--- /dev/null
+From 7487c1d7e3a4c9f882d820936466c5df1ca4a2ae Mon Sep 17 00:00:00 2001
+From: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
+Date: Wed, 12 Oct 2011 16:04:29 +0000
+Subject: bonding: use local function pointer of bond->recv_probe in bond_handle_frame
+
+
+From: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
+
+[ Upstream commit 4d97480b1806e883eb1c7889d4e7a87e936e06d9 ]
+
+The bond->recv_probe is called in bond_handle_frame() when
+a packet is received, but bond_close() sets it to NULL. So,
+a panic occurs when both functions work in parallel.
+
+Why this happen:
+After null pointer check of bond->recv_probe, an sk_buff is
+duplicated and bond->recv_probe is called in bond_handle_frame.
+So, a panic occurs when bond_close() is called between the
+check and call of bond->recv_probe.
+
+Patch:
+This patch uses a local function pointer of bond->recv_probe
+in bond_handle_frame(). So, it can avoid the null pointer
+dereference.
+
+Signed-off-by: Mitsuo Hayasaka <mitsuo.hayasaka.hu@hitachi.com>
+Cc: Jay Vosburgh <fubar@us.ibm.com>
+Cc: Andy Gospodarek <andy@greyhouse.net>
+Cc: Eric Dumazet <eric.dumazet@gmail.com>
+Cc: WANG Cong <xiyou.wangcong@gmail.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/bonding/bond_main.c | 7 +++++--
+ 1 file changed, 5 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1500,6 +1500,8 @@ static rx_handler_result_t bond_handle_f
+ struct sk_buff *skb = *pskb;
+ struct slave *slave;
+ struct bonding *bond;
++ void (*recv_probe)(struct sk_buff *, struct bonding *,
++ struct slave *);
+
+ skb = skb_share_check(skb, GFP_ATOMIC);
+ if (unlikely(!skb))
+@@ -1513,11 +1515,12 @@ static rx_handler_result_t bond_handle_f
+ if (bond->params.arp_interval)
+ slave->dev->last_rx = jiffies;
+
+- if (bond->recv_probe) {
++ recv_probe = ACCESS_ONCE(bond->recv_probe);
++ if (recv_probe) {
+ struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
+
+ if (likely(nskb)) {
+- bond->recv_probe(nskb, bond, slave);
++ recv_probe(nskb, bond, slave);
+ dev_kfree_skb(nskb);
+ }
+ }
--- /dev/null
+From 431aace946beae4a74c98e3a5ac79b051b4d2900 Mon Sep 17 00:00:00 2001
+From: stephen hemminger <shemminger@vyatta.com>
+Date: Thu, 6 Oct 2011 11:19:41 +0000
+Subject: bridge: fix hang on removal of bridge via netlink
+
+
+From: stephen hemminger <shemminger@vyatta.com>
+
+[ Upstream commit 1ce5cce895309862d2c35d922816adebe094fe4a ]
+
+Need to cleanup bridge device timers and ports when being bridge
+device is being removed via netlink.
+
+This fixes the problem of observed when doing:
+ ip link add br0 type bridge
+ ip link set dev eth1 master br0
+ ip link set br0 up
+ ip link del br0
+
+which would cause br0 to hang in unregister_netdev because
+of leftover reference count.
