--- /dev/null
+From d57019d1858a6f9b3ca05d76d793466ae428cfa3 Mon Sep 17 00:00:00 2001
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Date: Wed, 23 Mar 2016 00:44:40 +0300
+Subject: at803x: fix reset handling
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+
+commit d57019d1858a6f9b3ca05d76d793466ae428cfa3 upstream.
+
+The driver of course "knows" that the chip's reset signal is active low,
+so it drives the GPIO to 0 to reset the PHY and to 1 otherwise; however
+all this will only work iff the GPIO is specified as active-high in the
+device tree! I think both the driver and the device trees (if there are
+any -- I was unable to find them) need to be fixed in this case...
+
+Fixes: 13a56b449325 ("net: phy: at803x: Add support for hardware reset")
+Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/phy/at803x.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/phy/at803x.c
++++ b/drivers/net/phy/at803x.c
+@@ -198,7 +198,7 @@ static int at803x_probe(struct phy_devic
+ if (!priv)
+ return -ENOMEM;
+
+- gpiod_reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_HIGH);
++ gpiod_reset = devm_gpiod_get_optional(dev, "reset", GPIOD_OUT_LOW);
+ if (IS_ERR(gpiod_reset))
+ return PTR_ERR(gpiod_reset);
+
+@@ -274,10 +274,10 @@ static void at803x_link_change_notify(st
+
+ at803x_context_save(phydev, &context);
+
+- gpiod_set_value(priv->gpiod_reset, 0);
+- msleep(1);
+ gpiod_set_value(priv->gpiod_reset, 1);
+ msleep(1);
++ gpiod_set_value(priv->gpiod_reset, 0);
++ msleep(1);
+
+ at803x_context_restore(phydev, &context);
+
--- /dev/null
+From 55e610cdd28c0ad3dce0652030c0296d549673f3 Mon Sep 17 00:00:00 2001
+From: Mans Rullgard <mans@mansr.com>
+Date: Tue, 26 Apr 2016 12:03:02 +0300
+Subject: ata: sata_dwc_460ex: remove incorrect locking
+
+From: Mans Rullgard <mans@mansr.com>
+
+commit 55e610cdd28c0ad3dce0652030c0296d549673f3 upstream.
+
+This lock is already taken in ata_scsi_queuecmd() a few levels up the
+call stack so attempting to take it here is an error. Moreover, it is
+pointless in the first place since it only protects a single, atomic
+assignment.
+
+Enabling lock debugging gives the following output:
+
+=============================================
+[ INFO: possible recursive locking detected ]
+4.4.0-rc5+ #189 Not tainted
+---------------------------------------------
+kworker/u2:3/37 is trying to acquire lock:
+ (&(&host->lock)->rlock){-.-...}, at: [<90283294>] sata_dwc_exec_command_by_tag.constprop.14+0x44/0x8c
+
+but task is already holding lock:
+ (&(&host->lock)->rlock){-.-...}, at: [<902761ac>] ata_scsi_queuecmd+0x2c/0x330
+
+other info that might help us debug this:
+ Possible unsafe locking scenario:
+
+ CPU0
+ ----
+ lock(&(&host->lock)->rlock);
+ lock(&(&host->lock)->rlock);
+
+ *** DEADLOCK ***
+ May be due to missing lock nesting notation
+
+4 locks held by kworker/u2:3/37:
+ #0: ("events_unbound"){.+.+.+}, at: [<9003a0a4>] process_one_work+0x12c/0x430
+ #1: ((&entry->work)){+.+.+.}, at: [<9003a0a4>] process_one_work+0x12c/0x430
+ #2: (&bdev->bd_mutex){+.+.+.}, at: [<9011fd54>] __blkdev_get+0x50/0x380
+ #3: (&(&host->lock)->rlock){-.-...}, at: [<902761ac>] ata_scsi_queuecmd+0x2c/0x330
+
+stack backtrace:
+CPU: 0 PID: 37 Comm: kworker/u2:3 Not tainted 4.4.0-rc5+ #189
+Workqueue: events_unbound async_run_entry_fn
+Stack : 90b38e30 00000021 00000003 9b2a6040 00000000 9005f3f0 904fc8dc 00000025
+ 906b96e4 00000000 90528648 9b3336c4 904fc8dc 9009bf18 00000002 00000004
+ 00000000 00000000 9b3336c4 9b3336e4 904fc8dc 9003d074 00000000 90500000
+ 9005e738 00000000 00000000 00000000 00000000 00000000 00000000 00000000
+ 6e657665 755f7374 756f626e 0000646e 00000000 00000000 9b00ca00 9b025000
+ ...
+Call Trace:
+[<90009d6c>] show_stack+0x88/0xa4
+[<90057744>] __lock_acquire+0x1ce8/0x2154
+[<900583e4>] lock_acquire+0x64/0x8c
+[<9045ff10>] _raw_spin_lock_irqsave+0x54/0x78
+[<90283294>] sata_dwc_exec_command_by_tag.constprop.14+0x44/0x8c
+[<90283484>] sata_dwc_qc_issue+0x1a8/0x24c
+[<9026b39c>] ata_qc_issue+0x1f0/0x410
+[<90273c6c>] ata_scsi_translate+0xb4/0x200
+[<90276234>] ata_scsi_queuecmd+0xb4/0x330
+[<9025800c>] scsi_dispatch_cmd+0xd0/0x128
+[<90259934>] scsi_request_fn+0x58c/0x638
+[<901a3e50>] __blk_run_queue+0x40/0x5c
+[<901a83d4>] blk_queue_bio+0x27c/0x28c
+[<901a5914>] generic_make_request+0xf0/0x188
+[<901a5a54>] submit_bio+0xa8/0x194
+[<9011adcc>] submit_bh_wbc.isra.23+0x15c/0x17c
+[<9011c908>] block_read_full_page+0x3e4/0x428
+[<9009e2e0>] do_read_cache_page+0xac/0x210
+[<9009fd90>] read_cache_page+0x18/0x24
+[<901bbd18>] read_dev_sector+0x38/0xb0
+[<901bd174>] msdos_partition+0xb4/0x5c0
+[<901bcb8c>] check_partition+0x140/0x274
+[<901bba60>] rescan_partitions+0xa0/0x2b0
+[<9011ff68>] __blkdev_get+0x264/0x380
+[<901201ac>] blkdev_get+0x128/0x36c
+[<901b9378>] add_disk+0x3c0/0x4bc
+[<90268268>] sd_probe_async+0x100/0x224
+[<90043a44>] async_run_entry_fn+0x50/0x124
+[<9003a11c>] process_one_work+0x1a4/0x430
+[<9003a4f4>] worker_thread+0x14c/0x4fc
+[<900408f4>] kthread+0xd0/0xe8
+[<90004338>] ret_from_kernel_thread+0x14/0x1c
+
+Fixes: 62936009f35a ("[libata] Add 460EX on-chip SATA driver, sata_dwc_460ex")
+Tested-by: Christian Lamparter <chunkeey@googlemail.com>
+Signed-off-by: Mans Rullgard <mans@mansr.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/sata_dwc_460ex.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/drivers/ata/sata_dwc_460ex.c
++++ b/drivers/ata/sata_dwc_460ex.c
+@@ -924,15 +924,13 @@ static void sata_dwc_exec_command_by_tag
+ struct ata_taskfile *tf,
+ u8 tag, u32 cmd_issued)
+ {
+- unsigned long flags;
+ struct sata_dwc_device_port *hsdevp = HSDEVP_FROM_AP(ap);
+
+ dev_dbg(ap->dev, "%s cmd(0x%02x): %s tag=%d\n", __func__, tf->command,
+ ata_get_cmd_descript(tf->command), tag);
+
+- spin_lock_irqsave(&ap->host->lock, flags);
+ hsdevp->cmd_issued[tag] = cmd_issued;
+- spin_unlock_irqrestore(&ap->host->lock, flags);
++
+ /*
+ * Clear SError before executing a new command.
+ * sata_dwc_scr_write and read can not be used here. Clearing the PM
--- /dev/null
+From 2835d2d9e366a2985b24051d228333bfba82f3a7 Mon Sep 17 00:00:00 2001
+From: Ivan Vecera <ivecera@redhat.com>
+Date: Thu, 15 Sep 2016 22:47:51 +0200
+Subject: bna: add missing per queue ethtool stat
+
+From: Ivan Vecera <ivecera@redhat.com>
+
+commit 2835d2d9e366a2985b24051d228333bfba82f3a7 upstream.
+
+Commit ba5ca784 "bna: check for dma mapping errors" added besides other
+things a statistic that counts number of DMA buffer mapping failures
+per each Rx queue. This counter is not included in ethtool stats output.
+
+Fixes: ba5ca784 "bna: check for dma mapping errors"
+Signed-off-by: Ivan Vecera <ivecera@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/brocade/bna/bnad_ethtool.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
++++ b/drivers/net/ethernet/brocade/bna/bnad_ethtool.c
+@@ -31,7 +31,7 @@
+ #define BNAD_NUM_TXF_COUNTERS 12
+ #define BNAD_NUM_RXF_COUNTERS 10
+ #define BNAD_NUM_CQ_COUNTERS (3 + 5)
+-#define BNAD_NUM_RXQ_COUNTERS 6
++#define BNAD_NUM_RXQ_COUNTERS 7
+ #define BNAD_NUM_TXQ_COUNTERS 5
+
+ #define BNAD_ETHTOOL_STATS_NUM \
+@@ -658,6 +658,8 @@ bnad_get_strings(struct net_device *netd
+ string += ETH_GSTRING_LEN;
+ sprintf(string, "rxq%d_allocbuf_failed", q_num);
+ string += ETH_GSTRING_LEN;
++ sprintf(string, "rxq%d_mapbuf_failed", q_num);
++ string += ETH_GSTRING_LEN;
+ sprintf(string, "rxq%d_producer_index", q_num);
+ string += ETH_GSTRING_LEN;
+ sprintf(string, "rxq%d_consumer_index", q_num);
+@@ -678,6 +680,9 @@ bnad_get_strings(struct net_device *netd
+ sprintf(string, "rxq%d_allocbuf_failed",
+ q_num);
+ string += ETH_GSTRING_LEN;
++ sprintf(string, "rxq%d_mapbuf_failed",
++ q_num);
++ string += ETH_GSTRING_LEN;
+ sprintf(string, "rxq%d_producer_index",
+ q_num);
+ string += ETH_GSTRING_LEN;
--- /dev/null
+From e5f6f564fd191d365fcd775c06a732a488205588 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 16 Nov 2016 06:31:52 -0800
+Subject: bnxt: add a missing rcu synchronization
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit e5f6f564fd191d365fcd775c06a732a488205588 upstream.
+
+Add a missing synchronize_net() call to avoid potential use after free,
+since we explicitly call napi_hash_del() to factorize the RCU grace
+period.
+
+Fixes: c0c050c58d84 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Michael Chan <michael.chan@broadcom.com>
+Acked-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -4250,6 +4250,10 @@ static void bnxt_del_napi(struct bnxt *b
+ napi_hash_del(&bnapi->napi);
+ netif_napi_del(&bnapi->napi);
+ }
++ /* We called napi_hash_del() before netif_napi_del(), we need
++ * to respect an RCU grace period before freeing napi structures.
++ */
++ synchronize_net();
+ }
+
+ static void bnxt_init_napi(struct bnxt *bp)
--- /dev/null
+From cbce91cad4ee39070bf3c7873767194e4be88e16 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 18 Jul 2016 13:02:47 -0700
+Subject: bnxt_en: Remove locking around txr->dev_state
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit cbce91cad4ee39070bf3c7873767194e4be88e16 upstream.
+
+txr->dev_state was not consistently manipulated with the acquisition of
+the per-queue lock, after further inspection the lock does not seem
+necessary, either the value is read as BNXT_DEV_STATE_CLOSING or 0.
+
+Reported-by: coverity (CID 1339583)
+Fixes: c0c050c58d840 ("bnxt_en: New Broadcom ethernet driver.")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Acked-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/bnxt/bnxt.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnxt/bnxt.c
++++ b/drivers/net/ethernet/broadcom/bnxt/bnxt.c
+@@ -4310,9 +4310,7 @@ static void bnxt_tx_disable(struct bnxt
+ bnapi = bp->bnapi[i];
+ txr = &bnapi->tx_ring;
+ txq = netdev_get_tx_queue(bp->dev, i);
+- __netif_tx_lock(txq, smp_processor_id());
+ txr->dev_state = BNXT_DEV_STATE_CLOSING;
+- __netif_tx_unlock(txq);
+ }
+ }
+ /* Stop all TX queues */
--- /dev/null
+From 94abd778a7bb00ed5d00f56d9fbfcbf5b7c02a5c Mon Sep 17 00:00:00 2001
+From: Jaap Jan Meijer <jjmeijer88@gmail.com>
+Date: Thu, 12 May 2016 18:25:08 +0200
+Subject: brcmfmac: add fallback for devices that do not report per-chain values
+
+From: Jaap Jan Meijer <jjmeijer88@gmail.com>
+
+commit 94abd778a7bb00ed5d00f56d9fbfcbf5b7c02a5c upstream.
+
+If brcmf_cfg80211_get_station fails to determine the RSSI from the
+per-chain values get the value individually as a fallback.
+
+Fixes: 1f0dc59a6de9 ("brcmfmac: rework .get_station() callback")
+Signed-off-by: Jaap Jan Meijer <jjmeijer88@gmail.com>
+Acked-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c | 16 ++++++++++++++++
+ 1 file changed, 16 insertions(+)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/cfg80211.c
+@@ -2419,12 +2419,14 @@ brcmf_cfg80211_get_station(struct wiphy
+ const u8 *mac, struct station_info *sinfo)
+ {
+ struct brcmf_if *ifp = netdev_priv(ndev);
++ struct brcmf_scb_val_le scb_val;
+ s32 err = 0;
+ struct brcmf_sta_info_le sta_info_le;
+ u32 sta_flags;
+ u32 is_tdls_peer;
+ s32 total_rssi;
+ s32 count_rssi;
++ int rssi;
+ u32 i;
+
+ brcmf_dbg(TRACE, "Enter, MAC %pM\n", mac);
+@@ -2505,6 +2507,20 @@ brcmf_cfg80211_get_station(struct wiphy
+ sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
+ total_rssi /= count_rssi;
+ sinfo->signal = total_rssi;
++ } else if (test_bit(BRCMF_VIF_STATUS_CONNECTED,
++ &ifp->vif->sme_state)) {
++ memset(&scb_val, 0, sizeof(scb_val));
++ err = brcmf_fil_cmd_data_get(ifp, BRCMF_C_GET_RSSI,
++ &scb_val, sizeof(scb_val));
++ if (err) {
++ brcmf_err("Could not get rssi (%d)\n", err);
++ goto done;
++ } else {
++ rssi = le32_to_cpu(scb_val.val);
++ sinfo->filled |= BIT(NL80211_STA_INFO_SIGNAL);
++ sinfo->signal = rssi;
++ brcmf_dbg(CONN, "RSSI %d dBm\n", rssi);
++ }
+ }
+ }
+ done:
--- /dev/null
+From 82bc9ab6a8f577d2174a736c33f3d4ecf7d9ef47 Mon Sep 17 00:00:00 2001
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+Date: Fri, 15 Jul 2016 12:16:12 +0200
+Subject: brcmfmac: restore stopping netdev queue when bus clogs up
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Arend Van Spriel <arend.vanspriel@broadcom.com>
+
+commit 82bc9ab6a8f577d2174a736c33f3d4ecf7d9ef47 upstream.
