Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0167-3.4.68-all-fixes.patch

    Annotation of /trunk/kernel-lts/patches-3.4/0167-3.4.68-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2322 - (hide annotations) (download)
    Mon Nov 18 12:00:12 2013 UTC (10 years, 7 months ago) by niro
    File size: 40078 byte(s) 
    -linux-3.4.68
    1 niro 2322 diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
    2     index 77e1e6cd66ce..2894461e0bdb 100644
    3     --- a/drivers/connector/cn_proc.c
    4     +++ b/drivers/connector/cn_proc.c
    5     @@ -64,6 +64,7 @@ void proc_fork_connector(struct task_struct *task)
    6    
    7     msg = (struct cn_msg*)buffer;
    8     ev = (struct proc_event*)msg->data;
    9     + memset(&ev->event_data, 0, sizeof(ev->event_data));
    10     get_seq(&msg->seq, &ev->cpu);
    11     ktime_get_ts(&ts); /* get high res monotonic timestamp */
    12     put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    13     @@ -79,6 +80,7 @@ void proc_fork_connector(struct task_struct *task)
    14     memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    15     msg->ack = 0; /* not used */
    16     msg->len = sizeof(*ev);
    17     + msg->flags = 0; /* not used */
    18     /* If cn_netlink_send() failed, the data is not sent */
    19     cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    20     }
    21     @@ -95,6 +97,7 @@ void proc_exec_connector(struct task_struct *task)
    22    
    23     msg = (struct cn_msg*)buffer;
    24     ev = (struct proc_event*)msg->data;
    25     + memset(&ev->event_data, 0, sizeof(ev->event_data));
    26     get_seq(&msg->seq, &ev->cpu);
    27     ktime_get_ts(&ts); /* get high res monotonic timestamp */
    28     put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    29     @@ -105,6 +108,7 @@ void proc_exec_connector(struct task_struct *task)
    30     memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    31     msg->ack = 0; /* not used */
    32     msg->len = sizeof(*ev);
    33     + msg->flags = 0; /* not used */
    34     cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    35     }
    36    
    37     @@ -121,6 +125,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
    38    
    39     msg = (struct cn_msg*)buffer;
    40     ev = (struct proc_event*)msg->data;
    41     + memset(&ev->event_data, 0, sizeof(ev->event_data));
    42     ev->what = which_id;
    43     ev->event_data.id.process_pid = task->pid;
    44     ev->event_data.id.process_tgid = task->tgid;
    45     @@ -144,6 +149,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
    46     memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    47     msg->ack = 0; /* not used */
    48     msg->len = sizeof(*ev);
    49     + msg->flags = 0; /* not used */
    50     cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    51     }
    52    
    53     @@ -159,6 +165,7 @@ void proc_sid_connector(struct task_struct *task)
    54    
    55     msg = (struct cn_msg *)buffer;
    56     ev = (struct proc_event *)msg->data;
    57     + memset(&ev->event_data, 0, sizeof(ev->event_data));
    58     get_seq(&msg->seq, &ev->cpu);
    59     ktime_get_ts(&ts); /* get high res monotonic timestamp */
    60     put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    61     @@ -169,6 +176,7 @@ void proc_sid_connector(struct task_struct *task)
    62     memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    63     msg->ack = 0; /* not used */
    64     msg->len = sizeof(*ev);
    65     + msg->flags = 0; /* not used */
    66     cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    67     }
    68    
    69     @@ -184,6 +192,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
    70    
    71     msg = (struct cn_msg *)buffer;
    72     ev = (struct proc_event *)msg->data;
    73     + memset(&ev->event_data, 0, sizeof(ev->event_data));
    74     get_seq(&msg->seq, &ev->cpu);
    75     ktime_get_ts(&ts); /* get high res monotonic timestamp */
    76     put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    77     @@ -202,6 +211,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
    78     memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    79     msg->ack = 0; /* not used */
    80     msg->len = sizeof(*ev);
    81     + msg->flags = 0; /* not used */
    82     cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    83     }
    84    
    85     @@ -217,6 +227,7 @@ void proc_comm_connector(struct task_struct *task)
    86    
    87     msg = (struct cn_msg *)buffer;
    88     ev = (struct proc_event *)msg->data;
    89     + memset(&ev->event_data, 0, sizeof(ev->event_data));
    90     get_seq(&msg->seq, &ev->cpu);
    91     ktime_get_ts(&ts); /* get high res monotonic timestamp */
    92     put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    93     @@ -228,6 +239,7 @@ void proc_comm_connector(struct task_struct *task)
    94     memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    95     msg->ack = 0; /* not used */
    96     msg->len = sizeof(*ev);
    97     + msg->flags = 0; /* not used */
    98     cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    99     }
    100    
    101     @@ -243,6 +255,7 @@ void proc_exit_connector(struct task_struct *task)
    102    
    103     msg = (struct cn_msg*)buffer;
    104     ev = (struct proc_event*)msg->data;
    105     + memset(&ev->event_data, 0, sizeof(ev->event_data));
    106     get_seq(&msg->seq, &ev->cpu);
    107     ktime_get_ts(&ts); /* get high res monotonic timestamp */
    108     put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    109     @@ -255,6 +268,7 @@ void proc_exit_connector(struct task_struct *task)
    110     memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    111     msg->ack = 0; /* not used */
    112     msg->len = sizeof(*ev);
    113     + msg->flags = 0; /* not used */
    114     cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    115     }
    116    
    117     @@ -278,6 +292,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
    118    
    119     msg = (struct cn_msg*)buffer;
    120     ev = (struct proc_event*)msg->data;
    121     + memset(&ev->event_data, 0, sizeof(ev->event_data));
    122     msg->seq = rcvd_seq;
    123     ktime_get_ts(&ts); /* get high res monotonic timestamp */
    124     put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    125     @@ -287,6 +302,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
    126     memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    127     msg->ack = rcvd_ack + 1;
    128     msg->len = sizeof(*ev);
    129     + msg->flags = 0; /* not used */
    130     cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    131     }
    132    
    133     diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
    134     index dde6a0fad408..ea6efe86468e 100644
    135     --- a/drivers/connector/connector.c
    136     +++ b/drivers/connector/connector.c
    137     @@ -157,17 +157,18 @@ static int cn_call_callback(struct sk_buff *skb)
    138     static void cn_rx_skb(struct sk_buff *__skb)
    139     {
    140     struct nlmsghdr *nlh;
    141     - int err;
    142     struct sk_buff *skb;
    143     + int len, err;
    144    
    145     skb = skb_get(__skb);
    146    
    147     if (skb->len >= NLMSG_SPACE(0)) {
    148     nlh = nlmsg_hdr(skb);
    149     + len = nlmsg_len(nlh);
    150    
    151     - if (nlh->nlmsg_len < sizeof(struct cn_msg) ||
    152     + if (len < (int)sizeof(struct cn_msg) ||
    153     skb->len < nlh->nlmsg_len ||
    154     - nlh->nlmsg_len > CONNECTOR_MAX_MSG_SIZE) {
    155     + len > CONNECTOR_MAX_MSG_SIZE) {
    156     kfree_skb(skb);
    157     return;
    158     }
    159     diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
    160     index 4caa8e6d59d7..2d2b1b7588d7 100644
    161     --- a/drivers/md/dm-snap-persistent.c
    162     +++ b/drivers/md/dm-snap-persistent.c
    163     @@ -269,6 +269,14 @@ static chunk_t area_location(struct pstore *ps, chunk_t area)
    164     return NUM_SNAPSHOT_HDR_CHUNKS + ((ps->exceptions_per_area + 1) * area);
    165     }
    166    
    167     +static void skip_metadata(struct pstore *ps)
    168     +{
    169     + uint32_t stride = ps->exceptions_per_area + 1;
    170     + chunk_t next_free = ps->next_free;
    171     + if (sector_div(next_free, stride) == NUM_SNAPSHOT_HDR_CHUNKS)
    172     + ps->next_free++;
    173     +}
    174     +
    175     /*
    176     * Read or write a metadata area. Remembering to skip the first
    177     * chunk which holds the header.
