Merge branches 'pm-devfreq' and 'pm-cpufreq'

* pm-devfreq:
  PM / devfreq: fix double kfree
  PM / devfreq: Fix governor_store()

* pm-cpufreq:
  cpufreq: prevent lockup on reading scaling_available_frequencies
  cpufreq: acpi_cpufreq: prevent crash on reading freqdomain_cpus

15 files changed, 78 insertions, 77 deletions

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 805a95a48107..830f8a7c1cb1 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -31,7 +31,6 @@
 static const char fmt_hex[] = "%#x\n";
 static const char fmt_long_hex[] = "%#lx\n";
 static const char fmt_dec[] = "%d\n";
-static const char fmt_udec[] = "%u\n";
 static const char fmt_ulong[] = "%lu\n";
 static const char fmt_u64[] = "%llu\n";
 
@@ -202,7 +201,7 @@ static ssize_t speed_show(struct device *dev,
         if (netif_running(netdev)) {
                 struct ethtool_cmd cmd;
                 if (!__ethtool_get_settings(netdev, &cmd))
-                        ret = sprintf(buf, fmt_udec, ethtool_cmd_speed(&cmd));
+                        ret = sprintf(buf, fmt_dec, ethtool_cmd_speed(&cmd));
         }
         rtnl_unlock();
         return ret;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index dad4dd37e2aa..fab4599ba8b2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2958,11 +2958,12 @@ EXPORT_SYMBOL_GPL(skb_append_pagefrags);
  */
 unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len)
 {
+        unsigned char *data = skb->data;
+
         BUG_ON(len > skb->len);
-        skb->len -= len;
-        BUG_ON(skb->len < skb->data_len);
-        skb_postpull_rcsum(skb, skb->data, len);
-        return skb->data += len;
+        __skb_pull(skb, len);
+        skb_postpull_rcsum(skb, data, len);
+        return skb->data;
 }
 EXPORT_SYMBOL_GPL(skb_pull_rcsum);
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index cce97385f743..7d91f4612ac0 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -458,12 +458,17 @@ static int dsa_slave_stp_update(struct net_device *dev, u8 state)
 static int dsa_slave_port_attr_set(struct net_device *dev,
                                    struct switchdev_attr *attr)
 {
-        int ret = 0;
+        struct dsa_slave_priv *p = netdev_priv(dev);
+        struct dsa_switch *ds = p->parent;
+        int ret;
 
         switch (attr->id) {
         case SWITCHDEV_ATTR_PORT_STP_STATE:
-                if (attr->trans == SWITCHDEV_TRANS_COMMIT)
-                        ret = dsa_slave_stp_update(dev, attr->u.stp_state);
+                if (attr->trans == SWITCHDEV_TRANS_PREPARE)
+                        ret = ds->drv->port_stp_update ? 0 : -EOPNOTSUPP;
+                else
+                        ret = ds->drv->port_stp_update(ds, p->port,
+                                                       attr->u.stp_state);
                 break;
         default:
                 ret = -EOPNOTSUPP;
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 6fcbd215cdbc..690bcbc59f26 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -340,6 +340,7 @@ static int __fib_validate_source(struct sk_buff *skb, __be32 src, __be32 dst,
         fl4.flowi4_tos = tos;
         fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
         fl4.flowi4_tun_key.tun_id = 0;
+        fl4.flowi4_flags = 0;
 
         no_addr = idev->ifa_list == NULL;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index c6ad99ad0ffb..c81deb85acb4 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1737,6 +1737,7 @@ static int ip_route_input_slow(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         fl4.flowi4_mark = skb->mark;
         fl4.flowi4_tos = tos;
         fl4.flowi4_scope = RT_SCOPE_UNIVERSE;
+        fl4.flowi4_flags = 0;
         fl4.daddr = daddr;
         fl4.saddr = saddr;
         err = fib_lookup(net, &fl4, &res, 0);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f204089e854c..cb32ce250db0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1193,7 +1193,8 @@ struct dst_entry *ip6_route_output(struct net *net, const struct sock *sk,
 
         fl6->flowi6_iif = LOOPBACK_IFINDEX;
 
