19 files changed, 128 insertions, 32 deletions

diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
index d4a548a6a55c..a452d5a1b0f3 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_tc_flower.c
@@ -111,6 +111,9 @@ static void cxgb4_process_flow_match(struct net_device *dev,
                         ethtype_mask = 0;
                 }
 
+                if (ethtype_key == ETH_P_IPV6)
+                        fs->type = 1;
+
                 fs->val.ethtype = ethtype_key;
                 fs->mask.ethtype = ethtype_mask;
                 fs->val.proto = key->ip_proto;
@@ -205,8 +208,8 @@ static void cxgb4_process_flow_match(struct net_device *dev,
                                            VLAN_PRIO_SHIFT);
                 vlan_tci_mask = mask->vlan_id | (mask->vlan_priority <<
                                                  VLAN_PRIO_SHIFT);
-                fs->val.ivlan = cpu_to_be16(vlan_tci);
-                fs->mask.ivlan = cpu_to_be16(vlan_tci_mask);
+                fs->val.ivlan = vlan_tci;
+                fs->mask.ivlan = vlan_tci_mask;
 
                 /* Chelsio adapters use ivlan_vld bit to match vlan packets
                  * as 802.1Q. Also, when vlan tag is present in packets,
diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index c6e859a27ee6..e180657a02ef 100644
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -4634,6 +4634,15 @@ int be_update_queues(struct be_adapter *adapter)
 
         be_schedule_worker(adapter);
 
+        /*
+         * The IF was destroyed and re-created. We need to clear
+         * all promiscuous flags valid for the destroyed IF.
+         * Without this promisc mode is not restored during
+         * be_open() because the driver thinks that it is
+         * already enabled in HW.
+         */
+        adapter->if_flags &= ~BE_IF_FLAGS_ALL_PROMISCUOUS;
+
         if (netif_running(netdev))
                 status = be_open(netdev);
 
diff --git a/drivers/net/ethernet/ibm/ibmvnic.c b/drivers/net/ethernet/ibm/ibmvnic.c
index ab2e1917cd04..b65f5f3ac034 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.c
+++ b/drivers/net/ethernet/ibm/ibmvnic.c
@@ -410,6 +410,10 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter)
         struct ibmvnic_rx_pool *rx_pool;
         int rx_scrqs;
         int i, j, rc;
+        u64 *size_array;
+
+        size_array = (u64 *)((u8 *)(adapter->login_rsp_buf) +
+                be32_to_cpu(adapter->login_rsp_buf->off_rxadd_buff_size));
 
         rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
         for (i = 0; i < rx_scrqs; i++) {
@@ -417,7 +421,17 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter)
 
                 netdev_dbg(adapter->netdev, "Re-setting rx_pool[%d]\n", i);
 
-                rc = reset_long_term_buff(adapter, &rx_pool->long_term_buff);
+                if (rx_pool->buff_size != be64_to_cpu(size_array[i])) {
+                        free_long_term_buff(adapter, &rx_pool->long_term_buff);
+                        rx_pool->buff_size = be64_to_cpu(size_array[i]);
+                        alloc_long_term_buff(adapter, &rx_pool->long_term_buff,
+                                             rx_pool->size *
+                                             rx_pool->buff_size);
+                } else {
+                        rc = reset_long_term_buff(adapter,
+                                                  &rx_pool->long_term_buff);
+                }
+
                 if (rc)
                         return rc;
 
@@ -439,14 +453,12 @@ static int reset_rx_pools(struct ibmvnic_adapter *adapter)
 static void release_rx_pools(struct ibmvnic_adapter *adapter)
 {
         struct ibmvnic_rx_pool *rx_pool;
-        int rx_scrqs;
         int i, j;
 
         if (!adapter->rx_pool)
                 return;
 
-        rx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_rxadd_subcrqs);
-        for (i = 0; i < rx_scrqs; i++) {
+        for (i = 0; i < adapter->num_active_rx_pools; i++) {
                 rx_pool = &adapter->rx_pool[i];
 
                 netdev_dbg(adapter->netdev, "Releasing rx_pool[%d]\n", i);
@@ -469,6 +481,7 @@ static void release_rx_pools(struct ibmvnic_adapter *adapter)
 
         kfree(adapter->rx_pool);
         adapter->rx_pool = NULL;
+        adapter->num_active_rx_pools = 0;
 }
 
 static int init_rx_pools(struct net_device *netdev)
@@ -493,6 +506,8 @@ static int init_rx_pools(struct net_device *netdev)
                 return -1;
         }
 
