Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-5.4/0270-5.4.171-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-5.4/0270-5.4.171-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3635 - (show annotations) (download)
    Mon Oct 24 12:34:12 2022 UTC (19 months, 1 week ago) by niro
    File size: 31290 byte(s) 
    -sync kernel patches
    1 diff --git a/Makefile b/Makefile
    2 index 7380354e49513..062052f71a976 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 5
    8 PATCHLEVEL = 4
    9 -SUBLEVEL = 170
    10 +SUBLEVEL = 171
    11 EXTRAVERSION =
    12 NAME = Kleptomaniac Octopus
    13
    14 diff --git a/drivers/infiniband/core/uverbs_marshall.c b/drivers/infiniband/core/uverbs_marshall.c
    15 index b8d715c68ca44..11a0806469162 100644
    16 --- a/drivers/infiniband/core/uverbs_marshall.c
    17 +++ b/drivers/infiniband/core/uverbs_marshall.c
    18 @@ -66,7 +66,7 @@ void ib_copy_ah_attr_to_user(struct ib_device *device,
    19 struct rdma_ah_attr *src = ah_attr;
    20 struct rdma_ah_attr conv_ah;
    21
    22 - memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
    23 + memset(&dst->grh, 0, sizeof(dst->grh));
    24
    25 if ((ah_attr->type == RDMA_AH_ATTR_TYPE_OPA) &&
    26 (rdma_ah_get_dlid(ah_attr) > be16_to_cpu(IB_LID_PERMISSIVE)) &&
    27 diff --git a/drivers/infiniband/core/uverbs_uapi.c b/drivers/infiniband/core/uverbs_uapi.c
    28 index 00c5478871322..818699b855c5c 100644
    29 --- a/drivers/infiniband/core/uverbs_uapi.c
    30 +++ b/drivers/infiniband/core/uverbs_uapi.c
    31 @@ -450,6 +450,9 @@ static int uapi_finalize(struct uverbs_api *uapi)
    32 uapi->num_write_ex = max_write_ex + 1;
    33 data = kmalloc_array(uapi->num_write + uapi->num_write_ex,
    34 sizeof(*uapi->write_methods), GFP_KERNEL);
    35 + if (!data)
    36 + return -ENOMEM;
    37 +
    38 for (i = 0; i != uapi->num_write + uapi->num_write_ex; i++)
    39 data[i] = &uapi->notsupp_method;
    40 uapi->write_methods = data;
    41 diff --git a/drivers/input/touchscreen/of_touchscreen.c b/drivers/input/touchscreen/of_touchscreen.c
    42 index 2962c3747adc3..ed5fbcb40e3f0 100644
    43 --- a/drivers/input/touchscreen/of_touchscreen.c
    44 +++ b/drivers/input/touchscreen/of_touchscreen.c
    45 @@ -77,8 +77,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch,
    46 axis = multitouch ? ABS_MT_POSITION_X : ABS_X;
    47 data_present = touchscreen_get_prop_u32(dev, "touchscreen-min-x",
    48 input_abs_get_min(input, axis),
    49 - &minimum) |
    50 - touchscreen_get_prop_u32(dev, "touchscreen-size-x",
    51 + &minimum);
    52 + data_present |= touchscreen_get_prop_u32(dev, "touchscreen-size-x",
    53 input_abs_get_max(input,
    54 axis) + 1,
    55 &maximum);
    56 @@ -91,8 +91,8 @@ void touchscreen_parse_properties(struct input_dev *input, bool multitouch,
    57 axis = multitouch ? ABS_MT_POSITION_Y : ABS_Y;
    58 data_present = touchscreen_get_prop_u32(dev, "touchscreen-min-y",
    59 input_abs_get_min(input, axis),
    60 - &minimum) |
    61 - touchscreen_get_prop_u32(dev, "touchscreen-size-y",
    62 + &minimum);
    63 + data_present |= touchscreen_get_prop_u32(dev, "touchscreen-size-y",
    64 input_abs_get_max(input,
    65 axis) + 1,
    66 &maximum);
    67 diff --git a/drivers/isdn/mISDN/core.c b/drivers/isdn/mISDN/core.c
    68 index 55891e4204460..a41b4b2645941 100644
    69 --- a/drivers/isdn/mISDN/core.c
    70 +++ b/drivers/isdn/mISDN/core.c
    71 @@ -381,7 +381,7 @@ mISDNInit(void)
    72 err = mISDN_inittimer(&debug);
    73 if (err)
    74 goto error2;
    75 - err = l1_init(&debug);
    76 + err = Isdnl1_Init(&debug);
    77 if (err)
    78 goto error3;
    79 err = Isdnl2_Init(&debug);
    80 @@ -395,7 +395,7 @@ mISDNInit(void)
    81 error5:
    82 Isdnl2_cleanup();
    83 error4:
    84 - l1_cleanup();
    85 + Isdnl1_cleanup();
    86 error3:
    87 mISDN_timer_cleanup();
    88 error2:
    89 @@ -408,7 +408,7 @@ static void mISDN_cleanup(void)
    90 {
    91 misdn_sock_cleanup();
    92 Isdnl2_cleanup();
    93 - l1_cleanup();
    94 + Isdnl1_cleanup();
    95 mISDN_timer_cleanup();
    96 class_unregister(&mISDN_class);
    97
    98 diff --git a/drivers/isdn/mISDN/core.h b/drivers/isdn/mISDN/core.h
    99 index 23b44d3033279..42599f49c189d 100644
    100 --- a/drivers/isdn/mISDN/core.h
    101 +++ b/drivers/isdn/mISDN/core.h
    102 @@ -60,8 +60,8 @@ struct Bprotocol *get_Bprotocol4id(u_int);
    103 extern int mISDN_inittimer(u_int *);
    104 extern void mISDN_timer_cleanup(void);
    105
    106 -extern int l1_init(u_int *);
    107 -extern void l1_cleanup(void);
