Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) In ip_gre tunnel, handle the conflict between TUNNEL_{SEQ,CSUM} and
    GSO/LLTX properly. From Sabrina Dubroca.

 2) Stop properly on error in lan78xx_read_otp(), from Phil Elwell.

 3) Don't uncompress in slip before rstate is initialized, from Tejaswi
    Tanikella.

 4) When using 1.x firmware on aquantia, issue a deinit before we
    hardware reset the chip, otherwise we break dirty wake WOL. From
    Igor Russkikh.

 5) Correct log check in vhost_vq_access_ok(), from Stefan Hajnoczi.

 6) Fix ethtool -x crashes in bnxt_en, from Michael Chan.

 7) Fix races in l2tp tunnel creation and duplicate tunnel detection,
    from Guillaume Nault.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (22 commits)
  l2tp: fix race in duplicate tunnel detection
  l2tp: fix races in tunnel creation
  tun: send netlink notification when the device is modified
  tun: set the flags before registering the netdevice
  lan78xx: Don't reset the interface on open
  bnxt_en: Fix NULL pointer dereference at bnxt_free_irq().
  bnxt_en: Need to include RDMA rings in bnxt_check_rings().
  bnxt_en: Support max-mtu with VF-reps
  bnxt_en: Ignore src port field in decap filter nodes
  bnxt_en: do not allow wildcard matches for L2 flows
  bnxt_en: Fix ethtool -x crash when device is down.
  vhost: return bool from *_access_ok() functions
  vhost: fix vhost_vq_access_ok() log check
  vhost: Fix vhost_copy_to_user()
  net: aquantia: oops when shutdown on already stopped device
  net: aquantia: Regression on reset with 1.x firmware
  cdc_ether: flag the Cinterion AHS8 modem by gemalto as WWAN
  slip: Check if rstate is initialized before uncompressing
  lan78xx: Avoid spurious kevent 4 "error"
  lan78xx: Correctly indicate invalid OTP
  ...

6 files changed, 139 insertions, 142 deletions

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index a8772a978224..9c169bb2444d 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -781,8 +781,14 @@ static void ipgre_link_update(struct net_device *dev, bool set_mtu)
                     tunnel->encap.type == TUNNEL_ENCAP_NONE) {
                         dev->features |= NETIF_F_GSO_SOFTWARE;
                         dev->hw_features |= NETIF_F_GSO_SOFTWARE;
+                } else {
+                        dev->features &= ~NETIF_F_GSO_SOFTWARE;
+                        dev->hw_features &= ~NETIF_F_GSO_SOFTWARE;
                 }
                 dev->features |= NETIF_F_LLTX;
+        } else {
+                dev->hw_features &= ~NETIF_F_GSO_SOFTWARE;
+                dev->features &= ~(NETIF_F_LLTX | NETIF_F_GSO_SOFTWARE);
         }
 }
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 14b67dfacc4b..0fbd3ee26165 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -335,26 +335,6 @@ err_tlock:
 }
 EXPORT_SYMBOL_GPL(l2tp_session_register);
 
-/* Lookup a tunnel by id
- */
-struct l2tp_tunnel *l2tp_tunnel_find(const struct net *net, u32 tunnel_id)
-{
-        struct l2tp_tunnel *tunnel;
-        struct l2tp_net *pn = l2tp_pernet(net);
-
-        rcu_read_lock_bh();
-        list_for_each_entry_rcu(tunnel, &pn->l2tp_tunnel_list, list) {
-                if (tunnel->tunnel_id == tunnel_id) {
-                        rcu_read_unlock_bh();
-                        return tunnel;
-                }
-        }
-        rcu_read_unlock_bh();
-
-        return NULL;
-}
-EXPORT_SYMBOL_GPL(l2tp_tunnel_find);
-
 struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth)
 {
         struct l2tp_net *pn = l2tp_pernet(net);
@@ -1436,74 +1416,11 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
 {
         struct l2tp_tunnel *tunnel = NULL;
         int err;
-        struct socket *sock = NULL;
-        struct sock *sk = NULL;
-        struct l2tp_net *pn;
         enum l2tp_encap_type encap = L2TP_ENCAPTYPE_UDP;
 
