Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

20 files changed, 99 insertions, 96 deletions

diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 673728add60b..82c57069415f 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -59,8 +59,6 @@ struct cfcnfg *get_cfcnfg(struct net *net)
 {
         struct caif_net *caifn;
         caifn = net_generic(net, caif_net_id);
-        if (!caifn)
-                return NULL;
         return caifn->cfg;
 }
 EXPORT_SYMBOL(get_cfcnfg);
@@ -69,8 +67,6 @@ static struct caif_device_entry_list *caif_device_list(struct net *net)
 {
         struct caif_net *caifn;
         caifn = net_generic(net, caif_net_id);
-        if (!caifn)
-                return NULL;
         return &caifn->caifdevs;
 }
 
@@ -99,8 +95,6 @@ static struct caif_device_entry *caif_device_alloc(struct net_device *dev)
         struct caif_device_entry *caifd;
 
         caifdevs = caif_device_list(dev_net(dev));
-        if (!caifdevs)
-                return NULL;
 
         caifd = kzalloc(sizeof(*caifd), GFP_KERNEL);
         if (!caifd)
@@ -120,8 +114,6 @@ static struct caif_device_entry *caif_get(struct net_device *dev)
         struct caif_device_entry_list *caifdevs =
             caif_device_list(dev_net(dev));
         struct caif_device_entry *caifd;
-        if (!caifdevs)
-                return NULL;
 
         list_for_each_entry_rcu(caifd, &caifdevs->list, list) {
                 if (caifd->netdev == dev)
@@ -321,8 +313,6 @@ void caif_enroll_dev(struct net_device *dev, struct caif_dev_common *caifdev,
         struct caif_device_entry_list *caifdevs;
 
         caifdevs = caif_device_list(dev_net(dev));
-        if (!cfg || !caifdevs)
-                return;
         caifd = caif_device_alloc(dev);
         if (!caifd)
                 return;
@@ -374,8 +364,6 @@ static int caif_device_notify(struct notifier_block *me, unsigned long what,
 
         cfg = get_cfcnfg(dev_net(dev));
         caifdevs = caif_device_list(dev_net(dev));
-        if (!cfg || !caifdevs)
-                return 0;
 
         caifd = caif_get(dev);
         if (caifd == NULL && dev->type != ARPHRD_CAIF)
@@ -507,9 +495,6 @@ static struct notifier_block caif_device_notifier = {
 static int caif_init_net(struct net *net)
 {
         struct caif_net *caifn = net_generic(net, caif_net_id);
-        if (WARN_ON(!caifn))
-                return -EINVAL;
-
         INIT_LIST_HEAD(&caifn->caifdevs.list);
         mutex_init(&caifn->caifdevs.lock);
 
@@ -527,9 +512,6 @@ static void caif_exit_net(struct net *net)
             caif_device_list(net);
         struct cfcnfg *cfg =  get_cfcnfg(net);
 
-        if (!cfg || !caifdevs)
-                return;
-
         rtnl_lock();
         mutex_lock(&caifdevs->lock);
 
@@ -569,7 +551,7 @@ static int __init caif_device_init(void)
 {
         int result;
 
-        result = register_pernet_device(&caif_net_ops);
+        result = register_pernet_subsys(&caif_net_ops);
 
         if (result)
                 return result;
@@ -582,7 +564,7 @@ static int __init caif_device_init(void)
 
 static void __exit caif_device_exit(void)
 {
-        unregister_pernet_device(&caif_net_ops);
+        unregister_pernet_subsys(&caif_net_ops);
         unregister_netdevice_notifier(&caif_device_notifier);
         dev_remove_pack(&caif_packet_type);
 }
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index 0d1131864630..5016fa57b623 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -506,8 +506,10 @@ static int transmit_skb(struct sk_buff *skb, struct caifsock *cf_sk,
         pkt = cfpkt_fromnative(CAIF_DIR_OUT, skb);
         memset(skb->cb, 0, sizeof(struct caif_payload_info));
 
