Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Unbreak zebra and other netlink apps, from Eric W Biederman.

 2) Some new qmi_wwan device IDs, from Aleksander Morgado.

 3) Fix info leak in DCB netlink handler of qlcnic driver, from Dan
    Carpenter.

 4) inet_getid() and ipv6_select_ident() do not generate monotonically
    increasing ID numbers, fix from Eric Dumazet.

 5) Fix memory leak in __sk_prepare_filter(), from Leon Yu.

 6) Netlink leftover bytes warning message is user triggerable, rate
    limit it.  From Michal Schmidt.

 7) Fix non-linear SKB panic in ipvs, from Peter Christensen.

 8) Congestion window undo needs to be performed even if only never
    retransmitted data is SACK'd, fix from Yuching Cheng.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (24 commits)
  net: filter: fix possible memory leak in __sk_prepare_filter()
  net: ec_bhf: Add runtime dependencies
  tcp: fix cwnd undo on DSACK in F-RTO
  netlink: Only check file credentials for implicit destinations
  ipheth: Add support for iPad 2 and iPad 3
  team: fix mtu setting
  net: fix inet_getid() and ipv6_select_ident() bugs
  net: qmi_wwan: interface #11 in Sierra Wireless MC73xx is not QMI
  net: qmi_wwan: add additional Sierra Wireless QMI devices
  bridge: Prevent insertion of FDB entry with disallowed vlan
  netlink: rate-limit leftover bytes warning and print process name
  bridge: notify user space after fdb update
  net: qmi_wwan: add Netgear AirCard 341U
  net: fix wrong mac_len calculation for vlans
  batman-adv: fix NULL pointer dereferences
  net/mlx4_core: Reset RoCE VF gids when guest driver goes down
  emac: aggregation of v1-2 PLB errors for IER register
  emac: add missing support of 10mbit in emac/rgmii
  can: only rename enabled led triggers when changing the netdev name
  ipvs: Fix panic due to non-linear skb
  ...

12 files changed, 104 insertions, 39 deletions

diff --git a/net/batman-adv/multicast.c b/net/batman-adv/multicast.c
index 8c7ca811de6e..96b66fd30f96 100644
--- a/net/batman-adv/multicast.c
+++ b/net/batman-adv/multicast.c
@@ -415,7 +415,7 @@ batadv_mcast_forw_ipv4_node_get(struct batadv_priv *bat_priv)
         hlist_for_each_entry_rcu(tmp_orig_node,
                                  &bat_priv->mcast.want_all_ipv4_list,
                                  mcast_want_all_ipv4_node) {
-                if (!atomic_inc_not_zero(&orig_node->refcount))
+                if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                         continue;
 
                 orig_node = tmp_orig_node;
@@ -442,7 +442,7 @@ batadv_mcast_forw_ipv6_node_get(struct batadv_priv *bat_priv)
         hlist_for_each_entry_rcu(tmp_orig_node,
                                  &bat_priv->mcast.want_all_ipv6_list,
                                  mcast_want_all_ipv6_node) {
-                if (!atomic_inc_not_zero(&orig_node->refcount))
+                if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                         continue;
 
                 orig_node = tmp_orig_node;
@@ -493,7 +493,7 @@ batadv_mcast_forw_unsnoop_node_get(struct batadv_priv *bat_priv)
         hlist_for_each_entry_rcu(tmp_orig_node,
                                  &bat_priv->mcast.want_all_unsnoopables_list,
                                  mcast_want_all_unsnoopables_node) {
-                if (!atomic_inc_not_zero(&orig_node->refcount))
+                if (!atomic_inc_not_zero(&tmp_orig_node->refcount))
                         continue;
 
                 orig_node = tmp_orig_node;
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index a1e5bb7d06e8..dc4d301d3a72 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -7519,9 +7519,9 @@ int __init l2cap_init(void)
         l2cap_debugfs = debugfs_create_file("l2cap", 0444, bt_debugfs,
                                             NULL, &l2cap_debugfs_fops);
 
