--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: "Toke Høiland-Jørgensen" <toke@toke.dk>
+Date: Mon, 2 Jul 2018 22:52:20 +0200
+Subject: gen_stats: Fix netlink stats dumping in the presence of padding
+
+From: "Toke Høiland-Jørgensen" <toke@toke.dk>
+
+[ Upstream commit d5a672ac9f48f81b20b1cad1d9ed7bbf4e418d4c ]
+
+The gen_stats facility will add a header for the toplevel nlattr of type
+TCA_STATS2 that contains all stats added by qdisc callbacks. A reference
+to this header is stored in the gnet_dump struct, and when all the
+per-qdisc callbacks have finished adding their stats, the length of the
+containing header will be adjusted to the right value.
+
+However, on architectures that need padding (i.e., that don't set
+CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS), the padding nlattr is added
+before the stats, which means that the stored pointer will point to the
+padding, and so when the header is fixed up, the result is just a very
+big padding nlattr. Because most qdiscs also supply the legacy TCA_STATS
+struct, this problem has been mostly invisible, but we exposed it with
+the netlink attribute-based statistics in CAKE.
+
+Fix the issue by fixing up the stored pointer if it points to a padding
+nlattr.
+
+Tested-by: Pete Heist <pete@heistp.net>
+Tested-by: Kevin Darbyshire-Bryant <kevin@darbyshire-bryant.me.uk>
+Signed-off-by: Toke Høiland-Jørgensen <toke@toke.dk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/gen_stats.c | 16 ++++++++++++++--
+ 1 file changed, 14 insertions(+), 2 deletions(-)
+
+--- a/net/core/gen_stats.c
++++ b/net/core/gen_stats.c
+@@ -77,8 +77,20 @@ gnet_stats_start_copy_compat(struct sk_b
+ d->lock = lock;
+ spin_lock_bh(lock);
+ }
+- if (d->tail)
+- return gnet_stats_copy(d, type, NULL, 0, padattr);
++ if (d->tail) {
++ int ret = gnet_stats_copy(d, type, NULL, 0, padattr);
++
++ /* The initial attribute added in gnet_stats_copy() may be
++ * preceded by a padding attribute, in which case d->tail will
++ * end up pointing at the padding instead of the real attribute.
++ * Fix this so gnet_stats_finish_copy() adjusts the length of
++ * the right attribute.
++ */
++ if (ret == 0 && d->tail->nla_type == padattr)
++ d->tail = (struct nlattr *)((char *)d->tail +
++ NLA_ALIGN(d->tail->nla_len));
++ return ret;
++ }
+
+ return 0;
+ }
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Haiyang Zhang <haiyangz@microsoft.com>
+Date: Tue, 17 Jul 2018 17:11:13 +0000
+Subject: hv_netvsc: Fix napi reschedule while receive completion is busy
+
+From: Haiyang Zhang <haiyangz@microsoft.com>
+
+[ Upstream commit 6b81b193b83e87da1ea13217d684b54fccf8ee8a ]
+
+If out ring is full temporarily and receive completion cannot go out,
+we may still need to reschedule napi if certain conditions are met.
+Otherwise the napi poll might be stopped forever, and cause network
+disconnect.
+
+Fixes: 7426b1a51803 ("netvsc: optimize receive completions")
+Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
+Signed-off-by: Haiyang Zhang <haiyangz@microsoft.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/hyperv/netvsc.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/net/hyperv/netvsc.c
++++ b/drivers/net/hyperv/netvsc.c
+@@ -1250,6 +1250,7 @@ int netvsc_poll(struct napi_struct *napi
+ struct hv_device *device = netvsc_channel_to_device(channel);
+ struct net_device *ndev = hv_get_drvdata(device);
+ int work_done = 0;
++ int ret;
+
+ /* If starting a new interval */
+ if (!nvchan->desc)
+@@ -1261,16 +1262,18 @@ int netvsc_poll(struct napi_struct *napi
+ nvchan->desc = hv_pkt_iter_next(channel, nvchan->desc);
+ }
+
+- /* If send of pending receive completions suceeded
+- * and did not exhaust NAPI budget this time
+- * and not doing busy poll
++ /* Send any pending receive completions */
++ ret = send_recv_completions(ndev, net_device, nvchan);
++
++ /* If it did not exhaust NAPI budget this time
++ * and not doing busy poll
+ * then re-enable host interrupts
+- * and reschedule if ring is not empty.
++ * and reschedule if ring is not empty
++ * or sending receive completion failed.
