14 files changed, 90 insertions, 60 deletions

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 7550abb0c96a..675614e38e14 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -859,6 +859,7 @@ static void __l2cap_sock_close(struct sock *sk, int reason)
                                 result = L2CAP_CR_SEC_BLOCK;
                         else
                                 result = L2CAP_CR_BAD_PSM;
+                        sk->sk_state = BT_DISCONN;
 
                         rsp.scid   = cpu_to_le16(l2cap_pi(sk)->dcid);
                         rsp.dcid   = cpu_to_le16(l2cap_pi(sk)->scid);
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 6f6d8e1b776f..88e4aa9cb1f9 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -80,7 +80,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
         if (is_multicast_ether_addr(dest)) {
                 mdst = br_mdb_get(br, skb);
                 if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
-                        if ((mdst && !hlist_unhashed(&mdst->mglist)) ||
+                        if ((mdst && mdst->mglist) ||
                             br_multicast_is_router(br))
                                 skb2 = skb;
                         br_multicast_forward(mdst, skb, skb2);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f701a21acb34..09d5c0987925 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -232,8 +232,7 @@ static void br_multicast_group_expired(unsigned long data)
         if (!netif_running(br->dev) || timer_pending(&mp->timer))
                 goto out;
 
-        if (!hlist_unhashed(&mp->mglist))
-                hlist_del_init(&mp->mglist);
+        mp->mglist = false;
 
         if (mp->ports)
                 goto out;
@@ -276,7 +275,7 @@ static void br_multicast_del_pg(struct net_bridge *br,
                 del_timer(&p->query_timer);
                 call_rcu_bh(&p->rcu, br_multicast_free_pg);
 
-                if (!mp->ports && hlist_unhashed(&mp->mglist) &&
+                if (!mp->ports && !mp->mglist &&
                     netif_running(br->dev))
                         mod_timer(&mp->timer, jiffies);
 
@@ -528,7 +527,7 @@ static void br_multicast_group_query_expired(unsigned long data)
         struct net_bridge *br = mp->br;
 
         spin_lock(&br->multicast_lock);
-        if (!netif_running(br->dev) || hlist_unhashed(&mp->mglist) ||
+        if (!netif_running(br->dev) || !mp->mglist ||
             mp->queries_sent >= br->multicast_last_member_count)
                 goto out;
 
@@ -719,7 +718,7 @@ static int br_multicast_add_group(struct net_bridge *br,
                 goto err;
 
         if (!port) {
-                hlist_add_head(&mp->mglist, &br->mglist);
+                mp->mglist = true;
                 mod_timer(&mp->timer, now + br->multicast_membership_interval);
                 goto out;
         }
@@ -1165,7 +1164,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
 
         max_delay *= br->multicast_last_member_count;
 
-        if (!hlist_unhashed(&mp->mglist) &&
+        if (mp->mglist &&
             (timer_pending(&mp->timer) ?
              time_after(mp->timer.expires, now + max_delay) :
              try_to_del_timer_sync(&mp->timer) >= 0))
@@ -1177,7 +1176,7 @@ static int br_ip4_multicast_query(struct net_bridge *br,
                 if (timer_pending(&p->timer) ?
                     time_after(p->timer.expires, now + max_delay) :
                     try_to_del_timer_sync(&p->timer) >= 0)
-                        mod_timer(&mp->timer, now + max_delay);
+                        mod_timer(&p->timer, now + max_delay);
         }
 
 out:
@@ -1236,7 +1235,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 goto out;
 
         max_delay *= br->multicast_last_member_count;
-        if (!hlist_unhashed(&mp->mglist) &&
+        if (mp->mglist &&
             (timer_pending(&mp->timer) ?
              time_after(mp->timer.expires, now + max_delay) :
              try_to_del_timer_sync(&mp->timer) >= 0))
@@ -1248,7 +1247,7 @@ static int br_ip6_multicast_query(struct net_bridge *br,
                 if (timer_pending(&p->timer) ?
                     time_after(p->timer.expires, now + max_delay) :
                     try_to_del_timer_sync(&p->timer) >= 0)
-                        mod_timer(&mp->timer, now + max_delay);
+                        mod_timer(&p->timer, now + max_delay);
         }
 
 out:
@@ -1283,7 +1282,7 @@ static void br_multicast_leave_group(struct net_bridge *br,
                      br->multicast_last_member_interval;
 
         if (!port) {
-                if (!hlist_unhashed(&mp->mglist) &&
+                if (mp->mglist &&
                     (timer_pending(&mp->timer) ?
                      time_after(mp->timer.expires, time) :
                      try_to_del_timer_sync(&mp->timer) >= 0)) {
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 84aac7734bfc..4e1b620b6be6 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -84,13 +84,13 @@ struct net_bridge_port_group {
 struct net_bridge_mdb_entry
 {
         struct hlist_node               hlist[2];
-        struct hlist_node               mglist;
         struct net_bridge               *br;
         struct net_bridge_port_group __rcu *ports;
         struct rcu_head                 rcu;
         struct timer_list               timer;
         struct timer_list               query_timer;
         struct br_ip                    addr;
+        bool                            mglist;
         u32                             queries_sent;
 };
 
