Annotation of /trunk/kernel-magellan/patches-4.15/0102-4.15.3-all-fixes.patch
Parent Directory | Revision Log
Revision 3086 -
(hide annotations)
(download)
Wed Mar 21 14:52:20 2018 UTC (6 years, 6 months ago) by niro
File size: 26231 byte(s)
Wed Mar 21 14:52:20 2018 UTC (6 years, 6 months ago) by niro
File size: 26231 byte(s)
-linux-4.15.3
1 | niro | 3086 | diff --git a/Makefile b/Makefile |
2 | index 54f1bc10b531..13566ad7863a 100644 | ||
3 | --- a/Makefile | ||
4 | +++ b/Makefile | ||
5 | @@ -1,7 +1,7 @@ | ||
6 | # SPDX-License-Identifier: GPL-2.0 | ||
7 | VERSION = 4 | ||
8 | PATCHLEVEL = 15 | ||
9 | -SUBLEVEL = 2 | ||
10 | +SUBLEVEL = 3 | ||
11 | EXTRAVERSION = | ||
12 | NAME = Fearless Coyote | ||
13 | |||
14 | diff --git a/crypto/tcrypt.c b/crypto/tcrypt.c | ||
15 | index 9267cbdb14d2..3ced1ba1fd11 100644 | ||
16 | --- a/crypto/tcrypt.c | ||
17 | +++ b/crypto/tcrypt.c | ||
18 | @@ -198,11 +198,13 @@ static void sg_init_aead(struct scatterlist *sg, char *xbuf[XBUFSIZE], | ||
19 | } | ||
20 | |||
21 | sg_init_table(sg, np + 1); | ||
22 | - np--; | ||
23 | + if (rem) | ||
24 | + np--; | ||
25 | for (k = 0; k < np; k++) | ||
26 | sg_set_buf(&sg[k + 1], xbuf[k], PAGE_SIZE); | ||
27 | |||
28 | - sg_set_buf(&sg[k + 1], xbuf[k], rem); | ||
29 | + if (rem) | ||
30 | + sg_set_buf(&sg[k + 1], xbuf[k], rem); | ||
31 | } | ||
32 | |||
33 | static void test_aead_speed(const char *algo, int enc, unsigned int secs, | ||
34 | diff --git a/drivers/gpio/gpio-uniphier.c b/drivers/gpio/gpio-uniphier.c | ||
35 | index 016d7427ebfa..761d8279abca 100644 | ||
36 | --- a/drivers/gpio/gpio-uniphier.c | ||
37 | +++ b/drivers/gpio/gpio-uniphier.c | ||
38 | @@ -505,4 +505,4 @@ module_platform_driver(uniphier_gpio_driver); | ||
39 | |||
40 | MODULE_AUTHOR("Masahiro Yamada <yamada.masahiro@socionext.com>"); | ||
41 | MODULE_DESCRIPTION("UniPhier GPIO driver"); | ||
42 | -MODULE_LICENSE("GPL"); | ||
43 | +MODULE_LICENSE("GPL v2"); | ||
44 | diff --git a/drivers/media/platform/mtk-vcodec/mtk_vcodec_util.c b/drivers/media/platform/mtk-vcodec/mtk_vcodec_util.c | ||
45 | index 46768c056193..0c28d0b995cc 100644 | ||
46 | --- a/drivers/media/platform/mtk-vcodec/mtk_vcodec_util.c | ||
47 | +++ b/drivers/media/platform/mtk-vcodec/mtk_vcodec_util.c | ||
48 | @@ -115,3 +115,6 @@ struct mtk_vcodec_ctx *mtk_vcodec_get_curr_ctx(struct mtk_vcodec_dev *dev) | ||
49 | return ctx; | ||
50 | } | ||
51 | EXPORT_SYMBOL(mtk_vcodec_get_curr_ctx); | ||
52 | + | ||
53 | +MODULE_LICENSE("GPL v2"); | ||
54 | +MODULE_DESCRIPTION("Mediatek video codec driver"); | ||
55 | diff --git a/drivers/media/platform/soc_camera/soc_scale_crop.c b/drivers/media/platform/soc_camera/soc_scale_crop.c | ||
56 | index 270ec613c27c..6164102e6f9f 100644 | ||
57 | --- a/drivers/media/platform/soc_camera/soc_scale_crop.c | ||
58 | +++ b/drivers/media/platform/soc_camera/soc_scale_crop.c | ||
59 | @@ -420,3 +420,7 @@ void soc_camera_calc_client_output(struct soc_camera_device *icd, | ||
60 | mf->height = soc_camera_shift_scale(rect->height, shift, scale_v); | ||
61 | } | ||
62 | EXPORT_SYMBOL(soc_camera_calc_client_output); | ||
63 | + | ||
64 | +MODULE_DESCRIPTION("soc-camera scaling-cropping functions"); | ||
65 | +MODULE_AUTHOR("Guennadi Liakhovetski <kernel@pengutronix.de>"); | ||
66 | +MODULE_LICENSE("GPL"); | ||
67 | diff --git a/drivers/media/platform/tegra-cec/tegra_cec.c b/drivers/media/platform/tegra-cec/tegra_cec.c | ||
68 | index 807c94c70049..92f93a880015 100644 | ||
69 | --- a/drivers/media/platform/tegra-cec/tegra_cec.c | ||
70 | +++ b/drivers/media/platform/tegra-cec/tegra_cec.c | ||
71 | @@ -493,3 +493,8 @@ static struct platform_driver tegra_cec_driver = { | ||
72 | }; | ||
73 | |||
74 | module_platform_driver(tegra_cec_driver); | ||
75 | + | ||
76 | +MODULE_DESCRIPTION("Tegra HDMI CEC driver"); | ||
77 | +MODULE_AUTHOR("NVIDIA CORPORATION"); | ||
78 | +MODULE_AUTHOR("Cisco Systems, Inc. and/or its affiliates"); | ||
79 | +MODULE_LICENSE("GPL v2"); | ||
80 | diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | ||
81 | index f7080d0ab874..46b0372dd032 100644 | ||
82 | --- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | ||
