Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.6/0103-4.6.4-all-fixes.patch

    Annotation of /trunk/kernel-magellan/patches-4.6/0103-4.6.4-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2818 - (hide annotations) (download)
    Thu Aug 4 13:24:47 2016 UTC (7 years, 9 months ago) by niro
    File size: 33248 byte(s) 
    -linux-4.6.4
    1 niro 2818 diff --git a/Makefile b/Makefile
    2     index c62b531d5a85..cd374426114a 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 6
    8     -SUBLEVEL = 3
    9     +SUBLEVEL = 4
    10     EXTRAVERSION =
    11     NAME = Charred Weasel
    12    
    13     diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
    14     index 43fe85f20d57..7097a3395b25 100644
    15     --- a/crypto/crypto_user.c
    16     +++ b/crypto/crypto_user.c
    17     @@ -455,6 +455,7 @@ static const int crypto_msg_min[CRYPTO_NR_MSGTYPES] = {
    18     [CRYPTO_MSG_NEWALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
    19     [CRYPTO_MSG_DELALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
    20     [CRYPTO_MSG_UPDATEALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
    21     + [CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
    22     [CRYPTO_MSG_DELRNG - CRYPTO_MSG_BASE] = 0,
    23     };
    24    
    25     diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
    26     index 574e87c7f2b8..9acccad26928 100644
    27     --- a/drivers/crypto/ux500/hash/hash_core.c
    28     +++ b/drivers/crypto/ux500/hash/hash_core.c
    29     @@ -781,7 +781,7 @@ static int hash_process_data(struct hash_device_data *device_data,
    30     &device_data->state);
    31     memmove(req_ctx->state.buffer,
    32     device_data->state.buffer,
    33     - HASH_BLOCK_SIZE / sizeof(u32));
    34     + HASH_BLOCK_SIZE);
    35     if (ret) {
    36     dev_err(device_data->dev,
    37     "%s: hash_resume_state() failed!\n",
    38     @@ -832,7 +832,7 @@ static int hash_process_data(struct hash_device_data *device_data,
    39    
    40     memmove(device_data->state.buffer,
    41     req_ctx->state.buffer,
    42     - HASH_BLOCK_SIZE / sizeof(u32));
    43     + HASH_BLOCK_SIZE);
    44     if (ret) {
    45     dev_err(device_data->dev, "%s: hash_save_state() failed!\n",
    46     __func__);
    47     diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
    48     index 495577b6d31b..94ad5c0adbcb 100644
    49     --- a/drivers/crypto/vmx/aes_cbc.c
    50     +++ b/drivers/crypto/vmx/aes_cbc.c
    51     @@ -182,7 +182,7 @@ struct crypto_alg p8_aes_cbc_alg = {
    52     .cra_name = "cbc(aes)",
    53     .cra_driver_name = "p8_aes_cbc",
    54     .cra_module = THIS_MODULE,
    55     - .cra_priority = 1000,
    56     + .cra_priority = 2000,
    57     .cra_type = &crypto_blkcipher_type,
    58     .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK,
    59     .cra_alignmask = 0,
    60     diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c
    61     index 0a3c1b04cf3c..38ed10d761d0 100644
    62     --- a/drivers/crypto/vmx/aes_ctr.c
    63     +++ b/drivers/crypto/vmx/aes_ctr.c
    64     @@ -166,7 +166,7 @@ struct crypto_alg p8_aes_ctr_alg = {
    65     .cra_name = "ctr(aes)",
    66     .cra_driver_name = "p8_aes_ctr",
    67     .cra_module = THIS_MODULE,
    68     - .cra_priority = 1000,
    69     + .cra_priority = 2000,
    70     .cra_type = &crypto_blkcipher_type,
    71     .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK,
    72     .cra_alignmask = 0,
    73     diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    74     index 6dc810bce295..944a6dca0fcb 100644
    75     --- a/drivers/usb/core/quirks.c
    76     +++ b/drivers/usb/core/quirks.c
    77     @@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    78     /* Creative SB Audigy 2 NX */
    79     { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
    80    
    81     + /* USB3503 */
    82     + { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
    83     +
    84     /* Microsoft Wireless Laser Mouse 6000 Receiver */
    85     { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME },
    86    
    87     @@ -173,6 +176,10 @@ static const struct usb_device_id usb_quirk_list[] = {
    88     /* MAYA44USB sound device */
    89     { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
    90    
    91     + /* ASUS Base Station(T100) */
    92     + { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
    93     + USB_QUIRK_IGNORE_REMOTE_WAKEUP },
    94     +
    95     /* Action Semiconductor flash disk */
    96     { USB_DEVICE(0x10d6, 0x2200), .driver_info =
    97     USB_QUIRK_STRING_FETCH_255 },
    98     @@ -188,26 +195,22 @@ static const struct usb_device_id usb_quirk_list[] = {
    99     { USB_DEVICE(0x1908, 0x1315), .driver_info =
    100     USB_QUIRK_HONOR_BNUMINTERFACES },
    101    
    102     - /* INTEL VALUE SSD */
    103     - { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
    104     -
    105     - /* USB3503 */
    106     - { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
    107     -
    108     - /* ASUS Base Station(T100) */
    109     - { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
    110     - USB_QUIRK_IGNORE_REMOTE_WAKEUP },
    111     -
    112     /* Protocol and OTG Electrical Test Device */
    113     { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
    114     USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
    115    
