aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/bluetooth/hci_core.c7
-rw-r--r--net/bluetooth/l2cap_core.c3
-rw-r--r--net/bluetooth/l2cap_sock.c5
-rw-r--r--net/bluetooth/mgmt.c13
-rw-r--r--net/bridge/br_multicast.c81
-rw-r--r--net/bridge/br_private.h4
-rw-r--r--net/core/skbuff.c4
-rw-r--r--net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c12
-rw-r--r--net/ipv4/tcp.c15
-rw-r--r--net/ipv4/tcp_input.c9
-rw-r--r--net/ipv4/tcp_ipv4.c2
-rw-r--r--net/ipv4/tcp_output.c2
-rw-r--r--net/ipv6/netfilter/ip6_tables.c14
-rw-r--r--net/ipv6/tcp_ipv6.c2
-rw-r--r--net/mac80211/mlme.c3
-rw-r--r--net/netfilter/nf_conntrack_core.c2
-rw-r--r--net/netfilter/nf_conntrack_proto_tcp.c4
-rw-r--r--net/nfc/llcp/commands.c4
-rw-r--r--net/wireless/nl80211.c31
-rw-r--r--net/wireless/wext-core.c6
20 files changed, 79 insertions, 144 deletions
diff --git a/net/bluetooth/hci_core.c b/net/bluetooth/hci_core.c
index e33af63a884a..92a857e3786d 100644
--- a/net/bluetooth/hci_core.c
+++ b/net/bluetooth/hci_core.c
@@ -665,6 +665,11 @@ int hci_dev_open(__u16 dev)
665 665
666 hci_req_lock(hdev); 666 hci_req_lock(hdev);
667 667
668 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
669 ret = -ENODEV;
670 goto done;
671 }
672
668 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) { 673 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
669 ret = -ERFKILL; 674 ret = -ERFKILL;
670 goto done; 675 goto done;
@@ -1849,6 +1854,8 @@ void hci_unregister_dev(struct hci_dev *hdev)
1849 1854
1850 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); 1855 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1851 1856
1857 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
1858
1852 write_lock(&hci_dev_list_lock); 1859 write_lock(&hci_dev_list_lock);
1853 list_del(&hdev->list); 1860 list_del(&hdev->list);
1854 write_unlock(&hci_dev_list_lock); 1861 write_unlock(&hci_dev_list_lock);
diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index b8e17e4dac8b..94552b33d528 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c
@@ -1308,6 +1308,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
1308 if (chan->retry_count >= chan->remote_max_tx) { 1308 if (chan->retry_count >= chan->remote_max_tx) {
1309 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED); 1309 l2cap_send_disconn_req(chan->conn, chan, ECONNABORTED);
1310 l2cap_chan_unlock(chan); 1310 l2cap_chan_unlock(chan);
1311 l2cap_chan_put(chan);
1311 return; 1312 return;
1312 } 1313 }
1313 1314
@@ -1316,6 +1317,7 @@ static void l2cap_monitor_timeout(struct work_struct *work)
1316 1317
1317 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL); 1318 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
1318 l2cap_chan_unlock(chan); 1319 l2cap_chan_unlock(chan);
1320 l2cap_chan_put(chan);
1319} 1321}
1320 1322
1321static void l2cap_retrans_timeout(struct work_struct *work) 1323static void l2cap_retrans_timeout(struct work_struct *work)
@@ -1335,6 +1337,7 @@ static void l2cap_retrans_timeout(struct work_struct *work)
1335 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL); 1337 l2cap_send_rr_or_rnr(chan, L2CAP_CTRL_POLL);
1336 1338
1337 l2cap_chan_unlock(chan); 1339 l2cap_chan_unlock(chan);
1340 l2cap_chan_put(chan);
1338} 1341}
1339 1342
1340static void l2cap_drop_acked_frames(struct l2cap_chan *chan) 1343static void l2cap_drop_acked_frames(struct l2cap_chan *chan)
diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index c4fe583b0af6..29122ed28ea9 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c
@@ -82,7 +82,7 @@ static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
82 } 82 }
83 83
84 if (la.l2_cid) 84 if (la.l2_cid)
85 err = l2cap_add_scid(chan, la.l2_cid); 85 err = l2cap_add_scid(chan, __le16_to_cpu(la.l2_cid));
86 else 86 else
87 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm); 87 err = l2cap_add_psm(chan, &la.l2_bdaddr, la.l2_psm);
