Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "Lots of bug fixes here:

   1) Out of bounds access in __bpf_skc_lookup, from Lorenz Bauer.

   2) Fix rate reporting in cfg80211_calculate_bitrate_he(), from John
      Crispin.

   3) Use after free in psock backlog workqueue, from John Fastabend.

   4) Fix source port matching in fdb peer flow rule of mlx5, from Raed
      Salem.

   5) Use atomic_inc_not_zero() in fl6_sock_lookup(), from Eric Dumazet.

   6) Network header needs to be set for packet redirect in nfp, from
      John Hurley.

   7) Fix udp zerocopy refcnt, from Willem de Bruijn.

   8) Don't assume linear buffers in vxlan and geneve error handlers,
      from Stefano Brivio.

   9) Fix TOS matching in mlxsw, from Jiri Pirko.

  10) More SCTP cookie memory leak fixes, from Neil Horman.

  11) Fix VLAN filtering in rtl8366, from Linus Walluij.

  12) Various TCP SACK payload size and fragmentation memory limit fixes
      from Eric Dumazet.

  13) Use after free in pneigh_get_next(), also from Eric Dumazet.

  14) LAPB control block leak fix from Jeremy Sowden"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (145 commits)
  lapb: fixed leak of control-blocks.
  tipc: purge deferredq list for each grp member in tipc_group_delete
  ax25: fix inconsistent lock state in ax25_destroy_timer
  neigh: fix use-after-free read in pneigh_get_next
  tcp: fix compile error if !CONFIG_SYSCTL
  hv_sock: Suppress bogus "may be used uninitialized" warnings
  be2net: Fix number of Rx queues used for flow hashing
  net: handle 802.1P vlan 0 packets properly
  tcp: enforce tcp_min_snd_mss in tcp_mtu_probing()
  tcp: add tcp_min_snd_mss sysctl
  tcp: tcp_fragment() should apply sane memory limits
  tcp: limit payload size of sacked skbs
  Revert "net: phylink: set the autoneg state in phylink_phy_change"
  bpf: fix nested bpf tracepoints with per-cpu data
  bpf: Fix out of bounds memory access in bpf_sk_storage
  vsock/virtio: set SOCK_DONE on peer shutdown
  net: dsa: rtl8366: Fix up VLAN filtering
  net: phylink: set the autoneg state in phylink_phy_change
  net: add high_order_alloc_disable sysctl/static key
  tcp: add tcp_tx_skb_cache sysctl
  ...

1 files changed, 89 insertions, 14 deletions

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index d9a6699abe59..780c10ee359b 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -22,6 +22,7 @@
 #include <linux/usb/cdc.h>
 #include <linux/usb/usbnet.h>
 #include <linux/usb/cdc-wdm.h>
+#include <linux/u64_stats_sync.h>
 
 /* This driver supports wwan (3G/LTE/?) devices using a vendor
  * specific management protocol called Qualcomm MSM Interface (QMI) -
@@ -75,6 +76,7 @@ struct qmimux_hdr {
 struct qmimux_priv {
         struct net_device *real_dev;
         u8 mux_id;
+        struct pcpu_sw_netstats __percpu *stats64;
 };
 
 static int qmimux_open(struct net_device *dev)
@@ -101,19 +103,65 @@ static netdev_tx_t qmimux_start_xmit(struct sk_buff *skb, struct net_device *dev
         struct qmimux_priv *priv = netdev_priv(dev);
         unsigned int len = skb->len;
         struct qmimux_hdr *hdr;
+        netdev_tx_t ret;
 
         hdr = skb_push(skb, sizeof(struct qmimux_hdr));
         hdr->pad = 0;
         hdr->mux_id = priv->mux_id;
         hdr->pkt_len = cpu_to_be16(len);
         skb->dev = priv->real_dev;
-        return dev_queue_xmit(skb);
+        ret = dev_queue_xmit(skb);
+
+        if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
+                struct pcpu_sw_netstats *stats64 = this_cpu_ptr(priv->stats64);
+
+                u64_stats_update_begin(&stats64->syncp);
+                stats64->tx_packets++;
+                stats64->tx_bytes += len;
+                u64_stats_update_end(&stats64->syncp);
+        } else {
+                dev->stats.tx_dropped++;
+        }
+
+        return ret;
+}
+
+static void qmimux_get_stats64(struct net_device *net,
+                               struct rtnl_link_stats64 *stats)
+{
+        struct qmimux_priv *priv = netdev_priv(net);
+        unsigned int start;
+        int cpu;
+
+        netdev_stats_to_stats64(stats, &net->stats);
+
+        for_each_possible_cpu(cpu) {
+                struct pcpu_sw_netstats *stats64;
+                u64 rx_packets, rx_bytes;
+                u64 tx_packets, tx_bytes;
+
+                stats64 = per_cpu_ptr(priv->stats64, cpu);
+
+                do {
+                        start = u64_stats_fetch_begin_irq(&stats64->syncp);
+                        rx_packets = stats64->rx_packets;
+                        rx_bytes = stats64->rx_bytes;
+                        tx_packets = stats64->tx_packets;
+                        tx_bytes = stats64->tx_bytes;
+                } while (u64_stats_fetch_retry_irq(&stats64->syncp, start));
+
+                stats->rx_packets += rx_packets;
+                stats->rx_bytes += rx_bytes;
+                stats->tx_packets += tx_packets;
+                stats->tx_bytes += tx_bytes;
+        }
 }
 
