aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/bridge/br_multicast.c2
-rw-r--r--net/bridge/br_netlink.c13
-rw-r--r--net/bridge/br_private.h6
-rw-r--r--net/core/dev.c8
-rw-r--r--net/ipv4/devinet.c2
-rw-r--r--net/ipv4/ip_sockglue.c2
-rw-r--r--net/ipv4/ipconfig.c8
-rw-r--r--net/ipv4/netfilter/ipt_REJECT.c1
-rw-r--r--net/ipv4/netfilter/iptable_nat.c15
-rw-r--r--net/ipv4/tcp.c15
-rw-r--r--net/ipv4/tcp_input.c4
-rw-r--r--net/ipv6/addrconf.c27
-rw-r--r--net/ipv6/netfilter/ip6t_NPT.c33
-rw-r--r--net/ipv6/netfilter/ip6t_REJECT.c1
-rw-r--r--net/ipv6/netfilter/ip6table_nat.c15
-rw-r--r--net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c4
-rw-r--r--net/ipv6/netfilter/nf_conntrack_reasm.c5
-rw-r--r--net/iucv/iucv.c2
-rw-r--r--net/mac80211/cfg.c2
-rw-r--r--net/mac80211/chan.c38
-rw-r--r--net/mac80211/ibss.c9
-rw-r--r--net/mac80211/ieee80211_i.h16
-rw-r--r--net/mac80211/iface.c48
-rw-r--r--net/mac80211/mesh.c8
-rw-r--r--net/mac80211/mesh.h2
-rw-r--r--net/mac80211/mlme.c75
-rw-r--r--net/mac80211/scan.c46
-rw-r--r--net/mac80211/sta_info.c46
-rw-r--r--net/mac80211/sta_info.h3
-rw-r--r--net/mac802154/wpan.c2
-rw-r--r--net/netfilter/Kconfig7
-rw-r--r--net/netfilter/nf_conntrack_core.c2
-rw-r--r--net/netfilter/nf_conntrack_netlink.c2
-rw-r--r--net/netfilter/nfnetlink_log.c16
-rw-r--r--net/netfilter/xt_CT.c58
-rw-r--r--net/netfilter/xt_hashlimit.c54
-rw-r--r--net/netfilter/xt_recent.c43
-rw-r--r--net/sctp/Kconfig2
-rw-r--r--net/sunrpc/clnt.c7
-rw-r--r--net/sunrpc/sched.c30
-rw-r--r--net/sunrpc/xprt.c12
-rw-r--r--net/wireless/core.c3
42 files changed, 495 insertions, 199 deletions
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 5391ca43336a..6d6f26531de2 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1608,7 +1608,6 @@ void br_multicast_init(struct net_bridge *br)
1608 br_multicast_querier_expired, (unsigned long)br); 1608 br_multicast_querier_expired, (unsigned long)br);
1609 setup_timer(&br->multicast_query_timer, br_multicast_query_expired, 1609 setup_timer(&br->multicast_query_timer, br_multicast_query_expired,
1610 (unsigned long)br); 1610 (unsigned long)br);
1611 br_mdb_init();
1612} 1611}
1613 1612
1614void br_multicast_open(struct net_bridge *br) 1613void br_multicast_open(struct net_bridge *br)
@@ -1633,7 +1632,6 @@ void br_multicast_stop(struct net_bridge *br)
1633 del_timer_sync(&br->multicast_querier_timer); 1632 del_timer_sync(&br->multicast_querier_timer);
1634 del_timer_sync(&br->multicast_query_timer); 1633 del_timer_sync(&br->multicast_query_timer);
1635 1634
1636 br_mdb_uninit();
1637 spin_lock_bh(&br->multicast_lock); 1635 spin_lock_bh(&br->multicast_lock);
1638 mdb = mlock_dereference(br->mdb, br); 1636 mdb = mlock_dereference(br->mdb, br);
1639 if (!mdb) 1637 if (!mdb)
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 97ba0189c6f7..5dc66abcc9e2 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -299,10 +299,21 @@ struct rtnl_link_ops br_link_ops __read_mostly = {
299 299
300int __init br_netlink_init(void) 300int __init br_netlink_init(void)
301{ 301{
302 return rtnl_link_register(&br_link_ops); 302 int err;
303
304 br_mdb_init();
305 err = rtnl_link_register(&br_link_ops);
306 if (err)
307 goto out;
308
309 return 0;
310out:
311 br_mdb_uninit();
312 return err;
303} 313}
304 314
305void __exit br_netlink_fini(void) 315void __exit br_netlink_fini(void)
306{ 316{
317 br_mdb_uninit();
307 rtnl_link_unregister(&br_link_ops); 318 rtnl_link_unregister(&br_link_ops);
308} 319}
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 8d83be5ffedc..711094aed41a 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -526,6 +526,12 @@ static inline bool br_multicast_is_router(struct net_bridge *br)
526{ 526{
527 return 0; 527 return 0;
528} 528}
529static inline void br_mdb_init(void)
530{
531}
532static inline void br_mdb_uninit(void)
533{
534}
529#endif 535#endif
530 536
531/* br_netfilter.c */ 537/* br_netfilter.c */
diff --git a/net/core/dev.c b/net/core/dev.c
index 515473ee52cb..f64e439b4a00 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6121,6 +6121,14 @@ struct netdev_queue *dev_ingress_queue_create(struct net_device *dev)
6121 6121
6122static const struct ethtool_ops default_ethtool_ops; 6122static const struct ethtool_ops default_ethtool_ops;
6123 6123
6124void netdev_set_default_ethtool_ops(struct net_device *dev,
6125 const struct ethtool_ops *ops)
6126{
6127 if (dev->ethtool_ops == &default_ethtool_ops)
6128 dev->ethtool_ops = ops;
6129}
6130EXPORT_SYMBOL_GPL(netdev_set_default_ethtool_ops);
6131
6124/** 6132/**
6125 * alloc_netdev_mqs - allocate network device 6133 * alloc_netdev_mqs - allocate network device
6126 * @sizeof_priv: size of private data to allocate space for 6134 * @sizeof_priv: size of private data to allocate space for
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index cc06a47f1216..a8e4f2665d5e 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -823,9 +823,9 @@ int devinet_ioctl(struct net *net, unsigned int cmd, void __user *arg)
823 if (!ifa) { 823 if (!ifa) {
824 ret = -ENOBUFS; 824 ret = -ENOBUFS;
825 ifa = inet_alloc_ifa(); 825 ifa = inet_alloc_ifa();
826 INIT_HLIST_NODE(&ifa->hash);
827 if (!ifa) 826 if (!ifa)
828 break; 827 break;
828 INIT_HLIST_NODE(&ifa->hash);
829 if (colon) 829 if (colon)
830 memcpy(ifa->ifa_label, ifr.ifr_name, IFNAMSIZ); 830 memcpy(ifa->ifa_label, ifr.ifr_name, IFNAMSIZ);
831 else 831 else
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 3c9d20880283..d9c4f113d709 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -590,7 +590,7 @@ static int do_ip_setsockopt(struct sock *sk, int level,
590 case IP_TTL: 590 case IP_TTL:
591 if (optlen < 1) 591 if (optlen < 1)
592 goto e_inval; 592 goto e_inval;
593 if (val != -1 && (val < 0 || val > 255)) 593 if (val != -1 && (val < 1 || val > 255))
594 goto e_inval; 594 goto e_inval;
595 inet->uc_ttl = val; 595 inet->uc_ttl = val;
596 break; 596 break;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index d763701cff1b..a2e50ae80b53 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -136,6 +136,8 @@ __be32 ic_myaddr = NONE; /* My IP address */
136static __be32 ic_netmask = NONE; /* Netmask for local subnet */ 136static __be32 ic_netmask = NONE; /* Netmask for local subnet */
137__be32 ic_gateway = NONE; /* Gateway IP address */ 137__be32 ic_gateway = NONE; /* Gateway IP address */
138 138
139__be32 ic_addrservaddr = NONE; /* IP Address of the IP addresses'server */
140
139__be32 ic_servaddr = NONE; /* Boot server IP address */ 141__be32 ic_servaddr = NONE; /* Boot server IP address */
140 142
141__be32 root_server_addr = NONE; /* Address of NFS server */ 143__be32 root_server_addr = NONE; /* Address of NFS server */
@@ -558,6 +560,7 @@ ic_rarp_recv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
558 if (ic_myaddr == NONE) 560 if (ic_myaddr == NONE)
559 ic_myaddr = tip; 561 ic_myaddr = tip;
560 ic_servaddr = sip; 562 ic_servaddr = sip;
563 ic_addrservaddr = sip;
561 ic_got_reply = IC_RARP; 564 ic_got_reply = IC_RARP;
562 565
563drop_unlock: 566drop_unlock:
@@ -1068,7 +1071,7 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
1068 ic_servaddr = server_id; 1071 ic_servaddr = server_id;
1069#ifdef IPCONFIG_DEBUG 1072#ifdef IPCONFIG_DEBUG
1070 printk("DHCP: Offered address %pI4 by server %pI4\n", 1073 printk("DHCP: Offered address %pI4 by server %pI4\n",
1071 &ic_myaddr, &ic_servaddr); 1074 &ic_myaddr, &b->iph.saddr);
1072#endif 1075#endif
1073 /* The DHCP indicated server address takes 1076 /* The DHCP indicated server address takes
1074 * precedence over the bootp header one if 1077 * precedence over the bootp header one if
@@ -1113,6 +1116,7 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
1113 ic_dev = dev; 1116 ic_dev = dev;
1114 ic_myaddr = b->your_ip; 1117 ic_myaddr = b->your_ip;
1115 ic_servaddr = b->server_ip; 1118 ic_servaddr = b->server_ip;
1119 ic_addrservaddr = b->iph.saddr;
1116 if (ic_gateway == NONE && b->relay_ip) 1120 if (ic_gateway == NONE && b->relay_ip)
1117 ic_gateway = b->relay_ip; 1121 ic_gateway = b->relay_ip;
1118 if (ic_nameservers[0] == NONE) 1122 if (ic_nameservers[0] == NONE)
@@ -1268,7 +1272,7 @@ static int __init ic_dynamic(void)
1268 printk("IP-Config: Got %s answer from %pI4, ", 1272 printk("IP-Config: Got %s answer from %pI4, ",
1269 ((ic_got_reply & IC_RARP) ? "RARP" 1273 ((ic_got_reply & IC_RARP) ? "RARP"
1270 : (ic_proto_enabled & IC_USE_DHCP) ? "DHCP" : "BOOTP"), 1274 : (ic_proto_enabled & IC_USE_DHCP) ? "DHCP" : "BOOTP"),
1271 &ic_servaddr); 1275 &ic_addrservaddr);
1272 pr_cont("my address is %pI4\n", &ic_myaddr); 1276 pr_cont("my address is %pI4\n", &ic_myaddr);
1273 1277
1274 return 0; 1278 return 0;
diff --git a/net/ipv4/netfilter/ipt_REJECT.c b/net/ipv4/netfilter/ipt_REJECT.c
index 51f13f8ec724..04b18c1ac345 100644
--- a/net/ipv4/netfilter/ipt_REJECT.c
+++ b/net/ipv4/netfilter/ipt_REJECT.c
@@ -81,6 +81,7 @@ static void send_reset(struct sk_buff *oldskb, int hook)
81 niph->saddr = oiph->daddr; 81 niph->saddr = oiph->daddr;
82 niph->daddr = oiph->saddr; 82 niph->daddr = oiph->saddr;
83 83
84 skb_reset_transport_header(nskb);
84 tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr)); 85 tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
85 memset(tcph, 0, sizeof(*tcph)); 86 memset(tcph, 0, sizeof(*tcph));
86 tcph->source = oth->dest; 87 tcph->source = oth->dest;
diff --git a/net/ipv4/netfilter/iptable_nat.c b/net/ipv4/netfilter/iptable_nat.c
index da2c8a368f68..eeaff7e4acb5 100644
--- a/net/ipv4/netfilter/iptable_nat.c
+++ b/net/ipv4/netfilter/iptable_nat.c
@@ -124,23 +124,28 @@ nf_nat_ipv4_fn(unsigned int hooknum,
124 ret = nf_nat_rule_find(skb, hooknum, in, out, ct); 124 ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
125 if (ret != NF_ACCEPT) 125 if (ret != NF_ACCEPT)
126 return ret; 126 return ret;
127 } else 127 } else {
128 pr_debug("Already setup manip %s for ct %p\n", 128 pr_debug("Already setup manip %s for ct %p\n",
129 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST", 129 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
130 ct); 130 ct);
131 if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))
132 goto oif_changed;
133 }
131 break; 134 break;
132 135
133 default: 136 default:
134 /* ESTABLISHED */ 137 /* ESTABLISHED */
135 NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED || 138 NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
136 ctinfo == IP_CT_ESTABLISHED_REPLY); 139 ctinfo == IP_CT_ESTABLISHED_REPLY);
137 if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) { 140 if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))
138 nf_ct_kill_acct(ct, ctinfo, skb); 141 goto oif_changed;
139 return NF_DROP;
140 }
141 } 142 }
142 143
143 return nf_nat_packet(ct, ctinfo, hooknum, skb); 144 return nf_nat_packet(ct, ctinfo, hooknum, skb);
145
146oif_changed:
147 nf_ct_kill_acct(ct, ctinfo, skb);
148 return NF_DROP;
144} 149}
145 150
146static unsigned int 151static unsigned int
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 1ca253635f7a..2aa69c8ae60c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1428,12 +1428,12 @@ static void tcp_service_net_dma(struct sock *sk, bool wait)
1428} 1428}
1429#endif 1429#endif
1430 1430
1431static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off) 1431static struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
1432{ 1432{
1433 struct sk_buff *skb; 1433 struct sk_buff *skb;
1434 u32 offset; 1434 u32 offset;
1435 1435
1436 skb_queue_walk(&sk->sk_receive_queue, skb) { 1436 while ((skb = skb_peek(&sk->sk_receive_queue)) != NULL) {
1437 offset = seq - TCP_SKB_CB(skb)->seq; 1437 offset = seq - TCP_SKB_CB(skb)->seq;
1438 if (tcp_hdr(skb)->syn) 1438 if (tcp_hdr(skb)->syn)
1439 offset--; 1439 offset--;
@@ -1441,6 +1441,11 @@ static inline struct sk_buff *tcp_recv_skb(struct sock *sk, u32 seq, u32 *off)
1441 *off = offset; 1441 *off = offset;
1442 return skb; 1442 return skb;
1443 } 1443 }
1444 /* This looks weird, but this can happen if TCP collapsing
1445 * splitted a fat GRO packet, while we released socket lock
1446 * in skb_splice_bits()
1447 */
1448 sk_eat_skb(sk, skb, false);
1444 } 1449 }
1445 return NULL; 1450 return NULL;
1446} 1451}
@@ -1482,7 +1487,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
1482 break; 1487 break;
1483 } 1488 }
1484 used = recv_actor(desc, skb, offset, len); 1489 used = recv_actor(desc, skb, offset, len);
1485 if (used < 0) { 1490 if (used <= 0) {
1486 if (!copied) 1491 if (!copied)
1487 copied = used; 1492 copied = used;
1488 break; 1493 break;
@@ -1520,8 +1525,10 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
1520 tcp_rcv_space_adjust(sk); 1525 tcp_rcv_space_adjust(sk);
1521 1526
1522 /* Clean up data we have read: This will do ACK frames. */ 1527 /* Clean up data we have read: This will do ACK frames. */
1523 if (copied > 0) 1528 if (copied > 0) {
1529 tcp_recv_skb(sk, seq, &offset);
1524 tcp_cleanup_rbuf(sk, copied); 1530 tcp_cleanup_rbuf(sk, copied);
1531 }
1525 return copied; 1532 return copied;
1526} 1533}
1527EXPORT_SYMBOL(tcp_read_sock); 1534EXPORT_SYMBOL(tcp_read_sock);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a28e4db8a952..18f97ca76b00 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5543,7 +5543,7 @@ slow_path:
5543 if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb)) 5543 if (len < (th->doff << 2) || tcp_checksum_complete_user(sk, skb))
5544 goto csum_error; 5544 goto csum_error;
5545 5545
5546 if (!th->ack) 5546 if (!th->ack && !th->rst)
5547 goto discard; 5547 goto discard;
5548 5548
5549 /* 5549 /*
@@ -5988,7 +5988,7 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
5988 goto discard; 5988 goto discard;
5989 } 5989 }
5990 5990
5991 if (!th->ack) 5991 if (!th->ack && !th->rst)
5992 goto discard; 5992 goto discard;
5993 5993
5994 if (!tcp_validate_incoming(sk, skb, th, 0)) 5994 if (!tcp_validate_incoming(sk, skb, th, 0))
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 408cac4ae00a..420e56326384 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -154,6 +154,11 @@ static void addrconf_type_change(struct net_device *dev,
154 unsigned long event); 154 unsigned long event);
155static int addrconf_ifdown(struct net_device *dev, int how); 155static int addrconf_ifdown(struct net_device *dev, int how);
156 156
157static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
158 int plen,
159 const struct net_device *dev,
160 u32 flags, u32 noflags);
161
157static void addrconf_dad_start(struct inet6_ifaddr *ifp); 162static void addrconf_dad_start(struct inet6_ifaddr *ifp);
158static void addrconf_dad_timer(unsigned long data); 163static void addrconf_dad_timer(unsigned long data);
159static void addrconf_dad_completed(struct inet6_ifaddr *ifp); 164static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
@@ -250,12 +255,6 @@ static inline bool addrconf_qdisc_ok(const struct net_device *dev)
250 return !qdisc_tx_is_noop(dev); 255 return !qdisc_tx_is_noop(dev);
251} 256}
252 257
253/* Check if a route is valid prefix route */
254static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
255{
256 return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;
257}
258
259static void addrconf_del_timer(struct inet6_ifaddr *ifp) 258static void addrconf_del_timer(struct inet6_ifaddr *ifp)
260{ 259{
261 if (del_timer(&ifp->timer)) 260 if (del_timer(&ifp->timer))
@@ -941,17 +940,15 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
941 if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) { 940 if ((ifp->flags & IFA_F_PERMANENT) && onlink < 1) {
942 struct in6_addr prefix; 941 struct in6_addr prefix;
943 struct rt6_info *rt; 942 struct rt6_info *rt;
944 struct net *net = dev_net(ifp->idev->dev);
945 struct flowi6 fl6 = {};
946 943
947 ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len); 944 ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
948 fl6.flowi6_oif = ifp->idev->dev->ifindex;
949 fl6.daddr = prefix;
950 rt = (struct rt6_info *)ip6_route_lookup(net, &fl6,
951 RT6_LOOKUP_F_IFACE);
952 945
953 if (rt != net->ipv6.ip6_null_entry && 946 rt = addrconf_get_prefix_route(&prefix,
954 addrconf_is_prefix_route(rt)) { 947 ifp->prefix_len,
948 ifp->idev->dev,
949 0, RTF_GATEWAY | RTF_DEFAULT);
950
951 if (rt) {
955 if (onlink == 0) { 952 if (onlink == 0) {
956 ip6_del_rt(rt); 953 ip6_del_rt(rt);
957 rt = NULL; 954 rt = NULL;
@@ -1877,7 +1874,7 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
1877 continue; 1874 continue;
1878 if ((rt->rt6i_flags & flags) != flags) 1875 if ((rt->rt6i_flags & flags) != flags)
1879 continue; 1876 continue;
1880 if ((noflags != 0) && ((rt->rt6i_flags & flags) != 0)) 1877 if ((rt->rt6i_flags & noflags) != 0)
1881 continue; 1878 continue;
1882 dst_hold(&rt->dst); 1879 dst_hold(&rt->dst);
1883 break; 1880 break;
diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index e9486915eff6..7302b0b7b642 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -14,42 +14,23 @@
14#include <linux/netfilter_ipv6/ip6t_NPT.h> 14#include <linux/netfilter_ipv6/ip6t_NPT.h>
15#include <linux/netfilter/x_tables.h> 15#include <linux/netfilter/x_tables.h>
16 16
17static __sum16 csum16_complement(__sum16 a)
18{
19 return (__force __sum16)(0xffff - (__force u16)a);
20}
21
22static __sum16 csum16_add(__sum16 a, __sum16 b)
23{
24 u16 sum;
25
26 sum = (__force u16)a + (__force u16)b;
27 sum += (__force u16)a < (__force u16)b;
28 return (__force __sum16)sum;
29}
30
31static __sum16 csum16_sub(__sum16 a, __sum16 b)
32{
33 return csum16_add(a, csum16_complement(b));
34}
35
36static int ip6t_npt_checkentry(const struct xt_tgchk_param *par) 17static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
37{ 18{
38 struct ip6t_npt_tginfo *npt = par->targinfo; 19 struct ip6t_npt_tginfo *npt = par->targinfo;
39 __sum16 src_sum = 0, dst_sum = 0; 20 __wsum src_sum = 0, dst_sum = 0;
40 unsigned int i; 21 unsigned int i;
41 22
42 if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64) 23 if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64)
43 return -EINVAL; 24 return -EINVAL;
44 25
45 for (i = 0; i < ARRAY_SIZE(npt->src_pfx.in6.s6_addr16); i++) { 26 for (i = 0; i < ARRAY_SIZE(npt->src_pfx.in6.s6_addr16); i++) {
46 src_sum = csum16_add(src_sum, 27 src_sum = csum_add(src_sum,
47 (__force __sum16)npt->src_pfx.in6.s6_addr16[i]); 28 (__force __wsum)npt->src_pfx.in6.s6_addr16[i]);
48 dst_sum = csum16_add(dst_sum, 29 dst_sum = csum_add(dst_sum,
49 (__force __sum16)npt->dst_pfx.in6.s6_addr16[i]); 30 (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]);
50 } 31 }
51 32
52 npt->adjustment = csum16_sub(src_sum, dst_sum); 33 npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum);
53 return 0; 34 return 0;
54} 35}
55 36
@@ -85,7 +66,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
85 return false; 66 return false;
86 } 67 }
87 68
88 sum = csum16_add((__force __sum16)addr->s6_addr16[idx], 69 sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx],
89 npt->adjustment); 70 npt->adjustment);
90 if (sum == CSUM_MANGLED_0) 71 if (sum == CSUM_MANGLED_0)
91 sum = 0; 72 sum = 0;
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index fd4fb34c51c7..029623dbd411 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -132,6 +132,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
132 ip6h->saddr = oip6h->daddr; 132 ip6h->saddr = oip6h->daddr;
133 ip6h->daddr = oip6h->saddr; 133 ip6h->daddr = oip6h->saddr;
134 134
135 skb_reset_transport_header(nskb);
135 tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr)); 136 tcph = (struct tcphdr *)skb_put(nskb, sizeof(struct tcphdr));
136 /* Truncate to length (no data) */ 137 /* Truncate to length (no data) */
137 tcph->doff = sizeof(struct tcphdr)/4; 138 tcph->doff = sizeof(struct tcphdr)/4;
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index 6c8ae24b85eb..e0e788d25b14 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -127,23 +127,28 @@ nf_nat_ipv6_fn(unsigned int hooknum,
127 ret = nf_nat_rule_find(skb, hooknum, in, out, ct); 127 ret = nf_nat_rule_find(skb, hooknum, in, out, ct);
128 if (ret != NF_ACCEPT) 128 if (ret != NF_ACCEPT)
129 return ret; 129 return ret;
130 } else 130 } else {
131 pr_debug("Already setup manip %s for ct %p\n", 131 pr_debug("Already setup manip %s for ct %p\n",
132 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST", 132 maniptype == NF_NAT_MANIP_SRC ? "SRC" : "DST",
133 ct); 133 ct);
134 if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))
135 goto oif_changed;
136 }
134 break; 137 break;
135 138
136 default: 139 default:
137 /* ESTABLISHED */ 140 /* ESTABLISHED */
138 NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED || 141 NF_CT_ASSERT(ctinfo == IP_CT_ESTABLISHED ||
139 ctinfo == IP_CT_ESTABLISHED_REPLY); 142 ctinfo == IP_CT_ESTABLISHED_REPLY);
140 if (nf_nat_oif_changed(hooknum, ctinfo, nat, out)) { 143 if (nf_nat_oif_changed(hooknum, ctinfo, nat, out))
141 nf_ct_kill_acct(ct, ctinfo, skb); 144 goto oif_changed;
142 return NF_DROP;
143 }
144 } 145 }
145 146
146 return nf_nat_packet(ct, ctinfo, hooknum, skb); 147 return nf_nat_packet(ct, ctinfo, hooknum, skb);
148
149oif_changed:
150 nf_ct_kill_acct(ct, ctinfo, skb);
151 return NF_DROP;
147} 152}
148 153
149static unsigned int 154static unsigned int
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 00ee17c3e893..137e245860ab 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -81,8 +81,8 @@ static int ipv6_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
81 } 81 }
82 protoff = ipv6_skip_exthdr(skb, extoff, &nexthdr, &frag_off); 82 protoff = ipv6_skip_exthdr(skb, extoff, &nexthdr, &frag_off);
83 /* 83 /*
84 * (protoff == skb->len) mean that the packet doesn't have no data 84 * (protoff == skb->len) means the packet has not data, just
85 * except of IPv6 & ext headers. but it's tracked anyway. - YK 85 * IPv6 and possibly extensions headers, but it is tracked anyway
86 */ 86 */
87 if (protoff < 0 || (frag_off & htons(~0x7)) != 0) { 87 if (protoff < 0 || (frag_off & htons(~0x7)) != 0) {
88 pr_debug("ip6_conntrack_core: can't find proto in pkt\n"); 88 pr_debug("ip6_conntrack_core: can't find proto in pkt\n");
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 22c8ea951185..3dacecc99065 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -311,7 +311,10 @@ found:
311 else 311 else
312 fq->q.fragments = skb; 312 fq->q.fragments = skb;
313 313
314 skb->dev = NULL; 314 if (skb->dev) {
315 fq->iif = skb->dev->ifindex;
316 skb->dev = NULL;
317 }
315 fq->q.stamp = skb->tstamp; 318 fq->q.stamp = skb->tstamp;
316 fq->q.meat += skb->len; 319 fq->q.meat += skb->len;
317 if (payload_len > fq->q.max_size) 320 if (payload_len > fq->q.max_size)
diff --git a/net/iucv/iucv.c b/net/iucv/iucv.c
index 3ad1f9db5f8b..df082508362d 100644
--- a/net/iucv/iucv.c
+++ b/net/iucv/iucv.c
@@ -1806,7 +1806,7 @@ static void iucv_external_interrupt(struct ext_code ext_code,
1806 struct iucv_irq_data *p; 1806 struct iucv_irq_data *p;
1807 struct iucv_irq_list *work; 1807 struct iucv_irq_list *work;
1808 1808
1809 kstat_cpu(smp_processor_id()).irqs[EXTINT_IUC]++; 1809 inc_irq_stat(IRQEXT_IUC);
1810 p = iucv_irq_data[smp_processor_id()]; 1810 p = iucv_irq_data[smp_processor_id()];
1811 if (p->ippathid >= iucv_max_pathid) { 1811 if (p->ippathid >= iucv_max_pathid) {
1812 WARN_ON(p->ippathid >= iucv_max_pathid); 1812 WARN_ON(p->ippathid >= iucv_max_pathid);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 5c61677487cf..47e0aca614b7 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -1009,6 +1009,8 @@ static int ieee80211_stop_ap(struct wiphy *wiphy, struct net_device *dev)
1009 if (old_probe_resp) 1009 if (old_probe_resp)
1010 kfree_rcu(old_probe_resp, rcu_head); 1010 kfree_rcu(old_probe_resp, rcu_head);
1011 1011
1012 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
1013 sta_info_flush(local, vlan);
1012 sta_info_flush(local, sdata); 1014 sta_info_flush(local, sdata);
1013 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED); 1015 ieee80211_bss_info_change_notify(sdata, BSS_CHANGED_BEACON_ENABLED);
1014 1016
diff --git a/net/mac80211/chan.c b/net/mac80211/chan.c
index 53f03120db55..80e55527504b 100644
--- a/net/mac80211/chan.c
+++ b/net/mac80211/chan.c
@@ -4,6 +4,7 @@
4 4
5#include <linux/nl80211.h> 5#include <linux/nl80211.h>
6#include <linux/export.h> 6#include <linux/export.h>
7#include <linux/rtnetlink.h>
7#include <net/cfg80211.h> 8#include <net/cfg80211.h>
8#include "ieee80211_i.h" 9#include "ieee80211_i.h"
9#include "driver-ops.h" 10#include "driver-ops.h"
@@ -197,6 +198,15 @@ static void __ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
197 198
198 ctx = container_of(conf, struct ieee80211_chanctx, conf); 199 ctx = container_of(conf, struct ieee80211_chanctx, conf);
199 200
201 if (sdata->vif.type == NL80211_IFTYPE_AP) {
202 struct ieee80211_sub_if_data *vlan;
203
204 /* for the VLAN list */
205 ASSERT_RTNL();
206 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
207 rcu_assign_pointer(vlan->vif.chanctx_conf, NULL);
208 }
209
200 ieee80211_unassign_vif_chanctx(sdata, ctx); 210 ieee80211_unassign_vif_chanctx(sdata, ctx);
201 if (ctx->refcount == 0) 211 if (ctx->refcount == 0)
202 ieee80211_free_chanctx(local, ctx); 212 ieee80211_free_chanctx(local, ctx);
@@ -316,6 +326,15 @@ int ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
316 goto out; 326 goto out;
317 } 327 }
318 328
329 if (sdata->vif.type == NL80211_IFTYPE_AP) {
330 struct ieee80211_sub_if_data *vlan;
331
332 /* for the VLAN list */
333 ASSERT_RTNL();
334 list_for_each_entry(vlan, &sdata->u.ap.vlans, u.vlan.list)
335 rcu_assign_pointer(vlan->vif.chanctx_conf, &ctx->conf);
336 }
337
319 ieee80211_recalc_smps_chanctx(local, ctx); 338 ieee80211_recalc_smps_chanctx(local, ctx);
320 out: 339 out:
321 mutex_unlock(&local->chanctx_mtx); 340 mutex_unlock(&local->chanctx_mtx);
@@ -331,6 +350,25 @@ void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata)
331 mutex_unlock(&sdata->local->chanctx_mtx); 350 mutex_unlock(&sdata->local->chanctx_mtx);
332} 351}
333 352
353void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata)
354{
355 struct ieee80211_local *local = sdata->local;
356 struct ieee80211_sub_if_data *ap;
357 struct ieee80211_chanctx_conf *conf;
358
359 if (WARN_ON(sdata->vif.type != NL80211_IFTYPE_AP_VLAN || !sdata->bss))
360 return;
361
362 ap = container_of(sdata->bss, struct ieee80211_sub_if_data, u.ap);
363
364 mutex_lock(&local->chanctx_mtx);
365
366 conf = rcu_dereference_protected(ap->vif.chanctx_conf,
367 lockdep_is_held(&local->chanctx_mtx));
368 rcu_assign_pointer(sdata->vif.chanctx_conf, conf);
369 mutex_unlock(&local->chanctx_mtx);
370}
371
334void ieee80211_iter_chan_contexts_atomic( 372void ieee80211_iter_chan_contexts_atomic(
335 struct ieee80211_hw *hw, 373 struct ieee80211_hw *hw,
336 void (*iter)(struct ieee80211_hw *hw, 374 void (*iter)(struct ieee80211_hw *hw,
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index 8881fc77fb13..6b7644e818d8 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -703,8 +703,8 @@ static void ieee80211_sta_merge_ibss(struct ieee80211_sub_if_data *sdata)
703 sdata_info(sdata, 703 sdata_info(sdata,
704 "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n"); 704 "No active IBSS STAs - trying to scan for other IBSS networks with same SSID (merge)\n");
705 705
706 ieee80211_request_internal_scan(sdata, 706 ieee80211_request_ibss_scan(sdata, ifibss->ssid, ifibss->ssid_len,
707 ifibss->ssid, ifibss->ssid_len, NULL); 707 NULL);
708} 708}
709 709
710static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata) 710static void ieee80211_sta_create_ibss(struct ieee80211_sub_if_data *sdata)
@@ -802,9 +802,8 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
802 IEEE80211_SCAN_INTERVAL)) { 802 IEEE80211_SCAN_INTERVAL)) {
803 sdata_info(sdata, "Trigger new scan to find an IBSS to join\n"); 803 sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
804 804
805 ieee80211_request_internal_scan(sdata, 805 ieee80211_request_ibss_scan(sdata, ifibss->ssid,
806 ifibss->ssid, ifibss->ssid_len, 806 ifibss->ssid_len, chan);
807 ifibss->fixed_channel ? ifibss->channel : NULL);
808 } else { 807 } else {
809 int interval = IEEE80211_SCAN_INTERVAL; 808 int interval = IEEE80211_SCAN_INTERVAL;
810 809
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 42d0d0267730..8563b9a5cac3 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -92,8 +92,6 @@ struct ieee80211_bss {
92 92
93 u32 device_ts; 93 u32 device_ts;
94 94
95 u8 dtim_period;
96
97 bool wmm_used; 95 bool wmm_used;
98 bool uapsd_supported; 96 bool uapsd_supported;
99 97
@@ -140,7 +138,6 @@ enum ieee80211_bss_corrupt_data_flags {
140 138
141/** 139/**
142 * enum ieee80211_valid_data_flags - BSS valid data flags 140 * enum ieee80211_valid_data_flags - BSS valid data flags
143 * @IEEE80211_BSS_VALID_DTIM: DTIM data was gathered from non-corrupt IE
144 * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE 141 * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE
145 * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE 142 * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE
146 * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE 143 * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE
@@ -151,7 +148,6 @@ enum ieee80211_bss_corrupt_data_flags {
151 * beacon/probe response. 148 * beacon/probe response.