88 88
@@ -123,7 +123,8 @@ static int l2cap_sock_connect(struct socket *sock, struct sockaddr *addr, int al
123 if (la.l2_cid && la.l2_psm) 123 if (la.l2_cid && la.l2_psm)
124 return -EINVAL; 124 return -EINVAL;
125 125
126 err = l2cap_chan_connect(chan, la.l2_psm, la.l2_cid, &la.l2_bdaddr); 126 err = l2cap_chan_connect(chan, la.l2_psm, __le16_to_cpu(la.l2_cid),
127 &la.l2_bdaddr);
127 if (err) 128 if (err)
128 return err; 129 return err;
129 130
diff --git a/net/bluetooth/mgmt.c b/net/bluetooth/mgmt.c
index 7fcff8887131..4ef275c69675 100644
--- a/net/bluetooth/mgmt.c
+++ b/net/bluetooth/mgmt.c
@@ -2523,13 +2523,18 @@ static int set_fast_connectable(struct sock *sk, struct hci_dev *hdev,
2523 2523
2524 if (cp->val) { 2524 if (cp->val) {
2525 type = PAGE_SCAN_TYPE_INTERLACED; 2525 type = PAGE_SCAN_TYPE_INTERLACED;
2526 acp.interval = 0x0024; /* 22.5 msec page scan interval */ 2526
2527 /* 22.5 msec page scan interval */
2528 acp.interval = __constant_cpu_to_le16(0x0024);
2527 } else { 2529 } else {
2528 type = PAGE_SCAN_TYPE_STANDARD; /* default */ 2530 type = PAGE_SCAN_TYPE_STANDARD; /* default */
2529 acp.interval = 0x0800; /* default 1.28 sec page scan */ 2531
2532 /* default 1.28 sec page scan */
2533 acp.interval = __constant_cpu_to_le16(0x0800);
2530 } 2534 }
2531 2535
2532 acp.window = 0x0012; /* default 11.25 msec page scan window */ 2536 /* default 11.25 msec page scan window */
2537 acp.window = __constant_cpu_to_le16(0x0012);
2533 2538
2534 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp), 2539 err = hci_send_cmd(hdev, HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, sizeof(acp),
2535 &acp); 2540 &acp);
@@ -2936,7 +2941,7 @@ int mgmt_device_connected(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 link_type,
2936 name, name_len); 2941 name, name_len);
2937 2942
2938 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0) 2943 if (dev_class && memcmp(dev_class, "\0\0\0", 3) != 0)
2939 eir_len = eir_append_data(&ev->eir[eir_len], eir_len, 2944 eir_len = eir_append_data(ev->eir, eir_len,
2940 EIR_CLASS_OF_DEV, dev_class, 3); 2945 EIR_CLASS_OF_DEV, dev_class, 3);
2941 2946
2942 put_unaligned_le16(eir_len, &ev->eir_len); 2947 put_unaligned_le16(eir_len, &ev->eir_len);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 702a1ae9220b..27ca25ed7021 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -241,7 +241,6 @@ static void br_multicast_group_expired(unsigned long data)
241 hlist_del_rcu(&mp->hlist[mdb->ver]); 241 hlist_del_rcu(&mp->hlist[mdb->ver]);
242 mdb->size--; 242 mdb->size--;
243 243
244 del_timer(&mp->query_timer);
245 call_rcu_bh(&mp->rcu, br_multicast_free_group); 244 call_rcu_bh(&mp->rcu, br_multicast_free_group);
246 245
247out: 246out:
@@ -271,7 +270,6 @@ static void br_multicast_del_pg(struct net_bridge *br,
271 rcu_assign_pointer(*pp, p->next); 270 rcu_assign_pointer(*pp, p->next);
272 hlist_del_init(&p->mglist); 271 hlist_del_init(&p->mglist);
273 del_timer(&p->timer); 272 del_timer(&p->timer);
274 del_timer(&p->query_timer);
275 call_rcu_bh(&p->rcu, br_multicast_free_pg); 273 call_rcu_bh(&p->rcu, br_multicast_free_pg);
276 274
277 if (!mp->ports && !mp->mglist && 275 if (!mp->ports && !mp->mglist &&
@@ -507,74 +505,6 @@ static struct sk_buff *br_multicast_alloc_query(struct net_bridge *br,
507 return NULL; 505 return NULL;
508} 506}
509 507
510static void br_multicast_send_group_query(struct net_bridge_mdb_entry *mp)
511{
512 struct net_bridge *br = mp->br;
513 struct sk_buff *skb;
514
515 skb = br_multicast_alloc_query(br, &mp->addr);
516 if (!skb)
517 goto timer;
518
519 netif_rx(skb);
520
521timer:
522 if (++mp->queries_sent < br->multicast_last_member_count)
523 mod_timer(&mp->query_timer,
524 jiffies + br->multicast_last_member_interval);
525}
526
527static void br_multicast_group_query_expired(unsigned long data)
