4 files changed, 19 insertions, 9 deletions

diff --git a/net/core/sock.c b/net/core/sock.c
index 653f8c0aedc5..9e5b71fda6ec 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1592,6 +1592,11 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
         gfp_t gfp_mask;
         long timeo;
         int err;
+        int npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
+
+        err = -EMSGSIZE;
+        if (npages > MAX_SKB_FRAGS)
+                goto failure;
 
         gfp_mask = sk->sk_allocation;
         if (gfp_mask & __GFP_WAIT)
@@ -1610,14 +1615,12 @@ struct sk_buff *sock_alloc_send_pskb(struct sock *sk, unsigned long header_len,
                 if (atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
                         skb = alloc_skb(header_len, gfp_mask);
                         if (skb) {
-                                int npages;
                                 int i;
 
                                 /* No pages, we're done... */
                                 if (!data_len)
                                         break;
 
-                                npages = (data_len + (PAGE_SIZE - 1)) >> PAGE_SHIFT;
                                 skb->truesize += data_len;
                                 skb_shinfo(skb)->nr_frags = npages;
                                 for (i = 0; i < npages; i++) {
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 95e61596e605..f9ee7417f6a0 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -377,7 +377,8 @@ struct dst_entry *inet_csk_route_req(struct sock *sk,
 
         flowi4_init_output(fl4, sk->sk_bound_dev_if, sk->sk_mark,
                            RT_CONN_FLAGS(sk), RT_SCOPE_UNIVERSE,
-                           sk->sk_protocol, inet_sk_flowi_flags(sk),
+                           sk->sk_protocol,
+                           inet_sk_flowi_flags(sk) & ~FLOWI_FLAG_PRECOW_METRICS,
                            (opt && opt->opt.srr) ? opt->opt.faddr : ireq->rmt_addr,
                            ireq->loc_addr, ireq->rmt_port, inet_sk(sk)->inet_sport);
         security_req_classify_flow(req, flowi4_to_flowi(fl4));
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a43b87dfe800..c8d28c433b2b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -824,7 +824,8 @@ static void tcp_v4_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
  */
 static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
                               struct request_sock *req,
-                              struct request_values *rvp)
+                              struct request_values *rvp,
+                              u16 queue_mapping)
 {
         const struct inet_request_sock *ireq = inet_rsk(req);
         struct flowi4 fl4;
@@ -840,6 +841,7 @@ static int tcp_v4_send_synack(struct sock *sk, struct dst_entry *dst,
         if (skb) {
                 __tcp_v4_send_check(skb, ireq->loc_addr, ireq->rmt_addr);
 
+                skb_set_queue_mapping(skb, queue_mapping);
                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
                                             ireq->rmt_addr,
                                             ireq->opt);
@@ -854,7 +856,7 @@ static int tcp_v4_rtx_synack(struct sock *sk, struct request_sock *req,
                               struct request_values *rvp)
 {
         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
-        return tcp_v4_send_synack(sk, NULL, req, rvp);
+        return tcp_v4_send_synack(sk, NULL, req, rvp, 0);
 }
 
 /*
@@ -1422,7 +1424,8 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->snt_synack = tcp_time_stamp;
 
         if (tcp_v4_send_synack(sk, dst, req,
-                               (struct request_values *)&tmp_ext) ||
+                               (struct request_values *)&tmp_ext,
+                               skb_get_queue_mapping(skb)) ||
             want_cookie)
                 goto drop_and_free;
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 554d5999abc4..3a9aec29581a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -476,7 +476,8 @@ out:
 
 
 static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
-                              struct request_values *rvp)
+                              struct request_values *rvp,
+                              u16 queue_mapping)
 {
         struct inet6_request_sock *treq = inet6_rsk(req);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -513,6 +514,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 
                 fl6.daddr = treq->rmt_addr;
+                skb_set_queue_mapping(skb, queue_mapping);
                 err = ip6_xmit(sk, skb, &fl6, opt, np->tclass);
                 err = net_xmit_eval(err);
         }
@@ -528,7 +530,7 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
                              struct request_values *rvp)
 {
         TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
-        return tcp_v6_send_synack(sk, req, rvp);
+        return tcp_v6_send_synack(sk, req, rvp, 0);
 }
 
 static void tcp_v6_reqsk_destructor(struct request_sock *req)
@@ -1213,7 +1215,8 @@ have_isn:
         security_inet_conn_request(sk, skb, req);
 
         if (tcp_v6_send_synack(sk, req,
-                               (struct request_values *)&tmp_ext) ||
+                               (struct request_values *)&tmp_ext,
+                               skb_get_queue_mapping(skb)) ||
             want_cookie)
                 goto drop_and_free;