-        debugfs_create_u16("l2cap_le_max_credits", 0466, bt_debugfs,
+        debugfs_create_u16("l2cap_le_max_credits", 0644, bt_debugfs,
                            &le_max_credits);
-        debugfs_create_u16("l2cap_le_default_mps", 0466, bt_debugfs,
+        debugfs_create_u16("l2cap_le_default_mps", 0644, bt_debugfs,
                            &le_default_mps);
 
         bt_6lowpan_init();
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 9203d5a1943f..474d36f93342 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -487,6 +487,7 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
 {
         struct hlist_head *head = &br->hash[br_mac_hash(addr, vid)];
         struct net_bridge_fdb_entry *fdb;
+        bool fdb_modified = false;
 
         /* some users want to always flood. */
         if (hold_time(br) == 0)
@@ -507,10 +508,15 @@ void br_fdb_update(struct net_bridge *br, struct net_bridge_port *source,
                                         source->dev->name);
                 } else {
                         /* fastpath: update of existing entry */
-                        fdb->dst = source;
+                        if (unlikely(source != fdb->dst)) {
+                                fdb->dst = source;
+                                fdb_modified = true;
+                        }
                         fdb->updated = jiffies;
                         if (unlikely(added_by_user))
                                 fdb->added_by_user = 1;
+                        if (unlikely(fdb_modified))
+                                fdb_notify(br, fdb, RTM_NEWNEIGH);
                 }
         } else {
                 spin_lock(&br->hash_lock);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 7985deaff52f..04d6348fd530 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -147,8 +147,8 @@ static int br_handle_local_finish(struct sk_buff *skb)
         struct net_bridge_port *p = br_port_get_rcu(skb->dev);
         u16 vid = 0;
 
-        br_vlan_get_tag(skb, &vid);
-        if (p->flags & BR_LEARNING)
+        /* check if vlan is allowed, to avoid spoofing */
+        if (p->flags & BR_LEARNING && br_should_learn(p, skb, &vid))
                 br_fdb_update(p->br, p, eth_hdr(skb)->h_source, vid, false);
         return 0;        /* process further */
 }
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 06811d79f89f..59d3a85c5873 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -581,6 +581,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
                         struct sk_buff *skb, u16 *vid);
 bool br_allowed_egress(struct net_bridge *br, const struct net_port_vlans *v,
                        const struct sk_buff *skb);
+bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid);
 struct sk_buff *br_handle_vlan(struct net_bridge *br,
                                const struct net_port_vlans *v,
                                struct sk_buff *skb);
@@ -648,6 +649,12 @@ static inline bool br_allowed_egress(struct net_bridge *br,
         return true;
 }
 
+static inline bool br_should_learn(struct net_bridge_port *p,
+                                   struct sk_buff *skb, u16 *vid)
+{
+        return true;
+}
+
 static inline struct sk_buff *br_handle_vlan(struct net_bridge *br,
                                              const struct net_port_vlans *v,
                                              struct sk_buff *skb)
diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
index 4a3716102789..5fee2feaf292 100644
--- a/net/bridge/br_vlan.c
+++ b/net/bridge/br_vlan.c
@@ -241,6 +241,34 @@ bool br_allowed_egress(struct net_bridge *br,
         return false;
 }
 
+/* Called under RCU */
+bool br_should_learn(struct net_bridge_port *p, struct sk_buff *skb, u16 *vid)
+{
+        struct net_bridge *br = p->br;
+        struct net_port_vlans *v;
+
+        if (!br->vlan_enabled)
+                return true;
+
+        v = rcu_dereference(p->vlan_info);
+        if (!v)
+                return false;
+
+        br_vlan_get_tag(skb, vid);
+        if (!*vid) {
+                *vid = br_get_pvid(v);
+                if (*vid == VLAN_N_VID)
+                        return false;
+
+                return true;
+        }
+
+        if (test_bit(*vid, v->vlan_bitmap))
+                return true;
+
+        return false;
+}
+
 /* Must be protected by RTNL.
  * Must be called with vid in range from 1 to 4094 inclusive.
  */
diff --git a/net/core/dev.c b/net/core/dev.c
index 9abc503b19b7..fb8b0546485b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2283,8 +2283,8 @@ EXPORT_SYMBOL(skb_checksum_help);
 
