6 files changed, 13 insertions, 12 deletions

diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 3d560dec63ab..d4072533da21 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -170,8 +170,8 @@ config IP_NF_PPTP
           Documentation/modules.txt.  If unsure, say `N'.
 
 config IP_NF_H323
-        tristate  'H.323 protocol support'
-        depends on IP_NF_CONNTRACK
+        tristate  'H.323 protocol support (EXPERIMENTAL)'
+        depends on IP_NF_CONNTRACK && EXPERIMENTAL
         help
           H.323 is a VoIP signalling protocol from ITU-T. As one of the most
           important VoIP protocols, it is widely used by voice hardware and
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 979a2eac6f00..a297da7bbef5 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -1318,6 +1318,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                         .tuple.dst.u.tcp.port;
                 sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
                         .tuple.dst.ip;
+                memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
 
                 DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
                        NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
index 7d3ba4302e9e..8ccfe17bb253 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_pptp.c
@@ -469,8 +469,8 @@ pptp_inbound_pkt(struct sk_buff **pskb,
                         DEBUGP("%s but no session\n", pptp_msg_name[msg]);
                         break;
                 }
-                if (info->sstate != PPTP_CALL_IN_REP
-                    && info->sstate != PPTP_CALL_IN_CONF) {
+                if (info->cstate != PPTP_CALL_IN_REP
+                    && info->cstate != PPTP_CALL_IN_CONF) {
                         DEBUGP("%s but never sent IN_CALL_REPLY\n",
                                 pptp_msg_name[msg]);
                         break;
diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
index 5bc9f64d7b5b..77d974443c7b 100644
--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
@@ -348,6 +348,7 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
                         .tuple.dst.u.tcp.port;
                 sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL]
                         .tuple.dst.u3.ip;
+                memset(sin.sin_zero, 0, sizeof(sin.sin_zero));
 
                 DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n",
                        NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port));
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index b72fa55dfb84..ba7c63ca5bb1 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -135,7 +135,8 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
 
                 /* Do additive increase */
                 if (tp->snd_cwnd < tp->snd_cwnd_clamp) {
-                        tp->snd_cwnd_cnt += ca->ai;
+                        /* cwnd = cwnd + a(w) / cwnd */
+                        tp->snd_cwnd_cnt += ca->ai + 1;
                         if (tp->snd_cwnd_cnt >= tp->snd_cwnd) {
                                 tp->snd_cwnd_cnt -= tp->snd_cwnd;
                                 tp->snd_cwnd++;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 743016baa048..f33c9dddaa12 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -642,7 +642,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
  * eventually). The difference is that pulled data not copied, but
  * immediately discarded.
  */
-static unsigned char *__pskb_trim_head(struct sk_buff *skb, int len)
+static void __pskb_trim_head(struct sk_buff *skb, int len)
 {
         int i, k, eat;
 
@@ -667,7 +667,6 @@ static unsigned char *__pskb_trim_head(struct sk_buff *skb, int len)
         skb->tail = skb->data;
         skb->data_len -= len;
         skb->len = skb->data_len;
-        return skb->tail;
 }
 
 int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
@@ -676,12 +675,11 @@ int tcp_trim_head(struct sock *sk, struct sk_buff *skb, u32 len)
             pskb_expand_head(skb, 0, 0, GFP_ATOMIC))
                 return -ENOMEM;
 
-        if (len <= skb_headlen(skb)) {
+        /* If len == headlen, we avoid __skb_pull to preserve alignment. */
+        if (unlikely(len < skb_headlen(skb)))
                 __skb_pull(skb, len);
-        } else {
-                if (__pskb_trim_head(skb, len-skb_headlen(skb)) == NULL)
-                        return -ENOMEM;
-        }
+        else
+                __pskb_trim_head(skb, len - skb_headlen(skb));
 
         TCP_SKB_CB(skb)->seq += len;
         skb->ip_summed = CHECKSUM_HW;