Annotation of /trunk/kernel-lts/patches-3.10/0117-3.10.18-all-fixes.patch
Parent Directory | Revision Log
Revision 2395 -
(hide annotations)
(download)
Mon Feb 3 12:41:31 2014 UTC (10 years, 7 months ago) by niro
File size: 59864 byte(s)
Mon Feb 3 12:41:31 2014 UTC (10 years, 7 months ago) by niro
File size: 59864 byte(s)
-copied
1 | niro | 2345 | diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt |
2 | index 3458d6343e01..3994f0bbeeb6 100644 | ||
3 | --- a/Documentation/networking/ip-sysctl.txt | ||
4 | +++ b/Documentation/networking/ip-sysctl.txt | ||
5 | @@ -478,6 +478,15 @@ tcp_syn_retries - INTEGER | ||
6 | tcp_timestamps - BOOLEAN | ||
7 | Enable timestamps as defined in RFC1323. | ||
8 | |||
9 | +tcp_min_tso_segs - INTEGER | ||
10 | + Minimal number of segments per TSO frame. | ||
11 | + Since linux-3.12, TCP does an automatic sizing of TSO frames, | ||
12 | + depending on flow rate, instead of filling 64Kbytes packets. | ||
13 | + For specific usages, it's possible to force TCP to build big | ||
14 | + TSO frames. Note that TCP stack might split too big TSO packets | ||
15 | + if available window is too small. | ||
16 | + Default: 2 | ||
17 | + | ||
18 | tcp_tso_win_divisor - INTEGER | ||
19 | This allows control over what percentage of the congestion window | ||
20 | can be consumed by a single TSO frame. | ||
21 | diff --git a/Makefile b/Makefile | ||
22 | index 5c7d3d63d376..5fb14e503fe3 100644 | ||
23 | --- a/Makefile | ||
24 | +++ b/Makefile | ||
25 | @@ -1,6 +1,6 @@ | ||
26 | VERSION = 3 | ||
27 | PATCHLEVEL = 10 | ||
28 | -SUBLEVEL = 17 | ||
29 | +SUBLEVEL = 18 | ||
30 | EXTRAVERSION = | ||
31 | NAME = TOSSUG Baby Fish | ||
32 | |||
33 | diff --git a/arch/arm/boot/dts/integratorcp.dts b/arch/arm/boot/dts/integratorcp.dts | ||
34 | index ff1aea0ee043..72693a69f830 100644 | ||
35 | --- a/arch/arm/boot/dts/integratorcp.dts | ||
36 | +++ b/arch/arm/boot/dts/integratorcp.dts | ||
37 | @@ -9,11 +9,6 @@ | ||
38 | model = "ARM Integrator/CP"; | ||
39 | compatible = "arm,integrator-cp"; | ||
40 | |||
41 | - aliases { | ||
42 | - arm,timer-primary = &timer2; | ||
43 | - arm,timer-secondary = &timer1; | ||
44 | - }; | ||
45 | - | ||
46 | chosen { | ||
47 | bootargs = "root=/dev/ram0 console=ttyAMA0,38400n8 earlyprintk"; | ||
48 | }; | ||
49 | @@ -24,14 +19,18 @@ | ||
50 | }; | ||
51 | |||
52 | timer0: timer@13000000 { | ||
53 | + /* TIMER0 runs @ 25MHz */ | ||
54 | compatible = "arm,integrator-cp-timer"; | ||
55 | + status = "disabled"; | ||
56 | }; | ||
57 | |||
58 | timer1: timer@13000100 { | ||
59 | + /* TIMER1 runs @ 1MHz */ | ||
60 | compatible = "arm,integrator-cp-timer"; | ||
61 | }; | ||
62 | |||
63 | timer2: timer@13000200 { | ||
64 | + /* TIMER2 runs @ 1MHz */ | ||
65 | compatible = "arm,integrator-cp-timer"; | ||
66 | }; | ||
67 | |||
68 | diff --git a/arch/arm/include/asm/syscall.h b/arch/arm/include/asm/syscall.h | ||
69 | index f1d96d4e8092..73ddd7239b33 100644 | ||
70 | --- a/arch/arm/include/asm/syscall.h | ||
71 | +++ b/arch/arm/include/asm/syscall.h | ||
72 | @@ -57,6 +57,9 @@ static inline void syscall_get_arguments(struct task_struct *task, | ||
73 | unsigned int i, unsigned int n, | ||
74 | unsigned long *args) | ||
75 | { | ||
76 | + if (n == 0) | ||
77 | + return; | ||
78 | + | ||
79 | if (i + n > SYSCALL_MAX_ARGS) { | ||
80 | unsigned long *args_bad = args + SYSCALL_MAX_ARGS - i; | ||
81 | unsigned int n_bad = n + i - SYSCALL_MAX_ARGS; | ||
82 | @@ -81,6 +84,9 @@ static inline void syscall_set_arguments(struct task_struct *task, | ||
83 | unsigned int i, unsigned int n, | ||
84 | const unsigned long *args) | ||
85 | { | ||
86 | + if (n == 0) | ||
87 | + return; | ||
88 | + | ||
89 | if (i + n > SYSCALL_MAX_ARGS) { | ||
90 | pr_warning("%s called with max args %d, handling only %d\n", | ||
91 | __func__, i + n, SYSCALL_MAX_ARGS); | ||
92 | diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c | ||
93 | index 08ae128cce9b..c73fc2b74de2 100644 | ||
94 | --- a/drivers/connector/cn_proc.c | ||
95 | +++ b/drivers/connector/cn_proc.c | ||
96 | @@ -65,6 +65,7 @@ void proc_fork_connector(struct task_struct *task) | ||
97 | |||
98 | msg = (struct cn_msg *)buffer; | ||
99 | ev = (struct proc_event *)msg->data; | ||
100 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
101 | get_seq(&msg->seq, &ev->cpu); | ||
102 | ktime_get_ts(&ts); /* get high res monotonic timestamp */ | ||
103 | put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | ||
104 | @@ -80,6 +81,7 @@ void proc_fork_connector(struct task_struct *task) | ||
105 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
106 | msg->ack = 0; /* not used */ | ||
107 | msg->len = sizeof(*ev); | ||
108 | + msg->flags = 0; /* not used */ | ||
109 | /* If cn_netlink_send() failed, the data is not sent */ | ||
110 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
111 | } | ||
112 | @@ -96,6 +98,7 @@ void proc_exec_connector(struct task_struct *task) | ||
113 | |||
114 | msg = (struct cn_msg *)buffer; | ||
115 | ev = (struct proc_event *)msg->data; | ||
116 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
117 | get_seq(&msg->seq, &ev->cpu); | ||
118 | ktime_get_ts(&ts); /* get high res monotonic timestamp */ | ||
119 | put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | ||
120 | @@ -106,6 +109,7 @@ void proc_exec_connector(struct task_struct *task) | ||
121 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
122 | msg->ack = 0; /* not used */ | ||
123 | msg->len = sizeof(*ev); | ||
124 | + msg->flags = 0; /* not used */ | ||
125 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
126 | } | ||
127 | |||
128 | @@ -122,6 +126,7 @@ void proc_id_connector(struct task_struct *task, int which_id) | ||
129 | |||
130 | msg = (struct cn_msg *)buffer; | ||
131 | ev = (struct proc_event *)msg->data; | ||
132 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
133 | ev->what = which_id; | ||
134 | ev->event_data.id.process_pid = task->pid; | ||
135 | ev->event_data.id.process_tgid = task->tgid; | ||
136 | @@ -145,6 +150,7 @@ void proc_id_connector(struct task_struct *task, int which_id) | ||
137 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
138 | msg->ack = 0; /* not used */ | ||
139 | msg->len = sizeof(*ev); | ||
140 | + msg->flags = 0; /* not used */ | ||
141 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
142 | } | ||
143 | |||
144 | @@ -160,6 +166,7 @@ void proc_sid_connector(struct task_struct *task) | ||
145 | |||
146 | msg = (struct cn_msg *)buffer; | ||
147 | ev = (struct proc_event *)msg->data; | ||
148 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
149 | get_seq(&msg->seq, &ev->cpu); | ||
150 | ktime_get_ts(&ts); /* get high res monotonic timestamp */ | ||
151 | put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | ||
152 | @@ -170,6 +177,7 @@ void proc_sid_connector(struct task_struct *task) | ||
153 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
154 | msg->ack = 0; /* not used */ | ||
155 | msg->len = sizeof(*ev); | ||
156 | + msg->flags = 0; /* not used */ | ||
157 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
158 | } | ||
159 | |||
160 | @@ -185,6 +193,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id) | ||
161 | |||
162 | msg = (struct cn_msg *)buffer; | ||
163 | ev = (struct proc_event *)msg->data; | ||
164 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
165 | get_seq(&msg->seq, &ev->cpu); | ||
166 | ktime_get_ts(&ts); /* get high res monotonic timestamp */ | ||
167 | put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | ||
168 | @@ -203,6 +212,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id) | ||
169 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
170 | msg->ack = 0; /* not used */ | ||
171 | msg->len = sizeof(*ev); | ||
172 | + msg->flags = 0; /* not used */ | ||
173 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
174 | } | ||
175 | |||
176 | @@ -218,6 +228,7 @@ void proc_comm_connector(struct task_struct *task) | ||
177 | |||
178 | msg = (struct cn_msg *)buffer; | ||
179 | ev = (struct proc_event *)msg->data; | ||
180 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
181 | get_seq(&msg->seq, &ev->cpu); | ||
182 | ktime_get_ts(&ts); /* get high res monotonic timestamp */ | ||
183 | put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | ||
184 | @@ -229,6 +240,7 @@ void proc_comm_connector(struct task_struct *task) | ||
185 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
186 | msg->ack = 0; /* not used */ | ||
187 | msg->len = sizeof(*ev); | ||
188 | + msg->flags = 0; /* not used */ | ||
189 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
190 | } | ||
191 | |||
192 | @@ -244,6 +256,7 @@ void proc_coredump_connector(struct task_struct *task) | ||
193 | |||
194 | msg = (struct cn_msg *)buffer; | ||
195 | ev = (struct proc_event *)msg->data; | ||
196 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
197 | get_seq(&msg->seq, &ev->cpu); | ||
198 | ktime_get_ts(&ts); /* get high res monotonic timestamp */ | ||
199 | put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | ||
200 | @@ -254,6 +267,7 @@ void proc_coredump_connector(struct task_struct *task) | ||
201 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
202 | msg->ack = 0; /* not used */ | ||
203 | msg->len = sizeof(*ev); | ||
204 | + msg->flags = 0; /* not used */ | ||
205 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
206 | } | ||
207 | |||
208 | @@ -269,6 +283,7 @@ void proc_exit_connector(struct task_struct *task) | ||
