Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "Fixes keep trickling in:

  1) Various IP fragmentation memory limit hardening changes from Eric
     Dumazet.

  2) Revert ipv6 metrics leak change, it causes more problems than it
     fixes for now.

  3) Fix WoL regression in stmmac driver, from Jose Abreu.

  4) Netlink socket spectre v1 gadget fix, from Jeremy Cline"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  Revert "net/ipv6: fix metrics leak"
  rxrpc: Fix user call ID check in rxrpc_service_prealloc_one
  net: dsa: Do not suspend/resume closed slave_dev
  netlink: Fix spectre v1 gadget in netlink_create()
  Documentation: dpaa2: Use correct heading adornment
  net: stmmac: Fix WoL for PCI-based setups
  bonding: avoid lockdep confusion in bond_get_stats()
  enic: do not call enic_change_mtu in enic_probe
  ipv4: frags: handle possible skb truesize change
  inet: frag: enforce memory limits earlier
  net/mlx5e: IPoIB, Set the netdevice sw mtu in ipoib enhanced flow
  net/mlx5e: Fix null pointer access when setting MTU of vport representor
  net/mlx5e: Set port trust mode to PCP as default
  net/mlx5e: E-Switch, Initialize eswitch only if eswitch manager
  net: dsa: mv88e6xxx: Fix SERDES support on 88E6141/6341
  brcmfmac: fix regression in parsing NVRAM for multiple devices
  iwlwifi: add more card IDs for 9000 series

6 files changed, 22 insertions, 19 deletions

diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 1e3b6a6d8a40..732369c80644 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -1248,6 +1248,9 @@ int dsa_slave_suspend(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_detach(slave_dev);
 
         rtnl_lock();
@@ -1261,6 +1264,9 @@ int dsa_slave_resume(struct net_device *slave_dev)
 {
         struct dsa_port *dp = dsa_slave_to_port(slave_dev);
 
+        if (!netif_running(slave_dev))
+                return 0;
+
         netif_device_attach(slave_dev);
 
         rtnl_lock();
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 1e4cf3ab560f..0d70608cc2e1 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -157,9 +157,6 @@ static struct inet_frag_queue *inet_frag_alloc(struct netns_frags *nf,
 {
         struct inet_frag_queue *q;
 
-        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
-                return NULL;
-
         q = kmem_cache_zalloc(f->frags_cachep, GFP_ATOMIC);
         if (!q)
                 return NULL;
@@ -204,6 +201,9 @@ struct inet_frag_queue *inet_frag_find(struct netns_frags *nf, void *key)
 {
         struct inet_frag_queue *fq;
 
+        if (!nf->high_thresh || frag_mem_limit(nf) > nf->high_thresh)
+                return NULL;
+
         rcu_read_lock();
 
         fq = rhashtable_lookup(&nf->rhashtable, key, nf->f->rhash_params);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 8e9528ebaa8e..d14d741fb05e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -383,11 +383,16 @@ found:
                 int i = end - next->ip_defrag_offset; /* overlap is 'i' bytes */
 
                 if (i < next->len) {
+                        int delta = -next->truesize;
+
                         /* Eat head of the next overlapped fragment
                          * and leave the loop. The next ones cannot overlap.
                          */
                         if (!pskb_pull(next, i))
                                 goto err;
+                        delta += next->truesize;
+                        if (delta)
+                                add_frag_mem_limit(qp->q.net, delta);
                         next->ip_defrag_offset += i;
                         qp->q.meat -= i;
                         if (next->ip_summed != CHECKSUM_UNNECESSARY)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 211a2d437b56..d212738e9d10 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -167,22 +167,11 @@ struct fib6_info *fib6_info_alloc(gfp_t gfp_flags)
         return f6i;
 }
 
-static void fib6_metrics_release(struct fib6_info *f6i)
-{
-        struct dst_metrics *m;
-
-        if (!f6i)
-                return;
-
-        m = f6i->fib6_metrics;
-        if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))
-                kfree(m);
-}
-
 void fib6_info_destroy_rcu(struct rcu_head *head)
 {
         struct fib6_info *f6i = container_of(head, struct fib6_info, rcu);
         struct rt6_exception_bucket *bucket;
+        struct dst_metrics *m;
 
         WARN_ON(f6i->fib6_node);
 
@@ -212,7 +201,9 @@ void fib6_info_destroy_rcu(struct rcu_head *head)
         if (f6i->fib6_nh.nh_dev)
                 dev_put(f6i->fib6_nh.nh_dev);
 
-        fib6_metrics_release(f6i);
+        m = f6i->fib6_metrics;
+        if (m != &dst_default_metrics && refcount_dec_and_test(&m->refcnt))
+                kfree(m);
 
         kfree(f6i);
 }
@@ -896,7 +887,6 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
 
                         from = rcu_dereference_protected(pcpu_rt->from,
                                              lockdep_is_held(&table->tb6_lock));
-                        fib6_metrics_release(from);
                         rcu_assign_pointer(pcpu_rt->from, NULL);
                         fib6_info_release(from);
                 }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 7d860a22e5fb..c09d16870f74 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -63,6 +63,7 @@
 #include <linux/hash.h>
 #include <linux/genetlink.h>
 #include <linux/net_namespace.h>
+#include <linux/nospec.h>
 
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
@@ -679,6 +680,7 @@ static int netlink_create(struct net *net, struct socket *sock, int protocol,
 
         if (protocol < 0 || protocol >= MAX_LINKS)
                 return -EPROTONOSUPPORT;
+        protocol = array_index_nospec(protocol, MAX_LINKS);
 
         netlink_lock_table();
 #ifdef CONFIG_MODULES
diff --git a/net/rxrpc/call_accept.c b/net/rxrpc/call_accept.c
index a9a9be5519b9..9d1e298b784c 100644
--- a/net/rxrpc/call_accept.c
+++ b/net/rxrpc/call_accept.c
@@ -116,9 +116,9 @@ static int rxrpc_service_prealloc_one(struct rxrpc_sock *rx,
                 while (*pp) {
                         parent = *pp;
                         xcall = rb_entry(parent, struct rxrpc_call, sock_node);
-                        if (user_call_ID < call->user_call_ID)
+                        if (user_call_ID < xcall->user_call_ID)
                                 pp = &(*pp)->rb_left;
-                        else if (user_call_ID > call->user_call_ID)
+                        else if (user_call_ID > xcall->user_call_ID)
                                 pp = &(*pp)->rb_right;
                         else
                                 goto id_in_use;