aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/atm/br2684.c78
-rw-r--r--net/core/dev.c34
-rw-r--r--net/dccp/ackvec.c29
-rw-r--r--net/dccp/ccids/ccid3.c14
-rw-r--r--net/dccp/ccids/lib/tfrc.c8
-rw-r--r--net/dccp/ccids/lib/tfrc.h25
-rw-r--r--net/dccp/ccids/lib/tfrc_equation.c8
-rw-r--r--net/dccp/ipv4.c3
-rw-r--r--net/dccp/ipv6.c1
-rw-r--r--net/dccp/minisocks.c8
-rw-r--r--net/dccp/options.c4
-rw-r--r--net/dccp/output.c2
-rw-r--r--net/dccp/probe.c2
-rw-r--r--net/ipv4/fib_semantics.c5
-rw-r--r--net/ipv4/inet_connection_sock.c11
-rw-r--r--net/ipv4/netfilter/nf_nat_core.c3
-rw-r--r--net/ipv4/raw.c2
-rw-r--r--net/ipv4/syncookies.c3
-rw-r--r--net/ipv4/tcp.c18
-rw-r--r--net/ipv4/tcp_input.c45
-rw-r--r--net/ipv4/tcp_ipv4.c14
-rw-r--r--net/ipv4/tcp_minisocks.c32
-rw-r--r--net/ipv4/tcp_timer.c5
-rw-r--r--net/ipv4/xfrm4_mode_tunnel.c2
-rw-r--r--net/ipv6/af_inet6.c2
-rw-r--r--net/ipv6/datagram.c5
-rw-r--r--net/ipv6/ipv6_sockglue.c12
-rw-r--r--net/ipv6/raw.c4
-rw-r--r--net/ipv6/route.c8
-rw-r--r--net/ipv6/sit.c44
-rw-r--r--net/ipv6/syncookies.c1
-rw-r--r--net/ipv6/tcp_ipv6.c1
-rw-r--r--net/key/af_key.c3
-rw-r--r--net/mac80211/ieee80211_i.h2
-rw-r--r--net/mac80211/main.c1
-rw-r--r--net/mac80211/mlme.c18
-rw-r--r--net/mac80211/tx.c4
-rw-r--r--net/mac80211/wext.c18
-rw-r--r--net/mac80211/wme.c2
-rw-r--r--net/netfilter/nf_conntrack_core.c3
-rw-r--r--net/netfilter/nf_conntrack_extend.c9
-rw-r--r--net/netfilter/nf_conntrack_h323_main.c22
-rw-r--r--net/netfilter/nf_log.c4
-rw-r--r--net/netlink/genetlink.c15
-rw-r--r--net/sched/sch_htb.c23
-rw-r--r--net/sctp/associola.c13
-rw-r--r--net/sctp/protocol.c15
-rw-r--r--net/unix/af_unix.c79
48 files changed, 368 insertions, 296 deletions
diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 9d52ebfc1962..05fafdc2eea3 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -188,10 +188,13 @@ static int br2684_xmit_vcc(struct sk_buff *skb, struct br2684_dev *brdev,
188 return 0; 188 return 0;
189 } 189 }
190 } 190 }
191 } else { 191 } else { /* e_vc */
192 skb_push(skb, 2); 192 if (brdev->payload == p_bridged) {
193 if (brdev->payload == p_bridged) 193 skb_push(skb, 2);
194 memset(skb->data, 0, 2); 194 memset(skb->data, 0, 2);
195 } else { /* p_routed */
196 skb_pull(skb, ETH_HLEN);
197 }
195 } 198 }
196 skb_debug(skb); 199 skb_debug(skb);
197 200
@@ -377,11 +380,8 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
377 (skb->data + 6, ethertype_ipv4, 380 (skb->data + 6, ethertype_ipv4,
378 sizeof(ethertype_ipv4)) == 0) 381 sizeof(ethertype_ipv4)) == 0)
379 skb->protocol = __constant_htons(ETH_P_IP); 382 skb->protocol = __constant_htons(ETH_P_IP);
380 else { 383 else
381 brdev->stats.rx_errors++; 384 goto error;
382 dev_kfree_skb(skb);
383 return;
384 }
385 skb_pull(skb, sizeof(llc_oui_ipv4)); 385 skb_pull(skb, sizeof(llc_oui_ipv4));
386 skb_reset_network_header(skb); 386 skb_reset_network_header(skb);
387 skb->pkt_type = PACKET_HOST; 387 skb->pkt_type = PACKET_HOST;
@@ -394,44 +394,56 @@ static void br2684_push(struct atm_vcc *atmvcc, struct sk_buff *skb)
394 (memcmp(skb->data, llc_oui_pid_pad, 7) == 0)) { 394 (memcmp(skb->data, llc_oui_pid_pad, 7) == 0)) {
395 skb_pull(skb, sizeof(llc_oui_pid_pad)); 395 skb_pull(skb, sizeof(llc_oui_pid_pad));
396 skb->protocol = eth_type_trans(skb, net_dev); 396 skb->protocol = eth_type_trans(skb, net_dev);
397 } else { 397 } else
398 brdev->stats.rx_errors++; 398 goto error;
399 dev_kfree_skb(skb);
400 return;
401 }
402 399
403 } else { 400 } else { /* e_vc */
404 /* first 2 chars should be 0 */ 401 if (brdev->payload == p_routed) {
405 if (*((u16 *) (skb->data)) != 0) { 402 struct iphdr *iph;
406 brdev->stats.rx_errors++; 403
407 dev_kfree_skb(skb); 404 skb_reset_network_header(skb);
408 return; 405 iph = ip_hdr(skb);
406 if (iph->version == 4)
407 skb->protocol = __constant_htons(ETH_P_IP);
408 else if (iph->version == 6)
409 skb->protocol = __constant_htons(ETH_P_IPV6);
410 else
411 goto error;
412 skb->pkt_type = PACKET_HOST;
413 } else { /* p_bridged */
414 /* first 2 chars should be 0 */
415 if (*((u16 *) (skb->data)) != 0)
416 goto error;
417 skb_pull(skb, BR2684_PAD_LEN);
418 skb->protocol = eth_type_trans(skb, net_dev);
409 } 419 }
410 skb_pull(skb, BR2684_PAD_LEN + ETH_HLEN); /* pad, dstmac, srcmac, ethtype */
411 skb->protocol = eth_type_trans(skb, net_dev);
412 } 420 }
413 421
414#ifdef CONFIG_ATM_BR2684_IPFILTER 422#ifdef CONFIG_ATM_BR2684_IPFILTER
415 if (unlikely(packet_fails_filter(skb->protocol, brvcc, skb))) { 423 if (unlikely(packet_fails_filter(skb->protocol, brvcc, skb)))
416 brdev->stats.rx_dropped++; 424 goto dropped;
417 dev_kfree_skb(skb);
418 return;
419 }
420#endif /* CONFIG_ATM_BR2684_IPFILTER */ 425#endif /* CONFIG_ATM_BR2684_IPFILTER */
421 skb->dev = net_dev; 426 skb->dev = net_dev;
422 ATM_SKB(skb)->vcc = atmvcc; /* needed ? */ 427 ATM_SKB(skb)->vcc = atmvcc; /* needed ? */
423 pr_debug("received packet's protocol: %x\n", ntohs(skb->protocol)); 428 pr_debug("received packet's protocol: %x\n", ntohs(skb->protocol));
424 skb_debug(skb); 429 skb_debug(skb);
425 if (unlikely(!(net_dev->flags & IFF_UP))) { 430 /* sigh, interface is down? */
426 /* sigh, interface is down */ 431 if (unlikely(!(net_dev->flags & IFF_UP)))
427 brdev->stats.rx_dropped++; 432 goto dropped;
428 dev_kfree_skb(skb);
429 return;
430 }
431 brdev->stats.rx_packets++; 433 brdev->stats.rx_packets++;
432 brdev->stats.rx_bytes += skb->len; 434 brdev->stats.rx_bytes += skb->len;
433 memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data)); 435 memset(ATM_SKB(skb), 0, sizeof(struct atm_skb_data));
434 netif_rx(skb); 436 netif_rx(skb);
437 return;
438
439dropped:
440 brdev->stats.rx_dropped++;
441 goto free_skb;
442error:
443 brdev->stats.rx_errors++;
444free_skb:
445 dev_kfree_skb(skb);
446 return;
435} 447}
436 448
437/* 449/*
@@ -518,9 +530,9 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
518 struct sk_buff *next = skb->next; 530 struct sk_buff *next = skb->next;
519 531
520 skb->next = skb->prev = NULL; 532 skb->next = skb->prev = NULL;
533 br2684_push(atmvcc, skb);
521 BRPRIV(skb->dev)->stats.rx_bytes -= skb->len; 534 BRPRIV(skb->dev)->stats.rx_bytes -= skb->len;
522 BRPRIV(skb->dev)->stats.rx_packets--; 535 BRPRIV(skb->dev)->stats.rx_packets--;
523 br2684_push(atmvcc, skb);
524 536
525 skb = next; 537 skb = next;
526 } 538 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 582963077877..68d8df0992ab 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -119,6 +119,7 @@
119#include <linux/err.h> 119#include <linux/err.h>
120#include <linux/ctype.h> 120#include <linux/ctype.h>
121#include <linux/if_arp.h> 121#include <linux/if_arp.h>
122#include <linux/if_vlan.h>
122 123
123#include "net-sysfs.h" 124#include "net-sysfs.h"
124 125
@@ -1362,6 +1363,29 @@ void netif_device_attach(struct net_device *dev)
1362} 1363}
1363EXPORT_SYMBOL(netif_device_attach); 1364EXPORT_SYMBOL(netif_device_attach);
1364 1365
1366static bool can_checksum_protocol(unsigned long features, __be16 protocol)
1367{
1368 return ((features & NETIF_F_GEN_CSUM) ||
1369 ((features & NETIF_F_IP_CSUM) &&
1370 protocol == htons(ETH_P_IP)) ||
1371 ((features & NETIF_F_IPV6_CSUM) &&
1372 protocol == htons(ETH_P_IPV6)));
1373}
1374
1375static bool dev_can_checksum(struct net_device *dev, struct sk_buff *skb)
1376{
1377 if (can_checksum_protocol(dev->features, skb->protocol))
1378 return true;
1379
1380 if (skb->protocol == htons(ETH_P_8021Q)) {
1381 struct vlan_ethhdr *veh = (struct vlan_ethhdr *)skb->data;
1382 if (can_checksum_protocol(dev->features & dev->vlan_features,
1383 veh->h_vlan_encapsulated_proto))
1384 return true;
1385 }
1386
1387 return false;
1388}
1365 1389
1366/* 1390/*
1367 * Invalidate hardware checksum when packet is to be mangled, and 1391 * Invalidate hardware checksum when packet is to be mangled, and
@@ -1640,14 +1664,8 @@ int dev_queue_xmit(struct sk_buff *skb)
1640 if (skb->ip_summed == CHECKSUM_PARTIAL) { 1664 if (skb->ip_summed == CHECKSUM_PARTIAL) {
1641 skb_set_transport_header(skb, skb->csum_start - 1665 skb_set_transport_header(skb, skb->csum_start -
1642 skb_headroom(skb)); 1666 skb_headroom(skb));
1643 1667 if (!dev_can_checksum(dev, skb) && skb_checksum_help(skb))
1644 if (!(dev->features & NETIF_F_GEN_CSUM) && 1668 goto out_kfree_skb;
1645 !((dev->features & NETIF_F_IP_CSUM) &&
1646 skb->protocol == htons(ETH_P_IP)) &&
1647 !((dev->features & NETIF_F_IPV6_CSUM) &&
1648 skb->protocol == htons(ETH_P_IPV6)))
1649 if (skb_checksum_help(skb))
1650 goto out_kfree_skb;
1651 } 1669 }
1652 1670
1653gso: 1671gso:
diff --git a/net/dccp/ackvec.c b/net/dccp/ackvec.c
index 6de4bd195d28..1e8be246ad15 100644
--- a/net/dccp/ackvec.c
+++ b/net/dccp/ackvec.c
@@ -290,12 +290,12 @@ int dccp_ackvec_add(struct dccp_ackvec *av, const struct sock *sk,
290 290
291 while (1) { 291 while (1) {
292 const u8 len = dccp_ackvec_len(av, index); 292 const u8 len = dccp_ackvec_len(av, index);
293 const u8 state = dccp_ackvec_state(av, index); 293 const u8 av_state = dccp_ackvec_state(av, index);
294 /* 294 /*
295 * valid packets not yet in av_buf have a reserved 295 * valid packets not yet in av_buf have a reserved
296 * entry, with a len equal to 0. 296 * entry, with a len equal to 0.