-        if (cf_sk->layer.dn == NULL)
+        if (cf_sk->layer.dn == NULL) {
+                kfree_skb(skb);
                 return -EINVAL;
+        }
 
         return cf_sk->layer.dn->transmit(cf_sk->layer.dn, pkt);
 }
@@ -650,10 +652,10 @@ static int caif_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
                 }
                 err = transmit_skb(skb, cf_sk,
                                 msg->msg_flags&MSG_DONTWAIT, timeo);
-                if (err < 0) {
-                        kfree_skb(skb);
+                if (err < 0)
+                        /* skb is already freed */
                         goto pipe_err;
-                }
+
                 sent += size;
         }
 
diff --git a/net/caif/cfcnfg.c b/net/caif/cfcnfg.c
index 598aafb4cb51..ba9cfd47778a 100644
--- a/net/caif/cfcnfg.c
+++ b/net/caif/cfcnfg.c
@@ -309,7 +309,6 @@ int caif_connect_client(struct net *net, struct caif_connect_request *conn_req,
         int err;
         struct cfctrl_link_param param;
         struct cfcnfg *cfg = get_cfcnfg(net);
-        caif_assert(cfg != NULL);
 
         rcu_read_lock();
         err = caif_connect_req_to_link_param(cfg, conn_req, &param);
diff --git a/net/caif/cfmuxl.c b/net/caif/cfmuxl.c
index b36f24a4c8e7..94b08612a4d8 100644
--- a/net/caif/cfmuxl.c
+++ b/net/caif/cfmuxl.c
@@ -248,7 +248,6 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
 {
         struct cfmuxl *muxl = container_obj(layr);
         struct cflayer *layer;
-        int idx;
 
         rcu_read_lock();
         list_for_each_entry_rcu(layer, &muxl->srvl_list, node) {
@@ -257,14 +256,9 @@ static void cfmuxl_ctrlcmd(struct cflayer *layr, enum caif_ctrlcmd ctrl,
 
                         if ((ctrl == _CAIF_CTRLCMD_PHYIF_DOWN_IND ||
                                 ctrl == CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND) &&
-                                        layer->id != 0) {
-
-                                idx = layer->id % UP_CACHE_SIZE;
-                                spin_lock_bh(&muxl->receive_lock);
-                                RCU_INIT_POINTER(muxl->up_cache[idx], NULL);
-                                list_del_rcu(&layer->node);
-                                spin_unlock_bh(&muxl->receive_lock);
-                        }
+                                        layer->id != 0)
+                                cfmuxl_remove_uplayer(layr, layer->id);
+
                         /* NOTE: ctrlcmd is not allowed to block */
                         layer->ctrlcmd(layer, ctrl, phyid);
                 }
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index 369b41894527..3f79db1b612a 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -1190,6 +1190,8 @@ static noinline_for_stack int ethtool_flash_device(struct net_device *dev,
         if (!dev->ethtool_ops->flash_device)
                 return -EOPNOTSUPP;
 
+        efl.data[ETHTOOL_FLASH_MAX_FILENAME - 1] = 0;
+
         return dev->ethtool_ops->flash_device(dev, &efl);
 }
 
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index aefcd7acbffa..0e950fda9a0a 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -30,6 +30,20 @@ EXPORT_SYMBOL(init_net);
 
 #define INITIAL_NET_GEN_PTRS    13 /* +1 for len +2 for rcu_head */
 
+static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
+
+static struct net_generic *net_alloc_generic(void)
+{
+        struct net_generic *ng;
+        size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
+
+        ng = kzalloc(generic_size, GFP_KERNEL);
+        if (ng)
+                ng->len = max_gen_ptrs;
+
+        return ng;
+}
+
 static int net_assign_generic(struct net *net, int id, void *data)
 {
         struct net_generic *ng, *old_ng;
@@ -43,8 +57,7 @@ static int net_assign_generic(struct net *net, int id, void *data)
         if (old_ng->len >= id)
                 goto assign;
 
-        ng = kzalloc(sizeof(struct net_generic) +
-                        id * sizeof(void *), GFP_KERNEL);
+        ng = net_alloc_generic();
         if (ng == NULL)
                 return -ENOMEM;
 
@@ -59,7 +72,6 @@ static int net_assign_generic(struct net *net, int id, void *data)
          * the old copy for kfree after a grace period.
          */
 
-        ng->len = id;
         memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
 
         rcu_assign_pointer(net->gen, ng);
@@ -161,18 +173,6 @@ out_undo:
         goto out;
 }
 
-static struct net_generic *net_alloc_generic(void)
-{
-        struct net_generic *ng;
-        size_t generic_size = sizeof(struct net_generic) +
-                INITIAL_NET_GEN_PTRS * sizeof(void *);
-
-        ng = kzalloc(generic_size, GFP_KERNEL);
-        if (ng)
-                ng->len = INITIAL_NET_GEN_PTRS;
-
-        return ng;
-}
 
