Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

The netfilter conflicts were rather simple overlapping
changes.

However, the cls_tcindex.c stuff was a bit more complex.

On the 'net' side, Cong is fixing several races and memory
leaks.  Whilst on the 'net-next' side we have Vlad adding
the rtnl-ness support.

What I've decided to do, in order to resolve this, is revert the
conversion over to using a workqueue that Cong did, bringing us back
to pure RCU.  I did it this way because I believe that either Cong's
races don't apply with have Vlad did things, or Cong will have to
implement the race fix slightly differently.

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 44 insertions, 6 deletions

diff --git a/net/tipc/link.c b/net/tipc/link.c
index ac306d17f8ad..341ecd796aa4 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1145,7 +1145,7 @@ static bool tipc_data_input(struct tipc_link *l, struct sk_buff *skb,
         default:
                 pr_warn("Dropping received illegal msg type\n");
                 kfree_skb(skb);
-                return false;
+                return true;
         };
 }
 
@@ -1425,6 +1425,10 @@ static void tipc_link_build_proto_msg(struct tipc_link *l, int mtyp, bool probe,
                 l->rcv_unacked = 0;
         } else {
                 /* RESET_MSG or ACTIVATE_MSG */
+                if (mtyp == ACTIVATE_MSG) {
+                        msg_set_dest_session_valid(hdr, 1);
+                        msg_set_dest_session(hdr, l->peer_session);
+                }
                 msg_set_max_pkt(hdr, l->advertised_mtu);
                 strcpy(data, l->if_name);
                 msg_set_size(hdr, INT_H_SIZE + TIPC_MAX_IF_NAME);
@@ -1642,6 +1646,17 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                         rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
                         break;
                 }
+
+                /* If this endpoint was re-created while peer was ESTABLISHING
+                 * it doesn't know current session number. Force re-synch.
+                 */
+                if (mtyp == ACTIVATE_MSG && msg_dest_session_valid(hdr) &&
+                    l->session != msg_dest_session(hdr)) {
+                        if (less(l->session, msg_dest_session(hdr)))
+                                l->session = msg_dest_session(hdr) + 1;
+                        break;
+                }
+
                 /* ACTIVATE_MSG serves as PEER_RESET if link is already down */
                 if (mtyp == RESET_MSG || !link_is_up(l))
                         rc = tipc_link_fsm_evt(l, LINK_PEER_RESET_EVT);
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index a0924956bb61..d7e4b8b93f9d 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -360,6 +360,28 @@ static inline void msg_set_bcast_ack(struct tipc_msg *m, u16 n)
         msg_set_bits(m, 1, 0, 0xffff, n);
 }
 
+/* Note: reusing bits in word 1 for ACTIVATE_MSG only, to re-synch
+ * link peer session number
+ */
+static inline bool msg_dest_session_valid(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 16, 0x1);
+}
+
+static inline void msg_set_dest_session_valid(struct tipc_msg *m, bool valid)
+{
+        msg_set_bits(m, 1, 16, 0x1, valid);
+}
+
+static inline u16 msg_dest_session(struct tipc_msg *m)
+{
+        return msg_bits(m, 1, 0, 0xffff);
+}
+
+static inline void msg_set_dest_session(struct tipc_msg *m, u16 n)
+{
+        msg_set_bits(m, 1, 0, 0xffff, n);
+}
 
 /*
  * Word 2
diff --git a/net/tipc/node.c b/net/tipc/node.c
index db2a6c3e0be9..2dc4919ab23c 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -830,15 +830,16 @@ static void tipc_node_link_down(struct tipc_node *n, int bearer_id, bool delete)
         tipc_node_write_lock(n);
         if (!tipc_link_is_establishing(l)) {
                 __tipc_node_link_down(n, &bearer_id, &xmitq, &maddr);
-                if (delete) {
-                        kfree(l);
-                        le->link = NULL;
-                        n->link_cnt--;
-                }
         } else {
                 /* Defuse pending tipc_node_link_up() */
+                tipc_link_reset(l);
                 tipc_link_fsm_evt(l, LINK_RESET_EVT);
         }
+        if (delete) {
+                kfree(l);
+                le->link = NULL;
+                n->link_cnt--;
+        }
         trace_tipc_node_link_down(n, true, "node link down or deleted!");
         tipc_node_write_unlock(n);
         if (delete)