Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix leak in fsl/fman driver, from Dan Carpenter.

 2) Call flow dissector initcall earlier than any networking driver can
    register and start to use it, from Eric Dumazet.

 3) Some dup header fixes from Geliang Tang.

 4) TIPC link monitoring compat fix from Jon Paul Maloy.

 5) Link changes require EEE re-negotiation in bcm_sf2 driver, from
    Florian Fainelli.

 6) Fix bogus handle ID passed into tfilter_notify_chain(), from Roman
    Mashak.

 7) Fix dump size calculation in rtnl_calcit(), from Zhang Shengju.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (26 commits)
  tipc: resolve connection flow control compatibility problem
  mvpp2: use correct size for memset
  net/mlx5: drop duplicate header delay.h
  net: ieee802154: drop duplicate header delay.h
  ibmvnic: drop duplicate header seq_file.h
  fsl/fman: fix a leak in tgec_free()
  net: ethtool: don't require CAP_NET_ADMIN for ETHTOOL_GLINKSETTINGS
  tipc: improve sanity check for received domain records
  tipc: fix compatibility bug in link monitoring
  net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented
  dwc_eth_qos: drop duplicate headers
  net sched filters: fix filter handle ID in tfilter_notify_chain()
  net: dsa: bcm_sf2: Ensure we re-negotiate EEE during after link change
  bnxt: do not busy-poll when link is down
  udplite: call proper backlog handlers
  ipv6: bump genid when the IFA_F_TENTATIVE flag is clear
  net/mlx4_en: Free netdev resources under state lock
  net: revert "net: l2tp: Treat NET_XMIT_CN as success in l2tp_eth_dev_xmit"
  rtnetlink: fix the wrong minimal dump size getting from rtnl_calcit()
  bnxt_en: Fix a VXLAN vs GENEVE issue
  ...

21 files changed, 71 insertions, 39 deletions

diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c
index d020299baba4..1904a93f47d5 100644
--- a/net/bluetooth/6lowpan.c
+++ b/net/bluetooth/6lowpan.c
@@ -1090,7 +1090,6 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
 {
         struct hci_conn *hcon;
         struct hci_dev *hdev;
-        bdaddr_t *src = BDADDR_ANY;
         int n;
 
         n = sscanf(buf, "%hhx:%hhx:%hhx:%hhx:%hhx:%hhx %hhu",
@@ -1101,7 +1100,8 @@ static int get_l2cap_conn(char *buf, bdaddr_t *addr, u8 *addr_type,
         if (n < 7)
                 return -EINVAL;
 
-        hdev = hci_get_route(addr, src);
+        /* The LE_PUBLIC address type is ignored because of BDADDR_ANY */
+        hdev = hci_get_route(addr, BDADDR_ANY, BDADDR_LE_PUBLIC);
         if (!hdev)
                 return -ENOENT;
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 3809617aa98d..dc59eae54717 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -613,7 +613,7 @@ int hci_conn_del(struct hci_conn *conn)
         return 0;
 }
 
-struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
+struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src, uint8_t src_type)
 {
         int use_src = bacmp(src, BDADDR_ANY);
         struct hci_dev *hdev = NULL, *d;
@@ -634,7 +634,29 @@ struct hci_dev *hci_get_route(bdaddr_t *dst, bdaddr_t *src)
                  */
 
                 if (use_src) {
-                        if (!bacmp(&d->bdaddr, src)) {
+                        bdaddr_t id_addr;
+                        u8 id_addr_type;
+
+                        if (src_type == BDADDR_BREDR) {
+                                if (!lmp_bredr_capable(d))
+                                        continue;
+                                bacpy(&id_addr, &d->bdaddr);
+                                id_addr_type = BDADDR_BREDR;
+                        } else {
+                                if (!lmp_le_capable(d))
+                                        continue;
+
+                                hci_copy_identity_address(d, &id_addr,
+                                                          &id_addr_type);
+
+                                /* Convert from HCI to three-value type */
+                                if (id_addr_type == ADDR_LE_DEV_PUBLIC)
+                                        id_addr_type = BDADDR_LE_PUBLIC;
+                                else
+                                        id_addr_type = BDADDR_LE_RANDOM;
+                        }
+
+                        if (!bacmp(&id_addr, src) && id_addr_type == src_type) {
                                 hdev = d; break;
                         }
                 } else {
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index d4cad29b033f..577f1c01454a 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7060,7 +7060,7 @@ int l2cap_chan_connect(struct l2cap_chan *chan, __le16 psm, u16 cid,
         BT_DBG("%pMR -> %pMR (type %u) psm 0x%2.2x", &chan->src, dst,
                dst_type, __le16_to_cpu(psm));
 
