Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller: 1) Fix object leak on IPSEC offload failure, from Steffen Klassert. 2) Fix range checks in ipset address range addition operations, from Jozsef Kadlecsik. 3) Fix pernet ops unregistration order in ipset, from Florian Westphal. 4) Add missing netlink attribute policy for nl80211 packet pattern attrs, from Peng Xu. 5) Fix PPP device destruction race, from Guillaume Nault. 6) Write marks get lost when BPF verifier processes R1=R2 register assignments, causing incorrect liveness information and less state pruning. Fix from Alexei Starovoitov. 7) Fix blockhole routes so that they are marked dead and therefore not cached in sockets, otherwise IPSEC stops working. From Steffen Klassert. 8) Fix broadcast handling of UDP socket early demux, from Paolo Abeni. * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (37 commits) cdc_ether: flag the u-blox TOBY-L2 and SARA-U2 as wwan net: thunderx: mark expected switch fall-throughs in nicvf_main() udp: fix bcast packet reception netlink: do not set cb_running if dump's start() errs ipv4: Fix traffic triggered IPsec connections. ipv6: Fix traffic triggered IPsec connections. ixgbe: incorrect XDP ring accounting in ethtool tx_frame param net: ixgbe: Use new PCI_DEV_FLAGS_NO_RELAXED_ORDERING flag Revert commit 1a8b6d76dc5b ("net:add one common config...") ixgbe: fix masking of bits read from IXGBE_VXLANCTRL register ixgbe: Return error when getting PHY address if PHY access is not supported netfilter: xt_bpf: Fix XT_BPF_MODE_FD_PINNED mode of 'xt_bpf_info_v1' netfilter: SYNPROXY: skip non-tcp packet in {ipv4, ipv6}_synproxy_hook tipc: Unclone message at secondary destination lookup tipc: correct initialization of skb list gso: fix payload length when gso_size is zero mlxsw: spectrum_router: Avoid expensive lookup during route removal bpf: fix liveness marking doc: Fix typo "8023.ad" in bonding documentation ipv6: fix net.ipv6.conf.all.accept_dad behaviour for real ...

Linus Torvalds committed 9 years ago

Commit ff339522 parents 68ebe3c fdfbad354 files · +211 −164Browse files

Unified · Split

54 files

Documentation/networking/bonding.txt +1 −1
arch/Kconfig +0 −3
arch/sparc/Kconfig +0 −1
drivers/net/ethernet/cavium/thunder/nicvf_main.c +2 −0
drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c +0 −22
drivers/net/ethernet/intel/ixgbe/ixgbe_common.c +0 −19
drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c +8 −8
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c +5 −1
drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c +0 −14
drivers/net/ppp/ppp_generic.c +20 −0
drivers/net/usb/cdc_ether.c +13 −0
include/linux/bpf.h +5 −0
include/linux/netfilter_bridge/ebtables.h +4 −3
include/uapi/linux/netfilter/xt_bpf.h +1 −0
kernel/bpf/inode.c +1 −0
kernel/bpf/verifier.c +5 −0
net/bridge/netfilter/ebtable_broute.c +2 −2
net/bridge/netfilter/ebtable_filter.c +2 −2
net/bridge/netfilter/ebtable_nat.c +2 −2
net/bridge/netfilter/ebtables.c +9 −8
net/ipv4/gre_offload.c +1 −1
net/ipv4/netfilter/ipt_SYNPROXY.c +2 −1
net/ipv4/route.c +1 −1
net/ipv4/udp.c +5 −9
net/ipv4/udp_offload.c +1 −1
net/ipv6/addrconf.c +2 −2
net/ipv6/ip6_offload.c +1 −1
net/ipv6/netfilter/ip6t_SYNPROXY.c +1 −1
net/ipv6/route.c +1 −1
net/netfilter/ipset/ip_set_core.c +18 −11
net/netfilter/ipset/ip_set_hash_ip.c +12 −10
net/netfilter/ipset/ip_set_hash_ipmark.c +1 −1
net/netfilter/ipset/ip_set_hash_ipport.c +1 −1
net/netfilter/ipset/ip_set_hash_ipportip.c +1 −1
net/netfilter/ipset/ip_set_hash_ipportnet.c +2 −2
net/netfilter/ipset/ip_set_hash_net.c +1 −1
net/netfilter/ipset/ip_set_hash_netiface.c +1 −1
net/netfilter/ipset/ip_set_hash_netnet.c +2 −2
net/netfilter/ipset/ip_set_hash_netport.c +1 −1
net/netfilter/ipset/ip_set_hash_netportnet.c +2 −2
net/netfilter/ipvs/ip_vs_xmit.c +6 −2
net/netfilter/nf_tables_api.c +6 −4
net/netfilter/x_tables.c +2 −2
net/netfilter/xt_bpf.c +20 −2
net/netfilter/xt_socket.c +2 −2
net/netlink/af_netlink.c +7 −6
net/tipc/bcast.c +2 −2
net/tipc/msg.c +8 −0
net/wireless/nl80211.c +12 −2
net/xfrm/xfrm_device.c +1 −0
net/xfrm/xfrm_input.c +4 −2
net/xfrm/xfrm_state.c +2 −2
net/xfrm/xfrm_user.c +1 −0
tools/testing/selftests/networking/timestamping/rxtimestamp.c +1 −1

Documentation/networking/bonding.txt+1−1

@@ -2387,7 +2387,7 @@ broadcast: Like active-backup, there is not much advantage to this · 2386 unmodified lines
2387	2387	and packet type ID), so in a "gatewayed" configuration, all
2388	2388	outgoing traffic will generally use the same device. Incoming
2389	2389	traffic may also end up on a single device, but that is
2390		− dependent upon the balancing policy of the peer's 8023.ad
	2390	+ dependent upon the balancing policy of the peer's 802.3ad
2391	2391	implementation. In a "local" configuration, traffic will be
2392	2392	distributed across the devices in the bond.
2393	2393

arch/Kconfig+0−3

@@ -937,9 +937,6 @@ config STRICT_MODULE_RWX · 936 unmodified lines
937	937	and non-text memory will be made non-executable. This provides
938	938	protection against certain security exploits (e.g. writing to text)
939	939
940		−config ARCH_WANT_RELAX_ORDER
941		− bool
942		−
943	940	config ARCH_HAS_REFCOUNT
944	941	bool
945	942	help

arch/sparc/Kconfig+0−1

@@ -44,7 +44,6 @@ config SPARC · 43 unmodified lines
44	44	select ARCH_HAS_SG_CHAIN
45	45	select CPU_NO_EFFICIENT_FFS
46	46	select LOCKDEP_SMALL if LOCKDEP
47		− select ARCH_WANT_RELAX_ORDER
48	47
49	48	config SPARC32
50	49	def_bool !64BIT

drivers/net/ethernet/cavium/thunder/nicvf_main.c+2−0

@@ -565,8 +565,10 @@ static inline bool nicvf_xdp_rx(struct nicvf nic, struct bpf_prog prog, · 564 unmodified lines
565	565	return true;
566	566	default:
567	567	bpf_warn_invalid_xdp_action(action);
	568	+ /* fall through */
568	569	case XDP_ABORTED:
569	570	trace_xdp_exception(nic->netdev, prog, action);
	571	+ /* fall through */
570	572	case XDP_DROP:
571	573	/* Check if it's a recycled page, if not
572	574	* unmap the DMA mapping.

drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c+0−22

@@ -175,31 +175,9 @@ static s32 ixgbe_init_phy_ops_82598(struct ixgbe_hw *hw) · 174 unmodified lines
175	175	**/
176	176	static s32 ixgbe_start_hw_82598(struct ixgbe_hw *hw)
177	177	{
178		−#ifndef CONFIG_SPARC
179		− u32 regval;
180		− u32 i;
181		−#endif
182	178	s32 ret_val;
183	179
184	180	ret_val = ixgbe_start_hw_generic(hw);
185		−
186		−#ifndef CONFIG_SPARC
187		− /* Disable relaxed ordering */
188		− for (i = 0; ((i < hw->mac.max_tx_queues) &&
189		− (i < IXGBE_DCA_MAX_QUEUES_82598)); i++) {
190		− regval = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL(i));
191		− regval &= ~IXGBE_DCA_TXCTRL_DESC_WRO_EN;
192		− IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL(i), regval);
193		− }
194		−
195		− for (i = 0; ((i < hw->mac.max_rx_queues) &&
196		− (i < IXGBE_DCA_MAX_QUEUES_82598)); i++) {
197		− regval = IXGBE_READ_REG(hw, IXGBE_DCA_RXCTRL(i));
198		− regval &= ~(IXGBE_DCA_RXCTRL_DATA_WRO_EN \|
199		− IXGBE_DCA_RXCTRL_HEAD_WRO_EN);
200		− IXGBE_WRITE_REG(hw, IXGBE_DCA_RXCTRL(i), regval);
201		− }
202		−#endif
203	181	if (ret_val)
204	182	return ret_val;
205	183

drivers/net/ethernet/intel/ixgbe/ixgbe_common.c+0−19

@@ -366,25 +366,6 @@ s32 ixgbe_start_hw_gen2(struct ixgbe_hw *hw) · 365 unmodified lines
366	366	}
367	367	IXGBE_WRITE_FLUSH(hw);
368	368
369		−#ifndef CONFIG_ARCH_WANT_RELAX_ORDER
370		− /* Disable relaxed ordering */
371		− for (i = 0; i < hw->mac.max_tx_queues; i++) {
372		− u32 regval;
373		−
374		− regval = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL_82599(i));
375		− regval &= ~IXGBE_DCA_TXCTRL_DESC_WRO_EN;
376		− IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL_82599(i), regval);
377		− }
378		−
379		− for (i = 0; i < hw->mac.max_rx_queues; i++) {
380		− u32 regval;
381		−
382		− regval = IXGBE_READ_REG(hw, IXGBE_DCA_RXCTRL(i));
383		− regval &= ~(IXGBE_DCA_RXCTRL_DATA_WRO_EN \|
384		− IXGBE_DCA_RXCTRL_HEAD_WRO_EN);
385		− IXGBE_WRITE_REG(hw, IXGBE_DCA_RXCTRL(i), regval);
386		− }
387		−#endif
388	369	return 0;
389	370	}
390	371

drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c+8−8

@@ -1048,7 +1048,7 @@ static int ixgbe_set_ringparam(struct net_device *netdev, · 1047 unmodified lines
1048	1048	{
1049	1049	struct ixgbe_adapter *adapter = netdev_priv(netdev);
1050	1050	struct ixgbe_ring *temp_ring;
1051		− int i, err = 0;
	1051	+ int i, j, err = 0;
1052	1052	u32 new_rx_count, new_tx_count;
1053	1053
1054	1054	if ((ring->rx_mini_pending) \|\| (ring->rx_jumbo_pending))
@@ -1085,8 +1085,8 @@ static int ixgbe_set_ringparam(struct net_device *netdev, · 30 unmodified lines
1085	1085	}
1086	1086
1087	1087	/* allocate temporary buffer to store rings in */
1088		− i = max_t(int, adapter->num_tx_queues, adapter->num_rx_queues);
1089		− i = max_t(int, i, adapter->num_xdp_queues);
	1088	+ i = max_t(int, adapter->num_tx_queues + adapter->num_xdp_queues,
	1089	+ adapter->num_rx_queues);
1090	1090	temp_ring = vmalloc(i * sizeof(struct ixgbe_ring));
1091	1091
1092	1092	if (!temp_ring) {
@@ -1118,8 +1118,8 @@ static int ixgbe_set_ringparam(struct net_device *netdev, · 25 unmodified lines
1118	1118	}
1119	1119	}
1120	1120
1121		− for (i = 0; i < adapter->num_xdp_queues; i++) {
1122		− memcpy(&temp_ring[i], adapter->xdp_ring[i],
	1121	+ for (j = 0; j < adapter->num_xdp_queues; j++, i++) {
	1122	+ memcpy(&temp_ring[i], adapter->xdp_ring[j],
1123	1123	sizeof(struct ixgbe_ring));
1124	1124
1125	1125	temp_ring[i].count = new_tx_count;
@@ -1139,10 +1139,10 @@ static int ixgbe_set_ringparam(struct net_device *netdev, · 13 unmodified lines
1139	1139	memcpy(adapter->tx_ring[i], &temp_ring[i],
1140	1140	sizeof(struct ixgbe_ring));
1141	1141	}
1142		− for (i = 0; i < adapter->num_xdp_queues; i++) {
1143		− ixgbe_free_tx_resources(adapter->xdp_ring[i]);
	1142	+ for (j = 0; j < adapter->num_xdp_queues; j++, i++) {
	1143	+ ixgbe_free_tx_resources(adapter->xdp_ring[j]);
1144	1144
1145		− memcpy(adapter->xdp_ring[i], &temp_ring[i],
	1145	+ memcpy(adapter->xdp_ring[j], &temp_ring[i],
1146	1146	sizeof(struct ixgbe_ring));
1147	1147	}
1148	1148

drivers/net/ethernet/intel/ixgbe/ixgbe_main.c+5−1

@@ -4881,7 +4881,7 @@ static void ixgbe_clear_udp_tunnel_port(struct ixgbe_adapter *adapter, u32 mask) · 4880 unmodified lines
4881	4881	IXGBE_FLAG_GENEVE_OFFLOAD_CAPABLE)))
4882	4882	return;
4883	4883
4884		− vxlanctrl = IXGBE_READ_REG(hw, IXGBE_VXLANCTRL) && ~mask;
	4884	+ vxlanctrl = IXGBE_READ_REG(hw, IXGBE_VXLANCTRL) & ~mask;
4885	4885	IXGBE_WRITE_REG(hw, IXGBE_VXLANCTRL, vxlanctrl);
4886	4886
4887	4887	if (mask & IXGBE_VXLANCTRL_VXLAN_UDPPORT_MASK)
@@ -8529,6 +8529,10 @@ static int ixgbe_ioctl(struct net_device netdev, struct ifreq req, int cmd) · 3641 unmodified lines
8529	8529	return ixgbe_ptp_set_ts_config(adapter, req);
8530	8530	case SIOCGHWTSTAMP:
8531	8531	return ixgbe_ptp_get_ts_config(adapter, req);
	8532	+ case SIOCGMIIPHY:
	8533	+ if (!adapter->hw.phy.ops.read_reg)
	8534	+ return -EOPNOTSUPP;
	8535	+ /* fall through */
8532	8536	default:
8533	8537	return mdio_mii_ioctl(&adapter->hw.phy.mdio, if_mii(req), cmd);
8534	8538	}

drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c+0−14

@@ -3505,20 +3505,6 @@ static int mlxsw_sp_fib_lpm_tree_link(struct mlxsw_sp *mlxsw_sp, · 3504 unmodified lines
3505	3505	static void mlxsw_sp_fib_lpm_tree_unlink(struct mlxsw_sp *mlxsw_sp,
3506	3506	struct mlxsw_sp_fib *fib)
3507	3507	{
3508		− struct mlxsw_sp_prefix_usage req_prefix_usage = {{ 0 } };
3509		− struct mlxsw_sp_lpm_tree *lpm_tree;
3510		−
3511		− /* Aggregate prefix lengths across all virtual routers to make
3512		− * sure we only have used prefix lengths in the LPM tree.
3513		− */
3514		− mlxsw_sp_vrs_prefixes(mlxsw_sp, fib->proto, &req_prefix_usage);
3515		− lpm_tree = mlxsw_sp_lpm_tree_get(mlxsw_sp, &req_prefix_usage,
3516		− fib->proto);
3517		− if (IS_ERR(lpm_tree))
3518		− goto err_tree_get;
3519		− mlxsw_sp_vrs_lpm_tree_replace(mlxsw_sp, fib, lpm_tree);
3520		−
3521		−err_tree_get:
3522	3508	if (!mlxsw_sp_prefix_usage_none(&fib->prefix_usage))
3523	3509	return;
3524	3510	mlxsw_sp_vr_lpm_tree_unbind(mlxsw_sp, fib);

drivers/net/ppp/ppp_generic.c+20−0

@@ -1339,7 +1339,17 @@ ppp_get_stats64(struct net_device dev, struct rtnl_link_stats64 stats64) · 1338 unmodified lines
1339	1339
1340	1340	static int ppp_dev_init(struct net_device *dev)
1341	1341	{
	1342	+ struct ppp *ppp;
	1343	+
1342	1344	netdev_lockdep_set_classes(dev);
	1345	+
	1346	+ ppp = netdev_priv(dev);
	1347	+ /* Let the netdevice take a reference on the ppp file. This ensures
	1348	+ * that ppp_destroy_interface() won't run before the device gets
	1349	+ * unregistered.
	1350	+ */
	1351	+ atomic_inc(&ppp->file.refcnt);
	1352	+
1343	1353	return 0;
1344	1354	}
1345	1355
@@ -1362,6 +1372,15 @@ static void ppp_dev_uninit(struct net_device *dev) · 16 unmodified lines
1362	1372	wake_up_interruptible(&ppp->file.rwait);
1363	1373	}
1364	1374
	1375	+static void ppp_dev_priv_destructor(struct net_device *dev)
	1376	+{
	1377	+ struct ppp *ppp;
	1378	+
	1379	+ ppp = netdev_priv(dev);
	1380	+ if (atomic_dec_and_test(&ppp->file.refcnt))
	1381	+ ppp_destroy_interface(ppp);
	1382	+}
	1383	+
1365	1384	static const struct net_device_ops ppp_netdev_ops = {
1366	1385	.ndo_init = ppp_dev_init,
1367	1386	.ndo_uninit = ppp_dev_uninit,
@@ -1387,6 +1406,7 @@ static void ppp_setup(struct net_device *dev) · 19 unmodified lines
1387	1406	dev->tx_queue_len = 3;
1388	1407	dev->type = ARPHRD_PPP;
1389	1408	dev->flags = IFF_POINTOPOINT \| IFF_NOARP \| IFF_MULTICAST;
	1409	+ dev->priv_destructor = ppp_dev_priv_destructor;
1390	1410	netif_keep_dst(dev);
1391	1411	}
1392	1412

drivers/net/usb/cdc_ether.c+13−0

@@ -560,6 +560,7 @@ static const struct driver_info wwan_info = { · 559 unmodified lines
560	560	#define NVIDIA_VENDOR_ID 0x0955
561	561	#define HP_VENDOR_ID 0x03f0
562	562	#define MICROSOFT_VENDOR_ID 0x045e
	563	+#define UBLOX_VENDOR_ID 0x1546
563	564
564	565	static const struct usb_device_id products[] = {
565	566	/* BLACKLIST !!
@@ -868,6 +869,18 @@ static const struct usb_device_id products[] = { · 302 unmodified lines
868	869	USB_CDC_SUBCLASS_ETHERNET,
869	870	USB_CDC_PROTO_NONE),
870	871	.driver_info = (unsigned long)&zte_cdc_info,
	872	+}, {
	873	+ /* U-blox TOBY-L2 */
	874	+ USB_DEVICE_AND_INTERFACE_INFO(UBLOX_VENDOR_ID, 0x1143, USB_CLASS_COMM,
	875	+ USB_CDC_SUBCLASS_ETHERNET,
	876	+ USB_CDC_PROTO_NONE),
	877	+ .driver_info = (unsigned long)&wwan_info,
	878	+}, {
	879	+ /* U-blox SARA-U2 */
	880	+ USB_DEVICE_AND_INTERFACE_INFO(UBLOX_VENDOR_ID, 0x1104, USB_CLASS_COMM,
	881	+ USB_CDC_SUBCLASS_ETHERNET,
	882	+ USB_CDC_PROTO_NONE),
	883	+ .driver_info = (unsigned long)&wwan_info,
871	884	}, {
872	885	USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
873	886	USB_CDC_PROTO_NONE),

include/linux/bpf.h+5−0

@@ -368,6 +368,11 @@ static inline void __bpf_prog_uncharge(struct user_struct *user, u32 pages) · 367 unmodified lines
368	368	{
369	369	}
370	370
	371	+static inline int bpf_obj_get_user(const char __user *pathname)
	372	+{
	373	+ return -EOPNOTSUPP;
	374	+}
	375	+
371	376	static inline struct net_device __dev_map_lookup_elem(struct bpf_map map,
372	377	u32 key)
373	378	{

include/linux/netfilter_bridge/ebtables.h+4−3

@@ -108,9 +108,10 @@ struct ebt_table { · 107 unmodified lines
108	108
109	109	#define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
110	110	~(__alignof__(struct _xt_align)-1))
111		−extern struct ebt_table ebt_register_table(struct net net,
112		− const struct ebt_table *table,
113		− const struct nf_hook_ops *);
	111	+extern int ebt_register_table(struct net *net,
	112	+ const struct ebt_table *table,
	113	+ const struct nf_hook_ops *ops,
	114	+ struct ebt_table **res);
114	115	extern void ebt_unregister_table(struct net net, struct ebt_table table,
115	116	const struct nf_hook_ops *);
116	117	extern unsigned int ebt_do_table(struct sk_buff *skb,

include/uapi/linux/netfilter/xt_bpf.h+1−0

@@ -23,6 +23,7 @@ enum xt_bpf_modes { · 22 unmodified lines
23	23	XT_BPF_MODE_FD_PINNED,
24	24	XT_BPF_MODE_FD_ELF,
25	25	};
	26	+#define XT_BPF_MODE_PATH_PINNED XT_BPF_MODE_FD_PINNED
26	27
27	28	struct xt_bpf_info_v1 {
28	29	__u16 mode;

kernel/bpf/inode.c+1−0

@@ -363,6 +363,7 @@ out: · 362 unmodified lines
363	363	putname(pname);
364	364	return ret;
365	365	}
	366	+EXPORT_SYMBOL_GPL(bpf_obj_get_user);
366	367
367	368	static void bpf_evict_inode(struct inode *inode)
368	369	{

