aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorRobert Richter <robert.richter@amd.com>2008-09-24 05:25:31 -0400
committerRobert Richter <robert.richter@amd.com>2008-09-24 05:25:31 -0400
commitf78e80209cf143be49f268c340431ae9fa3abb74 (patch)
tree820fa64b688099dfdd93d27ba03252738ca5c7e2 /net
parent4c168eaf7ea39f25a45a3d8c7eebc3fedb633a1d (diff)
parent24342c34a022ee90839873d91396045e12ef1090 (diff)
Merge commit 'v2.6.27-rc5' into tip/oprofile
Conflicts: arch/x86/oprofile/nmi_int.c
Diffstat (limited to 'net')
-rw-r--r--net/bluetooth/af_bluetooth.c2
-rw-r--r--net/bluetooth/bnep/core.c2
-rw-r--r--net/bluetooth/hci_sysfs.c376
-rw-r--r--net/bluetooth/l2cap.c2
-rw-r--r--net/bluetooth/rfcomm/core.c2
-rw-r--r--net/bluetooth/sco.c2
-rw-r--r--net/bridge/br_device.c15
-rw-r--r--net/core/datagram.c87
-rw-r--r--net/core/dev.c49
-rw-r--r--net/core/gen_estimator.c9
-rw-r--r--net/core/skbuff.c12
-rw-r--r--net/dccp/input.c12
-rw-r--r--net/ipv4/icmp.c22
-rw-r--r--net/ipv4/netfilter/ipt_addrtype.c2
-rw-r--r--net/ipv4/netfilter/nf_nat_proto_common.c8
-rw-r--r--net/ipv4/route.c100
-rw-r--r--net/ipv4/tcp_output.c6
-rw-r--r--net/ipv6/addrconf.c4
-rw-r--r--net/ipv6/fib6_rules.c3
-rw-r--r--net/ipv6/icmp.c23
-rw-r--r--net/ipv6/ip6_fib.c1
-rw-r--r--net/ipv6/ip6_output.c2
-rw-r--r--net/ipv6/ipv6_sockglue.c4
-rw-r--r--net/ipv6/ndisc.c2
-rw-r--r--net/ipv6/route.c12
-rw-r--r--net/ipv6/sysctl_net_ipv6.c2
-rw-r--r--net/ipv6/xfrm6_policy.c4
-rw-r--r--net/mac80211/debugfs_netdev.c24
-rw-r--r--net/mac80211/ieee80211_i.h6
-rw-r--r--net/mac80211/mesh.c2
-rw-r--r--net/mac80211/mlme.c54
-rw-r--r--net/netfilter/nf_conntrack_netlink.c36
-rw-r--r--net/rfkill/rfkill.c16
-rw-r--r--net/sched/cls_api.c2
-rw-r--r--net/sched/sch_api.c113
-rw-r--r--net/sched/sch_cbq.c10
-rw-r--r--net/sched/sch_generic.c71
-rw-r--r--net/sched/sch_hfsc.c4
-rw-r--r--net/sched/sch_htb.c8
-rw-r--r--net/sched/sch_prio.c4
-rw-r--r--net/sched/sch_tbf.c11
-rw-r--r--net/sctp/auth.c7
-rw-r--r--net/sctp/endpointola.c4
-rw-r--r--net/sctp/ipv6.c3
-rw-r--r--net/sctp/socket.c96
45 files changed, 744 insertions, 492 deletions
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 4e59df5f8e05..1edfdf4c095b 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -456,7 +456,7 @@ static void __exit bt_exit(void)
456subsys_initcall(bt_init); 456subsys_initcall(bt_init);
457module_exit(bt_exit); 457module_exit(bt_exit);
458 458
459MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 459MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
460MODULE_DESCRIPTION("Bluetooth Core ver " VERSION); 460MODULE_DESCRIPTION("Bluetooth Core ver " VERSION);
461MODULE_VERSION(VERSION); 461MODULE_VERSION(VERSION);
462MODULE_LICENSE("GPL"); 462MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 12bba6207a8d..80ba30cf4b68 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -736,7 +736,7 @@ MODULE_PARM_DESC(compress_src, "Compress sources headers");
736module_param(compress_dst, bool, 0644); 736module_param(compress_dst, bool, 0644);
737MODULE_PARM_DESC(compress_dst, "Compress destination headers"); 737MODULE_PARM_DESC(compress_dst, "Compress destination headers");
738 738
739MODULE_AUTHOR("David Libault <david.libault@inventel.fr>, Maxim Krasnyansky <maxk@qualcomm.com>"); 739MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
740MODULE_DESCRIPTION("Bluetooth BNEP ver " VERSION); 740MODULE_DESCRIPTION("Bluetooth BNEP ver " VERSION);
741MODULE_VERSION(VERSION); 741MODULE_VERSION(VERSION);
742MODULE_LICENSE("GPL"); 742MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index c85bf8f678dc..f4f6615cad9f 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -3,8 +3,6 @@
3#include <linux/kernel.h> 3#include <linux/kernel.h>
4#include <linux/init.h> 4#include <linux/init.h>
5 5
6#include <linux/platform_device.h>
7
8#include <net/bluetooth/bluetooth.h> 6#include <net/bluetooth/bluetooth.h>
9#include <net/bluetooth/hci_core.h> 7#include <net/bluetooth/hci_core.h>
10 8
@@ -12,10 +10,164 @@
12#undef BT_DBG 10#undef BT_DBG
13#define BT_DBG(D...) 11#define BT_DBG(D...)
14#endif 12#endif
13
14struct class *bt_class = NULL;
15EXPORT_SYMBOL_GPL(bt_class);
16
15static struct workqueue_struct *btaddconn; 17static struct workqueue_struct *btaddconn;
16static struct workqueue_struct *btdelconn; 18static struct workqueue_struct *btdelconn;
17 19
18static inline char *typetostr(int type) 20static inline char *link_typetostr(int type)
21{
22 switch (type) {
23 case ACL_LINK:
24 return "ACL";
25 case SCO_LINK:
26 return "SCO";
27 case ESCO_LINK:
28 return "eSCO";
29 default:
30 return "UNKNOWN";
31 }
32}
33
34static ssize_t show_link_type(struct device *dev, struct device_attribute *attr, char *buf)
35{
36 struct hci_conn *conn = dev_get_drvdata(dev);
37 return sprintf(buf, "%s\n", link_typetostr(conn->type));
38}
39
40static ssize_t show_link_address(struct device *dev, struct device_attribute *attr, char *buf)
41{
42 struct hci_conn *conn = dev_get_drvdata(dev);
43 bdaddr_t bdaddr;
44 baswap(&bdaddr, &conn->dst);
45 return sprintf(buf, "%s\n", batostr(&bdaddr));
46}
47
48static ssize_t show_link_features(struct device *dev, struct device_attribute *attr, char *buf)
49{
50 struct hci_conn *conn = dev_get_drvdata(dev);
51
52 return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
53 conn->features[0], conn->features[1],
54 conn->features[2], conn->features[3],
55 conn->features[4], conn->features[5],
56 conn->features[6], conn->features[7]);
57}
58
59#define LINK_ATTR(_name,_mode,_show,_store) \
60struct device_attribute link_attr_##_name = __ATTR(_name,_mode,_show,_store)
61
62static LINK_ATTR(type, S_IRUGO, show_link_type, NULL);
63static LINK_ATTR(address, S_IRUGO, show_link_address, NULL);
64static LINK_ATTR(features, S_IRUGO, show_link_features, NULL);
65
66static struct attribute *bt_link_attrs[] = {
67 &link_attr_type.attr,
68 &link_attr_address.attr,
69 &link_attr_features.attr,
70 NULL
71};
72
73static struct attribute_group bt_link_group = {
74 .attrs = bt_link_attrs,
75};
76
77static struct attribute_group *bt_link_groups[] = {
78 &bt_link_group,
79 NULL
80};
81
82static void bt_link_release(struct device *dev)
83{
84 void *data = dev_get_drvdata(dev);
85 kfree(data);
86}
87
88static struct device_type bt_link = {
89 .name = "link",
90 .groups = bt_link_groups,
91 .release = bt_link_release,
92};
93
94static void add_conn(struct work_struct *work)
95{
96 struct hci_conn *conn = container_of(work, struct hci_conn, work);
97
98 flush_workqueue(btdelconn);
99
100 if (device_add(&conn->dev) < 0) {
101 BT_ERR("Failed to register connection device");
102 return;
103 }
104}
105
106void hci_conn_add_sysfs(struct hci_conn *conn)
107{
108 struct hci_dev *hdev = conn->hdev;
109
110 BT_DBG("conn %p", conn);
111
112 conn->dev.type = &bt_link;
113 conn->dev.class = bt_class;
114 conn->dev.parent = &hdev->dev;
115
116 snprintf(conn->dev.bus_id, BUS_ID_SIZE, "%s:%d",
117 hdev->name, conn->handle);
118
119 dev_set_drvdata(&conn->dev, conn);
120
121 device_initialize(&conn->dev);
122
123 INIT_WORK(&conn->work, add_conn);
124
125 queue_work(btaddconn, &conn->work);
126}
127
128/*
129 * The rfcomm tty device will possibly retain even when conn
130 * is down, and sysfs doesn't support move zombie device,
131 * so we should move the device before conn device is destroyed.
132 */
133static int __match_tty(struct device *dev, void *data)
134{
135 return !strncmp(dev->bus_id, "rfcomm", 6);
136}
137
138static void del_conn(struct work_struct *work)
139{
140 struct hci_conn *conn = container_of(work, struct hci_conn, work);
141 struct hci_dev *hdev = conn->hdev;
142
143 while (1) {
144 struct device *dev;
145
146 dev = device_find_child(&conn->dev, NULL, __match_tty);
147 if (!dev)
148 break;
149 device_move(dev, NULL);
150 put_device(dev);
151 }
152
153 device_del(&conn->dev);
154 put_device(&conn->dev);
155 hci_dev_put(hdev);
156}
157
158void hci_conn_del_sysfs(struct hci_conn *conn)
159{
160 BT_DBG("conn %p", conn);
161
162 if (!device_is_registered(&conn->dev))
163 return;
164
165 INIT_WORK(&conn->work, del_conn);
166
167 queue_work(btdelconn, &conn->work);
168}
169
170static inline char *host_typetostr(int type)
19{ 171{
20 switch (type) { 172 switch (type) {
21 case HCI_VIRTUAL: 173 case HCI_VIRTUAL:
@@ -40,7 +192,7 @@ static inline char *typetostr(int type)
40static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf) 192static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf)
41{ 193{
42 struct hci_dev *hdev = dev_get_drvdata(dev); 194 struct hci_dev *hdev = dev_get_drvdata(dev);
43 return sprintf(buf, "%s\n", typetostr(hdev->type)); 195 return sprintf(buf, "%s\n", host_typetostr(hdev->type));
44} 196}
45 197
46static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf) 198static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
@@ -221,183 +373,62 @@ static DEVICE_ATTR(sniff_max_interval, S_IRUGO | S_IWUSR,
221static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR, 373static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR,
222 show_sniff_min_interval, store_sniff_min_interval); 374 show_sniff_min_interval, store_sniff_min_interval);
223 375
224static struct device_attribute *bt_attrs[] = { 376static struct attribute *bt_host_attrs[] = {
225 &dev_attr_type, 377 &dev_attr_type.attr,
226 &dev_attr_name, 378 &dev_attr_name.attr,
227 &dev_attr_class, 379 &dev_attr_class.attr,
228 &dev_attr_address, 380 &dev_attr_address.attr,
229 &dev_attr_features, 381 &dev_attr_features.attr,
230 &dev_attr_manufacturer, 382 &dev_attr_manufacturer.attr,
231 &dev_attr_hci_version, 383 &dev_attr_hci_version.attr,
232 &dev_attr_hci_revision, 384 &dev_attr_hci_revision.attr,
233 &dev_attr_inquiry_cache, 385 &dev_attr_inquiry_cache.attr,
234 &dev_attr_idle_timeout, 386 &dev_attr_idle_timeout.attr,
235 &dev_attr_sniff_max_interval, 387 &dev_attr_sniff_max_interval.attr,
236 &dev_attr_sniff_min_interval, 388 &dev_attr_sniff_min_interval.attr,
237 NULL 389 NULL
238}; 390};
239 391
240static ssize_t show_conn_type(struct device *dev, struct device_attribute *attr, char *buf) 392static struct attribute_group bt_host_group = {
241{ 393 .attrs = bt_host_attrs,
242 struct hci_conn *conn = dev_get_drvdata(dev);
243 return sprintf(buf, "%s\n", conn->type == ACL_LINK ? "ACL" : "SCO");
244}
245
246static ssize_t show_conn_address(struct device *dev, struct device_attribute *attr, char *buf)
247{
248 struct hci_conn *conn = dev_get_drvdata(dev);
249 bdaddr_t bdaddr;
250 baswap(&bdaddr, &conn->dst);
251 return sprintf(buf, "%s\n", batostr(&bdaddr));
252}
253
254static ssize_t show_conn_features(struct device *dev, struct device_attribute *attr, char *buf)
255{
256 struct hci_conn *conn = dev_get_drvdata(dev);
257
258 return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
259 conn->features[0], conn->features[1],
260 conn->features[2], conn->features[3],
261 conn->features[4], conn->features[5],
262 conn->features[6], conn->features[7]);
263}
264
265#define CONN_ATTR(_name,_mode,_show,_store) \
266struct device_attribute conn_attr_##_name = __ATTR(_name,_mode,_show,_store)
267
268static CONN_ATTR(type, S_IRUGO, show_conn_type, NULL);
269static CONN_ATTR(address, S_IRUGO, show_conn_address, NULL);
270static CONN_ATTR(features, S_IRUGO, show_conn_features, NULL);
271
272static struct device_attribute *conn_attrs[] = {
273 &conn_attr_type,
274 &conn_attr_address,
275 &conn_attr_features,
276 NULL
277}; 394};
278 395
279struct class *bt_class = NULL; 396static struct attribute_group *bt_host_groups[] = {
280EXPORT_SYMBOL_GPL(bt_class); 397 &bt_host_group,
281 398 NULL
282static struct bus_type bt_bus = {
283 .name = "bluetooth",
284}; 399};
285 400
286static struct platform_device *bt_platform; 401static void bt_host_release(struct device *dev)
287
288static void bt_release(struct device *dev)
289{ 402{
290 void *data = dev_get_drvdata(dev); 403 void *data = dev_get_drvdata(dev);
291 kfree(data); 404 kfree(data);
292} 405}
293 406
294static void add_conn(struct work_struct *work) 407static struct device_type bt_host = {
295{ 408 .name = "host",
296 struct hci_conn *conn = container_of(work, struct hci_conn, work); 409 .groups = bt_host_groups,
297 int i; 410 .release = bt_host_release,
298 411};
299 flush_workqueue(btdelconn);
300
301 if (device_add(&conn->dev) < 0) {
302 BT_ERR("Failed to register connection device");
303 return;
304 }
305
306 for (i = 0; conn_attrs[i]; i++)
307 if (device_create_file(&conn->dev, conn_attrs[i]) < 0)
308 BT_ERR("Failed to create connection attribute");
309}
310
311void hci_conn_add_sysfs(struct hci_conn *conn)
312{
313 struct hci_dev *hdev = conn->hdev;
314
315 BT_DBG("conn %p", conn);
316
317 conn->dev.bus = &bt_bus;
318 conn->dev.parent = &hdev->dev;
319
320 conn->dev.release = bt_release;
321
322 snprintf(conn->dev.bus_id, BUS_ID_SIZE, "%s:%d",
323 hdev->name, conn->handle);
324
325 dev_set_drvdata(&conn->dev, conn);
326
327 device_initialize(&conn->dev);
328
329 INIT_WORK(&conn->work, add_conn);
330
331 queue_work(btaddconn, &conn->work);
332}
333
334/*
335 * The rfcomm tty device will possibly retain even when conn
336 * is down, and sysfs doesn't support move zombie device,
337 * so we should move the device before conn device is destroyed.
