3 files changed, 39 insertions, 33 deletions

diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 234a0ec2e932..0762aaf8e964 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1483,6 +1483,7 @@ static int ethtool_get_wol(struct net_device *dev, char __user *useraddr)
 static int ethtool_set_wol(struct net_device *dev, char __user *useraddr)
 {
         struct ethtool_wolinfo wol;
+        int ret;
 
         if (!dev->ethtool_ops->set_wol)
                 return -EOPNOTSUPP;
@@ -1490,7 +1491,13 @@ static int ethtool_set_wol(struct net_device *dev, char __user *useraddr)
         if (copy_from_user(&wol, useraddr, sizeof(wol)))
                 return -EFAULT;
 
-        return dev->ethtool_ops->set_wol(dev, &wol);
+        ret = dev->ethtool_ops->set_wol(dev, &wol);
+        if (ret)
+                return ret;
+
+        dev->wol_enabled = !!wol.wolopts;
+
+        return 0;
 }
 
 static int ethtool_get_eee(struct net_device *dev, char __user *useraddr)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 3219a2932463..de1d1ba92f2d 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -135,27 +135,9 @@ static void queue_process(struct work_struct *work)
         }
 }
 
-/*
- * Check whether delayed processing was scheduled for our NIC. If so,
- * we attempt to grab the poll lock and use ->poll() to pump the card.
- * If this fails, either we've recursed in ->poll() or it's already
- * running on another CPU.
- *
- * Note: we don't mask interrupts with this lock because we're using
- * trylock here and interrupts are already disabled in the softirq
- * case. Further, we test the poll_owner to avoid recursion on UP
- * systems where the lock doesn't exist.
- */
 static void poll_one_napi(struct napi_struct *napi)
 {
-        int work = 0;
-
-        /* net_rx_action's ->poll() invocations and our's are
-         * synchronized by this test which is only made while
-         * holding the napi->poll_lock.
-         */
-        if (!test_bit(NAPI_STATE_SCHED, &napi->state))
-                return;
+        int work;
 
         /* If we set this bit but see that it has already been set,
          * that indicates that napi has been disabled and we need
@@ -330,6 +312,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
         /* It is up to the caller to keep npinfo alive. */
         struct netpoll_info *npinfo;
 
+        rcu_read_lock_bh();
         lockdep_assert_irqs_disabled();
 
         npinfo = rcu_dereference_bh(np->dev->npinfo);
@@ -374,6 +357,7 @@ void netpoll_send_skb_on_dev(struct netpoll *np, struct sk_buff *skb,
                 skb_queue_tail(&npinfo->txq, skb);
                 schedule_delayed_work(&npinfo->tx_work,0);
         }
+        rcu_read_unlock_bh();
 }
 EXPORT_SYMBOL(netpoll_send_skb_on_dev);
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 63ce2283a456..37c7936124e6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1898,10 +1898,8 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
                 if (tb[IFLA_IF_NETNSID]) {
                         netnsid = nla_get_s32(tb[IFLA_IF_NETNSID]);
                         tgt_net = get_target_net(skb->sk, netnsid);
-                        if (IS_ERR(tgt_net)) {
-                                tgt_net = net;
-                                netnsid = -1;
-                        }
+                        if (IS_ERR(tgt_net))
+                                return PTR_ERR(tgt_net);
                 }
 
                 if (tb[IFLA_EXT_MASK])
@@ -2837,6 +2835,12 @@ struct net_device *rtnl_create_link(struct net *net,
         else if (ops->get_num_rx_queues)
                 num_rx_queues = ops->get_num_rx_queues();
 
+        if (num_tx_queues < 1 || num_tx_queues > 4096)
+                return ERR_PTR(-EINVAL);
+
+        if (num_rx_queues < 1 || num_rx_queues > 4096)
+                return ERR_PTR(-EINVAL);
+
         dev = alloc_netdev_mqs(ops->priv_size, ifname, name_assign_type,
                                ops->setup, num_tx_queues, num_rx_queues);
         if (!dev)
@@ -3744,16 +3748,27 @@ static int rtnl_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int err = 0;
         int fidx = 0;
 
-        err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
-                          IFLA_MAX, ifla_policy, NULL);
-        if (err < 0) {
-                return -EINVAL;
-        } else if (err == 0) {
-                if (tb[IFLA_MASTER])
-                        br_idx = nla_get_u32(tb[IFLA_MASTER]);
-        }
+        /* A hack to preserve kernel<->userspace interface.
+         * Before Linux v4.12 this code accepted ndmsg since iproute2 v3.3.0.
+         * However, ndmsg is shorter than ifinfomsg thus nlmsg_parse() bails.
+         * So, check for ndmsg with an optional u32 attribute (not used here).
+         * Fortunately these sizes don't conflict with the size of ifinfomsg
+         * with an optional attribute.
+         */
+        if (nlmsg_len(cb->nlh) != sizeof(struct ndmsg) &&
+            (nlmsg_len(cb->nlh) != sizeof(struct ndmsg) +
+             nla_attr_size(sizeof(u32)))) {
+                err = nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb,
+                                  IFLA_MAX, ifla_policy, NULL);
+                if (err < 0) {
+                        return -EINVAL;
+                } else if (err == 0) {
+                        if (tb[IFLA_MASTER])
+                                br_idx = nla_get_u32(tb[IFLA_MASTER]);
+                }
 
-        brport_idx = ifm->ifi_index;
+                brport_idx = ifm->ifi_index;
+        }
 
         if (br_idx) {
                 br_dev = __dev_get_by_index(net, br_idx);