    178     @@ -502,6 +510,8 @@ static int read_exceptions(struct pstore *ps,
    179    
    180     ps->current_area--;
    181    
    182     + skip_metadata(ps);
    183     +
    184     return 0;
    185     }
    186    
    187     @@ -616,8 +626,6 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
    188     struct dm_exception *e)
    189     {
    190     struct pstore *ps = get_info(store);
    191     - uint32_t stride;
    192     - chunk_t next_free;
    193     sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
    194    
    195     /* Is there enough room ? */
    196     @@ -630,10 +638,8 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
    197     * Move onto the next free pending, making sure to take
    198     * into account the location of the metadata chunks.
    199     */
    200     - stride = (ps->exceptions_per_area + 1);
    201     - next_free = ++ps->next_free;
    202     - if (sector_div(next_free, stride) == 1)
    203     - ps->next_free++;
    204     + ps->next_free++;
    205     + skip_metadata(ps);
    206    
    207     atomic_inc(&ps->pending_count);
    208     return 0;
    209     diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
    210     index e86f4c37f981..c2cdefa1651e 100644
    211     --- a/drivers/net/can/dev.c
    212     +++ b/drivers/net/can/dev.c
    213     @@ -665,14 +665,14 @@ static size_t can_get_size(const struct net_device *dev)
    214     size_t size;
    215    
    216     size = nla_total_size(sizeof(u32)); /* IFLA_CAN_STATE */
    217     - size += sizeof(struct can_ctrlmode); /* IFLA_CAN_CTRLMODE */
    218     + size += nla_total_size(sizeof(struct can_ctrlmode)); /* IFLA_CAN_CTRLMODE */
    219     size += nla_total_size(sizeof(u32)); /* IFLA_CAN_RESTART_MS */
    220     - size += sizeof(struct can_bittiming); /* IFLA_CAN_BITTIMING */
    221     - size += sizeof(struct can_clock); /* IFLA_CAN_CLOCK */
    222     + size += nla_total_size(sizeof(struct can_bittiming)); /* IFLA_CAN_BITTIMING */
    223     + size += nla_total_size(sizeof(struct can_clock)); /* IFLA_CAN_CLOCK */
    224     if (priv->do_get_berr_counter) /* IFLA_CAN_BERR_COUNTER */
    225     - size += sizeof(struct can_berr_counter);
    226     + size += nla_total_size(sizeof(struct can_berr_counter));
    227     if (priv->bittiming_const) /* IFLA_CAN_BITTIMING_CONST */
    228     - size += sizeof(struct can_bittiming_const);
    229     + size += nla_total_size(sizeof(struct can_bittiming_const));
    230    
    231     return size;
    232     }
    233     diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
    234     index acd824660367..e45b8b6d6848 100644
    235     --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
    236     +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
    237     @@ -547,6 +547,7 @@ static inline void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
    238     skb, cqe, cqe_idx)) {
    239     if (tpa_info->parsing_flags & PARSING_FLAGS_VLAN)
    240     __vlan_hwaccel_put_tag(skb, tpa_info->vlan_tag);
    241     + skb_record_rx_queue(skb, fp->rx_queue);
    242     napi_gro_receive(&fp->napi, skb);
    243     } else {
    244     DP(NETIF_MSG_RX_STATUS,
    245     diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
    246     index 5e1ca0f05090..ffa6a72dcc60 100644
    247     --- a/drivers/net/ethernet/marvell/mv643xx_eth.c
    248     +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
    249     @@ -1274,15 +1274,13 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
    250     p->rx_discard += rdlp(mp, RX_DISCARD_FRAME_CNT);
    251     p->rx_overrun += rdlp(mp, RX_OVERRUN_FRAME_CNT);
    252     spin_unlock_bh(&mp->mib_counters_lock);
    253     -
    254     - mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
    255     }
    256    
    257     static void mib_counters_timer_wrapper(unsigned long _mp)
    258     {
    259     struct mv643xx_eth_private *mp = (void *)_mp;
    260     -
    261     mib_counters_update(mp);
    262     + mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
    263     }
    264    
    265    
    266     @@ -2370,6 +2368,7 @@ static int mv643xx_eth_open(struct net_device *dev)
    267     mp->int_mask |= INT_TX_END_0 << i;
    268     }
    269    
    270     + add_timer(&mp->mib_counters_timer);
    271     port_start(mp);
    272    
    273     wrlp(mp, INT_MASK_EXT, INT_EXT_LINK_PHY | INT_EXT_TX);
    274     @@ -2911,7 +2910,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
    275     mp->mib_counters_timer.data = (unsigned long)mp;
    276     mp->mib_counters_timer.function = mib_counters_timer_wrapper;
    277     mp->mib_counters_timer.expires = jiffies + 30 * HZ;
    278     - add_timer(&mp->mib_counters_timer);
    279    
    280     spin_lock_init(&mp->mib_counters_lock);
    281    
    282     diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
    283     index 43fada572596..c336d36cf5ca 100644
    284     --- a/drivers/net/ethernet/ti/davinci_emac.c
    285     +++ b/drivers/net/ethernet/ti/davinci_emac.c
    286     @@ -875,8 +875,7 @@ static void emac_dev_mcast_set(struct net_device *ndev)
    287     netdev_mc_count(ndev) > EMAC_DEF_MAX_MULTICAST_ADDRESSES) {
    288     mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
    289     emac_add_mcast(priv, EMAC_ALL_MULTI_SET, NULL);
    290     - }
    291     - if (!netdev_mc_empty(ndev)) {
    292     + } else if (!netdev_mc_empty(ndev)) {
    293     struct netdev_hw_addr *ha;
    294    