152 */ 149 */
153enum ieee80211_bss_valid_data_flags { 150enum ieee80211_bss_valid_data_flags {
154 IEEE80211_BSS_VALID_DTIM = BIT(0),
155 IEEE80211_BSS_VALID_WMM = BIT(1), 151 IEEE80211_BSS_VALID_WMM = BIT(1),
156 IEEE80211_BSS_VALID_RATES = BIT(2), 152 IEEE80211_BSS_VALID_RATES = BIT(2),
157 IEEE80211_BSS_VALID_ERP = BIT(3) 153 IEEE80211_BSS_VALID_ERP = BIT(3)
@@ -440,6 +436,7 @@ struct ieee80211_if_managed {
440 unsigned long timers_running; /* used for quiesce/restart */ 436 unsigned long timers_running; /* used for quiesce/restart */
441 bool powersave; /* powersave requested for this iface */ 437 bool powersave; /* powersave requested for this iface */
442 bool broken_ap; /* AP is broken -- turn off powersave */ 438 bool broken_ap; /* AP is broken -- turn off powersave */
439 u8 dtim_period;
443 enum ieee80211_smps_mode req_smps, /* requested smps mode */ 440 enum ieee80211_smps_mode req_smps, /* requested smps mode */
444 driver_smps_mode; /* smps mode request */ 441 driver_smps_mode; /* smps mode request */
445 442
@@ -773,6 +770,10 @@ struct ieee80211_sub_if_data {
773 u32 mntr_flags; 770 u32 mntr_flags;
774 } u; 771 } u;
775 772
773 spinlock_t cleanup_stations_lock;
774 struct list_head cleanup_stations;
775 struct work_struct cleanup_stations_wk;
776
776#ifdef CONFIG_MAC80211_DEBUGFS 777#ifdef CONFIG_MAC80211_DEBUGFS
777 struct { 778 struct {
778 struct dentry *dir; 779 struct dentry *dir;
@@ -1329,9 +1330,9 @@ void ieee80211_mesh_rx_queued_mgmt(struct ieee80211_sub_if_data *sdata,
1329 1330
1330/* scan/BSS handling */ 1331/* scan/BSS handling */
1331void ieee80211_scan_work(struct work_struct *work); 1332void ieee80211_scan_work(struct work_struct *work);
1332int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata, 1333int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
1333 const u8 *ssid, u8 ssid_len, 1334 const u8 *ssid, u8 ssid_len,
1334 struct ieee80211_channel *chan); 1335 struct ieee80211_channel *chan);
1335int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata, 1336int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
1336 struct cfg80211_scan_request *req); 1337 struct cfg80211_scan_request *req);
1337void ieee80211_scan_cancel(struct ieee80211_local *local); 1338void ieee80211_scan_cancel(struct ieee80211_local *local);
@@ -1628,6 +1629,7 @@ ieee80211_vif_use_channel(struct ieee80211_sub_if_data *sdata,
1628 const struct cfg80211_chan_def *chandef, 1629 const struct cfg80211_chan_def *chandef,
1629 enum ieee80211_chanctx_mode mode); 1630 enum ieee80211_chanctx_mode mode);
1630void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata); 1631void ieee80211_vif_release_channel(struct ieee80211_sub_if_data *sdata);
1632void ieee80211_vif_vlan_copy_chanctx(struct ieee80211_sub_if_data *sdata);
1631 1633
1632void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local, 1634void ieee80211_recalc_smps_chanctx(struct ieee80211_local *local,
1633 struct ieee80211_chanctx *chanctx); 1635 struct ieee80211_chanctx *chanctx);
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 09a80b55cf5a..8be854e86cd9 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -207,17 +207,8 @@ void ieee80211_recalc_idle(struct ieee80211_local *local)
207 207
208static int ieee80211_change_mtu(struct net_device *dev, int new_mtu) 208static int ieee80211_change_mtu(struct net_device *dev, int new_mtu)
209{ 209{
210 int meshhdrlen; 210 if (new_mtu < 256 || new_mtu > IEEE80211_MAX_DATA_LEN)
211 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
212
213 meshhdrlen = (sdata->vif.type == NL80211_IFTYPE_MESH_POINT) ? 5 : 0;
214
215 /* FIX: what would be proper limits for MTU?
216 * This interface uses 802.3 frames. */
217 if (new_mtu < 256 ||
218 new_mtu > IEEE80211_MAX_DATA_LEN - 24 - 6 - meshhdrlen) {
219 return -EINVAL; 211 return -EINVAL;
220 }
221 212
222 dev->mtu = new_mtu; 213 dev->mtu = new_mtu;
223 return 0; 214 return 0;
@@ -586,11 +577,13 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
586 577
587 switch (sdata->vif.type) { 578 switch (sdata->vif.type) {
588 case NL80211_IFTYPE_AP_VLAN: 579 case NL80211_IFTYPE_AP_VLAN:
589 /* no need to tell driver, but set carrier */ 580 /* no need to tell driver, but set carrier and chanctx */
590 if (rtnl_dereference(sdata->bss->beacon)) 581 if (rtnl_dereference(sdata->bss->beacon)) {
582 ieee80211_vif_vlan_copy_chanctx(sdata);
591 netif_carrier_on(dev); 583 netif_carrier_on(dev);
592 else 584 } else {
593 netif_carrier_off(dev); 585 netif_carrier_off(dev);
586 }
594 break; 587 break;
595 case NL80211_IFTYPE_MONITOR: 588 case NL80211_IFTYPE_MONITOR:
596 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) { 589 if (sdata->u.mntr_flags & MONITOR_FLAG_COOK_FRAMES) {
@@ -839,6 +832,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
839 switch (sdata->vif.type) { 832 switch (sdata->vif.type) {
840 case NL80211_IFTYPE_AP_VLAN: 833 case NL80211_IFTYPE_AP_VLAN:
841 list_del(&sdata->u.vlan.list); 834 list_del(&sdata->u.vlan.list);
835 rcu_assign_pointer(sdata->vif.chanctx_conf, NULL);
842 /* no need to tell driver */ 836 /* no need to tell driver */
843 break; 837 break;
844 case NL80211_IFTYPE_MONITOR: 838 case NL80211_IFTYPE_MONITOR:
@@ -865,20 +859,11 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
865 cancel_work_sync(&sdata->work); 859 cancel_work_sync(&sdata->work);
866 /* 860 /*
867 * When we get here, the interface is marked down. 861 * When we get here, the interface is marked down.
868 * Call rcu_barrier() to wait both for the RX path 862 * Call synchronize_rcu() to wait for the RX path
869 * should it be using the interface and enqueuing 863 * should it be using the interface and enqueuing
870 * frames at this very time on another CPU, and 864 * frames at this very time on another CPU.
871 * for the sta free call_rcu callbacks.
872 */
873 rcu_barrier();
874
875 /*
876 * free_sta_rcu() enqueues a work for the actual
877 * sta cleanup, so we need to flush it while
878 * sdata is still valid.
879 */ 865 */
880 flush_workqueue(local->workqueue); 866 synchronize_rcu();
881
882 skb_queue_purge(&sdata->skb_queue); 867 skb_queue_purge(&sdata->skb_queue);
883 868
884 /* 869 /*
@@ -1498,6 +1483,15 @@ static void ieee80211_assign_perm_addr(struct ieee80211_local *local,
1498 mutex_unlock(&local->iflist_mtx); 1483 mutex_unlock(&local->iflist_mtx);
1499} 1484}
1500 1485
1486static void ieee80211_cleanup_sdata_stas_wk(struct work_struct *wk)
1487{
1488 struct ieee80211_sub_if_data *sdata;
1489
1490 sdata = container_of(wk, struct ieee80211_sub_if_data, cleanup_stations_wk);
1491
1492 ieee80211_cleanup_sdata_stas(sdata);
1493}
1494
1501int ieee80211_if_add(struct ieee80211_local *local, const char *name, 1495int ieee80211_if_add(struct ieee80211_local *local, const char *name,
1502 struct wireless_dev **new_wdev, enum nl80211_iftype type, 1496 struct wireless_dev **new_wdev, enum nl80211_iftype type,
1503 struct vif_params *params) 1497 struct vif_params *params)
@@ -1573,6 +1567,10 @@ int ieee80211_if_add(struct ieee80211_local *local, const char *name,
1573 1567
1574 INIT_LIST_HEAD(&sdata->key_list); 1568 INIT_LIST_HEAD(&sdata->key_list);
1575 1569
1570 spin_lock_init(&sdata->cleanup_stations_lock);
1571 INIT_LIST_HEAD(&sdata->cleanup_stations);
1572 INIT_WORK(&sdata->cleanup_stations_wk, ieee80211_cleanup_sdata_stas_wk);
1573
1576 for (i = 0; i < IEEE80211_NUM_BANDS; i++) { 1574 for (i = 0; i < IEEE80211_NUM_BANDS; i++) {
1577 struct ieee80211_supported_band *sband; 1575 struct ieee80211_supported_band *sband;
1578 sband = local->hw.wiphy->bands[i]; 1576 sband = local->hw.wiphy->bands[i];
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 1bf03f9ff3ba..649ad513547f 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -163,7 +163,7 @@ int mesh_rmc_init(struct ieee80211_sub_if_data *sdata)
163 return -ENOMEM; 163 return -ENOMEM;
164 sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1; 164 sdata->u.mesh.rmc->idx_mask = RMC_BUCKETS - 1;
165 for (i = 0; i < RMC_BUCKETS; i++) 165 for (i = 0; i < RMC_BUCKETS; i++)
166 INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i].list); 166 INIT_LIST_HEAD(&sdata->u.mesh.rmc->bucket[i]);
167 return 0; 167 return 0;
168} 168}
169 169
@@ -177,7 +177,7 @@ void mesh_rmc_free(struct ieee80211_sub_if_data *sdata)
177 return; 177 return;
178 178
179 for (i = 0; i < RMC_BUCKETS; i++) 179 for (i = 0; i < RMC_BUCKETS; i++)
180 list_for_each_entry_safe(p, n, &rmc->bucket[i].list, list) { 180 list_for_each_entry_safe(p, n, &rmc->bucket[i], list) {
181 list_del(&p->list); 181 list_del(&p->list);
182 kmem_cache_free(rm_cache, p); 182 kmem_cache_free(rm_cache, p);
183 } 183 }
@@ -210,7 +210,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
210 /* Don't care about endianness since only match matters */ 210 /* Don't care about endianness since only match matters */
211 memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum)); 211 memcpy(&seqnum, &mesh_hdr->seqnum, sizeof(mesh_hdr->seqnum));
212 idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask; 212 idx = le32_to_cpu(mesh_hdr->seqnum) & rmc->idx_mask;
213 list_for_each_entry_safe(p, n, &rmc->bucket[idx].list, list) { 213 list_for_each_entry_safe(p, n, &rmc->bucket[idx], list) {
214 ++entries; 214 ++entries;
215 if (time_after(jiffies, p->exp_time) || 215 if (time_after(jiffies, p->exp_time) ||
216 (entries == RMC_QUEUE_MAX_LEN)) { 216 (entries == RMC_QUEUE_MAX_LEN)) {
@@ -229,7 +229,7 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
229 p->seqnum = seqnum; 229 p->seqnum = seqnum;
230 p->exp_time = jiffies + RMC_TIMEOUT; 230 p->exp_time = jiffies + RMC_TIMEOUT;
231 memcpy(p->sa, sa, ETH_ALEN); 231 memcpy(p->sa, sa, ETH_ALEN);
232 list_add(&p->list, &rmc->bucket[idx].list); 232 list_add(&p->list, &rmc->bucket[idx]);
233 return 0; 233 return 0;
234} 234}
235 235
diff --git a/net/mac80211/mesh.h b/net/mac80211/mesh.h
index 7c9215fb2ac8..84c28c6101cd 100644
--- a/net/mac80211/mesh.h
+++ b/net/mac80211/mesh.h
@@ -184,7 +184,7 @@ struct rmc_entry {
184}; 184};
185 185
186struct mesh_rmc { 186struct mesh_rmc {
187 struct rmc_entry bucket[RMC_BUCKETS]; 187 struct list_head bucket[RMC_BUCKETS];
188 u32 idx_mask; 188 u32 idx_mask;
189}; 189};
190 190
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 7753a9ca98a6..a3552929a21d 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1074,12 +1074,8 @@ void ieee80211_recalc_ps(struct ieee80211_local *local, s32 latency)
1074 if (beaconint_us > latency) { 1074 if (beaconint_us > latency) {
1075 local->ps_sdata = NULL; 1075 local->ps_sdata = NULL;
1076 } else { 1076 } else {
1077 struct ieee80211_bss *bss;
1078 int maxslp = 1; 1077 int maxslp = 1;
1079 u8 dtimper; 1078 u8 dtimper = found->u.mgd.dtim_period;
1080
1081 bss = (void *)found->u.mgd.associated->priv;
1082 dtimper = bss->dtim_period;
1083 1079
1084 /* If the TIM IE is invalid, pretend the value is 1 */ 1080 /* If the TIM IE is invalid, pretend the value is 1 */
1085 if (!dtimper) 1081 if (!dtimper)
@@ -1410,10 +1406,17 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1410 1406
1411 ieee80211_led_assoc(local, 1); 1407 ieee80211_led_assoc(local, 1);
1412 1408
1413 if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) 1409 if (local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
1414 bss_conf->dtim_period = bss->dtim_period; 1410 /*
1415 else 1411 * If the AP is buggy we may get here with no DTIM period
1412 * known, so assume it's 1 which is the only safe assumption
1413 * in that case, although if the TIM IE is broken powersave
1414 * probably just won't work at all.
