Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Don't race in IPSEC dumps, from Yuejie Shi.

 2) Verify lengths properly in IPSEC reqeusts, from Herbert Xu.

 3) Fix out of bounds access in ipv6 segment routing code, from David
    Lebrun.

 4) Don't write into the header of cloned SKBs in smsc95xx driver, from
    James Hughes.

 5) Several other drivers have this bug too, fix them. From Eric
    Dumazet.

 6) Fix access to uninitialized data in TC action cookie code, from
    Wolfgang Bumiller.

 7) Fix double free in IPV6 segment routing, again from David Lebrun.

 8) Don't let userspace set the RTF_PCPU flag, oops. From David Ahern.

 9) Fix use after free in qrtr code, from Dan Carpenter.

10) Don't double-destroy devices in ip6mr code, from Nikolay
    Aleksandrov.

11) Don't pass out-of-range TX queue indices into drivers, from Tushar
    Dave.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (30 commits)
  netpoll: Check for skb->queue_mapping
  ip6mr: fix notification device destruction
  bpf, doc: update bpf maintainers entry
  net: qrtr: potential use after free in qrtr_sendmsg()
  bpf: Fix values type used in test_maps
  net: ipv6: RTF_PCPU should not be settable from userspace
  gso: Validate assumption of frag_list segementation
  kaweth: use skb_cow_head() to deal with cloned skbs
  ch9200: use skb_cow_head() to deal with cloned skbs
  lan78xx: use skb_cow_head() to deal with cloned skbs
  sr9700: use skb_cow_head() to deal with cloned skbs
  cx82310_eth: use skb_cow_head() to deal with cloned skbs
  smsc75xx: use skb_cow_head() to deal with cloned skbs
  ipv6: sr: fix double free of skb after handling invalid SRH
  MAINTAINERS: Add "B:" field for networking.
  net sched actions: allocate act cookie early
  qed: Fix issue in populating the PFC config paramters.
  qed: Fix possible system hang in the dcbnl-getdcbx() path.
  qed: Fix sending an invalid PFC error mask to MFW.
  qed: Fix possible error in populating max_tc field.
  ...

10 files changed, 101 insertions, 108 deletions

diff --git a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
index 5bd36a4a8fcd..a6e2bbe629bd 100644
--- a/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
+++ b/drivers/net/ethernet/qlogic/qed/qed_dcbx.c
@@ -583,6 +583,13 @@ qed_dcbx_get_ets_data(struct qed_hwfn *p_hwfn,
                    p_params->ets_cbs,
                    p_ets->pri_tc_tbl[0], p_params->max_ets_tc);
 
+        if (p_params->ets_enabled && !p_params->max_ets_tc) {
+                p_params->max_ets_tc = QED_MAX_PFC_PRIORITIES;
+                DP_VERBOSE(p_hwfn, QED_MSG_DCB,
+                           "ETS params: max_ets_tc is forced to %d\n",
+                p_params->max_ets_tc);
+        }
+
         /* 8 bit tsa and bw data corresponding to each of the 8 TC's are
          * encoded in a type u32 array of size 2.
          */
@@ -1001,6 +1008,8 @@ qed_dcbx_set_pfc_data(struct qed_hwfn *p_hwfn,
         u8 pfc_map = 0;
         int i;
 
+        *pfc &= ~DCBX_PFC_ERROR_MASK;
+
         if (p_params->pfc.willing)
                 *pfc |= DCBX_PFC_WILLING_MASK;
         else
@@ -1255,7 +1264,7 @@ static struct qed_dcbx_get *qed_dcbnl_get_dcbx(struct qed_hwfn *hwfn,
 {
         struct qed_dcbx_get *dcbx_info;
 
-        dcbx_info = kzalloc(sizeof(*dcbx_info), GFP_KERNEL);
+        dcbx_info = kmalloc(sizeof(*dcbx_info), GFP_ATOMIC);
         if (!dcbx_info)
                 return NULL;
 
@@ -2073,6 +2082,8 @@ static int qed_dcbnl_ieee_setpfc(struct qed_dev *cdev, struct ieee_pfc *pfc)
         for (i = 0; i < QED_MAX_PFC_PRIORITIES; i++)
                 dcbx_set.config.params.pfc.prio[i] = !!(pfc->pfc_en & BIT(i));
 
+        dcbx_set.config.params.pfc.max_tc = pfc->pfc_cap;
+
         ptt = qed_ptt_acquire(hwfn);
         if (!ptt)
                 return -EINVAL;
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 54248775f227..f68c4db656ed 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -1127,12 +1127,70 @@ static struct mdiobb_ops bb_ops = {
         .get_mdio_data = sh_get_mdio,
 };
 
+/* free Tx skb function */
+static int sh_eth_tx_free(struct net_device *ndev, bool sent_only)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+        struct sh_eth_txdesc *txdesc;
+        int free_num = 0;
+        int entry;
+        bool sent;
+
+        for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
+                entry = mdp->dirty_tx % mdp->num_tx_ring;
+                txdesc = &mdp->tx_ring[entry];
+                sent = !(txdesc->status & cpu_to_le32(TD_TACT));
+                if (sent_only && !sent)
+                        break;
+                /* TACT bit must be checked before all the following reads */
+                dma_rmb();
+                netif_info(mdp, tx_done, ndev,
+                           "tx entry %d status 0x%08x\n",
+                           entry, le32_to_cpu(txdesc->status));
+                /* Free the original skb. */
+                if (mdp->tx_skbuff[entry]) {
+                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
+                                         le32_to_cpu(txdesc->len) >> 16,
+                                         DMA_TO_DEVICE);
+                        dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
+                        mdp->tx_skbuff[entry] = NULL;
+                        free_num++;
+                }
+                txdesc->status = cpu_to_le32(TD_TFP);
+                if (entry >= mdp->num_tx_ring - 1)
+                        txdesc->status |= cpu_to_le32(TD_TDLE);
+
+                if (sent) {
+                        ndev->stats.tx_packets++;
+                        ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
+                }
+        }
+        return free_num;
+}
+
 /* free skb and descriptor buffer */
 static void sh_eth_ring_free(struct net_device *ndev)
 {
         struct sh_eth_private *mdp = netdev_priv(ndev);
         int ringsize, i;
 
+        if (mdp->rx_ring) {
+                for (i = 0; i < mdp->num_rx_ring; i++) {
+                        if (mdp->rx_skbuff[i]) {
+                                struct sh_eth_rxdesc *rxdesc = &mdp->rx_ring[i];
+
+                                dma_unmap_single(&ndev->dev,
+                                                 le32_to_cpu(rxdesc->addr),
+                                                 ALIGN(mdp->rx_buf_sz, 32),
+                                                 DMA_FROM_DEVICE);
+                        }
+                }
+                ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
+                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
+                                  mdp->rx_desc_dma);
+                mdp->rx_ring = NULL;
+        }
+
         /* Free Rx skb ringbuffer */
         if (mdp->rx_skbuff) {
                 for (i = 0; i < mdp->num_rx_ring; i++)
@@ -1141,27 +1199,18 @@ static void sh_eth_ring_free(struct net_device *ndev)
         kfree(mdp->rx_skbuff);
         mdp->rx_skbuff = NULL;
 
-        /* Free Tx skb ringbuffer */
-        if (mdp->tx_skbuff) {
-                for (i = 0; i < mdp->num_tx_ring; i++)
-                        dev_kfree_skb(mdp->tx_skbuff[i]);
-        }
-        kfree(mdp->tx_skbuff);
-        mdp->tx_skbuff = NULL;
-
-        if (mdp->rx_ring) {
-                ringsize = sizeof(struct sh_eth_rxdesc) * mdp->num_rx_ring;
-                dma_free_coherent(NULL, ringsize, mdp->rx_ring,
-                                  mdp->rx_desc_dma);
-                mdp->rx_ring = NULL;
-        }
-
         if (mdp->tx_ring) {
+                sh_eth_tx_free(ndev, false);
+
                 ringsize = sizeof(struct sh_eth_txdesc) * mdp->num_tx_ring;
                 dma_free_coherent(NULL, ringsize, mdp->tx_ring,
                                   mdp->tx_desc_dma);
                 mdp->tx_ring = NULL;
         }
+
+        /* Free Tx skb ringbuffer */
+        kfree(mdp->tx_skbuff);
+        mdp->tx_skbuff = NULL;
 }
 
 /* format skb and descriptor buffer */
@@ -1409,43 +1458,6 @@ static void sh_eth_dev_exit(struct net_device *ndev)
         update_mac_address(ndev);
 }
 
