Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Include fixes for netrom and dsa (Fabian Frederick and Florian
    Fainelli)

 2) Fix FIXED_PHY support in stmmac, from Giuseppe CAVALLARO.

 3) Several SKB use after free fixes (vxlan, openvswitch, vxlan,
    ip_tunnel, fou), from Li ROngQing.

 4) fec driver PTP support fixes from Luwei Zhou and Nimrod Andy.

 5) Use after free in virtio_net, from Michael S Tsirkin.

 6) Fix flow mask handling for megaflows in openvswitch, from Pravin B
    Shelar.

 7) ISDN gigaset and capi bug fixes from Tilman Schmidt.

 8) Fix route leak in ip_send_unicast_reply(), from Vasily Averin.

 9) Fix two eBPF JIT bugs on x86, from Alexei Starovoitov.

10) TCP_SKB_CB() reorganization caused a few regressions, fixed by Cong
    Wang and Eric Dumazet.

11) Don't overwrite end of SKB when parsing malformed sctp ASCONF
    chunks, from Daniel Borkmann.

12) Don't call sock_kfree_s() with NULL pointers, this function also has
    the side effect of adjusting the socket memory usage.  From Cong Wang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (90 commits)
  bna: fix skb->truesize underestimation
  net: dsa: add includes for ethtool and phy_fixed definitions
  openvswitch: Set flow-key members.
  netrom: use linux/uaccess.h
  dsa: Fix conversion from host device to mii bus
  tipc: fix bug in bundled buffer reception
  ipv6: introduce tcp_v6_iif()
  sfc: add support for skb->xmit_more
  r8152: return -EBUSY for runtime suspend
  ipv4: fix a potential use after free in fou.c
  ipv4: fix a potential use after free in ip_tunnel_core.c
  hyperv: Add handling of IP header with option field in netvsc_set_hash()
  openvswitch: Create right mask with disabled megaflows
  vxlan: fix a free after use
  openvswitch: fix a use after free
  ipv4: dst_entry leak in ip_send_unicast_reply()
  ipv4: clean up cookie_v4_check()
  ipv4: share tcp_v4_save_options() with cookie_v4_check()
  ipv4: call __ip_options_echo() in cookie_v4_check()
  atm: simplify lanai.c by using module_pci_driver
  ...

3 files changed, 16 insertions, 13 deletions

diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index f5e319a8d4e2..baf2742d1ec4 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -235,7 +235,6 @@ static struct ifacaddr6 *aca_alloc(struct rt6_info *rt,
         /* aca_tstamp should be updated upon changes */
         aca->aca_cstamp = aca->aca_tstamp = jiffies;
         atomic_set(&aca->aca_refcnt, 1);
-        spin_lock_init(&aca->aca_lock);
 
         return aca;
 }
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index e25b633266c3..2f25cb6347ca 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -214,7 +214,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         /* So that link locals have meaning */
         if (!sk->sk_bound_dev_if &&
             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
-                ireq->ir_iif = inet6_iif(skb);
+                ireq->ir_iif = tcp_v6_iif(skb);
 
         ireq->ir_mark = inet_request_mark(sk, skb);
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index cf2e45ab2fa4..831495529b82 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -424,6 +424,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 if (sock_owned_by_user(sk))
                         goto out;
 
+                /* Note : We use inet6_iif() here, not tcp_v6_iif() */
                 req = inet6_csk_search_req(sk, &prev, th->dest, &hdr->daddr,
                                            &hdr->saddr, inet6_iif(skb));
                 if (!req)
@@ -738,7 +739,7 @@ static void tcp_v6_init_req(struct request_sock *req, struct sock *sk,
         /* So that link locals have meaning */
         if (!sk->sk_bound_dev_if &&
             ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
-                ireq->ir_iif = inet6_iif(skb);
+                ireq->ir_iif = tcp_v6_iif(skb);
 
         if (!TCP_SKB_CB(skb)->tcp_tw_isn &&
             (ipv6_opt_accepted(sk, skb, &TCP_SKB_CB(skb)->header.h6) ||
@@ -860,7 +861,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
 
         fl6.flowi6_proto = IPPROTO_TCP;
         if (rt6_need_strict(&fl6.daddr) && !oif)
-                fl6.flowi6_oif = inet6_iif(skb);
+                fl6.flowi6_oif = tcp_v6_iif(skb);
         else
                 fl6.flowi6_oif = oif;
         fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
@@ -918,7 +919,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                 sk1 = inet6_lookup_listener(dev_net(skb_dst(skb)->dev),
                                            &tcp_hashinfo, &ipv6h->saddr,
                                            th->source, &ipv6h->daddr,
-                                           ntohs(th->source), inet6_iif(skb));
+                                           ntohs(th->source), tcp_v6_iif(skb));
                 if (!sk1)
                         return;
 
@@ -1000,13 +1001,14 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
         /* Find possible connection requests. */
         req = inet6_csk_search_req(sk, &prev, th->source,
                                    &ipv6_hdr(skb)->saddr,
-                                   &ipv6_hdr(skb)->daddr, inet6_iif(skb));
+                                   &ipv6_hdr(skb)->daddr, tcp_v6_iif(skb));
         if (req)
                 return tcp_check_req(sk, skb, req, prev, false);
 
         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,
-                        &ipv6_hdr(skb)->saddr, th->source,
-                        &ipv6_hdr(skb)->daddr, ntohs(th->dest), inet6_iif(skb));
+                                         &ipv6_hdr(skb)->saddr, th->source,
+                                         &ipv6_hdr(skb)->daddr, ntohs(th->dest),
+                                         tcp_v6_iif(skb));
 
         if (nsk) {
                 if (nsk->sk_state != TCP_TIME_WAIT) {
@@ -1090,7 +1092,7 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 newnp->ipv6_fl_list = NULL;
                 newnp->pktoptions  = NULL;
                 newnp->opt         = NULL;
-                newnp->mcast_oif   = inet6_iif(skb);
+                newnp->mcast_oif   = tcp_v6_iif(skb);
                 newnp->mcast_hops  = ipv6_hdr(skb)->hop_limit;
                 newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
                 if (np->repflow)
@@ -1174,7 +1176,7 @@ static struct sock *tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                         skb_set_owner_r(newnp->pktoptions, newsk);
         }
         newnp->opt        = NULL;
-        newnp->mcast_oif  = inet6_iif(skb);
+        newnp->mcast_oif  = tcp_v6_iif(skb);
         newnp->mcast_hops = ipv6_hdr(skb)->hop_limit;
         newnp->rcv_flowinfo = ip6_flowinfo(ipv6_hdr(skb));
         if (np->repflow)
@@ -1360,7 +1362,7 @@ ipv6_pktoptions:
         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
                 if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
-                        np->mcast_oif = inet6_iif(opt_skb);
+                        np->mcast_oif = tcp_v6_iif(opt_skb);
                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
                 if (np->rxopt.bits.rxflow || np->rxopt.bits.rxtclass)
@@ -1427,7 +1429,8 @@ static int tcp_v6_rcv(struct sk_buff *skb)
         TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
         TCP_SKB_CB(skb)->sacked = 0;
 
-        sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
+        sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest,
+                                tcp_v6_iif(skb));
         if (!sk)
                 goto no_tcp_socket;
 
@@ -1514,7 +1517,7 @@ do_time_wait:
                 sk2 = inet6_lookup_listener(dev_net(skb->dev), &tcp_hashinfo,
                                             &ipv6_hdr(skb)->saddr, th->source,
                                             &ipv6_hdr(skb)->daddr,
-                                            ntohs(th->dest), inet6_iif(skb));
+                                            ntohs(th->dest), tcp_v6_iif(skb));
                 if (sk2 != NULL) {
                         struct inet_timewait_sock *tw = inet_twsk(sk);
                         inet_twsk_deschedule(tw, &tcp_death_row);
@@ -1553,6 +1556,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
         if (th->doff < sizeof(struct tcphdr) / 4)
                 return;
 
+        /* Note : We use inet6_iif() here, not tcp_v6_iif() */
         sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
                                         &hdr->saddr, th->source,
                                         &hdr->daddr, ntohs(th->dest),