+ */
+- if (send_recv_completions(ndev, net_device, nvchan) == 0 &&
+- work_done < budget &&
++ if (work_done < budget &&
+ napi_complete_done(napi, work_done) &&
+- hv_end_read(&channel->inbound) &&
++ (ret || hv_end_read(&channel->inbound)) &&
+ napi_schedule_prep(napi)) {
+ hv_begin_read(&channel->inbound);
+ __napi_schedule(napi);
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Tyler Hicks <tyhicks@canonical.com>
+Date: Thu, 5 Jul 2018 18:49:23 +0000
+Subject: ipv4: Return EINVAL when ping_group_range sysctl doesn't map to user ns
+
+From: Tyler Hicks <tyhicks@canonical.com>
+
+[ Upstream commit 70ba5b6db96ff7324b8cfc87e0d0383cf59c9677 ]
+
+The low and high values of the net.ipv4.ping_group_range sysctl were
+being silently forced to the default disabled state when a write to the
+sysctl contained GIDs that didn't map to the associated user namespace.
+Confusingly, the sysctl's write operation would return success and then
+a subsequent read of the sysctl would indicate that the low and high
+values are the overflowgid.
+
+This patch changes the behavior by clearly returning an error when the
+sysctl write operation receives a GID range that doesn't map to the
+associated user namespace. In such a situation, the previous value of
+the sysctl is preserved and that range will be returned in a subsequent
+read of the sysctl.
+
+Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/sysctl_net_ipv4.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/net/ipv4/sysctl_net_ipv4.c
++++ b/net/ipv4/sysctl_net_ipv4.c
+@@ -186,8 +186,9 @@ static int ipv4_ping_group_range(struct
+ if (write && ret == 0) {
+ low = make_kgid(user_ns, urange[0]);
+ high = make_kgid(user_ns, urange[1]);
+- if (!gid_valid(low) || !gid_valid(high) ||
+- (urange[1] < urange[0]) || gid_lt(high, low)) {
++ if (!gid_valid(low) || !gid_valid(high))
++ return -EINVAL;
++ if (urange[1] < urange[0] || gid_lt(high, low)) {
+ low = make_kgid(&init_user_ns, 1);
+ high = make_kgid(&init_user_ns, 0);
+ }
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Colin Ian King <colin.king@canonical.com>
+Date: Tue, 17 Jul 2018 17:12:39 +0100
+Subject: ipv6: fix useless rol32 call on hash
+
+From: Colin Ian King <colin.king@canonical.com>
+
+[ Upstream commit 169dc027fb02492ea37a0575db6a658cf922b854 ]
+
+The rol32 call is currently rotating hash but the rol'd value is
+being discarded. I believe the current code is incorrect and hash
+should be assigned the rotated value returned from rol32.
+
+Thanks to David Lebrun for spotting this.
+
+Signed-off-by: Colin Ian King <colin.king@canonical.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/ipv6.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/include/net/ipv6.h
++++ b/include/net/ipv6.h
+@@ -795,7 +795,7 @@ static inline __be32 ip6_make_flowlabel(
+ * to minimize possbility that any useful information to an
+ * attacker is leaked. Only lower 20 bits are relevant.
+ */
+- rol32(hash, 16);
++ hash = rol32(hash, 16);
+
+ flowlabel = (__force __be32)hash & IPV6_FLOWLABEL_MASK;
+
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 18 Jul 2018 10:48:56 +0200
+Subject: ipv6: ila: select CONFIG_DST_CACHE
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+[ Upstream commit 83ed7d1fe2d2d4a11b30660dec20168bb473d9c1 ]
+
+My randconfig builds came across an old missing dependency for ILA:
+
+ERROR: "dst_cache_set_ip6" [net/ipv6/ila/ila.ko] undefined!
+ERROR: "dst_cache_get" [net/ipv6/ila/ila.ko] undefined!
+ERROR: "dst_cache_init" [net/ipv6/ila/ila.ko] undefined!
+ERROR: "dst_cache_destroy" [net/ipv6/ila/ila.ko] undefined!
+
+We almost never run into this by accident because randconfig builds
+end up selecting DST_CACHE from some other tunnel protocol, and this
+one appears to be the only one missing the explicit 'select'.
+
+>From all I can tell, this problem first appeared in linux-4.9
+when dst_cache support got added to ILA.
+
+Fixes: 79ff2fc31e0f ("ila: Cache a route to translated address")
+Cc: Tom Herbert <tom@herbertland.com>
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/Kconfig | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv6/Kconfig
++++ b/net/ipv6/Kconfig
+@@ -109,6 +109,7 @@ config IPV6_MIP6
+ config IPV6_ILA
+ tristate "IPv6: Identifier Locator Addressing (ILA)"
+ depends on NETFILTER
++ select DST_CACHE
+ select LWTUNNEL
+ ---help---
+ Support for IPv6 Identifier Locator Addressing (ILA).
