aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/8021q/vlan_dev.c15
-rw-r--r--net/atm/lec.c29
-rw-r--r--net/ax25/ax25_uid.c2
-rw-r--r--net/bridge/br_netfilter.c5
-rw-r--r--net/core/skbuff.c4
-rw-r--r--net/core/sock.c2
-rw-r--r--net/dccp/dccp.h6
-rw-r--r--net/dccp/ipv4.c1
-rw-r--r--net/dccp/output.c1
-rw-r--r--net/dccp/proto.c3
-rw-r--r--net/ethernet/eth.c2
-rw-r--r--net/ieee80211/ieee80211_rx.c43
-rw-r--r--net/ipv4/icmp.c24
-rw-r--r--net/ipv4/ip_sockglue.c2
-rw-r--r--net/ipv4/netfilter/ipt_CLUSTERIP.c4
-rw-r--r--net/ipv4/netfilter/nf_nat_core.c2
-rw-r--r--net/ipv4/tcp_input.c65
-rw-r--r--net/ipv4/tcp_output.c3
-rw-r--r--net/ipv6/addrconf.c31
-rw-r--r--net/ipv6/anycast.c9
-rw-r--r--net/ipv6/icmp.c22
-rw-r--r--net/netfilter/xt_hashlimit.c23
-rw-r--r--net/sched/cls_u32.c12
-rw-r--r--net/sctp/ipv6.c5
-rw-r--r--net/sctp/outqueue.c3
-rw-r--r--net/sctp/protocol.c4
-rw-r--r--net/sctp/sm_make_chunk.c29
-rw-r--r--net/sctp/sm_sideeffect.c3
-rw-r--r--net/sctp/sm_statefuns.c23
-rw-r--r--net/sctp/socket.c5
-rw-r--r--net/sctp/ulpevent.c2
-rw-r--r--net/wireless/nl80211.c2
-rw-r--r--net/xfrm/xfrm_user.c2
33 files changed, 261 insertions, 127 deletions
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 0e3b2d3e2339..4ae0d7ef62c1 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -692,6 +692,20 @@ static int vlan_dev_init(struct net_device *dev)
692 return 0; 692 return 0;
693} 693}
694 694
695static void vlan_dev_uninit(struct net_device *dev)
696{
697 struct vlan_priority_tci_mapping *pm;
698 struct vlan_dev_info *vlan = vlan_dev_info(dev);
699 int i;
700
701 for (i = 0; i < ARRAY_SIZE(vlan->egress_priority_map); i++) {
702 while ((pm = vlan->egress_priority_map[i]) != NULL) {
703 vlan->egress_priority_map[i] = pm->next;
704 kfree(pm);
705 }
706 }
707}
708
695void vlan_setup(struct net_device *dev) 709void vlan_setup(struct net_device *dev)
696{ 710{
697 ether_setup(dev); 711 ether_setup(dev);
@@ -701,6 +715,7 @@ void vlan_setup(struct net_device *dev)
701 715
702 dev->change_mtu = vlan_dev_change_mtu; 716 dev->change_mtu = vlan_dev_change_mtu;
703 dev->init = vlan_dev_init; 717 dev->init = vlan_dev_init;
718 dev->uninit = vlan_dev_uninit;
704 dev->open = vlan_dev_open; 719 dev->open = vlan_dev_open;
705 dev->stop = vlan_dev_stop; 720 dev->stop = vlan_dev_stop;
706 dev->set_mac_address = vlan_dev_set_mac_address; 721 dev->set_mac_address = vlan_dev_set_mac_address;
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 9bd64bd706b9..653aca3573ac 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -266,7 +266,6 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
266 char buf[300]; 266 char buf[300];
267 int i = 0; 267 int i = 0;
268#endif /* DUMP_PACKETS >0 */ 268#endif /* DUMP_PACKETS >0 */
269 DECLARE_MAC_BUF(mac);
270 269
271 pr_debug("lec_start_xmit called\n"); 270 pr_debug("lec_start_xmit called\n");
272 if (!priv->lecd) { 271 if (!priv->lecd) {
@@ -374,15 +373,19 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
374 if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) { 373 if (entry && (entry->tx_wait.qlen < LEC_UNRES_QUE_LEN)) {
375 pr_debug("%s:lec_start_xmit: queuing packet, ", 374 pr_debug("%s:lec_start_xmit: queuing packet, ",
376 dev->name); 375 dev->name);
377 pr_debug("MAC address %s\n", 376 pr_debug("MAC address " MAC_FMT "\n",
378 print_mac(mac, lec_h->h_dest)); 377 lec_h->h_dest[0], lec_h->h_dest[1],
378 lec_h->h_dest[2], lec_h->h_dest[3],
379 lec_h->h_dest[4], lec_h->h_dest[5]);
379 skb_queue_tail(&entry->tx_wait, skb); 380 skb_queue_tail(&entry->tx_wait, skb);
380 } else { 381 } else {
381 pr_debug 382 pr_debug
382 ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ", 383 ("%s:lec_start_xmit: tx queue full or no arp entry, dropping, ",
383 dev->name); 384 dev->name);
384 pr_debug("MAC address %s\n", 385 pr_debug("MAC address " MAC_FMT "\n",
385 print_mac(mac, lec_h->h_dest)); 386 lec_h->h_dest[0], lec_h->h_dest[1],
387 lec_h->h_dest[2], lec_h->h_dest[3],
388 lec_h->h_dest[4], lec_h->h_dest[5]);
386 priv->stats.tx_dropped++; 389 priv->stats.tx_dropped++;
387 dev_kfree_skb(skb); 390 dev_kfree_skb(skb);
388 } 391 }
@@ -394,8 +397,10 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
394 397
395 while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) { 398 while (entry && (skb2 = skb_dequeue(&entry->tx_wait))) {
396 pr_debug("lec.c: emptying tx queue, "); 399 pr_debug("lec.c: emptying tx queue, ");
397 pr_debug("MAC address %s\n", 400 pr_debug("MAC address " MAC_FMT "\n",
398 print_mac(mac, lec_h->h_dest)); 401 lec_h->h_dest[0], lec_h->h_dest[1],
402 lec_h->h_dest[2], lec_h->h_dest[3],
403 lec_h->h_dest[4], lec_h->h_dest[5]);
399 lec_send(vcc, skb2, priv); 404 lec_send(vcc, skb2, priv);
400 } 405 }
401 406
@@ -449,7 +454,6 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
449 struct lec_arp_table *entry; 454 struct lec_arp_table *entry;
450 int i; 455 int i;
451 char *tmp; /* FIXME */ 456 char *tmp; /* FIXME */
452 DECLARE_MAC_BUF(mac);
453 457
454 atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc); 458 atomic_sub(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
455 mesg = (struct atmlec_msg *)skb->data; 459 mesg = (struct atmlec_msg *)skb->data;
@@ -536,9 +540,14 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
536 struct net_bridge_fdb_entry *f; 540 struct net_bridge_fdb_entry *f;
537 541
538 pr_debug 542 pr_debug
539 ("%s: bridge zeppelin asks about %s\n", 543 ("%s: bridge zeppelin asks about " MAC_FMT "\n",
540 dev->name, 544 dev->name,
541 print_mac(mac, mesg->content.proxy.mac_addr)); 545 mesg->content.proxy.mac_addr[0],
546 mesg->content.proxy.mac_addr[1],
547 mesg->content.proxy.mac_addr[2],
548 mesg->content.proxy.mac_addr[3],
549 mesg->content.proxy.mac_addr[4],
550 mesg->content.proxy.mac_addr[5]);
542 551
543 if (br_fdb_get_hook == NULL || dev->br_port == NULL) 552 if (br_fdb_get_hook == NULL || dev->br_port == NULL)
544 break; 553 break;
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 5f4eb73fb9d3..57aeba729bae 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -218,9 +218,11 @@ void __exit ax25_uid_free(void)
218 struct hlist_node *node; 218 struct hlist_node *node;
219 219
220 write_lock(&ax25_uid_lock); 220 write_lock(&ax25_uid_lock);
