Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes and more updates from David Miller:

 1) Tunneling fixes from Tom Herbert and Alexander Duyck.

 2) AF_UNIX updates some struct sock bit fields with the socket lock,
    whereas setsockopt() sets overlapping ones with locking.  Seperate
    out the synchronized vs.  the AF_UNIX unsynchronized ones to avoid
    corruption.  From Andrey Ryabinin.

 3) Mount BPF filesystem with mount_nodev rather than mount_ns, from
    Eric Biederman.

 4) A couple kmemdup conversions, from Muhammad Falak R Wani.

 5) BPF verifier fixes from Alexei Starovoitov.

 6) Don't let tunneled UDP packets get stuck in socket queues, if
    something goes wrong during the encapsulation just drop the packet
    rather than signalling an error up the call stack.  From Hannes
    Frederic Sowa.

 7) SKB ref after free in batman-adv, from Florian Westphal.

 8) TCP iSCSI, ocfs2, rds, and tipc have to disable BH in it's TCP
    callbacks since the TCP stack runs pre-emptibly now.  From Eric
    Dumazet.

 9) Fix crash in fixed_phy_add, from Rabin Vincent.

10) Fix length checks in xen-netback, from Paul Durrant.

11) Fix mixup in KEY vs KEYID macsec attributes, from Sabrina Dubroca.

12) RDS connection spamming bug fixes from Sowmini Varadhan

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (152 commits)
  net: suppress warnings on dev_alloc_skb
  uapi glibc compat: fix compilation when !__USE_MISC in glibc
  udp: prevent skbs lingering in tunnel socket queues
  bpf: teach verifier to recognize imm += ptr pattern
  bpf: support decreasing order in direct packet access
  net: usb: ch9200: use kmemdup
  ps3_gelic: use kmemdup
  net:liquidio: use kmemdup
  bpf: Use mount_nodev not mount_ns to mount the bpf filesystem
  net: cdc_ncm: update datagram size after changing mtu
  tuntap: correctly wake up process during uninit
  intel: Add support for IPv6 IP-in-IP offload
  ip6_gre: Do not allow segmentation offloads GRE_CSUM is enabled with FOU/GUE
  RDS: TCP: Avoid rds connection churn from rogue SYNs
  RDS: TCP: rds_tcp_accept_worker() must exit gracefully when terminating rds-tcp
  net: sock: move ->sk_shutdown out of bitfields.
  ipv6: Don't reset inner headers in ip6_tnl_xmit
  ip4ip6: Support for GSO/GRO
  ip6ip6: Support for GSO/GRO
  ipv6: Set features for IPv6 tunnels
  ...

4 files changed, 17 insertions, 12 deletions

diff --git a/net/rds/tcp_connect.c b/net/rds/tcp_connect.c
index 49a3fcfed360..fb82e0a0bf89 100644
--- a/net/rds/tcp_connect.c
+++ b/net/rds/tcp_connect.c
@@ -43,7 +43,7 @@ void rds_tcp_state_change(struct sock *sk)
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (!conn) {
                 state_change = sk->sk_state_change;
@@ -69,7 +69,7 @@ void rds_tcp_state_change(struct sock *sk)
                         break;
         }
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         state_change(sk);
 }
 
diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c
index be263cdf268b..4bf4befe5066 100644
--- a/net/rds/tcp_listen.c
+++ b/net/rds/tcp_listen.c
@@ -80,6 +80,9 @@ int rds_tcp_accept_one(struct socket *sock)
         int conn_state;
         struct sock *nsk;
 
+        if (!sock) /* module unload or netns delete in progress */
+                return -ENETUNREACH;
+
         ret = sock_create_kern(sock_net(sock->sk), sock->sk->sk_family,
                                sock->sk->sk_type, sock->sk->sk_protocol,
                                &new_sock);
@@ -129,11 +132,13 @@ int rds_tcp_accept_one(struct socket *sock)
                  * so we must quiesce any send threads before resetting
                  * c_transport_data.
                  */
-                wait_event(conn->c_waitq,
-                           !test_bit(RDS_IN_XMIT, &conn->c_flags));
-                if (ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) {
+                if (ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr) ||
+                    !conn->c_outgoing) {
                         goto rst_nsk;
-                } else if (rs_tcp->t_sock) {
+                } else {
+                        atomic_set(&conn->c_state, RDS_CONN_CONNECTING);
+                        wait_event(conn->c_waitq,
+                                   !test_bit(RDS_IN_XMIT, &conn->c_flags));
                         rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
                         conn->c_outgoing = 0;
                 }
@@ -166,7 +171,7 @@ void rds_tcp_listen_data_ready(struct sock *sk)
 
         rdsdebug("listen data ready sk %p\n", sk);
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         ready = sk->sk_user_data;
         if (!ready) { /* check for teardown race */
                 ready = sk->sk_data_ready;
@@ -183,7 +188,7 @@ void rds_tcp_listen_data_ready(struct sock *sk)
                 rds_tcp_accept_work(sk);
 
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         ready(sk);
 }
 
diff --git a/net/rds/tcp_recv.c b/net/rds/tcp_recv.c
index d75d8b56a9e3..c3196f9d070a 100644
--- a/net/rds/tcp_recv.c
+++ b/net/rds/tcp_recv.c
@@ -301,7 +301,7 @@ void rds_tcp_data_ready(struct sock *sk)
 
         rdsdebug("data ready sk %p\n", sk);
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (!conn) { /* check for teardown race */
                 ready = sk->sk_data_ready;
@@ -315,7 +315,7 @@ void rds_tcp_data_ready(struct sock *sk)
         if (rds_tcp_read_sock(conn, GFP_ATOMIC) == -ENOMEM)
                 queue_delayed_work(rds_wq, &conn->c_recv_w, 0);
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
         ready(sk);
 }
 
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index 2894e6095e3b..22d0f2020a79 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -180,7 +180,7 @@ void rds_tcp_write_space(struct sock *sk)
         struct rds_connection *conn;
         struct rds_tcp_connection *tc;
 
-        read_lock(&sk->sk_callback_lock);
+        read_lock_bh(&sk->sk_callback_lock);
         conn = sk->sk_user_data;
         if (!conn) {
                 write_space = sk->sk_write_space;
@@ -200,7 +200,7 @@ void rds_tcp_write_space(struct sock *sk)
                 queue_delayed_work(rds_wq, &conn->c_send_w, 0);
 
 out:
-        read_unlock(&sk->sk_callback_lock);
+        read_unlock_bh(&sk->sk_callback_lock);
 
         /*
          * write_space is only called when data leaves tcp's send queue if