10 files changed, 42 insertions, 38 deletions

diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 4a141e3cf076..ef12839a7cfe 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1253,7 +1253,7 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
                         goto out;
 
         *uaddr_len = sizeof(struct sockaddr_at);
-        memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
+        memset(&sat, 0, sizeof(sat));
 
         if (peer) {
                 err = -ENOTCONN;
diff --git a/net/batman-adv/routing.c b/net/batman-adv/routing.c
index 2f1f88923df8..b27a4d792d15 100644
--- a/net/batman-adv/routing.c
+++ b/net/batman-adv/routing.c
@@ -939,7 +939,7 @@ out:
 }
 
 static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
-                                     struct sk_buff *skb) {
+                                     struct sk_buff *skb, int hdr_len) {
         uint8_t curr_ttvn, old_ttvn;
         struct batadv_orig_node *orig_node;
         struct ethhdr *ethhdr;
@@ -948,7 +948,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
         int is_old_ttvn;
 
         /* check if there is enough data before accessing it */
-        if (pskb_may_pull(skb, sizeof(*unicast_packet) + ETH_HLEN) < 0)
+        if (pskb_may_pull(skb, hdr_len + ETH_HLEN) < 0)
                 return 0;
 
         /* create a copy of the skb (in case of for re-routing) to modify it. */
@@ -956,7 +956,7 @@ static int batadv_check_unicast_ttvn(struct batadv_priv *bat_priv,
                 return 0;
 
         unicast_packet = (struct batadv_unicast_packet *)skb->data;
-        ethhdr = (struct ethhdr *)(skb->data + sizeof(*unicast_packet));
+        ethhdr = (struct ethhdr *)(skb->data + hdr_len);
 
         /* check if the destination client was served by this node and it is now
          * roaming. In this case, it means that the node has got a ROAM_ADV
@@ -1072,8 +1072,7 @@ int batadv_recv_unicast_packet(struct sk_buff *skb,
 
         if (check < 0)
                 return NET_RX_DROP;
-
-        if (!batadv_check_unicast_ttvn(bat_priv, skb))
+        if (!batadv_check_unicast_ttvn(bat_priv, skb, hdr_size))
                 return NET_RX_DROP;
 
         /* packet for me */
@@ -1117,7 +1116,7 @@ int batadv_recv_ucast_frag_packet(struct sk_buff *skb,
         if (batadv_check_unicast_packet(bat_priv, skb, hdr_size) < 0)
                 return NET_RX_DROP;
 
-        if (!batadv_check_unicast_ttvn(bat_priv, skb))
+        if (!batadv_check_unicast_ttvn(bat_priv, skb, hdr_size))
                 return NET_RX_DROP;
 
         unicast_packet = (struct batadv_unicast_frag_packet *)skb->data;
diff --git a/net/core/datagram.c b/net/core/datagram.c
index ebba65d7e0da..b71423db7785 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -78,9 +78,10 @@ static int receiver_wake_function(wait_queue_t *wait, unsigned int mode, int syn
         return autoremove_wake_function(wait, mode, sync, key);
 }
 /*
- * Wait for a packet..
+ * Wait for the last received packet to be different from skb
  */
-static int wait_for_packet(struct sock *sk, int *err, long *timeo_p)
+static int wait_for_more_packets(struct sock *sk, int *err, long *timeo_p,
+                                 const struct sk_buff *skb)
 {
         int error;
         DEFINE_WAIT_FUNC(wait, receiver_wake_function);
@@ -92,7 +93,7 @@ static int wait_for_packet(struct sock *sk, int *err, long *timeo_p)
         if (error)
                 goto out_err;
 
-        if (!skb_queue_empty(&sk->sk_receive_queue))
+        if (sk->sk_receive_queue.prev != skb)
                 goto out;
 
         /* Socket shut down? */
@@ -131,9 +132,9 @@ out_noerr:
  *      __skb_recv_datagram - Receive a datagram skbuff
  *      @sk: socket
  *      @flags: MSG_ flags
+ *      @peeked: returns non-zero if this packet has been seen before
  *      @off: an offset in bytes to peek skb from. Returns an offset
  *            within an skb where data actually starts
- *      @peeked: returns non-zero if this packet has been seen before
  *      @err: error code returned
  *
  *      Get a datagram skbuff, understands the peeking, nonblocking wakeups
@@ -161,7 +162,7 @@ out_noerr:
 struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                     int *peeked, int *off, int *err)
 {
-        struct sk_buff *skb;
+        struct sk_buff *skb, *last;
         long timeo;
         /*
          * Caller is allowed not to check sk->sk_err before skb_recv_datagram()
@@ -182,13 +183,17 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                  */
                 unsigned long cpu_flags;
                 struct sk_buff_head *queue = &sk->sk_receive_queue;
+                int _off = *off;
 
