Merge commit 'v2.6.38-rc4' into imx-for-2.6.39

Conflicts:
	arch/arm/mach-mxs/clock-mx28.c

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

4 files changed, 22 insertions, 11 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 54277df0f735..b6d0bf875a8e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -749,7 +749,8 @@ EXPORT_SYMBOL(dev_get_by_index);
  *      @ha: hardware address
  *
  *      Search for an interface by MAC address. Returns NULL if the device
- *      is not found or a pointer to the device. The caller must hold RCU
+ *      is not found or a pointer to the device.
+ *      The caller must hold RCU or RTNL.
  *      The returned device has not had its ref count increased
  *      and the caller must therefore be careful about locking
  *
@@ -2001,7 +2002,7 @@ static bool can_checksum_protocol(unsigned long features, __be16 protocol)
 
 static int harmonize_features(struct sk_buff *skb, __be16 protocol, int features)
 {
-        if (!can_checksum_protocol(protocol, features)) {
+        if (!can_checksum_protocol(features, protocol)) {
                 features &= ~NETIF_F_ALL_CSUM;
                 features &= ~NETIF_F_SG;
         } else if (illegal_highdma(skb->dev, skb)) {
@@ -2023,13 +2024,13 @@ int netif_skb_features(struct sk_buff *skb)
                 return harmonize_features(skb, protocol, features);
         }
 
-        features &= skb->dev->vlan_features;
+        features &= (skb->dev->vlan_features | NETIF_F_HW_VLAN_TX);
 
         if (protocol != htons(ETH_P_8021Q)) {
                 return harmonize_features(skb, protocol, features);
         } else {
                 features &= NETIF_F_SG | NETIF_F_HIGHDMA | NETIF_F_FRAGLIST |
-                                NETIF_F_GEN_CSUM;
+                                NETIF_F_GEN_CSUM | NETIF_F_HW_VLAN_TX;
                 return harmonize_features(skb, protocol, features);
         }
 }
@@ -2562,7 +2563,8 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
 
         map = rcu_dereference(rxqueue->rps_map);
         if (map) {
-                if (map->len == 1) {
+                if (map->len == 1 &&
+                    !rcu_dereference_raw(rxqueue->rps_flow_table)) {
                         tcpu = map->cpus[0];
                         if (cpu_online(tcpu))
                                 cpu = tcpu;
@@ -3423,6 +3425,8 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
         __skb_pull(skb, skb_headlen(skb));
         skb_reserve(skb, NET_IP_ALIGN - skb_headroom(skb));
         skb->vlan_tci = 0;
+        skb->dev = napi->dev;
+        skb->skb_iif = 0;
 
         napi->skb = skb;
 }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 17741782a345..ff2302910b5e 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -817,7 +817,7 @@ static int ethtool_get_regs(struct net_device *dev, char __user *useraddr)
         if (regs.len > reglen)
                 regs.len = reglen;
 
-        regbuf = vmalloc(reglen);
+        regbuf = vzalloc(reglen);
         if (!regbuf)
                 return -ENOMEM;
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index a5f7535aab5b..2d65c6bb24c1 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1121,8 +1121,7 @@ static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
                                 return -EOPNOTSUPP;
 
                         if (af_ops->validate_link_af) {
-                                err = af_ops->validate_link_af(dev,
-                                                        tb[IFLA_AF_SPEC]);
+                                err = af_ops->validate_link_af(dev, af);
                                 if (err < 0)
                                         return err;
                         }
@@ -1672,6 +1671,9 @@ replay:
                         snprintf(ifname, IFNAMSIZ, "%s%%d", ops->kind);
 
                 dest_net = rtnl_link_get_net(net, tb);
+                if (IS_ERR(dest_net))
+                        return PTR_ERR(dest_net);
+
                 dev = rtnl_create_link(net, dest_net, ifname, ops, tb);
 
                 if (IS_ERR(dev))
@@ -1820,7 +1822,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
         if (kind != 2 && security_netlink_recv(skb, CAP_NET_ADMIN))
                 return -EPERM;
 
-        if (kind == 2 && (nlh->nlmsg_flags & NLM_F_DUMP) == NLM_F_DUMP) {
+        if (kind == 2 && nlh->nlmsg_flags&NLM_F_DUMP) {
                 struct sock *rtnl;
                 rtnl_dumpit_func dumpit;
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d31bb36ae0dc..d883dcc78b6b 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -210,6 +210,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         shinfo = skb_shinfo(skb);
         memset(shinfo, 0, offsetof(struct skb_shared_info, dataref));
         atomic_set(&shinfo->dataref, 1);
+        kmemcheck_annotate_variable(shinfo->destructor_arg);
 
         if (fclone) {
                 struct sk_buff *child = skb + 1;
@@ -2744,8 +2745,12 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
 merge:
         if (offset > headlen) {
-                skbinfo->frags[0].page_offset += offset - headlen;
-                skbinfo->frags[0].size -= offset - headlen;
+                unsigned int eat = offset - headlen;
+
+                skbinfo->frags[0].page_offset += eat;
+                skbinfo->frags[0].size -= eat;
+                skb->data_len -= eat;
+                skb->len -= eat;
                 offset = headlen;
         }