Merge tag 'v4.4.81' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable into ti-linux-4.4.y

This is the 4.4.81 stable release

* tag 'v4.4.81' of http://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable: (59 commits)
  Linux 4.4.81
  workqueue: implicit ordered attribute should be overridable
  net: account for current skb length when deciding about UFO
  ipv4: Should use consistent conditional judgement for ip fragment in __ip_append_data and ip_finish_output
  mm: don't dereference struct page fields of invalid pages
  signal: protect SIGNAL_UNKILLABLE from unintentional clearing.
  lib/Kconfig.debug: fix frv build failure
  mm, slab: make sure that KMALLOC_MAX_SIZE will fit into MAX_ORDER
  ARM: 8632/1: ftrace: fix syscall name matching
  virtio_blk: fix panic in initialization error path
  drm/virtio: fix framebuffer sparse warning
  scsi: qla2xxx: Get mutex lock before checking optrom_state
  phy state machine: failsafe leave invalid RUNNING state
  x86/boot: Add missing declaration of string functions
  tg3: Fix race condition in tg3_get_stats64().
  net: phy: dp83867: fix irq generation
  sh_eth: R8A7740 supports packet shecksumming
  wext: handle NULL extra data in iwe_stream_add_point better
  sparc64: Measure receiver forward progress to avoid send mondo timeout
  xen-netback: correctly schedule rate-limited queues
  ...

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>

13 files changed, 32 insertions, 18 deletions

diff --git a/net/core/dev_ioctl.c b/net/core/dev_ioctl.c
index 183ef95db502..2bded3ecf03d 100644
--- a/net/core/dev_ioctl.c
+++ b/net/core/dev_ioctl.c
@@ -28,6 +28,7 @@ static int dev_ifname(struct net *net, struct ifreq __user *arg)
 
         if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
                 return -EFAULT;
+        ifr.ifr_name[IFNAMSIZ-1] = 0;
 
         error = netdev_get_name(net, ifr.ifr_name, ifr.ifr_ifindex);
         if (error)
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 2ec5324a7ff7..5b3d611d8b5f 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1742,7 +1742,8 @@ static int do_setlink(const struct sk_buff *skb,
                 struct sockaddr *sa;
                 int len;
 
-                len = sizeof(sa_family_t) + dev->addr_len;
+                len = sizeof(sa_family_t) + max_t(size_t, dev->addr_len,
+                                                  sizeof(*sa));
                 sa = kmalloc(len, GFP_KERNEL);
                 if (!sa) {
                         err = -ENOMEM;
diff --git a/net/dccp/feat.c b/net/dccp/feat.c
index 1704948e6a12..f227f002c73d 100644
--- a/net/dccp/feat.c
+++ b/net/dccp/feat.c
@@ -1471,9 +1471,12 @@ int dccp_feat_init(struct sock *sk)
          * singleton values (which always leads to failure).
          * These settings can still (later) be overridden via sockopts.
          */
-        if (ccid_get_builtin_ccids(&tx.val, &tx.len) ||
-            ccid_get_builtin_ccids(&rx.val, &rx.len))
+        if (ccid_get_builtin_ccids(&tx.val, &tx.len))
                 return -ENOBUFS;
+        if (ccid_get_builtin_ccids(&rx.val, &rx.len)) {
+                kfree(tx.val);
+                return -ENOBUFS;
+        }
 
         if (!dccp_feat_prefer(sysctl_dccp_tx_ccid, tx.val, tx.len) ||
             !dccp_feat_prefer(sysctl_dccp_rx_ccid, rx.val, rx.len))
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index 6467bf392e1b..e217f17997a4 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -635,6 +635,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
+        reqsk_put(req);
         return 0;
 
 drop_and_free:
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 3470ad1843bb..09a9ab65f4e1 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -376,6 +376,7 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                 goto drop_and_free;
 
         inet_csk_reqsk_queue_hash_add(sk, req, DCCP_TIMEOUT_INIT);
+        reqsk_put(req);
         return 0;
 
 drop_and_free:
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 66dcb529fd9c..0cb240c749bf 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1319,13 +1319,14 @@ static struct pernet_operations fib_net_ops = {
 
 void __init ip_fib_init(void)
 {
-        rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
-        rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
-        rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
+        fib_trie_init();
 
         register_pernet_subsys(&fib_net_ops);
+
         register_netdevice_notifier(&fib_netdev_notifier);
         register_inetaddr_notifier(&fib_inetaddr_notifier);
 
