--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Tue, 17 Nov 2020 10:45:05 +0800
+Subject: ah6: fix error return code in ah6_input()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit a5ebcbdf34b65fcc07f38eaf2d60563b42619a59 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1605581105-35295-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ah6.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/ah6.c
++++ b/net/ipv6/ah6.c
+@@ -595,7 +595,8 @@ static int ah6_input(struct xfrm_state *
+ memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+ memset(ah->auth_data, 0, ahp->icv_trunc_len);
+
+- if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
++ err = ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN);
++ if (err)
+ goto out_free;
+
+ ip6h->priority = 0;
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Date: Mon, 16 Nov 2020 17:21:14 +0100
+Subject: atm: nicstar: Unmap DMA on send error
+
+From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+
+[ Upstream commit 6dceaa9f56e22d0f9b4c4ad2ed9e04e315ce7fe5 ]
+
+The `skb' is mapped for DMA in ns_send() but does not unmap DMA in case
+push_scqe() fails to submit the `skb'. The memory of the `skb' is
+released so only the DMA mapping is leaking.
+
+Unmap the DMA mapping in case push_scqe() failed.
+
+Fixes: 864a3ff635fa7 ("atm: [nicstar] remove virt_to_bus() and support 64-bit platforms")
+Cc: Chas Williams <3chas3@gmail.com>
+Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/atm/nicstar.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/atm/nicstar.c
++++ b/drivers/atm/nicstar.c
+@@ -1704,6 +1704,8 @@ static int ns_send(struct atm_vcc *vcc,
+
+ if (push_scqe(card, vc, scq, &scqe, skb) != 0) {
+ atomic_inc(&vcc->stats->tx_err);
++ dma_unmap_single(&card->pcidev->dev, NS_PRV_DMA(skb), skb->len,
++ DMA_TO_DEVICE);
+ dev_kfree_skb_any(skb);
+ return -EIO;
+ }
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Tue, 17 Nov 2020 11:02:11 +0800
+Subject: net: b44: fix error return code in b44_init_one()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 7b027c249da54f492699c43e26cba486cfd48035 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 39a6f4bce6b4 ("b44: replace the ssb_dma API with the generic DMA API")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Link: https://lore.kernel.org/r/1605582131-36735-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/b44.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/broadcom/b44.c
++++ b/drivers/net/ethernet/broadcom/b44.c
+@@ -2393,7 +2393,8 @@ static int b44_init_one(struct ssb_devic
+ goto err_out_free_dev;
+ }
+
+- if (dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30))) {
++ err = dma_set_mask_and_coherent(sdev->dma_dev, DMA_BIT_MASK(30));
++ if (err) {
+ dev_err(sdev->dev,
+ "Required 30BIT DMA mask unsupported by the system\n");
+ goto err_out_powerdown;
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Fri, 13 Nov 2020 10:27:27 +0100
+Subject: net: bridge: add missing counters to ndo_get_stats64 callback
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit 7a30ecc9237681bb125cbd30eee92bef7e86293d ]
+
+In br_forward.c and br_input.c fields dev->stats.tx_dropped and
+dev->stats.multicast are populated, but they are ignored in
+ndo_get_stats64.
+
+Fixes: 28172739f0a2 ("net: fix 64 bit counters on 32 bit arches")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Link: https://lore.kernel.org/r/58ea9963-77ad-a7cf-8dfd-fc95ab95f606@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/bridge/br_device.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -166,6 +166,7 @@ static struct rtnl_link_stats64 *br_get_
+ sum.rx_packets += tmp.rx_packets;
+ }
+
++ netdev_stats_to_stats64(stats, &dev->stats);
+ stats->tx_bytes = sum.tx_bytes;
+ stats->tx_packets = sum.tx_packets;
+ stats->rx_bytes = sum.rx_bytes;
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Mon, 16 Nov 2020 19:52:34 -0800
+Subject: net: Have netpoll bring-up DSA management interface
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 1532b9778478577152201adbafa7738b1e844868 ]
+
+DSA network devices rely on having their DSA management interface up and
+running otherwise their ndo_open() will return -ENETDOWN. Without doing
+this it would not be possible to use DSA devices as netconsole when
+configured on the command line. These devices also do not utilize the
+upper/lower linking so the check about the netpoll device having upper
+is not going to be a problem.
