aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorJ. Bruce Fields <bfields@redhat.com>2010-12-17 13:29:07 -0500
committerJ. Bruce Fields <bfields@redhat.com>2010-12-17 13:29:07 -0500
commitec66ee3797e5848356cf593c6ec7aabf30a00cf1 (patch)
tree7ed5c84cc914644ffa1cd1b6a2b45db53fc224e8 /net
parent1205065764f2eda3216ebe213143f69891ee3460 (diff)
parentb0c3844d8af6b9f3f18f31e1b0502fbefa2166be (diff)
Merge commit 'v2.6.37-rc6' into for-2.6.38
Diffstat (limited to 'net')
-rw-r--r--net/atm/atm_sysfs.c3
-rw-r--r--net/atm/resources.c7
-rw-r--r--net/atm/resources.h2
-rw-r--r--net/bluetooth/sco.c6
-rw-r--r--net/ceph/Makefile22
-rw-r--r--net/ceph/buffer.c2
-rw-r--r--net/ceph/messenger.c13
-rw-r--r--net/ceph/osd_client.c25
-rw-r--r--net/ceph/pagevec.c3
-rw-r--r--net/core/filter.c19
-rw-r--r--net/core/net-sysfs.c10
-rw-r--r--net/core/request_sock.c4
-rw-r--r--net/core/timestamping.c6
-rw-r--r--net/dccp/input.c3
-rw-r--r--net/decnet/af_decnet.c2
-rw-r--r--net/econet/af_econet.c99
-rw-r--r--net/ipv4/fib_trie.c2
-rw-r--r--net/ipv4/icmp.c3
-rw-r--r--net/ipv4/inet_hashtables.c3
-rw-r--r--net/ipv4/proc.c1
-rw-r--r--net/ipv4/sysctl_net_ipv4.c6
-rw-r--r--net/ipv4/tcp.c2
-rw-r--r--net/ipv4/tcp_ipv4.c4
-rw-r--r--net/ipv4/tcp_minisocks.c2
-rw-r--r--net/ipv4/tcp_output.c42
-rw-r--r--net/ipv6/addrconf.c38
-rw-r--r--net/ipv6/ip6_tunnel.c7
-rw-r--r--net/ipv6/sit.c3
-rw-r--r--net/irda/af_irda.c1
-rw-r--r--net/irda/irnet/irnet_ppp.c1
-rw-r--r--net/irda/irttp.c30
-rw-r--r--net/l2tp/l2tp_ip.c6
-rw-r--r--net/llc/af_llc.c5
-rw-r--r--net/mac80211/Kconfig2
-rw-r--r--net/mac80211/rx.c6
-rw-r--r--net/mac80211/tx.c28
-rw-r--r--net/netfilter/ipvs/Kconfig1
-rw-r--r--net/rds/rdma.c2
-rw-r--r--net/sctp/socket.c8
-rw-r--r--net/socket.c15
-rw-r--r--net/sunrpc/clnt.c24
-rw-r--r--net/sunrpc/stats.c4
-rw-r--r--net/sunrpc/svc_xprt.c10
-rw-r--r--net/unix/af_unix.c37
-rw-r--r--net/unix/garbage.c9
-rw-r--r--net/wireless/chan.c54
-rw-r--r--net/x25/x25_link.c1
-rw-r--r--net/xfrm/xfrm_hash.c2
-rw-r--r--net/xfrm/xfrm_state.c2
49 files changed, 383 insertions, 204 deletions
diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index 799c631f0fe..f7fa67c7876 100644
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -143,12 +143,13 @@ static struct class atm_class = {
143 .dev_uevent = atm_uevent, 143 .dev_uevent = atm_uevent,
144}; 144};
145 145
146int atm_register_sysfs(struct atm_dev *adev) 146int atm_register_sysfs(struct atm_dev *adev, struct device *parent)
147{ 147{
148 struct device *cdev = &adev->class_dev; 148 struct device *cdev = &adev->class_dev;
149 int i, j, err; 149 int i, j, err;
150 150
151 cdev->class = &atm_class; 151 cdev->class = &atm_class;
152 cdev->parent = parent;
152 dev_set_drvdata(cdev, adev); 153 dev_set_drvdata(cdev, adev);
153 154
154 dev_set_name(cdev, "%s%d", adev->type, adev->number); 155 dev_set_name(cdev, "%s%d", adev->type, adev->number);
diff --git a/net/atm/resources.c b/net/atm/resources.c
index d29e5826151..23f45ce6f35 100644
--- a/net/atm/resources.c
+++ b/net/atm/resources.c
@@ -74,8 +74,9 @@ struct atm_dev *atm_dev_lookup(int number)
74} 74}
75EXPORT_SYMBOL(atm_dev_lookup); 75EXPORT_SYMBOL(atm_dev_lookup);
76 76
77struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops, 77struct atm_dev *atm_dev_register(const char *type, struct device *parent,
78 int number, unsigned long *flags) 78 const struct atmdev_ops *ops, int number,
79 unsigned long *flags)
79{ 80{
80 struct atm_dev *dev, *inuse; 81 struct atm_dev *dev, *inuse;
81 82
@@ -115,7 +116,7 @@ struct atm_dev *atm_dev_register(const char *type, const struct atmdev_ops *ops,
115 goto out_fail; 116 goto out_fail;
116 } 117 }
117 118
118 if (atm_register_sysfs(dev) < 0) { 119 if (atm_register_sysfs(dev, parent) < 0) {
119 pr_err("atm_register_sysfs failed for dev %s\n", type); 120 pr_err("atm_register_sysfs failed for dev %s\n", type);
120 atm_proc_dev_deregister(dev); 121 atm_proc_dev_deregister(dev);
121 goto out_fail; 122 goto out_fail;
diff --git a/net/atm/resources.h b/net/atm/resources.h
index 126fb1840df..521431e3050 100644
--- a/net/atm/resources.h
+++ b/net/atm/resources.h
@@ -42,6 +42,6 @@ static inline void atm_proc_dev_deregister(struct atm_dev *dev)
42 42
43#endif /* CONFIG_PROC_FS */ 43#endif /* CONFIG_PROC_FS */
44 44
45int atm_register_sysfs(struct atm_dev *adev); 45int atm_register_sysfs(struct atm_dev *adev, struct device *parent);
46void atm_unregister_sysfs(struct atm_dev *adev); 46void atm_unregister_sysfs(struct atm_dev *adev);
47#endif 47#endif
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d0927d1fdad..66b9e5c0523 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -882,7 +882,7 @@ static int sco_connect_ind(struct hci_dev *hdev, bdaddr_t *bdaddr, __u8 type)
882 int lm = 0; 882 int lm = 0;
883 883
884 if (type != SCO_LINK && type != ESCO_LINK) 884 if (type != SCO_LINK && type != ESCO_LINK)
885 return 0; 885 return -EINVAL;
886 886
887 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr)); 887 BT_DBG("hdev %s, bdaddr %s", hdev->name, batostr(bdaddr));
888 888
@@ -908,7 +908,7 @@ static int sco_connect_cfm(struct hci_conn *hcon, __u8 status)
908 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status); 908 BT_DBG("hcon %p bdaddr %s status %d", hcon, batostr(&hcon->dst), status);
909 909
910 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 910 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
911 return 0; 911 return -EINVAL;
912 912
913 if (!status) { 913 if (!status) {
914 struct sco_conn *conn; 914 struct sco_conn *conn;
@@ -927,7 +927,7 @@ static int sco_disconn_cfm(struct hci_conn *hcon, __u8 reason)
927 BT_DBG("hcon %p reason %d", hcon, reason); 927 BT_DBG("hcon %p reason %d", hcon, reason);
928 928
929 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK) 929 if (hcon->type != SCO_LINK && hcon->type != ESCO_LINK)
930 return 0; 930 return -EINVAL;
931 931
932 sco_conn_del(hcon, bt_err(reason)); 932 sco_conn_del(hcon, bt_err(reason));
933 933
diff --git a/net/ceph/Makefile b/net/ceph/Makefile
index aab1cabb803..5f19415ec9c 100644
--- a/net/ceph/Makefile
+++ b/net/ceph/Makefile
@@ -1,9 +1,6 @@
1# 1#
2# Makefile for CEPH filesystem. 2# Makefile for CEPH filesystem.
3# 3#
4
5ifneq ($(KERNELRELEASE),)
6
7obj-$(CONFIG_CEPH_LIB) += libceph.o 4obj-$(CONFIG_CEPH_LIB) += libceph.o
8 5
9libceph-objs := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \ 6libceph-objs := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
@@ -16,22 +13,3 @@ libceph-objs := ceph_common.o messenger.o msgpool.o buffer.o pagelist.o \
16 ceph_fs.o ceph_strings.o ceph_hash.o \ 13 ceph_fs.o ceph_strings.o ceph_hash.o \
17 pagevec.o 14 pagevec.o
18 15
19else
20#Otherwise we were called directly from the command
21# line; invoke the kernel build system.
