Merge ra.kernel.org:/pub/scm/linux/kernel/git/davem/net

6 files changed, 100 insertions, 61 deletions

diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 598333b123b9..bae9096821be 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1200,8 +1200,7 @@ static void igmpv3_del_delrec(struct in_device *in_dev, struct ip_mc_list *im)
         spin_lock_bh(&im->lock);
         if (pmc) {
                 im->interface = pmc->interface;
-                im->sfmode = pmc->sfmode;
-                if (pmc->sfmode == MCAST_INCLUDE) {
+                if (im->sfmode == MCAST_INCLUDE) {
                         im->tomb = pmc->tomb;
                         im->sources = pmc->sources;
                         for (psf = im->sources; psf; psf = psf->sf_next)
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index e2b6bd478afb..9c4e72e9c60a 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -524,6 +524,8 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->dev = from->dev;
         to->mark = from->mark;
 
+        skb_copy_hash(to, from);
+
         /* Copy the flags to each fragment. */
         IPCB(to)->flags = IPCB(from)->flags;
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 64c76dcf7386..c0fe5ad996f2 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -150,15 +150,18 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
 {
         struct sockaddr_in sin;
         const struct iphdr *iph = ip_hdr(skb);
-        __be16 *ports = (__be16 *)skb_transport_header(skb);
+        __be16 *ports;
+        int end;
 
-        if (skb_transport_offset(skb) + 4 > (int)skb->len)
+        end = skb_transport_offset(skb) + 4;
+        if (end > 0 && !pskb_may_pull(skb, end))
                 return;
 
         /* All current transport protocols have the port numbers in the
          * first four bytes of the transport header and this function is
          * written with this assumption in mind.
          */
+        ports = (__be16 *)skb_transport_header(skb);
 
         sin.sin_family = AF_INET;
         sin.sin_addr.s_addr = iph->daddr;
diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index 5869f89ca656..8b637f9f23a2 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c
@@ -129,24 +129,14 @@ static void dctcp_ce_state_0_to_1(struct sock *sk)
         struct dctcp *ca = inet_csk_ca(sk);
         struct tcp_sock *tp = tcp_sk(sk);
 
-        /* State has changed from CE=0 to CE=1 and delayed
-         * ACK has not sent yet.
-         */
-        if (!ca->ce_state &&
-            inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) {
-                u32 tmp_rcv_nxt;
-
-                /* Save current rcv_nxt. */
-                tmp_rcv_nxt = tp->rcv_nxt;
-
-                /* Generate previous ack with CE=0. */
-                tp->ecn_flags &= ~TCP_ECN_DEMAND_CWR;
-                tp->rcv_nxt = ca->prior_rcv_nxt;
-
-                tcp_send_ack(sk);
-
-                /* Recover current rcv_nxt. */
-                tp->rcv_nxt = tmp_rcv_nxt;
+        if (!ca->ce_state) {
+                /* State has changed from CE=0 to CE=1, force an immediate
+                 * ACK to reflect the new CE state. If an ACK was delayed,
+                 * send that first to reflect the prior CE state.
+                 */
+                if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER)
+                        __tcp_send_ack(sk, ca->prior_rcv_nxt);
+                tcp_enter_quickack_mode(sk, 1);
         }
 
         ca->prior_rcv_nxt = tp->rcv_nxt;
@@ -160,24 +150,14 @@ static void dctcp_ce_state_1_to_0(struct sock *sk)
         struct dctcp *ca = inet_csk_ca(sk);
         struct tcp_sock *tp = tcp_sk(sk);
 