297 */ 297 */
298 if (state == DCCP_ACKVEC_STATE_NOT_RECEIVED && 298 if (av_state == DCCP_ACKVEC_STATE_NOT_RECEIVED &&
299 len == 0 && delta == 0) { /* Found our 299 len == 0 && delta == 0) { /* Found our
300 reserved seat! */ 300 reserved seat! */
301 dccp_pr_debug("Found %llu reserved seat!\n", 301 dccp_pr_debug("Found %llu reserved seat!\n",
@@ -325,31 +325,6 @@ out_duplicate:
325 return -EILSEQ; 325 return -EILSEQ;
326} 326}
327 327
328#ifdef CONFIG_IP_DCCP_DEBUG
329void dccp_ackvector_print(const u64 ackno, const unsigned char *vector, int len)
330{
331 dccp_pr_debug_cat("ACK vector len=%d, ackno=%llu |", len,
332 (unsigned long long)ackno);
333
334 while (len--) {
335 const u8 state = (*vector & DCCP_ACKVEC_STATE_MASK) >> 6;
336 const u8 rl = *vector & DCCP_ACKVEC_LEN_MASK;
337
338 dccp_pr_debug_cat("%d,%d|", state, rl);
339 ++vector;
340 }
341
342 dccp_pr_debug_cat("\n");
343}
344
345void dccp_ackvec_print(const struct dccp_ackvec *av)
346{
347 dccp_ackvector_print(av->av_buf_ackno,
348 av->av_buf + av->av_buf_head,
349 av->av_vec_len);
350}
351#endif
352
353static void dccp_ackvec_throw_record(struct dccp_ackvec *av, 328static void dccp_ackvec_throw_record(struct dccp_ackvec *av,
354 struct dccp_ackvec_record *avr) 329 struct dccp_ackvec_record *avr)
355{ 330{
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index f813077234b7..a1929f33d703 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -159,8 +159,8 @@ static void ccid3_hc_tx_update_x(struct sock *sk, ktime_t *stamp)
159 } else if (ktime_us_delta(now, hctx->ccid3hctx_t_ld) 159 } else if (ktime_us_delta(now, hctx->ccid3hctx_t_ld)
160 - (s64)hctx->ccid3hctx_rtt >= 0) { 160 - (s64)hctx->ccid3hctx_rtt >= 0) {
161 161
162 hctx->ccid3hctx_x = 162 hctx->ccid3hctx_x = min(2 * hctx->ccid3hctx_x, min_rate);
163 max(min(2 * hctx->ccid3hctx_x, min_rate), 163 hctx->ccid3hctx_x = max(hctx->ccid3hctx_x,
164 scaled_div(((__u64)hctx->ccid3hctx_s) << 6, 164 scaled_div(((__u64)hctx->ccid3hctx_s) << 6,
165 hctx->ccid3hctx_rtt)); 165 hctx->ccid3hctx_rtt));
166 hctx->ccid3hctx_t_ld = now; 166 hctx->ccid3hctx_t_ld = now;
@@ -329,8 +329,14 @@ static int ccid3_hc_tx_send_packet(struct sock *sk, struct sk_buff *skb)
329 hctx->ccid3hctx_x = rfc3390_initial_rate(sk); 329 hctx->ccid3hctx_x = rfc3390_initial_rate(sk);
330 hctx->ccid3hctx_t_ld = now; 330 hctx->ccid3hctx_t_ld = now;
331 } else { 331 } else {
332 /* Sender does not have RTT sample: X_pps = 1 pkt/sec */ 332 /*
333 hctx->ccid3hctx_x = hctx->ccid3hctx_s; 333 * Sender does not have RTT sample:
334 * - set fallback RTT (RFC 4340, 3.4) since a RTT value
335 * is needed in several parts (e.g. window counter);
336 * - set sending rate X_pps = 1pps as per RFC 3448, 4.2.
337 */
338 hctx->ccid3hctx_rtt = DCCP_FALLBACK_RTT;
339 hctx->ccid3hctx_x = hctx->ccid3hctx_s;
334 hctx->ccid3hctx_x <<= 6; 340 hctx->ccid3hctx_x <<= 6;
335 } 341 }
336 ccid3_update_send_interval(hctx); 342 ccid3_update_send_interval(hctx);
diff --git a/net/dccp/ccids/lib/tfrc.c b/net/dccp/ccids/lib/tfrc.c
index d1dfbb8de64c..97ecec0a8e76 100644
--- a/net/dccp/ccids/lib/tfrc.c
+++ b/net/dccp/ccids/lib/tfrc.c
@@ -14,14 +14,6 @@ module_param(tfrc_debug, bool, 0444);
14MODULE_PARM_DESC(tfrc_debug, "Enable debug messages"); 14MODULE_PARM_DESC(tfrc_debug, "Enable debug messages");
15#endif 15#endif
16 16
17extern int tfrc_tx_packet_history_init(void);
18extern void tfrc_tx_packet_history_exit(void);
19extern int tfrc_rx_packet_history_init(void);
20extern void tfrc_rx_packet_history_exit(void);
21
22extern int tfrc_li_init(void);
23extern void tfrc_li_exit(void);
24
25static int __init tfrc_module_init(void) 17static int __init tfrc_module_init(void)
26{ 18{
27 int rc = tfrc_li_init(); 19 int rc = tfrc_li_init();
diff --git a/net/dccp/ccids/lib/tfrc.h b/net/dccp/ccids/lib/tfrc.h
index 1fb1187bbf1c..ed9857527acf 100644
--- a/net/dccp/ccids/lib/tfrc.h
+++ b/net/dccp/ccids/lib/tfrc.h
@@ -15,7 +15,7 @@
15 * (at your option) any later version. 15 * (at your option) any later version.
16 */ 16 */
17#include <linux/types.h> 17#include <linux/types.h>
18#include <asm/div64.h> 18#include <linux/math64.h>
19#include "../../dccp.h" 19#include "../../dccp.h"
20/* internal includes that this module exports: */ 20/* internal includes that this module exports: */
21#include "loss_interval.h" 21#include "loss_interval.h"
@@ -29,21 +29,19 @@ extern int tfrc_debug;
29#endif 29#endif
30 30
31/* integer-arithmetic divisions of type (a * 1000000)/b */ 31/* integer-arithmetic divisions of type (a * 1000000)/b */
32static inline u64 scaled_div(u64 a, u32 b) 32static inline u64 scaled_div(u64 a, u64 b)
33{ 33{
34 BUG_ON(b==0); 34 BUG_ON(b==0);
35 a *= 1000000; 35 return div64_u64(a * 1000000, b);
36 do_div(a, b);
37 return a;
38} 36}
39 37
40static inline u32 scaled_div32(u64 a, u32 b) 38static inline u32 scaled_div32(u64 a, u64 b)
41{ 39{
42 u64 result = scaled_div(a, b); 40 u64 result = scaled_div(a, b);
43 41
44 if (result > UINT_MAX) { 42 if (result > UINT_MAX) {
45 DCCP_CRIT("Overflow: a(%llu)/b(%u) > ~0U", 43 DCCP_CRIT("Overflow: %llu/%llu > UINT_MAX",
46 (unsigned long long)a, b); 44 (unsigned long long)a, (unsigned long long)b);
47 return UINT_MAX; 45 return UINT_MAX;
48 } 46 }
49 return result; 47 return result;
@@ -58,7 +56,14 @@ static inline u32 tfrc_ewma(const u32 avg, const u32 newval, const u8 weight)
58 return avg ? (weight * avg + (10 - weight) * newval) / 10 : newval; 56 return avg ? (weight * avg + (10 - weight) * newval) / 10 : newval;
59} 57}
60 58
61extern u32 tfrc_calc_x(u16 s, u32 R, u32 p); 59extern u32 tfrc_calc_x(u16 s, u32 R, u32 p);
62extern u32 tfrc_calc_x_reverse_lookup(u32 fvalue); 60extern u32 tfrc_calc_x_reverse_lookup(u32 fvalue);
63 61
62extern int tfrc_tx_packet_history_init(void);
63extern void tfrc_tx_packet_history_exit(void);
64extern int tfrc_rx_packet_history_init(void);
65extern void tfrc_rx_packet_history_exit(void);
66
67extern int tfrc_li_init(void);
68extern void tfrc_li_exit(void);
64#endif /* _TFRC_H_ */ 69#endif /* _TFRC_H_ */
diff --git a/net/dccp/ccids/lib/tfrc_equation.c b/net/dccp/ccids/lib/tfrc_equation.c
index e4e64b76c10c..2f20a29cffe4 100644
--- a/net/dccp/ccids/lib/tfrc_equation.c
+++ b/net/dccp/ccids/lib/tfrc_equation.c
@@ -661,7 +661,7 @@ u32 tfrc_calc_x(u16 s, u32 R, u32 p)
661 661
662EXPORT_SYMBOL_GPL(tfrc_calc_x); 662EXPORT_SYMBOL_GPL(tfrc_calc_x);
663 663
664/* 664/**
665 * tfrc_calc_x_reverse_lookup - try to find p given f(p) 665 * tfrc_calc_x_reverse_lookup - try to find p given f(p)
666 * 666 *
667 * @fvalue: function value to match, scaled by 1000000 667 * @fvalue: function value to match, scaled by 1000000
@@ -676,11 +676,11 @@ u32 tfrc_calc_x_reverse_lookup(u32 fvalue)
676 676
677 /* Error cases. */ 677 /* Error cases. */
678 if (fvalue < tfrc_calc_x_lookup[0][1]) { 678 if (fvalue < tfrc_calc_x_lookup[0][1]) {
679 DCCP_WARN("fvalue %d smaller than resolution\n", fvalue); 679 DCCP_WARN("fvalue %u smaller than resolution\n", fvalue);
680 return tfrc_calc_x_lookup[0][1]; 680 return TFRC_SMALLEST_P;
681 } 681 }
682 if (fvalue > tfrc_calc_x_lookup[TFRC_CALC_X_ARRSIZE - 1][0]) { 682 if (fvalue > tfrc_calc_x_lookup[TFRC_CALC_X_ARRSIZE - 1][0]) {
683 DCCP_WARN("fvalue %d exceeds bounds!\n", fvalue); 683 DCCP_WARN("fvalue %u exceeds bounds!\n", fvalue);
684 return 1000000; 684 return 1000000;
685 } 685 }
686 686
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index c22a3780c14e..37d27bcb361f 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -589,7 +589,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
589 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) 589 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
590 goto drop; 590 goto drop;
591 591
592 req = reqsk_alloc(&dccp_request_sock_ops); 592 req = inet_reqsk_alloc(&dccp_request_sock_ops);
593 if (req == NULL) 593 if (req == NULL)
594 goto drop; 594 goto drop;
595 595
@@ -605,7 +605,6 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
605 ireq = inet_rsk(req); 605 ireq = inet_rsk(req);
606 ireq->loc_addr = ip_hdr(skb)->daddr; 606 ireq->loc_addr = ip_hdr(skb)->daddr;
607 ireq->rmt_addr = ip_hdr(skb)->saddr; 607 ireq->rmt_addr = ip_hdr(skb)->saddr;
608 ireq->opt = NULL;
609 608
610 /* 609 /*
611 * Step 3: Process LISTEN state 610 * Step 3: Process LISTEN state
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9b1129bb7ece..f7fe2a572d7b 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -421,7 +421,6 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
421 ireq6 = inet6_rsk(req); 421 ireq6 = inet6_rsk(req);
422 ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr); 422 ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
423 ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr); 423 ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
424 ireq6->pktopts = NULL;
425 424
426 if (ipv6_opt_accepted(sk, skb) || 425 if (ipv6_opt_accepted(sk, skb) ||
427 np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo || 426 np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
diff --git a/net/dccp/minisocks.c b/net/dccp/minisocks.c
index 33ad48321b08..66dca5bba858 100644
--- a/net/dccp/minisocks.c
+++ b/net/dccp/minisocks.c
@@ -165,12 +165,12 @@ out_free:
165 /* See dccp_v4_conn_request */ 165 /* See dccp_v4_conn_request */
166 newdmsk->dccpms_sequence_window = req->rcv_wnd; 166 newdmsk->dccpms_sequence_window = req->rcv_wnd;
167 167
168 newdp->dccps_gar = newdp->dccps_isr = dreq->dreq_isr; 168 newdp->dccps_gar = newdp->dccps_iss = dreq->dreq_iss;
169 dccp_update_gsr(newsk, dreq->dreq_isr);
170
171 newdp->dccps_iss = dreq->dreq_iss;
172 dccp_update_gss(newsk, dreq->dreq_iss); 169 dccp_update_gss(newsk, dreq->dreq_iss);
173 170
171 newdp->dccps_isr = dreq->dreq_isr;
172 dccp_update_gsr(newsk, dreq->dreq_isr);
173
174 /* 174 /*
175 * SWL and AWL are initially adjusted so that they are not less than 175 * SWL and AWL are initially adjusted so that they are not less than
176 * the initial Sequence Numbers received and sent, respectively: 176 * the initial Sequence Numbers received and sent, respectively:
diff --git a/net/dccp/options.c b/net/dccp/options.c
index d2a84a2fecee..43bc24e761d0 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -107,9 +107,11 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
107 * 107 *
108 * CCID-specific options are ignored during connection setup, as 108 * CCID-specific options are ignored during connection setup, as
109 * negotiation may still be in progress (see RFC 4340, 10.3). 109 * negotiation may still be in progress (see RFC 4340, 10.3).
