Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  iwlwifi: Allow building iwl3945 without iwl4965.
  wireless: Fix compile error with wifi & leds
  tcp: Fix slab corruption with ipv6 and tcp6fuzz
  ipv4/ipv6 compat: Fix SSM applications on 64bit kernels.
  [IPSEC]: Use digest_null directly for auth
  sunrpc: fix missing kernel-doc
  can: Fix copy_from_user() results interpretation
  Revert "ipv6: Fix typo in net/ipv6/Kconfig"
  tipc: endianness annotations
  ipv6: result of csum_fold() is already 16bit, no need to cast
  [XFRM] AUDIT: Fix flowlabel text format ambibuity.

12 files changed, 149 insertions, 24 deletions

diff --git a/net/can/raw.c b/net/can/raw.c
index 201cbfc6b9e..69877b8e7e9 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -435,15 +435,13 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                         if (!filter)
                                 return -ENOMEM;
 
-                        err = copy_from_user(filter, optval, optlen);
-                        if (err) {
+                        if (copy_from_user(filter, optval, optlen)) {
                                 kfree(filter);
-                                return err;
+                                return -EFAULT;
                         }
                 } else if (count == 1) {
-                        err = copy_from_user(&sfilter, optval, optlen);
-                        if (err)
-                                return err;
+                        if (copy_from_user(&sfilter, optval, optlen))
+                                return -EFAULT;
                 }
 
                 lock_sock(sk);
@@ -493,9 +491,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                 if (optlen != sizeof(err_mask))
                         return -EINVAL;
 
-                err = copy_from_user(&err_mask, optval, optlen);
-                if (err)
-                        return err;
+                if (copy_from_user(&err_mask, optval, optlen))
+                        return -EFAULT;
 
                 err_mask &= CAN_ERR_MASK;
 
@@ -531,7 +528,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                 if (optlen != sizeof(ro->loopback))
                         return -EINVAL;
 
-                err = copy_from_user(&ro->loopback, optval, optlen);
+                if (copy_from_user(&ro->loopback, optval, optlen))
+                        return -EFAULT;
 
                 break;
 
@@ -539,7 +537,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                 if (optlen != sizeof(ro->recv_own_msgs))
                         return -EINVAL;
 
-                err = copy_from_user(&ro->recv_own_msgs, optval, optlen);
+                if (copy_from_user(&ro->recv_own_msgs, optval, optlen))
+                        return -EFAULT;
 
                 break;
 
diff --git a/net/compat.c b/net/compat.c
index 80013fb69a6..01bf95d0832 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -24,6 +24,8 @@
 
 #include <net/scm.h>
 #include <net/sock.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
 #include <asm/uaccess.h>
 #include <net/compat.h>
 
