Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0256-5.4.157-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-5.4/0256-5.4.157-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (show annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (18 months, 1 week ago) by niro
    File size: 54691 byte(s) 
    -sync kernel patches
    1 diff --git a/Makefile b/Makefile
    2 index ced1f0fd48dc6..49d639fe5a801 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 5
    8 PATCHLEVEL = 4
    9 -SUBLEVEL = 156
    10 +SUBLEVEL = 157
    11 EXTRAVERSION =
    12 NAME = Kleptomaniac Octopus
    13
    14 diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c
    15 index aa075d8372ea2..74255e8198314 100644
    16 --- a/arch/arm/boot/compressed/decompress.c
    17 +++ b/arch/arm/boot/compressed/decompress.c
    18 @@ -47,7 +47,10 @@ extern char * strchrnul(const char *, int);
    19 #endif
    20
    21 #ifdef CONFIG_KERNEL_XZ
    22 +/* Prevent KASAN override of string helpers in decompressor */
    23 +#undef memmove
    24 #define memmove memmove
    25 +#undef memcpy
    26 #define memcpy memcpy
    27 #include "../../../../lib/decompress_unxz.c"
    28 #endif
    29 diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
    30 index 8c74037ade229..b1f366df620b0 100644
    31 --- a/arch/arm/kernel/vmlinux-xip.lds.S
    32 +++ b/arch/arm/kernel/vmlinux-xip.lds.S
    33 @@ -180,7 +180,7 @@ ASSERT(__hyp_idmap_text_end - (__hyp_idmap_text_start & PAGE_MASK) <= PAGE_SIZE,
    34 ASSERT((_end - __bss_start) >= 12288, ".bss too small for CONFIG_XIP_DEFLATED_DATA")
    35 #endif
    36
    37 -#ifdef CONFIG_ARM_MPU
    38 +#if defined(CONFIG_ARM_MPU) && !defined(CONFIG_COMPILE_TEST)
    39 /*
    40 * Due to PMSAv7 restriction on base address and size we have to
    41 * enforce minimal alignment restrictions. It was seen that weaker
    42 diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
    43 index 60ac7c5999a98..86e54447dc916 100644
    44 --- a/arch/arm/mm/proc-macros.S
    45 +++ b/arch/arm/mm/proc-macros.S
    46 @@ -342,6 +342,7 @@ ENTRY(\name\()_cache_fns)
    47
    48 .macro define_tlb_functions name:req, flags_up:req, flags_smp
    49 .type \name\()_tlb_fns, #object
    50 + .align 2
    51 ENTRY(\name\()_tlb_fns)
    52 .long \name\()_flush_user_tlb_range
    53 .long \name\()_flush_kern_tlb_range
    54 diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
    55 index 90b5bc723c83f..0a783bd4641c5 100644
    56 --- a/arch/arm/probes/kprobes/core.c
    57 +++ b/arch/arm/probes/kprobes/core.c
    58 @@ -534,7 +534,7 @@ static struct undef_hook kprobes_arm_break_hook = {
    59
    60 #endif /* !CONFIG_THUMB2_KERNEL */
    61
    62 -int __init arch_init_kprobes()
    63 +int __init arch_init_kprobes(void)
    64 {
    65 arm_probes_decode_init();
    66 #ifdef CONFIG_THUMB2_KERNEL
    67 diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
    68 index 57a6f45036c1f..d7177465b0968 100644
    69 --- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
    70 +++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
    71 @@ -114,7 +114,7 @@
    72 pinctrl-0 = <&emac_rgmii_pins>;
    73 phy-supply = <&reg_gmac_3v3>;
    74 phy-handle = <&ext_rgmii_phy>;
    75 - phy-mode = "rgmii";
    76 + phy-mode = "rgmii-id";
    77 status = "okay";
    78 };
    79
    80 diff --git a/arch/nios2/platform/Kconfig.platform b/arch/nios2/platform/Kconfig.platform
    81 index 9e32fb7f3d4ce..e849daff6fd16 100644
    82 --- a/arch/nios2/platform/Kconfig.platform
    83 +++ b/arch/nios2/platform/Kconfig.platform
    84 @@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR
    85
    86 config NIOS2_DTB_SOURCE_BOOL
    87 bool "Compile and link device tree into kernel image"
    88 + depends on !COMPILE_TEST
    89 help
    90 This allows you to specify a dts (device tree source) file
    91 which will be compiled and linked into the kernel image.
    92 diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
    93 index 20bfd753bcba6..81e6279c9874f 100644
    94 --- a/arch/powerpc/net/bpf_jit_comp64.c
    95 +++ b/arch/powerpc/net/bpf_jit_comp64.c
    96 @@ -408,8 +408,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
    97 case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */
    98 if (imm == 0)
    99 return -EINVAL;
    100 - else if (imm == 1)
    101 - goto bpf_alu32_trunc;
    102 + if (imm == 1) {
    103 + if (BPF_OP(code) == BPF_DIV) {
    104 + goto bpf_alu32_trunc;
    105 + } else {
    106 + PPC_LI(dst_reg, 0);
    107 + break;
    108 + }
    109 + }
    110
    111 PPC_LI32(b2p[TMP_REG_1], imm);
    112 switch (BPF_CLASS(code)) {
    113 diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
    114 index fa9483aa4f575..fd73a8aa89d23 100644
    115 --- a/arch/s390/kvm/interrupt.c
    116 +++ b/arch/s390/kvm/interrupt.c
    117 @@ -2987,13 +2987,14 @@ static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask)
    118 int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus);
    119 struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
    120 struct kvm_vcpu *vcpu;
    121 + u8 vcpu_isc_mask;
    122
    123 for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) {
    124 vcpu = kvm_get_vcpu(kvm, vcpu_idx);
    125 if (psw_ioint_disabled(vcpu))
    126 continue;
    127 - deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
    128 - if (deliverable_mask) {
    129 + vcpu_isc_mask = (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
    130 + if (deliverable_mask & vcpu_isc_mask) {
    131 /* lately kicked but not yet running */
    132 if (test_and_set_bit(vcpu_idx, gi->kicked_mask))
    133 return;
    134 diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
    135 index 9ed2fee612297..b286818d8d54d 100644
    136 --- a/arch/s390/kvm/kvm-s390.c
    137 +++ b/arch/s390/kvm/kvm-s390.c
    138 @@ -3092,6 +3092,7 @@ out:
    139
    140 int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
    141 {
    142 + clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.gisa_int.kicked_mask);
    143 return kvm_s390_vcpu_has_irq(vcpu, 0);
    144 }
    145
    146 diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
    147 index d1ed9679c7177..3fca3e13ed6ae 100644
    148 --- a/drivers/ata/sata_mv.c
    149 +++ b/drivers/ata/sata_mv.c
    150 @@ -3892,8 +3892,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
    151 break;
    152
    153 default:
    154 - dev_err(host->dev, "BUG: invalid board index %u\n", board_idx);
    155 - return 1;
    156 + dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx);
    157 + return -EINVAL;
    158 }
    159
    160 hpriv->hp_flags = hp_flags;
    161 diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
    162 index cfa29dc89bbff..fabf87058d80b 100644
    163 --- a/drivers/base/regmap/regcache-rbtree.c
    164 +++ b/drivers/base/regmap/regcache-rbtree.c
    165 @@ -281,14 +281,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
    166 if (!blk)
    167 return -ENOMEM;
    168
    169 + rbnode->block = blk;
    170 +
    171 if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
    172 present = krealloc(rbnode->cache_present,
    173 BITS_TO_LONGS(blklen) * sizeof(*present),
    174 GFP_KERNEL);
    175 - if (!present) {
    176 - kfree(blk);
    177 + if (!present)
    178 return -ENOMEM;
    179 - }
    180
    181 memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
    182 (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
    183 @@ -305,7 +305,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
    184 }
    185
    186 /* update the rbnode block, its size and the base register */
    187 - rbnode->block = blk;
    188 rbnode->blklen = blklen;
    189 rbnode->base_reg = base_reg;