110 * The same applies to Ack Vectors, as these depend on the CCID.
110 * 111 *
111 */ 112 */
112 if (dreq != NULL && opt >= 128) 113 if (dreq != NULL && (opt >= 128 ||
114 opt == DCCPO_ACK_VECTOR_0 || opt == DCCPO_ACK_VECTOR_1))
113 goto ignore_option; 115 goto ignore_option;
114 116
115 switch (opt) { 117 switch (opt) {
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 1f8a9b64c083..fe20068c5d8e 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -508,6 +508,7 @@ void dccp_send_ack(struct sock *sk)
508 508
509EXPORT_SYMBOL_GPL(dccp_send_ack); 509EXPORT_SYMBOL_GPL(dccp_send_ack);
510 510
511#if 0
511/* FIXME: Is this still necessary (11.3) - currently nowhere used by DCCP. */ 512/* FIXME: Is this still necessary (11.3) - currently nowhere used by DCCP. */
512void dccp_send_delayed_ack(struct sock *sk) 513void dccp_send_delayed_ack(struct sock *sk)
513{ 514{
@@ -538,6 +539,7 @@ void dccp_send_delayed_ack(struct sock *sk)
538 icsk->icsk_ack.timeout = timeout; 539 icsk->icsk_ack.timeout = timeout;
539 sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout); 540 sk_reset_timer(sk, &icsk->icsk_delack_timer, timeout);
540} 541}
542#endif
541 543
542void dccp_send_sync(struct sock *sk, const u64 ackno, 544void dccp_send_sync(struct sock *sk, const u64 ackno,
543 const enum dccp_pkt_type pkt_type) 545 const enum dccp_pkt_type pkt_type)
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 0bcdc9250279..81368a7f5379 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -42,7 +42,7 @@ static int bufsize = 64 * 1024;
42 42
43static const char procname[] = "dccpprobe"; 43static const char procname[] = "dccpprobe";
44 44
45struct { 45static struct {
46 struct kfifo *fifo; 46 struct kfifo *fifo;
47 spinlock_t lock; 47 spinlock_t lock;
48 wait_queue_head_t wait; 48 wait_queue_head_t wait;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 3b83c34019fc..0d4d72827e4b 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -960,7 +960,10 @@ int fib_dump_info(struct sk_buff *skb, u32 pid, u32 seq, int event,
960 rtm->rtm_dst_len = dst_len; 960 rtm->rtm_dst_len = dst_len;
961 rtm->rtm_src_len = 0; 961 rtm->rtm_src_len = 0;
962 rtm->rtm_tos = tos; 962 rtm->rtm_tos = tos;
963 rtm->rtm_table = tb_id; 963 if (tb_id < 256)
964 rtm->rtm_table = tb_id;
965 else
966 rtm->rtm_table = RT_TABLE_COMPAT;
964 NLA_PUT_U32(skb, RTA_TABLE, tb_id); 967 NLA_PUT_U32(skb, RTA_TABLE, tb_id);
965 rtm->rtm_type = type; 968 rtm->rtm_type = type;
966 rtm->rtm_flags = fi->fib_flags; 969 rtm->rtm_flags = fi->fib_flags;
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 828ea211ff21..ec834480abe7 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -419,7 +419,8 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
419 struct inet_connection_sock *icsk = inet_csk(parent); 419 struct inet_connection_sock *icsk = inet_csk(parent);
420 struct request_sock_queue *queue = &icsk->icsk_accept_queue; 420 struct request_sock_queue *queue = &icsk->icsk_accept_queue;
421 struct listen_sock *lopt = queue->listen_opt; 421 struct listen_sock *lopt = queue->listen_opt;
422 int thresh = icsk->icsk_syn_retries ? : sysctl_tcp_synack_retries; 422 int max_retries = icsk->icsk_syn_retries ? : sysctl_tcp_synack_retries;
423 int thresh = max_retries;
423 unsigned long now = jiffies; 424 unsigned long now = jiffies;
424 struct request_sock **reqp, *req; 425 struct request_sock **reqp, *req;
425 int i, budget; 426 int i, budget;
@@ -455,6 +456,9 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
455 } 456 }
456 } 457 }
457 458
459 if (queue->rskq_defer_accept)
460 max_retries = queue->rskq_defer_accept;
461
458 budget = 2 * (lopt->nr_table_entries / (timeout / interval)); 462 budget = 2 * (lopt->nr_table_entries / (timeout / interval));
459 i = lopt->clock_hand; 463 i = lopt->clock_hand;
460 464
@@ -462,8 +466,9 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
462 reqp=&lopt->syn_table[i]; 466 reqp=&lopt->syn_table[i];
463 while ((req = *reqp) != NULL) { 467 while ((req = *reqp) != NULL) {
464 if (time_after_eq(now, req->expires)) { 468 if (time_after_eq(now, req->expires)) {
465 if (req->retrans < thresh && 469 if ((req->retrans < thresh ||
466 !req->rsk_ops->rtx_syn_ack(parent, req)) { 470 (inet_rsk(req)->acked && req->retrans < max_retries))
471 && !req->rsk_ops->rtx_syn_ack(parent, req)) {
467 unsigned long timeo; 472 unsigned long timeo;
468 473
469 if (req->retrans++ == 0) 474 if (req->retrans++ == 0)
diff --git a/net/ipv4/netfilter/nf_nat_core.c b/net/ipv4/netfilter/nf_nat_core.c
index 04578593e100..d2a887fc8d9b 100644
--- a/net/ipv4/netfilter/nf_nat_core.c
+++ b/net/ipv4/netfilter/nf_nat_core.c
@@ -556,7 +556,6 @@ static void nf_nat_cleanup_conntrack(struct nf_conn *ct)
556 556
557 spin_lock_bh(&nf_nat_lock); 557 spin_lock_bh(&nf_nat_lock);
558 hlist_del_rcu(&nat->bysource); 558 hlist_del_rcu(&nat->bysource);
559 nat->ct = NULL;
560 spin_unlock_bh(&nf_nat_lock); 559 spin_unlock_bh(&nf_nat_lock);
561} 560}
562 561
@@ -570,8 +569,8 @@ static void nf_nat_move_storage(void *new, void *old)
570 return; 569 return;
571 570
572 spin_lock_bh(&nf_nat_lock); 571 spin_lock_bh(&nf_nat_lock);
573 hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
574 new_nat->ct = ct; 572 new_nat->ct = ct;
573 hlist_replace_rcu(&old_nat->bysource, &new_nat->bysource);
575 spin_unlock_bh(&nf_nat_lock); 574 spin_unlock_bh(&nf_nat_lock);
576} 575}
577 576
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index e7e091d365ff..37a1ecd9d600 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -934,7 +934,7 @@ static void raw_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
934 srcp = inet->num; 934 srcp = inet->num;
935 935
936 seq_printf(seq, "%4d: %08X:%04X %08X:%04X" 936 seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
937 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d", 937 " %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
938 i, src, srcp, dest, destp, sp->sk_state, 938 i, src, srcp, dest, destp, sp->sk_state,
939 atomic_read(&sp->sk_wmem_alloc), 939 atomic_read(&sp->sk_wmem_alloc),
940 atomic_read(&sp->sk_rmem_alloc), 940 atomic_read(&sp->sk_rmem_alloc),
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 73ba98921d64..d182a2a26291 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -285,7 +285,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
285 cookie_check_timestamp(&tcp_opt); 285 cookie_check_timestamp(&tcp_opt);
286 286
287 ret = NULL; 287 ret = NULL;
288 req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */ 288 req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
289 if (!req) 289 if (!req)
290 goto out; 290 goto out;
291 291
@@ -301,7 +301,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
301 ireq->rmt_port = th->source; 301 ireq->rmt_port = th->source;
302 ireq->loc_addr = ip_hdr(skb)->daddr; 302 ireq->loc_addr = ip_hdr(skb)->daddr;
303 ireq->rmt_addr = ip_hdr(skb)->saddr; 303 ireq->rmt_addr = ip_hdr(skb)->saddr;
304 ireq->opt = NULL;
305 ireq->snd_wscale = tcp_opt.snd_wscale; 304 ireq->snd_wscale = tcp_opt.snd_wscale;
306 ireq->rcv_wscale = tcp_opt.rcv_wscale; 305 ireq->rcv_wscale = tcp_opt.rcv_wscale;
307 ireq->sack_ok = tcp_opt.sack_ok; 306 ireq->sack_ok = tcp_opt.sack_ok;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ab66683b8043..fc54a48fde1e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2112,12 +2112,15 @@ static int do_tcp_setsockopt(struct sock *sk, int level,
2112 break; 2112 break;
2113 2113
2114 case TCP_DEFER_ACCEPT: 2114 case TCP_DEFER_ACCEPT:
2115 if (val < 0) { 2115 icsk->icsk_accept_queue.rskq_defer_accept = 0;
2116 err = -EINVAL; 2116 if (val > 0) {
2117 } else { 2117 /* Translate value in seconds to number of
2118 if (val > MAX_TCP_ACCEPT_DEFERRED) 2118 * retransmits */
2119 val = MAX_TCP_ACCEPT_DEFERRED; 2119 while (icsk->icsk_accept_queue.rskq_defer_accept < 32 &&
2120 icsk->icsk_accept_queue.rskq_defer_accept = val; 2120 val > ((TCP_TIMEOUT_INIT / HZ) <<
2121 icsk->icsk_accept_queue.rskq_defer_accept))
2122 icsk->icsk_accept_queue.rskq_defer_accept++;
2123 icsk->icsk_accept_queue.rskq_defer_accept++;
2121 } 2124 }
2122 break; 2125 break;
2123 2126
@@ -2299,7 +2302,8 @@ static int do_tcp_getsockopt(struct sock *sk, int level,
2299 val = (val ? : sysctl_tcp_fin_timeout) / HZ; 2302 val = (val ? : sysctl_tcp_fin_timeout) / HZ;
2300 break; 2303 break;
2301 case TCP_DEFER_ACCEPT: 2304 case TCP_DEFER_ACCEPT:
2302 val = icsk->icsk_accept_queue.rskq_defer_accept; 2305 val = !icsk->icsk_accept_queue.rskq_defer_accept ? 0 :
2306 ((TCP_TIMEOUT_INIT / HZ) << (icsk->icsk_accept_queue.rskq_defer_accept - 1));
2303 break; 2307 break;
2304 case TCP_WINDOW_CLAMP: 2308 case TCP_WINDOW_CLAMP:
2305 val = tp->window_clamp; 2309 val = tp->window_clamp;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index eba873e9b560..cad73b7dfef0 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4541,49 +4541,6 @@ static void tcp_urg(struct sock *sk, struct sk_buff *skb, struct tcphdr *th)
4541 } 4541 }
4542} 4542}
4543 4543
4544static int tcp_defer_accept_check(struct sock *sk)
4545{
4546 struct tcp_sock *tp = tcp_sk(sk);
4547
4548 if (tp->defer_tcp_accept.request) {
4549 int queued_data = tp->rcv_nxt - tp->copied_seq;
4550 int hasfin = !skb_queue_empty(&sk->sk_receive_queue) ?
