;
    784    
    785     if (resp->len < 8)
    786     mask = 0;
    787     diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
    788     index 38bbbbbc6f47f..ff0d06e8ebb53 100644
    789     --- a/drivers/nvme/host/tcp.c
    790     +++ b/drivers/nvme/host/tcp.c
    791     @@ -962,7 +962,7 @@ static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req)
    792     int ret;
    793     struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_EOR };
    794     struct kvec iov = {
    795     - .iov_base = &req->ddgst + req->offset,
    796     + .iov_base = (u8 *)&req->ddgst + req->offset,
    797     .iov_len = NVME_TCP_DIGEST_LENGTH - req->offset
    798     };
    799    
    800     diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
    801     index 2ae846297d7ca..2f4e512bd449f 100644
    802     --- a/drivers/nvme/target/tcp.c
    803     +++ b/drivers/nvme/target/tcp.c
    804     @@ -633,7 +633,7 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd)
    805     struct nvmet_tcp_queue *queue = cmd->queue;
    806     struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
    807     struct kvec iov = {
    808     - .iov_base = &cmd->exp_ddgst + cmd->offset,
    809     + .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset,
    810     .iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset
    811     };
    812     int ret;
    813     diff --git a/drivers/pinctrl/bcm/pinctrl-ns.c b/drivers/pinctrl/bcm/pinctrl-ns.c
    814     index e79690bd8b85f..d7f8175d2c1c8 100644
    815     --- a/drivers/pinctrl/bcm/pinctrl-ns.c
    816     +++ b/drivers/pinctrl/bcm/pinctrl-ns.c
    817     @@ -5,7 +5,6 @@
    818    
    819     #include <linux/err.h>
    820     #include <linux/io.h>
    821     -#include <linux/mfd/syscon.h>
    822     #include <linux/module.h>
    823     #include <linux/of.h>
    824     #include <linux/of_device.h>
    825     @@ -13,7 +12,6 @@
    826     #include <linux/pinctrl/pinctrl.h>
    827     #include <linux/pinctrl/pinmux.h>
    828     #include <linux/platform_device.h>
    829     -#include <linux/regmap.h>
    830     #include <linux/slab.h>
    831    
    832     #define FLAG_BCM4708 BIT(1)
    833     @@ -24,8 +22,7 @@ struct ns_pinctrl {
    834     struct device *dev;
    835     unsigned int chipset_flag;
    836     struct pinctrl_dev *pctldev;
    837     - struct regmap *regmap;
    838     - u32 offset;
    839     + void __iomem *base;
    840    
    841     struct pinctrl_desc pctldesc;
    842     struct ns_pinctrl_group *groups;
    843     @@ -232,9 +229,9 @@ static int ns_pinctrl_set_mux(struct pinctrl_dev *pctrl_dev,
    844     unset |= BIT(pin_number);
    845     }
    846    
    847     - regmap_read(ns_pinctrl->regmap, ns_pinctrl->offset, &tmp);
    848     + tmp = readl(ns_pinctrl->base);
    849     tmp &= ~unset;
    850     - regmap_write(ns_pinctrl->regmap, ns_pinctrl->offset, tmp);
    851     + writel(tmp, ns_pinctrl->base);
    852    
    853     return 0;
    854     }
    855     @@ -266,13 +263,13 @@ static const struct of_device_id ns_pinctrl_of_match_table[] = {
    856     static int ns_pinctrl_probe(struct platform_device *pdev)
    857     {
    858     struct device *dev = &pdev->dev;
    859     - struct device_node *np = dev->of_node;
    860     const struct of_device_id *of_id;
    861     struct ns_pinctrl *ns_pinctrl;
    862     struct pinctrl_desc *pctldesc;
    863     struct pinctrl_pin_desc *pin;
    864     struct ns_pinctrl_group *group;
    865     struct ns_pinctrl_function *function;
    866     + struct resource *res;
    867     int i;
    868    
    869     ns_pinctrl = devm_kzalloc(dev, sizeof(*ns_pinctrl), GFP_KERNEL);
    870     @@ -290,18 +287,12 @@ static int ns_pinctrl_probe(struct platform_device *pdev)
    871     return -EINVAL;
    872     ns_pinctrl->chipset_flag = (uintptr_t)of_id->data;
    873    
    874     - ns_pinctrl->regmap = syscon_node_to_regmap(of_get_parent(np));
    875     - if (IS_ERR(ns_pinctrl->regmap)) {
    876     - int err = PTR_ERR(ns_pinctrl->regmap);
    877     -
