Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.6/0103-4.6.4-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-4.6/0103-4.6.4-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2818 - (show annotations) (download)
    Thu Aug 4 13:24:47 2016 UTC (7 years, 9 months ago) by niro
    File size: 33248 byte(s) 
    -linux-4.6.4
    1 diff --git a/Makefile b/Makefile
    2 index c62b531d5a85..cd374426114a 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 6
    8 -SUBLEVEL = 3
    9 +SUBLEVEL = 4
    10 EXTRAVERSION =
    11 NAME = Charred Weasel
    12
    13 diff --git a/crypto/crypto_user.c b/crypto/crypto_user.c
    14 index 43fe85f20d57..7097a3395b25 100644
    15 --- a/crypto/crypto_user.c
    16 +++ b/crypto/crypto_user.c
    17 @@ -455,6 +455,7 @@ static const int crypto_msg_min[CRYPTO_NR_MSGTYPES] = {
    18 [CRYPTO_MSG_NEWALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
    19 [CRYPTO_MSG_DELALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
    20 [CRYPTO_MSG_UPDATEALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
    21 + [CRYPTO_MSG_GETALG - CRYPTO_MSG_BASE] = MSGSIZE(crypto_user_alg),
    22 [CRYPTO_MSG_DELRNG - CRYPTO_MSG_BASE] = 0,
    23 };
    24
    25 diff --git a/drivers/crypto/ux500/hash/hash_core.c b/drivers/crypto/ux500/hash/hash_core.c
    26 index 574e87c7f2b8..9acccad26928 100644
    27 --- a/drivers/crypto/ux500/hash/hash_core.c
    28 +++ b/drivers/crypto/ux500/hash/hash_core.c
    29 @@ -781,7 +781,7 @@ static int hash_process_data(struct hash_device_data *device_data,
    30 &device_data->state);
    31 memmove(req_ctx->state.buffer,
    32 device_data->state.buffer,
    33 - HASH_BLOCK_SIZE / sizeof(u32));
    34 + HASH_BLOCK_SIZE);
    35 if (ret) {
    36 dev_err(device_data->dev,
    37 "%s: hash_resume_state() failed!\n",
    38 @@ -832,7 +832,7 @@ static int hash_process_data(struct hash_device_data *device_data,
    39
    40 memmove(device_data->state.buffer,
    41 req_ctx->state.buffer,
    42 - HASH_BLOCK_SIZE / sizeof(u32));
    43 + HASH_BLOCK_SIZE);
    44 if (ret) {
    45 dev_err(device_data->dev, "%s: hash_save_state() failed!\n",
    46 __func__);
    47 diff --git a/drivers/crypto/vmx/aes_cbc.c b/drivers/crypto/vmx/aes_cbc.c
    48 index 495577b6d31b..94ad5c0adbcb 100644
    49 --- a/drivers/crypto/vmx/aes_cbc.c
    50 +++ b/drivers/crypto/vmx/aes_cbc.c
    51 @@ -182,7 +182,7 @@ struct crypto_alg p8_aes_cbc_alg = {
    52 .cra_name = "cbc(aes)",
    53 .cra_driver_name = "p8_aes_cbc",
    54 .cra_module = THIS_MODULE,
    55 - .cra_priority = 1000,
    56 + .cra_priority = 2000,
    57 .cra_type = &crypto_blkcipher_type,
    58 .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK,
    59 .cra_alignmask = 0,
    60 diff --git a/drivers/crypto/vmx/aes_ctr.c b/drivers/crypto/vmx/aes_ctr.c
    61 index 0a3c1b04cf3c..38ed10d761d0 100644
    62 --- a/drivers/crypto/vmx/aes_ctr.c
    63 +++ b/drivers/crypto/vmx/aes_ctr.c
    64 @@ -166,7 +166,7 @@ struct crypto_alg p8_aes_ctr_alg = {
    65 .cra_name = "ctr(aes)",
    66 .cra_driver_name = "p8_aes_ctr",
    67 .cra_module = THIS_MODULE,
    68 - .cra_priority = 1000,
    69 + .cra_priority = 2000,
    70 .cra_type = &crypto_blkcipher_type,
    71 .cra_flags = CRYPTO_ALG_TYPE_BLKCIPHER | CRYPTO_ALG_NEED_FALLBACK,
    72 .cra_alignmask = 0,
    73 diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
    74 index 6dc810bce295..944a6dca0fcb 100644
    75 --- a/drivers/usb/core/quirks.c
    76 +++ b/drivers/usb/core/quirks.c
    77 @@ -44,6 +44,9 @@ static const struct usb_device_id usb_quirk_list[] = {
    78 /* Creative SB Audigy 2 NX */
    79 { USB_DEVICE(0x041e, 0x3020), .driver_info = USB_QUIRK_RESET_RESUME },
    80
    81 + /* USB3503 */
    82 + { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
    83 +
    84 /* Microsoft Wireless Laser Mouse 6000 Receiver */
    85 { USB_DEVICE(0x045e, 0x00e1), .driver_info = USB_QUIRK_RESET_RESUME },
    86
    87 @@ -173,6 +176,10 @@ static const struct usb_device_id usb_quirk_list[] = {
    88 /* MAYA44USB sound device */
    89 { USB_DEVICE(0x0a92, 0x0091), .driver_info = USB_QUIRK_RESET_RESUME },
    90
    91 + /* ASUS Base Station(T100) */
    92 + { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
    93 + USB_QUIRK_IGNORE_REMOTE_WAKEUP },
    94 +
    95 /* Action Semiconductor flash disk */
    96 { USB_DEVICE(0x10d6, 0x2200), .driver_info =
    97 USB_QUIRK_STRING_FETCH_255 },
    98 @@ -188,26 +195,22 @@ static const struct usb_device_id usb_quirk_list[] = {
    99 { USB_DEVICE(0x1908, 0x1315), .driver_info =
    100 USB_QUIRK_HONOR_BNUMINTERFACES },
    101
    102 - /* INTEL VALUE SSD */
    103 - { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
    104 -
    105 - /* USB3503 */
    106 - { USB_DEVICE(0x0424, 0x3503), .driver_info = USB_QUIRK_RESET_RESUME },
    107 -
    108 - /* ASUS Base Station(T100) */
    109 - { USB_DEVICE(0x0b05, 0x17e0), .driver_info =
    110 - USB_QUIRK_IGNORE_REMOTE_WAKEUP },
    111 -
    112 /* Protocol and OTG Electrical Test Device */