+
+When the host-interface bus has hard time handling transmit packets
+it informs higher layer about this and it would stop the netdev
+queue when needed. However, since commit 9cd18359d31e ("brcmfmac:
+Make FWS queueing configurable.") this was broken. With this patch
+the behaviour is restored.
+
+Cc: stable@vger.kernel.org # v4.5, v4.6, v4.7
+Fixes: 9cd18359d31e ("brcmfmac: Make FWS queueing configurable.")
+Tested-by: Per Förlin <per.forlin@gmail.com>
+Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
+Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
+Reviewed-by: Franky Lin <franky.lin@broadcom.com>
+Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c | 22 ++++++++++++++++-----
+ 1 file changed, 17 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
++++ b/drivers/net/wireless/brcm80211/brcmfmac/fwsignal.c
+@@ -2262,10 +2262,22 @@ void brcmf_fws_bustxfail(struct brcmf_fw
+ void brcmf_fws_bus_blocked(struct brcmf_pub *drvr, bool flow_blocked)
+ {
+ struct brcmf_fws_info *fws = drvr->fws;
++ struct brcmf_if *ifp;
++ int i;
+
+- fws->bus_flow_blocked = flow_blocked;
+- if (!flow_blocked)
+- brcmf_fws_schedule_deq(fws);
+- else
+- fws->stats.bus_flow_block++;
++ if (fws->avoid_queueing) {
++ for (i = 0; i < BRCMF_MAX_IFS; i++) {
++ ifp = drvr->iflist[i];
++ if (!ifp || !ifp->ndev)
++ continue;
++ brcmf_txflowblock_if(ifp, BRCMF_NETIF_STOP_REASON_FLOW,
++ flow_blocked);
++ }
++ } else {
++ fws->bus_flow_blocked = flow_blocked;
++ if (!flow_blocked)
++ brcmf_fws_schedule_deq(fws);
++ else
++ fws->stats.bus_flow_block++;
++ }
+ }
--- /dev/null
+From 7bb90c3715a496c650b2e879225030f9dd9cfafb Mon Sep 17 00:00:00 2001
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Date: Thu, 4 Aug 2016 11:11:19 +0900
+Subject: bridge: Fix problems around fdb entries pointing to the bridge device
+
+From: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+
+commit 7bb90c3715a496c650b2e879225030f9dd9cfafb upstream.
+
+Adding fdb entries pointing to the bridge device uses fdb_insert(),
+which lacks various checks and does not respect added_by_user flag.
+
+As a result, some inconsistent behavior can happen:
+* Adding temporary entries succeeds but results in permanent entries.
+* Same goes for "dynamic" and "use".
+* Changing mac address of the bridge device causes deletion of
+ user-added entries.
+* Replacing existing entries looks successful from userspace but actually
+ not, regardless of NLM_F_EXCL flag.
+
+Use the same logic as other entries and fix them.
+
+Fixes: 3741873b4f73 ("bridge: allow adding of fdb entries pointing to the bridge device")
+Signed-off-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
+Acked-by: Roopa Prabhu <roopa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bridge/br_fdb.c | 52 +++++++++++++++++++++++++++-------------------------
+ 1 file changed, 27 insertions(+), 25 deletions(-)
+
+--- a/net/bridge/br_fdb.c
++++ b/net/bridge/br_fdb.c
+@@ -266,7 +266,7 @@ void br_fdb_change_mac_address(struct ne
+
+ /* If old entry was unassociated with any port, then delete it. */
+ f = __br_fdb_get(br, br->dev->dev_addr, 0);
+- if (f && f->is_local && !f->dst)
++ if (f && f->is_local && !f->dst && !f->added_by_user)
+ fdb_delete_local(br, NULL, f);
+
+ fdb_insert(br, NULL, newaddr, 0);
+@@ -281,7 +281,7 @@ void br_fdb_change_mac_address(struct ne
+ if (!br_vlan_should_use(v))
+ continue;
+ f = __br_fdb_get(br, br->dev->dev_addr, v->vid);
+- if (f && f->is_local && !f->dst)
++ if (f && f->is_local && !f->dst && !f->added_by_user)
+ fdb_delete_local(br, NULL, f);
+ fdb_insert(br, NULL, newaddr, v->vid);
+ }
+@@ -758,20 +758,25 @@ out:
+ }
+
+ /* Update (create or replace) forwarding database entry */
+-static int fdb_add_entry(struct net_bridge_port *source, const __u8 *addr,
+- __u16 state, __u16 flags, __u16 vid)
++static int fdb_add_entry(struct net_bridge *br, struct net_bridge_port *source,
++ const __u8 *addr, __u16 state, __u16 flags, __u16 vid)
+ {
+- struct net_bridge *br = source->br;
+ struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
+ struct net_bridge_fdb_entry *fdb;
+ bool modified = false;
+
+ /* If the port cannot learn allow only local and static entries */
+- if (!(state & NUD_PERMANENT) && !(state & NUD_NOARP) &&
++ if (source && !(state & NUD_PERMANENT) && !(state & NUD_NOARP) &&
+ !(source->state == BR_STATE_LEARNING ||
+ source->state == BR_STATE_FORWARDING))
+ return -EPERM;
+
++ if (!source && !(state & NUD_PERMANENT)) {
++ pr_info("bridge: RTM_NEWNEIGH %s without NUD_PERMANENT\n",
++ br->dev->name);
++ return -EINVAL;
++ }
++
+ fdb = fdb_find(head, addr, vid);
+ if (fdb == NULL) {
+ if (!(flags & NLM_F_CREATE))
+@@ -826,22 +831,28 @@ static int fdb_add_entry(struct net_brid
+ return 0;
+ }
+
+-static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge_port *p,
+- const unsigned char *addr, u16 nlh_flags, u16 vid)
++static int __br_fdb_add(struct ndmsg *ndm, struct net_bridge *br,
++ struct net_bridge_port *p, const unsigned char *addr,
++ u16 nlh_flags, u16 vid)
+ {
+ int err = 0;
+
+ if (ndm->ndm_flags & NTF_USE) {
++ if (!p) {
++ pr_info("bridge: RTM_NEWNEIGH %s with NTF_USE is not supported\n",
++ br->dev->name);
++ return -EINVAL;
++ }
+ local_bh_disable();
+ rcu_read_lock();
+- br_fdb_update(p->br, p, addr, vid, true);
++ br_fdb_update(br, p, addr, vid, true);
+ rcu_read_unlock();
+ local_bh_enable();
+ } else {
+- spin_lock_bh(&p->br->hash_lock);
+- err = fdb_add_entry(p, addr, ndm->ndm_state,
++ spin_lock_bh(&br->hash_lock);
++ err = fdb_add_entry(br, p, addr, ndm->ndm_state,
+ nlh_flags, vid);
+- spin_unlock_bh(&p->br->hash_lock);
++ spin_unlock_bh(&br->hash_lock);
+ }
+
+ return err;
+@@ -878,6 +889,7 @@ int br_fdb_add(struct ndmsg *ndm, struct
+ dev->name);
+ return -EINVAL;
+ }
++ br = p->br;
+ vg = nbp_vlan_group(p);
+ }
+
+@@ -889,15 +901,9 @@ int br_fdb_add(struct ndmsg *ndm, struct
+ }
+
+ /* VID was specified, so use it. */
+- if (dev->priv_flags & IFF_EBRIDGE)
+- err = br_fdb_insert(br, NULL, addr, vid);
+- else
+- err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
++ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, vid);
+ } else {
+- if (dev->priv_flags & IFF_EBRIDGE)
+- err = br_fdb_insert(br, NULL, addr, 0);
+- else
+- err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
++ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, 0);
+ if (err || !vg || !vg->num_vlans)
+ goto out;
+
+@@ -908,11 +914,7 @@ int br_fdb_add(struct ndmsg *ndm, struct
+ list_for_each_entry(v, &vg->vlan_list, vlist) {
+ if (!br_vlan_should_use(v))
+ continue;
+- if (dev->priv_flags & IFF_EBRIDGE)
+- err = br_fdb_insert(br, NULL, addr, v->vid);
+- else
+- err = __br_fdb_add(ndm, p, addr, nlh_flags,
+- v->vid);
++ err = __br_fdb_add(ndm, br, p, addr, nlh_flags, v->vid);
+ if (err)
+ goto out;
+ }
--- /dev/null
+From 3d6d30d60abb19ba9a20e53ce65b18a9c148fcd1 Mon Sep 17 00:00:00 2001
+From: Jiri Benc <jbenc@redhat.com>
+Date: Fri, 22 Apr 2016 13:09:13 +0200
+Subject: cxgbi: fix uninitialized flowi6
+
+From: Jiri Benc <jbenc@redhat.com>
+
+commit 3d6d30d60abb19ba9a20e53ce65b18a9c148fcd1 upstream.
+
+ip6_route_output looks into different fields in the passed flowi6 structure,
+yet cxgbi passes garbage in nearly all those fields. Zero the structure out
+first.
+
+Fixes: fc8d0590d9142 ("libcxgbi: Add ipv6 api to driver")
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/cxgbi/libcxgbi.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/scsi/cxgbi/libcxgbi.c
++++ b/drivers/scsi/cxgbi/libcxgbi.c
+@@ -692,6 +692,7 @@ static struct rt6_info *find_route_ipv6(
+ {
+ struct flowi6 fl;
+
++ memset(&fl, 0, sizeof(fl));
+ if (saddr)
+ memcpy(&fl.saddr, saddr, sizeof(struct in6_addr));
+ if (daddr)
--- /dev/null
+From 3b1dbfa14f97188ec33fdfc7acb66bea59a3bb21 Mon Sep 17 00:00:00 2001
+From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
+Date: Wed, 20 Apr 2016 03:59:47 -0400
+Subject: cxl: Fix DAR check & use REGION_ID instead of opencoding
+
+From: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+
+commit 3b1dbfa14f97188ec33fdfc7acb66bea59a3bb21 upstream.
+
+The current code will set _PAGE_USER to the access flags for any
+fault address, because the ~ operation will be true for all address we
+take a fault on. But setting _PAGE_USER also means that the fault will
+be handled only if the page table have _PAGE_USER set. Hence there is
+no security hole with the current code.
+
+Now if it is an user space access, then the change in this patch really
+don't have an impact because we have (!ctx->kernel) set true
+and we take the if condition true.
+
+Now kernel context created fault on an address in the kernel range
+will result in a fault loop because we will not insert the
+hash pte due to access and pte permission mismatch. This patch fix
+the above issue.
+
+Fixes: f204e0b8cedd ("cxl: Driver code for powernv PCIe based cards for userspace access")
+Reviewed-by: Andrew Donnellan <andrew.donnellan@au1.ibm.com>
+Acked-by: Ian Munsie <imunsie@au1.ibm.com>
+Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/misc/cxl/fault.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/misc/cxl/fault.c
++++ b/drivers/misc/cxl/fault.c
+@@ -152,7 +152,7 @@ static void cxl_handle_page_fault(struct
+ access = _PAGE_PRESENT;
+ if (dsisr & CXL_PSL_DSISR_An_S)
+ access |= _PAGE_RW;
+- if ((!ctx->kernel) || ~(dar & (1ULL << 63)))
++ if ((!ctx->kernel) || (REGION_ID(dar) == USER_REGION_ID))
+ access |= _PAGE_USER;
+
+ if (dsisr & DSISR_NOHPTE)
--- /dev/null
+From de702da7a823ab0c4a1e53ed79a2695f0d453855 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Fri, 15 Jul 2016 16:40:22 -0700
+Subject: et131x: Fix logical vs bitwise check in et131x_tx_timeout()
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit de702da7a823ab0c4a1e53ed79a2695f0d453855 upstream.
+
+We should be using a logical check here instead of a bitwise operation
+to check if the device is closed already in et131x_tx_timeout().
+
+Reported-by: coverity (CID 146498)
+Fixes: 38df6492eb511 ("et131x: Add PCIe gigabit ethernet driver et131x to drivers/net")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/agere/et131x.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/agere/et131x.c
++++ b/drivers/net/ethernet/agere/et131x.c
+@@ -3854,7 +3854,7 @@ static void et131x_tx_timeout(struct net
+ unsigned long flags;
+
+ /* If the device is closed, ignore the timeout */
+- if (~(adapter->flags & FMP_ADAPTER_INTERRUPT_IN_USE))
++ if (!(adapter->flags & FMP_ADAPTER_INTERRUPT_IN_USE))
+ return;
+
+ /* Any nonrecoverable hardware error?
--- /dev/null
+From aafddbf0cffeb790f919436285328c762279b5d4 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 6 Jun 2016 09:12:39 -0700
+Subject: fq_codel: return non zero qlen in class dumps
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit aafddbf0cffeb790f919436285328c762279b5d4 upstream.
+
+We properly scan the flow list to count number of packets,
+but John passed 0 to gnet_stats_copy_queue() so we report
+a zero value to user space instead of the result.
+
+Fixes: 640158536632 ("net: sched: restrict use of qstats qlen")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: John Fastabend <john.r.fastabend@intel.com>
+Acked-by: John Fastabend <john.r.fastabend@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_fq_codel.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/sched/sch_fq_codel.c
++++ b/net/sched/sch_fq_codel.c
+@@ -588,7 +588,7 @@ static int fq_codel_dump_class_stats(str
+ qs.backlog = q->backlogs[idx];
+ qs.drops = flow->dropped;
+ }
+- if (gnet_stats_copy_queue(d, NULL, &qs, 0) < 0)
++ if (gnet_stats_copy_queue(d, NULL, &qs, qs.qlen) < 0)
+ return -1;
+ if (idx < q->flows_cnt)
+ return gnet_stats_copy_app(d, &xstats, sizeof(xstats));
--- /dev/null
+From 2090714e1d6e80979dd6926be22b0de9ca432273 Mon Sep 17 00:00:00 2001
+From: Jiri Benc <jbenc@redhat.com>
+Date: Wed, 27 Apr 2016 11:29:07 +0200
+Subject: gre: build header correctly for collect metadata tunnels
+
+From: Jiri Benc <jbenc@redhat.com>
+
+commit 2090714e1d6e80979dd6926be22b0de9ca432273 upstream.