    295     mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
    296     diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
    297     index 1a623183cbe5..3710427c3fe1 100644
    298     --- a/drivers/net/wan/farsync.c
    299     +++ b/drivers/net/wan/farsync.c
    300     @@ -1972,6 +1972,7 @@ fst_get_iface(struct fst_card_info *card, struct fst_port_info *port,
    301     }
    302    
    303     i = port->index;
    304     + memset(&sync, 0, sizeof(sync));
    305     sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed);
    306     /* Lucky card and linux use same encoding here */
    307     sync.clock_type = FST_RDB(card, portConfig[i].internalClock) ==
    308     diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c
    309     index feb7541b33fb..ccd496bf32d9 100644
    310     --- a/drivers/net/wan/wanxl.c
    311     +++ b/drivers/net/wan/wanxl.c
    312     @@ -355,6 +355,7 @@ static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    313     ifr->ifr_settings.size = size; /* data size wanted */
    314     return -ENOBUFS;
    315     }
    316     + memset(&line, 0, sizeof(line));
    317     line.clock_type = get_status(port)->clocking;
    318     line.clock_rate = 0;
    319     line.loopback = 0;
    320     diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    321     index 9def72f018e0..b3440c66a995 100644
    322     --- a/drivers/usb/serial/option.c
    323     +++ b/drivers/usb/serial/option.c
    324     @@ -457,6 +457,10 @@ static void option_instat_callback(struct urb *urb);
    325     #define CHANGHONG_VENDOR_ID 0x2077
    326     #define CHANGHONG_PRODUCT_CH690 0x7001
    327    
    328     +/* Inovia */
    329     +#define INOVIA_VENDOR_ID 0x20a6
    330     +#define INOVIA_SEW858 0x1105
    331     +
    332     /* some devices interfaces need special handling due to a number of reasons */
    333     enum option_blacklist_reason {
    334     OPTION_BLACKLIST_NONE = 0,
    335     @@ -1279,7 +1283,9 @@ static const struct usb_device_id option_ids[] = {
    336    
    337     { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
    338     { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
    339     - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
    340     + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
    341     + .driver_info = (kernel_ulong_t)&net_intf6_blacklist
    342     + },
    343     { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
    344     { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
    345     { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
    346     @@ -1367,6 +1373,7 @@ static const struct usb_device_id option_ids[] = {
    347     { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
    348     { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
    349     { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
    350     + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
    351     { } /* Terminating entry */
    352     };
    353     MODULE_DEVICE_TABLE(usb, option_ids);
    354     diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
    355     index a7492ba5371a..1b0430e00b75 100644
    356     --- a/drivers/usb/serial/ti_usb_3410_5052.c
    357     +++ b/drivers/usb/serial/ti_usb_3410_5052.c
    358     @@ -210,6 +210,7 @@ static struct usb_device_id ti_id_table_combined[19+2*TI_EXTRA_VID_PID_COUNT+1]
    359     { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
    360     { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
    361     { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
    362     + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
    363     { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
    364     { }
    365     };
    366     diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
    367     index cc761ad8fa57..92490e9f85ca 100644
    368     --- a/fs/ext3/dir.c
    369     +++ b/fs/ext3/dir.c
    370     @@ -21,30 +21,15 @@
    371     *
    372     */
    373    
    374     +#include <linux/compat.h>
    375     #include "ext3.h"
    376    
    377     static unsigned char ext3_filetype_table[] = {
    378     DT_UNKNOWN, DT_REG, DT_DIR, DT_CHR, DT_BLK, DT_FIFO, DT_SOCK, DT_LNK
    379     };
    380    
    381     -static int ext3_readdir(struct file *, void *, filldir_t);
    382     static int ext3_dx_readdir(struct file * filp,
    383     void * dirent, filldir_t filldir);
    384     -static int ext3_release_dir (struct inode * inode,
    385     - struct file * filp);
    386     -
    387     -const struct file_operations ext3_dir_operations = {
    388     - .llseek = generic_file_llseek,
    389     - .read = generic_read_dir,
    390     - .readdir = ext3_readdir, /* we take BKL. needed?*/
    391     - .unlocked_ioctl = ext3_ioctl,
    392     -#ifdef CONFIG_COMPAT
    393     - .compat_ioctl = ext3_compat_ioctl,
    394     -#endif
    395     - .fsync = ext3_sync_file, /* BKL held */
    396     - .release = ext3_release_dir,
    397     -};
    398     -
    399    
    400     static unsigned char get_dtype(struct super_block *sb, int filetype)
    401     {
    402     @@ -55,6 +40,25 @@ static unsigned char get_dtype(struct super_block *sb, int filetype)
    403     return (ext3_filetype_table[filetype]);
    404     }
    405    
    406     +/**
    407     + * Check if the given dir-inode refers to an htree-indexed directory
    408     + * (or a directory which chould potentially get coverted to use htree
    409     + * indexing).
