Merge branch 'foreign/liubo/replace-lockup' into for-chris-4.6

15 files changed, 85 insertions, 24 deletions

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index d79699c9d1b9..eab81bc80e5c 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -208,7 +208,6 @@ ip:
         case htons(ETH_P_IPV6): {
                 const struct ipv6hdr *iph;
                 struct ipv6hdr _iph;
-                __be32 flow_label;
 
 ipv6:
                 iph = __skb_header_pointer(skb, nhoff, sizeof(_iph), data, hlen, &_iph);
@@ -230,8 +229,12 @@ ipv6:
                         key_control->addr_type = FLOW_DISSECTOR_KEY_IPV6_ADDRS;
                 }
 
-                flow_label = ip6_flowlabel(iph);
-                if (flow_label) {
+                if ((dissector_uses_key(flow_dissector,
+                                        FLOW_DISSECTOR_KEY_FLOW_LABEL) ||
+                     (flags & FLOW_DISSECTOR_F_STOP_AT_FLOW_LABEL)) &&
+                    ip6_flowlabel(iph)) {
+                        __be32 flow_label = ip6_flowlabel(iph);
+
                         if (dissector_uses_key(flow_dissector,
                                                FLOW_DISSECTOR_KEY_FLOW_LABEL)) {
                                 key_tags = skb_flow_dissector_target(flow_dissector,
diff --git a/net/core/scm.c b/net/core/scm.c
index 14596fb37172..2696aefdc148 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                 *fplp = fpl;
                 fpl->count = 0;
                 fpl->max = SCM_MAX_FD;
+                fpl->user = NULL;
         }
         fpp = &fpl->fp[fpl->count];
 
@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                 *fpp++ = file;
                 fpl->count++;
         }
+
+        if (!fpl->user)
+                fpl->user = get_uid(current_user());
+
         return num;
 }
 
@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *scm)
                 scm->fp = NULL;
                 for (i=fpl->count-1; i>=0; i--)
                         fput(fpl->fp[i]);
+                free_uid(fpl->user);
                 kfree(fpl);
         }
 }
@@ -336,6 +342,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
                 for (i = 0; i < fpl->count; i++)
                         get_file(fpl->fp[i]);
                 new_fpl->max = new_fpl->count;
+                new_fpl->user = get_uid(fpl->user);
         }
         return new_fpl;
 }
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index b2df375ec9c2..5bf88f58bee7 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -79,6 +79,8 @@
 
 struct kmem_cache *skbuff_head_cache __read_mostly;
 static struct kmem_cache *skbuff_fclone_cache __read_mostly;
+int sysctl_max_skb_frags __read_mostly = MAX_SKB_FRAGS;
+EXPORT_SYMBOL(sysctl_max_skb_frags);
 
 /**
  *      skb_panic - private function for out-of-line support
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 95b6139d710c..a6beb7b6ae55 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -26,6 +26,7 @@ static int zero = 0;
 static int one = 1;
 static int min_sndbuf = SOCK_MIN_SNDBUF;
 static int min_rcvbuf = SOCK_MIN_RCVBUF;
+static int max_skb_frags = MAX_SKB_FRAGS;
 
 static int net_msg_warn;        /* Unused, but still a sysctl */
 
@@ -392,6 +393,15 @@ static struct ctl_table net_core_table[] = {
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec
         },
+        {
+                .procname       = "max_skb_frags",
+                .data           = &sysctl_max_skb_frags,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec_minmax,
+                .extra1         = &one,
+                .extra2         = &max_skb_frags,
+        },
         { }
 };
 
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 7c51c4e1661f..56fdf4e0dce4 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1240,6 +1240,14 @@ struct net_device *gretap_fb_dev_create(struct net *net, const char *name,
         err = ipgre_newlink(net, dev, tb, NULL);
         if (err < 0)
                 goto out;
+
+        /* openvswitch users expect packet sizes to be unrestricted,
+         * so set the largest MTU we can.
+         */
+        err = __ip_tunnel_change_mtu(dev, IP_MAX_MTU, false);
+        if (err)
+                goto out;
+
         return dev;
 out:
         free_netdev(dev);
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index c7bd72e9b544..89e8861e05fc 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -943,17 +943,31 @@ done:
 }
 EXPORT_SYMBOL_GPL(ip_tunnel_ioctl);
 
-int ip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
+int __ip_tunnel_change_mtu(struct net_device *dev, int new_mtu, bool strict)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         int t_hlen = tunnel->hlen + sizeof(struct iphdr);
+        int max_mtu = 0xFFF8 - dev->hard_header_len - t_hlen;
 