    116     + /* Acer C120 LED Projector */
    117     + { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
    118     +
    119     /* Blackmagic Design Intensity Shuttle */
    120     { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
    121    
    122     /* Blackmagic Design UltraStudio SDI */
    123     { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
    124    
    125     + /* INTEL VALUE SSD */
    126     + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
    127     +
    128     { } /* terminating entry must be last */
    129     };
    130    
    131     diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
    132     index dd5cb5577dca..2f1fb7e7aa54 100644
    133     --- a/drivers/usb/dwc3/dwc3-exynos.c
    134     +++ b/drivers/usb/dwc3/dwc3-exynos.c
    135     @@ -128,12 +128,6 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
    136    
    137     platform_set_drvdata(pdev, exynos);
    138    
    139     - ret = dwc3_exynos_register_phys(exynos);
    140     - if (ret) {
    141     - dev_err(dev, "couldn't register PHYs\n");
    142     - return ret;
    143     - }
    144     -
    145     exynos->dev = dev;
    146    
    147     exynos->clk = devm_clk_get(dev, "usbdrd30");
    148     @@ -183,20 +177,29 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
    149     goto err3;
    150     }
    151    
    152     + ret = dwc3_exynos_register_phys(exynos);
    153     + if (ret) {
    154     + dev_err(dev, "couldn't register PHYs\n");
    155     + goto err4;
    156     + }
    157     +
    158     if (node) {
    159     ret = of_platform_populate(node, NULL, NULL, dev);
    160     if (ret) {
    161     dev_err(dev, "failed to add dwc3 core\n");
    162     - goto err4;
    163     + goto err5;
    164     }
    165     } else {
    166     dev_err(dev, "no device node, failed to add dwc3 core\n");
    167     ret = -ENODEV;
    168     - goto err4;
    169     + goto err5;
    170     }
    171    
    172     return 0;
    173    
    174     +err5:
    175     + platform_device_unregister(exynos->usb2_phy);
    176     + platform_device_unregister(exynos->usb3_phy);
    177     err4:
    178     regulator_disable(exynos->vdd10);
    179     err3:
    180     diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
    181     index e64479f882a5..aa3707bdebb4 100644
    182     --- a/drivers/usb/gadget/legacy/inode.c
    183     +++ b/drivers/usb/gadget/legacy/inode.c
    184     @@ -938,8 +938,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
    185     struct usb_ep *ep = dev->gadget->ep0;
    186     struct usb_request *req = dev->req;
    187    
    188     - if ((retval = setup_req (ep, req, 0)) == 0)
    189     - retval = usb_ep_queue (ep, req, GFP_ATOMIC);
    190     + if ((retval = setup_req (ep, req, 0)) == 0) {
    191     + spin_unlock_irq (&dev->lock);
    192     + retval = usb_ep_queue (ep, req, GFP_KERNEL);
    193     + spin_lock_irq (&dev->lock);
    194     + }
    195     dev->state = STATE_DEV_CONNECTED;
    196    
    197     /* assume that was SET_CONFIGURATION */
    198     @@ -1457,8 +1460,11 @@ delegate:
    199     w_length);
    200     if (value < 0)
    201     break;
    202     +
    203     + spin_unlock (&dev->lock);
    204     value = usb_ep_queue (gadget->ep0, dev->req,
    205     - GFP_ATOMIC);
    206     + GFP_KERNEL);
    207     + spin_lock (&dev->lock);
    208     if (value < 0) {
    209     clean_req (gadget->ep0, dev->req);
    210     break;
    211     @@ -1481,11 +1487,14 @@ delegate:
    212     if (value >= 0 && dev->state != STATE_DEV_SETUP) {
    213     req->length = value;
    214     req->zero = value < w_length;
    215     - value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
    216     +
    217     + spin_unlock (&dev->lock);
    218     + value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
    219     if (value < 0) {
    220     DBG (dev, "ep_queue --> %d\n", value);
    221     req->status = 0;
    222     }
    223     + return value;
    224     }
    225    
    226     /* device stalls when value < 0 */
    227     diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
    228     index 4031b372008e..c1c1024a054c 100644
    229     --- a/drivers/usb/host/ehci-tegra.c
    230     +++ b/drivers/usb/host/ehci-tegra.c
    231     @@ -89,7 +89,7 @@ static int tegra_reset_usb_controller(struct platform_device *pdev)
    232     if (!usb1_reset_attempted) {
    233     struct reset_control *usb1_reset;
    234    
    235     - usb1_reset = of_reset_control_get(phy_np, "usb");
    236     + usb1_reset = of_reset_control_get(phy_np, "utmi-pads");
    237     if (IS_ERR(usb1_reset)) {
    238     dev_warn(&pdev->dev,
    239     "can't get utmi-pads reset from the PHY\n");
    240     diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    241     index 48672fac7ff3..c10972fcc8e4 100644
    242     --- a/drivers/usb/host/xhci-pci.c
    243     +++ b/drivers/usb/host/xhci-pci.c
    244     @@ -37,6 +37,7 @@
    245     /* Device for a quirk */
    246     #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
    247     #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000
    248     +#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009
    249     #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400
    250    
    251     #define PCI_VENDOR_ID_ETRON 0x1b6f
    252     @@ -114,6 +115,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    253     xhci->quirks |= XHCI_TRUST_TX_LENGTH;
