13 files changed, 113 insertions, 141 deletions

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index da0f64f82b57..d6b1b054e294 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -1781,8 +1781,8 @@ static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 ax25_info.idletimer = ax25_display_timer(&ax25->idletimer) / (60 * HZ);
                 ax25_info.n2count   = ax25->n2count;
                 ax25_info.state     = ax25->state;
-                ax25_info.rcv_q     = sk_wmem_alloc_get(sk);
-                ax25_info.snd_q     = sk_rmem_alloc_get(sk);
+                ax25_info.rcv_q     = sk_rmem_alloc_get(sk);
+                ax25_info.snd_q     = sk_wmem_alloc_get(sk);
                 ax25_info.vs        = ax25->vs;
                 ax25_info.vr        = ax25->vr;
                 ax25_info.va        = ax25->va;
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 0bcecbf06581..4d11c28ca8ca 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -192,11 +192,10 @@
 #define F_QUEUE_MAP_CPU (1<<14) /* queue map mirrors smp_processor_id() */
 
 /* Thread control flag bits */
-#define T_TERMINATE   (1<<0)
-#define T_STOP        (1<<1)    /* Stop run */
-#define T_RUN         (1<<2)    /* Start run */
-#define T_REMDEVALL   (1<<3)    /* Remove all devs */
-#define T_REMDEV      (1<<4)    /* Remove one dev */
+#define T_STOP        (1<<0)    /* Stop run */
+#define T_RUN         (1<<1)    /* Start run */
+#define T_REMDEVALL   (1<<2)    /* Remove all devs */
+#define T_REMDEV      (1<<3)    /* Remove one dev */
 
 /* If lock -- can be removed after some work */
 #define   if_lock(t)           spin_lock(&(t->if_lock));
@@ -2105,7 +2104,7 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
 
 static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
 {
-        ktime_t start;
+        ktime_t start_time, end_time;
         s32 remaining;
         struct hrtimer_sleeper t;
 
@@ -2116,7 +2115,7 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
         if (remaining <= 0)
                 return;
 
-        start = ktime_now();
+        start_time = ktime_now();
         if (remaining < 100)
                 udelay(remaining);      /* really small just spin */
         else {
@@ -2135,7 +2134,10 @@ static void spin(struct pktgen_dev *pkt_dev, ktime_t spin_until)
                 } while (t.task && pkt_dev->running && !signal_pending(current));
                 __set_current_state(TASK_RUNNING);
         }
-        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(ktime_now(), start));
+        end_time = ktime_now();
+
+        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(end_time, start_time));
+        pkt_dev->next_tx = ktime_add_ns(end_time, pkt_dev->delay);
 }
 
 static inline void set_pkt_overhead(struct pktgen_dev *pkt_dev)
@@ -3365,19 +3367,29 @@ static void pktgen_rem_thread(struct pktgen_thread *t)
         mutex_unlock(&pktgen_thread_lock);
 }
 
-static void idle(struct pktgen_dev *pkt_dev)
+static void pktgen_resched(struct pktgen_dev *pkt_dev)
 {
         ktime_t idle_start = ktime_now();
+        schedule();
+        pkt_dev->idle_acc += ktime_to_ns(ktime_sub(ktime_now(), idle_start));
+}
 
-        if (need_resched())
-                schedule();
-        else
-                cpu_relax();
+static void pktgen_wait_for_skb(struct pktgen_dev *pkt_dev)
+{
+        ktime_t idle_start = ktime_now();
 
+        while (atomic_read(&(pkt_dev->skb->users)) != 1) {
+                if (signal_pending(current))
+                        break;
+
+                if (need_resched())
+                        pktgen_resched(pkt_dev);
+                else
+                        cpu_relax();
+        }
         pkt_dev->idle_acc += ktime_to_ns(ktime_sub(ktime_now(), idle_start));
 }
 
-
 static void pktgen_xmit(struct pktgen_dev *pkt_dev)
 {
         struct net_device *odev = pkt_dev->odev;
@@ -3387,36 +3399,21 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
         u16 queue_map;
         int ret;
 