209 | |||
210 | msg = (struct cn_msg *)buffer; | ||
211 | ev = (struct proc_event *)msg->data; | ||
212 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
213 | get_seq(&msg->seq, &ev->cpu); | ||
214 | ktime_get_ts(&ts); /* get high res monotonic timestamp */ | ||
215 | put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | ||
216 | @@ -281,6 +296,7 @@ void proc_exit_connector(struct task_struct *task) | ||
217 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
218 | msg->ack = 0; /* not used */ | ||
219 | msg->len = sizeof(*ev); | ||
220 | + msg->flags = 0; /* not used */ | ||
221 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
222 | } | ||
223 | |||
224 | @@ -304,6 +320,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack) | ||
225 | |||
226 | msg = (struct cn_msg *)buffer; | ||
227 | ev = (struct proc_event *)msg->data; | ||
228 | + memset(&ev->event_data, 0, sizeof(ev->event_data)); | ||
229 | msg->seq = rcvd_seq; | ||
230 | ktime_get_ts(&ts); /* get high res monotonic timestamp */ | ||
231 | put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns); | ||
232 | @@ -313,6 +330,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack) | ||
233 | memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id)); | ||
234 | msg->ack = rcvd_ack + 1; | ||
235 | msg->len = sizeof(*ev); | ||
236 | + msg->flags = 0; /* not used */ | ||
237 | cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL); | ||
238 | } | ||
239 | |||
240 | diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c | ||
241 | index 6ecfa758942c..0daa11e418b1 100644 | ||
242 | --- a/drivers/connector/connector.c | ||
243 | +++ b/drivers/connector/connector.c | ||
244 | @@ -157,17 +157,18 @@ static int cn_call_callback(struct sk_buff *skb) | ||
245 | static void cn_rx_skb(struct sk_buff *__skb) | ||
246 | { | ||
247 | struct nlmsghdr *nlh; | ||
248 | - int err; | ||
249 | struct sk_buff *skb; | ||
250 | + int len, err; | ||
251 | |||
252 | skb = skb_get(__skb); | ||
253 | |||
254 | if (skb->len >= NLMSG_HDRLEN) { | ||
255 | nlh = nlmsg_hdr(skb); | ||
256 | + len = nlmsg_len(nlh); | ||
257 | |||
258 | - if (nlh->nlmsg_len < sizeof(struct cn_msg) || | ||
259 | + if (len < (int)sizeof(struct cn_msg) || | ||
260 | skb->len < nlh->nlmsg_len || | ||
261 | - nlh->nlmsg_len > CONNECTOR_MAX_MSG_SIZE) { | ||
262 | + len > CONNECTOR_MAX_MSG_SIZE) { | ||
263 | kfree_skb(skb); | ||
264 | return; | ||
265 | } | ||
266 | diff --git a/drivers/gpio/gpio-lynxpoint.c b/drivers/gpio/gpio-lynxpoint.c | ||
267 | index 86c17de87692..71d86143aec5 100644 | ||
268 | --- a/drivers/gpio/gpio-lynxpoint.c | ||
269 | +++ b/drivers/gpio/gpio-lynxpoint.c | ||
270 | @@ -248,14 +248,15 @@ static void lp_gpio_irq_handler(unsigned irq, struct irq_desc *desc) | ||
271 | struct lp_gpio *lg = irq_data_get_irq_handler_data(data); | ||
272 | struct irq_chip *chip = irq_data_get_irq_chip(data); | ||
273 | u32 base, pin, mask; | ||
274 | - unsigned long reg, pending; | ||
275 | + unsigned long reg, ena, pending; | ||
276 | unsigned virq; | ||
277 | |||
278 | /* check from GPIO controller which pin triggered the interrupt */ | ||
279 | for (base = 0; base < lg->chip.ngpio; base += 32) { | ||
280 | reg = lp_gpio_reg(&lg->chip, base, LP_INT_STAT); | ||
281 | + ena = lp_gpio_reg(&lg->chip, base, LP_INT_ENABLE); | ||
282 | |||
283 | - while ((pending = inl(reg))) { | ||
284 | + while ((pending = (inl(reg) & inl(ena)))) { | ||
285 | pin = __ffs(pending); | ||
286 | mask = BIT(pin); | ||
287 | /* Clear before handling so we don't lose an edge */ | ||
288 | diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c | ||
289 | index cd82eb44e4c4..7c9f053556f2 100644 | ||
290 | --- a/drivers/i2c/busses/i2c-ismt.c | ||
291 | +++ b/drivers/i2c/busses/i2c-ismt.c | ||
292 | @@ -393,6 +393,9 @@ static int ismt_access(struct i2c_adapter *adap, u16 addr, | ||
293 | |||
294 | desc = &priv->hw[priv->head]; | ||
295 | |||
296 | + /* Initialize the DMA buffer */ | ||
297 | + memset(priv->dma_buffer, 0, sizeof(priv->dma_buffer)); | ||
298 | + | ||
299 | /* Initialize the descriptor */ | ||
300 | memset(desc, 0, sizeof(struct ismt_desc)); | ||
301 | desc->tgtaddr_rw = ISMT_DESC_ADDR_RW(addr, read_write); | ||
302 | diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c | ||
303 | index 4caa8e6d59d7..2d2b1b7588d7 100644 | ||
304 | --- a/drivers/md/dm-snap-persistent.c | ||
305 | +++ b/drivers/md/dm-snap-persistent.c | ||
306 | @@ -269,6 +269,14 @@ static chunk_t area_location(struct pstore *ps, chunk_t area) | ||
307 | return NUM_SNAPSHOT_HDR_CHUNKS + ((ps->exceptions_per_area + 1) * area); | ||
308 | } | ||
309 | |||
310 | +static void skip_metadata(struct pstore *ps) | ||
311 | +{ | ||
312 | + uint32_t stride = ps->exceptions_per_area + 1; | ||
313 | + chunk_t next_free = ps->next_free; | ||
314 | + if (sector_div(next_free, stride) == NUM_SNAPSHOT_HDR_CHUNKS) | ||
315 | + ps->next_free++; | ||
316 | +} | ||
317 | + | ||
318 | /* | ||
319 | * Read or write a metadata area. Remembering to skip the first | ||
320 | * chunk which holds the header. | ||
321 | @@ -502,6 +510,8 @@ static int read_exceptions(struct pstore *ps, | ||
322 | |||
323 | ps->current_area--; | ||
324 | |||
325 | + skip_metadata(ps); | ||
326 | + | ||
327 | return 0; | ||
328 | } | ||
329 | |||
330 | @@ -616,8 +626,6 @@ static int persistent_prepare_exception(struct dm_exception_store *store, | ||
331 | struct dm_exception *e) | ||
332 | { | ||
333 | struct pstore *ps = get_info(store); | ||
334 | - uint32_t stride; | ||
335 | - chunk_t next_free; | ||
336 | sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev); | ||
337 | |||
338 | /* Is there enough room ? */ | ||
339 | @@ -630,10 +638,8 @@ static int persistent_prepare_exception(struct dm_exception_store *store, | ||
340 | * Move onto the next free pending, making sure to take | ||
341 | * into account the location of the metadata chunks. | ||
342 | */ | ||
343 | - stride = (ps->exceptions_per_area + 1); | ||
344 | - next_free = ++ps->next_free; | ||
345 | - if (sector_div(next_free, stride) == 1) | ||
346 | - ps->next_free++; | ||
347 | + ps->next_free++; | ||
348 | + skip_metadata(ps); | ||
349 | |||
350 | atomic_inc(&ps->pending_count); | ||
351 | return 0; | ||
352 | diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c | ||
353 | index f9cba4123c66..1870c4731a57 100644 | ||
354 | --- a/drivers/net/can/dev.c | ||
355 | +++ b/drivers/net/can/dev.c | ||
356 | @@ -705,14 +705,14 @@ static size_t can_get_size(const struct net_device *dev) | ||
357 | size_t size; | ||
358 | |||
359 | size = nla_total_size(sizeof(u32)); /* IFLA_CAN_STATE */ | ||
360 | - size += sizeof(struct can_ctrlmode); /* IFLA_CAN_CTRLMODE */ | ||
361 | + size += nla_total_size(sizeof(struct can_ctrlmode)); /* IFLA_CAN_CTRLMODE */ | ||
362 | size += nla_total_size(sizeof(u32)); /* IFLA_CAN_RESTART_MS */ | ||
363 | - size += sizeof(struct can_bittiming); /* IFLA_CAN_BITTIMING */ | ||
364 | - size += sizeof(struct can_clock); /* IFLA_CAN_CLOCK */ | ||
365 | + size += nla_total_size(sizeof(struct can_bittiming)); /* IFLA_CAN_BITTIMING */ | ||
366 | + size += nla_total_size(sizeof(struct can_clock)); /* IFLA_CAN_CLOCK */ | ||
367 | if (priv->do_get_berr_counter) /* IFLA_CAN_BERR_COUNTER */ | ||
368 | - size += sizeof(struct can_berr_counter); | ||
369 | + size += nla_total_size(sizeof(struct can_berr_counter)); | ||
370 | if (priv->bittiming_const) /* IFLA_CAN_BITTIMING_CONST */ | ||
371 | - size += sizeof(struct can_bittiming_const); | ||
372 | + size += nla_total_size(sizeof(struct can_bittiming_const)); | ||
373 | |||
374 | return size; | ||
375 | } | ||
376 | diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | ||
377 | index 638e55435b04..8c4babc0efbd 100644 | ||
378 | --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | ||
379 | +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c | ||
380 | @@ -670,6 +670,7 @@ static void bnx2x_gro_receive(struct bnx2x *bp, struct bnx2x_fastpath *fp, | ||
381 | } | ||
382 | } | ||
383 | #endif | ||
384 | + skb_record_rx_queue(skb, fp->rx_queue); | ||
385 | napi_gro_receive(&fp->napi, skb); | ||
386 | } | ||
387 | |||
388 | diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c | ||
389 | index 1db2df61b8af..696674edbdc4 100644 | ||
390 | --- a/drivers/net/ethernet/emulex/benet/be_cmds.c | ||
391 | +++ b/drivers/net/ethernet/emulex/benet/be_cmds.c | ||
392 | @@ -1150,7 +1150,6 @@ int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo) | ||
393 | |||
394 | if (lancer_chip(adapter)) { | ||
395 | req->hdr.version = 1; | ||
396 | - req->if_id = cpu_to_le16(adapter->if_handle); | ||
397 | } else if (BEx_chip(adapter)) { | ||
398 | if (adapter->function_caps & BE_FUNCTION_CAPS_SUPER_NIC) | ||
399 | req->hdr.version = 2; | ||
400 | @@ -1158,6 +1157,8 @@ int be_cmd_txq_create(struct be_adapter *adapter, struct be_tx_obj *txo) | ||
401 | req->hdr.version = 2; | ||
402 | } | ||
403 | |||
404 | + if (req->hdr.version > 0) | ||
405 | + req->if_id = cpu_to_le16(adapter->if_handle); | ||
406 | req->num_pages = PAGES_4K_SPANNED(q_mem->va, q_mem->size); | ||
407 | req->ulp_num = BE_ULP1_NUM; | ||
408 | req->type = BE_ETH_TX_RING_TYPE_STANDARD; | ||
409 | diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c | ||
410 | index d1cbfb12c1ca..4be11ff516a0 100644 | ||
411 | --- a/drivers/net/ethernet/marvell/mv643xx_eth.c | ||
412 | +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c | ||
413 | @@ -1125,15 +1125,13 @@ static void mib_counters_update(struct mv643xx_eth_private *mp) | ||
414 | p->rx_discard += rdlp(mp, RX_DISCARD_FRAME_CNT); | ||
415 | p->rx_overrun += rdlp(mp, RX_OVERRUN_FRAME_CNT); | ||
416 | spin_unlock_bh(&mp->mib_counters_lock); | ||
417 | - | ||
418 | - mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ); | ||
419 | } | ||
420 | |||
421 | static void mib_counters_timer_wrapper(unsigned long _mp) | ||
422 | { | ||
423 | struct mv643xx_eth_private *mp = (void *)_mp; | ||
424 | - | ||
425 | mib_counters_update(mp); | ||
426 | + mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ); | ||
427 | } | ||
428 | |||
429 | |||
430 | @@ -2231,6 +2229,7 @@ static int mv643xx_eth_open(struct net_device *dev) | ||
431 | mp->int_mask |= INT_TX_END_0 << i; | ||
432 | } | ||
433 | |||
434 | + add_timer(&mp->mib_counters_timer); | ||
435 | port_start(mp); | ||
436 | |||
437 | wrlp(mp, INT_MASK_EXT, INT_EXT_LINK_PHY | INT_EXT_TX); | ||
438 | @@ -2739,7 +2738,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev) | ||
439 | mp->mib_counters_timer.data = (unsigned long)mp; | ||
440 | mp->mib_counters_timer.function = mib_counters_timer_wrapper; | ||
441 | mp->mib_counters_timer.expires = jiffies + 30 * HZ; | ||
442 | - add_timer(&mp->mib_counters_timer); | ||
443 | |||
444 | spin_lock_init(&mp->mib_counters_lock); | ||
445 | |||
446 | diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c | ||
447 | index 860e15ddfbcb..7233610164cd 100644 | ||
448 | --- a/drivers/net/ethernet/ti/davinci_emac.c | ||
449 | +++ b/drivers/net/ethernet/ti/davinci_emac.c | ||
450 | @@ -876,8 +876,7 @@ static void emac_dev_mcast_set(struct net_device *ndev) | ||
451 | netdev_mc_count(ndev) > EMAC_DEF_MAX_MULTICAST_ADDRESSES) { | ||
452 | mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST); | ||
453 | emac_add_mcast(priv, EMAC_ALL_MULTI_SET, NULL); | ||
454 | - } | ||
455 | - if (!netdev_mc_empty(ndev)) { | ||
456 | + } else if (!netdev_mc_empty(ndev)) { | ||
457 | struct netdev_hw_addr *ha; | ||
458 | |||
459 | mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST); | ||
460 | diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c | ||
461 | index 42d670a468f8..1d01534c2020 100644 | ||
462 | --- a/drivers/net/virtio_net.c | ||
463 | +++ b/drivers/net/virtio_net.c | ||
464 | @@ -902,7 +902,6 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs) | ||
465 | struct scatterlist sg; | ||
466 | struct virtio_net_ctrl_mq s; | ||
467 | struct net_device *dev = vi->dev; | ||
468 | - int i; | ||
469 | |||
470 | if (!vi->has_cvq || !virtio_has_feature(vi->vdev, VIRTIO_NET_F_MQ)) | ||
471 | return 0; | ||
472 | @@ -916,10 +915,10 @@ static int virtnet_set_queues(struct virtnet_info *vi, u16 queue_pairs) | ||
473 | queue_pairs); | ||
474 | return -EINVAL; | ||
475 | } else { | ||
476 | - for (i = vi->curr_queue_pairs; i < queue_pairs; i++) | ||
477 | - if (!try_fill_recv(&vi->rq[i], GFP_KERNEL)) | ||
478 | - schedule_delayed_work(&vi->refill, 0); | ||
479 | vi->curr_queue_pairs = queue_pairs; | ||
480 | + /* virtnet_open() will refill when device is going to up. */ | ||
481 | + if (dev->flags & IFF_UP) | ||
482 | + schedule_delayed_work(&vi->refill, 0); | ||
483 | } | ||
484 | |||
485 | return 0; | ||
486 | @@ -1097,6 +1096,11 @@ static int virtnet_cpu_callback(struct notifier_block *nfb, | ||
487 | { | ||
488 | struct virtnet_info *vi = container_of(nfb, struct virtnet_info, nb); | ||
489 | |||
490 | + mutex_lock(&vi->config_lock); | ||
491 | + | ||
492 | + if (!vi->config_enable) | ||
493 | + goto done; | ||
494 | + | ||
495 | switch(action & ~CPU_TASKS_FROZEN) { | ||
496 | case CPU_ONLINE: | ||
497 | case CPU_DOWN_FAILED: | ||
498 | @@ -1109,6 +1113,9 @@ static int virtnet_cpu_callback(struct notifier_block *nfb, | ||
499 | default: | ||
500 | break; | ||
501 | } | ||
502 | + | ||
503 | +done: | ||
504 | + mutex_unlock(&vi->config_lock); | ||
505 | return NOTIFY_OK; | ||
506 | } | ||
507 | |||
508 | @@ -1709,7 +1716,9 @@ static int virtnet_restore(struct virtio_device *vdev) | ||
509 | vi->config_enable = true; | ||
510 | mutex_unlock(&vi->config_lock); | ||
511 | |||
512 | + rtnl_lock(); | ||
513 | virtnet_set_queues(vi, vi->curr_queue_pairs); | ||
514 | + rtnl_unlock(); | ||
515 | |||
516 | return 0; | ||
517 | } | ||
518 | diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c | ||
519 | index 3f0c4f268751..bcfff0d62de4 100644 | ||
520 | --- a/drivers/net/wan/farsync.c | ||
521 | +++ b/drivers/net/wan/farsync.c | ||
522 | @@ -1972,6 +1972,7 @@ fst_get_iface(struct fst_card_info *card, struct fst_port_info *port, | ||
523 | } | ||
524 | |||
525 | i = port->index; | ||
526 | + memset(&sync, 0, sizeof(sync)); | ||
527 | sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed); | ||
528 | /* Lucky card and linux use same encoding here */ | ||
529 | sync.clock_type = FST_RDB(card, portConfig[i].internalClock) == | ||
530 | diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c | ||
531 | index 6a24a5a70cc7..4c0a69779b89 100644 | ||
532 | --- a/drivers/net/wan/wanxl.c | ||
533 | +++ b/drivers/net/wan/wanxl.c | ||
534 | @@ -355,6 +355,7 @@ static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) | ||
535 | ifr->ifr_settings.size = size; /* data size wanted */ | ||
536 | return -ENOBUFS; | ||
537 | } | ||
538 | + memset(&line, 0, sizeof(line)); | ||
539 | line.clock_type = get_status(port)->clocking; | ||
540 | line.clock_rate = 0; | ||
541 | line.loopback = 0; | ||
542 | diff --git a/drivers/net/xen-netback/common.h b/drivers/net/xen-netback/common.h | ||
543 | index 9d7f1723dd8f..1a285083d24a 100644 | ||
544 | --- a/drivers/net/xen-netback/common.h | ||
545 | +++ b/drivers/net/xen-netback/common.h | ||
546 | @@ -115,6 +115,7 @@ struct xenvif *xenvif_alloc(struct device *parent, | ||
547 | int xenvif_connect(struct xenvif *vif, unsigned long tx_ring_ref, | ||
548 | unsigned long rx_ring_ref, unsigned int evtchn); | ||
549 | void xenvif_disconnect(struct xenvif *vif); | ||
550 | +void xenvif_free(struct xenvif *vif); | ||
551 | |||
552 | void xenvif_get(struct xenvif *vif); | ||
553 | void xenvif_put(struct xenvif *vif); | ||
554 | diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c | ||
555 | index d98414168485..3a294c2528d5 100644 | ||
556 | --- a/drivers/net/xen-netback/interface.c | ||
557 | +++ b/drivers/net/xen-netback/interface.c | ||
558 | @@ -304,6 +304,9 @@ struct xenvif *xenvif_alloc(struct device *parent, domid_t domid, | ||
559 | } | ||
560 | |||
561 | netdev_dbg(dev, "Successfully created xenvif\n"); | ||
562 | + | ||
563 | + __module_get(THIS_MODULE); | ||
564 | + | ||
565 | return vif; | ||
566 | } | ||
567 | |||
568 | @@ -369,9 +372,14 @@ void xenvif_disconnect(struct xenvif *vif) | ||
569 | if (vif->irq) | ||
570 | unbind_from_irqhandler(vif->irq, vif); | ||
571 | |||
572 | - unregister_netdev(vif->dev); | ||
573 | - | ||
574 | xen_netbk_unmap_frontend_rings(vif); | ||
575 | +} | ||
576 | + | ||
577 | +void xenvif_free(struct xenvif *vif) | ||
578 | +{ | ||
579 | + unregister_netdev(vif->dev); | ||
580 | |||
581 | free_netdev(vif->dev); | ||
582 | + | ||
583 | + module_put(THIS_MODULE); | ||
584 | } | ||
585 | diff --git a/drivers/net/xen-netback/xenbus.c b/drivers/net/xen-netback/xenbus.c | ||
586 | index 410018c4c528..abe24ff000f0 100644 | ||
587 | --- a/drivers/net/xen-netback/xenbus.c | ||
588 | +++ b/drivers/net/xen-netback/xenbus.c | ||
589 | @@ -42,7 +42,7 @@ static int netback_remove(struct xenbus_device *dev) | ||
590 | if (be->vif) { | ||
591 | kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE); | ||
592 | xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status"); | ||
593 | - xenvif_disconnect(be->vif); | ||
594 | + xenvif_free(be->vif); | ||
595 | be->vif = NULL; | ||
596 | } | ||
597 | kfree(be); | ||
598 | @@ -203,9 +203,18 @@ static void disconnect_backend(struct xenbus_device *dev) | ||
599 | { | ||
600 | struct backend_info *be = dev_get_drvdata(&dev->dev); | ||
601 | |||
602 | + if (be->vif) | ||
603 | + xenvif_disconnect(be->vif); | ||
604 | +} | ||
605 | + | ||
606 | +static void destroy_backend(struct xenbus_device *dev) | ||
607 | +{ | ||
608 | + struct backend_info *be = dev_get_drvdata(&dev->dev); | ||
609 | + | ||
610 | if (be->vif) { | ||
611 | + kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE); | ||
612 | xenbus_rm(XBT_NIL, dev->nodename, "hotplug-status"); | ||
613 | - xenvif_disconnect(be->vif); | ||
614 | + xenvif_free(be->vif); | ||
615 | be->vif = NULL; | ||
616 | } | ||
617 | } | ||
618 | @@ -237,14 +246,11 @@ static void frontend_changed(struct xenbus_device *dev, | ||
619 | case XenbusStateConnected: | ||
620 | if (dev->state == XenbusStateConnected) | ||
621 | break; | ||
622 | - backend_create_xenvif(be); | ||
623 | if (be->vif) | ||
624 | connect(be); | ||
625 | break; | ||
626 | |||
627 | case XenbusStateClosing: | ||
628 | - if (be->vif) | ||
629 | - kobject_uevent(&dev->dev.kobj, KOBJ_OFFLINE); | ||
630 | disconnect_backend(dev); | ||
631 | xenbus_switch_state(dev, XenbusStateClosing); | ||
632 | break; | ||
633 | @@ -253,6 +259,7 @@ static void frontend_changed(struct xenbus_device *dev, | ||
634 | xenbus_switch_state(dev, XenbusStateClosed); | ||
635 | if (xenbus_dev_is_online(dev)) | ||
636 | break; | ||
637 | + destroy_backend(dev); | ||
638 | /* fall through if not online */ | ||
639 | case XenbusStateUnknown: | ||
640 | device_unregister(&dev->dev); | ||
641 | diff --git a/drivers/tty/serial/vt8500_serial.c b/drivers/tty/serial/vt8500_serial.c | ||
