sync to Linus v4.13-rc2 for subsystem developers to work against

1 files changed, 16 insertions, 11 deletions

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 6a7fe7660551..7b52a380d710 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -212,7 +212,7 @@ EXPORT_SYMBOL_GPL(unix_peer_get);
 
 static inline void unix_release_addr(struct unix_address *addr)
 {
-        if (atomic_dec_and_test(&addr->refcnt))
+        if (refcount_dec_and_test(&addr->refcnt))
                 kfree(addr);
 }
 
@@ -343,7 +343,7 @@ found:
  * are still connected to it and there's no way to inform "a polling
  * implementation" that it should let go of a certain wait queue
  *
- * In order to propagate a wake up, a wait_queue_t of the client
+ * In order to propagate a wake up, a wait_queue_entry_t of the client
  * socket is enqueued on the peer_wait queue of the server socket
  * whose wake function does a wake_up on the ordinary client socket
  * wait queue. This connection is established whenever a write (or
@@ -352,7 +352,7 @@ found:
  * was relayed.
  */
 
-static int unix_dgram_peer_wake_relay(wait_queue_t *q, unsigned mode, int flags,
+static int unix_dgram_peer_wake_relay(wait_queue_entry_t *q, unsigned mode, int flags,
                                       void *key)
 {
         struct unix_sock *u;
@@ -442,7 +442,7 @@ static int unix_dgram_peer_wake_me(struct sock *sk, struct sock *other)
 static int unix_writable(const struct sock *sk)
 {
         return sk->sk_state != TCP_LISTEN &&
-               (atomic_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
+               (refcount_read(&sk->sk_wmem_alloc) << 2) <= sk->sk_sndbuf;
 }
 
 static void unix_write_space(struct sock *sk)
@@ -487,7 +487,7 @@ static void unix_sock_destructor(struct sock *sk)
 
         skb_queue_purge(&sk->sk_receive_queue);
 
-        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(refcount_read(&sk->sk_wmem_alloc));
         WARN_ON(!sk_unhashed(sk));
         WARN_ON(sk->sk_socket);
         if (!sock_flag(sk, SOCK_DEAD)) {
@@ -864,7 +864,7 @@ static int unix_autobind(struct socket *sock)
                 goto out;
 
         addr->name->sun_family = AF_UNIX;
-        atomic_set(&addr->refcnt, 1);
+        refcount_set(&addr->refcnt, 1);
 
 retry:
         addr->len = sprintf(addr->name->sun_path+1, "%05x", ordernum) + 1 + sizeof(short);
@@ -999,7 +999,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         struct path path = { };
 
         err = -EINVAL;
-        if (sunaddr->sun_family != AF_UNIX)
+        if (addr_len < offsetofend(struct sockaddr_un, sun_family) ||
+            sunaddr->sun_family != AF_UNIX)
                 goto out;
 
         if (addr_len == sizeof(short)) {
@@ -1039,7 +1040,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
         memcpy(addr->name, sunaddr, addr_len);
         addr->len = addr_len;
         addr->hash = hash ^ sk->sk_type;
-        atomic_set(&addr->refcnt, 1);
+        refcount_set(&addr->refcnt, 1);
 
         if (sun_path[0]) {
                 addr->hash = UNIX_HASH_SIZE;
@@ -1110,6 +1111,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr,
         unsigned int hash;
         int err;
 
+        err = -EINVAL;
+        if (alen < offsetofend(struct sockaddr, sa_family))
+                goto out;
+
         if (addr->sa_family != AF_UNSPEC) {
                 err = unix_mkname(sunaddr, alen, &hash);
                 if (err < 0)
@@ -1330,7 +1335,7 @@ restart:
 
         /* copy address information from listening to new sock*/
         if (otheru->addr) {
-                atomic_inc(&otheru->addr->refcnt);
+                refcount_inc(&otheru->addr->refcnt);
                 newu->addr = otheru->addr;
         }
         if (otheru->path.dentry) {
@@ -2028,7 +2033,7 @@ alloc_skb:
         skb->len += size;
         skb->data_len += size;
         skb->truesize += size;
-        atomic_add(size, &sk->sk_wmem_alloc);
+        refcount_add(size, &sk->sk_wmem_alloc);
 
         if (newskb) {
                 err = unix_scm_to_skb(&scm, skb, false);
@@ -2842,7 +2847,7 @@ static int unix_seq_show(struct seq_file *seq, void *v)
 
                 seq_printf(seq, "%pK: %08X %08X %08X %04X %02X %5lu",
                         s,
-                        atomic_read(&s->sk_refcnt),
+                        refcount_read(&s->sk_refcnt),
                         0,
                         s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
                         s->sk_type,