aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/batman-adv/distributed-arp-table.c19
-rw-r--r--net/bluetooth/hci_core.c8
-rw-r--r--net/bluetooth/hci_event.c2
-rw-r--r--net/bluetooth/hidp/core.c2
-rw-r--r--net/bluetooth/l2cap_core.c11
-rw-r--r--net/bluetooth/sco.c2
-rw-r--r--net/core/dev.c8
-rw-r--r--net/core/request_sock.c2
-rw-r--r--net/core/scm.c5
-rw-r--r--net/core/skbuff.c44
-rw-r--r--net/ipv4/ah4.c18
-rw-r--r--net/ipv4/datagram.c25
-rw-r--r--net/ipv4/esp4.c12
-rw-r--r--net/ipv4/ip_gre.c6
-rw-r--r--net/ipv4/ip_sockglue.c2
-rw-r--r--net/ipv4/ipcomp.c7
-rw-r--r--net/ipv4/ping.c1
-rw-r--r--net/ipv4/raw.c1
-rw-r--r--net/ipv4/route.c54
-rw-r--r--net/ipv4/tcp.c15
-rw-r--r--net/ipv4/tcp_input.c4
-rw-r--r--net/ipv4/tcp_ipv4.c9
-rw-r--r--net/ipv4/udp.c1
-rw-r--r--net/ipv6/addrconf.c27
-rw-r--r--net/ipv6/ah6.c11
-rw-r--r--net/ipv6/esp6.c5
-rw-r--r--net/ipv6/icmp.c12
-rw-r--r--net/ipv6/ip6_output.c4
-rw-r--r--net/ipv6/ip6mr.c3
-rw-r--r--net/mac80211/cfg.c14
-rw-r--r--net/mac80211/chan.c38
-rw-r--r--net/mac80211/ibss.c9
-rw-r--r--net/mac80211/ieee80211_i.h22
-rw-r--r--net/mac80211/iface.c48
-rw-r--r--net/mac80211/mesh.c8
-rw-r--r--net/mac80211/mesh.h2
-rw-r--r--net/mac80211/mesh_hwmp.c5
-rw-r--r--net/mac80211/mlme.c75
-rw-r--r--net/mac80211/offchannel.c19
-rw-r--r--net/mac80211/scan.c61
-rw-r--r--net/mac80211/sta_info.c46
-rw-r--r--net/mac80211/sta_info.h3
-rw-r--r--net/mac80211/tx.c9
-rw-r--r--net/netfilter/nf_conntrack_core.c9
-rw-r--r--net/netfilter/nf_conntrack_standalone.c1
-rw-r--r--net/netfilter/x_tables.c28
-rw-r--r--net/netfilter/xt_CT.c4
-rw-r--r--net/sctp/outqueue.c12
-rw-r--r--net/sctp/sm_statefuns.c4
-rw-r--r--net/sctp/sysctl.c4
-rw-r--r--net/sunrpc/clnt.c2
-rw-r--r--net/sunrpc/sched.c3
-rw-r--r--net/sunrpc/xprt.c12
-rw-r--r--net/wireless/core.c3
-rw-r--r--net/xfrm/xfrm_policy.c2
-rw-r--r--net/xfrm/xfrm_replay.c4
56 files changed, 527 insertions, 240 deletions
diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index 8e1d89d2b1c1..183f97a86bb2 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -738,6 +738,7 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
738 struct arphdr *arphdr; 738 struct arphdr *arphdr;
739 struct ethhdr *ethhdr; 739 struct ethhdr *ethhdr;
740 __be32 ip_src, ip_dst; 740 __be32 ip_src, ip_dst;
741 uint8_t *hw_src, *hw_dst;
741 uint16_t type = 0; 742 uint16_t type = 0;
742 743
743 /* pull the ethernet header */ 744 /* pull the ethernet header */
@@ -777,9 +778,23 @@ static uint16_t batadv_arp_get_type(struct batadv_priv *bat_priv,
777 ip_src = batadv_arp_ip_src(skb, hdr_size); 778 ip_src = batadv_arp_ip_src(skb, hdr_size);
778 ip_dst = batadv_arp_ip_dst(skb, hdr_size); 779 ip_dst = batadv_arp_ip_dst(skb, hdr_size);
779 if (ipv4_is_loopback(ip_src) || ipv4_is_multicast(ip_src) || 780 if (ipv4_is_loopback(ip_src) || ipv4_is_multicast(ip_src) ||
780 ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst)) 781 ipv4_is_loopback(ip_dst) || ipv4_is_multicast(ip_dst) ||
782 ipv4_is_zeronet(ip_src) || ipv4_is_lbcast(ip_src) ||
783 ipv4_is_zeronet(ip_dst) || ipv4_is_lbcast(ip_dst))
781 goto out; 784 goto out;
782 785
786 hw_src = batadv_arp_hw_src(skb, hdr_size);
787 if (is_zero_ether_addr(hw_src) || is_multicast_ether_addr(hw_src))
788 goto out;
789
790 /* we don't care about the destination MAC address in ARP requests */
791 if (arphdr->ar_op != htons(ARPOP_REQUEST)) {
792 hw_dst = batadv_arp_hw_dst(skb, hdr_size);
793 if (is_zero_ether_addr(hw_dst) ||
794 is_multicast_ether_addr(hw_dst))
795 goto out;
796 }
797
783 type = ntohs(arphdr->ar_op); 798 type = ntohs(arphdr->ar_op);
784out: 799out:
785 return type; 800 return type;
@@ -1012,6 +1027,8 @@ bool batadv_dat_snoop_incoming_arp_reply(struct batadv_priv *bat_priv,
1012 */ 1027 */
1013 ret = !batadv_is_my_client(bat_priv, hw_dst); 1028 ret = !batadv_is_my_client(bat_priv, hw_dst);
1014out: 1029out:
1030 if (ret)
1031 kfree_skb(skb);
1015 /* if ret == false -> packet has to be delivered to the interface */ 1032 /* if ret == false -> packet has to be delivered to the interface */
1016 return ret; 1033 return ret;
1017} 1034}
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index 596660d37c5e..0f78e34220c9 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -2810,14 +2810,6 @@ static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2810 if (conn) { 2810 if (conn) {
2811 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF); 2811 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
2812 2812
2813 hci_dev_lock(hdev);
2814 if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2815 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2816 mgmt_device_connected(hdev, &conn->dst, conn->type,
2817 conn->dst_type, 0, NULL, 0,
2818 conn->dev_class);
2819 hci_dev_unlock(hdev);
2820
2821 /* Send to upper protocol */ 2813 /* Send to upper protocol */
2822 l2cap_recv_acldata(conn, skb, flags); 2814 l2cap_recv_acldata(conn, skb, flags);
2823 return; 2815 return;
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 705078a0cc39..81b44481d0d9 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -2688,7 +2688,7 @@ static void hci_cmd_complete_evt(struct hci_dev *hdev, struct sk_buff *skb)
2688 if (ev->opcode != HCI_OP_NOP) 2688 if (ev->opcode != HCI_OP_NOP)
2689 del_timer(&hdev->cmd_timer); 2689 del_timer(&hdev->cmd_timer);
2690 2690
2691 if (ev->ncmd) { 2691 if (ev->ncmd && !test_bit(HCI_RESET, &hdev->flags)) {
2692 atomic_set(&hdev->cmd_cnt, 1); 2692 atomic_set(&hdev->cmd_cnt, 1);
2693 if (!skb_queue_empty(&hdev->cmd_q)) 2693 if (!skb_queue_empty(&hdev->cmd_q))
2694 queue_work(hdev->workqueue, &hdev->cmd_work); 2694 queue_work(hdev->workqueue, &hdev->cmd_work);
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index b2bcbe2dc328..a7352ff3fd1e 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -931,7 +931,7 @@ static int hidp_setup_hid(struct hidp_session *session,
931 hid->version = req->version; 931 hid->version = req->version;
932 hid->country = req->country; 932 hid->country = req->country;
933 933
934 strncpy(hid->name, req->name, 128); 934 strncpy(hid->name, req->name, sizeof(req->name) - 1);
935 935
936 snprintf(hid->phys, sizeof(hid->phys), "%pMR", 936 snprintf(hid->phys, sizeof(hid->phys), "%pMR",
937 &bt_sk(session->ctrl_sock->sk)->src); 937 &bt_sk(session->ctrl_sock->sk)->src);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 2c78208d793e..22e658322845 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -3727,6 +3727,17 @@ sendresp:
3727static int l2cap_connect_req(struct l2cap_conn *conn, 3727static int l2cap_connect_req(struct l2cap_conn *conn,
3728 struct l2cap_cmd_hdr *cmd, u8 *data) 3728 struct l2cap_cmd_hdr *cmd, u8 *data)
3729{ 3729{
3730 struct hci_dev *hdev = conn->hcon->hdev;
3731 struct hci_conn *hcon = conn->hcon;
3732
3733 hci_dev_lock(hdev);
3734 if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
3735 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &hcon->flags))
3736 mgmt_device_connected(hdev, &hcon->dst, hcon->type,
3737 hcon->dst_type, 0, NULL, 0,
3738 hcon->dev_class);
3739 hci_dev_unlock(hdev);
3740
3730 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0); 3741 l2cap_connect(conn, cmd, data, L2CAP_CONN_RSP, 0);
3731 return 0; 3742 return 0;
3732} 3743}
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 531a93d613d4..57f250c20e39 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -352,7 +352,7 @@ static void __sco_sock_close(struct sock *sk)
352 352
353 case BT_CONNECTED: 353 case BT_CONNECTED:
354 case BT_CONFIG: 354 case BT_CONFIG:
355 if (sco_pi(sk)->conn) { 355 if (sco_pi(sk)->conn->hcon) {
356 sk->sk_state = BT_DISCONN; 356 sk->sk_state = BT_DISCONN;
357 sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT); 357 sco_sock_set_timer(sk, SCO_DISCONN_TIMEOUT);
358 hci_conn_put(sco_pi(sk)->conn->hcon); 358 hci_conn_put(sco_pi(sk)->conn->hcon);
diff --git a/net/core/dev.c b/net/core/dev.c
index 515473ee52cb..f64e439b4a00 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6121,6 +6121,14 @@ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev)
6121 6121
6122static const struct ethtool_ops default_ethtool_ops; 6122static const struct ethtool_ops default_ethtool_ops;
6123 6123
6124void netdev_set_default_ethtool_ops(struct net_device *dev,
6125 const struct ethtool_ops *ops)
6126{
6127 if (dev->ethtool_ops == &default_ethtool_ops)
6128 dev->ethtool_ops = ops;
6129}
6130EXPORT_SYMBOL_GPL(netdev_set_default_ethtool_ops);
6131
6124/** 6132/**
6125 * alloc_netdev_mqs - allocate network device 6133 * alloc_netdev_mqs - allocate network device
6126 * @sizeof_priv: size of private data to allocate space for 6134 * @sizeof_priv: size of private data to allocate space for
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index c31d9e8668c3..4425148d2b51 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -186,8 +186,6 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
186 struct fastopen_queue *fastopenq = 186 struct fastopen_queue *fastopenq =
187 inet_csk(lsk)->icsk_accept_queue.fastopenq; 187 inet_csk(lsk)->icsk_accept_queue.fastopenq;
188 188
189 BUG_ON(!spin_is_locked(&sk->sk_lock.slock) && !sock_owned_by_user(sk));
190
191 tcp_sk(sk)->fastopen_rsk = NULL; 189 tcp_sk(sk)->fastopen_rsk = NULL;
192 spin_lock_bh(&fastopenq->lock); 190 spin_lock_bh(&fastopenq->lock);
193 fastopenq->qlen--; 191 fastopenq->qlen--;
diff --git a/net/core/scm.c b/net/core/scm.c
