commit 9db8a8bb98cf75b0a51d66f560c87028e93a8ed8 Author: Greg Kroah-Hartman Date: Wed Oct 15 12:29:30 2014 +0200 Linux 3.17.1 commit fd979860f7e04a9028f803b1a79099e05a60f579 Author: Frederic Weisbecker Date: Sat Aug 16 18:48:05 2014 +0200 arm64: Tell irq work about self IPI support commit 3631073659d0aafeaa52227bb61a100efaf901dc upstream. ARM64 irq work self-IPI support depends on __smp_cross_call to point to some relevant IRQ controller operations. This information should be available after the call to init_IRQ(). Lets implement arch_irq_work_has_interrupt() accordingly. Acked-by: Peter Zijlstra (Intel) Acked-by: Catalin Marinas Cc: Ingo Molnar Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: Will Deacon Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit 1063368632f52a61ceb20565501606a090335878 Author: George Spelvin Date: Tue Oct 7 07:26:38 2014 -0400 libata: Un-break ATA blacklist commit 1c40279960bcd7d52dbdf1d466b20d24b99176c8 upstream. lib/glob.c provides a new glob_match() function, with arguments in (pattern, string) order. It replaced a private function with arguments in (string, pattern) order, but I didn't swap the call site... The result was the entire ATA blacklist was effectively disabled. The lesson for today is "I f***ed up *how* badly *how* many months ago?", er, I mean "Nobody Tests RC Kernels On Legacy Hardware". This was not a subtle break, but it made it through an entire RC cycle unreported, presumably because all the people doing testing have full-featured hardware. (FWIW, the reason for the argument swap was because fnmatch() does it that way, and for a while implementing a full fnmatch() was being considered.) Fixes: 428ac5fc056e0 (libata: Use glob_match from lib/glob.c) Reported-by: Steven Honeyman Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=71371#c21 Signed-off-by: George Spelvin Tested-by: Steven Honeyman Signed-off-by: Tejun Heo Cc: Henrique de Moraes Holschuh Signed-off-by: Greg Kroah-Hartman commit 5ec101482849be488400b639730a013be2792ec7 Author: Bryan O'Donoghue Date: Tue Sep 23 01:21:11 2014 +0100 serial: 8250: Add Quark X1000 to 8250_pci.c commit 1ede7dcca3c4fa15a518ab0473126f9c3e621e4c upstream. Quark X1000 contains two designware derived 8250 serial ports. Each port has a unique PCI configuration space consisting of BAR0:UART BAR1:DMA respectively. Unlike the standard 8250 the register width is 32 bits for RHR,IER etc The Quark UART has a fundamental clock @ 44.2368 MHz allowing for a bitrate of up to about 2.76 megabits per second. This patch enables standard 8250 mode Signed-off-by: Bryan O'Donoghue Reviewed-by: Heikki Krogerus Signed-off-by: Greg Kroah-Hartman commit 243e25b5170afb2f720b68f5c6af0b979997a746 Author: Yasuaki Ishimatsu Date: Fri Oct 3 19:06:03 2014 +0900 driver/base/node: remove unnecessary kfree of node struct from unregister_one_node commit 33ead538f642a33b1d658782a5d14a40b5014d1f upstream. Commit 92d585ef067d ("numa: fix NULL pointer access and memory leak in unregister_one_node()") added kfree() of node struct in unregister_one_node(). But node struct is freed by node_device_release() which is called in unregister_node(). So by adding the kfree(), node struct is freed two times. While hot removing memory, the commit leads the following BUG_ON(): kernel BUG at mm/slub.c:3346! invalid opcode: 0000 [#1] SMP [...] Call Trace: [...] unregister_one_node [...] try_offline_node [...] remove_memory [...] acpi_memory_device_remove [...] acpi_bus_trim [...] acpi_bus_trim [...] acpi_device_hotplug [...] acpi_hotplug_work_fn [...] process_one_work [...] worker_thread [...] ? rescuer_thread [...] kthread [...] ? kthread_create_on_node [...] ret_from_fork [...] ? kthread_create_on_node This patch removes unnecessary kfree() from unregister_one_node(). Signed-off-by: Yasuaki Ishimatsu Cc: Xishi Qiu Fixes: 92d585ef067d "numa: fix NULL pointer access and memory leak in unregister_one_node()" Signed-off-by: Andrew Morton Signed-off-by: Greg Kroah-Hartman commit 26ad374b2e70043b1b5951599d0dffc41b94e8e1 Author: Cristian Stoica Date: Thu Aug 14 13:51:57 2014 +0300 crypto: caam - fix addressing of struct member commit 4451d494b1910bf7b7f8381a637d0fe6d2142467 upstream. buf_0 and buf_1 in caam_hash_state are not next to each other. Accessing buf_1 is incorrect from &buf_0 with an offset of only size_of(buf_0). The same issue is also with buflen_0 and buflen_1 Signed-off-by: Cristian Stoica Signed-off-by: Herbert Xu Signed-off-by: Greg Kroah-Hartman commit 3cd99033c7ffd72c18a29ae4abefb80bfa89c3a4 Author: Lu Baolu Date: Fri Sep 19 10:13:50 2014 +0800 USB: Add device quirk for ASUS T100 Base Station keyboard commit ddbe1fca0bcb87ca8c199ea873a456ca8a948567 upstream. This full-speed USB device generates spurious remote wakeup event as soon as USB_DEVICE_REMOTE_WAKEUP feature is set. As the result, Linux can't enter system suspend and S0ix power saving modes once this keyboard is used. This patch tries to introduce USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk. With this quirk set, wakeup capability will be ignored during device configure. This patch could be back-ported to kernels as old as 2.6.39. Signed-off-by: Lu Baolu Acked-by: Alan Stern Signed-off-by: Greg Kroah-Hartman commit b2dd17bca11cdcc294c177435a834650be972139 Author: Felipe Balbi Date: Mon Sep 15 09:03:24 2014 -0500 usb: musb: dsps: kill OTG timer on suspend commit 468bcc2a2ca071f652009d2d20d97f2437630cae upstream. if we don't make sure to kill the timer, it could expire after we have already gated our clocks. That will trigger a Data Abort exception because we would try to access register while clock is gated. Fix that bug. Fixes 869c597 (usb: musb: dsps: add support for suspend and resume) Tested-by: Dave Gerlach Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 17ea14cd58b617339a754e1c61de06175f152941 Author: Andreas Bomholtz Date: Mon Sep 22 09:50:43 2014 +0200 USB: cp210x: add support for Seluxit USB dongle commit dee80ad12d2b1b304286a707fde7ab05d1fc7bab upstream. Added the Seluxit ApS USB Serial Dongle to cp210x driver. Signed-off-by: Andreas Bomholtz Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 4aaf2c94cbd1b2d73976709f8d037354a8838b29 Author: Joe Savage Date: Sat Sep 20 08:01:16 2014 -0500 USB: serial: cp210x: added Ketra N1 wireless interface support commit bfc2d7dfdd761ae3beccdb26abebe03cef042f46 upstream. Added support for Ketra N1 wireless interface, which uses the Silicon Labs' CP2104 USB to UART bridge with customized PID 8946. Signed-off-by: Joe Savage Signed-off-by: Johan Hovold Signed-off-by: Greg Kroah-Hartman commit 2d8b382aca6d7a158c27b4e0c2eb8896dee866b4 Author: Felipe Balbi Date: Thu Sep 18 09:31:32 2014 -0500 Revert "usb: gadget: composite: dequeue cdev->req before free it in composite_dev_cleanup" commit bf17eba7ae1e813b0ad67cb1078dcbd7083b906e upstream. This reverts commit f2267089ea17fa97b796b1b4247e3f8957655df3. That commit causes more problem than fixes. Firstly, kfree() should be called after usb_ep_dequeue() and secondly, the way things are, we will try to dequeue a request that has already completed much more frequently than one which is pending. Cc: Li Jun Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 6ed8a450f618ebca47b03c59c6975cfd76790542 Author: Dan Carpenter Date: Tue Sep 9 15:06:09 2014 +0300 usb: gadget: f_fs: signedness bug in __ffs_func_bind_do_descs() commit 85b06f5e53d17c15844ef3cd45d0c7107f0ae45c upstream. We need "idx" to be signed for the error handling to work. Fixes: 6d5c1c77bbf9 ('usb: gadget: f_fs: fix the redundant ep files problem') Acked-by: Michal Nazarewicz Signed-off-by: Dan Carpenter Signed-off-by: Felipe Balbi Signed-off-by: Greg Kroah-Hartman commit 3842f8ec4ac6df95afbbed484d7701f2caf6bf86 Author: Hans de Goede Date: Tue Sep 23 15:48:50 2014 +0200 uas: Add another ASM1051 usb-id to the uas blacklist commit 710f1bf16ab1b1558f099b62c5011c4cbba6a7bb upstream. As most ASM1051 based devices, this one has unfixable issues with uas too. Signed-off-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman commit de3af5fefe6f76102b21a5b596d11f245810d2c4 Author: Hans de Goede Date: Wed Sep 17 10:10:58 2014 +0200 uas: Add US_FL_NO_ATA_1X quirk for Seagate (0bc2:ab20) drives commit f9554a6b199360c2f888173fd600e1eb7ff165ef upstream. https://bbs.archlinux.org/viewtopic.php?pid=1457492 Signed-off-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman commit c0f5e44c171ed08de0929f83ff6f8faf912bb109 Author: Hans de Goede Date: Tue Sep 16 18:36:52 2014 +0200 uas: Add no-report-opcodes quirk commit 734016b00b50a3c6a0e1fc1b7b217e783f5123a1 upstream. Besides the ASM1051 (*) needing sdev->no_report_opcodes = 1, it turns out that the JMicron JMS567 also needs it to work properly with uas (usb-storage always sets it). Since some of the scsi devs were not to keen on the idea to outrightly set sdev->no_report_opcodes = 1 for all uas devices, so add a quirk for this, and set it for the JMS567. *) Which has become a non-issue since we've completely blacklisted uas on the ASM1051 for other reasons Reported-and-tested-by: Claudio Bizzarri Signed-off-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman commit c36cac9f20886a5a60d4f9388f6faef547d78d61 Author: Hans de Goede Date: Mon Sep 15 16:04:12 2014 +0200 uas: Add a quirk for rejecting ATA_12 and ATA_16 commands commit 593078525c8b234a35a36ff551b8716464e86481 upstream. And set this quirk for the Seagate Expansion Desk (0bc2:2312), as that one seems to hang upon receiving an ATA_12 or ATA_16 command. https://bugzilla.kernel.org/show_bug.cgi?id=79511 https://bbs.archlinux.org/viewtopic.php?id=183190 While at it also add missing documentation for the u value for usb-storage quirks. Signed-off-by: Hans de Goede Signed-off-by: Greg Kroah-Hartman commit 117ef0db3c7f8e218ebb3bd9dfbf3856a0320e4d Author: Yinghai Lu Date: Mon Sep 22 20:07:35 2014 -0600 PCI: pciehp: Fix wait time in timeout message commit d433889cd5a0933fbd90f1e65bff5a8d7963cc52 upstream. When we warned about a timeout on a hotplug command, we previously printed the time between calls to pcie_write_cmd(), without accounting for any time spent actually waiting. Consider this sequence: pcie_write_cmd write SLTCTL cmd_started = jiffies # T1 pcie_write_cmd pcie_wait_cmd now = jiffies # T2 wait_event_timeout # we may wait here if (timeout) ctrl_info("Timeout on command issued %u msec ago", jiffies_to_msecs(now - cmd_started)) We previously printed (T2 - T1), but that doesn't include the time spent in wait_event_timeout(). Fix this by using the current jiffies value, not the one cached before calling wait_event_timeout(). [bhelgaas: changelog, use current jiffies instead of adding timeout] Fixes: 40b960831cfa ("PCI: pciehp: Compute timeout from hotplug command start time") Signed-off-by: Yinghai Lu Signed-off-by: Bjorn Helgaas Signed-off-by: Greg Kroah-Hartman commit 6c3dfd886da9fd6529693fd0b2cd5f9fb8acd298 Author: Frederic Weisbecker Date: Sat Aug 16 18:47:53 2014 +0200 arm: Tell irq work about self IPI support commit 09f6edd424218eb69078551b2ecfada1f2d098eb upstream. ARM irq work IPI support depends on SMP support. That information is partly known at early boottime. Lets implement arch_irq_work_has_interrupt() accordingly. Acked-by: Peter Zijlstra (Intel) Cc: Ingo Molnar Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Russell King Cc: Thomas Gleixner Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit 1d3408209d43d2e72b5d8dbfb9b60fece399d75b Author: Frederic Weisbecker Date: Sat Aug 16 18:47:15 2014 +0200 x86: Tell irq work about self IPI support commit 3010279f0fc36f0388872203e63ca49912f648fd upstream. x86 supports irq work self-IPIs when local apic is available. This is partly known on runtime so lets implement arch_irq_work_has_interrupt() accordingly. This should be safely called after setup_arch(). Acked-by: Peter Zijlstra (Intel) Cc: Ingo Molnar Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit 6fd5de08a5337d0d601f6361671813df4f013da9 Author: Frederic Weisbecker Date: Sat Aug 16 18:37:19 2014 +0200 irq_work: Force raised irq work to run on irq work interrupt commit 76a33061b9323b7fdb220ae5fa116c10833ec22e upstream. The nohz full kick, which restarts the tick when any resource depend on it, can't be executed anywhere given the operation it does on timers. If it is called from the scheduler or timers code, chances are that we run into a deadlock. This is why we run the nohz full kick from an irq work. That way we make sure that the kick runs on a virgin context. However if that's the case when irq work runs in its own dedicated self-ipi, things are different for the big bunch of archs that don't support the self triggered way. In order to support them, irq works are also handled by the timer interrupt as fallback. Now when irq works run on the timer interrupt, the context isn't blank. More precisely, they can run in the context of the hrtimer that runs the tick. But the nohz kick cancels and restarts this hrtimer and cancelling an hrtimer from itself isn't allowed. This is why we run in an endless loop: Kernel panic - not syncing: Watchdog detected hard LOCKUP on cpu 2 CPU: 2 PID: 7538 Comm: kworker/u8:8 Not tainted 3.16.0+ #34 Workqueue: btrfs-endio-write normal_work_helper [btrfs] ffff880244c06c88 000000001b486fe1 ffff880244c06bf0 ffffffff8a7f1e37 ffffffff8ac52a18 ffff880244c06c78 ffffffff8a7ef928 0000000000000010 ffff880244c06c88 ffff880244c06c20 000000001b486fe1 0000000000000000 Call Trace: ] dump_stack+0x4e/0x7a [] panic+0xd4/0x207 [] watchdog_overflow_callback+0x118/0x120 [] __perf_event_overflow+0xae/0x350 [] ? perf_event_task_disable+0xa0/0xa0 [] ? x86_perf_event_set_period+0xbf/0x150 [] perf_event_overflow+0x14/0x20 [] intel_pmu_handle_irq+0x206/0x410 [] perf_event_nmi_handler+0x2b/0x50 [] nmi_handle+0xd2/0x390 [] ? nmi_handle+0x5/0x390 [] ? match_held_lock+0x8/0x1b0 [] default_do_nmi+0x72/0x1c0 [] do_nmi+0xb8/0x100 [] end_repeat_nmi+0x1e/0x2e [] ? match_held_lock+0x8/0x1b0 [] ? match_held_lock+0x8/0x1b0 [] ? match_held_lock+0x8/0x1b0 <] lock_acquired+0xaf/0x450 [] ? lock_hrtimer_base.isra.20+0x25/0x50 [] _raw_spin_lock_irqsave+0x78/0x90 [] ? lock_hrtimer_base.isra.20+0x25/0x50 [] lock_hrtimer_base.isra.20+0x25/0x50 [] hrtimer_try_to_cancel+0x33/0x1e0 [] hrtimer_cancel+0x1a/0x30 [] tick_nohz_restart+0x17/0x90 [] __tick_nohz_full_check+0xc3/0x100 [] nohz_full_kick_work_func+0xe/0x10 [] irq_work_run_list+0x44/0x70 [] irq_work_run+0x2a/0x50 [] update_process_times+0x5b/0x70 [] tick_sched_handle.isra.21+0x25/0x60 [] tick_sched_timer+0x41/0x60 [] __run_hrtimer+0x72/0x470 [] ? tick_sched_do_timer+0xb0/0xb0 [] hrtimer_interrupt+0x117/0x270 [] local_apic_timer_interrupt+0x37/0x60 [] smp_apic_timer_interrupt+0x3f/0x50 [] apic_timer_interrupt+0x6f/0x80 To fix this we force non-lazy irq works to run on irq work self-IPIs when available. That ability of the arch to trigger irq work self IPIs is available with arch_irq_work_has_interrupt(). Reported-by: Catalin Iacob Reported-by: Dave Jones Acked-by: Peter Zijlstra (Intel) Cc: Ingo Molnar Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit b677a767bcb3b9fbb4c7f921e5ba9577f1577049 Author: Peter Zijlstra Date: Sat Sep 6 15:43:02 2014 +0200 irq_work: Introduce arch_irq_work_has_interrupt() commit c5c38ef3d70377dc504a6a3f611a3ec814bc757b upstream. The nohz full code needs irq work to trigger its own interrupt so that the subsystem can work even when the tick is stopped. Lets introduce arch_irq_work_has_interrupt() that archs can override to tell about their support for this ability. Signed-off-by: Peter Zijlstra Cc: Ingo Molnar Cc: Paul E. McKenney Cc: Peter Zijlstra Cc: Thomas Gleixner Signed-off-by: Frederic Weisbecker Signed-off-by: Greg Kroah-Hartman commit 3bc0d3356f30096b610e027a70dcf3445f8c4a38 Author: WANG Cong Date: Mon Oct 6 17:21:54 2014 -0700 net_sched: copy exts->type in tcf_exts_change() [ Upstream commit 5301e3e117d88ef0967ce278912e54757f1a31a2 ] We need to copy exts->type when committing the change, otherwise it would be always 0. This is a quick fix for -net and -stable, for net-next tcf_exts will be removed. Fixes: commit 33be627159913b094bb578e83 ("net_sched: act: use standard struct list_head") Reported-by: Jamal Hadi Salim Cc: Jamal Hadi Salim Cc: John Fastabend Signed-off-by: Cong Wang Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit f823cda9b841d142930e3de51dfda6cd245a2f83 Author: Sylvain \\\"ythier\\\" Hitier Date: Tue Oct 7 13:40:34 2014 +0000 3c59x: fix bad split of cpu_to_le32(pci_map_single()) [ Upstream commit 88b09a6d958af6c458acf055ee2eb5bc9564efda ] In commit 6f2b6a3005b2c34c39f207a87667564f64f2f91a, # 3c59x: Add dma error checking and recovery the intent is to split out the mapping from the byte-swapping in order to insert a dma_mapping_error() check. Kinda this semantic patch: // See http://coccinelle.lip6.fr/ // // Beware, grouik-and-dirty! @@ expression DEV, X, Y, Z; @@ - cpu_to_le32(pci_map_single(DEV, X, Y, Z)) + dma_addr_t addr = pci_map_single(DEV, X, Y, Z); + if (dma_mapping_error(&DEV->dev, addr)) + /* snip */; + cpu_to_le32(addr) However, the #else part (of the #if DO_ZEROCOPY test) is changed this way: - cpu_to_le32(pci_map_single(DEV, X, Y, Z)) + dma_addr_t addr = cpu_to_le32(pci_map_single(DEV, X, Y, Z)); // ^^^^^^^^^^^ // That mismatches the 3 other changes! + if (dma_mapping_error(&DEV->dev, addr)) + /* snip */; + cpu_to_le32(addr) Let's remove the leftover cpu_to_le32() for coherency. v2: Better changelog. v3: Add Acked-by Fixes: 6f2b6a3005b2c34c39f207a87667564f64f2f91a # 3c59x: Add dma error checking and recovery Acked-by: Neil Horman Signed-off-by: Sylvain "ythier" Hitier Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 404db05025f2fb873b0569a99cf541519fec607f Author: Vlad Yasevich Date: Fri Oct 3 18:16:20 2014 -0400 sctp: handle association restarts when the socket is closed. [ Upstream commit bdf6fa52f01b941d4a80372d56de465bdbbd1d23 ] Currently association restarts do not take into consideration the state of the socket. When a restart happens, the current assocation simply transitions into established state. This creates a condition where a remote system, through a the restart procedure, may create a local association that is no way reachable by user. The conditions to trigger this are as follows: 1) Remote does not acknoledge some data causing data to remain outstanding. 2) Local application calls close() on the socket. Since data is still outstanding, the association is placed in SHUTDOWN_PENDING state. However, the socket is closed. 3) The remote tries to create a new association, triggering a restart on the local system. The association moves from SHUTDOWN_PENDING to ESTABLISHED. At this point, it is no longer reachable by any socket on the local system. This patch addresses the above situation by moving the newly ESTABLISHED association into SHUTDOWN-SENT state and bundling a SHUTDOWN after the COOKIE-ACK chunk. This way, the restarted associate immidiately enters the shutdown procedure and forces the termination of the unreachable association. Reported-by: David Laight Signed-off-by: Vlad Yasevich Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit ed54569e2b2be022e8e155e23fdca672690b6642 Author: KY Srinivasan Date: Sun Oct 5 10:42:51 2014 -0700 hyperv: Fix a bug in netvsc_send() [ Upstream commit 3a67c9ccad926a168d8b7891537a452018368a5b ] After the packet is successfully sent, we should not touch the packet as it may have been freed. This patch is based on the work done by Long Li . David, please queue this up for stable. Signed-off-by: K. Y. Srinivasan Reported-by: Sitsofe Wheeler Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit c96de3dca9d548b56d07e27500ba33a5462a7931 Author: Joe Lawrence Date: Fri Oct 3 09:58:34 2014 -0400 team: avoid race condition in scheduling delayed work [ Upstream commit 47549650abd13d873fd2e5fc218db19e21031074 ] When team_notify_peers and team_mcast_rejoin are called, they both reset their respective .count_pending atomic variable. Then when the actual worker function is executed, the variable is atomically decremented. This pattern introduces a potential race condition where the .count_pending rolls over and the worker function keeps rescheduling until .count_pending decrements to zero again: THREAD 1 THREAD 2 ======== ======== team_notify_peers(teamX) atomic_set count_pending = 1 schedule_delayed_work team_notify_peers(teamX) atomic_set count_pending = 1 team_notify_peers_work atomic_dec_and_test count_pending = 0 (return) schedule_delayed_work team_notify_peers_work atomic_dec_and_test count_pending = -1 schedule_delayed_work (repeat until count_pending = 0) Instead of assigning a new value to .count_pending, use atomic_add to tack-on the additional desired worker function invocations. Signed-off-by: Joe Lawrence Acked-by: Jiri Pirko Fixes: fc423ff00df3a19554414ee ("team: add peer notification") Fixes: 492b200efdd20b8fcfdac87 ("team: add support for sending multicast rejoins") Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit e0ff82758ea34358e50b1c954e1d1851d38489a6 Author: Florian Fainelli Date: Thu Oct 2 09:43:16 2014 -0700 net: systemport: fix bcm_sysport_insert_tsb() [ Upstream commit e87474a6e697857df21cff0707a2472abceca8b3 ] Similar to commit bc23333ba11fb7f959b7e87e121122f5a0fbbca8 ("net: bcmgenet: fix bcmgenet_put_tx_csum()"), we need to return the skb pointer in case we had to reallocate the SKB headroom. Fixes: 80105befdb4b8 ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver") Signed-off-by: Florian Fainelli Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman commit 570f480a5498a7d86d8ca0717f354bcb08c17fdb Author: Nicolas Dichtel Date: Thu Oct 2 18:26:49 2014 +0200 ip6_gre: fix flowi6_proto value in xmit path [ Upstream commit 3be07244b7337760a3269d56b2f4a63e72218648 ] In xmit path, we build a flowi6 which will be used for the output route lookup. We are sending a GRE packet, neither IPv4 nor IPv6 encapsulated packet, thus the protocol should be IPPROTO_GRE. Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Reported-by: Matthieu Ternisien d'Ouville Signed-off-by: Nicolas Dichtel Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman