Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix NAPI poll list corruption in enic driver, from Christian
    Lamparter.

 2) Fix route use after free, from Eric Dumazet.

 3) Fix regression in reuseaddr handling, from Josef Bacik.

 4) Assert the size of control messages in compat handling since we copy
    it in from userspace twice. From Meng Xu.

 5) SMC layer bug fixes (missing RCU locking, bad refcounting, etc.)
    from Ursula Braun.

 6) Fix races in AF_PACKET fanout handling, from Willem de Bruijn.

 7) Don't use ARRAY_SIZE on spinlock array which might have zero
    entries, from Geert Uytterhoeven.

 8) Fix miscomputation of checksum in ipv6 udp code, from Subash Abhinov
    Kasiviswanathan.

 9) Push the ipv6 header properly in ipv6 GRE tunnel driver, from Xin
    Long.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (75 commits)
  inet: fix improper empty comparison
  net: use inet6_rcv_saddr to compare sockets
  net: set tb->fast_sk_family
  net: orphan frags on stand-alone ptype in dev_queue_xmit_nit
  MAINTAINERS: update git tree locations for ieee802154 subsystem
  net: prevent dst uses after free
  net: phy: Fix truncation of large IRQ numbers in phy_attached_print()
  net/smc: no close wait in case of process shut down
  net/smc: introduce a delay
  net/smc: terminate link group if out-of-sync is received
  net/smc: longer delay for client link group removal
  net/smc: adapt send request completion notification
  net/smc: adjust net_device refcount
  net/smc: take RCU read lock for routing cache lookup
  net/smc: add receive timeout check
  net/smc: add missing dev_put
  net: stmmac: Cocci spatch "of_table"
  lan78xx: Use default values loaded from EEPROM/OTP after reset
  lan78xx: Allow EEPROM write for less than MAX_EEPROM_SIZE
  lan78xx: Fix for eeprom read/write when device auto suspend
  ...

4 files changed, 16 insertions, 6 deletions

diff --git a/kernel/bpf/devmap.c b/kernel/bpf/devmap.c
index 959c9a07f318..e093d9a2c4dd 100644
--- a/kernel/bpf/devmap.c
+++ b/kernel/bpf/devmap.c
@@ -75,8 +75,8 @@ static u64 dev_map_bitmap_size(const union bpf_attr *attr)
 static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
 {
         struct bpf_dtab *dtab;
+        int err = -EINVAL;
         u64 cost;
-        int err;
 
         /* check sanity of attributes */
         if (attr->max_entries == 0 || attr->key_size != 4 ||
@@ -108,6 +108,8 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
         if (err)
                 goto free_dtab;
 
+        err = -ENOMEM;
+
         /* A per cpu bitfield with a bit per possible net device */
         dtab->flush_needed = __alloc_percpu(dev_map_bitmap_size(attr),
                                             __alignof__(unsigned long));
@@ -128,7 +130,7 @@ static struct bpf_map *dev_map_alloc(union bpf_attr *attr)
 free_dtab:
         free_percpu(dtab->flush_needed);
         kfree(dtab);
-        return ERR_PTR(-ENOMEM);
+        return ERR_PTR(err);
 }
 
 static void dev_map_free(struct bpf_map *map)
diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index cb17e1cd1d43..25d074920a00 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c
@@ -186,15 +186,17 @@ static int bpf_map_alloc_id(struct bpf_map *map)
 
 static void bpf_map_free_id(struct bpf_map *map, bool do_idr_lock)
 {
+        unsigned long flags;
+
         if (do_idr_lock)
-                spin_lock_bh(&map_idr_lock);
+                spin_lock_irqsave(&map_idr_lock, flags);
         else
                 __acquire(&map_idr_lock);
 
         idr_remove(&map_idr, map->id);
 
         if (do_idr_lock)
-                spin_unlock_bh(&map_idr_lock);
+                spin_unlock_irqrestore(&map_idr_lock, flags);
         else
                 __release(&map_idr_lock);
 }
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 799b2451ef2d..b914fbe1383e 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -4205,7 +4205,12 @@ static int fixup_bpf_calls(struct bpf_verifier_env *env)
                 }
 
                 if (insn->imm == BPF_FUNC_redirect_map) {
-                        u64 addr = (unsigned long)prog;
+                        /* Note, we cannot use prog directly as imm as subsequent
+                         * rewrites would still change the prog pointer. The only
+                         * stable address we can use is aux, which also works with
+                         * prog clones during blinding.
+                         */
+                        u64 addr = (unsigned long)prog->aux;
                         struct bpf_insn r4_ld[] = {
                                 BPF_LD_IMM64(BPF_REG_4, addr),
                                 *insn,
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 3e691b75b2db..6bc21e202ae4 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8171,6 +8171,7 @@ static int perf_event_set_bpf_prog(struct perf_event *event, u32 prog_fd)
                 }
         }
         event->tp_event->prog = prog;
+        event->tp_event->bpf_prog_owner = event;
 
         return 0;
 }
@@ -8185,7 +8186,7 @@ static void perf_event_free_bpf_prog(struct perf_event *event)
                 return;
 
         prog = event->tp_event->prog;
-        if (prog) {
+        if (prog && event->tp_event->bpf_prog_owner == event) {
                 event->tp_event->prog = NULL;
                 bpf_prog_put(prog);
         }