--- /dev/null
+From c610c10796608605c16a799104b970739317faf2 Mon Sep 17 00:00:00 2001
+From: Neil Horman <nhorman@tuxdriver.com>
+Date: Wed, 31 Jul 2013 09:03:56 -0400
+Subject: 8139cp: Add dma_mapping_error checking
+
+From: Neil Horman <nhorman@tuxdriver.com>
+
+[ Upstream commit cf3c4c03060b688cbc389ebc5065ebcce5653e96 ]
+
+Self explanitory dma_mapping_error addition to the 8139 driver, based on this:
+https://bugzilla.redhat.com/show_bug.cgi?id=947250
+
+It showed several backtraces arising for dma_map_* usage without checking the
+return code on the mapping. Add the check and abort the rx/tx operation if its
+failed. Untested as I have no hardware and the reporter has wandered off, but
+seems pretty straightforward.
+
+Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
+CC: "David S. Miller" <davem@davemloft.net>
+CC: Francois Romieu <romieu@fr.zoreil.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/realtek/8139cp.c | 48 +++++++++++++++++++++++++++++++---
+ 1 file changed, 45 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/realtek/8139cp.c
++++ b/drivers/net/ethernet/realtek/8139cp.c
+@@ -478,7 +478,7 @@ rx_status_loop:
+
+ while (1) {
+ u32 status, len;
+- dma_addr_t mapping;
++ dma_addr_t mapping, new_mapping;
+ struct sk_buff *skb, *new_skb;
+ struct cp_desc *desc;
+ const unsigned buflen = cp->rx_buf_sz;
+@@ -520,6 +520,13 @@ rx_status_loop:
+ goto rx_next;
+ }
+
++ new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
++ PCI_DMA_FROMDEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
++ dev->stats.rx_dropped++;
++ goto rx_next;
++ }
++
+ dma_unmap_single(&cp->pdev->dev, mapping,
+ buflen, PCI_DMA_FROMDEVICE);
+
+@@ -531,12 +538,11 @@ rx_status_loop:
+
+ skb_put(skb, len);
+
+- mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
+- PCI_DMA_FROMDEVICE);
+ cp->rx_skb[rx_tail] = new_skb;
+
+ cp_rx_skb(cp, skb, desc);
+ rx++;
++ mapping = new_mapping;
+
+ rx_next:
+ cp->rx_ring[rx_tail].opts2 = 0;
+@@ -716,6 +722,22 @@ static inline u32 cp_tx_vlan_tag(struct
+ TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
+ }
+
++static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb,
++ int first, int entry_last)
++{
++ int frag, index;
++ struct cp_desc *txd;
++ skb_frag_t *this_frag;
++ for (frag = 0; frag+first < entry_last; frag++) {
++ index = first+frag;
++ cp->tx_skb[index] = NULL;
++ txd = &cp->tx_ring[index];
++ this_frag = &skb_shinfo(skb)->frags[frag];
++ dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
++ skb_frag_size(this_frag), PCI_DMA_TODEVICE);
++ }
++}
++
+ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
+ struct net_device *dev)
+ {
+@@ -749,6 +771,9 @@ static netdev_tx_t cp_start_xmit (struct
+
+ len = skb->len;
+ mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping))
++ goto out_dma_error;
++
+ txd->opts2 = opts2;
+ txd->addr = cpu_to_le64(mapping);
+ wmb();
+@@ -786,6 +811,9 @@ static netdev_tx_t cp_start_xmit (struct
+ first_len = skb_headlen(skb);
+ first_mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ first_len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, first_mapping))
++ goto out_dma_error;
++
+ cp->tx_skb[entry] = skb;
+ entry = NEXT_TX(entry);
+
+@@ -799,6 +827,11 @@ static netdev_tx_t cp_start_xmit (struct
+ mapping = dma_map_single(&cp->pdev->dev,
+ skb_frag_address(this_frag),
+ len, PCI_DMA_TODEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++ unwind_tx_frag_mapping(cp, skb, first_entry, entry);
++ goto out_dma_error;
++ }
++
+ eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
+
+ ctrl = eor | len | DescOwn;
+@@ -859,11 +892,16 @@ static netdev_tx_t cp_start_xmit (struct
+ if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
+ netif_stop_queue(dev);
+
++out_unlock:
+ spin_unlock_irqrestore(&cp->lock, intr_flags);
+
+ cpw8(TxPoll, NormalTxPoll);
+
+ return NETDEV_TX_OK;
++out_dma_error:
++ kfree_skb(skb);
++ cp->dev->stats.tx_dropped++;
++ goto out_unlock;
+ }
+
+ /* Set or clear the multicast filter for this adaptor.
+@@ -1054,6 +1092,10 @@ static int cp_refill_rx(struct cp_privat
+
+ mapping = dma_map_single(&cp->pdev->dev, skb->data,
+ cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
++ if (dma_mapping_error(&cp->pdev->dev, mapping)) {
++ kfree_skb(skb);
++ goto err_out;
++ }
+ cp->rx_skb[i] = skb;
+
+ cp->rx_ring[i].opts2 = 0;
--- /dev/null
+From c5606776451a929334fa68240e59fd77fbd0732d Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Sun, 28 Jul 2013 23:04:45 +0300
+Subject: af_key: more info leaks in pfkey messages
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit ff862a4668dd6dba962b1d2d8bd344afa6375683 ]
+
+This is inspired by a5cc68f3d6 "af_key: fix info leaks in notify
+messages". There are some struct members which don't get initialized
+and could disclose small amounts of private information.
