10 files changed, 107 insertions, 92 deletions

diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b1b3b0fbf41c..4a9f52732655 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -377,12 +377,16 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
         struct net_bridge_port *p;
         int err = 0;
 
-        if (dev->flags & IFF_LOOPBACK || dev->type != ARPHRD_ETHER)
+        /* Don't allow bridging non-ethernet like devices */
+        if ((dev->flags & IFF_LOOPBACK) ||
+            dev->type != ARPHRD_ETHER || dev->addr_len != ETH_ALEN)
                 return -EINVAL;
 
+        /* No bridging of bridges */
         if (dev->netdev_ops->ndo_start_xmit == br_dev_xmit)
                 return -ELOOP;
 
+        /* Device is already being bridged */
         if (dev->br_port != NULL)
                 return -EBUSY;
 
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 597da4f8f888..e8d58f33fe09 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -132,23 +132,27 @@ static inline struct bcm_sock *bcm_sk(const struct sock *sk)
 /*
  * procfs functions
  */
-static char *bcm_proc_getifname(int ifindex)
+static char *bcm_proc_getifname(char *result, int ifindex)
 {
         struct net_device *dev;
 
         if (!ifindex)
                 return "any";
 
-        /* no usage counting */
+        read_lock(&dev_base_lock);
         dev = __dev_get_by_index(&init_net, ifindex);
         if (dev)
-                return dev->name;
+                strcpy(result, dev->name);
+        else
+                strcpy(result, "???");
+        read_unlock(&dev_base_lock);
 
-        return "???";
+        return result;
 }
 
 static int bcm_proc_show(struct seq_file *m, void *v)
 {
+        char ifname[IFNAMSIZ];
         struct sock *sk = (struct sock *)m->private;
         struct bcm_sock *bo = bcm_sk(sk);
         struct bcm_op *op;
@@ -157,7 +161,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
         seq_printf(m, " / sk %p", sk);
         seq_printf(m, " / bo %p", bo);
         seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
-        seq_printf(m, " / bound %s", bcm_proc_getifname(bo->ifindex));
+        seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
         seq_printf(m, " <<<\n");
 
         list_for_each_entry(op, &bo->rx_ops, list) {
@@ -169,7 +173,7 @@ static int bcm_proc_show(struct seq_file *m, void *v)
                         continue;
 
                 seq_printf(m, "rx_op: %03X %-5s ",
-                                op->can_id, bcm_proc_getifname(op->ifindex));
+                                op->can_id, bcm_proc_getifname(ifname, op->ifindex));
                 seq_printf(m, "[%d]%c ", op->nframes,
                                 (op->flags & RX_CHECK_DLC)?'d':' ');
                 if (op->kt_ival1.tv64)
@@ -194,7 +198,8 @@ static int bcm_proc_show(struct seq_file *m, void *v)
         list_for_each_entry(op, &bo->tx_ops, list) {
 
                 seq_printf(m, "tx_op: %03X %s [%d] ",
-                                op->can_id, bcm_proc_getifname(op->ifindex),
+                                op->can_id,
+                                bcm_proc_getifname(ifname, op->ifindex),
                                 op->nframes);
 
                 if (op->kt_ival1.tv64)
diff --git a/net/decnet/sysctl_net_decnet.c b/net/decnet/sysctl_net_decnet.c
index 26b0ab1e9f56..2036568beea9 100644
--- a/net/decnet/sysctl_net_decnet.c
+++ b/net/decnet/sysctl_net_decnet.c
@@ -263,11 +263,10 @@ static int dn_def_dev_strategy(ctl_table *table,
                         return -ENODEV;
 
                 rv = -ENODEV;
-                if (dev->dn_ptr != NULL) {
+                if (dev->dn_ptr != NULL)
                         rv = dn_dev_set_default(dev, 1);
-                        if (rv)
-                                dev_put(dev);
-                }
+                if (rv)
+                        dev_put(dev);
         }
 
         return rv;
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index 08ccd344de7a..ae40ed1ba560 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -438,25 +438,27 @@ static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 goto tx_error;
         }
 
-        if (tiph->frag_off)
+        df |= old_iph->frag_off & htons(IP_DF);
+
+        if (df) {
                 mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
-        else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
 
-        if (mtu < 68) {
-                stats->collisions++;
-                ip_rt_put(rt);
-                goto tx_error;
-        }
-        if (skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+                if (mtu < 68) {
+                        stats->collisions++;
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
 
-        df |= (old_iph->frag_off&htons(IP_DF));
+                if (skb_dst(skb))
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
 
-        if ((old_iph->frag_off&htons(IP_DF)) && mtu < ntohs(old_iph->tot_len)) {
-                icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED, htonl(mtu));
-                ip_rt_put(rt);
-                goto tx_error;
+                if ((old_iph->frag_off & htons(IP_DF)) &&
+                    mtu < ntohs(old_iph->tot_len)) {
+                        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
+                                  htonl(mtu));
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
         }
 
         if (tunnel->err_count > 0) {
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 68afc6ecd343..fe1a64479dd0 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -750,6 +750,8 @@ static int __init nf_nat_init(void)
         BUG_ON(nfnetlink_parse_nat_setup_hook != NULL);
         rcu_assign_pointer(nfnetlink_parse_nat_setup_hook,
                            nfnetlink_parse_nat_setup);
+        BUG_ON(nf_ct_nat_offset != NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, nf_nat_get_offset);
         return 0;
 
  cleanup_extend:
@@ -764,6 +766,7 @@ static void __exit nf_nat_cleanup(void)
         nf_ct_extend_unregister(&nat_extend);
         rcu_assign_pointer(nf_nat_seq_adjust_hook, NULL);
         rcu_assign_pointer(nfnetlink_parse_nat_setup_hook, NULL);
+        rcu_assign_pointer(nf_ct_nat_offset, NULL);
         synchronize_net();
 }
 
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 09172a65d9b6..f9520fa3aba9 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -73,6 +73,28 @@ adjust_tcp_sequence(u32 seq,
         DUMP_OFFSET(this_way);
 }
 
+/* Get the offset value, for conntrack */
+s16 nf_nat_get_offset(const struct nf_conn *ct,
+                      enum ip_conntrack_dir dir,
+                      u32 seq)
+{
+        struct nf_conn_nat *nat = nfct_nat(ct);
+        struct nf_nat_seq *this_way;
+        s16 offset;
+
+        if (!nat)
+                return 0;
+
+        this_way = &nat->seq[dir];
+        spin_lock_bh(&nf_nat_seqofs_lock);
+        offset = after(seq, this_way->correction_pos)
+                 ? this_way->offset_after : this_way->offset_before;
+        spin_unlock_bh(&nf_nat_seqofs_lock);
+
+        return offset;
+}
+EXPORT_SYMBOL_GPL(nf_nat_get_offset);
+
 /* Frobs data inside this packet, which is linear. */
 static void mangle_contents(struct sk_buff *skb,
                             unsigned int dataoff,
@@ -189,11 +211,6 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                 adjust_tcp_sequence(ntohl(tcph->seq),
                                     (int)rep_len - (int)match_len,
                                     ct, ctinfo);
-                /* Tell TCP window tracking about seq change */
-                nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
-                                        ct, CTINFO2DIR(ctinfo),
-                                        (int)rep_len - (int)match_len);
-
                 nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
         }
         return 1;
@@ -415,12 +432,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         tcph->seq = newseq;
         tcph->ack_seq = newack;
 
-        if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
-                return 0;
-
-        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
-
-        return 1;
+        return nf_nat_sack_adjust(skb, tcph, ct, ctinfo);
 }
 
 /* Setup NAT on this expected conntrack so it follows master. */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index ca6e68dcd8a8..b9168c1864ca 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1351,6 +1351,11 @@ err_stat:
         return ret;
 }
 
+s16 (*nf_ct_nat_offset)(const struct nf_conn *ct,
+                        enum ip_conntrack_dir dir,
+                        u32 seq);
+EXPORT_SYMBOL_GPL(nf_ct_nat_offset);
+
 int nf_conntrack_init(struct net *net)
 {
         int ret;
@@ -1368,6 +1373,9 @@ int nf_conntrack_init(struct net *net)
                 /* For use by REJECT target */
                 rcu_assign_pointer(ip_ct_attach, nf_conntrack_attach);
                 rcu_assign_pointer(nf_ct_destroy, destroy_conntrack);
+
+                /* Howto get NAT offsets */
+                rcu_assign_pointer(nf_ct_nat_offset, NULL);
         }
         return 0;
 
