17 files changed, 152 insertions, 61 deletions

diff --git a/arch/arm/mach-mxs/mach-mxs.c b/arch/arm/mach-mxs/mach-mxs.c
index 8dabfe81d07c..ff886e01a0b0 100644
--- a/arch/arm/mach-mxs/mach-mxs.c
+++ b/arch/arm/mach-mxs/mach-mxs.c
@@ -261,7 +261,7 @@ static void __init apx4devkit_init(void)
         enable_clk_enet_out();
 
         if (IS_BUILTIN(CONFIG_PHYLIB))
-                phy_register_fixup_for_uid(PHY_ID_KS8051, MICREL_PHY_ID_MASK,
+                phy_register_fixup_for_uid(PHY_ID_KSZ8051, MICREL_PHY_ID_MASK,
                                            apx4devkit_phy_fixup);
 
         mxsfb_pdata.mode_list = apx4devkit_video_modes;
diff --git a/drivers/net/phy/bcm87xx.c b/drivers/net/phy/bcm87xx.c
index 2346b38b9837..799789518e87 100644
--- a/drivers/net/phy/bcm87xx.c
+++ b/drivers/net/phy/bcm87xx.c
@@ -229,3 +229,5 @@ static void __exit bcm87xx_exit(void)
                 ARRAY_SIZE(bcm87xx_driver));
 }
 module_exit(bcm87xx_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/net/phy/micrel.c b/drivers/net/phy/micrel.c
index cf287e0eb408..2165d5fdb8c0 100644
--- a/drivers/net/phy/micrel.c
+++ b/drivers/net/phy/micrel.c
@@ -21,6 +21,12 @@
 #include <linux/phy.h>
 #include <linux/micrel_phy.h>
 
+/* Operation Mode Strap Override */
+#define MII_KSZPHY_OMSO                         0x16
+#define KSZPHY_OMSO_B_CAST_OFF                  (1 << 9)
+#define KSZPHY_OMSO_RMII_OVERRIDE               (1 << 1)
+#define KSZPHY_OMSO_MII_OVERRIDE                (1 << 0)
+
 /* general Interrupt control/status reg in vendor specific block. */
 #define MII_KSZPHY_INTCS                        0x1B
 #define KSZPHY_INTCS_JABBER                     (1 << 15)
@@ -101,6 +107,13 @@ static int kszphy_config_init(struct phy_device *phydev)
         return 0;
 }
 
+static int ksz8021_config_init(struct phy_device *phydev)
+{
+        const u16 val = KSZPHY_OMSO_B_CAST_OFF | KSZPHY_OMSO_RMII_OVERRIDE;
+        phy_write(phydev, MII_KSZPHY_OMSO, val);
+        return 0;
+}
+
 static int ks8051_config_init(struct phy_device *phydev)
 {
         int regval;
@@ -128,9 +141,22 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = ks8737_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8041,
+        .phy_id         = PHY_ID_KSZ8021,
+        .phy_id_mask    = 0x00ffffff,
+        .name           = "Micrel KSZ8021",
+        .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause |
+                           SUPPORTED_Asym_Pause),
+        .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
+        .config_init    = ksz8021_config_init,
+        .config_aneg    = genphy_config_aneg,
+        .read_status    = genphy_read_status,
+        .ack_interrupt  = kszphy_ack_interrupt,
+        .config_intr    = kszphy_config_intr,
+        .driver         = { .owner = THIS_MODULE,},
+}, {
+        .phy_id         = PHY_ID_KSZ8041,
         .phy_id_mask    = 0x00fffff0,
-        .name           = "Micrel KS8041",
+        .name           = "Micrel KSZ8041",
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
                                 | SUPPORTED_Asym_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -141,9 +167,9 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = kszphy_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8051,
+        .phy_id         = PHY_ID_KSZ8051,
         .phy_id_mask    = 0x00fffff0,
-        .name           = "Micrel KS8051",
+        .name           = "Micrel KSZ8051",
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause
                                 | SUPPORTED_Asym_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -154,8 +180,8 @@ static struct phy_driver ksphy_driver[] = {
         .config_intr    = kszphy_config_intr,
         .driver         = { .owner = THIS_MODULE,},
 }, {
-        .phy_id         = PHY_ID_KS8001,
-        .name           = "Micrel KS8001 or KS8721",
+        .phy_id         = PHY_ID_KSZ8001,
+        .name           = "Micrel KSZ8001 or KS8721",
         .phy_id_mask    = 0x00ffffff,
         .features       = (PHY_BASIC_FEATURES | SUPPORTED_Pause),
         .flags          = PHY_HAS_MAGICANEG | PHY_HAS_INTERRUPT,
@@ -201,10 +227,11 @@ MODULE_LICENSE("GPL");
 
