diff --git a/patch/kernel/mvebu-default/03-patch-4.4.47-48.patch b/patch/kernel/mvebu-default/03-patch-4.4.47-48.patch deleted file mode 100644 index baf0a0010..000000000 --- a/patch/kernel/mvebu-default/03-patch-4.4.47-48.patch +++ /dev/null @@ -1,1022 +0,0 @@ -diff --git a/Makefile b/Makefile -index 7b233ac7f86c..0793cd412656 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 47 -+SUBLEVEL = 48 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm64/crypto/aes-modes.S b/arch/arm64/crypto/aes-modes.S -index c53dbeae79f2..838dad5c209f 100644 ---- a/arch/arm64/crypto/aes-modes.S -+++ b/arch/arm64/crypto/aes-modes.S -@@ -193,15 +193,16 @@ AES_ENTRY(aes_cbc_encrypt) - cbz w6, .Lcbcencloop - - ld1 {v0.16b}, [x5] /* get iv */ -- enc_prepare w3, x2, x5 -+ enc_prepare w3, x2, x6 - - .Lcbcencloop: - ld1 {v1.16b}, [x1], #16 /* get next pt block */ - eor v0.16b, v0.16b, v1.16b /* ..and xor with iv */ -- encrypt_block v0, w3, x2, x5, w6 -+ encrypt_block v0, w3, x2, x6, w7 - st1 {v0.16b}, [x0], #16 - subs w4, w4, #1 - bne .Lcbcencloop -+ st1 {v0.16b}, [x5] /* return iv */ - ret - AES_ENDPROC(aes_cbc_encrypt) - -@@ -211,7 +212,7 @@ AES_ENTRY(aes_cbc_decrypt) - cbz w6, .LcbcdecloopNx - - ld1 {v7.16b}, [x5] /* get iv */ -- dec_prepare w3, x2, x5 -+ dec_prepare w3, x2, x6 - - .LcbcdecloopNx: - #if INTERLEAVE >= 2 -@@ -248,7 +249,7 @@ AES_ENTRY(aes_cbc_decrypt) - .Lcbcdecloop: - ld1 {v1.16b}, [x1], #16 /* get next ct block */ - mov v0.16b, v1.16b /* ...and copy to v0 */ -- decrypt_block v0, w3, x2, x5, w6 -+ decrypt_block v0, w3, x2, x6, w7 - eor v0.16b, v0.16b, v7.16b /* xor with iv => pt */ - mov v7.16b, v1.16b /* ct is next iv */ - st1 {v0.16b}, [x0], #16 -@@ -256,6 +257,7 @@ AES_ENTRY(aes_cbc_decrypt) - bne .Lcbcdecloop - .Lcbcdecout: - FRAME_POP -+ st1 {v7.16b}, [x5] /* return iv */ - ret - AES_ENDPROC(aes_cbc_decrypt) - -@@ -267,24 +269,15 @@ AES_ENDPROC(aes_cbc_decrypt) - - AES_ENTRY(aes_ctr_encrypt) - FRAME_PUSH -- cbnz w6, .Lctrfirst /* 1st time around? */ -- umov x5, v4.d[1] /* keep swabbed ctr in reg */ -- rev x5, x5 --#if INTERLEAVE >= 2 -- cmn w5, w4 /* 32 bit overflow? */ -- bcs .Lctrinc -- add x5, x5, #1 /* increment BE ctr */ -- b .LctrincNx --#else -- b .Lctrinc --#endif --.Lctrfirst: -+ cbz w6, .Lctrnotfirst /* 1st time around? */ - enc_prepare w3, x2, x6 - ld1 {v4.16b}, [x5] -- umov x5, v4.d[1] /* keep swabbed ctr in reg */ -- rev x5, x5 -+ -+.Lctrnotfirst: -+ umov x8, v4.d[1] /* keep swabbed ctr in reg */ -+ rev x8, x8 - #if INTERLEAVE >= 2 -- cmn w5, w4 /* 32 bit overflow? */ -+ cmn w8, w4 /* 32 bit overflow? */ - bcs .Lctrloop - .LctrloopNx: - subs w4, w4, #INTERLEAVE -@@ -292,11 +285,11 @@ AES_ENTRY(aes_ctr_encrypt) - #if INTERLEAVE == 2 - mov v0.8b, v4.8b - mov v1.8b, v4.8b -- rev x7, x5 -- add x5, x5, #1 -+ rev x7, x8 -+ add x8, x8, #1 - ins v0.d[1], x7 -- rev x7, x5 -- add x5, x5, #1 -+ rev x7, x8 -+ add x8, x8, #1 - ins v1.d[1], x7 - ld1 {v2.16b-v3.16b}, [x1], #32 /* get 2 input blocks */ - do_encrypt_block2x -@@ -305,7 +298,7 @@ AES_ENTRY(aes_ctr_encrypt) - st1 {v0.16b-v1.16b}, [x0], #32 - #else - ldr q8, =0x30000000200000001 /* addends 1,2,3[,0] */ -- dup v7.4s, w5 -+ dup v7.4s, w8 - mov v0.16b, v4.16b - add v7.4s, v7.4s, v8.4s - mov v1.16b, v4.16b -@@ -323,18 +316,12 @@ AES_ENTRY(aes_ctr_encrypt) - eor v2.16b, v7.16b, v2.16b - eor v3.16b, v5.16b, v3.16b - st1 {v0.16b-v3.16b}, [x0], #64 -- add x5, x5, #INTERLEAVE -+ add x8, x8, #INTERLEAVE - #endif -- cbz w4, .LctroutNx --.LctrincNx: -- rev x7, x5 -+ rev x7, x8 - ins v4.d[1], x7 -+ cbz w4, .Lctrout - b .LctrloopNx --.LctroutNx: -- sub x5, x5, #1 -- rev x7, x5 -- ins v4.d[1], x7 -- b .Lctrout - .Lctr1x: - adds w4, w4, #INTERLEAVE - beq .Lctrout -@@ -342,30 +329,39 @@ AES_ENTRY(aes_ctr_encrypt) - .Lctrloop: - mov v0.16b, v4.16b - encrypt_block v0, w3, x2, x6, w7 -+ -+ adds x8, x8, #1 /* increment BE ctr */ -+ rev x7, x8 -+ ins v4.d[1], x7 -+ bcs .Lctrcarry /* overflow? */ -+ -+.Lctrcarrydone: - subs w4, w4, #1 - bmi .Lctrhalfblock /* blocks < 0 means 1/2 block */ - ld1 {v3.16b}, [x1], #16 - eor v3.16b, v0.16b, v3.16b - st1 {v3.16b}, [x0], #16 -- beq .Lctrout --.Lctrinc: -- adds x5, x5, #1 /* increment BE ctr */ -- rev x7, x5 -- ins v4.d[1], x7 -- bcc .Lctrloop /* no overflow? */ -- umov x7, v4.d[0] /* load upper word of ctr */ -- rev x7, x7 /* ... to handle the carry */ -- add x7, x7, #1 -- rev x7, x7 -- ins v4.d[0], x7 -- b .Lctrloop -+ bne .Lctrloop -+ -+.Lctrout: -+ st1 {v4.16b}, [x5] /* return next CTR value */ -+ FRAME_POP -+ ret -+ - .Lctrhalfblock: - ld1 {v3.8b}, [x1] - eor v3.8b, v0.8b, v3.8b - st1 {v3.8b}, [x0] --.Lctrout: - FRAME_POP - ret -+ -+.Lctrcarry: -+ umov x7, v4.d[0] /* load upper word of ctr */ -+ rev x7, x7 /* ... to handle the carry */ -+ add x7, x7, #1 -+ rev x7, x7 -+ ins v4.d[0], x7 -+ b .Lctrcarrydone - AES_ENDPROC(aes_ctr_encrypt) - .ltorg - -diff --git a/arch/powerpc/kernel/eeh_driver.c b/arch/powerpc/kernel/eeh_driver.c -index 300382e5a2cc..c314db8b798c 100644 ---- a/arch/powerpc/kernel/eeh_driver.c -+++ b/arch/powerpc/kernel/eeh_driver.c -@@ -485,7 +485,7 @@ static void *eeh_pe_detach_dev(void *data, void *userdata) - static void *__eeh_clear_pe_frozen_state(void *data, void *flag) - { - struct eeh_pe *pe = (struct eeh_pe *)data; -- bool *clear_sw_state = flag; -+ bool clear_sw_state = *(bool *)flag; - int i, rc = 1; - - for (i = 0; rc && i < 3; i++) -diff --git a/arch/powerpc/kernel/prom_init.c b/arch/powerpc/kernel/prom_init.c -index 7b89e7b305e6..3139533640fc 100644 ---- a/arch/powerpc/kernel/prom_init.c -+++ b/arch/powerpc/kernel/prom_init.c -@@ -2664,6 +2664,9 @@ static void __init prom_find_boot_cpu(void) - - cpu_pkg = call_prom("instance-to-package", 1, 1, prom_cpu); - -+ if (!PHANDLE_VALID(cpu_pkg)) -+ return; -+ - prom_getprop(cpu_pkg, "reg", &rval, sizeof(rval)); - prom.cpu = be32_to_cpu(rval); - -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index aaacbd667212..1e5d2f07416b 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -2117,6 +2117,7 @@ static inline void __init check_timer(void) - if (idx != -1 && irq_trigger(idx)) - unmask_ioapic_irq(irq_get_chip_data(0)); - } -+ irq_domain_deactivate_irq(irq_data); - irq_domain_activate_irq(irq_data); - if (timer_irq_works()) { - if (disable_timer_pin_1 > 0) -@@ -2138,6 +2139,7 @@ static inline void __init check_timer(void) - * legacy devices should be connected to IO APIC #0 - */ - replace_pin_at_irq_node(data, node, apic1, pin1, apic2, pin2); -+ irq_domain_deactivate_irq(irq_data); - irq_domain_activate_irq(irq_data); - legacy_pic->unmask(0); - if (timer_irq_works()) { -diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c -index b8e6ff5cd5d0..acc9b8f19ca8 100644 ---- a/arch/x86/kernel/hpet.c -+++ b/arch/x86/kernel/hpet.c -@@ -351,6 +351,7 @@ static int hpet_resume(struct clock_event_device *evt, int timer) - } else { - struct hpet_dev *hdev = EVT_TO_HPET_DEV(evt); - -+ irq_domain_deactivate_irq(irq_get_irq_data(hdev->irq)); - irq_domain_activate_irq(irq_get_irq_data(hdev->irq)); - disable_irq(hdev->irq); - irq_set_affinity(hdev->irq, cpumask_of(hdev->cpu)); -diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c -index 25a6efcfdf7f..e75095fa414e 100644 ---- a/arch/x86/kvm/x86.c -+++ b/arch/x86/kvm/x86.c -@@ -3057,6 +3057,7 @@ static void fill_xsave(u8 *dest, struct kvm_vcpu *vcpu) - memcpy(dest, xsave, XSAVE_HDR_OFFSET); - - /* Set XSTATE_BV */ -+ xstate_bv &= vcpu->arch.guest_supported_xcr0 | XFEATURE_MASK_FPSSE; - *(u64 *)(dest + XSAVE_HDR_OFFSET) = xstate_bv; - - /* -diff --git a/crypto/algapi.c b/crypto/algapi.c -index 59bf491fe3d8..43f5bdb6b570 100644 ---- a/crypto/algapi.c -+++ b/crypto/algapi.c -@@ -357,6 +357,7 @@ int crypto_register_alg(struct crypto_alg *alg) - struct crypto_larval *larval; - int err; - -+ alg->cra_flags &= ~CRYPTO_ALG_DEAD; - err = crypto_check_alg(alg); - if (err) - return err; -diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c -index bd370c98f77d..b0b77b61c40c 100644 ---- a/drivers/ata/libata-core.c -+++ b/drivers/ata/libata-core.c -@@ -4139,10 +4139,10 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = { - { "ST380013AS", "3.20", ATA_HORKAGE_MAX_SEC_1024 }, - - /* -- * Device times out with higher max sects. -+ * These devices time out with higher max sects. - * https://bugzilla.kernel.org/show_bug.cgi?id=121671 - */ -- { "LITEON CX1-JB256-HP", NULL, ATA_HORKAGE_MAX_SEC_1024 }, -+ { "LITEON CX1-JB*-HP", NULL, ATA_HORKAGE_MAX_SEC_1024 }, - - /* Devices we expect to fail diagnostics */ - -diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c -index bd74ee555278..729f26322095 100644 ---- a/drivers/ata/sata_mv.c -+++ b/drivers/ata/sata_mv.c -@@ -4121,6 +4121,9 @@ static int mv_platform_probe(struct platform_device *pdev) - host->iomap = NULL; - hpriv->base = devm_ioremap(&pdev->dev, res->start, - resource_size(res)); -+ if (!hpriv->base) -+ return -ENOMEM; -+ - hpriv->base -= SATAHC0_REG_BASE; - - hpriv->clk = clk_get(&pdev->dev, NULL); -diff --git a/drivers/base/memory.c b/drivers/base/memory.c -index 25425d3f2575..48c0a1d0dd3a 100644 ---- a/drivers/base/memory.c -+++ b/drivers/base/memory.c -@@ -388,30 +388,29 @@ static ssize_t show_valid_zones(struct device *dev, - { - struct memory_block *mem = to_memory_block(dev); - unsigned long start_pfn, end_pfn; -+ unsigned long valid_start, valid_end; - unsigned long nr_pages = PAGES_PER_SECTION * sections_per_block; -- struct page *first_page; - struct zone *zone; - - start_pfn = section_nr_to_pfn(mem->start_section_nr); - end_pfn = start_pfn + nr_pages; -- first_page = pfn_to_page(start_pfn); - - /* The block contains more than one zone can not be offlined. */ -- if (!test_pages_in_a_zone(start_pfn, end_pfn)) -+ if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end)) - return sprintf(buf, "none\n"); - -- zone = page_zone(first_page); -+ zone = page_zone(pfn_to_page(valid_start)); - - if (zone_idx(zone) == ZONE_MOVABLE - 1) { - /*The mem block is the last memoryblock of this zone.*/ -- if (end_pfn == zone_end_pfn(zone)) -+ if (valid_end == zone_end_pfn(zone)) - return sprintf(buf, "%s %s\n", - zone->name, (zone + 1)->name); - } - - if (zone_idx(zone) == ZONE_MOVABLE) { - /*The mem block is the first memoryblock of ZONE_MOVABLE.