    878     - dev_err(dev, "Failed to map pinctrl regs: %d\n", err);
    879     -
    880     - return err;
    881     - }
    882     -
    883     - if (of_property_read_u32(np, "offset", &ns_pinctrl->offset)) {
    884     - dev_err(dev, "Failed to get register offset\n");
    885     - return -ENOENT;
    886     + res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
    887     + "cru_gpio_control");
    888     + ns_pinctrl->base = devm_ioremap_resource(dev, res);
    889     + if (IS_ERR(ns_pinctrl->base)) {
    890     + dev_err(dev, "Failed to map pinctrl regs\n");
    891     + return PTR_ERR(ns_pinctrl->base);
    892     }
    893    
    894     memcpy(pctldesc, &ns_pinctrl_desc, sizeof(*pctldesc));
    895     diff --git a/include/net/tls.h b/include/net/tls.h
    896     index 697df45c0bcee..7f220e03ebb2d 100644
    897     --- a/include/net/tls.h
    898     +++ b/include/net/tls.h
    899     @@ -360,6 +360,7 @@ int tls_sk_query(struct sock *sk, int optname, char __user *optval,
    900     int __user *optlen);
    901     int tls_sk_attach(struct sock *sk, int optname, char __user *optval,
    902     unsigned int optlen);
    903     +void tls_err_abort(struct sock *sk, int err);
    904    
    905     int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx);
    906     void tls_sw_strparser_arm(struct sock *sk, struct tls_context *ctx);
    907     @@ -465,12 +466,6 @@ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk)
    908     #endif
    909     }
    910    
    911     -static inline void tls_err_abort(struct sock *sk, int err)
    912     -{
    913     - sk->sk_err = err;
    914     - sk->sk_error_report(sk);
    915     -}
    916     -
    917     static inline bool tls_bigint_increment(unsigned char *seq, int len)
    918     {
    919     int i;
    920     @@ -499,7 +494,7 @@ static inline void tls_advance_record_sn(struct sock *sk,
    921     struct cipher_context *ctx)
    922     {
    923     if (tls_bigint_increment(ctx->rec_seq, prot->rec_seq_size))
    924     - tls_err_abort(sk, EBADMSG);
    925     + tls_err_abort(sk, -EBADMSG);
    926    
    927     if (prot->version != TLS_1_3_VERSION)
    928     tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
    929     diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
    930     index a6b26ca5c6973..2e818eca3e1c6 100644
    931     --- a/net/batman-adv/bridge_loop_avoidance.c
    932     +++ b/net/batman-adv/bridge_loop_avoidance.c
    933     @@ -1561,10 +1561,14 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
    934     return 0;
    935    
    936     bat_priv->bla.claim_hash = batadv_hash_new(128);
    937     - bat_priv->bla.backbone_hash = batadv_hash_new(32);
    938     + if (!bat_priv->bla.claim_hash)
    939     + return -ENOMEM;
    940    
    941     - if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash)
    942     + bat_priv->bla.backbone_hash = batadv_hash_new(32);
    943     + if (!bat_priv->bla.backbone_hash) {
    944     + batadv_hash_destroy(bat_priv->bla.claim_hash);
    945     return -ENOMEM;
    946     + }
    947    
    948     batadv_hash_set_lock_class(bat_priv->bla.claim_hash,
    949     &batadv_claim_hash_lock_class_key);
    950     diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
    951     index 4a89177def647..6a183c94cdeb4 100644
    952     --- a/net/batman-adv/main.c
    953     +++ b/net/batman-adv/main.c
    954     @@ -197,29 +197,41 @@ int batadv_mesh_init(struct net_device *soft_iface)
    955    
    956     bat_priv->gw.generation = 0;
    957    
    958     - ret = batadv_v_mesh_init(bat_priv);
    959     - if (ret < 0)
    960     - goto err;
    961     -
    962     ret = batadv_originator_init(bat_priv);
    963     - if (ret < 0)
    964     - goto err;
    965     + if (ret < 0) {
    966     + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    967     + goto err_orig;
    968     + }
    969    
    970     ret = batadv_tt_init(bat_priv);
    971     - if (ret < 0)
    972     - goto err;
    973     + if (ret < 0) {
    974     + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    975     + goto err_tt;
