Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Infinite loop in _decode_session6(), from Eric Dumazet.

 2) Pass correct argument to nla_strlcpy() in netfilter, also from Eric
    Dumazet.

 3) Out of bounds memory access in ipv6 srh code, from Mathieu Xhonneux.

 4) NULL deref in XDP_REDIRECT handling of tun driver, from Toshiaki
    Makita.

 5) Incorrect idr release in cls_flower, from Paul Blakey.

 6) Probe error handling fix in davinci_emac, from Dan Carpenter.

 7) Memory leak in XPS configuration, from Alexander Duyck.

 8) Use after free with cloned sockets in kcm, from Kirill Tkhai.

 9) MTU handling fixes fo ip_tunnel and ip6_tunnel, from Nicolas
    Dichtel.

10) Fix UAPI hole in bpf data structure for 32-bit compat applications,
    from Daniel Borkmann.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (33 commits)
  bpf: fix uapi hole for 32 bit compat applications
  net: usb: cdc_mbim: add flag FLAG_SEND_ZLP
  ip6_tunnel: remove magic mtu value 0xFFF8
  ip_tunnel: restore binding to ifaces with a large mtu
  net: dsa: b53: Add BCM5389 support
  kcm: Fix use-after-free caused by clonned sockets
  net-sysfs: Fix memory leak in XPS configuration
  ixgbe: fix parsing of TC actions for HW offload
  net: ethernet: davinci_emac: fix error handling in probe()
  net/ncsi: Fix array size in dumpit handler
  cls_flower: Fix incorrect idr release when failing to modify rule
  net/sonic: Use dma_mapping_error()
  xfrm Fix potential error pointer dereference in xfrm_bundle_create.
  vhost_net: flush batched heads before trying to busy polling
  tun: Fix NULL pointer dereference in XDP redirect
  be2net: Fix error detection logic for BE3
  net: qmi_wwan: Add Netgear Aircard 779S
  mlxsw: spectrum: Forbid creation of VLAN 1 over port/LAG
  atm: zatm: fix memcmp casting
  iwlwifi: pcie: compare with number of IRQs requested for, not number of CPUs
  ...

diff --git a/Documentation/devicetree/bindings/net/dsa/b53.txt b/Documentation/devicetree/bindings/net/dsa/b53.txt
index 8acf51a4dfa8a51800e974d9cfe8d729bee3ee84..47a6a7fe0b86432e1ba6fe27fea3dda1f9cf7352 100644 (file)
--- a/Documentation/devicetree/bindings/net/dsa/b53.txt
+++ b/Documentation/devicetree/bindings/net/dsa/b53.txt
@@ -10,6 +10,7 @@ Required properties:
       "brcm,bcm53128"
       "brcm,bcm5365"
       "brcm,bcm5395"
+      "brcm,bcm5389"
       "brcm,bcm5397"
       "brcm,bcm5398"
 

diff --git a/drivers/atm/zatm.c b/drivers/atm/zatm.c
index 9c9a229587176d560419c0c9c4df9562c1279a75..a8d2eb0ceb8d8f78788182f81f8e1e9f9dc8fbbb 100644 (file)
--- a/drivers/atm/zatm.c
+++ b/drivers/atm/zatm.c
@@ -1151,8 +1151,8 @@ static void eprom_get_byte(struct zatm_dev *zatm_dev, unsigned char *byte,
 }
 
 
-static unsigned char eprom_try_esi(struct atm_dev *dev, unsigned short cmd,
-                                  int offset, int swap)
+static int eprom_try_esi(struct atm_dev *dev, unsigned short cmd, int offset,
+                        int swap)
 {
        unsigned char buf[ZEPROM_SIZE];
        struct zatm_dev *zatm_dev;

diff --git a/drivers/net/dsa/b53/b53_common.c b/drivers/net/dsa/b53/b53_common.c
index 78616787f2a396102a4b9c5910fcd3abb87bcfb5..3da5fca77cbdd70e3e4991f230ac6ec74de4f5a9 100644 (file)
--- a/drivers/net/dsa/b53/b53_common.c
+++ b/drivers/net/dsa/b53/b53_common.c
@@ -1711,6 +1711,18 @@ static const struct b53_chip_data b53_switch_chips[] = {
                .cpu_port = B53_CPU_PORT_25,
                .duplex_reg = B53_DUPLEX_STAT_FE,
        },
+       {
+               .chip_id = BCM5389_DEVICE_ID,
+               .dev_name = "BCM5389",
+               .vlans = 4096,
+               .enabled_ports = 0x1f,
+               .arl_entries = 4,
+               .cpu_port = B53_CPU_PORT,
+               .vta_regs = B53_VTA_REGS,
+               .duplex_reg = B53_DUPLEX_STAT_GE,
+               .jumbo_pm_reg = B53_JUMBO_PORT_MASK,
+               .jumbo_size_reg = B53_JUMBO_MAX_SIZE,
+       },
        {
                .chip_id = BCM5395_DEVICE_ID,
                .dev_name = "BCM5395",
@@ -2034,6 +2046,7 @@ int b53_switch_detect(struct b53_device *dev)
                else
                        dev->chip_id = BCM5365_DEVICE_ID;
                break;
+       case BCM5389_DEVICE_ID:
        case BCM5395_DEVICE_ID:
        case BCM5397_DEVICE_ID:
        case BCM5398_DEVICE_ID:

diff --git a/drivers/net/dsa/b53/b53_mdio.c b/drivers/net/dsa/b53/b53_mdio.c
index fa7556f5d4fb1b98a1da56c18bccad65f020171f..a533a90e39048dbac2b4cbb56af4e25ddfc36b31 100644 (file)
--- a/drivers/net/dsa/b53/b53_mdio.c
+++ b/drivers/net/dsa/b53/b53_mdio.c
@@ -285,6 +285,7 @@ static const struct b53_io_ops b53_mdio_ops = {
 #define B53_BRCM_OUI_1 0x0143bc00
 #define B53_BRCM_OUI_2 0x03625c00
 #define B53_BRCM_OUI_3 0x00406000
+#define B53_BRCM_OUI_4 0x01410c00
 
 static int b53_mdio_probe(struct mdio_device *mdiodev)
 {
@@ -311,7 +312,8 @@ static int b53_mdio_probe(struct mdio_device *mdiodev)
         */
        if ((phy_id & 0xfffffc00) != B53_BRCM_OUI_1 &&
            (phy_id & 0xfffffc00) != B53_BRCM_OUI_2 &&
-           (phy_id & 0xfffffc00) != B53_BRCM_OUI_3) {
+           (phy_id & 0xfffffc00) != B53_BRCM_OUI_3 &&
+           (phy_id & 0xfffffc00) != B53_BRCM_OUI_4) {
                dev_err(&mdiodev->dev, "Unsupported device: 0x%08x\n", phy_id);
                return -ENODEV;
        }
@@ -360,6 +362,7 @@ static const struct of_device_id b53_of_match[] = {
        { .compatible = "brcm,bcm53125" },
        { .compatible = "brcm,bcm53128" },
        { .compatible = "brcm,bcm5365" },
+       { .compatible = "brcm,bcm5389" },
        { .compatible = "brcm,bcm5395" },
        { .compatible = "brcm,bcm5397" },
        { .compatible = "brcm,bcm5398" },

