Contents of /trunk/kernel-lts/patches-3.4/0161-3.4.62-all-fixes.patch
Parent Directory | Revision Log
Revision 2303 -
(show annotations)
(download)
Mon Oct 14 07:15:13 2013 UTC (10 years, 11 months ago) by niro
File size: 18199 byte(s)
Mon Oct 14 07:15:13 2013 UTC (10 years, 11 months ago) by niro
File size: 18199 byte(s)
-linux-3.4.62
1 | diff --git a/arch/m32r/boot/compressed/Makefile b/arch/m32r/boot/compressed/Makefile |
2 | index 177716b..01729c2 100644 |
3 | --- a/arch/m32r/boot/compressed/Makefile |
4 | +++ b/arch/m32r/boot/compressed/Makefile |
5 | @@ -43,9 +43,9 @@ endif |
6 | |
7 | OBJCOPYFLAGS += -R .empty_zero_page |
8 | |
9 | -suffix_$(CONFIG_KERNEL_GZIP) = gz |
10 | -suffix_$(CONFIG_KERNEL_BZIP2) = bz2 |
11 | -suffix_$(CONFIG_KERNEL_LZMA) = lzma |
12 | +suffix-$(CONFIG_KERNEL_GZIP) = gz |
13 | +suffix-$(CONFIG_KERNEL_BZIP2) = bz2 |
14 | +suffix-$(CONFIG_KERNEL_LZMA) = lzma |
15 | |
16 | $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.$(suffix-y) FORCE |
17 | $(call if_changed,ld) |
18 | diff --git a/arch/m32r/boot/compressed/misc.c b/arch/m32r/boot/compressed/misc.c |
19 | index 370d608..28a0952 100644 |
20 | --- a/arch/m32r/boot/compressed/misc.c |
21 | +++ b/arch/m32r/boot/compressed/misc.c |
22 | @@ -28,7 +28,7 @@ static unsigned long free_mem_ptr; |
23 | static unsigned long free_mem_end_ptr; |
24 | |
25 | #ifdef CONFIG_KERNEL_BZIP2 |
26 | -static void *memset(void *s, int c, size_t n) |
27 | +void *memset(void *s, int c, size_t n) |
28 | { |
29 | char *ss = s; |
30 | |
31 | @@ -39,6 +39,16 @@ static void *memset(void *s, int c, size_t n) |
32 | #endif |
33 | |
34 | #ifdef CONFIG_KERNEL_GZIP |
35 | +void *memcpy(void *dest, const void *src, size_t n) |
36 | +{ |
37 | + char *d = dest; |
38 | + const char *s = src; |
39 | + while (n--) |
40 | + *d++ = *s++; |
41 | + |
42 | + return dest; |
43 | +} |
44 | + |
45 | #define BOOT_HEAP_SIZE 0x10000 |
46 | #include "../../../../lib/decompress_inflate.c" |
47 | #endif |
48 | diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c |
49 | index 8c45818..8375622 100644 |
50 | --- a/arch/x86/kvm/emulate.c |
51 | +++ b/arch/x86/kvm/emulate.c |
52 | @@ -3737,10 +3737,6 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op, |
53 | break; |
54 | case OpMem8: |
55 | ctxt->memop.bytes = 1; |
56 | - if (ctxt->memop.type == OP_REG) { |
57 | - ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm, 1); |
58 | - fetch_register_operand(&ctxt->memop); |
59 | - } |
60 | goto mem_common; |
61 | case OpMem16: |
62 | ctxt->memop.bytes = 2; |
63 | diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c |
64 | index d9f8358..80103bb 100644 |
65 | --- a/drivers/net/bonding/bond_main.c |
66 | +++ b/drivers/net/bonding/bond_main.c |
67 | @@ -3750,11 +3750,17 @@ static int bond_neigh_init(struct neighbour *n) |
68 | * The bonding ndo_neigh_setup is called at init time beofre any |
69 | * slave exists. So we must declare proxy setup function which will |
70 | * be used at run time to resolve the actual slave neigh param setup. |
71 | + * |
72 | + * It's also called by master devices (such as vlans) to setup their |
73 | + * underlying devices. In that case - do nothing, we're already set up from |