index 57fb1ee6649f..905dcc6ad1e3 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -35,6 +35,7 @@
35#include <net/sock.h> 35#include <net/sock.h>
36#include <net/compat.h> 36#include <net/compat.h>
37#include <net/scm.h> 37#include <net/scm.h>
38#include <net/cls_cgroup.h>
38 39
39 40
40/* 41/*
@@ -302,8 +303,10 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
302 } 303 }
303 /* Bump the usage count and install the file. */ 304 /* Bump the usage count and install the file. */
304 sock = sock_from_file(fp[i], &err); 305 sock = sock_from_file(fp[i], &err);
305 if (sock) 306 if (sock) {
306 sock_update_netprioidx(sock->sk, current); 307 sock_update_netprioidx(sock->sk, current);
308 sock_update_classid(sock->sk, current);
309 }
307 fd_install(new_fd, get_file(fp[i])); 310 fd_install(new_fd, get_file(fp[i]));
308 } 311 }
309 312
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 3ab989b0de42..a9a2ae3e2213 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1649,7 +1649,7 @@ static void sock_spd_release(struct splice_pipe_desc *spd, unsigned int i)
1649 1649
1650static struct page *linear_to_page(struct page *page, unsigned int *len, 1650static struct page *linear_to_page(struct page *page, unsigned int *len,
1651 unsigned int *offset, 1651 unsigned int *offset,
1652 struct sk_buff *skb, struct sock *sk) 1652 struct sock *sk)
1653{ 1653{
1654 struct page_frag *pfrag = sk_page_frag(sk); 1654 struct page_frag *pfrag = sk_page_frag(sk);
1655 1655
@@ -1682,14 +1682,14 @@ static bool spd_can_coalesce(const struct splice_pipe_desc *spd,
1682static bool spd_fill_page(struct splice_pipe_desc *spd, 1682static bool spd_fill_page(struct splice_pipe_desc *spd,
1683 struct pipe_inode_info *pipe, struct page *page, 1683 struct pipe_inode_info *pipe, struct page *page,
1684 unsigned int *len, unsigned int offset, 1684 unsigned int *len, unsigned int offset,
1685 struct sk_buff *skb, bool linear, 1685 bool linear,
1686 struct sock *sk) 1686 struct sock *sk)
1687{ 1687{
1688 if (unlikely(spd->nr_pages == MAX_SKB_FRAGS)) 1688 if (unlikely(spd->nr_pages == MAX_SKB_FRAGS))
1689 return true; 1689 return true;
1690 1690
1691 if (linear) { 1691 if (linear) {
1692 page = linear_to_page(page, len, &offset, skb, sk); 1692 page = linear_to_page(page, len, &offset, sk);
1693 if (!page) 1693 if (!page)
1694 return true; 1694 return true;
1695 } 1695 }
@@ -1706,23 +1706,9 @@ static bool spd_fill_page(struct splice_pipe_desc *spd,
1706 return false; 1706 return false;
1707} 1707}
1708 1708
1709static inline void __segment_seek(struct page **page, unsigned int *poff,
1710 unsigned int *plen, unsigned int off)
1711{
1712 unsigned long n;
1713
1714 *poff += off;
1715 n = *poff / PAGE_SIZE;
1716 if (n)
1717 *page = nth_page(*page, n);
1718
1719 *poff = *poff % PAGE_SIZE;
1720 *plen -= off;
1721}
1722
1723static bool __splice_segment(struct page *page, unsigned int poff, 1709static bool __splice_segment(struct page *page, unsigned int poff,
1724 unsigned int plen, unsigned int *off, 1710 unsigned int plen, unsigned int *off,
1725 unsigned int *len, struct sk_buff *skb, 1711 unsigned int *len,
1726 struct splice_pipe_desc *spd, bool linear, 1712 struct splice_pipe_desc *spd, bool linear,
1727 struct sock *sk, 1713 struct sock *sk,
1728 struct pipe_inode_info *pipe) 1714 struct pipe_inode_info *pipe)
@@ -1737,23 +1723,19 @@ static bool __splice_segment(struct page *page, unsigned int poff,
1737 } 1723 }
1738 1724
1739 /* ignore any bits we already processed */ 1725 /* ignore any bits we already processed */
1740 if (*off) { 1726 poff += *off;
1741 __segment_seek(&page, &poff, &plen, *off); 1727 plen -= *off;
1742 *off = 0; 1728 *off = 0;
1743 }
1744 1729
1745 do { 1730 do {
1746 unsigned int flen = min(*len, plen); 1731 unsigned int flen = min(*len, plen);
1747 1732
1748 /* the linear region may spread across several pages */ 1733 if (spd_fill_page(spd, pipe, page, &flen, poff,
1749 flen = min_t(unsigned int, flen, PAGE_SIZE - poff); 1734 linear, sk))
1750
1751 if (spd_fill_page(spd, pipe, page, &flen, poff, skb, linear, sk))
1752 return true; 1735 return true;
1753 1736 poff += flen;
1754 __segment_seek(&page, &poff, &plen, flen); 1737 plen -= flen;
1755 *len -= flen; 1738 *len -= flen;
1756
1757 } while (*len && plen); 1739 } while (*len && plen);
1758 1740
1759 return false; 1741 return false;
@@ -1777,7 +1759,7 @@ static bool __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
1777 if (__splice_segment(virt_to_page(skb->data), 1759 if (__splice_segment(virt_to_page(skb->data),
1778 (unsigned long) skb->data & (PAGE_SIZE - 1), 1760 (unsigned long) skb->data & (PAGE_SIZE - 1),
1779 skb_headlen(skb), 1761 skb_headlen(skb),
1780 offset, len, skb, spd, 1762 offset, len, spd,
1781 skb_head_is_locked(skb), 1763 skb_head_is_locked(skb),
1782 sk, pipe)) 1764 sk, pipe))
1783 return true; 1765 return true;
@@ -1790,7 +1772,7 @@ static bool __skb_splice_bits(struct sk_buff *skb, struct pipe_inode_info *pipe,
1790 1772
1791 if (__splice_segment(skb_frag_page(f), 1773 if (__splice_segment(skb_frag_page(f),
1792 f->page_offset, skb_frag_size(f), 1774 f->page_offset, skb_frag_size(f),
1793 offset, len, skb, spd, false, sk, pipe)) 1775 offset, len, spd, false, sk, pipe))
1794 return true; 1776 return true;
1795 } 1777 }
1796 1778
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index a0d8392491c3..a69b4e4a02b5 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -269,7 +269,11 @@ static void ah_input_done(struct crypto_async_request *base, int err)
269 skb->network_header += ah_hlen; 269 skb->network_header += ah_hlen;
270 memcpy(skb_network_header(skb), work_iph, ihl); 270 memcpy(skb_network_header(skb), work_iph, ihl);
271 __skb_pull(skb, ah_hlen + ihl); 271 __skb_pull(skb, ah_hlen + ihl);
272 skb_set_transport_header(skb, -ihl); 272
273 if (x->props.mode == XFRM_MODE_TUNNEL)
274 skb_reset_transport_header(skb);
275 else
276 skb_set_transport_header(skb, -ihl);
273out: 277out:
274 kfree(AH_SKB_CB(skb)->tmp); 278 kfree(AH_SKB_CB(skb)->tmp);
275 xfrm_input_resume(skb, err); 279 xfrm_input_resume(skb, err);
@@ -381,7 +385,10 @@ static int ah_input(struct xfrm_state *x, struct sk_buff *skb)
381 skb->network_header += ah_hlen; 385 skb->network_header += ah_hlen;
382 memcpy(skb_network_header(skb), work_iph, ihl); 386 memcpy(skb_network_header(skb), work_iph, ihl);
383 __skb_pull(skb, ah_hlen + ihl); 387 __skb_pull(skb, ah_hlen + ihl);
384 skb_set_transport_header(skb, -ihl); 388 if (x->props.mode == XFRM_MODE_TUNNEL)
389 skb_reset_transport_header(skb);
390 else
391 skb_set_transport_header(skb, -ihl);
385 392
386 err = nexthdr; 393 err = nexthdr;
387 394
@@ -413,9 +420,12 @@ static void ah4_err(struct sk_buff *skb, u32 info)
413 if (!x) 420 if (!x)
414 return; 421 return;
415 422
416 if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) 423 if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
424 atomic_inc(&flow_cache_genid);
425 rt_genid_bump(net);
426
417 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_AH, 0); 427 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_AH, 0);
418 else 428 } else
419 ipv4_redirect(skb, net, 0, 0, IPPROTO_AH, 0); 429 ipv4_redirect(skb, net, 0, 0, IPPROTO_AH, 0);
420 xfrm_state_put(x); 430 xfrm_state_put(x);
421} 431}
diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
index 424fafbc8cb0..b28e863fe0a7 100644
--- a/net/ipv4/datagram.c
+++ b/net/ipv4/datagram.c
@@ -85,3 +85,28 @@ out:
85 return err; 85 return err;
86} 86}
87EXPORT_SYMBOL(ip4_datagram_connect); 87EXPORT_SYMBOL(ip4_datagram_connect);
88
89void ip4_datagram_release_cb(struct sock *sk)
90{
91 const struct inet_sock *inet = inet_sk(sk);
92 const struct ip_options_rcu *inet_opt;
93 __be32 daddr = inet->inet_daddr;
94 struct flowi4 fl4;
95 struct rtable *rt;
96
97 if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0))
98 return;
99
100 rcu_read_lock();
101 inet_opt = rcu_dereference(inet->inet_opt);
102 if (inet_opt && inet_opt->opt.srr)
103 daddr = inet_opt->opt.faddr;
104 rt = ip_route_output_ports(sock_net(sk), &fl4, sk, daddr,
105 inet->inet_saddr, inet->inet_dport,
106 inet->inet_sport, sk->sk_protocol,
107 RT_CONN_FLAGS(sk), sk->sk_bound_dev_if);
108 if (!IS_ERR(rt))
109 __sk_dst_set(sk, &rt->dst);
110 rcu_read_unlock();
111}
112EXPORT_SYMBOL_GPL(ip4_datagram_release_cb);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index b61e9deb7c7e..3b4f0cd2e63e 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -346,7 +346,10 @@ static int esp_input_done2(struct sk_buff *skb, int err)
346 346
347 pskb_trim(skb, skb->len - alen - padlen - 2); 347 pskb_trim(skb, skb->len - alen - padlen - 2);
348 __skb_pull(skb, hlen); 348 __skb_pull(skb, hlen);
349 skb_set_transport_header(skb, -ihl); 349 if (x->props.mode == XFRM_MODE_TUNNEL)
350 skb_reset_transport_header(skb);
351 else
352 skb_set_transport_header(skb, -ihl);
350 353
351 err = nexthdr[1]; 354 err = nexthdr[1];
352 355
@@ -499,9 +502,12 @@ static void esp4_err(struct sk_buff *skb, u32 info)
499 if (!x) 502 if (!x)
500 return; 503 return;
501 504
502 if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) 505 if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
506 atomic_inc(&flow_cache_genid);
507 rt_genid_bump(net);
508
503 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ESP, 0); 509 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_ESP, 0);
504 else 510 } else