-        hdev = hci_get_route(dst, &chan->src);
+        hdev = hci_get_route(dst, &chan->src, chan->src_type);
         if (!hdev)
                 return -EHOSTUNREACH;
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index 8e385a0ae60e..2f2cb5e27cdd 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -178,7 +178,7 @@ static void rfcomm_reparent_device(struct rfcomm_dev *dev)
         struct hci_dev *hdev;
         struct hci_conn *conn;
 
-        hdev = hci_get_route(&dev->dst, &dev->src);
+        hdev = hci_get_route(&dev->dst, &dev->src, BDADDR_BREDR);
         if (!hdev)
                 return;
 
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index f52bcbf2e58c..3125ce670c2f 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -219,7 +219,7 @@ static int sco_connect(struct sock *sk)
 
         BT_DBG("%pMR -> %pMR", &sco_pi(sk)->src, &sco_pi(sk)->dst);
 
-        hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src);
+        hdev = hci_get_route(&sco_pi(sk)->dst, &sco_pi(sk)->src, BDADDR_BREDR);
         if (!hdev)
                 return -EHOSTUNREACH;
 
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 8af9d25ff988..436a7537e6a9 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -77,7 +77,7 @@
                      (CAN_EFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG) : \
                      (CAN_SFF_MASK | CAN_EFF_FLAG | CAN_RTR_FLAG))
 
-#define CAN_BCM_VERSION "20160617"
+#define CAN_BCM_VERSION "20161123"
 
 MODULE_DESCRIPTION("PF_CAN broadcast manager protocol");
 MODULE_LICENSE("Dual BSD/GPL");
@@ -109,8 +109,9 @@ struct bcm_op {
         u32 count;
         u32 nframes;
         u32 currframe;
-        struct canfd_frame *frames;
-        struct canfd_frame *last_frames;
+        /* void pointers to arrays of struct can[fd]_frame */
+        void *frames;
+        void *last_frames;
         struct canfd_frame sframe;
         struct canfd_frame last_sframe;
         struct sock *sk;
@@ -681,7 +682,7 @@ static void bcm_rx_handler(struct sk_buff *skb, void *data)
 
         if (op->flags & RX_FILTER_ID) {
                 /* the easiest case */
-                bcm_rx_update_and_send(op, &op->last_frames[0], rxframe);
+                bcm_rx_update_and_send(op, op->last_frames, rxframe);
                 goto rx_starttimer;
         }
 
@@ -1068,7 +1069,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
 
                 if (msg_head->nframes) {
                         /* update CAN frames content */
-                        err = memcpy_from_msg((u8 *)op->frames, msg,
+                        err = memcpy_from_msg(op->frames, msg,
                                               msg_head->nframes * op->cfsiz);
                         if (err < 0)
                                 return err;
@@ -1118,7 +1119,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                 }
 
                 if (msg_head->nframes) {
-                        err = memcpy_from_msg((u8 *)op->frames, msg,
+                        err = memcpy_from_msg(op->frames, msg,
                                               msg_head->nframes * op->cfsiz);
                         if (err < 0) {
                                 if (op->frames != &op->sframe)
@@ -1163,6 +1164,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
         /* check flags */
 
         if (op->flags & RX_RTR_FRAME) {
+                struct canfd_frame *frame0 = op->frames;
 
                 /* no timers in RTR-mode */
                 hrtimer_cancel(&op->thrtimer);
@@ -1174,8 +1176,8 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg,
                  * prevent a full-load-loopback-test ... ;-]
                  */
                 if ((op->flags & TX_CP_CAN_ID) ||
-                    (op->frames[0].can_id == op->can_id))
-                        op->frames[0].can_id = op->can_id & ~CAN_RTR_FLAG;
+                    (frame0->can_id == op->can_id))
+                        frame0->can_id = op->can_id & ~CAN_RTR_FLAG;
 
         } else {
                 if (op->flags & SETTIMER) {
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 977489820eb9..047a1752ece1 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -2479,6 +2479,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         case ETHTOOL_GET_TS_INFO:
         case ETHTOOL_GEEE:
         case ETHTOOL_GTUNABLE:
+        case ETHTOOL_GLINKSETTINGS:
                 break;
         default:
                 if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 69e4463a4b1b..c6d8207ffa7e 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1013,4 +1013,4 @@ static int __init init_default_flow_dissectors(void)
         return 0;
 }
 
