Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull more networking updates from David Miller:

 1) If a VXLAN interface is created with no groups, we can crash on
    reception of packets.  Fix from Mike Rapoport.

 2) Missing includes in CPTS driver, from Alexei Starovoitov.

 3) Fix string validations in isdnloop driver, from YOSHIFUJI Hideaki
    and Dan Carpenter.

 4) Missing irq.h include in bnxw2x, enic, and qlcnic drivers.  From
    Josh Boyer.

 5) AF_PACKET transmit doesn't statistically count TX drops, from Daniel
    Borkmann.

 6) Byte-Queue-Limit enabled drivers aren't handled properly in
    AF_PACKET transmit path, also from Daniel Borkmann.

    Same problem exists in pktgen, and Daniel fixed it there too.

 7) Fix resource leaks in driver probe error paths of new sxgbe driver,
    from Francois Romieu.

 8) Truesize of SKBs can gradually get more and more corrupted in NAPI
    packet recycling path, fix from Eric Dumazet.

 9) Fix uniprocessor netfilter build, from Florian Westphal.  In the
    longer term we should perhaps try to find a way for ARRAY_SIZE() to
    work even with zero sized array elements.

10) Fix crash in netfilter conntrack extensions due to mis-estimation of
    required extension space.  From Andrey Vagin.

11) Since we commit table rule updates before trying to copy the
    counters back to userspace (it's the last action we perform), we
    really can't signal the user copy with an error as we are beyond the
    point from which we can unwind everything.  This causes all kinds of
    use after free crashes and other mysterious behavior.

    From Thomas Graf.

12) Restore previous behvaior of div/mod by zero in BPF filter
    processing.  From Daniel Borkmann.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (38 commits)
  net: sctp: wake up all assocs if sndbuf policy is per socket
  isdnloop: several buffer overflows
  netdev: remove potentially harmful checks
  pktgen: fix xmit test for BQL enabled devices
  net/at91_ether: avoid NULL pointer dereference
  tipc: Let tipc_release() return 0
  at86rf230: fix MAX_CSMA_RETRIES parameter
  mac802154: fix duplicate #include headers
  sxgbe: fix duplicate #include headers
  net: filter: be more defensive on div/mod by X==0
  netfilter: Can't fail and free after table replacement
  xen-netback: Trivial format string fix
  net: bcmgenet: Remove unnecessary version.h inclusion
  net: smc911x: Remove unused local variable
  bonding: Inactive slaves should keep inactive flag's value
  netfilter: nf_tables: fix wrong format in request_module()
  netfilter: nf_tables: set names cannot be larger than 15 bytes
  netfilter: nf_conntrack: reserve two bytes for nf_ct_ext->len
  netfilter: Add {ipt,ip6t}_osf aliases for xt_osf
  netfilter: x_tables: allow to use cgroup match for LOCAL_IN nf hooks
  ...

17 files changed, 107 insertions, 48 deletions

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 0e474b13463b..1059ed3bc255 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
         if (repl->num_counters &&
            copy_to_user(repl->counters, counterstmp,
            repl->num_counters * sizeof(struct ebt_counter))) {
-                ret = -EFAULT;
+                /* Silent error, can't fail, new table is already in place */
+                net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
         }
-        else
-                ret = 0;
 
         /* decrease module count and free resources */
         EBT_ENTRY_ITERATE(table->entries, table->entries_size,
diff --git a/net/core/dev.c b/net/core/dev.c
index 757063420ce0..14dac0654f28 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4043,6 +4043,7 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         skb->vlan_tci = 0;
         skb->dev = napi->dev;
         skb->skb_iif = 0;
+        skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
 
         napi->skb = skb;
 }
@@ -4588,8 +4589,7 @@ void *netdev_lower_get_next_private(struct net_device *dev,
         if (&lower->list == &dev->adj_list.lower)
                 return NULL;
 