+
+Reported-by: Sridhar Samudrala <sri@us.ibm.com>
+Signed-off-by: Stephen Hemminger <shemminger@vyatta.com>
+Acked-by: Sridhar Samudrala <sri@us.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/bridge/br_if.c | 9 +++++----
+ net/bridge/br_netlink.c | 1 +
+ net/bridge/br_private.h | 1 +
+ 3 files changed, 7 insertions(+), 4 deletions(-)
+
+--- a/net/bridge/br_if.c
++++ b/net/bridge/br_if.c
+@@ -161,9 +161,10 @@ static void del_nbp(struct net_bridge_po
+ call_rcu(&p->rcu, destroy_nbp_rcu);
+ }
+
+-/* called with RTNL */
+-static void del_br(struct net_bridge *br, struct list_head *head)
++/* Delete bridge device */
++void br_dev_delete(struct net_device *dev, struct list_head *head)
+ {
++ struct net_bridge *br = netdev_priv(dev);
+ struct net_bridge_port *p, *n;
+
+ list_for_each_entry_safe(p, n, &br->port_list, list) {
+@@ -268,7 +269,7 @@ int br_del_bridge(struct net *net, const
+ }
+
+ else
+- del_br(netdev_priv(dev), NULL);
++ br_dev_delete(dev, NULL);
+
+ rtnl_unlock();
+ return ret;
+@@ -445,7 +446,7 @@ void __net_exit br_net_exit(struct net *
+ rtnl_lock();
+ for_each_netdev(net, dev)
+ if (dev->priv_flags & IFF_EBRIDGE)
+- del_br(netdev_priv(dev), &list);
++ br_dev_delete(dev, &list);
+
+ unregister_netdevice_many(&list);
+ rtnl_unlock();
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -208,6 +208,7 @@ static struct rtnl_link_ops br_link_ops
+ .priv_size = sizeof(struct net_bridge),
+ .setup = br_dev_setup,
+ .validate = br_validate,
++ .dellink = br_dev_delete,
+ };
+
+ int __init br_netlink_init(void)
+--- a/net/bridge/br_private.h
++++ b/net/bridge/br_private.h
+@@ -294,6 +294,7 @@ static inline int br_is_root_bridge(cons
+
+ /* br_device.c */
+ extern void br_dev_setup(struct net_device *dev);
++extern void br_dev_delete(struct net_device *dev, struct list_head *list);
+ extern netdev_tx_t br_dev_xmit(struct sk_buff *skb,
+ struct net_device *dev);
+ #ifdef CONFIG_NET_POLL_CONTROLLER
--- /dev/null
+From 1f60b78fb2ee344c36bb14f21d44255a1dcafcde Mon Sep 17 00:00:00 2001
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+Date: Fri, 23 Sep 2011 08:23:47 +0000
+Subject: can bcm: fix tx_setup off-by-one errors
+
+
+From: Oliver Hartkopp <socketcan@hartkopp.net>
+
+[ Upstream commit aabdcb0b553b9c9547b1a506b34d55a764745870 ]
+
+This patch fixes two off-by-one errors that canceled each other out.
+Checking for the same condition two times in bcm_tx_timeout_tsklet() reduced
+the count of frames to be sent by one. This did not show up the first time
+tx_setup is invoked as an additional frame is sent due to TX_ANNONCE.
+Invoking a second tx_setup on the same item led to a reduced (by 1) number of
+sent frames.
+
+Reported-by: Andre Naujoks <nautsch@gmail.com>
+Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/can/bcm.c | 13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/net/can/bcm.c
++++ b/net/can/bcm.c
+@@ -364,9 +364,6 @@ static void bcm_tx_timeout_tsklet(unsign
+
+ bcm_send_to_user(op, &msg_head, NULL, 0);
+ }
+- }
+-
+- if (op->kt_ival1.tv64 && (op->count > 0)) {
+
+ /* send (next) frame */
+ bcm_can_tx(op);
+@@ -969,8 +966,9 @@ static int bcm_tx_setup(struct bcm_msg_h
+ /* spec: send can_frame when starting timer */
+ op->flags |= TX_ANNOUNCE;
+
+- if (op->kt_ival1.tv64 && (op->count > 0)) {
+- /* op->count-- is done in bcm_tx_timeout_handler */
++ /* only start timer when having more frames than sent below */
++ if (op->kt_ival1.tv64 && (op->count > 1)) {
++ /* op->count-- is done in bcm_tx_timeout_tsklet */
+ hrtimer_start(&op->timer, op->kt_ival1,
+ HRTIMER_MODE_REL);
+ } else
+@@ -978,8 +976,11 @@ static int bcm_tx_setup(struct bcm_msg_h
+ HRTIMER_MODE_REL);
+ }
+
+- if (op->flags & TX_ANNOUNCE)
++ if (op->flags & TX_ANNOUNCE) {
+ bcm_can_tx(op);
++ if (op->kt_ival1.tv64 && (op->count > 0))
++ op->count--;
++ }
+
+ return msg_head->nframes * CFSIZ + MHSIZ;
+ }
--- /dev/null
+From dfb3029e1e6524dfbefecc0f3d5732cec794d054 Mon Sep 17 00:00:00 2001
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+Date: Sat, 22 Oct 2011 21:58:20 +0000
+Subject: ipv4: fix ipsec forward performance regression
+
+
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+
+[ Upstream commit b73233960a59ee66e09d642f13d0592b13651e94 ]
+
+There is bug in commit 5e2b61f(ipv4: Remove flowi from struct rtable).
