9 files changed, 107 insertions, 34 deletions

diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 7f939ce29801..2bc6f6a8de68 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -92,6 +92,8 @@ static void add_conn(struct work_struct *work)
 
         dev_set_name(&conn->dev, "%s:%d", hdev->name, conn->handle);
 
+        dev_set_drvdata(&conn->dev, conn);
+
         if (device_add(&conn->dev) < 0) {
                 BT_ERR("Failed to register connection device");
                 return;
@@ -144,8 +146,6 @@ void hci_conn_init_sysfs(struct hci_conn *conn)
         conn->dev.class = bt_class;
         conn->dev.parent = &hdev->dev;
 
-        dev_set_drvdata(&conn->dev, conn);
-
         device_initialize(&conn->dev);
 
         INIT_WORK(&conn->work_add, add_conn);
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 4b66bd579f4a..d65101d92ee5 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -555,12 +555,12 @@ static struct l2cap_conn *l2cap_conn_add(struct hci_conn *hcon, u8 status)
 
         conn->feat_mask = 0;
 
-        setup_timer(&conn->info_timer, l2cap_info_timeout,
-                                                (unsigned long) conn);
-
         spin_lock_init(&conn->lock);
         rwlock_init(&conn->chan_list.lock);
 
+        setup_timer(&conn->info_timer, l2cap_info_timeout,
+                                                (unsigned long) conn);
+
         conn->disc_reason = 0x13;
 
         return conn;
@@ -783,6 +783,9 @@ static void l2cap_sock_init(struct sock *sk, struct sock *parent)
         /* Default config options */
         pi->conf_len = 0;
         pi->flush_to = L2CAP_DEFAULT_FLUSH_TO;
+        skb_queue_head_init(TX_QUEUE(sk));
+        skb_queue_head_init(SREJ_QUEUE(sk));
+        INIT_LIST_HEAD(SREJ_LIST(sk));
 }
 
 static struct proto l2cap_proto = {
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 1da0e038df78..5ce017bf4afa 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -335,6 +335,7 @@ struct pktgen_dev {
         __u32 cur_src_mac_offset;
         __be32 cur_saddr;
         __be32 cur_daddr;
+        __u16 ip_id;
         __u16 cur_udp_dst;
         __u16 cur_udp_src;
         __u16 cur_queue_map;
@@ -2630,6 +2631,8 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         iph->protocol = IPPROTO_UDP;    /* UDP */
         iph->saddr = pkt_dev->cur_saddr;
         iph->daddr = pkt_dev->cur_daddr;
+        iph->id = htons(pkt_dev->ip_id);
+        pkt_dev->ip_id++;
         iph->frag_off = 0;
         iplen = 20 + 8 + datalen;
         iph->tot_len = htons(iplen);
@@ -2641,24 +2644,26 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
 
-        if (pkt_dev->nfrags <= 0)
+        if (pkt_dev->nfrags <= 0) {
                 pgh = (struct pktgen_hdr *)skb_put(skb, datalen);
-        else {
+                memset(pgh + 1, 0, datalen - sizeof(struct pktgen_hdr));
+        } else {
                 int frags = pkt_dev->nfrags;
-                int i;
+                int i, len;
 
                 pgh = (struct pktgen_hdr *)(((char *)(udph)) + 8);
 
                 if (frags > MAX_SKB_FRAGS)
                         frags = MAX_SKB_FRAGS;
                 if (datalen > frags * PAGE_SIZE) {
-                        skb_put(skb, datalen - frags * PAGE_SIZE);
+                        len = datalen - frags * PAGE_SIZE;
+                        memset(skb_put(skb, len), 0, len);
                         datalen = frags * PAGE_SIZE;
                 }
 
                 i = 0;
                 while (datalen > 0) {
-                        struct page *page = alloc_pages(GFP_KERNEL, 0);
+                        struct page *page = alloc_pages(GFP_KERNEL | __GFP_ZERO, 0);
                         skb_shinfo(skb)->frags[i].page = page;
                         skb_shinfo(skb)->frags[i].page_offset = 0;
                         skb_shinfo(skb)->frags[i].size =
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index f6a0af759932..26fb50e91311 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -447,6 +447,28 @@ extern int sysctl_tcp_synack_retries;
 