-late_initcall_sync(init_default_flow_dissectors);
+core_initcall(init_default_flow_dissectors);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a99917b5de33..deb35acbefd0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2737,7 +2737,7 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
                                                            ext_filter_mask));
         }
 
-        return min_ifinfo_dump_size;
+        return nlmsg_total_size(min_ifinfo_dump_size);
 }
 
 static int rtnl_dump_all(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 0de9d5d2b9ae..5bab6c3f7a2f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1455,7 +1455,7 @@ static void udp_v4_rehash(struct sock *sk)
         udp_lib_rehash(sk, new_hash);
 }
 
-static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
diff --git a/net/ipv4/udp_impl.h b/net/ipv4/udp_impl.h
index 7e0fe4bdd967..feb50a16398d 100644
--- a/net/ipv4/udp_impl.h
+++ b/net/ipv4/udp_impl.h
@@ -25,7 +25,7 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                 int flags, int *addr_len);
 int udp_sendpage(struct sock *sk, struct page *page, int offset, size_t size,
                  int flags);
-int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
+int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 void udp_destroy_sock(struct sock *sk);
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv4/udplite.c b/net/ipv4/udplite.c
index af817158d830..ff450c2aad9b 100644
--- a/net/ipv4/udplite.c
+++ b/net/ipv4/udplite.c
@@ -50,7 +50,7 @@ struct proto 	udplite_prot = {
         .sendmsg           = udp_sendmsg,
         .recvmsg           = udp_recvmsg,
         .sendpage          = udp_sendpage,
-        .backlog_rcv       = udp_queue_rcv_skb,
+        .backlog_rcv       = __udp_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v4_get_port,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 060dd9922018..4bc5ba3ae452 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -183,7 +183,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
 
 static void addrconf_dad_start(struct inet6_ifaddr *ifp);
 static void addrconf_dad_work(struct work_struct *w);
-static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
+static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id);
 static void addrconf_dad_run(struct inet6_dev *idev);
 static void addrconf_rs_timer(unsigned long data);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
@@ -2898,6 +2898,7 @@ static void add_addr(struct inet6_dev *idev, const struct in6_addr *addr,
                 spin_lock_bh(&ifp->lock);
                 ifp->flags &= ~IFA_F_TENTATIVE;
                 spin_unlock_bh(&ifp->lock);
+                rt_genid_bump_ipv6(dev_net(idev->dev));
                 ipv6_ifa_notify(RTM_NEWADDR, ifp);
                 in6_ifa_put(ifp);
         }
@@ -3740,7 +3741,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
 {
         struct inet6_dev *idev = ifp->idev;
         struct net_device *dev = idev->dev;
-        bool notify = false;
+        bool bump_id, notify = false;
 
         addrconf_join_solict(dev, &ifp->addr);
 
@@ -3755,11 +3756,12 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
             idev->cnf.accept_dad < 1 ||
             !(ifp->flags&IFA_F_TENTATIVE) ||
             ifp->flags & IFA_F_NODAD) {
+                bump_id = ifp->flags & IFA_F_TENTATIVE;
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
                 spin_unlock(&ifp->lock);
                 read_unlock_bh(&idev->lock);
 
-                addrconf_dad_completed(ifp);
+                addrconf_dad_completed(ifp, bump_id);
                 return;
         }
 
@@ -3819,8 +3821,8 @@ static void addrconf_dad_work(struct work_struct *w)
                                                 struct inet6_ifaddr,
                                                 dad_work);
         struct inet6_dev *idev = ifp->idev;
+        bool bump_id, disable_ipv6 = false;
         struct in6_addr mcaddr;
-        bool disable_ipv6 = false;
 
         enum {
                 DAD_PROCESS,
@@ -3890,11 +3892,12 @@ static void addrconf_dad_work(struct work_struct *w)
                  * DAD was successful
                  */
 
+                bump_id = ifp->flags & IFA_F_TENTATIVE;
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
                 spin_unlock(&ifp->lock);
                 write_unlock_bh(&idev->lock);
 
-                addrconf_dad_completed(ifp);
+                addrconf_dad_completed(ifp, bump_id);
 
                 goto out;
         }
@@ -3931,7 +3934,7 @@ static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp)
         return true;
 }
 