642 | index 1a8bc2275ea4..f72b43fbbef9 100644 | ||
643 | --- a/drivers/tty/serial/vt8500_serial.c | ||
644 | +++ b/drivers/tty/serial/vt8500_serial.c | ||
645 | @@ -559,12 +559,13 @@ static int vt8500_serial_probe(struct platform_device *pdev) | ||
646 | if (!mmres || !irqres) | ||
647 | return -ENODEV; | ||
648 | |||
649 | - if (np) | ||
650 | + if (np) { | ||
651 | port = of_alias_get_id(np, "serial"); | ||
652 | if (port >= VT8500_MAX_PORTS) | ||
653 | port = -1; | ||
654 | - else | ||
655 | + } else { | ||
656 | port = -1; | ||
657 | + } | ||
658 | |||
659 | if (port < 0) { | ||
660 | /* calculate the port id */ | ||
661 | diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c | ||
662 | index 80a7104d5ddb..f1507c052a2e 100644 | ||
663 | --- a/drivers/usb/serial/option.c | ||
664 | +++ b/drivers/usb/serial/option.c | ||
665 | @@ -451,6 +451,10 @@ static void option_instat_callback(struct urb *urb); | ||
666 | #define CHANGHONG_VENDOR_ID 0x2077 | ||
667 | #define CHANGHONG_PRODUCT_CH690 0x7001 | ||
668 | |||
669 | +/* Inovia */ | ||
670 | +#define INOVIA_VENDOR_ID 0x20a6 | ||
671 | +#define INOVIA_SEW858 0x1105 | ||
672 | + | ||
673 | /* some devices interfaces need special handling due to a number of reasons */ | ||
674 | enum option_blacklist_reason { | ||
675 | OPTION_BLACKLIST_NONE = 0, | ||
676 | @@ -1257,7 +1261,9 @@ static const struct usb_device_id option_ids[] = { | ||
677 | |||
678 | { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) }, | ||
679 | { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) }, | ||
680 | - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) }, | ||
681 | + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200), | ||
682 | + .driver_info = (kernel_ulong_t)&net_intf6_blacklist | ||
683 | + }, | ||
684 | { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */ | ||
685 | { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/ | ||
686 | { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) }, | ||
687 | @@ -1345,6 +1351,7 @@ static const struct usb_device_id option_ids[] = { | ||
688 | { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) }, | ||
689 | { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */ | ||
690 | { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */ | ||
691 | + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, | ||
692 | { } /* Terminating entry */ | ||
693 | }; | ||
694 | MODULE_DEVICE_TABLE(usb, option_ids); | ||
695 | diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c | ||
696 | index 32bdd5eac59b..4cc84c0c990d 100644 | ||
697 | --- a/drivers/usb/serial/ti_usb_3410_5052.c | ||
698 | +++ b/drivers/usb/serial/ti_usb_3410_5052.c | ||
699 | @@ -203,6 +203,7 @@ static struct usb_device_id ti_id_table_combined[19+2*TI_EXTRA_VID_PID_COUNT+1] | ||
700 | { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) }, | ||
701 | { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) }, | ||
702 | { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) }, | ||
703 | + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) }, | ||
704 | { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) }, | ||
705 | { } | ||
706 | }; | ||
707 | diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h | ||
708 | index dec1748cd002..eaf602781635 100644 | ||
709 | --- a/include/linux/skbuff.h | ||
710 | +++ b/include/linux/skbuff.h | ||
711 | @@ -1308,6 +1308,11 @@ static inline int skb_pagelen(const struct sk_buff *skb) | ||
712 | return len + skb_headlen(skb); | ||
713 | } | ||
714 | |||
715 | +static inline bool skb_has_frags(const struct sk_buff *skb) | ||
716 | +{ | ||
717 | + return skb_shinfo(skb)->nr_frags; | ||
718 | +} | ||
719 | + | ||
720 | /** | ||
721 | * __skb_fill_page_desc - initialise a paged fragment in an skb | ||
722 | * @skb: buffer containing fragment to be initialised | ||
723 | diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h | ||
724 | index a7a683e30b64..a8c2ef6d3b93 100644 | ||
725 | --- a/include/net/cipso_ipv4.h | ||
726 | +++ b/include/net/cipso_ipv4.h | ||
727 | @@ -290,6 +290,7 @@ static inline int cipso_v4_validate(const struct sk_buff *skb, | ||
728 | unsigned char err_offset = 0; | ||
729 | u8 opt_len = opt[1]; | ||
730 | u8 opt_iter; | ||
731 | + u8 tag_len; | ||
732 | |||
733 | if (opt_len < 8) { | ||
734 | err_offset = 1; | ||
735 | @@ -302,11 +303,12 @@ static inline int cipso_v4_validate(const struct sk_buff *skb, | ||
736 | } | ||
737 | |||
738 | for (opt_iter = 6; opt_iter < opt_len;) { | ||
739 | - if (opt[opt_iter + 1] > (opt_len - opt_iter)) { | ||
740 | + tag_len = opt[opt_iter + 1]; | ||
741 | + if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) { | ||
742 | err_offset = opt_iter + 1; | ||
743 | goto out; | ||
744 | } | ||
745 | - opt_iter += opt[opt_iter + 1]; | ||
746 | + opt_iter += tag_len; | ||
747 | } | ||
748 | |||
749 | out: | ||
750 | diff --git a/include/net/dst.h b/include/net/dst.h | ||
751 | index 1f8fd109e225..e0c97f5a57cf 100644 | ||
752 | --- a/include/net/dst.h | ||
753 | +++ b/include/net/dst.h | ||
754 | @@ -477,10 +477,22 @@ static inline struct dst_entry *xfrm_lookup(struct net *net, | ||
755 | { | ||
756 | return dst_orig; | ||
757 | } | ||
758 | + | ||
759 | +static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst) | ||
760 | +{ | ||
761 | + return NULL; | ||
762 | +} | ||
763 | + | ||
764 | #else | ||
765 | extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig, | ||
766 | const struct flowi *fl, struct sock *sk, | ||
767 | int flags); | ||
768 | + | ||
769 | +/* skb attached with this dst needs transformation if dst->xfrm is valid */ | ||
770 | +static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst) | ||
771 | +{ | ||
772 | + return dst->xfrm; | ||
773 | +} | ||
774 | #endif | ||
775 | |||
776 | #endif /* _NET_DST_H */ | ||
777 | diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h | ||
778 | index 260f83f16bcf..b906f4a131a4 100644 | ||
779 | --- a/include/net/ip6_route.h | ||
780 | +++ b/include/net/ip6_route.h | ||
781 | @@ -194,11 +194,9 @@ static inline int ip6_skb_dst_mtu(struct sk_buff *skb) | ||
782 | skb_dst(skb)->dev->mtu : dst_mtu(skb_dst(skb)); | ||
783 | } | ||
784 | |||
785 | -static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt, struct in6_addr *dest) | ||
786 | +static inline struct in6_addr *rt6_nexthop(struct rt6_info *rt) | ||
787 | { | ||
788 | - if (rt->rt6i_flags & RTF_GATEWAY) | ||
789 | - return &rt->rt6i_gateway; | ||
790 | - return dest; | ||
791 | + return &rt->rt6i_gateway; | ||
792 | } | ||
793 | |||
794 | #endif | ||
795 | diff --git a/include/net/sock.h b/include/net/sock.h | ||
796 | index 66772cf8c3c5..cec4c723db9a 100644 | ||
797 | --- a/include/net/sock.h | ||
798 | +++ b/include/net/sock.h | ||
799 | @@ -230,6 +230,7 @@ struct cg_proto; | ||
800 | * @sk_wmem_queued: persistent queue size | ||
801 | * @sk_forward_alloc: space allocated forward | ||
802 | * @sk_allocation: allocation mode | ||
803 | + * @sk_pacing_rate: Pacing rate (if supported by transport/packet scheduler) | ||
804 | * @sk_sndbuf: size of send buffer in bytes | ||
805 | * @sk_flags: %SO_LINGER (l_onoff), %SO_BROADCAST, %SO_KEEPALIVE, | ||
806 | * %SO_OOBINLINE settings, %SO_TIMESTAMPING settings | ||
807 | @@ -355,6 +356,7 @@ struct sock { | ||
808 | kmemcheck_bitfield_end(flags); | ||
809 | int sk_wmem_queued; | ||
810 | gfp_t sk_allocation; | ||
811 | + u32 sk_pacing_rate; /* bytes per second */ | ||
812 | netdev_features_t sk_route_caps; | ||
813 | netdev_features_t sk_route_nocaps; | ||
814 | int sk_gso_type; | ||
815 | diff --git a/include/net/tcp.h b/include/net/tcp.h | ||
816 | index 5bba80fbd1d9..3fc77e90624a 100644 | ||
817 | --- a/include/net/tcp.h | ||
818 | +++ b/include/net/tcp.h | ||
819 | @@ -287,6 +287,7 @@ extern int sysctl_tcp_thin_dupack; | ||
820 | extern int sysctl_tcp_early_retrans; | ||
821 | extern int sysctl_tcp_limit_output_bytes; | ||
822 | extern int sysctl_tcp_challenge_ack_limit; | ||
823 | +extern int sysctl_tcp_min_tso_segs; | ||
824 | |||
825 | extern atomic_long_t tcp_memory_allocated; | ||
826 | extern struct percpu_counter tcp_sockets_allocated; | ||
827 | diff --git a/mm/huge_memory.c b/mm/huge_memory.c | ||
828 | index b92d0ce428b1..0164b09c1e99 100644 | ||
829 | --- a/mm/huge_memory.c | ||
830 | +++ b/mm/huge_memory.c | ||
831 | @@ -2699,6 +2699,7 @@ void __split_huge_page_pmd(struct vm_area_struct *vma, unsigned long address, | ||
832 | |||
833 | mmun_start = haddr; | ||
834 | mmun_end = haddr + HPAGE_PMD_SIZE; | ||
835 | +again: | ||
836 | mmu_notifier_invalidate_range_start(mm, mmun_start, mmun_end); | ||
837 | spin_lock(&mm->page_table_lock); | ||
838 | if (unlikely(!pmd_trans_huge(*pmd))) { | ||
839 | @@ -2721,7 +2722,14 @@ void __split_huge_page_pmd(struct vm_area_struct *vma, unsigned long address, | ||
840 | split_huge_page(page); | ||
841 | |||
842 | put_page(page); | ||
843 | - BUG_ON(pmd_trans_huge(*pmd)); | ||
844 | + | ||
845 | + /* | ||
846 | + * We don't always have down_write of mmap_sem here: a racing | ||
847 | + * do_huge_pmd_wp_page() might have copied-on-write to another | ||
848 | + * huge page before our split_huge_page() got the anon_vma lock. | ||
849 | + */ | ||
850 | + if (unlikely(pmd_trans_huge(*pmd))) | ||
851 | + goto again; | ||
852 | } | ||
853 | |||
854 | void split_huge_page_pmd_mm(struct mm_struct *mm, unsigned long address, | ||
855 | diff --git a/mm/page-writeback.c b/mm/page-writeback.c | ||