    190 rbnode->cache_present = present;
    191 diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
    192 index fe81c565e7ef8..a7b88ca8b97b3 100644
    193 --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
    194 +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
    195 @@ -463,6 +463,7 @@ static void ttm_transfered_destroy(struct ttm_buffer_object *bo)
    196 struct ttm_transfer_obj *fbo;
    197
    198 fbo = container_of(bo, struct ttm_transfer_obj, base);
    199 + dma_resv_fini(&fbo->base.base._resv);
    200 ttm_bo_put(fbo->bo);
    201 kfree(fbo);
    202 }
    203 diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
    204 index d2d70c89193ff..11ab6390eda4d 100644
    205 --- a/drivers/infiniband/core/sa_query.c
    206 +++ b/drivers/infiniband/core/sa_query.c
    207 @@ -760,8 +760,9 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb,
    208
    209 /* Construct the family header first */
    210 header = skb_put(skb, NLMSG_ALIGN(sizeof(*header)));
    211 - memcpy(header->device_name, dev_name(&query->port->agent->device->dev),
    212 - LS_DEVICE_NAME_MAX);
    213 + strscpy_pad(header->device_name,
    214 + dev_name(&query->port->agent->device->dev),
    215 + LS_DEVICE_NAME_MAX);
    216 header->port_num = query->port->port_num;
    217
    218 if ((comp_mask & IB_SA_PATH_REC_REVERSIBLE) &&
    219 diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
    220 index 79126b2b14ab0..1a82ea73a0fc2 100644
    221 --- a/drivers/infiniband/hw/hfi1/pio.c
    222 +++ b/drivers/infiniband/hw/hfi1/pio.c
    223 @@ -920,6 +920,7 @@ void sc_disable(struct send_context *sc)
    224 {
    225 u64 reg;
    226 struct pio_buf *pbuf;
    227 + LIST_HEAD(wake_list);
    228
    229 if (!sc)
    230 return;
    231 @@ -954,19 +955,21 @@ void sc_disable(struct send_context *sc)
    232 spin_unlock(&sc->release_lock);
    233
    234 write_seqlock(&sc->waitlock);
    235 - while (!list_empty(&sc->piowait)) {
    236 + if (!list_empty(&sc->piowait))
    237 + list_move(&sc->piowait, &wake_list);
    238 + write_sequnlock(&sc->waitlock);
    239 + while (!list_empty(&wake_list)) {
    240 struct iowait *wait;
    241 struct rvt_qp *qp;
    242 struct hfi1_qp_priv *priv;
    243
    244 - wait = list_first_entry(&sc->piowait, struct iowait, list);
    245 + wait = list_first_entry(&wake_list, struct iowait, list);
    246 qp = iowait_to_qp(wait);
    247 priv = qp->priv;
    248 list_del_init(&priv->s_iowait.list);
    249 priv->s_iowait.lock = NULL;
    250 hfi1_qp_wakeup(qp, RVT_S_WAIT_PIO | HFI1_S_WAIT_PIO_DRAIN);
    251 }
    252 - write_sequnlock(&sc->waitlock);
    253
    254 spin_unlock_irq(&sc->alloc_lock);
    255 }
    256 diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
    257 index 4540835e05bda..634f29cb7395c 100644
    258 --- a/drivers/infiniband/hw/mlx5/qp.c
    259 +++ b/drivers/infiniband/hw/mlx5/qp.c
    260 @@ -3865,6 +3865,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
    261 MLX5_SET(dctc, dctc, mtu, attr->path_mtu);
    262 MLX5_SET(dctc, dctc, my_addr_index, attr->ah_attr.grh.sgid_index);
    263 MLX5_SET(dctc, dctc, hop_limit, attr->ah_attr.grh.hop_limit);
    264 + if (attr->ah_attr.type == RDMA_AH_ATTR_TYPE_ROCE)
    265 + MLX5_SET(dctc, dctc, eth_prio, attr->ah_attr.sl & 0x7);
    266
    267 err = mlx5_core_create_dct(dev->mdev, &qp->dct.mdct, qp->dct.in,
    268 MLX5_ST_SZ_BYTES(create_dct_in), out,
    269 diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
    270 index 05190edc2611e..5fd28574124fb 100644
    271 --- a/drivers/infiniband/hw/qib/qib_user_sdma.c
    272 +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
    273 @@ -602,7 +602,7 @@ done:
    274 /*
    275 * How many pages in this iovec element?
    276 */
    277 -static int qib_user_sdma_num_pages(const struct iovec *iov)
    278 +static size_t qib_user_sdma_num_pages(const struct iovec *iov)
    279 {
    280 const unsigned long addr = (unsigned long) iov->iov_base;
    281 const unsigned long len = iov->iov_len;
    282 @@ -658,7 +658,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev,
    283 static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,
    284 struct qib_user_sdma_queue *pq,
    285 struct qib_user_sdma_pkt *pkt,
    286 - unsigned long addr, int tlen, int npages)
    287 + unsigned long addr, int tlen, size_t npages)
    288 {
    289 struct page *pages[8];
    290 int i, j;
    291 @@ -722,7 +722,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd,
    292 unsigned long idx;
    293
    294 for (idx = 0; idx < niov; idx++) {
    295 - const int npages = qib_user_sdma_num_pages(iov + idx);
    296 + const size_t npages = qib_user_sdma_num_pages(iov + idx);
    297 const unsigned long addr = (unsigned long) iov[idx].iov_base;
    298
    299 ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr,
    300 @@ -824,8 +824,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    301 unsigned pktnw;
    302 unsigned pktnwc;
    303 int nfrags = 0;
    304 - int npages = 0;
    305 - int bytes_togo = 0;
    306 + size_t npages = 0;
    307 + size_t bytes_togo = 0;
    308 int tiddma = 0;
    309 int cfur;
    310
    311 @@ -885,7 +885,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    312
    313 npages += qib_user_sdma_num_pages(&iov[idx]);
    314
    315 - bytes_togo += slen;
    316 + if (check_add_overflow(bytes_togo, slen, &bytes_togo) ||
    317 + bytes_togo > type_max(typeof(pkt->bytes_togo))) {
    318 + ret = -EINVAL;
    319 + goto free_pbc;
    320 + }
    321 pktnwc += slen >> 2;
    322 idx++;
    323 nfrags++;
    324 @@ -904,8 +908,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    325 }
    326
    327 if (frag_size) {
    328 - int tidsmsize, n;
    329 - size_t pktsize;
    330 + size_t tidsmsize, n, pktsize, sz, addrlimit;
    331
    332 n = npages*((2*PAGE_SIZE/frag_size)+1);
    333 pktsize = struct_size(pkt, addr, n);
    334 @@ -923,14 +926,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    335 else
    336 tidsmsize = 0;
    337
    338 - pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL);
    339 + if (check_add_overflow(pktsize, tidsmsize, &sz)) {
    340 + ret = -EINVAL;
    341 + goto free_pbc;
    342 + }
    343 + pkt = kmalloc(sz, GFP_KERNEL);
    344 if (!pkt) {
    345 ret = -ENOMEM;
    346 goto free_pbc;
    347 }
    348 pkt->largepkt = 1;
    349 pkt->frag_size = frag_size;
    350 - pkt->addrlimit = n + ARRAY_SIZE(pkt->addr);
    351 + if (check_add_overflow(n, ARRAY_SIZE(pkt->addr),
    352 + &addrlimit) ||
    353 + addrlimit > type_max(typeof(pkt->addrlimit))) {
    354 + ret = -EINVAL;
    355 + goto free_pbc;
    356 + }
    357 + pkt->addrlimit = addrlimit;
    358
    359 if (tiddma) {
    360 char *tidsm = (char *)pkt + pktsize;
    361 diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
    362 index 2d65b32d205a5..ec56464eaf23e 100644
    363 --- a/drivers/mmc/host/cqhci.c
    364 +++ b/drivers/mmc/host/cqhci.c
    365 @@ -273,6 +273,9 @@ static void __cqhci_enable(struct cqhci_host *cq_host)
    366
    367 cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
    368
    369 + if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT)
    370 + cqhci_writel(cq_host, 0, CQHCI_CTL);
    371 +
    372 mmc->cqe_on = true;
    373
    374 if (cq_host->ops->enable)
    375 diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
    376 index 5e3d95b636769..ae2c74186e1d2 100644
    377 --- a/drivers/mmc/host/dw_mmc-exynos.c
    378 +++ b/drivers/mmc/host/dw_mmc-exynos.c
    379 @@ -462,6 +462,18 @@ static s8 dw_mci_exynos_get_best_clksmpl(u8 candiates)
    380 }
    381 }
    382
    383 + /*
    384 + * If there is no cadiates value, then it needs to return -EIO.