22
23KERNELDIR ?= /lib/modules/$(shell uname -r)/build
24PWD := $(shell pwd)
25
26default: all
27
28all:
29 $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules
30
31modules_install:
32 $(MAKE) -C $(KERNELDIR) M=$(PWD) CONFIG_CEPH_LIB=m modules_install
33
34clean:
35 $(MAKE) -C $(KERNELDIR) M=$(PWD) clean
36
37endif
diff --git a/net/ceph/buffer.c b/net/ceph/buffer.c
index 53d8abfa25d..bf3e6a13c21 100644
--- a/net/ceph/buffer.c
+++ b/net/ceph/buffer.c
@@ -19,7 +19,7 @@ struct ceph_buffer *ceph_buffer_new(size_t len, gfp_t gfp)
19 if (b->vec.iov_base) { 19 if (b->vec.iov_base) {
20 b->is_vmalloc = false; 20 b->is_vmalloc = false;
21 } else { 21 } else {
22 b->vec.iov_base = __vmalloc(len, gfp, PAGE_KERNEL); 22 b->vec.iov_base = __vmalloc(len, gfp | __GFP_HIGHMEM, PAGE_KERNEL);
23 if (!b->vec.iov_base) { 23 if (!b->vec.iov_base) {
24 kfree(b); 24 kfree(b);
25 return NULL; 25 return NULL;
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 0e8157ee5d4..1c7a2ec4f3c 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -540,8 +540,7 @@ static void prepare_write_message(struct ceph_connection *con)
540 /* initialize page iterator */ 540 /* initialize page iterator */
541 con->out_msg_pos.page = 0; 541 con->out_msg_pos.page = 0;
542 if (m->pages) 542 if (m->pages)
543 con->out_msg_pos.page_pos = 543 con->out_msg_pos.page_pos = m->page_alignment;
544 le16_to_cpu(m->hdr.data_off) & ~PAGE_MASK;
545 else 544 else
546 con->out_msg_pos.page_pos = 0; 545 con->out_msg_pos.page_pos = 0;
547 con->out_msg_pos.data_pos = 0; 546 con->out_msg_pos.data_pos = 0;
@@ -1491,7 +1490,7 @@ static int read_partial_message(struct ceph_connection *con)
1491 struct ceph_msg *m = con->in_msg; 1490 struct ceph_msg *m = con->in_msg;
1492 int ret; 1491 int ret;
1493 int to, left; 1492 int to, left;
1494 unsigned front_len, middle_len, data_len, data_off; 1493 unsigned front_len, middle_len, data_len;
1495 int datacrc = con->msgr->nocrc; 1494 int datacrc = con->msgr->nocrc;
1496 int skip; 1495 int skip;
1497 u64 seq; 1496 u64 seq;
@@ -1527,19 +1526,17 @@ static int read_partial_message(struct ceph_connection *con)
1527 data_len = le32_to_cpu(con->in_hdr.data_len); 1526 data_len = le32_to_cpu(con->in_hdr.data_len);
1528 if (data_len > CEPH_MSG_MAX_DATA_LEN) 1527 if (data_len > CEPH_MSG_MAX_DATA_LEN)
1529 return -EIO; 1528 return -EIO;
1530 data_off = le16_to_cpu(con->in_hdr.data_off);
1531 1529
1532 /* verify seq# */ 1530 /* verify seq# */
1533 seq = le64_to_cpu(con->in_hdr.seq); 1531 seq = le64_to_cpu(con->in_hdr.seq);
1534 if ((s64)seq - (s64)con->in_seq < 1) { 1532 if ((s64)seq - (s64)con->in_seq < 1) {
1535 pr_info("skipping %s%lld %s seq %lld, expected %lld\n", 1533 pr_info("skipping %s%lld %s seq %lld expected %lld\n",
1536 ENTITY_NAME(con->peer_name), 1534 ENTITY_NAME(con->peer_name),
1537 ceph_pr_addr(&con->peer_addr.in_addr), 1535 ceph_pr_addr(&con->peer_addr.in_addr),
1538 seq, con->in_seq + 1); 1536 seq, con->in_seq + 1);
1539 con->in_base_pos = -front_len - middle_len - data_len - 1537 con->in_base_pos = -front_len - middle_len - data_len -
1540 sizeof(m->footer); 1538 sizeof(m->footer);
1541 con->in_tag = CEPH_MSGR_TAG_READY; 1539 con->in_tag = CEPH_MSGR_TAG_READY;
1542 con->in_seq++;
1543 return 0; 1540 return 0;
1544 } else if ((s64)seq - (s64)con->in_seq > 1) { 1541 } else if ((s64)seq - (s64)con->in_seq > 1) {
1545 pr_err("read_partial_message bad seq %lld expected %lld\n", 1542 pr_err("read_partial_message bad seq %lld expected %lld\n",
@@ -1576,7 +1573,7 @@ static int read_partial_message(struct ceph_connection *con)
1576 1573
1577 con->in_msg_pos.page = 0; 1574 con->in_msg_pos.page = 0;
1578 if (m->pages) 1575 if (m->pages)
1579 con->in_msg_pos.page_pos = data_off & ~PAGE_MASK; 1576 con->in_msg_pos.page_pos = m->page_alignment;
1580 else 1577 else
1581 con->in_msg_pos.page_pos = 0; 1578 con->in_msg_pos.page_pos = 0;
1582 con->in_msg_pos.data_pos = 0; 1579 con->in_msg_pos.data_pos = 0;
@@ -2301,6 +2298,7 @@ struct ceph_msg *ceph_msg_new(int type, int front_len, gfp_t flags)
2301 2298
2302 /* data */ 2299 /* data */
2303 m->nr_pages = 0; 2300 m->nr_pages = 0;
2301 m->page_alignment = 0;
2304 m->pages = NULL; 2302 m->pages = NULL;
2305 m->pagelist = NULL; 2303 m->pagelist = NULL;
2306 m->bio = NULL; 2304 m->bio = NULL;
@@ -2370,6 +2368,7 @@ static struct ceph_msg *ceph_alloc_msg(struct ceph_connection *con,
2370 type, front_len); 2368 type, front_len);
2371 return NULL; 2369 return NULL;
2372 } 2370 }
2371 msg->page_alignment = le16_to_cpu(hdr->data_off);
2373 } 2372 }
2374 memcpy(&msg->hdr, &con->in_hdr, sizeof(con->in_hdr)); 2373 memcpy(&msg->hdr, &con->in_hdr, sizeof(con->in_hdr));
2375 2374
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 79391994b3e..3e20a122ffa 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -71,6 +71,7 @@ void ceph_calc_raw_layout(struct ceph_osd_client *osdc,
71 op->extent.length = objlen; 71 op->extent.length = objlen;
72 } 72 }
73 req->r_num_pages = calc_pages_for(off, *plen); 73 req->r_num_pages = calc_pages_for(off, *plen);
74 req->r_page_alignment = off & ~PAGE_MASK;
74 if (op->op == CEPH_OSD_OP_WRITE) 75 if (op->op == CEPH_OSD_OP_WRITE)
75 op->payload_len = *plen; 76 op->payload_len = *plen;
76 77
@@ -390,6 +391,8 @@ void ceph_osdc_build_request(struct ceph_osd_request *req,
390 req->r_request->hdr.data_len = cpu_to_le32(data_len); 391 req->r_request->hdr.data_len = cpu_to_le32(data_len);
391 } 392 }
392 393
394 req->r_request->page_alignment = req->r_page_alignment;
395
393 BUG_ON(p > msg->front.iov_base + msg->front.iov_len); 396 BUG_ON(p > msg->front.iov_base + msg->front.iov_len);
394 msg_size = p - msg->front.iov_base; 397 msg_size = p - msg->front.iov_base;
395 msg->front.iov_len = msg_size; 398 msg->front.iov_len = msg_size;
@@ -419,7 +422,8 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
419 u32 truncate_seq, 422 u32 truncate_seq,
420 u64 truncate_size, 423 u64 truncate_size,
421 struct timespec *mtime, 424 struct timespec *mtime,
422 bool use_mempool, int num_reply) 425 bool use_mempool, int num_reply,
426 int page_align)
423{ 427{
424 struct ceph_osd_req_op ops[3]; 428 struct ceph_osd_req_op ops[3];
425 struct ceph_osd_request *req; 429 struct ceph_osd_request *req;
@@ -447,6 +451,10 @@ struct ceph_osd_request *ceph_osdc_new_request(struct ceph_osd_client *osdc,
447 calc_layout(osdc, vino, layout, off, plen, req, ops); 451 calc_layout(osdc, vino, layout, off, plen, req, ops);
448 req->r_file_layout = *layout; /* keep a copy */ 452 req->r_file_layout = *layout; /* keep a copy */
449 453
454 /* in case it differs from natural alignment that calc_layout
455 filled in for us */
456 req->r_page_alignment = page_align;
457
450 ceph_osdc_build_request(req, off, plen, ops, 458 ceph_osdc_build_request(req, off, plen, ops,
451 snapc, 459 snapc,
452 mtime, 460 mtime,
@@ -1489,7 +1497,7 @@ int ceph_osdc_readpages(struct ceph_osd_client *osdc,
1489 struct ceph_vino vino, struct ceph_file_layout *layout, 1497 struct ceph_vino vino, struct ceph_file_layout *layout,
1490 u64 off, u64 *plen, 1498 u64 off, u64 *plen,
1491 u32 truncate_seq, u64 truncate_size, 1499 u32 truncate_seq, u64 truncate_size,
1492 struct page **pages, int num_pages) 1500 struct page **pages, int num_pages, int page_align)
1493{ 1501{
1494 struct ceph_osd_request *req; 1502 struct ceph_osd_request *req;
1495 int rc = 0; 1503 int rc = 0;
@@ -1499,15 +1507,15 @@ int ceph_osdc_readpages(struct ceph_osd_client *osdc,
1499 req = ceph_osdc_new_request(osdc, layout, vino, off, plen, 1507 req = ceph_osdc_new_request(osdc, layout, vino, off, plen,
1500 CEPH_OSD_OP_READ, CEPH_OSD_FLAG_READ, 1508 CEPH_OSD_OP_READ, CEPH_OSD_FLAG_READ,
1501 NULL, 0, truncate_seq, truncate_size, NULL, 1509 NULL, 0, truncate_seq, truncate_size, NULL,
1502 false, 1); 1510 false, 1, page_align);
1503 if (!req) 1511 if (!req)
1504 return -ENOMEM; 1512 return -ENOMEM;
1505 1513
1506 /* it may be a short read due to an object boundary */ 1514 /* it may be a short read due to an object boundary */
1507 req->r_pages = pages; 1515 req->r_pages = pages;
1508 1516
1509 dout("readpages final extent is %llu~%llu (%d pages)\n", 1517 dout("readpages final extent is %llu~%llu (%d pages align %d)\n",
1510 off, *plen, req->r_num_pages); 1518 off, *plen, req->r_num_pages, page_align);
1511 1519
1512 rc = ceph_osdc_start_request(osdc, req, false); 1520 rc = ceph_osdc_start_request(osdc, req, false);
1513 if (!rc) 1521 if (!rc)
@@ -1533,6 +1541,7 @@ int ceph_osdc_writepages(struct ceph_osd_client *osdc, struct ceph_vino vino,
1533{ 1541{
1534 struct ceph_osd_request *req; 1542 struct ceph_osd_request *req;
1535 int rc = 0; 1543 int rc = 0;
1544 int page_align = off & ~PAGE_MASK;
1536 1545
1537 BUG_ON(vino.snap != CEPH_NOSNAP); 1546 BUG_ON(vino.snap != CEPH_NOSNAP);
1538 req = ceph_osdc_new_request(osdc, layout, vino, off, &len, 1547 req = ceph_osdc_new_request(osdc, layout, vino, off, &len,
@@ -1541,7 +1550,7 @@ int ceph_osdc_writepages(struct ceph_osd_client *osdc, struct ceph_vino vino,
1541 CEPH_OSD_FLAG_WRITE, 1550 CEPH_OSD_FLAG_WRITE,
1542 snapc, do_sync, 1551 snapc, do_sync,
1543 truncate_seq, truncate_size, mtime, 1552 truncate_seq, truncate_size, mtime,
1544 nofail, 1); 1553 nofail, 1, page_align);
1545 if (!req) 1554 if (!req)
1546 return -ENOMEM; 1555 return -ENOMEM;
1547 1556
@@ -1638,8 +1647,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
1638 m = ceph_msg_get(req->r_reply); 1647 m = ceph_msg_get(req->r_reply);
1639 1648
1640 if (data_len > 0) { 1649 if (data_len > 0) {
1641 unsigned data_off = le16_to_cpu(hdr->data_off); 1650 int want = calc_pages_for(req->r_page_alignment, data_len);
1642 int want = calc_pages_for(data_off & ~PAGE_MASK, data_len);
1643 1651
1644 if (unlikely(req->r_num_pages < want)) { 1652 if (unlikely(req->r_num_pages < want)) {
1645 pr_warning("tid %lld reply %d > expected %d pages\n", 1653 pr_warning("tid %lld reply %d > expected %d pages\n",
@@ -1651,6 +1659,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
1651 } 1659 }
1652 m->pages = req->r_pages; 1660 m->pages = req->r_pages;
1653 m->nr_pages = req->r_num_pages; 1661 m->nr_pages = req->r_num_pages;
1662 m->page_alignment = req->r_page_alignment;
1654#ifdef CONFIG_BLOCK 1663#ifdef CONFIG_BLOCK
1655 m->bio = req->r_bio; 1664 m->bio = req->r_bio;
1656#endif 1665#endif
diff --git a/net/ceph/pagevec.c b/net/ceph/pagevec.c
index 54caf068715..ac34feeb2b3 100644
--- a/net/ceph/pagevec.c
+++ b/net/ceph/pagevec.c
@@ -13,8 +13,7 @@
13 * build a vector of user pages 13 * build a vector of user pages
14 */ 14 */
15struct page **ceph_get_direct_page_vector(const char __user *data, 15struct page **ceph_get_direct_page_vector(const char __user *data,
16 int num_pages, 16 int num_pages)
17 loff_t off, size_t len)
18{ 17{
19 struct page **pages; 18 struct page **pages;
20 int rc; 19 int rc;
diff --git a/net/core/filter.c b/net/core/filter.c
index 23e9b2a6b4c..ae21a0d3c4a 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -589,23 +589,16 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
589EXPORT_SYMBOL(sk_chk_filter); 589EXPORT_SYMBOL(sk_chk_filter);
590 590
591/** 591/**
592 * sk_filter_rcu_release: Release a socket filter by rcu_head 592 * sk_filter_release_rcu - Release a socket filter by rcu_head
593 * @rcu: rcu_head that contains the sk_filter to free 593 * @rcu: rcu_head that contains the sk_filter to free
594 */ 594 */
595static void sk_filter_rcu_release(struct rcu_head *rcu) 595void sk_filter_release_rcu(struct rcu_head *rcu)
596{ 596{
597 struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu); 597 struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
598 598
599 sk_filter_release(fp); 599 kfree(fp);
600}
601
602static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
603{
604 unsigned int size = sk_filter_len(fp);
605
606 atomic_sub(size, &sk->sk_omem_alloc);
607 call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
608} 600}
601EXPORT_SYMBOL(sk_filter_release_rcu);
609 602
610/** 603/**
611 * sk_attach_filter - attach a socket filter 604 * sk_attach_filter - attach a socket filter
@@ -649,7 +642,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
649 rcu_assign_pointer(sk->sk_filter, fp); 642 rcu_assign_pointer(sk->sk_filter, fp);
650 643
651 if (old_fp) 644 if (old_fp)
652 sk_filter_delayed_uncharge(sk, old_fp); 645 sk_filter_uncharge(sk, old_fp);
653 return 0; 646 return 0;
654} 647}
655EXPORT_SYMBOL_GPL(sk_attach_filter); 648EXPORT_SYMBOL_GPL(sk_attach_filter);
@@ -663,7 +656,7 @@ int sk_detach_filter(struct sock *sk)
663 sock_owned_by_user(sk)); 656 sock_owned_by_user(sk));
664 if (filter) { 657 if (filter) {
665 rcu_assign_pointer(sk->sk_filter, NULL); 658 rcu_assign_pointer(sk->sk_filter, NULL);
666 sk_filter_delayed_uncharge(sk, filter); 659 sk_filter_uncharge(sk, filter);
667 ret = 0; 660 ret = 0;
668 } 661 }
669 return ret; 662 return ret;
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index a5ff5a89f37..7f902cad10f 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -712,15 +712,21 @@ static void rx_queue_release(struct kobject *kobj)
712 712
713 713
714 map = rcu_dereference_raw(queue->rps_map); 714 map = rcu_dereference_raw(queue->rps_map);
715 if (map) 715 if (map) {
716 RCU_INIT_POINTER(queue->rps_map, NULL);
716 call_rcu(&map->rcu, rps_map_release); 717 call_rcu(&map->rcu, rps_map_release);
718 }
717 719
718 flow_table = rcu_dereference_raw(queue->rps_flow_table); 720 flow_table = rcu_dereference_raw(queue->rps_flow_table);
719 if (flow_table) 721 if (flow_table) {
722 RCU_INIT_POINTER(queue->rps_flow_table, NULL);
720 call_rcu(&flow_table->rcu, rps_dev_flow_table_release); 723 call_rcu(&flow_table->rcu, rps_dev_flow_table_release);
724 }
721 725
722 if (atomic_dec_and_test(&first->count)) 726 if (atomic_dec_and_test(&first->count))
723 kfree(first); 727 kfree(first);
728 else
729 memset(kobj, 0, sizeof(*kobj));
724} 730}
725 731
726static struct kobj_type rx_queue_ktype = { 732static struct kobj_type rx_queue_ktype = {
diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 7552495aff7..fceeb37d716 100644
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -45,9 +45,7 @@ int reqsk_queue_alloc(struct request_sock_queue *queue,
45 nr_table_entries = roundup_pow_of_two(nr_table_entries + 1); 45 nr_table_entries = roundup_pow_of_two(nr_table_entries + 1);
46 lopt_size += nr_table_entries * sizeof(struct request_sock *); 46 lopt_size += nr_table_entries * sizeof(struct request_sock *);
47 if (lopt_size > PAGE_SIZE) 47 if (lopt_size > PAGE_SIZE)
48 lopt = __vmalloc(lopt_size, 48 lopt = vzalloc(lopt_size);
49 GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO,
50 PAGE_KERNEL);
51 else 49 else
52 lopt = kzalloc(lopt_size, GFP_KERNEL); 50 lopt = kzalloc(lopt_size, GFP_KERNEL);
53 if (lopt == NULL) 51 if (lopt == NULL)
diff --git a/net/core/timestamping.c b/net/core/timestamping.c
index 0ae6c22da85..c19bb4ee405 100644
--- a/net/core/timestamping.c
+++ b/net/core/timestamping.c
@@ -96,11 +96,13 @@ bool skb_defer_rx_timestamp(struct sk_buff *skb)
96 struct phy_device *phydev; 96 struct phy_device *phydev;
97 unsigned int type; 97 unsigned int type;
98 98
99 skb_push(skb, ETH_HLEN); 99 if (skb_headroom(skb) < ETH_HLEN)
100 return false;
101 __skb_push(skb, ETH_HLEN);
100 102
101 type = classify(skb); 103 type = classify(skb);
102 104
103 skb_pull(skb, ETH_HLEN); 105 __skb_pull(skb, ETH_HLEN);
104 106
105 switch (type) { 107 switch (type) {
106 case PTP_CLASS_V1_IPV4: 108 case PTP_CLASS_V1_IPV4:
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 265985370fa..e424a09e83f 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -239,7 +239,8 @@ static int dccp_check_seqno(struct sock *sk, struct sk_buff *skb)
239 dccp_update_gsr(sk, seqno); 239 dccp_update_gsr(sk, seqno);
240 240
241 if (dh->dccph_type != DCCP_PKT_SYNC && 241 if (dh->dccph_type != DCCP_PKT_SYNC &&
242 (ackno != DCCP_PKT_WITHOUT_ACK_SEQ)) 242 ackno != DCCP_PKT_WITHOUT_ACK_SEQ &&
243 after48(ackno, dp->dccps_gar))
243 dp->dccps_gar = ackno; 244 dp->dccps_gar = ackno;
244 } else { 245 } else {
245 unsigned long now = jiffies; 246 unsigned long now = jiffies;
diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
index a76b78de679..6f97268ed85 100644
--- a/net/decnet/af_decnet.c
+++ b/net/decnet/af_decnet.c
@@ -1556,6 +1556,8 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
1556 if (r_len > sizeof(struct linkinfo_dn)) 1556 if (r_len > sizeof(struct linkinfo_dn))
1557 r_len = sizeof(struct linkinfo_dn); 1557 r_len = sizeof(struct linkinfo_dn);
1558 1558
1559 memset(&link, 0, sizeof(link));
1560
1559 switch(sock->state) { 1561 switch(sock->state) {
1560 case SS_CONNECTING: 1562 case SS_CONNECTING:
1561 link.idn_linkstate = LL_CONNECTING; 1563 link.idn_linkstate = LL_CONNECTING;
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index f8c1ae4b41f..15dcc1a586b 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -31,6 +31,7 @@
31#include <linux/skbuff.h> 31#include <linux/skbuff.h>
32#include <linux/udp.h> 32#include <linux/udp.h>
33#include <linux/slab.h> 33#include <linux/slab.h>
34#include <linux/vmalloc.h>
34#include <net/sock.h> 35#include <net/sock.h>
35#include <net/inet_common.h> 36#include <net/inet_common.h>
36#include <linux/stat.h> 37#include <linux/stat.h>
@@ -276,12 +277,12 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
276#endif 277#endif
277#ifdef CONFIG_ECONET_AUNUDP 278#ifdef CONFIG_ECONET_AUNUDP
278 struct msghdr udpmsg; 279 struct msghdr udpmsg;
279 struct iovec iov[msg->msg_iovlen+1]; 280 struct iovec iov[2];
280 struct aunhdr ah; 281 struct aunhdr ah;
281 struct sockaddr_in udpdest; 282 struct sockaddr_in udpdest;
282 __kernel_size_t size; 283 __kernel_size_t size;
283 int i;
284 mm_segment_t oldfs; 284 mm_segment_t oldfs;
285 char *userbuf;
285#endif 286#endif
286 287
287 /* 288 /*
@@ -297,23 +298,14 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
297 298
298 mutex_lock(&econet_mutex); 299 mutex_lock(&econet_mutex);
299 300
300 if (saddr == NULL) { 301 if (saddr == NULL || msg->msg_namelen < sizeof(struct sockaddr_ec)) {
301 struct econet_sock *eo = ec_sk(sk); 302 mutex_unlock(&econet_mutex);
302 303 return -EINVAL;
303 addr.station = eo->station; 304 }
304 addr.net = eo->net; 305 addr.station = saddr->addr.station;
305 port = eo->port; 306 addr.net = saddr->addr.net;
306 cb = eo->cb; 307 port = saddr->port;
307 } else { 308 cb = saddr->cb;
308 if (msg->msg_namelen < sizeof(struct sockaddr_ec)) {
309 mutex_unlock(&econet_mutex);
310 return -EINVAL;
311 }
312 addr.station = saddr->addr.station;
313 addr.net = saddr->addr.net;
314 port = saddr->port;
315 cb = saddr->cb;
316 }
317 309
318 /* Look for a device with the right network number. */ 310 /* Look for a device with the right network number. */
319 dev = net2dev_map[addr.net]; 311 dev = net2dev_map[addr.net];
@@ -328,17 +320,17 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
328 } 320 }
329 } 321 }
330 322
331 if (len + 15 > dev->mtu) {
332 mutex_unlock(&econet_mutex);
333 return -EMSGSIZE;
334 }
335
336 if (dev->type == ARPHRD_ECONET) { 323 if (dev->type == ARPHRD_ECONET) {
337 /* Real hardware Econet. We're not worthy etc. */ 324 /* Real hardware Econet. We're not worthy etc. */
338#ifdef CONFIG_ECONET_NATIVE 325#ifdef CONFIG_ECONET_NATIVE
339 unsigned short proto = 0; 326 unsigned short proto = 0;
340 int res; 327 int res;
341 328
329 if (len + 15 > dev->mtu) {
330 mutex_unlock(&econet_mutex);
331 return -EMSGSIZE;
332 }
333
342 dev_hold(dev); 334 dev_hold(dev);
343 335
344 skb = sock_alloc_send_skb(sk, len+LL_ALLOCATED_SPACE(dev), 336 skb = sock_alloc_send_skb(sk, len+LL_ALLOCATED_SPACE(dev),
@@ -351,7 +343,6 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
351 343
352 eb = (struct ec_cb *)&skb->cb; 344 eb = (struct ec_cb *)&skb->cb;
353 345
354 /* BUG: saddr may be NULL */
355 eb->cookie = saddr->cookie; 346 eb->cookie = saddr->cookie;