856 | index 4514ad7415c3..aca4364275b5 100644 | ||
857 | --- a/mm/page-writeback.c | ||
858 | +++ b/mm/page-writeback.c | ||
859 | @@ -1104,11 +1104,11 @@ static unsigned long dirty_poll_interval(unsigned long dirty, | ||
860 | return 1; | ||
861 | } | ||
862 | |||
863 | -static long bdi_max_pause(struct backing_dev_info *bdi, | ||
864 | - unsigned long bdi_dirty) | ||
865 | +static unsigned long bdi_max_pause(struct backing_dev_info *bdi, | ||
866 | + unsigned long bdi_dirty) | ||
867 | { | ||
868 | - long bw = bdi->avg_write_bandwidth; | ||
869 | - long t; | ||
870 | + unsigned long bw = bdi->avg_write_bandwidth; | ||
871 | + unsigned long t; | ||
872 | |||
873 | /* | ||
874 | * Limit pause time for small memory systems. If sleeping for too long | ||
875 | @@ -1120,7 +1120,7 @@ static long bdi_max_pause(struct backing_dev_info *bdi, | ||
876 | t = bdi_dirty / (1 + bw / roundup_pow_of_two(1 + HZ / 8)); | ||
877 | t++; | ||
878 | |||
879 | - return min_t(long, t, MAX_PAUSE); | ||
880 | + return min_t(unsigned long, t, MAX_PAUSE); | ||
881 | } | ||
882 | |||
883 | static long bdi_min_pause(struct backing_dev_info *bdi, | ||
884 | diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c | ||
885 | index 309129732285..c7e634af8516 100644 | ||
886 | --- a/net/8021q/vlan_netlink.c | ||
887 | +++ b/net/8021q/vlan_netlink.c | ||
888 | @@ -171,7 +171,7 @@ static size_t vlan_get_size(const struct net_device *dev) | ||
889 | |||
890 | return nla_total_size(2) + /* IFLA_VLAN_PROTOCOL */ | ||
891 | nla_total_size(2) + /* IFLA_VLAN_ID */ | ||
892 | - sizeof(struct ifla_vlan_flags) + /* IFLA_VLAN_FLAGS */ | ||
893 | + nla_total_size(sizeof(struct ifla_vlan_flags)) + /* IFLA_VLAN_FLAGS */ | ||
894 | vlan_qos_map_size(vlan->nr_ingress_mappings) + | ||
895 | vlan_qos_map_size(vlan->nr_egress_mappings); | ||
896 | } | ||
897 | diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c | ||
898 | index 108084a04671..656a6f3e40de 100644 | ||
899 | --- a/net/bridge/br_stp_if.c | ||
900 | +++ b/net/bridge/br_stp_if.c | ||
901 | @@ -134,7 +134,7 @@ static void br_stp_start(struct net_bridge *br) | ||
902 | |||
903 | if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY) | ||
904 | __br_set_forward_delay(br, BR_MIN_FORWARD_DELAY); | ||
905 | - else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY) | ||
906 | + else if (br->bridge_forward_delay > BR_MAX_FORWARD_DELAY) | ||
907 | __br_set_forward_delay(br, BR_MAX_FORWARD_DELAY); | ||
908 | |||
909 | if (r == 0) { | ||
910 | diff --git a/net/compat.c b/net/compat.c | ||
911 | index f0a1ba6c8086..89032580bd1d 100644 | ||
912 | --- a/net/compat.c | ||
913 | +++ b/net/compat.c | ||
914 | @@ -71,6 +71,8 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg) | ||
915 | __get_user(kmsg->msg_controllen, &umsg->msg_controllen) || | ||
916 | __get_user(kmsg->msg_flags, &umsg->msg_flags)) | ||
917 | return -EFAULT; | ||
918 | + if (kmsg->msg_namelen > sizeof(struct sockaddr_storage)) | ||
919 | + return -EINVAL; | ||
920 | kmsg->msg_name = compat_ptr(tmp1); | ||
921 | kmsg->msg_iov = compat_ptr(tmp2); | ||
922 | kmsg->msg_control = compat_ptr(tmp3); | ||
923 | diff --git a/net/core/secure_seq.c b/net/core/secure_seq.c | ||
924 | index 3f1ec1586ae1..8d9d05edd2eb 100644 | ||
925 | --- a/net/core/secure_seq.c | ||
926 | +++ b/net/core/secure_seq.c | ||
927 | @@ -10,6 +10,7 @@ | ||
928 | |||
929 | #include <net/secure_seq.h> | ||
930 | |||
931 | +#if IS_ENABLED(CONFIG_IPV6) || IS_ENABLED(CONFIG_INET) | ||
932 | #define NET_SECRET_SIZE (MD5_MESSAGE_BYTES / 4) | ||
933 | |||
934 | static u32 net_secret[NET_SECRET_SIZE] ____cacheline_aligned; | ||
935 | @@ -29,6 +30,7 @@ static void net_secret_init(void) | ||
936 | cmpxchg(&net_secret[--i], 0, tmp); | ||
937 | } | ||
938 | } | ||
939 | +#endif | ||
940 | |||
941 | #ifdef CONFIG_INET | ||
942 | static u32 seq_scale(u32 seq) | ||
943 | diff --git a/net/core/sock.c b/net/core/sock.c | ||
944 | index d6d024cfaaaf..6565431b0e6d 100644 | ||
945 | --- a/net/core/sock.c | ||
946 | +++ b/net/core/sock.c | ||
947 | @@ -2271,6 +2271,7 @@ void sock_init_data(struct socket *sock, struct sock *sk) | ||
948 | |||
949 | sk->sk_stamp = ktime_set(-1L, 0); | ||
950 | |||
951 | + sk->sk_pacing_rate = ~0U; | ||
952 | /* | ||
953 | * Before updating sk_refcnt, we must commit prior changes to memory | ||
954 | * (Documentation/RCU/rculist_nulls.txt for details) | ||
955 | diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c | ||
956 | index 6af375afeeef..c95848d00039 100644 | ||
957 | --- a/net/ipv4/inet_hashtables.c | ||
958 | +++ b/net/ipv4/inet_hashtables.c | ||
959 | @@ -287,7 +287,7 @@ begintw: | ||
960 | if (unlikely(!INET_TW_MATCH(sk, net, acookie, | ||
961 | saddr, daddr, ports, | ||
962 | dif))) { | ||
963 | - sock_put(sk); | ||
964 | + inet_twsk_put(inet_twsk(sk)); | ||
965 | goto begintw; | ||
966 | } | ||
967 | goto out; | ||
968 | diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c | ||
969 | index ec2d430a6a55..6ca5873d6175 100644 | ||
970 | --- a/net/ipv4/ip_output.c | ||
971 | +++ b/net/ipv4/ip_output.c | ||
972 | @@ -844,7 +844,7 @@ static int __ip_append_data(struct sock *sk, | ||
973 | csummode = CHECKSUM_PARTIAL; | ||
974 | |||
975 | cork->length += length; | ||
976 | - if (((length > mtu) || (skb && skb_is_gso(skb))) && | ||
977 | + if (((length > mtu) || (skb && skb_has_frags(skb))) && | ||
978 | (sk->sk_protocol == IPPROTO_UDP) && | ||
979 | (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) { | ||
980 | err = ip_ufo_append_data(sk, queue, getfrag, from, length, | ||
981 | diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c | ||
982 | index 17cc0ffa8c0d..065604127418 100644 | ||
983 | --- a/net/ipv4/ip_vti.c | ||
984 | +++ b/net/ipv4/ip_vti.c | ||
985 | @@ -285,8 +285,17 @@ static int vti_rcv(struct sk_buff *skb) | ||
986 | tunnel = vti_tunnel_lookup(dev_net(skb->dev), iph->saddr, iph->daddr); | ||
987 | if (tunnel != NULL) { | ||
988 | struct pcpu_tstats *tstats; | ||
989 | + u32 oldmark = skb->mark; | ||
990 | + int ret; | ||
991 | |||
992 | - if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) | ||
993 | + | ||
994 | + /* temporarily mark the skb with the tunnel o_key, to | ||
995 | + * only match policies with this mark. | ||
996 | + */ | ||
997 | + skb->mark = be32_to_cpu(tunnel->parms.o_key); | ||
998 | + ret = xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb); | ||
999 | + skb->mark = oldmark; | ||
1000 | + if (!ret) | ||
1001 | return -1; | ||
1002 | |||
1003 | tstats = this_cpu_ptr(tunnel->dev->tstats); | ||
1004 | @@ -295,7 +304,6 @@ static int vti_rcv(struct sk_buff *skb) | ||
1005 | tstats->rx_bytes += skb->len; | ||
1006 | u64_stats_update_end(&tstats->syncp); | ||
1007 | |||
1008 | - skb->mark = 0; | ||
1009 | secpath_reset(skb); | ||
1010 | skb->dev = tunnel->dev; | ||
1011 | return 1; | ||
1012 | @@ -327,7 +335,7 @@ static netdev_tx_t vti_tunnel_xmit(struct sk_buff *skb, struct net_device *dev) | ||
1013 | |||
1014 | memset(&fl4, 0, sizeof(fl4)); | ||
1015 | flowi4_init_output(&fl4, tunnel->parms.link, | ||
1016 | - be32_to_cpu(tunnel->parms.i_key), RT_TOS(tos), | ||
1017 | + be32_to_cpu(tunnel->parms.o_key), RT_TOS(tos), | ||
1018 | RT_SCOPE_UNIVERSE, | ||
1019 | IPPROTO_IPIP, 0, | ||
1020 | dst, tiph->saddr, 0, 0); | ||
1021 | diff --git a/net/ipv4/route.c b/net/ipv4/route.c | ||
1022 | index d35bbf0cf404..d11e73ce9365 100644 | ||
1023 | --- a/net/ipv4/route.c | ||
1024 | +++ b/net/ipv4/route.c | ||
1025 | @@ -2020,7 +2020,7 @@ struct rtable *__ip_route_output_key(struct net *net, struct flowi4 *fl4) | ||
1026 | RT_SCOPE_LINK); | ||
1027 | goto make_route; | ||
1028 | } | ||
1029 | - if (fl4->saddr) { | ||
1030 | + if (!fl4->saddr) { | ||
1031 | if (ipv4_is_multicast(fl4->daddr)) | ||
1032 | fl4->saddr = inet_select_addr(dev_out, 0, | ||
1033 | fl4->flowi4_scope); | ||
1034 | diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c | ||
1035 | index 3f25e75ae692..90b26beb84d4 100644 | ||
1036 | --- a/net/ipv4/sysctl_net_ipv4.c | ||
1037 | +++ b/net/ipv4/sysctl_net_ipv4.c | ||
1038 | @@ -29,6 +29,7 @@ | ||
1039 | static int zero; | ||
1040 | static int one = 1; | ||
1041 | static int four = 4; | ||
1042 | +static int gso_max_segs = GSO_MAX_SEGS; | ||
1043 | static int tcp_retr1_max = 255; | ||
1044 | static int ip_local_port_range_min[] = { 1, 1 }; | ||
1045 | static int ip_local_port_range_max[] = { 65535, 65535 }; | ||
1046 | @@ -753,6 +754,15 @@ static struct ctl_table ipv4_table[] = { | ||
1047 | .extra2 = &four, | ||
1048 | }, | ||
1049 | { | ||
1050 | + .procname = "tcp_min_tso_segs", | ||
1051 | + .data = &sysctl_tcp_min_tso_segs, | ||
1052 | + .maxlen = sizeof(int), | ||
1053 | + .mode = 0644, | ||
1054 | + .proc_handler = proc_dointvec_minmax, | ||
1055 | + .extra1 = &zero, | ||
1056 | + .extra2 = &gso_max_segs, | ||
1057 | + }, | ||
1058 | + { | ||
1059 | .procname = "udp_mem", | ||
1060 | .data = &sysctl_udp_mem, | ||
1061 | .maxlen = sizeof(sysctl_udp_mem), | ||
1062 | diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c | ||
1063 | index 2b1b57f213b2..c888abf5a728 100644 | ||
1064 | --- a/net/ipv4/tcp.c | ||
1065 | +++ b/net/ipv4/tcp.c | ||
1066 | @@ -282,6 +282,8 @@ | ||
1067 | |||
1068 | int sysctl_tcp_fin_timeout __read_mostly = TCP_FIN_TIMEOUT; | ||
1069 | |||
1070 | +int sysctl_tcp_min_tso_segs __read_mostly = 2; | ||
1071 | + | ||
1072 | struct percpu_counter tcp_orphan_count; | ||
1073 | EXPORT_SYMBOL_GPL(tcp_orphan_count); | ||
1074 | |||