kernel/bpf/verifier.c+5−0

@@ -653,6 +653,10 @@ static void mark_reg_read(const struct bpf_verifier_state *state, u32 regno) · 652 unmodified lines
653	653	{
654	654	struct bpf_verifier_state *parent = state->parent;
655	655
	656	+ if (regno == BPF_REG_FP)
	657	+ /* We don't need to worry about FP liveness because it's read-only */
	658	+ return;
	659	+
656	660	while (parent) {
657	661	/* if read wasn't screened by an earlier write ... */
658	662	if (state->regs[regno].live & REG_LIVE_WRITTEN)
@@ -2345,6 +2349,7 @@ static int check_alu_op(struct bpf_verifier_env env, struct bpf_insn insn) · 1686 unmodified lines
2345	2349	* copy register state to dest reg
2346	2350	*/
2347	2351	regs[insn->dst_reg] = regs[insn->src_reg];
	2352	+ regs[insn->dst_reg].live \|= REG_LIVE_WRITTEN;
2348	2353	} else {
2349	2354	/* R1 = (u32) R2 */
2350	2355	if (is_pointer_value(env, insn->src_reg)) {

net/bridge/netfilter/ebtable_broute.c+2−2

@@ -65,8 +65,8 @@ static int ebt_broute(struct sk_buff *skb) · 64 unmodified lines
65	65
66	66	static int __net_init broute_net_init(struct net *net)
67	67	{
68		− net->xt.broute_table = ebt_register_table(net, &broute_table, NULL);
69		− return PTR_ERR_OR_ZERO(net->xt.broute_table);
	68	+ return ebt_register_table(net, &broute_table, NULL,
	69	+ &net->xt.broute_table);
70	70	}
71	71
72	72	static void __net_exit broute_net_exit(struct net *net)

net/bridge/netfilter/ebtable_filter.c+2−2

@@ -93,8 +93,8 @@ static const struct nf_hook_ops ebt_ops_filter[] = { · 92 unmodified lines
93	93
94	94	static int __net_init frame_filter_net_init(struct net *net)
95	95	{
96		− net->xt.frame_filter = ebt_register_table(net, &frame_filter, ebt_ops_filter);
97		− return PTR_ERR_OR_ZERO(net->xt.frame_filter);
	96	+ return ebt_register_table(net, &frame_filter, ebt_ops_filter,
	97	+ &net->xt.frame_filter);
98	98	}
99	99
100	100	static void __net_exit frame_filter_net_exit(struct net *net)

net/bridge/netfilter/ebtable_nat.c+2−2

@@ -93,8 +93,8 @@ static const struct nf_hook_ops ebt_ops_nat[] = { · 92 unmodified lines
93	93
94	94	static int __net_init frame_nat_net_init(struct net *net)
95	95	{
96		− net->xt.frame_nat = ebt_register_table(net, &frame_nat, ebt_ops_nat);
97		− return PTR_ERR_OR_ZERO(net->xt.frame_nat);
	96	+ return ebt_register_table(net, &frame_nat, ebt_ops_nat,
	97	+ &net->xt.frame_nat);
98	98	}
99	99
100	100	static void __net_exit frame_nat_net_exit(struct net *net)

net/bridge/netfilter/ebtables.c+9−8

@@ -1169,9 +1169,8 @@ static void __ebt_unregister_table(struct net net, struct ebt_table table) · 1168 unmodified lines
1169	1169	kfree(table);
1170	1170	}
1171	1171
1172		−struct ebt_table *
1173		−ebt_register_table(struct net net, const struct ebt_table input_table,
1174		− const struct nf_hook_ops *ops)
	1172	+int ebt_register_table(struct net net, const struct ebt_table input_table,
	1173	+ const struct nf_hook_ops ops, struct ebt_table *res)
1175	1174	{
1176	1175	struct ebt_table_info *newinfo;
1177	1176	struct ebt_table t, table;
@@ -1183,7 +1182,7 @@ ebt_register_table(struct net net, const struct ebt_table input_table, · 5 unmodified lines
1183	1182	repl->entries == NULL \|\| repl->entries_size == 0 \|\|
1184	1183	repl->counters != NULL \|\| input_table->private != NULL) {
1185	1184	BUGPRINT("Bad table data for ebt_register_table!!!\n");
1186		− return ERR_PTR(-EINVAL);
	1185	+ return -EINVAL;
1187	1186	}
1188	1187
1189	1188	/* Don't add one table to multiple lists. */
@@ -1252,16 +1251,18 @@ ebt_register_table(struct net net, const struct ebt_table input_table, · 62 unmodified lines
1252	1251	list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
1253	1252	mutex_unlock(&ebt_mutex);
1254	1253
	1254	+ WRITE_ONCE(*res, table);
	1255	+
1255	1256	if (!ops)
1256		− return table;
	1257	+ return 0;
1257	1258
1258	1259	ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
1259	1260	if (ret) {
1260	1261	__ebt_unregister_table(net, table);
1261		− return ERR_PTR(ret);
	1262	+ *res = NULL;
1262	1263	}
1263	1264
1264		− return table;
	1265	+ return ret;
1265	1266	free_unlock:
1266	1267	mutex_unlock(&ebt_mutex);
1267	1268	free_chainstack:
@@ -1276,7 +1277,7 @@ free_newinfo: · 8 unmodified lines
1276	1277	free_table:
1277	1278	kfree(table);
1278	1279	out:
1279		− return ERR_PTR(ret);
	1280	+ return ret;
1280	1281	}
1281	1282
1282	1283	void ebt_unregister_table(struct net net, struct ebt_table table,

net/ipv4/gre_offload.c+1−1

@@ -86,7 +86,7 @@ static struct sk_buff gre_gso_segment(struct sk_buff skb, · 85 unmodified lines
86	86	greh = (struct gre_base_hdr *)skb_transport_header(skb);
87	87	pcsum = (__sum16 *)(greh + 1);
88	88
89		− if (gso_partial) {
	89	+ if (gso_partial && skb_is_gso(skb)) {
90	90	unsigned int partial_adj;
91	91
92	92	/* Adjust checksum to account for the fact that

net/ipv4/netfilter/ipt_SYNPROXY.c+2−1

@@ -330,7 +330,8 @@ static unsigned int ipv4_synproxy_hook(void *priv, · 329 unmodified lines
330	330	if (synproxy == NULL)
331	331	return NF_ACCEPT;
332	332
333		− if (nf_is_loopback_packet(skb))
	333	+ if (nf_is_loopback_packet(skb) \|\|
	334	+ ip_hdr(skb)->protocol != IPPROTO_TCP)
334	335	return NF_ACCEPT;
335	336
336	337	thoff = ip_hdrlen(skb);

net/ipv4/route.c+1−1

@@ -2513,7 +2513,7 @@ struct dst_entry ipv4_blackhole_route(struct net net, struct dst_entry *dst_or · 2512 unmodified lines
2513	2513	struct rtable ort = (struct rtable ) dst_orig;
2514	2514	struct rtable *rt;
2515	2515
2516		− rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, 0);
	2516	+ rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_DEAD, 0);
2517	2517	if (rt) {
2518	2518	struct dst_entry *new = &rt->dst;
2519	2519

net/ipv4/udp.c+5−9

@@ -2240,20 +2240,16 @@ int udp_v4_early_demux(struct sk_buff *skb) · 2239 unmodified lines
2240	2240	iph = ip_hdr(skb);
2241	2241	uh = udp_hdr(skb);
2242	2242
2243		− if (skb->pkt_type == PACKET_BROADCAST \|\|
2244		− skb->pkt_type == PACKET_MULTICAST) {
	2243	+ if (skb->pkt_type == PACKET_MULTICAST) {
2245	2244	in_dev = __in_dev_get_rcu(skb->dev);
2246	2245
2247	2246	if (!in_dev)
2248	2247	return 0;
2249	2248
2250		− /* we are supposed to accept bcast packets */
2251		− if (skb->pkt_type == PACKET_MULTICAST) {
2252		− ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
2253		− iph->protocol);
2254		− if (!ours)
2255		− return 0;
2256		− }
	2249	+ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
	2250	+ iph->protocol);
	2251	+ if (!ours)
	2252	+ return 0;
2257	2253
2258	2254	sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
2259	2255	uh->source, iph->saddr,

net/ipv4/udp_offload.c+1−1

@@ -120,7 +120,7 @@ static struct sk_buff __skb_udp_tunnel_segment(struct sk_buff skb, · 119 unmodified lines
120	120	* will be using a length value equal to only one MSS sized
121	121	* segment instead of the entire frame.
122	122	*/
123		− if (gso_partial) {
	123	+ if (gso_partial && skb_is_gso(skb)) {
124	124	uh->len = htons(skb_shinfo(skb)->gso_size +
125	125	SKB_GSO_CB(skb)->data_offset +
126	126	skb->head - (unsigned char *)uh);

net/ipv6/addrconf.c+2−2

@@ -3820,8 +3820,8 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp) · 3819 unmodified lines
3820	3820	goto out;
3821	3821
3822	3822	if (dev->flags&(IFF_NOARP\|IFF_LOOPBACK) \|\|
3823		− dev_net(dev)->ipv6.devconf_all->accept_dad < 1 \|\|
3824		− idev->cnf.accept_dad < 1 \|\|
	3823	+ (dev_net(dev)->ipv6.devconf_all->accept_dad < 1 &&
	3824	+ idev->cnf.accept_dad < 1) \|\|
3825	3825	!(ifp->flags&IFA_F_TENTATIVE) \|\|
3826	3826	ifp->flags & IFA_F_NODAD) {
3827	3827	bump_id = ifp->flags & IFA_F_TENTATIVE;

net/ipv6/ip6_offload.c+1−1

@@ -105,7 +105,7 @@ static struct sk_buff ipv6_gso_segment(struct sk_buff skb, · 104 unmodified lines
105	105
106	106	for (skb = segs; skb; skb = skb->next) {
107	107	ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
108		− if (gso_partial)
	108	+ if (gso_partial && skb_is_gso(skb))
109	109	payload_len = skb_shinfo(skb)->gso_size +
110	110	SKB_GSO_CB(skb)->data_offset +
111	111	skb->head - (unsigned char *)(ipv6h + 1);

net/ipv6/netfilter/ip6t_SYNPROXY.c+1−1

@@ -353,7 +353,7 @@ static unsigned int ipv6_synproxy_hook(void *priv, · 352 unmodified lines
353	353	nexthdr = ipv6_hdr(skb)->nexthdr;
354	354	thoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
355	355	&frag_off);
356		− if (thoff < 0)
	356	+ if (thoff < 0 \|\| nexthdr != IPPROTO_TCP)
357	357	return NF_ACCEPT;
358	358
359	359	th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);

net/ipv6/route.c+1−1

@@ -1325,7 +1325,7 @@ struct dst_entry ip6_blackhole_route(struct net net, struct dst_entry *dst_ori · 1324 unmodified lines
1325	1325	struct dst_entry *new = NULL;
1326	1326
1327	1327	rt = dst_alloc(&ip6_dst_blackhole_ops, loopback_dev, 1,
1328		− DST_OBSOLETE_NONE, 0);
	1328	+ DST_OBSOLETE_DEAD, 0);
1329	1329	if (rt) {
1330	1330	rt6_info_init(rt);
1331	1331

net/netfilter/ipset/ip_set_core.c+18−11

@@ -1191,14 +1191,17 @@ static int ip_set_swap(struct net net, struct sock ctnl, struct sk_buff *skb, · 1190 unmodified lines
1191	1191	from->family == to->family))
1192	1192	return -IPSET_ERR_TYPE_MISMATCH;
1193	1193
1194		− if (from->ref_netlink \|\| to->ref_netlink)
	1194	+ write_lock_bh(&ip_set_ref_lock);
	1195	+
	1196	+ if (from->ref_netlink \|\| to->ref_netlink) {
	1197	+ write_unlock_bh(&ip_set_ref_lock);
1195	1198	return -EBUSY;
	1199	+ }
1196	1200
1197	1201	strncpy(from_name, from->name, IPSET_MAXNAMELEN);
1198	1202	strncpy(from->name, to->name, IPSET_MAXNAMELEN);
1199	1203	strncpy(to->name, from_name, IPSET_MAXNAMELEN);
1200	1204
1201		− write_lock_bh(&ip_set_ref_lock);
1202	1205	swap(from->ref, to->ref);
1203	1206	ip_set(inst, from_id) = to;
1204	1207	ip_set(inst, to_id) = from;
@@ -2072,25 +2075,28 @@ static struct pernet_operations ip_set_net_ops = { · 867 unmodified lines
2072	2075	static int __init
2073	2076	ip_set_init(void)
2074	2077	{
2075		− int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
	2078	+ int ret = register_pernet_subsys(&ip_set_net_ops);
	2079	+
	2080	+ if (ret) {
	2081	+ pr_err("ip_set: cannot register pernet_subsys.\n");
	2082	+ return ret;
	2083	+ }
2076	2084
	2085	+ ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
2077	2086	if (ret != 0) {
2078	2087	pr_err("ip_set: cannot register with nfnetlink.\n");
	2088	+ unregister_pernet_subsys(&ip_set_net_ops);
2079	2089	return ret;
2080	2090	}
	2091	+
2081	2092	ret = nf_register_sockopt(&so_set);
2082	2093	if (ret != 0) {
2083	2094	pr_err("SO_SET registry failed: %d\n", ret);
2084	2095	nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
	2096	+ unregister_pernet_subsys(&ip_set_net_ops);
2085	2097	return ret;
2086	2098	}
2087		− ret = register_pernet_subsys(&ip_set_net_ops);
2088		− if (ret) {
2089		− pr_err("ip_set: cannot register pernet_subsys.\n");
2090		− nf_unregister_sockopt(&so_set);
2091		− nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
2092		− return ret;
2093		− }
	2099	+
2094	2100	pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
2095	2101	return 0;
2096	2102	}
@@ -2098,9 +2104,10 @@ ip_set_init(void) · 1 unmodified line
2098	2104	static void __exit
2099	2105	ip_set_fini(void)
2100	2106	{
2101		− unregister_pernet_subsys(&ip_set_net_ops);
2102	2107	nf_unregister_sockopt(&so_set);
2103	2108	nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
	2109	+
	2110	+ unregister_pernet_subsys(&ip_set_net_ops);
2104	2111	pr_debug("these are the famous last words\n");
2105	2112	}
2106	2113

