11 files changed, 121 insertions, 57 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 17d67b579beb..c2442b46646e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -133,6 +133,8 @@
 #include <linux/pci.h>
 #include <linux/inetdevice.h>
 #include <linux/cpu_rmap.h>
+#include <linux/if_tunnel.h>
+#include <linux/if_pppox.h>
 
 #include "net-sysfs.h"
 
@@ -2519,24 +2521,29 @@ static inline void ____napi_schedule(struct softnet_data *sd,
 
 /*
  * __skb_get_rxhash: calculate a flow hash based on src/dst addresses
- * and src/dst port numbers. Returns a non-zero hash number on success
- * and 0 on failure.
+ * and src/dst port numbers.  Sets rxhash in skb to non-zero hash value
+ * on success, zero indicates no valid hash.  Also, sets l4_rxhash in skb
+ * if hash is a canonical 4-tuple hash over transport ports.
  */
-__u32 __skb_get_rxhash(struct sk_buff *skb)
+void __skb_get_rxhash(struct sk_buff *skb)
 {
         int nhoff, hash = 0, poff;
         const struct ipv6hdr *ip6;
         const struct iphdr *ip;
+        const struct vlan_hdr *vlan;
         u8 ip_proto;
-        u32 addr1, addr2, ihl;
+        u32 addr1, addr2;
+        u16 proto;
         union {
                 u32 v32;
                 u16 v16[2];
         } ports;
 
         nhoff = skb_network_offset(skb);
+        proto = skb->protocol;
 
-        switch (skb->protocol) {
+again:
+        switch (proto) {
         case __constant_htons(ETH_P_IP):
                 if (!pskb_may_pull(skb, sizeof(*ip) + nhoff))
                         goto done;
@@ -2548,7 +2555,7 @@ __u32 __skb_get_rxhash(struct sk_buff *skb)
                         ip_proto = ip->protocol;
                 addr1 = (__force u32) ip->saddr;
                 addr2 = (__force u32) ip->daddr;
-                ihl = ip->ihl;
+                nhoff += ip->ihl * 4;
                 break;
         case __constant_htons(ETH_P_IPV6):
                 if (!pskb_may_pull(skb, sizeof(*ip6) + nhoff))
@@ -2558,20 +2565,62 @@ __u32 __skb_get_rxhash(struct sk_buff *skb)
                 ip_proto = ip6->nexthdr;
                 addr1 = (__force u32) ip6->saddr.s6_addr32[3];
                 addr2 = (__force u32) ip6->daddr.s6_addr32[3];
-                ihl = (40 >> 2);
+                nhoff += 40;
                 break;
+        case __constant_htons(ETH_P_8021Q):
+                if (!pskb_may_pull(skb, sizeof(*vlan) + nhoff))
+                        goto done;
+                vlan = (const struct vlan_hdr *) (skb->data + nhoff);
+                proto = vlan->h_vlan_encapsulated_proto;
+                nhoff += sizeof(*vlan);
+                goto again;
+        case __constant_htons(ETH_P_PPP_SES):
+                if (!pskb_may_pull(skb, PPPOE_SES_HLEN + nhoff))
+                        goto done;
+                proto = *((__be16 *) (skb->data + nhoff +
+                                      sizeof(struct pppoe_hdr)));
+                nhoff += PPPOE_SES_HLEN;
+                goto again;
         default:
                 goto done;
         }
 
