5 files changed, 69 insertions, 59 deletions

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index b9e9e0d38672..e16129019c66 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -766,9 +766,6 @@ static void neigh_periodic_work(struct work_struct *work)
         nht = rcu_dereference_protected(tbl->nht,
                                         lockdep_is_held(&tbl->lock));
 
-        if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
-                goto out;
-
         /*
          *      periodically recompute ReachableTime from random function
          */
@@ -781,6 +778,9 @@ static void neigh_periodic_work(struct work_struct *work)
                                 neigh_rand_reach_time(NEIGH_VAR(p, BASE_REACHABLE_TIME));
         }
 
+        if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
+                goto out;
+
         for (i = 0 ; i < (1 << nht->hash_shift); i++) {
                 np = &nht->hash_buckets[i];
 
@@ -3046,7 +3046,7 @@ int neigh_sysctl_register(struct net_device *dev, struct neigh_parms *p,
         if (!t)
                 goto err;
 
-        for (i = 0; i < ARRAY_SIZE(t->neigh_vars); i++) {
+        for (i = 0; i < NEIGH_VAR_GC_INTERVAL; i++) {
                 t->neigh_vars[i].data += (long) p;
                 t->neigh_vars[i].extra1 = dev;
                 t->neigh_vars[i].extra2 = p;
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index a664f7829a6d..df9e6b1a9759 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -742,7 +742,7 @@ static bool pkt_is_ns(struct sk_buff *skb)
         struct nd_msg *msg;
         struct ipv6hdr *hdr;
 
-        if (skb->protocol != htons(ETH_P_ARP))
+        if (skb->protocol != htons(ETH_P_IPV6))
                 return false;
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg)))
                 return false;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 1a0dac2ef9ad..120eecc0f5a4 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2121,12 +2121,13 @@ EXPORT_SYMBOL(rtmsg_ifinfo);
 static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
                                    struct net_device *dev,
                                    u8 *addr, u32 pid, u32 seq,
-                                   int type, unsigned int flags)
+                                   int type, unsigned int flags,
+                                   int nlflags)
 {
         struct nlmsghdr *nlh;
         struct ndmsg *ndm;
 
-        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), nlflags);
         if (!nlh)
                 return -EMSGSIZE;
 
@@ -2164,7 +2165,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, int type)
         if (!skb)
                 goto errout;
 
-        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF);
+        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF, 0);
         if (err < 0) {
                 kfree_skb(skb);
                 goto errout;
@@ -2389,7 +2390,8 @@ static int nlmsg_populate_fdb(struct sk_buff *skb,
 
                 err = nlmsg_populate_fdb_fill(skb, dev, ha->addr,
                                               portid, seq,
-                                              RTM_NEWNEIGH, NTF_SELF);
+                                              RTM_NEWNEIGH, NTF_SELF,
+                                              NLM_F_MULTI);
                 if (err < 0)
                         return err;
 skip:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 5976ef0846bd..869c7afe3b07 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -707,9 +707,6 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->mark               = old->mark;
         new->skb_iif            = old->skb_iif;
         __nf_copy(new, old);
-#if IS_ENABLED(CONFIG_NETFILTER_XT_TARGET_TRACE)
-        new->nf_trace           = old->nf_trace;
-#endif
 #ifdef CONFIG_NET_SCHED
         new->tc_index           = old->tc_index;
 #ifdef CONFIG_NET_CLS_ACT
@@ -2841,81 +2838,84 @@ EXPORT_SYMBOL_GPL(skb_pull_rcsum);
 