4551 tcp_hdr((struct sk_buff *)
4552 sk->sk_receive_queue.prev)->fin : 0;
4553
4554 if (queued_data && hasfin)
4555 queued_data--;
4556
4557 if (queued_data &&
4558 tp->defer_tcp_accept.listen_sk->sk_state == TCP_LISTEN) {
4559 if (sock_flag(sk, SOCK_KEEPOPEN)) {
4560 inet_csk_reset_keepalive_timer(sk,
4561 keepalive_time_when(tp));
4562 } else {
4563 inet_csk_delete_keepalive_timer(sk);
4564 }
4565
4566 inet_csk_reqsk_queue_add(
4567 tp->defer_tcp_accept.listen_sk,
4568 tp->defer_tcp_accept.request,
4569 sk);
4570
4571 tp->defer_tcp_accept.listen_sk->sk_data_ready(
4572 tp->defer_tcp_accept.listen_sk, 0);
4573
4574 sock_put(tp->defer_tcp_accept.listen_sk);
4575 sock_put(sk);
4576 tp->defer_tcp_accept.listen_sk = NULL;
4577 tp->defer_tcp_accept.request = NULL;
4578 } else if (hasfin ||
4579 tp->defer_tcp_accept.listen_sk->sk_state != TCP_LISTEN) {
4580 tcp_reset(sk);
4581 return -1;
4582 }
4583 }
4584 return 0;
4585}
4586
4587static int tcp_copy_to_iovec(struct sock *sk, struct sk_buff *skb, int hlen) 4544static int tcp_copy_to_iovec(struct sock *sk, struct sk_buff *skb, int hlen)
4588{ 4545{
4589 struct tcp_sock *tp = tcp_sk(sk); 4546 struct tcp_sock *tp = tcp_sk(sk);
@@ -4944,8 +4901,6 @@ step5:
4944 4901
4945 tcp_data_snd_check(sk); 4902 tcp_data_snd_check(sk);
4946 tcp_ack_snd_check(sk); 4903 tcp_ack_snd_check(sk);
4947
4948 tcp_defer_accept_check(sk);
4949 return 0; 4904 return 0;
4950 4905
4951csum_error: 4906csum_error:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index cd601a866c2f..12695be2c255 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -85,10 +85,6 @@
85int sysctl_tcp_tw_reuse __read_mostly; 85int sysctl_tcp_tw_reuse __read_mostly;
86int sysctl_tcp_low_latency __read_mostly; 86int sysctl_tcp_low_latency __read_mostly;
87 87
88/* Check TCP sequence numbers in ICMP packets. */
89#define ICMP_MIN_LENGTH 8
90
91void tcp_v4_send_check(struct sock *sk, int len, struct sk_buff *skb);
92 88
93#ifdef CONFIG_TCP_MD5SIG 89#ifdef CONFIG_TCP_MD5SIG
94static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk, 90static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
@@ -1285,7 +1281,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
1285 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1) 1281 if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
1286 goto drop; 1282 goto drop;
1287 1283
1288 req = reqsk_alloc(&tcp_request_sock_ops); 1284 req = inet_reqsk_alloc(&tcp_request_sock_ops);
1289 if (!req) 1285 if (!req)
1290 goto drop; 1286 goto drop;
1291 1287
@@ -1918,14 +1914,6 @@ int tcp_v4_destroy_sock(struct sock *sk)
1918 sk->sk_sndmsg_page = NULL; 1914 sk->sk_sndmsg_page = NULL;
1919 } 1915 }
1920 1916
1921 if (tp->defer_tcp_accept.request) {
1922 reqsk_free(tp->defer_tcp_accept.request);
1923 sock_put(tp->defer_tcp_accept.listen_sk);
1924 sock_put(sk);
1925 tp->defer_tcp_accept.listen_sk = NULL;
1926 tp->defer_tcp_accept.request = NULL;
1927 }
1928
1929 atomic_dec(&tcp_sockets_allocated); 1917 atomic_dec(&tcp_sockets_allocated);
1930 1918
1931 return 0; 1919 return 0;
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 019c8c16e5cc..8245247a6ceb 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -571,8 +571,10 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
571 does sequence test, SYN is truncated, and thus we consider 571 does sequence test, SYN is truncated, and thus we consider
572 it a bare ACK. 572 it a bare ACK.
573 573
574 Both ends (listening sockets) accept the new incoming 574 If icsk->icsk_accept_queue.rskq_defer_accept, we silently drop this
575 connection and try to talk to each other. 8-) 575 bare ACK. Otherwise, we create an established connection. Both
576 ends (listening sockets) accept the new incoming connection and try
577 to talk to each other. 8-)
576 578
577 Note: This case is both harmless, and rare. Possibility is about the 579 Note: This case is both harmless, and rare. Possibility is about the
578 same as us discovering intelligent life on another plant tomorrow. 580 same as us discovering intelligent life on another plant tomorrow.
@@ -640,6 +642,13 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
640 if (!(flg & TCP_FLAG_ACK)) 642 if (!(flg & TCP_FLAG_ACK))
641 return NULL; 643 return NULL;
642 644
645 /* If TCP_DEFER_ACCEPT is set, drop bare ACK. */
646 if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept &&
647 TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
648 inet_rsk(req)->acked = 1;
649 return NULL;
650 }
651
643 /* OK, ACK is valid, create big socket and 652 /* OK, ACK is valid, create big socket and
644 * feed this segment to it. It will repeat all 653 * feed this segment to it. It will repeat all
645 * the tests. THIS SEGMENT MUST MOVE SOCKET TO 654 * the tests. THIS SEGMENT MUST MOVE SOCKET TO
@@ -678,24 +687,7 @@ struct sock *tcp_check_req(struct sock *sk,struct sk_buff *skb,
678 inet_csk_reqsk_queue_unlink(sk, req, prev); 687 inet_csk_reqsk_queue_unlink(sk, req, prev);
679 inet_csk_reqsk_queue_removed(sk, req); 688 inet_csk_reqsk_queue_removed(sk, req);
680 689
681 if (inet_csk(sk)->icsk_accept_queue.rskq_defer_accept && 690 inet_csk_reqsk_queue_add(sk, req, child);
682 TCP_SKB_CB(skb)->end_seq == tcp_rsk(req)->rcv_isn + 1) {
683
684 /* the accept queue handling is done is est recv slow
685 * path so lets make sure to start there
686 */
687 tcp_sk(child)->pred_flags = 0;
688 sock_hold(sk);
689 sock_hold(child);
690 tcp_sk(child)->defer_tcp_accept.listen_sk = sk;
691 tcp_sk(child)->defer_tcp_accept.request = req;
692
693 inet_csk_reset_keepalive_timer(child,
694 inet_csk(sk)->icsk_accept_queue.rskq_defer_accept * HZ);
695 } else {
696 inet_csk_reqsk_queue_add(sk, req, child);
697 }
698
699 return child; 691 return child;
700 692
701 listen_overflow: 693 listen_overflow:
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 4de68cf5f2aa..63ed9d6830e7 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -489,11 +489,6 @@ static void tcp_keepalive_timer (unsigned long data)
489 goto death; 489 goto death;
490 } 490 }
491 491
492 if (tp->defer_tcp_accept.request && sk->sk_state == TCP_ESTABLISHED) {
493 tcp_send_active_reset(sk, GFP_ATOMIC);
494 goto death;
495 }
496
497 if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE) 492 if (!sock_flag(sk, SOCK_KEEPOPEN) || sk->sk_state == TCP_CLOSE)
498 goto out; 493 goto out;
499 494
diff --git a/net/ipv4/xfrm4_mode_tunnel.c b/net/ipv4/xfrm4_mode_tunnel.c
index 584e6d74e3a9..7135279f3f84 100644
--- a/net/ipv4/xfrm4_mode_tunnel.c
+++ b/net/ipv4/xfrm4_mode_tunnel.c
@@ -52,7 +52,7 @@ static int xfrm4_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
52 IP_ECN_clear(top_iph); 52 IP_ECN_clear(top_iph);
53 53
54 top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ? 54 top_iph->frag_off = (flags & XFRM_STATE_NOPMTUDISC) ?
55 0 : XFRM_MODE_SKB_CB(skb)->frag_off; 55 0 : (XFRM_MODE_SKB_CB(skb)->frag_off & htons(IP_DF));
56 ip_select_ident(top_iph, dst->child, NULL); 56 ip_select_ident(top_iph, dst->child, NULL);
57 57
58 top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT); 58 top_iph->ttl = dst_metric(dst->child, RTAX_HOPLIMIT);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3c6aafb02183..e84b3fd17fb4 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -191,7 +191,7 @@ lookup_protocol:
191 np->mcast_hops = -1; 191 np->mcast_hops = -1;
192 np->mc_loop = 1; 192 np->mc_loop = 1;
193 np->pmtudisc = IPV6_PMTUDISC_WANT; 193 np->pmtudisc = IPV6_PMTUDISC_WANT;
194 np->ipv6only = init_net.ipv6.sysctl.bindv6only; 194 np->ipv6only = net->ipv6.sysctl.bindv6only;
195 195
196 /* Init the ipv4 part of the socket since we can have sockets 196 /* Init the ipv4 part of the socket since we can have sockets
197 * using v6 API for ipv4. 197 * using v6 API for ipv4.