 EXPORT_SYMBOL_GPL(inet_csk_reqsk_queue_hash_add);
 
+/* Decide when to expire the request and when to resend SYN-ACK */
+static inline void syn_ack_recalc(struct request_sock *req, const int thresh,
+                                  const int max_retries,
+                                  const u8 rskq_defer_accept,
+                                  int *expire, int *resend)
+{
+        if (!rskq_defer_accept) {
+                *expire = req->retrans >= thresh;
+                *resend = 1;
+                return;
+        }
+        *expire = req->retrans >= thresh &&
+                  (!inet_rsk(req)->acked || req->retrans >= max_retries);
+        /*
+         * Do not resend while waiting for data after ACK,
+         * start to resend on end of deferring period to give
+         * last chance for data or ACK to create established socket.
+         */
+        *resend = !inet_rsk(req)->acked ||
+                  req->retrans >= rskq_defer_accept - 1;
+}
+
 void inet_csk_reqsk_queue_prune(struct sock *parent,
                                 const unsigned long interval,
                                 const unsigned long timeout,
@@ -502,9 +524,15 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                 reqp=&lopt->syn_table[i];
                 while ((req = *reqp) != NULL) {
                         if (time_after_eq(now, req->expires)) {
-                                if ((req->retrans < thresh ||
-                                     (inet_rsk(req)->acked && req->retrans < max_retries))
-                                    && !req->rsk_ops->rtx_syn_ack(parent, req)) {
+                                int expire = 0, resend = 0;
+
+                                syn_ack_recalc(req, thresh, max_retries,
+                                               queue->rskq_defer_accept,
+                                               &expire, &resend);
+                                if (!expire &&
+                                    (!resend ||
+                                     !req->rsk_ops->rtx_syn_ack(parent, req) ||
+                                     inet_rsk(req)->acked)) {
                                         unsigned long timeo;
 
                                         if (req->retrans++ == 0)
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 2445fedec0b8..a72f43ce33be 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -634,17 +634,16 @@ static int do_ip_setsockopt(struct sock *sk, int level,
                                 break;
                         }
                         dev = ip_dev_find(sock_net(sk), mreq.imr_address.s_addr);
-                        if (dev) {
+                        if (dev)
                                 mreq.imr_ifindex = dev->ifindex;
-                                dev_put(dev);
-                        }
                 } else
-                        dev = __dev_get_by_index(sock_net(sk), mreq.imr_ifindex);
+                        dev = dev_get_by_index(sock_net(sk), mreq.imr_ifindex);
 
 
                 err = -EADDRNOTAVAIL;
                 if (!dev)
                         break;
+                dev_put(dev);
 
                 err = -EINVAL;
                 if (sk->sk_bound_dev_if &&
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 206a291dff03..e0cfa633680a 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -326,6 +326,43 @@ void tcp_enter_memory_pressure(struct sock *sk)
 
 EXPORT_SYMBOL(tcp_enter_memory_pressure);
 
