9 files changed, 63 insertions, 50 deletions

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 8af508536d36..3a8c8fd63c88 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -628,7 +628,7 @@ static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
         netdev_features_t features)
 {
         struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
-        u32 old_features = features;
+        netdev_features_t old_features = features;
 
         features &= real_dev->vlan_features;
         features |= NETIF_F_RXCSUM;
diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
index c3530a81a33b..950663d4d330 100644
--- a/net/bridge/br_stp_timer.c
+++ b/net/bridge/br_stp_timer.c
@@ -107,7 +107,7 @@ static void br_tcn_timer_expired(unsigned long arg)
 
         br_debug(br, "tcn timer expired\n");
         spin_lock(&br->lock);
-        if (br->dev->flags & IFF_UP) {
+        if (!br_is_root_bridge(br) && (br->dev->flags & IFF_UP)) {
                 br_transmit_tcn(br);
 
                 mod_timer(&br->tcn_timer,jiffies + br->bridge_hello_time);
diff --git a/net/core/dev.c b/net/core/dev.c
index 4040673f806a..40b1fadaf637 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2456,7 +2456,7 @@ EXPORT_SYMBOL(netif_skb_features);
  *      2. skb is fragmented and the device does not support SG.
  */
 static inline int skb_needs_linearize(struct sk_buff *skb,
-                                      int features)
+                                      netdev_features_t features)
 {
         return skb_is_nonlinear(skb) &&
                         ((skb_has_frag_list(skb) &&
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 5a934ef90f8b..22efdaa76ebf 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1421,7 +1421,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
         void __user *useraddr = ifr->ifr_data;
         u32 ethcmd;
         int rc;
-        u32 old_features;
+        netdev_features_t old_features;
 
         if (!dev || !netif_device_present(dev))
                 return -ENODEV;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index c61b3bb87a16..d01be2a3ae53 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1293,6 +1293,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb,
                        SKB_GSO_DODGY |
                        SKB_GSO_TCP_ECN |
                        SKB_GSO_GRE |
+                       SKB_GSO_TCPV6 |
                        SKB_GSO_UDP_TUNNEL |
                        0)))
                 goto out;
diff --git a/net/ipv4/gre.c b/net/ipv4/gre.c
index d2d5a99fba09..cc22363965d2 100644
--- a/net/ipv4/gre.c
+++ b/net/ipv4/gre.c
@@ -121,6 +121,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
         int ghl = GRE_HEADER_SECTION;
         struct gre_base_hdr *greh;
         int mac_len = skb->mac_len;
+        __be16 protocol = skb->protocol;
         int tnl_hlen;
         bool csum;
 
@@ -150,7 +151,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
 
         /* setup inner skb. */
         if (greh->protocol == htons(ETH_P_TEB)) {
-                struct ethhdr *eth = eth_hdr(skb);
+                struct ethhdr *eth = (struct ethhdr *)skb_inner_mac_header(skb);
                 skb->protocol = eth->h_proto;
         } else {
                 skb->protocol = greh->protocol;
@@ -199,6 +200,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
                 skb_reset_mac_header(skb);
                 skb_set_network_header(skb, mac_len);
                 skb->mac_len = mac_len;
+                skb->protocol = protocol;
         } while ((skb = skb->next));
 out:
         return segs;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 6abbe6455129..0ae038a4c7a8 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2311,8 +2311,10 @@ static struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         int mac_len = skb->mac_len;
         int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
-        int outer_hlen;
+        struct ethhdr *inner_eth = (struct ethhdr *)skb_inner_mac_header(skb);
+        __be16 protocol = skb->protocol;
         netdev_features_t enc_features;
+        int outer_hlen;
 
         if (unlikely(!pskb_may_pull(skb, tnl_hlen)))
                 goto out;
@@ -2322,6 +2324,8 @@ static struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
         skb_reset_mac_header(skb);
         skb_set_network_header(skb, skb_inner_network_offset(skb));
         skb->mac_len = skb_inner_network_offset(skb);
+        inner_eth = (struct ethhdr *)skb_mac_header(skb);
+        skb->protocol = inner_eth->h_proto;
 
         /* segment inner packet. */
         enc_features = skb->dev->hw_enc_features & netif_skb_features(skb);
@@ -2358,6 +2362,7 @@ static struct sk_buff *skb_udp_tunnel_segment(struct sk_buff *skb,
 
                 }
                 skb->ip_summed = CHECKSUM_NONE;
+                skb->protocol = protocol;
         } while ((skb = skb->next));
 out:
         return segs;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index dd5cd49b0e09..8ec1bca7f859 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -742,36 +742,33 @@ static void prb_open_block(struct tpacket_kbdq_core *pkc1,
 
         smp_rmb();
 
-        if (likely(TP_STATUS_KERNEL == BLOCK_STATUS(pbd1))) {
+        /* We could have just memset this but we will lose the
+         * flexibility of making the priv area sticky
+         */
 