528{
529 struct net_bridge_mdb_entry *mp = (void *)data;
530 struct net_bridge *br = mp->br;
531
532 spin_lock(&br->multicast_lock);
533 if (!netif_running(br->dev) || !mp->mglist ||
534 mp->queries_sent >= br->multicast_last_member_count)
535 goto out;
536
537 br_multicast_send_group_query(mp);
538
539out:
540 spin_unlock(&br->multicast_lock);
541}
542
543static void br_multicast_send_port_group_query(struct net_bridge_port_group *pg)
544{
545 struct net_bridge_port *port = pg->port;
546 struct net_bridge *br = port->br;
547 struct sk_buff *skb;
548
549 skb = br_multicast_alloc_query(br, &pg->addr);
550 if (!skb)
551 goto timer;
552
553 br_deliver(port, skb);
554
555timer:
556 if (++pg->queries_sent < br->multicast_last_member_count)
557 mod_timer(&pg->query_timer,
558 jiffies + br->multicast_last_member_interval);
559}
560
561static void br_multicast_port_group_query_expired(unsigned long data)
562{
563 struct net_bridge_port_group *pg = (void *)data;
564 struct net_bridge_port *port = pg->port;
565 struct net_bridge *br = port->br;
566
567 spin_lock(&br->multicast_lock);
568 if (!netif_running(br->dev) || hlist_unhashed(&pg->mglist) ||
569 pg->queries_sent >= br->multicast_last_member_count)
570 goto out;
571
572 br_multicast_send_port_group_query(pg);
573
574out:
575 spin_unlock(&br->multicast_lock);
576}
577
578static struct net_bridge_mdb_entry *br_multicast_get_group( 508static struct net_bridge_mdb_entry *br_multicast_get_group(
579 struct net_bridge *br, struct net_bridge_port *port, 509 struct net_bridge *br, struct net_bridge_port *port,
580 struct br_ip *group, int hash) 510 struct br_ip *group, int hash)
@@ -690,8 +620,6 @@ rehash:
690 mp->addr = *group; 620 mp->addr = *group;
691 setup_timer(&mp->timer, br_multicast_group_expired, 621 setup_timer(&mp->timer, br_multicast_group_expired,
692 (unsigned long)mp); 622 (unsigned long)mp);
693 setup_timer(&mp->query_timer, br_multicast_group_query_expired,
694 (unsigned long)mp);
695 623
696 hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]); 624 hlist_add_head_rcu(&mp->hlist[mdb->ver], &mdb->mhash[hash]);
697 mdb->size++; 625 mdb->size++;
@@ -746,8 +674,6 @@ static int br_multicast_add_group(struct net_bridge *br,
746 hlist_add_head(&p->mglist, &port->mglist); 674 hlist_add_head(&p->mglist, &port->mglist);
747 setup_timer(&p->timer, br_multicast_port_group_expired, 675 setup_timer(&p->timer, br_multicast_port_group_expired,
748 (unsigned long)p); 676 (unsigned long)p);
749 setup_timer(&p->query_timer, br_multicast_port_group_query_expired,
750 (unsigned long)p);
751 677
752 rcu_assign_pointer(*pp, p); 678 rcu_assign_pointer(*pp, p);
753 679
@@ -1291,9 +1217,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
1291 time_after(mp->timer.expires, time) : 1217 time_after(mp->timer.expires, time) :
1292 try_to_del_timer_sync(&mp->timer) >= 0)) { 1218 try_to_del_timer_sync(&mp->timer) >= 0)) {
1293 mod_timer(&mp->timer, time); 1219 mod_timer(&mp->timer, time);
1294
1295 mp->queries_sent = 0;
1296 mod_timer(&mp->query_timer, now);
1297 } 1220 }
1298 1221
1299 goto out; 1222 goto out;
@@ -1310,9 +1233,6 @@ static void br_multicast_leave_group(struct net_bridge *br,
1310 time_after(p->timer.expires, time) : 1233 time_after(p->timer.expires, time) :
1311 try_to_del_timer_sync(&p->timer) >= 0)) { 1234 try_to_del_timer_sync(&p->timer) >= 0)) {
1312 mod_timer(&p->timer, time); 1235 mod_timer(&p->timer, time);
1313
1314 p->queries_sent = 0;
1315 mod_timer(&p->query_timer, now);
1316 } 1236 }
1317 1237
1318 break; 1238 break;
@@ -1681,7 +1601,6 @@ void br_multicast_stop(struct net_bridge *br)
1681 hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i], 1601 hlist_for_each_entry_safe(mp, p, n, &mdb->mhash[i],
1682 hlist[ver]) { 1602 hlist[ver]) {
1683 del_timer(&mp->timer); 1603 del_timer(&mp->timer);
