1 |
commit: fa93352971e5dd4e0cda149358e6fb0af0a8218b |
2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
3 |
AuthorDate: Mon Jun 11 21:50:11 2018 +0000 |
4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
5 |
CommitDate: Mon Jun 11 21:50:11 2018 +0000 |
6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=fa933529 |
7 |
|
8 |
Linux patch 4.17.1 |
9 |
|
10 |
0000_README | 4 + |
11 |
1000_linux-4.17.1.patch | 602 ++++++++++++++++++++++++++++++++++++++++++++++++ |
12 |
2 files changed, 606 insertions(+) |
13 |
|
14 |
diff --git a/0000_README b/0000_README |
15 |
index 86e4a15..de4fd96 100644 |
16 |
--- a/0000_README |
17 |
+++ b/0000_README |
18 |
@@ -43,6 +43,10 @@ EXPERIMENTAL |
19 |
Individual Patch Descriptions: |
20 |
-------------------------------------------------------------------------- |
21 |
|
22 |
+Patch: 1000_linux-4.17.1.patch |
23 |
+From: http://www.kernel.org |
24 |
+Desc: Linux 4.17.1 |
25 |
+ |
26 |
Patch: 1500_XATTR_USER_PREFIX.patch |
27 |
From: https://bugs.gentoo.org/show_bug.cgi?id=470644 |
28 |
Desc: Support for namespace user.pax.* on tmpfs. |
29 |
|
30 |
diff --git a/1000_linux-4.17.1.patch b/1000_linux-4.17.1.patch |
31 |
new file mode 100644 |
32 |
index 0000000..8c58c98 |
33 |
--- /dev/null |
34 |
+++ b/1000_linux-4.17.1.patch |
35 |
@@ -0,0 +1,602 @@ |
36 |
+diff --git a/Documentation/networking/netdev-FAQ.txt b/Documentation/networking/netdev-FAQ.txt |
37 |
+index 2a3278d5cf35..fa951b820b25 100644 |
38 |
+--- a/Documentation/networking/netdev-FAQ.txt |
39 |
++++ b/Documentation/networking/netdev-FAQ.txt |
40 |
+@@ -179,6 +179,15 @@ A: No. See above answer. In short, if you think it really belongs in |
41 |
+ dash marker line as described in Documentation/process/submitting-patches.rst to |
42 |
+ temporarily embed that information into the patch that you send. |
43 |
+ |
44 |
++Q: Are all networking bug fixes backported to all stable releases? |
45 |
++ |
46 |
++A: Due to capacity, Dave could only take care of the backports for the last |
47 |
++ 2 stable releases. For earlier stable releases, each stable branch maintainer |
48 |
++ is supposed to take care of them. If you find any patch is missing from an |
49 |
++ earlier stable branch, please notify stable@×××××××××××.org with either a |
50 |
++ commit ID or a formal patch backported, and CC Dave and other relevant |
51 |
++ networking developers. |
52 |
++ |
53 |
+ Q: Someone said that the comment style and coding convention is different |
54 |
+ for the networking content. Is this true? |
55 |
+ |
56 |
+diff --git a/Makefile b/Makefile |
57 |
+index 554dcaddbce4..e551c9af6a06 100644 |
58 |
+--- a/Makefile |
59 |
++++ b/Makefile |
60 |
+@@ -1,7 +1,7 @@ |
61 |
+ # SPDX-License-Identifier: GPL-2.0 |
62 |
+ VERSION = 4 |
63 |
+ PATCHLEVEL = 17 |
64 |
+-SUBLEVEL = 0 |
65 |
++SUBLEVEL = 1 |
66 |
+ EXTRAVERSION = |
67 |
+ NAME = Merciless Moray |
68 |
+ |
69 |
+diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c |
70 |
+index 3da5fca77cbd..bbc6cc609ec3 100644 |
71 |
+--- a/drivers/net/dsa/b53/b53_common.c |
72 |
++++ b/drivers/net/dsa/b53/b53_common.c |
73 |
+@@ -684,7 +684,8 @@ static int b53_switch_reset(struct b53_device *dev) |
74 |
+ * still use this driver as a library and need to perform the reset |
75 |
+ * earlier. |
76 |
+ */ |
77 |
+- if (dev->chip_id == BCM58XX_DEVICE_ID) { |
78 |
++ if (dev->chip_id == BCM58XX_DEVICE_ID || |
79 |
++ dev->chip_id == BCM583XX_DEVICE_ID) { |
80 |
+ b53_read8(dev, B53_CTRL_PAGE, B53_SOFTRESET, ®); |
81 |
+ reg |= SW_RST | EN_SW_RST | EN_CH_RST; |
82 |
+ b53_write8(dev, B53_CTRL_PAGE, B53_SOFTRESET, reg); |
83 |
+@@ -1879,6 +1880,18 @@ static const struct b53_chip_data b53_switch_chips[] = { |
84 |
+ .jumbo_pm_reg = B53_JUMBO_PORT_MASK, |
85 |
+ .jumbo_size_reg = B53_JUMBO_MAX_SIZE, |
86 |
+ }, |
87 |
++ { |
88 |
++ .chip_id = BCM583XX_DEVICE_ID, |
89 |
++ .dev_name = "BCM583xx/11360", |
90 |
++ .vlans = 4096, |
91 |
++ .enabled_ports = 0x103, |
92 |
++ .arl_entries = 4, |
93 |
++ .cpu_port = B53_CPU_PORT, |
94 |
++ .vta_regs = B53_VTA_REGS, |
95 |
++ .duplex_reg = B53_DUPLEX_STAT_GE, |
96 |
++ .jumbo_pm_reg = B53_JUMBO_PORT_MASK, |
97 |
++ .jumbo_size_reg = B53_JUMBO_MAX_SIZE, |
98 |
++ }, |
99 |
+ { |
100 |
+ .chip_id = BCM7445_DEVICE_ID, |
101 |
+ .dev_name = "BCM7445", |
102 |
+diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h |
103 |
+index 3b57f47d0e79..b232aaae20aa 100644 |
104 |
+--- a/drivers/net/dsa/b53/b53_priv.h |
105 |
++++ b/drivers/net/dsa/b53/b53_priv.h |
106 |
+@@ -62,6 +62,7 @@ enum { |
107 |
+ BCM53018_DEVICE_ID = 0x53018, |
108 |
+ BCM53019_DEVICE_ID = 0x53019, |
109 |
+ BCM58XX_DEVICE_ID = 0x5800, |
110 |
++ BCM583XX_DEVICE_ID = 0x58300, |
111 |
+ BCM7445_DEVICE_ID = 0x7445, |
112 |
+ BCM7278_DEVICE_ID = 0x7278, |
113 |
+ }; |
114 |
+@@ -181,6 +182,7 @@ static inline int is5301x(struct b53_device *dev) |
115 |
+ static inline int is58xx(struct b53_device *dev) |
116 |
+ { |
117 |
+ return dev->chip_id == BCM58XX_DEVICE_ID || |
118 |
++ dev->chip_id == BCM583XX_DEVICE_ID || |
119 |
+ dev->chip_id == BCM7445_DEVICE_ID || |
120 |
+ dev->chip_id == BCM7278_DEVICE_ID; |
121 |
+ } |
122 |
+diff --git a/drivers/net/dsa/b53/b53_srab.c b/drivers/net/dsa/b53/b53_srab.c |
123 |
+index c37ffd1b6833..8247481eaa06 100644 |
124 |
+--- a/drivers/net/dsa/b53/b53_srab.c |
125 |
++++ b/drivers/net/dsa/b53/b53_srab.c |
126 |
+@@ -364,7 +364,7 @@ static const struct of_device_id b53_srab_of_match[] = { |
127 |
+ { .compatible = "brcm,bcm53018-srab" }, |
128 |
+ { .compatible = "brcm,bcm53019-srab" }, |
129 |
+ { .compatible = "brcm,bcm5301x-srab" }, |
130 |
+- { .compatible = "brcm,bcm11360-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
131 |
++ { .compatible = "brcm,bcm11360-srab", .data = (void *)BCM583XX_DEVICE_ID }, |
132 |
+ { .compatible = "brcm,bcm58522-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
133 |
+ { .compatible = "brcm,bcm58525-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
134 |
+ { .compatible = "brcm,bcm58535-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
135 |
+@@ -372,7 +372,7 @@ static const struct of_device_id b53_srab_of_match[] = { |
136 |
+ { .compatible = "brcm,bcm58623-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
137 |
+ { .compatible = "brcm,bcm58625-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
138 |
+ { .compatible = "brcm,bcm88312-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
139 |
+- { .compatible = "brcm,cygnus-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
140 |
++ { .compatible = "brcm,cygnus-srab", .data = (void *)BCM583XX_DEVICE_ID }, |
141 |
+ { .compatible = "brcm,nsp-srab", .data = (void *)BCM58XX_DEVICE_ID }, |
142 |
+ { /* sentinel */ }, |
143 |
+ }; |
144 |
+diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c |
145 |
+index 7dd83d0ef0a0..22243c480a05 100644 |
146 |
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c |
147 |
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_link.c |
148 |
+@@ -588,7 +588,7 @@ static void bnx2x_ets_e3b0_nig_disabled(const struct link_params *params, |
149 |
+ * slots for the highest priority. |
150 |
+ */ |
151 |
+ REG_WR(bp, (port) ? NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS : |
152 |
+- NIG_REG_P1_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100); |
153 |
++ NIG_REG_P0_TX_ARB_NUM_STRICT_ARB_SLOTS, 0x100); |
154 |
+ /* Mapping between the CREDIT_WEIGHT registers and actual client |
155 |
+ * numbers |
156 |
+ */ |
157 |
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c |
158 |
+index ddb6bf85a59c..e141563a4682 100644 |
159 |
+--- a/drivers/net/team/team.c |
160 |
++++ b/drivers/net/team/team.c |
161 |
+@@ -1004,7 +1004,8 @@ static void team_port_disable(struct team *team, |
162 |
+ static void __team_compute_features(struct team *team) |
163 |
+ { |
164 |
+ struct team_port *port; |
165 |
+- u32 vlan_features = TEAM_VLAN_FEATURES & NETIF_F_ALL_FOR_ALL; |
166 |
++ netdev_features_t vlan_features = TEAM_VLAN_FEATURES & |
167 |
++ NETIF_F_ALL_FOR_ALL; |
168 |
+ netdev_features_t enc_features = TEAM_ENC_FEATURES; |
169 |
+ unsigned short max_hard_header_len = ETH_HLEN; |
170 |
+ unsigned int dst_release_flag = IFF_XMIT_DST_RELEASE | |
171 |
+diff --git a/drivers/pci/host/pci-hyperv.c b/drivers/pci/host/pci-hyperv.c |
172 |
+index 50cdefe3f6d3..c75199538c05 100644 |
173 |
+--- a/drivers/pci/host/pci-hyperv.c |
174 |
++++ b/drivers/pci/host/pci-hyperv.c |
175 |
+@@ -556,6 +556,26 @@ static void put_pcichild(struct hv_pci_dev *hv_pcidev, |
176 |
+ static void get_hvpcibus(struct hv_pcibus_device *hv_pcibus); |
177 |
+ static void put_hvpcibus(struct hv_pcibus_device *hv_pcibus); |
178 |
+ |
179 |
++/* |
180 |
++ * There is no good way to get notified from vmbus_onoffer_rescind(), |
181 |
++ * so let's use polling here, since this is not a hot path. |
182 |
++ */ |
183 |
++static int wait_for_response(struct hv_device *hdev, |
184 |
++ struct completion *comp) |
185 |
++{ |
186 |
++ while (true) { |
187 |
++ if (hdev->channel->rescind) { |
188 |
++ dev_warn_once(&hdev->device, "The device is gone.\n"); |
189 |
++ return -ENODEV; |
190 |
++ } |
191 |
++ |
192 |
++ if (wait_for_completion_timeout(comp, HZ / 10)) |
193 |
++ break; |
194 |
++ } |
195 |
++ |
196 |
++ return 0; |
197 |
++} |
198 |
++ |
199 |
+ /** |
200 |
+ * devfn_to_wslot() - Convert from Linux PCI slot to Windows |
201 |
+ * @devfn: The Linux representation of PCI slot |
202 |
+@@ -1568,7 +1588,8 @@ static struct hv_pci_dev *new_pcichild_device(struct hv_pcibus_device *hbus, |
203 |
+ if (ret) |
204 |
+ goto error; |
205 |
+ |
206 |
+- wait_for_completion(&comp_pkt.host_event); |
207 |
++ if (wait_for_response(hbus->hdev, &comp_pkt.host_event)) |
208 |
++ goto error; |
209 |
+ |
210 |
+ hpdev->desc = *desc; |
211 |
+ refcount_set(&hpdev->refs, 1); |
212 |
+@@ -2069,15 +2090,16 @@ static int hv_pci_protocol_negotiation(struct hv_device *hdev) |
213 |
+ sizeof(struct pci_version_request), |
214 |
+ (unsigned long)pkt, VM_PKT_DATA_INBAND, |
215 |
+ VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED); |
216 |
++ if (!ret) |
217 |
++ ret = wait_for_response(hdev, &comp_pkt.host_event); |
218 |
++ |
219 |
+ if (ret) { |
220 |
+ dev_err(&hdev->device, |
221 |
+- "PCI Pass-through VSP failed sending version reqquest: %#x", |
222 |
++ "PCI Pass-through VSP failed to request version: %d", |
223 |
+ ret); |
224 |
+ goto exit; |
225 |
+ } |
226 |
+ |
227 |
+- wait_for_completion(&comp_pkt.host_event); |
228 |
+- |
229 |
+ if (comp_pkt.completion_status >= 0) { |
230 |
+ pci_protocol_version = pci_protocol_versions[i]; |
231 |
+ dev_info(&hdev->device, |
232 |
+@@ -2286,11 +2308,12 @@ static int hv_pci_enter_d0(struct hv_device *hdev) |
233 |
+ ret = vmbus_sendpacket(hdev->channel, d0_entry, sizeof(*d0_entry), |
234 |
+ (unsigned long)pkt, VM_PKT_DATA_INBAND, |
235 |
+ VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED); |
236 |
++ if (!ret) |
237 |
++ ret = wait_for_response(hdev, &comp_pkt.host_event); |
238 |
++ |
239 |
+ if (ret) |
240 |
+ goto exit; |
241 |
+ |
242 |
+- wait_for_completion(&comp_pkt.host_event); |
243 |
+- |
244 |
+ if (comp_pkt.completion_status < 0) { |
245 |
+ dev_err(&hdev->device, |
246 |
+ "PCI Pass-through VSP failed D0 Entry with status %x\n", |
247 |
+@@ -2330,11 +2353,10 @@ static int hv_pci_query_relations(struct hv_device *hdev) |
248 |
+ |
249 |
+ ret = vmbus_sendpacket(hdev->channel, &message, sizeof(message), |
250 |
+ 0, VM_PKT_DATA_INBAND, 0); |
251 |
+- if (ret) |
252 |
+- return ret; |
253 |
++ if (!ret) |
254 |
++ ret = wait_for_response(hdev, &comp); |
255 |
+ |
256 |
+- wait_for_completion(&comp); |
257 |
+- return 0; |
258 |
++ return ret; |
259 |
+ } |
260 |
+ |
261 |
+ /** |
262 |
+@@ -2404,11 +2426,11 @@ static int hv_send_resources_allocated(struct hv_device *hdev) |
263 |
+ size_res, (unsigned long)pkt, |
264 |
+ VM_PKT_DATA_INBAND, |
265 |
+ VMBUS_DATA_PACKET_FLAG_COMPLETION_REQUESTED); |
266 |
++ if (!ret) |
267 |
++ ret = wait_for_response(hdev, &comp_pkt.host_event); |
268 |
+ if (ret) |
269 |
+ break; |
270 |
+ |
271 |
+- wait_for_completion(&comp_pkt.host_event); |
272 |
+- |
273 |
+ if (comp_pkt.completion_status < 0) { |
274 |
+ ret = -EPROTO; |
275 |
+ dev_err(&hdev->device, |
276 |
+diff --git a/include/linux/mroute_base.h b/include/linux/mroute_base.h |
277 |
+index d617fe45543e..d633f737b3c6 100644 |
278 |
+--- a/include/linux/mroute_base.h |
279 |
++++ b/include/linux/mroute_base.h |
280 |
+@@ -307,16 +307,6 @@ static inline void vif_device_init(struct vif_device *v, |
281 |
+ { |
282 |
+ } |
283 |
+ |
284 |
+-static inline void * |
285 |
+-mr_table_alloc(struct net *net, u32 id, |
286 |
+- struct mr_table_ops *ops, |
287 |
+- void (*expire_func)(struct timer_list *t), |
288 |
+- void (*table_set)(struct mr_table *mrt, |
289 |
+- struct net *net)) |
290 |
+-{ |
291 |
+- return NULL; |
292 |
+-} |
293 |
+- |
294 |
+ static inline void *mr_mfc_find_parent(struct mr_table *mrt, |
295 |
+ void *hasharg, int parent) |
296 |
+ { |
297 |
+diff --git a/include/net/ipv6.h b/include/net/ipv6.h |
298 |
+index 836f31af1369..a406f2e8680a 100644 |
299 |
+--- a/include/net/ipv6.h |
300 |
++++ b/include/net/ipv6.h |
301 |
+@@ -906,6 +906,11 @@ static inline __be32 ip6_make_flowinfo(unsigned int tclass, __be32 flowlabel) |
302 |
+ return htonl(tclass << IPV6_TCLASS_SHIFT) | flowlabel; |
303 |
+ } |
304 |
+ |
305 |
++static inline __be32 flowi6_get_flowlabel(const struct flowi6 *fl6) |
306 |
++{ |
307 |
++ return fl6->flowlabel & IPV6_FLOWLABEL_MASK; |
308 |
++} |
309 |
++ |
310 |
+ /* |
311 |
+ * Prototypes exported by ipv6 |
312 |
+ */ |
313 |
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c |
314 |
+index d29f09bc5ff9..0234f8d1f0ac 100644 |
315 |
+--- a/net/core/flow_dissector.c |
316 |
++++ b/net/core/flow_dissector.c |
317 |
+@@ -1334,7 +1334,7 @@ __u32 __get_hash_from_flowi6(const struct flowi6 *fl6, struct flow_keys *keys) |
318 |
+ keys->ports.src = fl6->fl6_sport; |
319 |
+ keys->ports.dst = fl6->fl6_dport; |
320 |
+ keys->keyid.keyid = fl6->fl6_gre_key; |
321 |
+- keys->tags.flow_label = (__force u32)fl6->flowlabel; |
322 |
++ keys->tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6); |
323 |
+ keys->basic.ip_proto = fl6->flowi6_proto; |
324 |
+ |
325 |
+ return flow_hash_from_keys(keys); |
326 |
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c |
327 |
+index 45936922d7e2..19f6ab5de6e1 100644 |
328 |
+--- a/net/core/rtnetlink.c |
329 |
++++ b/net/core/rtnetlink.c |
330 |
+@@ -2256,6 +2256,10 @@ static int do_setlink(const struct sk_buff *skb, |
331 |
+ const struct net_device_ops *ops = dev->netdev_ops; |
332 |
+ int err; |
333 |
+ |
334 |
++ err = validate_linkmsg(dev, tb); |
335 |
++ if (err < 0) |
336 |
++ return err; |
337 |
++ |
338 |
+ if (tb[IFLA_NET_NS_PID] || tb[IFLA_NET_NS_FD] || tb[IFLA_IF_NETNSID]) { |
339 |
+ struct net *net = rtnl_link_get_net_capable(skb, dev_net(dev), |
340 |
+ tb, CAP_NET_ADMIN); |
341 |
+@@ -2619,10 +2623,6 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, |
342 |
+ goto errout; |
343 |
+ } |
344 |
+ |
345 |
+- err = validate_linkmsg(dev, tb); |
346 |
+- if (err < 0) |
347 |
+- goto errout; |
348 |
+- |
349 |
+ err = do_setlink(skb, dev, ifm, extack, tb, ifname, 0); |
350 |
+ errout: |
351 |
+ return err; |
352 |
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c |
353 |
+index c27122f01b87..cfae17335705 100644 |
354 |
+--- a/net/ipv4/fib_semantics.c |
355 |
++++ b/net/ipv4/fib_semantics.c |
356 |
+@@ -717,6 +717,8 @@ bool fib_metrics_match(struct fib_config *cfg, struct fib_info *fi) |
357 |
+ nla_strlcpy(tmp, nla, sizeof(tmp)); |
358 |
+ val = tcp_ca_get_key_by_name(fi->fib_net, tmp, &ecn_ca); |
359 |
+ } else { |
360 |
++ if (nla_len(nla) != sizeof(u32)) |
361 |
++ return false; |
362 |
+ val = nla_get_u32(nla); |
363 |
+ } |
364 |
+ |
365 |
+@@ -1043,6 +1045,8 @@ fib_convert_metrics(struct fib_info *fi, const struct fib_config *cfg) |
366 |
+ if (val == TCP_CA_UNSPEC) |
367 |
+ return -EINVAL; |
368 |
+ } else { |
369 |
++ if (nla_len(nla) != sizeof(u32)) |
370 |
++ return -EINVAL; |
371 |
+ val = nla_get_u32(nla); |
372 |
+ } |
373 |
+ if (type == RTAX_ADVMSS && val > 65535 - 40) |
374 |
+diff --git a/net/ipv4/ipmr_base.c b/net/ipv4/ipmr_base.c |
375 |
+index 30221701614c..cafb0506c8c9 100644 |
376 |
+--- a/net/ipv4/ipmr_base.c |
377 |
++++ b/net/ipv4/ipmr_base.c |
378 |
+@@ -35,17 +35,19 @@ mr_table_alloc(struct net *net, u32 id, |
379 |
+ struct net *net)) |
380 |
+ { |
381 |
+ struct mr_table *mrt; |
382 |
++ int err; |
383 |
+ |
384 |
+ mrt = kzalloc(sizeof(*mrt), GFP_KERNEL); |
385 |
+ if (!mrt) |
386 |
+- return NULL; |
387 |
++ return ERR_PTR(-ENOMEM); |
388 |
+ mrt->id = id; |
389 |
+ write_pnet(&mrt->net, net); |
390 |
+ |
391 |
+ mrt->ops = *ops; |
392 |
+- if (rhltable_init(&mrt->mfc_hash, mrt->ops.rht_params)) { |
393 |
++ err = rhltable_init(&mrt->mfc_hash, mrt->ops.rht_params); |
394 |
++ if (err) { |
