[net-next PATCH 0/5] Flow dissector fixes and improvements

---
 net/core/flow_dissector.c |   17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 12e700332010..1f88f8280280 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c

@@ -178,15 +178,16 @@ ip:

                ip_proto = iph->protocol;

-               if (!dissector_uses_key(flow_dissector,
-                                       FLOW_DISSECTOR_KEY_IPV4_ADDRS))
-                       break;
+               if (dissector_uses_key(flow_dissector,
+                                      FLOW_DISSECTOR_KEY_IPV4_ADDRS)) {
+                       key_addrs = skb_flow_dissector_target(flow_dissector,
+                                                             FLOW_DISSECTOR_KEY_IPV4_ADDRS,
+                                                             target_container);

-               key_addrs = skb_flow_dissector_target(flow_dissector,
-                             FLOW_DISSECTOR_KEY_IPV4_ADDRS, target_container);
-               memcpy(&key_addrs->v4addrs, &iph->saddr,
-                      sizeof(key_addrs->v4addrs));
-               key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
+                       memcpy(&key_addrs->v4addrs, &iph->saddr,
+                              sizeof(key_addrs->v4addrs));
+                       key_control->addr_type = FLOW_DISSECTOR_KEY_IPV4_ADDRS;
+               }

                if (ip_is_fragment(iph)) {
                        key_control->flags |= FLOW_DIS_IS_FRAGMENT;

---
 net/core/flow_dissector.c |   10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 1f88f8280280..8bd745f72734 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c

@@ -448,13 +448,12 @@ ip_proto_again:
                key_control->flags |= FLOW_DIS_IS_FRAGMENT;

                nhoff += sizeof(_fh);
+               ip_proto = fh->nexthdr;

                if (!(fh->frag_off & htons(IP6_OFFSET))) {
                        key_control->flags |= FLOW_DIS_FIRST_FRAG;
-                       if (flags & FLOW_DISSECTOR_F_PARSE_1ST_FRAG) {
-                               ip_proto = fh->nexthdr;
+                       if (flags & FLOW_DISSECTOR_F_PARSE_1ST_FRAG)
                                goto ip_proto_again;
-                       }
                }
                goto out_good;
        }

@@ -741,6 +740,11 @@ u32 __skb_get_poff(const struct sk_buff *skb, void *data,
 {
        u32 poff = keys->control.thoff;

+       /* skip L4 headers for fragments after the first */
+       if ((keys->control.flags & FLOW_DIS_IS_FRAGMENT) &&
+           !(keys->control.flags & FLOW_DIS_FIRST_FRAG))
+               return poff;
+
        switch (keys->basic.ip_proto) {
        case IPPROTO_TCP: {
                /* access doff as u8 to avoid unaligned access */

---
 net/core/flow_dissector.c |    7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 8bd745f72734..6288153d7f36 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c

@@ -340,8 +340,11 @@ mpls:
        }

        case htons(ETH_P_FCOE):
-               key_control->thoff = (u16)(nhoff + FCOE_HEADER_LEN);
-               /* fall through */
+               if ((hlen - nhoff) < FCOE_HEADER_LEN)
+                       goto out_bad;
+
+               nhoff += FCOE_HEADER_LEN;
+               goto out_good;
        default:
                goto out_bad;
        }

---
 net/core/flow_dissector.c |   11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 6288153d7f36..7c7b8739b8b8 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c

@@ -220,13 +220,12 @@ ipv6:

                if (dissector_uses_key(flow_dissector,
                                       FLOW_DISSECTOR_KEY_IPV6_ADDRS)) {
-                       struct flow_dissector_key_ipv6_addrs *key_ipv6_addrs;
-
-                       key_ipv6_addrs = skb_flow_dissector_target(flow_dissector,
-                                                                  FLOW_DISSECTOR_KEY_IPV6_ADDRS,
-                                                                  target_container);
+                       key_addrs = skb_flow_dissector_target(flow_dissector,
+                                                             FLOW_DISSECTOR_KEY_IPV6_ADDRS,
+                                                             target_container);

-                       memcpy(key_ipv6_addrs, &iph->saddr, sizeof(*key_ipv6_addrs));
+                       memcpy(&key_addrs->v6addrs, &iph->saddr,
+                              sizeof(key_addrs->v6addrs));
                        key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
                }

---
 net/ethernet/eth.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 103871784e50..66dff5e3d772 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c

@@ -125,6 +125,7 @@ EXPORT_SYMBOL(eth_header);
  */
 u32 eth_get_headlen(void *data, unsigned int len)
 {
+       const unsigned int flags = FLOW_DISSECTOR_F_PARSE_1ST_FRAG;
        const struct ethhdr *eth = (const struct ethhdr *)data;
        struct flow_keys keys;

@@ -134,7 +135,7 @@ u32 eth_get_headlen(void *data, unsigned int len)

        /* parse any remaining L2/L3 headers, check for L4 */
        if (!skb_flow_dissect_flow_keys_buf(&keys, data, eth->h_proto,
-                                           sizeof(*eth), len, 0))
+                                           sizeof(*eth), len, flags))
                return max_t(u32, keys.control.thoff, sizeof(*eth));

        /* parse for any L4 headers */