12 files changed, 71 insertions, 74 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 6c7dc9d78e10..c25d453b2803 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4028,54 +4028,41 @@ static int dev_ifconf(struct net *net, char __user *arg)
 
 #ifdef CONFIG_PROC_FS
 
-#define BUCKET_SPACE (32 - NETDEV_HASHBITS)
-
-struct dev_iter_state {
-        struct seq_net_private p;
-        unsigned int pos; /* bucket << BUCKET_SPACE + offset */
-};
+#define BUCKET_SPACE (32 - NETDEV_HASHBITS - 1)
 
 #define get_bucket(x) ((x) >> BUCKET_SPACE)
 #define get_offset(x) ((x) & ((1 << BUCKET_SPACE) - 1))
 #define set_bucket_offset(b, o) ((b) << BUCKET_SPACE | (o))
 
-static inline struct net_device *dev_from_same_bucket(struct seq_file *seq)
+static inline struct net_device *dev_from_same_bucket(struct seq_file *seq, loff_t *pos)
 {
-        struct dev_iter_state *state = seq->private;
         struct net *net = seq_file_net(seq);
         struct net_device *dev;
         struct hlist_node *p;
         struct hlist_head *h;
-        unsigned int count, bucket, offset;
+        unsigned int count = 0, offset = get_offset(*pos);
 
-        bucket = get_bucket(state->pos);
-        offset = get_offset(state->pos);
-        h = &net->dev_name_head[bucket];
-        count = 0;
+        h = &net->dev_name_head[get_bucket(*pos)];
         hlist_for_each_entry_rcu(dev, p, h, name_hlist) {
-                if (count++ == offset) {
-                        state->pos = set_bucket_offset(bucket, count);
+                if (++count == offset)
                         return dev;
-                }
         }
 
         return NULL;
 }
 
-static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
+static inline struct net_device *dev_from_bucket(struct seq_file *seq, loff_t *pos)
 {
-        struct dev_iter_state *state = seq->private;
         struct net_device *dev;
         unsigned int bucket;
 
-        bucket = get_bucket(state->pos);
         do {
-                dev = dev_from_same_bucket(seq);
+                dev = dev_from_same_bucket(seq, pos);
                 if (dev)
                         return dev;
 
-                bucket++;
-                state->pos = set_bucket_offset(bucket, 0);
+                bucket = get_bucket(*pos) + 1;
+                *pos = set_bucket_offset(bucket, 1);
         } while (bucket < NETDEV_HASHENTRIES);
 
         return NULL;
@@ -4088,33 +4075,20 @@ static inline struct net_device *dev_from_new_bucket(struct seq_file *seq)
 void *dev_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(RCU)
 {
-        struct dev_iter_state *state = seq->private;
-
         rcu_read_lock();
         if (!*pos)
                 return SEQ_START_TOKEN;
 
-        /* check for end of the hash */
-        if (state->pos == 0 && *pos > 1)
+        if (get_bucket(*pos) >= NETDEV_HASHENTRIES)
                 return NULL;
 
-        return dev_from_new_bucket(seq);
+        return dev_from_bucket(seq, pos);
 }
 
 void *dev_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct net_device *dev;
-
         ++*pos;
-
-        if (v == SEQ_START_TOKEN)
-                return dev_from_new_bucket(seq);
-
-        dev = dev_from_same_bucket(seq);
-        if (dev)
-                return dev;
-
-        return dev_from_new_bucket(seq);
+        return dev_from_bucket(seq, pos);
 }
 
 void dev_seq_stop(struct seq_file *seq, void *v)
@@ -4213,13 +4187,7 @@ static const struct seq_operations dev_seq_ops = {
 static int dev_seq_open(struct inode *inode, struct file *file)
 {
         return seq_open_net(inode, file, &dev_seq_ops,
-                            sizeof(struct dev_iter_state));
-}
-
-int dev_seq_open_ops(struct inode *inode, struct file *file,
-                     const struct seq_operations *ops)
-{
-        return seq_open_net(inode, file, ops, sizeof(struct dev_iter_state));
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations dev_seq_fops = {
diff --git a/net/core/dev_addr_lists.c b/net/core/dev_addr_lists.c
index 29c07fef9228..626698f0db8b 100644
--- a/net/core/dev_addr_lists.c
+++ b/net/core/dev_addr_lists.c
@@ -696,7 +696,8 @@ static const struct seq_operations dev_mc_seq_ops = {
 
 static int dev_mc_seq_open(struct inode *inode, struct file *file)
 {
-        return dev_seq_open_ops(inode, file, &dev_mc_seq_ops);
+        return seq_open_net(inode, file, &dev_mc_seq_ops,
+                            sizeof(struct seq_net_private));
 }
 
 static const struct file_operations dev_mc_seq_fops = {
diff --git a/net/core/filter.c b/net/core/filter.c
index cf4989ac503b..6f755cca4520 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -39,8 +39,11 @@
 #include <linux/reciprocal_div.h>
 #include <linux/ratelimit.h>
 
-/* No hurry in this branch */
-static void *__load_pointer(const struct sk_buff *skb, int k, unsigned int size)
+/* No hurry in this branch
+ *
+ * Exported for the bpf jit load helper.
+ */
+void *bpf_internal_load_pointer_neg_helper(const struct sk_buff *skb, int k, unsigned int size)
 {
         u8 *ptr = NULL;
 
@@ -59,7 +62,7 @@ static inline void *load_pointer(const struct sk_buff *skb, int k,
 {
         if (k >= 0)
                 return skb_header_pointer(skb, k, size, buffer);
-        return __load_pointer(skb, k, size);
+        return bpf_internal_load_pointer_neg_helper(skb, k, size);
 }
 
 /**
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f223cdc75da6..baf8d281152c 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -3161,6 +3161,8 @@ static void sock_rmem_free(struct sk_buff *skb)
  */
 int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 {
+        int len = skb->len;
+
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned)sk->sk_rcvbuf)
                 return -ENOMEM;
@@ -3175,7 +3177,7 @@ int sock_queue_err_skb(struct sock *sk, struct sk_buff *skb)
 
         skb_queue_tail(&sk->sk_error_queue, skb);
         if (!sock_flag(sk, SOCK_DEAD))
-                sk->sk_data_ready(sk, skb->len);
+                sk->sk_data_ready(sk, len);
         return 0;
 }
 EXPORT_SYMBOL(sock_queue_err_skb);
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index cfd7edda0a8e..5d54ed30e821 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -860,7 +860,7 @@ wait_for_memory:
         }
 
 out:
-        if (copied)
+        if (copied && !(flags & MSG_SENDPAGE_NOTLAST))
                 tcp_push(sk, flags, mss_now, tp->nonagle);
         return copied;
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 16c33e308121..b2869cab2092 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2044,7 +2044,7 @@ static int ip6_mc_add_src(struct inet6_dev *idev, const struct in6_addr *pmca,
                 if (!delta)
                         pmc->mca_sfcount[sfmode]--;
                 for (j=0; j<i; j++)
-                        (void) ip6_mc_del1_src(pmc, sfmode, &psfsrc[i]);
+                        ip6_mc_del1_src(pmc, sfmode, &psfsrc[j]);
         } else if (isexclude != (pmc->mca_sfcount[MCAST_EXCLUDE] != 0)) {
                 struct ip6_sf_list *psf;
 
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index cbdb754dbb10..3cc4487ac349 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -735,6 +735,7 @@ __nf_conntrack_alloc(struct net *net, u16 zone,
 
 #ifdef CONFIG_NF_CONNTRACK_ZONES
 out_free:
+        atomic_dec(&net->ct.count);
         kmem_cache_free(net->ct.nf_conntrack_cachep, ct);
         return ERR_PTR(-ENOMEM);
 #endif
diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 0c8e43810ce3..59530e93fa58 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -150,6 +150,17 @@ err1:
         return ret;
 }
 
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+static void __xt_ct_tg_timeout_put(struct ctnl_timeout *timeout)
+{
+        typeof(nf_ct_timeout_put_hook) timeout_put;
+
+        timeout_put = rcu_dereference(nf_ct_timeout_put_hook);
+        if (timeout_put)
+                timeout_put(timeout);
+}
+#endif
+
 static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 {
         struct xt_ct_target_info_v1 *info = par->targinfo;
@@ -158,7 +169,9 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
         struct nf_conn *ct;
         int ret = 0;
         u8 proto;
-
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+        struct ctnl_timeout *timeout;
+#endif
         if (info->flags & ~XT_CT_NOTRACK)
                 return -EINVAL;
 
@@ -216,7 +229,6 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
 #ifdef CONFIG_NF_CONNTRACK_TIMEOUT
         if (info->timeout) {
                 typeof(nf_ct_timeout_find_get_hook) timeout_find_get;
-                struct ctnl_timeout *timeout;
                 struct nf_conn_timeout *timeout_ext;
 
                 rcu_read_lock();
@@ -245,7 +257,7 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
                                 pr_info("Timeout policy `%s' can only be "
                                         "used by L3 protocol number %d\n",
                                         info->timeout, timeout->l3num);
-                                goto err4;
+                                goto err5;
                         }
                         /* Make sure the timeout policy matches any existing
                          * protocol tracker, otherwise default to generic.
@@ -258,13 +270,13 @@ static int xt_ct_tg_check_v1(const struct xt_tgchk_param *par)
                                         "used by L4 protocol number %d\n",
                                         info->timeout,
                                         timeout->l4proto->l4proto);
-                                goto err4;
+                                goto err5;
                         }
                         timeout_ext = nf_ct_timeout_ext_add(ct, timeout,
-                                                            GFP_KERNEL);
+                                                            GFP_ATOMIC);
                         if (timeout_ext == NULL) {
                                 ret = -ENOMEM;
-                                goto err4;
+                                goto err5;
                         }
                 } else {
                         ret = -ENOENT;
@@ -281,8 +293,12 @@ out:
         info->ct = ct;
         return 0;
 
+#ifdef CONFIG_NF_CONNTRACK_TIMEOUT
+err5:
+        __xt_ct_tg_timeout_put(timeout);
 err4:
         rcu_read_unlock();
+#endif
 err3:
         nf_conntrack_free(ct);
 err2:
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 32bb75324e76..faa48f70b7c9 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -829,12 +829,19 @@ int netlink_attachskb(struct sock *sk, struct sk_buff *skb,
         return 0;
 }
 
-int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+static int __netlink_sendskb(struct sock *sk, struct sk_buff *skb)
 {
         int len = skb->len;
 
         skb_queue_tail(&sk->sk_receive_queue, skb);
         sk->sk_data_ready(sk, len);
+        return len;
+}
+
+int netlink_sendskb(struct sock *sk, struct sk_buff *skb)
+{
+        int len = __netlink_sendskb(sk, skb);
+
         sock_put(sk);
         return len;
 }
@@ -957,8 +964,7 @@ static int netlink_broadcast_deliver(struct sock *sk, struct sk_buff *skb)
         if (atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf &&
             !test_bit(0, &nlk->state)) {
                 skb_set_owner_r(skb, sk);
-                skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
+                __netlink_sendskb(sk, skb);
                 return atomic_read(&sk->sk_rmem_alloc) > (sk->sk_rcvbuf >> 1);
         }
         return -1;
@@ -1698,10 +1704,8 @@ static int netlink_dump(struct sock *sk)
 
                 if (sk_filter(sk, skb))
                         kfree_skb(skb);
-                else {
-                        skb_queue_tail(&sk->sk_receive_queue, skb);
-                        sk->sk_data_ready(sk, skb->len);
-                }
+                else
+                        __netlink_sendskb(sk, skb);
                 return 0;
         }
 
@@ -1715,10 +1719,8 @@ static int netlink_dump(struct sock *sk)
 
         if (sk_filter(sk, skb))
                 kfree_skb(skb);
-        else {
-                skb_queue_tail(&sk->sk_receive_queue, skb);
-                sk->sk_data_ready(sk, skb->len);
-        }
+        else
+                __netlink_sendskb(sk, skb);
 
         if (cb->done)
                 cb->done(cb);
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index 9f60008740e3..9726fe684ab8 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -1130,6 +1130,9 @@ static int pep_sendmsg(struct kiocb *iocb, struct sock *sk,
         int flags = msg->msg_flags;
         int err, done;
 
+        if (len > USHRT_MAX)
+                return -EMSGSIZE;
+
         if ((msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_NOSIGNAL|
                                 MSG_CMSG_COMPAT)) ||
                         !(msg->msg_flags & MSG_EOR))
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 06b42b7f5a02..92ba71dfe080 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -4133,9 +4133,10 @@ static int sctp_getsockopt_disable_fragments(struct sock *sk, int len,
 static int sctp_getsockopt_events(struct sock *sk, int len, char __user *optval,
                                   int __user *optlen)
 {
-        if (len < sizeof(struct sctp_event_subscribe))
+        if (len <= 0)
                 return -EINVAL;
-        len = sizeof(struct sctp_event_subscribe);
+        if (len > sizeof(struct sctp_event_subscribe))
+                len = sizeof(struct sctp_event_subscribe);
         if (put_user(len, optlen))
                 return -EFAULT;
         if (copy_to_user(optval, &sctp_sk(sk)->subscribe, len))
diff --git a/net/socket.c b/net/socket.c
index 484cc6953fc6..851edcd6b098 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -811,9 +811,9 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
 
         sock = file->private_data;
 
-        flags = !(file->f_flags & O_NONBLOCK) ? 0 : MSG_DONTWAIT;
-        if (more)
-                flags |= MSG_MORE;
+        flags = (file->f_flags & O_NONBLOCK) ? MSG_DONTWAIT : 0;
+        /* more is a combination of MSG_MORE and MSG_SENDPAGE_NOTLAST */
+        flags |= more;
 
         return kernel_sendpage(sock, page, offset, size, flags);
 }