+        switch (ip_proto) {
+        case IPPROTO_GRE:
+                if (pskb_may_pull(skb, nhoff + 16)) {
+                        u8 *h = skb->data + nhoff;
+                        __be16 flags = *(__be16 *)h;
+
+                        /*
+                         * Only look inside GRE if version zero and no
+                         * routing
+                         */
+                        if (!(flags & (GRE_VERSION|GRE_ROUTING))) {
+                                proto = *(__be16 *)(h + 2);
+                                nhoff += 4;
+                                if (flags & GRE_CSUM)
+                                        nhoff += 4;
+                                if (flags & GRE_KEY)
+                                        nhoff += 4;
+                                if (flags & GRE_SEQ)
+                                        nhoff += 4;
+                                goto again;
+                        }
+                }
+                break;
+        default:
+                break;
+        }
+
         ports.v32 = 0;
         poff = proto_ports_offset(ip_proto);
         if (poff >= 0) {
-                nhoff += ihl * 4 + poff;
+                nhoff += poff;
                 if (pskb_may_pull(skb, nhoff + 4)) {
                         ports.v32 = * (__force u32 *) (skb->data + nhoff);
                         if (ports.v16[1] < ports.v16[0])
                                 swap(ports.v16[0], ports.v16[1]);
+                        skb->l4_rxhash = 1;
                 }
         }
 
@@ -2584,7 +2633,7 @@ __u32 __skb_get_rxhash(struct sk_buff *skb)
                 hash = 1;
 
 done:
-        return hash;
+        skb->rxhash = hash;
 }
 EXPORT_SYMBOL(__skb_get_rxhash);
 
@@ -2673,13 +2722,13 @@ static int get_rps_cpu(struct net_device *dev, struct sk_buff *skb,
         map = rcu_dereference(rxqueue->rps_map);
         if (map) {
                 if (map->len == 1 &&
-                    !rcu_dereference_raw(rxqueue->rps_flow_table)) {
+                    !rcu_access_pointer(rxqueue->rps_flow_table)) {
                         tcpu = map->cpus[0];
                         if (cpu_online(tcpu))
                                 cpu = tcpu;
                         goto done;
                 }
-        } else if (!rcu_dereference_raw(rxqueue->rps_flow_table)) {
+        } else if (!rcu_access_pointer(rxqueue->rps_flow_table)) {
                 goto done;
         }
 
@@ -3094,8 +3143,8 @@ void netdev_rx_handler_unregister(struct net_device *dev)
 {
 
         ASSERT_RTNL();
-        rcu_assign_pointer(dev->rx_handler, NULL);
-        rcu_assign_pointer(dev->rx_handler_data, NULL);
+        RCU_INIT_POINTER(dev->rx_handler, NULL);
+        RCU_INIT_POINTER(dev->rx_handler_data, NULL);
 }
 EXPORT_SYMBOL_GPL(netdev_rx_handler_unregister);
 
@@ -4489,9 +4538,7 @@ void __dev_set_rx_mode(struct net_device *dev)
         if (!netif_device_present(dev))
                 return;
 
-        if (ops->ndo_set_rx_mode)
-                ops->ndo_set_rx_mode(dev);
-        else {
+        if (!(dev->priv_flags & IFF_UNICAST_FLT)) {
                 /* Unicast addresses changes may only happen under the rtnl,
                  * therefore calling __dev_set_promiscuity here is safe.
                  */
@@ -4502,10 +4549,10 @@ void __dev_set_rx_mode(struct net_device *dev)
                         __dev_set_promiscuity(dev, -1);
                         dev->uc_promisc = false;
                 }
-
-                if (ops->ndo_set_multicast_list)
-                        ops->ndo_set_multicast_list(dev);
         }
+
+        if (ops->ndo_set_rx_mode)
+                ops->ndo_set_rx_mode(dev);
 }
 
 void dev_set_rx_mode(struct net_device *dev)
@@ -4855,7 +4902,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                 return -EOPNOTSUPP;
 
         case SIOCADDMULTI:
-                if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
+                if (!ops->ndo_set_rx_mode ||
                     ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
                         return -EINVAL;
                 if (!netif_device_present(dev))
@@ -4863,7 +4910,7 @@ static int dev_ifsioc(struct net *net, struct ifreq *ifr, unsigned int cmd)
                 return dev_mc_add_global(dev, ifr->ifr_hwaddr.sa_data);
 
         case SIOCDELMULTI:
-                if ((!ops->ndo_set_multicast_list && !ops->ndo_set_rx_mode) ||
+                if (!ops->ndo_set_rx_mode ||
                     ifr->ifr_hwaddr.sa_family != AF_UNSPEC)
                         return -EINVAL;
                 if (!netif_device_present(dev))
@@ -5727,8 +5774,8 @@ void netdev_run_todo(void)
 
