Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.17/0100-4.17.1-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-4.17/0100-4.17.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3134 - (show annotations) (download)
    Mon Jun 18 09:23:26 2018 UTC (5 years, 10 months ago) by niro
    File size: 21196 byte(s) 
    -linux-4.17.1
    1 diff --git a/Documentation/networking/netdev-FAQ.txt b/Documentation/networking/netdev-FAQ.txt
    2 index 2a3278d5cf35..fa951b820b25 100644
    3 --- a/Documentation/networking/netdev-FAQ.txt
    4 +++ b/Documentation/networking/netdev-FAQ.txt
    5 @@ -179,6 +179,15 @@ A: No. See above answer. In short, if you think it really belongs in
    6 dash marker line as described in Documentation/process/submitting-patches.rst to
    7 temporarily embed that information into the patch that you send.
    8
    9 +Q: Are all networking bug fixes backported to all stable releases?
    10 +
    11 +A: Due to capacity, Dave could only take care of the backports for the last
    12 + 2 stable releases. For earlier stable releases, each stable branch maintainer
    13 + is supposed to take care of them. If you find any patch is missing from an
    14 + earlier stable branch, please notify stable@vger.kernel.org with either a
    15 + commit ID or a formal patch backported, and CC Dave and other relevant
    16 + networking developers.
    17 +
    18 Q: Someone said that the comment style and coding convention is different
    19 for the networking content. Is this true?
    20
    21 diff --git a/Makefile b/Makefile
    22 index 554dcaddbce4..e551c9af6a06 100644
    23 --- a/Makefile
    24 +++ b/Makefile
    25 @@ -1,7 +1,7 @@
    26 # SPDX-License-Identifier: GPL-2.0
    27 VERSION = 4
    28 PATCHLEVEL = 17
    29 -SUBLEVEL = 0
    30 +SUBLEVEL = 1
    31 EXTRAVERSION =
    32 NAME = Merciless Moray
    33
    34 diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
    35 index 3da5fca77cbd..bbc6cc609ec3 100644
    36 --- a/drivers/net/dsa/b53/b53_common.c
    37 +++ b/drivers/net/dsa/b53/b53_common.c
    38 @@ -684,7 +684,8 @@ static int b53_switch_reset(struct b53_device *dev)
    39 * still use this driver as a library and need to perform the reset
    40 * earlier.
    41 */
    42 - if (dev->chip_id == BCM58XX_DEVICE_ID) {
    43 + if (dev->chip_id == BCM58XX_DEVICE_ID ||
    44 + dev->chip_id == BCM583XX_DEVICE_ID) {
    45 b53_read8(dev, B53_CTRL_PAGE, B53_SOFTRESET, &reg);
    46 reg |= SW_RST | EN_SW_RST | EN_CH_RST;
    47 b53_write8(dev, B53_CTRL_PAGE, B53_SOFTRESET, reg);
    48 @@ -1879,6 +1880,18 @@ static const struct b53_chip_data b53_switch_chips[] = {
    49 .jumbo_pm_reg = B53_JUMBO_PORT_MASK,
    50 .jumbo_size_reg = B53_JUMBO_MAX_SIZE,
    51 },
    52 + {
    53 + .chip_id = BCM583XX_DEVICE_ID,
    54 + .dev_name = "BCM583xx/11360",
    55 + .vlans = 4096,
    56 + .enabled_ports = 0x103,
    57 + .arl_entries = 4,
    58 + .cpu_port = B53_CPU_PORT,
    59 + .vta_regs = B53_VTA_REGS,
    60 + .duplex_reg = B53_DUPLEX_STAT_GE,
    61 + .jumbo_pm_reg = B53_JUMBO_PORT_MASK,
    62 + .jumbo_size_reg = B53_JUMBO_MAX_SIZE,
    63 + },
    64 {
    65 .chip_id = BCM7445_DEVICE_ID,
    66 .dev_name = "BCM7445",
    67 diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
    68 index 3b57f47d0e79..b232aaae20aa 100644
    69 --- a/drivers/net/dsa/b53/b53_priv.h
    70 +++ b/drivers/net/dsa/b53/b53_priv.h
    71 @@ -62,6 +62,7 @@ enum {
    72 BCM53018_DEVICE_ID = 0x53018,
    73 BCM53019_DEVICE_ID = 0x53019,
    74 BCM58XX_DEVICE_ID = 0x5800,
    75 + BCM583XX_DEVICE_ID = 0x58300,
    76 BCM7445_DEVICE_ID = 0x7445,
    77 BCM7278_DEVICE_ID = 0x7278,
    78 };
    79 @@ -181,6 +182,7 @@ static inline int is5301x(struct b53_device *dev)
