8 files changed, 37 insertions, 28 deletions

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index 7a1874b7b8fd..cfeb85cff4f0 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -263,10 +263,8 @@ void build_ehash_secret(void)
                 get_random_bytes(&rnd, sizeof(rnd));
         } while (rnd == 0);
 
-        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0) {
+        if (cmpxchg(&inet_ehash_secret, 0, rnd) == 0)
                 get_random_bytes(&ipv6_hash_secret, sizeof(ipv6_hash_secret));
-                net_secret_init();
-        }
 }
 EXPORT_SYMBOL(build_ehash_secret);
 
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index dace87f06e5f..7defdc9ba167 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -736,7 +736,7 @@ static void igmp_gq_timer_expire(unsigned long data)
 
         in_dev->mr_gq_running = 0;
         igmpv3_send_report(in_dev, NULL);
-        __in_dev_put(in_dev);
+        in_dev_put(in_dev);
 }
 
 static void igmp_ifc_timer_expire(unsigned long data)
@@ -749,7 +749,7 @@ static void igmp_ifc_timer_expire(unsigned long data)
                 igmp_ifc_start_timer(in_dev,
                                      unsolicited_report_interval(in_dev));
         }
-        __in_dev_put(in_dev);
+        in_dev_put(in_dev);
 }
 
 static void igmp_ifc_event(struct in_device *in_dev)
diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
index ac9fabe0300f..63a6d6d6b875 100644
--- a/net/ipv4/ip_tunnel.c
+++ b/net/ipv4/ip_tunnel.c
@@ -623,6 +623,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
                         tunnel->err_count = 0;
         }
 
+        tos = ip_tunnel_ecn_encap(tos, inner_iph, skb);
         ttl = tnl_params->ttl;
         if (ttl == 0) {
                 if (skb->protocol == htons(ETH_P_IP))
@@ -641,18 +642,17 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
 
         max_headroom = LL_RESERVED_SPACE(rt->dst.dev) + sizeof(struct iphdr)
                         + rt->dst.header_len;
-        if (max_headroom > dev->needed_headroom) {
+        if (max_headroom > dev->needed_headroom)
                 dev->needed_headroom = max_headroom;
-                if (skb_cow_head(skb, dev->needed_headroom)) {
-                        dev->stats.tx_dropped++;
-                        dev_kfree_skb(skb);
-                        return;
-                }
+
+        if (skb_cow_head(skb, dev->needed_headroom)) {
+                dev->stats.tx_dropped++;
+                dev_kfree_skb(skb);
+                return;
         }
 
         err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, protocol,
-                            ip_tunnel_ecn_encap(tos, inner_iph, skb), ttl, df,
-                            !net_eq(tunnel->net, dev_net(dev)));
+                            tos, ttl, df, !net_eq(tunnel->net, dev_net(dev)));
         iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
 
         return;
@@ -853,8 +853,10 @@ int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
         /* FB netdevice is special: we have one, and only one per netns.
          * Allowing to move it to another netns is clearly unsafe.
          */
-        if (!IS_ERR(itn->fb_tunnel_dev))
+        if (!IS_ERR(itn->fb_tunnel_dev)) {
                 itn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
+                ip_tunnel_add(itn, netdev_priv(itn->fb_tunnel_dev));
+        }
         rtnl_unlock();
 
         return PTR_RET(itn->fb_tunnel_dev);
@@ -884,8 +886,6 @@ static void ip_tunnel_destroy(struct ip_tunnel_net *itn, struct list_head *head,
                         if (!net_eq(dev_net(t->dev), net))
                                 unregister_netdevice_queue(t->dev, head);
         }
-        if (itn->fb_tunnel_dev)
-                unregister_netdevice_queue(itn->fb_tunnel_dev, head);
 }
 
 void ip_tunnel_delete_net(struct ip_tunnel_net *itn, struct rtnl_link_ops *ops)
diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index d6c856b17fd4..c31e3ad98ef2 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c
@@ -61,7 +61,7 @@ int iptunnel_xmit(struct rtable *rt, struct sk_buff *skb,
         memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
         /* Push down and install the IP header. */
-        __skb_push(skb, sizeof(struct iphdr));
+        skb_push(skb, sizeof(struct iphdr));
         skb_reset_network_header(skb);
 
         iph = ip_hdr(skb);
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 67e17dcda65e..b6346bf2fde3 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -267,7 +267,8 @@ synproxy_tg4(struct sk_buff *skb, const struct xt_action_param *par)
         if (th == NULL)
                 return NF_DROP;
 