@@ -521,6 +523,121 @@ asmlinkage long compat_sys_getsockopt(int fd, int level, int optname,
         }
         return err;
 }
+
+struct compat_group_req {
+        __u32                            gr_interface;
+        struct __kernel_sockaddr_storage gr_group
+                __attribute__ ((aligned(4)));
+} __attribute__ ((packed));
+
+struct compat_group_source_req {
+        __u32                            gsr_interface;
+        struct __kernel_sockaddr_storage gsr_group
+                __attribute__ ((aligned(4)));
+        struct __kernel_sockaddr_storage gsr_source
+                __attribute__ ((aligned(4)));
+} __attribute__ ((packed));
+
+struct compat_group_filter {
+        __u32                            gf_interface;
+        struct __kernel_sockaddr_storage gf_group
+                __attribute__ ((aligned(4)));
+        __u32                            gf_fmode;
+        __u32                            gf_numsrc;
+        struct __kernel_sockaddr_storage gf_slist[1]
+                __attribute__ ((aligned(4)));
+} __attribute__ ((packed));
+
+
+int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+        char __user *optval, int optlen,
+        int (*setsockopt)(struct sock *,int,int,char __user *,int))
+{
+        char __user     *koptval = optval;
+        int             koptlen = optlen;
+
+        switch (optname) {
+        case MCAST_JOIN_GROUP:
+        case MCAST_LEAVE_GROUP:
+        {
+                struct compat_group_req __user *gr32 = (void *)optval;
+                struct group_req __user *kgr =
+                        compat_alloc_user_space(sizeof(struct group_req));
+                u32 interface;
+
+                if (!access_ok(VERIFY_READ, gr32, sizeof(*gr32)) ||
+                    !access_ok(VERIFY_WRITE, kgr, sizeof(struct group_req)) ||
+                    __get_user(interface, &gr32->gr_interface) ||
+                    __put_user(interface, &kgr->gr_interface) ||
+                    copy_in_user(&kgr->gr_group, &gr32->gr_group,
+                                sizeof(kgr->gr_group)))
+                        return -EFAULT;
+                koptval = (char __user *)kgr;
+                koptlen = sizeof(struct group_req);
+                break;
+        }
+        case MCAST_JOIN_SOURCE_GROUP:
+        case MCAST_LEAVE_SOURCE_GROUP:
+        case MCAST_BLOCK_SOURCE:
+        case MCAST_UNBLOCK_SOURCE:
+        {
+                struct compat_group_source_req __user *gsr32 = (void *)optval;
+                struct group_source_req *kgsr = compat_alloc_user_space(
+                        sizeof(struct group_source_req));
+                u32 interface;
+
+                if (!access_ok(VERIFY_READ, gsr32, sizeof(*gsr32)) ||
+                    !access_ok(VERIFY_WRITE, kgsr,
+                        sizeof(struct group_source_req)) ||
+                    __get_user(interface, &gsr32->gsr_interface) ||
+                    __put_user(interface, &kgsr->gsr_interface) ||
+                    copy_in_user(&kgsr->gsr_group, &gsr32->gsr_group,
+                                sizeof(kgsr->gsr_group)) ||
+                    copy_in_user(&kgsr->gsr_source, &gsr32->gsr_source,
+                                sizeof(kgsr->gsr_source)))
+                        return -EFAULT;
+                koptval = (char __user *)kgsr;
+                koptlen = sizeof(struct group_source_req);
+                break;
+        }
+        case MCAST_MSFILTER:
+        {
+                struct compat_group_filter __user *gf32 = (void *)optval;
+                struct group_filter *kgf;
+                u32 interface, fmode, numsrc;
+
+                if (!access_ok(VERIFY_READ, gf32, sizeof(*gf32)) ||
+                    __get_user(interface, &gf32->gf_interface) ||
+                    __get_user(fmode, &gf32->gf_fmode) ||
+                    __get_user(numsrc, &gf32->gf_numsrc))
+                        return -EFAULT;
+                koptlen = optlen + sizeof(struct group_filter) -
+                                sizeof(struct compat_group_filter);
+                if (koptlen < GROUP_FILTER_SIZE(numsrc))
+                        return -EINVAL;
+                kgf = compat_alloc_user_space(koptlen);
+                if (!access_ok(VERIFY_WRITE, kgf, koptlen) ||
+                    __put_user(interface, &kgf->gf_interface) ||
+                    __put_user(fmode, &kgf->gf_fmode) ||
+                    __put_user(numsrc, &kgf->gf_numsrc) ||
+                    copy_in_user(&kgf->gf_group, &gf32->gf_group,
+                                sizeof(kgf->gf_group)) ||
+                    (numsrc && copy_in_user(&kgf->gf_slist, &gf32->gf_slist,
+                                numsrc * sizeof(kgf->gf_slist[0]))))
+                        return -EFAULT;
+                koptval = (char __user *)kgf;
+                break;
+        }
+
+        default:
+                break;
+        }
+        return setsockopt(sock, level, optname, koptval, koptlen);
+}
+
+EXPORT_SYMBOL(compat_mc_setsockopt);
+
+
 /* Argument list sizes for compat_sys_socketcall */
 #define AL(x) ((x) * sizeof(u32))
 static unsigned char nas[18]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index d8adfd4972e..4d8d95404f4 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -36,6 +36,7 @@
 #include <linux/mroute.h>
 #include <net/route.h>
 #include <net/xfrm.h>
+#include <net/compat.h>
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <net/transp_v6.h>
 #endif
@@ -923,6 +924,10 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname,
         if (level != SOL_IP)
                 return -ENOPROTOOPT;
 
+        if (optname >= MCAST_JOIN_GROUP && optname <= MCAST_MSFILTER)
+                return compat_mc_setsockopt(sk, level, optname, optval, optlen,
+                        ip_setsockopt);
+
         err = do_ip_setsockopt(sk, level, optname, optval, optlen);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index ac9b8482f70..0298f80681f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4925,8 +4925,7 @@ step5:
         tcp_data_snd_check(sk);
         tcp_ack_snd_check(sk);
 