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index b9c2de84a8a2..0f0f94a40335 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -705,6 +705,11 @@ int datagram_send_ctl(struct net *net,
705 } 705 }
706 706
707 *hlimit = *(int *)CMSG_DATA(cmsg); 707 *hlimit = *(int *)CMSG_DATA(cmsg);
708 if (*hlimit < -1 || *hlimit > 0xff) {
709 err = -EINVAL;
710 goto exit_f;
711 }
712
708 break; 713 break;
709 714
710 case IPV6_TCLASS: 715 case IPV6_TCLASS:
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 26b83e512a09..c042ce19bd14 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -67,7 +67,7 @@ int ip6_ra_control(struct sock *sk, int sel, void (*destructor)(struct sock *))
67 67
68 /* RA packet may be delivered ONLY to IPPROTO_RAW socket */ 68 /* RA packet may be delivered ONLY to IPPROTO_RAW socket */
69 if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW) 69 if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW)
70 return -EINVAL; 70 return -ENOPROTOOPT;
71 71
72 new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL; 72 new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
73 73
@@ -446,7 +446,7 @@ done:
446 446
447 case IPV6_MULTICAST_HOPS: 447 case IPV6_MULTICAST_HOPS:
448 if (sk->sk_type == SOCK_STREAM) 448 if (sk->sk_type == SOCK_STREAM)
449 goto e_inval; 449 break;
450 if (optlen < sizeof(int)) 450 if (optlen < sizeof(int))
451 goto e_inval; 451 goto e_inval;
452 if (val > 255 || val < -1) 452 if (val > 255 || val < -1)
@@ -458,13 +458,15 @@ done:
458 case IPV6_MULTICAST_LOOP: 458 case IPV6_MULTICAST_LOOP:
459 if (optlen < sizeof(int)) 459 if (optlen < sizeof(int))
460 goto e_inval; 460 goto e_inval;
461 if (val != valbool)
462 goto e_inval;
461 np->mc_loop = valbool; 463 np->mc_loop = valbool;
462 retv = 0; 464 retv = 0;
463 break; 465 break;
464 466
465 case IPV6_MULTICAST_IF: 467 case IPV6_MULTICAST_IF:
466 if (sk->sk_type == SOCK_STREAM) 468 if (sk->sk_type == SOCK_STREAM)
467 goto e_inval; 469 break;
468 if (optlen < sizeof(int)) 470 if (optlen < sizeof(int))
469 goto e_inval; 471 goto e_inval;
470 472
@@ -860,7 +862,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
860 if (sk->sk_protocol != IPPROTO_UDP && 862 if (sk->sk_protocol != IPPROTO_UDP &&
861 sk->sk_protocol != IPPROTO_UDPLITE && 863 sk->sk_protocol != IPPROTO_UDPLITE &&
862 sk->sk_protocol != IPPROTO_TCP) 864 sk->sk_protocol != IPPROTO_TCP)
863 return -EINVAL; 865 return -ENOPROTOOPT;
864 if (sk->sk_state != TCP_ESTABLISHED) 866 if (sk->sk_state != TCP_ESTABLISHED)
865 return -ENOTCONN; 867 return -ENOTCONN;
866 val = sk->sk_family; 868 val = sk->sk_family;
@@ -874,6 +876,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
874 return -EINVAL; 876 return -EINVAL;
875 if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0))) 877 if (copy_from_user(&gsf, optval, GROUP_FILTER_SIZE(0)))
876 return -EFAULT; 878 return -EFAULT;
879 if (gsf.gf_group.ss_family != AF_INET6)
880 return -EADDRNOTAVAIL;
877 lock_sock(sk); 881 lock_sock(sk);
878 err = ip6_mc_msfget(sk, &gsf, 882 err = ip6_mc_msfget(sk, &gsf,
879 (struct group_filter __user *)optval, optlen); 883 (struct group_filter __user *)optval, optlen);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 8fee9a15b2d3..3aee12310d94 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1169,7 +1169,8 @@ static int raw6_destroy(struct sock *sk)
1169 lock_sock(sk); 1169 lock_sock(sk);
1170 ip6_flush_pending_frames(sk); 1170 ip6_flush_pending_frames(sk);
1171 release_sock(sk); 1171 release_sock(sk);
1172 return 0; 1172
1173 return inet6_destroy_sock(sk);
1173} 1174}
1174 1175
1175static int rawv6_init_sk(struct sock *sk) 1176static int rawv6_init_sk(struct sock *sk)
@@ -1200,7 +1201,6 @@ struct proto rawv6_prot = {
1200 .disconnect = udp_disconnect, 1201 .disconnect = udp_disconnect,
1201 .ioctl = rawv6_ioctl, 1202 .ioctl = rawv6_ioctl,
1202 .init = rawv6_init_sk, 1203 .init = rawv6_init_sk,
1203 .destroy = inet6_destroy_sock,
1204 .setsockopt = rawv6_setsockopt, 1204 .setsockopt = rawv6_setsockopt,
1205 .getsockopt = rawv6_getsockopt, 1205 .getsockopt = rawv6_getsockopt,
1206 .sendmsg = rawv6_sendmsg, 1206 .sendmsg = rawv6_sendmsg,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 220cffe9e63b..d1f3e19b06c7 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2196,8 +2196,12 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
2196 2196
2197 NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric); 2197 NLA_PUT_U32(skb, RTA_PRIORITY, rt->rt6i_metric);
2198 2198
2199 expires = (rt->rt6i_flags & RTF_EXPIRES) ? 2199 if (!(rt->rt6i_flags & RTF_EXPIRES))
2200 rt->rt6i_expires - jiffies : 0; 2200 expires = 0;
2201 else if (rt->rt6i_expires - jiffies < INT_MAX)
2202 expires = rt->rt6i_expires - jiffies;
2203 else
2204 expires = INT_MAX;
2201 2205
2202 if (rtnl_put_cacheinfo(skb, &rt->u.dst, 0, 0, 0, 2206 if (rtnl_put_cacheinfo(skb, &rt->u.dst, 0, 0, 0,
2203 expires, rt->u.dst.error) < 0) 2207 expires, rt->u.dst.error) < 0)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 3de6ffdaedf2..32e871a6c25a 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -222,15 +222,18 @@ __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
222 222
223} 223}
224 224
225static int ipip6_tunnel_get_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a) 225static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
226 struct ip_tunnel_prl __user *a)
226{ 227{
227 struct ip_tunnel_prl *kp; 228 struct ip_tunnel_prl kprl, *kp;
228 struct ip_tunnel_prl_entry *prl; 229 struct ip_tunnel_prl_entry *prl;
229 unsigned int cmax, c = 0, ca, len; 230 unsigned int cmax, c = 0, ca, len;
230 int ret = 0; 231 int ret = 0;
231 232
232 cmax = a->datalen / sizeof(*a); 233 if (copy_from_user(&kprl, a, sizeof(kprl)))
233 if (cmax > 1 && a->addr != htonl(INADDR_ANY)) 234 return -EFAULT;
235 cmax = kprl.datalen / sizeof(kprl);
236 if (cmax > 1 && kprl.addr != htonl(INADDR_ANY))
234 cmax = 1; 237 cmax = 1;
235 238
236 /* For simple GET or for root users, 239 /* For simple GET or for root users,
@@ -261,26 +264,25 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
261 for (prl = t->prl; prl; prl = prl->next) { 264 for (prl = t->prl; prl; prl = prl->next) {
262 if (c > cmax) 265 if (c > cmax)
263 break; 266 break;
264 if (a->addr != htonl(INADDR_ANY) && prl->addr != a->addr) 267 if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
265 continue; 268 continue;
266 kp[c].addr = prl->addr; 269 kp[c].addr = prl->addr;
267 kp[c].flags = prl->flags; 270 kp[c].flags = prl->flags;
268 c++; 271 c++;
269 if (a->addr != htonl(INADDR_ANY)) 272 if (kprl.addr != htonl(INADDR_ANY))
270 break; 273 break;
271 } 274 }
272out: 275out:
273 read_unlock(&ipip6_lock); 276 read_unlock(&ipip6_lock);
274 277
275 len = sizeof(*kp) * c; 278 len = sizeof(*kp) * c;
276 ret = len ? copy_to_user(a->data, kp, len) : 0; 279 ret = 0;
280 if ((len && copy_to_user(a + 1, kp, len)) || put_user(len, &a->datalen))
281 ret = -EFAULT;
277 282
278 kfree(kp); 283 kfree(kp);
279 if (ret)
280 return -EFAULT;
281 284
282 a->datalen = len; 285 return ret;
283 return 0;
284} 286}
285 287
286static int 288static int
@@ -873,11 +875,20 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
873 break; 875 break;
874 876
875 case SIOCGETPRL: 877 case SIOCGETPRL:
878 err = -EINVAL;
879 if (dev == sitn->fb_tunnel_dev)
880 goto done;
881 err = -ENOENT;
882 if (!(t = netdev_priv(dev)))
883 goto done;
884 err = ipip6_tunnel_get_prl(t, ifr->ifr_ifru.ifru_data);
885 break;
886
876 case SIOCADDPRL: 887 case SIOCADDPRL:
877 case SIOCDELPRL: 888 case SIOCDELPRL:
878 case SIOCCHGPRL: 889 case SIOCCHGPRL:
879 err = -EPERM; 890 err = -EPERM;
880 if (cmd != SIOCGETPRL && !capable(CAP_NET_ADMIN)) 891 if (!capable(CAP_NET_ADMIN))
881 goto done; 892 goto done;
882 err = -EINVAL; 893 err = -EINVAL;
883 if (dev == sitn->fb_tunnel_dev) 894 if (dev == sitn->fb_tunnel_dev)
@@ -890,12 +901,6 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
890 goto done; 901 goto done;
891 902
892 switch (cmd) { 903 switch (cmd) {
893 case SIOCGETPRL:
894 err = ipip6_tunnel_get_prl(t, &prl);
895 if (!err && copy_to_user(ifr->ifr_ifru.ifru_data,
896 &prl, sizeof(prl)))
897 err = -EFAULT;
898 break;
899 case SIOCDELPRL: 904 case SIOCDELPRL:
900 err = ipip6_tunnel_del_prl(t, &prl); 905 err = ipip6_tunnel_del_prl(t, &prl);
901 break; 906 break;
@@ -904,8 +909,7 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
904 err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL); 909 err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
905 break; 910 break;
906 } 911 }
907 if (cmd != SIOCGETPRL) 912 netdev_state_change(dev);
908 netdev_state_change(dev);
909 break; 913 break;
910 914
911 default: 915 default:
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 938ce4ecde55..3ecc1157994e 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -198,7 +198,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
198 ireq = inet_rsk(req); 198 ireq = inet_rsk(req);
199 ireq6 = inet6_rsk(req); 199 ireq6 = inet6_rsk(req);
200 treq = tcp_rsk(req); 200 treq = tcp_rsk(req);
201 ireq6->pktopts = NULL;
202 201
203 if (security_inet_conn_request(sk, skb, req)) { 202 if (security_inet_conn_request(sk, skb, req)) {
204 reqsk_free(req); 203 reqsk_free(req);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 715965f0fac0..cb46749d4c32 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1299,7 +1299,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
1299 treq = inet6_rsk(req); 1299 treq = inet6_rsk(req);
1300 ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr); 1300 ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
1301 ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr); 1301 ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
1302 treq->pktopts = NULL;
1303 if (!want_cookie) 1302 if (!want_cookie)
1304 TCP_ECN_create_request(req, tcp_hdr(skb)); 1303 TCP_ECN_create_request(req, tcp_hdr(skb));
1305 1304
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 9bba7ac5fee0..7470e367272b 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3030,6 +3030,9 @@ static int key_notify_sa_expire(struct xfrm_state *x, struct km_event *c)
3030 3030
3031static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c) 3031static int pfkey_send_notify(struct xfrm_state *x, struct km_event *c)
3032{ 3032{
3033 if (atomic_read(&pfkey_socks_nr) == 0)
3034 return 0;
3035
3033 switch (c->event) { 3036 switch (c->event) {
3034 case XFRM_MSG_EXPIRE: 3037 case XFRM_MSG_EXPIRE:
3035 return key_notify_sa_expire(x, c); 3038 return key_notify_sa_expire(x, c);
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index c7314bf4bec2..006486b26726 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -899,7 +899,7 @@ extern const struct iw_handler_def ieee80211_iw_handler_def;
899 899
900 900
901/* ieee80211_ioctl.c */ 901/* ieee80211_ioctl.c */
902int ieee80211_set_freq(struct ieee80211_local *local, int freq); 902int ieee80211_set_freq(struct net_device *dev, int freq);
903/* ieee80211_sta.c */ 903/* ieee80211_sta.c */
904void ieee80211_sta_timer(unsigned long data); 904void ieee80211_sta_timer(unsigned long data);
905void ieee80211_sta_work(struct work_struct *work); 905void ieee80211_sta_work(struct work_struct *work);
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 5c876450b14c..98c0b5e56ecc 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -511,6 +511,7 @@ static int ieee80211_stop(struct net_device *dev)
511 case IEEE80211_IF_TYPE_STA: 511 case IEEE80211_IF_TYPE_STA:
512 case IEEE80211_IF_TYPE_IBSS: 512 case IEEE80211_IF_TYPE_IBSS:
513 sdata->u.sta.state = IEEE80211_DISABLED; 513 sdata->u.sta.state = IEEE80211_DISABLED;
514 memset(sdata->u.sta.bssid, 0, ETH_ALEN);
514 del_timer_sync(&sdata->u.sta.timer); 515 del_timer_sync(&sdata->u.sta.timer);
515 /* 516 /*
516 * When we get here, the interface is marked down. 517 * When we get here, the interface is marked down.
