aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
Diffstat
-rw-r--r--drivers/net/3c509.c1
-rw-r--r--drivers/net/r8169.c93
-rw-r--r--drivers/net/sungem.c8
-rw-r--r--drivers/net/sunhme.c12
-rw-r--r--drivers/net/wireless/iwlwifi/iwl-sta.c3
-rw-r--r--include/linux/dmaengine.h12
-rw-r--r--net/9p/protocol.c22
-rw-r--r--net/core/dev.c4
-rw-r--r--net/core/neighbour.c14
-rw-r--r--net/ipv4/tcp_output.c12
-rw-r--r--net/ipv4/udp.c9
-rw-r--r--net/ipv6/ip6_flowlabel.c8
-rw-r--r--net/ipv6/ip6_output.c67
-rw-r--r--net/rxrpc/af_rxrpc.c5
14 files changed, 180 insertions, 90 deletions
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index d58919c7032e..fbb371921991 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -1482,6 +1482,7 @@ el3_resume(struct device *pdev)
1482 spin_lock_irqsave(&lp->lock, flags); 1482 spin_lock_irqsave(&lp->lock, flags);
1483 1483
1484 outw(PowerUp, ioaddr + EL3_CMD); 1484 outw(PowerUp, ioaddr + EL3_CMD);
1485 EL3WINDOW(0);
1485 el3_up(dev); 1486 el3_up(dev);
1486 1487
1487 if (netif_running(dev)) 1488 if (netif_running(dev))
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 1c4a980253fe..dd83f936b036 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -437,6 +437,22 @@ enum features {
437 RTL_FEATURE_GMII = (1 << 2), 437 RTL_FEATURE_GMII = (1 << 2),
438}; 438};
439 439
440struct rtl8169_counters {
441 __le64 tx_packets;
442 __le64 rx_packets;
443 __le64 tx_errors;
444 __le32 rx_errors;
445 __le16 rx_missed;
446 __le16 align_errors;
447 __le32 tx_one_collision;
448 __le32 tx_multi_collision;
449 __le64 rx_unicast;
450 __le64 rx_broadcast;
451 __le32 rx_multicast;
452 __le16 tx_aborted;
453 __le16 tx_underun;
454};
455
440struct rtl8169_private { 456struct rtl8169_private {
441 void __iomem *mmio_addr; /* memory map physical address */ 457 void __iomem *mmio_addr; /* memory map physical address */
442 struct pci_dev *pci_dev; /* Index of PCI device */ 458 struct pci_dev *pci_dev; /* Index of PCI device */
@@ -480,6 +496,7 @@ struct rtl8169_private {
480 unsigned features; 496 unsigned features;
481 497
482 struct mii_if_info mii; 498 struct mii_if_info mii;
499 struct rtl8169_counters counters;
483}; 500};
484 501
485MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>"); 502MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
@@ -1100,22 +1117,6 @@ static const char rtl8169_gstrings[][ETH_GSTRING_LEN] = {
1100 "tx_underrun", 1117 "tx_underrun",
1101}; 1118};
1102 1119
1103struct rtl8169_counters {
1104 __le64 tx_packets;
1105 __le64 rx_packets;
1106 __le64 tx_errors;
1107 __le32 rx_errors;
1108 __le16 rx_missed;
1109 __le16 align_errors;
1110 __le32 tx_one_collision;
1111 __le32 tx_multi_collision;
1112 __le64 rx_unicast;
1113 __le64 rx_broadcast;
1114 __le32 rx_multicast;
1115 __le16 tx_aborted;
1116 __le16 tx_underun;
1117};
1118
1119static int rtl8169_get_sset_count(struct net_device *dev, int sset) 1120static int rtl8169_get_sset_count(struct net_device *dev, int sset)
1120{ 1121{
1121 switch (sset) { 1122 switch (sset) {
@@ -1126,16 +1127,21 @@ static int rtl8169_get_sset_count(struct net_device *dev, int sset)
1126 } 1127 }
1127} 1128}
1128 1129
1129static void rtl8169_get_ethtool_stats(struct net_device *dev, 1130static void rtl8169_update_counters(struct net_device *dev)
1130 struct ethtool_stats *stats, u64 *data)
1131{ 1131{
1132 struct rtl8169_private *tp = netdev_priv(dev); 1132 struct rtl8169_private *tp = netdev_priv(dev);
1133 void __iomem *ioaddr = tp->mmio_addr; 1133 void __iomem *ioaddr = tp->mmio_addr;
1134 struct rtl8169_counters *counters; 1134 struct rtl8169_counters *counters;
1135 dma_addr_t paddr; 1135 dma_addr_t paddr;
1136 u32 cmd; 1136 u32 cmd;
1137 int wait = 1000;
1137 1138
1138 ASSERT_RTNL(); 1139 /*
1140 * Some chips are unable to dump tally counters when the receiver
1141 * is disabled.
