Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Fix NBMA tunnel mac header handling in GRE, from Timo Teräs.

 2) Fix a NAPI race in the fec driver, from Nimrod Andy.

 3) The new IFF_VNET_LE bit is outside the size of the flags member it
    is stored in (which is 16-bits), store the state locally in the
    drivers.  From Michael S Tsirkin.

 4) We are kicking the tires with the new wireless maintainership
    situation.  Bluetooth fixes via Johan Hedberg, and mac80211 fixes
    from Johannes Berg.

 5) Fix locking and leaks in geneve driver, from Jesse Gross.

 6) Make netlink TX mmap code always copy, so we don't have to be
    potentially exposed to the user changing the underlying contents
    from underneath us.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (63 commits)
  be2net: Fix incorrect setting of tunnel offload flag in netdev features
  bnx2x: fix typos in "configure"
  xen-netback: support frontends without feature-rx-notify again
  MAINTAINERS: changes for wireless
  cxgb4: Fix decoding QSA module for ethtool get settings
  geneve: Fix races between socket add and release.
  geneve: Remove socket and offload handlers at destruction.
  netlink: Don't reorder loads/stores before marking mmap netlink frame as available
  netlink: Always copy on mmap TX.
  Bluetooth: Fix bug with filter in service discovery optimization
  mac80211: free management frame keys when removing station
  net: Disallow providing non zero VLAN ID for NIC drivers FDB add flow
  net/mlx4: Cache line CQE/EQE stride fixes
  net: fec: Fix NAPI race
  xen-netfront: use napi_complete() correctly to prevent Rx stalling
  ip_tunnel: Add missing validation of encap type to ip_tunnel_encap_setup()
  ip_tunnel: Add sanity checks to ip_tunnel_encap_add_ops()
  net: Allow FIXED_PHY to be modular.
  if_tun: drop broken IFF_VNET_LE
  macvtap: drop broken IFF_VNET_LE
  ...

6 files changed, 132 insertions, 59 deletions

diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index 79d84b88b8f0..fe18825cc8a4 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -661,7 +661,7 @@ static void hci_req_add_le_create_conn(struct hci_request *req,
         memset(&cp, 0, sizeof(cp));
 
         /* Update random address, but set require_privacy to false so
-         * that we never connect with an unresolvable address.
+         * that we never connect with an non-resolvable address.
          */
         if (hci_update_random_address(req, false, &own_addr_type))
                 return;
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 93f92a085506..5dcacf9607e4 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -1373,8 +1373,6 @@ static void hci_init1_req(struct hci_request *req, unsigned long opt)
 
 static void bredr_setup(struct hci_request *req)
 {
-        struct hci_dev *hdev = req->hdev;
-
         __le16 param;
         __u8 flt_type;
 
@@ -1403,14 +1401,6 @@ static void bredr_setup(struct hci_request *req)
         /* Connection accept timeout ~20 secs */
         param = cpu_to_le16(0x7d00);
         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
-
-        /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
-         * but it does not support page scan related HCI commands.
-         */
-        if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1) {
-                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
-                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
-        }
 }
 
 static void le_setup(struct hci_request *req)
@@ -1718,6 +1708,16 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
         if (hdev->commands[5] & 0x10)
                 hci_setup_link_policy(req);
 
+        if (hdev->commands[8] & 0x01)
+                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
+
+        /* Some older Broadcom based Bluetooth 1.2 controllers do not
+         * support the Read Page Scan Type command. Check support for
+         * this command in the bit mask of supported commands.
+         */
+        if (hdev->commands[13] & 0x01)
+                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
+
         if (lmp_le_capable(hdev)) {
                 u8 events[8];
 
@@ -2634,6 +2634,12 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         drain_workqueue(hdev->workqueue);
 
         hci_dev_lock(hdev);
+
+        if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
+                if (hdev->dev_type == HCI_BREDR)
+                        mgmt_powered(hdev, 0);
+        }
+
         hci_inquiry_cache_flush(hdev);
         hci_pend_le_actions_clear(hdev);
         hci_conn_hash_flush(hdev);
@@ -2681,14 +2687,6 @@ static int hci_dev_do_close(struct hci_dev *hdev)
         hdev->flags &= BIT(HCI_RAW);
         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
 