83 | +++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c | ||
84 | @@ -3891,7 +3891,7 @@ static void qlcnic_83xx_flush_mbx_queue(struct qlcnic_adapter *adapter) | ||
85 | struct list_head *head = &mbx->cmd_q; | ||
86 | struct qlcnic_cmd_args *cmd = NULL; | ||
87 | |||
88 | - spin_lock(&mbx->queue_lock); | ||
89 | + spin_lock_bh(&mbx->queue_lock); | ||
90 | |||
91 | while (!list_empty(head)) { | ||
92 | cmd = list_entry(head->next, struct qlcnic_cmd_args, list); | ||
93 | @@ -3902,7 +3902,7 @@ static void qlcnic_83xx_flush_mbx_queue(struct qlcnic_adapter *adapter) | ||
94 | qlcnic_83xx_notify_cmd_completion(adapter, cmd); | ||
95 | } | ||
96 | |||
97 | - spin_unlock(&mbx->queue_lock); | ||
98 | + spin_unlock_bh(&mbx->queue_lock); | ||
99 | } | ||
100 | |||
101 | static int qlcnic_83xx_check_mbx_status(struct qlcnic_adapter *adapter) | ||
102 | @@ -3938,12 +3938,12 @@ static void qlcnic_83xx_dequeue_mbx_cmd(struct qlcnic_adapter *adapter, | ||
103 | { | ||
104 | struct qlcnic_mailbox *mbx = adapter->ahw->mailbox; | ||
105 | |||
106 | - spin_lock(&mbx->queue_lock); | ||
107 | + spin_lock_bh(&mbx->queue_lock); | ||
108 | |||
109 | list_del(&cmd->list); | ||
110 | mbx->num_cmds--; | ||
111 | |||
112 | - spin_unlock(&mbx->queue_lock); | ||
113 | + spin_unlock_bh(&mbx->queue_lock); | ||
114 | |||
115 | qlcnic_83xx_notify_cmd_completion(adapter, cmd); | ||
116 | } | ||
117 | @@ -4008,7 +4008,7 @@ static int qlcnic_83xx_enqueue_mbx_cmd(struct qlcnic_adapter *adapter, | ||
118 | init_completion(&cmd->completion); | ||
119 | cmd->rsp_opcode = QLC_83XX_MBX_RESPONSE_UNKNOWN; | ||
120 | |||
121 | - spin_lock(&mbx->queue_lock); | ||
122 | + spin_lock_bh(&mbx->queue_lock); | ||
123 | |||
124 | list_add_tail(&cmd->list, &mbx->cmd_q); | ||
125 | mbx->num_cmds++; | ||
126 | @@ -4016,7 +4016,7 @@ static int qlcnic_83xx_enqueue_mbx_cmd(struct qlcnic_adapter *adapter, | ||
127 | *timeout = cmd->total_cmds * QLC_83XX_MBX_TIMEOUT; | ||
128 | queue_work(mbx->work_q, &mbx->work); | ||
129 | |||
130 | - spin_unlock(&mbx->queue_lock); | ||
131 | + spin_unlock_bh(&mbx->queue_lock); | ||
132 | |||
133 | return 0; | ||
134 | } | ||
135 | @@ -4112,15 +4112,15 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work) | ||
136 | mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT; | ||
137 | spin_unlock_irqrestore(&mbx->aen_lock, flags); | ||
138 | |||
139 | - spin_lock(&mbx->queue_lock); | ||
140 | + spin_lock_bh(&mbx->queue_lock); | ||
141 | |||
142 | if (list_empty(head)) { | ||
143 | - spin_unlock(&mbx->queue_lock); | ||
144 | + spin_unlock_bh(&mbx->queue_lock); | ||
145 | return; | ||
146 | } | ||
147 | cmd = list_entry(head->next, struct qlcnic_cmd_args, list); | ||
148 | |||
149 | - spin_unlock(&mbx->queue_lock); | ||
150 | + spin_unlock_bh(&mbx->queue_lock); | ||
151 | |||
152 | mbx_ops->encode_cmd(adapter, cmd); | ||
153 | mbx_ops->nofity_fw(adapter, QLC_83XX_MBX_REQUEST); | ||
154 | diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c | ||
155 | index 734286ebe5ef..dd713dff8d22 100644 | ||
156 | --- a/drivers/net/ethernet/realtek/r8169.c | ||
157 | +++ b/drivers/net/ethernet/realtek/r8169.c | ||
158 | @@ -1395,7 +1395,7 @@ DECLARE_RTL_COND(rtl_ocp_tx_cond) | ||
159 | { | ||
160 | void __iomem *ioaddr = tp->mmio_addr; | ||
161 | |||
162 | - return RTL_R8(IBISR0) & 0x02; | ||
163 | + return RTL_R8(IBISR0) & 0x20; | ||
164 | } | ||
165 | |||
166 | static void rtl8168ep_stop_cmac(struct rtl8169_private *tp) | ||
167 | @@ -1403,7 +1403,7 @@ static void rtl8168ep_stop_cmac(struct rtl8169_private *tp) | ||
168 | void __iomem *ioaddr = tp->mmio_addr; | ||
169 | |||
170 | RTL_W8(IBCR2, RTL_R8(IBCR2) & ~0x01); | ||
171 | - rtl_msleep_loop_wait_low(tp, &rtl_ocp_tx_cond, 50, 2000); | ||
172 | + rtl_msleep_loop_wait_high(tp, &rtl_ocp_tx_cond, 50, 2000); | ||
173 | RTL_W8(IBISR0, RTL_R8(IBISR0) | 0x20); | ||
174 | RTL_W8(IBCR0, RTL_R8(IBCR0) & ~0x01); | ||
175 | } | ||
176 | diff --git a/drivers/net/ethernet/rocker/rocker_main.c b/drivers/net/ethernet/rocker/rocker_main.c | ||
177 | index fc8f8bdf6579..056cb6093630 100644 | ||
178 | --- a/drivers/net/ethernet/rocker/rocker_main.c | ||
179 | +++ b/drivers/net/ethernet/rocker/rocker_main.c | ||