diff --git a/drivers/net/dsa/b53/b53_priv.h b/drivers/net/dsa/b53/b53_priv.h
index 1187ebd79287bec832f78a04e47805e45fc22aeb..3b57f47d0e79aae23f3c473709545dc86ebec431 100644 (file)
--- a/drivers/net/dsa/b53/b53_priv.h
+++ b/drivers/net/dsa/b53/b53_priv.h
@@ -48,6 +48,7 @@ struct b53_io_ops {
 enum {
        BCM5325_DEVICE_ID = 0x25,
        BCM5365_DEVICE_ID = 0x65,
+       BCM5389_DEVICE_ID = 0x89,
        BCM5395_DEVICE_ID = 0x95,
        BCM5397_DEVICE_ID = 0x97,
        BCM5398_DEVICE_ID = 0x98,

diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c
index c697e79e491e321fb9011888de200fabcdae714d..8f755009ff3820e34fa1501970054513cf5198ce 100644 (file)
--- a/drivers/net/ethernet/emulex/benet/be_main.c
+++ b/drivers/net/ethernet/emulex/benet/be_main.c
@@ -3309,7 +3309,9 @@ void be_detect_error(struct be_adapter *adapter)
                                if ((val & POST_STAGE_FAT_LOG_START)
                                     != POST_STAGE_FAT_LOG_START &&
                                    (val & POST_STAGE_ARMFW_UE)
-                                    != POST_STAGE_ARMFW_UE)
+                                    != POST_STAGE_ARMFW_UE &&
+                                   (val & POST_STAGE_RECOVERABLE_ERR)
+                                    != POST_STAGE_RECOVERABLE_ERR)
                                        return;
                        }
 

diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index afadba99f7b8286e287a2a88703026319f78924b..2ecd55856c502cf39f4f28e4eb74096c5adb51cc 100644 (file)
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -9054,7 +9054,6 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
 {
        const struct tc_action *a;
        LIST_HEAD(actions);
-       int err;
 
        if (!tcf_exts_has_actions(exts))
                return -EINVAL;
@@ -9075,11 +9074,11 @@ static int parse_tc_actions(struct ixgbe_adapter *adapter,
 
                        if (!dev)
                                return -EINVAL;
-                       err = handle_redirect_action(adapter, dev->ifindex, queue,
-                                                    action);
-                       if (err == 0)
-                               return err;
+                       return handle_redirect_action(adapter, dev->ifindex,
+                                                     queue, action);
                }
+
+               return -EINVAL;
        }
 
        return -EINVAL;

diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
index ca38a30fbe913c6126f1dab6afad79fae193887b..adc6ab2cf42922abe0e93a6e89da7492700cb5fa 100644 (file)
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.c
@@ -4433,6 +4433,11 @@ static int mlxsw_sp_netdevice_port_upper_event(struct net_device *lower_dev,
                        NL_SET_ERR_MSG_MOD(extack, "Can not put a VLAN on an OVS port");
                        return -EINVAL;
                }
+               if (is_vlan_dev(upper_dev) &&
+                   vlan_dev_vlan_id(upper_dev) == 1) {
+                       NL_SET_ERR_MSG_MOD(extack, "Creating a VLAN device with VID 1 is unsupported: VLAN 1 carries untagged traffic");
+                       return -EINVAL;
+               }
                break;
        case NETDEV_CHANGEUPPER:
                upper_dev = info->upper_dev;

diff --git a/drivers/net/ethernet/natsemi/sonic.c b/drivers/net/ethernet/natsemi/sonic.c
index 7ed08486ae23aadf1ce6710d343a892a41d1fa30..c805dcbebd0278752b2ed8b34b7531ec19ea2357 100644 (file)
--- a/drivers/net/ethernet/natsemi/sonic.c
+++ b/drivers/net/ethernet/natsemi/sonic.c
@@ -84,7 +84,7 @@ static int sonic_open(struct net_device *dev)
        for (i = 0; i < SONIC_NUM_RRS; i++) {
                dma_addr_t laddr = dma_map_single(lp->device, skb_put(lp->rx_skb[i], SONIC_RBSIZE),
                                                  SONIC_RBSIZE, DMA_FROM_DEVICE);
-               if (!laddr) {
+               if (dma_mapping_error(lp->device, laddr)) {
                        while(i > 0) { /* free any that were mapped successfully */
                                i--;
                                dma_unmap_single(lp->device, lp->rx_laddr[i], SONIC_RBSIZE, DMA_FROM_DEVICE);

diff --git a/drivers/net/ethernet/socionext/netsec.c b/drivers/net/ethernet/socionext/netsec.c
index f4c0b02ddad82acc9962ee94744a86d8a5611d88..59fbf74dcadaf29c53fb369175ccb19656c517ff 100644 (file)
--- a/drivers/net/ethernet/socionext/netsec.c
+++ b/drivers/net/ethernet/socionext/netsec.c
@@ -1674,8 +1674,8 @@ static int netsec_probe(struct platform_device *pdev)
        if (ret)
                goto unreg_napi;
 
-       if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(64)))
-               dev_warn(&pdev->dev, "Failed to enable 64-bit DMA\n");
+       if (dma_set_mask_and_coherent(&pdev->dev, DMA_BIT_MASK(40)))
+               dev_warn(&pdev->dev, "Failed to set DMA mask\n");
 
        ret = register_netdev(ndev);
        if (ret) {

diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
index abceea802ea1b0b351628a264aca624696e2c290..38828ab77eb9cb57989cef134abd1b22336ecfbf 100644 (file)
--- a/drivers/net/ethernet/ti/davinci_emac.c
+++ b/drivers/net/ethernet/ti/davinci_emac.c
@@ -1873,7 +1873,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
        if (IS_ERR(priv->txchan)) {
                dev_err(&pdev->dev, "error initializing tx dma channel\n");
                rc = PTR_ERR(priv->txchan);
-               goto no_cpdma_chan;
+               goto err_free_dma;
        }
 
        priv->rxchan = cpdma_chan_create(priv->dma, EMAC_DEF_RX_CH,
@@ -1881,14 +1881,14 @@ static int davinci_emac_probe(struct platform_device *pdev)
        if (IS_ERR(priv->rxchan)) {
                dev_err(&pdev->dev, "error initializing rx dma channel\n");
                rc = PTR_ERR(priv->rxchan);
-               goto no_cpdma_chan;
+               goto err_free_txchan;
        }
 
        res = platform_get_resource(pdev, IORESOURCE_IRQ, 0);
        if (!res) {
                dev_err(&pdev->dev, "error getting irq res\n");
                rc = -ENOENT;
-               goto no_cpdma_chan;
+               goto err_free_rxchan;
        }
        ndev->irq = res->start;
 