74 | + * our init. |
75 | */ |
76 | static int bond_neigh_setup(struct net_device *dev, |
77 | struct neigh_parms *parms) |
78 | { |
79 | - parms->neigh_setup = bond_neigh_init; |
80 | + /* modify only our neigh_parms */ |
81 | + if (parms->dev == dev) |
82 | + parms->neigh_setup = bond_neigh_init; |
83 | |
84 | return 0; |
85 | } |
86 | diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c |
87 | index 2205db7..1b44047 100644 |
88 | --- a/drivers/net/ethernet/realtek/8139cp.c |
89 | +++ b/drivers/net/ethernet/realtek/8139cp.c |
90 | @@ -524,6 +524,7 @@ rx_status_loop: |
91 | PCI_DMA_FROMDEVICE); |
92 | if (dma_mapping_error(&cp->pdev->dev, new_mapping)) { |
93 | dev->stats.rx_dropped++; |
94 | + kfree_skb(new_skb); |
95 | goto rx_next; |
96 | } |
97 | |
98 | diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c |
99 | index 5151f06..77ce8b2 100644 |
100 | --- a/drivers/net/macvtap.c |
101 | +++ b/drivers/net/macvtap.c |
102 | @@ -642,6 +642,28 @@ static int macvtap_skb_to_vnet_hdr(const struct sk_buff *skb, |
103 | return 0; |
104 | } |
105 | |
106 | +static unsigned long iov_pages(const struct iovec *iv, int offset, |
107 | + unsigned long nr_segs) |
108 | +{ |
109 | + unsigned long seg, base; |
110 | + int pages = 0, len, size; |
111 | + |
112 | + while (nr_segs && (offset >= iv->iov_len)) { |
113 | + offset -= iv->iov_len; |
114 | + ++iv; |
115 | + --nr_segs; |
116 | + } |
117 | + |
118 | + for (seg = 0; seg < nr_segs; seg++) { |
119 | + base = (unsigned long)iv[seg].iov_base + offset; |
120 | + len = iv[seg].iov_len - offset; |
121 | + size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT; |
122 | + pages += size; |
123 | + offset = 0; |
124 | + } |
125 | + |
126 | + return pages; |
127 | +} |
128 | |
129 | /* Get packet from user space buffer */ |
130 | static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, |
131 | @@ -688,31 +710,15 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, |
132 | if (unlikely(count > UIO_MAXIOV)) |
133 | goto err; |
134 | |
135 | - if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) |
136 | - zerocopy = true; |
137 | - |
138 | - if (zerocopy) { |
139 | - /* Userspace may produce vectors with count greater than |
140 | - * MAX_SKB_FRAGS, so we need to linearize parts of the skb |
141 | - * to let the rest of data to be fit in the frags. |
142 | - */ |
143 | - if (count > MAX_SKB_FRAGS) { |
144 | - copylen = iov_length(iv, count - MAX_SKB_FRAGS); |
145 | - if (copylen < vnet_hdr_len) |
146 | - copylen = 0; |
147 | - else |
148 | - copylen -= vnet_hdr_len; |
149 | - } |
150 | - /* There are 256 bytes to be copied in skb, so there is enough |
151 | - * room for skb expand head in case it is used. |
152 | - * The rest buffer is mapped from userspace. |
153 | - */ |
154 | - if (copylen < vnet_hdr.hdr_len) |
155 | - copylen = vnet_hdr.hdr_len; |
156 | - if (!copylen) |
157 | - copylen = GOODCOPY_LEN; |
158 | + if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) { |
159 | + copylen = vnet_hdr.hdr_len ? vnet_hdr.hdr_len : GOODCOPY_LEN; |
160 | linear = copylen; |
161 | - } else { |
162 | + if (iov_pages(iv, vnet_hdr_len + copylen, count) |
163 | + <= MAX_SKB_FRAGS) |
164 | + zerocopy = true; |
165 | + } |
166 | + |
167 | + if (!zerocopy) { |
168 | copylen = len; |
169 | linear = vnet_hdr.hdr_len; |
170 | } |
171 | @@ -724,9 +730,15 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, |
172 | |
173 | if (zerocopy) |
174 | err = zerocopy_sg_from_iovec(skb, iv, vnet_hdr_len, count); |
175 | - else |
176 | + else { |
177 | err = skb_copy_datagram_from_iovec(skb, 0, iv, vnet_hdr_len, |
178 | len); |
179 | + if (!err && m && m->msg_control) { |
180 | + struct ubuf_info *uarg = m->msg_control; |
181 | + uarg->callback(uarg); |
182 | + } |
183 | + } |
184 | + |
185 | if (err) |
186 | goto err_kfree; |
187 | |
188 | diff --git a/drivers/net/tun.c b/drivers/net/tun.c |
189 | index c896b8f..194f879 100644 |
190 | --- a/drivers/net/tun.c |
191 | +++ b/drivers/net/tun.c |
192 | @@ -615,8 +615,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, |
193 | int offset = 0; |
194 | |
195 | if (!(tun->flags & TUN_NO_PI)) { |
196 | - if ((len -= sizeof(pi)) > count) |
197 | + if (len < sizeof(pi)) |
198 | return -EINVAL; |
199 | + len -= sizeof(pi); |
200 | |
201 | if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi))) |
202 | return -EFAULT; |
203 | @@ -624,8 +625,9 @@ static ssize_t tun_get_user(struct tun_struct *tun, |
204 | } |
205 | |
206 | if (tun->flags & TUN_VNET_HDR) { |
207 | - if ((len -= tun->vnet_hdr_sz) > count) |
208 | + if (len < tun->vnet_hdr_sz) |
209 | return -EINVAL; |
210 | + len -= tun->vnet_hdr_sz; |
211 | |
212 | if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso))) |
213 | return -EFAULT; |
214 | diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c |
215 | index 1a9e2a9..a50cb9c 100644 |
216 | --- a/drivers/vhost/vhost.c |
217 | +++ b/drivers/vhost/vhost.c |
218 | @@ -1603,6 +1603,7 @@ void vhost_zerocopy_callback(struct ubuf_info *ubuf) |
219 | struct vhost_ubuf_ref *ubufs = ubuf->ctx; |
220 | struct vhost_virtqueue *vq = ubufs->vq; |
221 | |
222 | + vhost_poll_queue(&vq->poll); |
223 | /* set len = 1 to mark this desc buffers done DMA */ |
224 | vq->heads[ubuf->desc].len = VHOST_DMA_DONE_LEN; |
225 | kref_put(&ubufs->kref, vhost_zerocopy_done_signal); |
226 | diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h |
227 | index ba45e6b..f5a21d0 100644 |
228 | --- a/include/linux/icmpv6.h |
229 | +++ b/include/linux/icmpv6.h |
230 | @@ -123,6 +123,8 @@ static inline struct icmp6hdr *icmp6_hdr(const struct sk_buff *skb) |
231 | #define ICMPV6_NOT_NEIGHBOUR 2 |
232 | #define ICMPV6_ADDR_UNREACH 3 |
233 | #define ICMPV6_PORT_UNREACH 4 |
234 | +#define ICMPV6_POLICY_FAIL 5 |
235 | +#define ICMPV6_REJECT_ROUTE 6 |
236 | |
237 | /* |
238 | * Codes for Time Exceeded |
239 | diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h |
240 | index 8260ef7..e6412ee 100644 |
241 | --- a/include/linux/ipv6.h |
242 | +++ b/include/linux/ipv6.h |
243 | @@ -260,6 +260,7 @@ struct inet6_skb_parm { |
244 | #define IP6SKB_XFRM_TRANSFORMED 1 |
245 | #define IP6SKB_FORWARDED 2 |
246 | #define IP6SKB_REROUTED 4 |
247 | +#define IP6SKB_FRAGMENTED 16 |
248 | }; |
249 | |
250 | #define IP6CB(skb) ((struct inet6_skb_parm*)((skb)->cb)) |
