11 files changed, 101 insertions, 38 deletions

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index cebd9d31e65a..f6303b17546b 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1847,7 +1847,7 @@ static int inet_netconf_get_devconf(struct sk_buff *in_skb,
         if (err < 0)
                 goto errout;
 
-        err = EINVAL;
+        err = -EINVAL;
         if (!tb[NETCONFA_IFINDEX])
                 goto errout;
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 46b9c887bede..64148914803a 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -789,14 +789,16 @@ static void inet_child_forget(struct sock *sk, struct request_sock *req,
         reqsk_put(req);
 }
 
-void inet_csk_reqsk_queue_add(struct sock *sk, struct request_sock *req,
-                              struct sock *child)
+struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
+                                      struct request_sock *req,
+                                      struct sock *child)
 {
         struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
 
         spin_lock(&queue->rskq_lock);
         if (unlikely(sk->sk_state != TCP_LISTEN)) {
                 inet_child_forget(sk, req, child);
+                child = NULL;
         } else {
                 req->sk = child;
                 req->dl_next = NULL;
@@ -808,6 +810,7 @@ void inet_csk_reqsk_queue_add(struct sock *sk, struct request_sock *req,
                 sk_acceptq_added(sk);
         }
         spin_unlock(&queue->rskq_lock);
+        return child;
 }
 EXPORT_SYMBOL(inet_csk_reqsk_queue_add);
 
@@ -817,11 +820,8 @@ struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child,
         if (own_req) {
                 inet_csk_reqsk_queue_drop(sk, req);
                 reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
-                inet_csk_reqsk_queue_add(sk, req, child);
-                /* Warning: caller must not call reqsk_put(req);
-                 * child stole last reference on it.
-                 */
-                return child;
+                if (inet_csk_reqsk_queue_add(sk, req, child))
+                        return child;
         }
         /* Too bad, another child took ownership of the request, undo. */
         bh_unlock_sock(child);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 56fdf4e0dce4..41ba68de46d8 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1054,8 +1054,9 @@ static const struct net_device_ops gre_tap_netdev_ops = {
 static void ipgre_tap_setup(struct net_device *dev)
 {
         ether_setup(dev);
-        dev->netdev_ops         = &gre_tap_netdev_ops;
-        dev->priv_flags         |= IFF_LIVE_ADDR_CHANGE;
+        dev->netdev_ops = &gre_tap_netdev_ops;
+        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+        dev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
         ip_tunnel_setup(dev, gre_tap_net_id);
 }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 5f73a7c03e27..a50124260f5a 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -249,6 +249,8 @@ int ip_cmsg_send(struct net *net, struct msghdr *msg, struct ipcm_cookie *ipc,
                 switch (cmsg->cmsg_type) {
                 case IP_RETOPTS:
                         err = cmsg->cmsg_len - CMSG_ALIGN(sizeof(struct cmsghdr));
+
+                        /* Our caller is responsible for freeing ipc->opt */
                         err = ip_options_get(net, &ipc->opt, CMSG_DATA(cmsg),
                                              err < 40 ? err : 40);
                         if (err)
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index c117b21b937d..d3a27165f9cc 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -746,8 +746,10 @@ static int ping_v4_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 
         if (msg->msg_controllen) {
                 err = ip_cmsg_send(sock_net(sk), msg, &ipc, false);
-                if (err)
+                if (unlikely(err)) {
+                        kfree(ipc.opt);
                         return err;
+                }
                 if (ipc.opt)
                         free = 1;
         }
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bc35f1842512..7113bae4e6a0 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -547,8 +547,10 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 
         if (msg->msg_controllen) {
                 err = ip_cmsg_send(net, msg, &ipc, false);
-                if (err)
+                if (unlikely(err)) {
+                        kfree(ipc.opt);
                         goto out;
+                }
                 if (ipc.opt)
                         free = 1;
         }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 85f184e429c6..02c62299d717 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -129,6 +129,7 @@ static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
 static int ip_rt_min_pmtu __read_mostly         = 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly       = 256;
 
