aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/bluetooth/af_bluetooth.c2
-rw-r--r--net/bluetooth/bnep/core.c2
-rw-r--r--net/bluetooth/hci_sysfs.c376
-rw-r--r--net/bluetooth/l2cap.c2
-rw-r--r--net/bluetooth/rfcomm/core.c2
-rw-r--r--net/bluetooth/sco.c2
-rw-r--r--net/bridge/br_device.c15
-rw-r--r--net/core/datagram.c87
-rw-r--r--net/core/dev.c49
-rw-r--r--net/core/gen_estimator.c9
-rw-r--r--net/core/skbuff.c12
-rw-r--r--net/dccp/input.c12
-rw-r--r--net/ipv4/icmp.c22
-rw-r--r--net/ipv4/netfilter/ipt_addrtype.c2
-rw-r--r--net/ipv4/netfilter/nf_nat_proto_common.c8
-rw-r--r--net/ipv4/route.c76
-rw-r--r--net/ipv6/addrconf.c4
-rw-r--r--net/ipv6/fib6_rules.c3
-rw-r--r--net/ipv6/icmp.c23
-rw-r--r--net/ipv6/ip6_fib.c1
-rw-r--r--net/ipv6/ip6_output.c2
-rw-r--r--net/ipv6/ipv6_sockglue.c4
-rw-r--r--net/ipv6/ndisc.c2
-rw-r--r--net/ipv6/route.c12
-rw-r--r--net/ipv6/xfrm6_policy.c4
-rw-r--r--net/mac80211/mlme.c2
-rw-r--r--net/netfilter/nf_conntrack_netlink.c36
-rw-r--r--net/rfkill/rfkill.c14
-rw-r--r--net/sched/cls_api.c2
-rw-r--r--net/sched/sch_api.c95
-rw-r--r--net/sched/sch_cbq.c6
-rw-r--r--net/sched/sch_generic.c67
-rw-r--r--net/sched/sch_htb.c4
-rw-r--r--net/sched/sch_prio.c4
-rw-r--r--net/sched/sch_tbf.c11
-rw-r--r--net/sctp/endpointola.c4
-rw-r--r--net/sctp/ipv6.c3
-rw-r--r--net/sctp/socket.c85
38 files changed, 651 insertions, 415 deletions
diff --git a/net/bluetooth/af_bluetooth.c b/net/bluetooth/af_bluetooth.c
index 4e59df5f8e05..1edfdf4c095b 100644
--- a/net/bluetooth/af_bluetooth.c
+++ b/net/bluetooth/af_bluetooth.c
@@ -456,7 +456,7 @@ static void __exit bt_exit(void)
456subsys_initcall(bt_init); 456subsys_initcall(bt_init);
457module_exit(bt_exit); 457module_exit(bt_exit);
458 458
459MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 459MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
460MODULE_DESCRIPTION("Bluetooth Core ver " VERSION); 460MODULE_DESCRIPTION("Bluetooth Core ver " VERSION);
461MODULE_VERSION(VERSION); 461MODULE_VERSION(VERSION);
462MODULE_LICENSE("GPL"); 462MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
index 12bba6207a8d..80ba30cf4b68 100644
--- a/net/bluetooth/bnep/core.c
+++ b/net/bluetooth/bnep/core.c
@@ -736,7 +736,7 @@ MODULE_PARM_DESC(compress_src, "Compress sources headers");
736module_param(compress_dst, bool, 0644); 736module_param(compress_dst, bool, 0644);
737MODULE_PARM_DESC(compress_dst, "Compress destination headers"); 737MODULE_PARM_DESC(compress_dst, "Compress destination headers");
738 738
739MODULE_AUTHOR("David Libault <david.libault@inventel.fr>, Maxim Krasnyansky <maxk@qualcomm.com>"); 739MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
740MODULE_DESCRIPTION("Bluetooth BNEP ver " VERSION); 740MODULE_DESCRIPTION("Bluetooth BNEP ver " VERSION);
741MODULE_VERSION(VERSION); 741MODULE_VERSION(VERSION);
742MODULE_LICENSE("GPL"); 742MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index c85bf8f678dc..f4f6615cad9f 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -3,8 +3,6 @@
3#include <linux/kernel.h> 3#include <linux/kernel.h>
4#include <linux/init.h> 4#include <linux/init.h>
5 5
6#include <linux/platform_device.h>
7
8#include <net/bluetooth/bluetooth.h> 6#include <net/bluetooth/bluetooth.h>
9#include <net/bluetooth/hci_core.h> 7#include <net/bluetooth/hci_core.h>
10 8
@@ -12,10 +10,164 @@
12#undef BT_DBG 10#undef BT_DBG
13#define BT_DBG(D...) 11#define BT_DBG(D...)
14#endif 12#endif
13
14struct class *bt_class = NULL;
15EXPORT_SYMBOL_GPL(bt_class);
16
15static struct workqueue_struct *btaddconn; 17static struct workqueue_struct *btaddconn;
16static struct workqueue_struct *btdelconn; 18static struct workqueue_struct *btdelconn;
17 19
18static inline char *typetostr(int type) 20static inline char *link_typetostr(int type)
21{
22 switch (type) {
23 case ACL_LINK:
24 return "ACL";
25 case SCO_LINK:
26 return "SCO";
27 case ESCO_LINK:
28 return "eSCO";
29 default:
30 return "UNKNOWN";
31 }
32}
33
34static ssize_t show_link_type(struct device *dev, struct device_attribute *attr, char *buf)
35{
36 struct hci_conn *conn = dev_get_drvdata(dev);
37 return sprintf(buf, "%s\n", link_typetostr(conn->type));
38}
39
40static ssize_t show_link_address(struct device *dev, struct device_attribute *attr, char *buf)
41{
42 struct hci_conn *conn = dev_get_drvdata(dev);
43 bdaddr_t bdaddr;
44 baswap(&bdaddr, &conn->dst);
45 return sprintf(buf, "%s\n", batostr(&bdaddr));
46}
47
48static ssize_t show_link_features(struct device *dev, struct device_attribute *attr, char *buf)
49{
50 struct hci_conn *conn = dev_get_drvdata(dev);
51
52 return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
53 conn->features[0], conn->features[1],
54 conn->features[2], conn->features[3],
55 conn->features[4], conn->features[5],
56 conn->features[6], conn->features[7]);
57}
58
59#define LINK_ATTR(_name,_mode,_show,_store) \
60struct device_attribute link_attr_##_name = __ATTR(_name,_mode,_show,_store)
61
62static LINK_ATTR(type, S_IRUGO, show_link_type, NULL);
63static LINK_ATTR(address, S_IRUGO, show_link_address, NULL);
64static LINK_ATTR(features, S_IRUGO, show_link_features, NULL);
65
66static struct attribute *bt_link_attrs[] = {
67 &link_attr_type.attr,
68 &link_attr_address.attr,
69 &link_attr_features.attr,
70 NULL
71};
72
73static struct attribute_group bt_link_group = {
74 .attrs = bt_link_attrs,
75};
76
77static struct attribute_group *bt_link_groups[] = {
78 &bt_link_group,
79 NULL
80};
81
82static void bt_link_release(struct device *dev)
83{
84 void *data = dev_get_drvdata(dev);
85 kfree(data);
86}
87
88static struct device_type bt_link = {
89 .name = "link",
90 .groups = bt_link_groups,
91 .release = bt_link_release,
92};
93
94static void add_conn(struct work_struct *work)
95{
96 struct hci_conn *conn = container_of(work, struct hci_conn, work);
97
98 flush_workqueue(btdelconn);
99
100 if (device_add(&conn->dev) < 0) {
101 BT_ERR("Failed to register connection device");
102 return;
103 }
104}
105
106void hci_conn_add_sysfs(struct hci_conn *conn)
107{
108 struct hci_dev *hdev = conn->hdev;
109
110 BT_DBG("conn %p", conn);
111
112 conn->dev.type = &bt_link;
113 conn->dev.class = bt_class;
114 conn->dev.parent = &hdev->dev;
115
116 snprintf(conn->dev.bus_id, BUS_ID_SIZE, "%s:%d",
117 hdev->name, conn->handle);
118
119 dev_set_drvdata(&conn->dev, conn);
120
121 device_initialize(&conn->dev);
122
123 INIT_WORK(&conn->work, add_conn);
124
125 queue_work(btaddconn, &conn->work);
126}
127
128/*
129 * The rfcomm tty device will possibly retain even when conn
130 * is down, and sysfs doesn't support move zombie device,
131 * so we should move the device before conn device is destroyed.
132 */
133static int __match_tty(struct device *dev, void *data)
134{
135 return !strncmp(dev->bus_id, "rfcomm", 6);
136}
137
138static void del_conn(struct work_struct *work)
139{
140 struct hci_conn *conn = container_of(work, struct hci_conn, work);
141 struct hci_dev *hdev = conn->hdev;
142
143 while (1) {
144 struct device *dev;
145
146 dev = device_find_child(&conn->dev, NULL, __match_tty);
147 if (!dev)
148 break;
149 device_move(dev, NULL);
150 put_device(dev);
151 }
152
153 device_del(&conn->dev);
154 put_device(&conn->dev);
155 hci_dev_put(hdev);
156}
157
158void hci_conn_del_sysfs(struct hci_conn *conn)
159{
160 BT_DBG("conn %p", conn);
161
162 if (!device_is_registered(&conn->dev))
163 return;
164
165 INIT_WORK(&conn->work, del_conn);
166
167 queue_work(btdelconn, &conn->work);
168}
169
170static inline char *host_typetostr(int type)
19{ 171{
20 switch (type) { 172 switch (type) {
21 case HCI_VIRTUAL: 173 case HCI_VIRTUAL:
@@ -40,7 +192,7 @@ static inline char *typetostr(int type)
40static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf) 192static ssize_t show_type(struct device *dev, struct device_attribute *attr, char *buf)
41{ 193{
42 struct hci_dev *hdev = dev_get_drvdata(dev); 194 struct hci_dev *hdev = dev_get_drvdata(dev);
43 return sprintf(buf, "%s\n", typetostr(hdev->type)); 195 return sprintf(buf, "%s\n", host_typetostr(hdev->type));
44} 196}
45 197
46static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf) 198static ssize_t show_name(struct device *dev, struct device_attribute *attr, char *buf)
@@ -221,183 +373,62 @@ static DEVICE_ATTR(sniff_max_interval, S_IRUGO | S_IWUSR,
221static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR, 373static DEVICE_ATTR(sniff_min_interval, S_IRUGO | S_IWUSR,
222 show_sniff_min_interval, store_sniff_min_interval); 374 show_sniff_min_interval, store_sniff_min_interval);
223 375
224static struct device_attribute *bt_attrs[] = { 376static struct attribute *bt_host_attrs[] = {
225 &dev_attr_type, 377 &dev_attr_type.attr,
226 &dev_attr_name, 378 &dev_attr_name.attr,
227 &dev_attr_class, 379 &dev_attr_class.attr,
228 &dev_attr_address, 380 &dev_attr_address.attr,
229 &dev_attr_features, 381 &dev_attr_features.attr,
230 &dev_attr_manufacturer, 382 &dev_attr_manufacturer.attr,
231 &dev_attr_hci_version, 383 &dev_attr_hci_version.attr,
232 &dev_attr_hci_revision, 384 &dev_attr_hci_revision.attr,
233 &dev_attr_inquiry_cache, 385 &dev_attr_inquiry_cache.attr,
234 &dev_attr_idle_timeout, 386 &dev_attr_idle_timeout.attr,
235 &dev_attr_sniff_max_interval, 387 &dev_attr_sniff_max_interval.attr,
236 &dev_attr_sniff_min_interval, 388 &dev_attr_sniff_min_interval.attr,
237 NULL 389 NULL
238}; 390};
239 391
240static ssize_t show_conn_type(struct device *dev, struct device_attribute *attr, char *buf) 392static struct attribute_group bt_host_group = {
241{ 393 .attrs = bt_host_attrs,
242 struct hci_conn *conn = dev_get_drvdata(dev);
243 return sprintf(buf, "%s\n", conn->type == ACL_LINK ? "ACL" : "SCO");
244}
245
246static ssize_t show_conn_address(struct device *dev, struct device_attribute *attr, char *buf)
247{
248 struct hci_conn *conn = dev_get_drvdata(dev);
249 bdaddr_t bdaddr;
250 baswap(&bdaddr, &conn->dst);
251 return sprintf(buf, "%s\n", batostr(&bdaddr));
252}
253
254static ssize_t show_conn_features(struct device *dev, struct device_attribute *attr, char *buf)
255{
256 struct hci_conn *conn = dev_get_drvdata(dev);
257
258 return sprintf(buf, "0x%02x%02x%02x%02x%02x%02x%02x%02x\n",
259 conn->features[0], conn->features[1],
260 conn->features[2], conn->features[3],
261 conn->features[4], conn->features[5],
262 conn->features[6], conn->features[7]);
263}
264
265#define CONN_ATTR(_name,_mode,_show,_store) \
266struct device_attribute conn_attr_##_name = __ATTR(_name,_mode,_show,_store)
267
268static CONN_ATTR(type, S_IRUGO, show_conn_type, NULL);
269static CONN_ATTR(address, S_IRUGO, show_conn_address, NULL);
270static CONN_ATTR(features, S_IRUGO, show_conn_features, NULL);
271
272static struct device_attribute *conn_attrs[] = {
273 &conn_attr_type,
274 &conn_attr_address,
275 &conn_attr_features,
276 NULL
277}; 394};
278 395
279struct class *bt_class = NULL; 396static struct attribute_group *bt_host_groups[] = {
280EXPORT_SYMBOL_GPL(bt_class); 397 &bt_host_group,
281 398 NULL
282static struct bus_type bt_bus = {
283 .name = "bluetooth",
284}; 399};
285 400
286static struct platform_device *bt_platform; 401static void bt_host_release(struct device *dev)
287
288static void bt_release(struct device *dev)
289{ 402{
290 void *data = dev_get_drvdata(dev); 403 void *data = dev_get_drvdata(dev);
291 kfree(data); 404 kfree(data);
292} 405}
293 406
294static void add_conn(struct work_struct *work) 407static struct device_type bt_host = {
295{ 408 .name = "host",
296 struct hci_conn *conn = container_of(work, struct hci_conn, work); 409 .groups = bt_host_groups,
297 int i; 410 .release = bt_host_release,
298 411};
299 flush_workqueue(btdelconn);
300
301 if (device_add(&conn->dev) < 0) {
302 BT_ERR("Failed to register connection device");
303 return;
304 }
305
306 for (i = 0; conn_attrs[i]; i++)
307 if (device_create_file(&conn->dev, conn_attrs[i]) < 0)
308 BT_ERR("Failed to create connection attribute");
309}
310
311void hci_conn_add_sysfs(struct hci_conn *conn)
312{
313 struct hci_dev *hdev = conn->hdev;
314
315 BT_DBG("conn %p", conn);
316
317 conn->dev.bus = &bt_bus;
318 conn->dev.parent = &hdev->dev;
319
320 conn->dev.release = bt_release;
321
322 snprintf(conn->dev.bus_id, BUS_ID_SIZE, "%s:%d",
323 hdev->name, conn->handle);
324
325 dev_set_drvdata(&conn->dev, conn);
326
327 device_initialize(&conn->dev);
328
329 INIT_WORK(&conn->work, add_conn);
330
331 queue_work(btaddconn, &conn->work);
332}
333
334/*
335 * The rfcomm tty device will possibly retain even when conn
336 * is down, and sysfs doesn't support move zombie device,
337 * so we should move the device before conn device is destroyed.