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Sabrina Dubroca <sd@queasysnail.net>
+Date: Fri, 13 Jul 2018 17:21:42 +0200
+Subject: ipv6: make DAD fail with enhanced DAD when nonce length differs
+
+From: Sabrina Dubroca <sd@queasysnail.net>
+
+[ Upstream commit e66515999b627368892ccc9b3a13a506f2ea1357 ]
+
+Commit adc176c54722 ("ipv6 addrconf: Implemented enhanced DAD (RFC7527)")
+added enhanced DAD with a nonce length of 6 bytes. However, RFC7527
+doesn't specify the length of the nonce, other than being 6 + 8*k bytes,
+with integer k >= 0 (RFC3971 5.3.2). The current implementation simply
+assumes that the nonce will always be 6 bytes, but others systems are
+free to choose different sizes.
+
+If another system sends a nonce of different length but with the same 6
+bytes prefix, it shouldn't be considered as the same nonce. Thus, check
+that the length of the received nonce is the same as the length we sent.
+
+Ugly scapy test script running on veth0:
+
+def loop():
+ pkt=sniff(iface="veth0", filter="icmp6", count=1)
+ pkt = pkt[0]
+ b = bytearray(pkt[Raw].load)
+ b[1] += 1
+ b += b'\xde\xad\xbe\xef\xde\xad\xbe\xef'
+ pkt[Raw].load = bytes(b)
+ pkt[IPv6].plen += 8
+ # fixup checksum after modifying the payload
+ pkt[IPv6].payload.cksum -= 0x3b44
+ if pkt[IPv6].payload.cksum < 0:
+ pkt[IPv6].payload.cksum += 0xffff
+ sendp(pkt, iface="veth0")
+
+This should result in DAD failure for any address added to veth0's peer,
+but is currently ignored.
+
+Fixes: adc176c54722 ("ipv6 addrconf: Implemented enhanced DAD (RFC7527)")
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/ndisc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/ipv6/ndisc.c
++++ b/net/ipv6/ndisc.c
+@@ -803,7 +803,7 @@ static void ndisc_recv_ns(struct sk_buff
+ return;
+ }
+ }
+- if (ndopts.nd_opts_nonce)
++ if (ndopts.nd_opts_nonce && ndopts.nd_opts_nonce->nd_opt_len == 1)
+ memcpy(&nonce, (u8 *)(ndopts.nd_opts_nonce + 1), 6);
+
+ inc = ipv6_addr_is_multicast(daddr);
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Davidlohr Bueso <dave@stgolabs.net>
+Date: Mon, 16 Jul 2018 13:26:13 -0700
+Subject: lib/rhashtable: consider param->min_size when setting initial table size
+
+From: Davidlohr Bueso <dave@stgolabs.net>
+
+[ Upstream commit 107d01f5ba10f4162c38109496607eb197059064 ]
+
+rhashtable_init() currently does not take into account the user-passed
+min_size parameter unless param->nelem_hint is set as well. As such,
+the default size (number of buckets) will always be HASH_DEFAULT_SIZE
+even if the smallest allowed size is larger than that. Remediate this
+by unconditionally calling into rounded_hashtable_size() and handling
+things accordingly.
+
+Signed-off-by: Davidlohr Bueso <dbueso@suse.de>
+Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ lib/rhashtable.c | 17 +++++++++++------
+ 1 file changed, 11 insertions(+), 6 deletions(-)
+
+--- a/lib/rhashtable.c
++++ b/lib/rhashtable.c
+@@ -878,8 +878,16 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_stop);
+
+ static size_t rounded_hashtable_size(const struct rhashtable_params *params)
+ {
+- return max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
+- (unsigned long)params->min_size);
++ size_t retsize;
++
++ if (params->nelem_hint)
++ retsize = max(roundup_pow_of_two(params->nelem_hint * 4 / 3),
++ (unsigned long)params->min_size);
++ else
++ retsize = max(HASH_DEFAULT_SIZE,
++ (unsigned long)params->min_size);
++
++ return retsize;
+ }
+
+ static u32 rhashtable_jhash2(const void *key, u32 length, u32 seed)
+@@ -936,8 +944,6 @@ int rhashtable_init(struct rhashtable *h
+ struct bucket_table *tbl;
+ size_t size;
+
+- size = HASH_DEFAULT_SIZE;
+-
+ if ((!params->key_len && !params->obj_hashfn) ||
+ (params->obj_hashfn && !params->obj_cmpfn))
+ return -EINVAL;
+@@ -964,8 +970,7 @@ int rhashtable_init(struct rhashtable *h
+
+ ht->p.min_size = max_t(u16, ht->p.min_size, HASH_MIN_SIZE);
+
+- if (params->nelem_hint)
+- size = rounded_hashtable_size(&ht->p);
++ size = rounded_hashtable_size(&ht->p);
+
+ if (params->locks_mul)
+ ht->p.locks_mul = roundup_pow_of_two(params->locks_mul);
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Lorenzo Colitti <lorenzo@google.com>
+Date: Sat, 7 Jul 2018 16:31:40 +0900
+Subject: net: diag: Don't double-free TCP_NEW_SYN_RECV sockets in tcp_abort
+
+From: Lorenzo Colitti <lorenzo@google.com>
+
+[ Upstream commit acc2cf4e37174646a24cba42fa53c668b2338d4e ]
+
+When tcp_diag_destroy closes a TCP_NEW_SYN_RECV socket, it first
+frees it by calling inet_csk_reqsk_queue_drop_and_and_put in
+tcp_abort, and then frees it again by calling sock_gen_put.
