6 files changed, 40 insertions, 82 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 30eedf677913..7990984ca364 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -148,6 +148,9 @@ struct list_head ptype_all __read_mostly;	/* Taps */
 static struct list_head offload_base __read_mostly;
 
 static int netif_rx_internal(struct sk_buff *skb);
+static int call_netdevice_notifiers_info(unsigned long val,
+                                         struct net_device *dev,
+                                         struct netdev_notifier_info *info);
 
 /*
  * The @dev_base_head list is protected by @dev_base_lock and the rtnl
@@ -1207,7 +1210,11 @@ EXPORT_SYMBOL(netdev_features_change);
 void netdev_state_change(struct net_device *dev)
 {
         if (dev->flags & IFF_UP) {
-                call_netdevice_notifiers(NETDEV_CHANGE, dev);
+                struct netdev_notifier_change_info change_info;
+
+                change_info.flags_changed = 0;
+                call_netdevice_notifiers_info(NETDEV_CHANGE, dev,
+                                              &change_info.info);
                 rtmsg_ifinfo(RTM_NEWLINK, dev, 0, GFP_KERNEL);
         }
 }
@@ -4227,9 +4234,8 @@ static int process_backlog(struct napi_struct *napi, int quota)
 #endif
         napi->weight = weight_p;
         local_irq_disable();
-        while (work < quota) {
+        while (1) {
                 struct sk_buff *skb;
-                unsigned int qlen;
 
                 while ((skb = __skb_dequeue(&sd->process_queue))) {
                         local_irq_enable();
@@ -4243,24 +4249,24 @@ static int process_backlog(struct napi_struct *napi, int quota)
                 }
 
                 rps_lock(sd);
-                qlen = skb_queue_len(&sd->input_pkt_queue);
-                if (qlen)
-                        skb_queue_splice_tail_init(&sd->input_pkt_queue,
-                                                   &sd->process_queue);
-
-                if (qlen < quota - work) {
+                if (skb_queue_empty(&sd->input_pkt_queue)) {
                         /*
                          * Inline a custom version of __napi_complete().
                          * only current cpu owns and manipulates this napi,
-                         * and NAPI_STATE_SCHED is the only possible flag set on backlog.
-                         * we can use a plain write instead of clear_bit(),
+                         * and NAPI_STATE_SCHED is the only possible flag set
+                         * on backlog.
+                         * We can use a plain write instead of clear_bit(),
                          * and we dont need an smp_mb() memory barrier.
                          */
                         list_del(&napi->poll_list);
                         napi->state = 0;
+                        rps_unlock(sd);
 
-                        quota = work + qlen;
+                        break;
                 }
+
+                skb_queue_splice_tail_init(&sd->input_pkt_queue,
+                                           &sd->process_queue);
                 rps_unlock(sd);
         }
         local_irq_enable();
diff --git a/net/core/dst.c b/net/core/dst.c
index 80d6286c8b62..a028409ee438 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -269,6 +269,15 @@ again:
 }
 EXPORT_SYMBOL(dst_destroy);
 
+static void dst_destroy_rcu(struct rcu_head *head)
+{
+        struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
+
+        dst = dst_destroy(dst);
+        if (dst)
+                __dst_free(dst);
+}
+
 void dst_release(struct dst_entry *dst)
 {
         if (dst) {
@@ -276,11 +285,8 @@ void dst_release(struct dst_entry *dst)
 
                 newrefcnt = atomic_dec_return(&dst->__refcnt);
                 WARN_ON(newrefcnt < 0);
-                if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) {
-                        dst = dst_destroy(dst);
-                        if (dst)
-                                __dst_free(dst);
-                }
+                if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt)
+                        call_rcu(&dst->rcu_head, dst_destroy_rcu);
         }
 }
 EXPORT_SYMBOL(dst_release);
diff --git a/net/core/filter.c b/net/core/filter.c
index 735fad897496..1dbf6462f766 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -840,11 +840,11 @@ int sk_convert_filter(struct sock_filter *prog, int len,
         BUILD_BUG_ON(BPF_MEMWORDS * sizeof(u32) > MAX_BPF_STACK);
         BUILD_BUG_ON(BPF_REG_FP + 1 != MAX_BPF_REG);
 
-        if (len <= 0 || len >= BPF_MAXINSNS)
+        if (len <= 0 || len > BPF_MAXINSNS)
                 return -EINVAL;
 
         if (new_prog) {
-                addrs = kzalloc(len * sizeof(*addrs), GFP_KERNEL);
+                addrs = kcalloc(len, sizeof(*addrs), GFP_KERNEL);
                 if (!addrs)
                         return -ENOMEM;
         }
@@ -1101,7 +1101,7 @@ static int check_load_and_stores(struct sock_filter *filter, int flen)
 
         BUILD_BUG_ON(BPF_MEMWORDS > 16);
 
-        masks = kmalloc(flen * sizeof(*masks), GFP_KERNEL);
+        masks = kmalloc_array(flen, sizeof(*masks), GFP_KERNEL);
         if (!masks)
                 return -ENOMEM;
 
@@ -1382,7 +1382,7 @@ static struct sk_filter *__sk_migrate_realloc(struct sk_filter *fp,
         fp_new = sock_kmalloc(sk, len, GFP_KERNEL);
         if (fp_new) {
                 *fp_new = *fp;
-                /* As we're kepping orig_prog in fp_new along,
+                /* As we're keeping orig_prog in fp_new along,
                  * we need to make sure we're not evicting it
                  * from the old fp.
                  */
@@ -1524,8 +1524,8 @@ static struct sk_filter *__sk_prepare_filter(struct sk_filter *fp,
 
 /**
  *      sk_unattached_filter_create - create an unattached filter
- *      @fprog: the filter program
  *      @pfp: the unattached filter that is created
+ *      @fprog: the filter program
  *
  * Create a filter independent of any socket. We first run some
  * sanity checks on it to make sure it does not explode on us later.
diff --git a/net/core/iovec.c b/net/core/iovec.c
index b61869429f4c..827dd6beb49c 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -75,61 +75,6 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr_storage *a
 }
 
 /*
- *      Copy kernel to iovec. Returns -EFAULT on error.
- */
-
-int memcpy_toiovecend(const struct iovec *iov, unsigned char *kdata,
-                      int offset, int len)
-{
-        int copy;
-        for (; len > 0; ++iov) {
-                /* Skip over the finished iovecs */
-                if (unlikely(offset >= iov->iov_len)) {
-                        offset -= iov->iov_len;
-                        continue;
-                }
-                copy = min_t(unsigned int, iov->iov_len - offset, len);
-                if (copy_to_user(iov->iov_base + offset, kdata, copy))
-                        return -EFAULT;
-                offset = 0;
-                kdata += copy;
-                len -= copy;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(memcpy_toiovecend);
-
-/*
- *      Copy iovec to kernel. Returns -EFAULT on error.
- */
-
-int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
-                        int offset, int len)
-{
-        /* Skip over the finished iovecs */
-        while (offset >= iov->iov_len) {
-                offset -= iov->iov_len;
-                iov++;
-        }
-
-        while (len > 0) {
-                u8 __user *base = iov->iov_base + offset;
-                int copy = min_t(unsigned int, len, iov->iov_len - offset);
-
-                offset = 0;
-                if (copy_from_user(kdata, base, copy))
-                        return -EFAULT;
-                len -= copy;
-                kdata += copy;
-                iov++;
-        }
-
-        return 0;
-}
-EXPORT_SYMBOL(memcpy_fromiovecend);
-
-/*
  *      And now for the all-in-one: copy and checksum from a user iovec
  *      directly to a datagram
  *      Calls to csum_partial but the last must be in 32 bit chunks
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 32d872eec7f5..559890b0f0a2 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -3059,11 +3059,12 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
                 memset(&t->neigh_vars[NEIGH_VAR_GC_INTERVAL], 0,
                        sizeof(t->neigh_vars[NEIGH_VAR_GC_INTERVAL]));
         } else {
+                struct neigh_table *tbl = p->tbl;
                 dev_name_source = "default";
-                t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = (int *)(p + 1);
-                t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = (int *)(p + 1) + 1;
-                t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = (int *)(p + 1) + 2;
-                t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = (int *)(p + 1) + 3;
+                t->neigh_vars[NEIGH_VAR_GC_INTERVAL].data = &tbl->gc_interval;
+                t->neigh_vars[NEIGH_VAR_GC_THRESH1].data = &tbl->gc_thresh1;
+                t->neigh_vars[NEIGH_VAR_GC_THRESH2].data = &tbl->gc_thresh2;
+                t->neigh_vars[NEIGH_VAR_GC_THRESH3].data = &tbl->gc_thresh3;
         }
 
         if (handler) {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 9cd5344fad73..c1a33033cbe2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2993,7 +2993,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
                                                             skb_put(nskb, len),
                                                             len, 0);
                         SKB_GSO_CB(nskb)->csum_start =
-                            skb_headroom(nskb) + offset;
+                            skb_headroom(nskb) + doffset;
                         continue;
                 }