    80 static inline int is58xx(struct b53_device *dev)
    81 {
    82 return dev->chip_id == BCM58XX_DEVICE_ID ||
    83 + dev->chip_id == BCM583XX_DEVICE_ID ||
    84 dev->chip_id == BCM7445_DEVICE_ID ||
    85 dev->chip_id == BCM7278_DEVICE_ID;
    86 }
    87 diff --git a/drivers/net/dsa/b53/b53_srab.c b/drivers/net/dsa/b53/b53_srab.c
    88 index c37ffd1b6833..8247481eaa06 100644
    89 --- a/drivers/net/dsa/b53/b53_srab.c
    90 +++ b/drivers/net/dsa/b53/b53_srab.c
    91 @@ -364,7 +364,7 @@ static const struct of_device_id b53_srab_of_match[] = {
    92 { .compatible = "brcm,bcm53018-srab" },
    93 { .compatible = "brcm,bcm53019-srab" },
    94 { .compatible = "brcm,bcm5301x-srab" },
    95 - { .compatible = "brcm,bcm11360-srab", .data = (void *)BCM58XX_DEVICE_ID },
    96 + { .compatible = "brcm,bcm11360-srab", .data = (void *)BCM583XX_DEVICE_ID },
    97 { .compatible = "brcm,bcm58522-srab", .data = (void *)BCM58XX_DEVICE_ID },
    98 { .compatible = "brcm,bcm58525-srab", .data = (void *)BCM58XX_DEVICE_ID },
    99 { .compatible = "brcm,bcm58535-srab", .data = (void *)BCM58XX_DEVICE_ID },
    100 @@ -372,7 +372,7 @@ static const struct of_device_id b53_srab_of_match[] = {
    101 { .compatible = "brcm,bcm58623-srab", .data = (void *)BCM58XX_DEVICE_ID },
    102 { .compatible = "brcm,bcm58625-srab", .data = (void *)BCM58XX_DEVICE_ID },
    103 { .compatible = "brcm,bcm88312-srab", .data = (void *)BCM58XX_DEVICE_ID },
    104 - { .compatible = "brcm,cygnus-srab", .data = (void *)BCM58XX_DEVICE_ID },
    105 + { .compatible = "brcm,cygnus-srab", .data = (void *)BCM583XX_DEVICE_ID },
    106 { .compatible = "brcm,nsp-srab", .data = (void *)BCM58XX_DEVICE_ID },
    107 { /* sentinel */ },
    108 };
    109 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
    110 index 7dd83d0ef0a0..22243c480a05 100644
    111 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
    112 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c
    113 @@ -588,7 +588,7 @@ static void bnx2x_ets_e3b0_nig_disabled(const struct link_params *params,
    114 * slots for the highest priority.
    115 */
    116 REG_WR(bp, (port) ? NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS :
    117 - NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100);
    118 + NIG_REG_P0_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100);
    119 /* Mapping between the CREDIT_WEIGHT registers and actual client
    120 * numbers
    121 */
    122 diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
    123 index ddb6bf85a59c..e141563a4682 100644
    124 --- a/drivers/net/team/team.c
    125 +++ b/drivers/net/team/team.c
    126 @@ -1004,7 +1004,8 @@ static void team_port_disable(struct team *team,
    127 static void __team_compute_features(struct team *team)
    128 {
    129 struct team_port *port;
    130 - u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL;
    131 + netdev_features_t vlan_features = TEAM_VLAN_FEATURES &
    132 + NETIF_F_ALL_FOR_ALL;
    133 netdev_features_t enc_features = TEAM_ENC_FEATURES;
    134 unsigned short max_hard_header_len = ETH_HLEN;
    135 unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE |
    136 diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c
    137 index 50cdefe3f6d3..c75199538c05 100644
    138 --- a/drivers/pci/host/pci-hyperv.c
    139 +++ b/drivers/pci/host/pci-hyperv.c
    140 @@ -556,6 +556,26 @@ static void put_pcichild(struct hv_pci_dev *hv_pcidev,
    141 static void get_hvpcibus(struct hv_pcibus_device *hv_pcibus);
    142 static void put_hvpcibus(struct hv_pcibus_device *hv_pcibus);
    143
    144 +/*
    145 + * There is no good way to get notified from vmbus_onoffer_rescind(),
    146 + * so let's use polling here, since this is not a hot path.