 static struct mdio_device_id __maybe_unused micrel_tbl[] = {
         { PHY_ID_KSZ9021, 0x000ffffe },
-        { PHY_ID_KS8001, 0x00ffffff },
+        { PHY_ID_KSZ8001, 0x00ffffff },
         { PHY_ID_KS8737, 0x00fffff0 },
-        { PHY_ID_KS8041, 0x00fffff0 },
-        { PHY_ID_KS8051, 0x00fffff0 },
+        { PHY_ID_KSZ8021, 0x00ffffff },
+        { PHY_ID_KSZ8041, 0x00fffff0 },
+        { PHY_ID_KSZ8051, 0x00fffff0 },
         { }
 };
 
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index cbf7047decc0..20f31d0d1536 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -570,7 +570,7 @@ static int pppoe_release(struct socket *sock)
 
         po = pppox_sk(sk);
 
-        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND)) {
+        if (sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
                 dev_put(po->pppoe_dev);
                 po->pppoe_dev = NULL;
         }
diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
index 341b65dbbcd3..3ffe8a6e3c8b 100644
--- a/drivers/net/team/team.c
+++ b/drivers/net/team/team.c
@@ -848,7 +848,7 @@ static struct netpoll_info *team_netpoll_info(struct team *team)
 }
 #endif
 
-static void __team_port_change_check(struct team_port *port, bool linkup);
+static void __team_port_change_port_added(struct team_port *port, bool linkup);
 
 static int team_port_add(struct team *team, struct net_device *port_dev)
 {
@@ -948,7 +948,7 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
         team_port_enable(team, port);
         list_add_tail_rcu(&port->list, &team->port_list);
         __team_compute_features(team);
-        __team_port_change_check(port, !!netif_carrier_ok(port_dev));
+        __team_port_change_port_added(port, !!netif_carrier_ok(port_dev));
         __team_options_change_check(team);
 
         netdev_info(dev, "Port device %s added\n", portname);
@@ -983,6 +983,8 @@ err_set_mtu:
         return err;
 }
 
+static void __team_port_change_port_removed(struct team_port *port);
+
 static int team_port_del(struct team *team, struct net_device *port_dev)
 {
         struct net_device *dev = team->dev;
@@ -999,8 +1001,7 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
         __team_option_inst_mark_removed_port(team, port);
         __team_options_change_check(team);
         __team_option_inst_del_port(team, port);
-        port->removed = true;
-        __team_port_change_check(port, false);
+        __team_port_change_port_removed(port);
         team_port_disable(team, port);
         list_del_rcu(&port->list);
         netdev_rx_handler_unregister(port_dev);
@@ -2251,13 +2252,11 @@ static void __team_options_change_check(struct team *team)
 }
 
 /* rtnl lock is held */
-static void __team_port_change_check(struct team_port *port, bool linkup)
+
+static void __team_port_change_send(struct team_port *port, bool linkup)
 {
         int err;
 
-        if (!port->removed && port->state.linkup == linkup)
-                return;
-
         port->changed = true;
         port->state.linkup = linkup;
         team_refresh_port_linkup(port);
@@ -2282,6 +2281,23 @@ send_event:
 