+
+Acked-by: Mathias Krause <minipli@googlemail.com>
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/key/af_key.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -2081,6 +2081,7 @@ static int pfkey_xfrm_policy2msg(struct
+ pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
+ }
+ pol->sadb_x_policy_dir = dir+1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
+ pol->sadb_x_policy_priority = xp->priority;
+
+@@ -3137,7 +3138,9 @@ static int pfkey_send_acquire(struct xfr
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = XFRM_POLICY_OUT + 1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = xp->index;
++ pol->sadb_x_policy_priority = xp->priority;
+
+ /* Set sadb_comb's. */
+ if (x->id.proto == IPPROTO_AH)
+@@ -3525,6 +3528,7 @@ static int pfkey_send_migrate(const stru
+ pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
+ pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
+ pol->sadb_x_policy_dir = dir + 1;
++ pol->sadb_x_policy_reserved = 0;
+ pol->sadb_x_policy_id = 0;
+ pol->sadb_x_policy_priority = 0;
+
--- /dev/null
+From 89e2c474ab38ffd0f1abc551ee2b4744230f169c Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Fri, 19 Jul 2013 08:48:05 +0300
+Subject: arcnet: cleanup sizeof parameter
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 087d273caf4f7d3f2159256f255f1f432bc84a5b ]
+
+This patch doesn't change the compiled code because ARC_HDR_SIZE is 4
+and sizeof(int) is 4, but the intent was to use the header size and not
+the sizeof the header size.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/arcnet/arcnet.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/arcnet/arcnet.c
++++ b/drivers/net/arcnet/arcnet.c
+@@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device
+
+ soft = &pkt.soft.rfc1201;
+
+- lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
++ lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
+ if (pkt.hard.offset[0]) {
+ ofs = pkt.hard.offset[0];
+ length = 256 - ofs;
--- /dev/null
+From 93b9b6e69777de669032e068df8f44f61f87b7bb Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Mon, 29 Jul 2013 10:24:04 -0700
+Subject: atl1c: use custom skb allocator
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 7b70176421993866e616f1cbc4d0dd4054f1bf78 ]
+
+We had reports ( https://bugzilla.kernel.org/show_bug.cgi?id=54021 )
+that using high order pages for skb allocations is problematic for atl1c
+
+We do not know exactly what the problem is, but we suspect that crossing
+4K pages is not well supported by this hardware.
+
+Use a custom allocator, using page allocator and 2K fragments for
+optimal stack behavior. We might make this allocator generic
+in future kernels.
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Luis Henriques <luis.henriques@canonical.com>
+Cc: Neil Horman <nhorman@tuxdriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/atheros/atl1c/atl1c.h | 3 +
+ drivers/net/ethernet/atheros/atl1c/atl1c_main.c | 40 +++++++++++++++++++++++-
+ 2 files changed, 42 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/atheros/atl1c/atl1c.h
++++ b/drivers/net/ethernet/atheros/atl1c/atl1c.h
+@@ -520,6 +520,9 @@ struct atl1c_adapter {
+ struct net_device *netdev;
+ struct pci_dev *pdev;
+ struct napi_struct napi;
++ struct page *rx_page;
++ unsigned int rx_page_offset;
++ unsigned int rx_frag_size;
+ struct atl1c_hw hw;
+ struct atl1c_hw_stats hw_stats;
+ struct mii_if_info mii; /* MII interface info */
+--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
++++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+@@ -481,10 +481,15 @@ static int atl1c_set_mac_addr(struct net
+ static void atl1c_set_rxbufsize(struct atl1c_adapter *adapter,
+ struct net_device *dev)
+ {
++ unsigned int head_size;
+ int mtu = dev->mtu;
+
+ adapter->rx_buffer_len = mtu > AT_RX_BUF_SIZE ?