    113 { USB_DEVICE(0x1a0a, 0x0200), .driver_info =
    114 USB_QUIRK_LINEAR_UFRAME_INTR_BINTERVAL },
    115
    116 + /* Acer C120 LED Projector */
    117 + { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
    118 +
    119 /* Blackmagic Design Intensity Shuttle */
    120 { USB_DEVICE(0x1edb, 0xbd3b), .driver_info = USB_QUIRK_NO_LPM },
    121
    122 /* Blackmagic Design UltraStudio SDI */
    123 { USB_DEVICE(0x1edb, 0xbd4f), .driver_info = USB_QUIRK_NO_LPM },
    124
    125 + /* INTEL VALUE SSD */
    126 + { USB_DEVICE(0x8086, 0xf1a5), .driver_info = USB_QUIRK_RESET_RESUME },
    127 +
    128 { } /* terminating entry must be last */
    129 };
    130
    131 diff --git a/drivers/usb/dwc3/dwc3-exynos.c b/drivers/usb/dwc3/dwc3-exynos.c
    132 index dd5cb5577dca..2f1fb7e7aa54 100644
    133 --- a/drivers/usb/dwc3/dwc3-exynos.c
    134 +++ b/drivers/usb/dwc3/dwc3-exynos.c
    135 @@ -128,12 +128,6 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
    136
    137 platform_set_drvdata(pdev, exynos);
    138
    139 - ret = dwc3_exynos_register_phys(exynos);
    140 - if (ret) {
    141 - dev_err(dev, "couldn't register PHYs\n");
    142 - return ret;
    143 - }
    144 -
    145 exynos->dev = dev;
    146
    147 exynos->clk = devm_clk_get(dev, "usbdrd30");
    148 @@ -183,20 +177,29 @@ static int dwc3_exynos_probe(struct platform_device *pdev)
    149 goto err3;
    150 }
    151
    152 + ret = dwc3_exynos_register_phys(exynos);
    153 + if (ret) {
    154 + dev_err(dev, "couldn't register PHYs\n");
    155 + goto err4;
    156 + }
    157 +
    158 if (node) {
    159 ret = of_platform_populate(node, NULL, NULL, dev);
    160 if (ret) {
    161 dev_err(dev, "failed to add dwc3 core\n");
    162 - goto err4;
    163 + goto err5;
    164 }
    165 } else {
    166 dev_err(dev, "no device node, failed to add dwc3 core\n");
    167 ret = -ENODEV;
    168 - goto err4;
    169 + goto err5;
    170 }
    171
    172 return 0;
    173
    174 +err5:
    175 + platform_device_unregister(exynos->usb2_phy);
    176 + platform_device_unregister(exynos->usb3_phy);
    177 err4:
    178 regulator_disable(exynos->vdd10);
    179 err3:
    180 diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
    181 index e64479f882a5..aa3707bdebb4 100644
    182 --- a/drivers/usb/gadget/legacy/inode.c
    183 +++ b/drivers/usb/gadget/legacy/inode.c
    184 @@ -938,8 +938,11 @@ ep0_read (struct file *fd, char __user *buf, size_t len, loff_t *ptr)
    185 struct usb_ep *ep = dev->gadget->ep0;
    186 struct usb_request *req = dev->req;
    187
    188 - if ((retval = setup_req (ep, req, 0)) == 0)
    189 - retval = usb_ep_queue (ep, req, GFP_ATOMIC);
    190 + if ((retval = setup_req (ep, req, 0)) == 0) {
    191 + spin_unlock_irq (&dev->lock);
    192 + retval = usb_ep_queue (ep, req, GFP_KERNEL);
    193 + spin_lock_irq (&dev->lock);
    194 + }
    195 dev->state = STATE_DEV_CONNECTED;
    196
    197 /* assume that was SET_CONFIGURATION */
    198 @@ -1457,8 +1460,11 @@ delegate:
    199 w_length);
    200 if (value < 0)
    201 break;
    202 +
    203 + spin_unlock (&dev->lock);
    204 value = usb_ep_queue (gadget->ep0, dev->req,
    205 - GFP_ATOMIC);
    206 + GFP_KERNEL);
    207 + spin_lock (&dev->lock);
    208 if (value < 0) {
    209 clean_req (gadget->ep0, dev->req);
    210 break;
    211 @@ -1481,11 +1487,14 @@ delegate:
    212 if (value >= 0 && dev->state != STATE_DEV_SETUP) {
    213 req->length = value;
    214 req->zero = value < w_length;
    215 - value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
    216 +
    217 + spin_unlock (&dev->lock);
    218 + value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
    219 if (value < 0) {
    220 DBG (dev, "ep_queue --> %d\n", value);
    221 req->status = 0;
    222 }
    223 + return value;
    224 }
    225
    226 /* device stalls when value < 0 */
    227 diff --git a/drivers/usb/host/ehci-tegra.c b/drivers/usb/host/ehci-tegra.c
    228 index 4031b372008e..c1c1024a054c 100644
    229 --- a/drivers/usb/host/ehci-tegra.c
    230 +++ b/drivers/usb/host/ehci-tegra.c
    231 @@ -89,7 +89,7 @@ static int tegra_reset_usb_controller(struct platform_device *pdev)
    232 if (!usb1_reset_attempted) {
    233 struct reset_control *usb1_reset;
    234
    235 - usb1_reset = of_reset_control_get(phy_np, "usb");
    236 + usb1_reset = of_reset_control_get(phy_np, "utmi-pads");
    237 if (IS_ERR(usb1_reset)) {
    238 dev_warn(&pdev->dev,
    239 "can't get utmi-pads reset from the PHY\n");
    240 diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    241 index 48672fac7ff3..c10972fcc8e4 100644
    242 --- a/drivers/usb/host/xhci-pci.c
    243 +++ b/drivers/usb/host/xhci-pci.c
    244 @@ -37,6 +37,7 @@
    245 /* Device for a quirk */
    246 #define PCI_VENDOR_ID_FRESCO_LOGIC 0x1b73
    247 #define PCI_DEVICE_ID_FRESCO_LOGIC_PDK 0x1000
    248 +#define PCI_DEVICE_ID_FRESCO_LOGIC_FL1009 0x1009
    249 #define PCI_DEVICE_ID_FRESCO_LOGIC_FL1400 0x1400
    250
    251 #define PCI_VENDOR_ID_ETRON 0x1b6f