+
+The solution adopted here is identical to the one done for
+net/ipv4/ipconfig.c with 728c02089a0e ("net: ipv4: handle DSA enabled
+master network devices"), with the network namespace scope being
+restricted to that of the process configuring netpoll.
+
+Fixes: 04ff53f96a93 ("net: dsa: Add netconsole support")
+Tested-by: Vladimir Oltean <olteanv@gmail.com>
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Link: https://lore.kernel.org/r/20201117035236.22658-1-f.fainelli@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/netpoll.c | 22 ++++++++++++++++++----
+ 1 file changed, 18 insertions(+), 4 deletions(-)
+
+--- a/net/core/netpoll.c
++++ b/net/core/netpoll.c
+@@ -28,6 +28,7 @@
+ #include <linux/slab.h>
+ #include <linux/export.h>
+ #include <linux/if_vlan.h>
++#include <net/dsa.h>
+ #include <net/tcp.h>
+ #include <net/udp.h>
+ #include <net/addrconf.h>
+@@ -661,15 +662,15 @@ EXPORT_SYMBOL_GPL(__netpoll_setup);
+
+ int netpoll_setup(struct netpoll *np)
+ {
+- struct net_device *ndev = NULL;
++ struct net_device *ndev = NULL, *dev = NULL;
++ struct net *net = current->nsproxy->net_ns;
+ struct in_device *in_dev;
+ int err;
+
+ rtnl_lock();
+- if (np->dev_name) {
+- struct net *net = current->nsproxy->net_ns;
+++ if (np->dev_name)
+ ndev = __dev_get_by_name(net, np->dev_name);
+- }
++
+ if (!ndev) {
+ np_err(np, "%s doesn't exist, aborting\n", np->dev_name);
+ err = -ENODEV;
+@@ -677,6 +678,19 @@ int netpoll_setup(struct netpoll *np)
+ }
+ dev_hold(ndev);
+
++ /* bring up DSA management network devices up first */
++ for_each_netdev(net, dev) {
++ if (!netdev_uses_dsa(dev))
++ continue;
++
++ err = dev_change_flags(dev, dev->flags | IFF_UP);
++ if (err < 0) {
++ np_err(np, "%s failed to open %s\n",
++ np->dev_name, dev->name);
++ goto put;
++ }
++ }
++
+ if (netdev_master_upper_dev_get(ndev)) {
+ np_err(np, "%s is a slave device, aborting\n", np->dev_name);
+ err = -EBUSY;
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Aya Levin <ayal@nvidia.com>
+Date: Wed, 18 Nov 2020 10:19:22 +0200
+Subject: net/mlx4_core: Fix init_hca fields offset
+
+From: Aya Levin <ayal@nvidia.com>
+
+[ Upstream commit 6d9c8d15af0ef20a66a0b432cac0d08319920602 ]
+
+Slave function read the following capabilities from the wrong offset:
+1. log_mc_entry_sz
+2. fs_log_entry_sz
+3. log_mc_hash_sz
+
+Fix that by adjusting these capabilities offset to match firmware
+layout.
+
+Due to the wrong offset read, the following issues might occur:
+1+2. Negative value reported at max_mcast_qp_attach.
+3. Driver to init FW with multicast hash size of zero.