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 841278f1df8e..4d2b582dd055 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -44,7 +44,7 @@
44#define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ) 44#define IEEE80211_RETRY_AUTH_INTERVAL (1 * HZ)
45#define IEEE80211_SCAN_INTERVAL (2 * HZ) 45#define IEEE80211_SCAN_INTERVAL (2 * HZ)
46#define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ) 46#define IEEE80211_SCAN_INTERVAL_SLOW (15 * HZ)
47#define IEEE80211_IBSS_JOIN_TIMEOUT (20 * HZ) 47#define IEEE80211_IBSS_JOIN_TIMEOUT (7 * HZ)
48 48
49#define IEEE80211_PROBE_DELAY (HZ / 33) 49#define IEEE80211_PROBE_DELAY (HZ / 33)
50#define IEEE80211_CHANNEL_TIME (HZ / 33) 50#define IEEE80211_CHANNEL_TIME (HZ / 33)
@@ -2336,6 +2336,7 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
2336 u8 *pos; 2336 u8 *pos;
2337 struct ieee80211_sub_if_data *sdata; 2337 struct ieee80211_sub_if_data *sdata;
2338 struct ieee80211_supported_band *sband; 2338 struct ieee80211_supported_band *sband;
2339 union iwreq_data wrqu;
2339 2340
2340 sband = local->hw.wiphy->bands[local->hw.conf.channel->band]; 2341 sband = local->hw.wiphy->bands[local->hw.conf.channel->band];
2341 2342
@@ -2358,13 +2359,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
2358 sdata->drop_unencrypted = bss->capability & 2359 sdata->drop_unencrypted = bss->capability &
2359 WLAN_CAPABILITY_PRIVACY ? 1 : 0; 2360 WLAN_CAPABILITY_PRIVACY ? 1 : 0;
2360 2361
2361 res = ieee80211_set_freq(local, bss->freq); 2362 res = ieee80211_set_freq(dev, bss->freq);
2362 2363
2363 if (local->oper_channel->flags & IEEE80211_CHAN_NO_IBSS) { 2364 if (res)
2364 printk(KERN_DEBUG "%s: IBSS not allowed on frequency " 2365 return res;
2365 "%d MHz\n", dev->name, local->oper_channel->center_freq);
2366 return -1;
2367 }
2368 2366
2369 /* Set beacon template */ 2367 /* Set beacon template */
2370 skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400); 2368 skb = dev_alloc_skb(local->hw.extra_tx_headroom + 400);
@@ -2479,6 +2477,10 @@ static int ieee80211_sta_join_ibss(struct net_device *dev,
2479 ifsta->state = IEEE80211_IBSS_JOINED; 2477 ifsta->state = IEEE80211_IBSS_JOINED;
2480 mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL); 2478 mod_timer(&ifsta->timer, jiffies + IEEE80211_IBSS_MERGE_INTERVAL);
2481 2479
2480 memset(&wrqu, 0, sizeof(wrqu));
2481 memcpy(wrqu.ap_addr.sa_data, bss->bssid, ETH_ALEN);
2482 wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
2483
2482 return res; 2484 return res;
2483} 2485}
2484 2486
@@ -3486,7 +3488,7 @@ static int ieee80211_sta_config_auth(struct net_device *dev,
3486 spin_unlock_bh(&local->sta_bss_lock); 3488 spin_unlock_bh(&local->sta_bss_lock);
3487 3489
3488 if (selected) { 3490 if (selected) {
3489 ieee80211_set_freq(local, selected->freq); 3491 ieee80211_set_freq(dev, selected->freq);
3490 if (!(ifsta->flags & IEEE80211_STA_SSID_SET)) 3492 if (!(ifsta->flags & IEEE80211_STA_SSID_SET))
3491 ieee80211_sta_set_ssid(dev, selected->ssid, 3493 ieee80211_sta_set_ssid(dev, selected->ssid,
3492 selected->ssid_len); 3494 selected->ssid_len);
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 1d7dd54aacef..28d8bd53bd3a 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1562,13 +1562,13 @@ int ieee80211_subif_start_xmit(struct sk_buff *skb,
1562 * be cloned. This could happen, e.g., with Linux bridge code passing 1562 * be cloned. This could happen, e.g., with Linux bridge code passing
1563 * us broadcast frames. */ 1563 * us broadcast frames. */
1564 1564
1565 if (head_need > 0 || skb_header_cloned(skb)) { 1565 if (head_need > 0 || skb_cloned(skb)) {
1566#if 0 1566#if 0
1567 printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes " 1567 printk(KERN_DEBUG "%s: need to reallocate buffer for %d bytes "
1568 "of headroom\n", dev->name, head_need); 1568 "of headroom\n", dev->name, head_need);
1569#endif 1569#endif
1570 1570
1571 if (skb_header_cloned(skb)) 1571 if (skb_cloned(skb))
1572 I802_DEBUG_INC(local->tx_expand_skb_head_cloned); 1572 I802_DEBUG_INC(local->tx_expand_skb_head_cloned);
1573 else 1573 else
1574 I802_DEBUG_INC(local->tx_expand_skb_head); 1574 I802_DEBUG_INC(local->tx_expand_skb_head);
diff --git a/net/mac80211/wext.c b/net/mac80211/wext.c
index 8311bb24f9f3..6106cb79060c 100644
--- a/net/mac80211/wext.c
+++ b/net/mac80211/wext.c
@@ -290,14 +290,22 @@ static int ieee80211_ioctl_giwmode(struct net_device *dev,
290 return 0; 290 return 0;
291} 291}
292 292
293int ieee80211_set_freq(struct ieee80211_local *local, int freqMHz) 293int ieee80211_set_freq(struct net_device *dev, int freqMHz)
294{ 294{
295 int ret = -EINVAL; 295 int ret = -EINVAL;
296 struct ieee80211_channel *chan; 296 struct ieee80211_channel *chan;
297 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
298 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
297 299
298 chan = ieee80211_get_channel(local->hw.wiphy, freqMHz); 300 chan = ieee80211_get_channel(local->hw.wiphy, freqMHz);
299 301
300 if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) { 302 if (chan && !(chan->flags & IEEE80211_CHAN_DISABLED)) {
303 if (sdata->vif.type == IEEE80211_IF_TYPE_IBSS &&
304 chan->flags & IEEE80211_CHAN_NO_IBSS) {
305 printk(KERN_DEBUG "%s: IBSS not allowed on frequency "
306 "%d MHz\n", dev->name, chan->center_freq);
307 return ret;
308 }
301 local->oper_channel = chan; 309 local->oper_channel = chan;
302 310
303 if (local->sta_sw_scanning || local->sta_hw_scanning) 311 if (local->sta_sw_scanning || local->sta_hw_scanning)
@@ -315,7 +323,6 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
315 struct iw_request_info *info, 323 struct iw_request_info *info,
316 struct iw_freq *freq, char *extra) 324 struct iw_freq *freq, char *extra)
317{ 325{
318 struct ieee80211_local *local = wdev_priv(dev->ieee80211_ptr);
319 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev); 326 struct ieee80211_sub_if_data *sdata = IEEE80211_DEV_TO_SUB_IF(dev);
320 327
321 if (sdata->vif.type == IEEE80211_IF_TYPE_STA) 328 if (sdata->vif.type == IEEE80211_IF_TYPE_STA)
@@ -329,14 +336,14 @@ static int ieee80211_ioctl_siwfreq(struct net_device *dev,
329 IEEE80211_STA_AUTO_CHANNEL_SEL; 336 IEEE80211_STA_AUTO_CHANNEL_SEL;
330 return 0; 337 return 0;
331 } else 338 } else
332 return ieee80211_set_freq(local, 339 return ieee80211_set_freq(dev,
333 ieee80211_channel_to_frequency(freq->m)); 340 ieee80211_channel_to_frequency(freq->m));
334 } else { 341 } else {
335 int i, div = 1000000; 342 int i, div = 1000000;
336 for (i = 0; i < freq->e; i++) 343 for (i = 0; i < freq->e; i++)
337 div /= 10; 344 div /= 10;
338 if (div > 0) 345 if (div > 0)
339 return ieee80211_set_freq(local, freq->m / div); 346 return ieee80211_set_freq(dev, freq->m / div);
340 else 347 else
341 return -EINVAL; 348 return -EINVAL;
342 } 349 }
@@ -489,7 +496,8 @@ static int ieee80211_ioctl_giwap(struct net_device *dev,
489 sdata = IEEE80211_DEV_TO_SUB_IF(dev); 496 sdata = IEEE80211_DEV_TO_SUB_IF(dev);
490 if (sdata->vif.type == IEEE80211_IF_TYPE_STA || 497 if (sdata->vif.type == IEEE80211_IF_TYPE_STA ||
491 sdata->vif.type == IEEE80211_IF_TYPE_IBSS) { 498 sdata->vif.type == IEEE80211_IF_TYPE_IBSS) {
492 if (sdata->u.sta.state == IEEE80211_ASSOCIATED) { 499 if (sdata->u.sta.state == IEEE80211_ASSOCIATED ||
500 sdata->u.sta.state == IEEE80211_IBSS_JOINED) {
493 ap_addr->sa_family = ARPHRD_ETHER; 501 ap_addr->sa_family = ARPHRD_ETHER;
494 memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN); 502 memcpy(&ap_addr->sa_data, sdata->u.sta.bssid, ETH_ALEN);
495 return 0; 503 return 0;
diff --git a/net/mac80211/wme.c b/net/mac80211/wme.c
index dc1598b86004..635b996c8c35 100644
--- a/net/mac80211/wme.c
+++ b/net/mac80211/wme.c
@@ -673,7 +673,7 @@ int ieee80211_ht_agg_queue_add(struct ieee80211_local *local,
673#ifdef CONFIG_MAC80211_HT_DEBUG 673#ifdef CONFIG_MAC80211_HT_DEBUG
674 if (net_ratelimit()) 674 if (net_ratelimit())
675 printk(KERN_DEBUG "allocated aggregation queue" 675 printk(KERN_DEBUG "allocated aggregation queue"
676 " %d tid %d addr %s pool=0x%lX", 676 " %d tid %d addr %s pool=0x%lX\n",
677 i, tid, print_mac(mac, sta->addr), 677 i, tid, print_mac(mac, sta->addr),
678 q->qdisc_pool[0]); 678 q->qdisc_pool[0]);
679#endif /* CONFIG_MAC80211_HT_DEBUG */ 679#endif /* CONFIG_MAC80211_HT_DEBUG */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index c4b1799da5d7..662c1ccfee26 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -196,8 +196,6 @@ destroy_conntrack(struct nf_conntrack *nfct)
196 if (l4proto && l4proto->destroy) 196 if (l4proto && l4proto->destroy)
197 l4proto->destroy(ct); 197 l4proto->destroy(ct);
198 198
199 nf_ct_ext_destroy(ct);
200
201 rcu_read_unlock(); 199 rcu_read_unlock();
202 200
203 spin_lock_bh(&nf_conntrack_lock); 201 spin_lock_bh(&nf_conntrack_lock);
@@ -520,6 +518,7 @@ static void nf_conntrack_free_rcu(struct rcu_head *head)
520 518
521void nf_conntrack_free(struct nf_conn *ct) 519void nf_conntrack_free(struct nf_conn *ct)
522{ 520{
521 nf_ct_ext_destroy(ct);
523 call_rcu(&ct->rcu, nf_conntrack_free_rcu); 522 call_rcu(&ct->rcu, nf_conntrack_free_rcu);
524} 523}
525EXPORT_SYMBOL_GPL(nf_conntrack_free); 524EXPORT_SYMBOL_GPL(nf_conntrack_free);
diff --git a/net/netfilter/nf_conntrack_extend.c b/net/netfilter/nf_conntrack_extend.c
index bcc19fa4ed1e..8a3f8b34e466 100644
--- a/net/netfilter/nf_conntrack_extend.c
+++ b/net/netfilter/nf_conntrack_extend.c
@@ -59,12 +59,19 @@ nf_ct_ext_create(struct nf_ct_ext **ext, enum nf_ct_ext_id id, gfp_t gfp)
59 if (!*ext) 59 if (!*ext)
60 return NULL; 60 return NULL;
61 61
62 INIT_RCU_HEAD(&(*ext)->rcu);
62 (*ext)->offset[id] = off; 63 (*ext)->offset[id] = off;
63 (*ext)->len = len; 64 (*ext)->len = len;
64 65
65 return (void *)(*ext) + off; 66 return (void *)(*ext) + off;
66} 67}
67 68
69static void __nf_ct_ext_free_rcu(struct rcu_head *head)
70{
71 struct nf_ct_ext *ext = container_of(head, struct nf_ct_ext, rcu);
72 kfree(ext);
73}
74
68void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp) 75void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
69{ 76{
70 struct nf_ct_ext *new; 77 struct nf_ct_ext *new;