    252 @@ -114,6 +115,10 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    253 xhci->quirks |= XHCI_TRUST_TX_LENGTH;
    254 }
    255
    256 + if (pdev->vendor == PCI_VENDOR_ID_FRESCO_LOGIC &&
    257 + pdev->device == PCI_DEVICE_ID_FRESCO_LOGIC_FL1009)
    258 + xhci->quirks |= XHCI_BROKEN_STREAMS;
    259 +
    260 if (pdev->vendor == PCI_VENDOR_ID_NEC)
    261 xhci->quirks |= XHCI_NEC_HOST;
    262
    263 diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
    264 index 474b5fa14900..d6e2b2751e50 100644
    265 --- a/drivers/usb/host/xhci-plat.c
    266 +++ b/drivers/usb/host/xhci-plat.c
    267 @@ -194,6 +194,9 @@ static int xhci_plat_probe(struct platform_device *pdev)
    268 ret = clk_prepare_enable(clk);
    269 if (ret)
    270 goto put_hcd;
    271 + } else if (PTR_ERR(clk) == -EPROBE_DEFER) {
    272 + ret = -EPROBE_DEFER;
    273 + goto put_hcd;
    274 }
    275
    276 xhci = hcd_to_xhci(hcd);
    277 diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
    278 index 99b4ff42f7a0..8b5b2aca277d 100644
    279 --- a/drivers/usb/host/xhci-ring.c
    280 +++ b/drivers/usb/host/xhci-ring.c
    281 @@ -290,6 +290,14 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
    282
    283 temp_64 = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
    284 xhci->cmd_ring_state = CMD_RING_STATE_ABORTED;
    285 +
    286 + /*
    287 + * Writing the CMD_RING_ABORT bit should cause a cmd completion event,
    288 + * however on some host hw the CMD_RING_RUNNING bit is correctly cleared
    289 + * but the completion event in never sent. Use the cmd timeout timer to
    290 + * handle those cases. Use twice the time to cover the bit polling retry
    291 + */
    292 + mod_timer(&xhci->cmd_timer, jiffies + (2 * XHCI_CMD_DEFAULT_TIMEOUT));
    293 xhci_write_64(xhci, temp_64 | CMD_RING_ABORT,
    294 &xhci->op_regs->cmd_ring);
    295
    296 @@ -314,6 +322,7 @@ static int xhci_abort_cmd_ring(struct xhci_hcd *xhci)
    297
    298 xhci_err(xhci, "Stopped the command ring failed, "
    299 "maybe the host is dead\n");
    300 + del_timer(&xhci->cmd_timer);
    301 xhci->xhc_state |= XHCI_STATE_DYING;
    302 xhci_quiesce(xhci);
    303 xhci_halt(xhci);
    304 @@ -1253,22 +1262,21 @@ void xhci_handle_command_timeout(unsigned long data)
    305 int ret;
    306 unsigned long flags;
    307 u64 hw_ring_state;
    308 - struct xhci_command *cur_cmd = NULL;
    309 + bool second_timeout = false;
    310 xhci = (struct xhci_hcd *) data;
    311
    312 /* mark this command to be cancelled */
    313 spin_lock_irqsave(&xhci->lock, flags);
    314 if (xhci->current_cmd) {
    315 - cur_cmd = xhci->current_cmd;
    316 - cur_cmd->status = COMP_CMD_ABORT;
    317 + if (xhci->current_cmd->status == COMP_CMD_ABORT)
    318 + second_timeout = true;
    319 + xhci->current_cmd->status = COMP_CMD_ABORT;
    320 }
    321
    322 -
    323 /* Make sure command ring is running before aborting it */
    324 hw_ring_state = xhci_read_64(xhci, &xhci->op_regs->cmd_ring);
    325 if ((xhci->cmd_ring_state & CMD_RING_STATE_RUNNING) &&
    326 (hw_ring_state & CMD_RING_RUNNING)) {
    327 -
    328 spin_unlock_irqrestore(&xhci->lock, flags);
    329 xhci_dbg(xhci, "Command timeout\n");
    330 ret = xhci_abort_cmd_ring(xhci);
    331 @@ -1280,6 +1288,15 @@ void xhci_handle_command_timeout(unsigned long data)
    332 }
    333 return;
    334 }
    335 +
    336 + /* command ring failed to restart, or host removed. Bail out */
    337 + if (second_timeout || xhci->xhc_state & XHCI_STATE_REMOVING) {
    338 + spin_unlock_irqrestore(&xhci->lock, flags);
    339 + xhci_dbg(xhci, "command timed out twice, ring start fail?\n");
    340 + xhci_cleanup_command_queue(xhci);
    341 + return;
    342 + }
    343 +
    344 /* command timeout on stopped ring, ring can't be aborted */
    345 xhci_dbg(xhci, "Command timeout on stopped ring\n");
    346 xhci_handle_stopped_cmd_ring(xhci, xhci->current_cmd);
    347 @@ -2728,7 +2745,8 @@ hw_died:
    348 writel(irq_pending, &xhci->ir_set->irq_pending);
    349 }
    350
    351 - if (xhci->xhc_state & XHCI_STATE_DYING) {
    352 + if (xhci->xhc_state & XHCI_STATE_DYING ||
    353 + xhci->xhc_state & XHCI_STATE_HALTED) {
    354 xhci_dbg(xhci, "xHCI dying, ignoring interrupt. "
    355 "Shouldn't IRQs be disabled?\n");
    356 /* Clear the event handler busy flag (RW1C);
    357 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    358 index 9e71c96ad74a..327280535848 100644
    359 --- a/drivers/usb/host/xhci.c
    360 +++ b/drivers/usb/host/xhci.c
    361 @@ -685,20 +685,23 @@ void xhci_stop(struct usb_hcd *hcd)
    362 u32 temp;
    363 struct xhci_hcd *xhci = hcd_to_xhci(hcd);
    364
    365 - if (xhci->xhc_state & XHCI_STATE_HALTED)
    366 - return;
    367 -
    368 mutex_lock(&xhci->mutex);
    369 - spin_lock_irq(&xhci->lock);
    370 - xhci->xhc_state |= XHCI_STATE_HALTED;
    371 - xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
    372
    373 - /* Make sure the xHC is halted for a USB3 roothub
    374 - * (xhci_stop() could be called as part of failed init).
    375 - */
    376 - xhci_halt(xhci);
    377 - xhci_reset(xhci);
    378 - spin_unlock_irq(&xhci->lock);
    379 + if (!(xhci->xhc_state & XHCI_STATE_HALTED)) {
    380 + spin_lock_irq(&xhci->lock);
    381 +
    382 + xhci->xhc_state |= XHCI_STATE_HALTED;
    383 + xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
    384 + xhci_halt(xhci);
    385 + xhci_reset(xhci);
    386 +
    387 + spin_unlock_irq(&xhci->lock);
    388 + }
    389 +
    390 + if (!usb_hcd_is_primary_hcd(hcd)) {
    391 + mutex_unlock(&xhci->mutex);
    392 + return;
    393 + }
    394
    395 xhci_cleanup_msix(xhci);
    396
    397 diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
    398 index 39fd95833eb8..c84f4d0816e5 100644
    399 --- a/drivers/usb/musb/musb_core.c
    400 +++ b/drivers/usb/musb/musb_core.c
    401 @@ -2429,7 +2429,8 @@ static void musb_restore_context(struct musb *musb)
    402 musb_writew(musb_base, MUSB_INTRTXE, musb->intrtxe);
    403 musb_writew(musb_base, MUSB_INTRRXE, musb->intrrxe);
    404 musb_writeb(musb_base, MUSB_INTRUSBE, musb->context.intrusbe);
    405 - musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl);
    406 + if (musb->context.devctl & MUSB_DEVCTL_SESSION)
    407 + musb_writeb(musb_base, MUSB_DEVCTL, musb->context.devctl);
    408
    409 for (i = 0; i < musb->config->num_eps; ++i) {
    410 struct musb_hw_ep *hw_ep;
    411 diff --git a/drivers/usb/musb/musb_host.c b/drivers/usb/musb/musb_host.c
    412 index 2f8ad7f1f482..8ff03228540a 100644
    413 --- a/drivers/usb/musb/musb_host.c
    414 +++ b/drivers/usb/musb/musb_host.c
    415 @@ -594,14 +594,13 @@ musb_rx_reinit(struct musb *musb, struct musb_qh *qh, u8 epnum)
    416 musb_writew(ep->regs, MUSB_TXCSR, 0);
    417
    418 /* scrub all previous state, clearing toggle */
    419 - } else {
    420 - csr = musb_readw(ep->regs, MUSB_RXCSR);
    421 - if (csr & MUSB_RXCSR_RXPKTRDY)
    422 - WARNING("rx%d, packet/%d ready?\n", ep->epnum,
    423 - musb_readw(ep->regs, MUSB_RXCOUNT));
    424 -
    425 - musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
    426 }
    427 + csr = musb_readw(ep->regs, MUSB_RXCSR);
    428 + if (csr & MUSB_RXCSR_RXPKTRDY)
    429 + WARNING("rx%d, packet/%d ready?\n", ep->epnum,
    430 + musb_readw(ep->regs, MUSB_RXCOUNT));
    431 +
    432 + musb_h_flush_rxfifo(ep, MUSB_RXCSR_CLRDATATOG);
    433
    434 /* target addr and (for multipoint) hub addr/port */
    435 if (musb->is_multipoint) {
    436 @@ -995,9 +994,15 @@ static void musb_bulk_nak_timeout(struct musb *musb, struct musb_hw_ep *ep,
    437 if (is_in) {
    438 dma = is_dma_capable() ? ep->rx_channel : NULL;
    439
    440 - /* clear nak timeout bit */
    441 + /*
    442 + * Need to stop the transaction by clearing REQPKT first
    443 + * then the NAK Timeout bit ref MUSBMHDRC USB 2.0 HIGH-SPEED
    444 + * DUAL-ROLE CONTROLLER Programmer's Guide, section 9.2.2
    445 + */
    446 rx_csr = musb_readw(epio, MUSB_RXCSR);
    447 rx_csr |= MUSB_RXCSR_H_WZC_BITS;
    448 + rx_csr &= ~MUSB_RXCSR_H_REQPKT;
    449 + musb_writew(epio, MUSB_RXCSR, rx_csr);
    450 rx_csr &= ~MUSB_RXCSR_DATAERROR;
    451 musb_writew(epio, MUSB_RXCSR, rx_csr);
    452
    453 @@ -1551,7 +1556,7 @@ static int musb_rx_dma_iso_cppi41(struct dma_controller *dma,
    454 struct urb *urb,
    455 size_t len)
    456 {
    457 - struct dma_channel *channel = hw_ep->tx_channel;
    458 + struct dma_channel *channel = hw_ep->rx_channel;
    459 void __iomem *epio = hw_ep->regs;
    460 dma_addr_t *buf;
    461 u32 length, res;
    462 diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
    463 index 2eddbe538cda..5608af4a369d 100644
    464 --- a/drivers/usb/serial/mos7720.c
    465 +++ b/drivers/usb/serial/mos7720.c
    466 @@ -2007,6 +2007,7 @@ static void mos7720_release(struct usb_serial *serial)
    467 urblist_entry)
    468 usb_unlink_urb(urbtrack->urb);
    469 spin_unlock_irqrestore(&mos_parport->listlock, flags);
    470 + parport_del_port(mos_parport->pp);
    471
    472 kref_put(&mos_parport->ref_count, destroy_mos_parport);
    473 }
    474 diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
    475 index 16bc679dc2fc..ecc7d4b1dfa3 100644
    476 --- a/drivers/usb/storage/uas.c
    477 +++ b/drivers/usb/storage/uas.c
    478 @@ -835,6 +835,7 @@ static int uas_slave_configure(struct scsi_device *sdev)
    479 if (devinfo->flags & US_FL_BROKEN_FUA)
    480 sdev->broken_fua = 1;
    481
    482 + scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
    483 return 0;
    484 }
    485
    486 diff --git a/include/linux/bpf.h b/include/linux/bpf.h
    487 index f1d5c5acc8dd..ca80d5830bfd 100644
    488 --- a/include/linux/bpf.h
    489 +++ b/include/linux/bpf.h
    490 @@ -229,6 +229,10 @@ static inline struct bpf_prog *bpf_prog_get(u32 ufd)
    491 static inline void bpf_prog_put(struct bpf_prog *prog)
    492 {
    493 }
    494 +
    495 +static inline void bpf_prog_put_rcu(struct bpf_prog *prog)
    496 +{