-                /* We could have just memset this but we will lose the
-                 * flexibility of making the priv area sticky
-                 */
-                BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
-                BLOCK_NUM_PKTS(pbd1) = 0;
-                BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
-                getnstimeofday(&ts);
-                h1->ts_first_pkt.ts_sec = ts.tv_sec;
-                h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
-                pkc1->pkblk_start = (char *)pbd1;
-                pkc1->nxt_offset = pkc1->pkblk_start + BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
-                BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
-                BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
-                pbd1->version = pkc1->version;
-                pkc1->prev = pkc1->nxt_offset;
-                pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
-                prb_thaw_queue(pkc1);
-                _prb_refresh_rx_retire_blk_timer(pkc1);
+        BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
+        BLOCK_NUM_PKTS(pbd1) = 0;
+        BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
 
-                smp_wmb();
+        getnstimeofday(&ts);
 
-                return;
-        }
+        h1->ts_first_pkt.ts_sec = ts.tv_sec;
+        h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
 
-        WARN(1, "ERROR block:%p is NOT FREE status:%d kactive_blk_num:%d\n",
-                pbd1, BLOCK_STATUS(pbd1), pkc1->kactive_blk_num);
-        dump_stack();
-        BUG();
+        pkc1->pkblk_start = (char *)pbd1;
+        pkc1->nxt_offset = pkc1->pkblk_start + BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
+
+        BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
+        BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
+
+        pbd1->version = pkc1->version;
+        pkc1->prev = pkc1->nxt_offset;
+        pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
+
+        prb_thaw_queue(pkc1);
+        _prb_refresh_rx_retire_blk_timer(pkc1);
+
+        smp_wmb();
 }
 
 /*
@@ -862,10 +859,6 @@ static void prb_retire_current_block(struct tpacket_kbdq_core *pkc,
                 prb_close_block(pkc, pbd, po, status);
                 return;
         }
-
-        WARN(1, "ERROR-pbd[%d]:%p\n", pkc->kactive_blk_num, pbd);
-        dump_stack();
-        BUG();
 }
 
 static int prb_curr_blk_in_use(struct tpacket_kbdq_core *pkc,
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 25e159c2feb4..e5f3da507823 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -584,8 +584,7 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
 {
         int bp_index;
 
-        /*
-         * Prepare broadcast link message for reliable transmission,
+        /* Prepare broadcast link message for reliable transmission,
          * if first time trying to send it;
          * preparation is skipped for broadcast link protocol messages
          * since they are sent in an unreliable manner and don't need it
@@ -611,30 +610,43 @@ static int tipc_bcbearer_send(struct sk_buff *buf,
         for (bp_index = 0; bp_index < MAX_BEARERS; bp_index++) {
                 struct tipc_bearer *p = bcbearer->bpairs[bp_index].primary;
                 struct tipc_bearer *s = bcbearer->bpairs[bp_index].secondary;
+                struct tipc_bearer *b = p;
+                struct sk_buff *tbuf;
 
                 if (!p)
-                        break;  /* no more bearers to try */
+                        break; /* No more bearers to try */
+
+                if (tipc_bearer_blocked(p)) {
+                        if (!s || tipc_bearer_blocked(s))
+                                continue; /* Can't use either bearer */
+                        b = s;
+                }
 
-                tipc_nmap_diff(&bcbearer->remains, &p->nodes, &bcbearer->remains_new);
+                tipc_nmap_diff(&bcbearer->remains, &b->nodes,
+                               &bcbearer->remains_new);
                 if (bcbearer->remains_new.count == bcbearer->remains.count)
-                        continue;       /* bearer pair doesn't add anything */
+                        continue; /* Nothing added by bearer pair */
 
-                if (!tipc_bearer_blocked(p))
-                        tipc_bearer_send(p, buf, &p->bcast_addr);
-                else if (s && !tipc_bearer_blocked(s))
-                        /* unable to send on primary bearer */
-                        tipc_bearer_send(s, buf, &s->bcast_addr);
-                else
-                        /* unable to send on either bearer */
-                        continue;
+                if (bp_index == 0) {
+                        /* Use original buffer for first bearer */
+                        tipc_bearer_send(b, buf, &b->bcast_addr);
+                } else {
+                        /* Avoid concurrent buffer access */
+                        tbuf = pskb_copy(buf, GFP_ATOMIC);
+                        if (!tbuf)
+                                break;
+                        tipc_bearer_send(b, tbuf, &b->bcast_addr);
+                        kfree_skb(tbuf); /* Bearer keeps a clone */
+                }
 
+                /* Swap bearers for next packet */
                 if (s) {
                         bcbearer->bpairs[bp_index].primary = s;
                         bcbearer->bpairs[bp_index].secondary = p;
                 }
 
                 if (bcbearer->remains_new.count == 0)
-                        break;  /* all targets reached */
+                        break; /* All targets reached */
 
                 bcbearer->remains = bcbearer->remains_new;
         }