1075 | @@ -786,12 +788,28 @@ static unsigned int tcp_xmit_size_goal(struct sock *sk, u32 mss_now, | ||
1076 | xmit_size_goal = mss_now; | ||
1077 | |||
1078 | if (large_allowed && sk_can_gso(sk)) { | ||
1079 | - xmit_size_goal = ((sk->sk_gso_max_size - 1) - | ||
1080 | - inet_csk(sk)->icsk_af_ops->net_header_len - | ||
1081 | - inet_csk(sk)->icsk_ext_hdr_len - | ||
1082 | - tp->tcp_header_len); | ||
1083 | + u32 gso_size, hlen; | ||
1084 | + | ||
1085 | + /* Maybe we should/could use sk->sk_prot->max_header here ? */ | ||
1086 | + hlen = inet_csk(sk)->icsk_af_ops->net_header_len + | ||
1087 | + inet_csk(sk)->icsk_ext_hdr_len + | ||
1088 | + tp->tcp_header_len; | ||
1089 | + | ||
1090 | + /* Goal is to send at least one packet per ms, | ||
1091 | + * not one big TSO packet every 100 ms. | ||
1092 | + * This preserves ACK clocking and is consistent | ||
1093 | + * with tcp_tso_should_defer() heuristic. | ||
1094 | + */ | ||
1095 | + gso_size = sk->sk_pacing_rate / (2 * MSEC_PER_SEC); | ||
1096 | + gso_size = max_t(u32, gso_size, | ||
1097 | + sysctl_tcp_min_tso_segs * mss_now); | ||
1098 | + | ||
1099 | + xmit_size_goal = min_t(u32, gso_size, | ||
1100 | + sk->sk_gso_max_size - 1 - hlen); | ||
1101 | |||
1102 | - /* TSQ : try to have two TSO segments in flight */ | ||
1103 | + /* TSQ : try to have at least two segments in flight | ||
1104 | + * (one in NIC TX ring, another in Qdisc) | ||
1105 | + */ | ||
1106 | xmit_size_goal = min_t(u32, xmit_size_goal, | ||
1107 | sysctl_tcp_limit_output_bytes >> 1); | ||
1108 | |||
1109 | diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c | ||
1110 | index 4b75aad14b04..e15d330919af 100644 | ||
1111 | --- a/net/ipv4/tcp_input.c | ||
1112 | +++ b/net/ipv4/tcp_input.c | ||
1113 | @@ -699,6 +699,34 @@ static void tcp_rtt_estimator(struct sock *sk, const __u32 mrtt) | ||
1114 | } | ||
1115 | } | ||
1116 | |||
1117 | +/* Set the sk_pacing_rate to allow proper sizing of TSO packets. | ||
1118 | + * Note: TCP stack does not yet implement pacing. | ||
1119 | + * FQ packet scheduler can be used to implement cheap but effective | ||
1120 | + * TCP pacing, to smooth the burst on large writes when packets | ||
1121 | + * in flight is significantly lower than cwnd (or rwin) | ||
1122 | + */ | ||
1123 | +static void tcp_update_pacing_rate(struct sock *sk) | ||
1124 | +{ | ||
1125 | + const struct tcp_sock *tp = tcp_sk(sk); | ||
1126 | + u64 rate; | ||
1127 | + | ||
1128 | + /* set sk_pacing_rate to 200 % of current rate (mss * cwnd / srtt) */ | ||
1129 | + rate = (u64)tp->mss_cache * 2 * (HZ << 3); | ||
1130 | + | ||
1131 | + rate *= max(tp->snd_cwnd, tp->packets_out); | ||
1132 | + | ||
1133 | + /* Correction for small srtt : minimum srtt being 8 (1 jiffy << 3), | ||
1134 | + * be conservative and assume srtt = 1 (125 us instead of 1.25 ms) | ||
1135 | + * We probably need usec resolution in the future. | ||
1136 | + * Note: This also takes care of possible srtt=0 case, | ||
1137 | + * when tcp_rtt_estimator() was not yet called. | ||
1138 | + */ | ||
1139 | + if (tp->srtt > 8 + 2) | ||
1140 | + do_div(rate, tp->srtt); | ||
1141 | + | ||
1142 | + sk->sk_pacing_rate = min_t(u64, rate, ~0U); | ||
1143 | +} | ||
1144 | + | ||
1145 | /* Calculate rto without backoff. This is the second half of Van Jacobson's | ||
1146 | * routine referred to above. | ||
1147 | */ | ||
1148 | @@ -1264,7 +1292,10 @@ static bool tcp_shifted_skb(struct sock *sk, struct sk_buff *skb, | ||
1149 | tp->lost_cnt_hint -= tcp_skb_pcount(prev); | ||
1150 | } | ||
1151 | |||
1152 | - TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(prev)->tcp_flags; | ||
1153 | + TCP_SKB_CB(prev)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags; | ||
1154 | + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) | ||
1155 | + TCP_SKB_CB(prev)->end_seq++; | ||
1156 | + | ||
1157 | if (skb == tcp_highest_sack(sk)) | ||
1158 | tcp_advance_highest_sack(sk, skb); | ||
1159 | |||
1160 | @@ -3314,7 +3345,7 @@ static void tcp_process_tlp_ack(struct sock *sk, u32 ack, int flag) | ||
1161 | tcp_init_cwnd_reduction(sk, true); | ||
1162 | tcp_set_ca_state(sk, TCP_CA_CWR); | ||
1163 | tcp_end_cwnd_reduction(sk); | ||
1164 | - tcp_set_ca_state(sk, TCP_CA_Open); | ||
1165 | + tcp_try_keep_open(sk); | ||
1166 | NET_INC_STATS_BH(sock_net(sk), | ||
1167 | LINUX_MIB_TCPLOSSPROBERECOVERY); | ||
1168 | } | ||
1169 | @@ -3330,7 +3361,7 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) | ||
1170 | u32 ack_seq = TCP_SKB_CB(skb)->seq; | ||
1171 | u32 ack = TCP_SKB_CB(skb)->ack_seq; | ||
1172 | bool is_dupack = false; | ||
1173 | - u32 prior_in_flight; | ||
1174 | + u32 prior_in_flight, prior_cwnd = tp->snd_cwnd, prior_rtt = tp->srtt; | ||
1175 | u32 prior_fackets; | ||
1176 | int prior_packets = tp->packets_out; | ||
1177 | int prior_sacked = tp->sacked_out; | ||
1178 | @@ -3438,6 +3469,8 @@ static int tcp_ack(struct sock *sk, const struct sk_buff *skb, int flag) | ||
1179 | |||
1180 | if (icsk->icsk_pending == ICSK_TIME_RETRANS) | ||
1181 | tcp_schedule_loss_probe(sk); | ||
1182 | + if (tp->srtt != prior_rtt || tp->snd_cwnd != prior_cwnd) | ||
1183 | + tcp_update_pacing_rate(sk); | ||
1184 | return 1; | ||
1185 | |||
1186 | no_queue: | ||
1187 | @@ -5736,6 +5769,8 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb, | ||
1188 | } else | ||
1189 | tcp_init_metrics(sk); | ||
1190 | |||
1191 | + tcp_update_pacing_rate(sk); | ||
1192 | + | ||
1193 | /* Prevent spurious tcp_cwnd_restart() on | ||
1194 | * first data packet. | ||
1195 | */ | ||
1196 | diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c | ||
1197 | index 0145ce7e6098..cd16eb06bebf 100644 | ||
1198 | --- a/net/ipv4/tcp_output.c | ||
1199 | +++ b/net/ipv4/tcp_output.c | ||
1200 | @@ -887,8 +887,7 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it, | ||
1201 | |||
1202 | skb_orphan(skb); | ||
1203 | skb->sk = sk; | ||
1204 | - skb->destructor = (sysctl_tcp_limit_output_bytes > 0) ? | ||
1205 | - tcp_wfree : sock_wfree; | ||
1206 | + skb->destructor = tcp_wfree; | ||
1207 | atomic_add(skb->truesize, &sk->sk_wmem_alloc); | ||
1208 | |||
1209 | /* Build TCP header and checksum it. */ | ||
1210 | @@ -977,6 +976,9 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb) | ||
1211 | static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb, | ||
1212 | unsigned int mss_now) | ||
1213 | { | ||
1214 | + /* Make sure we own this skb before messing gso_size/gso_segs */ | ||
1215 | + WARN_ON_ONCE(skb_cloned(skb)); | ||
1216 | + | ||
1217 | if (skb->len <= mss_now || !sk_can_gso(sk) || | ||
1218 | skb->ip_summed == CHECKSUM_NONE) { | ||
1219 | /* Avoid the costly divide in the normal | ||
1220 | @@ -1058,9 +1060,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, | ||
1221 | if (nsize < 0) | ||
1222 | nsize = 0; | ||
1223 | |||
1224 | - if (skb_cloned(skb) && | ||
1225 | - skb_is_nonlinear(skb) && | ||
1226 | - pskb_expand_head(skb, 0, 0, GFP_ATOMIC)) | ||
1227 | + if (skb_unclone(skb, GFP_ATOMIC)) | ||
1228 | return -ENOMEM; | ||
1229 | |||
1230 | /* Get a new skb... force flag on. */ | ||
1231 | @@ -1623,7 +1623,7 @@ static bool tcp_tso_should_defer(struct sock *sk, struct sk_buff *skb) | ||
1232 | |||
1233 | /* If a full-sized TSO skb can be sent, do it. */ | ||
1234 | if (limit >= min_t(unsigned int, sk->sk_gso_max_size, | ||
1235 | - sk->sk_gso_max_segs * tp->mss_cache)) | ||
1236 | + tp->xmit_size_goal_segs * tp->mss_cache)) | ||
1237 | goto send_now; | ||
1238 | |||
1239 | /* Middle in queue won't get any more data, full sendable already? */ | ||
1240 | @@ -1832,7 +1832,6 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, | ||
1241 | while ((skb = tcp_send_head(sk))) { | ||
1242 | unsigned int limit; | ||
1243 | |||
1244 | - | ||
1245 | tso_segs = tcp_init_tso_segs(sk, skb, mss_now); | ||
1246 | BUG_ON(!tso_segs); | ||
1247 | |||
1248 | @@ -1861,13 +1860,20 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle, | ||
1249 | break; | ||
1250 | } | ||
1251 | |||
1252 | - /* TSQ : sk_wmem_alloc accounts skb truesize, | ||
1253 | - * including skb overhead. But thats OK. | ||
1254 | + /* TCP Small Queues : | ||
1255 | + * Control number of packets in qdisc/devices to two packets / or ~1 ms. | ||
1256 | + * This allows for : | ||
1257 | + * - better RTT estimation and ACK scheduling | ||
1258 | + * - faster recovery | ||
1259 | + * - high rates | ||
1260 | */ | ||
1261 | - if (atomic_read(&sk->sk_wmem_alloc) >= sysctl_tcp_limit_output_bytes) { | ||
1262 | + limit = max(skb->truesize, sk->sk_pacing_rate >> 10); | ||
1263 | + | ||
1264 | + if (atomic_read(&sk->sk_wmem_alloc) > limit) { | ||
1265 | set_bit(TSQ_THROTTLED, &tp->tsq_flags); | ||
1266 | break; | ||
1267 | } | ||
1268 | + | ||
1269 | limit = mss_now; | ||
1270 | if (tso_segs > 1 && !tcp_urg_mode(tp)) | ||
1271 | limit = tcp_mss_split_point(sk, skb, mss_now, | ||
1272 | @@ -2329,6 +2335,8 @@ int __tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb) | ||
1273 | int oldpcount = tcp_skb_pcount(skb); | ||
1274 | |||
1275 | if (unlikely(oldpcount > 1)) { | ||
1276 | + if (skb_unclone(skb, GFP_ATOMIC)) | ||
1277 | + return -ENOMEM; | ||
1278 | tcp_init_tso_segs(sk, skb, cur_mss); | ||
1279 | tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb)); | ||
1280 | } | ||
1281 | diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c | ||
1282 | index 32b4a1675d82..066640e0ba8e 100644 | ||
1283 | --- a/net/ipv6/inet6_hashtables.c | ||
1284 | +++ b/net/ipv6/inet6_hashtables.c | ||