+
+Fixes: a40ded604365 ("net/mlx4_core: Add masking for a few queries on HCA caps")
+Signed-off-by: Aya Levin <ayal@nvidia.com>
+Reviewed-by: Moshe Shemesh <moshe@nvidia.com>
+Reviewed-by: Eran Ben Elisha <eranbe@nvidia.com>
+Signed-off-by: Tariq Toukan <tariqt@nvidia.com>
+Link: https://lore.kernel.org/r/20201118081922.553-1-tariqt@nvidia.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/fw.c | 6 +++---
+ drivers/net/ethernet/mellanox/mlx4/fw.h | 4 ++--
+ 2 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -1711,14 +1711,14 @@ int mlx4_INIT_HCA(struct mlx4_dev *dev,
+ #define INIT_HCA_LOG_RD_OFFSET (INIT_HCA_QPC_OFFSET + 0x77)
+ #define INIT_HCA_MCAST_OFFSET 0x0c0
+ #define INIT_HCA_MC_BASE_OFFSET (INIT_HCA_MCAST_OFFSET + 0x00)
+-#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x12)
+-#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x16)
++#define INIT_HCA_LOG_MC_ENTRY_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x13)
++#define INIT_HCA_LOG_MC_HASH_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x17)
+ #define INIT_HCA_UC_STEERING_OFFSET (INIT_HCA_MCAST_OFFSET + 0x18)
+ #define INIT_HCA_LOG_MC_TABLE_SZ_OFFSET (INIT_HCA_MCAST_OFFSET + 0x1b)
+ #define INIT_HCA_DEVICE_MANAGED_FLOW_STEERING_EN 0x6
+ #define INIT_HCA_FS_PARAM_OFFSET 0x1d0
+ #define INIT_HCA_FS_BASE_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x00)
+-#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x12)
++#define INIT_HCA_FS_LOG_ENTRY_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x13)
+ #define INIT_HCA_FS_A0_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x18)
+ #define INIT_HCA_FS_LOG_TABLE_SZ_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x1b)
+ #define INIT_HCA_FS_ETH_BITS_OFFSET (INIT_HCA_FS_PARAM_OFFSET + 0x21)
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.h
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.h
+@@ -184,8 +184,8 @@ struct mlx4_init_hca_param {
+ u64 cmpt_base;
+ u64 mtt_base;
+ u64 global_caps;
+- u16 log_mc_entry_sz;
+- u16 log_mc_hash_sz;
++ u8 log_mc_entry_sz;
++ u8 log_mc_hash_sz;
+ u16 hca_core_clock; /* Internal Clock Frequency (in MHz) */
+ u8 log_num_qps;
+ u8 log_num_srqs;
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Filip Moc <dev@moc6.cz>
+Date: Tue, 17 Nov 2020 18:36:31 +0100
+Subject: net: usb: qmi_wwan: Set DTR quirk for MR400
+
+From: Filip Moc <dev@moc6.cz>
+
+[ Upstream commit df8d85d8c69d6837817e54dcb73c84a8b5a13877 ]
+
+LTE module MR400 embedded in TL-MR6400 v4 requires DTR to be set.
+
+Signed-off-by: Filip Moc <dev@moc6.cz>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Link: https://lore.kernel.org/r/20201117173631.GA550981@moc6.cz
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -702,7 +702,7 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x05c6, 0x9011, 4)},
+ {QMI_FIXED_INTF(0x05c6, 0x9021, 1)},
+ {QMI_FIXED_INTF(0x05c6, 0x9022, 2)},
+- {QMI_FIXED_INTF(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
++ {QMI_QUIRK_SET_DTR(0x05c6, 0x9025, 4)}, /* Alcatel-sbell ASB TL131 TDD LTE (China Mobile) */
+ {QMI_FIXED_INTF(0x05c6, 0x9026, 3)},
+ {QMI_FIXED_INTF(0x05c6, 0x902e, 5)},
+ {QMI_FIXED_INTF(0x05c6, 0x9031, 5)},
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Xie He <xie.he.0141@gmail.com>
+Date: Thu, 12 Nov 2020 02:35:06 -0800
+Subject: net: x25: Increase refcnt of "struct x25_neigh" in x25_rx_call_request
+
+From: Xie He <xie.he.0141@gmail.com>
+
+[ Upstream commit 4ee18c179e5e815fa5575e0d2db0c05795a804ee ]
+
+The x25_disconnect function in x25_subr.c would decrease the refcount of
+"x25->neighbour" (struct x25_neigh) and reset this pointer to NULL.
+
+However, the x25_rx_call_request function in af_x25.c, which is called
+when we receive a connection request, does not increase the refcount when
+it assigns the pointer.
+
+Fix this issue by increasing the refcount of "struct x25_neigh" in
+x25_rx_call_request.
+
+This patch fixes frequent kernel crashes when using AF_X25 sockets.