+ roundup(mtu + ETH_HLEN + ETH_FCS_LEN + VLAN_HLEN, 8) : AT_RX_BUF_SIZE;
++
++ head_size = SKB_DATA_ALIGN(adapter->rx_buffer_len + NET_SKB_PAD) +
++ SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
++ adapter->rx_frag_size = roundup_pow_of_two(head_size);
+ }
+
+ static netdev_features_t atl1c_fix_features(struct net_device *netdev,
+@@ -952,6 +957,10 @@ static void atl1c_free_ring_resources(st
+ kfree(adapter->tpd_ring[0].buffer_info);
+ adapter->tpd_ring[0].buffer_info = NULL;
+ }
++ if (adapter->rx_page) {
++ put_page(adapter->rx_page);
++ adapter->rx_page = NULL;
++ }
+ }
+
+ /**
+@@ -1639,6 +1648,35 @@ static inline void atl1c_rx_checksum(str
+ skb_checksum_none_assert(skb);
+ }
+
++static struct sk_buff *atl1c_alloc_skb(struct atl1c_adapter *adapter)
++{
++ struct sk_buff *skb;
++ struct page *page;
++
++ if (adapter->rx_frag_size > PAGE_SIZE)
++ return netdev_alloc_skb(adapter->netdev,
++ adapter->rx_buffer_len);
++
++ page = adapter->rx_page;
++ if (!page) {
++ adapter->rx_page = page = alloc_page(GFP_ATOMIC);
++ if (unlikely(!page))
++ return NULL;
++ adapter->rx_page_offset = 0;
++ }
++
++ skb = build_skb(page_address(page) + adapter->rx_page_offset,
++ adapter->rx_frag_size);
++ if (likely(skb)) {
++ adapter->rx_page_offset += adapter->rx_frag_size;
++ if (adapter->rx_page_offset >= PAGE_SIZE)
++ adapter->rx_page = NULL;
++ else
++ get_page(page);
++ }
++ return skb;
++}
++
+ static int atl1c_alloc_rx_buffer(struct atl1c_adapter *adapter)
+ {
+ struct atl1c_rfd_ring *rfd_ring = &adapter->rfd_ring;
+@@ -1660,7 +1698,7 @@ static int atl1c_alloc_rx_buffer(struct
+ while (next_info->flags & ATL1C_BUFFER_FREE) {
+ rfd_desc = ATL1C_RFD_DESC(rfd_ring, rfd_next_to_use);
+
+- skb = netdev_alloc_skb(adapter->netdev, adapter->rx_buffer_len);
++ skb = atl1c_alloc_skb(adapter);
+ if (unlikely(!skb)) {
+ if (netif_msg_rx_err(adapter))
+ dev_warn(&pdev->dev, "alloc rx buffer failed\n");
--- /dev/null
+From 6883c1fc2e91010dc9bbb097da29ec9923a1e9f7 Mon Sep 17 00:00:00 2001
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+Date: Fri, 26 Jul 2013 11:00:10 +0200
+Subject: genetlink: release cb_lock before requesting additional module
+
+From: Stanislaw Gruszka <sgruszka@redhat.com>
+
+[ Upstream commit c74f2b2678f40b80265dd53556f1f778c8e1823f ]
+
+Requesting external module with cb_lock taken can result in
+the deadlock like showed below:
+
+[ 2458.111347] Showing all locks held in the system:
+[ 2458.111347] 1 lock held by NetworkManager/582:
+[ 2458.111347] #0: (cb_lock){++++++}, at: [<ffffffff8162bc79>] genl_rcv+0x19/0x40
+[ 2458.111347] 1 lock held by modprobe/603:
+[ 2458.111347] #0: (cb_lock){++++++}, at: [<ffffffff8162baa5>] genl_lock_all+0x15/0x30
+
+[ 2461.579457] SysRq : Show Blocked State
+[ 2461.580103] task PC stack pid father
+[ 2461.580103] NetworkManager D ffff880034b84500 4040 582 1 0x00000080
+[ 2461.580103] ffff8800197ff720 0000000000000046 00000000001d5340 ffff8800197fffd8
+[ 2461.580103] ffff8800197fffd8 00000000001d5340 ffff880019631700 7fffffffffffffff
+[ 2461.580103] ffff8800197ff880 ffff8800197ff878 ffff880019631700 ffff880019631700
+[ 2461.580103] Call Trace:
+[ 2461.580103] [<ffffffff817355f9>] schedule+0x29/0x70
+[ 2461.580103] [<ffffffff81731ad1>] schedule_timeout+0x1c1/0x360
+[ 2461.580103] [<ffffffff810e69eb>] ? mark_held_locks+0xbb/0x140
+[ 2461.580103] [<ffffffff817377ac>] ? _raw_spin_unlock_irq+0x2c/0x50
+[ 2461.580103] [<ffffffff810e6b6d>] ? trace_hardirqs_on_caller+0xfd/0x1c0
+[ 2461.580103] [<ffffffff81736398>] wait_for_completion_killable+0xe8/0x170
+[ 2461.580103] [<ffffffff810b7fa0>] ? wake_up_state+0x20/0x20
+[ 2461.580103] [<ffffffff81095825>] call_usermodehelper_exec+0x1a5/0x210
+[ 2461.580103] [<ffffffff817362ed>] ? wait_for_completion_killable+0x3d/0x170
+[ 2461.580103] [<ffffffff81095cc3>] __request_module+0x1b3/0x370
+[ 2461.580103] [<ffffffff810e6b6d>] ? trace_hardirqs_on_caller+0xfd/0x1c0
+[ 2461.580103] [<ffffffff8162c5c9>] ctrl_getfamily+0x159/0x190
+[ 2461.580103] [<ffffffff8162d8a4>] genl_family_rcv_msg+0x1f4/0x2e0
+[ 2461.580103] [<ffffffff8162d990>] ? genl_family_rcv_msg+0x2e0/0x2e0
