[gentoo-commits] proj/linux-patches:4.9 commit in: /

["Alice Ferrazzi" <alicef@gentoo.org>]

commit:     974c350d3dc7a84302e830fb2d2443cbc8cd1b91
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sat Dec 16 17:42:46 2017 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sat Dec 16 17:42:46 2017 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=974c350d

linux kernel 4.9.70

 0000_README             |    4 +
 1069_linux-4.9.70.patch | 1073 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1077 insertions(+)

diff --git a/0000_README b/0000_README
index 4f00249..085faed 100644
--- a/0000_README
+++ b/0000_README
@@ -319,6 +319,10 @@ Patch:  1068_linux-4.9.69.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.69
 
+Patch:  1069_linux-4.9.70.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.70
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1069_linux-4.9.70.patch b/1069_linux-4.9.70.patch
new file mode 100644
index 0000000..8d87b3e
--- /dev/null
+++ b/1069_linux-4.9.70.patch
@@ -0,0 +1,1073 @@
+diff --git a/Makefile b/Makefile
+index 8f2819bf8135..7ad3271a1a1d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 69
++SUBLEVEL = 70
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+@@ -370,9 +370,6 @@ LDFLAGS_MODULE  =
+ CFLAGS_KERNEL	=
+ AFLAGS_KERNEL	=
+ LDFLAGS_vmlinux =
+-CFLAGS_GCOV	:= -fprofile-arcs -ftest-coverage -fno-tree-loop-im $(call cc-disable-warning,maybe-uninitialized,)
+-CFLAGS_KCOV	:= $(call cc-option,-fsanitize-coverage=trace-pc,)
+-
+ 
+ # Use USERINCLUDE when you must reference the UAPI directories only.
+ USERINCLUDE    := \
+@@ -393,21 +390,19 @@ LINUXINCLUDE    := \
+ 
+ LINUXINCLUDE	+= $(filter-out $(LINUXINCLUDE),$(USERINCLUDE))
+ 
+-KBUILD_CPPFLAGS := -D__KERNEL__
+-
++KBUILD_AFLAGS   := -D__ASSEMBLY__
+ KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ 		   -fno-strict-aliasing -fno-common \
+ 		   -Werror-implicit-function-declaration \
+ 		   -Wno-format-security \
+-		   -std=gnu89 $(call cc-option,-fno-PIE)
+-
+-
++		   -std=gnu89
++KBUILD_CPPFLAGS := -D__KERNEL__
+ KBUILD_AFLAGS_KERNEL :=
+ KBUILD_CFLAGS_KERNEL :=
+-KBUILD_AFLAGS   := -D__ASSEMBLY__ $(call cc-option,-fno-PIE)
+ KBUILD_AFLAGS_MODULE  := -DMODULE
+ KBUILD_CFLAGS_MODULE  := -DMODULE
+ KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds
++GCC_PLUGINS_CFLAGS :=
+ 
+ # Read KERNELRELEASE from include/config/kernel.release (if it exists)
+ KERNELRELEASE = $(shell cat include/config/kernel.release 2> /dev/null)
+@@ -420,7 +415,7 @@ export MAKE AWK GENKSYMS INSTALLKERNEL PERL PYTHON UTS_MACHINE
+ export HOSTCXX HOSTCXXFLAGS LDFLAGS_MODULE CHECK CHECKFLAGS
+ 
+ export KBUILD_CPPFLAGS NOSTDINC_FLAGS LINUXINCLUDE OBJCOPYFLAGS LDFLAGS
+-export KBUILD_CFLAGS CFLAGS_KERNEL CFLAGS_MODULE CFLAGS_GCOV CFLAGS_KCOV CFLAGS_KASAN CFLAGS_UBSAN
++export KBUILD_CFLAGS CFLAGS_KERNEL CFLAGS_MODULE CFLAGS_KASAN CFLAGS_UBSAN
+ export KBUILD_AFLAGS AFLAGS_KERNEL AFLAGS_MODULE
+ export KBUILD_AFLAGS_MODULE KBUILD_CFLAGS_MODULE KBUILD_LDFLAGS_MODULE
+ export KBUILD_AFLAGS_KERNEL KBUILD_CFLAGS_KERNEL
+@@ -620,6 +615,12 @@ endif
+ # Defaults to vmlinux, but the arch makefile usually adds further targets
+ all: vmlinux
+ 
++KBUILD_CFLAGS	+= $(call cc-option,-fno-PIE)
++KBUILD_AFLAGS	+= $(call cc-option,-fno-PIE)
++CFLAGS_GCOV	:= -fprofile-arcs -ftest-coverage -fno-tree-loop-im $(call cc-disable-warning,maybe-uninitialized,)
++CFLAGS_KCOV	:= $(call cc-option,-fsanitize-coverage=trace-pc,)
++export CFLAGS_GCOV CFLAGS_KCOV
++
+ # The arch Makefile can set ARCH_{CPP,A,C}FLAGS to override the default
+ # values of the respective KBUILD_* variables
+ ARCH_CPPFLAGS :=
+diff --git a/arch/powerpc/include/asm/checksum.h b/arch/powerpc/include/asm/checksum.h
+index a67bb09585f4..430d038eb2a4 100644
+--- a/arch/powerpc/include/asm/checksum.h
++++ b/arch/powerpc/include/asm/checksum.h
+@@ -53,17 +53,25 @@ static inline __sum16 csum_fold(__wsum sum)
+ 	return (__force __sum16)(~((__force u32)sum + tmp) >> 16);
+ }
+ 
++static inline u32 from64to32(u64 x)
++{
++	/* add up 32-bit and 32-bit for 32+c bit */
++	x = (x & 0xffffffff) + (x >> 32);
++	/* add up carry.. */
++	x = (x & 0xffffffff) + (x >> 32);
++	return (u32)x;
++}
++
+ static inline __wsum csum_tcpudp_nofold(__be32 saddr, __be32 daddr, __u32 len,
+ 					__u8 proto, __wsum sum)
+ {
+ #ifdef __powerpc64__
+-	unsigned long s = (__force u32)sum;
++	u64 s = (__force u32)sum;
+ 
+ 	s += (__force u32)saddr;
+ 	s += (__force u32)daddr;
+ 	s += proto + len;
+-	s += (s >> 32);
+-	return (__force __wsum) s;
++	return (__force __wsum) from64to32(s);
+ #else
+     __asm__("\n\
+ 	addc %0,%0,%1 \n\
+@@ -123,8 +131,7 @@ static inline __wsum ip_fast_csum_nofold(const void *iph, unsigned int ihl)
+ 
+ 	for (i = 0; i < ihl - 1; i++, ptr++)
+ 		s += *ptr;
+-	s += (s >> 32);
+-	return (__force __wsum)s;
++	return (__force __wsum)from64to32(s);
+ #else
+ 	__wsum sum, tmp;
+ 
+diff --git a/arch/s390/include/asm/switch_to.h b/arch/s390/include/asm/switch_to.h
+index dde6b52359c5..ff2fbdafe689 100644
+--- a/arch/s390/include/asm/switch_to.h
++++ b/arch/s390/include/asm/switch_to.h
+@@ -29,17 +29,16 @@ static inline void restore_access_regs(unsigned int *acrs)
+ }
+ 
+ #define switch_to(prev,next,last) do {					\
+-	if (prev->mm) {							\
+-		save_fpu_regs();					\
+-		save_access_regs(&prev->thread.acrs[0]);		\
+-		save_ri_cb(prev->thread.ri_cb);				\
+-	}								\
++	/* save_fpu_regs() sets the CIF_FPU flag, which enforces	\
++	 * a restore of the floating point / vector registers as	\
++	 * soon as the next task returns to user space			\
++	 */								\
++	save_fpu_regs();						\
++	save_access_regs(&prev->thread.acrs[0]);			\
++	save_ri_cb(prev->thread.ri_cb);					\
+ 	update_cr_regs(next);						\
+-	if (next->mm) {							\
+-		set_cpu_flag(CIF_FPU);					\
+-		restore_access_regs(&next->thread.acrs[0]);		\
+-		restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);	\
+-	}								\
++	restore_access_regs(&next->thread.acrs[0]);			\
++	restore_ri_cb(next->thread.ri_cb, prev->thread.ri_cb);		\
+ 	prev = __switch_to(prev,next);					\
+ } while (0)
+ 
+diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
+index a112c0146012..e0a53156b782 100644
+--- a/drivers/char/ipmi/ipmi_si_intf.c
++++ b/drivers/char/ipmi/ipmi_si_intf.c
+@@ -241,6 +241,9 @@ struct smi_info {
+ 	/* The timer for this si. */
+ 	struct timer_list   si_timer;
+ 
++	/* This flag is set, if the timer can be set */
++	bool		    timer_can_start;
++
+ 	/* This flag is set, if the timer is running (timer_pending() isn't enough) */
+ 	bool		    timer_running;
+ 
+@@ -416,6 +419,8 @@ static enum si_sm_result start_next_msg(struct smi_info *smi_info)
+ 
+ static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
+ {
++	if (!smi_info->timer_can_start)
++		return;
+ 	smi_info->last_timeout_jiffies = jiffies;
+ 	mod_timer(&smi_info->si_timer, new_val);
+ 	smi_info->timer_running = true;
+@@ -435,21 +440,18 @@ static void start_new_msg(struct smi_info *smi_info, unsigned char *msg,
+ 	smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
+ }
+ 
+-static void start_check_enables(struct smi_info *smi_info, bool start_timer)
++static void start_check_enables(struct smi_info *smi_info)
+ {
+ 	unsigned char msg[2];
+ 
+ 	msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
+ 	msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
+ 
+-	if (start_timer)
+-		start_new_msg(smi_info, msg, 2);
+-	else
+-		smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
++	start_new_msg(smi_info, msg, 2);
+ 	smi_info->si_state = SI_CHECKING_ENABLES;
+ }
+ 
+-static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
++static void start_clear_flags(struct smi_info *smi_info)
+ {
+ 	unsigned char msg[3];
+ 
+@@ -458,10 +460,7 @@ static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
+ 	msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
+ 	msg[2] = WDT_PRE_TIMEOUT_INT;
+ 
+-	if (start_timer)
+-		start_new_msg(smi_info, msg, 3);
+-	else
+-		smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
++	start_new_msg(smi_info, msg, 3);
+ 	smi_info->si_state = SI_CLEARING_FLAGS;
+ }
+ 
+@@ -496,11 +495,11 @@ static void start_getting_events(struct smi_info *smi_info)
+  * Note that we cannot just use disable_irq(), since the interrupt may
+  * be shared.
+  */
+-static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
++static inline bool disable_si_irq(struct smi_info *smi_info)
+ {
+ 	if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
+ 		smi_info->interrupt_disabled = true;
+-		start_check_enables(smi_info, start_timer);
++		start_check_enables(smi_info);
+ 		return true;
+ 	}
+ 	return false;
+@@ -510,7 +509,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info)
+ {
+ 	if ((smi_info->irq) && (smi_info->interrupt_disabled)) {
+ 		smi_info->interrupt_disabled = false;
+-		start_check_enables(smi_info, true);
++		start_check_enables(smi_info);
+ 		return true;
+ 	}
+ 	return false;
+@@ -528,7 +527,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
+ 
+ 	msg = ipmi_alloc_smi_msg();
+ 	if (!msg) {
+-		if (!disable_si_irq(smi_info, true))
++		if (!disable_si_irq(smi_info))
+ 			smi_info->si_state = SI_NORMAL;
+ 	} else if (enable_si_irq(smi_info)) {
+ 		ipmi_free_smi_msg(msg);
+@@ -544,7 +543,7 @@ static void handle_flags(struct smi_info *smi_info)
+ 		/* Watchdog pre-timeout */
+ 		smi_inc_stat(smi_info, watchdog_pretimeouts);
+ 
+-		start_clear_flags(smi_info, true);
++		start_clear_flags(smi_info);
+ 		smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
+ 		if (smi_info->intf)
+ 			ipmi_smi_watchdog_pretimeout(smi_info->intf);
+@@ -927,7 +926,7 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
+ 		 * disable and messages disabled.
