Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Two minor conflicts in virtio_net driver (bug fix overlapping addition
of a helper) and MAINTAINERS (new driver edit overlapping revamp of
PHY entry).

Signed-off-by: David S. Miller <davem@davemloft.net>

16 files changed, 81 insertions, 52 deletions

diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 06b147d7d9e2..709a4e6fb447 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -263,6 +263,8 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                 return dev_set_mtu(dev, ifr->ifr_mtu);
 
         case SIOCSIFHWADDR:
+                if (dev->addr_len > sizeof(struct sockaddr))
+                        return -EINVAL;
                 return dev_set_mac_address(dev, &ifr->ifr_hwaddr);
 
         case SIOCSIFHWBROADCAST:
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 8357f164c660..912731bed7b7 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -666,7 +666,7 @@ int netpoll_setup(struct netpoll *np)
         int err;
 
         rtnl_lock();
-        if (np->dev_name) {
+        if (np->dev_name[0]) {
                 struct net *net = current->nsproxy->net_ns;
                 ndev = __dev_get_by_name(net, np->dev_name);
         }
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index 1704948e6a12..f227f002c73d 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk)
          * singleton values (which always leads to failure).
          * These settings can still (later) be overridden via sockopts.
          */
-        if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
-            ccid_get_builtin_ccids(&rx.val, &rx.len))
+        if (ccid_get_builtin_ccids(&tx.val, &tx.len))
                 return -ENOBUFS;
+        if (ccid_get_builtin_ccids(&rx.val, &rx.len)) {
+                kfree(tx.val);
+                return -ENOBUFS;
+        }
 
         if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
             !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index f85d901f4e3f..1b202f16531f 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -631,6 +631,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
+        reqsk_put(req);
         return 0;
 
 drop_and_free:
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index c376af5bfdfb..1b58eac8aad3 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -380,6 +380,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
+        reqsk_put(req);
         return 0;
 
 drop_and_free:
diff --git a/net/dsa/dsa2.c b/net/dsa/dsa2.c
index 56e46090526b..c442051d5a55 100644
--- a/net/dsa/dsa2.c
+++ b/net/dsa/dsa2.c
@@ -509,21 +509,22 @@ static int dsa_cpu_parse(struct dsa_port *port, u32 index,
                 dst->cpu_dp->netdev = ethernet_dev;
         }
 
+        /* Initialize cpu_port_mask now for drv->setup()
+         * to have access to a correct value, just like what
+         * net/dsa/dsa.c::dsa_switch_setup_one does.
+         */
+        ds->cpu_port_mask |= BIT(index);
+
         tag_protocol = ds->ops->get_tag_protocol(ds);
         dst->tag_ops = dsa_resolve_tag_protocol(tag_protocol);
         if (IS_ERR(dst->tag_ops)) {
                 dev_warn(ds->dev, "No tagger for this switch\n");
+                ds->cpu_port_mask &= ~BIT(index);
                 return PTR_ERR(dst->tag_ops);
         }
 
         dst->rcv = dst->tag_ops->rcv;
 
-        /* Initialize cpu_port_mask now for drv->setup()
-         * to have access to a correct value, just like what
-         * net/dsa/dsa.c::dsa_switch_setup_one does.
-         */
-        ds->cpu_port_mask |= BIT(index);
-
         return 0;
 }
 
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 222100103808..b8d18171cca3 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1452,7 +1452,7 @@ static int call_fib_nh_notifiers(struct fib_nh *fib_nh,
                 return call_fib_notifiers(dev_net(fib_nh->nh_dev), event_type,
                                           &info.info);
         case FIB_EVENT_NH_DEL:
-                if ((IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) &&
+                if ((in_dev && IN_DEV_IGNORE_ROUTES_WITH_LINKDOWN(in_dev) &&
                      fib_nh->nh_flags & RTNH_F_LINKDOWN) ||
                     (fib_nh->nh_flags & RTNH_F_DEAD))
                         return call_fib_notifiers(dev_net(fib_nh->nh_dev),
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 8380464aead1..d49bff51bdb7 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2200,9 +2200,10 @@ static bool tcp_small_queue_check(struct sock *sk, const struct sk_buff *skb,
 static void tcp_chrono_set(struct tcp_sock *tp, const enum tcp_chrono new)
 {
         const u32 now = tcp_jiffies32;
+        enum tcp_chrono old = tp->chrono_type;
 
-        if (tp->chrono_type > TCP_CHRONO_UNSPEC)
-                tp->chrono_stat[tp->chrono_type - 1] += now - tp->chrono_start;
+        if (old > TCP_CHRONO_UNSPEC)
+                tp->chrono_stat[old - 1] += now - tp->chrono_start;
         tp->chrono_start = now;
         tp->chrono_type = new;
 }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b057653ceca9..e6276fa3750b 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1163,34 +1163,32 @@ out:
         return ret;
 }
 