    108 +extern int Isdnl1_Init(u_int *);
    109 +extern void Isdnl1_cleanup(void);
    110 extern int Isdnl2_Init(u_int *);
    111 extern void Isdnl2_cleanup(void);
    112
    113 diff --git a/drivers/isdn/mISDN/layer1.c b/drivers/isdn/mISDN/layer1.c
    114 index 98a3bc6c17009..7b31c25a550e3 100644
    115 --- a/drivers/isdn/mISDN/layer1.c
    116 +++ b/drivers/isdn/mISDN/layer1.c
    117 @@ -398,7 +398,7 @@ create_l1(struct dchannel *dch, dchannel_l1callback *dcb) {
    118 EXPORT_SYMBOL(create_l1);
    119
    120 int
    121 -l1_init(u_int *deb)
    122 +Isdnl1_Init(u_int *deb)
    123 {
    124 debug = deb;
    125 l1fsm_s.state_count = L1S_STATE_COUNT;
    126 @@ -409,7 +409,7 @@ l1_init(u_int *deb)
    127 }
    128
    129 void
    130 -l1_cleanup(void)
    131 +Isdnl1_cleanup(void)
    132 {
    133 mISDN_FsmFree(&l1fsm_s);
    134 }
    135 diff --git a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
    136 index 03821b46a8cb4..4c22f119ac62f 100644
    137 --- a/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
    138 +++ b/drivers/net/ethernet/aquantia/atlantic/aq_ring.c
    139 @@ -305,6 +305,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
    140 if (!buff->is_eop) {
    141 buff_ = buff;
    142 do {
    143 + if (buff_->next >= self->size) {
    144 + err = -EIO;
    145 + goto err_exit;
    146 + }
    147 next_ = buff_->next,
    148 buff_ = &self->buff_ring[next_];
    149 is_rsc_completed =
    150 @@ -327,6 +331,10 @@ int aq_ring_rx_clean(struct aq_ring_s *self,
    151 if (buff->is_error || buff->is_cso_err) {
    152 buff_ = buff;
    153 do {
    154 + if (buff_->next >= self->size) {
    155 + err = -EIO;
    156 + goto err_exit;
    157 + }
    158 next_ = buff_->next,
    159 buff_ = &self->buff_ring[next_];
    160
    161 diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
    162 index ce237da003ddb..a2326683be170 100644
    163 --- a/drivers/net/ethernet/intel/i40e/i40e_main.c
    164 +++ b/drivers/net/ethernet/intel/i40e/i40e_main.c
    165 @@ -107,6 +107,24 @@ MODULE_VERSION(DRV_VERSION);
    166
    167 static struct workqueue_struct *i40e_wq;
    168
    169 +static void netdev_hw_addr_refcnt(struct i40e_mac_filter *f,
    170 + struct net_device *netdev, int delta)
    171 +{
    172 + struct netdev_hw_addr *ha;
    173 +
    174 + if (!f || !netdev)
    175 + return;
    176 +
    177 + netdev_for_each_mc_addr(ha, netdev) {
    178 + if (ether_addr_equal(ha->addr, f->macaddr)) {
    179 + ha->refcount += delta;
    180 + if (ha->refcount <= 0)
    181 + ha->refcount = 1;
    182 + break;
    183 + }
    184 + }
    185 +}
    186 +
    187 /**
    188 * i40e_allocate_dma_mem_d - OS specific memory alloc for shared code
    189 * @hw: pointer to the HW structure
    190 @@ -2022,6 +2040,7 @@ static void i40e_undo_add_filter_entries(struct i40e_vsi *vsi,
    191 hlist_for_each_entry_safe(new, h, from, hlist) {
    192 /* We can simply free the wrapper structure */
    193 hlist_del(&new->hlist);
    194 + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1);
    195 kfree(new);
    196 }
    197 }
    198 @@ -2369,6 +2388,10 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
    199 &tmp_add_list,
    200 &tmp_del_list,
    201 vlan_filters);
    202 +
    203 + hlist_for_each_entry(new, &tmp_add_list, hlist)
    204 + netdev_hw_addr_refcnt(new->f, vsi->netdev, 1);
    205 +
    206 if (retval)
    207 goto err_no_memory_locked;
    208
    209 @@ -2501,6 +2524,7 @@ int i40e_sync_vsi_filters(struct i40e_vsi *vsi)
    210 if (new->f->state == I40E_FILTER_NEW)
    211 new->f->state = new->state;
    212 hlist_del(&new->hlist);
    213 + netdev_hw_addr_refcnt(new->f, vsi->netdev, -1);
    214 kfree(new);
    215 }
    216 spin_unlock_bh(&vsi->mac_filter_hash_lock);
    217 @@ -8302,6 +8326,27 @@ int i40e_open(struct net_device *netdev)
    218 return 0;
    219 }
    220
    221 +/**
    222 + * i40e_netif_set_realnum_tx_rx_queues - Update number of tx/rx queues
    223 + * @vsi: vsi structure
    224 + *
    225 + * This updates netdev's number of tx/rx queues
    226 + *
    227 + * Returns status of setting tx/rx queues
    228 + **/
    229 +static int i40e_netif_set_realnum_tx_rx_queues(struct i40e_vsi *vsi)
    230 +{
    231 + int ret;
    232 +
    233 + ret = netif_set_real_num_rx_queues(vsi->netdev,
    234 + vsi->num_queue_pairs);
    235 + if (ret)
    236 + return ret;
    237 +
    238 + return netif_set_real_num_tx_queues(vsi->netdev,
    239 + vsi->num_queue_pairs);
    240 +}
    241 +
    242 /**
    243 * i40e_vsi_open -
    244 * @vsi: the VSI to open
    245 @@ -8338,13 +8383,7 @@ int i40e_vsi_open(struct i40e_vsi *vsi)
    246 goto err_setup_rx;
    247
    248 /* Notify the stack of the actual queue counts. */
    249 - err = netif_set_real_num_tx_queues(vsi->netdev,
    250 - vsi->num_queue_pairs);
    251 - if (err)
    252 - goto err_set_queues;
    253 -
    254 - err = netif_set_real_num_rx_queues(vsi->netdev,
    255 - vsi->num_queue_pairs);
    256 + err = i40e_netif_set_realnum_tx_rx_queues(vsi);
    257 if (err)
    258 goto err_set_queues;
    259
    260 @@ -13766,6 +13805,9 @@ struct i40e_vsi *i40e_vsi_setup(struct i40e_pf *pf, u8 type,
    261 case I40E_VSI_MAIN:
    262 case I40E_VSI_VMDQ2:
    263 ret = i40e_config_netdev(vsi);
    264 + if (ret)
    265 + goto err_netdev;
    266 + ret = i40e_netif_set_realnum_tx_rx_queues(vsi);
    267 if (ret)
    268 goto err_netdev;
    269 ret = register_netdev(vsi->netdev);
    270 @@ -15012,8 +15054,8 @@ static int i40e_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
    271
    272 if (hw->aq.api_maj_ver == I40E_FW_API_VERSION_MAJOR &&
    273 hw->aq.api_min_ver > I40E_FW_MINOR_VERSION(hw))
    274 - dev_info(&pdev->dev,
    275 - "The driver for the device detected a newer version of the NVM image v%u.%u than expected v%u.%u. Please install the most recent version of the network driver.\n",
    276 + dev_dbg(&pdev->dev,
    277 + "The driver for the device detected a newer version of the NVM image v%u.%u than v%u.%u.\n",
    278 hw->aq.api_maj_ver,
    279 hw->aq.api_min_ver,
    280 I40E_FW_API_VERSION_MAJOR,
    281 diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
    282 index 449eb06e2c7da..309e953ed1e44 100644
    283 --- a/drivers/net/ethernet/intel/iavf/iavf_main.c
    284 +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
    285 @@ -2604,8 +2604,11 @@ static int iavf_validate_ch_config(struct iavf_adapter *adapter,
    286 total_max_rate += tx_rate;
    287 num_qps += mqprio_qopt->qopt.count[i];
    288 }
    289 - if (num_qps > IAVF_MAX_REQ_QUEUES)
    290 + if (num_qps > adapter->num_active_queues) {
    291 + dev_err(&adapter->pdev->dev,
    292 + "Cannot support requested number of queues\n");
    293 return -EINVAL;
    294 + }
    295
    296 ret = iavf_validate_tx_bandwidth(adapter, total_max_rate);
    297 return ret;
    298 diff --git a/drivers/net/ieee802154/atusb.c b/drivers/net/ieee802154/atusb.c
    299 index 23ee0b14cbfa1..2f5e7b31032aa 100644
    300 --- a/drivers/net/ieee802154/atusb.c
    301 +++ b/drivers/net/ieee802154/atusb.c
    302 @@ -93,7 +93,9 @@ static int atusb_control_msg(struct atusb *atusb, unsigned int pipe,
    303
    304 ret = usb_control_msg(usb_dev, pipe, request, requesttype,
    305 value, index, data, size, timeout);
    306 - if (ret < 0) {
    307 + if (ret < size) {
    308 + ret = ret < 0 ? ret : -ENODATA;
    309 +
    310 atusb->err = ret;
    311 dev_err(&usb_dev->dev,
    312 "%s: req 0x%02x val 0x%x idx 0x%x, error %d\n",
    313 @@ -861,9 +863,9 @@ static int atusb_get_and_show_build(struct atusb *atusb)
    314 if (!build)
    315 return -ENOMEM;
    316
    317 - ret = atusb_control_msg(atusb, usb_rcvctrlpipe(usb_dev, 0),
    318 - ATUSB_BUILD, ATUSB_REQ_FROM_DEV, 0, 0,
    319 - build, ATUSB_BUILD_SIZE, 1000);
    320 + /* We cannot call atusb_control_msg() here, since this request may read various length data */
    321 + ret = usb_control_msg(atusb->usb_dev, usb_rcvctrlpipe(usb_dev, 0), ATUSB_BUILD,
    322 + ATUSB_REQ_FROM_DEV, 0, 0, build, ATUSB_BUILD_SIZE, 1000);
    323 if (ret >= 0) {
    324 build[ret] = 0;
    325 dev_info(&usb_dev->dev, "Firmware: build %s\n", build);
    326 diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
    327 index 0b61d80ea3f8c..18cc5e4280e83 100644
    328 --- a/drivers/net/phy/micrel.c
    329 +++ b/drivers/net/phy/micrel.c
    330 @@ -1096,6 +1096,7 @@ static struct phy_driver ksphy_driver[] = {
    331 .probe = kszphy_probe,
    332 .config_init = ksz8081_config_init,
    333 .ack_interrupt = kszphy_ack_interrupt,
    334 + .soft_reset = genphy_soft_reset,
    335 .config_intr = kszphy_config_intr,
    336 .get_sset_count = kszphy_get_sset_count,
    337 .get_strings = kszphy_get_strings,
    338 diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
    339 index f9b359d4e2939..1505fe3f87ed3 100644
    340 --- a/drivers/net/usb/rndis_host.c
    341 +++ b/drivers/net/usb/rndis_host.c
    342 @@ -608,6 +608,11 @@ static const struct usb_device_id products [] = {
    343 USB_DEVICE_AND_INTERFACE_INFO(0x1630, 0x0042,
    344 USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
    345 .driver_info = (unsigned long) &rndis_poll_status_info,
    346 +}, {
    347 + /* Hytera Communications DMR radios' "Radio to PC Network" */
    348 + USB_VENDOR_AND_INTERFACE_INFO(0x238b,
    349 + USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
    350 + .driver_info = (unsigned long)&rndis_info,
    351 }, {
    352 /* RNDIS is MSFT's un-official variant of CDC ACM */
    353 USB_INTERFACE_INFO(USB_CLASS_COMM, 2 /* ACM */, 0x0ff),
    354 diff --git a/drivers/power/reset/ltc2952-poweroff.c b/drivers/power/reset/ltc2952-poweroff.c
    355 index e4a0cc45b3d11..ec613bcc0a302 100644
    356 --- a/drivers/power/reset/ltc2952-poweroff.c
    357 +++ b/drivers/power/reset/ltc2952-poweroff.c
    358 @@ -160,8 +160,8 @@ static void ltc2952_poweroff_kill(void)
    359
    360 static void ltc2952_poweroff_default(struct ltc2952_poweroff *data)
    361 {
    362 - data->wde_interval = 300L * 1E6L;
    363 - data->trigger_delay = ktime_set(2, 500L*1E6L);
    364 + data->wde_interval = 300L * NSEC_PER_MSEC;
    365 + data->trigger_delay = ktime_set(2, 500L * NSEC_PER_MSEC);
    366
    367 hrtimer_init(&data->timer_trigger, CLOCK_MONOTONIC, HRTIMER_MODE_REL);
    368 data->timer_trigger.function = ltc2952_poweroff_timer_trigger;
    369 diff --git a/drivers/power/supply/power_supply_core.c b/drivers/power/supply/power_supply_core.c
    370 index 5c36c430ce8b6..a2f56a68c50d6 100644
    371 --- a/drivers/power/supply/power_supply_core.c
    372 +++ b/drivers/power/supply/power_supply_core.c
    373 @@ -742,6 +742,10 @@ power_supply_find_ocv2cap_table(struct power_supply_battery_info *info,
    374 return NULL;
    375
    376 for (i = 0; i < POWER_SUPPLY_OCV_TEMP_MAX; i++) {
    377 + /* Out of capacity tables */
    378 + if (!info->ocv_table[i])
    379 + break;
    380 +
    381 temp_diff = abs(info->ocv_temp[i] - temp);
    382
    383 if (temp_diff < best_temp_diff) {
    384 diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
    385 index eeba6180711cd..f3cee64c6d12f 100644
    386 --- a/drivers/scsi/libiscsi.c
    387 +++ b/drivers/scsi/libiscsi.c
    388 @@ -2948,6 +2948,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
    389 {
    390 struct iscsi_conn *conn = cls_conn->dd_data;
    391 struct iscsi_session *session = conn->session;
    392 + char *tmp_persistent_address = conn->persistent_address;
    393 + char *tmp_local_ipaddr = conn->local_ipaddr;
    394
    395 del_timer_sync(&conn->transport_timer);
    396
    397 @@ -2969,8 +2971,6 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
    398 spin_lock_bh(&session->frwd_lock);
    399 free_pages((unsigned long) conn->data,
    400 get_order(ISCSI_DEF_MAX_RECV_SEG_LEN));
    401 - kfree(conn->persistent_address);
    402 - kfree(conn->local_ipaddr);
    403 /* regular RX path uses back_lock */
    404 spin_lock_bh(&session->back_lock);
    405 kfifo_in(&session->cmdpool.queue, (void*)&conn->login_task,
    406 @@ -2982,6 +2982,8 @@ void iscsi_conn_teardown(struct iscsi_cls_conn *cls_conn)
    407 mutex_unlock(&session->eh_mutex);
    408
    409 iscsi_destroy_conn(cls_conn);
    410 + kfree(tmp_persistent_address);
    411 + kfree(tmp_local_ipaddr);
    412 }
    413 EXPORT_SYMBOL_GPL(iscsi_conn_teardown);
    414
    415 diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
    416 index 253c8b71d3c49..061da9b82b967 100644
    417 --- a/drivers/usb/mtu3/mtu3_gadget.c
    418 +++ b/drivers/usb/mtu3/mtu3_gadget.c
    419 @@ -85,7 +85,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep)
    420 if (usb_endpoint_xfer_int(desc) ||
    421 usb_endpoint_xfer_isoc(desc)) {
    422 interval = desc->bInterval;
    423 - interval = clamp_val(interval, 1, 16) - 1;
    424 + interval = clamp_val(interval, 1, 16);
    425 if (usb_endpoint_xfer_isoc(desc) && comp_desc)
    426 mult = comp_desc->bmAttributes;
    427 }
    428 @@ -97,7 +97,7 @@ static int mtu3_ep_enable(struct mtu3_ep *mep)
    429 if (usb_endpoint_xfer_isoc(desc) ||
    430 usb_endpoint_xfer_int(desc)) {
    431 interval = desc->bInterval;
    432 - interval = clamp_val(interval, 1, 16) - 1;
    433 + interval = clamp_val(interval, 1, 16);
    434 mult = usb_endpoint_maxp_mult(desc) - 1;
    435 }
    436 break;
    437 diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
    438 index f7d27cbbeb860..03dce3980d90a 100644
    439 --- a/fs/f2fs/checkpoint.c
    440 +++ b/fs/f2fs/checkpoint.c
    441 @@ -1144,7 +1144,8 @@ static bool __need_flush_quota(struct f2fs_sb_info *sbi)
    442 if (!is_journalled_quota(sbi))
    443 return false;
    444
    445 - down_write(&sbi->quota_sem);
