13 files changed, 72 insertions, 71 deletions

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 3d59c9bf8feb..3bccdd12a264 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -510,7 +510,8 @@ static int vlan_dev_open(struct net_device *dev)
         if (vlan->flags & VLAN_FLAG_GVRP)
                 vlan_gvrp_request_join(dev);
 
-        netif_carrier_on(dev);
+        if (netif_carrier_ok(real_dev))
+                netif_carrier_on(dev);
         return 0;
 
 clear_allmulti:
diff --git a/net/core/dev.c b/net/core/dev.c
index 4d74d26b8e1a..7cd5237d9822 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -3156,7 +3156,7 @@ pull:
                         put_page(skb_shinfo(skb)->frags[0].page);
                         memmove(skb_shinfo(skb)->frags,
                                 skb_shinfo(skb)->frags + 1,
-                                --skb_shinfo(skb)->nr_frags);
+                                --skb_shinfo(skb)->nr_frags * sizeof(skb_frag_t));
                 }
         }
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 6bccba31d132..51d6c3167975 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -735,6 +735,7 @@ static void get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                local_bh_disable();
                 xt_info_wrlock(cpu);
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
                         ADD_COUNTER(counters[i], iter->counters.bcnt,
@@ -742,6 +743,7 @@ static void get_counters(const struct xt_table_info *t,
                         ++i;
                 }
                 xt_info_wrunlock(cpu);
+                local_bh_enable();
         }
         put_cpu();
 }
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index c439721b165a..97b64b22c412 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -909,6 +909,7 @@ get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                local_bh_disable();
                 xt_info_wrlock(cpu);
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
                         ADD_COUNTER(counters[i], iter->counters.bcnt,
@@ -916,6 +917,7 @@ get_counters(const struct xt_table_info *t,
                         ++i; /* macro does multi eval of i */
                 }
                 xt_info_wrunlock(cpu);
+                local_bh_enable();
         }
         put_cpu();
 }
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 5359ef4daac5..29a7bca29e3f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -922,6 +922,7 @@ get_counters(const struct xt_table_info *t,
                 if (cpu == curcpu)
                         continue;
                 i = 0;
+                local_bh_disable();
                 xt_info_wrlock(cpu);
                 xt_entry_foreach(iter, t->entries[cpu], t->size) {
                         ADD_COUNTER(counters[i], iter->counters.bcnt,
@@ -929,6 +930,7 @@ get_counters(const struct xt_table_info *t,
                         ++i;
                 }
                 xt_info_wrunlock(cpu);
+                local_bh_enable();
         }
         put_cpu();
 }
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index 9616c32d1076..5bb8353105cc 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -169,6 +169,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
 {
         struct irlan_cb *self = netdev_priv(dev);
         int ret;
+        unsigned int len;
 
         /* skb headroom large enough to contain all IrDA-headers? */
         if ((skb_headroom(skb) < self->max_header_size) || (skb_shared(skb))) {
@@ -188,6 +189,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
 
         dev->trans_start = jiffies;
 
+        len = skb->len;
         /* Now queue the packet in the transport layer */
         if (self->use_udata)
                 ret = irttp_udata_request(self->tsap_data, skb);
@@ -209,7 +211,7 @@ static netdev_tx_t irlan_eth_xmit(struct sk_buff *skb,
                 self->stats.tx_dropped++;
         } else {
                 self->stats.tx_packets++;
-                self->stats.tx_bytes += skb->len;
+                self->stats.tx_bytes += len;
         }
 
         return NETDEV_TX_OK;
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 8648a9922aab..980fe4ad0016 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1406,7 +1406,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         struct netlink_sock *nlk = nlk_sk(sk);
         int noblock = flags&MSG_DONTWAIT;
         size_t copied;
-        struct sk_buff *skb, *frag __maybe_unused = NULL;
+        struct sk_buff *skb, *data_skb;
         int err;
 
         if (flags&MSG_OOB)
@@ -1418,45 +1418,35 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         if (skb == NULL)
                 goto out;
 
