Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (51 commits)
  [IPV6]: Fix again the fl6_sock_lookup() fixed locking
  [NETFILTER]: nf_conntrack_tcp: fix connection reopening fix
  [IPV6]: Fix race in ipv6_flowlabel_opt() when inserting two labels
  [IPV6]: Lost locking in fl6_sock_lookup
  [IPV6]: Lost locking when inserting a flowlabel in ipv6_fl_list
  [NETFILTER]: xt_sctp: fix mistake to pass a pointer where array is required
  [NET]: Fix OOPS due to missing check in dev_parse_header().
  [TCP]: Remove lost_retrans zero seqno special cases
  [NET]: fix carrier-on bug?
  [NET]: Fix uninitialised variable in ip_frag_reasm()
  [IPSEC]: Rename mode to outer_mode and add inner_mode
  [IPSEC]: Disallow combinations of RO and AH/ESP/IPCOMP
  [IPSEC]: Use the top IPv4 route's peer instead of the bottom
  [IPSEC]: Store afinfo pointer in xfrm_mode
  [IPSEC]: Add missing BEET checks
  [IPSEC]: Move type and mode map into xfrm_state.c
  [IPSEC]: Fix length check in xfrm_parse_spi
  [IPSEC]: Move ip_summed zapping out of xfrm6_rcv_spi
  [IPSEC]: Get nexthdr from caller in xfrm6_rcv_spi
  [IPSEC]: Move tunnel parsing for IPv4 out of xfrm4_input
  ...

3 files changed, 49 insertions, 25 deletions

diff --git a/net/core/filter.c b/net/core/filter.c
index bd903aaf7aa7..1f0068eae501 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -387,6 +387,25 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
 }
 
 /**
+ *      sk_filter_rcu_release: Release a socket filter by rcu_head
+ *      @rcu: rcu_head that contains the sk_filter to free
+ */
+static void sk_filter_rcu_release(struct rcu_head *rcu)
+{
+        struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
+
+        sk_filter_release(fp);
+}
+
+static void sk_filter_delayed_uncharge(struct sock *sk, struct sk_filter *fp)
+{
+        unsigned int size = sk_filter_len(fp);
+
+        atomic_sub(size, &sk->sk_omem_alloc);
+        call_rcu_bh(&fp->rcu, sk_filter_rcu_release);
+}
+
+/**
  *      sk_attach_filter - attach a socket filter
  *      @fprog: the filter program
  *      @sk: the socket to use
@@ -398,7 +417,7 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
  */
 int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
 {
-        struct sk_filter *fp;
+        struct sk_filter *fp, *old_fp;
         unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
         int err;
 
@@ -418,19 +437,34 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         fp->len = fprog->len;
 
         err = sk_chk_filter(fp->insns, fp->len);
-        if (!err) {
-                struct sk_filter *old_fp;
-
-                rcu_read_lock_bh();
-                old_fp = rcu_dereference(sk->sk_filter);
-                rcu_assign_pointer(sk->sk_filter, fp);
-                rcu_read_unlock_bh();
-                fp = old_fp;
+        if (err) {
+                sk_filter_uncharge(sk, fp);
+                return err;
         }
 
-        if (fp)
-                sk_filter_release(sk, fp);
-        return err;
+        rcu_read_lock_bh();
+        old_fp = rcu_dereference(sk->sk_filter);
+        rcu_assign_pointer(sk->sk_filter, fp);
+        rcu_read_unlock_bh();
+
+        sk_filter_delayed_uncharge(sk, old_fp);
+        return 0;
+}
+
+int sk_detach_filter(struct sock *sk)
+{
+        int ret = -ENOENT;
+        struct sk_filter *filter;
+
+        rcu_read_lock_bh();
+        filter = rcu_dereference(sk->sk_filter);
+        if (filter) {
+                rcu_assign_pointer(sk->sk_filter, NULL);
+                sk_filter_delayed_uncharge(sk, filter);
+                ret = 0;
+        }
+        rcu_read_unlock_bh();
+        return ret;
 }
 
 EXPORT_SYMBOL(sk_chk_filter);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 2100c734b102..8cae60c53383 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2454,7 +2454,7 @@ static int pktgen_output_ipsec(struct sk_buff *skb, struct pktgen_dev *pkt_dev)
         spin_lock(&x->lock);
         iph = ip_hdr(skb);
 
-        err = x->mode->output(x, skb);
+        err = x->outer_mode->output(x, skb);
         if (err)
                 goto error;
         err = x->type->output(x, skb);
diff --git a/net/core/sock.c b/net/core/sock.c
index d45ecdccc6a1..d292b4113d6e 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -428,7 +428,6 @@ int sock_setsockopt(struct socket *sock, int level, int optname,
                     char __user *optval, int optlen)
 {
         struct sock *sk=sock->sk;
-        struct sk_filter *filter;
         int val;
         int valbool;
         struct linger ling;
@@ -652,16 +651,7 @@ set_rcvbuf:
                 break;
 
         case SO_DETACH_FILTER:
-                rcu_read_lock_bh();
-                filter = rcu_dereference(sk->sk_filter);
-                if (filter) {
-                        rcu_assign_pointer(sk->sk_filter, NULL);
-                        sk_filter_release(sk, filter);
-                        rcu_read_unlock_bh();
-                        break;
-                }
-                rcu_read_unlock_bh();
-                ret = -ENONET;
+                ret = sk_detach_filter(sk);
                 break;
 
         case SO_PASSSEC:
@@ -925,7 +915,7 @@ void sk_free(struct sock *sk)
 
         filter = rcu_dereference(sk->sk_filter);
         if (filter) {
-                sk_filter_release(sk, filter);
+                sk_filter_uncharge(sk, filter);
                 rcu_assign_pointer(sk->sk_filter, NULL);
         }