-#if BITS_PER_LONG == 64
+#define UDP_SKB_IS_STATELESS 0x80000000
+
 static void udp_set_dev_scratch(struct sk_buff *skb)
 {
-        struct udp_dev_scratch *scratch;
+        struct udp_dev_scratch *scratch = udp_skb_scratch(skb);
 
         BUILD_BUG_ON(sizeof(struct udp_dev_scratch) > sizeof(long));
-        scratch = (struct udp_dev_scratch *)&skb->dev_scratch;
-        scratch->truesize = skb->truesize;
+        scratch->_tsize_state = skb->truesize;
+#if BITS_PER_LONG == 64
         scratch->len = skb->len;
         scratch->csum_unnecessary = !!skb_csum_unnecessary(skb);
         scratch->is_linear = !skb_is_nonlinear(skb);
+#endif
+        if (likely(!skb->_skb_refdst))
+                scratch->_tsize_state |= UDP_SKB_IS_STATELESS;
 }
 
 static int udp_skb_truesize(struct sk_buff *skb)
 {
-        return ((struct udp_dev_scratch *)&skb->dev_scratch)->truesize;
-}
-#else
-static void udp_set_dev_scratch(struct sk_buff *skb)
-{
-        skb->dev_scratch = skb->truesize;
+        return udp_skb_scratch(skb)->_tsize_state & ~UDP_SKB_IS_STATELESS;
 }
 
-static int udp_skb_truesize(struct sk_buff *skb)
+static bool udp_skb_has_head_state(struct sk_buff *skb)
 {
-        return skb->dev_scratch;
+        return !(udp_skb_scratch(skb)->_tsize_state & UDP_SKB_IS_STATELESS);
 }
-#endif
 
 /* fully reclaim rmem/fwd memory allocated for skb */
 static void udp_rmem_release(struct sock *sk, int size, int partial,
@@ -1388,10 +1386,10 @@ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len)
                 unlock_sock_fast(sk, slow);
         }
 
-        /* we cleared the head states previously only if the skb lacks any IP
-         * options, see __udp_queue_rcv_skb().
+        /* In the more common cases we cleared the head states previously,
+         * see __udp_queue_rcv_skb().
          */
-        if (unlikely(IPCB(skb)->opt.optlen > 0))
+        if (unlikely(udp_skb_has_head_state(skb)))
                 skb_release_head_state(skb);
         consume_stateless_skb(skb);
 }
@@ -1784,11 +1782,11 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 sk_mark_napi_id_once(sk, skb);
         }
 
-        /* At recvmsg() time we need skb->dst to process IP options-related
-         * cmsg, elsewhere can we clear all pending head states while they are
-         * hot in the cache
+        /* At recvmsg() time we may access skb->dst or skb->sp depending on
+         * the IP options and the cmsg flags, elsewhere can we clear all
+         * pending head states while they are hot in the cache
          */
-        if (likely(IPCB(skb)->opt.optlen == 0))
+        if (likely(IPCB(skb)->opt.optlen == 0 && !skb_sec_path(skb)))
                 skb_release_head_state(skb);
 
         rc = __udp_enqueue_schedule_skb(sk, skb);
@@ -1930,7 +1928,7 @@ drop:
 /* For TCP sockets, sk_rx_dst is protected by socket lock
  * For UDP, we use xchg() to guard against concurrent changes.
  */
-static void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
+void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
 {
         struct dst_entry *old;
 
@@ -1939,6 +1937,7 @@ static void udp_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
                 dst_release(old);
         }
 }
+EXPORT_SYMBOL(udp_sk_rx_dst_set);
 
 /*
  *      Multicasts and broadcasts go to each listener.
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 4996d734f1d2..3cec529c6113 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -756,6 +756,7 @@ static bool ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
         if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
                 goto drop;
 
+        IP6CB(skb)->flags |= IP6SKB_JUMBOGRAM;
         return true;
 
 drop:
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index c6ec06465ce0..43ca864327c7 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -673,8 +673,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                 *prevhdr = NEXTHDR_FRAGMENT;
                 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
                 if (!tmp_hdr) {
-                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                      IPSTATS_MIB_FRAGFAILS);
                         err = -ENOMEM;
                         goto fail;
                 }
@@ -789,8 +787,6 @@ slow_path:
                 frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
                                  hroom + troom, GFP_ATOMIC);
                 if (!frag) {
-                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                      IPSTATS_MIB_FRAGFAILS);
                         err = -ENOMEM;
                         goto fail;
                 }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4a3e65626e8b..578142b7ca3e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -291,11 +291,7 @@ static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
                                           struct udp_table *udptable)
 {
         const struct ipv6hdr *iph = ipv6_hdr(skb);
-        struct sock *sk;
 
