Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	drivers/net/usb/asix_common.c
	drivers/net/usb/sr9800.c
	drivers/net/usb/usbnet.c
	include/linux/usb/usbnet.h
	net/ipv4/tcp_ipv4.c
	net/ipv6/tcp_ipv6.c

The TCP conflicts were overlapping changes.  In 'net' we added a
READ_ONCE() to the socket cached RX route read, whilst in 'net-next'
Eric Dumazet touched the surrounding code dealing with how mini
sockets are handled.

With USB, it's a case of the same bug fix first going into net-next
and then I cherry picked it back into net.

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 17 insertions, 11 deletions

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index e5e96b0f6717..ce6396a75b8b 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -338,7 +338,7 @@ static LIST_HEAD(cleanup_list);  /* Must hold cleanup_list_lock to touch */
 static void cleanup_net(struct work_struct *work)
 {
         const struct pernet_operations *ops;
-        struct net *net, *tmp;
+        struct net *net, *tmp, *peer;
         struct list_head net_kill_list;
         LIST_HEAD(net_exit_list);
 
@@ -354,14 +354,6 @@ static void cleanup_net(struct work_struct *work)
         list_for_each_entry(net, &net_kill_list, cleanup_list) {
                 list_del_rcu(&net->list);
                 list_add_tail(&net->exit_list, &net_exit_list);
-                for_each_net(tmp) {
-                        int id = __peernet2id(tmp, net, false);
-
-                        if (id >= 0)
-                                idr_remove(&tmp->netns_ids, id);
-                }
-                idr_destroy(&net->netns_ids);
-
         }
         rtnl_unlock();
 
@@ -387,12 +379,26 @@ static void cleanup_net(struct work_struct *work)
          */
         rcu_barrier();
 
+        rtnl_lock();
         /* Finally it is safe to free my network namespace structure */
         list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
+                /* Unreference net from all peers (no need to loop over
+                 * net_exit_list because idr_destroy() will be called for each
+                 * element of this list.
+                 */
+                for_each_net(peer) {
+                        int id = __peernet2id(peer, net, false);
+
+                        if (id >= 0)
+                                idr_remove(&peer->netns_ids, id);
+                }
+                idr_destroy(&net->netns_ids);
+
                 list_del_init(&net->exit_list);
                 put_user_ns(net->user_ns);
                 net_drop_ns(net);
         }
+        rtnl_unlock();
 }
 static DECLARE_WORK(net_cleanup_work, cleanup_net);
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index ee0186cdd5cf..5e02260b087f 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1991,10 +1991,10 @@ static int rtnl_group_changelink(const struct sk_buff *skb,
                 struct ifinfomsg *ifm,
                 struct nlattr **tb)
 {
-        struct net_device *dev;
+        struct net_device *dev, *aux;
         int err;
 
-        for_each_netdev(net, dev) {
+        for_each_netdev_safe(net, dev, aux) {
                 if (dev->group == group) {
                         err = do_setlink(skb, dev, ifm, tb, NULL, 0);
                         if (err < 0)