    976     + }
    977     +
    978     + ret = batadv_v_mesh_init(bat_priv);
    979     + if (ret < 0) {
    980     + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    981     + goto err_v;
    982     + }
    983    
    984     ret = batadv_bla_init(bat_priv);
    985     - if (ret < 0)
    986     - goto err;
    987     + if (ret < 0) {
    988     + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    989     + goto err_bla;
    990     + }
    991    
    992     ret = batadv_dat_init(bat_priv);
    993     - if (ret < 0)
    994     - goto err;
    995     + if (ret < 0) {
    996     + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    997     + goto err_dat;
    998     + }
    999    
    1000     ret = batadv_nc_mesh_init(bat_priv);
    1001     - if (ret < 0)
    1002     - goto err;
    1003     + if (ret < 0) {
    1004     + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    1005     + goto err_nc;
    1006     + }
    1007    
    1008     batadv_gw_init(bat_priv);
    1009     batadv_mcast_init(bat_priv);
    1010     @@ -229,8 +241,20 @@ int batadv_mesh_init(struct net_device *soft_iface)
    1011    
    1012     return 0;
    1013    
    1014     -err:
    1015     - batadv_mesh_free(soft_iface);
    1016     +err_nc:
    1017     + batadv_dat_free(bat_priv);
    1018     +err_dat:
    1019     + batadv_bla_free(bat_priv);
    1020     +err_bla:
    1021     + batadv_v_mesh_free(bat_priv);
    1022     +err_v:
    1023     + batadv_tt_free(bat_priv);
    1024     +err_tt:
    1025     + batadv_originator_free(bat_priv);
    1026     +err_orig:
    1027     + batadv_purge_outstanding_packets(bat_priv, NULL);
    1028     + atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
    1029     +
    1030     return ret;
    1031     }
    1032    
    1033     diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
    1034     index 70e3b161c6635..850f927f33de2 100644
    1035     --- a/net/batman-adv/network-coding.c
    1036     +++ b/net/batman-adv/network-coding.c
    1037     @@ -155,8 +155,10 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
    1038     &batadv_nc_coding_hash_lock_class_key);
    1039    
    1040     bat_priv->nc.decoding_hash = batadv_hash_new(128);
    1041     - if (!bat_priv->nc.decoding_hash)
    1042     + if (!bat_priv->nc.decoding_hash) {
    1043     + batadv_hash_destroy(bat_priv->nc.coding_hash);
    1044     goto err;
    1045     + }
    1046    
    1047     batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
    1048     &batadv_nc_decoding_hash_lock_class_key);
    1049     diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
    1050     index c5271ea4dc832..515205d7b650f 100644
    1051     --- a/net/batman-adv/translation-table.c
    1052     +++ b/net/batman-adv/translation-table.c
    1053     @@ -4405,8 +4405,10 @@ int batadv_tt_init(struct batadv_priv *bat_priv)
    1054     return ret;
    1055    
    1056     ret = batadv_tt_global_init(bat_priv);
    1057     - if (ret < 0)
    1058     + if (ret < 0) {
    1059     + batadv_tt_local_table_free(bat_priv);
    1060     return ret;
    1061     + }
    1062    
    1063     batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1,
    1064     batadv_tt_tvlv_unicast_handler_v1,
    1065     diff --git a/net/core/dev.c b/net/core/dev.c
    1066     index 3810eaf89b266..e4e492bf72af0 100644
    1067     --- a/net/core/dev.c
    1068     +++ b/net/core/dev.c
    1069     @@ -2787,6 +2787,12 @@ static u16 skb_tx_hash(const struct net_device *dev,
    1070    
    1071     qoffset = sb_dev->tc_to_txq[tc].offset;
    1072     qcount = sb_dev->tc_to_txq[tc].count;
    1073     + if (unlikely(!qcount)) {
    1074     + net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n",
    1075     + sb_dev->name, qoffset, tc);
    1076     + qoffset = 0;
    1077     + qcount = dev->real_num_tx_queues;
    1078     + }
    1079     }
    1080    
    1081     if (skb_rx_queue_recorded(skb)) {
    1082     diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    1083     index a53b101ce41ae..55c0f32b9375b 100644
