Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c

The bnx2x gso_type setting bug fix in 'net' conflicted with
changes in 'net-next' that broke the gso_* setting logic
out into a seperate function, which also fixes the bug in
question.  Thus, use the 'net-next' version.

Signed-off-by: David S. Miller <davem@davemloft.net>

9 files changed, 58 insertions, 40 deletions

diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 7f884e3fb955..8660ea3be705 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -16,6 +16,7 @@
 #include <linux/etherdevice.h>
 #include <linux/llc.h>
 #include <linux/slab.h>
+#include <linux/pkt_sched.h>
 #include <net/net_namespace.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
@@ -40,6 +41,7 @@ static void br_send_bpdu(struct net_bridge_port *p,
 
         skb->dev = p->dev;
         skb->protocol = htons(ETH_P_802_2);
+        skb->priority = TC_PRIO_CONTROL;
 
         skb_reserve(skb, LLC_RESERVE);
         memcpy(__skb_put(skb, length), data, length);
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 0337e2b76862..368f9c3f9dc6 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -187,7 +187,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                 skb_queue_walk(queue, skb) {
                         *peeked = skb->peeked;
                         if (flags & MSG_PEEK) {
-                                if (*off >= skb->len) {
+                                if (*off >= skb->len && skb->len) {
                                         *off -= skb->len;
                                         continue;
                                 }
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 9547a273b9e9..ded146b217f1 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -928,24 +928,25 @@ static void parp_redo(struct sk_buff *skb)
 static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
                    struct packet_type *pt, struct net_device *orig_dev)
 {
-        struct arphdr *arp;
+        const struct arphdr *arp;
+
+        if (dev->flags & IFF_NOARP ||
+            skb->pkt_type == PACKET_OTHERHOST ||
+            skb->pkt_type == PACKET_LOOPBACK)
+                goto freeskb;
+
+        skb = skb_share_check(skb, GFP_ATOMIC);
+        if (!skb)
+                goto out_of_mem;
 
         /* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
         if (!pskb_may_pull(skb, arp_hdr_len(dev)))
                 goto freeskb;
 
         arp = arp_hdr(skb);
-        if (arp->ar_hln != dev->addr_len ||
-            dev->flags & IFF_NOARP ||
-            skb->pkt_type == PACKET_OTHERHOST ||
-            skb->pkt_type == PACKET_LOOPBACK ||
-            arp->ar_pln != 4)
+        if (arp->ar_hln != dev->addr_len || arp->ar_pln != 4)
                 goto freeskb;
 
-        skb = skb_share_check(skb, GFP_ATOMIC);
-        if (skb == NULL)
-                goto out_of_mem;
-
         memset(NEIGH_CB(skb), 0, sizeof(struct neighbour_cb));
 
         return NF_HOOK(NFPROTO_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 7302b0b7b642..83acc1405a18 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -9,6 +9,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ipv6.h>
+#include <net/ipv6.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_ipv6/ip6t_NPT.h>
@@ -18,11 +19,20 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
 {
         struct ip6t_npt_tginfo *npt = par->targinfo;
         __wsum src_sum = 0, dst_sum = 0;
+        struct in6_addr pfx;
         unsigned int i;
 
         if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64)
                 return -EINVAL;
 
+        /* Ensure that LSB of prefix is zero */
+        ipv6_addr_prefix(&pfx, &npt->src_pfx.in6, npt->src_pfx_len);
+        if (!ipv6_addr_equal(&pfx, &npt->src_pfx.in6))
+                return -EINVAL;
+        ipv6_addr_prefix(&pfx, &npt->dst_pfx.in6, npt->dst_pfx_len);
+        if (!ipv6_addr_equal(&pfx, &npt->dst_pfx.in6))
+                return -EINVAL;
+
         for (i = 0; i < ARRAY_SIZE(npt->src_pfx.in6.s6_addr16); i++) {
                 src_sum = csum_add(src_sum,
                                 (__force __wsum)npt->src_pfx.in6.s6_addr16[i]);
@@ -30,7 +40,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
                                 (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]);
         }
 
-        npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum);
+        npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum));
         return 0;
 }
 
@@ -51,7 +61,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
 
                 idx = i / 32;
                 addr->s6_addr32[idx] &= mask;
-                addr->s6_addr32[idx] |= npt->dst_pfx.in6.s6_addr32[idx];
+                addr->s6_addr32[idx] |= ~mask & npt->dst_pfx.in6.s6_addr32[idx];
         }
 
         if (pfx_len <= 48)
@@ -66,8 +76,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
                         return false;
         }
 
-        sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx],
-                         npt->adjustment);
+        sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]),
+                                  csum_unfold(npt->adjustment)));
         if (sum == CSUM_MANGLED_0)
                 sum = 0;
         *(__force __sum16 *)&addr->s6_addr16[idx] = sum;
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 661b878bd19c..15d886c639e9 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -2058,7 +2058,8 @@ static int ieee80211_set_mcast_rate(struct wiphy *wiphy, struct net_device *dev,
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
 
-        memcpy(sdata->vif.bss_conf.mcast_rate, rate, sizeof(rate));
+        memcpy(sdata->vif.bss_conf.mcast_rate, rate,
+               sizeof(int) * IEEE80211_NUM_BANDS);
 
         return 0;
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 5913fb924b12..72924399077e 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3422,6 +3422,7 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
 
         ret = 0;
 
+out:
         while (!cfg80211_chandef_usable(sdata->local->hw.wiphy, chandef,
                                         IEEE80211_CHAN_DISABLED)) {
                 if (WARN_ON(chandef->width == NL80211_CHAN_WIDTH_20_NOHT)) {
@@ -3430,14 +3431,13 @@ ieee80211_determine_chantype(struct ieee80211_sub_if_data *sdata,
                         goto out;
                 }
 
-                ret = chandef_downgrade(chandef);
+                ret |= chandef_downgrade(chandef);
         }
 
         if (chandef->width != vht_chandef.width)
                 sdata_info(sdata,
-                           "local regulatory prevented using AP HT/VHT configuration, downgraded\n");
+                           "capabilities/regulatory prevented using AP HT/VHT configuration, downgraded\n");
 
-out:
         WARN_ON_ONCE(!cfg80211_chandef_valid(chandef));
         return ret;
 }
@@ -3551,8 +3551,11 @@ static int ieee80211_prep_channel(struct ieee80211_sub_if_data *sdata,
          */
         ret = ieee80211_vif_use_channel(sdata, &chandef,
                                         IEEE80211_CHANCTX_SHARED);
-        while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT)
+        while (ret && chandef.width != NL80211_CHAN_WIDTH_20_NOHT) {
                 ifmgd->flags |= chandef_downgrade(&chandef);
+                ret = ieee80211_vif_use_channel(sdata, &chandef,
+                                                IEEE80211_CHANCTX_SHARED);
+        }
         return ret;
 }
 
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 746048b13ef3..ae8ec6f27688 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -61,14 +61,27 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
         return 1;
 }
 
+static void sctp_nat_csum(struct sk_buff *skb, sctp_sctphdr_t *sctph,
+                          unsigned int sctphoff)
+{
+        __u32 crc32;
+        struct sk_buff *iter;
+
+        crc32 = sctp_start_cksum((__u8 *)sctph, skb_headlen(skb) - sctphoff);
+        skb_walk_frags(skb, iter)
+                crc32 = sctp_update_cksum((u8 *) iter->data,
+                                          skb_headlen(iter), crc32);
+        sctph->checksum = sctp_end_cksum(crc32);
+
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
+
 static int
 sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
                   struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
 {
         sctp_sctphdr_t *sctph;
         unsigned int sctphoff = iph->len;
-        struct sk_buff *iter;
-        __be32 crc32;
 
 #ifdef CONFIG_IP_VS_IPV6
         if (cp->af == AF_INET6 && iph->fragoffs)
@@ -92,13 +105,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
         sctph = (void *) skb_network_header(skb) + sctphoff;
         sctph->source = cp->vport;
 
-        /* Calculate the checksum */
-        crc32 = sctp_start_cksum((u8 *) sctph, skb_headlen(skb) - sctphoff);
-        skb_walk_frags(skb, iter)
-                crc32 = sctp_update_cksum((u8 *) iter->data, skb_headlen(iter),
-                                          crc32);
-        crc32 = sctp_end_cksum(crc32);
-        sctph->checksum = crc32;
+        sctp_nat_csum(skb, sctph, sctphoff);
 
         return 1;
 }
@@ -109,8 +116,6 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
 {
         sctp_sctphdr_t *sctph;
         unsigned int sctphoff = iph->len;
-        struct sk_buff *iter;
-        __be32 crc32;
 
 #ifdef CONFIG_IP_VS_IPV6
         if (cp->af == AF_INET6 && iph->fragoffs)
@@ -134,13 +139,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
         sctph = (void *) skb_network_header(skb) + sctphoff;
         sctph->dest = cp->dport;
 
-        /* Calculate the checksum */
-        crc32 = sctp_start_cksum((u8 *) sctph, skb_headlen(skb) - sctphoff);
-        skb_walk_frags(skb, iter)
-                crc32 = sctp_update_cksum((u8 *) iter->data, skb_headlen(iter),
-                                          crc32);
-        crc32 = sctp_end_cksum(crc32);
-        sctph->checksum = crc32;
+        sctp_nat_csum(skb, sctph, sctphoff);
 
         return 1;
 }
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index effa10c9e4e3..44fd10c539ac 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
                                              GFP_KERNEL);
                         if (!tinfo->buf)
                                 goto outtinfo;
+                } else {
+                        tinfo->buf = NULL;
                 }
                 tinfo->id = id;
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 51561eafcb72..79e8ed4ac7ce 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1135,9 +1135,9 @@ static int htb_dump_class(struct Qdisc *sch, unsigned long arg,
         memset(&opt, 0, sizeof(opt));
 
         opt.rate.rate = cl->rate.rate_bps >> 3;
-        opt.buffer = cl->buffer;
+        opt.buffer = PSCHED_NS2TICKS(cl->buffer);
         opt.ceil.rate = cl->ceil.rate_bps >> 3;
-        opt.cbuffer = cl->cbuffer;
+        opt.cbuffer = PSCHED_NS2TICKS(cl->cbuffer);
         opt.quantum = cl->quantum;
         opt.prio = cl->prio;
         opt.level = cl->level;