-        if (iter)
-                *iter = lower->list.next;
+        *iter = lower->list.next;
 
         return lower->private;
 }
@@ -4617,8 +4617,7 @@ void *netdev_lower_get_next_private_rcu(struct net_device *dev,
         if (&lower->list == &dev->adj_list.lower)
                 return NULL;
 
-        if (iter)
-                *iter = &lower->list;
+        *iter = &lower->list;
 
         return lower->private;
 }
@@ -5696,6 +5695,13 @@ static netdev_features_t netdev_fix_features(struct net_device *dev,
                 }
         }
 
+#ifdef CONFIG_NET_RX_BUSY_POLL
+        if (dev->netdev_ops->ndo_busy_poll)
+                features |= NETIF_F_BUSY_POLL;
+        else
+#endif
+                features &= ~NETIF_F_BUSY_POLL;
+
         return features;
 }
 
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 30071dec287a..640ba0e5831c 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -97,6 +97,7 @@ static const char netdev_features_strings[NETDEV_FEATURE_COUNT][ETH_GSTRING_LEN]
         [NETIF_F_RXFCS_BIT] =            "rx-fcs",
         [NETIF_F_RXALL_BIT] =            "rx-all",
         [NETIF_F_HW_L2FW_DOFFLOAD_BIT] = "l2-fwd-offload",
+        [NETIF_F_BUSY_POLL_BIT] =        "busy-poll",
 };
 
 static int ethtool_get_features(struct net_device *dev, void __user *useraddr)
diff --git a/net/core/filter.c b/net/core/filter.c
index 765556ba32ef..e08b3822c72a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -295,43 +295,43 @@ select_insn:
                 (*(s64 *) &A) >>= K;
                 CONT;
         BPF_ALU64_BPF_MOD_BPF_X:
+                if (unlikely(X == 0))
+                        return 0;
                 tmp = A;
-                if (X)
-                        A = do_div(tmp, X);
+                A = do_div(tmp, X);
                 CONT;
         BPF_ALU_BPF_MOD_BPF_X:
+                if (unlikely(X == 0))
+                        return 0;
                 tmp = (u32) A;
-                if (X)
-                        A = do_div(tmp, (u32) X);
+                A = do_div(tmp, (u32) X);
                 CONT;
         BPF_ALU64_BPF_MOD_BPF_K:
                 tmp = A;
-                if (K)
-                        A = do_div(tmp, K);
+                A = do_div(tmp, K);
                 CONT;
         BPF_ALU_BPF_MOD_BPF_K:
                 tmp = (u32) A;
-                if (K)
-                        A = do_div(tmp, (u32) K);
+                A = do_div(tmp, (u32) K);
                 CONT;
         BPF_ALU64_BPF_DIV_BPF_X:
-                if (X)
-                        do_div(A, X);
+                if (unlikely(X == 0))
+                        return 0;
+                do_div(A, X);
                 CONT;
         BPF_ALU_BPF_DIV_BPF_X:
+                if (unlikely(X == 0))
+                        return 0;
                 tmp = (u32) A;
-                if (X)
-                        do_div(tmp, (u32) X);
+                do_div(tmp, (u32) X);
                 A = (u32) tmp;
                 CONT;
         BPF_ALU64_BPF_DIV_BPF_K:
-                if (K)
-                        do_div(A, K);
+                do_div(A, K);
                 CONT;
         BPF_ALU_BPF_DIV_BPF_K:
                 tmp = (u32) A;
-                if (K)
-                        do_div(tmp, (u32) K);
+                do_div(tmp, (u32) K);
                 A = (u32) tmp;
                 CONT;
         BPF_ALU_BPF_END_BPF_TO_BE:
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index d0dac57291af..d068ec25db1e 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3340,7 +3340,7 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
 