-        /* Get the tunnel socket from the fd, which was opened by
-         * the userspace L2TP daemon. If not specified, create a
-         * kernel socket.
-         */
-        if (fd < 0) {
-                err = l2tp_tunnel_sock_create(net, tunnel_id, peer_tunnel_id,
-                                cfg, &sock);
-                if (err < 0)
-                        goto err;
-        } else {
-                sock = sockfd_lookup(fd, &err);
-                if (!sock) {
-                        pr_err("tunl %u: sockfd_lookup(fd=%d) returned %d\n",
-                               tunnel_id, fd, err);
-                        err = -EBADF;
-                        goto err;
-                }
-
-                /* Reject namespace mismatches */
-                if (!net_eq(sock_net(sock->sk), net)) {
-                        pr_err("tunl %u: netns mismatch\n", tunnel_id);
-                        err = -EINVAL;
-                        goto err;
-                }
-        }
-
-        sk = sock->sk;
-
         if (cfg != NULL)
                 encap = cfg->encap;
 
-        /* Quick sanity checks */
-        err = -EPROTONOSUPPORT;
-        if (sk->sk_type != SOCK_DGRAM) {
-                pr_debug("tunl %hu: fd %d wrong socket type\n",
-                         tunnel_id, fd);
-                goto err;
-        }
-        switch (encap) {
-        case L2TP_ENCAPTYPE_UDP:
-                if (sk->sk_protocol != IPPROTO_UDP) {
-                        pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
-                               tunnel_id, fd, sk->sk_protocol, IPPROTO_UDP);
-                        goto err;
-                }
-                break;
-        case L2TP_ENCAPTYPE_IP:
-                if (sk->sk_protocol != IPPROTO_L2TP) {
-                        pr_err("tunl %hu: fd %d wrong protocol, got %d, expected %d\n",
-                               tunnel_id, fd, sk->sk_protocol, IPPROTO_L2TP);
-                        goto err;
-                }
-                break;
-        }
-
-        /* Check if this socket has already been prepped */
-        tunnel = l2tp_tunnel(sk);
-        if (tunnel != NULL) {
-                /* This socket has already been prepped */
-                err = -EBUSY;
-                goto err;
-        }
-
         tunnel = kzalloc(sizeof(struct l2tp_tunnel), GFP_KERNEL);
         if (tunnel == NULL) {
                 err = -ENOMEM;
@@ -1520,72 +1437,126 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
         rwlock_init(&tunnel->hlist_lock);
         tunnel->acpt_newsess = true;
 
-        /* The net we belong to */
-        tunnel->l2tp_net = net;
-        pn = l2tp_pernet(net);
-
         if (cfg != NULL)
                 tunnel->debug = cfg->debug;
 
-        /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */
         tunnel->encap = encap;
-        if (encap == L2TP_ENCAPTYPE_UDP) {
-                struct udp_tunnel_sock_cfg udp_cfg = { };
-
-                udp_cfg.sk_user_data = tunnel;
-                udp_cfg.encap_type = UDP_ENCAP_L2TPINUDP;
-                udp_cfg.encap_rcv = l2tp_udp_encap_recv;
-                udp_cfg.encap_destroy = l2tp_udp_encap_destroy;
-
-                setup_udp_tunnel_sock(net, sock, &udp_cfg);
-        } else {
-                sk->sk_user_data = tunnel;
-        }
 
-        /* Bump the reference count. The tunnel context is deleted
-         * only when this drops to zero. A reference is also held on
-         * the tunnel socket to ensure that it is not released while
-         * the tunnel is extant. Must be done before sk_destruct is
-         * set.
-         */
         refcount_set(&tunnel->ref_count, 1);
-        sock_hold(sk);
-        tunnel->sock = sk;
         tunnel->fd = fd;
 
-        /* Hook on the tunnel socket destructor so that we can cleanup
-         * if the tunnel socket goes away.
-         */
-        tunnel->old_sk_destruct = sk->sk_destruct;
-        sk->sk_destruct = &l2tp_tunnel_destruct;
-        lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class, "l2tp_sock");
-
-        sk->sk_allocation = GFP_ATOMIC;
-
         /* Init delete workqueue struct */
         INIT_WORK(&tunnel->del_work, l2tp_tunnel_del_work);
 
-        /* Add tunnel to our list */
         INIT_LIST_HEAD(&tunnel->list);
-        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
-        list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
-        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
 
         err = 0;
 err:
         if (tunnelp)
                 *tunnelp = tunnel;
 
