11 files changed, 31 insertions, 21 deletions

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 461216b47948..8d157157bf8e 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1097,7 +1097,7 @@ int inet_sk_rebuild_header(struct sock *sk)
 
 EXPORT_SYMBOL(inet_sk_rebuild_header);
 
-static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int sg)
+static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct iphdr *iph;
@@ -1126,10 +1126,10 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int sg)
         rcu_read_lock();
         ops = rcu_dereference(inet_protos[proto]);
         if (ops && ops->gso_segment)
-                segs = ops->gso_segment(skb, sg);
+                segs = ops->gso_segment(skb, features);
         rcu_read_unlock();
 
-        if (IS_ERR(segs))
+        if (!segs || unlikely(IS_ERR(segs)))
                 goto out;
 
         skb = segs;
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index e1d7f5fbc526..ef0b5aac5838 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -332,7 +332,7 @@ config IP_NF_MATCH_HASHLIMIT
         help
           This option adds a new iptables `hashlimit' match.  
 
-          As opposed to `limit', this match dynamically crates a hash table
+          As opposed to `limit', this match dynamically creates a hash table
           of limit buckets, based on your selection of source/destination
           ip addresses and/or ports.
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index d0d19192026d..ad39bf640567 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1120,7 +1120,8 @@ int arpt_register_table(struct arpt_table *table,
                 return ret;
         }
 
-        if (xt_register_table(table, &bootstrap, newinfo) != 0) {
+        ret = xt_register_table(table, &bootstrap, newinfo);
+        if (ret != 0) {
                 xt_free_table_info(newinfo);
                 return ret;
         }
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index b93f0494362f..198ac36db861 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -457,11 +457,19 @@ dev_cmp(struct ipq_queue_entry *entry, unsigned long ifindex)
         if (entry->info->indev)
                 if (entry->info->indev->ifindex == ifindex)
                         return 1;
-                        
         if (entry->info->outdev)
                 if (entry->info->outdev->ifindex == ifindex)
                         return 1;
-
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (entry->skb->nf_bridge) {
+                if (entry->skb->nf_bridge->physindev &&
+                    entry->skb->nf_bridge->physindev->ifindex == ifindex)
+                        return 1;
+                if (entry->skb->nf_bridge->physoutdev &&
+                    entry->skb->nf_bridge->physoutdev->ifindex == ifindex)
+                        return 1;
+        }
+#endif
         return 0;
 }
 
@@ -507,7 +515,7 @@ ipq_rcv_skb(struct sk_buff *skb)
         if (type <= IPQM_BASE)
                 return;
                 
-        if (security_netlink_recv(skb))
+        if (security_netlink_recv(skb, CAP_NET_ADMIN))
                 RCV_SKB_FAIL(-EPERM);
         
         write_lock_bh(&queue_lock);
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 706c0025ec5e..7aaaf92efb59 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -2113,7 +2113,8 @@ int ipt_register_table(struct xt_table *table, const struct ipt_replace *repl)
                 return ret;
         }
 
-        if (xt_register_table(table, &bootstrap, newinfo) != 0) {
+        ret = xt_register_table(table, &bootstrap, newinfo);
+        if (ret != 0) {
                 xt_free_table_info(newinfo);
                 return ret;
         }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index c04176be7ed1..0336422c88a0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2145,7 +2145,7 @@ int compat_tcp_getsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(compat_tcp_getsockopt);
 #endif
 
-struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int sg)
+struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct tcphdr *th;
@@ -2166,10 +2166,14 @@ struct sk_buff *tcp_tso_segment(struct sk_buff *skb, int sg)
         if (!pskb_may_pull(skb, thlen))
                 goto out;
 
+        segs = NULL;
+        if (skb_gso_ok(skb, features | NETIF_F_GSO_ROBUST))
+                goto out;
+
         oldlen = (u16)~skb->len;
         __skb_pull(skb, thlen);
 
-        segs = skb_segment(skb, sg);
+        segs = skb_segment(skb, features);
         if (IS_ERR(segs))
                 goto out;
 
diff --git a/net/ipv4/tcp_diag.c b/net/ipv4/tcp_diag.c
index c148c1081880..b56399c7cc12 100644
--- a/net/ipv4/tcp_diag.c
+++ b/net/ipv4/tcp_diag.c
@@ -26,7 +26,10 @@ static void tcp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
         const struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_info *info = _info;
 
-        r->idiag_rqueue = tp->rcv_nxt - tp->copied_seq;
+        if (sk->sk_state == TCP_LISTEN)
+                r->idiag_rqueue = sk->sk_ack_backlog;
+        else
+                r->idiag_rqueue = tp->rcv_nxt - tp->copied_seq;
         r->idiag_wqueue = tp->write_seq - tp->snd_una;
         if (info != NULL)
                 tcp_get_info(sk, info);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 94fe5b1f9dcb..7fa0b4a8a389 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4178,8 +4178,6 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
                  */
 
                 TCP_ECN_rcv_synack(tp, th);
-                if (tp->ecn_flags&TCP_ECN_OK)
-                        sock_set_flag(sk, SOCK_NO_LARGESEND);
 
                 tp->snd_wl1 = TCP_SKB_CB(skb)->seq;
                 tcp_ack(sk, skb, FLAG_SLOWPATH);
@@ -4322,8 +4320,6 @@ discard:
                 tp->max_window = tp->snd_wnd;
 
                 TCP_ECN_rcv_syn(tp, th);
-                if (tp->ecn_flags&TCP_ECN_OK)
-                        sock_set_flag(sk, SOCK_NO_LARGESEND);
 
                 tcp_mtup_init(sk);
                 tcp_sync_mss(sk, icsk->icsk_pmtu_cookie);
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 25ecc6e2478b..4c6ef47eb1c3 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1726,7 +1726,8 @@ static void get_tcp4_sock(struct sock *sp, char *tmpbuf, int i)
         sprintf(tmpbuf, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
                         "%08X %5d %8d %lu %d %p %u %u %u %u %d",
                 i, src, srcp, dest, destp, sp->sk_state,
-                tp->write_seq - tp->snd_una, tp->rcv_nxt - tp->copied_seq,
+                tp->write_seq - tp->snd_una,
+                (sp->sk_state == TCP_LISTEN) ? sp->sk_ack_backlog : (tp->rcv_nxt - tp->copied_seq),
                 timer_active,
                 jiffies_to_clock_t(timer_expires - jiffies),
                 icsk->icsk_retransmits,
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 2b9b7f6c7f7c..54b2ef7d3efe 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -440,8 +440,6 @@ struct sock *tcp_create_openreq_child(struct sock *sk, struct request_sock *req,
                         newicsk->icsk_ack.last_seg_size = skb->len - newtp->tcp_header_len;
                 newtp->rx_opt.mss_clamp = req->mss;
                 TCP_ECN_openreq_child(newtp, req);
-                if (newtp->ecn_flags&TCP_ECN_OK)
-                        sock_set_flag(newsk, SOCK_NO_LARGESEND);
 
                 TCP_INC_STATS_BH(TCP_MIB_PASSIVEOPENS);
         }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index bdd71db8bf90..5a7cb4a9c867 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2044,8 +2044,6 @@ struct sk_buff * tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         memset(th, 0, sizeof(struct tcphdr));
         th->syn = 1;
         th->ack = 1;
-        if (dst->dev->features&NETIF_F_TSO)
-                ireq->ecn_ok = 0;
         TCP_ECN_make_synack(req, th);
         th->source = inet_sk(sk)->sport;
         th->dest = ireq->rmt_port;