 __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
 {
+        unsigned int vlan_depth = skb->mac_len;
         __be16 type = skb->protocol;
-        int vlan_depth = skb->mac_len;
 
         /* Tunnel gso handlers can set protocol to ethernet. */
         if (type == htons(ETH_P_TEB)) {
@@ -2297,15 +2297,30 @@ __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
                 type = eth->h_proto;
         }
 
-        while (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
-                struct vlan_hdr *vh;
-
-                if (unlikely(!pskb_may_pull(skb, vlan_depth + VLAN_HLEN)))
-                        return 0;
-
-                vh = (struct vlan_hdr *)(skb->data + vlan_depth);
-                type = vh->h_vlan_encapsulated_proto;
-                vlan_depth += VLAN_HLEN;
+        /* if skb->protocol is 802.1Q/AD then the header should already be
+         * present at mac_len - VLAN_HLEN (if mac_len > 0), or at
+         * ETH_HLEN otherwise
+         */
+        if (type == htons(ETH_P_8021Q) || type == htons(ETH_P_8021AD)) {
+                if (vlan_depth) {
+                        if (unlikely(WARN_ON(vlan_depth < VLAN_HLEN)))
+                                return 0;
+                        vlan_depth -= VLAN_HLEN;
+                } else {
+                        vlan_depth = ETH_HLEN;
+                }
+                do {
+                        struct vlan_hdr *vh;
+
+                        if (unlikely(!pskb_may_pull(skb,
+                                                    vlan_depth + VLAN_HLEN)))
+                                return 0;
+
+                        vh = (struct vlan_hdr *)(skb->data + vlan_depth);
+                        type = vh->h_vlan_encapsulated_proto;
+                        vlan_depth += VLAN_HLEN;
+                } while (type == htons(ETH_P_8021Q) ||
+                         type == htons(ETH_P_8021AD));
         }
 
         *depth = vlan_depth;
diff --git a/net/core/filter.c b/net/core/filter.c
index 9d79ca0a6e8e..4aec7b93f1a9 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -1559,8 +1559,13 @@ static struct sk_filter *__sk_prepare_filter(struct sk_filter *fp,
         fp->jited = 0;
 
         err = sk_chk_filter(fp->insns, fp->len);
-        if (err)
+        if (err) {
+                if (sk != NULL)
+                        sk_filter_uncharge(sk, fp);
+                else
+                        kfree(fp);
                 return ERR_PTR(err);
+        }
 
         /* Probe if we can JIT compile the filter and if so, do
          * the compilation of the filter.
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index d6b46eb2f94c..3a26b3b23f16 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2684,13 +2684,12 @@ static void tcp_process_loss(struct sock *sk, int flag, bool is_dupack)
         bool recovered = !before(tp->snd_una, tp->high_seq);
 
         if (tp->frto) { /* F-RTO RFC5682 sec 3.1 (sack enhanced version). */
-                if (flag & FLAG_ORIG_SACK_ACKED) {
-                        /* Step 3.b. A timeout is spurious if not all data are
-                         * lost, i.e., never-retransmitted data are (s)acked.
-                         */
-                        tcp_try_undo_loss(sk, true);
+                /* Step 3.b. A timeout is spurious if not all data are
+                 * lost, i.e., never-retransmitted data are (s)acked.
+                 */
+                if (tcp_try_undo_loss(sk, flag & FLAG_ORIG_SACK_ACKED))
                         return;
-                }
+
                 if (after(tp->snd_nxt, tp->high_seq) &&
                     (flag & FLAG_DATA_SACKED || is_dupack)) {
                         tp->frto = 0; /* Loss was real: 2nd part of step 3.a */
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 6313abd53c9d..56596ce390a1 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -12,7 +12,7 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
 {
         static atomic_t ipv6_fragmentation_id;
         struct in6_addr addr;
-        int old, new;
+        int ident;
 
 #if IS_ENABLED(CONFIG_IPV6)
         struct inet_peer *peer;
@@ -26,15 +26,10 @@ void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
                 return;
         }
 #endif
-        do {
-                old = atomic_read(&ipv6_fragmentation_id);
-                new = old + 1;
-                if (!new)
-                        new = 1;
-        } while (atomic_cmpxchg(&ipv6_fragmentation_id, old, new) != old);
+        ident = atomic_inc_return(&ipv6_fragmentation_id);
 
         addr = rt->rt6i_dst.addr;
-        addr.s6_addr32[0] ^= (__force __be32)new;
+        addr.s6_addr32[0] ^= (__force __be32)ident;
         fhdr->identification = htonl(secure_ipv6_id(addr.s6_addr32));
 }
 EXPORT_SYMBOL(ipv6_select_ident);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index 4f26ee46b51f..3d2d2c8108ca 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1392,15 +1392,19 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
 
         if (ipip) {
                 __be32 info = ic->un.gateway;
+                __u8 type = ic->type;
+                __u8 code = ic->code;
 
                 /* Update the MTU */
                 if (ic->type == ICMP_DEST_UNREACH &&
                     ic->code == ICMP_FRAG_NEEDED) {
                         struct ip_vs_dest *dest = cp->dest;
                         u32 mtu = ntohs(ic->un.frag.mtu);
+                        __be16 frag_off = cih->frag_off;
 
                         /* Strip outer IP and ICMP, go to IPIP header */
-                        __skb_pull(skb, ihl + sizeof(_icmph));
+                        if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL)
+                                goto ignore_ipip;
                         offset2 -= ihl + sizeof(_icmph);
                         skb_reset_network_header(skb);
                         IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
@@ -1408,7 +1412,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
                         ipv4_update_pmtu(skb, dev_net(skb->dev),
                                          mtu, 0, 0, 0, 0);
                         /* Client uses PMTUD? */
-                        if (!(cih->frag_off & htons(IP_DF)))
+                        if (!(frag_off & htons(IP_DF)))
                                 goto ignore_ipip;
                         /* Prefer the resulting PMTU */
                         if (dest) {
@@ -1427,12 +1431,13 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
                 /* Strip outer IP, ICMP and IPIP, go to IP header of
                  * original request.
                  */
-                __skb_pull(skb, offset2);
+                if (pskb_pull(skb, offset2) == NULL)
+                        goto ignore_ipip;
                 skb_reset_network_header(skb);
                 IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
                         &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
-                        ic->type, ic->code, ntohl(info));
-                icmp_send(skb, ic->type, ic->code, info);
+                        type, code, ntohl(info));
+                icmp_send(skb, type, code, info);
                 /* ICMP can be shorter but anyways, account it */
                 ip_vs_out_stats(cp, skb);
 
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 81dca96d2be6..f22757a29cd0 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1373,7 +1373,9 @@ retry:
 bool __netlink_ns_capable(const struct netlink_skb_parms *nsp,
                         struct user_namespace *user_ns, int cap)
 {
-        return sk_ns_capable(nsp->sk, user_ns, cap);
+        return ((nsp->flags & NETLINK_SKB_DST) ||
+                file_ns_capable(nsp->sk->sk_socket->file, user_ns, cap)) &&
+                ns_capable(user_ns, cap);
 }
 EXPORT_SYMBOL(__netlink_ns_capable);
 
@@ -2293,6 +2295,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
         struct sk_buff *skb;
         int err;
         struct scm_cookie scm;
+        u32 netlink_skb_flags = 0;
 
         if (msg->msg_flags&MSG_OOB)
                 return -EOPNOTSUPP;
@@ -2314,6 +2317,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 if ((dst_group || dst_portid) &&
                     !netlink_allowed(sock, NL_CFG_F_NONROOT_SEND))
                         goto out;
+                netlink_skb_flags |= NETLINK_SKB_DST;
         } else {
                 dst_portid = nlk->dst_portid;
                 dst_group = nlk->dst_group;
@@ -2343,6 +2347,7 @@ static int netlink_sendmsg(struct kiocb *kiocb, struct socket *sock,
         NETLINK_CB(skb).portid  = nlk->portid;
         NETLINK_CB(skb).dst_group = dst_group;
         NETLINK_CB(skb).creds   = siocb->scm->creds;
+        NETLINK_CB(skb).flags   = netlink_skb_flags;
 
         err = -EFAULT;
         if (memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len)) {