@@ -1914,7 +1914,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
                pm_runtime_put_noidle(&pdev->dev);
                dev_err(&pdev->dev, "%s: failed to get_sync(%d)\n",
                        __func__, rc);
-               goto no_cpdma_chan;
+               goto err_napi_del;
        }
 
        /* register the network device */
@@ -1924,7 +1924,7 @@ static int davinci_emac_probe(struct platform_device *pdev)
                dev_err(&pdev->dev, "error in register_netdev\n");
                rc = -ENODEV;
                pm_runtime_put(&pdev->dev);
-               goto no_cpdma_chan;
+               goto err_napi_del;
        }
 
 
@@ -1937,11 +1937,13 @@ static int davinci_emac_probe(struct platform_device *pdev)
 
        return 0;
 
-no_cpdma_chan:
-       if (priv->txchan)
-               cpdma_chan_destroy(priv->txchan);
-       if (priv->rxchan)
-               cpdma_chan_destroy(priv->rxchan);
+err_napi_del:
+       netif_napi_del(&priv->napi);
+err_free_rxchan:
+       cpdma_chan_destroy(priv->rxchan);
+err_free_txchan:
+       cpdma_chan_destroy(priv->txchan);
+err_free_dma:
        cpdma_ctlr_destroy(priv->dma);
 no_pdata:
        if (of_phy_is_fixed_link(np))

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 45d807796a18a1584ea7af3d43cb0b8daab9ca8f..23e9eb66197fbeb3de4d5e2fdf9f22fcdb1777be 100644 (file)
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1650,7 +1650,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
        else
                *skb_xdp = 0;
 
-       preempt_disable();
+       local_bh_disable();
        rcu_read_lock();
        xdp_prog = rcu_dereference(tun->xdp_prog);
        if (xdp_prog && !*skb_xdp) {
@@ -1675,7 +1675,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                        if (err)
                                goto err_redirect;
                        rcu_read_unlock();
-                       preempt_enable();
+                       local_bh_enable();
                        return NULL;
                case XDP_TX:
                        get_page(alloc_frag->page);
@@ -1684,7 +1684,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
                                goto err_redirect;
                        tun_xdp_flush(tun->dev);
                        rcu_read_unlock();
-                       preempt_enable();
+                       local_bh_enable();
                        return NULL;
                case XDP_PASS:
                        delta = orig_data - xdp.data;
@@ -1703,7 +1703,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
        skb = build_skb(buf, buflen);
        if (!skb) {
                rcu_read_unlock();
-               preempt_enable();
+               local_bh_enable();
                return ERR_PTR(-ENOMEM);
        }
 
@@ -1713,7 +1713,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
        alloc_frag->offset += buflen;
 
        rcu_read_unlock();
-       preempt_enable();
+       local_bh_enable();
 
        return skb;
 
@@ -1721,7 +1721,7 @@ static struct sk_buff *tun_build_skb(struct tun_struct *tun,
        put_page(alloc_frag->page);
 err_xdp:
        rcu_read_unlock();
-       preempt_enable();
+       local_bh_enable();
        this_cpu_inc(tun->pcpu_stats->rx_dropped);
        return NULL;
 }
@@ -1917,16 +1917,19 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
                struct bpf_prog *xdp_prog;
                int ret;
 
+               local_bh_disable();
                rcu_read_lock();
                xdp_prog = rcu_dereference(tun->xdp_prog);
                if (xdp_prog) {
                        ret = do_xdp_generic(xdp_prog, skb);
                        if (ret != XDP_PASS) {
                                rcu_read_unlock();
+                               local_bh_enable();
                                return total_len;
                        }
                }
                rcu_read_unlock();
+               local_bh_enable();
        }
 
        rcu_read_lock();

diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
index 7220cd62071726b171ab2ae792f672d7b513343b..0362acd5cdcaaf2debe7ab13941a06d1504ad21c 100644 (file)
--- a/drivers/net/usb/cdc_mbim.c
+++ b/drivers/net/usb/cdc_mbim.c
@@ -609,7 +609,7 @@ static const struct driver_info cdc_mbim_info_ndp_to_end = {
  */
 static const struct driver_info cdc_mbim_info_avoid_altsetting_toggle = {
        .description = "CDC MBIM",
-       .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN,
+       .flags = FLAG_NO_SETINT | FLAG_MULTI_PACKET | FLAG_WWAN | FLAG_SEND_ZLP,
        .bind = cdc_mbim_bind,
        .unbind = cdc_mbim_unbind,
        .manage_power = cdc_mbim_manage_power,

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index 42565dd33aa66a09d73b0e397f3c9872587a6843..094680871687d44a601286c7875af66945d4b618 100644 (file)
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -1103,6 +1103,7 @@ static const struct usb_device_id products[] = {
        {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
        {QMI_QUIRK_SET_DTR(0x05c6, 0x9625, 4)}, /* YUGA CLM920-NC5 */
        {QMI_FIXED_INTF(0x0846, 0x68a2, 8)},
+       {QMI_FIXED_INTF(0x0846, 0x68d3, 8)},    /* Netgear Aircard 779S */
        {QMI_FIXED_INTF(0x12d1, 0x140c, 1)},    /* Huawei E173 */
        {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},    /* Huawei E1820 */
        {QMI_FIXED_INTF(0x1435, 0xd181, 3)},    /* Wistron NeWeb D18Q1 */

diff --git a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
index f8a0234d332c2abeb90db93b616c491f4e886cae..5517ea4c2aa0b7f46938cb741d3a3b714f839191 100644 (file)
--- a/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
+++ b/drivers/net/wireless/intel/iwlwifi/pcie/trans.c
@@ -1590,14 +1590,13 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
                                        struct iwl_trans *trans)
 {
        struct iwl_trans_pcie *trans_pcie = IWL_TRANS_GET_PCIE_TRANS(trans);
-       int max_irqs, num_irqs, i, ret, nr_online_cpus;
+       int max_irqs, num_irqs, i, ret;
        u16 pci_cmd;
 
        if (!trans->cfg->mq_rx_supported)
                goto enable_msi;
 
-       nr_online_cpus = num_online_cpus();
-       max_irqs = min_t(u32, nr_online_cpus + 2, IWL_MAX_RX_HW_QUEUES);
+       max_irqs = min_t(u32, num_online_cpus() + 2, IWL_MAX_RX_HW_QUEUES);
        for (i = 0; i < max_irqs; i++)
                trans_pcie->msix_entries[i].entry = i;
 
