Merge tag 'net-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from bluetooth and CAN. No known outstanding
  regressions.

  Current release - regressions:

   - mptcp: initialize rcv_mss before calling tcp_send_active_reset()

   - eth: mlx5e: fix validation logic in rate limiting

  Previous releases - regressions:

   - xsk: avoid data corruption on cq descriptor number

   - bluetooth:
       - prevent race in socket write iter and sock bind
       - fix not generating mackey and ltk when repairing

   - can:
       - kvaser_usb: fix potential infinite loop in command parsers
       - rcar_canfd: fix CAN-FD mode as default

   - eth:
       - veth: reduce XDP no_direct return section to fix race
       - virtio-net: avoid unnecessary checksum calculation on guest RX

  Previous releases - always broken:

   - sched: fix TCF_LAYER_TRANSPORT handling in tcf_get_base_ptr()

   - bluetooth: mediatek: fix kernel crash when releasing iso interface

   - vhost: rewind next_avail_head while discarding descriptors

   - eth:
       - r8169: fix RTL8127 hang on suspend/shutdown
       - aquantia: add missing descriptor cache invalidation on ATL2

   - dsa: microchip: fix resource releases in error path"

* tag 'net-6.18-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (47 commits)
  mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose().
  net: fec: do not register PPS event for PEROUT
  net: fec: do not allow enabling PPS and PEROUT simultaneously
  net: fec: do not update PEROUT if it is enabled
  net: fec: cancel perout_timer when PEROUT is disabled
  net: mctp: unconditionally set skb->dev on dst output
  net: atlantic: fix fragment overflow handling in RX path
  MAINTAINERS: separate VIRTIO NET DRIVER and add netdev
  virtio-net: avoid unnecessary checksum calculation on guest RX
  eth: fbnic: Fix counter roll-over issue
  mptcp: clear scheduled subflows on retransmit
  net: dsa: sja1105: fix SGMII linking at 10M or 100M but not passing traffic
  s390/net: list Aswin Karuvally as maintainer
  net: wwan: mhi: Keep modem name match with Foxconn T99W640
  vhost: rewind next_avail_head while discarding descriptors
  net/sched: em_canid: fix uninit-value in em_canid_match
  can: rcar_canfd: Fix CAN-FD mode as default
  xsk: avoid data corruption on cq descriptor number
  r8169: fix RTL8127 hang on suspend/shutdown
  net: sxgbe: fix potential NULL dereference in sxgbe_rx()
  ...

3 files changed, 20 insertions, 10 deletions

diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
index b673c31569f3..75dabb763c65 100644
--- a/include/linux/virtio_net.h
+++ b/include/linux/virtio_net.h
@@ -384,7 +384,8 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,
 			    struct virtio_net_hdr_v1_hash_tunnel *vhdr,
 			    bool tnl_hdr_negotiated,
 			    bool little_endian,
-			    int vlan_hlen)
+			    int vlan_hlen,
+			    bool has_data_valid)
 {
 	struct virtio_net_hdr *hdr = (struct virtio_net_hdr *)vhdr;
 	unsigned int inner_nh, outer_th;
@@ -394,8 +395,8 @@ virtio_net_hdr_tnl_from_skb(const struct sk_buff *skb,
 	tnl_gso_type = skb_shinfo(skb)->gso_type & (SKB_GSO_UDP_TUNNEL |
 						    SKB_GSO_UDP_TUNNEL_CSUM);
 	if (!tnl_gso_type)
-		return virtio_net_hdr_from_skb(skb, hdr, little_endian, false,
-					       vlan_hlen);
+		return virtio_net_hdr_from_skb(skb, hdr, little_endian,
+					       has_data_valid, vlan_hlen);
 
 	/* Tunnel support not negotiated but skb ask for it. */
 	if (!tnl_hdr_negotiated)
diff --git a/include/net/bluetooth/hci_core.h b/include/net/bluetooth/hci_core.h
index b8100dbfe5d7..0cb87687837f 100644
--- a/include/net/bluetooth/hci_core.h
+++ b/include/net/bluetooth/hci_core.h
@@ -749,7 +749,6 @@ struct hci_conn {
 
 	__u8		remote_cap;
 	__u8		remote_auth;
-	__u8		remote_id;
 
 	unsigned int	sent;
 
@@ -857,11 +856,12 @@ extern struct mutex hci_cb_list_lock;
 /* ----- HCI interface to upper protocols ----- */
 int l2cap_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr);
 int l2cap_disconn_ind(struct hci_conn *hcon);
-void l2cap_recv_acldata(struct hci_conn *hcon, struct sk_buff *skb, u16 flags);
+int l2cap_recv_acldata(struct hci_dev *hdev, u16 handle, struct sk_buff *skb,
+		       u16 flags);
 
 #if IS_ENABLED(CONFIG_BT_BREDR)
 int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags);
-void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb);
+int sco_recv_scodata(struct hci_dev *hdev, u16 handle, struct sk_buff *skb);
 #else
 static inline int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
 				  __u8 *flags)
@@ -869,23 +869,30 @@ static inline int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
 	return 0;
 }
 
-static inline void sco_recv_scodata(struct hci_conn *hcon, struct sk_buff *skb)
+static inline int sco_recv_scodata(struct hci_dev *hdev, u16 handle,
+				   struct sk_buff *skb)
 {
+	kfree_skb(skb);
+	return -ENOENT;
 }
 #endif
 
 #if IS_ENABLED(CONFIG_BT_LE)
 int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 *flags);
-void iso_recv(struct hci_conn *hcon, struct sk_buff *skb, u16 flags);
+int iso_recv(struct hci_dev *hdev, u16 handle, struct sk_buff *skb,
+	     u16 flags);
 #else
 static inline int iso_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr,
 				  __u8 *flags)
 {
 	return 0;
 }
-static inline void iso_recv(struct hci_conn *hcon, struct sk_buff *skb,
-			    u16 flags)
+
+static inline int iso_recv(struct hci_dev *hdev, u16 handle,
+			   struct sk_buff *skb, u16 flags)
 {
+	kfree_skb(skb);
+	return -ENOENT;
 }
 #endif
 
diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index c64fd896b1f9..99ac747b7906 100644
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -536,6 +536,8 @@ static inline unsigned char * tcf_get_base_ptr(struct sk_buff *skb, int layer)
 		case TCF_LAYER_NETWORK:
 			return skb_network_header(skb);
 		case TCF_LAYER_TRANSPORT:
+			if (!skb_transport_header_was_set(skb))
+				break;
 			return skb_transport_header(skb);
 	}