    385 + * If there are candiates values and don't find bset clk sample value,
    386 + * then use a first candiates clock sample value.
    387 + */
    388 + for (i = 0; i < iter; i++) {
    389 + __c = ror8(candiates, i);
    390 + if ((__c & 0x1) == 0x1) {
    391 + loc = i;
    392 + goto out;
    393 + }
    394 + }
    395 out:
    396 return loc;
    397 }
    398 @@ -492,6 +504,8 @@ static int dw_mci_exynos_execute_tuning(struct dw_mci_slot *slot, u32 opcode)
    399 priv->tuned_sample = found;
    400 } else {
    401 ret = -EIO;
    402 + dev_warn(&mmc->class_dev,
    403 + "There is no candiates value about clksmpl!\n");
    404 }
    405
    406 return ret;
    407 diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
    408 index 771676209005b..2c01e2ebef7aa 100644
    409 --- a/drivers/mmc/host/sdhci-esdhc-imx.c
    410 +++ b/drivers/mmc/host/sdhci-esdhc-imx.c
    411 @@ -24,6 +24,7 @@
    412 #include <linux/pinctrl/consumer.h>
    413 #include <linux/platform_data/mmc-esdhc-imx.h>
    414 #include <linux/pm_runtime.h>
    415 +#include <linux/iopoll.h>
    416 #include "sdhci-pltfm.h"
    417 #include "sdhci-esdhc.h"
    418 #include "cqhci.h"
    419 @@ -1022,6 +1023,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
    420 struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
    421 struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
    422 u32 ctrl;
    423 + int ret;
    424
    425 /* Reset the tuning circuit */
    426 if (esdhc_is_usdhc(imx_data)) {
    427 @@ -1034,7 +1036,22 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
    428 } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
    429 ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
    430 ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
    431 + ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE;
    432 writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
    433 + /* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */
    434 + ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS,
    435 + ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50);
    436 + if (ret == -ETIMEDOUT)
    437 + dev_warn(mmc_dev(host->mmc),
    438 + "Warning! clear execute tuning bit failed\n");
    439 + /*
    440 + * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the
    441 + * usdhc IP internal logic flag execute_tuning_with_clr_buf, which
    442 + * will finally make sure the normal data transfer logic correct.
    443 + */
    444 + ctrl = readl(host->ioaddr + SDHCI_INT_STATUS);
    445 + ctrl |= SDHCI_INT_DATA_AVAIL;
    446 + writel(ctrl, host->ioaddr + SDHCI_INT_STATUS);
    447 }
    448 }
    449 }
    450 diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
    451 index 2ecd9acebb2f0..cb54fa2120d72 100644
    452 --- a/drivers/mmc/host/sdhci.c
    453 +++ b/drivers/mmc/host/sdhci.c
    454 @@ -1741,6 +1741,12 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode,
    455 break;
    456 case MMC_VDD_32_33:
    457 case MMC_VDD_33_34:
    458 + /*
    459 + * 3.4 ~ 3.6V are valid only for those platforms where it's
    460 + * known that the voltage range is supported by hardware.
    461 + */
    462 + case MMC_VDD_34_35:
    463 + case MMC_VDD_35_36:
    464 pwr = SDHCI_POWER_330;
    465 break;
    466 default:
    467 diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
    468 index 156046e56a584..5e1d7025dbf78 100644
    469 --- a/drivers/mmc/host/vub300.c
    470 +++ b/drivers/mmc/host/vub300.c
    471 @@ -576,7 +576,7 @@ static void check_vub300_port_status(struct vub300_mmc_host *vub300)
    472 GET_SYSTEM_PORT_STATUS,
    473 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    474 0x0000, 0x0000, &vub300->system_port_status,
    475 - sizeof(vub300->system_port_status), HZ);
    476 + sizeof(vub300->system_port_status), 1000);
    477 if (sizeof(vub300->system_port_status) == retval)
    478 new_system_port_status(vub300);
    479 }
    480 @@ -1241,7 +1241,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
    481 SET_INTERRUPT_PSEUDOCODE,
    482 USB_DIR_OUT | USB_TYPE_VENDOR |
    483 USB_RECIP_DEVICE, 0x0000, 0x0000,
    484 - xfer_buffer, xfer_length, HZ);
    485 + xfer_buffer, xfer_length, 1000);
    486 kfree(xfer_buffer);
    487 if (retval < 0)
    488 goto copy_error_message;
    489 @@ -1284,7 +1284,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
    490 SET_TRANSFER_PSEUDOCODE,
    491 USB_DIR_OUT | USB_TYPE_VENDOR |
    492 USB_RECIP_DEVICE, 0x0000, 0x0000,
    493 - xfer_buffer, xfer_length, HZ);
    494 + xfer_buffer, xfer_length, 1000);
    495 kfree(xfer_buffer);
    496 if (retval < 0)
    497 goto copy_error_message;
    498 @@ -1991,7 +1991,7 @@ static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
    499 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
    500 SET_CLOCK_SPEED,
    501 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    502 - 0x00, 0x00, buf, buf_array_size, HZ);
    503 + 0x00, 0x00, buf, buf_array_size, 1000);
    504 if (retval != 8) {
    505 dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
    506 " %dkHz failed with retval=%d\n", kHzClock, retval);
    507 @@ -2013,14 +2013,14 @@ static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
    508 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
    509 SET_SD_POWER,
    510 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    511 - 0x0000, 0x0000, NULL, 0, HZ);
    512 + 0x0000, 0x0000, NULL, 0, 1000);
    513 /* must wait for the VUB300 u-proc to boot up */
    514 msleep(600);
    515 } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
    516 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
    517 SET_SD_POWER,
    518 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    519 - 0x0001, 0x0000, NULL, 0, HZ);
    520 + 0x0001, 0x0000, NULL, 0, 1000);
    521 msleep(600);
    522 vub300->card_powered = 1;
    523 } else if (ios->power_mode == MMC_POWER_ON) {
    524 @@ -2282,14 +2282,14 @@ static int vub300_probe(struct usb_interface *interface,
    525 GET_HC_INF0,
    526 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    527 0x0000, 0x0000, &vub300->hc_info,
    528 - sizeof(vub300->hc_info), HZ);
    529 + sizeof(vub300->hc_info), 1000);
    530 if (retval < 0)
    531 goto error5;
    532 retval =
    533 usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
    534 SET_ROM_WAIT_STATES,
    535 USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    536 - firmware_rom_wait_states, 0x0000, NULL, 0, HZ);
    537 + firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
    538 if (retval < 0)
    539 goto error5;
    540 dev_info(&vub300->udev->dev,
    541 @@ -2304,7 +2304,7 @@ static int vub300_probe(struct usb_interface *interface,
    542 GET_SYSTEM_PORT_STATUS,
    543 USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
    544 0x0000, 0x0000, &vub300->system_port_status,
    545 - sizeof(vub300->system_port_status), HZ);
    546 + sizeof(vub300->system_port_status), 1000);
    547 if (retval < 0) {
    548 goto error4;
    549 } else if (sizeof(vub300->system_port_status) == retval) {
    550 diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
    551 index 1949f631e1bc5..a7eaf80f500c0 100644
    552 --- a/drivers/net/bonding/bond_main.c
    553 +++ b/drivers/net/bonding/bond_main.c
    554 @@ -1219,7 +1219,7 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
    555 skb->dev = bond->dev;
    556
    557 if (BOND_MODE(bond) == BOND_MODE_ALB &&
    558 - bond->dev->priv_flags & IFF_BRIDGE_PORT &&
    559 + netif_is_bridge_port(bond->dev) &&
    560 skb->pkt_type == PACKET_HOST) {
    561
    562 if (unlikely(skb_cow_head(skb,
    563 diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
    564 index 7dc451fdaf35e..2431723bc2fb4 100644
    565 --- a/drivers/net/ethernet/micrel/ksz884x.c
    566 +++ b/drivers/net/ethernet/micrel/ksz884x.c
    567 @@ -5693,7 +5693,7 @@ static void dev_set_promiscuous(struct net_device *dev, struct dev_priv *priv,
    568 * from the bridge.
