1 files changed, 297 insertions, 169 deletions

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f2d116a5cb35..243946d4809d 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -60,6 +60,7 @@
 #include <linux/wireless.h>
 #include <linux/kernel.h>
 #include <linux/kmod.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/ip.h>
 #include <net/protocol.h>
@@ -79,6 +80,8 @@
 #include <linux/module.h>
 #include <linux/init.h>
 #include <linux/mutex.h>
+#include <linux/if_vlan.h>
+#include <linux/virtio_net.h>
 
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
@@ -155,7 +158,6 @@ struct packet_mreq_max {
         unsigned char   mr_address[MAX_ADDR_LEN];
 };
 
-#ifdef CONFIG_PACKET_MMAP
 static int packet_set_ring(struct sock *sk, struct tpacket_req *req,
                 int closing, int tx_ring);
 
@@ -175,7 +177,6 @@ struct packet_ring_buffer {
 
 struct packet_sock;
 static int tpacket_snd(struct packet_sock *po, struct msghdr *msg);
-#endif
 
 static void packet_flush_mclist(struct sock *sk);
 
@@ -183,27 +184,24 @@ struct packet_sock {
         /* struct sock has to be the first member of packet_sock */
         struct sock             sk;
         struct tpacket_stats    stats;
-#ifdef CONFIG_PACKET_MMAP
         struct packet_ring_buffer       rx_ring;
         struct packet_ring_buffer       tx_ring;
         int                     copy_thresh;
-#endif
-        struct packet_type      prot_hook;
         spinlock_t              bind_lock;
         struct mutex            pg_vec_lock;
         unsigned int            running:1,      /* prot_hook is attached*/
                                 auxdata:1,
-                                origdev:1;
+                                origdev:1,
+                                has_vnet_hdr:1;
         int                     ifindex;        /* bound device         */
         __be16                  num;
         struct packet_mclist    *mclist;
-#ifdef CONFIG_PACKET_MMAP
         atomic_t                mapped;
         enum tpacket_versions   tp_version;
         unsigned int            tp_hdrlen;
         unsigned int            tp_reserve;
         unsigned int            tp_loss:1;
-#endif
+        struct packet_type      prot_hook ____cacheline_aligned_in_smp;
 };
 
 struct packet_skb_cb {
@@ -216,8 +214,6 @@ struct packet_skb_cb {
 
 #define PACKET_SKB_CB(__skb)    ((struct packet_skb_cb *)((__skb)->cb))
 
-#ifdef CONFIG_PACKET_MMAP
-
 static void __packet_set_status(struct packet_sock *po, void *frame, int status)
 {
         union {
@@ -312,8 +308,6 @@ static inline void packet_increment_head(struct packet_ring_buffer *buff)
         buff->head = buff->head != buff->frame_max ? buff->head+1 : 0;
 }
 
-#endif
-
 static inline struct packet_sock *pkt_sk(struct sock *sk)
 {
         return (struct packet_sock *)sk;
@@ -364,7 +358,7 @@ static int packet_rcv_spkt(struct sk_buff *skb, struct net_device *dev,
         if (skb->pkt_type == PACKET_LOOPBACK)
                 goto out;
 
-        if (dev_net(dev) != sock_net(sk))
+        if (!net_eq(dev_net(dev), sock_net(sk)))
                 goto out;
 
         skb = skb_share_check(skb, GFP_ATOMIC);
@@ -414,7 +408,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 {
         struct sock *sk = sock->sk;
         struct sockaddr_pkt *saddr = (struct sockaddr_pkt *)msg->msg_name;
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct net_device *dev;
         __be16 proto = 0;
         int err;
@@ -436,7 +430,9 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
          */
 
         saddr->spkt_device[13] = 0;
-        dev = dev_get_by_name(sock_net(sk), saddr->spkt_device);
+retry:
+        rcu_read_lock();
+        dev = dev_get_by_name_rcu(sock_net(sk), saddr->spkt_device);
         err = -ENODEV;
         if (dev == NULL)
                 goto out_unlock;
@@ -454,58 +450,48 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         if (len > dev->mtu + dev->hard_header_len)
                 goto out_unlock;
 
-        err = -ENOBUFS;
-        skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
-
-        /*
-         * If the write buffer is full, then tough. At this level the user
-         * gets to deal with the problem - do your own algorithmic backoffs.
-         * That's far more flexible.
-         */
-
-        if (skb == NULL)
-                goto out_unlock;
-
-        /*
-         *      Fill it in
-         */
-
-        /* FIXME: Save some space for broken drivers that write a
-         * hard header at transmission time by themselves. PPP is the
-         * notable one here. This should really be fixed at the driver level.
-         */
-        skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        skb_reset_network_header(skb);
-
-        /* Try to align data part correctly */
-        if (dev->header_ops) {
-                skb->data -= dev->hard_header_len;
-                skb->tail -= dev->hard_header_len;
-                if (len < dev->hard_header_len)
-                        skb_reset_network_header(skb);
+        if (!skb) {
+                size_t reserved = LL_RESERVED_SPACE(dev);
+                unsigned int hhlen = dev->header_ops ? dev->hard_header_len : 0;
+
+                rcu_read_unlock();
+                skb = sock_wmalloc(sk, len + reserved, 0, GFP_KERNEL);
+                if (skb == NULL)
+                        return -ENOBUFS;
+                /* FIXME: Save some space for broken drivers that write a hard
+                 * header at transmission time by themselves. PPP is the notable
+                 * one here. This should really be fixed at the driver level.
+                 */
+                skb_reserve(skb, reserved);
+                skb_reset_network_header(skb);
+
+                /* Try to align data part correctly */
+                if (hhlen) {
+                        skb->data -= hhlen;
+                        skb->tail -= hhlen;
+                        if (len < hhlen)
+                                skb_reset_network_header(skb);
+                }
+                err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+                if (err)
+                        goto out_free;
+                goto retry;
         }
 
-        /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
-        if (err)
-                goto out_free;
-
-        /*
-         *      Now send it
-         */
+        skb->mark = sk->sk_mark;
 
         dev_queue_xmit(skb);
-        dev_put(dev);
+        rcu_read_unlock();
         return len;
 
+out_unlock:
+        rcu_read_unlock();
 out_free:
         kfree_skb(skb);
-out_unlock:
-        if (dev)
-                dev_put(dev);
         return err;
 }
 
@@ -515,7 +501,7 @@ static inline unsigned int run_filter(struct sk_buff *skb, struct sock *sk,
         struct sk_filter *filter;
 
         rcu_read_lock_bh();
-        filter = rcu_dereference(sk->sk_filter);
+        filter = rcu_dereference_bh(sk->sk_filter);
         if (filter != NULL)
                 res = sk_run_filter(skb, filter->insns, filter->len);
         rcu_read_unlock_bh();
@@ -551,7 +537,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
         sk = pt->af_packet_priv;
         po = pkt_sk(sk);
 
-        if (dev_net(dev) != sock_net(sk))
+        if (!net_eq(dev_net(dev), sock_net(sk)))
                 goto drop;
 
         skb->dev = dev;
@@ -626,15 +612,14 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
 
         spin_lock(&sk->sk_receive_queue.lock);
         po->stats.tp_packets++;
+        skb->dropcount = atomic_read(&sk->sk_drops);
         __skb_queue_tail(&sk->sk_receive_queue, skb);
         spin_unlock(&sk->sk_receive_queue.lock);
         sk->sk_data_ready(sk, skb->len);
         return 0;
 
 drop_n_acct:
-        spin_lock(&sk->sk_receive_queue.lock);
-        po->stats.tp_drops++;
-        spin_unlock(&sk->sk_receive_queue.lock);
+        po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
 
 drop_n_restore:
         if (skb_head != skb->data && skb_shared(skb)) {
@@ -646,7 +631,6 @@ drop:
         return 0;
 }
 
-#ifdef CONFIG_PACKET_MMAP
 static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                        struct packet_type *pt, struct net_device *orig_dev)
 {
@@ -673,7 +657,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
         sk = pt->af_packet_priv;
         po = pkt_sk(sk);
 
