10 files changed, 64 insertions, 80 deletions

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 3cc96730c4ed..478a30179a52 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -233,11 +233,14 @@ int inet_addr_onlink(struct in_device *in_dev, u32 a, u32 b)
 static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
                          int destroy)
 {
+        struct in_ifaddr *promote = NULL;
         struct in_ifaddr *ifa1 = *ifap;
 
         ASSERT_RTNL();
 
-        /* 1. Deleting primary ifaddr forces deletion all secondaries */
+        /* 1. Deleting primary ifaddr forces deletion all secondaries 
+         * unless alias promotion is set
+         **/
 
         if (!(ifa1->ifa_flags & IFA_F_SECONDARY)) {
                 struct in_ifaddr *ifa;
@@ -251,11 +254,16 @@ static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
                                 continue;
                         }
 
-                        *ifap1 = ifa->ifa_next;
+                        if (!IN_DEV_PROMOTE_SECONDARIES(in_dev)) {
+                                *ifap1 = ifa->ifa_next;
 
-                        rtmsg_ifa(RTM_DELADDR, ifa);
-                        notifier_call_chain(&inetaddr_chain, NETDEV_DOWN, ifa);
-                        inet_free_ifa(ifa);
+                                rtmsg_ifa(RTM_DELADDR, ifa);
+                                notifier_call_chain(&inetaddr_chain, NETDEV_DOWN, ifa);
+                                inet_free_ifa(ifa);
+                        } else {
+                                promote = ifa;
+                                break;
+                        }
                 }
         }
 
@@ -281,6 +289,13 @@ static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
                 if (!in_dev->ifa_list)
                         inetdev_destroy(in_dev);
         }
+
+        if (promote && IN_DEV_PROMOTE_SECONDARIES(in_dev)) {
+                /* not sure if we should send a delete notify first? */
+                promote->ifa_flags &= ~IFA_F_SECONDARY;
+                rtmsg_ifa(RTM_NEWADDR, promote);
+                notifier_call_chain(&inetaddr_chain, NETDEV_UP, promote);
+        }
 }
 
 static int inet_insert_ifa(struct in_ifaddr *ifa)
@@ -1384,6 +1399,15 @@ static struct devinet_sysctl_table {
                         .proc_handler   = &ipv4_doint_and_flush,
                         .strategy       = &ipv4_doint_and_flush_strategy,
                 },
+                {
+                        .ctl_name       = NET_IPV4_CONF_PROMOTE_SECONDARIES,
+                        .procname       = "promote_secondaries",
+                        .data           = &ipv4_devconf.promote_secondaries,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = &ipv4_doint_and_flush,
+                        .strategy       = &ipv4_doint_and_flush_strategy,
+                },
         },
         .devinet_dev = {
                 {
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 053a883247ba..eae84cc39d3f 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -478,7 +478,7 @@ static int __init esp4_init(void)
 {
         struct xfrm_decap_state decap;
 
-        if (sizeof(struct esp_decap_data)  <
+        if (sizeof(struct esp_decap_data)  >
             sizeof(decap.decap_data)) {
                 extern void decap_data_too_small(void);
 
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index daebd93fd8a0..760dc8238d65 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -490,6 +490,14 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
                                 goto slow_path;
+
+                        BUG_ON(frag->sk);
+                        if (skb->sk) {
+                                sock_hold(skb->sk);
+                                frag->sk = skb->sk;
+                                frag->destructor = sock_wfree;
+                                skb->truesize -= frag->truesize;
+                        }
                 }
 
                 /* Everything is OK. Generate! */
diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index faa6176bbeb1..de21da00057f 100644
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -508,7 +508,6 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                         rc = NF_ACCEPT;
                 /* do not touch skb anymore */
                 atomic_inc(&cp->in_pkts);
-                __ip_vs_conn_put(cp);
                 goto out;
         }
 
diff --git a/net/ipv4/multipath_drr.c b/net/ipv4/multipath_drr.c
index 9349686131fc..cf2e6bcf7973 100644
--- a/net/ipv4/multipath_drr.c
+++ b/net/ipv4/multipath_drr.c
@@ -57,7 +57,6 @@ struct multipath_device {
 
 static struct multipath_device state[MULTIPATH_MAX_DEVICECANDIDATES];
 static DEFINE_SPINLOCK(state_lock);
-static struct rtable *last_selection = NULL;
 
 static int inline __multipath_findslot(void)
 {
@@ -111,11 +110,6 @@ struct notifier_block drr_dev_notifier = {
         .notifier_call  = drr_dev_event,
 };
 
-static void drr_remove(struct rtable *rt)
-{
-        if (last_selection == rt)
-                last_selection = NULL;
-}
 
 static void drr_safe_inc(atomic_t *usecount)
 {
@@ -144,14 +138,6 @@ static void drr_select_route(const struct flowi *flp,
         int devidx = -1;
         int cur_min_devidx = -1;
 
-        /* if necessary and possible utilize the old alternative */
-        if ((flp->flags & FLOWI_FLAG_MULTIPATHOLDROUTE) != 0 &&
-            last_selection != NULL) {
-                result = last_selection;
-                *rp = result;
-                return;
-        }
-
         /* 1. make sure all alt. nexthops have the same GC related data */
         /* 2. determine the new candidate to be returned */
         result = NULL;
@@ -229,12 +215,10 @@ static void drr_select_route(const struct flowi *flp,
         }
 
         *rp = result;
-        last_selection = result;
 }
 
 static struct ip_mp_alg_ops drr_ops = {
         .mp_alg_select_route    =       drr_select_route,
-        .mp_alg_remove          =       drr_remove,
 };
 
 static int __init drr_init(void)
@@ -244,7 +228,7 @@ static int __init drr_init(void)
         if (err)
                 return err;
 
-        err = multipath_alg_register(&drr_ops, IP_MP_ALG_RR);
+        err = multipath_alg_register(&drr_ops, IP_MP_ALG_DRR);
         if (err)
                 goto fail;
 
diff --git a/net/ipv4/multipath_rr.c b/net/ipv4/multipath_rr.c
index 554a82568160..061b6b253982 100644
--- a/net/ipv4/multipath_rr.c
+++ b/net/ipv4/multipath_rr.c
@@ -47,29 +47,12 @@
 #include <net/checksum.h>
 #include <net/ip_mp_alg.h>
 
-#define MULTIPATH_MAX_CANDIDATES 40
-
-static struct rtable* last_used = NULL;
-
-static void rr_remove(struct rtable *rt)
-{
-        if (last_used == rt)
-                last_used = NULL;
-}
-
 static void rr_select_route(const struct flowi *flp,
                             struct rtable *first, struct rtable **rp)
 {
         struct rtable *nh, *result, *min_use_cand = NULL;
         int min_use = -1;
 
-        /* if necessary and possible utilize the old alternative */
-        if ((flp->flags & FLOWI_FLAG_MULTIPATHOLDROUTE) != 0 &&
-            last_used != NULL) {
-                result = last_used;
-                goto out;
-        }
-
         /* 1. make sure all alt. nexthops have the same GC related data
          * 2. determine the new candidate to be returned
          */
@@ -90,15 +73,12 @@ static void rr_select_route(const struct flowi *flp,
         if (!result)
                 result = first;
 
-out:
-        last_used = result;
         result->u.dst.__use++;
         *rp = result;
 }
 
 static struct ip_mp_alg_ops rr_ops = {
         .mp_alg_select_route    =       rr_select_route,
-        .mp_alg_remove          =       rr_remove,
 };
 
 static int __init rr_init(void)
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 28d9425d5c39..09e824622977 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -940,37 +940,25 @@ void ip_ct_refresh_acct(struct ip_conntrack *ct,
 struct sk_buff *
 ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user)
 {
-        struct sock *sk = skb->sk;
 #ifdef CONFIG_NETFILTER_DEBUG
         unsigned int olddebug = skb->nf_debug;
 #endif
 
-        if (sk) {
-                sock_hold(sk);
-                skb_orphan(skb);
-        }
+        skb_orphan(skb);
 
         local_bh_disable(); 
         skb = ip_defrag(skb, user);
         local_bh_enable();
 
-        if (!skb) {
-                if (sk)
-                        sock_put(sk);
-                return skb;
-        }
-
-        if (sk) {
-                skb_set_owner_w(skb, sk);
-                sock_put(sk);
-        }
-
-        ip_send_check(skb->nh.iph);
-        skb->nfcache |= NFC_ALTERED;
+        if (skb) {
+                ip_send_check(skb->nh.iph);
+                skb->nfcache |= NFC_ALTERED;
 #ifdef CONFIG_NETFILTER_DEBUG
-        /* Packet path as if nothing had happened. */
-        skb->nf_debug = olddebug;
+                /* Packet path as if nothing had happened. */
+                skb->nf_debug = olddebug;
 #endif
+        }
+
         return skb;
 }
 