338 */
339static int __match_tty(struct device *dev, void *data)
340{
341 return !strncmp(dev->bus_id, "rfcomm", 6);
342}
343
344static void del_conn(struct work_struct *work)
345{
346 struct hci_conn *conn = container_of(work, struct hci_conn, work);
347 struct hci_dev *hdev = conn->hdev;
348
349 while (1) {
350 struct device *dev;
351
352 dev = device_find_child(&conn->dev, NULL, __match_tty);
353 if (!dev)
354 break;
355 device_move(dev, NULL);
356 put_device(dev);
357 }
358
359 device_del(&conn->dev);
360 put_device(&conn->dev);
361 hci_dev_put(hdev);
362}
363
364void hci_conn_del_sysfs(struct hci_conn *conn)
365{
366 BT_DBG("conn %p", conn);
367
368 if (!device_is_registered(&conn->dev))
369 return;
370
371 INIT_WORK(&conn->work, del_conn);
372
373 queue_work(btdelconn, &conn->work);
374}
375 412
376int hci_register_sysfs(struct hci_dev *hdev) 413int hci_register_sysfs(struct hci_dev *hdev)
377{ 414{
378 struct device *dev = &hdev->dev; 415 struct device *dev = &hdev->dev;
379 unsigned int i;
380 int err; 416 int err;
381 417
382 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type); 418 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
383 419
384 dev->bus = &bt_bus; 420 dev->type = &bt_host;
421 dev->class = bt_class;
385 dev->parent = hdev->parent; 422 dev->parent = hdev->parent;
386 423
387 strlcpy(dev->bus_id, hdev->name, BUS_ID_SIZE); 424 strlcpy(dev->bus_id, hdev->name, BUS_ID_SIZE);
388 425
389 dev->release = bt_release;
390
391 dev_set_drvdata(dev, hdev); 426 dev_set_drvdata(dev, hdev);
392 427
393 err = device_register(dev); 428 err = device_register(dev);
394 if (err < 0) 429 if (err < 0)
395 return err; 430 return err;
396 431
397 for (i = 0; bt_attrs[i]; i++)
398 if (device_create_file(dev, bt_attrs[i]) < 0)
399 BT_ERR("Failed to create device attribute");
400
401 return 0; 432 return 0;
402} 433}
403 434
@@ -410,59 +441,30 @@ void hci_unregister_sysfs(struct hci_dev *hdev)
410 441
411int __init bt_sysfs_init(void) 442int __init bt_sysfs_init(void)
412{ 443{
413 int err;
414
415 btaddconn = create_singlethread_workqueue("btaddconn"); 444 btaddconn = create_singlethread_workqueue("btaddconn");
416 if (!btaddconn) { 445 if (!btaddconn)
417 err = -ENOMEM; 446 return -ENOMEM;
418 goto out;
419 }
420 447
421 btdelconn = create_singlethread_workqueue("btdelconn"); 448 btdelconn = create_singlethread_workqueue("btdelconn");
422 if (!btdelconn) { 449 if (!btdelconn) {
423 err = -ENOMEM; 450 destroy_workqueue(btaddconn);
424 goto out_del; 451 return -ENOMEM;
425 }
426
427 bt_platform = platform_device_register_simple("bluetooth", -1, NULL, 0);
428 if (IS_ERR(bt_platform)) {
429 err = PTR_ERR(bt_platform);
430 goto out_platform;
431 } 452 }
432 453
433 err = bus_register(&bt_bus);
434 if (err < 0)
435 goto out_bus;
436
437 bt_class = class_create(THIS_MODULE, "bluetooth"); 454 bt_class = class_create(THIS_MODULE, "bluetooth");
438 if (IS_ERR(bt_class)) { 455 if (IS_ERR(bt_class)) {
439 err = PTR_ERR(bt_class); 456 destroy_workqueue(btdelconn);
440 goto out_class; 457 destroy_workqueue(btaddconn);
458 return PTR_ERR(bt_class);
441 } 459 }
442 460
443 return 0; 461 return 0;
444
445out_class:
446 bus_unregister(&bt_bus);
447out_bus:
448 platform_device_unregister(bt_platform);
449out_platform:
450 destroy_workqueue(btdelconn);
451out_del:
452 destroy_workqueue(btaddconn);
453out:
454 return err;
455} 462}
456 463
457void bt_sysfs_cleanup(void) 464void bt_sysfs_cleanup(void)
458{ 465{
459 destroy_workqueue(btaddconn); 466 destroy_workqueue(btaddconn);
460
461 destroy_workqueue(btdelconn); 467 destroy_workqueue(btdelconn);
462 468
463 class_destroy(bt_class); 469 class_destroy(bt_class);
464
465 bus_unregister(&bt_bus);
466
467 platform_device_unregister(bt_platform);
468} 470}
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c1239852834a..3396d5bdef1c 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2516,7 +2516,7 @@ EXPORT_SYMBOL(l2cap_load);
2516module_init(l2cap_init); 2516module_init(l2cap_init);
2517module_exit(l2cap_exit); 2517module_exit(l2cap_exit);
2518 2518
2519MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 2519MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2520MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION); 2520MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
2521MODULE_VERSION(VERSION); 2521MODULE_VERSION(VERSION);
2522MODULE_LICENSE("GPL"); 2522MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 6cfc7ba611b3..ba537fae0a4c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2115,7 +2115,7 @@ MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2115module_param(l2cap_mtu, uint, 0644); 2115module_param(l2cap_mtu, uint, 0644);
2116MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection"); 2116MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2117 2117
2118MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 2118MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2119MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION); 2119MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2120MODULE_VERSION(VERSION); 2120MODULE_VERSION(VERSION);
2121MODULE_LICENSE("GPL"); 2121MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 8cda49874868..a16011fedc1d 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -1002,7 +1002,7 @@ module_exit(sco_exit);
1002module_param(disable_esco, bool, 0644); 1002module_param(disable_esco, bool, 0644);
1003MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation"); 1003MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1004 1004
1005MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 1005MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1006MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION); 1006MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
1007MODULE_VERSION(VERSION); 1007MODULE_VERSION(VERSION);
1008MODULE_LICENSE("GPL"); 1008MODULE_LICENSE("GPL");
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 9b58d70b0e7d..4f52c3d50ebe 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -148,11 +148,16 @@ static int br_set_tx_csum(struct net_device *dev, u32 data)
148} 148}
149 149
150static struct ethtool_ops br_ethtool_ops = { 150static struct ethtool_ops br_ethtool_ops = {
151 .get_drvinfo = br_getinfo, 151 .get_drvinfo = br_getinfo,
152 .get_link = ethtool_op_get_link, 152 .get_link = ethtool_op_get_link,
153 .set_sg = br_set_sg, 153 .get_tx_csum = ethtool_op_get_tx_csum,
154 .set_tx_csum = br_set_tx_csum, 154 .set_tx_csum = br_set_tx_csum,
155 .set_tso = br_set_tso, 155 .get_sg = ethtool_op_get_sg,
156 .set_sg = br_set_sg,
157 .get_tso = ethtool_op_get_tso,
158 .set_tso = br_set_tso,
159 .get_ufo = ethtool_op_get_ufo,
160 .get_flags = ethtool_op_get_flags,
156}; 161};
157 162
158void br_dev_setup(struct net_device *dev) 163void br_dev_setup(struct net_device *dev)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index dd61dcad6019..52f577a0f544 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -339,6 +339,93 @@ fault:
339 return -EFAULT; 339 return -EFAULT;
340} 340}
341 341
342/**
343 * skb_copy_datagram_from_iovec - Copy a datagram from an iovec.
344 * @skb: buffer to copy
345 * @offset: offset in the buffer to start copying to
346 * @from: io vector to copy to
347 * @len: amount of data to copy to buffer from iovec
348 *
349 * Returns 0 or -EFAULT.
350 * Note: the iovec is modified during the copy.
351 */
352int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
353 struct iovec *from, int len)
354{
355 int start = skb_headlen(skb);
356 int i, copy = start - offset;
357
358 /* Copy header. */
359 if (copy > 0) {
360 if (copy > len)
361 copy = len;
362 if (memcpy_fromiovec(skb->data + offset, from, copy))
363 goto fault;
364 if ((len -= copy) == 0)
365 return 0;
366 offset += copy;
367 }
368
369 /* Copy paged appendix. Hmm... why does this look so complicated? */
370 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
371 int end;
372
373 WARN_ON(start > offset + len);
374
375 end = start + skb_shinfo(skb)->frags[i].size;
376 if ((copy = end - offset) > 0) {
377 int err;
378 u8 *vaddr;
379 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
380 struct page *page = frag->page;
381
382 if (copy > len)
383 copy = len;
384 vaddr = kmap(page);
385 err = memcpy_fromiovec(vaddr + frag->page_offset +
386 offset - start, from, copy);
387 kunmap(page);
388 if (err)
389 goto fault;
390
391 if (!(len -= copy))
392 return 0;
393 offset += copy;
394 }
395 start = end;
396 }
397
398 if (skb_shinfo(skb)->frag_list) {
399 struct sk_buff *list = skb_shinfo(skb)->frag_list;
400
401 for (; list; list = list->next) {
402 int end;
403
404 WARN_ON(start > offset + len);
405
406 end = start + list->len;
407 if ((copy = end - offset) > 0) {
408 if (copy > len)
409 copy = len;
410 if (skb_copy_datagram_from_iovec(list,
411 offset - start,
412 from, copy))
413 goto fault;
414 if ((len -= copy) == 0)
415 return 0;
416 offset += copy;
417 }
418 start = end;
419 }
420 }
421 if (!len)
422 return 0;
423
424fault:
425 return -EFAULT;
426}
427EXPORT_SYMBOL(skb_copy_datagram_from_iovec);
428
342static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset, 429static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
343 u8 __user *to, int len, 430 u8 __user *to, int len,
344 __wsum *csump) 431 __wsum *csump)
diff --git a/net/core/dev.c b/net/core/dev.c
index 600bb23c4c2e..60c51f765887 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1339,19 +1339,23 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
1339} 1339}
1340 1340
1341 1341
1342void __netif_schedule(struct Qdisc *q) 1342static inline void __netif_reschedule(struct Qdisc *q)
1343{ 1343{
1344 if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state)) { 1344 struct softnet_data *sd;
1345 struct softnet_data *sd; 1345 unsigned long flags;
1346 unsigned long flags;
1347 1346
1348 local_irq_save(flags); 1347 local_irq_save(flags);
1349 sd = &__get_cpu_var(softnet_data); 1348 sd = &__get_cpu_var(softnet_data);
1350 q->next_sched = sd->output_queue; 1349 q->next_sched = sd->output_queue;
1351 sd->output_queue = q; 1350 sd->output_queue = q;
1352 raise_softirq_irqoff(NET_TX_SOFTIRQ); 1351 raise_softirq_irqoff(NET_TX_SOFTIRQ);
1353 local_irq_restore(flags); 1352 local_irq_restore(flags);
1354 } 1353}
1354
1355void __netif_schedule(struct Qdisc *q)
1356{
1357 if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state))
1358 __netif_reschedule(q);
1355} 1359}
1356EXPORT_SYMBOL(__netif_schedule); 1360EXPORT_SYMBOL(__netif_schedule);
1357 1361
@@ -1800,9 +1804,13 @@ gso:
1800 1804
1801 spin_lock(root_lock); 1805 spin_lock(root_lock);
1802 1806
1803 rc = qdisc_enqueue_root(skb, q); 1807 if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, &q->state))) {
1804 qdisc_run(q); 1808 kfree_skb(skb);
1805 1809 rc = NET_XMIT_DROP;
1810 } else {
1811 rc = qdisc_enqueue_root(skb, q);
1812 qdisc_run(q);
1813 }
1806 spin_unlock(root_lock); 1814 spin_unlock(root_lock);
1807 1815
1808 goto out; 1816 goto out;
@@ -1974,15 +1982,17 @@ static void net_tx_action(struct softirq_action *h)
1974 1982
1975 head = head->next_sched; 1983 head = head->next_sched;
1976 1984
1977 smp_mb__before_clear_bit();
1978 clear_bit(__QDISC_STATE_SCHED, &q->state);
1979
1980 root_lock = qdisc_lock(q); 1985 root_lock = qdisc_lock(q);
1981 if (spin_trylock(root_lock)) { 1986 if (spin_trylock(root_lock)) {
1987 smp_mb__before_clear_bit();
1988 clear_bit(__QDISC_STATE_SCHED,
1989 &q->state);
1982 qdisc_run(q); 1990 qdisc_run(q);
1983 spin_unlock(root_lock); 1991 spin_unlock(root_lock);
1984 } else { 1992 } else {
1985 __netif_schedule(q); 1993 if (!test_bit(__QDISC_STATE_DEACTIVATED,
1994 &q->state))
1995 __netif_reschedule(q);
1986 } 1996 }
1987 } 1997 }
1988 } 1998 }
@@ -2084,7 +2094,8 @@ static int ing_filter(struct sk_buff *skb)
2084 q = rxq->qdisc; 2094 q = rxq->qdisc;
2085 if (q != &noop_qdisc) { 2095 if (q != &noop_qdisc) {
2086 spin_lock(qdisc_lock(q)); 2096 spin_lock(qdisc_lock(q));
2087 result = qdisc_enqueue_root(skb, q); 2097 if (likely(!test_bit(__QDISC_STATE_DEACTIVATED, &q->state)))
2098 result = qdisc_enqueue_root(skb, q);
2088 spin_unlock(qdisc_lock(q)); 2099 spin_unlock(qdisc_lock(q));
2089 } 2100 }
2090 2101
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index a89f32fa94f6..57abe8266be1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -99,7 +99,7 @@ struct gen_estimator_head
99 99
100static struct gen_estimator_head elist[EST_MAX_INTERVAL+1]; 100static struct gen_estimator_head elist[EST_MAX_INTERVAL+1];
101 101
102/* Protects against NULL dereference and RCU write-side */ 102/* Protects against NULL dereference */
103static DEFINE_RWLOCK(est_lock); 103static DEFINE_RWLOCK(est_lock);
104 104
105static void est_timer(unsigned long arg) 105static void est_timer(unsigned long arg)
@@ -185,7 +185,6 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
185 est->last_packets = bstats->packets; 185 est->last_packets = bstats->packets;
186 est->avpps = rate_est->pps<<10; 186 est->avpps = rate_est->pps<<10;
187 187
188 write_lock_bh(&est_lock);
189 if (!elist[idx].timer.function) { 188 if (!elist[idx].timer.function) {
190 INIT_LIST_HEAD(&elist[idx].list); 189 INIT_LIST_HEAD(&elist[idx].list);
191 setup_timer(&elist[idx].timer, est_timer, idx); 190 setup_timer(&elist[idx].timer, est_timer, idx);
@@ -195,7 +194,6 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
195 mod_timer(&elist[idx].timer, jiffies + ((HZ/4) << idx)); 194 mod_timer(&elist[idx].timer, jiffies + ((HZ/4) << idx));
196 195
197 list_add_rcu(&est->list, &elist[idx].list); 196 list_add_rcu(&est->list, &elist[idx].list);
198 write_unlock_bh(&est_lock);
199 return 0; 197 return 0;
200} 198}
201 199
@@ -214,6 +212,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
214 * Removes the rate estimator specified by &bstats and &rate_est 212 * Removes the rate estimator specified by &bstats and &rate_est
215 * and deletes the timer. 213 * and deletes the timer.