-        if (dev_net(dev) != sock_net(sk))
+        if (!net_eq(dev_net(dev), sock_net(sk)))
                 goto drop;
 
         if (dev->header_ops) {
@@ -766,7 +750,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
                         getnstimeofday(&ts);
                 h.h2->tp_sec = ts.tv_sec;
                 h.h2->tp_nsec = ts.tv_nsec;
-                h.h2->tp_vlan_tci = skb->vlan_tci;
+                h.h2->tp_vlan_tci = vlan_tx_tag_get(skb);
                 hdrlen = sizeof(*h.h2);
                 break;
         default:
@@ -856,6 +840,7 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = po->sk.sk_priority;
+        skb->mark = po->sk.sk_mark;
         skb_shinfo(skb)->destructor_arg = ph.raw;
 
         switch (po->tp_version) {
@@ -1028,20 +1013,30 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
 
                 status = TP_STATUS_SEND_REQUEST;
                 err = dev_queue_xmit(skb);
-                if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0))
-                        goto out_xmit;
+                if (unlikely(err > 0)) {
+                        err = net_xmit_errno(err);
+                        if (err && __packet_get_status(po, ph) ==
+                                   TP_STATUS_AVAILABLE) {
+                                /* skb was destructed already */
+                                skb = NULL;
+                                goto out_status;
+                        }
+                        /*
+                         * skb was dropped but not destructed yet;
+                         * let's treat it like congestion or err < 0
+                         */
+                        err = 0;
+                }
                 packet_increment_head(&po->tx_ring);
                 len_sum += tp_len;
-        } while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT))
-                                        && (atomic_read(&po->tx_ring.pending))))
-              );
+        } while (likely((ph != NULL) ||
+                        ((!(msg->msg_flags & MSG_DONTWAIT)) &&
+                         (atomic_read(&po->tx_ring.pending))))
+                );
 
         err = len_sum;
         goto out_put;
 
-out_xmit:
-        skb->destructor = sock_wfree;
-        atomic_dec(&po->tx_ring.pending);
 out_status:
         __packet_set_status(po, ph, status);
         kfree_skb(skb);
@@ -1051,7 +1046,30 @@ out:
         mutex_unlock(&po->pg_vec_lock);
         return err;
 }
-#endif
+
+static inline struct sk_buff *packet_alloc_skb(struct sock *sk, size_t prepad,
+                                               size_t reserve, size_t len,
+                                               size_t linear, int noblock,
+                                               int *err)
+{
+        struct sk_buff *skb;
+
+        /* Under a page?  Don't bother with paged skb. */
+        if (prepad + len < PAGE_SIZE || !linear)
+                linear = len;
+
+        skb = sock_alloc_send_pskb(sk, prepad + linear, len - linear, noblock,
+                                   err);
+        if (!skb)
+                return NULL;
+
+        skb_reserve(skb, reserve);
+        skb_put(skb, linear);
+        skb->data_len = len - linear;
+        skb->len += len - linear;
+
+        return skb;
+}
 
 static int packet_snd(struct socket *sock,
                           struct msghdr *msg, size_t len)
@@ -1063,14 +1081,17 @@ static int packet_snd(struct socket *sock,
         __be16 proto;
         unsigned char *addr;
         int ifindex, err, reserve = 0;
+        struct virtio_net_hdr vnet_hdr = { 0 };
+        int offset = 0;
+        int vnet_hdr_len;
+        struct packet_sock *po = pkt_sk(sk);
+        unsigned short gso_type = 0;
 
         /*
          *      Get and verify the address.
          */
 
         if (saddr == NULL) {
-                struct packet_sock *po = pkt_sk(sk);
-
                 ifindex = po->ifindex;
                 proto   = po->num;
                 addr    = NULL;
@@ -1097,31 +1118,100 @@ static int packet_snd(struct socket *sock,
         if (!(dev->flags & IFF_UP))
                 goto out_unlock;
 