+        data_skb = skb;
+
 #ifdef CONFIG_COMPAT_NETLINK_MESSAGES
         if (unlikely(skb_shinfo(skb)->frag_list)) {
-                bool need_compat = !!(flags & MSG_CMSG_COMPAT);
-
                 /*
-                 * If this skb has a frag_list, then here that means that
-                 * we will have to use the frag_list skb for compat tasks
-                 * and the regular skb for non-compat tasks.
+                 * If this skb has a frag_list, then here that means that we
+                 * will have to use the frag_list skb's data for compat tasks
+                 * and the regular skb's data for normal (non-compat) tasks.
                  *
-                 * The skb might (and likely will) be cloned, so we can't
-                 * just reset frag_list and go on with things -- we need to
-                 * keep that. For the compat case that's easy -- simply get
-                 * a reference to the compat skb and free the regular one
-                 * including the frag. For the non-compat case, we need to
-                 * avoid sending the frag to the user -- so assign NULL but
-                 * restore it below before freeing the skb.
+                 * If we need to send the compat skb, assign it to the
+                 * 'data_skb' variable so that it will be used below for data
+                 * copying. We keep 'skb' for everything else, including
+                 * freeing both later.
                  */
-                if (need_compat) {
-                        struct sk_buff *compskb = skb_shinfo(skb)->frag_list;
-                        skb_get(compskb);
-                        kfree_skb(skb);
-                        skb = compskb;
-                } else {
-                        frag = skb_shinfo(skb)->frag_list;
-                        skb_shinfo(skb)->frag_list = NULL;
-                }
+                if (flags & MSG_CMSG_COMPAT)
+                        data_skb = skb_shinfo(skb)->frag_list;
         }
 #endif
 
         msg->msg_namelen = 0;
 
-        copied = skb->len;
+        copied = data_skb->len;
         if (len < copied) {
                 msg->msg_flags |= MSG_TRUNC;
                 copied = len;
         }
 
-        skb_reset_transport_header(skb);
-        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        skb_reset_transport_header(data_skb);
+        err = skb_copy_datagram_iovec(data_skb, 0, msg->msg_iov, copied);
 
         if (msg->msg_name) {
                 struct sockaddr_nl *addr = (struct sockaddr_nl *)msg->msg_name;
@@ -1476,11 +1466,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
         }
         siocb->scm->creds = *NETLINK_CREDS(skb);
         if (flags & MSG_TRUNC)
-                copied = skb->len;
-
-#ifdef CONFIG_COMPAT_NETLINK_MESSAGES
-        skb_shinfo(skb)->frag_list = frag;
-#endif
+                copied = data_skb->len;
 
         skb_free_datagram(sk, skb);
 
diff --git a/net/rds/recv.c b/net/rds/recv.c
index 795a00b7f2cb..c93588c2d553 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -297,7 +297,7 @@ static int rds_still_queued(struct rds_sock *rs, struct rds_incoming *inc,
 int rds_notify_queue_get(struct rds_sock *rs, struct msghdr *msghdr)
 {
         struct rds_notifier *notifier;
-        struct rds_rdma_notify cmsg;
+        struct rds_rdma_notify cmsg = { 0 }; /* fill holes with zero */
         unsigned int count = 0, max_messages = ~0U;
         unsigned long flags;
         LIST_HEAD(copy);
diff --git a/net/sched/act_gact.c b/net/sched/act_gact.c
index 8406c6654990..c2ed90a4c0b4 100644
--- a/net/sched/act_gact.c
+++ b/net/sched/act_gact.c
@@ -152,21 +152,24 @@ static int tcf_gact(struct sk_buff *skb, struct tc_action *a, struct tcf_result
 static int tcf_gact_dump(struct sk_buff *skb, struct tc_action *a, int bind, int ref)
 {
         unsigned char *b = skb_tail_pointer(skb);
-        struct tc_gact opt;
         struct tcf_gact *gact = a->priv;
+        struct tc_gact opt = {
+                .index   = gact->tcf_index,
+                .refcnt  = gact->tcf_refcnt - ref,
+                .bindcnt = gact->tcf_bindcnt - bind,
+                .action  = gact->tcf_action,
+        };
         struct tcf_t t;
 
-        opt.index = gact->tcf_index;
-        opt.refcnt = gact->tcf_refcnt - ref;
-        opt.bindcnt = gact->tcf_bindcnt - bind;
-        opt.action = gact->tcf_action;
         NLA_PUT(skb, TCA_GACT_PARMS, sizeof(opt), &opt);
 #ifdef CONFIG_GACT_PROB
         if (gact->tcfg_ptype) {
-                struct tc_gact_p p_opt;
-                p_opt.paction = gact->tcfg_paction;
-                p_opt.pval = gact->tcfg_pval;
-                p_opt.ptype = gact->tcfg_ptype;
+                struct tc_gact_p p_opt = {
+                        .paction = gact->tcfg_paction,
+                        .pval    = gact->tcfg_pval,
+                        .ptype   = gact->tcfg_ptype,
+                };
+
                 NLA_PUT(skb, TCA_GACT_PROB, sizeof(p_opt), &p_opt);
         }
 #endif
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 11f195af2da0..0c311be92827 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -219,15 +219,16 @@ static int tcf_mirred_dump(struct sk_buff *skb, struct tc_action *a, int bind, i
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_mirred *m = a->priv;
-        struct tc_mirred opt;
+        struct tc_mirred opt = {
+                .index   = m->tcf_index,
+                .action  = m->tcf_action,
+                .refcnt  = m->tcf_refcnt - ref,
+                .bindcnt = m->tcf_bindcnt - bind,
+                .eaction = m->tcfm_eaction,
+                .ifindex = m->tcfm_ifindex,
+        };
         struct tcf_t t;
 