-static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
+static void addrconf_dad_completed(struct inet6_ifaddr *ifp, bool bump_id)
 {
         struct net_device *dev = ifp->idev->dev;
         struct in6_addr lladdr;
@@ -3983,6 +3986,9 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
                 spin_unlock(&ifp->lock);
                 write_unlock_bh(&ifp->idev->lock);
         }
+
+        if (bump_id)
+                rt_genid_bump_ipv6(dev_net(dev));
 }
 
 static void addrconf_dad_run(struct inet6_dev *idev)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e5056d4873d1..e4a8000d59ad 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -514,7 +514,7 @@ out:
         return;
 }
 
-static int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
+int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index f6eb1ab34f4b..e78bdc76dcc3 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -26,7 +26,7 @@ int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
 int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len);
 int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                   int flags, int *addr_len);
-int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
+int __udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb);
 void udpv6_destroy_sock(struct sock *sk);
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 47d0d2b87106..2f5101a12283 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -45,7 +45,7 @@ struct proto udplitev6_prot = {
         .getsockopt        = udpv6_getsockopt,
         .sendmsg           = udpv6_sendmsg,
         .recvmsg           = udpv6_recvmsg,
-        .backlog_rcv       = udpv6_queue_rcv_skb,
+        .backlog_rcv       = __udpv6_queue_rcv_skb,
         .hash              = udp_lib_hash,
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v6_get_port,
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 3dc97b4f982b..965f7e344cef 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -97,7 +97,7 @@ static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev)
         unsigned int len = skb->len;
         int ret = l2tp_xmit_skb(session, skb, session->hdr_len);
 
-        if (likely(ret == NET_XMIT_SUCCESS || ret == NET_XMIT_CN)) {
+        if (likely(ret == NET_XMIT_SUCCESS)) {
                 atomic_long_add(len, &priv->tx_bytes);
                 atomic_long_inc(&priv->tx_packets);
         } else {
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index 8e93d4afe5ea..b05d4a2155b0 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -112,7 +112,7 @@ static void tfilter_notify_chain(struct net *net, struct sk_buff *oskb,
 
         for (it_chain = chain; (tp = rtnl_dereference(*it_chain)) != NULL;
              it_chain = &tp->next)
-                tfilter_notify(net, oskb, n, tp, n->nlmsg_flags, event, false);
+                tfilter_notify(net, oskb, n, tp, 0, event, false);
 }
 
 /* Select new prio value from the range, managed by kernel. */
diff --git a/net/tipc/link.c b/net/tipc/link.c
index 1055164c6232..ecc12411155e 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -1492,8 +1492,9 @@ static int tipc_link_proto_rcv(struct tipc_link *l, struct sk_buff *skb,
                 if (in_range(peers_tol, TIPC_MIN_LINK_TOL, TIPC_MAX_LINK_TOL))
                         l->tolerance = peers_tol;
 
-                if (peers_prio && in_range(peers_prio, TIPC_MIN_LINK_PRI,
-                                           TIPC_MAX_LINK_PRI)) {
+                /* Update own prio if peer indicates a different value */
+                if ((peers_prio != l->priority) &&
+                    in_range(peers_prio, 1, TIPC_MAX_LINK_PRI)) {
                         l->priority = peers_prio;
                         rc = tipc_link_fsm_evt(l, LINK_FAILURE_EVT);
                 }
diff --git a/net/tipc/monitor.c b/net/tipc/monitor.c
index ed97a5876ebe..9e109bb1a207 100644
--- a/net/tipc/monitor.c
+++ b/net/tipc/monitor.c
@@ -455,14 +455,14 @@ void tipc_mon_rcv(struct net *net, void *data, u16 dlen, u32 addr,
         int i, applied_bef;
 
         state->probing = false;
-        if (!dlen)
-                return;
 
         /* Sanity check received domain record */
-        if ((dlen < new_dlen) || ntohs(arrv_dom->len) != new_dlen) {
-                pr_warn_ratelimited("Received illegal domain record\n");
+        if (dlen < dom_rec_len(arrv_dom, 0))
+                return;
+        if (dlen != dom_rec_len(arrv_dom, new_member_cnt))
+                return;
+        if ((dlen < new_dlen) || ntohs(arrv_dom->len) != new_dlen)
                 return;
-        }
 
         /* Synch generation numbers with peer if link just came up */
         if (!state->synched) {
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index db32777ab591..41f013888f07 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -186,7 +186,7 @@ static struct tipc_sock *tipc_sk(const struct sock *sk)
 
 static bool tsk_conn_cong(struct tipc_sock *tsk)
 {
-        return tsk->snt_unacked >= tsk->snd_win;
+        return tsk->snt_unacked > tsk->snd_win;
 }
 
 /* tsk_blocks(): translate a buffer size in bytes to number of