+        if (po->has_vnet_hdr) {
+                vnet_hdr_len = sizeof(vnet_hdr);
+
+                err = -EINVAL;
+                if (len < vnet_hdr_len)
+                        goto out_unlock;
+
+                len -= vnet_hdr_len;
+
+                err = memcpy_fromiovec((void *)&vnet_hdr, msg->msg_iov,
+                                       vnet_hdr_len);
+                if (err < 0)
+                        goto out_unlock;
+
+                if ((vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) &&
+                    (vnet_hdr.csum_start + vnet_hdr.csum_offset + 2 >
+                      vnet_hdr.hdr_len))
+                        vnet_hdr.hdr_len = vnet_hdr.csum_start +
+                                                 vnet_hdr.csum_offset + 2;
+
+                err = -EINVAL;
+                if (vnet_hdr.hdr_len > len)
+                        goto out_unlock;
+
+                if (vnet_hdr.gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+                        switch (vnet_hdr.gso_type & ~VIRTIO_NET_HDR_GSO_ECN) {
+                        case VIRTIO_NET_HDR_GSO_TCPV4:
+                                gso_type = SKB_GSO_TCPV4;
+                                break;
+                        case VIRTIO_NET_HDR_GSO_TCPV6:
+                                gso_type = SKB_GSO_TCPV6;
+                                break;
+                        case VIRTIO_NET_HDR_GSO_UDP:
+                                gso_type = SKB_GSO_UDP;
+                                break;
+                        default:
+                                goto out_unlock;
+                        }
+
+                        if (vnet_hdr.gso_type & VIRTIO_NET_HDR_GSO_ECN)
+                                gso_type |= SKB_GSO_TCP_ECN;
+
+                        if (vnet_hdr.gso_size == 0)
+                                goto out_unlock;
+
+                }
+        }
+
         err = -EMSGSIZE;
-        if (len > dev->mtu+reserve)
+        if (!gso_type && (len > dev->mtu+reserve))
                 goto out_unlock;
 
-        skb = sock_alloc_send_skb(sk, len + LL_ALLOCATED_SPACE(dev),
-                                msg->msg_flags & MSG_DONTWAIT, &err);
+        err = -ENOBUFS;
+        skb = packet_alloc_skb(sk, LL_ALLOCATED_SPACE(dev),
+                               LL_RESERVED_SPACE(dev), len, vnet_hdr.hdr_len,
+                               msg->msg_flags & MSG_DONTWAIT, &err);
         if (skb == NULL)
                 goto out_unlock;
 
-        skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        skb_reset_network_header(skb);
+        skb_set_network_header(skb, reserve);
 
         err = -EINVAL;
         if (sock->type == SOCK_DGRAM &&
-            dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len) < 0)
+            (offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len)) < 0)
                 goto out_free;
 
         /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+        err = skb_copy_datagram_from_iovec(skb, offset, msg->msg_iov, 0, len);
         if (err)
                 goto out_free;
 
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
+        skb->mark = sk->sk_mark;
+
+        if (po->has_vnet_hdr) {
+                if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
+                        if (!skb_partial_csum_set(skb, vnet_hdr.csum_start,
+                                                  vnet_hdr.csum_offset)) {
+                                err = -EINVAL;
+                                goto out_free;
+                        }
+                }
+
+                skb_shinfo(skb)->gso_size = vnet_hdr.gso_size;
+                skb_shinfo(skb)->gso_type = gso_type;
+
+                /* Header must be checked, and gso_segs computed. */
+                skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
+                skb_shinfo(skb)->gso_segs = 0;
+
+                len += vnet_hdr_len;
+        }
 
         /*
          *      Now send it
@@ -1147,13 +1237,11 @@ out:
 static int packet_sendmsg(struct kiocb *iocb, struct socket *sock,
                 struct msghdr *msg, size_t len)
 {
-#ifdef CONFIG_PACKET_MMAP
         struct sock *sk = sock->sk;
         struct packet_sock *po = pkt_sk(sk);
         if (po->tx_ring.pg_vec)
                 return tpacket_snd(po, msg);
         else
-#endif
                 return packet_snd(sock, msg, len);
 }
 
@@ -1167,9 +1255,7 @@ static int packet_release(struct socket *sock)
         struct sock *sk = sock->sk;
         struct packet_sock *po;
         struct net *net;
-#ifdef CONFIG_PACKET_MMAP
         struct tpacket_req req;
-#endif
 
         if (!sk)
                 return 0;
@@ -1177,28 +1263,25 @@ static int packet_release(struct socket *sock)
         net = sock_net(sk);
         po = pkt_sk(sk);
 
