1 files changed, 23 insertions, 15 deletions

diff --git a/net/core/sock.c b/net/core/sock.c
index e1f6f225f012..c5812bbc2cc9 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -340,8 +340,12 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested)
                 rc = sk_backlog_rcv(sk, skb);
 
                 mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
-        } else
-                sk_add_backlog(sk, skb);
+        } else if (sk_add_backlog(sk, skb)) {
+                bh_unlock_sock(sk);
+                atomic_inc(&sk->sk_drops);
+                goto discard_and_relse;
+        }
+
         bh_unlock_sock(sk);
 out:
         sock_put(sk);
@@ -741,7 +745,7 @@ int sock_getsockopt(struct socket *sock, int level, int optname,
                 struct timeval tm;
         } v;
 
-        unsigned int lv = sizeof(int);
+        int lv = sizeof(int);
         int len;
 
         if (get_user(len, optlen))
@@ -1073,7 +1077,8 @@ static void __sk_free(struct sock *sk)
         if (sk->sk_destruct)
                 sk->sk_destruct(sk);
 
-        filter = rcu_dereference(sk->sk_filter);
+        filter = rcu_dereference_check(sk->sk_filter,
+                                       atomic_read(&sk->sk_wmem_alloc) == 0);
         if (filter) {
                 sk_filter_uncharge(sk, filter);
                 rcu_assign_pointer(sk->sk_filter, NULL);
@@ -1138,6 +1143,7 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
                 sock_lock_init(newsk);
                 bh_lock_sock(newsk);
                 newsk->sk_backlog.head  = newsk->sk_backlog.tail = NULL;
+                newsk->sk_backlog.len = 0;
 
                 atomic_set(&newsk->sk_rmem_alloc, 0);
                 /*
@@ -1541,6 +1547,12 @@ static void __release_sock(struct sock *sk)
 
                 bh_lock_sock(sk);
         } while ((skb = sk->sk_backlog.head) != NULL);
+
+        /*
+         * Doing the zeroing here guarantee we can not loop forever
+         * while a wild producer attempts to flood us.
+         */
+        sk->sk_backlog.len = 0;
 }
 
 /**
@@ -1873,6 +1885,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
         sk->sk_allocation       =       GFP_KERNEL;
         sk->sk_rcvbuf           =       sysctl_rmem_default;
         sk->sk_sndbuf           =       sysctl_wmem_default;
+        sk->sk_backlog.limit    =       sk->sk_rcvbuf << 1;
         sk->sk_state            =       TCP_CLOSE;
         sk_set_socket(sk, sock);
 
@@ -2140,13 +2153,13 @@ int sock_prot_inuse_get(struct net *net, struct proto *prot)
 }
 EXPORT_SYMBOL_GPL(sock_prot_inuse_get);
 
-static int sock_inuse_init_net(struct net *net)
+static int __net_init sock_inuse_init_net(struct net *net)
 {
         net->core.inuse = alloc_percpu(struct prot_inuse);
         return net->core.inuse ? 0 : -ENOMEM;
 }
 
-static void sock_inuse_exit_net(struct net *net)
+static void __net_exit sock_inuse_exit_net(struct net *net)
 {
         free_percpu(net->core.inuse);
 }
@@ -2228,13 +2241,10 @@ int proto_register(struct proto *prot, int alloc_slab)
                 }
 
                 if (prot->rsk_prot != NULL) {
-                        static const char mask[] = "request_sock_%s";
-
-                        prot->rsk_prot->slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->rsk_prot->slab_name = kasprintf(GFP_KERNEL, "request_sock_%s", prot->name);
                         if (prot->rsk_prot->slab_name == NULL)
                                 goto out_free_sock_slab;
 
-                        sprintf(prot->rsk_prot->slab_name, mask, prot->name);
                         prot->rsk_prot->slab = kmem_cache_create(prot->rsk_prot->slab_name,
                                                                  prot->rsk_prot->obj_size, 0,
                                                                  SLAB_HWCACHE_ALIGN, NULL);
@@ -2247,14 +2257,11 @@ int proto_register(struct proto *prot, int alloc_slab)
                 }
 
                 if (prot->twsk_prot != NULL) {
-                        static const char mask[] = "tw_sock_%s";
-
-                        prot->twsk_prot->twsk_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->twsk_prot->twsk_slab_name = kasprintf(GFP_KERNEL, "tw_sock_%s", prot->name);
 
                         if (prot->twsk_prot->twsk_slab_name == NULL)
                                 goto out_free_request_sock_slab;
 
-                        sprintf(prot->twsk_prot->twsk_slab_name, mask, prot->name);
                         prot->twsk_prot->twsk_slab =
                                 kmem_cache_create(prot->twsk_prot->twsk_slab_name,
                                                   prot->twsk_prot->twsk_obj_size,
@@ -2281,7 +2288,8 @@ out_free_request_sock_slab:
                 prot->rsk_prot->slab = NULL;
         }
 out_free_request_sock_slab_name:
-        kfree(prot->rsk_prot->slab_name);
+        if (prot->rsk_prot)
+                kfree(prot->rsk_prot->slab_name);
 out_free_sock_slab:
         kmem_cache_destroy(prot->slab);
         prot->slab = NULL;