Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "This fixes some fallout from the net-next merge the other day, plus
  some non-merge-window-related bug fixes:

  1) Fix sparse warnings in bcmgenet, systemport, b53, and mt7530
     (Florian Fainelli)

  2) pptp does a bogus dst_release() on a route we have a single
     refcount on, and attached to a socket, which needs that refcount
     (Eric Dumazet)

  3) UDP connected sockets on ipv6 can race with route update handling,
     resulting in a pre-PMTU update route still stuck on the socket and
     thus continuing to get ICMPV6_PKT_TOOBIG errors. We end up never
     seeing the updated route. (Alexey Kodanev)

  4) Missing list initializer(s) in TIPC (Jon Maloy)

  5) Connect phy early to prevent crashes in lan78xx driver (Alexander
     Graf)

  6) Fix build with modular NVMEM (Arnd Bergmann)

  7) netdevsim canot mark nsim_devlink_net_ops and nsim_fib_net_ops as
     __net_initdata, as these are references from module unload
     unconditionally (Arnd Bergmann)"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (23 commits)
  netdevsim: remove incorrect __net_initdata annotations
  sfc: remove ctpio_dmabuf_start from stats
  inet: frags: fix ip6frag_low_thresh boundary
  tipc: Fix namespace violation in tipc_sk_fill_sock_diag
  net: avoid unneeded atomic operation in ip*_append_data()
  nvmem: disallow modular CONFIG_NVMEM
  net: hns3: fix length overflow when CONFIG_ARM64_64K_PAGES
  nfp: use full 40 bits of the NSP buffer address
  lan78xx: Connect phy early
  nfp: add a separate counter for packets with CHECKSUM_COMPLETE
  tipc: Fix missing list initializations in struct tipc_subscription
  ipv6: udp: set dst cache for a connected sk if current not valid
  ipv6: udp: convert 'connected' to bool type in udpv6_sendmsg()
  ipv6: allow to cache dst for a connected sk in ip6_sk_dst_lookup_flow()
  ipv6: add a wrapper for ip6_dst_store() with flowi6 checks
  net: phy: marvell10g: add thermal hwmon device
  pptp: remove a buggy dst release in pptp_connect()
  net: dsa: mt7530: Use NULL instead of plain integer
  net: dsa: b53: Fix sparse warnings in b53_mmap.c
  af_unix: remove redundant lockdep class
  ...

15 files changed, 60 insertions, 58 deletions

diff --git a/net/ieee802154/6lowpan/reassembly.c b/net/ieee802154/6lowpan/reassembly.c
index 44f148a6bb57..1790b65944b3 100644
--- a/net/ieee802154/6lowpan/reassembly.c
+++ b/net/ieee802154/6lowpan/reassembly.c
@@ -411,7 +411,6 @@ err:
 }
 
 #ifdef CONFIG_SYSCTL
-static long zero;
 
 static struct ctl_table lowpan_frags_ns_ctl_table[] = {
         {
@@ -428,7 +427,6 @@ static struct ctl_table lowpan_frags_ns_ctl_table[] = {
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
                 .proc_handler   = proc_doulongvec_minmax,
-                .extra1         = &zero,
                 .extra2         = &init_net.ieee802154_lowpan.frags.high_thresh
         },
         {
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 994fa70a910f..8e9528ebaa8e 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -667,7 +667,7 @@ struct sk_buff *ip_check_defrag(struct net *net, struct sk_buff *skb, u32 user)
 EXPORT_SYMBOL(ip_check_defrag);
 
 #ifdef CONFIG_SYSCTL
-static long zero;
+static int dist_min;
 
 static struct ctl_table ip4_frags_ns_ctl_table[] = {
         {
@@ -684,7 +684,6 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
                 .proc_handler   = proc_doulongvec_minmax,
-                .extra1         = &zero,
                 .extra2         = &init_net.ipv4.frags.high_thresh
         },
         {
@@ -700,7 +699,7 @@ static struct ctl_table ip4_frags_ns_ctl_table[] = {
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .extra1         = &zero
+                .extra1         = &dist_min,
         },
         { }
 };
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 94cacae76aca..4c11b810a447 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -1090,7 +1090,8 @@ alloc_new_skb:
                 length -= copy;
         }
 