395 |
+ kfree(mrt); |
396 |
+- return NULL; |
397 |
++ return ERR_PTR(err); |
398 |
+ } |
399 |
+ INIT_LIST_HEAD(&mrt->mfc_cache_list); |
400 |
+ INIT_LIST_HEAD(&mrt->mfc_unres_queue); |
401 |
+diff --git a/net/ipv4/netfilter/nf_flow_table_ipv4.c b/net/ipv4/netfilter/nf_flow_table_ipv4.c |
402 |
+index 0cd46bffa469..fc3923932eda 100644 |
403 |
+--- a/net/ipv4/netfilter/nf_flow_table_ipv4.c |
404 |
++++ b/net/ipv4/netfilter/nf_flow_table_ipv4.c |
405 |
+@@ -213,7 +213,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, |
406 |
+ enum flow_offload_tuple_dir dir; |
407 |
+ struct flow_offload *flow; |
408 |
+ struct net_device *outdev; |
409 |
+- const struct rtable *rt; |
410 |
++ struct rtable *rt; |
411 |
+ struct iphdr *iph; |
412 |
+ __be32 nexthop; |
413 |
+ |
414 |
+@@ -234,7 +234,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, |
415 |
+ dir = tuplehash->tuple.dir; |
416 |
+ flow = container_of(tuplehash, struct flow_offload, tuplehash[dir]); |
417 |
+ |
418 |
+- rt = (const struct rtable *)flow->tuplehash[dir].tuple.dst_cache; |
419 |
++ rt = (struct rtable *)flow->tuplehash[dir].tuple.dst_cache; |
420 |
+ if (unlikely(nf_flow_exceeds_mtu(skb, rt))) |
421 |
+ return NF_ACCEPT; |
422 |
+ |
423 |
+@@ -251,6 +251,7 @@ nf_flow_offload_ip_hook(void *priv, struct sk_buff *skb, |
424 |
+ |
425 |
+ skb->dev = outdev; |
426 |
+ nexthop = rt_nexthop(rt, flow->tuplehash[!dir].tuple.src_v4.s_addr); |
427 |
++ skb_dst_set_noref(skb, &rt->dst); |
428 |
+ neigh_xmit(NEIGH_ARP_TABLE, outdev, &nexthop, skb); |
429 |
+ |
430 |
+ return NF_STOLEN; |
431 |
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c |
432 |
+index 7b6d1689087b..af49f6cb5d3e 100644 |
433 |
+--- a/net/ipv6/ip6_output.c |
434 |
++++ b/net/ipv6/ip6_output.c |
435 |
+@@ -507,7 +507,8 @@ int ip6_forward(struct sk_buff *skb) |
436 |
+ send redirects to source routed frames. |
437 |
+ We don't send redirects to frames decapsulated from IPsec. |
438 |
+ */ |
439 |
+- if (skb->dev == dst->dev && opt->srcrt == 0 && !skb_sec_path(skb)) { |
440 |
++ if (IP6CB(skb)->iif == dst->dev->ifindex && |
441 |
++ opt->srcrt == 0 && !skb_sec_path(skb)) { |
442 |
+ struct in6_addr *target = NULL; |
443 |
+ struct inet_peer *peer; |
444 |
+ struct rt6_info *rt; |
445 |
+diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c |
446 |
+index 298fd8b6ed17..37936671dcb3 100644 |
447 |
+--- a/net/ipv6/ip6mr.c |
448 |
++++ b/net/ipv6/ip6mr.c |
449 |
+@@ -227,8 +227,8 @@ static int __net_init ip6mr_rules_init(struct net *net) |
450 |
+ INIT_LIST_HEAD(&net->ipv6.mr6_tables); |
451 |
+ |
452 |
+ mrt = ip6mr_new_table(net, RT6_TABLE_DFLT); |
453 |
+- if (!mrt) { |
454 |
+- err = -ENOMEM; |
455 |
++ if (IS_ERR(mrt)) { |
456 |
++ err = PTR_ERR(mrt); |
457 |
+ goto err1; |
458 |
+ } |
459 |
+ |
460 |
+@@ -301,8 +301,13 @@ static int ip6mr_fib_lookup(struct net *net, struct flowi6 *flp6, |
461 |
+ |
462 |
+ static int __net_init ip6mr_rules_init(struct net *net) |
463 |
+ { |
464 |
+- net->ipv6.mrt6 = ip6mr_new_table(net, RT6_TABLE_DFLT); |
465 |
+- return net->ipv6.mrt6 ? 0 : -ENOMEM; |
466 |
++ struct mr_table *mrt; |
467 |
++ |
468 |
++ mrt = ip6mr_new_table(net, RT6_TABLE_DFLT); |
469 |
++ if (IS_ERR(mrt)) |
470 |
++ return PTR_ERR(mrt); |
471 |
++ net->ipv6.mrt6 = mrt; |
472 |
++ return 0; |
473 |
+ } |
474 |
+ |
475 |
+ static void __net_exit ip6mr_rules_exit(struct net *net) |
