15 files changed, 84 insertions, 44 deletions

diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 2ff9706647f2..e5ec470b851f 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -280,6 +280,7 @@ static const struct nla_policy br_port_policy[IFLA_BRPORT_MAX + 1] = {
         [IFLA_BRPORT_MODE]      = { .type = NLA_U8 },
         [IFLA_BRPORT_GUARD]     = { .type = NLA_U8 },
         [IFLA_BRPORT_PROTECT]   = { .type = NLA_U8 },
+        [IFLA_BRPORT_FAST_LEAVE]= { .type = NLA_U8 },
         [IFLA_BRPORT_LEARNING]  = { .type = NLA_U8 },
         [IFLA_BRPORT_UNICAST_FLOOD] = { .type = NLA_U8 },
 };
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a6882686ca3a..76321ea442c3 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1498,6 +1498,7 @@ static int do_setlink(const struct sk_buff *skb,
                         goto errout;
                 }
                 if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+                        put_net(net);
                         err = -EPERM;
                         goto errout;
                 }
@@ -2685,13 +2686,20 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
         int idx = 0;
         u32 portid = NETLINK_CB(cb->skb).portid;
         u32 seq = cb->nlh->nlmsg_seq;
-        struct nlattr *extfilt;
         u32 filter_mask = 0;
 
-        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
-                                  IFLA_EXT_MASK);
-        if (extfilt)
-                filter_mask = nla_get_u32(extfilt);
+        if (nlmsg_len(cb->nlh) > sizeof(struct ifinfomsg)) {
+                struct nlattr *extfilt;
+
+                extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
+                                          IFLA_EXT_MASK);
+                if (extfilt) {
+                        if (nla_len(extfilt) < sizeof(filter_mask))
+                                return -EINVAL;
+
+                        filter_mask = nla_get_u32(extfilt);
+                }
+        }
 
         rcu_read_lock();
         for_each_netdev_rcu(net, dev) {
@@ -2798,6 +2806,9 @@ static int rtnl_bridge_setlink(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (br_spec) {
                 nla_for_each_nested(attr, br_spec, rem) {
                         if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
+                                if (nla_len(attr) < sizeof(flags))
+                                        return -EINVAL;
+
                                 have_flags = true;
                                 flags = nla_get_u16(attr);
                                 break;
@@ -2868,6 +2879,9 @@ static int rtnl_bridge_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (br_spec) {
                 nla_for_each_nested(attr, br_spec, rem) {
                         if (nla_type(attr) == IFLA_BRIDGE_FLAGS) {
+                                if (nla_len(attr) < sizeof(flags))
+                                        return -EINVAL;
+
                                 have_flags = true;
                                 flags = nla_get_u16(attr);
                                 break;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 8b7fe5b03906..e67da4e6c324 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1386,6 +1386,17 @@ out:
         return pp;
 }
 
+int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
+{
+        if (sk->sk_family == AF_INET)
+                return ip_recv_error(sk, msg, len, addr_len);
+#if IS_ENABLED(CONFIG_IPV6)
+        if (sk->sk_family == AF_INET6)
+                return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len);
+#endif
+        return -EINVAL;
+}
+
 static int inet_gro_complete(struct sk_buff *skb, int nhoff)
 {
         __be16 newlen = htons(skb->len - nhoff);
diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
index 3e861011e4a3..1a7e979e80ba 100644
--- a/net/ipv4/ip_vti.c
+++ b/net/ipv4/ip_vti.c
@@ -528,6 +528,7 @@ static struct rtnl_link_ops vti_link_ops __read_mostly = {
         .validate       = vti_tunnel_validate,
         .newlink        = vti_newlink,
         .changelink     = vti_changelink,
+        .dellink        = ip_tunnel_dellink,
         .get_size       = vti_get_size,
         .fill_info      = vti_fill_info,
 };
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 57f7c9804139..5d740cccf69e 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -217,6 +217,8 @@ static struct sock *ping_lookup(struct net *net, struct sk_buff *skb, u16 ident)
                                              &ipv6_hdr(skb)->daddr))
                                 continue;
 #endif
+                } else {
+                        continue;
                 }
 
                 if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
@@ -853,16 +855,8 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         if (flags & MSG_OOB)
                 goto out;
 