251 | diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c |
252 | index 9069071..ca670d9 100644 |
253 | --- a/net/bridge/br_multicast.c |
254 | +++ b/net/bridge/br_multicast.c |
255 | @@ -1155,7 +1155,8 @@ static int br_ip6_multicast_query(struct net_bridge *br, |
256 | mld2q = (struct mld2_query *)icmp6_hdr(skb); |
257 | if (!mld2q->mld2q_nsrcs) |
258 | group = &mld2q->mld2q_mca; |
259 | - max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(mld2q->mld2q_mrc) : 1; |
260 | + |
261 | + max_delay = max(msecs_to_jiffies(MLDV2_MRC(ntohs(mld2q->mld2q_mrc))), 1UL); |
262 | } |
263 | |
264 | if (!group) |
265 | diff --git a/net/core/neighbour.c b/net/core/neighbour.c |
266 | index 69b7ca3..ebd4b21 100644 |
267 | --- a/net/core/neighbour.c |
268 | +++ b/net/core/neighbour.c |
269 | @@ -1442,16 +1442,18 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev, |
270 | atomic_set(&p->refcnt, 1); |
271 | p->reachable_time = |
272 | neigh_rand_reach_time(p->base_reachable_time); |
273 | + dev_hold(dev); |
274 | + p->dev = dev; |
275 | + write_pnet(&p->net, hold_net(net)); |
276 | + p->sysctl_table = NULL; |
277 | |
278 | if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) { |
279 | + release_net(net); |
280 | + dev_put(dev); |
281 | kfree(p); |
282 | return NULL; |
283 | } |
284 | |
285 | - dev_hold(dev); |
286 | - p->dev = dev; |
287 | - write_pnet(&p->net, hold_net(net)); |
288 | - p->sysctl_table = NULL; |
289 | write_lock_bh(&tbl->lock); |
290 | p->next = tbl->parms.next; |
291 | tbl->parms.next = p; |
292 | diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c |
293 | index 0c28508..77d1550 100644 |
294 | --- a/net/core/sysctl_net_core.c |
295 | +++ b/net/core/sysctl_net_core.c |
296 | @@ -19,6 +19,9 @@ |
297 | #include <net/sock.h> |
298 | #include <net/net_ratelimit.h> |
299 | |
300 | +static int zero = 0; |
301 | +static int ushort_max = USHRT_MAX; |
302 | + |
303 | #ifdef CONFIG_RPS |
304 | static int rps_sock_flow_sysctl(ctl_table *table, int write, |
305 | void __user *buffer, size_t *lenp, loff_t *ppos) |
306 | @@ -197,7 +200,9 @@ static struct ctl_table netns_core_table[] = { |
307 | .data = &init_net.core.sysctl_somaxconn, |
308 | .maxlen = sizeof(int), |
309 | .mode = 0644, |
310 | - .proc_handler = proc_dointvec |
311 | + .extra1 = &zero, |
312 | + .extra2 = &ushort_max, |
313 | + .proc_handler = proc_dointvec_minmax |
314 | }, |
315 | { } |
316 | }; |
317 | diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c |
318 | index 30b88d7..424704a 100644 |
319 | --- a/net/ipv4/fib_trie.c |
320 | +++ b/net/ipv4/fib_trie.c |
321 | @@ -71,7 +71,6 @@ |
322 | #include <linux/init.h> |
323 | #include <linux/list.h> |
324 | #include <linux/slab.h> |
325 | -#include <linux/prefetch.h> |
326 | #include <linux/export.h> |
327 | #include <net/net_namespace.h> |
328 | #include <net/ip.h> |
329 | @@ -1772,10 +1771,8 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct rt_trie_node *c) |
330 | if (!c) |
331 | continue; |
332 | |
333 | - if (IS_LEAF(c)) { |
334 | - prefetch(rcu_dereference_rtnl(p->child[idx])); |
335 | + if (IS_LEAF(c)) |
336 | return (struct leaf *) c; |
337 | - } |
338 | |
339 | /* Rescan start scanning in new node */ |
340 | p = (struct tnode *) c; |
341 | diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c |
342 | index a9077f4..b6ae92a 100644 |
343 | --- a/net/ipv4/tcp_cubic.c |
344 | +++ b/net/ipv4/tcp_cubic.c |
345 | @@ -206,8 +206,8 @@ static u32 cubic_root(u64 a) |
346 | */ |
347 | static inline void bictcp_update(struct bictcp *ca, u32 cwnd) |
348 | { |
349 | - u64 offs; |
350 | - u32 delta, t, bic_target, max_cnt; |
351 | + u32 delta, bic_target, max_cnt; |
352 | + u64 offs, t; |
353 | |
354 | ca->ack_cnt++; /* count the number of ACKs */ |
355 | |
356 | @@ -250,9 +250,11 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd) |
357 | * if the cwnd < 1 million packets !!! |
358 | */ |
359 | |
360 | + t = (s32)(tcp_time_stamp - ca->epoch_start); |
361 | + t += msecs_to_jiffies(ca->delay_min >> 3); |
362 | /* change the unit from HZ to bictcp_HZ */ |
363 | - t = ((tcp_time_stamp + msecs_to_jiffies(ca->delay_min>>3) |
364 | - - ca->epoch_start) << BICTCP_HZ) / HZ; |
365 | + t <<= BICTCP_HZ; |
366 | + do_div(t, HZ); |
367 | |
368 | if (t < ca->bic_K) /* t - K */ |
369 | offs = ca->bic_K - t; |
370 | @@ -414,7 +416,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us) |
371 | return; |
372 | |
373 | /* Discard delay samples right after fast recovery */ |
374 | - if ((s32)(tcp_time_stamp - ca->epoch_start) < HZ) |
375 | + if (ca->epoch_start && (s32)(tcp_time_stamp - ca->epoch_start) < HZ) |
376 | return; |
377 | |
378 | delay = (rtt_us << 3) / USEC_PER_MSEC; |
379 | diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c |
380 | index d427f1b..abfa007 100644 |
381 | --- a/net/ipv6/addrconf.c |
382 | +++ b/net/ipv6/addrconf.c |
383 | @@ -910,12 +910,10 @@ retry: |
384 | if (ifp->flags & IFA_F_OPTIMISTIC) |
385 | addr_flags |= IFA_F_OPTIMISTIC; |
386 | |
387 | - ift = !max_addresses || |
388 | - ipv6_count_addresses(idev) < max_addresses ? |
389 | - ipv6_add_addr(idev, &addr, tmp_plen, |
390 | - ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK, |
391 | - addr_flags) : NULL; |
392 | - if (!ift || IS_ERR(ift)) { |
393 | + ift = ipv6_add_addr(idev, &addr, tmp_plen, |
394 | + ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK, |
395 | + addr_flags); |
396 | + if (IS_ERR(ift)) { |
397 | in6_ifa_put(ifp); |
398 | in6_dev_put(idev); |
399 | printk(KERN_INFO |
400 | diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c |
401 | index 27ac95a..dbf20f6 100644 |
402 | --- a/net/ipv6/icmp.c |
403 | +++ b/net/ipv6/icmp.c |
404 | @@ -917,6 +917,14 @@ static const struct icmp6_err { |
405 | .err = ECONNREFUSED, |
406 | .fatal = 1, |
407 | }, |
408 | + { /* POLICY_FAIL */ |
409 | + .err = EACCES, |
410 | + .fatal = 1, |
411 | + }, |
412 | + { /* REJECT_ROUTE */ |
413 | + .err = EACCES, |
414 | + .fatal = 1, |
415 | + }, |
416 | }; |
417 | |
418 | int icmpv6_err_convert(u8 type, u8 code, int *err) |
419 | @@ -928,7 +936,7 @@ int icmpv6_err_convert(u8 type, u8 code, int *err) |
420 | switch (type) { |
421 | case ICMPV6_DEST_UNREACH: |
422 | fatal = 1; |
423 | - if (code <= ICMPV6_PORT_UNREACH) { |
424 | + if (code < ARRAY_SIZE(tab_unreach)) { |