    446 + if (!down_write_trylock(&sbi->quota_sem))
    447 + return true;
    448 if (is_sbi_flag_set(sbi, SBI_QUOTA_SKIP_FLUSH)) {
    449 ret = false;
    450 } else if (is_sbi_flag_set(sbi, SBI_QUOTA_NEED_REPAIR)) {
    451 diff --git a/fs/xfs/xfs_ioctl.c b/fs/xfs/xfs_ioctl.c
    452 index b3021d9b34a5e..7b7a009425e21 100644
    453 --- a/fs/xfs/xfs_ioctl.c
    454 +++ b/fs/xfs/xfs_ioctl.c
    455 @@ -714,7 +714,8 @@ xfs_ioc_space(
    456 flags |= XFS_PREALLOC_CLEAR;
    457 if (bf->l_start > XFS_ISIZE(ip)) {
    458 error = xfs_alloc_file_space(ip, XFS_ISIZE(ip),
    459 - bf->l_start - XFS_ISIZE(ip), 0);
    460 + bf->l_start - XFS_ISIZE(ip),
    461 + XFS_BMAPI_PREALLOC);
    462 if (error)
    463 goto out_unlock;
    464 }
    465 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
    466 index 5240ba9a82db8..54f5b2f080f53 100644
    467 --- a/kernel/trace/trace.c
    468 +++ b/kernel/trace/trace.c
    469 @@ -3007,7 +3007,7 @@ struct trace_buffer_struct {
    470 char buffer[4][TRACE_BUF_SIZE];
    471 };
    472
    473 -static struct trace_buffer_struct *trace_percpu_buffer;
    474 +static struct trace_buffer_struct __percpu *trace_percpu_buffer;
    475
    476 /*
    477 * Thise allows for lockless recording. If we're nested too deeply, then
    478 @@ -3017,7 +3017,7 @@ static char *get_trace_buf(void)
    479 {
    480 struct trace_buffer_struct *buffer = this_cpu_ptr(trace_percpu_buffer);
    481
    482 - if (!buffer || buffer->nesting >= 4)
    483 + if (!trace_percpu_buffer || buffer->nesting >= 4)
    484 return NULL;
    485
    486 buffer->nesting++;
    487 @@ -3036,7 +3036,7 @@ static void put_trace_buf(void)
    488
    489 static int alloc_percpu_trace_buffer(void)
    490 {
    491 - struct trace_buffer_struct *buffers;
    492 + struct trace_buffer_struct __percpu *buffers;
    493
    494 buffers = alloc_percpu(struct trace_buffer_struct);
    495 if (WARN(!buffers, "Could not allocate percpu trace_printk buffer"))
    496 diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
    497 index f5bf931252c4b..09d81f9c2a649 100644
    498 --- a/net/batman-adv/multicast.c
    499 +++ b/net/batman-adv/multicast.c
    500 @@ -1373,6 +1373,7 @@ batadv_mcast_forw_rtr_node_get(struct batadv_priv *bat_priv,
    501 * @bat_priv: the bat priv with all the soft interface information
    502 * @skb: The multicast packet to check
    503 * @orig: an originator to be set to forward the skb to
    504 + * @is_routable: stores whether the destination is routable
    505 *
    506 * Return: the forwarding mode as enum batadv_forw_mode and in case of
    507 * BATADV_FORW_SINGLE set the orig to the single originator the skb
    508 @@ -1380,17 +1381,16 @@ batadv_mcast_forw_rtr_node_get(struct batadv_priv *bat_priv,
    509 */
    510 enum batadv_forw_mode
    511 batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
    512 - struct batadv_orig_node **orig)
    513 + struct batadv_orig_node **orig, int *is_routable)
    514 {
    515 int ret, tt_count, ip_count, unsnoop_count, total_count;
    516 bool is_unsnoopable = false;
    517 unsigned int mcast_fanout;
    518 struct ethhdr *ethhdr;
    519 - int is_routable = 0;
    520 int rtr_count = 0;
    521
    522 ret = batadv_mcast_forw_mode_check(bat_priv, skb, &is_unsnoopable,
    523 - &is_routable);
    524 + is_routable);
    525 if (ret == -ENOMEM)
    526 return BATADV_FORW_NONE;
    527 else if (ret < 0)
    528 @@ -1403,7 +1403,7 @@ batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
    529 ip_count = batadv_mcast_forw_want_all_ip_count(bat_priv, ethhdr);
    530 unsnoop_count = !is_unsnoopable ? 0 :
    531 atomic_read(&bat_priv->mcast.num_want_all_unsnoopables);
    532 - rtr_count = batadv_mcast_forw_rtr_count(bat_priv, is_routable);
    533 + rtr_count = batadv_mcast_forw_rtr_count(bat_priv, *is_routable);
    534
    535 total_count = tt_count + ip_count + unsnoop_count + rtr_count;
    536
    537 @@ -1723,6 +1723,7 @@ batadv_mcast_forw_want_rtr(struct batadv_priv *bat_priv,
    538 * @bat_priv: the bat priv with all the soft interface information
    539 * @skb: the multicast packet to transmit
    540 * @vid: the vlan identifier
    541 + * @is_routable: stores whether the destination is routable
    542 *
    543 * Sends copies of a frame with multicast destination to any node that signaled
    544 * interest in it, that is either via the translation table or the according
    545 @@ -1735,7 +1736,7 @@ batadv_mcast_forw_want_rtr(struct batadv_priv *bat_priv,
    546 * is neither IPv4 nor IPv6. NET_XMIT_SUCCESS otherwise.