505 ipv4_redirect(skb, net, 0, 0, IPPROTO_ESP, 0); 511 ipv4_redirect(skb, net, 0, 0, IPPROTO_ESP, 0);
506 xfrm_state_put(x); 512 xfrm_state_put(x);
507} 513}
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 303012adf9e6..e81b1caf2ea2 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -963,8 +963,12 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
963 ptr--; 963 ptr--;
964 } 964 }
965 if (tunnel->parms.o_flags&GRE_CSUM) { 965 if (tunnel->parms.o_flags&GRE_CSUM) {
966 int offset = skb_transport_offset(skb);
967
966 *ptr = 0; 968 *ptr = 0;
967 *(__sum16 *)ptr = ip_compute_csum((void *)(iph+1), skb->len - sizeof(struct iphdr)); 969 *(__sum16 *)ptr = csum_fold(skb_checksum(skb, offset,
970 skb->len - offset,
971 0));
968 } 972 }
969 } 973 }
970 974
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3c9d20880283..d9c4f113d709 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -590,7 +590,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
590 case IP_TTL: 590 case IP_TTL:
591 if (optlen < 1) 591 if (optlen < 1)
592 goto e_inval; 592 goto e_inval;
593 if (val != -1 && (val < 0 || val > 255)) 593 if (val != -1 && (val < 1 || val > 255))
594 goto e_inval; 594 goto e_inval;
595 inet->uc_ttl = val; 595 inet->uc_ttl = val;
596 break; 596 break;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index d3ab47e19a89..9a46daed2f3c 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -47,9 +47,12 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
47 if (!x) 47 if (!x)
48 return; 48 return;
49 49
50 if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) 50 if (icmp_hdr(skb)->type == ICMP_DEST_UNREACH) {
51 atomic_inc(&flow_cache_genid);
52 rt_genid_bump(net);
53
51 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_COMP, 0); 54 ipv4_update_pmtu(skb, net, info, 0, 0, IPPROTO_COMP, 0);
52 else 55 } else
53 ipv4_redirect(skb, net, 0, 0, IPPROTO_COMP, 0); 56 ipv4_redirect(skb, net, 0, 0, IPPROTO_COMP, 0);
54 xfrm_state_put(x); 57 xfrm_state_put(x);
55} 58}
diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
index 8f3d05424a3e..6f9c07268cf6 100644
--- a/net/ipv4/ping.c
+++ b/net/ipv4/ping.c
@@ -738,6 +738,7 @@ struct proto ping_prot = {
738 .recvmsg = ping_recvmsg, 738 .recvmsg = ping_recvmsg,
739 .bind = ping_bind, 739 .bind = ping_bind,
740 .backlog_rcv = ping_queue_rcv_skb, 740 .backlog_rcv = ping_queue_rcv_skb,
741 .release_cb = ip4_datagram_release_cb,
741 .hash = ping_v4_hash, 742 .hash = ping_v4_hash,
742 .unhash = ping_v4_unhash, 743 .unhash = ping_v4_unhash,
743 .get_port = ping_v4_get_port, 744 .get_port = ping_v4_get_port,
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 73d1e4df4bf6..6f08991409c3 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -894,6 +894,7 @@ struct proto raw_prot = {
894 .recvmsg = raw_recvmsg, 894 .recvmsg = raw_recvmsg,
895 .bind = raw_bind, 895 .bind = raw_bind,
896 .backlog_rcv = raw_rcv_skb, 896 .backlog_rcv = raw_rcv_skb,
897 .release_cb = ip4_datagram_release_cb,
897 .hash = raw_hash_sk, 898 .hash = raw_hash_sk,
898 .unhash = raw_unhash_sk, 899 .unhash = raw_unhash_sk,
899 .obj_size = sizeof(struct raw_sock), 900 .obj_size = sizeof(struct raw_sock),
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 844a9ef60dbd..a0fcc47fee73 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -912,6 +912,9 @@ static void __ip_rt_update_pmtu(struct rtable *rt, struct flowi4 *fl4, u32 mtu)
912 struct dst_entry *dst = &rt->dst; 912 struct dst_entry *dst = &rt->dst;
913 struct fib_result res; 913 struct fib_result res;
914 914
915 if (dst_metric_locked(dst, RTAX_MTU))
916 return;
917
915 if (dst->dev->mtu < mtu) 918 if (dst->dev->mtu < mtu)
916 return; 919 return;
917 920
@@ -962,7 +965,7 @@ void ipv4_update_pmtu(struct sk_buff *skb, struct net *net, u32 mtu,
962} 965}
963EXPORT_SYMBOL_GPL(ipv4_update_pmtu); 966EXPORT_SYMBOL_GPL(ipv4_update_pmtu);
964 967
965void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu) 968static void __ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
966{ 969{
967 const struct iphdr *iph = (const struct iphdr *) skb->data; 970 const struct iphdr *iph = (const struct iphdr *) skb->data;
968 struct flowi4 fl4; 971 struct flowi4 fl4;
@@ -975,6 +978,53 @@ void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
975 ip_rt_put(rt); 978 ip_rt_put(rt);
976 } 979 }
977} 980}
981
982void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu)
983{
984 const struct iphdr *iph = (const struct iphdr *) skb->data;
985 struct flowi4 fl4;
986 struct rtable *rt;
987 struct dst_entry *dst;
988 bool new = false;
989
990 bh_lock_sock(sk);
991 rt = (struct rtable *) __sk_dst_get(sk);
992
993 if (sock_owned_by_user(sk) || !rt) {
994 __ipv4_sk_update_pmtu(skb, sk, mtu);
995 goto out;
996 }
997
998 __build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0);
999
1000 if (!__sk_dst_check(sk, 0)) {
1001 rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1002 if (IS_ERR(rt))
1003 goto out;
1004
1005 new = true;
1006 }
1007
1008 __ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu);
1009
1010 dst = dst_check(&rt->dst, 0);
1011 if (!dst) {
1012 if (new)
1013 dst_release(&rt->dst);
1014
1015 rt = ip_route_output_flow(sock_net(sk), &fl4, sk);
1016 if (IS_ERR(rt))
1017 goto out;
1018
1019 new = true;
1020 }
1021
1022 if (new)
1023 __sk_dst_set(sk, &rt->dst);
1024
1025out:
1026 bh_unlock_sock(sk);
1027}
978EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu); 1028EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu);
979 1029
980void ipv4_redirect(struct sk_buff *skb, struct net *net, 1030void ipv4_redirect(struct sk_buff *skb, struct net *net,
@@ -1120,7 +1170,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
1120 if (!mtu || time_after_eq(jiffies, rt->dst.expires)) 1170 if (!mtu || time_after_eq(jiffies, rt->dst.expires))
1121 mtu = dst_metric_raw(dst, RTAX_MTU); 1171 mtu = dst_metric_raw(dst, RTAX_MTU);
1122 1172
1123 if (mtu && rt_is_output_route(rt)) 1173 if (mtu)
1124 return mtu; 1174 return mtu;
1125 1175
1126 mtu = dst->dev->mtu; 1176 mtu = dst->dev->mtu;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1ca253635f7a..2aa69c8ae60c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1428,12 +1428,12 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
1428} 1428}
1429#endif 1429#endif
1430 1430
1431static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off) 1431static struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
1432{ 1432{
1433 struct sk_buff *skb; 1433 struct sk_buff *skb;
1434 u32 offset; 1434 u32 offset;
1435 1435
1436 skb_queue_walk(&sk->sk_receive_queue, skb) { 1436 while ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) {
1437 offset = seq - TCP_SKB_CB(skb)->seq; 1437 offset = seq - TCP_SKB_CB(skb)->seq;
1438 if (tcp_hdr(skb)->syn) 1438 if (tcp_hdr(skb)->syn)
1439 offset--; 1439 offset--;
@@ -1441,6 +1441,11 @@ static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
1441 *off = offset; 1441 *off = offset;
1442 return skb; 1442 return skb;
1443 } 1443 }
1444 /* This looks weird, but this can happen if TCP collapsing
1445 * splitted a fat GRO packet, while we released socket lock
1446 * in skb_splice_bits()
1447 */
1448 sk_eat_skb(sk, skb, false);
1444 } 1449 }
1445 return NULL; 1450 return NULL;
1446} 1451}
@@ -1482,7 +1487,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
1482 break; 1487 break;
1483 } 1488 }
1484 used = recv_actor(desc, skb, offset, len); 1489 used = recv_actor(desc, skb, offset, len);
1485 if (used < 0) { 1490 if (used <= 0) {
1486 if (!copied) 1491 if (!copied)
1487 copied = used; 1492 copied = used;
1488 break; 1493 break;
@@ -1520,8 +1525,10 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
1520 tcp_rcv_space_adjust(sk); 1525 tcp_rcv_space_adjust(sk);
1521 1526
1522 /* Clean up data we have read: This will do ACK frames. */ 1527 /* Clean up data we have read: This will do ACK frames. */
1523 if (copied > 0) 1528 if (copied > 0) {
1529 tcp_recv_skb(sk, seq, &offset);
1524 tcp_cleanup_rbuf(sk, copied); 1530 tcp_cleanup_rbuf(sk, copied);
1531 }
1525 return copied; 1532 return copied;
1526} 1533}
1527EXPORT_SYMBOL(tcp_read_sock); 1534EXPORT_SYMBOL(tcp_read_sock);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a28e4db8a952..18f97ca76b00 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5543,7 +5543,7 @@ slow_path:
5543 if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb)) 5543 if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
5544 goto csum_error; 5544 goto csum_error;
5545 5545
5546 if (!th->ack) 5546 if (!th->ack && !th->rst)
5547 goto discard; 5547 goto discard;
5548 5548
5549 /* 5549 /*
@@ -5988,7 +5988,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
5988 goto discard; 5988 goto discard;
5989 } 5989 }
5990 5990
5991 if (!th->ack) 5991 if (!th->ack && !th->rst)
5992 goto discard; 5992 goto discard;
5993 5993
5994 if (!tcp_validate_incoming(sk, skb, th, 0)) 5994 if (!tcp_validate_incoming(sk, skb, th, 0))
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 54139fa514e6..70b09ef2463b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -369,11 +369,10 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
369 * We do take care of PMTU discovery (RFC1191) special case : 369 * We do take care of PMTU discovery (RFC1191) special case :
370 * we can receive locally generated ICMP messages while socket is held. 370 * we can receive locally generated ICMP messages while socket is held.
371 */ 371 */
372 if (sock_owned_by_user(sk) && 372 if (sock_owned_by_user(sk)) {
373 type != ICMP_DEST_UNREACH && 373 if (!(type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED))
374 code != ICMP_FRAG_NEEDED) 374 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
375 NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS); 375 }
376
377 if (sk->sk_state == TCP_CLOSE) 376 if (sk->sk_state == TCP_CLOSE)
378 goto out; 377 goto out;
379 378
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 79c8dbe59b54..1f4d405eafba 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1952,6 +1952,7 @@ struct proto udp_prot = {
1952 .recvmsg = udp_recvmsg, 1952 .recvmsg = udp_recvmsg,
1953 .sendpage = udp_sendpage, 1953 .sendpage = udp_sendpage,
1954 .backlog_rcv = __udp_queue_rcv_skb, 1954 .backlog_rcv = __udp_queue_rcv_skb,
1955 .release_cb = ip4_datagram_release_cb,
1955 .hash = udp_lib_hash, 1956 .hash = udp_lib_hash,
1956 .unhash = udp_lib_unhash, 1957 .unhash = udp_lib_unhash,
1957 .rehash = udp_v4_rehash, 1958 .rehash = udp_v4_rehash,
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 408cac4ae00a..420e56326384 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -154,6 +154,11 @@ static void addrconf_type_change(struct net_device *dev,
154 unsigned long event); 154 unsigned long event);
155static int addrconf_ifdown(struct net_device *dev, int how); 155static int addrconf_ifdown(struct net_device *dev, int how);
156 156
157static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
158 int plen,
159 const struct net_device *dev,
160 u32 flags, u32 noflags);
161
157static void addrconf_dad_start(struct inet6_ifaddr *ifp); 162static void addrconf_dad_start(struct inet6_ifaddr *ifp);
158static void addrconf_dad_timer(unsigned long data); 163static void addrconf_dad_timer(unsigned long data);
159static void addrconf_dad_completed(struct inet6_ifaddr *ifp); 164static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
@@ -250,12 +255,6 @@ static inline bool addrconf_qdisc_ok(const struct net_device *dev)
250 return !qdisc_tx_is_noop(dev); 255 return !qdisc_tx_is_noop(dev);
251} 256}
252 257
253/* Check if a route is valid prefix route */
254static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
255{
256 return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;
257}
258
259static void addrconf_del_timer(struct inet6_ifaddr *ifp) 258static void addrconf_del_timer(struct inet6_ifaddr *ifp)
260{ 259{
261 if (del_timer(&ifp->timer)) 260 if (del_timer(&ifp->timer))
@@ -941,17 +940,15 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
941 if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) { 940 if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) {
942 struct in6_addr prefix; 941 struct in6_addr prefix;
943 struct rt6_info *rt; 942 struct rt6_info *rt;
944 struct net *net = dev_net(ifp->idev->dev);
945 struct flowi6 fl6 = {};
946 943
947 ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len); 944 ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
948 fl6.flowi6_oif = ifp->idev->dev->ifindex;
949 fl6.daddr = prefix;
950 rt = (struct rt6_info *)ip6_route_lookup(net, &fl6,
951 RT6_LOOKUP_F_IFACE);
952 945
953 if (rt != net->ipv6.ip6_null_entry && 946 rt = addrconf_get_prefix_route(&prefix,
954 addrconf_is_prefix_route(rt)) { 947 ifp->prefix_len,
948 ifp->idev->dev,
949 0, RTF_GATEWAY | RTF_DEFAULT);
950
951 if (rt) {
955 if (onlink == 0) { 952 if (onlink == 0) {
956 ip6_del_rt(rt); 953 ip6_del_rt(rt);
957 rt = NULL; 954 rt = NULL;
@@ -1877,7 +1874,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
1877 continue; 1874 continue;
1878 if ((rt->rt6i_flags & flags) != flags) 1875 if ((rt->rt6i_flags & flags) != flags)
1879 continue; 1876 continue;
1880 if ((noflags != 0) && ((rt->rt6i_flags & flags) != 0)) 1877 if ((rt->rt6i_flags & noflags) != 0)
1881 continue; 1878 continue;
1882 dst_hold(&rt->dst); 1879 dst_hold(&rt->dst);
1883 break; 1880 break;
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index ecc35b93314b..384233188ac1 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -472,7 +472,10 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
472 skb->network_header += ah_hlen; 472 skb->network_header += ah_hlen;
473 memcpy(skb_network_header(skb), work_iph, hdr_len); 473 memcpy(skb_network_header(skb), work_iph, hdr_len);
474 __skb_pull(skb, ah_hlen + hdr_len); 474 __skb_pull(skb, ah_hlen + hdr_len);
475 skb_set_transport_header(skb, -hdr_len); 475 if (x->props.mode == XFRM_MODE_TUNNEL)
476 skb_reset_transport_header(skb);
477 else
478 skb_set_transport_header(skb, -hdr_len);
476out: 479out:
477 kfree(AH_SKB_CB(skb)->tmp); 480 kfree(AH_SKB_CB(skb)->tmp);
478 xfrm_input_resume(skb, err); 481 xfrm_input_resume(skb, err);
@@ -593,9 +596,13 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
593 596
594 skb->network_header += ah_hlen; 597 skb->network_header += ah_hlen;
595 memcpy(skb_network_header(skb), work_iph, hdr_len); 598 memcpy(skb_network_header(skb), work_iph, hdr_len);
596 skb->transport_header = skb->network_header;
597 __skb_pull(skb, ah_hlen + hdr_len); 599 __skb_pull(skb, ah_hlen + hdr_len);
598 600
601 if (x->props.mode == XFRM_MODE_TUNNEL)
602 skb_reset_transport_header(skb);
603 else
604 skb_set_transport_header(skb, -hdr_len);
605
599 err = nexthdr; 606 err = nexthdr;
600 607
601out_free: 608out_free:
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 282f3723ee19..40ffd72243a4 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -300,7 +300,10 @@ static int esp_input_done2(struct sk_buff *skb, int err)
300 300
301 pskb_trim(skb, skb->len - alen - padlen - 2); 301 pskb_trim(skb, skb->len - alen - padlen - 2);
302 __skb_pull(skb, hlen); 302 __skb_pull(skb, hlen);
303 skb_set_transport_header(skb, -hdr_len); 303 if (x->props.mode == XFRM_MODE_TUNNEL)
304 skb_reset_transport_header(skb);
305 else
306 skb_set_transport_header(skb, -hdr_len);
304 307
305 err = nexthdr[1]; 308 err = nexthdr[1];
306 309
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index b4a9fd51dae7..fff5bdd8b680 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -81,10 +81,22 @@ static inline struct sock *icmpv6_sk(struct net *net)
81 return net->ipv6.icmp_sk[smp_processor_id()]; 81 return net->ipv6.icmp_sk[smp_processor_id()];
82} 82}
83 83
84static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
85 u8 type, u8 code, int offset, __be32 info)
86{
87 struct net *net = dev_net(skb->dev);
88
89 if (type == ICMPV6_PKT_TOOBIG)
90 ip6_update_pmtu(skb, net, info, 0, 0);
91 else if (type == NDISC_REDIRECT)
92 ip6_redirect(skb, net, 0, 0);
93}
94
84static int icmpv6_rcv(struct sk_buff *skb); 95static int icmpv6_rcv(struct sk_buff *skb);
85 96
86static const struct inet6_protocol icmpv6_protocol = { 97static const struct inet6_protocol icmpv6_protocol = {
87 .handler = icmpv6_rcv, 98 .handler = icmpv6_rcv,
99 .err_handler = icmpv6_err,
88 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, 100 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
89}; 101};
90 102
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5552d13ae92f..0c7c03d50dc0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1213,10 +1213,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1213 if (dst_allfrag(rt->dst.path)) 1213 if (dst_allfrag(rt->dst.path))
1214 cork->flags |= IPCORK_ALLFRAG; 1214 cork->flags |= IPCORK_ALLFRAG;
1215 cork->length = 0; 1215 cork->length = 0;
1216 exthdrlen = (opt ? opt->opt_flen : 0) - rt->rt6i_nfheader_len; 1216 exthdrlen = (opt ? opt->opt_flen : 0);
1217 length += exthdrlen; 1217 length += exthdrlen;
1218 transhdrlen += exthdrlen; 1218 transhdrlen += exthdrlen;
1219 dst_exthdrlen = rt->dst.header_len; 1219 dst_exthdrlen = rt->dst.header_len - rt->rt6i_nfheader_len;
1220 } else { 1220 } else {
1221 rt = (struct rt6_info *)cork->dst; 1221 rt = (struct rt6_info *)cork->dst;
1222 fl6 = &inet->cork.fl.u.ip6; 1222 fl6 = &inet->cork.fl.u.ip6;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 26dcdec9e3a5..8fd154e5f079 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1710,6 +1710,9 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
1710 return -EINVAL; 1710 return -EINVAL;
1711 if (get_user(v, (u32 __user *)optval)) 1711 if (get_user(v, (u32 __user *)optval))
1712 return -EFAULT; 1712 return -EFAULT;
1713 /* "pim6reg%u" should not exceed 16 bytes (IFNAMSIZ) */
1714 if (v != RT_TABLE_DEFAULT && v >= 100000000)
1715 return -EINVAL;
1713 if (sk == mrt->mroute6_sk) 1716 if (sk == mrt->mroute6_sk)
1714 return -EBUSY; 1717 return -EBUSY;
1715 1718
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5c61677487cf..516fbc96feff 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -164,7 +164,17 @@ static int ieee80211_add_key(struct wiphy *wiphy, struct net_device *dev,
164 sta = sta_info_get(sdata, mac_addr); 164 sta = sta_info_get(sdata, mac_addr);
165 else 165 else
166 sta = sta_info_get_bss(sdata, mac_addr); 166 sta = sta_info_get_bss(sdata, mac_addr);
167 if (!sta) { 167 /*
168 * The ASSOC test makes sure the driver is ready to
169 * receive the key. When wpa_supplicant has roamed
170 * using FT, it attempts to set the key before
171 * association has completed, this rejects that attempt
172 * so it will set the key again after assocation.
173 *
174 * TODO: accept the key if we have a station entry and
175 * add it to the device after the station.
176 */
177 if (!sta || !test_sta_flag(sta, WLAN_STA_ASSOC)) {
168 ieee80211_key_free(sdata->local, key); 178 ieee80211_key_free(sdata->local, key);
169 err = -ENOENT; 179 err = -ENOENT;
170 goto out_unlock; 180 goto out_unlock;
@@ -1009,6 +1019,8 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
1009 if (old_probe_resp) 1019 if (old_probe_resp)
1010 kfree_rcu(old_probe_resp, rcu_head); 1020 kfree_rcu(old_probe_resp, rcu_head);
1011 1021
1022 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
1023 sta_info_flush(local, vlan);
1012 sta_info_flush(local, sdata); 1024 sta_info_flush(local, sdata);
1013 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED); 1025 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
1014 1026
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 53f03120db55..80e55527504b 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -4,6 +4,7 @@
4 4
5#include <linux/nl80211.h> 5#include <linux/nl80211.h>
6#include <linux/export.h> 6#include <linux/export.h>
7#include <linux/rtnetlink.h>
7#include <net/cfg80211.h> 8#include <net/cfg80211.h>
8#include "ieee80211_i.h" 9#include "ieee80211_i.h"
9#include "driver-ops.h" 10#include "driver-ops.h"
@@ -197,6 +198,15 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
197 198
198 ctx = container_of(conf, struct ieee80211_chanctx, conf); 199 ctx = container_of(conf, struct ieee80211_chanctx, conf);
199 200
201 if (sdata->vif.type == NL80211_IFTYPE_AP) {
202 struct ieee80211_sub_if_data *vlan;
203
204 /* for the VLAN list */
205 ASSERT_RTNL();
206 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
207 rcu_assign_pointer(vlan->vif.chanctx_conf, NULL);
208 }
209
200 ieee80211_unassign_vif_chanctx(sdata, ctx); 210 ieee80211_unassign_vif_chanctx(sdata, ctx);
201 if (ctx->refcount == 0) 211 if (ctx->refcount == 0)
202 ieee80211_free_chanctx(local, ctx); 212 ieee80211_free_chanctx(local, ctx);
@@ -316,6 +326,15 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
316 goto out; 326 goto out;
317 } 327 }
318 328
329 if (sdata->vif.type == NL80211_IFTYPE_AP) {
330 struct ieee80211_sub_if_data *vlan;
331
332 /* for the VLAN list */
333 ASSERT_RTNL();
334 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
335 rcu_assign_pointer(vlan->vif.chanctx_conf, &ctx->conf);
336 }
337
319 ieee80211_recalc_smps_chanctx(local, ctx); 338 ieee80211_recalc_smps_chanctx(local, ctx);
320 out: 339 out:
321 mutex_unlock(&local->chanctx_mtx); 340 mutex_unlock(&local->chanctx_mtx);
@@ -331,6 +350,25 @@ void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
331 mutex_unlock(&sdata->local->chanctx_mtx); 350 mutex_unlock(&sdata->local->chanctx_mtx);
332} 351}
333 352
353void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata)
354{
355 struct ieee80211_local *local = sdata->local;
356 struct ieee80211_sub_if_data *ap;
357 struct ieee80211_chanctx_conf *conf;
358
359 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->bss))
360 return;
361
362 ap = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
363
364 mutex_lock(&local->chanctx_mtx);
365
366 conf = rcu_dereference_protected(ap->vif.chanctx_conf,
367 lockdep_is_held(&local->chanctx_mtx));
368 rcu_assign_pointer(sdata->vif.chanctx_conf, conf);
369 mutex_unlock(&local->chanctx_mtx);
370}
371
334void ieee80211_iter_chan_contexts_atomic( 372void ieee80211_iter_chan_contexts_atomic(
335 struct ieee80211_hw *hw, 373 struct ieee80211_hw *hw,
336 void (*iter)(struct ieee80211_hw *hw, 374 void (*iter)(struct ieee80211_hw *hw,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 8881fc77fb13..6b7644e818d8 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -703,8 +703,8 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
703 sdata_info(sdata, 703 sdata_info(sdata,
704 "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n"); 704 "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
705 705
706 ieee80211_request_internal_scan(sdata, 706 ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
707 ifibss->ssid, ifibss->ssid_len, NULL); 707 NULL);
708} 708}
709 709
710static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata) 710static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -802,9 +802,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
802 IEEE80211_SCAN_INTERVAL)) { 802 IEEE80211_SCAN_INTERVAL)) {
803 sdata_info(sdata, "Trigger new scan to find an IBSS to join\n"); 803 sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
804 804
805 ieee80211_request_internal_scan(sdata, 805 ieee80211_request_ibss_scan(sdata, ifibss->ssid,
806 ifibss->ssid, ifibss->ssid_len, 806 ifibss->ssid_len, chan);
807 ifibss->fixed_channel ? ifibss->channel : NULL);
808 } else { 807 } else {
809 int interval = IEEE80211_SCAN_INTERVAL; 808 int interval = IEEE80211_SCAN_INTERVAL;
810 809
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 42d0d0267730..2ed065c09562 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -92,8 +92,6 @@ struct ieee80211_bss {
92 92
93 u32 device_ts; 93 u32 device_ts;
94 94
95 u8 dtim_period;
96
97 bool wmm_used; 95 bool wmm_used;
98 bool uapsd_supported; 96 bool uapsd_supported;
99 97
@@ -140,7 +138,6 @@ enum ieee80211_bss_corrupt_data_flags {
140 138
141/** 139/**
142 * enum ieee80211_valid_data_flags - BSS valid data flags 140 * enum ieee80211_valid_data_flags - BSS valid data flags
143 * @IEEE80211_BSS_VALID_DTIM: DTIM data was gathered from non-corrupt IE
144 * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE 141 * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE
145 * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE 142 * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE
146 * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE 143 * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
@@ -151,7 +148,6 @@ enum ieee80211_bss_corrupt_data_flags {
151 * beacon/probe response. 148 * beacon/probe response.