+
+Fixes: 4becb7ee5b3d ("net/x25: Fix x25_neigh refcnt leak when x25 disconnect")
+Cc: Martin Schiller <ms@dev.tdt.de>
+Signed-off-by: Xie He <xie.he.0141@gmail.com>
+Link: https://lore.kernel.org/r/20201112103506.5875-1-xie.he.0141@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/x25/af_x25.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/x25/af_x25.c
++++ b/net/x25/af_x25.c
+@@ -1047,6 +1047,7 @@ int x25_rx_call_request(struct sk_buff *
+ makex25->lci = lci;
+ makex25->dest_addr = dest_addr;
+ makex25->source_addr = source_addr;
++ x25_neigh_hold(nb);
+ makex25->neighbour = nb;
+ makex25->facilities = facilities;
+ makex25->dte_facilities= dte_facilities;
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Paul Moore <paul@paul-moore.com>
+Date: Fri, 13 Nov 2020 16:30:40 -0500
+Subject: netlabel: fix an uninitialized warning in netlbl_unlabel_staticlist()
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 1ba86d4366e023d96df3dbe415eea7f1dc08c303 ]
+
+Static checking revealed that a previous fix to
+netlbl_unlabel_staticlist() leaves a stack variable uninitialized,
+this patches fixes that.
+
+Fixes: 866358ec331f ("netlabel: fix our progress tracking in netlbl_unlabel_staticlist()")
+Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Reviewed-by: James Morris <jamorris@linux.microsoft.com>
+Link: https://lore.kernel.org/r/160530304068.15651.18355773009751195447.stgit@sifl
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlabel/netlabel_unlabeled.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netlabel/netlabel_unlabeled.c
++++ b/net/netlabel/netlabel_unlabeled.c
+@@ -1186,7 +1186,7 @@ static int netlbl_unlabel_staticlist(str
+ u32 skip_bkt = cb->args[0];
+ u32 skip_chain = cb->args[1];
+ u32 skip_addr4 = cb->args[2];
+- u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
++ u32 iter_bkt, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
+ struct netlbl_unlhsh_iface *iface;
+ struct list_head *iter_list;
+ struct netlbl_af4list *addr4;
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Paul Moore <paul@paul-moore.com>
+Date: Sun, 8 Nov 2020 09:08:26 -0500
+Subject: netlabel: fix our progress tracking in netlbl_unlabel_staticlist()
+
+From: Paul Moore <paul@paul-moore.com>
+
+[ Upstream commit 866358ec331f8faa394995fb4b511af1db0247c8 ]
+
+The current NetLabel code doesn't correctly keep track of the netlink
+dump state in some cases, in particular when multiple interfaces with
+large configurations are loaded. The problem manifests itself by not
+reporting the full configuration to userspace, even though it is
+loaded and active in the kernel. This patch fixes this by ensuring
+that the dump state is properly reset when necessary inside the
+netlbl_unlabel_staticlist() function.
+
+Fixes: 8cc44579d1bd ("NetLabel: Introduce static network labels for unlabeled connections")
+Signed-off-by: Paul Moore <paul@paul-moore.com>
+Link: https://lore.kernel.org/r/160484450633.3752.16512718263560813473.stgit@sifl
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlabel/netlabel_unlabeled.c | 17 ++++++++++++-----
+ 1 file changed, 12 insertions(+), 5 deletions(-)
+
+--- a/net/netlabel/netlabel_unlabeled.c
++++ b/net/netlabel/netlabel_unlabeled.c
+@@ -1185,12 +1185,13 @@ static int netlbl_unlabel_staticlist(str
+ struct netlbl_unlhsh_walk_arg cb_arg;
+ u32 skip_bkt = cb->args[0];
+ u32 skip_chain = cb->args[1];
+- u32 iter_bkt;
+- u32 iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0;
++ u32 skip_addr4 = cb->args[2];
++ u32 iter_bkt, iter_chain, iter_addr4 = 0, iter_addr6 = 0;
+ struct netlbl_unlhsh_iface *iface;
+ struct list_head *iter_list;
+ struct netlbl_af4list *addr4;
+ #if IS_ENABLED(CONFIG_IPV6)
++ u32 skip_addr6 = cb->args[3];
+ struct netlbl_af6list *addr6;