1684 del_timer(&mp->query_timer);
1685 call_rcu_bh(&mp->rcu, br_multicast_free_group); 1604 call_rcu_bh(&mp->rcu, br_multicast_free_group);
1686 } 1605 }
1687 } 1606 }
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index 0b67a63ad7a8..e1d882257877 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -82,9 +82,7 @@ struct net_bridge_port_group {
82 struct hlist_node mglist; 82 struct hlist_node mglist;
83 struct rcu_head rcu; 83 struct rcu_head rcu;
84 struct timer_list timer; 84 struct timer_list timer;
85 struct timer_list query_timer;
86 struct br_ip addr; 85 struct br_ip addr;
87 u32 queries_sent;
88}; 86};
89 87
90struct net_bridge_mdb_entry 88struct net_bridge_mdb_entry
@@ -94,10 +92,8 @@ struct net_bridge_mdb_entry
94 struct net_bridge_port_group __rcu *ports; 92 struct net_bridge_port_group __rcu *ports;
95 struct rcu_head rcu; 93 struct rcu_head rcu;
96 struct timer_list timer; 94 struct timer_list timer;
97 struct timer_list query_timer;
98 struct br_ip addr; 95 struct br_ip addr;
99 bool mglist; 96 bool mglist;
100 u32 queries_sent;
101}; 97};
102 98
103struct net_bridge_mdb_htable 99struct net_bridge_mdb_htable
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index a396a6926238..35b3a685e342 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -951,9 +951,11 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
951 goto adjust_others; 951 goto adjust_others;
952 } 952 }
953 953
954 data = kmalloc(size + sizeof(struct skb_shared_info), gfp_mask); 954 data = kmalloc(size + SKB_DATA_ALIGN(sizeof(struct skb_shared_info)),
955 gfp_mask);
955 if (!data) 956 if (!data)
956 goto nodata; 957 goto nodata;
958 size = SKB_WITH_OVERHEAD(ksize(data));
957 959
958 /* Copy only real data... and, alas, header. This should be 960 /* Copy only real data... and, alas, header. This should be
959 * optimized for the cases when header is void. 961 * optimized for the cases when header is void.
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 5c45e30cf788..345c7dc08482 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -74,16 +74,24 @@ static int ipv4_get_l4proto(const struct sk_buff *skb, unsigned int nhoff,
74 74
75 iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph); 75 iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
76 if (iph == NULL) 76 if (iph == NULL)
77 return -NF_DROP; 77 return -NF_ACCEPT;
78 78
79 /* Conntrack defragments packets, we might still see fragments 79 /* Conntrack defragments packets, we might still see fragments
80 * inside ICMP packets though. */ 80 * inside ICMP packets though. */
81 if (iph->frag_off & htons(IP_OFFSET)) 81 if (iph->frag_off & htons(IP_OFFSET))
82 return -NF_DROP; 82 return -NF_ACCEPT;
83 83
84 *dataoff = nhoff + (iph->ihl << 2); 84 *dataoff = nhoff + (iph->ihl << 2);
85 *protonum = iph->protocol; 85 *protonum = iph->protocol;
86 86
87 /* Check bogus IP headers */
88 if (*dataoff > skb->len) {
89 pr_debug("nf_conntrack_ipv4: bogus IPv4 packet: "
90 "nhoff %u, ihl %u, skblen %u\n",
91 nhoff, iph->ihl << 2, skb->len);
92 return -NF_ACCEPT;
93 }
94
87 return NF_ACCEPT; 95 return NF_ACCEPT;
88} 96}
89 97
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5d54ed30e821..8bb6adeb62c0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -701,11 +701,12 @@ struct sk_buff *sk_stream_alloc_skb(struct sock *sk, int size, gfp_t gfp)
701 skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp); 701 skb = alloc_skb_fclone(size + sk->sk_prot->max_header, gfp);
702 if (skb) { 702 if (skb) {
703 if (sk_wmem_schedule(sk, skb->truesize)) { 703 if (sk_wmem_schedule(sk, skb->truesize)) {
704 skb_reserve(skb, sk->sk_prot->max_header);
704 /* 705 /*
705 * Make sure that we have exactly size bytes 706 * Make sure that we have exactly size bytes
706 * available to the caller, no more, no less. 707 * available to the caller, no more, no less.
