Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:5.4 commit in: /
Date: Tue, 02 Nov 2021 19:31:52
Message-Id: 1635881497.715f74cb9adc0a3818d2b23b65f52f28e437d036.mpagano@gentoo
1 commit: 715f74cb9adc0a3818d2b23b65f52f28e437d036
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Tue Nov 2 19:31:37 2021 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Tue Nov 2 19:31:37 2021 +0000
6 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=715f74cb
7
8 Linux patch 5.4.157
9
10 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>
11
12 0000_README | 4 +
13 1156_linux-5.4.157.patch | 1584 ++++++++++++++++++++++++++++++++++++++++++++++
14 2 files changed, 1588 insertions(+)
15
16 diff --git a/0000_README b/0000_README
17 index e008863..eb1b9b5 100644
18 --- a/0000_README
19 +++ b/0000_README
20 @@ -667,6 +667,10 @@ Patch: 1155_linux-5.4.156.patch
21 From: http://www.kernel.org
22 Desc: Linux 5.4.156
23
24 +Patch: 1156_linux-5.4.157.patch
25 +From: http://www.kernel.org
26 +Desc: Linux 5.4.157
27 +
28 Patch: 1500_XATTR_USER_PREFIX.patch
29 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
30 Desc: Support for namespace user.pax.* on tmpfs.
31
32 diff --git a/1156_linux-5.4.157.patch b/1156_linux-5.4.157.patch
33 new file mode 100644
34 index 0000000..d821b0a
35 --- /dev/null
36 +++ b/1156_linux-5.4.157.patch
37 @@ -0,0 +1,1584 @@
38 +diff --git a/Makefile b/Makefile
39 +index ced1f0fd48dc6..49d639fe5a801 100644
40 +--- a/Makefile
41 ++++ b/Makefile
42 +@@ -1,7 +1,7 @@
43 + # SPDX-License-Identifier: GPL-2.0
44 + VERSION = 5
45 + PATCHLEVEL = 4
46 +-SUBLEVEL = 156
47 ++SUBLEVEL = 157
48 + EXTRAVERSION =
49 + NAME = Kleptomaniac Octopus
50 +
51 +diff --git a/arch/arm/boot/compressed/decompress.c b/arch/arm/boot/compressed/decompress.c
52 +index aa075d8372ea2..74255e8198314 100644
53 +--- a/arch/arm/boot/compressed/decompress.c
54 ++++ b/arch/arm/boot/compressed/decompress.c
55 +@@ -47,7 +47,10 @@ extern char * strchrnul(const char *, int);
56 + #endif
57 +
58 + #ifdef CONFIG_KERNEL_XZ
59 ++/* Prevent KASAN override of string helpers in decompressor */
60 ++#undef memmove
61 + #define memmove memmove
62 ++#undef memcpy
63 + #define memcpy memcpy
64 + #include "../../../../lib/decompress_unxz.c"
65 + #endif
66 +diff --git a/arch/arm/kernel/vmlinux-xip.lds.S b/arch/arm/kernel/vmlinux-xip.lds.S
67 +index 8c74037ade229..b1f366df620b0 100644
68 +--- a/arch/arm/kernel/vmlinux-xip.lds.S
69 ++++ b/arch/arm/kernel/vmlinux-xip.lds.S
70 +@@ -180,7 +180,7 @@ ASSERT(__hyp_idmap_text_end - (__hyp_idmap_text_start & PAGE_MASK) <= PAGE_SIZE,
71 + ASSERT((_end - __bss_start) >= 12288, ".bss too small for CONFIG_XIP_DEFLATED_DATA")
72 + #endif
73 +
74 +-#ifdef CONFIG_ARM_MPU
75 ++#if defined(CONFIG_ARM_MPU) && !defined(CONFIG_COMPILE_TEST)
76 + /*
77 + * Due to PMSAv7 restriction on base address and size we have to
78 + * enforce minimal alignment restrictions. It was seen that weaker
79 +diff --git a/arch/arm/mm/proc-macros.S b/arch/arm/mm/proc-macros.S
80 +index 60ac7c5999a98..86e54447dc916 100644
81 +--- a/arch/arm/mm/proc-macros.S
82 ++++ b/arch/arm/mm/proc-macros.S
83 +@@ -342,6 +342,7 @@ ENTRY(\name\()_cache_fns)
84 +
85 + .macro define_tlb_functions name:req, flags_up:req, flags_smp
86 + .type \name\()_tlb_fns, #object
87 ++ .align 2
88 + ENTRY(\name\()_tlb_fns)
89 + .long \name\()_flush_user_tlb_range
90 + .long \name\()_flush_kern_tlb_range
91 +diff --git a/arch/arm/probes/kprobes/core.c b/arch/arm/probes/kprobes/core.c
92 +index 90b5bc723c83f..0a783bd4641c5 100644
93 +--- a/arch/arm/probes/kprobes/core.c
94 ++++ b/arch/arm/probes/kprobes/core.c
95 +@@ -534,7 +534,7 @@ static struct undef_hook kprobes_arm_break_hook = {
96 +
97 + #endif /* !CONFIG_THUMB2_KERNEL */
98 +
99 +-int __init arch_init_kprobes()
100 ++int __init arch_init_kprobes(void)
101 + {
102 + arm_probes_decode_init();
103 + #ifdef CONFIG_THUMB2_KERNEL
104 +diff --git a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
105 +index 57a6f45036c1f..d7177465b0968 100644
106 +--- a/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
107 ++++ b/arch/arm64/boot/dts/allwinner/sun50i-h5-nanopi-neo2.dts
108 +@@ -114,7 +114,7 @@
109 + pinctrl-0 = <&emac_rgmii_pins>;
110 + phy-supply = <&reg_gmac_3v3>;
111 + phy-handle = <&ext_rgmii_phy>;
112 +- phy-mode = "rgmii";
113 ++ phy-mode = "rgmii-id";
114 + status = "okay";
115 + };
116 +
117 +diff --git a/arch/nios2/platform/Kconfig.platform b/arch/nios2/platform/Kconfig.platform
118 +index 9e32fb7f3d4ce..e849daff6fd16 100644
119 +--- a/arch/nios2/platform/Kconfig.platform
120 ++++ b/arch/nios2/platform/Kconfig.platform
121 +@@ -37,6 +37,7 @@ config NIOS2_DTB_PHYS_ADDR
122 +
123 + config NIOS2_DTB_SOURCE_BOOL
124 + bool "Compile and link device tree into kernel image"
125 ++ depends on !COMPILE_TEST
126 + help
127 + This allows you to specify a dts (device tree source) file
128 + which will be compiled and linked into the kernel image.
129 +diff --git a/arch/powerpc/net/bpf_jit_comp64.c b/arch/powerpc/net/bpf_jit_comp64.c
130 +index 20bfd753bcba6..81e6279c9874f 100644
131 +--- a/arch/powerpc/net/bpf_jit_comp64.c
132 ++++ b/arch/powerpc/net/bpf_jit_comp64.c
133 +@@ -408,8 +408,14 @@ static int bpf_jit_build_body(struct bpf_prog *fp, u32 *image,
134 + case BPF_ALU64 | BPF_DIV | BPF_K: /* dst /= imm */
135 + if (imm == 0)
136 + return -EINVAL;
137 +- else if (imm == 1)
138 +- goto bpf_alu32_trunc;
139 ++ if (imm == 1) {
140 ++ if (BPF_OP(code) == BPF_DIV) {
141 ++ goto bpf_alu32_trunc;
142 ++ } else {
143 ++ PPC_LI(dst_reg, 0);
144 ++ break;
145 ++ }
146 ++ }
147 +
148 + PPC_LI32(b2p[TMP_REG_1], imm);
149 + switch (BPF_CLASS(code)) {
150 +diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
151 +index fa9483aa4f575..fd73a8aa89d23 100644
152 +--- a/arch/s390/kvm/interrupt.c
153 ++++ b/arch/s390/kvm/interrupt.c
154 +@@ -2987,13 +2987,14 @@ static void __airqs_kick_single_vcpu(struct kvm *kvm, u8 deliverable_mask)
155 + int vcpu_idx, online_vcpus = atomic_read(&kvm->online_vcpus);
156 + struct kvm_s390_gisa_interrupt *gi = &kvm->arch.gisa_int;
157 + struct kvm_vcpu *vcpu;
158 ++ u8 vcpu_isc_mask;
159 +
160 + for_each_set_bit(vcpu_idx, kvm->arch.idle_mask, online_vcpus) {
161 + vcpu = kvm_get_vcpu(kvm, vcpu_idx);
162 + if (psw_ioint_disabled(vcpu))
163 + continue;
164 +- deliverable_mask &= (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
165 +- if (deliverable_mask) {
166 ++ vcpu_isc_mask = (u8)(vcpu->arch.sie_block->gcr[6] >> 24);
167 ++ if (deliverable_mask & vcpu_isc_mask) {
168 + /* lately kicked but not yet running */
169 + if (test_and_set_bit(vcpu_idx, gi->kicked_mask))
170 + return;
171 +diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
172 +index 9ed2fee612297..b286818d8d54d 100644
173 +--- a/arch/s390/kvm/kvm-s390.c
174 ++++ b/arch/s390/kvm/kvm-s390.c
175 +@@ -3092,6 +3092,7 @@ out:
176 +
177 + int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
178 + {
179 ++ clear_bit(vcpu->vcpu_idx, vcpu->kvm->arch.gisa_int.kicked_mask);
180 + return kvm_s390_vcpu_has_irq(vcpu, 0);
181 + }
182 +
183 +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
184 +index d1ed9679c7177..3fca3e13ed6ae 100644
185 +--- a/drivers/ata/sata_mv.c
186 ++++ b/drivers/ata/sata_mv.c
187 +@@ -3892,8 +3892,8 @@ static int mv_chip_id(struct ata_host *host, unsigned int board_idx)
188 + break;
189 +
190 + default:
191 +- dev_err(host->dev, "BUG: invalid board index %u\n", board_idx);
192 +- return 1;
193 ++ dev_alert(host->dev, "BUG: invalid board index %u\n", board_idx);
194 ++ return -EINVAL;
195 + }
196 +
197 + hpriv->hp_flags = hp_flags;
198 +diff --git a/drivers/base/regmap/regcache-rbtree.c b/drivers/base/regmap/regcache-rbtree.c
199 +index cfa29dc89bbff..fabf87058d80b 100644
200 +--- a/drivers/base/regmap/regcache-rbtree.c
201 ++++ b/drivers/base/regmap/regcache-rbtree.c
202 +@@ -281,14 +281,14 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
203 + if (!blk)
204 + return -ENOMEM;
205 +
206 ++ rbnode->block = blk;
207 ++
208 + if (BITS_TO_LONGS(blklen) > BITS_TO_LONGS(rbnode->blklen)) {
209 + present = krealloc(rbnode->cache_present,
210 + BITS_TO_LONGS(blklen) * sizeof(*present),
211 + GFP_KERNEL);
212 +- if (!present) {
213 +- kfree(blk);
214 ++ if (!present)
215 + return -ENOMEM;
216 +- }
217 +
218 + memset(present + BITS_TO_LONGS(rbnode->blklen), 0,
219 + (BITS_TO_LONGS(blklen) - BITS_TO_LONGS(rbnode->blklen))
220 +@@ -305,7 +305,6 @@ static int regcache_rbtree_insert_to_block(struct regmap *map,
221 + }
222 +
223 + /* update the rbnode block, its size and the base register */
224 +- rbnode->block = blk;
225 + rbnode->blklen = blklen;
226 + rbnode->base_reg = base_reg;
227 + rbnode->cache_present = present;
228 +diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
229 +index fe81c565e7ef8..a7b88ca8b97b3 100644
230 +--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
231 ++++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
232 +@@ -463,6 +463,7 @@ static void ttm_transfered_destroy(struct ttm_buffer_object *bo)
233 + struct ttm_transfer_obj *fbo;
234 +
235 + fbo = container_of(bo, struct ttm_transfer_obj, base);
236 ++ dma_resv_fini(&fbo->base.base._resv);
237 + ttm_bo_put(fbo->bo);
238 + kfree(fbo);
239 + }
240 +diff --git a/drivers/infiniband/core/sa_query.c b/drivers/infiniband/core/sa_query.c
241 +index d2d70c89193ff..11ab6390eda4d 100644
242 +--- a/drivers/infiniband/core/sa_query.c
243 ++++ b/drivers/infiniband/core/sa_query.c
244 +@@ -760,8 +760,9 @@ static void ib_nl_set_path_rec_attrs(struct sk_buff *skb,
245 +
246 + /* Construct the family header first */
247 + header = skb_put(skb, NLMSG_ALIGN(sizeof(*header)));
248 +- memcpy(header->device_name, dev_name(&query->port->agent->device->dev),
249 +- LS_DEVICE_NAME_MAX);
250 ++ strscpy_pad(header->device_name,
251 ++ dev_name(&query->port->agent->device->dev),
252 ++ LS_DEVICE_NAME_MAX);
253 + header->port_num = query->port->port_num;
254 +
255 + if ((comp_mask & IB_SA_PATH_REC_REVERSIBLE) &&
256 +diff --git a/drivers/infiniband/hw/hfi1/pio.c b/drivers/infiniband/hw/hfi1/pio.c
257 +index 79126b2b14ab0..1a82ea73a0fc2 100644
258 +--- a/drivers/infiniband/hw/hfi1/pio.c
259 ++++ b/drivers/infiniband/hw/hfi1/pio.c
260 +@@ -920,6 +920,7 @@ void sc_disable(struct send_context *sc)
261 + {
262 + u64 reg;
263 + struct pio_buf *pbuf;
264 ++ LIST_HEAD(wake_list);
265 +
266 + if (!sc)
267 + return;
268 +@@ -954,19 +955,21 @@ void sc_disable(struct send_context *sc)
269 + spin_unlock(&sc->release_lock);
270 +
271 + write_seqlock(&sc->waitlock);
272 +- while (!list_empty(&sc->piowait)) {
273 ++ if (!list_empty(&sc->piowait))
274 ++ list_move(&sc->piowait, &wake_list);
275 ++ write_sequnlock(&sc->waitlock);
276 ++ while (!list_empty(&wake_list)) {
277 + struct iowait *wait;
278 + struct rvt_qp *qp;
279 + struct hfi1_qp_priv *priv;
280 +
281 +- wait = list_first_entry(&sc->piowait, struct iowait, list);
282 ++ wait = list_first_entry(&wake_list, struct iowait, list);
283 + qp = iowait_to_qp(wait);
284 + priv = qp->priv;
285 + list_del_init(&priv->s_iowait.list);
286 + priv->s_iowait.lock = NULL;
287 + hfi1_qp_wakeup(qp, RVT_S_WAIT_PIO | HFI1_S_WAIT_PIO_DRAIN);
288 + }
289 +- write_sequnlock(&sc->waitlock);
290 +
291 + spin_unlock_irq(&sc->alloc_lock);
292 + }
293 +diff --git a/drivers/infiniband/hw/mlx5/qp.c b/drivers/infiniband/hw/mlx5/qp.c
294 +index 4540835e05bda..634f29cb7395c 100644
295 +--- a/drivers/infiniband/hw/mlx5/qp.c
296 ++++ b/drivers/infiniband/hw/mlx5/qp.c
297 +@@ -3865,6 +3865,8 @@ static int mlx5_ib_modify_dct(struct ib_qp *ibqp, struct ib_qp_attr *attr,
298 + MLX5_SET(dctc, dctc, mtu, attr->path_mtu);
299 + MLX5_SET(dctc, dctc, my_addr_index, attr->ah_attr.grh.sgid_index);
300 + MLX5_SET(dctc, dctc, hop_limit, attr->ah_attr.grh.hop_limit);
301 ++ if (attr->ah_attr.type == RDMA_AH_ATTR_TYPE_ROCE)
302 ++ MLX5_SET(dctc, dctc, eth_prio, attr->ah_attr.sl & 0x7);
303 +
304 + err = mlx5_core_create_dct(dev->mdev, &qp->dct.mdct, qp->dct.in,
305 + MLX5_ST_SZ_BYTES(create_dct_in), out,
306 +diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
307 +index 05190edc2611e..5fd28574124fb 100644
308 +--- a/drivers/infiniband/hw/qib/qib_user_sdma.c
309 ++++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
310 +@@ -602,7 +602,7 @@ done:
311 + /*
312 + * How many pages in this iovec element?
313 + */
314 +-static int qib_user_sdma_num_pages(const struct iovec *iov)
315 ++static size_t qib_user_sdma_num_pages(const struct iovec *iov)
316 + {
317 + const unsigned long addr = (unsigned long) iov->iov_base;
318 + const unsigned long len = iov->iov_len;
319 +@@ -658,7 +658,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev,
320 + static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,
321 + struct qib_user_sdma_queue *pq,
322 + struct qib_user_sdma_pkt *pkt,
323 +- unsigned long addr, int tlen, int npages)
324 ++ unsigned long addr, int tlen, size_t npages)
325 + {
326 + struct page *pages[8];
327 + int i, j;
328 +@@ -722,7 +722,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd,
329 + unsigned long idx;
330 +
331 + for (idx = 0; idx < niov; idx++) {
332 +- const int npages = qib_user_sdma_num_pages(iov + idx);
333 ++ const size_t npages = qib_user_sdma_num_pages(iov + idx);
334 + const unsigned long addr = (unsigned long) iov[idx].iov_base;
335 +
336 + ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr,
337 +@@ -824,8 +824,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
338 + unsigned pktnw;
339 + unsigned pktnwc;
340 + int nfrags = 0;
341 +- int npages = 0;
342 +- int bytes_togo = 0;
343 ++ size_t npages = 0;
344 ++ size_t bytes_togo = 0;
345 + int tiddma = 0;
346 + int cfur;
347 +
348 +@@ -885,7 +885,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
349 +
350 + npages += qib_user_sdma_num_pages(&iov[idx]);
351 +
352 +- bytes_togo += slen;
353 ++ if (check_add_overflow(bytes_togo, slen, &bytes_togo) ||
354 ++ bytes_togo > type_max(typeof(pkt->bytes_togo))) {
355 ++ ret = -EINVAL;
356 ++ goto free_pbc;
357 ++ }
358 + pktnwc += slen >> 2;
359 + idx++;
360 + nfrags++;
361 +@@ -904,8 +908,7 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
362 + }
363 +
364 + if (frag_size) {
365 +- int tidsmsize, n;
366 +- size_t pktsize;
367 ++ size_t tidsmsize, n, pktsize, sz, addrlimit;
368 +
369 + n = npages*((2*PAGE_SIZE/frag_size)+1);
370 + pktsize = struct_size(pkt, addr, n);
371 +@@ -923,14 +926,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
372 + else
373 + tidsmsize = 0;
374 +
375 +- pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL);
376 ++ if (check_add_overflow(pktsize, tidsmsize, &sz)) {
377 ++ ret = -EINVAL;
378 ++ goto free_pbc;
379 ++ }
380 ++ pkt = kmalloc(sz, GFP_KERNEL);
381 + if (!pkt) {
382 + ret = -ENOMEM;
383 + goto free_pbc;
384 + }
385 + pkt->largepkt = 1;
386 + pkt->frag_size = frag_size;
387 +- pkt->addrlimit = n + ARRAY_SIZE(pkt->addr);
388 ++ if (check_add_overflow(n, ARRAY_SIZE(pkt->addr),
389 ++ &addrlimit) ||
390 ++ addrlimit > type_max(typeof(pkt->addrlimit))) {
391 ++ ret = -EINVAL;
392 ++ goto free_pbc;
393 ++ }
394 ++ pkt->addrlimit = addrlimit;
395 +
396 + if (tiddma) {
397 + char *tidsm = (char *)pkt + pktsize;
398 +diff --git a/drivers/mmc/host/cqhci.c b/drivers/mmc/host/cqhci.c
399 +index 2d65b32d205a5..ec56464eaf23e 100644
400 +--- a/drivers/mmc/host/cqhci.c
401 ++++ b/drivers/mmc/host/cqhci.c
402 +@@ -273,6 +273,9 @@ static void __cqhci_enable(struct cqhci_host *cq_host)
403 +
404 + cqhci_writel(cq_host, cqcfg, CQHCI_CFG);
405 +
406 ++ if (cqhci_readl(cq_host, CQHCI_CTL) & CQHCI_HALT)
407 ++ cqhci_writel(cq_host, 0, CQHCI_CTL);
408 ++
409 + mmc->cqe_on = true;
410 +
411 + if (cq_host->ops->enable)
412 +diff --git a/drivers/mmc/host/dw_mmc-exynos.c b/drivers/mmc/host/dw_mmc-exynos.c
413 +index 5e3d95b636769..ae2c74186e1d2 100644
414 +--- a/drivers/mmc/host/dw_mmc-exynos.c
415 ++++ b/drivers/mmc/host/dw_mmc-exynos.c
416 +@@ -462,6 +462,18 @@ static s8 dw_mci_exynos_get_best_clksmpl(u8 candiates)
417 + }
418 + }
419 +
420 ++ /*
421 ++ * If there is no cadiates value, then it needs to return -EIO.
422 ++ * If there are candiates values and don't find bset clk sample value,
423 ++ * then use a first candiates clock sample value.
424 ++ */
425 ++ for (i = 0; i < iter; i++) {
426 ++ __c = ror8(candiates, i);
427 ++ if ((__c & 0x1) == 0x1) {
428 ++ loc = i;
429 ++ goto out;
430 ++ }
431 ++ }
432 + out:
433 + return loc;
434 + }
435 +@@ -492,6 +504,8 @@ static int dw_mci_exynos_execute_tuning(struct dw_mci_slot *slot, u32 opcode)
436 + priv->tuned_sample = found;
437 + } else {
438 + ret = -EIO;
439 ++ dev_warn(&mmc->class_dev,
440 ++ "There is no candiates value about clksmpl!\n");
441 + }
442 +
443 + return ret;
444 +diff --git a/drivers/mmc/host/sdhci-esdhc-imx.c b/drivers/mmc/host/sdhci-esdhc-imx.c
445 +index 771676209005b..2c01e2ebef7aa 100644
446 +--- a/drivers/mmc/host/sdhci-esdhc-imx.c
447 ++++ b/drivers/mmc/host/sdhci-esdhc-imx.c
448 +@@ -24,6 +24,7 @@
449 + #include <linux/pinctrl/consumer.h>
450 + #include <linux/platform_data/mmc-esdhc-imx.h>
451 + #include <linux/pm_runtime.h>
452 ++#include <linux/iopoll.h>
453 + #include "sdhci-pltfm.h"
454 + #include "sdhci-esdhc.h"
455 + #include "cqhci.h"
456 +@@ -1022,6 +1023,7 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
457 + struct sdhci_pltfm_host *pltfm_host = sdhci_priv(host);
458 + struct pltfm_imx_data *imx_data = sdhci_pltfm_priv(pltfm_host);
459 + u32 ctrl;
460 ++ int ret;
461 +
462 + /* Reset the tuning circuit */
463 + if (esdhc_is_usdhc(imx_data)) {
464 +@@ -1034,7 +1036,22 @@ static void esdhc_reset_tuning(struct sdhci_host *host)
465 + } else if (imx_data->socdata->flags & ESDHC_FLAG_STD_TUNING) {
466 + ctrl = readl(host->ioaddr + SDHCI_AUTO_CMD_STATUS);
467 + ctrl &= ~ESDHC_MIX_CTRL_SMPCLK_SEL;
468 ++ ctrl &= ~ESDHC_MIX_CTRL_EXE_TUNE;
469 + writel(ctrl, host->ioaddr + SDHCI_AUTO_CMD_STATUS);
470 ++ /* Make sure ESDHC_MIX_CTRL_EXE_TUNE cleared */
471 ++ ret = readl_poll_timeout(host->ioaddr + SDHCI_AUTO_CMD_STATUS,
472 ++ ctrl, !(ctrl & ESDHC_MIX_CTRL_EXE_TUNE), 1, 50);
473 ++ if (ret == -ETIMEDOUT)
474 ++ dev_warn(mmc_dev(host->mmc),
475 ++ "Warning! clear execute tuning bit failed\n");
476 ++ /*
477 ++ * SDHCI_INT_DATA_AVAIL is W1C bit, set this bit will clear the
478 ++ * usdhc IP internal logic flag execute_tuning_with_clr_buf, which
479 ++ * will finally make sure the normal data transfer logic correct.
480 ++ */
481 ++ ctrl = readl(host->ioaddr + SDHCI_INT_STATUS);
482 ++ ctrl |= SDHCI_INT_DATA_AVAIL;
483 ++ writel(ctrl, host->ioaddr + SDHCI_INT_STATUS);
484 + }
485 + }
486 + }
487 +diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
488 +index 2ecd9acebb2f0..cb54fa2120d72 100644
489 +--- a/drivers/mmc/host/sdhci.c
490 ++++ b/drivers/mmc/host/sdhci.c
491 +@@ -1741,6 +1741,12 @@ void sdhci_set_power_noreg(struct sdhci_host *host, unsigned char mode,
492 + break;
493 + case MMC_VDD_32_33:
494 + case MMC_VDD_33_34:
495 ++ /*
496 ++ * 3.4 ~ 3.6V are valid only for those platforms where it's
497 ++ * known that the voltage range is supported by hardware.
498 ++ */
499 ++ case MMC_VDD_34_35:
500 ++ case MMC_VDD_35_36:
501 + pwr = SDHCI_POWER_330;
502 + break;
503 + default:
504 +diff --git a/drivers/mmc/host/vub300.c b/drivers/mmc/host/vub300.c
505 +index 156046e56a584..5e1d7025dbf78 100644
506 +--- a/drivers/mmc/host/vub300.c
507 ++++ b/drivers/mmc/host/vub300.c
508 +@@ -576,7 +576,7 @@ static void check_vub300_port_status(struct vub300_mmc_host *vub300)
509 + GET_SYSTEM_PORT_STATUS,
510 + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
511 + 0x0000, 0x0000, &vub300->system_port_status,
512 +- sizeof(vub300->system_port_status), HZ);
513 ++ sizeof(vub300->system_port_status), 1000);
514 + if (sizeof(vub300->system_port_status) == retval)
515 + new_system_port_status(vub300);
516 + }
517 +@@ -1241,7 +1241,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
518 + SET_INTERRUPT_PSEUDOCODE,
519 + USB_DIR_OUT | USB_TYPE_VENDOR |
520 + USB_RECIP_DEVICE, 0x0000, 0x0000,
521 +- xfer_buffer, xfer_length, HZ);
522 ++ xfer_buffer, xfer_length, 1000);
523 + kfree(xfer_buffer);
524 + if (retval < 0)
525 + goto copy_error_message;
526 +@@ -1284,7 +1284,7 @@ static void __download_offload_pseudocode(struct vub300_mmc_host *vub300,
527 + SET_TRANSFER_PSEUDOCODE,
528 + USB_DIR_OUT | USB_TYPE_VENDOR |
529 + USB_RECIP_DEVICE, 0x0000, 0x0000,
530 +- xfer_buffer, xfer_length, HZ);
531 ++ xfer_buffer, xfer_length, 1000);
532 + kfree(xfer_buffer);
533 + if (retval < 0)
534 + goto copy_error_message;
535 +@@ -1991,7 +1991,7 @@ static void __set_clock_speed(struct vub300_mmc_host *vub300, u8 buf[8],
536 + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
537 + SET_CLOCK_SPEED,
538 + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
539 +- 0x00, 0x00, buf, buf_array_size, HZ);
540 ++ 0x00, 0x00, buf, buf_array_size, 1000);
541 + if (retval != 8) {
542 + dev_err(&vub300->udev->dev, "SET_CLOCK_SPEED"
543 + " %dkHz failed with retval=%d\n", kHzClock, retval);
544 +@@ -2013,14 +2013,14 @@ static void vub300_mmc_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
545 + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
546 + SET_SD_POWER,
547 + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
548 +- 0x0000, 0x0000, NULL, 0, HZ);
549 ++ 0x0000, 0x0000, NULL, 0, 1000);
550 + /* must wait for the VUB300 u-proc to boot up */
551 + msleep(600);
552 + } else if ((ios->power_mode == MMC_POWER_UP) && !vub300->card_powered) {
553 + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
554 + SET_SD_POWER,
555 + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
556 +- 0x0001, 0x0000, NULL, 0, HZ);
557 ++ 0x0001, 0x0000, NULL, 0, 1000);
558 + msleep(600);
559 + vub300->card_powered = 1;
560 + } else if (ios->power_mode == MMC_POWER_ON) {
561 +@@ -2282,14 +2282,14 @@ static int vub300_probe(struct usb_interface *interface,
562 + GET_HC_INF0,
563 + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
564 + 0x0000, 0x0000, &vub300->hc_info,
565 +- sizeof(vub300->hc_info), HZ);
566 ++ sizeof(vub300->hc_info), 1000);
567 + if (retval < 0)
568 + goto error5;
569 + retval =
570 + usb_control_msg(vub300->udev, usb_sndctrlpipe(vub300->udev, 0),
571 + SET_ROM_WAIT_STATES,
572 + USB_DIR_OUT | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
573 +- firmware_rom_wait_states, 0x0000, NULL, 0, HZ);
574 ++ firmware_rom_wait_states, 0x0000, NULL, 0, 1000);
575 + if (retval < 0)
576 + goto error5;
577 + dev_info(&vub300->udev->dev,
578 +@@ -2304,7 +2304,7 @@ static int vub300_probe(struct usb_interface *interface,
579 + GET_SYSTEM_PORT_STATUS,
580 + USB_DIR_IN | USB_TYPE_VENDOR | USB_RECIP_DEVICE,
581 + 0x0000, 0x0000, &vub300->system_port_status,
582 +- sizeof(vub300->system_port_status), HZ);
583 ++ sizeof(vub300->system_port_status), 1000);
584 + if (retval < 0) {
585 + goto error4;
586 + } else if (sizeof(vub300->system_port_status) == retval) {
587 +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
588 +index 1949f631e1bc5..a7eaf80f500c0 100644
589 +--- a/drivers/net/bonding/bond_main.c
590 ++++ b/drivers/net/bonding/bond_main.c
591 +@@ -1219,7 +1219,7 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
592 + skb->dev = bond->dev;
593 +
594 + if (BOND_MODE(bond) == BOND_MODE_ALB &&
595 +- bond->dev->priv_flags & IFF_BRIDGE_PORT &&
596 ++ netif_is_bridge_port(bond->dev) &&
597 + skb->pkt_type == PACKET_HOST) {
598 +
599 + if (unlikely(skb_cow_head(skb,
600 +diff --git a/drivers/net/ethernet/micrel/ksz884x.c b/drivers/net/ethernet/micrel/ksz884x.c
601 +index 7dc451fdaf35e..2431723bc2fb4 100644
602 +--- a/drivers/net/ethernet/micrel/ksz884x.c
603 ++++ b/drivers/net/ethernet/micrel/ksz884x.c
604 +@@ -5693,7 +5693,7 @@ static void dev_set_promiscuous(struct net_device *dev, struct dev_priv *priv,
605 + * from the bridge.
606 + */
607 + if ((hw->features & STP_SUPPORT) && !promiscuous &&
608 +- (dev->priv_flags & IFF_BRIDGE_PORT)) {
609 ++ netif_is_bridge_port(dev)) {
610 + struct ksz_switch *sw = hw->ksz_switch;
611 + int port = priv->port.first_port;
612 +
613 +diff --git a/drivers/net/ethernet/microchip/lan743x_main.c b/drivers/net/ethernet/microchip/lan743x_main.c
614 +index dfa0ded169ee9..a109120da0e7c 100644
615 +--- a/drivers/net/ethernet/microchip/lan743x_main.c
616 ++++ b/drivers/net/ethernet/microchip/lan743x_main.c
617 +@@ -1706,6 +1706,16 @@ static int lan743x_tx_ring_init(struct lan743x_tx *tx)
618 + ret = -EINVAL;
619 + goto cleanup;
620 + }
621 ++ if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
622 ++ DMA_BIT_MASK(64))) {
623 ++ if (dma_set_mask_and_coherent(&tx->adapter->pdev->dev,
624 ++ DMA_BIT_MASK(32))) {
625 ++ dev_warn(&tx->adapter->pdev->dev,
626 ++ "lan743x_: No suitable DMA available\n");
627 ++ ret = -ENOMEM;
628 ++ goto cleanup;
629 ++ }
630 ++ }
631 + ring_allocation_size = ALIGN(tx->ring_size *
632 + sizeof(struct lan743x_tx_descriptor),
633 + PAGE_SIZE);
634 +@@ -2256,6 +2266,16 @@ static int lan743x_rx_ring_init(struct lan743x_rx *rx)
635 + ret = -EINVAL;
636 + goto cleanup;
637 + }
638 ++ if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
639 ++ DMA_BIT_MASK(64))) {
640 ++ if (dma_set_mask_and_coherent(&rx->adapter->pdev->dev,
641 ++ DMA_BIT_MASK(32))) {
642 ++ dev_warn(&rx->adapter->pdev->dev,
643 ++ "lan743x_: No suitable DMA available\n");
644 ++ ret = -ENOMEM;
645 ++ goto cleanup;
646 ++ }
647 ++ }
648 + ring_allocation_size = ALIGN(rx->ring_size *
649 + sizeof(struct lan743x_rx_descriptor),
650 + PAGE_SIZE);
651 +@@ -3001,6 +3021,8 @@ static int lan743x_pm_resume(struct device *dev)
652 + if (ret) {
653 + netif_err(adapter, probe, adapter->netdev,
654 + "lan743x_hardware_init returned %d\n", ret);
655 ++ lan743x_pci_cleanup(adapter);
656 ++ return ret;
657 + }
658 +
659 + /* open netdev when netdev is at running state while resume.
660 +diff --git a/drivers/net/ethernet/nxp/lpc_eth.c b/drivers/net/ethernet/nxp/lpc_eth.c
661 +index 1d59ef367a85c..3b177421651f1 100644
662 +--- a/drivers/net/ethernet/nxp/lpc_eth.c
663 ++++ b/drivers/net/ethernet/nxp/lpc_eth.c
664 +@@ -1007,9 +1007,6 @@ static int lpc_eth_close(struct net_device *ndev)
665 + napi_disable(&pldat->napi);
666 + netif_stop_queue(ndev);
667 +
668 +- if (ndev->phydev)
669 +- phy_stop(ndev->phydev);
670 +-
671 + spin_lock_irqsave(&pldat->lock, flags);
672 + __lpc_eth_reset(pldat);
673 + netif_carrier_off(ndev);
674 +@@ -1017,6 +1014,8 @@ static int lpc_eth_close(struct net_device *ndev)
675 + writel(0, LPC_ENET_MAC2(pldat->net_base));
676 + spin_unlock_irqrestore(&pldat->lock, flags);
677 +
678 ++ if (ndev->phydev)
679 ++ phy_stop(ndev->phydev);
680 + clk_disable_unprepare(pldat->clk);
681 +
682 + return 0;
683 +diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
684 +index 8377ff229a303..bec73f0640d03 100644
685 +--- a/drivers/net/phy/mdio_bus.c
686 ++++ b/drivers/net/phy/mdio_bus.c
687 +@@ -395,7 +395,6 @@ int __mdiobus_register(struct mii_bus *bus, struct module *owner)
688 + err = device_register(&bus->dev);
689 + if (err) {
690 + pr_err("mii_bus %s failed to register\n", bus->id);
691 +- put_device(&bus->dev);
692 + return -EINVAL;
693 + }
694 +
695 +diff --git a/drivers/net/phy/phy.c b/drivers/net/phy/phy.c
696 +index b0b8a3ce82b68..6c52ff8c0d2eb 100644
697 +--- a/drivers/net/phy/phy.c
698 ++++ b/drivers/net/phy/phy.c
699 +@@ -367,6 +367,7 @@ EXPORT_SYMBOL(phy_ethtool_ksettings_set);
700 + void phy_ethtool_ksettings_get(struct phy_device *phydev,
701 + struct ethtool_link_ksettings *cmd)
702 + {
703 ++ mutex_lock(&phydev->lock);
704 + linkmode_copy(cmd->link_modes.supported, phydev->supported);
705 + linkmode_copy(cmd->link_modes.advertising, phydev->advertising);
706 + linkmode_copy(cmd->link_modes.lp_advertising, phydev->lp_advertising);
707 +@@ -383,6 +384,7 @@ void phy_ethtool_ksettings_get(struct phy_device *phydev,
708 + cmd->base.autoneg = phydev->autoneg;
709 + cmd->base.eth_tp_mdix_ctrl = phydev->mdix_ctrl;
710 + cmd->base.eth_tp_mdix = phydev->mdix;
711 ++ mutex_unlock(&phydev->lock);
712 + }
713 + EXPORT_SYMBOL(phy_ethtool_ksettings_get);
714 +
715 +@@ -553,7 +555,7 @@ static int phy_check_link_status(struct phy_device *phydev)
716 + }
717 +
718 + /**
719 +- * phy_start_aneg - start auto-negotiation for this PHY device
720 ++ * _phy_start_aneg - start auto-negotiation for this PHY device
721 + * @phydev: the phy_device struct
722 + *
723 + * Description: Sanitizes the settings (if we're not autonegotiating
724 +@@ -561,25 +563,43 @@ static int phy_check_link_status(struct phy_device *phydev)
725 + * If the PHYCONTROL Layer is operating, we change the state to
726 + * reflect the beginning of Auto-negotiation or forcing.
727 + */
728 +-int phy_start_aneg(struct phy_device *phydev)
729 ++static int _phy_start_aneg(struct phy_device *phydev)
730 + {
731 + int err;
732 +
733 ++ lockdep_assert_held(&phydev->lock);
734 ++
735 + if (!phydev->drv)
736 + return -EIO;
737 +
738 +- mutex_lock(&phydev->lock);
739 +-
740 + if (AUTONEG_DISABLE == phydev->autoneg)
741 + phy_sanitize_settings(phydev);
742 +
743 + err = phy_config_aneg(phydev);
744 + if (err < 0)
745 +- goto out_unlock;
746 ++ return err;
747 +
748 + if (phy_is_started(phydev))
749 + err = phy_check_link_status(phydev);
750 +-out_unlock:
751 ++
752 ++ return err;
753 ++}
754 ++
755 ++/**
756 ++ * phy_start_aneg - start auto-negotiation for this PHY device
757 ++ * @phydev: the phy_device struct
758 ++ *
759 ++ * Description: Sanitizes the settings (if we're not autonegotiating
760 ++ * them), and then calls the driver's config_aneg function.
761 ++ * If the PHYCONTROL Layer is operating, we change the state to
762 ++ * reflect the beginning of Auto-negotiation or forcing.
763 ++ */
764 ++int phy_start_aneg(struct phy_device *phydev)
765 ++{
766 ++ int err;
767 ++
768 ++ mutex_lock(&phydev->lock);
769 ++ err = _phy_start_aneg(phydev);
770 + mutex_unlock(&phydev->lock);
771 +
772 + return err;
773 +diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
774 +index 92d9d3407b79b..fe830b72c3b0f 100644
775 +--- a/drivers/net/usb/lan78xx.c
776 ++++ b/drivers/net/usb/lan78xx.c
777 +@@ -3753,6 +3753,12 @@ static int lan78xx_probe(struct usb_interface *intf,
778 +
779 + dev->maxpacket = usb_maxpacket(dev->udev, dev->pipe_out, 1);
780 +
781 ++ /* Reject broken descriptors. */
782 ++ if (dev->maxpacket == 0) {
783 ++ ret = -ENODEV;
784 ++ goto out4;
785 ++ }
786 ++
787 + /* driver requires remote-wakeup capability during autosuspend. */
788 + intf->needs_remote_wakeup = 1;
789 +
790 +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
791 +index dde05e2fdc3e6..b8b9df82f51ef 100644
792 +--- a/drivers/net/usb/usbnet.c
793 ++++ b/drivers/net/usb/usbnet.c
794 +@@ -1773,6 +1773,11 @@ usbnet_probe (struct usb_interface *udev, const struct usb_device_id *prod)
795 + if (!dev->rx_urb_size)
796 + dev->rx_urb_size = dev->hard_mtu;
797 + dev->maxpacket = usb_maxpacket (dev->udev, dev->out, 1);
798 ++ if (dev->maxpacket == 0) {
799 ++ /* that is a broken device */
800 ++ status = -ENODEV;
801 ++ goto out4;
802 ++ }
803 +
804 + /* let userspace know we have a random address */
805 + if (ether_addr_equal(net->dev_addr, node_id))
806 +diff --git a/drivers/nfc/port100.c b/drivers/nfc/port100.c
807 +index 8e4d355dc3aec..1caebefb25ff1 100644
808 +--- a/drivers/nfc/port100.c
809 ++++ b/drivers/nfc/port100.c
810 +@@ -1003,11 +1003,11 @@ static u64 port100_get_command_type_mask(struct port100 *dev)
811 +
812 + skb = port100_alloc_skb(dev, 0);
813 + if (!skb)
814 +- return -ENOMEM;
815 ++ return 0;
816 +
817 + resp = port100_send_cmd_sync(dev, PORT100_CMD_GET_COMMAND_TYPE, skb);
818 + if (IS_ERR(resp))
819 +- return PTR_ERR(resp);
820 ++ return 0;
821 +
822 + if (resp->len < 8)
823 + mask = 0;
824 +diff --git a/drivers/nvme/host/tcp.c b/drivers/nvme/host/tcp.c
825 +index 38bbbbbc6f47f..ff0d06e8ebb53 100644
826 +--- a/drivers/nvme/host/tcp.c
827 ++++ b/drivers/nvme/host/tcp.c
828 +@@ -962,7 +962,7 @@ static int nvme_tcp_try_send_ddgst(struct nvme_tcp_request *req)
829 + int ret;
830 + struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_EOR };
831 + struct kvec iov = {
832 +- .iov_base = &req->ddgst + req->offset,
833 ++ .iov_base = (u8 *)&req->ddgst + req->offset,
834 + .iov_len = NVME_TCP_DIGEST_LENGTH - req->offset
835 + };
836 +
837 +diff --git a/drivers/nvme/target/tcp.c b/drivers/nvme/target/tcp.c
838 +index 2ae846297d7ca..2f4e512bd449f 100644
839 +--- a/drivers/nvme/target/tcp.c
840 ++++ b/drivers/nvme/target/tcp.c
841 +@@ -633,7 +633,7 @@ static int nvmet_try_send_ddgst(struct nvmet_tcp_cmd *cmd)
842 + struct nvmet_tcp_queue *queue = cmd->queue;
843 + struct msghdr msg = { .msg_flags = MSG_DONTWAIT };
844 + struct kvec iov = {
845 +- .iov_base = &cmd->exp_ddgst + cmd->offset,
846 ++ .iov_base = (u8 *)&cmd->exp_ddgst + cmd->offset,
847 + .iov_len = NVME_TCP_DIGEST_LENGTH - cmd->offset
848 + };
849 + int ret;
850 +diff --git a/drivers/pinctrl/bcm/pinctrl-ns.c b/drivers/pinctrl/bcm/pinctrl-ns.c
851 +index e79690bd8b85f..d7f8175d2c1c8 100644
852 +--- a/drivers/pinctrl/bcm/pinctrl-ns.c
853 ++++ b/drivers/pinctrl/bcm/pinctrl-ns.c
854 +@@ -5,7 +5,6 @@
855 +
856 + #include <linux/err.h>
857 + #include <linux/io.h>
858 +-#include <linux/mfd/syscon.h>
859 + #include <linux/module.h>
860 + #include <linux/of.h>
861 + #include <linux/of_device.h>
862 +@@ -13,7 +12,6 @@
863 + #include <linux/pinctrl/pinctrl.h>
864 + #include <linux/pinctrl/pinmux.h>
865 + #include <linux/platform_device.h>
866 +-#include <linux/regmap.h>
867 + #include <linux/slab.h>
868 +
869 + #define FLAG_BCM4708 BIT(1)
870 +@@ -24,8 +22,7 @@ struct ns_pinctrl {
871 + struct device *dev;
872 + unsigned int chipset_flag;
873 + struct pinctrl_dev *pctldev;
874 +- struct regmap *regmap;
875 +- u32 offset;
876 ++ void __iomem *base;
877 +
878 + struct pinctrl_desc pctldesc;
879 + struct ns_pinctrl_group *groups;
880 +@@ -232,9 +229,9 @@ static int ns_pinctrl_set_mux(struct pinctrl_dev *pctrl_dev,
881 + unset |= BIT(pin_number);
882 + }
883 +
884 +- regmap_read(ns_pinctrl->regmap, ns_pinctrl->offset, &tmp);
885 ++ tmp = readl(ns_pinctrl->base);
886 + tmp &= ~unset;
887 +- regmap_write(ns_pinctrl->regmap, ns_pinctrl->offset, tmp);
888 ++ writel(tmp, ns_pinctrl->base);
889 +
890 + return 0;
891 + }
892 +@@ -266,13 +263,13 @@ static const struct of_device_id ns_pinctrl_of_match_table[] = {
893 + static int ns_pinctrl_probe(struct platform_device *pdev)
894 + {
895 + struct device *dev = &pdev->dev;
896 +- struct device_node *np = dev->of_node;
897 + const struct of_device_id *of_id;
898 + struct ns_pinctrl *ns_pinctrl;
899 + struct pinctrl_desc *pctldesc;
900 + struct pinctrl_pin_desc *pin;
901 + struct ns_pinctrl_group *group;
902 + struct ns_pinctrl_function *function;
903 ++ struct resource *res;
904 + int i;
905 +
906 + ns_pinctrl = devm_kzalloc(dev, sizeof(*ns_pinctrl), GFP_KERNEL);
907 +@@ -290,18 +287,12 @@ static int ns_pinctrl_probe(struct platform_device *pdev)
908 + return -EINVAL;
909 + ns_pinctrl->chipset_flag = (uintptr_t)of_id->data;
910 +
911 +- ns_pinctrl->regmap = syscon_node_to_regmap(of_get_parent(np));
912 +- if (IS_ERR(ns_pinctrl->regmap)) {
913 +- int err = PTR_ERR(ns_pinctrl->regmap);
914 +-
915 +- dev_err(dev, "Failed to map pinctrl regs: %d\n", err);
916 +-
917 +- return err;
918 +- }
919 +-
920 +- if (of_property_read_u32(np, "offset", &ns_pinctrl->offset)) {
921 +- dev_err(dev, "Failed to get register offset\n");
922 +- return -ENOENT;
923 ++ res = platform_get_resource_byname(pdev, IORESOURCE_MEM,
924 ++ "cru_gpio_control");
925 ++ ns_pinctrl->base = devm_ioremap_resource(dev, res);
926 ++ if (IS_ERR(ns_pinctrl->base)) {
927 ++ dev_err(dev, "Failed to map pinctrl regs\n");
928 ++ return PTR_ERR(ns_pinctrl->base);
929 + }
930 +
931 + memcpy(pctldesc, &ns_pinctrl_desc, sizeof(*pctldesc));
932 +diff --git a/include/net/tls.h b/include/net/tls.h
933 +index 697df45c0bcee..7f220e03ebb2d 100644
934 +--- a/include/net/tls.h
935 ++++ b/include/net/tls.h
936 +@@ -360,6 +360,7 @@ int tls_sk_query(struct sock *sk, int optname, char __user *optval,
937 + int __user *optlen);
938 + int tls_sk_attach(struct sock *sk, int optname, char __user *optval,
939 + unsigned int optlen);
940 ++void tls_err_abort(struct sock *sk, int err);
941 +
942 + int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx, int tx);
943 + void tls_sw_strparser_arm(struct sock *sk, struct tls_context *ctx);
944 +@@ -465,12 +466,6 @@ static inline bool tls_is_sk_tx_device_offloaded(struct sock *sk)
945 + #endif
946 + }
947 +
948 +-static inline void tls_err_abort(struct sock *sk, int err)
949 +-{
950 +- sk->sk_err = err;
951 +- sk->sk_error_report(sk);
952 +-}
953 +-
954 + static inline bool tls_bigint_increment(unsigned char *seq, int len)
955 + {
956 + int i;
957 +@@ -499,7 +494,7 @@ static inline void tls_advance_record_sn(struct sock *sk,
958 + struct cipher_context *ctx)
959 + {
960 + if (tls_bigint_increment(ctx->rec_seq, prot->rec_seq_size))
961 +- tls_err_abort(sk, EBADMSG);
962 ++ tls_err_abort(sk, -EBADMSG);
963 +
964 + if (prot->version != TLS_1_3_VERSION)
965 + tls_bigint_increment(ctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
966 +diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
967 +index a6b26ca5c6973..2e818eca3e1c6 100644
968 +--- a/net/batman-adv/bridge_loop_avoidance.c
969 ++++ b/net/batman-adv/bridge_loop_avoidance.c
970 +@@ -1561,10 +1561,14 @@ int batadv_bla_init(struct batadv_priv *bat_priv)
971 + return 0;
972 +
973 + bat_priv->bla.claim_hash = batadv_hash_new(128);
974 +- bat_priv->bla.backbone_hash = batadv_hash_new(32);
975 ++ if (!bat_priv->bla.claim_hash)
976 ++ return -ENOMEM;
977 +
978 +- if (!bat_priv->bla.claim_hash || !bat_priv->bla.backbone_hash)
979 ++ bat_priv->bla.backbone_hash = batadv_hash_new(32);
980 ++ if (!bat_priv->bla.backbone_hash) {
981 ++ batadv_hash_destroy(bat_priv->bla.claim_hash);
982 + return -ENOMEM;
983 ++ }
984 +
985 + batadv_hash_set_lock_class(bat_priv->bla.claim_hash,
986 + &batadv_claim_hash_lock_class_key);
987 +diff --git a/net/batman-adv/main.c b/net/batman-adv/main.c
988 +index 4a89177def647..6a183c94cdeb4 100644
989 +--- a/net/batman-adv/main.c
990 ++++ b/net/batman-adv/main.c
991 +@@ -197,29 +197,41 @@ int batadv_mesh_init(struct net_device *soft_iface)