-        write_lock_bh(&net->packet.sklist_lock);
-        sk_del_node_init(sk);
+        spin_lock_bh(&net->packet.sklist_lock);
+        sk_del_node_init_rcu(sk);
         sock_prot_inuse_add(net, sk->sk_prot, -1);
-        write_unlock_bh(&net->packet.sklist_lock);
-
-        /*
-         *      Unhook packet receive handler.
-         */
+        spin_unlock_bh(&net->packet.sklist_lock);
 
+        spin_lock(&po->bind_lock);
         if (po->running) {
                 /*
-                 *      Remove the protocol hook
+                 * Remove from protocol table
                  */
-                dev_remove_pack(&po->prot_hook);
                 po->running = 0;
                 po->num = 0;
+                __dev_remove_pack(&po->prot_hook);
                 __sock_put(sk);
         }
+        spin_unlock(&po->bind_lock);
 
         packet_flush_mclist(sk);
 
-#ifdef CONFIG_PACKET_MMAP
         memset(&req, 0, sizeof(req));
 
         if (po->rx_ring.pg_vec)
@@ -1206,12 +1289,11 @@ static int packet_release(struct socket *sock)
 
         if (po->tx_ring.pg_vec)
                 packet_set_ring(sk, &req, 1, 1);
-#endif
 
+        synchronize_net();
         /*
          *      Now the socket is dead. No more input will appear.
          */
-
         sock_orphan(sk);
         sock->sk = NULL;
 
@@ -1341,7 +1423,8 @@ static struct proto packet_proto = {
  *      Create a packet of type SOCK_PACKET.
  */
 
-static int packet_create(struct net *net, struct socket *sock, int protocol)
+static int packet_create(struct net *net, struct socket *sock, int protocol,
+                         int kern)
 {
         struct sock *sk;
         struct packet_sock *po;
@@ -1394,10 +1477,11 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
                 po->running = 1;
         }
 
-        write_lock_bh(&net->packet.sklist_lock);
-        sk_add_node(sk, &net->packet.sklist);
+        spin_lock_bh(&net->packet.sklist_lock);
+        sk_add_node_rcu(sk, &net->packet.sklist);
         sock_prot_inuse_add(net, &packet_proto, 1);
-        write_unlock_bh(&net->packet.sklist_lock);
+        spin_unlock_bh(&net->packet.sklist_lock);
+
         return 0;
 out:
         return err;
@@ -1415,6 +1499,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         struct sk_buff *skb;
         int copied, err;
         struct sockaddr_ll *sll;
+        int vnet_hdr_len = 0;
 
         err = -EINVAL;
         if (flags & ~(MSG_PEEK|MSG_DONTWAIT|MSG_TRUNC|MSG_CMSG_COMPAT))
@@ -1446,6 +1531,48 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (skb == NULL)
                 goto out;
 
+        if (pkt_sk(sk)->has_vnet_hdr) {
+                struct virtio_net_hdr vnet_hdr = { 0 };
+
+                err = -EINVAL;
+                vnet_hdr_len = sizeof(vnet_hdr);
+                if ((len -= vnet_hdr_len) < 0)
+                        goto out_free;
+
+                if (skb_is_gso(skb)) {
+                        struct skb_shared_info *sinfo = skb_shinfo(skb);
+
+                        /* This is a hint as to how much should be linear. */
+                        vnet_hdr.hdr_len = skb_headlen(skb);
+                        vnet_hdr.gso_size = sinfo->gso_size;
+                        if (sinfo->gso_type & SKB_GSO_TCPV4)
+                                vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
+                        else if (sinfo->gso_type & SKB_GSO_TCPV6)
+                                vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_TCPV6;
+                        else if (sinfo->gso_type & SKB_GSO_UDP)
+                                vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_UDP;
+                        else if (sinfo->gso_type & SKB_GSO_FCOE)
+                                goto out_free;
+                        else
+                                BUG();
+                        if (sinfo->gso_type & SKB_GSO_TCP_ECN)
+                                vnet_hdr.gso_type |= VIRTIO_NET_HDR_GSO_ECN;
+                } else
+                        vnet_hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE;
+
+                if (skb->ip_summed == CHECKSUM_PARTIAL) {
+                        vnet_hdr.flags = VIRTIO_NET_HDR_F_NEEDS_CSUM;
+                        vnet_hdr.csum_start = skb->csum_start -
+                                                        skb_headroom(skb);
+                        vnet_hdr.csum_offset = skb->csum_offset;
+                } /* else everything is zero */
+
+                err = memcpy_toiovec(msg->msg_iov, (void *)&vnet_hdr,
+                                     vnet_hdr_len);
+                if (err < 0)
+                        goto out_free;
+        }
+
         /*
          *      If the address length field is there to be filled in, we fill
          *      it in now.
@@ -1472,7 +1599,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (err)
                 goto out_free;
 
