1 files changed, 23 insertions, 12 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index ba09016d1bfd..65947c1f4733 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -587,7 +587,7 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
         } rep;
         struct ip_reply_arg arg;
 #ifdef CONFIG_TCP_MD5SIG
-        struct tcp_md5sig_key *key;
+        struct tcp_md5sig_key *key = NULL;
         const __u8 *hash_location = NULL;
         unsigned char newhash[16];
         int genhash;
@@ -627,7 +627,10 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
         net = sk ? sock_net(sk) : dev_net(skb_dst(skb)->dev);
 #ifdef CONFIG_TCP_MD5SIG
         hash_location = tcp_parse_md5sig_option(th);
-        if (!sk && hash_location) {
+        if (sk && sk_fullsock(sk)) {
+                key = tcp_md5_do_lookup(sk, (union tcp_md5_addr *)
+                                        &ip_hdr(skb)->saddr, AF_INET);
+        } else if (hash_location) {
                 /*
                  * active side is lost. Try to find listening socket through
                  * source port, and then find md5 key through listening socket.
@@ -651,10 +654,6 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
                 genhash = tcp_v4_md5_hash_skb(newhash, key, NULL, skb);
                 if (genhash || memcmp(hash_location, newhash, 16) != 0)
                         goto release_sk1;
-        } else {
-                key = sk ? tcp_md5_do_lookup(sk, (union tcp_md5_addr *)
-                                             &ip_hdr(skb)->saddr,
-                                             AF_INET) : NULL;
         }
 
         if (key) {
@@ -675,7 +674,8 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
                                       ip_hdr(skb)->saddr, /* XXX */
                                       arg.iov[0].iov_len, IPPROTO_TCP, 0);
         arg.csumoffset = offsetof(struct tcphdr, check) / 2;
-        arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0;
+        arg.flags = (sk && inet_sk_transparent(sk)) ? IP_REPLY_ARG_NOSRCCHECK : 0;
+
         /* When socket is gone, all binding information is lost.
          * routing might fail in this case. No choice here, if we choose to force
          * input interface, we will misroute in case of asymmetric route.
@@ -683,6 +683,9 @@ static void tcp_v4_send_reset(const struct sock *sk, struct sk_buff *skb)
         if (sk)
                 arg.bound_dev_if = sk->sk_bound_dev_if;
 
+        BUILD_BUG_ON(offsetof(struct sock, sk_bound_dev_if) !=
+                     offsetof(struct inet_timewait_sock, tw_bound_dev_if));
+
         arg.tos = ip_hdr(skb)->tos;
         ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
                               skb, &TCP_SKB_CB(skb)->header.h4.opt,
@@ -921,7 +924,8 @@ int tcp_md5_do_add(struct sock *sk, const union tcp_md5_addr *addr,
         }
 
         md5sig = rcu_dereference_protected(tp->md5sig_info,
-                                           sock_owned_by_user(sk));
+                                           sock_owned_by_user(sk) ||
+                                           lockdep_is_held(&sk->sk_lock.slock));
         if (!md5sig) {
                 md5sig = kmalloc(sizeof(*md5sig), gfp);
                 if (!md5sig)
@@ -1275,6 +1279,7 @@ struct sock *tcp_v4_syn_recv_sock(const struct sock *sk, struct sk_buff *skb,
         ireq                  = inet_rsk(req);
         sk_daddr_set(newsk, ireq->ir_rmt_addr);
         sk_rcv_saddr_set(newsk, ireq->ir_loc_addr);
+        newsk->sk_bound_dev_if = ireq->ir_iif;
         newinet->inet_saddr           = ireq->ir_loc_addr;
         inet_opt              = ireq->opt;
         rcu_assign_pointer(newinet->inet_opt, inet_opt);
@@ -1492,7 +1497,7 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
         if (likely(sk->sk_rx_dst))
                 skb_dst_drop(skb);
         else
-                skb_dst_force(skb);
+                skb_dst_force_safe(skb);
 
         __skb_queue_tail(&tp->ucopy.prequeue, skb);
         tp->ucopy.memory += skb->truesize;
@@ -1704,7 +1709,9 @@ do_time_wait:
                 tcp_v4_timewait_ack(sk, skb);
                 break;
         case TCP_TW_RST:
-                goto no_tcp_socket;
+                tcp_v4_send_reset(sk, skb);
+                inet_twsk_deschedule_put(inet_twsk(sk));
+                goto discard_it;
         case TCP_TW_SUCCESS:;
         }
         goto discard_it;
@@ -1720,8 +1727,7 @@ void inet_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
 
-        if (dst) {
-                dst_hold(dst);
+        if (dst && dst_hold_safe(dst)) {
                 sk->sk_rx_dst = dst;
                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
         }
@@ -2341,6 +2347,7 @@ struct proto tcp_prot = {
         .destroy_cgroup         = tcp_destroy_cgroup,
         .proto_cgroup           = tcp_proto_cgroup,
 #endif
+        .diag_destroy           = tcp_abort,
 };
 EXPORT_SYMBOL(tcp_prot);
 
@@ -2378,6 +2385,10 @@ static int __net_init tcp_sk_init(struct net *net)
         net->ipv4.sysctl_tcp_probe_threshold = TCP_PROBE_THRESHOLD;
         net->ipv4.sysctl_tcp_probe_interval = TCP_PROBE_INTERVAL;
 
+        net->ipv4.sysctl_tcp_keepalive_time = TCP_KEEPALIVE_TIME;
+        net->ipv4.sysctl_tcp_keepalive_probes = TCP_KEEPALIVE_PROBES;
+        net->ipv4.sysctl_tcp_keepalive_intvl = TCP_KEEPALIVE_INTVL;
+
         return 0;
 fail:
         tcp_sk_exit(net);