    497 +}
    498 #endif /* CONFIG_BPF_SYSCALL */
    499
    500 /* verifier prototypes for helper functions called from eBPF programs */
    501 diff --git a/include/linux/net.h b/include/linux/net.h
    502 index f840d77c6c31..9d90efe6a708 100644
    503 --- a/include/linux/net.h
    504 +++ b/include/linux/net.h
    505 @@ -252,7 +252,8 @@ do { \
    506 DEFINE_DYNAMIC_DEBUG_METADATA(descriptor, fmt); \
    507 if (unlikely(descriptor.flags & _DPRINTK_FLAGS_PRINT) && \
    508 net_ratelimit()) \
    509 - __dynamic_pr_debug(&descriptor, fmt, ##__VA_ARGS__); \
    510 + __dynamic_pr_debug(&descriptor, pr_fmt(fmt), \
    511 + ##__VA_ARGS__); \
    512 } while (0)
    513 #elif defined(DEBUG)
    514 #define net_dbg_ratelimited(fmt, ...) \
    515 diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
    516 index 4018b48f2b3b..a0596ca0e80a 100644
    517 --- a/include/linux/sock_diag.h
    518 +++ b/include/linux/sock_diag.h
    519 @@ -36,6 +36,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk)
    520 {
    521 switch (sk->sk_family) {
    522 case AF_INET:
    523 + if (sk->sk_type == SOCK_RAW)
    524 + return SKNLGRP_NONE;
    525 +
    526 switch (sk->sk_protocol) {
    527 case IPPROTO_TCP:
    528 return SKNLGRP_INET_TCP_DESTROY;
    529 @@ -45,6 +48,9 @@ enum sknetlink_groups sock_diag_destroy_group(const struct sock *sk)
    530 return SKNLGRP_NONE;
    531 }
    532 case AF_INET6:
    533 + if (sk->sk_type == SOCK_RAW)
    534 + return SKNLGRP_NONE;
    535 +
    536 switch (sk->sk_protocol) {
    537 case IPPROTO_TCP:
    538 return SKNLGRP_INET6_TCP_DESTROY;
    539 diff --git a/kernel/events/core.c b/kernel/events/core.c
    540 index c0ded2416615..a69c90cea05d 100644
    541 --- a/kernel/events/core.c
    542 +++ b/kernel/events/core.c
    543 @@ -7143,7 +7143,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event)
    544 prog = event->tp_event->prog;
    545 if (prog) {
    546 event->tp_event->prog = NULL;
    547 - bpf_prog_put(prog);
    548 + bpf_prog_put_rcu(prog);
    549 }
    550 }
    551
    552 diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
    553 index fbd0acf80b13..2fdebabbfacd 100644
    554 --- a/net/ax25/af_ax25.c
    555 +++ b/net/ax25/af_ax25.c
    556 @@ -976,7 +976,8 @@ static int ax25_release(struct socket *sock)
    557 release_sock(sk);
    558 ax25_disconnect(ax25, 0);
    559 lock_sock(sk);
    560 - ax25_destroy_socket(ax25);
    561 + if (!sock_flag(ax25->sk, SOCK_DESTROY))
    562 + ax25_destroy_socket(ax25);
    563 break;
    564
    565 case AX25_STATE_3:
    566 diff --git a/net/ax25/ax25_ds_timer.c b/net/ax25/ax25_ds_timer.c
    567 index 951cd57bb07d..5237dff6941d 100644
    568 --- a/net/ax25/ax25_ds_timer.c
    569 +++ b/net/ax25/ax25_ds_timer.c
    570 @@ -102,6 +102,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
    571 switch (ax25->state) {
    572
    573 case AX25_STATE_0:
    574 + case AX25_STATE_2:
    575 /* Magic here: If we listen() and a new link dies before it
    576 is accepted() it isn't 'dead' so doesn't get removed. */
    577 if (!sk || sock_flag(sk, SOCK_DESTROY) ||
    578 @@ -111,6 +112,7 @@ void ax25_ds_heartbeat_expiry(ax25_cb *ax25)
    579 sock_hold(sk);
    580 ax25_destroy_socket(ax25);
    581 bh_unlock_sock(sk);
    582 + /* Ungrab socket and destroy it */
    583 sock_put(sk);
    584 } else
    585 ax25_destroy_socket(ax25);
    586 @@ -213,7 +215,8 @@ void ax25_ds_t1_timeout(ax25_cb *ax25)
    587 case AX25_STATE_2:
    588 if (ax25->n2count == ax25->n2) {
    589 ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
    590 - ax25_disconnect(ax25, ETIMEDOUT);
    591 + if (!sock_flag(ax25->sk, SOCK_DESTROY))
    592 + ax25_disconnect(ax25, ETIMEDOUT);
    593 return;
    594 } else {
    595 ax25->n2count++;
    596 diff --git a/net/ax25/ax25_std_timer.c b/net/ax25/ax25_std_timer.c
    597 index 004467c9e6e1..2c0d6ef66f9d 100644
    598 --- a/net/ax25/ax25_std_timer.c
    599 +++ b/net/ax25/ax25_std_timer.c
    600 @@ -38,6 +38,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
    601
    602 switch (ax25->state) {
    603 case AX25_STATE_0:
    604 + case AX25_STATE_2:
    605 /* Magic here: If we listen() and a new link dies before it
    606 is accepted() it isn't 'dead' so doesn't get removed. */
    607 if (!sk || sock_flag(sk, SOCK_DESTROY) ||
    608 @@ -47,6 +48,7 @@ void ax25_std_heartbeat_expiry(ax25_cb *ax25)
    609 sock_hold(sk);
    610 ax25_destroy_socket(ax25);
    611 bh_unlock_sock(sk);
    612 + /* Ungrab socket and destroy it */
    613 sock_put(sk);
    614 } else
    615 ax25_destroy_socket(ax25);
    616 @@ -144,7 +146,8 @@ void ax25_std_t1timer_expiry(ax25_cb *ax25)
    617 case AX25_STATE_2:
    618 if (ax25->n2count == ax25->n2) {
    619 ax25_send_control(ax25, AX25_DISC, AX25_POLLON, AX25_COMMAND);
    620 - ax25_disconnect(ax25, ETIMEDOUT);
    621 + if (!sock_flag(ax25->sk, SOCK_DESTROY))
    622 + ax25_disconnect(ax25, ETIMEDOUT);
    623 return;
