13 files changed, 61 insertions, 42 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 962ee9d71964..45109b70664e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2848,7 +2848,9 @@ static void skb_update_prio(struct sk_buff *skb)
 #define skb_update_prio(skb)
 #endif
 
-static DEFINE_PER_CPU(int, xmit_recursion);
+DEFINE_PER_CPU(int, xmit_recursion);
+EXPORT_SYMBOL(xmit_recursion);
+
 #define RECURSION_LIMIT 10
 
 /**
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 44706e81b2e0..e4fdc9dfb2c7 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -175,9 +175,9 @@ void fib_rules_unregister(struct fib_rules_ops *ops)
 
         spin_lock(&net->rules_mod_lock);
         list_del_rcu(&ops->list);
-        fib_rules_cleanup_ops(ops);
         spin_unlock(&net->rules_mod_lock);
 
+        fib_rules_cleanup_ops(ops);
         call_rcu(&ops->rcu, fib_rules_put_rcu);
 }
 EXPORT_SYMBOL_GPL(fib_rules_unregister);
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 5221f975a4cc..70d3450588b2 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -198,8 +198,10 @@ static int __peernet2id(struct net *net, struct net *peer, bool alloc)
  */
 int peernet2id(struct net *net, struct net *peer)
 {
-        int id = __peernet2id(net, peer, true);
+        bool alloc = atomic_read(&peer->count) == 0 ? false : true;
+        int id;
 
+        id = __peernet2id(net, peer, alloc);
         return id >= 0 ? id : NETNSA_NSID_NOT_ASSIGNED;
 }
 EXPORT_SYMBOL(peernet2id);
@@ -349,7 +351,7 @@ static LIST_HEAD(cleanup_list);  /* Must hold cleanup_list_lock to touch */
 static void cleanup_net(struct work_struct *work)
 {
         const struct pernet_operations *ops;
-        struct net *net, *tmp, *peer;
+        struct net *net, *tmp;
         struct list_head net_kill_list;
         LIST_HEAD(net_exit_list);
 
@@ -365,6 +367,14 @@ static void cleanup_net(struct work_struct *work)
         list_for_each_entry(net, &net_kill_list, cleanup_list) {
                 list_del_rcu(&net->list);
                 list_add_tail(&net->exit_list, &net_exit_list);
+                for_each_net(tmp) {
+                        int id = __peernet2id(tmp, net, false);
+
+                        if (id >= 0)
+                                idr_remove(&tmp->netns_ids, id);
+                }
+                idr_destroy(&net->netns_ids);
+
         }
         rtnl_unlock();
 
@@ -390,26 +400,12 @@ static void cleanup_net(struct work_struct *work)
          */
         rcu_barrier();
 
-        rtnl_lock();
         /* Finally it is safe to free my network namespace structure */
         list_for_each_entry_safe(net, tmp, &net_exit_list, exit_list) {
-                /* Unreference net from all peers (no need to loop over
-                 * net_exit_list because idr_destroy() will be called for each
-                 * element of this list.
-                 */
-                for_each_net(peer) {
-                        int id = __peernet2id(peer, net, false);
-
-                        if (id >= 0)
-                                idr_remove(&peer->netns_ids, id);
-                }
-                idr_destroy(&net->netns_ids);
-
                 list_del_init(&net->exit_list);
                 put_user_ns(net->user_ns);
                 net_drop_ns(net);
         }
-        rtnl_unlock();
 }
 static DECLARE_WORK(net_cleanup_work, cleanup_net);
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 78e89eb7eb70..71e3e5f1eaa0 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -653,6 +653,25 @@ static inline void sock_valbool_flag(struct sock *sk, int bit, int valbool)
                 sock_reset_flag(sk, bit);
 }
 
+bool sk_mc_loop(struct sock *sk)
+{
+        if (dev_recursion_level())
+                return false;
+        if (!sk)
+                return true;
+        switch (sk->sk_family) {
+        case AF_INET:
+                return inet_sk(sk)->mc_loop;
+#if IS_ENABLED(CONFIG_IPV6)
+        case AF_INET6:
+                return inet6_sk(sk)->mc_loop;
+#endif
+        }
+        WARN_ON(1);
+        return true;
+}
+EXPORT_SYMBOL(sk_mc_loop);
+
 /*
  *      This is meant for all protocols to use and covers goings on
  *      at the socket level. Everything here is generic.
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index faf7cc3483fe..9d66a0f72f90 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -248,7 +248,9 @@ void __init dn_fib_rules_init(void)
 
 void __exit dn_fib_rules_cleanup(void)
 {
+        rtnl_lock();
         fib_rules_unregister(dn_fib_rules_ops);
+        rtnl_unlock();
         rcu_barrier();
 }
 
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 2173402d87e0..4dea2e0681d1 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -501,12 +501,10 @@ static struct net_device *dev_to_net_device(struct device *dev)
 #ifdef CONFIG_OF
 static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
                                         struct dsa_chip_data *cd,
-                                        int chip_index,
+                                        int chip_index, int port_index,
                                         struct device_node *link)
 {
-        int ret;
         const __be32 *reg;
-        int link_port_addr;
         int link_sw_addr;
         struct device_node *parent_sw;
         int len;
@@ -519,6 +517,10 @@ static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
         if (!reg || (len != sizeof(*reg) * 2))
                 return -EINVAL;
 
