Merge branch 'x86/urgent' into x86/cache, to pick up dependent fix

Signed-off-by: Ingo Molnar <mingo@kernel.org>

7 files changed, 17 insertions, 10 deletions

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index dfd5009f96ef..15e7f7915a21 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -544,7 +544,8 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk,
         struct ip_options_rcu *opt;
         struct rtable *rt;
 
-        opt = ireq_opt_deref(ireq);
+        rcu_read_lock();
+        opt = rcu_dereference(ireq->ireq_opt);
 
         flowi4_init_output(fl4, ireq->ir_iif, ireq->ir_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
@@ -558,11 +559,13 @@ struct dst_entry *inet_csk_route_req(const struct sock *sk,
                 goto no_route;
         if (opt && opt->opt.is_strictroute && rt->rt_uses_gateway)
                 goto route_err;
+        rcu_read_unlock();
         return &rt->dst;
 
 route_err:
         ip_rt_put(rt);
 no_route:
+        rcu_read_unlock();
         __IP_INC_STATS(net, IPSTATS_MIB_OUTNOROUTES);
         return NULL;
 }
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index c0fe5ad996f2..26c36cccabdc 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -149,7 +149,6 @@ static void ip_cmsg_recv_security(struct msghdr *msg, struct sk_buff *skb)
 static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
 {
         struct sockaddr_in sin;
-        const struct iphdr *iph = ip_hdr(skb);
         __be16 *ports;
         int end;
 
@@ -164,7 +163,7 @@ static void ip_cmsg_recv_dstaddr(struct msghdr *msg, struct sk_buff *skb)
         ports = (__be16 *)skb_transport_header(skb);
 
         sin.sin_family = AF_INET;
-        sin.sin_addr.s_addr = iph->daddr;
+        sin.sin_addr.s_addr = ip_hdr(skb)->daddr;
         sin.sin_port = ports[1];
         memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
 
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index b92f422f2fa8..891ed2f91467 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -48,6 +48,7 @@ static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
 static int ip_ping_group_range_min[] = { 0, 0 };
 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
 static int comp_sack_nr_max = 255;
+static u32 u32_max_div_HZ = UINT_MAX / HZ;
 
 /* obsolete */
 static int sysctl_tcp_low_latency __read_mostly;
@@ -745,9 +746,10 @@ static struct ctl_table ipv4_net_table[] = {
         {
                 .procname       = "tcp_probe_interval",
                 .data           = &init_net.ipv4.sysctl_tcp_probe_interval,
-                .maxlen         = sizeof(int),
+                .maxlen         = sizeof(u32),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec,
+                .proc_handler   = proc_douintvec_minmax,
+                .extra2         = &u32_max_div_HZ,
         },
         {
                 .procname       = "igmp_link_local_mcast_reports",
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 4cf2f7bb2802..47e08c1b5bc3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6009,11 +6009,13 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
                         if (th->fin)
                                 goto discard;
                         /* It is possible that we process SYN packets from backlog,
-                         * so we need to make sure to disable BH right there.
+                         * so we need to make sure to disable BH and RCU right there.
                          */
+                        rcu_read_lock();
                         local_bh_disable();
                         acceptable = icsk->icsk_af_ops->conn_request(sk, skb) >= 0;
                         local_bh_enable();
+                        rcu_read_unlock();
 
                         if (!acceptable)
                                 return 1;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 44c09eddbb78..cd426313a298 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -943,9 +943,11 @@ static int tcp_v4_send_synack(const struct sock *sk, struct dst_entry *dst,
         if (skb) {
                 __tcp_v4_send_check(skb, ireq->ir_loc_addr, ireq->ir_rmt_addr);
 
+                rcu_read_lock();
                 err = ip_build_and_send_pkt(skb, sk, ireq->ir_loc_addr,
                                             ireq->ir_rmt_addr,
-                                            ireq_opt_deref(ireq));
+                                            rcu_dereference(ireq->ireq_opt));
+                rcu_read_unlock();
                 err = net_xmit_eval(err);
         }
 
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index bcfc00e88756..f8de2482a529 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -67,6 +67,7 @@ int xfrm4_transport_finish(struct sk_buff *skb, int async)
 
         if (xo && (xo->flags & XFRM_GRO)) {
                 skb_mac_header_rebuild(skb);
+                skb_reset_transport_header(skb);
                 return 0;
         }
 
diff --git a/net/ipv4/xfrm4_mode_transport.c b/net/ipv4/xfrm4_mode_transport.c
index 3d36644890bb..1ad2c2c4e250 100644
--- a/net/ipv4/xfrm4_mode_transport.c
+++ b/net/ipv4/xfrm4_mode_transport.c
@@ -46,7 +46,6 @@ static int xfrm4_transport_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int ihl = skb->data - skb_transport_header(skb);
-        struct xfrm_offload *xo = xfrm_offload(skb);
 
         if (skb->transport_header != skb->network_header) {
                 memmove(skb_transport_header(skb),
@@ -54,8 +53,7 @@ static int xfrm4_transport_input(struct xfrm_state *x, struct sk_buff *skb)
                 skb->network_header = skb->transport_header;
         }
         ip_hdr(skb)->tot_len = htons(skb->len + ihl);
-        if (!xo || !(xo->flags & XFRM_GRO))
-                skb_reset_transport_header(skb);
+        skb_reset_transport_header(skb);
         return 0;
 }