+It makes xfrm4_fill_dst() modify wrong data structure.
+
+Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
+Reported-by: Kim Phillips <kim.phillips@freescale.com>
+Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/xfrm4_policy.c | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/net/ipv4/xfrm4_policy.c
++++ b/net/ipv4/xfrm4_policy.c
+@@ -79,13 +79,13 @@ static int xfrm4_fill_dst(struct xfrm_ds
+ struct rtable *rt = (struct rtable *)xdst->route;
+ const struct flowi4 *fl4 = &fl->u.ip4;
+
+- rt->rt_key_dst = fl4->daddr;
+- rt->rt_key_src = fl4->saddr;
+- rt->rt_key_tos = fl4->flowi4_tos;
+- rt->rt_route_iif = fl4->flowi4_iif;
+- rt->rt_iif = fl4->flowi4_iif;
+- rt->rt_oif = fl4->flowi4_oif;
+- rt->rt_mark = fl4->flowi4_mark;
++ xdst->u.rt.rt_key_dst = fl4->daddr;
++ xdst->u.rt.rt_key_src = fl4->saddr;
++ xdst->u.rt.rt_key_tos = fl4->flowi4_tos;
++ xdst->u.rt.rt_route_iif = fl4->flowi4_iif;
++ xdst->u.rt.rt_iif = fl4->flowi4_iif;
++ xdst->u.rt.rt_oif = fl4->flowi4_oif;
++ xdst->u.rt.rt_mark = fl4->flowi4_mark;
+
+ xdst->u.dst.dev = dev;
+ dev_hold(dev);
--- /dev/null
+From 822b4bd8f14b64c946f0420d162cacf0754bf18d Mon Sep 17 00:00:00 2001
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+Date: Sun, 25 Sep 2011 02:21:30 +0000
+Subject: ipv6: nullify ipv6_ac_list and ipv6_fl_list when creating new socket
+
+
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+
+[ Upstream commit 676a1184e8afd4fed7948232df1ff91517400859 ]
+
+ipv6_ac_list and ipv6_fl_list from listening socket are inadvertently
+shared with new socket created for connection.
+
+Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv6/tcp_ipv6.c | 3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -1409,6 +1409,8 @@ static struct sock * tcp_v6_syn_recv_soc
+ newtp->af_specific = &tcp_sock_ipv6_mapped_specific;
+ #endif
+
++ newnp->ipv6_ac_list = NULL;
++ newnp->ipv6_fl_list = NULL;
+ newnp->pktoptions = NULL;
+ newnp->opt = NULL;
+ newnp->mcast_oif = inet6_iif(skb);
+@@ -1473,6 +1475,7 @@ static struct sock * tcp_v6_syn_recv_soc
+ First: no IPv4 options.
+ */
+ newinet->inet_opt = NULL;
++ newnp->ipv6_ac_list = NULL;
+ newnp->ipv6_fl_list = NULL;
+
+ /* Clone RX bits */
--- /dev/null
+From 6d99e95f5255f0a3d6434137091cb73c90b00c28 Mon Sep 17 00:00:00 2001
+From: Eric Dumazet <eric.dumazet@gmail.com>
+Date: Fri, 7 Oct 2011 05:35:46 +0000
+Subject: l2tp: fix a potential skb leak in l2tp_xmit_skb()
+
+
+From: Eric Dumazet <eric.dumazet@gmail.com>
+
+[ Upstream commit 835acf5da239b91edb9f7ebe36516999e156e6ee ]
+
+l2tp_xmit_skb() can leak one skb if skb_cow_head() returns an error.