+
+Since tcp_abort only has one caller, and all the other codepaths
+in tcp_abort don't free the socket, just remove the free in that
+function.
+
+Cc: David Ahern <dsa@cumulusnetworks.com>
+Tested: passes Android sock_diag_test.py, which exercises this codepath
+Fixes: d7226c7a4dd1 ("net: diag: Fix refcnt leak in error path destroying socket")
+Signed-off-by: Lorenzo Colitti <lorenzo@google.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reviewed-by: David Ahern <dsa@cumulusnetworks.com>
+Tested-by: David Ahern <dsa@cumulusnetworks.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/tcp.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/ipv4/tcp.c
++++ b/net/ipv4/tcp.c
+@@ -3415,8 +3415,7 @@ int tcp_abort(struct sock *sk, int err)
+ struct request_sock *req = inet_reqsk(sk);
+
+ local_bh_disable();
+- inet_csk_reqsk_queue_drop_and_put(req->rsk_listener,
+- req);
++ inet_csk_reqsk_queue_drop(req->rsk_listener, req);
+ local_bh_enable();
+ return 0;
+ }
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Stefano Brivio <sbrivio@redhat.com>
+Date: Wed, 11 Jul 2018 14:39:42 +0200
+Subject: net: Don't copy pfmemalloc flag in __copy_skb_header()
+
+From: Stefano Brivio <sbrivio@redhat.com>
+
+[ Upstream commit 8b7008620b8452728cadead460a36f64ed78c460 ]
+
+The pfmemalloc flag indicates that the skb was allocated from
+the PFMEMALLOC reserves, and the flag is currently copied on skb
+copy and clone.
+
+However, an skb copied from an skb flagged with pfmemalloc
+wasn't necessarily allocated from PFMEMALLOC reserves, and on
+the other hand an skb allocated that way might be copied from an
+skb that wasn't.
+
+So we should not copy the flag on skb copy, and rather decide
+whether to allow an skb to be associated with sockets unrelated
+to page reclaim depending only on how it was allocated.
+
+Move the pfmemalloc flag before headers_start[0] using an
+existing 1-bit hole, so that __copy_skb_header() doesn't copy
+it.
+
+When cloning, we'll now take care of this flag explicitly,
+contravening to the warning comment of __skb_clone().
+
+While at it, restore the newline usage introduced by commit
+b19372273164 ("net: reorganize sk_buff for faster
+__copy_skb_header()") to visually separate bytes used in
+bitfields after headers_start[0], that was gone after commit
+a9e419dc7be6 ("netfilter: merge ctinfo into nfct pointer storage
+area"), and describe the pfmemalloc flag in the kernel-doc
+structure comment.
+
+This doesn't change the size of sk_buff or cacheline boundaries,
+but consolidates the 15 bits hole before tc_index into a 2 bytes
+hole before csum, that could now be filled more easily.
