7 files changed, 50 insertions, 37 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 82f20022259d..5d03889502eb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -8152,7 +8152,7 @@ static netdev_features_t netdev_sync_upper_features(struct net_device *lower,
         netdev_features_t feature;
         int feature_bit;
 
-        for_each_netdev_feature(&upper_disables, feature_bit) {
+        for_each_netdev_feature(upper_disables, feature_bit) {
                 feature = __NETIF_F_BIT(feature_bit);
                 if (!(upper->wanted_features & feature)
                     && (features & feature)) {
@@ -8172,7 +8172,7 @@ static void netdev_sync_lower_features(struct net_device *upper,
         netdev_features_t feature;
         int feature_bit;
 
-        for_each_netdev_feature(&upper_disables, feature_bit) {
+        for_each_netdev_feature(upper_disables, feature_bit) {
                 feature = __NETIF_F_BIT(feature_bit);
                 if (!(features & feature) && (lower->features & feature)) {
                         netdev_dbg(upper, "Disabling feature %pNF on lower dev %s.\n",
@@ -8712,6 +8712,9 @@ int init_dummy_netdev(struct net_device *dev)
         set_bit(__LINK_STATE_PRESENT, &dev->state);
         set_bit(__LINK_STATE_START, &dev->state);
 
+        /* napi_busy_loop stats accounting wants this */
+        dev_net_set(dev, &init_net);
+
         /* Note : We dont allocate pcpu_refcnt for dummy devices,
          * because users of this 'device' dont need to change
          * its refcount.
diff --git a/net/core/filter.c b/net/core/filter.c
index 447dd1bad31f..f7d0004fc160 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -2020,18 +2020,19 @@ static inline int __bpf_tx_skb(struct net_device *dev, struct sk_buff *skb)
 static int __bpf_redirect_no_mac(struct sk_buff *skb, struct net_device *dev,
                                  u32 flags)
 {
-        /* skb->mac_len is not set on normal egress */
-        unsigned int mlen = skb->network_header - skb->mac_header;
+        unsigned int mlen = skb_network_offset(skb);
 
-        __skb_pull(skb, mlen);
+        if (mlen) {
+                __skb_pull(skb, mlen);
 
-        /* At ingress, the mac header has already been pulled once.
-         * At egress, skb_pospull_rcsum has to be done in case that
-         * the skb is originated from ingress (i.e. a forwarded skb)
-         * to ensure that rcsum starts at net header.
-         */
-        if (!skb_at_tc_ingress(skb))
-                skb_postpull_rcsum(skb, skb_mac_header(skb), mlen);
+                /* At ingress, the mac header has already been pulled once.
+                 * At egress, skb_pospull_rcsum has to be done in case that
+                 * the skb is originated from ingress (i.e. a forwarded skb)
+                 * to ensure that rcsum starts at net header.
+                 */
+                if (!skb_at_tc_ingress(skb))
+                        skb_postpull_rcsum(skb, skb_mac_header(skb), mlen);
+        }
         skb_pop_mac_header(skb);
         skb_reset_mac_len(skb);
         return flags & BPF_F_INGRESS ?
@@ -2788,8 +2789,7 @@ static int bpf_skb_proto_4_to_6(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_cow(skb, len_diff);
@@ -2830,8 +2830,7 @@ static int bpf_skb_proto_6_to_4(struct sk_buff *skb)
         u32 off = skb_mac_header_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_unclone(skb, GFP_ATOMIC);
@@ -2956,8 +2955,7 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_cow(skb, len_diff);
@@ -2986,8 +2984,7 @@ static int bpf_skb_net_shrink(struct sk_buff *skb, u32 len_diff)
         u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
         int ret;
 
-        /* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
-        if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+        if (!skb_is_gso_tcp(skb))
                 return -ENOTSUPP;
 
         ret = skb_unclone(skb, GFP_ATOMIC);
@@ -4111,14 +4108,20 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                 /* Only some socketops are supported */
                 switch (optname) {
                 case SO_RCVBUF:
+                        val = min_t(u32, val, sysctl_rmem_max);
                         sk->sk_userlocks |= SOCK_RCVBUF_LOCK;
                         sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF);
                         break;
                 case SO_SNDBUF:
+                        val = min_t(u32, val, sysctl_wmem_max);
                         sk->sk_userlocks |= SOCK_SNDBUF_LOCK;
                         sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF);
                         break;
                 case SO_MAX_PACING_RATE: /* 32bit version */
+                        if (val != ~0U)
+                                cmpxchg(&sk->sk_pacing_status,
+                                        SK_PACING_NONE,
+                                        SK_PACING_NEEDED);
                         sk->sk_max_pacing_rate = (val == ~0U) ? ~0UL : val;
                         sk->sk_pacing_rate = min(sk->sk_pacing_rate,
                                                  sk->sk_max_pacing_rate);
@@ -4132,7 +4135,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                         sk->sk_rcvlowat = val ? : 1;
                         break;
                 case SO_MARK:
-                        sk->sk_mark = val;
+                        if (sk->sk_mark != val) {
+                                sk->sk_mark = val;
+                                sk_dst_reset(sk);
+                        }
                         break;
                 default:
                         ret = -EINVAL;
@@ -4203,7 +4209,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
                         /* Only some options are supported */
                         switch (optname) {
                         case TCP_BPF_IW:
-                                if (val <= 0 || tp->data_segs_out > 0)
+                                if (val <= 0 || tp->data_segs_out > tp->syn_data)
                                         ret = -EINVAL;
                                 else
                                         tp->snd_cwnd = val;
@@ -5309,7 +5315,7 @@ bpf_base_func_proto(enum bpf_func_id func_id)
         case BPF_FUNC_trace_printk:
                 if (capable(CAP_SYS_ADMIN))
                         return bpf_get_trace_printk_proto();
-                /* else: fall through */
+                /* else, fall through */
         default:
                 return NULL;
         }
diff --git a/net/core/lwt_bpf.c b/net/core/lwt_bpf.c
index 3e85437f7106..a648568c5e8f 100644
--- a/net/core/lwt_bpf.c
+++ b/net/core/lwt_bpf.c
@@ -63,6 +63,7 @@ static int run_lwt_bpf(struct sk_buff *skb, struct bpf_lwt_prog *lwt,
                                      lwt->name ? : "<unknown>");
                         ret = BPF_OK;
                 } else {
+                        skb_reset_mac_header(skb);
                         ret = skb_do_redirect(skb);
                         if (ret == 0)
                                 ret = BPF_REDIRECT;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 763a7b08df67..4230400b9a30 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -18,6 +18,7 @@
 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
 
 #include <linux/slab.h>
+#include <linux/kmemleak.h>
 #include <linux/types.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
@@ -443,12 +444,14 @@ static struct neigh_hash_table *neigh_hash_alloc(unsigned int shift)
         ret = kmalloc(sizeof(*ret), GFP_ATOMIC);
         if (!ret)
                 return NULL;
-        if (size <= PAGE_SIZE)
+        if (size <= PAGE_SIZE) {
                 buckets = kzalloc(size, GFP_ATOMIC);
-        else
+        } else {
                 buckets = (struct neighbour __rcu **)
                           __get_free_pages(GFP_ATOMIC | __GFP_ZERO,
                                            get_order(size));
+                kmemleak_alloc(buckets, size, 1, GFP_ATOMIC);
+        }
         if (!buckets) {
                 kfree(ret);
                 return NULL;
@@ -468,10 +471,12 @@ static void neigh_hash_free_rcu(struct rcu_head *head)
         size_t size = (1 << nht->hash_shift) * sizeof(struct neighbour *);
         struct neighbour __rcu **buckets = nht->hash_buckets;
 
-        if (size <= PAGE_SIZE)
+        if (size <= PAGE_SIZE) {
                 kfree(buckets);
-        else
+        } else {
+                kmemleak_free(buckets);
                 free_pages((unsigned long)buckets, get_order(size));
+        }
         kfree(nht);
 }
 
@@ -1002,7 +1007,7 @@ static void neigh_probe(struct neighbour *neigh)
         if (neigh->ops->solicit)
                 neigh->ops->solicit(neigh, skb);
         atomic_inc(&neigh->probes);
-        kfree_skb(skb);
+        consume_skb(skb);
 }
 
 /* Called when a timer expires for a neighbour entry. */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 37317ffec146..2415d9cb9b89 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -356,6 +356,8 @@ static void *__netdev_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
  */
 void *netdev_alloc_frag(unsigned int fragsz)
 {
+        fragsz = SKB_DATA_ALIGN(fragsz);
+
         return __netdev_alloc_frag(fragsz, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(netdev_alloc_frag);
@@ -369,6 +371,8 @@ static void *__napi_alloc_frag(unsigned int fragsz, gfp_t gfp_mask)
 
 void *napi_alloc_frag(unsigned int fragsz)
 {
+        fragsz = SKB_DATA_ALIGN(fragsz);
+
         return __napi_alloc_frag(fragsz, GFP_ATOMIC);
 }
 EXPORT_SYMBOL(napi_alloc_frag);
@@ -5270,7 +5274,6 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
         unsigned long chunk;
         struct sk_buff *skb;
         struct page *page;
-        gfp_t gfp_head;
         int i;
 
         *errcode = -EMSGSIZE;
@@ -5280,12 +5283,8 @@ struct sk_buff *alloc_skb_with_frags(unsigned long header_len,
         if (npages > MAX_SKB_FRAGS)
                 return NULL;
 
-        gfp_head = gfp_mask;
-        if (gfp_head & __GFP_DIRECT_RECLAIM)
-                gfp_head |= __GFP_RETRY_MAYFAIL;
-
         *errcode = -ENOBUFS;
-        skb = alloc_skb(header_len, gfp_head);
+        skb = alloc_skb(header_len, gfp_mask);
         if (!skb)
                 return NULL;
 
diff --git a/net/core/skmsg.c b/net/core/skmsg.c
index d6d5c20d7044..8c826603bf36 100644
--- a/net/core/skmsg.c
+++ b/net/core/skmsg.c
@@ -545,8 +545,7 @@ static void sk_psock_destroy_deferred(struct work_struct *gc)
         struct sk_psock *psock = container_of(gc, struct sk_psock, gc);
 
         /* No sk_callback_lock since already detached. */
-        if (psock->parser.enabled)
-                strp_done(&psock->parser.strp);
+        strp_done(&psock->parser.strp);
 
         cancel_work_sync(&psock->work);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 6aa2e7e0b4fb..bc3512f230a3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2380,7 +2380,7 @@ int __sk_mem_raise_allocated(struct sock *sk, int size, int amt, int kind)
         }
 
         if (sk_has_memory_pressure(sk)) {
-                int alloc;
+                u64 alloc;
 
                 if (!sk_under_memory_pressure(sk))
                         return 1;