Merge branch 'master' into upstream-fixes

12 files changed, 37 insertions, 44 deletions

diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 84b9af76f0a2..3a13ed643459 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -831,7 +831,7 @@ static int translate_table(struct ebt_replace *repl,
                         return -ENOMEM;
                 for_each_possible_cpu(i) {
                         newinfo->chainstack[i] =
-                           vmalloc(udc_cnt * sizeof(struct ebt_chainstack));
+                          vmalloc(udc_cnt * sizeof(*(newinfo->chainstack[0])));
                         if (!newinfo->chainstack[i]) {
                                 while (i)
                                         vfree(newinfo->chainstack[--i]);
@@ -841,8 +841,7 @@ static int translate_table(struct ebt_replace *repl,
                         }
                 }
 
-                cl_s = (struct ebt_cl_stack *)
-                   vmalloc(udc_cnt * sizeof(struct ebt_cl_stack));
+                cl_s = vmalloc(udc_cnt * sizeof(*cl_s));
                 if (!cl_s)
                         return -ENOMEM;
                 i = 0; /* the i'th udc */
@@ -944,8 +943,7 @@ static int do_replace(void __user *user, unsigned int len)
 
         countersize = COUNTER_OFFSET(tmp.nentries) * 
                                         (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
         if (!newinfo)
                 return -ENOMEM;
 
@@ -967,8 +965,7 @@ static int do_replace(void __user *user, unsigned int len)
         /* the user wants counters back
            the check on the size is done later, when we have the lock */
         if (tmp.num_counters) {
-                counterstmp = (struct ebt_counter *)
-                   vmalloc(tmp.num_counters * sizeof(struct ebt_counter));
+                counterstmp = vmalloc(tmp.num_counters * sizeof(*counterstmp));
                 if (!counterstmp) {
                         ret = -ENOMEM;
                         goto free_entries;
@@ -1148,8 +1145,7 @@ int ebt_register_table(struct ebt_table *table)
 
         countersize = COUNTER_OFFSET(table->table->nentries) *
                                         (highest_possible_processor_id()+1);
-        newinfo = (struct ebt_table_info *)
-           vmalloc(sizeof(struct ebt_table_info) + countersize);
+        newinfo = vmalloc(sizeof(*newinfo) + countersize);
         ret = -ENOMEM;
         if (!newinfo)
                 return -ENOMEM;
@@ -1247,8 +1243,7 @@ static int update_counters(void __user *user, unsigned int len)
         if (hlp.num_counters == 0)
                 return -EINVAL;
 
-        if ( !(tmp = (struct ebt_counter *)
-           vmalloc(hlp.num_counters * sizeof(struct ebt_counter))) ){
+        if (!(tmp = vmalloc(hlp.num_counters * sizeof(*tmp)))) {
                 MEMPRINT("Update_counters && nomemory\n");
                 return -ENOMEM;
         }
@@ -1377,8 +1372,7 @@ static int copy_everything_to_user(struct ebt_table *t, void __user *user,
                         BUGPRINT("Num_counters wrong\n");
                         return -EINVAL;
                 }
-                counterstmp = (struct ebt_counter *)
-                   vmalloc(nentries * sizeof(struct ebt_counter));
+                counterstmp = vmalloc(nentries * sizeof(*counterstmp));
                 if (!counterstmp) {
                         MEMPRINT("Couldn't copy counters, out of memory\n");
                         return -ENOMEM;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 09464fa8d72f..fb3770f9c094 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -112,6 +112,14 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
         BUG();
 }
 
+void skb_truesize_bug(struct sk_buff *skb)
+{
+        printk(KERN_ERR "SKB BUG: Invalid truesize (%u) "
+               "len=%u, sizeof(sk_buff)=%Zd\n",
+               skb->truesize, skb->len, sizeof(struct sk_buff));
+}
+EXPORT_SYMBOL(skb_truesize_bug);
+
 /*      Allocate a new skbuff. We do this ourselves so we can fill in a few
  *      'private' fields and also do memory statistics to find all the
  *      [BEEP] leaks.
diff --git a/net/core/stream.c b/net/core/stream.c
index 35e25259fd95..e9489696f694 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -176,6 +176,7 @@ void sk_stream_rfree(struct sk_buff *skb)
 {
         struct sock *sk = skb->sk;
 
+        skb_truesize_check(skb);
         atomic_sub(skb->truesize, &sk->sk_rmem_alloc);
         sk->sk_forward_alloc += skb->truesize;
 }
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index c60fd5c4ea1e..3d560dec63ab 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -345,7 +345,7 @@ config IP_NF_TARGET_LOG
           To compile it as a module, choose M here.  If unsure, say N.
 
 config IP_NF_TARGET_ULOG
-        tristate "ULOG target support (OBSOLETE)"
+        tristate "ULOG target support"
         depends on IP_NF_IPTABLES
         ---help---
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 44df1db726a3..a28ae593b976 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -533,6 +533,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         struct tcp_sock *tp = tcp_sk(sk);
         struct sk_buff *buff;
         int nsize, old_factor;
+        int nlen;
         u16 flags;
 
         BUG_ON(len > skb->len);
@@ -552,8 +553,10 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         if (buff == NULL)
                 return -ENOMEM; /* We'll just try again later. */
 
-        buff->truesize = skb->len - len;
-        skb->truesize -= buff->truesize;
+        sk_charge_skb(sk, buff);
+        nlen = skb->len - len - nsize;
+        buff->truesize += nlen;
+        skb->truesize -= nlen;
 
