Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from David Miller:

 1) Fix ieeeu02154 atusb driver use-after-free, from Johan Hovold.

 2) Need to validate TCA_CBQ_WRROPT netlink attributes, from Eric
    Dumazet.

 3) txq null deref in mac80211, from Miaoqing Pan.

 4) ionic driver needs to select NET_DEVLINK, from Arnd Bergmann.

 5) Need to disable bh during nft_connlimit GC, from Pablo Neira Ayuso.

 6) Avoid division by zero in taprio scheduler, from Vladimir Oltean.

 7) Various xgmac fixes in stmmac driver from Jose Abreu.

 8) Avoid 64-bit division in mlx5 leading to link errors on 32-bit from
    Michal Kubecek.

 9) Fix bad VLAN check in rtl8366 DSA driver, from Linus Walleij.

10) Fix sleep while atomic in sja1105, from Vladimir Oltean.

11) Suspend/resume deadlock in stmmac, from Thierry Reding.

12) Various UDP GSO fixes from Josh Hunt.

13) Fix slab out of bounds access in tcp_zerocopy_receive(), from Eric
    Dumazet.

14) Fix OOPS in __ipv6_ifa_notify(), from David Ahern.

15) Memory leak in NFC's llcp_sock_bind, from Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (72 commits)
  selftests/net: add nettest to .gitignore
  net: qlogic: Fix memory leak in ql_alloc_large_buffers
  nfc: fix memory leak in llcp_sock_bind()
  sch_dsmark: fix potential NULL deref in dsmark_init()
  net: phy: at803x: use operating parameters from PHY-specific status
  net: phy: extract pause mode
  net: phy: extract link partner advertisement reading
  net: phy: fix write to mii-ctrl1000 register
  ipv6: Handle missing host route in __ipv6_ifa_notify
  net: phy: allow for reset line to be tied to a sleepy GPIO controller
  net: ipv4: avoid mixed n_redirects and rate_tokens usage
  r8152: Set macpassthru in reset_resume callback
  cxgb4:Fix out-of-bounds MSI-X info array access
  Revert "ipv6: Handle race in addrconf_dad_work"
  net: make sock_prot_memory_pressure() return "const char *"
  rxrpc: Fix rxrpc_recvmsg tracepoint
  qmi_wwan: add support for Cinterion CLS8 devices
  tcp: fix slab-out-of-bounds in tcp_zerocopy_receive()
  lib: textsearch: fix escapes in example code
  udp: only do GSO if # of segs > 1
  ...

1 files changed, 18 insertions, 11 deletions

diff --git a/net/tipc/link.c b/net/tipc/link.c
index 6cc75ffd9e2c..999eab592de8 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -160,6 +160,7 @@ struct tipc_link {
         struct {
                 u16 len;
                 u16 limit;
+                struct sk_buff *target_bskb;
         } backlog[5];
         u16 snd_nxt;
         u16 window;
@@ -880,6 +881,7 @@ static void link_prepare_wakeup(struct tipc_link *l)
 void tipc_link_reset(struct tipc_link *l)
 {
         struct sk_buff_head list;
+        u32 imp;
 
         __skb_queue_head_init(&list);
 
@@ -901,11 +903,10 @@ void tipc_link_reset(struct tipc_link *l)
         __skb_queue_purge(&l->deferdq);
         __skb_queue_purge(&l->backlogq);
         __skb_queue_purge(&l->failover_deferdq);
-        l->backlog[TIPC_LOW_IMPORTANCE].len = 0;
-        l->backlog[TIPC_MEDIUM_IMPORTANCE].len = 0;
-        l->backlog[TIPC_HIGH_IMPORTANCE].len = 0;
-        l->backlog[TIPC_CRITICAL_IMPORTANCE].len = 0;
-        l->backlog[TIPC_SYSTEM_IMPORTANCE].len = 0;
+        for (imp = 0; imp <= TIPC_SYSTEM_IMPORTANCE; imp++) {
+                l->backlog[imp].len = 0;
+                l->backlog[imp].target_bskb = NULL;
+        }
         kfree_skb(l->reasm_buf);
         kfree_skb(l->reasm_tnlmsg);
         kfree_skb(l->failover_reasm_skb);
@@ -947,7 +948,7 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
         u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
         struct sk_buff_head *transmq = &l->transmq;
         struct sk_buff_head *backlogq = &l->backlogq;
-        struct sk_buff *skb, *_skb, *bskb;
+        struct sk_buff *skb, *_skb, **tskb;
         int pkt_cnt = skb_queue_len(list);
         int rc = 0;
 
@@ -999,19 +1000,21 @@ int tipc_link_xmit(struct tipc_link *l, struct sk_buff_head *list,
                         seqno++;
                         continue;
                 }
-                if (tipc_msg_bundle(skb_peek_tail(backlogq), hdr, mtu)) {
+                tskb = &l->backlog[imp].target_bskb;
+                if (tipc_msg_bundle(*tskb, hdr, mtu)) {
                         kfree_skb(__skb_dequeue(list));
                         l->stats.sent_bundled++;
                         continue;
                 }
-                if (tipc_msg_make_bundle(&bskb, hdr, mtu, l->addr)) {
+                if (tipc_msg_make_bundle(tskb, hdr, mtu, l->addr)) {
                         kfree_skb(__skb_dequeue(list));
-                        __skb_queue_tail(backlogq, bskb);
-                        l->backlog[msg_importance(buf_msg(bskb))].len++;
+                        __skb_queue_tail(backlogq, *tskb);
+                        l->backlog[imp].len++;
                         l->stats.sent_bundled++;
                         l->stats.sent_bundles++;
                         continue;
                 }
+                l->backlog[imp].target_bskb = NULL;
                 l->backlog[imp].len += skb_queue_len(list);
                 skb_queue_splice_tail_init(list, backlogq);
         }
@@ -1027,6 +1030,7 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
         u16 seqno = l->snd_nxt;
         u16 ack = l->rcv_nxt - 1;
         u16 bc_ack = l->bc_rcvlink->rcv_nxt - 1;
+        u32 imp;
 
         while (skb_queue_len(&l->transmq) < l->window) {
                 skb = skb_peek(&l->backlogq);
@@ -1037,7 +1041,10 @@ static void tipc_link_advance_backlog(struct tipc_link *l,
                         break;
                 __skb_dequeue(&l->backlogq);
                 hdr = buf_msg(skb);
-                l->backlog[msg_importance(hdr)].len--;
+                imp = msg_importance(hdr);
+                l->backlog[imp].len--;
+                if (unlikely(skb == l->backlog[imp].target_bskb))
+                        l->backlog[imp].target_bskb = NULL;
                 __skb_queue_tail(&l->transmq, skb);
                 /* next retransmit attempt */
                 if (link_is_bc_sndlink(l))