Merge remote-tracking branch 'linus/master' into merge

Conflicts:
	Documentation/hwmon/ina2xx
	arch/powerpc/Kconfig
	arch/powerpc/boot/dts/b4860emu.dts
	arch/powerpc/boot/dts/b4qds.dtsi
	arch/powerpc/boot/dts/fsl/b4si-post.dtsi
	arch/powerpc/boot/dts/fsl/qoriq-sec6.0-0.dtsi
	arch/powerpc/boot/dts/p1023rdb.dts
	arch/powerpc/boot/dts/t4240emu.dts
	arch/powerpc/boot/dts/t4240qds.dts
	arch/powerpc/configs/85xx/p1023_defconfig
	arch/powerpc/configs/corenet32_smp_defconfig
	arch/powerpc/configs/corenet64_smp_defconfig
	arch/powerpc/configs/mpc85xx_smp_defconfig
	arch/powerpc/include/asm/cputable.h
	arch/powerpc/include/asm/device.h
	arch/powerpc/include/asm/epapr_hcalls.h
	arch/powerpc/include/asm/kvm_host.h
	arch/powerpc/include/asm/mpic.h
	arch/powerpc/include/asm/pci.h
	arch/powerpc/include/asm/ppc-opcode.h
	arch/powerpc/include/asm/ppc_asm.h
	arch/powerpc/include/asm/reg_booke.h
	arch/powerpc/kernel/epapr_paravirt.c
	arch/powerpc/kernel/process.c
	arch/powerpc/kernel/prom.c
	arch/powerpc/kernel/setup-common.c
	arch/powerpc/kernel/setup_32.c
	arch/powerpc/kernel/setup_64.c
	arch/powerpc/kernel/smp.c
	arch/powerpc/kernel/swsusp_asm64.S
	arch/powerpc/kernel/swsusp_booke.S
	arch/powerpc/kvm/book3s_pr.c
	arch/powerpc/kvm/booke.c
	arch/powerpc/kvm/booke.h
	arch/powerpc/kvm/e500.c
	arch/powerpc/kvm/e500.h
	arch/powerpc/kvm/e500_emulate.c
	arch/powerpc/kvm/e500mc.c
	arch/powerpc/kvm/powerpc.c
	arch/powerpc/perf/e6500-pmu.c
	arch/powerpc/platforms/85xx/Kconfig
	arch/powerpc/platforms/85xx/Makefile
	arch/powerpc/platforms/85xx/b4_qds.c
	arch/powerpc/platforms/85xx/c293pcie.c
	arch/powerpc/platforms/85xx/corenet_ds.c
	arch/powerpc/platforms/85xx/corenet_ds.h
	arch/powerpc/platforms/85xx/p1023_rds.c
	arch/powerpc/platforms/85xx/p2041_rdb.c
	arch/powerpc/platforms/85xx/p3041_ds.c
	arch/powerpc/platforms/85xx/p4080_ds.c
	arch/powerpc/platforms/85xx/p5020_ds.c
	arch/powerpc/platforms/85xx/p5040_ds.c
	arch/powerpc/platforms/85xx/smp.c
	arch/powerpc/platforms/85xx/t4240_qds.c
	arch/powerpc/platforms/Kconfig
	arch/powerpc/sysdev/Makefile
	arch/powerpc/sysdev/fsl_mpic_timer_wakeup.c
	arch/powerpc/sysdev/fsl_msi.c
	arch/powerpc/sysdev/fsl_pci.c
	arch/powerpc/sysdev/fsl_pci.h
	arch/powerpc/sysdev/fsl_soc.h
	arch/powerpc/sysdev/mpic.c
	arch/powerpc/sysdev/mpic_timer.c
	drivers/Kconfig
	drivers/clk/Kconfig
	drivers/clk/clk-ppc-corenet.c
	drivers/cpufreq/Kconfig.powerpc
	drivers/cpufreq/Makefile
	drivers/cpufreq/ppc-corenet-cpufreq.c
	drivers/crypto/caam/Kconfig
	drivers/crypto/caam/Makefile
	drivers/crypto/caam/ctrl.c
	drivers/crypto/caam/desc_constr.h
	drivers/crypto/caam/intern.h
	drivers/crypto/caam/jr.c
	drivers/crypto/caam/regs.h
	drivers/dma/fsldma.c
	drivers/hwmon/ina2xx.c
	drivers/iommu/Kconfig
	drivers/iommu/fsl_pamu.c
	drivers/iommu/fsl_pamu.h
	drivers/iommu/fsl_pamu_domain.c
	drivers/iommu/fsl_pamu_domain.h
	drivers/misc/Makefile
	drivers/mmc/card/block.c
	drivers/mmc/core/core.c
	drivers/mmc/host/sdhci-esdhc.h
	drivers/mmc/host/sdhci-pltfm.c
	drivers/mtd/nand/fsl_ifc_nand.c
	drivers/net/ethernet/freescale/gianfar.c
	drivers/net/ethernet/freescale/gianfar.h
	drivers/net/ethernet/freescale/gianfar_ethtool.c
	drivers/net/phy/at803x.c
	drivers/net/phy/phy_device.c
	drivers/net/phy/vitesse.c
	drivers/pci/msi.c
	drivers/staging/Kconfig
	drivers/staging/Makefile
	drivers/uio/Kconfig
	drivers/uio/Makefile
	drivers/uio/uio.c
	drivers/usb/host/ehci-fsl.c
	drivers/vfio/Kconfig
	drivers/vfio/Makefile
	include/crypto/algapi.h
	include/linux/iommu.h
	include/linux/mmc/sdhci.h
	include/linux/msi.h
	include/linux/netdev_features.h
	include/linux/phy.h
	include/linux/skbuff.h
	include/net/ip.h
	include/uapi/linux/vfio.h
	net/core/ethtool.c
	net/ipv4/route.c
	net/ipv6/route.c

1 files changed, 33 insertions, 21 deletions

diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index f874fc5..891070e 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -27,6 +27,8 @@
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
+#include <net/netfilter/nf_conntrack_seqadj.h>
+#include <net/netfilter/nf_conntrack_synproxy.h>
 #include <net/netfilter/nf_log.h>
 #include <net/netfilter/ipv4/nf_conntrack_ipv4.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
@@ -495,21 +497,6 @@ static void tcp_sack(const struct sk_buff *skb, unsigned int dataoff,
 	}
 }
 
-#ifdef CONFIG_NF_NAT_NEEDED
-static inline s16 nat_offset(const struct nf_conn *ct,
-			     enum ip_conntrack_dir dir,
-			     u32 seq)
-{
-	typeof(nf_ct_nat_offset) get_offset = rcu_dereference(nf_ct_nat_offset);
-
-	return get_offset != NULL ? get_offset(ct, dir, seq) : 0;
-}
-#define NAT_OFFSET(ct, dir, seq) \
-	(nat_offset(ct, dir, seq))
-#else
-#define NAT_OFFSET(ct, dir, seq)	0
-#endif
-
 static bool tcp_in_window(const struct nf_conn *ct,
 			  struct ip_ct_tcp *state,
 			  enum ip_conntrack_dir dir,
@@ -525,8 +512,8 @@ static bool tcp_in_window(const struct nf_conn *ct,
 	struct ip_ct_tcp_state *receiver = &state->seen[!dir];
 	const struct nf_conntrack_tuple *tuple = &ct->tuplehash[dir].tuple;
 	__u32 seq, ack, sack, end, win, swin;
-	s16 receiver_offset;
-	bool res;
+	s32 receiver_offset;
+	bool res, in_recv_win;
 
 	/*
 	 * Get the required data from the packet.
@@ -540,7 +527,7 @@ static bool tcp_in_window(const struct nf_conn *ct,
 		tcp_sack(skb, dataoff, tcph, &sack);
 
 	/* Take into account NAT sequence number mangling */
-	receiver_offset = NAT_OFFSET(ct, !dir, ack - 1);
+	receiver_offset = nf_ct_seq_offset(ct, !dir, ack - 1);
 	ack -= receiver_offset;
 	sack -= receiver_offset;
 
@@ -649,14 +636,18 @@ static bool tcp_in_window(const struct nf_conn *ct,
 		 receiver->td_end, receiver->td_maxend, receiver->td_maxwin,
 		 receiver->td_scale);
 
+	/* Is the ending sequence in the receive window (if available)? */
+	in_recv_win = !receiver->td_maxwin ||
+		      after(end, sender->td_end - receiver->td_maxwin - 1);
+
 	pr_debug("tcp_in_window: I=%i II=%i III=%i IV=%i\n",
 		 before(seq, sender->td_maxend + 1),
-		 after(end, sender->td_end - receiver->td_maxwin - 1),
+		 (in_recv_win ? 1 : 0),
 		 before(sack, receiver->td_end + 1),
 		 after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1));
 
 	if (before(seq, sender->td_maxend + 1) &&
-	    after(end, sender->td_end - receiver->td_maxwin - 1) &&
+	    in_recv_win &&
 	    before(sack, receiver->td_end + 1) &&
 	    after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1)) {
 		/*
@@ -767,7 +758,7 @@ DONE:
 			nf_log_packet(net, pf, 0, skb, NULL, NULL, NULL,
 			"nf_ct_tcp: %s ",
 			before(seq, sender->td_maxend + 1) ?
-			after(end, sender->td_end - receiver->td_maxwin - 1) ?
+			in_recv_win ?
 			before(sack, receiver->td_end + 1) ?
 			after(sack, receiver->td_end - MAXACKWINDOW(sender) - 1) ? "BUG"
 			: "ACK is under the lower bound (possible overly delayed ACK)"
@@ -998,6 +989,21 @@ static int tcp_packet(struct nf_conn *ct,
 				  "state %s ", tcp_conntrack_names[old_state]);
 		return NF_ACCEPT;
 	case TCP_CONNTRACK_MAX:
+		/* Special case for SYN proxy: when the SYN to the server or
+		 * the SYN/ACK from the server is lost, the client may transmit
+		 * a keep-alive packet while in SYN_SENT state. This needs to
+		 * be associated with the original conntrack entry in order to
+		 * generate a new SYN with the correct sequence number.
+		 */
+		if (nfct_synproxy(ct) && old_state == TCP_CONNTRACK_SYN_SENT &&
+		    index == TCP_ACK_SET && dir == IP_CT_DIR_ORIGINAL &&
+		    ct->proto.tcp.last_dir == IP_CT_DIR_ORIGINAL &&
+		    ct->proto.tcp.seen[dir].td_end - 1 == ntohl(th->seq)) {
+			pr_debug("nf_ct_tcp: SYN proxy client keep alive\n");
+			spin_unlock_bh(&ct->lock);
+			return NF_ACCEPT;
+		}
+
 		/* Invalid packet */
 		pr_debug("nf_ct_tcp: Invalid dir=%i index=%u ostate=%u\n",
 			 dir, get_conntrack_index(th), old_state);
@@ -1085,6 +1091,12 @@ static int tcp_packet(struct nf_conn *ct,
 			nf_ct_kill_acct(ct, ctinfo, skb);
 			return NF_ACCEPT;
 		}
+		/* ESTABLISHED without SEEN_REPLY, i.e. mid-connection
+		 * pickup with loose=1. Avoid large ESTABLISHED timeout.
+		 */
+		if (new_state == TCP_CONNTRACK_ESTABLISHED &&
+		    timeout > timeouts[TCP_CONNTRACK_UNACK])
+			timeout = timeouts[TCP_CONNTRACK_UNACK];
 	} else if (!test_bit(IPS_ASSURED_BIT, &ct->status)
 		   && (old_state == TCP_CONNTRACK_SYN_RECV
 		       || old_state == TCP_CONNTRACK_ESTABLISHED)