425 | *err = tab_unreach[code].err; |
426 | fatal = tab_unreach[code].fatal; |
427 | } |
428 | diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c |
429 | index c3a007d..5bb77a6 100644 |
430 | --- a/net/ipv6/ip6_fib.c |
431 | +++ b/net/ipv6/ip6_fib.c |
432 | @@ -949,14 +949,22 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root, |
433 | |
434 | if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) { |
435 | #ifdef CONFIG_IPV6_SUBTREES |
436 | - if (fn->subtree) |
437 | - fn = fib6_lookup_1(fn->subtree, args + 1); |
438 | + if (fn->subtree) { |
439 | + struct fib6_node *sfn; |
440 | + sfn = fib6_lookup_1(fn->subtree, |
441 | + args + 1); |
442 | + if (!sfn) |
443 | + goto backtrack; |
444 | + fn = sfn; |
445 | + } |
446 | #endif |
447 | - if (!fn || fn->fn_flags & RTN_RTINFO) |
448 | + if (fn->fn_flags & RTN_RTINFO) |
449 | return fn; |
450 | } |
451 | } |
452 | - |
453 | +#ifdef CONFIG_IPV6_SUBTREES |
454 | +backtrack: |
455 | +#endif |
456 | if (fn->fn_flags & RTN_ROOT) |
457 | break; |
458 | |
459 | diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c |
460 | index 843d6eb..5cc78e6 100644 |
461 | --- a/net/ipv6/ndisc.c |
462 | +++ b/net/ipv6/ndisc.c |
463 | @@ -441,7 +441,6 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev, |
464 | int hlen = LL_RESERVED_SPACE(dev); |
465 | int tlen = dev->needed_tailroom; |
466 | int len; |
467 | - int err; |
468 | u8 *opt; |
469 | |
470 | if (!dev->addr_len) |
471 | @@ -451,14 +450,12 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev, |
472 | if (llinfo) |
473 | len += ndisc_opt_addr_space(dev); |
474 | |
475 | - skb = sock_alloc_send_skb(sk, |
476 | - (MAX_HEADER + sizeof(struct ipv6hdr) + |
477 | - len + hlen + tlen), |
478 | - 1, &err); |
479 | + skb = alloc_skb((MAX_HEADER + sizeof(struct ipv6hdr) + |
480 | + len + hlen + tlen), GFP_ATOMIC); |
481 | if (!skb) { |
482 | ND_PRINTK0(KERN_ERR |
483 | - "ICMPv6 ND: %s() failed to allocate an skb, err=%d.\n", |
484 | - __func__, err); |
485 | + "ICMPv6 ND: %s() failed to allocate an skb.\n", |
486 | + __func__); |
487 | return NULL; |
488 | } |
489 | |
490 | @@ -486,6 +483,11 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev, |
491 | csum_partial(hdr, |
492 | len, 0)); |
493 | |
494 | + /* Manually assign socket ownership as we avoid calling |
495 | + * sock_alloc_send_pskb() to bypass wmem buffer limits |
496 | + */ |
497 | + skb_set_owner_w(skb, sk); |
498 | + |
499 | return skb; |
500 | } |
501 | |
502 | diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c |
503 | index 6bda7aa..ff900ac 100644 |
504 | --- a/net/ipv6/reassembly.c |
505 | +++ b/net/ipv6/reassembly.c |
506 | @@ -516,6 +516,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, |
507 | head->tstamp = fq->q.stamp; |
508 | ipv6_hdr(head)->payload_len = htons(payload_len); |
509 | IP6CB(head)->nhoff = nhoff; |
510 | + IP6CB(head)->flags |= IP6SKB_FRAGMENTED; |
511 | |
512 | /* Yes, and fold redundant checksum back. 8) */ |
513 | if (head->ip_summed == CHECKSUM_COMPLETE) |
514 | @@ -551,6 +552,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
515 | const struct ipv6hdr *hdr = ipv6_hdr(skb); |
516 | struct net *net = dev_net(skb_dst(skb)->dev); |