+        adapter->num_active_rx_pools = 0;
+
         for (i = 0; i < rxadd_subcrqs; i++) {
                 rx_pool = &adapter->rx_pool[i];
 
@@ -536,6 +551,8 @@ static int init_rx_pools(struct net_device *netdev)
                 rx_pool->next_free = 0;
         }
 
+        adapter->num_active_rx_pools = rxadd_subcrqs;
+
         return 0;
 }
 
@@ -586,13 +603,12 @@ static void release_vpd_data(struct ibmvnic_adapter *adapter)
 static void release_tx_pools(struct ibmvnic_adapter *adapter)
 {
         struct ibmvnic_tx_pool *tx_pool;
-        int i, tx_scrqs;
+        int i;
 
         if (!adapter->tx_pool)
                 return;
 
-        tx_scrqs = be32_to_cpu(adapter->login_rsp_buf->num_txsubm_subcrqs);
-        for (i = 0; i < tx_scrqs; i++) {
+        for (i = 0; i < adapter->num_active_tx_pools; i++) {
                 netdev_dbg(adapter->netdev, "Releasing tx_pool[%d]\n", i);
                 tx_pool = &adapter->tx_pool[i];
                 kfree(tx_pool->tx_buff);
@@ -603,6 +619,7 @@ static void release_tx_pools(struct ibmvnic_adapter *adapter)
 
         kfree(adapter->tx_pool);
         adapter->tx_pool = NULL;
+        adapter->num_active_tx_pools = 0;
 }
 
 static int init_tx_pools(struct net_device *netdev)
@@ -619,6 +636,8 @@ static int init_tx_pools(struct net_device *netdev)
         if (!adapter->tx_pool)
                 return -1;
 
+        adapter->num_active_tx_pools = 0;
+
         for (i = 0; i < tx_subcrqs; i++) {
                 tx_pool = &adapter->tx_pool[i];
 
@@ -666,6 +685,8 @@ static int init_tx_pools(struct net_device *netdev)
                 tx_pool->producer_index = 0;
         }
 
+        adapter->num_active_tx_pools = tx_subcrqs;
+
         return 0;
 }
 
@@ -860,7 +881,7 @@ static int ibmvnic_get_vpd(struct ibmvnic_adapter *adapter)
         if (adapter->vpd->buff)
                 len = adapter->vpd->len;
 
-        reinit_completion(&adapter->fw_done);
+        init_completion(&adapter->fw_done);
         crq.get_vpd_size.first = IBMVNIC_CRQ_CMD;
         crq.get_vpd_size.cmd = GET_VPD_SIZE;
         ibmvnic_send_crq(adapter, &crq);
@@ -922,6 +943,13 @@ static int init_resources(struct ibmvnic_adapter *adapter)
         if (!adapter->vpd)
                 return -ENOMEM;
 
+        /* Vital Product Data (VPD) */
+        rc = ibmvnic_get_vpd(adapter);
+        if (rc) {
+                netdev_err(netdev, "failed to initialize Vital Product Data (VPD)\n");
+                return rc;
+        }
+
         adapter->map_id = 1;
         adapter->napi = kcalloc(adapter->req_rx_queues,
                                 sizeof(struct napi_struct), GFP_KERNEL);
@@ -995,7 +1023,7 @@ static int __ibmvnic_open(struct net_device *netdev)
 static int ibmvnic_open(struct net_device *netdev)
 {
         struct ibmvnic_adapter *adapter = netdev_priv(netdev);
-        int rc, vpd;
+        int rc;
 
         mutex_lock(&adapter->reset_lock);
 
@@ -1018,11 +1046,6 @@ static int ibmvnic_open(struct net_device *netdev)
         rc = __ibmvnic_open(netdev);
         netif_carrier_on(netdev);
 
-        /* Vital Product Data (VPD) */
-        vpd = ibmvnic_get_vpd(adapter);
-        if (vpd)
-                netdev_err(netdev, "failed to initialize Vital Product Data (VPD)\n");
-
         mutex_unlock(&adapter->reset_lock);
 
         return rc;
@@ -1548,6 +1571,7 @@ static int ibmvnic_set_mac(struct net_device *netdev, void *p)
 static int do_reset(struct ibmvnic_adapter *adapter,
                     struct ibmvnic_rwi *rwi, u32 reset_state)
 {
+        u64 old_num_rx_queues, old_num_tx_queues;
         struct net_device *netdev = adapter->netdev;
         int i, rc;
 