+ #endif
+
+@@ -1201,7 +1202,7 @@ static int netlbl_unlabel_staticlist(str
+ rcu_read_lock();
+ for (iter_bkt = skip_bkt;
+ iter_bkt < rcu_dereference(netlbl_unlhsh)->size;
+- iter_bkt++, iter_chain = 0, iter_addr4 = 0, iter_addr6 = 0) {
++ iter_bkt++) {
+ iter_list = &rcu_dereference(netlbl_unlhsh)->tbl[iter_bkt];
+ list_for_each_entry_rcu(iface, iter_list, list) {
+ if (!iface->valid ||
+@@ -1209,7 +1210,7 @@ static int netlbl_unlabel_staticlist(str
+ continue;
+ netlbl_af4list_foreach_rcu(addr4,
+ &iface->addr4_list) {
+- if (iter_addr4++ < cb->args[2])
++ if (iter_addr4++ < skip_addr4)
+ continue;
+ if (netlbl_unlabel_staticlist_gen(
+ NLBL_UNLABEL_C_STATICLIST,
+@@ -1222,10 +1223,12 @@ static int netlbl_unlabel_staticlist(str
+ goto unlabel_staticlist_return;
+ }
+ }
++ iter_addr4 = 0;
++ skip_addr4 = 0;
+ #if IS_ENABLED(CONFIG_IPV6)
+ netlbl_af6list_foreach_rcu(addr6,
+ &iface->addr6_list) {
+- if (iter_addr6++ < cb->args[3])
++ if (iter_addr6++ < skip_addr6)
+ continue;
+ if (netlbl_unlabel_staticlist_gen(
+ NLBL_UNLABEL_C_STATICLIST,
+@@ -1238,8 +1241,12 @@ static int netlbl_unlabel_staticlist(str
+ goto unlabel_staticlist_return;
+ }
+ }
++ iter_addr6 = 0;
++ skip_addr6 = 0;
+ #endif /* IPv6 */
+ }
++ iter_chain = 0;
++ skip_chain = 0;
+ }
+
+ unlabel_staticlist_return:
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+Date: Fri, 13 Nov 2020 14:16:26 +0800
+Subject: qlcnic: fix error return code in qlcnic_83xx_restart_hw()
+
+From: Zhang Changzhong <zhangchangzhong@huawei.com>
+
+[ Upstream commit 3beb9be165083c2964eba1923601c3bfac0b02d4 ]
+
+Fix to return a negative error code from the error handling
+case instead of 0, as done elsewhere in this function.
+
+Fixes: 3ced0a88cd4c ("qlcnic: Add support to run firmware POST")
+Reported-by: Hulk Robot <hulkci@huawei.com>
+Signed-off-by: Zhang Changzhong <zhangchangzhong@huawei.com>
+Link: https://lore.kernel.org/r/1605248186-16013-1-git-send-email-zhangchangzhong@huawei.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_init.c
+@@ -2255,7 +2255,8 @@ static int qlcnic_83xx_restart_hw(struct
+
+ /* Boot either flash image or firmware image from host file system */
+ if (qlcnic_load_fw_file == 1) {
+- if (qlcnic_83xx_load_fw_image_from_host(adapter))
++ err = qlcnic_83xx_load_fw_image_from_host(adapter);
++ if (err)
+ return err;
+ } else {
+ QLC_SHARED_REG_WR32(adapter, QLCNIC_FW_IMG_VALID,
--- /dev/null
+From foo@baz Sun Nov 22 12:23:07 PM CET 2020
+From: Xin Long <lucien.xin@gmail.com>
+Date: Sat, 14 Nov 2020 13:22:53 +0800
+Subject: sctp: change to hold/put transport for proto_unreach_timer
+
+From: Xin Long <lucien.xin@gmail.com>
+
+[ Upstream commit 057a10fa1f73d745c8e69aa54ab147715f5630ae ]
+
+A call trace was found in Hangbin's Codenomicon testing with debug kernel:
+
+ [ 2615.981988] ODEBUG: free active (active state 0) object type: timer_list hint: sctp_generate_proto_unreach_event+0x0/0x3a0 [sctp]
+ [ 2615.995050] WARNING: CPU: 17 PID: 0 at lib/debugobjects.c:328 debug_print_object+0x199/0x2b0
+ [ 2616.095934] RIP: 0010:debug_print_object+0x199/0x2b0
+ [ 2616.191533] Call Trace:
+ [ 2616.194265] <IRQ>
+ [ 2616.202068] debug_check_no_obj_freed+0x25e/0x3f0
+ [ 2616.207336] slab_free_freelist_hook+0xeb/0x140
+ [ 2616.220971] kfree+0xd6/0x2c0
+ [ 2616.224293] rcu_do_batch+0x3bd/0xc70
+ [ 2616.243096] rcu_core+0x8b9/0xd00
+ [ 2616.256065] __do_softirq+0x23d/0xacd
+ [ 2616.260166] irq_exit+0x236/0x2a0
+ [ 2616.263879] smp_apic_timer_interrupt+0x18d/0x620
+ [ 2616.269138] apic_timer_interrupt+0xf/0x20
+ [ 2616.273711] </IRQ>
+
+This is because it holds asoc when transport->proto_unreach_timer starts
+and puts asoc when the timer stops, and without holding transport the
+transport could be freed when the timer is still running.
