Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "This looks like a lot but it's a mixture of regression fixes as well
  as fixes for longer standing issues.

   1) Fix on-channel cancellation in mac80211, from Johannes Berg.

   2) Handle CHECKSUM_COMPLETE properly in xt_TCPMSS netfilter xtables
      module, from Eric Dumazet.

   3) Avoid infinite loop in UDP SO_REUSEPORT logic, also from Eric
      Dumazet.

   4) Avoid a NULL deref if we try to set SO_REUSEPORT after a socket is
      bound, from Craig Gallek.

   5) GRO key comparisons don't take lightweight tunnels into account,
      from Jesse Gross.

   6) Fix struct pid leak via SCM credentials in AF_UNIX, from Eric
      Dumazet.

   7) We need to set the rtnl_link_ops of ipv6 SIT tunnels before we
      register them, otherwise the NEWLINK netlink message is missing
      the proper attributes.  From Thadeu Lima de Souza Cascardo.

   8) Several Spectrum chip bug fixes for mlxsw switch driver, from Ido
      Schimmel

   9) Handle fragments properly in ipv4 easly socket demux, from Eric
      Dumazet.

  10) Don't ignore the ifindex key specifier on ipv6 output route
      lookups, from Paolo Abeni"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (128 commits)
  tcp: avoid cwnd undo after receiving ECN
  irda: fix a potential use-after-free in ircomm_param_request
  net: tg3: avoid uninitialized variable warning
  net: nb8800: avoid uninitialized variable warning
  net: vxge: avoid unused function warnings
  net: bgmac: clarify CONFIG_BCMA dependency
  net: hp100: remove unnecessary #ifdefs
  net: davinci_cpdma: use dma_addr_t for DMA address
  ipv6/udp: use sticky pktinfo egress ifindex on connect()
  ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail()
  netlink: not trim skb for mmaped socket when dump
  vxlan: fix a out of bounds access in __vxlan_find_mac
  net: dsa: mv88e6xxx: fix port VLAN maps
  fib_trie: Fix shift by 32 in fib_table_lookup
  net: moxart: use correct accessors for DMA memory
  ipv4: ipconfig: avoid unused ic_proto_used symbol
  bnxt_en: Fix crash in bnxt_free_tx_skbs() during tx timeout.
  bnxt_en: Exclude rx_drop_pkts hw counter from the stack's rx_dropped counter.
  bnxt_en: Ring free response from close path should use completion ring
  net_sched: drr: check for NULL pointer in drr_dequeue
  ...

5 files changed, 42 insertions, 35 deletions

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index d040365ba98e..8a4cc2f7f0db 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -307,6 +307,9 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 
         /* check that it's our buffer */
         if (lowpan_is_ipv6(*skb_network_header(skb))) {
+                /* Pull off the 1-byte of 6lowpan header. */
+                skb_pull(skb, 1);
+
                 /* Copy the packet so that the IPv6 header is
                  * properly aligned.
                  */
@@ -317,6 +320,7 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 
                 local_skb->protocol = htons(ETH_P_IPV6);
                 local_skb->pkt_type = PACKET_HOST;
+                local_skb->dev = dev;
 
                 skb_set_transport_header(local_skb, sizeof(struct ipv6hdr));
 
@@ -335,6 +339,8 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
                 if (!local_skb)
                         goto drop;
 
+                local_skb->dev = dev;
+
                 ret = iphc_decompress(local_skb, dev, chan);
                 if (ret < 0) {
                         kfree_skb(local_skb);
@@ -343,7 +349,6 @@ static int recv_pkt(struct sk_buff *skb, struct net_device *dev,
 
                 local_skb->protocol = htons(ETH_P_IPV6);
                 local_skb->pkt_type = PACKET_HOST;
-                local_skb->dev = dev;
 
                 if (give_skb_to_upper(local_skb, dev)
                                 != NET_RX_SUCCESS) {
diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index 41b5f3813f02..c78ee2dc9323 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c
@@ -688,21 +688,29 @@ static u8 update_white_list(struct hci_request *req)
          * command to remove it from the controller.
          */
         list_for_each_entry(b, &hdev->le_white_list, list) {
-                struct hci_cp_le_del_from_white_list cp;
+                /* If the device is neither in pend_le_conns nor
+                 * pend_le_reports then remove it from the whitelist.
+                 */
+                if (!hci_pend_le_action_lookup(&hdev->pend_le_conns,
+                                               &b->bdaddr, b->bdaddr_type) &&
+                    !hci_pend_le_action_lookup(&hdev->pend_le_reports,
+                                               &b->bdaddr, b->bdaddr_type)) {
+                        struct hci_cp_le_del_from_white_list cp;
+
+                        cp.bdaddr_type = b->bdaddr_type;
+                        bacpy(&cp.bdaddr, &b->bdaddr);
 