    410     + *
    411     + * Return 1 if it is a dx dir, 0 if not
    412     + */
    413     +static int is_dx_dir(struct inode *inode)
    414     +{
    415     + struct super_block *sb = inode->i_sb;
    416     +
    417     + if (EXT3_HAS_COMPAT_FEATURE(inode->i_sb,
    418     + EXT3_FEATURE_COMPAT_DIR_INDEX) &&
    419     + ((EXT3_I(inode)->i_flags & EXT3_INDEX_FL) ||
    420     + ((inode->i_size >> sb->s_blocksize_bits) == 1)))
    421     + return 1;
    422     +
    423     + return 0;
    424     +}
    425    
    426     int ext3_check_dir_entry (const char * function, struct inode * dir,
    427     struct ext3_dir_entry_2 * de,
    428     @@ -94,18 +98,13 @@ static int ext3_readdir(struct file * filp,
    429     unsigned long offset;
    430     int i, stored;
    431     struct ext3_dir_entry_2 *de;
    432     - struct super_block *sb;
    433     int err;
    434     struct inode *inode = filp->f_path.dentry->d_inode;
    435     + struct super_block *sb = inode->i_sb;
    436     int ret = 0;
    437     int dir_has_error = 0;
    438    
    439     - sb = inode->i_sb;
    440     -
    441     - if (EXT3_HAS_COMPAT_FEATURE(inode->i_sb,
    442     - EXT3_FEATURE_COMPAT_DIR_INDEX) &&
    443     - ((EXT3_I(inode)->i_flags & EXT3_INDEX_FL) ||
    444     - ((inode->i_size >> sb->s_blocksize_bits) == 1))) {
    445     + if (is_dx_dir(inode)) {
    446     err = ext3_dx_readdir(filp, dirent, filldir);
    447     if (err != ERR_BAD_DX_DIR) {
    448     ret = err;
    449     @@ -227,22 +226,87 @@ out:
    450     return ret;
    451     }
    452    
    453     +static inline int is_32bit_api(void)
    454     +{
    455     +#ifdef CONFIG_COMPAT
    456     + return is_compat_task();
    457     +#else
    458     + return (BITS_PER_LONG == 32);
    459     +#endif
    460     +}
    461     +
    462     /*
    463     * These functions convert from the major/minor hash to an f_pos
    464     - * value.
    465     + * value for dx directories
    466     *
    467     - * Currently we only use major hash numer. This is unfortunate, but
    468     - * on 32-bit machines, the same VFS interface is used for lseek and
    469     - * llseek, so if we use the 64 bit offset, then the 32-bit versions of
    470     - * lseek/telldir/seekdir will blow out spectacularly, and from within
    471     - * the ext2 low-level routine, we don't know if we're being called by
    472     - * a 64-bit version of the system call or the 32-bit version of the
    473     - * system call. Worse yet, NFSv2 only allows for a 32-bit readdir
    474     - * cookie. Sigh.
    475     + * Upper layer (for example NFS) should specify FMODE_32BITHASH or
    476     + * FMODE_64BITHASH explicitly. On the other hand, we allow ext3 to be mounted
    477     + * directly on both 32-bit and 64-bit nodes, under such case, neither
    478     + * FMODE_32BITHASH nor FMODE_64BITHASH is specified.
    479     */
    480     -#define hash2pos(major, minor) (major >> 1)
    481     -#define pos2maj_hash(pos) ((pos << 1) & 0xffffffff)
    482     -#define pos2min_hash(pos) (0)
    483     +static inline loff_t hash2pos(struct file *filp, __u32 major, __u32 minor)
    484     +{
    485     + if ((filp->f_mode & FMODE_32BITHASH) ||
    486     + (!(filp->f_mode & FMODE_64BITHASH) && is_32bit_api()))
    487     + return major >> 1;
    488     + else
    489     + return ((__u64)(major >> 1) << 32) | (__u64)minor;
    490     +}
    491     +
    492     +static inline __u32 pos2maj_hash(struct file *filp, loff_t pos)
    493     +{
    494     + if ((filp->f_mode & FMODE_32BITHASH) ||
    495     + (!(filp->f_mode & FMODE_64BITHASH) && is_32bit_api()))
    496     + return (pos << 1) & 0xffffffff;
    497     + else
    498     + return ((pos >> 32) << 1) & 0xffffffff;
    499     +}
    500     +
    501     +static inline __u32 pos2min_hash(struct file *filp, loff_t pos)
    502     +{
    503     + if ((filp->f_mode & FMODE_32BITHASH) ||
    504     + (!(filp->f_mode & FMODE_64BITHASH) && is_32bit_api()))
    505     + return 0;
    506     + else
    507     + return pos & 0xffffffff;
    508     +}
    509     +
    510     +/*
    511     + * Return 32- or 64-bit end-of-file for dx directories
    512     + */
    513     +static inline loff_t ext3_get_htree_eof(struct file *filp)
    514     +{
    515     + if ((filp->f_mode & FMODE_32BITHASH) ||
    516     + (!(filp->f_mode & FMODE_64BITHASH) && is_32bit_api()))
    517     + return EXT3_HTREE_EOF_32BIT;
    518     + else
    519     + return EXT3_HTREE_EOF_64BIT;
    520     +}
    521     +
    522     +
    523     +/*
    524     + * ext3_dir_llseek() calls generic_file_llseek[_size]() to handle both
    525     + * non-htree and htree directories, where the "offset" is in terms
    526     + * of the filename hash value instead of the byte offset.
    527     + *
    528     + * Because we may return a 64-bit hash that is well beyond s_maxbytes,
    529     + * we need to pass the max hash as the maximum allowable offset in
    530     + * the htree directory case.