@@ -238,7 +238,6 @@ struct net_bridge
         spinlock_t                      multicast_lock;
         struct net_bridge_mdb_htable __rcu *mdb;
         struct hlist_head               router_list;
-        struct hlist_head               mglist;
 
         struct timer_list               multicast_router_timer;
         struct timer_list               multicast_querier_timer;
diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
index dff633d62e5b..35b36b86d762 100644
--- a/net/ceph/messenger.c
+++ b/net/ceph/messenger.c
@@ -252,8 +252,12 @@ static int ceph_tcp_recvmsg(struct socket *sock, void *buf, size_t len)
 {
         struct kvec iov = {buf, len};
         struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
+        int r;
 
-        return kernel_recvmsg(sock, &msg, &iov, 1, len, msg.msg_flags);
+        r = kernel_recvmsg(sock, &msg, &iov, 1, len, msg.msg_flags);
+        if (r == -EAGAIN)
+                r = 0;
+        return r;
 }
 
 /*
@@ -264,13 +268,17 @@ static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov,
                      size_t kvlen, size_t len, int more)
 {
         struct msghdr msg = { .msg_flags = MSG_DONTWAIT | MSG_NOSIGNAL };
+        int r;
 
         if (more)
                 msg.msg_flags |= MSG_MORE;
         else
                 msg.msg_flags |= MSG_EOR;  /* superfluous, but what the hell */
 
-        return kernel_sendmsg(sock, &msg, iov, kvlen, len);
+        r = kernel_sendmsg(sock, &msg, iov, kvlen, len);
+        if (r == -EAGAIN)
+                r = 0;
+        return r;
 }
 
 
@@ -847,6 +855,8 @@ static int write_partial_msg_pages(struct ceph_connection *con)
                     (msg->pages || msg->pagelist || msg->bio || in_trail))
                         kunmap(page);
 
+                if (ret == -EAGAIN)
+                        ret = 0;
                 if (ret <= 0)
                         goto out;
 
@@ -1737,16 +1747,12 @@ more_kvec:
         if (con->out_skip) {
                 ret = write_partial_skip(con);
                 if (ret <= 0)
-                        goto done;
-                if (ret < 0) {
-                        dout("try_write write_partial_skip err %d\n", ret);
-                        goto done;
-                }
+                        goto out;
         }
         if (con->out_kvec_left) {
                 ret = write_partial_kvec(con);
                 if (ret <= 0)
-                        goto done;
+                        goto out;
         }
 
         /* msg pages? */
@@ -1761,11 +1767,11 @@ more_kvec:
                 if (ret == 1)
                         goto more_kvec;  /* we need to send the footer, too! */
                 if (ret == 0)
-                        goto done;
+                        goto out;
                 if (ret < 0) {
                         dout("try_write write_partial_msg_pages err %d\n",
                              ret);
-                        goto done;
+                        goto out;
                 }
         }
 
@@ -1789,10 +1795,9 @@ do_next:
         /* Nothing to do! */
         clear_bit(WRITE_PENDING, &con->state);
         dout("try_write nothing else to write.\n");
-done:
         ret = 0;
 out:
-        dout("try_write done on %p\n", con);
+        dout("try_write done on %p ret %d\n", con, ret);
         return ret;
 }
 
@@ -1821,19 +1826,17 @@ more:
                         dout("try_read connecting\n");
                         ret = read_partial_banner(con);
                         if (ret <= 0)
-                                goto done;
-                        if (process_banner(con) < 0) {
-                                ret = -1;
                                 goto out;
-                        }
+                        ret = process_banner(con);
+                        if (ret < 0)
+                                goto out;
                 }
                 ret = read_partial_connect(con);
                 if (ret <= 0)
-                        goto done;
-                if (process_connect(con) < 0) {
-                        ret = -1;
                         goto out;
-                }
+                ret = process_connect(con);
+                if (ret < 0)
+                        goto out;
                 goto more;
         }
 