517 | |
518 | + if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED) |
519 | + goto fail_hdr; |
520 | + |
521 | IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS); |
522 | |
523 | /* Jumbo payload inhibits frag. header */ |
524 | @@ -571,6 +575,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb) |
525 | ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS); |
526 | |
527 | IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb); |
528 | + IP6CB(skb)->flags |= IP6SKB_FRAGMENTED; |
529 | return 1; |
530 | } |
531 | |
532 | diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c |
533 | index 7ee7121..c4717e8 100644 |
534 | --- a/net/ipv6/tcp_ipv6.c |
535 | +++ b/net/ipv6/tcp_ipv6.c |
536 | @@ -1571,7 +1571,7 @@ ipv6_pktoptions: |
537 | if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) |
538 | np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit; |
539 | if (np->rxopt.bits.rxtclass) |
540 | - np->rcv_tclass = ipv6_tclass(ipv6_hdr(skb)); |
541 | + np->rcv_tclass = ipv6_tclass(ipv6_hdr(opt_skb)); |
542 | if (ipv6_opt_accepted(sk, opt_skb)) { |
543 | skb_set_owner_r(opt_skb, sk); |
544 | opt_skb = xchg(&np->pktoptions, opt_skb); |
545 | diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c |
546 | index f08b9166..caa5aff 100644 |
547 | --- a/net/sched/sch_htb.c |
548 | +++ b/net/sched/sch_htb.c |
549 | @@ -86,7 +86,7 @@ struct htb_class { |
550 | unsigned int children; |
551 | struct htb_class *parent; /* parent class */ |
552 | |
553 | - int prio; /* these two are used only by leaves... */ |
554 | + u32 prio; /* these two are used only by leaves... */ |
555 | int quantum; /* but stored for parent-to-leaf return */ |
556 | |
557 | union { |
558 | diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c |
559 | index 527e3f0..dd625af 100644 |
560 | --- a/net/tipc/eth_media.c |
561 | +++ b/net/tipc/eth_media.c |
562 | @@ -53,6 +53,7 @@ struct eth_bearer { |
563 | struct tipc_bearer *bearer; |
564 | struct net_device *dev; |
565 | struct packet_type tipc_packet_type; |
566 | + struct work_struct setup; |
567 | struct work_struct cleanup; |
568 | }; |
569 | |
570 | @@ -138,6 +139,17 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev, |
571 | } |
572 | |
573 | /** |
574 | + * setup_bearer - setup association between Ethernet bearer and interface |
575 | + */ |
576 | +static void setup_bearer(struct work_struct *work) |
577 | +{ |
578 | + struct eth_bearer *eb_ptr = |
579 | + container_of(work, struct eth_bearer, setup); |
580 | + |
581 | + dev_add_pack(&eb_ptr->tipc_packet_type); |
582 | +} |
583 | + |
584 | +/** |
585 | * enable_bearer - attach TIPC bearer to an Ethernet interface |
586 | */ |
587 | |
588 | @@ -181,7 +193,8 @@ static int enable_bearer(struct tipc_bearer *tb_ptr) |
589 | eb_ptr->tipc_packet_type.func = recv_msg; |
590 | eb_ptr->tipc_packet_type.af_packet_priv = eb_ptr; |
591 | INIT_LIST_HEAD(&(eb_ptr->tipc_packet_type.list)); |
592 | - dev_add_pack(&eb_ptr->tipc_packet_type); |
593 | + INIT_WORK(&eb_ptr->setup, setup_bearer); |
594 | + schedule_work(&eb_ptr->setup); |
595 | |
596 | /* Associate TIPC bearer with Ethernet bearer */ |
597 |