-        if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
-                if (hdev->dev_type == HCI_BREDR) {
-                        hci_dev_lock(hdev);
-                        mgmt_powered(hdev, 0);
-                        hci_dev_unlock(hdev);
-                }
-        }
-
         /* Controller radio is available but is currently powered down */
         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
 
@@ -3083,7 +3081,9 @@ static void hci_power_on(struct work_struct *work)
 
         err = hci_dev_do_open(hdev);
         if (err < 0) {
+                hci_dev_lock(hdev);
                 mgmt_set_powered_failed(hdev, err);
+                hci_dev_unlock(hdev);
                 return;
         }
 
@@ -3959,17 +3959,29 @@ int hci_update_random_address(struct hci_request *req, bool require_privacy,
         }
 
         /* In case of required privacy without resolvable private address,
-         * use an unresolvable private address. This is useful for active
+         * use an non-resolvable private address. This is useful for active
          * scanning and non-connectable advertising.
          */
         if (require_privacy) {
-                bdaddr_t urpa;
+                bdaddr_t nrpa;
+
+                while (true) {
+                        /* The non-resolvable private address is generated
+                         * from random six bytes with the two most significant
+                         * bits cleared.
+                         */
+                        get_random_bytes(&nrpa, 6);
+                        nrpa.b[5] &= 0x3f;
 
-                get_random_bytes(&urpa, 6);
-                urpa.b[5] &= 0x3f;      /* Clear two most significant bits */
+                        /* The non-resolvable private address shall not be
+                         * equal to the public address.
+                         */
+                        if (bacmp(&hdev->bdaddr, &nrpa))
+                                break;
+                }
 
                 *own_addr_type = ADDR_LE_DEV_RANDOM;
-                set_random_addr(req, &urpa);
+                set_random_addr(req, &nrpa);
                 return 0;
         }
 
@@ -5625,7 +5637,7 @@ void hci_req_add_le_passive_scan(struct hci_request *req)
         u8 filter_policy;
 
         /* Set require_privacy to false since no SCAN_REQ are send
-         * during passive scanning. Not using an unresolvable address
+         * during passive scanning. Not using an non-resolvable address
          * here is important so that peer devices using direct
          * advertising with our address will be correctly reported
          * by the controller.
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 322abbbbcef9..39a5c8a01726 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -257,6 +257,8 @@ static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (!status) {
                 __u8 param = *((__u8 *) sent);
 
@@ -268,6 +270,8 @@ static void hci_cc_write_auth_enable(struct hci_dev *hdev, struct sk_buff *skb)
 
         if (test_bit(HCI_MGMT, &hdev->dev_flags))
                 mgmt_auth_enable_complete(hdev, status);
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_write_encrypt_mode(struct hci_dev *hdev, struct sk_buff *skb)
@@ -443,6 +447,8 @@ static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (!status) {
                 if (sent->mode)
                         hdev->features[1][0] |= LMP_HOST_SSP;
@@ -458,6 +464,8 @@ static void hci_cc_write_ssp_mode(struct hci_dev *hdev, struct sk_buff *skb)
                 else
                         clear_bit(HCI_SSP_ENABLED, &hdev->dev_flags);
         }
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
@@ -471,6 +479,8 @@ static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (!status) {
                 if (sent->support)
                         hdev->features[1][0] |= LMP_HOST_SC;
@@ -486,6 +496,8 @@ static void hci_cc_write_sc_support(struct hci_dev *hdev, struct sk_buff *skb)
                 else
                         clear_bit(HCI_SC_ENABLED, &hdev->dev_flags);
         }
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_read_local_version(struct hci_dev *hdev, struct sk_buff *skb)
@@ -1135,6 +1147,8 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
         if (!cp)
                 return;
 
+        hci_dev_lock(hdev);
+
         switch (cp->enable) {
         case LE_SCAN_ENABLE:
                 set_bit(HCI_LE_SCAN, &hdev->dev_flags);
@@ -1184,6 +1198,8 @@ static void hci_cc_le_set_scan_enable(struct hci_dev *hdev,
                 BT_ERR("Used reserved LE_Scan_Enable param %d", cp->enable);
                 break;
         }
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_le_read_white_list_size(struct hci_dev *hdev,
@@ -1278,6 +1294,8 @@ static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
         if (!sent)
                 return;
 
+        hci_dev_lock(hdev);
+
         if (sent->le) {
                 hdev->features[1][0] |= LMP_HOST_LE;
                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
@@ -1291,6 +1309,8 @@ static void hci_cc_write_le_host_supported(struct hci_dev *hdev,
                 hdev->features[1][0] |= LMP_HOST_LE_BREDR;
         else
                 hdev->features[1][0] &= ~LMP_HOST_LE_BREDR;
+
+        hci_dev_unlock(hdev);
 }
 
 static void hci_cc_set_adv_param(struct hci_dev *hdev, struct sk_buff *skb)
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a2b6dfa38a0c..d04dc0095736 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -6966,8 +6966,9 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon)
             test_bit(HCI_HS_ENABLED, &hcon->hdev->dev_flags))
                 conn->local_fixed_chan |= L2CAP_FC_A2MP;
 
-        if (bredr_sc_enabled(hcon->hdev) &&
-            test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags))
+        if (test_bit(HCI_LE_ENABLED, &hcon->hdev->dev_flags) &&
+            (bredr_sc_enabled(hcon->hdev) ||
+             test_bit(HCI_FORCE_LESC, &hcon->hdev->dbg_flags)))
                 conn->local_fixed_chan |= L2CAP_FC_SMP_BREDR;
 
         mutex_init(&conn->ident_lock);
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 7384f1161336..693ce8bcd06e 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2199,12 +2199,14 @@ static void le_enable_complete(struct hci_dev *hdev, u8 status)
 {
         struct cmd_lookup match = { NULL, hdev };
 
+        hci_dev_lock(hdev);
+
         if (status) {
                 u8 mgmt_err = mgmt_status(status);
 
                 mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, cmd_status_rsp,
                                      &mgmt_err);
-                return;
+                goto unlock;
         }
 
         mgmt_pending_foreach(MGMT_OP_SET_LE, hdev, settings_rsp, &match);
@@ -2222,17 +2224,16 @@ static void le_enable_complete(struct hci_dev *hdev, u8 status)
         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
                 struct hci_request req;
 
-                hci_dev_lock(hdev);
-
                 hci_req_init(&req, hdev);
                 update_adv_data(&req);
                 update_scan_rsp_data(&req);
                 hci_req_run(&req, NULL);
 
                 hci_update_background_scan(hdev);
-
-                hci_dev_unlock(hdev);
         }
+
+unlock:
+        hci_dev_unlock(hdev);
 }
 
 static int set_le(struct sock *sk, struct hci_dev *hdev, void *data, u16 len)
@@ -3114,14 +3115,13 @@ static void pairing_complete(struct pending_cmd *cmd, u8 status)
         conn->disconn_cfm_cb = NULL;
 
         hci_conn_drop(conn);
-        hci_conn_put(conn);
-
-        mgmt_pending_remove(cmd);
 
         /* The device is paired so there is no need to remove
          * its connection parameters anymore.
          */
         clear_bit(HCI_CONN_PARAM_REMOVAL_PEND, &conn->flags);
+
+        hci_conn_put(conn);
 }
 
 void mgmt_smp_complete(struct hci_conn *conn, bool complete)
@@ -3130,8 +3130,10 @@ void mgmt_smp_complete(struct hci_conn *conn, bool complete)
         struct pending_cmd *cmd;
 
         cmd = find_pairing(conn);
-        if (cmd)
+        if (cmd) {
                 cmd->cmd_complete(cmd, status);
+                mgmt_pending_remove(cmd);
+        }
 }
 
 static void pairing_complete_cb(struct hci_conn *conn, u8 status)
@@ -3141,10 +3143,13 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
         BT_DBG("status %u", status);
 
         cmd = find_pairing(conn);
-        if (!cmd)
+        if (!cmd) {
                 BT_DBG("Unable to find a pending command");
-        else
-                cmd->cmd_complete(cmd, mgmt_status(status));
+                return;
+        }
+
+        cmd->cmd_complete(cmd, mgmt_status(status));
+        mgmt_pending_remove(cmd);
 }
 
 static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
@@ -3157,10 +3162,13 @@ static void le_pairing_complete_cb(struct hci_conn *conn, u8 status)
                 return;
 
         cmd = find_pairing(conn);
-        if (!cmd)
+        if (!cmd) {
                 BT_DBG("Unable to find a pending command");
-        else
-                cmd->cmd_complete(cmd, mgmt_status(status));
+                return;
+        }
+
+        cmd->cmd_complete(cmd, mgmt_status(status));
+        mgmt_pending_remove(cmd);
 }
 
 static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -3274,8 +3282,10 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
         cmd->user_data = hci_conn_get(conn);
 
         if ((conn->state == BT_CONNECTED || conn->state == BT_CONFIG) &&
-            hci_conn_security(conn, sec_level, auth_type, true))
-                pairing_complete(cmd, 0);
+            hci_conn_security(conn, sec_level, auth_type, true)) {
+                cmd->cmd_complete(cmd, 0);
+                mgmt_pending_remove(cmd);
+        }
 
         err = 0;
 
@@ -3317,7 +3327,8 @@ static int cancel_pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
                 goto unlock;
         }
 
-        pairing_complete(cmd, MGMT_STATUS_CANCELLED);
+        cmd->cmd_complete(cmd, MGMT_STATUS_CANCELLED);
+        mgmt_pending_remove(cmd);
 
         err = cmd_complete(sk, hdev->id, MGMT_OP_CANCEL_PAIR_DEVICE, 0,
                            addr, sizeof(*addr));
@@ -3791,7 +3802,7 @@ static bool trigger_discovery(struct hci_request *req, u8 *status)
 
                 /* All active scans will be done with either a resolvable
                  * private address (when privacy feature has been enabled)
-                 * or unresolvable private address.
+                 * or non-resolvable private address.
                  */
                 err = hci_update_random_address(req, true, &own_addr_type);
                 if (err < 0) {
@@ -4279,12 +4290,14 @@ static void set_advertising_complete(struct hci_dev *hdev, u8 status)
 {
         struct cmd_lookup match = { NULL, hdev };
 
+        hci_dev_lock(hdev);
+
         if (status) {
                 u8 mgmt_err = mgmt_status(status);
 
                 mgmt_pending_foreach(MGMT_OP_SET_ADVERTISING, hdev,
                                      cmd_status_rsp, &mgmt_err);
-                return;
+                goto unlock;
         }
 
         if (test_bit(HCI_LE_ADV, &hdev->dev_flags))
@@ -4299,6 +4312,9 @@ static void set_advertising_complete(struct hci_dev *hdev, u8 status)
 
         if (match.sk)
                 sock_put(match.sk);
+
+unlock:
+        hci_dev_unlock(hdev);
 }
 
 static int set_advertising(struct sock *sk, struct hci_dev *hdev, void *data,
@@ -6081,6 +6097,11 @@ static int powered_update_hci(struct hci_dev *hdev)
                 hci_req_add(&req, HCI_OP_WRITE_SSP_MODE, 1, &ssp);
         }
 
+        if (bredr_sc_enabled(hdev) && !lmp_host_sc_capable(hdev)) {
+                u8 sc = 0x01;
+                hci_req_add(&req, HCI_OP_WRITE_SC_SUPPORT, sizeof(sc), &sc);
+        }
+
         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags) &&
             lmp_bredr_capable(hdev)) {
                 struct hci_cp_write_le_host_supported cp;
@@ -6130,8 +6151,7 @@ static int powered_update_hci(struct hci_dev *hdev)
 int mgmt_powered(struct hci_dev *hdev, u8 powered)
 {
         struct cmd_lookup match = { NULL, hdev };
-        u8 status_not_powered = MGMT_STATUS_NOT_POWERED;
-        u8 zero_cod[] = { 0, 0, 0 };
+        u8 status, zero_cod[] = { 0, 0, 0 };
         int err;
 
         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
@@ -6147,7 +6167,20 @@ int mgmt_powered(struct hci_dev *hdev, u8 powered)
         }
 
         mgmt_pending_foreach(MGMT_OP_SET_POWERED, hdev, settings_rsp, &match);
-        mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status_not_powered);
+
+        /* If the power off is because of hdev unregistration let
+         * use the appropriate INVALID_INDEX status. Otherwise use
+         * NOT_POWERED. We cover both scenarios here since later in
+         * mgmt_index_removed() any hci_conn callbacks will have already
+         * been triggered, potentially causing misleading DISCONNECTED
+         * status responses.
+         */
+        if (test_bit(HCI_UNREGISTER, &hdev->dev_flags))
+                status = MGMT_STATUS_INVALID_INDEX;
+        else
+                status = MGMT_STATUS_NOT_POWERED;
+
+        mgmt_pending_foreach(0, hdev, cmd_complete_rsp, &status);
 
         if (memcmp(hdev->dev_class, zero_cod, sizeof(zero_cod)) != 0)
                 mgmt_event(MGMT_EV_CLASS_OF_DEV_CHANGED, hdev,
@@ -6681,8 +6714,10 @@ void mgmt_auth_failed(struct hci_conn *conn, u8 hci_status)
         mgmt_event(MGMT_EV_AUTH_FAILED, conn->hdev, &ev, sizeof(ev),
                     cmd ? cmd->sk : NULL);
 
-        if (cmd)
-                pairing_complete(cmd, status);
+        if (cmd) {
+                cmd->cmd_complete(cmd, status);
+                mgmt_pending_remove(cmd);
+        }
 }
 
 void mgmt_auth_enable_complete(struct hci_dev *hdev, u8 status)
@@ -7046,13 +7081,15 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                  * kept and checking possible scan response data
                  * will be skipped.
                  */
-                if (hdev->discovery.uuid_count > 0) {
+                if (hdev->discovery.uuid_count > 0)
                         match = eir_has_uuids(eir, eir_len,
                                               hdev->discovery.uuid_count,
                                               hdev->discovery.uuids);
-                        if (!match)
-                                return;
-                }
+                else
+                        match = true;
+
+                if (!match && !scan_rsp_len)
+                        return;
 
                 /* Copy EIR or advertising data into event */
                 memcpy(ev->eir, eir, eir_len);
@@ -7061,8 +7098,10 @@ void mgmt_device_found(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
                  * provided, results with empty EIR or advertising data
                  * should be dropped since they do not match any UUID.
                  */
-                if (hdev->discovery.uuid_count > 0)
+                if (hdev->discovery.uuid_count > 0 && !scan_rsp_len)
                         return;
+
+                match = false;
         }
 
         if (dev_class && !eir_has_data_type(ev->eir, eir_len, EIR_CLASS_OF_DEV))
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6a46252fe66f..b67749bb55bf 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -1673,7 +1673,8 @@ static u8 smp_cmd_pairing_req(struct l2cap_conn *conn, struct sk_buff *skb)
         /* SMP over BR/EDR requires special treatment */
         if (conn->hcon->type == ACL_LINK) {
                 /* We must have a BR/EDR SC link */
-                if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags))
+                if (!test_bit(HCI_CONN_AES_CCM, &conn->hcon->flags) &&
+                    !test_bit(HCI_FORCE_LESC, &hdev->dbg_flags))
                         return SMP_CROSS_TRANSP_NOT_ALLOWED;
 
                 set_bit(SMP_FLAG_SC, &smp->flags);
@@ -2927,7 +2928,7 @@ static struct l2cap_chan *smp_add_cid(struct hci_dev *hdev, u16 cid)
         tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0, 0);
         if (IS_ERR(tfm_aes)) {
                 BT_ERR("Unable to create crypto context");
-                return ERR_PTR(PTR_ERR(tfm_aes));
+                return ERR_CAST(tfm_aes);
         }
 
 create_chan: