Merge tag 'v3.4.109' into mm-6.0
Change-Id: I93b29443377e338fc5d3b031b130da720f788879
Signed-off-by: José Adolfo Galdámez <josegalre@pac-rom.com>
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 5ba0c84..3cb93e8 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -440,7 +440,7 @@
fdb->updated = jiffies;
}
} else {
- spin_lock(&br->hash_lock);
+ spin_lock_bh(&br->hash_lock);
if (likely(!fdb_find(head, addr))) {
fdb = fdb_create(head, source, addr);
if (fdb)
@@ -449,7 +449,7 @@
/* else we lose race and someone else inserts
* it first, don't bother updating
*/
- spin_unlock(&br->hash_lock);
+ spin_unlock_bh(&br->hash_lock);
}
}
@@ -665,9 +665,11 @@
}
if (ndm->ndm_flags & NTF_USE) {
+ local_bh_disable();
rcu_read_lock();
br_fdb_update(p->br, p, addr);
rcu_read_unlock();
+ local_bh_enable();
} else {
spin_lock_bh(&p->br->hash_lock);
err = fdb_add_entry(p, addr, ndm->ndm_state, nlh->nlmsg_flags);
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 0b870d7..a41051a 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -972,7 +972,7 @@
}
err = br_ip6_multicast_add_group(br, port, &grec->grec_mca);
- if (!err)
+ if (err)
break;
}
@@ -991,6 +991,9 @@
struct net_bridge_port *p;
struct hlist_node *n, *slot = NULL;
+ if (!hlist_unhashed(&port->rlist))
+ return;
+
hlist_for_each_entry(p, n, &br->router_list, rlist) {
if ((unsigned long) port >= (unsigned long) p)
break;
@@ -1018,12 +1021,8 @@
if (port->multicast_router != 1)
return;
- if (!hlist_unhashed(&port->rlist))
- goto timer;
-
br_multicast_add_router(br, port);
-timer:
mod_timer(&port->multicast_router_timer,
now + br->multicast_querier_interval);
}
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index e54ef82..5ba4248 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -818,12 +818,12 @@
return NF_STOLEN;
}
-#if IS_ENABLED(CONFIG_NF_CONNTRACK_IPV4)
+#if IS_ENABLED(CONFIG_NF_DEFRAG_IPV4)
static int br_nf_dev_queue_xmit(struct sk_buff *skb)
{
int ret;
- if (skb->nfct != NULL && skb->protocol == htons(ETH_P_IP) &&
+ if (skb->protocol == htons(ETH_P_IP) &&
skb->len + nf_bridge_mtu_reduction(skb) > skb->dev->mtu &&
!skb_is_gso(skb)) {
if (br_parse_ip_options(skb))
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5fbb7cc..e7bb871 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1659,6 +1659,17 @@
goto out;
}
+#ifdef CONFIG_IPV6_MULTIPLE_TABLES
+ if (rt == net->ipv6.ip6_blk_hole_entry ||
+ rt == net->ipv6.ip6_prohibit_entry) {
+ if (net_ratelimit())
+ printk(KERN_DEBUG "rt6_redirect: source isn't a valid" \
+ " nexthop for redirect target " \
+ "(blackhole or prohibited)\n");
+ goto out;
+ }
+#endif
+
/*
* We have finally decided to accept it.
*/
diff --git a/net/mac80211/wep.c b/net/mac80211/wep.c
index 7aa31bb..9464f92 100644
--- a/net/mac80211/wep.c
+++ b/net/mac80211/wep.c
@@ -97,8 +97,7 @@
hdr->frame_control |= cpu_to_le16(IEEE80211_FCTL_PROTECTED);
- if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN ||
- skb_headroom(skb) < WEP_IV_LEN))
+ if (WARN_ON(skb_headroom(skb) < WEP_IV_LEN))
return NULL;
hdrlen = ieee80211_hdrlen(hdr->frame_control);
@@ -160,6 +159,9 @@
size_t len;
u8 rc4key[3 + WLAN_KEY_LEN_WEP104];
+ if (WARN_ON(skb_tailroom(skb) < WEP_ICV_LEN))
+ return -1;
+
iv = ieee80211_wep_add_iv(local, skb, keylen, keyidx);
if (!iv)
return -1;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index cbc5bfd..f2ed4a9 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -3689,6 +3689,9 @@
cancel_delayed_work_sync(&ipvs->defense_work);
cancel_work_sync(&ipvs->defense_work.work);
unregister_net_sysctl_table(ipvs->sysctl_hdr);
+
+ if (!net_eq(net, &init_net))
+ kfree(ipvs->sysctl_tbl);
}
#else
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index bde7d69..e895636 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -194,7 +194,8 @@
if (rose->device == dev) {
rose_disconnect(s, ENETUNREACH, ROSE_OUT_OF_ORDER, 0);
- rose->neighbour->use--;
+ if (rose->neighbour)
+ rose->neighbour->use--;
rose->device = NULL;
}
}
diff --git a/net/socket.c b/net/socket.c
index 025f7f4..f5ce151 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1934,14 +1934,12 @@
int err, ctl_len, iov_size, total_len;
err = -EFAULT;
- if (MSG_CMSG_COMPAT & flags) {
- if (get_compat_msghdr(msg_sys, msg_compat))
- return -EFAULT;
- } else {
+ if (MSG_CMSG_COMPAT & flags)
+ err = get_compat_msghdr(msg_sys, msg_compat);
+ else
err = copy_msghdr_from_user(msg_sys, msg);
- if (err)
- return err;
- }
+ if (err)
+ return err;
/* do not move before msg_sys is valid */
err = -EMSGSIZE;
@@ -2149,14 +2147,12 @@
struct sockaddr __user *uaddr;
int __user *uaddr_len;
- if (MSG_CMSG_COMPAT & flags) {
- if (get_compat_msghdr(msg_sys, msg_compat))
- return -EFAULT;
- } else {
+ if (MSG_CMSG_COMPAT & flags)
+ err = get_compat_msghdr(msg_sys, msg_compat);
+ else
err = copy_msghdr_from_user(msg_sys, msg);
- if (err)
- return err;
- }
+ if (err)
+ return err;
err = -EMSGSIZE;
if (msg_sys->msg_iovlen > UIO_MAXIOV)