-        refcount_add(wmem_alloc_delta, &sk->sk_wmem_alloc);
+        if (wmem_alloc_delta)
+                refcount_add(wmem_alloc_delta, &sk->sk_wmem_alloc);
         return 0;
 
 error_efault:
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 88bc2ef7c7a8..a02ad100f0d7 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -106,14 +106,7 @@ int ip6_datagram_dst_update(struct sock *sk, bool fix_sk_saddr)
                 }
         }
 
-        ip6_dst_store(sk, dst,
-                      ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
-                      &sk->sk_v6_daddr : NULL,
-#ifdef CONFIG_IPV6_SUBTREES
-                      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
-                      &np->saddr :
-#endif
-                      NULL);
+        ip6_sk_dst_store_flow(sk, dst, &fl6);
 
 out:
         fl6_sock_release(flowlabel);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index e6eaa4dd9f60..b8ee50e94af3 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1105,23 +1105,32 @@ EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
  *      @sk: socket which provides the dst cache and route info
  *      @fl6: flow to lookup
  *      @final_dst: final destination address for ipsec lookup
+ *      @connected: whether @sk is connected or not
  *
  *      This function performs a route lookup on the given flow with the
  *      possibility of using the cached route in the socket if it is valid.
  *      It will take the socket dst lock when operating on the dst cache.
  *      As a result, this function can only be used in process context.
  *
+ *      In addition, for a connected socket, cache the dst in the socket
+ *      if the current cache is not valid.
+ *
  *      It returns a valid dst pointer on success, or a pointer encoded
  *      error code.
  */
 struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi6 *fl6,
-                                         const struct in6_addr *final_dst)
+                                         const struct in6_addr *final_dst,
+                                         bool connected)
 {
         struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
 
         dst = ip6_sk_dst_check(sk, dst, fl6);
-        if (!dst)
-                dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
+        if (dst)
+                return dst;
+
+        dst = ip6_dst_lookup_flow(sk, fl6, final_dst);
+        if (connected && !IS_ERR(dst))
+                ip6_sk_dst_store_flow(sk, dst_clone(dst), fl6);
 
         return dst;
 }
@@ -1536,7 +1545,8 @@ alloc_new_skb:
                 length -= copy;
         }
 
-        refcount_add(wmem_alloc_delta, &sk->sk_wmem_alloc);
+        if (wmem_alloc_delta)
+                refcount_add(wmem_alloc_delta, &sk->sk_wmem_alloc);
         return 0;
 
 error_efault:
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 3622aac343ae..5e0332014c17 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -55,7 +55,6 @@ static const char nf_frags_cache_name[] = "nf-frags";
 static struct inet_frags nf_frags;
 
 #ifdef CONFIG_SYSCTL
-static long zero;
 
 static struct ctl_table nf_ct_frag6_sysctl_table[] = {
         {
@@ -71,7 +70,6 @@ static struct ctl_table nf_ct_frag6_sysctl_table[] = {
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
                 .proc_handler   = proc_doulongvec_minmax,
-                .extra1         = &zero,
                 .extra2         = &init_net.nf_frag.frags.high_thresh
         },
         {
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index d12c55dad7d1..746eeae7f581 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -121,7 +121,7 @@ static int ping_v6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         ipc6.tclass = np->tclass;
         fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
 
-        dst = ip6_sk_dst_lookup_flow(sk, &fl6,  daddr);
+        dst = ip6_sk_dst_lookup_flow(sk, &fl6, daddr, false);
         if (IS_ERR(dst))
                 return PTR_ERR(dst);
         rt = (struct rt6_info *) dst;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 70e4a578b2fb..4979610287e2 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -548,7 +548,6 @@ static const struct inet6_protocol frag_protocol = {
 };
 
 #ifdef CONFIG_SYSCTL
-static int zero;
 
 static struct ctl_table ip6_frags_ns_ctl_table[] = {
         {
@@ -565,7 +564,6 @@ static struct ctl_table ip6_frags_ns_ctl_table[] = {
                 .maxlen         = sizeof(unsigned long),
                 .mode           = 0644,
                 .proc_handler   = proc_doulongvec_minmax,
-                .extra1         = &zero,
                 .extra2         = &init_net.ipv6.frags.high_thresh
         },
         {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index f239f91d2efb..49b954d6d0fa 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2229,6 +2229,23 @@ void ip6_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, __be32 mtu)
 }
 EXPORT_SYMBOL_GPL(ip6_sk_update_pmtu);
 