216 * 214 *
215 * NOTE: Called under rtnl_mutex
217 */ 216 */
218void gen_kill_estimator(struct gnet_stats_basic *bstats, 217void gen_kill_estimator(struct gnet_stats_basic *bstats,
219 struct gnet_stats_rate_est *rate_est) 218 struct gnet_stats_rate_est *rate_est)
@@ -227,17 +226,17 @@ void gen_kill_estimator(struct gnet_stats_basic *bstats,
227 if (!elist[idx].timer.function) 226 if (!elist[idx].timer.function)
228 continue; 227 continue;
229 228
230 write_lock_bh(&est_lock);
231 list_for_each_entry_safe(e, n, &elist[idx].list, list) { 229 list_for_each_entry_safe(e, n, &elist[idx].list, list) {
232 if (e->rate_est != rate_est || e->bstats != bstats) 230 if (e->rate_est != rate_est || e->bstats != bstats)
233 continue; 231 continue;
234 232
233 write_lock_bh(&est_lock);
235 e->bstats = NULL; 234 e->bstats = NULL;
235 write_unlock_bh(&est_lock);
236 236
237 list_del_rcu(&e->list); 237 list_del_rcu(&e->list);
238 call_rcu(&e->e_rcu, __gen_kill_estimator); 238 call_rcu(&e->e_rcu, __gen_kill_estimator);
239 } 239 }
240 write_unlock_bh(&est_lock);
241 } 240 }
242} 241}
243 242
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 84640172d65d..ca1ccdf1ef76 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2256,14 +2256,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
2256 segs = nskb; 2256 segs = nskb;
2257 tail = nskb; 2257 tail = nskb;
2258 2258
2259 nskb->dev = skb->dev; 2259 __copy_skb_header(nskb, skb);
2260 skb_copy_queue_mapping(nskb, skb);
2261 nskb->priority = skb->priority;
2262 nskb->protocol = skb->protocol;
2263 nskb->vlan_tci = skb->vlan_tci;
2264 nskb->dst = dst_clone(skb->dst);
2265 memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
2266 nskb->pkt_type = skb->pkt_type;
2267 nskb->mac_len = skb->mac_len; 2260 nskb->mac_len = skb->mac_len;
2268 2261
2269 skb_reserve(nskb, headroom); 2262 skb_reserve(nskb, headroom);
@@ -2274,6 +2267,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
2274 skb_copy_from_linear_data(skb, skb_put(nskb, doffset), 2267 skb_copy_from_linear_data(skb, skb_put(nskb, doffset),
2275 doffset); 2268 doffset);
2276 if (!sg) { 2269 if (!sg) {
2270 nskb->ip_summed = CHECKSUM_NONE;
2277 nskb->csum = skb_copy_and_csum_bits(skb, offset, 2271 nskb->csum = skb_copy_and_csum_bits(skb, offset,
2278 skb_put(nskb, len), 2272 skb_put(nskb, len),
2279 len, 0); 2273 len, 0);
@@ -2283,8 +2277,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
2283 frag = skb_shinfo(nskb)->frags; 2277 frag = skb_shinfo(nskb)->frags;
2284 k = 0; 2278 k = 0;
2285 2279
2286 nskb->ip_summed = CHECKSUM_PARTIAL;
2287 nskb->csum = skb->csum;
2288 skb_copy_from_linear_data_offset(skb, offset, 2280 skb_copy_from_linear_data_offset(skb, offset,
2289 skb_put(nskb, hsize), hsize); 2281 skb_put(nskb, hsize), hsize);
2290 2282
diff --git a/net/dccp/input.c b/net/dccp/input.c
index df2f110df94a..803933ab396d 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -411,12 +411,6 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
411 struct dccp_sock *dp = dccp_sk(sk); 411 struct dccp_sock *dp = dccp_sk(sk);
412 long tstamp = dccp_timestamp(); 412 long tstamp = dccp_timestamp();
413 413
414 /* Stop the REQUEST timer */
415 inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
416 WARN_ON(sk->sk_send_head == NULL);
417 __kfree_skb(sk->sk_send_head);
418 sk->sk_send_head = NULL;
419
420 if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq, 414 if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
421 dp->dccps_awl, dp->dccps_awh)) { 415 dp->dccps_awl, dp->dccps_awh)) {
422 dccp_pr_debug("invalid ackno: S.AWL=%llu, " 416 dccp_pr_debug("invalid ackno: S.AWL=%llu, "
@@ -441,6 +435,12 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
441 DCCP_ACKVEC_STATE_RECEIVED)) 435 DCCP_ACKVEC_STATE_RECEIVED))
442 goto out_invalid_packet; /* FIXME: change error code */ 436 goto out_invalid_packet; /* FIXME: change error code */
443 437
438 /* Stop the REQUEST timer */
439 inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
440 WARN_ON(sk->sk_send_head == NULL);
441 kfree_skb(sk->sk_send_head);
442 sk->sk_send_head = NULL;
443
444 dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq; 444 dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq;
445 dccp_update_gsr(sk, dp->dccps_isr); 445 dccp_update_gsr(sk, dp->dccps_isr);
446 /* 446 /*
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 860558633b2c..55c355e63234 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -204,18 +204,22 @@ static struct sock *icmp_sk(struct net *net)
204 return net->ipv4.icmp_sk[smp_processor_id()]; 204 return net->ipv4.icmp_sk[smp_processor_id()];
205} 205}
206 206
207static inline int icmp_xmit_lock(struct sock *sk) 207static inline struct sock *icmp_xmit_lock(struct net *net)
208{ 208{
209 struct sock *sk;
210
209 local_bh_disable(); 211 local_bh_disable();
210 212
213 sk = icmp_sk(net);
214
211 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) { 215 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
212 /* This can happen if the output path signals a 216 /* This can happen if the output path signals a
213 * dst_link_failure() for an outgoing ICMP packet. 217 * dst_link_failure() for an outgoing ICMP packet.
214 */ 218 */
215 local_bh_enable(); 219 local_bh_enable();
216 return 1; 220 return NULL;
217 } 221 }
218 return 0; 222 return sk;
219} 223}
220 224
221static inline void icmp_xmit_unlock(struct sock *sk) 225static inline void icmp_xmit_unlock(struct sock *sk)
@@ -354,15 +358,17 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
354 struct ipcm_cookie ipc; 358 struct ipcm_cookie ipc;
355 struct rtable *rt = skb->rtable; 359 struct rtable *rt = skb->rtable;
356 struct net *net = dev_net(rt->u.dst.dev); 360 struct net *net = dev_net(rt->u.dst.dev);
357 struct sock *sk = icmp_sk(net); 361 struct sock *sk;
358 struct inet_sock *inet = inet_sk(sk); 362 struct inet_sock *inet;
359 __be32 daddr; 363 __be32 daddr;
360 364
361 if (ip_options_echo(&icmp_param->replyopts, skb)) 365 if (ip_options_echo(&icmp_param->replyopts, skb))
362 return; 366 return;
363 367
364 if (icmp_xmit_lock(sk)) 368 sk = icmp_xmit_lock(net);
369 if (sk == NULL)
365 return; 370 return;
371 inet = inet_sk(sk);
366 372
367 icmp_param->data.icmph.checksum = 0; 373 icmp_param->data.icmph.checksum = 0;
368 374
@@ -419,7 +425,6 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
419 if (!rt) 425 if (!rt)
420 goto out; 426 goto out;
421 net = dev_net(rt->u.dst.dev); 427 net = dev_net(rt->u.dst.dev);
422 sk = icmp_sk(net);
423 428
424 /* 429 /*
425 * Find the original header. It is expected to be valid, of course. 430 * Find the original header. It is expected to be valid, of course.
@@ -483,7 +488,8 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
483 } 488 }
484 } 489 }
485 490
486 if (icmp_xmit_lock(sk)) 491 sk = icmp_xmit_lock(net);
492 if (sk == NULL)
487 return; 493 return;
488 494
489 /* 495 /*
diff --git a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
index 49587a497229..462a22c97877 100644
--- a/net/ipv4/netfilter/ipt_addrtype.c
+++ b/net/ipv4/netfilter/ipt_addrtype.c
@@ -70,7 +70,7 @@ addrtype_mt_v1(const struct sk_buff *skb, const struct net_device *in,
70 (info->flags & IPT_ADDRTYPE_INVERT_SOURCE); 70 (info->flags & IPT_ADDRTYPE_INVERT_SOURCE);
71 if (ret && info->dest) 71 if (ret && info->dest)
72 ret &= match_type(dev, iph->daddr, info->dest) ^ 72 ret &= match_type(dev, iph->daddr, info->dest) ^
73 (info->flags & IPT_ADDRTYPE_INVERT_DEST); 73 !!(info->flags & IPT_ADDRTYPE_INVERT_DEST);
74 return ret; 74 return ret;
75} 75}
76 76
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/ipv4/netfilter/nf_nat_proto_common.c
index 91537f11273f..6c4f11f51446 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/ipv4/netfilter/nf_nat_proto_common.c
@@ -73,9 +73,13 @@ bool nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
73 range_size = ntohs(range->max.all) - min + 1; 73 range_size = ntohs(range->max.all) - min + 1;
74 } 74 }
75 75
76 off = *rover;
77 if (range->flags & IP_NAT_RANGE_PROTO_RANDOM) 76 if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
78 off = net_random(); 77 off = secure_ipv4_port_ephemeral(tuple->src.u3.ip, tuple->dst.u3.ip,
78 maniptype == IP_NAT_MANIP_SRC
79 ? tuple->dst.u.all
80 : tuple->src.u.all);
81 else
82 off = *rover;
79 83
80 for (i = 0; i < range_size; i++, off++) { 84 for (i = 0; i < range_size; i++, off++) {
81 *portptr = htons(min + off % range_size); 85 *portptr = htons(min + off % range_size);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 16fc6f454a31..6ee5354c9aa1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2914,6 +2914,68 @@ static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
2914 return 0; 2914 return 0;
2915} 2915}
2916 2916
2917static void rt_secret_reschedule(int old)
2918{
2919 struct net *net;
2920 int new = ip_rt_secret_interval;
2921 int diff = new - old;
2922
2923 if (!diff)
2924 return;
2925
2926 rtnl_lock();
2927 for_each_net(net) {
2928 int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
2929
2930 if (!new)
2931 continue;
2932
2933 if (deleted) {
2934 long time = net->ipv4.rt_secret_timer.expires - jiffies;
2935
2936 if (time <= 0 || (time += diff) <= 0)
2937 time = 0;
2938
2939 net->ipv4.rt_secret_timer.expires = time;
2940 } else
2941 net->ipv4.rt_secret_timer.expires = new;
2942
2943 net->ipv4.rt_secret_timer.expires += jiffies;
2944 add_timer(&net->ipv4.rt_secret_timer);
2945 }
2946 rtnl_unlock();
2947}
2948
2949static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
2950 struct file *filp,
2951 void __user *buffer, size_t *lenp,
2952 loff_t *ppos)
2953{
2954 int old = ip_rt_secret_interval;
2955 int ret = proc_dointvec_jiffies(ctl, write, filp, buffer, lenp, ppos);
2956
2957 rt_secret_reschedule(old);
2958
2959 return ret;
2960}
2961
2962static int ipv4_sysctl_rt_secret_interval_strategy(ctl_table *table,
2963 int __user *name,
2964 int nlen,
2965 void __user *oldval,
2966 size_t __user *oldlenp,
2967 void __user *newval,
2968 size_t newlen)
2969{
2970 int old = ip_rt_secret_interval;
2971 int ret = sysctl_jiffies(table, name, nlen, oldval, oldlenp, newval,
2972 newlen);
2973
2974 rt_secret_reschedule(old);
2975
2976 return ret;
2977}
2978
2917static ctl_table ipv4_route_table[] = { 2979static ctl_table ipv4_route_table[] = {
2918 { 2980 {
2919 .ctl_name = NET_IPV4_ROUTE_GC_THRESH, 2981 .ctl_name = NET_IPV4_ROUTE_GC_THRESH,
@@ -3048,20 +3110,29 @@ static ctl_table ipv4_route_table[] = {
3048 .data = &ip_rt_secret_interval, 3110 .data = &ip_rt_secret_interval,
3049 .maxlen = sizeof(int), 3111 .maxlen = sizeof(int),
3050 .mode = 0644, 3112 .mode = 0644,
3051 .proc_handler = &proc_dointvec_jiffies, 3113 .proc_handler = &ipv4_sysctl_rt_secret_interval,
3052 .strategy = &sysctl_jiffies, 3114 .strategy = &ipv4_sysctl_rt_secret_interval_strategy,
3053 }, 3115 },
3054 { .ctl_name = 0 } 3116 { .ctl_name = 0 }
3055}; 3117};
3056 3118
3057static __net_initdata struct ctl_path ipv4_route_path[] = { 3119static struct ctl_table empty[1];
3120
3121static struct ctl_table ipv4_skeleton[] =
3122{
3123 { .procname = "route", .ctl_name = NET_IPV4_ROUTE,
3124 .mode = 0555, .child = ipv4_route_table},
3125 { .procname = "neigh", .ctl_name = NET_IPV4_NEIGH,
3126 .mode = 0555, .child = empty},
3127 { }
3128};
3129
3130static __net_initdata struct ctl_path ipv4_path[] = {
3058 { .procname = "net", .ctl_name = CTL_NET, }, 3131 { .procname = "net", .ctl_name = CTL_NET, },
3059 { .procname = "ipv4", .ctl_name = NET_IPV4, }, 3132 { .procname = "ipv4", .ctl_name = NET_IPV4, },
3060 { .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
3061 { }, 3133 { },
3062}; 3134};
3063 3135
3064
3065static struct ctl_table ipv4_route_flush_table[] = { 3136static struct ctl_table ipv4_route_flush_table[] = {
3066 { 3137 {
3067 .ctl_name = NET_IPV4_ROUTE_FLUSH, 3138 .ctl_name = NET_IPV4_ROUTE_FLUSH,
@@ -3074,6 +3145,13 @@ static struct ctl_table ipv4_route_flush_table[] = {
3074 { .ctl_name = 0 }, 3145 { .ctl_name = 0 },
3075}; 3146};
3076 3147
3148static __net_initdata struct ctl_path ipv4_route_path[] = {
3149 { .procname = "net", .ctl_name = CTL_NET, },
3150 { .procname = "ipv4", .ctl_name = NET_IPV4, },
3151 { .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
3152 { },
3153};
3154
3077static __net_init int sysctl_route_net_init(struct net *net) 3155static __net_init int sysctl_route_net_init(struct net *net)
3078{ 3156{
3079 struct ctl_table *tbl; 3157 struct ctl_table *tbl;
@@ -3126,10 +3204,12 @@ static __net_init int rt_secret_timer_init(struct net *net)
3126 net->ipv4.rt_secret_timer.data = (unsigned long)net; 3204 net->ipv4.rt_secret_timer.data = (unsigned long)net;
