7 files changed, 66 insertions, 27 deletions

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 090e9991ac2a..4e80f336c0cf 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -130,7 +130,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb);
 static void arp_error_report(struct neighbour *neigh, struct sk_buff *skb);
 static void parp_redo(struct sk_buff *skb);
 
-static struct neigh_ops arp_generic_ops = {
+static const struct neigh_ops arp_generic_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
@@ -140,7 +140,7 @@ static struct neigh_ops arp_generic_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-static struct neigh_ops arp_hh_ops = {
+static const struct neigh_ops arp_hh_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
@@ -150,7 +150,7 @@ static struct neigh_ops arp_hh_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-static struct neigh_ops arp_direct_ops = {
+static const struct neigh_ops arp_direct_ops = {
         .family =               AF_INET,
         .output =               dev_queue_xmit,
         .connected_output =     dev_queue_xmit,
@@ -158,7 +158,7 @@ static struct neigh_ops arp_direct_ops = {
         .queue_xmit =           dev_queue_xmit,
 };
 
-struct neigh_ops arp_broken_ops = {
+const struct neigh_ops arp_broken_ops = {
         .family =               AF_INET,
         .solicit =              arp_solicit,
         .error_report =         arp_error_report,
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index b902ef55be7f..533afaadefd4 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -662,7 +662,7 @@ drop_nolock:
         return(0);
 }
 
-static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct net_device_stats *stats = &tunnel->dev->stats;
@@ -951,7 +951,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
                         addend += 4;
         }
         dev->needed_headroom = addend + hlen;
-        mtu -= dev->hard_header_len - addend;
+        mtu -= dev->hard_header_len + addend;
 
         if (mtu < 68)
                 mtu = 68;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 98075b6d619c..62548cb0923c 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -387,7 +387,7 @@ static int ipip_rcv(struct sk_buff *skb)
  *      and that skb is filled properly by that function.
  */
 
-static int ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct net_device_stats *stats = &tunnel->dev->stats;
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 06c33fb6b321..65d421cf5bc7 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -201,7 +201,7 @@ failure:
 
 #ifdef CONFIG_IP_PIMSM
 
-static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
+static netdev_tx_t reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct net *net = dev_net(dev);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 2bdb0da237e6..af6d6fa00db1 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -685,7 +685,7 @@ static inline void tcp_set_rto(struct sock *sk)
          *    is invisible. Actually, Linux-2.4 also generates erratic
          *    ACKs in some circumstances.
          */
-        inet_csk(sk)->icsk_rto = (tp->srtt >> 3) + tp->rttvar;
+        inet_csk(sk)->icsk_rto = __tcp_set_rto(tp);
 
         /* 2. Fixups made earlier cannot be right.
          *    If we do not estimate RTO correctly without them,
@@ -696,8 +696,7 @@ static inline void tcp_set_rto(struct sock *sk)
         /* NOTE: clamping at TCP_RTO_MIN is not required, current algo
          * guarantees that rto is higher.
          */
-        if (inet_csk(sk)->icsk_rto > TCP_RTO_MAX)
-                inet_csk(sk)->icsk_rto = TCP_RTO_MAX;
+        tcp_bound_rto(sk);
 }
 
 /* Save metrics learned by this TCP session.
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6d88219c5e22..ce7d3b021ffc 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -328,26 +328,29 @@ static void do_pmtu_discovery(struct sock *sk, struct iphdr *iph, u32 mtu)
  *
  */
 
-void tcp_v4_err(struct sk_buff *skb, u32 info)
+void tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 {
-        struct iphdr *iph = (struct iphdr *)skb->data;
-        struct tcphdr *th = (struct tcphdr *)(skb->data + (iph->ihl << 2));
+        struct iphdr *iph = (struct iphdr *)icmp_skb->data;
+        struct tcphdr *th = (struct tcphdr *)(icmp_skb->data + (iph->ihl << 2));
+        struct inet_connection_sock *icsk;
         struct tcp_sock *tp;
         struct inet_sock *inet;
-        const int type = icmp_hdr(skb)->type;
-        const int code = icmp_hdr(skb)->code;
+        const int type = icmp_hdr(icmp_skb)->type;
+        const int code = icmp_hdr(icmp_skb)->code;
         struct sock *sk;
+        struct sk_buff *skb;
         __u32 seq;
+        __u32 remaining;
         int err;
-        struct net *net = dev_net(skb->dev);
+        struct net *net = dev_net(icmp_skb->dev);
 
-        if (skb->len < (iph->ihl << 2) + 8) {
+        if (icmp_skb->len < (iph->ihl << 2) + 8) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
         }
 
         sk = inet_lookup(net, &tcp_hashinfo, iph->daddr, th->dest,
-                        iph->saddr, th->source, inet_iif(skb));
+                        iph->saddr, th->source, inet_iif(icmp_skb));
         if (!sk) {
                 ICMP_INC_STATS_BH(net, ICMP_MIB_INERRORS);
                 return;
@@ -367,6 +370,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        icsk = inet_csk(sk);
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
@@ -393,6 +397,39 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 }
 
                 err = icmp_err_convert[code].errno;
+                /* check if icmp_skb allows revert of backoff
+                 * (see draft-zimmermann-tcp-lcd) */
+                if (code != ICMP_NET_UNREACH && code != ICMP_HOST_UNREACH)
+                        break;
+                if (seq != tp->snd_una  || !icsk->icsk_retransmits ||
+                    !icsk->icsk_backoff)
+                        break;
+
+                icsk->icsk_backoff--;
+                inet_csk(sk)->icsk_rto = __tcp_set_rto(tp) <<
+                                         icsk->icsk_backoff;
+                tcp_bound_rto(sk);
+
+                skb = tcp_write_queue_head(sk);
+                BUG_ON(!skb);
+
+                remaining = icsk->icsk_rto - min(icsk->icsk_rto,
+                                tcp_time_stamp - TCP_SKB_CB(skb)->when);
+
+                if (remaining) {
+                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+                                                  remaining, TCP_RTO_MAX);
+                } else if (sock_owned_by_user(sk)) {
+                        /* RTO revert clocked out retransmission,
+                         * but socket is locked. Will defer. */
+                        inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS,
+                                                  HZ/20, TCP_RTO_MAX);
+                } else {
+                        /* RTO revert clocked out retransmission.
+                         * Will retransmit now */
+                        tcp_retransmit_timer(sk);
+                }
+
                 break;
         case ICMP_TIME_EXCEEDED:
                 err = EHOSTUNREACH;
@@ -1158,7 +1195,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
+static const struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
         .md5_lookup     =       tcp_v4_reqsk_md5_lookup,
         .calc_md5_hash  =       tcp_v4_md5_hash_skb,
 };
@@ -1717,7 +1754,7 @@ int tcp_v4_tw_remember_stamp(struct inet_timewait_sock *tw)
         return 0;
 }
 
-struct inet_connection_sock_af_ops ipv4_specific = {
+const struct inet_connection_sock_af_ops ipv4_specific = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
@@ -1737,7 +1774,7 @@ struct inet_connection_sock_af_ops ipv4_specific = {
 };
 
 #ifdef CONFIG_TCP_MD5SIG
-static struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
+static const struct tcp_sock_af_ops tcp_sock_ipv4_specific = {
         .md5_lookup             = tcp_v4_md5_lookup,
         .calc_md5_hash          = tcp_v4_md5_hash_skb,
         .md5_add                = tcp_v4_md5_add_func,
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index c520fb6e06d9..cdb2ca7684d4 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -137,13 +137,14 @@ static int tcp_write_timeout(struct sock *sk)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         int retry_until;
+        bool do_reset;
 
         if ((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV)) {
                 if (icsk->icsk_retransmits)
                         dst_negative_advice(&sk->sk_dst_cache);
                 retry_until = icsk->icsk_syn_retries ? : sysctl_tcp_syn_retries;
         } else {
-                if (icsk->icsk_retransmits >= sysctl_tcp_retries1) {
+                if (retransmits_timed_out(sk, sysctl_tcp_retries1)) {
                         /* Black hole detection */
                         tcp_mtu_probing(icsk, sk);
 
@@ -155,13 +156,15 @@ static int tcp_write_timeout(struct sock *sk)
                         const int alive = (icsk->icsk_rto < TCP_RTO_MAX);
 
                         retry_until = tcp_orphan_retries(sk, alive);
+                        do_reset = alive ||
+                                   !retransmits_timed_out(sk, retry_until);
 
-                        if (tcp_out_of_resources(sk, alive || icsk->icsk_retransmits < retry_until))
+                        if (tcp_out_of_resources(sk, do_reset))
                                 return 1;
                 }
         }
 
-        if (icsk->icsk_retransmits >= retry_until) {
+        if (retransmits_timed_out(sk, retry_until)) {
                 /* Has it gone just too far? */
                 tcp_write_err(sk);
                 return 1;
@@ -279,7 +282,7 @@ static void tcp_probe_timer(struct sock *sk)
  *      The TCP retransmit timer.
  */
 
-static void tcp_retransmit_timer(struct sock *sk)
+void tcp_retransmit_timer(struct sock *sk)
 {
         struct tcp_sock *tp = tcp_sk(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
@@ -385,7 +388,7 @@ static void tcp_retransmit_timer(struct sock *sk)
 out_reset_timer:
         icsk->icsk_rto = min(icsk->icsk_rto << 1, TCP_RTO_MAX);
         inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, icsk->icsk_rto, TCP_RTO_MAX);
-        if (icsk->icsk_retransmits > sysctl_tcp_retries1)
+        if (retransmits_timed_out(sk, sysctl_tcp_retries1 + 1))
                 __sk_dst_reset(sk);
 
 out:;