152 */ 149 */
153enum ieee80211_bss_valid_data_flags { 150enum ieee80211_bss_valid_data_flags {
154 IEEE80211_BSS_VALID_DTIM = BIT(0),
155 IEEE80211_BSS_VALID_WMM = BIT(1), 151 IEEE80211_BSS_VALID_WMM = BIT(1),
156 IEEE80211_BSS_VALID_RATES = BIT(2), 152 IEEE80211_BSS_VALID_RATES = BIT(2),
157 IEEE80211_BSS_VALID_ERP = BIT(3) 153 IEEE80211_BSS_VALID_ERP = BIT(3)
@@ -440,6 +436,7 @@ struct ieee80211_if_managed {
440 unsigned long timers_running; /* used for quiesce/restart */ 436 unsigned long timers_running; /* used for quiesce/restart */
441 bool powersave; /* powersave requested for this iface */ 437 bool powersave; /* powersave requested for this iface */
442 bool broken_ap; /* AP is broken -- turn off powersave */ 438 bool broken_ap; /* AP is broken -- turn off powersave */
439 u8 dtim_period;
443 enum ieee80211_smps_mode req_smps, /* requested smps mode */ 440 enum ieee80211_smps_mode req_smps, /* requested smps mode */
444 driver_smps_mode; /* smps mode request */ 441 driver_smps_mode; /* smps mode request */
445 442
@@ -773,6 +770,10 @@ struct ieee80211_sub_if_data {
773 u32 mntr_flags; 770 u32 mntr_flags;
774 } u; 771 } u;
775 772
773 spinlock_t cleanup_stations_lock;
774 struct list_head cleanup_stations;
775 struct work_struct cleanup_stations_wk;
776
776#ifdef CONFIG_MAC80211_DEBUGFS 777#ifdef CONFIG_MAC80211_DEBUGFS
777 struct { 778 struct {
778 struct dentry *dir; 779 struct dentry *dir;
@@ -1329,9 +1330,9 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1329 1330
1330/* scan/BSS handling */ 1331/* scan/BSS handling */
1331void ieee80211_scan_work(struct work_struct *work); 1332void ieee80211_scan_work(struct work_struct *work);
1332int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata, 1333int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
1333 const u8 *ssid, u8 ssid_len, 1334 const u8 *ssid, u8 ssid_len,
1334 struct ieee80211_channel *chan); 1335 struct ieee80211_channel *chan);
1335int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata, 1336int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
1336 struct cfg80211_scan_request *req); 1337 struct cfg80211_scan_request *req);
1337void ieee80211_scan_cancel(struct ieee80211_local *local); 1338void ieee80211_scan_cancel(struct ieee80211_local *local);
@@ -1357,10 +1358,8 @@ int ieee80211_request_sched_scan_stop(struct ieee80211_sub_if_data *sdata);
1357void ieee80211_sched_scan_stopped_work(struct work_struct *work); 1358void ieee80211_sched_scan_stopped_work(struct work_struct *work);
1358 1359
1359/* off-channel helpers */ 1360/* off-channel helpers */
1360void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, 1361void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local);
1361 bool offchannel_ps_enable); 1362void ieee80211_offchannel_return(struct ieee80211_local *local);
1362void ieee80211_offchannel_return(struct ieee80211_local *local,
1363 bool offchannel_ps_disable);
1364void ieee80211_roc_setup(struct ieee80211_local *local); 1363void ieee80211_roc_setup(struct ieee80211_local *local);
1365void ieee80211_start_next_roc(struct ieee80211_local *local); 1364void ieee80211_start_next_roc(struct ieee80211_local *local);
1366void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata); 1365void ieee80211_roc_purge(struct ieee80211_sub_if_data *sdata);
@@ -1628,6 +1627,7 @@ ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
1628 const struct cfg80211_chan_def *chandef, 1627 const struct cfg80211_chan_def *chandef,
1629 enum ieee80211_chanctx_mode mode); 1628 enum ieee80211_chanctx_mode mode);
1630void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata); 1629void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
1630void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
1631 1631
1632void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local, 1632void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
1633 struct ieee80211_chanctx *chanctx); 1633 struct ieee80211_chanctx *chanctx);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 09a80b55cf5a..8be854e86cd9 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -207,17 +207,8 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
207 207
208static int ieee80211_change_mtu(struct net_device *dev, int new_mtu) 208static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
209{ 209{
210 int meshhdrlen; 210 if (new_mtu < 256 || new_mtu > IEEE80211_MAX_DATA_LEN)
211 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
212
213 meshhdrlen = (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) ? 5 : 0;
214
215 /* FIX: what would be proper limits for MTU?
216 * This interface uses 802.3 frames. */
217 if (new_mtu < 256 ||
218 new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
219 return -EINVAL; 211 return -EINVAL;
220 }
221 212
222 dev->mtu = new_mtu; 213 dev->mtu = new_mtu;
223 return 0; 214 return 0;
@@ -586,11 +577,13 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
586 577
587 switch (sdata->vif.type) { 578 switch (sdata->vif.type) {
588 case NL80211_IFTYPE_AP_VLAN: 579 case NL80211_IFTYPE_AP_VLAN:
589 /* no need to tell driver, but set carrier */ 580 /* no need to tell driver, but set carrier and chanctx */
590 if (rtnl_dereference(sdata->bss->beacon)) 581 if (rtnl_dereference(sdata->bss->beacon)) {
582 ieee80211_vif_vlan_copy_chanctx(sdata);
591 netif_carrier_on(dev); 583 netif_carrier_on(dev);
592 else 584 } else {
593 netif_carrier_off(dev); 585 netif_carrier_off(dev);
586 }
594 break; 587 break;
595 case NL80211_IFTYPE_MONITOR: 588 case NL80211_IFTYPE_MONITOR:
596 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) { 589 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
@@ -839,6 +832,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
839 switch (sdata->vif.type) { 832 switch (sdata->vif.type) {
840 case NL80211_IFTYPE_AP_VLAN: 833 case NL80211_IFTYPE_AP_VLAN:
841 list_del(&sdata->u.vlan.list); 834 list_del(&sdata->u.vlan.list);
835 rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
842 /* no need to tell driver */ 836 /* no need to tell driver */
843 break; 837 break;
844 case NL80211_IFTYPE_MONITOR: 838 case NL80211_IFTYPE_MONITOR:
@@ -865,20 +859,11 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
865 cancel_work_sync(&sdata->work); 859 cancel_work_sync(&sdata->work);
866 /* 860 /*
867 * When we get here, the interface is marked down. 861 * When we get here, the interface is marked down.
868 * Call rcu_barrier() to wait both for the RX path 862 * Call synchronize_rcu() to wait for the RX path
869 * should it be using the interface and enqueuing 863 * should it be using the interface and enqueuing
870 * frames at this very time on another CPU, and 864 * frames at this very time on another CPU.
871 * for the sta free call_rcu callbacks.
872 */
873 rcu_barrier();
874
875 /*
876 * free_sta_rcu() enqueues a work for the actual
877 * sta cleanup, so we need to flush it while
878 * sdata is still valid.
879 */ 865 */
880 flush_workqueue(local->workqueue); 866 synchronize_rcu();
881
882 skb_queue_purge(&sdata->skb_queue); 867 skb_queue_purge(&sdata->skb_queue);
883 868
884 /* 869 /*
@@ -1498,6 +1483,15 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
1498 mutex_unlock(&local->iflist_mtx); 1483 mutex_unlock(&local->iflist_mtx);
1499} 1484}
1500 1485
1486static void ieee80211_cleanup_sdata_stas_wk(struct work_struct *wk)
1487{
1488 struct ieee80211_sub_if_data *sdata;
1489
1490 sdata = container_of(wk, struct ieee80211_sub_if_data, cleanup_stations_wk);
1491
1492 ieee80211_cleanup_sdata_stas(sdata);
1493}
1494
1501int ieee80211_if_add(struct ieee80211_local *local, const char *name, 1495int ieee80211_if_add(struct ieee80211_local *local, const char *name,
1502 struct wireless_dev **new_wdev, enum nl80211_iftype type, 1496 struct wireless_dev **new_wdev, enum nl80211_iftype type,
1503 struct vif_params *params) 1497 struct vif_params *params)
@@ -1573,6 +1567,10 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
1573 1567
1574 INIT_LIST_HEAD(&sdata->key_list); 1568 INIT_LIST_HEAD(&sdata->key_list);
1575 1569
1570 spin_lock_init(&sdata->cleanup_stations_lock);
1571 INIT_LIST_HEAD(&sdata->cleanup_stations);
1572 INIT_WORK(&sdata->cleanup_stations_wk, ieee80211_cleanup_sdata_stas_wk);
1573
1576 for (i = 0; i < IEEE80211_NUM_BANDS; i++) { 1574 for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
1577 struct ieee80211_supported_band *sband; 1575 struct ieee80211_supported_band *sband;
1578 sband = local->hw.wiphy->bands[i]; 1576 sband = local->hw.wiphy->bands[i];
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 1bf03f9ff3ba..649ad513547f 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -163,7 +163,7 @@ int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
163 return -ENOMEM; 163 return -ENOMEM;
164 sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1; 164 sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1;
165 for (i = 0; i < RMC_BUCKETS; i++) 165 for (i = 0; i < RMC_BUCKETS; i++)
166 INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i].list); 166 INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i]);
167 return 0; 167 return 0;
168} 168}
169 169
@@ -177,7 +177,7 @@ void mesh_rmc_free(struct ieee80211_sub_if_data *sdata)
177 return; 177 return;
178 178
179 for (i = 0; i < RMC_BUCKETS; i++) 179 for (i = 0; i < RMC_BUCKETS; i++)
180 list_for_each_entry_safe(p, n, &rmc->bucket[i].list, list) { 180 list_for_each_entry_safe(p, n, &rmc->bucket[i], list) {
181 list_del(&p->list); 181 list_del(&p->list);
182 kmem_cache_free(rm_cache, p); 182 kmem_cache_free(rm_cache, p);
183 } 183 }
@@ -210,7 +210,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
210 /* Don't care about endianness since only match matters */ 210 /* Don't care about endianness since only match matters */
211 memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum)); 211 memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum));
212 idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask; 212 idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask;
213 list_for_each_entry_safe(p, n, &rmc->bucket[idx].list, list) { 213 list_for_each_entry_safe(p, n, &rmc->bucket[idx], list) {
214 ++entries; 214 ++entries;
215 if (time_after(jiffies, p->exp_time) || 215 if (time_after(jiffies, p->exp_time) ||
216 (entries == RMC_QUEUE_MAX_LEN)) { 216 (entries == RMC_QUEUE_MAX_LEN)) {
@@ -229,7 +229,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
229 p->seqnum = seqnum; 229 p->seqnum = seqnum;
230 p->exp_time = jiffies + RMC_TIMEOUT; 230 p->exp_time = jiffies + RMC_TIMEOUT;
231 memcpy(p->sa, sa, ETH_ALEN); 231 memcpy(p->sa, sa, ETH_ALEN);
232 list_add(&p->list, &rmc->bucket[idx].list); 232 list_add(&p->list, &rmc->bucket[idx]);
233 return 0; 233 return 0;
234} 234}
235 235
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 7c9215fb2ac8..84c28c6101cd 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -184,7 +184,7 @@ struct rmc_entry {
184}; 184};
185 185
186struct mesh_rmc { 186struct mesh_rmc {
187 struct rmc_entry bucket[RMC_BUCKETS]; 187 struct list_head bucket[RMC_BUCKETS];
188 u32 idx_mask; 188 u32 idx_mask;
189}; 189};
190 190
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 47aeee2d8db1..2659e428b80c 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -215,6 +215,7 @@ static void prepare_frame_for_deferred_tx(struct ieee80211_sub_if_data *sdata,
215 skb->priority = 7; 215 skb->priority = 7;
216 216
217 info->control.vif = &sdata->vif; 217 info->control.vif = &sdata->vif;
218 info->flags |= IEEE80211_TX_INTFL_NEED_TXPROCESSING;
218 ieee80211_set_qos_hdr(sdata, skb); 219 ieee80211_set_qos_hdr(sdata, skb);
219} 220}
220 221
@@ -246,11 +247,13 @@ int mesh_path_error_tx(u8 ttl, u8 *target, __le32 target_sn,
246 return -EAGAIN; 247 return -EAGAIN;
247 248
248 skb = dev_alloc_skb(local->tx_headroom + 249 skb = dev_alloc_skb(local->tx_headroom +
250 IEEE80211_ENCRYPT_HEADROOM +
251 IEEE80211_ENCRYPT_TAILROOM +
249 hdr_len + 252 hdr_len +
250 2 + 15 /* PERR IE */); 253 2 + 15 /* PERR IE */);
251 if (!skb) 254 if (!skb)
252 return -1; 255 return -1;
253 skb_reserve(skb, local->tx_headroom); 256 skb_reserve(skb, local->tx_headroom + IEEE80211_ENCRYPT_HEADROOM);
254 mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len); 257 mgmt = (struct ieee80211_mgmt *) skb_put(skb, hdr_len);
255 memset(mgmt, 0, hdr_len); 258 memset(mgmt, 0, hdr_len);
256 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT | 259 mgmt->frame_control = cpu_to_le16(IEEE80211_FTYPE_MGMT |
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7753a9ca98a6..a3552929a21d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1074,12 +1074,8 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1074 if (beaconint_us > latency) { 1074 if (beaconint_us > latency) {
1075 local->ps_sdata = NULL; 1075 local->ps_sdata = NULL;
1076 } else { 1076 } else {
1077 struct ieee80211_bss *bss;
1078 int maxslp = 1; 1077 int maxslp = 1;
1079 u8 dtimper; 1078 u8 dtimper = found->u.mgd.dtim_period;
1080
1081 bss = (void *)found->u.mgd.associated->priv;
1082 dtimper = bss->dtim_period;
1083 1079
1084 /* If the TIM IE is invalid, pretend the value is 1 */ 1080 /* If the TIM IE is invalid, pretend the value is 1 */
1085 if (!dtimper) 1081 if (!dtimper)
@@ -1410,10 +1406,17 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1410 1406
1411 ieee80211_led_assoc(local, 1); 1407 ieee80211_led_assoc(local, 1);
1412 1408
1413 if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) 1409 if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
1414 bss_conf->dtim_period = bss->dtim_period; 1410 /*
1415 else 1411 * If the AP is buggy we may get here with no DTIM period
1412 * known, so assume it's 1 which is the only safe assumption
1413 * in that case, although if the TIM IE is broken powersave
1414 * probably just won't work at all.