    531     + *
    532     + * NOTE: offsets obtained *before* ext3_set_inode_flag(dir, EXT3_INODE_INDEX)
    533     + * will be invalid once the directory was converted into a dx directory
    534     + */
    535     +loff_t ext3_dir_llseek(struct file *file, loff_t offset, int origin)
    536     +{
    537     + struct inode *inode = file->f_mapping->host;
    538     + int dx_dir = is_dx_dir(inode);
    539     +
    540     + if (likely(dx_dir))
    541     + return generic_file_llseek_size(file, offset, origin,
    542     + ext3_get_htree_eof(file));
    543     + else
    544     + return generic_file_llseek(file, offset, origin);
    545     +}
    546    
    547     /*
    548     * This structure holds the nodes of the red-black tree used to store
    549     @@ -303,15 +367,16 @@ static void free_rb_tree_fname(struct rb_root *root)
    550     }
    551    
    552    
    553     -static struct dir_private_info *ext3_htree_create_dir_info(loff_t pos)
    554     +static struct dir_private_info *ext3_htree_create_dir_info(struct file *filp,
    555     + loff_t pos)
    556     {
    557     struct dir_private_info *p;
    558    
    559     p = kzalloc(sizeof(struct dir_private_info), GFP_KERNEL);
    560     if (!p)
    561     return NULL;
    562     - p->curr_hash = pos2maj_hash(pos);
    563     - p->curr_minor_hash = pos2min_hash(pos);
    564     + p->curr_hash = pos2maj_hash(filp, pos);
    565     + p->curr_minor_hash = pos2min_hash(filp, pos);
    566     return p;
    567     }
    568    
    569     @@ -401,7 +466,7 @@ static int call_filldir(struct file * filp, void * dirent,
    570     printk("call_filldir: called with null fname?!?\n");
    571     return 0;
    572     }
    573     - curr_pos = hash2pos(fname->hash, fname->minor_hash);
    574     + curr_pos = hash2pos(filp, fname->hash, fname->minor_hash);
    575     while (fname) {
    576     error = filldir(dirent, fname->name,
    577     fname->name_len, curr_pos,
    578     @@ -426,13 +491,13 @@ static int ext3_dx_readdir(struct file * filp,
    579     int ret;
    580    
    581     if (!info) {
    582     - info = ext3_htree_create_dir_info(filp->f_pos);
    583     + info = ext3_htree_create_dir_info(filp, filp->f_pos);
    584     if (!info)
    585     return -ENOMEM;
    586     filp->private_data = info;
    587     }
    588    
    589     - if (filp->f_pos == EXT3_HTREE_EOF)
    590     + if (filp->f_pos == ext3_get_htree_eof(filp))
    591     return 0; /* EOF */
    592    
    593     /* Some one has messed with f_pos; reset the world */
    594     @@ -440,8 +505,8 @@ static int ext3_dx_readdir(struct file * filp,
    595     free_rb_tree_fname(&info->root);
    596     info->curr_node = NULL;
    597     info->extra_fname = NULL;
    598     - info->curr_hash = pos2maj_hash(filp->f_pos);
    599     - info->curr_minor_hash = pos2min_hash(filp->f_pos);
    600     + info->curr_hash = pos2maj_hash(filp, filp->f_pos);
    601     + info->curr_minor_hash = pos2min_hash(filp, filp->f_pos);
    602     }
    603    
    604     /*
    605     @@ -473,7 +538,7 @@ static int ext3_dx_readdir(struct file * filp,
    606     if (ret < 0)
    607     return ret;
    608     if (ret == 0) {
    609     - filp->f_pos = EXT3_HTREE_EOF;
    610     + filp->f_pos = ext3_get_htree_eof(filp);
    611     break;
    612     }
    613     info->curr_node = rb_first(&info->root);
    614     @@ -493,7 +558,7 @@ static int ext3_dx_readdir(struct file * filp,
    615     info->curr_minor_hash = fname->minor_hash;
    616     } else {
    617     if (info->next_hash == ~0) {
    618     - filp->f_pos = EXT3_HTREE_EOF;
    619     + filp->f_pos = ext3_get_htree_eof(filp);
    620     break;
    621     }
    622     info->curr_hash = info->next_hash;
    623     @@ -512,3 +577,15 @@ static int ext3_release_dir (struct inode * inode, struct file * filp)
    624    
    625     return 0;
    626     }
    627     +
    628     +const struct file_operations ext3_dir_operations = {
    629     + .llseek = ext3_dir_llseek,
    630     + .read = generic_read_dir,
    631     + .readdir = ext3_readdir,
    632     + .unlocked_ioctl = ext3_ioctl,
    633     +#ifdef CONFIG_COMPAT
    634     + .compat_ioctl = ext3_compat_ioctl,
    635     +#endif
    636     + .fsync = ext3_sync_file,
    637     + .release = ext3_release_dir,
    638     +};
    639     diff --git a/fs/ext3/ext3.h b/fs/ext3/ext3.h
    640     index b6515fd7e56c..fe5bef7914ea 100644
    641     --- a/fs/ext3/ext3.h
    642     +++ b/fs/ext3/ext3.h
    643     @@ -920,7 +920,11 @@ struct dx_hash_info
    644     u32 *seed;
    645     };
    646    
    647     -#define EXT3_HTREE_EOF 0x7fffffff
    648     +
    649     +/* 32 and 64 bit signed EOF for dx directories */
    650     +#define EXT3_HTREE_EOF_32BIT ((1UL << (32 - 1)) - 1)
    651     +#define EXT3_HTREE_EOF_64BIT ((1ULL << (64 - 1)) - 1)
    652     +
    653    
    654     /*
    655     * Control parameters used by ext3_htree_next_block
    656     diff --git a/fs/ext3/hash.c b/fs/ext3/hash.c
    657     index d10231ddcf8a..ede315cdf126 100644
    658     --- a/fs/ext3/hash.c
    659     +++ b/fs/ext3/hash.c
    660     @@ -198,8 +198,8 @@ int ext3fs_dirhash(const char *name, int len, struct dx_hash_info *hinfo)
    661     return -1;
    662     }
    663     hash = hash & ~1;
    664     - if (hash == (EXT3_HTREE_EOF << 1))
    665     - hash = (EXT3_HTREE_EOF-1) << 1;
    666     + if (hash == (EXT3_HTREE_EOF_32BIT << 1))
    667     + hash = (EXT3_HTREE_EOF_32BIT - 1) << 1;
    668     hinfo->hash = hash;
    669     hinfo->minor_hash = minor_hash;
    670     return 0;
    671     diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
    672     index dc4d49a0c07d..42b919c36da1 100644
    673     --- a/include/linux/skbuff.h
    674     +++ b/include/linux/skbuff.h
    675     @@ -760,6 +760,16 @@ static inline int skb_cloned(const struct sk_buff *skb)
    676     (atomic_read(&skb_shinfo(skb)->dataref) & SKB_DATAREF_MASK) != 1;
    677     }
    678    
    679     +static inline int skb_unclone(struct sk_buff *skb, gfp_t pri)
    680     +{
    681     + might_sleep_if(pri & __GFP_WAIT);
    682     +
    683     + if (skb_cloned(skb))
    684     + return pskb_expand_head(skb, 0, 0, pri);
    685     +
    686     + return 0;
    687     +}
    688     +
    689     /**
    690     * skb_header_cloned - is the header a clone
    691     * @skb: buffer to check
    692     @@ -1198,6 +1208,11 @@ static inline int skb_pagelen(const struct sk_buff *skb)
