Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 1) Name string overrun fix in gianfar driver from Joe Perches.

 2) VHOST bug fixes from Michael S. Tsirkin and Nadav Har'El

 3) Fix dependencies on xt_LOG netfilter module, from Pablo Neira Ayuso.

 4) Fix RCU locking in xt_CT, also from Pablo Neira Ayuso.

 5) Add a parameter to skb_add_rx_frag() so we can fix the truesize
    adjustments in the drivers that use it.  The individual drivers
    aren't fixed by this commit, but will be dealt with using follow-on
    commits.  From Eric Dumazet.

 6) Add some device IDs to qmi_wwan driver, from Andrew Bird.

 7) Fix a potential rcu_read_lock() imbalancein rt6_fill_node().  From
    Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  net: fix a potential rcu_read_lock() imbalance in rt6_fill_node()
  net: add a truesize parameter to skb_add_rx_frag()
  gianfar: Fix possible overrun and simplify interrupt name field creation
  USB: qmi_wwan: Add ZTE (Vodafone) K3570-Z and K3571-Z net interfaces
  USB: option: Ignore ZTE (Vodafone) K3570/71 net interfaces
  USB: qmi_wwan: Add ZTE (Vodafone) K3565-Z and K4505-Z net interfaces
  qlcnic: Bug fix for LRO
  netfilter: nf_conntrack: permanently attach timeout policy to conntrack
  netfilter: xt_CT: fix assignation of the generic protocol tracker
  netfilter: xt_CT: missing rcu_read_lock section in timeout assignment
  netfilter: cttimeout: fix dependency with l4protocol conntrack module
  netfilter: xt_LOG: use CONFIG_IP6_NF_IPTABLES instead of CONFIG_IPV6
  vhost: fix release path lockdep checks
  vhost: don't forget to schedule()
  tools/virtio: stub out strong barriers
  tools/virtio: add linux/hrtimer.h stub
  tools/virtio: add linux/module.h stub

14 files changed, 72 insertions, 50 deletions

diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index d9428f0e738a..e7bed5303997 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -968,7 +968,6 @@ static int gfar_probe(struct platform_device *ofdev)
         struct gfar_private *priv = NULL;
         struct gfar __iomem *regs = NULL;
         int err = 0, i, grp_idx = 0;
-        int len_devname;
         u32 rstat = 0, tstat = 0, rqueue = 0, tqueue = 0;
         u32 isrg = 0;
         u32 __iomem *baddr;
@@ -1169,40 +1168,16 @@ static int gfar_probe(struct platform_device *ofdev)
                 priv->device_flags & FSL_GIANFAR_DEV_HAS_MAGIC_PACKET);
 
         /* fill out IRQ number and name fields */
-        len_devname = strlen(dev->name);
         for (i = 0; i < priv->num_grps; i++) {
-                strncpy(&priv->gfargrp[i].int_name_tx[0], dev->name,
-                                len_devname);
                 if (priv->device_flags & FSL_GIANFAR_DEV_HAS_MULTI_INTR) {
-                        strncpy(&priv->gfargrp[i].int_name_tx[len_devname],
-                                "_g", sizeof("_g"));
-                        priv->gfargrp[i].int_name_tx[
-                                strlen(priv->gfargrp[i].int_name_tx)] = i+48;
-                        strncpy(&priv->gfargrp[i].int_name_tx[strlen(
-                                priv->gfargrp[i].int_name_tx)],
-                                "_tx", sizeof("_tx") + 1);
-
-                        strncpy(&priv->gfargrp[i].int_name_rx[0], dev->name,
-                                        len_devname);
-                        strncpy(&priv->gfargrp[i].int_name_rx[len_devname],
-                                        "_g", sizeof("_g"));
-                        priv->gfargrp[i].int_name_rx[
-                                strlen(priv->gfargrp[i].int_name_rx)] = i+48;
-                        strncpy(&priv->gfargrp[i].int_name_rx[strlen(
-                                priv->gfargrp[i].int_name_rx)],
-                                "_rx", sizeof("_rx") + 1);
-
-                        strncpy(&priv->gfargrp[i].int_name_er[0], dev->name,
-                                        len_devname);
-                        strncpy(&priv->gfargrp[i].int_name_er[len_devname],
-                                "_g", sizeof("_g"));
-                        priv->gfargrp[i].int_name_er[strlen(
-                                        priv->gfargrp[i].int_name_er)] = i+48;
-                        strncpy(&priv->gfargrp[i].int_name_er[strlen(\
-                                priv->gfargrp[i].int_name_er)],
-                                "_er", sizeof("_er") + 1);
+                        sprintf(priv->gfargrp[i].int_name_tx, "%s%s%c%s",
+                                dev->name, "_g", '0' + i, "_tx");
+                        sprintf(priv->gfargrp[i].int_name_rx, "%s%s%c%s",
+                                dev->name, "_g", '0' + i, "_rx");
+                        sprintf(priv->gfargrp[i].int_name_er, "%s%s%c%s",
+                                dev->name, "_g", '0' + i, "_er");
                 } else
-                        priv->gfargrp[i].int_name_tx[len_devname] = '\0';
+                        strcpy(priv->gfargrp[i].int_name_tx, dev->name);
         }
 