+
+In ipgre (i.e. not gretap) + collect metadata mode, the skb was assumed to
+contain Ethernet header and was encapsulated as ETH_P_TEB. This is not the
+case, the interface is ARPHRD_IPGRE and the protocol to be used for
+encapsulation is skb->protocol.
+
+Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.")
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Acked-by: Pravin B Shelar <pshelar@ovn.org>
+Reviewed-by: Simon Horman <simon.horman@netronome.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/ip_gre.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -520,7 +520,8 @@ static struct rtable *gre_get_rt(struct
+ return ip_route_output_key(net, fl);
+ }
+
+-static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev)
++static void gre_fb_xmit(struct sk_buff *skb, struct net_device *dev,
++ __be16 proto)
+ {
+ struct ip_tunnel_info *tun_info;
+ const struct ip_tunnel_key *key;
+@@ -563,7 +564,7 @@ static void gre_fb_xmit(struct sk_buff *
+ }
+
+ flags = tun_info->key.tun_flags & (TUNNEL_CSUM | TUNNEL_KEY);
+- build_header(skb, tunnel_hlen, flags, htons(ETH_P_TEB),
++ build_header(skb, tunnel_hlen, flags, proto,
+ tunnel_id_to_key(tun_info->key.tun_id), 0);
+
+ df = key->tun_flags & TUNNEL_DONT_FRAGMENT ? htons(IP_DF) : 0;
+@@ -605,7 +606,7 @@ static netdev_tx_t ipgre_xmit(struct sk_
+ const struct iphdr *tnl_params;
+
+ if (tunnel->collect_md) {
+- gre_fb_xmit(skb, dev);
++ gre_fb_xmit(skb, dev, skb->protocol);
+ return NETDEV_TX_OK;
+ }
+
+@@ -649,7 +650,7 @@ static netdev_tx_t gre_tap_xmit(struct s
+ struct ip_tunnel *tunnel = netdev_priv(dev);
+
+ if (tunnel->collect_md) {
+- gre_fb_xmit(skb, dev);
++ gre_fb_xmit(skb, dev, htons(ETH_P_TEB));
+ return NETDEV_TX_OK;
+ }
+
--- /dev/null
+From a64b04d86d14c81f50f68e102f79ef301e3d0a0e Mon Sep 17 00:00:00 2001
+From: Jiri Benc <jbenc@redhat.com>
+Date: Wed, 27 Apr 2016 11:29:06 +0200
+Subject: gre: do not assign header_ops in collect metadata mode
+
+From: Jiri Benc <jbenc@redhat.com>
+
+commit a64b04d86d14c81f50f68e102f79ef301e3d0a0e upstream.
+
+In ipgre mode (i.e. not gretap) with collect metadata flag set, the tunnel
+is incorrectly assumed to be mGRE in NBMA mode (see commit 6a5f44d7a048c).
+This is not the case, we're controlling the encapsulation addresses by
+lwtunnel metadata. And anyway, assigning dev->header_ops in collect metadata
+mode does not make sense.
+
+Although it would be more user firendly to reject requests that specify
+both the collect metadata flag and a remote/local IP address, this would
+break current users of gretap or introduce ugly code and differences in
+handling ipgre and gretap configuration. Keep the current behavior of
+remote/local IP address being ignored in such case.
+
+v3: Back to v1, added explanation paragraph.
+v2: Reject configuration specifying both remote/local address and collect
+ metadata flag.
+
+Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.")
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/ip_gre.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -882,7 +882,7 @@ static int ipgre_tunnel_init(struct net_
+ netif_keep_dst(dev);
+ dev->addr_len = 4;
+
+- if (iph->daddr) {
++ if (iph->daddr && !tunnel->collect_md) {
+ #ifdef CONFIG_NET_IPGRE_BROADCAST
+ if (ipv4_is_multicast(iph->daddr)) {
+ if (!iph->saddr)
+@@ -891,8 +891,9 @@ static int ipgre_tunnel_init(struct net_
+ dev->header_ops = &ipgre_header_ops;
+ }
+ #endif
+- } else
++ } else if (!tunnel->collect_md) {
+ dev->header_ops = &ipgre_header_ops;
++ }
+
+ return ip_tunnel_init(dev);
+ }
--- /dev/null
+From 946b636f1730c64e05ff7fe8cf7136422fa8ea70 Mon Sep 17 00:00:00 2001
+From: Jiri Benc <jbenc@redhat.com>
+Date: Wed, 27 Apr 2016 14:08:01 +0200
+Subject: gre: reject GUE and FOU in collect metadata mode
+
+From: Jiri Benc <jbenc@redhat.com>
+
+commit 946b636f1730c64e05ff7fe8cf7136422fa8ea70 upstream.
+
+The collect metadata mode does not support GUE nor FOU. This might be
+implemented later; until then, we should reject such config.
+
+I think this is okay to be changed. It's unlikely anyone has such
+configuration (as it doesn't work anyway) and we may need a way to
+distinguish whether it's supported or not by the kernel later.
+
+For backwards compatibility with iproute2, it's not possible to just check
+the attribute presence (iproute2 always includes the attribute), the actual
+value has to be checked, too.
+
+Fixes: 2e15ea390e6f4 ("ip_gre: Add support to collect tunnel metadata.")
+Signed-off-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/ip_gre.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -937,6 +937,11 @@ static int ipgre_tunnel_validate(struct
+ if (flags & (GRE_VERSION|GRE_ROUTING))
+ return -EINVAL;
+
++ if (data[IFLA_GRE_COLLECT_METADATA] &&
++ data[IFLA_GRE_ENCAP_TYPE] &&
++ nla_get_u16(data[IFLA_GRE_ENCAP_TYPE]) != TUNNEL_ENCAP_NONE)
++ return -EINVAL;
++
+ return 0;
+ }
+
--- /dev/null
+From 27d80fa8bccf8d28bef4f89709638efc624fef9a Mon Sep 17 00:00:00 2001
+From: Krzysztof Kozlowski <krzk@kernel.org>
+Date: Mon, 14 Mar 2016 09:07:15 +0900
+Subject: hwrng: exynos - Disable runtime PM on driver unbind
+
+From: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+
+commit 27d80fa8bccf8d28bef4f89709638efc624fef9a upstream.
+
+Driver enabled runtime PM but did not revert this on removal. Re-binding
+of a device triggered warning:
+ exynos-rng 10830400.rng: Unbalanced pm_runtime_enable!
+
+Fixes: b329669ea0b5 ("hwrng: exynos - Add support for Exynos random number generator")
+Signed-off-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/char/hw_random/exynos-rng.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/char/hw_random/exynos-rng.c
++++ b/drivers/char/hw_random/exynos-rng.c
+@@ -155,6 +155,14 @@ static int exynos_rng_probe(struct platf
+ return ret;
+ }
+
++static int exynos_rng_remove(struct platform_device *pdev)
++{
++ pm_runtime_dont_use_autosuspend(&pdev->dev);
++ pm_runtime_disable(&pdev->dev);
++
++ return 0;
++}
++
+ static int __maybe_unused exynos_rng_runtime_suspend(struct device *dev)
+ {
+ struct platform_device *pdev = to_platform_device(dev);
+@@ -212,6 +220,7 @@ static struct platform_driver exynos_rng
+ .of_match_table = exynos_rng_dt_match,
+ },
+ .probe = exynos_rng_probe,
++ .remove = exynos_rng_remove,
+ };
+
+ module_platform_driver(exynos_rng_driver);
--- /dev/null
+From 2f86953e7436c9b9a4690909c5e2db24799e173b Mon Sep 17 00:00:00 2001
+From: Sabrina Dubroca <sd@queasysnail.net>
+Date: Fri, 2 Sep 2016 10:22:54 +0200
+Subject: l2tp: fix use-after-free during module unload
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+commit 2f86953e7436c9b9a4690909c5e2db24799e173b upstream.
+
+Tunnel deletion is delayed by both a workqueue (l2tp_tunnel_delete -> wq
+ -> l2tp_tunnel_del_work) and RCU (sk_destruct -> RCU ->
+l2tp_tunnel_destruct).
+
+By the time l2tp_tunnel_destruct() runs to destroy the tunnel and finish
+destroying the socket, the private data reserved via the net_generic
+mechanism has already been freed, but l2tp_tunnel_destruct() actually
+uses this data.
+
+Make sure tunnel deletion for the netns has completed before returning
+from l2tp_exit_net() by first flushing the tunnel removal workqueue, and
+then waiting for RCU callbacks to complete.
+
+Fixes: 167eb17e0b17 ("l2tp: create tunnel sockets in the right namespace")
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/l2tp/l2tp_core.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1953,6 +1953,9 @@ static __net_exit void l2tp_exit_net(str
+ l2tp_tunnel_delete(tunnel);
+ }
+ rcu_read_unlock_bh();
++
++ flush_workqueue(l2tp_wq);
++ rcu_barrier();
+ }
+
+ static struct pernet_operations l2tp_net_ops = {
--- /dev/null
+From 260916dfb48c374f7840f3b86e69afd3afdb6e96 Mon Sep 17 00:00:00 2001
+From: Herbert Xu <herbert@gondor.apana.org.au>
+Date: Wed, 1 Jun 2016 11:43:00 +0800
+Subject: macvlan: Fix potential use-after free for broadcasts
+
+From: Herbert Xu <herbert@gondor.apana.org.au>
+
+commit 260916dfb48c374f7840f3b86e69afd3afdb6e96 upstream.
+
+When we postpone a broadcast packet we save the source port in
+the skb if it is local. However, the source port can disappear
+before we get a chance to process the packet.
+
+This patch fixes this by holding a ref count on the netdev.
+
+It also delays the skb->cb modification until after we allocate
+the new skb as you should not modify shared skbs.
+
+Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue")
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/macvlan.c | 10 ++++++++--
+ 1 file changed, 8 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -305,6 +305,8 @@ static void macvlan_process_broadcast(st
+
+ rcu_read_unlock();
+
++ if (src)
++ dev_put(src->dev);
+ kfree_skb(skb);
+
+ cond_resched();
+@@ -312,6 +314,7 @@ static void macvlan_process_broadcast(st
+ }
+
+ static void macvlan_broadcast_enqueue(struct macvlan_port *port,
++ const struct macvlan_dev *src,
+ struct sk_buff *skb)
+ {
+ struct sk_buff *nskb;
+@@ -321,8 +324,12 @@ static void macvlan_broadcast_enqueue(st
+ if (!nskb)
+ goto err;
+
++ MACVLAN_SKB_CB(nskb)->src = src;
++
+ spin_lock(&port->bc_queue.lock);
+ if (skb_queue_len(&port->bc_queue) < MACVLAN_BC_QUEUE_LEN) {
++ if (src)
++ dev_hold(src->dev);
+ __skb_queue_tail(&port->bc_queue, nskb);
+ err = 0;
+ }
+@@ -432,8 +439,7 @@ static rx_handler_result_t macvlan_handl
+ goto out;
+ }
+
+- MACVLAN_SKB_CB(skb)->src = src;
+- macvlan_broadcast_enqueue(port, skb);
++ macvlan_broadcast_enqueue(port, src, skb);
+
+ return RX_HANDLER_PASS;
+ }
--- /dev/null
+From be0bd3160165e42783d8215f426e41c07179c08a Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 6 May 2016 05:58:21 -0700
+Subject: macvtap: segmented packet is consumed
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit be0bd3160165e42783d8215f426e41c07179c08a upstream.
+
+If GSO packet is segmented and its segments are properly queued,
+we call consume_skb() instead of kfree_skb() to be drop monitor
+friendly.
+
+Fixes: 3e4f8b7873709 ("macvtap: Perform GSO on forwarding path.")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Vlad Yasevich <vyasevic@redhat.com>
+Reviewed-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/macvtap.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -373,7 +373,7 @@ static rx_handler_result_t macvtap_handl
+ goto wake_up;
+ }
+
+- kfree_skb(skb);
++ consume_skb(skb);
+ while (segs) {
+ struct sk_buff *nskb = segs->next;
+
--- /dev/null
+From e8f967c3d88489fc1562a31d4e44d905ac1d3aff Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Thu, 24 Nov 2016 17:28:12 +0100
+Subject: mvpp2: use correct size for memset
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit e8f967c3d88489fc1562a31d4e44d905ac1d3aff upstream.
+
+gcc-7 detects a short memset in mvpp2, introduced in the original
+merge of the driver:
+
+drivers/net/ethernet/marvell/mvpp2.c: In function 'mvpp2_cls_init':
+drivers/net/ethernet/marvell/mvpp2.c:3296:2: error: 'memset' used with length equal to number of elements without multiplication by element size [-Werror=memset-elt-size]
+
+The result seems to be that we write uninitialized data into the
+flow table registers, although we did not get any warning about
+that uninitialized data usage.
+
+Using sizeof() lets us initialize then entire array instead.
+
+Fixes: 3f518509dedc ("ethernet: Add new driver for Marvell Armada 375 network unit")
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/marvell/mvpp2.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvpp2.c
++++ b/drivers/net/ethernet/marvell/mvpp2.c
+@@ -3305,7 +3305,7 @@ static void mvpp2_cls_init(struct mvpp2
+ mvpp2_write(priv, MVPP2_CLS_MODE_REG, MVPP2_CLS_MODE_ACTIVE_MASK);
+
+ /* Clear classifier flow table */
+- memset(&fe.data, 0, MVPP2_CLS_FLOWS_TBL_DATA_WORDS);
++ memset(&fe.data, 0, sizeof(fe.data));
+ for (index = 0; index < MVPP2_CLS_FLOWS_TBL_SIZE; index++) {
+ fe.index = index;
+ mvpp2_cls_flow_write(priv, &fe);
--- /dev/null
+From 3ad7b1477ef9b01988ac052b02be9cd410c95157 Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Date: Tue, 19 Jul 2016 11:23:24 +0000
+Subject: net: axienet: Fix return value check in axienet_probe()
+
+From: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+
+commit 3ad7b1477ef9b01988ac052b02be9cd410c95157 upstream.
+
+In case of error, the function of_parse_phandle() returns NULL
+pointer not ERR_PTR(). The IS_ERR() test in the return value
+check should be replaced with NULL test.