707 */ 708 */
708 skb_reserve(skb, skb_tailroom(skb) - size); 709 skb->avail_size = size;
709 return skb; 710 return skb;
710 } 711 }
711 __kfree_skb(skb); 712 __kfree_skb(skb);
@@ -995,10 +996,9 @@ new_segment:
995 copy = seglen; 996 copy = seglen;
996 997
997 /* Where to copy to? */ 998 /* Where to copy to? */
998 if (skb_tailroom(skb) > 0) { 999 if (skb_availroom(skb) > 0) {
999 /* We have some space in skb head. Superb! */ 1000 /* We have some space in skb head. Superb! */
1000 if (copy > skb_tailroom(skb)) 1001 copy = min_t(int, copy, skb_availroom(skb));
1001 copy = skb_tailroom(skb);
1002 err = skb_add_data_nocache(sk, skb, from, copy); 1002 err = skb_add_data_nocache(sk, skb, from, copy);
1003 if (err) 1003 if (err)
1004 goto do_fault; 1004 goto do_fault;
@@ -1452,7 +1452,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
1452 if ((available < target) && 1452 if ((available < target) &&
1453 (len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) && 1453 (len > sysctl_tcp_dma_copybreak) && !(flags & MSG_PEEK) &&
1454 !sysctl_tcp_low_latency && 1454 !sysctl_tcp_low_latency &&
1455 dma_find_channel(DMA_MEMCPY)) { 1455 net_dma_find_channel()) {
1456 preempt_enable_no_resched(); 1456 preempt_enable_no_resched();
1457 tp->ucopy.pinned_list = 1457 tp->ucopy.pinned_list =
1458 dma_pin_iovec_pages(msg->msg_iov, len); 1458 dma_pin_iovec_pages(msg->msg_iov, len);
@@ -1667,7 +1667,7 @@ do_prequeue:
1667 if (!(flags & MSG_TRUNC)) { 1667 if (!(flags & MSG_TRUNC)) {
1668#ifdef CONFIG_NET_DMA 1668#ifdef CONFIG_NET_DMA
1669 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list) 1669 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1670 tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY); 1670 tp->ucopy.dma_chan = net_dma_find_channel();
1671 1671
1672 if (tp->ucopy.dma_chan) { 1672 if (tp->ucopy.dma_chan) {
1673 tp->ucopy.dma_cookie = dma_skb_copy_datagram_iovec( 1673 tp->ucopy.dma_cookie = dma_skb_copy_datagram_iovec(
@@ -3302,8 +3302,7 @@ void __init tcp_init(void)
3302 3302
3303 tcp_init_mem(&init_net); 3303 tcp_init_mem(&init_net);
3304 /* Set per-socket limits to no more than 1/128 the pressure threshold */ 3304 /* Set per-socket limits to no more than 1/128 the pressure threshold */
3305 limit = nr_free_buffer_pages() << (PAGE_SHIFT - 10); 3305 limit = nr_free_buffer_pages() << (PAGE_SHIFT - 7);
3306 limit = max(limit, 128UL);
3307 max_share = min(4UL*1024*1024, limit); 3306 max_share = min(4UL*1024*1024, limit);
3308 3307
3309 sysctl_tcp_wmem[0] = SK_MEM_QUANTUM; 3308 sysctl_tcp_wmem[0] = SK_MEM_QUANTUM;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e886e2f7fa8d..9944c1d9a218 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -474,8 +474,11 @@ static void tcp_rcv_rtt_update(struct tcp_sock *tp, u32 sample, int win_dep)
474 if (!win_dep) { 474 if (!win_dep) {
475 m -= (new_sample >> 3); 475 m -= (new_sample >> 3);
476 new_sample += m; 476 new_sample += m;
477 } else if (m < new_sample) 477 } else {
478 new_sample = m << 3; 478 m <<= 3;
479 if (m < new_sample)
480 new_sample = m;
481 }
479 } else { 482 } else {
480 /* No previous measure. */ 483 /* No previous measure. */
481 new_sample = m << 3; 484 new_sample = m << 3;
@@ -5225,7 +5228,7 @@ static int tcp_dma_try_early_copy(struct sock *sk, struct sk_buff *skb,
5225 return 0; 5228 return 0;
5226 5229
5227 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list) 5230 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
5228 tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY); 5231 tp->ucopy.dma_chan = net_dma_find_channel();
5229 5232
5230 if (tp->ucopy.dma_chan && skb_csum_unnecessary(skb)) { 5233 if (tp->ucopy.dma_chan && skb_csum_unnecessary(skb)) {
5231 5234
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3a25cf743f8b..0cb86ceb652f 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1730,7 +1730,7 @@ process:
1730#ifdef CONFIG_NET_DMA 1730#ifdef CONFIG_NET_DMA
1731 struct tcp_sock *tp = tcp_sk(sk); 1731 struct tcp_sock *tp = tcp_sk(sk);
1732 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list) 1732 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1733 tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY); 1733 tp->ucopy.dma_chan = net_dma_find_channel();
1734 if (tp->ucopy.dma_chan) 1734 if (tp->ucopy.dma_chan)