net/netfilter/ipset/ip_set_hash_ip.c+12−10

@@ -123,13 +123,12 @@ hash_ip4_uadt(struct ip_set set, struct nlattr tb[], · 122 unmodified lines
123	123	return ret;
124	124
125	125	ip &= ip_set_hostmask(h->netmask);
	126	+ e.ip = htonl(ip);
	127	+ if (e.ip == 0)
	128	+ return -IPSET_ERR_HASH_ELEM;
126	129
127		− if (adt == IPSET_TEST) {
128		− e.ip = htonl(ip);
129		− if (e.ip == 0)
130		− return -IPSET_ERR_HASH_ELEM;
	130	+ if (adt == IPSET_TEST)
131	131	return adtfn(set, &e, &ext, &ext, flags);
132		− }
133	132
134	133	ip_to = ip;
135	134	if (tb[IPSET_ATTR_IP_TO]) {
@@ -148,17 +147,20 @@ hash_ip4_uadt(struct ip_set set, struct nlattr tb[], · 12 unmodified lines
148	147
149	148	hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);
150	149
151		− if (retried)
	150	+ if (retried) {
152	151	ip = ntohl(h->next.ip);
153		− for (; !before(ip_to, ip); ip += hosts) {
154	152	e.ip = htonl(ip);
155		− if (e.ip == 0)
156		− return -IPSET_ERR_HASH_ELEM;
	153	+ }
	154	+ for (; ip <= ip_to;) {
157	155	ret = adtfn(set, &e, &ext, &ext, flags);
158		−
159	156	if (ret && !ip_set_eexist(ret, flags))
160	157	return ret;
161	158
	159	+ ip += hosts;
	160	+ e.ip = htonl(ip);
	161	+ if (e.ip == 0)
	162	+ return 0;
	163	+
162	164	ret = 0;
163	165	}
164	166	return ret;

net/netfilter/ipset/ip_set_hash_ipmark.c+1−1

@@ -149,7 +149,7 @@ hash_ipmark4_uadt(struct ip_set set, struct nlattr tb[], · 148 unmodified lines
149	149
150	150	if (retried)
151	151	ip = ntohl(h->next.ip);
152		− for (; !before(ip_to, ip); ip++) {
	152	+ for (; ip <= ip_to; ip++) {
153	153	e.ip = htonl(ip);
154	154	ret = adtfn(set, &e, &ext, &ext, flags);
155	155

net/netfilter/ipset/ip_set_hash_ipport.c+1−1

@@ -178,7 +178,7 @@ hash_ipport4_uadt(struct ip_set set, struct nlattr tb[], · 177 unmodified lines
178	178
179	179	if (retried)
180	180	ip = ntohl(h->next.ip);
181		− for (; !before(ip_to, ip); ip++) {
	181	+ for (; ip <= ip_to; ip++) {
182	182	p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
183	183	: port;
184	184	for (; p <= port_to; p++) {

net/netfilter/ipset/ip_set_hash_ipportip.c+1−1

@@ -185,7 +185,7 @@ hash_ipportip4_uadt(struct ip_set set, struct nlattr tb[], · 184 unmodified lines
185	185
186	186	if (retried)
187	187	ip = ntohl(h->next.ip);
188		− for (; !before(ip_to, ip); ip++) {
	188	+ for (; ip <= ip_to; ip++) {
189	189	p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
190	190	: port;
191	191	for (; p <= port_to; p++) {

net/netfilter/ipset/ip_set_hash_ipportnet.c+2−2

@@ -271,7 +271,7 @@ hash_ipportnet4_uadt(struct ip_set set, struct nlattr tb[], · 270 unmodified lines
271	271
272	272	if (retried)
273	273	ip = ntohl(h->next.ip);
274		− for (; !before(ip_to, ip); ip++) {
	274	+ for (; ip <= ip_to; ip++) {
275	275	e.ip = htonl(ip);
276	276	p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
277	277	: port;
@@ -281,7 +281,7 @@ hash_ipportnet4_uadt(struct ip_set set, struct nlattr tb[], · 3 unmodified lines
281	281	ip == ntohl(h->next.ip) &&
282	282	p == ntohs(h->next.port)
283	283	? ntohl(h->next.ip2) : ip2_from;
284		− while (!after(ip2, ip2_to)) {
	284	+ while (ip2 <= ip2_to) {
285	285	e.ip2 = htonl(ip2);
286	286	ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
287	287	&cidr);

net/netfilter/ipset/ip_set_hash_net.c+1−1

@@ -193,7 +193,7 @@ hash_net4_uadt(struct ip_set set, struct nlattr tb[], · 192 unmodified lines
193	193	}
194	194	if (retried)
195	195	ip = ntohl(h->next.ip);
196		− while (!after(ip, ip_to)) {
	196	+ while (ip <= ip_to) {
197	197	e.ip = htonl(ip);
198	198	last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
199	199	ret = adtfn(set, &e, &ext, &ext, flags);

net/netfilter/ipset/ip_set_hash_netiface.c+1−1

@@ -255,7 +255,7 @@ hash_netiface4_uadt(struct ip_set set, struct nlattr tb[], · 254 unmodified lines
255	255
256	256	if (retried)
257	257	ip = ntohl(h->next.ip);
258		− while (!after(ip, ip_to)) {
	258	+ while (ip <= ip_to) {
259	259	e.ip = htonl(ip);
260	260	last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
261	261	ret = adtfn(set, &e, &ext, &ext, flags);

net/netfilter/ipset/ip_set_hash_netnet.c+2−2

@@ -250,13 +250,13 @@ hash_netnet4_uadt(struct ip_set set, struct nlattr tb[], · 249 unmodified lines
250	250	if (retried)
251	251	ip = ntohl(h->next.ip[0]);
252	252
253		− while (!after(ip, ip_to)) {
	253	+ while (ip <= ip_to) {
254	254	e.ip[0] = htonl(ip);
255	255	last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
256	256	ip2 = (retried &&
257	257	ip == ntohl(h->next.ip[0])) ? ntohl(h->next.ip[1])
258	258	: ip2_from;
259		− while (!after(ip2, ip2_to)) {
	259	+ while (ip2 <= ip2_to) {
260	260	e.ip[1] = htonl(ip2);
261	261	last2 = ip_set_range_to_cidr(ip2, ip2_to, &e.cidr[1]);
262	262	ret = adtfn(set, &e, &ext, &ext, flags);

net/netfilter/ipset/ip_set_hash_netport.c+1−1

@@ -241,7 +241,7 @@ hash_netport4_uadt(struct ip_set set, struct nlattr tb[], · 240 unmodified lines
241	241
242	242	if (retried)
243	243	ip = ntohl(h->next.ip);
244		− while (!after(ip, ip_to)) {
	244	+ while (ip <= ip_to) {
245	245	e.ip = htonl(ip);
246	246	last = ip_set_range_to_cidr(ip, ip_to, &cidr);
247	247	e.cidr = cidr - 1;