+static int ip_rt_gc_timeout __read_mostly       = RT_GC_TIMEOUT;
 /*
  *      Interface to generic destination cache.
  */
@@ -755,7 +756,7 @@ static void __ip_do_redirect(struct rtable *rt, struct sk_buff *skb, struct flow
                                 struct fib_nh *nh = &FIB_RES_NH(res);
 
                                 update_or_create_fnhe(nh, fl4->daddr, new_gw,
-                                                      0, 0);
+                                                0, jiffies + ip_rt_gc_timeout);
                         }
                         if (kill_route)
                                 rt->dst.obsolete = DST_OBSOLETE_KILL;
@@ -1556,6 +1557,36 @@ static void ip_handle_martian_source(struct net_device *dev,
 #endif
 }
 
+static void ip_del_fnhe(struct fib_nh *nh, __be32 daddr)
+{
+        struct fnhe_hash_bucket *hash;
+        struct fib_nh_exception *fnhe, __rcu **fnhe_p;
+        u32 hval = fnhe_hashfun(daddr);
+
+        spin_lock_bh(&fnhe_lock);
+
+        hash = rcu_dereference_protected(nh->nh_exceptions,
+                                         lockdep_is_held(&fnhe_lock));
+        hash += hval;
+
+        fnhe_p = &hash->chain;
+        fnhe = rcu_dereference_protected(*fnhe_p, lockdep_is_held(&fnhe_lock));
+        while (fnhe) {
+                if (fnhe->fnhe_daddr == daddr) {
+                        rcu_assign_pointer(*fnhe_p, rcu_dereference_protected(
+                                fnhe->fnhe_next, lockdep_is_held(&fnhe_lock)));
+                        fnhe_flush_routes(fnhe);
+                        kfree_rcu(fnhe, rcu);
+                        break;
+                }
+                fnhe_p = &fnhe->fnhe_next;
+                fnhe = rcu_dereference_protected(fnhe->fnhe_next,
+                                                 lockdep_is_held(&fnhe_lock));
+        }
+
+        spin_unlock_bh(&fnhe_lock);
+}
+
 /* called in rcu_read_lock() section */
 static int __mkroute_input(struct sk_buff *skb,
                            const struct fib_result *res,
@@ -1609,11 +1640,20 @@ static int __mkroute_input(struct sk_buff *skb,
 
         fnhe = find_exception(&FIB_RES_NH(*res), daddr);
         if (do_cache) {
-                if (fnhe)
+                if (fnhe) {
                         rth = rcu_dereference(fnhe->fnhe_rth_input);
-                else
-                        rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
+                        if (rth && rth->dst.expires &&
+                            time_after(jiffies, rth->dst.expires)) {
+                                ip_del_fnhe(&FIB_RES_NH(*res), daddr);
+                                fnhe = NULL;
+                        } else {
+                                goto rt_cache;
+                        }
+                }
+
+                rth = rcu_dereference(FIB_RES_NH(*res).nh_rth_input);
 
+rt_cache:
                 if (rt_cache_valid(rth)) {
                         skb_dst_set_noref(skb, &rth->dst);
                         goto out;
@@ -2014,19 +2054,29 @@ static struct rtable *__mkroute_output(const struct fib_result *res,
                 struct fib_nh *nh = &FIB_RES_NH(*res);
 
                 fnhe = find_exception(nh, fl4->daddr);
-                if (fnhe)
+                if (fnhe) {
                         prth = &fnhe->fnhe_rth_output;
-                else {
-                        if (unlikely(fl4->flowi4_flags &
-                                     FLOWI_FLAG_KNOWN_NH &&
-                                     !(nh->nh_gw &&
-                                       nh->nh_scope == RT_SCOPE_LINK))) {
-                                do_cache = false;
-                                goto add;
+                        rth = rcu_dereference(*prth);
+                        if (rth && rth->dst.expires &&
+                            time_after(jiffies, rth->dst.expires)) {
+                                ip_del_fnhe(nh, fl4->daddr);
+                                fnhe = NULL;
+                        } else {
+                                goto rt_cache;
                         }
-                        prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
                 }
+
+                if (unlikely(fl4->flowi4_flags &
+                             FLOWI_FLAG_KNOWN_NH &&
+                             !(nh->nh_gw &&
+                               nh->nh_scope == RT_SCOPE_LINK))) {
+                        do_cache = false;
+                        goto add;
+                }
+                prth = raw_cpu_ptr(nh->nh_pcpu_rth_output);
                 rth = rcu_dereference(*prth);
+
+rt_cache:
                 if (rt_cache_valid(rth)) {
                         dst_hold(&rth->dst);
                         return rth;
@@ -2569,7 +2619,6 @@ void ip_rt_multicast_event(struct in_device *in_dev)
 }
 