    693     return len + skb_headlen(skb);
    694     }
    695    
    696     +static inline bool skb_has_frags(const struct sk_buff *skb)
    697     +{
    698     + return skb_shinfo(skb)->nr_frags;
    699     +}
    700     +
    701     /**
    702     * __skb_fill_page_desc - initialise a paged fragment in an skb
    703     * @skb: buffer containing fragment to be initialised
    704     diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
    705     index a7a683e30b64..a8c2ef6d3b93 100644
    706     --- a/include/net/cipso_ipv4.h
    707     +++ b/include/net/cipso_ipv4.h
    708     @@ -290,6 +290,7 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
    709     unsigned char err_offset = 0;
    710     u8 opt_len = opt[1];
    711     u8 opt_iter;
    712     + u8 tag_len;
    713    
    714     if (opt_len < 8) {
    715     err_offset = 1;
    716     @@ -302,11 +303,12 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
    717     }
    718    
    719     for (opt_iter = 6; opt_iter < opt_len;) {
    720     - if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
    721     + tag_len = opt[opt_iter + 1];
    722     + if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) {
    723     err_offset = opt_iter + 1;
    724     goto out;
    725     }
    726     - opt_iter += opt[opt_iter + 1];
    727     + opt_iter += tag_len;
    728     }
    729    
    730     out:
    731     diff --git a/include/net/dst.h b/include/net/dst.h
    732     index 8197eadca819..1efe71aad089 100644
    733     --- a/include/net/dst.h
    734     +++ b/include/net/dst.h
    735     @@ -464,10 +464,22 @@ static inline struct dst_entry *xfrm_lookup(struct net *net,
    736     {
    737     return dst_orig;
    738     }
    739     +
    740     +static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
    741     +{
    742     + return NULL;
    743     +}
    744     +
    745     #else
    746     extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
    747     const struct flowi *fl, struct sock *sk,
    748     int flags);
    749     +
    750     +/* skb attached with this dst needs transformation if dst->xfrm is valid */
    751     +static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
    752     +{
    753     + return dst->xfrm;
    754     +}
    755     #endif
    756    
    757     #endif /* _NET_DST_H */
    758     diff --git a/mm/page-writeback.c b/mm/page-writeback.c
    759     index bc8465f579a8..3b15e2a147a2 100644
    760     --- a/mm/page-writeback.c
    761     +++ b/mm/page-writeback.c
    762     @@ -1072,11 +1072,11 @@ static unsigned long dirty_poll_interval(unsigned long dirty,
    763     return 1;
    764     }
    765    
    766     -static long bdi_max_pause(struct backing_dev_info *bdi,
    767     - unsigned long bdi_dirty)
    768     +static unsigned long bdi_max_pause(struct backing_dev_info *bdi,
    769     + unsigned long bdi_dirty)
    770     {
    771     - long bw = bdi->avg_write_bandwidth;
    772     - long t;
    773     + unsigned long bw = bdi->avg_write_bandwidth;
    774     + unsigned long t;
    775    
    776     /*
    777     * Limit pause time for small memory systems. If sleeping for too long
    778     @@ -1088,7 +1088,7 @@ static long bdi_max_pause(struct backing_dev_info *bdi,
    779     t = bdi_dirty / (1 + bw / roundup_pow_of_two(1 + HZ / 8));
    780     t++;
    781    
    782     - return min_t(long, t, MAX_PAUSE);
    783     + return min_t(unsigned long, t, MAX_PAUSE);
    784     }
    785    
    786     static long bdi_min_pause(struct backing_dev_info *bdi,
    787     diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
    788     index 50711368ad6a..7f046b4c06bc 100644
    789     --- a/net/8021q/vlan_netlink.c
    790     +++ b/net/8021q/vlan_netlink.c
    791     @@ -152,7 +152,7 @@ static size_t vlan_get_size(const struct net_device *dev)
    792     struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
    793    
    794     return nla_total_size(2) + /* IFLA_VLAN_ID */
    795     - sizeof(struct ifla_vlan_flags) + /* IFLA_VLAN_FLAGS */
    796     + nla_total_size(sizeof(struct ifla_vlan_flags)) + /* IFLA_VLAN_FLAGS */
    797     vlan_qos_map_size(vlan->nr_ingress_mappings) +
    798     vlan_qos_map_size(vlan->nr_egress_mappings);
    799     }
    800     diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
    801     index f774796f7e57..2f100ccef86f 100644
    802     --- a/net/bridge/br_stp_if.c
    803     +++ b/net/bridge/br_stp_if.c
    804     @@ -134,7 +134,7 @@ static void br_stp_start(struct net_bridge *br)
    805    
    806     if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY)
    807     __br_set_forward_delay(br, BR_MIN_FORWARD_DELAY);
    808     - else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY)
    809     + else if (br->bridge_forward_delay > BR_MAX_FORWARD_DELAY)
    810     __br_set_forward_delay(br, BR_MAX_FORWARD_DELAY);
    811    
    812     if (r == 0) {
    813     diff --git a/net/compat.c b/net/compat.c
    814     index 014e1c78ecc5..ee84d82d7287 100644
    815     --- a/net/compat.c
    816     +++ b/net/compat.c
    817     @@ -71,6 +71,8 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
    818     __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
    819     __get_user(kmsg->msg_flags, &umsg->msg_flags))
    820     return -EFAULT;
    821     + if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
    822     + return -EINVAL;
    823     kmsg->msg_name = compat_ptr(tmp1);
    824     kmsg->msg_iov = compat_ptr(tmp2);
    825     kmsg->msg_control = compat_ptr(tmp3);
    826     diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
    827     index 984ec656b03b..4afcf31bdfeb 100644
    828     --- a/net/ipv4/inet_hashtables.c
    829     +++ b/net/ipv4/inet_hashtables.c
    830     @@ -268,7 +268,7 @@ begintw:
    831     }
    832     if (unlikely(!INET_TW_MATCH(sk, net, hash, acookie,
    833     saddr, daddr, ports, dif))) {
    834     - sock_put(sk);
    835     + inet_twsk_put(inet_twsk(sk));
    836     goto begintw;
    837     }
    838     goto out;
    839     diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
    840     index 3bc4c978d7ad..d6407b563fd8 100644
    841     --- a/net/ipv4/ip_output.c
    842     +++ b/net/ipv4/ip_output.c
    843     @@ -846,7 +846,7 @@ static int __ip_append_data(struct sock *sk,
    844     csummode = CHECKSUM_PARTIAL;
    845    
    846     cork->length += length;
    847     - if (((length > mtu) || (skb && skb_is_gso(skb))) &&