         __netif_tx_lock_bh(txq);
 
-        if (unlikely(netif_xmit_frozen_or_stopped(txq))) {
+        if (unlikely(netif_xmit_frozen_or_drv_stopped(txq))) {
                 ret = NETDEV_TX_BUSY;
                 pkt_dev->last_ok = 0;
                 goto unlock;
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 59da7cde0724..f95b6f93814b 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1044,8 +1044,10 @@ static int __do_replace(struct net *net, const char *name,
 
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
-                         sizeof(struct xt_counters) * num_counters) != 0)
-                ret = -EFAULT;
+                         sizeof(struct xt_counters) * num_counters) != 0) {
+                /* Silent error, can't fail, new table is already in place */
+                net_warn_ratelimited("arptables: counters copy to user failed while replacing table\n");
+        }
         vfree(counters);
         xt_table_unlock(t);
         return ret;
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 718dfbd30cbe..99e810f84671 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1231,8 +1231,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
-                         sizeof(struct xt_counters) * num_counters) != 0)
-                ret = -EFAULT;
+                         sizeof(struct xt_counters) * num_counters) != 0) {
+                /* Silent error, can't fail, new table is already in place */
+                net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n");
+        }
         vfree(counters);
         xt_table_unlock(t);
         return ret;
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 710238f58aa9..e080fbbbc0e5 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1241,8 +1241,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 
         xt_free_table_info(oldinfo);
         if (copy_to_user(counters_ptr, counters,
-                         sizeof(struct xt_counters) * num_counters) != 0)
-                ret = -EFAULT;
+                         sizeof(struct xt_counters) * num_counters) != 0) {
+                /* Silent error, can't fail, new table is already in place */
+                net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
+        }
         vfree(counters);
         xt_table_unlock(t);
         return ret;
diff --git a/net/mac802154/mib.c b/net/mac802154/mib.c
index 153bd1ddbfbb..f0991f2344d4 100644
--- a/net/mac802154/mib.c
+++ b/net/mac802154/mib.c
@@ -26,7 +26,6 @@
 #include <net/mac802154.h>
 #include <net/ieee802154_netdev.h>
 #include <net/wpan-phy.h>
-#include <net/ieee802154_netdev.h>
 
 #include "mac802154.h"
 
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 33045a562297..3fd159db9f06 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -152,8 +152,8 @@ nf_tables_chain_type_lookup(const struct nft_af_info *afi,
 #ifdef CONFIG_MODULES
         if (autoload) {
                 nfnl_unlock(NFNL_SUBSYS_NFTABLES);
-                request_module("nft-chain-%u-%*.s", afi->family,
-                               nla_len(nla)-1, (const char *)nla_data(nla));
+                request_module("nft-chain-%u-%.*s", afi->family,
+                               nla_len(nla), (const char *)nla_data(nla));
                 nfnl_lock(NFNL_SUBSYS_NFTABLES);
                 type = __nf_tables_chain_type_lookup(afi->family, nla);
                 if (type != NULL)
@@ -1946,7 +1946,8 @@ static const struct nft_set_ops *nft_select_set_ops(const struct nlattr * const
 
 static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
         [NFTA_SET_TABLE]                = { .type = NLA_STRING },
-        [NFTA_SET_NAME]                 = { .type = NLA_STRING },
+        [NFTA_SET_NAME]                 = { .type = NLA_STRING,
+                                            .len = IFNAMSIZ - 1 },
         [NFTA_SET_FLAGS]                = { .type = NLA_U32 },
         [NFTA_SET_KEY_TYPE]             = { .type = NLA_U32 },
         [NFTA_SET_KEY_LEN]              = { .type = NLA_U32 },
diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
index 9a8e77e7f8d4..f4e833005320 100644
--- a/net/netfilter/xt_cgroup.c
+++ b/net/netfilter/xt_cgroup.c
@@ -54,7 +54,8 @@ static struct xt_match cgroup_mt_reg __read_mostly = {
         .matchsize  = sizeof(struct xt_cgroup_info),
         .me         = THIS_MODULE,
         .hooks      = (1 << NF_INET_LOCAL_OUT) |
-                      (1 << NF_INET_POST_ROUTING),
+                      (1 << NF_INET_POST_ROUTING) |
+                      (1 << NF_INET_LOCAL_IN),
 };
 
 static int __init cgroup_mt_init(void)
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 458464e7bd7a..fbc66bb250d5 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -32,8 +32,14 @@
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_zones.h>
 