1142 */
1143 if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
1144 return;
1139 1145
1140 counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr); 1146 counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
1141 if (!counters) 1147 if (!counters)
@@ -1146,31 +1152,45 @@ static void rtl8169_get_ethtool_stats(struct net_device *dev,
1146 RTL_W32(CounterAddrLow, cmd); 1152 RTL_W32(CounterAddrLow, cmd);
1147 RTL_W32(CounterAddrLow, cmd | CounterDump); 1153 RTL_W32(CounterAddrLow, cmd | CounterDump);
1148 1154
1149 while (RTL_R32(CounterAddrLow) & CounterDump) { 1155 while (wait--) {
1150 if (msleep_interruptible(1)) 1156 if ((RTL_R32(CounterAddrLow) & CounterDump) == 0) {
1157 /* copy updated counters */
1158 memcpy(&tp->counters, counters, sizeof(*counters));
1151 break; 1159 break;
1160 }
1161 udelay(10);
1152 } 1162 }
1153 1163
1154 RTL_W32(CounterAddrLow, 0); 1164 RTL_W32(CounterAddrLow, 0);
1155 RTL_W32(CounterAddrHigh, 0); 1165 RTL_W32(CounterAddrHigh, 0);
1156 1166
1157 data[0] = le64_to_cpu(counters->tx_packets);
1158 data[1] = le64_to_cpu(counters->rx_packets);
1159 data[2] = le64_to_cpu(counters->tx_errors);
1160 data[3] = le32_to_cpu(counters->rx_errors);
1161 data[4] = le16_to_cpu(counters->rx_missed);
1162 data[5] = le16_to_cpu(counters->align_errors);
1163 data[6] = le32_to_cpu(counters->tx_one_collision);
1164 data[7] = le32_to_cpu(counters->tx_multi_collision);
1165 data[8] = le64_to_cpu(counters->rx_unicast);
1166 data[9] = le64_to_cpu(counters->rx_broadcast);
1167 data[10] = le32_to_cpu(counters->rx_multicast);
1168 data[11] = le16_to_cpu(counters->tx_aborted);
1169 data[12] = le16_to_cpu(counters->tx_underun);
1170
1171 pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr); 1167 pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
1172} 1168}
1173 1169
1170static void rtl8169_get_ethtool_stats(struct net_device *dev,
1171 struct ethtool_stats *stats, u64 *data)
1172{
1173 struct rtl8169_private *tp = netdev_priv(dev);
1174
1175 ASSERT_RTNL();
1176
1177 rtl8169_update_counters(dev);
1178
1179 data[0] = le64_to_cpu(tp->counters.tx_packets);
1180 data[1] = le64_to_cpu(tp->counters.rx_packets);
1181 data[2] = le64_to_cpu(tp->counters.tx_errors);
1182 data[3] = le32_to_cpu(tp->counters.rx_errors);
1183 data[4] = le16_to_cpu(tp->counters.rx_missed);
1184 data[5] = le16_to_cpu(tp->counters.align_errors);
1185 data[6] = le32_to_cpu(tp->counters.tx_one_collision);
1186 data[7] = le32_to_cpu(tp->counters.tx_multi_collision);
1187 data[8] = le64_to_cpu(tp->counters.rx_unicast);
1188 data[9] = le64_to_cpu(tp->counters.rx_broadcast);
1189 data[10] = le32_to_cpu(tp->counters.rx_multicast);
1190 data[11] = le16_to_cpu(tp->counters.tx_aborted);
1191 data[12] = le16_to_cpu(tp->counters.tx_underun);
1192}
1193
1174static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data) 1194static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data)
1175{ 1195{
1176 switch(stringset) { 1196 switch(stringset) {
@@ -3682,6 +3702,9 @@ static int rtl8169_close(struct net_device *dev)
3682 struct rtl8169_private *tp = netdev_priv(dev); 3702 struct rtl8169_private *tp = netdev_priv(dev);
3683 struct pci_dev *pdev = tp->pci_dev; 3703 struct pci_dev *pdev = tp->pci_dev;
3684 3704
3705 /* update counters before going down */
3706 rtl8169_update_counters(dev);
3707
3685 rtl8169_down(dev); 3708 rtl8169_down(dev);
3686 3709
3687 free_irq(dev->irq, dev); 3710 free_irq(dev->irq, dev);
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index fc1e7f1d024b..5322bb79b2b5 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -2221,6 +2221,8 @@ static int gem_do_start(struct net_device *dev)