    848     + if (((length > mtu) || (skb && skb_has_frags(skb))) &&
    849     (sk->sk_protocol == IPPROTO_UDP) &&
    850     (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
    851     err = ip_ufo_append_data(sk, queue, getfrag, from, length,
    852     diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    853     index 167ea10b521a..108c73d760df 100644
    854     --- a/net/ipv4/route.c
    855     +++ b/net/ipv4/route.c
    856     @@ -2713,7 +2713,7 @@ static struct rtable *ip_route_output_slow(struct net *net, struct flowi4 *fl4)
    857     RT_SCOPE_LINK);
    858     goto make_route;
    859     }
    860     - if (fl4->saddr) {
    861     + if (!fl4->saddr) {
    862     if (ipv4_is_multicast(fl4->daddr))
    863     fl4->saddr = inet_select_addr(dev_out, 0,
    864     fl4->flowi4_scope);
    865     diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    866     index 55d96c392e7f..99eb909c9d5f 100644
    867     --- a/net/ipv4/tcp_input.c
    868     +++ b/net/ipv4/tcp_input.c
    869     @@ -1468,7 +1468,10 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
    870     tp->lost_cnt_hint -= tcp_skb_pcount(prev);
    871     }
    872    
    873     - TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(prev)->tcp_flags;
    874     + TCP_SKB_CB(prev)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
    875     + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
    876     + TCP_SKB_CB(prev)->end_seq++;
    877     +
    878     if (skb == tcp_highest_sack(sk))
    879     tcp_advance_highest_sack(sk, skb);
    880    
    881     diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    882     index 12999a3aaf95..987f5cc706b4 100644
    883     --- a/net/ipv4/tcp_output.c
    884     +++ b/net/ipv4/tcp_output.c
    885     @@ -933,6 +933,9 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
    886     static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
    887     unsigned int mss_now)
    888     {
    889     + /* Make sure we own this skb before messing gso_size/gso_segs */
    890     + WARN_ON_ONCE(skb_cloned(skb));
    891     +
    892     if (skb->len <= mss_now || !sk_can_gso(sk) ||
    893     skb->ip_summed == CHECKSUM_NONE) {
    894     /* Avoid the costly divide in the normal
    895     @@ -1014,9 +1017,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
    896     if (nsize < 0)
    897     nsize = 0;
    898    
    899     - if (skb_cloned(skb) &&
    900     - skb_is_nonlinear(skb) &&
    901     - pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
    902     + if (skb_unclone(skb, GFP_ATOMIC))
    903     return -ENOMEM;
    904    
    905     /* Get a new skb... force flag on. */
    906     @@ -2129,6 +2130,8 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
    907     int oldpcount = tcp_skb_pcount(skb);
    908    
    909     if (unlikely(oldpcount > 1)) {
    910     + if (skb_unclone(skb, GFP_ATOMIC))
    911     + return -ENOMEM;
    912     tcp_init_tso_segs(sk, skb, cur_mss);
    913     tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
    914     }
    915     diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
    916     index 73f1a00a96af..e38290b7c7a1 100644
    917     --- a/net/ipv6/inet6_hashtables.c
    918     +++ b/net/ipv6/inet6_hashtables.c
    919     @@ -110,7 +110,7 @@ begintw:
    920     goto out;
    921     }
    922     if (!INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
    923     - sock_put(sk);
    924     + inet_twsk_put(inet_twsk(sk));
    925     goto begintw;
    926     }
    927     goto out;
    928     diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    929     index 1acfb19cb570..7dabea3a7125 100644
    930     --- a/net/ipv6/ip6_output.c
    931     +++ b/net/ipv6/ip6_output.c
    932     @@ -1345,7 +1345,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
    933     skb = skb_peek_tail(&sk->sk_write_queue);
    934     cork->length += length;
    935     if (((length > mtu) ||
    936     - (skb && skb_is_gso(skb))) &&
    937     + (skb && skb_has_frags(skb))) &&
    938     (sk->sk_protocol == IPPROTO_UDP) &&
    939     (rt->dst.dev->features & NETIF_F_UFO)) {
    940     err = ip6_ufo_append_data(sk, getfrag, from, length,
    941     diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    942     index 016ed7c22fc9..4f768a4c2907 100644
    943     --- a/net/ipv6/route.c
    944     +++ b/net/ipv6/route.c
    945     @@ -818,7 +818,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort,
    946     }
    947    
    948     static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, int oif,
    949     - struct flowi6 *fl6, int flags)
    950     + struct flowi6 *fl6, int flags, bool input)
    951     {
    952     struct fib6_node *fn;
    953     struct rt6_info *rt, *nrt;
    954     @@ -826,8 +826,11 @@ static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
    955     int attempts = 3;
    956     int err;
    957     int reachable = net->ipv6.devconf_all->forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
    958     + int local = RTF_NONEXTHOP;
    959    
    960     strict |= flags & RT6_LOOKUP_F_IFACE;
    961     + if (input)
    962     + local |= RTF_LOCAL;
    963    
    964     relookup:
    965     read_lock_bh(&table->tb6_lock);
    966     @@ -847,7 +850,7 @@ restart:
    967     read_unlock_bh(&table->tb6_lock);
    968    
    969     if (!dst_get_neighbour_noref_raw(&rt->dst) &&
    970     - !(rt->rt6i_flags & (RTF_NONEXTHOP | RTF_LOCAL)))
    971     + !(rt->rt6i_flags & local))
    972     nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
    973     else if (!(rt->dst.flags & DST_HOST))
    974     nrt = rt6_alloc_clone(rt, &fl6->daddr);
    975     @@ -891,7 +894,7 @@ out2:
    976     static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *table,
    977     struct flowi6 *fl6, int flags)
    978     {
    979     - return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
    980     + return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags, true);
    981     }
    982    
    983     static struct dst_entry *ip6_route_input_lookup(struct net *net,
    984     @@ -924,7 +927,7 @@ void ip6_route_input(struct sk_buff *skb)
    985     static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
    986     struct flowi6 *fl6, int flags)
    987     {
    988     - return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
    989     + return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags, false);
    990     }
    991    