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 97a82ba75376..ba2b76937283 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -492,6 +492,21 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
         }
 }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+static inline s16 nat_offset(const struct nf_conn *ct,
+                             enum ip_conntrack_dir dir,
+                             u32 seq)
+{
+        typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
+
+        return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
+}
+#define NAT_OFFSET(pf, ct, dir, seq) \
+        (pf == NFPROTO_IPV4 ? nat_offset(ct, dir, seq) : 0)
+#else
+#define NAT_OFFSET(pf, ct, dir, seq)    0
+#endif
+
 static bool tcp_in_window(const struct nf_conn *ct,
                           struct ip_ct_tcp *state,
                           enum ip_conntrack_dir dir,
@@ -506,6 +521,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
         struct ip_ct_tcp_state *receiver = &state->seen[!dir];
         const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
         __u32 seq, ack, sack, end, win, swin;
+        s16 receiver_offset;
         bool res;
 
         /*
@@ -519,11 +535,16 @@ static bool tcp_in_window(const struct nf_conn *ct,
         if (receiver->flags & IP_CT_TCP_FLAG_SACK_PERM)
                 tcp_sack(skb, dataoff, tcph, &sack);
 
+        /* Take into account NAT sequence number mangling */
+        receiver_offset = NAT_OFFSET(pf, ct, !dir, ack - 1);
+        ack -= receiver_offset;
+        sack -= receiver_offset;
+
         pr_debug("tcp_in_window: START\n");
         pr_debug("tcp_in_window: ");
         nf_ct_dump_tuple(tuple);
-        pr_debug("seq=%u ack=%u sack=%u win=%u end=%u\n",
-                 seq, ack, sack, win, end);
+        pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
+                 seq, ack, receiver_offset, sack, receiver_offset, win, end);
         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                  sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -613,8 +634,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
 
         pr_debug("tcp_in_window: ");
         nf_ct_dump_tuple(tuple);
-        pr_debug("seq=%u ack=%u sack =%u win=%u end=%u\n",
-                 seq, ack, sack, win, end);
+        pr_debug("seq=%u ack=%u+(%d) sack=%u+(%d) win=%u end=%u\n",
+                 seq, ack, receiver_offset, sack, receiver_offset, win, end);
         pr_debug("tcp_in_window: sender end=%u maxend=%u maxwin=%u scale=%i "
                  "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
                  sender->td_end, sender->td_maxend, sender->td_maxwin,
@@ -700,7 +721,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
                         before(seq, sender->td_maxend + 1) ?
                         after(end, sender->td_end - receiver->td_maxwin - 1) ?
                         before(sack, receiver->td_end + 1) ?
-                        after(ack, receiver->td_end - MAXACKWINDOW(sender)) ? "BUG"
+                        after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
                         : "ACK is under the lower bound (possible overly delayed ACK)"
                         : "ACK is over the upper bound (ACKed data not seen yet)"
                         : "SEQ is under the lower bound (already ACKed data retransmitted)"
@@ -715,39 +736,6 @@ static bool tcp_in_window(const struct nf_conn *ct,
         return res;
 }
 