180 | @@ -2902,6 +2902,12 @@ static int rocker_probe(struct pci_dev *pdev, const struct pci_device_id *id) | ||
181 | goto err_alloc_ordered_workqueue; | ||
182 | } | ||
183 | |||
184 | + err = rocker_probe_ports(rocker); | ||
185 | + if (err) { | ||
186 | + dev_err(&pdev->dev, "failed to probe ports\n"); | ||
187 | + goto err_probe_ports; | ||
188 | + } | ||
189 | + | ||
190 | /* Only FIBs pointing to our own netdevs are programmed into | ||
191 | * the device, so no need to pass a callback. | ||
192 | */ | ||
193 | @@ -2918,22 +2924,16 @@ static int rocker_probe(struct pci_dev *pdev, const struct pci_device_id *id) | ||
194 | |||
195 | rocker->hw.id = rocker_read64(rocker, SWITCH_ID); | ||
196 | |||
197 | - err = rocker_probe_ports(rocker); | ||
198 | - if (err) { | ||
199 | - dev_err(&pdev->dev, "failed to probe ports\n"); | ||
200 | - goto err_probe_ports; | ||
201 | - } | ||
202 | - | ||
203 | dev_info(&pdev->dev, "Rocker switch with id %*phN\n", | ||
204 | (int)sizeof(rocker->hw.id), &rocker->hw.id); | ||
205 | |||
206 | return 0; | ||
207 | |||
208 | -err_probe_ports: | ||
209 | - unregister_switchdev_notifier(&rocker_switchdev_notifier); | ||
210 | err_register_switchdev_notifier: | ||
211 | unregister_fib_notifier(&rocker->fib_nb); | ||
212 | err_register_fib_notifier: | ||
213 | + rocker_remove_ports(rocker); | ||
214 | +err_probe_ports: | ||
215 | destroy_workqueue(rocker->rocker_owq); | ||
216 | err_alloc_ordered_workqueue: | ||
217 | free_irq(rocker_msix_vector(rocker, ROCKER_MSIX_VEC_EVENT), rocker); | ||
218 | @@ -2961,9 +2961,9 @@ static void rocker_remove(struct pci_dev *pdev) | ||
219 | { | ||
220 | struct rocker *rocker = pci_get_drvdata(pdev); | ||
221 | |||
222 | - rocker_remove_ports(rocker); | ||
223 | unregister_switchdev_notifier(&rocker_switchdev_notifier); | ||
224 | unregister_fib_notifier(&rocker->fib_nb); | ||
225 | + rocker_remove_ports(rocker); | ||
226 | rocker_write32(rocker, CONTROL, ROCKER_CONTROL_RESET); | ||
227 | destroy_workqueue(rocker->rocker_owq); | ||
228 | free_irq(rocker_msix_vector(rocker, ROCKER_MSIX_VEC_EVENT), rocker); | ||
229 | diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c | ||
230 | index 728819feab44..e7114c34fe4b 100644 | ||
231 | --- a/drivers/net/usb/qmi_wwan.c | ||
232 | +++ b/drivers/net/usb/qmi_wwan.c | ||
233 | @@ -1245,6 +1245,7 @@ static const struct usb_device_id products[] = { | ||
234 | {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */ | ||
235 | {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */ | ||
236 | {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */ | ||
237 | + {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */ | ||
238 | |||
239 | /* 4. Gobi 1000 devices */ | ||
240 | {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */ | ||
241 | diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c | ||
242 | index c7bdeb655646..5636c7ca8eba 100644 | ||
243 | --- a/drivers/vhost/net.c | ||
244 | +++ b/drivers/vhost/net.c | ||
245 | @@ -1208,6 +1208,7 @@ static long vhost_net_reset_owner(struct vhost_net *n) | ||
246 | } | ||
247 | vhost_net_stop(n, &tx_sock, &rx_sock); | ||
248 | vhost_net_flush(n); | ||
249 | + vhost_dev_stop(&n->dev); | ||
250 | vhost_dev_reset_owner(&n->dev, umem); | ||
251 | vhost_net_vq_reset(n); | ||
252 | done: | ||
253 | diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h | ||
254 | index becf86aa4ac6..d6ec5a5a6782 100644 | ||
255 | --- a/include/net/sch_generic.h | ||
256 | +++ b/include/net/sch_generic.h | ||
257 | @@ -280,7 +280,6 @@ struct tcf_block { | ||
258 | struct net *net; | ||
259 | struct Qdisc *q; | ||
260 | struct list_head cb_list; | ||
261 | - struct work_struct work; | ||
262 | }; | ||
263 | |||
264 | static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz) | ||
265 | diff --git a/mm/memcontrol.c b/mm/memcontrol.c | ||
266 | index ac2ffd5e02b9..0a78ce57872d 100644 | ||
267 | --- a/mm/memcontrol.c | ||
268 | +++ b/mm/memcontrol.c | ||
269 | @@ -5828,6 +5828,20 @@ void mem_cgroup_sk_alloc(struct sock *sk) | ||
270 | if (!mem_cgroup_sockets_enabled) | ||
271 | return; | ||
272 | |||
273 | + /* | ||
274 | + * Socket cloning can throw us here with sk_memcg already | ||
275 | + * filled. It won't however, necessarily happen from | ||
276 | + * process context. So the test for root memcg given | ||
277 | + * the current task's memcg won't help us in this case. | ||
278 | + * | ||
279 | + * Respecting the original socket's memcg is a better | ||
280 | + * decision in this case. | ||
281 | + */ | ||
282 | + if (sk->sk_memcg) { | ||
283 | + css_get(&sk->sk_memcg->css); | ||
284 | + return; | ||
285 | + } | ||
286 | + | ||
287 | rcu_read_lock(); | ||
288 | memcg = mem_cgroup_from_task(current); | ||
289 | if (memcg == root_mem_cgroup) | ||
290 | diff --git a/net/core/sock.c b/net/core/sock.c | ||
291 | index c0b5b2f17412..7571dabfc4cf 100644 | ||
292 | --- a/net/core/sock.c | ||
293 | +++ b/net/core/sock.c | ||
294 | @@ -1675,16 +1675,13 @@ struct sock *sk_clone_lock(const struct sock *sk, const gfp_t priority) | ||
295 | newsk->sk_dst_pending_confirm = 0; | ||
296 | newsk->sk_wmem_queued = 0; | ||
297 | newsk->sk_forward_alloc = 0; | ||
298 | - | ||
299 | - /* sk->sk_memcg will be populated at accept() time */ | ||
300 | - newsk->sk_memcg = NULL; | ||
301 | - | ||
302 | atomic_set(&newsk->sk_drops, 0); | ||
303 | newsk->sk_send_head = NULL; | ||
304 | newsk->sk_userlocks = sk->sk_userlocks & ~SOCK_BINDPORT_LOCK; | ||
305 | atomic_set(&newsk->sk_zckey, 0); | ||
306 | |||
307 | sock_reset_flag(newsk, SOCK_DONE); | ||
308 | + mem_cgroup_sk_alloc(newsk); | ||
309 | cgroup_sk_alloc(&newsk->sk_cgrp_data); | ||
310 | |||
311 | rcu_read_lock(); | ||
312 | diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c | ||
313 | index 5eeb1d20cc38..676092d7bd81 100644 | ||
314 | --- a/net/core/sock_reuseport.c | ||
315 | +++ b/net/core/sock_reuseport.c | ||
316 | @@ -94,6 +94,16 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse) | ||
317 | return more_reuse; | ||
318 | } | ||
319 | |||
320 | +static void reuseport_free_rcu(struct rcu_head *head) | ||
321 | +{ | ||
322 | + struct sock_reuseport *reuse; | ||
323 | + | ||
324 | + reuse = container_of(head, struct sock_reuseport, rcu); | ||
325 | + if (reuse->prog) | ||
326 | + bpf_prog_destroy(reuse->prog); | ||
327 | + kfree(reuse); | ||
328 | +} | ||
329 | + | ||
330 | /** | ||
331 | * reuseport_add_sock - Add a socket to the reuseport group of another. | ||
332 | * @sk: New socket to add to the group. | ||
333 | @@ -102,7 +112,7 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse) | ||
334 | */ | ||
335 | int reuseport_add_sock(struct sock *sk, struct sock *sk2) | ||
336 | { | ||
337 | - struct sock_reuseport *reuse; | ||
338 | + struct sock_reuseport *old_reuse, *reuse; | ||
339 | |||
340 | if (!rcu_access_pointer(sk2->sk_reuseport_cb)) { | ||
341 | int err = reuseport_alloc(sk2); | ||
342 | @@ -113,10 +123,13 @@ int reuseport_add_sock(struct sock *sk, struct sock *sk2) | ||
343 | |||
344 | spin_lock_bh(&reuseport_lock); | ||
345 | reuse = rcu_dereference_protected(sk2->sk_reuseport_cb, | ||
346 | - lockdep_is_held(&reuseport_lock)), | ||
347 | - WARN_ONCE(rcu_dereference_protected(sk->sk_reuseport_cb, | ||
348 | - lockdep_is_held(&reuseport_lock)), | ||
349 | - "socket already in reuseport group"); | ||
350 | + lockdep_is_held(&reuseport_lock)); | ||
351 | + old_reuse = rcu_dereference_protected(sk->sk_reuseport_cb, | ||
352 | + lockdep_is_held(&reuseport_lock)); | ||
353 | + if (old_reuse && old_reuse->num_socks != 1) { | ||
354 | + spin_unlock_bh(&reuseport_lock); | ||
355 | + return -EBUSY; | ||
356 | + } | ||
357 | |||
358 | if (reuse->num_socks == reuse->max_socks) { | ||
359 | reuse = reuseport_grow(reuse); | ||
360 | @@ -134,19 +147,11 @@ int reuseport_add_sock(struct sock *sk, struct sock *sk2) | ||
361 | |||
362 | spin_unlock_bh(&reuseport_lock); | ||
363 | |||
364 | + if (old_reuse) | ||
365 | + call_rcu(&old_reuse->rcu, reuseport_free_rcu); | ||
366 | return 0; | ||
367 | } | ||
368 | |||
369 | -static void reuseport_free_rcu(struct rcu_head *head) | ||
370 | -{ | ||
371 | - struct sock_reuseport *reuse; | ||
372 | - | ||
373 | - reuse = container_of(head, struct sock_reuseport, rcu); | ||
374 | - if (reuse->prog) | ||
375 | - bpf_prog_destroy(reuse->prog); | ||
376 | - kfree(reuse); | ||
377 | -} | ||
378 | - | ||
379 | void reuseport_detach_sock(struct sock *sk) | ||
380 | { | ||
381 | struct sock_reuseport *reuse; | ||
382 | diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c | ||
383 | index 2d49717a7421..f0b1fc35dde1 100644 | ||
384 | --- a/net/ipv4/igmp.c | ||
385 | +++ b/net/ipv4/igmp.c | ||
386 | @@ -386,7 +386,11 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu) | ||
387 | pip->frag_off = htons(IP_DF); | ||
388 | pip->ttl = 1; | ||
389 | pip->daddr = fl4.daddr; | ||
390 | + | ||
391 | + rcu_read_lock(); | ||
392 | pip->saddr = igmpv3_get_srcaddr(dev, &fl4); | ||
393 | + rcu_read_unlock(); | ||
394 | + | ||
395 | pip->protocol = IPPROTO_IGMP; | ||
396 | pip->tot_len = 0; /* filled in later */ | ||
397 | ip_select_ident(net, skb, NULL); | ||
398 | diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c | ||
399 | index 4ca46dc08e63..3668c4182655 100644 | ||
400 | --- a/net/ipv4/inet_connection_sock.c | ||
401 | +++ b/net/ipv4/inet_connection_sock.c | ||
402 | @@ -475,7 +475,6 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err, bool kern) | ||
403 | } | ||
404 | spin_unlock_bh(&queue->fastopenq.lock); | ||
405 | } | ||
406 | - mem_cgroup_sk_alloc(newsk); | ||
407 | out: | ||
408 | release_sock(sk); | ||
409 | if (req) | ||
410 | diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c | ||
411 | index 8e053ad7cae2..c821f5d68720 100644 | ||
412 | --- a/net/ipv4/tcp.c | ||
413 | +++ b/net/ipv4/tcp.c | ||
414 | @@ -2434,6 +2434,12 @@ int tcp_disconnect(struct sock *sk, int flags) | ||
415 | |||
416 | WARN_ON(inet->inet_num && !icsk->icsk_bind_hash); | ||
417 | |||
418 | + if (sk->sk_frag.page) { | ||
419 | + put_page(sk->sk_frag.page); | ||
420 | + sk->sk_frag.page = NULL; | ||
421 | + sk->sk_frag.offset = 0; | ||
422 | + } | ||
423 | + | ||
424 | sk->sk_error_report(sk); | ||
425 | return err; | ||
426 | } | ||
427 | diff --git a/net/ipv4/tcp_bbr.c b/net/ipv4/tcp_bbr.c | ||
428 | index 8322f26e770e..25c5a0b60cfc 100644 | ||
429 | --- a/net/ipv4/tcp_bbr.c | ||
430 | +++ b/net/ipv4/tcp_bbr.c | ||
431 | @@ -481,7 +481,8 @@ static void bbr_advance_cycle_phase(struct sock *sk) | ||
432 | |||
433 | bbr->cycle_idx = (bbr->cycle_idx + 1) & (CYCLE_LEN - 1); | ||
434 | bbr->cycle_mstamp = tp->delivered_mstamp; | ||
435 | - bbr->pacing_gain = bbr_pacing_gain[bbr->cycle_idx]; | ||
436 | + bbr->pacing_gain = bbr->lt_use_bw ? BBR_UNIT : | ||
437 | + bbr_pacing_gain[bbr->cycle_idx]; | ||
438 | } | ||
439 | |||
440 | /* Gain cycling: cycle pacing gain to converge to fair share of available bw. */ | ||
441 | @@ -490,8 +491,7 @@ static void bbr_update_cycle_phase(struct sock *sk, | ||
442 | { | ||
443 | struct bbr *bbr = inet_csk_ca(sk); | ||
444 | |||
445 | - if ((bbr->mode == BBR_PROBE_BW) && !bbr->lt_use_bw && | ||
446 | - bbr_is_next_cycle_phase(sk, rs)) | ||
447 | + if (bbr->mode == BBR_PROBE_BW && bbr_is_next_cycle_phase(sk, rs)) | ||
448 | bbr_advance_cycle_phase(sk); | ||
449 | } | ||
450 | |||
451 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c | ||
452 | index f49bd7897e95..2547222589fe 100644 | ||
453 | --- a/net/ipv6/addrconf.c | ||
454 | +++ b/net/ipv6/addrconf.c | ||
455 | @@ -186,7 +186,8 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx, | ||
456 | |||
457 | static void addrconf_dad_start(struct inet6_ifaddr *ifp); | ||
458 | static void addrconf_dad_work(struct work_struct *w); | ||
459 | -static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id); | ||
460 | +static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id, | ||
461 | + bool send_na); | ||
462 | static void addrconf_dad_run(struct inet6_dev *idev); | ||
463 | static void addrconf_rs_timer(struct timer_list *t); | ||
464 | static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa); | ||
465 | @@ -3833,12 +3834,17 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp) | ||
466 | idev->cnf.accept_dad < 1) || | ||
467 | !(ifp->flags&IFA_F_TENTATIVE) || | ||
468 | ifp->flags & IFA_F_NODAD) { | ||
469 | + bool send_na = false; | ||
470 | + | ||
471 | + if (ifp->flags & IFA_F_TENTATIVE && | ||
472 | + !(ifp->flags & IFA_F_OPTIMISTIC)) | ||
473 | + send_na = true; | ||
474 | bump_id = ifp->flags & IFA_F_TENTATIVE; | ||