@@ -1557,6 +1581,9 @@ static int do_reset(struct ibmvnic_adapter *adapter,
         netif_carrier_off(netdev);
         adapter->reset_reason = rwi->reset_reason;
 
+        old_num_rx_queues = adapter->req_rx_queues;
+        old_num_tx_queues = adapter->req_tx_queues;
+
         if (rwi->reset_reason == VNIC_RESET_MOBILITY) {
                 rc = ibmvnic_reenable_crq_queue(adapter);
                 if (rc)
@@ -1601,6 +1628,12 @@ static int do_reset(struct ibmvnic_adapter *adapter,
                         rc = init_resources(adapter);
                         if (rc)
                                 return rc;
+                } else if (adapter->req_rx_queues != old_num_rx_queues ||
+                           adapter->req_tx_queues != old_num_tx_queues) {
+                        release_rx_pools(adapter);
+                        release_tx_pools(adapter);
+                        init_rx_pools(netdev);
+                        init_tx_pools(netdev);
                 } else {
                         rc = reset_tx_pools(adapter);
                         if (rc)
@@ -3592,7 +3625,17 @@ static void handle_request_cap_rsp(union ibmvnic_crq *crq,
                          *req_value,
                          (long int)be64_to_cpu(crq->request_capability_rsp.
                                                number), name);
-                *req_value = be64_to_cpu(crq->request_capability_rsp.number);
+
+                if (be16_to_cpu(crq->request_capability_rsp.capability) ==
+                    REQ_MTU) {
+                        pr_err("mtu of %llu is not supported. Reverting.\n",
+                               *req_value);
+                        *req_value = adapter->fallback.mtu;
+                } else {
+                        *req_value =
+                                be64_to_cpu(crq->request_capability_rsp.number);
+                }
+
                 ibmvnic_send_req_caps(adapter, 1);
                 return;
         default:
diff --git a/drivers/net/ethernet/ibm/ibmvnic.h b/drivers/net/ethernet/ibm/ibmvnic.h
index 4487f1e2c266..3aec42118db2 100644
--- a/drivers/net/ethernet/ibm/ibmvnic.h
+++ b/drivers/net/ethernet/ibm/ibmvnic.h
@@ -1091,6 +1091,8 @@ struct ibmvnic_adapter {
         u64 opt_rxba_entries_per_subcrq;
         __be64 tx_rx_desc_req;
         u8 map_id;
+        u64 num_active_rx_pools;
+        u64 num_active_tx_pools;
 
         struct tasklet_struct tasklet;
         enum vnic_state state;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
index e401d9d245f3..b69a705fd787 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx_am.c
@@ -201,9 +201,15 @@ static int mlx5e_am_stats_compare(struct mlx5e_rx_am_stats *curr,
                 return (curr->bpms > prev->bpms) ? MLX5E_AM_STATS_BETTER :
                                                    MLX5E_AM_STATS_WORSE;
 
+        if (!prev->ppms)
+                return curr->ppms ? MLX5E_AM_STATS_BETTER :
+                                    MLX5E_AM_STATS_SAME;
+
         if (IS_SIGNIFICANT_DIFF(curr->ppms, prev->ppms))
                 return (curr->ppms > prev->ppms) ? MLX5E_AM_STATS_BETTER :
                                                    MLX5E_AM_STATS_WORSE;
+        if (!prev->epms)
+                return MLX5E_AM_STATS_SAME;
 
         if (IS_SIGNIFICANT_DIFF(curr->epms, prev->epms))
                 return (curr->epms < prev->epms) ? MLX5E_AM_STATS_BETTER :
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index d56fe32bf48d..8a22ff67b026 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -457,12 +457,10 @@ static enum skb_state defer_bh(struct usbnet *dev, struct sk_buff *skb,
 void usbnet_defer_kevent (struct usbnet *dev, int work)
 {
         set_bit (work, &dev->flags);
-        if (!schedule_work (&dev->kevent)) {
-                if (net_ratelimit())
-                        netdev_err(dev->net, "kevent %d may have been dropped\n", work);
-        } else {
+        if (!schedule_work (&dev->kevent))
+                netdev_dbg(dev->net, "kevent %d may have been dropped\n", work);
+        else
                 netdev_dbg(dev->net, "kevent %d scheduled\n", work);
-        }
 }
 EXPORT_SYMBOL_GPL(usbnet_defer_kevent);
 
diff --git a/net/core/dev.c b/net/core/dev.c
index 0e0ba36eeac9..613fb4066be7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3151,10 +3151,21 @@ static void qdisc_pkt_len_init(struct sk_buff *skb)
                 hdr_len = skb_transport_header(skb) - skb_mac_header(skb);
 
                 /* + transport layer */
-                if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
-                        hdr_len += tcp_hdrlen(skb);
-                else
-                        hdr_len += sizeof(struct udphdr);
+                if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6))) {
+                        const struct tcphdr *th;
+                        struct tcphdr _tcphdr;
+
+                        th = skb_header_pointer(skb, skb_transport_offset(skb),
+                                                sizeof(_tcphdr), &_tcphdr);
+                        if (likely(th))
+                                hdr_len += __tcp_hdrlen(th);
+                } else {
+                        struct udphdr _udphdr;
+
+                        if (skb_header_pointer(skb, skb_transport_offset(skb),
+                                               sizeof(_udphdr), &_udphdr))
+                                hdr_len += sizeof(struct udphdr);
+                }
 
                 if (shinfo->gso_type & SKB_GSO_DODGY)
                         gso_segs = DIV_ROUND_UP(skb->len - hdr_len,
diff --git a/net/ipv4/esp4_offload.c b/net/ipv4/esp4_offload.c
index b1338e576d00..29b333a62ab0 100644
--- a/net/ipv4/esp4_offload.c
+++ b/net/ipv4/esp4_offload.c
@@ -122,6 +122,9 @@ static struct sk_buff *esp4_gso_segment(struct sk_buff *skb,
         if (!xo)
                 goto out;
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))
+                goto out;
+
         seq = xo->seq.low;
 
         x = skb->sp->xvec[skb->sp->len - 1];
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 726f6b608274..2d49717a7421 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -332,7 +332,7 @@ static __be32 igmpv3_get_srcaddr(struct net_device *dev,
                 return htonl(INADDR_ANY);
 
         for_ifa(in_dev) {
-                if (inet_ifa_match(fl4->saddr, ifa))
+                if (fl4->saddr == ifa->ifa_local)
                         return fl4->saddr;
         } endfor_ifa(in_dev);
 
diff --git a/net/ipv4/tcp_offload.c b/net/ipv4/tcp_offload.c
index b6a2aa1dcf56..4d58e2ce0b5b 100644
--- a/net/ipv4/tcp_offload.c
+++ b/net/ipv4/tcp_offload.c
@@ -32,6 +32,9 @@ static void tcp_gso_tstamp(struct sk_buff *skb, unsigned int ts_seq,
 static struct sk_buff *tcp4_gso_segment(struct sk_buff *skb,
                                         netdev_features_t features)
 {
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4))
+                return ERR_PTR(-EINVAL);
+
         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
                 return ERR_PTR(-EINVAL);
 
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 01801b77bd0d..ea6e6e7df0ee 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -203,6 +203,9 @@ static struct sk_buff *udp4_ufo_fragment(struct sk_buff *skb,
                 goto out;
         }
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP))
+                goto out;
+
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                 goto out;
 
diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index dd9627490c7c..f52c314d4c97 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -149,6 +149,9 @@ static struct sk_buff *esp6_gso_segment(struct sk_buff *skb,
         if (!xo)
                 goto out;
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_ESP))
+                goto out;
+
         seq = xo->seq.low;
 
         x = skb->sp->xvec[skb->sp->len - 1];
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index d883c9204c01..278e49cd67d4 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -46,6 +46,9 @@ static struct sk_buff *tcp6_gso_segment(struct sk_buff *skb,
 {
         struct tcphdr *th;
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6))
+                return ERR_PTR(-EINVAL);
+
         if (!pskb_may_pull(skb, sizeof(*th)))
                 return ERR_PTR(-EINVAL);
 
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index a0f89ad76f9d..2a04dc9c781b 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -42,6 +42,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                 const struct ipv6hdr *ipv6h;
                 struct udphdr *uh;
 
