7 files changed, 42 insertions, 69 deletions

diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 3100a8940af..2912665fc58 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -228,7 +228,7 @@ static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct br2684_dev *brdev = BRPRIV(dev);
         struct br2684_vcc *brvcc;
 
-        pr_debug("br2684_start_xmit, skb->dst=%p\n", skb->dst);
+        pr_debug("br2684_start_xmit, skb_dst(skb)=%p\n", skb_dst(skb));
         read_lock(&devs_lock);
         brvcc = pick_outgoing_vcc(skb, brdev);
         if (brvcc == NULL) {
@@ -445,9 +445,10 @@ free_skb:
  */
 static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
 {
+        struct sk_buff_head queue;
         int err;
         struct br2684_vcc *brvcc;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *tmp;
         struct sk_buff_head *rq;
         struct br2684_dev *brdev;
         struct net_device *net_dev;
@@ -505,29 +506,20 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         barrier();
         atmvcc->push = br2684_push;
 
+        __skb_queue_head_init(&queue);
         rq = &sk_atm(atmvcc)->sk_receive_queue;
 
         spin_lock_irqsave(&rq->lock, flags);
-        if (skb_queue_empty(rq)) {
-                skb = NULL;
-        } else {
-                /* NULL terminate the list.  */
-                rq->prev->next = NULL;
-                skb = rq->next;
-        }
-        rq->prev = rq->next = (struct sk_buff *)rq;
-        rq->qlen = 0;
+        skb_queue_splice_init(rq, &queue);
         spin_unlock_irqrestore(&rq->lock, flags);
 
-        while (skb) {
-                struct sk_buff *next = skb->next;
+        skb_queue_walk_safe(&queue, skb, tmp) {
+                struct net_device *dev = skb->dev;
 
-                skb->next = skb->prev = NULL;
-                br2684_push(atmvcc, skb);
-                skb->dev->stats.rx_bytes -= skb->len;
-                skb->dev->stats.rx_packets--;
+                dev->stats.rx_bytes -= skb->len;
+                dev->stats.rx_packets--;
 
-                skb = next;
+                br2684_push(atmvcc, skb);
         }
         __module_get(THIS_MODULE);
         return 0;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 3dc0a3a42a5..e65a3b1477f 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -369,16 +369,16 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         unsigned long flags;
 
         pr_debug("clip_start_xmit (skb %p)\n", skb);
-        if (!skb->dst) {
-                printk(KERN_ERR "clip_start_xmit: skb->dst == NULL\n");
+        if (!skb_dst(skb)) {
+                printk(KERN_ERR "clip_start_xmit: skb_dst(skb) == NULL\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
                 return 0;
         }
-        if (!skb->dst->neighbour) {
+        if (!skb_dst(skb)->neighbour) {
 #if 0
-                skb->dst->neighbour = clip_find_neighbour(skb->dst, 1);
-                if (!skb->dst->neighbour) {
+                skb_dst(skb)->neighbour = clip_find_neighbour(skb_dst(skb), 1);
+                if (!skb_dst(skb)->neighbour) {
                         dev_kfree_skb(skb);     /* lost that one */
                         dev->stats.tx_dropped++;
                         return 0;
@@ -389,7 +389,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 dev->stats.tx_dropped++;
                 return 0;
         }
-        entry = NEIGH2ENTRY(skb->dst->neighbour);
+        entry = NEIGH2ENTRY(skb_dst(skb)->neighbour);
         if (!entry->vccs) {
                 if (time_after(jiffies, entry->expires)) {
                         /* should be resolved */
@@ -406,7 +406,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
         pr_debug("neigh %p, vccs %p\n", entry, entry->vccs);
         ATM_SKB(skb)->vcc = vcc = entry->vccs->vcc;
-        pr_debug("using neighbour %p, vcc %p\n", skb->dst->neighbour, vcc);
+        pr_debug("using neighbour %p, vcc %p\n", skb_dst(skb)->neighbour, vcc);
         if (entry->vccs->encap) {
                 void *here;
 
@@ -445,9 +445,9 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
 static int clip_mkip(struct atm_vcc *vcc, int timeout)
 {
+        struct sk_buff_head *rq, queue;
         struct clip_vcc *clip_vcc;
-        struct sk_buff *skb;
-        struct sk_buff_head *rq;
+        struct sk_buff *skb, *tmp;
         unsigned long flags;
 
         if (!vcc->push)
@@ -469,39 +469,28 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
         vcc->push = clip_push;
         vcc->pop = clip_pop;
 
+        __skb_queue_head_init(&queue);
         rq = &sk_atm(vcc)->sk_receive_queue;
 
         spin_lock_irqsave(&rq->lock, flags);
-        if (skb_queue_empty(rq)) {
-                skb = NULL;
-        } else {
-                /* NULL terminate the list.  */
-                rq->prev->next = NULL;
-                skb = rq->next;
-        }
-        rq->prev = rq->next = (struct sk_buff *)rq;
-        rq->qlen = 0;
+        skb_queue_splice_init(rq, &queue);
         spin_unlock_irqrestore(&rq->lock, flags);
 
         /* re-process everything received between connection setup and MKIP */
-        while (skb) {
-                struct sk_buff *next = skb->next;
-
-                skb->next = skb->prev = NULL;
+        skb_queue_walk_safe(&queue, skb, tmp) {
                 if (!clip_devs) {
                         atm_return(vcc, skb->truesize);
                         kfree_skb(skb);
                 } else {
+                        struct net_device *dev = skb->dev;
                         unsigned int len = skb->len;
 
                         skb_get(skb);
                         clip_push(vcc, skb);
-                        skb->dev->stats.rx_packets--;
-                        skb->dev->stats.rx_bytes -= len;
+                        dev->stats.rx_packets--;
+                        dev->stats.rx_bytes -= len;
                         kfree_skb(skb);
                 }
-
-                skb = next;
         }
         return 0;
 }
@@ -568,6 +557,7 @@ static void clip_setup(struct net_device *dev)
         /* without any more elaborate queuing. 100 is a reasonable */
         /* compromise between decent burst-tolerance and protection */
         /* against memory hogs. */
+        dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
 }
 
 static int clip_create(int number)
diff --git a/net/atm/common.c b/net/atm/common.c
index d34edbe754c..c1c97936192 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -62,15 +62,15 @@ static struct sk_buff *alloc_tx(struct atm_vcc *vcc,unsigned int size)
         struct sk_buff *skb;
         struct sock *sk = sk_atm(vcc);
 
-        if (atomic_read(&sk->sk_wmem_alloc) && !atm_may_send(vcc, size)) {
+        if (sk_wmem_alloc_get(sk) && !atm_may_send(vcc, size)) {
                 pr_debug("Sorry: wmem_alloc = %d, size = %d, sndbuf = %d\n",
-                        atomic_read(&sk->sk_wmem_alloc), size,
+                        sk_wmem_alloc_get(sk), size,
                         sk->sk_sndbuf);
                 return NULL;
         }
-        while (!(skb = alloc_skb(size,GFP_KERNEL))) schedule();
-        pr_debug("AlTx %d += %d\n", atomic_read(&sk->sk_wmem_alloc),
-                skb->truesize);
+        while (!(skb = alloc_skb(size, GFP_KERNEL)))
+                schedule();
+        pr_debug("AlTx %d += %d\n", sk_wmem_alloc_get(sk), skb->truesize);
         atomic_add(skb->truesize, &sk->sk_wmem_alloc);
         return skb;
 }
@@ -145,7 +145,7 @@ int vcc_create(struct net *net, struct socket *sock, int protocol, int family)
         memset(&vcc->local,0,sizeof(struct sockaddr_atmsvc));
         memset(&vcc->remote,0,sizeof(struct sockaddr_atmsvc));
         vcc->qos.txtp.max_sdu = 1 << 16; /* for meta VCs */
-        atomic_set(&sk->sk_wmem_alloc, 0);
+        atomic_set(&sk->sk_wmem_alloc, 1);
         atomic_set(&sk->sk_rmem_alloc, 0);
         vcc->push = NULL;
         vcc->pop = NULL;
diff --git a/net/atm/ioctl.c b/net/atm/ioctl.c
index 76ed3c8d26e..4da8892ced5 100644
--- a/net/atm/ioctl.c
+++ b/net/atm/ioctl.c
@@ -63,8 +63,7 @@ static int do_vcc_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg
                                 error =  -EINVAL;
                                 goto done;
                         }
-                        error = put_user(sk->sk_sndbuf -
-                                         atomic_read(&sk->sk_wmem_alloc),
+                        error = put_user(sk->sk_sndbuf - sk_wmem_alloc_get(sk),
                                          (int __user *) argp) ? -EFAULT : 0;
                         goto done;
                 case SIOCINQ:
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 199b6bb79f4..ff2e594dca9 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -34,7 +34,6 @@
 
 /* Proxy LEC knows about bridging */
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
-#include <linux/if_bridge.h>
 #include "../bridge/br_private.h"
 
 static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 };
@@ -271,7 +270,8 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk("%s:No lecd attached\n", dev->name);
                 dev->stats.tx_errors++;
                 netif_stop_queue(dev);
-                return -EUNATCH;
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
         }
 
         pr_debug("skbuff head:%lx data:%lx tail:%lx end:%lx\n",
@@ -518,18 +518,14 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
         case l_should_bridge:
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
                 {
-                        struct net_bridge_fdb_entry *f;
-
                         pr_debug("%s: bridge zeppelin asks about %pM\n",
                                  dev->name, mesg->content.proxy.mac_addr);
 
-                        if (br_fdb_get_hook == NULL || dev->br_port == NULL)
+                        if (br_fdb_test_addr_hook == NULL)
                                 break;
 
-                        f = br_fdb_get_hook(dev->br_port->br,
-                                            mesg->content.proxy.mac_addr);
-                        if (f != NULL && f->dst->dev != dev
-                            && f->dst->state == BR_STATE_FORWARDING) {
+                        if (br_fdb_test_addr_hook(dev,
+                                        mesg->content.proxy.mac_addr)) {
                                 /* hit from bridge table, send LE_ARP_RESPONSE */
                                 struct sk_buff *skb2;
                                 struct sock *sk;
@@ -540,10 +536,8 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                                 skb2 =
                                     alloc_skb(sizeof(struct atmlec_msg),
                                               GFP_ATOMIC);
-                                if (skb2 == NULL) {
-                                        br_fdb_put_hook(f);
+                                if (skb2 == NULL)
                                         break;
-                                }
                                 skb2->len = sizeof(struct atmlec_msg);
                                 skb_copy_to_linear_data(skb2, mesg,
                                                         sizeof(*mesg));
@@ -552,8 +546,6 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                                 skb_queue_tail(&sk->sk_receive_queue, skb2);
                                 sk->sk_data_ready(sk, skb2->len);
                         }
-                        if (f != NULL)
-                                br_fdb_put_hook(f);
                 }
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
                 break;
diff --git a/net/atm/proc.c b/net/atm/proc.c
index e7b3b273907..38de5ff61ec 100644
--- a/net/atm/proc.c
+++ b/net/atm/proc.c
@@ -204,8 +204,8 @@ static void vcc_info(struct seq_file *seq, struct atm_vcc *vcc)
                         seq_printf(seq, "%3d", sk->sk_family);
         }
         seq_printf(seq, " %04lx  %5d %7d/%7d %7d/%7d [%d]\n", vcc->flags, sk->sk_err,
-                  atomic_read(&sk->sk_wmem_alloc), sk->sk_sndbuf,
-                  atomic_read(&sk->sk_rmem_alloc), sk->sk_rcvbuf,
+                  sk_wmem_alloc_get(sk), sk->sk_sndbuf,
+                  sk_rmem_alloc_get(sk), sk->sk_rcvbuf,
                   atomic_read(&sk->sk_refcnt));
 }
 
diff --git a/net/atm/raw.c b/net/atm/raw.c
index b0a2d8cb674..cbfcc71a17b 100644
--- a/net/atm/raw.c
+++ b/net/atm/raw.c
@@ -33,7 +33,7 @@ static void atm_pop_raw(struct atm_vcc *vcc,struct sk_buff *skb)
         struct sock *sk = sk_atm(vcc);
 
         pr_debug("APopR (%d) %d -= %d\n", vcc->vci,
-                atomic_read(&sk->sk_wmem_alloc), skb->truesize);
+                sk_wmem_alloc_get(sk), skb->truesize);
         atomic_sub(skb->truesize, &sk->sk_wmem_alloc);
         dev_kfree_skb_any(skb);
         sk->sk_write_space(sk);