-#define CONNLIMIT_SLOTS         32
-#define CONNLIMIT_LOCK_SLOTS    32
+#define CONNLIMIT_SLOTS         256U
+
+#ifdef CONFIG_LOCKDEP
+#define CONNLIMIT_LOCK_SLOTS    8U
+#else
+#define CONNLIMIT_LOCK_SLOTS    256U
+#endif
+
 #define CONNLIMIT_GC_MAX_NODES  8
 
 /* we will save the tuples of all connections we care about */
@@ -49,10 +55,11 @@ struct xt_connlimit_rb {
         union nf_inet_addr addr; /* search key */
 };
 
+static spinlock_t xt_connlimit_locks[CONNLIMIT_LOCK_SLOTS] __cacheline_aligned_in_smp;
+
 struct xt_connlimit_data {
         struct rb_root climit_root4[CONNLIMIT_SLOTS];
         struct rb_root climit_root6[CONNLIMIT_SLOTS];
-        spinlock_t              locks[CONNLIMIT_LOCK_SLOTS];
 };
 
 static u_int32_t connlimit_rnd __read_mostly;
@@ -297,11 +304,11 @@ static int count_them(struct net *net,
                 root = &data->climit_root4[hash];
         }
 
-        spin_lock_bh(&data->locks[hash % CONNLIMIT_LOCK_SLOTS]);
+        spin_lock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
 
         count = count_tree(net, root, tuple, addr, mask, family);
 
-        spin_unlock_bh(&data->locks[hash % CONNLIMIT_LOCK_SLOTS]);
+        spin_unlock_bh(&xt_connlimit_locks[hash % CONNLIMIT_LOCK_SLOTS]);
 
         return count;
 }
@@ -377,9 +384,6 @@ static int connlimit_mt_check(const struct xt_mtchk_param *par)
                 return -ENOMEM;
         }
 
-        for (i = 0; i < ARRAY_SIZE(info->data->locks); ++i)
-                spin_lock_init(&info->data->locks[i]);
-
         for (i = 0; i < ARRAY_SIZE(info->data->climit_root4); ++i)
                 info->data->climit_root4[i] = RB_ROOT;
         for (i = 0; i < ARRAY_SIZE(info->data->climit_root6); ++i)
@@ -435,11 +439,14 @@ static struct xt_match connlimit_mt_reg __read_mostly = {
 
 static int __init connlimit_mt_init(void)
 {
-        int ret;
+        int ret, i;
 
         BUILD_BUG_ON(CONNLIMIT_LOCK_SLOTS > CONNLIMIT_SLOTS);
         BUILD_BUG_ON((CONNLIMIT_SLOTS % CONNLIMIT_LOCK_SLOTS) != 0);
 
+        for (i = 0; i < CONNLIMIT_LOCK_SLOTS; ++i)
+                spin_lock_init(&xt_connlimit_locks[i]);
+
         connlimit_conn_cachep = kmem_cache_create("xt_connlimit_conn",
                                            sizeof(struct xt_connlimit_conn),
                                            0, 0, NULL);
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 7174611bd672..c529161cdbf8 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -422,4 +422,6 @@ module_exit(xt_osf_fini);
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Evgeniy Polyakov <zbr@ioremap.net>");
 MODULE_DESCRIPTION("Passive OS fingerprint matching.");
+MODULE_ALIAS("ipt_osf");
+MODULE_ALIAS("ip6t_osf");
 MODULE_ALIAS_NFNL_SUBSYS(NFNL_SUBSYS_OSF);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 01039d2b1695..72e0c71fb01d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -261,7 +261,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
         local_bh_disable();
 