    569 */
    570 if ((hw->features & STP_SUPPORT) && !promiscuous &&
    571 - (dev->priv_flags & IFF_BRIDGE_PORT)) {
    572 + netif_is_bridge_port(dev)) {
    573 struct ksz_switch *sw = hw->ksz_switch;
    574 int port = priv->port.first_port;
    575
    576 diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
    577 index dfa0ded169ee9..a109120da0e7c 100644
    578 --- a/drivers/net/ethernet/microchip/lan743x_main.c
    579 +++ b/drivers/net/ethernet/microchip/lan743x_main.c
    580 @@ -1706,6 +1706,16 @@ static int lan743x_tx_ring_init(struct lan743x_tx *tx)
    581 ret = -EINVAL;
    582 goto cleanup;
    583 }
    584 + if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
    585 + DMA_BIT_MASK(64))) {
    586 + if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
    587 + DMA_BIT_MASK(32))) {
    588 + dev_warn(&tx->adapter->pdev->dev,
    589 + "lan743x_: No suitable DMA available\n");
    590 + ret = -ENOMEM;
    591 + goto cleanup;
    592 + }
    593 + }
    594 ring_allocation_size = ALIGN(tx->ring_size *
    595 sizeof(struct lan743x_tx_descriptor),
    596 PAGE_SIZE);
    597 @@ -2256,6 +2266,16 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx)
    598 ret = -EINVAL;
    599 goto cleanup;
    600 }
    601 + if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
    602 + DMA_BIT_MASK(64))) {
    603 + if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
    604 + DMA_BIT_MASK(32))) {
    605 + dev_warn(&rx->adapter->pdev->dev,
    606 + "lan743x_: No suitable DMA available\n");
    607 + ret = -ENOMEM;
    608 + goto cleanup;
    609 + }
    610 + }
    611 ring_allocation_size = ALIGN(rx->ring_size *
    612 sizeof(struct lan743x_rx_descriptor),
    613 PAGE_SIZE);
    614 @@ -3001,6 +3021,8 @@ static int lan743x_pm_resume(struct device *dev)
    615 if (ret) {
    616 netif_err(adapter, probe, adapter->netdev,
    617 "lan743x_hardware_init returned %d\n", ret);
    618 + lan743x_pci_cleanup(adapter);
    619 + return ret;
    620 }
    621
    622 /* open netdev when netdev is at running state while resume.
    623 diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
    624 index 1d59ef367a85c..3b177421651f1 100644
    625 --- a/drivers/net/ethernet/nxp/lpc_eth.c
    626 +++ b/drivers/net/ethernet/nxp/lpc_eth.c
    627 @@ -1007,9 +1007,6 @@ static int lpc_eth_close(struct net_device *ndev)
    628 napi_disable(&pldat->napi);
    629 netif_stop_queue(ndev);
    630
    631 - if (ndev->phydev)
    632 - phy_stop(ndev->phydev);
    633 -
    634 spin_lock_irqsave(&pldat->lock, flags);
    635 __lpc_eth_reset(pldat);
    636 netif_carrier_off(ndev);
    637 @@ -1017,6 +1014,8 @@ static int lpc_eth_close(struct net_device *ndev)
    638 writel(0, LPC_ENET_MAC2(pldat->net_base));
    639 spin_unlock_irqrestore(&pldat->lock, flags);
    640
    641 + if (ndev->phydev)
    642 + phy_stop(ndev->phydev);
    643 clk_disable_unprepare(pldat->clk);
    644
    645 return 0;
    646 diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
    647 index 8377ff229a303..bec73f0640d03 100644
    648 --- a/drivers/net/phy/mdio_bus.c
    649 +++ b/drivers/net/phy/mdio_bus.c
    650 @@ -395,7 +395,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
    651 err = device_register(&bus->dev);
    652 if (err) {
    653 pr_err("mii_bus %s failed to register\n", bus->id);
    654 - put_device(&bus->dev);
    655 return -EINVAL;
    656 }
    657
    658 diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
    659 index b0b8a3ce82b68..6c52ff8c0d2eb 100644
    660 --- a/drivers/net/phy/phy.c
    661 +++ b/drivers/net/phy/phy.c
    662 @@ -367,6 +367,7 @@ EXPORT_SYMBOL(phy_ethtool_ksettings_set);
    663 void phy_ethtool_ksettings_get(struct phy_device *phydev,
    664 struct ethtool_link_ksettings *cmd)
    665 {
    666 + mutex_lock(&phydev->lock);
    667 linkmode_copy(cmd->link_modes.supported, phydev->supported);
    668 linkmode_copy(cmd->link_modes.advertising, phydev->advertising);
    669 linkmode_copy(cmd->link_modes.lp_advertising, phydev->lp_advertising);
    670 @@ -383,6 +384,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev,
    671 cmd->base.autoneg = phydev->autoneg;
    672 cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl;
    673 cmd->base.eth_tp_mdix = phydev->mdix;
    674 + mutex_unlock(&phydev->lock);
    675 }
    676 EXPORT_SYMBOL(phy_ethtool_ksettings_get);
    677
    678 @@ -553,7 +555,7 @@ static int phy_check_link_status(struct phy_device *phydev)
    679 }
    680
    681 /**
    682 - * phy_start_aneg - start auto-negotiation for this PHY device
    683 + * _phy_start_aneg - start auto-negotiation for this PHY device
    684 * @phydev: the phy_device struct
    685 *
    686 * Description: Sanitizes the settings (if we're not autonegotiating
    687 @@ -561,25 +563,43 @@ static int phy_check_link_status(struct phy_device *phydev)
    688 * If the PHYCONTROL Layer is operating, we change the state to
    689 * reflect the beginning of Auto-negotiation or forcing.
    690 */
    691 -int phy_start_aneg(struct phy_device *phydev)
    692 +static int _phy_start_aneg(struct phy_device *phydev)
    693 {
    694 int err;
    695
    696 + lockdep_assert_held(&phydev->lock);
    697 +
    698 if (!phydev->drv)
    699 return -EIO;
    700
    701 - mutex_lock(&phydev->lock);
    702 -
    703 if (AUTONEG_DISABLE == phydev->autoneg)
    704 phy_sanitize_settings(phydev);
    705
    706 err = phy_config_aneg(phydev);
    707 if (err < 0)
    708 - goto out_unlock;
    709 + return err;
    710
    711 if (phy_is_started(phydev))
    712 err = phy_check_link_status(phydev);
    713 -out_unlock:
    714 +
    715 + return err;
    716 +}
    717 +
    718 +/**
    719 + * phy_start_aneg - start auto-negotiation for this PHY device
    720 + * @phydev: the phy_device struct
    721 + *
    722 + * Description: Sanitizes the settings (if we're not autonegotiating
    723 + * them), and then calls the driver's config_aneg function.
    724 + * If the PHYCONTROL Layer is operating, we change the state to
    725 + * reflect the beginning of Auto-negotiation or forcing.
