Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	drivers/net/usb/asix_common.c
	drivers/net/usb/sr9800.c
	drivers/net/usb/usbnet.c
	include/linux/usb/usbnet.h
	net/ipv4/tcp_ipv4.c
	net/ipv6/tcp_ipv6.c

The TCP conflicts were overlapping changes.  In 'net' we added a
READ_ONCE() to the socket cached RX route read, whilst in 'net-next'
Eric Dumazet touched the surrounding code dealing with how mini
sockets are handled.

With USB, it's a case of the same bug fix first going into net-next
and then I cherry picked it back into net.

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 12 insertions, 5 deletions

diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 2c090c507391..5c564a68fb50 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -49,8 +49,6 @@ static void ieee80211_free_tid_rx(struct rcu_head *h)
                 container_of(h, struct tid_ampdu_rx, rcu_head);
         int i;
 
-        del_timer_sync(&tid_rx->reorder_timer);
-
         for (i = 0; i < tid_rx->buf_size; i++)
                 __skb_queue_purge(&tid_rx->reorder_buf[i]);
         kfree(tid_rx->reorder_buf);
@@ -93,6 +91,12 @@ void ___ieee80211_stop_rx_ba_session(struct sta_info *sta, u16 tid,
 
         del_timer_sync(&tid_rx->session_timer);
 
+        /* make sure ieee80211_sta_reorder_release() doesn't re-arm the timer */
+        spin_lock_bh(&tid_rx->reorder_lock);
+        tid_rx->removed = true;
+        spin_unlock_bh(&tid_rx->reorder_lock);
+        del_timer_sync(&tid_rx->reorder_timer);
+
         call_rcu(&tid_rx->rcu_head, ieee80211_free_tid_rx);
 }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 4f7b922cfda4..2cd02278d4d4 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -873,9 +873,10 @@ static void ieee80211_sta_reorder_release(struct ieee80211_sub_if_data *sdata,
 
  set_release_timer:
 
-                mod_timer(&tid_agg_rx->reorder_timer,
-                          tid_agg_rx->reorder_time[j] + 1 +
-                          HT_RX_REORDER_BUF_TIMEOUT);
+                if (!tid_agg_rx->removed)
+                        mod_timer(&tid_agg_rx->reorder_timer,
+                                  tid_agg_rx->reorder_time[j] + 1 +
+                                  HT_RX_REORDER_BUF_TIMEOUT);
         } else {
                 del_timer(&tid_agg_rx->reorder_timer);
         }
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 248f56e59ebc..7e2fa4018d41 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -175,6 +175,7 @@ struct tid_ampdu_tx {
  * @reorder_lock: serializes access to reorder buffer, see below.
  * @auto_seq: used for offloaded BA sessions to automatically pick head_seq_and
  *      and ssn.
+ * @removed: this session is removed (but might have been found due to RCU)
  *
  * This structure's lifetime is managed by RCU, assignments to
  * the array holding it must hold the aggregation mutex.
@@ -199,6 +200,7 @@ struct tid_ampdu_rx {
         u16 timeout;
         u8 dialog_token;
         bool auto_seq;
+        bool removed;
 };
 
 /**