-        if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr))
+        if ((sk && sk->sk_bound_dev_if) || rt6_need_strict(&fl6->daddr) ||
+            fl6->flowi6_oif)
                 flags |= RT6_LOOKUP_F_IFACE;
 
         if (!ipv6_addr_any(&fl6->saddr))
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index f6b090df3930..afca2eb4dfa7 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct work_struct *work)
         tunnel = container_of(work, struct l2tp_tunnel, del_work);
         sk = l2tp_tunnel_sock_lookup(tunnel);
         if (!sk)
-                return;
+                goto out;
 
         sock = sk->sk_socket;
 
@@ -1341,6 +1341,8 @@ static void l2tp_tunnel_del_work(struct work_struct *work)
         }
 
         l2tp_tunnel_sock_put(sk);
+out:
+        l2tp_tunnel_dec_refcount(tunnel);
 }
 
 /* Create a socket for the tunnel, if one isn't set up by
@@ -1636,8 +1638,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
  */
 int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
 {
+        l2tp_tunnel_inc_refcount(tunnel);
         l2tp_tunnel_closeall(tunnel);
-        return (false == queue_work(l2tp_wq, &tunnel->del_work));
+        if (false == queue_work(l2tp_wq, &tunnel->del_work)) {
+                l2tp_tunnel_dec_refcount(tunnel);
+                return 1;
+        }
+        return 0;
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
 
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 197c3f59ecbf..b00f1f9611d6 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1208,20 +1208,22 @@ void sctp_assoc_update(struct sctp_association *asoc,
  *   within this document.
  *
  * Our basic strategy is to round-robin transports in priorities
- * according to sctp_state_prio_map[] e.g., if no such
+ * according to sctp_trans_score() e.g., if no such
  * transport with state SCTP_ACTIVE exists, round-robin through
  * SCTP_UNKNOWN, etc. You get the picture.
  */
-static const u8 sctp_trans_state_to_prio_map[] = {
-        [SCTP_ACTIVE]   = 3,    /* best case */
-        [SCTP_UNKNOWN]  = 2,
-        [SCTP_PF]       = 1,
-        [SCTP_INACTIVE] = 0,    /* worst case */
-};
-
 static u8 sctp_trans_score(const struct sctp_transport *trans)
 {
-        return sctp_trans_state_to_prio_map[trans->state];
+        switch (trans->state) {
+        case SCTP_ACTIVE:
+                return 3;       /* best case */
+        case SCTP_UNKNOWN:
+                return 2;
+        case SCTP_PF:
+                return 1;
+        default: /* case SCTP_INACTIVE */
+                return 0;       /* worst case */
+        }
 }
 
 static struct sctp_transport *sctp_trans_elect_tie(struct sctp_transport *trans1,
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 35df1266bf07..6098d4c42fa9 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -244,12 +244,13 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
         int error;
         struct sctp_transport *transport = (struct sctp_transport *) peer;
         struct sctp_association *asoc = transport->asoc;
-        struct net *net = sock_net(asoc->base.sk);
+        struct sock *sk = asoc->base.sk;
+        struct net *net = sock_net(sk);
 
         /* Check whether a task is in the sock.  */
 
-        bh_lock_sock(asoc->base.sk);
-        if (sock_owned_by_user(asoc->base.sk)) {
+        bh_lock_sock(sk);
+        if (sock_owned_by_user(sk)) {
                 pr_debug("%s: sock is busy\n", __func__);
 
                 /* Try again later.  */
@@ -272,10 +273,10 @@ void sctp_generate_t3_rtx_event(unsigned long peer)
                            transport, GFP_ATOMIC);
 
         if (error)
-                asoc->base.sk->sk_err = -error;
+                sk->sk_err = -error;
 
 out_unlock:
-        bh_unlock_sock(asoc->base.sk);
+        bh_unlock_sock(sk);
         sctp_transport_put(transport);
 }
 
@@ -285,11 +286,12 @@ out_unlock:
 static void sctp_generate_timeout_event(struct sctp_association *asoc,
                                         sctp_event_timeout_t timeout_type)
 {
-        struct net *net = sock_net(asoc->base.sk);
+        struct sock *sk = asoc->base.sk;
+        struct net *net = sock_net(sk);
         int error = 0;
 