 #ifdef CONFIG_SYSCTL
-static int ip_rt_gc_timeout __read_mostly       = RT_GC_TIMEOUT;
 static int ip_rt_gc_interval __read_mostly  = 60 * HZ;
 static int ip_rt_gc_min_interval __read_mostly  = HZ / 2;
 static int ip_rt_gc_elasticity __read_mostly    = 8;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0c36ef4a3f86..483ffdf5aa4d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2950,7 +2950,7 @@ static void __tcp_alloc_md5sig_pool(void)
                         struct crypto_hash *hash;
 
                         hash = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
-                        if (IS_ERR_OR_NULL(hash))
+                        if (IS_ERR(hash))
                                 return;
                         per_cpu(tcp_md5sig_pool, cpu).md5_desc.tfm = hash;
                 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 1c2a73406261..3b2c8e90a475 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2896,7 +2896,10 @@ static void tcp_update_rtt_min(struct sock *sk, u32 rtt_us)
 {
         const u32 now = tcp_time_stamp, wlen = sysctl_tcp_min_rtt_wlen * HZ;
         struct rtt_meas *m = tcp_sk(sk)->rtt_min;
-        struct rtt_meas rttm = { .rtt = (rtt_us ? : 1), .ts = now };
+        struct rtt_meas rttm = {
+                .rtt = likely(rtt_us) ? rtt_us : jiffies_to_usecs(1),
+                .ts = now,
+        };
         u32 elapsed;
 
         /* Check if the new measurement updates the 1st, 2nd, or 3rd choices */
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 7f6ff037adaf..487ac67059e2 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1597,28 +1597,30 @@ process:
 
         if (sk->sk_state == TCP_NEW_SYN_RECV) {
                 struct request_sock *req = inet_reqsk(sk);
-                struct sock *nsk = NULL;
+                struct sock *nsk;
 
                 sk = req->rsk_listener;
-                if (tcp_v4_inbound_md5_hash(sk, skb))
-                        goto discard_and_relse;
-                if (likely(sk->sk_state == TCP_LISTEN)) {
-                        nsk = tcp_check_req(sk, skb, req, false);
-                } else {
+                if (unlikely(tcp_v4_inbound_md5_hash(sk, skb))) {
+                        reqsk_put(req);
+                        goto discard_it;
+                }
+                if (unlikely(sk->sk_state != TCP_LISTEN)) {
                         inet_csk_reqsk_queue_drop_and_put(sk, req);
                         goto lookup;
                 }
+                sock_hold(sk);
+                nsk = tcp_check_req(sk, skb, req, false);
                 if (!nsk) {
                         reqsk_put(req);
-                        goto discard_it;
+                        goto discard_and_relse;
                 }
                 if (nsk == sk) {
-                        sock_hold(sk);
                         reqsk_put(req);
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v4_send_reset(nsk, skb);
-                        goto discard_it;
+                        goto discard_and_relse;
                 } else {
+                        sock_put(sk);
                         return 0;
                 }
         }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index be0b21852b13..95d2f198017e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1048,8 +1048,10 @@ int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
         if (msg->msg_controllen) {
                 err = ip_cmsg_send(sock_net(sk), msg, &ipc,
                                    sk->sk_family == AF_INET6);
-                if (err)
+                if (unlikely(err)) {
+                        kfree(ipc.opt);
                         return err;
+                }
                 if (ipc.opt)
                         free = 1;
                 connected = 0;