Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0167-3.4.68-all-fixes.patch

    Contents of /trunk/kernel-lts/patches-3.4/0167-3.4.68-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2322 - (show annotations) (download)
    Mon Nov 18 12:00:12 2013 UTC (10 years, 5 months ago) by niro
    File size: 40078 byte(s) 
    -linux-3.4.68
    1 diff --git a/drivers/connector/cn_proc.c b/drivers/connector/cn_proc.c
    2 index 77e1e6cd66ce..2894461e0bdb 100644
    3 --- a/drivers/connector/cn_proc.c
    4 +++ b/drivers/connector/cn_proc.c
    5 @@ -64,6 +64,7 @@ void proc_fork_connector(struct task_struct *task)
    6
    7 msg = (struct cn_msg*)buffer;
    8 ev = (struct proc_event*)msg->data;
    9 + memset(&ev->event_data, 0, sizeof(ev->event_data));
    10 get_seq(&msg->seq, &ev->cpu);
    11 ktime_get_ts(&ts); /* get high res monotonic timestamp */
    12 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    13 @@ -79,6 +80,7 @@ void proc_fork_connector(struct task_struct *task)
    14 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    15 msg->ack = 0; /* not used */
    16 msg->len = sizeof(*ev);
    17 + msg->flags = 0; /* not used */
    18 /* If cn_netlink_send() failed, the data is not sent */
    19 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    20 }
    21 @@ -95,6 +97,7 @@ void proc_exec_connector(struct task_struct *task)
    22
    23 msg = (struct cn_msg*)buffer;
    24 ev = (struct proc_event*)msg->data;
    25 + memset(&ev->event_data, 0, sizeof(ev->event_data));
    26 get_seq(&msg->seq, &ev->cpu);
    27 ktime_get_ts(&ts); /* get high res monotonic timestamp */
    28 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    29 @@ -105,6 +108,7 @@ void proc_exec_connector(struct task_struct *task)
    30 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    31 msg->ack = 0; /* not used */
    32 msg->len = sizeof(*ev);
    33 + msg->flags = 0; /* not used */
    34 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    35 }
    36
    37 @@ -121,6 +125,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
    38
    39 msg = (struct cn_msg*)buffer;
    40 ev = (struct proc_event*)msg->data;
    41 + memset(&ev->event_data, 0, sizeof(ev->event_data));
    42 ev->what = which_id;
    43 ev->event_data.id.process_pid = task->pid;
    44 ev->event_data.id.process_tgid = task->tgid;
    45 @@ -144,6 +149,7 @@ void proc_id_connector(struct task_struct *task, int which_id)
    46 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    47 msg->ack = 0; /* not used */
    48 msg->len = sizeof(*ev);
    49 + msg->flags = 0; /* not used */
    50 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    51 }
    52
    53 @@ -159,6 +165,7 @@ void proc_sid_connector(struct task_struct *task)
    54
    55 msg = (struct cn_msg *)buffer;
    56 ev = (struct proc_event *)msg->data;
    57 + memset(&ev->event_data, 0, sizeof(ev->event_data));
    58 get_seq(&msg->seq, &ev->cpu);
    59 ktime_get_ts(&ts); /* get high res monotonic timestamp */
    60 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    61 @@ -169,6 +176,7 @@ void proc_sid_connector(struct task_struct *task)
    62 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    63 msg->ack = 0; /* not used */
    64 msg->len = sizeof(*ev);
    65 + msg->flags = 0; /* not used */
    66 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    67 }
    68
    69 @@ -184,6 +192,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
    70
    71 msg = (struct cn_msg *)buffer;
    72 ev = (struct proc_event *)msg->data;
    73 + memset(&ev->event_data, 0, sizeof(ev->event_data));
    74 get_seq(&msg->seq, &ev->cpu);
    75 ktime_get_ts(&ts); /* get high res monotonic timestamp */
    76 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    77 @@ -202,6 +211,7 @@ void proc_ptrace_connector(struct task_struct *task, int ptrace_id)
    78 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    79 msg->ack = 0; /* not used */
    80 msg->len = sizeof(*ev);
    81 + msg->flags = 0; /* not used */
    82 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    83 }
    84
    85 @@ -217,6 +227,7 @@ void proc_comm_connector(struct task_struct *task)
    86
    87 msg = (struct cn_msg *)buffer;
    88 ev = (struct proc_event *)msg->data;
    89 + memset(&ev->event_data, 0, sizeof(ev->event_data));
    90 get_seq(&msg->seq, &ev->cpu);
    91 ktime_get_ts(&ts); /* get high res monotonic timestamp */
    92 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    93 @@ -228,6 +239,7 @@ void proc_comm_connector(struct task_struct *task)
    94 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    95 msg->ack = 0; /* not used */
    96 msg->len = sizeof(*ev);
    97 + msg->flags = 0; /* not used */
    98 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    99 }
    100
    101 @@ -243,6 +255,7 @@ void proc_exit_connector(struct task_struct *task)
    102
    103 msg = (struct cn_msg*)buffer;
    104 ev = (struct proc_event*)msg->data;
    105 + memset(&ev->event_data, 0, sizeof(ev->event_data));
    106 get_seq(&msg->seq, &ev->cpu);
    107 ktime_get_ts(&ts); /* get high res monotonic timestamp */
    108 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    109 @@ -255,6 +268,7 @@ void proc_exit_connector(struct task_struct *task)
    110 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    111 msg->ack = 0; /* not used */
    112 msg->len = sizeof(*ev);
    113 + msg->flags = 0; /* not used */
    114 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    115 }
    116
    117 @@ -278,6 +292,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
    118
    119 msg = (struct cn_msg*)buffer;
    120 ev = (struct proc_event*)msg->data;
    121 + memset(&ev->event_data, 0, sizeof(ev->event_data));
    122 msg->seq = rcvd_seq;
    123 ktime_get_ts(&ts); /* get high res monotonic timestamp */
    124 put_unaligned(timespec_to_ns(&ts), (__u64 *)&ev->timestamp_ns);
    125 @@ -287,6 +302,7 @@ static void cn_proc_ack(int err, int rcvd_seq, int rcvd_ack)
    126 memcpy(&msg->id, &cn_proc_event_id, sizeof(msg->id));
    127 msg->ack = rcvd_ack + 1;
    128 msg->len = sizeof(*ev);
    129 + msg->flags = 0; /* not used */
    130 cn_netlink_send(msg, CN_IDX_PROC, GFP_KERNEL);
    131 }
    132
    133 diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
    134 index dde6a0fad408..ea6efe86468e 100644
    135 --- a/drivers/connector/connector.c
    136 +++ b/drivers/connector/connector.c
    137 @@ -157,17 +157,18 @@ static int cn_call_callback(struct sk_buff *skb)
    138 static void cn_rx_skb(struct sk_buff *__skb)
    139 {
    140 struct nlmsghdr *nlh;
    141 - int err;
    142 struct sk_buff *skb;
    143 + int len, err;
    144
    145 skb = skb_get(__skb);
    146
    147 if (skb->len >= NLMSG_SPACE(0)) {
    148 nlh = nlmsg_hdr(skb);
    149 + len = nlmsg_len(nlh);
    150
    151 - if (nlh->nlmsg_len < sizeof(struct cn_msg) ||
    152 + if (len < (int)sizeof(struct cn_msg) ||
    153 skb->len < nlh->nlmsg_len ||
    154 - nlh->nlmsg_len > CONNECTOR_MAX_MSG_SIZE) {
    155 + len > CONNECTOR_MAX_MSG_SIZE) {
    156 kfree_skb(skb);
    157 return;
    158 }
    159 diff --git a/drivers/md/dm-snap-persistent.c b/drivers/md/dm-snap-persistent.c
    160 index 4caa8e6d59d7..2d2b1b7588d7 100644
    161 --- a/drivers/md/dm-snap-persistent.c
    162 +++ b/drivers/md/dm-snap-persistent.c
    163 @@ -269,6 +269,14 @@ static chunk_t area_location(struct pstore *ps, chunk_t area)
    164 return NUM_SNAPSHOT_HDR_CHUNKS + ((ps->exceptions_per_area + 1) * area);
    165 }
    166
    167 +static void skip_metadata(struct pstore *ps)
    168 +{
    169 + uint32_t stride = ps->exceptions_per_area + 1;
    170 + chunk_t next_free = ps->next_free;
    171 + if (sector_div(next_free, stride) == NUM_SNAPSHOT_HDR_CHUNKS)
    172 + ps->next_free++;
    173 +}
    174 +
    175 /*
    176 * Read or write a metadata area. Remembering to skip the first
    177 * chunk which holds the header.
    178 @@ -502,6 +510,8 @@ static int read_exceptions(struct pstore *ps,
    179
    180 ps->current_area--;
    181
    182 + skip_metadata(ps);
    183 +
    184 return 0;
    185 }
    186
    187 @@ -616,8 +626,6 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
    188 struct dm_exception *e)
    189 {
    190 struct pstore *ps = get_info(store);
    191 - uint32_t stride;
    192 - chunk_t next_free;
    193 sector_t size = get_dev_size(dm_snap_cow(store->snap)->bdev);
    194
    195 /* Is there enough room ? */
    196 @@ -630,10 +638,8 @@ static int persistent_prepare_exception(struct dm_exception_store *store,
    197 * Move onto the next free pending, making sure to take
    198 * into account the location of the metadata chunks.
    199 */
    200 - stride = (ps->exceptions_per_area + 1);
    201 - next_free = ++ps->next_free;
    202 - if (sector_div(next_free, stride) == 1)
    203 - ps->next_free++;
    204 + ps->next_free++;
    205 + skip_metadata(ps);
    206
    207 atomic_inc(&ps->pending_count);
    208 return 0;
    209 diff --git a/drivers/net/can/dev.c b/drivers/net/can/dev.c
    210 index e86f4c37f981..c2cdefa1651e 100644
    211 --- a/drivers/net/can/dev.c
    212 +++ b/drivers/net/can/dev.c
    213 @@ -665,14 +665,14 @@ static size_t can_get_size(const struct net_device *dev)
    214 size_t size;
    215
    216 size = nla_total_size(sizeof(u32)); /* IFLA_CAN_STATE */
    217 - size += sizeof(struct can_ctrlmode); /* IFLA_CAN_CTRLMODE */
    218 + size += nla_total_size(sizeof(struct can_ctrlmode)); /* IFLA_CAN_CTRLMODE */
    219 size += nla_total_size(sizeof(u32)); /* IFLA_CAN_RESTART_MS */
    220 - size += sizeof(struct can_bittiming); /* IFLA_CAN_BITTIMING */
    221 - size += sizeof(struct can_clock); /* IFLA_CAN_CLOCK */
    222 + size += nla_total_size(sizeof(struct can_bittiming)); /* IFLA_CAN_BITTIMING */
    223 + size += nla_total_size(sizeof(struct can_clock)); /* IFLA_CAN_CLOCK */
    224 if (priv->do_get_berr_counter) /* IFLA_CAN_BERR_COUNTER */
    225 - size += sizeof(struct can_berr_counter);
    226 + size += nla_total_size(sizeof(struct can_berr_counter));
    227 if (priv->bittiming_const) /* IFLA_CAN_BITTIMING_CONST */
    228 - size += sizeof(struct can_bittiming_const);
    229 + size += nla_total_size(sizeof(struct can_bittiming_const));
    230
    231 return size;
    232 }
    233 diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
    234 index acd824660367..e45b8b6d6848 100644
    235 --- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
    236 +++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
    237 @@ -547,6 +547,7 @@ static inline void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp,
    238 skb, cqe, cqe_idx)) {
    239 if (tpa_info->parsing_flags & PARSING_FLAGS_VLAN)
    240 __vlan_hwaccel_put_tag(skb, tpa_info->vlan_tag);
    241 + skb_record_rx_queue(skb, fp->rx_queue);
    242 napi_gro_receive(&fp->napi, skb);
    243 } else {
    244 DP(NETIF_MSG_RX_STATUS,
    245 diff --git a/drivers/net/ethernet/marvell/mv643xx_eth.c b/drivers/net/ethernet/marvell/mv643xx_eth.c
    246 index 5e1ca0f05090..ffa6a72dcc60 100644
    247 --- a/drivers/net/ethernet/marvell/mv643xx_eth.c
    248 +++ b/drivers/net/ethernet/marvell/mv643xx_eth.c
    249 @@ -1274,15 +1274,13 @@ static void mib_counters_update(struct mv643xx_eth_private *mp)
    250 p->rx_discard += rdlp(mp, RX_DISCARD_FRAME_CNT);
    251 p->rx_overrun += rdlp(mp, RX_OVERRUN_FRAME_CNT);
    252 spin_unlock_bh(&mp->mib_counters_lock);
    253 -
    254 - mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
    255 }
    256
    257 static void mib_counters_timer_wrapper(unsigned long _mp)
    258 {
    259 struct mv643xx_eth_private *mp = (void *)_mp;
    260 -
    261 mib_counters_update(mp);
    262 + mod_timer(&mp->mib_counters_timer, jiffies + 30 * HZ);
    263 }
    264
    265
    266 @@ -2370,6 +2368,7 @@ static int mv643xx_eth_open(struct net_device *dev)
    267 mp->int_mask |= INT_TX_END_0 << i;
    268 }
    269
    270 + add_timer(&mp->mib_counters_timer);
    271 port_start(mp);
    272
    273 wrlp(mp, INT_MASK_EXT, INT_EXT_LINK_PHY | INT_EXT_TX);
    274 @@ -2911,7 +2910,6 @@ static int mv643xx_eth_probe(struct platform_device *pdev)
    275 mp->mib_counters_timer.data = (unsigned long)mp;
    276 mp->mib_counters_timer.function = mib_counters_timer_wrapper;
    277 mp->mib_counters_timer.expires = jiffies + 30 * HZ;
    278 - add_timer(&mp->mib_counters_timer);
    279
    280 spin_lock_init(&mp->mib_counters_lock);
    281
    282 diff --git a/drivers/net/ethernet/ti/davinci_emac.c b/drivers/net/ethernet/ti/davinci_emac.c
    283 index 43fada572596..c336d36cf5ca 100644
    284 --- a/drivers/net/ethernet/ti/davinci_emac.c
    285 +++ b/drivers/net/ethernet/ti/davinci_emac.c
    286 @@ -875,8 +875,7 @@ static void emac_dev_mcast_set(struct net_device *ndev)
    287 netdev_mc_count(ndev) > EMAC_DEF_MAX_MULTICAST_ADDRESSES) {
    288 mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
    289 emac_add_mcast(priv, EMAC_ALL_MULTI_SET, NULL);
    290 - }
    291 - if (!netdev_mc_empty(ndev)) {
    292 + } else if (!netdev_mc_empty(ndev)) {
    293 struct netdev_hw_addr *ha;
    294
    295 mbp_enable = (mbp_enable | EMAC_MBP_RXMCAST);
    296 diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
    297 index 1a623183cbe5..3710427c3fe1 100644
    298 --- a/drivers/net/wan/farsync.c
    299 +++ b/drivers/net/wan/farsync.c
    300 @@ -1972,6 +1972,7 @@ fst_get_iface(struct fst_card_info *card, struct fst_port_info *port,
    301 }
    302
    303 i = port->index;
    304 + memset(&sync, 0, sizeof(sync));
    305 sync.clock_rate = FST_RDL(card, portConfig[i].lineSpeed);
    306 /* Lucky card and linux use same encoding here */
    307 sync.clock_type = FST_RDB(card, portConfig[i].internalClock) ==
    308 diff --git a/drivers/net/wan/wanxl.c b/drivers/net/wan/wanxl.c
    309 index feb7541b33fb..ccd496bf32d9 100644
    310 --- a/drivers/net/wan/wanxl.c
    311 +++ b/drivers/net/wan/wanxl.c
    312 @@ -355,6 +355,7 @@ static int wanxl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    313 ifr->ifr_settings.size = size; /* data size wanted */
    314 return -ENOBUFS;
    315 }
    316 + memset(&line, 0, sizeof(line));
    317 line.clock_type = get_status(port)->clocking;
    318 line.clock_rate = 0;
    319 line.loopback = 0;
    320 diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
    321 index 9def72f018e0..b3440c66a995 100644
    322 --- a/drivers/usb/serial/option.c
    323 +++ b/drivers/usb/serial/option.c
    324 @@ -457,6 +457,10 @@ static void option_instat_callback(struct urb *urb);
    325 #define CHANGHONG_VENDOR_ID 0x2077
    326 #define CHANGHONG_PRODUCT_CH690 0x7001
    327
    328 +/* Inovia */
    329 +#define INOVIA_VENDOR_ID 0x20a6
    330 +#define INOVIA_SEW858 0x1105
    331 +
    332 /* some devices interfaces need special handling due to a number of reasons */
    333 enum option_blacklist_reason {
    334 OPTION_BLACKLIST_NONE = 0,
    335 @@ -1279,7 +1283,9 @@ static const struct usb_device_id option_ids[] = {
    336
    337 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD100) },
    338 { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD145) },
    339 - { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200) },
    340 + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
    341 + .driver_info = (kernel_ulong_t)&net_intf6_blacklist
    342 + },
    343 { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
    344 { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
    345 { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
    346 @@ -1367,6 +1373,7 @@ static const struct usb_device_id option_ids[] = {
    347 { USB_DEVICE_AND_INTERFACE_INFO(0x2001, 0x7d03, 0xff, 0x00, 0x00) },
    348 { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e01, 0xff, 0xff, 0xff) }, /* D-Link DWM-152/C1 */
    349 { USB_DEVICE_AND_INTERFACE_INFO(0x07d1, 0x3e02, 0xff, 0xff, 0xff) }, /* D-Link DWM-156/C1 */
    350 + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) },
    351 { } /* Terminating entry */
    352 };
    353 MODULE_DEVICE_TABLE(usb, option_ids);
    354 diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
    355 index a7492ba5371a..1b0430e00b75 100644
    356 --- a/drivers/usb/serial/ti_usb_3410_5052.c
    357 +++ b/drivers/usb/serial/ti_usb_3410_5052.c
    358 @@ -210,6 +210,7 @@ static struct usb_device_id ti_id_table_combined[19+2*TI_EXTRA_VID_PID_COUNT+1]
    359 { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
    360 { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
    361 { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_PRODUCT_ID) },
    362 + { USB_DEVICE(ABBOTT_VENDOR_ID, ABBOTT_STRIP_PORT_ID) },
    363 { USB_DEVICE(TI_VENDOR_ID, FRI2_PRODUCT_ID) },
    364 { }
    365 };
    366 diff --git a/fs/ext3/dir.c b/fs/ext3/dir.c
    367 index cc761ad8fa57..92490e9f85ca 100644
    368 --- a/fs/ext3/dir.c
    369 +++ b/fs/ext3/dir.c
    370 @@ -21,30 +21,15 @@
    371 *
    372 */
    373
    374 +#include <linux/compat.h>
    375 #include "ext3.h"
    376
    377 static unsigned char ext3_filetype_table[] = {
    378 DT_UNKNOWN, DT_REG, DT_DIR, DT_CHR, DT_BLK, DT_FIFO, DT_SOCK, DT_LNK
    379 };
    380
    381 -static int ext3_readdir(struct file *, void *, filldir_t);
    382 static int ext3_dx_readdir(struct file * filp,
    383 void * dirent, filldir_t filldir);
    384 -static int ext3_release_dir (struct inode * inode,
    385 - struct file * filp);
    386 -
    387 -const struct file_operations ext3_dir_operations = {
    388 - .llseek = generic_file_llseek,
    389 - .read = generic_read_dir,
    390 - .readdir = ext3_readdir, /* we take BKL. needed?*/
    391 - .unlocked_ioctl = ext3_ioctl,
    392 -#ifdef CONFIG_COMPAT
    393 - .compat_ioctl = ext3_compat_ioctl,
    394 -#endif
    395 - .fsync = ext3_sync_file, /* BKL held */
    396 - .release = ext3_release_dir,
    397 -};
    398 -
    399
    400 static unsigned char get_dtype(struct super_block *sb, int filetype)
    401 {
    402 @@ -55,6 +40,25 @@ static unsigned char get_dtype(struct super_block *sb, int filetype)
    403 return (ext3_filetype_table[filetype]);
    404 }
    405
    406 +/**
    407 + * Check if the given dir-inode refers to an htree-indexed directory
    408 + * (or a directory which chould potentially get coverted to use htree
    409 + * indexing).