356 eb->sec = *saddr; 347 eb->sec = *saddr;
357 eb->sent = ec_tx_done; 348 eb->sent = ec_tx_done;
@@ -415,6 +406,11 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
415 return -ENETDOWN; /* No socket - can't send */ 406 return -ENETDOWN; /* No socket - can't send */
416 } 407 }
417 408
409 if (len > 32768) {
410 err = -E2BIG;
411 goto error;
412 }
413
418 /* Make up a UDP datagram and hand it off to some higher intellect. */ 414 /* Make up a UDP datagram and hand it off to some higher intellect. */
419 415
420 memset(&udpdest, 0, sizeof(udpdest)); 416 memset(&udpdest, 0, sizeof(udpdest));
@@ -446,36 +442,26 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
446 442
447 /* tack our header on the front of the iovec */ 443 /* tack our header on the front of the iovec */
448 size = sizeof(struct aunhdr); 444 size = sizeof(struct aunhdr);
449 /*
450 * XXX: that is b0rken. We can't mix userland and kernel pointers
451 * in iovec, since on a lot of platforms copy_from_user() will
452 * *not* work with the kernel and userland ones at the same time,
453 * regardless of what we do with set_fs(). And we are talking about
454 * econet-over-ethernet here, so "it's only ARM anyway" doesn't
455 * apply. Any suggestions on fixing that code? -- AV
456 */
457 iov[0].iov_base = (void *)&ah; 445 iov[0].iov_base = (void *)&ah;
458 iov[0].iov_len = size; 446 iov[0].iov_len = size;
459 for (i = 0; i < msg->msg_iovlen; i++) { 447
460 void __user *base = msg->msg_iov[i].iov_base; 448 userbuf = vmalloc(len);
461 size_t iov_len = msg->msg_iov[i].iov_len; 449 if (userbuf == NULL) {
462 /* Check it now since we switch to KERNEL_DS later. */ 450 err = -ENOMEM;
463 if (!access_ok(VERIFY_READ, base, iov_len)) { 451 goto error;
464 mutex_unlock(&econet_mutex);
465 return -EFAULT;
466 }
467 iov[i+1].iov_base = base;
468 iov[i+1].iov_len = iov_len;
469 size += iov_len;
470 } 452 }
471 453
454 iov[1].iov_base = userbuf;
455 iov[1].iov_len = len;
456 err = memcpy_fromiovec(userbuf, msg->msg_iov, len);
457 if (err)
458 goto error_free_buf;
459
472 /* Get a skbuff (no data, just holds our cb information) */ 460 /* Get a skbuff (no data, just holds our cb information) */
473 if ((skb = sock_alloc_send_skb(sk, 0, 461 if ((skb = sock_alloc_send_skb(sk, 0,
474 msg->msg_flags & MSG_DONTWAIT, 462 msg->msg_flags & MSG_DONTWAIT,
475 &err)) == NULL) { 463 &err)) == NULL)
476 mutex_unlock(&econet_mutex); 464 goto error_free_buf;
477 return err;
478 }
479 465
480 eb = (struct ec_cb *)&skb->cb; 466 eb = (struct ec_cb *)&skb->cb;
481 467
@@ -491,7 +477,7 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
491 udpmsg.msg_name = (void *)&udpdest; 477 udpmsg.msg_name = (void *)&udpdest;
492 udpmsg.msg_namelen = sizeof(udpdest); 478 udpmsg.msg_namelen = sizeof(udpdest);
493 udpmsg.msg_iov = &iov[0]; 479 udpmsg.msg_iov = &iov[0];
494 udpmsg.msg_iovlen = msg->msg_iovlen + 1; 480 udpmsg.msg_iovlen = 2;
495 udpmsg.msg_control = NULL; 481 udpmsg.msg_control = NULL;
496 udpmsg.msg_controllen = 0; 482 udpmsg.msg_controllen = 0;
497 udpmsg.msg_flags=0; 483 udpmsg.msg_flags=0;
@@ -499,9 +485,13 @@ static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
499 oldfs = get_fs(); set_fs(KERNEL_DS); /* More privs :-) */ 485 oldfs = get_fs(); set_fs(KERNEL_DS); /* More privs :-) */
500 err = sock_sendmsg(udpsock, &udpmsg, size); 486 err = sock_sendmsg(udpsock, &udpmsg, size);
501 set_fs(oldfs); 487 set_fs(oldfs);
488
489error_free_buf:
490 vfree(userbuf);
502#else 491#else
503 err = -EPROTOTYPE; 492 err = -EPROTOTYPE;
504#endif 493#endif
494 error:
505 mutex_unlock(&econet_mutex); 495 mutex_unlock(&econet_mutex);
506 496
507 return err; 497 return err;
@@ -671,6 +661,11 @@ static int ec_dev_ioctl(struct socket *sock, unsigned int cmd, void __user *arg)
671 err = 0; 661 err = 0;
672 switch (cmd) { 662 switch (cmd) {
673 case SIOCSIFADDR: 663 case SIOCSIFADDR:
664 if (!capable(CAP_NET_ADMIN)) {
665 err = -EPERM;
666 break;
667 }
668
674 edev = dev->ec_ptr; 669 edev = dev->ec_ptr;
675 if (edev == NULL) { 670 if (edev == NULL) {
676 /* Magic up a new one. */ 671 /* Magic up a new one. */
@@ -856,9 +851,13 @@ static void aun_incoming(struct sk_buff *skb, struct aunhdr *ah, size_t len)
856{ 851{
857 struct iphdr *ip = ip_hdr(skb); 852 struct iphdr *ip = ip_hdr(skb);
858 unsigned char stn = ntohl(ip->saddr) & 0xff; 853 unsigned char stn = ntohl(ip->saddr) & 0xff;
854 struct dst_entry *dst = skb_dst(skb);
855 struct ec_device *edev = NULL;
859 struct sock *sk = NULL; 856 struct sock *sk = NULL;
860 struct sk_buff *newskb; 857 struct sk_buff *newskb;
861 struct ec_device *edev = skb->dev->ec_ptr; 858
859 if (dst)
860 edev = dst->dev->ec_ptr;
862 861
863 if (! edev) 862 if (! edev)
864 goto bad; 863 goto bad;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 200eb538fbb..0f280348e0f 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -365,7 +365,7 @@ static struct tnode *tnode_alloc(size_t size)
365 if (size <= PAGE_SIZE) 365 if (size <= PAGE_SIZE)
366 return kzalloc(size, GFP_KERNEL); 366 return kzalloc(size, GFP_KERNEL);
367 else 367 else
368 return __vmalloc(size, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL); 368 return vzalloc(size);
369} 369}
370 370
371static void __tnode_vfree(struct work_struct *arg) 371static void __tnode_vfree(struct work_struct *arg)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 96bc7f9475a..e5d1a44bcbd 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -569,6 +569,9 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
569 /* No need to clone since we're just using its address. */ 569 /* No need to clone since we're just using its address. */
570 rt2 = rt; 570 rt2 = rt;
571 571
572 if (!fl.nl_u.ip4_u.saddr)
573 fl.nl_u.ip4_u.saddr = rt->rt_src;
574
572 err = xfrm_lookup(net, (struct dst_entry **)&rt, &fl, NULL, 0); 575 err = xfrm_lookup(net, (struct dst_entry **)&rt, &fl, NULL, 0);
573 switch (err) { 576 switch (err) {
574 case 0: 577 case 0:
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 1b344f30b46..3c0369a3a66 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -133,8 +133,7 @@ int __inet_inherit_port(struct sock *sk, struct sock *child)
133 } 133 }
134 } 134 }
135 } 135 }
136 sk_add_bind_node(child, &tb->owners); 136 inet_bind_hash(child, tb, port);
137 inet_csk(child)->icsk_bind_hash = tb;
138 spin_unlock(&head->lock); 137 spin_unlock(&head->lock);
139 138
140 return 0; 139 return 0;
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 1b48eb1ed45..b14ec7d03b6 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -253,6 +253,7 @@ static const struct snmp_mib snmp4_net_list[] = {
253 SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP), 253 SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP),
254 SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP), 254 SNMP_MIB_ITEM("TCPDeferAcceptDrop", LINUX_MIB_TCPDEFERACCEPTDROP),
255 SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER), 255 SNMP_MIB_ITEM("IPReversePathFilter", LINUX_MIB_IPRPFILTER),
256 SNMP_MIB_ITEM("TCPTimeWaitOverflow", LINUX_MIB_TCPTIMEWAITOVERFLOW),
256 SNMP_MIB_SENTINEL 257 SNMP_MIB_SENTINEL
257}; 258};
258 259
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index e91911d7aae..1b4ec21497a 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -26,6 +26,8 @@ static int zero;
26static int tcp_retr1_max = 255; 26static int tcp_retr1_max = 255;
27static int ip_local_port_range_min[] = { 1, 1 }; 27static int ip_local_port_range_min[] = { 1, 1 };
28static int ip_local_port_range_max[] = { 65535, 65535 }; 28static int ip_local_port_range_max[] = { 65535, 65535 };
29static int tcp_adv_win_scale_min = -31;
30static int tcp_adv_win_scale_max = 31;
29 31
30/* Update system visible IP port range */ 32/* Update system visible IP port range */
31static void set_local_port_range(int range[2]) 33static void set_local_port_range(int range[2])
@@ -426,7 +428,9 @@ static struct ctl_table ipv4_table[] = {
426 .data = &sysctl_tcp_adv_win_scale, 428 .data = &sysctl_tcp_adv_win_scale,
427 .maxlen = sizeof(int), 429 .maxlen = sizeof(int),
428 .mode = 0644, 430 .mode = 0644,
429 .proc_handler = proc_dointvec 431 .proc_handler = proc_dointvec_minmax,
432 .extra1 = &tcp_adv_win_scale_min,
433 .extra2 = &tcp_adv_win_scale_max,
430 }, 434 },
431 { 435 {
432 .procname = "tcp_tw_reuse", 436 .procname = "tcp_tw_reuse",
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 08141996948..f15c36a706e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2246,7 +2246,7 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
2246 /* Values greater than interface MTU won't take effect. However 2246 /* Values greater than interface MTU won't take effect. However
2247 * at the point when this call is done we typically don't yet 2247 * at the point when this call is done we typically don't yet
2248 * know which interface is going to be used */ 2248 * know which interface is going to be used */
2249 if (val < 64 || val > MAX_TCP_WINDOW) { 2249 if (val < TCP_MIN_MSS || val > MAX_TCP_WINDOW) {
2250 err = -EINVAL; 2250 err = -EINVAL;
2251 break; 2251 break;
2252 } 2252 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 69ccbc1dde9..e13da6de1fc 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2043,7 +2043,9 @@ get_req:
2043 } 2043 }
2044get_sk: 2044get_sk:
2045 sk_nulls_for_each_from(sk, node) { 2045 sk_nulls_for_each_from(sk, node) {
2046 if (sk->sk_family == st->family && net_eq(sock_net(sk), net)) { 2046 if (!net_eq(sock_net(sk), net))
2047 continue;
2048 if (sk->sk_family == st->family) {
2047 cur = sk; 2049 cur = sk;
2048 goto out; 2050 goto out;
2049 } 2051 }
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 43cf901d765..a66735f7596 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -347,7 +347,7 @@ void tcp_time_wait(struct sock *sk, int state, int timeo)
347 * socket up. We've got bigger problems than 347 * socket up. We've got bigger problems than
348 * non-graceful socket closings. 348 * non-graceful socket closings.
349 */ 349 */
350 LIMIT_NETDEBUG(KERN_INFO "TCP: time wait bucket table overflow\n"); 350 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPTIMEWAITOVERFLOW);
351 } 351 }
352 352
353 tcp_update_metrics(sk); 353 tcp_update_metrics(sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 05b1ecf3676..61c2463e275 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -231,11 +231,10 @@ void tcp_select_initial_window(int __space, __u32 mss,
231 /* when initializing use the value from init_rcv_wnd 231 /* when initializing use the value from init_rcv_wnd
232 * rather than the default from above 232 * rather than the default from above
233 */ 233 */
234 if (init_rcv_wnd && 234 if (init_rcv_wnd)
235 (*rcv_wnd > init_rcv_wnd * mss)) 235 *rcv_wnd = min(*rcv_wnd, init_rcv_wnd * mss);
236 *rcv_wnd = init_rcv_wnd * mss; 236 else
237 else if (*rcv_wnd > init_cwnd * mss) 237 *rcv_wnd = min(*rcv_wnd, init_cwnd * mss);
238 *rcv_wnd = init_cwnd * mss;
239 } 238 }
240 239
241 /* Set the clamp no higher than max representable value */ 240 /* Set the clamp no higher than max representable value */
@@ -386,27 +385,30 @@ struct tcp_out_options {
386 */ 385 */
387static u8 tcp_cookie_size_check(u8 desired) 386static u8 tcp_cookie_size_check(u8 desired)
388{ 387{
389 if (desired > 0) { 388 int cookie_size;
389
390 if (desired > 0)
390 /* previously specified */ 391 /* previously specified */
391 return desired; 392 return desired;
392 } 393
393 if (sysctl_tcp_cookie_size <= 0) { 394 cookie_size = ACCESS_ONCE(sysctl_tcp_cookie_size);
395 if (cookie_size <= 0)
394 /* no default specified */ 396 /* no default specified */
395 return 0; 397 return 0;
396 } 398
397 if (sysctl_tcp_cookie_size <= TCP_COOKIE_MIN) { 399 if (cookie_size <= TCP_COOKIE_MIN)
398 /* value too small, specify minimum */ 400 /* value too small, specify minimum */
399 return TCP_COOKIE_MIN; 401 return TCP_COOKIE_MIN;
400 } 402
401 if (sysctl_tcp_cookie_size >= TCP_COOKIE_MAX) { 403 if (cookie_size >= TCP_COOKIE_MAX)
402 /* value too large, specify maximum */ 404 /* value too large, specify maximum */
403 return TCP_COOKIE_MAX; 405 return TCP_COOKIE_MAX;
404 } 406
405 if (0x1 & sysctl_tcp_cookie_size) { 407 if (cookie_size & 1)
406 /* 8-bit multiple, illegal, fix it */ 408 /* 8-bit multiple, illegal, fix it */
407 return (u8)(sysctl_tcp_cookie_size + 0x1); 409 cookie_size++;
408 } 410
409 return (u8)sysctl_tcp_cookie_size; 411 return (u8)cookie_size;
410} 412}
411 413
412/* Write previously computed TCP options to the packet. 414/* Write previously computed TCP options to the packet.
@@ -1513,6 +1515,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
1513 struct tcp_sock *tp = tcp_sk(sk); 1515 struct tcp_sock *tp = tcp_sk(sk);
1514 const struct inet_connection_sock *icsk = inet_csk(sk); 1516 const struct inet_connection_sock *icsk = inet_csk(sk);
1515 u32 send_win, cong_win, limit, in_flight; 1517 u32 send_win, cong_win, limit, in_flight;
1518 int win_divisor;
1516 1519
1517 if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN) 1520 if (TCP_SKB_CB(skb)->flags & TCPHDR_FIN)
1518 goto send_now; 1521 goto send_now;
@@ -1544,13 +1547,14 @@ static int tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb)
1544 if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len)) 1547 if ((skb != tcp_write_queue_tail(sk)) && (limit >= skb->len))
1545 goto send_now; 1548 goto send_now;
1546 1549
1547 if (sysctl_tcp_tso_win_divisor) { 1550 win_divisor = ACCESS_ONCE(sysctl_tcp_tso_win_divisor);
1551 if (win_divisor) {
1548 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache); 1552 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
1549 1553
1550 /* If at least some fraction of a window is available, 1554 /* If at least some fraction of a window is available,
1551 * just use it. 1555 * just use it.
1552 */ 1556 */
1553 chunk /= sysctl_tcp_tso_win_divisor; 1557 chunk /= win_divisor;
1554 if (limit >= chunk) 1558 if (limit >= chunk)
1555 goto send_now; 1559 goto send_now;
1556 } else { 1560 } else {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index b41ce0f0d51..93b7a933a77 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -98,7 +98,11 @@
98#endif 98#endif
99 99
100#define INFINITY_LIFE_TIME 0xFFFFFFFF 100#define INFINITY_LIFE_TIME 0xFFFFFFFF
101#define TIME_DELTA(a, b) ((unsigned long)((long)(a) - (long)(b))) 101
102static inline u32 cstamp_delta(unsigned long cstamp)
103{
104 return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
105}
102 106
103#define ADDRCONF_TIMER_FUZZ_MINUS (HZ > 50 ? HZ/50 : 1) 107#define ADDRCONF_TIMER_FUZZ_MINUS (HZ > 50 ? HZ/50 : 1)
104#define ADDRCONF_TIMER_FUZZ (HZ / 4) 108#define ADDRCONF_TIMER_FUZZ (HZ / 4)
@@ -2754,13 +2758,13 @@ static int addrconf_ifdown(struct net_device *dev, int how)
2754 ifa->state = INET6_IFADDR_STATE_DEAD; 2758 ifa->state = INET6_IFADDR_STATE_DEAD;
2755 spin_unlock_bh(&ifa->state_lock); 2759 spin_unlock_bh(&ifa->state_lock);
2756 2760
2757 if (state == INET6_IFADDR_STATE_DEAD) { 2761 if (state != INET6_IFADDR_STATE_DEAD) {
2758 in6_ifa_put(ifa);
2759 } else {
2760 __ipv6_ifa_notify(RTM_DELADDR, ifa); 2762 __ipv6_ifa_notify(RTM_DELADDR, ifa);
2761 atomic_notifier_call_chain(&inet6addr_chain, 2763 atomic_notifier_call_chain(&inet6addr_chain,
2762 NETDEV_DOWN, ifa); 2764 NETDEV_DOWN, ifa);
2763 } 2765 }
2766
2767 in6_ifa_put(ifa);
2764 write_lock_bh(&idev->lock); 2768 write_lock_bh(&idev->lock);
2765 } 2769 }
2766 } 2770 }
@@ -3444,10 +3448,8 @@ static int put_cacheinfo(struct sk_buff *skb, unsigned long cstamp,
3444{ 3448{
3445 struct ifa_cacheinfo ci; 3449 struct ifa_cacheinfo ci;
3446 3450
3447 ci.cstamp = (u32)(TIME_DELTA(cstamp, INITIAL_JIFFIES) / HZ * 100 3451 ci.cstamp = cstamp_delta(cstamp);
3448 + TIME_DELTA(cstamp, INITIAL_JIFFIES) % HZ * 100 / HZ); 3452 ci.tstamp = cstamp_delta(tstamp);
3449 ci.tstamp = (u32)(TIME_DELTA(tstamp, INITIAL_JIFFIES) / HZ * 100
3450 + TIME_DELTA(tstamp, INITIAL_JIFFIES) % HZ * 100 / HZ);
3451 ci.ifa_prefered = preferred; 3453 ci.ifa_prefered = preferred;
3452 ci.ifa_valid = valid; 3454 ci.ifa_valid = valid;
3453 3455
@@ -3798,8 +3800,10 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
3798 array[DEVCONF_AUTOCONF] = cnf->autoconf; 3800 array[DEVCONF_AUTOCONF] = cnf->autoconf;
3799 array[DEVCONF_DAD_TRANSMITS] = cnf->dad_transmits; 3801 array[DEVCONF_DAD_TRANSMITS] = cnf->dad_transmits;
3800 array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits; 3802 array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits;
3801 array[DEVCONF_RTR_SOLICIT_INTERVAL] = cnf->rtr_solicit_interval; 3803 array[DEVCONF_RTR_SOLICIT_INTERVAL] =
3802 array[DEVCONF_RTR_SOLICIT_DELAY] = cnf->rtr_solicit_delay; 3804 jiffies_to_msecs(cnf->rtr_solicit_interval);
3805 array[DEVCONF_RTR_SOLICIT_DELAY] =
3806 jiffies_to_msecs(cnf->rtr_solicit_delay);
3803 array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version; 3807 array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
3804#ifdef CONFIG_IPV6_PRIVACY 3808#ifdef CONFIG_IPV6_PRIVACY
3805 array[DEVCONF_USE_TEMPADDR] = cnf->use_tempaddr; 3809 array[DEVCONF_USE_TEMPADDR] = cnf->use_tempaddr;
@@ -3813,7 +3817,8 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
3813 array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo; 3817 array[DEVCONF_ACCEPT_RA_PINFO] = cnf->accept_ra_pinfo;
3814#ifdef CONFIG_IPV6_ROUTER_PREF 3818#ifdef CONFIG_IPV6_ROUTER_PREF
3815 array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref; 3819 array[DEVCONF_ACCEPT_RA_RTR_PREF] = cnf->accept_ra_rtr_pref;
3816 array[DEVCONF_RTR_PROBE_INTERVAL] = cnf->rtr_probe_interval; 3820 array[DEVCONF_RTR_PROBE_INTERVAL] =
3821 jiffies_to_msecs(cnf->rtr_probe_interval);
3817#ifdef CONFIG_IPV6_ROUTE_INFO 3822#ifdef CONFIG_IPV6_ROUTE_INFO
3818 array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen; 3823 array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
3819#endif 3824#endif
@@ -3929,10 +3934,9 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
3929 NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags); 3934 NLA_PUT_U32(skb, IFLA_INET6_FLAGS, idev->if_flags);
3930 3935
3931 ci.max_reasm_len = IPV6_MAXPLEN; 3936 ci.max_reasm_len = IPV6_MAXPLEN;
3932 ci.tstamp = (__u32)(TIME_DELTA(idev->tstamp, INITIAL_JIFFIES) / HZ * 100 3937 ci.tstamp = cstamp_delta(idev->tstamp);
3933 + TIME_DELTA(idev->tstamp, INITIAL_JIFFIES) % HZ * 100 / HZ); 3938 ci.reachable_time = jiffies_to_msecs(idev->nd_parms->reachable_time);
3934 ci.reachable_time = idev->nd_parms->reachable_time; 3939 ci.retrans_time = jiffies_to_msecs(idev->nd_parms->retrans_time);
3935 ci.retrans_time = idev->nd_parms->retrans_time;
3936 NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci); 3940 NLA_PUT(skb, IFLA_INET6_CACHEINFO, sizeof(ci), &ci);
3937 3941
3938 nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32)); 3942 nla = nla_reserve(skb, IFLA_INET6_CONF, DEVCONF_MAX * sizeof(s32));
@@ -4017,11 +4021,11 @@ void inet6_ifinfo_notify(int event, struct inet6_dev *idev)
4017 kfree_skb(skb); 4021 kfree_skb(skb);
4018 goto errout; 4022 goto errout;
4019 } 4023 }
4020 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFADDR, NULL, GFP_ATOMIC); 4024 rtnl_notify(skb, net, 0, RTNLGRP_IPV6_IFINFO, NULL, GFP_ATOMIC);
4021 return; 4025 return;
4022errout: 4026errout:
4023 if (err < 0) 4027 if (err < 0)
4024 rtnl_set_sk_err(net, RTNLGRP_IPV6_IFADDR, err); 4028 rtnl_set_sk_err(net, RTNLGRP_IPV6_IFINFO, err);
4025} 4029}
4026 4030
4027static inline size_t inet6_prefix_nlmsg_size(void) 4031static inline size_t inet6_prefix_nlmsg_size(void)
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2a59610c2a5..70e891a20fb 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1175,6 +1175,8 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
1175 sizeof (struct ipv6hdr); 1175 sizeof (struct ipv6hdr);
1176 1176
1177 dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr); 1177 dev->mtu = rt->rt6i_dev->mtu - sizeof (struct ipv6hdr);
1178 if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1179 dev->mtu-=8;
1178 1180
1179 if (dev->mtu < IPV6_MIN_MTU) 1181 if (dev->mtu < IPV6_MIN_MTU)
1180 dev->mtu = IPV6_MIN_MTU; 1182 dev->mtu = IPV6_MIN_MTU;
@@ -1363,12 +1365,17 @@ static const struct net_device_ops ip6_tnl_netdev_ops = {
1363 1365
1364static void ip6_tnl_dev_setup(struct net_device *dev) 1366static void ip6_tnl_dev_setup(struct net_device *dev)
1365{ 1367{
1368 struct ip6_tnl *t;
1369
1366 dev->netdev_ops = &ip6_tnl_netdev_ops; 1370 dev->netdev_ops = &ip6_tnl_netdev_ops;
1367 dev->destructor = ip6_dev_free; 1371 dev->destructor = ip6_dev_free;
1368 1372
1369 dev->type = ARPHRD_TUNNEL6; 1373 dev->type = ARPHRD_TUNNEL6;
1370 dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr); 1374 dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
1371 dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr); 1375 dev->mtu = ETH_DATA_LEN - sizeof (struct ipv6hdr);
1376 t = netdev_priv(dev);
1377 if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
1378 dev->mtu-=8;
1372 dev->flags |= IFF_NOARP; 1379 dev->flags |= IFF_NOARP;
1373 dev->addr_len = sizeof(struct in6_addr); 1380 dev->addr_len = sizeof(struct in6_addr);
1374 dev->features |= NETIF_F_NETNS_LOCAL; 1381 dev->features |= NETIF_F_NETNS_LOCAL;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index d6bfaec3bbb..8c4d00c7cd2 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -606,8 +606,9 @@ static int ipip6_rcv(struct sk_buff *skb)
606 return 0; 606 return 0;
607 } 607 }
608 608
609 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0); 609 /* no tunnel matched, let upstream know, ipsec may handle it */
610 rcu_read_unlock(); 610 rcu_read_unlock();
611 return 1;
611out: 612out:
612 kfree_skb(skb); 613 kfree_skb(skb);
613 return 0; 614 return 0;
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index 7f097989cde..a6de3059746 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -45,7 +45,6 @@
45#include <linux/capability.h> 45#include <linux/capability.h>
46#include <linux/module.h> 46#include <linux/module.h>
47#include <linux/types.h> 47#include <linux/types.h>
48#include <linux/smp_lock.h>
49#include <linux/socket.h> 48#include <linux/socket.h>
50#include <linux/sockios.h> 49#include <linux/sockios.h>
51#include <linux/slab.h> 50#include <linux/slab.h>
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 7fa86373de4..7c567b8aa89 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -15,7 +15,6 @@
15 15
16#include <linux/sched.h> 16#include <linux/sched.h>
17#include <linux/slab.h> 17#include <linux/slab.h>
18#include <linux/smp_lock.h>
19#include "irnet_ppp.h" /* Private header */ 18#include "irnet_ppp.h" /* Private header */
20/* Please put other headers in irnet.h - Thanks */ 19/* Please put other headers in irnet.h - Thanks */
21 20
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index 285761e77d9..f6054f9ccbe 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -550,22 +550,30 @@ EXPORT_SYMBOL(irttp_close_tsap);
550 */ 550 */
551int irttp_udata_request(struct tsap_cb *self, struct sk_buff *skb) 551int irttp_udata_request(struct tsap_cb *self, struct sk_buff *skb)
552{ 552{
553 int ret;
554
553 IRDA_ASSERT(self != NULL, return -1;); 555 IRDA_ASSERT(self != NULL, return -1;);
554 IRDA_ASSERT(self->magic == TTP_TSAP_MAGIC, return -1;); 556 IRDA_ASSERT(self->magic == TTP_TSAP_MAGIC, return -1;);
555 IRDA_ASSERT(skb != NULL, return -1;); 557 IRDA_ASSERT(skb != NULL, return -1;);
556 558
557 IRDA_DEBUG(4, "%s()\n", __func__); 559 IRDA_DEBUG(4, "%s()\n", __func__);
558 560
561 /* Take shortcut on zero byte packets */
562 if (skb->len == 0) {
563 ret = 0;
564 goto err;
565 }
566
559 /* Check that nothing bad happens */ 567 /* Check that nothing bad happens */
560 if ((skb->len == 0) || (!self->connected)) { 568 if (!self->connected) {
561 IRDA_DEBUG(1, "%s(), No data, or not connected\n", 569 IRDA_WARNING("%s(), Not connected\n", __func__);
562 __func__); 570 ret = -ENOTCONN;
563 goto err; 571 goto err;
564 } 572 }
565 573
566 if (skb->len > self->max_seg_size) { 574 if (skb->len > self->max_seg_size) {
567 IRDA_DEBUG(1, "%s(), UData is too large for IrLAP!\n", 575 IRDA_ERROR("%s(), UData is too large for IrLAP!\n", __func__);
568 __func__); 576 ret = -EMSGSIZE;
569 goto err; 577 goto err;
570 } 578 }
571 579
@@ -576,7 +584,7 @@ int irttp_udata_request(struct tsap_cb *self, struct sk_buff *skb)
576 584
577err: 585err:
578 dev_kfree_skb(skb); 586 dev_kfree_skb(skb);
579 return -1; 587 return ret;
580} 588}
581EXPORT_SYMBOL(irttp_udata_request); 589EXPORT_SYMBOL(irttp_udata_request);
582 590
@@ -599,9 +607,15 @@ int irttp_data_request(struct tsap_cb *self, struct sk_buff *skb)
599 IRDA_DEBUG(2, "%s() : queue len = %d\n", __func__, 607 IRDA_DEBUG(2, "%s() : queue len = %d\n", __func__,
600 skb_queue_len(&self->tx_queue)); 608 skb_queue_len(&self->tx_queue));
601 609
610 /* Take shortcut on zero byte packets */
611 if (skb->len == 0) {
612 ret = 0;
613 goto err;
614 }
615
602 /* Check that nothing bad happens */ 616 /* Check that nothing bad happens */
603 if ((skb->len == 0) || (!self->connected)) { 617 if (!self->connected) {
604 IRDA_WARNING("%s: No data, or not connected\n", __func__); 618 IRDA_WARNING("%s: Not connected\n", __func__);
605 ret = -ENOTCONN; 619 ret = -ENOTCONN;
606 goto err; 620 goto err;
607 } 621 }
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 0bf6a59545a..522e219f355 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -674,4 +674,8 @@ MODULE_LICENSE("GPL");
674MODULE_AUTHOR("James Chapman <jchapman@katalix.com>"); 674MODULE_AUTHOR("James Chapman <jchapman@katalix.com>");
675MODULE_DESCRIPTION("L2TP over IP"); 675MODULE_DESCRIPTION("L2TP over IP");
676MODULE_VERSION("1.0"); 676MODULE_VERSION("1.0");
677MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, SOCK_DGRAM, IPPROTO_L2TP); 677
678/* Use the value of SOCK_DGRAM (2) directory, because __stringify does't like
679 * enums
680 */
681MODULE_ALIAS_NET_PF_PROTO_TYPE(PF_INET, 2, IPPROTO_L2TP);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 58261299821..e35dbe55f52 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -317,8 +317,9 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
317 goto out; 317 goto out;
318 rc = -ENODEV; 318 rc = -ENODEV;
319 rtnl_lock(); 319 rtnl_lock();
320 rcu_read_lock();
320 if (sk->sk_bound_dev_if) { 321 if (sk->sk_bound_dev_if) {
321 llc->dev = dev_get_by_index(&init_net, sk->sk_bound_dev_if); 322 llc->dev = dev_get_by_index_rcu(&init_net, sk->sk_bound_dev_if);
322 if (llc->dev) { 323 if (llc->dev) {
323 if (!addr->sllc_arphrd) 324 if (!addr->sllc_arphrd)
324 addr->sllc_arphrd = llc->dev->type; 325 addr->sllc_arphrd = llc->dev->type;
@@ -329,13 +330,13 @@ static int llc_ui_bind(struct socket *sock, struct sockaddr *uaddr, int addrlen)
329 !llc_mac_match(addr->sllc_mac, 330 !llc_mac_match(addr->sllc_mac,
330 llc->dev->dev_addr)) { 331 llc->dev->dev_addr)) {
331 rc = -EINVAL; 332 rc = -EINVAL;
332 dev_put(llc->dev);
333 llc->dev = NULL; 333 llc->dev = NULL;
334 } 334 }
335 } 335 }
336 } else 336 } else
337 llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd, 337 llc->dev = dev_getbyhwaddr(&init_net, addr->sllc_arphrd,
338 addr->sllc_mac); 338 addr->sllc_mac);
339 rcu_read_unlock();
339 rtnl_unlock(); 340 rtnl_unlock();
340 if (!llc->dev) 341 if (!llc->dev)
341 goto out; 342 goto out;
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 4d6f8653ec8..8e8ea9cb709 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -92,7 +92,7 @@ config MAC80211_MESH
92config MAC80211_LEDS 92config MAC80211_LEDS
93 bool "Enable LED triggers" 93 bool "Enable LED triggers"
94 depends on MAC80211 94 depends on MAC80211
95 select NEW_LEDS 95 depends on LEDS_CLASS
96 select LEDS_TRIGGERS 96 select LEDS_TRIGGERS
97 ---help--- 97 ---help---
98 This option enables a few LED triggers for different 98 This option enables a few LED triggers for different
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 902b03ee8f6..54fb4a0e76f 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2247,6 +2247,10 @@ ieee80211_rx_h_mgmt(struct ieee80211_rx_data *rx)
2247 break; 2247 break;
2248 case cpu_to_le16(IEEE80211_STYPE_DEAUTH): 2248 case cpu_to_le16(IEEE80211_STYPE_DEAUTH):
2249 case cpu_to_le16(IEEE80211_STYPE_DISASSOC): 2249 case cpu_to_le16(IEEE80211_STYPE_DISASSOC):
2250 if (is_multicast_ether_addr(mgmt->da) &&
2251 !is_broadcast_ether_addr(mgmt->da))
2252 return RX_DROP_MONITOR;
2253
2250 /* process only for station */ 2254 /* process only for station */
2251 if (sdata->vif.type != NL80211_IFTYPE_STATION) 2255 if (sdata->vif.type != NL80211_IFTYPE_STATION)
2252 return RX_DROP_MONITOR; 2256 return RX_DROP_MONITOR;
@@ -2741,6 +2745,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2741 2745
2742 if (ieee80211_prepare_and_rx_handle(&rx, skb, true)) 2746 if (ieee80211_prepare_and_rx_handle(&rx, skb, true))
2743 return; 2747 return;
2748 goto out;
2744 } 2749 }
2745 } 2750 }
2746 2751
@@ -2780,6 +2785,7 @@ static void __ieee80211_rx_handle_packet(struct ieee80211_hw *hw,
2780 return; 2785 return;
2781 } 2786 }
2782 2787
2788 out:
2783 dev_kfree_skb(skb); 2789 dev_kfree_skb(skb);
2784} 2790}
2785 2791
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 96c59430950..7a637b80a62 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1587,7 +1587,12 @@ static void ieee80211_xmit(struct ieee80211_sub_if_data *sdata,
1587 list) { 1587 list) {
1588 if (!ieee80211_sdata_running(tmp_sdata)) 1588 if (!ieee80211_sdata_running(tmp_sdata))
1589 continue; 1589 continue;
1590 if (tmp_sdata->vif.type != NL80211_IFTYPE_AP) 1590 if (tmp_sdata->vif.type ==
1591 NL80211_IFTYPE_MONITOR ||
1592 tmp_sdata->vif.type ==
1593 NL80211_IFTYPE_AP_VLAN ||
1594 tmp_sdata->vif.type ==
1595 NL80211_IFTYPE_WDS)
1591 continue; 1596 continue;
1592 if (compare_ether_addr(tmp_sdata->vif.addr, 1597 if (compare_ether_addr(tmp_sdata->vif.addr,
1593 hdr->addr2) == 0) { 1598 hdr->addr2) == 0) {
@@ -1732,15 +1737,13 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
1732 int nh_pos, h_pos; 1737 int nh_pos, h_pos;
1733 struct sta_info *sta = NULL; 1738 struct sta_info *sta = NULL;
1734 u32 sta_flags = 0; 1739 u32 sta_flags = 0;
1740 struct sk_buff *tmp_skb;
1735 1741
1736 if (unlikely(skb->len < ETH_HLEN)) { 1742 if (unlikely(skb->len < ETH_HLEN)) {
1737 ret = NETDEV_TX_OK; 1743 ret = NETDEV_TX_OK;
1738 goto fail; 1744 goto fail;
1739 } 1745 }
1740 1746
1741 nh_pos = skb_network_header(skb) - skb->data;
1742 h_pos = skb_transport_header(skb) - skb->data;
1743
1744 /* convert Ethernet header to proper 802.11 header (based on 1747 /* convert Ethernet header to proper 802.11 header (based on
1745 * operation mode) */ 1748 * operation mode) */
1746 ethertype = (skb->data[12] << 8) | skb->data[13]; 1749 ethertype = (skb->data[12] << 8) | skb->data[13];
@@ -1913,6 +1916,20 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
1913 goto fail; 1916 goto fail;
1914 } 1917 }
1915 1918
1919 /*
1920 * If the skb is shared we need to obtain our own copy.
1921 */
1922 if (skb_shared(skb)) {
1923 tmp_skb = skb;
1924 skb = skb_copy(skb, GFP_ATOMIC);
1925 kfree_skb(tmp_skb);
1926
1927 if (!skb) {
1928 ret = NETDEV_TX_OK;
1929 goto fail;
1930 }
1931 }
1932
1916 hdr.frame_control = fc; 1933 hdr.frame_control = fc;
1917 hdr.duration_id = 0; 1934 hdr.duration_id = 0;
1918 hdr.seq_ctrl = 0; 1935 hdr.seq_ctrl = 0;
@@ -1931,6 +1948,9 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
1931 encaps_len = 0; 1948 encaps_len = 0;
1932 } 1949 }
1933 1950
1951 nh_pos = skb_network_header(skb) - skb->data;
1952 h_pos = skb_transport_header(skb) - skb->data;
1953
1934 skb_pull(skb, skip_header_bytes); 1954 skb_pull(skb, skip_header_bytes);
1935 nh_pos -= skip_header_bytes; 1955 nh_pos -= skip_header_bytes;
1936 h_pos -= skip_header_bytes; 1956 h_pos -= skip_header_bytes;
diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
index a22dac22705..70bd1d0774c 100644
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -4,6 +4,7 @@
4menuconfig IP_VS 4menuconfig IP_VS
5 tristate "IP virtual server support" 5 tristate "IP virtual server support"
6 depends on NET && INET && NETFILTER 6 depends on NET && INET && NETFILTER
7 depends on (NF_CONNTRACK || NF_CONNTRACK=n)
7 ---help--- 8 ---help---
8 IP Virtual Server support will let you build a high-performance 9 IP Virtual Server support will let you build a high-performance
9 virtual server based on cluster of two or more real servers. This 10 virtual server based on cluster of two or more real servers. This
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 8920f2a8332..4e37c1cbe8b 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -567,7 +567,7 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
567 goto out; 567 goto out;
568 } 568 }
569 569
570 if (args->nr_local > (u64)UINT_MAX) { 570 if (args->nr_local > UIO_MAXIOV) {
571 ret = -EMSGSIZE; 571 ret = -EMSGSIZE;
572 goto out; 572 goto out;
573 } 573 }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 6bd554323a3..0b9ee34ad35 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2932,6 +2932,7 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
2932 struct sctp_association *asoc = NULL; 2932 struct sctp_association *asoc = NULL;
2933 struct sctp_setpeerprim prim; 2933 struct sctp_setpeerprim prim;
2934 struct sctp_chunk *chunk; 2934 struct sctp_chunk *chunk;
2935 struct sctp_af *af;
2935 int err; 2936 int err;
2936 2937
2937 sp = sctp_sk(sk); 2938 sp = sctp_sk(sk);
@@ -2959,6 +2960,13 @@ static int sctp_setsockopt_peer_primary_addr(struct sock *sk, char __user *optva
2959 if (!sctp_state(asoc, ESTABLISHED)) 2960 if (!sctp_state(asoc, ESTABLISHED))
2960 return -ENOTCONN; 2961 return -ENOTCONN;
2961 2962
2963 af = sctp_get_af_specific(prim.sspp_addr.ss_family);
2964 if (!af)
2965 return -EINVAL;
2966
2967 if (!af->addr_valid((union sctp_addr *)&prim.sspp_addr, sp, NULL))
2968 return -EADDRNOTAVAIL;
2969
2962 if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr)) 2970 if (!sctp_assoc_lookup_laddr(asoc, (union sctp_addr *)&prim.sspp_addr))
2963 return -EADDRNOTAVAIL; 2971 return -EADDRNOTAVAIL;
2964 2972
diff --git a/net/socket.c b/net/socket.c
index 3ca2fd9e372..088fb3fd45e 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -732,6 +732,21 @@ static int sock_recvmsg_nosec(struct socket *sock, struct msghdr *msg,
732 return ret; 732 return ret;
733} 733}
734 734
735/**
736 * kernel_recvmsg - Receive a message from a socket (kernel space)
737 * @sock: The socket to receive the message from
738 * @msg: Received message
739 * @vec: Input s/g array for message data
740 * @num: Size of input s/g array
741 * @size: Number of bytes to read
742 * @flags: Message flags (MSG_DONTWAIT, etc...)
743 *
744 * On return the msg structure contains the scatter/gather array passed in the
745 * vec argument. The array is modified so that it consists of the unfilled
746 * portion of the original array.
747 *
748 * The returned value is the total number of bytes received, or an error.
749 */
735int kernel_recvmsg(struct socket *sock, struct msghdr *msg, 750int kernel_recvmsg(struct socket *sock, struct msghdr *msg,
736 struct kvec *vec, size_t num, size_t size, int flags) 751 struct kvec *vec, size_t num, size_t size, int flags)
737{ 752{
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 9dab9573be4..92ce94f5146 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -989,20 +989,26 @@ call_refreshresult(struct rpc_task *task)
989 dprint_status(task); 989 dprint_status(task);
990 990
991 task->tk_status = 0; 991 task->tk_status = 0;
992 task->tk_action = call_allocate; 992 task->tk_action = call_refresh;
993 if (status >= 0 && rpcauth_uptodatecred(task))
994 return;
995 switch (status) { 993 switch (status) {
996 case -EACCES: 994 case 0:
997 rpc_exit(task, -EACCES); 995 if (rpcauth_uptodatecred(task))
998 return; 996 task->tk_action = call_allocate;
999 case -ENOMEM:
1000 rpc_exit(task, -ENOMEM);
1001 return; 997 return;
1002 case -ETIMEDOUT: 998 case -ETIMEDOUT:
1003 rpc_delay(task, 3*HZ); 999 rpc_delay(task, 3*HZ);
1000 case -EAGAIN:
1001 status = -EACCES;
1002 if (!task->tk_cred_retry)
1003 break;
1004 task->tk_cred_retry--;
1005 dprintk("RPC: %5u %s: retry refresh creds\n",
1006 task->tk_pid, __func__);
1007 return;
1004 } 1008 }
1005 task->tk_action = call_refresh; 1009 dprintk("RPC: %5u %s: refresh creds failed with error %d\n",
1010 task->tk_pid, __func__, status);
1011 rpc_exit(task, status);
1006} 1012}
1007 1013
1008/* 1014/*
diff --git a/net/sunrpc/stats.c b/net/sunrpc/stats.c
index f71a73107ae..80df89d957b 100644
--- a/net/sunrpc/stats.c
+++ b/net/sunrpc/stats.c
@@ -115,9 +115,7 @@ EXPORT_SYMBOL_GPL(svc_seq_show);
115 */ 115 */
116struct rpc_iostats *rpc_alloc_iostats(struct rpc_clnt *clnt) 116struct rpc_iostats *rpc_alloc_iostats(struct rpc_clnt *clnt)
117{ 117{
118 struct rpc_iostats *new; 118 return kcalloc(clnt->cl_maxproc, sizeof(struct rpc_iostats), GFP_KERNEL);
119 new = kcalloc(clnt->cl_maxproc, sizeof(struct rpc_iostats), GFP_KERNEL);
120 return new;
121} 119}
122EXPORT_SYMBOL_GPL(rpc_alloc_iostats); 120EXPORT_SYMBOL_GPL(rpc_alloc_iostats);
123 121
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index b6f47da170b..5a75d23645c 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -5,7 +5,6 @@
5 */ 5 */
6 6
7#include <linux/sched.h> 7#include <linux/sched.h>
8#include <linux/smp_lock.h>
9#include <linux/errno.h> 8#include <linux/errno.h>
10#include <linux/freezer.h> 9#include <linux/freezer.h>
11#include <linux/kthread.h> 10#include <linux/kthread.h>
@@ -213,6 +212,7 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
213 spin_lock(&svc_xprt_class_lock); 212 spin_lock(&svc_xprt_class_lock);
214 list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) { 213 list_for_each_entry(xcl, &svc_xprt_class_list, xcl_list) {
215 struct svc_xprt *newxprt; 214 struct svc_xprt *newxprt;
215 unsigned short newport;
216 216
217 if (strcmp(xprt_name, xcl->xcl_name)) 217 if (strcmp(xprt_name, xcl->xcl_name))
218 continue; 218 continue;
@@ -231,8 +231,9 @@ int svc_create_xprt(struct svc_serv *serv, const char *xprt_name,
231 spin_lock_bh(&serv->sv_lock); 231 spin_lock_bh(&serv->sv_lock);
232 list_add(&newxprt->xpt_list, &serv->sv_permsocks); 232 list_add(&newxprt->xpt_list, &serv->sv_permsocks);
233 spin_unlock_bh(&serv->sv_lock); 233 spin_unlock_bh(&serv->sv_lock);
234 newport = svc_xprt_local_port(newxprt);
234 clear_bit(XPT_BUSY, &newxprt->xpt_flags); 235 clear_bit(XPT_BUSY, &newxprt->xpt_flags);
235 return svc_xprt_local_port(newxprt); 236 return newport;
236 } 237 }
237 err: 238 err:
238 spin_unlock(&svc_xprt_class_lock); 239 spin_unlock(&svc_xprt_class_lock);
@@ -415,8 +416,13 @@ void svc_xprt_received(struct svc_xprt *xprt)
415{ 416{
416 BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags)); 417 BUG_ON(!test_bit(XPT_BUSY, &xprt->xpt_flags));
417 xprt->xpt_pool = NULL; 418 xprt->xpt_pool = NULL;
419 /* As soon as we clear busy, the xprt could be closed and
420 * 'put', so we need a reference to call svc_xprt_enqueue with:
421 */
422 svc_xprt_get(xprt);
418 clear_bit(XPT_BUSY, &xprt->xpt_flags); 423 clear_bit(XPT_BUSY, &xprt->xpt_flags);
419 svc_xprt_enqueue(xprt); 424 svc_xprt_enqueue(xprt);
425 svc_xprt_put(xprt);
420} 426}
421EXPORT_SYMBOL_GPL(svc_xprt_received); 427EXPORT_SYMBOL_GPL(svc_xprt_received);
422 428
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 3c95304a081..2268e679812 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1343,9 +1343,25 @@ static void unix_destruct_scm(struct sk_buff *skb)
1343 sock_wfree(skb); 1343 sock_wfree(skb);
1344} 1344}
1345 1345
1346#define MAX_RECURSION_LEVEL 4
1347
1346static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb) 1348static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1347{ 1349{
1348 int i; 1350 int i;
1351 unsigned char max_level = 0;
1352 int unix_sock_count = 0;
1353
1354 for (i = scm->fp->count - 1; i >= 0; i--) {
1355 struct sock *sk = unix_get_socket(scm->fp->fp[i]);
1356
1357 if (sk) {
1358 unix_sock_count++;
1359 max_level = max(max_level,
1360 unix_sk(sk)->recursion_level);
1361 }
1362 }
1363 if (unlikely(max_level > MAX_RECURSION_LEVEL))
1364 return -ETOOMANYREFS;
1349 1365
1350 /* 1366 /*
1351 * Need to duplicate file references for the sake of garbage 1367 * Need to duplicate file references for the sake of garbage
@@ -1356,9 +1372,11 @@ static int unix_attach_fds(struct scm_cookie *scm, struct sk_buff *skb)
1356 if (!UNIXCB(skb).fp) 1372 if (!UNIXCB(skb).fp)
1357 return -ENOMEM; 1373 return -ENOMEM;
1358 1374
1359 for (i = scm->fp->count-1; i >= 0; i--) 1375 if (unix_sock_count) {
1360 unix_inflight(scm->fp->fp[i]); 1376 for (i = scm->fp->count - 1; i >= 0; i--)
1361 return 0; 1377 unix_inflight(scm->fp->fp[i]);
1378 }
1379 return max_level;
1362} 1380}
1363 1381
1364static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds) 1382static int unix_scm_to_skb(struct scm_cookie *scm, struct sk_buff *skb, bool send_fds)
@@ -1393,6 +1411,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
1393 struct sk_buff *skb; 1411 struct sk_buff *skb;
1394 long timeo; 1412 long timeo;
1395 struct scm_cookie tmp_scm; 1413 struct scm_cookie tmp_scm;
1414 int max_level;
1396 1415
1397 if (NULL == siocb->scm) 1416 if (NULL == siocb->scm)
1398 siocb->scm = &tmp_scm; 1417 siocb->scm = &tmp_scm;
@@ -1431,8 +1450,9 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
1431 goto out; 1450 goto out;
1432 1451
1433 err = unix_scm_to_skb(siocb->scm, skb, true); 1452 err = unix_scm_to_skb(siocb->scm, skb, true);
1434 if (err) 1453 if (err < 0)
1435 goto out_free; 1454 goto out_free;
1455 max_level = err + 1;
1436 unix_get_secdata(siocb->scm, skb); 1456 unix_get_secdata(siocb->scm, skb);
1437 1457
1438 skb_reset_transport_header(skb); 1458 skb_reset_transport_header(skb);
@@ -1514,6 +1534,8 @@ restart:
1514 if (sock_flag(other, SOCK_RCVTSTAMP)) 1534 if (sock_flag(other, SOCK_RCVTSTAMP))
1515 __net_timestamp(skb); 1535 __net_timestamp(skb);
1516 skb_queue_tail(&other->sk_receive_queue, skb); 1536 skb_queue_tail(&other->sk_receive_queue, skb);
1537 if (max_level > unix_sk(other)->recursion_level)
1538 unix_sk(other)->recursion_level = max_level;
1517 unix_state_unlock(other); 1539 unix_state_unlock(other);
1518 other->sk_data_ready(other, len); 1540 other->sk_data_ready(other, len);
1519 sock_put(other); 1541 sock_put(other);
@@ -1544,6 +1566,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
1544 int sent = 0; 1566 int sent = 0;
1545 struct scm_cookie tmp_scm; 1567 struct scm_cookie tmp_scm;
1546 bool fds_sent = false; 1568 bool fds_sent = false;
1569 int max_level;
1547 1570
1548 if (NULL == siocb->scm) 1571 if (NULL == siocb->scm)
1549 siocb->scm = &tmp_scm; 1572 siocb->scm = &tmp_scm;
@@ -1607,10 +1630,11 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
1607 1630
1608 /* Only send the fds in the first buffer */ 1631 /* Only send the fds in the first buffer */
1609 err = unix_scm_to_skb(siocb->scm, skb, !fds_sent); 1632 err = unix_scm_to_skb(siocb->scm, skb, !fds_sent);
1610 if (err) { 1633 if (err < 0) {
1611 kfree_skb(skb); 1634 kfree_skb(skb);
1612 goto out_err; 1635 goto out_err;
1613 } 1636 }
1637 max_level = err + 1;
1614 fds_sent = true; 1638 fds_sent = true;
1615 1639
1616 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size); 1640 err = memcpy_fromiovec(skb_put(skb, size), msg->msg_iov, size);
@@ -1626,6 +1650,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
1626 goto pipe_err_free; 1650 goto pipe_err_free;
1627 1651
1628 skb_queue_tail(&other->sk_receive_queue, skb); 1652 skb_queue_tail(&other->sk_receive_queue, skb);
1653 if (max_level > unix_sk(other)->recursion_level)
1654 unix_sk(other)->recursion_level = max_level;
1629 unix_state_unlock(other); 1655 unix_state_unlock(other);
1630 other->sk_data_ready(other, size); 1656 other->sk_data_ready(other, size);
1631 sent += size; 1657 sent += size;
@@ -1845,6 +1871,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
1845 unix_state_lock(sk); 1871 unix_state_lock(sk);
1846 skb = skb_dequeue(&sk->sk_receive_queue); 1872 skb = skb_dequeue(&sk->sk_receive_queue);
1847 if (skb == NULL) { 1873 if (skb == NULL) {
1874 unix_sk(sk)->recursion_level = 0;
1848 if (copied >= target) 1875 if (copied >= target)
1849 goto unlock; 1876 goto unlock;
1850 1877
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index c8df6fda0b1..f89f83bf828 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -96,7 +96,7 @@ static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
96unsigned int unix_tot_inflight; 96unsigned int unix_tot_inflight;
97 97
98 98
99static struct sock *unix_get_socket(struct file *filp) 99struct sock *unix_get_socket(struct file *filp)
100{ 100{
101 struct sock *u_sock = NULL; 101 struct sock *u_sock = NULL;
102 struct inode *inode = filp->f_path.dentry->d_inode; 102 struct inode *inode = filp->f_path.dentry->d_inode;
@@ -259,9 +259,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
259} 259}
260 260
261static bool gc_in_progress = false; 261static bool gc_in_progress = false;
262#define UNIX_INFLIGHT_TRIGGER_GC 16000
262 263
263void wait_for_unix_gc(void) 264void wait_for_unix_gc(void)
264{ 265{
266 /*
267 * If number of inflight sockets is insane,
268 * force a garbage collect right now.
269 */
270 if (unix_tot_inflight > UNIX_INFLIGHT_TRIGGER_GC && !gc_in_progress)
271 unix_gc();
265 wait_event(unix_gc_wait, gc_in_progress == false); 272 wait_event(unix_gc_wait, gc_in_progress == false);
266} 273}
267 274
diff --git a/net/wireless/chan.c b/net/wireless/chan.c
index d0c92dddb26..17cd0c04d13 100644
--- a/net/wireless/chan.c
+++ b/net/wireless/chan.c
@@ -44,6 +44,38 @@ rdev_freq_to_chan(struct cfg80211_registered_device *rdev,
44 return chan; 44 return chan;
45} 45}
46 46
47static bool can_beacon_sec_chan(struct wiphy *wiphy,
48 struct ieee80211_channel *chan,
49 enum nl80211_channel_type channel_type)
50{
51 struct ieee80211_channel *sec_chan;
52 int diff;
53
54 switch (channel_type) {
55 case NL80211_CHAN_HT40PLUS:
56 diff = 20;
57 break;
58 case NL80211_CHAN_HT40MINUS:
59 diff = -20;
60 break;
61 default:
62 return false;
63 }
64
65 sec_chan = ieee80211_get_channel(wiphy, chan->center_freq + diff);
66 if (!sec_chan)
67 return false;
68
69 /* we'll need a DFS capability later */
70 if (sec_chan->flags & (IEEE80211_CHAN_DISABLED |
71 IEEE80211_CHAN_PASSIVE_SCAN |
72 IEEE80211_CHAN_NO_IBSS |
73 IEEE80211_CHAN_RADAR))
74 return false;
75
76 return true;
77}
78
47int cfg80211_set_freq(struct cfg80211_registered_device *rdev, 79int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
48 struct wireless_dev *wdev, int freq, 80 struct wireless_dev *wdev, int freq,
49 enum nl80211_channel_type channel_type) 81 enum nl80211_channel_type channel_type)
@@ -68,6 +100,28 @@ int cfg80211_set_freq(struct cfg80211_registered_device *rdev,
68 if (!chan) 100 if (!chan)
69 return -EINVAL; 101 return -EINVAL;
70 102
103 /* Both channels should be able to initiate communication */
104 if (wdev && (wdev->iftype == NL80211_IFTYPE_ADHOC ||
105 wdev->iftype == NL80211_IFTYPE_AP ||
106 wdev->iftype == NL80211_IFTYPE_AP_VLAN ||
107 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
108 wdev->iftype == NL80211_IFTYPE_P2P_GO)) {
109 switch (channel_type) {
110 case NL80211_CHAN_HT40PLUS:
111 case NL80211_CHAN_HT40MINUS:
112 if (!can_beacon_sec_chan(&rdev->wiphy, chan,
113 channel_type)) {
114 printk(KERN_DEBUG
115 "cfg80211: Secondary channel not "
116 "allowed to initiate communication\n");
117 return -EINVAL;
118 }
119 break;
120 default:
121 break;
122 }
123 }
124
71 result = rdev->ops->set_channel(&rdev->wiphy, 125 result = rdev->ops->set_channel(&rdev->wiphy,
72 wdev ? wdev->netdev : NULL, 126 wdev ? wdev->netdev : NULL,
73 chan, channel_type); 127 chan, channel_type);
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index 73e7b954ad2..b25c6463c3e 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -394,6 +394,7 @@ void __exit x25_link_free(void)
394 list_for_each_safe(entry, tmp, &x25_neigh_list) { 394 list_for_each_safe(entry, tmp, &x25_neigh_list) {
395 nb = list_entry(entry, struct x25_neigh, node); 395 nb = list_entry(entry, struct x25_neigh, node);
396 __x25_remove_neigh(nb); 396 __x25_remove_neigh(nb);
397 dev_put(nb->dev);
397 } 398 }
398 write_unlock_bh(&x25_neigh_list_lock); 399 write_unlock_bh(&x25_neigh_list_lock);
399} 400}
diff --git a/net/xfrm/xfrm_hash.c b/net/xfrm/xfrm_hash.c
index a2023ec5232..1e98bc0fe0a 100644
--- a/net/xfrm/xfrm_hash.c
+++ b/net/xfrm/xfrm_hash.c
@@ -19,7 +19,7 @@ struct hlist_head *xfrm_hash_alloc(unsigned int sz)
19 if (sz <= PAGE_SIZE) 19 if (sz <= PAGE_SIZE)
20 n = kzalloc(sz, GFP_KERNEL); 20 n = kzalloc(sz, GFP_KERNEL);
21 else if (hashdist) 21 else if (hashdist)
22 n = __vmalloc(sz, GFP_KERNEL | __GFP_ZERO, PAGE_KERNEL); 22 n = vzalloc(sz);
23 else 23 else
24 n = (struct hlist_head *) 24 n = (struct hlist_head *)
25 __get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO, 25 __get_free_pages(GFP_KERNEL | __GFP_NOWARN | __GFP_ZERO,
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index eb96ce52f17..220ebc05c7a 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -1268,7 +1268,7 @@ struct xfrm_state * xfrm_state_migrate(struct xfrm_state *x,
1268 1268
1269 return xc; 1269 return xc;
1270error: 1270error:
1271 kfree(xc); 1271 xfrm_state_put(xc);
1272 return NULL; 1272 return NULL;
1273} 1273}
1274EXPORT_SYMBOL(xfrm_state_migrate); 1274EXPORT_SYMBOL(xfrm_state_migrate);
generated by cgit v1.2.2 (git 2.25.0) at 2026-04-19 03:45:25 -0400