221again:
221 ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) { 222 ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
222 hlist_del_init(&ax25_uid->uid_node); 223 hlist_del_init(&ax25_uid->uid_node);
223 ax25_uid_put(ax25_uid); 224 ax25_uid_put(ax25_uid);
225 goto again;
224 } 226 }
225 write_unlock(&ax25_uid_lock); 227 write_unlock(&ax25_uid_lock);
226} 228}
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 0278a069c6f1..bb90cd7bace3 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -110,7 +110,10 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
110 * ipt_REJECT needs it. Future netfilter modules might 110 * ipt_REJECT needs it. Future netfilter modules might
111 * require us to fill additional fields. */ 111 * require us to fill additional fields. */
112static struct net_device __fake_net_device = { 112static struct net_device __fake_net_device = {
113 .hard_header_len = ETH_HLEN 113 .hard_header_len = ETH_HLEN,
114#ifdef CONFIG_NET_NS
115 .nd_net = &init_net,
116#endif
114}; 117};
115 118
116static struct rtable __fake_rtable = { 119static struct rtable __fake_rtable = {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 4cd12d99b12e..4fe605fa6f8a 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2225,8 +2225,8 @@ EXPORT_SYMBOL_GPL(skb_pull_rcsum);
2225 * @features: features for the output path (see dev->features) 2225 * @features: features for the output path (see dev->features)
2226 * 2226 *
2227 * This function performs segmentation on the given skb. It returns 2227 * This function performs segmentation on the given skb. It returns
2228 * the segment at the given position. It returns NULL if there are 2228 * a pointer to the first in a list of new skbs for the segments.
2229 * no more segments to generate, or when an error is encountered. 2229 * In case of error it returns ERR_PTR(err).
2230 */ 2230 */
2231struct sk_buff *skb_segment(struct sk_buff *skb, int features) 2231struct sk_buff *skb_segment(struct sk_buff *skb, int features)
2232{ 2232{
diff --git a/net/core/sock.c b/net/core/sock.c
index f2ccb1620dc4..c0ecbdcf75d8 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1746,7 +1746,7 @@ void sock_init_data(struct socket *sock, struct sock *sk)
1746 sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT; 1746 sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
1747 sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT; 1747 sk->sk_sndtimeo = MAX_SCHEDULE_TIMEOUT;
1748 1748
1749 sk->sk_stamp = ktime_set(-1L, -1L); 1749 sk->sk_stamp = ktime_set(-1L, 0);
1750 1750
1751 atomic_set(&sk->sk_refcnt, 1); 1751 atomic_set(&sk->sk_refcnt, 1);
1752 atomic_set(&sk->sk_drops, 0); 1752 atomic_set(&sk->sk_drops, 0);
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index fe7726b0018f..f44d492d3b74 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -325,6 +325,12 @@ static inline int dccp_bad_service_code(const struct sock *sk,
325 * This is used for transmission as well as for reception. 325 * This is used for transmission as well as for reception.
326 */ 326 */
327struct dccp_skb_cb { 327struct dccp_skb_cb {
328 union {
329 struct inet_skb_parm h4;
330#if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
331 struct inet6_skb_parm h6;
332#endif
333 } header;
328 __u8 dccpd_type:4; 334 __u8 dccpd_type:4;
329 __u8 dccpd_ccval:4; 335 __u8 dccpd_ccval:4;
330 __u8 dccpd_reset_code, 336 __u8 dccpd_reset_code,
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index b9974669edb4..baa268d02e24 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -488,7 +488,6 @@ static int dccp_v4_send_response(struct sock *sk, struct request_sock *req)
488 488
489 dh->dccph_checksum = dccp_v4_csum_finish(skb, ireq->loc_addr, 489 dh->dccph_checksum = dccp_v4_csum_finish(skb, ireq->loc_addr,
490 ireq->rmt_addr); 490 ireq->rmt_addr);
491 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
492 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr, 491 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
493 ireq->rmt_addr, 492 ireq->rmt_addr,
494 ireq->opt); 493 ireq->opt);
diff --git a/net/dccp/output.c b/net/dccp/output.c
index f32a84ef757b..1f8a9b64c083 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -126,7 +126,6 @@ static int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
126 126
127 DCCP_INC_STATS(DCCP_MIB_OUTSEGS); 127 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
128 128
129 memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
130 err = icsk->icsk_af_ops->queue_xmit(skb, 0); 129 err = icsk->icsk_af_ops->queue_xmit(skb, 0);
131 return net_xmit_eval(err); 130 return net_xmit_eval(err);
132 } 131 }
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index d534cdf9603b..a4c1b36f4bc7 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -1038,6 +1038,9 @@ static int __init dccp_init(void)
1038 int ehash_order, bhash_order, i; 1038 int ehash_order, bhash_order, i;
1039 int rc = -ENOBUFS; 1039 int rc = -ENOBUFS;
1040 1040
1041 BUILD_BUG_ON(sizeof(struct dccp_skb_cb) >
1042 FIELD_SIZEOF(struct sk_buff, cb));
1043
1041 dccp_hashinfo.bind_bucket_cachep = 1044 dccp_hashinfo.bind_bucket_cachep =
1042 kmem_cache_create("dccp_bind_bucket", 1045 kmem_cache_create("dccp_bind_bucket",
1043 sizeof(struct inet_bind_bucket), 0, 1046 sizeof(struct inet_bind_bucket), 0,
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index a7b417523e9b..a80839b02e3f 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -301,7 +301,7 @@ static int eth_change_mtu(struct net_device *dev, int new_mtu)
301static int eth_validate_addr(struct net_device *dev) 301static int eth_validate_addr(struct net_device *dev)
302{ 302{
303 if (!is_valid_ether_addr(dev->dev_addr)) 303 if (!is_valid_ether_addr(dev->dev_addr))
304 return -EINVAL; 304 return -EADDRNOTAVAIL;
305 305
306 return 0; 306 return 0;
307} 307}
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 1e3f87c8c012..200ee1e63728 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -271,7 +271,6 @@ ieee80211_rx_frame_decrypt(struct ieee80211_device *ieee, struct sk_buff *skb,
271{ 271{
272 struct ieee80211_hdr_3addr *hdr; 272 struct ieee80211_hdr_3addr *hdr;
273 int res, hdrlen; 273 int res, hdrlen;