         /* Initialize the filer table */
diff --git a/drivers/net/ethernet/freescale/gianfar.h b/drivers/net/ethernet/freescale/gianfar.h
index fc2488adca36..4c9f8d487dbb 100644
--- a/drivers/net/ethernet/freescale/gianfar.h
+++ b/drivers/net/ethernet/freescale/gianfar.h
@@ -517,7 +517,7 @@ extern const char gfar_driver_version[];
 #define RXFCB_PERR_MASK         0x000c
 #define RXFCB_PERR_BADL3        0x0008
 
-#define GFAR_INT_NAME_MAX       IFNAMSIZ + 4
+#define GFAR_INT_NAME_MAX       (IFNAMSIZ + 6)  /* '_g#_xx' */
 
 struct txbd8
 {
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
index 2b5af22419a5..385a4d5c7c25 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
@@ -36,8 +36,8 @@
 
 #define _QLCNIC_LINUX_MAJOR 5
 #define _QLCNIC_LINUX_MINOR 0
-#define _QLCNIC_LINUX_SUBVERSION 25
-#define QLCNIC_LINUX_VERSIONID  "5.0.26"
+#define _QLCNIC_LINUX_SUBVERSION 27
+#define QLCNIC_LINUX_VERSIONID  "5.0.27"
 #define QLCNIC_DRV_IDC_VER  0x01
 #define QLCNIC_DRIVER_VERSION  ((_QLCNIC_LINUX_MAJOR << 16) |\
                  (_QLCNIC_LINUX_MINOR << 8) | (_QLCNIC_LINUX_SUBVERSION))
diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
index 81bb1a69e69f..75c32e875fef 100644
--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
+++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_main.c
@@ -1458,8 +1458,10 @@ qlcnic_reset_context(struct qlcnic_adapter *adapter)
 
                 if (netif_running(netdev)) {
                         err = qlcnic_attach(adapter);
-                        if (!err)
+                        if (!err) {
                                 __qlcnic_up(adapter, netdev);
+                                qlcnic_restore_indev_addr(netdev, NETDEV_UP);
+                        }
                 }
 
                 netif_device_attach(netdev);
diff --git a/drivers/net/usb/cdc-phonet.c b/drivers/net/usb/cdc-phonet.c
index 790cbdea7392..3886b30ed373 100644
--- a/drivers/net/usb/cdc-phonet.c
+++ b/drivers/net/usb/cdc-phonet.c
@@ -164,12 +164,14 @@ static void rx_complete(struct urb *req)
                                 /* Can't use pskb_pull() on page in IRQ */
                                 memcpy(skb_put(skb, 1), page_address(page), 1);
                                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
-                                                page, 1, req->actual_length);
+                                                page, 1, req->actual_length,
+                                                req->actual_length);
                                 page = NULL;
                         }
                 } else {
                         skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
-                                        page, 0, req->actual_length);
+                                        page, 0, req->actual_length,
+                                        req->actual_length);
                         page = NULL;
                 }
                 if (req->actual_length < PAGE_SIZE)
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index aac68f5195c0..552d24bf862e 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -409,6 +409,42 @@ static const struct usb_device_id products[] = {
                 .bInterfaceProtocol = 0xff,
                 .driver_info        = (unsigned long)&qmi_wwan_force_int4,
         },
+        {       /* ZTE (Vodafone) K3565-Z */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x19d2,
+                .idProduct          = 0x0063,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
+        },
+        {       /* ZTE (Vodafone) K3570-Z */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x19d2,
+                .idProduct          = 0x1008,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
+        },
+        {       /* ZTE (Vodafone) K3571-Z */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x19d2,
+                .idProduct          = 0x1010,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
+        },
+        {       /* ZTE (Vodafone) K4505-Z */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x19d2,
+                .idProduct          = 0x0104,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
+        },
         {QMI_GOBI_DEVICE(0x05c6, 0x9212)},      /* Acer Gobi Modem Device */
         {QMI_GOBI_DEVICE(0x03f0, 0x1f1d)},      /* HP un2400 Gobi Modem Device */
         {QMI_GOBI_DEVICE(0x03f0, 0x371d)},      /* HP un2430 Mobile Broadband Module */
diff --git a/drivers/net/wireless/iwlegacy/3945.c b/drivers/net/wireless/iwlegacy/3945.c
index c5b1d199e0bc..b25c01be0d90 100644
--- a/drivers/net/wireless/iwlegacy/3945.c
+++ b/drivers/net/wireless/iwlegacy/3945.c
@@ -499,7 +499,8 @@ il3945_pass_packet_to_mac80211(struct il_priv *il, struct il_rx_buf *rxb,
                                       le32_to_cpu(rx_end->status), stats);
 
         skb_add_rx_frag(skb, 0, rxb->page,
-                        (void *)rx_hdr->payload - (void *)pkt, len);
+                        (void *)rx_hdr->payload - (void *)pkt, len,
+                        len);
 
         il_update_stats(il, false, fc, len);
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 7b54dbb338be..17f1c6853182 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -596,7 +596,8 @@ il4965_pass_packet_to_mac80211(struct il_priv *il, struct ieee80211_hdr *hdr,
                 return;
         }
 
-        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len);
+        skb_add_rx_frag(skb, 0, rxb->page, (void *)hdr - rxb_addr(rxb), len,
+                        len);
 
         il_update_stats(il, false, fc, len);
         memcpy(IEEE80211_SKB_RXCB(skb), stats, sizeof(*stats));
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
index 44c6f712b77d..f4b84d1596e3 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn-rx.c
@@ -796,7 +796,7 @@ static void iwlagn_pass_packet_to_mac80211(struct iwl_priv *priv,
 
         offset = (void *)hdr - rxb_addr(rxb);
         p = rxb_steal_page(rxb);
-        skb_add_rx_frag(skb, 0, p, offset, len);
+        skb_add_rx_frag(skb, 0, p, offset, len, len);
 
         iwl_update_stats(priv, false, fc, len);
 
diff --git a/drivers/usb/gadget/f_phonet.c b/drivers/usb/gadget/f_phonet.c
index 7cdcb63b21ff..85a5cebe96b3 100644
--- a/drivers/usb/gadget/f_phonet.c
+++ b/drivers/usb/gadget/f_phonet.c
@@ -345,7 +345,7 @@ static void pn_rx_complete(struct usb_ep *ep, struct usb_request *req)
                 }
 
                 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, page,
-                                skb->len <= 1, req->actual);
+                                skb->len <= 1, req->actual, req->actual);
                 page = NULL;
 
                 if (req->actual < req->length) { /* Last fragment */
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 6815701cf656..836cfa9a515f 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -903,8 +903,10 @@ static const struct usb_device_id option_ids[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff),
           .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff) },
-        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff) },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
+        { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff),
+          .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) },
         { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) },
diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 9dab1f51dd43..f0da2c32fbde 100644
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -588,7 +588,7 @@ static int vhost_net_release(struct inode *inode, struct file *f)
 
         vhost_net_stop(n, &tx_sock, &rx_sock);
         vhost_net_flush(n);
-        vhost_dev_cleanup(&n->dev);
+        vhost_dev_cleanup(&n->dev, false);
         if (tx_sock)
                 fput(tx_sock->file);
         if (rx_sock)
diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index bdb2d6436b2b..947f00d8e091 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c
@@ -222,6 +222,8 @@ static int vhost_worker(void *data)
                 if (work) {
                         __set_current_state(TASK_RUNNING);
                         work->fn(work);
+                        if (need_resched())
+                                schedule();
                 } else
                         schedule();
 
@@ -403,7 +405,7 @@ long vhost_dev_reset_owner(struct vhost_dev *dev)
         if (!memory)
                 return -ENOMEM;
 
-        vhost_dev_cleanup(dev);
+        vhost_dev_cleanup(dev, true);
 
         memory->nregions = 0;
         RCU_INIT_POINTER(dev->memory, memory);
@@ -434,8 +436,8 @@ int vhost_zerocopy_signal_used(struct vhost_virtqueue *vq)
         return j;
 }
 
-/* Caller should have device mutex */
-void vhost_dev_cleanup(struct vhost_dev *dev)
+/* Caller should have device mutex if and only if locked is set */
+void vhost_dev_cleanup(struct vhost_dev *dev, bool locked)
 {
         int i;
 
@@ -472,7 +474,8 @@ void vhost_dev_cleanup(struct vhost_dev *dev)
         dev->log_file = NULL;
         /* No one will access memory at this point */
         kfree(rcu_dereference_protected(dev->memory,
-                                        lockdep_is_held(&dev->mutex)));
+                                        locked ==
+                                                lockdep_is_held(&dev->mutex)));
         RCU_INIT_POINTER(dev->memory, NULL);
         WARN_ON(!list_empty(&dev->work_list));
         if (dev->worker) {
diff --git a/drivers/vhost/vhost.h b/drivers/vhost/vhost.h
index a801e2821d03..8dcf4cca6bf2 100644
--- a/drivers/vhost/vhost.h
+++ b/drivers/vhost/vhost.h
@@ -163,7 +163,7 @@ struct vhost_dev {
 long vhost_dev_init(struct vhost_dev *, struct vhost_virtqueue *vqs, int nvqs);
 long vhost_dev_check_owner(struct vhost_dev *);
 long vhost_dev_reset_owner(struct vhost_dev *);
-void vhost_dev_cleanup(struct vhost_dev *);
+void vhost_dev_cleanup(struct vhost_dev *, bool locked);
 long vhost_dev_ioctl(struct vhost_dev *, unsigned int ioctl, unsigned long arg);
 int vhost_vq_access_ok(struct vhost_virtqueue *vq);
 int vhost_log_access_ok(struct vhost_dev *);