aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/9p/protocol.c2
-rw-r--r--net/9p/trans_virtio.c2
-rw-r--r--net/appletalk/ddp.c4
-rw-r--r--net/batman-adv/routing.c2
-rw-r--r--net/batman-adv/translation-table.c12
-rw-r--r--net/bluetooth/af_bluetooth.c2
-rw-r--r--net/bluetooth/hci_event.c48
-rw-r--r--net/bluetooth/hidp/Kconfig2
-rw-r--r--net/bluetooth/l2cap_core.c21
-rw-r--r--net/bluetooth/mgmt.c20
-rw-r--r--net/bluetooth/smp.c11
-rw-r--r--net/bridge/br_if.c1
-rw-r--r--net/bridge/br_netlink.c2
-rw-r--r--net/bridge/br_private.h1
-rw-r--r--net/caif/caif_dev.c3
-rw-r--r--net/caif/caif_socket.c1
-rw-r--r--net/can/raw.c3
-rw-r--r--net/ceph/ceph_common.c7
-rw-r--r--net/ceph/messenger.c4
-rw-r--r--net/ceph/mon_client.c8
-rw-r--r--net/ceph/osd_client.c12
-rw-r--r--net/core/dev.c23
-rw-r--r--net/core/drop_monitor.c102
-rw-r--r--net/core/filter.c4
-rw-r--r--net/core/neighbour.c14
-rw-r--r--net/core/netpoll.c11
-rw-r--r--net/core/skbuff.c2
-rw-r--r--net/ipv4/inetpeer.c16
-rw-r--r--net/ipv4/ip_forward.c1
-rw-r--r--net/ipv4/ipmr.c1
-rw-r--r--net/ipv6/ip6_fib.c6
-rw-r--r--net/ipv6/ip6_output.c1
-rw-r--r--net/ipv6/ip6mr.c2
-rw-r--r--net/ipv6/route.c41
-rw-r--r--net/ipv6/tcp_ipv6.c3
-rw-r--r--net/iucv/af_iucv.c1
-rw-r--r--net/l2tp/l2tp_eth.c47
-rw-r--r--net/l2tp/l2tp_ip.c9
-rw-r--r--net/mac80211/agg-rx.c7
-rw-r--r--net/mac80211/cfg.c9
-rw-r--r--net/mac80211/iface.c12
-rw-r--r--net/mac80211/mlme.c40
-rw-r--r--net/mac80211/offchannel.c16
-rw-r--r--net/mac80211/sta_info.c4
-rw-r--r--net/mac80211/sta_info.h5
-rw-r--r--net/mac80211/tx.c9
-rw-r--r--net/mac80211/util.c2
-rw-r--r--net/mac802154/tx.c3
-rw-r--r--net/netfilter/nf_conntrack_h323_main.c5
-rw-r--r--net/netfilter/xt_HMARK.c72
-rw-r--r--net/nfc/llcp/sock.c3
-rw-r--r--net/phonet/af_phonet.c4
-rw-r--r--net/phonet/datagram.c4
-rw-r--r--net/phonet/pep-gprs.c2
-rw-r--r--net/phonet/pep.c2
-rw-r--r--net/phonet/pn_dev.c4
-rw-r--r--net/phonet/pn_netlink.c4
-rw-r--r--net/phonet/socket.c4
-rw-r--r--net/phonet/sysctl.c2
-rw-r--r--net/sctp/protocol.c2
-rw-r--r--net/sunrpc/rpc_pipe.c12
-rw-r--r--net/sunrpc/svc.c3
-rw-r--r--net/wireless/ibss.c6
-rw-r--r--net/wireless/reg.c2
-rw-r--r--net/wireless/util.c21
65 files changed, 446 insertions, 265 deletions
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index 9ee48cb30179..3d33ecf13327 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -368,7 +368,7 @@ p9pdu_vwritef(struct p9_fcall *pdu, int proto_version, const char *fmt,
368 const char *sptr = va_arg(ap, const char *); 368 const char *sptr = va_arg(ap, const char *);
369 uint16_t len = 0; 369 uint16_t len = 0;
370 if (sptr) 370 if (sptr)
371 len = min_t(uint16_t, strlen(sptr), 371 len = min_t(size_t, strlen(sptr),
372 USHRT_MAX); 372 USHRT_MAX);
373 373
374 errcode = p9pdu_writef(pdu, proto_version, 374 errcode = p9pdu_writef(pdu, proto_version,
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 5af18d11b518..2a167658bb95 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -192,10 +192,10 @@ static int pack_sg_list(struct scatterlist *sg, int start,
192 s = rest_of_page(data); 192 s = rest_of_page(data);
193 if (s > count) 193 if (s > count)
194 s = count; 194 s = count;
195 BUG_ON(index > limit);
195 sg_set_buf(&sg[index++], data, s); 196 sg_set_buf(&sg[index++], data, s);
196 count -= s; 197 count -= s;
197 data += s; 198 data += s;
198 BUG_ON(index > limit);
199 } 199 }
200 200
201 return index-start; 201 return index-start;
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 0301b328cf0f..86852963b7f7 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1208,9 +1208,7 @@ static int atalk_connect(struct socket *sock, struct sockaddr *uaddr,
1208 if (addr->sat_addr.s_node == ATADDR_BCAST && 1208 if (addr->sat_addr.s_node == ATADDR_BCAST &&
1209 !sock_flag(sk, SOCK_BROADCAST)) { 1209 !sock_flag(sk, SOCK_BROADCAST)) {
1210#if 1 1210#if 1
1211 printk(KERN_WARNING "%s is broken and did not set " 1211 pr_warn("atalk_connect: %s is broken and did not set SO_BROADCAST.\n",
1212 "SO_BROADCAST. It will break when 2.2 is "
1213 "released.\n",
1214 current->comm); 1212 current->comm);
1215#else 1213#else
1216 return -EACCES; 1214 return -EACCES;
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 840e2c64a301..015471d801b4 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -617,6 +617,8 @@ int recv_tt_query(struct sk_buff *skb, struct hard_iface *recv_if)
617 * changes */ 617 * changes */
618 if (skb_linearize(skb) < 0) 618 if (skb_linearize(skb) < 0)
619 goto out; 619 goto out;
620 /* skb_linearize() possibly changed skb->data */
621 tt_query = (struct tt_query_packet *)skb->data;
620 622
621 tt_len = tt_query->tt_data * sizeof(struct tt_change); 623 tt_len = tt_query->tt_data * sizeof(struct tt_change);
622 624
diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index a66c2dcd1088..2ab83d7fb1f8 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c
@@ -141,13 +141,14 @@ static void tt_orig_list_entry_free_rcu(struct rcu_head *rcu)
141 struct tt_orig_list_entry *orig_entry; 141 struct tt_orig_list_entry *orig_entry;
142 142
143 orig_entry = container_of(rcu, struct tt_orig_list_entry, rcu); 143 orig_entry = container_of(rcu, struct tt_orig_list_entry, rcu);
144 atomic_dec(&orig_entry->orig_node->tt_size);
145 orig_node_free_ref(orig_entry->orig_node); 144 orig_node_free_ref(orig_entry->orig_node);
146 kfree(orig_entry); 145 kfree(orig_entry);
147} 146}
148 147
149static void tt_orig_list_entry_free_ref(struct tt_orig_list_entry *orig_entry) 148static void tt_orig_list_entry_free_ref(struct tt_orig_list_entry *orig_entry)
150{ 149{
150 /* to avoid race conditions, immediately decrease the tt counter */
151 atomic_dec(&orig_entry->orig_node->tt_size);
151 call_rcu(&orig_entry->rcu, tt_orig_list_entry_free_rcu); 152 call_rcu(&orig_entry->rcu, tt_orig_list_entry_free_rcu);
152} 153}
153 154
@@ -910,7 +911,6 @@ void tt_global_del_orig(struct bat_priv *bat_priv,
910 } 911 }
911 spin_unlock_bh(list_lock); 912 spin_unlock_bh(list_lock);
912 } 913 }
913 atomic_set(&orig_node->tt_size, 0);
914 orig_node->tt_initialised = false; 914 orig_node->tt_initialised = false;
915} 915}
916 916
@@ -2031,10 +2031,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst)
2031{ 2031{
2032 struct tt_local_entry *tt_local_entry = NULL; 2032 struct tt_local_entry *tt_local_entry = NULL;
2033 struct tt_global_entry *tt_global_entry = NULL; 2033 struct tt_global_entry *tt_global_entry = NULL;
2034 bool ret = true; 2034 bool ret = false;
2035 2035
2036 if (!atomic_read(&bat_priv->ap_isolation)) 2036 if (!atomic_read(&bat_priv->ap_isolation))
2037 return false; 2037 goto out;
2038 2038
2039 tt_local_entry = tt_local_hash_find(bat_priv, dst); 2039 tt_local_entry = tt_local_hash_find(bat_priv, dst);
2040 if (!tt_local_entry) 2040 if (!tt_local_entry)
@@ -2044,10 +2044,10 @@ bool is_ap_isolated(struct bat_priv *bat_priv, uint8_t *src, uint8_t *dst)
2044 if (!tt_global_entry) 2044 if (!tt_global_entry)
2045 goto out; 2045 goto out;
2046 2046
2047 if (_is_ap_isolated(tt_local_entry, tt_global_entry)) 2047 if (!_is_ap_isolated(tt_local_entry, tt_global_entry))
2048 goto out; 2048 goto out;
2049 2049
2050 ret = false; 2050 ret = true;
2051 2051
2052out: 2052out:
2053 if (tt_global_entry) 2053 if (tt_global_entry)
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 46e7f86acfc9..3e18af4dadc4 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -210,7 +210,7 @@ struct sock *bt_accept_dequeue(struct sock *parent, struct socket *newsock)
210 } 210 }
211 211
212 if (sk->sk_state == BT_CONNECTED || !newsock || 212 if (sk->sk_state == BT_CONNECTED || !newsock ||
213 test_bit(BT_DEFER_SETUP, &bt_sk(parent)->flags)) { 213 test_bit(BT_SK_DEFER_SETUP, &bt_sk(parent)->flags)) {
214 bt_accept_unlink(sk); 214 bt_accept_unlink(sk);
215 if (newsock) 215 if (newsock)
216 sock_graft(sk, newsock); 216 sock_graft(sk, newsock);
diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
index 4eefb7f65cf6..94ad124a4ea3 100644
--- a/net/bluetooth/hci_event.c
+++ b/net/bluetooth/hci_event.c
@@ -3043,6 +3043,50 @@ static inline void hci_extended_inquiry_result_evt(struct hci_dev *hdev, struct
3043 hci_dev_unlock(hdev); 3043 hci_dev_unlock(hdev);
3044} 3044}
3045 3045
3046static void hci_key_refresh_complete_evt(struct hci_dev *hdev,
3047 struct sk_buff *skb)
3048{
3049 struct hci_ev_key_refresh_complete *ev = (void *) skb->data;
3050 struct hci_conn *conn;
3051
3052 BT_DBG("%s status %u handle %u", hdev->name, ev->status,
3053 __le16_to_cpu(ev->handle));
3054
3055 hci_dev_lock(hdev);
3056
3057 conn = hci_conn_hash_lookup_handle(hdev, __le16_to_cpu(ev->handle));
3058 if (!conn)
3059 goto unlock;
3060
3061 if (!ev->status)
3062 conn->sec_level = conn->pending_sec_level;
3063
3064 clear_bit(HCI_CONN_ENCRYPT_PEND, &conn->flags);
3065
3066 if (ev->status && conn->state == BT_CONNECTED) {
3067 hci_acl_disconn(conn, HCI_ERROR_AUTH_FAILURE);
3068 hci_conn_put(conn);
3069 goto unlock;
3070 }
3071
3072 if (conn->state == BT_CONFIG) {
3073 if (!ev->status)
3074 conn->state = BT_CONNECTED;
3075
3076 hci_proto_connect_cfm(conn, ev->status);
3077 hci_conn_put(conn);
3078 } else {
3079 hci_auth_cfm(conn, ev->status);
3080
3081 hci_conn_hold(conn);
3082 conn->disc_timeout = HCI_DISCONN_TIMEOUT;
3083 hci_conn_put(conn);
3084 }
3085
3086unlock:
3087 hci_dev_unlock(hdev);
3088}
3089
3046static inline u8 hci_get_auth_req(struct hci_conn *conn) 3090static inline u8 hci_get_auth_req(struct hci_conn *conn)
3047{ 3091{
3048 /* If remote requests dedicated bonding follow that lead */ 3092 /* If remote requests dedicated bonding follow that lead */
@@ -3559,6 +3603,10 @@ void hci_event_packet(struct hci_dev *hdev, struct sk_buff *skb)
3559 hci_extended_inquiry_result_evt(hdev, skb); 3603 hci_extended_inquiry_result_evt(hdev, skb);
3560 break; 3604 break;
3561 3605
3606 case HCI_EV_KEY_REFRESH_COMPLETE:
3607 hci_key_refresh_complete_evt(hdev, skb);
3608 break;
3609
3562 case HCI_EV_IO_CAPA_REQUEST: 3610 case HCI_EV_IO_CAPA_REQUEST:
3563 hci_io_capa_request_evt(hdev, skb); 3611 hci_io_capa_request_evt(hdev, skb);
3564 break; 3612 break;
diff --git a/net/bluetooth/hidp/Kconfig b/net/bluetooth/hidp/Kconfig
index 4deaca78e91e..9332bc7aa851 100644
--- a/net/bluetooth/hidp/Kconfig
+++ b/net/bluetooth/hidp/Kconfig
@@ -1,6 +1,6 @@
1config BT_HIDP 1config BT_HIDP
2 tristate "HIDP protocol support" 2 tristate "HIDP protocol support"
3 depends on BT && INPUT && HID_SUPPORT 3 depends on BT && INPUT
4 select HID 4 select HID
5 help 5 help
6 HIDP (Human Interface Device Protocol) is a transport layer 6 HIDP (Human Interface Device Protocol) is a transport layer
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index 24f144b72a96..4554e80d16a3 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1295,7 +1295,12 @@ static void security_timeout(struct work_struct *work)
1295 struct l2cap_conn *conn = container_of(work, struct l2cap_conn, 1295 struct l2cap_conn *conn = container_of(work, struct l2cap_conn,
1296 security_timer.work); 1296 security_timer.work);