    254     }
    255    
    256     + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
    257     + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009)
    258     + xhci->quirks |= XHCI_BROKEN_STREAMS;
    259     +
    260     if (pdev->vendor == PCI_VENDOR_ID_NEC)
    261     xhci->quirks |= XHCI_NEC_HOST;
    262    
    263     diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
    264     index 474b5fa14900..d6e2b2751e50 100644
    265     --- a/drivers/usb/host/xhci-plat.c
    266     +++ b/drivers/usb/host/xhci-plat.c
    267     @@ -194,6 +194,9 @@ static int xhci_plat_probe(struct platform_device *pdev)
    268     ret = clk_prepare_enable(clk);
    269     if (ret)
    270     goto put_hcd;
    271     + } else if (PTR_ERR(clk) == -EPROBE_DEFER) {
    272     + ret = -EPROBE_DEFER;
    273     + goto put_hcd;
    274     }
    275    
    276     xhci = hcd_to_xhci(hcd);
    277     diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    278     index 99b4ff42f7a0..8b5b2aca277d 100644
    279     --- a/drivers/usb/host/xhci-ring.c
    280     +++ b/drivers/usb/host/xhci-ring.c
    281     @@ -290,6 +290,14 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
    282    
    283     temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
    284     xhci->cmd_ring_state = CMD_RING_STATE_ABORTED;
    285     +
    286     + /*
    287     + * Writing the CMD_RING_ABORT bit should cause a cmd completion event,
    288     + * however on some host hw the CMD_RING_RUNNING bit is correctly cleared
    289     + * but the completion event in never sent. Use the cmd timeout timer to
    290     + * handle those cases. Use twice the time to cover the bit polling retry
    291     + */
    292     + mod_timer(&xhci->cmd_timer, jiffies + (2 * XHCI_CMD_DEFAULT_TIMEOUT));
    293     xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
    294     &xhci->op_regs->cmd_ring);
    295    
    296     @@ -314,6 +322,7 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
    297    
    298     xhci_err(xhci, "Stopped the command ring failed, "
    299     "maybe the host is dead\n");
    300     + del_timer(&xhci->cmd_timer);
    301     xhci->xhc_state |= XHCI_STATE_DYING;
    302     xhci_quiesce(xhci);
    303     xhci_halt(xhci);
    304     @@ -1253,22 +1262,21 @@ void xhci_handle_command_timeout(unsigned long data)
    305     int ret;
    306     unsigned long flags;
    307     u64 hw_ring_state;
    308     - struct xhci_command *cur_cmd = NULL;
    309     + bool second_timeout = false;
    310     xhci = (struct xhci_hcd *) data;
    311    
    312     /* mark this command to be cancelled */
    313     spin_lock_irqsave(&xhci->lock, flags);
    314     if (xhci->current_cmd) {
    315     - cur_cmd = xhci->current_cmd;
    316     - cur_cmd->status = COMP_CMD_ABORT;
    317     + if (xhci->current_cmd->status == COMP_CMD_ABORT)
    318     + second_timeout = true;
    319     + xhci->current_cmd->status = COMP_CMD_ABORT;
    320     }
    321    
    322     -
    323     /* Make sure command ring is running before aborting it */
    324     hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
    325     if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) &&
    326     (hw_ring_state & CMD_RING_RUNNING)) {
    327     -
    328     spin_unlock_irqrestore(&xhci->lock, flags);
    329     xhci_dbg(xhci, "Command timeout\n");
    330     ret = xhci_abort_cmd_ring(xhci);
    331     @@ -1280,6 +1288,15 @@ void xhci_handle_command_timeout(unsigned long data)
    332     }
    333     return;
    334     }
    335     +
    336     + /* command ring failed to restart, or host removed. Bail out */
    337     + if (second_timeout || xhci->xhc_state & XHCI_STATE_REMOVING) {
    338     + spin_unlock_irqrestore(&xhci->lock, flags);
    339     + xhci_dbg(xhci, "command timed out twice, ring start fail?\n");
    340     + xhci_cleanup_command_queue(xhci);
    341     + return;
    342     + }
    343     +
    344     /* command timeout on stopped ring, ring can't be aborted */
    345     xhci_dbg(xhci, "Command timeout on stopped ring\n");
    346     xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd);
    347     @@ -2728,7 +2745,8 @@ hw_died:
    348     writel(irq_pending, &xhci->ir_set->irq_pending);
    349     }
    350    
    351     - if (xhci->xhc_state & XHCI_STATE_DYING) {
    352     + if (xhci->xhc_state & XHCI_STATE_DYING ||
    353     + xhci->xhc_state & XHCI_STATE_HALTED) {
    354     xhci_dbg(xhci, "xHCI dying, ignoring interrupt. "
    355     "Shouldn't IRQs be disabled?\n");
    356     /* Clear the event handler busy flag (RW1C);
    357     diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    358     index 9e71c96ad74a..327280535848 100644
    359     --- a/drivers/usb/host/xhci.c
    360     +++ b/drivers/usb/host/xhci.c
    361     @@ -685,20 +685,23 @@ void xhci_stop(struct usb_hcd *hcd)
    362     u32 temp;
    363     struct xhci_hcd *xhci = hcd_to_xhci(hcd);
    364    
    365     - if (xhci->xhc_state & XHCI_STATE_HALTED)
    366     - return;
    367     -
    368     mutex_lock(&xhci->mutex);
    369     - spin_lock_irq(&xhci->lock);
    370     - xhci->xhc_state |= XHCI_STATE_HALTED;
    371     - xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
    372    
    373     - /* Make sure the xHC is halted for a USB3 roothub
    374     - * (xhci_stop() could be called as part of failed init).