-                if (hci_pend_le_action_lookup(&hdev->pend_le_conns,
-                                              &b->bdaddr, b->bdaddr_type) ||
-                    hci_pend_le_action_lookup(&hdev->pend_le_reports,
-                                              &b->bdaddr, b->bdaddr_type)) {
-                        white_list_entries++;
+                        hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
+                                    sizeof(cp), &cp);
                         continue;
                 }
 
-                cp.bdaddr_type = b->bdaddr_type;
-                bacpy(&cp.bdaddr, &b->bdaddr);
+                if (hci_find_irk_by_addr(hdev, &b->bdaddr, b->bdaddr_type)) {
+                        /* White list can not be used with RPAs */
+                        return 0x00;
+                }
 
-                hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
-                            sizeof(cp), &cp);
+                white_list_entries++;
         }
 
         /* Since all no longer valid white list entries have been
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 39a5149f3010..eb4f5f24cbe3 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -197,10 +197,20 @@ int l2cap_add_psm(struct l2cap_chan *chan, bdaddr_t *src, __le16 psm)
                 chan->sport = psm;
                 err = 0;
         } else {
-                u16 p;
+                u16 p, start, end, incr;
+
+                if (chan->src_type == BDADDR_BREDR) {
+                        start = L2CAP_PSM_DYN_START;
+                        end = L2CAP_PSM_AUTO_END;
+                        incr = 2;
+                } else {
+                        start = L2CAP_PSM_LE_DYN_START;
+                        end = L2CAP_PSM_LE_DYN_END;
+                        incr = 1;
+                }
 
                 err = -EINVAL;
-                for (p = 0x1001; p < 0x1100; p += 2)
+                for (p = start; p <= end; p += incr)
                         if (!__l2cap_global_chan_by_addr(cpu_to_le16(p), src)) {
                                 chan->psm   = cpu_to_le16(p);
                                 chan->sport = cpu_to_le16(p);
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 1bb551527044..e4cae72895a7 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -58,7 +58,7 @@ static int l2cap_validate_bredr_psm(u16 psm)
                 return -EINVAL;
 
         /* Restrict usage of well-known PSMs */
-        if (psm < 0x1001 && !capable(CAP_NET_BIND_SERVICE))
+        if (psm < L2CAP_PSM_DYN_START && !capable(CAP_NET_BIND_SERVICE))
                 return -EACCES;
 
         return 0;
@@ -67,11 +67,11 @@ static int l2cap_validate_bredr_psm(u16 psm)
 static int l2cap_validate_le_psm(u16 psm)
 {
         /* Valid LE_PSM ranges are defined only until 0x00ff */
-        if (psm > 0x00ff)
+        if (psm > L2CAP_PSM_LE_DYN_END)
                 return -EINVAL;
 
         /* Restrict fixed, SIG assigned PSM values to CAP_NET_BIND_SERVICE */
-        if (psm <= 0x007f && !capable(CAP_NET_BIND_SERVICE))
+        if (psm < L2CAP_PSM_LE_DYN_START && !capable(CAP_NET_BIND_SERVICE))
                 return -EACCES;
 
         return 0;
@@ -125,6 +125,9 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                         goto done;
         }
 
+        bacpy(&chan->src, &la.l2_bdaddr);
+        chan->src_type = la.l2_bdaddr_type;
+
         if (la.l2_cid)
                 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
         else
@@ -156,9 +159,6 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
                 break;
         }
 
-        bacpy(&chan->src, &la.l2_bdaddr);
-        chan->src_type = la.l2_bdaddr_type;
-
         if (chan->psm && bdaddr_type_is_le(chan->src_type))
                 chan->mode = L2CAP_MODE_LE_FLOWCTL;
 
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index ffed8a1d4f27..4b175df35184 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1072,22 +1072,6 @@ static void smp_notify_keys(struct l2cap_conn *conn)
                         hcon->dst_type = smp->remote_irk->addr_type;
                         queue_work(hdev->workqueue, &conn->id_addr_update_work);
                 }
-
-                /* When receiving an indentity resolving key for
-                 * a remote device that does not use a resolvable
-                 * private address, just remove the key so that
-                 * it is possible to use the controller white
-                 * list for scanning.
-                 *
-                 * Userspace will have been told to not store
-                 * this key at this point. So it is safe to
-                 * just remove it.
-                 */
-                if (!bacmp(&smp->remote_irk->rpa, BDADDR_ANY)) {
-                        list_del_rcu(&smp->remote_irk->list);
-                        kfree_rcu(smp->remote_irk, rcu);
-                        smp->remote_irk = NULL;
-                }
         }
 
         if (smp->csrk) {