1415 */
1416 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1417 } else {
1416 bss_conf->dtim_period = 0; 1418 bss_conf->dtim_period = 0;
1419 }
1417 1420
1418 bss_conf->assoc = 1; 1421 bss_conf->assoc = 1;
1419 1422
@@ -1562,6 +1565,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1562 1565
1563 sdata->u.mgd.timers_running = 0; 1566 sdata->u.mgd.timers_running = 0;
1564 1567
1568 sdata->vif.bss_conf.dtim_period = 0;
1569
1565 ifmgd->flags = 0; 1570 ifmgd->flags = 0;
1566 ieee80211_vif_release_channel(sdata); 1571 ieee80211_vif_release_channel(sdata);
1567} 1572}
@@ -2373,11 +2378,18 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2373 struct ieee80211_channel *channel; 2378 struct ieee80211_channel *channel;
2374 bool need_ps = false; 2379 bool need_ps = false;
2375 2380
2376 if (sdata->u.mgd.associated && 2381 if ((sdata->u.mgd.associated &&
2377 ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) { 2382 ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
2378 bss = (void *)sdata->u.mgd.associated->priv; 2383 (sdata->u.mgd.assoc_data &&
2384 ether_addr_equal(mgmt->bssid,
2385 sdata->u.mgd.assoc_data->bss->bssid))) {
2379 /* not previously set so we may need to recalc */ 2386 /* not previously set so we may need to recalc */
2380 need_ps = !bss->dtim_period; 2387 need_ps = sdata->u.mgd.associated && !sdata->u.mgd.dtim_period;
2388
2389 if (elems->tim && !elems->parse_error) {
2390 struct ieee80211_tim_ie *tim_ie = elems->tim;
2391 sdata->u.mgd.dtim_period = tim_ie->dtim_period;
2392 }
2381 } 2393 }
2382 2394
2383 if (elems->ds_params && elems->ds_params_len == 1) 2395 if (elems->ds_params && elems->ds_params_len == 1)
@@ -3896,20 +3908,41 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
3896 /* kick off associate process */ 3908 /* kick off associate process */
3897 3909
3898 ifmgd->assoc_data = assoc_data; 3910 ifmgd->assoc_data = assoc_data;
3911 ifmgd->dtim_period = 0;
3899 3912
3900 err = ieee80211_prep_connection(sdata, req->bss, true); 3913 err = ieee80211_prep_connection(sdata, req->bss, true);
3901 if (err) 3914 if (err)
3902 goto err_clear; 3915 goto err_clear;
3903 3916
3904 if (!bss->dtim_period && 3917 if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
3905 sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) { 3918 const struct cfg80211_bss_ies *beacon_ies;
3906 /* 3919
3907 * Wait up to one beacon interval ... 3920 rcu_read_lock();
3908 * should this be more if we miss one? 3921 beacon_ies = rcu_dereference(req->bss->beacon_ies);
3909 */ 3922 if (!beacon_ies) {
3910 sdata_info(sdata, "waiting for beacon from %pM\n", 3923 /*
3911 ifmgd->bssid); 3924 * Wait up to one beacon interval ...
3912 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval); 3925 * should this be more if we miss one?
3926 */
3927 sdata_info(sdata, "waiting for beacon from %pM\n",
3928 ifmgd->bssid);
3929 assoc_data->timeout =
3930 TU_TO_EXP_TIME(req->bss->beacon_interval);
3931 } else {
3932 const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
3933 beacon_ies->data,
3934 beacon_ies->len);
3935 if (tim_ie && tim_ie[1] >=
3936 sizeof(struct ieee80211_tim_ie)) {
3937 const struct ieee80211_tim_ie *tim;
3938 tim = (void *)(tim_ie + 2);
3939 ifmgd->dtim_period = tim->dtim_period;
3940 }
3941 assoc_data->have_beacon = true;
3942 assoc_data->sent_assoc = false;
3943 assoc_data->timeout = jiffies;
3944 }
3945 rcu_read_unlock();
3913 } else { 3946 } else {
3914 assoc_data->have_beacon = true; 3947 assoc_data->have_beacon = true;
3915 assoc_data->sent_assoc = false; 3948 assoc_data->sent_assoc = false;
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index a5379aea7d09..a3ad4c3c80a3 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -102,8 +102,7 @@ static void ieee80211_offchannel_ps_disable(struct ieee80211_sub_if_data *sdata)
102 ieee80211_sta_reset_conn_monitor(sdata); 102 ieee80211_sta_reset_conn_monitor(sdata);
103} 103}
104 104
105void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local, 105void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local)
106 bool offchannel_ps_enable)
107{ 106{
108 struct ieee80211_sub_if_data *sdata; 107 struct ieee80211_sub_if_data *sdata;
109 108
@@ -134,8 +133,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
134 133
135 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) { 134 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
136 netif_tx_stop_all_queues(sdata->dev); 135 netif_tx_stop_all_queues(sdata->dev);
137 if (offchannel_ps_enable && 136 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
138 (sdata->vif.type == NL80211_IFTYPE_STATION) &&
139 sdata->u.mgd.associated) 137 sdata->u.mgd.associated)
140 ieee80211_offchannel_ps_enable(sdata); 138 ieee80211_offchannel_ps_enable(sdata);
141 } 139 }
@@ -143,8 +141,7 @@ void ieee80211_offchannel_stop_vifs(struct ieee80211_local *local,
143 mutex_unlock(&local->iflist_mtx); 141 mutex_unlock(&local->iflist_mtx);
144} 142}
145 143
146void ieee80211_offchannel_return(struct ieee80211_local *local, 144void ieee80211_offchannel_return(struct ieee80211_local *local)
147 bool offchannel_ps_disable)
148{ 145{
149 struct ieee80211_sub_if_data *sdata; 146 struct ieee80211_sub_if_data *sdata;
150 147
@@ -163,11 +160,9 @@ void ieee80211_offchannel_return(struct ieee80211_local *local,
163 continue; 160 continue;
164 161
165 /* Tell AP we're back */ 162 /* Tell AP we're back */
166 if (offchannel_ps_disable && 163 if (sdata->vif.type == NL80211_IFTYPE_STATION &&
167 sdata->vif.type == NL80211_IFTYPE_STATION) { 164 sdata->u.mgd.associated)
168 if (sdata->u.mgd.associated) 165 ieee80211_offchannel_ps_disable(sdata);
169 ieee80211_offchannel_ps_disable(sdata);
170 }
171 166
172 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) { 167 if (sdata->vif.type != NL80211_IFTYPE_MONITOR) {
173 /* 168 /*
@@ -385,7 +380,7 @@ void ieee80211_sw_roc_work(struct work_struct *work)
385 local->tmp_channel = NULL; 380 local->tmp_channel = NULL;
386 ieee80211_hw_config(local, 0); 381 ieee80211_hw_config(local, 0);
387 382
388 ieee80211_offchannel_return(local, true); 383 ieee80211_offchannel_return(local);
389 } 384 }
390 385
391 ieee80211_recalc_idle(local); 386 ieee80211_recalc_idle(local);
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 8ed83dcc149f..bf82e69d0601 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -113,18 +113,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
113 bss->valid_data |= IEEE80211_BSS_VALID_ERP; 113 bss->valid_data |= IEEE80211_BSS_VALID_ERP;
114 } 114 }
115 115
116 if (elems->tim && (!elems->parse_error ||
117 !(bss->valid_data & IEEE80211_BSS_VALID_DTIM))) {
118 struct ieee80211_tim_ie *tim_ie = elems->tim;
119 bss->dtim_period = tim_ie->dtim_period;
120 if (!elems->parse_error)
121 bss->valid_data |= IEEE80211_BSS_VALID_DTIM;
122 }
123
124 /* If the beacon had no TIM IE, or it was invalid, use 1 */
125 if (beacon && !bss->dtim_period)
126 bss->dtim_period = 1;
127
128 /* replace old supported rates if we get new values */ 116 /* replace old supported rates if we get new values */
129 if (!elems->parse_error || 117 if (!elems->parse_error ||
130 !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) { 118 !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
@@ -304,7 +292,7 @@ static void __ieee80211_scan_completed(struct ieee80211_hw *hw, bool aborted,
304 if (!was_hw_scan) { 292 if (!was_hw_scan) {
305 ieee80211_configure_filter(local); 293 ieee80211_configure_filter(local);
306 drv_sw_scan_complete(local); 294 drv_sw_scan_complete(local);
307 ieee80211_offchannel_return(local, true); 295 ieee80211_offchannel_return(local);
308 } 296 }
309 297
310 ieee80211_recalc_idle(local); 298 ieee80211_recalc_idle(local);
@@ -353,7 +341,7 @@ static int ieee80211_start_sw_scan(struct ieee80211_local *local)
353 local->next_scan_state = SCAN_DECISION; 341 local->next_scan_state = SCAN_DECISION;
354 local->scan_channel_idx = 0; 342 local->scan_channel_idx = 0;
355 343
356 ieee80211_offchannel_stop_vifs(local, true); 344 ieee80211_offchannel_stop_vifs(local);
357 345
358 ieee80211_configure_filter(local); 346 ieee80211_configure_filter(local);
359 347
@@ -690,12 +678,8 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
690 local->scan_channel = NULL; 678 local->scan_channel = NULL;
691 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL); 679 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
692 680
693 /* 681 /* disable PS */
694 * Re-enable vifs and beaconing. Leave PS 682 ieee80211_offchannel_return(local);
695 * in off-channel state..will put that back
696 * on-channel at the end of scanning.
