Merge tag 'nand/fixes-for-4.12-rc3' of git://git.infradead.org/linux-mtd into MTD

From Boris:
"""
This pull request contains several fixes to the core and the tango
driver.

tango fixes:
 * Add missing MODULE_DEVICE_TABLE() in tango_nand.c
 * Update the number of corrected bitflips

core fixes:
 * Fix a long standing memory leak in nand_scan_tail()
 * Fix several bugs introduced by the per-vendor init/detection
   infrastructure (introduced in 4.12)
 * Add a static specifier to nand_ooblayout_lp_hamming_ops definition
"""

4 files changed, 103 insertions, 72 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 96cf83da0d66..fca407b4a6ea 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6852,6 +6852,32 @@ int dev_change_proto_down(struct net_device *dev, bool proto_down)
 }
 EXPORT_SYMBOL(dev_change_proto_down);
 
+bool __dev_xdp_attached(struct net_device *dev, xdp_op_t xdp_op)
+{
+        struct netdev_xdp xdp;
+
+        memset(&xdp, 0, sizeof(xdp));
+        xdp.command = XDP_QUERY_PROG;
+
+        /* Query must always succeed. */
+        WARN_ON(xdp_op(dev, &xdp) < 0);
+        return xdp.prog_attached;
+}
+
+static int dev_xdp_install(struct net_device *dev, xdp_op_t xdp_op,
+                           struct netlink_ext_ack *extack,
+                           struct bpf_prog *prog)
+{
+        struct netdev_xdp xdp;
+
+        memset(&xdp, 0, sizeof(xdp));
+        xdp.command = XDP_SETUP_PROG;
+        xdp.extack = extack;
+        xdp.prog = prog;
+
+        return xdp_op(dev, &xdp);
+}
+
 /**
  *      dev_change_xdp_fd - set or clear a bpf program for a device rx path
  *      @dev: device
@@ -6864,41 +6890,34 @@ EXPORT_SYMBOL(dev_change_proto_down);
 int dev_change_xdp_fd(struct net_device *dev, struct netlink_ext_ack *extack,
                       int fd, u32 flags)
 {
-        int (*xdp_op)(struct net_device *dev, struct netdev_xdp *xdp);
         const struct net_device_ops *ops = dev->netdev_ops;
         struct bpf_prog *prog = NULL;
-        struct netdev_xdp xdp;
+        xdp_op_t xdp_op, xdp_chk;
         int err;
 
         ASSERT_RTNL();
 
-        xdp_op = ops->ndo_xdp;
+        xdp_op = xdp_chk = ops->ndo_xdp;
+        if (!xdp_op && (flags & XDP_FLAGS_DRV_MODE))
+                return -EOPNOTSUPP;
         if (!xdp_op || (flags & XDP_FLAGS_SKB_MODE))
                 xdp_op = generic_xdp_install;
+        if (xdp_op == xdp_chk)
+                xdp_chk = generic_xdp_install;
 
         if (fd >= 0) {
-                if (flags & XDP_FLAGS_UPDATE_IF_NOEXIST) {
-                        memset(&xdp, 0, sizeof(xdp));
-                        xdp.command = XDP_QUERY_PROG;
-
-                        err = xdp_op(dev, &xdp);
-                        if (err < 0)
-                                return err;
-                        if (xdp.prog_attached)
-                                return -EBUSY;
-                }
+                if (xdp_chk && __dev_xdp_attached(dev, xdp_chk))
+                        return -EEXIST;
+                if ((flags & XDP_FLAGS_UPDATE_IF_NOEXIST) &&
+                    __dev_xdp_attached(dev, xdp_op))
+                        return -EBUSY;
 
                 prog = bpf_prog_get_type(fd, BPF_PROG_TYPE_XDP);
                 if (IS_ERR(prog))
                         return PTR_ERR(prog);
         }
 