3127 init_timer_deferrable(&net->ipv4.rt_secret_timer); 3205 init_timer_deferrable(&net->ipv4.rt_secret_timer);
3128 3206
3129 net->ipv4.rt_secret_timer.expires = 3207 if (ip_rt_secret_interval) {
3130 jiffies + net_random() % ip_rt_secret_interval + 3208 net->ipv4.rt_secret_timer.expires =
3131 ip_rt_secret_interval; 3209 jiffies + net_random() % ip_rt_secret_interval +
3132 add_timer(&net->ipv4.rt_secret_timer); 3210 ip_rt_secret_interval;
3211 add_timer(&net->ipv4.rt_secret_timer);
3212 }
3133 return 0; 3213 return 0;
3134} 3214}
3135 3215
@@ -3223,7 +3303,7 @@ int __init ip_rt_init(void)
3223 */ 3303 */
3224void __init ip_static_sysctl_init(void) 3304void __init ip_static_sysctl_init(void)
3225{ 3305{
3226 register_sysctl_paths(ipv4_route_path, ipv4_route_table); 3306 register_sysctl_paths(ipv4_path, ipv4_skeleton);
3227} 3307}
3228#endif 3308#endif
3229 3309
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a00532de2a8c..8165f5aa8c71 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -468,7 +468,8 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
468 } 468 }
469 if (likely(sysctl_tcp_window_scaling)) { 469 if (likely(sysctl_tcp_window_scaling)) {
470 opts->ws = tp->rx_opt.rcv_wscale; 470 opts->ws = tp->rx_opt.rcv_wscale;
471 size += TCPOLEN_WSCALE_ALIGNED; 471 if(likely(opts->ws))
472 size += TCPOLEN_WSCALE_ALIGNED;
472 } 473 }
473 if (likely(sysctl_tcp_sack)) { 474 if (likely(sysctl_tcp_sack)) {
474 opts->options |= OPTION_SACK_ADVERTISE; 475 opts->options |= OPTION_SACK_ADVERTISE;
@@ -509,7 +510,8 @@ static unsigned tcp_synack_options(struct sock *sk,
509 510
510 if (likely(ireq->wscale_ok)) { 511 if (likely(ireq->wscale_ok)) {
511 opts->ws = ireq->rcv_wscale; 512 opts->ws = ireq->rcv_wscale;
512 size += TCPOLEN_WSCALE_ALIGNED; 513 if(likely(opts->ws))
514 size += TCPOLEN_WSCALE_ALIGNED;
513 } 515 }
514 if (likely(doing_ts)) { 516 if (likely(doing_ts)) {
515 opts->options |= OPTION_TS; 517 opts->options |= OPTION_TS;
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a7842c54f58a..7b6a584b62dd 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1106,13 +1106,12 @@ out:
1106 return ret; 1106 return ret;
1107} 1107}
1108 1108
1109int ipv6_dev_get_saddr(struct net_device *dst_dev, 1109int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
1110 const struct in6_addr *daddr, unsigned int prefs, 1110 const struct in6_addr *daddr, unsigned int prefs,
1111 struct in6_addr *saddr) 1111 struct in6_addr *saddr)
1112{ 1112{
1113 struct ipv6_saddr_score scores[2], 1113 struct ipv6_saddr_score scores[2],
1114 *score = &scores[0], *hiscore = &scores[1]; 1114 *score = &scores[0], *hiscore = &scores[1];
1115 struct net *net = dev_net(dst_dev);
1116 struct ipv6_saddr_dst dst; 1115 struct ipv6_saddr_dst dst;
1117 struct net_device *dev; 1116 struct net_device *dev;
1118 int dst_type; 1117 int dst_type;
@@ -1689,6 +1688,7 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
1689 .fc_dst_len = plen, 1688 .fc_dst_len = plen,
1690 .fc_flags = RTF_UP | flags, 1689 .fc_flags = RTF_UP | flags,
1691 .fc_nlinfo.nl_net = dev_net(dev), 1690 .fc_nlinfo.nl_net = dev_net(dev),
1691 .fc_protocol = RTPROT_KERNEL,
1692 }; 1692 };
1693 1693
1694 ipv6_addr_copy(&cfg.fc_dst, pfx); 1694 ipv6_addr_copy(&cfg.fc_dst, pfx);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 8d05527524e3..f5de3f9dc692 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
93 if (flags & RT6_LOOKUP_F_SRCPREF_COA) 93 if (flags & RT6_LOOKUP_F_SRCPREF_COA)
94 srcprefs |= IPV6_PREFER_SRC_COA; 94 srcprefs |= IPV6_PREFER_SRC_COA;
95 95
96 if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev, 96 if (ipv6_dev_get_saddr(net,
97 ip6_dst_idev(&rt->u.dst)->dev,
97 &flp->fl6_dst, srcprefs, 98 &flp->fl6_dst, srcprefs,
98 &saddr)) 99 &saddr))
99 goto again; 100 goto again;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index abedf95fdf2d..b3157a0cc15d 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -91,19 +91,22 @@ static struct inet6_protocol icmpv6_protocol = {
91 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, 91 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
92}; 92};
93 93
94static __inline__ int icmpv6_xmit_lock(struct sock *sk) 94static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
95{ 95{
96 struct sock *sk;
97
96 local_bh_disable(); 98 local_bh_disable();
97 99
100 sk = icmpv6_sk(net);
98 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) { 101 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
99 /* This can happen if the output path (f.e. SIT or 102 /* This can happen if the output path (f.e. SIT or
100 * ip6ip6 tunnel) signals dst_link_failure() for an 103 * ip6ip6 tunnel) signals dst_link_failure() for an
101 * outgoing ICMP6 packet. 104 * outgoing ICMP6 packet.
102 */ 105 */
103 local_bh_enable(); 106 local_bh_enable();
104 return 1; 107 return NULL;
105 } 108 }
106 return 0; 109 return sk;
107} 110}
108 111
109static __inline__ void icmpv6_xmit_unlock(struct sock *sk) 112static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
@@ -392,11 +395,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
392 fl.fl_icmp_code = code; 395 fl.fl_icmp_code = code;
393 security_skb_classify_flow(skb, &fl); 396 security_skb_classify_flow(skb, &fl);
394 397
395 sk = icmpv6_sk(net); 398 sk = icmpv6_xmit_lock(net);
396 np = inet6_sk(sk); 399 if (sk == NULL)
397
398 if (icmpv6_xmit_lock(sk))
399 return; 400 return;
401 np = inet6_sk(sk);
400 402
401 if (!icmpv6_xrlim_allow(sk, type, &fl)) 403 if (!icmpv6_xrlim_allow(sk, type, &fl))
402 goto out; 404 goto out;
@@ -539,11 +541,10 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
539 fl.fl_icmp_type = ICMPV6_ECHO_REPLY; 541 fl.fl_icmp_type = ICMPV6_ECHO_REPLY;
540 security_skb_classify_flow(skb, &fl); 542 security_skb_classify_flow(skb, &fl);
541 543
542 sk = icmpv6_sk(net); 544 sk = icmpv6_xmit_lock(net);
543 np = inet6_sk(sk); 545 if (sk == NULL)
544
545 if (icmpv6_xmit_lock(sk))
546 return; 546 return;
547 np = inet6_sk(sk);
547 548
548 if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst)) 549 if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
549 fl.oif = np->mcast_oif; 550 fl.oif = np->mcast_oif;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 52dddc25d3e6..29c7c99e69f7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -378,6 +378,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
378 378
379 arg.skb = skb; 379 arg.skb = skb;
380 arg.cb = cb; 380 arg.cb = cb;
381 arg.net = net;
381 w->args = &arg; 382 w->args = &arg;
382 383
383 for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) { 384 for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a4402de425d9..0e844c2736a7 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -934,7 +934,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
934 goto out_err_release; 934 goto out_err_release;
935 935
936 if (ipv6_addr_any(&fl->fl6_src)) { 936 if (ipv6_addr_any(&fl->fl6_src)) {
937 err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev, 937 err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
938 &fl->fl6_dst, 938 &fl->fl6_dst,
939 sk ? inet6_sk(sk)->srcprefs : 0, 939 sk ? inet6_sk(sk)->srcprefs : 0,
940 &fl->fl6_src); 940 &fl->fl6_src);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 741cfcd96f88..4e5eac301f91 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -911,7 +911,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
911 } else { 911 } else {
912 if (np->rxopt.bits.rxinfo) { 912 if (np->rxopt.bits.rxinfo) {
913 struct in6_pktinfo src_info; 913 struct in6_pktinfo src_info;
914 src_info.ipi6_ifindex = np->mcast_oif; 914 src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
915 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr); 915 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
916 put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info); 916 put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
917 } 917 }
@@ -921,7 +921,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
921 } 921 }
922 if (np->rxopt.bits.rxoinfo) { 922 if (np->rxopt.bits.rxoinfo) {
923 struct in6_pktinfo src_info; 923 struct in6_pktinfo src_info;
924 src_info.ipi6_ifindex = np->mcast_oif; 924 src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
925 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr); 925 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
926 put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info); 926 put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
927 } 927 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index beb48e3f038a..f1c62ba0f56b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
549 override = 0; 549 override = 0;
550 in6_ifa_put(ifp); 550 in6_ifa_put(ifp);
551 } else { 551 } else {
552 if (ipv6_dev_get_saddr(dev, daddr, 552 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
553 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs, 553 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
554 &tmpaddr)) 554 &tmpaddr))
555 return; 555 return;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 41b165ffb369..9af6115f0f50 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2106,7 +2106,8 @@ static inline size_t rt6_nlmsg_size(void)
2106 + nla_total_size(sizeof(struct rta_cacheinfo)); 2106 + nla_total_size(sizeof(struct rta_cacheinfo));
2107} 2107}
2108 2108
2109static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt, 2109static int rt6_fill_node(struct net *net,
2110 struct sk_buff *skb, struct rt6_info *rt,
2110 struct in6_addr *dst, struct in6_addr *src, 2111 struct in6_addr *dst, struct in6_addr *src,
2111 int iif, int type, u32 pid, u32 seq, 2112 int iif, int type, u32 pid, u32 seq,
2112 int prefix, int nowait, unsigned int flags) 2113 int prefix, int nowait, unsigned int flags)
@@ -2189,7 +2190,7 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
2189 } else if (dst) { 2190 } else if (dst) {
2190 struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst); 2191 struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
2191 struct in6_addr saddr_buf; 2192 struct in6_addr saddr_buf;
2192 if (ipv6_dev_get_saddr(idev ? idev->dev : NULL, 2193 if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
2193 dst, 0, &saddr_buf) == 0) 2194 dst, 0, &saddr_buf) == 0)
2194 NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf); 2195 NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
2195 } 2196 }
@@ -2234,7 +2235,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
2234 } else 2235 } else
2235 prefix = 0; 2236 prefix = 0;
2236 2237
2237 return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE, 2238 return rt6_fill_node(arg->net,
2239 arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
2238 NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq, 2240 NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
2239 prefix, 0, NLM_F_MULTI); 2241 prefix, 0, NLM_F_MULTI);
2240} 2242}
@@ -2300,7 +2302,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
2300 rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl); 2302 rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl);
2301 skb->dst = &rt->u.dst; 2303 skb->dst = &rt->u.dst;
2302 2304
2303 err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif, 2305 err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
2304 RTM_NEWROUTE, NETLINK_CB(in_skb).pid, 2306 RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
2305 nlh->nlmsg_seq, 0, 0, 0); 2307 nlh->nlmsg_seq, 0, 0, 0);
2306 if (err < 0) { 2308 if (err < 0) {
@@ -2327,7 +2329,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
2327 if (skb == NULL) 2329 if (skb == NULL)
2328 goto errout; 2330 goto errout;
2329 2331
2330 err = rt6_fill_node(skb, rt, NULL, NULL, 0, 2332 err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
2331 event, info->pid, seq, 0, 0, 0); 2333 event, info->pid, seq, 0, 0, 0);
2332 if (err < 0) { 2334 if (err < 0) {
2333 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */ 2335 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index e6dfaeac6be3..587f8f60c489 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -156,7 +156,7 @@ static struct ctl_table_header *ip6_base;
156int ipv6_static_sysctl_register(void) 156int ipv6_static_sysctl_register(void)
157{ 157{
158 static struct ctl_table empty[1]; 158 static struct ctl_table empty[1];
159 ip6_base = register_net_sysctl_rotable(net_ipv6_ctl_path, empty); 159 ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
160 if (ip6_base == NULL) 160 if (ip6_base == NULL)
161 return -ENOMEM; 161 return -ENOMEM;
162 return 0; 162 return 0;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8f1e0543b3c4..08e4cbbe3f04 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
52static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr) 52static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
53{ 53{
54 struct dst_entry *dst; 54 struct dst_entry *dst;
55 struct net_device *dev;
55 56
56 dst = xfrm6_dst_lookup(0, NULL, daddr); 57 dst = xfrm6_dst_lookup(0, NULL, daddr);
57 if (IS_ERR(dst)) 58 if (IS_ERR(dst))
58 return -EHOSTUNREACH; 59 return -EHOSTUNREACH;
59 60
60 ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev, 61 dev = ip6_dst_idev(dst)->dev;
62 ipv6_dev_get_saddr(dev_net(dev), dev,
61 (struct in6_addr *)&daddr->a6, 0, 63 (struct in6_addr *)&daddr->a6, 0,
62 (struct in6_addr *)&saddr->a6); 64 (struct in6_addr *)&saddr->a6);
63 dst_release(dst); 65 dst_release(dst);
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 475f89a8aee1..8165df578c92 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -248,8 +248,8 @@ IEEE80211_IF_WFILE(min_discovery_timeout,
248static void add_sta_files(struct ieee80211_sub_if_data *sdata) 248static void add_sta_files(struct ieee80211_sub_if_data *sdata)
249{ 249{
250 DEBUGFS_ADD(drop_unencrypted, sta); 250 DEBUGFS_ADD(drop_unencrypted, sta);
251 DEBUGFS_ADD(force_unicast_rateidx, ap); 251 DEBUGFS_ADD(force_unicast_rateidx, sta);
252 DEBUGFS_ADD(max_ratectrl_rateidx, ap); 252 DEBUGFS_ADD(max_ratectrl_rateidx, sta);
253 253
254 DEBUGFS_ADD(state, sta); 254 DEBUGFS_ADD(state, sta);
255 DEBUGFS_ADD(bssid, sta); 255 DEBUGFS_ADD(bssid, sta);
@@ -283,8 +283,8 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
283static void add_wds_files(struct ieee80211_sub_if_data *sdata) 283static void add_wds_files(struct ieee80211_sub_if_data *sdata)
284{ 284{
285 DEBUGFS_ADD(drop_unencrypted, wds); 285 DEBUGFS_ADD(drop_unencrypted, wds);
286 DEBUGFS_ADD(force_unicast_rateidx, ap); 286 DEBUGFS_ADD(force_unicast_rateidx, wds);
287 DEBUGFS_ADD(max_ratectrl_rateidx, ap); 287 DEBUGFS_ADD(max_ratectrl_rateidx, wds);
288 288
289 DEBUGFS_ADD(peer, wds); 289 DEBUGFS_ADD(peer, wds);
290} 290}
@@ -292,8 +292,8 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
292static void add_vlan_files(struct ieee80211_sub_if_data *sdata) 292static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
293{ 293{
294 DEBUGFS_ADD(drop_unencrypted, vlan); 294 DEBUGFS_ADD(drop_unencrypted, vlan);
295 DEBUGFS_ADD(force_unicast_rateidx, ap); 295 DEBUGFS_ADD(force_unicast_rateidx, vlan);
296 DEBUGFS_ADD(max_ratectrl_rateidx, ap); 296 DEBUGFS_ADD(max_ratectrl_rateidx, vlan);
297} 297}
298 298
299static void add_monitor_files(struct ieee80211_sub_if_data *sdata) 299static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -381,8 +381,8 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
381static void del_sta_files(struct ieee80211_sub_if_data *sdata) 381static void del_sta_files(struct ieee80211_sub_if_data *sdata)
382{ 382{
383 DEBUGFS_DEL(drop_unencrypted, sta); 383 DEBUGFS_DEL(drop_unencrypted, sta);
384 DEBUGFS_DEL(force_unicast_rateidx, ap); 384 DEBUGFS_DEL(force_unicast_rateidx, sta);
385 DEBUGFS_DEL(max_ratectrl_rateidx, ap); 385 DEBUGFS_DEL(max_ratectrl_rateidx, sta);
386 386
387 DEBUGFS_DEL(state, sta); 387 DEBUGFS_DEL(state, sta);
388 DEBUGFS_DEL(bssid, sta); 388 DEBUGFS_DEL(bssid, sta);
@@ -416,8 +416,8 @@ static void del_ap_files(struct ieee80211_sub_if_data *sdata)
416static void del_wds_files(struct ieee80211_sub_if_data *sdata) 416static void del_wds_files(struct ieee80211_sub_if_data *sdata)
417{ 417{
418 DEBUGFS_DEL(drop_unencrypted, wds); 418 DEBUGFS_DEL(drop_unencrypted, wds);
419 DEBUGFS_DEL(force_unicast_rateidx, ap); 419 DEBUGFS_DEL(force_unicast_rateidx, wds);
420 DEBUGFS_DEL(max_ratectrl_rateidx, ap); 420 DEBUGFS_DEL(max_ratectrl_rateidx, wds);
421 421
422 DEBUGFS_DEL(peer, wds); 422 DEBUGFS_DEL(peer, wds);
423} 423}
@@ -425,8 +425,8 @@ static void del_wds_files(struct ieee80211_sub_if_data *sdata)
425static void del_vlan_files(struct ieee80211_sub_if_data *sdata) 425static void del_vlan_files(struct ieee80211_sub_if_data *sdata)
426{ 426{
427 DEBUGFS_DEL(drop_unencrypted, vlan); 427 DEBUGFS_DEL(drop_unencrypted, vlan);
428 DEBUGFS_DEL(force_unicast_rateidx, ap); 428 DEBUGFS_DEL(force_unicast_rateidx, vlan);
429 DEBUGFS_DEL(max_ratectrl_rateidx, ap); 429 DEBUGFS_DEL(max_ratectrl_rateidx, vlan);
430} 430}
431 431
432static void del_monitor_files(struct ieee80211_sub_if_data *sdata) 432static void del_monitor_files(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ec59345af65b..586a9b49b0fc 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -470,6 +470,8 @@ struct ieee80211_sub_if_data {
470 struct dentry *auth_transaction; 470 struct dentry *auth_transaction;
471 struct dentry *flags; 471 struct dentry *flags;
472 struct dentry *num_beacons_sta; 472 struct dentry *num_beacons_sta;
473 struct dentry *force_unicast_rateidx;
474 struct dentry *max_ratectrl_rateidx;
473 } sta; 475 } sta;
474 struct { 476 struct {
475 struct dentry *drop_unencrypted; 477 struct dentry *drop_unencrypted;
@@ -483,9 +485,13 @@ struct ieee80211_sub_if_data {
483 struct { 485 struct {
484 struct dentry *drop_unencrypted; 486 struct dentry *drop_unencrypted;
485 struct dentry *peer; 487 struct dentry *peer;
488 struct dentry *force_unicast_rateidx;
489 struct dentry *max_ratectrl_rateidx;
486 } wds; 490 } wds;
487 struct { 491 struct {
488 struct dentry *drop_unencrypted; 492 struct dentry *drop_unencrypted;
493 struct dentry *force_unicast_rateidx;
494 struct dentry *max_ratectrl_rateidx;
489 } vlan; 495 } vlan;
490 struct { 496 struct {
491 struct dentry *mode; 497 struct dentry *mode;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index b5933b271491..35f2f95f2fa7 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -383,7 +383,7 @@ errcopy:
383 hlist_for_each_safe(p, q, &newtbl->hash_buckets[i]) 383 hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
384 tbl->free_node(p, 0); 384 tbl->free_node(p, 0);
385 } 385 }
386 __mesh_table_free(tbl); 386 __mesh_table_free(newtbl);
387endgrow: 387endgrow:
388 return NULL; 388 return NULL;
389} 389}
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e1d11c9b6729..9bb68c6a8f44 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -478,51 +478,21 @@ int ieee80211_ht_addt_info_ie_to_ht_bss_info(
478static void ieee80211_sta_send_associnfo(struct net_device *dev, 478static void ieee80211_sta_send_associnfo(struct net_device *dev,
479 struct ieee80211_if_sta *ifsta) 479 struct ieee80211_if_sta *ifsta)
480{ 480{
481 char *buf;
482 size_t len;
483 int i;
484 union iwreq_data wrqu; 481 union iwreq_data wrqu;
485 482
486 if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
487 return;
488
489 buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
490 ifsta->assocresp_ies_len), GFP_KERNEL);
491 if (!buf)
492 return;
493
494 len = sprintf(buf, "ASSOCINFO(");
495 if (ifsta->assocreq_ies) { 483 if (ifsta->assocreq_ies) {
496 len += sprintf(buf + len, "ReqIEs="); 484 memset(&wrqu, 0, sizeof(wrqu));
497 for (i = 0; i < ifsta->assocreq_ies_len; i++) { 485 wrqu.data.length = ifsta->assocreq_ies_len;
498 len += sprintf(buf + len, "%02x", 486 wireless_send_event(dev, IWEVASSOCREQIE, &wrqu,
499 ifsta->assocreq_ies[i]); 487 ifsta->assocreq_ies);
500 }
501 } 488 }
502 if (ifsta->assocresp_ies) {
503 if (ifsta->assocreq_ies)
504 len += sprintf(buf + len, " ");
505 len += sprintf(buf + len, "RespIEs=");
506 for (i = 0; i < ifsta->assocresp_ies_len; i++) {
507 len += sprintf(buf + len, "%02x",
508 ifsta->assocresp_ies[i]);
509 }
510 }
511 len += sprintf(buf + len, ")");
512 489
513 if (len > IW_CUSTOM_MAX) { 490 if (ifsta->assocresp_ies) {
514 len = sprintf(buf, "ASSOCRESPIE="); 491 memset(&wrqu, 0, sizeof(wrqu));
515 for (i = 0; i < ifsta->assocresp_ies_len; i++) { 492 wrqu.data.length = ifsta->assocresp_ies_len;
516 len += sprintf(buf + len, "%02x", 493 wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu,
517 ifsta->assocresp_ies[i]); 494 ifsta->assocresp_ies);
518 }
519 } 495 }
520
521 memset(&wrqu, 0, sizeof(wrqu));
522 wrqu.data.length = len;
523 wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
524
525 kfree(buf);
526} 496}
527 497
528 498
@@ -813,7 +783,7 @@ static void ieee80211_send_assoc(struct net_device *dev,
813 } 783 }
814 } 784 }
815 785
816 if (count == 8) { 786 if (rates_len > count) {
817 pos = skb_put(skb, rates_len - count + 2); 787 pos = skb_put(skb, rates_len - count + 2);
818 *pos++ = WLAN_EID_EXT_SUPP_RATES; 788 *pos++ = WLAN_EID_EXT_SUPP_RATES;
819 *pos++ = rates_len - count; 789 *pos++ = rates_len - count;
@@ -2103,6 +2073,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2103 rcu_read_unlock(); 2073 rcu_read_unlock();
2104 return; 2074 return;
2105 } 2075 }
2076 /* update new sta with its last rx activity */
2077 sta->last_rx = jiffies;
2106 } 2078 }
2107 2079
2108 /* 2080 /*
@@ -2866,7 +2838,7 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
2866 jiffies); 2838 jiffies);
2867#endif /* CONFIG_MAC80211_IBSS_DEBUG */ 2839#endif /* CONFIG_MAC80211_IBSS_DEBUG */
2868 if (beacon_timestamp > rx_timestamp) { 2840 if (beacon_timestamp > rx_timestamp) {
2869#ifndef CONFIG_MAC80211_IBSS_DEBUG 2841#ifdef CONFIG_MAC80211_IBSS_DEBUG
2870 printk(KERN_DEBUG "%s: beacon TSF higher than " 2842 printk(KERN_DEBUG "%s: beacon TSF higher than "
2871 "local TSF - IBSS merge with BSSID %s\n", 2843 "local TSF - IBSS merge with BSSID %s\n",
2872 dev->name, print_mac(mac, mgmt->bssid)); 2844 dev->name, print_mac(mac, mgmt->bssid));
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 105a616c5c78..a8752031adcb 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -968,7 +968,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
968 /* need to zero data of old helper */ 968 /* need to zero data of old helper */
969 memset(&help->help, 0, sizeof(help->help)); 969 memset(&help->help, 0, sizeof(help->help));
970 } else { 970 } else {
971 help = nf_ct_helper_ext_add(ct, GFP_KERNEL); 971 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
972 if (help == NULL) 972 if (help == NULL)
973 return -ENOMEM; 973 return -ENOMEM;
974 } 974 }
@@ -1136,16 +1136,33 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
1136 ct->timeout.expires = jiffies + ct->timeout.expires * HZ; 1136 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
1137 ct->status |= IPS_CONFIRMED; 1137 ct->status |= IPS_CONFIRMED;
1138 1138
1139 rcu_read_lock();
1140 helper = __nf_ct_helper_find(rtuple);
1141 if (helper) {
1142 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1143 if (help == NULL) {
1144 rcu_read_unlock();
1145 err = -ENOMEM;
1146 goto err;
1147 }
1148 /* not in hash table yet so not strictly necessary */
1149 rcu_assign_pointer(help->helper, helper);
1150 }
1151
1139 if (cda[CTA_STATUS]) { 1152 if (cda[CTA_STATUS]) {
1140 err = ctnetlink_change_status(ct, cda); 1153 err = ctnetlink_change_status(ct, cda);
1141 if (err < 0) 1154 if (err < 0) {
1155 rcu_read_unlock();
1142 goto err; 1156 goto err;
1157 }
1143 } 1158 }
1144 1159
1145 if (cda[CTA_PROTOINFO]) { 1160 if (cda[CTA_PROTOINFO]) {
1146 err = ctnetlink_change_protoinfo(ct, cda); 1161 err = ctnetlink_change_protoinfo(ct, cda);
1147 if (err < 0) 1162 if (err < 0) {
1163 rcu_read_unlock();
1148 goto err; 1164 goto err;
1165 }
1149 } 1166 }
1150 1167
1151 nf_ct_acct_ext_add(ct, GFP_KERNEL); 1168 nf_ct_acct_ext_add(ct, GFP_KERNEL);
@@ -1155,19 +1172,6 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
1155 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK])); 1172 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1156#endif 1173#endif
1157 1174
1158 rcu_read_lock();
1159 helper = __nf_ct_helper_find(rtuple);
1160 if (helper) {
1161 help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
1162 if (help == NULL) {
1163 rcu_read_unlock();
1164 err = -ENOMEM;
1165 goto err;
1166 }
1167 /* not in hash table yet so not strictly necessary */
1168 rcu_assign_pointer(help->helper, helper);
1169 }
1170
1171 /* setup master conntrack: this is a confirmed expectation */ 1175 /* setup master conntrack: this is a confirmed expectation */
1172 if (master_ct) { 1176 if (master_ct) {
1173 __set_bit(IPS_EXPECTED_BIT, &ct->status); 1177 __set_bit(IPS_EXPECTED_BIT, &ct->status);
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index d2d45655cd1a..74aecc098bad 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -150,6 +150,8 @@ static void update_rfkill_state(struct rfkill *rfkill)
150 * calls and handling all the red tape such as issuing notifications 150 * calls and handling all the red tape such as issuing notifications
151 * if the call is successful. 151 * if the call is successful.
152 * 152 *
153 * Suspended devices are not touched at all, and -EAGAIN is returned.
154 *
153 * Note that the @force parameter cannot override a (possibly cached) 155 * Note that the @force parameter cannot override a (possibly cached)
154 * state of RFKILL_STATE_HARD_BLOCKED. Any device making use of 156 * state of RFKILL_STATE_HARD_BLOCKED. Any device making use of
155 * RFKILL_STATE_HARD_BLOCKED implements either get_state() or 157 * RFKILL_STATE_HARD_BLOCKED implements either get_state() or
@@ -168,6 +170,9 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
168 int retval = 0; 170 int retval = 0;
169 enum rfkill_state oldstate, newstate; 171 enum rfkill_state oldstate, newstate;
170 172
173 if (unlikely(rfkill->dev.power.power_state.event & PM_EVENT_SLEEP))
174 return -EBUSY;
175
171 oldstate = rfkill->state; 176 oldstate = rfkill->state;
172 177
173 if (rfkill->get_state && !force && 178 if (rfkill->get_state && !force &&
@@ -214,7 +219,7 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
214 * 219 *
215 * This function toggles the state of all switches of given type, 220 * This function toggles the state of all switches of given type,
216 * unless a specific switch is claimed by userspace (in which case, 221 * unless a specific switch is claimed by userspace (in which case,
217 * that switch is left alone). 222 * that switch is left alone) or suspended.
218 */ 223 */
219void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state) 224void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
220{ 225{
@@ -239,8 +244,8 @@ EXPORT_SYMBOL(rfkill_switch_all);
239/** 244/**
240 * rfkill_epo - emergency power off all transmitters 245 * rfkill_epo - emergency power off all transmitters
241 * 246 *
242 * This kicks all rfkill devices to RFKILL_STATE_SOFT_BLOCKED, ignoring 247 * This kicks all non-suspended rfkill devices to RFKILL_STATE_SOFT_BLOCKED,
243 * everything in its path but rfkill_mutex and rfkill->mutex. 248 * ignoring everything in its path but rfkill_mutex and rfkill->mutex.
244 */ 249 */
245void rfkill_epo(void) 250void rfkill_epo(void)
246{ 251{
@@ -372,7 +377,7 @@ static ssize_t rfkill_claim_show(struct device *dev,
372{ 377{
373 struct rfkill *rfkill = to_rfkill(dev); 378 struct rfkill *rfkill = to_rfkill(dev);
374 379
375 return sprintf(buf, "%d", rfkill->user_claim); 380 return sprintf(buf, "%d\n", rfkill->user_claim);
376} 381}
377 382
378static ssize_t rfkill_claim_store(struct device *dev, 383static ssize_t rfkill_claim_store(struct device *dev,
@@ -458,13 +463,14 @@ static int rfkill_resume(struct device *dev)
458 if (dev->power.power_state.event != PM_EVENT_ON) { 463 if (dev->power.power_state.event != PM_EVENT_ON) {
459 mutex_lock(&rfkill->mutex); 464 mutex_lock(&rfkill->mutex);
460 465
466 dev->power.power_state.event = PM_EVENT_ON;
467
461 /* restore radio state AND notify everybody */ 468 /* restore radio state AND notify everybody */
462 rfkill_toggle_radio(rfkill, rfkill->state, 1); 469 rfkill_toggle_radio(rfkill, rfkill->state, 1);
463 470
464 mutex_unlock(&rfkill->mutex); 471 mutex_unlock(&rfkill->mutex);
465 } 472 }
466 473
467 dev->power.power_state = PMSG_ON;
468 return 0; 474 return 0;
469} 475}
470#else 476#else
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index d2b6f54a6261..5cafdd4c8018 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -280,7 +280,7 @@ replay:
280 if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) { 280 if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
281 spin_lock_bh(root_lock); 281 spin_lock_bh(root_lock);
282 *back = tp->next; 282 *back = tp->next;
283 spin_lock_bh(root_lock); 283 spin_unlock_bh(root_lock);
284 284
285 tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER); 285 tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER);
286 tcf_destroy(tp); 286 tcf_destroy(tp);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c25465e5607a..506b709510b6 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -27,6 +27,7 @@
27#include <linux/kmod.h> 27#include <linux/kmod.h>
28#include <linux/list.h> 28#include <linux/list.h>
29#include <linux/hrtimer.h> 29#include <linux/hrtimer.h>
30#include <linux/lockdep.h>
30 31
31#include <net/net_namespace.h> 32#include <net/net_namespace.h>
32#include <net/sock.h> 33#include <net/sock.h>
@@ -198,19 +199,53 @@ struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
198 return NULL; 199 return NULL;
199} 200}
200 201
202/*
203 * This lock is needed until some qdiscs stop calling qdisc_tree_decrease_qlen()
204 * without rtnl_lock(); currently hfsc_dequeue(), netem_dequeue(), tbf_dequeue()
205 */
206static DEFINE_SPINLOCK(qdisc_list_lock);
207
208static void qdisc_list_add(struct Qdisc *q)
209{
210 if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
211 spin_lock_bh(&qdisc_list_lock);
212 list_add_tail(&q->list, &qdisc_root_sleeping(q)->list);
213 spin_unlock_bh(&qdisc_list_lock);
214 }
215}
216
217void qdisc_list_del(struct Qdisc *q)
218{
219 if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
220 spin_lock_bh(&qdisc_list_lock);
221 list_del(&q->list);
222 spin_unlock_bh(&qdisc_list_lock);
223 }
224}
225EXPORT_SYMBOL(qdisc_list_del);
226
201struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle) 227struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
202{ 228{
203 unsigned int i; 229 unsigned int i;
230 struct Qdisc *q;
231
232 spin_lock_bh(&qdisc_list_lock);
204 233
205 for (i = 0; i < dev->num_tx_queues; i++) { 234 for (i = 0; i < dev->num_tx_queues; i++) {
206 struct netdev_queue *txq = netdev_get_tx_queue(dev, i); 235 struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
207 struct Qdisc *q, *txq_root = txq->qdisc_sleeping; 236 struct Qdisc *txq_root = txq->qdisc_sleeping;
208 237
209 q = qdisc_match_from_root(txq_root, handle); 238 q = qdisc_match_from_root(txq_root, handle);
210 if (q) 239 if (q)
211 return q; 240 goto unlock;
212 } 241 }
213 return qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle); 242
243 q = qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle);
244
245unlock:
246 spin_unlock_bh(&qdisc_list_lock);
247
248 return q;
214} 249}
215 250
216static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid) 251static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
@@ -331,7 +366,7 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
331 if (!s || tsize != s->tsize || (!tab && tsize > 0)) 366 if (!s || tsize != s->tsize || (!tab && tsize > 0))
332 return ERR_PTR(-EINVAL); 367 return ERR_PTR(-EINVAL);
333 368
334 spin_lock_bh(&qdisc_stab_lock); 369 spin_lock(&qdisc_stab_lock);
335 370
336 list_for_each_entry(stab, &qdisc_stab_list, list) { 371 list_for_each_entry(stab, &qdisc_stab_list, list) {
337 if (memcmp(&stab->szopts, s, sizeof(*s))) 372 if (memcmp(&stab->szopts, s, sizeof(*s)))
@@ -339,11 +374,11 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
339 if (tsize > 0 && memcmp(stab->data, tab, tsize * sizeof(u16))) 374 if (tsize > 0 && memcmp(stab->data, tab, tsize * sizeof(u16)))
340 continue; 375 continue;
341 stab->refcnt++; 376 stab->refcnt++;
342 spin_unlock_bh(&qdisc_stab_lock); 377 spin_unlock(&qdisc_stab_lock);
343 return stab; 378 return stab;
344 } 379 }
345 380
346 spin_unlock_bh(&qdisc_stab_lock); 381 spin_unlock(&qdisc_stab_lock);
347 382
348 stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL); 383 stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
349 if (!stab) 384 if (!stab)
@@ -354,9 +389,9 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
354 if (tsize > 0) 389 if (tsize > 0)
355 memcpy(stab->data, tab, tsize * sizeof(u16)); 390 memcpy(stab->data, tab, tsize * sizeof(u16));
356 391
357 spin_lock_bh(&qdisc_stab_lock); 392 spin_lock(&qdisc_stab_lock);
358 list_add_tail(&stab->list, &qdisc_stab_list); 393 list_add_tail(&stab->list, &qdisc_stab_list);
359 spin_unlock_bh(&qdisc_stab_lock); 394 spin_unlock(&qdisc_stab_lock);
360 395
361 return stab; 396 return stab;
362} 397}
@@ -366,14 +401,14 @@ void qdisc_put_stab(struct qdisc_size_table *tab)
366 if (!tab) 401 if (!tab)
367 return; 402 return;
368 403
369 spin_lock_bh(&qdisc_stab_lock); 404 spin_lock(&qdisc_stab_lock);
370 405
371 if (--tab->refcnt == 0) { 406 if (--tab->refcnt == 0) {
372 list_del(&tab->list); 407 list_del(&tab->list);
373 kfree(tab); 408 kfree(tab);
374 } 409 }
375 410
376 spin_unlock_bh(&qdisc_stab_lock); 411 spin_unlock(&qdisc_stab_lock);
377} 412}
378EXPORT_SYMBOL(qdisc_put_stab); 413EXPORT_SYMBOL(qdisc_put_stab);
379 414
@@ -426,7 +461,7 @@ static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
426 461
427 wd->qdisc->flags &= ~TCQ_F_THROTTLED; 462 wd->qdisc->flags &= ~TCQ_F_THROTTLED;
428 smp_wmb(); 463 smp_wmb();
429 __netif_schedule(wd->qdisc); 464 __netif_schedule(qdisc_root(wd->qdisc));
430 465
431 return HRTIMER_NORESTART; 466 return HRTIMER_NORESTART;
432} 467}
@@ -443,6 +478,10 @@ void qdisc_watchdog_schedule(struct qdisc_watchdog *wd, psched_time_t expires)
443{ 478{
444 ktime_t time; 479 ktime_t time;
445 480
481 if (test_bit(__QDISC_STATE_DEACTIVATED,
482 &qdisc_root_sleeping(wd->qdisc)->state))
483 return;
484
446 wd->qdisc->flags |= TCQ_F_THROTTLED; 485 wd->qdisc->flags |= TCQ_F_THROTTLED;
447 time = ktime_set(0, 0); 486 time = ktime_set(0, 0);
448 time = ktime_add_ns(time, PSCHED_US2NS(expires)); 487 time = ktime_add_ns(time, PSCHED_US2NS(expires));
@@ -585,7 +624,7 @@ static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
585 struct Qdisc *oqdisc = dev_queue->qdisc_sleeping; 624 struct Qdisc *oqdisc = dev_queue->qdisc_sleeping;
586 spinlock_t *root_lock; 625 spinlock_t *root_lock;
587 626
588 root_lock = qdisc_root_lock(oqdisc); 627 root_lock = qdisc_lock(oqdisc);
589 spin_lock_bh(root_lock); 628 spin_lock_bh(root_lock);
590 629
591 /* Prune old scheduler */ 630 /* Prune old scheduler */
@@ -596,7 +635,7 @@ static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
596 if (qdisc == NULL) 635 if (qdisc == NULL)
597 qdisc = &noop_qdisc; 636 qdisc = &noop_qdisc;
598 dev_queue->qdisc_sleeping = qdisc; 637 dev_queue->qdisc_sleeping = qdisc;
599 dev_queue->qdisc = &noop_qdisc; 638 rcu_assign_pointer(dev_queue->qdisc, &noop_qdisc);
600 639
601 spin_unlock_bh(root_lock); 640 spin_unlock_bh(root_lock);
602 641
@@ -637,11 +676,8 @@ static void notify_and_destroy(struct sk_buff *skb, struct nlmsghdr *n, u32 clid
637 if (new || old) 676 if (new || old)
638 qdisc_notify(skb, n, clid, old, new); 677 qdisc_notify(skb, n, clid, old, new);
639 678
640 if (old) { 679 if (old)
641 spin_lock_bh(&old->q.lock);
642 qdisc_destroy(old); 680 qdisc_destroy(old);
643 spin_unlock_bh(&old->q.lock);
644 }
645} 681}
646 682
647/* Graft qdisc "new" to class "classid" of qdisc "parent" or 683/* Graft qdisc "new" to class "classid" of qdisc "parent" or
@@ -707,6 +743,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
707 return err; 743 return err;
708} 744}
709 745
746/* lockdep annotation is needed for ingress; egress gets it only for name */
747static struct lock_class_key qdisc_tx_lock;
748static struct lock_class_key qdisc_rx_lock;
