Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) ping_err() ICMP error handler looks at wrong ICMP header, from Li
    Wei.

 2) TCP socket hash function on ipv6 is too weak, from Eric Dumazet.

 3) netif_set_xps_queue() forgets to drop mutex on errors, fix from
    Alexander Duyck.

 4) sum_frag_mem_limit() can deadlock due to lack of BH disabling, fix
    from Eric Dumazet.

 5) TCP SYN data is miscalculated in tcp_send_syn_data(), because the
    amount of TCP option space was not taken into account properly in
    this code path.  Fix from yuchung Cheng.

 6) MLX4 driver allocates device queues with the wrong size, from Kleber
    Sacilotto.

 7) sock_diag can access past the end of the sock_diag_handlers[] array,
    from Mathias Krause.

 8) vlan_set_encap_proto() makes incorrect assumptions about where
    skb->data points, rework the logic so that it works regardless of
    where skb->data happens to be.  From Jesse Gross.

 9) Fix gianfar build failure with NET_POLL enabled, from Paul
    Gortmaker.

10) Fix Ipv4 ID setting and checksum calculations in GRE driver, from
   Pravin B Shelar.

11) bgmac driver does:

        int i;

        for (i = 0; ...; ...) {
                ...
                for (i = 0; ...; ...) {

    effectively corrupting the outer loop index, use a seperate
    variable for the inner loops.  From Rafał Miłecki.

12) Fix suspend bugs in smsc95xx driver, from Ming Lei.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (35 commits)
  usbnet: smsc95xx: rename FEATURE_AUTOSUSPEND
  usbnet: smsc95xx: fix broken runtime suspend
  usbnet: smsc95xx: fix suspend failure
  bgmac: fix indexing of 2nd level loops
  b43: Fix lockdep splat on module unload
  Revert "ip_gre: propogate target device GSO capability to the tunnel device"
  IP_GRE: Fix GRE_CSUM case.
  VXLAN: Use tunnel_ip_select_ident() for tunnel IP-Identification.
  IP_GRE: Fix IP-Identification.
  net/pasemi: Fix missing coding style
  vmxnet3: fix ethtool ring buffer size setting
  vmxnet3: make local function static
  bnx2x: remove dead code and make local funcs static
  gianfar: fix compile fail for NET_POLL=y due to struct packing
  vlan: adjust vlan_set_encap_proto() for its callers
  sock_diag: Simplify sock_diag_handlers[] handling in __sock_diag_rcv_msg
  sock_diag: Fix out-of-bounds access to sock_diag_handlers[]
  vxlan: remove depends on CONFIG_EXPERIMENTAL
  mlx4_en: fix allocation of CPU affinity reverse-map
  mlx4_en: fix allocation of device tx_cq
  ...

7 files changed, 45 insertions, 8 deletions

diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
index d06cc5c8f58c..218a3b686d90 100644
--- a/include/linux/if_vlan.h
+++ b/include/linux/if_vlan.h
@@ -331,7 +331,7 @@ static inline void vlan_set_encap_proto(struct sk_buff *skb,
                                         struct vlan_hdr *vhdr)
 {
         __be16 proto;
-        unsigned char *rawp;
+        unsigned short *rawp;
 
         /*
          * Was a VLAN packet, grab the encapsulated protocol, which the layer
@@ -344,8 +344,8 @@ static inline void vlan_set_encap_proto(struct sk_buff *skb,
                 return;
         }
 
-        rawp = skb->data;
-        if (*(unsigned short *) rawp == 0xFFFF)
+        rawp = (unsigned short *)(vhdr + 1);
+        if (*rawp == 0xFFFF)
                 /*
                  * This is a magic hack to spot IPX packets. Older Novell
                  * breaks the protocol design and runs IPX over 802.3 without
diff --git a/include/net/icmp.h b/include/net/icmp.h
index 9ac2524d1402..081439fd070e 100644
--- a/include/net/icmp.h
+++ b/include/net/icmp.h
@@ -41,6 +41,7 @@ struct net;
 
 extern void     icmp_send(struct sk_buff *skb_in,  int type, int code, __be32 info);
 extern int      icmp_rcv(struct sk_buff *skb);
+extern void     icmp_err(struct sk_buff *, u32 info);
 extern int      icmp_init(void);
 extern void     icmp_out_count(struct net *net, unsigned char type);
 
diff --git a/include/net/inet6_hashtables.h b/include/net/inet6_hashtables.h
index 7ca75cbbf75e..fd4ee016ba5c 100644
--- a/include/net/inet6_hashtables.h
+++ b/include/net/inet6_hashtables.h
@@ -28,16 +28,16 @@
 
 struct inet_hashinfo;
 
-/* I have no idea if this is a good hash for v6 or not. -DaveM */
 static inline unsigned int inet6_ehashfn(struct net *net,
                                 const struct in6_addr *laddr, const u16 lport,
                                 const struct in6_addr *faddr, const __be16 fport)
 {
-        u32 ports = (lport ^ (__force u16)fport);
+        u32 ports = (((u32)lport) << 16) | (__force u32)fport;
 
         return jhash_3words((__force u32)laddr->s6_addr32[3],
-                            (__force u32)faddr->s6_addr32[3],
-                            ports, inet_ehash_secret + net_hash_mix(net));
+                            ipv6_addr_jhash(faddr),
+                            ports,
+                            inet_ehash_secret + net_hash_mix(net));
 }
 
 static inline int inet6_sk_ehashfn(const struct sock *sk)
diff --git a/include/net/inet_frag.h b/include/net/inet_frag.h
index 3f237db0a426..76c3fe5ecc2e 100644
--- a/include/net/inet_frag.h
+++ b/include/net/inet_frag.h
@@ -114,7 +114,13 @@ static inline void init_frag_mem_limit(struct netns_frags *nf)
 
 static inline int sum_frag_mem_limit(struct netns_frags *nf)
 {
-        return percpu_counter_sum_positive(&nf->mem);
+        int res;
+
+        local_bh_disable();
+        res = percpu_counter_sum_positive(&nf->mem);
+        local_bh_enable();
+
+        return res;
 }
 
 static inline void inet_frag_lru_move(struct inet_frag_queue *q)
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a4196cbc84ec..7235ae73a1e8 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -203,6 +203,7 @@ static inline void inet_sk_copy_descendant(struct sock *sk_to,
 extern int inet_sk_rebuild_header(struct sock *sk);
 
 extern u32 inet_ehash_secret;
+extern u32 ipv6_hash_secret;
 extern void build_ehash_secret(void);
 
 static inline unsigned int inet_ehashfn(struct net *net,
diff --git a/include/net/ipip.h b/include/net/ipip.h
index 21947cf4fa46..fd19625ff99d 100644
--- a/include/net/ipip.h
+++ b/include/net/ipip.h
@@ -71,4 +71,21 @@ static inline void iptunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         }
 }
 
+static inline void tunnel_ip_select_ident(struct sk_buff *skb,
+                                          const struct iphdr  *old_iph,
+                                          struct dst_entry *dst)
+{
+        struct iphdr *iph = ip_hdr(skb);
+
+        if (iph->frag_off & htons(IP_DF))
+                iph->id = 0;
+        else {
+                /* Use inner packet iph-id if possible. */
+                if (skb->protocol == htons(ETH_P_IP) && old_iph->id)
+                        iph->id = old_iph->id;
+                else
+                        __ip_select_ident(iph, dst,
+                                          (skb_shinfo(skb)->gso_segs ?: 1) - 1);
+        }
+}
 #endif
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 851d5412a299..64d12e77719a 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -15,6 +15,7 @@
 
 #include <linux/ipv6.h>
 #include <linux/hardirq.h>
+#include <linux/jhash.h>
 #include <net/if_inet6.h>
 #include <net/ndisc.h>
 #include <net/flow.h>
@@ -514,6 +515,17 @@ static inline u32 ipv6_addr_hash(const struct in6_addr *a)
 #endif
 }
 
+/* more secured version of ipv6_addr_hash() */
+static inline u32 ipv6_addr_jhash(const struct in6_addr *a)
+{
+        u32 v = (__force u32)a->s6_addr32[0] ^ (__force u32)a->s6_addr32[1];
+
+        return jhash_3words(v,
+                            (__force u32)a->s6_addr32[2],
+                            (__force u32)a->s6_addr32[3],
+                            ipv6_hash_secret);
+}
+
 static inline bool ipv6_addr_loopback(const struct in6_addr *a)
 {
 #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS) && BITS_PER_LONG == 64