    1084     --- a/net/core/rtnetlink.c
    1085     +++ b/net/core/rtnetlink.c
    1086     @@ -3729,7 +3729,7 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh,
    1087    
    1088     /* Support fdb on master device the net/bridge default case */
    1089     if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) &&
    1090     - (dev->priv_flags & IFF_BRIDGE_PORT)) {
    1091     + netif_is_bridge_port(dev)) {
    1092     struct net_device *br_dev = netdev_master_upper_dev_get(dev);
    1093     const struct net_device_ops *ops = br_dev->netdev_ops;
    1094    
    1095     @@ -3840,7 +3840,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,
    1096    
    1097     /* Support fdb on master device the net/bridge default case */
    1098     if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) &&
    1099     - (dev->priv_flags & IFF_BRIDGE_PORT)) {
    1100     + netif_is_bridge_port(dev)) {
    1101     struct net_device *br_dev = netdev_master_upper_dev_get(dev);
    1102     const struct net_device_ops *ops = br_dev->netdev_ops;
    1103    
    1104     @@ -4066,13 +4066,13 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
    1105     continue;
    1106    
    1107     if (!br_idx) { /* user did not specify a specific bridge */
    1108     - if (dev->priv_flags & IFF_BRIDGE_PORT) {
    1109     + if (netif_is_bridge_port(dev)) {
    1110     br_dev = netdev_master_upper_dev_get(dev);
    1111     cops = br_dev->netdev_ops;
    1112     }
    1113     } else {
    1114     if (dev != br_dev &&
    1115     - !(dev->priv_flags & IFF_BRIDGE_PORT))
    1116     + !netif_is_bridge_port(dev))
    1117     continue;
    1118    
    1119     if (br_dev != netdev_master_upper_dev_get(dev) &&
    1120     @@ -4084,7 +4084,7 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
    1121     if (idx < s_idx)
    1122     goto cont;
    1123    
    1124     - if (dev->priv_flags & IFF_BRIDGE_PORT) {
    1125     + if (netif_is_bridge_port(dev)) {
    1126     if (cops && cops->ndo_fdb_dump) {
    1127     err = cops->ndo_fdb_dump(skb, cb,
    1128     br_dev, dev,
    1129     @@ -4234,7 +4234,7 @@ static int rtnl_fdb_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
    1130    
    1131     if (dev) {
    1132     if (!ndm_flags || (ndm_flags & NTF_MASTER)) {
    1133     - if (!(dev->priv_flags & IFF_BRIDGE_PORT)) {
    1134     + if (!netif_is_bridge_port(dev)) {
    1135     NL_SET_ERR_MSG(extack, "Device is not a bridge port");
    1136     return -EINVAL;
    1137     }
    1138     diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    1139     index 539492998864e..d1feec97fa062 100644
    1140     --- a/net/ipv4/route.c
    1141     +++ b/net/ipv4/route.c
    1142     @@ -631,14 +631,14 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
    1143     kfree_rcu(oldest, rcu);
    1144     }
    1145    
    1146     -static inline u32 fnhe_hashfun(__be32 daddr)
    1147     +static u32 fnhe_hashfun(__be32 daddr)
    1148     {
    1149     - static u32 fnhe_hashrnd __read_mostly;
    1150     - u32 hval;
    1151     + static siphash_key_t fnhe_hash_key __read_mostly;
    1152     + u64 hval;
    1153    
    1154     - net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
    1155     - hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
    1156     - return hash_32(hval, FNHE_HASH_SHIFT);
    1157     + net_get_random_once(&fnhe_hash_key, sizeof(fnhe_hash_key));
    1158     + hval = siphash_1u32((__force u32)daddr, &fnhe_hash_key);
    1159     + return hash_64(hval, FNHE_HASH_SHIFT);
    1160     }
    1161    
    1162     static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
    1163     diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
    1164     index 6a0c4326d9cf2..7df7ec74807ac 100644
    1165     --- a/net/ipv4/tcp_bpf.c
    1166     +++ b/net/ipv4/tcp_bpf.c
    1167     @@ -313,6 +313,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
    1168     bool cork = false, enospc = sk_msg_full(msg);
    1169     struct sock *sk_redir;
    1170     u32 tosend, delta = 0;
    1171     + u32 eval = __SK_NONE;