+void ip6_sk_dst_store_flow(struct sock *sk, struct dst_entry *dst,
+                           const struct flowi6 *fl6)
+{
+#ifdef CONFIG_IPV6_SUBTREES
+        struct ipv6_pinfo *np = inet6_sk(sk);
+#endif
+
+        ip6_dst_store(sk, dst,
+                      ipv6_addr_equal(&fl6->daddr, &sk->sk_v6_daddr) ?
+                      &sk->sk_v6_daddr : NULL,
+#ifdef CONFIG_IPV6_SUBTREES
+                      ipv6_addr_equal(&fl6->saddr, &np->saddr) ?
+                      &np->saddr :
+#endif
+                      NULL);
+}
+
 /* Handle redirects */
 struct ip6rd_flowi {
         struct flowi6 fl6;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 6861ed479469..4ec76a87aeb8 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1116,10 +1116,10 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         struct dst_entry *dst;
         struct ipcm6_cookie ipc6;
         int addr_len = msg->msg_namelen;
+        bool connected = false;
         int ulen = len;
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int err;
-        int connected = 0;
         int is_udplite = IS_UDPLITE(sk);
         int (*getfrag)(void *, char *, int, int, int, struct sk_buff *);
         struct sockcm_cookie sockc;
@@ -1241,7 +1241,7 @@ do_udp_sendmsg:
                 fl6.fl6_dport = inet->inet_dport;
                 daddr = &sk->sk_v6_daddr;
                 fl6.flowlabel = np->flow_label;
-                connected = 1;
+                connected = true;
         }
 
         if (!fl6.flowi6_oif)
@@ -1271,7 +1271,7 @@ do_udp_sendmsg:
                 }
                 if (!(opt->opt_nflen|opt->opt_flen))
                         opt = NULL;
-                connected = 0;
+                connected = false;
         }
         if (!opt) {
                 opt = txopt_get(np);
@@ -1293,11 +1293,11 @@ do_udp_sendmsg:
 
         final_p = fl6_update_dst(&fl6, opt, &final);
         if (final_p)
-                connected = 0;
+                connected = false;
 
         if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr)) {
                 fl6.flowi6_oif = np->mcast_oif;
-                connected = 0;
+                connected = false;
         } else if (!fl6.flowi6_oif)
                 fl6.flowi6_oif = np->ucast_oif;
 
@@ -1308,7 +1308,7 @@ do_udp_sendmsg:
 
         fl6.flowlabel = ip6_make_flowinfo(ipc6.tclass, fl6.flowlabel);
 
-        dst = ip6_sk_dst_lookup_flow(sk, &fl6, final_p);
+        dst = ip6_sk_dst_lookup_flow(sk, &fl6, final_p, connected);
         if (IS_ERR(dst)) {
                 err = PTR_ERR(dst);
                 dst = NULL;
@@ -1333,7 +1333,7 @@ back_from_confirm:
                 err = PTR_ERR(skb);
                 if (!IS_ERR_OR_NULL(skb))
                         err = udp_v6_send_skb(skb, &fl6);
-                goto release_dst;
+                goto out;
         }
 
         lock_sock(sk);
@@ -1367,23 +1367,6 @@ do_append_data:
                 err = np->recverr ? net_xmit_errno(err) : 0;
         release_sock(sk);
 
-release_dst:
-        if (dst) {
-                if (connected) {
-                        ip6_dst_store(sk, dst,
-                                      ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
-                                      &sk->sk_v6_daddr : NULL,
-#ifdef CONFIG_IPV6_SUBTREES
-                                      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
-                                      &np->saddr :
-#endif
-                                      NULL);
-                } else {
-                        dst_release(dst);
-                }
-                dst = NULL;
-        }
-
 out:
         dst_release(dst);
         fl6_sock_release(flowlabel);
diff --git a/net/rxrpc/input.c b/net/rxrpc/input.c
index 21800e6f5019..0410d2277ca2 100644
--- a/net/rxrpc/input.c
+++ b/net/rxrpc/input.c
@@ -1200,6 +1200,12 @@ void rxrpc_data_ready(struct sock *udp_sk)
                     !rxrpc_validate_jumbo(skb))
                         goto bad_message;
                 break;
+
+                /* Packet types 9-11 should just be ignored. */
+        case RXRPC_PACKET_TYPE_PARAMS:
+        case RXRPC_PACKET_TYPE_10:
+        case RXRPC_PACKET_TYPE_11:
+                goto discard;
         }
 