2221 2221
2222 gp->running = 1; 2222 gp->running = 1;
2223 2223
2224 napi_enable(&gp->napi);
2225
2224 if (gp->lstate == link_up) { 2226 if (gp->lstate == link_up) {
2225 netif_carrier_on(gp->dev); 2227 netif_carrier_on(gp->dev);
2226 gem_set_link_modes(gp); 2228 gem_set_link_modes(gp);
@@ -2238,6 +2240,8 @@ static int gem_do_start(struct net_device *dev)
2238 spin_lock_irqsave(&gp->lock, flags); 2240 spin_lock_irqsave(&gp->lock, flags);
2239 spin_lock(&gp->tx_lock); 2241 spin_lock(&gp->tx_lock);
2240 2242
2243 napi_disable(&gp->napi);
2244
2241 gp->running = 0; 2245 gp->running = 0;
2242 gem_reset(gp); 2246 gem_reset(gp);
2243 gem_clean_rings(gp); 2247 gem_clean_rings(gp);
@@ -2338,8 +2342,6 @@ static int gem_open(struct net_device *dev)
2338 if (!gp->asleep) 2342 if (!gp->asleep)
2339 rc = gem_do_start(dev); 2343 rc = gem_do_start(dev);
2340 gp->opened = (rc == 0); 2344 gp->opened = (rc == 0);
2341 if (gp->opened)
2342 napi_enable(&gp->napi);
2343 2345
2344 mutex_unlock(&gp->pm_mutex); 2346 mutex_unlock(&gp->pm_mutex);
2345 2347
@@ -2476,8 +2478,6 @@ static int gem_resume(struct pci_dev *pdev)
2476 2478
2477 /* Re-attach net device */ 2479 /* Re-attach net device */
2478 netif_device_attach(dev); 2480 netif_device_attach(dev);
2479
2480 napi_enable(&gp->napi);
2481 } 2481 }
2482 2482
2483 spin_lock_irqsave(&gp->lock, flags); 2483 spin_lock_irqsave(&gp->lock, flags);
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 7a72a3112f0a..cc4013be5e18 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -2629,6 +2629,14 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
2629 int i, qfe_slot = -1; 2629 int i, qfe_slot = -1;
2630 int err = -ENODEV; 2630 int err = -ENODEV;
2631 2631
2632 sbus_dp = to_of_device(op->dev.parent)->node;
2633 if (is_qfe)
2634 sbus_dp = to_of_device(op->dev.parent->parent)->node;
2635
2636 /* We can match PCI devices too, do not accept those here. */
2637 if (strcmp(sbus_dp->name, "sbus"))
2638 return err;
2639
2632 if (is_qfe) { 2640 if (is_qfe) {
2633 qp = quattro_sbus_find(op); 2641 qp = quattro_sbus_find(op);
2634 if (qp == NULL) 2642 if (qp == NULL)
@@ -2734,10 +2742,6 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
2734 if (qp != NULL) 2742 if (qp != NULL)
2735 hp->happy_flags |= HFLAG_QUATTRO; 2743 hp->happy_flags |= HFLAG_QUATTRO;
2736 2744
2737 sbus_dp = to_of_device(op->dev.parent)->node;
2738 if (is_qfe)
2739 sbus_dp = to_of_device(op->dev.parent->parent)->node;
2740
2741 /* Get the supported DVMA burst sizes from our Happy SBUS. */ 2745 /* Get the supported DVMA burst sizes from our Happy SBUS. */
2742 hp->happy_bursts = of_getintprop_default(sbus_dp, 2746 hp->happy_bursts = of_getintprop_default(sbus_dp,
2743 "burst-sizes", 0x00); 2747 "burst-sizes", 0x00);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 9bba98e5e056..20dc84152d4f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -483,6 +483,9 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
483 priv->num_stations = 0; 483 priv->num_stations = 0;
484 memset(priv->stations, 0, sizeof(priv->stations)); 484 memset(priv->stations, 0, sizeof(priv->stations));
485 485
486 /* clean ucode key table bit map */
487 priv->ucode_key_table = 0;
488
486 spin_unlock_irqrestore(&priv->sta_lock, flags); 489 spin_unlock_irqrestore(&priv->sta_lock, flags);
487} 490}
488EXPORT_SYMBOL(iwl_clear_stations_table); 491EXPORT_SYMBOL(iwl_clear_stations_table);
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 3e0f64c335c8..3e68469c1885 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -282,6 +282,18 @@ static inline void dmaengine_put(void)