274 DECLARE_MAC_BUF(mac);
275 274
276 if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL) 275 if (crypt == NULL || crypt->ops->decrypt_mpdu == NULL)
277 return 0; 276 return 0;
@@ -283,8 +282,12 @@ ieee80211_rx_frame_decrypt(struct ieee80211_device *ieee, struct sk_buff *skb,
283 res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv); 282 res = crypt->ops->decrypt_mpdu(skb, hdrlen, crypt->priv);
284 atomic_dec(&crypt->refcnt); 283 atomic_dec(&crypt->refcnt);
285 if (res < 0) { 284 if (res < 0) {
286 IEEE80211_DEBUG_DROP("decryption failed (SA=%s" 285 IEEE80211_DEBUG_DROP("decryption failed (SA=" MAC_FMT
287 ") res=%d\n", print_mac(mac, hdr->addr2), res); 286 ") res=%d\n",
287 hdr->addr2[0], hdr->addr2[1],
288 hdr->addr2[2], hdr->addr2[3],
289 hdr->addr2[4], hdr->addr2[5],
290 res);
288 if (res == -2) 291 if (res == -2)
289 IEEE80211_DEBUG_DROP("Decryption failed ICV " 292 IEEE80211_DEBUG_DROP("Decryption failed ICV "
290 "mismatch (key %d)\n", 293 "mismatch (key %d)\n",
@@ -304,7 +307,6 @@ ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device *ieee,
304{ 307{
305 struct ieee80211_hdr_3addr *hdr; 308 struct ieee80211_hdr_3addr *hdr;
306 int res, hdrlen; 309 int res, hdrlen;
307 DECLARE_MAC_BUF(mac);
308 310
309 if (crypt == NULL || crypt->ops->decrypt_msdu == NULL) 311 if (crypt == NULL || crypt->ops->decrypt_msdu == NULL)
310 return 0; 312 return 0;
@@ -317,8 +319,12 @@ ieee80211_rx_frame_decrypt_msdu(struct ieee80211_device *ieee,
317 atomic_dec(&crypt->refcnt); 319 atomic_dec(&crypt->refcnt);
318 if (res < 0) { 320 if (res < 0) {
319 printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed" 321 printk(KERN_DEBUG "%s: MSDU decryption/MIC verification failed"
320 " (SA=%s keyidx=%d)\n", 322 " (SA=" MAC_FMT " keyidx=%d)\n",
321 ieee->dev->name, print_mac(mac, hdr->addr2), keyidx); 323 ieee->dev->name,
324 hdr->addr2[0], hdr->addr2[1],
325 hdr->addr2[2], hdr->addr2[3],
326 hdr->addr2[4], hdr->addr2[5],
327 keyidx);
322 return -1; 328 return -1;
323 } 329 }
324 330
@@ -462,8 +468,10 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
462 * frames silently instead of filling system log with 468 * frames silently instead of filling system log with
463 * these reports. */ 469 * these reports. */
464 IEEE80211_DEBUG_DROP("Decryption failed (not set)" 470 IEEE80211_DEBUG_DROP("Decryption failed (not set)"
465 " (SA=%s)\n", 471 " (SA=" MAC_FMT ")\n",
466 print_mac(mac, hdr->addr2)); 472 hdr->addr2[0], hdr->addr2[1],
473 hdr->addr2[2], hdr->addr2[3],
474 hdr->addr2[4], hdr->addr2[5]);
467 ieee->ieee_stats.rx_discards_undecryptable++; 475 ieee->ieee_stats.rx_discards_undecryptable++;
468 goto rx_dropped; 476 goto rx_dropped;
469 } 477 }
@@ -474,8 +482,10 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
474 fc & IEEE80211_FCTL_PROTECTED && ieee->host_decrypt && 482 fc & IEEE80211_FCTL_PROTECTED && ieee->host_decrypt &&
475 (keyidx = hostap_rx_frame_decrypt(ieee, skb, crypt)) < 0) { 483 (keyidx = hostap_rx_frame_decrypt(ieee, skb, crypt)) < 0) {
476 printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth " 484 printk(KERN_DEBUG "%s: failed to decrypt mgmt::auth "
477 "from %s\n", dev->name, 485 "from " MAC_FMT "\n", dev->name,
478 print_mac(mac, hdr->addr2)); 486 hdr->addr2[0], hdr->addr2[1],
487 hdr->addr2[2], hdr->addr2[3],
488 hdr->addr2[4], hdr->addr2[5]);
479 /* TODO: could inform hostapd about this so that it 489 /* TODO: could inform hostapd about this so that it
480 * could send auth failure report */ 490 * could send auth failure report */
481 goto rx_dropped; 491 goto rx_dropped;
@@ -653,8 +663,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
653 * configured */ 663 * configured */
654 } else { 664 } else {
655 IEEE80211_DEBUG_DROP("encryption configured, but RX " 665 IEEE80211_DEBUG_DROP("encryption configured, but RX "
656 "frame not encrypted (SA=%s" 666 "frame not encrypted (SA="
657 ")\n", print_mac(mac, hdr->addr2)); 667 MAC_FMT ")\n",
668 hdr->addr2[0], hdr->addr2[1],
669 hdr->addr2[2], hdr->addr2[3],
670 hdr->addr2[4], hdr->addr2[5]);
658 goto rx_dropped; 671 goto rx_dropped;
659 } 672 }
660 } 673 }
@@ -662,9 +675,11 @@ int ieee80211_rx(struct ieee80211_device *ieee, struct sk_buff *skb,
662 if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !ieee->open_wep && 675 if (crypt && !(fc & IEEE80211_FCTL_PROTECTED) && !ieee->open_wep &&
663 !ieee80211_is_eapol_frame(ieee, skb)) { 676 !ieee80211_is_eapol_frame(ieee, skb)) {
664 IEEE80211_DEBUG_DROP("dropped unencrypted RX data " 677 IEEE80211_DEBUG_DROP("dropped unencrypted RX data "
665 "frame from %s" 678 "frame from " MAC_FMT
666 " (drop_unencrypted=1)\n", 679 " (drop_unencrypted=1)\n",
667 print_mac(mac, hdr->addr2)); 680 hdr->addr2[0], hdr->addr2[1],
681 hdr->addr2[2], hdr->addr2[3],
682 hdr->addr2[4], hdr->addr2[5]);
668 goto rx_dropped; 683 goto rx_dropped;
669 } 684 }
670 685
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index efc7cbe759c9..3e14d9cd29b3 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -578,7 +578,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
578 } 578 }
579 579
580 if (xfrm_decode_session_reverse(skb_in, &fl, AF_INET)) 580 if (xfrm_decode_session_reverse(skb_in, &fl, AF_INET))
581 goto ende; 581 goto relookup_failed;
582 582
583 if (inet_addr_type(net, fl.fl4_src) == RTN_LOCAL) 583 if (inet_addr_type(net, fl.fl4_src) == RTN_LOCAL)
584 err = __ip_route_output_key(net, &rt2, &fl); 584 err = __ip_route_output_key(net, &rt2, &fl);
@@ -588,7 +588,7 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
588 588
589 fl2.fl4_dst = fl.fl4_src; 589 fl2.fl4_dst = fl.fl4_src;
590 if (ip_route_output_key(net, &rt2, &fl2)) 590 if (ip_route_output_key(net, &rt2, &fl2))
591 goto ende; 591 goto relookup_failed;
592 592
593 /* Ugh! */ 593 /* Ugh! */
594 odst = skb_in->dst; 594 odst = skb_in->dst;
@@ -601,21 +601,23 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
601 } 601 }
602 602
603 if (err) 603 if (err)
604 goto ende; 604 goto relookup_failed;
605 605
606 err = xfrm_lookup((struct dst_entry **)&rt2, &fl, NULL, 606 err = xfrm_lookup((struct dst_entry **)&rt2, &fl, NULL,
607 XFRM_LOOKUP_ICMP); 607 XFRM_LOOKUP_ICMP);
608 if (err == -ENOENT) { 608 switch (err) {
