From: Linus Torvalds <torvalds@linux-foundation.org>
Date: Sat, 18 Oct 2014 16:31:37 +0000 (-0700)
Subject: Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=2e923b0251932ad4a82cc87ec1443a1f1d17073e;p=openwrt%2Fstaging%2Fblogic.git

Merge git://git./linux/kernel/git/davem/net

Pull networking fixes from David Miller:

 1) Include fixes for netrom and dsa (Fabian Frederick and Florian
    Fainelli)

 2) Fix FIXED_PHY support in stmmac, from Giuseppe CAVALLARO.

 3) Several SKB use after free fixes (vxlan, openvswitch, vxlan,
    ip_tunnel, fou), from Li ROngQing.

 4) fec driver PTP support fixes from Luwei Zhou and Nimrod Andy.

 5) Use after free in virtio_net, from Michael S Tsirkin.

 6) Fix flow mask handling for megaflows in openvswitch, from Pravin B
    Shelar.

 7) ISDN gigaset and capi bug fixes from Tilman Schmidt.

 8) Fix route leak in ip_send_unicast_reply(), from Vasily Averin.

 9) Fix two eBPF JIT bugs on x86, from Alexei Starovoitov.

10) TCP_SKB_CB() reorganization caused a few regressions, fixed by Cong
    Wang and Eric Dumazet.

11) Don't overwrite end of SKB when parsing malformed sctp ASCONF
    chunks, from Daniel Borkmann.

12) Don't call sock_kfree_s() with NULL pointers, this function also has
    the side effect of adjusting the socket memory usage.  From Cong Wang.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (90 commits)
  bna: fix skb->truesize underestimation
  net: dsa: add includes for ethtool and phy_fixed definitions
  openvswitch: Set flow-key members.
  netrom: use linux/uaccess.h
  dsa: Fix conversion from host device to mii bus
  tipc: fix bug in bundled buffer reception
  ipv6: introduce tcp_v6_iif()
  sfc: add support for skb->xmit_more
  r8152: return -EBUSY for runtime suspend
  ipv4: fix a potential use after free in fou.c
  ipv4: fix a potential use after free in ip_tunnel_core.c
  hyperv: Add handling of IP header with option field in netvsc_set_hash()
  openvswitch: Create right mask with disabled megaflows
  vxlan: fix a free after use
  openvswitch: fix a use after free
  ipv4: dst_entry leak in ip_send_unicast_reply()
  ipv4: clean up cookie_v4_check()
  ipv4: share tcp_v4_save_options() with cookie_v4_check()
  ipv4: call __ip_options_echo() in cookie_v4_check()
  atm: simplify lanai.c by using module_pci_driver
  ...
---

2e923b0251932ad4a82cc87ec1443a1f1d17073e
diff --cc net/ipv4/tcp_output.c
index becd98ce9a1c,e13d77857225..3af21296d967
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@@ -845,14 -861,9 +861,9 @@@ void tcp_wfree(struct sk_buff *skb
  		unsigned long flags;
  		struct tsq_tasklet *tsq;
  
- 		/* Keep a ref on socket.
- 		 * This last ref will be released in tcp_tasklet_func()
- 		 */
- 		atomic_sub(skb->truesize - 1, &sk->sk_wmem_alloc);
- 
  		/* queue this socket to tasklet queue */
  		local_irq_save(flags);
 -		tsq = &__get_cpu_var(tsq_tasklet);
 +		tsq = this_cpu_ptr(&tsq_tasklet);
  		list_add(&tp->tsq_node, &tsq->head);
  		tasklet_schedule(&tsq->tasklet);
  		local_irq_restore(flags);