Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix out-of-bounds array access in netfilter ipset, from Jozsef
    Kadlecsik.

 2) Use correct free operation on netfilter conntrack templates, from
    Daniel Borkmann.

 3) Fix route leak in SCTP, from Marcelo Ricardo Leitner.

 4) Fix sizeof(pointer) in mac80211, from Thierry Reding.

 5) Fix cache pointer comparison in ip6mr leading to missed unlock of
    mrt_lock.  From Richard Laing.

 6) rds_conn_lookup() needs to consider network namespace in key
    comparison, from Sowmini Varadhan.

 7) Fix deadlock in TIPC code wrt broadcast link wakeups, from Kolmakov
    Dmitriy.

 8) Fix fd leaks in bpf syscall, from Daniel Borkmann.

 9) Fix error recovery when installing ipv6 multipath routes, we would
    delete the old route before we would know if we could fully commit
    to the new set of nexthops.  Fix from Roopa Prabhu.

10) Fix run-time suspend problems in r8152, from Hayes Wang.

11) In fec, don't program the MAC address into the chip when the clocks
    are gated off.  From Fugang Duan.

12) Fix poll behavior for netlink sockets when using rx ring mmap, from
    Daniel Borkmann.

13) Don't allocate memory with GFP_KERNEL from get_stats64 in r8169
    driver, from Corinna Vinschen.

14) In TCP Cubic congestion control, handle idle periods better where we
    are application limited, in order to keep cwnd from growing out of
    control.  From Eric Dumzet.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (65 commits)
  tcp_cubic: better follow cubic curve after idle period
  tcp: generate CA_EVENT_TX_START on data frames
  xen-netfront: respect user provided max_queues
  xen-netback: respect user provided max_queues
  r8169: Fix sleeping function called during get_stats64, v2
  ether: add IEEE 1722 ethertype - TSN
  netlink, mmap: fix edge-case leakages in nf queue zero-copy
  netlink, mmap: don't walk rx ring on poll if receive queue non-empty
  cxgb4: changes for new firmware 1.14.4.0
  net: fec: add netif status check before set mac address
  r8152: fix the runtime suspend issues
  r8152: split DRIVER_VERSION
  ipv6: fix ifnullfree.cocci warnings
  add microchip LAN88xx phy driver
  stmmac: fix check for phydev being open
  net: qlcnic: delete redundant memsets
  net: mv643xx_eth: use kzalloc
  net: jme: use kzalloc() instead of kmalloc+memset
  net: cavium: liquidio: use kzalloc in setup_glist()
  net: ipv6: use common fib_default_rule_pref
  ...

3 files changed, 175 insertions, 34 deletions

diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 2367a16eae58..9f777ec59a59 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -258,11 +258,6 @@ nla_put_failure:
         return -ENOBUFS;
 }
 
-static u32 fib6_rule_default_pref(struct fib_rules_ops *ops)
-{
-        return 0x3FFF;
-}
-
 static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
 {
         return nla_total_size(16) /* dst */
@@ -279,7 +274,6 @@ static const struct fib_rules_ops __net_initconst fib6_rules_ops_template = {
         .configure              = fib6_rule_configure,
         .compare                = fib6_rule_compare,
         .fill                   = fib6_rule_fill,
-        .default_pref           = fib6_rule_default_pref,
         .nlmsg_payload          = fib6_rule_nlmsg_payload,
         .nlgroup                = RTNLGRP_IPV6_RULE,
         .policy                 = fib6_rule_policy,
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 74ceb73c1c9a..0e004cc42a22 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -217,7 +217,6 @@ static const struct fib_rules_ops __net_initconst ip6mr_rules_ops_template = {
         .match          = ip6mr_rule_match,
         .configure      = ip6mr_rule_configure,
         .compare        = ip6mr_rule_compare,
-        .default_pref   = fib_default_rule_pref,
         .fill           = ip6mr_rule_fill,
         .nlgroup        = RTNLGRP_IPV6_RULE,
         .policy         = ip6mr_rule_policy,
@@ -550,7 +549,7 @@ static void ipmr_mfc_seq_stop(struct seq_file *seq, void *v)
 
         if (it->cache == &mrt->mfc6_unres_queue)
                 spin_unlock_bh(&mfc_unres_lock);
-        else if (it->cache == mrt->mfc6_cache_array)
+        else if (it->cache == &mrt->mfc6_cache_array[it->ct])
                 read_unlock(&mrt_lock);
 }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f45cac6f8356..53617d715188 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1748,7 +1748,7 @@ static int ip6_convert_metrics(struct mx6_config *mxc,
         return -EINVAL;
 }
 
