Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (108 commits)
  bridge: ensure to unlock in error path in br_multicast_query().
  drivers/net/tulip/eeprom.c: fix bogus "(null)" in tulip init messages
  sky2: Avoid rtnl_unlock without rtnl_lock
  ipv6: Send netlink notification when DAD fails
  drivers/net/tg3.c: change the field used with the TG3_FLAG_10_100_ONLY constant
  ipconfig: Handle devices which take some time to come up.
  mac80211: Fix memory leak in ieee80211_if_write()
  mac80211: Fix (dynamic) power save entry
  ipw2200: use kmalloc for large local variables
  ath5k: read eeprom IQ calibration values correctly for G mode
  ath5k: fix I/Q calibration (for real)
  ath5k: fix TSF reset
  ath5k: use fixed antenna for tx descriptors
  libipw: split ieee->networks into small pieces
  mac80211: Fix sta_mtx unlocking on insert STA failure path
  rt2x00: remove KSEG1ADDR define from rt2x00soc.h
  net: add ColdFire support to the smc91x driver
  asix: fix setting mac address for AX88772
  ipv6 ip6_tunnel: eliminate unused recursion field from ip6_tnl{}.
  net: Fix dev_mc_add()
  ...

9 files changed, 116 insertions, 46 deletions

diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index c0c5274d0271..f47c9f76754b 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1144,12 +1144,9 @@ static int ipgre_header(struct sk_buff *skb, struct net_device *dev,
 
         if (saddr)
                 memcpy(&iph->saddr, saddr, 4);
-
-        if (daddr) {
+        if (daddr)
                 memcpy(&iph->daddr, daddr, 4);
-                return t->hlen;
-        }
-        if (iph->daddr && !ipv4_is_multicast(iph->daddr))
+        if (iph->daddr)
                 return t->hlen;
 
         return -t->hlen;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 10a6a604bf32..678909281648 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -187,6 +187,16 @@ struct ic_device {
 static struct ic_device *ic_first_dev __initdata = NULL;/* List of open device */
 static struct net_device *ic_dev __initdata = NULL;     /* Selected device */
 
+static bool __init ic_device_match(struct net_device *dev)
+{
+        if (user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
+            (!(dev->flags & IFF_LOOPBACK) &&
+             (dev->flags & (IFF_POINTOPOINT|IFF_BROADCAST)) &&
+             strncmp(dev->name, "dummy", 5)))
+                return true;
+        return false;
+}
+
 static int __init ic_open_devs(void)
 {
         struct ic_device *d, **last;
@@ -207,10 +217,7 @@ static int __init ic_open_devs(void)
         for_each_netdev(&init_net, dev) {
                 if (dev->flags & IFF_LOOPBACK)
                         continue;
-                if (user_dev_name[0] ? !strcmp(dev->name, user_dev_name) :
-                    (!(dev->flags & IFF_LOOPBACK) &&
-                     (dev->flags & (IFF_POINTOPOINT|IFF_BROADCAST)) &&
-                     strncmp(dev->name, "dummy", 5))) {
+                if (ic_device_match(dev)) {
                         int able = 0;
                         if (dev->mtu >= 364)
                                 able |= IC_BOOTP;
@@ -228,7 +235,7 @@ static int __init ic_open_devs(void)
                         }
                         if (!(d = kmalloc(sizeof(struct ic_device), GFP_KERNEL))) {
                                 rtnl_unlock();
-                                return -1;
+                                return -ENOMEM;
                         }
                         d->dev = dev;
                         *last = d;
@@ -253,7 +260,7 @@ static int __init ic_open_devs(void)
                         printk(KERN_ERR "IP-Config: Device `%s' not found.\n", user_dev_name);
                 else
                         printk(KERN_ERR "IP-Config: No network devices available.\n");
-                return -1;
+                return -ENODEV;
         }
         return 0;
 }
@@ -1303,6 +1310,32 @@ __be32 __init root_nfs_parse_addr(char *name)
         return addr;
 }
 
+#define DEVICE_WAIT_MAX         12 /* 12 seconds */
+
+static int __init wait_for_devices(void)
+{
+        int i;
+
+        msleep(CONF_PRE_OPEN);
+        for (i = 0; i < DEVICE_WAIT_MAX; i++) {
+                struct net_device *dev;
+                int found = 0;
+
+                rtnl_lock();
+                for_each_netdev(&init_net, dev) {
+                        if (ic_device_match(dev)) {
+                                found = 1;
+                                break;
+                        }
+                }
+                rtnl_unlock();
+                if (found)
+                        return 0;
+                ssleep(1);
+        }
+        return -ENODEV;
+}
+
 /*
  *      IP Autoconfig dispatcher.
  */
@@ -1313,6 +1346,7 @@ static int __init ip_auto_config(void)
 #ifdef IPCONFIG_DYNAMIC
         int retries = CONF_OPEN_RETRIES;
 #endif
+        int err;
 