+[ 2461.580103] [<ffffffff8162da1e>] genl_rcv_msg+0x8e/0xd0
+[ 2461.580103] [<ffffffff8162b729>] netlink_rcv_skb+0xa9/0xc0
+[ 2461.580103] [<ffffffff8162bc88>] genl_rcv+0x28/0x40
+[ 2461.580103] [<ffffffff8162ad6d>] netlink_unicast+0xdd/0x190
+[ 2461.580103] [<ffffffff8162b149>] netlink_sendmsg+0x329/0x750
+[ 2461.580103] [<ffffffff815db849>] sock_sendmsg+0x99/0xd0
+[ 2461.580103] [<ffffffff810bb58f>] ? local_clock+0x5f/0x70
+[ 2461.580103] [<ffffffff810e96e8>] ? lock_release_non_nested+0x308/0x350
+[ 2461.580103] [<ffffffff815dbc6e>] ___sys_sendmsg+0x39e/0x3b0
+[ 2461.580103] [<ffffffff810565af>] ? kvm_clock_read+0x2f/0x50
+[ 2461.580103] [<ffffffff810218b9>] ? sched_clock+0x9/0x10
+[ 2461.580103] [<ffffffff810bb2bd>] ? sched_clock_local+0x1d/0x80
+[ 2461.580103] [<ffffffff810bb448>] ? sched_clock_cpu+0xa8/0x100
+[ 2461.580103] [<ffffffff810e33ad>] ? trace_hardirqs_off+0xd/0x10
+[ 2461.580103] [<ffffffff810bb58f>] ? local_clock+0x5f/0x70
+[ 2461.580103] [<ffffffff810e3f7f>] ? lock_release_holdtime.part.28+0xf/0x1a0
+[ 2461.580103] [<ffffffff8120fec9>] ? fget_light+0xf9/0x510
+[ 2461.580103] [<ffffffff8120fe0c>] ? fget_light+0x3c/0x510
+[ 2461.580103] [<ffffffff815dd1d2>] __sys_sendmsg+0x42/0x80
+[ 2461.580103] [<ffffffff815dd222>] SyS_sendmsg+0x12/0x20
+[ 2461.580103] [<ffffffff81741ad9>] system_call_fastpath+0x16/0x1b
+[ 2461.580103] modprobe D ffff88000f2c8000 4632 603 602 0x00000080
+[ 2461.580103] ffff88000f04fba8 0000000000000046 00000000001d5340 ffff88000f04ffd8
+[ 2461.580103] ffff88000f04ffd8 00000000001d5340 ffff8800377d4500 ffff8800377d4500
+[ 2461.580103] ffffffff81d0b260 ffffffff81d0b268 ffffffff00000000 ffffffff81d0b2b0
+[ 2461.580103] Call Trace:
+[ 2461.580103] [<ffffffff817355f9>] schedule+0x29/0x70
+[ 2461.580103] [<ffffffff81736d4d>] rwsem_down_write_failed+0xed/0x1a0
+[ 2461.580103] [<ffffffff810bb200>] ? update_cpu_load_active+0x10/0xb0
+[ 2461.580103] [<ffffffff8137b473>] call_rwsem_down_write_failed+0x13/0x20
+[ 2461.580103] [<ffffffff8173492d>] ? down_write+0x9d/0xb2
+[ 2461.580103] [<ffffffff8162baa5>] ? genl_lock_all+0x15/0x30
+[ 2461.580103] [<ffffffff8162baa5>] genl_lock_all+0x15/0x30
+[ 2461.580103] [<ffffffff8162cbb3>] genl_register_family+0x53/0x1f0
+[ 2461.580103] [<ffffffffa01dc000>] ? 0xffffffffa01dbfff
+[ 2461.580103] [<ffffffff8162d650>] genl_register_family_with_ops+0x20/0x80
+[ 2461.580103] [<ffffffffa01dc000>] ? 0xffffffffa01dbfff
+[ 2461.580103] [<ffffffffa017fe84>] nl80211_init+0x24/0xf0 [cfg80211]
+[ 2461.580103] [<ffffffffa01dc000>] ? 0xffffffffa01dbfff
+[ 2461.580103] [<ffffffffa01dc043>] cfg80211_init+0x43/0xdb [cfg80211]
+[ 2461.580103] [<ffffffff810020fa>] do_one_initcall+0xfa/0x1b0
+[ 2461.580103] [<ffffffff8105cb93>] ? set_memory_nx+0x43/0x50
+[ 2461.580103] [<ffffffff810f75af>] load_module+0x1c6f/0x27f0
+[ 2461.580103] [<ffffffff810f2c90>] ? store_uevent+0x40/0x40
+[ 2461.580103] [<ffffffff810f82c6>] SyS_finit_module+0x86/0xb0
+[ 2461.580103] [<ffffffff81741ad9>] system_call_fastpath+0x16/0x1b
+[ 2461.580103] Sched Debug Version: v0.10, 3.11.0-0.rc1.git4.1.fc20.x86_64 #1
+
+Problem start to happen after adding net-pf-16-proto-16-family-nl80211
+alias name to cfg80211 module by below commit (though that commit
+itself is perfectly fine):
+
+commit fb4e156886ce6e8309e912d8b370d192330d19d3
+Author: Marcel Holtmann <marcel@holtmann.org>
+Date: Sun Apr 28 16:22:06 2013 -0700
+
+ nl80211: Add generic netlink module alias for cfg80211/nl80211
+
+Reported-and-tested-by: Jeff Layton <jlayton@redhat.com>
+Reported-by: Richard W.M. Jones <rjones@redhat.com>
+Signed-off-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Reviewed-by: Pravin B Shelar <pshelar@nicira.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlink/genetlink.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/net/netlink/genetlink.c
++++ b/net/netlink/genetlink.c
+@@ -877,8 +877,10 @@ static int ctrl_getfamily(struct sk_buff
+ #ifdef CONFIG_MODULES
+ if (res == NULL) {
+ genl_unlock();
++ up_read(&cb_lock);
+ request_module("net-pf-%d-proto-%d-family-%s",
+ PF_NETLINK, NETLINK_GENERIC, name);
++ down_read(&cb_lock);
+ genl_lock();
+ res = genl_family_find_byname(name);