@@ -1623,16 +1622,17 @@ static void iwl_pcie_set_interrupt_capa(struct pci_dev *pdev,
         * Two interrupts less: non rx causes shared with FBQ and RSS.
         * More than two interrupts: we will use fewer RSS queues.
         */
-       if (num_irqs <= nr_online_cpus) {
+       if (num_irqs <= max_irqs - 2) {
                trans_pcie->trans->num_rx_queues = num_irqs + 1;
                trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX |
                        IWL_SHARED_IRQ_FIRST_RSS;
-       } else if (num_irqs == nr_online_cpus + 1) {
+       } else if (num_irqs == max_irqs - 1) {
                trans_pcie->trans->num_rx_queues = num_irqs;
                trans_pcie->shared_vec_mask = IWL_SHARED_IRQ_NON_RX;
        } else {
                trans_pcie->trans->num_rx_queues = num_irqs - 1;
        }
+       WARN_ON(trans_pcie->trans->num_rx_queues > IWL_MAX_RX_HW_QUEUES);
 
        trans_pcie->alloc_vecs = num_irqs;
        trans_pcie->msix_enabled = true;

diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
index a6884e73d2abfb2228de1e83f91e2226c2b0b65c..7ddee980048bcc51e8ca60e4717508927bb72b16 100644 (file)
--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
@@ -372,16 +372,15 @@ static void rt2x00queue_create_tx_descriptor_ht(struct rt2x00_dev *rt2x00dev,
 
        /*
         * Determine IFS values
-        * - Use TXOP_BACKOFF for probe and management frames except beacons
+        * - Use TXOP_BACKOFF for management frames except beacons
         * - Use TXOP_SIFS for fragment bursts
         * - Use TXOP_HTTXOP for everything else
         *
         * Note: rt2800 devices won't use CTS protection (if used)
         * for frames not transmitted with TXOP_HTTXOP
         */
-       if ((ieee80211_is_mgmt(hdr->frame_control) &&
-            !ieee80211_is_beacon(hdr->frame_control)) ||
-           (tx_info->flags & IEEE80211_TX_CTL_RATE_CTRL_PROBE))
+       if (ieee80211_is_mgmt(hdr->frame_control) &&
+           !ieee80211_is_beacon(hdr->frame_control))
                txdesc->u.ht.txop = TXOP_BACKOFF;
        else if (!(tx_info->flags & IEEE80211_TX_CTL_FIRST_FRAGMENT))
                txdesc->u.ht.txop = TXOP_SIFS;

diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c
index 986058a57917f5b6ce0394d83206c08e161f4bd9..eeaf6739215f519dddfa6f63c7099d7416a91ec0 100644 (file)
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -105,7 +105,9 @@ struct vhost_net_virtqueue {
        /* vhost zerocopy support fields below: */
        /* last used idx for outstanding DMA zerocopy buffers */
        int upend_idx;
-       /* first used idx for DMA done zerocopy buffers */
+       /* For TX, first used idx for DMA done zerocopy buffers
+        * For RX, number of batched heads
+        */
        int done_idx;
        /* an array of userspace buffers info */
        struct ubuf_info *ubuf_info;
@@ -626,6 +628,18 @@ static int sk_has_rx_data(struct sock *sk)
        return skb_queue_empty(&sk->sk_receive_queue);
 }
 
+static void vhost_rx_signal_used(struct vhost_net_virtqueue *nvq)
+{
+       struct vhost_virtqueue *vq = &nvq->vq;
+       struct vhost_dev *dev = vq->dev;
+
+       if (!nvq->done_idx)
+               return;
+
+       vhost_add_used_and_signal_n(dev, vq, vq->heads, nvq->done_idx);
+       nvq->done_idx = 0;
+}
+
 static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk)
 {
        struct vhost_net_virtqueue *rvq = &net->vqs[VHOST_NET_VQ_RX];
@@ -635,6 +649,8 @@ static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk)
        int len = peek_head_len(rvq, sk);
 
        if (!len && vq->busyloop_timeout) {
+               /* Flush batched heads first */
+               vhost_rx_signal_used(rvq);
                /* Both tx vq and rx socket were polled here */
                mutex_lock_nested(&vq->mutex, 1);
                vhost_disable_notify(&net->dev, vq);
@@ -762,7 +778,7 @@ static void handle_rx(struct vhost_net *net)
        };
        size_t total_len = 0;
        int err, mergeable;
-       s16 headcount, nheads = 0;
+       s16 headcount;
        size_t vhost_hlen, sock_hlen;
        size_t vhost_len, sock_len;
        struct socket *sock;
@@ -790,8 +806,8 @@ static void handle_rx(struct vhost_net *net)
        while ((sock_len = vhost_net_rx_peek_head_len(net, sock->sk))) {
                sock_len += sock_hlen;
                vhost_len = sock_len + vhost_hlen;
-               headcount = get_rx_bufs(vq, vq->heads + nheads, vhost_len,
-                                       &in, vq_log, &log,
+               headcount = get_rx_bufs(vq, vq->heads + nvq->done_idx,
+                                       vhost_len, &in, vq_log, &log,
                                        likely(mergeable) ? UIO_MAXIOV : 1);
                /* On error, stop handling until the next kick. */
                if (unlikely(headcount < 0))
@@ -862,12 +878,9 @@ static void handle_rx(struct vhost_net *net)
                        vhost_discard_vq_desc(vq, headcount);
                        goto out;
                }
-               nheads += headcount;
-               if (nheads > VHOST_RX_BATCH) {
-                       vhost_add_used_and_signal_n(&net->dev, vq, vq->heads,
-                                                   nheads);
-                       nheads = 0;
-               }
+               nvq->done_idx += headcount;
+               if (nvq->done_idx > VHOST_RX_BATCH)
+                       vhost_rx_signal_used(nvq);
                if (unlikely(vq_log))
                        vhost_log_write(vq, vq_log, log, vhost_len);
                total_len += vhost_len;
@@ -878,9 +891,7 @@ static void handle_rx(struct vhost_net *net)
        }
        vhost_net_enable_vq(net, vq);
 out:
-       if (nheads)
-               vhost_add_used_and_signal_n(&net->dev, vq, vq->heads,
-                                           nheads);
+       vhost_rx_signal_used(nvq);
        mutex_unlock(&vq->mutex);
 }
 

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index c5ec89732a8d92a7db596795602192a83615122f..8c317737ba3f01e272724456ed2325f9a682a075 100644 (file)
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h
@@ -1017,6 +1017,7 @@ struct bpf_prog_info {
        __aligned_u64 map_ids;
        char name[BPF_OBJ_NAME_LEN];
        __u32 ifindex;
+       __u32 :32;
        __u64 netns_dev;
        __u64 netns_ino;
 } __attribute__((aligned(8)));
@@ -1030,6 +1031,7 @@ struct bpf_map_info {
        __u32 map_flags;
        char  name[BPF_OBJ_NAME_LEN];
        __u32 ifindex;
+       __u32 :32;
        __u64 netns_dev;
        __u64 netns_ino;
 } __attribute__((aligned(8)));

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 28a4c3490359ccb5cc8a27e684dcfe56a13e5c40..6ba639f6c51d12446e385af1b688fee0e46e884e 100644 (file)
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1954,7 +1954,8 @@ static int compat_mtw_from_user(struct compat_ebt_entry_mwt *mwt,
        int off, pad = 0;
        unsigned int size_kern, match_size = mwt->match_size;
 
-       strlcpy(name, mwt->u.name, sizeof(name));
+       if (strscpy(name, mwt->u.name, sizeof(name)) < 0)
+               return -EINVAL;
 
        if (state->buf_kern_start)
                dst = state->buf_kern_start + state->buf_kern_offset;

diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index c476f07941323f0b9ff27e947583dc6adc8d728e..bb7e80f4ced3746dc6946cfbc3e71520db503e50 100644 (file)
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -1214,9 +1214,6 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue,
        cpumask_var_t mask;
        unsigned long index;
 
-       if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
-               return -ENOMEM;
-
        index = get_netdev_queue_index(queue);
 
        if (dev->num_tc) {
@@ -1226,6 +1223,9 @@ static ssize_t xps_cpus_show(struct netdev_queue *queue,
                        return -EINVAL;
        }
 
+       if (!zalloc_cpumask_var(&mask, GFP_KERNEL))
+               return -ENOMEM;
+
        rcu_read_lock();
        dev_maps = rcu_dereference(dev->xps_maps);
        if (dev_maps) {

diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index 6b0e362cc99b5d3510ea7aa8db68dcb5c8eb675c..38d906baf1df837c5009b7487fb14f6a1c11acaa 100644 (file)
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -328,7 +328,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
 
        if (tdev) {
                hlen = tdev->hard_header_len + tdev->needed_headroom;
-               mtu = tdev->mtu;
+               mtu = min(tdev->mtu, IP_MAX_MTU);
        }
 
        dev->needed_headroom = t_hlen + hlen;
@@ -362,7 +362,7 @@ static struct ip_tunnel *ip_tunnel_create(struct net *net,
        nt = netdev_priv(dev);
        t_hlen = nt->hlen + sizeof(struct iphdr);
        dev->min_mtu = ETH_MIN_MTU;
-       dev->max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
+       dev->max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
        ip_tunnel_add(itn, nt);
        return nt;
 
@@ -930,7 +930,7 @@ int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        int t_hlen = tunnel->hlen + sizeof(struct iphdr);
-       int max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
+       int max_mtu = IP_MAX_MTU - dev->hard_header_len - t_hlen;
 
        if (new_mtu < ETH_MIN_MTU)
                return -EINVAL;
@@ -1107,7 +1107,7 @@ int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
 
        mtu = ip_tunnel_bind_dev(dev);
        if (tb[IFLA_MTU]) {
-               unsigned int max = 0xfff8 - dev->hard_header_len - nt->hlen;
+               unsigned int max = IP_MAX_MTU - dev->hard_header_len - nt->hlen;
 
                mtu = clamp(dev->mtu, (unsigned int)ETH_MIN_MTU,
                            (unsigned int)(max - sizeof(struct iphdr)));

diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index da66aaac51cecbf933827c8842e61a8cbb4d274f..00e138a44cbba2e7c03cb003f5823b42e18a923a 100644 (file)
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1692,8 +1692,13 @@ int ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
                if (new_mtu < ETH_MIN_MTU)
                        return -EINVAL;
        }
-       if (new_mtu > 0xFFF8 - dev->hard_header_len)
-               return -EINVAL;
+       if (tnl->parms.proto == IPPROTO_IPV6 || tnl->parms.proto == 0) {
+               if (new_mtu > IP6_MAX_MTU - dev->hard_header_len)
+                       return -EINVAL;
+       } else {
+               if (new_mtu > IP_MAX_MTU - dev->hard_header_len)
+                       return -EINVAL;
+       }
        dev->mtu = new_mtu;
        return 0;
 }
@@ -1841,7 +1846,7 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
        if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
                dev->mtu -= 8;
        dev->min_mtu = ETH_MIN_MTU;
-       dev->max_mtu = 0xFFF8 - dev->hard_header_len;
+       dev->max_mtu = IP6_MAX_MTU - dev->hard_header_len;
 
        return 0;
 

diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 5fe13948491968f2121782a4e4c2d3b93abe6e17..bf4763fd68c22388f59cb68755ec799545e7fb29 100644 (file)
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -103,7 +103,7 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
        hdrlen = (osrh->hdrlen + 1) << 3;
        tot_len = hdrlen + sizeof(*hdr);
 
-       err = skb_cow_head(skb, tot_len);
+       err = skb_cow_head(skb, tot_len + skb->mac_len);
        if (unlikely(err))
                return err;
 
@@ -161,7 +161,7 @@ int seg6_do_srh_inline(struct sk_buff *skb, struct ipv6_sr_hdr *osrh)
 
        hdrlen = (osrh->hdrlen + 1) << 3;
 
-       err = skb_cow_head(skb, hdrlen);
+       err = skb_cow_head(skb, hdrlen + skb->mac_len);
        if (unlikely(err))
                return err;
 

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 2afce37a71776f5ebd44d20e2d064909cb91f8dd..e9400ffa7875c7a81d139618dae53143d164a1e1 100644 (file)
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1371,7 +1371,7 @@ static void ipip6_tunnel_setup(struct net_device *dev)
        dev->hard_header_len    = LL_MAX_HEADER + t_hlen;
        dev->mtu                = ETH_DATA_LEN - t_hlen;
        dev->min_mtu            = IPV6_MIN_MTU;
-       dev->max_mtu            = 0xFFF8 - t_hlen;
+       dev->max_mtu            = IP6_MAX_MTU - t_hlen;
        dev->flags              = IFF_NOARP;
        netif_keep_dst(dev);
        dev->addr_len           = 4;
@@ -1583,7 +1583,8 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
        if (tb[IFLA_MTU]) {
                u32 mtu = nla_get_u32(tb[IFLA_MTU]);
 