 static const struct net_device_ops qmimux_netdev_ops = {
-        .ndo_open       = qmimux_open,
-        .ndo_stop       = qmimux_stop,
-        .ndo_start_xmit = qmimux_start_xmit,
+        .ndo_open        = qmimux_open,
+        .ndo_stop        = qmimux_stop,
+        .ndo_start_xmit  = qmimux_start_xmit,
+        .ndo_get_stats64 = qmimux_get_stats64,
 };
 
 static void qmimux_setup(struct net_device *dev)
@@ -153,7 +201,7 @@ static bool qmimux_has_slaves(struct usbnet *dev)
 
 static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
 {
-        unsigned int len, offset = 0;
+        unsigned int len, offset = 0, pad_len, pkt_len;
         struct qmimux_hdr *hdr;
         struct net_device *net;
         struct sk_buff *skbn;
@@ -171,10 +219,16 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                 if (hdr->pad & 0x80)
                         goto skip;
 
+                /* extract padding length and check for valid length info */
+                pad_len = hdr->pad & 0x3f;
+                if (len == 0 || pad_len >= len)
+                        goto skip;
+                pkt_len = len - pad_len;
+
                 net = qmimux_find_dev(dev, hdr->mux_id);
                 if (!net)
                         goto skip;
-                skbn = netdev_alloc_skb(net, len);
+                skbn = netdev_alloc_skb(net, pkt_len);
                 if (!skbn)
                         return 0;
                 skbn->dev = net;
@@ -191,9 +245,20 @@ static int qmimux_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
                         goto skip;
                 }
 
-                skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, len);
-                if (netif_rx(skbn) != NET_RX_SUCCESS)
+                skb_put_data(skbn, skb->data + offset + qmimux_hdr_sz, pkt_len);
+                if (netif_rx(skbn) != NET_RX_SUCCESS) {
+                        net->stats.rx_errors++;
                         return 0;
+                } else {
+                        struct pcpu_sw_netstats *stats64;
+                        struct qmimux_priv *priv = netdev_priv(net);
+
+                        stats64 = this_cpu_ptr(priv->stats64);
+                        u64_stats_update_begin(&stats64->syncp);
+                        stats64->rx_packets++;
+                        stats64->rx_bytes += pkt_len;
+                        u64_stats_update_end(&stats64->syncp);
+                }
 
 skip:
                 offset += len + qmimux_hdr_sz;
@@ -217,6 +282,12 @@ static int qmimux_register_device(struct net_device *real_dev, u8 mux_id)
         priv->mux_id = mux_id;
         priv->real_dev = real_dev;
 
+        priv->stats64 = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
+        if (!priv->stats64) {
+                err = -ENOBUFS;
+                goto out_free_newdev;
+        }
+
         err = register_netdevice(new_dev);
         if (err < 0)
                 goto out_free_newdev;
@@ -241,13 +312,15 @@ out_free_newdev:
         return err;
 }
 
-static void qmimux_unregister_device(struct net_device *dev)
+static void qmimux_unregister_device(struct net_device *dev,
+                                     struct list_head *head)
 {
         struct qmimux_priv *priv = netdev_priv(dev);
         struct net_device *real_dev = priv->real_dev;
 
+        free_percpu(priv->stats64);
         netdev_upper_dev_unlink(real_dev, dev);
-        unregister_netdevice(dev);
+        unregister_netdevice_queue(dev, head);
 
         /* Get rid of the reference to real_dev */
         dev_put(real_dev);
@@ -356,8 +429,8 @@ static ssize_t add_mux_store(struct device *d,  struct device_attribute *attr, c
         if (kstrtou8(buf, 0, &mux_id))
                 return -EINVAL;
 
-        /* mux_id [1 - 0x7f] range empirically found */
-        if (mux_id < 1 || mux_id > 0x7f)
+        /* mux_id [1 - 254] for compatibility with ip(8) and the rmnet driver */
+        if (mux_id < 1 || mux_id > 254)
                 return -EINVAL;
 
         if (!rtnl_trylock())
@@ -418,7 +491,7 @@ static ssize_t del_mux_store(struct device *d,  struct device_attribute *attr, c
                 ret = -EINVAL;
                 goto err;
         }
-        qmimux_unregister_device(del_dev);
+        qmimux_unregister_device(del_dev, NULL);
 
         if (!qmimux_has_slaves(dev))
                 info->flags &= ~QMI_WWAN_FLAG_MUX;
@@ -1428,6 +1501,7 @@ static void qmi_wwan_disconnect(struct usb_interface *intf)
         struct qmi_wwan_state *info;
         struct list_head *iter;
         struct net_device *ldev;
+        LIST_HEAD(list);
 
         /* called twice if separate control and data intf */
         if (!dev)
@@ -1440,8 +1514,9 @@ static void qmi_wwan_disconnect(struct usb_interface *intf)
                 }
                 rcu_read_lock();
                 netdev_for_each_upper_dev_rcu(dev->net, ldev, iter)
-                        qmimux_unregister_device(ldev);
+                        qmimux_unregister_device(ldev, &list);
                 rcu_read_unlock();
+                unregister_netdevice_many(&list);
                 rtnl_unlock();
                 info->flags &= ~QMI_WWAN_FLAG_MUX;
         }