-        if (flags & MSG_ERRQUEUE) {
-                if (family == AF_INET) {
-                        return ip_recv_error(sk, msg, len, addr_len);
-#if IS_ENABLED(CONFIG_IPV6)
-                } else if (family == AF_INET6) {
-                        return pingv6_ops.ipv6_recv_error(sk, msg, len,
-                                                          addr_len);
-#endif
-                }
-        }
+        if (flags & MSG_ERRQUEUE)
+                return inet_recv_error(sk, msg, len, addr_len);
 
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 39ec0c379545..38c2bcb8dd5d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1598,7 +1598,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
         u32 urg_hole = 0;
 
         if (unlikely(flags & MSG_ERRQUEUE))
-                return ip_recv_error(sk, msg, len, addr_len);
+                return inet_recv_error(sk, msg, len, addr_len);
 
         if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
             (sk->sk_state == TCP_ESTABLISHED))
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 9c7d7621466b..147be2024290 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -598,7 +598,10 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
         if (th->rst)
                 return;
 
-        if (skb_rtable(skb)->rt_type != RTN_LOCAL)
+        /* If sk not NULL, it means we did a successful lookup and incoming
+         * route had to be correct. prequeue might have dropped our dst.
+         */
+        if (!sk && skb_rtable(skb)->rt_type != RTN_LOCAL)
                 return;
 
         /* Swap the send and the receive. */
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 4564e1fca3eb..0e32d2e1bdbf 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -502,11 +502,11 @@ static int ip6gre_rcv(struct sk_buff *skb)
 
                 skb->protocol = gre_proto;
                 /* WCCP version 1 and 2 protocol decoding.
-                 * - Change protocol to IP
+                 * - Change protocol to IPv6
                  * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
                  */
                 if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
-                        skb->protocol = htons(ETH_P_IP);
+                        skb->protocol = htons(ETH_P_IPV6);
                         if ((*(h + offset) & 0xF0) != 0x40)
                                 offset += 4;
                 }
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index a071563a7e6e..01e12d0d8fcc 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -69,7 +69,8 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
         int nhoff;
 
         if (unlikely(skb_shinfo(skb)->gso_type &
-                     ~(SKB_GSO_UDP |
+                     ~(SKB_GSO_TCPV4 |
+                       SKB_GSO_UDP |
                        SKB_GSO_DODGY |
                        SKB_GSO_TCP_ECN |
                        SKB_GSO_GRE |
diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index b04ed72c4542..8db6c98fe218 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -79,15 +79,13 @@ int udp_tunnel6_xmit_skb(struct socket *sock, struct dst_entry *dst,
         uh->source = src_port;
 
         uh->len = htons(skb->len);
-        uh->check = 0;
 
         memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
         IPCB(skb)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED
                             | IPSKB_REROUTED);
         skb_dst_set(skb, dst);
 
-        udp6_set_csum(udp_get_no_check6_tx(sk), skb, &inet6_sk(sk)->saddr,
-                      &sk->sk_v6_daddr, skb->len);
+        udp6_set_csum(udp_get_no_check6_tx(sk), skb, saddr, daddr, skb->len);
 
         __skb_push(skb, sizeof(*ip6h));
         skb_reset_network_header(skb);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 31089d153fd3..bcda14de7f84 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -905,6 +905,15 @@ static int vti6_newlink(struct net *src_net, struct net_device *dev,
         return vti6_tnl_create2(dev);
 }
 
+static void vti6_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct vti6_net *ip6n = net_generic(net, vti6_net_id);
+
+        if (dev != ip6n->fb_tnl_dev)
+                unregister_netdevice_queue(dev, head);
+}
+
 static int vti6_changelink(struct net_device *dev, struct nlattr *tb[],
                            struct nlattr *data[])
 {
@@ -980,6 +989,7 @@ static struct rtnl_link_ops vti6_link_ops __read_mostly = {
         .setup          = vti6_dev_setup,
         .validate       = vti6_validate,
         .newlink        = vti6_newlink,
+        .dellink        = vti6_dellink,
         .changelink     = vti6_changelink,
         .get_size       = vti6_get_size,
         .fill_info      = vti6_fill_info,
@@ -1020,6 +1030,7 @@ static int __net_init vti6_init_net(struct net *net)
         if (!ip6n->fb_tnl_dev)
                 goto err_alloc_dev;
         dev_net_set(ip6n->fb_tnl_dev, net);
+        ip6n->fb_tnl_dev->rtnl_link_ops = &vti6_link_ops;
 
         err = vti6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
         if (err < 0)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ace29b60813c..dc495ae2ead0 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -903,7 +903,10 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
         if (th->rst)
                 return;
 
-        if (!ipv6_unicast_destination(skb))
+        /* If sk not NULL, it means we did a successful lookup and incoming
+         * route had to be correct. prequeue might have dropped our dst.
+         */
+        if (!sk && !ipv6_unicast_destination(skb))
                 return;
 
 #ifdef CONFIG_TCP_MD5SIG
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 2c699757bccf..5016a6929085 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -611,16 +611,12 @@ __nf_conntrack_confirm(struct sk_buff *skb)
          */
         NF_CT_ASSERT(!nf_ct_is_confirmed(ct));
         pr_debug("Confirming conntrack %p\n", ct);
-
-        /* We have to check the DYING flag after unlink to prevent
-         * a race against nf_ct_get_next_corpse() possibly called from
-         * user context, else we insert an already 'dead' hash, blocking
-         * further use of that particular connection -JM.
-         */
-        nf_ct_del_from_dying_or_unconfirmed_list(ct);
+        /* We have to check the DYING flag inside the lock to prevent
+           a race against nf_ct_get_next_corpse() possibly called from
+           user context, else we insert an already 'dead' hash, blocking
+           further use of that particular connection -JM */
 
         if (unlikely(nf_ct_is_dying(ct))) {
-                nf_ct_add_to_dying_list(ct);
                 nf_conntrack_double_unlock(hash, reply_hash);
                 local_bh_enable();
                 return NF_ACCEPT;
@@ -640,6 +636,8 @@ __nf_conntrack_confirm(struct sk_buff *skb)
                     zone == nf_ct_zone(nf_ct_tuplehash_to_ctrack(h)))
                         goto out;
 
+        nf_ct_del_from_dying_or_unconfirmed_list(ct);
+
         /* Timer relative to confirmation time, not original
            setting time, otherwise we'd get timer wrap in
            weird delay cases. */
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 87d20f48ff06..07c04a841ba0 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -378,7 +378,7 @@ static void unregister_prot_hook(struct sock *sk, bool sync)
                 __unregister_prot_hook(sk, sync);
 }
 
-static inline __pure struct page *pgv_to_page(void *addr)
+static inline struct page * __pure pgv_to_page(void *addr)
 {
         if (is_vmalloc_addr(addr))
                 return vmalloc_to_page(addr);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 3f959c681885..f9c052d508f0 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1019,17 +1019,12 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
         xid = *p++;
         calldir = *p;
 
-        if (bc_xprt)
-                req = xprt_lookup_rqst(bc_xprt, xid);
-
-        if (!req) {
-                printk(KERN_NOTICE
-                        "%s: Got unrecognized reply: "
-                        "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
-                        __func__, ntohl(calldir),
-                        bc_xprt, ntohl(xid));
+        if (!bc_xprt)
                 return -EAGAIN;
-        }
+        spin_lock_bh(&bc_xprt->transport_lock);
+        req = xprt_lookup_rqst(bc_xprt, xid);
+        if (!req)
+                goto unlock_notfound;
 
         memcpy(&req->rq_private_buf, &req->rq_rcv_buf, sizeof(struct xdr_buf));
         /*
@@ -1040,11 +1035,21 @@ static int receive_cb_reply(struct svc_sock *svsk, struct svc_rqst *rqstp)
         dst = &req->rq_private_buf.head[0];
         src = &rqstp->rq_arg.head[0];
         if (dst->iov_len < src->iov_len)
-                return -EAGAIN; /* whatever; just giving up. */
+                goto unlock_eagain; /* whatever; just giving up. */
         memcpy(dst->iov_base, src->iov_base, src->iov_len);
         xprt_complete_rqst(req->rq_task, rqstp->rq_arg.len);
         rqstp->rq_arg.len = 0;
+        spin_unlock_bh(&bc_xprt->transport_lock);
         return 0;
+unlock_notfound:
+        printk(KERN_NOTICE
+                "%s: Got unrecognized reply: "
+                "calldir 0x%x xpt_bc_xprt %p xid %08x\n",
+                __func__, ntohl(calldir),
+                bc_xprt, ntohl(xid));
+unlock_eagain:
+        spin_unlock_bh(&bc_xprt->transport_lock);
+        return -EAGAIN;
 }
 
 static int copy_pages_to_kvecs(struct kvec *vec, struct page **pages, int len)