    147 + */
    148 +static int wait_for_response(struct hv_device *hdev,
    149 + struct completion *comp)
    150 +{
    151 + while (true) {
    152 + if (hdev->channel->rescind) {
    153 + dev_warn_once(&hdev->device, "The device is gone.\n");
    154 + return -ENODEV;
    155 + }
    156 +
    157 + if (wait_for_completion_timeout(comp, HZ / 10))
    158 + break;
    159 + }
    160 +
    161 + return 0;
    162 +}
    163 +
    164 /**
    165 * devfn_to_wslot() - Convert from Linux PCI slot to Windows
    166 * @devfn: The Linux representation of PCI slot
    167 @@ -1568,7 +1588,8 @@ static struct hv_pci_dev *new_pcichild_device(struct hv_pcibus_device *hbus,
    168 if (ret)
    169 goto error;
    170
    171 - wait_for_completion(&comp_pkt.host_event);
    172 + if (wait_for_response(hbus->hdev, &comp_pkt.host_event))
    173 + goto error;
    174
    175 hpdev->desc = *desc;
    176 refcount_set(&hpdev->refs, 1);
    177 @@ -2069,15 +2090,16 @@ static int hv_pci_protocol_negotiation(struct hv_device *hdev)
    178 sizeof(struct pci_version_request),
    179 (unsigned long)pkt, VM_PKT_DATA_INBAND,
    180 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
    181 + if (!ret)
    182 + ret = wait_for_response(hdev, &comp_pkt.host_event);
    183 +
    184 if (ret) {
    185 dev_err(&hdev->device,
    186 - "PCI Pass-through VSP failed sending version reqquest: %#x",
    187 + "PCI Pass-through VSP failed to request version: %d",
    188 ret);
    189 goto exit;
    190 }
    191
    192 - wait_for_completion(&comp_pkt.host_event);
    193 -
    194 if (comp_pkt.completion_status >= 0) {
    195 pci_protocol_version = pci_protocol_versions[i];
    196 dev_info(&hdev->device,
    197 @@ -2286,11 +2308,12 @@ static int hv_pci_enter_d0(struct hv_device *hdev)
    198 ret = vmbus_sendpacket(hdev->channel, d0_entry, sizeof(*d0_entry),
    199 (unsigned long)pkt, VM_PKT_DATA_INBAND,
    200 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
    201 + if (!ret)
    202 + ret = wait_for_response(hdev, &comp_pkt.host_event);
    203 +
    204 if (ret)
    205 goto exit;
    206
    207 - wait_for_completion(&comp_pkt.host_event);
    208 -
    209 if (comp_pkt.completion_status < 0) {
    210 dev_err(&hdev->device,
    211 "PCI Pass-through VSP failed D0 Entry with status %x\n",
    212 @@ -2330,11 +2353,10 @@ static int hv_pci_query_relations(struct hv_device *hdev)
    213
    214 ret = vmbus_sendpacket(hdev->channel, &message, sizeof(message),
    215 0, VM_PKT_DATA_INBAND, 0);
    216 - if (ret)
    217 - return ret;
    218 + if (!ret)
    219 + ret = wait_for_response(hdev, &comp);
    220
    221 - wait_for_completion(&comp);
    222 - return 0;
    223 + return ret;
    224 }
    225
    226 /**
    227 @@ -2404,11 +2426,11 @@ static int hv_send_resources_allocated(struct hv_device *hdev)
    228 size_res, (unsigned long)pkt,
    229 VM_PKT_DATA_INBAND,
    230 VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED);
    231 + if (!ret)
    232 + ret = wait_for_response(hdev, &comp_pkt.host_event);
    233 if (ret)
    234 break;
    235
    236 - wait_for_completion(&comp_pkt.host_event);
    237 -
