13 files changed, 75 insertions, 35 deletions

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa5cda4e552a..45f61c348e36 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -101,6 +101,18 @@ static inline __be16 pppoe_proto(const struct sk_buff *skb)
          pppoe_proto(skb) == htons(PPP_IPV6) && \
          brnf_filter_pppoe_tagged)
 
+static void fake_update_pmtu(struct dst_entry *dst, u32 mtu)
+{
+}
+
+static struct dst_ops fake_dst_ops = {
+        .family =               AF_INET,
+        .protocol =             __constant_htons(ETH_P_IP),
+        .update_pmtu =          fake_update_pmtu,
+        .entry_size =           sizeof(struct rtable),
+        .entries =              ATOMIC_INIT(0),
+};
+
 /*
  * Initialize bogus route table used to keep netfilter happy.
  * Currently, we fill in the PMTU entry because netfilter
@@ -117,6 +129,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         rt->u.dst.path = &rt->u.dst;
         rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
         rt->u.dst.flags = DST_NOXFRM;
+        rt->u.dst.ops = &fake_dst_ops;
 }
 
 static inline struct rtable *bridge_parent_rtable(const struct net_device *dev)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index d49ef8301b5b..65f7757465bd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -149,7 +149,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 
 void skb_truesize_bug(struct sk_buff *skb)
 {
-        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+        WARN(net_ratelimit(), KERN_ERR "SKB BUG: Invalid truesize (%u) "
                "len=%u, sizeof(sk_buff)=%Zd\n",
                skb->truesize, skb->len, sizeof(struct sk_buff));
 }
diff --git a/net/core/sock.c b/net/core/sock.c
index 341e39456952..edf7220889a4 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -2035,9 +2035,6 @@ static inline void release_proto_idx(struct proto *prot)
 
 int proto_register(struct proto *prot, int alloc_slab)
 {
-        char *request_sock_slab_name = NULL;
-        char *timewait_sock_slab_name;
-
         if (alloc_slab) {
                 prot->slab = kmem_cache_create(prot->name, prot->obj_size, 0,
                                                SLAB_HWCACHE_ALIGN, NULL);
@@ -2051,12 +2048,12 @@ int proto_register(struct proto *prot, int alloc_slab)
                 if (prot->rsk_prot != NULL) {
                         static const char mask[] = "request_sock_%s";
 
-                        request_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
-                        if (request_sock_slab_name == NULL)
+                        prot->rsk_prot->slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        if (prot->rsk_prot->slab_name == NULL)
                                 goto out_free_sock_slab;
 
-                        sprintf(request_sock_slab_name, mask, prot->name);
-                        prot->rsk_prot->slab = kmem_cache_create(request_sock_slab_name,
+                        sprintf(prot->rsk_prot->slab_name, mask, prot->name);
+                        prot->rsk_prot->slab = kmem_cache_create(prot->rsk_prot->slab_name,
                                                                  prot->rsk_prot->obj_size, 0,
                                                                  SLAB_HWCACHE_ALIGN, NULL);
 
@@ -2070,14 +2067,14 @@ int proto_register(struct proto *prot, int alloc_slab)
                 if (prot->twsk_prot != NULL) {
                         static const char mask[] = "tw_sock_%s";
 
-                        timewait_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
+                        prot->twsk_prot->twsk_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
 
-                        if (timewait_sock_slab_name == NULL)
+                        if (prot->twsk_prot->twsk_slab_name == NULL)
                                 goto out_free_request_sock_slab;
 
-                        sprintf(timewait_sock_slab_name, mask, prot->name);
+                        sprintf(prot->twsk_prot->twsk_slab_name, mask, prot->name);
                         prot->twsk_prot->twsk_slab =
-                                kmem_cache_create(timewait_sock_slab_name,
+                                kmem_cache_create(prot->twsk_prot->twsk_slab_name,
                                                   prot->twsk_prot->twsk_obj_size,
                                                   0, SLAB_HWCACHE_ALIGN,
                                                   NULL);
@@ -2093,14 +2090,14 @@ int proto_register(struct proto *prot, int alloc_slab)
         return 0;
 
 out_free_timewait_sock_slab_name:
-        kfree(timewait_sock_slab_name);
+        kfree(prot->twsk_prot->twsk_slab_name);
 out_free_request_sock_slab:
         if (prot->rsk_prot && prot->rsk_prot->slab) {
                 kmem_cache_destroy(prot->rsk_prot->slab);
                 prot->rsk_prot->slab = NULL;
         }
 out_free_request_sock_slab_name:
-        kfree(request_sock_slab_name);
+        kfree(prot->rsk_prot->slab_name);
 out_free_sock_slab:
         kmem_cache_destroy(prot->slab);
         prot->slab = NULL;
@@ -2123,18 +2120,14 @@ void proto_unregister(struct proto *prot)
         }
 