-int ip6_route_add(struct fib6_config *cfg)
+int ip6_route_info_create(struct fib6_config *cfg, struct rt6_info **rt_ret)
 {
         int err;
         struct net *net = cfg->fc_nlinfo.nl_net;
@@ -1756,7 +1756,6 @@ int ip6_route_add(struct fib6_config *cfg)
         struct net_device *dev = NULL;
         struct inet6_dev *idev = NULL;
         struct fib6_table *table;
-        struct mx6_config mxc = { .mx = NULL, };
         int addr_type;
 
         if (cfg->fc_dst_len > 128 || cfg->fc_src_len > 128)
@@ -1981,6 +1980,32 @@ install_route:
 
         cfg->fc_nlinfo.nl_net = dev_net(dev);
 
+        *rt_ret = rt;
+
+        return 0;
+out:
+        if (dev)
+                dev_put(dev);
+        if (idev)
+                in6_dev_put(idev);
+        if (rt)
+                dst_free(&rt->dst);
+
+        *rt_ret = NULL;
+
+        return err;
+}
+
+int ip6_route_add(struct fib6_config *cfg)
+{
+        struct mx6_config mxc = { .mx = NULL, };
+        struct rt6_info *rt = NULL;
+        int err;
+
+        err = ip6_route_info_create(cfg, &rt);
+        if (err)
+                goto out;
+
         err = ip6_convert_metrics(&mxc, cfg);
         if (err)
                 goto out;
@@ -1988,14 +2013,12 @@ install_route:
         err = __ip6_ins_rt(rt, &cfg->fc_nlinfo, &mxc);
 
         kfree(mxc.mx);
+
         return err;
 out:
-        if (dev)
-                dev_put(dev);
-        if (idev)
-                in6_dev_put(idev);
         if (rt)
                 dst_free(&rt->dst);
+
         return err;
 }
 
@@ -2776,19 +2799,78 @@ errout:
         return err;
 }
 
-static int ip6_route_multipath(struct fib6_config *cfg, int add)
+struct rt6_nh {
+        struct rt6_info *rt6_info;
+        struct fib6_config r_cfg;
+        struct mx6_config mxc;
+        struct list_head next;
+};
+
+static void ip6_print_replace_route_err(struct list_head *rt6_nh_list)
+{
+        struct rt6_nh *nh;
+
+        list_for_each_entry(nh, rt6_nh_list, next) {
+                pr_warn("IPV6: multipath route replace failed (check consistency of installed routes): %pI6 nexthop %pI6 ifi %d\n",
+                        &nh->r_cfg.fc_dst, &nh->r_cfg.fc_gateway,
+                        nh->r_cfg.fc_ifindex);
+        }
+}
+
+static int ip6_route_info_append(struct list_head *rt6_nh_list,
+                                 struct rt6_info *rt, struct fib6_config *r_cfg)
+{
+        struct rt6_nh *nh;
+        struct rt6_info *rtnh;
+        int err = -EEXIST;
+
+        list_for_each_entry(nh, rt6_nh_list, next) {
+                /* check if rt6_info already exists */
+                rtnh = nh->rt6_info;
+
+                if (rtnh->dst.dev == rt->dst.dev &&
+                    rtnh->rt6i_idev == rt->rt6i_idev &&
+                    ipv6_addr_equal(&rtnh->rt6i_gateway,
+                                    &rt->rt6i_gateway))
+                        return err;
+        }
+
+        nh = kzalloc(sizeof(*nh), GFP_KERNEL);
+        if (!nh)
+                return -ENOMEM;
+        nh->rt6_info = rt;
+        err = ip6_convert_metrics(&nh->mxc, r_cfg);
+        if (err) {
+                kfree(nh);
+                return err;
+        }
+        memcpy(&nh->r_cfg, r_cfg, sizeof(*r_cfg));
+        list_add_tail(&nh->next, rt6_nh_list);
+
+        return 0;
+}
+
+static int ip6_route_multipath_add(struct fib6_config *cfg)
 {
         struct fib6_config r_cfg;
         struct rtnexthop *rtnh;
+        struct rt6_info *rt;
+        struct rt6_nh *err_nh;
+        struct rt6_nh *nh, *nh_safe;
         int remaining;
         int attrlen;
-        int err = 0, last_err = 0;
+        int err = 1;
+        int nhn = 0;
+        int replace = (cfg->fc_nlinfo.nlh &&
+                       (cfg->fc_nlinfo.nlh->nlmsg_flags & NLM_F_REPLACE));
+        LIST_HEAD(rt6_nh_list);
 
         remaining = cfg->fc_mp_len;
-beginning:
         rtnh = (struct rtnexthop *)cfg->fc_mp;
 