282} 282}
283#endif 283#endif
284 284
285#ifdef CONFIG_NET_DMA
286#define net_dmaengine_get() dmaengine_get()
287#define net_dmaengine_put() dmaengine_put()
288#else
289static inline void net_dmaengine_get(void)
290{
291}
292static inline void net_dmaengine_put(void)
293{
294}
295#endif
296
285dma_cookie_t dma_async_memcpy_buf_to_buf(struct dma_chan *chan, 297dma_cookie_t dma_async_memcpy_buf_to_buf(struct dma_chan *chan,
286 void *dest, void *src, size_t len); 298 void *dest, void *src, size_t len);
287dma_cookie_t dma_async_memcpy_buf_to_pg(struct dma_chan *chan, 299dma_cookie_t dma_async_memcpy_buf_to_pg(struct dma_chan *chan,
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index dcd7666824ba..fc70147c771e 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -29,6 +29,7 @@
29#include <linux/errno.h> 29#include <linux/errno.h>
30#include <linux/uaccess.h> 30#include <linux/uaccess.h>
31#include <linux/sched.h> 31#include <linux/sched.h>
32#include <linux/types.h>
32#include <net/9p/9p.h> 33#include <net/9p/9p.h>
33#include <net/9p/client.h> 34#include <net/9p/client.h>
34#include "protocol.h" 35#include "protocol.h"
@@ -160,29 +161,32 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
160 break; 161 break;
161 case 'w':{ 162 case 'w':{
162 int16_t *val = va_arg(ap, int16_t *); 163 int16_t *val = va_arg(ap, int16_t *);
163 if (pdu_read(pdu, val, sizeof(*val))) { 164 __le16 le_val;
165 if (pdu_read(pdu, &le_val, sizeof(le_val))) {
164 errcode = -EFAULT; 166 errcode = -EFAULT;
165 break; 167 break;
166 } 168 }
167 *val = cpu_to_le16(*val); 169 *val = le16_to_cpu(le_val);
168 } 170 }
169 break; 171 break;
170 case 'd':{ 172 case 'd':{
171 int32_t *val = va_arg(ap, int32_t *); 173 int32_t *val = va_arg(ap, int32_t *);
172 if (pdu_read(pdu, val, sizeof(*val))) { 174 __le32 le_val;
175 if (pdu_read(pdu, &le_val, sizeof(le_val))) {
173 errcode = -EFAULT; 176 errcode = -EFAULT;
174 break; 177 break;
175 } 178 }
176 *val = cpu_to_le32(*val); 179 *val = le32_to_cpu(le_val);
177 } 180 }
178 break; 181 break;
179 case 'q':{ 182 case 'q':{
180 int64_t *val = va_arg(ap, int64_t *); 183 int64_t *val = va_arg(ap, int64_t *);
181 if (pdu_read(pdu, val, sizeof(*val))) { 184 __le64 le_val;
185 if (pdu_read(pdu, &le_val, sizeof(le_val))) {
182 errcode = -EFAULT; 186 errcode = -EFAULT;
183 break; 187 break;
184 } 188 }
185 *val = cpu_to_le64(*val); 189 *val = le64_to_cpu(le_val);
186 } 190 }
187 break; 191 break;
188 case 's':{ 192 case 's':{
@@ -362,19 +366,19 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
362 } 366 }
363 break; 367 break;
364 case 'w':{ 368 case 'w':{
365 int16_t val = va_arg(ap, int); 369 __le16 val = cpu_to_le16(va_arg(ap, int));
366 if (pdu_write(pdu, &val, sizeof(val))) 370 if (pdu_write(pdu, &val, sizeof(val)))
367 errcode = -EFAULT; 371 errcode = -EFAULT;
368 } 372 }
369 break; 373 break;
370 case 'd':{ 374 case 'd':{
371 int32_t val = va_arg(ap, int32_t); 375 __le32 val = cpu_to_le32(va_arg(ap, int32_t));
372 if (pdu_write(pdu, &val, sizeof(val))) 376 if (pdu_write(pdu, &val, sizeof(val)))
373 errcode = -EFAULT; 377 errcode = -EFAULT;
374 } 378 }
375 break; 379 break;
376 case 'q':{ 380 case 'q':{
377 int64_t val = va_arg(ap, int64_t); 381 __le64 val = cpu_to_le64(va_arg(ap, int64_t));
378 if (pdu_write(pdu, &val, sizeof(val))) 382 if (pdu_write(pdu, &val, sizeof(val)))
379 errcode = -EFAULT; 383 errcode = -EFAULT;
380 } 384 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 247f1614a796..709a9a922258 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1105,7 +1105,7 @@ int dev_open(struct net_device *dev)
1105 /* 1105 /*
1106 * Enable NET_DMA 1106 * Enable NET_DMA
1107 */ 1107 */
1108 dmaengine_get(); 1108 net_dmaengine_get();
1109 1109
1110 /* 1110 /*
1111 * Initialize multicasting status 1111 * Initialize multicasting status
@@ -1187,7 +1187,7 @@ int dev_close(struct net_device *dev)
1187 /* 1187 /*
1188 * Shutdown NET_DMA 1188 * Shutdown NET_DMA
1189 */ 1189 */
1190 dmaengine_put(); 1190 net_dmaengine_put();
1191 1191
1192 return 0; 1192 return 0;
1193} 1193}
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f66c58df8953..278a142d1047 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1994,8 +1994,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
1994 if (!net_eq(neigh_parms_net(p), net)) 1994 if (!net_eq(neigh_parms_net(p), net))
1995 continue; 1995 continue;
1996 1996
1997 if (nidx++ < neigh_skip) 1997 if (nidx < neigh_skip)
1998 continue; 1998 goto next;
1999 1999
2000 if (neightbl_fill_param_info(skb, tbl, p, 2000 if (neightbl_fill_param_info(skb, tbl, p,
2001 NETLINK_CB(cb->skb).pid, 2001 NETLINK_CB(cb->skb).pid,
@@ -2003,6 +2003,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2003 RTM_NEWNEIGHTBL, 2003 RTM_NEWNEIGHTBL,
2004 NLM_F_MULTI) <= 0) 2004 NLM_F_MULTI) <= 0)
2005 goto out; 2005 goto out;
2006 next:
2007 nidx++;
2006 } 2008 }
2007 2009
2008 neigh_skip = 0; 2010 neigh_skip = 0;
@@ -2082,12 +2084,10 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2082 if (h > s_h) 2084 if (h > s_h)
2083 s_idx = 0; 2085 s_idx = 0;
2084 for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) { 2086 for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) {
2085 int lidx;
2086 if (dev_net(n->dev) != net) 2087 if (dev_net(n->dev) != net)
2087 continue; 2088 continue;
2088 lidx = idx++; 2089 if (idx < s_idx)
2089 if (lidx < s_idx) 2090 goto next;
2090 continue;
2091 if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid, 2091 if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
2092 cb->nlh->nlmsg_seq, 2092 cb->nlh->nlmsg_seq,
2093 RTM_NEWNEIGH, 2093 RTM_NEWNEIGH,
@@ -2096,6 +2096,8 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2096 rc = -1; 2096 rc = -1;
2097 goto out; 2097 goto out;
2098 } 2098 }
2099 next:
2100 idx++;
2099 } 2101 }
2100 } 2102 }
2101 read_unlock_bh(&tbl->lock); 2103 read_unlock_bh(&tbl->lock);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 557fe16cbfb0..dda42f0bd7a3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -663,14 +663,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
663 th->urg_ptr = 0; 663 th->urg_ptr = 0;
664 664
665 /* The urg_mode check is necessary during a below snd_una win probe */ 665 /* The urg_mode check is necessary during a below snd_una win probe */
666 if (unlikely(tcp_urg_mode(tp))) { 666 if (unlikely(tcp_urg_mode(tp) &&
667 if (between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF)) { 667 between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF))) {
668 th->urg_ptr = htons(tp->snd_up - tcb->seq); 668 th->urg_ptr = htons(tp->snd_up - tcb->seq);
669 th->urg = 1; 669 th->urg = 1;
670 } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
671 th->urg_ptr = 0xFFFF;
672 th->urg = 1;
673 }
674 } 670 }
675 671
676 tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location); 672 tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1ab180bad72a..c47c989cb1fb 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1231,11 +1231,10 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
1231 int proto) 1231 int proto)
1232{ 1232{
1233 struct sock *sk; 1233 struct sock *sk;
1234 struct udphdr *uh = udp_hdr(skb); 1234 struct udphdr *uh;
1235 unsigned short ulen; 1235 unsigned short ulen;
1236 struct rtable *rt = (struct rtable*)skb->dst; 1236 struct rtable *rt = (struct rtable*)skb->dst;
1237 __be32 saddr = ip_hdr(skb)->saddr; 1237 __be32 saddr, daddr;
1238 __be32 daddr = ip_hdr(skb)->daddr;
1239 struct net *net = dev_net(skb->dev); 1238 struct net *net = dev_net(skb->dev);
1240 1239
1241 /* 1240 /*
@@ -1244,6 +1243,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
1244 if (!pskb_may_pull(skb, sizeof(struct udphdr))) 1243 if (!pskb_may_pull(skb, sizeof(struct udphdr)))
1245 goto drop; /* No space for header. */ 1244 goto drop; /* No space for header. */
1246 1245
1246 uh = udp_hdr(skb);
1247 ulen = ntohs(uh->len); 1247 ulen = ntohs(uh->len);
1248 if (ulen > skb->len) 1248 if (ulen > skb->len)
1249 goto short_packet; 1249 goto short_packet;
@@ -1258,6 +1258,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
1258 if (udp4_csum_init(skb, uh, proto)) 1258 if (udp4_csum_init(skb, uh, proto))
1259 goto csum_error; 1259 goto csum_error;
1260 1260
1261 saddr = ip_hdr(skb)->saddr;
1262 daddr = ip_hdr(skb)->daddr;
1263
1261 if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST)) 1264 if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
1262 return __udp4_lib_mcast_deliver(net, skb, uh, 1265 return __udp4_lib_mcast_deliver(net, skb, uh,
1263 saddr, daddr, udptable); 1266 saddr, daddr, udptable);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index c62dd247774f..7712578bdc66 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -323,17 +323,21 @@ static struct ip6_flowlabel *
323fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval, 323fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
324 int optlen, int *err_p) 324 int optlen, int *err_p)
325{ 325{
326 struct ip6_flowlabel *fl; 326 struct ip6_flowlabel *fl = NULL;
327 int olen; 327 int olen;
328 int addr_type; 328 int addr_type;
329 int err; 329 int err;
330 330
331 olen = optlen - CMSG_ALIGN(sizeof(*freq));
332 err = -EINVAL;
333 if (olen > 64 * 1024)
334 goto done;
335
331 err = -ENOMEM; 336 err = -ENOMEM;
332 fl = kzalloc(sizeof(*fl), GFP_KERNEL); 337 fl = kzalloc(sizeof(*fl), GFP_KERNEL);
333 if (fl == NULL) 338 if (fl == NULL)
334 goto done; 339 goto done;
335 340
336 olen = optlen - CMSG_ALIGN(sizeof(*freq));
337 if (olen > 0) { 341 if (olen > 0) {
338 struct msghdr msg; 342 struct msghdr msg;
339 struct flowi flowi; 343 struct flowi flowi;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4b15938bef4d..9fb49c3b518a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1105,6 +1105,18 @@ static inline int ip6_ufo_append_data(struct sock *sk,
1105 return err; 1105 return err;
1106} 1106}
1107 1107
1108static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
1109 gfp_t gfp)
1110{
1111 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1112}
1113
1114static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
1115 gfp_t gfp)
1116{
1117 return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
1118}
1119
1108int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, 1120int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1109 int offset, int len, int odd, struct sk_buff *skb), 1121 int offset, int len, int odd, struct sk_buff *skb),
1110 void *from, int length, int transhdrlen, 1122 void *from, int length, int transhdrlen,
@@ -1130,17 +1142,37 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1130 * setup for corking 1142 * setup for corking
1131 */ 1143 */
1132 if (opt) { 1144 if (opt) {
1133 if (np->cork.opt == NULL) { 1145 if (WARN_ON(np->cork.opt))
1134 np->cork.opt = kmalloc(opt->tot_len,
1135 sk->sk_allocation);
1136 if (unlikely(np->cork.opt == NULL))
1137 return -ENOBUFS;
1138 } else if (np->cork.opt->tot_len < opt->tot_len) {
1139 printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
1140 return -EINVAL; 1146 return -EINVAL;
1141 } 1147
1142 memcpy(np->cork.opt, opt, opt->tot_len); 1148 np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
1143 inet->cork.flags |= IPCORK_OPT; 1149 if (unlikely(np->cork.opt == NULL))
1150 return -ENOBUFS;
1151
1152 np->cork.opt->tot_len = opt->tot_len;
1153 np->cork.opt->opt_flen = opt->opt_flen;
1154 np->cork.opt->opt_nflen = opt->opt_nflen;
1155
1156 np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
1157 sk->sk_allocation);
1158 if (opt->dst0opt && !np->cork.opt->dst0opt)
1159 return -ENOBUFS;
1160
1161 np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
1162 sk->sk_allocation);
1163 if (opt->dst1opt && !np->cork.opt->dst1opt)
1164 return -ENOBUFS;
1165
1166 np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
1167 sk->sk_allocation);
1168 if (opt->hopopt && !np->cork.opt->hopopt)
1169 return -ENOBUFS;
1170
1171 np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
1172 sk->sk_allocation);
1173 if (opt->srcrt && !np->cork.opt->srcrt)
1174 return -ENOBUFS;
1175
1144 /* need source address above miyazawa*/ 1176 /* need source address above miyazawa*/
1145 } 1177 }
1146 dst_hold(&rt->u.dst); 1178 dst_hold(&rt->u.dst);
@@ -1167,8 +1199,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
1167 } else { 1199 } else {
1168 rt = (struct rt6_info *)inet->cork.dst; 1200 rt = (struct rt6_info *)inet->cork.dst;
1169 fl = &inet->cork.fl; 1201 fl = &inet->cork.fl;
1170 if (inet->cork.flags & IPCORK_OPT) 1202 opt = np->cork.opt;
1171 opt = np->cork.opt;
1172 transhdrlen = 0; 1203 transhdrlen = 0;
1173 exthdrlen = 0; 1204 exthdrlen = 0;
1174 mtu = inet->cork.fragsize; 1205 mtu = inet->cork.fragsize;
@@ -1407,9 +1438,15 @@ error:
1407 1438
1408static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np) 1439static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
1409{ 1440{
1410 inet->cork.flags &= ~IPCORK_OPT; 1441 if (np->cork.opt) {
1411 kfree(np->cork.opt); 1442 kfree(np->cork.opt->dst0opt);
1412 np->cork.opt = NULL; 1443 kfree(np->cork.opt->dst1opt);
1444 kfree(np->cork.opt->hopopt);
1445 kfree(np->cork.opt->srcrt);
1446 kfree(np->cork.opt);
1447 np->cork.opt = NULL;
1448 }
1449
1413 if (inet->cork.dst) { 1450 if (inet->cork.dst) {
1414 dst_release(inet->cork.dst); 1451 dst_release(inet->cork.dst);
1415 inet->cork.dst = NULL; 1452 inet->cork.dst = NULL;
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d7d2bed7a699..eac5e7bb7365 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -284,13 +284,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
284 if (IS_ERR(trans)) { 284 if (IS_ERR(trans)) {
285 call = ERR_CAST(trans); 285 call = ERR_CAST(trans);
286 trans = NULL; 286 trans = NULL;
287 goto out; 287 goto out_notrans;
288 } 288 }
289 } else { 289 } else {
290 trans = rx->trans; 290 trans = rx->trans;
291 if (!trans) { 291 if (!trans) {
292 call = ERR_PTR(-ENOTCONN); 292 call = ERR_PTR(-ENOTCONN);
293 goto out; 293 goto out_notrans;
294 } 294 }
295 atomic_inc(&trans->usage); 295 atomic_inc(&trans->usage);
296 } 296 }
@@ -315,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
315 rxrpc_put_bundle(trans, bundle); 315 rxrpc_put_bundle(trans, bundle);
316out: 316out:
317 rxrpc_put_transport(trans); 317 rxrpc_put_transport(trans);
318out_notrans:
318 release_sock(&rx->sk); 319 release_sock(&rx->sk);
319 _leave(" = %p", call); 320 _leave(" = %p", call);
320 return call; 321 return call;
generated by cgit v1.2.2 (git 2.25.0) at 2025-01-01 17:33:29 -0500