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index e5746b674413..eda1fba431a4 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -3,6 +3,7 @@
  * communicating with userspace via netlink.
  *
  * (C) 2000-2002 James Morris <jmorris@intercode.com.au>
+ * (C) 2003-2005 Netfilter Core Team <coreteam@netfilter.org>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
@@ -17,6 +18,7 @@
  * 2005-01-10: Added /proc counter for dropped packets; fixed so
  *             packets aren't delivered to user space if they're going 
  *             to be dropped. 
+ * 2005-05-26: local_bh_{disable,enable} around nf_reinject (Harald Welte)
  *
  */
 #include <linux/module.h>
@@ -71,7 +73,15 @@ static DECLARE_MUTEX(ipqnl_sem);
 static void
 ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
 {
+        /* TCP input path (and probably other bits) assume to be called
+         * from softirq context, not from syscall, like ipq_issue_verdict is
+         * called.  TCP input path deadlocks with locks taken from timer
+         * softirq, e.g.  We therefore emulate this by local_bh_disable() */
+
+        local_bh_disable();
         nf_reinject(entry->skb, entry->info, verdict);
+        local_bh_enable();
+
         kfree(entry);
 }
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 79835a67a274..5bad504630a3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4355,16 +4355,7 @@ int tcp_rcv_established(struct sock *sk, struct sk_buff *skb,
                                         goto no_ack;
                         }
 
-                        if (eaten) {
-                                if (tcp_in_quickack_mode(tp)) {
-                                        tcp_send_ack(sk);
-                                } else {
-                                        tcp_send_delayed_ack(sk);
-                                }
-                        } else {
-                                __tcp_ack_snd_check(sk, 0);
-                        }
-
+                        __tcp_ack_snd_check(sk, 0);
 no_ack:
                         if (eaten)
                                 __kfree_skb(skb);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4a6952e3fee9..7c24e64b443f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -738,7 +738,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
                         unsigned long amount;
 
                         amount = 0;
-                        spin_lock_irq(&sk->sk_receive_queue.lock);
+                        spin_lock_bh(&sk->sk_receive_queue.lock);
                         skb = skb_peek(&sk->sk_receive_queue);
                         if (skb != NULL) {
                                 /*
@@ -748,7 +748,7 @@ int udp_ioctl(struct sock *sk, int cmd, unsigned long arg)
                                  */
                                 amount = skb->len - sizeof(struct udphdr);
                         }
-                        spin_unlock_irq(&sk->sk_receive_queue.lock);
+                        spin_unlock_bh(&sk->sk_receive_queue.lock);
                         return put_user(amount, (int __user *)arg);
                 }
 
@@ -848,12 +848,12 @@ csum_copy_err:
         /* Clear queue. */
         if (flags&MSG_PEEK) {
                 int clear = 0;
-                spin_lock_irq(&sk->sk_receive_queue.lock);
+                spin_lock_bh(&sk->sk_receive_queue.lock);
                 if (skb == skb_peek(&sk->sk_receive_queue)) {
                         __skb_unlink(skb, &sk->sk_receive_queue);
                         clear = 1;
                 }
-                spin_unlock_irq(&sk->sk_receive_queue.lock);
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
                 if (clear)
                         kfree_skb(skb);
         }
@@ -1334,7 +1334,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
                 struct sk_buff_head *rcvq = &sk->sk_receive_queue;
                 struct sk_buff *skb;
 
-                spin_lock_irq(&rcvq->lock);
+                spin_lock_bh(&rcvq->lock);
                 while ((skb = skb_peek(rcvq)) != NULL) {
                         if (udp_checksum_complete(skb)) {
                                 UDP_INC_STATS_BH(UDP_MIB_INERRORS);
@@ -1345,7 +1345,7 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
                                 break;
                         }
                 }
-                spin_unlock_irq(&rcvq->lock);
+                spin_unlock_bh(&rcvq->lock);
 
                 /* nothing to see, move along */
                 if (skb == NULL)