-        /* State has changed from CE=1 to CE=0 and delayed
-         * ACK has not sent yet.
-         */
-        if (ca->ce_state &&
-            inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER) {
-                u32 tmp_rcv_nxt;
-
-                /* Save current rcv_nxt. */
-                tmp_rcv_nxt = tp->rcv_nxt;
-
-                /* Generate previous ack with CE=1. */
-                tp->ecn_flags |= TCP_ECN_DEMAND_CWR;
-                tp->rcv_nxt = ca->prior_rcv_nxt;
-
-                tcp_send_ack(sk);
-
-                /* Recover current rcv_nxt. */
-                tp->rcv_nxt = tmp_rcv_nxt;
+        if (ca->ce_state) {
+                /* State has changed from CE=1 to CE=0, force an immediate
+                 * ACK to reflect the new CE state. If an ACK was delayed,
+                 * send that first to reflect the prior CE state.
+                 */
+                if (inet_csk(sk)->icsk_ack.pending & ICSK_ACK_TIMER)
+                        __tcp_send_ack(sk, ca->prior_rcv_nxt);
+                tcp_enter_quickack_mode(sk, 1);
         }
 
         ca->prior_rcv_nxt = tp->rcv_nxt;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 91dbb9afb950..d51fa358b2b1 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -216,7 +216,7 @@ static void tcp_incr_quickack(struct sock *sk, unsigned int max_quickacks)
                 icsk->icsk_ack.quick = quickacks;
 }
 
-static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
+void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
 
@@ -224,6 +224,7 @@ static void tcp_enter_quickack_mode(struct sock *sk, unsigned int max_quickacks)
         icsk->icsk_ack.pingpong = 0;
         icsk->icsk_ack.ato = TCP_ATO_MIN;
 }
+EXPORT_SYMBOL(tcp_enter_quickack_mode);
 
 /* Send ACKs quickly, if "quick" count is not exhausted
  * and the session is not interactive.
@@ -4366,6 +4367,23 @@ static bool tcp_try_coalesce(struct sock *sk,
         return true;
 }
 
+static bool tcp_ooo_try_coalesce(struct sock *sk,
+                             struct sk_buff *to,
+                             struct sk_buff *from,
+                             bool *fragstolen)
+{
+        bool res = tcp_try_coalesce(sk, to, from, fragstolen);
+
+        /* In case tcp_drop() is called later, update to->gso_segs */
+        if (res) {
+                u32 gso_segs = max_t(u16, 1, skb_shinfo(to)->gso_segs) +
+                               max_t(u16, 1, skb_shinfo(from)->gso_segs);
+
+                skb_shinfo(to)->gso_segs = min_t(u32, gso_segs, 0xFFFF);
+        }
+        return res;
+}
+
 static void tcp_drop(struct sock *sk, struct sk_buff *skb)
 {
         sk_drops_add(sk, skb);
@@ -4489,8 +4507,8 @@ static void tcp_data_queue_ofo(struct sock *sk, struct sk_buff *skb)
         /* In the typical case, we are adding an skb to the end of the list.
          * Use of ooo_last_skb avoids the O(Log(N)) rbtree lookup.
          */
-        if (tcp_try_coalesce(sk, tp->ooo_last_skb,
-                             skb, &fragstolen)) {
+        if (tcp_ooo_try_coalesce(sk, tp->ooo_last_skb,
+                                 skb, &fragstolen)) {
 coalesce_done:
                 tcp_grow_window(sk, skb);
                 kfree_skb_partial(skb, fragstolen);
@@ -4518,7 +4536,7 @@ coalesce_done:
                                 /* All the bits are present. Drop. */
                                 NET_INC_STATS(sock_net(sk),
                                               LINUX_MIB_TCPOFOMERGE);
-                                __kfree_skb(skb);
+                                tcp_drop(sk, skb);
                                 skb = NULL;
                                 tcp_dsack_set(sk, seq, end_seq);
                                 goto add_sack;
@@ -4537,11 +4555,11 @@ coalesce_done:
                                                  TCP_SKB_CB(skb1)->end_seq);
                                 NET_INC_STATS(sock_net(sk),
                                               LINUX_MIB_TCPOFOMERGE);
-                                __kfree_skb(skb1);
+                                tcp_drop(sk, skb1);
                                 goto merge_right;
                         }
-                } else if (tcp_try_coalesce(sk, skb1,
-                                            skb, &fragstolen)) {
+                } else if (tcp_ooo_try_coalesce(sk, skb1,
+                                                skb, &fragstolen)) {
                         goto coalesce_done;
                 }
                 p = &parent->rb_right;
@@ -4924,6 +4942,7 @@ end:
 static void tcp_collapse_ofo_queue(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
+        u32 range_truesize, sum_tiny = 0;
         struct sk_buff *skb, *head;
         u32 start, end;
 
@@ -4935,6 +4954,7 @@ new_range:
         }
         start = TCP_SKB_CB(skb)->seq;
         end = TCP_SKB_CB(skb)->end_seq;
+        range_truesize = skb->truesize;
 
         for (head = skb;;) {
                 skb = skb_rb_next(skb);
@@ -4945,11 +4965,20 @@ new_range:
                 if (!skb ||
                     after(TCP_SKB_CB(skb)->seq, end) ||
                     before(TCP_SKB_CB(skb)->end_seq, start)) {
-                        tcp_collapse(sk, NULL, &tp->out_of_order_queue,
-                                     head, skb, start, end);
+                        /* Do not attempt collapsing tiny skbs */
+                        if (range_truesize != head->truesize ||
+                            end - start >= SKB_WITH_OVERHEAD(SK_MEM_QUANTUM)) {
+                                tcp_collapse(sk, NULL, &tp->out_of_order_queue,
+                                             head, skb, start, end);
+                        } else {
+                                sum_tiny += range_truesize;
+                                if (sum_tiny > sk->sk_rcvbuf >> 3)
+                                        return;
+                        }
                         goto new_range;
                 }
 
+                range_truesize += skb->truesize;
                 if (unlikely(before(TCP_SKB_CB(skb)->seq, start)))
                         start = TCP_SKB_CB(skb)->seq;
                 if (after(TCP_SKB_CB(skb)->end_seq, end))
@@ -4964,6 +4993,7 @@ new_range:
  * 2) not add too big latencies if thousands of packets sit there.
  *    (But if application shrinks SO_RCVBUF, we could still end up
  *     freeing whole queue here)
+ * 3) Drop at least 12.5 % of sk_rcvbuf to avoid malicious attacks.
  *
  * Return true if queue has shrunk.
  */
@@ -4971,20 +5001,26 @@ static bool tcp_prune_ofo_queue(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct rb_node *node, *prev;
+        int goal;
 
         if (RB_EMPTY_ROOT(&tp->out_of_order_queue))
                 return false;
 
         NET_INC_STATS(sock_net(sk), LINUX_MIB_OFOPRUNED);
+        goal = sk->sk_rcvbuf >> 3;
         node = &tp->ooo_last_skb->rbnode;
         do {
                 prev = rb_prev(node);
                 rb_erase(node, &tp->out_of_order_queue);
+                goal -= rb_to_skb(node)->truesize;
                 tcp_drop(sk, rb_to_skb(node));
-                sk_mem_reclaim(sk);
-                if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
-                    !tcp_under_memory_pressure(sk))
-                        break;
+                if (!prev || goal <= 0) {
+                        sk_mem_reclaim(sk);
+                        if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
+                            !tcp_under_memory_pressure(sk))
+                                break;
+                        goal = sk->sk_rcvbuf >> 3;
+                }
                 node = prev;
         } while (node);
         tp->ooo_last_skb = rb_to_skb(prev);
@@ -5019,6 +5055,9 @@ static int tcp_prune_queue(struct sock *sk)
         else if (tcp_under_memory_pressure(sk))
                 tp->rcv_ssthresh = min(tp->rcv_ssthresh, 4U * tp->advmss);
 
+        if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)
+                return 0;
+
         tcp_collapse_ofo_queue(sk);
         if (!skb_queue_empty(&sk->sk_receive_queue))
                 tcp_collapse(sk, &sk->sk_receive_queue, NULL,
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 6cbab56e7407..490df62f26d4 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -160,7 +160,8 @@ static void tcp_event_data_sent(struct tcp_sock *tp,
 }
 
 /* Account for an ACK we sent. */
-static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
+static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts,
+                                      u32 rcv_nxt)
 {
         struct tcp_sock *tp = tcp_sk(sk);
 
@@ -171,6 +172,9 @@ static inline void tcp_event_ack_sent(struct sock *sk, unsigned int pkts)
                 if (hrtimer_try_to_cancel(&tp->compressed_ack_timer) == 1)
                         __sock_put(sk);
         }
+
+        if (unlikely(rcv_nxt != tp->rcv_nxt))
+                return;  /* Special ACK sent by DCTCP to reflect ECN */
         tcp_dec_quickack_mode(sk, pkts);
         inet_csk_clear_xmit_timer(sk, ICSK_TIME_DACK);
 }
@@ -1009,8 +1013,8 @@ static void tcp_update_skb_after_send(struct tcp_sock *tp, struct sk_buff *skb)
  * We are working here with either a clone of the original
  * SKB, or a fresh unique copy made by the retransmit engine.
  */
-static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
-                            gfp_t gfp_mask)
+static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb,
+                              int clone_it, gfp_t gfp_mask, u32 rcv_nxt)
 {
         const struct inet_connection_sock *icsk = inet_csk(sk);
         struct inet_sock *inet;
@@ -1086,7 +1090,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         th->source              = inet->inet_sport;
         th->dest                = inet->inet_dport;
         th->seq                 = htonl(tcb->seq);
-        th->ack_seq             = htonl(tp->rcv_nxt);
+        th->ack_seq             = htonl(rcv_nxt);
         *(((__be16 *)th) + 6)   = htons(((tcp_header_size >> 2) << 12) |
                                         tcb->tcp_flags);
 
@@ -1127,7 +1131,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         icsk->icsk_af_ops->send_check(sk, skb);
 
         if (likely(tcb->tcp_flags & TCPHDR_ACK))
-                tcp_event_ack_sent(sk, tcp_skb_pcount(skb));
+                tcp_event_ack_sent(sk, tcp_skb_pcount(skb), rcv_nxt);
 
         if (skb->len != tcp_header_size) {
                 tcp_event_data_sent(tp, sk);
@@ -1164,6 +1168,13 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         return err;
 }
 
+static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
+                            gfp_t gfp_mask)
+{
+        return __tcp_transmit_skb(sk, skb, clone_it, gfp_mask,
+                                  tcp_sk(sk)->rcv_nxt);
+}
+
 /* This routine just queues the buffer for sending.
  *
  * NOTE: probe0 timer is not checked, do not forget tcp_push_pending_frames,
@@ -3557,7 +3568,7 @@ void tcp_send_delayed_ack(struct sock *sk)
 }
 
 /* This routine sends an ack and also updates the window. */
-void tcp_send_ack(struct sock *sk)
+void __tcp_send_ack(struct sock *sk, u32 rcv_nxt)
 {
         struct sk_buff *buff;
 
@@ -3590,9 +3601,14 @@ void tcp_send_ack(struct sock *sk)
         skb_set_tcp_pure_ack(buff);
 
         /* Send it off, this clears delayed acks for us. */
-        tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0);
+        __tcp_transmit_skb(sk, buff, 0, (__force gfp_t)0, rcv_nxt);
+}
+EXPORT_SYMBOL_GPL(__tcp_send_ack);
+
+void tcp_send_ack(struct sock *sk)
+{
+        __tcp_send_ack(sk, tcp_sk(sk)->rcv_nxt);
 }
-EXPORT_SYMBOL_GPL(tcp_send_ack);
 
 /* This routine sends a packet with an out of date sequence
  * number. It assumes the other end will try to ack it.