Merge tag 'v3.16-rc5' into next/fixes-non-critical

Linux 3.16-rc5

1 files changed, 8 insertions, 2 deletions

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index bb7e8ba821f4..e96884380732 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1207,7 +1207,7 @@ restart:
         sk->sk_state    = TCP_ESTABLISHED;
         sock_hold(newsk);
 
-        smp_mb__after_atomic_inc();     /* sock_hold() does an atomic_inc() */
+        smp_mb__after_atomic(); /* sock_hold() does an atomic_inc() */
         unix_peer(sk)   = newsk;
 
         unix_state_unlock(sk);
@@ -1492,10 +1492,14 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
         if (len > sk->sk_sndbuf - 32)
                 goto out;
 
-        if (len > SKB_MAX_ALLOC)
+        if (len > SKB_MAX_ALLOC) {
                 data_len = min_t(size_t,
                                  len - SKB_MAX_ALLOC,
                                  MAX_SKB_FRAGS * PAGE_SIZE);
+                data_len = PAGE_ALIGN(data_len);
+
+                BUILD_BUG_ON(SKB_MAX_ALLOC < PAGE_SIZE);
+        }
 
         skb = sock_alloc_send_pskb(sk, len - data_len, data_len,
                                    msg->msg_flags & MSG_DONTWAIT, &err,
@@ -1670,6 +1674,8 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
                 data_len = max_t(int, 0, size - SKB_MAX_HEAD(0));
 
+                data_len = min_t(size_t, size, PAGE_ALIGN(data_len));
+
                 skb = sock_alloc_send_pskb(sk, size - data_len, data_len,
                                            msg->msg_flags & MSG_DONTWAIT, &err,
                                            get_order(UNIX_SKB_FRAGS_SZ));