-        synproxy_parse_options(skb, par->thoff, th, &opts);
+        if (!synproxy_parse_options(skb, par->thoff, th, &opts))
+                return NF_DROP;
 
         if (th->syn && !(th->ack || th->fin || th->rst)) {
                 /* Initial SYN from client */
@@ -350,7 +351,8 @@ static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
 
                 /* fall through */
         case TCP_CONNTRACK_SYN_SENT:
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
 
                 if (!th->syn && th->ack &&
                     CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
@@ -373,7 +375,9 @@ static unsigned int ipv4_synproxy_hook(unsigned int hooknum,
                 if (!th->syn || !th->ack)
                         break;
 
-                synproxy_parse_options(skb, thoff, th, &opts);
+                if (!synproxy_parse_options(skb, thoff, th, &opts))
+                        return NF_DROP;
+
                 if (opts.options & XT_SYNPROXY_OPT_TIMESTAMP)
                         synproxy->tsoff = opts.tsval - synproxy->its;
 
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index bfec521c717f..193db03540ad 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -218,8 +218,10 @@ static void raw_err(struct sock *sk, struct sk_buff *skb, u32 info)
 
         if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED)
                 ipv4_sk_update_pmtu(skb, sk, info);
-        else if (type == ICMP_REDIRECT)
+        else if (type == ICMP_REDIRECT) {
                 ipv4_sk_redirect(skb, sk);
+                return;
+        }
 
         /* Report error on raw socket, if:
            1. User requested ip_recverr.
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7c83cb8bf137..e6bb8256e59f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -895,8 +895,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
 
         skb_orphan(skb);
         skb->sk = sk;
-        skb->destructor = (sysctl_tcp_limit_output_bytes > 0) ?
-                          tcp_wfree : sock_wfree;
+        skb->destructor = tcp_wfree;
         atomic_add(skb->truesize, &sk->sk_wmem_alloc);
 
         /* Build TCP header and checksum it. */
@@ -1840,7 +1839,6 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
         while ((skb = tcp_send_head(sk))) {
                 unsigned int limit;
 
-
                 tso_segs = tcp_init_tso_segs(sk, skb, mss_now);
                 BUG_ON(!tso_segs);
 
@@ -1869,13 +1867,20 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
                                 break;
                 }
 
-                /* TSQ : sk_wmem_alloc accounts skb truesize,
-                 * including skb overhead. But thats OK.
+                /* TCP Small Queues :
+                 * Control number of packets in qdisc/devices to two packets / or ~1 ms.
+                 * This allows for :
+                 *  - better RTT estimation and ACK scheduling
+                 *  - faster recovery
+                 *  - high rates
                  */
-                if (atomic_read(&sk->sk_wmem_alloc) >= sysctl_tcp_limit_output_bytes) {
+                limit = max(skb->truesize, sk->sk_pacing_rate >> 10);
+
+                if (atomic_read(&sk->sk_wmem_alloc) > limit) {
                         set_bit(TSQ_THROTTLED, &tp->tsq_flags);
                         break;
                 }
+
                 limit = mss_now;
                 if (tso_segs > 1 && !tcp_urg_mode(tp))
                         limit = tcp_mss_split_point(sk, skb, mss_now,
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 74d2c95db57f..0ca44df51ee9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -658,7 +658,7 @@ void __udp4_lib_err(struct sk_buff *skb, u32 info, struct udp_table *udptable)
                 break;
         case ICMP_REDIRECT:
                 ipv4_sk_redirect(skb, sk);
-                break;
+                goto out;
         }
 
         /*