749
710/* 750/*
711 Allocate and initialize new qdisc. 751 Allocate and initialize new qdisc.
712 752
@@ -767,6 +807,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
767 if (handle == TC_H_INGRESS) { 807 if (handle == TC_H_INGRESS) {
768 sch->flags |= TCQ_F_INGRESS; 808 sch->flags |= TCQ_F_INGRESS;
769 handle = TC_H_MAKE(TC_H_INGRESS, 0); 809 handle = TC_H_MAKE(TC_H_INGRESS, 0);
810 lockdep_set_class(qdisc_lock(sch), &qdisc_rx_lock);
770 } else { 811 } else {
771 if (handle == 0) { 812 if (handle == 0) {
772 handle = qdisc_alloc_handle(dev); 813 handle = qdisc_alloc_handle(dev);
@@ -774,6 +815,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
774 if (handle == 0) 815 if (handle == 0)
775 goto err_out3; 816 goto err_out3;
776 } 817 }
818 lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
777 } 819 }
778 820
779 sch->handle = handle; 821 sch->handle = handle;
@@ -788,9 +830,16 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
788 sch->stab = stab; 830 sch->stab = stab;
789 } 831 }
790 if (tca[TCA_RATE]) { 832 if (tca[TCA_RATE]) {
833 spinlock_t *root_lock;
834
835 if ((sch->parent != TC_H_ROOT) &&
836 !(sch->flags & TCQ_F_INGRESS))
837 root_lock = qdisc_root_sleeping_lock(sch);
838 else
839 root_lock = qdisc_lock(sch);
840
791 err = gen_new_estimator(&sch->bstats, &sch->rate_est, 841 err = gen_new_estimator(&sch->bstats, &sch->rate_est,
792 qdisc_root_lock(sch), 842 root_lock, tca[TCA_RATE]);
793 tca[TCA_RATE]);
794 if (err) { 843 if (err) {
795 /* 844 /*
796 * Any broken qdiscs that would require 845 * Any broken qdiscs that would require
@@ -802,8 +851,8 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
802 goto err_out3; 851 goto err_out3;
803 } 852 }
804 } 853 }
805 if ((parent != TC_H_ROOT) && !(sch->flags & TCQ_F_INGRESS)) 854
806 list_add_tail(&sch->list, &dev_queue->qdisc_sleeping->list); 855 qdisc_list_add(sch);
807 856
808 return sch; 857 return sch;
809 } 858 }
@@ -842,7 +891,8 @@ static int qdisc_change(struct Qdisc *sch, struct nlattr **tca)
842 891
843 if (tca[TCA_RATE]) 892 if (tca[TCA_RATE])
844 gen_replace_estimator(&sch->bstats, &sch->rate_est, 893 gen_replace_estimator(&sch->bstats, &sch->rate_est,
845 qdisc_root_lock(sch), tca[TCA_RATE]); 894 qdisc_root_sleeping_lock(sch),
895 tca[TCA_RATE]);
846 return 0; 896 return 0;
847} 897}
848 898
@@ -1084,20 +1134,13 @@ create_n_graft:
1084 } 1134 }
1085 1135
1086graft: 1136graft:
1087 if (1) { 1137 err = qdisc_graft(dev, p, skb, n, clid, q, NULL);
1088 spinlock_t *root_lock; 1138 if (err) {
1089 1139 if (q)
1090 err = qdisc_graft(dev, p, skb, n, clid, q, NULL); 1140 qdisc_destroy(q);
1091 if (err) { 1141 return err;
1092 if (q) {
1093 root_lock = qdisc_root_lock(q);
1094 spin_lock_bh(root_lock);
1095 qdisc_destroy(q);
1096 spin_unlock_bh(root_lock);
1097 }
1098 return err;
1099 }
1100 } 1142 }
1143
1101 return 0; 1144 return 0;
1102} 1145}
1103 1146
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 4e261ce62f48..9b720adedead 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -521,6 +521,10 @@ static void cbq_ovl_delay(struct cbq_class *cl)
521 struct cbq_sched_data *q = qdisc_priv(cl->qdisc); 521 struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
522 psched_tdiff_t delay = cl->undertime - q->now; 522 psched_tdiff_t delay = cl->undertime - q->now;
523 523
524 if (test_bit(__QDISC_STATE_DEACTIVATED,
525 &qdisc_root_sleeping(cl->qdisc)->state))
526 return;
527
524 if (!cl->delayed) { 528 if (!cl->delayed) {
525 psched_time_t sched = q->now; 529 psched_time_t sched = q->now;
526 ktime_t expires; 530 ktime_t expires;
@@ -654,7 +658,7 @@ static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
654 } 658 }
655 659
656 sch->flags &= ~TCQ_F_THROTTLED; 660 sch->flags &= ~TCQ_F_THROTTLED;
657 __netif_schedule(sch); 661 __netif_schedule(qdisc_root(sch));
658 return HRTIMER_NORESTART; 662 return HRTIMER_NORESTART;
659} 663}
660 664
@@ -1835,7 +1839,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
1835 1839
1836 if (tca[TCA_RATE]) 1840 if (tca[TCA_RATE])
1837 gen_replace_estimator(&cl->bstats, &cl->rate_est, 1841 gen_replace_estimator(&cl->bstats, &cl->rate_est,
1838 qdisc_root_lock(sch), 1842 qdisc_root_sleeping_lock(sch),
1839 tca[TCA_RATE]); 1843 tca[TCA_RATE]);
1840 return 0; 1844 return 0;
1841 } 1845 }
@@ -1926,7 +1930,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
1926 1930
1927 if (tca[TCA_RATE]) 1931 if (tca[TCA_RATE])
1928 gen_new_estimator(&cl->bstats, &cl->rate_est, 1932 gen_new_estimator(&cl->bstats, &cl->rate_est,
1929 qdisc_root_lock(sch), tca[TCA_RATE]); 1933 qdisc_root_sleeping_lock(sch), tca[TCA_RATE]);
1930 1934
1931 *arg = (unsigned long)cl; 1935 *arg = (unsigned long)cl;
1932 return 0; 1936 return 0;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 468574682caa..9634091ee2f0 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -518,15 +518,17 @@ void qdisc_reset(struct Qdisc *qdisc)
518} 518}
519EXPORT_SYMBOL(qdisc_reset); 519EXPORT_SYMBOL(qdisc_reset);
520 520
521/* this is the rcu callback function to clean up a qdisc when there 521void qdisc_destroy(struct Qdisc *qdisc)
522 * are no further references to it */
523
524static void __qdisc_destroy(struct rcu_head *head)
525{ 522{
526 struct Qdisc *qdisc = container_of(head, struct Qdisc, q_rcu);
527 const struct Qdisc_ops *ops = qdisc->ops; 523 const struct Qdisc_ops *ops = qdisc->ops;
528 524
525 if (qdisc->flags & TCQ_F_BUILTIN ||
526 !atomic_dec_and_test(&qdisc->refcnt))
527 return;
528
529#ifdef CONFIG_NET_SCHED 529#ifdef CONFIG_NET_SCHED
530 qdisc_list_del(qdisc);
531
530 qdisc_put_stab(qdisc->stab); 532 qdisc_put_stab(qdisc->stab);
531#endif 533#endif
532 gen_kill_estimator(&qdisc->bstats, &qdisc->rate_est); 534 gen_kill_estimator(&qdisc->bstats, &qdisc->rate_est);
@@ -542,20 +544,6 @@ static void __qdisc_destroy(struct rcu_head *head)
542 544
543 kfree((char *) qdisc - qdisc->padded); 545 kfree((char *) qdisc - qdisc->padded);
544} 546}
545
546/* Under qdisc_lock(qdisc) and BH! */
547
548void qdisc_destroy(struct Qdisc *qdisc)
549{
550 if (qdisc->flags & TCQ_F_BUILTIN ||
551 !atomic_dec_and_test(&qdisc->refcnt))
552 return;
553
554 if (qdisc->parent)
555 list_del(&qdisc->list);
556
557 call_rcu(&qdisc->q_rcu, __qdisc_destroy);
558}
559EXPORT_SYMBOL(qdisc_destroy); 547EXPORT_SYMBOL(qdisc_destroy);
560 548
561static bool dev_all_qdisc_sleeping_noop(struct net_device *dev) 549static bool dev_all_qdisc_sleeping_noop(struct net_device *dev)
@@ -597,6 +585,9 @@ static void transition_one_qdisc(struct net_device *dev,
597 struct Qdisc *new_qdisc = dev_queue->qdisc_sleeping; 585 struct Qdisc *new_qdisc = dev_queue->qdisc_sleeping;
598 int *need_watchdog_p = _need_watchdog; 586 int *need_watchdog_p = _need_watchdog;
599 587
588 if (!(new_qdisc->flags & TCQ_F_BUILTIN))
589 clear_bit(__QDISC_STATE_DEACTIVATED, &new_qdisc->state);
590
600 rcu_assign_pointer(dev_queue->qdisc, new_qdisc); 591 rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
601 if (need_watchdog_p && new_qdisc != &noqueue_qdisc) 592 if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
602 *need_watchdog_p = 1; 593 *need_watchdog_p = 1;
@@ -640,14 +631,17 @@ static void dev_deactivate_queue(struct net_device *dev,
640 if (qdisc) { 631 if (qdisc) {
641 spin_lock_bh(qdisc_lock(qdisc)); 632 spin_lock_bh(qdisc_lock(qdisc));
642 633
643 dev_queue->qdisc = qdisc_default; 634 if (!(qdisc->flags & TCQ_F_BUILTIN))
635 set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
636
637 rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
644 qdisc_reset(qdisc); 638 qdisc_reset(qdisc);
645 639
646 spin_unlock_bh(qdisc_lock(qdisc)); 640 spin_unlock_bh(qdisc_lock(qdisc));
647 } 641 }
648} 642}
649 643
650static bool some_qdisc_is_busy(struct net_device *dev, int lock) 644static bool some_qdisc_is_busy(struct net_device *dev)
651{ 645{
652 unsigned int i; 646 unsigned int i;
653 647
@@ -661,14 +655,12 @@ static bool some_qdisc_is_busy(struct net_device *dev, int lock)
661 q = dev_queue->qdisc_sleeping; 655 q = dev_queue->qdisc_sleeping;
662 root_lock = qdisc_lock(q); 656 root_lock = qdisc_lock(q);
663 657
664 if (lock) 658 spin_lock_bh(root_lock);
665 spin_lock_bh(root_lock);
666 659
667 val = (test_bit(__QDISC_STATE_RUNNING, &q->state) || 660 val = (test_bit(__QDISC_STATE_RUNNING, &q->state) ||
668 test_bit(__QDISC_STATE_SCHED, &q->state)); 661 test_bit(__QDISC_STATE_SCHED, &q->state));
669 662
670 if (lock) 663 spin_unlock_bh(root_lock);
671 spin_unlock_bh(root_lock);
672 664
673 if (val) 665 if (val)
674 return true; 666 return true;
@@ -678,8 +670,6 @@ static bool some_qdisc_is_busy(struct net_device *dev, int lock)
678 670
679void dev_deactivate(struct net_device *dev) 671void dev_deactivate(struct net_device *dev)
680{ 672{
681 bool running;
682
683 netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc); 673 netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc);
684 dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc); 674 dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc);
685 675
@@ -689,25 +679,8 @@ void dev_deactivate(struct net_device *dev)
689 synchronize_rcu(); 679 synchronize_rcu();
690 680
691 /* Wait for outstanding qdisc_run calls. */ 681 /* Wait for outstanding qdisc_run calls. */
692 do { 682 while (some_qdisc_is_busy(dev))
693 while (some_qdisc_is_busy(dev, 0)) 683 yield();
694 yield();
695
696 /*
697 * Double-check inside queue lock to ensure that all effects
698 * of the queue run are visible when we return.
699 */
700 running = some_qdisc_is_busy(dev, 1);
701
702 /*
703 * The running flag should never be set at this point because
704 * we've already set dev->qdisc to noop_qdisc *inside* the same
705 * pair of spin locks. That is, if any qdisc_run starts after
706 * our initial test it should see the noop_qdisc and then
707 * clear the RUNNING bit before dropping the queue lock. So
708 * if it is set here then we've found a bug.
