12 files changed, 110 insertions, 78 deletions

diff --git a/net/ieee802154/netlink.c b/net/ieee802154/netlink.c
index 105ad10876af..27eda9fdf3c2 100644
--- a/net/ieee802154/netlink.c
+++ b/net/ieee802154/netlink.c
@@ -276,6 +276,9 @@ static struct net_device *ieee802154_nl_get_dev(struct genl_info *info)
         else
                 return NULL;
 
+        if (!dev)
+                return NULL;
+
         if (dev->type != ARPHRD_IEEE802154) {
                 dev_put(dev);
                 return NULL;
@@ -521,3 +524,6 @@ static void __exit ieee802154_nl_exit(void)
 }
 module_exit(ieee802154_nl_exit);
 
+MODULE_LICENSE("GPL v2");
+MODULE_DESCRIPTION("ieee 802.15.4 configuration interface");
+
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 8a3881e28aca..c29d75d8f1b1 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -801,11 +801,8 @@ static int arp_process(struct sk_buff *skb)
  *  cache.
  */
 
-        /*
-         *  Special case: IPv4 duplicate address detection packet (RFC2131)
-         *  and Gratuitous ARP/ARP Announce. (RFC3927, Section 2.4)
-         */
-        if (sip == 0 || tip == sip) {
+        /* Special case: IPv4 duplicate address detection packet (RFC2131) */
+        if (sip == 0) {
                 if (arp->ar_op == htons(ARPOP_REQUEST) &&
                     inet_addr_type(net, tip) == RTN_LOCAL &&
                     !arp_ignore(in_dev, sip, tip))
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 012cf5a68581..00a54b246dfe 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1021,6 +1021,9 @@ static void trie_rebalance(struct trie *t, struct tnode *tn)
                                       (struct node *)tn, wasfull);
 
                 tp = node_parent((struct node *) tn);
+                if (!tp)
+                        rcu_assign_pointer(t->trie, (struct node *)tn);
+
                 tnode_free_flush();
                 if (!tp)
                         break;
diff --git a/net/ipv4/netfilter/nf_nat_helper.c b/net/ipv4/netfilter/nf_nat_helper.c
index 155c008626c8..09172a65d9b6 100644
--- a/net/ipv4/netfilter/nf_nat_helper.c
+++ b/net/ipv4/netfilter/nf_nat_helper.c
@@ -191,7 +191,8 @@ nf_nat_mangle_tcp_packet(struct sk_buff *skb,
                                     ct, ctinfo);
                 /* Tell TCP window tracking about seq change */
                 nf_conntrack_tcp_update(skb, ip_hdrlen(skb),
-                                        ct, CTINFO2DIR(ctinfo));
+                                        ct, CTINFO2DIR(ctinfo),
+                                        (int)rep_len - (int)match_len);
 
                 nf_conntrack_event_cache(IPCT_NATSEQADJ, ct);
         }
@@ -377,6 +378,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         struct tcphdr *tcph;
         int dir;
         __be32 newseq, newack;
+        s16 seqoff, ackoff;
         struct nf_conn_nat *nat = nfct_nat(ct);
         struct nf_nat_seq *this_way, *other_way;
 
@@ -390,15 +392,18 @@ nf_nat_seq_adjust(struct sk_buff *skb,
 
         tcph = (void *)skb->data + ip_hdrlen(skb);
         if (after(ntohl(tcph->seq), this_way->correction_pos))
-                newseq = htonl(ntohl(tcph->seq) + this_way->offset_after);
+                seqoff = this_way->offset_after;
         else
-                newseq = htonl(ntohl(tcph->seq) + this_way->offset_before);
+                seqoff = this_way->offset_before;
 
         if (after(ntohl(tcph->ack_seq) - other_way->offset_before,
                   other_way->correction_pos))
-                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_after);
+                ackoff = other_way->offset_after;
         else
-                newack = htonl(ntohl(tcph->ack_seq) - other_way->offset_before);
+                ackoff = other_way->offset_before;
+
+        newseq = htonl(ntohl(tcph->seq) + seqoff);
+        newack = htonl(ntohl(tcph->ack_seq) - ackoff);
 
         inet_proto_csum_replace4(&tcph->check, skb, tcph->seq, newseq, 0);
         inet_proto_csum_replace4(&tcph->check, skb, tcph->ack_seq, newack, 0);
@@ -413,7 +418,7 @@ nf_nat_seq_adjust(struct sk_buff *skb,
         if (!nf_nat_sack_adjust(skb, tcph, ct, ctinfo))
                 return 0;
 