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
 
         if (msg->msg_name)
                 memcpy(msg->msg_name, &PACKET_SKB_CB(skb)->sa,
@@ -1488,7 +1615,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
                 aux.tp_snaplen = skb->len;
                 aux.tp_mac = 0;
                 aux.tp_net = skb_network_offset(skb);
-                aux.tp_vlan_tci = skb->vlan_tci;
+                aux.tp_vlan_tci = vlan_tx_tag_get(skb);
 
                 put_cmsg(msg, SOL_PACKET, PACKET_AUXDATA, sizeof(aux), &aux);
         }
@@ -1497,7 +1624,7 @@ static int packet_recvmsg(struct kiocb *iocb, struct socket *sock,
          *      Free or return the buffer as appropriate. Again this
          *      hides all the races and re-entrancy issues from us.
          */
-        err = (flags&MSG_TRUNC) ? skb->len : copied;
+        err = vnet_hdr_len + ((flags&MSG_TRUNC) ? skb->len : copied);
 
 out_free:
         skb_free_datagram(sk, skb);
@@ -1515,12 +1642,13 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr,
                 return -EOPNOTSUPP;
 
         uaddr->sa_family = AF_PACKET;
-        dev = dev_get_by_index(sock_net(sk), pkt_sk(sk)->ifindex);
-        if (dev) {
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex);
+        if (dev)
                 strlcpy(uaddr->sa_data, dev->name, 15);
-                dev_put(dev);
-        } else
+        else
                 memset(uaddr->sa_data, 0, 14);
+        rcu_read_unlock();
         *uaddr_len = sizeof(*uaddr);
 
         return 0;
@@ -1532,7 +1660,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         struct net_device *dev;
         struct sock *sk = sock->sk;
         struct packet_sock *po = pkt_sk(sk);
-        struct sockaddr_ll *sll = (struct sockaddr_ll *)uaddr;
+        DECLARE_SOCKADDR(struct sockaddr_ll *, sll, uaddr);
 
         if (peer)
                 return -EOPNOTSUPP;
@@ -1540,16 +1668,17 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr,
         sll->sll_family = AF_PACKET;
         sll->sll_ifindex = po->ifindex;
         sll->sll_protocol = po->num;
-        dev = dev_get_by_index(sock_net(sk), po->ifindex);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex);
         if (dev) {
                 sll->sll_hatype = dev->type;
                 sll->sll_halen = dev->addr_len;
                 memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
-                dev_put(dev);
         } else {
                 sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
                 sll->sll_halen = 0;
         }
+        rcu_read_unlock();
         *uaddr_len = offsetof(struct sockaddr_ll, sll_addr) + sll->sll_halen;
 
         return 0;
@@ -1560,6 +1689,8 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
 {
         switch (i->type) {
         case PACKET_MR_MULTICAST:
+                if (i->alen != dev->addr_len)
+                        return -EINVAL;
                 if (what > 0)
                         return dev_mc_add(dev, i->addr, i->alen, 0);
                 else
@@ -1572,6 +1703,8 @@ static int packet_dev_mc(struct net_device *dev, struct packet_mclist *i,
                 return dev_set_allmulti(dev, what);
                 break;
         case PACKET_MR_UNICAST:
+                if (i->alen != dev->addr_len)
+                        return -EINVAL;
                 if (what > 0)
                         return dev_unicast_add(dev, i->addr);
                 else
@@ -1659,11 +1792,9 @@ static int packet_mc_drop(struct sock *sk, struct packet_mreq_max *mreq)
                         if (--ml->count == 0) {
                                 struct net_device *dev;
                                 *mlp = ml->next;
-                                dev = dev_get_by_index(sock_net(sk), ml->ifindex);
-                                if (dev) {
+                                dev = __dev_get_by_index(sock_net(sk), ml->ifindex);
+                                if (dev)
                                         packet_dev_mc(dev, ml, -1);
-                                        dev_put(dev);
-                                }
                                 kfree(ml);
                         }
                         rtnl_unlock();
@@ -1687,11 +1818,9 @@ static void packet_flush_mclist(struct sock *sk)
                 struct net_device *dev;
 