*/ -- if (start_pfn == zone->zone_start_pfn) -+ if (valid_start == zone->zone_start_pfn) - return sprintf(buf, "%s %s\n", - zone->name, (zone - 1)->name); - } -diff --git a/drivers/gpu/drm/nouveau/dispnv04/hw.c b/drivers/gpu/drm/nouveau/dispnv04/hw.c -index 956a833b8200..57c7389feee4 100644 ---- a/drivers/gpu/drm/nouveau/dispnv04/hw.c -+++ b/drivers/gpu/drm/nouveau/dispnv04/hw.c -@@ -222,6 +222,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype) - uint32_t mpllP; - - pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP); -+ mpllP = (mpllP >> 8) & 0xf; - if (!mpllP) - mpllP = 4; - -@@ -232,7 +233,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype) - uint32_t clock; - - pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock); -- return clock; -+ return clock / 1000; - } - - ret = nouveau_hw_get_pllvals(dev, plltype, &pllvals); -diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c -index c1590b746f13..eb58cd7bfbc9 100644 ---- a/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c -+++ b/drivers/gpu/drm/nouveau/nvkm/engine/disp/hdagt215.c -@@ -59,7 +59,7 @@ gt215_hda_eld(NV50_DISP_MTHD_V1) - ); - } - for (i = 0; i < size; i++) -- nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[0]); -+ nvkm_wr32(device, 0x61c440 + soff, (i << 8) | args->v0.data[i]); - for (; i < 0x60; i++) - nvkm_wr32(device, 0x61c440 + soff, (i << 8)); - nvkm_mask(device, 0x61c448 + soff, 0x80000003, 0x80000003); -diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c -index 5c02d7bbc7f2..35e3fd9fadf6 100644 ---- a/drivers/hid/wacom_wac.c -+++ b/drivers/hid/wacom_wac.c -@@ -148,19 +148,21 @@ static int wacom_pl_irq(struct wacom_wac *wacom) - wacom->id[0] = STYLUS_DEVICE_ID; - } - -- pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1)); -- if (features->pressure_max > 255) -- pressure = (pressure << 1) | ((data[4] >> 6) & 1); -- pressure += (features->pressure_max + 1) / 2; -- -- input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14)); -- input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14)); -- input_report_abs(input, ABS_PRESSURE, pressure); -- -- input_report_key(input, BTN_TOUCH, data[4] & 0x08); -- input_report_key(input, BTN_STYLUS, data[4] & 0x10); -- /* Only allow the stylus2 button to be reported for the pen tool. */ -- input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20)); -+ if (prox) { -+ pressure = (signed char)((data[7] << 1) | ((data[4] >> 2) & 1)); -+ if (features->pressure_max > 255) -+ pressure = (pressure << 1) | ((data[4] >> 6) & 1); -+ pressure += (features->pressure_max + 1) / 2; -+ -+ input_report_abs(input, ABS_X, data[3] | (data[2] << 7) | ((data[1] & 0x03) << 14)); -+ input_report_abs(input, ABS_Y, data[6] | (data[5] << 7) | ((data[4] & 0x03) << 14)); -+ input_report_abs(input, ABS_PRESSURE, pressure); -+ -+ input_report_key(input, BTN_TOUCH, data[4] & 0x08); -+ input_report_key(input, BTN_STYLUS, data[4] & 0x10); -+ /* Only allow the stylus2 button to be reported for the pen tool. */ -+ input_report_key(input, BTN_STYLUS2, (wacom->tool[0] == BTN_TOOL_PEN) && (data[4] & 0x20)); -+ } - - if (!prox) - wacom->id[0] = 0; -diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c -index 7277dfd7338f..bda164089904 100644 ---- a/drivers/mmc/host/sdhci.c -+++ b/drivers/mmc/host/sdhci.c -@@ -2629,7 +2629,8 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id) - pr_err("%s: Card is consuming too much power!\n", - mmc_hostname(host->mmc)); - -- if (intmask & SDHCI_INT_CARD_INT) { -+ if ((intmask & SDHCI_INT_CARD_INT) && -+ (host->ier & SDHCI_INT_CARD_INT)) { - sdhci_enable_sdio_irq_nolock(host, false); - host->thread_isr |= SDHCI_INT_CARD_INT; - result = IRQ_WAKE_THREAD; -diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c -index 317e3558a35e..c6a012b5ba39 100644 ---- a/drivers/pci/pcie/aspm.c -+++ b/drivers/pci/pcie/aspm.c -@@ -518,25 +518,32 @@ static struct pcie_link_state *alloc_pcie_link_state(struct pci_dev *pdev) - link = kzalloc(sizeof(*link), GFP_KERNEL); - if (!link) - return NULL; -+ - INIT_LIST_HEAD(&link->sibling); - INIT_LIST_HEAD(&link->children); - INIT_LIST_HEAD(&link->link); - link->pdev = pdev; -- if (pci_pcie_type(pdev) != PCI_EXP_TYPE_ROOT_PORT) { -+ -+ /* -+ * Root Ports and PCI/PCI-X to PCIe Bridges are roots of PCIe -+ * hierarchies. -+ */ -+ if (pci_pcie_type(pdev) == PCI_EXP_TYPE_ROOT_PORT || -+ pci_pcie_type(pdev) == PCI_EXP_TYPE_PCIE_BRIDGE) { -+ link->root = link; -+ } else { - struct pcie_link_state *parent; -+ - parent = pdev->bus->parent->self->link_state; - if (!parent) { - kfree(link); - return NULL; - } -+ - link->parent = parent; -+ link->root = link->parent->root; - list_add(&link->link, &parent->children); - } -- /* Setup a pointer to the root port link */ -- if (!link->parent) -- link->root = link; -- else -- link->root = link->parent->root; - - list_add(&link->sibling, &link_list); - pdev->link_state = link; -diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c -index d2e50a27140c..24f9f98968a5 100644 ---- a/drivers/usb/core/quirks.c -+++ b/drivers/usb/core/quirks.c -@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { - /* CBM - Flash disk */ - { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, - -+ /* WORLDE easy key (easykey.25) MIDI controller */ -+ { USB_DEVICE(0x0218, 0x0401), .driver_info = -+ USB_QUIRK_CONFIG_INTF_STRINGS }, -+ - /* HP 5300/5370C scanner */ - { USB_DEVICE(0x03f0, 0x0701), .driver_info = - USB_QUIRK_STRING_FETCH_255 }, -diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c -index 803c503a2e3d..cfda1a1c0ab6 100644 ---- a/drivers/usb/gadget/function/f_fs.c -+++ b/drivers/usb/gadget/function/f_fs.c -@@ -2079,6 +2079,8 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, - if (len < sizeof(*d) || h->interface >= ffs->interfaces_count) - return -EINVAL; - length = le32_to_cpu(d->dwSize); -+ if (len < length) -+ return -EINVAL; - type = le32_to_cpu(d->dwPropertyDataType); - if (type < USB_EXT_PROP_UNICODE || - type > USB_EXT_PROP_UNICODE_MULTI) { -@@ -2087,6 +2089,11 @@ static int __ffs_data_do_os_desc(enum ffs_os_desc_type type, - return -EINVAL; - } - pnl = le16_to_cpu(d->wPropertyNameLength); -+ if (length < 14 + pnl) { -+ pr_vdebug("invalid os descriptor length: %d pnl:%d (descriptor %d)\n", -+ length, pnl, type); -+ return -EINVAL; -+ } - pdl = le32_to_cpu(*(u32 *)((u8 *)data + 10 + pnl)); - if (length != 14 + pnl + pdl) { - pr_vdebug("invalid os descriptor length: %d pnl:%d pdl:%d (descriptor %d)\n", -@@ -2171,6 +2178,9 @@ static int __ffs_data_got_descs(struct ffs_data *ffs, - } - } - if (flags & (1 << i)) { -+ if (len < 4) { -+ goto error; -+ } - os_descs_count = get_unaligned_le32(data); - data += 4; - len -= 4; -@@ -2243,7 +2253,8 @@ static int __ffs_data_got_strings(struct ffs_data *ffs, - - ENTER(); - -- if (unlikely(get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC || -+ if (unlikely(len < 16 || -+ get_unaligned_le32(data) != FUNCTIONFS_STRINGS_MAGIC || - get_unaligned_le32(data + 4) != len)) - goto error; - str_count = get_unaligned_le32(data + 8); -diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c -index 7ce31a4c7e7f..42cc72e54c05 100644 ---- a/drivers/usb/serial/option.c -+++ b/drivers/usb/serial/option.c -@@ -2007,6 +2007,7 @@ static const struct usb_device_id option_ids[] = { - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, - { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, -+ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ - { } /* Terminating entry */ - }; - MODULE_DEVICE_TABLE(usb, option_ids); -diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c -index 46fca6b75846..1db4b61bdf7b 100644 ---- a/drivers/usb/serial/pl2303.c -+++ b/drivers/usb/serial/pl2303.c -@@ -49,6 +49,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, - { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, - { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, -+ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, - { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, - { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, - { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) }, -diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h -index e3b7af8adfb7..09d9be88209e 100644 ---- a/drivers/usb/serial/pl2303.h -+++ b/drivers/usb/serial/pl2303.h -@@ -27,6 +27,7 @@ - #define ATEN_VENDOR_ID 0x0557 - #define ATEN_VENDOR_ID2 0x0547 - #define ATEN_PRODUCT_ID 0x2008 -+#define ATEN_PRODUCT_ID2 0x2118 - - #define IODATA_VENDOR_ID 0x04bb - #define IODATA_PRODUCT_ID 0x0a03 -diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c -index 1bc6089b9008..696458db7e3c 100644 ---- a/drivers/usb/serial/qcserial.c -+++ b/drivers/usb/serial/qcserial.c -@@ -124,6 +124,7 @@ static const struct usb_device_id id_table[] = { - {USB_DEVICE(0x1410, 0xa021)}, /* Novatel Gobi 3000 Composite */ - {USB_DEVICE(0x413c, 0x8193)}, /* Dell Gobi 3000 QDL */ - {USB_DEVICE(0x413c, 0x8194)}, /* Dell Gobi 3000 Composite */ -+ {USB_DEVICE(0x413c, 0x81a6)}, /* Dell DW5570 QDL (MC8805) */ - {USB_DEVICE(0x1199, 0x68a4)}, /* Sierra Wireless QDL */ - {USB_DEVICE(0x1199, 0x68a5)}, /* Sierra Wireless Modem */ - {USB_DEVICE(0x1199, 0x68a8)}, /* Sierra Wireless QDL */ -diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c -index 833e5844a2db..97d1a15873c5 100644 ---- a/fs/cifs/readdir.c -+++ b/fs/cifs/readdir.c -@@ -282,6 +282,7 @@ initiate_cifs_search(const unsigned int xid, struct file *file) - rc = -ENOMEM; - goto error_exit; - } -+ spin_lock_init(&cifsFile->file_info_lock); - file->private_data = cifsFile; - cifsFile->tlink = cifs_get_tlink(tlink); - tcon = tlink_tcon(tlink); -diff --git a/fs/ext4/super.c b/fs/ext4/super.c -index 68640e6f95c5..b405a7b74ce0 100644 ---- a/fs/ext4/super.c -+++ b/fs/ext4/super.c -@@ -3663,6 +3663,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) - (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); - db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / - EXT4_DESC_PER_BLOCK(sb); -+ if (ext4_has_feature_meta_bg(sb)) { -+ if (le32_to_cpu(es->s_first_meta_bg) >= db_count) { -+ ext4_msg(sb, KERN_WARNING, -+ "first meta block group too large: %u " -+ "(group descriptor block count %u)", -+ le32_to_cpu(es->s_first_meta_bg), db_count); -+ goto failed_mount; -+ } -+ } - sbi->s_group_desc = ext4_kvmalloc(db_count * - sizeof(struct buffer_head *), - GFP_KERNEL); -diff --git a/fs/nfsd/nfs4layouts.c b/fs/nfsd/nfs4layouts.c -index c9d6c715c0fb..9eed219f57a5 100644 ---- a/fs/nfsd/nfs4layouts.c -+++ b/fs/nfsd/nfs4layouts.c -@@ -189,10 +189,11 @@ nfsd4_alloc_layout_stateid(struct nfsd4_compound_state *cstate, - struct nfs4_layout_stateid *ls; - struct nfs4_stid *stp; - -- stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache); -+ stp = nfs4_alloc_stid(cstate->clp, nfs4_layout_stateid_cache, -+ nfsd4_free_layout_stateid); - if (!stp) - return NULL; -- stp->sc_free = nfsd4_free_layout_stateid; -+ - get_nfs4_file(fp); - stp->sc_file = fp; - -diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c -index 55638110cb06..c7f1ce41442a 100644 ---- a/fs/nfsd/nfs4state.c -+++ b/fs/nfsd/nfs4state.c -@@ -553,8 +553,8 @@ out: - return co; - } - --struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, -- struct kmem_cache *slab) -+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, -+ void (*sc_free)(struct nfs4_stid *)) - { - struct nfs4_stid *stid; - int new_id; -@@ -570,6 +570,8 @@ struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, - idr_preload_end(); - if (new_id < 0) - goto out_free; -+ -+ stid->sc_free = sc_free; - stid->sc_client = cl; - stid->sc_stateid.si_opaque.so_id = new_id; - stid->sc_stateid.si_opaque.so_clid = cl->cl_clientid; -@@ -595,15 +597,12 @@ out_free: - static struct nfs4_ol_stateid * nfs4_alloc_open_stateid(struct nfs4_client *clp) - { - struct nfs4_stid *stid; -- struct nfs4_ol_stateid *stp; - -- stid = nfs4_alloc_stid(clp, stateid_slab); -+ stid = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_ol_stateid); - if (!stid) - return NULL; - -- stp = openlockstateid(stid); -- stp->st_stid.sc_free = nfs4_free_ol_stateid; -- return stp; -+ return openlockstateid(stid); - } - - static void nfs4_free_deleg(struct nfs4_stid *stid) -@@ -701,11 +700,10 @@ alloc_init_deleg(struct nfs4_client *clp, struct svc_fh *current_fh, - goto out_dec; - if (delegation_blocked(¤t_fh->fh_handle)) - goto out_dec; -- dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab)); -+ dp = delegstateid(nfs4_alloc_stid(clp, deleg_slab, nfs4_free_deleg)); - if (dp == NULL) - goto out_dec; - -- dp->dl_stid.sc_free = nfs4_free_deleg; - /* - * delegation seqid's are never incremented. The 4.1 special - * meaning of seqid 0 isn't meaningful, really, but let's avoid -@@ -5396,7 +5394,6 @@ init_lock_stateid(struct nfs4_ol_stateid *stp, struct nfs4_lockowner *lo, - stp->st_stateowner = nfs4_get_stateowner(&lo->lo_owner); - get_nfs4_file(fp); - stp->st_stid.sc_file = fp; -- stp->st_stid.sc_free = nfs4_free_lock_stateid; - stp->st_access_bmap = 0; - stp->st_deny_bmap = open_stp->st_deny_bmap; - stp->st_openstp = open_stp; -@@ -5439,7 +5436,7 @@ find_or_create_lock_stateid(struct nfs4_lockowner *lo, struct nfs4_file *fi, - lst = find_lock_stateid(lo, fi); - if (lst == NULL) { - spin_unlock(&clp->cl_lock); -- ns = nfs4_alloc_stid(clp, stateid_slab); -+ ns = nfs4_alloc_stid(clp, stateid_slab, nfs4_free_lock_stateid); - if (ns == NULL) - return NULL; - -diff --git a/fs/nfsd/state.h b/fs/nfsd/state.h -index 77860b75da9d..5134eedcb16c 100644 ---- a/fs/nfsd/state.h -+++ b/fs/nfsd/state.h -@@ -583,8 +583,8 @@ extern __be32 nfs4_preprocess_stateid_op(struct svc_rqst *rqstp, - __be32 nfsd4_lookup_stateid(struct nfsd4_compound_state *cstate, - stateid_t *stateid, unsigned char typemask, - struct nfs4_stid **s, struct nfsd_net *nn); --struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, -- struct kmem_cache *slab); -+struct nfs4_stid *nfs4_alloc_stid(struct nfs4_client *cl, struct kmem_cache *slab, -+ void (*sc_free)(struct nfs4_stid *)); - void nfs4_unhash_stid(struct nfs4_stid *s); - void nfs4_put_stid(struct nfs4_stid *s); - void nfs4_inc_and_copy_stateid(stateid_t *dst, struct nfs4_stid *stid); -diff --git a/include/linux/memory_hotplug.h b/include/linux/memory_hotplug.h -index 2ea574ff9714..538488bd1d3d 100644 ---- a/include/linux/memory_hotplug.h -+++ b/include/linux/memory_hotplug.h -@@ -85,7 +85,8 @@ extern int zone_grow_waitqueues(struct zone *zone, unsigned long nr_pages); - extern int add_one_highpage(struct page *page, int pfn, int bad_ppro); - /* VM interface that may be used by firmware interface */ - extern int online_pages(unsigned long, unsigned long, int); --extern int test_pages_in_a_zone(unsigned long, unsigned long); -+extern int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, -+ unsigned long *valid_start, unsigned long *valid_end); - extern void __offline_isolated_pages(unsigned long, unsigned long); - - typedef void (*online_page_callback_t)(struct page *page); -diff --git a/include/linux/percpu-refcount.h b/include/linux/percpu-refcount.h -index 12c9b485beb7..abd7c01c84db 100644 ---- a/include/linux/percpu-refcount.h -+++ b/include/linux/percpu-refcount.h -@@ -206,7 +206,7 @@ static inline void percpu_ref_get(struct percpu_ref *ref) - static inline bool percpu_ref_tryget(struct percpu_ref *ref) - { - unsigned long __percpu *percpu_count; -- int ret; -+ bool ret; - - rcu_read_lock_sched(); - -@@ -240,7 +240,7 @@ static inline bool percpu_ref_tryget(struct percpu_ref *ref) - static inline bool percpu_ref_tryget_live(struct percpu_ref *ref) - { - unsigned long __percpu *percpu_count; -- int ret = false; -+ bool ret = false; - - rcu_read_lock_sched(); - -diff --git a/kernel/events/core.c b/kernel/events/core.c -index bc6371b0e4fb..9bbe9ac23cf2 100644 ---- a/kernel/events/core.c -+++ b/kernel/events/core.c -@@ -6039,6 +6039,27 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) - char *buf = NULL; - char *name; - -+ if (vma->vm_flags & VM_READ) -+ prot |= PROT_READ; -+ if (vma->vm_flags & VM_WRITE) -+ prot |= PROT_WRITE; -+ if (vma->vm_flags & VM_EXEC) -+ prot |= PROT_EXEC; -+ -+ if (vma->vm_flags & VM_MAYSHARE) -+ flags = MAP_SHARED; -+ else -+ flags = MAP_PRIVATE; -+ -+ if (vma->vm_flags & VM_DENYWRITE) -+ flags |= MAP_DENYWRITE; -+ if (vma->vm_flags & VM_MAYEXEC) -+ flags |= MAP_EXECUTABLE; -+ if (vma->vm_flags & VM_LOCKED) -+ flags |= MAP_LOCKED; -+ if (vma->vm_flags & VM_HUGETLB) -+ flags |= MAP_HUGETLB; -+ - if (file) { - struct inode *inode; - dev_t dev; -@@ -6065,27 +6086,6 @@ static void perf_event_mmap_event(struct perf_mmap_event *mmap_event) - maj = MAJOR(dev); - min = MINOR(dev); - -- if (vma->vm_flags & VM_READ) -- prot |= PROT_READ; -- if (vma->vm_flags & VM_WRITE) -- prot |= PROT_WRITE; -- if (vma->vm_flags & VM_EXEC) -- prot |= PROT_EXEC; -- -- if (vma->vm_flags & VM_MAYSHARE) -- flags = MAP_SHARED; -- else -- flags = MAP_PRIVATE; -- -- if (vma->vm_flags & VM_DENYWRITE) -- flags |= MAP_DENYWRITE; -- if (vma->vm_flags & VM_MAYEXEC) -- flags |= MAP_EXECUTABLE; -- if (vma->vm_flags & VM_LOCKED) -- flags |= MAP_LOCKED; -- if (vma->vm_flags & VM_HUGETLB) -- flags |= MAP_HUGETLB; -- - goto got_name; - } else { - if (vma->vm_ops && vma->vm_ops->name) { -diff --git a/mm/filemap.c b/mm/filemap.c -index c588d1222b2a..c33c31d75a2b 100644 ---- a/mm/filemap.c -+++ b/mm/filemap.c -@@ -1559,6 +1559,11 @@ static ssize_t do_generic_file_read(struct file *filp, loff_t *ppos, - - cond_resched(); - find_page: -+ if (fatal_signal_pending(current)) { -+ error = -EINTR; -+ goto out; -+ } -+ - page = find_get_page(mapping, index); - if (!page) { - page_cache_sync_readahead(mapping, -diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c -index a042a9d537bb..a18923e4359d 100644 ---- a/mm/memory_hotplug.c -+++ b/mm/memory_hotplug.c -@@ -1371,17 +1371,20 @@ int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages) - } - - /* -- * Confirm all pages in a range [start, end) is belongs to the same zone. -+ * Confirm all pages in a range [start, end) belong to the same zone. -+ * When true, return its valid [start, end). - */ --int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) -+int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn, -+ unsigned long *valid_start, unsigned long *valid_end) - { - unsigned long pfn, sec_end_pfn; -+ unsigned long start, end; - struct zone *zone = NULL; - struct page *page; - int i; -- for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn); -+ for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1); - pfn < end_pfn; -- pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) { -+ pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) { - /* Make sure the memory section is present first */ - if (!present_section_nr(pfn_to_section_nr(pfn))) - continue; -@@ -1397,10 +1400,20 @@ int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) - page = pfn_to_page(pfn + i); - if (zone && page_zone(page) != zone) - return 0; -+ if (!zone) -+ start = pfn + i; - zone = page_zone(page); -+ end = pfn + MAX_ORDER_NR_PAGES; - } - } -- return 1; -+ -+ if (zone) { -+ *valid_start = start; -+ *valid_end = end; -+ return 1; -+ } else { -+ return 0; -+ } - } - - /* -@@ -1718,6 +1731,7 @@ static int __ref __offline_pages(unsigned long start_pfn, - long offlined_pages; - int ret, drain, retry_max, node; - unsigned long flags; -+ unsigned long valid_start, valid_end; - struct zone *zone; - struct memory_notify arg; - -@@ -1728,10 +1742,10 @@ static int __ref __offline_pages(unsigned long start_pfn, - return -EINVAL; - /* This makes hotplug much easier...and readable. - we assume this for now. .*/ -- if (!test_pages_in_a_zone(start_pfn, end_pfn)) -+ if (!test_pages_in_a_zone(start_pfn, end_pfn, &valid_start, &valid_end)) - return -EINVAL; - -- zone = page_zone(pfn_to_page(start_pfn)); -+ zone = page_zone(pfn_to_page(valid_start)); - node = zone_to_nid(zone); - nr_pages = end_pfn - start_pfn; - -diff --git a/mm/zswap.c b/mm/zswap.c -index 340261946fda..45476f429789 100644 ---- a/mm/zswap.c -+++ b/mm/zswap.c -@@ -78,7 +78,13 @@ static u64 zswap_duplicate_entry; - - /* Enable/disable zswap (disabled by default) */ - static bool zswap_enabled; --module_param_named(enabled, zswap_enabled, bool, 0644); -+static int zswap_enabled_param_set(const char *, -+ const struct kernel_param *); -+static struct kernel_param_ops zswap_enabled_param_ops = { -+ .set = zswap_enabled_param_set, -+ .get = param_get_bool, -+}; -+module_param_cb(enabled, &zswap_enabled_param_ops, &zswap_enabled, 0644); - - /* Crypto compressor to use */ - #define ZSWAP_COMPRESSOR_DEFAULT "lzo" -@@ -176,6 +182,9 @@ static atomic_t zswap_pools_count = ATOMIC_INIT(0); - /* used by param callback function */ - static bool zswap_init_started; - -+/* fatal error during init */ -+static bool zswap_init_failed; -+ - /********************************* - * helpers and fwd declarations - **********************************/ -@@ -702,6 +711,11 @@ static int __zswap_param_set(const char *val, const struct kernel_param *kp, - char *s = strstrip((char *)val); - int ret; - -+ if (zswap_init_failed) { -+ pr_err("can't set param, initialization failed\n"); -+ return -ENODEV; -+ } -+ - /* no change required */ - if (!strcmp(s, *(char **)kp->arg)) - return 0; -@@ -781,6 +795,17 @@ static int zswap_zpool_param_set(const char *val, - return __zswap_param_set(val, kp, NULL, zswap_compressor); - } - -+static int zswap_enabled_param_set(const char *val, -+ const struct kernel_param *kp) -+{ -+ if (zswap_init_failed) { -+ pr_err("can't enable, initialization failed\n"); -+ return -ENODEV; -+ } -+ -+ return param_set_bool(val, kp); -+} -+ - /********************************* - * writeback code - **********************************/ -@@ -1267,6 +1292,9 @@ pool_fail: - dstmem_fail: - zswap_entry_cache_destroy(); - cache_fail: -+ /* if built-in, we aren't unloaded on failure; don't allow use */ -+ zswap_init_failed = true; -+ zswap_enabled = false; - return -ENOMEM; - } - /* must be late so crypto has time to come up */ -diff --git a/net/can/bcm.c b/net/can/bcm.c -index 8ef1afacad82..24d66c1cc0cd 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -710,14 +710,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops, canid_t can_id, - - static void bcm_remove_op(struct bcm_op *op) - { -- hrtimer_cancel(&op->timer); -- hrtimer_cancel(&op->thrtimer); -- -- if (op->tsklet.func) -- tasklet_kill(&op->tsklet); -+ if (op->tsklet.func) { -+ while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) || -+ test_bit(TASKLET_STATE_RUN, &op->tsklet.state) || -+ hrtimer_active(&op->timer)) { -+ hrtimer_cancel(&op->timer); -+ tasklet_kill(&op->tsklet); -+ } -+ } - -- if (op->thrtsklet.func) -- tasklet_kill(&op->thrtsklet); -+ if (op->thrtsklet.func) { -+ while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) || -+ test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) || -+ hrtimer_active(&op->thrtimer)) { -+ hrtimer_cancel(&op->thrtimer); -+ tasklet_kill(&op->thrtsklet); -+ } -+ } - - if ((op->frames) && (op->frames != &op->sframe)) - kfree(op->frames); -diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c -index eeeba5adee6d..2410d557ae39 100644 ---- a/net/sunrpc/auth_gss/gss_rpc_xdr.c -+++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c -@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr, - if (!oa->data) - return -ENOMEM; - -- creds = kmalloc(sizeof(struct svc_cred), GFP_KERNEL); -+ creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL); - if (!creds) { - kfree(oa->data); - return -ENOMEM; diff --git a/patch/kernel/mvebu-default/03-patch-4.4.48-49.patch b/patch/kernel/mvebu-default/03-patch-4.4.48-49.patch deleted file mode 100644 index d1ccaa909..000000000 --- a/patch/kernel/mvebu-default/03-patch-4.4.48-49.patch +++ /dev/null @@ -1,531 +0,0 @@ -diff --git a/Makefile b/Makefile -index 0793cd412656..5fab6d4068b5 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 48 -+SUBLEVEL = 49 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c -index 91ebe382147f..5f69c3bd59bb 100644 ---- a/arch/arc/kernel/unaligned.c -+++ b/arch/arc/kernel/unaligned.c -@@ -243,7 +243,7 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs, - - /* clear any remanants of delay slot */ - if (delay_mode(regs)) { -- regs->ret = regs->bta ~1U; -+ regs->ret = regs->bta & ~1U; - regs->status32 &= ~STATUS_DE_MASK; - } else { - regs->ret += state.instr_len; -diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c -index 4d9375814b53..d54c53b7ab63 100644 ---- a/arch/arm/kernel/ptrace.c -+++ b/arch/arm/kernel/ptrace.c -@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target, - const void *kbuf, const void __user *ubuf) - { - int ret; -- struct pt_regs newregs; -+ struct pt_regs newregs = *task_pt_regs(target); - - ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, - &newregs, -diff --git a/arch/arm/mm/fault.c b/arch/arm/mm/fault.c -index daafcf121ce0..c095455d496e 100644 ---- a/arch/arm/mm/fault.c -+++ b/arch/arm/mm/fault.c -@@ -610,9 +610,9 @@ static int __init early_abort_handler(unsigned long addr, unsigned int fsr, - - void __init early_abt_enable(void) - { -- fsr_info[22].fn = early_abort_handler; -+ fsr_info[FSR_FS_AEA].fn = early_abort_handler; - local_abt_enable(); -- fsr_info[22].fn = do_bad; -+ fsr_info[FSR_FS_AEA].fn = do_bad; - } - - #ifndef CONFIG_ARM_LPAE -diff --git a/arch/arm/mm/fault.h b/arch/arm/mm/fault.h -index 05ec5e0df32d..78830657cab3 100644 ---- a/arch/arm/mm/fault.h -+++ b/arch/arm/mm/fault.h -@@ -11,11 +11,15 @@ - #define FSR_FS5_0 (0x3f) - - #ifdef CONFIG_ARM_LPAE -+#define FSR_FS_AEA 17 -+ - static inline int fsr_fs(unsigned int fsr) - { - return fsr & FSR_FS5_0; - } - #else -+#define FSR_FS_AEA 22 -+ - static inline int fsr_fs(unsigned int fsr) - { - return (fsr & FSR_FS3_0) | (fsr & FSR_FS4) >> 6; -diff --git a/arch/x86/kernel/apic/io_apic.c b/arch/x86/kernel/apic/io_apic.c -index 1e5d2f07416b..8ca533b8c606 100644 ---- a/arch/x86/kernel/apic/io_apic.c -+++ b/arch/x86/kernel/apic/io_apic.c -@@ -1875,7 +1875,6 @@ static struct irq_chip ioapic_chip __read_mostly = { - .irq_ack = irq_chip_ack_parent, - .irq_eoi = ioapic_ack_level, - .irq_set_affinity = ioapic_set_affinity, -- .irq_retrigger = irq_chip_retrigger_hierarchy, - .flags = IRQCHIP_SKIP_SET_WAKE, - }; - -@@ -1887,7 +1886,6 @@ static struct irq_chip ioapic_ir_chip __read_mostly = { - .irq_ack = irq_chip_ack_parent, - .irq_eoi = ioapic_ir_ack_level, - .irq_set_affinity = ioapic_set_affinity, -- .irq_retrigger = irq_chip_retrigger_hierarchy, - .flags = IRQCHIP_SKIP_SET_WAKE, - }; - -diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index 909d1d71d130..4f5d07bb3511 100644 ---- a/drivers/gpu/drm/i915/intel_display.c -+++ b/drivers/gpu/drm/i915/intel_display.c -@@ -3948,10 +3948,10 @@ static void page_flip_completed(struct intel_crtc *intel_crtc) - drm_crtc_vblank_put(&intel_crtc->base); - - wake_up_all(&dev_priv->pending_flip_queue); -- queue_work(dev_priv->wq, &work->work); -- - trace_i915_flip_complete(intel_crtc->plane, - work->pending_flip_obj); -+ -+ queue_work(dev_priv->wq, &work->work); - } - - void intel_crtc_wait_for_pending_flips(struct drm_crtc *crtc) -diff --git a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h -index bdbd80423b17..9ff2881f933d 100644 ---- a/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h -+++ b/drivers/net/ethernet/hisilicon/hns/hns_dsaf_reg.h -@@ -900,9 +900,7 @@ - - static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value) - { -- u8 __iomem *reg_addr = ACCESS_ONCE(base); -- -- writel(value, reg_addr + reg); -+ writel(value, base + reg); - } - - #define dsaf_write_dev(a, reg, value) \ -@@ -910,9 +908,7 @@ static inline void dsaf_write_reg(void __iomem *base, u32 reg, u32 value) - - static inline u32 dsaf_read_reg(u8 __iomem *base, u32 reg) - { -- u8 __iomem *reg_addr = ACCESS_ONCE(base); -- -- return readl(reg_addr + reg); -+ return readl(base + reg); - } - - #define dsaf_read_dev(a, reg) \ -diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c -index 7a601d8c615e..e8a09ff9e724 100644 ---- a/drivers/net/hyperv/netvsc_drv.c -+++ b/drivers/net/hyperv/netvsc_drv.c -@@ -854,7 +854,6 @@ static int netvsc_set_channels(struct net_device *net, - } - goto recover; - } -- netif_set_gso_max_size(net, NETVSC_GSO_MAX_SIZE); - - out: - netvsc_open(net); -@@ -1142,6 +1141,7 @@ static int netvsc_probe(struct hv_device *dev, - nvdev = hv_get_drvdata(dev); - netif_set_real_num_tx_queues(net, nvdev->num_chn); - netif_set_real_num_rx_queues(net, nvdev->num_chn); -+ netif_set_gso_max_size(net, NETVSC_GSO_MAX_SIZE); - - ret = register_netdev(net); - if (ret != 0) { -diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c -index d6abf191122a..1f445f357da1 100644 ---- a/drivers/net/xen-netfront.c -+++ b/drivers/net/xen-netfront.c -@@ -1391,6 +1391,8 @@ static void xennet_disconnect_backend(struct netfront_info *info) - for (i = 0; i < num_queues && info->queues; ++i) { - struct netfront_queue *queue = &info->queues[i]; - -+ del_timer_sync(&queue->rx_refill_timer); -+ - if (queue->tx_irq && (queue->tx_irq == queue->rx_irq)) - unbind_from_irqhandler(queue->tx_irq, queue); - if (queue->tx_irq && (queue->tx_irq != queue->rx_irq)) { -@@ -1745,7 +1747,6 @@ static void xennet_destroy_queues(struct netfront_info *info) - - if (netif_running(info->netdev)) - napi_disable(&queue->napi); -- del_timer_sync(&queue->rx_refill_timer); - netif_napi_del(&queue->napi); - } - -diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c -index 75f820ca17b7..27ff38f839fc 100644 ---- a/drivers/s390/scsi/zfcp_fsf.c -+++ b/drivers/s390/scsi/zfcp_fsf.c -@@ -1583,7 +1583,7 @@ out: - int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port) - { - struct zfcp_qdio *qdio = wka_port->adapter->qdio; -- struct zfcp_fsf_req *req = NULL; -+ struct zfcp_fsf_req *req; - int retval = -EIO; - - spin_lock_irq(&qdio->req_q_lock); -@@ -1612,7 +1612,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port) - zfcp_fsf_req_free(req); - out: - spin_unlock_irq(&qdio->req_q_lock); -- if (req && !IS_ERR(req)) -+ if (!retval) - zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id); - return retval; - } -@@ -1638,7 +1638,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req) - int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port) - { - struct zfcp_qdio *qdio = wka_port->adapter->qdio; -- struct zfcp_fsf_req *req = NULL; -+ struct zfcp_fsf_req *req; - int retval = -EIO; - - spin_lock_irq(&qdio->req_q_lock); -@@ -1667,7 +1667,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port) - zfcp_fsf_req_free(req); - out: - spin_unlock_irq(&qdio->req_q_lock); -- if (req && !IS_ERR(req)) -+ if (!retval) - zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id); - return retval; - } -diff --git a/drivers/scsi/aacraid/comminit.c b/drivers/scsi/aacraid/comminit.c -index 0d351cd3191b..26d38b1a45ab 100644 ---- a/drivers/scsi/aacraid/comminit.c -+++ b/drivers/scsi/aacraid/comminit.c -@@ -50,9 +50,13 @@ struct aac_common aac_config = { - - static inline int aac_is_msix_mode(struct aac_dev *dev) - { -- u32 status; -+ u32 status = 0; - -- status = src_readl(dev, MUnit.OMR); -+ if (dev->pdev->device == PMC_DEVICE_S6 || -+ dev->pdev->device == PMC_DEVICE_S7 || -+ dev->pdev->device == PMC_DEVICE_S8) { -+ status = src_readl(dev, MUnit.OMR); -+ } - return (status & AAC_INT_MODE_MSIX); - } - -diff --git a/drivers/scsi/mpt3sas/mpt3sas_scsih.c b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -index 8cead04f26d6..f6a8e9958e75 100644 ---- a/drivers/scsi/mpt3sas/mpt3sas_scsih.c -+++ b/drivers/scsi/mpt3sas/mpt3sas_scsih.c -@@ -51,6 +51,7 @@ - #include - #include - #include -+#include - #include - #include - #include -@@ -8483,6 +8484,8 @@ _scsih_probe(struct pci_dev *pdev, const struct pci_device_id *id) - - switch (hba_mpi_version) { - case MPI2_VERSION: -+ pci_disable_link_state(pdev, PCIE_LINK_STATE_L0S | -+ PCIE_LINK_STATE_L1 | PCIE_LINK_STATE_CLKPM); - /* Use mpt2sas driver host template for SAS 2.0 HBA's */ - shost = scsi_host_alloc(&mpt2sas_driver_template, - sizeof(struct MPT3SAS_ADAPTER)); -diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c -index dcd5ed26eb18..356c80fbb304 100644 ---- a/drivers/target/target_core_device.c -+++ b/drivers/target/target_core_device.c -@@ -362,7 +362,15 @@ int core_enable_device_list_for_node( - kfree(new); - return -EINVAL; - } -- BUG_ON(orig->se_lun_acl != NULL); -+ if (orig->se_lun_acl != NULL) { -+ pr_warn_ratelimited("Detected existing explicit" -+ " se_lun_acl->se_lun_group reference for %s" -+ " mapped_lun: %llu, failing\n", -+ nacl->initiatorname, mapped_lun); -+ mutex_unlock(&nacl->lun_entry_mutex); -+ kfree(new); -+ return -EINVAL; -+ } - - rcu_assign_pointer(new->se_lun, lun); - rcu_assign_pointer(new->se_lun_acl, lun_acl); -diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c -index c220bb8dfa9d..2e27b1034ede 100644 ---- a/drivers/target/target_core_sbc.c -+++ b/drivers/target/target_core_sbc.c -@@ -442,6 +442,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, - int *post_ret) - { - struct se_device *dev = cmd->se_dev; -+ sense_reason_t ret = TCM_NO_SENSE; - - /* - * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through -@@ -449,9 +450,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, - * sent to the backend driver. - */ - spin_lock_irq(&cmd->t_state_lock); -- if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) { -+ if (cmd->transport_state & CMD_T_SENT) { - cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST; - *post_ret = 1; -+ -+ if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION) -+ ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; - } - spin_unlock_irq(&cmd->t_state_lock); - -@@ -461,7 +465,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, - */ - up(&dev->caw_sem); - -- return TCM_NO_SENSE; -+ return ret; - } - - static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success, -diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c -index 2a67af4e2e13..aa517c4fadb9 100644 ---- a/drivers/target/target_core_transport.c -+++ b/drivers/target/target_core_transport.c -@@ -3058,7 +3058,6 @@ static void target_tmr_work(struct work_struct *work) - spin_unlock_irqrestore(&cmd->t_state_lock, flags); - goto check_stop; - } -- cmd->t_state = TRANSPORT_ISTATE_PROCESSING; - spin_unlock_irqrestore(&cmd->t_state_lock, flags); - - cmd->se_tfo->queue_tm_rsp(cmd); -@@ -3071,11 +3070,25 @@ int transport_generic_handle_tmr( - struct se_cmd *cmd) - { - unsigned long flags; -+ bool aborted = false; - - spin_lock_irqsave(&cmd->t_state_lock, flags); -- cmd->transport_state |= CMD_T_ACTIVE; -+ if (cmd->transport_state & CMD_T_ABORTED) { -+ aborted = true; -+ } else { -+ cmd->t_state = TRANSPORT_ISTATE_PROCESSING; -+ cmd->transport_state |= CMD_T_ACTIVE; -+ } - spin_unlock_irqrestore(&cmd->t_state_lock, flags); - -+ if (aborted) { -+ pr_warn_ratelimited("handle_tmr caught CMD_T_ABORTED TMR %d" -+ "ref_tag: %llu tag: %llu\n", cmd->se_tmr_req->function, -+ cmd->se_tmr_req->ref_task_tag, cmd->tag); -+ transport_cmd_check_stop_to_fabric(cmd); -+ return 0; -+ } -+ - INIT_WORK(&cmd->work, target_tmr_work); - queue_work(cmd->se_dev->tmr_wq, &cmd->work); - return 0; -diff --git a/drivers/target/target_core_xcopy.c b/drivers/target/target_core_xcopy.c -index 153a6f255b6d..6415e9b09a52 100644 ---- a/drivers/target/target_core_xcopy.c -+++ b/drivers/target/target_core_xcopy.c -@@ -836,7 +836,7 @@ out: - " CHECK_CONDITION -> sending response\n", rc); - ec_cmd->scsi_status = SAM_STAT_CHECK_CONDITION; - } -- target_complete_cmd(ec_cmd, SAM_STAT_CHECK_CONDITION); -+ target_complete_cmd(ec_cmd, ec_cmd->scsi_status); - } - - sense_reason_t target_do_xcopy(struct se_cmd *se_cmd) -diff --git a/include/linux/cpumask.h b/include/linux/cpumask.h -index 59915ea5373c..a91b3b75da0f 100644 ---- a/include/linux/cpumask.h -+++ b/include/linux/cpumask.h -@@ -556,7 +556,7 @@ static inline void cpumask_copy(struct cpumask *dstp, - static inline int cpumask_parse_user(const char __user *buf, int len, - struct cpumask *dstp) - { -- return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpu_ids); -+ return bitmap_parse_user(buf, len, cpumask_bits(dstp), nr_cpumask_bits); - } - - /** -@@ -571,7 +571,7 @@ static inline int cpumask_parselist_user(const char __user *buf, int len, - struct cpumask *dstp) - { - return bitmap_parselist_user(buf, len, cpumask_bits(dstp), -- nr_cpu_ids); -+ nr_cpumask_bits); - } - - /** -@@ -586,7 +586,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp) - char *nl = strchr(buf, '\n'); - unsigned int len = nl ? (unsigned int)(nl - buf) : strlen(buf); - -- return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpu_ids); -+ return bitmap_parse(buf, len, cpumask_bits(dstp), nr_cpumask_bits); - } - - /** -@@ -598,7 +598,7 @@ static inline int cpumask_parse(const char *buf, struct cpumask *dstp) - */ - static inline int cpulist_parse(const char *buf, struct cpumask *dstp) - { -- return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpu_ids); -+ return bitmap_parselist(buf, cpumask_bits(dstp), nr_cpumask_bits); - } - - /** -diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c -index f7bb6829b415..9063e8e736ad 100644 ---- a/net/mac80211/mesh.c -+++ b/net/mac80211/mesh.c -@@ -355,7 +355,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata, - /* fast-forward to vendor IEs */ - offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0); - -- if (offset) { -+ if (offset < ifmsh->ie_len) { - len = ifmsh->ie_len - offset; - data = ifmsh->ie + offset; - if (skb_tailroom(skb) < len) -diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c -index d0cfaa9f19d0..4b56c3b6c25f 100644 ---- a/security/selinux/hooks.c -+++ b/security/selinux/hooks.c -@@ -5640,7 +5640,7 @@ static int selinux_setprocattr(struct task_struct *p, - return error; - - /* Obtain a SID for the context, if one was specified. */ -- if (size && str[1] && str[1] != '\n') { -+ if (size && str[0] && str[0] != '\n') { - if (str[size-1] == '\n') { - str[size-1] = 0; - size--; -diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c -index c850345c43b5..dfa5156f3585 100644 ---- a/sound/core/seq/seq_memory.c -+++ b/sound/core/seq/seq_memory.c -@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool) - { - unsigned long flags; - struct snd_seq_event_cell *ptr; -- int max_count = 5 * HZ; - - if (snd_BUG_ON(!pool)) - return -EINVAL; -@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool) - if (waitqueue_active(&pool->output_sleep)) - wake_up(&pool->output_sleep); - -- while (atomic_read(&pool->counter) > 0) { -- if (max_count == 0) { -- pr_warn("ALSA: snd_seq_pool_done timeout: %d cells remain\n", atomic_read(&pool->counter)); -- break; -- } -+ while (atomic_read(&pool->counter) > 0) - schedule_timeout_uninterruptible(1); -- max_count--; -- } - - /* release all resources */ - spin_lock_irqsave(&pool->lock, flags); -diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c -index 0bec02e89d51..450c5187eecb 100644 ---- a/sound/core/seq/seq_queue.c -+++ b/sound/core/seq/seq_queue.c -@@ -181,6 +181,8 @@ void __exit snd_seq_queues_delete(void) - } - } - -+static void queue_use(struct snd_seq_queue *queue, int client, int use); -+ - /* allocate a new queue - - * return queue index value or negative value for error - */ -@@ -192,11 +194,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags) - if (q == NULL) - return -ENOMEM; - q->info_flags = info_flags; -+ queue_use(q, client, 1); - if (queue_list_add(q) < 0) { - queue_delete(q); - return -ENOMEM; - } -- snd_seq_queue_use(q->queue, client, 1); /* use this queue */ - return q->queue; - } - -@@ -502,19 +504,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client, - return result; - } - -- --/* use or unuse this queue - -- * if it is the first client, starts the timer. -- * if it is not longer used by any clients, stop the timer. -- */ --int snd_seq_queue_use(int queueid, int client, int use) -+/* use or unuse this queue */ -+static void queue_use(struct snd_seq_queue *queue, int client, int use) - { -- struct snd_seq_queue *queue; -- -- queue = queueptr(queueid); -- if (queue == NULL) -- return -EINVAL; -- mutex_lock(&queue->timer_mutex); - if (use) { - if (!test_and_set_bit(client, queue->clients_bitmap)) - queue->clients++; -@@ -529,6 +521,21 @@ int snd_seq_queue_use(int queueid, int client, int use) - } else { - snd_seq_timer_close(queue); - } -+} -+ -+/* use or unuse this queue - -+ * if it is the first client, starts the timer. -+ * if it is not longer used by any clients, stop the timer. -+ */ -+int snd_seq_queue_use(int queueid, int client, int use) -+{ -+ struct snd_seq_queue *queue; -+ -+ queue = queueptr(queueid); -+ if (queue == NULL) -+ return -EINVAL; -+ mutex_lock(&queue->timer_mutex); -+ queue_use(queue, client, use); - mutex_unlock(&queue->timer_mutex); - queuefree(queue); - return 0; diff --git a/patch/kernel/mvebu-default/03-patch-4.4.49-50.patch b/patch/kernel/mvebu-default/03-patch-4.4.49-50.patch deleted file mode 100644 index ac8d29078..000000000 --- a/patch/kernel/mvebu-default/03-patch-4.4.49-50.patch +++ /dev/null @@ -1,763 +0,0 @@ -diff --git a/Makefile b/Makefile -index 5fab6d4068b5..10993715abb8 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 49 -+SUBLEVEL = 50 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -index bbff8ec6713e..28a4b34310b2 100644 ---- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c -+++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c -@@ -502,8 +502,11 @@ void mlx4_en_recover_from_oom(struct mlx4_en_priv *priv) - return; - - for (ring = 0; ring < priv->rx_ring_num; ring++) { -- if (mlx4_en_is_ring_empty(priv->rx_ring[ring])) -+ if (mlx4_en_is_ring_empty(priv->rx_ring[ring])) { -+ local_bh_disable(); - napi_reschedule(&priv->rx_cq[ring]->napi); -+ local_bh_enable(); -+ } - } - } - -diff --git a/drivers/net/loopback.c b/drivers/net/loopback.c -index dc7d970bd1c0..effcdbfb06e9 100644 ---- a/drivers/net/loopback.c -+++ b/drivers/net/loopback.c -@@ -164,6 +164,7 @@ static void loopback_setup(struct net_device *dev) - { - dev->mtu = 64 * 1024; - dev->hard_header_len = ETH_HLEN; /* 14 */ -+ dev->min_header_len = ETH_HLEN; /* 14 */ - dev->addr_len = ETH_ALEN; /* 6 */ - dev->type = ARPHRD_LOOPBACK; /* 0x0001*/ - dev->flags = IFF_LOOPBACK; -diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c -index 159a68782bec..79de9608ac48 100644 ---- a/drivers/net/macvtap.c -+++ b/drivers/net/macvtap.c -@@ -725,7 +725,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, - ssize_t n; - - if (q->flags & IFF_VNET_HDR) { -- vnet_hdr_len = q->vnet_hdr_sz; -+ vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz); - - err = -EINVAL; - if (len < vnet_hdr_len) -@@ -865,7 +865,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q, - - if (q->flags & IFF_VNET_HDR) { - struct virtio_net_hdr vnet_hdr; -- vnet_hdr_len = q->vnet_hdr_sz; -+ vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz); - if (iov_iter_count(iter) < vnet_hdr_len) - return -EINVAL; - -diff --git a/drivers/net/tun.c b/drivers/net/tun.c -index 111b972e3053..c31d8e74f131 100644 ---- a/drivers/net/tun.c -+++ b/drivers/net/tun.c -@@ -1108,9 +1108,11 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - } - - if (tun->flags & IFF_VNET_HDR) { -- if (len < tun->vnet_hdr_sz) -+ int vnet_hdr_sz = READ_ONCE(tun->vnet_hdr_sz); -+ -+ if (len < vnet_hdr_sz) - return -EINVAL; -- len -= tun->vnet_hdr_sz; -+ len -= vnet_hdr_sz; - - n = copy_from_iter(&gso, sizeof(gso), from); - if (n != sizeof(gso)) -@@ -1122,7 +1124,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, - - if (tun16_to_cpu(tun, gso.hdr_len) > len) - return -EINVAL; -- iov_iter_advance(from, tun->vnet_hdr_sz - sizeof(gso)); -+ iov_iter_advance(from, vnet_hdr_sz - sizeof(gso)); - } - - if ((tun->flags & TUN_TYPE_MASK) == IFF_TAP) { -@@ -1301,7 +1303,7 @@ static ssize_t tun_put_user(struct tun_struct *tun, - vlan_hlen = VLAN_HLEN; - - if (tun->flags & IFF_VNET_HDR) -- vnet_hdr_sz = tun->vnet_hdr_sz; -+ vnet_hdr_sz = READ_ONCE(tun->vnet_hdr_sz); - - total = skb->len + vlan_hlen + vnet_hdr_sz; - -diff --git a/include/linux/can/core.h b/include/linux/can/core.h -index a0875001b13c..df08a41d5be5 100644 ---- a/include/linux/can/core.h -+++ b/include/linux/can/core.h -@@ -45,10 +45,9 @@ struct can_proto { - extern int can_proto_register(const struct can_proto *cp); - extern void can_proto_unregister(const struct can_proto *cp); - --extern int can_rx_register(struct net_device *dev, canid_t can_id, -- canid_t mask, -- void (*func)(struct sk_buff *, void *), -- void *data, char *ident); -+int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, -+ void (*func)(struct sk_buff *, void *), -+ void *data, char *ident, struct sock *sk); - - extern void can_rx_unregister(struct net_device *dev, canid_t can_id, - canid_t mask, -diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h -index 93a6a2c66d15..4035bbe40971 100644 ---- a/include/linux/netdevice.h -+++ b/include/linux/netdevice.h -@@ -1399,6 +1399,7 @@ enum netdev_priv_flags { - * @mtu: Interface MTU value - * @type: Interface hardware type - * @hard_header_len: Maximum hardware header length. -+ * @min_header_len: Minimum hardware header length - * - * @needed_headroom: Extra headroom the hardware may need, but not in all - * cases can this be guaranteed -@@ -1619,6 +1620,7 @@ struct net_device { - unsigned int mtu; - unsigned short type; - unsigned short hard_header_len; -+ unsigned short min_header_len; - - unsigned short needed_headroom; - unsigned short needed_tailroom; -@@ -2541,6 +2543,8 @@ static inline bool dev_validate_header(const struct net_device *dev, - { - if (likely(len >= dev->hard_header_len)) - return true; -+ if (len < dev->min_header_len) -+ return false; - - if (capable(CAP_SYS_RAWIO)) { - memset(ll_header + len, 0, dev->hard_header_len - len); -diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h -index 3ebb168b9afc..a34b141f125f 100644 ---- a/include/net/cipso_ipv4.h -+++ b/include/net/cipso_ipv4.h -@@ -309,6 +309,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb, - } - - for (opt_iter = 6; opt_iter < opt_len;) { -+ if (opt_iter + 1 == opt_len) { -+ err_offset = opt_iter; -+ goto out; -+ } - tag_len = opt[opt_iter + 1]; - if ((tag_len == 0) || (tag_len > (opt_len - opt_iter))) { - err_offset = opt_iter + 1; -diff --git a/net/can/af_can.c b/net/can/af_can.c -index 166d436196c1..928f58064098 100644 ---- a/net/can/af_can.c -+++ b/net/can/af_can.c -@@ -445,6 +445,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, - * @func: callback function on filter match - * @data: returned parameter for callback function - * @ident: string for calling module identification -+ * @sk: socket pointer (might be NULL) - * - * Description: - * Invokes the callback function with the received sk_buff and the given -@@ -468,7 +469,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, - */ - int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, - void (*func)(struct sk_buff *, void *), void *data, -- char *ident) -+ char *ident, struct sock *sk) - { - struct receiver *r; - struct hlist_head *rl; -@@ -496,6 +497,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, - r->func = func; - r->data = data; - r->ident = ident; -+ r->sk = sk; - - hlist_add_head_rcu(&r->list, rl); - d->entries++; -@@ -520,8 +522,11 @@ EXPORT_SYMBOL(can_rx_register); - static void can_rx_delete_receiver(struct rcu_head *rp) - { - struct receiver *r = container_of(rp, struct receiver, rcu); -+ struct sock *sk = r->sk; - - kmem_cache_free(rcv_cache, r); -+ if (sk) -+ sock_put(sk); - } - - /** -@@ -596,8 +601,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask, - spin_unlock(&can_rcvlists_lock); - - /* schedule the receiver item for deletion */ -- if (r) -+ if (r) { -+ if (r->sk) -+ sock_hold(r->sk); - call_rcu(&r->rcu, can_rx_delete_receiver); -+ } - } - EXPORT_SYMBOL(can_rx_unregister); - -diff --git a/net/can/af_can.h b/net/can/af_can.h -index fca0fe9fc45a..b86f5129e838 100644 ---- a/net/can/af_can.h -+++ b/net/can/af_can.h -@@ -50,13 +50,14 @@ - - struct receiver { - struct hlist_node list; -- struct rcu_head rcu; - canid_t can_id; - canid_t mask; - unsigned long matches; - void (*func)(struct sk_buff *, void *); - void *data; - char *ident; -+ struct sock *sk; -+ struct rcu_head rcu; - }; - - #define CAN_SFF_RCV_ARRAY_SZ (1 << CAN_SFF_ID_BITS) -diff --git a/net/can/bcm.c b/net/can/bcm.c -index 24d66c1cc0cd..4ccfd356baed 100644 ---- a/net/can/bcm.c -+++ b/net/can/bcm.c -@@ -1179,7 +1179,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - err = can_rx_register(dev, op->can_id, - REGMASK(op->can_id), - bcm_rx_handler, op, -- "bcm"); -+ "bcm", sk); - - op->rx_reg_dev = dev; - dev_put(dev); -@@ -1188,7 +1188,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, - } else - err = can_rx_register(NULL, op->can_id, - REGMASK(op->can_id), -- bcm_rx_handler, op, "bcm"); -+ bcm_rx_handler, op, "bcm", sk); - if (err) { - /* this bcm rx op is broken -> remove it */ - list_del(&op->list); -diff --git a/net/can/gw.c b/net/can/gw.c -index 455168718c2e..77c8af4047ef 100644 ---- a/net/can/gw.c -+++ b/net/can/gw.c -@@ -442,7 +442,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj) - { - return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id, - gwj->ccgw.filter.can_mask, can_can_gw_rcv, -- gwj, "gw"); -+ gwj, "gw", NULL); - } - - static inline void cgw_unregister_filter(struct cgw_job *gwj) -diff --git a/net/can/raw.c b/net/can/raw.c -index 56af689ca999..e9403a26a1d5 100644 ---- a/net/can/raw.c -+++ b/net/can/raw.c -@@ -190,7 +190,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk, - for (i = 0; i < count; i++) { - err = can_rx_register(dev, filter[i].can_id, - filter[i].can_mask, -- raw_rcv, sk, "raw"); -+ raw_rcv, sk, "raw", sk); - if (err) { - /* clean up successfully registered filters */ - while (--i >= 0) -@@ -211,7 +211,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk, - - if (err_mask) - err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG, -- raw_rcv, sk, "raw"); -+ raw_rcv, sk, "raw", sk); - - return err; - } -diff --git a/net/core/dev.c b/net/core/dev.c -index 0798a0f1b395..08215a85c742 100644 ---- a/net/core/dev.c -+++ b/net/core/dev.c -@@ -1676,24 +1676,19 @@ EXPORT_SYMBOL_GPL(net_dec_ingress_queue); - - static struct static_key netstamp_needed __read_mostly; - #ifdef HAVE_JUMP_LABEL --/* We are not allowed to call static_key_slow_dec() from irq context -- * If net_disable_timestamp() is called from irq context, defer the -- * static_key_slow_dec() calls. -- */ - static atomic_t netstamp_needed_deferred; --#endif -- --void net_enable_timestamp(void) -+static void netstamp_clear(struct work_struct *work) - { --#ifdef HAVE_JUMP_LABEL - int deferred = atomic_xchg(&netstamp_needed_deferred, 0); - -- if (deferred) { -- while (--deferred) -- static_key_slow_dec(&netstamp_needed); -- return; -- } -+ while (deferred--) -+ static_key_slow_dec(&netstamp_needed); -+} -+static DECLARE_WORK(netstamp_work, netstamp_clear); - #endif -+ -+void net_enable_timestamp(void) -+{ - static_key_slow_inc(&netstamp_needed); - } - EXPORT_SYMBOL(net_enable_timestamp); -@@ -1701,12 +1696,12 @@ EXPORT_SYMBOL(net_enable_timestamp); - void net_disable_timestamp(void) - { - #ifdef HAVE_JUMP_LABEL -- if (in_interrupt()) { -- atomic_inc(&netstamp_needed_deferred); -- return; -- } --#endif -+ /* net_disable_timestamp() can be called from non process context */ -+ atomic_inc(&netstamp_needed_deferred); -+ schedule_work(&netstamp_work); -+#else - static_key_slow_dec(&netstamp_needed); -+#endif - } - EXPORT_SYMBOL(net_disable_timestamp); - -diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c -index de85d4e1cf43..52dcd414c2af 100644 ---- a/net/ethernet/eth.c -+++ b/net/ethernet/eth.c -@@ -353,6 +353,7 @@ void ether_setup(struct net_device *dev) - dev->header_ops = ð_header_ops; - dev->type = ARPHRD_ETHER; - dev->hard_header_len = ETH_HLEN; -+ dev->min_header_len = ETH_HLEN; - dev->mtu = ETH_DATA_LEN; - dev->addr_len = ETH_ALEN; - dev->tx_queue_len = 1000; /* Ethernet wants good queues */ -diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c -index bdb2a07ec363..6cc3e1d602fb 100644 ---- a/net/ipv4/cipso_ipv4.c -+++ b/net/ipv4/cipso_ipv4.c -@@ -1657,6 +1657,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) - goto validate_return_locked; - } - -+ if (opt_iter + 1 == opt_len) { -+ err_offset = opt_iter; -+ goto validate_return_locked; -+ } - tag_len = tag[1]; - if (tag_len > (opt_len - opt_iter)) { - err_offset = opt_iter + 1; -diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c -index 9ce202549e7a..bc14c5bb124b 100644 ---- a/net/ipv4/ip_sockglue.c -+++ b/net/ipv4/ip_sockglue.c -@@ -1192,7 +1192,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb) - pktinfo->ipi_ifindex = 0; - pktinfo->ipi_spec_dst.s_addr = 0; - } -- skb_dst_drop(skb); -+ /* We need to keep the dst for __ip_options_echo() -+ * We could restrict the test to opt.ts_needtime || opt.srr, -+ * but the following is good enough as IP options are not often used. -+ */ -+ if (unlikely(IPCB(skb)->opt.optlen)) -+ skb_dst_force(skb); -+ else -+ skb_dst_drop(skb); - } - - int ip_setsockopt(struct sock *sk, int level, -diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c -index 23160d2b3f71..3a00512addbc 100644 ---- a/net/ipv4/ping.c -+++ b/net/ipv4/ping.c -@@ -645,6 +645,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh, - { - struct sk_buff *skb = skb_peek(&sk->sk_write_queue); - -+ if (!skb) -+ return 0; - pfh->wcheck = csum_partial((char *)&pfh->icmph, - sizeof(struct icmphdr), pfh->wcheck); - pfh->icmph.checksum = csum_fold(pfh->wcheck); -diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c -index 69daa81736f6..600dcda840d1 100644 ---- a/net/ipv4/tcp.c -+++ b/net/ipv4/tcp.c -@@ -783,6 +783,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos, - ret = -EAGAIN; - break; - } -+ /* if __tcp_splice_read() got nothing while we have -+ * an skb in receive queue, we do not want to loop. -+ * This might happen with URG data. -+ */ -+ if (!skb_queue_empty(&sk->sk_receive_queue)) -+ break; - sk_wait_data(sk, &timeo, NULL); - if (signal_pending(current)) { - ret = sock_intr_errno(timeo); -diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c -index 0795647e94c6..de95714d021c 100644 ---- a/net/ipv4/tcp_output.c -+++ b/net/ipv4/tcp_output.c -@@ -2383,9 +2383,11 @@ u32 __tcp_select_window(struct sock *sk) - int full_space = min_t(int, tp->window_clamp, allowed_space); - int window; - -- if (mss > full_space) -+ if (unlikely(mss > full_space)) { - mss = full_space; -- -+ if (mss <= 0) -+ return 0; -+ } - if (free_space < (full_space >> 1)) { - icsk->icsk_ack.quick = 0; - -diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c -index 17430f341073..e89135828c3d 100644 ---- a/net/ipv6/ip6_gre.c -+++ b/net/ipv6/ip6_gre.c -@@ -55,6 +55,7 @@ - #include - #include - #include -+#include - - - static bool log_ecn_error = true; -@@ -367,35 +368,37 @@ static void ip6gre_tunnel_uninit(struct net_device *dev) - - - static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt, -- u8 type, u8 code, int offset, __be32 info) -+ u8 type, u8 code, int offset, __be32 info) - { -- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data; -- __be16 *p = (__be16 *)(skb->data + offset); -- int grehlen = offset + 4; -+ const struct gre_base_hdr *greh; -+ const struct ipv6hdr *ipv6h; -+ int grehlen = sizeof(*greh); - struct ip6_tnl *t; -+ int key_off = 0; - __be16 flags; -+ __be32 key; - -- flags = p[0]; -- if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) { -- if (flags&(GRE_VERSION|GRE_ROUTING)) -- return; -- if (flags&GRE_KEY) { -- grehlen += 4; -- if (flags&GRE_CSUM) -- grehlen += 4; -- } -+ if (!pskb_may_pull(skb, offset + grehlen)) -+ return; -+ greh = (const struct gre_base_hdr *)(skb->data + offset); -+ flags = greh->flags; -+ if (flags & (GRE_VERSION | GRE_ROUTING)) -+ return; -+ if (flags & GRE_CSUM) -+ grehlen += 4; -+ if (flags & GRE_KEY) { -+ key_off = grehlen + offset; -+ grehlen += 4; - } - -- /* If only 8 bytes returned, keyed message will be dropped here */ -- if (!pskb_may_pull(skb, grehlen)) -+ if (!pskb_may_pull(skb, offset + grehlen)) - return; - ipv6h = (const struct ipv6hdr *)skb->data; -- p = (__be16 *)(skb->data + offset); -+ greh = (const struct gre_base_hdr *)(skb->data + offset); -+ key = key_off ? *(__be32 *)(skb->data + key_off) : 0; - - t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr, -- flags & GRE_KEY ? -- *(((__be32 *)p) + (grehlen / 4) - 1) : 0, -- p[1]); -+ key, greh->protocol); - if (!t) - return; - -diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c -index 2994d1f1a661..6c6161763c2f 100644 ---- a/net/ipv6/ip6_tunnel.c -+++ b/net/ipv6/ip6_tunnel.c -@@ -479,18 +479,19 @@ ip6_tnl_dev_uninit(struct net_device *dev) - - __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) - { -- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw; -- __u8 nexthdr = ipv6h->nexthdr; -- __u16 off = sizeof(*ipv6h); -+ const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; -+ unsigned int nhoff = raw - skb->data; -+ unsigned int off = nhoff + sizeof(*ipv6h); -+ u8 next, nexthdr = ipv6h->nexthdr; - - while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) { -- __u16 optlen = 0; - struct ipv6_opt_hdr *hdr; -- if (raw + off + sizeof(*hdr) > skb->data && -- !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr))) -+ u16 optlen; -+ -+ if (!pskb_may_pull(skb, off + sizeof(*hdr))) - break; - -- hdr = (struct ipv6_opt_hdr *) (raw + off); -+ hdr = (struct ipv6_opt_hdr *)(skb->data + off); - if (nexthdr == NEXTHDR_FRAGMENT) { - struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; - if (frag_hdr->frag_off) -@@ -501,20 +502,29 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) - } else { - optlen = ipv6_optlen(hdr); - } -+ /* cache hdr->nexthdr, since pskb_may_pull() might -+ * invalidate hdr -+ */ -+ next = hdr->nexthdr; - if (nexthdr == NEXTHDR_DEST) { -- __u16 i = off + 2; -+ u16 i = 2; -+ -+ /* Remember : hdr is no longer valid at this point. */ -+ if (!pskb_may_pull(skb, off + optlen)) -+ break; -+ - while (1) { - struct ipv6_tlv_tnl_enc_lim *tel; - - /* No more room for encapsulation limit */ -- if (i + sizeof (*tel) > off + optlen) -+ if (i + sizeof(*tel) > optlen) - break; - -- tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i]; -+ tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i); - /* return index of option if found and valid */ - if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT && - tel->length == 1) -- return i; -+ return i + off - nhoff; - /* else jump to next option */ - if (tel->type) - i += tel->length + 2; -@@ -522,7 +532,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) - i++; - } - } -- nexthdr = hdr->nexthdr; -+ nexthdr = next; - off += optlen; - } - return 0; -diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c -index 3da2b16356eb..184f0fe35dc6 100644 ---- a/net/ipv6/sit.c -+++ b/net/ipv6/sit.c -@@ -1389,6 +1389,7 @@ static int ipip6_tunnel_init(struct net_device *dev) - tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst); - if (!tunnel->dst_cache) { - free_percpu(dev->tstats); -+ dev->tstats = NULL; - return -ENOMEM; - } - -diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 5f581616bf6a..76a8c8057a23 100644 ---- a/net/ipv6/tcp_ipv6.c -+++ b/net/ipv6/tcp_ipv6.c -@@ -974,6 +974,16 @@ drop: - return 0; /* don't send reset */ - } - -+static void tcp_v6_restore_cb(struct sk_buff *skb) -+{ -+ /* We need to move header back to the beginning if xfrm6_policy_check() -+ * and tcp_v6_fill_cb() are going to be called again. -+ * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there. -+ */ -+ memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6, -+ sizeof(struct inet6_skb_parm)); -+} -+ - static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *skb, - struct request_sock *req, - struct dst_entry *dst, -@@ -1163,8 +1173,10 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff * - sk_gfp_atomic(sk, GFP_ATOMIC)); - consume_skb(ireq->pktopts); - ireq->pktopts = NULL; -- if (newnp->pktoptions) -+ if (newnp->pktoptions) { -+ tcp_v6_restore_cb(newnp->pktoptions); - skb_set_owner_r(newnp->pktoptions, newsk); -+ } - } - } - -@@ -1179,16 +1191,6 @@ out: - return NULL; - } - --static void tcp_v6_restore_cb(struct sk_buff *skb) --{ -- /* We need to move header back to the beginning if xfrm6_policy_check() -- * and tcp_v6_fill_cb() are going to be called again. -- * ip6_datagram_recv_specific_ctl() also expects IP6CB to be there. -- */ -- memmove(IP6CB(skb), &TCP_SKB_CB(skb)->header.h6, -- sizeof(struct inet6_skb_parm)); --} -- - /* The socket must have it's spinlock held when we get - * here, unless it is a TCP_LISTEN socket. - * -diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h -index 5871537af387..763e8e241ce3 100644 ---- a/net/l2tp/l2tp_core.h -+++ b/net/l2tp/l2tp_core.h -@@ -273,6 +273,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, - int l2tp_nl_register_ops(enum l2tp_pwtype pw_type, - const struct l2tp_nl_cmd_ops *ops); - void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type); -+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg); - - /* Session reference counts. Incremented when code obtains a reference - * to a session. -diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c -index d0e906d39642..445b7cd0826a 100644 ---- a/net/l2tp/l2tp_ip.c -+++ b/net/l2tp/l2tp_ip.c -@@ -11,6 +11,7 @@ - - #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt - -+#include - #include - #include - #include -@@ -555,6 +556,30 @@ out: - return err ? err : copied; - } - -+int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg) -+{ -+ struct sk_buff *skb; -+ int amount; -+ -+ switch (cmd) { -+ case SIOCOUTQ: -+ amount = sk_wmem_alloc_get(sk); -+ break; -+ case SIOCINQ: -+ spin_lock_bh(&sk->sk_receive_queue.lock); -+ skb = skb_peek(&sk->sk_receive_queue); -+ amount = skb ? skb->len : 0; -+ spin_unlock_bh(&sk->sk_receive_queue.lock); -+ break; -+ -+ default: -+ return -ENOIOCTLCMD; -+ } -+ -+ return put_user(amount, (int __user *)arg); -+} -+EXPORT_SYMBOL(l2tp_ioctl); -+ - static struct proto l2tp_ip_prot = { - .name = "L2TP/IP", - .owner = THIS_MODULE, -@@ -563,7 +588,7 @@ static struct proto l2tp_ip_prot = { - .bind = l2tp_ip_bind, - .connect = l2tp_ip_connect, - .disconnect = l2tp_ip_disconnect, -- .ioctl = udp_ioctl, -+ .ioctl = l2tp_ioctl, - .destroy = l2tp_ip_destroy_sock, - .setsockopt = ip_setsockopt, - .getsockopt = ip_getsockopt, -diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c -index 3c4f867d3633..bcdab1cba773 100644 ---- a/net/l2tp/l2tp_ip6.c -+++ b/net/l2tp/l2tp_ip6.c -@@ -714,7 +714,7 @@ static struct proto l2tp_ip6_prot = { - .bind = l2tp_ip6_bind, - .connect = l2tp_ip6_connect, - .disconnect = l2tp_ip6_disconnect, -- .ioctl = udp_ioctl, -+ .ioctl = l2tp_ioctl, - .destroy = l2tp_ip6_destroy_sock, - .setsockopt = ipv6_setsockopt, - .getsockopt = ipv6_getsockopt, -diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c -index f223d1c80ccf..f2d28ed74a0a 100644 ---- a/net/packet/af_packet.c -+++ b/net/packet/af_packet.c -@@ -2637,7 +2637,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - int vnet_hdr_len; - struct packet_sock *po = pkt_sk(sk); - unsigned short gso_type = 0; -- int hlen, tlen; -+ int hlen, tlen, linear; - int extra_len = 0; - ssize_t n; - -@@ -2741,8 +2741,9 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len) - err = -ENOBUFS; - hlen = LL_RESERVED_SPACE(dev); - tlen = dev->needed_tailroom; -- skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, -- __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len), -+ linear = __virtio16_to_cpu(vio_le(), vnet_hdr.hdr_len); -+ linear = max(linear, min_t(int, len, dev->hard_header_len)); -+ skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, linear, - msg->msg_flags & MSG_DONTWAIT, &err); - if (skb == NULL) - goto out_unlock; -diff --git a/net/sctp/socket.c b/net/sctp/socket.c -index b5fd4ab56156..138f2d667212 100644 ---- a/net/sctp/socket.c -+++ b/net/sctp/socket.c -@@ -6960,7 +6960,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, - */ - release_sock(sk); - current_timeo = schedule_timeout(current_timeo); -- BUG_ON(sk != asoc->base.sk); -+ if (sk != asoc->base.sk) -+ goto do_error; - lock_sock(sk); - - *timeo_p = current_timeo; diff --git a/patch/kernel/mvebu-default/03-patch-4.4.50-51.patch b/patch/kernel/mvebu-default/03-patch-4.4.50-51.patch deleted file mode 100644 index 77732c892..000000000 --- a/patch/kernel/mvebu-default/03-patch-4.4.50-51.patch +++ /dev/null @@ -1,368 +0,0 @@ -diff --git a/Makefile b/Makefile -index 10993715abb8..117357188f01 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 4 - PATCHLEVEL = 4 --SUBLEVEL = 50 -+SUBLEVEL = 51 - EXTRAVERSION = - NAME = Blurry Fish Butt - -diff --git a/arch/arm/lib/getuser.S b/arch/arm/lib/getuser.S -index 8ecfd15c3a02..df73914e81c8 100644 ---- a/arch/arm/lib/getuser.S -+++ b/arch/arm/lib/getuser.S -@@ -67,7 +67,7 @@ ENTRY(__get_user_4) - ENDPROC(__get_user_4) - - ENTRY(__get_user_8) -- check_uaccess r0, 8, r1, r2, __get_user_bad -+ check_uaccess r0, 8, r1, r2, __get_user_bad8 - #ifdef CONFIG_THUMB2_KERNEL - 5: TUSER(ldr) r2, [r0] - 6: TUSER(ldr) r3, [r0, #4] -diff --git a/drivers/gpu/drm/drm_dp_mst_topology.c b/drivers/gpu/drm/drm_dp_mst_topology.c -index 7cb2815e815e..a3b96d691ac9 100644 ---- a/drivers/gpu/drm/drm_dp_mst_topology.c -+++ b/drivers/gpu/drm/drm_dp_mst_topology.c -@@ -1812,7 +1812,7 @@ int drm_dp_update_payload_part1(struct drm_dp_mst_topology_mgr *mgr) - mgr->payloads[i].num_slots = req_payload.num_slots; - } else if (mgr->payloads[i].num_slots) { - mgr->payloads[i].num_slots = 0; -- drm_dp_destroy_payload_step1(mgr, port, port->vcpi.vcpi, &mgr->payloads[i]); -+ drm_dp_destroy_payload_step1(mgr, port, mgr->payloads[i].vcpi, &mgr->payloads[i]); - req_payload.payload_state = mgr->payloads[i].payload_state; - mgr->payloads[i].start_slot = 0; - } -diff --git a/drivers/gpu/drm/radeon/radeon_cursor.c b/drivers/gpu/drm/radeon/radeon_cursor.c -index 04cec0da5d1e..8901228b5d5d 100644 ---- a/drivers/gpu/drm/radeon/radeon_cursor.c -+++ b/drivers/gpu/drm/radeon/radeon_cursor.c -@@ -205,8 +205,8 @@ static int radeon_cursor_move_locked(struct drm_crtc *crtc, int x, int y) - } - - if (x <= (crtc->x - w) || y <= (crtc->y - radeon_crtc->cursor_height) || -- x >= (crtc->x + crtc->mode.crtc_hdisplay) || -- y >= (crtc->y + crtc->mode.crtc_vdisplay)) -+ x >= (crtc->x + crtc->mode.hdisplay) || -+ y >= (crtc->y + crtc->mode.vdisplay)) - goto out_of_bounds; - - x += xorigin; -diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c -index d15b33813021..ed1935f300a7 100644 ---- a/drivers/input/mouse/elan_i2c_core.c -+++ b/drivers/input/mouse/elan_i2c_core.c -@@ -1232,6 +1232,7 @@ static const struct acpi_device_id elan_acpi_id[] = { - { "ELAN0000", 0 }, - { "ELAN0100", 0 }, - { "ELAN0600", 0 }, -+ { "ELAN0605", 0 }, - { "ELAN1000", 0 }, - { } - }; -diff --git a/drivers/md/bcache/bcache.h b/drivers/md/bcache/bcache.h -index 6b420a55c745..c3ea03c9a1a8 100644 ---- a/drivers/md/bcache/bcache.h -+++ b/drivers/md/bcache/bcache.h -@@ -425,7 +425,7 @@ struct cache { - * until a gc finishes - otherwise we could pointlessly burn a ton of - * cpu - */ -- unsigned invalidate_needs_gc:1; -+ unsigned invalidate_needs_gc; - - bool discard; /* Get rid of? */ - -@@ -593,8 +593,8 @@ struct cache_set { - - /* Counts how many sectors bio_insert has added to the cache */ - atomic_t sectors_to_gc; -+ wait_queue_head_t gc_wait; - -- wait_queue_head_t moving_gc_wait; - struct keybuf moving_gc_keys; - /* Number of moving GC bios in flight */ - struct semaphore moving_in_flight; -diff --git a/drivers/md/bcache/btree.c b/drivers/md/bcache/btree.c -index 22b9e34ceb75..5b815e64c1c9 100644 ---- a/drivers/md/bcache/btree.c -+++ b/drivers/md/bcache/btree.c -@@ -1762,33 +1762,34 @@ static void bch_btree_gc(struct cache_set *c) - bch_moving_gc(c); - } - --static int bch_gc_thread(void *arg) -+static bool gc_should_run(struct cache_set *c) - { -- struct cache_set *c = arg; - struct cache *ca; - unsigned i; - -- while (1) { --again: -- bch_btree_gc(c); -+ for_each_cache(ca, c, i) -+ if (ca->invalidate_needs_gc) -+ return true; - -- set_current_state(TASK_INTERRUPTIBLE); -- if (kthread_should_stop()) -- break; -+ if (atomic_read(&c->sectors_to_gc) < 0) -+ return true; - -- mutex_lock(&c->bucket_lock); -+ return false; -+} - -- for_each_cache(ca, c, i) -- if (ca->invalidate_needs_gc) { -- mutex_unlock(&c->bucket_lock); -- set_current_state(TASK_RUNNING); -- goto again; -- } -+static int bch_gc_thread(void *arg) -+{ -+ struct cache_set *c = arg; - -- mutex_unlock(&c->bucket_lock); -+ while (1) { -+ wait_event_interruptible(c->gc_wait, -+ kthread_should_stop() || gc_should_run(c)); - -- try_to_freeze(); -- schedule(); -+ if (kthread_should_stop()) -+ break; -+ -+ set_gc_sectors(c); -+ bch_btree_gc(c); - } - - return 0; -@@ -1796,11 +1797,10 @@ again: - - int bch_gc_thread_start(struct cache_set *c) - { -- c->gc_thread = kthread_create(bch_gc_thread, c, "bcache_gc"); -+ c->gc_thread = kthread_run(bch_gc_thread, c, "bcache_gc"); - if (IS_ERR(c->gc_thread)) - return PTR_ERR(c->gc_thread); - -- set_task_state(c->gc_thread, TASK_INTERRUPTIBLE); - return 0; - } - -diff --git a/drivers/md/bcache/btree.h b/drivers/md/bcache/btree.h -index 5c391fa01bed..9b80417cd547 100644 ---- a/drivers/md/bcache/btree.h -+++ b/drivers/md/bcache/btree.h -@@ -260,8 +260,7 @@ void bch_initial_mark_key(struct cache_set *, int, struct bkey *); - - static inline void wake_up_gc(struct cache_set *c) - { -- if (c->gc_thread) -- wake_up_process(c->gc_thread); -+ wake_up(&c->gc_wait); - } - - #define MAP_DONE 0 -diff --git a/drivers/md/bcache/request.c b/drivers/md/bcache/request.c -index 25fa8445bb24..2410df1c2a05 100644 ---- a/drivers/md/bcache/request.c -+++ b/drivers/md/bcache/request.c -@@ -196,10 +196,8 @@ static void bch_data_insert_start(struct closure *cl) - struct data_insert_op *op = container_of(cl, struct data_insert_op, cl); - struct bio *bio = op->bio, *n; - -- if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) { -- set_gc_sectors(op->c); -+ if (atomic_sub_return(bio_sectors(bio), &op->c->sectors_to_gc) < 0) - wake_up_gc(op->c); -- } - - if (op->bypass) - return bch_data_invalidate(cl); -diff --git a/drivers/md/bcache/super.c b/drivers/md/bcache/super.c -index 3d5c0ba13181..7b5880b8874c 100644 ---- a/drivers/md/bcache/super.c -+++ b/drivers/md/bcache/super.c -@@ -1489,6 +1489,7 @@ struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) - mutex_init(&c->bucket_lock); - init_waitqueue_head(&c->btree_cache_wait); - init_waitqueue_head(&c->bucket_wait); -+ init_waitqueue_head(&c->gc_wait); - sema_init(&c->uuid_write_mutex, 1); - - spin_lock_init(&c->btree_gc_time.lock); -@@ -1547,6 +1548,7 @@ static void run_cache_set(struct cache_set *c) - - for_each_cache(ca, c, i) - c->nbuckets += ca->sb.nbuckets; -+ set_gc_sectors(c); - - if (CACHE_SYNC(&c->sb)) { - LIST_HEAD(journal); -diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c -index c945e4c2fbd4..ec30a004f319 100644 ---- a/drivers/media/usb/siano/smsusb.c -+++ b/drivers/media/usb/siano/smsusb.c -@@ -200,22 +200,30 @@ static int smsusb_start_streaming(struct smsusb_device_t *dev) - static int smsusb_sendrequest(void *context, void *buffer, size_t size) - { - struct smsusb_device_t *dev = (struct smsusb_device_t *) context; -- struct sms_msg_hdr *phdr = (struct sms_msg_hdr *) buffer; -- int dummy; -+ struct sms_msg_hdr *phdr; -+ int dummy, ret; - - if (dev->state != SMSUSB_ACTIVE) { - pr_debug("Device not active yet\n"); - return -ENOENT; - } - -+ phdr = kmalloc(size, GFP_KERNEL); -+ if (!phdr) -+ return -ENOMEM; -+ memcpy(phdr, buffer, size); -+ - pr_debug("sending %s(%d) size: %d\n", - smscore_translate_msg(phdr->msg_type), phdr->msg_type, - phdr->msg_length); - - smsendian_handle_tx_message((struct sms_msg_data *) phdr); -- smsendian_handle_message_header((struct sms_msg_hdr *)buffer); -- return usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 2), -- buffer, size, &dummy, 1000); -+ smsendian_handle_message_header((struct sms_msg_hdr *)phdr); -+ ret = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 2), -+ phdr, size, &dummy, 1000); -+ -+ kfree(phdr); -+ return ret; - } - - static char *smsusb1_fw_lkup[] = { -diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c -index 78187699467a..79a0c26e1419 100644 ---- a/drivers/mmc/core/mmc.c -+++ b/drivers/mmc/core/mmc.c -@@ -1581,10 +1581,10 @@ static int mmc_init_card(struct mmc_host *host, u32 ocr, - err = mmc_select_hs400(card); - if (err) - goto free_card; -- } else if (mmc_card_hs(card)) { -+ } else { - /* Select the desired bus width optionally */ - err = mmc_select_bus_width(card); -- if (!IS_ERR_VALUE(err)) { -+ if (!IS_ERR_VALUE(err) && mmc_card_hs(card)) { - err = mmc_select_hs_ddr(card); - if (err) - goto free_card; -diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c -index 60654d524858..ecc6fb9ca92f 100644 ---- a/drivers/ntb/ntb_transport.c -+++ b/drivers/ntb/ntb_transport.c -@@ -1623,7 +1623,7 @@ ntb_transport_create_queue(void *data, struct device *client_dev, - - node = dev_to_node(&ndev->dev); - -- free_queue = ffs(nt->qp_bitmap); -+ free_queue = ffs(nt->qp_bitmap_free); - if (!free_queue) - goto err; - -@@ -2082,9 +2082,8 @@ module_init(ntb_transport_init); - - static void __exit ntb_transport_exit(void) - { -- debugfs_remove_recursive(nt_debugfs_dir); -- - ntb_unregister_client(&ntb_transport_client); - bus_unregister(&ntb_transport_bus); -+ debugfs_remove_recursive(nt_debugfs_dir); - } - module_exit(ntb_transport_exit); -diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c -index cf5b99e1f12b..8558e3886960 100644 ---- a/drivers/scsi/scsi_lib.c -+++ b/drivers/scsi/scsi_lib.c -@@ -1120,7 +1120,8 @@ int scsi_init_io(struct scsi_cmnd *cmd) - bool is_mq = (rq->mq_ctx != NULL); - int error; - -- BUG_ON(!rq->nr_phys_segments); -+ if (WARN_ON_ONCE(!rq->nr_phys_segments)) -+ return -EINVAL; - - error = scsi_init_sgtable(rq, &cmd->sdb); - if (error) -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index a1c29b0afb22..dedcff9cabb5 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -1763,6 +1763,10 @@ sg_start_req(Sg_request *srp, unsigned char *cmd) - return res; - - iov_iter_truncate(&i, hp->dxfer_len); -+ if (!iov_iter_count(&i)) { -+ kfree(iov); -+ return -EINVAL; -+ } - - res = blk_rq_map_user_iov(q, rq, md, &i, GFP_ATOMIC); - kfree(iov); -diff --git a/fs/fuse/dev.c b/fs/fuse/dev.c -index 9096d44eb221..d0cf1f010fbe 100644 ---- a/fs/fuse/dev.c -+++ b/fs/fuse/dev.c -@@ -418,6 +418,10 @@ static void request_end(struct fuse_conn *fc, struct fuse_req *req) - static void queue_interrupt(struct fuse_iqueue *fiq, struct fuse_req *req) - { - spin_lock(&fiq->waitq.lock); -+ if (test_bit(FR_FINISHED, &req->flags)) { -+ spin_unlock(&fiq->waitq.lock); -+ return; -+ } - if (list_empty(&req->intr_entry)) { - list_add_tail(&req->intr_entry, &fiq->interrupts); - wake_up_locked(&fiq->waitq); -diff --git a/fs/splice.c b/fs/splice.c -index 0f77e9682857..8398974e1538 100644 ---- a/fs/splice.c -+++ b/fs/splice.c -@@ -211,6 +211,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, - buf->len = spd->partial[page_nr].len; - buf->private = spd->partial[page_nr].private; - buf->ops = spd->ops; -+ buf->flags = 0; - if (spd->flags & SPLICE_F_GIFT) - buf->flags |= PIPE_BUF_FLAG_GIFT; - -diff --git a/kernel/futex.c b/kernel/futex.c -index 9d8163afd87c..9d251dc3ec40 100644 ---- a/kernel/futex.c -+++ b/kernel/futex.c -@@ -3199,4 +3199,4 @@ static int __init futex_init(void) - - return 0; - } --__initcall(futex_init); -+core_initcall(futex_init); -diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c -index c048e34b177f..0b5613554769 100644 ---- a/kernel/printk/printk.c -+++ b/kernel/printk/printk.c -@@ -1436,7 +1436,7 @@ static void call_console_drivers(int level, - { - struct console *con; - -- trace_console(text, len); -+ trace_console_rcuidle(text, len); - - if (level >= console_loglevel && !ignore_loglevel) - return;