    547 */
    548 int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb,
    549 - unsigned short vid)
    550 + unsigned short vid, int is_routable)
    551 {
    552 int ret;
    553
    554 @@ -1751,12 +1752,16 @@ int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb,
    555 return ret;
    556 }
    557
    558 + if (!is_routable)
    559 + goto skip_mc_router;
    560 +
    561 ret = batadv_mcast_forw_want_rtr(bat_priv, skb, vid);
    562 if (ret != NET_XMIT_SUCCESS) {
    563 kfree_skb(skb);
    564 return ret;
    565 }
    566
    567 +skip_mc_router:
    568 consume_skb(skb);
    569 return ret;
    570 }
    571 diff --git a/net/batman-adv/multicast.h b/net/batman-adv/multicast.h
    572 index 403929013ac47..fc1ffd22a6715 100644
    573 --- a/net/batman-adv/multicast.h
    574 +++ b/net/batman-adv/multicast.h
    575 @@ -44,7 +44,8 @@ enum batadv_forw_mode {
    576
    577 enum batadv_forw_mode
    578 batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
    579 - struct batadv_orig_node **mcast_single_orig);
    580 + struct batadv_orig_node **mcast_single_orig,
    581 + int *is_routable);
    582
    583 int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
    584 struct sk_buff *skb,
    585 @@ -52,7 +53,7 @@ int batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
    586 struct batadv_orig_node *orig_node);
    587
    588 int batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb,
    589 - unsigned short vid);
    590 + unsigned short vid, int is_routable);
    591
    592 void batadv_mcast_init(struct batadv_priv *bat_priv);
    593
    594 @@ -71,7 +72,8 @@ void batadv_mcast_purge_orig(struct batadv_orig_node *orig_node);
    595
    596 static inline enum batadv_forw_mode
    597 batadv_mcast_forw_mode(struct batadv_priv *bat_priv, struct sk_buff *skb,
    598 - struct batadv_orig_node **mcast_single_orig)
    599 + struct batadv_orig_node **mcast_single_orig,
    600 + int *is_routable)
    601 {
    602 return BATADV_FORW_ALL;
    603 }
    604 @@ -88,7 +90,7 @@ batadv_mcast_forw_send_orig(struct batadv_priv *bat_priv,
    605
    606 static inline int
    607 batadv_mcast_forw_send(struct batadv_priv *bat_priv, struct sk_buff *skb,
    608 - unsigned short vid)
    609 + unsigned short vid, int is_routable)
    610 {
    611 kfree_skb(skb);
    612 return NET_XMIT_DROP;
    613 diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
    614 index 7f209390069ea..504e3cb67bed4 100644
    615 --- a/net/batman-adv/soft-interface.c
    616 +++ b/net/batman-adv/soft-interface.c
    617 @@ -200,6 +200,7 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
    618 int gw_mode;
    619 enum batadv_forw_mode forw_mode = BATADV_FORW_SINGLE;
    620 struct batadv_orig_node *mcast_single_orig = NULL;
    621 + int mcast_is_routable = 0;
    622 int network_offset = ETH_HLEN;
    623 __be16 proto;
    624
    625 @@ -302,7 +303,8 @@ static netdev_tx_t batadv_interface_tx(struct sk_buff *skb,
    626 send:
    627 if (do_bcast && !is_broadcast_ether_addr(ethhdr->h_dest)) {
    628 forw_mode = batadv_mcast_forw_mode(bat_priv, skb,
    629 - &mcast_single_orig);
    630 + &mcast_single_orig,
    631 + &mcast_is_routable);
    632 if (forw_mode == BATADV_FORW_NONE)
    633 goto dropped;
    634
    635 @@ -367,7 +369,8 @@ send:
    636 ret = batadv_mcast_forw_send_orig(bat_priv, skb, vid,
    637 mcast_single_orig);
    638 } else if (forw_mode == BATADV_FORW_SOME) {
    639 - ret = batadv_mcast_forw_send(bat_priv, skb, vid);
    640 + ret = batadv_mcast_forw_send(bat_priv, skb, vid,
    641 + mcast_is_routable);
    642 } else {
    643 if (batadv_dat_snoop_outgoing_arp_request(bat_priv,
    644 skb))
    645 diff --git a/net/core/lwtunnel.c b/net/core/lwtunnel.c
    646 index 2f9c0de533c75..0b64f015b3b0b 100644
    647 --- a/net/core/lwtunnel.c
    648 +++ b/net/core/lwtunnel.c
    649 @@ -190,6 +190,10 @@ int lwtunnel_valid_encap_type_attr(struct nlattr *attr, int remaining,
    650 nla_entype = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
    651
    652 if (nla_entype) {
    653 + if (nla_len(nla_entype) < sizeof(u16)) {
    654 + NL_SET_ERR_MSG(extack, "Invalid RTA_ENCAP_TYPE");
    655 + return -EINVAL;
    656 + }
    657 encap_type = nla_get_u16(nla_entype);
    658
    659 if (lwtunnel_valid_encap_type(encap_type,
    660 diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
    661 index c0b8154205237..ce4b28f011485 100644
    662 --- a/net/ipv4/fib_semantics.c
    663 +++ b/net/ipv4/fib_semantics.c
    664 @@ -654,6 +654,19 @@ static int fib_count_nexthops(struct rtnexthop *rtnh, int remaining,
    665 return nhs;
    666 }
    667
    668 +static int fib_gw_from_attr(__be32 *gw, struct nlattr *nla,
    669 + struct netlink_ext_ack *extack)
    670 +{
    671 + if (nla_len(nla) < sizeof(*gw)) {
    672 + NL_SET_ERR_MSG(extack, "Invalid IPv4 address in RTA_GATEWAY");
    673 + return -EINVAL;
    674 + }
    675 +
    676 + *gw = nla_get_in_addr(nla);
    677 +
    678 + return 0;
    679 +}
    680 +
    681 /* only called when fib_nh is integrated into fib_info */
    682 static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
    683 int remaining, struct fib_config *cfg,
    684 @@ -696,7 +709,11 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
    685 return -EINVAL;
    686 }
    687 if (nla) {
    688 - fib_cfg.fc_gw4 = nla_get_in_addr(nla);
    689 + ret = fib_gw_from_attr(&fib_cfg.fc_gw4, nla,
    690 + extack);
    691 + if (ret)
    692 + goto errout;
    693 +
    694 if (fib_cfg.fc_gw4)
    695 fib_cfg.fc_gw_family = AF_INET;
    696 } else if (nlav) {
    697 @@ -706,10 +723,18 @@ static int fib_get_nhs(struct fib_info *fi, struct rtnexthop *rtnh,
    698 }
    699
    700 nla = nla_find(attrs, attrlen, RTA_FLOW);
    701 - if (nla)
    702 + if (nla) {
    703 + if (nla_len(nla) < sizeof(u32)) {
    704 + NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW");
    705 + return -EINVAL;
    706 + }
    707 fib_cfg.fc_flow = nla_get_u32(nla);
    708 + }
    709
    710 fib_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);
    711 + /* RTA_ENCAP_TYPE length checked in
    712 + * lwtunnel_valid_encap_type_attr
    713 + */
    714 nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
    715 if (nla)
    716 fib_cfg.fc_encap_type = nla_get_u16(nla);
    717 @@ -894,6 +919,7 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi,
    718 attrlen = rtnh_attrlen(rtnh);
    719 if (attrlen > 0) {
    720 struct nlattr *nla, *nlav, *attrs = rtnh_attrs(rtnh);
    721 + int err;
    722
    723 nla = nla_find(attrs, attrlen, RTA_GATEWAY);
    724 nlav = nla_find(attrs, attrlen, RTA_VIA);
    725 @@ -904,12 +930,17 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi,
    726 }
    727
    728 if (nla) {
    729 + __be32 gw;
    730 +
    731 + err = fib_gw_from_attr(&gw, nla, extack);
    732 + if (err)
    733 + return err;
    734 +
    735 if (nh->fib_nh_gw_family != AF_INET ||
    736 - nla_get_in_addr(nla) != nh->fib_nh_gw4)
    737 + gw != nh->fib_nh_gw4)
    738 return 1;
    739 } else if (nlav) {
    740 struct fib_config cfg2;
    741 - int err;
    742
    743 err = fib_gw_from_via(&cfg2, nlav, extack);
    744 if (err)
    745 @@ -932,8 +963,14 @@ int fib_nh_match(struct fib_config *cfg, struct fib_info *fi,
    746
    747 #ifdef CONFIG_IP_ROUTE_CLASSID
    748 nla = nla_find(attrs, attrlen, RTA_FLOW);
    749 - if (nla && nla_get_u32(nla) != nh->nh_tclassid)
    750 - return 1;
    751 + if (nla) {
    752 + if (nla_len(nla) < sizeof(u32)) {
    753 + NL_SET_ERR_MSG(extack, "Invalid RTA_FLOW");
    754 + return -EINVAL;
    755 + }
    756 + if (nla_get_u32(nla) != nh->nh_tclassid)
    757 + return 1;
    758 + }
    759 #endif
    760 }
    761
    762 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    763 index a0016f05c4f86..3cdf011a8dd8d 100644
    764 --- a/net/ipv4/udp.c
    765 +++ b/net/ipv4/udp.c
    766 @@ -2943,7 +2943,7 @@ int udp4_seq_show(struct seq_file *seq, void *v)
    767 {
    768 seq_setwidth(seq, 127);
    769 if (v == SEQ_START_TOKEN)
    770 - seq_puts(seq, " sl local_address rem_address st tx_queue "
    771 + seq_puts(seq, " sl local_address rem_address st tx_queue "
    772 "rx_queue tr tm->when retrnsmt uid timeout "
    773 "inode ref pointer drops");
    774 else {
    775 diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
    776 index 12ab6605d9617..8b44d3b53844e 100644
    777 --- a/net/ipv6/ip6_vti.c
    778 +++ b/net/ipv6/ip6_vti.c
    779 @@ -795,6 +795,8 @@ vti6_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    780 struct net *net = dev_net(dev);
    781 struct vti6_net *ip6n = net_generic(net, vti6_net_id);
    782
    783 + memset(&p1, 0, sizeof(p1));
    784 +
    785 switch (cmd) {
    786 case SIOCGETTUNNEL:
    787 if (dev == ip6n->fb_tnl_dev) {
    788 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    789 index f36db3dd97346..5ef6e27e026e9 100644
    790 --- a/net/ipv6/route.c
