Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking updates from David Miller:
 "Here is a pile of bug fixes that accumulated while I was in Europe"

 1) In fixing kernel leaks to userspace during copying of socket
    addresses, we broke a case that used to work, namely the user
    providing a buffer larger than the in-kernel generic socket address
    structure.  This broke Ruby amongst other things.  Fix from Dan
    Carpenter.

 2) Fix regression added by byte queue limit support in 8139cp driver,
    from Yang Yingliang.

 3) The addition of MSG_SENDPAGE_NOTLAST buggered up a few sendpage
    implementations, they should just treat it the same as MSG_MORE.
    Fix from Richard Weinberger and Shawn Landden.

 4) Handle icmpv4 errors received on ipv6 SIT tunnels correctly, from
    Oussama Ghorbel.  In particular we should send an ICMPv6 unreachable
    in such situations.

 5) Fix some regressions in the recent genetlink fixes, in particular
    get the pmcraid driver to use the new safer interfaces correctly.
    From Johannes Berg.

 6) macvtap was converted to use a per-cpu set of statistics, but some
    code was still bumping tx_dropped elsewhere.  From Jason Wang.

 7) Fix build failure of xen-netback due to missing include on some
    architectures, from Andy Whitecroft.

 8) macvtap double counts received packets in statistics, fix from Vlad
    Yasevich.

 9) Fix various cases of using *_STATS_BH() when *_STATS() is more
    appropriate.  From Eric Dumazet and Hannes Frederic Sowa.

10) Pktgen ipsec mode doesn't update the ipv4 header length and checksum
    properly after encapsulation.  Fix from Fan Du.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (61 commits)
  net/mlx4_en: Remove selftest TX queues empty condition
  {pktgen, xfrm} Update IPv4 header total len and checksum after tranformation
  virtio_net: make all RX paths handle erors consistently
  virtio_net: fix error handling for mergeable buffers
  virtio_net: Fixed a trivial typo (fitler --> filter)
  netem: fix gemodel loss generator
  netem: fix loss 4 state model
  netem: missing break in ge loss generator
  net/hsr: Support iproute print_opt ('ip -details ...')
  net/hsr: Very small fix of comment style.
  MAINTAINERS: Added net/hsr/ maintainer
  ipv6: fix possible seqlock deadlock in ip6_finish_output2
  ixgbe: Make ixgbe_identify_qsfp_module_generic static
  ixgbe: turn NETIF_F_HW_L2FW_DOFFLOAD off by default
  ixgbe: ixgbe_fwd_ring_down needs to be static
  e1000: fix possible reset_task running after adapter down
  e1000: fix lockdep warning in e1000_reset_task
  e1000: prevent oops when adapter is being closed and reset simultaneously
  igb: Fixed Wake On LAN support
  inet: fix possible seqlock deadlocks
  ...

1 files changed, 88 insertions, 48 deletions

diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 7bab4de658a9..916241d16c67 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -299,35 +299,76 @@ static struct sk_buff *page_to_skb(struct receive_queue *rq,
         return skb;
 }
 
-static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
+static struct sk_buff *receive_small(void *buf, unsigned int len)
 {
-        struct skb_vnet_hdr *hdr = skb_vnet_hdr(head_skb);
+        struct sk_buff * skb = buf;
+
+        len -= sizeof(struct virtio_net_hdr);
+        skb_trim(skb, len);
+
+        return skb;
+}
+
+static struct sk_buff *receive_big(struct net_device *dev,
+                                   struct receive_queue *rq,
+                                   void *buf,
+                                   unsigned int len)
+{
+        struct page *page = buf;
+        struct sk_buff *skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
+
+        if (unlikely(!skb))
+                goto err;
+
+        return skb;
+
+err:
+        dev->stats.rx_dropped++;
+        give_pages(rq, page);
+        return NULL;
+}
+
+static struct sk_buff *receive_mergeable(struct net_device *dev,
+                                         struct receive_queue *rq,
+                                         void *buf,
+                                         unsigned int len)
+{
+        struct skb_vnet_hdr *hdr = buf;
+        int num_buf = hdr->mhdr.num_buffers;
+        struct page *page = virt_to_head_page(buf);
+        int offset = buf - page_address(page);
+        struct sk_buff *head_skb = page_to_skb(rq, page, offset, len,
+                                               MERGE_BUFFER_LEN);
         struct sk_buff *curr_skb = head_skb;
-        char *buf;
-        struct page *page;
-        int num_buf, len, offset;
 
-        num_buf = hdr->mhdr.num_buffers;
+        if (unlikely(!curr_skb))
+                goto err_skb;
+
         while (--num_buf) {
-                int num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
+                int num_skb_frags;
+
                 buf = virtqueue_get_buf(rq->vq, &len);
                 if (unlikely(!buf)) {
-                        pr_debug("%s: rx error: %d buffers missing\n",
-                                 head_skb->dev->name, hdr->mhdr.num_buffers);
-                        head_skb->dev->stats.rx_length_errors++;
-                        return -EINVAL;
+                        pr_debug("%s: rx error: %d buffers out of %d missing\n",
+                                 dev->name, num_buf, hdr->mhdr.num_buffers);
+                        dev->stats.rx_length_errors++;
+                        goto err_buf;
                 }
                 if (unlikely(len > MERGE_BUFFER_LEN)) {
                         pr_debug("%s: rx error: merge buffer too long\n",
-                                 head_skb->dev->name);
+                                 dev->name);
                         len = MERGE_BUFFER_LEN;
                 }
+
+                page = virt_to_head_page(buf);
+                --rq->num;
+
+                num_skb_frags = skb_shinfo(curr_skb)->nr_frags;
                 if (unlikely(num_skb_frags == MAX_SKB_FRAGS)) {
                         struct sk_buff *nskb = alloc_skb(0, GFP_ATOMIC);
-                        if (unlikely(!nskb)) {
-                                head_skb->dev->stats.rx_dropped++;
-                                return -ENOMEM;
-                        }
+
+                        if (unlikely(!nskb))
+                                goto err_skb;
                         if (curr_skb == head_skb)
                                 skb_shinfo(curr_skb)->frag_list = nskb;
                         else
@@ -341,8 +382,7 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                         head_skb->len += len;
                         head_skb->truesize += MERGE_BUFFER_LEN;
                 }
-                page = virt_to_head_page(buf);
-                offset = buf - (char *)page_address(page);
+                offset = buf - page_address(page);
                 if (skb_can_coalesce(curr_skb, num_skb_frags, page, offset)) {
                         put_page(page);
                         skb_coalesce_rx_frag(curr_skb, num_skb_frags - 1,
@@ -351,9 +391,28 @@ static int receive_mergeable(struct receive_queue *rq, struct sk_buff *head_skb)
                         skb_add_rx_frag(curr_skb, num_skb_frags, page,
                                         offset, len, MERGE_BUFFER_LEN);
                 }
+        }
+
+        return head_skb;
+
+err_skb:
+        put_page(page);
+        while (--num_buf) {
+                buf = virtqueue_get_buf(rq->vq, &len);
+                if (unlikely(!buf)) {
+                        pr_debug("%s: rx error: %d buffers missing\n",
+                                 dev->name, num_buf);
+                        dev->stats.rx_length_errors++;
+                        break;
+                }
+                page = virt_to_head_page(buf);
+                put_page(page);
                 --rq->num;
         }
-        return 0;
+err_buf:
+        dev->stats.rx_dropped++;
+        dev_kfree_skb(head_skb);
+        return NULL;
 }
 
 static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
@@ -362,7 +421,6 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
         struct net_device *dev = vi->dev;
         struct virtnet_stats *stats = this_cpu_ptr(vi->stats);
         struct sk_buff *skb;
-        struct page *page;
         struct skb_vnet_hdr *hdr;
 
         if (unlikely(len < sizeof(struct virtio_net_hdr) + ETH_HLEN)) {
@@ -377,33 +435,15 @@ static void receive_buf(struct receive_queue *rq, void *buf, unsigned int len)
                 return;
         }
 
-        if (!vi->mergeable_rx_bufs && !vi->big_packets) {
-                skb = buf;
-                len -= sizeof(struct virtio_net_hdr);
-                skb_trim(skb, len);
-        } else if (vi->mergeable_rx_bufs) {
-                struct page *page = virt_to_head_page(buf);
-                skb = page_to_skb(rq, page,
-                                  (char *)buf - (char *)page_address(page),
-                                  len, MERGE_BUFFER_LEN);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        put_page(page);
-                        return;
-                }
-                if (receive_mergeable(rq, skb)) {
-                        dev_kfree_skb(skb);
-                        return;
-                }
-        } else {
-                page = buf;
-                skb = page_to_skb(rq, page, 0, len, PAGE_SIZE);
-                if (unlikely(!skb)) {
-                        dev->stats.rx_dropped++;
-                        give_pages(rq, page);
-                        return;
-                }
-        }
+        if (vi->mergeable_rx_bufs)
+                skb = receive_mergeable(dev, rq, buf, len);
+        else if (vi->big_packets)
+                skb = receive_big(dev, rq, buf, len);
+        else
+                skb = receive_small(buf, len);
+
+        if (unlikely(!skb))
+                return;
 
         hdr = skb_vnet_hdr(skb);
 
@@ -1084,7 +1124,7 @@ static void virtnet_set_rx_mode(struct net_device *dev)
         if (!virtnet_send_command(vi, VIRTIO_NET_CTRL_MAC,
                                   VIRTIO_NET_CTRL_MAC_TABLE_SET,
                                   sg, NULL))
-                dev_warn(&dev->dev, "Failed to set MAC fitler table.\n");
+                dev_warn(&dev->dev, "Failed to set MAC filter table.\n");
 
         kfree(buf);
 }