Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Out of bounds access in xfrm IPSEC policy unlink, from Yue Haibing.

 2) Missing length check for esp4 UDP encap, from Sabrina Dubroca.

 3) Fix byte order of RX STBC access in mac80211, from Johannes Berg.

 4) Inifnite loop in bpftool map create, from Alban Crequy.

 5) Register mark fix in ebpf verifier after pkt/null checks, from Paul
    Chaignon.

 6) Properly use rcu_dereference_sk_user_data in L2TP code, from Eric
    Dumazet.

 7) Buffer overrun in marvell phy driver, from Andrew Lunn.

 8) Several crash and statistics handling fixes to bnxt_en driver, from
    Michael Chan and Vasundhara Volam.

 9) Several fixes to the TLS layer from Jakub Kicinski (copying negative
    amounts of data in reencrypt, reencrypt frag copying, blind nskb->sk
    NULL deref, etc).

10) Several UDP GRO fixes, from Paolo Abeni and Eric Dumazet.

11) PID/UID checks on ipv6 flow labels are inverted, from Willem de
    Bruijn.

12) Use after free in l2tp, from Eric Dumazet.

13) IPV6 route destroy races, also from Eric Dumazet.

14) SCTP state machine can erroneously run recursively, fix from Xin
    Long.

15) Adjust AF_PACKET msg_name length checks, add padding bytes if
    necessary. From Willem de Bruijn.

16) Preserve skb_iif, so that forwarded packets have consistent values
    even if fragmentation is involved. From Shmulik Ladkani.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (69 commits)
  udp: fix GRO packet of death
  ipv6: A few fixes on dereferencing rt->from
  rds: ib: force endiannes annotation
  selftests: fib_rule_tests: print the result and return 1 if any tests failed
  ipv4: ip_do_fragment: Preserve skb_iif during fragmentation
  net/tls: avoid NULL pointer deref on nskb->sk in fallback
  selftests: fib_rule_tests: Fix icmp proto with ipv6
  packet: validate msg_namelen in send directly
  packet: in recvmsg msg_name return at least sizeof sockaddr_ll
  sctp: avoid running the sctp state machine recursively
  stmmac: pci: Fix typo in IOT2000 comment
  Documentation: fix netdev-FAQ.rst markup warning
  ipv6: fix races in ip6_dst_destroy()
  l2ip: fix possible use-after-free
  appletalk: Set error code if register_snap_client failed
  net: dsa: bcm_sf2: fix buffer overflow doing set_rxnfc
  rxrpc: Fix net namespace cleanup
  ipv6/flowlabel: wait rcu grace period before put_pid()
  vrf: Use orig netdev to count Ip6InNoRoutes and a fresh route lookup when sending dest unreach
  tcp: add sanity tests in tcp_add_backlog()
  ...

1 files changed, 25 insertions, 12 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 9419c5cf4de5..9b81813dd16a 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2602,8 +2602,8 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         void *ph;
         DECLARE_SOCKADDR(struct sockaddr_ll *, saddr, msg->msg_name);
         bool need_wait = !(msg->msg_flags & MSG_DONTWAIT);
+        unsigned char *addr = NULL;
         int tp_len, size_max;
-        unsigned char *addr;
         void *data;
         int len_sum = 0;
         int status = TP_STATUS_AVAILABLE;
@@ -2614,7 +2614,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
         if (likely(saddr == NULL)) {
                 dev     = packet_cached_dev_get(po);
                 proto   = po->num;
-                addr    = NULL;
         } else {
                 err = -EINVAL;
                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
@@ -2624,10 +2623,13 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
                                                 sll_addr)))
                         goto out;
                 proto   = saddr->sll_protocol;
-                addr    = saddr->sll_halen ? saddr->sll_addr : NULL;
                 dev = dev_get_by_index(sock_net(&po->sk), saddr->sll_ifindex);
-                if (addr && dev && saddr->sll_halen < dev->addr_len)
-                        goto out_put;
+                if (po->sk.sk_socket->type == SOCK_DGRAM) {
+                        if (dev && msg->msg_namelen < dev->addr_len +
+                                   offsetof(struct sockaddr_ll, sll_addr))
+                                goto out_put;
+                        addr = saddr->sll_addr;
+                }
         }
 
         err = -ENXIO;
@@ -2799,7 +2801,7 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         struct sk_buff *skb;
         struct net_device *dev;
         __be16 proto;
-        unsigned char *addr;
+        unsigned char *addr = NULL;
         int err, reserve = 0;
         struct sockcm_cookie sockc;
         struct virtio_net_hdr vnet_hdr = { 0 };
@@ -2816,7 +2818,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
         if (likely(saddr == NULL)) {
                 dev     = packet_cached_dev_get(po);
                 proto   = po->num;
-                addr    = NULL;
         } else {
                 err = -EINVAL;
                 if (msg->msg_namelen < sizeof(struct sockaddr_ll))
@@ -2824,10 +2825,13 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
                 if (msg->msg_namelen < (saddr->sll_halen + offsetof(struct sockaddr_ll, sll_addr)))
                         goto out;
                 proto   = saddr->sll_protocol;
-                addr    = saddr->sll_halen ? saddr->sll_addr : NULL;
                 dev = dev_get_by_index(sock_net(sk), saddr->sll_ifindex);
-                if (addr && dev && saddr->sll_halen < dev->addr_len)
-                        goto out_unlock;
+                if (sock->type == SOCK_DGRAM) {
+                        if (dev && msg->msg_namelen < dev->addr_len +
+                                   offsetof(struct sockaddr_ll, sll_addr))
+                                goto out_unlock;
+                        addr = saddr->sll_addr;
+                }
         }
 
         err = -ENXIO;
@@ -3344,20 +3348,29 @@ static int packet_recvmsg(struct socket *sock, struct msghdr *msg, size_t len,
         sock_recv_ts_and_drops(msg, sk, skb);
 
         if (msg->msg_name) {
+                int copy_len;
+
                 /* If the address length field is there to be filled
                  * in, we fill it in now.
                  */
                 if (sock->type == SOCK_PACKET) {
                         __sockaddr_check_size(sizeof(struct sockaddr_pkt));
                         msg->msg_namelen = sizeof(struct sockaddr_pkt);
+                        copy_len = msg->msg_namelen;
                 } else {
                         struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
 
                         msg->msg_namelen = sll->sll_halen +
                                 offsetof(struct sockaddr_ll, sll_addr);
+                        copy_len = msg->msg_namelen;
+                        if (msg->msg_namelen < sizeof(struct sockaddr_ll)) {
+                                memset(msg->msg_name +
+                                       offsetof(struct sockaddr_ll, sll_addr),
+                                       0, sizeof(sll->sll_addr));
+                                msg->msg_namelen = sizeof(struct sockaddr_ll);
+                        }
                 }
-                memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
-                       msg->msg_namelen);
+                memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa, copy_len);
         }
 
         if (pkt_sk(sk)->auxdata) {