Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:
 "Several bug fixes, some to new features appearing in this merge
  window, some that have been around for a while.

  I have a short list of known problems that need to be sorted out, but
  all of them can be solved easily during the run up to 3.6-final.

  I'll be offline until Sunday afternoon, but nothing need hold up
  3.6-rc1 and the close of the merge window, networking wise, at this
  point.

  1) Fix interface check in ipv4 TCP early demux, from Eric Dumazet.

  2) Fix a long standing bug in TCP DMA to userspace offload that can
     hang applications using MSG_TRUNC, from Jiri Kosina.

  3) Don't allow TCP_USER_TIMEOUT to be negative, from Hangbin Liu.

  4) Don't use GFP_KERNEL under spinlock in kaweth driver, from Dan
     Carpenter"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  tcp: perform DMA to userspace only if there is a task waiting for it
  Revert "openvswitch: potential NULL deref in sample()"
  ipv4: fix TCP early demux
  net: fix rtnetlink IFF_PROMISC and IFF_ALLMULTI handling
  USB: kaweth.c: use GFP_ATOMIC under spin_lock
  tcp: Add TCP_USER_TIMEOUT negative value check
  bcma: add missing iounmap on error path
  bcma: fix regression in interrupt assignment on mips
  mac80211_hwsim: fix possible race condition in usage of info->control.sta & control.vif

6 files changed, 22 insertions, 14 deletions

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 334b930e0de3..bc9e380f0abf 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -659,6 +659,12 @@ static void set_operstate(struct net_device *dev, unsigned char transition)
         }
 }
 
+static unsigned int rtnl_dev_get_flags(const struct net_device *dev)
+{
+        return (dev->flags & ~(IFF_PROMISC | IFF_ALLMULTI)) |
+               (dev->gflags & (IFF_PROMISC | IFF_ALLMULTI));
+}
+
 static unsigned int rtnl_dev_combine_flags(const struct net_device *dev,
                                            const struct ifinfomsg *ifm)
 {
@@ -667,7 +673,7 @@ static unsigned int rtnl_dev_combine_flags(const struct net_device *dev,
         /* bugwards compatibility: ifi_change == 0 is treated as ~0 */
         if (ifm->ifi_change)
                 flags = (flags & ifm->ifi_change) |
-                        (dev->flags & ~ifm->ifi_change);
+                        (rtnl_dev_get_flags(dev) & ~ifm->ifi_change);
 
         return flags;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 581ecf02c6b5..e7e6eeae49c0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2681,7 +2681,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 /* Cap the max timeout in ms TCP will retry/retrans
                  * before giving up and aborting (ETIMEDOUT) a connection.
                  */
-                icsk->icsk_user_timeout = msecs_to_jiffies(val);
+                if (val < 0)
+                        err = -EINVAL;
+                else
+                        icsk->icsk_user_timeout = msecs_to_jiffies(val);
                 break;
         default:
                 err = -ENOPROTOOPT;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3e07a64ca44e..a356e1fecf9a 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5475,7 +5475,9 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                         if (tp->copied_seq == tp->rcv_nxt &&
                             len - tcp_header_len <= tp->ucopy.len) {
 #ifdef CONFIG_NET_DMA
-                                if (tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
+                                if (tp->ucopy.task == current &&
+                                    sock_owned_by_user(sk) &&
+                                    tcp_dma_try_early_copy(sk, skb, tcp_header_len)) {
                                         copied_early = 1;
                                         eaten = 1;
                                 }
@@ -5603,6 +5605,7 @@ void tcp_finish_connect(struct sock *sk, struct sk_buff *skb)
 
         if (skb != NULL) {
                 sk->sk_rx_dst = dst_clone(skb_dst(skb));
+                inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
                 security_inet_conn_established(sk, skb);
         }
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index b6b07c93924c..2fbd9921253f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1620,17 +1620,15 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
                 sock_rps_save_rxhash(sk, skb);
                 if (sk->sk_rx_dst) {
                         struct dst_entry *dst = sk->sk_rx_dst;
-                        if (dst->ops->check(dst, 0) == NULL) {
+                        if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
+                            dst->ops->check(dst, 0) == NULL) {
                                 dst_release(dst);
                                 sk->sk_rx_dst = NULL;
                         }
                 }
                 if (unlikely(sk->sk_rx_dst == NULL)) {
-                        struct inet_sock *icsk = inet_sk(sk);
-                        struct rtable *rt = skb_rtable(skb);
-
-                        sk->sk_rx_dst = dst_clone(&rt->dst);
-                        icsk->rx_dst_ifindex = inet_iif(skb);
+                        sk->sk_rx_dst = dst_clone(skb_dst(skb));
+                        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
                 }
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len)) {
                         rsk = sk;
@@ -1709,11 +1707,11 @@ void tcp_v4_early_demux(struct sk_buff *skb)
                 skb->destructor = sock_edemux;
                 if (sk->sk_state != TCP_TIME_WAIT) {
                         struct dst_entry *dst = sk->sk_rx_dst;
-                        struct inet_sock *icsk = inet_sk(sk);
+
                         if (dst)
                                 dst = dst_check(dst, 0);
                         if (dst &&
-                            icsk->rx_dst_ifindex == skb->skb_iif)
+                            inet_sk(sk)->rx_dst_ifindex == skb->skb_iif)
                                 skb_dst_set_noref(skb, dst);
                 }
         }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 5912ac3fd240..3f1cc2028edd 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -388,6 +388,7 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                 struct tcp_cookie_values *oldcvp = oldtp->cookie_values;
 
                 newsk->sk_rx_dst = dst_clone(skb_dst(skb));
+                inet_sk(newsk)->rx_dst_ifindex = skb->skb_iif;
 
                 /* TCP Cookie Transactions require space for the cookie pair,
                  * as it differs for each connection.  There is no need to
diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 320fa0e6951a..f3f96badf5aa 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c
@@ -325,9 +325,6 @@ static int sample(struct datapath *dp, struct sk_buff *skb,
                 }
         }
 
-        if (!acts_list)
-                return 0;
-
         return do_execute_actions(dp, skb, nla_data(acts_list),
                                                  nla_len(acts_list), true);
 }