609 case 0:
610 dst_release(&rt->u.dst);
611 rt = rt2;
612 break;
613 case -EPERM:
614 goto ende;
615 default:
616relookup_failed:
609 if (!rt) 617 if (!rt)
610 goto out_unlock; 618 goto out_unlock;
611 goto route_done; 619 break;
612 } 620 }
613
614 dst_release(&rt->u.dst);
615 rt = rt2;
616
617 if (err)
618 goto out_unlock;
619 } 621 }
620 622
621route_done: 623route_done:
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index d6e76f5229cc..d8adfd4972e2 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -1133,7 +1133,7 @@ static int do_ip_getsockopt(struct sock *sk, int level, int optname,
1133 } 1133 }
1134 release_sock(sk); 1134 release_sock(sk);
1135 1135
1136 if (len < sizeof(int) && len > 0 && val>=0 && val<255) { 1136 if (len < sizeof(int) && len > 0 && val>=0 && val<=255) {
1137 unsigned char ucval = (unsigned char)val; 1137 unsigned char ucval = (unsigned char)val;
1138 len = 1; 1138 len = 1;
1139 if (put_user(len, optlen)) 1139 if (put_user(len, optlen))
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 965b08a7d738..380d8daac72b 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -82,8 +82,8 @@ clusterip_config_put(struct clusterip_config *c)
82static inline void 82static inline void
83clusterip_config_entry_put(struct clusterip_config *c) 83clusterip_config_entry_put(struct clusterip_config *c)
84{ 84{
85 write_lock_bh(&clusterip_lock);
85 if (atomic_dec_and_test(&c->entries)) { 86 if (atomic_dec_and_test(&c->entries)) {
86 write_lock_bh(&clusterip_lock);
87 list_del(&c->list); 87 list_del(&c->list);
88 write_unlock_bh(&clusterip_lock); 88 write_unlock_bh(&clusterip_lock);
89 89
@@ -96,7 +96,9 @@ clusterip_config_entry_put(struct clusterip_config *c)
96#ifdef CONFIG_PROC_FS 96#ifdef CONFIG_PROC_FS
97 remove_proc_entry(c->pde->name, c->pde->parent); 97 remove_proc_entry(c->pde->name, c->pde->parent);
98#endif 98#endif
99 return;
99 } 100 }
101 write_unlock_bh(&clusterip_lock);
100} 102}
101 103
102static struct clusterip_config * 104static struct clusterip_config *
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 0d5fa3a54d04..36b4e3bb056f 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -629,6 +629,8 @@ static int __init nf_nat_init(void)
629 size_t i; 629 size_t i;
630 int ret; 630 int ret;
631 631
632 need_ipv4_conntrack();
633
632 ret = nf_ct_extend_register(&nat_extend); 634 ret = nf_ct_extend_register(&nat_extend);
633 if (ret < 0) { 635 if (ret < 0) {
634 printk(KERN_ERR "nf_nat_core: Unable to register extension\n"); 636 printk(KERN_ERR "nf_nat_core: Unable to register extension\n");
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 743611956045..bd0ee8ca8b21 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1625,13 +1625,11 @@ out:
1625 return flag; 1625 return flag;
1626} 1626}
1627 1627
1628/* If we receive more dupacks than we expected counting segments 1628/* Limits sacked_out so that sum with lost_out isn't ever larger than
1629 * in assumption of absent reordering, interpret this as reordering. 1629 * packets_out. Returns zero if sacked_out adjustement wasn't necessary.
1630 * The only another reason could be bug in receiver TCP.
1631 */ 1630 */
1632static void tcp_check_reno_reordering(struct sock *sk, const int addend) 1631int tcp_limit_reno_sacked(struct tcp_sock *tp)
1633{ 1632{
1634 struct tcp_sock *tp = tcp_sk(sk);
1635 u32 holes; 1633 u32 holes;
1636 1634
1637 holes = max(tp->lost_out, 1U); 1635 holes = max(tp->lost_out, 1U);
@@ -1639,8 +1637,20 @@ static void tcp_check_reno_reordering(struct sock *sk, const int addend)
1639 1637
1640 if ((tp->sacked_out + holes) > tp->packets_out) { 1638 if ((tp->sacked_out + holes) > tp->packets_out) {
1641 tp->sacked_out = tp->packets_out - holes; 1639 tp->sacked_out = tp->packets_out - holes;
1642 tcp_update_reordering(sk, tp->packets_out + addend, 0); 1640 return 1;
1643 } 1641 }
1642 return 0;
1643}
1644
1645/* If we receive more dupacks than we expected counting segments
1646 * in assumption of absent reordering, interpret this as reordering.
1647 * The only another reason could be bug in receiver TCP.
1648 */
1649static void tcp_check_reno_reordering(struct sock *sk, const int addend)
1650{
1651 struct tcp_sock *tp = tcp_sk(sk);
1652 if (tcp_limit_reno_sacked(tp))
1653 tcp_update_reordering(sk, tp->packets_out + addend, 0);
1644} 1654}
1645 1655
1646/* Emulate SACKs for SACKless connection: account for a new dupack. */ 1656/* Emulate SACKs for SACKless connection: account for a new dupack. */
@@ -1681,11 +1691,16 @@ static inline void tcp_reset_reno_sack(struct tcp_sock *tp)
1681int tcp_use_frto(struct sock *sk) 1691int tcp_use_frto(struct sock *sk)
1682{ 1692{
1683 const struct tcp_sock *tp = tcp_sk(sk); 1693 const struct tcp_sock *tp = tcp_sk(sk);
1694 const struct inet_connection_sock *icsk = inet_csk(sk);
1684 struct sk_buff *skb; 1695 struct sk_buff *skb;
1685 1696
1686 if (!sysctl_tcp_frto) 1697 if (!sysctl_tcp_frto)
1687 return 0; 1698 return 0;
1688 1699
1700 /* MTU probe and F-RTO won't really play nicely along currently */
1701 if (icsk->icsk_mtup.probe_size)
1702 return 0;
1703
1689 if (IsSackFrto()) 1704 if (IsSackFrto())
1690 return 1; 1705 return 1;
1691 1706
@@ -2134,11 +2149,13 @@ static void tcp_verify_retransmit_hint(struct tcp_sock *tp, struct sk_buff *skb)
2134/* Mark head of queue up as lost. With RFC3517 SACK, the packets is 2149/* Mark head of queue up as lost. With RFC3517 SACK, the packets is
2135 * is against sacked "cnt", otherwise it's against facked "cnt" 2150 * is against sacked "cnt", otherwise it's against facked "cnt"
2136 */ 2151 */
2137static void tcp_mark_head_lost(struct sock *sk, int packets, int fast_rexmit) 2152static void tcp_mark_head_lost(struct sock *sk, int packets)
2138{ 2153{
2139 struct tcp_sock *tp = tcp_sk(sk); 2154 struct tcp_sock *tp = tcp_sk(sk);
2140 struct sk_buff *skb; 2155 struct sk_buff *skb;
2141 int cnt; 2156 int cnt, oldcnt;
2157 int err;
2158 unsigned int mss;
2142 2159
2143 BUG_TRAP(packets <= tp->packets_out); 2160 BUG_TRAP(packets <= tp->packets_out);
2144 if (tp->lost_skb_hint) { 2161 if (tp->lost_skb_hint) {
@@ -2157,13 +2174,25 @@ static void tcp_mark_head_lost(struct sock *sk, int packets, int fast_rexmit)
2157 tp->lost_skb_hint = skb; 2174 tp->lost_skb_hint = skb;
2158 tp->lost_cnt_hint = cnt; 2175 tp->lost_cnt_hint = cnt;
2159 2176
2177 if (after(TCP_SKB_CB(skb)->end_seq, tp->high_seq))
2178 break;
2179
2180 oldcnt = cnt;
2160 if (tcp_is_fack(tp) || tcp_is_reno(tp) || 2181 if (tcp_is_fack(tp) || tcp_is_reno(tp) ||
2161 (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED)) 2182 (TCP_SKB_CB(skb)->sacked & TCPCB_SACKED_ACKED))
2162 cnt += tcp_skb_pcount(skb); 2183 cnt += tcp_skb_pcount(skb);
2163 2184
2164 if (((!fast_rexmit || (tp->lost_out > 0)) && (cnt > packets)) || 2185 if (cnt > packets) {
2165 after(TCP_SKB_CB(skb)->end_seq, tp->high_seq)) 2186 if (tcp_is_sack(tp) || (oldcnt >= packets))
2166 break; 2187 break;
2188
2189 mss = skb_shinfo(skb)->gso_size;
2190 err = tcp_fragment(sk, skb, (packets - oldcnt) * mss, mss);
2191 if (err < 0)
2192 break;
2193 cnt = packets;
2194 }
2195
2167 if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_SACKED_ACKED|TCPCB_LOST))) { 2196 if (!(TCP_SKB_CB(skb)->sacked & (TCPCB_SACKED_ACKED|TCPCB_LOST))) {
2168 TCP_SKB_CB(skb)->sacked |= TCPCB_LOST; 2197 TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
2169 tp->lost_out += tcp_skb_pcount(skb); 2198 tp->lost_out += tcp_skb_pcount(skb);
@@ -2180,17 +2209,17 @@ static void tcp_update_scoreboard(struct sock *sk, int fast_rexmit)
2180 struct tcp_sock *tp = tcp_sk(sk); 2209 struct tcp_sock *tp = tcp_sk(sk);
2181 2210
2182 if (tcp_is_reno(tp)) { 2211 if (tcp_is_reno(tp)) {
2183 tcp_mark_head_lost(sk, 1, fast_rexmit); 2212 tcp_mark_head_lost(sk, 1);
2184 } else if (tcp_is_fack(tp)) { 2213 } else if (tcp_is_fack(tp)) {
2185 int lost = tp->fackets_out - tp->reordering; 2214 int lost = tp->fackets_out - tp->reordering;
2186 if (lost <= 0) 2215 if (lost <= 0)
2187 lost = 1; 2216 lost = 1;
2188 tcp_mark_head_lost(sk, lost, fast_rexmit); 2217 tcp_mark_head_lost(sk, lost);
2189 } else { 2218 } else {
2190 int sacked_upto = tp->sacked_out - tp->reordering; 2219 int sacked_upto = tp->sacked_out - tp->reordering;
2191 if (sacked_upto < 0) 2220 if (sacked_upto < fast_rexmit)
2192 sacked_upto = 0; 2221 sacked_upto = fast_rexmit;
2193 tcp_mark_head_lost(sk, sacked_upto, fast_rexmit); 2222 tcp_mark_head_lost(sk, sacked_upto);
2194 } 2223 }
2195 2224
2196 /* New heuristics: it is possible only after we switched 2225 /* New heuristics: it is possible only after we switched
@@ -2524,7 +2553,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
2524 before(tp->snd_una, tp->high_seq) && 2553 before(tp->snd_una, tp->high_seq) &&
2525 icsk->icsk_ca_state != TCP_CA_Open && 2554 icsk->icsk_ca_state != TCP_CA_Open &&
2526 tp->fackets_out > tp->reordering) { 2555 tp->fackets_out > tp->reordering) {
2527 tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering, 0); 2556 tcp_mark_head_lost(sk, tp->fackets_out - tp->reordering);
2528 NET_INC_STATS_BH(LINUX_MIB_TCPLOSS); 2557 NET_INC_STATS_BH(LINUX_MIB_TCPLOSS);
2529 } 2558 }
2530 2559
@@ -2586,6 +2615,8 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
2586 case TCP_CA_Loss: 2615 case TCP_CA_Loss:
2587 if (flag & FLAG_DATA_ACKED) 2616 if (flag & FLAG_DATA_ACKED)
2588 icsk->icsk_retransmits = 0; 2617 icsk->icsk_retransmits = 0;
2618 if (tcp_is_reno(tp) && flag & FLAG_SND_UNA_ADVANCED)
2619 tcp_reset_reno_sack(tp);
2589 if (!tcp_try_undo_loss(sk)) { 2620 if (!tcp_try_undo_loss(sk)) {
2590 tcp_moderate_cwnd(tp); 2621 tcp_moderate_cwnd(tp);
2591 tcp_xmit_retransmit_queue(sk); 2622 tcp_xmit_retransmit_queue(sk);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 76b3653e9b4c..90270cbdf42c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1808,6 +1808,9 @@ void tcp_simple_retransmit(struct sock *sk)
1808 if (!lost) 1808 if (!lost)
1809 return; 1809 return;
1810 1810
1811 if (tcp_is_reno(tp))
1812 tcp_limit_reno_sacked(tp);
1813
1811 tcp_verify_left_out(tp); 1814 tcp_verify_left_out(tp);
1812 1815
1813 /* Don't muck with the congestion window here. 1816 /* Don't muck with the congestion window here.
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9d49ed2578d7..8a0fd4007bdb 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -372,25 +372,26 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
372 */ 372 */
373 in6_dev_hold(ndev); 373 in6_dev_hold(ndev);
374 374
375#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
376 if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
377 printk(KERN_INFO
378 "%s: Disabled Multicast RS\n",
379 dev->name);
380 ndev->cnf.rtr_solicits = 0;
381 }
382#endif
383
375#ifdef CONFIG_IPV6_PRIVACY 384#ifdef CONFIG_IPV6_PRIVACY
376 setup_timer(&ndev->regen_timer, ipv6_regen_rndid, (unsigned long)ndev); 385 setup_timer(&ndev->regen_timer, ipv6_regen_rndid, (unsigned long)ndev);
377 if ((dev->flags&IFF_LOOPBACK) || 386 if ((dev->flags&IFF_LOOPBACK) ||
378 dev->type == ARPHRD_TUNNEL || 387 dev->type == ARPHRD_TUNNEL ||
379#if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE) 388 dev->type == ARPHRD_TUNNEL6 ||
380 dev->type == ARPHRD_SIT || 389 dev->type == ARPHRD_SIT ||
381#endif
382 dev->type == ARPHRD_NONE) { 390 dev->type == ARPHRD_NONE) {
383 printk(KERN_INFO 391 printk(KERN_INFO
384 "%s: Disabled Privacy Extensions\n", 392 "%s: Disabled Privacy Extensions\n",
385 dev->name); 393 dev->name);
386 ndev->cnf.use_tempaddr = -1; 394 ndev->cnf.use_tempaddr = -1;
387
388 if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
389 printk(KERN_INFO
390 "%s: Disabled Multicast RS\n",
391 dev->name);
392 ndev->cnf.rtr_solicits = 0;
393 }
394 } else { 395 } else {
395 in6_dev_hold(ndev); 396 in6_dev_hold(ndev);
396 ipv6_regen_rndid((unsigned long) ndev); 397 ipv6_regen_rndid((unsigned long) ndev);
@@ -2529,7 +2530,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
2529 2530
2530 ASSERT_RTNL(); 2531 ASSERT_RTNL();
2531 2532
2532 if (dev == init_net.loopback_dev && how == 1) 2533 if ((dev->flags & IFF_LOOPBACK) && how == 1)
2533 how = 0; 2534 how = 0;
2534 2535
2535 rt6_ifdown(net, dev); 2536 rt6_ifdown(net, dev);
@@ -2542,7 +2543,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
2542 /* Step 1: remove reference to ipv6 device from parent device. 2543 /* Step 1: remove reference to ipv6 device from parent device.
2543 Do not dev_put! 2544 Do not dev_put!
2544 */ 2545 */
2545 if (how == 1) { 2546 if (how) {
2546 idev->dead = 1; 2547 idev->dead = 1;
2547 2548
2548 /* protected by rtnl_lock */ 2549 /* protected by rtnl_lock */
@@ -2574,12 +2575,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
2574 write_lock_bh(&idev->lock); 2575 write_lock_bh(&idev->lock);
2575 2576
2576 /* Step 3: clear flags for stateless addrconf */ 2577 /* Step 3: clear flags for stateless addrconf */
2577 if (how != 1) 2578 if (!how)
2578 idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY); 2579 idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
2579 2580
2580 /* Step 4: clear address list */ 2581 /* Step 4: clear address list */
2581#ifdef CONFIG_IPV6_PRIVACY 2582#ifdef CONFIG_IPV6_PRIVACY
2582 if (how == 1 && del_timer(&idev->regen_timer)) 2583 if (how && del_timer(&idev->regen_timer))
2583 in6_dev_put(idev); 2584 in6_dev_put(idev);
2584 2585
2585 /* clear tempaddr list */ 2586 /* clear tempaddr list */
@@ -2616,7 +2617,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
2616 2617
2617 /* Step 5: Discard multicast list */ 2618 /* Step 5: Discard multicast list */
2618 2619
2619 if (how == 1) 2620 if (how)
2620 ipv6_mc_destroy_dev(idev); 2621 ipv6_mc_destroy_dev(idev);
2621 else 2622 else
2622 ipv6_mc_down(idev); 2623 ipv6_mc_down(idev);
@@ -2625,7 +2626,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
2625 2626
2626 /* Shot the device (if unregistered) */ 2627 /* Shot the device (if unregistered) */
2627 2628
2628 if (how == 1) { 2629 if (how) {
2629 addrconf_sysctl_unregister(idev); 2630 addrconf_sysctl_unregister(idev);
2630 neigh_parms_release(&nd_tbl, idev->nd_parms); 2631 neigh_parms_release(&nd_tbl, idev->nd_parms);
2631 neigh_ifdown(&nd_tbl, dev); 2632 neigh_ifdown(&nd_tbl, dev);
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 36e817492095..4e1b29fabdf0 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -314,9 +314,7 @@ int ipv6_dev_ac_inc(struct net_device *dev, struct in6_addr *addr)
314 idev->ac_list = aca; 314 idev->ac_list = aca;
315 write_unlock_bh(&idev->lock); 315 write_unlock_bh(&idev->lock);
316 316
317 dst_hold(&rt->u.dst); 317 ip6_ins_rt(rt);
318 if (ip6_ins_rt(rt))
319 dst_release(&rt->u.dst);
320 318
321 addrconf_join_solict(dev, &aca->aca_addr); 319 addrconf_join_solict(dev, &aca->aca_addr);
322 320
@@ -358,10 +356,7 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, struct in6_addr *addr)
358 addrconf_leave_solict(idev, &aca->aca_addr); 356 addrconf_leave_solict(idev, &aca->aca_addr);
359 357
360 dst_hold(&aca->aca_rt->u.dst); 358 dst_hold(&aca->aca_rt->u.dst);
361 if (ip6_del_rt(aca->aca_rt)) 359 ip6_del_rt(aca->aca_rt);
362 dst_free(&aca->aca_rt->u.dst);
363 else
364 dst_release(&aca->aca_rt->u.dst);
365 360
366 aca_put(aca); 361 aca_put(aca);
367 return 0; 362 return 0;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 195086114e63..d42dd16d3487 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -441,24 +441,26 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
441 } 441 }
442 442
443 if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6)) 443 if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6))
444 goto out_dst_release; 444 goto relookup_failed;
445 445
446 if (ip6_dst_lookup(sk, &dst2, &fl)) 446 if (ip6_dst_lookup(sk, &dst2, &fl))
447 goto out_dst_release; 447 goto relookup_failed;
448 448
449 err = xfrm_lookup(&dst2, &fl, sk, XFRM_LOOKUP_ICMP); 449 err = xfrm_lookup(&dst2, &fl, sk, XFRM_LOOKUP_ICMP);
450 if (err == -ENOENT) { 450 switch (err) {
451 case 0:
452 dst_release(dst);
453 dst = dst2;
454 break;
455 case -EPERM:
456 goto out_dst_release;
457 default:
458relookup_failed:
451 if (!dst) 459 if (!dst)
452 goto out; 460 goto out;
453 goto route_done; 461 break;
454 } 462 }
455 463
456 dst_release(dst);
457 dst = dst2;
458
459 if (err)
460 goto out;
461
462route_done: 464route_done:
463 if (ipv6_addr_is_multicast(&fl.fl6_dst)) 465 if (ipv6_addr_is_multicast(&fl.fl6_dst))
464 hlimit = np->mcast_hops; 466 hlimit = np->mcast_hops;
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index dc29007c52cd..40d344b21453 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -466,38 +466,25 @@ static inline void rateinfo_recalc(struct dsthash_ent *dh, unsigned long now)
466 466
467static inline __be32 maskl(__be32 a, unsigned int l) 467static inline __be32 maskl(__be32 a, unsigned int l)
468{ 468{
469 return htonl(ntohl(a) & ~(~(u_int32_t)0 >> l)); 469 return l ? htonl(ntohl(a) & ~0 << (32 - l)) : 0;
470} 470}
471 471
472#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE) 472#if defined(CONFIG_IP6_NF_IPTABLES) || defined(CONFIG_IP6_NF_IPTABLES_MODULE)
473static void hashlimit_ipv6_mask(__be32 *i, unsigned int p) 473static void hashlimit_ipv6_mask(__be32 *i, unsigned int p)
474{ 474{
475 switch (p) { 475 switch (p) {
476 case 0: 476 case 0 ... 31:
477 i[0] = i[1] = 0;
478 i[2] = i[3] = 0;
479 break;
480 case 1 ... 31:
481 i[0] = maskl(i[0], p); 477 i[0] = maskl(i[0], p);
482 i[1] = i[2] = i[3] = 0; 478 i[1] = i[2] = i[3] = 0;
483 break; 479 break;
484 case 32: 480 case 32 ... 63:
485 i[1] = i[2] = i[3] = 0;
486 break;
487 case 33 ... 63:
488 i[1] = maskl(i[1], p - 32); 481 i[1] = maskl(i[1], p - 32);