1415 */
1416 bss_conf->dtim_period = sdata->u.mgd.dtim_period ?: 1;
1417 } else {
1416 bss_conf->dtim_period = 0; 1418 bss_conf->dtim_period = 0;
1419 }
1417 1420
1418 bss_conf->assoc = 1; 1421 bss_conf->assoc = 1;
1419 1422
@@ -1562,6 +1565,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1562 1565
1563 sdata->u.mgd.timers_running = 0; 1566 sdata->u.mgd.timers_running = 0;
1564 1567
1568 sdata->vif.bss_conf.dtim_period = 0;
1569
1565 ifmgd->flags = 0; 1570 ifmgd->flags = 0;
1566 ieee80211_vif_release_channel(sdata); 1571 ieee80211_vif_release_channel(sdata);
1567} 1572}
@@ -2373,11 +2378,18 @@ static void ieee80211_rx_bss_info(struct ieee80211_sub_if_data *sdata,
2373 struct ieee80211_channel *channel; 2378 struct ieee80211_channel *channel;
2374 bool need_ps = false; 2379 bool need_ps = false;
2375 2380
2376 if (sdata->u.mgd.associated && 2381 if ((sdata->u.mgd.associated &&
2377 ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) { 2382 ether_addr_equal(mgmt->bssid, sdata->u.mgd.associated->bssid)) ||
2378 bss = (void *)sdata->u.mgd.associated->priv; 2383 (sdata->u.mgd.assoc_data &&
2384 ether_addr_equal(mgmt->bssid,
2385 sdata->u.mgd.assoc_data->bss->bssid))) {
2379 /* not previously set so we may need to recalc */ 2386 /* not previously set so we may need to recalc */
2380 need_ps = !bss->dtim_period; 2387 need_ps = sdata->u.mgd.associated && !sdata->u.mgd.dtim_period;
2388
2389 if (elems->tim && !elems->parse_error) {
2390 struct ieee80211_tim_ie *tim_ie = elems->tim;
2391 sdata->u.mgd.dtim_period = tim_ie->dtim_period;
2392 }
2381 } 2393 }
2382 2394
2383 if (elems->ds_params && elems->ds_params_len == 1) 2395 if (elems->ds_params && elems->ds_params_len == 1)
@@ -3896,20 +3908,41 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
3896 /* kick off associate process */ 3908 /* kick off associate process */
3897 3909
3898 ifmgd->assoc_data = assoc_data; 3910 ifmgd->assoc_data = assoc_data;
3911 ifmgd->dtim_period = 0;
3899 3912
3900 err = ieee80211_prep_connection(sdata, req->bss, true); 3913 err = ieee80211_prep_connection(sdata, req->bss, true);
3901 if (err) 3914 if (err)
3902 goto err_clear; 3915 goto err_clear;
3903 3916
3904 if (!bss->dtim_period && 3917 if (sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) {
3905 sdata->local->hw.flags & IEEE80211_HW_NEED_DTIM_PERIOD) { 3918 const struct cfg80211_bss_ies *beacon_ies;
3906 /* 3919
3907 * Wait up to one beacon interval ... 3920 rcu_read_lock();
3908 * should this be more if we miss one? 3921 beacon_ies = rcu_dereference(req->bss->beacon_ies);
3909 */ 3922 if (!beacon_ies) {
3910 sdata_info(sdata, "waiting for beacon from %pM\n", 3923 /*
3911 ifmgd->bssid); 3924 * Wait up to one beacon interval ...
3912 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval); 3925 * should this be more if we miss one?
3926 */
3927 sdata_info(sdata, "waiting for beacon from %pM\n",
3928 ifmgd->bssid);
3929 assoc_data->timeout =
3930 TU_TO_EXP_TIME(req->bss->beacon_interval);
3931 } else {
3932 const u8 *tim_ie = cfg80211_find_ie(WLAN_EID_TIM,
3933 beacon_ies->data,
3934 beacon_ies->len);
3935 if (tim_ie && tim_ie[1] >=
3936 sizeof(struct ieee80211_tim_ie)) {
3937 const struct ieee80211_tim_ie *tim;
3938 tim = (void *)(tim_ie + 2);
3939 ifmgd->dtim_period = tim->dtim_period;
3940 }
3941 assoc_data->have_beacon = true;
3942 assoc_data->sent_assoc = false;
3943 assoc_data->timeout = jiffies;
3944 }
3945 rcu_read_unlock();
3913 } else { 3946 } else {
3914 assoc_data->have_beacon = true; 3947 assoc_data->have_beacon = true;
3915 assoc_data->sent_assoc = false; 3948 assoc_data->sent_assoc = false;
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 8ed83dcc149f..d59fc6818b1c 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -113,18 +113,6 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
113 bss->valid_data |= IEEE80211_BSS_VALID_ERP; 113 bss->valid_data |= IEEE80211_BSS_VALID_ERP;
114 } 114 }
115 115
116 if (elems->tim && (!elems->parse_error ||
117 !(bss->valid_data & IEEE80211_BSS_VALID_DTIM))) {
118 struct ieee80211_tim_ie *tim_ie = elems->tim;
119 bss->dtim_period = tim_ie->dtim_period;
120 if (!elems->parse_error)
121 bss->valid_data |= IEEE80211_BSS_VALID_DTIM;
122 }
123
124 /* If the beacon had no TIM IE, or it was invalid, use 1 */
125 if (beacon && !bss->dtim_period)
126 bss->dtim_period = 1;
127
128 /* replace old supported rates if we get new values */ 116 /* replace old supported rates if we get new values */
129 if (!elems->parse_error || 117 if (!elems->parse_error ||
130 !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) { 118 !(bss->valid_data & IEEE80211_BSS_VALID_RATES)) {
@@ -832,9 +820,9 @@ int ieee80211_request_scan(struct ieee80211_sub_if_data *sdata,
832 return res; 820 return res;
833} 821}
834 822
835int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata, 823int ieee80211_request_ibss_scan(struct ieee80211_sub_if_data *sdata,
836 const u8 *ssid, u8 ssid_len, 824 const u8 *ssid, u8 ssid_len,
837 struct ieee80211_channel *chan) 825 struct ieee80211_channel *chan)
838{ 826{
839 struct ieee80211_local *local = sdata->local; 827 struct ieee80211_local *local = sdata->local;
840 int ret = -EBUSY; 828 int ret = -EBUSY;
@@ -848,22 +836,36 @@ int ieee80211_request_internal_scan(struct ieee80211_sub_if_data *sdata,
848 836
849 /* fill internal scan request */ 837 /* fill internal scan request */
850 if (!chan) { 838 if (!chan) {
851 int i, nchan = 0; 839 int i, max_n;
840 int n_ch = 0;
852 841
853 for (band = 0; band < IEEE80211_NUM_BANDS; band++) { 842 for (band = 0; band < IEEE80211_NUM_BANDS; band++) {
854 if (!local->hw.wiphy->bands[band]) 843 if (!local->hw.wiphy->bands[band])
855 continue; 844 continue;
856 for (i = 0; 845
857 i < local->hw.wiphy->bands[band]->n_channels; 846 max_n = local->hw.wiphy->bands[band]->n_channels;
858 i++) { 847 for (i = 0; i < max_n; i++) {
859 local->int_scan_req->channels[nchan] = 848 struct ieee80211_channel *tmp_ch =
860 &local->hw.wiphy->bands[band]->channels[i]; 849 &local->hw.wiphy->bands[band]->channels[i];
861 nchan++; 850
851 if (tmp_ch->flags & (IEEE80211_CHAN_NO_IBSS |
852 IEEE80211_CHAN_DISABLED))
853 continue;
854
855 local->int_scan_req->channels[n_ch] = tmp_ch;
856 n_ch++;
862 } 857 }
863 } 858 }
864 859
865 local->int_scan_req->n_channels = nchan; 860 if (WARN_ON_ONCE(n_ch == 0))
861 goto unlock;
862
863 local->int_scan_req->n_channels = n_ch;
866 } else { 864 } else {
865 if (WARN_ON_ONCE(chan->flags & (IEEE80211_CHAN_NO_IBSS |
866 IEEE80211_CHAN_DISABLED)))
867 goto unlock;
868
867 local->int_scan_req->channels[0] = chan; 869 local->int_scan_req->channels[0] = chan;
868 local->int_scan_req->n_channels = 1; 870 local->int_scan_req->n_channels = 1;
869 } 871 }
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f3e502502fee..ca9fde198188 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -91,9 +91,8 @@ static int sta_info_hash_del(struct ieee80211_local *local,
91 return -ENOENT; 91 return -ENOENT;
92} 92}
93 93
94static void free_sta_work(struct work_struct *wk) 94static void cleanup_single_sta(struct sta_info *sta)
95{ 95{
96 struct sta_info *sta = container_of(wk, struct sta_info, free_sta_wk);
97 int ac, i; 96 int ac, i;
98 struct tid_ampdu_tx *tid_tx; 97 struct tid_ampdu_tx *tid_tx;
99 struct ieee80211_sub_if_data *sdata = sta->sdata; 98 struct ieee80211_sub_if_data *sdata = sta->sdata;
@@ -153,11 +152,35 @@ static void free_sta_work(struct work_struct *wk)
153 sta_info_free(local, sta); 152 sta_info_free(local, sta);
154} 153}
155 154
155void ieee80211_cleanup_sdata_stas(struct ieee80211_sub_if_data *sdata)
156{
157 struct sta_info *sta;
158
159 spin_lock_bh(&sdata->cleanup_stations_lock);
160 while (!list_empty(&sdata->cleanup_stations)) {
