9 files changed, 73 insertions, 7 deletions

diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 7ed3e4ae93ae..987b47dc69ad 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -393,7 +393,7 @@ static void ah4_err(struct sk_buff *skb, u32 info)
             icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                 return;
 
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET);
         if (!x)
                 return;
         printk(KERN_DEBUG "pmtu discovery on SA AH/%08x/%08x\n",
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 014982b61564..51ca946e3392 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1317,14 +1317,19 @@ static int devinet_sysctl_forward(ctl_table *ctl, int write,
 {
         int *valp = ctl->data;
         int val = *valp;
+        loff_t pos = *ppos;
         int ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
 
         if (write && *valp != val) {
                 struct net *net = ctl->extra2;
 
                 if (valp != &IPV4_DEVCONF_DFLT(net, FORWARDING)) {
-                        if (!rtnl_trylock())
+                        if (!rtnl_trylock()) {
+                                /* Restore the original values before restarting */
+                                *valp = val;
+                                *ppos = pos;
                                 return restart_syscall();
+                        }
                         if (valp == &IPV4_DEVCONF_ALL(net, FORWARDING)) {
                                 inet_forward_change(net);
                         } else if (*valp) {
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index 1948895beb6d..14ca1f1c3fb0 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -422,7 +422,7 @@ static void esp4_err(struct sk_buff *skb, u32 info)
             icmp_hdr(skb)->code != ICMP_FRAG_NEEDED)
                 return;
 
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET);
         if (!x)
                 return;
         NETDEBUG(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%08x\n",
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index a2a5983dbf03..c0c5274d0271 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -793,7 +793,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                 }
 
                 if (mtu >= IPV6_MIN_MTU && mtu < skb->len - tunnel->hlen + gre_hlen) {
-                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                         ip_rt_put(rt);
                         goto tx_error;
                 }
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index 83ed71500898..629067571f02 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -36,7 +36,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
                 return;
 
         spi = htonl(ntohs(ipch->cpi));
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr,
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr,
                               spi, IPPROTO_COMP, AF_INET);
         if (!x)
                 return;
@@ -63,6 +63,7 @@ static struct xfrm_state *ipcomp_tunnel_create(struct xfrm_state *x)
         t->props.mode = x->props.mode;
         t->props.saddr.a4 = x->props.saddr.a4;
         t->props.flags = x->props.flags;
+        memcpy(&t->mark, &x->mark, sizeof(t->mark));
 
         if (xfrm_init_state(t))
                 goto error;
@@ -87,8 +88,9 @@ static int ipcomp_tunnel_attach(struct xfrm_state *x)
         struct net *net = xs_net(x);
         int err = 0;
         struct xfrm_state *t;
+        u32 mark = x->mark.v & x->mark.m;
 
-        t = xfrm_state_lookup(net, (xfrm_address_t *)&x->id.daddr.a4,
+        t = xfrm_state_lookup(net, mark, (xfrm_address_t *)&x->id.daddr.a4,
                               x->props.saddr.a4, IPPROTO_IPIP, AF_INET);
         if (!t) {
                 t = ipcomp_tunnel_create(x);
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index 7e3712ce3994..c1bc074f61b7 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -576,6 +576,20 @@ static struct ctl_table ipv4_table[] = {
                 .proc_handler   = proc_dointvec
         },
         {
+                .procname       = "tcp_thin_linear_timeouts",
+                .data           = &sysctl_tcp_thin_linear_timeouts,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
+                .procname       = "tcp_thin_dupack",
+                .data           = &sysctl_tcp_thin_dupack,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
+        {
                 .procname       = "udp_mem",
                 .data           = &sysctl_udp_mem,
                 .maxlen         = sizeof(sysctl_udp_mem),
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index e471d037fcc9..5901010fad55 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2229,6 +2229,20 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 }
                 break;
 
+        case TCP_THIN_LINEAR_TIMEOUTS:
+                if (val < 0 || val > 1)
+                        err = -EINVAL;
+                else
+                        tp->thin_lto = val;
+                break;
+
+        case TCP_THIN_DUPACK:
+                if (val < 0 || val > 1)
+                        err = -EINVAL;
+                else
+                        tp->thin_dupack = val;
+                break;
+
         case TCP_CORK:
                 /* When set indicates to always queue non-full frames.
                  * Later the user clears this option and we transmit
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3fddc69ccccc..788851ca8c5d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -89,6 +89,8 @@ int sysctl_tcp_frto __read_mostly = 2;
 int sysctl_tcp_frto_response __read_mostly;
 int sysctl_tcp_nometrics_save __read_mostly;
 
+int sysctl_tcp_thin_dupack __read_mostly;
+
 int sysctl_tcp_moderate_rcvbuf __read_mostly = 1;
 int sysctl_tcp_abc __read_mostly;
 
@@ -2447,6 +2449,16 @@ static int tcp_time_to_recover(struct sock *sk)
                 return 1;
         }
 
+        /* If a thin stream is detected, retransmit after first
+         * received dupack. Employ only if SACK is supported in order
+         * to avoid possible corner-case series of spurious retransmissions
+         * Use only if there are no unsent data.
+         */
+        if ((tp->thin_dupack || sysctl_tcp_thin_dupack) &&
+            tcp_stream_is_thin(tp) && tcp_dupack_heuristics(tp) > 1 &&
+            tcp_is_sack(tp) && !tcp_send_head(sk))
+                return 1;
+
         return 0;
 }
 
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index de7d1bf9114f..a17629b8912e 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -29,6 +29,7 @@ int sysctl_tcp_keepalive_intvl __read_mostly = TCP_KEEPALIVE_INTVL;
 int sysctl_tcp_retries1 __read_mostly = TCP_RETR1;
 int sysctl_tcp_retries2 __read_mostly = TCP_RETR2;
 int sysctl_tcp_orphan_retries __read_mostly;
+int sysctl_tcp_thin_linear_timeouts __read_mostly;
 
 static void tcp_write_timer(unsigned long);
 static void tcp_delack_timer(unsigned long);
@@ -415,7 +416,25 @@ void tcp_retransmit_timer(struct sock *sk)
         icsk->icsk_retransmits++;
 
 out_reset_timer:
-        icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
+        /* If stream is thin, use linear timeouts. Since 'icsk_backoff' is
+         * used to reset timer, set to 0. Recalculate 'icsk_rto' as this
+         * might be increased if the stream oscillates between thin and thick,
+         * thus the old value might already be too high compared to the value
+         * set by 'tcp_set_rto' in tcp_input.c which resets the rto without
+         * backoff. Limit to TCP_THIN_LINEAR_RETRIES before initiating
+         * exponential backoff behaviour to avoid continue hammering
+         * linear-timeout retransmissions into a black hole
+         */
+        if (sk->sk_state == TCP_ESTABLISHED &&
+            (tp->thin_lto || sysctl_tcp_thin_linear_timeouts) &&
+            tcp_stream_is_thin(tp) &&
+            icsk->icsk_retransmits <= TCP_THIN_LINEAR_RETRIES) {
+                icsk->icsk_backoff = 0;
+                icsk->icsk_rto = min(__tcp_set_rto(tp), TCP_RTO_MAX);
+        } else {
+                /* Use normal (exponential) backoff */
+                icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
+        }
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
         if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
                 __sk_dst_reset(sk);