Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

18 files changed, 79 insertions, 37 deletions

diff --git a/net/core/datagram.c b/net/core/datagram.c
index 2f3277945d35..a4d5f10d83a1 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -169,14 +169,20 @@ struct sk_buff *__skb_try_recv_from_queue(struct sock *sk,
                                           int *peeked, int *off, int *err,
                                           struct sk_buff **last)
 {
+        bool peek_at_off = false;
         struct sk_buff *skb;
-        int _off = *off;
+        int _off = 0;
+
+        if (unlikely(flags & MSG_PEEK && *off >= 0)) {
+                peek_at_off = true;
+                _off = *off;
+        }
 
         *last = queue->prev;
         skb_queue_walk(queue, skb) {
                 if (flags & MSG_PEEK) {
-                        if (_off >= skb->len && (skb->len || _off ||
-                                                 skb->peeked)) {
+                        if (peek_at_off && _off >= skb->len &&
+                            (_off || skb->peeked)) {
                                 _off -= skb->len;
                                 continue;
                         }
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 86bc40ba6ba5..b68168fcc06a 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -24,6 +24,7 @@
 #include <net/checksum.h>
 
 #include <net/inet_sock.h>
+#include <net/inet_common.h>
 #include <net/sock.h>
 #include <net/xfrm.h>
 
@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int type)
 
 EXPORT_SYMBOL_GPL(dccp_packet_name);
 
+static void dccp_sk_destruct(struct sock *sk)
+{
+        struct dccp_sock *dp = dccp_sk(sk);
+
+        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+        dp->dccps_hc_tx_ccid = NULL;
+        inet_sock_destruct(sk);
+}
+
 int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
 {
         struct dccp_sock *dp = dccp_sk(sk);
@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
         icsk->icsk_syn_retries  = sysctl_dccp_request_retries;
         sk->sk_state            = DCCP_CLOSED;
         sk->sk_write_space      = dccp_write_space;
+        sk->sk_destruct         = dccp_sk_destruct;
         icsk->icsk_sync_mss     = dccp_sync_mss;
         dp->dccps_mss_cache     = 536;
         dp->dccps_rate_last     = jiffies;
@@ -219,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk)
                 dp->dccps_hc_rx_ackvec = NULL;
         }
         ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
-        ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
-        dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
+        dp->dccps_hc_rx_ccid = NULL;
 
         /* clean up feature negotiation state */
         dccp_feat_list_purge(&dp->dccps_featneg);
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 9f86b5133605..ab183af0b5b6 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1007,10 +1007,18 @@ int igmp_rcv(struct sk_buff *skb)
 {
         /* This basically follows the spec line by line -- see RFC1112 */
         struct igmphdr *ih;
-        struct in_device *in_dev = __in_dev_get_rcu(skb->dev);
+        struct net_device *dev = skb->dev;
+        struct in_device *in_dev;
         int len = skb->len;
         bool dropped = true;
 
+        if (netif_is_l3_master(dev)) {
+                dev = dev_get_by_index_rcu(dev_net(dev), IPCB(skb)->iif);
+                if (!dev)
+                        goto drop;
+        }
+
+        in_dev = __in_dev_get_rcu(dev);
         if (!in_dev)
                 goto drop;
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 872b4cb136d3..94d4cd2d5ea4 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1267,7 +1267,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
         if (mtu)
                 return mtu;
 
-        mtu = dst->dev->mtu;
+        mtu = READ_ONCE(dst->dev->mtu);
 
         if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
                 if (rt->rt_uses_gateway && mtu > 576)
@@ -2769,14 +2769,21 @@ static int inet_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
         if (rtm->rtm_flags & RTM_F_LOOKUP_TABLE)
                 table_id = rt->rt_table_id;
 
-        if (rtm->rtm_flags & RTM_F_FIB_MATCH)
+        if (rtm->rtm_flags & RTM_F_FIB_MATCH) {
+                if (!res.fi) {
+                        err = fib_props[res.type].error;
+                        if (!err)
+                                err = -EHOSTUNREACH;
+                        goto errout_free;
+                }
                 err = fib_dump_info(skb, NETLINK_CB(in_skb).portid,
                                     nlh->nlmsg_seq, RTM_NEWROUTE, table_id,
                                     rt->rt_type, res.prefix, res.prefixlen,
                                     fl4.flowi4_tos, res.fi, 0);
-        else
+        } else {
                 err = rt_fill_info(net, dst, src, table_id, &fl4, skb,
                                    NETLINK_CB(in_skb).portid, nlh->nlmsg_seq);
+        }
         if (err < 0)
                 goto errout_free;
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d73903fe8c83..ddc854728a60 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3009,8 +3009,7 @@ void tcp_rearm_rto(struct sock *sk)
                         /* delta_us may not be positive if the socket is locked
                          * when the retrans timer fires and is rescheduled.
                          */
-                        if (delta_us > 0)
-                                rto = usecs_to_jiffies(delta_us);
+                        rto = usecs_to_jiffies(max_t(int, delta_us, 1));
                 }
                 inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, rto,
                                           TCP_RTO_MAX);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cb633884e825..25fb14490d6a 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1585,7 +1585,8 @@ int udp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, int noblock,
                 return ip_recv_error(sk, msg, len, addr_len);
 