+                last = (struct sk_buff *)queue;
                 spin_lock_irqsave(&queue->lock, cpu_flags);
                 skb_queue_walk(queue, skb) {
+                        last = skb;
                         *peeked = skb->peeked;
                         if (flags & MSG_PEEK) {
-                                if (*off >= skb->len && skb->len) {
-                                        *off -= skb->len;
+                                if (_off >= skb->len && (skb->len || _off ||
+                                                         skb->peeked)) {
+                                        _off -= skb->len;
                                         continue;
                                 }
                                 skb->peeked = 1;
@@ -197,6 +202,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                                 __skb_unlink(skb, queue);
 
                         spin_unlock_irqrestore(&queue->lock, cpu_flags);
+                        *off = _off;
                         return skb;
                 }
                 spin_unlock_irqrestore(&queue->lock, cpu_flags);
@@ -206,7 +212,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
                 if (!timeo)
                         goto no_packet;
 
-        } while (!wait_for_packet(sk, err, &timeo));
+        } while (!wait_for_more_packets(sk, err, &timeo, last));
 
         return NULL;
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 8ea975164596..d979657b8a12 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1927,6 +1927,7 @@ bool tcp_prequeue(struct sock *sk, struct sk_buff *skb)
             skb_queue_len(&tp->ucopy.prequeue) == 0)
                 return false;
 
+        skb_dst_force(skb);
         __skb_queue_tail(&tp->ucopy.prequeue, skb);
         tp->ucopy.memory += skb->truesize;
         if (tp->ucopy.memory > sk->sk_rcvbuf) {
diff --git a/net/mac802154/mac802154.h b/net/mac802154/mac802154.h
index 5c9e021994ba..d48422e27110 100644
--- a/net/mac802154/mac802154.h
+++ b/net/mac802154/mac802154.h
@@ -88,7 +88,7 @@ struct mac802154_sub_if_data {
 
 #define mac802154_to_priv(_hw)  container_of(_hw, struct mac802154_priv, hw)
 
-#define MAC802154_CHAN_NONE             (~(u8)0) /* No channel is assigned */
+#define MAC802154_CHAN_NONE             0xff /* No channel is assigned */
 
 extern struct ieee802154_reduced_mlme_ops mac802154_mlme_reduced;
 extern struct ieee802154_mlme_ops mac802154_mlme_wpan;
diff --git a/net/netfilter/ipvs/ip_vs_pe_sip.c b/net/netfilter/ipvs/ip_vs_pe_sip.c
index 9a8f4213e8a6..9ef22bdce9f1 100644
--- a/net/netfilter/ipvs/ip_vs_pe_sip.c
+++ b/net/netfilter/ipvs/ip_vs_pe_sip.c
@@ -38,14 +38,10 @@ static int get_callid(const char *dptr, unsigned int dataoff,
                 if (ret > 0)
                         break;
                 if (!ret)
-                        return 0;
+                        return -EINVAL;
                 dataoff += *matchoff;
         }
 
-        /* Empty callid is useless */
-        if (!*matchlen)
-                return -EINVAL;
-
         /* Too large is useless */
         if (*matchlen > IP_VS_PEDATA_MAXLEN)
                 return -EINVAL;
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 103bd704b5fc..ec0c80fde69f 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -834,6 +834,8 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sock *sk = sock->sk;
         struct nr_sock *nr = nr_sk(sk);
 
+        memset(&sax->fsa_ax25, 0, sizeof(struct sockaddr_ax25));
+
         lock_sock(sk);
         if (peer != 0) {
                 if (sk->sk_state != TCP_ESTABLISHED) {
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index 38f08c31cdd8..380253eccb74 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -508,12 +508,13 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *uaddr,
         pr_debug("%p %d %d %d\n", sk, llcp_sock->target_idx,
                  llcp_sock->dsap, llcp_sock->ssap);
 