+        /*
+         * Get the destination switch number from the second field of its 'reg'
+         * property, i.e. for "reg = <0x19 1>" sw_addr is '1'.
+         */
         link_sw_addr = be32_to_cpup(reg + 1);
 
         if (link_sw_addr >= pd->nr_chips)
@@ -535,20 +537,9 @@ static int dsa_of_setup_routing_table(struct dsa_platform_data *pd,
                 memset(cd->rtable, -1, pd->nr_chips * sizeof(s8));
         }
 
-        reg = of_get_property(link, "reg", NULL);
-        if (!reg) {
-                ret = -EINVAL;
-                goto out;
-        }
-
-        link_port_addr = be32_to_cpup(reg);
-
-        cd->rtable[link_sw_addr] = link_port_addr;
+        cd->rtable[link_sw_addr] = port_index;
 
         return 0;
-out:
-        kfree(cd->rtable);
-        return ret;
 }
 
 static void dsa_of_free_platform_data(struct dsa_platform_data *pd)
@@ -658,7 +649,7 @@ static int dsa_of_probe(struct platform_device *pdev)
                         if (!strcmp(port_name, "dsa") && link &&
                                         pd->nr_chips > 1) {
                                 ret = dsa_of_setup_routing_table(pd, cd,
-                                                chip_index, link);
+                                                chip_index, port_index, link);
                                 if (ret)
                                         goto out_free_chip;
                         }
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 57be71dd6a9e..23b9b3e86f4c 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1111,11 +1111,10 @@ static void ip_fib_net_exit(struct net *net)
 {
         unsigned int i;
 
+        rtnl_lock();
 #ifdef CONFIG_IP_MULTIPLE_TABLES
         fib4_rules_exit(net);
 #endif
-
-        rtnl_lock();
         for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
                 struct fib_table *tb;
                 struct hlist_head *head;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 92825443fad6..fe54eba6d00d 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -278,11 +278,13 @@ static void __net_exit ipmr_rules_exit(struct net *net)
 {
         struct mr_table *mrt, *next;
 
+        rtnl_lock();
         list_for_each_entry_safe(mrt, next, &net->ipv4.mr_tables, list) {
                 list_del(&mrt->list);
                 ipmr_free_table(mrt);
         }
         fib_rules_unregister(net->ipv4.mr_rules_ops);
+        rtnl_unlock();
 }
 #else
 #define ipmr_for_each_table(mrt, net) \
@@ -308,7 +310,10 @@ static int __net_init ipmr_rules_init(struct net *net)
 
 static void __net_exit ipmr_rules_exit(struct net *net)
 {
+        rtnl_lock();
         ipmr_free_table(net->ipv4.mrt);
+        net->ipv4.mrt = NULL;
+        rtnl_unlock();
 }
 #endif
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index fb4cf8b8e121..f501ac048366 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3105,10 +3105,11 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets,
                         if (!first_ackt.v64)
                                 first_ackt = last_ackt;
 
-                        if (!(sacked & TCPCB_SACKED_ACKED))
+                        if (!(sacked & TCPCB_SACKED_ACKED)) {
                                 reord = min(pkts_acked, reord);
-                        if (!after(scb->end_seq, tp->high_seq))
-                                flag |= FLAG_ORIG_SACK_ACKED;
+                                if (!after(scb->end_seq, tp->high_seq))
+                                        flag |= FLAG_ORIG_SACK_ACKED;
+                        }
                 }
 
                 if (sacked & TCPCB_SACKED_ACKED)
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 27ca79682efb..70bc6abc0639 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -322,7 +322,9 @@ out_fib6_rules_ops:
 
 static void __net_exit fib6_rules_net_exit(struct net *net)
 {
+        rtnl_lock();
         fib_rules_unregister(net->ipv6.fib6_rules_ops);
+        rtnl_unlock();
 }
 
 static struct pernet_operations fib6_rules_net_ops = {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7e80b61b51ff..36cf0ab685a0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -542,7 +542,8 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct sk_buff *frag;
         struct rt6_info *rt = (struct rt6_info *)skb_dst(skb);
-        struct ipv6_pinfo *np = skb->sk ? inet6_sk(skb->sk) : NULL;
+        struct ipv6_pinfo *np = skb->sk && !dev_recursion_level() ?
+                                inet6_sk(skb->sk) : NULL;
         struct ipv6hdr *tmp_hdr;
         struct frag_hdr *fh;
         unsigned int mtu, hlen, left, len;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 52028f449a89..312e0ff47339 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -267,8 +267,8 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
                 list_del(&mrt->list);
                 ip6mr_free_table(mrt);
         }
-        rtnl_unlock();
         fib_rules_unregister(net->ipv6.mr6_rules_ops);
+        rtnl_unlock();
 }
 #else
 #define ip6mr_for_each_table(mrt, net) \
@@ -336,7 +336,7 @@ static struct mr6_table *ip6mr_new_table(struct net *net, u32 id)
 
 static void ip6mr_free_table(struct mr6_table *mrt)
 {
-        del_timer(&mrt->ipmr_expire_timer);
+        del_timer_sync(&mrt->ipmr_expire_timer);
         mroute_clean_tables(mrt);
         kfree(mrt);
 }
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 895348e44c7d..a29a504492af 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1871,6 +1871,7 @@ static int __init l2tp_init(void)
         l2tp_wq = alloc_workqueue("l2tp", WQ_UNBOUND, 0);
         if (!l2tp_wq) {
                 pr_err("alloc_workqueue failed\n");
+                unregister_pernet_device(&l2tp_net_ops);
                 rc = -ENOMEM;
                 goto out;
         }