                 /* paranoia */
                 BUG_ON(netdev_refcnt_read(dev));
-                WARN_ON(rcu_dereference_raw(dev->ip_ptr));
-                WARN_ON(rcu_dereference_raw(dev->ip6_ptr));
+                WARN_ON(rcu_access_pointer(dev->ip_ptr));
+                WARN_ON(rcu_access_pointer(dev->ip6_ptr));
                 WARN_ON(dev->dn_ptr);
 
                 if (dev->destructor)
@@ -5932,7 +5979,7 @@ void free_netdev(struct net_device *dev)
         kfree(dev->_rx);
 #endif
 
-        kfree(rcu_dereference_raw(dev->ingress_queue));
+        kfree(rcu_dereference_protected(dev->ingress_queue, 1));
 
         /* Flush device addresses */
         dev_addr_flush(dev);
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index e2e66939ed00..283d1b863876 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -591,8 +591,8 @@ EXPORT_SYMBOL(dev_mc_del_global);
  *      addresses that have no users left. The source device must be
  *      locked by netif_tx_lock_bh.
  *
- *      This function is intended to be called from the dev->set_multicast_list
- *      or dev->set_rx_mode function of layered software devices.
+ *      This function is intended to be called from the ndo_set_rx_mode
+ *      function of layered software devices.
  */
 int dev_mc_sync(struct net_device *to, struct net_device *from)
 {
diff --git a/net/core/dst.c b/net/core/dst.c
index 14b33baf0733..d5e2c4c09107 100644
--- a/net/core/dst.c
+++ b/net/core/dst.c
@@ -171,7 +171,7 @@ void *dst_alloc(struct dst_ops *ops, struct net_device *dev,
         dst_init_metrics(dst, dst_default_metrics, true);
         dst->expires = 0UL;
         dst->path = dst;
-        dst->_neighbour = NULL;
+        RCU_INIT_POINTER(dst->_neighbour, NULL);
 #ifdef CONFIG_XFRM
         dst->xfrm = NULL;
 #endif
@@ -229,11 +229,11 @@ struct dst_entry *dst_destroy(struct dst_entry * dst)
         smp_rmb();
 
 again:
-        neigh = dst->_neighbour;
+        neigh = rcu_dereference_protected(dst->_neighbour, 1);
         child = dst->child;
 
         if (neigh) {
-                dst->_neighbour = NULL;
+                RCU_INIT_POINTER(dst->_neighbour, NULL);
                 neigh_release(neigh);
         }
 
@@ -360,14 +360,19 @@ static void dst_ifdown(struct dst_entry *dst, struct net_device *dev,
         if (!unregister) {
                 dst->input = dst->output = dst_discard;
         } else {
+                struct neighbour *neigh;
+
                 dst->dev = dev_net(dst->dev)->loopback_dev;
                 dev_hold(dst->dev);
                 dev_put(dev);
-                if (dst->_neighbour && dst->_neighbour->dev == dev) {
-                        dst->_neighbour->dev = dst->dev;
+                rcu_read_lock();
+                neigh = dst_get_neighbour(dst);
+                if (neigh && neigh->dev == dev) {
+                        neigh->dev = dst->dev;
                         dev_hold(dst->dev);
                         dev_put(dev);
                 }
+                rcu_read_unlock();
         }
 }
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index e7ab0c0285b5..67c5c288cd80 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -487,7 +487,7 @@ static int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                 if (ops->nr_goto_rules > 0) {
                         list_for_each_entry(tmp, &ops->rules_list, list) {
                                 if (rtnl_dereference(tmp->ctarget) == rule) {
-                                        rcu_assign_pointer(tmp->ctarget, NULL);
+                                        RCU_INIT_POINTER(tmp->ctarget, NULL);
                                         ops->unresolved_rules++;
                                 }
                         }
@@ -545,7 +545,7 @@ static int fib_nl_fill_rule(struct sk_buff *skb, struct fib_rule *rule,
         frh->flags = rule->flags;
 
         if (rule->action == FR_ACT_GOTO &&
-            rcu_dereference_raw(rule->ctarget) == NULL)
+            rcu_access_pointer(rule->ctarget) == NULL)
                 frh->flags |= FIB_RULE_UNRESOLVED;
 
         if (rule->iifname[0]) {
diff --git a/net/core/filter.c b/net/core/filter.c
index 36f975fa87cb..8fcc2d776e09 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -645,7 +645,7 @@ int sk_detach_filter(struct sock *sk)
         filter = rcu_dereference_protected(sk->sk_filter,
                                            sock_owned_by_user(sk));
         if (filter) {
-                rcu_assign_pointer(sk->sk_filter, NULL);
+                RCU_INIT_POINTER(sk->sk_filter, NULL);
                 sk_filter_uncharge(sk, filter);
                 ret = 0;
         }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 8fab9b0bb203..4002261f20d1 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -844,6 +844,19 @@ static void neigh_invalidate(struct neighbour *neigh)
         skb_queue_purge(&neigh->arp_queue);
 }
 
+static void neigh_probe(struct neighbour *neigh)
+        __releases(neigh->lock)
+{
+        struct sk_buff *skb = skb_peek(&neigh->arp_queue);
+        /* keep skb alive even if arp_queue overflows */
+        if (skb)
+                skb = skb_copy(skb, GFP_ATOMIC);
+        write_unlock(&neigh->lock);
+        neigh->ops->solicit(neigh, skb);
+        atomic_inc(&neigh->probes);
+        kfree_skb(skb);
+}
+
 /* Called when a timer expires for a neighbour entry. */
 
 static void neigh_timer_handler(unsigned long arg)
@@ -920,14 +933,7 @@ static void neigh_timer_handler(unsigned long arg)
                         neigh_hold(neigh);
         }
         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
-                struct sk_buff *skb = skb_peek(&neigh->arp_queue);
-                /* keep skb alive even if arp_queue overflows */
-                if (skb)
-                        skb = skb_copy(skb, GFP_ATOMIC);
-                write_unlock(&neigh->lock);
-                neigh->ops->solicit(neigh, skb);
-                atomic_inc(&neigh->probes);
-                kfree_skb(skb);
+                neigh_probe(neigh);
         } else {
 out:
                 write_unlock(&neigh->lock);
@@ -942,7 +948,7 @@ out:
 int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
 {
         int rc;
-        unsigned long now;
+        bool immediate_probe = false;
 
         write_lock_bh(&neigh->lock);
 
@@ -950,14 +956,16 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
         if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
                 goto out_unlock_bh;
 
-        now = jiffies;
-
         if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
                 if (neigh->parms->mcast_probes + neigh->parms->app_probes) {
+                        unsigned long next, now = jiffies;
+
                         atomic_set(&neigh->probes, neigh->parms->ucast_probes);
                         neigh->nud_state     = NUD_INCOMPLETE;
-                        neigh->updated = jiffies;
-                        neigh_add_timer(neigh, now + 1);
+                        neigh->updated = now;
+                        next = now + max(neigh->parms->retrans_time, HZ/2);
+                        neigh_add_timer(neigh, next);
+                        immediate_probe = true;
                 } else {
                         neigh->nud_state = NUD_FAILED;
                         neigh->updated = jiffies;
@@ -989,7 +997,11 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
                 rc = 1;
         }
 out_unlock_bh:
-        write_unlock_bh(&neigh->lock);
+        if (immediate_probe)
+                neigh_probe(neigh);
+        else
+                write_unlock(&neigh->lock);
+        local_bh_enable();
         return rc;
 }
 EXPORT_SYMBOL(__neigh_event_send);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 1683e5db2f27..56e42ab7cbc6 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -712,13 +712,13 @@ static void rx_queue_release(struct kobject *kobj)
         struct rps_dev_flow_table *flow_table;
 
 
-        map = rcu_dereference_raw(queue->rps_map);
+        map = rcu_dereference_protected(queue->rps_map, 1);
         if (map) {
                 RCU_INIT_POINTER(queue->rps_map, NULL);
                 kfree_rcu(map, rcu);
         }
 
-        flow_table = rcu_dereference_raw(queue->rps_flow_table);
+        flow_table = rcu_dereference_protected(queue->rps_flow_table, 1);
         if (flow_table) {
                 RCU_INIT_POINTER(queue->rps_flow_table, NULL);
                 call_rcu(&flow_table->rcu, rps_dev_flow_table_release);
@@ -987,10 +987,10 @@ static ssize_t store_xps_map(struct netdev_queue *queue,
         }
 
         if (nonempty)
-                rcu_assign_pointer(dev->xps_maps, new_dev_maps);
+                RCU_INIT_POINTER(dev->xps_maps, new_dev_maps);
         else {
                 kfree(new_dev_maps);
-                rcu_assign_pointer(dev->xps_maps, NULL);
+                RCU_INIT_POINTER(dev->xps_maps, NULL);
         }
 
         if (dev_maps)
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index adf84dd8c7b5..d676a561d983 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -760,7 +760,7 @@ int __netpoll_setup(struct netpoll *np)
         }
 
         /* last thing to do is link it to the net device structure */
-        rcu_assign_pointer(ndev->npinfo, npinfo);
+        RCU_INIT_POINTER(ndev->npinfo, npinfo);
 
         return 0;
 
@@ -901,7 +901,7 @@ void __netpoll_cleanup(struct netpoll *np)
                 if (ops->ndo_netpoll_cleanup)
                         ops->ndo_netpoll_cleanup(np->dev);
 
-                rcu_assign_pointer(np->dev->npinfo, NULL);
+                RCU_INIT_POINTER(np->dev->npinfo, NULL);
 
                 /* avoid racing with NAPI reading npinfo */
                 synchronize_rcu_bh();
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 99d9e953fe39..39f8dd6a2821 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1604,7 +1604,6 @@ struct net_device *rtnl_create_link(struct net *src_net, struct net *net,
         dev_net_set(dev, net);
         dev->rtnl_link_ops = ops;
         dev->rtnl_link_state = RTNL_LINK_INITIALIZING;
-        dev->real_num_tx_queues = real_num_queues;
 
         if (tb[IFLA_MTU])
                 dev->mtu = nla_get_u32(tb[IFLA_MTU]);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 27002dffe7ed..edb66f3e24f1 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -529,6 +529,7 @@ static void __copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->mac_header         = old->mac_header;
         skb_dst_copy(new, old);
         new->rxhash             = old->rxhash;
+        new->l4_rxhash          = old->l4_rxhash;
 #ifdef CONFIG_XFRM
         new->sp                 = secpath_get(old->sp);
 #endif
diff --git a/net/core/sock.c b/net/core/sock.c
index bc745d00ea4d..9997026b44b2 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -387,7 +387,7 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie)
 
         if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
                 sk_tx_queue_clear(sk);
-                rcu_assign_pointer(sk->sk_dst_cache, NULL);
+                RCU_INIT_POINTER(sk->sk_dst_cache, NULL);
                 dst_release(dst);
                 return NULL;
         }
@@ -1158,7 +1158,7 @@ static void __sk_free(struct sock *sk)
                                        atomic_read(&sk->sk_wmem_alloc) == 0);
         if (filter) {
                 sk_filter_uncharge(sk, filter);
-                rcu_assign_pointer(sk->sk_filter, NULL);
+                RCU_INIT_POINTER(sk->sk_filter, NULL);
         }
 
         sock_disable_timestamp(sk, SOCK_TIMESTAMP);