+
+Fixes: 46aa27df8853 ('net: axienet: Use devm_* calls')
+Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
++++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+@@ -1602,9 +1602,9 @@ static int axienet_probe(struct platform
+
+ /* Find the DMA node, map the DMA registers, and decode the DMA IRQs */
+ np = of_parse_phandle(pdev->dev.of_node, "axistream-connected", 0);
+- if (IS_ERR(np)) {
++ if (!np) {
+ dev_err(&pdev->dev, "could not find DMA node\n");
+- ret = PTR_ERR(np);
++ ret = -ENODEV;
+ goto free_netdev;
+ }
+ ret = of_address_to_resource(np, 0, &dmares);
--- /dev/null
+From 6517eb59b03965689e6bb16bb2d480096b3ef95d Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Fri, 15 Apr 2016 10:47:52 -0700
+Subject: net: bcmgenet: device stats are unsigned long
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 6517eb59b03965689e6bb16bb2d480096b3ef95d upstream.
+
+On 64bit kernels, device stats are 64bit wide, not 32bit.
+
+Fixes: 1c1008c793fa4 ("net: bcmgenet: add main driver file")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -927,7 +927,11 @@ static void bcmgenet_get_ethtool_stats(s
+ else
+ p = (char *)priv;
+ p += s->stat_offset;
+- data[i] = *(u32 *)p;
++ if (sizeof(unsigned long) != sizeof(u32) &&
++ s->stat_sizeof == sizeof(unsigned long))
++ data[i] = *(unsigned long *)p;
++ else
++ data[i] = *(u32 *)p;
+ }
+ }
+
--- /dev/null
+From 7dd399130efb5a454daf24075b7563d197114e39 Mon Sep 17 00:00:00 2001
+From: Petri Gynther <pgynther@google.com>
+Date: Thu, 24 Mar 2016 11:27:21 -0700
+Subject: net: bcmgenet: fix skb_len in bcmgenet_xmit_single()
+
+From: Petri Gynther <pgynther@google.com>
+
+commit 7dd399130efb5a454daf24075b7563d197114e39 upstream.
+
+skb_len needs to be skb_headlen(skb) in bcmgenet_xmit_single().
+
+Fragmented skbs can have only Ethernet + IP + TCP headers (14+20+20=54 bytes)
+in the linear buffer, followed by the rest in fragments. Bumping skb_len to
+ETH_ZLEN would be incorrect for this case, as it would introduce garbage
+between TCP header and the fragment data.
+
+This also works with regular/non-fragmented small packets < ETH_ZLEN bytes.
+Successfully tested this on GENETv3 with 42-byte ARP frames.
+
+For testing, I used:
+ethtool -K eth0 tx-checksum-ipv4 off
+ethtool -K eth0 tx-checksum-ipv6 off
+echo 0 > /proc/sys/net/ipv4/tcp_timestamps
+
+Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
+Signed-off-by: Petri Gynther <pgynther@google.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/genet/bcmgenet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1346,7 +1346,7 @@ static int bcmgenet_xmit_single(struct n
+
+ tx_cb_ptr->skb = skb;
+
+- skb_len = skb_headlen(skb) < ETH_ZLEN ? ETH_ZLEN : skb_headlen(skb);
++ skb_len = skb_headlen(skb);
+
+ mapping = dma_map_single(kdev, skb->data, skb_len, DMA_TO_DEVICE);
+ ret = dma_mapping_error(kdev, mapping);
--- /dev/null
+From 016eb55157166132b094e53434748cae35e18455 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Thu, 30 Jun 2016 13:27:20 -0700
+Subject: net: bcmsysport: Device stats are unsigned long
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit 016eb55157166132b094e53434748cae35e18455 upstream.
+
+On 64bits kernels, device stats are 64bits wide, not 32bits.
+
+Fixes: 80105befdb4b ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -396,7 +396,7 @@ static void bcm_sysport_get_stats(struct
+ else
+ p = (char *)priv;
+ p += s->stat_offset;
+- data[i] = *(u32 *)p;
++ data[i] = *(unsigned long *)p;
+ }
+ }
+
--- /dev/null
+From 85a3d4a9356b595d5440c3f1bf07ee7cecca1567 Mon Sep 17 00:00:00 2001
+From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Date: Tue, 30 Aug 2016 17:44:29 +0200
+Subject: net: bridge: don't increment tx_dropped in br_do_proxy_arp
+
+From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+
+commit 85a3d4a9356b595d5440c3f1bf07ee7cecca1567 upstream.
+
+pskb_may_pull may fail due to various reasons (e.g. alloc failure), but the
+skb isn't changed/dropped and processing continues so we shouldn't
+increment tx_dropped.
+
+CC: Kyeyoon Park <kyeyoonp@codeaurora.org>
+CC: Roopa Prabhu <roopa@cumulusnetworks.com>
+CC: Stephen Hemminger <stephen@networkplumber.org>
+CC: bridge@lists.linux-foundation.org
+Fixes: 958501163ddd ("bridge: Add support for IEEE 802.11 Proxy ARP")
+Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/bridge/br_input.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -78,13 +78,10 @@ static void br_do_proxy_arp(struct sk_bu
+
+ BR_INPUT_SKB_CB(skb)->proxyarp_replied = false;
+
+- if (dev->flags & IFF_NOARP)
++ if ((dev->flags & IFF_NOARP) ||
++ !pskb_may_pull(skb, arp_hdr_len(dev)))
+ return;
+
+- if (!pskb_may_pull(skb, arp_hdr_len(dev))) {
+- dev->stats.tx_dropped++;
+- return;
+- }
+ parp = arp_hdr(skb);
+
+ if (parp->ar_pro != htons(ETH_P_IP) ||
--- /dev/null
+From 996ecb8246676100af2a4dc1cfed747712a3c85f Mon Sep 17 00:00:00 2001
+From: Vivien Didelot <vivien.didelot@gmail.com>
+Date: Thu, 14 Apr 2016 14:42:08 -0400
+Subject: net: dsa: mv88e6xxx: enable SA learning on DSA ports
+
+From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+
+commit 996ecb8246676100af2a4dc1cfed747712a3c85f upstream.
+
+In multi-chip systems, DSA Tag ports must learn SA addresses in order to
+correctly switch frames between interconnected chips.
+
+This fixes cross-chip hardware bridging in a VLAN filtering aware
+system, because a bridge group gets implemented as an hardware 802.1Q
+VLAN and thus DSA and user ports share the same FDB.
+
+Fixes: 4c7ea3c0791e ("net: dsa: mv88e6xxx: disable SA learning for DSA and CPU ports")
+Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/dsa/mv88e6xxx.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -2064,8 +2064,8 @@ static int mv88e6xxx_setup_port(struct d
+ * the other bits clear.
+ */
+ reg = 1 << port;
+- /* Disable learning for DSA and CPU ports */
+- if (dsa_is_cpu_port(ds, port) || dsa_is_dsa_port(ds, port))
++ /* Disable learning for CPU port */
++ if (dsa_is_cpu_port(ds, port))
+ reg = 0;
+
+ ret = _mv88e6xxx_reg_write(ds, REG_PORT(port), PORT_ASSOC_VECTOR, reg);
--- /dev/null
+From be1faa92e83b1252d9200c59d8c98aab44463f1e Mon Sep 17 00:00:00 2001
+From: Vivien Didelot <vivien.didelot@gmail.com>
+Date: Thu, 28 Jan 2016 16:54:37 -0500
+Subject: net: dsa: mv88e6xxx: fix port VLAN maps
+
+From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+
+commit be1faa92e83b1252d9200c59d8c98aab44463f1e upstream.
+
+Currently the port based VLAN maps should be configured to allow every
+port to egress frames on all other ports, except themselves.
+
+The debugfs interface shows that they are misconfigured. For instance, a
+7-port switch has the following content in the related register 0x06:
+
+ GLOBAL GLOBAL2 SERDES 0 1 2 3 4 5 6
+ ...
+ 6: 1fa4 1f0f 4 7f 7e 7d 7c 7b 7a 79
+ ...
+
+This means that port 3 is allowed to talk to port 2-6, but cannot talk
+to ports 0 and 1. With this fix, port 3 can correctly talk to all ports
+except 3 itself:
+
+ GLOBAL GLOBAL2 SERDES 0 1 2 3 4 5 6
+ ...
+ 6: 1fa4 1f0f 4 7e 7d 7b 77 6f 5f 3f
+ ...
+
+Fixes: ede8098d0fef ("net: dsa: mv88e6xxx: bridges do not need an FID")
+Reported-by: Kevin Smith <kevin.smith@elecsyscorp.com>
+Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Tested-by: Kevin Smith <kevin.smith@elecsyscorp.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/dsa/mv88e6xxx.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/dsa/mv88e6xxx.c
++++ b/drivers/net/dsa/mv88e6xxx.c
+@@ -2150,7 +2150,8 @@ static int mv88e6xxx_setup_port(struct d
+ * database, and allow every port to egress frames on all other ports.
+ */
+ reg = BIT(ps->num_ports) - 1; /* all ports */
+- ret = _mv88e6xxx_port_vlan_map_set(ds, port, reg & ~port);
++ reg &= ~BIT(port); /* except itself */
++ ret = _mv88e6xxx_port_vlan_map_set(ds, port, reg);
+ if (ret)
+ goto abort;
+
--- /dev/null
+From 1740c29a46b30a2f157afc473156f157e599d4c2 Mon Sep 17 00:00:00 2001
+From: "xypron.glpk@gmx.de" <xypron.glpk@gmx.de>
+Date: Tue, 17 May 2016 22:28:54 +0200
+Subject: net: ehea: avoid null pointer dereference
+
+From: xypron.glpk@gmx.de <xypron.glpk@gmx.de>
+
+commit 1740c29a46b30a2f157afc473156f157e599d4c2 upstream.
+
+ehea_get_port may return NULL. Do not dereference NULL value.
+
+Fixes: 8c4877a4128e ("ehea: Use the standard logging functions")
+Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Acked-by: Thadeu Lima de Souza Cascardo <cascardo@debian.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ibm/ehea/ehea_main.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/ehea/ehea_main.c
++++ b/drivers/net/ethernet/ibm/ehea/ehea_main.c
+@@ -1169,16 +1169,15 @@ static void ehea_parse_eqe(struct ehea_a
+ ec = EHEA_BMASK_GET(NEQE_EVENT_CODE, eqe);
+ portnum = EHEA_BMASK_GET(NEQE_PORTNUM, eqe);
+ port = ehea_get_port(adapter, portnum);
++ if (!port) {
++ netdev_err(NULL, "unknown portnum %x\n", portnum);
++ return;
++ }
+ dev = port->netdev;
+
+ switch (ec) {
+ case EHEA_EC_PORTSTATE_CHG: /* port state change */
+
+- if (!port) {
+- netdev_err(dev, "unknown portnum %x\n", portnum);
+- break;
+- }
+-
+ if (EHEA_BMASK_GET(NEQE_PORT_UP, eqe)) {
+ if (!netif_carrier_ok(dev)) {
+ ret = ehea_sense_port_attr(port);
--- /dev/null
+From c823abac17926767fb50175e098f087a6ac684c3 Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Sun, 4 Dec 2016 19:22:05 -0800
+Subject: net: ep93xx_eth: Do not crash unloading module
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit c823abac17926767fb50175e098f087a6ac684c3 upstream.
+
+When we unload the ep93xx_eth, whether we have opened the network
+interface or not, we will either hit a kernel paging request error, or a
+simple NULL pointer de-reference because:
+
+- if ep93xx_open has been called, we have created a valid DMA mapping
+ for ep->descs, when we call ep93xx_stop, we also call
+ ep93xx_free_buffers, ep->descs now has a stale value
+
+- if ep93xx_open has not been called, we have a NULL pointer for
+ ep->descs, so performing any operation against that address just won't
+ work
+
+Fix this by adding a NULL pointer check for ep->descs which means that
+ep93xx_free_buffers() was able to successfully tear down the descriptors
+and free the DMA cookie as well.
+
+Fixes: 1d22e05df818 ("[PATCH] Cirrus Logic ep93xx ethernet driver")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/cirrus/ep93xx_eth.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/ethernet/cirrus/ep93xx_eth.c
++++ b/drivers/net/ethernet/cirrus/ep93xx_eth.c
+@@ -468,6 +468,9 @@ static void ep93xx_free_buffers(struct e
+ struct device *dev = ep->dev->dev.parent;
+ int i;
+
++ if (!ep->descs)
++ return;
++
+ for (i = 0; i < RX_QUEUE_ENTRIES; i++) {
+ dma_addr_t d;
+
+@@ -490,6 +493,7 @@ static void ep93xx_free_buffers(struct e
+
+ dma_free_coherent(dev, sizeof(struct ep93xx_descs), ep->descs,
+ ep->descs_dma_addr);
++ ep->descs = NULL;
+ }
+
+ static int ep93xx_alloc_buffers(struct ep93xx_priv *ep)
--- /dev/null
+From 62522ef3c399996f6c8120bfd14b94280bc9f490 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Mon, 25 Apr 2016 19:41:38 +0200
+Subject: net: ethernet: davinci_emac: Fix devioctl while in fixed link
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+commit 62522ef3c399996f6c8120bfd14b94280bc9f490 upstream.
+
+When configured in fixed link, the DaVinci emac driver sets the
+priv->phydev to NULL and further ioctl calls to the phy_mii_ioctl()
+causes the kernel to crash.
+
+Cc: Brian Hutchinson <b.hutchman@gmail.com>
+Fixes: 1bb6aa56bb38 ("net: davinci_emac: Add support for fixed-link PHY")
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Mugunthan V N <mugunthanvnm@ti.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ti/davinci_emac.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1512,7 +1512,10 @@ static int emac_devioctl(struct net_devi
+
+ /* TODO: Add phy read and write and private statistics get feature */
+
+- return phy_mii_ioctl(priv->phydev, ifrq, cmd);
++ if (priv->phydev)
++ return phy_mii_ioctl(priv->phydev, ifrq, cmd);
++ else
++ return -EOPNOTSUPP;
+ }
+
+ static int match_first_device(struct device *dev, void *data)
--- /dev/null
+From 210990b05a1247886539078e857cd038881bb2d6 Mon Sep 17 00:00:00 2001
+From: Neil Armstrong <narmstrong@baylibre.com>
+Date: Wed, 20 Apr 2016 10:56:45 +0200
+Subject: net: ethernet: davinci_emac: Fix platform_data overwrite
+
+From: Neil Armstrong <narmstrong@baylibre.com>
+
+commit 210990b05a1247886539078e857cd038881bb2d6 upstream.
+
+When the DaVinci emac driver is removed and re-probed, the actual
+pdev->dev.platform_data is populated with an unwanted valid pointer saved by
+the previous davinci_emac_of_get_pdata() call, causing a kernel crash when
+calling priv->int_disable() in emac_int_disable().