+                if (!(skb_shinfo(skb)->gso_type & SKB_GSO_UDP))
+                        goto out;
+
                 if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                         goto out;
 
diff --git a/net/rds/tcp.c b/net/rds/tcp.c
index 6b7ee71f40c6..ab7356e0ba83 100644
--- a/net/rds/tcp.c
+++ b/net/rds/tcp.c
@@ -90,9 +90,10 @@ void rds_tcp_nonagle(struct socket *sock)
                               sizeof(val));
 }
 
-u32 rds_tcp_snd_nxt(struct rds_tcp_connection *tc)
+u32 rds_tcp_write_seq(struct rds_tcp_connection *tc)
 {
-        return tcp_sk(tc->t_sock->sk)->snd_nxt;
+        /* seq# of the last byte of data in tcp send buffer */
+        return tcp_sk(tc->t_sock->sk)->write_seq;
 }
 
 u32 rds_tcp_snd_una(struct rds_tcp_connection *tc)
diff --git a/net/rds/tcp.h b/net/rds/tcp.h
index 1aafbf7c3011..864ca7d8f019 100644
--- a/net/rds/tcp.h
+++ b/net/rds/tcp.h
@@ -54,7 +54,7 @@ void rds_tcp_set_callbacks(struct socket *sock, struct rds_conn_path *cp);
 void rds_tcp_reset_callbacks(struct socket *sock, struct rds_conn_path *cp);
 void rds_tcp_restore_callbacks(struct socket *sock,
                                struct rds_tcp_connection *tc);
-u32 rds_tcp_snd_nxt(struct rds_tcp_connection *tc);
+u32 rds_tcp_write_seq(struct rds_tcp_connection *tc);
 u32 rds_tcp_snd_una(struct rds_tcp_connection *tc);
 u64 rds_tcp_map_seq(struct rds_tcp_connection *tc, u32 seq);
 extern struct rds_transport rds_tcp_transport;
diff --git a/net/rds/tcp_send.c b/net/rds/tcp_send.c
index dc860d1bb608..9b76e0fa1722 100644
--- a/net/rds/tcp_send.c
+++ b/net/rds/tcp_send.c
@@ -86,7 +86,7 @@ int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
                  * m_ack_seq is set to the sequence number of the last byte of
                  * header and data.  see rds_tcp_is_acked().
                  */
-                tc->t_last_sent_nxt = rds_tcp_snd_nxt(tc);
+                tc->t_last_sent_nxt = rds_tcp_write_seq(tc);
                 rm->m_ack_seq = tc->t_last_sent_nxt +
                                 sizeof(struct rds_header) +
                                 be32_to_cpu(rm->m_inc.i_hdr.h_len) - 1;
@@ -98,7 +98,7 @@ int rds_tcp_xmit(struct rds_connection *conn, struct rds_message *rm,
                         rm->m_inc.i_hdr.h_flags |= RDS_FLAG_RETRANSMITTED;
 
                 rdsdebug("rm %p tcp nxt %u ack_seq %llu\n",
-                         rm, rds_tcp_snd_nxt(tc),
+                         rm, rds_tcp_write_seq(tc),
                          (unsigned long long)rm->m_ack_seq);
         }
 
diff --git a/net/sctp/offload.c b/net/sctp/offload.c
index 275925b93b29..35bc7106d182 100644
--- a/net/sctp/offload.c
+++ b/net/sctp/offload.c
@@ -45,6 +45,9 @@ static struct sk_buff *sctp_gso_segment(struct sk_buff *skb,
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct sctphdr *sh;
 
+        if (!(skb_shinfo(skb)->gso_type & SKB_GSO_SCTP))
+                goto out;
+
         sh = sctp_hdr(skb);
         if (!pskb_may_pull(skb, sizeof(*sh)))
                 goto out;
diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
index 61f394d369bf..0a9b72fbd761 100644
--- a/net/tls/tls_sw.c
+++ b/net/tls/tls_sw.c
@@ -577,6 +577,8 @@ alloc_payload:
                 get_page(page);
                 sg = ctx->sg_plaintext_data + ctx->sg_plaintext_num_elem;
                 sg_set_page(sg, page, copy, offset);
+                sg_unmark_end(sg);
+
                 ctx->sg_plaintext_num_elem++;
 
                 sk_mem_charge(sk, copy);