    375     - */
    376     - xhci_halt(xhci);
    377     - xhci_reset(xhci);
    378     - spin_unlock_irq(&xhci->lock);
    379     + if (!(xhci->xhc_state & XHCI_STATE_HALTED)) {
    380     + spin_lock_irq(&xhci->lock);
    381     +
    382     + xhci->xhc_state |= XHCI_STATE_HALTED;
    383     + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
    384     + xhci_halt(xhci);
    385     + xhci_reset(xhci);
    386     +
    387     + spin_unlock_irq(&xhci->lock);
    388     + }
    389     +
    390     + if (!usb_hcd_is_primary_hcd(hcd)) {
    391     + mutex_unlock(&xhci->mutex);
    392     + return;
    393     + }
    394    
    395     xhci_cleanup_msix(xhci);
    396    
    397     diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
    398     index 39fd95833eb8..c84f4d0816e5 100644
    399     --- a/drivers/usb/musb/musb_core.c
    400     +++ b/drivers/usb/musb/musb_core.c
    401     @@ -2429,7 +2429,8 @@ static void musb_restore_context(struct musb *musb)
    402     musb_writew(musb_base, MUSB_INTRTXE, musb->intrtxe);
    403     musb_writew(musb_base, MUSB_INTRRXE, musb->intrrxe);
    404     musb_writeb(musb_base, MUSB_INTRUSBE, musb->context.intrusbe);
    405     - musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl);
    406     + if (musb->context.devctl & MUSB_DEVCTL_SESSION)
    407     + musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl);
    408    
    409     for (i = 0; i < musb->config->num_eps; ++i) {
    410     struct musb_hw_ep *hw_ep;
    411     diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
    412     index 2f8ad7f1f482..8ff03228540a 100644
    413     --- a/drivers/usb/musb/musb_host.c
    414     +++ b/drivers/usb/musb/musb_host.c
    415     @@ -594,14 +594,13 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, u8 epnum)
    416     musb_writew(ep->regs, MUSB_TXCSR, 0);
    417    
    418     /* scrub all previous state, clearing toggle */
    419     - } else {
    420     - csr = musb_readw(ep->regs, MUSB_RXCSR);
    421     - if (csr & MUSB_RXCSR_RXPKTRDY)
    422     - WARNING("rx%d, packet/%d ready?\n", ep->epnum,
    423     - musb_readw(ep->regs, MUSB_RXCOUNT));
    424     -
    425     - musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
    426     }
    427     + csr = musb_readw(ep->regs, MUSB_RXCSR);
    428     + if (csr & MUSB_RXCSR_RXPKTRDY)
    429     + WARNING("rx%d, packet/%d ready?\n", ep->epnum,
    430     + musb_readw(ep->regs, MUSB_RXCOUNT));
    431     +
    432     + musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
    433    
    434     /* target addr and (for multipoint) hub addr/port */
    435     if (musb->is_multipoint) {
    436     @@ -995,9 +994,15 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep,
    437     if (is_in) {
    438     dma = is_dma_capable() ? ep->rx_channel : NULL;
    439    
    440     - /* clear nak timeout bit */
    441     + /*
    442     + * Need to stop the transaction by clearing REQPKT first
    443     + * then the NAK Timeout bit ref MUSBMHDRC USB 2.0 HIGH-SPEED
    444     + * DUAL-ROLE CONTROLLER Programmer's Guide, section 9.2.2
    445     + */
    446     rx_csr = musb_readw(epio, MUSB_RXCSR);
    447     rx_csr |= MUSB_RXCSR_H_WZC_BITS;
    448     + rx_csr &= ~MUSB_RXCSR_H_REQPKT;
    449     + musb_writew(epio, MUSB_RXCSR, rx_csr);
    450     rx_csr &= ~MUSB_RXCSR_DATAERROR;
    451     musb_writew(epio, MUSB_RXCSR, rx_csr);
    452    
    453     @@ -1551,7 +1556,7 @@ static int musb_rx_dma_iso_cppi41(struct dma_controller *dma,
    454     struct urb *urb,
    455     size_t len)
    456     {
    457     - struct dma_channel *channel = hw_ep->tx_channel;
    458     + struct dma_channel *channel = hw_ep->rx_channel;
    459     void __iomem *epio = hw_ep->regs;
    460     dma_addr_t *buf;
    461     u32 length, res;
    462     diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
    463     index 2eddbe538cda..5608af4a369d 100644
    464     --- a/drivers/usb/serial/mos7720.c
    465     +++ b/drivers/usb/serial/mos7720.c
    466     @@ -2007,6 +2007,7 @@ static void mos7720_release(struct usb_serial *serial)
    467     urblist_entry)
    468     usb_unlink_urb(urbtrack->urb);
    469     spin_unlock_irqrestore(&mos_parport->listlock, flags);
    470     + parport_del_port(mos_parport->pp);
    471    
    472     kref_put(&mos_parport->ref_count, destroy_mos_parport);
    473     }
    474     diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
    475     index 16bc679dc2fc..ecc7d4b1dfa3 100644
    476     --- a/drivers/usb/storage/uas.c
    477     +++ b/drivers/usb/storage/uas.c
    478     @@ -835,6 +835,7 @@ static int uas_slave_configure(struct scsi_device *sdev)
    479     if (devinfo->flags & US_FL_BROKEN_FUA)
    480     sdev->broken_fua = 1;
    481    
    482     + scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
    483     return 0;
    484     }
    485    
    486     diff --git a/include/linux/bpf.h b/include/linux/bpf.h
    487     index f1d5c5acc8dd..ca80d5830bfd 100644
    488     --- a/include/linux/bpf.h
    489     +++ b/include/linux/bpf.h
    490     @@ -229,6 +229,10 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd)
    491     static inline void bpf_prog_put(struct bpf_prog *prog)
    492     {
    493     }
    494     +
    495     +static inline void bpf_prog_put_rcu(struct bpf_prog *prog)
    496     +{