    624 } else {
    625 ax25->n2count++;
    626 diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
    627 index 3b78e8473a01..655a7d4c96e1 100644
    628 --- a/net/ax25/ax25_subr.c
    629 +++ b/net/ax25/ax25_subr.c
    630 @@ -264,7 +264,8 @@ void ax25_disconnect(ax25_cb *ax25, int reason)
    631 {
    632 ax25_clear_queues(ax25);
    633
    634 - ax25_stop_heartbeat(ax25);
    635 + if (!sock_flag(ax25->sk, SOCK_DESTROY))
    636 + ax25_stop_heartbeat(ax25);
    637 ax25_stop_t1timer(ax25);
    638 ax25_stop_t2timer(ax25);
    639 ax25_stop_t3timer(ax25);
    640 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
    641 index 6852f3c7009c..43844144c9c4 100644
    642 --- a/net/bridge/br_multicast.c
    643 +++ b/net/bridge/br_multicast.c
    644 @@ -464,8 +464,11 @@ static struct sk_buff *br_ip6_multicast_alloc_query(struct net_bridge *br,
    645 if (ipv6_dev_get_saddr(dev_net(br->dev), br->dev, &ip6h->daddr, 0,
    646 &ip6h->saddr)) {
    647 kfree_skb(skb);
    648 + br->has_ipv6_addr = 0;
    649 return NULL;
    650 }
    651 +
    652 + br->has_ipv6_addr = 1;
    653 ipv6_eth_mc_map(&ip6h->daddr, eth->h_dest);
    654
    655 hopopt = (u8 *)(ip6h + 1);
    656 @@ -1745,6 +1748,7 @@ void br_multicast_init(struct net_bridge *br)
    657 br->ip6_other_query.delay_time = 0;
    658 br->ip6_querier.port = NULL;
    659 #endif
    660 + br->has_ipv6_addr = 1;
    661
    662 spin_lock_init(&br->multicast_lock);
    663 setup_timer(&br->multicast_router_timer,
    664 diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
    665 index d9da857182ef..f516c53bafb6 100644
    666 --- a/net/bridge/br_private.h
    667 +++ b/net/bridge/br_private.h
    668 @@ -304,6 +304,7 @@ struct net_bridge
    669 u8 multicast_disabled:1;
    670 u8 multicast_querier:1;
    671 u8 multicast_query_use_ifaddr:1;
    672 + u8 has_ipv6_addr:1;
    673
    674 u32 hash_elasticity;
    675 u32 hash_max;
    676 @@ -577,10 +578,22 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
    677
    678 static inline bool
    679 __br_multicast_querier_exists(struct net_bridge *br,
    680 - struct bridge_mcast_other_query *querier)
    681 + struct bridge_mcast_other_query *querier,
    682 + const bool is_ipv6)
    683 {
    684 + bool own_querier_enabled;
    685 +
    686 + if (br->multicast_querier) {
    687 + if (is_ipv6 && !br->has_ipv6_addr)
    688 + own_querier_enabled = false;
    689 + else
    690 + own_querier_enabled = true;
    691 + } else {
    692 + own_querier_enabled = false;
    693 + }
    694 +
    695 return time_is_before_jiffies(querier->delay_time) &&
    696 - (br->multicast_querier || timer_pending(&querier->timer));
    697 + (own_querier_enabled || timer_pending(&querier->timer));
    698 }
    699
    700 static inline bool br_multicast_querier_exists(struct net_bridge *br,
    701 @@ -588,10 +601,12 @@ static inline bool br_multicast_querier_exists(struct net_bridge *br,
    702 {
    703 switch (eth->h_proto) {
    704 case (htons(ETH_P_IP)):
    705 - return __br_multicast_querier_exists(br, &br->ip4_other_query);
    706 + return __br_multicast_querier_exists(br,
    707 + &br->ip4_other_query, false);
    708 #if IS_ENABLED(CONFIG_IPV6)
    709 case (htons(ETH_P_IPV6)):
    710 - return __br_multicast_querier_exists(br, &br->ip6_other_query);
    711 + return __br_multicast_querier_exists(br,
    712 + &br->ip6_other_query, true);
    713 #endif
    714 default:
    715 return false;
    716 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    717 index f18ae91b652e..769cece9b00b 100644
    718 --- a/net/core/neighbour.c
    719 +++ b/net/core/neighbour.c
    720 @@ -2467,13 +2467,17 @@ int neigh_xmit(int index, struct net_device *dev,
    721 tbl = neigh_tables[index];
    722 if (!tbl)
    723 goto out;
    724 + rcu_read_lock_bh();
    725 neigh = __neigh_lookup_noref(tbl, addr, dev);
    726 if (!neigh)
    727 neigh = __neigh_create(tbl, addr, dev, false);
    728 err = PTR_ERR(neigh);
    729 - if (IS_ERR(neigh))
    730 + if (IS_ERR(neigh)) {
    731 + rcu_read_unlock_bh();
    732 goto out_kfree_skb;
    733 + }
    734 err = neigh->output(neigh, skb);
    735 + rcu_read_unlock_bh();
    736 }
    737 else if (index == NEIGH_LINK_TABLE) {
    738 err = dev_hard_header(skb, dev, ntohs(skb->protocol),
    739 diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
    740 index 477937465a20..d95631d09248 100644
    741 --- a/net/ipv4/esp4.c
    742 +++ b/net/ipv4/esp4.c
    743 @@ -23,6 +23,11 @@ struct esp_skb_cb {
    744 void *tmp;
    745 };
    746
    747 +struct esp_output_extra {
    748 + __be32 seqhi;
    749 + u32 esphoff;
    750 +};
    751 +
    752 #define ESP_SKB_CB(__skb) ((struct esp_skb_cb *)&((__skb)->cb[0]))
    753
    754 static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
    755 @@ -35,11 +40,11 @@ static u32 esp4_get_mtu(struct xfrm_state *x, int mtu);
    756 *
    757 * TODO: Use spare space in skb for this where possible.
    758 */
    759 -static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen)
    760 +static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int extralen)
    761 {
    762 unsigned int len;
    763
    764 - len = seqhilen;
    765 + len = extralen;
    766
    767 len += crypto_aead_ivsize(aead);
    768
    769 @@ -57,15 +62,16 @@ static void *esp_alloc_tmp(struct crypto_aead *aead, int nfrags, int seqhilen)
    770 return kmalloc(len, GFP_ATOMIC);
    771 }
    772
    773 -static inline __be32 *esp_tmp_seqhi(void *tmp)
    774 +static inline void *esp_tmp_extra(void *tmp)
    775 {
    776 - return PTR_ALIGN((__be32 *)tmp, __alignof__(__be32));
    777 + return PTR_ALIGN(tmp, __alignof__(struct esp_output_extra));
    778 }
    779 -static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int seqhilen)
    780 +
    781 +static inline u8 *esp_tmp_iv(struct crypto_aead *aead, void *tmp, int extralen)
    782 {
    783 return crypto_aead_ivsize(aead) ?
    784 - PTR_ALIGN((u8 *)tmp + seqhilen,
    785 - crypto_aead_alignmask(aead) + 1) : tmp + seqhilen;
    786 + PTR_ALIGN((u8 *)tmp + extralen,
    787 + crypto_aead_alignmask(aead) + 1) : tmp + extralen;
    788 }
    789
    790 static inline struct aead_request *esp_tmp_req(struct crypto_aead *aead, u8 *iv)
    791 @@ -99,7 +105,7 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset)
    792 {
    793 struct ip_esp_hdr *esph = (void *)(skb->data + offset);
    794 void *tmp = ESP_SKB_CB(skb)->tmp;
    795 - __be32 *seqhi = esp_tmp_seqhi(tmp);
    796 + __be32 *seqhi = esp_tmp_extra(tmp);
    797
    798 esph->seq_no = esph->spi;
    799 esph->spi = *seqhi;
    800 @@ -107,7 +113,11 @@ static void esp_restore_header(struct sk_buff *skb, unsigned int offset)
    801
    802 static void esp_output_restore_header(struct sk_buff *skb)
    803 {
    804 - esp_restore_header(skb, skb_transport_offset(skb) - sizeof(__be32));
    805 + void *tmp = ESP_SKB_CB(skb)->tmp;
    806 + struct esp_output_extra *extra = esp_tmp_extra(tmp);
    807 +
    808 + esp_restore_header(skb, skb_transport_offset(skb) + extra->esphoff -
    809 + sizeof(__be32));
    810 }
    811
    812 static void esp_output_done_esn(struct crypto_async_request *base, int err)
    813 @@ -121,6 +131,7 @@ static void esp_output_done_esn(struct crypto_async_request *base, int err)
    814 static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
    815 {
    816 int err;
    817 + struct esp_output_extra *extra;
    818 struct ip_esp_hdr *esph;
    819 struct crypto_aead *aead;
    820 struct aead_request *req;
    821 @@ -137,8 +148,7 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
    822 int tfclen;
    823 int nfrags;
    824 int assoclen;
    825 - int seqhilen;
    826 - __be32 *seqhi;
    827 + int extralen;
    828 __be64 seqno;
    829
    830 /* skb is pure payload to encrypt */
    831 @@ -166,21 +176,21 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
    832 nfrags = err;
    833
    834 assoclen = sizeof(*esph);
    835 - seqhilen = 0;
    836 + extralen = 0;
    837
    838 if (x->props.flags & XFRM_STATE_ESN) {
    839 - seqhilen += sizeof(__be32);
    840 - assoclen += seqhilen;
    841 + extralen += sizeof(*extra);
    842 + assoclen += sizeof(__be32);
    843 }
    844
    845 - tmp = esp_alloc_tmp(aead, nfrags, seqhilen);
    846 + tmp = esp_alloc_tmp(aead, nfrags, extralen);
    847 if (!tmp) {
    848 err = -ENOMEM;
    849 goto error;
    850 }
    851
    852 - seqhi = esp_tmp_seqhi(tmp);
    853 - iv = esp_tmp_iv(aead, tmp, seqhilen);
    854 + extra = esp_tmp_extra(tmp);
    855 + iv = esp_tmp_iv(aead, tmp, extralen);
    856 req = esp_tmp_req(aead, iv);
    857 sg = esp_req_sg(aead, req);
    858
    859 @@ -247,8 +257,10 @@ static int esp_output(struct xfrm_state *x, struct sk_buff *skb)
    860 * encryption.
    861 */
    862 if ((x->props.flags & XFRM_STATE_ESN)) {
    863 - esph = (void *)(skb_transport_header(skb) - sizeof(__be32));
    864 - *seqhi = esph->spi;
    865 + extra->esphoff = (unsigned char *)esph -
    866 + skb_transport_header(skb);
    867 + esph = (struct ip_esp_hdr *)((unsigned char *)esph - 4);
    868 + extra->seqhi = esph->spi;
    869 esph->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output.hi);
    870 aead_request_set_callback(req, 0, esp_output_done_esn, skb);
    871 }
    872 @@ -445,7 +457,7 @@ static int esp_input(struct xfrm_state *x, struct sk_buff *skb)
    873 goto out;
    874
    875 ESP_SKB_CB(skb)->tmp = tmp;
    876 - seqhi = esp_tmp_seqhi(tmp);
    877 + seqhi = esp_tmp_extra(tmp);
    878 iv = esp_tmp_iv(aead, tmp, seqhilen);
    879 req = esp_tmp_req(aead, iv);
    880 sg = esp_req_sg(aead, req);
    881 diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
    882 index 395e2814a46d..a42dd8021b6b 100644
    883 --- a/net/ipv4/ipmr.c
    884 +++ b/net/ipv4/ipmr.c
    885 @@ -891,8 +891,10 @@ static struct mfc_cache *ipmr_cache_alloc(void)
    886 {
    887 struct mfc_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
    888
    889 - if (c)
    890 + if (c) {
    891 + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
    892 c->mfc_un.res.minvif = MAXVIFS;
    893 + }
    894 return c;
    895 }
    896
    897 diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
    898 index a10e77103c88..e207cb2468da 100644
    899 --- a/net/ipv6/ip6mr.c
    900 +++ b/net/ipv6/ip6mr.c
    901 @@ -1074,6 +1074,7 @@ static struct mfc6_cache *ip6mr_cache_alloc(void)
    902 struct mfc6_cache *c = kmem_cache_zalloc(mrt_cachep, GFP_KERNEL);
    903 if (!c)
    904 return NULL;
    905 + c->mfc_un.res.last_assert = jiffies - MFC_ASSERT_THRESH - 1;
    906 c->mfc_un.res.minvif = MAXMIFS;
    907 return c;
    908 }
    909 diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    910 index 83384308d032..6c53e4eb0f09 100644
    911 --- a/net/ipv6/sit.c
    912 +++ b/net/ipv6/sit.c
    913 @@ -560,13 +560,13 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
    914
    915 if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
    916 ipv4_update_pmtu(skb, dev_net(skb->dev), info,
    917 - t->parms.link, 0, IPPROTO_IPV6, 0);
    918 + t->parms.link, 0, iph->protocol, 0);
    919 err = 0;
    920 goto out;
    921 }
    922 if (type == ICMP_REDIRECT) {
    923 ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
    924 - IPPROTO_IPV6, 0);
    925 + iph->protocol, 0);
    926 err = 0;
    927 goto out;
    928 }
    929 diff --git a/net/kcm/kcmproc.c b/net/kcm/kcmproc.c
    930 index 738008726cc6..fda7f4715c58 100644
    931 --- a/net/kcm/kcmproc.c
    932 +++ b/net/kcm/kcmproc.c
    933 @@ -241,6 +241,7 @@ static const struct file_operations kcm_seq_fops = {
    934 .open = kcm_seq_open,
    935 .read = seq_read,
    936 .llseek = seq_lseek,
    937 + .release = seq_release_net,
    938 };
    939
    940 static struct kcm_seq_muxinfo kcm_seq_muxinfo = {
    941 diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
    942 index 8b5270008a6e..606323339e1f 100644
    943 --- a/net/sched/act_ipt.c
    944 +++ b/net/sched/act_ipt.c
    945 @@ -121,10 +121,13 @@ static int __tcf_ipt_init(struct tc_action_net *tn, struct nlattr *nla,
    946 }
    947
    948 td = (struct xt_entry_target *)nla_data(tb[TCA_IPT_TARG]);
    949 - if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size)
    950 + if (nla_len(tb[TCA_IPT_TARG]) < td->u.target_size) {
    951 + if (exists)
    952 + tcf_hash_release(a, bind);
    953 return -EINVAL;
    954 + }
    955
    956 - if (!tcf_hash_check(tn, index, a, bind)) {
    957 + if (!exists) {
    958 ret = tcf_hash_create(tn, index, est, a, sizeof(*ipt), bind,
    959 false);
    960 if (ret)
    961 diff --git a/net/sched/sch_fifo.c b/net/sched/sch_fifo.c
    962 index 2177eac0a61e..2e4bd2c0a50c 100644
    963 --- a/net/sched/sch_fifo.c
    964 +++ b/net/sched/sch_fifo.c
    965 @@ -37,14 +37,18 @@ static int pfifo_enqueue(struct sk_buff *skb, struct Qdisc *sch)
    966
    967 static int pfifo_tail_enqueue(struct sk_buff *skb, struct Qdisc *sch)
    968 {
    969 + unsigned int prev_backlog;
    970 +
    971 if (likely(skb_queue_len(&sch->q) < sch->limit))
    972 return qdisc_enqueue_tail(skb, sch);
    973
    974 + prev_backlog = sch->qstats.backlog;
    975 /* queue full, remove one skb to fulfill the limit */
    976 __qdisc_queue_drop_head(sch, &sch->q);
    977 qdisc_qstats_drop(sch);
    978 qdisc_enqueue_tail(skb, sch);
    979
    980 + qdisc_tree_reduce_backlog(sch, 0, prev_backlog - sch->qstats.backlog);
    981 return NET_XMIT_CN;
    982 }
    983
    984 diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
    985 index 4befe97a9034..b7c29d5b6f04 100644
    986 --- a/net/sched/sch_netem.c
    987 +++ b/net/sched/sch_netem.c
    988 @@ -650,14 +650,14 @@ deliver:
    989 #endif
    990
    991 if (q->qdisc) {
    992 + unsigned int pkt_len = qdisc_pkt_len(skb);
    993 int err = qdisc_enqueue(skb, q->qdisc);
    994
    995 - if (unlikely(err != NET_XMIT_SUCCESS)) {
    996 - if (net_xmit_drop_count(err)) {
    997 - qdisc_qstats_drop(sch);
    998 - qdisc_tree_reduce_backlog(sch, 1,
    999 - qdisc_pkt_len(skb));
    1000 - }
    1001 + if (err != NET_XMIT_SUCCESS &&
    1002 + net_xmit_drop_count(err)) {
    1003 + qdisc_qstats_drop(sch);
    1004 + qdisc_tree_reduce_backlog(sch, 1,
    1005 + pkt_len);
    1006 }
    1007 goto tfifo_dequeue;
    1008 }