-               if (mtu >= IPV6_MIN_MTU && mtu <= 0xFFF8 - dev->hard_header_len)
+               if (mtu >= IPV6_MIN_MTU &&
+                   mtu <= IP6_MAX_MTU - dev->hard_header_len)
                        dev->mtu = mtu;
        }
 

diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 416fe67271a920f5a86dd3007c03e3113f857f8a..86dba282a147ce6ad4b3e4e2f3b5c81962493130 100644 (file)
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -126,7 +126,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
        struct flowi6 *fl6 = &fl->u.ip6;
        int onlyproto = 0;
        const struct ipv6hdr *hdr = ipv6_hdr(skb);
-       u16 offset = sizeof(*hdr);
+       u32 offset = sizeof(*hdr);
        struct ipv6_opt_hdr *exthdr;
        const unsigned char *nh = skb_network_header(skb);
        u16 nhoff = IP6CB(skb)->nhoff;

diff --git a/net/kcm/kcmsock.c b/net/kcm/kcmsock.c
index dc76bc34682901e4dac8c00503e9c5da7d997dec..d3601d421571b9825ff0a6cea9b75cb52fd51dea 100644 (file)
--- a/net/kcm/kcmsock.c
+++ b/net/kcm/kcmsock.c
@@ -1671,7 +1671,7 @@ static struct file *kcm_clone(struct socket *osock)
        __module_get(newsock->ops->owner);
 
        newsk = sk_alloc(sock_net(osock->sk), PF_KCM, GFP_KERNEL,
-                        &kcm_proto, true);
+                        &kcm_proto, false);
        if (!newsk) {
                sock_release(newsock);
                return ERR_PTR(-ENOMEM);

diff --git a/net/ncsi/ncsi-netlink.c b/net/ncsi/ncsi-netlink.c
index 8d7e849d4825233e7f71c24f5c42a9f8574e0415..41cede4041d3cbd801984cc005acff2cb0aba6dc 100644 (file)
--- a/net/ncsi/ncsi-netlink.c
+++ b/net/ncsi/ncsi-netlink.c
@@ -215,7 +215,7 @@ static int ncsi_pkg_info_nl(struct sk_buff *msg, struct genl_info *info)
 static int ncsi_pkg_info_all_nl(struct sk_buff *skb,
                                struct netlink_callback *cb)
 {
-       struct nlattr *attrs[NCSI_ATTR_MAX];
+       struct nlattr *attrs[NCSI_ATTR_MAX + 1];
        struct ncsi_package *np, *package;
        struct ncsi_dev_priv *ndp;
        unsigned int package_id;

diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index f36098887ad0c4bcfa8c075654be3353ba7565d6..3ecca0616d8c7daa5b7c59d343c492a9a9b29761 100644 (file)
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2381,8 +2381,10 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                        struct ipvs_sync_daemon_cfg cfg;
 
                        memset(&cfg, 0, sizeof(cfg));
-                       strlcpy(cfg.mcast_ifn, dm->mcast_ifn,
-                               sizeof(cfg.mcast_ifn));
+                       ret = -EINVAL;
+                       if (strscpy(cfg.mcast_ifn, dm->mcast_ifn,
+                                   sizeof(cfg.mcast_ifn)) <= 0)
+                               goto out_dec;
                        cfg.syncid = dm->syncid;
                        ret = start_sync_thread(ipvs, &cfg, dm->state);
                } else {
@@ -2420,12 +2422,19 @@ do_ip_vs_set_ctl(struct sock *sk, int cmd, void __user *user, unsigned int len)
                }
        }
 
+       if ((cmd == IP_VS_SO_SET_ADD || cmd == IP_VS_SO_SET_EDIT) &&
+           strnlen(usvc.sched_name, IP_VS_SCHEDNAME_MAXLEN) ==
+           IP_VS_SCHEDNAME_MAXLEN) {
+               ret = -EINVAL;
+               goto out_unlock;
+       }
+
        /* Check for valid protocol: TCP or UDP or SCTP, even for fwmark!=0 */
        if (usvc.protocol != IPPROTO_TCP && usvc.protocol != IPPROTO_UDP &&
            usvc.protocol != IPPROTO_SCTP) {
-               pr_err("set_ctl: invalid protocol: %d %pI4:%d %s\n",
+               pr_err("set_ctl: invalid protocol: %d %pI4:%d\n",
                       usvc.protocol, &usvc.addr.ip,
-                      ntohs(usvc.port), usvc.sched_name);
+                      ntohs(usvc.port));
                ret = -EFAULT;
                goto out_unlock;
        }
@@ -2847,7 +2856,7 @@ static const struct nla_policy ip_vs_cmd_policy[IPVS_CMD_ATTR_MAX + 1] = {
 static const struct nla_policy ip_vs_daemon_policy[IPVS_DAEMON_ATTR_MAX + 1] = {
        [IPVS_DAEMON_ATTR_STATE]        = { .type = NLA_U32 },
        [IPVS_DAEMON_ATTR_MCAST_IFN]    = { .type = NLA_NUL_STRING,
-                                           .len = IP_VS_IFNAME_MAXLEN },
+                                           .len = IP_VS_IFNAME_MAXLEN - 1 },
        [IPVS_DAEMON_ATTR_SYNC_ID]      = { .type = NLA_U32 },
        [IPVS_DAEMON_ATTR_SYNC_MAXLEN]  = { .type = NLA_U16 },
        [IPVS_DAEMON_ATTR_MCAST_GROUP]  = { .type = NLA_U32 },
@@ -2865,7 +2874,7 @@ static const struct nla_policy ip_vs_svc_policy[IPVS_SVC_ATTR_MAX + 1] = {
        [IPVS_SVC_ATTR_PORT]            = { .type = NLA_U16 },
        [IPVS_SVC_ATTR_FWMARK]          = { .type = NLA_U32 },
        [IPVS_SVC_ATTR_SCHED_NAME]      = { .type = NLA_NUL_STRING,
-                                           .len = IP_VS_SCHEDNAME_MAXLEN },
+                                           .len = IP_VS_SCHEDNAME_MAXLEN - 1 },
        [IPVS_SVC_ATTR_PE_NAME]         = { .type = NLA_NUL_STRING,
                                            .len = IP_VS_PENAME_MAXLEN },
        [IPVS_SVC_ATTR_FLAGS]           = { .type = NLA_BINARY,

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 91e80aa852d630b01ceede24f79dedbeca166ece..501e48a7965b4a1de0e71a2e7bda1ad9daf3f15d 100644 (file)
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1298,8 +1298,10 @@ static void nft_chain_stats_replace(struct nft_base_chain *chain,
                rcu_assign_pointer(chain->stats, newstats);
                synchronize_rcu();
                free_percpu(oldstats);
-       } else
+       } else {
                rcu_assign_pointer(chain->stats, newstats);
+               static_branch_inc(&nft_counters_enabled);
+       }
 }
 
 static void nf_tables_chain_destroy(struct nft_ctx *ctx)
@@ -4706,7 +4708,7 @@ static int nf_tables_dump_obj(struct sk_buff *skb, struct netlink_callback *cb)
                        if (idx > s_idx)
                                memset(&cb->args[1], 0,
                                       sizeof(cb->args) - sizeof(cb->args[0]));
-                       if (filter && filter->table[0] &&
+                       if (filter && filter->table &&
                            strcmp(filter->table, table->name))
                                goto cont;
                        if (filter &&
@@ -5380,7 +5382,7 @@ static int nf_tables_dump_flowtable(struct sk_buff *skb,
                        if (idx > s_idx)
                                memset(&cb->args[1], 0,
                                       sizeof(cb->args) - sizeof(cb->args[0]));
-                       if (filter && filter->table[0] &&
+                       if (filter && filter->table &&
                            strcmp(filter->table, table->name))
                                goto cont;
 

diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
index 942702a2776f6a57313b07c7f88bb67f98710016..40e744572283c709540cccbda7650c4966d845d7 100644 (file)
--- a/net/netfilter/nf_tables_core.c
+++ b/net/netfilter/nf_tables_core.c
@@ -126,15 +126,15 @@ static noinline void nft_update_chain_stats(const struct nft_chain *chain,
        if (!base_chain->stats)
                return;
 
+       local_bh_disable();
        stats = this_cpu_ptr(rcu_dereference(base_chain->stats));
        if (stats) {
-               local_bh_disable();
                u64_stats_update_begin(&stats->syncp);
                stats->pkts++;
                stats->bytes += pkt->skb->len;
                u64_stats_update_end(&stats->syncp);
-               local_bh_enable();
        }
+       local_bh_enable();
 }
 
 struct nft_jumpstack {

diff --git a/net/netfilter/nfnetlink_acct.c b/net/netfilter/nfnetlink_acct.c
index 6ddf89183e7b47e6c029b28cf5b524c73a790498..a0e5adf0b3b6ddbcd01f956d25dda01c611a7663 100644 (file)
--- a/net/netfilter/nfnetlink_acct.c
+++ b/net/netfilter/nfnetlink_acct.c
@@ -115,7 +115,7 @@ static int nfnl_acct_new(struct net *net, struct sock *nfnl,
                nfacct->flags = flags;
        }
 
-       nla_strlcpy(nfacct->name, nla_data(tb[NFACCT_NAME]), NFACCT_NAME_MAX);
+       nla_strlcpy(nfacct->name, tb[NFACCT_NAME], NFACCT_NAME_MAX);
 
        if (tb[NFACCT_BYTES]) {
                atomic64_set(&nfacct->bytes,

diff --git a/net/netfilter/nfnetlink_cthelper.c b/net/netfilter/nfnetlink_cthelper.c
index fa026b269b3691d5186e28020eb2b08e93dc3679..cb5b5f2077774c29fb987b7f1eb2d75e9efc2fe1 100644 (file)
--- a/net/netfilter/nfnetlink_cthelper.c
+++ b/net/netfilter/nfnetlink_cthelper.c
@@ -150,7 +150,7 @@ nfnl_cthelper_expect_policy(struct nf_conntrack_expect_policy *expect_policy,
                return -EINVAL;
 
        nla_strlcpy(expect_policy->name,
-                   nla_data(tb[NFCTH_POLICY_NAME]), NF_CT_HELPER_NAME_LEN);
+                   tb[NFCTH_POLICY_NAME], NF_CT_HELPER_NAME_LEN);
        expect_policy->max_expected =
                ntohl(nla_get_be32(tb[NFCTH_POLICY_EXPECT_MAX]));
        if (expect_policy->max_expected > NF_CT_EXPECT_MAX_CNT)
@@ -235,7 +235,7 @@ nfnl_cthelper_create(const struct nlattr * const tb[],
                goto err1;
 
        nla_strlcpy(helper->name,
-                   nla_data(tb[NFCTH_NAME]), NF_CT_HELPER_NAME_LEN);
+                   tb[NFCTH_NAME], NF_CT_HELPER_NAME_LEN);
        size = ntohl(nla_get_be32(tb[NFCTH_PRIV_DATA_LEN]));
        if (size > FIELD_SIZEOF(struct nf_conn_help, data)) {
                ret = -ENOMEM;

diff --git a/net/netfilter/nft_ct.c b/net/netfilter/nft_ct.c
index ea737fd789e871d025faf27e6324feb89c930b83..5c0de704bad5a1365a6ce4557e2d0802a5bdbe0b 100644 (file)
--- a/net/netfilter/nft_ct.c
+++ b/net/netfilter/nft_ct.c
@@ -880,22 +880,26 @@ static int nft_ct_helper_obj_dump(struct sk_buff *skb,
                                  struct nft_object *obj, bool reset)
 {
        const struct nft_ct_helper_obj *priv = nft_obj_data(obj);
-       const struct nf_conntrack_helper *helper = priv->helper4;
+       const struct nf_conntrack_helper *helper;
        u16 family;
 
+       if (priv->helper4 && priv->helper6) {
+               family = NFPROTO_INET;
+               helper = priv->helper4;
+       } else if (priv->helper6) {
+               family = NFPROTO_IPV6;
+               helper = priv->helper6;
+       } else {
+               family = NFPROTO_IPV4;
+               helper = priv->helper4;
+       }
+
        if (nla_put_string(skb, NFTA_CT_HELPER_NAME, helper->name))
                return -1;
 
        if (nla_put_u8(skb, NFTA_CT_HELPER_L4PROTO, priv->l4proto))
                return -1;
 
-       if (priv->helper4 && priv->helper6)
-               family = NFPROTO_INET;
-       else if (priv->helper6)
-               family = NFPROTO_IPV6;
-       else
-               family = NFPROTO_IPV4;
-
        if (nla_put_be16(skb, NFTA_CT_HELPER_L3PROTO, htons(family)))
                return -1;
 

diff --git a/net/netfilter/nft_limit.c b/net/netfilter/nft_limit.c
index a9fc298ef4c3a9be6c1a4b9fb65cacfd71c3dc46..72f13a1144dd6a88d508f33696aa0646fa79988b 100644 (file)
--- a/net/netfilter/nft_limit.c
+++ b/net/netfilter/nft_limit.c
@@ -51,10 +51,13 @@ static inline bool nft_limit_eval(struct nft_limit *limit, u64 cost)
        return !limit->invert;
 }
 