-        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir);
+        nf_conntrack_tcp_update(skb, ip_hdrlen(skb), ct, dir, seqoff);
 
         return 1;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 17b89c523f9d..7870a535dac6 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -903,13 +903,17 @@ int tcp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
                 iov++;
 
                 while (seglen > 0) {
-                        int copy;
+                        int copy = 0;
+                        int max = size_goal;
 
                         skb = tcp_write_queue_tail(sk);
+                        if (tcp_send_head(sk)) {
+                                if (skb->ip_summed == CHECKSUM_NONE)
+                                        max = mss_now;
+                                copy = max - skb->len;
+                        }
 
-                        if (!tcp_send_head(sk) ||
-                            (copy = size_goal - skb->len) <= 0) {
-
+                        if (copy <= 0) {
 new_segment:
                                 /* Allocate new segment. If the interface is SG,
                                  * allocate skb fitting to single page.
@@ -930,6 +934,7 @@ new_segment:
 
                                 skb_entail(sk, skb);
                                 copy = size_goal;
+                                max = size_goal;
                         }
 
                         /* Try to append data to the end of skb. */
@@ -1028,7 +1033,7 @@ new_segment:
                         if ((seglen -= copy) == 0 && iovlen == 0)
                                 goto out;
 
-                        if (skb->len < size_goal || (flags & MSG_OOB))
+                        if (skb->len < max || (flags & MSG_OOB))
                                 continue;
 
                         if (forced_push(tp)) {
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 416fc4c2e7eb..5bdf08d312d9 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -725,7 +725,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk)) {
+        if (skb->len <= mss_now || !sk_can_gso(sk) ||
+            skb->ip_summed == CHECKSUM_NONE) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index afde8f991646..2032dfe25ca8 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -617,8 +617,10 @@ err1:
 void nf_conntrack_expect_fini(struct net *net)
 {
         exp_proc_remove(net);
-        if (net_eq(net, &init_net))
+        if (net_eq(net, &init_net)) {
+                rcu_barrier(); /* Wait for call_rcu() before destroy */
                 kmem_cache_destroy(nf_ct_expect_cachep);
+        }
         nf_ct_free_hashtable(net->ct.expect_hash, net->ct.expect_vmalloc,
                              nf_ct_expect_hsize);
 }
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index 4b2c769d555f..fef95be334bd 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -186,6 +186,6 @@ void nf_ct_extend_unregister(struct nf_ct_ext_type *type)
         rcu_assign_pointer(nf_ct_ext_types[type->id], NULL);
         update_alloc_size(type);
         mutex_unlock(&nf_ct_ext_type_mutex);
-        synchronize_rcu();
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 EXPORT_SYMBOL_GPL(nf_ct_extend_unregister);
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index 33fc0a443f3d..97a82ba75376 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -720,8 +720,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
 /* Caller must linearize skb at tcp header. */
 void nf_conntrack_tcp_update(const struct sk_buff *skb,
                              unsigned int dataoff,
-                             struct nf_conn *ct,
-                             int dir)
+                             struct nf_conn *ct, int dir,
+                             s16 offset)
 {
         const struct tcphdr *tcph = (const void *)skb->data + dataoff;
         const struct ip_ct_tcp_state *sender = &ct->proto.tcp.seen[dir];
@@ -734,7 +734,7 @@ void nf_conntrack_tcp_update(const struct sk_buff *skb,
         /*
          * We have to worry for the ack in the reply packet only...
          */
-        if (after(end, ct->proto.tcp.seen[dir].td_end))
+        if (ct->proto.tcp.seen[dir].td_end + offset == end)
                 ct->proto.tcp.seen[dir].td_end = end;
         ct->proto.tcp.last_end = end;
         spin_unlock_bh(&ct->lock);
diff --git a/net/netfilter/xt_conntrack.c b/net/netfilter/xt_conntrack.c
index 0b7139f3dd78..fc581800698e 100644
--- a/net/netfilter/xt_conntrack.c
+++ b/net/netfilter/xt_conntrack.c
@@ -129,7 +129,7 @@ conntrack_addrcmp(const union nf_inet_addr *kaddr,
 
 static inline bool
 conntrack_mt_origsrc(const struct nf_conn *ct,
-                     const struct xt_conntrack_mtinfo1 *info,
+                     const struct xt_conntrack_mtinfo2 *info,
                      u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.src.u3,
@@ -138,7 +138,7 @@ conntrack_mt_origsrc(const struct nf_conn *ct,
 
 static inline bool
 conntrack_mt_origdst(const struct nf_conn *ct,
-                     const struct xt_conntrack_mtinfo1 *info,
+                     const struct xt_conntrack_mtinfo2 *info,
                      u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3,
@@ -147,7 +147,7 @@ conntrack_mt_origdst(const struct nf_conn *ct,
 
 static inline bool
 conntrack_mt_replsrc(const struct nf_conn *ct,
-                     const struct xt_conntrack_mtinfo1 *info,
+                     const struct xt_conntrack_mtinfo2 *info,
                      u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.src.u3,
@@ -156,7 +156,7 @@ conntrack_mt_replsrc(const struct nf_conn *ct,
 
 static inline bool
 conntrack_mt_repldst(const struct nf_conn *ct,
-                     const struct xt_conntrack_mtinfo1 *info,
+                     const struct xt_conntrack_mtinfo2 *info,
                      u_int8_t family)
 {
         return conntrack_addrcmp(&ct->tuplehash[IP_CT_DIR_REPLY].tuple.dst.u3,
@@ -164,7 +164,7 @@ conntrack_mt_repldst(const struct nf_conn *ct,
 }
 
 static inline bool
-ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info,
+ct_proto_port_check(const struct xt_conntrack_mtinfo2 *info,
                     const struct nf_conn *ct)
 {
         const struct nf_conntrack_tuple *tuple;
@@ -204,7 +204,7 @@ ct_proto_port_check(const struct xt_conntrack_mtinfo1 *info,
 static bool
 conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
 {
-        const struct xt_conntrack_mtinfo1 *info = par->matchinfo;
+        const struct xt_conntrack_mtinfo2 *info = par->matchinfo;
         enum ip_conntrack_info ctinfo;
         const struct nf_conn *ct;
         unsigned int statebit;
@@ -278,6 +278,16 @@ conntrack_mt(const struct sk_buff *skb, const struct xt_match_param *par)
         return true;
 }
 
+static bool
+conntrack_mt_v1(const struct sk_buff *skb, const struct xt_match_param *par)
+{
+        const struct xt_conntrack_mtinfo2 *const *info = par->matchinfo;
+        struct xt_match_param newpar = *par;
+
+        newpar.matchinfo = *info;
+        return conntrack_mt(skb, &newpar);
+}
+
 static bool conntrack_mt_check(const struct xt_mtchk_param *par)
 {
         if (nf_ct_l3proto_try_module_get(par->family) < 0) {
@@ -288,11 +298,45 @@ static bool conntrack_mt_check(const struct xt_mtchk_param *par)
         return true;
 }
 
+static bool conntrack_mt_check_v1(const struct xt_mtchk_param *par)
+{
+        struct xt_conntrack_mtinfo1 *info = par->matchinfo;
+        struct xt_conntrack_mtinfo2 *up;
+        int ret = conntrack_mt_check(par);
+
+        if (ret < 0)
+                return ret;
+
+        up = kmalloc(sizeof(*up), GFP_KERNEL);
+        if (up == NULL) {
+                nf_ct_l3proto_module_put(par->family);
+                return -ENOMEM;
+        }
+
+        /*
+         * The strategy here is to minimize the overhead of v1 matching,
+         * by prebuilding a v2 struct and putting the pointer into the
+         * v1 dataspace.
+         */
+        memcpy(up, info, offsetof(typeof(*info), state_mask));
+        up->state_mask  = info->state_mask;
+        up->status_mask = info->status_mask;
+        *(void **)info  = up;
+        return true;
+}
+
 static void conntrack_mt_destroy(const struct xt_mtdtor_param *par)
 {
         nf_ct_l3proto_module_put(par->family);
 }
 
+static void conntrack_mt_destroy_v1(const struct xt_mtdtor_param *par)
+{
+        struct xt_conntrack_mtinfo2 **info = par->matchinfo;
+        kfree(*info);
+        conntrack_mt_destroy(par);
+}
+
 #ifdef CONFIG_COMPAT
 struct compat_xt_conntrack_info
 {
@@ -363,6 +407,16 @@ static struct xt_match conntrack_mt_reg[] __read_mostly = {
                 .revision   = 1,
                 .family     = NFPROTO_UNSPEC,
                 .matchsize  = sizeof(struct xt_conntrack_mtinfo1),
+                .match      = conntrack_mt_v1,
+                .checkentry = conntrack_mt_check_v1,
+                .destroy    = conntrack_mt_destroy_v1,
+                .me         = THIS_MODULE,
+        },
+        {
+                .name       = "conntrack",
+                .revision   = 2,
+                .family     = NFPROTO_UNSPEC,
+                .matchsize  = sizeof(struct xt_conntrack_mtinfo2),
                 .match      = conntrack_mt,
                 .checkentry = conntrack_mt_check,
                 .destroy    = conntrack_mt_destroy,
diff --git a/net/sctp/output.c b/net/sctp/output.c
index b76411444515..b94c21190566 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -407,7 +407,7 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         }
         dst = dst_clone(tp->dst);
         skb_dst_set(nskb, dst);
-        if (dst)
+        if (!dst)
                 goto no_route;
 
         /* Build the SCTP header.  */
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5f1f86565f16..f2f7c638083e 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -668,22 +668,10 @@ static struct xfrm_state *__xfrm_state_lookup(struct net *net, xfrm_address_t *d
         hlist_for_each_entry(x, entry, net->xfrm.state_byspi+h, byspi) {
                 if (x->props.family != family ||
                     x->id.spi       != spi ||
-                    x->id.proto     != proto)
+                    x->id.proto     != proto ||
+                    xfrm_addr_cmp(&x->id.daddr, daddr, family))
                         continue;
 
-                switch (family) {
-                case AF_INET:
-                        if (x->id.daddr.a4 != daddr->a4)
-                                continue;
-                        break;
-                case AF_INET6:
-                        if (!ipv6_addr_equal((struct in6_addr *)daddr,
-                                             (struct in6_addr *)
-                                             x->id.daddr.a6))
-                                continue;
-                        break;
-                }
-
                 xfrm_state_hold(x);
                 return x;
         }
@@ -699,26 +687,11 @@ static struct xfrm_state *__xfrm_state_lookup_byaddr(struct net *net, xfrm_addre
 
         hlist_for_each_entry(x, entry, net->xfrm.state_bysrc+h, bysrc) {
                 if (x->props.family != family ||
-                    x->id.proto     != proto)
+                    x->id.proto     != proto ||
+                    xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
+                    xfrm_addr_cmp(&x->props.saddr, saddr, family))
                         continue;
 
-                switch (family) {
-                case AF_INET:
-                        if (x->id.daddr.a4 != daddr->a4 ||
-                            x->props.saddr.a4 != saddr->a4)
-                                continue;
-                        break;
-                case AF_INET6:
-                        if (!ipv6_addr_equal((struct in6_addr *)daddr,
-                                             (struct in6_addr *)
-                                             x->id.daddr.a6) ||
-                            !ipv6_addr_equal((struct in6_addr *)saddr,
-                                             (struct in6_addr *)
-                                             x->props.saddr.a6))
-                                continue;
-                        break;
-                }
-
                 xfrm_state_hold(x);
                 return x;
         }
@@ -1001,25 +974,11 @@ static struct xfrm_state *__find_acq_core(struct net *net, unsigned short family
                     x->props.family != family ||
                     x->km.state     != XFRM_STATE_ACQ ||
                     x->id.spi       != 0 ||
-                    x->id.proto     != proto)
+                    x->id.proto     != proto ||
+                    xfrm_addr_cmp(&x->id.daddr, daddr, family) ||
+                    xfrm_addr_cmp(&x->props.saddr, saddr, family))
                         continue;
 
-                switch (family) {
-                case AF_INET:
-                        if (x->id.daddr.a4    != daddr->a4 ||
-                            x->props.saddr.a4 != saddr->a4)
-                                continue;
-                        break;
-                case AF_INET6:
-                        if (!ipv6_addr_equal((struct in6_addr *)x->id.daddr.a6,
-                                             (struct in6_addr *)daddr) ||
-                            !ipv6_addr_equal((struct in6_addr *)
-                                             x->props.saddr.a6,
-                                             (struct in6_addr *)saddr))
-                                continue;
-                        break;
-                }
-
                 xfrm_state_hold(x);
                 return x;
         }