    497     +}
    498     #endif /* CONFIG_BPF_SYSCALL */
    499    
    500     /* verifier prototypes for helper functions called from eBPF programs */
    501     diff --git a/include/linux/net.h b/include/linux/net.h
    502     index f840d77c6c31..9d90efe6a708 100644
    503     --- a/include/linux/net.h
    504     +++ b/include/linux/net.h
    505     @@ -252,7 +252,8 @@ do { \
    506     DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \
    507     if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) && \
    508     net_ratelimit()) \
    509     - __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__); \
    510     + __dynamic_pr_debug(&descriptor, pr_fmt(fmt), \
    511     + ##__VA_ARGS__); \
    512     } while (0)
    513     #elif defined(DEBUG)
    514     #define net_dbg_ratelimited(fmt, ...) \
    515     diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
    516     index 4018b48f2b3b..a0596ca0e80a 100644
    517     --- a/include/linux/sock_diag.h
    518     +++ b/include/linux/sock_diag.h
    519     @@ -36,6 +36,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk)
    520     {
    521     switch (sk->sk_family) {
    522     case AF_INET:
    523     + if (sk->sk_type == SOCK_RAW)
    524     + return SKNLGRP_NONE;
    525     +
    526     switch (sk->sk_protocol) {
    527     case IPPROTO_TCP:
    528     return SKNLGRP_INET_TCP_DESTROY;
    529     @@ -45,6 +48,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk)
    530     return SKNLGRP_NONE;
    531     }
    532     case AF_INET6:
    533     + if (sk->sk_type == SOCK_RAW)
    534     + return SKNLGRP_NONE;
    535     +
    536     switch (sk->sk_protocol) {
    537     case IPPROTO_TCP:
    538     return SKNLGRP_INET6_TCP_DESTROY;
    539     diff --git a/kernel/events/core.c b/kernel/events/core.c
    540     index c0ded2416615..a69c90cea05d 100644
    541     --- a/kernel/events/core.c
    542     +++ b/kernel/events/core.c
    543     @@ -7143,7 +7143,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event)
    544     prog = event->tp_event->prog;
    545     if (prog) {
    546     event->tp_event->prog = NULL;
    547     - bpf_prog_put(prog);
    548     + bpf_prog_put_rcu(prog);
    549     }
    550     }
    551    
    552     diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    553     index fbd0acf80b13..2fdebabbfacd 100644
    554     --- a/net/ax25/af_ax25.c
    555     +++ b/net/ax25/af_ax25.c
    556     @@ -976,7 +976,8 @@ static int ax25_release(struct socket *sock)
    557     release_sock(sk);
    558     ax25_disconnect(ax25, 0);
    559     lock_sock(sk);
    560     - ax25_destroy_socket(ax25);
    561     + if (!sock_flag(ax25->sk, SOCK_DESTROY))
    562     + ax25_destroy_socket(ax25);
    563     break;
    564    
    565     case AX25_STATE_3:
    566     diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
    567     index 951cd57bb07d..5237dff6941d 100644
    568     --- a/net/ax25/ax25_ds_timer.c
    569     +++ b/net/ax25/ax25_ds_timer.c
    570     @@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
    571     switch (ax25->state) {
    572    
    573     case AX25_STATE_0:
    574     + case AX25_STATE_2:
    575     /* Magic here: If we listen() and a new link dies before it
    576     is accepted() it isn't 'dead' so doesn't get removed. */
    577     if (!sk || sock_flag(sk, SOCK_DESTROY) ||
    578     @@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
    579     sock_hold(sk);
    580     ax25_destroy_socket(ax25);
    581     bh_unlock_sock(sk);
    582     + /* Ungrab socket and destroy it */
    583     sock_put(sk);
    584     } else
    585     ax25_destroy_socket(ax25);
    586     @@ -213,7 +215,8 @@ void ax25_ds_t1_timeout(ax25_cb *ax25)
    587     case AX25_STATE_2:
    588     if (ax25->n2count == ax25->n2) {
    589     ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
    590     - ax25_disconnect(ax25, ETIMEDOUT);
    591     + if (!sock_flag(ax25->sk, SOCK_DESTROY))
    592     + ax25_disconnect(ax25, ETIMEDOUT);
    593     return;
    594     } else {
    595     ax25->n2count++;
    596     diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c
    597     index 004467c9e6e1..2c0d6ef66f9d 100644
    598     --- a/net/ax25/ax25_std_timer.c
    599     +++ b/net/ax25/ax25_std_timer.c
    600     @@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
    601    
    602     switch (ax25->state) {
    603     case AX25_STATE_0:
    604     + case AX25_STATE_2:
    605     /* Magic here: If we listen() and a new link dies before it
    606     is accepted() it isn't 'dead' so doesn't get removed. */
    607     if (!sk || sock_flag(sk, SOCK_DESTROY) ||
    608     @@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
    609     sock_hold(sk);
    610     ax25_destroy_socket(ax25);
    611     bh_unlock_sock(sk);
    612     + /* Ungrab socket and destroy it */
    613     sock_put(sk);
    614     } else
    615     ax25_destroy_socket(ax25);
    616     @@ -144,7 +146,8 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25)
    617     case AX25_STATE_2:
    618     if (ax25->n2count == ax25->n2) {
    619     ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
    620     - ax25_disconnect(ax25, ETIMEDOUT);
    621     + if (!sock_flag(ax25->sk, SOCK_DESTROY))
    622     + ax25_disconnect(ax25, ETIMEDOUT);
    623     return;
    624     } else {