1285 | @@ -116,7 +116,7 @@ begintw: | ||
1286 | } | ||
1287 | if (unlikely(!INET6_TW_MATCH(sk, net, saddr, daddr, | ||
1288 | ports, dif))) { | ||
1289 | - sock_put(sk); | ||
1290 | + inet_twsk_put(inet_twsk(sk)); | ||
1291 | goto begintw; | ||
1292 | } | ||
1293 | goto out; | ||
1294 | diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c | ||
1295 | index 44ffdb99a62e..878f8027ebf6 100644 | ||
1296 | --- a/net/ipv6/ip6_output.c | ||
1297 | +++ b/net/ipv6/ip6_output.c | ||
1298 | @@ -130,7 +130,7 @@ static int ip6_finish_output2(struct sk_buff *skb) | ||
1299 | } | ||
1300 | |||
1301 | rcu_read_lock_bh(); | ||
1302 | - nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr); | ||
1303 | + nexthop = rt6_nexthop((struct rt6_info *)dst); | ||
1304 | neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop); | ||
1305 | if (unlikely(!neigh)) | ||
1306 | neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false); | ||
1307 | @@ -898,7 +898,7 @@ static int ip6_dst_lookup_tail(struct sock *sk, | ||
1308 | */ | ||
1309 | rt = (struct rt6_info *) *dst; | ||
1310 | rcu_read_lock_bh(); | ||
1311 | - n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt, &fl6->daddr)); | ||
1312 | + n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt)); | ||
1313 | err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0; | ||
1314 | rcu_read_unlock_bh(); | ||
1315 | |||
1316 | @@ -1250,7 +1250,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, | ||
1317 | skb = skb_peek_tail(&sk->sk_write_queue); | ||
1318 | cork->length += length; | ||
1319 | if (((length > mtu) || | ||
1320 | - (skb && skb_is_gso(skb))) && | ||
1321 | + (skb && skb_has_frags(skb))) && | ||
1322 | (sk->sk_protocol == IPPROTO_UDP) && | ||
1323 | (rt->dst.dev->features & NETIF_F_UFO)) { | ||
1324 | err = ip6_ufo_append_data(sk, getfrag, from, length, | ||
1325 | diff --git a/net/ipv6/route.c b/net/ipv6/route.c | ||
1326 | index bacce6c08644..3c1f493ccc63 100644 | ||
1327 | --- a/net/ipv6/route.c | ||
1328 | +++ b/net/ipv6/route.c | ||
1329 | @@ -473,6 +473,24 @@ out: | ||
1330 | } | ||
1331 | |||
1332 | #ifdef CONFIG_IPV6_ROUTER_PREF | ||
1333 | +struct __rt6_probe_work { | ||
1334 | + struct work_struct work; | ||
1335 | + struct in6_addr target; | ||
1336 | + struct net_device *dev; | ||
1337 | +}; | ||
1338 | + | ||
1339 | +static void rt6_probe_deferred(struct work_struct *w) | ||
1340 | +{ | ||
1341 | + struct in6_addr mcaddr; | ||
1342 | + struct __rt6_probe_work *work = | ||
1343 | + container_of(w, struct __rt6_probe_work, work); | ||
1344 | + | ||
1345 | + addrconf_addr_solict_mult(&work->target, &mcaddr); | ||
1346 | + ndisc_send_ns(work->dev, NULL, &work->target, &mcaddr, NULL); | ||
1347 | + dev_put(work->dev); | ||
1348 | + kfree(w); | ||
1349 | +} | ||
1350 | + | ||
1351 | static void rt6_probe(struct rt6_info *rt) | ||
1352 | { | ||
1353 | struct neighbour *neigh; | ||
1354 | @@ -496,17 +514,23 @@ static void rt6_probe(struct rt6_info *rt) | ||
1355 | |||
1356 | if (!neigh || | ||
1357 | time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) { | ||
1358 | - struct in6_addr mcaddr; | ||
1359 | - struct in6_addr *target; | ||
1360 | + struct __rt6_probe_work *work; | ||
1361 | |||
1362 | - if (neigh) { | ||
1363 | + work = kmalloc(sizeof(*work), GFP_ATOMIC); | ||
1364 | + | ||
1365 | + if (neigh && work) | ||
1366 | neigh->updated = jiffies; | ||
1367 | + | ||
1368 | + if (neigh) | ||
1369 | write_unlock(&neigh->lock); | ||
1370 | - } | ||
1371 | |||
1372 | - target = (struct in6_addr *)&rt->rt6i_gateway; | ||
1373 | - addrconf_addr_solict_mult(target, &mcaddr); | ||
1374 | - ndisc_send_ns(rt->dst.dev, NULL, target, &mcaddr, NULL); | ||
1375 | + if (work) { | ||
1376 | + INIT_WORK(&work->work, rt6_probe_deferred); | ||
1377 | + work->target = rt->rt6i_gateway; | ||
1378 | + dev_hold(rt->dst.dev); | ||
1379 | + work->dev = rt->dst.dev; | ||
1380 | + schedule_work(&work->work); | ||
1381 | + } | ||
1382 | } else { | ||
1383 | out: | ||
1384 | write_unlock(&neigh->lock); | ||
1385 | @@ -848,7 +872,6 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, | ||
1386 | if (ort->rt6i_dst.plen != 128 && | ||
1387 | ipv6_addr_equal(&ort->rt6i_dst.addr, daddr)) | ||
1388 | rt->rt6i_flags |= RTF_ANYCAST; | ||
1389 | - rt->rt6i_gateway = *daddr; | ||
1390 | } | ||
1391 | |||
1392 | rt->rt6i_flags |= RTF_CACHE; | ||
1393 | @@ -1245,6 +1268,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev, | ||
1394 | rt->dst.flags |= DST_HOST; | ||
1395 | rt->dst.output = ip6_output; | ||
1396 | atomic_set(&rt->dst.__refcnt, 1); | ||
1397 | + rt->rt6i_gateway = fl6->daddr; | ||
1398 | rt->rt6i_dst.addr = fl6->daddr; | ||
1399 | rt->rt6i_dst.plen = 128; | ||
1400 | rt->rt6i_idev = idev; | ||
1401 | @@ -1801,7 +1825,10 @@ static struct rt6_info *ip6_rt_copy(struct rt6_info *ort, | ||
1402 | in6_dev_hold(rt->rt6i_idev); | ||
1403 | rt->dst.lastuse = jiffies; | ||
1404 | |||
1405 | - rt->rt6i_gateway = ort->rt6i_gateway; | ||
1406 | + if (ort->rt6i_flags & RTF_GATEWAY) | ||
1407 | + rt->rt6i_gateway = ort->rt6i_gateway; | ||
1408 | + else | ||
1409 | + rt->rt6i_gateway = *dest; | ||
1410 | rt->rt6i_flags = ort->rt6i_flags; | ||
1411 | if ((ort->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF)) == | ||
1412 | (RTF_DEFAULT | RTF_ADDRCONF)) | ||
1413 | @@ -2088,6 +2115,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev, | ||
1414 | else | ||
1415 | rt->rt6i_flags |= RTF_LOCAL; | ||
1416 | |||
1417 | + rt->rt6i_gateway = *addr; | ||
1418 | rt->rt6i_dst.addr = *addr; | ||
1419 | rt->rt6i_dst.plen = 128; | ||
1420 | rt->rt6i_table = fib6_get_table(net, RT6_TABLE_LOCAL); | ||
1421 | diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c | ||
1422 | index 6984c3a353cd..8c27de2b4d5a 100644 | ||
1423 | --- a/net/l2tp/l2tp_core.c | ||
1424 | +++ b/net/l2tp/l2tp_core.c | ||
1425 | @@ -115,6 +115,11 @@ struct l2tp_net { | ||
1426 | static void l2tp_session_set_header_len(struct l2tp_session *session, int version); | ||
1427 | static void l2tp_tunnel_free(struct l2tp_tunnel *tunnel); | ||
1428 | |||
1429 | +static inline struct l2tp_tunnel *l2tp_tunnel(struct sock *sk) | ||
1430 | +{ | ||
1431 | + return sk->sk_user_data; | ||
1432 | +} | ||
1433 | + | ||
1434 | static inline struct l2tp_net *l2tp_pernet(struct net *net) | ||
1435 | { | ||
1436 | BUG_ON(!net); | ||
1437 | @@ -507,7 +512,7 @@ static inline int l2tp_verify_udp_checksum(struct sock *sk, | ||
1438 | return 0; | ||
1439 | |||
1440 | #if IS_ENABLED(CONFIG_IPV6) | ||
1441 | - if (sk->sk_family == PF_INET6) { | ||
1442 | + if (sk->sk_family == PF_INET6 && !l2tp_tunnel(sk)->v4mapped) { | ||
1443 | if (!uh->check) { | ||
1444 | LIMIT_NETDEBUG(KERN_INFO "L2TP: IPv6: checksum is 0\n"); | ||
1445 | return 1; | ||
1446 | @@ -1071,7 +1076,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, | ||
1447 | /* Queue the packet to IP for output */ | ||
1448 | skb->local_df = 1; | ||
1449 | #if IS_ENABLED(CONFIG_IPV6) | ||
1450 | - if (skb->sk->sk_family == PF_INET6) | ||
1451 | + if (skb->sk->sk_family == PF_INET6 && !tunnel->v4mapped) | ||
1452 | error = inet6_csk_xmit(skb, NULL); | ||
1453 | else | ||
1454 | #endif | ||
1455 | @@ -1198,7 +1203,7 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len | ||
1456 | |||
1457 | /* Calculate UDP checksum if configured to do so */ | ||
1458 | #if IS_ENABLED(CONFIG_IPV6) | ||
1459 | - if (sk->sk_family == PF_INET6) | ||
1460 | + if (sk->sk_family == PF_INET6 && !tunnel->v4mapped) | ||
1461 | l2tp_xmit_ipv6_csum(sk, skb, udp_len); | ||
1462 | else | ||
1463 | #endif | ||
1464 | @@ -1247,10 +1252,9 @@ EXPORT_SYMBOL_GPL(l2tp_xmit_skb); | ||
1465 | */ | ||
1466 | static void l2tp_tunnel_destruct(struct sock *sk) | ||
1467 | { | ||
1468 | - struct l2tp_tunnel *tunnel; | ||
1469 | + struct l2tp_tunnel *tunnel = l2tp_tunnel(sk); | ||
1470 | struct l2tp_net *pn; | ||
1471 | |||
1472 | - tunnel = sk->sk_user_data; | ||
1473 | if (tunnel == NULL) | ||
1474 | goto end; | ||
1475 | |||
1476 | @@ -1618,7 +1622,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 | ||
1477 | } | ||
1478 | |||
1479 | /* Check if this socket has already been prepped */ | ||
1480 | - tunnel = (struct l2tp_tunnel *)sk->sk_user_data; | ||
1481 | + tunnel = l2tp_tunnel(sk); | ||
1482 | if (tunnel != NULL) { | ||
1483 | /* This socket has already been prepped */ | ||
1484 | err = -EBUSY; | ||
1485 | @@ -1647,6 +1651,24 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 | ||
1486 | if (cfg != NULL) | ||
1487 | tunnel->debug = cfg->debug; | ||
1488 | |||
1489 | +#if IS_ENABLED(CONFIG_IPV6) | ||
1490 | + if (sk->sk_family == PF_INET6) { | ||
1491 | + struct ipv6_pinfo *np = inet6_sk(sk); | ||
1492 | + | ||
1493 | + if (ipv6_addr_v4mapped(&np->saddr) && | ||
1494 | + ipv6_addr_v4mapped(&np->daddr)) { | ||
1495 | + struct inet_sock *inet = inet_sk(sk); | ||
1496 | + | ||
1497 | + tunnel->v4mapped = true; | ||
1498 | + inet->inet_saddr = np->saddr.s6_addr32[3]; | ||
1499 | + inet->inet_rcv_saddr = np->rcv_saddr.s6_addr32[3]; | ||
1500 | + inet->inet_daddr = np->daddr.s6_addr32[3]; | ||
1501 | + } else { | ||
1502 | + tunnel->v4mapped = false; | ||
1503 | + } | ||
1504 | + } | ||
1505 | +#endif | ||
1506 | + | ||
1507 | /* Mark socket as an encapsulation socket. See net/ipv4/udp.c */ | ||
1508 | tunnel->encap = encap; | ||
1509 | if (encap == L2TP_ENCAPTYPE_UDP) { | ||
1510 | @@ -1655,7 +1677,7 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32 | ||
