Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from David Miller:

 1) Fix ieeeu02154 atusb driver use-after-free, from Johan Hovold.

 2) Need to validate TCA_CBQ_WRROPT netlink attributes, from Eric
    Dumazet.

 3) txq null deref in mac80211, from Miaoqing Pan.

 4) ionic driver needs to select NET_DEVLINK, from Arnd Bergmann.

 5) Need to disable bh during nft_connlimit GC, from Pablo Neira Ayuso.

 6) Avoid division by zero in taprio scheduler, from Vladimir Oltean.

 7) Various xgmac fixes in stmmac driver from Jose Abreu.

 8) Avoid 64-bit division in mlx5 leading to link errors on 32-bit from
    Michal Kubecek.

 9) Fix bad VLAN check in rtl8366 DSA driver, from Linus Walleij.

10) Fix sleep while atomic in sja1105, from Vladimir Oltean.

11) Suspend/resume deadlock in stmmac, from Thierry Reding.

12) Various UDP GSO fixes from Josh Hunt.

13) Fix slab out of bounds access in tcp_zerocopy_receive(), from Eric
    Dumazet.

14) Fix OOPS in __ipv6_ifa_notify(), from David Ahern.

15) Memory leak in NFC's llcp_sock_bind, from Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (72 commits)
  selftests/net: add nettest to .gitignore
  net: qlogic: Fix memory leak in ql_alloc_large_buffers
  nfc: fix memory leak in llcp_sock_bind()
  sch_dsmark: fix potential NULL deref in dsmark_init()
  net: phy: at803x: use operating parameters from PHY-specific status
  net: phy: extract pause mode
  net: phy: extract link partner advertisement reading
  net: phy: fix write to mii-ctrl1000 register
  ipv6: Handle missing host route in __ipv6_ifa_notify
  net: phy: allow for reset line to be tied to a sleepy GPIO controller
  net: ipv4: avoid mixed n_redirects and rate_tokens usage
  r8152: Set macpassthru in reset_resume callback
  cxgb4:Fix out-of-bounds MSI-X info array access
  Revert "ipv6: Handle race in addrconf_dad_work"
  net: make sock_prot_memory_pressure() return "const char *"
  rxrpc: Fix rxrpc_recvmsg tracepoint
  qmi_wwan: add support for Cinterion CLS8 devices
  tcp: fix slab-out-of-bounds in tcp_zerocopy_receive()
  lib: textsearch: fix escapes in example code
  udp: only do GSO if # of segs > 1
  ...

1 files changed, 9 insertions, 6 deletions

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cf755156a684..14bc654b6842 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -821,6 +821,7 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
         int is_udplite = IS_UDPLITE(sk);
         int offset = skb_transport_offset(skb);
         int len = skb->len - offset;
+        int datalen = len - sizeof(*uh);
         __wsum csum = 0;
 
         /*
@@ -854,10 +855,12 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
                         return -EIO;
                 }
 
-                skb_shinfo(skb)->gso_size = cork->gso_size;
-                skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
-                skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(len - sizeof(uh),
-                                                         cork->gso_size);
+                if (datalen > cork->gso_size) {
+                        skb_shinfo(skb)->gso_size = cork->gso_size;
+                        skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
+                        skb_shinfo(skb)->gso_segs = DIV_ROUND_UP(datalen,
+                                                                 cork->gso_size);
+                }
                 goto csum_partial;
         }
 
@@ -1969,7 +1972,7 @@ static int udp_queue_rcv_one_skb(struct sock *sk, struct sk_buff *skb)
          */
         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto drop;
-        nf_reset(skb);
+        nf_reset_ct(skb);
 
         if (static_branch_unlikely(&udp_encap_needed_key) && up->encap_type) {
                 int (*encap_rcv)(struct sock *sk, struct sk_buff *skb);
@@ -2298,7 +2301,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
         if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                 goto drop;
-        nf_reset(skb);
+        nf_reset_ct(skb);
 
         /* No socket. Drop packet silently, if checksum is wrong */
         if (udp_lib_checksum_complete(skb))