    410 + *
    411 + * Return 1 if it is a dx dir, 0 if not
    412 + */
    413 +static int is_dx_dir(struct inode *inode)
    414 +{
    415 + struct super_block *sb = inode->i_sb;
    416 +
    417 + if (EXT3_HAS_COMPAT_FEATURE(inode->i_sb,
    418 + EXT3_FEATURE_COMPAT_DIR_INDEX) &&
    419 + ((EXT3_I(inode)->i_flags & EXT3_INDEX_FL) ||
    420 + ((inode->i_size >> sb->s_blocksize_bits) == 1)))
    421 + return 1;
    422 +
    423 + return 0;
    424 +}
    425
    426 int ext3_check_dir_entry (const char * function, struct inode * dir,
    427 struct ext3_dir_entry_2 * de,
    428 @@ -94,18 +98,13 @@ static int ext3_readdir(struct file * filp,
    429 unsigned long offset;
    430 int i, stored;
    431 struct ext3_dir_entry_2 *de;
    432 - struct super_block *sb;
    433 int err;
    434 struct inode *inode = filp->f_path.dentry->d_inode;
    435 + struct super_block *sb = inode->i_sb;
    436 int ret = 0;
    437 int dir_has_error = 0;
    438
    439 - sb = inode->i_sb;
    440 -
    441 - if (EXT3_HAS_COMPAT_FEATURE(inode->i_sb,
    442 - EXT3_FEATURE_COMPAT_DIR_INDEX) &&
    443 - ((EXT3_I(inode)->i_flags & EXT3_INDEX_FL) ||
    444 - ((inode->i_size >> sb->s_blocksize_bits) == 1))) {
    445 + if (is_dx_dir(inode)) {
    446 err = ext3_dx_readdir(filp, dirent, filldir);
    447 if (err != ERR_BAD_DX_DIR) {
    448 ret = err;
    449 @@ -227,22 +226,87 @@ out:
    450 return ret;
    451 }
    452
    453 +static inline int is_32bit_api(void)
    454 +{
    455 +#ifdef CONFIG_COMPAT
    456 + return is_compat_task();
    457 +#else
    458 + return (BITS_PER_LONG == 32);
    459 +#endif
    460 +}
    461 +
    462 /*
    463 * These functions convert from the major/minor hash to an f_pos
    464 - * value.
    465 + * value for dx directories
    466 *
    467 - * Currently we only use major hash numer. This is unfortunate, but
    468 - * on 32-bit machines, the same VFS interface is used for lseek and
    469 - * llseek, so if we use the 64 bit offset, then the 32-bit versions of
    470 - * lseek/telldir/seekdir will blow out spectacularly, and from within
    471 - * the ext2 low-level routine, we don't know if we're being called by
    472 - * a 64-bit version of the system call or the 32-bit version of the
    473 - * system call. Worse yet, NFSv2 only allows for a 32-bit readdir
    474 - * cookie. Sigh.
    475 + * Upper layer (for example NFS) should specify FMODE_32BITHASH or
    476 + * FMODE_64BITHASH explicitly. On the other hand, we allow ext3 to be mounted
    477 + * directly on both 32-bit and 64-bit nodes, under such case, neither
    478 + * FMODE_32BITHASH nor FMODE_64BITHASH is specified.
    479 */
    480 -#define hash2pos(major, minor) (major >> 1)
    481 -#define pos2maj_hash(pos) ((pos << 1) & 0xffffffff)
    482 -#define pos2min_hash(pos) (0)
    483 +static inline loff_t hash2pos(struct file *filp, __u32 major, __u32 minor)
    484 +{
    485 + if ((filp->f_mode & FMODE_32BITHASH) ||
    486 + (!(filp->f_mode & FMODE_64BITHASH) && is_32bit_api()))
    487 + return major >> 1;
    488 + else
    489 + return ((__u64)(major >> 1) << 32) | (__u64)minor;
    490 +}
    491 +
    492 +static inline __u32 pos2maj_hash(struct file *filp, loff_t pos)
    493 +{
    494 + if ((filp->f_mode & FMODE_32BITHASH) ||
    495 + (!(filp->f_mode & FMODE_64BITHASH) && is_32bit_api()))
    496 + return (pos << 1) & 0xffffffff;
    497 + else
    498 + return ((pos >> 32) << 1) & 0xffffffff;
    499 +}
    500 +
    501 +static inline __u32 pos2min_hash(struct file *filp, loff_t pos)
    502 +{
    503 + if ((filp->f_mode & FMODE_32BITHASH) ||
    504 + (!(filp->f_mode & FMODE_64BITHASH) && is_32bit_api()))
    505 + return 0;
    506 + else
    507 + return pos & 0xffffffff;
    508 +}
    509 +
    510 +/*
    511 + * Return 32- or 64-bit end-of-file for dx directories
    512 + */
    513 +static inline loff_t ext3_get_htree_eof(struct file *filp)
    514 +{
    515 + if ((filp->f_mode & FMODE_32BITHASH) ||
    516 + (!(filp->f_mode & FMODE_64BITHASH) && is_32bit_api()))
    517 + return EXT3_HTREE_EOF_32BIT;
    518 + else
    519 + return EXT3_HTREE_EOF_64BIT;
    520 +}
    521 +
    522 +
    523 +/*
    524 + * ext3_dir_llseek() calls generic_file_llseek[_size]() to handle both
    525 + * non-htree and htree directories, where the "offset" is in terms
    526 + * of the filename hash value instead of the byte offset.
    527 + *
    528 + * Because we may return a 64-bit hash that is well beyond s_maxbytes,
    529 + * we need to pass the max hash as the maximum allowable offset in
    530 + * the htree directory case.
    531 + *
    532 + * NOTE: offsets obtained *before* ext3_set_inode_flag(dir, EXT3_INODE_INDEX)
    533 + * will be invalid once the directory was converted into a dx directory
    534 + */
    535 +loff_t ext3_dir_llseek(struct file *file, loff_t offset, int origin)
    536 +{
    537 + struct inode *inode = file->f_mapping->host;
    538 + int dx_dir = is_dx_dir(inode);
    539 +
    540 + if (likely(dx_dir))
    541 + return generic_file_llseek_size(file, offset, origin,
    542 + ext3_get_htree_eof(file));
    543 + else
    544 + return generic_file_llseek(file, offset, origin);
    545 +}
    546
    547 /*
    548 * This structure holds the nodes of the red-black tree used to store
    549 @@ -303,15 +367,16 @@ static void free_rb_tree_fname(struct rb_root *root)
    550 }
    551
    552
    553 -static struct dir_private_info *ext3_htree_create_dir_info(loff_t pos)
    554 +static struct dir_private_info *ext3_htree_create_dir_info(struct file *filp,
    555 + loff_t pos)
    556 {
    557 struct dir_private_info *p;
    558
    559 p = kzalloc(sizeof(struct dir_private_info), GFP_KERNEL);
    560 if (!p)
    561 return NULL;
    562 - p->curr_hash = pos2maj_hash(pos);
    563 - p->curr_minor_hash = pos2min_hash(pos);
    564 + p->curr_hash = pos2maj_hash(filp, pos);
    565 + p->curr_minor_hash = pos2min_hash(filp, pos);
    566 return p;
    567 }
    568
    569 @@ -401,7 +466,7 @@ static int call_filldir(struct file * filp, void * dirent,
    570 printk("call_filldir: called with null fname?!?\n");
    571 return 0;
    572 }
    573 - curr_pos = hash2pos(fname->hash, fname->minor_hash);
    574 + curr_pos = hash2pos(filp, fname->hash, fname->minor_hash);
    575 while (fname) {
    576 error = filldir(dirent, fname->name,
    577 fname->name_len, curr_pos,
    578 @@ -426,13 +491,13 @@ static int ext3_dx_readdir(struct file * filp,
    579 int ret;
    580
    581 if (!info) {
    582 - info = ext3_htree_create_dir_info(filp->f_pos);
    583 + info = ext3_htree_create_dir_info(filp, filp->f_pos);
    584 if (!info)
    585 return -ENOMEM;
    586 filp->private_data = info;
    587 }
    588
    589 - if (filp->f_pos == EXT3_HTREE_EOF)
    590 + if (filp->f_pos == ext3_get_htree_eof(filp))
    591 return 0; /* EOF */
    592
    593 /* Some one has messed with f_pos; reset the world */
    594 @@ -440,8 +505,8 @@ static int ext3_dx_readdir(struct file * filp,
    595 free_rb_tree_fname(&info->root);
    596 info->curr_node = NULL;
    597 info->extra_fname = NULL;
    598 - info->curr_hash = pos2maj_hash(filp->f_pos);
    599 - info->curr_minor_hash = pos2min_hash(filp->f_pos);
    600 + info->curr_hash = pos2maj_hash(filp, filp->f_pos);
    601 + info->curr_minor_hash = pos2min_hash(filp, filp->f_pos);
    602 }
    603
    604 /*
    605 @@ -473,7 +538,7 @@ static int ext3_dx_readdir(struct file * filp,
    606 if (ret < 0)
    607 return ret;
    608 if (ret == 0) {
    609 - filp->f_pos = EXT3_HTREE_EOF;
    610 + filp->f_pos = ext3_get_htree_eof(filp);
    611 break;
    612 }
    613 info->curr_node = rb_first(&info->root);
    614 @@ -493,7 +558,7 @@ static int ext3_dx_readdir(struct file * filp,
    615 info->curr_minor_hash = fname->minor_hash;
    616 } else {
    617 if (info->next_hash == ~0) {
    618 - filp->f_pos = EXT3_HTREE_EOF;
    619 + filp->f_pos = ext3_get_htree_eof(filp);
    620 break;
    621 }
    622 info->curr_hash = info->next_hash;
    623 @@ -512,3 +577,15 @@ static int ext3_release_dir (struct inode * inode, struct file * filp)
    624
    625 return 0;
    626 }
    627 +
    628 +const struct file_operations ext3_dir_operations = {
    629 + .llseek = ext3_dir_llseek,
    630 + .read = generic_read_dir,
    631 + .readdir = ext3_readdir,
    632 + .unlocked_ioctl = ext3_ioctl,
    633 +#ifdef CONFIG_COMPAT
    634 + .compat_ioctl = ext3_compat_ioctl,
    635 +#endif
    636 + .fsync = ext3_sync_file,
    637 + .release = ext3_release_dir,
    638 +};
    639 diff --git a/fs/ext3/ext3.h b/fs/ext3/ext3.h
    640 index b6515fd7e56c..fe5bef7914ea 100644
    641 --- a/fs/ext3/ext3.h
    642 +++ b/fs/ext3/ext3.h
    643 @@ -920,7 +920,11 @@ struct dx_hash_info
    644 u32 *seed;
    645 };
    646
    647 -#define EXT3_HTREE_EOF 0x7fffffff
    648 +
    649 +/* 32 and 64 bit signed EOF for dx directories */
    650 +#define EXT3_HTREE_EOF_32BIT ((1UL << (32 - 1)) - 1)
    651 +#define EXT3_HTREE_EOF_64BIT ((1ULL << (64 - 1)) - 1)
    652 +
    653
    654 /*
    655 * Control parameters used by ext3_htree_next_block
    656 diff --git a/fs/ext3/hash.c b/fs/ext3/hash.c
    657 index d10231ddcf8a..ede315cdf126 100644
    658 --- a/fs/ext3/hash.c
    659 +++ b/fs/ext3/hash.c
    660 @@ -198,8 +198,8 @@ int ext3fs_dirhash(const char *name, int len, struct dx_hash_info *hinfo)
    661 return -1;
    662 }
    663 hash = hash & ~1;
    664 - if (hash == (EXT3_HTREE_EOF << 1))
    665 - hash = (EXT3_HTREE_EOF-1) << 1;
    666 + if (hash == (EXT3_HTREE_EOF_32BIT << 1))
    667 + hash = (EXT3_HTREE_EOF_32BIT - 1) << 1;
    668 hinfo->hash = hash;
    669 hinfo->minor_hash = minor_hash;
    670 return 0;
    671 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
    672 index dc4d49a0c07d..42b919c36da1 100644
    673 --- a/include/linux/skbuff.h
    674 +++ b/include/linux/skbuff.h
    675 @@ -760,6 +760,16 @@ static inline int skb_cloned(const struct sk_buff *skb)
    676 (atomic_read(&skb_shinfo(skb)->dataref) & SKB_DATAREF_MASK) != 1;
    677 }
    678
    679 +static inline int skb_unclone(struct sk_buff *skb, gfp_t pri)
    680 +{
    681 + might_sleep_if(pri & __GFP_WAIT);
    682 +
    683 + if (skb_cloned(skb))
    684 + return pskb_expand_head(skb, 0, 0, pri);
    685 +
    686 + return 0;
    687 +}
    688 +
    689 /**
    690 * skb_header_cloned - is the header a clone
    691 * @skb: buffer to check
    692 @@ -1198,6 +1208,11 @@ static inline int skb_pagelen(const struct sk_buff *skb)
    693 return len + skb_headlen(skb);
    694 }
    695
    696 +static inline bool skb_has_frags(const struct sk_buff *skb)
    697 +{
    698 + return skb_shinfo(skb)->nr_frags;
    699 +}
    700 +
    701 /**
    702 * __skb_fill_page_desc - initialise a paged fragment in an skb
    703 * @skb: buffer containing fragment to be initialised
    704 diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h
    705 index a7a683e30b64..a8c2ef6d3b93 100644
    706 --- a/include/net/cipso_ipv4.h
    707 +++ b/include/net/cipso_ipv4.h
    708 @@ -290,6 +290,7 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
    709 unsigned char err_offset = 0;
    710 u8 opt_len = opt[1];
    711 u8 opt_iter;
    712 + u8 tag_len;
    713
    714 if (opt_len < 8) {
    715 err_offset = 1;
    716 @@ -302,11 +303,12 @@ static inline int cipso_v4_validate(const struct sk_buff *skb,
    717 }
    718
    719 for (opt_iter = 6; opt_iter < opt_len;) {
    720 - if (opt[opt_iter + 1] > (opt_len - opt_iter)) {
    721 + tag_len = opt[opt_iter + 1];
    722 + if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) {
    723 err_offset = opt_iter + 1;
    724 goto out;
    725 }
    726 - opt_iter += opt[opt_iter + 1];
    727 + opt_iter += tag_len;
    728 }
    729
    730 out:
    731 diff --git a/include/net/dst.h b/include/net/dst.h
    732 index 8197eadca819..1efe71aad089 100644
    733 --- a/include/net/dst.h
    734 +++ b/include/net/dst.h
    735 @@ -464,10 +464,22 @@ static inline struct dst_entry *xfrm_lookup(struct net *net,
    736 {
    737 return dst_orig;
    738 }
    739 +
    740 +static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
    741 +{
    742 + return NULL;
    743 +}
    744 +
    745 #else
    746 extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
    747 const struct flowi *fl, struct sock *sk,
    748 int flags);
    749 +
    750 +/* skb attached with this dst needs transformation if dst->xfrm is valid */
    751 +static inline struct xfrm_state *dst_xfrm(const struct dst_entry *dst)
    752 +{
    753 + return dst->xfrm;
    754 +}
    755 #endif
    756
    757 #endif /* _NET_DST_H */
    758 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
    759 index bc8465f579a8..3b15e2a147a2 100644
    760 --- a/mm/page-writeback.c
    761 +++ b/mm/page-writeback.c
    762 @@ -1072,11 +1072,11 @@ static unsigned long dirty_poll_interval(unsigned long dirty,
    763 return 1;
    764 }
    765
    766 -static long bdi_max_pause(struct backing_dev_info *bdi,
    767 - unsigned long bdi_dirty)
    768 +static unsigned long bdi_max_pause(struct backing_dev_info *bdi,
    769 + unsigned long bdi_dirty)
    770 {
    771 - long bw = bdi->avg_write_bandwidth;
    772 - long t;
    773 + unsigned long bw = bdi->avg_write_bandwidth;
    774 + unsigned long t;
    775
    776 /*
    777 * Limit pause time for small memory systems. If sleeping for too long
    778 @@ -1088,7 +1088,7 @@ static long bdi_max_pause(struct backing_dev_info *bdi,
    779 t = bdi_dirty / (1 + bw / roundup_pow_of_two(1 + HZ / 8));
    780 t++;
    781
    782 - return min_t(long, t, MAX_PAUSE);
    783 + return min_t(unsigned long, t, MAX_PAUSE);
    784 }
    785
    786 static long bdi_min_pause(struct backing_dev_info *bdi,
    787 diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
    788 index 50711368ad6a..7f046b4c06bc 100644
    789 --- a/net/8021q/vlan_netlink.c
    790 +++ b/net/8021q/vlan_netlink.c
    791 @@ -152,7 +152,7 @@ static size_t vlan_get_size(const struct net_device *dev)
    792 struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
    793
    794 return nla_total_size(2) + /* IFLA_VLAN_ID */
    795 - sizeof(struct ifla_vlan_flags) + /* IFLA_VLAN_FLAGS */
    796 + nla_total_size(sizeof(struct ifla_vlan_flags)) + /* IFLA_VLAN_FLAGS */
    797 vlan_qos_map_size(vlan->nr_ingress_mappings) +
    798 vlan_qos_map_size(vlan->nr_egress_mappings);
    799 }
    800 diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
    801 index f774796f7e57..2f100ccef86f 100644
    802 --- a/net/bridge/br_stp_if.c
    803 +++ b/net/bridge/br_stp_if.c
    804 @@ -134,7 +134,7 @@ static void br_stp_start(struct net_bridge *br)
    805
    806 if (br->bridge_forward_delay < BR_MIN_FORWARD_DELAY)
    807 __br_set_forward_delay(br, BR_MIN_FORWARD_DELAY);
    808 - else if (br->bridge_forward_delay < BR_MAX_FORWARD_DELAY)
    809 + else if (br->bridge_forward_delay > BR_MAX_FORWARD_DELAY)
    810 __br_set_forward_delay(br, BR_MAX_FORWARD_DELAY);
    811
    812 if (r == 0) {
    813 diff --git a/net/compat.c b/net/compat.c
    814 index 014e1c78ecc5..ee84d82d7287 100644
    815 --- a/net/compat.c
    816 +++ b/net/compat.c
    817 @@ -71,6 +71,8 @@ int get_compat_msghdr(struct msghdr *kmsg, struct compat_msghdr __user *umsg)
    818 __get_user(kmsg->msg_controllen, &umsg->msg_controllen) ||
    819 __get_user(kmsg->msg_flags, &umsg->msg_flags))
    820 return -EFAULT;
    821 + if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
    822 + return -EINVAL;
    823 kmsg->msg_name = compat_ptr(tmp1);
    824 kmsg->msg_iov = compat_ptr(tmp2);
    825 kmsg->msg_control = compat_ptr(tmp3);
    826 diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
    827 index 984ec656b03b..4afcf31bdfeb 100644
    828 --- a/net/ipv4/inet_hashtables.c
    829 +++ b/net/ipv4/inet_hashtables.c
    830 @@ -268,7 +268,7 @@ begintw:
    831 }
    832 if (unlikely(!INET_TW_MATCH(sk, net, hash, acookie,
    833 saddr, daddr, ports, dif))) {
    834 - sock_put(sk);
    835 + inet_twsk_put(inet_twsk(sk));
    836 goto begintw;
    837 }
    838 goto out;
    839 diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
    840 index 3bc4c978d7ad..d6407b563fd8 100644
    841 --- a/net/ipv4/ip_output.c
    842 +++ b/net/ipv4/ip_output.c
    843 @@ -846,7 +846,7 @@ static int __ip_append_data(struct sock *sk,
    844 csummode = CHECKSUM_PARTIAL;
    845
    846 cork->length += length;
    847 - if (((length > mtu) || (skb && skb_is_gso(skb))) &&
    848 + if (((length > mtu) || (skb && skb_has_frags(skb))) &&
    849 (sk->sk_protocol == IPPROTO_UDP) &&
    850 (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
    851 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
    852 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    853 index 167ea10b521a..108c73d760df 100644
    854 --- a/net/ipv4/route.c
    855 +++ b/net/ipv4/route.c
    856 @@ -2713,7 +2713,7 @@ static struct rtable *ip_route_output_slow(struct net *net, struct flowi4 *fl4)
    857 RT_SCOPE_LINK);
    858 goto make_route;
    859 }
    860 - if (fl4->saddr) {
    861 + if (!fl4->saddr) {
    862 if (ipv4_is_multicast(fl4->daddr))
    863 fl4->saddr = inet_select_addr(dev_out, 0,
    864 fl4->flowi4_scope);
    865 diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    866 index 55d96c392e7f..99eb909c9d5f 100644
    867 --- a/net/ipv4/tcp_input.c
    868 +++ b/net/ipv4/tcp_input.c
    869 @@ -1468,7 +1468,10 @@ static int tcp_shifted_skb(struct sock *sk, struct sk_buff *skb,
    870 tp->lost_cnt_hint -= tcp_skb_pcount(prev);
    871 }
    872
    873 - TCP_SKB_CB(skb)->tcp_flags |= TCP_SKB_CB(prev)->tcp_flags;
    874 + TCP_SKB_CB(prev)->tcp_flags |= TCP_SKB_CB(skb)->tcp_flags;
    875 + if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
    876 + TCP_SKB_CB(prev)->end_seq++;
    877 +
    878 if (skb == tcp_highest_sack(sk))
    879 tcp_advance_highest_sack(sk, skb);
    880
    881 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    882 index 12999a3aaf95..987f5cc706b4 100644
    883 --- a/net/ipv4/tcp_output.c
    884 +++ b/net/ipv4/tcp_output.c
    885 @@ -933,6 +933,9 @@ static void tcp_queue_skb(struct sock *sk, struct sk_buff *skb)
    886 static void tcp_set_skb_tso_segs(const struct sock *sk, struct sk_buff *skb,
    887 unsigned int mss_now)
    888 {
    889 + /* Make sure we own this skb before messing gso_size/gso_segs */
    890 + WARN_ON_ONCE(skb_cloned(skb));
    891 +
    892 if (skb->len <= mss_now || !sk_can_gso(sk) ||
    893 skb->ip_summed == CHECKSUM_NONE) {
    894 /* Avoid the costly divide in the normal
    895 @@ -1014,9 +1017,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len,
    896 if (nsize < 0)
    897 nsize = 0;
    898
    899 - if (skb_cloned(skb) &&
    900 - skb_is_nonlinear(skb) &&
    901 - pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
    902 + if (skb_unclone(skb, GFP_ATOMIC))
    903 return -ENOMEM;
    904
    905 /* Get a new skb... force flag on. */
    906 @@ -2129,6 +2130,8 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb)
    907 int oldpcount = tcp_skb_pcount(skb);
    908
    909 if (unlikely(oldpcount > 1)) {
    910 + if (skb_unclone(skb, GFP_ATOMIC))
    911 + return -ENOMEM;
    912 tcp_init_tso_segs(sk, skb, cur_mss);
    913 tcp_adjust_pcount(sk, skb, oldpcount - tcp_skb_pcount(skb));
    914 }
    915 diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
    916 index 73f1a00a96af..e38290b7c7a1 100644
    917 --- a/net/ipv6/inet6_hashtables.c
    918 +++ b/net/ipv6/inet6_hashtables.c
    919 @@ -110,7 +110,7 @@ begintw:
    920 goto out;
    921 }
    922 if (!INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
    923 - sock_put(sk);
    924 + inet_twsk_put(inet_twsk(sk));
    925 goto begintw;
    926 }
    927 goto out;
    928 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    929 index 1acfb19cb570..7dabea3a7125 100644
    930 --- a/net/ipv6/ip6_output.c
    931 +++ b/net/ipv6/ip6_output.c
    932 @@ -1345,7 +1345,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
    933 skb = skb_peek_tail(&sk->sk_write_queue);
    934 cork->length += length;
    935 if (((length > mtu) ||
    936 - (skb && skb_is_gso(skb))) &&
    937 + (skb && skb_has_frags(skb))) &&
    938 (sk->sk_protocol == IPPROTO_UDP) &&
    939 (rt->dst.dev->features & NETIF_F_UFO)) {
    940 err = ip6_ufo_append_data(sk, getfrag, from, length,
    941 diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    942 index 016ed7c22fc9..4f768a4c2907 100644
    943 --- a/net/ipv6/route.c
    944 +++ b/net/ipv6/route.c
    945 @@ -818,7 +818,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort,
    946 }
    947
    948 static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, int oif,
    949 - struct flowi6 *fl6, int flags)
    950 + struct flowi6 *fl6, int flags, bool input)
    951 {
    952 struct fib6_node *fn;
    953 struct rt6_info *rt, *nrt;
    954 @@ -826,8 +826,11 @@ static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
    955 int attempts = 3;
    956 int err;
    957 int reachable = net->ipv6.devconf_all->forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
    958 + int local = RTF_NONEXTHOP;
    959
    960 strict |= flags & RT6_LOOKUP_F_IFACE;
    961 + if (input)
    962 + local |= RTF_LOCAL;
    963
    964 relookup:
    965 read_lock_bh(&table->tb6_lock);
    966 @@ -847,7 +850,7 @@ restart:
    967 read_unlock_bh(&table->tb6_lock);
    968
    969 if (!dst_get_neighbour_noref_raw(&rt->dst) &&
    970 - !(rt->rt6i_flags & (RTF_NONEXTHOP | RTF_LOCAL)))
    971 + !(rt->rt6i_flags & local))
    972 nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
    973 else if (!(rt->dst.flags & DST_HOST))
    974 nrt = rt6_alloc_clone(rt, &fl6->daddr);
    975 @@ -891,7 +894,7 @@ out2:
    976 static struct rt6_info *ip6_pol_route_input(struct net *net, struct fib6_table *table,
    977 struct flowi6 *fl6, int flags)
    978 {
    979 - return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags);
    980 + return ip6_pol_route(net, table, fl6->flowi6_iif, fl6, flags, true);
    981 }
    982
    983 static struct dst_entry *ip6_route_input_lookup(struct net *net,
    984 @@ -924,7 +927,7 @@ void ip6_route_input(struct sk_buff *skb)
    985 static struct rt6_info *ip6_pol_route_output(struct net *net, struct fib6_table *table,
    986 struct flowi6 *fl6, int flags)
    987 {
    988 - return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags);
    989 + return ip6_pol_route(net, table, fl6->flowi6_oif, fl6, flags, false);
    990 }
    991
    992 struct dst_entry * ip6_route_output(struct net *net, const struct sock *sk,
    993 diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
    994 index b2982f4214d1..904bc098790d 100644
    995 --- a/net/l2tp/l2tp_ppp.c
    996 +++ b/net/l2tp/l2tp_ppp.c
    997 @@ -357,7 +357,9 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
    998 goto error_put_sess_tun;
    999 }
    1000
    1001 + local_bh_disable();
    1002 l2tp_xmit_skb(session, skb, session->hdr_len);
    1003 + local_bh_enable();
    1004
    1005 sock_put(ps->tunnel_sock);
    1006 sock_put(sk);
    1007 @@ -432,7 +434,9 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
    1008 skb->data[0] = ppph[0];
    1009 skb->data[1] = ppph[1];
    1010
    1011 + local_bh_disable();
    1012 l2tp_xmit_skb(session, skb, session->hdr_len);
    1013 + local_bh_enable();
    1014
    1015 sock_put(sk_tun);
    1016 sock_put(sk);
    1017 diff --git a/net/sctp/output.c b/net/sctp/output.c
    1018 index 32ba8d0e50e2..cf3e22c586a6 100644
    1019 --- a/net/sctp/output.c
    1020 +++ b/net/sctp/output.c
    1021 @@ -518,7 +518,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
    1022 * by CRC32-C as described in <draft-ietf-tsvwg-sctpcsum-02.txt>.