+/* Convert seconds to retransmits based on initial and max timeout */
+static u8 secs_to_retrans(int seconds, int timeout, int rto_max)
+{
+        u8 res = 0;
+
+        if (seconds > 0) {
+                int period = timeout;
+
+                res = 1;
+                while (seconds > period && res < 255) {
+                        res++;
+                        timeout <<= 1;
+                        if (timeout > rto_max)
+                                timeout = rto_max;
+                        period += timeout;
+                }
+        }
+        return res;
+}
+
+/* Convert retransmits to seconds based on initial and max timeout */
+static int retrans_to_secs(u8 retrans, int timeout, int rto_max)
+{
+        int period = 0;
+
+        if (retrans > 0) {
+                period = timeout;
+                while (--retrans) {
+                        timeout <<= 1;
+                        if (timeout > rto_max)
+                                timeout = rto_max;
+                        period += timeout;
+                }
+        }
+        return period;
+}
+
 /*
  *      Wait for a TCP event.
  *
@@ -1405,7 +1442,9 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                 goto found_ok_skb;
                         if (tcp_hdr(skb)->fin)
                                 goto found_fin_ok;
-                        WARN_ON(!(flags & MSG_PEEK));
+                        WARN(!(flags & MSG_PEEK), KERN_INFO "recvmsg bug 2: "
+                                        "copied %X seq %X\n", *seq,
+                                        TCP_SKB_CB(skb)->seq);
                 }
 
                 /* Well, if we have backlog, try to process it now yet. */
@@ -2163,16 +2202,10 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
                 break;
 
         case TCP_DEFER_ACCEPT:
-                icsk->icsk_accept_queue.rskq_defer_accept = 0;
-                if (val > 0) {
-                        /* Translate value in seconds to number of
-                         * retransmits */
-                        while (icsk->icsk_accept_queue.rskq_defer_accept < 32 &&
-                               val > ((TCP_TIMEOUT_INIT / HZ) <<
-                                       icsk->icsk_accept_queue.rskq_defer_accept))
-                                icsk->icsk_accept_queue.rskq_defer_accept++;
-                        icsk->icsk_accept_queue.rskq_defer_accept++;
-                }
+                /* Translate value in seconds to number of retransmits */
+                icsk->icsk_accept_queue.rskq_defer_accept =
+                        secs_to_retrans(val, TCP_TIMEOUT_INIT / HZ,
+                                        TCP_RTO_MAX / HZ);
                 break;
 
         case TCP_WINDOW_CLAMP:
@@ -2353,8 +2386,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
                         val = (val ? : sysctl_tcp_fin_timeout) / HZ;
                 break;
         case TCP_DEFER_ACCEPT:
-                val = !icsk->icsk_accept_queue.rskq_defer_accept ? 0 :
-                        ((TCP_TIMEOUT_INIT / HZ) << (icsk->icsk_accept_queue.rskq_defer_accept - 1));
+                val = retrans_to_secs(icsk->icsk_accept_queue.rskq_defer_accept,
+                                      TCP_TIMEOUT_INIT / HZ, TCP_RTO_MAX / HZ);
                 break;
         case TCP_WINDOW_CLAMP:
                 val = tp->window_clamp;
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index e320afea07fc..4c03598ed924 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -641,10 +641,9 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         if (!(flg & TCP_FLAG_ACK))
                 return NULL;
 
-        /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
-        if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
+        /* While TCP_DEFER_ACCEPT is active, drop bare ACK. */
+        if (req->retrans < inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
             TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
-                inet_csk(sk)->icsk_accept_queue.rskq_defer_accept--;
                 inet_rsk(req)->acked = 1;
                 return NULL;
         }
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 68566de4bcc5..430454ee5ead 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -497,13 +497,17 @@ done:
                         goto e_inval;
 
                 if (val) {
+                        struct net_device *dev;
+
                         if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != val)
                                 goto e_inval;
 
-                        if (__dev_get_by_index(net, val) == NULL) {
+                        dev = dev_get_by_index(net, val);
+                        if (!dev) {
                                 retv = -ENODEV;
                                 break;
                         }
+                        dev_put(dev);
                 }
                 np->mcast_oif = val;
                 retv = 0;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 0f133c5a8d3c..3291902f0b88 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1074,6 +1074,8 @@ restart:
         err = -ECONNREFUSED;
         if (other->sk_state != TCP_LISTEN)
                 goto out_unlock;
+        if (other->sk_shutdown & RCV_SHUTDOWN)
+                goto out_unlock;
 
         if (unix_recvq_full(other)) {
                 err = -EAGAIN;