709 */
710 } while (WARN_ON_ONCE(running));
711} 684}
712 685
713static void dev_init_scheduler_queue(struct net_device *dev, 686static void dev_init_scheduler_queue(struct net_device *dev,
@@ -736,14 +709,10 @@ static void shutdown_scheduler_queue(struct net_device *dev,
736 struct Qdisc *qdisc_default = _qdisc_default; 709 struct Qdisc *qdisc_default = _qdisc_default;
737 710
738 if (qdisc) { 711 if (qdisc) {
739 spinlock_t *root_lock = qdisc_lock(qdisc); 712 rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
740
741 dev_queue->qdisc = qdisc_default;
742 dev_queue->qdisc_sleeping = qdisc_default; 713 dev_queue->qdisc_sleeping = qdisc_default;
743 714
744 spin_lock_bh(root_lock);
745 qdisc_destroy(qdisc); 715 qdisc_destroy(qdisc);
746 spin_unlock_bh(root_lock);
747 } 716 }
748} 717}
749 718
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index c2b8d9cce3d2..c1e77da8cd09 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1045,7 +1045,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
1045 1045
1046 if (tca[TCA_RATE]) 1046 if (tca[TCA_RATE])
1047 gen_replace_estimator(&cl->bstats, &cl->rate_est, 1047 gen_replace_estimator(&cl->bstats, &cl->rate_est,
1048 qdisc_root_lock(sch), 1048 qdisc_root_sleeping_lock(sch),
1049 tca[TCA_RATE]); 1049 tca[TCA_RATE]);
1050 return 0; 1050 return 0;
1051 } 1051 }
@@ -1104,7 +1104,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
1104 1104
1105 if (tca[TCA_RATE]) 1105 if (tca[TCA_RATE])
1106 gen_new_estimator(&cl->bstats, &cl->rate_est, 1106 gen_new_estimator(&cl->bstats, &cl->rate_est,
1107 qdisc_root_lock(sch), tca[TCA_RATE]); 1107 qdisc_root_sleeping_lock(sch), tca[TCA_RATE]);
1108 *arg = (unsigned long)cl; 1108 *arg = (unsigned long)cl;
1109 return 0; 1109 return 0;
1110} 1110}
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 6febd245e62b..97d4761cc31e 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -577,7 +577,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
577 sch->qstats.drops++; 577 sch->qstats.drops++;
578 cl->qstats.drops++; 578 cl->qstats.drops++;
579 } 579 }
580 return NET_XMIT_DROP; 580 return ret;
581 } else { 581 } else {
582 cl->bstats.packets += 582 cl->bstats.packets +=
583 skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1; 583 skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
@@ -623,7 +623,7 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
623 sch->qstats.drops++; 623 sch->qstats.drops++;
624 cl->qstats.drops++; 624 cl->qstats.drops++;
625 } 625 }
626 return NET_XMIT_DROP; 626 return ret;
627 } else 627 } else
628 htb_activate(q, cl); 628 htb_activate(q, cl);
629 629
@@ -1372,7 +1372,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
1372 goto failure; 1372 goto failure;
1373 1373
1374 gen_new_estimator(&cl->bstats, &cl->rate_est, 1374 gen_new_estimator(&cl->bstats, &cl->rate_est,
1375 qdisc_root_lock(sch), 1375 qdisc_root_sleeping_lock(sch),
1376 tca[TCA_RATE] ? : &est.nla); 1376 tca[TCA_RATE] ? : &est.nla);
1377 cl->refcnt = 1; 1377 cl->refcnt = 1;
1378 cl->children = 0; 1378 cl->children = 0;
@@ -1427,7 +1427,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
1427 } else { 1427 } else {
1428 if (tca[TCA_RATE]) 1428 if (tca[TCA_RATE])
1429 gen_replace_estimator(&cl->bstats, &cl->rate_est, 1429 gen_replace_estimator(&cl->bstats, &cl->rate_est,
1430 qdisc_root_lock(sch), 1430 qdisc_root_sleeping_lock(sch),
1431 tca[TCA_RATE]); 1431 tca[TCA_RATE]);
1432 sch_tree_lock(sch); 1432 sch_tree_lock(sch);
1433 } 1433 }
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index eac197610edf..a6697c686c7f 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -113,11 +113,11 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
113 if ((ret = qdisc->ops->requeue(skb, qdisc)) == NET_XMIT_SUCCESS) { 113 if ((ret = qdisc->ops->requeue(skb, qdisc)) == NET_XMIT_SUCCESS) {
114 sch->q.qlen++; 114 sch->q.qlen++;
115 sch->qstats.requeues++; 115 sch->qstats.requeues++;
116 return 0; 116 return NET_XMIT_SUCCESS;
117 } 117 }
118 if (net_xmit_drop_count(ret)) 118 if (net_xmit_drop_count(ret))
119 sch->qstats.drops++; 119 sch->qstats.drops++;
120 return NET_XMIT_DROP; 120 return ret;
121} 121}
122 122
123 123
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 7d3b7ff3bf07..94c61598b86a 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
123 struct tbf_sched_data *q = qdisc_priv(sch); 123 struct tbf_sched_data *q = qdisc_priv(sch);
124 int ret; 124 int ret;
125 125
126 if (qdisc_pkt_len(skb) > q->max_size) { 126 if (qdisc_pkt_len(skb) > q->max_size)
127 sch->qstats.drops++; 127 return qdisc_reshape_fail(skb, sch);
128#ifdef CONFIG_NET_CLS_ACT
129 if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
130#endif
131 kfree_skb(skb);
132
133 return NET_XMIT_DROP;
134 }
135 128
136 ret = qdisc_enqueue(skb, q->qdisc); 129 ret = qdisc_enqueue(skb, q->qdisc);
137 if (ret != 0) { 130 if (ret != 0) {
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 675a5c3e68a6..52db5f60daa0 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
80{ 80{
81 struct sctp_auth_bytes *key; 81 struct sctp_auth_bytes *key;
82 82
83 /* Verify that we are not going to overflow INT_MAX */
84 if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
85 return NULL;
86
83 /* Allocate the shared key */ 87 /* Allocate the shared key */
84 key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp); 88 key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
85 if (!key) 89 if (!key)
@@ -782,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
782 for (i = 0; i < hmacs->shmac_num_idents; i++) { 786 for (i = 0; i < hmacs->shmac_num_idents; i++) {
783 id = hmacs->shmac_idents[i]; 787 id = hmacs->shmac_idents[i];
784 788
789 if (id > SCTP_AUTH_HMAC_ID_MAX)
790 return -EOPNOTSUPP;
791
785 if (SCTP_AUTH_HMAC_ID_SHA1 == id) 792 if (SCTP_AUTH_HMAC_ID_SHA1 == id)
786 has_sha1 = 1; 793 has_sha1 = 1;
787 794
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index e39a0cdef184..4c8d9f45ce09 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
103 103
104 /* Initialize the CHUNKS parameter */ 104 /* Initialize the CHUNKS parameter */
105 auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS; 105 auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS;
106 auth_chunks->param_hdr.length = htons(sizeof(sctp_paramhdr_t));
106 107
107 /* If the Add-IP functionality is enabled, we must 108 /* If the Add-IP functionality is enabled, we must
108 * authenticate, ASCONF and ASCONF-ACK chunks 109 * authenticate, ASCONF and ASCONF-ACK chunks
@@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
110 if (sctp_addip_enable) { 111 if (sctp_addip_enable) {
111 auth_chunks->chunks[0] = SCTP_CID_ASCONF; 112 auth_chunks->chunks[0] = SCTP_CID_ASCONF;
112 auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK; 113 auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK;
113 auth_chunks->param_hdr.length = 114 auth_chunks->param_hdr.length += htons(2);
114 htons(sizeof(sctp_paramhdr_t) + 2);
115 } 115 }
116 } 116 }
117 117
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 483a01d0740a..47f91afa0211 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -319,7 +319,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
319 __func__, asoc, dst, NIP6(daddr->v6.sin6_addr)); 319 __func__, asoc, dst, NIP6(daddr->v6.sin6_addr));
320 320
321 if (!asoc) { 321 if (!asoc) {
322 ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL, 322 ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)),
323 dst ? ip6_dst_idev(dst)->dev : NULL,
323 &daddr->v6.sin6_addr, 324 &daddr->v6.sin6_addr,
324 inet6_sk(&sk->inet.sk)->srcprefs, 325 inet6_sk(&sk->inet.sk)->srcprefs,
325 &saddr->v6.sin6_addr); 326 &saddr->v6.sin6_addr);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index dbb79adf8f3c..5ffb9dec1c3f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3055,6 +3055,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
3055{ 3055{
3056 struct sctp_authchunk val; 3056 struct sctp_authchunk val;
3057 3057
3058 if (!sctp_auth_enable)
3059 return -EACCES;
3060
3058 if (optlen != sizeof(struct sctp_authchunk)) 3061 if (optlen != sizeof(struct sctp_authchunk))
3059 return -EINVAL; 3062 return -EINVAL;
3060 if (copy_from_user(&val, optval, optlen)) 3063 if (copy_from_user(&val, optval, optlen))
@@ -3083,8 +3086,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
3083 int optlen) 3086 int optlen)
3084{ 3087{
3085 struct sctp_hmacalgo *hmacs; 3088 struct sctp_hmacalgo *hmacs;
3089 u32 idents;
3086 int err; 3090 int err;
3087 3091
3092 if (!sctp_auth_enable)
3093 return -EACCES;
3094
3088 if (optlen < sizeof(struct sctp_hmacalgo)) 3095 if (optlen < sizeof(struct sctp_hmacalgo))
3089 return -EINVAL; 3096 return -EINVAL;
3090 3097
@@ -3097,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
3097 goto out; 3104 goto out;
3098 } 3105 }
3099 3106
3100 if (hmacs->shmac_num_idents == 0 || 3107 idents = hmacs->shmac_num_idents;
3101 hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) { 3108 if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
3109 (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
3102 err = -EINVAL; 3110 err = -EINVAL;
3103 goto out; 3111 goto out;
3104 } 3112 }
@@ -3123,6 +3131,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
3123 struct sctp_association *asoc; 3131 struct sctp_association *asoc;
3124 int ret; 3132 int ret;
3125 3133
3134 if (!sctp_auth_enable)
3135 return -EACCES;
3136
3126 if (optlen <= sizeof(struct sctp_authkey)) 3137 if (optlen <= sizeof(struct sctp_authkey))
3127 return -EINVAL; 3138 return -EINVAL;
3128 3139
@@ -3135,6 +3146,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
3135 goto out; 3146 goto out;
3136 } 3147 }
3137 3148
3149 if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
3150 ret = -EINVAL;
3151 goto out;
3152 }
3153
3138 asoc = sctp_id2assoc(sk, authkey->sca_assoc_id); 3154 asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
3139 if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) { 3155 if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
3140 ret = -EINVAL; 3156 ret = -EINVAL;
@@ -3160,6 +3176,9 @@ static int sctp_setsockopt_active_key(struct sock *sk,
3160 struct sctp_authkeyid val; 3176 struct sctp_authkeyid val;
3161 struct sctp_association *asoc; 3177 struct sctp_association *asoc;
3162 3178
3179 if (!sctp_auth_enable)
3180 return -EACCES;
3181
3163 if (optlen != sizeof(struct sctp_authkeyid)) 3182 if (optlen != sizeof(struct sctp_authkeyid))
3164 return -EINVAL; 3183 return -EINVAL;
3165 if (copy_from_user(&val, optval, optlen)) 3184 if (copy_from_user(&val, optval, optlen))
@@ -3185,6 +3204,9 @@ static int sctp_setsockopt_del_key(struct sock *sk,
3185 struct sctp_authkeyid val; 3204 struct sctp_authkeyid val;
3186 struct sctp_association *asoc; 3205 struct sctp_association *asoc;
3187 3206
3207 if (!sctp_auth_enable)
3208 return -EACCES;
3209
3188 if (optlen != sizeof(struct sctp_authkeyid)) 3210 if (optlen != sizeof(struct sctp_authkeyid))
3189 return -EINVAL; 3211 return -EINVAL;
3190 if (copy_from_user(&val, optval, optlen)) 3212 if (copy_from_user(&val, optval, optlen))
@@ -5197,19 +5219,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
5197static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, 5219static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
5198 char __user *optval, int __user *optlen) 5220 char __user *optval, int __user *optlen)
5199{ 5221{
5222 struct sctp_hmacalgo __user *p = (void __user *)optval;
5200 struct sctp_hmac_algo_param *hmacs; 5223 struct sctp_hmac_algo_param *hmacs;
5201 __u16 param_len; 5224 __u16 data_len = 0;
5225 u32 num_idents;
5226
5227 if (!sctp_auth_enable)
5228 return -EACCES;
5202 5229
5203 hmacs = sctp_sk(sk)->ep->auth_hmacs_list; 5230 hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
5204 param_len = ntohs(hmacs->param_hdr.length); 5231 data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
5205 5232
5206 if (len < param_len) 5233 if (len < sizeof(struct sctp_hmacalgo) + data_len)
5207 return -EINVAL; 5234 return -EINVAL;
5235
5236 len = sizeof(struct sctp_hmacalgo) + data_len;
5237 num_idents = data_len / sizeof(u16);
5238
5208 if (put_user(len, optlen)) 5239 if (put_user(len, optlen))
5209 return -EFAULT; 5240 return -EFAULT;
5210 if (copy_to_user(optval, hmacs->hmac_ids, len)) 5241 if (put_user(num_idents, &p->shmac_num_idents))
5242 return -EFAULT;
5243 if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
5211 return -EFAULT; 5244 return -EFAULT;
5212
5213 return 0; 5245 return 0;
5214} 5246}
5215 5247
@@ -5219,6 +5251,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
5219 struct sctp_authkeyid val; 5251 struct sctp_authkeyid val;
5220 struct sctp_association *asoc; 5252 struct sctp_association *asoc;
5221 5253
5254 if (!sctp_auth_enable)
5255 return -EACCES;
5256
5222 if (len < sizeof(struct sctp_authkeyid)) 5257 if (len < sizeof(struct sctp_authkeyid))
5223 return -EINVAL; 5258 return -EINVAL;
5224 if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) 5259 if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
@@ -5233,6 +5268,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
5233 else 5268 else
5234 val.scact_keynumber = sctp_sk(sk)->ep->active_key_id; 5269 val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
5235 5270
5271 len = sizeof(struct sctp_authkeyid);
5272 if (put_user(len, optlen))
5273 return -EFAULT;
5274 if (copy_to_user(optval, &val, len))
5275 return -EFAULT;
5276
5236 return 0; 5277 return 0;
5237} 5278}
5238 5279
@@ -5243,13 +5284,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
5243 struct sctp_authchunks val; 5284 struct sctp_authchunks val;
5244 struct sctp_association *asoc; 5285 struct sctp_association *asoc;
5245 struct sctp_chunks_param *ch; 5286 struct sctp_chunks_param *ch;
5246 u32 num_chunks; 5287 u32 num_chunks = 0;
5247 char __user *to; 5288 char __user *to;
5248 5289
5249 if (len <= sizeof(struct sctp_authchunks)) 5290 if (!sctp_auth_enable)
5291 return -EACCES;
5292
5293 if (len < sizeof(struct sctp_authchunks))
5250 return -EINVAL; 5294 return -EINVAL;
5251 5295
5252 if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) 5296 if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5253 return -EFAULT; 5297 return -EFAULT;
5254 5298
5255 to = p->gauth_chunks; 5299 to = p->gauth_chunks;
@@ -5258,20 +5302,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
5258 return -EINVAL; 5302 return -EINVAL;
5259 5303
5260 ch = asoc->peer.peer_chunks; 5304 ch = asoc->peer.peer_chunks;
5305 if (!ch)
5306 goto num;
5261 5307
5262 /* See if the user provided enough room for all the data */ 5308 /* See if the user provided enough room for all the data */
5263 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); 5309 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5264 if (len < num_chunks) 5310 if (len < num_chunks)
5265 return -EINVAL; 5311 return -EINVAL;
5266 5312
5267 len = num_chunks; 5313 if (copy_to_user(to, ch->chunks, num_chunks))
5268 if (put_user(len, optlen))
5269 return -EFAULT; 5314 return -EFAULT;
5315num:
5316 len = sizeof(struct sctp_authchunks) + num_chunks;
5317 if (put_user(len, optlen)) return -EFAULT;
5270 if (put_user(num_chunks, &p->gauth_number_of_chunks)) 5318 if (put_user(num_chunks, &p->gauth_number_of_chunks))
5271 return -EFAULT; 5319 return -EFAULT;
5272 if (copy_to_user(to, ch->chunks, len))
5273 return -EFAULT;
5274
5275 return 0; 5320 return 0;
5276} 5321}
5277 5322
@@ -5282,13 +5327,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
5282 struct sctp_authchunks val; 5327 struct sctp_authchunks val;
5283 struct sctp_association *asoc; 5328 struct sctp_association *asoc;
5284 struct sctp_chunks_param *ch; 5329 struct sctp_chunks_param *ch;
5285 u32 num_chunks; 5330 u32 num_chunks = 0;
5286 char __user *to; 5331 char __user *to;
5287 5332
5288 if (len <= sizeof(struct sctp_authchunks)) 5333 if (!sctp_auth_enable)
5334 return -EACCES;
5335
5336 if (len < sizeof(struct sctp_authchunks))
5289 return -EINVAL; 5337 return -EINVAL;
5290 5338
5291 if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) 5339 if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5292 return -EFAULT; 5340 return -EFAULT;
5293 5341
5294 to = p->gauth_chunks; 5342 to = p->gauth_chunks;
@@ -5301,17 +5349,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
5301 else 5349 else
5302 ch = sctp_sk(sk)->ep->auth_chunk_list; 5350 ch = sctp_sk(sk)->ep->auth_chunk_list;
5303 5351
5352 if (!ch)
5353 goto num;
5354
5304 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); 5355 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5305 if (len < num_chunks) 5356 if (len < sizeof(struct sctp_authchunks) + num_chunks)
5306 return -EINVAL; 5357 return -EINVAL;
5307 5358
5308 len = num_chunks; 5359 if (copy_to_user(to, ch->chunks, num_chunks))
5360 return -EFAULT;
5361num:
5362 len = sizeof(struct sctp_authchunks) + num_chunks;
5309 if (put_user(len, optlen)) 5363 if (put_user(len, optlen))
5310 return -EFAULT; 5364 return -EFAULT;
5311 if (put_user(num_chunks, &p->gauth_number_of_chunks)) 5365 if (put_user(num_chunks, &p->gauth_number_of_chunks))
5312 return -EFAULT; 5366 return -EFAULT;
5313 if (copy_to_user(to, ch->chunks, len))
5314 return -EFAULT;
5315 5367
5316 return 0; 5368 return 0;
5317} 5369}
generated by cgit v1.2.2 (git 2.25.0) at 2025-08-24 22:18:29 -0400