         if (prot->rsk_prot != NULL && prot->rsk_prot->slab != NULL) {
-                const char *name = kmem_cache_name(prot->rsk_prot->slab);
-
                 kmem_cache_destroy(prot->rsk_prot->slab);
-                kfree(name);
+                kfree(prot->rsk_prot->slab_name);
                 prot->rsk_prot->slab = NULL;
         }
 
         if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) {
-                const char *name = kmem_cache_name(prot->twsk_prot->twsk_slab);
-
                 kmem_cache_destroy(prot->twsk_prot->twsk_slab);
-                kfree(name);
+                kfree(prot->twsk_prot->twsk_slab_name);
                 prot->twsk_prot->twsk_slab = NULL;
         }
 }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index ba85d8831893..85b07eba1879 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -722,7 +722,8 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
 static void tcp_set_skb_tso_segs(struct sock *sk, struct sk_buff *skb,
                                  unsigned int mss_now)
 {
-        if (skb->len <= mss_now || !sk_can_gso(sk)) {
+        if (skb->len <= mss_now || !sk_can_gso(sk) ||
+            tcp_urg_mode(tcp_sk(sk))) {
                 /* Avoid the costly divide in the normal
                  * non-TSO case.
                  */
@@ -1163,7 +1164,9 @@ static int tcp_init_tso_segs(struct sock *sk, struct sk_buff *skb,
 {
         int tso_segs = tcp_skb_pcount(skb);
 
-        if (!tso_segs || (tso_segs > 1 && tcp_skb_mss(skb) != mss_now)) {
+        if (!tso_segs ||
+            (tso_segs > 1 && (tcp_skb_mss(skb) != mss_now ||
+                              tcp_urg_mode(tcp_sk(sk))))) {
                 tcp_set_skb_tso_segs(sk, skb, mss_now);
                 tso_segs = tcp_skb_pcount(skb);
         }
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 742f811ca416..ab4ddba874be 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -271,6 +271,7 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                                    __u32 *mode, char *extra)
 {
         struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
+        struct ieee80211_local *local = sdata->local;
         int type;
 
         if (sdata->vif.type == NL80211_IFTYPE_AP_VLAN)
@@ -281,6 +282,13 @@ static int ieee80211_ioctl_siwmode(struct net_device *dev,
                 type = NL80211_IFTYPE_STATION;
                 break;
         case IW_MODE_ADHOC:
+                /* Setting ad-hoc mode on non ibss channel is not
+                 * supported.
+                 */
+                if (local->oper_channel &&
+                    (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS))
+                        return -EOPNOTSUPP;
+
                 type = NL80211_IFTYPE_ADHOC;
                 break;
         case IW_MODE_REPEAT:
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 622d7c671cb7..233fdd2d7d21 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -305,9 +305,7 @@ void nf_conntrack_hash_insert(struct nf_conn *ct)
         hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple);
         repl_hash = hash_conntrack(&ct->tuplehash[IP_CT_DIR_REPLY].tuple);
 
-        spin_lock_bh(&nf_conntrack_lock);
         __nf_conntrack_hash_insert(ct, hash, repl_hash);
-        spin_unlock_bh(&nf_conntrack_lock);
 }
 EXPORT_SYMBOL_GPL(nf_conntrack_hash_insert);
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index a040d46f85d6..5f4a6516b3b6 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1090,7 +1090,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
         struct nf_conn_help *help;
         struct nf_conntrack_helper *helper;
 
-        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_KERNEL);
+        ct = nf_conntrack_alloc(&init_net, otuple, rtuple, GFP_ATOMIC);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM;
 
@@ -1138,7 +1138,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                 }
         }
 
-        nf_ct_acct_ext_add(ct, GFP_KERNEL);
+        nf_ct_acct_ext_add(ct, GFP_ATOMIC);
 
 #if defined(CONFIG_NF_CONNTRACK_MARK)
         if (cda[CTA_MARK])
@@ -1212,13 +1212,14 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                         atomic_inc(&master_ct->ct_general.use);
                 }
 
-                spin_unlock_bh(&nf_conntrack_lock);
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda,
                                                          &otuple,
                                                          &rtuple,
                                                          master_ct);
+                spin_unlock_bh(&nf_conntrack_lock);
+
                 if (err < 0 && master_ct)
                         nf_ct_put(master_ct);
 
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 53be9fc82aaa..f93ff8ef47d0 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -115,7 +115,7 @@ int phonet_address_del(struct net_device *dev, u8 addr)
         pnd = __phonet_get(dev);
         if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
                 err = -EADDRNOTAVAIL;
-        if (bitmap_empty(pnd->addrs, 64))
+        else if (bitmap_empty(pnd->addrs, 64))
                 __phonet_device_free(pnd);
         spin_unlock_bh(&pndevs.lock);
         return err;
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index a7f1ce11bc22..0c1cc7612800 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -1072,6 +1072,10 @@ static int rose_sendmsg(struct kiocb *iocb, struct socket *sock,
         unsigned char *asmptr;
         int n, size, qbit = 0;
 