    726 + */
    727 +int phy_start_aneg(struct phy_device *phydev)
    728 +{
    729 + int err;
    730 +
    731 + mutex_lock(&phydev->lock);
    732 + err = _phy_start_aneg(phydev);
    733 mutex_unlock(&phydev->lock);
    734
    735 return err;
    736 diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
    737 index 92d9d3407b79b..fe830b72c3b0f 100644
    738 --- a/drivers/net/usb/lan78xx.c
    739 +++ b/drivers/net/usb/lan78xx.c
    740 @@ -3753,6 +3753,12 @@ static int lan78xx_probe(struct usb_interface *intf,
    741
    742 dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1);
    743
    744 + /* Reject broken descriptors. */
    745 + if (dev->maxpacket == 0) {
    746 + ret = -ENODEV;
    747 + goto out4;
    748 + }
    749 +
    750 /* driver requires remote-wakeup capability during autosuspend. */
    751 intf->needs_remote_wakeup = 1;
    752
    753 diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
    754 index dde05e2fdc3e6..b8b9df82f51ef 100644
    755 --- a/drivers/net/usb/usbnet.c
    756 +++ b/drivers/net/usb/usbnet.c
    757 @@ -1773,6 +1773,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
    758 if (!dev->rx_urb_size)
    759 dev->rx_urb_size = dev->hard_mtu;
    760 dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
    761 + if (dev->maxpacket == 0) {
    762 + /* that is a broken device */
    763 + status = -ENODEV;
    764 + goto out4;
    765 + }
    766
    767 /* let userspace know we have a random address */
    768 if (ether_addr_equal(net->dev_addr, node_id))
    769 diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
    770 index 8e4d355dc3aec..1caebefb25ff1 100644
    771 --- a/drivers/nfc/port100.c
    772 +++ b/drivers/nfc/port100.c
    773 @@ -1003,11 +1003,11 @@ static u64 port100_get_command_type_mask(struct port100 *dev)
    774
    775 skb = port100_alloc_skb(dev, 0);
    776 if (!skb)
    777 - return -ENOMEM;
    778 + return 0;
    779
    780 resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb);
    781 if (IS_ERR(resp))
    782 - return PTR_ERR(resp);
    783 + return 0;
    784
    785 if (resp->len < 8)
    786 mask = 0;
    787 diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
    788 index 38bbbbbc6f47f..ff0d06e8ebb53 100644
    789 --- a/drivers/nvme/host/tcp.c
    790 +++ b/drivers/nvme/host/tcp.c
    791 @@ -962,7 +962,7 @@ static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req)
    792 int ret;
    793 struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_EOR };
    794 struct kvec iov = {
    795 - .iov_base = &req->ddgst + req->offset,
    796 + .iov_base = (u8 *)&req->ddgst + req->offset,
    797 .iov_len = NVME_TCP_DIGEST_LENGTH - req->offset
    798 };
    799
    800 diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
    801 index 2ae846297d7ca..2f4e512bd449f 100644
    802 --- a/drivers/nvme/target/tcp.c
    803 +++ b/drivers/nvme/target/tcp.c
    804 @@ -633,7 +633,7 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd)
    805 struct nvmet_tcp_queue *queue = cmd->queue;
    806 struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
    807 struct kvec iov = {
    808 - .iov_base = &cmd->exp_ddgst + cmd->offset,
    809 + .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset,
    810 .iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset
    811 };
    812 int ret;
    813 diff --git a/drivers/pinctrl/bcm/pinctrl-ns.c b/drivers/pinctrl/bcm/pinctrl-ns.c
    814 index e79690bd8b85f..d7f8175d2c1c8 100644
    815 --- a/drivers/pinctrl/bcm/pinctrl-ns.c
    816 +++ b/drivers/pinctrl/bcm/pinctrl-ns.c
    817 @@ -5,7 +5,6 @@
    818
    819 #include <linux/err.h>
    820 #include <linux/io.h>
    821 -#include <linux/mfd/syscon.h>
    822 #include <linux/module.h>
    823 #include <linux/of.h>
    824 #include <linux/of_device.h>
    825 @@ -13,7 +12,6 @@
    826 #include <linux/pinctrl/pinctrl.h>
    827 #include <linux/pinctrl/pinmux.h>
    828 #include <linux/platform_device.h>
    829 -#include <linux/regmap.h>
    830 #include <linux/slab.h>
    831
    832 #define FLAG_BCM4708 BIT(1)
    833 @@ -24,8 +22,7 @@ struct ns_pinctrl {
    834 struct device *dev;
    835 unsigned int chipset_flag;
    836 struct pinctrl_dev *pctldev;
    837 - struct regmap *regmap;
    838 - u32 offset;
    839 + void __iomem *base;
    840
    841 struct pinctrl_desc pctldesc;
    842 struct ns_pinctrl_group *groups;
    843 @@ -232,9 +229,9 @@ static int ns_pinctrl_set_mux(struct pinctrl_dev *pctrl_dev,
    844 unset |= BIT(pin_number);
    845 }
    846
    847 - regmap_read(ns_pinctrl->regmap, ns_pinctrl->offset, &tmp);
    848 + tmp = readl(ns_pinctrl->base);
    849 tmp &= ~unset;
    850 - regmap_write(ns_pinctrl->regmap, ns_pinctrl->offset, tmp);
    851 + writel(tmp, ns_pinctrl->base);
    852
    853 return 0;
    854 }
    855 @@ -266,13 +263,13 @@ static const struct of_device_id ns_pinctrl_of_match_table[] = {
    856 static int ns_pinctrl_probe(struct platform_device *pdev)
    857 {
    858 struct device *dev = &pdev->dev;
    859 - struct device_node *np = dev->of_node;
    860 const struct of_device_id *of_id;
    861 struct ns_pinctrl *ns_pinctrl;
    862 struct pinctrl_desc *pctldesc;
    863 struct pinctrl_pin_desc *pin;
    864 struct ns_pinctrl_group *group;
    865 struct ns_pinctrl_function *function;
    866 + struct resource *res;
    867 int i;
    868
    869 ns_pinctrl = devm_kzalloc(dev, sizeof(*ns_pinctrl), GFP_KERNEL);
    870 @@ -290,18 +287,12 @@ static int ns_pinctrl_probe(struct platform_device *pdev)
    871 return -EINVAL;
    872 ns_pinctrl->chipset_flag = (uintptr_t)of_id->data;
    873
    874 - ns_pinctrl->regmap = syscon_node_to_regmap(of_get_parent(np));
    875 - if (IS_ERR(ns_pinctrl->regmap)) {
    876 - int err = PTR_ERR(ns_pinctrl->regmap);
    877 -
    878 - dev_err(dev, "Failed to map pinctrl regs: %d\n", err);
    879 -
    880 - return err;
    881 - }
    882 -
    883 - if (of_property_read_u32(np, "offset", &ns_pinctrl->offset)) {
    884 - dev_err(dev, "Failed to get register offset\n");
    885 - return -ENOENT;
    886 + res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
    887 + "cru_gpio_control");
    888 + ns_pinctrl->base = devm_ioremap_resource(dev, res);
    889 + if (IS_ERR(ns_pinctrl->base)) {
    890 + dev_err(dev, "Failed to map pinctrl regs\n");
    891 + return PTR_ERR(ns_pinctrl->base);
    892 }
    893
    894 memcpy(pctldesc, &ns_pinctrl_desc, sizeof(*pctldesc));
    895 diff --git a/include/net/tls.h b/include/net/tls.h
    896 index 697df45c0bcee..7f220e03ebb2d 100644
    897 --- a/include/net/tls.h
    898 +++ b/include/net/tls.h
    899 @@ -360,6 +360,7 @@ int tls_sk_query(struct sock *sk, int optname, char __user *optval,
    900 int __user *optlen);
    901 int tls_sk_attach(struct sock *sk, int optname, char __user *optval,
    902 unsigned int optlen);
    903 +void tls_err_abort(struct sock *sk, int err);
    904
    905 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx);
    906 void tls_sw_strparser_arm(struct sock *sk, struct tls_context *ctx);
    907 @@ -465,12 +466,6 @@ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk)
    908 #endif
    909 }
    910
    911 -static inline void tls_err_abort(struct sock *sk, int err)
    912 -{
    913 - sk->sk_err = err;
    914 - sk->sk_error_report(sk);
    915 -}
    916 -
    917 static inline bool tls_bigint_increment(unsigned char *seq, int len)
    918 {
    919 int i;
    920 @@ -499,7 +494,7 @@ static inline void tls_advance_record_sn(struct sock *sk,
    921 struct cipher_context *ctx)
    922 {
    923 if (tls_bigint_increment(ctx->rec_seq, prot->rec_seq_size))
    924 - tls_err_abort(sk, EBADMSG);
    925 + tls_err_abort(sk, -EBADMSG);
    926
    927 if (prot->version != TLS_1_3_VERSION)
    928 tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
    929 diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
    930 index a6b26ca5c6973..2e818eca3e1c6 100644
    931 --- a/net/batman-adv/bridge_loop_avoidance.c
    932 +++ b/net/batman-adv/bridge_loop_avoidance.c
    933 @@ -1561,10 +1561,14 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
    934 return 0;
    935
    936 bat_priv->bla.claim_hash = batadv_hash_new(128);
    937 - bat_priv->bla.backbone_hash = batadv_hash_new(32);
    938 + if (!bat_priv->bla.claim_hash)
    939 + return -ENOMEM;
    940
    941 - if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash)
    942 + bat_priv->bla.backbone_hash = batadv_hash_new(32);
    943 + if (!bat_priv->bla.backbone_hash) {
    944 + batadv_hash_destroy(bat_priv->bla.claim_hash);
    945 return -ENOMEM;
    946 + }
    947
    948 batadv_hash_set_lock_class(bat_priv->bla.claim_hash,
    949 &batadv_claim_hash_lock_class_key);
    950 diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
    951 index 4a89177def647..6a183c94cdeb4 100644
    952 --- a/net/batman-adv/main.c
    953 +++ b/net/batman-adv/main.c
    954 @@ -197,29 +197,41 @@ int batadv_mesh_init(struct net_device *soft_iface)
    955
    956 bat_priv->gw.generation = 0;
    957
    958 - ret = batadv_v_mesh_init(bat_priv);
    959 - if (ret < 0)
    960 - goto err;
    961 -
    962 ret = batadv_originator_init(bat_priv);
    963 - if (ret < 0)
    964 - goto err;
    965 + if (ret < 0) {
    966 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    967 + goto err_orig;
    968 + }
    969
    970 ret = batadv_tt_init(bat_priv);
    971 - if (ret < 0)
    972 - goto err;
    973 + if (ret < 0) {
    974 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    975 + goto err_tt;
    976 + }
    977 +
    978 + ret = batadv_v_mesh_init(bat_priv);
    979 + if (ret < 0) {
    980 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    981 + goto err_v;
    982 + }
    983
    984 ret = batadv_bla_init(bat_priv);
    985 - if (ret < 0)
    986 - goto err;
    987 + if (ret < 0) {
    988 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    989 + goto err_bla;
    990 + }
    991
    992 ret = batadv_dat_init(bat_priv);
    993 - if (ret < 0)
    994 - goto err;
    995 + if (ret < 0) {
    996 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    997 + goto err_dat;
    998 + }
    999
    1000 ret = batadv_nc_mesh_init(bat_priv);
    1001 - if (ret < 0)
    1002 - goto err;
    1003 + if (ret < 0) {
    1004 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
    1005 + goto err_nc;
    1006 + }
    1007
    1008 batadv_gw_init(bat_priv);
    1009 batadv_mcast_init(bat_priv);
    1010 @@ -229,8 +241,20 @@ int batadv_mesh_init(struct net_device *soft_iface)
    1011
    1012 return 0;
    1013
    1014 -err:
    1015 - batadv_mesh_free(soft_iface);
    1016 +err_nc:
    1017 + batadv_dat_free(bat_priv);
    1018 +err_dat:
    1019 + batadv_bla_free(bat_priv);
    1020 +err_bla:
    1021 + batadv_v_mesh_free(bat_priv);
    1022 +err_v:
    1023 + batadv_tt_free(bat_priv);
    1024 +err_tt:
    1025 + batadv_originator_free(bat_priv);
    1026 +err_orig:
    1027 + batadv_purge_outstanding_packets(bat_priv, NULL);
    1028 + atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
    1029 +
    1030 return ret;
    1031 }
    1032
    1033 diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
    1034 index 70e3b161c6635..850f927f33de2 100644
    1035 --- a/net/batman-adv/network-coding.c
    1036 +++ b/net/batman-adv/network-coding.c
    1037 @@ -155,8 +155,10 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
    1038 &batadv_nc_coding_hash_lock_class_key);
    1039
    1040 bat_priv->nc.decoding_hash = batadv_hash_new(128);
    1041 - if (!bat_priv->nc.decoding_hash)
    1042 + if (!bat_priv->nc.decoding_hash) {
    1043 + batadv_hash_destroy(bat_priv->nc.coding_hash);
    1044 goto err;
    1045 + }
    1046
    1047 batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
    1048 &batadv_nc_decoding_hash_lock_class_key);
    1049 diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
    1050 index c5271ea4dc832..515205d7b650f 100644
    1051 --- a/net/batman-adv/translation-table.c
    1052 +++ b/net/batman-adv/translation-table.c
    1053 @@ -4405,8 +4405,10 @@ int batadv_tt_init(struct batadv_priv *bat_priv)
    1054 return ret;
    1055
    1056 ret = batadv_tt_global_init(bat_priv);
    1057 - if (ret < 0)
    1058 + if (ret < 0) {
    1059 + batadv_tt_local_table_free(bat_priv);
    1060 return ret;
    1061 + }
    1062
    1063 batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1,
    1064 batadv_tt_tvlv_unicast_handler_v1,
    1065 diff --git a/net/core/dev.c b/net/core/dev.c
    1066 index 3810eaf89b266..e4e492bf72af0 100644
    1067 --- a/net/core/dev.c
    1068 +++ b/net/core/dev.c
    1069 @@ -2787,6 +2787,12 @@ static u16 skb_tx_hash(const struct net_device *dev,
    1070
    1071 qoffset = sb_dev->tc_to_txq[tc].offset;
    1072 qcount = sb_dev->tc_to_txq[tc].count;
    1073 + if (unlikely(!qcount)) {
    1074 + net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n",
    1075 + sb_dev->name, qoffset, tc);
    1076 + qoffset = 0;
    1077 + qcount = dev->real_num_tx_queues;
    1078 + }
    1079 }
    1080
    1081 if (skb_rx_queue_recorded(skb)) {
    1082 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    1083 index a53b101ce41ae..55c0f32b9375b 100644
    1084 --- a/net/core/rtnetlink.c
    1085 +++ b/net/core/rtnetlink.c
    1086 @@ -3729,7 +3729,7 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh,
    1087
    1088 /* Support fdb on master device the net/bridge default case */
    1089 if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) &&
    1090 - (dev->priv_flags & IFF_BRIDGE_PORT)) {
    1091 + netif_is_bridge_port(dev)) {
    1092 struct net_device *br_dev = netdev_master_upper_dev_get(dev);
    1093 const struct net_device_ops *ops = br_dev->netdev_ops;
    1094
    1095 @@ -3840,7 +3840,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,
    1096
    1097 /* Support fdb on master device the net/bridge default case */
    1098 if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) &&
    1099 - (dev->priv_flags & IFF_BRIDGE_PORT)) {
    1100 + netif_is_bridge_port(dev)) {
    1101 struct net_device *br_dev = netdev_master_upper_dev_get(dev);
    1102 const struct net_device_ops *ops = br_dev->netdev_ops;
    1103
    1104 @@ -4066,13 +4066,13 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
    1105 continue;
    1106
    1107 if (!br_idx) { /* user did not specify a specific bridge */
    1108 - if (dev->priv_flags & IFF_BRIDGE_PORT) {
    1109 + if (netif_is_bridge_port(dev)) {
    1110 br_dev = netdev_master_upper_dev_get(dev);
    1111 cops = br_dev->netdev_ops;
    1112 }
    1113 } else {
    1114 if (dev != br_dev &&
    1115 - !(dev->priv_flags & IFF_BRIDGE_PORT))
    1116 + !netif_is_bridge_port(dev))
    1117 continue;
    1118
    1119 if (br_dev != netdev_master_upper_dev_get(dev) &&
    1120 @@ -4084,7 +4084,7 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
    1121 if (idx < s_idx)
    1122 goto cont;
    1123
    1124 - if (dev->priv_flags & IFF_BRIDGE_PORT) {
    1125 + if (netif_is_bridge_port(dev)) {
    1126 if (cops && cops->ndo_fdb_dump) {
    1127 err = cops->ndo_fdb_dump(skb, cb,
    1128 br_dev, dev,
    1129 @@ -4234,7 +4234,7 @@ static int rtnl_fdb_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
    1130
    1131 if (dev) {
    1132 if (!ndm_flags || (ndm_flags & NTF_MASTER)) {
    1133 - if (!(dev->priv_flags & IFF_BRIDGE_PORT)) {
    1134 + if (!netif_is_bridge_port(dev)) {
    1135 NL_SET_ERR_MSG(extack, "Device is not a bridge port");
    1136 return -EINVAL;
    1137 }
    1138 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    1139 index 539492998864e..d1feec97fa062 100644
    1140 --- a/net/ipv4/route.c
    1141 +++ b/net/ipv4/route.c
    1142 @@ -631,14 +631,14 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
    1143 kfree_rcu(oldest, rcu);
    1144 }
    1145
    1146 -static inline u32 fnhe_hashfun(__be32 daddr)
    1147 +static u32 fnhe_hashfun(__be32 daddr)
    1148 {
    1149 - static u32 fnhe_hashrnd __read_mostly;
    1150 - u32 hval;
    1151 + static siphash_key_t fnhe_hash_key __read_mostly;
    1152 + u64 hval;
    1153
    1154 - net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
    1155 - hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
    1156 - return hash_32(hval, FNHE_HASH_SHIFT);
    1157 + net_get_random_once(&fnhe_hash_key, sizeof(fnhe_hash_key));
    1158 + hval = siphash_1u32((__force u32)daddr, &fnhe_hash_key);
    1159 + return hash_64(hval, FNHE_HASH_SHIFT);
    1160 }
    1161
    1162 static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
    1163 diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
    1164 index 6a0c4326d9cf2..7df7ec74807ac 100644
    1165 --- a/net/ipv4/tcp_bpf.c
    1166 +++ b/net/ipv4/tcp_bpf.c
    1167 @@ -313,6 +313,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
    1168 bool cork = false, enospc = sk_msg_full(msg);
    1169 struct sock *sk_redir;
    1170 u32 tosend, delta = 0;
    1171 + u32 eval = __SK_NONE;
    1172 int ret;
    1173
    1174 more_data:
    1175 @@ -356,13 +357,24 @@ more_data:
    1176 case __SK_REDIRECT:
    1177 sk_redir = psock->sk_redir;
    1178 sk_msg_apply_bytes(psock, tosend);
    1179 + if (!psock->apply_bytes) {
    1180 + /* Clean up before releasing the sock lock. */
    1181 + eval = psock->eval;
    1182 + psock->eval = __SK_NONE;
    1183 + psock->sk_redir = NULL;
    1184 + }
    1185 if (psock->cork) {
    1186 cork = true;
    1187 psock->cork = NULL;
    1188 }
    1189 sk_msg_return(sk, msg, tosend);
    1190 release_sock(sk);
    1191 +
    1192 ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags);
    1193 +
    1194 + if (eval == __SK_REDIRECT)
    1195 + sock_put(sk_redir);
    1196 +
    1197 lock_sock(sk);
    1198 if (unlikely(ret < 0)) {
