7 files changed, 47 insertions, 29 deletions

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 00ee068efc1c..d12e3a9a5356 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -65,6 +65,7 @@ ipv6:
                 nhoff += sizeof(struct ipv6hdr);
                 break;
         }
+        case __constant_htons(ETH_P_8021AD):
         case __constant_htons(ETH_P_8021Q): {
                 const struct vlan_hdr *vlan;
                 struct vlan_hdr _vlan;
@@ -345,14 +346,9 @@ u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
                 if (new_index < 0)
                         new_index = skb_tx_hash(dev, skb);
 
-                if (queue_index != new_index && sk) {
-                        struct dst_entry *dst =
-                                    rcu_dereference_check(sk->sk_dst_cache, 1);
-
-                        if (dst && skb_dst(skb) == dst)
-                                sk_tx_queue_set(sk, queue_index);
-
-                }
+                if (queue_index != new_index && sk &&
+                    rcu_access_pointer(sk->sk_dst_cache))
+                        sk_tx_queue_set(sk, queue_index);
 
                 queue_index = new_index;
         }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b7de821f98df..60533db8b72d 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1441,16 +1441,18 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
                 atomic_set(&p->refcnt, 1);
                 p->reachable_time =
                                 neigh_rand_reach_time(p->base_reachable_time);
+                dev_hold(dev);
+                p->dev = dev;
+                write_pnet(&p->net, hold_net(net));
+                p->sysctl_table = NULL;
 
                 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
+                        release_net(net);
+                        dev_put(dev);
                         kfree(p);
                         return NULL;
                 }
 
-                dev_hold(dev);
-                p->dev = dev;
-                write_pnet(&p->net, hold_net(net));
-                p->sysctl_table = NULL;
                 write_lock_bh(&tbl->lock);
                 p->next         = tbl->parms.next;
                 tbl->parms.next = p;
@@ -2767,6 +2769,7 @@ EXPORT_SYMBOL(neigh_app_ns);
 
 #ifdef CONFIG_SYSCTL
 static int zero;
+static int int_max = INT_MAX;
 static int unres_qlen_max = INT_MAX / SKB_TRUESIZE(ETH_FRAME_LEN);
 
 static int proc_unres_qlen(struct ctl_table *ctl, int write,
@@ -2819,19 +2822,25 @@ static struct neigh_sysctl_table {
                         .procname       = "mcast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_UCAST_PROBE] = {
                         .procname       = "ucast_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_APP_PROBE] = {
                         .procname       = "app_solicit",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_RETRANS_TIME] = {
                         .procname       = "retrans_time",
@@ -2874,7 +2883,9 @@ static struct neigh_sysctl_table {
                         .procname       = "proxy_qlen",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_ANYCAST_DELAY] = {
                         .procname       = "anycast_delay",
@@ -2916,19 +2927,25 @@ static struct neigh_sysctl_table {
                         .procname       = "gc_thresh1",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH2] = {
                         .procname       = "gc_thresh2",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 [NEIGH_VAR_GC_THRESH3] = {
                         .procname       = "gc_thresh3",
                         .maxlen         = sizeof(int),
                         .mode           = 0644,
-                        .proc_handler   = proc_dointvec,
+                        .extra1         = &zero,
+                        .extra2         = &int_max,
+                        .proc_handler   = proc_dointvec_minmax,
                 },
                 {},
         },
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 3de740834d1f..ca198c1d1d30 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2156,7 +2156,7 @@ int ndo_dflt_fdb_del(struct ndmsg *ndm,
         /* If aging addresses are supported device will need to
          * implement its own handler for this.
          */
-        if (ndm->ndm_state & NUD_PERMANENT) {
+        if (!(ndm->ndm_state & NUD_PERMANENT)) {
                 pr_info("%s: FDB only supports static addresses\n", dev->name);
                 return -EINVAL;
         }
@@ -2384,7 +2384,7 @@ static int rtnl_bridge_getlink(struct sk_buff *skb, struct netlink_callback *cb)
         struct nlattr *extfilt;
         u32 filter_mask = 0;
 
-        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct rtgenmsg),
+        extfilt = nlmsg_find_attr(cb->nlh, sizeof(struct ifinfomsg),
                                   IFLA_EXT_MASK);
         if (extfilt)
                 filter_mask = nla_get_u32(extfilt);
diff --git a/net/core/scm.c b/net/core/scm.c
index 03795d0147f2..b4da80b1cc07 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -54,7 +54,7 @@ static __inline__ int scm_check_creds(struct ucred *creds)
                 return -EINVAL;
 
         if ((creds->pid == task_tgid_vnr(current) ||
-             ns_capable(current->nsproxy->pid_ns->user_ns, CAP_SYS_ADMIN)) &&
+             ns_capable(task_active_pid_ns(current)->user_ns, CAP_SYS_ADMIN)) &&
             ((uid_eq(uid, cred->uid)   || uid_eq(uid, cred->euid) ||
               uid_eq(uid, cred->suid)) || nsown_capable(CAP_SETUID)) &&
             ((gid_eq(gid, cred->gid)   || gid_eq(gid, cred->egid) ||
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 20e02d2605ec..2c3d0f53d198 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -309,7 +309,8 @@ EXPORT_SYMBOL(__alloc_skb);
  * @frag_size: size of fragment, or 0 if head was kmalloced
  *
  * Allocate a new &sk_buff. Caller provides space holding head and
- * skb_shared_info. @data must have been allocated by kmalloc()
+ * skb_shared_info. @data must have been allocated by kmalloc() only if
+ * @frag_size is 0, otherwise data should come from the page allocator.
  * The return is the new skb buffer.
  * On a failure the return is %NULL, and @data is not freed.
  * Notes :
@@ -739,7 +740,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
 
         skb_copy_secmark(new, old);
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         new->napi_id    = old->napi_id;
 #endif
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 548d716c5f62..2c097c5a35dd 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -900,7 +900,7 @@ set_rcvbuf:
                 sock_valbool_flag(sk, SOCK_SELECT_ERR_QUEUE, valbool);
                 break;
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         case SO_BUSY_POLL:
                 /* allow unprivileged users to decrease the value */
                 if ((val > sk->sk_ll_usec) && !capable(CAP_NET_ADMIN))
@@ -1170,7 +1170,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 v.val = sock_flag(sk, SOCK_SELECT_ERR_QUEUE);
                 break;
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         case SO_BUSY_POLL:
                 v.val = sk->sk_ll_usec;
                 break;
@@ -2292,7 +2292,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
 
         sk->sk_stamp = ktime_set(-1L, 0);
 
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         sk->sk_napi_id          =       0;
         sk->sk_ll_usec          =       sysctl_net_busy_read;
 #endif
diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
index 660968616637..31107abd2783 100644
--- a/net/core/sysctl_net_core.c
+++ b/net/core/sysctl_net_core.c
@@ -21,7 +21,9 @@
 #include <net/net_ratelimit.h>
 #include <net/busy_poll.h>
 
+static int zero = 0;
 static int one = 1;
+static int ushort_max = USHRT_MAX;
 
 #ifdef CONFIG_RPS
 static int rps_sock_flow_sysctl(struct ctl_table *table, int write,
@@ -298,7 +300,7 @@ static struct ctl_table net_core_table[] = {
                 .proc_handler   = flow_limit_table_len_sysctl
         },
 #endif /* CONFIG_NET_FLOW_LIMIT */
-#ifdef CONFIG_NET_LL_RX_POLL
+#ifdef CONFIG_NET_RX_BUSY_POLL
         {
                 .procname       = "busy_poll",
                 .data           = &sysctl_net_busy_poll,
@@ -339,7 +341,9 @@ static struct ctl_table netns_core_table[] = {
                 .data           = &init_net.core.sysctl_somaxconn,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = proc_dointvec
+                .extra1         = &zero,
+                .extra2         = &ushort_max,
+                .proc_handler   = proc_dointvec_minmax
         },
         { }
 };