    238 if (comp_pkt.completion_status < 0) {
    239 ret = -EPROTO;
    240 dev_err(&hdev->device,
    241 diff --git a/include/linux/mroute_base.h b/include/linux/mroute_base.h
    242 index d617fe45543e..d633f737b3c6 100644
    243 --- a/include/linux/mroute_base.h
    244 +++ b/include/linux/mroute_base.h
    245 @@ -307,16 +307,6 @@ static inline void vif_device_init(struct vif_device *v,
    246 {
    247 }
    248
    249 -static inline void *
    250 -mr_table_alloc(struct net *net, u32 id,
    251 - struct mr_table_ops *ops,
    252 - void (*expire_func)(struct timer_list *t),
    253 - void (*table_set)(struct mr_table *mrt,
    254 - struct net *net))
    255 -{
    256 - return NULL;
    257 -}
    258 -
    259 static inline void *mr_mfc_find_parent(struct mr_table *mrt,
    260 void *hasharg, int parent)
    261 {
    262 diff --git a/include/net/ipv6.h b/include/net/ipv6.h
    263 index 836f31af1369..a406f2e8680a 100644
    264 --- a/include/net/ipv6.h
    265 +++ b/include/net/ipv6.h
    266 @@ -906,6 +906,11 @@ static inline __be32 ip6_make_flowinfo(unsigned int tclass, __be32 flowlabel)
    267 return htonl(tclass << IPV6_TCLASS_SHIFT) | flowlabel;
    268 }
    269
    270 +static inline __be32 flowi6_get_flowlabel(const struct flowi6 *fl6)
    271 +{
    272 + return fl6->flowlabel & IPV6_FLOWLABEL_MASK;
    273 +}
    274 +
    275 /*
    276 * Prototypes exported by ipv6
    277 */
    278 diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
    279 index d29f09bc5ff9..0234f8d1f0ac 100644
    280 --- a/net/core/flow_dissector.c
    281 +++ b/net/core/flow_dissector.c
    282 @@ -1334,7 +1334,7 @@ __u32 __get_hash_from_flowi6(const struct flowi6 *fl6, struct flow_keys *keys)
    283 keys->ports.src = fl6->fl6_sport;
    284 keys->ports.dst = fl6->fl6_dport;
    285 keys->keyid.keyid = fl6->fl6_gre_key;
    286 - keys->tags.flow_label = (__force u32)fl6->flowlabel;
    287 + keys->tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6);
    288 keys->basic.ip_proto = fl6->flowi6_proto;
    289
    290 return flow_hash_from_keys(keys);
    291 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    292 index 45936922d7e2..19f6ab5de6e1 100644
    293 --- a/net/core/rtnetlink.c
    294 +++ b/net/core/rtnetlink.c
    295 @@ -2256,6 +2256,10 @@ static int do_setlink(const struct sk_buff *skb,
    296 const struct net_device_ops *ops = dev->netdev_ops;
    297 int err;
    298
    299 + err = validate_linkmsg(dev, tb);
    300 + if (err < 0)
    301 + return err;
    302 +
    303 if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD] || tb[IFLA_IF_NETNSID]) {
    304 struct net *net = rtnl_link_get_net_capable(skb, dev_net(dev),
    305 tb, CAP_NET_ADMIN);
    306 @@ -2619,10 +2623,6 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh,
    307 goto errout;
    308 }
    309
    310 - err = validate_linkmsg(dev, tb);
    311 - if (err < 0)
    312 - goto errout;
    313 -
    314 err = do_setlink(skb, dev, ifm, extack, tb, ifname, 0);
    315 errout:
    316 return err;
    317 diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
    318 index c27122f01b87..cfae17335705 100644
    319 --- a/net/ipv4/fib_semantics.c
    320 +++ b/net/ipv4/fib_semantics.c
    321 @@ -717,6 +717,8 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi)
    322 nla_strlcpy(tmp, nla, sizeof(tmp));
    323 val = tcp_ca_get_key_by_name(fi->fib_net, tmp, &ecn_ca);
    324 } else {
    325 + if (nla_len(nla) != sizeof(u32))
    326 + return false;
    327 val = nla_get_u32(nla);
    328 }
    329
    330 @@ -1043,6 +1045,8 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg)
    331 if (val == TCP_CA_UNSPEC)
    332 return -EINVAL;
    333 } else {
    334 + if (nla_len(nla) != sizeof(u32))
    335 + return -EINVAL;
    336 val = nla_get_u32(nla);
    337 }
    338 if (type == RTAX_ADVMSS && val > 65535 - 40)
    339 diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c
    340 index 30221701614c..cafb0506c8c9 100644
    341 --- a/net/ipv4/ipmr_base.c
    342 +++ b/net/ipv4/ipmr_base.c
    343 @@ -35,17 +35,19 @@ mr_table_alloc(struct net *net, u32 id,
    344 struct net *net))
    345 {
    346 struct mr_table *mrt;
    347 + int err;
    348
    349 mrt = kzalloc(sizeof(*mrt), GFP_KERNEL);
    350 if (!mrt)
    351 - return NULL;
    352 + return ERR_PTR(-ENOMEM);
    353 mrt->id = id;
    354 write_pnet(&mrt->net, net);
    355
    356 mrt->ops = *ops;
    357 - if (rhltable_init(&mrt->mfc_hash, mrt->ops.rht_params)) {
    358 + err = rhltable_init(&mrt->mfc_hash, mrt->ops.rht_params);
    359 + if (err) {
    360 kfree(mrt);
    361 - return NULL;
    362 + return ERR_PTR(err);
    363 }
    364 INIT_LIST_HEAD(&mrt->mfc_cache_list);
    365 INIT_LIST_HEAD(&mrt->mfc_unres_queue);
    366 diff --git a/net/ipv4/netfilter/nf_flow_table_ipv4.c b/net/ipv4/netfilter/nf_flow_table_ipv4.c
    367 index 0cd46bffa469..fc3923932eda 100644
    368 --- a/net/ipv4/netfilter/nf_flow_table_ipv4.c
    369 +++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c
    370 @@ -213,7 +213,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
    371 enum flow_offload_tuple_dir dir;
    372 struct flow_offload *flow;
    373 struct net_device *outdev;
    374 - const struct rtable *rt;
    375 + struct rtable *rt;
    376 struct iphdr *iph;
    377 __be32 nexthop;
    378
    379 @@ -234,7 +234,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
    380 dir = tuplehash->tuple.dir;
    381 flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]);
    382
    383 - rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
    384 + rt = (struct rtable *)flow->tuplehash[dir].tuple.dst_cache;
    385 if (unlikely(nf_flow_exceeds_mtu(skb, rt)))
    386 return NF_ACCEPT;
    387
    388 @@ -251,6 +251,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb,
    389
    390 skb->dev = outdev;
    391 nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr);
    392 + skb_dst_set_noref(skb, &rt->dst);
    393 neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb);
    394
    395 return NF_STOLEN;
    396 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    397 index 7b6d1689087b..af49f6cb5d3e 100644
    398 --- a/net/ipv6/ip6_output.c
    399 +++ b/net/ipv6/ip6_output.c
    400 @@ -507,7 +507,8 @@ int ip6_forward(struct sk_buff *skb)
    401 send redirects to source routed frames.
