11 files changed, 75 insertions, 45 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 8836575f9d79..a29c5ab5815c 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -281,8 +281,11 @@ out_uninit_applicant:
         if (ngrp)
                 vlan_gvrp_uninit_applicant(real_dev);
 out_free_group:
-        if (ngrp)
-                vlan_group_free(ngrp);
+        if (ngrp) {
+                hlist_del_rcu(&ngrp->hlist);
+                /* Free the group, after all cpu's are done. */
+                call_rcu(&ngrp->rcu, vlan_rcu_free);
+        }
         return err;
 }
 
diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
index a9750984f772..b7c4224f4e7d 100644
--- a/net/bluetooth/hci_conn.c
+++ b/net/bluetooth/hci_conn.c
@@ -211,6 +211,7 @@ struct hci_conn *hci_conn_add(struct hci_dev *hdev, int type, bdaddr_t *dst)
         conn->type  = type;
         conn->mode  = HCI_CM_ACTIVE;
         conn->state = BT_OPEN;
+        conn->auth_type = HCI_AT_GENERAL_BONDING;
 
         conn->power_save = 1;
         conn->disc_timeout = HCI_DISCONN_TIMEOUT;
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 77e9fb130adb..947f8bbb4bb3 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2205,7 +2205,7 @@ static int l2cap_build_conf_req(struct sock *sk, void *data)
 {
         struct l2cap_pinfo *pi = l2cap_pi(sk);
         struct l2cap_conf_req *req = data;
-        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_ERTM };
+        struct l2cap_conf_rfc rfc = { .mode = L2CAP_MODE_BASIC };
         void *ptr = req->data;
 
         BT_DBG("sk %p", sk);
@@ -2394,6 +2394,10 @@ done:
                         rfc.monitor_timeout = L2CAP_DEFAULT_MONITOR_TO;
 
                         pi->conf_state |= L2CAP_CONF_MODE_DONE;
+
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+
                         break;
 
                 case L2CAP_MODE_STREAMING:
@@ -2401,6 +2405,10 @@ done:
                         pi->max_pdu_size = rfc.max_pdu_size;
 
                         pi->conf_state |= L2CAP_CONF_MODE_DONE;
+
+                        l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
+                                        sizeof(rfc), (unsigned long) &rfc);
+
                         break;
 
                 default:
@@ -2410,9 +2418,6 @@ done:
                         rfc.mode = pi->mode;
                 }
 
-                l2cap_add_conf_opt(&ptr, L2CAP_CONF_RFC,
-                                        sizeof(rfc), (unsigned long) &rfc);
-
                 if (result == L2CAP_CONF_SUCCESS)
                         pi->conf_state |= L2CAP_CONF_OUTPUT_DONE;
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index b8f74cfb1bfd..fe10551d3671 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -942,14 +942,15 @@ rollback:
         ret = notifier_to_errno(ret);
 
         if (ret) {
-                if (err) {
-                        printk(KERN_ERR
-                               "%s: name change rollback failed: %d.\n",
-                               dev->name, ret);
-                } else {
+                /* err >= 0 after dev_alloc_name() or stores the first errno */
+                if (err >= 0) {
                         err = ret;
                         memcpy(dev->name, oldname, IFNAMSIZ);
                         goto rollback;
+                } else {
+                        printk(KERN_ERR
+                               "%s: name change rollback failed: %d.\n",
+                               dev->name, ret);
                 }
         }
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 80a96166df39..ec85681a7dd8 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2701,7 +2701,8 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
 
                 NAPI_GRO_CB(skb)->free = 1;
                 goto done;
-        }
+        } else if (skb_gro_len(p) != pinfo->gso_size)
+                return -E2BIG;
 
         headroom = skb_headroom(p);
         nskb = netdev_alloc_skb(p->dev, headroom + skb_gro_offset(p));
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index 630a56df7b47..99508d66a642 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -483,8 +483,10 @@ static int vif_add(struct net *net, struct vifctl *vifc, int mrtsock)
                 return -EINVAL;
         }
 
-        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL)
+        if ((in_dev = __in_dev_get_rtnl(dev)) == NULL) {
+                dev_put(dev);
                 return -EADDRNOTAVAIL;
+        }
         IPV4_DEVCONF(in_dev->cnf, MC_FORWARDING)++;
         ip_rt_multicast_event(in_dev);
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 98440ad82558..f1813bc71088 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1183,7 +1183,9 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
 #if TCP_DEBUG
         struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 
-        WARN_ON(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
+        WARN(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq),
+             KERN_INFO "cleanup rbuf bug: copied %X seq %X rcvnxt %X\n",
+             tp->copied_seq, TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt);
 #endif
 
         if (inet_csk_ack_scheduled(sk)) {
@@ -1430,11 +1432,13 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         /* Now that we have two receive queues this
                          * shouldn't happen.
                          */
-                        if (before(*seq, TCP_SKB_CB(skb)->seq)) {
-                                printk(KERN_INFO "recvmsg bug: copied %X "
-                                       "seq %X\n", *seq, TCP_SKB_CB(skb)->seq);
+                        if (WARN(before(*seq, TCP_SKB_CB(skb)->seq),
+                             KERN_INFO "recvmsg bug: copied %X "
+                                       "seq %X rcvnxt %X fl %X\n", *seq,
+                                       TCP_SKB_CB(skb)->seq, tp->rcv_nxt,
+                                       flags))
                                 break;
-                        }
+
                         offset = *seq - TCP_SKB_CB(skb)->seq;
                         if (tcp_hdr(skb)->syn)
                                 offset--;
@@ -1443,8 +1447,9 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                         if (tcp_hdr(skb)->fin)
                                 goto found_fin_ok;
                         WARN(!(flags & MSG_PEEK), KERN_INFO "recvmsg bug 2: "
-                                        "copied %X seq %X\n", *seq,
-                                        TCP_SKB_CB(skb)->seq);
+                                        "copied %X seq %X rcvnxt %X fl %X\n",
+                                        *seq, TCP_SKB_CB(skb)->seq,
+                                        tp->rcv_nxt, flags);
                 }
 
                 /* Well, if we have backlog, try to process it now yet. */
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 8450960df24f..7eed77a39d0d 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1485,15 +1485,13 @@ void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned len)
  * local endpoint and the remote peer.
  */
 int sctp_assoc_set_bind_addr_from_ep(struct sctp_association *asoc,
-                                     gfp_t gfp)
+                                     sctp_scope_t scope, gfp_t gfp)
 {
-        sctp_scope_t scope;
         int flags;
 
         /* Use scoping rules to determine the subset of addresses from
          * the endpoint.
          */
-        scope = sctp_scope(&asoc->peer.active_path->ipaddr);
         flags = (PF_INET6 == asoc->base.sk->sk_family) ? SCTP_ADDR6_ALLOWED : 0;
         if (asoc->peer.ipv4_address)
                 flags |= SCTP_ADDR4_PEERSUPP;
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index c8fae1983dd1..d4df45022ffa 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -384,6 +384,11 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
         if (!new_asoc)
                 goto nomem;
 
+        if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
+                                             sctp_scope(sctp_source(chunk)),
+                                             GFP_ATOMIC) < 0)
+                goto nomem_init;
+
         /* The call, sctp_process_init(), can fail on memory allocation.  */
         if (!sctp_process_init(new_asoc, chunk->chunk_hdr->type,
                                sctp_source(chunk),
@@ -401,9 +406,6 @@ sctp_disposition_t sctp_sf_do_5_1B_init(const struct sctp_endpoint *ep,
                 len = ntohs(err_chunk->chunk_hdr->length) -
                         sizeof(sctp_chunkhdr_t);
 
-        if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
-                goto nomem_init;
-
         repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
         if (!repl)
                 goto nomem_init;
@@ -1452,6 +1454,10 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
         if (!new_asoc)
                 goto nomem;
 
+        if (sctp_assoc_set_bind_addr_from_ep(new_asoc,
+                                sctp_scope(sctp_source(chunk)), GFP_ATOMIC) < 0)
+                goto nomem;
+
         /* In the outbound INIT ACK the endpoint MUST copy its current
          * Verification Tag and Peers Verification tag into a reserved
          * place (local tie-tag and per tie-tag) within the state cookie.
@@ -1488,9 +1494,6 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
                         sizeof(sctp_chunkhdr_t);
         }
 
-        if (sctp_assoc_set_bind_addr_from_ep(new_asoc, GFP_ATOMIC) < 0)
-                goto nomem;
-
         repl = sctp_make_init_ack(new_asoc, chunk, GFP_ATOMIC, len);
         if (!repl)
                 goto nomem;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index c8d05758661d..3a95fcb17a9e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1080,6 +1080,13 @@ static int __sctp_connect(struct sock* sk,
                                 err = -ENOMEM;
                                 goto out_free;
                         }
+
+                        err = sctp_assoc_set_bind_addr_from_ep(asoc, scope,
+                                                              GFP_KERNEL);
+                        if (err < 0) {
+                                goto out_free;
+                        }
+
                 }
 
                 /* Prime the peer's transport structures.  */
@@ -1095,11 +1102,6 @@ static int __sctp_connect(struct sock* sk,
                 walk_size += af->sockaddr_len;
         }
 
-        err = sctp_assoc_set_bind_addr_from_ep(asoc, GFP_KERNEL);
-        if (err < 0) {
-                goto out_free;
-        }
-
         /* In case the user of sctp_connectx() wants an association
          * id back, assign one now.
          */
@@ -1274,22 +1276,30 @@ SCTP_STATIC int sctp_setsockopt_connectx(struct sock* sk,
 }
 
 /*
- * New (hopefully final) interface for the API.  The option buffer is used
- * both for the returned association id and the addresses.
+ * New (hopefully final) interface for the API.
+ * We use the sctp_getaddrs_old structure so that use-space library
+ * can avoid any unnecessary allocations.   The only defferent part
+ * is that we store the actual length of the address buffer into the
+ * addrs_num structure member.  That way we can re-use the existing
+ * code.
  */
 SCTP_STATIC int sctp_getsockopt_connectx3(struct sock* sk, int len,
                                         char __user *optval,
                                         int __user *optlen)
 {
+        struct sctp_getaddrs_old param;
         sctp_assoc_t assoc_id = 0;
         int err = 0;
 
-        if (len < sizeof(assoc_id))
+        if (len < sizeof(param))
                 return -EINVAL;
 
+        if (copy_from_user(&param, optval, sizeof(param)))
+                return -EFAULT;
+
         err = __sctp_setsockopt_connectx(sk,
-                        (struct sockaddr __user *)(optval + sizeof(assoc_id)),
-                        len - sizeof(assoc_id), &assoc_id);
+                        (struct sockaddr __user *)param.addrs,
+                        param.addr_num, &assoc_id);
 
         if (err == 0 || err == -EINPROGRESS) {
                 if (copy_to_user(optval, &assoc_id, sizeof(assoc_id)))
@@ -1689,6 +1699,11 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                         goto out_unlock;
                 }
                 asoc = new_asoc;
+                err = sctp_assoc_set_bind_addr_from_ep(asoc, scope, GFP_KERNEL);
+                if (err < 0) {
+                        err = -ENOMEM;
+                        goto out_free;
+                }
 
                 /* If the SCTP_INIT ancillary data is specified, set all
                  * the association init values accordingly.
@@ -1718,11 +1733,6 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                         err = -ENOMEM;
                         goto out_free;
                 }
-                err = sctp_assoc_set_bind_addr_from_ep(asoc, GFP_KERNEL);
-                if (err < 0) {
-                        err = -ENOMEM;
-                        goto out_free;
-                }
         }
 
         /* ASSERT: we have a valid association at this point.  */
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index c256e4839316..3b141bb32faf 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -308,7 +308,8 @@ void sctp_transport_route(struct sctp_transport *transport,
                 /* Initialize sk->sk_rcv_saddr, if the transport is the
                  * association's active path for getsockname().
                  */
-                if (asoc && (transport == asoc->peer.active_path))
+                if (asoc && (!asoc->peer.primary_path ||
+                                (transport == asoc->peer.active_path)))
                         opt->pf->af->to_sk_saddr(&transport->saddr,
                                                  asoc->base.sk);
         } else