992 +
993 + bat_priv->gw.generation = 0;
994 +
995 +- ret = batadv_v_mesh_init(bat_priv);
996 +- if (ret < 0)
997 +- goto err;
998 +-
999 + ret = batadv_originator_init(bat_priv);
1000 +- if (ret < 0)
1001 +- goto err;
1002 ++ if (ret < 0) {
1003 ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
1004 ++ goto err_orig;
1005 ++ }
1006 +
1007 + ret = batadv_tt_init(bat_priv);
1008 +- if (ret < 0)
1009 +- goto err;
1010 ++ if (ret < 0) {
1011 ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
1012 ++ goto err_tt;
1013 ++ }
1014 ++
1015 ++ ret = batadv_v_mesh_init(bat_priv);
1016 ++ if (ret < 0) {
1017 ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
1018 ++ goto err_v;
1019 ++ }
1020 +
1021 + ret = batadv_bla_init(bat_priv);
1022 +- if (ret < 0)
1023 +- goto err;
1024 ++ if (ret < 0) {
1025 ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
1026 ++ goto err_bla;
1027 ++ }
1028 +
1029 + ret = batadv_dat_init(bat_priv);
1030 +- if (ret < 0)
1031 +- goto err;
1032 ++ if (ret < 0) {
1033 ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
1034 ++ goto err_dat;
1035 ++ }
1036 +
1037 + ret = batadv_nc_mesh_init(bat_priv);
1038 +- if (ret < 0)
1039 +- goto err;
1040 ++ if (ret < 0) {
1041 ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_DEACTIVATING);
1042 ++ goto err_nc;
1043 ++ }
1044 +
1045 + batadv_gw_init(bat_priv);
1046 + batadv_mcast_init(bat_priv);
1047 +@@ -229,8 +241,20 @@ int batadv_mesh_init(struct net_device *soft_iface)
1048 +
1049 + return 0;
1050 +
1051 +-err:
1052 +- batadv_mesh_free(soft_iface);
1053 ++err_nc:
1054 ++ batadv_dat_free(bat_priv);
1055 ++err_dat:
1056 ++ batadv_bla_free(bat_priv);
1057 ++err_bla:
1058 ++ batadv_v_mesh_free(bat_priv);
1059 ++err_v:
1060 ++ batadv_tt_free(bat_priv);
1061 ++err_tt:
1062 ++ batadv_originator_free(bat_priv);
1063 ++err_orig:
1064 ++ batadv_purge_outstanding_packets(bat_priv, NULL);
1065 ++ atomic_set(&bat_priv->mesh_state, BATADV_MESH_INACTIVE);
1066 ++
1067 + return ret;
1068 + }
1069 +
1070 +diff --git a/net/batman-adv/network-coding.c b/net/batman-adv/network-coding.c
1071 +index 70e3b161c6635..850f927f33de2 100644
1072 +--- a/net/batman-adv/network-coding.c
1073 ++++ b/net/batman-adv/network-coding.c
1074 +@@ -155,8 +155,10 @@ int batadv_nc_mesh_init(struct batadv_priv *bat_priv)
1075 + &batadv_nc_coding_hash_lock_class_key);
1076 +
1077 + bat_priv->nc.decoding_hash = batadv_hash_new(128);
1078 +- if (!bat_priv->nc.decoding_hash)
1079 ++ if (!bat_priv->nc.decoding_hash) {
1080 ++ batadv_hash_destroy(bat_priv->nc.coding_hash);
1081 + goto err;
1082 ++ }
1083 +
1084 + batadv_hash_set_lock_class(bat_priv->nc.decoding_hash,
1085 + &batadv_nc_decoding_hash_lock_class_key);
1086 +diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
1087 +index c5271ea4dc832..515205d7b650f 100644
1088 +--- a/net/batman-adv/translation-table.c
1089 ++++ b/net/batman-adv/translation-table.c
1090 +@@ -4405,8 +4405,10 @@ int batadv_tt_init(struct batadv_priv *bat_priv)
1091 + return ret;
1092 +
1093 + ret = batadv_tt_global_init(bat_priv);
1094 +- if (ret < 0)
1095 ++ if (ret < 0) {
1096 ++ batadv_tt_local_table_free(bat_priv);
1097 + return ret;
1098 ++ }
1099 +
1100 + batadv_tvlv_handler_register(bat_priv, batadv_tt_tvlv_ogm_handler_v1,
1101 + batadv_tt_tvlv_unicast_handler_v1,
1102 +diff --git a/net/core/dev.c b/net/core/dev.c
1103 +index 3810eaf89b266..e4e492bf72af0 100644
1104 +--- a/net/core/dev.c
1105 ++++ b/net/core/dev.c
1106 +@@ -2787,6 +2787,12 @@ static u16 skb_tx_hash(const struct net_device *dev,
1107 +
1108 + qoffset = sb_dev->tc_to_txq[tc].offset;
1109 + qcount = sb_dev->tc_to_txq[tc].count;
1110 ++ if (unlikely(!qcount)) {
1111 ++ net_warn_ratelimited("%s: invalid qcount, qoffset %u for tc %u\n",
1112 ++ sb_dev->name, qoffset, tc);
1113 ++ qoffset = 0;
1114 ++ qcount = dev->real_num_tx_queues;
1115 ++ }
1116 + }
1117 +
1118 + if (skb_rx_queue_recorded(skb)) {
1119 +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
1120 +index a53b101ce41ae..55c0f32b9375b 100644
1121 +--- a/net/core/rtnetlink.c
1122 ++++ b/net/core/rtnetlink.c
1123 +@@ -3729,7 +3729,7 @@ static int rtnl_fdb_add(struct sk_buff *skb, struct nlmsghdr *nlh,
1124 +
1125 + /* Support fdb on master device the net/bridge default case */
1126 + if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) &&
1127 +- (dev->priv_flags & IFF_BRIDGE_PORT)) {
1128 ++ netif_is_bridge_port(dev)) {
1129 + struct net_device *br_dev = netdev_master_upper_dev_get(dev);
1130 + const struct net_device_ops *ops = br_dev->netdev_ops;
1131 +
1132 +@@ -3840,7 +3840,7 @@ static int rtnl_fdb_del(struct sk_buff *skb, struct nlmsghdr *nlh,
1133 +
1134 + /* Support fdb on master device the net/bridge default case */
1135 + if ((!ndm->ndm_flags || ndm->ndm_flags & NTF_MASTER) &&
1136 +- (dev->priv_flags & IFF_BRIDGE_PORT)) {
1137 ++ netif_is_bridge_port(dev)) {
1138 + struct net_device *br_dev = netdev_master_upper_dev_get(dev);
1139 + const struct net_device_ops *ops = br_dev->netdev_ops;
1140 +
1141 +@@ -4066,13 +4066,13 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
1142 + continue;
1143 +
1144 + if (!br_idx) { /* user did not specify a specific bridge */
1145 +- if (dev->priv_flags & IFF_BRIDGE_PORT) {
1146 ++ if (netif_is_bridge_port(dev)) {
1147 + br_dev = netdev_master_upper_dev_get(dev);
1148 + cops = br_dev->netdev_ops;
1149 + }
1150 + } else {
1151 + if (dev != br_dev &&
1152 +- !(dev->priv_flags & IFF_BRIDGE_PORT))
1153 ++ !netif_is_bridge_port(dev))
1154 + continue;
1155 +
1156 + if (br_dev != netdev_master_upper_dev_get(dev) &&
1157 +@@ -4084,7 +4084,7 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
1158 + if (idx < s_idx)
1159 + goto cont;
1160 +
1161 +- if (dev->priv_flags & IFF_BRIDGE_PORT) {
1162 ++ if (netif_is_bridge_port(dev)) {
1163 + if (cops && cops->ndo_fdb_dump) {
1164 + err = cops->ndo_fdb_dump(skb, cb,
1165 + br_dev, dev,
1166 +@@ -4234,7 +4234,7 @@ static int rtnl_fdb_get(struct sk_buff *in_skb, struct nlmsghdr *nlh,
1167 +
1168 + if (dev) {
1169 + if (!ndm_flags || (ndm_flags & NTF_MASTER)) {
1170 +- if (!(dev->priv_flags & IFF_BRIDGE_PORT)) {
1171 ++ if (!netif_is_bridge_port(dev)) {
1172 + NL_SET_ERR_MSG(extack, "Device is not a bridge port");
1173 + return -EINVAL;
1174 + }
1175 +diff --git a/net/ipv4/route.c b/net/ipv4/route.c
1176 +index 539492998864e..d1feec97fa062 100644
1177 +--- a/net/ipv4/route.c
1178 ++++ b/net/ipv4/route.c
1179 +@@ -631,14 +631,14 @@ static void fnhe_remove_oldest(struct fnhe_hash_bucket *hash)
1180 + kfree_rcu(oldest, rcu);
1181 + }
1182 +
1183 +-static inline u32 fnhe_hashfun(__be32 daddr)
1184 ++static u32 fnhe_hashfun(__be32 daddr)
1185 + {
1186 +- static u32 fnhe_hashrnd __read_mostly;
1187 +- u32 hval;
1188 ++ static siphash_key_t fnhe_hash_key __read_mostly;
1189 ++ u64 hval;
1190 +
1191 +- net_get_random_once(&fnhe_hashrnd, sizeof(fnhe_hashrnd));
1192 +- hval = jhash_1word((__force u32) daddr, fnhe_hashrnd);
1193 +- return hash_32(hval, FNHE_HASH_SHIFT);
1194 ++ net_get_random_once(&fnhe_hash_key, sizeof(fnhe_hash_key));
1195 ++ hval = siphash_1u32((__force u32)daddr, &fnhe_hash_key);
1196 ++ return hash_64(hval, FNHE_HASH_SHIFT);
1197 + }
1198 +
1199 + static void fill_route_from_fnhe(struct rtable *rt, struct fib_nh_exception *fnhe)
1200 +diff --git a/net/ipv4/tcp_bpf.c b/net/ipv4/tcp_bpf.c
1201 +index 6a0c4326d9cf2..7df7ec74807ac 100644
1202 +--- a/net/ipv4/tcp_bpf.c
1203 ++++ b/net/ipv4/tcp_bpf.c
1204 +@@ -313,6 +313,7 @@ static int tcp_bpf_send_verdict(struct sock *sk, struct sk_psock *psock,
1205 + bool cork = false, enospc = sk_msg_full(msg);
1206 + struct sock *sk_redir;
1207 + u32 tosend, delta = 0;
1208 ++ u32 eval = __SK_NONE;
1209 + int ret;
1210 +
1211 + more_data:
1212 +@@ -356,13 +357,24 @@ more_data:
1213 + case __SK_REDIRECT:
1214 + sk_redir = psock->sk_redir;
1215 + sk_msg_apply_bytes(psock, tosend);
1216 ++ if (!psock->apply_bytes) {
1217 ++ /* Clean up before releasing the sock lock. */
1218 ++ eval = psock->eval;
1219 ++ psock->eval = __SK_NONE;
1220 ++ psock->sk_redir = NULL;
1221 ++ }
1222 + if (psock->cork) {
1223 + cork = true;
1224 + psock->cork = NULL;
1225 + }
1226 + sk_msg_return(sk, msg, tosend);
1227 + release_sock(sk);
1228 ++
1229 + ret = tcp_bpf_sendmsg_redir(sk_redir, msg, tosend, flags);
1230 ++
1231 ++ if (eval == __SK_REDIRECT)
1232 ++ sock_put(sk_redir);
1233 ++
1234 + lock_sock(sk);
1235 + if (unlikely(ret < 0)) {
1236 + int free = sk_msg_free_nocharge(sk, msg);
1237 +diff --git a/net/ipv6/route.c b/net/ipv6/route.c