@@ -1848,7 +1851,7 @@ more:
                 dout("skipping %d / %d bytes\n", skip, -con->in_base_pos);
                 ret = ceph_tcp_recvmsg(con->sock, buf, skip);
                 if (ret <= 0)
-                        goto done;
+                        goto out;
                 con->in_base_pos += ret;
                 if (con->in_base_pos)
                         goto more;
@@ -1859,7 +1862,7 @@ more:
                  */
                 ret = ceph_tcp_recvmsg(con->sock, &con->in_tag, 1);
                 if (ret <= 0)
-                        goto done;
+                        goto out;
                 dout("try_read got tag %d\n", (int)con->in_tag);
                 switch (con->in_tag) {
                 case CEPH_MSGR_TAG_MSG:
@@ -1870,7 +1873,7 @@ more:
                         break;
                 case CEPH_MSGR_TAG_CLOSE:
                         set_bit(CLOSED, &con->state);   /* fixme */
-                        goto done;
+                        goto out;
                 default:
                         goto bad_tag;
                 }
@@ -1882,13 +1885,12 @@ more:
                         case -EBADMSG:
                                 con->error_msg = "bad crc";
                                 ret = -EIO;
-                                goto out;
+                                break;
                         case -EIO:
                                 con->error_msg = "io error";
-                                goto out;
-                        default:
-                                goto done;
+                                break;
                         }
+                        goto out;
                 }
                 if (con->in_tag == CEPH_MSGR_TAG_READY)
                         goto more;
@@ -1898,15 +1900,13 @@ more:
         if (con->in_tag == CEPH_MSGR_TAG_ACK) {
                 ret = read_partial_ack(con);
                 if (ret <= 0)
-                        goto done;
+                        goto out;
                 process_ack(con);
                 goto more;
         }
 
-done:
-        ret = 0;
 out:
-        dout("try_read done on %p\n", con);
+        dout("try_read done on %p ret %d\n", con, ret);
         return ret;
 
 bad_tag:
diff --git a/net/core/dev.c b/net/core/dev.c
index 8e726cb47ed7..8ae6631abcc2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1280,10 +1280,13 @@ static int __dev_close_many(struct list_head *head)
 
 static int __dev_close(struct net_device *dev)
 {
+        int retval;
         LIST_HEAD(single);
 
         list_add(&dev->unreg_list, &single);
-        return __dev_close_many(&single);
+        retval = __dev_close_many(&single);
+        list_del(&single);
+        return retval;
 }
 
 int dev_close_many(struct list_head *head)
@@ -1325,7 +1328,7 @@ int dev_close(struct net_device *dev)
 
         list_add(&dev->unreg_list, &single);
         dev_close_many(&single);
-
+        list_del(&single);
         return 0;
 }
 EXPORT_SYMBOL(dev_close);
@@ -5063,6 +5066,7 @@ static void rollback_registered(struct net_device *dev)
 
         list_add(&dev->unreg_list, &single);
         rollback_registered_many(&single);
+        list_del(&single);
 }
 
 unsigned long netdev_fix_features(unsigned long features, const char *name)
@@ -6216,6 +6220,7 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
                 }
         }
         unregister_netdevice_many(&dev_kill_list);
+        list_del(&dev_kill_list);
         rtnl_unlock();
 }
 
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 6b03f561caec..d5074a567289 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -626,6 +626,9 @@ static int dcbnl_getapp(struct net_device *netdev, struct nlattr **tb,
         dcb->cmd = DCB_CMD_GAPP;
 
         app_nest = nla_nest_start(dcbnl_skb, DCB_ATTR_APP);
+        if (!app_nest)
+                goto out_cancel;
+
         ret = nla_put_u8(dcbnl_skb, DCB_APP_ATTR_IDTYPE, idtype);
         if (ret)
                 goto out_cancel;
@@ -1613,6 +1616,10 @@ EXPORT_SYMBOL(dcb_getapp);
 u8 dcb_setapp(struct net_device *dev, struct dcb_app *new)
 {
         struct dcb_app_type *itr;
+        struct dcb_app_type event;
+
+        memcpy(&event.name, dev->name, sizeof(event.name));
+        memcpy(&event.app, new, sizeof(event.app));
 
         spin_lock(&dcb_lock);
         /* Search for existing match and replace */
@@ -1644,7 +1651,7 @@ u8 dcb_setapp(struct net_device *dev, struct dcb_app *new)
         }
 out:
         spin_unlock(&dcb_lock);
-        call_dcbevent_notifiers(DCB_APP_EVENT, new);
+        call_dcbevent_notifiers(DCB_APP_EVENT, &event);
         return 0;
 }
 EXPORT_SYMBOL(dcb_setapp);
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 748cb5b337bd..df4616fce929 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1030,6 +1030,21 @@ static inline bool inetdev_valid_mtu(unsigned mtu)
         return mtu >= 68;
 }
 
+static void inetdev_send_gratuitous_arp(struct net_device *dev,
+                                        struct in_device *in_dev)
+
+{
+        struct in_ifaddr *ifa = in_dev->ifa_list;
+
+        if (!ifa)
+                return;
+
+        arp_send(ARPOP_REQUEST, ETH_P_ARP,
+                 ifa->ifa_address, dev,
+                 ifa->ifa_address, NULL,
+                 dev->dev_addr, NULL);
+}
+
 /* Called only under RTNL semaphore */
 
 static int inetdev_event(struct notifier_block *this, unsigned long event,
@@ -1082,18 +1097,13 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
                 }
                 ip_mc_up(in_dev);
                 /* fall through */
-        case NETDEV_NOTIFY_PEERS:
         case NETDEV_CHANGEADDR:
+                if (!IN_DEV_ARP_NOTIFY(in_dev))
+                        break;
+                /* fall through */
+        case NETDEV_NOTIFY_PEERS:
                 /* Send gratuitous ARP to notify of link change */
-                if (IN_DEV_ARP_NOTIFY(in_dev)) {
-                        struct in_ifaddr *ifa = in_dev->ifa_list;
-
-                        if (ifa)
-                                arp_send(ARPOP_REQUEST, ETH_P_ARP,
-                                         ifa->ifa_address, dev,
-                                         ifa->ifa_address, NULL,
-                                         dev->dev_addr, NULL);
-                }
+                inetdev_send_gratuitous_arp(dev, in_dev);
                 break;
         case NETDEV_DOWN:
                 ip_mc_down(in_dev);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index eb68a0e34e49..6613edfac28c 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -775,6 +775,7 @@ static netdev_tx_t ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev
                         .fl4_dst = dst,
                         .fl4_src = tiph->saddr,
                         .fl4_tos = RT_TOS(tos),
+                        .proto = IPPROTO_GRE,
                         .fl_gre_key = tunnel->parms.o_key
                 };
                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 788a3e74834e..6ed6603c2f6d 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2722,6 +2722,7 @@ static struct dst_ops ipv4_dst_blackhole_ops = {
         .destroy                =       ipv4_dst_destroy,
         .check                  =       ipv4_blackhole_dst_check,
         .default_mtu            =       ipv4_blackhole_default_mtu,
+        .default_advmss         =       ipv4_default_advmss,
         .update_pmtu            =       ipv4_rt_blackhole_update_pmtu,
 };
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1c29f95695de..a998db6e7895 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -128,6 +128,7 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
         .default_mtu            =       ip6_blackhole_default_mtu,
+        .default_advmss         =       ip6_default_advmss,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
 };
 
diff --git a/net/mac80211/util.c b/net/mac80211/util.c
index cf68700abffa..d036597aabbe 100644
--- a/net/mac80211/util.c
+++ b/net/mac80211/util.c
@@ -1210,7 +1210,9 @@ int ieee80211_reconfig(struct ieee80211_local *local)
                 switch (sdata->vif.type) {
                 case NL80211_IFTYPE_STATION:
                         changed |= BSS_CHANGED_ASSOC;
+                        mutex_lock(&sdata->u.mgd.mtx);
                         ieee80211_bss_info_change_notify(sdata, changed);
+                        mutex_unlock(&sdata->u.mgd.mtx);
                         break;
                 case NL80211_IFTYPE_ADHOC:
                         changed |= BSS_CHANGED_IBSS;
diff --git a/net/netfilter/core.c b/net/netfilter/core.c
index 32fcbe290c04..4aa614b8a96a 100644
--- a/net/netfilter/core.c
+++ b/net/netfilter/core.c
@@ -133,6 +133,7 @@ unsigned int nf_iterate(struct list_head *head,
 
                 /* Optimization: we don't need to hold module
                    reference here, since function can't sleep. --RR */
+repeat:
                 verdict = elem->hook(hook, skb, indev, outdev, okfn);
                 if (verdict != NF_ACCEPT) {
 #ifdef CONFIG_NETFILTER_DEBUG
@@ -145,7 +146,7 @@ unsigned int nf_iterate(struct list_head *head,
 #endif
                         if (verdict != NF_REPEAT)
                                 return verdict;
-                        *i = (*i)->prev;
+                        goto repeat;
                 }
         }
         return NF_ACCEPT;
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 8b3ef404c794..6459588befc3 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1340,10 +1340,13 @@ static inline struct xfrm_dst *xfrm_alloc_dst(struct net *net, int family)
         default:
                 BUG();
         }
-        xdst = dst_alloc(dst_ops) ?: ERR_PTR(-ENOBUFS);
+        xdst = dst_alloc(dst_ops);
         xfrm_policy_put_afinfo(afinfo);
 
-        xdst->flo.ops = &xfrm_bundle_fc_ops;
+        if (likely(xdst))
+                xdst->flo.ops = &xfrm_bundle_fc_ops;
+        else
+                xdst = ERR_PTR(-ENOBUFS);
 
         return xdst;
 }