1735 ret = tcp_v4_do_rcv(sk, skb); 1735 ret = tcp_v4_do_rcv(sk, skb);
1736 else 1736 else
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 364784a91939..376b2cfbb685 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2060,7 +2060,7 @@ static void tcp_retrans_try_collapse(struct sock *sk, struct sk_buff *to,
2060 /* Punt if not enough space exists in the first SKB for 2060 /* Punt if not enough space exists in the first SKB for
2061 * the data in the second 2061 * the data in the second
2062 */ 2062 */
2063 if (skb->len > skb_tailroom(to)) 2063 if (skb->len > skb_availroom(to))
2064 break; 2064 break;
2065 2065
2066 if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp))) 2066 if (after(TCP_SKB_CB(skb)->end_seq, tcp_wnd_end(tp)))
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 94874b0bdcdc..9d4e15559319 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -78,19 +78,6 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
78 78
79 Hence the start of any table is given by get_table() below. */ 79 Hence the start of any table is given by get_table() below. */
80 80
81/* Check for an extension */
82int
83ip6t_ext_hdr(u8 nexthdr)
84{
85 return (nexthdr == IPPROTO_HOPOPTS) ||
86 (nexthdr == IPPROTO_ROUTING) ||
87 (nexthdr == IPPROTO_FRAGMENT) ||
88 (nexthdr == IPPROTO_ESP) ||
89 (nexthdr == IPPROTO_AH) ||
90 (nexthdr == IPPROTO_NONE) ||
91 (nexthdr == IPPROTO_DSTOPTS);
92}
93
94/* Returns whether matches rule or not. */ 81/* Returns whether matches rule or not. */
95/* Performance critical - called for every packet */ 82/* Performance critical - called for every packet */
96static inline bool 83static inline bool
@@ -2366,7 +2353,6 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
2366EXPORT_SYMBOL(ip6t_register_table); 2353EXPORT_SYMBOL(ip6t_register_table);
2367EXPORT_SYMBOL(ip6t_unregister_table); 2354EXPORT_SYMBOL(ip6t_unregister_table);
2368EXPORT_SYMBOL(ip6t_do_table); 2355EXPORT_SYMBOL(ip6t_do_table);
2369EXPORT_SYMBOL(ip6t_ext_hdr);
2370EXPORT_SYMBOL(ipv6_find_hdr); 2356EXPORT_SYMBOL(ipv6_find_hdr);
2371 2357
2372module_init(ip6_tables_init); 2358module_init(ip6_tables_init);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 12c6ece67f39..86cfe6005f40 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1645,7 +1645,7 @@ process:
1645#ifdef CONFIG_NET_DMA 1645#ifdef CONFIG_NET_DMA
1646 struct tcp_sock *tp = tcp_sk(sk); 1646 struct tcp_sock *tp = tcp_sk(sk);
1647 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list) 1647 if (!tp->ucopy.dma_chan && tp->ucopy.pinned_list)
1648 tp->ucopy.dma_chan = dma_find_channel(DMA_MEMCPY); 1648 tp->ucopy.dma_chan = net_dma_find_channel();
1649 if (tp->ucopy.dma_chan) 1649 if (tp->ucopy.dma_chan)
1650 ret = tcp_v6_do_rcv(sk, skb); 1650 ret = tcp_v6_do_rcv(sk, skb);
1651 else 1651 else
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 576fb25456dd..f76da5b3f5c5 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -3387,8 +3387,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
3387 */ 3387 */
3388 printk(KERN_DEBUG "%s: waiting for beacon from %pM\n", 3388 printk(KERN_DEBUG "%s: waiting for beacon from %pM\n",
3389 sdata->name, ifmgd->bssid); 3389 sdata->name, ifmgd->bssid);
3390 assoc_data->timeout = jiffies + 3390 assoc_data->timeout = TU_TO_EXP_TIME(req->bss->beacon_interval);
3391 TU_TO_EXP_TIME(req->bss->beacon_interval);
3392 } else { 3391 } else {
3393 assoc_data->have_beacon = true; 3392 assoc_data->have_beacon = true;
3394 assoc_data->sent_assoc = false; 3393 assoc_data->sent_assoc = false;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 6cd8e32e281c..cf0747c5741f 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -1593,7 +1593,7 @@ static int nf_conntrack_init_net(struct net *net)
1593 return 0; 1593 return 0;
1594 1594
1595err_timeout: 1595err_timeout:
1596 nf_conntrack_timeout_fini(net); 1596 nf_conntrack_ecache_fini(net);
1597err_ecache: 1597err_ecache:
1598 nf_conntrack_tstamp_fini(net); 1598 nf_conntrack_tstamp_fini(net);
1599err_tstamp: 1599err_tstamp:
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index cc558162493b..4dfbfa840f8a 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -584,8 +584,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
584 * Let's try to use the data from the packet. 584 * Let's try to use the data from the packet.