    625     ax25->n2count++;
    626     diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
    627     index 3b78e8473a01..655a7d4c96e1 100644
    628     --- a/net/ax25/ax25_subr.c
    629     +++ b/net/ax25/ax25_subr.c
    630     @@ -264,7 +264,8 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
    631     {
    632     ax25_clear_queues(ax25);
    633    
    634     - ax25_stop_heartbeat(ax25);
    635     + if (!sock_flag(ax25->sk, SOCK_DESTROY))
    636     + ax25_stop_heartbeat(ax25);
    637     ax25_stop_t1timer(ax25);
    638     ax25_stop_t2timer(ax25);
    639     ax25_stop_t3timer(ax25);
    640     diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
    641     index 6852f3c7009c..43844144c9c4 100644
    642     --- a/net/bridge/br_multicast.c
    643     +++ b/net/bridge/br_multicast.c
    644     @@ -464,8 +464,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
    645     if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
    646     &ip6h->saddr)) {
    647     kfree_skb(skb);
    648     + br->has_ipv6_addr = 0;
    649     return NULL;
    650     }
    651     +
    652     + br->has_ipv6_addr = 1;
    653     ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
    654    
    655     hopopt = (u8 *)(ip6h + 1);
    656     @@ -1745,6 +1748,7 @@ void br_multicast_init(struct net_bridge *br)
    657     br->ip6_other_query.delay_time = 0;
    658     br->ip6_querier.port = NULL;
    659     #endif
    660     + br->has_ipv6_addr = 1;
    661    
    662     spin_lock_init(&br->multicast_lock);
    663     setup_timer(&br->multicast_router_timer,
    664     diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
    665     index d9da857182ef..f516c53bafb6 100644
    666     --- a/net/bridge/br_private.h
    667     +++ b/net/bridge/br_private.h
    668     @@ -304,6 +304,7 @@ struct net_bridge
    669     u8 multicast_disabled:1;
    670     u8 multicast_querier:1;
    671     u8 multicast_query_use_ifaddr:1;
    672     + u8 has_ipv6_addr:1;
    673    
    674     u32 hash_elasticity;
    675     u32 hash_max;
    676     @@ -577,10 +578,22 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
    677    
    678     static inline bool
    679     __br_multicast_querier_exists(struct net_bridge *br,
    680     - struct bridge_mcast_other_query *querier)
    681     + struct bridge_mcast_other_query *querier,
    682     + const bool is_ipv6)
    683     {
    684     + bool own_querier_enabled;
    685     +
    686     + if (br->multicast_querier) {
    687     + if (is_ipv6 && !br->has_ipv6_addr)
    688     + own_querier_enabled = false;
    689     + else
    690     + own_querier_enabled = true;
    691     + } else {
    692     + own_querier_enabled = false;
    693     + }
    694     +
    695     return time_is_before_jiffies(querier->delay_time) &&
    696     - (br->multicast_querier || timer_pending(&querier->timer));
    697     + (own_querier_enabled || timer_pending(&querier->timer));
    698     }
    699    
    700     static inline bool br_multicast_querier_exists(struct net_bridge *br,
    701     @@ -588,10 +601,12 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br,
    702     {
    703     switch (eth->h_proto) {
    704     case (htons(ETH_P_IP)):
    705     - return __br_multicast_querier_exists(br, &br->ip4_other_query);
    706     + return __br_multicast_querier_exists(br,
    707     + &br->ip4_other_query, false);
    708     #if IS_ENABLED(CONFIG_IPV6)
    709     case (htons(ETH_P_IPV6)):
    710     - return __br_multicast_querier_exists(br, &br->ip6_other_query);
    711     + return __br_multicast_querier_exists(br,
    712     + &br->ip6_other_query, true);
    713     #endif
    714     default:
    715     return false;
    716     diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    717     index f18ae91b652e..769cece9b00b 100644
    718     --- a/net/core/neighbour.c
    719     +++ b/net/core/neighbour.c
    720     @@ -2467,13 +2467,17 @@ int neigh_xmit(int index, struct net_device *dev,
    721     tbl = neigh_tables[index];
    722     if (!tbl)
    723     goto out;
    724     + rcu_read_lock_bh();
    725     neigh = __neigh_lookup_noref(tbl, addr, dev);
    726     if (!neigh)
    727     neigh = __neigh_create(tbl, addr, dev, false);
    728     err = PTR_ERR(neigh);
    729     - if (IS_ERR(neigh))
    730     + if (IS_ERR(neigh)) {
    731     + rcu_read_unlock_bh();
    732     goto out_kfree_skb;
    733     + }
    734     err = neigh->output(neigh, skb);
    735     + rcu_read_unlock_bh();
    736     }
    737     else if (index == NEIGH_LINK_TABLE) {
    738     err = dev_hard_header(skb, dev, ntohs(skb->protocol),
    739     diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
    740     index 477937465a20..d95631d09248 100644
    741     --- a/net/ipv4/esp4.c
    742     +++ b/net/ipv4/esp4.c
    743     @@ -23,6 +23,11 @@ struct esp_skb_cb {
    744     void *tmp;
    745     };
    746    
    747     +struct esp_output_extra {
    748     + __be32 seqhi;
    749     + u32 esphoff;
    750     +};
    751     +
    752     #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
    753    
    754     static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
    755     @@ -35,11 +40,11 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
    756     *
    757     * TODO: Use spare space in skb for this where possible.