    402 We don't send redirects to frames decapsulated from IPsec.
    403 */
    404 - if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) {
    405 + if (IP6CB(skb)->iif == dst->dev->ifindex &&
    406 + opt->srcrt == 0 && !skb_sec_path(skb)) {
    407 struct in6_addr *target = NULL;
    408 struct inet_peer *peer;
    409 struct rt6_info *rt;
    410 diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
    411 index 298fd8b6ed17..37936671dcb3 100644
    412 --- a/net/ipv6/ip6mr.c
    413 +++ b/net/ipv6/ip6mr.c
    414 @@ -227,8 +227,8 @@ static int __net_init ip6mr_rules_init(struct net *net)
    415 INIT_LIST_HEAD(&net->ipv6.mr6_tables);
    416
    417 mrt = ip6mr_new_table(net, RT6_TABLE_DFLT);
    418 - if (!mrt) {
    419 - err = -ENOMEM;
    420 + if (IS_ERR(mrt)) {
    421 + err = PTR_ERR(mrt);
    422 goto err1;
    423 }
    424
    425 @@ -301,8 +301,13 @@ static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6,
    426
    427 static int __net_init ip6mr_rules_init(struct net *net)
    428 {
    429 - net->ipv6.mrt6 = ip6mr_new_table(net, RT6_TABLE_DFLT);
    430 - return net->ipv6.mrt6 ? 0 : -ENOMEM;
    431 + struct mr_table *mrt;
    432 +
    433 + mrt = ip6mr_new_table(net, RT6_TABLE_DFLT);
    434 + if (IS_ERR(mrt))
    435 + return PTR_ERR(mrt);
    436 + net->ipv6.mrt6 = mrt;
    437 + return 0;
    438 }
    439
    440 static void __net_exit ip6mr_rules_exit(struct net *net)
    441 @@ -1757,9 +1762,11 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
    442
    443 rtnl_lock();
    444 ret = 0;
    445 - if (!ip6mr_new_table(net, v))
    446 - ret = -ENOMEM;
    447 - raw6_sk(sk)->ip6mr_table = v;
    448 + mrt = ip6mr_new_table(net, v);
    449 + if (IS_ERR(mrt))
    450 + ret = PTR_ERR(mrt);
    451 + else
    452 + raw6_sk(sk)->ip6mr_table = v;
    453 rtnl_unlock();
    454 return ret;
    455 }
    456 diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
    457 index 9de4dfb126ba..525051a886bc 100644
    458 --- a/net/ipv6/ndisc.c
    459 +++ b/net/ipv6/ndisc.c
    460 @@ -1576,6 +1576,12 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
    461 ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL;
    462 bool ret;
    463
    464 + if (netif_is_l3_master(skb->dev)) {
    465 + dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif);
    466 + if (!dev)
    467 + return;
    468 + }
    469 +
    470 if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) {
    471 ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n",
    472 dev->name);
    473 diff --git a/net/ipv6/netfilter/nf_flow_table_ipv6.c b/net/ipv6/netfilter/nf_flow_table_ipv6.c
    474 index 207cb35569b1..2d6652146bba 100644
    475 --- a/net/ipv6/netfilter/nf_flow_table_ipv6.c
    476 +++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c
    477 @@ -243,6 +243,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb,
    478
    479 skb->dev = outdev;
    480 nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6);
    481 + skb_dst_set_noref(skb, &rt->dst);
    482 neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb);
    483
    484 return NF_STOLEN;
    485 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    486 index f4d61736c41a..4530a82aaa2e 100644
    487 --- a/net/ipv6/route.c
    488 +++ b/net/ipv6/route.c
    489 @@ -1868,7 +1868,7 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb,
    490 } else {
    491 keys->addrs.v6addrs.src = key_iph->saddr;
    492 keys->addrs.v6addrs.dst = key_iph->daddr;
    493 - keys->tags.flow_label = ip6_flowinfo(key_iph);
    494 + keys->tags.flow_label = ip6_flowlabel(key_iph);
    495 keys->basic.ip_proto = key_iph->nexthdr;
    496 }
    497 }
    498 @@ -1889,7 +1889,7 @@ u32 rt6_multipath_hash(const struct net *net, const struct flowi6 *fl6,
    499 } else {
    500 hash_keys.addrs.v6addrs.src = fl6->saddr;
    501 hash_keys.addrs.v6addrs.dst = fl6->daddr;
    502 - hash_keys.tags.flow_label = (__force u32)fl6->flowlabel;
    503 + hash_keys.tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6);
    504 hash_keys.basic.ip_proto = fl6->flowi6_proto;
    505 }
    506 break;
    507 diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
    508 index 1fd9e145076a..466f17646625 100644
    509 --- a/net/l2tp/l2tp_ppp.c
    510 +++ b/net/l2tp/l2tp_ppp.c
    511 @@ -428,16 +428,6 @@ static void pppol2tp_put_sk(struct rcu_head *head)
    512 */
    513 static void pppol2tp_session_close(struct l2tp_session *session)
    514 {
    515 - struct pppol2tp_session *ps;
    516 -
    517 - ps = l2tp_session_priv(session);
    518 - mutex_lock(&ps->sk_lock);
    519 - ps->__sk = rcu_dereference_protected(ps->sk,
    520 - lockdep_is_held(&ps->sk_lock));
    521 - RCU_INIT_POINTER(ps->sk, NULL);
    522 - if (ps->__sk)
    523 - call_rcu(&ps->rcu, pppol2tp_put_sk);
    524 - mutex_unlock(&ps->sk_lock);
    525 }
    526
    527 /* Really kill the session socket. (Called from sock_put() if
    528 @@ -480,15 +470,24 @@ static int pppol2tp_release(struct socket *sock)
    529 sock_orphan(sk);
    530 sock->sk = NULL;
    531
    532 - /* If the socket is associated with a session,
    533 - * l2tp_session_delete will call pppol2tp_session_close which
    534 - * will drop the session's ref on the socket.