 #ifdef CONFIG_NET_NS
 static struct kmem_cache *net_cachep;
@@ -483,6 +483,7 @@ again:
                         }
                         return error;
                 }
+                max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
         }
         error = __register_pernet_operations(list, ops);
         if (error) {
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 3a9fd4826b75..9ae183a9a381 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -58,11 +58,12 @@ static int get_prioidx(u32 *prio)
 
         spin_lock_irqsave(&prioidx_map_lock, flags);
         prioidx = find_first_zero_bit(prioidx_map, sizeof(unsigned long) * PRIOIDX_SZ);
+        if (prioidx == sizeof(unsigned long) * PRIOIDX_SZ) {
+                spin_unlock_irqrestore(&prioidx_map_lock, flags);
+                return -ENOSPC;
+        }
         set_bit(prioidx, prioidx_map);
         spin_unlock_irqrestore(&prioidx_map_lock, flags);
-        if (prioidx == sizeof(unsigned long) * PRIOIDX_SZ)
-                return -ENOSPC;
-
         atomic_set(&max_prioidx, prioidx);
         *prio = prioidx;
         return 0;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f16444bc6cbb..65aebd450027 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1509,6 +1509,9 @@ errout:
 
         if (send_addr_notify)
                 call_netdevice_notifiers(NETDEV_CHANGEADDR, dev);
+        min_ifinfo_dump_size = max_t(u16, if_nlmsg_size(dev),
+                                     min_ifinfo_dump_size);
+
         return err;
 }
 
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 2e4e24476c4c..19d66cefd7d3 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -123,11 +123,14 @@ again:
                                                 smallest_size = tb->num_owners;
                                                 smallest_rover = rover;
                                                 if (atomic_read(&hashinfo->bsockets) > (high - low) + 1) {
-                                                        spin_unlock(&head->lock);
                                                         snum = smallest_rover;
-                                                        goto have_snum;
+                                                        goto tb_found;
                                                 }
                                         }
+                                        if (!inet_csk(sk)->icsk_af_ops->bind_conflict(sk, tb)) {
+                                                snum = rover;
+                                                goto tb_found;
+                                        }
                                         goto next;
                                 }
                         break;
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index bf9541648b96..0286d78c589c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -422,6 +422,10 @@ static struct ip_tunnel *ipgre_tunnel_locate(struct net *net,
         if (register_netdevice(dev) < 0)
                 goto failed_free;
 
+        /* Can use a lockless transmit, unless we generate output sequences */
+        if (!(nt->parms.o_flags & GRE_SEQ))
+                dev->features |= NETIF_F_LLTX;
+
         dev_hold(dev);
         ipgre_tunnel_link(ign, nt);
         return nt;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 4aa7e9dc0cbb..7a7724da9bff 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -778,7 +778,6 @@ EXPORT_SYMBOL_GPL(net_ipv4_ctl_path);
 static __net_init int ipv4_sysctl_init_net(struct net *net)
 {
         struct ctl_table *table;
-        unsigned long limit;
 
         table = ipv4_net_table;
         if (!net_eq(net, &init_net)) {
@@ -814,11 +813,7 @@ static __net_init int ipv4_sysctl_init_net(struct net *net)
 
         net->ipv4.sysctl_rt_cache_rebuild_count = 4;
 
-        limit = nr_free_buffer_pages() / 8;
-        limit = max(limit, 128UL);
-        net->ipv4.sysctl_tcp_mem[0] = limit / 4 * 3;
-        net->ipv4.sysctl_tcp_mem[1] = limit;
-        net->ipv4.sysctl_tcp_mem[2] = net->ipv4.sysctl_tcp_mem[0] * 2;
+        tcp_init_mem(net);
 
         net->ipv4.ipv4_hdr = register_net_sysctl_table(net,
                         net_ipv4_ctl_path, table);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9bcdec3ad772..37755ccc0e96 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1876,6 +1876,20 @@ void tcp_shutdown(struct sock *sk, int how)
 }
 EXPORT_SYMBOL(tcp_shutdown);
 
+bool tcp_check_oom(struct sock *sk, int shift)
+{
+        bool too_many_orphans, out_of_socket_memory;
+
+        too_many_orphans = tcp_too_many_orphans(sk, shift);
+        out_of_socket_memory = tcp_out_of_memory(sk);
+
+        if (too_many_orphans && net_ratelimit())
+                pr_info("TCP: too many orphaned sockets\n");
+        if (out_of_socket_memory && net_ratelimit())
+                pr_info("TCP: out of memory -- consider tuning tcp_mem\n");
+        return too_many_orphans || out_of_socket_memory;
+}
+
 void tcp_close(struct sock *sk, long timeout)
 {
         struct sk_buff *skb;
@@ -2015,10 +2029,7 @@ adjudge_to_death:
         }
         if (sk->sk_state != TCP_CLOSE) {
                 sk_mem_reclaim(sk);
-                if (tcp_too_many_orphans(sk, 0)) {
-                        if (net_ratelimit())
-                                printk(KERN_INFO "TCP: too many of orphaned "
-                                       "sockets\n");
+                if (tcp_check_oom(sk, 0)) {
                         tcp_set_state(sk, TCP_CLOSE);
                         tcp_send_active_reset(sk, GFP_ATOMIC);
                         NET_INC_STATS_BH(sock_net(sk),
@@ -3216,6 +3227,15 @@ static int __init set_thash_entries(char *str)
 }
 __setup("thash_entries=", set_thash_entries);
 