net/netfilter/ipset/ip_set_hash_netportnet.c+2−2

@@ -291,7 +291,7 @@ hash_netportnet4_uadt(struct ip_set set, struct nlattr tb[], · 290 unmodified lines
291	291	if (retried)
292	292	ip = ntohl(h->next.ip[0]);
293	293
294		− while (!after(ip, ip_to)) {
	294	+ while (ip <= ip_to) {
295	295	e.ip[0] = htonl(ip);
296	296	ip_last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
297	297	p = retried && ip == ntohl(h->next.ip[0]) ? ntohs(h->next.port)
@@ -301,7 +301,7 @@ hash_netportnet4_uadt(struct ip_set set, struct nlattr tb[], · 3 unmodified lines
301	301	ip2 = (retried && ip == ntohl(h->next.ip[0]) &&
302	302	p == ntohs(h->next.port)) ? ntohl(h->next.ip[1])
303	303	: ip2_from;
304		− while (!after(ip2, ip2_to)) {
	304	+ while (ip2 <= ip2_to) {
305	305	e.ip[1] = htonl(ip2);
306	306	ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
307	307	&e.cidr[1]);

net/netfilter/ipvs/ip_vs_xmit.c+6−2

@@ -921,6 +921,7 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af, · 920 unmodified lines
921	921	{
922	922	struct sk_buff *new_skb = NULL;
923	923	struct iphdr *old_iph = NULL;
	924	+ __u8 old_dsfield;
924	925	#ifdef CONFIG_IP_VS_IPV6
925	926	struct ipv6hdr *old_ipv6h = NULL;
926	927	#endif
@@ -945,7 +946,7 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af, · 18 unmodified lines
945	946	*payload_len =
946	947	ntohs(old_ipv6h->payload_len) +
947	948	sizeof(*old_ipv6h);
948		− *dsfield = ipv6_get_dsfield(old_ipv6h);
	949	+ old_dsfield = ipv6_get_dsfield(old_ipv6h);
949	950	*ttl = old_ipv6h->hop_limit;
950	951	if (df)
951	952	*df = 0;
@@ -960,12 +961,15 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af, · 8 unmodified lines
960	961
961	962	/* fix old IP header checksum */
962	963	ip_send_check(old_iph);
963		− *dsfield = ipv4_get_dsfield(old_iph);
	964	+ old_dsfield = ipv4_get_dsfield(old_iph);
964	965	*ttl = old_iph->ttl;
965	966	if (payload_len)
966	967	*payload_len = ntohs(old_iph->tot_len);
967	968	}
968	969
	970	+ /* Implement full-functionality option for ECN encapsulation */
	971	+ *dsfield = INET_ECN_encapsulate(old_dsfield, old_dsfield);
	972	+
969	973	return skb;
970	974	error:
971	975	kfree_skb(skb);

net/netfilter/nf_tables_api.c+6−4

@@ -1048,7 +1048,7 @@ static int nf_tables_fill_chain_info(struct sk_buff skb, struct net net, · 1047 unmodified lines
1048	1048	if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
1049	1049	goto nla_put_failure;
1050	1050
1051		− if (nft_dump_stats(skb, nft_base_chain(chain)->stats))
	1051	+ if (basechain->stats && nft_dump_stats(skb, basechain->stats))
1052	1052	goto nla_put_failure;
1053	1053	}
1054	1054
@@ -1487,8 +1487,8 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy, · 432 unmodified lines
1487	1487
1488	1488	chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
1489	1489	genmask);
1490		− if (IS_ERR(chain2))
1491		− return PTR_ERR(chain2);
	1490	+ if (!IS_ERR(chain2))
	1491	+ return -EEXIST;
1492	1492	}
1493	1493
1494	1494	if (nla[NFTA_CHAIN_COUNTERS]) {
@@ -2741,8 +2741,10 @@ cont: · 1246 unmodified lines
2741	2741	list_for_each_entry(i, &ctx->table->sets, list) {
2742	2742	if (!nft_is_active_next(ctx->net, i))
2743	2743	continue;
2744		− if (!strcmp(set->name, i->name))
	2744	+ if (!strcmp(set->name, i->name)) {
	2745	+ kfree(set->name);
2745	2746	return -ENFILE;
	2747	+ }
2746	2748	}
2747	2749	return 0;
2748	2750	}

net/netfilter/x_tables.c+2−2

@@ -892,7 +892,7 @@ void xt_copy_counters_from_user(const void __user user, unsigned int len, · 891 unmodified lines
892	892	if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0)
893	893	return ERR_PTR(-EFAULT);
894	894
895		− strlcpy(info->name, compat_tmp.name, sizeof(info->name));
	895	+ memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1);
896	896	info->num_counters = compat_tmp.num_counters;
897	897	user += sizeof(compat_tmp);
898	898	} else
@@ -905,9 +905,9 @@ void xt_copy_counters_from_user(const void __user user, unsigned int len, · 6 unmodified lines
905	905	if (copy_from_user(info, user, sizeof(*info)) != 0)
906	906	return ERR_PTR(-EFAULT);
907	907
908		− info->name[sizeof(info->name) - 1] = '\0';
909	908	user += sizeof(*info);
910	909	}
	910	+ info->name[sizeof(info->name) - 1] = '\0';
911	911
912	912	size = sizeof(struct xt_counters);
913	913	size *= info->num_counters;

net/netfilter/xt_bpf.c+20−2

@@ -8,6 +8,7 @@ · 7 unmodified lines
8	8	*/
9	9
10	10	#include <linux/module.h>
	11	+#include <linux/syscalls.h>
11	12	#include <linux/skbuff.h>
12	13	#include <linux/filter.h>
13	14	#include <linux/bpf.h>
@@ -49,6 +50,22 @@ static int __bpf_mt_check_fd(int fd, struct bpf_prog **ret) · 35 unmodified lines
49	50	return 0;
50	51	}
51	52
	53	+static int __bpf_mt_check_path(const char path, struct bpf_prog *ret)
	54	+{
	55	+ mm_segment_t oldfs = get_fs();
	56	+ int retval, fd;
	57	+
	58	+ set_fs(KERNEL_DS);
	59	+ fd = bpf_obj_get_user(path);
	60	+ set_fs(oldfs);
	61	+ if (fd < 0)
	62	+ return fd;
	63	+
	64	+ retval = __bpf_mt_check_fd(fd, ret);
	65	+ sys_close(fd);
	66	+ return retval;
	67	+}
	68	+
52	69	static int bpf_mt_check(const struct xt_mtchk_param *par)
53	70	{
54	71	struct xt_bpf_info *info = par->matchinfo;
@@ -66,9 +83,10 @@ static int bpf_mt_check_v1(const struct xt_mtchk_param *par) · 11 unmodified lines
66	83	return __bpf_mt_check_bytecode(info->bpf_program,
67	84	info->bpf_program_num_elem,
68	85	&info->filter);
69		− else if (info->mode == XT_BPF_MODE_FD_PINNED \|\|
70		− info->mode == XT_BPF_MODE_FD_ELF)
	86	+ else if (info->mode == XT_BPF_MODE_FD_ELF)
71	87	return __bpf_mt_check_fd(info->fd, &info->filter);
	88	+ else if (info->mode == XT_BPF_MODE_PATH_PINNED)
	89	+ return __bpf_mt_check_path(info->path, &info->filter);
72	90	else
73	91	return -EINVAL;
74	92	}

net/netfilter/xt_socket.c+2−2

@@ -76,7 +76,7 @@ socket_match(const struct sk_buff skb, struct xt_action_param par, · 75 unmodified lines
76	76	transparent = nf_sk_is_transparent(sk);
77	77
78	78	if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
79		− transparent)
	79	+ transparent && sk_fullsock(sk))
80	80	pskb->mark = sk->sk_mark;
81	81
82	82	if (sk != skb->sk)
@@ -133,7 +133,7 @@ socket_mt6_v1_v2_v3(const struct sk_buff skb, struct xt_action_param par) · 50 unmodified lines
133	133	transparent = nf_sk_is_transparent(sk);
134	134
135	135	if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
136		− transparent)
	136	+ transparent && sk_fullsock(sk))
137	137	pskb->mark = sk->sk_mark;
138	138
139	139	if (sk != skb->sk)

net/netlink/af_netlink.c+7−6

@@ -2266,16 +2266,17 @@ int __netlink_dump_start(struct sock ssk, struct sk_buff skb, · 2265 unmodified lines
2266	2266	cb->min_dump_alloc = control->min_dump_alloc;
2267	2267	cb->skb = skb;
2268	2268
	2269	+ if (cb->start) {
	2270	+ ret = cb->start(cb);
	2271	+ if (ret)
	2272	+ goto error_unlock;
	2273	+ }
	2274	+
2269	2275	nlk->cb_running = true;
2270	2276
2271	2277	mutex_unlock(nlk->cb_mutex);
2272	2278
2273		− ret = 0;
2274		− if (cb->start)
2275		− ret = cb->start(cb);
2276		−
2277		− if (!ret)
2278		− ret = netlink_dump(sk);
	2279	+ ret = netlink_dump(sk);
2279	2280
2280	2281	sock_put(sk);
2281	2282

net/tipc/bcast.c+2−2

@@ -233,7 +233,7 @@ static int tipc_bcast_xmit(struct net net, struct sk_buff_head pkts, · 232 unmodified lines
233	233	struct sk_buff_head xmitq;
234	234	int rc = 0;
235	235
236		− __skb_queue_head_init(&xmitq);
	236	+ skb_queue_head_init(&xmitq);
237	237	tipc_bcast_lock(net);
238	238	if (tipc_link_bc_peers(l))
239	239	rc = tipc_link_xmit(l, pkts, &xmitq);
@@ -263,7 +263,7 @@ static int tipc_rcast_xmit(struct net net, struct sk_buff_head pkts, · 23 unmodified lines
263	263	u32 dst, selector;
264	264
265	265	selector = msg_link_selector(buf_msg(skb_peek(pkts)));
266		− __skb_queue_head_init(&_pkts);
	266	+ skb_queue_head_init(&_pkts);
267	267
268	268	list_for_each_entry_safe(n, tmp, &dests->list, list) {
269	269	dst = n->value;

net/tipc/msg.c+8−0

@@ -568,6 +568,14 @@ bool tipc_msg_lookup_dest(struct net net, struct sk_buff skb, int *err) · 567 unmodified lines
568	568	msg_set_destnode(msg, dnode);
569	569	msg_set_destport(msg, dport);
570	570	*err = TIPC_OK;
	571	+
	572	+ if (!skb_cloned(skb))
	573	+ return true;
	574	+
	575	+ /* Unclone buffer in case it was bundled */
	576	+ if (pskb_expand_head(skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
	577	+ return false;
	578	+
571	579	return true;
572	580	}
573	581

net/wireless/nl80211.c+12−2

@@ -549,6 +549,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = { · 548 unmodified lines
549	549	[NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
550	550	};
551	551
	552	+/* policy for packet pattern attributes */
	553	+static const struct nla_policy
	554	+nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
	555	+ [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
	556	+ [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
	557	+ [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
	558	+};
	559	+
552	560	static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
553	561	struct netlink_callback *cb,
554	562	struct cfg80211_registered_device **rdev,
@@ -10532,7 +10540,8 @@ static int nl80211_set_wowlan(struct sk_buff skb, struct genl_info info) · 9977 unmodified lines
10532	10540	u8 *mask_pat;
10533	10541
10534	10542	nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10535		− NULL, info->extack);
	10543	+ nl80211_packet_pattern_policy,
	10544	+ info->extack);
10536	10545	err = -EINVAL;
10537	10546	if (!pat_tb[NL80211_PKTPAT_MASK] \|\|
10538	10547	!pat_tb[NL80211_PKTPAT_PATTERN])
@@ -10781,7 +10790,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev, · 242 unmodified lines
10781	10790	rem) {
10782	10791	u8 *mask_pat;
10783	10792
10784		− nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL, NULL);
	10793	+ nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
	10794	+ nl80211_packet_pattern_policy, NULL);
10785	10795	if (!pat_tb[NL80211_PKTPAT_MASK] \|\|
10786	10796	!pat_tb[NL80211_PKTPAT_PATTERN])
10787	10797	return -EINVAL;

net/xfrm/xfrm_device.c+1−0

@@ -91,6 +91,7 @@ int xfrm_dev_state_add(struct net net, struct xfrm_state x, · 90 unmodified lines
91	91	}
92	92
93	93	if (!dev->xfrmdev_ops \|\| !dev->xfrmdev_ops->xdo_dev_state_add) {
	94	+ xso->dev = NULL;
94	95	dev_put(dev);
95	96	return 0;
96	97	}

net/xfrm/xfrm_input.c+4−2

@@ -429,7 +429,8 @@ resume: · 428 unmodified lines
429	429	nf_reset(skb);
430	430
431	431	if (decaps) {
432		− skb->sp->olen = 0;
	432	+ if (skb->sp)
	433	+ skb->sp->olen = 0;
433	434	skb_dst_drop(skb);
434	435	gro_cells_receive(&gro_cells, skb);
435	436	return 0;
@@ -440,7 +441,8 @@ resume: · 4 unmodified lines
440	441
441	442	err = x->inner_mode->afinfo->transport_finish(skb, xfrm_gro \|\| async);
442	443	if (xfrm_gro) {
443		− skb->sp->olen = 0;
	444	+ if (skb->sp)
	445	+ skb->sp->olen = 0;
444	446	skb_dst_drop(skb);
445	447	gro_cells_receive(&gro_cells, skb);
446	448	return err;

net/xfrm/xfrm_state.c+2−2

@@ -732,12 +732,12 @@ restart: · 731 unmodified lines
732	732	}
733	733	}
734	734	}
	735	+out:
	736	+ spin_unlock_bh(&net->xfrm.xfrm_state_lock);
735	737	if (cnt) {
736	738	err = 0;
737	739	xfrm_policy_cache_flush();
738	740	}
739		−out:
740		− spin_unlock_bh(&net->xfrm.xfrm_state_lock);
741	741	return err;
742	742	}
743	743	EXPORT_SYMBOL(xfrm_state_flush);

net/xfrm/xfrm_user.c+1−0

@@ -657,6 +657,7 @@ static int xfrm_add_sa(struct sk_buff skb, struct nlmsghdr nlh, · 656 unmodified lines
657	657
658	658	if (err < 0) {
659	659	x->km.state = XFRM_STATE_DEAD;
	660	+ xfrm_dev_state_delete(x);
660	661	__xfrm_state_put(x);
661	662	goto out;
662	663	}

tools/testing/selftests/networking/timestamping/rxtimestamp.c+1−1

@@ -341,7 +341,7 @@ int main(int argc, char **argv) · 340 unmodified lines
341	341	return 0;
342	342	case 'n':
343	343	t = atoi(optarg);
344		− if (t > ARRAY_SIZE(test_cases))
	344	+ if (t >= ARRAY_SIZE(test_cases))
345	345	error(1, 0, "Invalid test case: %d", t);
346	346	all_tests = false;
347	347	test_cases[t].enabled = true;