585 */ 585 */
586 sender->td_end = end; 586 sender->td_end = end;
587 win <<= sender->td_scale; 587 swin = win << sender->td_scale;
588 sender->td_maxwin = (win == 0 ? 1 : win); 588 sender->td_maxwin = (swin == 0 ? 1 : swin);
589 sender->td_maxend = end + sender->td_maxwin; 589 sender->td_maxend = end + sender->td_maxwin;
590 /* 590 /*
591 * We haven't seen traffic in the other direction yet 591 * We haven't seen traffic in the other direction yet
diff --git a/net/nfc/llcp/commands.c b/net/nfc/llcp/commands.c
index 7b76eb7192f3..ef10ffcb4b6f 100644
--- a/net/nfc/llcp/commands.c
+++ b/net/nfc/llcp/commands.c
@@ -474,7 +474,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
474 474
475 while (remaining_len > 0) { 475 while (remaining_len > 0) {
476 476
477 frag_len = min_t(u16, local->remote_miu, remaining_len); 477 frag_len = min_t(size_t, local->remote_miu, remaining_len);
478 478
479 pr_debug("Fragment %zd bytes remaining %zd", 479 pr_debug("Fragment %zd bytes remaining %zd",
480 frag_len, remaining_len); 480 frag_len, remaining_len);
@@ -497,7 +497,7 @@ int nfc_llcp_send_i_frame(struct nfc_llcp_sock *sock,
497 release_sock(sk); 497 release_sock(sk);
498 498
499 remaining_len -= frag_len; 499 remaining_len -= frag_len;
500 msg_ptr += len; 500 msg_ptr += frag_len;
501 } 501 }
502 502
503 kfree(msg_data); 503 kfree(msg_data);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index a4aab1d36285..65622e9c7c54 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -1332,6 +1332,11 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
1332 goto bad_res; 1332 goto bad_res;
1333 } 1333 }
1334 1334
1335 if (!netif_running(netdev)) {
1336 result = -ENETDOWN;
1337 goto bad_res;
1338 }
1339
1335 nla_for_each_nested(nl_txq_params, 1340 nla_for_each_nested(nl_txq_params,
1336 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS], 1341 info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
1337 rem_txq_params) { 1342 rem_txq_params) {
@@ -6467,7 +6472,7 @@ static struct genl_ops nl80211_ops[] = {
6467 .doit = nl80211_get_key, 6472 .doit = nl80211_get_key,
6468 .policy = nl80211_policy, 6473 .policy = nl80211_policy,
6469 .flags = GENL_ADMIN_PERM, 6474 .flags = GENL_ADMIN_PERM,
6470 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6475 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6471 NL80211_FLAG_NEED_RTNL, 6476 NL80211_FLAG_NEED_RTNL,
6472 }, 6477 },
6473 { 6478 {
@@ -6499,7 +6504,7 @@ static struct genl_ops nl80211_ops[] = {
6499 .policy = nl80211_policy, 6504 .policy = nl80211_policy,
6500 .flags = GENL_ADMIN_PERM, 6505 .flags = GENL_ADMIN_PERM,
6501 .doit = nl80211_set_beacon, 6506 .doit = nl80211_set_beacon,
6502 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6507 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6503 NL80211_FLAG_NEED_RTNL, 6508 NL80211_FLAG_NEED_RTNL,
6504 }, 6509 },
6505 { 6510 {
@@ -6507,7 +6512,7 @@ static struct genl_ops nl80211_ops[] = {
6507 .policy = nl80211_policy, 6512 .policy = nl80211_policy,
6508 .flags = GENL_ADMIN_PERM, 6513 .flags = GENL_ADMIN_PERM,
6509 .doit = nl80211_start_ap, 6514 .doit = nl80211_start_ap,
6510 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6515 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6511 NL80211_FLAG_NEED_RTNL, 6516 NL80211_FLAG_NEED_RTNL,
6512 }, 6517 },
6513 { 6518 {
@@ -6515,7 +6520,7 @@ static struct genl_ops nl80211_ops[] = {
6515 .policy = nl80211_policy, 6520 .policy = nl80211_policy,
6516 .flags = GENL_ADMIN_PERM, 6521 .flags = GENL_ADMIN_PERM,
6517 .doit = nl80211_stop_ap, 6522 .doit = nl80211_stop_ap,
6518 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6523 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6519 NL80211_FLAG_NEED_RTNL, 6524 NL80211_FLAG_NEED_RTNL,
6520 }, 6525 },
6521 { 6526 {
@@ -6531,7 +6536,7 @@ static struct genl_ops nl80211_ops[] = {
6531 .doit = nl80211_set_station, 6536 .doit = nl80211_set_station,
6532 .policy = nl80211_policy, 6537 .policy = nl80211_policy,
6533 .flags = GENL_ADMIN_PERM, 6538 .flags = GENL_ADMIN_PERM,
6534 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6539 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6535 NL80211_FLAG_NEED_RTNL, 6540 NL80211_FLAG_NEED_RTNL,
6536 }, 6541 },
6537 { 6542 {