1511 | udp_sk(sk)->encap_rcv = l2tp_udp_encap_recv; | ||
1512 | udp_sk(sk)->encap_destroy = l2tp_udp_encap_destroy; | ||
1513 | #if IS_ENABLED(CONFIG_IPV6) | ||
1514 | - if (sk->sk_family == PF_INET6) | ||
1515 | + if (sk->sk_family == PF_INET6 && !tunnel->v4mapped) | ||
1516 | udpv6_encap_enable(); | ||
1517 | else | ||
1518 | #endif | ||
1519 | diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h | ||
1520 | index 485a490fd990..2f89d43877d7 100644 | ||
1521 | --- a/net/l2tp/l2tp_core.h | ||
1522 | +++ b/net/l2tp/l2tp_core.h | ||
1523 | @@ -189,6 +189,9 @@ struct l2tp_tunnel { | ||
1524 | struct sock *sock; /* Parent socket */ | ||
1525 | int fd; /* Parent fd, if tunnel socket | ||
1526 | * was created by userspace */ | ||
1527 | +#if IS_ENABLED(CONFIG_IPV6) | ||
1528 | + bool v4mapped; | ||
1529 | +#endif | ||
1530 | |||
1531 | struct work_struct del_work; | ||
1532 | |||
1533 | diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c | ||
1534 | index 5ebee2ded9e9..8c46b271064a 100644 | ||
1535 | --- a/net/l2tp/l2tp_ppp.c | ||
1536 | +++ b/net/l2tp/l2tp_ppp.c | ||
1537 | @@ -353,7 +353,9 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh | ||
1538 | goto error_put_sess_tun; | ||
1539 | } | ||
1540 | |||
1541 | + local_bh_disable(); | ||
1542 | l2tp_xmit_skb(session, skb, session->hdr_len); | ||
1543 | + local_bh_enable(); | ||
1544 | |||
1545 | sock_put(ps->tunnel_sock); | ||
1546 | sock_put(sk); | ||
1547 | @@ -422,7 +424,9 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb) | ||
1548 | skb->data[0] = ppph[0]; | ||
1549 | skb->data[1] = ppph[1]; | ||
1550 | |||
1551 | + local_bh_disable(); | ||
1552 | l2tp_xmit_skb(session, skb, session->hdr_len); | ||
1553 | + local_bh_enable(); | ||
1554 | |||
1555 | sock_put(sk_tun); | ||
1556 | sock_put(sk); | ||
1557 | diff --git a/net/netfilter/nf_conntrack_h323_main.c b/net/netfilter/nf_conntrack_h323_main.c | ||
1558 | index bdebd03bc8cd..70866d192efc 100644 | ||
1559 | --- a/net/netfilter/nf_conntrack_h323_main.c | ||
1560 | +++ b/net/netfilter/nf_conntrack_h323_main.c | ||
1561 | @@ -778,8 +778,8 @@ static int callforward_do_filter(const union nf_inet_addr *src, | ||
1562 | flowi6_to_flowi(&fl1), false)) { | ||
1563 | if (!afinfo->route(&init_net, (struct dst_entry **)&rt2, | ||
1564 | flowi6_to_flowi(&fl2), false)) { | ||
1565 | - if (!memcmp(&rt1->rt6i_gateway, &rt2->rt6i_gateway, | ||
1566 | - sizeof(rt1->rt6i_gateway)) && | ||
1567 | + if (ipv6_addr_equal(rt6_nexthop(rt1), | ||
1568 | + rt6_nexthop(rt2)) && | ||
1569 | rt1->dst.dev == rt2->dst.dev) | ||
1570 | ret = 1; | ||
1571 | dst_release(&rt2->dst); | ||
1572 | diff --git a/net/sctp/output.c b/net/sctp/output.c | ||
1573 | index bbef4a7a9b56..0beb2f9c8a7c 100644 | ||
1574 | --- a/net/sctp/output.c | ||
1575 | +++ b/net/sctp/output.c | ||
1576 | @@ -547,7 +547,8 @@ int sctp_packet_transmit(struct sctp_packet *packet) | ||
1577 | * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>. | ||
1578 | */ | ||
1579 | if (!sctp_checksum_disable) { | ||
1580 | - if (!(dst->dev->features & NETIF_F_SCTP_CSUM)) { | ||
1581 | + if (!(dst->dev->features & NETIF_F_SCTP_CSUM) || | ||
1582 | + (dst_xfrm(dst) != NULL) || packet->ipfragok) { | ||
1583 | __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len); | ||
1584 | |||
1585 | /* 3) Put the resultant value into the checksum field in the | ||
1586 | diff --git a/net/socket.c b/net/socket.c | ||
1587 | index 4ca1526db756..9c467b2afc84 100644 | ||
1588 | --- a/net/socket.c | ||
1589 | +++ b/net/socket.c | ||
1590 | @@ -1956,6 +1956,16 @@ struct used_address { | ||
1591 | unsigned int name_len; | ||
1592 | }; | ||
1593 | |||
1594 | +static int copy_msghdr_from_user(struct msghdr *kmsg, | ||
1595 | + struct msghdr __user *umsg) | ||
1596 | +{ | ||
1597 | + if (copy_from_user(kmsg, umsg, sizeof(struct msghdr))) | ||
1598 | + return -EFAULT; | ||
1599 | + if (kmsg->msg_namelen > sizeof(struct sockaddr_storage)) | ||
1600 | + return -EINVAL; | ||
1601 | + return 0; | ||
1602 | +} | ||
1603 | + | ||
1604 | static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg, | ||
1605 | struct msghdr *msg_sys, unsigned int flags, | ||
1606 | struct used_address *used_address) | ||
1607 | @@ -1974,8 +1984,11 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg, | ||
1608 | if (MSG_CMSG_COMPAT & flags) { | ||
1609 | if (get_compat_msghdr(msg_sys, msg_compat)) | ||
1610 | return -EFAULT; | ||
1611 | - } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr))) | ||
1612 | - return -EFAULT; | ||
1613 | + } else { | ||
1614 | + err = copy_msghdr_from_user(msg_sys, msg); | ||
1615 | + if (err) | ||
1616 | + return err; | ||
1617 | + } | ||
1618 | |||
1619 | if (msg_sys->msg_iovlen > UIO_FASTIOV) { | ||
1620 | err = -EMSGSIZE; | ||
1621 | @@ -2183,8 +2196,11 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg, | ||
1622 | if (MSG_CMSG_COMPAT & flags) { | ||
1623 | if (get_compat_msghdr(msg_sys, msg_compat)) | ||
1624 | return -EFAULT; | ||
1625 | - } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr))) | ||
1626 | - return -EFAULT; | ||
1627 | + } else { | ||
1628 | + err = copy_msghdr_from_user(msg_sys, msg); | ||
1629 | + if (err) | ||
1630 | + return err; | ||
1631 | + } | ||
1632 | |||
1633 | if (msg_sys->msg_iovlen > UIO_FASTIOV) { | ||
1634 | err = -EMSGSIZE; | ||
1635 | diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c | ||
1636 | index 826e09938bff..0258072a518f 100644 | ||
1637 | --- a/net/unix/af_unix.c | ||
1638 | +++ b/net/unix/af_unix.c | ||
1639 | @@ -1245,6 +1245,15 @@ static int unix_socketpair(struct socket *socka, struct socket *sockb) | ||
1640 | return 0; | ||
1641 | } | ||
1642 | |||
1643 | +static void unix_sock_inherit_flags(const struct socket *old, | ||
1644 | + struct socket *new) | ||
1645 | +{ | ||
1646 | + if (test_bit(SOCK_PASSCRED, &old->flags)) | ||
1647 | + set_bit(SOCK_PASSCRED, &new->flags); | ||
1648 | + if (test_bit(SOCK_PASSSEC, &old->flags)) | ||
1649 | + set_bit(SOCK_PASSSEC, &new->flags); | ||
1650 | +} | ||
1651 | + | ||
1652 | static int unix_accept(struct socket *sock, struct socket *newsock, int flags) | ||
1653 | { | ||
1654 | struct sock *sk = sock->sk; | ||
1655 | @@ -1279,6 +1288,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags) | ||
1656 | /* attach accepted sock to socket */ | ||
1657 | unix_state_lock(tsk); | ||
1658 | newsock->state = SS_CONNECTED; | ||
1659 | + unix_sock_inherit_flags(sock, newsock); | ||
1660 | sock_graft(tsk, newsock); | ||
1661 | unix_state_unlock(tsk); | ||
1662 | return 0; | ||
1663 | diff --git a/net/unix/diag.c b/net/unix/diag.c | ||
1664 | index d591091603bf..86fa0f3b2caf 100644 | ||
1665 | --- a/net/unix/diag.c | ||
1666 | +++ b/net/unix/diag.c | ||
1667 | @@ -124,6 +124,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r | ||
1668 | rep->udiag_family = AF_UNIX; | ||
1669 | rep->udiag_type = sk->sk_type; | ||
1670 | rep->udiag_state = sk->sk_state; | ||
1671 | + rep->pad = 0; | ||
1672 | rep->udiag_ino = sk_ino; | ||
1673 | sock_diag_save_cookie(sk, rep->udiag_cookie); | ||
1674 | |||
1675 | diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c | ||
1676 | index 7d604c06c3dc..a271c27fac77 100644 | ||
1677 | --- a/net/wireless/radiotap.c | ||
1678 | +++ b/net/wireless/radiotap.c | ||
1679 | @@ -97,6 +97,10 @@ int ieee80211_radiotap_iterator_init( | ||
1680 | struct ieee80211_radiotap_header *radiotap_header, | ||
1681 | int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns) | ||
1682 | { | ||
1683 | + /* check the radiotap header can actually be present */ | ||
1684 | + if (max_length < sizeof(struct ieee80211_radiotap_header)) | ||
1685 | + return -EINVAL; | ||
1686 | + | ||
1687 | /* Linux only supports version 0 radiotap format */ | ||
1688 | if (radiotap_header->it_version) | ||
1689 | return -EINVAL; | ||
1690 | @@ -131,7 +135,8 @@ int ieee80211_radiotap_iterator_init( | ||
1691 | */ | ||
1692 | |||
1693 | if ((unsigned long)iterator->_arg - | ||
1694 | - (unsigned long)iterator->_rtheader > | ||
1695 | + (unsigned long)iterator->_rtheader + | ||
1696 | + sizeof(uint32_t) > | ||
1697 | (unsigned long)iterator->_max_length) | ||
1698 | return -EINVAL; | ||
1699 | } | ||
1700 | diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c | ||
1701 | index ad22decad02b..2519f9d03c0f 100644 | ||
1702 | --- a/sound/pci/hda/hda_generic.c | ||
1703 | +++ b/sound/pci/hda/hda_generic.c | ||
1704 | @@ -3474,7 +3474,7 @@ static int create_capture_mixers(struct hda_codec *codec) | ||
1705 | if (!multi) | ||
1706 | err = create_single_cap_vol_ctl(codec, n, vol, sw, | ||
1707 | inv_dmic); | ||
1708 | - else if (!multi_cap_vol) | ||
1709 | + else if (!multi_cap_vol && !inv_dmic) | ||
1710 | err = create_bind_cap_vol_ctl(codec, n, vol, sw); | ||
1711 | else | ||
1712 | err = create_multi_cap_vol_ctl(codec); | ||
1713 | diff --git a/sound/usb/usx2y/us122l.c b/sound/usb/usx2y/us122l.c | ||
1714 | index d0323a693ba2..999550bbad40 100644 | ||
1715 | --- a/sound/usb/usx2y/us122l.c | ||
1716 | +++ b/sound/usb/usx2y/us122l.c | ||
1717 | @@ -262,7 +262,9 @@ static int usb_stream_hwdep_mmap(struct snd_hwdep *hw, | ||
1718 | } | ||
1719 | |||
1720 | area->vm_ops = &usb_stream_hwdep_vm_ops; | ||
1721 | - area->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP; | ||
1722 | + area->vm_flags |= VM_DONTDUMP; | ||
1723 | + if (!read) | ||
1724 | + area->vm_flags |= VM_DONTEXPAND; | ||
1725 | area->vm_private_data = us122l; | ||
1726 | atomic_inc(&us122l->mmap_count); | ||
1727 | out: |