@@ -106,7 +113,7 @@ void *__nf_ct_ext_add(struct nf_conn *ct, enum nf_ct_ext_id id, gfp_t gfp)
106 (void *)ct->ext + ct->ext->offset[i]); 113 (void *)ct->ext + ct->ext->offset[i]);
107 rcu_read_unlock(); 114 rcu_read_unlock();
108 } 115 }
109 kfree(ct->ext); 116 call_rcu(&ct->ext->rcu, __nf_ct_ext_free_rcu);
110 ct->ext = new; 117 ct->ext = new;
111 } 118 }
112 119
diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c
index 95da1a24aab7..2f83c158934d 100644
--- a/net/netfilter/nf_conntrack_h323_main.c
+++ b/net/netfilter/nf_conntrack_h323_main.c
@@ -619,6 +619,7 @@ static const struct nf_conntrack_expect_policy h245_exp_policy = {
619static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = { 619static struct nf_conntrack_helper nf_conntrack_helper_h245 __read_mostly = {
620 .name = "H.245", 620 .name = "H.245",
621 .me = THIS_MODULE, 621 .me = THIS_MODULE,
622 .tuple.src.l3num = AF_UNSPEC,
622 .tuple.dst.protonum = IPPROTO_UDP, 623 .tuple.dst.protonum = IPPROTO_UDP,
623 .help = h245_help, 624 .help = h245_help,
624 .expect_policy = &h245_exp_policy, 625 .expect_policy = &h245_exp_policy,
@@ -1765,6 +1766,7 @@ static void __exit nf_conntrack_h323_fini(void)
1765 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]); 1766 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
1766 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]); 1767 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
1767 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]); 1768 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
1769 nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
1768 kfree(h323_buffer); 1770 kfree(h323_buffer);
1769 pr_debug("nf_ct_h323: fini\n"); 1771 pr_debug("nf_ct_h323: fini\n");
1770} 1772}
@@ -1777,28 +1779,34 @@ static int __init nf_conntrack_h323_init(void)
1777 h323_buffer = kmalloc(65536, GFP_KERNEL); 1779 h323_buffer = kmalloc(65536, GFP_KERNEL);
1778 if (!h323_buffer) 1780 if (!h323_buffer)
1779 return -ENOMEM; 1781 return -ENOMEM;
1780 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]); 1782 ret = nf_conntrack_helper_register(&nf_conntrack_helper_h245);
1781 if (ret < 0) 1783 if (ret < 0)
1782 goto err1; 1784 goto err1;
1783 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]); 1785 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[0]);
1784 if (ret < 0) 1786 if (ret < 0)
1785 goto err2; 1787 goto err2;
1786 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]); 1788 ret = nf_conntrack_helper_register(&nf_conntrack_helper_q931[1]);
1787 if (ret < 0) 1789 if (ret < 0)
1788 goto err3; 1790 goto err3;
1789 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]); 1791 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[0]);
1790 if (ret < 0) 1792 if (ret < 0)
1791 goto err4; 1793 goto err4;
1794 ret = nf_conntrack_helper_register(&nf_conntrack_helper_ras[1]);
1795 if (ret < 0)
1796 goto err5;
1792 pr_debug("nf_ct_h323: init success\n"); 1797 pr_debug("nf_ct_h323: init success\n");
1793 return 0; 1798 return 0;
1794 1799
1795err4: 1800err5:
1796 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]); 1801 nf_conntrack_helper_unregister(&nf_conntrack_helper_ras[0]);
1797err3: 1802err4:
1798 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]); 1803 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[1]);
1799err2: 1804err3:
1800 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]); 1805 nf_conntrack_helper_unregister(&nf_conntrack_helper_q931[0]);
1806err2:
1807 nf_conntrack_helper_unregister(&nf_conntrack_helper_h245);
1801err1: 1808err1:
1809 kfree(h323_buffer);
1802 return ret; 1810 return ret;
1803} 1811}
1804 1812
diff --git a/net/netfilter/nf_log.c b/net/netfilter/nf_log.c
index bc11d7092032..9fda6ee95a31 100644
--- a/net/netfilter/nf_log.c
+++ b/net/netfilter/nf_log.c
@@ -92,10 +92,6 @@ void nf_log_packet(int pf,
92 vsnprintf(prefix, sizeof(prefix), fmt, args); 92 vsnprintf(prefix, sizeof(prefix), fmt, args);
93 va_end(args); 93 va_end(args);
94 logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix); 94 logger->logfn(pf, hooknum, skb, in, out, loginfo, prefix);
95 } else if (net_ratelimit()) {
96 printk(KERN_WARNING "nf_log_packet: can\'t log since "
97 "no backend logging module loaded in! Please either "
98 "load one, or disable logging explicitly\n");
99 } 95 }
100 rcu_read_unlock(); 96 rcu_read_unlock();
101} 97}
diff --git a/net/netlink/genetlink.c b/net/netlink/genetlink.c
index f5aa23c3e886..3e1191cecaf0 100644
--- a/net/netlink/genetlink.c
+++ b/net/netlink/genetlink.c
@@ -444,8 +444,11 @@ static int genl_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
444 if (ops->dumpit == NULL) 444 if (ops->dumpit == NULL)
445 return -EOPNOTSUPP; 445 return -EOPNOTSUPP;
446 446
447 return netlink_dump_start(genl_sock, skb, nlh, 447 genl_unlock();
448 ops->dumpit, ops->done); 448 err = netlink_dump_start(genl_sock, skb, nlh,
449 ops->dumpit, ops->done);
450 genl_lock();
451 return err;
449 } 452 }
450 453
451 if (ops->doit == NULL) 454 if (ops->doit == NULL)
@@ -603,9 +606,6 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
603 int chains_to_skip = cb->args[0]; 606 int chains_to_skip = cb->args[0];
604 int fams_to_skip = cb->args[1]; 607 int fams_to_skip = cb->args[1];
605 608
606 if (chains_to_skip != 0)
607 genl_lock();
608
609 for (i = 0; i < GENL_FAM_TAB_SIZE; i++) { 609 for (i = 0; i < GENL_FAM_TAB_SIZE; i++) {
610 if (i < chains_to_skip) 610 if (i < chains_to_skip)
611 continue; 611 continue;
@@ -623,9 +623,6 @@ static int ctrl_dumpfamily(struct sk_buff *skb, struct netlink_callback *cb)
623 } 623 }
624 624
625errout: 625errout:
626 if (chains_to_skip != 0)
627 genl_unlock();
628
629 cb->args[0] = i; 626 cb->args[0] = i;
630 cb->args[1] = n; 627 cb->args[1] = n;
631 628
@@ -770,7 +767,7 @@ static int __init genl_init(void)
770 767
771 /* we'll bump the group number right afterwards */ 768 /* we'll bump the group number right afterwards */
772 genl_sock = netlink_kernel_create(&init_net, NETLINK_GENERIC, 0, 769 genl_sock = netlink_kernel_create(&init_net, NETLINK_GENERIC, 0,
773 genl_rcv, NULL, THIS_MODULE); 770 genl_rcv, &genl_mutex, THIS_MODULE);
774 if (genl_sock == NULL) 771 if (genl_sock == NULL)
775 panic("GENL: Cannot initialize generic netlink\n"); 772 panic("GENL: Cannot initialize generic netlink\n");
776 773
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 5bc1ed490180..6807c97985a5 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -28,6 +28,7 @@
28 * $Id: sch_htb.c,v 1.25 2003/12/07 11:08:25 devik Exp devik $ 28 * $Id: sch_htb.c,v 1.25 2003/12/07 11:08:25 devik Exp devik $
29 */ 29 */
30#include <linux/module.h> 30#include <linux/module.h>
31#include <linux/moduleparam.h>
31#include <linux/types.h> 32#include <linux/types.h>
32#include <linux/kernel.h> 33#include <linux/kernel.h>
33#include <linux/string.h> 34#include <linux/string.h>
@@ -53,13 +54,17 @@
53*/ 54*/
54 55
55#define HTB_HSIZE 16 /* classid hash size */ 56#define HTB_HSIZE 16 /* classid hash size */
56#define HTB_HYSTERESIS 1 /* whether to use mode hysteresis for speedup */ 57static int htb_hysteresis __read_mostly = 0; /* whether to use mode hysteresis for speedup */
57#define HTB_VER 0x30011 /* major must be matched with number suplied by TC as version */ 58#define HTB_VER 0x30011 /* major must be matched with number suplied by TC as version */
58 59
59#if HTB_VER >> 16 != TC_HTB_PROTOVER 60#if HTB_VER >> 16 != TC_HTB_PROTOVER
60#error "Mismatched sch_htb.c and pkt_sch.h" 61#error "Mismatched sch_htb.c and pkt_sch.h"
61#endif 62#endif
62 63
64/* Module parameter and sysfs export */
65module_param (htb_hysteresis, int, 0640);
66MODULE_PARM_DESC(htb_hysteresis, "Hysteresis mode, less CPU load, less accurate");
67
63/* used internaly to keep status of single class */ 68/* used internaly to keep status of single class */
64enum htb_cmode { 69enum htb_cmode {
65 HTB_CANT_SEND, /* class can't send and can't borrow */ 70 HTB_CANT_SEND, /* class can't send and can't borrow */
@@ -462,19 +467,21 @@ static void htb_deactivate_prios(struct htb_sched *q, struct htb_class *cl)
462 htb_remove_class_from_row(q, cl, mask); 467 htb_remove_class_from_row(q, cl, mask);
463} 468}
464 469
465#if HTB_HYSTERESIS
466static inline long htb_lowater(const struct htb_class *cl) 470static inline long htb_lowater(const struct htb_class *cl)
467{ 471{
468 return cl->cmode != HTB_CANT_SEND ? -cl->cbuffer : 0; 472 if (htb_hysteresis)
473 return cl->cmode != HTB_CANT_SEND ? -cl->cbuffer : 0;
474 else
475 return 0;
469} 476}
470static inline long htb_hiwater(const struct htb_class *cl) 477static inline long htb_hiwater(const struct htb_class *cl)
471{ 478{
472 return cl->cmode == HTB_CAN_SEND ? -cl->buffer : 0; 479 if (htb_hysteresis)
480 return cl->cmode == HTB_CAN_SEND ? -cl->buffer : 0;
481 else
482 return 0;
473} 483}
474#else 484
475#define htb_lowater(cl) (0)
476#define htb_hiwater(cl) (0)
477#endif
478 485
479/** 486/**
480 * htb_class_mode - computes and returns current class mode 487 * htb_class_mode - computes and returns current class mode
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index 532634861db1..024c3ebd9661 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -474,6 +474,15 @@ static void sctp_association_destroy(struct sctp_association *asoc)
474void sctp_assoc_set_primary(struct sctp_association *asoc, 474void sctp_assoc_set_primary(struct sctp_association *asoc,
475 struct sctp_transport *transport) 475 struct sctp_transport *transport)
476{ 476{
477 int changeover = 0;
478
479 /* it's a changeover only if we already have a primary path
480 * that we are changing
481 */
482 if (asoc->peer.primary_path != NULL &&
483 asoc->peer.primary_path != transport)
484 changeover = 1 ;
485
477 asoc->peer.primary_path = transport; 486 asoc->peer.primary_path = transport;
478 487
479 /* Set a default msg_name for events. */ 488 /* Set a default msg_name for events. */
@@ -499,12 +508,12 @@ void sctp_assoc_set_primary(struct sctp_association *asoc,
499 * double switch to the same destination address. 508 * double switch to the same destination address.