-#ifdef CONFIG_NF_NAT_NEEDED
-/* Update sender->td_end after NAT successfully mangled the packet */
-/* Caller must linearize skb at tcp header. */
-void nf_conntrack_tcp_update(const struct sk_buff *skb,
-                             unsigned int dataoff,
-                             struct nf_conn *ct, int dir,
-                             s16 offset)
-{
-        const struct tcphdr *tcph = (const void *)skb->data + dataoff;
-        const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
-        const struct ip_ct_tcp_state *receiver = &ct->proto.tcp.seen[!dir];
-        __u32 end;
-
-        end = segment_seq_plus_len(ntohl(tcph->seq), skb->len, dataoff, tcph);
-
-        spin_lock_bh(&ct->lock);
-        /*
-         * We have to worry for the ack in the reply packet only...
-         */
-        if (ct->proto.tcp.seen[dir].td_end + offset == end)
-                ct->proto.tcp.seen[dir].td_end = end;
-        ct->proto.tcp.last_end = end;
-        spin_unlock_bh(&ct->lock);
-        pr_debug("tcp_update: sender end=%u maxend=%u maxwin=%u scale=%i "
-                 "receiver end=%u maxend=%u maxwin=%u scale=%i\n",
-                 sender->td_end, sender->td_maxend, sender->td_maxwin,
-                 sender->td_scale,
-                 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
-                 receiver->td_scale);
-}
-EXPORT_SYMBOL_GPL(nf_conntrack_tcp_update);
-#endif
-
 #define TH_FIN  0x01
 #define TH_SYN  0x02
 #define TH_RST  0x04
diff --git a/net/netfilter/xt_connlimit.c b/net/netfilter/xt_connlimit.c
index 680980954395..38f03f75a636 100644
--- a/net/netfilter/xt_connlimit.c
+++ b/net/netfilter/xt_connlimit.c
@@ -103,7 +103,7 @@ static int count_them(struct xt_connlimit_data *data,
                       const struct nf_conntrack_tuple *tuple,
                       const union nf_inet_addr *addr,
                       const union nf_inet_addr *mask,
-                      const struct xt_match *match)
+                      u_int8_t family)
 {
         const struct nf_conntrack_tuple_hash *found;
         struct xt_connlimit_conn *conn;
@@ -113,8 +113,7 @@ static int count_them(struct xt_connlimit_data *data,
         bool addit = true;
         int matches = 0;
 
-
-        if (match->family == NFPROTO_IPV6)
+        if (family == NFPROTO_IPV6)
                 hash = &data->iphash[connlimit_iphash6(addr, mask)];
         else
                 hash = &data->iphash[connlimit_iphash(addr->ip & mask->ip)];
@@ -157,8 +156,7 @@ static int count_them(struct xt_connlimit_data *data,
                         continue;
                 }
 
-                if (same_source_net(addr, mask, &conn->tuple.src.u3,
-                    match->family))
+                if (same_source_net(addr, mask, &conn->tuple.src.u3, family))
                         /* same source network -> be counted! */
                         ++matches;
                 nf_ct_put(found_ct);
@@ -207,7 +205,7 @@ connlimit_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 
         spin_lock_bh(&info->data->lock);
         connections = count_them(info->data, tuple_ptr, &addr,
-                                 &info->mask, par->match);
+                                 &info->mask, par->family);
         spin_unlock_bh(&info->data->lock);
 
         if (connections < 0) {
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index 9478d9b3d977..f3e21989b88c 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -578,18 +578,18 @@ static int rose_clear_routes(void)
 
 /*
  *      Check that the device given is a valid AX.25 interface that is "up".
+ *      called whith RTNL
  */
-static struct net_device *rose_ax25_dev_get(char *devname)
+static struct net_device *rose_ax25_dev_find(char *devname)
 {
         struct net_device *dev;
 
-        if ((dev = dev_get_by_name(&init_net, devname)) == NULL)
+        if ((dev = __dev_get_by_name(&init_net, devname)) == NULL)
                 return NULL;
 
         if ((dev->flags & IFF_UP) && dev->type == ARPHRD_AX25)
                 return dev;
 
-        dev_put(dev);
         return NULL;
 }
 
@@ -720,27 +720,23 @@ int rose_rt_ioctl(unsigned int cmd, void __user *arg)
         case SIOCADDRT:
                 if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
                         return -EFAULT;
-                if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
+                if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
                         return -EINVAL;
-                if (rose_dev_exists(&rose_route.address)) { /* Can't add routes to ourself */
-                        dev_put(dev);
+                if (rose_dev_exists(&rose_route.address)) /* Can't add routes to ourself */
                         return -EINVAL;
-                }
                 if (rose_route.mask > 10) /* Mask can't be more than 10 digits */
                         return -EINVAL;
                 if (rose_route.ndigis > AX25_MAX_DIGIS)
                         return -EINVAL;
                 err = rose_add_node(&rose_route, dev);
-                dev_put(dev);
                 return err;
 
         case SIOCDELRT:
                 if (copy_from_user(&rose_route, arg, sizeof(struct rose_route_struct)))
                         return -EFAULT;
-                if ((dev = rose_ax25_dev_get(rose_route.device)) == NULL)
+                if ((dev = rose_ax25_dev_find(rose_route.device)) == NULL)
                         return -EINVAL;
                 err = rose_del_node(&rose_route, dev);
-                dev_put(dev);
                 return err;
 
         case SIOCRSCLRRT: