From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from lists.gentoo.org (pigeon.gentoo.org [208.92.234.80]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by finch.gentoo.org (Postfix) with ESMTPS id AA558158086 for ; Sun, 17 Oct 2021 13:13:02 +0000 (UTC) Received: from pigeon.gentoo.org (localhost [127.0.0.1]) by pigeon.gentoo.org (Postfix) with SMTP id E19FCE08FE; Sun, 17 Oct 2021 13:13:01 +0000 (UTC) Received: from smtp.gentoo.org (dev.gentoo.org [IPv6:2001:470:ea4a:1:5054:ff:fec7:86e4]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by pigeon.gentoo.org (Postfix) with ESMTPS id B3E07E08FE for ; Sun, 17 Oct 2021 13:13:01 +0000 (UTC) Received: from oystercatcher.gentoo.org (oystercatcher.gentoo.org [148.251.78.52]) (using TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)) (No client certificate requested) by smtp.gentoo.org (Postfix) with ESMTPS id C0B2A3431FF for ; Sun, 17 Oct 2021 13:13:00 +0000 (UTC) Received: from localhost.localdomain (localhost [IPv6:::1]) by oystercatcher.gentoo.org (Postfix) with ESMTP id 5EEA4101 for ; Sun, 17 Oct 2021 13:12:59 +0000 (UTC) From: "Mike Pagano" To: gentoo-commits@lists.gentoo.org Content-Transfer-Encoding: 8bit Content-type: text/plain; charset=UTF-8 Reply-To: gentoo-dev@lists.gentoo.org, "Mike Pagano" Message-ID: <1634476365.f46dbd68b6a1a3e65d847aae6abf4f5ddb375360.mpagano@gentoo> Subject: [gentoo-commits] proj/linux-patches:4.19 commit in: / X-VCS-Repository: proj/linux-patches X-VCS-Files: 0000_README 1211_linux-4.19.212.patch X-VCS-Directories: / X-VCS-Committer: mpagano X-VCS-Committer-Name: Mike Pagano X-VCS-Revision: f46dbd68b6a1a3e65d847aae6abf4f5ddb375360 X-VCS-Branch: 4.19 Date: Sun, 17 Oct 2021 13:12:59 +0000 (UTC) Precedence: bulk List-Post: List-Help: List-Unsubscribe: List-Subscribe: List-Id: Gentoo Linux mail X-BeenThere: gentoo-commits@lists.gentoo.org X-Auto-Response-Suppress: DR, RN, NRN, OOF, AutoReply X-Archives-Salt: bd8e4f9e-020f-490a-bbf1-9729603cc0a3 X-Archives-Hash: 26d31c9bfa4cdd82a4787e5ac9ca426e commit: f46dbd68b6a1a3e65d847aae6abf4f5ddb375360 Author: Mike Pagano gentoo org> AuthorDate: Sun Oct 17 13:12:45 2021 +0000 Commit: Mike Pagano gentoo org> CommitDate: Sun Oct 17 13:12:45 2021 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=f46dbd68 Linux patch 4.19.212 Signed-off-by: Mike Pagano gentoo.org> 0000_README | 4 + 1211_linux-4.19.212.patch | 498 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 502 insertions(+) diff --git a/0000_README b/0000_README index ac7acb4..45a3155 100644 --- a/0000_README +++ b/0000_README @@ -883,6 +883,10 @@ Patch: 1210_linux-4.19.211.patch From: https://www.kernel.org Desc: Linux 4.19.211 +Patch: 1211_linux-4.19.212.patch +From: https://www.kernel.org +Desc: Linux 4.19.212 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1211_linux-4.19.212.patch b/1211_linux-4.19.212.patch new file mode 100644 index 0000000..7b8a2b5 --- /dev/null +++ b/1211_linux-4.19.212.patch @@ -0,0 +1,498 @@ +diff --git a/Makefile b/Makefile +index d4e6f5d326b06..484b0665e5721 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 19 +-SUBLEVEL = 211 ++SUBLEVEL = 212 + EXTRAVERSION = + NAME = "People's Front" + +diff --git a/arch/m68k/kernel/signal.c b/arch/m68k/kernel/signal.c +index 72850b85ecf85..c67a68b6b69d1 100644 +--- a/arch/m68k/kernel/signal.c ++++ b/arch/m68k/kernel/signal.c +@@ -448,7 +448,7 @@ static inline void save_fpu_state(struct sigcontext *sc, struct pt_regs *regs) + + if (CPU_IS_060 ? sc->sc_fpstate[2] : sc->sc_fpstate[0]) { + fpu_version = sc->sc_fpstate[0]; +- if (CPU_IS_020_OR_030 && ++ if (CPU_IS_020_OR_030 && !regs->stkadj && + regs->vector >= (VEC_FPBRUC * 4) && + regs->vector <= (VEC_FPNAN * 4)) { + /* Clear pending exception in 68882 idle frame */ +@@ -511,7 +511,7 @@ static inline int rt_save_fpu_state(struct ucontext __user *uc, struct pt_regs * + if (!(CPU_IS_060 || CPU_IS_COLDFIRE)) + context_size = fpstate[1]; + fpu_version = fpstate[0]; +- if (CPU_IS_020_OR_030 && ++ if (CPU_IS_020_OR_030 && !regs->stkadj && + regs->vector >= (VEC_FPBRUC * 4) && + regs->vector <= (VEC_FPNAN * 4)) { + /* Clear pending exception in 68882 idle frame */ +@@ -828,18 +828,24 @@ badframe: + return 0; + } + ++static inline struct pt_regs *rte_regs(struct pt_regs *regs) ++{ ++ return (void *)regs + regs->stkadj; ++} ++ + static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs, + unsigned long mask) + { ++ struct pt_regs *tregs = rte_regs(regs); + sc->sc_mask = mask; + sc->sc_usp = rdusp(); + sc->sc_d0 = regs->d0; + sc->sc_d1 = regs->d1; + sc->sc_a0 = regs->a0; + sc->sc_a1 = regs->a1; +- sc->sc_sr = regs->sr; +- sc->sc_pc = regs->pc; +- sc->sc_formatvec = regs->format << 12 | regs->vector; ++ sc->sc_sr = tregs->sr; ++ sc->sc_pc = tregs->pc; ++ sc->sc_formatvec = tregs->format << 12 | tregs->vector; + save_a5_state(sc, regs); + save_fpu_state(sc, regs); + } +@@ -847,6 +853,7 @@ static void setup_sigcontext(struct sigcontext *sc, struct pt_regs *regs, + static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs *regs) + { + struct switch_stack *sw = (struct switch_stack *)regs - 1; ++ struct pt_regs *tregs = rte_regs(regs); + greg_t __user *gregs = uc->uc_mcontext.gregs; + int err = 0; + +@@ -867,9 +874,9 @@ static inline int rt_setup_ucontext(struct ucontext __user *uc, struct pt_regs * + err |= __put_user(sw->a5, &gregs[13]); + err |= __put_user(sw->a6, &gregs[14]); + err |= __put_user(rdusp(), &gregs[15]); +- err |= __put_user(regs->pc, &gregs[16]); +- err |= __put_user(regs->sr, &gregs[17]); +- err |= __put_user((regs->format << 12) | regs->vector, &uc->uc_formatvec); ++ err |= __put_user(tregs->pc, &gregs[16]); ++ err |= __put_user(tregs->sr, &gregs[17]); ++ err |= __put_user((tregs->format << 12) | tregs->vector, &uc->uc_formatvec); + err |= rt_save_fpu_state(uc, regs); + return err; + } +@@ -886,13 +893,14 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set, + struct pt_regs *regs) + { + struct sigframe __user *frame; +- int fsize = frame_extra_sizes(regs->format); ++ struct pt_regs *tregs = rte_regs(regs); ++ int fsize = frame_extra_sizes(tregs->format); + struct sigcontext context; + int err = 0, sig = ksig->sig; + + if (fsize < 0) { + pr_debug("setup_frame: Unknown frame format %#x\n", +- regs->format); ++ tregs->format); + return -EFAULT; + } + +@@ -903,7 +911,7 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set, + + err |= __put_user(sig, &frame->sig); + +- err |= __put_user(regs->vector, &frame->code); ++ err |= __put_user(tregs->vector, &frame->code); + err |= __put_user(&frame->sc, &frame->psc); + + if (_NSIG_WORDS > 1) +@@ -928,34 +936,28 @@ static int setup_frame(struct ksignal *ksig, sigset_t *set, + + push_cache ((unsigned long) &frame->retcode); + +- /* +- * Set up registers for signal handler. All the state we are about +- * to destroy is successfully copied to sigframe. +- */ +- wrusp ((unsigned long) frame); +- regs->pc = (unsigned long) ksig->ka.sa.sa_handler; +- adjustformat(regs); +- + /* + * This is subtle; if we build more than one sigframe, all but the + * first one will see frame format 0 and have fsize == 0, so we won't + * screw stkadj. + */ +- if (fsize) ++ if (fsize) { + regs->stkadj = fsize; +- +- /* Prepare to skip over the extra stuff in the exception frame. */ +- if (regs->stkadj) { +- struct pt_regs *tregs = +- (struct pt_regs *)((ulong)regs + regs->stkadj); ++ tregs = rte_regs(regs); + pr_debug("Performing stackadjust=%04lx\n", regs->stkadj); +- /* This must be copied with decreasing addresses to +- handle overlaps. */ + tregs->vector = 0; + tregs->format = 0; +- tregs->pc = regs->pc; + tregs->sr = regs->sr; + } ++ ++ /* ++ * Set up registers for signal handler. All the state we are about ++ * to destroy is successfully copied to sigframe. ++ */ ++ wrusp ((unsigned long) frame); ++ tregs->pc = (unsigned long) ksig->ka.sa.sa_handler; ++ adjustformat(regs); ++ + return 0; + } + +@@ -963,7 +965,8 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + struct pt_regs *regs) + { + struct rt_sigframe __user *frame; +- int fsize = frame_extra_sizes(regs->format); ++ struct pt_regs *tregs = rte_regs(regs); ++ int fsize = frame_extra_sizes(tregs->format); + int err = 0, sig = ksig->sig; + + if (fsize < 0) { +@@ -1012,34 +1015,27 @@ static int setup_rt_frame(struct ksignal *ksig, sigset_t *set, + + push_cache ((unsigned long) &frame->retcode); + +- /* +- * Set up registers for signal handler. All the state we are about +- * to destroy is successfully copied to sigframe. +- */ +- wrusp ((unsigned long) frame); +- regs->pc = (unsigned long) ksig->ka.sa.sa_handler; +- adjustformat(regs); +- + /* + * This is subtle; if we build more than one sigframe, all but the + * first one will see frame format 0 and have fsize == 0, so we won't + * screw stkadj. + */ +- if (fsize) ++ if (fsize) { + regs->stkadj = fsize; +- +- /* Prepare to skip over the extra stuff in the exception frame. */ +- if (regs->stkadj) { +- struct pt_regs *tregs = +- (struct pt_regs *)((ulong)regs + regs->stkadj); ++ tregs = rte_regs(regs); + pr_debug("Performing stackadjust=%04lx\n", regs->stkadj); +- /* This must be copied with decreasing addresses to +- handle overlaps. */ + tregs->vector = 0; + tregs->format = 0; +- tregs->pc = regs->pc; + tregs->sr = regs->sr; + } ++ ++ /* ++ * Set up registers for signal handler. All the state we are about ++ * to destroy is successfully copied to sigframe. ++ */ ++ wrusp ((unsigned long) frame); ++ tregs->pc = (unsigned long) ksig->ka.sa.sa_handler; ++ adjustformat(regs); + return 0; + } + +diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c +index 429389489eed2..f612eb1cc8188 100644 +--- a/arch/x86/events/core.c ++++ b/arch/x86/events/core.c +@@ -2096,6 +2096,7 @@ static int x86_pmu_event_init(struct perf_event *event) + if (err) { + if (event->destroy) + event->destroy(event); ++ event->destroy = NULL; + } + + if (READ_ONCE(x86_pmu.attr_rdpmc) && +diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c +index b58ab769aa7b3..4e3dd3f55a963 100644 +--- a/drivers/hid/hid-apple.c ++++ b/drivers/hid/hid-apple.c +@@ -304,12 +304,19 @@ static int apple_event(struct hid_device *hdev, struct hid_field *field, + + /* + * MacBook JIS keyboard has wrong logical maximum ++ * Magic Keyboard JIS has wrong logical maximum + */ + static __u8 *apple_report_fixup(struct hid_device *hdev, __u8 *rdesc, + unsigned int *rsize) + { + struct apple_sc *asc = hid_get_drvdata(hdev); + ++ if(*rsize >=71 && rdesc[70] == 0x65 && rdesc[64] == 0x65) { ++ hid_info(hdev, ++ "fixing up Magic Keyboard JIS report descriptor\n"); ++ rdesc[64] = rdesc[70] = 0xe7; ++ } ++ + if ((asc->quirks & APPLE_RDESC_JIS) && *rsize >= 60 && + rdesc[53] == 0x65 && rdesc[59] == 0x65) { + hid_info(hdev, +diff --git a/drivers/net/ethernet/sun/Kconfig b/drivers/net/ethernet/sun/Kconfig +index 7b982e02ea3a4..1080a2a3e13a2 100644 +--- a/drivers/net/ethernet/sun/Kconfig ++++ b/drivers/net/ethernet/sun/Kconfig +@@ -73,6 +73,7 @@ config CASSINI + config SUNVNET_COMMON + tristate "Common routines to support Sun Virtual Networking" + depends on SUN_LDOMS ++ depends on INET + default m + + config SUNVNET +diff --git a/drivers/net/phy/bcm7xxx.c b/drivers/net/phy/bcm7xxx.c +index acaf072bb4b0f..35dc4ca696d33 100644 +--- a/drivers/net/phy/bcm7xxx.c ++++ b/drivers/net/phy/bcm7xxx.c +@@ -30,7 +30,12 @@ + #define MII_BCM7XXX_SHD_2_ADDR_CTRL 0xe + #define MII_BCM7XXX_SHD_2_CTRL_STAT 0xf + #define MII_BCM7XXX_SHD_2_BIAS_TRIM 0x1a ++#define MII_BCM7XXX_SHD_3_PCS_CTRL 0x0 ++#define MII_BCM7XXX_SHD_3_PCS_STATUS 0x1 ++#define MII_BCM7XXX_SHD_3_EEE_CAP 0x2 + #define MII_BCM7XXX_SHD_3_AN_EEE_ADV 0x3 ++#define MII_BCM7XXX_SHD_3_EEE_LP 0x4 ++#define MII_BCM7XXX_SHD_3_EEE_WK_ERR 0x5 + #define MII_BCM7XXX_SHD_3_PCS_CTRL_2 0x6 + #define MII_BCM7XXX_PCS_CTRL_2_DEF 0x4400 + #define MII_BCM7XXX_SHD_3_AN_STAT 0xb +@@ -463,6 +468,93 @@ static int bcm7xxx_28nm_ephy_config_init(struct phy_device *phydev) + return bcm7xxx_28nm_ephy_apd_enable(phydev); + } + ++#define MII_BCM7XXX_REG_INVALID 0xff ++ ++static u8 bcm7xxx_28nm_ephy_regnum_to_shd(u16 regnum) ++{ ++ switch (regnum) { ++ case MDIO_CTRL1: ++ return MII_BCM7XXX_SHD_3_PCS_CTRL; ++ case MDIO_STAT1: ++ return MII_BCM7XXX_SHD_3_PCS_STATUS; ++ case MDIO_PCS_EEE_ABLE: ++ return MII_BCM7XXX_SHD_3_EEE_CAP; ++ case MDIO_AN_EEE_ADV: ++ return MII_BCM7XXX_SHD_3_AN_EEE_ADV; ++ case MDIO_AN_EEE_LPABLE: ++ return MII_BCM7XXX_SHD_3_EEE_LP; ++ case MDIO_PCS_EEE_WK_ERR: ++ return MII_BCM7XXX_SHD_3_EEE_WK_ERR; ++ default: ++ return MII_BCM7XXX_REG_INVALID; ++ } ++} ++ ++static bool bcm7xxx_28nm_ephy_dev_valid(int devnum) ++{ ++ return devnum == MDIO_MMD_AN || devnum == MDIO_MMD_PCS; ++} ++ ++static int bcm7xxx_28nm_ephy_read_mmd(struct phy_device *phydev, ++ int devnum, u16 regnum) ++{ ++ u8 shd = bcm7xxx_28nm_ephy_regnum_to_shd(regnum); ++ int ret; ++ ++ if (!bcm7xxx_28nm_ephy_dev_valid(devnum) || ++ shd == MII_BCM7XXX_REG_INVALID) ++ return -EOPNOTSUPP; ++ ++ /* set shadow mode 2 */ ++ ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, ++ MII_BCM7XXX_SHD_MODE_2, 0); ++ if (ret < 0) ++ return ret; ++ ++ /* Access the desired shadow register address */ ++ ret = phy_write(phydev, MII_BCM7XXX_SHD_2_ADDR_CTRL, shd); ++ if (ret < 0) ++ goto reset_shadow_mode; ++ ++ ret = phy_read(phydev, MII_BCM7XXX_SHD_2_CTRL_STAT); ++ ++reset_shadow_mode: ++ /* reset shadow mode 2 */ ++ phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0, ++ MII_BCM7XXX_SHD_MODE_2); ++ return ret; ++} ++ ++static int bcm7xxx_28nm_ephy_write_mmd(struct phy_device *phydev, ++ int devnum, u16 regnum, u16 val) ++{ ++ u8 shd = bcm7xxx_28nm_ephy_regnum_to_shd(regnum); ++ int ret; ++ ++ if (!bcm7xxx_28nm_ephy_dev_valid(devnum) || ++ shd == MII_BCM7XXX_REG_INVALID) ++ return -EOPNOTSUPP; ++ ++ /* set shadow mode 2 */ ++ ret = phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, ++ MII_BCM7XXX_SHD_MODE_2, 0); ++ if (ret < 0) ++ return ret; ++ ++ /* Access the desired shadow register address */ ++ ret = phy_write(phydev, MII_BCM7XXX_SHD_2_ADDR_CTRL, shd); ++ if (ret < 0) ++ goto reset_shadow_mode; ++ ++ /* Write the desired value in the shadow register */ ++ phy_write(phydev, MII_BCM7XXX_SHD_2_CTRL_STAT, val); ++ ++reset_shadow_mode: ++ /* reset shadow mode 2 */ ++ return phy_set_clr_bits(phydev, MII_BCM7XXX_TEST, 0, ++ MII_BCM7XXX_SHD_MODE_2); ++} ++ + static int bcm7xxx_28nm_ephy_resume(struct phy_device *phydev) + { + int ret; +@@ -634,6 +726,8 @@ static int bcm7xxx_28nm_probe(struct phy_device *phydev) + .get_strings = bcm_phy_get_strings, \ + .get_stats = bcm7xxx_28nm_get_phy_stats, \ + .probe = bcm7xxx_28nm_probe, \ ++ .read_mmd = bcm7xxx_28nm_ephy_read_mmd, \ ++ .write_mmd = bcm7xxx_28nm_ephy_write_mmd, \ + } + + #define BCM7XXX_40NM_EPHY(_oui, _name) \ +diff --git a/drivers/scsi/ses.c b/drivers/scsi/ses.c +index caf35ca577ce3..e79d9f60a5282 100644 +--- a/drivers/scsi/ses.c ++++ b/drivers/scsi/ses.c +@@ -134,7 +134,7 @@ static int ses_recv_diag(struct scsi_device *sdev, int page_code, + static int ses_send_diag(struct scsi_device *sdev, int page_code, + void *buf, int bufflen) + { +- u32 result; ++ int result; + + unsigned char cmd[] = { + SEND_DIAGNOSTIC, +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 3d331a864b2fc..50e87823baab4 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -336,7 +336,7 @@ static void virtscsi_handle_transport_reset(struct virtio_scsi *vscsi, + } + break; + default: +- pr_info("Unsupport virtio scsi event reason %x\n", event->reason); ++ pr_info("Unsupported virtio scsi event reason %x\n", event->reason); + } + } + +@@ -389,7 +389,7 @@ static void virtscsi_handle_event(struct work_struct *work) + virtscsi_handle_param_change(vscsi, event); + break; + default: +- pr_err("Unsupport virtio scsi event %x\n", event->event); ++ pr_err("Unsupported virtio scsi event %x\n", event->event); + } + virtscsi_kick_event(vscsi, event_node); + } +diff --git a/include/linux/sched.h b/include/linux/sched.h +index 5524cd5c6abe6..761d0f85c4a50 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -1433,7 +1433,7 @@ extern struct pid *cad_pid; + #define tsk_used_math(p) ((p)->flags & PF_USED_MATH) + #define used_math() tsk_used_math(current) + +-static inline bool is_percpu_thread(void) ++static __always_inline bool is_percpu_thread(void) + { + #ifdef CONFIG_SMP + return (current->flags & PF_NO_SETAFFINITY) && +diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h +index 5e99771a5dcc2..edca90ef3bdc4 100644 +--- a/include/net/pkt_sched.h ++++ b/include/net/pkt_sched.h +@@ -11,6 +11,7 @@ + #include + + #define DEFAULT_TX_QUEUE_LEN 1000 ++#define STAB_SIZE_LOG_MAX 30 + + struct qdisc_walker { + int stop; +diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c +index dd0c1073dc8ee..d93490ac82759 100644 +--- a/net/ipv6/netfilter/ip6_tables.c ++++ b/net/ipv6/netfilter/ip6_tables.c +@@ -276,6 +276,7 @@ ip6t_do_table(struct sk_buff *skb, + * things we don't know, ie. tcp syn flag or ports). If the + * rule is also a fragment-specific rule, non-fragments won't + * match it. */ ++ acpar.fragoff = 0; + acpar.hotdrop = false; + acpar.state = state; + +diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c +index 6dc5f93b1e4d1..06b44c3c831ad 100644 +--- a/net/mac80211/mesh_pathtbl.c ++++ b/net/mac80211/mesh_pathtbl.c +@@ -63,7 +63,10 @@ static struct mesh_table *mesh_table_alloc(void) + atomic_set(&newtbl->entries, 0); + spin_lock_init(&newtbl->gates_lock); + spin_lock_init(&newtbl->walk_lock); +- rhashtable_init(&newtbl->rhead, &mesh_rht_params); ++ if (rhashtable_init(&newtbl->rhead, &mesh_rht_params)) { ++ kfree(newtbl); ++ return NULL; ++ } + + return newtbl; + } +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 012697efafc35..e0baa563a4dea 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -3875,7 +3875,8 @@ static bool ieee80211_accept_frame(struct ieee80211_rx_data *rx) + if (!bssid) + return false; + if (ether_addr_equal(sdata->vif.addr, hdr->addr2) || +- ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2)) ++ ether_addr_equal(sdata->u.ibss.bssid, hdr->addr2) || ++ !is_valid_ether_addr(hdr->addr2)) + return false; + if (ieee80211_is_beacon(hdr->frame_control)) + return true; +diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c +index 1f12be9f02070..0bb4f7a94a3c8 100644 +--- a/net/sched/sch_api.c ++++ b/net/sched/sch_api.c +@@ -498,6 +498,12 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt, + return stab; + } + ++ if (s->size_log > STAB_SIZE_LOG_MAX || ++ s->cell_log > STAB_SIZE_LOG_MAX) { ++ NL_SET_ERR_MSG(extack, "Invalid logarithmic size of size table"); ++ return ERR_PTR(-EINVAL); ++ } ++ + stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL); + if (!stab) + return ERR_PTR(-ENOMEM);