-/* free Tx skb function */
-static int sh_eth_txfree(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-        struct sh_eth_txdesc *txdesc;
-        int free_num = 0;
-        int entry;
-
-        for (; mdp->cur_tx - mdp->dirty_tx > 0; mdp->dirty_tx++) {
-                entry = mdp->dirty_tx % mdp->num_tx_ring;
-                txdesc = &mdp->tx_ring[entry];
-                if (txdesc->status & cpu_to_le32(TD_TACT))
-                        break;
-                /* TACT bit must be checked before all the following reads */
-                dma_rmb();
-                netif_info(mdp, tx_done, ndev,
-                           "tx entry %d status 0x%08x\n",
-                           entry, le32_to_cpu(txdesc->status));
-                /* Free the original skb. */
-                if (mdp->tx_skbuff[entry]) {
-                        dma_unmap_single(&ndev->dev, le32_to_cpu(txdesc->addr),
-                                         le32_to_cpu(txdesc->len) >> 16,
-                                         DMA_TO_DEVICE);
-                        dev_kfree_skb_irq(mdp->tx_skbuff[entry]);
-                        mdp->tx_skbuff[entry] = NULL;
-                        free_num++;
-                }
-                txdesc->status = cpu_to_le32(TD_TFP);
-                if (entry >= mdp->num_tx_ring - 1)
-                        txdesc->status |= cpu_to_le32(TD_TDLE);
-
-                ndev->stats.tx_packets++;
-                ndev->stats.tx_bytes += le32_to_cpu(txdesc->len) >> 16;
-        }
-        return free_num;
-}
-
 /* Packet receive function */
 static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
 {
@@ -1690,7 +1702,7 @@ static void sh_eth_error(struct net_device *ndev, u32 intr_status)
                            intr_status, mdp->cur_tx, mdp->dirty_tx,
                            (u32)ndev->state, edtrr);
                 /* dirty buffer free */
-                sh_eth_txfree(ndev);
+                sh_eth_tx_free(ndev, true);
 
                 /* SH7712 BUG */
                 if (edtrr ^ sh_eth_get_edtrr_trns(mdp)) {
@@ -1751,7 +1763,7 @@ static irqreturn_t sh_eth_interrupt(int irq, void *netdev)
                 /* Clear Tx interrupts */
                 sh_eth_write(ndev, intr_status & cd->tx_check, EESR);
 
-                sh_eth_txfree(ndev);
+                sh_eth_tx_free(ndev, true);
                 netif_wake_queue(ndev);
         }
 
@@ -2412,7 +2424,7 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
 
         spin_lock_irqsave(&mdp->lock, flags);
         if ((mdp->cur_tx - mdp->dirty_tx) >= (mdp->num_tx_ring - 4)) {
-                if (!sh_eth_txfree(ndev)) {
+                if (!sh_eth_tx_free(ndev, true)) {
                         netif_warn(mdp, tx_queued, ndev, "TxFD exhausted.\n");
                         netif_stop_queue(ndev);
                         spin_unlock_irqrestore(&mdp->lock, flags);
diff --git a/drivers/net/phy/dp83640.c b/drivers/net/phy/dp83640.c
index e2460a57e4b1..ed0d10f54f26 100644
--- a/drivers/net/phy/dp83640.c
+++ b/drivers/net/phy/dp83640.c
@@ -1438,8 +1438,6 @@ static bool dp83640_rxtstamp(struct phy_device *phydev,
                 skb_info->tmo = jiffies + SKB_TIMESTAMP_TIMEOUT;
                 skb_queue_tail(&dp83640->rx_queue, skb);
                 schedule_delayed_work(&dp83640->ts_work, SKB_TIMESTAMP_TIMEOUT);
-        } else {
-                netif_rx_ni(skb);
         }
 
         return true;
diff --git a/drivers/net/usb/ch9200.c b/drivers/net/usb/ch9200.c
index 8a40202c0a17..c4f1c363e24b 100644
--- a/drivers/net/usb/ch9200.c
+++ b/drivers/net/usb/ch9200.c
@@ -254,14 +254,9 @@ static struct sk_buff *ch9200_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
         tx_overhead = 0x40;
 
         len = skb->len;
-        if (skb_headroom(skb) < tx_overhead) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, tx_overhead, 0, flags);
+        if (skb_cow_head(skb, tx_overhead)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         __skb_push(skb, tx_overhead);
diff --git a/drivers/net/usb/cx82310_eth.c b/drivers/net/usb/cx82310_eth.c
index e221bfcee76b..947bea81d924 100644
--- a/drivers/net/usb/cx82310_eth.c
+++ b/drivers/net/usb/cx82310_eth.c
@@ -293,12 +293,9 @@ static struct sk_buff *cx82310_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 {
         int len = skb->len;
 
-        if (skb_headroom(skb) < 2) {
-                struct sk_buff *skb2 = skb_copy_expand(skb, 2, 0, flags);
+        if (skb_cow_head(skb, 2)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
         skb_push(skb, 2);
 
diff --git a/drivers/net/usb/kaweth.c b/drivers/net/usb/kaweth.c
index 876f02f4945e..2a2c3edb6bad 100644
--- a/drivers/net/usb/kaweth.c
+++ b/drivers/net/usb/kaweth.c
@@ -803,18 +803,12 @@ static netdev_tx_t kaweth_start_xmit(struct sk_buff *skb,
         }
 
         /* We now decide whether we can put our special header into the sk_buff */
-        if (skb_cloned(skb) || skb_headroom(skb) < 2) {
-                /* no such luck - we make our own */
-                struct sk_buff *copied_skb;
-                copied_skb = skb_copy_expand(skb, 2, 0, GFP_ATOMIC);
-                dev_kfree_skb_irq(skb);
-                skb = copied_skb;
-                if (!copied_skb) {
-                        kaweth->stats.tx_errors++;
-                        netif_start_queue(net);
-                        spin_unlock_irq(&kaweth->device_lock);
-                        return NETDEV_TX_OK;
-                }
+        if (skb_cow_head(skb, 2)) {
+                kaweth->stats.tx_errors++;
+                netif_start_queue(net);
+                spin_unlock_irq(&kaweth->device_lock);
+                dev_kfree_skb_any(skb);
+                return NETDEV_TX_OK;
         }
 
         private_header = (__le16 *)__skb_push(skb, 2);
diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
index 9889a70ff4f6..636f48f19d1e 100644
--- a/drivers/net/usb/lan78xx.c
+++ b/drivers/net/usb/lan78xx.c
@@ -2607,14 +2607,9 @@ static struct sk_buff *lan78xx_tx_prep(struct lan78xx_net *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        if (skb_headroom(skb) < TX_OVERHEAD) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         if (lan78xx_linearize(skb) < 0)
diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
index 0b17b40d7a4f..190de9a90f73 100644
--- a/drivers/net/usb/smsc75xx.c
+++ b/drivers/net/usb/smsc75xx.c
@@ -2203,13 +2203,9 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
 {
         u32 tx_cmd_a, tx_cmd_b;
 
-        if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
-                struct sk_buff *skb2 =
-                        skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, SMSC75XX_TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         tx_cmd_a = (u32)(skb->len & TX_CMD_A_LEN) | TX_CMD_A_FCS;
diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index 831aa33d078a..5f19fb0f025d 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c
@@ -2001,13 +2001,13 @@ static struct sk_buff *smsc95xx_tx_fixup(struct usbnet *dev,
         /* We do not advertise SG, so skbs should be already linearized */
         BUG_ON(skb_shinfo(skb)->nr_frags);
 
-        if (skb_headroom(skb) < overhead) {
-                struct sk_buff *skb2 = skb_copy_expand(skb,
-                        overhead, 0, flags);
+        /* Make writable and expand header space by overhead if required */
+        if (skb_cow_head(skb, overhead)) {
+                /* Must deallocate here as returning NULL to indicate error
+                 * means the skb won't be deallocated in the caller.
+                 */
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         if (csum) {
diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index 4a1e9c489f1f..aadfe1d1c37e 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c
@@ -456,14 +456,9 @@ static struct sk_buff *sr9700_tx_fixup(struct usbnet *dev, struct sk_buff *skb,
 
         len = skb->len;
 
-        if (skb_headroom(skb) < SR_TX_OVERHEAD) {
-                struct sk_buff *skb2;
-
-                skb2 = skb_copy_expand(skb, SR_TX_OVERHEAD, 0, flags);
+        if (skb_cow_head(skb, SR_TX_OVERHEAD)) {
                 dev_kfree_skb_any(skb);
-                skb = skb2;
-                if (!skb)
-                        return NULL;
+                return NULL;
         }
 
         __skb_push(skb, SR_TX_OVERHEAD);