 try_again:
-        peeking = off = sk_peek_offset(sk, flags);
+        peeking = flags & MSG_PEEK;
+        off = sk_peek_offset(sk, flags);
         skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
         if (!skb)
                 return err;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 8c58c7558de0..549aacc3cb2c 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1013,6 +1013,8 @@ add:
                 nsiblings = iter->rt6i_nsiblings;
                 iter->rt6i_node = NULL;
                 fib6_purge_rt(iter, fn, info->nl_net);
+                if (fn->rr_ptr == iter)
+                        fn->rr_ptr = NULL;
                 rt6_release(iter);
 
                 if (nsiblings) {
@@ -1026,6 +1028,8 @@ add:
                                         *ins = iter->dst.rt6_next;
                                         iter->rt6i_node = NULL;
                                         fib6_purge_rt(iter, fn, info->nl_net);
+                                        if (fn->rr_ptr == iter)
+                                                fn->rr_ptr = NULL;
                                         rt6_release(iter);
                                         nsiblings--;
                                 } else {
@@ -1114,7 +1118,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
                         /* Create subtree root node */
                         sfn = node_alloc();
                         if (!sfn)
-                                goto st_failure;
+                                goto failure;
 
                         sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
@@ -1131,12 +1135,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
                         if (IS_ERR(sn)) {
                                 /* If it is failed, discard just allocated
-                                   root, and then (in st_failure) stale node
+                                   root, and then (in failure) stale node
                                    in main tree.
                                  */
                                 node_free(sfn);
                                 err = PTR_ERR(sn);
-                                goto st_failure;
+                                goto failure;
                         }
 
                         /* Now link new subtree to main tree */
@@ -1151,7 +1155,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
 
                         if (IS_ERR(sn)) {
                                 err = PTR_ERR(sn);
-                                goto st_failure;
+                                goto failure;
                         }
                 }
 
@@ -1192,18 +1196,17 @@ out:
                         atomic_inc(&pn->leaf->rt6i_ref);
                 }
 #endif
-                /* Always release dst as dst->__refcnt is guaranteed
-                 * to be taken before entering this function
-                 */
-                dst_release_immediate(&rt->dst);
+                goto failure;
         }
         return err;
 
-#ifdef CONFIG_IPV6_SUBTREES
-        /* Subtree creation failed, probably main tree node
-           is orphan. If it is, shoot it.
+failure:
+        /* fn->leaf could be NULL if fn is an intermediate node and we
+         * failed to add the new route to it in both subtree creation
+         * failure and fib6_add_rt2node() failure case.
+         * In both cases, fib6_repair_tree() should be called to fix
+         * fn->leaf.
          */
-st_failure:
         if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
                 fib6_repair_tree(info->nl_net, fn);
         /* Always release dst as dst->__refcnt is guaranteed
@@ -1211,7 +1214,6 @@ st_failure:
          */
         dst_release_immediate(&rt->dst);
         return err;
-#endif
 }
 
 /*
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 19afcaf4a22e..2a15f1bb6ef8 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -366,7 +366,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
                 return ipv6_recv_rxpmtu(sk, msg, len, addr_len);
 
 try_again:
-        peeking = off = sk_peek_offset(sk, flags);
+        peeking = flags & MSG_PEEK;
+        off = sk_peek_offset(sk, flags);
         skb = __skb_recv_udp(sk, flags, noblock, &peeked, &off, &err);
         if (!skb)
                 return err;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 2e6990f8b80b..23fa7c8b09a5 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -2213,7 +2213,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
 {
         struct sock *sk = sock->sk;
         struct irda_sock *self = irda_sk(sk);
-        struct irda_device_list list;
+        struct irda_device_list list = { 0 };
         struct irda_device_info *discoveries;
         struct irda_ias_set *   ias_opt;        /* IAS get/query params */
         struct ias_object *     ias_obj;        /* Object in IAS */
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index e4610676299b..a54a556fcdb5 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -1337,6 +1337,7 @@ int ovs_execute_actions(struct datapath *dp, struct sk_buff *skb,
                 goto out;
         }
 
+        OVS_CB(skb)->acts_origlen = acts->orig_len;
         err = do_execute_actions(dp, skb, key,
                                  acts->actions, acts->actions_len);
 
diff --git a/net/openvswitch/datapath.c b/net/openvswitch/datapath.c
index f6e229b51dfb..76cf273a56c7 100644
--- a/net/openvswitch/datapath.c
+++ b/net/openvswitch/datapath.c
@@ -367,7 +367,7 @@ static int queue_gso_packets(struct datapath *dp, struct sk_buff *skb,
 }
 
 static size_t upcall_msg_size(const struct dp_upcall_info *upcall_info,
-                              unsigned int hdrlen)
+                              unsigned int hdrlen, int actions_attrlen)
 {
         size_t size = NLMSG_ALIGN(sizeof(struct ovs_header))
                 + nla_total_size(hdrlen) /* OVS_PACKET_ATTR_PACKET */
@@ -384,7 +384,7 @@ static size_t upcall_msg_size(const struct dp_upcall_info *upcall_info,
 