         HARD_TX_LOCK(dev, txq, smp_processor_id());
-        if (!netif_xmit_frozen_or_stopped(txq)) {
+        if (!netif_xmit_frozen_or_drv_stopped(txq)) {
                 ret = ops->ndo_start_xmit(skb, dev);
                 if (ret == NETDEV_TX_OK)
                         txq_trans_update(txq);
@@ -275,6 +275,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
 
         return ret;
 drop:
+        atomic_long_inc(&dev->tx_dropped);
         kfree_skb(skb);
         return NET_XMIT_DROP;
 }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 981aaf8b6ace..5f83a6a2fa67 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6593,6 +6593,40 @@ static void __sctp_write_space(struct sctp_association *asoc)
         }
 }
 
+static void sctp_wake_up_waiters(struct sock *sk,
+                                 struct sctp_association *asoc)
+{
+        struct sctp_association *tmp = asoc;
+
+        /* We do accounting for the sndbuf space per association,
+         * so we only need to wake our own association.
+         */
+        if (asoc->ep->sndbuf_policy)
+                return __sctp_write_space(asoc);
+
+        /* Accounting for the sndbuf space is per socket, so we
+         * need to wake up others, try to be fair and in case of
+         * other associations, let them have a go first instead
+         * of just doing a sctp_write_space() call.
+         *
+         * Note that we reach sctp_wake_up_waiters() only when
+         * associations free up queued chunks, thus we are under
+         * lock and the list of associations on a socket is
+         * guaranteed not to change.
+         */
+        for (tmp = list_next_entry(tmp, asocs); 1;
+             tmp = list_next_entry(tmp, asocs)) {
+                /* Manually skip the head element. */
+                if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
+                        continue;
+                /* Wake up association. */
+                __sctp_write_space(tmp);
+                /* We've reached the end. */
+                if (tmp == asoc)
+                        break;
+        }
+}
+
 /* Do accounting for the sndbuf space.
  * Decrement the used sndbuf space of the corresponding association by the
  * data size which was just transmitted(freed).
@@ -6620,7 +6654,7 @@ static void sctp_wfree(struct sk_buff *skb)
         sk_mem_uncharge(sk, skb->truesize);
 
         sock_wfree(skb);
-        __sctp_write_space(asoc);
+        sctp_wake_up_waiters(sk, asoc);
 
         sctp_association_put(asoc);
 }
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 0374a817631e..4c564eb69e1a 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -182,6 +182,8 @@ void tipc_net_start(u32 addr)
         tipc_bclink_init();
         write_unlock_bh(&tipc_net_lock);
 
+        tipc_nametbl_publish(TIPC_CFG_SRV, tipc_own_addr, tipc_own_addr,
+                             TIPC_ZONE_SCOPE, 0, tipc_own_addr);
         pr_info("Started in network mode\n");
         pr_info("Own node address %s, network identity %u\n",
                 tipc_addr_string_fill(addr_string, tipc_own_addr), tipc_net_id);
@@ -192,6 +194,7 @@ void tipc_net_stop(void)
         if (!tipc_own_addr)
                 return;
 
+        tipc_nametbl_withdraw(TIPC_CFG_SRV, tipc_own_addr, 0, tipc_own_addr);
         write_lock_bh(&tipc_net_lock);
         tipc_bearer_stop();
         tipc_bclink_stop();
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 29b7f26a12cf..adc12e227303 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -301,7 +301,6 @@ static int tipc_release(struct socket *sock)
         struct tipc_sock *tsk;
         struct tipc_port *port;
         struct sk_buff *buf;
-        int res;
 
         /*
          * Exit if socket isn't fully initialized (occurs when a failed accept()
@@ -349,7 +348,7 @@ static int tipc_release(struct socket *sock)
         sock_put(sk);
         sock->sk = NULL;
 
-        return res;
+        return 0;
 }
 
 /**