6 files changed, 74 insertions, 32 deletions

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 557fe16cbfb0..dda42f0bd7a3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -663,14 +663,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         th->urg_ptr             = 0;
 
         /* The urg_mode check is necessary during a below snd_una win probe */
-        if (unlikely(tcp_urg_mode(tp))) {
-                if (between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF)) {
-                        th->urg_ptr = htons(tp->snd_up - tcb->seq);
-                        th->urg = 1;
-                } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
-                        th->urg_ptr = 0xFFFF;
-                        th->urg = 1;
-                }
+        if (unlikely(tcp_urg_mode(tp) &&
+                     between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF))) {
+                th->urg_ptr             = htons(tp->snd_up - tcb->seq);
+                th->urg                 = 1;
         }
 
         tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index b7faffe5c029..cc3a0a06c004 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1015,9 +1015,11 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
         if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM)
+                if (rc == -ENOMEM) {
                         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
                                          is_udplite);
+                        atomic_inc(&sk->sk_drops);
+                }
                 goto drop;
         }
 
@@ -1229,7 +1231,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                    int proto)
 {
         struct sock *sk;
-        struct udphdr *uh = udp_hdr(skb);
+        struct udphdr *uh;
         unsigned short ulen;
         struct rtable *rt = (struct rtable*)skb->dst;
         __be32 saddr = ip_hdr(skb)->saddr;
@@ -1242,6 +1244,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                 goto drop;              /* No space for header. */
 
+        uh   = udp_hdr(skb);
         ulen = ntohs(uh->len);
         if (ulen > skb->len)
                 goto short_packet;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4b15938bef4d..9fb49c3b518a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1105,6 +1105,18 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         return err;
 }
 
+static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
+                                               gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+
+static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+                                                gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
@@ -1130,17 +1142,37 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                  * setup for corking
                  */
                 if (opt) {
-                        if (np->cork.opt == NULL) {
-                                np->cork.opt = kmalloc(opt->tot_len,
-                                                       sk->sk_allocation);
-                                if (unlikely(np->cork.opt == NULL))
-                                        return -ENOBUFS;
-                        } else if (np->cork.opt->tot_len < opt->tot_len) {
-                                printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
+                        if (WARN_ON(np->cork.opt))
                                 return -EINVAL;
-                        }
-                        memcpy(np->cork.opt, opt, opt->tot_len);
-                        inet->cork.flags |= IPCORK_OPT;
+
+                        np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
+                        if (unlikely(np->cork.opt == NULL))
+                                return -ENOBUFS;
+
+                        np->cork.opt->tot_len = opt->tot_len;
+                        np->cork.opt->opt_flen = opt->opt_flen;
+                        np->cork.opt->opt_nflen = opt->opt_nflen;
+
+                        np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst0opt && !np->cork.opt->dst0opt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst1opt && !np->cork.opt->dst1opt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
+                                                           sk->sk_allocation);
+                        if (opt->hopopt && !np->cork.opt->hopopt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
+                                                            sk->sk_allocation);
+                        if (opt->srcrt && !np->cork.opt->srcrt)
+                                return -ENOBUFS;
+
                         /* need source address above miyazawa*/
                 }
                 dst_hold(&rt->u.dst);
@@ -1167,8 +1199,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         } else {
                 rt = (struct rt6_info *)inet->cork.dst;
                 fl = &inet->cork.fl;
-                if (inet->cork.flags & IPCORK_OPT)
-                        opt = np->cork.opt;
+                opt = np->cork.opt;
                 transhdrlen = 0;
                 exthdrlen = 0;
                 mtu = inet->cork.fragsize;
@@ -1407,9 +1438,15 @@ error:
 
 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
 {
-        inet->cork.flags &= ~IPCORK_OPT;
-        kfree(np->cork.opt);
-        np->cork.opt = NULL;
+        if (np->cork.opt) {
+                kfree(np->cork.opt->dst0opt);
+                kfree(np->cork.opt->dst1opt);
+                kfree(np->cork.opt->hopopt);
+                kfree(np->cork.opt->srcrt);
+                kfree(np->cork.opt);
+                np->cork.opt = NULL;
+        }
+
         if (inet->cork.dst) {
                 dst_release(inet->cork.dst);
                 inet->cork.dst = NULL;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index d19a84b79503..228be551e9c1 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -48,6 +48,7 @@
 #include <linux/pim.h>
 #include <net/addrconf.h>
 #include <linux/netfilter_ipv6.h>
+#include <net/ip6_checksum.h>
 
 /* Big lock, protecting vif table, mrt cache and mroute socket state.
    Note that the changes are semaphored via rtnl_lock.
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 5f94db2f3e9e..1fc4a7885c41 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -77,6 +77,7 @@
 #include <linux/poll.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/mutex.h>
 
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
@@ -175,6 +176,7 @@ struct packet_sock {
 #endif
         struct packet_type      prot_hook;
         spinlock_t              bind_lock;
+        struct mutex            pg_vec_lock;
         unsigned int            running:1,      /* prot_hook is attached*/
                                 auxdata:1,
                                 origdev:1;
@@ -220,13 +222,13 @@ static void *packet_lookup_frame(struct packet_sock *po, unsigned int position,
         h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
         switch (po->tp_version) {
         case TPACKET_V1:
-                if (status != h.h1->tp_status ? TP_STATUS_USER :
-                                                TP_STATUS_KERNEL)
+                if (status != (h.h1->tp_status ? TP_STATUS_USER :
+                                                TP_STATUS_KERNEL))
                         return NULL;
                 break;
         case TPACKET_V2:
-                if (status != h.h2->tp_status ? TP_STATUS_USER :
-                                                TP_STATUS_KERNEL)
+                if (status != (h.h2->tp_status ? TP_STATUS_USER :
+                                                TP_STATUS_KERNEL))
                         return NULL;
                 break;
         }
@@ -1069,6 +1071,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
          */
 
         spin_lock_init(&po->bind_lock);
+        mutex_init(&po->pg_vec_lock);
         po->prot_hook.func = packet_rcv;
 
         if (sock->type == SOCK_PACKET)
@@ -1865,6 +1868,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
         synchronize_net();
 
         err = -EBUSY;
+        mutex_lock(&po->pg_vec_lock);
         if (closing || atomic_read(&po->mapped) == 0) {
                 err = 0;
 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
@@ -1886,6 +1890,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
                 if (atomic_read(&po->mapped))
                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
         }
+        mutex_unlock(&po->pg_vec_lock);
 
         spin_lock(&po->bind_lock);
         if (was_running && !po->running) {
@@ -1918,7 +1923,7 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
 
         size = vma->vm_end - vma->vm_start;
 
-        lock_sock(sk);
+        mutex_lock(&po->pg_vec_lock);
         if (po->pg_vec == NULL)
                 goto out;
         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
@@ -1941,7 +1946,7 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
         err = 0;
 
 out:
-        release_sock(sk);
+        mutex_unlock(&po->pg_vec_lock);
         return err;
 }
 #endif
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index dcef600d0bf5..5592883e1e4a 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -6,7 +6,7 @@ config SUNRPC_GSS
 
 config SUNRPC_XPRT_RDMA
         tristate
-        depends on SUNRPC && INFINIBAND && EXPERIMENTAL
+        depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS && EXPERIMENTAL
         default SUNRPC && INFINIBAND
         help
           This option allows the NFS client and server to support