-        if (pkt_dev->delay) {
-                spin(pkt_dev, pkt_dev->next_tx);
-
-                /* This is max DELAY, this has special meaning of
-                 * "never transmit"
-                 */
-                if (pkt_dev->delay == ULLONG_MAX) {
-                        pkt_dev->next_tx = ktime_add_ns(ktime_now(), ULONG_MAX);
-                        return;
-                }
-        }
-
-        if (!pkt_dev->skb) {
-                set_cur_queue_map(pkt_dev);
-                queue_map = pkt_dev->cur_queue_map;
-        } else {
-                queue_map = skb_get_queue_mapping(pkt_dev->skb);
+        /* If device is offline, then don't send */
+        if (unlikely(!netif_running(odev) || !netif_carrier_ok(odev))) {
+                pktgen_stop_device(pkt_dev);
+                return;
         }
 
-        txq = netdev_get_tx_queue(odev, queue_map);
-        /* Did we saturate the queue already? */
-        if (netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)) {
-                /* If device is down, then all queues are permnantly frozen */
-                if (netif_running(odev))
-                        idle(pkt_dev);
-                else
-                        pktgen_stop_device(pkt_dev);
+        /* This is max DELAY, this has special meaning of
+         * "never transmit"
+         */
+        if (unlikely(pkt_dev->delay == ULLONG_MAX)) {
+                pkt_dev->next_tx = ktime_add_ns(ktime_now(), ULONG_MAX);
                 return;
         }
 
+        /* If no skb or clone count exhausted then get new one */
         if (!pkt_dev->skb || (pkt_dev->last_ok &&
                               ++pkt_dev->clone_count >= pkt_dev->clone_skb)) {
                 /* build a new pkt */
@@ -3435,54 +3432,45 @@ static void pktgen_xmit(struct pktgen_dev *pkt_dev)
                 pkt_dev->clone_count = 0;       /* reset counter */
         }
 
-        /* fill_packet() might have changed the queue */
+        if (pkt_dev->delay && pkt_dev->last_ok)
+                spin(pkt_dev, pkt_dev->next_tx);
+
         queue_map = skb_get_queue_mapping(pkt_dev->skb);
         txq = netdev_get_tx_queue(odev, queue_map);
 
         __netif_tx_lock_bh(txq);
-        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)))
-                pkt_dev->last_ok = 0;
-        else {
-                atomic_inc(&(pkt_dev->skb->users));
+        atomic_inc(&(pkt_dev->skb->users));
 
-        retry_now:
+        if (unlikely(netif_tx_queue_stopped(txq) || netif_tx_queue_frozen(txq)))
+                ret = NETDEV_TX_BUSY;
+        else
                 ret = (*xmit)(pkt_dev->skb, odev);
-                switch (ret) {
-                case NETDEV_TX_OK:
-                        txq_trans_update(txq);
-                        pkt_dev->last_ok = 1;
-                        pkt_dev->sofar++;
-                        pkt_dev->seq_num++;
-                        pkt_dev->tx_bytes += pkt_dev->cur_pkt_size;
-                        break;
-                case NETDEV_TX_LOCKED:
-                        cpu_relax();
-                        goto retry_now;
-                default: /* Drivers are not supposed to return other values! */
-                        if (net_ratelimit())
-                                pr_info("pktgen: %s xmit error: %d\n",
-                                        odev->name, ret);
-                        pkt_dev->errors++;
-                        /* fallthru */
-                case NETDEV_TX_BUSY:
-                        /* Retry it next time */
-                        atomic_dec(&(pkt_dev->skb->users));
-                        pkt_dev->last_ok = 0;
-                }
-
-                if (pkt_dev->delay)
-                        pkt_dev->next_tx = ktime_add_ns(ktime_now(),
-                                                        pkt_dev->delay);
+
+        switch (ret) {
+        case NETDEV_TX_OK:
+                txq_trans_update(txq);
+                pkt_dev->last_ok = 1;
+                pkt_dev->sofar++;
+                pkt_dev->seq_num++;
+                pkt_dev->tx_bytes += pkt_dev->cur_pkt_size;
+                break;
+        default: /* Drivers are not supposed to return other values! */
+                if (net_ratelimit())
+                        pr_info("pktgen: %s xmit error: %d\n",
+                                odev->name, ret);
+                pkt_dev->errors++;
+                /* fallthru */
+        case NETDEV_TX_LOCKED:
+        case NETDEV_TX_BUSY:
+                /* Retry it next time */
+                atomic_dec(&(pkt_dev->skb->users));
+                pkt_dev->last_ok = 0;
         }
         __netif_tx_unlock_bh(txq);
 