1297 1297
1298 l2cap_conn_del(conn->hcon, ETIMEDOUT); 1298 BT_DBG("conn %p", conn);
1299
1300 if (test_and_clear_bit(HCI_CONN_LE_SMP_PEND, &conn->hcon->flags)) {
1301 smp_chan_destroy(conn);
1302 l2cap_conn_del(conn->hcon, ETIMEDOUT);
1303 }
1299} 1304}
1300 1305
1301static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status) 1306static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
@@ -2910,12 +2915,14 @@ static void l2cap_conf_rfc_get(struct l2cap_chan *chan, void *rsp, int len)
2910 while (len >= L2CAP_CONF_OPT_SIZE) { 2915 while (len >= L2CAP_CONF_OPT_SIZE) {
2911 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val); 2916 len -= l2cap_get_conf_opt(&rsp, &type, &olen, &val);
2912 2917
2913 switch (type) { 2918 if (type != L2CAP_CONF_RFC)
2914 case L2CAP_CONF_RFC: 2919 continue;
2915 if (olen == sizeof(rfc)) 2920
2916 memcpy(&rfc, (void *)val, olen); 2921 if (olen != sizeof(rfc))
2917 goto done; 2922 break;
2918 } 2923
2924 memcpy(&rfc, (void *)val, olen);
2925 goto done;
2919 } 2926 }
2920 2927
2921 /* Use sane default values in case a misbehaving remote device 2928 /* Use sane default values in case a misbehaving remote device
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 25d220776079..3e5e3362ea00 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -1598,7 +1598,7 @@ static int disconnect(struct sock *sk, struct hci_dev *hdev, void *data,
1598 else 1598 else
1599 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr); 1599 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, &cp->addr.bdaddr);
1600 1600
1601 if (!conn) { 1601 if (!conn || conn->state == BT_OPEN || conn->state == BT_CLOSED) {
1602 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT, 1602 err = cmd_status(sk, hdev->id, MGMT_OP_DISCONNECT,
1603 MGMT_STATUS_NOT_CONNECTED); 1603 MGMT_STATUS_NOT_CONNECTED);
1604 goto failed; 1604 goto failed;
@@ -1873,6 +1873,22 @@ static void pairing_complete_cb(struct hci_conn *conn, u8 status)
1873 pairing_complete(cmd, mgmt_status(status)); 1873 pairing_complete(cmd, mgmt_status(status));
1874} 1874}
1875 1875
1876static void le_connect_complete_cb(struct hci_conn *conn, u8 status)
1877{
1878 struct pending_cmd *cmd;
1879
1880 BT_DBG("status %u", status);
1881
1882 if (!status)
1883 return;
1884
1885 cmd = find_pairing(conn);
1886 if (!cmd)
1887 BT_DBG("Unable to find a pending command");
1888 else
1889 pairing_complete(cmd, mgmt_status(status));
1890}
1891
1876static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data, 1892static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1877 u16 len) 1893 u16 len)
1878{ 1894{
@@ -1934,6 +1950,8 @@ static int pair_device(struct sock *sk, struct hci_dev *hdev, void *data,
1934 /* For LE, just connecting isn't a proof that the pairing finished */ 1950 /* For LE, just connecting isn't a proof that the pairing finished */
1935 if (cp->addr.type == BDADDR_BREDR) 1951 if (cp->addr.type == BDADDR_BREDR)
1936 conn->connect_cfm_cb = pairing_complete_cb; 1952 conn->connect_cfm_cb = pairing_complete_cb;
1953 else
1954 conn->connect_cfm_cb = le_connect_complete_cb;
1937 1955
1938 conn->security_cfm_cb = pairing_complete_cb; 1956 conn->security_cfm_cb = pairing_complete_cb;
1939 conn->disconn_cfm_cb = pairing_complete_cb; 1957 conn->disconn_cfm_cb = pairing_complete_cb;
diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c
index 6fc7c4708f3e..37df4e9b3896 100644
--- a/net/bluetooth/smp.c
+++ b/net/bluetooth/smp.c
@@ -648,7 +648,7 @@ static u8 smp_cmd_pairing_rsp(struct l2cap_conn *conn, struct sk_buff *skb)
648 648
649 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM; 649 auth |= (req->auth_req | rsp->auth_req) & SMP_AUTH_MITM;
650 650
651 ret = tk_request(conn, 0, auth, rsp->io_capability, req->io_capability); 651 ret = tk_request(conn, 0, auth, req->io_capability, rsp->io_capability);
652 if (ret) 652 if (ret)
653 return SMP_UNSPECIFIED; 653 return SMP_UNSPECIFIED;
654 654
@@ -703,7 +703,7 @@ static u8 smp_cmd_pairing_random(struct l2cap_conn *conn, struct sk_buff *skb)
703 return 0; 703 return 0;
704} 704}
705 705
706static u8 smp_ltk_encrypt(struct l2cap_conn *conn) 706static u8 smp_ltk_encrypt(struct l2cap_conn *conn, u8 sec_level)
707{ 707{
708 struct smp_ltk *key; 708 struct smp_ltk *key;
709 struct hci_conn *hcon = conn->hcon; 709 struct hci_conn *hcon = conn->hcon;
@@ -712,6 +712,9 @@ static u8 smp_ltk_encrypt(struct l2cap_conn *conn)
712 if (!key) 712 if (!key)
713 return 0; 713 return 0;
714 714
715 if (sec_level > BT_SECURITY_MEDIUM && !key->authenticated)
716 return 0;
717
715 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags)) 718 if (test_and_set_bit(HCI_CONN_ENCRYPT_PEND, &hcon->flags))
716 return 1; 719 return 1;
717 720
@@ -732,7 +735,7 @@ static u8 smp_cmd_security_req(struct l2cap_conn *conn, struct sk_buff *skb)
732 735
733 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req); 736 hcon->pending_sec_level = authreq_to_seclevel(rp->auth_req);
734 737
735 if (smp_ltk_encrypt(conn)) 738 if (smp_ltk_encrypt(conn, hcon->pending_sec_level))
736 return 0; 739 return 0;
737 740
738 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) 741 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
@@ -771,7 +774,7 @@ int smp_conn_security(struct l2cap_conn *conn, __u8 sec_level)
771 return 1; 774 return 1;
772 775
773 if (hcon->link_mode & HCI_LM_MASTER) 776 if (hcon->link_mode & HCI_LM_MASTER)
774 if (smp_ltk_encrypt(conn)) 777 if (smp_ltk_encrypt(conn, sec_level))
775 goto done; 778 goto done;
776 779
777 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags)) 780 if (test_and_set_bit(HCI_CONN_LE_SMP_PEND, &hcon->flags))
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 0a942fbccc9a..e1144e1617be 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -240,6 +240,7 @@ int br_add_bridge(struct net *net, const char *name)
240 return -ENOMEM; 240 return -ENOMEM;
241 241
242 dev_net_set(dev, net); 242 dev_net_set(dev, net);
243 dev->rtnl_link_ops = &br_link_ops;
243 244
244 res = register_netdev(dev); 245 res = register_netdev(dev);
245 if (res) 246 if (res)
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index 2080485515f1..fe41260fbf38 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -208,7 +208,7 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
208 return 0; 208 return 0;
209} 209}
210 210
211static struct rtnl_link_ops br_link_ops __read_mostly = { 211struct rtnl_link_ops br_link_ops __read_mostly = {
212 .kind = "bridge", 212 .kind = "bridge",
213 .priv_size = sizeof(struct net_bridge), 213 .priv_size = sizeof(struct net_bridge),
214 .setup = br_dev_setup, 214 .setup = br_dev_setup,
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 1a8ad4fb9a6b..a768b2408edf 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -549,6 +549,7 @@ extern int (*br_fdb_test_addr_hook)(struct net_device *dev, unsigned char *addr)
549#endif 549#endif
550 550
551/* br_netlink.c */ 551/* br_netlink.c */
552extern struct rtnl_link_ops br_link_ops;
552extern int br_netlink_init(void); 553extern int br_netlink_init(void);
553extern void br_netlink_fini(void); 554extern void br_netlink_fini(void);
554extern void br_ifinfo_notify(int event, struct net_bridge_port *port); 555extern void br_ifinfo_notify(int event, struct net_bridge_port *port);
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index aa6f716524fd..554b31289607 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -4,8 +4,7 @@
4 * Author: Sjur Brendeland/sjur.brandeland@stericsson.com 4 * Author: Sjur Brendeland/sjur.brandeland@stericsson.com
5 * License terms: GNU General Public License (GPL) version 2 5 * License terms: GNU General Public License (GPL) version 2
6 * 6 *
7 * Borrowed heavily from file: pn_dev.c. Thanks to 7 * Borrowed heavily from file: pn_dev.c. Thanks to Remi Denis-Courmont
8 * Remi Denis-Courmont <remi.denis-courmont@nokia.com>
9 * and Sakari Ailus <sakari.ailus@nokia.com> 8 * and Sakari Ailus <sakari.ailus@nokia.com>
10 */ 9 */
11 10
diff --git a/net/caif/caif_socket.c b/net/caif/caif_socket.c
index fb8944355264..78f1cdad5b33 100644
--- a/net/caif/caif_socket.c
+++ b/net/caif/caif_socket.c
@@ -220,6 +220,7 @@ static void caif_ctrl_cb(struct cflayer *layr,
220 cfsk_hold, cfsk_put); 220 cfsk_hold, cfsk_put);
221 cf_sk->sk.sk_state = CAIF_CONNECTED; 221 cf_sk->sk.sk_state = CAIF_CONNECTED;
222 set_tx_flow_on(cf_sk); 222 set_tx_flow_on(cf_sk);
223 cf_sk->sk.sk_shutdown = 0;
223 cf_sk->sk.sk_state_change(&cf_sk->sk); 224 cf_sk->sk.sk_state_change(&cf_sk->sk);
224 break; 225 break;
225 226
diff --git a/net/can/raw.c b/net/can/raw.c
index cde1b4a20f75..46cca3a91d19 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -681,9 +681,6 @@ static int raw_sendmsg(struct kiocb *iocb, struct socket *sock,
681 if (err < 0) 681 if (err < 0)
682 goto free_skb; 682 goto free_skb;
683 683
684 /* to be able to check the received tx sock reference in raw_rcv() */
685 skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
686
687 skb->dev = dev; 684 skb->dev = dev;
688 skb->sk = sk; 685 skb->sk = sk;
689 686
diff --git a/net/ceph/ceph_common.c b/net/ceph/ceph_common.c
index a776f751edbf..ba4323bce0e9 100644
--- a/net/ceph/ceph_common.c
+++ b/net/ceph/ceph_common.c
@@ -504,13 +504,6 @@ void ceph_destroy_client(struct ceph_client *client)
504 /* unmount */ 504 /* unmount */
505 ceph_osdc_stop(&client->osdc); 505 ceph_osdc_stop(&client->osdc);
506 506
507 /*
508 * make sure osd connections close out before destroying the
509 * auth module, which is needed to free those connections'
510 * ceph_authorizers.
511 */
512 ceph_msgr_flush();
513
514 ceph_monc_stop(&client->monc); 507 ceph_monc_stop(&client->monc);
515 508
516 ceph_debugfs_client_cleanup(client); 509 ceph_debugfs_client_cleanup(client);
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index 524f4e4f598b..b332c3d76059 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -563,6 +563,10 @@ static void prepare_write_message(struct ceph_connection *con)
563 m->hdr.seq = cpu_to_le64(++con->out_seq); 563 m->hdr.seq = cpu_to_le64(++con->out_seq);
564 m->needs_out_seq = false; 564 m->needs_out_seq = false;
565 } 565 }
566#ifdef CONFIG_BLOCK
567 else
568 m->bio_iter = NULL;
569#endif
566 570
567 dout("prepare_write_message %p seq %lld type %d len %d+%d+%d %d pgs\n", 571 dout("prepare_write_message %p seq %lld type %d len %d+%d+%d %d pgs\n",
568 m, con->out_seq, le16_to_cpu(m->hdr.type), 572 m, con->out_seq, le16_to_cpu(m->hdr.type),
diff --git a/net/ceph/mon_client.c b/net/ceph/mon_client.c
index 10d6008d31f2..d0649a9655be 100644
--- a/net/ceph/mon_client.c
+++ b/net/ceph/mon_client.c
@@ -847,6 +847,14 @@ void ceph_monc_stop(struct ceph_mon_client *monc)
847 847
848 mutex_unlock(&monc->mutex); 848 mutex_unlock(&monc->mutex);
849 849
850 /*
851 * flush msgr queue before we destroy ourselves to ensure that:
852 * - any work that references our embedded con is finished.
853 * - any osd_client or other work that may reference an authorizer
854 * finishes before we shut down the auth subsystem.