    791 +++ b/net/ipv6/route.c
    792 @@ -5092,6 +5092,19 @@ static void ip6_route_mpath_notify(struct fib6_info *rt,
    793 inet6_rt_notify(RTM_NEWROUTE, rt, info, nlflags);
    794 }
    795
    796 +static int fib6_gw_from_attr(struct in6_addr *gw, struct nlattr *nla,
    797 + struct netlink_ext_ack *extack)
    798 +{
    799 + if (nla_len(nla) < sizeof(*gw)) {
    800 + NL_SET_ERR_MSG(extack, "Invalid IPv6 address in RTA_GATEWAY");
    801 + return -EINVAL;
    802 + }
    803 +
    804 + *gw = nla_get_in6_addr(nla);
    805 +
    806 + return 0;
    807 +}
    808 +
    809 static int ip6_route_multipath_add(struct fib6_config *cfg,
    810 struct netlink_ext_ack *extack)
    811 {
    812 @@ -5133,10 +5146,18 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
    813
    814 nla = nla_find(attrs, attrlen, RTA_GATEWAY);
    815 if (nla) {
    816 - r_cfg.fc_gateway = nla_get_in6_addr(nla);
    817 + err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
    818 + extack);
    819 + if (err)
    820 + goto cleanup;
    821 +
    822 r_cfg.fc_flags |= RTF_GATEWAY;
    823 }
    824 r_cfg.fc_encap = nla_find(attrs, attrlen, RTA_ENCAP);
    825 +
    826 + /* RTA_ENCAP_TYPE length checked in
    827 + * lwtunnel_valid_encap_type_attr
    828 + */
    829 nla = nla_find(attrs, attrlen, RTA_ENCAP_TYPE);
    830 if (nla)
    831 r_cfg.fc_encap_type = nla_get_u16(nla);
    832 @@ -5288,7 +5309,13 @@ static int ip6_route_multipath_del(struct fib6_config *cfg,
    833
    834 nla = nla_find(attrs, attrlen, RTA_GATEWAY);
    835 if (nla) {
    836 - nla_memcpy(&r_cfg.fc_gateway, nla, 16);
    837 + err = fib6_gw_from_attr(&r_cfg.fc_gateway, nla,
    838 + extack);
    839 + if (err) {
    840 + last_err = err;
    841 + goto next_rtnh;
    842 + }
    843 +
    844 r_cfg.fc_flags |= RTF_GATEWAY;
    845 }
    846 }
    847 @@ -5296,6 +5323,7 @@ static int ip6_route_multipath_del(struct fib6_config *cfg,
    848 if (err)
    849 last_err = err;
    850
    851 +next_rtnh:
    852 rtnh = rtnh_next(rtnh, &remaining);
    853 }
    854
    855 diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
    856 index 5c727af01143f..ad00f31e20023 100644
    857 --- a/net/mac80211/mlme.c
    858 +++ b/net/mac80211/mlme.c
    859 @@ -4953,7 +4953,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
    860 */
    861 if (new_sta) {
    862 u32 rates = 0, basic_rates = 0;
    863 - bool have_higher_than_11mbit;
    864 + bool have_higher_than_11mbit = false;
    865 int min_rate = INT_MAX, min_rate_index = -1;
    866 const struct cfg80211_bss_ies *ies;
    867 int shift = ieee80211_vif_get_shift(&sdata->vif);
    868 diff --git a/net/phonet/pep.c b/net/phonet/pep.c
    869 index a07e13f63332c..0c5d0f7b8b4bb 100644
    870 --- a/net/phonet/pep.c
    871 +++ b/net/phonet/pep.c
    872 @@ -868,6 +868,7 @@ static struct sock *pep_sock_accept(struct sock *sk, int flags, int *errp,
    873
    874 err = pep_accept_conn(newsk, skb);
    875 if (err) {
    876 + __sock_put(sk);
    877 sock_put(newsk);
    878 newsk = NULL;
    879 goto drop;
    880 diff --git a/net/sched/sch_qfq.c b/net/sched/sch_qfq.c
    881 index b046fd3cac2cf..1eb339d224ae5 100644
    882 --- a/net/sched/sch_qfq.c
    883 +++ b/net/sched/sch_qfq.c
    884 @@ -1421,10 +1421,8 @@ static int qfq_init_qdisc(struct Qdisc *sch, struct nlattr *opt,
    885 if (err < 0)
    886 return err;
    887
    888 - if (qdisc_dev(sch)->tx_queue_len + 1 > QFQ_MAX_AGG_CLASSES)
    889 - max_classes = QFQ_MAX_AGG_CLASSES;
    890 - else
    891 - max_classes = qdisc_dev(sch)->tx_queue_len + 1;
    892 + max_classes = min_t(u64, (u64)qdisc_dev(sch)->tx_queue_len + 1,
    893 + QFQ_MAX_AGG_CLASSES);
    894 /* max_cl_shift = floor(log_2(max_classes)) */
    895 max_cl_shift = __fls(max_classes);
    896 q->max_agg_classes = 1<<max_cl_shift;
    897 diff --git a/tools/testing/selftests/x86/test_vsyscall.c b/tools/testing/selftests/x86/test_vsyscall.c
    898 index a4f4d4cf22c3b..d0752a0a8f362 100644
    899 --- a/tools/testing/selftests/x86/test_vsyscall.c
    900 +++ b/tools/testing/selftests/x86/test_vsyscall.c
    901 @@ -480,7 +480,7 @@ static int test_process_vm_readv(void)
    902 }
    903
    904 if (vsyscall_map_r) {
    905 - if (!memcmp(buf, (const void *)0xffffffffff600000, 4096)) {
    906 + if (!memcmp(buf, remote.iov_base, sizeof(buf))) {
    907 printf("[OK]\tIt worked and read correct data\n");
    908 } else {
    909 printf("[FAIL]\tIt worked but returned incorrect data\n");