         /* If pkt_dev->count is zero, then run forever */
         if ((pkt_dev->count != 0) && (pkt_dev->sofar >= pkt_dev->count)) {
-                while (atomic_read(&(pkt_dev->skb->users)) != 1) {
-                        if (signal_pending(current))
-                                break;
-                        idle(pkt_dev);
-                }
+                pktgen_wait_for_skb(pkt_dev);
 
                 /* Done with this */
                 pktgen_stop_device(pkt_dev);
@@ -3515,20 +3503,24 @@ static int pktgen_thread_worker(void *arg)
         while (!kthread_should_stop()) {
                 pkt_dev = next_to_run(t);
 
-                if (!pkt_dev &&
-                    (t->control & (T_STOP | T_RUN | T_REMDEVALL | T_REMDEV))
-                    == 0) {
-                        prepare_to_wait(&(t->queue), &wait,
-                                        TASK_INTERRUPTIBLE);
-                        schedule_timeout(HZ / 10);
-                        finish_wait(&(t->queue), &wait);
+                if (unlikely(!pkt_dev && t->control == 0)) {
+                        wait_event_interruptible_timeout(t->queue,
+                                                         t->control != 0,
+                                                         HZ/10);
+                        continue;
                 }
 
                 __set_current_state(TASK_RUNNING);
 
-                if (pkt_dev)
+                if (likely(pkt_dev)) {
                         pktgen_xmit(pkt_dev);
 
+                        if (need_resched())
+                                pktgen_resched(pkt_dev);
+                        else
+                                cpu_relax();
+                }
+
                 if (t->control & T_STOP) {
                         pktgen_stop(t);
                         t->control &= ~(T_STOP);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index d9645c94a067..41ada9904d31 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -66,10 +66,7 @@
    solution, but it supposes maintaing new variable in ALL
    skb, even if no tunneling is used.
 
-   Current solution: t->recursion lock breaks dead loops. It looks
-   like dev->tbusy flag, but I preferred new variable, because
-   the semantics is different. One day, when hard_start_xmit
-   will be multithreaded we will have to use skb->encapsulation.
+   Current solution: HARD_TX_LOCK lock breaks dead loops.
 
 
 
@@ -678,11 +675,6 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         __be32 dst;
         int    mtu;
 
-        if (tunnel->recursion++) {
-                stats->collisions++;
-                goto tx_error;
-        }
-
         if (dev->type == ARPHRD_ETHER)
                 IPCB(skb)->flags = 0;
 
@@ -820,7 +812,6 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         ip_rt_put(rt);
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
-                        tunnel->recursion--;
                         return NETDEV_TX_OK;
                 }
                 if (skb->sk)
@@ -888,7 +879,6 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
         nf_reset(skb);
 
         IPTUNNEL_XMIT();
-        tunnel->recursion--;
         return NETDEV_TX_OK;
 
 tx_error_icmp:
@@ -897,7 +887,6 @@ tx_error_icmp:
 tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
-        tunnel->recursion--;
         return NETDEV_TX_OK;
 }
 
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index fc7993e9061f..5a0693576e82 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -611,6 +611,9 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                  *      Check the arguments are allowable
                  */
 
+                if (optlen < sizeof(struct in_addr))
+                        goto e_inval;
+
                 err = -EFAULT;
                 if (optlen >= sizeof(struct ip_mreqn)) {
                         if (copy_from_user(&mreq, optval, sizeof(mreq)))
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 62548cb0923c..08ccd344de7a 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -402,11 +402,6 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         __be32 dst = tiph->daddr;
         int    mtu;
 
-        if (tunnel->recursion++) {
-                stats->collisions++;
-                goto tx_error;
-        }
-
         if (skb->protocol != htons(ETH_P_IP))
                 goto tx_error;
 
@@ -485,7 +480,6 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                         ip_rt_put(rt);
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
-                        tunnel->recursion--;
                         return NETDEV_TX_OK;
                 }
                 if (skb->sk)
@@ -523,7 +517,6 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         nf_reset(skb);
 
         IPTUNNEL_XMIT();
-        tunnel->recursion--;
         return NETDEV_TX_OK;
 
 tx_error_icmp:
@@ -531,7 +524,6 @@ tx_error_icmp:
 tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
-        tunnel->recursion--;
         return NETDEV_TX_OK;
 }
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 7d25bbe32110..c595bbe1ed99 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1043,11 +1043,6 @@ ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         struct net_device_stats *stats = &t->dev->stats;
         int ret;
 
-        if (t->recursion++) {
-                stats->collisions++;
-                goto tx_err;
-        }
-
         switch (skb->protocol) {
         case htons(ETH_P_IP):
                 ret = ip4ip6_tnl_xmit(skb, dev);
@@ -1062,14 +1057,12 @@ ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         if (ret < 0)
                 goto tx_err;
 
-        t->recursion--;
         return NETDEV_TX_OK;
 
 tx_err:
         stats->tx_errors++;
         stats->tx_dropped++;
         kfree_skb(skb);
-        t->recursion--;
         return NETDEV_TX_OK;
 }
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 0ae4f6448187..fcb539628847 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -626,11 +626,6 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         struct in6_addr *addr6;
         int addr_type;
 
-        if (tunnel->recursion++) {
-                stats->collisions++;
-                goto tx_error;
-        }
-
         if (skb->protocol != htons(ETH_P_IPV6))
                 goto tx_error;
 
@@ -753,7 +748,6 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                         ip_rt_put(rt);
                         stats->tx_dropped++;
                         dev_kfree_skb(skb);
-                        tunnel->recursion--;
                         return NETDEV_TX_OK;
                 }
                 if (skb->sk)
@@ -794,7 +788,6 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         nf_reset(skb);
 
         IPTUNNEL_XMIT();
-        tunnel->recursion--;
         return NETDEV_TX_OK;
 
 tx_error_icmp:
@@ -802,7 +795,6 @@ tx_error_icmp:
 tx_error:
         stats->tx_errors++;
         dev_kfree_skb(skb);
-        tunnel->recursion--;
         return NETDEV_TX_OK;
 }
 
diff --git a/net/mac80211/scan.c b/net/mac80211/scan.c
index 039901109fa1..71e10cabf811 100644
--- a/net/mac80211/scan.c
+++ b/net/mac80211/scan.c
@@ -90,8 +90,8 @@ ieee80211_bss_info_update(struct ieee80211_local *local,
                 bss->dtim_period = tim_ie->dtim_period;
         }
 
-        /* set default value for buggy APs */
-        if (!elems->tim || bss->dtim_period == 0)
+        /* set default value for buggy AP/no TIM element */
+        if (bss->dtim_period == 0)
                 bss->dtim_period = 1;
 
         bss->supp_rates_len = 0;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 55180b99562a..a4bafbf15097 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1609,6 +1609,16 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
         return err;
 }
 
+void __netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
+{
+        struct sock *sk;
+        struct hlist_node *node;
+        struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
+
+        sk_for_each_bound(sk, node, &tbl->mc_list)
+                netlink_update_socket_mc(nlk_sk(sk), group, 0);
+}
+
 /**
  * netlink_clear_multicast_users - kick off multicast listeners
  *
@@ -1619,15 +1629,8 @@ int netlink_change_ngroups(struct sock *sk, unsigned int groups)
  */
 void netlink_clear_multicast_users(struct sock *ksk, unsigned int group)
 {
-        struct sock *sk;
-        struct hlist_node *node;
-        struct netlink_table *tbl = &nl_table[ksk->sk_protocol];
-
         netlink_table_grab();
-
-        sk_for_each_bound(sk, node, &tbl->mc_list)
-                netlink_update_socket_mc(nlk_sk(sk), group, 0);
-
+        __netlink_clear_multicast_users(ksk, group);
         netlink_table_ungrab();
 }
 
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index 566941e03363..44ff3f3810fa 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -220,10 +220,12 @@ static void __genl_unregister_mc_group(struct genl_family *family,
         struct net *net;
         BUG_ON(grp->family != family);
 
+        netlink_table_grab();
         rcu_read_lock();
         for_each_net_rcu(net)
-                netlink_clear_multicast_users(net->genl_sock, grp->id);
+                __netlink_clear_multicast_users(net->genl_sock, grp->id);
         rcu_read_unlock();
+        netlink_table_ungrab();
 
         clear_bit(grp->id, mc_groups);
         list_del(&grp->list);
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index a662e62a99cf..f60c0c2aacba 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -168,6 +168,12 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
                 goto drop;
         }
 
+        /* Broadcast sending is not implemented */
+        if (pn_addr(dst) == PNADDR_BROADCAST) {
+                err = -EOPNOTSUPP;
+                goto drop;
+        }
+
         skb_reset_transport_header(skb);
         WARN_ON(skb_headroom(skb) & 1); /* HW assumes word alignment */
         skb_push(skb, sizeof(struct phonethdr));
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 7a4ee397d2f7..07aa9f08d5fb 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -113,6 +113,8 @@ void pn_sock_unhash(struct sock *sk)
 }
 EXPORT_SYMBOL(pn_sock_unhash);
 
+static DEFINE_MUTEX(port_mutex);
+
 static int pn_socket_bind(struct socket *sock, struct sockaddr *addr, int len)
 {
         struct sock *sk = sock->sk;
@@ -140,9 +142,11 @@ static int pn_socket_bind(struct socket *sock, struct sockaddr *addr, int len)
                 err = -EINVAL; /* attempt to rebind */
                 goto out;
         }
+        WARN_ON(sk_hashed(sk));
+        mutex_lock(&port_mutex);
         err = sk->sk_prot->get_port(sk, pn_port(handle));
         if (err)
-                goto out;
+                goto out_port;
 
         /* get_port() sets the port, bind() sets the address if applicable */
         pn->sobject = pn_object(saddr, pn_port(pn->sobject));
@@ -150,6 +154,8 @@ static int pn_socket_bind(struct socket *sock, struct sockaddr *addr, int len)
 
         /* Enable RX on the socket */
         sk->sk_prot->hash(sk);
+out_port:
+        mutex_unlock(&port_mutex);
 out:
         release_sock(sk);
         return err;
@@ -357,8 +363,6 @@ const struct proto_ops phonet_stream_ops = {
 };
 EXPORT_SYMBOL(phonet_stream_ops);
 
-static DEFINE_MUTEX(port_mutex);
-
 /* allocate port for a socket */
 int pn_sock_get_port(struct sock *sk, unsigned short sport)
 {
@@ -370,9 +374,7 @@ int pn_sock_get_port(struct sock *sk, unsigned short sport)
 
         memset(&try_sa, 0, sizeof(struct sockaddr_pn));
         try_sa.spn_family = AF_PHONET;
-
-        mutex_lock(&port_mutex);
-
+        WARN_ON(!mutex_is_locked(&port_mutex));
         if (!sport) {
                 /* search free port */
                 int port, pmin, pmax;
@@ -401,8 +403,6 @@ int pn_sock_get_port(struct sock *sk, unsigned short sport)
                 else
                         sock_put(tmpsk);
         }
-        mutex_unlock(&port_mutex);
-
         /* the port must be in use already */
         return -EADDRINUSE;
 
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index d16cd9ea4d00..bf725275eb8d 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -26,11 +26,11 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
 
         wdev->wext.connect.ie = wdev->wext.ie;
         wdev->wext.connect.ie_len = wdev->wext.ie_len;
-        wdev->wext.connect.privacy = wdev->wext.default_key != -1;
 
         if (wdev->wext.keys) {
                 wdev->wext.keys->def = wdev->wext.default_key;
                 wdev->wext.keys->defmgmt = wdev->wext.default_mgmt_key;
+                wdev->wext.connect.privacy = true;
         }
 
         if (!wdev->wext.connect.ssid_len)