489 i[2] = i[3] = 0; 482 i[2] = i[3] = 0;
490 break; 483 break;
491 case 64: 484 case 64 ... 95:
492 i[2] = i[3] = 0;
493 break;
494 case 65 ... 95:
495 i[2] = maskl(i[2], p - 64); 485 i[2] = maskl(i[2], p - 64);
496 i[3] = 0; 486 i[3] = 0;
497 case 96: 487 case 96 ... 127:
498 i[3] = 0;
499 break;
500 case 97 ... 127:
501 i[3] = maskl(i[3], p - 96); 488 i[3] = maskl(i[3], p - 96);
502 break; 489 break;
503 case 128: 490 case 128:
diff --git a/net/sched/cls_u32.c b/net/sched/cls_u32.c
index c5c16b4b6e98..4d755444c449 100644
--- a/net/sched/cls_u32.c
+++ b/net/sched/cls_u32.c
@@ -411,8 +411,10 @@ static void u32_destroy(struct tcf_proto *tp)
411 } 411 }
412 } 412 }
413 413
414 for (ht=tp_c->hlist; ht; ht = ht->next) 414 for (ht = tp_c->hlist; ht; ht = ht->next) {
415 ht->refcnt--;
415 u32_clear_hnode(tp, ht); 416 u32_clear_hnode(tp, ht);
417 }
416 418
417 while ((ht = tp_c->hlist) != NULL) { 419 while ((ht = tp_c->hlist) != NULL) {
418 tp_c->hlist = ht->next; 420 tp_c->hlist = ht->next;
@@ -441,8 +443,12 @@ static int u32_delete(struct tcf_proto *tp, unsigned long arg)
441 if (tp->root == ht) 443 if (tp->root == ht)
442 return -EINVAL; 444 return -EINVAL;
443 445
444 if (--ht->refcnt == 0) 446 if (ht->refcnt == 1) {
447 ht->refcnt--;
445 u32_destroy_hnode(tp, ht); 448 u32_destroy_hnode(tp, ht);
449 } else {
450 return -EBUSY;
451 }
446 452
447 return 0; 453 return 0;
448} 454}
@@ -568,7 +574,7 @@ static int u32_change(struct tcf_proto *tp, unsigned long base, u32 handle,
568 if (ht == NULL) 574 if (ht == NULL)
569 return -ENOBUFS; 575 return -ENOBUFS;
570 ht->tp_c = tp_c; 576 ht->tp_c = tp_c;
571 ht->refcnt = 0; 577 ht->refcnt = 1;
572 ht->divisor = divisor; 578 ht->divisor = divisor;
573 ht->handle = handle; 579 ht->handle = handle;
574 ht->prio = tp->prio; 580 ht->prio = tp->prio;
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 036bfcc8d15b..e45e44c60635 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -110,8 +110,9 @@ static int sctp_inet6addr_event(struct notifier_block *this, unsigned long ev,
110 spin_lock_bh(&sctp_local_addr_lock); 110 spin_lock_bh(&sctp_local_addr_lock);
111 list_for_each_entry_safe(addr, temp, 111 list_for_each_entry_safe(addr, temp,
112 &sctp_local_addr_list, list) { 112 &sctp_local_addr_list, list) {
113 if (ipv6_addr_equal(&addr->a.v6.sin6_addr, 113 if (addr->a.sa.sa_family == AF_INET6 &&
114 &ifa->addr)) { 114 ipv6_addr_equal(&addr->a.v6.sin6_addr,
115 &ifa->addr)) {
115 found = 1; 116 found = 1;
116 addr->valid = 0; 117 addr->valid = 0;
117 list_del_rcu(&addr->list); 118 list_del_rcu(&addr->list);
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index 213c2e2926a9..a7ba9e146dff 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -794,6 +794,9 @@ int sctp_outq_flush(struct sctp_outq *q, int rtx_timeout)
794 break; 794 break;
795 795
796 case SCTP_CID_ABORT: 796 case SCTP_CID_ABORT:
797 if (sctp_test_T_bit(chunk)) {
798 packet->vtag = asoc->c.my_vtag;
799 }
797 case SCTP_CID_SACK: 800 case SCTP_CID_SACK:
798 case SCTP_CID_HEARTBEAT: 801 case SCTP_CID_HEARTBEAT:
799 case SCTP_CID_HEARTBEAT_ACK: 802 case SCTP_CID_HEARTBEAT_ACK:
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b34437fdea26..0ec234b762c2 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -650,7 +650,9 @@ static int sctp_inetaddr_event(struct notifier_block *this, unsigned long ev,
650 spin_lock_bh(&sctp_local_addr_lock); 650 spin_lock_bh(&sctp_local_addr_lock);
651 list_for_each_entry_safe(addr, temp, 651 list_for_each_entry_safe(addr, temp,
652 &sctp_local_addr_list, list) { 652 &sctp_local_addr_list, list) {
653 if (addr->a.v4.sin_addr.s_addr == ifa->ifa_local) { 653 if (addr->a.sa.sa_family == AF_INET &&
654 addr->a.v4.sin_addr.s_addr ==
655 ifa->ifa_local) {
654 found = 1; 656 found = 1;
655 addr->valid = 0; 657 addr->valid = 0;
656 list_del_rcu(&addr->list); 658 list_del_rcu(&addr->list);
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 0679bddf3a95..81b606424e12 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -1982,7 +1982,10 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
1982 struct sctp_chunk *chunk, 1982 struct sctp_chunk *chunk,
1983 struct sctp_chunk **err_chunk) 1983 struct sctp_chunk **err_chunk)
1984{ 1984{
1985 struct sctp_hmac_algo_param *hmacs;
1985 int retval = SCTP_IERROR_NO_ERROR; 1986 int retval = SCTP_IERROR_NO_ERROR;
1987 __u16 n_elt, id = 0;
1988 int i;
1986 1989
1987 /* FIXME - This routine is not looking at each parameter per the 1990 /* FIXME - This routine is not looking at each parameter per the
1988 * chunk type, i.e., unrecognized parameters should be further 1991 * chunk type, i.e., unrecognized parameters should be further
@@ -2056,9 +2059,29 @@ static sctp_ierror_t sctp_verify_param(const struct sctp_association *asoc,
2056 break; 2059 break;
2057 2060
2058 case SCTP_PARAM_HMAC_ALGO: 2061 case SCTP_PARAM_HMAC_ALGO:
2059 if (sctp_auth_enable) 2062 if (!sctp_auth_enable)
2060 break; 2063 goto fallthrough;
2061 /* Fall Through */ 2064
2065 hmacs = (struct sctp_hmac_algo_param *)param.p;
2066 n_elt = (ntohs(param.p->length) - sizeof(sctp_paramhdr_t)) >> 1;
2067
2068 /* SCTP-AUTH: Section 6.1
2069 * The HMAC algorithm based on SHA-1 MUST be supported and
2070 * included in the HMAC-ALGO parameter.
2071 */
2072 for (i = 0; i < n_elt; i++) {
2073 id = ntohs(hmacs->hmac_ids[i]);
2074
2075 if (id == SCTP_AUTH_HMAC_ID_SHA1)
2076 break;
2077 }
2078
2079 if (id != SCTP_AUTH_HMAC_ID_SHA1) {
2080 sctp_process_inv_paramlength(asoc, param.p, chunk,
2081 err_chunk);
2082 retval = SCTP_IERROR_ABORT;
2083 }
2084 break;
2062fallthrough: 2085fallthrough:
2063 default: 2086 default:
2064 SCTP_DEBUG_PRINTK("Unrecognized param: %d for chunk %d.\n", 2087 SCTP_DEBUG_PRINTK("Unrecognized param: %d for chunk %d.\n",
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 13beed263e31..23a9f1a95b7d 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -1529,6 +1529,9 @@ static int sctp_cmd_interpreter(sctp_event_t event_type,
1529 error = sctp_auth_asoc_init_active_key(asoc, 1529 error = sctp_auth_asoc_init_active_key(asoc,
1530 GFP_ATOMIC); 1530 GFP_ATOMIC);
1531 break; 1531 break;
1532 case SCTP_CMD_UPDATE_INITTAG:
1533 asoc->peer.i.init_tag = cmd->obj.u32;
1534 break;
1532 1535
1533 default: 1536 default:
1534 printk(KERN_WARNING "Impossible command: %u, %p\n", 1537 printk(KERN_WARNING "Impossible command: %u, %p\n",
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 622284805500..0c9d5a6950fe 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4138,6 +4138,24 @@ static sctp_disposition_t sctp_sf_abort_violation(
4138 goto nomem; 4138 goto nomem;
4139 4139
4140 if (asoc) { 4140 if (asoc) {
4141 /* Treat INIT-ACK as a special case during COOKIE-WAIT. */
4142 if (chunk->chunk_hdr->type == SCTP_CID_INIT_ACK &&
4143 !asoc->peer.i.init_tag) {
4144 sctp_initack_chunk_t *initack;
4145
4146 initack = (sctp_initack_chunk_t *)chunk->chunk_hdr;
4147 if (!sctp_chunk_length_valid(chunk,
4148 sizeof(sctp_initack_chunk_t)))
4149 abort->chunk_hdr->flags |= SCTP_CHUNK_FLAG_T;
4150 else {
4151 unsigned int inittag;
4152
4153 inittag = ntohl(initack->init_hdr.init_tag);
4154 sctp_add_cmd_sf(commands, SCTP_CMD_UPDATE_INITTAG,
4155 SCTP_U32(inittag));
4156 }
4157 }
4158
4141 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort)); 4159 sctp_add_cmd_sf(commands, SCTP_CMD_REPLY, SCTP_CHUNK(abort));
4142 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS); 4160 SCTP_INC_STATS(SCTP_MIB_OUTCTRLCHUNKS);
4143 4161
@@ -4343,6 +4361,7 @@ sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
4343 sctp_cmd_seq_t *commands) 4361 sctp_cmd_seq_t *commands)
4344{ 4362{
4345 struct sctp_chunk *repl; 4363 struct sctp_chunk *repl;
4364 struct sctp_association* my_asoc;
4346 4365
4347 /* The comment below says that we enter COOKIE-WAIT AFTER 4366 /* The comment below says that we enter COOKIE-WAIT AFTER
4348 * sending the INIT, but that doesn't actually work in our 4367 * sending the INIT, but that doesn't actually work in our
@@ -4366,8 +4385,8 @@ sctp_disposition_t sctp_sf_do_prm_asoc(const struct sctp_endpoint *ep,
4366 /* Cast away the const modifier, as we want to just 4385 /* Cast away the const modifier, as we want to just
4367 * rerun it through as a sideffect. 4386 * rerun it through as a sideffect.
4368 */ 4387 */
4369 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, 4388 my_asoc = (struct sctp_association *)asoc;
4370 SCTP_ASOC((struct sctp_association *) asoc)); 4389 sctp_add_cmd_sf(commands, SCTP_CMD_NEW_ASOC, SCTP_ASOC(my_asoc));
4371 4390
4372 /* Choose transport for INIT. */ 4391 /* Choose transport for INIT. */
4373 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT, 4392 sctp_add_cmd_sf(commands, SCTP_CMD_INIT_CHOOSE_TRANSPORT,
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 8c90289ba400..e7e3baf7009e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -5848,11 +5848,12 @@ SCTP_STATIC int sctp_msghdr_parse(const struct msghdr *msg,
5848 sctp_cmsgs_t *cmsgs) 5848 sctp_cmsgs_t *cmsgs)
5849{ 5849{
5850 struct cmsghdr *cmsg; 5850 struct cmsghdr *cmsg;
5851 struct msghdr *my_msg = (struct msghdr *)msg;
5851 5852
5852 for (cmsg = CMSG_FIRSTHDR(msg); 5853 for (cmsg = CMSG_FIRSTHDR(msg);
5853 cmsg != NULL; 5854 cmsg != NULL;
5854 cmsg = CMSG_NXTHDR((struct msghdr*)msg, cmsg)) { 5855 cmsg = CMSG_NXTHDR(my_msg, cmsg)) {
5855 if (!CMSG_OK(msg, cmsg)) 5856 if (!CMSG_OK(my_msg, cmsg))
5856 return -EINVAL; 5857 return -EINVAL;
5857 5858
5858 /* Should we parse this header or ignore? */ 5859 /* Should we parse this header or ignore? */
diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
index b43f1f110f87..ce6cda6b6994 100644
--- a/net/sctp/ulpevent.c
+++ b/net/sctp/ulpevent.c
@@ -859,7 +859,7 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event)
859 union sctp_notification *notification; 859 union sctp_notification *notification;
860 struct sk_buff *skb; 860 struct sk_buff *skb;
861 861
862 skb = sctp_event2skb((struct sctp_ulpevent *)event); 862 skb = sctp_event2skb(event);
863 notification = (union sctp_notification *) skb->data; 863 notification = (union sctp_notification *) skb->data;
864 return notification->sn_header.sn_type; 864 return notification->sn_header.sn_type;
865} 865}
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 64a7460af734..2bdd4dddc0e1 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1161,7 +1161,7 @@ static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
1161 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]); 1161 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
1162 params.listen_interval = 1162 params.listen_interval =
1163 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]); 1163 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
1164 params.listen_interval = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]); 1164 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
1165 1165
1166 if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS], 1166 if (parse_station_flags(info->attrs[NL80211_ATTR_STA_FLAGS],
1167 &params.station_flags)) 1167 &params.station_flags))
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ecf9d67daef5..b822b56e5b8e 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -288,7 +288,7 @@ static void copy_from_user_state(struct xfrm_state *x, struct xfrm_usersa_info *
288 memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr)); 288 memcpy(&x->props.saddr, &p->saddr, sizeof(x->props.saddr));
289 x->props.flags = p->flags; 289 x->props.flags = p->flags;
290 290
291 if (x->props.mode == XFRM_MODE_TRANSPORT) 291 if (!x->sel.family)
292 x->sel.family = p->family; 292 x->sel.family = p->family;
293 293
294} 294}
generated by cgit v1.2.2 (git 2.25.0) at 2024-11-01 20:38:44 -0400