+        /* ROSE empty frame has no meaning : don't send */
+        if (len == 0)
+                return 0;
+
         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_EOR|MSG_CMSG_COMPAT))
                 return -EINVAL;
 
@@ -1265,6 +1269,12 @@ static int rose_recvmsg(struct kiocb *iocb, struct socket *sock,
         skb_reset_transport_header(skb);
         copied     = skb->len;
 
+        /* ROSE empty frame has no meaning : ignore it */
+        if (copied == 0) {
+                skb_free_datagram(sk, skb);
+                return copied;
+        }
+
         if (copied > size) {
                 copied = size;
                 msg->msg_flags |= MSG_TRUNC;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index 95293f549e9c..a1951dcc5776 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -1183,7 +1183,11 @@ int svc_addsock(struct svc_serv *serv,
         else if (so->state > SS_UNCONNECTED)
                 err = -EISCONN;
         else {
-                svsk = svc_setup_socket(serv, so, &err, SVC_SOCK_DEFAULTS);
+                if (!try_module_get(THIS_MODULE))
+                        err = -ENOENT;
+                else
+                        svsk = svc_setup_socket(serv, so, &err,
+                                                SVC_SOCK_DEFAULTS);
                 if (svsk) {
                         struct sockaddr_storage addr;
                         struct sockaddr *sin = (struct sockaddr *)&addr;
@@ -1196,7 +1200,8 @@ int svc_addsock(struct svc_serv *serv,
                         spin_unlock_bh(&serv->sv_lock);
                         svc_xprt_received(&svsk->sk_xprt);
                         err = 0;
-                }
+                } else
+                        module_put(THIS_MODULE);
         }
         if (err) {
                 sockfd_put(so);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index eb90f77bb0e2..66d5ac4773ab 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1343,6 +1343,7 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
         err = scm_send(sock, msg, siocb->scm);
         if (err < 0)
                 return err;
@@ -1493,6 +1494,7 @@ static int unix_stream_sendmsg(struct kiocb *kiocb, struct socket *sock,
 
         if (NULL == siocb->scm)
                 siocb->scm = &tmp_scm;
+        wait_for_unix_gc();
         err = scm_send(sock, msg, siocb->scm);
         if (err < 0)
                 return err;
diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 6d4a9a8de5ef..abb3ab34cb1e 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c
@@ -80,6 +80,7 @@
 #include <linux/file.h>
 #include <linux/proc_fs.h>
 #include <linux/mutex.h>
+#include <linux/wait.h>
 
 #include <net/sock.h>
 #include <net/af_unix.h>
@@ -91,6 +92,7 @@
 static LIST_HEAD(gc_inflight_list);
 static LIST_HEAD(gc_candidates);
 static DEFINE_SPINLOCK(unix_gc_lock);
+static DECLARE_WAIT_QUEUE_HEAD(unix_gc_wait);
 
 unsigned int unix_tot_inflight;
 
@@ -266,12 +268,16 @@ static void inc_inflight_move_tail(struct unix_sock *u)
                 list_move_tail(&u->link, &gc_candidates);
 }
 
-/* The external entry point: unix_gc() */
+static bool gc_in_progress = false;
 
-void unix_gc(void)
+void wait_for_unix_gc(void)
 {
-        static bool gc_in_progress = false;
+        wait_event(unix_gc_wait, gc_in_progress == false);
+}
 
+/* The external entry point: unix_gc() */
+void unix_gc(void)
+{
         struct unix_sock *u;
         struct unix_sock *next;
         struct sk_buff_head hitlist;
@@ -376,6 +382,7 @@ void unix_gc(void)
         /* All candidates should have been detached by now. */
         BUG_ON(!list_empty(&gc_candidates));
         gc_in_progress = false;
+        wake_up(&unix_gc_wait);
 
  out:
         spin_unlock(&unix_gc_lock);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 626dbb688499..eb3b1a9f9b12 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -343,9 +343,9 @@ static int ignore_request(struct wiphy *wiphy, enum reg_set_by set_by,
                                 return 0;
                         return -EALREADY;
                 }
-                if (WARN_ON(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2)),
+                if (WARN(!is_alpha2_set(alpha2) || !is_an_alpha2(alpha2),
                                 "Invalid Country IE regulatory hint passed "
-                                "to the wireless core\n")
+                                "to the wireless core\n"))
                         return -EINVAL;
                 /* We ignore Country IE hints for now, as we haven't yet
                  * added the dot11MultiDomainCapabilityEnabled flag