-        memset(&xdp, 0, sizeof(xdp));
-        xdp.command = XDP_SETUP_PROG;
-        xdp.extack = extack;
-        xdp.prog = prog;
-
-        err = xdp_op(dev, &xdp);
+        err = dev_xdp_install(dev, xdp_op, extack, prog);
         if (err < 0 && prog)
                 bpf_prog_put(prog);
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 58b0bcc125b5..d274f81fcc2c 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1132,10 +1132,6 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 lladdr = neigh->ha;
         }
 
-        if (new & NUD_CONNECTED)
-                neigh->confirmed = jiffies;
-        neigh->updated = jiffies;
-
         /* If entry was valid and address is not changed,
            do not change entry state, if new one is STALE.
          */
@@ -1157,6 +1153,16 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 }
         }
 
+        /* Update timestamps only once we know we will make a change to the
+         * neighbour entry. Otherwise we risk to move the locktime window with
+         * noop updates and ignore relevant ARP updates.
+         */
+        if (new != old || lladdr != neigh->ha) {
+                if (new & NUD_CONNECTED)
+                        neigh->confirmed = jiffies;
+                neigh->updated = jiffies;
+        }
+
         if (new != old) {
                 neigh_del_timer(neigh);
                 if (new & NUD_PROBE)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index bcb0f610ee42..49a279a7cc15 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -899,8 +899,7 @@ static size_t rtnl_port_size(const struct net_device *dev,
 static size_t rtnl_xdp_size(void)
 {
         size_t xdp_size = nla_total_size(0) +   /* nest IFLA_XDP */
-                          nla_total_size(1) +   /* XDP_ATTACHED */
-                          nla_total_size(4);    /* XDP_FLAGS */
+                          nla_total_size(1);    /* XDP_ATTACHED */
 
         return xdp_size;
 }
@@ -1247,37 +1246,34 @@ static int rtnl_fill_link_ifmap(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
+static u8 rtnl_xdp_attached_mode(struct net_device *dev)
+{
+        const struct net_device_ops *ops = dev->netdev_ops;
+
+        ASSERT_RTNL();
+
+        if (rcu_access_pointer(dev->xdp_prog))
+                return XDP_ATTACHED_SKB;
+        if (ops->ndo_xdp && __dev_xdp_attached(dev, ops->ndo_xdp))
+                return XDP_ATTACHED_DRV;
+
+        return XDP_ATTACHED_NONE;
+}
+
 static int rtnl_xdp_fill(struct sk_buff *skb, struct net_device *dev)
 {
         struct nlattr *xdp;
-        u32 xdp_flags = 0;
-        u8 val = 0;
         int err;
 
         xdp = nla_nest_start(skb, IFLA_XDP);
         if (!xdp)
                 return -EMSGSIZE;
-        if (rcu_access_pointer(dev->xdp_prog)) {
-                xdp_flags = XDP_FLAGS_SKB_MODE;
-                val = 1;
-        } else if (dev->netdev_ops->ndo_xdp) {
-                struct netdev_xdp xdp_op = {};
-
-                xdp_op.command = XDP_QUERY_PROG;
-                err = dev->netdev_ops->ndo_xdp(dev, &xdp_op);
-                if (err)
-                        goto err_cancel;
-                val = xdp_op.prog_attached;
-        }
-        err = nla_put_u8(skb, IFLA_XDP_ATTACHED, val);
+
+        err = nla_put_u8(skb, IFLA_XDP_ATTACHED,
+                         rtnl_xdp_attached_mode(dev));
         if (err)
                 goto err_cancel;
 
-        if (xdp_flags) {
-                err = nla_put_u32(skb, IFLA_XDP_FLAGS, xdp_flags);
-                if (err)
-                        goto err_cancel;
-        }
         nla_nest_end(skb, xdp);
         return 0;
 
@@ -1631,13 +1627,13 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                                                cb->nlh->nlmsg_seq, 0,
                                                flags,
                                                ext_filter_mask);
-                        /* If we ran out of room on the first message,
-                         * we're in trouble
-                         */
-                        WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
 
-                        if (err < 0)
-                                goto out;
+                        if (err < 0) {
+                                if (likely(skb->len))
+                                        goto out;
+
+                                goto out_err;
+                        }
 