+void tcp_init_mem(struct net *net)
+{
+        unsigned long limit = nr_free_buffer_pages() / 8;
+        limit = max(limit, 128UL);
+        net->ipv4.sysctl_tcp_mem[0] = limit / 4 * 3;
+        net->ipv4.sysctl_tcp_mem[1] = limit;
+        net->ipv4.sysctl_tcp_mem[2] = net->ipv4.sysctl_tcp_mem[0] * 2;
+}
+
 void __init tcp_init(void)
 {
         struct sk_buff *skb = NULL;
@@ -3276,9 +3296,10 @@ void __init tcp_init(void)
         sysctl_tcp_max_orphans = cnt / 2;
         sysctl_max_syn_backlog = max(128, cnt / 256);
 
+        tcp_init_mem(&init_net);
         /* Set per-socket limits to no more than 1/128 the pressure threshold */
-        limit = ((unsigned long)init_net.ipv4.sysctl_tcp_mem[1])
-                << (PAGE_SHIFT - 7);
+        limit = nr_free_buffer_pages() << (PAGE_SHIFT - 10);
+        limit = max(limit, 128UL);
         max_share = min(4UL*1024*1024, limit);
 
         sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 561550ab3c30..364784a91939 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1141,11 +1141,9 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
         sk_mem_uncharge(sk, len);
         sock_set_flag(sk, SOCK_QUEUE_SHRUNK);
 
-        /* Any change of skb->len requires recalculation of tso
-         * factor and mss.
-         */
+        /* Any change of skb->len requires recalculation of tso factor. */
         if (tcp_skb_pcount(skb) > 1)
-                tcp_set_skb_tso_segs(sk, skb, tcp_current_mss(sk));
+                tcp_set_skb_tso_segs(sk, skb, tcp_skb_mss(skb));
 
         return 0;
 }
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index a516d1e399df..cd2e0723266d 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -77,10 +77,7 @@ static int tcp_out_of_resources(struct sock *sk, int do_reset)
         if (sk->sk_err_soft)
                 shift++;
 
-        if (tcp_too_many_orphans(sk, shift)) {
-                if (net_ratelimit())
-                        printk(KERN_INFO "Out of socket memory\n");
-
+        if (tcp_check_oom(sk, shift)) {
                 /* Catch exceptional cases, when connection requires reset.
                  *      1. Last segment was sent recently. */
                 if ((s32)(tcp_time_stamp - tp->lsndtime) <= TCP_TIMEWAIT_LEN ||
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index d21e7ebd91ca..55670ec3cd0f 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -393,11 +393,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
-        if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
-                goto drop;
-
-        nf_reset(skb);
-
         /* Charge it to the socket, dropping if the queue is full. */
         rc = sock_queue_rcv_skb(sk, skb);
         if (rc < 0)
diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
index b3d76b756cd5..a4643969a13b 100644
--- a/net/mac80211/ibss.c
+++ b/net/mac80211/ibss.c
@@ -106,6 +106,7 @@ static void __ieee80211_sta_join_ibss(struct ieee80211_sub_if_data *sdata,
 
         sdata->drop_unencrypted = capability & WLAN_CAPABILITY_PRIVACY ? 1 : 0;
 
+        local->oper_channel = chan;
         channel_type = ifibss->channel_type;
         if (channel_type > NL80211_CHAN_HT20 &&
             !cfg80211_can_beacon_sec_chan(local->hw.wiphy, chan, channel_type))
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index e47768cb8cb3..01a21c2f6ab3 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1314,6 +1314,7 @@ u32 __ieee80211_recalc_idle(struct ieee80211_local *local)
                         continue;
                 }
                 /* count everything else */
+                sdata->vif.bss_conf.idle = false;
                 count++;
         }
 