+
+Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/l2tp/l2tp_core.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/net/l2tp/l2tp_core.c
++++ b/net/l2tp/l2tp_core.c
+@@ -1045,8 +1045,10 @@ int l2tp_xmit_skb(struct l2tp_session *s
+ headroom = NET_SKB_PAD + sizeof(struct iphdr) +
+ uhlen + hdr_len;
+ old_headroom = skb_headroom(skb);
+- if (skb_cow_head(skb, headroom))
++ if (skb_cow_head(skb, headroom)) {
++ dev_kfree_skb(skb);
+ goto abort;
++ }
+
+ new_headroom = skb_headroom(skb);
+ skb_orphan(skb);
--- /dev/null
+From 74deb48f62095b945c7b00422f7b1541ebd2ea34 Mon Sep 17 00:00:00 2001
+From: David Ward <david.ward@ll.mit.edu>
+Date: Sun, 18 Sep 2011 12:53:20 +0000
+Subject: macvlan/macvtap: Fix unicast between macvtap interfaces in bridge mode
+
+
+From: David Ward <david.ward@ll.mit.edu>
+
+[ Upstream commit cb2d0f3e968bff7c6d262aca3e3ab8d4184e69b2 ]
+
+Packets should always be forwarded to the lowerdev using dev_forward_skb.
+vlan->forward is for packets being forwarded directly to another macvlan/
+macvtap device (used for multicast in bridge mode).
+
+Reported-and-tested-by: Shlomo Pongratz <shlomop@mellanox.com>
+Signed-off-by: David Ward <david.ward@ll.mit.edu>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/macvlan.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -239,7 +239,7 @@ static int macvlan_queue_xmit(struct sk_
+ dest = macvlan_hash_lookup(port, eth->h_dest);
+ if (dest && dest->mode == MACVLAN_MODE_BRIDGE) {
+ /* send to lowerdev first for its network taps */
+- vlan->forward(vlan->lowerdev, skb);
++ dev_forward_skb(vlan->lowerdev, skb);
+
+ return NET_XMIT_SUCCESS;
+ }
--- /dev/null
+From d084e1834f09ab9b876470add92a3870d5636f58 Mon Sep 17 00:00:00 2001
+From: Willem de Bruijn <willemb@google.com>
+Date: Fri, 30 Sep 2011 10:38:28 +0000
+Subject: make PACKET_STATISTICS getsockopt report consistently between ring and non-ring
+
+
+From: Willem de Bruijn <willemb@google.com>
+
+[ Upstream commit 7091fbd82cd5686444ffe9935ed6a8190101fe9d ]
+
+This is a minor change.
+
+Up until kernel 2.6.32, getsockopt(fd, SOL_PACKET, PACKET_STATISTICS,
+...) would return total and dropped packets since its last invocation. The
+introduction of socket queue overflow reporting [1] changed drop
+rate calculation in the normal packet socket path, but not when using a
+packet ring. As a result, the getsockopt now returns different statistics
+depending on the reception method used. With a ring, it still returns the
+count since the last call, as counts are incremented in tpacket_rcv and
+reset in getsockopt. Without a ring, it returns 0 if no drops occurred
+since the last getsockopt and the total drops over the lifespan of
+the socket otherwise. The culprit is this line in packet_rcv, executed
+on a drop:
+
+drop_n_acct:
+ po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
+
+As it shows, the new drop number it taken from the socket drop counter,
+which is not reset at getsockopt. I put together a small example
+that demonstrates the issue [2]. It runs for 10 seconds and overflows
+the queue/ring on every odd second. The reported drop rates are:
+ring: 16, 0, 16, 0, 16, ...
+non-ring: 0, 15, 0, 30, 0, 46, 0, 60, 0 , 74.
+
+Note how the even ring counts monotonically increase. Because the
+getsockopt adds tp_drops to tp_packets, total counts are similarly
+reported cumulatively. Long story short, reinstating the original code, as
+the below patch does, fixes the issue at the cost of additional per-packet
+cycles. Another solution that does not introduce per-packet overhead
+is be to keep the current data path, record the value of sk_drops at
+getsockopt() at call N in a new field in struct packetsock and subtract
+that when reporting at call N+1. I'll be happy to code that, instead,
+it's just more messy.