+ 		 */
+ 		if (smi_info->supports_event_msg_buff || smi_info->irq) {
+-			start_check_enables(smi_info, true);
++			start_check_enables(smi_info);
+ 		} else {
+ 			smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
+ 			if (!smi_info->curr_msg)
+@@ -1234,6 +1233,7 @@ static int smi_start_processing(void       *send_info,
+ 
+ 	/* Set up the timer that drives the interface. */
+ 	setup_timer(&new_smi->si_timer, smi_timeout, (long)new_smi);
++	new_smi->timer_can_start = true;
+ 	smi_mod_timer(new_smi, jiffies + SI_TIMEOUT_JIFFIES);
+ 
+ 	/* Try to claim any interrupts. */
+@@ -3448,10 +3448,12 @@ static void check_for_broken_irqs(struct smi_info *smi_info)
+ 	check_set_rcv_irq(smi_info);
+ }
+ 
+-static inline void wait_for_timer_and_thread(struct smi_info *smi_info)
++static inline void stop_timer_and_thread(struct smi_info *smi_info)
+ {
+ 	if (smi_info->thread != NULL)
+ 		kthread_stop(smi_info->thread);
++
++	smi_info->timer_can_start = false;
+ 	if (smi_info->timer_running)
+ 		del_timer_sync(&smi_info->si_timer);
+ }
+@@ -3593,7 +3595,7 @@ static int try_smi_init(struct smi_info *new_smi)
+ 	 * Start clearing the flags before we enable interrupts or the
+ 	 * timer to avoid racing with the timer.
+ 	 */
+-	start_clear_flags(new_smi, false);
++	start_clear_flags(new_smi);
+ 
+ 	/*
+ 	 * IRQ is defined to be set when non-zero.  req_events will
+@@ -3671,7 +3673,7 @@ static int try_smi_init(struct smi_info *new_smi)
+ 	return 0;
+ 
+ out_err_stop_timer:
+-	wait_for_timer_and_thread(new_smi);
++	stop_timer_and_thread(new_smi);
+ 
+ out_err:
+ 	new_smi->interrupt_disabled = true;
+@@ -3865,7 +3867,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
+ 	 */
+ 	if (to_clean->irq_cleanup)
+ 		to_clean->irq_cleanup(to_clean);
+-	wait_for_timer_and_thread(to_clean);
++	stop_timer_and_thread(to_clean);
+ 
+ 	/*
+ 	 * Timeouts are stopped, now make sure the interrupts are off
+@@ -3876,7 +3878,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
+ 		poll(to_clean);
+ 		schedule_timeout_uninterruptible(1);
+ 	}
+-	disable_si_irq(to_clean, false);
++	disable_si_irq(to_clean);
+ 	while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
+ 		poll(to_clean);
+ 		schedule_timeout_uninterruptible(1);
+diff --git a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
+index 010c709ba3bb..58c531db4f4a 100644
+--- a/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
++++ b/drivers/infiniband/hw/cxgb4/t4fw_ri_api.h
+@@ -675,8 +675,8 @@ struct fw_ri_fr_nsmr_tpte_wr {
+ 	__u16  wrid;
+ 	__u8   r1[3];
+ 	__u8   len16;
+-	__u32  r2;
+-	__u32  stag;
++	__be32  r2;
++	__be32  stag;
+ 	struct fw_ri_tpte tpte;
+ 	__u64  pbl[2];
+ };
+diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c
+index fb02c3979bf4..f7ff408567ad 100644
+--- a/drivers/md/bitmap.c
++++ b/drivers/md/bitmap.c
+@@ -2084,6 +2084,7 @@ int bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ 				for (k = 0; k < page; k++) {
+ 					kfree(new_bp[k].map);
+ 				}
++				kfree(new_bp);
+ 
+ 				/* restore some fields from old_counts */
+ 				bitmap->counts.bp = old_counts.bp;
+@@ -2134,6 +2135,14 @@ int bitmap_resize(struct bitmap *bitmap, sector_t blocks,
+ 		block += old_blocks;
+ 	}
+ 
++	if (bitmap->counts.bp != old_counts.bp) {
++		unsigned long k;
++		for (k = 0; k < old_counts.pages; k++)
++			if (!old_counts.bp[k].hijacked)
++				kfree(old_counts.bp[k].map);
++		kfree(old_counts.bp);
++	}
++
+ 	if (!init) {
+ 		int i;
+ 		while (block < (chunks << chunkshift)) {
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+index ef6bff820cf6..adf61a7b1b01 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+@@ -1795,6 +1795,7 @@ static int stmmac_open(struct net_device *dev)
+ 
+ 	priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
+ 	priv->rx_copybreak = STMMAC_RX_COPYBREAK;
++	priv->mss = 0;
+ 
+ 	ret = alloc_dma_desc_resources(priv);
+ 	if (ret < 0) {
+diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
+index b4e990743e1d..980e38524418 100644
+--- a/drivers/net/ipvlan/ipvlan_core.c
++++ b/drivers/net/ipvlan/ipvlan_core.c
+@@ -404,7 +404,7 @@ static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+ 	struct dst_entry *dst;
+ 	int err, ret = NET_XMIT_DROP;
+ 	struct flowi6 fl6 = {
+-		.flowi6_iif = dev->ifindex,
++		.flowi6_oif = dev->ifindex,
+ 		.daddr = ip6h->daddr,
+ 		.saddr = ip6h->saddr,
+ 		.flowi6_flags = FLOWI_FLAG_ANYSRC,
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 9cf11c83993a..62725655d8e4 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -74,9 +74,11 @@ static void qmi_wwan_netdev_setup(struct net_device *net)
+ 		net->hard_header_len = 0;
+ 		net->addr_len        = 0;
+ 		net->flags           = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
++		set_bit(EVENT_NO_IP_ALIGN, &dev->flags);
+ 		netdev_dbg(net, "mode: raw IP\n");
+ 	} else if (!net->header_ops) { /* don't bother if already set */
+ 		ether_setup(net);
++		clear_bit(EVENT_NO_IP_ALIGN, &dev->flags);
+ 		netdev_dbg(net, "mode: Ethernet\n");
+ 	}
+ 
+@@ -936,6 +938,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x1e0e, 0x9001, 5)},	/* SIMCom 7230E */
+ 	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)},	/* Quectel EC25, EC20 R2.0  Mini PCIe */
+ 	{QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)},	/* Quectel EC21 Mini PCIe */
++	{QMI_FIXED_INTF(0x2c7c, 0x0296, 4)},	/* Quectel BG96 */
+ 
+ 	/* 4. Gobi 1000 devices */
+ 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index d5071e364d40..4ab82b998a0f 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -485,7 +485,10 @@ static int rx_submit (struct usbnet *dev, struct urb *urb, gfp_t flags)
+ 		return -ENOLINK;
+ 	}
+ 
+-	skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
++	if (test_bit(EVENT_NO_IP_ALIGN, &dev->flags))
++		skb = __netdev_alloc_skb(dev->net, size, flags);
++	else
++		skb = __netdev_alloc_skb_ip_align(dev->net, size, flags);
+ 	if (!skb) {
+ 		netif_dbg(dev, rx_err, dev->net, "no rx skb\n");
+ 		usbnet_defer_kevent (dev, EVENT_RX_MEMORY);
+diff --git a/drivers/s390/net/qeth_core.h b/drivers/s390/net/qeth_core.h
+index d55e6438bb5e..e2bd2ad01b15 100644
+--- a/drivers/s390/net/qeth_core.h
++++ b/drivers/s390/net/qeth_core.h
+@@ -1004,6 +1004,9 @@ struct qeth_cmd_buffer *qeth_get_setassparms_cmd(struct qeth_card *,
+ int qeth_set_features(struct net_device *, netdev_features_t);
+ int qeth_recover_features(struct net_device *);
+ netdev_features_t qeth_fix_features(struct net_device *, netdev_features_t);
++netdev_features_t qeth_features_check(struct sk_buff *skb,
++				      struct net_device *dev,
++				      netdev_features_t features);
+ 
+ /* exports for OSN */
+ int qeth_osn_assist(struct net_device *, void *, int);
+diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
+index 21ef8023430f..b5fa6bb56b29 100644
+--- a/drivers/s390/net/qeth_core_main.c
++++ b/drivers/s390/net/qeth_core_main.c
+@@ -19,6 +19,11 @@
+ #include <linux/mii.h>
+ #include <linux/kthread.h>
+ #include <linux/slab.h>
++#include <linux/if_vlan.h>
++#include <linux/netdevice.h>
++#include <linux/netdev_features.h>
++#include <linux/skbuff.h>
++
+ #include <net/iucv/af_iucv.h>
+ #include <net/dsfield.h>
+ 
+@@ -6240,6 +6245,32 @@ netdev_features_t qeth_fix_features(struct net_device *dev,
+ }
+ EXPORT_SYMBOL_GPL(qeth_fix_features);
+ 
++netdev_features_t qeth_features_check(struct sk_buff *skb,
++				      struct net_device *dev,
++				      netdev_features_t features)
++{
++	/* GSO segmentation builds skbs with
++	 *	a (small) linear part for the headers, and
++	 *	page frags for the data.
++	 * Compared to a linear skb, the header-only part consumes an
++	 * additional buffer element. This reduces buffer utilization, and
++	 * hurts throughput. So compress small segments into one element.
++	 */
++	if (netif_needs_gso(skb, features)) {
++		/* match skb_segment(): */
++		unsigned int doffset = skb->data - skb_mac_header(skb);
++		unsigned int hsize = skb_shinfo(skb)->gso_size;
++		unsigned int hroom = skb_headroom(skb);
++
++		/* linearize only if resulting skb allocations are order-0: */
++		if (SKB_DATA_ALIGN(hroom + doffset + hsize) <= SKB_MAX_HEAD(0))
++			features &= ~NETIF_F_SG;
++	}
++
++	return vlan_features_check(skb, features);
++}
++EXPORT_SYMBOL_GPL(qeth_features_check);
++
+ static int __init qeth_core_init(void)
+ {
+ 	int rc;
+diff --git a/drivers/s390/net/qeth_l2_main.c b/drivers/s390/net/qeth_l2_main.c
+index 8530477caab8..ac33f6c999b1 100644
+--- a/drivers/s390/net/qeth_l2_main.c
++++ b/drivers/s390/net/qeth_l2_main.c
+@@ -1084,6 +1084,7 @@ static const struct net_device_ops qeth_l2_netdev_ops = {
+ 	.ndo_stop		= qeth_l2_stop,
+ 	.ndo_get_stats		= qeth_get_stats,
+ 	.ndo_start_xmit		= qeth_l2_hard_start_xmit,
++	.ndo_features_check	= qeth_features_check,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_set_rx_mode	= qeth_l2_set_rx_mode,
+ 	.ndo_do_ioctl	   	= qeth_l2_do_ioctl,