                 po->mclist = ml->next;
-                dev = dev_get_by_index(sock_net(sk), ml->ifindex);
-                if (dev != NULL) {
+                dev = __dev_get_by_index(sock_net(sk), ml->ifindex);
+                if (dev != NULL)
                         packet_dev_mc(dev, ml, -1);
-                        dev_put(dev);
-                }
                 kfree(ml);
         }
         rtnl_unlock();
@@ -1729,7 +1858,6 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 return ret;
         }
 
-#ifdef CONFIG_PACKET_MMAP
         case PACKET_RX_RING:
         case PACKET_TX_RING:
         {
@@ -1737,6 +1865,8 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
 
                 if (optlen < sizeof(req))
                         return -EINVAL;
+                if (pkt_sk(sk)->has_vnet_hdr)
+                        return -EINVAL;
                 if (copy_from_user(&req, optval, sizeof(req)))
                         return -EFAULT;
                 return packet_set_ring(sk, &req, 0, optname == PACKET_TX_RING);
@@ -1798,7 +1928,6 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 po->tp_loss = !!val;
                 return 0;
         }
-#endif
         case PACKET_AUXDATA:
         {
                 int val;
@@ -1823,6 +1952,22 @@ packet_setsockopt(struct socket *sock, int level, int optname, char __user *optv
                 po->origdev = !!val;
                 return 0;
         }
+        case PACKET_VNET_HDR:
+        {
+                int val;
+
+                if (sock->type != SOCK_RAW)
+                        return -EINVAL;
+                if (po->rx_ring.pg_vec || po->tx_ring.pg_vec)
+                        return -EBUSY;
+                if (optlen < sizeof(val))
+                        return -EINVAL;
+                if (copy_from_user(&val, optval, sizeof(val)))
+                        return -EFAULT;
+
+                po->has_vnet_hdr = !!val;
+                return 0;
+        }
         default:
                 return -ENOPROTOOPT;
         }
@@ -1873,7 +2018,13 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
 
                 data = &val;
                 break;
-#ifdef CONFIG_PACKET_MMAP
+        case PACKET_VNET_HDR:
+                if (len > sizeof(int))
+                        len = sizeof(int);
+                val = po->has_vnet_hdr;
+
+                data = &val;
+                break;
         case PACKET_VERSION:
                 if (len > sizeof(int))
                         len = sizeof(int);
@@ -1909,7 +2060,6 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
                 val = po->tp_loss;
                 data = &val;
                 break;
-#endif
         default:
                 return -ENOPROTOOPT;
         }
@@ -1929,8 +2079,8 @@ static int packet_notifier(struct notifier_block *this, unsigned long msg, void
         struct net_device *dev = data;
         struct net *net = dev_net(dev);
 
-        read_lock(&net->packet.sklist_lock);
-        sk_for_each(sk, node, &net->packet.sklist) {
+        rcu_read_lock();
+        sk_for_each_rcu(sk, node, &net->packet.sklist) {
                 struct packet_sock *po = pkt_sk(sk);
 
                 switch (msg) {
@@ -1958,18 +2108,19 @@ static int packet_notifier(struct notifier_block *this, unsigned long msg, void
                         }
                         break;
                 case NETDEV_UP:
-                        spin_lock(&po->bind_lock);
-                        if (dev->ifindex == po->ifindex && po->num &&
-                            !po->running) {
-                                dev_add_pack(&po->prot_hook);
-                                sock_hold(sk);
-                                po->running = 1;
+                        if (dev->ifindex == po->ifindex) {
+                                spin_lock(&po->bind_lock);
+                                if (po->num && !po->running) {
+                                        dev_add_pack(&po->prot_hook);
+                                        sock_hold(sk);
+                                        po->running = 1;
+                                }
+                                spin_unlock(&po->bind_lock);
                         }
-                        spin_unlock(&po->bind_lock);
                         break;
                 }
         }
-        read_unlock(&net->packet.sklist_lock);
+        rcu_read_unlock();
         return NOTIFY_DONE;
 }
 
@@ -2018,8 +2169,6 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
         case SIOCGIFDSTADDR:
         case SIOCSIFDSTADDR:
         case SIOCSIFFLAGS:
-                if (!net_eq(sock_net(sk), &init_net))
-                        return -ENOIOCTLCMD;
                 return inet_dgram_ops.ioctl(sock, cmd, arg);
 #endif
 
@@ -2029,11 +2178,6 @@ static int packet_ioctl(struct socket *sock, unsigned int cmd,
         return 0;
 }
 
-#ifndef CONFIG_PACKET_MMAP
-#define packet_mmap sock_no_mmap
-#define packet_poll datagram_poll
-#else
-
 static unsigned int packet_poll(struct file *file, struct socket *sock,
                                 poll_table *wait)
 {
@@ -2315,8 +2459,6 @@ out:
         mutex_unlock(&po->pg_vec_lock);
         return err;
 }
-#endif
-
 
 static const struct proto_ops packet_ops_spkt = {
         .family =       PF_PACKET,
@@ -2360,7 +2502,7 @@ static const struct proto_ops packet_ops = {
         .sendpage =     sock_no_sendpage,
 };
 
-static struct net_proto_family packet_family_ops = {
+static const struct net_proto_family packet_family_ops = {
         .family =       PF_PACKET,
         .create =       packet_create,
         .owner  =       THIS_MODULE,
@@ -2371,40 +2513,26 @@ static struct notifier_block packet_netdev_notifier = {
 };
 
 #ifdef CONFIG_PROC_FS
-static inline struct sock *packet_seq_idx(struct net *net, loff_t off)
-{
-        struct sock *s;
-        struct hlist_node *node;
-
-        sk_for_each(s, node, &net->packet.sklist) {
-                if (!off--)
-                        return s;
-        }
-        return NULL;
-}
 
 static void *packet_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(seq_file_net(seq)->packet.sklist_lock)
+        __acquires(RCU)
 {
         struct net *net = seq_file_net(seq);
-        read_lock(&net->packet.sklist_lock);
-        return *pos ? packet_seq_idx(net, *pos - 1) : SEQ_START_TOKEN;
+
+        rcu_read_lock();
+        return seq_hlist_start_head_rcu(&net->packet.sklist, *pos);
 }
 
 static void *packet_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
         struct net *net = seq_file_net(seq);
-        ++*pos;
-        return  (v == SEQ_START_TOKEN)
-                ? sk_head(&net->packet.sklist)
-                : sk_next((struct sock *)v) ;
+        return seq_hlist_next_rcu(v, &net->packet.sklist, pos);
 }
 
 static void packet_seq_stop(struct seq_file *seq, void *v)
-        __releases(seq_file_net(seq)->packet.sklist_lock)
+        __releases(RCU)
 {
-        struct net *net = seq_file_net(seq);
-        read_unlock(&net->packet.sklist_lock);
+        rcu_read_unlock();
 }
 
 static int packet_seq_show(struct seq_file *seq, void *v)
@@ -2412,7 +2540,7 @@ static int packet_seq_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN)
                 seq_puts(seq, "sk       RefCnt Type Proto  Iface R Rmem   User   Inode\n");
         else {
-                struct sock *s = v;
+                struct sock *s = sk_entry(v);
                 const struct packet_sock *po = pkt_sk(s);
 
                 seq_printf(seq,
@@ -2454,9 +2582,9 @@ static const struct file_operations packet_seq_fops = {
 
 #endif
 
-static int packet_net_init(struct net *net)
+static int __net_init packet_net_init(struct net *net)
 {
-        rwlock_init(&net->packet.sklist_lock);
+        spin_lock_init(&net->packet.sklist_lock);
         INIT_HLIST_HEAD(&net->packet.sklist);
 
         if (!proc_net_fops_create(net, "packet", 0, &packet_seq_fops))
@@ -2465,7 +2593,7 @@ static int packet_net_init(struct net *net)
         return 0;
 }
 
-static void packet_net_exit(struct net *net)
+static void __net_exit packet_net_exit(struct net *net)
 {
         proc_net_remove(net, "packet");
 }