+
+[1] http://patchwork.ozlabs.org/patch/35665/
+[2] http://kernel.googlecode.com/files/test-packetsock-getstatistics.c
+
+Signed-off-by: Willem de Bruijn <willemb@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/packet/af_packet.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -654,7 +654,10 @@ static int packet_rcv(struct sk_buff *sk
+ return 0;
+
+ drop_n_acct:
+- po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
++ spin_lock(&sk->sk_receive_queue.lock);
++ po->stats.tp_drops++;
++ atomic_inc(&sk->sk_drops);
++ spin_unlock(&sk->sk_receive_queue.lock);
+
+ drop_n_restore:
+ if (skb_head != skb->data && skb_shared(skb)) {
--- /dev/null
+From e5aef0ab2ecd79524da9e2364b665310c746c10e Mon Sep 17 00:00:00 2001
+From: David Vrabel <david.vrabel@citrix.com>
+Date: Fri, 30 Sep 2011 06:37:51 +0000
+Subject: net: xen-netback: correctly restart Tx after a VM restore/migrate
+
+
+From: David Vrabel <david.vrabel@citrix.com>
+
+[ Upstream commit d0e5d83284dac15c015bb48115b6780f5a6413cd ]
+
+If a VM is saved and restored (or migrated) the netback driver will no
+longer process any Tx packets from the frontend. xenvif_up() does not
+schedule the processing of any pending Tx requests from the front end
+because the carrier is off. Without this initial kick the frontend
+just adds Tx requests to the ring without raising an event (until the
+ring is full).
+
+This was caused by 47103041e91794acdbc6165da0ae288d844c820b (net:
+xen-netback: convert to hw_features) which reordered the calls to
+xenvif_up() and netif_carrier_on() in xenvif_connect().
+
+Signed-off-by: David Vrabel <david.vrabel@citrix.com>
+Cc: Ian Campbell <ian.campbell@citrix.com>
+Acked-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/xen-netback/interface.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/net/xen-netback/interface.c
++++ b/drivers/net/xen-netback/interface.c
+@@ -327,12 +327,12 @@ int xenvif_connect(struct xenvif *vif, u
+ xenvif_get(vif);
+
+ rtnl_lock();
+- if (netif_running(vif->dev))
+- xenvif_up(vif);
+ if (!vif->can_sg && vif->dev->mtu > ETH_DATA_LEN)
+ dev_set_mtu(vif->dev, ETH_DATA_LEN);
+ netdev_update_features(vif->dev);
+ netif_carrier_on(vif->dev);
++ if (netif_running(vif->dev))
++ xenvif_up(vif);
+ rtnl_unlock();
+
+ return 0;
--- /dev/null
+From 6943573977b22439184bc6ef0c9095446a223533 Mon Sep 17 00:00:00 2001
+From: Gao feng <gaofeng@cn.fujitsu.com>
+Date: Tue, 11 Oct 2011 16:08:11 +0000
+Subject: netconsole: enable netconsole can make net_device refcnt incorrent
+
+
+From: Gao feng <gaofeng@cn.fujitsu.com>
+
+[ Upstream commit d5123480b1d6f7d1a5fe1a13520cef88fb5d4c84 ]
+
+There is no check if netconsole is enabled current.
+so when exec echo 1 > enabled;
+the reference of net_device will increment always.
+
+Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
+Acked-by: Flavio Leitner <fbl@redhat.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/netconsole.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/net/netconsole.c
++++ b/drivers/net/netconsole.c
+@@ -307,6 +307,11 @@ static ssize_t store_enabled(struct netc
+ return err;
+ if (enabled < 0 || enabled > 1)
+ return -EINVAL;
++ if (enabled == nt->enabled) {
++ printk(KERN_INFO "netconsole: network logging has already %s\n",
++ nt->enabled ? "started" : "stopped");
++ return -EINVAL;
++ }
+
+ if (enabled) { /* 1 */
+
vfs-pathname-lookup-add-lookup_automount-flag.patch
ptrace-don-t-clear-group_stop_sigmask-on-double-stop.patch
jsm-remove-buggy-write-queue.patch
+bonding-use-local-function-pointer-of-bond-recv_probe-in-bond_handle_frame.patch
+bridge-fix-hang-on-removal-of-bridge-via-netlink.patch
+can-bcm-fix-tx_setup-off-by-one-errors.patch
+ipv4-fix-ipsec-forward-performance-regression.patch
+l2tp-fix-a-potential-skb-leak-in-l2tp_xmit_skb.patch
+macvlan-macvtap-fix-unicast-between-macvtap-interfaces-in-bridge-mode.patch
+netconsole-enable-netconsole-can-make-net_device-refcnt-incorrent.patch
+tcp-properly-handle-md5sig_pool-references.patch
+tcp-properly-update-lost_cnt_hint-during-shifting.patch
+tg3-negate-use_phylib-flag-check.patch
+ipv6-nullify-ipv6_ac_list-and-ipv6_fl_list-when-creating-new-socket.patch
+make-packet_statistics-getsockopt-report-consistently-between-ring-and-non-ring.patch
+net-xen-netback-correctly-restart-tx-after-a-vm-restore-migrate.patch
--- /dev/null
+From 5ea54d3798e896854f8767a887ebc3cd86488a8e Mon Sep 17 00:00:00 2001
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+Date: Thu, 29 Sep 2011 17:10:10 +0000
+Subject: tcp: properly handle md5sig_pool references
+
+
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+
+[ Upstream commit 260fcbeb1ae9e768a44c9925338fbacb0d7e5ba9 ]
+
+tcp_v4_clear_md5_list() assumes that multiple tcp md5sig peers
+only hold one reference to md5sig_pool. but tcp_v4_md5_do_add()
+increases use count of md5sig_pool for each peer. This patch
+makes tcp_v4_md5_do_add() only increases use count for the first
+tcp md5sig peer.
+
+Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_ipv4.c | 11 +++++++----
+ net/ipv6/tcp_ipv6.c | 8 +++++---
+ 2 files changed, 12 insertions(+), 7 deletions(-)
+
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -909,18 +909,21 @@ int tcp_v4_md5_do_add(struct sock *sk, _
+ }
+ sk_nocaps_add(sk, NETIF_F_GSO_MASK);
+ }
+- if (tcp_alloc_md5sig_pool(sk) == NULL) {
++
++ md5sig = tp->md5sig_info;
++ if (md5sig->entries4 == 0 &&
++ tcp_alloc_md5sig_pool(sk) == NULL) {
+ kfree(newkey);
+ return -ENOMEM;
+ }
+- md5sig = tp->md5sig_info;
+
+ if (md5sig->alloced4 == md5sig->entries4) {
+ keys = kmalloc((sizeof(*keys) *
+ (md5sig->entries4 + 1)), GFP_ATOMIC);
+ if (!keys) {
+ kfree(newkey);
+- tcp_free_md5sig_pool();
++ if (md5sig->entries4 == 0)
++ tcp_free_md5sig_pool();
+ return -ENOMEM;
+ }
+
+@@ -964,6 +967,7 @@ int tcp_v4_md5_do_del(struct sock *sk, _
+ kfree(tp->md5sig_info->keys4);
+ tp->md5sig_info->keys4 = NULL;
+ tp->md5sig_info->alloced4 = 0;
++ tcp_free_md5sig_pool();
+ } else if (tp->md5sig_info->entries4 != i) {
+ /* Need to do some manipulation */
+ memmove(&tp->md5sig_info->keys4[i],
+@@ -971,7 +975,6 @@ int tcp_v4_md5_do_del(struct sock *sk, _
+ (tp->md5sig_info->entries4 - i) *
+ sizeof(struct tcp4_md5sig_key));
+ }
+- tcp_free_md5sig_pool();
+ return 0;
+ }
+ }
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -605,7 +605,8 @@ static int tcp_v6_md5_do_add(struct sock
+ }
+ sk_nocaps_add(sk, NETIF_F_GSO_MASK);
+ }
+- if (tcp_alloc_md5sig_pool(sk) == NULL) {
++ if (tp->md5sig_info->entries6 == 0 &&
++ tcp_alloc_md5sig_pool(sk) == NULL) {
+ kfree(newkey);
+ return -ENOMEM;
+ }
+@@ -614,8 +615,9 @@ static int tcp_v6_md5_do_add(struct sock
+ (tp->md5sig_info->entries6 + 1)), GFP_ATOMIC);
+
+ if (!keys) {
+- tcp_free_md5sig_pool();
+ kfree(newkey);
++ if (tp->md5sig_info->entries6 == 0)
++ tcp_free_md5sig_pool();
+ return -ENOMEM;
+ }
+
+@@ -661,6 +663,7 @@ static int tcp_v6_md5_do_del(struct sock
+ kfree(tp->md5sig_info->keys6);
+ tp->md5sig_info->keys6 = NULL;
+ tp->md5sig_info->alloced6 = 0;
++ tcp_free_md5sig_pool();
+ } else {
+ /* shrink the database */
+ if (tp->md5sig_info->entries6 != i)
+@@ -669,7 +672,6 @@ static int tcp_v6_md5_do_del(struct sock
+ (tp->md5sig_info->entries6 - i)
+ * sizeof (tp->md5sig_info->keys6[0]));
+ }
+- tcp_free_md5sig_pool();
+ return 0;
+ }
+ }
--- /dev/null
+From 629737359198b16c0aadde2237db2e00c4aa4863 Mon Sep 17 00:00:00 2001
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+Date: Sun, 2 Oct 2011 04:21:50 +0000
+Subject: tcp: properly update lost_cnt_hint during shifting
+
+
+From: "Yan, Zheng" <zheng.z.yan@intel.com>
+
+[ Upstream commit 1e5289e121372a3494402b1b131b41bfe1cf9b7f ]
+
+lost_skb_hint is used by tcp_mark_head_lost() to mark the first unhandled skb.
+lost_cnt_hint is the number of packets or sacked packets before the lost_skb_hint;
+When shifting a skb that is before the lost_skb_hint, if tcp_is_fack() is ture,
+the skb has already been counted in the lost_cnt_hint; if tcp_is_fack() is false,
+tcp_sacktag_one() will increase the lost_cnt_hint. So tcp_shifted_skb() does not
+need to adjust the lost_cnt_hint by itself. When shifting a skb that is equal to
+lost_skb_hint, the shifted packets will not be counted by tcp_mark_head_lost().
+So tcp_shifted_skb() should adjust the lost_cnt_hint even tcp_is_fack(tp) is true.
+
+Signed-off-by: Zheng Yan <zheng.z.yan@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ net/ipv4/tcp_input.c | 4 +---
+ 1 file changed, 1 insertion(+), 3 deletions(-)
+
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -1380,9 +1380,7 @@ static int tcp_shifted_skb(struct sock *
+
+ BUG_ON(!pcount);
+
+- /* Tweak before seqno plays */
+- if (!tcp_is_fack(tp) && tcp_is_sack(tp) && tp->lost_skb_hint &&
+- !before(TCP_SKB_CB(tp->lost_skb_hint)->seq, TCP_SKB_CB(skb)->seq))
++ if (skb == tp->lost_skb_hint)
+ tp->lost_cnt_hint += pcount;
+
+ TCP_SKB_CB(prev)->end_seq += shifted;
--- /dev/null
+From 86154b3a8454cf91df13f2e2367ccb28cdcd3518 Mon Sep 17 00:00:00 2001
+From: Jiri Pirko <jpirko@redhat.com>
+Date: Tue, 11 Oct 2011 23:00:41 +0000
+Subject: tg3: negate USE_PHYLIB flag check
+
+
+From: Jiri Pirko <jpirko@redhat.com>
+
+[ Upstream commit e730c82347b9dc75914da998c44c3f348965db41 ]
+
+USE_PHYLIB flag in tg3_remove_one() is being checked incorrectly. This
+results tg3_phy_fini->phy_disconnect is never called and when tg3 module
+is removed.
+
+In my case this resulted in panics in phy_state_machine calling function
+phydev->adjust_link.
+
+So correct this check.
+
+Signed-off-by: Jiri Pirko <jpirko@redhat.com>
+Acked-by: Matt Carlson <mcarlson@broadcom.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+---
+ drivers/net/tg3.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/net/tg3.c
++++ b/drivers/net/tg3.c
+@@ -15278,7 +15278,7 @@ static void __devexit tg3_remove_one(str
+
+ cancel_work_sync(&tp->reset_task);
+
+- if (!tg3_flag(tp, USE_PHYLIB)) {
++ if (tg3_flag(tp, USE_PHYLIB)) {
+ tg3_phy_fini(tp);
+ tg3_mdio_fini(tp);
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