+ }
--- /dev/null
+From 611d77e7e12e173caaa266b503bab54dbaf08139 Mon Sep 17 00:00:00 2001
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Date: Mon, 22 Jul 2013 23:45:53 +0200
+Subject: ipv6: take rtnl_lock and mark mrt6 table as freed on namespace cleanup
+
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+
+[ Upstream commit 905a6f96a1b18e490a75f810d733ced93c39b0e5 ]
+
+Otherwise we end up dereferencing the already freed net->ipv6.mrt pointer
+which leads to a panic (from Srivatsa S. Bhat):
+
+BUG: unable to handle kernel paging request at ffff882018552020
+IP: [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
+PGD 290a067 PUD 207ffe0067 PMD 207ff1d067 PTE 8000002018552060
+Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
+Modules linked in: ebtable_nat ebtables nfs fscache nf_conntrack_ipv4 nf_defrag_ipv4 ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables nfsd lockd nfs_acl exportfs auth_rpcgss autofs4 sunrpc 8021q garp bridge stp llc ip6t_REJECT nf_conntrack_ipv6 nf_defrag_ipv6 xt_state nf_conntrack ip6table_filter
++ip6_tables ipv6 vfat fat vhost_net macvtap macvlan vhost tun kvm_intel kvm uinput iTCO_wdt iTCO_vendor_support cdc_ether usbnet mii microcode i2c_i801 i2c_core lpc_ich mfd_core shpchp ioatdma dca mlx4_core be2net wmi acpi_cpufreq mperf ext4 jbd2 mbcache dm_mirror dm_region_hash dm_log dm_mod
+CPU: 0 PID: 7 Comm: kworker/u33:0 Not tainted 3.11.0-rc1-ea45e-a #4
+Hardware name: IBM -[8737R2A]-/00Y2738, BIOS -[B2E120RUS-1.20]- 11/30/2012
+Workqueue: netns cleanup_net
+task: ffff8810393641c0 ti: ffff881039366000 task.ti: ffff881039366000
+RIP: 0010:[<ffffffffa0366b02>] [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
+RSP: 0018:ffff881039367bd8 EFLAGS: 00010286
+RAX: ffff881039367fd8 RBX: ffff882018552000 RCX: dead000000200200
+RDX: 0000000000000000 RSI: ffff881039367b68 RDI: ffff881039367b68
+RBP: ffff881039367bf8 R08: ffff881039367b68 R09: 2222222222222222
+R10: 2222222222222222 R11: 2222222222222222 R12: ffff882015a7a040
+R13: ffff882014eb89c0 R14: ffff8820289e2800 R15: 0000000000000000
+FS: 0000000000000000(0000) GS:ffff88103fc00000(0000) knlGS:0000000000000000
+CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+CR2: ffff882018552020 CR3: 0000000001c0b000 CR4: 00000000000407f0
+Stack:
+ ffff881039367c18 ffff882014eb89c0 ffff882015e28c00 0000000000000000
+ ffff881039367c18 ffffffffa034d9d1 ffff8820289e2800 ffff882014eb89c0
+ ffff881039367c58 ffffffff815bdecb ffffffff815bddf2 ffff882014eb89c0
+Call Trace:
+ [<ffffffffa034d9d1>] rawv6_close+0x21/0x40 [ipv6]
+ [<ffffffff815bdecb>] inet_release+0xfb/0x220
+ [<ffffffff815bddf2>] ? inet_release+0x22/0x220
+ [<ffffffffa032686f>] inet6_release+0x3f/0x50 [ipv6]
+ [<ffffffff8151c1d9>] sock_release+0x29/0xa0
+ [<ffffffff81525520>] sk_release_kernel+0x30/0x70
+ [<ffffffffa034f14b>] icmpv6_sk_exit+0x3b/0x80 [ipv6]
+ [<ffffffff8152fff9>] ops_exit_list+0x39/0x60
+ [<ffffffff815306fb>] cleanup_net+0xfb/0x1a0
+ [<ffffffff81075e3a>] process_one_work+0x1da/0x610
+ [<ffffffff81075dc9>] ? process_one_work+0x169/0x610
+ [<ffffffff81076390>] worker_thread+0x120/0x3a0
+ [<ffffffff81076270>] ? process_one_work+0x610/0x610
+ [<ffffffff8107da2e>] kthread+0xee/0x100
+ [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
+ [<ffffffff8162a99c>] ret_from_fork+0x7c/0xb0
+ [<ffffffff8107d940>] ? __init_kthread_worker+0x70/0x70
+Code: 20 48 89 5d e8 4c 89 65 f0 4c 89 6d f8 66 66 66 66 90 4c 8b 67 30 49 89 fd e8 db 3c 1e e1 49 8b 9c 24 90 08 00 00 48 85 db 74 06 <4c> 39 6b 20 74 20 bb f3 ff ff ff e8 8e 3c 1e e1 89 d8 4c 8b 65
+RIP [<ffffffffa0366b02>] ip6mr_sk_done+0x32/0xb0 [ipv6]
+ RSP <ffff881039367bd8>
+CR2: ffff882018552020
+
+Reported-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Tested-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
+Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ip6mr.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/net/ipv6/ip6mr.c
++++ b/net/ipv6/ip6mr.c
+@@ -259,10 +259,12 @@ static void __net_exit ip6mr_rules_exit(
+ {
+ struct mr6_table *mrt, *next;
+
++ rtnl_lock();
+ list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
+ list_del(&mrt->list);
+ ip6mr_free_table(mrt);
+ }
++ rtnl_unlock();
+ fib_rules_unregister(net->ipv6.mr6_rules_ops);
+ }
+ #else
+@@ -289,7 +291,10 @@ static int __net_init ip6mr_rules_init(s
+
+ static void __net_exit ip6mr_rules_exit(struct net *net)
+ {
++ rtnl_lock();
+ ip6mr_free_table(net->ipv6.mrt6);
++ net->ipv6.mrt6 = NULL;
++ rtnl_unlock();
+ }
+ #endif
+
--- /dev/null
+From 5dce790e0555436b087918988bbbd326b756249c Mon Sep 17 00:00:00 2001
+From: Joe Perches <joe@perches.com>
+Date: Tue, 30 Jul 2013 10:31:00 -0700
+Subject: ndisc: Add missing inline to ndisc_addr_option_pad
+
+From: Joe Perches <joe@perches.com>
+
+[ Upstream commit d9d10a30964504af834d8d250a0c76d4ae91eb1e ]
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/ndisc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/ndisc.h
++++ b/include/net/ndisc.h
+@@ -119,7 +119,7 @@ extern struct ndisc_options *ndisc_parse
+ * if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
+ * also need a pad of 2.
+ */
+-static int ndisc_addr_option_pad(unsigned short type)
++static inline int ndisc_addr_option_pad(unsigned short type)
+ {
+ switch (type) {
+ case ARPHRD_INFINIBAND: return 2;
--- /dev/null
+From 53d4517253579a520aed8c897b175b2256b517b7 Mon Sep 17 00:00:00 2001
+From: Or Gerlitz <ogerlitz@mellanox.com>
+Date: Thu, 1 Aug 2013 19:55:00 +0300
+Subject: net/mlx4_core: Don't give VFs MAC addresses which are derived from the PF MAC
+
+From: Or Gerlitz <ogerlitz@mellanox.com>
+
+[ Upstream commit 0508ad646836007e6e6b62331eee7356844eac3d ]
+
+If the user has not assigned a MAC address to a VM, then don't give it MAC which
+is based on the PF one. The current derivation scheme is wrong and leads to VM
+MAC collisions when the number of cards/hypervisors becomes big enough.
+
+Instead, just give it zeros and let them figure out what to do with that.
+
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/fw.c | 11 +----------
+ 1 file changed, 1 insertion(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/fw.c
++++ b/drivers/net/ethernet/mellanox/mlx4/fw.c
+@@ -840,16 +840,7 @@ int mlx4_QUERY_PORT_wrapper(struct mlx4_
+ MLX4_CMD_NATIVE);
+
+ if (!err && dev->caps.function != slave) {
+- /* if config MAC in DB use it */
+- if (priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac)
+- def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
+- else {
+- /* set slave default_mac address */
+- MLX4_GET(def_mac, outbox->buf, QUERY_PORT_MAC_OFFSET);
+- def_mac += slave << 8;
+- priv->mfunc.master.vf_admin[slave].vport[vhcr->in_modifier].mac = def_mac;
+- }
+-
++ def_mac = priv->mfunc.master.vf_oper[slave].vport[vhcr->in_modifier].state.mac;
+ MLX4_PUT(outbox->buf, def_mac, QUERY_PORT_MAC_OFFSET);
+
+ /* get port type - currently only eth is enabled */
--- /dev/null
+From 4b70714fca9f0c8de72451f091294ba26c5bf24b Mon Sep 17 00:00:00 2001
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Thu, 1 Aug 2013 19:55:01 +0300
+Subject: net/mlx4_core: VFs must ignore the enable_64b_cqe_eqe module param
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+[ Upstream commit b30513202c6c14120f70b2e9aa1e97d47bbc2313 ]
+
+Slaves get the 64B CQE/EQE state from QUERY_HCA, not from the module parameter.
+
+If the parameter is set to zero, the slave outputs an incorrect/irrelevant
+warning message that 64B CQEs/EQEs are supported but not enabled (even if the
+hypervisor has enabled 64B CQEs/EQEs).
+
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/main.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -371,7 +371,7 @@ static int mlx4_dev_cap(struct mlx4_dev
+
+ dev->caps.sqp_demux = (mlx4_is_master(dev)) ? MLX4_MAX_NUM_SLAVES : 0;
+
+- if (!enable_64b_cqe_eqe) {
++ if (!enable_64b_cqe_eqe && !mlx4_is_slave(dev)) {
+ if (dev_cap->flags &
+ (MLX4_DEV_CAP_FLAG_64B_CQE | MLX4_DEV_CAP_FLAG_64B_EQE)) {
+ mlx4_warn(dev, "64B EQEs/CQEs supported by the device but not enabled\n");
--- /dev/null
+From e0112818950ca4668db30a9919f1b252ee0f267b Mon Sep 17 00:00:00 2001
+From: "David S. Miller" <davem@davemloft.net>
+Date: Tue, 30 Jul 2013 00:16:21 -0700
+Subject: net_sched: Fix stack info leak in cbq_dump_wrr().
+
+From: "David S. Miller" <davem@davemloft.net>
+
+[ Upstream commit a0db856a95a29efb1c23db55c02d9f0ff4f0db48 ]
+
+Make sure the reserved fields, and padding (if any), are
+fully initialized.
+
+Based upon a patch by Dan Carpenter and feedback from
+Joe Perches.
+
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_cbq.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/sch_cbq.c
++++ b/net/sched/sch_cbq.c
+@@ -1465,6 +1465,7 @@ static int cbq_dump_wrr(struct sk_buff *
+ unsigned char *b = skb_tail_pointer(skb);
+ struct tc_cbq_wrropt opt;
+
++ memset(&opt, 0, sizeof(opt));
+ opt.flags = 0;
+ opt.allot = cl->allot;
+ opt.priority = cl->priority + 1;
--- /dev/null
+From 6275c04a8e60f5e8b300964f63c94121bfc5c4a5 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Tue, 30 Jul 2013 13:23:39 +0300
+Subject: net_sched: info leak in atm_tc_dump_class()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+[ Upstream commit 8cb3b9c3642c0263d48f31d525bcee7170eedc20 ]
+
+The "pvc" struct has a hole after pvc.sap_family which is not cleared.
+
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Reviewed-by: Jiri Pirko <jiri@resnulli.us>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/sch_atm.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/sch_atm.c
++++ b/net/sched/sch_atm.c
+@@ -605,6 +605,7 @@ static int atm_tc_dump_class(struct Qdis
+ struct sockaddr_atmpvc pvc;
+ int state;
+
++ memset(&pvc, 0, sizeof(pvc));
+ pvc.sap_family = AF_ATMPVC;
+ pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
+ pvc.sap_addr.vpi = flow->vcc->vpi;
userns-unshare_userns-cred-should-not-populate-cred-on-failure.patch
x86-iommu-vt-d-expand-interrupt-remapping-quirk-to-cover-x58-chipset.patch
spi-spi-davinci-fix-direction-in-dma_map_single.patch
+arcnet-cleanup-sizeof-parameter.patch
+sysctl-net-keep-tcp_syn_retries-inside-the-boundary.patch
+sfc-enable-rx-scatter-for-flows-steered-by-rfs.patch
+ipv6-take-rtnl_lock-and-mark-mrt6-table-as-freed-on-namespace-cleanup.patch
+usbnet-do-not-pretend-to-support-sg-tso.patch
+genetlink-release-cb_lock-before-requesting-additional-module.patch
+net_sched-fix-stack-info-leak-in-cbq_dump_wrr.patch
+af_key-more-info-leaks-in-pfkey-messages.patch
+atl1c-use-custom-skb-allocator.patch
+net_sched-info-leak-in-atm_tc_dump_class.patch
+ndisc-add-missing-inline-to-ndisc_addr_option_pad.patch
+8139cp-add-dma_mapping_error-checking.patch
+net-mlx4_core-don-t-give-vfs-mac-addresses-which-are-derived-from-the-pf-mac.patch
+net-mlx4_core-vfs-must-ignore-the-enable_64b_cqe_eqe-module-param.patch
--- /dev/null
+From 23e050350e7460f1289d65651bfdd1d1f5663a9e Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <bhutchings@solarflare.com>
+Date: Tue, 23 Jul 2013 00:17:25 +0100
+Subject: sfc: Enable RX scatter for flows steered by RFS
+
+From: Ben Hutchings <bhutchings@solarflare.com>
+
+[ Upstream commit 7aa0076c497d6f0d5d957b431d0d80e1e9780274 ]
+
+Received packets are only scattered if this is enabled in both the
+matching filter and the receiving queue. This was not being done for
+filters inserted for RFS, so any packet requiring more than a single
+descriptor was dropped.
+
+Signed-off-by: Ben Hutchings <bhutchings@solarflare.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/sfc/filter.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/ethernet/sfc/filter.c
++++ b/drivers/net/ethernet/sfc/filter.c
+@@ -1196,7 +1196,9 @@ int efx_filter_rfs(struct net_device *ne
+ EFX_BUG_ON_PARANOID(skb_headlen(skb) < nhoff + 4 * ip->ihl + 4);
+ ports = (const __be16 *)(skb->data + nhoff + 4 * ip->ihl);
+
+- efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT, 0, rxq_index);
++ efx_filter_init_rx(&spec, EFX_FILTER_PRI_HINT,
++ efx->rx_scatter ? EFX_FILTER_FLAG_RX_SCATTER : 0,
++ rxq_index);
+ rc = efx_filter_set_ipv4_full(&spec, ip->protocol,
+ ip->daddr, ports[1], ip->saddr, ports[0]);
+ if (rc)
--- /dev/null
+From 3f61e3472f3a999b825a8c925003f251fbba0995 Mon Sep 17 00:00:00 2001
+From: Michal Tesar <mtesar@redhat.com>
+Date: Fri, 19 Jul 2013 14:09:01 +0200
+Subject: sysctl net: Keep tcp_syn_retries inside the boundary
+
+From: Michal Tesar <mtesar@redhat.com>
+
+[ Upstream commit 651e92716aaae60fc41b9652f54cb6803896e0da ]
+
+Limit the min/max value passed to the
+/proc/sys/net/ipv4/tcp_syn_retries.
+
+Signed-off-by: Michal Tesar <mtesar@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/sysctl_net_ipv4.c | 6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -36,6 +36,8 @@ static int tcp_adv_win_scale_min = -31;
+ static int tcp_adv_win_scale_max = 31;
+ static int ip_ttl_min = 1;
+ static int ip_ttl_max = 255;
++static int tcp_syn_retries_min = 1;
++static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
+ static int ip_ping_group_range_min[] = { 0, 0 };
+ static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
+
+@@ -331,7 +333,9 @@ static struct ctl_table ipv4_table[] = {
+ .data = &sysctl_tcp_syn_retries,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec
++ .proc_handler = proc_dointvec_minmax,
++ .extra1 = &tcp_syn_retries_min,
++ .extra2 = &tcp_syn_retries_max
+ },
+ {
+ .procname = "tcp_synack_retries",
--- /dev/null
+From be7f6ab12c0cff03312ee9d534e1121097e5f638 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 23 Jul 2013 17:15:54 -0700
+Subject: usbnet: do not pretend to support SG/TSO
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 20f0170377264e8449b6987041f0bcc4d746d3ed ]
+
+usbnet doesn't support yet SG, so drivers should not advertise SG or TSO
+capabilities, as they allow TCP stack to build large TSO packets that
+need to be linearized and might use order-5 pages.
+
+This adds an extra copy overhead and possible allocation failures.
+
+Current code ignore skb_linearize() return code so crashes are even
+possible.
+
+Best is to not pretend SG/TSO is supported, and add this again when/if
+usbnet really supports SG for devices who could get a performance gain.
+
+Based on a prior patch from Freddy Xin <freddy@asix.com.tw>
+
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/ax88179_178a.c | 9 ++++-----
+ drivers/net/usb/smsc75xx.c | 12 +++---------
+ 2 files changed, 7 insertions(+), 14 deletions(-)
+
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1029,10 +1029,10 @@ static int ax88179_bind(struct usbnet *d
+ dev->mii.supports_gmii = 1;
+
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++ NETIF_F_RXCSUM;
+
+ dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++ NETIF_F_RXCSUM;
+
+ /* Enable checksum offload */
+ *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+@@ -1173,7 +1173,6 @@ ax88179_tx_fixup(struct usbnet *dev, str
+ if (((skb->len + 8) % frame_size) == 0)
+ tx_hdr2 |= 0x80008000; /* Enable padding */
+
+- skb_linearize(skb);
+ headroom = skb_headroom(skb);
+ tailroom = skb_tailroom(skb);
+
+@@ -1317,10 +1316,10 @@ static int ax88179_reset(struct usbnet *
+ 1, 1, tmp);
+
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++ NETIF_F_RXCSUM;
+
+ dev->net->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_RXCSUM | NETIF_F_SG | NETIF_F_TSO;
++ NETIF_F_RXCSUM;
+
+ /* Enable checksum offload */
+ *tmp = AX_RXCOE_IP | AX_RXCOE_TCP | AX_RXCOE_UDP |
+--- a/drivers/net/usb/smsc75xx.c
++++ b/drivers/net/usb/smsc75xx.c
+@@ -45,7 +45,6 @@
+ #define EEPROM_MAC_OFFSET (0x01)
+ #define DEFAULT_TX_CSUM_ENABLE (true)
+ #define DEFAULT_RX_CSUM_ENABLE (true)
+-#define DEFAULT_TSO_ENABLE (true)
+ #define SMSC75XX_INTERNAL_PHY_ID (1)
+ #define SMSC75XX_TX_OVERHEAD (8)
+ #define MAX_RX_FIFO_SIZE (20 * 1024)
+@@ -1410,17 +1409,14 @@ static int smsc75xx_bind(struct usbnet *
+
+ INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
+
+- if (DEFAULT_TX_CSUM_ENABLE) {
++ if (DEFAULT_TX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
+- if (DEFAULT_TSO_ENABLE)
+- dev->net->features |= NETIF_F_SG |
+- NETIF_F_TSO | NETIF_F_TSO6;
+- }
++
+ if (DEFAULT_RX_CSUM_ENABLE)
+ dev->net->features |= NETIF_F_RXCSUM;
+
+ dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
+- NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
++ NETIF_F_RXCSUM;
+
+ ret = smsc75xx_wait_ready(dev, 0);
+ if (ret < 0) {
+@@ -2200,8 +2196,6 @@ static struct sk_buff *smsc75xx_tx_fixup
+ {
+ u32 tx_cmd_a, tx_cmd_b;
+
+- skb_linearize(skb);
+-
+ if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
+ struct sk_buff *skb2 =
+ skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
projects / thirdparty / kernel / stable-queue.git / commitdiff