697 */
698 ieee80211_offchannel_return(local, false);
699 683
700 *next_delay = HZ / 5; 684 *next_delay = HZ / 5;
701 /* afterwards, resume scan & go to next channel */ 685 /* afterwards, resume scan & go to next channel */
@@ -705,8 +689,7 @@ static void ieee80211_scan_state_suspend(struct ieee80211_local *local,
705static void ieee80211_scan_state_resume(struct ieee80211_local *local, 689static void ieee80211_scan_state_resume(struct ieee80211_local *local,
706 unsigned long *next_delay) 690 unsigned long *next_delay)
707{ 691{
708 /* PS already is in off-channel mode */ 692 ieee80211_offchannel_stop_vifs(local);
709 ieee80211_offchannel_stop_vifs(local, false);
710 693
711 if (local->ops->flush) { 694 if (local->ops->flush) {
712 drv_flush(local, false); 695 drv_flush(local, false);
@@ -832,9 +815,9 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
832 return res; 815 return res;
833} 816}
834 817
835int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata, 818int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
836 const u8 *ssid, u8 ssid_len, 819 const u8 *ssid, u8 ssid_len,
837 struct ieee80211_channel *chan) 820 struct ieee80211_channel *chan)
838{ 821{
839 struct ieee80211_local *local = sdata->local; 822 struct ieee80211_local *local = sdata->local;
840 int ret = -EBUSY; 823 int ret = -EBUSY;
@@ -848,22 +831,36 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
848 831
849 /* fill internal scan request */ 832 /* fill internal scan request */
850 if (!chan) { 833 if (!chan) {
851 int i, nchan = 0; 834 int i, max_n;
835 int n_ch = 0;
852 836
853 for (band = 0; band < IEEE80211_NUM_BANDS; band++) { 837 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
854 if (!local->hw.wiphy->bands[band]) 838 if (!local->hw.wiphy->bands[band])
855 continue; 839 continue;
856 for (i = 0; 840
857 i < local->hw.wiphy->bands[band]->n_channels; 841 max_n = local->hw.wiphy->bands[band]->n_channels;
858 i++) { 842 for (i = 0; i < max_n; i++) {
859 local->int_scan_req->channels[nchan] = 843 struct ieee80211_channel *tmp_ch =
860 &local->hw.wiphy->bands[band]->channels[i]; 844 &local->hw.wiphy->bands[band]->channels[i];
861 nchan++; 845
846 if (tmp_ch->flags & (IEEE80211_CHAN_NO_IBSS |
847 IEEE80211_CHAN_DISABLED))
848 continue;
849
850 local->int_scan_req->channels[n_ch] = tmp_ch;
851 n_ch++;
862 } 852 }
863 } 853 }
864 854
865 local->int_scan_req->n_channels = nchan; 855 if (WARN_ON_ONCE(n_ch == 0))
856 goto unlock;
857
858 local->int_scan_req->n_channels = n_ch;
866 } else { 859 } else {
860 if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IBSS |
861 IEEE80211_CHAN_DISABLED)))
862 goto unlock;
863
867 local->int_scan_req->channels[0] = chan; 864 local->int_scan_req->channels[0] = chan;
868 local->int_scan_req->n_channels = 1; 865 local->int_scan_req->n_channels = 1;
869 } 866 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f3e502502fee..ca9fde198188 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -91,9 +91,8 @@ static int sta_info_hash_del(struct ieee80211_local *local,
91 return -ENOENT; 91 return -ENOENT;
92} 92}
93 93
94static void free_sta_work(struct work_struct *wk) 94static void cleanup_single_sta(struct sta_info *sta)
95{ 95{
96 struct sta_info *sta = container_of(wk, struct sta_info, free_sta_wk);
97 int ac, i; 96 int ac, i;
98 struct tid_ampdu_tx *tid_tx; 97 struct tid_ampdu_tx *tid_tx;
99 struct ieee80211_sub_if_data *sdata = sta->sdata; 98 struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -153,11 +152,35 @@ static void free_sta_work(struct work_struct *wk)
153 sta_info_free(local, sta); 152 sta_info_free(local, sta);
154} 153}
155 154
155void ieee80211_cleanup_sdata_stas(struct ieee80211_sub_if_data *sdata)
156{
157 struct sta_info *sta;
158
159 spin_lock_bh(&sdata->cleanup_stations_lock);
160 while (!list_empty(&sdata->cleanup_stations)) {
161 sta = list_first_entry(&sdata->cleanup_stations,
162 struct sta_info, list);
163 list_del(&sta->list);
164 spin_unlock_bh(&sdata->cleanup_stations_lock);
165
166 cleanup_single_sta(sta);
167
168 spin_lock_bh(&sdata->cleanup_stations_lock);
169 }
170
171 spin_unlock_bh(&sdata->cleanup_stations_lock);
172}
173
156static void free_sta_rcu(struct rcu_head *h) 174static void free_sta_rcu(struct rcu_head *h)
157{ 175{
158 struct sta_info *sta = container_of(h, struct sta_info, rcu_head); 176 struct sta_info *sta = container_of(h, struct sta_info, rcu_head);
177 struct ieee80211_sub_if_data *sdata = sta->sdata;
159 178
160 ieee80211_queue_work(&sta->local->hw, &sta->free_sta_wk); 179 spin_lock(&sdata->cleanup_stations_lock);
180 list_add_tail(&sta->list, &sdata->cleanup_stations);
181 spin_unlock(&sdata->cleanup_stations_lock);
182
183 ieee80211_queue_work(&sdata->local->hw, &sdata->cleanup_stations_wk);
161} 184}
162 185
163/* protected by RCU */ 186/* protected by RCU */
@@ -310,7 +333,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
310 333
311 spin_lock_init(&sta->lock); 334 spin_lock_init(&sta->lock);
312 INIT_WORK(&sta->drv_unblock_wk, sta_unblock); 335 INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
313 INIT_WORK(&sta->free_sta_wk, free_sta_work);
314 INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work); 336 INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
315 mutex_init(&sta->ampdu_mlme.mtx); 337 mutex_init(&sta->ampdu_mlme.mtx);
316 338
@@ -862,7 +884,7 @@ void sta_info_init(struct ieee80211_local *local)
862 884
863void sta_info_stop(struct ieee80211_local *local) 885void sta_info_stop(struct ieee80211_local *local)
864{ 886{
865 del_timer(&local->sta_cleanup); 887 del_timer_sync(&local->sta_cleanup);
866 sta_info_flush(local, NULL); 888 sta_info_flush(local, NULL);
867} 889}
868 890
@@ -891,6 +913,20 @@ int sta_info_flush(struct ieee80211_local *local,
891 } 913 }
892 mutex_unlock(&local->sta_mtx); 914 mutex_unlock(&local->sta_mtx);
893 915
916 rcu_barrier();
917
918 if (sdata) {
919 ieee80211_cleanup_sdata_stas(sdata);
920 cancel_work_sync(&sdata->cleanup_stations_wk);
921 } else {
922 mutex_lock(&local->iflist_mtx);
923 list_for_each_entry(sdata, &local->interfaces, list) {
924 ieee80211_cleanup_sdata_stas(sdata);
925 cancel_work_sync(&sdata->cleanup_stations_wk);
926 }
927 mutex_unlock(&local->iflist_mtx);
928 }
929
894 return ret; 930 return ret;
895} 931}
896 932
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 1489bca9ea97..37c1889afd3a 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -299,7 +299,6 @@ struct sta_info {
299 spinlock_t lock; 299 spinlock_t lock;
300 300
301 struct work_struct drv_unblock_wk; 301 struct work_struct drv_unblock_wk;
302 struct work_struct free_sta_wk;
303 302
304 u16 listen_interval; 303 u16 listen_interval;
305 304
@@ -563,4 +562,6 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta);
563void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta); 562void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta);
564void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta); 563void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta);
565 564
565void ieee80211_cleanup_sdata_stas(struct ieee80211_sub_if_data *sdata);
566
566#endif /* STA_INFO_H */ 567#endif /* STA_INFO_H */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index e9eadc40c09c..467c1d1b66f2 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1673,10 +1673,13 @@ netdev_tx_t ieee80211_monitor_start_xmit(struct sk_buff *skb,
1673 chanctx_conf = 1673 chanctx_conf =
1674 rcu_dereference(tmp_sdata->vif.chanctx_conf); 1674 rcu_dereference(tmp_sdata->vif.chanctx_conf);
1675 } 1675 }
1676 if (!chanctx_conf)
1677 goto fail_rcu;
1678 1676
1679 chan = chanctx_conf->def.chan; 1677 if (chanctx_conf)
1678 chan = chanctx_conf->def.chan;
1679 else if (!local->use_chanctx)
1680 chan = local->_oper_channel;
1681 else
1682 goto fail_rcu;
1680 1683
1681 /* 1684 /*
1682 * Frame injection is not allowed if beaconing is not allowed 1685 * Frame injection is not allowed if beaconing is not allowed
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 016d95ead930..e4a0c4fb3a7c 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1376,11 +1376,12 @@ void nf_conntrack_cleanup(struct net *net)
1376 synchronize_net(); 1376 synchronize_net();
1377 nf_conntrack_proto_fini(net); 1377 nf_conntrack_proto_fini(net);
1378 nf_conntrack_cleanup_net(net); 1378 nf_conntrack_cleanup_net(net);
1379}
1379 1380
1380 if (net_eq(net, &init_net)) { 1381void nf_conntrack_cleanup_end(void)
1381 RCU_INIT_POINTER(nf_ct_destroy, NULL); 1382{
1382 nf_conntrack_cleanup_init_net(); 1383 RCU_INIT_POINTER(nf_ct_destroy, NULL);
1383 } 1384 nf_conntrack_cleanup_init_net();
1384} 1385}
1385 1386
1386void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls) 1387void *nf_ct_alloc_hashtable(unsigned int *sizep, int nulls)
diff --git a/net/netfilter/nf_conntrack_standalone.c b/net/netfilter/nf_conntrack_standalone.c
index 363285d544a1..e7185c684816 100644
--- a/net/netfilter/nf_conntrack_standalone.c
+++ b/net/netfilter/nf_conntrack_standalone.c
@@ -575,6 +575,7 @@ static int __init nf_conntrack_standalone_init(void)
575static void __exit nf_conntrack_standalone_fini(void) 575static void __exit nf_conntrack_standalone_fini(void)
576{ 576{
577 unregister_pernet_subsys(&nf_conntrack_net_ops); 577 unregister_pernet_subsys(&nf_conntrack_net_ops);
578 nf_conntrack_cleanup_end();
578} 579}
579 580
580module_init(nf_conntrack_standalone_init); 581module_init(nf_conntrack_standalone_init);
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 8d987c3573fd..7b3a9e5999c0 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -345,19 +345,27 @@ int xt_find_revision(u8 af, const char *name, u8 revision, int target,
345} 345}
346EXPORT_SYMBOL_GPL(xt_find_revision); 346EXPORT_SYMBOL_GPL(xt_find_revision);
347 347
348static char *textify_hooks(char *buf, size_t size, unsigned int mask) 348static char *
349textify_hooks(char *buf, size_t size, unsigned int mask, uint8_t nfproto)
349{ 350{
350 static const char *const names[] = { 351 static const char *const inetbr_names[] = {
351 "PREROUTING", "INPUT", "FORWARD", 352 "PREROUTING", "INPUT", "FORWARD",
352 "OUTPUT", "POSTROUTING", "BROUTING", 353 "OUTPUT", "POSTROUTING", "BROUTING",
353 }; 354 };
354 unsigned int i; 355 static const char *const arp_names[] = {
356 "INPUT", "FORWARD", "OUTPUT",
357 };
358 const char *const *names;
359 unsigned int i, max;
355 char *p = buf; 360 char *p = buf;
356 bool np = false; 361 bool np = false;
357 int res; 362 int res;
358 363
364 names = (nfproto == NFPROTO_ARP) ? arp_names : inetbr_names;
365 max = (nfproto == NFPROTO_ARP) ? ARRAY_SIZE(arp_names) :
366 ARRAY_SIZE(inetbr_names);
359 *p = '\0'; 367 *p = '\0';
360 for (i = 0; i < ARRAY_SIZE(names); ++i) { 368 for (i = 0; i < max; ++i) {
361 if (!(mask & (1 << i))) 369 if (!(mask & (1 << i)))
362 continue; 370 continue;
