Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Fun set of conflict resolutions here...

For the mac80211 stuff, these were fortunately just parallel
adds.  Trivially resolved.

In drivers/net/phy/phy.c we had a bug fix in 'net' that moved the
function phy_disable_interrupts() earlier in the file, whilst in
'net-next' the phy_error() call from this function was removed.

In net/ipv4/xfrm4_policy.c, David Ahern's changes to remove the
'rt_table_id' member of rtable collided with a bug fix in 'net' that
added a new struct member "rt_mtu_locked" which needs to be copied
over here.

The mlxsw driver conflict consisted of net-next separating
the span code and definitions into separate files, whilst
a 'net' bug fix made some changes to that moved code.

The mlx5 infiniband conflict resolution was quite non-trivial,
the RDMA tree's merge commit was used as a guide here, and
here are their notes:

====================

    Due to bug fixes found by the syzkaller bot and taken into the for-rc
    branch after development for the 4.17 merge window had already started
    being taken into the for-next branch, there were fairly non-trivial
    merge issues that would need to be resolved between the for-rc branch
    and the for-next branch.  This merge resolves those conflicts and
    provides a unified base upon which ongoing development for 4.17 can
    be based.

    Conflicts:
            drivers/infiniband/hw/mlx5/main.c - Commit 42cea83f9524
            (IB/mlx5: Fix cleanup order on unload) added to for-rc and
            commit b5ca15ad7e61 (IB/mlx5: Add proper representors support)
            add as part of the devel cycle both needed to modify the
            init/de-init functions used by mlx5.  To support the new
            representors, the new functions added by the cleanup patch
            needed to be made non-static, and the init/de-init list
            added by the representors patch needed to be modified to
            match the init/de-init list changes made by the cleanup
            patch.
    Updates:
            drivers/infiniband/hw/mlx5/mlx5_ib.h - Update function
            prototypes added by representors patch to reflect new function
            names as changed by cleanup patch
            drivers/infiniband/hw/mlx5/ib_rep.c - Update init/de-init
            stage list to match new order from cleanup patch
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 24 insertions, 25 deletions

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 189a12a5e4ac..b86868da50d4 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -111,6 +111,13 @@ struct l2tp_net {
         spinlock_t l2tp_session_hlist_lock;
 };
 
+#if IS_ENABLED(CONFIG_IPV6)
+static bool l2tp_sk_is_v6(struct sock *sk)
+{
+        return sk->sk_family == PF_INET6 &&
+               !ipv6_addr_v4mapped(&sk->sk_v6_daddr);
+}
+#endif
 
 static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk)
 {
@@ -1049,7 +1056,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb,
         /* Queue the packet to IP for output */
         skb->ignore_df = 1;
 #if IS_ENABLED(CONFIG_IPV6)
-        if (tunnel->sock->sk_family == PF_INET6 && !tunnel->v4mapped)
+        if (l2tp_sk_is_v6(tunnel->sock))
                 error = inet6_csk_xmit(tunnel->sock, skb, NULL);
         else
 #endif
@@ -1112,6 +1119,15 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
                 goto out_unlock;
         }
 
+        /* The user-space may change the connection status for the user-space
+         * provided socket at run time: we must check it under the socket lock
+         */
+        if (tunnel->fd >= 0 && sk->sk_state != TCP_ESTABLISHED) {
+                kfree_skb(skb);
+                ret = NET_XMIT_DROP;
+                goto out_unlock;
+        }
+
         /* Get routing info from the tunnel socket */
         skb_dst_drop(skb);
         skb_dst_set(skb, dst_clone(__sk_dst_check(sk, 0)));
@@ -1131,7 +1147,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
 
                 /* Calculate UDP checksum if configured to do so */
 #if IS_ENABLED(CONFIG_IPV6)
-                if (sk->sk_family == PF_INET6 && !tunnel->v4mapped)
+                if (l2tp_sk_is_v6(sk))
                         udp6_set_csum(udp_get_no_check6_tx(sk),
                                       skb, &inet6_sk(sk)->saddr,
                                       &sk->sk_v6_daddr, udp_len);
@@ -1457,9 +1473,14 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 encap = cfg->encap;
 
         /* Quick sanity checks */
+        err = -EPROTONOSUPPORT;
+        if (sk->sk_type != SOCK_DGRAM) {
+                pr_debug("tunl %hu: fd %d wrong socket type\n",
+                         tunnel_id, fd);
+                goto err;
+        }
         switch (encap) {
         case L2TP_ENCAPTYPE_UDP:
-                err = -EPROTONOSUPPORT;
                 if (sk->sk_protocol != IPPROTO_UDP) {
                         pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                                tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
@@ -1467,7 +1488,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
                 }
                 break;
         case L2TP_ENCAPTYPE_IP:
-                err = -EPROTONOSUPPORT;
                 if (sk->sk_protocol != IPPROTO_L2TP) {
                         pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
                                tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
@@ -1507,24 +1527,6 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         if (cfg != NULL)
                 tunnel->debug = cfg->debug;
 
-#if IS_ENABLED(CONFIG_IPV6)
-        if (sk->sk_family == PF_INET6) {
-                struct ipv6_pinfo *np = inet6_sk(sk);
-
-                if (ipv6_addr_v4mapped(&np->saddr) &&
-                    ipv6_addr_v4mapped(&sk->sk_v6_daddr)) {
-                        struct inet_sock *inet = inet_sk(sk);
-
-                        tunnel->v4mapped = true;
-                        inet->inet_saddr = np->saddr.s6_addr32[3];
-                        inet->inet_rcv_saddr = sk->sk_v6_rcv_saddr.s6_addr32[3];
-                        inet->inet_daddr = sk->sk_v6_daddr.s6_addr32[3];
-                } else {
-                        tunnel->v4mapped = false;
-                }
-        }
-#endif
-
         /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
         tunnel->encap = encap;
         if (encap == L2TP_ENCAPTYPE_UDP) {
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index a1aa9550f04e..2718d0b284d0 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -188,9 +188,6 @@ struct l2tp_tunnel {
         struct sock             *sock;          /* Parent socket */
         int                     fd;             /* Parent fd, if tunnel socket
                                                  * was created by userspace */
-#if IS_ENABLED(CONFIG_IPV6)
-        bool                    v4mapped;
-#endif
 
         struct work_struct      del_work;