Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "This looks like a lot but it's a mixture of regression fixes as well
  as fixes for longer standing issues.

   1) Fix on-channel cancellation in mac80211, from Johannes Berg.

   2) Handle CHECKSUM_COMPLETE properly in xt_TCPMSS netfilter xtables
      module, from Eric Dumazet.

   3) Avoid infinite loop in UDP SO_REUSEPORT logic, also from Eric
      Dumazet.

   4) Avoid a NULL deref if we try to set SO_REUSEPORT after a socket is
      bound, from Craig Gallek.

   5) GRO key comparisons don't take lightweight tunnels into account,
      from Jesse Gross.

   6) Fix struct pid leak via SCM credentials in AF_UNIX, from Eric
      Dumazet.

   7) We need to set the rtnl_link_ops of ipv6 SIT tunnels before we
      register them, otherwise the NEWLINK netlink message is missing
      the proper attributes.  From Thadeu Lima de Souza Cascardo.

   8) Several Spectrum chip bug fixes for mlxsw switch driver, from Ido
      Schimmel

   9) Handle fragments properly in ipv4 easly socket demux, from Eric
      Dumazet.

  10) Don't ignore the ifindex key specifier on ipv6 output route
      lookups, from Paolo Abeni"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (128 commits)
  tcp: avoid cwnd undo after receiving ECN
  irda: fix a potential use-after-free in ircomm_param_request
  net: tg3: avoid uninitialized variable warning
  net: nb8800: avoid uninitialized variable warning
  net: vxge: avoid unused function warnings
  net: bgmac: clarify CONFIG_BCMA dependency
  net: hp100: remove unnecessary #ifdefs
  net: davinci_cpdma: use dma_addr_t for DMA address
  ipv6/udp: use sticky pktinfo egress ifindex on connect()
  ipv6: enforce flowi6_oif usage in ip6_dst_lookup_tail()
  netlink: not trim skb for mmaped socket when dump
  vxlan: fix a out of bounds access in __vxlan_find_mac
  net: dsa: mv88e6xxx: fix port VLAN maps
  fib_trie: Fix shift by 32 in fib_table_lookup
  net: moxart: use correct accessors for DMA memory
  ipv4: ipconfig: avoid unused ic_proto_used symbol
  bnxt_en: Fix crash in bnxt_free_tx_skbs() during tx timeout.
  bnxt_en: Exclude rx_drop_pkts hw counter from the stack's rx_dropped counter.
  bnxt_en: Ring free response from close path should use completion ring
  net_sched: drr: check for NULL pointer in drr_dequeue
  ...

11 files changed, 70 insertions, 40 deletions

diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index c22920525e5d..775824720b6b 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -353,6 +353,7 @@ config INET_ESP
         select CRYPTO_CBC
         select CRYPTO_SHA1
         select CRYPTO_DES
+        select CRYPTO_ECHAINIV
         ---help---
           Support for IPsec ESP.
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 7aea0ccb6be6..d07fc076bea0 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1394,9 +1394,10 @@ found:
                 struct fib_info *fi = fa->fa_info;
                 int nhsel, err;
 
-                if ((index >= (1ul << fa->fa_slen)) &&
-                    ((BITS_PER_LONG > KEYLENGTH) || (fa->fa_slen != KEYLENGTH)))
-                        continue;
+                if ((BITS_PER_LONG > KEYLENGTH) || (fa->fa_slen < KEYLENGTH)) {
+                        if (index >= (1ul << fa->fa_slen))
+                                continue;
+                }
                 if (fa->fa_tos && fa->fa_tos != flp->flowi4_tos)
                         continue;
                 if (fi->fib_dead)
diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
index 8bb8e7ad8548..6029157a19ed 100644
--- a/net/ipv4/inet_diag.c
+++ b/net/ipv4/inet_diag.c
@@ -361,13 +361,20 @@ struct sock *inet_diag_find_one_icsk(struct net *net,
                                  req->id.idiag_dport, req->id.idiag_src[0],
                                  req->id.idiag_sport, req->id.idiag_if);
 #if IS_ENABLED(CONFIG_IPV6)
-        else if (req->sdiag_family == AF_INET6)
-                sk = inet6_lookup(net, hashinfo,
-                                  (struct in6_addr *)req->id.idiag_dst,
-                                  req->id.idiag_dport,
-                                  (struct in6_addr *)req->id.idiag_src,
-                                  req->id.idiag_sport,
-                                  req->id.idiag_if);
+        else if (req->sdiag_family == AF_INET6) {
+                if (ipv6_addr_v4mapped((struct in6_addr *)req->id.idiag_dst) &&
+                    ipv6_addr_v4mapped((struct in6_addr *)req->id.idiag_src))
+                        sk = inet_lookup(net, hashinfo, req->id.idiag_dst[3],
+                                         req->id.idiag_dport, req->id.idiag_src[3],
+                                         req->id.idiag_sport, req->id.idiag_if);
+                else
+                        sk = inet6_lookup(net, hashinfo,
+                                          (struct in6_addr *)req->id.idiag_dst,
+                                          req->id.idiag_dport,
+                                          (struct in6_addr *)req->id.idiag_src,
+                                          req->id.idiag_sport,
+                                          req->id.idiag_if);
+        }
 #endif
         else
                 return ERR_PTR(-EINVAL);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 3f00810b7288..187c6fcc3027 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -661,6 +661,7 @@ int ip_defrag(struct net *net, struct sk_buff *skb, u32 user)
         struct ipq *qp;
 