161 sta = list_first_entry(&sdata->cleanup_stations,
162 struct sta_info, list);
163 list_del(&sta->list);
164 spin_unlock_bh(&sdata->cleanup_stations_lock);
165
166 cleanup_single_sta(sta);
167
168 spin_lock_bh(&sdata->cleanup_stations_lock);
169 }
170
171 spin_unlock_bh(&sdata->cleanup_stations_lock);
172}
173
156static void free_sta_rcu(struct rcu_head *h) 174static void free_sta_rcu(struct rcu_head *h)
157{ 175{
158 struct sta_info *sta = container_of(h, struct sta_info, rcu_head); 176 struct sta_info *sta = container_of(h, struct sta_info, rcu_head);
177 struct ieee80211_sub_if_data *sdata = sta->sdata;
159 178
160 ieee80211_queue_work(&sta->local->hw, &sta->free_sta_wk); 179 spin_lock(&sdata->cleanup_stations_lock);
180 list_add_tail(&sta->list, &sdata->cleanup_stations);
181 spin_unlock(&sdata->cleanup_stations_lock);
182
183 ieee80211_queue_work(&sdata->local->hw, &sdata->cleanup_stations_wk);
161} 184}
162 185
163/* protected by RCU */ 186/* protected by RCU */
@@ -310,7 +333,6 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
310 333
311 spin_lock_init(&sta->lock); 334 spin_lock_init(&sta->lock);
312 INIT_WORK(&sta->drv_unblock_wk, sta_unblock); 335 INIT_WORK(&sta->drv_unblock_wk, sta_unblock);
313 INIT_WORK(&sta->free_sta_wk, free_sta_work);
314 INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work); 336 INIT_WORK(&sta->ampdu_mlme.work, ieee80211_ba_session_work);
315 mutex_init(&sta->ampdu_mlme.mtx); 337 mutex_init(&sta->ampdu_mlme.mtx);
316 338
@@ -862,7 +884,7 @@ void sta_info_init(struct ieee80211_local *local)
862 884
863void sta_info_stop(struct ieee80211_local *local) 885void sta_info_stop(struct ieee80211_local *local)
864{ 886{
865 del_timer(&local->sta_cleanup); 887 del_timer_sync(&local->sta_cleanup);
866 sta_info_flush(local, NULL); 888 sta_info_flush(local, NULL);
867} 889}
868 890
@@ -891,6 +913,20 @@ int sta_info_flush(struct ieee80211_local *local,
891 } 913 }
892 mutex_unlock(&local->sta_mtx); 914 mutex_unlock(&local->sta_mtx);
893 915
916 rcu_barrier();
917
918 if (sdata) {
919 ieee80211_cleanup_sdata_stas(sdata);
920 cancel_work_sync(&sdata->cleanup_stations_wk);
921 } else {
922 mutex_lock(&local->iflist_mtx);
923 list_for_each_entry(sdata, &local->interfaces, list) {
924 ieee80211_cleanup_sdata_stas(sdata);
925 cancel_work_sync(&sdata->cleanup_stations_wk);
926 }
927 mutex_unlock(&local->iflist_mtx);
928 }
929
894 return ret; 930 return ret;
895} 931}
896 932
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 1489bca9ea97..37c1889afd3a 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -299,7 +299,6 @@ struct sta_info {
299 spinlock_t lock; 299 spinlock_t lock;
300 300
301 struct work_struct drv_unblock_wk; 301 struct work_struct drv_unblock_wk;
302 struct work_struct free_sta_wk;
303 302
304 u16 listen_interval; 303 u16 listen_interval;
305 304
@@ -563,4 +562,6 @@ void ieee80211_sta_ps_deliver_wakeup(struct sta_info *sta);
563void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta); 562void ieee80211_sta_ps_deliver_poll_response(struct sta_info *sta);
564void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta); 563void ieee80211_sta_ps_deliver_uapsd(struct sta_info *sta);
565 564
565void ieee80211_cleanup_sdata_stas(struct ieee80211_sub_if_data *sdata);
566
566#endif /* STA_INFO_H */ 567#endif /* STA_INFO_H */
diff --git a/net/mac802154/wpan.c b/net/mac802154/wpan.c
index 1191039c2b1b..199b92261e94 100644
--- a/net/mac802154/wpan.c
+++ b/net/mac802154/wpan.c
@@ -389,7 +389,7 @@ void mac802154_wpan_setup(struct net_device *dev)
389 389
390static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb) 390static int mac802154_process_data(struct net_device *dev, struct sk_buff *skb)
391{ 391{
392 return netif_rx(skb); 392 return netif_rx_ni(skb);
393} 393}
394 394
395static int 395static int
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index fefa514b9917..49e96df5fbc4 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -680,6 +680,13 @@ config NETFILTER_XT_TARGET_NFQUEUE
680 680
681 To compile it as a module, choose M here. If unsure, say N. 681 To compile it as a module, choose M here. If unsure, say N.
682 682
683config NETFILTER_XT_TARGET_NOTRACK
684 tristate '"NOTRACK" target support (DEPRECATED)'
685 depends on NF_CONNTRACK
686 depends on IP_NF_RAW || IP6_NF_RAW
687 depends on NETFILTER_ADVANCED
688 select NETFILTER_XT_TARGET_CT
689
683config NETFILTER_XT_TARGET_RATEEST 690config NETFILTER_XT_TARGET_RATEEST
684 tristate '"RATEEST" target support' 691 tristate '"RATEEST" target support'
685 depends on NETFILTER_ADVANCED 692 depends on NETFILTER_ADVANCED
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 08cdc71d8e87..016d95ead930 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1526,6 +1526,7 @@ err_extend:
1526 */ 1526 */
1527#define UNCONFIRMED_NULLS_VAL ((1<<30)+0) 1527#define UNCONFIRMED_NULLS_VAL ((1<<30)+0)
1528#define DYING_NULLS_VAL ((1<<30)+1) 1528#define DYING_NULLS_VAL ((1<<30)+1)
1529#define TEMPLATE_NULLS_VAL ((1<<30)+2)
1529 1530
1530static int nf_conntrack_init_net(struct net *net) 1531static int nf_conntrack_init_net(struct net *net)
1531{ 1532{
@@ -1534,6 +1535,7 @@ static int nf_conntrack_init_net(struct net *net)
1534 atomic_set(&net->ct.count, 0); 1535 atomic_set(&net->ct.count, 0);
1535 INIT_HLIST_NULLS_HEAD(&net->ct.unconfirmed, UNCONFIRMED_NULLS_VAL); 1536 INIT_HLIST_NULLS_HEAD(&net->ct.unconfirmed, UNCONFIRMED_NULLS_VAL);
1536 INIT_HLIST_NULLS_HEAD(&net->ct.dying, DYING_NULLS_VAL); 1537 INIT_HLIST_NULLS_HEAD(&net->ct.dying, DYING_NULLS_VAL);
1538 INIT_HLIST_NULLS_HEAD(&net->ct.tmpl, TEMPLATE_NULLS_VAL);
1537 net->ct.stat = alloc_percpu(struct ip_conntrack_stat); 1539 net->ct.stat = alloc_percpu(struct ip_conntrack_stat);
1538 if (!net->ct.stat) { 1540 if (!net->ct.stat) {
1539 ret = -ENOMEM; 1541 ret = -ENOMEM;
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 4e078cd84d83..627b0e50b238 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -2624,7 +2624,7 @@ ctnetlink_create_expect(struct net *net, u16 zone,
2624 if (!help) { 2624 if (!help) {
2625 if (!cda[CTA_EXPECT_TIMEOUT]) { 2625 if (!cda[CTA_EXPECT_TIMEOUT]) {
2626 err = -EINVAL; 2626 err = -EINVAL;
2627 goto out; 2627 goto err_out;
2628 } 2628 }
2629 exp->timeout.expires = 2629 exp->timeout.expires =
2630 jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ; 2630 jiffies + ntohl(nla_get_be32(cda[CTA_EXPECT_TIMEOUT])) * HZ;
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 9f199f2e31fa..92fd8eca0d31 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -13,6 +13,7 @@
13 */ 13 */
14#include <linux/module.h> 14#include <linux/module.h>
15#include <linux/skbuff.h> 15#include <linux/skbuff.h>
16#include <linux/if_arp.h>
16#include <linux/init.h> 17#include <linux/init.h>
17#include <linux/ip.h> 18#include <linux/ip.h>
18#include <linux/ipv6.h> 19#include <linux/ipv6.h>
@@ -384,6 +385,7 @@ __build_packet_message(struct nfulnl_instance *inst,
384 struct nfgenmsg *nfmsg; 385 struct nfgenmsg *nfmsg;
385 sk_buff_data_t old_tail = inst->skb->tail; 386 sk_buff_data_t old_tail = inst->skb->tail;
386 struct sock *sk; 387 struct sock *sk;
388 const unsigned char *hwhdrp;
387 389
388 nlh = nlmsg_put(inst->skb, 0, 0, 390 nlh = nlmsg_put(inst->skb, 0, 0,
389 NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET, 391 NFNL_SUBSYS_ULOG << 8 | NFULNL_MSG_PACKET,
@@ -485,9 +487,17 @@ __build_packet_message(struct nfulnl_instance *inst,
485 if (indev && skb_mac_header_was_set(skb)) { 487 if (indev && skb_mac_header_was_set(skb)) {
486 if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) || 488 if (nla_put_be16(inst->skb, NFULA_HWTYPE, htons(skb->dev->type)) ||
487 nla_put_be16(inst->skb, NFULA_HWLEN, 489 nla_put_be16(inst->skb, NFULA_HWLEN,