-        bh_lock_sock(asoc->base.sk);
-        if (sock_owned_by_user(asoc->base.sk)) {
+        bh_lock_sock(sk);
+        if (sock_owned_by_user(sk)) {
                 pr_debug("%s: sock is busy: timer %d\n", __func__,
                          timeout_type);
 
@@ -312,10 +314,10 @@ static void sctp_generate_timeout_event(struct sctp_association *asoc,
                            (void *)timeout_type, GFP_ATOMIC);
 
         if (error)
-                asoc->base.sk->sk_err = -error;
+                sk->sk_err = -error;
 
 out_unlock:
-        bh_unlock_sock(asoc->base.sk);
+        bh_unlock_sock(sk);
         sctp_association_put(asoc);
 }
 
@@ -365,10 +367,11 @@ void sctp_generate_heartbeat_event(unsigned long data)
         int error = 0;
         struct sctp_transport *transport = (struct sctp_transport *) data;
         struct sctp_association *asoc = transport->asoc;
-        struct net *net = sock_net(asoc->base.sk);
+        struct sock *sk = asoc->base.sk;
+        struct net *net = sock_net(sk);
 
-        bh_lock_sock(asoc->base.sk);
-        if (sock_owned_by_user(asoc->base.sk)) {
+        bh_lock_sock(sk);
+        if (sock_owned_by_user(sk)) {
                 pr_debug("%s: sock is busy\n", __func__);
 
                 /* Try again later.  */
@@ -388,11 +391,11 @@ void sctp_generate_heartbeat_event(unsigned long data)
                            asoc->state, asoc->ep, asoc,
                            transport, GFP_ATOMIC);
 
-         if (error)
-                 asoc->base.sk->sk_err = -error;
+        if (error)
+                sk->sk_err = -error;
 
 out_unlock:
-        bh_unlock_sock(asoc->base.sk);
+        bh_unlock_sock(sk);
         sctp_transport_put(transport);
 }
 
@@ -403,10 +406,11 @@ void sctp_generate_proto_unreach_event(unsigned long data)
 {
         struct sctp_transport *transport = (struct sctp_transport *) data;
         struct sctp_association *asoc = transport->asoc;
-        struct net *net = sock_net(asoc->base.sk);
+        struct sock *sk = asoc->base.sk;
+        struct net *net = sock_net(sk);
 
-        bh_lock_sock(asoc->base.sk);
-        if (sock_owned_by_user(asoc->base.sk)) {
+        bh_lock_sock(sk);
+        if (sock_owned_by_user(sk)) {
                 pr_debug("%s: sock is busy\n", __func__);
 
                 /* Try again later.  */
@@ -427,7 +431,7 @@ void sctp_generate_proto_unreach_event(unsigned long data)
                    asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
 
 out_unlock:
-        bh_unlock_sock(asoc->base.sk);
+        bh_unlock_sock(sk);
         sctp_association_put(asoc);
 }
 
diff --git a/net/sunrpc/xprtrdma/fmr_ops.c b/net/sunrpc/xprtrdma/fmr_ops.c
index cb25c89da623..f1e8dafbd507 100644
--- a/net/sunrpc/xprtrdma/fmr_ops.c
+++ b/net/sunrpc/xprtrdma/fmr_ops.c
@@ -39,25 +39,6 @@ static int
 fmr_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
             struct rpcrdma_create_data_internal *cdata)
 {
-        struct ib_device_attr *devattr = &ia->ri_devattr;
-        struct ib_mr *mr;
-
-        /* Obtain an lkey to use for the regbufs, which are
-         * protected from remote access.
-         */
-        if (devattr->device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY) {
-                ia->ri_dma_lkey = ia->ri_device->local_dma_lkey;
-        } else {
-                mr = ib_get_dma_mr(ia->ri_pd, IB_ACCESS_LOCAL_WRITE);
-                if (IS_ERR(mr)) {
-                        pr_err("%s: ib_get_dma_mr for failed with %lX\n",
-                               __func__, PTR_ERR(mr));
-                        return -ENOMEM;
-                }
-                ia->ri_dma_lkey = ia->ri_dma_mr->lkey;
-                ia->ri_dma_mr = mr;
-        }
-
         return 0;
 }
 
diff --git a/net/sunrpc/xprtrdma/frwr_ops.c b/net/sunrpc/xprtrdma/frwr_ops.c
index d6653f5d0830..5318951b3b53 100644
--- a/net/sunrpc/xprtrdma/frwr_ops.c
+++ b/net/sunrpc/xprtrdma/frwr_ops.c
@@ -189,11 +189,6 @@ frwr_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
         struct ib_device_attr *devattr = &ia->ri_devattr;
         int depth, delta;
 