@@ -6547,7 +6552,7 @@ static struct genl_ops nl80211_ops[] = {
6547 .doit = nl80211_del_station, 6552 .doit = nl80211_del_station,
6548 .policy = nl80211_policy, 6553 .policy = nl80211_policy,
6549 .flags = GENL_ADMIN_PERM, 6554 .flags = GENL_ADMIN_PERM,
6550 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6555 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6551 NL80211_FLAG_NEED_RTNL, 6556 NL80211_FLAG_NEED_RTNL,
6552 }, 6557 },
6553 { 6558 {
@@ -6580,7 +6585,7 @@ static struct genl_ops nl80211_ops[] = {
6580 .doit = nl80211_del_mpath, 6585 .doit = nl80211_del_mpath,
6581 .policy = nl80211_policy, 6586 .policy = nl80211_policy,
6582 .flags = GENL_ADMIN_PERM, 6587 .flags = GENL_ADMIN_PERM,
6583 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6588 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6584 NL80211_FLAG_NEED_RTNL, 6589 NL80211_FLAG_NEED_RTNL,
6585 }, 6590 },
6586 { 6591 {
@@ -6588,7 +6593,7 @@ static struct genl_ops nl80211_ops[] = {
6588 .doit = nl80211_set_bss, 6593 .doit = nl80211_set_bss,
6589 .policy = nl80211_policy, 6594 .policy = nl80211_policy,
6590 .flags = GENL_ADMIN_PERM, 6595 .flags = GENL_ADMIN_PERM,
6591 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6596 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6592 NL80211_FLAG_NEED_RTNL, 6597 NL80211_FLAG_NEED_RTNL,
6593 }, 6598 },
6594 { 6599 {
@@ -6614,7 +6619,7 @@ static struct genl_ops nl80211_ops[] = {
6614 .doit = nl80211_get_mesh_config, 6619 .doit = nl80211_get_mesh_config,
6615 .policy = nl80211_policy, 6620 .policy = nl80211_policy,
6616 /* can be retrieved by unprivileged users */ 6621 /* can be retrieved by unprivileged users */
6617 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6622 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6618 NL80211_FLAG_NEED_RTNL, 6623 NL80211_FLAG_NEED_RTNL,
6619 }, 6624 },
6620 { 6625 {
@@ -6747,7 +6752,7 @@ static struct genl_ops nl80211_ops[] = {
6747 .doit = nl80211_setdel_pmksa, 6752 .doit = nl80211_setdel_pmksa,
6748 .policy = nl80211_policy, 6753 .policy = nl80211_policy,
6749 .flags = GENL_ADMIN_PERM, 6754 .flags = GENL_ADMIN_PERM,
6750 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6755 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6751 NL80211_FLAG_NEED_RTNL, 6756 NL80211_FLAG_NEED_RTNL,
6752 }, 6757 },
6753 { 6758 {
@@ -6755,7 +6760,7 @@ static struct genl_ops nl80211_ops[] = {
6755 .doit = nl80211_setdel_pmksa, 6760 .doit = nl80211_setdel_pmksa,
6756 .policy = nl80211_policy, 6761 .policy = nl80211_policy,
6757 .flags = GENL_ADMIN_PERM, 6762 .flags = GENL_ADMIN_PERM,
6758 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6763 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6759 NL80211_FLAG_NEED_RTNL, 6764 NL80211_FLAG_NEED_RTNL,
6760 }, 6765 },
6761 { 6766 {
@@ -6763,7 +6768,7 @@ static struct genl_ops nl80211_ops[] = {
6763 .doit = nl80211_flush_pmksa, 6768 .doit = nl80211_flush_pmksa,
6764 .policy = nl80211_policy, 6769 .policy = nl80211_policy,
6765 .flags = GENL_ADMIN_PERM, 6770 .flags = GENL_ADMIN_PERM,
6766 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6771 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6767 NL80211_FLAG_NEED_RTNL, 6772 NL80211_FLAG_NEED_RTNL,
6768 }, 6773 },
6769 { 6774 {
@@ -6923,7 +6928,7 @@ static struct genl_ops nl80211_ops[] = {
6923 .doit = nl80211_probe_client, 6928 .doit = nl80211_probe_client,
6924 .policy = nl80211_policy, 6929 .policy = nl80211_policy,
6925 .flags = GENL_ADMIN_PERM, 6930 .flags = GENL_ADMIN_PERM,
6926 .internal_flags = NL80211_FLAG_NEED_NETDEV | 6931 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
6927 NL80211_FLAG_NEED_RTNL, 6932 NL80211_FLAG_NEED_RTNL,
6928 }, 6933 },
6929 { 6934 {
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index 9f544c95171c..22adfebaad27 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -781,8 +781,10 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
781 if (cmd == SIOCSIWENCODEEXT) { 781 if (cmd == SIOCSIWENCODEEXT) {
782 struct iw_encode_ext *ee = (void *) extra; 782 struct iw_encode_ext *ee = (void *) extra;
783 783
784 if (iwp->length < sizeof(*ee) + ee->key_len) 784 if (iwp->length < sizeof(*ee) + ee->key_len) {
785 return -EFAULT; 785 err = -EFAULT;
786 goto out;
787 }
786 } 788 }
787 } 789 }
788 790