488 htons(skb->dev->hard_header_len)) || 490 htons(skb->dev->hard_header_len)))
489 nla_put(inst->skb, NFULA_HWHEADER, skb->dev->hard_header_len, 491 goto nla_put_failure;
490 skb_mac_header(skb))) 492
493 hwhdrp = skb_mac_header(skb);
494
495 if (skb->dev->type == ARPHRD_SIT)
496 hwhdrp -= ETH_HLEN;
497
498 if (hwhdrp >= skb->head &&
499 nla_put(inst->skb, NFULA_HWHEADER,
500 skb->dev->hard_header_len, hwhdrp))
491 goto nla_put_failure; 501 goto nla_put_failure;
492 } 502 }
493 503
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index ae7f5daeee43..2a0843081840 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -149,6 +149,10 @@ static int xt_ct_tg_check_v0(const struct xt_tgchk_param *par)
149 149
150 __set_bit(IPS_TEMPLATE_BIT, &ct->status); 150 __set_bit(IPS_TEMPLATE_BIT, &ct->status);
151 __set_bit(IPS_CONFIRMED_BIT, &ct->status); 151 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
152
153 /* Overload tuple linked list to put us in template list. */
154 hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
155 &par->net->ct.tmpl);
152out: 156out:
153 info->ct = ct; 157 info->ct = ct;
154 return 0; 158 return 0;
@@ -289,6 +293,10 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
289 293
290 __set_bit(IPS_TEMPLATE_BIT, &ct->status); 294 __set_bit(IPS_TEMPLATE_BIT, &ct->status);
291 __set_bit(IPS_CONFIRMED_BIT, &ct->status); 295 __set_bit(IPS_CONFIRMED_BIT, &ct->status);
296
297 /* Overload tuple linked list to put us in template list. */
298 hlist_nulls_add_head_rcu(&ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode,
299 &par->net->ct.tmpl);
292out: 300out:
293 info->ct = ct; 301 info->ct = ct;
294 return 0; 302 return 0;
@@ -377,14 +385,60 @@ static struct xt_target xt_ct_tg_reg[] __read_mostly = {
377 }, 385 },
378}; 386};
379 387
388static unsigned int
389notrack_tg(struct sk_buff *skb, const struct xt_action_param *par)
390{
391 /* Previously seen (loopback)? Ignore. */
392 if (skb->nfct != NULL)
393 return XT_CONTINUE;
394
395 skb->nfct = &nf_ct_untracked_get()->ct_general;
396 skb->nfctinfo = IP_CT_NEW;
397 nf_conntrack_get(skb->nfct);
398
399 return XT_CONTINUE;
400}
401
402static int notrack_chk(const struct xt_tgchk_param *par)
403{
404 if (!par->net->xt.notrack_deprecated_warning) {
405 pr_info("netfilter: NOTRACK target is deprecated, "
406 "use CT instead or upgrade iptables\n");
407 par->net->xt.notrack_deprecated_warning = true;
408 }
409 return 0;
410}
411
412static struct xt_target notrack_tg_reg __read_mostly = {
413 .name = "NOTRACK",
414 .revision = 0,
415 .family = NFPROTO_UNSPEC,
416 .checkentry = notrack_chk,
417 .target = notrack_tg,
418 .table = "raw",
419 .me = THIS_MODULE,
420};
421
380static int __init xt_ct_tg_init(void) 422static int __init xt_ct_tg_init(void)
381{ 423{
382 return xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg)); 424 int ret;
425
426 ret = xt_register_target(&notrack_tg_reg);
427 if (ret < 0)
428 return ret;
429
430 ret = xt_register_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
431 if (ret < 0) {
432 xt_unregister_target(&notrack_tg_reg);
433 return ret;
434 }
435 return 0;
383} 436}
384 437
385static void __exit xt_ct_tg_exit(void) 438static void __exit xt_ct_tg_exit(void)
386{ 439{
387 xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg)); 440 xt_unregister_targets(xt_ct_tg_reg, ARRAY_SIZE(xt_ct_tg_reg));
441 xt_unregister_target(&notrack_tg_reg);
388} 442}
389 443
390module_init(xt_ct_tg_init); 444module_init(xt_ct_tg_init);
@@ -394,3 +448,5 @@ MODULE_LICENSE("GPL");
394MODULE_DESCRIPTION("Xtables: connection tracking target"); 448MODULE_DESCRIPTION("Xtables: connection tracking target");
395MODULE_ALIAS("ipt_CT"); 449MODULE_ALIAS("ipt_CT");
396MODULE_ALIAS("ip6t_CT"); 450MODULE_ALIAS("ip6t_CT");
451MODULE_ALIAS("ipt_NOTRACK");
452MODULE_ALIAS("ip6t_NOTRACK");
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 26a668a84aa2..a9d7af953ceb 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -157,11 +157,22 @@ dsthash_find(const struct xt_hashlimit_htable *ht,
157/* allocate dsthash_ent, initialize dst, put in htable and lock it */ 157/* allocate dsthash_ent, initialize dst, put in htable and lock it */
158static struct dsthash_ent * 158static struct dsthash_ent *
159dsthash_alloc_init(struct xt_hashlimit_htable *ht, 159dsthash_alloc_init(struct xt_hashlimit_htable *ht,
160 const struct dsthash_dst *dst) 160 const struct dsthash_dst *dst, bool *race)
161{ 161{
162 struct dsthash_ent *ent; 162 struct dsthash_ent *ent;
163 163
164 spin_lock(&ht->lock); 164 spin_lock(&ht->lock);
165
166 /* Two or more packets may race to create the same entry in the
167 * hashtable, double check if this packet lost race.
168 */
169 ent = dsthash_find(ht, dst);
170 if (ent != NULL) {
171 spin_unlock(&ht->lock);
172 *race = true;
173 return ent;
174 }
175
165 /* initialize hash with random val at the time we allocate 176 /* initialize hash with random val at the time we allocate
166 * the first hashtable entry */ 177 * the first hashtable entry */
167 if (unlikely(!ht->rnd_initialized)) { 178 if (unlikely(!ht->rnd_initialized)) {
@@ -318,7 +329,10 @@ static void htable_destroy(struct xt_hashlimit_htable *hinfo)
318 parent = hashlimit_net->ipt_hashlimit; 329 parent = hashlimit_net->ipt_hashlimit;
319 else 330 else
320 parent = hashlimit_net->ip6t_hashlimit; 331 parent = hashlimit_net->ip6t_hashlimit;
321 remove_proc_entry(hinfo->pde->name, parent); 332
333 if(parent != NULL)
334 remove_proc_entry(hinfo->pde->name, parent);
335
322 htable_selective_cleanup(hinfo, select_all); 336 htable_selective_cleanup(hinfo, select_all);
323 vfree(hinfo); 337 vfree(hinfo);
324} 338}
@@ -585,6 +599,7 @@ hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
585 unsigned long now = jiffies; 599 unsigned long now = jiffies;
586 struct dsthash_ent *dh; 600 struct dsthash_ent *dh;
587 struct dsthash_dst dst; 601 struct dsthash_dst dst;
602 bool race = false;
588 u32 cost; 603 u32 cost;
589 604
590 if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0) 605 if (hashlimit_init_dst(hinfo, &dst, skb, par->thoff) < 0)
@@ -593,13 +608,18 @@ hashlimit_mt(const struct sk_buff *skb, struct xt_action_param *par)
593 rcu_read_lock_bh(); 608 rcu_read_lock_bh();
594 dh = dsthash_find(hinfo, &dst); 609 dh = dsthash_find(hinfo, &dst);
595 if (dh == NULL) { 610 if (dh == NULL) {
596 dh = dsthash_alloc_init(hinfo, &dst); 611 dh = dsthash_alloc_init(hinfo, &dst, &race);
597 if (dh == NULL) { 612 if (dh == NULL) {
598 rcu_read_unlock_bh(); 613 rcu_read_unlock_bh();
599 goto hotdrop; 614 goto hotdrop;
615 } else if (race) {
616 /* Already got an entry, update expiration timeout */
617 dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
618 rateinfo_recalc(dh, now, hinfo->cfg.mode);
619 } else {
620 dh->expires = jiffies + msecs_to_jiffies(hinfo->cfg.expire);
621 rateinfo_init(dh, hinfo);
600 } 622 }
601 dh->expires = jiffies + msecs_to_jiffies(hinfo->cfg.expire);
602 rateinfo_init(dh, hinfo);
603 } else { 623 } else {
604 /* update expiration timeout */ 624 /* update expiration timeout */
605 dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire); 625 dh->expires = now + msecs_to_jiffies(hinfo->cfg.expire);
@@ -856,6 +876,27 @@ static int __net_init hashlimit_proc_net_init(struct net *net)
856 876
857static void __net_exit hashlimit_proc_net_exit(struct net *net) 877static void __net_exit hashlimit_proc_net_exit(struct net *net)
858{ 878{
879 struct xt_hashlimit_htable *hinfo;
880 struct hlist_node *pos;
881 struct proc_dir_entry *pde;
882 struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
883
884 /* recent_net_exit() is called before recent_mt_destroy(). Make sure
885 * that the parent xt_recent proc entry is is empty before trying to
886 * remove it.