-        /* Parse a Multipath Entry */
+        /* Parse a Multipath Entry and build a list (rt6_nh_list) of
+         * rt6_info structs per nexthop
+         */
         while (rtnh_ok(rtnh, remaining)) {
                 memcpy(&r_cfg, cfg, sizeof(*cfg));
                 if (rtnh->rtnh_ifindex)
@@ -2808,22 +2890,32 @@ beginning:
                         if (nla)
                                 r_cfg.fc_encap_type = nla_get_u16(nla);
                 }
-                err = add ? ip6_route_add(&r_cfg) : ip6_route_del(&r_cfg);
+
+                err = ip6_route_info_create(&r_cfg, &rt);
+                if (err)
+                        goto cleanup;
+
+                err = ip6_route_info_append(&rt6_nh_list, rt, &r_cfg);
                 if (err) {
-                        last_err = err;
-                        /* If we are trying to remove a route, do not stop the
-                         * loop when ip6_route_del() fails (because next hop is
-                         * already gone), we should try to remove all next hops.
-                         */
-                        if (add) {
-                                /* If add fails, we should try to delete all
-                                 * next hops that have been already added.
-                                 */
-                                add = 0;
-                                remaining = cfg->fc_mp_len - remaining;
-                                goto beginning;
-                        }
+                        dst_free(&rt->dst);
+                        goto cleanup;
+                }
+
+                rtnh = rtnh_next(rtnh, &remaining);
+        }
+
+        err_nh = NULL;
+        list_for_each_entry(nh, &rt6_nh_list, next) {
+                err = __ip6_ins_rt(nh->rt6_info, &cfg->fc_nlinfo, &nh->mxc);
+                /* nh->rt6_info is used or freed at this point, reset to NULL*/
+                nh->rt6_info = NULL;
+                if (err) {
+                        if (replace && nhn)
+                                ip6_print_replace_route_err(&rt6_nh_list);
+                        err_nh = nh;
+                        goto add_errout;
                 }
+
                 /* Because each route is added like a single route we remove
                  * these flags after the first nexthop: if there is a collision,
                  * we have already failed to add the first nexthop:
@@ -2833,6 +2925,62 @@ beginning:
                  */
                 cfg->fc_nlinfo.nlh->nlmsg_flags &= ~(NLM_F_EXCL |
                                                      NLM_F_REPLACE);
+                nhn++;
+        }
+
+        goto cleanup;
+
+add_errout:
+        /* Delete routes that were already added */
+        list_for_each_entry(nh, &rt6_nh_list, next) {
+                if (err_nh == nh)
+                        break;
+                ip6_route_del(&nh->r_cfg);
+        }
+
+cleanup:
+        list_for_each_entry_safe(nh, nh_safe, &rt6_nh_list, next) {
+                if (nh->rt6_info)
+                        dst_free(&nh->rt6_info->dst);
+                kfree(nh->mxc.mx);
+                list_del(&nh->next);
+                kfree(nh);
+        }
+
+        return err;
+}
+
+static int ip6_route_multipath_del(struct fib6_config *cfg)
+{
+        struct fib6_config r_cfg;
+        struct rtnexthop *rtnh;
+        int remaining;
+        int attrlen;
+        int err = 1, last_err = 0;
+
+        remaining = cfg->fc_mp_len;
+        rtnh = (struct rtnexthop *)cfg->fc_mp;
+
+        /* Parse a Multipath Entry */
+        while (rtnh_ok(rtnh, remaining)) {
+                memcpy(&r_cfg, cfg, sizeof(*cfg));
+                if (rtnh->rtnh_ifindex)
+                        r_cfg.fc_ifindex = rtnh->rtnh_ifindex;
+
+                attrlen = rtnh_attrlen(rtnh);
+                if (attrlen > 0) {
+                        struct nlattr *nla, *attrs = rtnh_attrs(rtnh);
+
+                        nla = nla_find(attrs, attrlen, RTA_GATEWAY);
+                        if (nla) {
+                                nla_memcpy(&r_cfg.fc_gateway, nla, 16);
+                                r_cfg.fc_flags |= RTF_GATEWAY;
+                        }
+                }
+                err = ip6_route_del(&r_cfg);
+                if (err)
+                        last_err = err;
+
                 rtnh = rtnh_next(rtnh, &remaining);
         }
 
@@ -2849,7 +2997,7 @@ static int inet6_rtm_delroute(struct sk_buff *skb, struct nlmsghdr *nlh)
                 return err;
 
         if (cfg.fc_mp)
-                return ip6_route_multipath(&cfg, 0);
+                return ip6_route_multipath_del(&cfg);
         else
                 return ip6_route_del(&cfg);
 }
@@ -2864,7 +3012,7 @@ static int inet6_rtm_newroute(struct sk_buff *skb, struct nlmsghdr *nlh)
                 return err;
 
         if (cfg.fc_mp)
-                return ip6_route_multipath(&cfg, 1);
+                return ip6_route_multipath_add(&cfg);
         else
                 return ip6_route_add(&cfg);
 }