338 */
339static int __match_tty(struct device *dev, void *data)
340{
341 return !strncmp(dev->bus_id, "rfcomm", 6);
342}
343
344static void del_conn(struct work_struct *work)
345{
346 struct hci_conn *conn = container_of(work, struct hci_conn, work);
347 struct hci_dev *hdev = conn->hdev;
348
349 while (1) {
350 struct device *dev;
351
352 dev = device_find_child(&conn->dev, NULL, __match_tty);
353 if (!dev)
354 break;
355 device_move(dev, NULL);
356 put_device(dev);
357 }
358
359 device_del(&conn->dev);
360 put_device(&conn->dev);
361 hci_dev_put(hdev);
362}
363
364void hci_conn_del_sysfs(struct hci_conn *conn)
365{
366 BT_DBG("conn %p", conn);
367
368 if (!device_is_registered(&conn->dev))
369 return;
370
371 INIT_WORK(&conn->work, del_conn);
372
373 queue_work(btdelconn, &conn->work);
374}
375 412
376int hci_register_sysfs(struct hci_dev *hdev) 413int hci_register_sysfs(struct hci_dev *hdev)
377{ 414{
378 struct device *dev = &hdev->dev; 415 struct device *dev = &hdev->dev;
379 unsigned int i;
380 int err; 416 int err;
381 417
382 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type); 418 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
383 419
384 dev->bus = &bt_bus; 420 dev->type = &bt_host;
421 dev->class = bt_class;
385 dev->parent = hdev->parent; 422 dev->parent = hdev->parent;
386 423
387 strlcpy(dev->bus_id, hdev->name, BUS_ID_SIZE); 424 strlcpy(dev->bus_id, hdev->name, BUS_ID_SIZE);
388 425
389 dev->release = bt_release;
390
391 dev_set_drvdata(dev, hdev); 426 dev_set_drvdata(dev, hdev);
392 427
393 err = device_register(dev); 428 err = device_register(dev);
394 if (err < 0) 429 if (err < 0)
395 return err; 430 return err;
396 431
397 for (i = 0; bt_attrs[i]; i++)
398 if (device_create_file(dev, bt_attrs[i]) < 0)
399 BT_ERR("Failed to create device attribute");
400
401 return 0; 432 return 0;
402} 433}
403 434
@@ -410,59 +441,30 @@ void hci_unregister_sysfs(struct hci_dev *hdev)
410 441
411int __init bt_sysfs_init(void) 442int __init bt_sysfs_init(void)
412{ 443{
413 int err;
414
415 btaddconn = create_singlethread_workqueue("btaddconn"); 444 btaddconn = create_singlethread_workqueue("btaddconn");
416 if (!btaddconn) { 445 if (!btaddconn)
417 err = -ENOMEM; 446 return -ENOMEM;
418 goto out;
419 }
420 447
421 btdelconn = create_singlethread_workqueue("btdelconn"); 448 btdelconn = create_singlethread_workqueue("btdelconn");
422 if (!btdelconn) { 449 if (!btdelconn) {
423 err = -ENOMEM; 450 destroy_workqueue(btaddconn);
424 goto out_del; 451 return -ENOMEM;
425 }
426
427 bt_platform = platform_device_register_simple("bluetooth", -1, NULL, 0);
428 if (IS_ERR(bt_platform)) {
429 err = PTR_ERR(bt_platform);
430 goto out_platform;
431 } 452 }
432 453
433 err = bus_register(&bt_bus);
434 if (err < 0)
435 goto out_bus;
436
437 bt_class = class_create(THIS_MODULE, "bluetooth"); 454 bt_class = class_create(THIS_MODULE, "bluetooth");
438 if (IS_ERR(bt_class)) { 455 if (IS_ERR(bt_class)) {
439 err = PTR_ERR(bt_class); 456 destroy_workqueue(btdelconn);
440 goto out_class; 457 destroy_workqueue(btaddconn);
458 return PTR_ERR(bt_class);
441 } 459 }
442 460
443 return 0; 461 return 0;
444
445out_class:
446 bus_unregister(&bt_bus);
447out_bus:
448 platform_device_unregister(bt_platform);
449out_platform:
450 destroy_workqueue(btdelconn);
451out_del:
452 destroy_workqueue(btaddconn);
453out:
454 return err;
455} 462}
456 463
457void bt_sysfs_cleanup(void) 464void bt_sysfs_cleanup(void)
458{ 465{
459 destroy_workqueue(btaddconn); 466 destroy_workqueue(btaddconn);
460
461 destroy_workqueue(btdelconn); 467 destroy_workqueue(btdelconn);
462 468
463 class_destroy(bt_class); 469 class_destroy(bt_class);
464
465 bus_unregister(&bt_bus);
466
467 platform_device_unregister(bt_platform);
468} 470}
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index c1239852834a..3396d5bdef1c 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2516,7 +2516,7 @@ EXPORT_SYMBOL(l2cap_load);
2516module_init(l2cap_init); 2516module_init(l2cap_init);
2517module_exit(l2cap_exit); 2517module_exit(l2cap_exit);
2518 2518
2519MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 2519MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2520MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION); 2520MODULE_DESCRIPTION("Bluetooth L2CAP ver " VERSION);
2521MODULE_VERSION(VERSION); 2521MODULE_VERSION(VERSION);
2522MODULE_LICENSE("GPL"); 2522MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index 6cfc7ba611b3..ba537fae0a4c 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2115,7 +2115,7 @@ MODULE_PARM_DESC(channel_mtu, "Default MTU for the RFCOMM channel");
2115module_param(l2cap_mtu, uint, 0644); 2115module_param(l2cap_mtu, uint, 0644);
2116MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection"); 2116MODULE_PARM_DESC(l2cap_mtu, "Default MTU for the L2CAP connection");
2117 2117
2118MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 2118MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
2119MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION); 2119MODULE_DESCRIPTION("Bluetooth RFCOMM ver " VERSION);
2120MODULE_VERSION(VERSION); 2120MODULE_VERSION(VERSION);
2121MODULE_LICENSE("GPL"); 2121MODULE_LICENSE("GPL");
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index 8cda49874868..a16011fedc1d 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -1002,7 +1002,7 @@ module_exit(sco_exit);
1002module_param(disable_esco, bool, 0644); 1002module_param(disable_esco, bool, 0644);
1003MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation"); 1003MODULE_PARM_DESC(disable_esco, "Disable eSCO connection creation");
1004 1004
1005MODULE_AUTHOR("Maxim Krasnyansky <maxk@qualcomm.com>, Marcel Holtmann <marcel@holtmann.org>"); 1005MODULE_AUTHOR("Marcel Holtmann <marcel@holtmann.org>");
1006MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION); 1006MODULE_DESCRIPTION("Bluetooth SCO ver " VERSION);
1007MODULE_VERSION(VERSION); 1007MODULE_VERSION(VERSION);
1008MODULE_LICENSE("GPL"); 1008MODULE_LICENSE("GPL");
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index 9b58d70b0e7d..4f52c3d50ebe 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -148,11 +148,16 @@ static int br_set_tx_csum(struct net_device *dev, u32 data)
148} 148}
149 149
150static struct ethtool_ops br_ethtool_ops = { 150static struct ethtool_ops br_ethtool_ops = {
151 .get_drvinfo = br_getinfo, 151 .get_drvinfo = br_getinfo,
152 .get_link = ethtool_op_get_link, 152 .get_link = ethtool_op_get_link,
153 .set_sg = br_set_sg, 153 .get_tx_csum = ethtool_op_get_tx_csum,
154 .set_tx_csum = br_set_tx_csum, 154 .set_tx_csum = br_set_tx_csum,
155 .set_tso = br_set_tso, 155 .get_sg = ethtool_op_get_sg,
156 .set_sg = br_set_sg,
157 .get_tso = ethtool_op_get_tso,
158 .set_tso = br_set_tso,
159 .get_ufo = ethtool_op_get_ufo,
160 .get_flags = ethtool_op_get_flags,
156}; 161};
157 162
158void br_dev_setup(struct net_device *dev) 163void br_dev_setup(struct net_device *dev)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index dd61dcad6019..52f577a0f544 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -339,6 +339,93 @@ fault:
339 return -EFAULT; 339 return -EFAULT;
340} 340}
341 341
342/**
343 * skb_copy_datagram_from_iovec - Copy a datagram from an iovec.
344 * @skb: buffer to copy
345 * @offset: offset in the buffer to start copying to
346 * @from: io vector to copy to
347 * @len: amount of data to copy to buffer from iovec
348 *
349 * Returns 0 or -EFAULT.
350 * Note: the iovec is modified during the copy.
