4 files changed, 40 insertions, 19 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index b1b0c8d4d7df..bc3c89792b0c 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2286,7 +2286,7 @@ out:
 }
 EXPORT_SYMBOL(skb_checksum_help);
 
-__be16 skb_network_protocol(struct sk_buff *skb)
+__be16 skb_network_protocol(struct sk_buff *skb, int *depth)
 {
         __be16 type = skb->protocol;
         int vlan_depth = ETH_HLEN;
@@ -2313,6 +2313,8 @@ __be16 skb_network_protocol(struct sk_buff *skb)
                 vlan_depth += VLAN_HLEN;
         }
 
+        *depth = vlan_depth;
+
         return type;
 }
 
@@ -2326,12 +2328,13 @@ struct sk_buff *skb_mac_gso_segment(struct sk_buff *skb,
 {
         struct sk_buff *segs = ERR_PTR(-EPROTONOSUPPORT);
         struct packet_offload *ptype;
-        __be16 type = skb_network_protocol(skb);
+        int vlan_depth = skb->mac_len;
+        __be16 type = skb_network_protocol(skb, &vlan_depth);
 
         if (unlikely(!type))
                 return ERR_PTR(-EINVAL);
 
-        __skb_pull(skb, skb->mac_len);
+        __skb_pull(skb, vlan_depth);
 
         rcu_read_lock();
         list_for_each_entry_rcu(ptype, &offload_base, list) {
@@ -2498,8 +2501,10 @@ static netdev_features_t harmonize_features(struct sk_buff *skb,
                                             const struct net_device *dev,
                                             netdev_features_t features)
 {
+        int tmp;
+
         if (skb->ip_summed != CHECKSUM_NONE &&
-            !can_checksum_protocol(features, skb_network_protocol(skb))) {
+            !can_checksum_protocol(features, skb_network_protocol(skb, &tmp))) {
                 features &= ~NETIF_F_ALL_CSUM;
         } else if (illegal_highdma(dev, skb)) {
                 features &= ~NETIF_F_SG;
@@ -4130,8 +4135,8 @@ static void net_rps_action_and_irq_enable(struct softnet_data *sd)
                         struct softnet_data *next = remsd->rps_ipi_next;
 
                         if (cpu_online(remsd->cpu))
-                                __smp_call_function_single(remsd->cpu,
-                                                           &remsd->csd, 0);
+                                smp_call_function_single_async(remsd->cpu,
+                                                           &remsd->csd);
                         remsd = next;
                 }
         } else
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index a664f7829a6d..df9e6b1a9759 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -742,7 +742,7 @@ static bool pkt_is_ns(struct sk_buff *skb)
         struct nd_msg *msg;
         struct ipv6hdr *hdr;
 
-        if (skb->protocol != htons(ETH_P_ARP))
+        if (skb->protocol != htons(ETH_P_IPV6))
                 return false;
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr) + sizeof(struct nd_msg)))
                 return false;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 1a0dac2ef9ad..120eecc0f5a4 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -2121,12 +2121,13 @@ EXPORT_SYMBOL(rtmsg_ifinfo);
 static int nlmsg_populate_fdb_fill(struct sk_buff *skb,
                                    struct net_device *dev,
                                    u8 *addr, u32 pid, u32 seq,
-                                   int type, unsigned int flags)
+                                   int type, unsigned int flags,
+                                   int nlflags)
 {
         struct nlmsghdr *nlh;
         struct ndmsg *ndm;
 
-        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), NLM_F_MULTI);
+        nlh = nlmsg_put(skb, pid, seq, type, sizeof(*ndm), nlflags);
         if (!nlh)
                 return -EMSGSIZE;
 
@@ -2164,7 +2165,7 @@ static void rtnl_fdb_notify(struct net_device *dev, u8 *addr, int type)
         if (!skb)
                 goto errout;
 
-        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF);
+        err = nlmsg_populate_fdb_fill(skb, dev, addr, 0, 0, type, NTF_SELF, 0);
         if (err < 0) {
                 kfree_skb(skb);
                 goto errout;
@@ -2389,7 +2390,8 @@ static int nlmsg_populate_fdb(struct sk_buff *skb,
 
                 err = nlmsg_populate_fdb_fill(skb, dev, ha->addr,
                                               portid, seq,
-                                              RTM_NEWNEIGH, NTF_SELF);
+                                              RTM_NEWNEIGH, NTF_SELF,
+                                              NLM_F_MULTI);
                 if (err < 0)
                         return err;
 skip:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 869c7afe3b07..90b96a11b974 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2127,25 +2127,31 @@ EXPORT_SYMBOL_GPL(skb_zerocopy_headlen);
  *
  *      The `hlen` as calculated by skb_zerocopy_headlen() specifies the
  *      headroom in the `to` buffer.
+ *
+ *      Return value:
+ *      0: everything is OK
+ *      -ENOMEM: couldn't orphan frags of @from due to lack of memory
+ *      -EFAULT: skb_copy_bits() found some problem with skb geometry
  */
-void
-skb_zerocopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
+int
+skb_zerocopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
 {
         int i, j = 0;
         int plen = 0; /* length of skb->head fragment */
+        int ret;
         struct page *page;
         unsigned int offset;
 
         BUG_ON(!from->head_frag && !hlen);
 
         /* dont bother with small payloads */
-        if (len <= skb_tailroom(to)) {
-                skb_copy_bits(from, 0, skb_put(to, len), len);
-                return;
-        }
+        if (len <= skb_tailroom(to))
+                return skb_copy_bits(from, 0, skb_put(to, len), len);
 
         if (hlen) {
-                skb_copy_bits(from, 0, skb_put(to, hlen), hlen);
+                ret = skb_copy_bits(from, 0, skb_put(to, hlen), hlen);
+                if (unlikely(ret))
+                        return ret;
                 len -= hlen;
         } else {
                 plen = min_t(int, skb_headlen(from), len);
@@ -2163,6 +2169,11 @@ skb_zerocopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
         to->len += len + plen;
         to->data_len += len + plen;
 
+        if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
+                skb_tx_error(from);
+                return -ENOMEM;
+        }
+
         for (i = 0; i < skb_shinfo(from)->nr_frags; i++) {
                 if (!len)
                         break;
@@ -2173,6 +2184,8 @@ skb_zerocopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
                 j++;
         }
         skb_shinfo(to)->nr_frags = j;
+
+        return 0;
 }
 EXPORT_SYMBOL_GPL(skb_zerocopy);
 
@@ -2866,8 +2879,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
         int err = -ENOMEM;
         int i = 0;
         int pos;
+        int dummy;
 
-        proto = skb_network_protocol(head_skb);
+        proto = skb_network_protocol(head_skb, &dummy);
         if (unlikely(!proto))
                 return ERR_PTR(-EINVAL);