+
+So fix it by holding/putting transport instead for proto_unreach_timer
+in transport, just like other timers in transport.
+
+v1->v2:
+ - Also use sctp_transport_put() for the "out_unlock:" path in
+ sctp_generate_proto_unreach_event(), as Marcelo noticed.
+
+Fixes: 50b5d6ad6382 ("sctp: Fix a race between ICMP protocol unreachable and connect()")
+Reported-by: Hangbin Liu <liuhangbin@gmail.com>
+Signed-off-by: Xin Long <lucien.xin@gmail.com>
+Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
+Link: https://lore.kernel.org/r/102788809b554958b13b95d33440f5448113b8d6.1605331373.git.lucien.xin@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sctp/input.c | 4 ++--
+ net/sctp/sm_sideeffect.c | 4 ++--
+ net/sctp/transport.c | 2 +-
+ 3 files changed, 5 insertions(+), 5 deletions(-)
+
+--- a/net/sctp/input.c
++++ b/net/sctp/input.c
+@@ -448,7 +448,7 @@ void sctp_icmp_proto_unreachable(struct
+ else {
+ if (!mod_timer(&t->proto_unreach_timer,
+ jiffies + (HZ/20)))
+- sctp_association_hold(asoc);
++ sctp_transport_hold(t);
+ }
+ } else {
+ struct net *net = sock_net(sk);
+@@ -457,7 +457,7 @@ void sctp_icmp_proto_unreachable(struct
+ "encountered!\n", __func__);
+
+ if (del_timer(&t->proto_unreach_timer))
+- sctp_association_put(asoc);
++ sctp_transport_put(t);
+
+ sctp_do_sm(net, SCTP_EVENT_T_OTHER,
+ SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -416,7 +416,7 @@ void sctp_generate_proto_unreach_event(u
+ /* Try again later. */
+ if (!mod_timer(&transport->proto_unreach_timer,
+ jiffies + (HZ/20)))
+- sctp_association_hold(asoc);
++ sctp_transport_hold(transport);
+ goto out_unlock;
+ }
+
+@@ -432,7 +432,7 @@ void sctp_generate_proto_unreach_event(u
+
+ out_unlock:
+ bh_unlock_sock(sk);
+- sctp_association_put(asoc);
++ sctp_transport_put(transport);
+ }
+
+
+--- a/net/sctp/transport.c
++++ b/net/sctp/transport.c
+@@ -148,7 +148,7 @@ void sctp_transport_free(struct sctp_tra
+
+ /* Delete the ICMP proto unreachable timer if it's active. */
+ if (del_timer(&transport->proto_unreach_timer))
+- sctp_association_put(transport->asoc);
++ sctp_transport_put(transport);
+
+ sctp_transport_put(transport);
+ }
--- /dev/null
+ah6-fix-error-return-code-in-ah6_input.patch
+atm-nicstar-unmap-dma-on-send-error.patch
+net-b44-fix-error-return-code-in-b44_init_one.patch
+net-bridge-add-missing-counters-to-ndo_get_stats64-callback.patch
+netlabel-fix-our-progress-tracking-in-netlbl_unlabel_staticlist.patch
+netlabel-fix-an-uninitialized-warning-in-netlbl_unlabel_staticlist.patch
+net-mlx4_core-fix-init_hca-fields-offset.patch
+net-x25-increase-refcnt-of-struct-x25_neigh-in-x25_rx_call_request.patch
+qlcnic-fix-error-return-code-in-qlcnic_83xx_restart_hw.patch
+sctp-change-to-hold-put-transport-for-proto_unreach_timer.patch
+net-usb-qmi_wwan-set-dtr-quirk-for-mr400.patch
+net-have-netpoll-bring-up-dsa-management-interface.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