    992     struct dst_entry * ip6_route_output(struct net *net, const struct sock *sk,
    993     diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
    994     index b2982f4214d1..904bc098790d 100644
    995     --- a/net/l2tp/l2tp_ppp.c
    996     +++ b/net/l2tp/l2tp_ppp.c
    997     @@ -357,7 +357,9 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
    998     goto error_put_sess_tun;
    999     }
    1000    
    1001     + local_bh_disable();
    1002     l2tp_xmit_skb(session, skb, session->hdr_len);
    1003     + local_bh_enable();
    1004    
    1005     sock_put(ps->tunnel_sock);
    1006     sock_put(sk);
    1007     @@ -432,7 +434,9 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
    1008     skb->data[0] = ppph[0];
    1009     skb->data[1] = ppph[1];
    1010    
    1011     + local_bh_disable();
    1012     l2tp_xmit_skb(session, skb, session->hdr_len);
    1013     + local_bh_enable();
    1014    
    1015     sock_put(sk_tun);
    1016     sock_put(sk);
    1017     diff --git a/net/sctp/output.c b/net/sctp/output.c
    1018     index 32ba8d0e50e2..cf3e22c586a6 100644
    1019     --- a/net/sctp/output.c
    1020     +++ b/net/sctp/output.c
    1021     @@ -518,7 +518,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
    1022     * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
    1023     */
    1024     if (!sctp_checksum_disable) {
    1025     - if (!(dst->dev->features & NETIF_F_SCTP_CSUM)) {
    1026     + if (!(dst->dev->features & NETIF_F_SCTP_CSUM) ||
    1027     + (dst_xfrm(dst) != NULL) || packet->ipfragok) {
    1028     __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
    1029    
    1030     /* 3) Put the resultant value into the checksum field in the
    1031     diff --git a/net/socket.c b/net/socket.c
    1032     index 47ce3ea44300..acc769562707 100644
    1033     --- a/net/socket.c
    1034     +++ b/net/socket.c
    1035     @@ -1899,6 +1899,16 @@ struct used_address {
    1036     unsigned int name_len;
    1037     };
    1038    
    1039     +static int copy_msghdr_from_user(struct msghdr *kmsg,
    1040     + struct msghdr __user *umsg)
    1041     +{
    1042     + if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
    1043     + return -EFAULT;
    1044     + if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
    1045     + return -EINVAL;
    1046     + return 0;
    1047     +}
    1048     +
    1049     static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
    1050     struct msghdr *msg_sys, unsigned flags,
    1051     struct used_address *used_address)
    1052     @@ -1917,8 +1927,11 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
    1053     if (MSG_CMSG_COMPAT & flags) {
    1054     if (get_compat_msghdr(msg_sys, msg_compat))
    1055     return -EFAULT;
    1056     - } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
    1057     - return -EFAULT;
    1058     + } else {
    1059     + err = copy_msghdr_from_user(msg_sys, msg);
    1060     + if (err)
    1061     + return err;
    1062     + }
    1063    
    1064     /* do not move before msg_sys is valid */
    1065     err = -EMSGSIZE;
    1066     @@ -2129,8 +2142,11 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
    1067     if (MSG_CMSG_COMPAT & flags) {
    1068     if (get_compat_msghdr(msg_sys, msg_compat))
    1069     return -EFAULT;
    1070     - } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
    1071     - return -EFAULT;
    1072     + } else {
    1073     + err = copy_msghdr_from_user(msg_sys, msg);
    1074     + if (err)
    1075     + return err;
    1076     + }
    1077    
    1078     err = -EMSGSIZE;
    1079     if (msg_sys->msg_iovlen > UIO_MAXIOV)
    1080     diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
    1081     index c4821fd23b79..ed005b425a7c 100644
    1082     --- a/net/unix/af_unix.c
    1083     +++ b/net/unix/af_unix.c
    1084     @@ -1247,6 +1247,15 @@ static int unix_socketpair(struct socket *socka, struct socket *sockb)
    1085     return 0;
    1086     }
    1087    
    1088     +static void unix_sock_inherit_flags(const struct socket *old,
    1089     + struct socket *new)
    1090     +{
    1091     + if (test_bit(SOCK_PASSCRED, &old->flags))
    1092     + set_bit(SOCK_PASSCRED, &new->flags);
    1093     + if (test_bit(SOCK_PASSSEC, &old->flags))
    1094     + set_bit(SOCK_PASSSEC, &new->flags);
    1095     +}
    1096     +
    1097     static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
    1098     {
    1099     struct sock *sk = sock->sk;
    1100     @@ -1281,6 +1290,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
    1101     /* attach accepted sock to socket */
    1102     unix_state_lock(tsk);
    1103     newsock->state = SS_CONNECTED;
    1104     + unix_sock_inherit_flags(sock, newsock);
    1105     sock_graft(tsk, newsock);
    1106     unix_state_unlock(tsk);
    1107     return 0;
    1108     diff --git a/net/unix/diag.c b/net/unix/diag.c
    1109     index f0486ae9ebe6..2656840cf203 100644
    1110     --- a/net/unix/diag.c
    1111     +++ b/net/unix/diag.c
    1112     @@ -134,6 +134,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
    1113     rep->udiag_family = AF_UNIX;
    1114     rep->udiag_type = sk->sk_type;
    1115     rep->udiag_state = sk->sk_state;
    1116     + rep->pad = 0;
    1117     rep->udiag_ino = sk_ino;
    1118     sock_diag_save_cookie(sk, rep->udiag_cookie);
    1119    
    1120     diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
    1121     index c4ad7958af52..617a310025b1 100644
    1122     --- a/net/wireless/radiotap.c
    1123     +++ b/net/wireless/radiotap.c
    1124     @@ -95,6 +95,10 @@ int ieee80211_radiotap_iterator_init(
    1125     struct ieee80211_radiotap_header *radiotap_header,
    1126     int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
    1127     {
    1128     + /* check the radiotap header can actually be present */
    1129     + if (max_length < sizeof(struct ieee80211_radiotap_header))
    1130     + return -EINVAL;
    1131     +
    1132     /* Linux only supports version 0 radiotap format */
    1133     if (radiotap_header->it_version)
    1134     return -EINVAL;
    1135     @@ -129,7 +133,8 @@ int ieee80211_radiotap_iterator_init(
    1136     */
    1137    
    1138     if ((unsigned long)iterator->_arg -
    1139     - (unsigned long)iterator->_rtheader >
    1140     + (unsigned long)iterator->_rtheader +
    1141     + sizeof(uint32_t) >
    1142     (unsigned long)iterator->_max_length)
    1143     return -EINVAL;
    1144     }