351 */
352int skb_copy_datagram_from_iovec(struct sk_buff *skb, int offset,
353 struct iovec *from, int len)
354{
355 int start = skb_headlen(skb);
356 int i, copy = start - offset;
357
358 /* Copy header. */
359 if (copy > 0) {
360 if (copy > len)
361 copy = len;
362 if (memcpy_fromiovec(skb->data + offset, from, copy))
363 goto fault;
364 if ((len -= copy) == 0)
365 return 0;
366 offset += copy;
367 }
368
369 /* Copy paged appendix. Hmm... why does this look so complicated? */
370 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
371 int end;
372
373 WARN_ON(start > offset + len);
374
375 end = start + skb_shinfo(skb)->frags[i].size;
376 if ((copy = end - offset) > 0) {
377 int err;
378 u8 *vaddr;
379 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
380 struct page *page = frag->page;
381
382 if (copy > len)
383 copy = len;
384 vaddr = kmap(page);
385 err = memcpy_fromiovec(vaddr + frag->page_offset +
386 offset - start, from, copy);
387 kunmap(page);
388 if (err)
389 goto fault;
390
391 if (!(len -= copy))
392 return 0;
393 offset += copy;
394 }
395 start = end;
396 }
397
398 if (skb_shinfo(skb)->frag_list) {
399 struct sk_buff *list = skb_shinfo(skb)->frag_list;
400
401 for (; list; list = list->next) {
402 int end;
403
404 WARN_ON(start > offset + len);
405
406 end = start + list->len;
407 if ((copy = end - offset) > 0) {
408 if (copy > len)
409 copy = len;
410 if (skb_copy_datagram_from_iovec(list,
411 offset - start,
412 from, copy))
413 goto fault;
414 if ((len -= copy) == 0)
415 return 0;
416 offset += copy;
417 }
418 start = end;
419 }
420 }
421 if (!len)
422 return 0;
423
424fault:
425 return -EFAULT;
426}
427EXPORT_SYMBOL(skb_copy_datagram_from_iovec);
428
342static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset, 429static int skb_copy_and_csum_datagram(const struct sk_buff *skb, int offset,
343 u8 __user *to, int len, 430 u8 __user *to, int len,
344 __wsum *csump) 431 __wsum *csump)
diff --git a/net/core/dev.c b/net/core/dev.c
index 600bb23c4c2e..60c51f765887 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1339,19 +1339,23 @@ static void dev_queue_xmit_nit(struct sk_buff *skb, struct net_device *dev)
1339} 1339}
1340 1340
1341 1341
1342void __netif_schedule(struct Qdisc *q) 1342static inline void __netif_reschedule(struct Qdisc *q)
1343{ 1343{
1344 if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state)) { 1344 struct softnet_data *sd;
1345 struct softnet_data *sd; 1345 unsigned long flags;
1346 unsigned long flags;
1347 1346
1348 local_irq_save(flags); 1347 local_irq_save(flags);
1349 sd = &__get_cpu_var(softnet_data); 1348 sd = &__get_cpu_var(softnet_data);
1350 q->next_sched = sd->output_queue; 1349 q->next_sched = sd->output_queue;
1351 sd->output_queue = q; 1350 sd->output_queue = q;
1352 raise_softirq_irqoff(NET_TX_SOFTIRQ); 1351 raise_softirq_irqoff(NET_TX_SOFTIRQ);
1353 local_irq_restore(flags); 1352 local_irq_restore(flags);
1354 } 1353}
1354
1355void __netif_schedule(struct Qdisc *q)
1356{
1357 if (!test_and_set_bit(__QDISC_STATE_SCHED, &q->state))
1358 __netif_reschedule(q);
1355} 1359}
1356EXPORT_SYMBOL(__netif_schedule); 1360EXPORT_SYMBOL(__netif_schedule);
1357 1361
@@ -1800,9 +1804,13 @@ gso:
1800 1804
1801 spin_lock(root_lock); 1805 spin_lock(root_lock);
1802 1806
1803 rc = qdisc_enqueue_root(skb, q); 1807 if (unlikely(test_bit(__QDISC_STATE_DEACTIVATED, &q->state))) {
1804 qdisc_run(q); 1808 kfree_skb(skb);
1805 1809 rc = NET_XMIT_DROP;
1810 } else {
1811 rc = qdisc_enqueue_root(skb, q);
1812 qdisc_run(q);
1813 }
1806 spin_unlock(root_lock); 1814 spin_unlock(root_lock);
1807 1815
1808 goto out; 1816 goto out;
@@ -1974,15 +1982,17 @@ static void net_tx_action(struct softirq_action *h)
1974 1982
1975 head = head->next_sched; 1983 head = head->next_sched;
1976 1984
1977 smp_mb__before_clear_bit();
1978 clear_bit(__QDISC_STATE_SCHED, &q->state);
1979
1980 root_lock = qdisc_lock(q); 1985 root_lock = qdisc_lock(q);
1981 if (spin_trylock(root_lock)) { 1986 if (spin_trylock(root_lock)) {
1987 smp_mb__before_clear_bit();
1988 clear_bit(__QDISC_STATE_SCHED,
1989 &q->state);
1982 qdisc_run(q); 1990 qdisc_run(q);
1983 spin_unlock(root_lock); 1991 spin_unlock(root_lock);
1984 } else { 1992 } else {
1985 __netif_schedule(q); 1993 if (!test_bit(__QDISC_STATE_DEACTIVATED,
1994 &q->state))
1995 __netif_reschedule(q);
1986 } 1996 }
1987 } 1997 }
1988 } 1998 }
@@ -2084,7 +2094,8 @@ static int ing_filter(struct sk_buff *skb)
2084 q = rxq->qdisc; 2094 q = rxq->qdisc;
2085 if (q != &noop_qdisc) { 2095 if (q != &noop_qdisc) {
2086 spin_lock(qdisc_lock(q)); 2096 spin_lock(qdisc_lock(q));
2087 result = qdisc_enqueue_root(skb, q); 2097 if (likely(!test_bit(__QDISC_STATE_DEACTIVATED, &q->state)))
2098 result = qdisc_enqueue_root(skb, q);
2088 spin_unlock(qdisc_lock(q)); 2099 spin_unlock(qdisc_lock(q));
2089 } 2100 }
2090 2101
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index a89f32fa94f6..57abe8266be1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -99,7 +99,7 @@ struct gen_estimator_head
99 99
100static struct gen_estimator_head elist[EST_MAX_INTERVAL+1]; 100static struct gen_estimator_head elist[EST_MAX_INTERVAL+1];
101 101
102/* Protects against NULL dereference and RCU write-side */ 102/* Protects against NULL dereference */
103static DEFINE_RWLOCK(est_lock); 103static DEFINE_RWLOCK(est_lock);
104 104
105static void est_timer(unsigned long arg) 105static void est_timer(unsigned long arg)
@@ -185,7 +185,6 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
185 est->last_packets = bstats->packets; 185 est->last_packets = bstats->packets;
186 est->avpps = rate_est->pps<<10; 186 est->avpps = rate_est->pps<<10;
187 187
188 write_lock_bh(&est_lock);
189 if (!elist[idx].timer.function) { 188 if (!elist[idx].timer.function) {
190 INIT_LIST_HEAD(&elist[idx].list); 189 INIT_LIST_HEAD(&elist[idx].list);
191 setup_timer(&elist[idx].timer, est_timer, idx); 190 setup_timer(&elist[idx].timer, est_timer, idx);
@@ -195,7 +194,6 @@ int gen_new_estimator(struct gnet_stats_basic *bstats,
195 mod_timer(&elist[idx].timer, jiffies + ((HZ/4) << idx)); 194 mod_timer(&elist[idx].timer, jiffies + ((HZ/4) << idx));
196 195
197 list_add_rcu(&est->list, &elist[idx].list); 196 list_add_rcu(&est->list, &elist[idx].list);
198 write_unlock_bh(&est_lock);
199 return 0; 197 return 0;
200} 198}
201 199
@@ -214,6 +212,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
214 * Removes the rate estimator specified by &bstats and &rate_est 212 * Removes the rate estimator specified by &bstats and &rate_est
215 * and deletes the timer. 213 * and deletes the timer.
216 * 214 *
215 * NOTE: Called under rtnl_mutex
217 */ 216 */
218void gen_kill_estimator(struct gnet_stats_basic *bstats, 217void gen_kill_estimator(struct gnet_stats_basic *bstats,
219 struct gnet_stats_rate_est *rate_est) 218 struct gnet_stats_rate_est *rate_est)
@@ -227,17 +226,17 @@ void gen_kill_estimator(struct gnet_stats_basic *bstats,
227 if (!elist[idx].timer.function) 226 if (!elist[idx].timer.function)
228 continue; 227 continue;
229 228
230 write_lock_bh(&est_lock);
231 list_for_each_entry_safe(e, n, &elist[idx].list, list) { 229 list_for_each_entry_safe(e, n, &elist[idx].list, list) {
232 if (e->rate_est != rate_est || e->bstats != bstats) 230 if (e->rate_est != rate_est || e->bstats != bstats)
233 continue; 231 continue;
234 232
233 write_lock_bh(&est_lock);
235 e->bstats = NULL; 234 e->bstats = NULL;
235 write_unlock_bh(&est_lock);
236 236
237 list_del_rcu(&e->list); 237 list_del_rcu(&e->list);
238 call_rcu(&e->e_rcu, __gen_kill_estimator); 238 call_rcu(&e->e_rcu, __gen_kill_estimator);
239 } 239 }
240 write_unlock_bh(&est_lock);
241 } 240 }
242} 241}
243 242
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 84640172d65d..ca1ccdf1ef76 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2256,14 +2256,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
2256 segs = nskb; 2256 segs = nskb;
2257 tail = nskb; 2257 tail = nskb;
2258 2258
2259 nskb->dev = skb->dev; 2259 __copy_skb_header(nskb, skb);
2260 skb_copy_queue_mapping(nskb, skb);
2261 nskb->priority = skb->priority;
2262 nskb->protocol = skb->protocol;
2263 nskb->vlan_tci = skb->vlan_tci;
2264 nskb->dst = dst_clone(skb->dst);
2265 memcpy(nskb->cb, skb->cb, sizeof(skb->cb));
2266 nskb->pkt_type = skb->pkt_type;
2267 nskb->mac_len = skb->mac_len; 2260 nskb->mac_len = skb->mac_len;
2268 2261
2269 skb_reserve(nskb, headroom); 2262 skb_reserve(nskb, headroom);
@@ -2274,6 +2267,7 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
2274 skb_copy_from_linear_data(skb, skb_put(nskb, doffset), 2267 skb_copy_from_linear_data(skb, skb_put(nskb, doffset),
2275 doffset); 2268 doffset);
2276 if (!sg) { 2269 if (!sg) {
2270 nskb->ip_summed = CHECKSUM_NONE;
2277 nskb->csum = skb_copy_and_csum_bits(skb, offset, 2271 nskb->csum = skb_copy_and_csum_bits(skb, offset,
2278 skb_put(nskb, len), 2272 skb_put(nskb, len),
2279 len, 0); 2273 len, 0);
@@ -2283,8 +2277,6 @@ struct sk_buff *skb_segment(struct sk_buff *skb, int features)
2283 frag = skb_shinfo(nskb)->frags; 2277 frag = skb_shinfo(nskb)->frags;
2284 k = 0; 2278 k = 0;
2285 2279
2286 nskb->ip_summed = CHECKSUM_PARTIAL;
2287 nskb->csum = skb->csum;
2288 skb_copy_from_linear_data_offset(skb, offset, 2280 skb_copy_from_linear_data_offset(skb, offset,
2289 skb_put(nskb, hsize), hsize); 2281 skb_put(nskb, hsize), hsize);
2290 2282
diff --git a/net/dccp/input.c b/net/dccp/input.c
index df2f110df94a..803933ab396d 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -411,12 +411,6 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
411 struct dccp_sock *dp = dccp_sk(sk); 411 struct dccp_sock *dp = dccp_sk(sk);
412 long tstamp = dccp_timestamp(); 412 long tstamp = dccp_timestamp();
413 413
414 /* Stop the REQUEST timer */
415 inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
416 WARN_ON(sk->sk_send_head == NULL);
417 __kfree_skb(sk->sk_send_head);
418 sk->sk_send_head = NULL;
419
420 if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq, 414 if (!between48(DCCP_SKB_CB(skb)->dccpd_ack_seq,
421 dp->dccps_awl, dp->dccps_awh)) { 415 dp->dccps_awl, dp->dccps_awh)) {
422 dccp_pr_debug("invalid ackno: S.AWL=%llu, " 416 dccp_pr_debug("invalid ackno: S.AWL=%llu, "
@@ -441,6 +435,12 @@ static int dccp_rcv_request_sent_state_process(struct sock *sk,
441 DCCP_ACKVEC_STATE_RECEIVED)) 435 DCCP_ACKVEC_STATE_RECEIVED))
442 goto out_invalid_packet; /* FIXME: change error code */ 436 goto out_invalid_packet; /* FIXME: change error code */
443 437
438 /* Stop the REQUEST timer */
439 inet_csk_clear_xmit_timer(sk, ICSK_TIME_RETRANS);
440 WARN_ON(sk->sk_send_head == NULL);
441 kfree_skb(sk->sk_send_head);
442 sk->sk_send_head = NULL;
443
444 dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq; 444 dp->dccps_isr = DCCP_SKB_CB(skb)->dccpd_seq;
445 dccp_update_gsr(sk, dp->dccps_isr); 445 dccp_update_gsr(sk, dp->dccps_isr);
446 /* 446 /*
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 860558633b2c..55c355e63234 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -204,18 +204,22 @@ static struct sock *icmp_sk(struct net *net)
204 return net->ipv4.icmp_sk[smp_processor_id()]; 204 return net->ipv4.icmp_sk[smp_processor_id()];
205} 205}
206 206
207static inline int icmp_xmit_lock(struct sock *sk) 207static inline struct sock *icmp_xmit_lock(struct net *net)
208{ 208{
209 struct sock *sk;
210
209 local_bh_disable(); 211 local_bh_disable();
210 212
213 sk = icmp_sk(net);
214
211 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) { 215 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
212 /* This can happen if the output path signals a 216 /* This can happen if the output path signals a
213 * dst_link_failure() for an outgoing ICMP packet. 217 * dst_link_failure() for an outgoing ICMP packet.
214 */ 218 */
215 local_bh_enable(); 219 local_bh_enable();
216 return 1; 220 return NULL;
217 } 221 }
218 return 0; 222 return sk;
219} 223}
220 224
221static inline void icmp_xmit_unlock(struct sock *sk) 225static inline void icmp_xmit_unlock(struct sock *sk)
@@ -354,15 +358,17 @@ static void icmp_reply(struct icmp_bxm *icmp_param, struct sk_buff *skb)
354 struct ipcm_cookie ipc; 358 struct ipcm_cookie ipc;
355 struct rtable *rt = skb->rtable; 359 struct rtable *rt = skb->rtable;
356 struct net *net = dev_net(rt->u.dst.dev); 360 struct net *net = dev_net(rt->u.dst.dev);
357 struct sock *sk = icmp_sk(net); 361 struct sock *sk;
358 struct inet_sock *inet = inet_sk(sk); 362 struct inet_sock *inet;
359 __be32 daddr; 363 __be32 daddr;
360 364
361 if (ip_options_echo(&icmp_param->replyopts, skb)) 365 if (ip_options_echo(&icmp_param->replyopts, skb))
362 return; 366 return;
363 367
364 if (icmp_xmit_lock(sk)) 368 sk = icmp_xmit_lock(net);
369 if (sk == NULL)
365 return; 370 return;
371 inet = inet_sk(sk);
366 372
367 icmp_param->data.icmph.checksum = 0; 373 icmp_param->data.icmph.checksum = 0;
368 374
@@ -419,7 +425,6 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
419 if (!rt) 425 if (!rt)
420 goto out; 426 goto out;
421 net = dev_net(rt->u.dst.dev); 427 net = dev_net(rt->u.dst.dev);
422 sk = icmp_sk(net);
423 428
424 /* 429 /*
425 * Find the original header. It is expected to be valid, of course. 430 * Find the original header. It is expected to be valid, of course.
@@ -483,7 +488,8 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
483 } 488 }
484 } 489 }
485 490
486 if (icmp_xmit_lock(sk)) 491 sk = icmp_xmit_lock(net);
492 if (sk == NULL)
487 return; 493 return;
488 494
489 /* 495 /*
diff --git a/net/ipv4/netfilter/ipt_addrtype.c b/net/ipv4/netfilter/ipt_addrtype.c
index 49587a497229..462a22c97877 100644
--- a/net/ipv4/netfilter/ipt_addrtype.c
+++ b/net/ipv4/netfilter/ipt_addrtype.c
@@ -70,7 +70,7 @@ addrtype_mt_v1(const struct sk_buff *skb, const struct net_device *in,
70 (info->flags & IPT_ADDRTYPE_INVERT_SOURCE); 70 (info->flags & IPT_ADDRTYPE_INVERT_SOURCE);
71 if (ret && info->dest) 71 if (ret && info->dest)
72 ret &= match_type(dev, iph->daddr, info->dest) ^ 72 ret &= match_type(dev, iph->daddr, info->dest) ^
73 (info->flags & IPT_ADDRTYPE_INVERT_DEST); 73 !!(info->flags & IPT_ADDRTYPE_INVERT_DEST);
74 return ret; 74 return ret;
75} 75}
76 76
diff --git a/net/ipv4/netfilter/nf_nat_proto_common.c b/net/ipv4/netfilter/nf_nat_proto_common.c
index 91537f11273f..6c4f11f51446 100644
--- a/net/ipv4/netfilter/nf_nat_proto_common.c
+++ b/net/ipv4/netfilter/nf_nat_proto_common.c
@@ -73,9 +73,13 @@ bool nf_nat_proto_unique_tuple(struct nf_conntrack_tuple *tuple,
73 range_size = ntohs(range->max.all) - min + 1; 73 range_size = ntohs(range->max.all) - min + 1;
74 } 74 }
75 75
76 off = *rover;
77 if (range->flags & IP_NAT_RANGE_PROTO_RANDOM) 76 if (range->flags & IP_NAT_RANGE_PROTO_RANDOM)
78 off = net_random(); 77 off = secure_ipv4_port_ephemeral(tuple->src.u3.ip, tuple->dst.u3.ip,
78 maniptype == IP_NAT_MANIP_SRC
79 ? tuple->dst.u.all
80 : tuple->src.u.all);
81 else
82 off = *rover;
79 83
80 for (i = 0; i < range_size; i++, off++) { 84 for (i = 0; i < range_size; i++, off++) {
81 *portptr = htons(min + off % range_size); 85 *portptr = htons(min + off % range_size);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 16fc6f454a31..cca921ea8550 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2914,6 +2914,68 @@ static int ipv4_sysctl_rtcache_flush_strategy(ctl_table *table,
2914 return 0; 2914 return 0;
2915} 2915}
2916 2916
2917static void rt_secret_reschedule(int old)
2918{
2919 struct net *net;
2920 int new = ip_rt_secret_interval;
2921 int diff = new - old;
2922
2923 if (!diff)
2924 return;
2925
2926 rtnl_lock();
2927 for_each_net(net) {
2928 int deleted = del_timer_sync(&net->ipv4.rt_secret_timer);
2929
2930 if (!new)
2931 continue;
2932
2933 if (deleted) {
2934 long time = net->ipv4.rt_secret_timer.expires - jiffies;
2935
2936 if (time <= 0 || (time += diff) <= 0)
2937 time = 0;
2938
2939 net->ipv4.rt_secret_timer.expires = time;
2940 } else
2941 net->ipv4.rt_secret_timer.expires = new;
2942
2943 net->ipv4.rt_secret_timer.expires += jiffies;
2944 add_timer(&net->ipv4.rt_secret_timer);
2945 }
2946 rtnl_unlock();
2947}
2948
2949static int ipv4_sysctl_rt_secret_interval(ctl_table *ctl, int write,
2950 struct file *filp,
2951 void __user *buffer, size_t *lenp,
2952 loff_t *ppos)
2953{
2954 int old = ip_rt_secret_interval;
2955 int ret = proc_dointvec_jiffies(ctl, write, filp, buffer, lenp, ppos);
2956
2957 rt_secret_reschedule(old);
2958
2959 return ret;
2960}
2961
2962static int ipv4_sysctl_rt_secret_interval_strategy(ctl_table *table,
2963 int __user *name,
2964 int nlen,
2965 void __user *oldval,
2966 size_t __user *oldlenp,
2967 void __user *newval,
2968 size_t newlen)
2969{
2970 int old = ip_rt_secret_interval;
2971 int ret = sysctl_jiffies(table, name, nlen, oldval, oldlenp, newval,
2972 newlen);
2973
2974 rt_secret_reschedule(old);
2975
2976 return ret;
2977}
2978
2917static ctl_table ipv4_route_table[] = { 2979static ctl_table ipv4_route_table[] = {
2918 { 2980 {
2919 .ctl_name = NET_IPV4_ROUTE_GC_THRESH, 2981 .ctl_name = NET_IPV4_ROUTE_GC_THRESH,
@@ -3048,8 +3110,8 @@ static ctl_table ipv4_route_table[] = {
3048 .data = &ip_rt_secret_interval, 3110 .data = &ip_rt_secret_interval,
3049 .maxlen = sizeof(int), 3111 .maxlen = sizeof(int),
3050 .mode = 0644, 3112 .mode = 0644,
3051 .proc_handler = &proc_dointvec_jiffies, 3113 .proc_handler = &ipv4_sysctl_rt_secret_interval,
3052 .strategy = &sysctl_jiffies, 3114 .strategy = &ipv4_sysctl_rt_secret_interval_strategy,
3053 }, 3115 },
3054 { .ctl_name = 0 } 3116 { .ctl_name = 0 }
3055}; 3117};
@@ -3126,10 +3188,12 @@ static __net_init int rt_secret_timer_init(struct net *net)
3126 net->ipv4.rt_secret_timer.data = (unsigned long)net; 3188 net->ipv4.rt_secret_timer.data = (unsigned long)net;
3127 init_timer_deferrable(&net->ipv4.rt_secret_timer); 3189 init_timer_deferrable(&net->ipv4.rt_secret_timer);
3128 3190
3129 net->ipv4.rt_secret_timer.expires = 3191 if (ip_rt_secret_interval) {
3130 jiffies + net_random() % ip_rt_secret_interval + 3192 net->ipv4.rt_secret_timer.expires =
3131 ip_rt_secret_interval; 3193 jiffies + net_random() % ip_rt_secret_interval +
3132 add_timer(&net->ipv4.rt_secret_timer); 3194 ip_rt_secret_interval;
3195 add_timer(&net->ipv4.rt_secret_timer);
3196 }
3133 return 0; 3197 return 0;
3134} 3198}
3135 3199
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a7842c54f58a..7b6a584b62dd 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1106,13 +1106,12 @@ out:
1106 return ret; 1106 return ret;
1107} 1107}
1108 1108
1109int ipv6_dev_get_saddr(struct net_device *dst_dev, 1109int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
1110 const struct in6_addr *daddr, unsigned int prefs, 1110 const struct in6_addr *daddr, unsigned int prefs,
1111 struct in6_addr *saddr) 1111 struct in6_addr *saddr)
1112{ 1112{
1113 struct ipv6_saddr_score scores[2], 1113 struct ipv6_saddr_score scores[2],
1114 *score = &scores[0], *hiscore = &scores[1]; 1114 *score = &scores[0], *hiscore = &scores[1];
1115 struct net *net = dev_net(dst_dev);
1116 struct ipv6_saddr_dst dst; 1115 struct ipv6_saddr_dst dst;
1117 struct net_device *dev; 1116 struct net_device *dev;
1118 int dst_type; 1117 int dst_type;
@@ -1689,6 +1688,7 @@ addrconf_prefix_route(struct in6_addr *pfx, int plen, struct net_device *dev,
1689 .fc_dst_len = plen, 1688 .fc_dst_len = plen,
1690 .fc_flags = RTF_UP | flags, 1689 .fc_flags = RTF_UP | flags,
1691 .fc_nlinfo.nl_net = dev_net(dev), 1690 .fc_nlinfo.nl_net = dev_net(dev),
1691 .fc_protocol = RTPROT_KERNEL,
1692 }; 1692 };
1693 1693
1694 ipv6_addr_copy(&cfg.fc_dst, pfx); 1694 ipv6_addr_copy(&cfg.fc_dst, pfx);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 8d05527524e3..f5de3f9dc692 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
93 if (flags & RT6_LOOKUP_F_SRCPREF_COA) 93 if (flags & RT6_LOOKUP_F_SRCPREF_COA)
94 srcprefs |= IPV6_PREFER_SRC_COA; 94 srcprefs |= IPV6_PREFER_SRC_COA;
95 95
96 if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev, 96 if (ipv6_dev_get_saddr(net,
97 ip6_dst_idev(&rt->u.dst)->dev,
97 &flp->fl6_dst, srcprefs, 98 &flp->fl6_dst, srcprefs,
98 &saddr)) 99 &saddr))
99 goto again; 100 goto again;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index abedf95fdf2d..b3157a0cc15d 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -91,19 +91,22 @@ static struct inet6_protocol icmpv6_protocol = {
91 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL, 91 .flags = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
92}; 92};
93 93
94static __inline__ int icmpv6_xmit_lock(struct sock *sk) 94static __inline__ struct sock *icmpv6_xmit_lock(struct net *net)
95{ 95{
96 struct sock *sk;
97
96 local_bh_disable(); 98 local_bh_disable();
97 99
100 sk = icmpv6_sk(net);
98 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) { 101 if (unlikely(!spin_trylock(&sk->sk_lock.slock))) {
99 /* This can happen if the output path (f.e. SIT or 102 /* This can happen if the output path (f.e. SIT or
100 * ip6ip6 tunnel) signals dst_link_failure() for an 103 * ip6ip6 tunnel) signals dst_link_failure() for an
101 * outgoing ICMP6 packet. 104 * outgoing ICMP6 packet.
102 */ 105 */
103 local_bh_enable(); 106 local_bh_enable();
104 return 1; 107 return NULL;
105 } 108 }
106 return 0; 109 return sk;
107} 110}
108 111
109static __inline__ void icmpv6_xmit_unlock(struct sock *sk) 112static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
@@ -392,11 +395,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
392 fl.fl_icmp_code = code; 395 fl.fl_icmp_code = code;
393 security_skb_classify_flow(skb, &fl); 396 security_skb_classify_flow(skb, &fl);
394 397
395 sk = icmpv6_sk(net); 398 sk = icmpv6_xmit_lock(net);
396 np = inet6_sk(sk); 399 if (sk == NULL)
397
398 if (icmpv6_xmit_lock(sk))
399 return; 400 return;
401 np = inet6_sk(sk);
400 402
401 if (!icmpv6_xrlim_allow(sk, type, &fl)) 403 if (!icmpv6_xrlim_allow(sk, type, &fl))
402 goto out; 404 goto out;
@@ -539,11 +541,10 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
539 fl.fl_icmp_type = ICMPV6_ECHO_REPLY; 541 fl.fl_icmp_type = ICMPV6_ECHO_REPLY;
540 security_skb_classify_flow(skb, &fl); 542 security_skb_classify_flow(skb, &fl);
541 543
542 sk = icmpv6_sk(net); 544 sk = icmpv6_xmit_lock(net);
543 np = inet6_sk(sk); 545 if (sk == NULL)
544
545 if (icmpv6_xmit_lock(sk))
546 return; 546 return;
547 np = inet6_sk(sk);
547 548
548 if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst)) 549 if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
549 fl.oif = np->mcast_oif; 550 fl.oif = np->mcast_oif;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 52dddc25d3e6..29c7c99e69f7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -378,6 +378,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
378 378
379 arg.skb = skb; 379 arg.skb = skb;
380 arg.cb = cb; 380 arg.cb = cb;
381 arg.net = net;
381 w->args = &arg; 382 w->args = &arg;
382 383
383 for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) { 384 for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a4402de425d9..0e844c2736a7 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -934,7 +934,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
934 goto out_err_release; 934 goto out_err_release;
935 935
936 if (ipv6_addr_any(&fl->fl6_src)) { 936 if (ipv6_addr_any(&fl->fl6_src)) {
937 err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev, 937 err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
938 &fl->fl6_dst, 938 &fl->fl6_dst,
939 sk ? inet6_sk(sk)->srcprefs : 0, 939 sk ? inet6_sk(sk)->srcprefs : 0,
940 &fl->fl6_src); 940 &fl->fl6_src);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 741cfcd96f88..4e5eac301f91 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -911,7 +911,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
911 } else { 911 } else {
912 if (np->rxopt.bits.rxinfo) { 912 if (np->rxopt.bits.rxinfo) {
913 struct in6_pktinfo src_info; 913 struct in6_pktinfo src_info;
914 src_info.ipi6_ifindex = np->mcast_oif; 914 src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
915 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr); 915 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
916 put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info); 916 put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
917 } 917 }
@@ -921,7 +921,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
921 } 921 }
922 if (np->rxopt.bits.rxoinfo) { 922 if (np->rxopt.bits.rxoinfo) {
923 struct in6_pktinfo src_info; 923 struct in6_pktinfo src_info;
924 src_info.ipi6_ifindex = np->mcast_oif; 924 src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
925 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr); 925 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
926 put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info); 926 put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
927 } 927 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index beb48e3f038a..f1c62ba0f56b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
549 override = 0; 549 override = 0;
550 in6_ifa_put(ifp); 550 in6_ifa_put(ifp);
551 } else { 551 } else {
552 if (ipv6_dev_get_saddr(dev, daddr, 552 if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
553 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs, 553 inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
554 &tmpaddr)) 554 &tmpaddr))
555 return; 555 return;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 41b165ffb369..9af6115f0f50 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2106,7 +2106,8 @@ static inline size_t rt6_nlmsg_size(void)
2106 + nla_total_size(sizeof(struct rta_cacheinfo)); 2106 + nla_total_size(sizeof(struct rta_cacheinfo));
2107} 2107}
2108 2108
2109static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt, 2109static int rt6_fill_node(struct net *net,
2110 struct sk_buff *skb, struct rt6_info *rt,
2110 struct in6_addr *dst, struct in6_addr *src, 2111 struct in6_addr *dst, struct in6_addr *src,
2111 int iif, int type, u32 pid, u32 seq, 2112 int iif, int type, u32 pid, u32 seq,
2112 int prefix, int nowait, unsigned int flags) 2113 int prefix, int nowait, unsigned int flags)
@@ -2189,7 +2190,7 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
2189 } else if (dst) { 2190 } else if (dst) {
2190 struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst); 2191 struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
2191 struct in6_addr saddr_buf; 2192 struct in6_addr saddr_buf;
2192 if (ipv6_dev_get_saddr(idev ? idev->dev : NULL, 2193 if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
2193 dst, 0, &saddr_buf) == 0) 2194 dst, 0, &saddr_buf) == 0)
2194 NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf); 2195 NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
2195 } 2196 }
@@ -2234,7 +2235,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
2234 } else 2235 } else
2235 prefix = 0; 2236 prefix = 0;
2236 2237
2237 return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE, 2238 return rt6_fill_node(arg->net,
2239 arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
2238 NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq, 2240 NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
2239 prefix, 0, NLM_F_MULTI); 2241 prefix, 0, NLM_F_MULTI);
2240} 2242}
@@ -2300,7 +2302,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
2300 rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl); 2302 rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl);
2301 skb->dst = &rt->u.dst; 2303 skb->dst = &rt->u.dst;
2302 2304
2303 err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif, 2305 err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
2304 RTM_NEWROUTE, NETLINK_CB(in_skb).pid, 2306 RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
2305 nlh->nlmsg_seq, 0, 0, 0); 2307 nlh->nlmsg_seq, 0, 0, 0);
2306 if (err < 0) { 2308 if (err < 0) {
@@ -2327,7 +2329,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
2327 if (skb == NULL) 2329 if (skb == NULL)
2328 goto errout; 2330 goto errout;
2329 2331
2330 err = rt6_fill_node(skb, rt, NULL, NULL, 0, 2332 err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
2331 event, info->pid, seq, 0, 0, 0); 2333 event, info->pid, seq, 0, 0, 0);
2332 if (err < 0) { 2334 if (err < 0) {
2333 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */ 2335 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8f1e0543b3c4..08e4cbbe3f04 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
52static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr) 52static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
53{ 53{
54 struct dst_entry *dst; 54 struct dst_entry *dst;
55 struct net_device *dev;
55 56
56 dst = xfrm6_dst_lookup(0, NULL, daddr); 57 dst = xfrm6_dst_lookup(0, NULL, daddr);
57 if (IS_ERR(dst)) 58 if (IS_ERR(dst))
58 return -EHOSTUNREACH; 59 return -EHOSTUNREACH;
59 60
60 ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev, 61 dev = ip6_dst_idev(dst)->dev;
62 ipv6_dev_get_saddr(dev_net(dev), dev,
61 (struct in6_addr *)&daddr->a6, 0, 63 (struct in6_addr *)&daddr->a6, 0,
62 (struct in6_addr *)&saddr->a6); 64 (struct in6_addr *)&saddr->a6);
63 dst_release(dst); 65 dst_release(dst);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index e1d11c9b6729..1e97fb9fb34b 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2103,6 +2103,8 @@ static void ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
2103 rcu_read_unlock(); 2103 rcu_read_unlock();
2104 return; 2104 return;
2105 } 2105 }
2106 /* update new sta with its last rx activity */
2107 sta->last_rx = jiffies;
2106 } 2108 }
2107 2109
2108 /* 2110 /*
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 105a616c5c78..a8752031adcb 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -968,7 +968,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
968 /* need to zero data of old helper */ 968 /* need to zero data of old helper */
969 memset(&help->help, 0, sizeof(help->help)); 969 memset(&help->help, 0, sizeof(help->help));
970 } else { 970 } else {
971 help = nf_ct_helper_ext_add(ct, GFP_KERNEL); 971 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
972 if (help == NULL) 972 if (help == NULL)
973 return -ENOMEM; 973 return -ENOMEM;
974 } 974 }
@@ -1136,16 +1136,33 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
1136 ct->timeout.expires = jiffies + ct->timeout.expires * HZ; 1136 ct->timeout.expires = jiffies + ct->timeout.expires * HZ;
1137 ct->status |= IPS_CONFIRMED; 1137 ct->status |= IPS_CONFIRMED;
1138 1138
1139 rcu_read_lock();
1140 helper = __nf_ct_helper_find(rtuple);
1141 if (helper) {
1142 help = nf_ct_helper_ext_add(ct, GFP_ATOMIC);
1143 if (help == NULL) {
1144 rcu_read_unlock();
1145 err = -ENOMEM;
1146 goto err;
1147 }
1148 /* not in hash table yet so not strictly necessary */
1149 rcu_assign_pointer(help->helper, helper);
1150 }
1151
1139 if (cda[CTA_STATUS]) { 1152 if (cda[CTA_STATUS]) {
1140 err = ctnetlink_change_status(ct, cda); 1153 err = ctnetlink_change_status(ct, cda);
1141 if (err < 0) 1154 if (err < 0) {
1155 rcu_read_unlock();
1142 goto err; 1156 goto err;
1157 }
1143 } 1158 }
1144 1159
1145 if (cda[CTA_PROTOINFO]) { 1160 if (cda[CTA_PROTOINFO]) {
1146 err = ctnetlink_change_protoinfo(ct, cda); 1161 err = ctnetlink_change_protoinfo(ct, cda);
1147 if (err < 0) 1162 if (err < 0) {
1163 rcu_read_unlock();
1148 goto err; 1164 goto err;
1165 }
1149 } 1166 }
1150 1167
1151 nf_ct_acct_ext_add(ct, GFP_KERNEL); 1168 nf_ct_acct_ext_add(ct, GFP_KERNEL);
@@ -1155,19 +1172,6 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
1155 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK])); 1172 ct->mark = ntohl(nla_get_be32(cda[CTA_MARK]));
1156#endif 1173#endif
1157 1174
1158 rcu_read_lock();
1159 helper = __nf_ct_helper_find(rtuple);
1160 if (helper) {
1161 help = nf_ct_helper_ext_add(ct, GFP_KERNEL);
1162 if (help == NULL) {
1163 rcu_read_unlock();
1164 err = -ENOMEM;
1165 goto err;
1166 }
1167 /* not in hash table yet so not strictly necessary */
1168 rcu_assign_pointer(help->helper, helper);
1169 }
1170
1171 /* setup master conntrack: this is a confirmed expectation */ 1175 /* setup master conntrack: this is a confirmed expectation */
1172 if (master_ct) { 1176 if (master_ct) {
1173 __set_bit(IPS_EXPECTED_BIT, &ct->status); 1177 __set_bit(IPS_EXPECTED_BIT, &ct->status);
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index d2d45655cd1a..35a9994e2339 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -150,6 +150,8 @@ static void update_rfkill_state(struct rfkill *rfkill)
150 * calls and handling all the red tape such as issuing notifications 150 * calls and handling all the red tape such as issuing notifications
151 * if the call is successful. 151 * if the call is successful.
152 * 152 *
153 * Suspended devices are not touched at all, and -EAGAIN is returned.
154 *
153 * Note that the @force parameter cannot override a (possibly cached) 155 * Note that the @force parameter cannot override a (possibly cached)
154 * state of RFKILL_STATE_HARD_BLOCKED. Any device making use of 156 * state of RFKILL_STATE_HARD_BLOCKED. Any device making use of
155 * RFKILL_STATE_HARD_BLOCKED implements either get_state() or 157 * RFKILL_STATE_HARD_BLOCKED implements either get_state() or
@@ -168,6 +170,9 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
168 int retval = 0; 170 int retval = 0;
169 enum rfkill_state oldstate, newstate; 171 enum rfkill_state oldstate, newstate;
170 172
173 if (unlikely(rfkill->dev.power.power_state.event & PM_EVENT_SLEEP))
174 return -EBUSY;
175
171 oldstate = rfkill->state; 176 oldstate = rfkill->state;
172 177
173 if (rfkill->get_state && !force && 178 if (rfkill->get_state && !force &&
@@ -214,7 +219,7 @@ static int rfkill_toggle_radio(struct rfkill *rfkill,
214 * 219 *
215 * This function toggles the state of all switches of given type, 220 * This function toggles the state of all switches of given type,
216 * unless a specific switch is claimed by userspace (in which case, 221 * unless a specific switch is claimed by userspace (in which case,
217 * that switch is left alone). 222 * that switch is left alone) or suspended.
218 */ 223 */
219void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state) 224void rfkill_switch_all(enum rfkill_type type, enum rfkill_state state)
220{ 225{
@@ -239,8 +244,8 @@ EXPORT_SYMBOL(rfkill_switch_all);
239/** 244/**
240 * rfkill_epo - emergency power off all transmitters 245 * rfkill_epo - emergency power off all transmitters
241 * 246 *
242 * This kicks all rfkill devices to RFKILL_STATE_SOFT_BLOCKED, ignoring 247 * This kicks all non-suspended rfkill devices to RFKILL_STATE_SOFT_BLOCKED,
243 * everything in its path but rfkill_mutex and rfkill->mutex. 248 * ignoring everything in its path but rfkill_mutex and rfkill->mutex.
244 */ 249 */
245void rfkill_epo(void) 250void rfkill_epo(void)
246{ 251{
@@ -458,13 +463,14 @@ static int rfkill_resume(struct device *dev)
458 if (dev->power.power_state.event != PM_EVENT_ON) { 463 if (dev->power.power_state.event != PM_EVENT_ON) {
459 mutex_lock(&rfkill->mutex); 464 mutex_lock(&rfkill->mutex);
460 465
466 dev->power.power_state.event = PM_EVENT_ON;
467
461 /* restore radio state AND notify everybody */ 468 /* restore radio state AND notify everybody */
462 rfkill_toggle_radio(rfkill, rfkill->state, 1); 469 rfkill_toggle_radio(rfkill, rfkill->state, 1);
463 470
464 mutex_unlock(&rfkill->mutex); 471 mutex_unlock(&rfkill->mutex);
465 } 472 }
466 473
467 dev->power.power_state = PMSG_ON;
468 return 0; 474 return 0;
469} 475}
470#else 476#else
diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
index d2b6f54a6261..5cafdd4c8018 100644
--- a/net/sched/cls_api.c
+++ b/net/sched/cls_api.c
@@ -280,7 +280,7 @@ replay:
280 if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) { 280 if (n->nlmsg_type == RTM_DELTFILTER && t->tcm_handle == 0) {
281 spin_lock_bh(root_lock); 281 spin_lock_bh(root_lock);
282 *back = tp->next; 282 *back = tp->next;
283 spin_lock_bh(root_lock); 283 spin_unlock_bh(root_lock);
284 284
285 tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER); 285 tfilter_notify(skb, n, tp, fh, RTM_DELTFILTER);
286 tcf_destroy(tp); 286 tcf_destroy(tp);
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index c25465e5607a..e7fb9e0d21b4 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -27,6 +27,7 @@
27#include <linux/kmod.h> 27#include <linux/kmod.h>
28#include <linux/list.h> 28#include <linux/list.h>
29#include <linux/hrtimer.h> 29#include <linux/hrtimer.h>
30#include <linux/lockdep.h>
30 31
31#include <net/net_namespace.h> 32#include <net/net_namespace.h>
32#include <net/sock.h> 33#include <net/sock.h>
@@ -198,19 +199,53 @@ struct Qdisc *qdisc_match_from_root(struct Qdisc *root, u32 handle)
198 return NULL; 199 return NULL;
199} 200}
200 201
202/*
203 * This lock is needed until some qdiscs stop calling qdisc_tree_decrease_qlen()
204 * without rtnl_lock(); currently hfsc_dequeue(), netem_dequeue(), tbf_dequeue()
205 */
206static DEFINE_SPINLOCK(qdisc_list_lock);
207
208static void qdisc_list_add(struct Qdisc *q)
209{
210 if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
211 spin_lock_bh(&qdisc_list_lock);
212 list_add_tail(&q->list, &qdisc_root_sleeping(q)->list);
213 spin_unlock_bh(&qdisc_list_lock);
214 }
215}
216
217void qdisc_list_del(struct Qdisc *q)
218{
219 if ((q->parent != TC_H_ROOT) && !(q->flags & TCQ_F_INGRESS)) {
220 spin_lock_bh(&qdisc_list_lock);
221 list_del(&q->list);
222 spin_unlock_bh(&qdisc_list_lock);
223 }
224}
225EXPORT_SYMBOL(qdisc_list_del);
226
201struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle) 227struct Qdisc *qdisc_lookup(struct net_device *dev, u32 handle)
202{ 228{
203 unsigned int i; 229 unsigned int i;
230 struct Qdisc *q;
231
232 spin_lock_bh(&qdisc_list_lock);
204 233
205 for (i = 0; i < dev->num_tx_queues; i++) { 234 for (i = 0; i < dev->num_tx_queues; i++) {
206 struct netdev_queue *txq = netdev_get_tx_queue(dev, i); 235 struct netdev_queue *txq = netdev_get_tx_queue(dev, i);
207 struct Qdisc *q, *txq_root = txq->qdisc_sleeping; 236 struct Qdisc *txq_root = txq->qdisc_sleeping;
208 237
209 q = qdisc_match_from_root(txq_root, handle); 238 q = qdisc_match_from_root(txq_root, handle);
210 if (q) 239 if (q)
211 return q; 240 goto unlock;
212 } 241 }
213 return qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle); 242
243 q = qdisc_match_from_root(dev->rx_queue.qdisc_sleeping, handle);
244
245unlock:
246 spin_unlock_bh(&qdisc_list_lock);
247
248 return q;
214} 249}
215 250
216static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid) 251static struct Qdisc *qdisc_leaf(struct Qdisc *p, u32 classid)
@@ -331,7 +366,7 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
331 if (!s || tsize != s->tsize || (!tab && tsize > 0)) 366 if (!s || tsize != s->tsize || (!tab && tsize > 0))
332 return ERR_PTR(-EINVAL); 367 return ERR_PTR(-EINVAL);
333 368
334 spin_lock_bh(&qdisc_stab_lock); 369 spin_lock(&qdisc_stab_lock);
335 370
336 list_for_each_entry(stab, &qdisc_stab_list, list) { 371 list_for_each_entry(stab, &qdisc_stab_list, list) {
337 if (memcmp(&stab->szopts, s, sizeof(*s))) 372 if (memcmp(&stab->szopts, s, sizeof(*s)))
@@ -339,11 +374,11 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
339 if (tsize > 0 && memcmp(stab->data, tab, tsize * sizeof(u16))) 374 if (tsize > 0 && memcmp(stab->data, tab, tsize * sizeof(u16)))
340 continue; 375 continue;
341 stab->refcnt++; 376 stab->refcnt++;
342 spin_unlock_bh(&qdisc_stab_lock); 377 spin_unlock(&qdisc_stab_lock);
343 return stab; 378 return stab;
344 } 379 }
345 380
346 spin_unlock_bh(&qdisc_stab_lock); 381 spin_unlock(&qdisc_stab_lock);
347 382
348 stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL); 383 stab = kmalloc(sizeof(*stab) + tsize * sizeof(u16), GFP_KERNEL);
349 if (!stab) 384 if (!stab)
@@ -354,9 +389,9 @@ static struct qdisc_size_table *qdisc_get_stab(struct nlattr *opt)
354 if (tsize > 0) 389 if (tsize > 0)
355 memcpy(stab->data, tab, tsize * sizeof(u16)); 390 memcpy(stab->data, tab, tsize * sizeof(u16));
356 391
357 spin_lock_bh(&qdisc_stab_lock); 392 spin_lock(&qdisc_stab_lock);
358 list_add_tail(&stab->list, &qdisc_stab_list); 393 list_add_tail(&stab->list, &qdisc_stab_list);
359 spin_unlock_bh(&qdisc_stab_lock); 394 spin_unlock(&qdisc_stab_lock);
360 395
361 return stab; 396 return stab;
362} 397}
@@ -366,14 +401,14 @@ void qdisc_put_stab(struct qdisc_size_table *tab)
366 if (!tab) 401 if (!tab)
367 return; 402 return;
368 403
369 spin_lock_bh(&qdisc_stab_lock); 404 spin_lock(&qdisc_stab_lock);
370 405
371 if (--tab->refcnt == 0) { 406 if (--tab->refcnt == 0) {
372 list_del(&tab->list); 407 list_del(&tab->list);
373 kfree(tab); 408 kfree(tab);
374 } 409 }
375 410
376 spin_unlock_bh(&qdisc_stab_lock); 411 spin_unlock(&qdisc_stab_lock);
377} 412}
378EXPORT_SYMBOL(qdisc_put_stab); 413EXPORT_SYMBOL(qdisc_put_stab);
379 414
@@ -426,7 +461,7 @@ static enum hrtimer_restart qdisc_watchdog(struct hrtimer *timer)
426 461
427 wd->qdisc->flags &= ~TCQ_F_THROTTLED; 462 wd->qdisc->flags &= ~TCQ_F_THROTTLED;
428 smp_wmb(); 463 smp_wmb();
429 __netif_schedule(wd->qdisc); 464 __netif_schedule(qdisc_root(wd->qdisc));
430 465
431 return HRTIMER_NORESTART; 466 return HRTIMER_NORESTART;
432} 467}
@@ -443,6 +478,10 @@ void qdisc_watchdog_schedule(struct qdisc_watchdog *wd, psched_time_t expires)
443{ 478{
444 ktime_t time; 479 ktime_t time;
445 480
481 if (test_bit(__QDISC_STATE_DEACTIVATED,
482 &qdisc_root_sleeping(wd->qdisc)->state))
483 return;
484
446 wd->qdisc->flags |= TCQ_F_THROTTLED; 485 wd->qdisc->flags |= TCQ_F_THROTTLED;
447 time = ktime_set(0, 0); 486 time = ktime_set(0, 0);
448 time = ktime_add_ns(time, PSCHED_US2NS(expires)); 487 time = ktime_add_ns(time, PSCHED_US2NS(expires));
@@ -637,11 +676,8 @@ static void notify_and_destroy(struct sk_buff *skb, struct nlmsghdr *n, u32 clid
637 if (new || old) 676 if (new || old)
638 qdisc_notify(skb, n, clid, old, new); 677 qdisc_notify(skb, n, clid, old, new);
639 678
640 if (old) { 679 if (old)
641 spin_lock_bh(&old->q.lock);
642 qdisc_destroy(old); 680 qdisc_destroy(old);
643 spin_unlock_bh(&old->q.lock);
644 }
645} 681}
646 682
647/* Graft qdisc "new" to class "classid" of qdisc "parent" or 683/* Graft qdisc "new" to class "classid" of qdisc "parent" or
@@ -707,6 +743,10 @@ static int qdisc_graft(struct net_device *dev, struct Qdisc *parent,
707 return err; 743 return err;
708} 744}
709 745
746/* lockdep annotation is needed for ingress; egress gets it only for name */
747static struct lock_class_key qdisc_tx_lock;
748static struct lock_class_key qdisc_rx_lock;
749
710/* 750/*
711 Allocate and initialize new qdisc. 751 Allocate and initialize new qdisc.
712 752
@@ -767,6 +807,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
767 if (handle == TC_H_INGRESS) { 807 if (handle == TC_H_INGRESS) {
768 sch->flags |= TCQ_F_INGRESS; 808 sch->flags |= TCQ_F_INGRESS;
769 handle = TC_H_MAKE(TC_H_INGRESS, 0); 809 handle = TC_H_MAKE(TC_H_INGRESS, 0);
810 lockdep_set_class(qdisc_lock(sch), &qdisc_rx_lock);
770 } else { 811 } else {
771 if (handle == 0) { 812 if (handle == 0) {
772 handle = qdisc_alloc_handle(dev); 813 handle = qdisc_alloc_handle(dev);
@@ -774,6 +815,7 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
774 if (handle == 0) 815 if (handle == 0)
775 goto err_out3; 816 goto err_out3;
776 } 817 }
818 lockdep_set_class(qdisc_lock(sch), &qdisc_tx_lock);
777 } 819 }
778 820
779 sch->handle = handle; 821 sch->handle = handle;
@@ -802,8 +844,8 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
802 goto err_out3; 844 goto err_out3;
803 } 845 }
804 } 846 }
805 if ((parent != TC_H_ROOT) && !(sch->flags & TCQ_F_INGRESS)) 847
806 list_add_tail(&sch->list, &dev_queue->qdisc_sleeping->list); 848 qdisc_list_add(sch);
807 849
808 return sch; 850 return sch;
809 } 851 }
@@ -1084,20 +1126,13 @@ create_n_graft:
1084 } 1126 }
1085 1127
1086graft: 1128graft:
1087 if (1) { 1129 err = qdisc_graft(dev, p, skb, n, clid, q, NULL);
1088 spinlock_t *root_lock; 1130 if (err) {
1089 1131 if (q)
1090 err = qdisc_graft(dev, p, skb, n, clid, q, NULL); 1132 qdisc_destroy(q);
1091 if (err) { 1133 return err;
1092 if (q) {
1093 root_lock = qdisc_root_lock(q);
1094 spin_lock_bh(root_lock);
1095 qdisc_destroy(q);
1096 spin_unlock_bh(root_lock);
1097 }
1098 return err;
1099 }
1100 } 1134 }
1135
1101 return 0; 1136 return 0;
1102} 1137}
1103 1138
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 4e261ce62f48..8fa90d68ec6d 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -521,6 +521,10 @@ static void cbq_ovl_delay(struct cbq_class *cl)
521 struct cbq_sched_data *q = qdisc_priv(cl->qdisc); 521 struct cbq_sched_data *q = qdisc_priv(cl->qdisc);
522 psched_tdiff_t delay = cl->undertime - q->now; 522 psched_tdiff_t delay = cl->undertime - q->now;
523 523
524 if (test_bit(__QDISC_STATE_DEACTIVATED,
525 &qdisc_root_sleeping(cl->qdisc)->state))
526 return;
527
524 if (!cl->delayed) { 528 if (!cl->delayed) {
525 psched_time_t sched = q->now; 529 psched_time_t sched = q->now;
526 ktime_t expires; 530 ktime_t expires;
@@ -654,7 +658,7 @@ static enum hrtimer_restart cbq_undelay(struct hrtimer *timer)
654 } 658 }
655 659
656 sch->flags &= ~TCQ_F_THROTTLED; 660 sch->flags &= ~TCQ_F_THROTTLED;
657 __netif_schedule(sch); 661 __netif_schedule(qdisc_root(sch));
658 return HRTIMER_NORESTART; 662 return HRTIMER_NORESTART;
659} 663}
660 664
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 468574682caa..5f0ade7806a7 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -518,15 +518,17 @@ void qdisc_reset(struct Qdisc *qdisc)
518} 518}
519EXPORT_SYMBOL(qdisc_reset); 519EXPORT_SYMBOL(qdisc_reset);
520 520
521/* this is the rcu callback function to clean up a qdisc when there 521void qdisc_destroy(struct Qdisc *qdisc)
522 * are no further references to it */
523
524static void __qdisc_destroy(struct rcu_head *head)
525{ 522{
526 struct Qdisc *qdisc = container_of(head, struct Qdisc, q_rcu);
527 const struct Qdisc_ops *ops = qdisc->ops; 523 const struct Qdisc_ops *ops = qdisc->ops;
528 524
525 if (qdisc->flags & TCQ_F_BUILTIN ||
526 !atomic_dec_and_test(&qdisc->refcnt))
527 return;
528
529#ifdef CONFIG_NET_SCHED 529#ifdef CONFIG_NET_SCHED
530 qdisc_list_del(qdisc);
531
530 qdisc_put_stab(qdisc->stab); 532 qdisc_put_stab(qdisc->stab);
531#endif 533#endif
532 gen_kill_estimator(&qdisc->bstats, &qdisc->rate_est); 534 gen_kill_estimator(&qdisc->bstats, &qdisc->rate_est);
@@ -542,20 +544,6 @@ static void __qdisc_destroy(struct rcu_head *head)
542 544
543 kfree((char *) qdisc - qdisc->padded); 545 kfree((char *) qdisc - qdisc->padded);
544} 546}
545
546/* Under qdisc_lock(qdisc) and BH! */
547
548void qdisc_destroy(struct Qdisc *qdisc)
549{
550 if (qdisc->flags & TCQ_F_BUILTIN ||
551 !atomic_dec_and_test(&qdisc->refcnt))
552 return;
553
554 if (qdisc->parent)
555 list_del(&qdisc->list);
556
557 call_rcu(&qdisc->q_rcu, __qdisc_destroy);
558}
559EXPORT_SYMBOL(qdisc_destroy); 547EXPORT_SYMBOL(qdisc_destroy);
560 548
561static bool dev_all_qdisc_sleeping_noop(struct net_device *dev) 549static bool dev_all_qdisc_sleeping_noop(struct net_device *dev)
@@ -597,6 +585,9 @@ static void transition_one_qdisc(struct net_device *dev,
597 struct Qdisc *new_qdisc = dev_queue->qdisc_sleeping; 585 struct Qdisc *new_qdisc = dev_queue->qdisc_sleeping;
598 int *need_watchdog_p = _need_watchdog; 586 int *need_watchdog_p = _need_watchdog;
599 587
588 if (!(new_qdisc->flags & TCQ_F_BUILTIN))
589 clear_bit(__QDISC_STATE_DEACTIVATED, &new_qdisc->state);
590
600 rcu_assign_pointer(dev_queue->qdisc, new_qdisc); 591 rcu_assign_pointer(dev_queue->qdisc, new_qdisc);
601 if (need_watchdog_p && new_qdisc != &noqueue_qdisc) 592 if (need_watchdog_p && new_qdisc != &noqueue_qdisc)
602 *need_watchdog_p = 1; 593 *need_watchdog_p = 1;
@@ -640,6 +631,9 @@ static void dev_deactivate_queue(struct net_device *dev,
640 if (qdisc) { 631 if (qdisc) {
641 spin_lock_bh(qdisc_lock(qdisc)); 632 spin_lock_bh(qdisc_lock(qdisc));
642 633
634 if (!(qdisc->flags & TCQ_F_BUILTIN))
635 set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
636
643 dev_queue->qdisc = qdisc_default; 637 dev_queue->qdisc = qdisc_default;
644 qdisc_reset(qdisc); 638 qdisc_reset(qdisc);
645 639
@@ -647,7 +641,7 @@ static void dev_deactivate_queue(struct net_device *dev,
647 } 641 }
648} 642}
649 643
650static bool some_qdisc_is_busy(struct net_device *dev, int lock) 644static bool some_qdisc_is_busy(struct net_device *dev)
651{ 645{
652 unsigned int i; 646 unsigned int i;
653 647
@@ -661,14 +655,12 @@ static bool some_qdisc_is_busy(struct net_device *dev, int lock)
661 q = dev_queue->qdisc_sleeping; 655 q = dev_queue->qdisc_sleeping;
662 root_lock = qdisc_lock(q); 656 root_lock = qdisc_lock(q);
663 657
664 if (lock) 658 spin_lock_bh(root_lock);
665 spin_lock_bh(root_lock);
666 659
667 val = (test_bit(__QDISC_STATE_RUNNING, &q->state) || 660 val = (test_bit(__QDISC_STATE_RUNNING, &q->state) ||
668 test_bit(__QDISC_STATE_SCHED, &q->state)); 661 test_bit(__QDISC_STATE_SCHED, &q->state));
669 662
670 if (lock) 663 spin_unlock_bh(root_lock);
671 spin_unlock_bh(root_lock);
672 664
673 if (val) 665 if (val)
674 return true; 666 return true;
@@ -678,8 +670,6 @@ static bool some_qdisc_is_busy(struct net_device *dev, int lock)
678 670
679void dev_deactivate(struct net_device *dev) 671void dev_deactivate(struct net_device *dev)
680{ 672{
681 bool running;
682
683 netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc); 673 netdev_for_each_tx_queue(dev, dev_deactivate_queue, &noop_qdisc);
684 dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc); 674 dev_deactivate_queue(dev, &dev->rx_queue, &noop_qdisc);
685 675
@@ -689,25 +679,8 @@ void dev_deactivate(struct net_device *dev)
689 synchronize_rcu(); 679 synchronize_rcu();
690 680
691 /* Wait for outstanding qdisc_run calls. */ 681 /* Wait for outstanding qdisc_run calls. */
692 do { 682 while (some_qdisc_is_busy(dev))
693 while (some_qdisc_is_busy(dev, 0)) 683 yield();
694 yield();
695
696 /*
697 * Double-check inside queue lock to ensure that all effects
698 * of the queue run are visible when we return.
699 */
700 running = some_qdisc_is_busy(dev, 1);
701
702 /*
703 * The running flag should never be set at this point because
704 * we've already set dev->qdisc to noop_qdisc *inside* the same
705 * pair of spin locks. That is, if any qdisc_run starts after
706 * our initial test it should see the noop_qdisc and then
707 * clear the RUNNING bit before dropping the queue lock. So
708 * if it is set here then we've found a bug.
709 */
710 } while (WARN_ON_ONCE(running));
711} 684}
712 685
713static void dev_init_scheduler_queue(struct net_device *dev, 686static void dev_init_scheduler_queue(struct net_device *dev,
@@ -736,14 +709,10 @@ static void shutdown_scheduler_queue(struct net_device *dev,
736 struct Qdisc *qdisc_default = _qdisc_default; 709 struct Qdisc *qdisc_default = _qdisc_default;
737 710
738 if (qdisc) { 711 if (qdisc) {
739 spinlock_t *root_lock = qdisc_lock(qdisc);
740
741 dev_queue->qdisc = qdisc_default; 712 dev_queue->qdisc = qdisc_default;
742 dev_queue->qdisc_sleeping = qdisc_default; 713 dev_queue->qdisc_sleeping = qdisc_default;
743 714
744 spin_lock_bh(root_lock);
745 qdisc_destroy(qdisc); 715 qdisc_destroy(qdisc);
746 spin_unlock_bh(root_lock);
747 } 716 }
748} 717}
749 718
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 6febd245e62b..0df0df202ed0 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -577,7 +577,7 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
577 sch->qstats.drops++; 577 sch->qstats.drops++;
578 cl->qstats.drops++; 578 cl->qstats.drops++;
579 } 579 }
580 return NET_XMIT_DROP; 580 return ret;
581 } else { 581 } else {
582 cl->bstats.packets += 582 cl->bstats.packets +=
583 skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1; 583 skb_is_gso(skb)?skb_shinfo(skb)->gso_segs:1;
@@ -623,7 +623,7 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
623 sch->qstats.drops++; 623 sch->qstats.drops++;
624 cl->qstats.drops++; 624 cl->qstats.drops++;
625 } 625 }
626 return NET_XMIT_DROP; 626 return ret;
627 } else 627 } else
628 htb_activate(q, cl); 628 htb_activate(q, cl);
629 629
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index eac197610edf..a6697c686c7f 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -113,11 +113,11 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
113 if ((ret = qdisc->ops->requeue(skb, qdisc)) == NET_XMIT_SUCCESS) { 113 if ((ret = qdisc->ops->requeue(skb, qdisc)) == NET_XMIT_SUCCESS) {
114 sch->q.qlen++; 114 sch->q.qlen++;
115 sch->qstats.requeues++; 115 sch->qstats.requeues++;
116 return 0; 116 return NET_XMIT_SUCCESS;
117 } 117 }
118 if (net_xmit_drop_count(ret)) 118 if (net_xmit_drop_count(ret))
119 sch->qstats.drops++; 119 sch->qstats.drops++;
120 return NET_XMIT_DROP; 120 return ret;
121} 121}
122 122
123 123
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index 7d3b7ff3bf07..94c61598b86a 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -123,15 +123,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
123 struct tbf_sched_data *q = qdisc_priv(sch); 123 struct tbf_sched_data *q = qdisc_priv(sch);
124 int ret; 124 int ret;
125 125
126 if (qdisc_pkt_len(skb) > q->max_size) { 126 if (qdisc_pkt_len(skb) > q->max_size)
127 sch->qstats.drops++; 127 return qdisc_reshape_fail(skb, sch);
128#ifdef CONFIG_NET_CLS_ACT
129 if (sch->reshape_fail == NULL || sch->reshape_fail(skb, sch))
130#endif
131 kfree_skb(skb);
132
133 return NET_XMIT_DROP;
134 }
135 128
136 ret = qdisc_enqueue(skb, q->qdisc); 129 ret = qdisc_enqueue(skb, q->qdisc);
137 if (ret != 0) { 130 if (ret != 0) {
diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
index e39a0cdef184..4c8d9f45ce09 100644
--- a/net/sctp/endpointola.c
+++ b/net/sctp/endpointola.c
@@ -103,6 +103,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
103 103
104 /* Initialize the CHUNKS parameter */ 104 /* Initialize the CHUNKS parameter */
105 auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS; 105 auth_chunks->param_hdr.type = SCTP_PARAM_CHUNKS;
106 auth_chunks->param_hdr.length = htons(sizeof(sctp_paramhdr_t));
106 107
107 /* If the Add-IP functionality is enabled, we must 108 /* If the Add-IP functionality is enabled, we must
108 * authenticate, ASCONF and ASCONF-ACK chunks 109 * authenticate, ASCONF and ASCONF-ACK chunks
@@ -110,8 +111,7 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
110 if (sctp_addip_enable) { 111 if (sctp_addip_enable) {
111 auth_chunks->chunks[0] = SCTP_CID_ASCONF; 112 auth_chunks->chunks[0] = SCTP_CID_ASCONF;
112 auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK; 113 auth_chunks->chunks[1] = SCTP_CID_ASCONF_ACK;
113 auth_chunks->param_hdr.length = 114 auth_chunks->param_hdr.length += htons(2);
114 htons(sizeof(sctp_paramhdr_t) + 2);
115 } 115 }
116 } 116 }
117 117
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 483a01d0740a..47f91afa0211 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -319,7 +319,8 @@ static void sctp_v6_get_saddr(struct sctp_sock *sk,
319 __func__, asoc, dst, NIP6(daddr->v6.sin6_addr)); 319 __func__, asoc, dst, NIP6(daddr->v6.sin6_addr));
320 320
321 if (!asoc) { 321 if (!asoc) {
322 ipv6_dev_get_saddr(dst ? ip6_dst_idev(dst)->dev : NULL, 322 ipv6_dev_get_saddr(sock_net(sctp_opt2sk(sk)),
323 dst ? ip6_dst_idev(dst)->dev : NULL,
323 &daddr->v6.sin6_addr, 324 &daddr->v6.sin6_addr,
324 inet6_sk(&sk->inet.sk)->srcprefs, 325 inet6_sk(&sk->inet.sk)->srcprefs,
325 &saddr->v6.sin6_addr); 326 &saddr->v6.sin6_addr);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index dbb79adf8f3c..bb5c9ef13046 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3055,6 +3055,9 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
3055{ 3055{
3056 struct sctp_authchunk val; 3056 struct sctp_authchunk val;
3057 3057
3058 if (!sctp_auth_enable)
3059 return -EACCES;
3060
3058 if (optlen != sizeof(struct sctp_authchunk)) 3061 if (optlen != sizeof(struct sctp_authchunk))
3059 return -EINVAL; 3062 return -EINVAL;
3060 if (copy_from_user(&val, optval, optlen)) 3063 if (copy_from_user(&val, optval, optlen))
@@ -3085,6 +3088,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
3085 struct sctp_hmacalgo *hmacs; 3088 struct sctp_hmacalgo *hmacs;
3086 int err; 3089 int err;
3087 3090
3091 if (!sctp_auth_enable)
3092 return -EACCES;
3093
3088 if (optlen < sizeof(struct sctp_hmacalgo)) 3094 if (optlen < sizeof(struct sctp_hmacalgo))
3089 return -EINVAL; 3095 return -EINVAL;
3090 3096
@@ -3123,6 +3129,9 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
3123 struct sctp_association *asoc; 3129 struct sctp_association *asoc;
3124 int ret; 3130 int ret;
3125 3131
3132 if (!sctp_auth_enable)
3133 return -EACCES;
3134
3126 if (optlen <= sizeof(struct sctp_authkey)) 3135 if (optlen <= sizeof(struct sctp_authkey))
3127 return -EINVAL; 3136 return -EINVAL;
3128 3137
@@ -3160,6 +3169,9 @@ static int sctp_setsockopt_active_key(struct sock *sk,
3160 struct sctp_authkeyid val; 3169 struct sctp_authkeyid val;
3161 struct sctp_association *asoc; 3170 struct sctp_association *asoc;
3162 3171
3172 if (!sctp_auth_enable)
3173 return -EACCES;
3174
3163 if (optlen != sizeof(struct sctp_authkeyid)) 3175 if (optlen != sizeof(struct sctp_authkeyid))
3164 return -EINVAL; 3176 return -EINVAL;
3165 if (copy_from_user(&val, optval, optlen)) 3177 if (copy_from_user(&val, optval, optlen))
@@ -3185,6 +3197,9 @@ static int sctp_setsockopt_del_key(struct sock *sk,
3185 struct sctp_authkeyid val; 3197 struct sctp_authkeyid val;
3186 struct sctp_association *asoc; 3198 struct sctp_association *asoc;
3187 3199
3200 if (!sctp_auth_enable)
3201 return -EACCES;
3202
3188 if (optlen != sizeof(struct sctp_authkeyid)) 3203 if (optlen != sizeof(struct sctp_authkeyid))
3189 return -EINVAL; 3204 return -EINVAL;
3190 if (copy_from_user(&val, optval, optlen)) 3205 if (copy_from_user(&val, optval, optlen))
@@ -5197,19 +5212,29 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
5197static int sctp_getsockopt_hmac_ident(struct sock *sk, int len, 5212static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
5198 char __user *optval, int __user *optlen) 5213 char __user *optval, int __user *optlen)
5199{ 5214{
5215 struct sctp_hmacalgo __user *p = (void __user *)optval;
5200 struct sctp_hmac_algo_param *hmacs; 5216 struct sctp_hmac_algo_param *hmacs;
5201 __u16 param_len; 5217 __u16 data_len = 0;
5218 u32 num_idents;
5219
5220 if (!sctp_auth_enable)
5221 return -EACCES;
5202 5222
5203 hmacs = sctp_sk(sk)->ep->auth_hmacs_list; 5223 hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
5204 param_len = ntohs(hmacs->param_hdr.length); 5224 data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
5205 5225
5206 if (len < param_len) 5226 if (len < sizeof(struct sctp_hmacalgo) + data_len)
5207 return -EINVAL; 5227 return -EINVAL;
5228
5229 len = sizeof(struct sctp_hmacalgo) + data_len;
5230 num_idents = data_len / sizeof(u16);
5231
5208 if (put_user(len, optlen)) 5232 if (put_user(len, optlen))
5209 return -EFAULT; 5233 return -EFAULT;
5210 if (copy_to_user(optval, hmacs->hmac_ids, len)) 5234 if (put_user(num_idents, &p->shmac_num_idents))
5235 return -EFAULT;
5236 if (copy_to_user(p->shmac_idents, hmacs->hmac_ids, data_len))
5211 return -EFAULT; 5237 return -EFAULT;
5212
5213 return 0; 5238 return 0;
5214} 5239}
5215 5240
@@ -5219,6 +5244,9 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
5219 struct sctp_authkeyid val; 5244 struct sctp_authkeyid val;
5220 struct sctp_association *asoc; 5245 struct sctp_association *asoc;
5221 5246
5247 if (!sctp_auth_enable)
5248 return -EACCES;
5249
5222 if (len < sizeof(struct sctp_authkeyid)) 5250 if (len < sizeof(struct sctp_authkeyid))
5223 return -EINVAL; 5251 return -EINVAL;
5224 if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid))) 5252 if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
@@ -5233,6 +5261,12 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
5233 else 5261 else
5234 val.scact_keynumber = sctp_sk(sk)->ep->active_key_id; 5262 val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
5235 5263
5264 len = sizeof(struct sctp_authkeyid);
5265 if (put_user(len, optlen))
5266 return -EFAULT;
5267 if (copy_to_user(optval, &val, len))
5268 return -EFAULT;
5269
5236 return 0; 5270 return 0;
5237} 5271}
5238 5272
@@ -5243,13 +5277,16 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
5243 struct sctp_authchunks val; 5277 struct sctp_authchunks val;
5244 struct sctp_association *asoc; 5278 struct sctp_association *asoc;
5245 struct sctp_chunks_param *ch; 5279 struct sctp_chunks_param *ch;
5246 u32 num_chunks; 5280 u32 num_chunks = 0;
5247 char __user *to; 5281 char __user *to;
5248 5282
5249 if (len <= sizeof(struct sctp_authchunks)) 5283 if (!sctp_auth_enable)
5284 return -EACCES;
5285
5286 if (len < sizeof(struct sctp_authchunks))
5250 return -EINVAL; 5287 return -EINVAL;
5251 5288
5252 if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) 5289 if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5253 return -EFAULT; 5290 return -EFAULT;
5254 5291
5255 to = p->gauth_chunks; 5292 to = p->gauth_chunks;
@@ -5258,20 +5295,21 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
5258 return -EINVAL; 5295 return -EINVAL;
5259 5296
5260 ch = asoc->peer.peer_chunks; 5297 ch = asoc->peer.peer_chunks;
5298 if (!ch)
5299 goto num;
5261 5300
5262 /* See if the user provided enough room for all the data */ 5301 /* See if the user provided enough room for all the data */
5263 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); 5302 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5264 if (len < num_chunks) 5303 if (len < num_chunks)
5265 return -EINVAL; 5304 return -EINVAL;
5266 5305
5267 len = num_chunks; 5306 if (copy_to_user(to, ch->chunks, num_chunks))
5268 if (put_user(len, optlen))
5269 return -EFAULT; 5307 return -EFAULT;
5308num:
5309 len = sizeof(struct sctp_authchunks) + num_chunks;
5310 if (put_user(len, optlen)) return -EFAULT;
5270 if (put_user(num_chunks, &p->gauth_number_of_chunks)) 5311 if (put_user(num_chunks, &p->gauth_number_of_chunks))
5271 return -EFAULT; 5312 return -EFAULT;
5272 if (copy_to_user(to, ch->chunks, len))
5273 return -EFAULT;
5274
5275 return 0; 5313 return 0;
5276} 5314}
5277 5315
@@ -5282,13 +5320,16 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
5282 struct sctp_authchunks val; 5320 struct sctp_authchunks val;
5283 struct sctp_association *asoc; 5321 struct sctp_association *asoc;
5284 struct sctp_chunks_param *ch; 5322 struct sctp_chunks_param *ch;
5285 u32 num_chunks; 5323 u32 num_chunks = 0;
5286 char __user *to; 5324 char __user *to;
5287 5325
5288 if (len <= sizeof(struct sctp_authchunks)) 5326 if (!sctp_auth_enable)
5327 return -EACCES;
5328
5329 if (len < sizeof(struct sctp_authchunks))
5289 return -EINVAL; 5330 return -EINVAL;
5290 5331
5291 if (copy_from_user(&val, p, sizeof(struct sctp_authchunks))) 5332 if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
5292 return -EFAULT; 5333 return -EFAULT;
5293 5334
5294 to = p->gauth_chunks; 5335 to = p->gauth_chunks;
@@ -5301,17 +5342,21 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
5301 else 5342 else
5302 ch = sctp_sk(sk)->ep->auth_chunk_list; 5343 ch = sctp_sk(sk)->ep->auth_chunk_list;
5303 5344
5345 if (!ch)
5346 goto num;
5347
5304 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t); 5348 num_chunks = ntohs(ch->param_hdr.length) - sizeof(sctp_paramhdr_t);
5305 if (len < num_chunks) 5349 if (len < sizeof(struct sctp_authchunks) + num_chunks)
5306 return -EINVAL; 5350 return -EINVAL;
5307 5351
5308 len = num_chunks; 5352 if (copy_to_user(to, ch->chunks, num_chunks))
5353 return -EFAULT;
5354num:
5355 len = sizeof(struct sctp_authchunks) + num_chunks;
5309 if (put_user(len, optlen)) 5356 if (put_user(len, optlen))
5310 return -EFAULT; 5357 return -EFAULT;
5311 if (put_user(num_chunks, &p->gauth_number_of_chunks)) 5358 if (put_user(num_chunks, &p->gauth_number_of_chunks))
5312 return -EFAULT; 5359 return -EFAULT;
5313 if (copy_to_user(to, ch->chunks, len))
5314 return -EFAULT;
5315 5360
5316 return 0; 5361 return 0;
5317} 5362}
generated by cgit v1.2.2 (git 2.25.0) at 2025-12-05 07:56:36 -0500