+/* Use same default as in iptables. */
+#define NFT_LIMIT_PKT_BURST_DEFAULT    5
+
 static int nft_limit_init(struct nft_limit *limit,
-                         const struct nlattr * const tb[])
+                         const struct nlattr * const tb[], bool pkts)
 {
-       u64 unit;
+       u64 unit, tokens;
 
        if (tb[NFTA_LIMIT_RATE] == NULL ||
            tb[NFTA_LIMIT_UNIT] == NULL)
@@ -68,18 +71,25 @@ static int nft_limit_init(struct nft_limit *limit,
 
        if (tb[NFTA_LIMIT_BURST])
                limit->burst = ntohl(nla_get_be32(tb[NFTA_LIMIT_BURST]));
-       else
-               limit->burst = 0;
+
+       if (pkts && limit->burst == 0)
+               limit->burst = NFT_LIMIT_PKT_BURST_DEFAULT;
 
        if (limit->rate + limit->burst < limit->rate)
                return -EOVERFLOW;
 
-       /* The token bucket size limits the number of tokens can be
-        * accumulated. tokens_max specifies the bucket size.
-        * tokens_max = unit * (rate + burst) / rate.
-        */
-       limit->tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
-                               limit->rate);
+       if (pkts) {
+               tokens = div_u64(limit->nsecs, limit->rate) * limit->burst;
+       } else {
+               /* The token bucket size limits the number of tokens can be
+                * accumulated. tokens_max specifies the bucket size.
+                * tokens_max = unit * (rate + burst) / rate.
+                */
+               tokens = div_u64(limit->nsecs * (limit->rate + limit->burst),
+                                limit->rate);
+       }
+
+       limit->tokens = tokens;
        limit->tokens_max = limit->tokens;
 
        if (tb[NFTA_LIMIT_FLAGS]) {
@@ -144,7 +154,7 @@ static int nft_limit_pkts_init(const struct nft_ctx *ctx,
        struct nft_limit_pkts *priv = nft_expr_priv(expr);
        int err;
 
-       err = nft_limit_init(&priv->limit, tb);
+       err = nft_limit_init(&priv->limit, tb, true);
        if (err < 0)
                return err;
 
@@ -185,7 +195,7 @@ static int nft_limit_bytes_init(const struct nft_ctx *ctx,
 {
        struct nft_limit *priv = nft_expr_priv(expr);
 
-       return nft_limit_init(priv, tb);
+       return nft_limit_init(priv, tb, false);
 }
 
 static int nft_limit_bytes_dump(struct sk_buff *skb,
@@ -246,7 +256,7 @@ static int nft_limit_obj_pkts_init(const struct nft_ctx *ctx,
        struct nft_limit_pkts *priv = nft_obj_data(obj);
        int err;
 
-       err = nft_limit_init(&priv->limit, tb);
+       err = nft_limit_init(&priv->limit, tb, true);
        if (err < 0)
                return err;
 
@@ -289,7 +299,7 @@ static int nft_limit_obj_bytes_init(const struct nft_ctx *ctx,
 {
        struct nft_limit *priv = nft_obj_data(obj);
 
-       return nft_limit_init(priv, tb);
+       return nft_limit_init(priv, tb, false);
 }
 
 static int nft_limit_obj_bytes_dump(struct sk_buff *skb,

diff --git a/net/netfilter/nft_meta.c b/net/netfilter/nft_meta.c
index 8fb91940e2e7246db0cb0ff9e307dda56cc60f88..204af9899482cfc350953ba78591294056c5677e 100644 (file)
--- a/net/netfilter/nft_meta.c
+++ b/net/netfilter/nft_meta.c
@@ -234,7 +234,7 @@ void nft_meta_set_eval(const struct nft_expr *expr,
        struct sk_buff *skb = pkt->skb;
        u32 *sreg = &regs->data[meta->sreg];
        u32 value = *sreg;
-       u8 pkt_type;
+       u8 value8;
 
        switch (meta->key) {
        case NFT_META_MARK:
@@ -244,15 +244,17 @@ void nft_meta_set_eval(const struct nft_expr *expr,
                skb->priority = value;
                break;
        case NFT_META_PKTTYPE:
-               pkt_type = nft_reg_load8(sreg);
+               value8 = nft_reg_load8(sreg);
 
-               if (skb->pkt_type != pkt_type &&
-                   skb_pkt_type_ok(pkt_type) &&
+               if (skb->pkt_type != value8 &&
+                   skb_pkt_type_ok(value8) &&
                    skb_pkt_type_ok(skb->pkt_type))
-                       skb->pkt_type = pkt_type;
+                       skb->pkt_type = value8;
                break;
        case NFT_META_NFTRACE:
-               skb->nf_trace = !!value;
+               value8 = nft_reg_load8(sreg);
+
+               skb->nf_trace = !!value8;
                break;
        default:
                WARN_ON(1);

diff --git a/net/sched/cls_flower.c b/net/sched/cls_flower.c
index d964e60c730eafb79a8a9437325e14c8d6288e40..c79f6e71512e5ec48b48ae7ec87a77c1c3ddd469 100644 (file)
--- a/net/sched/cls_flower.c
+++ b/net/sched/cls_flower.c
@@ -977,7 +977,7 @@ static int fl_change(struct net *net, struct sk_buff *in_skb,
        return 0;
 
 errout_idr:
-       if (fnew->handle)
+       if (!fold)
                idr_remove(&head->handle_idr, fnew->handle);
 errout:
        tcf_exts_destroy(&fnew->exts);

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 40b54cc64243b0751e59ef8762248209fa7dabd6..5f48251c1319aa5bb122fe4849030baa758769ee 100644 (file)
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1658,7 +1658,6 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
                trailer_len -= xdst_prev->u.dst.xfrm->props.trailer_len;
        }
 
-out:
        return &xdst0->u.dst;
 
 put_states:
@@ -1667,8 +1666,8 @@ static struct dst_entry *xfrm_bundle_create(struct xfrm_policy *policy,
 free_dst:
        if (xdst0)
                dst_release_immediate(&xdst0->u.dst);
-       xdst0 = ERR_PTR(err);
-       goto out;
+
+       return ERR_PTR(err);
 }
 
 static int xfrm_expand_policies(const struct flowi *fl, u16 family,

diff --git a/tools/include/uapi/linux/bpf.h b/tools/include/uapi/linux/bpf.h
index c5ec89732a8d92a7db596795602192a83615122f..8c317737ba3f01e272724456ed2325f9a682a075 100644 (file)
--- a/tools/include/uapi/linux/bpf.h
+++ b/tools/include/uapi/linux/bpf.h
@@ -1017,6 +1017,7 @@ struct bpf_prog_info {
        __aligned_u64 map_ids;
        char name[BPF_OBJ_NAME_LEN];
        __u32 ifindex;
+       __u32 :32;
        __u64 netns_dev;
        __u64 netns_ino;
 } __attribute__((aligned(8)));
@@ -1030,6 +1031,7 @@ struct bpf_map_info {
        __u32 map_flags;
        char  name[BPF_OBJ_NAME_LEN];
        __u32 ifindex;
+       __u32 :32;
        __u64 netns_dev;
        __u64 netns_ino;
 } __attribute__((aligned(8)));