-        sk = skb_steal_sock(skb);
-        if (unlikely(sk))
-                return sk;
         return __udp6_lib_lookup(dev_net(skb->dev), &iph->saddr, sport,
                                  &iph->daddr, dport, inet6_iif(skb),
                                  udptable, skb);
@@ -332,6 +328,15 @@ struct sock *udp6_lib_lookup(struct net *net, const struct in6_addr *saddr, __be
 EXPORT_SYMBOL_GPL(udp6_lib_lookup);
 #endif
 
+/* do not use the scratch area len for jumbogram: their length execeeds the
+ * scratch area space; note that the IP6CB flags is still in the first
+ * cacheline, so checking for jumbograms is cheap
+ */
+static int udp6_skb_len(struct sk_buff *skb)
+{
+        return unlikely(inet6_is_jumbogram(skb)) ? skb->len : udp_skb_len(skb);
+}
+
 /*
  *      This should be easy, if there is something there we
  *      return it, otherwise we block.
@@ -362,7 +367,7 @@ try_again:
         if (!skb)
                 return err;
 
-        ulen = udp_skb_len(skb);
+        ulen = udp6_skb_len(skb);
         copied = len;
         if (copied > ulen - off)
                 copied = ulen - off;
@@ -804,6 +809,24 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp6_csum_init(skb, uh, proto))
                 goto csum_error;
 
+        /* Check if the socket is already available, e.g. due to early demux */
+        sk = skb_steal_sock(skb);
+        if (sk) {
+                struct dst_entry *dst = skb_dst(skb);
+                int ret;
+
+                if (unlikely(sk->sk_rx_dst != dst))
+                        udp_sk_rx_dst_set(sk, dst);
+
+                ret = udpv6_queue_rcv_skb(sk, skb);
+                sock_put(sk);
+
+                /* a return value > 0 means to resubmit the input */
+                if (ret > 0)
+                        return ret;
+                return 0;
+        }
+
         /*
          *      Multicast receive code
          */
@@ -812,11 +835,6 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                                 saddr, daddr, udptable, proto);
 
         /* Unicast */
-
-        /*
-         * check socket cache ... must talk to Alan about his plans
-         * for sock caches... i'll skip this for now.
-         */
         sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
         if (sk) {
                 int ret;
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index e3c4c6c3fef7..03859e386b47 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -1310,8 +1310,8 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
 
         nla_for_each_nested(a, attr, rem) {
                 int type = nla_type(a);
-                int maxlen = ovs_ct_attr_lens[type].maxlen;
-                int minlen = ovs_ct_attr_lens[type].minlen;
+                int maxlen;
+                int minlen;
 
                 if (type > OVS_CT_ATTR_MAX) {
                         OVS_NLERR(log,
@@ -1319,6 +1319,9 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                                   type, OVS_CT_ATTR_MAX);
                         return -EINVAL;
                 }
+
+                maxlen = ovs_ct_attr_lens[type].maxlen;
+                minlen = ovs_ct_attr_lens[type].minlen;
                 if (nla_len(a) < minlen || nla_len(a) > maxlen) {
                         OVS_NLERR(log,
                                   "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index e7303f68972d..5a178047a7ce 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4327,7 +4327,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 register_prot_hook(sk);
         }
         spin_unlock(&po->bind_lock);
-        if (closing && (po->tp_version > TPACKET_V2)) {
+        if (pg_vec && (po->tp_version > TPACKET_V2)) {
                 /* Because we don't support block-based V3 on tx-ring */
                 if (!tx_ring)
                         prb_shutdown_retire_blk_timer(po, rb_queue);
diff --git a/net/socket.c b/net/socket.c
index 79d9bb964cd8..cb0fdf799f40 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1916,7 +1916,7 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
         if (copy_from_user(&msg, umsg, sizeof(*umsg)))
                 return -EFAULT;
 
-        kmsg->msg_control = msg.msg_control;
+        kmsg->msg_control = (void __force *)msg.msg_control;
         kmsg->msg_controllen = msg.msg_controllen;
         kmsg->msg_flags = msg.msg_flags;
 
@@ -1935,7 +1935,8 @@ static int copy_msghdr_from_user(struct msghdr *kmsg,
 
         if (msg.msg_name && kmsg->msg_namelen) {
                 if (!save_addr) {
-                        err = move_addr_to_kernel(msg.msg_name, kmsg->msg_namelen,
+                        err = move_addr_to_kernel(msg.msg_name,
+                                                  kmsg->msg_namelen,
                                                   kmsg->msg_name);
                         if (err < 0)
                                 return err;
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index d5b54c020dec..4f154d388748 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -1624,6 +1624,8 @@ static void xs_tcp_state_change(struct sock *sk)
                 if (test_and_clear_bit(XPRT_SOCK_CONNECTING,
                                         &transport->sock_state))
                         xprt_clear_connecting(xprt);
+                if (sk->sk_err)
+                        xprt_wake_pending_tasks(xprt, -sk->sk_err);
                 xs_sock_mark_closed(xprt);
         }
  out: