Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix memory leak in nftables, from Liping Zhang.

 2) Need to check result of vlan_insert_tag() in batman-adv otherwise we
    risk NULL skb derefs, from Sven Eckelmann.

 3) Check for dev_alloc_skb() failures in cfg80211, from Gregory
    Greenman.

 4) Handle properly when we have ppp_unregister_channel() happening in
    parallel with ppp_connect_channel(), from WANG Cong.

 5) Fix DCCP deadlock, from Eric Dumazet.

 6) Bail out properly in UDP if sk_filter() truncates the packet to be
    smaller than even the space that the protocol headers need.  From
    Michal Kubecek.

 7) Similarly for rose, dccp, and sctp, from Willem de Bruijn.

 8) Make TCP challenge ACKs less predictable, from Eric Dumazet.

 9) Fix infinite loop in bgmac_dma_tx_add() from Florian Fainelli.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (65 commits)
  packet: propagate sock_cmsg_send() error
  net/mlx5e: Fix del vxlan port command buffer memset
  packet: fix second argument of sock_tx_timestamp()
  net: switchdev: change ageing_time type to clock_t
  Update maintainer for EHEA driver.
  net/mlx4_en: Add resilience in low memory systems
  net/mlx4_en: Move filters cleanup to a proper location
  sctp: load transport header after sk_filter
  net/sched/sch_htb: clamp xstats tokens to fit into 32-bit int
  net: cavium: liquidio: Avoid dma_unmap_single on uninitialized ndata
  net: nb8800: Fix SKB leak in nb8800_receive()
  et131x: Fix logical vs bitwise check in et131x_tx_timeout()
  vlan: use a valid default mtu value for vlan over macsec
  net: bgmac: Fix infinite loop in bgmac_dma_tx_add()
  mlxsw: spectrum: Prevent invalid ingress buffer mapping
  mlxsw: spectrum: Prevent overwrite of DCB capability fields
  mlxsw: spectrum: Don't emit errors when PFC is disabled
  mlxsw: spectrum: Indicate support for autonegotiation
  mlxsw: spectrum: Force link training according to admin state
  r8152: add MODULE_VERSION
  ...

4 files changed, 35 insertions, 5 deletions

diff --git a/net/tipc/bearer.c b/net/tipc/bearer.c
index bf8f05c3eb82..a597708ae381 100644
--- a/net/tipc/bearer.c
+++ b/net/tipc/bearer.c
@@ -330,6 +330,21 @@ static int tipc_reset_bearer(struct net *net, struct tipc_bearer *b)
         return 0;
 }
 
+/* tipc_bearer_reset_all - reset all links on all bearers
+ */
+void tipc_bearer_reset_all(struct net *net)
+{
+        struct tipc_net *tn = tipc_net(net);
+        struct tipc_bearer *b;
+        int i;
+
+        for (i = 0; i < MAX_BEARERS; i++) {
+                b = rcu_dereference_rtnl(tn->bearer_list[i]);
+                if (b)
+                        tipc_reset_bearer(net, b);
+        }
+}
+
 /**
  * bearer_disable
  *
diff --git a/net/tipc/bearer.h b/net/tipc/bearer.h
index f686e41b5abb..60e49c3be19c 100644
--- a/net/tipc/bearer.h
+++ b/net/tipc/bearer.h
@@ -198,6 +198,7 @@ void tipc_bearer_add_dest(struct net *net, u32 bearer_id, u32 dest);
 void tipc_bearer_remove_dest(struct net *net, u32 bearer_id, u32 dest);
 struct tipc_bearer *tipc_bearer_find(struct net *net, const char *name);
 struct tipc_media *tipc_media_find(const char *name);
+void tipc_bearer_reset_all(struct net *net);
 int tipc_bearer_setup(void);
 void tipc_bearer_cleanup(void);
 void tipc_bearer_stop(struct net *net);
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 67b6ab9f4c8d..7d89f8713d49 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -349,6 +349,8 @@ void tipc_link_remove_bc_peer(struct tipc_link *snd_l,
         u16 ack = snd_l->snd_nxt - 1;
 
         snd_l->ackers--;
+        rcv_l->bc_peer_is_up = true;
+        rcv_l->state = LINK_ESTABLISHED;
         tipc_link_bc_ack_rcv(rcv_l, ack, xmitq);
         tipc_link_reset(rcv_l);
         rcv_l->state = LINK_RESET;
@@ -1559,7 +1561,12 @@ void tipc_link_bc_sync_rcv(struct tipc_link *l, struct tipc_msg *hdr,
         if (!msg_peer_node_is_up(hdr))
                 return;
 
-        l->bc_peer_is_up = true;
+        /* Open when peer ackowledges our bcast init msg (pkt #1) */
+        if (msg_ack(hdr))
+                l->bc_peer_is_up = true;
+
+        if (!l->bc_peer_is_up)
+                return;
 
         /* Ignore if peers_snd_nxt goes beyond receive window */
         if (more(peers_snd_nxt, l->rcv_nxt + l->window))
diff --git a/net/tipc/node.c b/net/tipc/node.c
index e01e2c71b5a1..23d4761842a0 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1297,10 +1297,6 @@ static void tipc_node_bc_rcv(struct net *net, struct sk_buff *skb, int bearer_id
 
         rc = tipc_bcast_rcv(net, be->link, skb);
 
-        /* Broadcast link reset may happen at reassembly failure */
-        if (rc & TIPC_LINK_DOWN_EVT)
-                tipc_node_reset_links(n);
-
         /* Broadcast ACKs are sent on a unicast link */
         if (rc & TIPC_LINK_SND_BC_ACK) {
                 tipc_node_read_lock(n);
@@ -1320,6 +1316,17 @@ static void tipc_node_bc_rcv(struct net *net, struct sk_buff *skb, int bearer_id
                 spin_unlock_bh(&be->inputq2.lock);
                 tipc_sk_mcast_rcv(net, &be->arrvq, &be->inputq2);
         }
+
+        if (rc & TIPC_LINK_DOWN_EVT) {
+                /* Reception reassembly failure => reset all links to peer */
+                if (!tipc_link_is_up(be->link))
+                        tipc_node_reset_links(n);
+
+                /* Retransmission failure => reset all links to all peers */
+                if (!tipc_link_is_up(tipc_bc_sndlink(net)))
+                        tipc_bearer_reset_all(net);
+        }
+
         tipc_node_put(n);
 }