    535 - */
    536 session = pppol2tp_sock_to_session(sk);
    537 if (session) {
    538 + struct pppol2tp_session *ps;
    539 +
    540 l2tp_session_delete(session);
    541 - /* drop the ref obtained by pppol2tp_sock_to_session */
    542 - sock_put(sk);
    543 +
    544 + ps = l2tp_session_priv(session);
    545 + mutex_lock(&ps->sk_lock);
    546 + ps->__sk = rcu_dereference_protected(ps->sk,
    547 + lockdep_is_held(&ps->sk_lock));
    548 + RCU_INIT_POINTER(ps->sk, NULL);
    549 + mutex_unlock(&ps->sk_lock);
    550 + call_rcu(&ps->rcu, pppol2tp_put_sk);
    551 +
    552 + /* Rely on the sock_put() call at the end of the function for
    553 + * dropping the reference held by pppol2tp_sock_to_session().
    554 + * The last reference will be dropped by pppol2tp_put_sk().
    555 + */
    556 }
    557
    558 release_sock(sk);
    559 @@ -742,7 +741,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
    560 */
    561 mutex_lock(&ps->sk_lock);
    562 if (rcu_dereference_protected(ps->sk,
    563 - lockdep_is_held(&ps->sk_lock))) {
    564 + lockdep_is_held(&ps->sk_lock)) ||
    565 + ps->__sk) {
    566 mutex_unlock(&ps->sk_lock);
    567 error = -EEXIST;
    568 goto end;
    569 @@ -803,7 +803,6 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
    570
    571 out_no_ppp:
    572 /* This is how we get the session context from the socket. */
    573 - sock_hold(sk);
    574 sk->sk_user_data = session;
    575 rcu_assign_pointer(ps->sk, sk);
    576 mutex_unlock(&ps->sk_lock);
    577 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    578 index acb7b86574cd..60c2a252bdf5 100644
    579 --- a/net/packet/af_packet.c
    580 +++ b/net/packet/af_packet.c
    581 @@ -4282,7 +4282,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
    582 goto out;
    583 if (po->tp_version >= TPACKET_V3 &&
    584 req->tp_block_size <=
    585 - BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv))
    586 + BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr))
    587 goto out;
    588 if (unlikely(req->tp_frame_size < po->tp_hdrlen +
    589 po->tp_reserve))
    590 diff --git a/net/sctp/transport.c b/net/sctp/transport.c
    591 index 47f82bd794d9..03fc2c427aca 100644
    592 --- a/net/sctp/transport.c
    593 +++ b/net/sctp/transport.c
    594 @@ -634,7 +634,7 @@ unsigned long sctp_transport_timeout(struct sctp_transport *trans)
    595 trans->state != SCTP_PF)
    596 timeout += trans->hbinterval;
    597
    598 - return timeout;
    599 + return max_t(unsigned long, timeout, HZ / 5);
    600 }
    601
    602 /* Reset transport variables to their initial values */