+@@ -1128,6 +1129,7 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
+ 	if (card->info.type == QETH_CARD_TYPE_OSD && !card->info.guestlan) {
+ 		card->dev->hw_features = NETIF_F_SG;
+ 		card->dev->vlan_features = NETIF_F_SG;
++		card->dev->features |= NETIF_F_SG;
+ 		/* OSA 3S and earlier has no RX/TX support */
+ 		if (qeth_is_supported(card, IPA_OUTBOUND_CHECKSUM)) {
+ 			card->dev->hw_features |= NETIF_F_IP_CSUM;
+@@ -1140,8 +1142,6 @@ static int qeth_l2_setup_netdev(struct qeth_card *card)
+ 	}
+ 	card->info.broadcast_capable = 1;
+ 	qeth_l2_request_initial_mac(card);
+-	card->dev->gso_max_size = (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
+-				  PAGE_SIZE;
+ 	SET_NETDEV_DEV(card->dev, &card->gdev->dev);
+ 	netif_napi_add(card->dev, &card->napi, qeth_l2_poll, QETH_NAPI_WEIGHT);
+ 	netif_carrier_off(card->dev);
+diff --git a/drivers/s390/net/qeth_l3_main.c b/drivers/s390/net/qeth_l3_main.c
+index 03a2619166ca..5735fc3be6c7 100644
+--- a/drivers/s390/net/qeth_l3_main.c
++++ b/drivers/s390/net/qeth_l3_main.c
+@@ -1416,6 +1416,7 @@ qeth_l3_add_mc_to_hash(struct qeth_card *card, struct in_device *in4_dev)
+ 
+ 		tmp->u.a4.addr = im4->multiaddr;
+ 		memcpy(tmp->mac, buf, sizeof(tmp->mac));
++		tmp->is_multicast = 1;
+ 
+ 		ipm = qeth_l3_ip_from_hash(card, tmp);
+ 		if (ipm) {
+@@ -1593,7 +1594,7 @@ static void qeth_l3_free_vlan_addresses4(struct qeth_card *card,
+ 
+ 	addr = qeth_l3_get_addr_buffer(QETH_PROT_IPV4);
+ 	if (!addr)
+-		return;
++		goto out;
+ 
+ 	spin_lock_bh(&card->ip_lock);
+ 
+@@ -1607,6 +1608,7 @@ static void qeth_l3_free_vlan_addresses4(struct qeth_card *card,
+ 	spin_unlock_bh(&card->ip_lock);
+ 
+ 	kfree(addr);
++out:
+ 	in_dev_put(in_dev);
+ }
+ 
+@@ -1631,7 +1633,7 @@ static void qeth_l3_free_vlan_addresses6(struct qeth_card *card,
+ 
+ 	addr = qeth_l3_get_addr_buffer(QETH_PROT_IPV6);
+ 	if (!addr)
+-		return;
++		goto out;
+ 
+ 	spin_lock_bh(&card->ip_lock);
+ 
+@@ -1646,6 +1648,7 @@ static void qeth_l3_free_vlan_addresses6(struct qeth_card *card,
+ 	spin_unlock_bh(&card->ip_lock);
+ 
+ 	kfree(addr);
++out:
+ 	in6_dev_put(in6_dev);
+ #endif /* CONFIG_QETH_IPV6 */
+ }
+@@ -3064,6 +3067,7 @@ static const struct net_device_ops qeth_l3_netdev_ops = {
+ 	.ndo_stop		= qeth_l3_stop,
+ 	.ndo_get_stats		= qeth_get_stats,
+ 	.ndo_start_xmit		= qeth_l3_hard_start_xmit,
++	.ndo_features_check	= qeth_features_check,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_set_rx_mode	= qeth_l3_set_multicast_list,
+ 	.ndo_do_ioctl		= qeth_l3_do_ioctl,
+@@ -3120,6 +3124,7 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
+ 				card->dev->vlan_features = NETIF_F_SG |
+ 					NETIF_F_RXCSUM | NETIF_F_IP_CSUM |
+ 					NETIF_F_TSO;
++				card->dev->features |= NETIF_F_SG;
+ 			}
+ 		}
+ 	} else if (card->info.type == QETH_CARD_TYPE_IQD) {
+@@ -3145,8 +3150,8 @@ static int qeth_l3_setup_netdev(struct qeth_card *card)
+ 				NETIF_F_HW_VLAN_CTAG_RX |
+ 				NETIF_F_HW_VLAN_CTAG_FILTER;
+ 	netif_keep_dst(card->dev);
+-	card->dev->gso_max_size = (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
+-				  PAGE_SIZE;
++	netif_set_gso_max_size(card->dev, (QETH_MAX_BUFFER_ELEMENTS(card) - 1) *
++					  PAGE_SIZE);
+ 
+ 	SET_NETDEV_DEV(card->dev, &card->gdev->dev);
+ 	netif_napi_add(card->dev, &card->napi, qeth_l3_poll, QETH_NAPI_WEIGHT);
+diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
+index 346a630cebd5..7b107e43b1c4 100644
+--- a/drivers/usb/gadget/function/f_fs.c
++++ b/drivers/usb/gadget/function/f_fs.c
+@@ -1015,7 +1015,7 @@ static ssize_t ffs_epfile_io(struct file *file, struct ffs_io_data *io_data)
+ 		else
+ 			ret = ep->status;
+ 		goto error_mutex;
+-	} else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) {
++	} else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
+ 		ret = -ENOMEM;
+ 	} else {
+ 		req->buf      = data;
+diff --git a/include/linux/rculist_nulls.h b/include/linux/rculist_nulls.h
+index 4ae95f7e8597..6224a0ab0b1e 100644
+--- a/include/linux/rculist_nulls.h
++++ b/include/linux/rculist_nulls.h
+@@ -99,44 +99,6 @@ static inline void hlist_nulls_add_head_rcu(struct hlist_nulls_node *n,
+ 		first->pprev = &n->next;
+ }
+ 
+-/**
+- * hlist_nulls_add_tail_rcu
+- * @n: the element to add to the hash list.
+- * @h: the list to add to.
+- *
+- * Description:
+- * Adds the specified element to the end of the specified hlist_nulls,
+- * while permitting racing traversals.  NOTE: tail insertion requires
+- * list traversal.