         /* Correct the sequence numbers. */
         TCP_SKB_CB(buff)->seq = TCP_SKB_CB(skb)->seq + len;
@@ -1039,7 +1042,8 @@ static int tso_fragment(struct sock *sk, struct sk_buff *skb, unsigned int len,
         if (unlikely(buff == NULL))
                 return -ENOMEM;
 
-        buff->truesize = nlen;
+        sk_charge_skb(sk, buff);
+        buff->truesize += nlen;
         skb->truesize -= nlen;
 
         /* Correct the sequence numbers. */
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 642b4b11464f..0a673038344f 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -288,19 +288,6 @@ ip6t_do_table(struct sk_buff **pskb,
         table_base = (void *)private->entries[smp_processor_id()];
         e = get_entry(table_base, private->hook_entry[hook]);
 
-#ifdef CONFIG_NETFILTER_DEBUG
-        /* Check noone else using our table */
-        if (((struct ip6t_entry *)table_base)->comefrom != 0xdead57ac
-            && ((struct ip6t_entry *)table_base)->comefrom != 0xeeeeeeec) {
-                printk("ASSERT: CPU #%u, %s comefrom(%p) = %X\n",
-                       smp_processor_id(),
-                       table->name,
-                       &((struct ip6t_entry *)table_base)->comefrom,
-                       ((struct ip6t_entry *)table_base)->comefrom);
-        }
-        ((struct ip6t_entry *)table_base)->comefrom = 0x57acc001;
-#endif
-
         /* For return from builtin chain */
         back = get_entry(table_base, private->underflow[hook]);
 
diff --git a/net/llc/llc_input.c b/net/llc/llc_input.c
index 8f3addf0724c..d62e0f9b9da3 100644
--- a/net/llc/llc_input.c
+++ b/net/llc/llc_input.c
@@ -118,7 +118,8 @@ static inline int llc_fixup_skb(struct sk_buff *skb)
                 u16 pdulen = eth_hdr(skb)->h_proto,
                     data_size = ntohs(pdulen) - llc_len;
 
-                skb_trim(skb, data_size);
+                if (unlikely(pskb_trim_rcsum(skb, data_size)))
+                        return 0;
         }
         return 1;
 }
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index e581190fb6c3..f9b83f91371a 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -178,9 +178,6 @@ static struct {
         /* allocated slab cache + modules which uses this slab cache */
         int use;
 
-        /* Initialization */
-        int (*init_conntrack)(struct nf_conn *, u_int32_t);
-
 } nf_ct_cache[NF_CT_F_NUM];
 
 /* protect members of nf_ct_cache except of "use" */
@@ -208,10 +205,8 @@ nf_ct_proto_find_get(u_int16_t l3proto, u_int8_t protocol)
 
         preempt_disable();
         p = __nf_ct_proto_find(l3proto, protocol);
-        if (p) {
-                if (!try_module_get(p->me))
-                        p = &nf_conntrack_generic_protocol;
-        }
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_protocol;
         preempt_enable();
         
         return p;
@@ -229,10 +224,8 @@ nf_ct_l3proto_find_get(u_int16_t l3proto)
 
         preempt_disable();
         p = __nf_ct_l3proto_find(l3proto);
-        if (p) {
-                if (!try_module_get(p->me))
-                        p = &nf_conntrack_generic_l3proto;
-        }
+        if (!try_module_get(p->me))
+                p = &nf_conntrack_generic_l3proto;
         preempt_enable();
 
         return p;
diff --git a/net/netfilter/nf_conntrack_l3proto_generic.c b/net/netfilter/nf_conntrack_l3proto_generic.c
index 7de4f06c63c5..3fc58e454d4e 100644
--- a/net/netfilter/nf_conntrack_l3proto_generic.c
+++ b/net/netfilter/nf_conntrack_l3proto_generic.c
@@ -94,5 +94,4 @@ struct nf_conntrack_l3proto nf_conntrack_generic_l3proto = {
         .print_conntrack = generic_print_conntrack,
         .prepare         = generic_prepare,
         .get_features    = generic_get_features,
-        .me              = THIS_MODULE,
 };
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index 00cf0a4f4d92..17abf60f9570 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -529,6 +529,7 @@ int xt_register_table(struct xt_table *table,
 
         /* Simplifies replace_table code. */
         table->private = bootstrap;
+        rwlock_init(&table->lock);
         if (!xt_replace_table(table, 0, newinfo, &ret))
                 goto unlock;
 
@@ -538,7 +539,6 @@ int xt_register_table(struct xt_table *table,
         /* save number of initial entries */
         private->initial_entries = private->number;
 
-        rwlock_init(&table->lock);
         list_prepend(&xt[table->af].tables, table);
 
         ret = 0;
diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
index 6056d20ef429..37640c6fc014 100644
--- a/net/sched/act_ipt.c
+++ b/net/sched/act_ipt.c
@@ -69,6 +69,11 @@ ipt_init_target(struct ipt_entry_target *t, char *table, unsigned int hook)
         DPRINTK("ipt_init_target: found %s\n", target->name);
         t->u.kernel.target = target;
 
+        ret = xt_check_target(target, AF_INET, t->u.target_size - sizeof(*t),
+                              table, hook, 0, 0);
+        if (ret)
+                return ret;
+
         if (t->u.kernel.target->checkentry
             && !t->u.kernel.target->checkentry(table, NULL,
                                                t->u.kernel.target, t->data,
diff --git a/net/socket.c b/net/socket.c
index 23898f45f713..0ce12dfc7a71 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -490,6 +490,7 @@ static struct socket *sockfd_lookup_light(int fd, int *err, int *fput_needed)
         struct file *file;
         struct socket *sock;
 
+        *err = -EBADF;
         file = fget_light(fd, fput_needed);
         if (file) {
                 sock = sock_from_file(file, err);