-        if (new_mtu < 68 ||
-            new_mtu > 0xFFF8 - dev->hard_header_len - t_hlen)
+        if (new_mtu < 68)
                 return -EINVAL;
+
+        if (new_mtu > max_mtu) {
+                if (strict)
+                        return -EINVAL;
+
+                new_mtu = max_mtu;
+        }
+
         dev->mtu = new_mtu;
         return 0;
 }
+EXPORT_SYMBOL_GPL(__ip_tunnel_change_mtu);
+
+int ip_tunnel_change_mtu(struct net_device *dev, int new_mtu)
+{
+        return __ip_tunnel_change_mtu(dev, new_mtu, true);
+}
 EXPORT_SYMBOL_GPL(ip_tunnel_change_mtu);
 
 static void ip_tunnel_dev_free(struct net_device *dev)
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 19746b3fcbbe..0c36ef4a3f86 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -940,7 +940,7 @@ new_segment:
 
                 i = skb_shinfo(skb)->nr_frags;
                 can_coalesce = skb_can_coalesce(skb, i, page, offset);
-                if (!can_coalesce && i >= MAX_SKB_FRAGS) {
+                if (!can_coalesce && i >= sysctl_max_skb_frags) {
                         tcp_mark_push(tp, skb);
                         goto new_segment;
                 }
@@ -1213,7 +1213,7 @@ new_segment:
 
                         if (!skb_can_coalesce(skb, i, pfrag->page,
                                               pfrag->offset)) {
-                                if (i == MAX_SKB_FRAGS || !sg) {
+                                if (i == sysctl_max_skb_frags || !sg) {
                                         tcp_mark_push(tp, skb);
                                         goto new_segment;
                                 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a4d523709ab3..7f6ff037adaf 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -311,7 +311,7 @@ static void do_redirect(struct sk_buff *skb, struct sock *sk)
 
 
 /* handle ICMP messages on TCP_NEW_SYN_RECV request sockets */
-void tcp_req_err(struct sock *sk, u32 seq)
+void tcp_req_err(struct sock *sk, u32 seq, bool abort)
 {
         struct request_sock *req = inet_reqsk(sk);
         struct net *net = sock_net(sk);
@@ -323,7 +323,7 @@ void tcp_req_err(struct sock *sk, u32 seq)
 
         if (seq != tcp_rsk(req)->snt_isn) {
                 NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
-        } else {
+        } else if (abort) {
                 /*
                  * Still in SYN_RECV, just remove it silently.
                  * There is no good way to pass the error to the newly
@@ -383,7 +383,12 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
         }
         seq = ntohl(th->seq);
         if (sk->sk_state == TCP_NEW_SYN_RECV)
-                return tcp_req_err(sk, seq);
+                return tcp_req_err(sk, seq,
+                                  type == ICMP_PARAMETERPROB ||
+                                  type == ICMP_TIME_EXCEEDED ||
+                                  (type == ICMP_DEST_UNREACH &&
+                                   (code == ICMP_NET_UNREACH ||
+                                    code == ICMP_HOST_UNREACH)));
 
         bh_lock_sock(sk);
         /* If too many ICMPs get dropped on busy
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 38eeddedfc21..9efd9ffdc34c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3538,6 +3538,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
 {
         struct inet6_dev *idev = ifp->idev;
         struct net_device *dev = idev->dev;
+        bool notify = false;
 
         addrconf_join_solict(dev, &ifp->addr);
 
@@ -3583,7 +3584,7 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
                         /* Because optimistic nodes can use this address,
                          * notify listeners. If DAD fails, RTM_DELADDR is sent.
                          */
-                        ipv6_ifa_notify(RTM_NEWADDR, ifp);
+                        notify = true;
                 }
         }
 
@@ -3591,6 +3592,8 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
 out:
         spin_unlock(&ifp->lock);
         read_unlock_bh(&idev->lock);
+        if (notify)
+                ipv6_ifa_notify(RTM_NEWADDR, ifp);
 }
 
 static void addrconf_dad_start(struct inet6_ifaddr *ifp)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 1f9ebe3cbb4a..dc2db4f7b182 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -540,12 +540,13 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                 }
                 spin_lock_bh(&ip6_sk_fl_lock);
                 for (sflp = &np->ipv6_fl_list;
-                     (sfl = rcu_dereference(*sflp)) != NULL;
+                     (sfl = rcu_dereference_protected(*sflp,
+                                                      lockdep_is_held(&ip6_sk_fl_lock))) != NULL;
                      sflp = &sfl->next) {
                         if (sfl->fl->label == freq.flr_label) {
                                 if (freq.flr_label == (np->flow_label&IPV6_FLOWLABEL_MASK))
                                         np->flow_label &= ~IPV6_FLOWLABEL_MASK;
-                                *sflp = rcu_dereference(sfl->next);
+                                *sflp = sfl->next;
                                 spin_unlock_bh(&ip6_sk_fl_lock);
                                 fl_release(sfl->fl);
                                 kfree_rcu(sfl, rcu);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 006396e31cb0..1a5a70fb8551 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -327,6 +327,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         struct tcp_sock *tp;
         __u32 seq, snd_una;
         struct sock *sk;
+        bool fatal;
         int err;
 
         sk = __inet6_lookup_established(net, &tcp_hashinfo,
@@ -345,8 +346,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 return;
         }
         seq = ntohl(th->seq);
+        fatal = icmpv6_err_convert(type, code, &err);
         if (sk->sk_state == TCP_NEW_SYN_RECV)
-                return tcp_req_err(sk, seq);
+                return tcp_req_err(sk, seq, fatal);
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk) && type != ICMPV6_PKT_TOOBIG)
@@ -400,7 +402,6 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 goto out;
         }
 
-        icmpv6_err_convert(type, code, &err);
 
         /* Might be for an request_sock */
         switch (sk->sk_state) {
diff --git a/net/openvswitch/vport-vxlan.c b/net/openvswitch/vport-vxlan.c
index 1605691d9414..de9cb19efb6a 100644
--- a/net/openvswitch/vport-vxlan.c
+++ b/net/openvswitch/vport-vxlan.c
@@ -91,6 +91,8 @@ static struct vport *vxlan_tnl_create(const struct vport_parms *parms)
         struct vxlan_config conf = {
                 .no_share = true,
                 .flags = VXLAN_F_COLLECT_METADATA,
+                /* Don't restrict the packets that can be sent by MTU */
+                .mtu = IP_MAX_MTU,
         };
 
         if (!options) {
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 5ca2ebfe0be8..e878da0949db 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5538,6 +5538,7 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
         struct sctp_hmac_algo_param *hmacs;
         __u16 data_len = 0;
         u32 num_idents;
+        int i;
 
         if (!ep->auth_enable)
                 return -EACCES;
@@ -5555,8 +5556,12 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
                 return -EFAULT;
         if (put_user(num_idents, &p->shmac_num_idents))
                 return -EFAULT;
-        if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
-                return -EFAULT;
+        for (i = 0; i < num_idents; i++) {
+                __u16 hmacid = ntohs(hmacs->hmac_ids[i]);
+
+                if (copy_to_user(&p->shmac_idents[i], &hmacid, sizeof(__u16)))
+                        return -EFAULT;
+        }
         return 0;
 }
 
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 49d5093eb055..29be035f9c65 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1496,7 +1496,7 @@ static void unix_detach_fds(struct scm_cookie *scm, struct sk_buff *skb)
         UNIXCB(skb).fp = NULL;
 
         for (i = scm->fp->count-1; i >= 0; i--)
-                unix_notinflight(scm->fp->fp[i]);
+                unix_notinflight(scm->fp->user, scm->fp->fp[i]);
 }
 
 static void unix_destruct_scm(struct sk_buff *skb)
@@ -1561,7 +1561,7 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
                 return -ENOMEM;
 
         for (i = scm->fp->count - 1; i >= 0; i--)
-                unix_inflight(scm->fp->fp[i]);
+                unix_inflight(scm->fp->user, scm->fp->fp[i]);
         return max_level;
 }
 
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 8fcdc2283af5..6a0d48525fcf 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -116,7 +116,7 @@ struct sock *unix_get_socket(struct file *filp)
  * descriptor if it is for an AF_UNIX socket.
  */
 
-void unix_inflight(struct file *fp)
+void unix_inflight(struct user_struct *user, struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
 
@@ -133,11 +133,11 @@ void unix_inflight(struct file *fp)
                 }
                 unix_tot_inflight++;
         }
-        fp->f_cred->user->unix_inflight++;
+        user->unix_inflight++;
         spin_unlock(&unix_gc_lock);
 }
 
-void unix_notinflight(struct file *fp)
+void unix_notinflight(struct user_struct *user, struct file *fp)
 {
         struct sock *s = unix_get_socket(fp);
 
@@ -152,7 +152,7 @@ void unix_notinflight(struct file *fp)
                         list_del_init(&u->link);
                 unix_tot_inflight--;
         }
-        fp->f_cred->user->unix_inflight--;
+        user->unix_inflight--;
         spin_unlock(&unix_gc_lock);
 }