 }
 
+static void __team_port_change_check(struct team_port *port, bool linkup)
+{
+        if (port->state.linkup != linkup)
+                __team_port_change_send(port, linkup);
+}
+
+static void __team_port_change_port_added(struct team_port *port, bool linkup)
+{
+        __team_port_change_send(port, linkup);
+}
+
+static void __team_port_change_port_removed(struct team_port *port)
+{
+        port->removed = true;
+        __team_port_change_send(port, false);
+}
+
 static void team_port_change_check(struct team_port *port, bool linkup)
 {
         struct team *team = port->team;
diff --git a/drivers/net/wireless/iwlwifi/pcie/trans.c b/drivers/net/wireless/iwlwifi/pcie/trans.c
index 1e86ea2266d4..dbeebef562d5 100644
--- a/drivers/net/wireless/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/iwlwifi/pcie/trans.c
@@ -1442,6 +1442,7 @@ static int iwl_trans_pcie_start_hw(struct iwl_trans *trans)
         return err;
 
 err_free_irq:
+        trans_pcie->irq_requested = false;
         free_irq(trans_pcie->irq, trans);
 error:
         iwl_free_isr_ict(trans);
diff --git a/include/linux/micrel_phy.h b/include/linux/micrel_phy.h
index 61f0905bdc48..de201203bc7c 100644
--- a/include/linux/micrel_phy.h
+++ b/include/linux/micrel_phy.h
@@ -1,3 +1,15 @@
+/*
+ * include/linux/micrel_phy.h
+ *
+ * Micrel PHY IDs
+ *
+ * This program is free software; you can redistribute  it and/or modify it
+ * under  the terms of  the GNU General  Public License as published by the
+ * Free Software Foundation;  either version 2 of the  License, or (at your
+ * option) any later version.
+ *
+ */
+
 #ifndef _MICREL_PHY_H
 #define _MICREL_PHY_H
 
@@ -5,10 +17,11 @@
 
 #define PHY_ID_KSZ9021          0x00221610
 #define PHY_ID_KS8737           0x00221720
-#define PHY_ID_KS8041           0x00221510
-#define PHY_ID_KS8051           0x00221550
+#define PHY_ID_KSZ8021          0x00221555
+#define PHY_ID_KSZ8041          0x00221510
+#define PHY_ID_KSZ8051          0x00221550
 /* both for ks8001 Rev. A/B, and for ks8721 Rev 3. */
-#define PHY_ID_KS8001           0x0022161A
+#define PHY_ID_KSZ8001          0x0022161A
 
 /* struct phy_device dev_flags definitions */
 #define MICREL_PHY_50MHZ_CLK    0x00000001
diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
index e877af8bdd1e..469daabd90c7 100644
--- a/net/batman-adv/bat_iv_ogm.c
+++ b/net/batman-adv/bat_iv_ogm.c
@@ -642,7 +642,8 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         struct batadv_neigh_node *router = NULL;
         struct batadv_orig_node *orig_node_tmp;
         struct hlist_node *node;
-        uint8_t bcast_own_sum_orig, bcast_own_sum_neigh;
+        int if_num;
+        uint8_t sum_orig, sum_neigh;
         uint8_t *neigh_addr;
 
         batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
@@ -727,17 +728,17 @@ batadv_iv_ogm_orig_update(struct batadv_priv *bat_priv,
         if (router && (neigh_node->tq_avg == router->tq_avg)) {
                 orig_node_tmp = router->orig_node;
                 spin_lock_bh(&orig_node_tmp->ogm_cnt_lock);
-                bcast_own_sum_orig =
-                        orig_node_tmp->bcast_own_sum[if_incoming->if_num];
+                if_num = router->if_incoming->if_num;
+                sum_orig = orig_node_tmp->bcast_own_sum[if_num];
                 spin_unlock_bh(&orig_node_tmp->ogm_cnt_lock);
 
                 orig_node_tmp = neigh_node->orig_node;
                 spin_lock_bh(&orig_node_tmp->ogm_cnt_lock);
-                bcast_own_sum_neigh =
-                        orig_node_tmp->bcast_own_sum[if_incoming->if_num];
+                if_num = neigh_node->if_incoming->if_num;
+                sum_neigh = orig_node_tmp->bcast_own_sum[if_num];
                 spin_unlock_bh(&orig_node_tmp->ogm_cnt_lock);
 
-                if (bcast_own_sum_orig >= bcast_own_sum_neigh)
+                if (sum_orig >= sum_neigh)
                         goto update_tt;
         }
 
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 109ea2aae96c..21c53577c8d6 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -100,18 +100,21 @@ static int batadv_interface_set_mac_addr(struct net_device *dev, void *p)
 {
         struct batadv_priv *bat_priv = netdev_priv(dev);
         struct sockaddr *addr = p;
+        uint8_t old_addr[ETH_ALEN];
 
         if (!is_valid_ether_addr(addr->sa_data))
                 return -EADDRNOTAVAIL;
 
+        memcpy(old_addr, dev->dev_addr, ETH_ALEN);
+        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
+
         /* only modify transtable if it has been initialized before */
         if (atomic_read(&bat_priv->mesh_state) == BATADV_MESH_ACTIVE) {
-                batadv_tt_local_remove(bat_priv, dev->dev_addr,
+                batadv_tt_local_remove(bat_priv, old_addr,
                                        "mac address changed", false);
                 batadv_tt_local_add(dev, addr->sa_data, BATADV_NULL_IFINDEX);
         }
 
-        memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
         dev->addr_assign_type &= ~NET_ADDR_RANDOM;
         return 0;
 }
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index d4de5db18d5a..0b997c8f9655 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -734,6 +734,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
 
         cancel_work_sync(&hdev->le_scan);
 
+        cancel_delayed_work(&hdev->power_off);
+
         hci_req_cancel(hdev, ENODEV);
         hci_req_lock(hdev);
 
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 4ea1710a4783..38c00f142203 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1008,7 +1008,7 @@ static void l2cap_send_disconn_req(struct l2cap_conn *conn, struct l2cap_chan *c
         if (!conn)
                 return;
 
-        if (chan->mode == L2CAP_MODE_ERTM) {
+        if (chan->mode == L2CAP_MODE_ERTM && chan->state == BT_CONNECTED) {
                 __clear_retrans_timer(chan);
                 __clear_monitor_timer(chan);
                 __clear_ack_timer(chan);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index ad6613d17ca6..eba022de3c20 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2875,6 +2875,22 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
                 if (scan)
                         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 
+                if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
+                        u8 ssp = 1;
+
+                        hci_send_cmd(hdev, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
+                }
+
+                if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
+                        struct hci_cp_write_le_host_supported cp;
+
+                        cp.le = 1;
+                        cp.simul = !!(hdev->features[6] & LMP_SIMUL_LE_BR);
+
+                        hci_send_cmd(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
+                                     sizeof(cp), &cp);
+                }
+
                 update_class(hdev);
                 update_name(hdev, hdev->dev_name);
                 update_eir(hdev);
diff --git a/net/core/sock.c b/net/core/sock.c
index 305792076121..a6000fbad294 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -691,7 +691,8 @@ set_rcvbuf:
 
         case SO_KEEPALIVE:
 #ifdef CONFIG_INET
-                if (sk->sk_protocol == IPPROTO_TCP)
+                if (sk->sk_protocol == IPPROTO_TCP &&
+                    sk->sk_type == SOCK_STREAM)
                         tcp_set_keepalive(sk, valbool);
 #endif
                 sock_valbool_flag(sk, SOCK_KEEPOPEN, valbool);
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index ff0f071969ea..d23c6571ba1c 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -131,18 +131,20 @@ found:
  *      0 - deliver
  *      1 - block
  */
-static __inline__ int icmp_filter(struct sock *sk, struct sk_buff *skb)
+static int icmp_filter(const struct sock *sk, const struct sk_buff *skb)
 {
-        int type;
+        struct icmphdr _hdr;
+        const struct icmphdr *hdr;
 
-        if (!pskb_may_pull(skb, sizeof(struct icmphdr)))
+        hdr = skb_header_pointer(skb, skb_transport_offset(skb),
+                                 sizeof(_hdr), &_hdr);
+        if (!hdr)
                 return 1;
 
-        type = icmp_hdr(skb)->type;
-        if (type < 32) {
+        if (hdr->type < 32) {
                 __u32 data = raw_sk(sk)->filter.data;
 
-                return ((1 << type) & data) != 0;
+                return ((1U << hdr->type) & data) != 0;
         }
 
         /* Do not block unknown ICMP types */
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 5b087c31d87b..0f9bdc5ee9f3 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -86,28 +86,30 @@ static int mip6_mh_len(int type)
 
 static int mip6_mh_filter(struct sock *sk, struct sk_buff *skb)
 {
-        struct ip6_mh *mh;
+        struct ip6_mh _hdr;
+        const struct ip6_mh *mh;
 
-        if (!pskb_may_pull(skb, (skb_transport_offset(skb)) + 8) ||
-            !pskb_may_pull(skb, (skb_transport_offset(skb) +
-                                 ((skb_transport_header(skb)[1] + 1) << 3))))
+        mh = skb_header_pointer(skb, skb_transport_offset(skb),
+                                sizeof(_hdr), &_hdr);
+        if (!mh)
                 return -1;
 
-        mh = (struct ip6_mh *)skb_transport_header(skb);
+        if (((mh->ip6mh_hdrlen + 1) << 3) > skb->len)
+                return -1;
 
         if (mh->ip6mh_hdrlen < mip6_mh_len(mh->ip6mh_type)) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH message too short: %d vs >=%d\n",
                                mh->ip6mh_hdrlen, mip6_mh_len(mh->ip6mh_type));
-                mip6_param_prob(skb, 0, ((&mh->ip6mh_hdrlen) -
-                                         skb_network_header(skb)));
+                mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_hdrlen) +
+                                skb_network_header_len(skb));
                 return -1;
         }
 
         if (mh->ip6mh_proto != IPPROTO_NONE) {
                 LIMIT_NETDEBUG(KERN_DEBUG "mip6: MH invalid payload proto = %d\n",
                                mh->ip6mh_proto);
-                mip6_param_prob(skb, 0, ((&mh->ip6mh_proto) -
-                                         skb_network_header(skb)));
+                mip6_param_prob(skb, 0, offsetof(struct ip6_mh, ip6mh_proto) +
+                                skb_network_header_len(skb));
                 return -1;
         }
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ef0579d5bca6..4a5f78b50495 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -107,21 +107,20 @@ found:
  *      0 - deliver
  *      1 - block
  */
-static __inline__ int icmpv6_filter(struct sock *sk, struct sk_buff *skb)
+static int icmpv6_filter(const struct sock *sk, const struct sk_buff *skb)
 {
-        struct icmp6hdr *icmph;
-        struct raw6_sock *rp = raw6_sk(sk);
-
-        if (pskb_may_pull(skb, sizeof(struct icmp6hdr))) {
-                __u32 *data = &rp->filter.data[0];
-                int bit_nr;
+        struct icmp6hdr *_hdr;
+        const struct icmp6hdr *hdr;
 
-                icmph = (struct icmp6hdr *) skb->data;
-                bit_nr = icmph->icmp6_type;
+        hdr = skb_header_pointer(skb, skb_transport_offset(skb),
+                                 sizeof(_hdr), &_hdr);
+        if (hdr) {
+                const __u32 *data = &raw6_sk(sk)->filter.data[0];
+                unsigned int type = hdr->icmp6_type;
 
-                return (data[bit_nr >> 5] & (1 << (bit_nr & 31))) != 0;
+                return (data[type >> 5] & (1U << (type & 31))) != 0;
         }
-        return 0;
+        return 1;
 }
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 2ded3c7fad06..72d170ca3406 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -350,6 +350,9 @@ static void reg_regdb_search(struct work_struct *work)
         struct reg_regdb_search_request *request;
         const struct ieee80211_regdomain *curdom, *regdom;
         int i, r;
+        bool set_reg = false;
+
+        mutex_lock(&cfg80211_mutex);
 
         mutex_lock(&reg_regdb_search_mutex);
         while (!list_empty(&reg_regdb_search_list)) {
@@ -365,9 +368,7 @@ static void reg_regdb_search(struct work_struct *work)
                                 r = reg_copy_regd(&regdom, curdom);
                                 if (r)
                                         break;
-                                mutex_lock(&cfg80211_mutex);
-                                set_regdom(regdom);
-                                mutex_unlock(&cfg80211_mutex);
+                                set_reg = true;
                                 break;
                         }
                 }
@@ -375,6 +376,11 @@ static void reg_regdb_search(struct work_struct *work)
                 kfree(request);
         }
         mutex_unlock(&reg_regdb_search_mutex);
+
+        if (set_reg)
+                set_regdom(regdom);
+
+        mutex_unlock(&cfg80211_mutex);
 }
 
 static DECLARE_WORK(reg_regdb_work, reg_regdb_search);