-        opt.index = m->tcf_index;
-        opt.action = m->tcf_action;
-        opt.refcnt = m->tcf_refcnt - ref;
-        opt.bindcnt = m->tcf_bindcnt - bind;
-        opt.eaction = m->tcfm_eaction;
-        opt.ifindex = m->tcfm_ifindex;
         NLA_PUT(skb, TCA_MIRRED_PARMS, sizeof(opt), &opt);
         t.install = jiffies_to_clock_t(jiffies - m->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - m->tcf_tm.lastuse);
diff --git a/net/sched/act_nat.c b/net/sched/act_nat.c
index 509a2d53a99d..186eb837e600 100644
--- a/net/sched/act_nat.c
+++ b/net/sched/act_nat.c
@@ -272,19 +272,19 @@ static int tcf_nat_dump(struct sk_buff *skb, struct tc_action *a,
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_nat *p = a->priv;
-        struct tc_nat opt;
+        struct tc_nat opt = {
+                .old_addr = p->old_addr,
+                .new_addr = p->new_addr,
+                .mask     = p->mask,
+                .flags    = p->flags,
+
+                .index    = p->tcf_index,
+                .action   = p->tcf_action,
+                .refcnt   = p->tcf_refcnt - ref,
+                .bindcnt  = p->tcf_bindcnt - bind,
+        };
         struct tcf_t t;
 
-        opt.old_addr = p->old_addr;
-        opt.new_addr = p->new_addr;
-        opt.mask = p->mask;
-        opt.flags = p->flags;
-
-        opt.index = p->tcf_index;
-        opt.action = p->tcf_action;
-        opt.refcnt = p->tcf_refcnt - ref;
-        opt.bindcnt = p->tcf_bindcnt - bind;
-
         NLA_PUT(skb, TCA_NAT_PARMS, sizeof(opt), &opt);
         t.install = jiffies_to_clock_t(jiffies - p->tcf_tm.install);
         t.lastuse = jiffies_to_clock_t(jiffies - p->tcf_tm.lastuse);
diff --git a/net/sched/act_simple.c b/net/sched/act_simple.c
index 4a1d640b0cf1..97e84f3ee775 100644
--- a/net/sched/act_simple.c
+++ b/net/sched/act_simple.c
@@ -164,13 +164,14 @@ static inline int tcf_simp_dump(struct sk_buff *skb, struct tc_action *a,
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_defact *d = a->priv;
-        struct tc_defact opt;
+        struct tc_defact opt = {
+                .index   = d->tcf_index,
+                .refcnt  = d->tcf_refcnt - ref,
+                .bindcnt = d->tcf_bindcnt - bind,
+                .action  = d->tcf_action,
+        };
         struct tcf_t t;
 
-        opt.index = d->tcf_index;
-        opt.refcnt = d->tcf_refcnt - ref;
-        opt.bindcnt = d->tcf_bindcnt - bind;
-        opt.action = d->tcf_action;
         NLA_PUT(skb, TCA_DEF_PARMS, sizeof(opt), &opt);
         NLA_PUT_STRING(skb, TCA_DEF_DATA, d->tcfd_defdata);
         t.install = jiffies_to_clock_t(jiffies - d->tcf_tm.install);
diff --git a/net/sched/act_skbedit.c b/net/sched/act_skbedit.c
index e9607fe55b58..66cbf4eb8855 100644
--- a/net/sched/act_skbedit.c
+++ b/net/sched/act_skbedit.c
@@ -159,13 +159,14 @@ static inline int tcf_skbedit_dump(struct sk_buff *skb, struct tc_action *a,
 {
         unsigned char *b = skb_tail_pointer(skb);
         struct tcf_skbedit *d = a->priv;
-        struct tc_skbedit opt;
+        struct tc_skbedit opt = {
+                .index   = d->tcf_index,
+                .refcnt  = d->tcf_refcnt - ref,
+                .bindcnt = d->tcf_bindcnt - bind,
+                .action  = d->tcf_action,
+        };
         struct tcf_t t;
 
-        opt.index = d->tcf_index;
-        opt.refcnt = d->tcf_refcnt - ref;
-        opt.bindcnt = d->tcf_bindcnt - bind;
-        opt.action = d->tcf_action;
         NLA_PUT(skb, TCA_SKBEDIT_PARMS, sizeof(opt), &opt);
         if (d->flags & SKBEDIT_F_PRIORITY)
                 NLA_PUT(skb, TCA_SKBEDIT_PRIORITY, sizeof(d->priority),