855 */
856 ceph_msgr_flush();
857
850 ceph_auth_destroy(monc->auth); 858 ceph_auth_destroy(monc->auth);
851 859
852 ceph_msg_put(monc->m_auth); 860 ceph_msg_put(monc->m_auth);
diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
index 1ffebed5ce0f..ca59e66c9787 100644
--- a/net/ceph/osd_client.c
+++ b/net/ceph/osd_client.c
@@ -139,15 +139,15 @@ void ceph_osdc_release_request(struct kref *kref)
139 139
140 if (req->r_request) 140 if (req->r_request)
141 ceph_msg_put(req->r_request); 141 ceph_msg_put(req->r_request);
142 if (req->r_reply)
143 ceph_msg_put(req->r_reply);
144 if (req->r_con_filling_msg) { 142 if (req->r_con_filling_msg) {
145 dout("release_request revoking pages %p from con %p\n", 143 dout("release_request revoking pages %p from con %p\n",
146 req->r_pages, req->r_con_filling_msg); 144 req->r_pages, req->r_con_filling_msg);
147 ceph_con_revoke_message(req->r_con_filling_msg, 145 ceph_con_revoke_message(req->r_con_filling_msg,
148 req->r_reply); 146 req->r_reply);
149 ceph_con_put(req->r_con_filling_msg); 147 req->r_con_filling_msg->ops->put(req->r_con_filling_msg);
150 } 148 }
149 if (req->r_reply)
150 ceph_msg_put(req->r_reply);
151 if (req->r_own_pages) 151 if (req->r_own_pages)
152 ceph_release_page_vector(req->r_pages, 152 ceph_release_page_vector(req->r_pages,
153 req->r_num_pages); 153 req->r_num_pages);
@@ -1216,7 +1216,7 @@ static void handle_reply(struct ceph_osd_client *osdc, struct ceph_msg *msg,
1216 if (req->r_con_filling_msg == con && req->r_reply == msg) { 1216 if (req->r_con_filling_msg == con && req->r_reply == msg) {
1217 dout(" dropping con_filling_msg ref %p\n", con); 1217 dout(" dropping con_filling_msg ref %p\n", con);
1218 req->r_con_filling_msg = NULL; 1218 req->r_con_filling_msg = NULL;
1219 ceph_con_put(con); 1219 con->ops->put(con);
1220 } 1220 }
1221 1221
1222 if (!req->r_got_reply) { 1222 if (!req->r_got_reply) {
@@ -2028,7 +2028,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
2028 dout("get_reply revoking msg %p from old con %p\n", 2028 dout("get_reply revoking msg %p from old con %p\n",
2029 req->r_reply, req->r_con_filling_msg); 2029 req->r_reply, req->r_con_filling_msg);
2030 ceph_con_revoke_message(req->r_con_filling_msg, req->r_reply); 2030 ceph_con_revoke_message(req->r_con_filling_msg, req->r_reply);
2031 ceph_con_put(req->r_con_filling_msg); 2031 req->r_con_filling_msg->ops->put(req->r_con_filling_msg);
2032 req->r_con_filling_msg = NULL; 2032 req->r_con_filling_msg = NULL;
2033 } 2033 }
2034 2034
@@ -2063,7 +2063,7 @@ static struct ceph_msg *get_reply(struct ceph_connection *con,
2063#endif 2063#endif
2064 } 2064 }
2065 *skip = 0; 2065 *skip = 0;
2066 req->r_con_filling_msg = ceph_con_get(con); 2066 req->r_con_filling_msg = con->ops->get(con);
2067 dout("get_reply tid %lld %p\n", tid, m); 2067 dout("get_reply tid %lld %p\n", tid, m);
2068 2068
2069out: 2069out:
diff --git a/net/core/dev.c b/net/core/dev.c
index cd0981977f5c..6df214041a5e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2089,25 +2089,6 @@ static int dev_gso_segment(struct sk_buff *skb, netdev_features_t features)
2089 return 0; 2089 return 0;
2090} 2090}
2091 2091
2092/*
2093 * Try to orphan skb early, right before transmission by the device.
2094 * We cannot orphan skb if tx timestamp is requested or the sk-reference
2095 * is needed on driver level for other reasons, e.g. see net/can/raw.c
2096 */
2097static inline void skb_orphan_try(struct sk_buff *skb)
2098{
2099 struct sock *sk = skb->sk;
2100
2101 if (sk && !skb_shinfo(skb)->tx_flags) {
2102 /* skb_tx_hash() wont be able to get sk.
2103 * We copy sk_hash into skb->rxhash
2104 */
2105 if (!skb->rxhash)
2106 skb->rxhash = sk->sk_hash;
2107 skb_orphan(skb);
2108 }
2109}
2110
2111static bool can_checksum_protocol(netdev_features_t features, __be16 protocol) 2092static bool can_checksum_protocol(netdev_features_t features, __be16 protocol)
2112{ 2093{
2113 return ((features & NETIF_F_GEN_CSUM) || 2094 return ((features & NETIF_F_GEN_CSUM) ||
@@ -2193,8 +2174,6 @@ int dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev,
2193 if (!list_empty(&ptype_all)) 2174 if (!list_empty(&ptype_all))
2194 dev_queue_xmit_nit(skb, dev); 2175 dev_queue_xmit_nit(skb, dev);
2195 2176
2196 skb_orphan_try(skb);
2197
2198 features = netif_skb_features(skb); 2177 features = netif_skb_features(skb);
2199 2178
2200 if (vlan_tx_tag_present(skb) && 2179 if (vlan_tx_tag_present(skb) &&
@@ -2304,7 +2283,7 @@ u16 __skb_tx_hash(const struct net_device *dev, const struct sk_buff *skb,
2304 if (skb->sk && skb->sk->sk_hash) 2283 if (skb->sk && skb->sk->sk_hash)
2305 hash = skb->sk->sk_hash; 2284 hash = skb->sk->sk_hash;
2306 else 2285 else
2307 hash = (__force u16) skb->protocol ^ skb->rxhash; 2286 hash = (__force u16) skb->protocol;
2308 hash = jhash_1word(hash, hashrnd); 2287 hash = jhash_1word(hash, hashrnd);
2309 2288
2310 return (u16) (((u64) hash * qcount) >> 32) + qoffset; 2289 return (u16) (((u64) hash * qcount) >> 32) + qoffset;
diff --git a/net/core/drop_monitor.c b/net/core/drop_monitor.c
index ea5fb9fcc3f5..d23b6682f4e9 100644
--- a/net/core/drop_monitor.c
+++ b/net/core/drop_monitor.c
@@ -36,9 +36,6 @@
36#define TRACE_ON 1 36#define TRACE_ON 1
37#define TRACE_OFF 0 37#define TRACE_OFF 0
38 38
39static void send_dm_alert(struct work_struct *unused);
40
41
42/* 39/*
43 * Globals, our netlink socket pointer 40 * Globals, our netlink socket pointer
44 * and the work handle that will send up 41 * and the work handle that will send up
@@ -48,11 +45,10 @@ static int trace_state = TRACE_OFF;
48static DEFINE_MUTEX(trace_state_mutex); 45static DEFINE_MUTEX(trace_state_mutex);
49 46
50struct per_cpu_dm_data { 47struct per_cpu_dm_data {
51 struct work_struct dm_alert_work; 48 spinlock_t lock;
52 struct sk_buff __rcu *skb; 49 struct sk_buff *skb;
53 atomic_t dm_hit_count; 50 struct work_struct dm_alert_work;
54 struct timer_list send_timer; 51 struct timer_list send_timer;
55 int cpu;
56}; 52};
57 53
58struct dm_hw_stat_delta { 54struct dm_hw_stat_delta {
@@ -78,13 +74,13 @@ static int dm_delay = 1;
78static unsigned long dm_hw_check_delta = 2*HZ; 74static unsigned long dm_hw_check_delta = 2*HZ;
79static LIST_HEAD(hw_stats_list); 75static LIST_HEAD(hw_stats_list);
80 76
81static void reset_per_cpu_data(struct per_cpu_dm_data *data) 77static struct sk_buff *reset_per_cpu_data(struct per_cpu_dm_data *data)
82{ 78{
83 size_t al; 79 size_t al;
84 struct net_dm_alert_msg *msg; 80 struct net_dm_alert_msg *msg;
85 struct nlattr *nla; 81 struct nlattr *nla;
86 struct sk_buff *skb; 82 struct sk_buff *skb;
87 struct sk_buff *oskb = rcu_dereference_protected(data->skb, 1); 83 unsigned long flags;
88 84
89 al = sizeof(struct net_dm_alert_msg); 85 al = sizeof(struct net_dm_alert_msg);
90 al += dm_hit_limit * sizeof(struct net_dm_drop_point); 86 al += dm_hit_limit * sizeof(struct net_dm_drop_point);
@@ -99,65 +95,40 @@ static void reset_per_cpu_data(struct per_cpu_dm_data *data)
99 sizeof(struct net_dm_alert_msg)); 95 sizeof(struct net_dm_alert_msg));
100 msg = nla_data(nla); 96 msg = nla_data(nla);
101 memset(msg, 0, al); 97 memset(msg, 0, al);
102 } else 98 } else {
103 schedule_work_on(data->cpu, &data->dm_alert_work); 99 mod_timer(&data->send_timer, jiffies + HZ / 10);
104
105 /*
106 * Don't need to lock this, since we are guaranteed to only
107 * run this on a single cpu at a time.
108 * Note also that we only update data->skb if the old and new skb
109 * pointers don't match. This ensures that we don't continually call
110 * synchornize_rcu if we repeatedly fail to alloc a new netlink message.
111 */
112 if (skb != oskb) {
113 rcu_assign_pointer(data->skb, skb);
114
115 synchronize_rcu();
116
117 atomic_set(&data->dm_hit_count, dm_hit_limit);
118 } 100 }
119 101
102 spin_lock_irqsave(&data->lock, flags);
103 swap(data->skb, skb);
104 spin_unlock_irqrestore(&data->lock, flags);
105
106 return skb;
120} 107}
121 108
122static void send_dm_alert(struct work_struct *unused) 109static void send_dm_alert(struct work_struct *work)
123{ 110{
124 struct sk_buff *skb; 111 struct sk_buff *skb;
125 struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data); 112 struct per_cpu_dm_data *data;
126 113
127 WARN_ON_ONCE(data->cpu != smp_processor_id()); 114 data = container_of(work, struct per_cpu_dm_data, dm_alert_work);
128 115
129 /* 116 skb = reset_per_cpu_data(data);
130 * Grab the skb we're about to send
131 */
132 skb = rcu_dereference_protected(data->skb, 1);
133
134 /*
135 * Replace it with a new one
136 */
137 reset_per_cpu_data(data);
138 117
139 /*
140 * Ship it!
141 */
142 if (skb) 118 if (skb)
143 genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL); 119 genlmsg_multicast(skb, 0, NET_DM_GRP_ALERT, GFP_KERNEL);
144
145 put_cpu_var(dm_cpu_data);
146} 120}
147 121
148/* 122/*
149 * This is the timer function to delay the sending of an alert 123 * This is the timer function to delay the sending of an alert
150 * in the event that more drops will arrive during the 124 * in the event that more drops will arrive during the
151 * hysteresis period. Note that it operates under the timer interrupt 125 * hysteresis period.
152 * so we don't need to disable preemption here
153 */ 126 */
154static void sched_send_work(unsigned long unused) 127static void sched_send_work(unsigned long _data)
155{ 128{
156 struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data); 129 struct per_cpu_dm_data *data = (struct per_cpu_dm_data *)_data;
157
158 schedule_work_on(smp_processor_id(), &data->dm_alert_work);
159 130
160 put_cpu_var(dm_cpu_data); 131 schedule_work(&data->dm_alert_work);
161} 132}
162 133
163static void trace_drop_common(struct sk_buff *skb, void *location) 134static void trace_drop_common(struct sk_buff *skb, void *location)
@@ -167,33 +138,28 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
167 struct nlattr *nla; 138 struct nlattr *nla;
168 int i; 139 int i;
169 struct sk_buff *dskb; 140 struct sk_buff *dskb;
170 struct per_cpu_dm_data *data = &get_cpu_var(dm_cpu_data); 141 struct per_cpu_dm_data *data;
171 142 unsigned long flags;
172 143
173 rcu_read_lock(); 144 local_irq_save(flags);
174 dskb = rcu_dereference(data->skb); 145 data = &__get_cpu_var(dm_cpu_data);
146 spin_lock(&data->lock);
147 dskb = data->skb;
175 148
176 if (!dskb) 149 if (!dskb)
177 goto out; 150 goto out;
178 151
179 if (!atomic_add_unless(&data->dm_hit_count, -1, 0)) {
180 /*
181 * we're already at zero, discard this hit
182 */
183 goto out;
184 }
185
186 nlh = (struct nlmsghdr *)dskb->data; 152 nlh = (struct nlmsghdr *)dskb->data;
187 nla = genlmsg_data(nlmsg_data(nlh)); 153 nla = genlmsg_data(nlmsg_data(nlh));
188 msg = nla_data(nla); 154 msg = nla_data(nla);
189 for (i = 0; i < msg->entries; i++) { 155 for (i = 0; i < msg->entries; i++) {
190 if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) { 156 if (!memcmp(&location, msg->points[i].pc, sizeof(void *))) {
191 msg->points[i].count++; 157 msg->points[i].count++;
192 atomic_inc(&data->dm_hit_count);
193 goto out; 158 goto out;
194 } 159 }
195 } 160 }
196 161 if (msg->entries == dm_hit_limit)
162 goto out;
197 /* 163 /*
198 * We need to create a new entry 164 * We need to create a new entry
199 */ 165 */
@@ -205,13 +171,11 @@ static void trace_drop_common(struct sk_buff *skb, void *location)
205 171
206 if (!timer_pending(&data->send_timer)) { 172 if (!timer_pending(&data->send_timer)) {
207 data->send_timer.expires = jiffies + dm_delay * HZ; 173 data->send_timer.expires = jiffies + dm_delay * HZ;
208 add_timer_on(&data->send_timer, smp_processor_id()); 174 add_timer(&data->send_timer);
209 } 175 }
210 176
211out: 177out:
212 rcu_read_unlock(); 178 spin_unlock_irqrestore(&data->lock, flags);
213 put_cpu_var(dm_cpu_data);
214 return;
215} 179}
216 180
217static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, void *location) 181static void trace_kfree_skb_hit(void *ignore, struct sk_buff *skb, void *location)
@@ -418,11 +382,11 @@ static int __init init_net_drop_monitor(void)
418 382
419 for_each_possible_cpu(cpu) { 383 for_each_possible_cpu(cpu) {
420 data = &per_cpu(dm_cpu_data, cpu); 384 data = &per_cpu(dm_cpu_data, cpu);
421 data->cpu = cpu;
422 INIT_WORK(&data->dm_alert_work, send_dm_alert); 385 INIT_WORK(&data->dm_alert_work, send_dm_alert);
423 init_timer(&data->send_timer); 386 init_timer(&data->send_timer);
424 data->send_timer.data = cpu; 387 data->send_timer.data = (unsigned long)data;
425 data->send_timer.function = sched_send_work; 388 data->send_timer.function = sched_send_work;
389 spin_lock_init(&data->lock);
426 reset_per_cpu_data(data); 390 reset_per_cpu_data(data);
427 } 391 }
428 392
diff --git a/net/core/filter.c b/net/core/filter.c
index a3eddb515d1b..d4ce2dc712e3 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -616,9 +616,9 @@ static int __sk_prepare_filter(struct sk_filter *fp)
616/** 616/**
617 * sk_unattached_filter_create - create an unattached filter 617 * sk_unattached_filter_create - create an unattached filter
618 * @fprog: the filter program 618 * @fprog: the filter program
619 * @sk: the socket to use 619 * @pfp: the unattached filter that is created
620 * 620 *
621 * Create a filter independent ofr any socket. We first run some 621 * Create a filter independent of any socket. We first run some
622 * sanity checks on it to make sure it does not explode on us later. 622 * sanity checks on it to make sure it does not explode on us later.
623 * If an error occurs or there is insufficient memory for the filter 623 * If an error occurs or there is insufficient memory for the filter
624 * a negative errno code is returned. On success the return is zero. 624 * a negative errno code is returned. On success the return is zero.
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index eb09f8bbbf07..d81d026138f0 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2219,9 +2219,7 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2219 rcu_read_lock_bh(); 2219 rcu_read_lock_bh();
2220 nht = rcu_dereference_bh(tbl->nht); 2220 nht = rcu_dereference_bh(tbl->nht);
2221 2221
2222 for (h = 0; h < (1 << nht->hash_shift); h++) { 2222 for (h = s_h; h < (1 << nht->hash_shift); h++) {
2223 if (h < s_h)
2224 continue;
2225 if (h > s_h) 2223 if (h > s_h)
2226 s_idx = 0; 2224 s_idx = 0;
2227 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0; 2225 for (n = rcu_dereference_bh(nht->hash_buckets[h]), idx = 0;
@@ -2260,9 +2258,7 @@ static int pneigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
2260 2258
2261 read_lock_bh(&tbl->lock); 2259 read_lock_bh(&tbl->lock);
2262 2260
2263 for (h = 0; h <= PNEIGH_HASHMASK; h++) { 2261 for (h = s_h; h <= PNEIGH_HASHMASK; h++) {
2264 if (h < s_h)
2265 continue;
2266 if (h > s_h) 2262 if (h > s_h)
2267 s_idx = 0; 2263 s_idx = 0;
2268 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) { 2264 for (n = tbl->phash_buckets[h], idx = 0; n; n = n->next) {
@@ -2297,7 +2293,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2297 struct neigh_table *tbl; 2293 struct neigh_table *tbl;
2298 int t, family, s_t; 2294 int t, family, s_t;
2299 int proxy = 0; 2295 int proxy = 0;
2300 int err = 0; 2296 int err;
2301 2297
2302 read_lock(&neigh_tbl_lock); 2298 read_lock(&neigh_tbl_lock);
2303 family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family; 2299 family = ((struct rtgenmsg *) nlmsg_data(cb->nlh))->rtgen_family;
@@ -2311,7 +2307,7 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2311 2307
2312 s_t = cb->args[0]; 2308 s_t = cb->args[0];
2313 2309
2314 for (tbl = neigh_tables, t = 0; tbl && (err >= 0); 2310 for (tbl = neigh_tables, t = 0; tbl;
2315 tbl = tbl->next, t++) { 2311 tbl = tbl->next, t++) {
2316 if (t < s_t || (family && tbl->family != family)) 2312 if (t < s_t || (family && tbl->family != family))
2317 continue; 2313 continue;
@@ -2322,6 +2318,8 @@ static int neigh_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
2322 err = pneigh_dump_table(tbl, skb, cb); 2318 err = pneigh_dump_table(tbl, skb, cb);
2323 else 2319 else
2324 err = neigh_dump_table(tbl, skb, cb); 2320 err = neigh_dump_table(tbl, skb, cb);
2321 if (err < 0)
2322 break;
2325 } 2323 }
2326 read_unlock(&neigh_tbl_lock); 2324 read_unlock(&neigh_tbl_lock);
2327 2325
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 3d84fb9d8873..f9f40b932e4b 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -362,22 +362,23 @@ EXPORT_SYMBOL(netpoll_send_skb_on_dev);
362 362
363void netpoll_send_udp(struct netpoll *np, const char *msg, int len) 363void netpoll_send_udp(struct netpoll *np, const char *msg, int len)
364{ 364{
365 int total_len, eth_len, ip_len, udp_len; 365 int total_len, ip_len, udp_len;
366 struct sk_buff *skb; 366 struct sk_buff *skb;
367 struct udphdr *udph; 367 struct udphdr *udph;
368 struct iphdr *iph; 368 struct iphdr *iph;
369 struct ethhdr *eth; 369 struct ethhdr *eth;
370 370
371 udp_len = len + sizeof(*udph); 371 udp_len = len + sizeof(*udph);
372 ip_len = eth_len = udp_len + sizeof(*iph); 372 ip_len = udp_len + sizeof(*iph);
373 total_len = eth_len + ETH_HLEN + NET_IP_ALIGN; 373 total_len = ip_len + LL_RESERVED_SPACE(np->dev);
374 374
375 skb = find_skb(np, total_len, total_len - len); 375 skb = find_skb(np, total_len + np->dev->needed_tailroom,
376 total_len - len);
376 if (!skb) 377 if (!skb)
377 return; 378 return;
378 379
379 skb_copy_to_linear_data(skb, msg, len); 380 skb_copy_to_linear_data(skb, msg, len);
380 skb->len += len; 381 skb_put(skb, len);
381 382
382 skb_push(skb, sizeof(*udph)); 383 skb_push(skb, sizeof(*udph));
383 skb_reset_transport_header(skb); 384 skb_reset_transport_header(skb);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 016694d62484..d78671e9d545 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3361,7 +3361,7 @@ EXPORT_SYMBOL(kfree_skb_partial);
3361 * @to: prior buffer 3361 * @to: prior buffer
3362 * @from: buffer to add 3362 * @from: buffer to add
3363 * @fragstolen: pointer to boolean 3363 * @fragstolen: pointer to boolean
3364 * 3364 * @delta_truesize: how much more was allocated than was requested
3365 */ 3365 */
3366bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from, 3366bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
3367 bool *fragstolen, int *delta_truesize) 3367 bool *fragstolen, int *delta_truesize)
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index d4d61b694fab..dfba343b2509 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -560,6 +560,17 @@ bool inet_peer_xrlim_allow(struct inet_peer *peer, int timeout)
560} 560}
561EXPORT_SYMBOL(inet_peer_xrlim_allow); 561EXPORT_SYMBOL(inet_peer_xrlim_allow);
562 562
563static void inetpeer_inval_rcu(struct rcu_head *head)
564{
565 struct inet_peer *p = container_of(head, struct inet_peer, gc_rcu);
566
567 spin_lock_bh(&gc_lock);
568 list_add_tail(&p->gc_list, &gc_list);
569 spin_unlock_bh(&gc_lock);
570
571 schedule_delayed_work(&gc_work, gc_delay);
572}
573
563void inetpeer_invalidate_tree(int family) 574void inetpeer_invalidate_tree(int family)
564{ 575{
565 struct inet_peer *old, *new, *prev; 576 struct inet_peer *old, *new, *prev;
@@ -576,10 +587,7 @@ void inetpeer_invalidate_tree(int family)
576 prev = cmpxchg(&base->root, old, new); 587 prev = cmpxchg(&base->root, old, new);
577 if (prev == old) { 588 if (prev == old) {
578 base->total = 0; 589 base->total = 0;
579 spin_lock(&gc_lock); 590 call_rcu(&prev->gc_rcu, inetpeer_inval_rcu);
580 list_add_tail(&prev->gc_list, &gc_list);
581 spin_unlock(&gc_lock);
582 schedule_delayed_work(&gc_work, gc_delay);
583 } 591 }
584 592
585out: 593out:
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index e5c44fc586ab..ab09b126423c 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -44,6 +44,7 @@ static int ip_forward_finish(struct sk_buff *skb)
44 struct ip_options *opt = &(IPCB(skb)->opt); 44 struct ip_options *opt = &(IPCB(skb)->opt);
45 45
46 IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); 46 IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
47 IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
47 48
48 if (unlikely(opt->optlen)) 49 if (unlikely(opt->optlen))
49 ip_forward_options(skb); 50 ip_forward_options(skb);
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index a9e519ad6db5..c94bbc6f2ba3 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -1574,6 +1574,7 @@ static inline int ipmr_forward_finish(struct sk_buff *skb)
1574 struct ip_options *opt = &(IPCB(skb)->opt); 1574 struct ip_options *opt = &(IPCB(skb)->opt);
1575 1575
1576 IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS); 1576 IP_INC_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTFORWDATAGRAMS);
1577 IP_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), IPSTATS_MIB_OUTOCTETS, skb->len);
1577 1578
1578 if (unlikely(opt->optlen)) 1579 if (unlikely(opt->optlen))
1579 ip_forward_options(skb); 1580 ip_forward_options(skb);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 0c220a416626..608327661960 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1349,8 +1349,8 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
1349 if (w->leaf && fn->fn_flags & RTN_RTINFO) { 1349 if (w->leaf && fn->fn_flags & RTN_RTINFO) {
1350 int err; 1350 int err;
1351 1351
1352 if (w->count < w->skip) { 1352 if (w->skip) {
1353 w->count++; 1353 w->skip--;
1354 continue; 1354 continue;
1355 } 1355 }
1356 1356
@@ -1561,7 +1561,7 @@ static int fib6_age(struct rt6_info *rt, void *arg)
1561 neigh_flags = neigh->flags; 1561 neigh_flags = neigh->flags;
1562 neigh_release(neigh); 1562 neigh_release(neigh);
1563 } 1563 }
1564 if (neigh_flags & NTF_ROUTER) { 1564 if (!(neigh_flags & NTF_ROUTER)) {
1565 RT6_TRACE("purging route %p via non-router but gateway\n", 1565 RT6_TRACE("purging route %p via non-router but gateway\n",
1566 rt); 1566 rt);
1567 return -1; 1567 return -1;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 17b8c67998bb..decc21d19c53 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -526,6 +526,7 @@ int ip6_forward(struct sk_buff *skb)
526 hdr->hop_limit--; 526 hdr->hop_limit--;
527 527
528 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS); 528 IP6_INC_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTFORWDATAGRAMS);
529 IP6_ADD_STATS_BH(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTOCTETS, skb->len);
529 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev, 530 return NF_HOOK(NFPROTO_IPV6, NF_INET_FORWARD, skb, skb->dev, dst->dev,
530 ip6_forward_finish); 531 ip6_forward_finish);
531 532
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index b15dc08643a4..461e47c8e956 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1886,6 +1886,8 @@ static inline int ip6mr_forward2_finish(struct sk_buff *skb)
1886{ 1886{
1887 IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)), 1887 IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
1888 IPSTATS_MIB_OUTFORWDATAGRAMS); 1888 IPSTATS_MIB_OUTFORWDATAGRAMS);
1889 IP6_ADD_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
1890 IPSTATS_MIB_OUTOCTETS, skb->len);
1889 return dst_output(skb); 1891 return dst_output(skb);
1890} 1892}
1891 1893
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 999a982ad3fd..becb048d18d4 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2957,10 +2957,6 @@ static int __net_init ip6_route_net_init(struct net *net)
2957 net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ; 2957 net->ipv6.sysctl.ip6_rt_mtu_expires = 10*60*HZ;
2958 net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40; 2958 net->ipv6.sysctl.ip6_rt_min_advmss = IPV6_MIN_MTU - 20 - 40;
2959 2959
2960#ifdef CONFIG_PROC_FS
2961 proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
2962 proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
2963#endif
2964 net->ipv6.ip6_rt_gc_expire = 30*HZ; 2960 net->ipv6.ip6_rt_gc_expire = 30*HZ;
2965 2961
2966 ret = 0; 2962 ret = 0;
@@ -2981,10 +2977,6 @@ out_ip6_dst_ops:
2981 2977
2982static void __net_exit ip6_route_net_exit(struct net *net) 2978static void __net_exit ip6_route_net_exit(struct net *net)
2983{ 2979{
2984#ifdef CONFIG_PROC_FS
2985 proc_net_remove(net, "ipv6_route");
2986 proc_net_remove(net, "rt6_stats");
2987#endif
2988 kfree(net->ipv6.ip6_null_entry); 2980 kfree(net->ipv6.ip6_null_entry);
2989#ifdef CONFIG_IPV6_MULTIPLE_TABLES 2981#ifdef CONFIG_IPV6_MULTIPLE_TABLES
2990 kfree(net->ipv6.ip6_prohibit_entry); 2982 kfree(net->ipv6.ip6_prohibit_entry);
@@ -2993,11 +2985,33 @@ static void __net_exit ip6_route_net_exit(struct net *net)
2993 dst_entries_destroy(&net->ipv6.ip6_dst_ops); 2985 dst_entries_destroy(&net->ipv6.ip6_dst_ops);
2994} 2986}
2995 2987
2988static int __net_init ip6_route_net_init_late(struct net *net)
2989{
2990#ifdef CONFIG_PROC_FS
2991 proc_net_fops_create(net, "ipv6_route", 0, &ipv6_route_proc_fops);
2992 proc_net_fops_create(net, "rt6_stats", S_IRUGO, &rt6_stats_seq_fops);
2993#endif
2994 return 0;
2995}
2996
2997static void __net_exit ip6_route_net_exit_late(struct net *net)
2998{
2999#ifdef CONFIG_PROC_FS
3000 proc_net_remove(net, "ipv6_route");
3001 proc_net_remove(net, "rt6_stats");
3002#endif
3003}
3004
2996static struct pernet_operations ip6_route_net_ops = { 3005static struct pernet_operations ip6_route_net_ops = {
2997 .init = ip6_route_net_init, 3006 .init = ip6_route_net_init,
2998 .exit = ip6_route_net_exit, 3007 .exit = ip6_route_net_exit,
2999}; 3008};
3000 3009
3010static struct pernet_operations ip6_route_net_late_ops = {
3011 .init = ip6_route_net_init_late,
3012 .exit = ip6_route_net_exit_late,
3013};
3014
3001static struct notifier_block ip6_route_dev_notifier = { 3015static struct notifier_block ip6_route_dev_notifier = {
3002 .notifier_call = ip6_route_dev_notify, 3016 .notifier_call = ip6_route_dev_notify,
3003 .priority = 0, 3017 .priority = 0,
@@ -3047,19 +3061,25 @@ int __init ip6_route_init(void)
3047 if (ret) 3061 if (ret)
3048 goto xfrm6_init; 3062 goto xfrm6_init;
3049 3063
3064 ret = register_pernet_subsys(&ip6_route_net_late_ops);
3065 if (ret)
3066 goto fib6_rules_init;
3067
3050 ret = -ENOBUFS; 3068 ret = -ENOBUFS;
3051 if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) || 3069 if (__rtnl_register(PF_INET6, RTM_NEWROUTE, inet6_rtm_newroute, NULL, NULL) ||
3052 __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) || 3070 __rtnl_register(PF_INET6, RTM_DELROUTE, inet6_rtm_delroute, NULL, NULL) ||
3053 __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL)) 3071 __rtnl_register(PF_INET6, RTM_GETROUTE, inet6_rtm_getroute, NULL, NULL))
3054 goto fib6_rules_init; 3072 goto out_register_late_subsys;
3055 3073
3056 ret = register_netdevice_notifier(&ip6_route_dev_notifier); 3074 ret = register_netdevice_notifier(&ip6_route_dev_notifier);
3057 if (ret) 3075 if (ret)
3058 goto fib6_rules_init; 3076 goto out_register_late_subsys;
3059 3077
3060out: 3078out:
3061 return ret; 3079 return ret;
3062 3080
3081out_register_late_subsys:
3082 unregister_pernet_subsys(&ip6_route_net_late_ops);
3063fib6_rules_init: 3083fib6_rules_init:
3064 fib6_rules_cleanup(); 3084 fib6_rules_cleanup();
3065xfrm6_init: 3085xfrm6_init:
@@ -3078,6 +3098,7 @@ out_kmem_cache:
3078void ip6_route_cleanup(void) 3098void ip6_route_cleanup(void)
3079{ 3099{
3080 unregister_netdevice_notifier(&ip6_route_dev_notifier); 3100 unregister_netdevice_notifier(&ip6_route_dev_notifier);
3101 unregister_pernet_subsys(&ip6_route_net_late_ops);
3081 fib6_rules_cleanup(); 3102 fib6_rules_cleanup();
3082 xfrm6_fini(); 3103 xfrm6_fini();
3083 fib6_gc_cleanup(); 3104 fib6_gc_cleanup();
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 3a9aec29581a..9df64a50b075 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1212,7 +1212,8 @@ have_isn:
1212 tcp_rsk(req)->snt_isn = isn; 1212 tcp_rsk(req)->snt_isn = isn;
1213 tcp_rsk(req)->snt_synack = tcp_time_stamp; 1213 tcp_rsk(req)->snt_synack = tcp_time_stamp;
1214 1214
1215 security_inet_conn_request(sk, skb, req); 1215 if (security_inet_conn_request(sk, skb, req))
1216 goto drop_and_release;
1216 1217
1217 if (tcp_v6_send_synack(sk, req, 1218 if (tcp_v6_send_synack(sk, req,
1218 (struct request_values *)&tmp_ext, 1219 (struct request_values *)&tmp_ext,
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 07d7d55a1b93..cd6f7a991d80 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -372,7 +372,6 @@ static int afiucv_hs_send(struct iucv_message *imsg, struct sock *sock,
372 skb_trim(skb, skb->dev->mtu); 372 skb_trim(skb, skb->dev->mtu);
373 } 373 }
374 skb->protocol = ETH_P_AF_IUCV; 374 skb->protocol = ETH_P_AF_IUCV;
375 skb_shinfo(skb)->tx_flags |= SKBTX_DRV_NEEDS_SK_REF;
376 nskb = skb_clone(skb, GFP_ATOMIC); 375 nskb = skb_clone(skb, GFP_ATOMIC);
377 if (!nskb) 376 if (!nskb)
378 return -ENOMEM; 377 return -ENOMEM;
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index 443591d629ca..47b259fccd27 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -42,6 +42,11 @@ struct l2tp_eth {
42 struct sock *tunnel_sock; 42 struct sock *tunnel_sock;
43 struct l2tp_session *session; 43 struct l2tp_session *session;
44 struct list_head list; 44 struct list_head list;
45 atomic_long_t tx_bytes;
46 atomic_long_t tx_packets;
47 atomic_long_t rx_bytes;
48 atomic_long_t rx_packets;
49 atomic_long_t rx_errors;
45}; 50};
46 51
47/* via l2tp_session_priv() */ 52/* via l2tp_session_priv() */
@@ -88,24 +93,40 @@ static int l2tp_eth_dev_xmit(struct sk_buff *skb, struct net_device *dev)
88 struct l2tp_eth *priv = netdev_priv(dev); 93 struct l2tp_eth *priv = netdev_priv(dev);
89 struct l2tp_session *session = priv->session; 94 struct l2tp_session *session = priv->session;
90 95
96 atomic_long_add(skb->len, &priv->tx_bytes);
97 atomic_long_inc(&priv->tx_packets);
98
91 l2tp_xmit_skb(session, skb, session->hdr_len); 99 l2tp_xmit_skb(session, skb, session->hdr_len);
92 100
93 dev->stats.tx_bytes += skb->len; 101 return NETDEV_TX_OK;
94 dev->stats.tx_packets++; 102}
95 103
96 return 0; 104static struct rtnl_link_stats64 *l2tp_eth_get_stats64(struct net_device *dev,
105 struct rtnl_link_stats64 *stats)
106{
107 struct l2tp_eth *priv = netdev_priv(dev);
108
109 stats->tx_bytes = atomic_long_read(&priv->tx_bytes);
110 stats->tx_packets = atomic_long_read(&priv->tx_packets);
111 stats->rx_bytes = atomic_long_read(&priv->rx_bytes);
112 stats->rx_packets = atomic_long_read(&priv->rx_packets);
113 stats->rx_errors = atomic_long_read(&priv->rx_errors);
114 return stats;
97} 115}
98 116
117
99static struct net_device_ops l2tp_eth_netdev_ops = { 118static struct net_device_ops l2tp_eth_netdev_ops = {
100 .ndo_init = l2tp_eth_dev_init, 119 .ndo_init = l2tp_eth_dev_init,
101 .ndo_uninit = l2tp_eth_dev_uninit, 120 .ndo_uninit = l2tp_eth_dev_uninit,
102 .ndo_start_xmit = l2tp_eth_dev_xmit, 121 .ndo_start_xmit = l2tp_eth_dev_xmit,
122 .ndo_get_stats64 = l2tp_eth_get_stats64,
103}; 123};
104 124
105static void l2tp_eth_dev_setup(struct net_device *dev) 125static void l2tp_eth_dev_setup(struct net_device *dev)
106{ 126{
107 ether_setup(dev); 127 ether_setup(dev);
108 dev->priv_flags &= ~IFF_TX_SKB_SHARING; 128 dev->priv_flags &= ~IFF_TX_SKB_SHARING;
129 dev->features |= NETIF_F_LLTX;
109 dev->netdev_ops = &l2tp_eth_netdev_ops; 130 dev->netdev_ops = &l2tp_eth_netdev_ops;
110 dev->destructor = free_netdev; 131 dev->destructor = free_netdev;
111} 132}
@@ -114,17 +135,17 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
114{ 135{
115 struct l2tp_eth_sess *spriv = l2tp_session_priv(session); 136 struct l2tp_eth_sess *spriv = l2tp_session_priv(session);
116 struct net_device *dev = spriv->dev; 137 struct net_device *dev = spriv->dev;
138 struct l2tp_eth *priv = netdev_priv(dev);
117 139
118 if (session->debug & L2TP_MSG_DATA) { 140 if (session->debug & L2TP_MSG_DATA) {
119 unsigned int length; 141 unsigned int length;
120 u8 *ptr = skb->data;
121 142
122 length = min(32u, skb->len); 143 length = min(32u, skb->len);
123 if (!pskb_may_pull(skb, length)) 144 if (!pskb_may_pull(skb, length))
124 goto error; 145 goto error;
125 146
126 pr_debug("%s: eth recv\n", session->name); 147 pr_debug("%s: eth recv\n", session->name);
127 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); 148 print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, skb->data, length);
128 } 149 }
129 150
130 if (!pskb_may_pull(skb, sizeof(ETH_HLEN))) 151 if (!pskb_may_pull(skb, sizeof(ETH_HLEN)))
@@ -139,15 +160,15 @@ static void l2tp_eth_dev_recv(struct l2tp_session *session, struct sk_buff *skb,
139 nf_reset(skb); 160 nf_reset(skb);
140 161
141 if (dev_forward_skb(dev, skb) == NET_RX_SUCCESS) { 162 if (dev_forward_skb(dev, skb) == NET_RX_SUCCESS) {
142 dev->stats.rx_packets++; 163 atomic_long_inc(&priv->rx_packets);
143 dev->stats.rx_bytes += data_len; 164 atomic_long_add(data_len, &priv->rx_bytes);
144 } else 165 } else {
145 dev->stats.rx_errors++; 166 atomic_long_inc(&priv->rx_errors);
146 167 }
147 return; 168 return;
148 169
149error: 170error:
150 dev->stats.rx_errors++; 171 atomic_long_inc(&priv->rx_errors);
151 kfree_skb(skb); 172 kfree_skb(skb);
152} 173}
153 174
@@ -162,6 +183,7 @@ static void l2tp_eth_delete(struct l2tp_session *session)
162 if (dev) { 183 if (dev) {
163 unregister_netdev(dev); 184 unregister_netdev(dev);
164 spriv->dev = NULL; 185 spriv->dev = NULL;
186 module_put(THIS_MODULE);
165 } 187 }
166 } 188 }
167} 189}
@@ -249,6 +271,7 @@ static int l2tp_eth_create(struct net *net, u32 tunnel_id, u32 session_id, u32 p
249 if (rc < 0) 271 if (rc < 0)
250 goto out_del_dev; 272 goto out_del_dev;
251 273
274 __module_get(THIS_MODULE);
252 /* Must be done after register_netdev() */ 275 /* Must be done after register_netdev() */
253 strlcpy(session->ifname, dev->name, IFNAMSIZ); 276 strlcpy(session->ifname, dev->name, IFNAMSIZ);
254 277
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index 70614e7affab..61d8b75d2686 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -464,10 +464,12 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
464 sk->sk_bound_dev_if); 464 sk->sk_bound_dev_if);
465 if (IS_ERR(rt)) 465 if (IS_ERR(rt))
466 goto no_route; 466 goto no_route;
467 if (connected) 467 if (connected) {
468 sk_setup_caps(sk, &rt->dst); 468 sk_setup_caps(sk, &rt->dst);
469 else 469 } else {
470 dst_release(&rt->dst); /* safe since we hold rcu_read_lock */ 470 skb_dst_set(skb, &rt->dst);
471 goto xmit;
472 }
471 } 473 }
472 474
473 /* We dont need to clone dst here, it is guaranteed to not disappear. 475 /* We dont need to clone dst here, it is guaranteed to not disappear.
@@ -475,6 +477,7 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
475 */ 477 */
476 skb_dst_set_noref(skb, &rt->dst); 478 skb_dst_set_noref(skb, &rt->dst);
477 479
480xmit:
478 /* Queue the packet to IP for output */ 481 /* Queue the packet to IP for output */
479 rc = ip_queue_xmit(skb, &inet->cork.fl); 482 rc = ip_queue_xmit(skb, &inet->cork.fl);
480 rcu_read_unlock(); 483 rcu_read_unlock();
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 26ddb699d693..c649188314cc 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -145,15 +145,20 @@ static void sta_rx_agg_session_timer_expired(unsigned long data)
145 struct tid_ampdu_rx *tid_rx; 145 struct tid_ampdu_rx *tid_rx;
146 unsigned long timeout; 146 unsigned long timeout;
147 147
148 rcu_read_lock();
148 tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[*ptid]); 149 tid_rx = rcu_dereference(sta->ampdu_mlme.tid_rx[*ptid]);
149 if (!tid_rx) 150 if (!tid_rx) {
151 rcu_read_unlock();
150 return; 152 return;
153 }
151 154
152 timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout); 155 timeout = tid_rx->last_rx + TU_TO_JIFFIES(tid_rx->timeout);
153 if (time_is_after_jiffies(timeout)) { 156 if (time_is_after_jiffies(timeout)) {
154 mod_timer(&tid_rx->session_timer, timeout); 157 mod_timer(&tid_rx->session_timer, timeout);
158 rcu_read_unlock();
155 return; 159 return;
156 } 160 }
161 rcu_read_unlock();
157 162
158#ifdef CONFIG_MAC80211_HT_DEBUG 163#ifdef CONFIG_MAC80211_HT_DEBUG
159 printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid); 164 printk(KERN_DEBUG "rx session timer expired on tid %d\n", (u16)*ptid);
diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
index 495831ee48f1..7d5108a867ad 100644
--- a/net/mac80211/cfg.c
+++ b/net/mac80211/cfg.c
@@ -533,16 +533,16 @@ static void ieee80211_get_et_stats(struct wiphy *wiphy,
533 sinfo.filled = 0; 533 sinfo.filled = 0;
534 sta_set_sinfo(sta, &sinfo); 534 sta_set_sinfo(sta, &sinfo);
535 535
536 if (sinfo.filled | STATION_INFO_TX_BITRATE) 536 if (sinfo.filled & STATION_INFO_TX_BITRATE)
537 data[i] = 100000 * 537 data[i] = 100000 *
538 cfg80211_calculate_bitrate(&sinfo.txrate); 538 cfg80211_calculate_bitrate(&sinfo.txrate);
539 i++; 539 i++;
540 if (sinfo.filled | STATION_INFO_RX_BITRATE) 540 if (sinfo.filled & STATION_INFO_RX_BITRATE)
541 data[i] = 100000 * 541 data[i] = 100000 *
542 cfg80211_calculate_bitrate(&sinfo.rxrate); 542 cfg80211_calculate_bitrate(&sinfo.rxrate);
543 i++; 543 i++;
544 544
545 if (sinfo.filled | STATION_INFO_SIGNAL_AVG) 545 if (sinfo.filled & STATION_INFO_SIGNAL_AVG)
546 data[i] = (u8)sinfo.signal_avg; 546 data[i] = (u8)sinfo.signal_avg;
547 i++; 547 i++;
548 } else { 548 } else {
@@ -2093,6 +2093,9 @@ static int ieee80211_set_bitrate_mask(struct wiphy *wiphy,
2093 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr); 2093 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
2094 int i, ret; 2094 int i, ret;
2095 2095
2096 if (!ieee80211_sdata_running(sdata))
2097 return -ENETDOWN;
2098
2096 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) { 2099 if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
2097 ret = drv_set_bitrate_mask(local, sdata, mask); 2100 ret = drv_set_bitrate_mask(local, sdata, mask);
2098 if (ret) 2101 if (ret)
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index d4c19a7773db..8664111d0566 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -637,6 +637,18 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
637 ieee80211_configure_filter(local); 637 ieee80211_configure_filter(local);
638 break; 638 break;
639 default: 639 default:
640 mutex_lock(&local->mtx);
641 if (local->hw_roc_dev == sdata->dev &&
642 local->hw_roc_channel) {
643 /* ignore return value since this is racy */
644 drv_cancel_remain_on_channel(local);
645 ieee80211_queue_work(&local->hw, &local->hw_roc_done);
646 }
647 mutex_unlock(&local->mtx);
648
649 flush_work(&local->hw_roc_start);
650 flush_work(&local->hw_roc_done);
651
640 flush_work(&sdata->work); 652 flush_work(&sdata->work);
641 /* 653 /*
642 * When we get here, the interface is marked down. 654 * When we get here, the interface is marked down.
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 04c306308987..66e4fcdd1c6b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1220,6 +1220,22 @@ static void ieee80211_sta_wmm_params(struct ieee80211_local *local,
1220 sdata->vif.bss_conf.qos = true; 1220 sdata->vif.bss_conf.qos = true;
1221} 1221}
1222 1222
1223static void __ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1224{
1225 lockdep_assert_held(&sdata->local->mtx);
1226
1227 sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL |
1228 IEEE80211_STA_BEACON_POLL);
1229 ieee80211_run_deferred_scan(sdata->local);
1230}
1231
1232static void ieee80211_stop_poll(struct ieee80211_sub_if_data *sdata)
1233{
1234 mutex_lock(&sdata->local->mtx);
1235 __ieee80211_stop_poll(sdata);
1236 mutex_unlock(&sdata->local->mtx);
1237}
1238
1223static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata, 1239static u32 ieee80211_handle_bss_capability(struct ieee80211_sub_if_data *sdata,
1224 u16 capab, bool erp_valid, u8 erp) 1240 u16 capab, bool erp_valid, u8 erp)
1225{ 1241{
@@ -1285,8 +1301,7 @@ static void ieee80211_set_associated(struct ieee80211_sub_if_data *sdata,
1285 sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE; 1301 sdata->u.mgd.flags |= IEEE80211_STA_RESET_SIGNAL_AVE;
1286 1302
1287 /* just to be sure */ 1303 /* just to be sure */
1288 sdata->u.mgd.flags &= ~(IEEE80211_STA_CONNECTION_POLL | 1304 ieee80211_stop_poll(sdata);
1289 IEEE80211_STA_BEACON_POLL);
1290 1305
1291 ieee80211_led_assoc(local, 1); 1306 ieee80211_led_assoc(local, 1);
1292 1307
@@ -1337,6 +1352,8 @@ static void ieee80211_set_disassoc(struct ieee80211_sub_if_data *sdata,
1337 if (WARN_ON(!ifmgd->associated)) 1352 if (WARN_ON(!ifmgd->associated))
1338 return; 1353 return;
1339 1354
1355 ieee80211_stop_poll(sdata);
1356
1340 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN); 1357 memcpy(bssid, ifmgd->associated->bssid, ETH_ALEN);
1341 1358
1342 ifmgd->associated = NULL; 1359 ifmgd->associated = NULL;
@@ -1456,8 +1473,7 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1456 return; 1473 return;
1457 } 1474 }
1458 1475
1459 ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL | 1476 __ieee80211_stop_poll(sdata);
1460 IEEE80211_STA_BEACON_POLL);
1461 1477
1462 mutex_lock(&local->iflist_mtx); 1478 mutex_lock(&local->iflist_mtx);
1463 ieee80211_recalc_ps(local, -1); 1479 ieee80211_recalc_ps(local, -1);
@@ -1477,7 +1493,6 @@ static void ieee80211_reset_ap_probe(struct ieee80211_sub_if_data *sdata)
1477 round_jiffies_up(jiffies + 1493 round_jiffies_up(jiffies +
1478 IEEE80211_CONNECTION_IDLE_TIME)); 1494 IEEE80211_CONNECTION_IDLE_TIME));
1479out: 1495out:
1480 ieee80211_run_deferred_scan(local);
1481 mutex_unlock(&local->mtx); 1496 mutex_unlock(&local->mtx);
1482} 1497}
1483 1498
@@ -2408,7 +2423,11 @@ static void ieee80211_rx_mgmt_beacon(struct ieee80211_sub_if_data *sdata,
2408 net_dbg_ratelimited("%s: cancelling probereq poll due to a received beacon\n", 2423 net_dbg_ratelimited("%s: cancelling probereq poll due to a received beacon\n",
2409 sdata->name); 2424 sdata->name);
2410#endif 2425#endif
2426 mutex_lock(&local->mtx);
2411 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL; 2427 ifmgd->flags &= ~IEEE80211_STA_BEACON_POLL;
2428 ieee80211_run_deferred_scan(local);
2429 mutex_unlock(&local->mtx);
2430
2412 mutex_lock(&local->iflist_mtx); 2431 mutex_lock(&local->iflist_mtx);
2413 ieee80211_recalc_ps(local, -1); 2432 ieee80211_recalc_ps(local, -1);
2414 mutex_unlock(&local->iflist_mtx); 2433 mutex_unlock(&local->iflist_mtx);
@@ -2595,9 +2614,6 @@ static void ieee80211_sta_connection_lost(struct ieee80211_sub_if_data *sdata,
2595 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; 2614 struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
2596 u8 frame_buf[DEAUTH_DISASSOC_LEN]; 2615 u8 frame_buf[DEAUTH_DISASSOC_LEN];
2597 2616
2598 ifmgd->flags &= ~(IEEE80211_STA_CONNECTION_POLL |
2599 IEEE80211_STA_BEACON_POLL);
2600
2601 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason, 2617 ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, reason,
2602 false, frame_buf); 2618 false, frame_buf);
2603 mutex_unlock(&ifmgd->mtx); 2619 mutex_unlock(&ifmgd->mtx);
@@ -2874,8 +2890,7 @@ static void ieee80211_restart_sta_timer(struct ieee80211_sub_if_data *sdata)
2874 u32 flags; 2890 u32 flags;
2875 2891
2876 if (sdata->vif.type == NL80211_IFTYPE_STATION) { 2892 if (sdata->vif.type == NL80211_IFTYPE_STATION) {
2877 sdata->u.mgd.flags &= ~(IEEE80211_STA_BEACON_POLL | 2893 __ieee80211_stop_poll(sdata);
2878 IEEE80211_STA_CONNECTION_POLL);
2879 2894
2880 /* let's probe the connection once */ 2895 /* let's probe the connection once */
2881 flags = sdata->local->hw.flags; 2896 flags = sdata->local->hw.flags;
@@ -2944,7 +2959,10 @@ void ieee80211_sta_restart(struct ieee80211_sub_if_data *sdata)
2944 if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running)) 2959 if (test_and_clear_bit(TMR_RUNNING_CHANSW, &ifmgd->timers_running))
2945 add_timer(&ifmgd->chswitch_timer); 2960 add_timer(&ifmgd->chswitch_timer);
2946 ieee80211_sta_reset_beacon_monitor(sdata); 2961 ieee80211_sta_reset_beacon_monitor(sdata);
2962
2963 mutex_lock(&sdata->local->mtx);
2947 ieee80211_restart_sta_timer(sdata); 2964 ieee80211_restart_sta_timer(sdata);
2965 mutex_unlock(&sdata->local->mtx);
2948} 2966}
2949#endif 2967#endif
2950 2968
@@ -3106,7 +3124,7 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata,
3106 } 3124 }
3107 3125
3108 local->oper_channel = cbss->channel; 3126 local->oper_channel = cbss->channel;
3109 ieee80211_hw_config(local, 0); 3127 ieee80211_hw_config(local, IEEE80211_CONF_CHANGE_CHANNEL);
3110 3128
3111 if (!have_sta) { 3129 if (!have_sta) {
3112 u32 rates = 0, basic_rates = 0; 3130 u32 rates = 0, basic_rates = 0;
diff --git a/net/mac80211/offchannel.c b/net/mac80211/offchannel.c
index f054e94901a2..935aa4b6deee 100644
--- a/net/mac80211/offchannel.c
+++ b/net/mac80211/offchannel.c
@@ -234,6 +234,22 @@ static void ieee80211_hw_roc_done(struct work_struct *work)
234 return; 234 return;
235 } 235 }
236 236
237 /* was never transmitted */
238 if (local->hw_roc_skb) {
239 u64 cookie;
240
241 cookie = local->hw_roc_cookie ^ 2;
242
243 cfg80211_mgmt_tx_status(local->hw_roc_dev, cookie,
244 local->hw_roc_skb->data,
245 local->hw_roc_skb->len, false,
246 GFP_KERNEL);
247
248 kfree_skb(local->hw_roc_skb);
249 local->hw_roc_skb = NULL;
250 local->hw_roc_skb_for_status = NULL;
251 }
252
237 if (!local->hw_roc_for_tx) 253 if (!local->hw_roc_for_tx)
238 cfg80211_remain_on_channel_expired(local->hw_roc_dev, 254 cfg80211_remain_on_channel_expired(local->hw_roc_dev,
239 local->hw_roc_cookie, 255 local->hw_roc_cookie,
diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
index f5b1638fbf80..de455f8bbb91 100644
--- a/net/mac80211/sta_info.c
+++ b/net/mac80211/sta_info.c
@@ -378,7 +378,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
378 /* make the station visible */ 378 /* make the station visible */
379 sta_info_hash_add(local, sta); 379 sta_info_hash_add(local, sta);
380 380
381 list_add(&sta->list, &local->sta_list); 381 list_add_rcu(&sta->list, &local->sta_list);
382 382
383 set_sta_flag(sta, WLAN_STA_INSERTED); 383 set_sta_flag(sta, WLAN_STA_INSERTED);
384 384
@@ -688,7 +688,7 @@ int __must_check __sta_info_destroy(struct sta_info *sta)
688 if (ret) 688 if (ret)
689 return ret; 689 return ret;
690 690
691 list_del(&sta->list); 691 list_del_rcu(&sta->list);
692 692
693 mutex_lock(&local->key_mtx); 693 mutex_lock(&local->key_mtx);
694 for (i = 0; i < NUM_DEFAULT_KEYS; i++) 694 for (i = 0; i < NUM_DEFAULT_KEYS; i++)
diff --git a/net/mac80211/sta_info.h b/net/mac80211/sta_info.h
index 3bb24a121c95..a470e1123a55 100644
--- a/net/mac80211/sta_info.h
+++ b/net/mac80211/sta_info.h
@@ -271,6 +271,9 @@ struct sta_ampdu_mlme {
271 * @plink_timer: peer link watch timer 271 * @plink_timer: peer link watch timer
272 * @plink_timer_was_running: used by suspend/resume to restore timers 272 * @plink_timer_was_running: used by suspend/resume to restore timers
273 * @t_offset: timing offset relative to this host 273 * @t_offset: timing offset relative to this host
274 * @t_offset_setpoint: reference timing offset of this sta to be used when
275 * calculating clockdrift
276 * @ch_type: peer's channel type
274 * @debugfs: debug filesystem info 277 * @debugfs: debug filesystem info
275 * @dead: set to true when sta is unlinked 278 * @dead: set to true when sta is unlinked
276 * @uploaded: set to true when sta is uploaded to the driver 279 * @uploaded: set to true when sta is uploaded to the driver
@@ -278,6 +281,8 @@ struct sta_ampdu_mlme {
278 * @sta: station information we share with the driver 281 * @sta: station information we share with the driver
279 * @sta_state: duplicates information about station state (for debug) 282 * @sta_state: duplicates information about station state (for debug)
280 * @beacon_loss_count: number of times beacon loss has triggered 283 * @beacon_loss_count: number of times beacon loss has triggered
284 * @supports_40mhz: tracks whether the station advertised 40 MHz support
285 * as we overwrite its HT parameters with the currently used value
281 */ 286 */
282struct sta_info { 287struct sta_info {
283 /* General information, mostly static */ 288 /* General information, mostly static */
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 847215bb2a6f..e453212fa17f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1737,7 +1737,7 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
1737 __le16 fc; 1737 __le16 fc;
1738 struct ieee80211_hdr hdr; 1738 struct ieee80211_hdr hdr;
1739 struct ieee80211s_hdr mesh_hdr __maybe_unused; 1739 struct ieee80211s_hdr mesh_hdr __maybe_unused;
1740 struct mesh_path __maybe_unused *mppath = NULL; 1740 struct mesh_path __maybe_unused *mppath = NULL, *mpath = NULL;
1741 const u8 *encaps_data; 1741 const u8 *encaps_data;
1742 int encaps_len, skip_header_bytes; 1742 int encaps_len, skip_header_bytes;
1743 int nh_pos, h_pos; 1743 int nh_pos, h_pos;
@@ -1803,8 +1803,11 @@ netdev_tx_t ieee80211_subif_start_xmit(struct sk_buff *skb,
1803 goto fail; 1803 goto fail;
1804 } 1804 }
1805 rcu_read_lock(); 1805 rcu_read_lock();
1806 if (!is_multicast_ether_addr(skb->data)) 1806 if (!is_multicast_ether_addr(skb->data)) {
1807 mppath = mpp_path_lookup(skb->data, sdata); 1807 mpath = mesh_path_lookup(skb->data, sdata);
1808 if (!mpath)
1809 mppath = mpp_path_lookup(skb->data, sdata);
1810 }
1808 1811
1809 /* 1812 /*
1810 * Use address extension if it is a packet from 1813 * Use address extension if it is a packet from
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index a44c6807df01..8dd4712620ff 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1271,7 +1271,7 @@ int ieee80211_reconfig(struct ieee80211_local *local)
1271 enum ieee80211_sta_state state; 1271 enum ieee80211_sta_state state;
1272 1272
1273 for (state = IEEE80211_STA_NOTEXIST; 1273 for (state = IEEE80211_STA_NOTEXIST;
1274 state < sta->sta_state - 1; state++) 1274 state < sta->sta_state; state++)
1275 WARN_ON(drv_sta_state(local, sta->sdata, sta, 1275 WARN_ON(drv_sta_state(local, sta->sdata, sta,
1276 state, state + 1)); 1276 state, state + 1));
1277 } 1277 }
diff --git a/net/mac802154/tx.c b/net/mac802154/tx.c
index 8781d8f904d9..434b6873b352 100644
--- a/net/mac802154/tx.c
+++ b/net/mac802154/tx.c
@@ -83,9 +83,10 @@ netdev_tx_t mac802154_tx(struct mac802154_priv *priv, struct sk_buff *skb,
83{ 83{
84 struct xmit_work *work; 84 struct xmit_work *work;
85 85
86 if (!(priv->phy->channels_supported[page] & (1 << chan))) 86 if (!(priv->phy->channels_supported[page] & (1 << chan))) {
87 WARN_ON(1); 87 WARN_ON(1);
88 return NETDEV_TX_OK; 88 return NETDEV_TX_OK;
89 }
89 90
90 if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) { 91 if (!(priv->hw.flags & IEEE802154_HW_OMIT_CKSUM)) {
91 u16 crc = crc_ccitt(0, skb->data, skb->len); 92 u16 crc = crc_ccitt(0, skb->data, skb->len);
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 46d69d7f1bb4..31f50bc3a312 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -270,9 +270,8 @@ static int expect_rtp_rtcp(struct sk_buff *skb, struct nf_conn *ct,
270 return 0; 270 return 0;
271 271
272 /* RTP port is even */ 272 /* RTP port is even */
273 port &= htons(~1); 273 rtp_port = port & ~htons(1);
274 rtp_port = port; 274 rtcp_port = port | htons(1);
275 rtcp_port = htons(ntohs(port) + 1);
276 275
277 /* Create expect for RTP */ 276 /* Create expect for RTP */
278 if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL) 277 if ((rtp_exp = nf_ct_expect_alloc(ct)) == NULL)
diff --git a/net/netfilter/xt_HMARK.c b/net/netfilter/xt_HMARK.c
index 0a96a43108ed..1686ca1b53a1 100644
--- a/net/netfilter/xt_HMARK.c
+++ b/net/netfilter/xt_HMARK.c
@@ -32,13 +32,13 @@ MODULE_ALIAS("ipt_HMARK");
32MODULE_ALIAS("ip6t_HMARK"); 32MODULE_ALIAS("ip6t_HMARK");
33 33
34struct hmark_tuple { 34struct hmark_tuple {
35 u32 src; 35 __be32 src;
36 u32 dst; 36 __be32 dst;
37 union hmark_ports uports; 37 union hmark_ports uports;
38 uint8_t proto; 38 u8 proto;
39}; 39};
40 40
41static inline u32 hmark_addr6_mask(const __u32 *addr32, const __u32 *mask) 41static inline __be32 hmark_addr6_mask(const __be32 *addr32, const __be32 *mask)
42{ 42{
43 return (addr32[0] & mask[0]) ^ 43 return (addr32[0] & mask[0]) ^
44 (addr32[1] & mask[1]) ^ 44 (addr32[1] & mask[1]) ^
@@ -46,8 +46,8 @@ static inline u32 hmark_addr6_mask(const __u32 *addr32, const __u32 *mask)
46 (addr32[3] & mask[3]); 46 (addr32[3] & mask[3]);
47} 47}
48 48
49static inline u32 49static inline __be32
50hmark_addr_mask(int l3num, const __u32 *addr32, const __u32 *mask) 50hmark_addr_mask(int l3num, const __be32 *addr32, const __be32 *mask)
51{ 51{
52 switch (l3num) { 52 switch (l3num) {
53 case AF_INET: 53 case AF_INET:
@@ -58,6 +58,22 @@ hmark_addr_mask(int l3num, const __u32 *addr32, const __u32 *mask)
58 return 0; 58 return 0;
59} 59}
60 60
61static inline void hmark_swap_ports(union hmark_ports *uports,
62 const struct xt_hmark_info *info)
63{
64 union hmark_ports hp;
65 u16 src, dst;
66
67 hp.b32 = (uports->b32 & info->port_mask.b32) | info->port_set.b32;
68 src = ntohs(hp.b16.src);
69 dst = ntohs(hp.b16.dst);
70
71 if (dst > src)
72 uports->v32 = (dst << 16) | src;
73 else
74 uports->v32 = (src << 16) | dst;
75}
76
61static int 77static int
62hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t, 78hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
63 const struct xt_hmark_info *info) 79 const struct xt_hmark_info *info)
@@ -74,22 +90,19 @@ hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
74 otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple; 90 otuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
75 rtuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple; 91 rtuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
76 92
77 t->src = hmark_addr_mask(otuple->src.l3num, otuple->src.u3.all, 93 t->src = hmark_addr_mask(otuple->src.l3num, otuple->src.u3.ip6,
78 info->src_mask.all); 94 info->src_mask.ip6);
79 t->dst = hmark_addr_mask(otuple->src.l3num, rtuple->src.u3.all, 95 t->dst = hmark_addr_mask(otuple->src.l3num, rtuple->src.u3.ip6,
80 info->dst_mask.all); 96 info->dst_mask.ip6);
81 97
82 if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3)) 98 if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
83 return 0; 99 return 0;
84 100
85 t->proto = nf_ct_protonum(ct); 101 t->proto = nf_ct_protonum(ct);
86 if (t->proto != IPPROTO_ICMP) { 102 if (t->proto != IPPROTO_ICMP) {
87 t->uports.p16.src = otuple->src.u.all; 103 t->uports.b16.src = otuple->src.u.all;
88 t->uports.p16.dst = rtuple->src.u.all; 104 t->uports.b16.dst = rtuple->src.u.all;
89 t->uports.v32 = (t->uports.v32 & info->port_mask.v32) | 105 hmark_swap_ports(&t->uports, info);
90 info->port_set.v32;
91 if (t->uports.p16.dst < t->uports.p16.src)
92 swap(t->uports.p16.dst, t->uports.p16.src);
93 } 106 }
94 107
95 return 0; 108 return 0;
@@ -98,15 +111,19 @@ hmark_ct_set_htuple(const struct sk_buff *skb, struct hmark_tuple *t,
98#endif 111#endif
99} 112}
100 113
114/* This hash function is endian independent, to ensure consistent hashing if
115 * the cluster is composed of big and little endian systems. */
101static inline u32 116static inline u32
102hmark_hash(struct hmark_tuple *t, const struct xt_hmark_info *info) 117hmark_hash(struct hmark_tuple *t, const struct xt_hmark_info *info)
103{ 118{
104 u32 hash; 119 u32 hash;
120 u32 src = ntohl(t->src);
121 u32 dst = ntohl(t->dst);
105 122
106 if (t->dst < t->src) 123 if (dst < src)
107 swap(t->src, t->dst); 124 swap(src, dst);
108 125
109 hash = jhash_3words(t->src, t->dst, t->uports.v32, info->hashrnd); 126 hash = jhash_3words(src, dst, t->uports.v32, info->hashrnd);
110 hash = hash ^ (t->proto & info->proto_mask); 127 hash = hash ^ (t->proto & info->proto_mask);
111 128
112 return (((u64)hash * info->hmodulus) >> 32) + info->hoffset; 129 return (((u64)hash * info->hmodulus) >> 32) + info->hoffset;
@@ -126,11 +143,7 @@ hmark_set_tuple_ports(const struct sk_buff *skb, unsigned int nhoff,
126 if (skb_copy_bits(skb, nhoff, &t->uports, sizeof(t->uports)) < 0) 143 if (skb_copy_bits(skb, nhoff, &t->uports, sizeof(t->uports)) < 0)
127 return; 144 return;
128 145
129 t->uports.v32 = (t->uports.v32 & info->port_mask.v32) | 146 hmark_swap_ports(&t->uports, info);
130 info->port_set.v32;
131
132 if (t->uports.p16.dst < t->uports.p16.src)
133 swap(t->uports.p16.dst, t->uports.p16.src);
134} 147}
135 148
136#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES) 149#if IS_ENABLED(CONFIG_IP6_NF_IPTABLES)
@@ -178,8 +191,8 @@ hmark_pkt_set_htuple_ipv6(const struct sk_buff *skb, struct hmark_tuple *t,
178 return -1; 191 return -1;
179 } 192 }
180noicmp: 193noicmp:
181 t->src = hmark_addr6_mask(ip6->saddr.s6_addr32, info->src_mask.all); 194 t->src = hmark_addr6_mask(ip6->saddr.s6_addr32, info->src_mask.ip6);
182 t->dst = hmark_addr6_mask(ip6->daddr.s6_addr32, info->dst_mask.all); 195 t->dst = hmark_addr6_mask(ip6->daddr.s6_addr32, info->dst_mask.ip6);
183 196
184 if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3)) 197 if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
185 return 0; 198 return 0;
@@ -255,11 +268,8 @@ hmark_pkt_set_htuple_ipv4(const struct sk_buff *skb, struct hmark_tuple *t,
255 } 268 }
256 } 269 }
257 270
258 t->src = (__force u32) ip->saddr; 271 t->src = ip->saddr & info->src_mask.ip;
259 t->dst = (__force u32) ip->daddr; 272 t->dst = ip->daddr & info->dst_mask.ip;
260
261 t->src &= info->src_mask.ip;
262 t->dst &= info->dst_mask.ip;
263 273
264 if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3)) 274 if (info->flags & XT_HMARK_FLAG(XT_HMARK_METHOD_L3))
265 return 0; 275 return 0;
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 3f339b19d140..17a707db40eb 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -292,6 +292,9 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
292 292
293 pr_debug("%p\n", sk); 293 pr_debug("%p\n", sk);
294 294
295 if (llcp_sock == NULL)
296 return -EBADFD;
297
295 addr->sa_family = AF_NFC; 298 addr->sa_family = AF_NFC;
296 *len = sizeof(struct sockaddr_nfc_llcp); 299 *len = sizeof(struct sockaddr_nfc_llcp);
297 300
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index 779ce4ff92ec..5a940dbd74a3 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -5,8 +5,8 @@
5 * 5 *
6 * Copyright (C) 2008 Nokia Corporation. 6 * Copyright (C) 2008 Nokia Corporation.
7 * 7 *
8 * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com> 8 * Authors: Sakari Ailus <sakari.ailus@nokia.com>
9 * Original author: Sakari Ailus <sakari.ailus@nokia.com> 9 * Rémi Denis-Courmont
10 * 10 *
11 * This program is free software; you can redistribute it and/or 11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License 12 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/datagram.c b/net/phonet/datagram.c
index bf35b4e1a14c..12c30f3e643e 100644
--- a/net/phonet/datagram.c
+++ b/net/phonet/datagram.c
@@ -5,8 +5,8 @@
5 * 5 *
6 * Copyright (C) 2008 Nokia Corporation. 6 * Copyright (C) 2008 Nokia Corporation.