    758     */
    759     -static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen)
    760     +static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int extralen)
    761     {
    762     unsigned int len;
    763    
    764     - len = seqhilen;
    765     + len = extralen;
    766    
    767     len += crypto_aead_ivsize(aead);
    768    
    769     @@ -57,15 +62,16 @@ static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen)
    770     return kmalloc(len, GFP_ATOMIC);
    771     }
    772    
    773     -static inline __be32 *esp_tmp_seqhi(void *tmp)
    774     +static inline void *esp_tmp_extra(void *tmp)
    775     {
    776     - return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32));
    777     + return PTR_ALIGN(tmp, __alignof__(struct esp_output_extra));
    778     }
    779     -static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen)
    780     +
    781     +static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int extralen)
    782     {
    783     return crypto_aead_ivsize(aead) ?
    784     - PTR_ALIGN((u8 *)tmp + seqhilen,
    785     - crypto_aead_alignmask(aead) + 1) : tmp + seqhilen;
    786     + PTR_ALIGN((u8 *)tmp + extralen,
    787     + crypto_aead_alignmask(aead) + 1) : tmp + extralen;
    788     }
    789    
    790     static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv)
    791     @@ -99,7 +105,7 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset)
    792     {
    793     struct ip_esp_hdr *esph = (void *)(skb->data + offset);
    794     void *tmp = ESP_SKB_CB(skb)->tmp;
    795     - __be32 *seqhi = esp_tmp_seqhi(tmp);
    796     + __be32 *seqhi = esp_tmp_extra(tmp);
    797    
    798     esph->seq_no = esph->spi;
    799     esph->spi = *seqhi;
    800     @@ -107,7 +113,11 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset)
    801    
    802     static void esp_output_restore_header(struct sk_buff *skb)
    803     {
    804     - esp_restore_header(skb, skb_transport_offset(skb) - sizeof(__be32));
    805     + void *tmp = ESP_SKB_CB(skb)->tmp;
    806     + struct esp_output_extra *extra = esp_tmp_extra(tmp);
    807     +
    808     + esp_restore_header(skb, skb_transport_offset(skb) + extra->esphoff -
    809     + sizeof(__be32));
    810     }
    811    
    812     static void esp_output_done_esn(struct crypto_async_request *base, int err)
    813     @@ -121,6 +131,7 @@ static void esp_output_done_esn(struct crypto_async_request *base, int err)
    814     static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
    815     {
    816     int err;
    817     + struct esp_output_extra *extra;
    818     struct ip_esp_hdr *esph;
    819     struct crypto_aead *aead;
    820     struct aead_request *req;
    821     @@ -137,8 +148,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
    822     int tfclen;
    823     int nfrags;
    824     int assoclen;
    825     - int seqhilen;
    826     - __be32 *seqhi;
    827     + int extralen;
    828     __be64 seqno;
    829    
    830     /* skb is pure payload to encrypt */
    831     @@ -166,21 +176,21 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
    832     nfrags = err;
    833    
    834     assoclen = sizeof(*esph);
    835     - seqhilen = 0;
    836     + extralen = 0;
    837    
    838     if (x->props.flags & XFRM_STATE_ESN) {
    839     - seqhilen += sizeof(__be32);
    840     - assoclen += seqhilen;
    841     + extralen += sizeof(*extra);
    842     + assoclen += sizeof(__be32);
    843     }
    844    
    845     - tmp = esp_alloc_tmp(aead, nfrags, seqhilen);
    846     + tmp = esp_alloc_tmp(aead, nfrags, extralen);
    847     if (!tmp) {
    848     err = -ENOMEM;
    849     goto error;
    850     }
    851    
    852     - seqhi = esp_tmp_seqhi(tmp);
    853     - iv = esp_tmp_iv(aead, tmp, seqhilen);
    854     + extra = esp_tmp_extra(tmp);
    855     + iv = esp_tmp_iv(aead, tmp, extralen);
    856     req = esp_tmp_req(aead, iv);
    857     sg = esp_req_sg(aead, req);
    858    
    859     @@ -247,8 +257,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
    860     * encryption.