475 | ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED); | ||
476 | spin_unlock(&ifp->lock); | ||
477 | read_unlock_bh(&idev->lock); | ||
478 | |||
479 | - addrconf_dad_completed(ifp, bump_id); | ||
480 | + addrconf_dad_completed(ifp, bump_id, send_na); | ||
481 | return; | ||
482 | } | ||
483 | |||
484 | @@ -3967,16 +3973,21 @@ static void addrconf_dad_work(struct work_struct *w) | ||
485 | } | ||
486 | |||
487 | if (ifp->dad_probes == 0) { | ||
488 | + bool send_na = false; | ||
489 | + | ||
490 | /* | ||
491 | * DAD was successful | ||
492 | */ | ||
493 | |||
494 | + if (ifp->flags & IFA_F_TENTATIVE && | ||
495 | + !(ifp->flags & IFA_F_OPTIMISTIC)) | ||
496 | + send_na = true; | ||
497 | bump_id = ifp->flags & IFA_F_TENTATIVE; | ||
498 | ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED); | ||
499 | spin_unlock(&ifp->lock); | ||
500 | write_unlock_bh(&idev->lock); | ||
501 | |||
502 | - addrconf_dad_completed(ifp, bump_id); | ||
503 | + addrconf_dad_completed(ifp, bump_id, send_na); | ||
504 | |||
505 | goto out; | ||
506 | } | ||
507 | @@ -4014,7 +4025,8 @@ static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp) | ||
508 | return true; | ||
509 | } | ||
510 | |||
511 | -static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id) | ||
512 | +static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id, | ||
513 | + bool send_na) | ||
514 | { | ||
515 | struct net_device *dev = ifp->idev->dev; | ||
516 | struct in6_addr lladdr; | ||
517 | @@ -4046,6 +4058,16 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id) | ||
518 | if (send_mld) | ||
519 | ipv6_mc_dad_complete(ifp->idev); | ||
520 | |||
521 | + /* send unsolicited NA if enabled */ | ||
522 | + if (send_na && | ||
523 | + (ifp->idev->cnf.ndisc_notify || | ||
524 | + dev_net(dev)->ipv6.devconf_all->ndisc_notify)) { | ||
525 | + ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifp->addr, | ||
526 | + /*router=*/ !!ifp->idev->cnf.forwarding, | ||
527 | + /*solicited=*/ false, /*override=*/ true, | ||
528 | + /*inc_opt=*/ true); | ||
529 | + } | ||
530 | + | ||
531 | if (send_rs) { | ||
532 | /* | ||
533 | * If a host as already performed a random delay | ||
534 | @@ -4352,9 +4374,11 @@ static void addrconf_verify_rtnl(void) | ||
535 | spin_lock(&ifpub->lock); | ||
536 | ifpub->regen_count = 0; | ||
537 | spin_unlock(&ifpub->lock); | ||
538 | + rcu_read_unlock_bh(); | ||
539 | ipv6_create_tempaddr(ifpub, ifp, true); | ||
540 | in6_ifa_put(ifpub); | ||
541 | in6_ifa_put(ifp); | ||
542 | + rcu_read_lock_bh(); | ||
543 | goto restart; | ||
544 | } | ||
545 | } else if (time_before(ifp->tstamp + ifp->prefered_lft * HZ - regen_advance * HZ, next)) | ||
546 | diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c | ||
547 | index c9441ca45399..416917719a6f 100644 | ||
548 | --- a/net/ipv6/af_inet6.c | ||
549 | +++ b/net/ipv6/af_inet6.c | ||
550 | @@ -284,6 +284,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) | ||
551 | struct net *net = sock_net(sk); | ||
552 | __be32 v4addr = 0; | ||
553 | unsigned short snum; | ||
554 | + bool saved_ipv6only; | ||
555 | int addr_type = 0; | ||
556 | int err = 0; | ||
557 | |||
558 | @@ -389,19 +390,21 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) | ||
559 | if (!(addr_type & IPV6_ADDR_MULTICAST)) | ||
560 | np->saddr = addr->sin6_addr; | ||
561 | |||
562 | + saved_ipv6only = sk->sk_ipv6only; | ||
563 | + if (addr_type != IPV6_ADDR_ANY && addr_type != IPV6_ADDR_MAPPED) | ||
564 | + sk->sk_ipv6only = 1; | ||
565 | + | ||
566 | /* Make sure we are allowed to bind here. */ | ||
567 | if ((snum || !inet->bind_address_no_port) && | ||
568 | sk->sk_prot->get_port(sk, snum)) { | ||
569 | + sk->sk_ipv6only = saved_ipv6only; | ||
570 | inet_reset_saddr(sk); | ||
571 | err = -EADDRINUSE; | ||
572 | goto out; | ||
573 | } | ||
574 | |||
575 | - if (addr_type != IPV6_ADDR_ANY) { | ||
576 | + if (addr_type != IPV6_ADDR_ANY) | ||
577 | sk->sk_userlocks |= SOCK_BINDADDR_LOCK; | ||
578 | - if (addr_type != IPV6_ADDR_MAPPED) | ||
579 | - sk->sk_ipv6only = 1; | ||
580 | - } | ||
581 | if (snum) | ||
582 | sk->sk_userlocks |= SOCK_BINDPORT_LOCK; | ||
583 | inet->inet_sport = htons(inet->inet_num); | ||
584 | diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c | ||
585 | index a2e1a864eb46..4fc566ec7e79 100644 | ||
586 | --- a/net/ipv6/ip6mr.c | ||
587 | +++ b/net/ipv6/ip6mr.c | ||
588 | @@ -495,6 +495,7 @@ static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos) | ||
589 | return ERR_PTR(-ENOENT); | ||
590 | |||
591 | it->mrt = mrt; | ||
592 | + it->cache = NULL; | ||
593 | return *pos ? ipmr_mfc_seq_idx(net, seq->private, *pos - 1) | ||
594 | : SEQ_START_TOKEN; | ||
595 | } | ||
596 | diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c | ||
597 | index b3cea200c85e..f61a5b613b52 100644 | ||
598 | --- a/net/ipv6/ndisc.c | ||
599 | +++ b/net/ipv6/ndisc.c | ||
600 | @@ -566,6 +566,11 @@ static void ndisc_send_unsol_na(struct net_device *dev) | ||
601 | |||
602 | read_lock_bh(&idev->lock); | ||
603 | list_for_each_entry(ifa, &idev->addr_list, if_list) { | ||
604 | + /* skip tentative addresses until dad completes */ | ||
605 | + if (ifa->flags & IFA_F_TENTATIVE && | ||
606 | + !(ifa->flags & IFA_F_OPTIMISTIC)) | ||
607 | + continue; | ||
608 | + | ||
609 | ndisc_send_na(dev, &in6addr_linklocal_allnodes, &ifa->addr, | ||
610 | /*router=*/ !!idev->cnf.forwarding, | ||
611 | /*solicited=*/ false, /*override=*/ true, | ||
612 | diff --git a/net/ipv6/route.c b/net/ipv6/route.c | ||
613 | index 0458b761f3c5..a560fb1d0230 100644 | ||
614 | --- a/net/ipv6/route.c | ||
615 | +++ b/net/ipv6/route.c | ||
616 | @@ -1586,12 +1586,19 @@ static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket, | ||
617 | * EXPIRES exceptions - e.g. pmtu-generated ones are pruned when | ||
618 | * expired, independently from their aging, as per RFC 8201 section 4 | ||
619 | */ | ||
620 | - if (!(rt->rt6i_flags & RTF_EXPIRES) && | ||
621 | - time_after_eq(now, rt->dst.lastuse + gc_args->timeout)) { | ||
622 | - RT6_TRACE("aging clone %p\n", rt); | ||
623 | + if (!(rt->rt6i_flags & RTF_EXPIRES)) { | ||
624 | + if (time_after_eq(now, rt->dst.lastuse + gc_args->timeout)) { | ||
625 | + RT6_TRACE("aging clone %p\n", rt); | ||
626 | + rt6_remove_exception(bucket, rt6_ex); | ||
627 | + return; | ||
628 | + } | ||
629 | + } else if (time_after(jiffies, rt->dst.expires)) { | ||
630 | + RT6_TRACE("purging expired route %p\n", rt); | ||
631 | rt6_remove_exception(bucket, rt6_ex); | ||
632 | return; | ||
633 | - } else if (rt->rt6i_flags & RTF_GATEWAY) { | ||
634 | + } | ||
635 | + | ||
636 | + if (rt->rt6i_flags & RTF_GATEWAY) { | ||
637 | struct neighbour *neigh; | ||
638 | __u8 neigh_flags = 0; | ||
639 | |||
640 | @@ -1606,11 +1613,8 @@ static void rt6_age_examine_exception(struct rt6_exception_bucket *bucket, | ||
641 | rt6_remove_exception(bucket, rt6_ex); | ||
642 | return; | ||
643 | } | ||
644 | - } else if (__rt6_check_expired(rt)) { | ||
645 | - RT6_TRACE("purging expired route %p\n", rt); | ||
646 | - rt6_remove_exception(bucket, rt6_ex); | ||
647 | - return; | ||
648 | } | ||
649 | + | ||
650 | gc_args->more++; | ||
651 | } | ||
652 | |||
653 | diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c | ||
654 | index b9d63d2246e6..e6b853f0ee4f 100644 | ||
655 | --- a/net/sched/cls_api.c | ||
656 | +++ b/net/sched/cls_api.c | ||
657 | @@ -217,8 +217,12 @@ static void tcf_chain_flush(struct tcf_chain *chain) | ||
658 | |||
659 | static void tcf_chain_destroy(struct tcf_chain *chain) | ||
660 | { | ||
661 | + struct tcf_block *block = chain->block; | ||
662 | + | ||
663 | list_del(&chain->list); | ||
664 | kfree(chain); | ||
665 | + if (list_empty(&block->chain_list)) | ||
666 | + kfree(block); | ||
667 | } | ||
668 | |||
669 | static void tcf_chain_hold(struct tcf_chain *chain) | ||
670 | @@ -329,49 +333,34 @@ int tcf_block_get(struct tcf_block **p_block, | ||
671 | } | ||
672 | EXPORT_SYMBOL(tcf_block_get); | ||
673 | |||
674 | -static void tcf_block_put_final(struct work_struct *work) | ||
675 | -{ | ||
676 | - struct tcf_block *block = container_of(work, struct tcf_block, work); | ||
677 | - struct tcf_chain *chain, *tmp; | ||
678 | - | ||
679 | - rtnl_lock(); | ||
680 | - | ||
681 | - /* At this point, all the chains should have refcnt == 1. */ | ||
682 | - list_for_each_entry_safe(chain, tmp, &block->chain_list, list) | ||
683 | - tcf_chain_put(chain); | ||
684 | - rtnl_unlock(); | ||
685 | - kfree(block); | ||
686 | -} | ||
687 | - | ||
688 | /* XXX: Standalone actions are not allowed to jump to any chain, and bound | ||
689 | * actions should be all removed after flushing. | ||
690 | */ | ||
691 | void tcf_block_put_ext(struct tcf_block *block, struct Qdisc *q, | ||
692 | struct tcf_block_ext_info *ei) | ||
693 | { | ||
694 | - struct tcf_chain *chain; | ||
695 | + struct tcf_chain *chain, *tmp; | ||
696 | |||
697 | if (!block) | ||
698 | return; | ||
699 | - /* Hold a refcnt for all chains, except 0, so that they don't disappear | ||
700 | + /* Hold a refcnt for all chains, so that they don't disappear | ||
701 | * while we are iterating. | ||
702 | */ | ||
703 | list_for_each_entry(chain, &block->chain_list, list) | ||
704 | - if (chain->index) | ||
705 | - tcf_chain_hold(chain); | ||
706 | + tcf_chain_hold(chain); | ||
707 | |||
708 | list_for_each_entry(chain, &block->chain_list, list) | ||
709 | tcf_chain_flush(chain); | ||
710 | |||
711 | tcf_block_offload_unbind(block, q, ei); | ||
712 | |||
713 | - INIT_WORK(&block->work, tcf_block_put_final); | ||
714 | - /* Wait for existing RCU callbacks to cool down, make sure their works | ||
715 | - * have been queued before this. We can not flush pending works here | ||
716 | - * because we are holding the RTNL lock. | ||
717 | - */ | ||
718 | - rcu_barrier(); | ||
719 | - tcf_queue_work(&block->work); | ||
720 | + /* At this point, all the chains should have refcnt >= 1. */ | ||
721 | + list_for_each_entry_safe(chain, tmp, &block->chain_list, list) | ||
722 | + tcf_chain_put(chain); | ||
723 | + | ||
724 | + /* Finally, put chain 0 and allow block to be freed. */ | ||
725 | + chain = list_first_entry(&block->chain_list, struct tcf_chain, list); | ||
726 | + tcf_chain_put(chain); | ||
727 | } | ||
728 | EXPORT_SYMBOL(tcf_block_put_ext); | ||
729 | |||
730 | diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c | ||
731 | index 507859cdd1cb..33294b5b2c6a 100644 | ||
732 | --- a/net/sched/cls_u32.c | ||
733 | +++ b/net/sched/cls_u32.c | ||
734 | @@ -544,6 +544,7 @@ static void u32_remove_hw_knode(struct tcf_proto *tp, u32 handle) | ||
735 | static int u32_replace_hw_knode(struct tcf_proto *tp, struct tc_u_knode *n, | ||
736 | u32 flags) | ||
737 | { | ||
738 | + struct tc_u_hnode *ht = rtnl_dereference(n->ht_down); | ||
739 | struct tcf_block *block = tp->chain->block; | ||
740 | struct tc_cls_u32_offload cls_u32 = {}; | ||
741 | bool skip_sw = tc_skip_sw(flags); | ||
742 | @@ -563,7 +564,7 @@ static int u32_replace_hw_knode(struct tcf_proto *tp, struct tc_u_knode *n, | ||
743 | cls_u32.knode.sel = &n->sel; | ||
744 | cls_u32.knode.exts = &n->exts; | ||
745 | if (n->ht_down) | ||
746 | - cls_u32.knode.link_handle = n->ht_down->handle; | ||
747 | + cls_u32.knode.link_handle = ht->handle; | ||
748 | |||
749 | err = tc_setup_cb_call(block, NULL, TC_SETUP_CLSU32, &cls_u32, skip_sw); | ||
750 | if (err < 0) { | ||
751 | @@ -840,8 +841,9 @@ static void u32_replace_knode(struct tcf_proto *tp, struct tc_u_common *tp_c, | ||
752 | static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp, | ||
753 | struct tc_u_knode *n) | ||
754 | { | ||
755 | - struct tc_u_knode *new; | ||
756 | + struct tc_u_hnode *ht = rtnl_dereference(n->ht_down); | ||
757 | struct tc_u32_sel *s = &n->sel; | ||
758 | + struct tc_u_knode *new; | ||
759 | |||
760 | new = kzalloc(sizeof(*n) + s->nkeys*sizeof(struct tc_u32_key), | ||
761 | GFP_KERNEL); | ||
762 | @@ -859,11 +861,11 @@ static struct tc_u_knode *u32_init_knode(struct tcf_proto *tp, | ||
763 | new->fshift = n->fshift; | ||
764 | new->res = n->res; | ||
765 | new->flags = n->flags; | ||
766 | - RCU_INIT_POINTER(new->ht_down, n->ht_down); | ||
767 | + RCU_INIT_POINTER(new->ht_down, ht); | ||
768 | |||
769 | /* bump reference count as long as we hold pointer to structure */ | ||
770 | - if (new->ht_down) | ||
771 | - new->ht_down->refcnt++; | ||
772 | + if (ht) | ||
773 | + ht->refcnt++; | ||
774 | |||
775 | #ifdef CONFIG_CLS_U32_PERF | ||
776 | /* Statistics may be incremented by readers during update |