                         nl_dump_check_consistent(cb, nlmsg_hdr(skb));
 cont:
@@ -1645,10 +1641,12 @@ cont:
                 }
         }
 out:
+        err = skb->len;
+out_err:
         cb->args[1] = idx;
         cb->args[0] = h;
 
-        return skb->len;
+        return err;
 }
 
 int rtnl_nla_parse_ifla(struct nlattr **tb, const struct nlattr *head, int len,
@@ -2199,6 +2197,11 @@ static int do_setlink(const struct sk_buff *skb,
                                 err = -EINVAL;
                                 goto errout;
                         }
+                        if ((xdp_flags & XDP_FLAGS_SKB_MODE) &&
+                            (xdp_flags & XDP_FLAGS_DRV_MODE)) {
+                                err = -EINVAL;
+                                goto errout;
+                        }
                 }
 
                 if (xdp[IFLA_XDP_FD]) {
@@ -3452,8 +3455,12 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                                 err = br_dev->netdev_ops->ndo_bridge_getlink(
                                                 skb, portid, seq, dev,
                                                 filter_mask, NLM_F_MULTI);
-                                if (err < 0 && err != -EOPNOTSUPP)
-                                        break;
+                                if (err < 0 && err != -EOPNOTSUPP) {
+                                        if (likely(skb->len))
+                                                break;
+
+                                        goto out_err;
+                                }
                         }
                         idx++;
                 }
@@ -3464,16 +3471,22 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
                                                               seq, dev,
                                                               filter_mask,
                                                               NLM_F_MULTI);
-                                if (err < 0 && err != -EOPNOTSUPP)
-                                        break;
+                                if (err < 0 && err != -EOPNOTSUPP) {
+                                        if (likely(skb->len))
+                                                break;
+
+                                        goto out_err;
+                                }
                         }
                         idx++;
                 }
         }
+        err = skb->len;
+out_err:
         rcu_read_unlock();
         cb->args[0] = idx;
 
-        return skb->len;
+        return err;
 }
 
 static inline size_t bridge_nlmsg_size(void)
diff --git a/net/core/sock.c b/net/core/sock.c
index 79c6aee6af9b..727f924b7f91 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -139,10 +139,7 @@
 
 #include <trace/events/sock.h>
 
-#ifdef CONFIG_INET
 #include <net/tcp.h>
-#endif
-
 #include <net/busy_poll.h>
 
 static DEFINE_MUTEX(proto_list_mutex);
@@ -1803,28 +1800,24 @@ EXPORT_SYMBOL(skb_set_owner_w);
  * delay queue. We want to allow the owner socket to send more
  * packets, as if they were already TX completed by a typical driver.
  * But we also want to keep skb->sk set because some packet schedulers
- * rely on it (sch_fq for example). So we set skb->truesize to a small
- * amount (1) and decrease sk_wmem_alloc accordingly.
+ * rely on it (sch_fq for example).
  */
 void skb_orphan_partial(struct sk_buff *skb)
 {
-        /* If this skb is a TCP pure ACK or already went here,
-         * we have nothing to do. 2 is already a very small truesize.
-         */
-        if (skb->truesize <= 2)
+        if (skb_is_tcp_pure_ack(skb))
                 return;
 
-        /* TCP stack sets skb->ooo_okay based on sk_wmem_alloc,
-         * so we do not completely orphan skb, but transfert all
-         * accounted bytes but one, to avoid unexpected reorders.
-         */
         if (skb->destructor == sock_wfree
 #ifdef CONFIG_INET
             || skb->destructor == tcp_wfree
 #endif
                 ) {
-                atomic_sub(skb->truesize - 1, &skb->sk->sk_wmem_alloc);
-                skb->truesize = 1;
+                struct sock *sk = skb->sk;
+
+                if (atomic_inc_not_zero(&sk->sk_refcnt)) {
+                        atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
+                        skb->destructor = sock_efree;
+                }
         } else {
                 skb_orphan(skb);
         }