    1023 */
    1024 if (!sctp_checksum_disable) {
    1025 - if (!(dst->dev->features & NETIF_F_SCTP_CSUM)) {
    1026 + if (!(dst->dev->features & NETIF_F_SCTP_CSUM) ||
    1027 + (dst_xfrm(dst) != NULL) || packet->ipfragok) {
    1028 __u32 crc32 = sctp_start_cksum((__u8 *)sh, cksum_buf_len);
    1029
    1030 /* 3) Put the resultant value into the checksum field in the
    1031 diff --git a/net/socket.c b/net/socket.c
    1032 index 47ce3ea44300..acc769562707 100644
    1033 --- a/net/socket.c
    1034 +++ b/net/socket.c
    1035 @@ -1899,6 +1899,16 @@ struct used_address {
    1036 unsigned int name_len;
    1037 };
    1038
    1039 +static int copy_msghdr_from_user(struct msghdr *kmsg,
    1040 + struct msghdr __user *umsg)
    1041 +{
    1042 + if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
    1043 + return -EFAULT;
    1044 + if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
    1045 + return -EINVAL;
    1046 + return 0;
    1047 +}
    1048 +
    1049 static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
    1050 struct msghdr *msg_sys, unsigned flags,
    1051 struct used_address *used_address)
    1052 @@ -1917,8 +1927,11 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
    1053 if (MSG_CMSG_COMPAT & flags) {
    1054 if (get_compat_msghdr(msg_sys, msg_compat))
    1055 return -EFAULT;
    1056 - } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
    1057 - return -EFAULT;
    1058 + } else {
    1059 + err = copy_msghdr_from_user(msg_sys, msg);
    1060 + if (err)
    1061 + return err;
    1062 + }
    1063
    1064 /* do not move before msg_sys is valid */
    1065 err = -EMSGSIZE;
    1066 @@ -2129,8 +2142,11 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
    1067 if (MSG_CMSG_COMPAT & flags) {
    1068 if (get_compat_msghdr(msg_sys, msg_compat))
    1069 return -EFAULT;
    1070 - } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
    1071 - return -EFAULT;
    1072 + } else {
    1073 + err = copy_msghdr_from_user(msg_sys, msg);
    1074 + if (err)
    1075 + return err;
    1076 + }
    1077
    1078 err = -EMSGSIZE;
    1079 if (msg_sys->msg_iovlen > UIO_MAXIOV)
    1080 diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
    1081 index c4821fd23b79..ed005b425a7c 100644
    1082 --- a/net/unix/af_unix.c
    1083 +++ b/net/unix/af_unix.c
    1084 @@ -1247,6 +1247,15 @@ static int unix_socketpair(struct socket *socka, struct socket *sockb)
    1085 return 0;
    1086 }
    1087
    1088 +static void unix_sock_inherit_flags(const struct socket *old,
    1089 + struct socket *new)
    1090 +{
    1091 + if (test_bit(SOCK_PASSCRED, &old->flags))
    1092 + set_bit(SOCK_PASSCRED, &new->flags);
    1093 + if (test_bit(SOCK_PASSSEC, &old->flags))
    1094 + set_bit(SOCK_PASSSEC, &new->flags);
    1095 +}
    1096 +
    1097 static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
    1098 {
    1099 struct sock *sk = sock->sk;
    1100 @@ -1281,6 +1290,7 @@ static int unix_accept(struct socket *sock, struct socket *newsock, int flags)
    1101 /* attach accepted sock to socket */
    1102 unix_state_lock(tsk);
    1103 newsock->state = SS_CONNECTED;
    1104 + unix_sock_inherit_flags(sock, newsock);
    1105 sock_graft(tsk, newsock);
    1106 unix_state_unlock(tsk);
    1107 return 0;
    1108 diff --git a/net/unix/diag.c b/net/unix/diag.c
    1109 index f0486ae9ebe6..2656840cf203 100644
    1110 --- a/net/unix/diag.c
    1111 +++ b/net/unix/diag.c
    1112 @@ -134,6 +134,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb, struct unix_diag_r
    1113 rep->udiag_family = AF_UNIX;
    1114 rep->udiag_type = sk->sk_type;
    1115 rep->udiag_state = sk->sk_state;
    1116 + rep->pad = 0;
    1117 rep->udiag_ino = sk_ino;
    1118 sock_diag_save_cookie(sk, rep->udiag_cookie);
    1119
    1120 diff --git a/net/wireless/radiotap.c b/net/wireless/radiotap.c
    1121 index c4ad7958af52..617a310025b1 100644
    1122 --- a/net/wireless/radiotap.c
    1123 +++ b/net/wireless/radiotap.c
    1124 @@ -95,6 +95,10 @@ int ieee80211_radiotap_iterator_init(
    1125 struct ieee80211_radiotap_header *radiotap_header,
    1126 int max_length, const struct ieee80211_radiotap_vendor_namespaces *vns)
    1127 {
    1128 + /* check the radiotap header can actually be present */
    1129 + if (max_length < sizeof(struct ieee80211_radiotap_header))
    1130 + return -EINVAL;
    1131 +
    1132 /* Linux only supports version 0 radiotap format */
    1133 if (radiotap_header->it_version)
    1134 return -EINVAL;
    1135 @@ -129,7 +133,8 @@ int ieee80211_radiotap_iterator_init(
    1136 */
    1137
    1138 if ((unsigned long)iterator->_arg -
    1139 - (unsigned long)iterator->_rtheader >
    1140 + (unsigned long)iterator->_rtheader +
    1141 + sizeof(uint32_t) >
    1142 (unsigned long)iterator->_max_length)
    1143 return -EINVAL;
    1144 }