Merge commit 'v2.6.26-rc9' into cpus4096

8 files changed, 61 insertions, 27 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index ee61b987f4d9..94d9d6f77e04 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -119,6 +119,7 @@
 #include <linux/err.h>
 #include <linux/ctype.h>
 #include <linux/if_arp.h>
+#include <linux/if_vlan.h>
 
 #include "net-sysfs.h"
 
@@ -453,7 +454,7 @@ static int netdev_boot_setup_add(char *name, struct ifmap *map)
         for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
                 if (s[i].name[0] == '\0' || s[i].name[0] == ' ') {
                         memset(s[i].name, 0, sizeof(s[i].name));
-                        strcpy(s[i].name, name);
+                        strlcpy(s[i].name, name, IFNAMSIZ);
                         memcpy(&s[i].map, map, sizeof(s[i].map));
                         break;
                 }
@@ -478,7 +479,7 @@ int netdev_boot_setup_check(struct net_device *dev)
 
         for (i = 0; i < NETDEV_BOOT_SETUP_MAX; i++) {
                 if (s[i].name[0] != '\0' && s[i].name[0] != ' ' &&
-                    !strncmp(dev->name, s[i].name, strlen(s[i].name))) {
+                    !strcmp(dev->name, s[i].name)) {
                         dev->irq        = s[i].map.irq;
                         dev->base_addr  = s[i].map.base_addr;
                         dev->mem_start  = s[i].map.mem_start;
@@ -1362,6 +1363,29 @@ void netif_device_attach(struct net_device *dev)
 }
 EXPORT_SYMBOL(netif_device_attach);
 
+static bool can_checksum_protocol(unsigned long features, __be16 protocol)
+{
+        return ((features & NETIF_F_GEN_CSUM) ||
+                ((features & NETIF_F_IP_CSUM) &&
+                 protocol == htons(ETH_P_IP)) ||
+                ((features & NETIF_F_IPV6_CSUM) &&
+                 protocol == htons(ETH_P_IPV6)));
+}
+
+static bool dev_can_checksum(struct net_device *dev, struct sk_buff *skb)
+{
+        if (can_checksum_protocol(dev->features, skb->protocol))
+                return true;
+
+        if (skb->protocol == htons(ETH_P_8021Q)) {
+                struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
+                if (can_checksum_protocol(dev->features & dev->vlan_features,
+                                          veh->h_vlan_encapsulated_proto))
+                        return true;
+        }
+
+        return false;
+}
 
 /*
  * Invalidate hardware checksum when packet is to be mangled, and
@@ -1640,14 +1664,8 @@ int dev_queue_xmit(struct sk_buff *skb)
         if (skb->ip_summed == CHECKSUM_PARTIAL) {
                 skb_set_transport_header(skb, skb->csum_start -
                                               skb_headroom(skb));
-
-                if (!(dev->features & NETIF_F_GEN_CSUM) &&
-                    !((dev->features & NETIF_F_IP_CSUM) &&
-                      skb->protocol == htons(ETH_P_IP)) &&
-                    !((dev->features & NETIF_F_IPV6_CSUM) &&
-                      skb->protocol == htons(ETH_P_IPV6)))
-                        if (skb_checksum_help(skb))
-                                goto out_kfree_skb;
+                if (!dev_can_checksum(dev, skb) && skb_checksum_help(skb))
+                        goto out_kfree_skb;
         }
 
 gso:
@@ -2059,6 +2077,10 @@ int netif_receive_skb(struct sk_buff *skb)
 
         rcu_read_lock();
 
+        /* Don't receive packets in an exiting network namespace */
+        if (!net_alive(dev_net(skb->dev)))
+                goto out;
+
 #ifdef CONFIG_NET_CLS_ACT
         if (skb->tc_verd & TC_NCLS) {
                 skb->tc_verd = CLR_TC_NCLS(skb->tc_verd);
@@ -2951,7 +2973,7 @@ EXPORT_SYMBOL(dev_unicast_delete);
 /**
  *      dev_unicast_add         - add a secondary unicast address
  *      @dev: device
- *      @addr: address to delete
+ *      @addr: address to add
  *      @alen: length of @addr
  *
  *      Add a secondary unicast address to the device or increase
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index e3e9ab0f74e3..277a2302eb3a 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -226,7 +226,7 @@ static int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 
         ops = lookup_rules_ops(net, frh->family);
         if (ops == NULL) {
-                err = EAFNOSUPPORT;
+                err = -EAFNOSUPPORT;
                 goto errout;
         }
 
@@ -365,7 +365,7 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 
         ops = lookup_rules_ops(net, frh->family);
         if (ops == NULL) {
-                err = EAFNOSUPPORT;
+                err = -EAFNOSUPPORT;
                 goto errout;
         }
 
diff --git a/net/core/filter.c b/net/core/filter.c
index 4f8369729a4e..df3744355839 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -68,7 +68,6 @@ static inline void *load_pointer(struct sk_buff *skb, int k,
  *      sk_filter - run a packet through a socket filter
  *      @sk: sock associated with &sk_buff
  *      @skb: buffer to filter
- *      @needlock: set to 1 if the sock is not locked by caller.
  *
  * Run the filter code and then cut skb->data to correct size returned by
  * sk_run_filter. If pkt_len is 0 we toss packet. If skb->len is smaller
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5d9d7130bd6e..65f01f71b3f3 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1714,7 +1714,8 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
         return nla_nest_end(skb, nest);
 
 nla_put_failure:
-        return nla_nest_cancel(skb, nest);
+        nla_nest_cancel(skb, nest);
+        return -EMSGSIZE;
 }
 
 static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
@@ -2057,9 +2058,9 @@ static int neigh_fill_info(struct sk_buff *skb, struct neighbour *neigh,
                 goto nla_put_failure;
         }
 
-        ci.ndm_used      = now - neigh->used;
-        ci.ndm_confirmed = now - neigh->confirmed;
-        ci.ndm_updated   = now - neigh->updated;
+        ci.ndm_used      = jiffies_to_clock_t(now - neigh->used);
+        ci.ndm_confirmed = jiffies_to_clock_t(now - neigh->confirmed);
+        ci.ndm_updated   = jiffies_to_clock_t(now - neigh->updated);
         ci.ndm_refcnt    = atomic_read(&neigh->refcnt) - 1;
         read_unlock_bh(&neigh->lock);
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 72b4c184dd84..7c52fe277b62 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -140,6 +140,9 @@ static void cleanup_net(struct work_struct *work)
         struct pernet_operations *ops;
         struct net *net;
 
+        /* Be very certain incoming network packets will not find us */
+        rcu_barrier();
+
         net = container_of(work, struct net, work);
 
         mutex_lock(&net_mutex);
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index cf857c4dc7b1..a9a77216310e 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -498,7 +498,8 @@ int rtnetlink_put_metrics(struct sk_buff *skb, u32 *metrics)
         return nla_nest_end(skb, mx);
 
 nla_put_failure:
-        return nla_nest_cancel(skb, mx);
+        nla_nest_cancel(skb, mx);
+        return -EMSGSIZE;
 }
 
 int rtnl_put_cacheinfo(struct sk_buff *skb, struct dst_entry *dst, u32 id,
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5c459f2b7985..366621610e76 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -1292,12 +1292,14 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
 {
         unsigned int nr_pages = spd->nr_pages;
         unsigned int poff, plen, len, toff, tlen;
-        int headlen, seg;
+        int headlen, seg, error = 0;
 
         toff = *offset;
         tlen = *total_len;
-        if (!tlen)
+        if (!tlen) {
+                error = 1;
                 goto err;
+        }
 
         /*
          * if the offset is greater than the linear part, go directly to
@@ -1339,7 +1341,8 @@ static int __skb_splice_bits(struct sk_buff *skb, unsigned int *offset,
                  * just jump directly to update and return, no point
                  * in going over fragments when the output is full.
                  */
-                if (spd_fill_page(spd, virt_to_page(p), plen, poff, skb))
+                error = spd_fill_page(spd, virt_to_page(p), plen, poff, skb);
+                if (error)
                         goto done;
 
                 tlen -= plen;
@@ -1369,7 +1372,8 @@ map_frag:
                 if (!plen)
                         break;
 
-                if (spd_fill_page(spd, f->page, plen, poff, skb))
+                error = spd_fill_page(spd, f->page, plen, poff, skb);
+                if (error)
                         break;
 
                 tlen -= plen;
@@ -1382,7 +1386,10 @@ done:
                 return 0;
         }
 err:
-        return 1;
+        /* update the offset to reflect the linear part skip, if any */
+        if (!error)
+                *offset = toff;
+        return error;
 }
 
 /*
@@ -1445,6 +1452,7 @@ done:
 
         if (spd.nr_pages) {
                 int ret;
+                struct sock *sk = __skb->sk;
 
                 /*
                  * Drop the socket lock, otherwise we have reverse
@@ -1455,9 +1463,9 @@ done:
                  * we call into ->sendpage() with the i_mutex lock held
                  * and networking will grab the socket lock.
                  */
-                release_sock(__skb->sk);
+                release_sock(sk);
                 ret = splice_to_pipe(pipe, &spd);
-                lock_sock(__skb->sk);
+                lock_sock(sk);
                 return ret;
         }
 
diff --git a/net/core/user_dma.c b/net/core/user_dma.c
index 0ad1cd57bc39..c77aff9c6eb3 100644
--- a/net/core/user_dma.c
+++ b/net/core/user_dma.c
@@ -75,7 +75,7 @@ int dma_skb_copy_datagram_iovec(struct dma_chan *chan,
 
                 end = start + skb_shinfo(skb)->frags[i].size;
                 copy = end - offset;
-                if ((copy = end - offset) > 0) {
+                if (copy > 0) {
                         skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
                         struct page *page = frag->page;