    1172     int ret;
    1173    
    1174     more_data:
    1175     @@ -356,13 +357,24 @@ more_data:
    1176     case __SK_REDIRECT:
    1177     sk_redir = psock->sk_redir;
    1178     sk_msg_apply_bytes(psock, tosend);
    1179     + if (!psock->apply_bytes) {
    1180     + /* Clean up before releasing the sock lock. */
    1181     + eval = psock->eval;
    1182     + psock->eval = __SK_NONE;
    1183     + psock->sk_redir = NULL;
    1184     + }
    1185     if (psock->cork) {
    1186     cork = true;
    1187     psock->cork = NULL;
    1188     }
    1189     sk_msg_return(sk, msg, tosend);
    1190     release_sock(sk);
    1191     +
    1192     ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags);
    1193     +
    1194     + if (eval == __SK_REDIRECT)
    1195     + sock_put(sk_redir);
    1196     +
    1197     lock_sock(sk);
    1198     if (unlikely(ret < 0)) {
    1199     int free = sk_msg_free_nocharge(sk, msg);
    1200     diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    1201     index 3fb259c20546e..daa876c6ae8db 100644
    1202     --- a/net/ipv6/route.c
    1203     +++ b/net/ipv6/route.c
    1204     @@ -41,6 +41,7 @@
    1205     #include <linux/nsproxy.h>
    1206     #include <linux/slab.h>
    1207     #include <linux/jhash.h>
    1208     +#include <linux/siphash.h>
    1209     #include <net/net_namespace.h>
    1210     #include <net/snmp.h>
    1211     #include <net/ipv6.h>
    1212     @@ -1502,17 +1503,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
    1213     static u32 rt6_exception_hash(const struct in6_addr *dst,
    1214     const struct in6_addr *src)
    1215     {
    1216     - static u32 seed __read_mostly;
    1217     - u32 val;
    1218     + static siphash_key_t rt6_exception_key __read_mostly;
    1219     + struct {
    1220     + struct in6_addr dst;
    1221     + struct in6_addr src;
    1222     + } __aligned(SIPHASH_ALIGNMENT) combined = {
    1223     + .dst = *dst,
    1224     + };
    1225     + u64 val;
    1226    
    1227     - net_get_random_once(&seed, sizeof(seed));
    1228     - val = jhash(dst, sizeof(*dst), seed);
    1229     + net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key));
    1230    
    1231     #ifdef CONFIG_IPV6_SUBTREES
    1232     if (src)
    1233     - val = jhash(src, sizeof(*src), val);
    1234     + combined.src = *src;
    1235     #endif
    1236     - return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
    1237     + val = siphash(&combined, sizeof(combined), &rt6_exception_key);
    1238     +
    1239     + return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
    1240     }
    1241    
    1242     /* Helper function to find the cached rt in the hash table
    1243     diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
    1244     index 82a202d71a31e..7c6dcbc8e98ba 100644
    1245     --- a/net/sctp/sm_statefuns.c
    1246     +++ b/net/sctp/sm_statefuns.c
    1247     @@ -697,6 +697,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
    1248     struct sock *sk;
    1249     int error = 0;
    1250    
    1251     + if (asoc && !sctp_vtag_verify(chunk, asoc))
    1252     + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1253     +
    1254     /* If the packet is an OOTB packet which is temporarily on the
    1255     * control endpoint, respond with an ABORT.
    1256     */
    1257     @@ -711,7 +714,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
    1258     * in sctp_unpack_cookie().
    1259     */
    1260     if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1261     - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1262     + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1263     + commands);
    1264    
    1265     /* If the endpoint is not listening or if the number of associations
    1266     * on the TCP-style socket exceed the max backlog, respond with an
    1267     @@ -2141,9 +2145,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
    1268     * enough for the chunk header. Cookie length verification is
    1269     * done later.