    1199 int free = sk_msg_free_nocharge(sk, msg);
    1200 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    1201 index 3fb259c20546e..daa876c6ae8db 100644
    1202 --- a/net/ipv6/route.c
    1203 +++ b/net/ipv6/route.c
    1204 @@ -41,6 +41,7 @@
    1205 #include <linux/nsproxy.h>
    1206 #include <linux/slab.h>
    1207 #include <linux/jhash.h>
    1208 +#include <linux/siphash.h>
    1209 #include <net/net_namespace.h>
    1210 #include <net/snmp.h>
    1211 #include <net/ipv6.h>
    1212 @@ -1502,17 +1503,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
    1213 static u32 rt6_exception_hash(const struct in6_addr *dst,
    1214 const struct in6_addr *src)
    1215 {
    1216 - static u32 seed __read_mostly;
    1217 - u32 val;
    1218 + static siphash_key_t rt6_exception_key __read_mostly;
    1219 + struct {
    1220 + struct in6_addr dst;
    1221 + struct in6_addr src;
    1222 + } __aligned(SIPHASH_ALIGNMENT) combined = {
    1223 + .dst = *dst,
    1224 + };
    1225 + u64 val;
    1226
    1227 - net_get_random_once(&seed, sizeof(seed));
    1228 - val = jhash(dst, sizeof(*dst), seed);
    1229 + net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key));
    1230
    1231 #ifdef CONFIG_IPV6_SUBTREES
    1232 if (src)
    1233 - val = jhash(src, sizeof(*src), val);
    1234 + combined.src = *src;
    1235 #endif
    1236 - return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
    1237 + val = siphash(&combined, sizeof(combined), &rt6_exception_key);
    1238 +
    1239 + return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
    1240 }
    1241
    1242 /* Helper function to find the cached rt in the hash table
    1243 diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
    1244 index 82a202d71a31e..7c6dcbc8e98ba 100644
    1245 --- a/net/sctp/sm_statefuns.c
    1246 +++ b/net/sctp/sm_statefuns.c
    1247 @@ -697,6 +697,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
    1248 struct sock *sk;
    1249 int error = 0;
    1250
    1251 + if (asoc && !sctp_vtag_verify(chunk, asoc))
    1252 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1253 +
    1254 /* If the packet is an OOTB packet which is temporarily on the
    1255 * control endpoint, respond with an ABORT.
    1256 */
    1257 @@ -711,7 +714,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
    1258 * in sctp_unpack_cookie().
    1259 */
    1260 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1261 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1262 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1263 + commands);
    1264
    1265 /* If the endpoint is not listening or if the number of associations
    1266 * on the TCP-style socket exceed the max backlog, respond with an
    1267 @@ -2141,9 +2145,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
    1268 * enough for the chunk header. Cookie length verification is
    1269 * done later.
    1270 */
    1271 - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1272 - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1273 - commands);
    1274 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) {
    1275 + if (!sctp_vtag_verify(chunk, asoc))
    1276 + asoc = NULL;
    1277 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands);
    1278 + }
    1279
    1280 /* "Decode" the chunk. We have no optional parameters so we
    1281 * are in good shape.
    1282 @@ -2280,7 +2286,7 @@ enum sctp_disposition sctp_sf_shutdown_pending_abort(
    1283 */
    1284 if (SCTP_ADDR_DEL ==
    1285 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
    1286 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
    1287 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1288
    1289 if (!sctp_err_chunk_valid(chunk))
    1290 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1291 @@ -2326,7 +2332,7 @@ enum sctp_disposition sctp_sf_shutdown_sent_abort(
    1292 */
    1293 if (SCTP_ADDR_DEL ==
    1294 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
    1295 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
    1296 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1297
    1298 if (!sctp_err_chunk_valid(chunk))
    1299 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1300 @@ -2596,7 +2602,7 @@ enum sctp_disposition sctp_sf_do_9_1_abort(
    1301 */
    1302 if (SCTP_ADDR_DEL ==
    1303 sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
    1304 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
    1305 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1306
    1307 if (!sctp_err_chunk_valid(chunk))
    1308 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1309 @@ -3562,6 +3568,9 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
    1310
    1311 SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
    1312
    1313 + if (asoc && !sctp_vtag_verify(chunk, asoc))
    1314 + asoc = NULL;
    1315 +
    1316 ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
    1317 do {
    1318 /* Report violation if the chunk is less then minimal */
    1319 @@ -3677,12 +3686,6 @@ static enum sctp_disposition sctp_sf_shut_8_4_5(
    1320
    1321 SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
    1322
    1323 - /* If the chunk length is invalid, we don't want to process
    1324 - * the reset of the packet.
    1325 - */
    1326 - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1327 - return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1328 -
    1329 /* We need to discard the rest of the packet to prevent
    1330 * potential bomming attacks from additional bundled chunks.
    1331 * This is documented in SCTP Threats ID.
    1332 @@ -3710,6 +3713,9 @@ enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
    1333 {
    1334 struct sctp_chunk *chunk = arg;
    1335
    1336 + if (!sctp_vtag_verify(chunk, asoc))
    1337 + asoc = NULL;
    1338 +
    1339 /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
    1340 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1341 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1342 @@ -3745,6 +3751,11 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
    1343 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1344 }
    1345
    1346 + /* Make sure that the ASCONF ADDIP chunk has a valid length. */
    1347 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
    1348 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1349 + commands);
    1350 +
    1351 /* ADD-IP: Section 4.1.1
    1352 * This chunk MUST be sent in an authenticated way by using
    1353 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
    1354 @@ -3753,13 +3764,7 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
    1355 */
    1356 if (!asoc->peer.asconf_capable ||
    1357 (!net->sctp.addip_noauth && !chunk->auth))
    1358 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
    1359 - commands);
    1360 -
    1361 - /* Make sure that the ASCONF ADDIP chunk has a valid length. */
    1362 - if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
    1363 - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1364 - commands);
    1365 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1366
    1367 hdr = (struct sctp_addiphdr *)chunk->skb->data;
    1368 serial = ntohl(hdr->serial);
    1369 @@ -3888,6 +3893,12 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
    1370 return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1371 }
    1372
    1373 + /* Make sure that the ADDIP chunk has a valid length. */
    1374 + if (!sctp_chunk_length_valid(asconf_ack,
    1375 + sizeof(struct sctp_addip_chunk)))
    1376 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1377 + commands);
    1378 +
    1379 /* ADD-IP, Section 4.1.2:
    1380 * This chunk MUST be sent in an authenticated way by using
    1381 * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
    1382 @@ -3896,14 +3907,7 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
    1383 */
    1384 if (!asoc->peer.asconf_capable ||
    1385 (!net->sctp.addip_noauth && !asconf_ack->auth))
    1386 - return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
    1387 - commands);
    1388 -
    1389 - /* Make sure that the ADDIP chunk has a valid length. */
    1390 - if (!sctp_chunk_length_valid(asconf_ack,
    1391 - sizeof(struct sctp_addip_chunk)))
    1392 - return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1393 - commands);
    1394 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1395
    1396 addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
    1397 rcvd_serial = ntohl(addip_hdr->serial);
    1398 @@ -4475,6 +4479,9 @@ enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
    1399 {
    1400 struct sctp_chunk *chunk = arg;
    1401
    1402 + if (asoc && !sctp_vtag_verify(chunk, asoc))
    1403 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1404 +
    1405 /* Make sure that the chunk has a valid length.
    1406 * Since we don't know the chunk type, we use a general
    1407 * chunkhdr structure to make a comparison.
    1408 @@ -4542,6 +4549,9 @@ enum sctp_disposition sctp_sf_violation(struct net *net,
    1409 {
    1410 struct sctp_chunk *chunk = arg;
    1411
    1412 + if (!sctp_vtag_verify(chunk, asoc))
    1413 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
    1414 +
    1415 /* Make sure that the chunk has a valid length. */
    1416 if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
    1417 return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
    1418 @@ -6248,6 +6258,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(
    1419 * yet.
    1420 */
    1421 switch (chunk->chunk_hdr->type) {
    1422 + case SCTP_CID_INIT:
    1423 case SCTP_CID_INIT_ACK:
    1424 {
    1425 struct sctp_initack_chunk *initack;
    1426 diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
    1427 index 7fb5c067f4293..02821b9140546 100644
    1428 --- a/net/tls/tls_sw.c
    1429 +++ b/net/tls/tls_sw.c
    1430 @@ -35,6 +35,7 @@
    1431 * SOFTWARE.
    1432 */
    1433
    1434 +#include <linux/bug.h>
    1435 #include <linux/sched/signal.h>
    1436 #include <linux/module.h>
    1437 #include <linux/splice.h>
    1438 @@ -43,6 +44,14 @@
    1439 #include <net/strparser.h>
    1440 #include <net/tls.h>
    1441
    1442 +noinline void tls_err_abort(struct sock *sk, int err)
    1443 +{
    1444 + WARN_ON_ONCE(err >= 0);
    1445 + /* sk->sk_err should contain a positive error code. */
    1446 + sk->sk_err = -err;
    1447 + sk->sk_error_report(sk);
    1448 +}
    1449 +
    1450 static int __skb_nsg(struct sk_buff *skb, int offset, int len,
    1451 unsigned int recursion_level)
    1452 {
    1453 @@ -416,7 +425,7 @@ int tls_tx_records(struct sock *sk, int flags)
    1454
    1455 tx_err:
    1456 if (rc < 0 && rc != -EAGAIN)
    1457 - tls_err_abort(sk, EBADMSG);
    1458 + tls_err_abort(sk, -EBADMSG);
    1459
    1460 return rc;
    1461 }
    1462 @@ -447,7 +456,7 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err)
    1463
    1464 /* If err is already set on socket, return the same code */
    1465 if (sk->sk_err) {
    1466 - ctx->async_wait.err = sk->sk_err;
    1467 + ctx->async_wait.err = -sk->sk_err;
    1468 } else {
    1469 ctx->async_wait.err = err;
    1470 tls_err_abort(sk, err);
    1471 @@ -761,7 +770,7 @@ static int tls_push_record(struct sock *sk, int flags,
    1472 msg_pl->sg.size + prot->tail_size, i);
    1473 if (rc < 0) {
    1474 if (rc != -EINPROGRESS) {
    1475 - tls_err_abort(sk, EBADMSG);
    1476 + tls_err_abort(sk, -EBADMSG);
    1477 if (split) {
    1478 tls_ctx->pending_open_record_frags = true;
    1479 tls_merge_open_record(sk, rec, tmp, orig_end);
    1480 @@ -1822,7 +1831,7 @@ int tls_sw_recvmsg(struct sock *sk,
    1481 err = decrypt_skb_update(sk, skb, &msg->msg_iter,
    1482 &chunk, &zc, async_capable);
    1483 if (err < 0 && err != -EINPROGRESS) {
    1484 - tls_err_abort(sk, EBADMSG);
    1485 + tls_err_abort(sk, -EBADMSG);
    1486 goto recv_end;
    1487 }
    1488
    1489 @@ -2002,7 +2011,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
    1490 }
    1491
    1492 if (err < 0) {
    1493 - tls_err_abort(sk, EBADMSG);
    1494 + tls_err_abort(sk, -EBADMSG);
    1495 goto splice_read_end;
    1496 }
    1497 ctx->decrypted = true;
    1498 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    1499 index 7b170ed6923e7..7633d6a74bc2b 100644
    1500 --- a/net/wireless/nl80211.c
    1501 +++ b/net/wireless/nl80211.c
    1502 @@ -3480,7 +3480,7 @@ static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
    1503 enum nl80211_iftype iftype)
    1504 {
    1505 if (!use_4addr) {
    1506 - if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
    1507 + if (netdev && netif_is_bridge_port(netdev))
    1508 return -EBUSY;
    1509 return 0;
    1510 }
    1511 diff --git a/net/wireless/scan.c b/net/wireless/scan.c
    1512 index 1580535d53f86..6cefaad3b7f84 100644
    1513 --- a/net/wireless/scan.c
    1514 +++ b/net/wireless/scan.c
    1515 @@ -379,14 +379,17 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
    1516 }
    1517 ssid_len = ssid[1];
    1518 ssid = ssid + 2;
    1519 - rcu_read_unlock();
    1520
    1521 /* check if nontrans_bss is in the list */
    1522 list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
    1523 - if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len))
    1524 + if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) {
    1525 + rcu_read_unlock();
    1526 return 0;
    1527 + }
    1528 }
    1529
    1530 + rcu_read_unlock();
    1531 +
    1532 /* add to the list */
    1533 list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
    1534 return 0;
    1535 diff --git a/net/wireless/util.c b/net/wireless/util.c
    1536 index f0247eab5bc94..aaefaf3422a1a 100644
    1537 --- a/net/wireless/util.c
    1538 +++ b/net/wireless/util.c
    1539 @@ -975,14 +975,14 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
    1540 !(rdev->wiphy.interface_modes & (1 << ntype)))
    1541 return -EOPNOTSUPP;
    1542
    1543 - /* if it's part of a bridge, reject changing type to station/ibss */
    1544 - if ((dev->priv_flags & IFF_BRIDGE_PORT) &&
    1545 - (ntype == NL80211_IFTYPE_ADHOC ||
    1546 - ntype == NL80211_IFTYPE_STATION ||
    1547 - ntype == NL80211_IFTYPE_P2P_CLIENT))
    1548 - return -EBUSY;
    1549 -
    1550 if (ntype != otype) {
    1551 + /* if it's part of a bridge, reject changing type to station/ibss */
    1552 + if (netif_is_bridge_port(dev) &&
    1553 + (ntype == NL80211_IFTYPE_ADHOC ||
    1554 + ntype == NL80211_IFTYPE_STATION ||
    1555 + ntype == NL80211_IFTYPE_P2P_CLIENT))
    1556 + return -EBUSY;
    1557 +
    1558 dev->ieee80211_ptr->use_4addr = false;
    1559 dev->ieee80211_ptr->mesh_id_up_len = 0;
    1560 wdev_lock(dev->ieee80211_ptr);
    1561 diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
    1562 index f3ff825d9dd33..3a169a026635d 100644
    1563 --- a/tools/perf/builtin-script.c
    1564 +++ b/tools/perf/builtin-script.c
    1565 @@ -3779,11 +3779,15 @@ int cmd_script(int argc, const char **argv)
    1566 goto out_delete;
    1567
    1568 uname(&uts);
    1569 - if (data.is_pipe || /* assume pipe_mode indicates native_arch */
    1570 - !strcmp(uts.machine, session->header.env.arch) ||
    1571 - (!strcmp(uts.machine, "x86_64") &&
    1572 - !strcmp(session->header.env.arch, "i386")))
    1573 + if (data.is_pipe) { /* Assume pipe_mode indicates native_arch */
    1574 native_arch = true;
    1575 + } else if (session->header.env.arch) {
    1576 + if (!strcmp(uts.machine, session->header.env.arch))
    1577 + native_arch = true;
    1578 + else if (!strcmp(uts.machine, "x86_64") &&
    1579 + !strcmp(session->header.env.arch, "i386"))
    1580 + native_arch = true;
    1581 + }
    1582
    1583 script.session = session;
    1584 script__setup_sample_type(&script);