Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1623 commits)
  netxen: update copyright
  netxen: fix tx timeout recovery
  netxen: fix file firmware leak
  netxen: improve pci memory access
  netxen: change firmware write size
  tg3: Fix return ring size breakage
  netxen: build fix for INET=n
  cdc-phonet: autoconfigure Phonet address
  Phonet: back-end for autoconfigured addresses
  Phonet: fix netlink address dump error handling
  ipv6: Add IFA_F_DADFAILED flag
  net: Add DEVTYPE support for Ethernet based devices
  mv643xx_eth.c: remove unused txq_set_wrr()
  ucc_geth: Fix hangs after switching from full to half duplex
  ucc_geth: Rearrange some code to avoid forward declarations
  phy/marvell: Make non-aneg speed/duplex forcing work for 88E1111 PHYs
  drivers/net/phy: introduce missing kfree
  drivers/net/wan: introduce missing kfree
  net: force bridge module(s) to be GPL
  Subject: [PATCH] appletalk: Fix skb leak when ipddp interface is not loaded
  ...

Fixed up trivial conflicts:

 - arch/x86/include/asm/socket.h

   converted to <asm-generic/socket.h> in the x86 tree.  The generic
   header has the same new #define's, so that works out fine.

 - drivers/net/tun.c

   fix conflict between 89f56d1e9 ("tun: reuse struct sock fields") that
   switched over to using 'tun->socket.sk' instead of the redundantly
   available (and thus removed) 'tun->sk', and 2b980dbd ("lsm: Add hooks
   to the TUN driver") which added a new 'tun->sk' use.

   Noted in 'next' by Stephen Rothwell.

1 files changed, 52 insertions, 14 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6d88219c5e22..0543561da999 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -328,26 +328,29 @@ static void do_pmtu_discovery(struct sock *sk, struct iphdr *iph, u32 mtu)
  *
  */
 
-void tcp_v4_err(struct sk_buff *skb, u32 info)
+void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 {
-        struct iphdr *iph = (struct iphdr *)skb->data;
-        struct tcphdr *th = (struct tcphdr *)(skb->data + (iph->ihl << 2));
+        struct iphdr *iph = (struct iphdr *)icmp_skb->data;
+        struct tcphdr *th = (struct tcphdr *)(icmp_skb->data + (iph->ihl << 2));
+        struct inet_connection_sock *icsk;
         struct tcp_sock *tp;
         struct inet_sock *inet;
-        const int type = icmp_hdr(skb)->type;
-        const int code = icmp_hdr(skb)->code;
+        const int type = icmp_hdr(icmp_skb)->type;
+        const int code = icmp_hdr(icmp_skb)->code;
         struct sock *sk;
+        struct sk_buff *skb;
         __u32 seq;
+        __u32 remaining;
         int err;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(icmp_skb->dev);
 
-        if (skb->len < (iph->ihl << 2) + 8) {
+        if (icmp_skb->len < (iph->ihl << 2) + 8) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
         }
 
         sk = inet_lookup(net, &tcp_hashinfo, iph->daddr, th->dest,
-                        iph->saddr, th->source, inet_iif(skb));
+                        iph->saddr, th->source, inet_iif(icmp_skb));
         if (!sk) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
@@ -367,6 +370,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        icsk = inet_csk(sk);
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
@@ -393,6 +397,39 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 }
 
                 err = icmp_err_convert[code].errno;
+                /* check if icmp_skb allows revert of backoff
+                 * (see draft-zimmermann-tcp-lcd) */
+                if (code != ICMP_NET_UNREACH && code != ICMP_HOST_UNREACH)
+                        break;
+                if (seq != tp->snd_una  || !icsk->icsk_retransmits ||
+                    !icsk->icsk_backoff)
+                        break;
+
+                icsk->icsk_backoff--;
+                inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
+                                         icsk->icsk_backoff;
+                tcp_bound_rto(sk);
+
+                skb = tcp_write_queue_head(sk);
+                BUG_ON(!skb);
+
+                remaining = icsk->icsk_rto - min(icsk->icsk_rto,
+                                tcp_time_stamp - TCP_SKB_CB(skb)->when);
+
+                if (remaining) {
+                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+                                                  remaining, TCP_RTO_MAX);
+                } else if (sock_owned_by_user(sk)) {
+                        /* RTO revert clocked out retransmission,
+                         * but socket is locked. Will defer. */
+                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+                                                  HZ/20, TCP_RTO_MAX);
+                } else {
+                        /* RTO revert clocked out retransmission.
+                         * Will retransmit now */
+                        tcp_retransmit_timer(sk);
+                }
+
                 break;
         case ICMP_TIME_EXCEEDED:
                 err = EHOSTUNREACH;
@@ -849,7 +886,7 @@ int tcp_v4_md5_do_add(struct sock *sk, __be32 addr,
                         }
                         sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
                 }
-                if (tcp_alloc_md5sig_pool() == NULL) {
+                if (tcp_alloc_md5sig_pool(sk) == NULL) {
                         kfree(newkey);
                         return -ENOMEM;
                 }
@@ -970,8 +1007,9 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
 
         if (!tcp_sk(sk)->md5sig_info) {
                 struct tcp_sock *tp = tcp_sk(sk);
-                struct tcp_md5sig_info *p = kzalloc(sizeof(*p), GFP_KERNEL);
+                struct tcp_md5sig_info *p;
 
+                p = kzalloc(sizeof(*p), sk->sk_allocation);
                 if (!p)
                         return -EINVAL;
 
@@ -979,7 +1017,7 @@ static int tcp_v4_parse_md5_keys(struct sock *sk, char __user *optval,
                 sk->sk_route_caps &= ~NETIF_F_GSO_MASK;
         }
 
-        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, GFP_KERNEL);
+        newkey = kmemdup(cmd.tcpm_key, cmd.tcpm_keylen, sk->sk_allocation);
         if (!newkey)
                 return -ENOMEM;
         return tcp_v4_md5_do_add(sk, sin->sin_addr.s_addr,
@@ -1158,7 +1196,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
+static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
         .md5_lookup     =       tcp_v4_reqsk_md5_lookup,
         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
 };
@@ -1717,7 +1755,7 @@ int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
         return 0;
 }
 
-struct inet_connection_sock_af_ops ipv4_specific = {
+const struct inet_connection_sock_af_ops ipv4_specific = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
@@ -1737,7 +1775,7 @@ struct inet_connection_sock_af_ops ipv4_specific = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
+static const struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
         .md5_lookup             = tcp_v4_md5_lookup,
         .calc_md5_hash          = tcp_v4_md5_hash_skb,
         .md5_add                = tcp_v4_md5_add_func,