-        fib_trie_init();
+        rtnl_register(PF_INET, RTM_NEWROUTE, inet_rtm_newroute, NULL, NULL);
+        rtnl_register(PF_INET, RTM_DELROUTE, inet_rtm_delroute, NULL, NULL);
+        rtnl_register(PF_INET, RTM_GETROUTE, NULL, inet_dump_fib, NULL);
 }
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 2b7283303650..5d58a6703a43 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -922,7 +922,8 @@ static int __ip_append_data(struct sock *sk,
                 csummode = CHECKSUM_PARTIAL;
 
         cork->length += length;
-        if (((length > mtu) || (skb && skb_is_gso(skb))) &&
+        if ((((length + (skb ? skb->len : fragheaderlen)) > mtu) ||
+             (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
             (sk->sk_type == SOCK_DGRAM) && !sk->sk_no_check_tx) {
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 4cbe9f0a4281..731b91409625 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -337,6 +337,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
         treq = tcp_rsk(req);
         treq->rcv_isn           = ntohl(th->seq) - 1;
         treq->snt_isn           = cookie;
+        treq->txhash            = net_tx_rndhash();
         req->mss                = mss;
         ireq->ir_num            = ntohs(th->dest);
         ireq->ir_rmt_port       = th->source;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 150b4923fb72..0de3245ea42f 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -647,8 +647,6 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                 *prevhdr = NEXTHDR_FRAGMENT;
                 tmp_hdr = kmemdup(skb_network_header(skb), hlen, GFP_ATOMIC);
                 if (!tmp_hdr) {
-                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                      IPSTATS_MIB_FRAGFAILS);
                         err = -ENOMEM;
                         goto fail;
                 }
@@ -767,8 +765,6 @@ slow_path:
                 frag = alloc_skb(len + hlen + sizeof(struct frag_hdr) +
                                  hroom + troom, GFP_ATOMIC);
                 if (!frag) {
-                        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
-                                      IPSTATS_MIB_FRAGFAILS);
                         err = -ENOMEM;
                         goto fail;
                 }
@@ -1361,7 +1357,7 @@ emsgsize:
          */
 
         cork->length += length;
-        if ((((length + fragheaderlen) > mtu) ||
+        if ((((length + (skb ? skb->len : headersize)) > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
             (rt->dst.dev->features & NETIF_F_UFO) &&
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 8b56c5240429..f9f02581c4ca 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -78,7 +78,7 @@ EXPORT_SYMBOL(ipv6_select_ident);
 
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
-        u16 offset = sizeof(struct ipv6hdr);
+        unsigned int offset = sizeof(struct ipv6hdr);
         unsigned int packet_len = skb_tail_pointer(skb) -
                 skb_network_header(skb);
         int found_rhdr = 0;
@@ -86,6 +86,7 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
         while (offset <= packet_len) {
                 struct ipv6_opt_hdr *exthdr;
+                unsigned int len;
 
                 switch (**nexthdr) {
 
@@ -111,7 +112,10 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 
                 exthdr = (struct ipv6_opt_hdr *)(skb_network_header(skb) +
                                                  offset);
-                offset += ipv6_optlen(exthdr);
+                len = ipv6_optlen(exthdr);
+                if (len + offset >= IPV6_MAXPLEN)
+                        return -EINVAL;
+                offset += len;
                 *nexthdr = &exthdr->nexthdr;
         }
 
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index eaf7ac496d50..aee87282d352 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -210,6 +210,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         treq->snt_synack.v64    = 0;
         treq->rcv_isn = ntohl(th->seq) - 1;
         treq->snt_isn = cookie;
+        treq->txhash = net_tx_rndhash();
 
         /*
          * We need to lookup the dst_entry to get the correct window size.
diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
index ad58d2a6284e..6a2507f24b0f 100644
--- a/net/openvswitch/conntrack.c
+++ b/net/openvswitch/conntrack.c
@@ -577,8 +577,8 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
 
         nla_for_each_nested(a, attr, rem) {
                 int type = nla_type(a);
-                int maxlen = ovs_ct_attr_lens[type].maxlen;
-                int minlen = ovs_ct_attr_lens[type].minlen;
+                int maxlen;
+                int minlen;
 
                 if (type > OVS_CT_ATTR_MAX) {
                         OVS_NLERR(log,
@@ -586,6 +586,9 @@ static int parse_ct(const struct nlattr *attr, struct ovs_conntrack_info *info,
                                   type, OVS_CT_ATTR_MAX);
                         return -EINVAL;
                 }
+
+                maxlen = ovs_ct_attr_lens[type].maxlen;
+                minlen = ovs_ct_attr_lens[type].minlen;
                 if (nla_len(a) < minlen || nla_len(a) > maxlen) {
                         OVS_NLERR(log,
                                   "Conntrack attr type has unexpected length (type=%d, length=%d, expected=%d)",
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f8d6a0ca9c03..061771ca2582 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -4225,7 +4225,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
                 register_prot_hook(sk);
         }
         spin_unlock(&po->bind_lock);
-        if (closing && (po->tp_version > TPACKET_V2)) {
+        if (pg_vec && (po->tp_version > TPACKET_V2)) {
                 /* Because we don't support block-based V3 on tx-ring */
                 if (!tx_ring)
                         prb_shutdown_retire_blk_timer(po, rb_queue);