476 |
+@@ -1757,9 +1762,11 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns |
477 |
+ |
478 |
+ rtnl_lock(); |
479 |
+ ret = 0; |
480 |
+- if (!ip6mr_new_table(net, v)) |
481 |
+- ret = -ENOMEM; |
482 |
+- raw6_sk(sk)->ip6mr_table = v; |
483 |
++ mrt = ip6mr_new_table(net, v); |
484 |
++ if (IS_ERR(mrt)) |
485 |
++ ret = PTR_ERR(mrt); |
486 |
++ else |
487 |
++ raw6_sk(sk)->ip6mr_table = v; |
488 |
+ rtnl_unlock(); |
489 |
+ return ret; |
490 |
+ } |
491 |
+diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c |
492 |
+index 9de4dfb126ba..525051a886bc 100644 |
493 |
+--- a/net/ipv6/ndisc.c |
494 |
++++ b/net/ipv6/ndisc.c |
495 |
+@@ -1576,6 +1576,12 @@ void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target) |
496 |
+ ops_data_buf[NDISC_OPS_REDIRECT_DATA_SPACE], *ops_data = NULL; |
497 |
+ bool ret; |
498 |
+ |
499 |
++ if (netif_is_l3_master(skb->dev)) { |
500 |
++ dev = __dev_get_by_index(dev_net(skb->dev), IPCB(skb)->iif); |
501 |
++ if (!dev) |
502 |
++ return; |
503 |
++ } |
504 |
++ |
505 |
+ if (ipv6_get_lladdr(dev, &saddr_buf, IFA_F_TENTATIVE)) { |
506 |
+ ND_PRINTK(2, warn, "Redirect: no link-local address on %s\n", |
507 |
+ dev->name); |
508 |
+diff --git a/net/ipv6/netfilter/nf_flow_table_ipv6.c b/net/ipv6/netfilter/nf_flow_table_ipv6.c |
509 |
+index 207cb35569b1..2d6652146bba 100644 |
510 |
+--- a/net/ipv6/netfilter/nf_flow_table_ipv6.c |
511 |
++++ b/net/ipv6/netfilter/nf_flow_table_ipv6.c |
512 |
+@@ -243,6 +243,7 @@ nf_flow_offload_ipv6_hook(void *priv, struct sk_buff *skb, |
513 |
+ |
514 |
+ skb->dev = outdev; |
515 |
+ nexthop = rt6_nexthop(rt, &flow->tuplehash[!dir].tuple.src_v6); |
516 |
++ skb_dst_set_noref(skb, &rt->dst); |
517 |
+ neigh_xmit(NEIGH_ND_TABLE, outdev, nexthop, skb); |
518 |
+ |
519 |
+ return NF_STOLEN; |
520 |
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c |
521 |
+index f4d61736c41a..4530a82aaa2e 100644 |
522 |
+--- a/net/ipv6/route.c |
523 |
++++ b/net/ipv6/route.c |
524 |
+@@ -1868,7 +1868,7 @@ static void ip6_multipath_l3_keys(const struct sk_buff *skb, |
525 |
+ } else { |
526 |
+ keys->addrs.v6addrs.src = key_iph->saddr; |
527 |
+ keys->addrs.v6addrs.dst = key_iph->daddr; |
528 |
+- keys->tags.flow_label = ip6_flowinfo(key_iph); |
529 |
++ keys->tags.flow_label = ip6_flowlabel(key_iph); |
530 |
+ keys->basic.ip_proto = key_iph->nexthdr; |
531 |
+ } |
532 |
+ } |
533 |
+@@ -1889,7 +1889,7 @@ u32 rt6_multipath_hash(const struct net *net, const struct flowi6 *fl6, |
534 |
+ } else { |
535 |
+ hash_keys.addrs.v6addrs.src = fl6->saddr; |
536 |
+ hash_keys.addrs.v6addrs.dst = fl6->daddr; |
537 |
+- hash_keys.tags.flow_label = (__force u32)fl6->flowlabel; |
538 |
++ hash_keys.tags.flow_label = (__force u32)flowi6_get_flowlabel(fl6); |
539 |
+ hash_keys.basic.ip_proto = fl6->flowi6_proto; |
540 |
+ } |
541 |
+ break; |
542 |
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c |
543 |
+index 1fd9e145076a..466f17646625 100644 |
544 |
+--- a/net/l2tp/l2tp_ppp.c |
545 |
++++ b/net/l2tp/l2tp_ppp.c |
546 |
+@@ -428,16 +428,6 @@ static void pppol2tp_put_sk(struct rcu_head *head) |
547 |
+ */ |
548 |
+ static void pppol2tp_session_close(struct l2tp_session *session) |
549 |
+ { |
550 |
+- struct pppol2tp_session *ps; |
551 |
+- |
552 |
+- ps = l2tp_session_priv(session); |
553 |
+- mutex_lock(&ps->sk_lock); |
554 |
+- ps->__sk = rcu_dereference_protected(ps->sk, |
555 |
+- lockdep_is_held(&ps->sk_lock)); |
556 |
+- RCU_INIT_POINTER(ps->sk, NULL); |
557 |
+- if (ps->__sk) |
558 |
+- call_rcu(&ps->rcu, pppol2tp_put_sk); |
559 |
+- mutex_unlock(&ps->sk_lock); |
560 |
+ } |
561 |
+ |
562 |
+ /* Really kill the session socket. (Called from sock_put() if |
563 |
+@@ -480,15 +470,24 @@ static int pppol2tp_release(struct socket *sock) |
564 |
+ sock_orphan(sk); |
565 |
+ sock->sk = NULL; |
566 |
+ |
567 |
+- /* If the socket is associated with a session, |
568 |
+- * l2tp_session_delete will call pppol2tp_session_close which |
569 |
+- * will drop the session's ref on the socket. |
570 |
+- */ |
571 |
+ session = pppol2tp_sock_to_session(sk); |
572 |
+ if (session) { |
573 |
++ struct pppol2tp_session *ps; |
574 |
++ |
575 |
+ l2tp_session_delete(session); |
576 |
+- /* drop the ref obtained by pppol2tp_sock_to_session */ |
577 |
+- sock_put(sk); |
578 |
++ |
579 |
++ ps = l2tp_session_priv(session); |
580 |
++ mutex_lock(&ps->sk_lock); |
581 |
++ ps->__sk = rcu_dereference_protected(ps->sk, |
582 |
++ lockdep_is_held(&ps->sk_lock)); |
583 |
++ RCU_INIT_POINTER(ps->sk, NULL); |
584 |
++ mutex_unlock(&ps->sk_lock); |
585 |
++ call_rcu(&ps->rcu, pppol2tp_put_sk); |
586 |
++ |
587 |
++ /* Rely on the sock_put() call at the end of the function for |
588 |
++ * dropping the reference held by pppol2tp_sock_to_session(). |
589 |
++ * The last reference will be dropped by pppol2tp_put_sk(). |
590 |
++ */ |
591 |
+ } |
592 |
+ |
593 |
+ release_sock(sk); |
594 |
+@@ -742,7 +741,8 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, |
595 |
+ */ |
596 |
+ mutex_lock(&ps->sk_lock); |
597 |
+ if (rcu_dereference_protected(ps->sk, |
598 |
+- lockdep_is_held(&ps->sk_lock))) { |
599 |
++ lockdep_is_held(&ps->sk_lock)) || |
600 |
++ ps->__sk) { |
601 |
+ mutex_unlock(&ps->sk_lock); |
602 |
+ error = -EEXIST; |
603 |
+ goto end; |
604 |
+@@ -803,7 +803,6 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr, |
605 |
+ |
606 |
+ out_no_ppp: |
607 |
+ /* This is how we get the session context from the socket. */ |
608 |
+- sock_hold(sk); |
609 |
+ sk->sk_user_data = session; |
610 |
+ rcu_assign_pointer(ps->sk, sk); |
611 |
+ mutex_unlock(&ps->sk_lock); |
612 |
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c |
613 |
+index acb7b86574cd..60c2a252bdf5 100644 |
614 |
+--- a/net/packet/af_packet.c |
615 |
++++ b/net/packet/af_packet.c |
616 |
+@@ -4282,7 +4282,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, |
617 |
+ goto out; |
618 |
+ if (po->tp_version >= TPACKET_V3 && |
619 |
+ req->tp_block_size <= |
620 |
+- BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) |
621 |
++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv) + sizeof(struct tpacket3_hdr)) |
622 |
+ goto out; |
623 |
+ if (unlikely(req->tp_frame_size < po->tp_hdrlen + |
624 |
+ po->tp_reserve)) |
625 |
+diff --git a/net/sctp/transport.c b/net/sctp/transport.c |
626 |
+index 47f82bd794d9..03fc2c427aca 100644 |
627 |
+--- a/net/sctp/transport.c |
628 |
++++ b/net/sctp/transport.c |
629 |
+@@ -634,7 +634,7 @@ unsigned long sctp_transport_timeout(struct sctp_transport *trans) |
630 |
+ trans->state != SCTP_PF) |
631 |
+ timeout += trans->hbinterval; |
632 |
+ |
633 |
+- return timeout; |
634 |
++ return max_t(unsigned long, timeout, HZ / 5); |
635 |
+ } |
636 |
+ |
637 |
+ /* Reset transport variables to their initial values */ |