500 */ 509 */
501 if (transport->cacc.changeover_active) 510 if (transport->cacc.changeover_active)
502 transport->cacc.cycling_changeover = 1; 511 transport->cacc.cycling_changeover = changeover;
503 512
504 /* 2) The sender MUST set CHANGEOVER_ACTIVE to indicate that 513 /* 2) The sender MUST set CHANGEOVER_ACTIVE to indicate that
505 * a changeover has occurred. 514 * a changeover has occurred.
506 */ 515 */
507 transport->cacc.changeover_active = 1; 516 transport->cacc.changeover_active = changeover;
508 517
509 /* 3) The sender MUST store the next TSN to be sent in 518 /* 3) The sender MUST store the next TSN to be sent in
510 * next_tsn_at_change. 519 * next_tsn_at_change.
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index b435a193c5df..9258dfe784ae 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -108,14 +108,23 @@ static __init int sctp_proc_init(void)
108 } 108 }
109 109
110 if (sctp_snmp_proc_init()) 110 if (sctp_snmp_proc_init())
111 goto out_nomem; 111 goto out_snmp_proc_init;
112 if (sctp_eps_proc_init()) 112 if (sctp_eps_proc_init())
113 goto out_nomem; 113 goto out_eps_proc_init;
114 if (sctp_assocs_proc_init()) 114 if (sctp_assocs_proc_init())
115 goto out_nomem; 115 goto out_assocs_proc_init;
116 116
117 return 0; 117 return 0;
118 118
119out_assocs_proc_init:
120 sctp_eps_proc_exit();
121out_eps_proc_init:
122 sctp_snmp_proc_exit();
123out_snmp_proc_init:
124 if (proc_net_sctp) {
125 proc_net_sctp = NULL;
126 remove_proc_entry("sctp", init_net.proc_net);
127 }
119out_nomem: 128out_nomem:
120 return -ENOMEM; 129 return -ENOMEM;
121} 130}
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index e18cd3628db4..657835f227d3 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -169,6 +169,11 @@ static inline int unix_may_send(struct sock *sk, struct sock *osk)
169 return (unix_peer(osk) == NULL || unix_our_peer(sk, osk)); 169 return (unix_peer(osk) == NULL || unix_our_peer(sk, osk));
170} 170}
171 171
172static inline int unix_recvq_full(struct sock const *sk)
173{
174 return skb_queue_len(&sk->sk_receive_queue) > sk->sk_max_ack_backlog;
175}
176
172static struct sock *unix_peer_get(struct sock *s) 177static struct sock *unix_peer_get(struct sock *s)
173{ 178{
174 struct sock *peer; 179 struct sock *peer;
@@ -482,6 +487,8 @@ static int unix_socketpair(struct socket *, struct socket *);
482static int unix_accept(struct socket *, struct socket *, int); 487static int unix_accept(struct socket *, struct socket *, int);
483static int unix_getname(struct socket *, struct sockaddr *, int *, int); 488static int unix_getname(struct socket *, struct sockaddr *, int *, int);
484static unsigned int unix_poll(struct file *, struct socket *, poll_table *); 489static unsigned int unix_poll(struct file *, struct socket *, poll_table *);
490static unsigned int unix_datagram_poll(struct file *, struct socket *,
491 poll_table *);
485static int unix_ioctl(struct socket *, unsigned int, unsigned long); 492static int unix_ioctl(struct socket *, unsigned int, unsigned long);
486static int unix_shutdown(struct socket *, int); 493static int unix_shutdown(struct socket *, int);
487static int unix_stream_sendmsg(struct kiocb *, struct socket *, 494static int unix_stream_sendmsg(struct kiocb *, struct socket *,
@@ -527,7 +534,7 @@ static const struct proto_ops unix_dgram_ops = {
527 .socketpair = unix_socketpair, 534 .socketpair = unix_socketpair,
528 .accept = sock_no_accept, 535 .accept = sock_no_accept,
529 .getname = unix_getname, 536 .getname = unix_getname,
530 .poll = datagram_poll, 537 .poll = unix_datagram_poll,
531 .ioctl = unix_ioctl, 538 .ioctl = unix_ioctl,
532 .listen = sock_no_listen, 539 .listen = sock_no_listen,
533 .shutdown = unix_shutdown, 540 .shutdown = unix_shutdown,
@@ -548,7 +555,7 @@ static const struct proto_ops unix_seqpacket_ops = {
548 .socketpair = unix_socketpair, 555 .socketpair = unix_socketpair,
549 .accept = unix_accept, 556 .accept = unix_accept,
550 .getname = unix_getname, 557 .getname = unix_getname,
551 .poll = datagram_poll, 558 .poll = unix_datagram_poll,
552 .ioctl = unix_ioctl, 559 .ioctl = unix_ioctl,
553 .listen = unix_listen, 560 .listen = unix_listen,
554 .shutdown = unix_shutdown, 561 .shutdown = unix_shutdown,
@@ -983,8 +990,7 @@ static long unix_wait_for_peer(struct sock *other, long timeo)
983 990
984 sched = !sock_flag(other, SOCK_DEAD) && 991 sched = !sock_flag(other, SOCK_DEAD) &&
985 !(other->sk_shutdown & RCV_SHUTDOWN) && 992 !(other->sk_shutdown & RCV_SHUTDOWN) &&
986 (skb_queue_len(&other->sk_receive_queue) > 993 unix_recvq_full(other);
987 other->sk_max_ack_backlog);
988 994
989 unix_state_unlock(other); 995 unix_state_unlock(other);
990 996
@@ -1058,8 +1064,7 @@ restart:
1058 if (other->sk_state != TCP_LISTEN) 1064 if (other->sk_state != TCP_LISTEN)
1059 goto out_unlock; 1065 goto out_unlock;
1060 1066
1061 if (skb_queue_len(&other->sk_receive_queue) > 1067 if (unix_recvq_full(other)) {
1062 other->sk_max_ack_backlog) {
1063 err = -EAGAIN; 1068 err = -EAGAIN;
1064 if (!timeo) 1069 if (!timeo)
1065 goto out_unlock; 1070 goto out_unlock;
@@ -1428,9 +1433,7 @@ restart:
1428 goto out_unlock; 1433 goto out_unlock;
1429 } 1434 }
1430 1435
1431 if (unix_peer(other) != sk && 1436 if (unix_peer(other) != sk && unix_recvq_full(other)) {
1432 (skb_queue_len(&other->sk_receive_queue) >
1433 other->sk_max_ack_backlog)) {
1434 if (!timeo) { 1437 if (!timeo) {
1435 err = -EAGAIN; 1438 err = -EAGAIN;
1436 goto out_unlock; 1439 goto out_unlock;
@@ -1991,6 +1994,64 @@ static unsigned int unix_poll(struct file * file, struct socket *sock, poll_tabl
1991 return mask; 1994 return mask;
1992} 1995}
1993 1996
1997static unsigned int unix_datagram_poll(struct file *file, struct socket *sock,
1998 poll_table *wait)
1999{
2000 struct sock *sk = sock->sk, *peer;
2001 unsigned int mask;
2002
2003 poll_wait(file, sk->sk_sleep, wait);
2004
2005 peer = unix_peer_get(sk);
2006 if (peer) {
2007 if (peer != sk) {
2008 /*
2009 * Writability of a connected socket additionally
2010 * depends on the state of the receive queue of the
2011 * peer.
2012 */
2013 poll_wait(file, &unix_sk(peer)->peer_wait, wait);
2014 } else {
2015 sock_put(peer);
2016 peer = NULL;
2017 }
2018 }
2019
2020 mask = 0;
2021
2022 /* exceptional events? */
2023 if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
2024 mask |= POLLERR;
2025 if (sk->sk_shutdown & RCV_SHUTDOWN)
2026 mask |= POLLRDHUP;
2027 if (sk->sk_shutdown == SHUTDOWN_MASK)
2028 mask |= POLLHUP;
2029
2030 /* readable? */
2031 if (!skb_queue_empty(&sk->sk_receive_queue) ||
2032 (sk->sk_shutdown & RCV_SHUTDOWN))
2033 mask |= POLLIN | POLLRDNORM;
2034
2035 /* Connection-based need to check for termination and startup */
2036 if (sk->sk_type == SOCK_SEQPACKET) {
2037 if (sk->sk_state == TCP_CLOSE)
2038 mask |= POLLHUP;
2039 /* connection hasn't started yet? */
2040 if (sk->sk_state == TCP_SYN_SENT)
2041 return mask;
2042 }
2043
2044 /* writable? */
2045 if (unix_writable(sk) && !(peer && unix_recvq_full(peer)))
2046 mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
2047 else
2048 set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
2049
2050 if (peer)
2051 sock_put(peer);
2052
2053 return mask;
2054}
1994 2055
1995#ifdef CONFIG_PROC_FS 2056#ifdef CONFIG_PROC_FS
1996static struct sock *first_unix_socket(int *i) 2057static struct sock *first_unix_socket(int *i)
generated by cgit v1.2.2 (git 2.25.0) at 2025-08-24 17:48:05 -0400