-        uaddr->sa_family = AF_NFC;
-
+        memset(llcp_addr, 0, sizeof(*llcp_addr));
         *len = sizeof(struct sockaddr_nfc_llcp);
 
+        llcp_addr->sa_family = AF_NFC;
         llcp_addr->dev_idx = llcp_sock->dev->idx;
         llcp_addr->target_idx = llcp_sock->target_idx;
+        llcp_addr->nfc_protocol = llcp_sock->nfc_protocol;
         llcp_addr->dsap = llcp_sock->dsap;
         llcp_addr->ssap = llcp_sock->ssap;
         llcp_addr->service_name_len = llcp_sock->service_name_len;
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 9efe01113c5c..826e09938bff 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1858,10 +1858,10 @@ out:
 }
 
 /*
- *      Sleep until data has arrive. But check for races..
+ *      Sleep until more data has arrived. But check for races..
  */
-
-static long unix_stream_data_wait(struct sock *sk, long timeo)
+static long unix_stream_data_wait(struct sock *sk, long timeo,
+                                  struct sk_buff *last)
 {
         DEFINE_WAIT(wait);
 
@@ -1870,7 +1870,7 @@ static long unix_stream_data_wait(struct sock *sk, long timeo)
         for (;;) {
                 prepare_to_wait(sk_sleep(sk), &wait, TASK_INTERRUPTIBLE);
 
-                if (!skb_queue_empty(&sk->sk_receive_queue) ||
+                if (skb_peek_tail(&sk->sk_receive_queue) != last ||
                     sk->sk_err ||
                     (sk->sk_shutdown & RCV_SHUTDOWN) ||
                     signal_pending(current) ||
@@ -1889,8 +1889,6 @@ static long unix_stream_data_wait(struct sock *sk, long timeo)
         return timeo;
 }
 
-
-
 static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                                struct msghdr *msg, size_t size,
                                int flags)
@@ -1935,14 +1933,12 @@ static int unix_stream_recvmsg(struct kiocb *iocb, struct socket *sock,
                 goto out;
         }
 
-        skip = sk_peek_offset(sk, flags);
-
         do {
                 int chunk;
-                struct sk_buff *skb;
+                struct sk_buff *skb, *last;
 
                 unix_state_lock(sk);
-                skb = skb_peek(&sk->sk_receive_queue);
+                last = skb = skb_peek(&sk->sk_receive_queue);
 again:
                 if (skb == NULL) {
                         unix_sk(sk)->recursion_level = 0;
@@ -1965,7 +1961,7 @@ again:
                                 break;
                         mutex_unlock(&u->readlock);
 
-                        timeo = unix_stream_data_wait(sk, timeo);
+                        timeo = unix_stream_data_wait(sk, timeo, last);
 
                         if (signal_pending(current)
                             ||  mutex_lock_interruptible(&u->readlock)) {
@@ -1979,10 +1975,13 @@ again:
                         break;
                 }
 
-                if (skip >= skb->len) {
+                skip = sk_peek_offset(sk, flags);
+                while (skip >= skb->len) {
                         skip -= skb->len;
+                        last = skb;
                         skb = skb_peek_next(skb, &sk->sk_receive_queue);
-                        goto again;
+                        if (!skb)
+                                goto again;
                 }
 
                 unix_state_unlock(sk);
diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
index 7f93e2a42d7a..3f77f42a3b58 100644
--- a/net/vmw_vsock/af_vsock.c
+++ b/net/vmw_vsock/af_vsock.c
@@ -165,7 +165,7 @@ static struct list_head vsock_bind_table[VSOCK_HASH_SIZE + 1];
 static struct list_head vsock_connected_table[VSOCK_HASH_SIZE];
 static DEFINE_SPINLOCK(vsock_table_lock);
 
-static __init void vsock_init_tables(void)
+static void vsock_init_tables(void)
 {
         int i;
 
@@ -1932,7 +1932,6 @@ static const struct file_operations vsock_device_ops = {
 
 static struct miscdevice vsock_device = {
         .name           = "vsock",
-        .minor          = MISC_DYNAMIC_MINOR,
         .fops           = &vsock_device_ops,
 };
 
@@ -1942,6 +1941,7 @@ static int __vsock_core_init(void)
 
         vsock_init_tables();
 
+        vsock_device.minor = MISC_DYNAMIC_MINOR;
         err = misc_register(&vsock_device);
         if (err) {
                 pr_err("Failed to register misc device\n");