363 res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]); 371 res = snprintf(p, size, "%s%s", np ? "/" : "", names[i]);
@@ -402,8 +410,10 @@ int xt_check_match(struct xt_mtchk_param *par,
402 pr_err("%s_tables: %s match: used from hooks %s, but only " 410 pr_err("%s_tables: %s match: used from hooks %s, but only "
403 "valid from %s\n", 411 "valid from %s\n",
404 xt_prefix[par->family], par->match->name, 412 xt_prefix[par->family], par->match->name,
405 textify_hooks(used, sizeof(used), par->hook_mask), 413 textify_hooks(used, sizeof(used), par->hook_mask,
406 textify_hooks(allow, sizeof(allow), par->match->hooks)); 414 par->family),
415 textify_hooks(allow, sizeof(allow), par->match->hooks,
416 par->family));
407 return -EINVAL; 417 return -EINVAL;
408 } 418 }
409 if (par->match->proto && (par->match->proto != proto || inv_proto)) { 419 if (par->match->proto && (par->match->proto != proto || inv_proto)) {
@@ -575,8 +585,10 @@ int xt_check_target(struct xt_tgchk_param *par,
575 pr_err("%s_tables: %s target: used from hooks %s, but only " 585 pr_err("%s_tables: %s target: used from hooks %s, but only "
576 "usable from %s\n", 586 "usable from %s\n",
577 xt_prefix[par->family], par->target->name, 587 xt_prefix[par->family], par->target->name,
578 textify_hooks(used, sizeof(used), par->hook_mask), 588 textify_hooks(used, sizeof(used), par->hook_mask,
579 textify_hooks(allow, sizeof(allow), par->target->hooks)); 589 par->family),
590 textify_hooks(allow, sizeof(allow), par->target->hooks,
591 par->family));
580 return -EINVAL; 592 return -EINVAL;
581 } 593 }
582 if (par->target->proto && (par->target->proto != proto || inv_proto)) { 594 if (par->target->proto && (par->target->proto != proto || inv_proto)) {
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 2a0843081840..bde009ed8d3b 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -109,7 +109,7 @@ static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
109 struct xt_ct_target_info *info = par->targinfo; 109 struct xt_ct_target_info *info = par->targinfo;
110 struct nf_conntrack_tuple t; 110 struct nf_conntrack_tuple t;
111 struct nf_conn *ct; 111 struct nf_conn *ct;
112 int ret; 112 int ret = -EOPNOTSUPP;
113 113
114 if (info->flags & ~XT_CT_NOTRACK) 114 if (info->flags & ~XT_CT_NOTRACK)
115 return -EINVAL; 115 return -EINVAL;
@@ -247,7 +247,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
247 struct xt_ct_target_info_v1 *info = par->targinfo; 247 struct xt_ct_target_info_v1 *info = par->targinfo;
248 struct nf_conntrack_tuple t; 248 struct nf_conntrack_tuple t;
249 struct nf_conn *ct; 249 struct nf_conn *ct;
250 int ret; 250 int ret = -EOPNOTSUPP;
251 251
252 if (info->flags & ~XT_CT_NOTRACK) 252 if (info->flags & ~XT_CT_NOTRACK)
253 return -EINVAL; 253 return -EINVAL;
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 379c81dee9d1..9bcdbd02d777 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -224,7 +224,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
224 224
225/* Free the outqueue structure and any related pending chunks. 225/* Free the outqueue structure and any related pending chunks.
226 */ 226 */
227void sctp_outq_teardown(struct sctp_outq *q) 227static void __sctp_outq_teardown(struct sctp_outq *q)
228{ 228{
229 struct sctp_transport *transport; 229 struct sctp_transport *transport;
230 struct list_head *lchunk, *temp; 230 struct list_head *lchunk, *temp;
@@ -277,8 +277,6 @@ void sctp_outq_teardown(struct sctp_outq *q)
277 sctp_chunk_free(chunk); 277 sctp_chunk_free(chunk);
278 } 278 }
279 279
280 q->error = 0;
281
282 /* Throw away any leftover control chunks. */ 280 /* Throw away any leftover control chunks. */
283 list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) { 281 list_for_each_entry_safe(chunk, tmp, &q->control_chunk_list, list) {
284 list_del_init(&chunk->list); 282 list_del_init(&chunk->list);
@@ -286,11 +284,17 @@ void sctp_outq_teardown(struct sctp_outq *q)
286 } 284 }
287} 285}
288 286
287void sctp_outq_teardown(struct sctp_outq *q)
288{
289 __sctp_outq_teardown(q);
290 sctp_outq_init(q->asoc, q);
291}
292
289/* Free the outqueue structure and any related pending chunks. */ 293/* Free the outqueue structure and any related pending chunks. */
290void sctp_outq_free(struct sctp_outq *q) 294void sctp_outq_free(struct sctp_outq *q)
291{ 295{
292 /* Throw away leftover chunks. */ 296 /* Throw away leftover chunks. */
293 sctp_outq_teardown(q); 297 __sctp_outq_teardown(q);
294 298
295 /* If we were kmalloc()'d, free the memory. */ 299 /* If we were kmalloc()'d, free the memory. */
296 if (q->malloced) 300 if (q->malloced)
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 618ec7e216ca..5131fcfedb03 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -1779,8 +1779,10 @@ static sctp_disposition_t sctp_sf_do_dupcook_a(struct net *net,
1779 1779
1780 /* Update the content of current association. */ 1780 /* Update the content of current association. */
1781 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc)); 1781 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_ASSOC, SCTP_ASOC(new_asoc));
1782 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1783 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev)); 1782 sctp_add_cmd_sf(commands, SCTP_CMD_EVENT_ULP, SCTP_ULPEVENT(ev));
1783 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_STATE,
1784 SCTP_STATE(SCTP_STATE_ESTABLISHED));
1785 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(repl));
1784 return SCTP_DISPOSITION_CONSUME; 1786 return SCTP_DISPOSITION_CONSUME;
1785 1787
1786nomem_ev: 1788nomem_ev:
diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
index 043889ac86c0..bf3c6e8fc401 100644
--- a/net/sctp/sysctl.c
+++ b/net/sctp/sysctl.c
@@ -366,7 +366,11 @@ int sctp_sysctl_net_register(struct net *net)
366 366
367void sctp_sysctl_net_unregister(struct net *net) 367void sctp_sysctl_net_unregister(struct net *net)
368{ 368{
369 struct ctl_table *table;
370
371 table = net->sctp.sysctl_header->ctl_table_arg;
369 unregister_net_sysctl_table(net->sctp.sysctl_header); 372 unregister_net_sysctl_table(net->sctp.sysctl_header);
373 kfree(table);
370} 374}
371 375
372static struct ctl_table_header * sctp_sysctl_header; 376static struct ctl_table_header * sctp_sysctl_header;
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 1915ffe598e3..507b5e84fbdb 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -555,7 +555,7 @@ EXPORT_SYMBOL_GPL(rpc_clone_client);
555 * rpc_clone_client_set_auth - Clone an RPC client structure and set its auth 555 * rpc_clone_client_set_auth - Clone an RPC client structure and set its auth
556 * 556 *
557 * @clnt: RPC client whose parameters are copied 557 * @clnt: RPC client whose parameters are copied
558 * @auth: security flavor for new client 558 * @flavor: security flavor for new client
559 * 559 *
560 * Returns a fresh RPC client or an ERR_PTR. 560 * Returns a fresh RPC client or an ERR_PTR.
561 */ 561 */
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index b4133bd13915..bfa31714581f 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -972,8 +972,7 @@ static void rpc_async_release(struct work_struct *work)
972 972
973static void rpc_release_resources_task(struct rpc_task *task) 973static void rpc_release_resources_task(struct rpc_task *task)
974{ 974{
975 if (task->tk_rqstp) 975 xprt_release(task);
976 xprt_release(task);
977 if (task->tk_msg.rpc_cred) { 976 if (task->tk_msg.rpc_cred) {
978 put_rpccred(task->tk_msg.rpc_cred); 977 put_rpccred(task->tk_msg.rpc_cred);
979 task->tk_msg.rpc_cred = NULL; 978 task->tk_msg.rpc_cred = NULL;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index bd462a532acf..33811db8788a 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1136,10 +1136,18 @@ static void xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
1136void xprt_release(struct rpc_task *task) 1136void xprt_release(struct rpc_task *task)
1137{ 1137{
1138 struct rpc_xprt *xprt; 1138 struct rpc_xprt *xprt;
1139 struct rpc_rqst *req; 1139 struct rpc_rqst *req = task->tk_rqstp;
1140 1140
1141 if (!(req = task->tk_rqstp)) 1141 if (req == NULL) {
1142 if (task->tk_client) {
1143 rcu_read_lock();
1144 xprt = rcu_dereference(task->tk_client->cl_xprt);
1145 if (xprt->snd_task == task)
1146 xprt_release_write(xprt, task);
1147 rcu_read_unlock();
1148 }
1142 return; 1149 return;
1150 }
1143 1151
1144 xprt = req->rq_xprt; 1152 xprt = req->rq_xprt;
1145 if (task->tk_ops->rpc_count_stats != NULL) 1153 if (task->tk_ops->rpc_count_stats != NULL)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 14d990400354..b677eab55b68 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -866,8 +866,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
866 /* allow mac80211 to determine the timeout */ 866 /* allow mac80211 to determine the timeout */
867 wdev->ps_timeout = -1; 867 wdev->ps_timeout = -1;
868 868
869 if (!dev->ethtool_ops) 869 netdev_set_default_ethtool_ops(dev, &cfg80211_ethtool_ops);
870 dev->ethtool_ops = &cfg80211_ethtool_ops;
871 870
872 if ((wdev->iftype == NL80211_IFTYPE_STATION || 871 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
873 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT || 872 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 41eabc46f110..07c585756d2a 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2656,7 +2656,7 @@ static void xfrm_policy_fini(struct net *net)
2656 WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir])); 2656 WARN_ON(!hlist_empty(&net->xfrm.policy_inexact[dir]));
2657 2657
2658 htab = &net->xfrm.policy_bydst[dir]; 2658 htab = &net->xfrm.policy_bydst[dir];
2659 sz = (htab->hmask + 1); 2659 sz = (htab->hmask + 1) * sizeof(struct hlist_head);
2660 WARN_ON(!hlist_empty(htab->table)); 2660 WARN_ON(!hlist_empty(htab->table));
2661 xfrm_hash_free(htab->table, sz); 2661 xfrm_hash_free(htab->table, sz);
2662 } 2662 }
diff --git a/net/xfrm/xfrm_replay.c b/net/xfrm/xfrm_replay.c
index 765f6fe951eb..35754cc8a9e5 100644
--- a/net/xfrm/xfrm_replay.c
+++ b/net/xfrm/xfrm_replay.c
@@ -242,11 +242,13 @@ static void xfrm_replay_advance_bmp(struct xfrm_state *x, __be32 net_seq)
242 u32 diff; 242 u32 diff;
243 struct xfrm_replay_state_esn *replay_esn = x->replay_esn; 243 struct xfrm_replay_state_esn *replay_esn = x->replay_esn;
244 u32 seq = ntohl(net_seq); 244 u32 seq = ntohl(net_seq);
245 u32 pos = (replay_esn->seq - 1) % replay_esn->replay_window; 245 u32 pos;
246 246
247 if (!replay_esn->replay_window) 247 if (!replay_esn->replay_window)
248 return; 248 return;
249 249
250 pos = (replay_esn->seq - 1) % replay_esn->replay_window;
251
250 if (seq > replay_esn->seq) { 252 if (seq > replay_esn->seq) {
251 diff = seq - replay_esn->seq; 253 diff = seq - replay_esn->seq;
252 254
generated by cgit v1.2.2 (git 2.25.0) at 2025-12-27 15:20:20 -0500