1238 +index 3fb259c20546e..daa876c6ae8db 100644
1239 +--- a/net/ipv6/route.c
1240 ++++ b/net/ipv6/route.c
1241 +@@ -41,6 +41,7 @@
1242 + #include <linux/nsproxy.h>
1243 + #include <linux/slab.h>
1244 + #include <linux/jhash.h>
1245 ++#include <linux/siphash.h>
1246 + #include <net/net_namespace.h>
1247 + #include <net/snmp.h>
1248 + #include <net/ipv6.h>
1249 +@@ -1502,17 +1503,24 @@ static void rt6_exception_remove_oldest(struct rt6_exception_bucket *bucket)
1250 + static u32 rt6_exception_hash(const struct in6_addr *dst,
1251 + const struct in6_addr *src)
1252 + {
1253 +- static u32 seed __read_mostly;
1254 +- u32 val;
1255 ++ static siphash_key_t rt6_exception_key __read_mostly;
1256 ++ struct {
1257 ++ struct in6_addr dst;
1258 ++ struct in6_addr src;
1259 ++ } __aligned(SIPHASH_ALIGNMENT) combined = {
1260 ++ .dst = *dst,
1261 ++ };
1262 ++ u64 val;
1263 +
1264 +- net_get_random_once(&seed, sizeof(seed));
1265 +- val = jhash(dst, sizeof(*dst), seed);
1266 ++ net_get_random_once(&rt6_exception_key, sizeof(rt6_exception_key));
1267 +
1268 + #ifdef CONFIG_IPV6_SUBTREES
1269 + if (src)
1270 +- val = jhash(src, sizeof(*src), val);
1271 ++ combined.src = *src;
1272 + #endif
1273 +- return hash_32(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
1274 ++ val = siphash(&combined, sizeof(combined), &rt6_exception_key);
1275 ++
1276 ++ return hash_64(val, FIB6_EXCEPTION_BUCKET_SIZE_SHIFT);
1277 + }
1278 +
1279 + /* Helper function to find the cached rt in the hash table
1280 +diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
1281 +index 82a202d71a31e..7c6dcbc8e98ba 100644
1282 +--- a/net/sctp/sm_statefuns.c
1283 ++++ b/net/sctp/sm_statefuns.c
1284 +@@ -697,6 +697,9 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
1285 + struct sock *sk;
1286 + int error = 0;
1287 +
1288 ++ if (asoc && !sctp_vtag_verify(chunk, asoc))
1289 ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1290 ++
1291 + /* If the packet is an OOTB packet which is temporarily on the
1292 + * control endpoint, respond with an ABORT.
1293 + */
1294 +@@ -711,7 +714,8 @@ enum sctp_disposition sctp_sf_do_5_1D_ce(struct net *net,
1295 + * in sctp_unpack_cookie().
1296 + */
1297 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
1298 +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1299 ++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1300 ++ commands);
1301 +
1302 + /* If the endpoint is not listening or if the number of associations
1303 + * on the TCP-style socket exceed the max backlog, respond with an
1304 +@@ -2141,9 +2145,11 @@ enum sctp_disposition sctp_sf_do_5_2_4_dupcook(
1305 + * enough for the chunk header. Cookie length verification is
1306 + * done later.
1307 + */
1308 +- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
1309 +- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1310 +- commands);
1311 ++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr))) {
1312 ++ if (!sctp_vtag_verify(chunk, asoc))
1313 ++ asoc = NULL;
1314 ++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg, commands);
1315 ++ }
1316 +
1317 + /* "Decode" the chunk. We have no optional parameters so we
1318 + * are in good shape.
1319 +@@ -2280,7 +2286,7 @@ enum sctp_disposition sctp_sf_shutdown_pending_abort(
1320 + */
1321 + if (SCTP_ADDR_DEL ==
1322 + sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
1323 +- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1324 ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1325 +
1326 + if (!sctp_err_chunk_valid(chunk))
1327 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1328 +@@ -2326,7 +2332,7 @@ enum sctp_disposition sctp_sf_shutdown_sent_abort(
1329 + */
1330 + if (SCTP_ADDR_DEL ==
1331 + sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
1332 +- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1333 ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1334 +
1335 + if (!sctp_err_chunk_valid(chunk))
1336 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1337 +@@ -2596,7 +2602,7 @@ enum sctp_disposition sctp_sf_do_9_1_abort(
1338 + */
1339 + if (SCTP_ADDR_DEL ==
1340 + sctp_bind_addr_state(&asoc->base.bind_addr, &chunk->dest))
1341 +- return sctp_sf_discard_chunk(net, ep, asoc, type, arg, commands);
1342 ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1343 +
1344 + if (!sctp_err_chunk_valid(chunk))
1345 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1346 +@@ -3562,6 +3568,9 @@ enum sctp_disposition sctp_sf_ootb(struct net *net,
1347 +
1348 + SCTP_INC_STATS(net, SCTP_MIB_OUTOFBLUES);
1349 +
1350 ++ if (asoc && !sctp_vtag_verify(chunk, asoc))
1351 ++ asoc = NULL;
1352 ++
1353 + ch = (struct sctp_chunkhdr *)chunk->chunk_hdr;
1354 + do {
1355 + /* Report violation if the chunk is less then minimal */
1356 +@@ -3677,12 +3686,6 @@ static enum sctp_disposition sctp_sf_shut_8_4_5(
1357 +
1358 + SCTP_INC_STATS(net, SCTP_MIB_OUTCTRLCHUNKS);
1359 +
1360 +- /* If the chunk length is invalid, we don't want to process
1361 +- * the reset of the packet.
1362 +- */
1363 +- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
1364 +- return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1365 +-
1366 + /* We need to discard the rest of the packet to prevent
1367 + * potential bomming attacks from additional bundled chunks.
1368 + * This is documented in SCTP Threats ID.
1369 +@@ -3710,6 +3713,9 @@ enum sctp_disposition sctp_sf_do_8_5_1_E_sa(struct net *net,
1370 + {
1371 + struct sctp_chunk *chunk = arg;
1372 +
1373 ++ if (!sctp_vtag_verify(chunk, asoc))
1374 ++ asoc = NULL;
1375 ++
1376 + /* Make sure that the SHUTDOWN_ACK chunk has a valid length. */
1377 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
1378 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1379 +@@ -3745,6 +3751,11 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
1380 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1381 + }
1382 +
1383 ++ /* Make sure that the ASCONF ADDIP chunk has a valid length. */
1384 ++ if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
1385 ++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1386 ++ commands);
1387 ++
1388 + /* ADD-IP: Section 4.1.1
1389 + * This chunk MUST be sent in an authenticated way by using
1390 + * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
1391 +@@ -3753,13 +3764,7 @@ enum sctp_disposition sctp_sf_do_asconf(struct net *net,
1392 + */
1393 + if (!asoc->peer.asconf_capable ||
1394 + (!net->sctp.addip_noauth && !chunk->auth))
1395 +- return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
1396 +- commands);
1397 +-
1398 +- /* Make sure that the ASCONF ADDIP chunk has a valid length. */
1399 +- if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_addip_chunk)))
1400 +- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1401 +- commands);
1402 ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1403 +
1404 + hdr = (struct sctp_addiphdr *)chunk->skb->data;
1405 + serial = ntohl(hdr->serial);
1406 +@@ -3888,6 +3893,12 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
1407 + return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1408 + }
1409 +
1410 ++ /* Make sure that the ADDIP chunk has a valid length. */
1411 ++ if (!sctp_chunk_length_valid(asconf_ack,
1412 ++ sizeof(struct sctp_addip_chunk)))
1413 ++ return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1414 ++ commands);
1415 ++
1416 + /* ADD-IP, Section 4.1.2:
1417 + * This chunk MUST be sent in an authenticated way by using
1418 + * the mechanism defined in [I-D.ietf-tsvwg-sctp-auth]. If this chunk
1419 +@@ -3896,14 +3907,7 @@ enum sctp_disposition sctp_sf_do_asconf_ack(struct net *net,
1420 + */
1421 + if (!asoc->peer.asconf_capable ||
1422 + (!net->sctp.addip_noauth && !asconf_ack->auth))
1423 +- return sctp_sf_discard_chunk(net, ep, asoc, type, arg,
1424 +- commands);
1425 +-
1426 +- /* Make sure that the ADDIP chunk has a valid length. */
1427 +- if (!sctp_chunk_length_valid(asconf_ack,
1428 +- sizeof(struct sctp_addip_chunk)))
1429 +- return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1430 +- commands);
1431 ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1432 +
1433 + addip_hdr = (struct sctp_addiphdr *)asconf_ack->skb->data;
1434 + rcvd_serial = ntohl(addip_hdr->serial);
1435 +@@ -4475,6 +4479,9 @@ enum sctp_disposition sctp_sf_discard_chunk(struct net *net,
1436 + {
1437 + struct sctp_chunk *chunk = arg;
1438 +
1439 ++ if (asoc && !sctp_vtag_verify(chunk, asoc))
1440 ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1441 ++
1442 + /* Make sure that the chunk has a valid length.