-        /* Obtain an lkey to use for the regbufs, which are
-         * protected from remote access.
-         */
-        ia->ri_dma_lkey = ia->ri_device->local_dma_lkey;
-
         ia->ri_max_frmr_depth =
                         min_t(unsigned int, RPCRDMA_MAX_DATA_SEGS,
                               devattr->max_fast_reg_page_list_len);
diff --git a/net/sunrpc/xprtrdma/physical_ops.c b/net/sunrpc/xprtrdma/physical_ops.c
index 72cf8b15bbb4..617b76f22154 100644
--- a/net/sunrpc/xprtrdma/physical_ops.c
+++ b/net/sunrpc/xprtrdma/physical_ops.c
@@ -23,7 +23,6 @@ static int
 physical_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
                  struct rpcrdma_create_data_internal *cdata)
 {
-        struct ib_device_attr *devattr = &ia->ri_devattr;
         struct ib_mr *mr;
 
         /* Obtain an rkey to use for RPC data payloads.
@@ -37,15 +36,8 @@ physical_op_open(struct rpcrdma_ia *ia, struct rpcrdma_ep *ep,
                        __func__, PTR_ERR(mr));
                 return -ENOMEM;
         }
-        ia->ri_dma_mr = mr;
-
-        /* Obtain an lkey to use for regbufs.
-         */
-        if (devattr->device_cap_flags & IB_DEVICE_LOCAL_DMA_LKEY)
-                ia->ri_dma_lkey = ia->ri_device->local_dma_lkey;
-        else
-                ia->ri_dma_lkey = ia->ri_dma_mr->lkey;
 
+        ia->ri_dma_mr = mr;
         return 0;
 }
 
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 682996779970..eb081ad05e33 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -1252,7 +1252,7 @@ rpcrdma_alloc_regbuf(struct rpcrdma_ia *ia, size_t size, gfp_t flags)
                 goto out_free;
 
         iov->length = size;
-        iov->lkey = ia->ri_dma_lkey;
+        iov->lkey = ia->ri_pd->local_dma_lkey;
         rb->rg_size = size;
         rb->rg_owner = NULL;
         return rb;
diff --git a/net/sunrpc/xprtrdma/xprt_rdma.h b/net/sunrpc/xprtrdma/xprt_rdma.h
index 02512221b8bc..c09414e6f91b 100644
--- a/net/sunrpc/xprtrdma/xprt_rdma.h
+++ b/net/sunrpc/xprtrdma/xprt_rdma.h
@@ -65,7 +65,6 @@ struct rpcrdma_ia {
         struct rdma_cm_id       *ri_id;
         struct ib_pd            *ri_pd;
         struct ib_mr            *ri_dma_mr;
-        u32                     ri_dma_lkey;
         struct completion       ri_done;
         int                     ri_async_rc;
         unsigned int            ri_max_frmr_depth;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 03ee4d359f6a..ef31b40ad550 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2179,8 +2179,21 @@ unlock:
                         if (UNIXCB(skb).fp)
                                 scm.fp = scm_fp_dup(UNIXCB(skb).fp);
 
-                        sk_peek_offset_fwd(sk, chunk);
+                        if (skip) {
+                                sk_peek_offset_fwd(sk, chunk);
+                                skip -= chunk;
+                        }
 
+                        if (UNIXCB(skb).fp)
+                                break;
+
+                        last = skb;
+                        last_len = skb->len;
+                        unix_state_lock(sk);
+                        skb = skb_peek_next(skb, &sk->sk_receive_queue);
+                        if (skb)
+                                goto again;
+                        unix_state_unlock(sk);
                         break;
                 }
         } while (size);