Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	net/bridge/br_mdb.c

br_mdb.c conflict was a function call being removed to fix a bug in
'net' but whose signature was changed in 'net-next'.

Signed-off-by: David S. Miller <davem@davemloft.net>

3 files changed, 57 insertions, 14 deletions

diff --git a/net/core/datagram.c b/net/core/datagram.c
index b80fb91bb3f7..4967262b2707 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -131,6 +131,35 @@ out_noerr:
         goto out;
 }
 
+static int skb_set_peeked(struct sk_buff *skb)
+{
+        struct sk_buff *nskb;
+
+        if (skb->peeked)
+                return 0;
+
+        /* We have to unshare an skb before modifying it. */
+        if (!skb_shared(skb))
+                goto done;
+
+        nskb = skb_clone(skb, GFP_ATOMIC);
+        if (!nskb)
+                return -ENOMEM;
+
+        skb->prev->next = nskb;
+        skb->next->prev = nskb;
+        nskb->prev = skb->prev;
+        nskb->next = skb->next;
+
+        consume_skb(skb);
+        skb = nskb;
+
+done:
+        skb->peeked = 1;
+
+        return 0;
+}
+
 /**
  *      __skb_recv_datagram - Receive a datagram skbuff
  *      @sk: socket
@@ -165,7 +194,9 @@ out_noerr:
 struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                     int *peeked, int *off, int *err)
 {
+        struct sk_buff_head *queue = &sk->sk_receive_queue;
         struct sk_buff *skb, *last;
+        unsigned long cpu_flags;
         long timeo;
         /*
          * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@@ -184,8 +215,6 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                  * Look at current nfs client by the way...
                  * However, this function was correct in any case. 8)
                  */
-                unsigned long cpu_flags;
-                struct sk_buff_head *queue = &sk->sk_receive_queue;
                 int _off = *off;
 
                 last = (struct sk_buff *)queue;
@@ -199,7 +228,11 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                         _off -= skb->len;
                                         continue;
                                 }
-                                skb->peeked = 1;
+
+                                error = skb_set_peeked(skb);
+                                if (error)
+                                        goto unlock_err;
+
                                 atomic_inc(&skb->users);
                         } else
                                 __skb_unlink(skb, queue);
@@ -223,6 +256,8 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
 
         return NULL;
 
+unlock_err:
+        spin_unlock_irqrestore(&queue->lock, cpu_flags);
 no_packet:
         *err = error;
         return NULL;
@@ -622,7 +657,8 @@ __sum16 __skb_checksum_complete_head(struct sk_buff *skb, int len)
                     !skb->csum_complete_sw)
                         netdev_rx_csum_fault(skb->dev);
         }
-        skb->csum_valid = !sum;
+        if (!skb_shared(skb))
+                skb->csum_valid = !sum;
         return sum;
 }
 EXPORT_SYMBOL(__skb_checksum_complete_head);
@@ -642,11 +678,13 @@ __sum16 __skb_checksum_complete(struct sk_buff *skb)
                         netdev_rx_csum_fault(skb->dev);
         }
 
-        /* Save full packet checksum */
-        skb->csum = csum;
-        skb->ip_summed = CHECKSUM_COMPLETE;
-        skb->csum_complete_sw = 1;
-        skb->csum_valid = !sum;
+        if (!skb_shared(skb)) {
+                /* Save full packet checksum */
+                skb->csum = csum;
+                skb->ip_summed = CHECKSUM_COMPLETE;
+                skb->csum_complete_sw = 1;
+                skb->csum_valid = !sum;
+        }
 
         return sum;
 }
diff --git a/net/core/dst.c b/net/core/dst.c
index 917364f0d0be..76a617f6d60a 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -299,7 +299,9 @@ void dst_release(struct dst_entry *dst)
                 int newrefcnt;
 
                 newrefcnt = atomic_dec_return(&dst->__refcnt);
-                WARN_ON(newrefcnt < 0);
+                if (unlikely(newrefcnt < 0))
+                        net_warn_ratelimited("%s: dst:%p refcnt:%d\n",
+                                             __func__, dst, newrefcnt);
                 if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
                         call_rcu(&dst->rcu_head, dst_destroy_rcu);
         }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5fb4af20c6dd..788ceed39463 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1808,10 +1808,13 @@ static int do_setlink(const struct sk_buff *skb,
                         goto errout;
 
                 nla_for_each_nested(attr, tb[IFLA_VF_PORTS], rem) {
-                        if (nla_type(attr) != IFLA_VF_PORT)
-                                continue;
-                        err = nla_parse_nested(port, IFLA_PORT_MAX,
-                                attr, ifla_port_policy);
+                        if (nla_type(attr) != IFLA_VF_PORT ||
+                            nla_len(attr) < NLA_HDRLEN) {
+                                err = -EINVAL;
+                                goto errout;
+                        }
+                        err = nla_parse_nested(port, IFLA_PORT_MAX, attr,
+                                               ifla_port_policy);
                         if (err < 0)
                                 goto errout;
                         if (!port[IFLA_PORT_VF]) {