1443 + * Since we don't know the chunk type, we use a general
1444 + * chunkhdr structure to make a comparison.
1445 +@@ -4542,6 +4549,9 @@ enum sctp_disposition sctp_sf_violation(struct net *net,
1446 + {
1447 + struct sctp_chunk *chunk = arg;
1448 +
1449 ++ if (!sctp_vtag_verify(chunk, asoc))
1450 ++ return sctp_sf_pdiscard(net, ep, asoc, type, arg, commands);
1451 ++
1452 + /* Make sure that the chunk has a valid length. */
1453 + if (!sctp_chunk_length_valid(chunk, sizeof(struct sctp_chunkhdr)))
1454 + return sctp_sf_violation_chunklen(net, ep, asoc, type, arg,
1455 +@@ -6248,6 +6258,7 @@ static struct sctp_packet *sctp_ootb_pkt_new(
1456 + * yet.
1457 + */
1458 + switch (chunk->chunk_hdr->type) {
1459 ++ case SCTP_CID_INIT:
1460 + case SCTP_CID_INIT_ACK:
1461 + {
1462 + struct sctp_initack_chunk *initack;
1463 +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
1464 +index 7fb5c067f4293..02821b9140546 100644
1465 +--- a/net/tls/tls_sw.c
1466 ++++ b/net/tls/tls_sw.c
1467 +@@ -35,6 +35,7 @@
1468 + * SOFTWARE.
1469 + */
1470 +
1471 ++#include <linux/bug.h>
1472 + #include <linux/sched/signal.h>
1473 + #include <linux/module.h>
1474 + #include <linux/splice.h>
1475 +@@ -43,6 +44,14 @@
1476 + #include <net/strparser.h>
1477 + #include <net/tls.h>
1478 +
1479 ++noinline void tls_err_abort(struct sock *sk, int err)
1480 ++{
1481 ++ WARN_ON_ONCE(err >= 0);
1482 ++ /* sk->sk_err should contain a positive error code. */
1483 ++ sk->sk_err = -err;
1484 ++ sk->sk_error_report(sk);
1485 ++}
1486 ++
1487 + static int __skb_nsg(struct sk_buff *skb, int offset, int len,
1488 + unsigned int recursion_level)
1489 + {
1490 +@@ -416,7 +425,7 @@ int tls_tx_records(struct sock *sk, int flags)
1491 +
1492 + tx_err:
1493 + if (rc < 0 && rc != -EAGAIN)
1494 +- tls_err_abort(sk, EBADMSG);
1495 ++ tls_err_abort(sk, -EBADMSG);
1496 +
1497 + return rc;
1498 + }
1499 +@@ -447,7 +456,7 @@ static void tls_encrypt_done(struct crypto_async_request *req, int err)
1500 +
1501 + /* If err is already set on socket, return the same code */
1502 + if (sk->sk_err) {
1503 +- ctx->async_wait.err = sk->sk_err;
1504 ++ ctx->async_wait.err = -sk->sk_err;
1505 + } else {
1506 + ctx->async_wait.err = err;
1507 + tls_err_abort(sk, err);
1508 +@@ -761,7 +770,7 @@ static int tls_push_record(struct sock *sk, int flags,
1509 + msg_pl->sg.size + prot->tail_size, i);
1510 + if (rc < 0) {
1511 + if (rc != -EINPROGRESS) {
1512 +- tls_err_abort(sk, EBADMSG);
1513 ++ tls_err_abort(sk, -EBADMSG);
1514 + if (split) {
1515 + tls_ctx->pending_open_record_frags = true;
1516 + tls_merge_open_record(sk, rec, tmp, orig_end);
1517 +@@ -1822,7 +1831,7 @@ int tls_sw_recvmsg(struct sock *sk,
1518 + err = decrypt_skb_update(sk, skb, &msg->msg_iter,
1519 + &chunk, &zc, async_capable);
1520 + if (err < 0 && err != -EINPROGRESS) {
1521 +- tls_err_abort(sk, EBADMSG);
1522 ++ tls_err_abort(sk, -EBADMSG);
1523 + goto recv_end;
1524 + }
1525 +
1526 +@@ -2002,7 +2011,7 @@ ssize_t tls_sw_splice_read(struct socket *sock, loff_t *ppos,
1527 + }
1528 +
1529 + if (err < 0) {
1530 +- tls_err_abort(sk, EBADMSG);
1531 ++ tls_err_abort(sk, -EBADMSG);
1532 + goto splice_read_end;
1533 + }
1534 + ctx->decrypted = true;
1535 +diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
1536 +index 7b170ed6923e7..7633d6a74bc2b 100644
1537 +--- a/net/wireless/nl80211.c
1538 ++++ b/net/wireless/nl80211.c
1539 +@@ -3480,7 +3480,7 @@ static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
1540 + enum nl80211_iftype iftype)
1541 + {
1542 + if (!use_4addr) {
1543 +- if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
1544 ++ if (netdev && netif_is_bridge_port(netdev))
1545 + return -EBUSY;
1546 + return 0;
1547 + }
1548 +diff --git a/net/wireless/scan.c b/net/wireless/scan.c
1549 +index 1580535d53f86..6cefaad3b7f84 100644
1550 +--- a/net/wireless/scan.c
1551 ++++ b/net/wireless/scan.c
1552 +@@ -379,14 +379,17 @@ cfg80211_add_nontrans_list(struct cfg80211_bss *trans_bss,
1553 + }
1554 + ssid_len = ssid[1];
1555 + ssid = ssid + 2;
1556 +- rcu_read_unlock();
1557 +
1558 + /* check if nontrans_bss is in the list */
1559 + list_for_each_entry(bss, &trans_bss->nontrans_list, nontrans_list) {
1560 +- if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len))
1561 ++ if (is_bss(bss, nontrans_bss->bssid, ssid, ssid_len)) {
1562 ++ rcu_read_unlock();
1563 + return 0;
1564 ++ }
1565 + }
1566 +
1567 ++ rcu_read_unlock();
1568 ++
1569 + /* add to the list */
1570 + list_add_tail(&nontrans_bss->nontrans_list, &trans_bss->nontrans_list);
1571 + return 0;
1572 +diff --git a/net/wireless/util.c b/net/wireless/util.c
1573 +index f0247eab5bc94..aaefaf3422a1a 100644
1574 +--- a/net/wireless/util.c
1575 ++++ b/net/wireless/util.c
1576 +@@ -975,14 +975,14 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
1577 + !(rdev->wiphy.interface_modes & (1 << ntype)))
1578 + return -EOPNOTSUPP;
1579 +
1580 +- /* if it's part of a bridge, reject changing type to station/ibss */
1581 +- if ((dev->priv_flags & IFF_BRIDGE_PORT) &&
1582 +- (ntype == NL80211_IFTYPE_ADHOC ||
1583 +- ntype == NL80211_IFTYPE_STATION ||
1584 +- ntype == NL80211_IFTYPE_P2P_CLIENT))
1585 +- return -EBUSY;
1586 +-
1587 + if (ntype != otype) {
1588 ++ /* if it's part of a bridge, reject changing type to station/ibss */
1589 ++ if (netif_is_bridge_port(dev) &&
1590 ++ (ntype == NL80211_IFTYPE_ADHOC ||
1591 ++ ntype == NL80211_IFTYPE_STATION ||
1592 ++ ntype == NL80211_IFTYPE_P2P_CLIENT))
1593 ++ return -EBUSY;
1594 ++
1595 + dev->ieee80211_ptr->use_4addr = false;
1596 + dev->ieee80211_ptr->mesh_id_up_len = 0;
1597 + wdev_lock(dev->ieee80211_ptr);
1598 +diff --git a/tools/perf/builtin-script.c b/tools/perf/builtin-script.c
1599 +index f3ff825d9dd33..3a169a026635d 100644
1600 +--- a/tools/perf/builtin-script.c
1601 ++++ b/tools/perf/builtin-script.c
1602 +@@ -3779,11 +3779,15 @@ int cmd_script(int argc, const char **argv)
1603 + goto out_delete;
1604 +
1605 + uname(&uts);
1606 +- if (data.is_pipe || /* assume pipe_mode indicates native_arch */
1607 +- !strcmp(uts.machine, session->header.env.arch) ||
1608 +- (!strcmp(uts.machine, "x86_64") &&
1609 +- !strcmp(session->header.env.arch, "i386")))
1610 ++ if (data.is_pipe) { /* Assume pipe_mode indicates native_arch */
1611 + native_arch = true;
1612 ++ } else if (session->header.env.arch) {
1613 ++ if (!strcmp(uts.machine, session->header.env.arch))
1614 ++ native_arch = true;
1615 ++ else if (!strcmp(uts.machine, "x86_64") &&
1616 ++ !strcmp(session->header.env.arch, "i386"))
1617 ++ native_arch = true;
1618 ++ }
1619 +
1620 + script.session = session;
1621 + script__setup_sample_type(&script);