Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  [TCP]: Add return value indication to tcp_prune_ofo_queue().
  PS3: gelic: fix the oops on the broken IE returned from the hypervisor
  b43legacy: fix DMA mapping leakage
  mac80211: remove message on receiving unexpected unencrypted frames
  Update rt2x00 MAINTAINERS entry
  Add rfkill to MAINTAINERS file
  rfkill: Fix device type check when toggling states
  b43legacy: Fix usage of struct device used for DMAing
  ssb: Fix usage of struct device used for DMAing
  MAINTAINERS: move to generic repository for iwlwifi
  b43legacy: fix initvals loading on bcm4303
  rtl8187: Add missing priv->vif assignments
  netconsole: only set CON_PRINTBUFFER if the user specifies a netconsole
  [CAN]: Update documentation of struct sockaddr_can
  MAINTAINERS: isdn4linux@listserv.isdn4linux.de is subscribers-only
  [TCP]: Fix never pruned tcp out-of-order queue.
  [NET_SCHED] sch_api: fix qdisc_tree_decrease_qlen() loop

1 files changed, 52 insertions, 26 deletions

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 5119856017ab..bbb7d88a16b4 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3841,8 +3841,28 @@ static void tcp_ofo_queue(struct sock *sk)
         }
 }
 
+static int tcp_prune_ofo_queue(struct sock *sk);
 static int tcp_prune_queue(struct sock *sk);
 
+static inline int tcp_try_rmem_schedule(struct sock *sk, unsigned int size)
+{
+        if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
+            !sk_rmem_schedule(sk, size)) {
+
+                if (tcp_prune_queue(sk) < 0)
+                        return -1;
+
+                if (!sk_rmem_schedule(sk, size)) {
+                        if (!tcp_prune_ofo_queue(sk))
+                                return -1;
+
+                        if (!sk_rmem_schedule(sk, size))
+                                return -1;
+                }
+        }
+        return 0;
+}
+
 static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
 {
         struct tcphdr *th = tcp_hdr(skb);
@@ -3892,12 +3912,9 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
                 if (eaten <= 0) {
 queue_and_out:
                         if (eaten < 0 &&
-                            (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
-                             !sk_rmem_schedule(sk, skb->truesize))) {
-                                if (tcp_prune_queue(sk) < 0 ||
-                                    !sk_rmem_schedule(sk, skb->truesize))
-                                        goto drop;
-                        }
+                            tcp_try_rmem_schedule(sk, skb->truesize))
+                                goto drop;
+
                         skb_set_owner_r(skb, sk);
                         __skb_queue_tail(&sk->sk_receive_queue, skb);
                 }
@@ -3966,12 +3983,8 @@ drop:
 
         TCP_ECN_check_ce(tp, skb);
 
-        if (atomic_read(&sk->sk_rmem_alloc) > sk->sk_rcvbuf ||
-            !sk_rmem_schedule(sk, skb->truesize)) {
-                if (tcp_prune_queue(sk) < 0 ||
-                    !sk_rmem_schedule(sk, skb->truesize))
-                        goto drop;
-        }
+        if (tcp_try_rmem_schedule(sk, skb->truesize))
+                goto drop;
 
         /* Disable header prediction. */
         tp->pred_flags = 0;
@@ -4198,6 +4211,32 @@ static void tcp_collapse_ofo_queue(struct sock *sk)
         }
 }
 
+/*
+ * Purge the out-of-order queue.
+ * Return true if queue was pruned.
+ */
+static int tcp_prune_ofo_queue(struct sock *sk)
+{
+        struct tcp_sock *tp = tcp_sk(sk);
+        int res = 0;
+
+        if (!skb_queue_empty(&tp->out_of_order_queue)) {
+                NET_INC_STATS_BH(LINUX_MIB_OFOPRUNED);
+                __skb_queue_purge(&tp->out_of_order_queue);
+
+                /* Reset SACK state.  A conforming SACK implementation will
+                 * do the same at a timeout based retransmit.  When a connection
+                 * is in a sad state like this, we care only about integrity
+                 * of the connection not performance.
+                 */
+                if (tp->rx_opt.sack_ok)
+                        tcp_sack_reset(&tp->rx_opt);
+                sk_mem_reclaim(sk);
+                res = 1;
+        }
+        return res;
+}
+
 /* Reduce allocated memory if we can, trying to get
  * the socket within its memory limits again.
  *
@@ -4231,20 +4270,7 @@ static int tcp_prune_queue(struct sock *sk)
         /* Collapsing did not help, destructive actions follow.
          * This must not ever occur. */
 
-        /* First, purge the out_of_order queue. */
-        if (!skb_queue_empty(&tp->out_of_order_queue)) {
-                NET_INC_STATS_BH(LINUX_MIB_OFOPRUNED);
-                __skb_queue_purge(&tp->out_of_order_queue);
-
-                /* Reset SACK state.  A conforming SACK implementation will
-                 * do the same at a timeout based retransmit.  When a connection
-                 * is in a sad state like this, we care only about integrity
-                 * of the connection not performance.
-                 */
-                if (tcp_is_sack(tp))
-                        tcp_sack_reset(&tp->rx_opt);
-                sk_mem_reclaim(sk);
-        }
+        tcp_prune_ofo_queue(sk);
 
         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf)
                 return 0;