    861     */
    862     if ((x->props.flags & XFRM_STATE_ESN)) {
    863     - esph = (void *)(skb_transport_header(skb) - sizeof(__be32));
    864     - *seqhi = esph->spi;
    865     + extra->esphoff = (unsigned char *)esph -
    866     + skb_transport_header(skb);
    867     + esph = (struct ip_esp_hdr *)((unsigned char *)esph - 4);
    868     + extra->seqhi = esph->spi;
    869     esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.hi);
    870     aead_request_set_callback(req, 0, esp_output_done_esn, skb);
    871     }
    872     @@ -445,7 +457,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
    873     goto out;
    874    
    875     ESP_SKB_CB(skb)->tmp = tmp;
    876     - seqhi = esp_tmp_seqhi(tmp);
    877     + seqhi = esp_tmp_extra(tmp);
    878     iv = esp_tmp_iv(aead, tmp, seqhilen);
    879     req = esp_tmp_req(aead, iv);
    880     sg = esp_req_sg(aead, req);
    881     diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
    882     index 395e2814a46d..a42dd8021b6b 100644
    883     --- a/net/ipv4/ipmr.c
    884     +++ b/net/ipv4/ipmr.c
    885     @@ -891,8 +891,10 @@ static struct mfc_cache *ipmr_cache_alloc(void)
    886     {
    887     struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
    888    
    889     - if (c)
    890     + if (c) {
    891     + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
    892     c->mfc_un.res.minvif = MAXVIFS;
    893     + }
    894     return c;
    895     }
    896    
    897     diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
    898     index a10e77103c88..e207cb2468da 100644
    899     --- a/net/ipv6/ip6mr.c
    900     +++ b/net/ipv6/ip6mr.c
    901     @@ -1074,6 +1074,7 @@ static struct mfc6_cache *ip6mr_cache_alloc(void)
    902     struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
    903     if (!c)
    904     return NULL;
    905     + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
    906     c->mfc_un.res.minvif = MAXMIFS;
    907     return c;
    908     }
    909     diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    910     index 83384308d032..6c53e4eb0f09 100644
    911     --- a/net/ipv6/sit.c
    912     +++ b/net/ipv6/sit.c
    913     @@ -560,13 +560,13 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
    914    
    915     if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
    916     ipv4_update_pmtu(skb, dev_net(skb->dev), info,
    917     - t->parms.link, 0, IPPROTO_IPV6, 0);
    918     + t->parms.link, 0, iph->protocol, 0);
    919     err = 0;
    920     goto out;
    921     }
    922     if (type == ICMP_REDIRECT) {
    923     ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
    924     - IPPROTO_IPV6, 0);
    925     + iph->protocol, 0);
    926     err = 0;
    927     goto out;
    928     }
    929     diff --git a/net/kcm/kcmproc.c b/net/kcm/kcmproc.c
    930     index 738008726cc6..fda7f4715c58 100644
    931     --- a/net/kcm/kcmproc.c
    932     +++ b/net/kcm/kcmproc.c
    933     @@ -241,6 +241,7 @@ static const struct file_operations kcm_seq_fops = {
    934     .open = kcm_seq_open,
    935     .read = seq_read,
    936     .llseek = seq_lseek,
    937     + .release = seq_release_net,
    938     };
    939    
    940     static struct kcm_seq_muxinfo kcm_seq_muxinfo = {
    941     diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
    942     index 8b5270008a6e..606323339e1f 100644
    943     --- a/net/sched/act_ipt.c
    944     +++ b/net/sched/act_ipt.c
    945     @@ -121,10 +121,13 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla,
    946     }
    947    
    948     td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
    949     - if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size)
    950     + if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) {
    951     + if (exists)
    952     + tcf_hash_release(a, bind);
    953     return -EINVAL;
    954     + }
    955    
    956     - if (!tcf_hash_check(tn, index, a, bind)) {
    957     + if (!exists) {
    958     ret = tcf_hash_create(tn, index, est, a, sizeof(*ipt), bind,
    959     false);
    960     if (ret)
    961     diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
    962     index 2177eac0a61e..2e4bd2c0a50c 100644
    963     --- a/net/sched/sch_fifo.c
    964     +++ b/net/sched/sch_fifo.c
    965     @@ -37,14 +37,18 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch)
    966    
    967     static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch)
    968     {
    969     + unsigned int prev_backlog;
    970     +
    971     if (likely(skb_queue_len(&sch->q) < sch->limit))
    972     return qdisc_enqueue_tail(skb, sch);
    973    
    974     + prev_backlog = sch->qstats.backlog;
    975     /* queue full, remove one skb to fulfill the limit */
    976     __qdisc_queue_drop_head(sch, &sch->q);
    977     qdisc_qstats_drop(sch);
    978     qdisc_enqueue_tail(skb, sch);
    979    
    980     + qdisc_tree_reduce_backlog(sch, 0, prev_backlog - sch->qstats.backlog);
    981     return NET_XMIT_CN;
    982     }
    983    
    984     diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
    985     index 4befe97a9034..b7c29d5b6f04 100644
    986     --- a/net/sched/sch_netem.c
    987     +++ b/net/sched/sch_netem.c
    988     @@ -650,14 +650,14 @@ deliver:
    989     #endif
    990    
    991     if (q->qdisc) {
    992     + unsigned int pkt_len = qdisc_pkt_len(skb);
    993     int err = qdisc_enqueue(skb, q->qdisc);
    994    
    995     - if (unlikely(err != NET_XMIT_SUCCESS)) {
    996     - if (net_xmit_drop_count(err)) {
    997     - qdisc_qstats_drop(sch);
    998     - qdisc_tree_reduce_backlog(sch, 1,
    999     - qdisc_pkt_len(skb));
    1000     - }
    1001     + if (err != NET_XMIT_SUCCESS &&
    1002     + net_xmit_drop_count(err)) {
    1003     + qdisc_qstats_drop(sch);
    1004     + qdisc_tree_reduce_backlog(sch, 1,
    1005     + pkt_len);
    1006     }
    1007     goto tfifo_dequeue;
    1008     }