+
+Unable to handle kernel paging request at virtual address c8622a80
+...
+[<c0426fb4>] (emac_int_disable) from [<c0427700>] (emac_dev_open+0x290/0x5f8)
+[<c0427700>] (emac_dev_open) from [<c04c00ec>] (__dev_open+0xb8/0x120)
+[<c04c00ec>] (__dev_open) from [<c04c0370>] (__dev_change_flags+0x88/0x14c)
+[<c04c0370>] (__dev_change_flags) from [<c04c044c>] (dev_change_flags+0x18/0x48)
+[<c04c044c>] (dev_change_flags) from [<c052bafc>] (devinet_ioctl+0x6b4/0x7ac)
+[<c052bafc>] (devinet_ioctl) from [<c04a1428>] (sock_ioctl+0x1d8/0x2c0)
+[<c04a1428>] (sock_ioctl) from [<c014f054>] (do_vfs_ioctl+0x41c/0x600)
+[<c014f054>] (do_vfs_ioctl) from [<c014f2a4>] (SyS_ioctl+0x6c/0x7c)
+[<c014f2a4>] (SyS_ioctl) from [<c000ff60>] (ret_fast_syscall+0x0/0x1c)
+
+Fixes: 42f59967a091 ("net: ethernet: davinci_emac: add OF support")
+Cc: Brian Hutchinson <b.hutchman@gmail.com>
+Signed-off-by: Neil Armstrong <narmstrong@baylibre.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ti/davinci_emac.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/net/ethernet/ti/davinci_emac.c
++++ b/drivers/net/ethernet/ti/davinci_emac.c
+@@ -1888,8 +1888,6 @@ davinci_emac_of_get_pdata(struct platfor
+ pdata->hw_ram_addr = auxdata->hw_ram_addr;
+ }
+
+- pdev->dev.platform_data = pdata;
+-
+ return pdata;
+ }
+
--- /dev/null
+From 97db8afa2ab919fc400fe982f5054060868bdf07 Mon Sep 17 00:00:00 2001
+From: Andrew Lunn <andrew@lunn.ch>
+Date: Thu, 24 Nov 2016 00:08:13 +0100
+Subject: net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented
+
+From: Andrew Lunn <andrew@lunn.ch>
+
+commit 97db8afa2ab919fc400fe982f5054060868bdf07 upstream.
+
+The mvneta driver advertises it supports IFF_UNICAST_FLT. However, it
+actually does not. The hardware probably does support it, but there is
+no code to configure the filter. As a quick and simple fix, remove the
+flag. This will cause the core to fall back to promiscuous mode.
+
+Signed-off-by: Andrew Lunn <andrew@lunn.ch>
+Fixes: b50b72de2f2f ("net: mvneta: enable features before registering the driver")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/marvell/mvneta.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3406,7 +3406,7 @@ static int mvneta_probe(struct platform_
+ dev->features = NETIF_F_SG | NETIF_F_IP_CSUM | NETIF_F_TSO;
+ dev->hw_features |= dev->features;
+ dev->vlan_features |= dev->features;
+- dev->priv_flags |= IFF_UNICAST_FLT | IFF_LIVE_ADDR_CHANGE;
++ dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
+ dev->gso_max_segs = MVNETA_MAX_TSO_SEGS;
+
+ err = register_netdev(dev);
--- /dev/null
+From 939b20022765bc338b0f72cbf1eed60a907398d7 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 30 Nov 2016 15:29:52 +0100
+Subject: net: ethernet: stmmac: dwmac-generic: fix probe error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 939b20022765bc338b0f72cbf1eed60a907398d7 upstream.
+
+Make sure to call any exit() callback to undo the effect of init()
+before returning on late probe errors.
+
+Fixes: cf3f047b9af4 ("stmmac: move hw init in the probe (v2)")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-generic.c
+@@ -53,7 +53,17 @@ static int dwmac_generic_probe(struct pl
+ return ret;
+ }
+
+- return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++ ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++ if (ret)
++ goto err_exit;
++
++ return 0;
++
++err_exit:
++ if (plat_dat->exit)
++ plat_dat->exit(pdev, plat_dat->bsp_priv);
++
++ return ret;
+ }
+
+ static const struct of_device_id dwmac_generic_match[] = {
--- /dev/null
+From 2d222656db08b8eef3b53b56cf1ce4a90fe8cd78 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 30 Nov 2016 15:29:51 +0100
+Subject: net: ethernet: stmmac: dwmac-rk: fix probe error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 2d222656db08b8eef3b53b56cf1ce4a90fe8cd78 upstream.
+
+Make sure to disable runtime PM, power down the PHY, and disable clocks
+before returning on late probe errors.
+
+Fixes: 27ffefd2d109 ("stmmac: dwmac-rk: create a new probe function")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-rk.c
+@@ -600,7 +600,16 @@ static int rk_gmac_probe(struct platform
+ if (ret)
+ return ret;
+
+- return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++ ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++ if (ret)
++ goto err_gmac_exit;
++
++ return 0;
++
++err_gmac_exit:
++ rk_gmac_exit(pdev, plat_dat->bsp_priv);
++
++ return ret;
+ }
+
+ static const struct of_device_id rk_gmac_dwmac_match[] = {
--- /dev/null
+From 0a9e22715ee384cf2a714c28f24ce8881b9fd815 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Wed, 30 Nov 2016 15:29:50 +0100
+Subject: net: ethernet: stmmac: dwmac-sti: fix probe error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 0a9e22715ee384cf2a714c28f24ce8881b9fd815 upstream.
+
+Make sure to disable clocks before returning on late probe errors.
+
+Fixes: 8387ee21f972 ("stmmac: dwmac-sti: turn setup callback into a
+probe function")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c | 11 ++++++++++-
+ 1 file changed, 10 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
++++ b/drivers/net/ethernet/stmicro/stmmac/dwmac-sti.c
+@@ -365,7 +365,16 @@ static int sti_dwmac_probe(struct platfo
+ if (ret)
+ return ret;
+
+- return stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++ ret = stmmac_dvr_probe(&pdev->dev, plat_dat, &stmmac_res);
++ if (ret)
++ goto err_dwmac_exit;
++
++ return 0;
++
++err_dwmac_exit:
++ sti_dwmac_exit(pdev, plat_dat->bsp_priv);
++
++ return ret;
+ }
+
+ static const struct sti_dwmac_of_data stih4xx_dwmac_data = {
--- /dev/null
+From c7262aaace1b17a650598063e3b9ee1785fde377 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 3 Nov 2016 18:40:20 +0100
+Subject: net: ethernet: ti: cpsw: fix device and of_node leaks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit c7262aaace1b17a650598063e3b9ee1785fde377 upstream.
+
+Make sure to drop the references taken by of_get_child_by_name() and
+bus_find_device() before returning from cpsw_phy_sel().
+
+Note that holding a reference to the cpsw-phy-sel device does not
+prevent the devres-managed private data from going away.
+
+Fixes: 5892cd135e16 ("drivers: net: cpsw-phy-sel: Add new driver...")
+Cc: Mugunthan V N <mugunthanvnm@ti.com>
+Cc: Grygorii Strashko <grygorii.strashko@ti.com>
+Cc: linux-omap@vger.kernel.org
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ti/cpsw-phy-sel.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/ti/cpsw-phy-sel.c
++++ b/drivers/net/ethernet/ti/cpsw-phy-sel.c
+@@ -154,9 +154,12 @@ void cpsw_phy_sel(struct device *dev, ph
+ }
+
+ dev = bus_find_device(&platform_bus_type, NULL, node, match);
++ of_node_put(node);
+ priv = dev_get_drvdata(dev);
+
+ priv->cpsw_phy_sel(priv, phy_mode, slave);
++
++ put_device(dev);
+ }
+ EXPORT_SYMBOL_GPL(cpsw_phy_sel);
+
--- /dev/null
+From a7fe9d466f6a33558a38c7ca9d58bcc83512d577 Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 17 Nov 2016 17:40:02 +0100
+Subject: net: ethernet: ti: cpsw: fix secondary-emac probe error path
+
+From: Johan Hovold <johan@kernel.org>
+
+commit a7fe9d466f6a33558a38c7ca9d58bcc83512d577 upstream.
+
+Make sure to deregister the primary device in case the secondary emac
+fails to probe.
+
+kernel BUG at /home/johan/work/omicron/src/linux/net/core/dev.c:7743!
+...
+[<c05b3dec>] (free_netdev) from [<c04fe6c0>] (cpsw_probe+0x9cc/0xe50)
+[<c04fe6c0>] (cpsw_probe) from [<c047b28c>] (platform_drv_probe+0x5c/0xc0)
+
+Fixes: d9ba8f9e6298 ("driver: net: ethernet: cpsw: dual emac interface
+implementation")
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ti/cpsw.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/ti/cpsw.c
++++ b/drivers/net/ethernet/ti/cpsw.c
+@@ -2532,12 +2532,14 @@ static int cpsw_probe(struct platform_de
+ ret = cpsw_probe_dual_emac(pdev, priv);
+ if (ret) {
+ cpsw_err(priv, probe, "error probe slave 2 emac interface\n");
+- goto clean_ale_ret;
++ goto clean_unregister_netdev_ret;
+ }
+ }
+
+ return 0;
+
++clean_unregister_netdev_ret:
++ unregister_netdev(ndev);
+ clean_ale_ret:
+ cpsw_ale_destroy(priv->ale);
+ clean_dma_ret:
--- /dev/null
+From 386512d18b268c6182903239f9f3390f03ce4c7b Mon Sep 17 00:00:00 2001
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Tue, 12 Jul 2016 16:04:35 -0700
+Subject: net: ethoc: Fix early error paths
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+commit 386512d18b268c6182903239f9f3390f03ce4c7b upstream.
+
+In case any operation fails before we can successfully go the point
+where we would register a MDIO bus, we would be going to an error label
+which involves unregistering then freeing this yet to be created MDIO
+bus. Update all error paths to go to label free which is the only one
+valid until either the clock is enabled, or the MDIO bus is allocated
+and registered. This fixes kernel oops observed while trying to
+dereference the MDIO bus structure which is not yet allocated.
+
+Fixes: a1702857724f ("net: Add support for the OpenCores 10/100 Mbps Ethernet MAC.")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/ethoc.c | 10 +++++-----
+ 1 file changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/ethoc.c
++++ b/drivers/net/ethernet/ethoc.c
+@@ -1088,7 +1088,7 @@ static int ethoc_probe(struct platform_d
+ if (!priv->iobase) {
+ dev_err(&pdev->dev, "cannot remap I/O memory space\n");
+ ret = -ENXIO;
+- goto error;
++ goto free;
+ }
+
+ if (netdev->mem_end) {
+@@ -1097,7 +1097,7 @@ static int ethoc_probe(struct platform_d
+ if (!priv->membase) {
+ dev_err(&pdev->dev, "cannot remap memory space\n");
+ ret = -ENXIO;
+- goto error;
++ goto free;
+ }
+ } else {
+ /* Allocate buffer memory */
+@@ -1108,7 +1108,7 @@ static int ethoc_probe(struct platform_d
+ dev_err(&pdev->dev, "cannot allocate %dB buffer\n",
+ buffer_size);
+ ret = -ENOMEM;
+- goto error;
++ goto free;
+ }
+ netdev->mem_end = netdev->mem_start + buffer_size;
+ priv->dma_alloc = buffer_size;
+@@ -1122,7 +1122,7 @@ static int ethoc_probe(struct platform_d
+ 128, (netdev->mem_end - netdev->mem_start + 1) / ETHOC_BUFSIZ);
+ if (num_bd < 4) {
+ ret = -ENODEV;
+- goto error;
++ goto free;
+ }
+ priv->num_bd = num_bd;
+ /* num_tx must be a power of two */
+@@ -1135,7 +1135,7 @@ static int ethoc_probe(struct platform_d
+ priv->vma = devm_kzalloc(&pdev->dev, num_bd*sizeof(void *), GFP_KERNEL);
+ if (!priv->vma) {
+ ret = -ENOMEM;
+- goto error;
++ goto free;
+ }
+
+ /* Allow the platform setup code to pass in a MAC address. */
--- /dev/null
+From 2271150bfb814b72ec57ae2fdf66e39da2eafafd Mon Sep 17 00:00:00 2001
+From: Johan Hovold <johan@kernel.org>
+Date: Thu, 3 Nov 2016 18:40:22 +0100
+Subject: net: hns: fix device reference leaks
+
+From: Johan Hovold <johan@kernel.org>
+
+commit 2271150bfb814b72ec57ae2fdf66e39da2eafafd upstream.
+
+Make sure to drop the reference taken by class_find_device() in
+hnae_get_handle() on errors and when later releasing the handle.
+
+Fixes: 6fe6611ff275 ("net: add Hisilicon Network Subsystem...")
+Cc: Yisen Zhuang <yisen.zhuang@huawei.com>
+Cc: Salil Mehta <salil.mehta@huawei.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/hisilicon/hns/hnae.c | 8 +++++++-
+ 1 file changed, 7 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/hisilicon/hns/hnae.c
++++ b/drivers/net/ethernet/hisilicon/hns/hnae.c
+@@ -331,8 +331,10 @@ struct hnae_handle *hnae_get_handle(stru
+ return ERR_PTR(-ENODEV);
+
+ handle = dev->ops->get_handle(dev, port_id);
+- if (IS_ERR(handle))
++ if (IS_ERR(handle)) {
++ put_device(&dev->cls_dev);
+ return handle;
++ }
+
+ handle->dev = dev;
+ handle->owner_dev = owner_dev;
+@@ -355,6 +357,8 @@ out_when_init_queue:
+ for (j = i - 1; j >= 0; j--)
+ hnae_fini_queue(handle->qs[j]);
+
++ put_device(&dev->cls_dev);
++
+ return ERR_PTR(-ENOMEM);
+ }
+ EXPORT_SYMBOL(hnae_get_handle);
+@@ -376,6 +380,8 @@ void hnae_put_handle(struct hnae_handle
+ dev->ops->put_handle(h);
+
+ module_put(dev->owner);
++
++ put_device(&dev->cls_dev);
+ }
+ EXPORT_SYMBOL(hnae_put_handle);
+
--- /dev/null
+From 5d41ce29e3b91ef305f88d23f72b3359de329cec Mon Sep 17 00:00:00 2001
+From: David Ahern <dsa@cumulusnetworks.com>
+Date: Thu, 3 Nov 2016 16:17:26 -0700
+Subject: net: icmp6_send should use dst dev to determine L3 domain
+
+From: David Ahern <dsa@cumulusnetworks.com>
+
+commit 5d41ce29e3b91ef305f88d23f72b3359de329cec upstream.
+
+icmp6_send is called in response to some event. The skb may not have
+the device set (skb->dev is NULL), but it is expected to have a dst set.
+Update icmp6_send to use the dst on the skb to determine L3 domain.
+
+Fixes: ca254490c8dfd ("net: Add VRF support to IPv6 stack")
+Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/icmp.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/icmp.c
++++ b/net/ipv6/icmp.c
+@@ -446,7 +446,7 @@ static void icmp6_send(struct sk_buff *s
+ if (__ipv6_addr_needs_scope_id(addr_type))
+ iif = skb->dev->ifindex;
+ else
+- iif = l3mdev_master_ifindex(skb->dev);
++ iif = l3mdev_master_ifindex(skb_dst(skb)->dev);
+
+ /*
+ * Must not send error if the source does not uniquely
--- /dev/null
+From 9d1a6c4ea43e48c7880c85971c17939b56832d8a Mon Sep 17 00:00:00 2001
+From: David Ahern <dsa@cumulusnetworks.com>
+Date: Mon, 7 Nov 2016 12:03:09 -0800
+Subject: net: icmp_route_lookup should use rt dev to determine L3 domain
+
+From: David Ahern <dsa@cumulusnetworks.com>
+
+commit 9d1a6c4ea43e48c7880c85971c17939b56832d8a upstream.
+
+icmp_send is called in response to some event. The skb may not have
+the device set (skb->dev is NULL), but it is expected to have an rt.
+Update icmp_route_lookup to use the rt on the skb to determine L3
+domain.
+
+Fixes: 613d09b30f8b ("net: Use VRF device index for lookups on TX")
+Signed-off-by: David Ahern <dsa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/icmp.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/icmp.c
++++ b/net/ipv4/icmp.c
+@@ -478,7 +478,7 @@ static struct rtable *icmp_route_lookup(
+ fl4->flowi4_proto = IPPROTO_ICMP;
+ fl4->fl4_icmp_type = type;
+ fl4->fl4_icmp_code = code;
+- fl4->flowi4_oif = l3mdev_master_ifindex(skb_in->dev);
++ fl4->flowi4_oif = l3mdev_master_ifindex(skb_dst(skb_in)->dev);
+
+ security_skb_classify_flow(skb_in, flowi4_to_flowi(fl4));
+ rt = __ip_route_output_key_hash(net, fl4,
+@@ -503,7 +503,7 @@ static struct rtable *icmp_route_lookup(
+ if (err)
+ goto relookup_failed;
+
+- if (inet_addr_type_dev_table(net, skb_in->dev,
++ if (inet_addr_type_dev_table(net, skb_dst(skb_in)->dev,
+ fl4_dec.saddr) == RTN_LOCAL) {
+ rt2 = __ip_route_output_key(net, &fl4_dec);
+ if (IS_ERR(rt2))
--- /dev/null
+From b22ae0b4d9669495158a7fa0fd027bd0fcd8896e Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyj.lk@gmail.com>
+Date: Fri, 12 Aug 2016 15:43:54 +0000
+Subject: net: macb: add missing free_netdev() on error in macb_probe()
+
+From: Wei Yongjun <weiyj.lk@gmail.com>
+
+commit b22ae0b4d9669495158a7fa0fd027bd0fcd8896e upstream.
+
+Add the missing free_netdev() before return from function macb_probe()
+in the platform_get_irq() error handling case.
+
+Fixes: c69618b3e4f2 ("net/macb: fix probe sequence to setup clocks earlier")
+Signed-off-by: Wei Yongjun <weiyj.lk@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/cadence/macb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/cadence/macb.c
++++ b/drivers/net/ethernet/cadence/macb.c
+@@ -2904,7 +2904,7 @@ static int macb_probe(struct platform_de
+ dev->irq = platform_get_irq(pdev, 0);
+ if (dev->irq < 0) {
+ err = dev->irq;
+- goto err_disable_clocks;
++ goto err_out_free_netdev;
+ }
+
+ mac = of_get_mac_address(np);
--- /dev/null
+From ba5049945421b8d2f3e2af786a15d13b82316503 Mon Sep 17 00:00:00 2001
+From: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+Date: Thu, 24 Mar 2016 15:40:04 +0100
+Subject: net: macb: replace macb_writel() call by queue_writel() to update queue ISR
+
+From: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+
+commit ba5049945421b8d2f3e2af786a15d13b82316503 upstream.
+
+macb_interrupt() should not use macb_writel(bp, ISR, <value>) but only
+queue_writel(queue, ISR, <value>).
+
+There is one IRQ and one set of {ISR, IER, IDR, IMR} [1] registers per
+queue on gem hardware, though only queue0 is actually used for now to
+receive frames: other queues can already be used to transmit frames.
+
+The queue_readl() and queue_writel() helper macros are designed to access
+the relevant IRQ registers.
+
+[1]
+ISR: Interrupt Status Register
+IER: Interrupt Enable Register
+IDR: Interrupt Disable Register
+IMR: Interrupt Mask Register
+
+Signed-off-by: Cyrille Pitchen <cyrille.pitchen@atmel.com>
+Fixes: bfbb92c44670 ("net: macb: Handle the RXUBR interrupt on all devices")
+Acked-by: Nicolas Ferre <nicolas.ferre@atmel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/cadence/macb.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/cadence/macb.c
++++ b/drivers/net/ethernet/cadence/macb.c
+@@ -1104,7 +1104,7 @@ static irqreturn_t macb_interrupt(int ir
+ macb_writel(bp, NCR, ctrl | MACB_BIT(RE));
+
+ if (bp->caps & MACB_CAPS_ISR_CLEAR_ON_WRITE)
+- macb_writel(bp, ISR, MACB_BIT(RXUBR));
++ queue_writel(queue, ISR, MACB_BIT(RXUBR));
+ }
+
+ if (status & MACB_BIT(ISR_ROVR)) {
--- /dev/null
+From 3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8 Mon Sep 17 00:00:00 2001
+From: Nicolas Schichan <nschichan@freebox.fr>
+Date: Tue, 26 Jan 2016 16:12:35 +0100
+Subject: net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
+
+From: Nicolas Schichan <nschichan@freebox.fr>
+
+commit 3b89624ab54b9dc2d92fc08ce2670e5f19ad8ec8 upstream.
+
+The code in txq_put_data() would use txq->tx_curr_desc to index the
+tso_hdrs/tso_hdrs_dma buffers, for less than 8 bytes unaligned
+fragments, which is already moved to the next descriptor at the
+beginning of the function.
+
+If that fragment was the last of the the skb, the next skb would use
+that same space to place the ip headers, overwritting that small
+fragment data.
+
+Fixes: 91986fd3d335 (net: mv643xx_eth: Ensure proper data alignment in TSO TX path)
+Signed-off-by: Nicolas Schichan <nschichan@freebox.fr>
+Reviewed-by: Philipp Kirchhofer <philipp@familie-kirchhofer.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/marvell/mv643xx_eth.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mv643xx_eth.c
++++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
+@@ -762,10 +762,10 @@ txq_put_data_tso(struct net_device *dev,
+
+ if (length <= 8 && (uintptr_t)data & 0x7) {
+ /* Copy unaligned small data fragment to TSO header data area */
+- memcpy(txq->tso_hdrs + txq->tx_curr_desc * TSO_HEADER_SIZE,
++ memcpy(txq->tso_hdrs + tx_index * TSO_HEADER_SIZE,
+ data, length);
+ desc->buf_ptr = txq->tso_hdrs_dma
+- + txq->tx_curr_desc * TSO_HEADER_SIZE;
++ + tx_index * TSO_HEADER_SIZE;
+ } else {
+ /* Alignment is okay, map buffer and hand off to hardware */
+ txq->tx_desc_mapping[tx_index] = DESC_DMA_MAP_SINGLE;
--- /dev/null
+From 2c832293e09be2f998ea916650927c8ccd5b4b3b Mon Sep 17 00:00:00 2001
+From: Jisheng Zhang <jszhang@marvell.com>
+Date: Wed, 20 Jan 2016 16:36:25 +0800
+Subject: net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats
+
+From: Jisheng Zhang <jszhang@marvell.com>
+
+commit 2c832293e09be2f998ea916650927c8ccd5b4b3b upstream.
+
+When s->type is T_REG_64, the high 32bits are lost in val. This patch
+fixes this trivial issue.
+
+Signed-off-by: Jisheng Zhang <jszhang@marvell.com>
+Fixes: 9b0cdefa4cd5 ("net: mvneta: add ethtool statistics")
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/marvell/mvneta.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/marvell/mvneta.c
++++ b/drivers/net/ethernet/marvell/mvneta.c
+@@ -3058,26 +3058,25 @@ static void mvneta_ethtool_update_stats(
+ const struct mvneta_statistic *s;
+ void __iomem *base = pp->base;
+ u32 high, low, val;
++ u64 val64;
+ int i;
+
+ for (i = 0, s = mvneta_statistics;
+ s < mvneta_statistics + ARRAY_SIZE(mvneta_statistics);
+ s++, i++) {
+- val = 0;
+-
+ switch (s->type) {
+ case T_REG_32:
+ val = readl_relaxed(base + s->offset);
++ pp->ethtool_stats[i] += val;
+ break;
+ case T_REG_64:
+ /* Docs say to read low 32-bit then high */
+ low = readl_relaxed(base + s->offset);
+ high = readl_relaxed(base + s->offset + 4);
+- val = (u64)high << 32 | low;
++ val64 = (u64)high << 32 | low;
++ pp->ethtool_stats[i] += val64;
+ break;
+ }
+-
+- pp->ethtool_stats[i] += val;
+ }
+ }
+
--- /dev/null
+From 636c2628086e40c86dac7ddc84a1c4b4fcccc6e3 Mon Sep 17 00:00:00 2001
+From: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
+Date: Tue, 20 Sep 2016 12:48:36 +0300
+Subject: net: skbuff: Remove errornous length validation in skb_vlan_pop()
+
+From: Shmulik Ladkani <shmulik.ladkani@ravellosystems.com>
+
+commit 636c2628086e40c86dac7ddc84a1c4b4fcccc6e3 upstream.
+
+In 93515d53b1
+ "net: move vlan pop/push functions into common code"
+skb_vlan_pop was moved from its private location in openvswitch to
+skbuff common code.
+
+In case skb has non hw-accel vlan tag, the original 'pop_vlan()' assured
+that skb->len is sufficient (if skb->len < VLAN_ETH_HLEN then pop was
+considered a no-op).
+
+This validation was moved as is into the new common 'skb_vlan_pop'.
+
+Alas, in its original location (openvswitch), there was a guarantee that
+'data' points to the mac_header, therefore the 'skb->len < VLAN_ETH_HLEN'
+condition made sense.
+However there's no such guarantee in the generic 'skb_vlan_pop'.
+
+For short packets received in rx path going through 'skb_vlan_pop',
+this causes 'skb_vlan_pop' to fail pop-ing a valid vlan hdr (in the non
+hw-accel case) or to fail moving next tag into hw-accel tag.
+
+Remove the 'skb->len < VLAN_ETH_HLEN' condition entirely:
+It is superfluous since inner '__skb_vlan_pop' already verifies there
+are VLAN_ETH_HLEN writable bytes at the mac_header.
+
+Note this presents a slight change to skb_vlan_pop() users:
+In case total length is smaller than VLAN_ETH_HLEN, skb_vlan_pop() now
+returns an error, as opposed to previous "no-op" behavior.
+Existing callers (e.g. tc act vlan, ovs) usually drop the packet if
+'skb_vlan_pop' fails.
+
+Fixes: 93515d53b1 ("net: move vlan pop/push functions into common code")
+Signed-off-by: Shmulik Ladkani <shmulik.ladkani@gmail.com>
+Cc: Pravin Shelar <pshelar@ovn.org>
+Reviewed-by: Pravin B Shelar <pshelar@ovn.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/skbuff.c | 10 ++++------
+ 1 file changed, 4 insertions(+), 6 deletions(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -4451,9 +4451,8 @@ int skb_vlan_pop(struct sk_buff *skb)
+ if (likely(skb_vlan_tag_present(skb))) {
+ skb->vlan_tci = 0;
+ } else {
+- if (unlikely((skb->protocol != htons(ETH_P_8021Q) &&
+- skb->protocol != htons(ETH_P_8021AD)) ||
+- skb->len < VLAN_ETH_HLEN))
++ if (unlikely(skb->protocol != htons(ETH_P_8021Q) &&
++ skb->protocol != htons(ETH_P_8021AD)))
+ return 0;
+
+ err = __skb_vlan_pop(skb, &vlan_tci);
+@@ -4461,9 +4460,8 @@ int skb_vlan_pop(struct sk_buff *skb)
+ return err;
+ }
+ /* move next vlan tag to hw accel tag */
+- if (likely((skb->protocol != htons(ETH_P_8021Q) &&
+- skb->protocol != htons(ETH_P_8021AD)) ||
+- skb->len < VLAN_ETH_HLEN))
++ if (likely(skb->protocol != htons(ETH_P_8021Q) &&
++ skb->protocol != htons(ETH_P_8021AD)))
+ return 0;
+
+ vlan_proto = skb->protocol;
--- /dev/null
+From bbec7802c6948c8626b71a4fe31283cb4691c358 Mon Sep 17 00:00:00 2001
+From: pravin shelar <pshelar@ovn.org>
+Date: Fri, 5 Aug 2016 17:45:37 -0700
+Subject: net: vxlan: lwt: Fix vxlan local traffic.
+
+From: pravin shelar <pshelar@ovn.org>
+
+commit bbec7802c6948c8626b71a4fe31283cb4691c358 upstream.
+
+vxlan driver has bypass for local vxlan traffic, but that
+depends on information about all VNIs on local system in
+vxlan driver. This is not available in case of LWT.
+Therefore following patch disable encap bypass for LWT
+vxlan traffic.
+
+Fixes: ee122c79d42 ("vxlan: Flow based tunneling").