         IP_INC_STATS_BH(net, IPSTATS_MIB_REASMREQDS);
+        skb_orphan(skb);
 
         /* Lookup (or create) queue header */
         qp = ip_find(net, ip_hdr(skb), user, vif);
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index b1209b63381f..d77eb0c3b684 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -316,7 +316,10 @@ static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
         const struct iphdr *iph = ip_hdr(skb);
         struct rtable *rt;
 
-        if (sysctl_ip_early_demux && !skb_dst(skb) && !skb->sk) {
+        if (sysctl_ip_early_demux &&
+            !skb_dst(skb) &&
+            !skb->sk &&
+            !ip_is_fragment(iph)) {
                 const struct net_protocol *ipprot;
                 int protocol = iph->protocol;
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 67f7c9de0b16..2ed9dd2b5f2f 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -143,7 +143,11 @@ static char dhcp_client_identifier[253] __initdata;
 
 /* Persistent data: */
 
+#ifdef IPCONFIG_DYNAMIC
 static int ic_proto_used;                       /* Protocol used, if any */
+#else
+#define ic_proto_used 0
+#endif
 static __be32 ic_nameservers[CONF_NAMESERVERS_MAX]; /* DNS Server IP addresses */
 static u8 ic_domain[64];                /* DNS (not NIS) domain name */
 
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index 6fb869f646bf..a04dee536b8e 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -27,8 +27,6 @@ static int nf_ct_ipv4_gather_frags(struct net *net, struct sk_buff *skb,
 {
         int err;
 
-        skb_orphan(skb);
-
         local_bh_disable();
         err = ip_defrag(net, skb, user);
         local_bh_enable();
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index fd17eec93525..19746b3fcbbe 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -279,6 +279,7 @@
 
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
+#include <asm/unaligned.h>
 #include <net/busy_poll.h>
 
 int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT;
@@ -2638,6 +2639,7 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         const struct inet_connection_sock *icsk = inet_csk(sk);
         u32 now = tcp_time_stamp;
         unsigned int start;
+        u64 rate64;
         u32 rate;
 
         memset(info, 0, sizeof(*info));
@@ -2703,15 +2705,17 @@ void tcp_get_info(struct sock *sk, struct tcp_info *info)
         info->tcpi_total_retrans = tp->total_retrans;
 
         rate = READ_ONCE(sk->sk_pacing_rate);
-        info->tcpi_pacing_rate = rate != ~0U ? rate : ~0ULL;
+        rate64 = rate != ~0U ? rate : ~0ULL;
+        put_unaligned(rate64, &info->tcpi_pacing_rate);
 
         rate = READ_ONCE(sk->sk_max_pacing_rate);
-        info->tcpi_max_pacing_rate = rate != ~0U ? rate : ~0ULL;
+        rate64 = rate != ~0U ? rate : ~0ULL;
+        put_unaligned(rate64, &info->tcpi_max_pacing_rate);
 
         do {
                 start = u64_stats_fetch_begin_irq(&tp->syncp);
-                info->tcpi_bytes_acked = tp->bytes_acked;
-                info->tcpi_bytes_received = tp->bytes_received;
+                put_unaligned(tp->bytes_acked, &info->tcpi_bytes_acked);
+                put_unaligned(tp->bytes_received, &info->tcpi_bytes_received);
         } while (u64_stats_fetch_retry_irq(&tp->syncp, start));
         info->tcpi_segs_out = tp->segs_out;
         info->tcpi_segs_in = tp->segs_in;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 0003d409fec5..1c2a73406261 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2164,8 +2164,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *skb;
-        int cnt, oldcnt;
-        int err;
+        int cnt, oldcnt, lost;
         unsigned int mss;
         /* Use SACK to deduce losses of new sequences sent during recovery */
         const u32 loss_high = tcp_is_sack(tp) ?  tp->snd_nxt : tp->high_seq;
@@ -2205,9 +2204,10 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int mark_head)
                                 break;
 