 /**
  *      skb_segment - Perform protocol segmentation on skb.
- *      @skb: buffer to segment
+ *      @head_skb: buffer to segment
  *      @features: features for the output path (see dev->features)
  *
  *      This function performs segmentation on the given skb.  It returns
  *      a pointer to the first in a list of new skbs for the segments.
  *      In case of error it returns ERR_PTR(err).
  */
-struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
+struct sk_buff *skb_segment(struct sk_buff *head_skb,
+                            netdev_features_t features)
 {
         struct sk_buff *segs = NULL;
         struct sk_buff *tail = NULL;
-        struct sk_buff *fskb = skb_shinfo(skb)->frag_list;
-        skb_frag_t *skb_frag = skb_shinfo(skb)->frags;
-        unsigned int mss = skb_shinfo(skb)->gso_size;
-        unsigned int doffset = skb->data - skb_mac_header(skb);
+        struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
+        skb_frag_t *frag = skb_shinfo(head_skb)->frags;
+        unsigned int mss = skb_shinfo(head_skb)->gso_size;
+        unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
+        struct sk_buff *frag_skb = head_skb;
         unsigned int offset = doffset;
-        unsigned int tnl_hlen = skb_tnl_header_len(skb);
+        unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
         unsigned int headroom;
         unsigned int len;
         __be16 proto;
         bool csum;
         int sg = !!(features & NETIF_F_SG);
-        int nfrags = skb_shinfo(skb)->nr_frags;
+        int nfrags = skb_shinfo(head_skb)->nr_frags;
         int err = -ENOMEM;
         int i = 0;
         int pos;
 
-        proto = skb_network_protocol(skb);
+        proto = skb_network_protocol(head_skb);
         if (unlikely(!proto))
                 return ERR_PTR(-EINVAL);
 
         csum = !!can_checksum_protocol(features, proto);
-        __skb_push(skb, doffset);
-        headroom = skb_headroom(skb);
-        pos = skb_headlen(skb);
+        __skb_push(head_skb, doffset);
+        headroom = skb_headroom(head_skb);
+        pos = skb_headlen(head_skb);
 
         do {
                 struct sk_buff *nskb;
-                skb_frag_t *frag;
+                skb_frag_t *nskb_frag;
                 int hsize;
                 int size;
 
-                len = skb->len - offset;
+                len = head_skb->len - offset;
                 if (len > mss)
                         len = mss;
 
-                hsize = skb_headlen(skb) - offset;
+                hsize = skb_headlen(head_skb) - offset;
                 if (hsize < 0)
                         hsize = 0;
                 if (hsize > len || !sg)
                         hsize = len;
 
-                if (!hsize && i >= nfrags && skb_headlen(fskb) &&
-                    (skb_headlen(fskb) == len || sg)) {
-                        BUG_ON(skb_headlen(fskb) > len);
+                if (!hsize && i >= nfrags && skb_headlen(list_skb) &&
+                    (skb_headlen(list_skb) == len || sg)) {
+                        BUG_ON(skb_headlen(list_skb) > len);
 
                         i = 0;
-                        nfrags = skb_shinfo(fskb)->nr_frags;
-                        skb_frag = skb_shinfo(fskb)->frags;
-                        pos += skb_headlen(fskb);
+                        nfrags = skb_shinfo(list_skb)->nr_frags;
+                        frag = skb_shinfo(list_skb)->frags;
+                        frag_skb = list_skb;
+                        pos += skb_headlen(list_skb);
 
                         while (pos < offset + len) {
                                 BUG_ON(i >= nfrags);
 
-                                size = skb_frag_size(skb_frag);
+                                size = skb_frag_size(frag);
                                 if (pos + size > offset + len)
                                         break;
 
                                 i++;
                                 pos += size;
-                                skb_frag++;
+                                frag++;
                         }
 
-                        nskb = skb_clone(fskb, GFP_ATOMIC);
-                        fskb = fskb->next;
+                        nskb = skb_clone(list_skb, GFP_ATOMIC);
+                        list_skb = list_skb->next;
 
                         if (unlikely(!nskb))
                                 goto err;
@@ -2936,7 +2936,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         __skb_push(nskb, doffset);
                 } else {
                         nskb = __alloc_skb(hsize + doffset + headroom,
-                                           GFP_ATOMIC, skb_alloc_rx_flag(skb),
+                                           GFP_ATOMIC, skb_alloc_rx_flag(head_skb),
                                            NUMA_NO_NODE);
 
                         if (unlikely(!nskb))
@@ -2952,12 +2952,12 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                         segs = nskb;
                 tail = nskb;
 
-                __copy_skb_header(nskb, skb);
-                nskb->mac_len = skb->mac_len;
+                __copy_skb_header(nskb, head_skb);
+                nskb->mac_len = head_skb->mac_len;
 
                 skb_headers_offset_update(nskb, skb_headroom(nskb) - headroom);
 
-                skb_copy_from_linear_data_offset(skb, -tnl_hlen,
+                skb_copy_from_linear_data_offset(head_skb, -tnl_hlen,
                                                  nskb->data - tnl_hlen,
                                                  doffset + tnl_hlen);
 
@@ -2966,30 +2966,32 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
 
                 if (!sg) {
                         nskb->ip_summed = CHECKSUM_NONE;
-                        nskb->csum = skb_copy_and_csum_bits(skb, offset,
+                        nskb->csum = skb_copy_and_csum_bits(head_skb, offset,
                                                             skb_put(nskb, len),
                                                             len, 0);
                         continue;
                 }
 
-                frag = skb_shinfo(nskb)->frags;
+                nskb_frag = skb_shinfo(nskb)->frags;
 
-                skb_copy_from_linear_data_offset(skb, offset,
+                skb_copy_from_linear_data_offset(head_skb, offset,
                                                  skb_put(nskb, hsize), hsize);
 
-                skb_shinfo(nskb)->tx_flags = skb_shinfo(skb)->tx_flags & SKBTX_SHARED_FRAG;
+                skb_shinfo(nskb)->tx_flags = skb_shinfo(head_skb)->tx_flags &
+                        SKBTX_SHARED_FRAG;
 
                 while (pos < offset + len) {
                         if (i >= nfrags) {
-                                BUG_ON(skb_headlen(fskb));
+                                BUG_ON(skb_headlen(list_skb));
 
                                 i = 0;
-                                nfrags = skb_shinfo(fskb)->nr_frags;
-                                skb_frag = skb_shinfo(fskb)->frags;
+                                nfrags = skb_shinfo(list_skb)->nr_frags;
+                                frag = skb_shinfo(list_skb)->frags;
+                                frag_skb = list_skb;
 
                                 BUG_ON(!nfrags);
 
-                                fskb = fskb->next;
+                                list_skb = list_skb->next;
                         }
 
                         if (unlikely(skb_shinfo(nskb)->nr_frags >=
@@ -3000,27 +3002,30 @@ struct sk_buff *skb_segment(struct sk_buff *skb, netdev_features_t features)
                                 goto err;
                         }
 
-                        *frag = *skb_frag;
-                        __skb_frag_ref(frag);
-                        size = skb_frag_size(frag);
+                        if (unlikely(skb_orphan_frags(frag_skb, GFP_ATOMIC)))
+                                goto err;
+
+                        *nskb_frag = *frag;
+                        __skb_frag_ref(nskb_frag);
+                        size = skb_frag_size(nskb_frag);
 
                         if (pos < offset) {
-                                frag->page_offset += offset - pos;
-                                skb_frag_size_sub(frag, offset - pos);
+                                nskb_frag->page_offset += offset - pos;
+                                skb_frag_size_sub(nskb_frag, offset - pos);
                         }
 
                         skb_shinfo(nskb)->nr_frags++;
 
                         if (pos + size <= offset + len) {
                                 i++;
-                                skb_frag++;
+                                frag++;
                                 pos += size;
                         } else {
-                                skb_frag_size_sub(frag, pos + size - (offset + len));
+                                skb_frag_size_sub(nskb_frag, pos + size - (offset + len));
                                 goto skip_fraglist;
                         }
 
-                        frag++;
+                        nskb_frag++;
                 }
 
 skip_fraglist:
@@ -3034,7 +3039,7 @@ perform_csum_check:
                                                   nskb->len - doffset, 0);
                         nskb->ip_summed = CHECKSUM_NONE;
                 }
-        } while ((offset += len) < skb->len);
+        } while ((offset += len) < head_skb->len);
 
         return segs;
 
diff --git a/net/core/sock.c b/net/core/sock.c
index 5b6a9431b017..c0fc6bdad1e3 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2357,10 +2357,13 @@ void release_sock(struct sock *sk)
         if (sk->sk_backlog.tail)
                 __release_sock(sk);
 
+        /* Warning : release_cb() might need to release sk ownership,
+         * ie call sock_release_ownership(sk) before us.
+         */
         if (sk->sk_prot->release_cb)
                 sk->sk_prot->release_cb(sk);
 
-        sk->sk_lock.owned = 0;
+        sock_release_ownership(sk);
         if (waitqueue_active(&sk->sk_lock.wq))
                 wake_up(&sk->sk_lock.wq);
         spin_unlock_bh(&sk->sk_lock.slock);