7 * 7 *
8 * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com> 8 * Authors: Sakari Ailus <sakari.ailus@nokia.com>
9 * Original author: Sakari Ailus <sakari.ailus@nokia.com> 9 * Rémi Denis-Courmont
10 * 10 *
11 * This program is free software; you can redistribute it and/or 11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License 12 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pep-gprs.c b/net/phonet/pep-gprs.c
index d01208968c83..a2fba7edfd1f 100644
--- a/net/phonet/pep-gprs.c
+++ b/net/phonet/pep-gprs.c
@@ -5,7 +5,7 @@
5 * 5 *
6 * Copyright (C) 2008 Nokia Corporation. 6 * Copyright (C) 2008 Nokia Corporation.
7 * 7 *
8 * Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com> 8 * Author: Rémi Denis-Courmont
9 * 9 *
10 * This program is free software; you can redistribute it and/or 10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License 11 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 9dd4f926f7d1..576f22c9c76e 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -5,7 +5,7 @@
5 * 5 *
6 * Copyright (C) 2008 Nokia Corporation. 6 * Copyright (C) 2008 Nokia Corporation.
7 * 7 *
8 * Author: Rémi Denis-Courmont <remi.denis-courmont@nokia.com> 8 * Author: Rémi Denis-Courmont
9 * 9 *
10 * This program is free software; you can redistribute it and/or 10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License 11 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 36f75a9e2c3d..5bf6341e2dd4 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -5,8 +5,8 @@
5 * 5 *
6 * Copyright (C) 2008 Nokia Corporation. 6 * Copyright (C) 2008 Nokia Corporation.
7 * 7 *
8 * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com> 8 * Authors: Sakari Ailus <sakari.ailus@nokia.com>
9 * Original author: Sakari Ailus <sakari.ailus@nokia.com> 9 * Rémi Denis-Courmont
10 * 10 *
11 * This program is free software; you can redistribute it and/or 11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License 12 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index cfdf135fcd69..7dd762a464e5 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -5,8 +5,8 @@
5 * 5 *
6 * Copyright (C) 2008 Nokia Corporation. 6 * Copyright (C) 2008 Nokia Corporation.
7 * 7 *
8 * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com> 8 * Authors: Sakari Ailus <sakari.ailus@nokia.com>
9 * Original author: Sakari Ailus <sakari.ailus@nokia.com> 9 * Remi Denis-Courmont
10 * 10 *
11 * This program is free software; you can redistribute it and/or 11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License 12 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 89cfa9ce4939..0acc943f713a 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -5,8 +5,8 @@
5 * 5 *
6 * Copyright (C) 2008 Nokia Corporation. 6 * Copyright (C) 2008 Nokia Corporation.
7 * 7 *
8 * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com> 8 * Authors: Sakari Ailus <sakari.ailus@nokia.com>
9 * Original author: Sakari Ailus <sakari.ailus@nokia.com> 9 * Rémi Denis-Courmont
10 * 10 *
11 * This program is free software; you can redistribute it and/or 11 * This program is free software; you can redistribute it and/or
12 * modify it under the terms of the GNU General Public License 12 * modify it under the terms of the GNU General Public License
diff --git a/net/phonet/sysctl.c b/net/phonet/sysctl.c
index 696348fd31a1..d6bbbbd0af18 100644
--- a/net/phonet/sysctl.c
+++ b/net/phonet/sysctl.c
@@ -5,7 +5,7 @@
5 * 5 *
6 * Copyright (C) 2008 Nokia Corporation. 6 * Copyright (C) 2008 Nokia Corporation.
7 * 7 *
8 * Contact: Remi Denis-Courmont <remi.denis-courmont@nokia.com> 8 * Author: Rémi Denis-Courmont
9 * 9 *
10 * This program is free software; you can redistribute it and/or 10 * This program is free software; you can redistribute it and/or
11 * modify it under the terms of the GNU General Public License 11 * modify it under the terms of the GNU General Public License
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 5942d27b1444..9c90811d1134 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -673,7 +673,9 @@ void sctp_addr_wq_timeout_handler(unsigned long arg)
673 SCTP_DEBUG_PRINTK("sctp_addrwq_timo_handler: sctp_asconf_mgmt failed\n"); 673 SCTP_DEBUG_PRINTK("sctp_addrwq_timo_handler: sctp_asconf_mgmt failed\n");
674 sctp_bh_unlock_sock(sk); 674 sctp_bh_unlock_sock(sk);
675 } 675 }
676#if IS_ENABLED(CONFIG_IPV6)
676free_next: 677free_next:
678#endif
677 list_del(&addrw->list); 679 list_del(&addrw->list);
678 kfree(addrw); 680 kfree(addrw);
679 } 681 }
diff --git a/net/sunrpc/rpc_pipe.c b/net/sunrpc/rpc_pipe.c
index 04040476082e..21fde99e5c56 100644
--- a/net/sunrpc/rpc_pipe.c
+++ b/net/sunrpc/rpc_pipe.c
@@ -71,7 +71,9 @@ static void rpc_purge_list(wait_queue_head_t *waitq, struct list_head *head,
71 msg->errno = err; 71 msg->errno = err;
72 destroy_msg(msg); 72 destroy_msg(msg);
73 } while (!list_empty(head)); 73 } while (!list_empty(head));
74 wake_up(waitq); 74
75 if (waitq)
76 wake_up(waitq);
75} 77}
76 78
77static void 79static void
@@ -91,11 +93,9 @@ rpc_timeout_upcall_queue(struct work_struct *work)
91 } 93 }
92 dentry = dget(pipe->dentry); 94 dentry = dget(pipe->dentry);
93 spin_unlock(&pipe->lock); 95 spin_unlock(&pipe->lock);
94 if (dentry) { 96 rpc_purge_list(dentry ? &RPC_I(dentry->d_inode)->waitq : NULL,
95 rpc_purge_list(&RPC_I(dentry->d_inode)->waitq, 97 &free_list, destroy_msg, -ETIMEDOUT);
96 &free_list, destroy_msg, -ETIMEDOUT); 98 dput(dentry);
97 dput(dentry);
98 }
99} 99}
100 100
101ssize_t rpc_pipe_generic_upcall(struct file *filp, struct rpc_pipe_msg *msg, 101ssize_t rpc_pipe_generic_upcall(struct file *filp, struct rpc_pipe_msg *msg,
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 7e9baaa1e543..3ee7461926d8 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1374,7 +1374,8 @@ bc_svc_process(struct svc_serv *serv, struct rpc_rqst *req,
1374 sizeof(req->rq_snd_buf)); 1374 sizeof(req->rq_snd_buf));
1375 return bc_send(req); 1375 return bc_send(req);
1376 } else { 1376 } else {
1377 /* Nothing to do to drop request */ 1377 /* drop request */
1378 xprt_free_bc_request(req);
1378 return 0; 1379 return 0;
1379 } 1380 }
1380} 1381}
diff --git a/net/wireless/ibss.c b/net/wireless/ibss.c
index d2a19b0ff71f..89baa3328411 100644
--- a/net/wireless/ibss.c
+++ b/net/wireless/ibss.c
@@ -42,6 +42,7 @@ void __cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid)
42 cfg80211_hold_bss(bss_from_pub(bss)); 42 cfg80211_hold_bss(bss_from_pub(bss));
43 wdev->current_bss = bss_from_pub(bss); 43 wdev->current_bss = bss_from_pub(bss);
44 44
45 wdev->sme_state = CFG80211_SME_CONNECTED;
45 cfg80211_upload_connect_keys(wdev); 46 cfg80211_upload_connect_keys(wdev);
46 47
47 nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid, 48 nl80211_send_ibss_bssid(wiphy_to_dev(wdev->wiphy), dev, bssid,
@@ -60,7 +61,7 @@ void cfg80211_ibss_joined(struct net_device *dev, const u8 *bssid, gfp_t gfp)
60 struct cfg80211_event *ev; 61 struct cfg80211_event *ev;
61 unsigned long flags; 62 unsigned long flags;
62 63
63 CFG80211_DEV_WARN_ON(!wdev->ssid_len); 64 CFG80211_DEV_WARN_ON(wdev->sme_state != CFG80211_SME_CONNECTING);
64 65
65 ev = kzalloc(sizeof(*ev), gfp); 66 ev = kzalloc(sizeof(*ev), gfp);
66 if (!ev) 67 if (!ev)
@@ -115,9 +116,11 @@ int __cfg80211_join_ibss(struct cfg80211_registered_device *rdev,
115#ifdef CONFIG_CFG80211_WEXT 116#ifdef CONFIG_CFG80211_WEXT
116 wdev->wext.ibss.channel = params->channel; 117 wdev->wext.ibss.channel = params->channel;
117#endif 118#endif
119 wdev->sme_state = CFG80211_SME_CONNECTING;
118 err = rdev->ops->join_ibss(&rdev->wiphy, dev, params); 120 err = rdev->ops->join_ibss(&rdev->wiphy, dev, params);
119 if (err) { 121 if (err) {
120 wdev->connect_keys = NULL; 122 wdev->connect_keys = NULL;
123 wdev->sme_state = CFG80211_SME_IDLE;
121 return err; 124 return err;
122 } 125 }
123 126
@@ -169,6 +172,7 @@ static void __cfg80211_clear_ibss(struct net_device *dev, bool nowext)
169 } 172 }
170 173
171 wdev->current_bss = NULL; 174 wdev->current_bss = NULL;
175 wdev->sme_state = CFG80211_SME_IDLE;
172 wdev->ssid_len = 0; 176 wdev->ssid_len = 0;
173#ifdef CONFIG_CFG80211_WEXT 177#ifdef CONFIG_CFG80211_WEXT
174 if (!nowext) 178 if (!nowext)
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 15f347477a99..baf5704740ee 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1389,7 +1389,7 @@ static void reg_set_request_processed(void)
1389 spin_unlock(&reg_requests_lock); 1389 spin_unlock(&reg_requests_lock);
1390 1390
1391 if (last_request->initiator == NL80211_REGDOM_SET_BY_USER) 1391 if (last_request->initiator == NL80211_REGDOM_SET_BY_USER)
1392 cancel_delayed_work_sync(&reg_timeout); 1392 cancel_delayed_work(&reg_timeout);
1393 1393
1394 if (need_more_processing) 1394 if (need_more_processing)
1395 schedule_work(&reg_work); 1395 schedule_work(&reg_work);
diff --git a/net/wireless/util.c b/net/wireless/util.c
index 55d99466babb..316cfd00914f 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -804,7 +804,7 @@ int cfg80211_change_iface(struct cfg80211_registered_device *rdev,
804 ntype == NL80211_IFTYPE_P2P_CLIENT)) 804 ntype == NL80211_IFTYPE_P2P_CLIENT))
805 return -EBUSY; 805 return -EBUSY;
806 806
807 if (ntype != otype) { 807 if (ntype != otype && netif_running(dev)) {
808 err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr, 808 err = cfg80211_can_change_interface(rdev, dev->ieee80211_ptr,
809 ntype); 809 ntype);
810 if (err) 810 if (err)
@@ -935,6 +935,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
935 enum nl80211_iftype iftype) 935 enum nl80211_iftype iftype)
936{ 936{
937 struct wireless_dev *wdev_iter; 937 struct wireless_dev *wdev_iter;
938 u32 used_iftypes = BIT(iftype);
938 int num[NUM_NL80211_IFTYPES]; 939 int num[NUM_NL80211_IFTYPES];
939 int total = 1; 940 int total = 1;
940 int i, j; 941 int i, j;
@@ -961,6 +962,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
961 962
962 num[wdev_iter->iftype]++; 963 num[wdev_iter->iftype]++;
963 total++; 964 total++;
965 used_iftypes |= BIT(wdev_iter->iftype);
964 } 966 }
965 mutex_unlock(&rdev->devlist_mtx); 967 mutex_unlock(&rdev->devlist_mtx);
966 968
@@ -970,6 +972,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
970 for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) { 972 for (i = 0; i < rdev->wiphy.n_iface_combinations; i++) {
971 const struct ieee80211_iface_combination *c; 973 const struct ieee80211_iface_combination *c;
972 struct ieee80211_iface_limit *limits; 974 struct ieee80211_iface_limit *limits;
975 u32 all_iftypes = 0;
973 976
974 c = &rdev->wiphy.iface_combinations[i]; 977 c = &rdev->wiphy.iface_combinations[i];
975 978
@@ -984,6 +987,7 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
984 if (rdev->wiphy.software_iftypes & BIT(iftype)) 987 if (rdev->wiphy.software_iftypes & BIT(iftype))
985 continue; 988 continue;
986 for (j = 0; j < c->n_limits; j++) { 989 for (j = 0; j < c->n_limits; j++) {
990 all_iftypes |= limits[j].types;
987 if (!(limits[j].types & BIT(iftype))) 991 if (!(limits[j].types & BIT(iftype)))
988 continue; 992 continue;
989 if (limits[j].max < num[iftype]) 993 if (limits[j].max < num[iftype])
@@ -991,7 +995,20 @@ int cfg80211_can_change_interface(struct cfg80211_registered_device *rdev,
991 limits[j].max -= num[iftype]; 995 limits[j].max -= num[iftype];
992 } 996 }
993 } 997 }
994 /* yay, it fits */ 998
999 /*
1000 * Finally check that all iftypes that we're currently
1001 * using are actually part of this combination. If they
1002 * aren't then we can't use this combination and have
1003 * to continue to the next.
1004 */
1005 if ((all_iftypes & used_iftypes) != used_iftypes)
1006 goto cont;
1007
1008 /*
1009 * This combination covered all interface types and
1010 * supported the requested numbers, so we're good.
1011 */
995 kfree(limits); 1012 kfree(limits);
996 return 0; 1013 return 0;
997 cont: 1014 cont:
generated by cgit v1.2.2 (git 2.25.0) at 2025-03-07 02:10:14 -0500