+- *
+- * The caller must take whatever precautions are necessary
+- * (such as holding appropriate locks) to avoid racing
+- * with another list-mutation primitive, such as hlist_nulls_add_head_rcu()
+- * or hlist_nulls_del_rcu(), running on this same list.
+- * However, it is perfectly legal to run concurrently with
+- * the _rcu list-traversal primitives, such as
+- * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency
+- * problems on Alpha CPUs.  Regardless of the type of CPU, the
+- * list-traversal primitive must be guarded by rcu_read_lock().
+- */
+-static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n,
+-					struct hlist_nulls_head *h)
+-{
+-	struct hlist_nulls_node *i, *last = NULL;
+-
+-	for (i = hlist_nulls_first_rcu(h); !is_a_nulls(i);
+-	     i = hlist_nulls_next_rcu(i))
+-		last = i;
+-
+-	if (last) {
+-		n->next = last->next;
+-		n->pprev = &last->next;
+-		rcu_assign_pointer(hlist_nulls_next_rcu(last), n);
+-	} else {
+-		hlist_nulls_add_head_rcu(n, h);
+-	}
+-}
+-
+ /**
+  * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type
+  * @tpos:	the type * to use as a loop cursor.
+diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
+index 6e0ce8c7b8cb..fde7550754df 100644
+--- a/include/linux/usb/usbnet.h
++++ b/include/linux/usb/usbnet.h
+@@ -79,6 +79,7 @@ struct usbnet {
+ #		define EVENT_RX_KILL	10
+ #		define EVENT_LINK_CHANGE	11
+ #		define EVENT_SET_RX_MODE	12
++#		define EVENT_NO_IP_ALIGN	13
+ };
+ 
+ static inline struct usb_driver *driver_of(struct usb_interface *intf)
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 92b269709b9a..6d42ed883bf9 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -648,11 +648,7 @@ static inline void sk_add_node_rcu(struct sock *sk, struct hlist_head *list)
+ 
+ static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
+ {
+-	if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport &&
+-	    sk->sk_family == AF_INET6)
+-		hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list);
+-	else
+-		hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
++	hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
+ }
+ 
+ static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
+diff --git a/kernel/audit.c b/kernel/audit.c
+index f1ca11613379..da4e7c0e36f7 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -79,13 +79,13 @@ static int	audit_initialized;
+ #define AUDIT_OFF	0
+ #define AUDIT_ON	1
+ #define AUDIT_LOCKED	2
+-u32		audit_enabled;
+-u32		audit_ever_enabled;
++u32		audit_enabled = AUDIT_OFF;
++u32		audit_ever_enabled = !!AUDIT_OFF;
+ 
+ EXPORT_SYMBOL_GPL(audit_enabled);
+ 
+ /* Default state when kernel boots without any parameters. */
+-static u32	audit_default;
++static u32	audit_default = AUDIT_OFF;
+ 
+ /* If auditing cannot proceed, audit_failure selects what happens. */
+ static u32	audit_failure = AUDIT_FAIL_PRINTK;
+@@ -1199,8 +1199,6 @@ static int __init audit_init(void)
+ 	skb_queue_head_init(&audit_skb_queue);
+ 	skb_queue_head_init(&audit_skb_hold_queue);
+ 	audit_initialized = AUDIT_INITIALIZED;
+-	audit_enabled = audit_default;
+-	audit_ever_enabled |= !!audit_default;
+ 
+ 	audit_log(NULL, GFP_KERNEL, AUDIT_KERNEL, "initialized");
+ 
+@@ -1217,6 +1215,8 @@ static int __init audit_enable(char *str)
+ 	audit_default = !!simple_strtol(str, NULL, 0);
+ 	if (!audit_default)
+ 		audit_initialized = AUDIT_DISABLED;
++	audit_enabled = audit_default;
++	audit_ever_enabled = !!audit_enabled;
+ 
+ 	pr_info("%s\n", audit_default ?
+ 		"enabled (after initialization)" : "disabled (until reboot)");
+diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
+index 39e7e2bca8db..62522b8d2f97 100644
+--- a/net/dccp/minisocks.c
++++ b/net/dccp/minisocks.c
+@@ -57,10 +57,16 @@ void dccp_time_wait(struct sock *sk, int state, int timeo)
+ 		if (state == DCCP_TIME_WAIT)
+ 			timeo = DCCP_TIMEWAIT_LEN;
+ 
++		/* tw_timer is pinned, so we need to make sure BH are disabled
++		 * in following section, otherwise timer handler could run before
++		 * we complete the initialization.
++		 */
++		local_bh_disable();
+ 		inet_twsk_schedule(tw, timeo);
+ 		/* Linkage updates. */
+ 		__inet_twsk_hashdance(tw, sk, &dccp_hashinfo);
+ 		inet_twsk_put(tw);
++		local_bh_enable();
+ 	} else {
+ 		/* Sorry, if we're out of memory, just CLOSE this
+ 		 * socket up.  We've got bigger problems than
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 64e1ba49c3e2..830a5645d8c1 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -328,10 +328,16 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
+ 				timeo = TCP_TIMEWAIT_LEN;
+ 		}
+ 
++		/* tw_timer is pinned, so we need to make sure BH are disabled
++		 * in following section, otherwise timer handler could run before
++		 * we complete the initialization.
++		 */
++		local_bh_disable();
+ 		inet_twsk_schedule(tw, timeo);
+ 		/* Linkage updates. */
+ 		__inet_twsk_hashdance(tw, sk, &tcp_hashinfo);
+ 		inet_twsk_put(tw);
++		local_bh_enable();
+ 	} else {
+ 		/* Sorry, if we're out of memory, just CLOSE this
+ 		 * socket up.  We've got bigger problems than
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 40d740572354..db6d437002a6 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -1085,6 +1085,7 @@ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p)
+ 	ipip6_tunnel_link(sitn, t);
+ 	t->parms.iph.ttl = p->iph.ttl;
+ 	t->parms.iph.tos = p->iph.tos;
++	t->parms.iph.frag_off = p->iph.frag_off;
+ 	if (t->parms.link != p->link) {
+ 		t->parms.link = p->link;
+ 		ipip6_tunnel_bind_dev(t->dev);
+diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
+index 7eb0e8fe3ca8..22785dc03051 100644
+--- a/net/kcm/kcmsock.c
++++ b/net/kcm/kcmsock.c
+@@ -1624,60 +1624,35 @@ static struct proto kcm_proto = {
+ };
+ 
+ /* Clone a kcm socket. */
+-static int kcm_clone(struct socket *osock, struct kcm_clone *info,
+-		     struct socket **newsockp)
++static struct file *kcm_clone(struct socket *osock)
+ {
+ 	struct socket *newsock;
+ 	struct sock *newsk;
+-	struct file *newfile;
+-	int err, newfd;
++	struct file *file;
+ 
+-	err = -ENFILE;
+ 	newsock = sock_alloc();
+ 	if (!newsock)
+-		goto out;
++		return ERR_PTR(-ENFILE);
+ 
+ 	newsock->type = osock->type;
+ 	newsock->ops = osock->ops;
+ 
+ 	__module_get(newsock->ops->owner);
+ 
+-	newfd = get_unused_fd_flags(0);
+-	if (unlikely(newfd < 0)) {
+-		err = newfd;
+-		goto out_fd_fail;
+-	}
+-
+-	newfile = sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name);
+-	if (unlikely(IS_ERR(newfile))) {
+-		err = PTR_ERR(newfile);
+-		goto out_sock_alloc_fail;
+-	}
+-
+ 	newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
+ 			 &kcm_proto, true);
+ 	if (!newsk) {
+-		err = -ENOMEM;
+-		goto out_sk_alloc_fail;
++		sock_release(newsock);
++		return ERR_PTR(-ENOMEM);
+ 	}
+-
+ 	sock_init_data(newsock, newsk);
+ 	init_kcm_sock(kcm_sk(newsk), kcm_sk(osock->sk)->mux);
+ 
+-	fd_install(newfd, newfile);
+-	*newsockp = newsock;
+-	info->fd = newfd;
+-
+-	return 0;
++	file = sock_alloc_file(newsock, 0, osock->sk->sk_prot_creator->name);
++	if (IS_ERR(file))
++		sock_release(newsock);
+ 
+-out_sk_alloc_fail:
+-	fput(newfile);
+-out_sock_alloc_fail:
+-	put_unused_fd(newfd);
+-out_fd_fail:
+-	sock_release(newsock);
+-out:
+-	return err;
++	return file;
+ }
+ 
+ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+@@ -1707,21 +1682,25 @@ static int kcm_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
+ 	}
+ 	case SIOCKCMCLONE: {
+ 		struct kcm_clone info;
+-		struct socket *newsock = NULL;
++		struct file *file;
+ 
+-		if (copy_from_user(&info, (void __user *)arg, sizeof(info)))
+-			return -EFAULT;
++		info.fd = get_unused_fd_flags(0);
++		if (unlikely(info.fd < 0))
++			return info.fd;
+ 
+-		err = kcm_clone(sock, &info, &newsock);
+-
+-		if (!err) {
+-			if (copy_to_user((void __user *)arg, &info,
+-					 sizeof(info))) {
+-				err = -EFAULT;
+-				sys_close(info.fd);
+-			}
++		file = kcm_clone(sock);
++		if (IS_ERR(file)) {
++			put_unused_fd(info.fd);
++			return PTR_ERR(file);
+ 		}
+-
++		if (copy_to_user((void __user *)arg, &info,
++				 sizeof(info))) {
++			put_unused_fd(info.fd);
++			fput(file);
++			return -EFAULT;
++		}
++		fd_install(info.fd, file);
++		err = 0;
+ 		break;
+ 	}
+ 	default:
+diff --git a/net/netfilter/core.c b/net/netfilter/core.c
+index 004af030ef1a..d869ea50623e 100644
+--- a/net/netfilter/core.c
++++ b/net/netfilter/core.c
+@@ -364,6 +364,11 @@ int nf_hook_slow(struct sk_buff *skb, struct nf_hook_state *state)
+ 		ret = nf_queue(skb, state, &entry, verdict);
+ 		if (ret == 1 && entry)
+ 			goto next_hook;
++	} else {
++		/* Implicit handling for NF_STOLEN, as well as any other
++		 * non conventional verdicts.
++		 */
++		ret = 0;
+ 	}
+ 	return ret;
+ }
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index e7f6657269e0..267db0d603bc 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1661,7 +1661,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
+ 		atomic_long_set(&rollover->num, 0);
+ 		atomic_long_set(&rollover->num_huge, 0);
+ 		atomic_long_set(&rollover->num_failed, 0);
+-		po->rollover = rollover;
+ 	}
+ 
+ 	match = NULL;
+@@ -1706,6 +1705,8 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
+ 		if (atomic_read(&match->sk_ref) < PACKET_FANOUT_MAX) {
+ 			__dev_remove_pack(&po->prot_hook);
+ 			po->fanout = match;
++			po->rollover = rollover;
++			rollover = NULL;
+ 			atomic_inc(&match->sk_ref);
+ 			__fanout_link(sk, po);
+ 			err = 0;
+@@ -1719,10 +1720,7 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags)
+ 	}
+ 
+ out:
+-	if (err && rollover) {
+-		kfree_rcu(rollover, rcu);
+-		po->rollover = NULL;
+-	}
++	kfree(rollover);
+ 	mutex_unlock(&fanout_mutex);
+ 	return err;
+ }
+@@ -1746,11 +1744,6 @@ static struct packet_fanout *fanout_release(struct sock *sk)
+ 			list_del(&f->list);
+ 		else
+ 			f = NULL;
+-
+-		if (po->rollover) {
+-			kfree_rcu(po->rollover, rcu);
+-			po->rollover = NULL;
+-		}
+ 	}
+ 	mutex_unlock(&fanout_mutex);
+ 
+@@ -3039,6 +3032,7 @@ static int packet_release(struct socket *sock)
+ 	synchronize_net();
+ 
+ 	if (f) {
++		kfree(po->rollover);
+ 		fanout_release_data(f);
+ 		kfree(f);
+ 	}
+@@ -3107,6 +3101,10 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
+ 	if (need_rehook) {
+ 		if (po->running) {
+ 			rcu_read_unlock();
++			/* prevents packet_notifier() from calling
++			 * register_prot_hook()
++			 */
++			po->num = 0;
+ 			__unregister_prot_hook(sk, true);
+ 			rcu_read_lock();
+ 			dev_curr = po->prot_hook.dev;
+@@ -3115,6 +3113,7 @@ static int packet_do_bind(struct sock *sk, const char *name, int ifindex,
+ 								 dev->ifindex);
+ 		}
+ 
++		BUG_ON(po->running);
+ 		po->num = proto;
+ 		po->prot_hook.type = proto;
+ 
+@@ -3853,7 +3852,6 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ 	void *data = &val;
+ 	union tpacket_stats_u st;
+ 	struct tpacket_rollover_stats rstats;
+-	struct packet_rollover *rollover;
+ 
+ 	if (level != SOL_PACKET)
+ 		return -ENOPROTOOPT;
+@@ -3932,18 +3930,13 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+ 		       0);
+ 		break;
+ 	case PACKET_ROLLOVER_STATS:
+-		rcu_read_lock();
+-		rollover = rcu_dereference(po->rollover);
+-		if (rollover) {
+-			rstats.tp_all = atomic_long_read(&rollover->num);
+-			rstats.tp_huge = atomic_long_read(&rollover->num_huge);
+-			rstats.tp_failed = atomic_long_read(&rollover->num_failed);
+-			data = &rstats;
+-			lv = sizeof(rstats);
+-		}
+-		rcu_read_unlock();
+-		if (!rollover)
++		if (!po->rollover)
+ 			return -EINVAL;
++		rstats.tp_all = atomic_long_read(&po->rollover->num);
++		rstats.tp_huge = atomic_long_read(&po->rollover->num_huge);
++		rstats.tp_failed = atomic_long_read(&po->rollover->num_failed);
++		data = &rstats;
++		lv = sizeof(rstats);
+ 		break;
+ 	case PACKET_TX_HAS_OFF:
+ 		val = po->tp_tx_has_off;
+diff --git a/net/packet/internal.h b/net/packet/internal.h
+index 9ee46314b7d7..d55bfc34d6b3 100644
+--- a/net/packet/internal.h
++++ b/net/packet/internal.h
+@@ -92,7 +92,6 @@ struct packet_fanout {
+ 
+ struct packet_rollover {
+ 	int			sock;
+-	struct rcu_head		rcu;
+ 	atomic_long_t		num;
+ 	atomic_long_t		num_huge;
+ 	atomic_long_t		num_failed;
+diff --git a/net/rds/rdma.c b/net/rds/rdma.c
+index 60e90f761838..de8496e60735 100644
+--- a/net/rds/rdma.c
++++ b/net/rds/rdma.c
+@@ -183,7 +183,7 @@ static int __rds_rdma_map(struct rds_sock *rs, struct rds_get_mr_args *args,
+ 	long i;
+ 	int ret;
+ 
+-	if (rs->rs_bound_addr == 0) {
++	if (rs->rs_bound_addr == 0 || !rs->rs_transport) {
+ 		ret = -ENOTCONN; /* XXX not a great errno */
+ 		goto out;
+ 	}
+diff --git a/net/tipc/server.c b/net/tipc/server.c
+index 3cd6402e812c..f4c1b18c5fb0 100644
+--- a/net/tipc/server.c
++++ b/net/tipc/server.c
+@@ -313,6 +313,7 @@ static int tipc_accept_from_sock(struct tipc_conn *con)
+ 	newcon->usr_data = s->tipc_conn_new(newcon->conid);
+ 	if (!newcon->usr_data) {
+ 		sock_release(newsock);
++		conn_put(newcon);
+ 		return -ENOMEM;
+ 	}
+ 
+diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
+index b58dc95f3d35..107375d80c70 100644
+--- a/net/tipc/udp_media.c
++++ b/net/tipc/udp_media.c
+@@ -371,10 +371,6 @@ static int tipc_udp_recv(struct sock *sk, struct sk_buff *skb)
+ 			goto rcu_out;
+ 	}
+ 
+-	tipc_rcv(sock_net(sk), skb, b);
+-	rcu_read_unlock();
+-	return 0;
+-
+ rcu_out:
+ 	rcu_read_unlock();
+ out:
+diff --git a/virt/kvm/arm/vgic/vgic-its.c b/virt/kvm/arm/vgic/vgic-its.c
+index ebcaf4641d2b..31f562507915 100644
+--- a/virt/kvm/arm/vgic/vgic-its.c
++++ b/virt/kvm/arm/vgic/vgic-its.c
+@@ -322,6 +322,7 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
+ 	int ret = 0;
+ 	u32 *intids;
+ 	int nr_irqs, i;
++	u8 pendmask;
+ 
+ 	nr_irqs = vgic_copy_lpi_list(vcpu->kvm, &intids);
+ 	if (nr_irqs < 0)
+@@ -329,7 +330,6 @@ static int its_sync_lpi_pending_table(struct kvm_vcpu *vcpu)
+ 
+ 	for (i = 0; i < nr_irqs; i++) {
+ 		int byte_offset, bit_nr;
+-		u8 pendmask;
+ 
+ 		byte_offset = intids[i] / BITS_PER_BYTE;
+ 		bit_nr = intids[i] % BITS_PER_BYTE;