-        /* If tunnel's socket was created by the kernel, it doesn't
-         *  have a file.
-         */
-        if (sock && sock->file)
-                sockfd_put(sock);
-
         return err;
 }
 EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
 
+static int l2tp_validate_socket(const struct sock *sk, const struct net *net,
+                                enum l2tp_encap_type encap)
+{
+        if (!net_eq(sock_net(sk), net))
+                return -EINVAL;
+
+        if (sk->sk_type != SOCK_DGRAM)
+                return -EPROTONOSUPPORT;
+
+        if ((encap == L2TP_ENCAPTYPE_UDP && sk->sk_protocol != IPPROTO_UDP) ||
+            (encap == L2TP_ENCAPTYPE_IP && sk->sk_protocol != IPPROTO_L2TP))
+                return -EPROTONOSUPPORT;
+
+        if (sk->sk_user_data)
+                return -EBUSY;
+
+        return 0;
+}
+
+int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
+                         struct l2tp_tunnel_cfg *cfg)
+{
+        struct l2tp_tunnel *tunnel_walk;
+        struct l2tp_net *pn;
+        struct socket *sock;
+        struct sock *sk;
+        int ret;
+
+        if (tunnel->fd < 0) {
+                ret = l2tp_tunnel_sock_create(net, tunnel->tunnel_id,
+                                              tunnel->peer_tunnel_id, cfg,
+                                              &sock);
+                if (ret < 0)
+                        goto err;
+        } else {
+                sock = sockfd_lookup(tunnel->fd, &ret);
+                if (!sock)
+                        goto err;
+
+                ret = l2tp_validate_socket(sock->sk, net, tunnel->encap);
+                if (ret < 0)
+                        goto err_sock;
+        }
+
+        sk = sock->sk;
+
+        sock_hold(sk);
+        tunnel->sock = sk;
+        tunnel->l2tp_net = net;
+
+        pn = l2tp_pernet(net);
+
+        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+        list_for_each_entry(tunnel_walk, &pn->l2tp_tunnel_list, list) {
+                if (tunnel_walk->tunnel_id == tunnel->tunnel_id) {
+                        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+
+                        ret = -EEXIST;
+                        goto err_sock;
+                }
+        }
+        list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
+        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
+
+        if (tunnel->encap == L2TP_ENCAPTYPE_UDP) {
+                struct udp_tunnel_sock_cfg udp_cfg = {
+                        .sk_user_data = tunnel,
+                        .encap_type = UDP_ENCAP_L2TPINUDP,
+                        .encap_rcv = l2tp_udp_encap_recv,
+                        .encap_destroy = l2tp_udp_encap_destroy,
+                };
+
+                setup_udp_tunnel_sock(net, sock, &udp_cfg);
+        } else {
+                sk->sk_user_data = tunnel;
+        }
+
+        tunnel->old_sk_destruct = sk->sk_destruct;
+        sk->sk_destruct = &l2tp_tunnel_destruct;
+        lockdep_set_class_and_name(&sk->sk_lock.slock, &l2tp_socket_class,
+                                   "l2tp_sock");
+        sk->sk_allocation = GFP_ATOMIC;
+
+        if (tunnel->fd >= 0)
+                sockfd_put(sock);
+
+        return 0;
+
+err_sock:
+        if (tunnel->fd < 0)
+                sock_release(sock);
+        else
+                sockfd_put(sock);
+err:
+        return ret;
+}
+EXPORT_SYMBOL_GPL(l2tp_tunnel_register);
+
 /* This function is used by the netlink TUNNEL_DELETE command.
  */
 void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h
index 2718d0b284d0..ba33cbec71eb 100644
--- a/net/l2tp/l2tp_core.h
+++ b/net/l2tp/l2tp_core.h
@@ -220,12 +220,14 @@ struct l2tp_session *l2tp_session_get(const struct net *net,
 struct l2tp_session *l2tp_session_get_nth(struct l2tp_tunnel *tunnel, int nth);
 struct l2tp_session *l2tp_session_get_by_ifname(const struct net *net,
                                                 const char *ifname);
-struct l2tp_tunnel *l2tp_tunnel_find(const struct net *net, u32 tunnel_id);
 struct l2tp_tunnel *l2tp_tunnel_find_nth(const struct net *net, int nth);
 
 int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id,
                        u32 peer_tunnel_id, struct l2tp_tunnel_cfg *cfg,
                        struct l2tp_tunnel **tunnelp);
+int l2tp_tunnel_register(struct l2tp_tunnel *tunnel, struct net *net,
+                         struct l2tp_tunnel_cfg *cfg);
+
 void l2tp_tunnel_closeall(struct l2tp_tunnel *tunnel);
 void l2tp_tunnel_delete(struct l2tp_tunnel *tunnel);
 struct l2tp_session *l2tp_session_create(int priv_size,
diff --git a/net/l2tp/l2tp_netlink.c b/net/l2tp/l2tp_netlink.c
index e7ea9c4b89ff..b05dbd9ffcb2 100644
--- a/net/l2tp/l2tp_netlink.c
+++ b/net/l2tp/l2tp_netlink.c
@@ -236,12 +236,6 @@ static int l2tp_nl_cmd_tunnel_create(struct sk_buff *skb, struct genl_info *info
         if (info->attrs[L2TP_ATTR_DEBUG])
                 cfg.debug = nla_get_u32(info->attrs[L2TP_ATTR_DEBUG]);
 
-        tunnel = l2tp_tunnel_find(net, tunnel_id);
-        if (tunnel != NULL) {
-                ret = -EEXIST;
-                goto out;
-        }
-
         ret = -EINVAL;
         switch (cfg.encap) {
         case L2TP_ENCAPTYPE_UDP:
@@ -251,9 +245,19 @@ static int l2tp_nl_cmd_tunnel_create(struct sk_buff *skb, struct genl_info *info
                 break;
         }
 
-        if (ret >= 0)
-                ret = l2tp_tunnel_notify(&l2tp_nl_family, info,
-                                         tunnel, L2TP_CMD_TUNNEL_CREATE);
+        if (ret < 0)
+                goto out;
+
+        l2tp_tunnel_inc_refcount(tunnel);
+        ret = l2tp_tunnel_register(tunnel, net, &cfg);
+        if (ret < 0) {
+                kfree(tunnel);
+                goto out;
+        }
+        ret = l2tp_tunnel_notify(&l2tp_nl_family, info, tunnel,
+                                 L2TP_CMD_TUNNEL_CREATE);
+        l2tp_tunnel_dec_refcount(tunnel);
+
 out:
         return ret;
 }
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index d6deca11da19..896bbca9bdaa 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -698,6 +698,15 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
                         error = l2tp_tunnel_create(sock_net(sk), fd, ver, tunnel_id, peer_tunnel_id, &tcfg, &tunnel);
                         if (error < 0)
                                 goto end;
+
+                        l2tp_tunnel_inc_refcount(tunnel);
+                        error = l2tp_tunnel_register(tunnel, sock_net(sk),
+                                                     &tcfg);
+                        if (error < 0) {
+                                kfree(tunnel);
+                                goto end;
+                        }
+                        drop_tunnel = true;
                 }
         } else {
                 /* Error if we can't find the tunnel */
diff --git a/net/rds/send.c b/net/rds/send.c
index acad04243b41..94c7f74909be 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2006 Oracle.  All rights reserved.
+ * Copyright (c) 2006, 2018 Oracle and/or its affiliates. All rights reserved.
  *
  * This software is available to you under a choice of one of two
  * licenses.  You may choose to be licensed under the terms of the GNU
@@ -1017,10 +1017,15 @@ static int rds_send_mprds_hash(struct rds_sock *rs, struct rds_connection *conn)
         if (conn->c_npaths == 0 && hash != 0) {
                 rds_send_ping(conn, 0);
 
-                if (conn->c_npaths == 0) {
-                        wait_event_interruptible(conn->c_hs_waitq,
-                                                 (conn->c_npaths != 0));
-                }
+                /* The underlying connection is not up yet.  Need to wait
+                 * until it is up to be sure that the non-zero c_path can be
+                 * used.  But if we are interrupted, we have to use the zero
+                 * c_path in case the connection ends up being non-MP capable.
+                 */
+                if (conn->c_npaths == 0)
+                        if (wait_event_interruptible(conn->c_hs_waitq,
+                                                     conn->c_npaths != 0))
+                                hash = 0;
                 if (conn->c_npaths == 1)
                         hash = 0;
         }