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 751409120769..5a5e504a8ffb 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -611,7 +611,7 @@ static void ieee80211_sta_reorder_release(struct ieee80211_hw *hw,
         index = seq_sub(tid_agg_rx->head_seq_num, tid_agg_rx->ssn) %
                                                 tid_agg_rx->buf_size;
         if (!tid_agg_rx->reorder_buf[index] &&
-            tid_agg_rx->stored_mpdu_num > 1) {
+            tid_agg_rx->stored_mpdu_num) {
                 /*
                  * No buffers ready to be released, but check whether any
                  * frames in the reorder buffer have timed out.
diff --git a/net/sunrpc/auth_generic.c b/net/sunrpc/auth_generic.c
index 1426ec3d0a53..75762f346975 100644
--- a/net/sunrpc/auth_generic.c
+++ b/net/sunrpc/auth_generic.c
@@ -92,6 +92,7 @@ generic_create_cred(struct rpc_auth *auth, struct auth_cred *acred, int flags)
         if (gcred->acred.group_info != NULL)
                 get_group_info(gcred->acred.group_info);
         gcred->acred.machine_cred = acred->machine_cred;
+        gcred->acred.principal = acred->principal;
 
         dprintk("RPC:       allocated %s cred %p for uid %d gid %d\n",
                         gcred->acred.machine_cred ? "machine" : "generic",
@@ -123,6 +124,17 @@ generic_destroy_cred(struct rpc_cred *cred)
         call_rcu(&cred->cr_rcu, generic_free_cred_callback);
 }
 
+static int
+machine_cred_match(struct auth_cred *acred, struct generic_cred *gcred, int flags)
+{
+        if (!gcred->acred.machine_cred ||
+            gcred->acred.principal != acred->principal ||
+            gcred->acred.uid != acred->uid ||
+            gcred->acred.gid != acred->gid)
+                return 0;
+        return 1;
+}
+
 /*
  * Match credentials against current process creds.
  */
@@ -132,9 +144,12 @@ generic_match(struct auth_cred *acred, struct rpc_cred *cred, int flags)
         struct generic_cred *gcred = container_of(cred, struct generic_cred, gc_base);
         int i;
 
+        if (acred->machine_cred)
+                return machine_cred_match(acred, gcred, flags);
+
         if (gcred->acred.uid != acred->uid ||
             gcred->acred.gid != acred->gid ||
-            gcred->acred.machine_cred != acred->machine_cred)
+            gcred->acred.machine_cred != 0)
                 goto out_nomatch;
 
         /* Optimisation in the case where pointers are identical... */
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index aad8fb699989..85d3bb7490aa 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1918,7 +1918,7 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 struct sk_buff *skb;
 
                 unix_state_lock(sk);
-                skb = skb_dequeue(&sk->sk_receive_queue);
+                skb = skb_peek(&sk->sk_receive_queue);
                 if (skb == NULL) {
                         unix_sk(sk)->recursion_level = 0;
                         if (copied >= target)
@@ -1958,11 +1958,8 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 if (check_creds) {
                         /* Never glue messages from different writers */
                         if ((UNIXCB(skb).pid  != siocb->scm->pid) ||
-                            (UNIXCB(skb).cred != siocb->scm->cred)) {
-                                skb_queue_head(&sk->sk_receive_queue, skb);
-                                sk->sk_data_ready(sk, skb->len);
+                            (UNIXCB(skb).cred != siocb->scm->cred))
                                 break;
-                        }
                 } else {
                         /* Copy credentials */
                         scm_set_cred(siocb->scm, UNIXCB(skb).pid, UNIXCB(skb).cred);
@@ -1977,8 +1974,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
 
                 chunk = min_t(unsigned int, skb->len, size);
                 if (memcpy_toiovec(msg->msg_iov, skb->data, chunk)) {
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
                         if (copied == 0)
                                 copied = -EFAULT;
                         break;
@@ -1993,13 +1988,10 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         if (UNIXCB(skb).fp)
                                 unix_detach_fds(siocb->scm, skb);
 
-                        /* put the skb back if we didn't use it up.. */
-                        if (skb->len) {
-                                skb_queue_head(&sk->sk_receive_queue, skb);
-                                sk->sk_data_ready(sk, skb->len);
+                        if (skb->len)
                                 break;
-                        }
 
+                        skb_unlink(skb, &sk->sk_receive_queue);
                         consume_skb(skb);
 
                         if (siocb->scm->fp)
@@ -2010,9 +2002,6 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                         if (UNIXCB(skb).fp)
                                 siocb->scm->fp = scm_fp_dup(UNIXCB(skb).fp);
 
-                        /* put message back and return */
-                        skb_queue_head(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
                         break;
                 }
         } while (size);