-        if (tcp_defer_accept_check(sk))
-                return -1;
+        tcp_defer_accept_check(sk);
         return 0;
 
 csum_error:
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index b2c9becc02e..42814a2ec9d 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -167,7 +167,7 @@ config IPV6_SIT
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
           encapsulating protocol. This driver implements encapsulation of IPv6
-          into IPv4 packets. This is useful if you want to connect to IPv6
+          into IPv4 packets. This is useful if you want to connect two IPv6
           networks over an IPv4-only path.
 
           Saying M here will produce a module called sit.ko. If unsure, say Y.
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c8c6e33d116..2de3c464fe7 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -358,7 +358,7 @@ static int pim6_rcv(struct sk_buff *skb)
         if (pim->type != ((PIM_VERSION << 4) | PIM_REGISTER) ||
             (pim->flags & PIM_NULL_REGISTER) ||
             (ip_compute_csum((void *)pim, sizeof(*pim)) != 0 &&
-             (u16)csum_fold(skb_checksum(skb, 0, skb->len, 0))))
+             csum_fold(skb_checksum(skb, 0, skb->len, 0))))
                 goto drop;
 
         /* check if the inner packet is destined to mcast group */
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 06de9d0e1f6..db6fdc1498a 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -52,6 +52,7 @@
 #include <net/udp.h>
 #include <net/udplite.h>
 #include <net/xfrm.h>
+#include <net/compat.h>
 
 #include <asm/uaccess.h>
 
@@ -779,6 +780,10 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
         if (level != SOL_IPV6)
                 return -ENOPROTOOPT;
 
+        if (optname >= MCAST_JOIN_GROUP && optname <= MCAST_MSFILTER)
+                return compat_mc_setsockopt(sk, level, optname, optval, optlen,
+                        ipv6_setsockopt);
+
         err = do_ipv6_setsockopt(sk, level, optname, optval, optlen);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 520a5180a4f..a24b459dd45 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -73,7 +73,9 @@ config MAC80211_MESH
 
 config MAC80211_LEDS
         bool "Enable LED triggers"
-        depends on MAC80211 && LEDS_TRIGGERS
+        depends on MAC80211
+        select NEW_LEDS
+        select LEDS_TRIGGERS
         ---help---
           This option enables a few LED triggers for different
           packet receive/transmit events.
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 75d748eee0e..e1770f7ba0b 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -445,7 +445,7 @@ EXPORT_SYMBOL_GPL(xprt_wake_pending_tasks);
 /**
  * xprt_wait_for_buffer_space - wait for transport output buffer to clear
  * @task: task to be put to sleep
- *
+ * @action: function pointer to be executed after wait
  */
 void xprt_wait_for_buffer_space(struct rpc_task *task, rpc_action action)
 {
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 6ad070d8770..ad487e8abcc 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -70,10 +70,9 @@ static inline void msg_set_bits(struct tipc_msg *m, u32 w,
                                 u32 pos, u32 mask, u32 val)
 {
         val = (val & mask) << pos;
-        val = htonl(val);
-        mask = htonl(mask << pos);
-        m->hdr[w] &= ~mask;
-        m->hdr[w] |= val;
+        mask = mask << pos;
+        m->hdr[w] &= ~htonl(mask);
+        m->hdr[w] |= htonl(val);
 }
 
 /*
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 8aa6440d689..ac765dd9c7f 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -129,8 +129,7 @@ static struct xfrm_algo_desc aead_list[] = {
 
 static struct xfrm_algo_desc aalg_list[] = {
 {
-        .name = "hmac(digest_null)",
-        .compat = "digest_null",
+        .name = "digest_null",
 
         .uinfo = {
                 .auth = {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 5dcc10b93c8..fac27ce770d 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2112,7 +2112,7 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
                 iph6 = ipv6_hdr(skb);
                 audit_log_format(audit_buf,
                                  " src=" NIP6_FMT " dst=" NIP6_FMT
-                                 " flowlbl=0x%x%x%x",
+                                 " flowlbl=0x%x%02x%02x",
                                  NIP6(iph6->saddr),
                                  NIP6(iph6->daddr),
                                  iph6->flow_lbl[0] & 0x0f,