887 */
888 mutex_lock(&hashlimit_mutex);
889 pde = hashlimit_net->ipt_hashlimit;
890 if (pde == NULL)
891 pde = hashlimit_net->ip6t_hashlimit;
892
893 hlist_for_each_entry(hinfo, pos, &hashlimit_net->htables, node)
894 remove_proc_entry(hinfo->pde->name, pde);
895
896 hashlimit_net->ipt_hashlimit = NULL;
897 hashlimit_net->ip6t_hashlimit = NULL;
898 mutex_unlock(&hashlimit_mutex);
899
859 proc_net_remove(net, "ipt_hashlimit"); 900 proc_net_remove(net, "ipt_hashlimit");
860#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) 901#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
861 proc_net_remove(net, "ip6t_hashlimit"); 902 proc_net_remove(net, "ip6t_hashlimit");
@@ -872,9 +913,6 @@ static int __net_init hashlimit_net_init(struct net *net)
872 913
873static void __net_exit hashlimit_net_exit(struct net *net) 914static void __net_exit hashlimit_net_exit(struct net *net)
874{ 915{
875 struct hashlimit_net *hashlimit_net = hashlimit_pernet(net);
876
877 BUG_ON(!hlist_empty(&hashlimit_net->htables));
878 hashlimit_proc_net_exit(net); 916 hashlimit_proc_net_exit(net);
879} 917}
880 918
diff --git a/net/netfilter/xt_recent.c b/net/netfilter/xt_recent.c
index 4635c9b00459..978efc9b555a 100644
--- a/net/netfilter/xt_recent.c
+++ b/net/netfilter/xt_recent.c
@@ -29,6 +29,7 @@
29#include <linux/skbuff.h> 29#include <linux/skbuff.h>
30#include <linux/inet.h> 30#include <linux/inet.h>
31#include <linux/slab.h> 31#include <linux/slab.h>
32#include <linux/vmalloc.h>
32#include <net/net_namespace.h> 33#include <net/net_namespace.h>
33#include <net/netns/generic.h> 34#include <net/netns/generic.h>
34 35
@@ -310,6 +311,14 @@ out:
310 return ret; 311 return ret;
311} 312}
312 313
314static void recent_table_free(void *addr)
315{
316 if (is_vmalloc_addr(addr))
317 vfree(addr);
318 else
319 kfree(addr);
320}
321
313static int recent_mt_check(const struct xt_mtchk_param *par, 322static int recent_mt_check(const struct xt_mtchk_param *par,
314 const struct xt_recent_mtinfo_v1 *info) 323 const struct xt_recent_mtinfo_v1 *info)
315{ 324{
@@ -322,6 +331,7 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
322#endif 331#endif
323 unsigned int i; 332 unsigned int i;
324 int ret = -EINVAL; 333 int ret = -EINVAL;
334 size_t sz;
325 335
326 if (unlikely(!hash_rnd_inited)) { 336 if (unlikely(!hash_rnd_inited)) {
327 get_random_bytes(&hash_rnd, sizeof(hash_rnd)); 337 get_random_bytes(&hash_rnd, sizeof(hash_rnd));
@@ -360,8 +370,11 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
360 goto out; 370 goto out;
361 } 371 }
362 372
363 t = kzalloc(sizeof(*t) + sizeof(t->iphash[0]) * ip_list_hash_size, 373 sz = sizeof(*t) + sizeof(t->iphash[0]) * ip_list_hash_size;
364 GFP_KERNEL); 374 if (sz <= PAGE_SIZE)
375 t = kzalloc(sz, GFP_KERNEL);
376 else
377 t = vzalloc(sz);
365 if (t == NULL) { 378 if (t == NULL) {
366 ret = -ENOMEM; 379 ret = -ENOMEM;
367 goto out; 380 goto out;
@@ -377,14 +390,14 @@ static int recent_mt_check(const struct xt_mtchk_param *par,
377 uid = make_kuid(&init_user_ns, ip_list_uid); 390 uid = make_kuid(&init_user_ns, ip_list_uid);
378 gid = make_kgid(&init_user_ns, ip_list_gid); 391 gid = make_kgid(&init_user_ns, ip_list_gid);
379 if (!uid_valid(uid) || !gid_valid(gid)) { 392 if (!uid_valid(uid) || !gid_valid(gid)) {
380 kfree(t); 393 recent_table_free(t);
381 ret = -EINVAL; 394 ret = -EINVAL;
382 goto out; 395 goto out;
383 } 396 }
384 pde = proc_create_data(t->name, ip_list_perms, recent_net->xt_recent, 397 pde = proc_create_data(t->name, ip_list_perms, recent_net->xt_recent,
385 &recent_mt_fops, t); 398 &recent_mt_fops, t);
386 if (pde == NULL) { 399 if (pde == NULL) {
387 kfree(t); 400 recent_table_free(t);
388 ret = -ENOMEM; 401 ret = -ENOMEM;
389 goto out; 402 goto out;
390 } 403 }
@@ -431,10 +444,11 @@ static void recent_mt_destroy(const struct xt_mtdtor_param *par)
431 list_del(&t->list); 444 list_del(&t->list);
432 spin_unlock_bh(&recent_lock); 445 spin_unlock_bh(&recent_lock);
433#ifdef CONFIG_PROC_FS 446#ifdef CONFIG_PROC_FS
434 remove_proc_entry(t->name, recent_net->xt_recent); 447 if (recent_net->xt_recent != NULL)
448 remove_proc_entry(t->name, recent_net->xt_recent);
435#endif 449#endif
436 recent_table_flush(t); 450 recent_table_flush(t);
437 kfree(t); 451 recent_table_free(t);
438 } 452 }
439 mutex_unlock(&recent_mutex); 453 mutex_unlock(&recent_mutex);
440} 454}
@@ -615,6 +629,20 @@ static int __net_init recent_proc_net_init(struct net *net)
615 629
616static void __net_exit recent_proc_net_exit(struct net *net) 630static void __net_exit recent_proc_net_exit(struct net *net)
617{ 631{
632 struct recent_net *recent_net = recent_pernet(net);
633 struct recent_table *t;
634
635 /* recent_net_exit() is called before recent_mt_destroy(). Make sure
636 * that the parent xt_recent proc entry is is empty before trying to
637 * remove it.
638 */
639 spin_lock_bh(&recent_lock);
640 list_for_each_entry(t, &recent_net->tables, list)
641 remove_proc_entry(t->name, recent_net->xt_recent);
642
643 recent_net->xt_recent = NULL;
644 spin_unlock_bh(&recent_lock);
645
618 proc_net_remove(net, "xt_recent"); 646 proc_net_remove(net, "xt_recent");
619} 647}
620#else 648#else
@@ -638,9 +666,6 @@ static int __net_init recent_net_init(struct net *net)
638 666
639static void __net_exit recent_net_exit(struct net *net) 667static void __net_exit recent_net_exit(struct net *net)
640{ 668{
641 struct recent_net *recent_net = recent_pernet(net);
642
643 BUG_ON(!list_empty(&recent_net->tables));
644 recent_proc_net_exit(net); 669 recent_proc_net_exit(net);
645} 670}
646 671
diff --git a/net/sctp/Kconfig b/net/sctp/Kconfig
index c26210618e14..7521d944c0fb 100644
--- a/net/sctp/Kconfig
+++ b/net/sctp/Kconfig
@@ -68,7 +68,7 @@ config SCTP_DBG_OBJCNT
68 If unsure, say N 68 If unsure, say N
69choice 69choice
70 prompt "Default SCTP cookie HMAC encoding" 70 prompt "Default SCTP cookie HMAC encoding"
71 default SCTP_COOKIE_HMAC_MD5 71 default SCTP_DEFAULT_COOKIE_HMAC_MD5
72 help 72 help
73 This option sets the default sctp cookie hmac algorithm 73 This option sets the default sctp cookie hmac algorithm
74 when in doubt select 'md5' 74 when in doubt select 'md5'
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 822f020fa7f4..507b5e84fbdb 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -555,7 +555,7 @@ EXPORT_SYMBOL_GPL(rpc_clone_client);
555 * rpc_clone_client_set_auth - Clone an RPC client structure and set its auth 555 * rpc_clone_client_set_auth - Clone an RPC client structure and set its auth
556 * 556 *
557 * @clnt: RPC client whose parameters are copied 557 * @clnt: RPC client whose parameters are copied
558 * @auth: security flavor for new client 558 * @flavor: security flavor for new client
559 * 559 *
560 * Returns a fresh RPC client or an ERR_PTR. 560 * Returns a fresh RPC client or an ERR_PTR.
561 */ 561 */
@@ -610,11 +610,6 @@ EXPORT_SYMBOL_GPL(rpc_killall_tasks);
610 */ 610 */
611void rpc_shutdown_client(struct rpc_clnt *clnt) 611void rpc_shutdown_client(struct rpc_clnt *clnt)
612{ 612{
613 /*
614 * To avoid deadlock, never call rpc_shutdown_client from a
615 * workqueue context!
616 */
617 WARN_ON_ONCE(current->flags & PF_WQ_WORKER);
618 might_sleep(); 613 might_sleep();
619 614
620 dprintk_rcu("RPC: shutting down %s client for %s\n", 615 dprintk_rcu("RPC: shutting down %s client for %s\n",
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index d17a704aaf5f..bfa31714581f 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -934,16 +934,35 @@ struct rpc_task *rpc_new_task(const struct rpc_task_setup *setup_data)
934 return task; 934 return task;
935} 935}
936 936
937/*
938 * rpc_free_task - release rpc task and perform cleanups
939 *
940 * Note that we free up the rpc_task _after_ rpc_release_calldata()
941 * in order to work around a workqueue dependency issue.
942 *
943 * Tejun Heo states:
944 * "Workqueue currently considers two work items to be the same if they're
945 * on the same address and won't execute them concurrently - ie. it
946 * makes a work item which is queued again while being executed wait
947 * for the previous execution to complete.
948 *
949 * If a work function frees the work item, and then waits for an event
950 * which should be performed by another work item and *that* work item
951 * recycles the freed work item, it can create a false dependency loop.
952 * There really is no reliable way to detect this short of verifying
953 * every memory free."
954 *
955 */
937static void rpc_free_task(struct rpc_task *task) 956static void rpc_free_task(struct rpc_task *task)
938{ 957{
939 const struct rpc_call_ops *tk_ops = task->tk_ops; 958 unsigned short tk_flags = task->tk_flags;
940 void *calldata = task->tk_calldata; 959
960 rpc_release_calldata(task->tk_ops, task->tk_calldata);
941 961
942 if (task->tk_flags & RPC_TASK_DYNAMIC) { 962 if (tk_flags & RPC_TASK_DYNAMIC) {
943 dprintk("RPC: %5u freeing task\n", task->tk_pid); 963 dprintk("RPC: %5u freeing task\n", task->tk_pid);
944 mempool_free(task, rpc_task_mempool); 964 mempool_free(task, rpc_task_mempool);
945 } 965 }
946 rpc_release_calldata(tk_ops, calldata);
947} 966}
948 967
949static void rpc_async_release(struct work_struct *work) 968static void rpc_async_release(struct work_struct *work)
@@ -953,8 +972,7 @@ static void rpc_async_release(struct work_struct *work)
953 972
954static void rpc_release_resources_task(struct rpc_task *task) 973static void rpc_release_resources_task(struct rpc_task *task)
955{ 974{
956 if (task->tk_rqstp) 975 xprt_release(task);
957 xprt_release(task);
958 if (task->tk_msg.rpc_cred) { 976 if (task->tk_msg.rpc_cred) {
959 put_rpccred(task->tk_msg.rpc_cred); 977 put_rpccred(task->tk_msg.rpc_cred);
960 task->tk_msg.rpc_cred = NULL; 978 task->tk_msg.rpc_cred = NULL;
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index bd462a532acf..33811db8788a 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -1136,10 +1136,18 @@ static void xprt_request_init(struct rpc_task *task, struct rpc_xprt *xprt)
1136void xprt_release(struct rpc_task *task) 1136void xprt_release(struct rpc_task *task)
1137{ 1137{
1138 struct rpc_xprt *xprt; 1138 struct rpc_xprt *xprt;
1139 struct rpc_rqst *req; 1139 struct rpc_rqst *req = task->tk_rqstp;
1140 1140
1141 if (!(req = task->tk_rqstp)) 1141 if (req == NULL) {
1142 if (task->tk_client) {
1143 rcu_read_lock();
1144 xprt = rcu_dereference(task->tk_client->cl_xprt);
1145 if (xprt->snd_task == task)
1146 xprt_release_write(xprt, task);
1147 rcu_read_unlock();
1148 }
1142 return; 1149 return;
1150 }
1143 1151
1144 xprt = req->rq_xprt; 1152 xprt = req->rq_xprt;
1145 if (task->tk_ops->rpc_count_stats != NULL) 1153 if (task->tk_ops->rpc_count_stats != NULL)
diff --git a/net/wireless/core.c b/net/wireless/core.c
index 14d990400354..b677eab55b68 100644
--- a/net/wireless/core.c
+++ b/net/wireless/core.c
@@ -866,8 +866,7 @@ static int cfg80211_netdev_notifier_call(struct notifier_block *nb,
866 /* allow mac80211 to determine the timeout */ 866 /* allow mac80211 to determine the timeout */
867 wdev->ps_timeout = -1; 867 wdev->ps_timeout = -1;
868 868
869 if (!dev->ethtool_ops) 869 netdev_set_default_ethtool_ops(dev, &cfg80211_ethtool_ops);
870 dev->ethtool_ops = &cfg80211_ethtool_ops;
871 870
872 if ((wdev->iftype == NL80211_IFTYPE_STATION || 871 if ((wdev->iftype == NL80211_IFTYPE_STATION ||
873 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT || 872 wdev->iftype == NL80211_IFTYPE_P2P_CLIENT ||
generated by cgit v1.2.2 (git 2.25.0) at 2026-01-04 12:47:01 -0500