         /* OVS_PACKET_ATTR_ACTIONS */
         if (upcall_info->actions_len)
-                size += nla_total_size(upcall_info->actions_len);
+                size += nla_total_size(actions_attrlen);
 
         /* OVS_PACKET_ATTR_MRU */
         if (upcall_info->mru)
@@ -451,7 +451,8 @@ static int queue_userspace_packet(struct datapath *dp, struct sk_buff *skb,
         else
                 hlen = skb->len;
 
-        len = upcall_msg_size(upcall_info, hlen - cutlen);
+        len = upcall_msg_size(upcall_info, hlen - cutlen,
+                              OVS_CB(skb)->acts_origlen);
         user_skb = genlmsg_new(len, GFP_ATOMIC);
         if (!user_skb) {
                 err = -ENOMEM;
diff --git a/net/openvswitch/datapath.h b/net/openvswitch/datapath.h
index 5d8dcd88815f..480600649d0b 100644
--- a/net/openvswitch/datapath.h
+++ b/net/openvswitch/datapath.h
@@ -99,11 +99,13 @@ struct datapath {
  * when a packet is received by OVS.
  * @mru: The maximum received fragement size; 0 if the packet is not
  * fragmented.
+ * @acts_origlen: The netlink size of the flow actions applied to this skb.
  * @cutlen: The number of bytes from the packet end to be removed.
  */
 struct ovs_skb_cb {
         struct vport            *input_vport;
         u16                     mru;
+        u16                     acts_origlen;
         u32                     cutlen;
 };
 #define OVS_CB(skb) ((struct ovs_skb_cb *)(skb)->cb)
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index dd30d74824b0..ec3383f97d4c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -223,6 +223,7 @@ void rxrpc_discard_prealloc(struct rxrpc_sock *rx)
         tail = b->call_backlog_tail;
         while (CIRC_CNT(head, tail, size) > 0) {
                 struct rxrpc_call *call = b->call_backlog[tail];
+                call->socket = rx;
                 if (rx->discard_new_call) {
                         _debug("discard %lx", call->user_call_ID);
                         rx->discard_new_call(call, call->user_call_ID);
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index d516ba8178b8..541707802a23 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -41,6 +41,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
 {
         struct xt_tgchk_param par;
         struct xt_target *target;
+        struct ipt_entry e = {};
         int ret = 0;
 
         target = xt_request_find_target(AF_INET, t->u.user.name,
@@ -52,6 +53,7 @@ static int ipt_init_target(struct net *net, struct xt_entry_target *t,
         memset(&par, 0, sizeof(par));
         par.net       = net;
         par.table     = table;
+        par.entryinfo = &e;
         par.target    = target;
         par.targinfo  = t->data;
         par.hook_mask = hook;
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index ebeeb87e6d44..eef6b077f30e 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -190,7 +190,7 @@ static void tcf_chain_flush(struct tcf_chain *chain)
 {
         struct tcf_proto *tp;
 
-        if (*chain->p_filter_chain)
+        if (chain->p_filter_chain)
                 RCU_INIT_POINTER(*chain->p_filter_chain, NULL);
         while ((tp = rtnl_dereference(chain->filter_chain)) != NULL) {
                 RCU_INIT_POINTER(chain->filter_chain, tp->next);
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index a2a1c1d08d51..51c488769590 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -512,7 +512,9 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
 {
         addr->sa.sa_family = AF_INET6;
         addr->v6.sin6_port = port;
+        addr->v6.sin6_flowinfo = 0;
         addr->v6.sin6_addr = *saddr;
+        addr->v6.sin6_scope_id = 0;
 }
 
 /* Compare addresses exactly.
diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
index 9bfe886ab330..750949dfc1d7 100644
--- a/net/tipc/netlink_compat.c
+++ b/net/tipc/netlink_compat.c
@@ -258,13 +258,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
         arg = nlmsg_new(0, GFP_KERNEL);
         if (!arg) {
                 kfree_skb(msg->rep);
+                msg->rep = NULL;
                 return -ENOMEM;
         }
 
         err = __tipc_nl_compat_dumpit(cmd, msg, arg);
-        if (err)
+        if (err) {
                 kfree_skb(msg->rep);
-
+                msg->rep = NULL;
+        }
         kfree_skb(arg);
 
         return err;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 5c53f22d62e8..7f46bab4ce5c 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -2283,10 +2283,7 @@ static int unix_stream_read_generic(struct unix_stream_read_state *state,
          */
         mutex_lock(&u->iolock);
 
-        if (flags & MSG_PEEK)
-                skip = sk_peek_offset(sk, flags);
-        else
-                skip = 0;
+        skip = max(sk_peek_offset(sk, flags), 0);
 
         do {
                 int chunk;