                         mss = tcp_skb_mss(skb);
-                        err = tcp_fragment(sk, skb, (packets - oldcnt) * mss,
-                                           mss, GFP_ATOMIC);
-                        if (err < 0)
+                        /* If needed, chop off the prefix to mark as lost. */
+                        lost = (packets - oldcnt) * mss;
+                        if (lost < skb->len &&
+                            tcp_fragment(sk, skb, lost, mss, GFP_ATOMIC) < 0)
                                 break;
                         cnt = packets;
                 }
@@ -2366,8 +2366,6 @@ static void tcp_undo_cwnd_reduction(struct sock *sk, bool unmark_loss)
                         tp->snd_ssthresh = tp->prior_ssthresh;
                         tcp_ecn_withdraw_cwr(tp);
                 }
-        } else {
-                tp->snd_cwnd = max(tp->snd_cwnd, tp->snd_ssthresh);
         }
         tp->snd_cwnd_stamp = tcp_time_stamp;
         tp->undo_marker = 0;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5ced3e4013e3..a4d523709ab3 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -707,7 +707,8 @@ release_sk1:
    outside socket context is ugly, certainly. What can I do?
  */
 
-static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
+static void tcp_v4_send_ack(struct net *net,
+                            struct sk_buff *skb, u32 seq, u32 ack,
                             u32 win, u32 tsval, u32 tsecr, int oif,
                             struct tcp_md5sig_key *key,
                             int reply_flags, u8 tos)
@@ -722,7 +723,6 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
                         ];
         } rep;
         struct ip_reply_arg arg;
-        struct net *net = dev_net(skb_dst(skb)->dev);
 
         memset(&rep.th, 0, sizeof(struct tcphdr));
         memset(&arg, 0, sizeof(arg));
@@ -784,7 +784,8 @@ static void tcp_v4_timewait_ack(struct sock *sk, struct sk_buff *skb)
         struct inet_timewait_sock *tw = inet_twsk(sk);
         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 
-        tcp_v4_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
+        tcp_v4_send_ack(sock_net(sk), skb,
+                        tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
                         tcp_time_stamp + tcptw->tw_ts_offset,
                         tcptw->tw_ts_recent,
@@ -803,8 +804,10 @@ static void tcp_v4_reqsk_send_ack(const struct sock *sk, struct sk_buff *skb,
         /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
          * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
          */
-        tcp_v4_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
-                        tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
+        u32 seq = (sk->sk_state == TCP_LISTEN) ? tcp_rsk(req)->snt_isn + 1 :
+                                             tcp_sk(sk)->snd_nxt;
+
+        tcp_v4_send_ack(sock_net(sk), skb, seq,
                         tcp_rsk(req)->rcv_nxt, req->rsk_rcv_wnd,
                         tcp_time_stamp,
                         req->ts_recent,
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index dc45b538e237..be0b21852b13 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -499,6 +499,7 @@ static struct sock *udp4_lib_lookup2(struct net *net,
         struct sock *sk, *result;
         struct hlist_nulls_node *node;
         int score, badness, matches = 0, reuseport = 0;
+        bool select_ok = true;
         u32 hash = 0;
 
 begin:
@@ -512,14 +513,18 @@ begin:
                         badness = score;
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
-                                struct sock *sk2;
                                 hash = udp_ehashfn(net, daddr, hnum,
                                                    saddr, sport);
-                                sk2 = reuseport_select_sock(sk, hash, skb,
-                                                            sizeof(struct udphdr));
-                                if (sk2) {
-                                        result = sk2;
-                                        goto found;
+                                if (select_ok) {
+                                        struct sock *sk2;
+
+                                        sk2 = reuseport_select_sock(sk, hash, skb,
+                                                        sizeof(struct udphdr));
+                                        if (sk2) {
+                                                result = sk2;
+                                                select_ok = false;
+                                                goto found;
+                                        }
                                 }
                                 matches = 1;
                         }
@@ -563,6 +568,7 @@ struct sock *__udp4_lib_lookup(struct net *net, __be32 saddr,
         unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
         struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
         int score, badness, matches = 0, reuseport = 0;
+        bool select_ok = true;
         u32 hash = 0;
 
         rcu_read_lock();
@@ -601,14 +607,18 @@ begin:
                         badness = score;
                         reuseport = sk->sk_reuseport;
                         if (reuseport) {
-                                struct sock *sk2;
                                 hash = udp_ehashfn(net, daddr, hnum,
                                                    saddr, sport);
-                                sk2 = reuseport_select_sock(sk, hash, skb,
+                                if (select_ok) {
+                                        struct sock *sk2;
+
+                                        sk2 = reuseport_select_sock(sk, hash, skb,
                                                         sizeof(struct udphdr));
-                                if (sk2) {
-                                        result = sk2;
-                                        goto found;
+                                        if (sk2) {
+                                                result = sk2;
+                                                select_ok = false;
+                                                goto found;
+                                        }
                                 }
                                 matches = 1;
                         }