    1270     */
    1271     - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1272     - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1273     - commands);
    1274     + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) {
    1275     + if (!sctp_vtag_verify(chunk, asoc))
    1276     + asoc = NULL;
    1277     + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands);
    1278     + }
    1279    
    1280     /* "Decode" the chunk. We have no optional parameters so we
    1281     * are in good shape.
    1282     @@ -2280,7 +2286,7 @@ enum sctp_disposition sctp_sf_shutdown_pending_abort(
    1283     */
    1284     if (SCTP_ADDR_DEL ==
    1285     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
    1286     - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
    1287     + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1288    
    1289     if (!sctp_err_chunk_valid(chunk))
    1290     return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1291     @@ -2326,7 +2332,7 @@ enum sctp_disposition sctp_sf_shutdown_sent_abort(
    1292     */
    1293     if (SCTP_ADDR_DEL ==
    1294     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
    1295     - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
    1296     + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1297    
    1298     if (!sctp_err_chunk_valid(chunk))
    1299     return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1300     @@ -2596,7 +2602,7 @@ enum sctp_disposition sctp_sf_do_9_1_abort(
    1301     */
    1302     if (SCTP_ADDR_DEL ==
    1303     sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
    1304     - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
    1305     + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1306    
    1307     if (!sctp_err_chunk_valid(chunk))
    1308     return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1309     @@ -3562,6 +3568,9 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
    1310    
    1311     SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
    1312    
    1313     + if (asoc && !sctp_vtag_verify(chunk, asoc))
    1314     + asoc = NULL;
    1315     +
    1316     ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
    1317     do {
    1318     /* Report violation if the chunk is less then minimal */
    1319     @@ -3677,12 +3686,6 @@ static enum sctp_disposition sctp_sf_shut_8_4_5(
    1320    
    1321     SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
    1322    
    1323     - /* If the chunk length is invalid, we don't want to process
    1324     - * the reset of the packet.
    1325     - */
    1326     - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1327     - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1328     -
    1329     /* We need to discard the rest of the packet to prevent
    1330     * potential bomming attacks from additional bundled chunks.
    1331     * This is documented in SCTP Threats ID.
    1332     @@ -3710,6 +3713,9 @@ enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
    1333     {
    1334     struct sctp_chunk *chunk = arg;
    1335    
    1336     + if (!sctp_vtag_verify(chunk, asoc))
    1337     + asoc = NULL;
    1338     +
    1339     /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
    1340     if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1341     return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1342     @@ -3745,6 +3751,11 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
    1343     return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1344     }
    1345    
    1346     + /* Make sure that the ASCONF ADDIP chunk has a valid length. */
    1347     + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
    1348     + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1349     + commands);
    1350     +
    1351     /* ADD-IP: Section 4.1.1
    1352     * This chunk MUST be sent in an authenticated way by using
    1353     * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
    1354     @@ -3753,13 +3764,7 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
    1355     */
    1356     if (!asoc->peer.asconf_capable ||
    1357     (!net->sctp.addip_noauth && !chunk->auth))
    1358     - return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
    1359     - commands);
    1360     -
    1361     - /* Make sure that the ASCONF ADDIP chunk has a valid length. */
    1362     - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
    1363     - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1364     - commands);
    1365     + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1366    
    1367     hdr = (struct sctp_addiphdr *)chunk->skb->data;
    1368     serial = ntohl(hdr->serial);
    1369     @@ -3888,6 +3893,12 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
    1370     return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1371     }
    1372    
    1373     + /* Make sure that the ADDIP chunk has a valid length. */
    1374     + if (!sctp_chunk_length_valid(asconf_ack,
    1375     + sizeof(struct sctp_addip_chunk)))
    1376     + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1377     + commands);
    1378     +
    1379     /* ADD-IP, Section 4.1.2:
    1380     * This chunk MUST be sent in an authenticated way by using
    1381     * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
    1382     @@ -3896,14 +3907,7 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
    1383     */
    1384     if (!asoc->peer.asconf_capable ||
    1385     (!net->sctp.addip_noauth && !asconf_ack->auth))
    1386     - return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
    1387     - commands);
    1388     -
    1389     - /* Make sure that the ADDIP chunk has a valid length. */
    1390     - if (!sctp_chunk_length_valid(asconf_ack,
    1391     - sizeof(struct sctp_addip_chunk)))
    1392     - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1393     - commands);
    1394     + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1395    
    1396     addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
    1397     rcvd_serial = ntohl(addip_hdr->serial);
    1398     @@ -4475,6 +4479,9 @@ enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
    1399     {
    1400     struct sctp_chunk *chunk = arg;
    1401    
    1402     + if (asoc && !sctp_vtag_verify(chunk, asoc))
    1403     + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1404     +
    1405     /* Make sure that the chunk has a valid length.
    1406     * Since we don't know the chunk type, we use a general
    1407     * chunkhdr structure to make a comparison.
    1408     @@ -4542,6 +4549,9 @@ enum sctp_disposition sctp_sf_violation(struct net *net,
    1409     {
    1410     struct sctp_chunk *chunk = arg;
    1411    
    1412     + if (!sctp_vtag_verify(chunk, asoc))
    1413     + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1414     +
    1415     /* Make sure that the chunk has a valid length. */
    1416     if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1417     return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1418     @@ -6248,6 +6258,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(
    1419     * yet.
    1420     */
    1421     switch (chunk->chunk_hdr->type) {
    1422     + case SCTP_CID_INIT:
    1423     case SCTP_CID_INIT_ACK:
    1424     {
    1425     struct sctp_initack_chunk *initack;
    1426     diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
    1427     index 7fb5c067f4293..02821b9140546 100644
    1428     --- a/net/tls/tls_sw.c
    1429     +++ b/net/tls/tls_sw.c
    1430     @@ -35,6 +35,7 @@
    1431     * SOFTWARE.
    1432     */
    1433    
    1434     +#include <linux/bug.h>
    1435     #include <linux/sched/signal.h>
    1436     #include <linux/module.h>
    1437     #include <linux/splice.h>
    1438     @@ -43,6 +44,14 @@
    1439     #include <net/strparser.h>
    1440     #include <net/tls.h>
    1441    
    1442     +noinline void tls_err_abort(struct sock *sk, int err)
    1443     +{
    1444     + WARN_ON_ONCE(err >= 0);
    1445     + /* sk->sk_err should contain a positive error code. */
    1446     + sk->sk_err = -err;
    1447     + sk->sk_error_report(sk);
    1448     +}
    1449     +
    1450     static int __skb_nsg(struct sk_buff *skb, int offset, int len,
    1451     unsigned int recursion_level)
    1452     {
    1453     @@ -416,7 +425,7 @@ int tls_tx_records(struct sock *sk, int flags)
    1454    
    1455     tx_err:
    1456     if (rc < 0 && rc != -EAGAIN)
    1457     - tls_err_abort(sk, EBADMSG);
    1458     + tls_err_abort(sk, -EBADMSG);
    1459    
    1460     return rc;
    1461     }
    1462     @@ -447,7 +456,7 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err)
    1463    
    1464     /* If err is already set on socket, return the same code */
    1465     if (sk->sk_err) {
    1466     - ctx->async_wait.err = sk->sk_err;
    1467     + ctx->async_wait.err = -sk->sk_err;
    1468     } else {
    1469     ctx->async_wait.err = err;
    1470     tls_err_abort(sk, err);
    1471     @@ -761,7 +770,7 @@ static int tls_push_record(struct sock *sk, int flags,
    1472     msg_pl->sg.size + prot->tail_size, i);
    1473     if (rc < 0) {
    1474     if (rc != -EINPROGRESS) {
    1475     - tls_err_abort(sk, EBADMSG);
    1476     + tls_err_abort(sk, -EBADMSG);
    1477     if (split) {
    1478     tls_ctx->pending_open_record_frags = true;
    1479     tls_merge_open_record(sk, rec, tmp, orig_end);
    1480     @@ -1822,7 +1831,7 @@ int tls_sw_recvmsg(struct sock *sk,
    1481     err = decrypt_skb_update(sk, skb, &msg->msg_iter,
    1482     &chunk, &zc, async_capable);
    1483     if (err < 0 && err != -EINPROGRESS) {
    1484     - tls_err_abort(sk, EBADMSG);
    1485     + tls_err_abort(sk, -EBADMSG);
    1486     goto recv_end;
    1487     }
    1488    
    1489     @@ -2002,7 +2011,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
    1490     }
    1491    
    1492     if (err < 0) {
    1493     - tls_err_abort(sk, EBADMSG);
    1494     + tls_err_abort(sk, -EBADMSG);
    1495     goto splice_read_end;
    1496     }
    1497     ctx->decrypted = true;
    1498     diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    1499     index 7b170ed6923e7..7633d6a74bc2b 100644
    1500     --- a/net/wireless/nl80211.c
    1501     +++ b/net/wireless/nl80211.c
    1502     @@ -3480,7 +3480,7 @@ static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
    1503     enum nl80211_iftype iftype)
    1504     {
    1505     if (!use_4addr) {
    1506     - if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
    1507     + if (netdev && netif_is_bridge_port(netdev))
    1508     return -EBUSY;
    1509     return 0;
    1510     }
    1511     diff --git a/net/wireless/scan.c b/net/wireless/scan.c
    1512     index 1580535d53f86..6cefaad3b7f84 100644
    1513     --- a/net/wireless/scan.c
    1514     +++ b/net/wireless/scan.c
    1515     @@ -379,14 +379,17 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
    1516     }
    1517     ssid_len = ssid[1];
    1518     ssid = ssid + 2;
    1519     - rcu_read_unlock();
    1520    
    1521     /* check if nontrans_bss is in the list */
    1522     list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
    1523     - if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len))
    1524     + if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) {
    1525     + rcu_read_unlock();
    1526     return 0;
    1527     + }
    1528     }
    1529    
    1530     + rcu_read_unlock();
    1531     +
    1532     /* add to the list */
    1533     list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
    1534     return 0;
    1535     diff --git a/net/wireless/util.c b/net/wireless/util.c
    1536     index f0247eab5bc94..aaefaf3422a1a 100644
    1537     --- a/net/wireless/util.c
    1538     +++ b/net/wireless/util.c
    1539     @@ -975,14 +975,14 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
    1540     !(rdev->wiphy.interface_modes & (1 << ntype)))
    1541     return -EOPNOTSUPP;
    1542    
    1543     - /* if it's part of a bridge, reject changing type to station/ibss */
    1544     - if ((dev->priv_flags & IFF_BRIDGE_PORT) &&
    1545     - (ntype == NL80211_IFTYPE_ADHOC ||
    1546     - ntype == NL80211_IFTYPE_STATION ||
    1547     - ntype == NL80211_IFTYPE_P2P_CLIENT))
    1548     - return -EBUSY;
    1549     -
    1550     if (ntype != otype) {
    1551     + /* if it's part of a bridge, reject changing type to station/ibss */
    1552     + if (netif_is_bridge_port(dev) &&
    1553     + (ntype == NL80211_IFTYPE_ADHOC ||
    1554     + ntype == NL80211_IFTYPE_STATION ||
    1555     + ntype == NL80211_IFTYPE_P2P_CLIENT))
    1556     + return -EBUSY;
    1557     +
    1558     dev->ieee80211_ptr->use_4addr = false;
    1559     dev->ieee80211_ptr->mesh_id_up_len = 0;
    1560     wdev_lock(dev->ieee80211_ptr);
    1561     diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
    1562     index f3ff825d9dd33..3a169a026635d 100644
    1563     --- a/tools/perf/builtin-script.c
    1564     +++ b/tools/perf/builtin-script.c
    1565     @@ -3779,11 +3779,15 @@ int cmd_script(int argc, const char **argv)
    1566     goto out_delete;
    1567    
    1568     uname(&uts);
    1569     - if (data.is_pipe || /* assume pipe_mode indicates native_arch */
    1570     - !strcmp(uts.machine, session->header.env.arch) ||
    1571     - (!strcmp(uts.machine, "x86_64") &&
    1572     - !strcmp(session->header.env.arch, "i386")))
    1573     + if (data.is_pipe) { /* Assume pipe_mode indicates native_arch */
    1574     native_arch = true;
    1575     + } else if (session->header.env.arch) {
    1576     + if (!strcmp(uts.machine, session->header.env.arch))
    1577     + native_arch = true;
    1578     + else if (!strcmp(uts.machine, "x86_64") &&
    1579     + !strcmp(session->header.env.arch, "i386"))
    1580     + native_arch = true;
    1581     + }
    1582    
    1583     script.session = session;
    1584     script__setup_sample_type(&script);