Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Clear congestion control state when changing algorithms on an
    existing socket, from Florian Westphal.

 2) Fix register bit values in altr_tse_pcs portion of stmmac driver,
    from Jia Jie Ho.

 3) Fix PTP handling in stammc driver for GMAC4, from Giuseppe
    CAVALLARO.

 4) Fix udplite multicast delivery handling, it ignores the udp_table
    parameter passed into the lookups, from Pablo Neira Ayuso.

 5) Synchronize the space estimated by rtnl_vfinfo_size and the space
    actually used by rtnl_fill_vfinfo. From Sabrina Dubroca.

 6) Fix memory leak in fib_info when splitting nodes, from Alexander
    Duyck.

 7) If a driver does a napi_hash_del() explicitily and not via
    netif_napi_del(), it must perform RCU synchronization as needed. Fix
    this in virtio-net and bnxt drivers, from Eric Dumazet.

 8) Likewise, it is not necessary to invoke napi_hash_del() is we are
    also doing neif_napi_del() in the same code path. Remove such calls
    from be2net and cxgb4 drivers, also from Eric Dumazet.

 9) Don't allocate an ID in peernet2id_alloc() if the netns is dead,
    from WANG Cong.

10) Fix OF node and device struct leaks in of_mdio, from Johan Hovold.

11) We cannot cache routes in ip6_tunnel when using inherited traffic
    classes, from Paolo Abeni.

12) Fix several crashes and leaks in cpsw driver, from Johan Hovold.

13) Splice operations cannot use freezable blocking calls in AF_UNIX,
    from WANG Cong.

14) Link dump filtering by master device and kind support added an error
    in loop index updates during the dump if we actually do filter, fix
    from Zhang Shengju.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (59 commits)
  tcp: zero ca_priv area when switching cc algorithms
  net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit
  ethernet: stmmac: make DWMAC_STM32 depend on it's associated SoC
  tipc: eliminate obsolete socket locking policy description
  rtnl: fix the loop index update error in rtnl_dump_ifinfo()
  l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()
  net: macb: add check for dma mapping error in start_xmit()
  rtnetlink: fix FDB size computation
  netns: fix get_net_ns_by_fd(int pid) typo
  af_unix: conditionally use freezable blocking calls in read
  net: ethernet: ti: cpsw: fix fixed-link phy probe deferral
  net: ethernet: ti: cpsw: add missing sanity check
  net: ethernet: ti: cpsw: fix secondary-emac probe error path
  net: ethernet: ti: cpsw: fix of_node and phydev leaks
  net: ethernet: ti: cpsw: fix deferred probe
  net: ethernet: ti: cpsw: fix mdio device reference leak
  net: ethernet: ti: cpsw: fix bad register access in probe error path
  net: sky2: Fix shutdown crash
  cfg80211: limit scan results cache size
  net sched filters: pass netlink message flags in event notification
  ...

1 files changed, 47 insertions, 23 deletions

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 99a7e5b388f2..6a936159c6e0 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -216,8 +216,8 @@ static void print_verifier_state(struct bpf_verifier_state *state)
                                 reg->map_ptr->key_size,
                                 reg->map_ptr->value_size);
                 if (reg->min_value != BPF_REGISTER_MIN_RANGE)
-                        verbose(",min_value=%llu",
-                                (unsigned long long)reg->min_value);
+                        verbose(",min_value=%lld",
+                                (long long)reg->min_value);
                 if (reg->max_value != BPF_REGISTER_MAX_RANGE)
                         verbose(",max_value=%llu",
                                 (unsigned long long)reg->max_value);
@@ -758,7 +758,7 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
                          * index'es we need to make sure that whatever we use
                          * will have a set floor within our range.
                          */
-                        if ((s64)reg->min_value < 0) {
+                        if (reg->min_value < 0) {
                                 verbose("R%d min value is negative, either use unsigned index or do a if (index >=0) check.\n",
                                         regno);
                                 return -EACCES;
@@ -1468,7 +1468,8 @@ static void check_reg_overflow(struct bpf_reg_state *reg)
 {
         if (reg->max_value > BPF_REGISTER_MAX_RANGE)
                 reg->max_value = BPF_REGISTER_MAX_RANGE;
-        if ((s64)reg->min_value < BPF_REGISTER_MIN_RANGE)
+        if (reg->min_value < BPF_REGISTER_MIN_RANGE ||
+            reg->min_value > BPF_REGISTER_MAX_RANGE)
                 reg->min_value = BPF_REGISTER_MIN_RANGE;
 }
 
@@ -1476,7 +1477,8 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                                     struct bpf_insn *insn)
 {
         struct bpf_reg_state *regs = env->cur_state.regs, *dst_reg;
-        u64 min_val = BPF_REGISTER_MIN_RANGE, max_val = BPF_REGISTER_MAX_RANGE;
+        s64 min_val = BPF_REGISTER_MIN_RANGE;
+        u64 max_val = BPF_REGISTER_MAX_RANGE;
         bool min_set = false, max_set = false;
         u8 opcode = BPF_OP(insn->code);
 
@@ -1512,22 +1514,43 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                 return;
         }
 
+        /* If one of our values was at the end of our ranges then we can't just
+         * do our normal operations to the register, we need to set the values
+         * to the min/max since they are undefined.
+         */
+        if (min_val == BPF_REGISTER_MIN_RANGE)
+                dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
+        if (max_val == BPF_REGISTER_MAX_RANGE)
+                dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
+
         switch (opcode) {
         case BPF_ADD:
-                dst_reg->min_value += min_val;
-                dst_reg->max_value += max_val;
+                if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
+                        dst_reg->min_value += min_val;
+                if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
+                        dst_reg->max_value += max_val;
                 break;
         case BPF_SUB:
-                dst_reg->min_value -= min_val;
-                dst_reg->max_value -= max_val;
+                if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
+                        dst_reg->min_value -= min_val;
+                if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
+                        dst_reg->max_value -= max_val;
                 break;
         case BPF_MUL:
-                dst_reg->min_value *= min_val;
-                dst_reg->max_value *= max_val;
+                if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
+                        dst_reg->min_value *= min_val;
+                if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
+                        dst_reg->max_value *= max_val;
                 break;
         case BPF_AND:
-                /* & is special since it could end up with 0 bits set. */
-                dst_reg->min_value &= min_val;
+                /* Disallow AND'ing of negative numbers, ain't nobody got time
+                 * for that.  Otherwise the minimum is 0 and the max is the max
+                 * value we could AND against.
+                 */
+                if (min_val < 0)
+                        dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
+                else
+                        dst_reg->min_value = 0;
                 dst_reg->max_value = max_val;
                 break;
         case BPF_LSH:
@@ -1537,24 +1560,25 @@ static void adjust_reg_min_max_vals(struct bpf_verifier_env *env,
                  */
                 if (min_val > ilog2(BPF_REGISTER_MAX_RANGE))
                         dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
-                else
+                else if (dst_reg->min_value != BPF_REGISTER_MIN_RANGE)
                         dst_reg->min_value <<= min_val;
 
                 if (max_val > ilog2(BPF_REGISTER_MAX_RANGE))
                         dst_reg->max_value = BPF_REGISTER_MAX_RANGE;
-                else
+                else if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
                         dst_reg->max_value <<= max_val;
                 break;
         case BPF_RSH:
-                dst_reg->min_value >>= min_val;
-                dst_reg->max_value >>= max_val;
-                break;
-        case BPF_MOD:
-                /* % is special since it is an unsigned modulus, so the floor
-                 * will always be 0.
+                /* RSH by a negative number is undefined, and the BPF_RSH is an
+                 * unsigned shift, so make the appropriate casts.
                  */
-                dst_reg->min_value = 0;
-                dst_reg->max_value = max_val - 1;
+                if (min_val < 0 || dst_reg->min_value < 0)
+                        dst_reg->min_value = BPF_REGISTER_MIN_RANGE;
+                else
+                        dst_reg->min_value =
+                                (u64)(dst_reg->min_value) >> min_val;
+                if (dst_reg->max_value != BPF_REGISTER_MAX_RANGE)
+                        dst_reg->max_value >>= max_val;
                 break;
         default:
                 reset_reg_range_values(regs, insn->dst_reg);