         rcu_read_lock();
diff --git a/net/rxrpc/protocol.h b/net/rxrpc/protocol.h
index 4bddcf3face3..93da73bf7098 100644
--- a/net/rxrpc/protocol.h
+++ b/net/rxrpc/protocol.h
@@ -46,6 +46,9 @@ struct rxrpc_wire_header {
 #define RXRPC_PACKET_TYPE_CHALLENGE     6       /* connection security challenge (SRVR->CLNT) */
 #define RXRPC_PACKET_TYPE_RESPONSE      7       /* connection secutity response (CLNT->SRVR) */
 #define RXRPC_PACKET_TYPE_DEBUG         8       /* debug info request */
+#define RXRPC_PACKET_TYPE_PARAMS        9       /* Parameter negotiation (unspec'd, ignore) */
+#define RXRPC_PACKET_TYPE_10            10      /* Ignored */
+#define RXRPC_PACKET_TYPE_11            11      /* Ignored */
 #define RXRPC_PACKET_TYPE_VERSION       13      /* version string request */
 #define RXRPC_N_PACKET_TYPES            14      /* number of packet types (incl type 0) */
 
@@ -78,6 +81,9 @@ struct rxrpc_wire_header {
                 (1 << RXRPC_PACKET_TYPE_CHALLENGE) |    \
                 (1 << RXRPC_PACKET_TYPE_RESPONSE) |     \
                 /*(1 << RXRPC_PACKET_TYPE_DEBUG) | */   \
+                (1 << RXRPC_PACKET_TYPE_PARAMS) |       \
+                (1 << RXRPC_PACKET_TYPE_10) |           \
+                (1 << RXRPC_PACKET_TYPE_11) |           \
                 (1 << RXRPC_PACKET_TYPE_VERSION))
 
 /*****************************************************************************/
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 3e5eba30865e..cee6674a3bf4 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -3280,7 +3280,8 @@ int tipc_sk_fill_sock_diag(struct sk_buff *skb, struct tipc_sock *tsk,
             nla_put_u32(skb, TIPC_NLA_SOCK_TIPC_STATE, (u32)sk->sk_state) ||
             nla_put_u32(skb, TIPC_NLA_SOCK_INO, sock_i_ino(sk)) ||
             nla_put_u32(skb, TIPC_NLA_SOCK_UID,
-                        from_kuid_munged(sk_user_ns(sk), sock_i_uid(sk))) ||
+                        from_kuid_munged(sk_user_ns(NETLINK_CB(skb).sk),
+                                         sock_i_uid(sk))) ||
             nla_put_u64_64bit(skb, TIPC_NLA_SOCK_COOKIE,
                               tipc_diag_gen_cookie(sk),
                               TIPC_NLA_SOCK_PAD))
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 6925a989569b..b7d80bc5f4ab 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -145,6 +145,8 @@ struct tipc_subscription *tipc_sub_subscribe(struct net *net,
                 pr_warn("Subscription rejected, no memory\n");
                 return NULL;
         }
+        INIT_LIST_HEAD(&sub->service_list);
+        INIT_LIST_HEAD(&sub->sub_list);
         sub->net = net;
         sub->conid = conid;
         sub->inactive = false;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index aded82da1aea..68bb70a62afe 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -745,14 +745,6 @@ static struct proto unix_proto = {
         .obj_size               = sizeof(struct unix_sock),
 };
 
-/*
- * AF_UNIX sockets do not interact with hardware, hence they
- * dont trigger interrupts - so it's safe for them to have
- * bh-unsafe locking for their sk_receive_queue.lock. Split off
- * this special lock-class by reinitializing the spinlock key:
- */
-static struct lock_class_key af_unix_sk_receive_queue_lock_key;
-
 static struct sock *unix_create1(struct net *net, struct socket *sock, int kern)
 {
         struct sock *sk = NULL;
@@ -767,8 +759,6 @@ static struct sock *unix_create1(struct net *net, struct socket *sock, int kern)
                 goto out;
 
         sock_init_data(sock, sk);
-        lockdep_set_class(&sk->sk_receive_queue.lock,
-                                &af_unix_sk_receive_queue_lock_key);
 
         sk->sk_allocation       = GFP_KERNEL_ACCOUNT;
         sk->sk_write_space      = unix_write_space;