Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Couple conflicts resolved here:

1) In the MACB driver, a bug fix to properly initialize the
   RX tail pointer properly overlapped with some changes
   to support variable sized rings.

2) In XGBE we had a "CONFIG_PM" --> "CONFIG_PM_SLEEP" fix
   overlapping with a reorganization of the driver to support
   ACPI, OF, as well as PCI variants of the chip.

3) In 'net' we had several probe error path bug fixes to the
   stmmac driver, meanwhile a lot of this code was cleaned up
   and reorganized in 'net-next'.

4) The cls_flower classifier obtained a helper function in
   'net-next' called __fl_delete() and this overlapped with
   Daniel Borkamann's bug fix to use RCU for object destruction
   in 'net'.  It also overlapped with Jiri's change to guard
   the rhashtable_remove_fast() call with a check against
   tc_skip_sw().

5) In mlx4, a revert bug fix in 'net' overlapped with some
   unrelated changes in 'net-next'.

6) In geneve, a stale header pointer after pskb_expand_head()
   bug fix in 'net' overlapped with a large reorganization of
   the same code in 'net-next'.  Since the 'net-next' code no
   longer had the bug in question, there was nothing to do
   other than to simply take the 'net-next' hunks.

Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 8 insertions, 2 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 8135cb1077ee..0e742210750e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -2508,6 +2508,7 @@ static bool states_equal(struct bpf_verifier_env *env,
                          struct bpf_verifier_state *old,
                          struct bpf_verifier_state *cur)
 {
+        bool varlen_map_access = env->varlen_map_value_access;
         struct bpf_reg_state *rold, *rcur;
         int i;
 
@@ -2521,12 +2522,17 @@ static bool states_equal(struct bpf_verifier_env *env,
                 /* If the ranges were not the same, but everything else was and
                  * we didn't do a variable access into a map then we are a-ok.
                  */
-                if (!env->varlen_map_value_access &&
+                if (!varlen_map_access &&
                     rold->type == rcur->type && rold->imm == rcur->imm)
                         continue;
 
+                /* If we didn't map access then again we don't care about the
+                 * mismatched range values and it's ok if our old type was
+                 * UNKNOWN and we didn't go to a NOT_INIT'ed reg.
+                 */
                 if (rold->type == NOT_INIT ||
-                    (rold->type == UNKNOWN_VALUE && rcur->type != NOT_INIT))
+                    (!varlen_map_access && rold->type == UNKNOWN_VALUE &&
+                     rcur->type != NOT_INIT))
                         continue;
 
                 if (rold->type == PTR_TO_PACKET && rcur->type == PTR_TO_PACKET &&