+Reported-by: Jakub Libosvar <jlibosva@redhat.com>
+Signed-off-by: Pravin B Shelar <pshelar@ovn.org>
+Acked-by: Jiri Benc <jbenc@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/vxlan.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2054,7 +2054,7 @@ static void vxlan_xmit_one(struct sk_buf
+ }
+
+ /* Bypass encapsulation if the destination is local */
+- if (rt->rt_flags & RTCF_LOCAL &&
++ if (!info && rt->rt_flags & RTCF_LOCAL &&
+ !(rt->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
+ struct vxlan_dev *dst_vxlan;
+
+@@ -2112,7 +2112,7 @@ static void vxlan_xmit_one(struct sk_buf
+
+ /* Bypass encapsulation if the destination is local */
+ rt6i_flags = ((struct rt6_info *)ndst)->rt6i_flags;
+- if (rt6i_flags & RTF_LOCAL &&
++ if (!info && rt6i_flags & RTF_LOCAL &&
+ !(rt6i_flags & (RTCF_BROADCAST | RTCF_MULTICAST))) {
+ struct vxlan_dev *dst_vxlan;
+
--- /dev/null
+From 41009481b690493c169ce85f591b9d32c6fd9422 Mon Sep 17 00:00:00 2001
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Date: Mon, 13 Jun 2016 10:31:07 +0200
+Subject: ovs/geneve: fix rtnl notifications on iface deletion
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+commit 41009481b690493c169ce85f591b9d32c6fd9422 upstream.
+
+The function geneve_dev_create_fb() (only used by ovs) never calls
+rtnl_configure_link(). The consequence is that dev->rtnl_link_state is
+never set to RTNL_LINK_INITIALIZED.
+During the deletion phase, the function rollback_registered_many() sends
+a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED.
+
+Fixes: e305ac6cf5a1 ("geneve: Add support to collect tunnel metadata.")
+CC: Pravin B Shelar <pshelar@nicira.com>
+CC: Jesse Gross <jesse@nicira.com>
+CC: Thomas Graf <tgraf@suug.ch>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/geneve.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/net/geneve.c
++++ b/drivers/net/geneve.c
+@@ -1363,6 +1363,10 @@ struct net_device *geneve_dev_create_fb(
+ if (err)
+ goto err;
+
++ err = rtnl_configure_link(dev, NULL);
++ if (err < 0)
++ goto err;
++
+ return dev;
+
+ err:
--- /dev/null
+From da6f1da819d4b9c081a477dec74dc468a0b44290 Mon Sep 17 00:00:00 2001
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Date: Mon, 13 Jun 2016 10:31:06 +0200
+Subject: ovs/gre: fix rtnl notifications on iface deletion
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+commit da6f1da819d4b9c081a477dec74dc468a0b44290 upstream.
+
+The function gretap_fb_dev_create() (only used by ovs) never calls
+rtnl_configure_link(). The consequence is that dev->rtnl_link_state is
+never set to RTNL_LINK_INITIALIZED.
+During the deletion phase, the function rollback_registered_many() sends
+a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED.
+
+Fixes: b2acd1dc3949 ("openvswitch: Use regular GRE net_device instead of vport")
+CC: Thomas Graf <tgraf@suug.ch>
+CC: Pravin B Shelar <pshelar@nicira.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv4/ip_gre.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -1265,6 +1265,10 @@ struct net_device *gretap_fb_dev_create(
+ if (err)
+ goto out;
+
++ err = rtnl_configure_link(dev, NULL);
++ if (err < 0)
++ goto out;
++
+ return dev;
+ out:
+ ip_tunnel_dellink(dev, &list_kill);
--- /dev/null
+From cf5da330bbdd0c06b05c525a3d1d58ccd82c87a6 Mon Sep 17 00:00:00 2001
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Date: Mon, 13 Jun 2016 10:31:05 +0200
+Subject: ovs/vxlan: fix rtnl notifications on iface deletion
+
+From: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+
+commit cf5da330bbdd0c06b05c525a3d1d58ccd82c87a6 upstream.
+
+The function vxlan_dev_create() (only used by ovs) never calls
+rtnl_configure_link(). The consequence is that dev->rtnl_link_state is
+never set to RTNL_LINK_INITIALIZED.
+During the deletion phase, the function rollback_registered_many() sends
+a RTM_DELLINK only if dev->rtnl_link_state is set to RTNL_LINK_INITIALIZED.
+
+Note that the function vxlan_dev_create() is moved after the rtnl stuff so
+that vxlan_dellink() can be called in this function.
+
+Fixes: dcc38c033b32 ("openvswitch: Re-add CONFIG_OPENVSWITCH_VXLAN")
+CC: Thomas Graf <tgraf@suug.ch>
+CC: Pravin B Shelar <pshelar@nicira.com>
+Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/vxlan.c | 58 ++++++++++++++++++++++++++++++----------------------
+ 1 file changed, 34 insertions(+), 24 deletions(-)
+
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2927,30 +2927,6 @@ static int vxlan_dev_configure(struct ne
+ return 0;
+ }
+
+-struct net_device *vxlan_dev_create(struct net *net, const char *name,
+- u8 name_assign_type, struct vxlan_config *conf)
+-{
+- struct nlattr *tb[IFLA_MAX+1];
+- struct net_device *dev;
+- int err;
+-
+- memset(&tb, 0, sizeof(tb));
+-
+- dev = rtnl_create_link(net, name, name_assign_type,
+- &vxlan_link_ops, tb);
+- if (IS_ERR(dev))
+- return dev;
+-
+- err = vxlan_dev_configure(net, dev, conf);
+- if (err < 0) {
+- free_netdev(dev);
+- return ERR_PTR(err);
+- }
+-
+- return dev;
+-}
+-EXPORT_SYMBOL_GPL(vxlan_dev_create);
+-
+ static int vxlan_newlink(struct net *src_net, struct net_device *dev,
+ struct nlattr *tb[], struct nlattr *data[])
+ {
+@@ -3218,6 +3194,40 @@ static struct rtnl_link_ops vxlan_link_o
+ .get_link_net = vxlan_get_link_net,
+ };
+
++struct net_device *vxlan_dev_create(struct net *net, const char *name,
++ u8 name_assign_type,
++ struct vxlan_config *conf)
++{
++ struct nlattr *tb[IFLA_MAX + 1];
++ struct net_device *dev;
++ int err;
++
++ memset(&tb, 0, sizeof(tb));
++
++ dev = rtnl_create_link(net, name, name_assign_type,
++ &vxlan_link_ops, tb);
++ if (IS_ERR(dev))
++ return dev;
++
++ err = vxlan_dev_configure(net, dev, conf);
++ if (err < 0) {
++ free_netdev(dev);
++ return ERR_PTR(err);
++ }
++
++ err = rtnl_configure_link(dev, NULL);
++ if (err < 0) {
++ LIST_HEAD(list_kill);
++
++ vxlan_dellink(dev, &list_kill);
++ unregister_netdevice_many(&list_kill);
++ return ERR_PTR(err);
++ }
++
++ return dev;
++}
++EXPORT_SYMBOL_GPL(vxlan_dev_create);
++
+ static void vxlan_handle_lowerdev_unregister(struct vxlan_net *vn,
+ struct net_device *dev)
+ {
--- /dev/null
+From b22ef2a0979f2b91cfeeabb086e4d665183a93a1 Mon Sep 17 00:00:00 2001
+From: Laxman Dewangan <ldewangan@nvidia.com>
+Date: Mon, 2 May 2016 22:53:24 +0530
+Subject: pinctrl: tegra: Correctly check the supported configuration
+
+From: Laxman Dewangan <ldewangan@nvidia.com>
+
+commit b22ef2a0979f2b91cfeeabb086e4d665183a93a1 upstream.
+
+The pincontrol registers of Tegra chips has multiple filed per
+registers. There is two type of registers mux and drive. All
+configurations belongs to one of these registers.
+
+If any configurations are supported then <config>_bit is set to
+bit position of these registers otherwise -1 to not support it.
+The member is defined as
+ s32 <config>_bit:6;
+
+So if config is not supported ifor given SoC then it is set to -1
+in soc pinmmux table.
+In common driver code, to find out that given config is supported
+or not, it is checked as:
+
+s8 bit = <config>_bit;
+if (bit > 31) {
+ /* Not supported config */
+}
+
+But in this case, bit is s8 and hence for non supporting it is -1.
+
+Correct the check as:
+if (bit < 0) {
+ /* Not supported config */
+}
+
+Fixes: e4c02dced975cb ("pinctrl: tegra: use signed bitfields for optional fields")
+Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>
+Acked-by: Stephen Warren <swarren@nvidia.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/pinctrl-tegra.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/pinctrl-tegra.c
++++ b/drivers/pinctrl/pinctrl-tegra.c
+@@ -418,7 +418,7 @@ static int tegra_pinconf_reg(struct tegr
+ return -ENOTSUPP;
+ }
+
+- if (*reg < 0 || *bit > 31) {
++ if (*reg < 0 || *bit < 0) {
+ if (report_err) {
+ const char *prop = "unknown";
+ int i;
--- /dev/null
+From 166ee5b87866de07a3e56c1b757f2b5cabba72a5 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Wed, 24 Aug 2016 09:39:02 -0700
+Subject: qdisc: fix a module refcount leak in qdisc_create_dflt()
+
+From: Eric Dumazet <edumazet@google.com>
+
+commit 166ee5b87866de07a3e56c1b757f2b5cabba72a5 upstream.
+
+Should qdisc_alloc() fail, we must release the module refcount
+we got right before.
+
+Fixes: 6da7c8fcbcbd ("qdisc: allow setting default queuing discipline")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Acked-by: John Fastabend <john.r.fastabend@intel.com>
+Acked-by: John Fastabend <john.r.fastabend@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/sched/sch_generic.c | 9 +++++----
+ 1 file changed, 5 insertions(+), 4 deletions(-)
+
+--- a/net/sched/sch_generic.c
++++ b/net/sched/sch_generic.c
+@@ -626,18 +626,19 @@ struct Qdisc *qdisc_create_dflt(struct n
+ struct Qdisc *sch;
+
+ if (!try_module_get(ops->owner))
+- goto errout;
++ return NULL;
+
+ sch = qdisc_alloc(dev_queue, ops);
+- if (IS_ERR(sch))
+- goto errout;
++ if (IS_ERR(sch)) {
++ module_put(ops->owner);
++ return NULL;
++ }
+ sch->parent = parentid;
+
+ if (!ops->init || ops->init(sch, NULL) == 0)
+ return sch;
+
+ qdisc_destroy(sch);
+-errout:
+ return NULL;
+ }
+ EXPORT_SYMBOL(qdisc_create_dflt);
--- /dev/null
+From 7fa816b92c52e2c304f2ff6401e0d51e1d229ca5 Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+Date: Sat, 7 May 2016 13:17:11 +0200
+Subject: ravb: Add missing free_irq() call to ravb_close()
+
+From: Geert Uytterhoeven <geert+renesas@glider.be>
+
+commit 7fa816b92c52e2c304f2ff6401e0d51e1d229ca5 upstream.
+
+When reopening the network device on ra7795/salvator-x, e.g. after a
+DHCP timeout:
+
+ IP-Config: Reopening network devices...
+ genirq: Flags mismatch irq 139. 00000000 (eth0:ch24:emac) vs. 00000000 (eth0:ch24:emac)
+ ravb e6800000.ethernet eth0: cannot request IRQ eth0:ch24:emac
+ IP-Config: Failed to open eth0
+ IP-Config: No network devices available
+
+The "mismatch" is due to requesting an IRQ that is already in use,
+while IRQF_PROBE_SHARED wasn't set.
+
+However, the real cause is that ravb_close() doesn't release the R-Car
+Gen3-specific secondary IRQ.
+
+Add the missing free_irq() call to fix this.
+
+Fixes: 22d4df8ff3a3cc72 ("ravb: Add support for r8a7795 SoC")
+Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Acked-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/renesas/ravb_main.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1528,6 +1528,8 @@ static int ravb_close(struct net_device
+ priv->phydev = NULL;
+ }
+
++ if (priv->chip_id == RCAR_GEN3)
++ free_irq(priv->emac_irq, ndev);
+ free_irq(ndev->irq, ndev);
+
+ napi_disable(&priv->napi[RAVB_NC]);
--- /dev/null
+From 6333ef46bbe514a8ece6c432aab6bcf8637b2d7c Mon Sep 17 00:00:00 2001
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Date: Tue, 26 Jan 2016 16:38:59 +0000
+Subject: regulator: core: Rely on regulator_dev_release to free constraints
+
+From: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+
+commit 6333ef46bbe514a8ece6c432aab6bcf8637b2d7c upstream.
+
+As we now free the constraints in regulator_dev_release we will still
+call free on the constraints pointer even if we went down an error
+path in regulator_register, because it is only allocated after the
+device_register. As such we no longer need to free rdev->constraints
+on the error paths, so this patch removes said frees.
+
+Fixes: 29f5f4860a8e ("regulator: core: Move more deallocation into class unregister")
+Signed-off-by: Charles Keepax <ckeepax@opensource.wolfsonmicro.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 29 ++++++++++++-----------------
+ 1 file changed, 12 insertions(+), 17 deletions(-)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -1057,18 +1057,18 @@ static int set_machine_constraints(struc
+
+ ret = machine_constraints_voltage(rdev, rdev->constraints);
+ if (ret != 0)
+- goto out;
++ return ret;
+
+ ret = machine_constraints_current(rdev, rdev->constraints);
+ if (ret != 0)
+- goto out;
++ return ret;
+
+ if (rdev->constraints->ilim_uA && ops->set_input_current_limit) {
+ ret = ops->set_input_current_limit(rdev,
+ rdev->constraints->ilim_uA);
+ if (ret < 0) {
+ rdev_err(rdev, "failed to set input limit\n");
+- goto out;
++ return ret;
+ }
+ }
+
+@@ -1077,21 +1077,20 @@ static int set_machine_constraints(struc
+ ret = suspend_prepare(rdev, rdev->constraints->initial_state);
+ if (ret < 0) {
+ rdev_err(rdev, "failed to set suspend state\n");
+- goto out;
++ return ret;
+ }
+ }
+
+ if (rdev->constraints->initial_mode) {
+ if (!ops->set_mode) {
+ rdev_err(rdev, "no set_mode operation\n");
+- ret = -EINVAL;
+- goto out;
++ return -EINVAL;
+ }
+
+ ret = ops->set_mode(rdev, rdev->constraints->initial_mode);
+ if (ret < 0) {
+ rdev_err(rdev, "failed to set initial mode: %d\n", ret);
+- goto out;
++ return ret;
+ }
+ }
+
+@@ -1102,7 +1101,7 @@ static int set_machine_constraints(struc
+ ret = _regulator_do_enable(rdev);
+ if (ret < 0 && ret != -EINVAL) {
+ rdev_err(rdev, "failed to enable\n");
+- goto out;
++ return ret;
+ }
+ }
+
+@@ -1111,7 +1110,7 @@ static int set_machine_constraints(struc
+ ret = ops->set_ramp_delay(rdev, rdev->constraints->ramp_delay);
+ if (ret < 0) {
+ rdev_err(rdev, "failed to set ramp_delay\n");
+- goto out;
++ return ret;
+ }
+ }
+
+@@ -1119,7 +1118,7 @@ static int set_machine_constraints(struc
+ ret = ops->set_pull_down(rdev);
+ if (ret < 0) {
+ rdev_err(rdev, "failed to set pull down\n");
+- goto out;
++ return ret;
+ }
+ }
+
+@@ -1127,7 +1126,7 @@ static int set_machine_constraints(struc
+ ret = ops->set_soft_start(rdev);
+ if (ret < 0) {
+ rdev_err(rdev, "failed to set soft start\n");
+- goto out;
++ return ret;
+ }
+ }
+
+@@ -1136,16 +1135,12 @@ static int set_machine_constraints(struc
+ ret = ops->set_over_current_protection(rdev);
+ if (ret < 0) {
+ rdev_err(rdev, "failed to set over current protection\n");
+- goto out;
++ return ret;
+ }
+ }
+
+ print_constraints(rdev);
+ return 0;
+-out:
+- kfree(rdev->constraints);
+- rdev->constraints = NULL;
+- return ret;
+ }
+
+ /**
+@@ -3983,7 +3978,7 @@ unset_supplies:
+
+ scrub:
+ regulator_ena_gpio_free(rdev);
+- kfree(rdev->constraints);
++
+ wash:
+ device_unregister(&rdev->dev);
+ /* device core frees rdev */
--- /dev/null
+From 5e3ca2b349b1e2c80b060b51bbf2af37448fad85 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Wed, 23 Mar 2016 20:59:34 -0300
+Subject: regulator: Try to resolve regulators supplies on registration
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+commit 5e3ca2b349b1e2c80b060b51bbf2af37448fad85 upstream.
+
+Commit 6261b06de565 ("regulator: Defer lookup of supply to regulator_get")
+moved the regulator supplies lookup logic from the regulators registration
+to the regulators get time.
+
+Unfortunately, that changed the behavior of the regulator core since now a
+parent supply with a child regulator marked as always-on, won't be enabled
+unless a client driver attempts to get the child regulator during boot.
+
+This patch tries to resolve the parent supply for the already registered
+regulators each time that a new regulator is registered. So the regulators
+that have child regulators marked as always on will be enabled regardless
+if a driver gets the child regulator or not.
+
+That was the behavior before the mentioned commit, since parent supplies
+were looked up at regulator registration time instead of during child get.
+
+Since regulator_resolve_supply() checks for rdev->supply, most of the times
+it will be a no-op. Errors aren't checked to keep the possible out of order
+dependencies which was the motivation for the mentioned commit.
+
+Also, the supply being available will be enforced on regulator get anyways
+in case the resolve fails on regulators registration.
+
+Fixes: 6261b06de565 ("regulator: Defer lookup of supply to regulator_get")
+Suggested-by: Mark Brown <broonie@kernel.org>
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Signed-off-by: Mark Brown <broonie@kernel.org>
+Cc: <stable@vger.kernel.org> # 4.1+
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/regulator/core.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/regulator/core.c
++++ b/drivers/regulator/core.c
+@@ -3822,6 +3822,11 @@ static void rdev_init_debugfs(struct reg
+ &rdev->bypass_count);
+ }
+
++static int regulator_register_resolve_supply(struct device *dev, void *data)
++{
++ return regulator_resolve_supply(dev_to_rdev(dev));
++}
++
+ /**
+ * regulator_register - register regulator
+ * @regulator_desc: regulator to register
+@@ -3968,6 +3973,10 @@ regulator_register(const struct regulato
+ }
+
+ rdev_init_debugfs(rdev);
++
++ /* try to resolve regulators supply since a new one was registered */
++ class_for_each_device(®ulator_class, NULL, NULL,
++ regulator_register_resolve_supply);
+ out:
+ mutex_unlock(®ulator_list_mutex);
+ kfree(config);
--- /dev/null
+From f567e950bf51290755a2539ff2aaef4c26f735d3 Mon Sep 17 00:00:00 2001
+From: Mathias Krause <minipli@googlemail.com>
+Date: Mon, 7 Nov 2016 23:22:19 +0100
+Subject: rtnl: reset calcit fptr in rtnl_unregister()
+
+From: Mathias Krause <minipli@googlemail.com>
+
+commit f567e950bf51290755a2539ff2aaef4c26f735d3 upstream.
+
+To avoid having dangling function pointers left behind, reset calcit in
+rtnl_unregister(), too.
+
+This is no issue so far, as only the rtnl core registers a netlink
+handler with a calcit hook which won't be unregistered, but may become
+one if new code makes use of the calcit hook.
+
+Fixes: c7ac8679bec9 ("rtnetlink: Compute and store minimum ifinfo...")
+Cc: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
+Cc: Greg Rose <gregory.v.rose@intel.com>
+Signed-off-by: Mathias Krause <minipli@googlemail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/core/rtnetlink.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -253,6 +253,7 @@ int rtnl_unregister(int protocol, int ms
+
+ rtnl_msg_handlers[protocol][msgindex].doit = NULL;
+ rtnl_msg_handlers[protocol][msgindex].dumpit = NULL;
++ rtnl_msg_handlers[protocol][msgindex].calcit = NULL;
+
+ return 0;
+ }
spi-rockchip-modify-dma-max-burst-to-1.patch
openvswitch-update-checksum-in-push-pop-_mpls.patch
cxgb4-cxgb4vf-fixes-regression-in-perf-when-tx-vlan-offload-is-disabled.patch
+net-bcmgenet-fix-skb_len-in-bcmgenet_xmit_single.patch
+net-bcmgenet-device-stats-are-unsigned-long.patch
+ovs-gre-fix-rtnl-notifications-on-iface-deletion.patch
+gre-do-not-assign-header_ops-in-collect-metadata-mode.patch
+gre-build-header-correctly-for-collect-metadata-tunnels.patch
+gre-reject-gue-and-fou-in-collect-metadata-mode.patch
+sfc-fix-potential-stack-corruption-from-running-past-stat-bitmask.patch
+sfc-clear-napi_hash-state-when-copying-channels.patch
+net-bcmsysport-device-stats-are-unsigned-long.patch
+cxgbi-fix-uninitialized-flowi6.patch
+net-macb-add-missing-free_netdev-on-error-in-macb_probe.patch
+macvtap-segmented-packet-is-consumed.patch
+tipc-fix-the-error-handling-in-tipc_udp_enable.patch
+net-icmp6_send-should-use-dst-dev-to-determine-l3-domain.patch
+et131x-fix-logical-vs-bitwise-check-in-et131x_tx_timeout.patch
+net-ethernet-stmmac-dwmac-sti-fix-probe-error-path.patch
+rtnl-reset-calcit-fptr-in-rtnl_unregister.patch
+net-ethernet-stmmac-dwmac-rk-fix-probe-error-path.patch
+fq_codel-return-non-zero-qlen-in-class-dumps.patch
+net-ethernet-stmmac-dwmac-generic-fix-probe-error-path.patch
+ovs-geneve-fix-rtnl-notifications-on-iface-deletion.patch
+bnxt-add-a-missing-rcu-synchronization.patch
+qdisc-fix-a-module-refcount-leak-in-qdisc_create_dflt.patch
+net-axienet-fix-return-value-check-in-axienet_probe.patch
+bnxt_en-remove-locking-around-txr-dev_state.patch
+net-ethernet-davinci_emac-fix-devioctl-while-in-fixed-link.patch
+net-ethernet-mvneta-remove-iff_unicast_flt-which-is-not-implemented.patch
+net-ethernet-ti-cpsw-fix-device-and-of_node-leaks.patch
+net-ethernet-ti-cpsw-fix-secondary-emac-probe-error-path.patch
+net-hns-fix-device-reference-leaks.patch
+net-bridge-don-t-increment-tx_dropped-in-br_do_proxy_arp.patch
+net-dsa-mv88e6xxx-enable-sa-learning-on-dsa-ports.patch
+net-ehea-avoid-null-pointer-dereference.patch
+l2tp-fix-use-after-free-during-module-unload.patch
+hwrng-exynos-disable-runtime-pm-on-driver-unbind.patch
+net-icmp_route_lookup-should-use-rt-dev-to-determine-l3-domain.patch
+net-mvneta-fix-trivial-cut-off-issue-in-mvneta_ethtool_update_stats.patch
+net-macb-replace-macb_writel-call-by-queue_writel-to-update-queue-isr.patch
+ravb-add-missing-free_irq-call-to-ravb_close.patch
+mvpp2-use-correct-size-for-memset.patch
+net-vxlan-lwt-fix-vxlan-local-traffic.patch
+net-ethoc-fix-early-error-paths.patch
+ovs-vxlan-fix-rtnl-notifications-on-iface-deletion.patch
+net-mv643xx_eth-fix-packet-corruption-with-tso-and-tiny-unaligned-packets.patch
+regulator-core-rely-on-regulator_dev_release-to-free-constraints.patch
+net-dsa-mv88e6xxx-fix-port-vlan-maps.patch
+at803x-fix-reset-handling.patch
+regulator-try-to-resolve-regulators-supplies-on-registration.patch
+cxl-fix-dar-check-use-region_id-instead-of-opencoding.patch
+net-ethernet-davinci_emac-fix-platform_data-overwrite.patch
+ata-sata_dwc_460ex-remove-incorrect-locking.patch
+pinctrl-tegra-correctly-check-the-supported-configuration.patch
+brcmfmac-add-fallback-for-devices-that-do-not-report-per-chain-values.patch
+brcmfmac-restore-stopping-netdev-queue-when-bus-clogs-up.patch
+bridge-fix-problems-around-fdb-entries-pointing-to-the-bridge-device.patch
+bna-add-missing-per-queue-ethtool-stat.patch
+net-skbuff-remove-errornous-length-validation-in-skb_vlan_pop.patch
+net-ep93xx_eth-do-not-crash-unloading-module.patch
+macvlan-fix-potential-use-after-free-for-broadcasts.patch
--- /dev/null
+From 46d054f8f540612f09987a53154aa39ae15f2e4c Mon Sep 17 00:00:00 2001
+From: Bert Kenward <bkenward@solarflare.com>
+Date: Fri, 11 Nov 2016 15:56:51 +0000
+Subject: sfc: clear napi_hash state when copying channels
+
+From: Bert Kenward <bkenward@solarflare.com>
+
+commit 46d054f8f540612f09987a53154aa39ae15f2e4c upstream.
+
+efx_copy_channel() doesn't correctly clear the napi_hash related state.
+This means that when napi_hash_add is called for that channel nothing is
+done, and we are left with a copy of the napi_hash_node from the old
+channel. When we later call napi_hash_del() on this channel we have a
+stale napi_hash_node.
+
+Corruption is only seen when there are multiple entries in one of the
+napi_hash lists. This is made more likely by having a very large number
+of channels. Testing was carried out with 512 channels - 32 channels on
+each of 16 ports.
+
+This failure typically appears as protection faults within napi_by_id()
+or napi_hash_add(). efx_copy_channel() is only used when tx or rx ring
+sizes are changed (ethtool -G).
+
+Fixes: 36763266bbe8 ("sfc: Add support for busy polling")
+Signed-off-by: Bert Kenward <bkenward@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/sfc/efx.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/drivers/net/ethernet/sfc/efx.c
++++ b/drivers/net/ethernet/sfc/efx.c
+@@ -479,6 +479,9 @@ efx_copy_channel(const struct efx_channe
+ *channel = *old_channel;
+
+ channel->napi_dev = NULL;
++ INIT_HLIST_NODE(&channel->napi_str.napi_hash_node);
++ channel->napi_str.napi_id = 0;
++ channel->napi_str.state = 0;
+ memset(&channel->eventq, 0, sizeof(channel->eventq));
+
+ for (j = 0; j < EFX_TXQ_TYPES; j++) {
--- /dev/null
+From e70c70c38d7a5ced76fc8b1c4a7ccee76e9c2911 Mon Sep 17 00:00:00 2001
+From: Andrew Rybchenko <Andrew.Rybchenko@oktetlabs.ru>
+Date: Fri, 26 Aug 2016 11:19:34 +0100
+Subject: sfc: fix potential stack corruption from running past stat bitmask
+
+From: Andrew Rybchenko <Andrew.Rybchenko@oktetlabs.ru>
+
+commit e70c70c38d7a5ced76fc8b1c4a7ccee76e9c2911 upstream.
+
+On 32-bit systems, mask is only an array of 3 longs, not 4, so don't try
+to write to mask[3].
+Also include build-time checks in case the size of the bitmask changes.
+
+Fixes: 3c36a2aded8c ("sfc: display vadaptor statistics for all interfaces")
+Signed-off-by: Edward Cree <ecree@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/sfc/ef10.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/sfc/ef10.c
++++ b/drivers/net/ethernet/sfc/ef10.c
+@@ -1304,13 +1304,14 @@ static void efx_ef10_get_stat_mask(struc
+ }
+
+ #if BITS_PER_LONG == 64
++ BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 2);
+ mask[0] = raw_mask[0];
+ mask[1] = raw_mask[1];
+ #else
++ BUILD_BUG_ON(BITS_TO_LONGS(EF10_STAT_COUNT) != 3);
+ mask[0] = raw_mask[0] & 0xffffffff;
+ mask[1] = raw_mask[0] >> 32;
+ mask[2] = raw_mask[1] & 0xffffffff;
+- mask[3] = raw_mask[1] >> 32;
+ #endif
+ }
+
--- /dev/null
+From a5de125dd46c851fc962806135953c1bd0a0f0df Mon Sep 17 00:00:00 2001
+From: Wei Yongjun <weiyongjun1@huawei.com>
+Date: Wed, 24 Aug 2016 13:32:19 +0000
+Subject: tipc: fix the error handling in tipc_udp_enable()
+
+From: Wei Yongjun <weiyongjun1@huawei.com>
+
+commit a5de125dd46c851fc962806135953c1bd0a0f0df upstream.
+
+Fix to return a negative error code in enable_mcast() error handling
+case, and release udp socket when necessary.
+
+Fixes: d0f91938bede ("tipc: add ip/udp media type")
+Signed-off-by: Wei Yongjun <weiyongjun1@huawei.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/tipc/udp_media.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/tipc/udp_media.c
++++ b/net/tipc/udp_media.c
+@@ -405,10 +405,13 @@ static int tipc_udp_enable(struct net *n
+ tuncfg.encap_destroy = NULL;
+ setup_udp_tunnel_sock(net, ub->ubsock, &tuncfg);
+
+- if (enable_mcast(ub, remote))
++ err = enable_mcast(ub, remote);
++ if (err)
+ goto err;
+ return 0;
+ err:
++ if (ub->ubsock)
++ udp_tunnel_sock_release(ub->ubsock);
+ kfree(ub);
+ return err;
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