+
+Reported-by: Patrick Talbert <ptalbert@redhat.com>
+Fixes: c93bdd0e03e8 ("netvm: allow skb allocation to use PFMEMALLOC reserves")
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/skbuff.h | 10 +++++-----
+ net/core/skbuff.c | 2 ++
+ 2 files changed, 7 insertions(+), 5 deletions(-)
+
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -624,6 +624,7 @@ typedef unsigned char *sk_buff_data_t;
+ * @hash: the packet hash
+ * @queue_mapping: Queue mapping for multiqueue devices
+ * @xmit_more: More SKBs are pending for this queue
++ * @pfmemalloc: skbuff was allocated from PFMEMALLOC reserves
+ * @ndisc_nodetype: router type (from link layer)
+ * @ooo_okay: allow the mapping of a socket to a queue to be changed
+ * @l4_hash: indicate hash is a canonical 4-tuple hash over transport
+@@ -722,7 +723,7 @@ struct sk_buff {
+ peeked:1,
+ head_frag:1,
+ xmit_more:1,
+- __unused:1; /* one bit hole */
++ pfmemalloc:1;
+
+ /* fields enclosed in headers_start/headers_end are copied
+ * using a single memcpy() in __copy_skb_header()
+@@ -741,31 +742,30 @@ struct sk_buff {
+
+ __u8 __pkt_type_offset[0];
+ __u8 pkt_type:3;
+- __u8 pfmemalloc:1;
+ __u8 ignore_df:1;
+-
+ __u8 nf_trace:1;
+ __u8 ip_summed:2;
+ __u8 ooo_okay:1;
++
+ __u8 l4_hash:1;
+ __u8 sw_hash:1;
+ __u8 wifi_acked_valid:1;
+ __u8 wifi_acked:1;
+-
+ __u8 no_fcs:1;
+ /* Indicates the inner headers are valid in the skbuff. */
+ __u8 encapsulation:1;
+ __u8 encap_hdr_csum:1;
+ __u8 csum_valid:1;
++
+ __u8 csum_complete_sw:1;
+ __u8 csum_level:2;
+ __u8 csum_not_inet:1;
+-
+ __u8 dst_pending_confirm:1;
+ #ifdef CONFIG_IPV6_NDISC_NODETYPE
+ __u8 ndisc_nodetype:2;
+ #endif
+ __u8 ipvs_property:1;
++
+ __u8 inner_protocol_type:1;
+ __u8 remcsum_offload:1;
+ #ifdef CONFIG_NET_SWITCHDEV
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -858,6 +858,8 @@ static struct sk_buff *__skb_clone(struc
+ n->cloned = 1;
+ n->nohdr = 0;
+ n->peeked = 0;
++ if (skb->pfmemalloc)
++ n->pfmemalloc = 1;
+ n->destructor = NULL;
+ C(tail);
+ C(end);
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: David Ahern <dsahern@gmail.com>
+Date: Sat, 7 Jul 2018 16:15:26 -0700
+Subject: net/ipv4: Set oif in fib_compute_spec_dst
+
+From: David Ahern <dsahern@gmail.com>
+
+[ Upstream commit e7372197e15856ec4ee66b668020a662994db103 ]
+
+Xin reported that icmp replies may not use the address on the device the
+echo request is received if the destination address is broadcast. Instead
+a route lookup is done without considering VRF context. Fix by setting
+oif in flow struct to the master device if it is enslaved. That directs
+the lookup to the VRF table. If the device is not enslaved, oif is still
+0 so no affect.
+
+Fixes: cd2fbe1b6b51 ("net: Use VRF device index for lookups on RX")
+Reported-by: Xin Long <lucien.xin@gmail.com>
+Signed-off-by: David Ahern <dsahern@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/fib_frontend.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -290,6 +290,7 @@ __be32 fib_compute_spec_dst(struct sk_bu
+ if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
+ struct flowi4 fl4 = {
+ .flowi4_iif = LOOPBACK_IFINDEX,
++ .flowi4_oif = l3mdev_master_ifindex_rcu(dev),
+ .daddr = ip_hdr(skb)->saddr,
+ .flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
+ .flowi4_scope = scope,
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Sun, 15 Jul 2018 13:54:39 +0300
+Subject: net/mlx4_en: Don't reuse RX page when XDP is set
+
+From: Saeed Mahameed <saeedm@mellanox.com>
+
+[ Upstream commit 432e629e56432064761be63bcd5e263c0920430d ]
+
+When a new rx packet arrives, the rx path will decide whether to reuse
+the remainder of the page or not according to one of the below conditions:
+1. frag_info->frag_stride == PAGE_SIZE / 2
+2. frags->page_offset + frag_info->frag_size > PAGE_SIZE;
+
+The first condition is no met for when XDP is set.
+For XDP, page_offset is always set to priv->rx_headroom which is
+XDP_PACKET_HEADROOM and frag_info->frag_size is around mtu size + some
+padding, still the 2nd release condition will hold since
+XDP_PACKET_HEADROOM + 1536 < PAGE_SIZE, as a result the page will not
+be released and will be _wrongly_ reused for next free rx descriptor.
+
+In XDP there is an assumption to have a page per packet and reuse can
+break such assumption and might cause packet data corruptions.
+
+Fix this by adding an extra condition (!priv->rx_headroom) to the 2nd
+case to avoid page reuse when XDP is set, since rx_headroom is set to 0
+for non XDP setup and set to XDP_PACKET_HEADROOM for XDP setup.
+
+No additional cache line is required for the new condition.
+
+Fixes: 34db548bfb95 ("mlx4: add page recycling in receive path")
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Tariq Toukan <tariqt@mellanox.com>
+Suggested-by: Martin KaFai Lau <kafai@fb.com>
+CC: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/mellanox/mlx4/en_rx.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -472,10 +472,10 @@ static int mlx4_en_complete_rx_desc(stru
+ {
+ const struct mlx4_en_frag_info *frag_info = priv->frag_info;
+ unsigned int truesize = 0;
++ bool release = true;
+ int nr, frag_size;
+ struct page *page;
+ dma_addr_t dma;
+- bool release;
+
+ /* Collect used fragments while replacing them in the HW descriptors */
+ for (nr = 0;; frags++) {
+@@ -498,7 +498,11 @@ static int mlx4_en_complete_rx_desc(stru
+ release = page_count(page) != 1 ||
+ page_is_pfmemalloc(page) ||
+ page_to_nid(page) != numa_mem_id();
+- } else {
++ } else if (!priv->rx_headroom) {
++ /* rx_headroom for non XDP setup is always 0.
++ * When XDP is set, the above condition will
++ * guarantee page is always released.
++ */
+ u32 sz_align = ALIGN(frag_size, SMP_CACHE_BYTES);
+
+ frags->page_offset += sz_align;
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Heiner Kallweit <hkallweit1@gmail.com>
+Date: Tue, 3 Jul 2018 22:34:54 +0200
+Subject: net: phy: fix flag masking in __set_phy_supported
+
+From: Heiner Kallweit <hkallweit1@gmail.com>
+
+[ Upstream commit df8ed346d4a806a6eef2db5924285e839604b3f9 ]
+
+Currently also the pause flags are removed from phydev->supported because
+they're not included in PHY_DEFAULT_FEATURES. I don't think this is
+intended, especially when considering that this function can be called
+via phy_set_max_speed() anywhere in a driver. Change the masking to mask
+out only the values we're going to change. In addition remove the
+misleading comment, job of this small function is just to adjust the
+supported and advertised speeds.
+
+Fixes: f3a6bd393c2c ("phylib: Add phy_set_max_speed helper")
+Signed-off-by: Heiner Kallweit <hkallweit1@gmail.com>
+Reviewed-by: Andrew Lunn <andrew@lunn.ch>
+Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/phy/phy_device.c | 7 ++-----
+ 1 file changed, 2 insertions(+), 5 deletions(-)
+
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -1686,11 +1686,8 @@ EXPORT_SYMBOL(genphy_loopback);
+
+ static int __set_phy_supported(struct phy_device *phydev, u32 max_speed)
+ {
+- /* The default values for phydev->supported are provided by the PHY
+- * driver "features" member, we want to reset to sane defaults first
+- * before supporting higher speeds.
+- */
+- phydev->supported &= PHY_DEFAULT_FEATURES;
++ phydev->supported &= ~(PHY_1000BT_FEATURES | PHY_100BT_FEATURES |
++ PHY_10BT_FEATURES);
+
+ switch (max_speed) {
+ default:
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Florian Fainelli <f.fainelli@gmail.com>
+Date: Wed, 11 Jul 2018 02:47:58 -0700
+Subject: net: systemport: Fix CRC forwarding check for SYSTEMPORT Lite
+
+From: Florian Fainelli <f.fainelli@gmail.com>
+
+[ Upstream commit 9e3bff923913729d76d87f0015848ee7b8ff7083 ]
+
+SYSTEMPORT Lite reversed the logic compared to SYSTEMPORT, the
+GIB_FCS_STRIP bit is set when the Ethernet FCS is stripped, and that bit
+is not set by default. Fix the logic such that we properly check whether
+that bit is set or not and we don't forward an extra 4 bytes to the
+network stack.
+
+Fixes: 44a4524c54af ("net: systemport: Add support for SYSTEMPORT Lite")
+Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/bcmsysport.c | 4 ++--
+ drivers/net/ethernet/broadcom/bcmsysport.h | 3 ++-
+ 2 files changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bcmsysport.c
++++ b/drivers/net/ethernet/broadcom/bcmsysport.c
+@@ -1851,8 +1851,8 @@ static int bcm_sysport_open(struct net_d
+ if (!priv->is_lite)
+ priv->crc_fwd = !!(umac_readl(priv, UMAC_CMD) & CMD_CRC_FWD);
+ else
+- priv->crc_fwd = !!(gib_readl(priv, GIB_CONTROL) &
+- GIB_FCS_STRIP);
++ priv->crc_fwd = !((gib_readl(priv, GIB_CONTROL) &
++ GIB_FCS_STRIP) >> GIB_FCS_STRIP_SHIFT);
+
+ phydev = of_phy_connect(dev, priv->phy_dn, bcm_sysport_adj_link,
+ 0, priv->phy_interface);
+--- a/drivers/net/ethernet/broadcom/bcmsysport.h
++++ b/drivers/net/ethernet/broadcom/bcmsysport.h
+@@ -277,7 +277,8 @@ struct bcm_rsb {
+ #define GIB_GTX_CLK_EXT_CLK (0 << GIB_GTX_CLK_SEL_SHIFT)
+ #define GIB_GTX_CLK_125MHZ (1 << GIB_GTX_CLK_SEL_SHIFT)
+ #define GIB_GTX_CLK_250MHZ (2 << GIB_GTX_CLK_SEL_SHIFT)
+-#define GIB_FCS_STRIP (1 << 6)
++#define GIB_FCS_STRIP_SHIFT 6
++#define GIB_FCS_STRIP (1 << GIB_FCS_STRIP_SHIFT)
+ #define GIB_LCL_LOOP_EN (1 << 7)
+ #define GIB_LCL_LOOP_TXEN (1 << 8)
+ #define GIB_RMT_LOOP_EN (1 << 9)
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Tue, 17 Jul 2018 13:17:09 +0200
+Subject: net: usb: asix: replace mii_nway_restart in resume path
+
+From: Alexander Couzens <lynxis@fe80.eu>
+
+[ Upstream commit 5c968f48021a9b3faa61ac2543cfab32461c0e05 ]
+
+mii_nway_restart is not pm aware which results in a rtnl deadlock.
+Implement mii_nway_restart manual by setting BMCR_ANRESTART if
+BMCR_ANENABLE is set.
+
+To reproduce:
+* plug an asix based usb network interface
+* wait until the device enters PM (~5 sec)
+* `ip link set eth1 up` will never return
+
+Fixes: d9fe64e51114 ("net: asix: Add in_pm parameter")
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/asix_devices.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/net/usb/asix_devices.c
++++ b/drivers/net/usb/asix_devices.c
+@@ -642,10 +642,12 @@ static void ax88772_restore_phy(struct u
+ priv->presvd_phy_advertise);
+
+ /* Restore BMCR */
++ if (priv->presvd_phy_bmcr & BMCR_ANENABLE)
++ priv->presvd_phy_bmcr |= BMCR_ANRESTART;
++
+ asix_mdio_write_nopm(dev->net, dev->mii.phy_id, MII_BMCR,
+ priv->presvd_phy_bmcr);
+
+- mii_nway_restart(&dev->mii);
+ priv->presvd_phy_advertise = 0;
+ priv->presvd_phy_bmcr = 0;
+ }
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+Date: Tue, 17 Jul 2018 20:17:33 -0500
+Subject: ptp: fix missing break in switch
+
+From: "Gustavo A. R. Silva" <gustavo@embeddedor.com>
+
+[ Upstream commit 9ba8376ce1e2cbf4ce44f7e4bee1d0648e10d594 ]
+
+It seems that a *break* is missing in order to avoid falling through
+to the default case. Otherwise, checking *chan* makes no sense.
+
+Fixes: 72df7a7244c0 ("ptp: Allow reassigning calibration pin function")
+Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com>
+Acked-by: Richard Cochran <richardcochran@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/ptp/ptp_chardev.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/ptp/ptp_chardev.c
++++ b/drivers/ptp/ptp_chardev.c
+@@ -89,6 +89,7 @@ int ptp_set_pinfunc(struct ptp_clock *pt
+ case PTP_PF_PHYSYNC:
+ if (chan != 0)
+ return -EINVAL;
++ break;
+ default:
+ return -EINVAL;
+ }
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Matevz Vucnik <vucnikm@gmail.com>
+Date: Wed, 4 Jul 2018 18:12:48 +0200
+Subject: qmi_wwan: add support for Quectel EG91
+
+From: Matevz Vucnik <vucnikm@gmail.com>
+
+[ Upstream commit 38cd58ed9c4e389799b507bcffe02a7a7a180b33 ]
+
+This adds the USB id of LTE modem Quectel EG91. It requires the
+same quirk as other Quectel modems to make it work.
+
+Signed-off-by: Matevz Vucnik <vucnikm@gmail.com>
+Acked-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/usb/qmi_wwan.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1252,6 +1252,7 @@ static const struct usb_device_id produc
+ {QMI_FIXED_INTF(0x1e0e, 0x9001, 5)}, /* SIMCom 7230E */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0125, 4)}, /* Quectel EC25, EC20 R2.0 Mini PCIe */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0121, 4)}, /* Quectel EC21 Mini PCIe */
++ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0191, 4)}, /* Quectel EG91 */
+ {QMI_FIXED_INTF(0x2c7c, 0x0296, 4)}, /* Quectel BG96 */
+ {QMI_QUIRK_SET_DTR(0x2c7c, 0x0306, 4)}, /* Quectel EP06 Mini PCIe */
+
drm-i915-fix-hotplug-irq-ack-on-i965-g4x.patch
drm-nouveau-use-drm_connector_list_iter_-for-iterating-connectors.patch
drm-nouveau-avoid-looping-through-fake-mst-connectors.patch
+gen_stats-fix-netlink-stats-dumping-in-the-presence-of-padding.patch
+ipv4-return-einval-when-ping_group_range-sysctl-doesn-t-map-to-user-ns.patch
+ipv6-fix-useless-rol32-call-on-hash.patch
+ipv6-ila-select-config_dst_cache.patch
+lib-rhashtable-consider-param-min_size-when-setting-initial-table-size.patch
+net-diag-don-t-double-free-tcp_new_syn_recv-sockets-in-tcp_abort.patch
+net-don-t-copy-pfmemalloc-flag-in-__copy_skb_header.patch
+skbuff-unconditionally-copy-pfmemalloc-in-__skb_clone.patch
+net-ipv4-set-oif-in-fib_compute_spec_dst.patch
+net-phy-fix-flag-masking-in-__set_phy_supported.patch
+ptp-fix-missing-break-in-switch.patch
+qmi_wwan-add-support-for-quectel-eg91.patch
+tg3-add-higher-cpu-clock-for-5762.patch
+hv_netvsc-fix-napi-reschedule-while-receive-completion-is-busy.patch
+net-mlx4_en-don-t-reuse-rx-page-when-xdp-is-set.patch
+net-systemport-fix-crc-forwarding-check-for-systemport-lite.patch
+ipv6-make-dad-fail-with-enhanced-dad-when-nonce-length-differs.patch
+net-usb-asix-replace-mii_nway_restart-in-resume-path.patch
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Stefano Brivio <sbrivio@redhat.com>
+Date: Fri, 13 Jul 2018 13:21:07 +0200
+Subject: skbuff: Unconditionally copy pfmemalloc in __skb_clone()
+
+From: Stefano Brivio <sbrivio@redhat.com>
+
+[ Upstream commit e78bfb0751d4e312699106ba7efbed2bab1a53ca ]
+
+Commit 8b7008620b84 ("net: Don't copy pfmemalloc flag in
+__copy_skb_header()") introduced a different handling for the
+pfmemalloc flag in copy and clone paths.
+
+In __skb_clone(), now, the flag is set only if it was set in the
+original skb, but not cleared if it wasn't. This is wrong and
+might lead to socket buffers being flagged with pfmemalloc even
+if the skb data wasn't allocated from pfmemalloc reserves. Copy
+the flag instead of ORing it.
+
+Reported-by: Sabrina Dubroca <sd@queasysnail.net>
+Fixes: 8b7008620b84 ("net: Don't copy pfmemalloc flag in __copy_skb_header()")
+Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
+Tested-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/skbuff.c | 3 +--
+ 1 file changed, 1 insertion(+), 2 deletions(-)
+
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -858,8 +858,7 @@ static struct sk_buff *__skb_clone(struc
+ n->cloned = 1;
+ n->nohdr = 0;
+ n->peeked = 0;
+- if (skb->pfmemalloc)
+- n->pfmemalloc = 1;
++ C(pfmemalloc);
+ n->destructor = NULL;
+ C(tail);
+ C(end);
--- /dev/null
+From foo@baz Mon Jul 23 07:31:18 CEST 2018
+From: Sanjeev Bansal <sanjeevb.bansal@broadcom.com>
+Date: Mon, 16 Jul 2018 11:13:32 +0530
+Subject: tg3: Add higher cpu clock for 5762.
+
+From: Sanjeev Bansal <sanjeevb.bansal@broadcom.com>
+
+[ Upstream commit 3a498606bb04af603a46ebde8296040b2de350d1 ]
+
+This patch has fix for TX timeout while running bi-directional
+traffic with 100 Mbps using 5762.
+
+Signed-off-by: Sanjeev Bansal <sanjeevb.bansal@broadcom.com>
+Signed-off-by: Siva Reddy Kallam <siva.kallam@broadcom.com>
+Reviewed-by: Michael Chan <michael.chan@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/broadcom/tg3.c | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -9279,6 +9279,15 @@ static int tg3_chip_reset(struct tg3 *tp
+
+ tg3_restore_clk(tp);
+
++ /* Increase the core clock speed to fix tx timeout issue for 5762
++ * with 100Mbps link speed.
++ */
++ if (tg3_asic_rev(tp) == ASIC_REV_5762) {
++ val = tr32(TG3_CPMU_CLCK_ORIDE_ENABLE);
++ tw32(TG3_CPMU_CLCK_ORIDE_ENABLE, val |
++ TG3_CPMU_MAC_ORIDE_ENABLE);
++ }
++
+ /* Reprobe ASF enable state. */
+ tg3_flag_clear(tp, ENABLE_ASF);
+ tp->phy_flags &= ~(TG3_PHYFLG_1G_ON_VAUX_OK |
projects / thirdparty / kernel / stable-queue.git / commitdiff