 #ifdef CONFIG_PROC_FS
         proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
@@ -1325,12 +1359,15 @@ static int __init ip_auto_config(void)
 #ifdef IPCONFIG_DYNAMIC
  try_try_again:
 #endif
-        /* Give hardware a chance to settle */
-        msleep(CONF_PRE_OPEN);
+        /* Wait for devices to appear */
+        err = wait_for_devices();
+        if (err)
+                return err;
 
         /* Setup all network devices */
-        if (ic_open_devs() < 0)
-                return -1;
+        err = ic_open_devs();
+        if (err)
+                return err;
 
         /* Give drivers a chance to settle */
         ssleep(CONF_POST_OPEN);
diff --git a/net/ipv4/proc.c b/net/ipv4/proc.c
index 242ed2307370..4f1f337f4337 100644
--- a/net/ipv4/proc.c
+++ b/net/ipv4/proc.c
@@ -249,6 +249,8 @@ static const struct snmp_mib snmp4_net_list[] = {
         SNMP_MIB_ITEM("TCPSackShifted", LINUX_MIB_SACKSHIFTED),
         SNMP_MIB_ITEM("TCPSackMerged", LINUX_MIB_SACKMERGED),
         SNMP_MIB_ITEM("TCPSackShiftFallback", LINUX_MIB_SACKSHIFTFALLBACK),
+        SNMP_MIB_ITEM("TCPBacklogDrop", LINUX_MIB_TCPBACKLOGDROP),
+        SNMP_MIB_ITEM("TCPMinTTLDrop", LINUX_MIB_TCPMINTTLDROP),
         SNMP_MIB_SENTINEL
 };
 
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index b2ba5581d2ae..d9b40248b97f 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -146,7 +146,6 @@ static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
 static void              ipv4_link_failure(struct sk_buff *skb);
 static void              ip_rt_update_pmtu(struct dst_entry *dst, u32 mtu);
 static int rt_garbage_collect(struct dst_ops *ops);
-static void rt_emergency_hash_rebuild(struct net *net);
 
 
 static struct dst_ops ipv4_dst_ops = {
@@ -780,11 +779,30 @@ static void rt_do_flush(int process_context)
 #define FRACT_BITS 3
 #define ONE (1UL << FRACT_BITS)
 
+/*
+ * Given a hash chain and an item in this hash chain,
+ * find if a previous entry has the same hash_inputs
+ * (but differs on tos, mark or oif)
+ * Returns 0 if an alias is found.
+ * Returns ONE if rth has no alias before itself.
+ */
+static int has_noalias(const struct rtable *head, const struct rtable *rth)
+{
+        const struct rtable *aux = head;
+
+        while (aux != rth) {
+                if (compare_hash_inputs(&aux->fl, &rth->fl))
+                        return 0;
+                aux = aux->u.dst.rt_next;
+        }
+        return ONE;
+}
+
 static void rt_check_expire(void)
 {
         static unsigned int rover;
         unsigned int i = rover, goal;
-        struct rtable *rth, *aux, **rthp;
+        struct rtable *rth, **rthp;
         unsigned long samples = 0;
         unsigned long sum = 0, sum2 = 0;
         unsigned long delta;
@@ -835,15 +853,7 @@ nofree:
                                          * attributes don't unfairly skew
                                          * the length computation
                                          */
-                                        for (aux = rt_hash_table[i].chain;;) {
-                                                if (aux == rth) {
-                                                        length += ONE;
-                                                        break;
-                                                }
-                                                if (compare_hash_inputs(&aux->fl, &rth->fl))
-                                                        break;
-                                                aux = aux->u.dst.rt_next;
-                                        }
+                                        length += has_noalias(rt_hash_table[i].chain, rth);
                                         continue;
                                 }
                         } else if (!rt_may_expire(rth, tmo, ip_rt_gc_timeout))
@@ -1073,6 +1083,21 @@ work_done:
 out:    return 0;
 }
 
+/*
+ * Returns number of entries in a hash chain that have different hash_inputs
+ */
+static int slow_chain_length(const struct rtable *head)
+{
+        int length = 0;
+        const struct rtable *rth = head;
+
+        while (rth) {
+                length += has_noalias(head, rth);
+                rth = rth->u.dst.rt_next;
+        }
+        return length >> FRACT_BITS;
+}
+
 static int rt_intern_hash(unsigned hash, struct rtable *rt,
                           struct rtable **rp, struct sk_buff *skb)
 {
@@ -1185,7 +1210,8 @@ restart:
                         rt_free(cand);
                 }
         } else {
-                if (chain_length > rt_chain_length_max) {
+                if (chain_length > rt_chain_length_max &&
+                    slow_chain_length(rt_hash_table[hash].chain) > rt_chain_length_max) {
                         struct net *net = dev_net(rt->u.dst.dev);
                         int num = ++net->ipv4.current_rt_cache_rebuild_count;
                         if (!rt_caching(dev_net(rt->u.dst.dev))) {
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index c3588b4fd979..70df40980a87 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1651,13 +1651,15 @@ int tcp_v4_rcv(struct sk_buff *skb)
         if (!sk)
                 goto no_tcp_socket;
 
-        if (iph->ttl < inet_sk(sk)->min_ttl)
-                goto discard_and_relse;
-
 process:
         if (sk->sk_state == TCP_TIME_WAIT)
                 goto do_time_wait;
 
+        if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto discard_and_relse;
+        }
+
         if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
         nf_reset(skb);
@@ -1682,8 +1684,11 @@ process:
                         if (!tcp_prequeue(sk, skb))
                                 ret = tcp_v4_do_rcv(sk, skb);
                 }
-        } else
-                sk_add_backlog(sk, skb);
+        } else if (unlikely(sk_add_backlog(sk, skb))) {
+                bh_unlock_sock(sk);
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
+                goto discard_and_relse;
+        }
         bh_unlock_sock(sk);
 
         sock_put(sk);
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index f206ee5dda80..4199bc6915c5 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -728,7 +728,7 @@ int tcp_child_process(struct sock *parent, struct sock *child,
                  * in main socket hash table and lock on listening
                  * socket does not protect us more.
                  */
-                sk_add_backlog(child, skb);
+                __sk_add_backlog(child, skb);
         }
 
         bh_unlock_sock(child);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 4a1605d3f909..f181b78f2385 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2395,13 +2395,17 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         struct tcp_extend_values *xvp = tcp_xv(rvp);
         struct inet_request_sock *ireq = inet_rsk(req);
         struct tcp_sock *tp = tcp_sk(sk);
+        const struct tcp_cookie_values *cvp = tp->cookie_values;
         struct tcphdr *th;
         struct sk_buff *skb;
         struct tcp_md5sig_key *md5;
         int tcp_header_size;
         int mss;
+        int s_data_desired = 0;
 
-        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
+        if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
+                s_data_desired = cvp->s_data_desired;
+        skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
         if (skb == NULL)
                 return NULL;
 
@@ -2457,16 +2461,12 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
                              TCPCB_FLAG_SYN | TCPCB_FLAG_ACK);
 
         if (OPTION_COOKIE_EXTENSION & opts.options) {
-                const struct tcp_cookie_values *cvp = tp->cookie_values;
-
-                if (cvp != NULL &&
-                    cvp->s_data_constant &&
-                    cvp->s_data_desired > 0) {
-                        u8 *buf = skb_put(skb, cvp->s_data_desired);
+                if (s_data_desired) {
+                        u8 *buf = skb_put(skb, s_data_desired);
 
                         /* copy data directly from the listening socket. */
-                        memcpy(buf, cvp->s_data_payload, cvp->s_data_desired);
-                        TCP_SKB_CB(skb)->end_seq += cvp->s_data_desired;
+                        memcpy(buf, cvp->s_data_payload, s_data_desired);
+                        TCP_SKB_CB(skb)->end_seq += s_data_desired;
                 }
 
                 if (opts.hash_size > 0) {
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 608a5446d05b..7af756d0f931 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1371,8 +1371,10 @@ int udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 rc = __udp_queue_rcv_skb(sk, skb);
-        else
-                sk_add_backlog(sk, skb);
+        else if (sk_add_backlog(sk, skb)) {
+                bh_unlock_sock(sk);
+                goto drop;
+        }
         bh_unlock_sock(sk);
 
         return rc;
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 67107d63c1cd..e4a1483fba77 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -91,11 +91,12 @@ static int xfrm4_init_path(struct xfrm_dst *path, struct dst_entry *dst,
         return 0;
 }
 
-static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
+static int xfrm4_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+                          struct flowi *fl)
 {
         struct rtable *rt = (struct rtable *)xdst->route;
 
-        xdst->u.rt.fl = rt->fl;
+        xdst->u.rt.fl = *fl;
 
         xdst->u.dst.dev = dev;
         dev_hold(dev);