Merge with /pub/scm/linux/kernel/git/torvalds/linux-2.6.git

Signed-off-by: Steve French <sfrench@us.ibm.com>

9 files changed, 76 insertions, 28 deletions

diff --git a/fs/cifs/file.c b/fs/cifs/file.c
index d17c97d07c80..675bd2568297 100644
--- a/fs/cifs/file.c
+++ b/fs/cifs/file.c
@@ -1442,13 +1442,15 @@ ssize_t cifs_user_read(struct file *file, char __user *read_data,
                                          &bytes_read, &smb_read_data,
                                          &buf_type);
                         pSMBr = (struct smb_com_read_rsp *)smb_read_data;
-                        if (copy_to_user(current_offset, 
-                                         smb_read_data + 4 /* RFC1001 hdr */
-                                         + le16_to_cpu(pSMBr->DataOffset), 
-                                         bytes_read)) {
-                                rc = -EFAULT;
-                        }
                         if (smb_read_data) {
+                                if (copy_to_user(current_offset,
+                                                smb_read_data +
+                                                4 /* RFC1001 length field */ +
+                                                le16_to_cpu(pSMBr->DataOffset),
+                                                bytes_read)) {
+                                        rc = -EFAULT;
+                                }
+
                                 if(buf_type == CIFS_SMALL_BUFFER)
                                         cifs_small_buf_release(smb_read_data);
                                 else if(buf_type == CIFS_LARGE_BUFFER)
diff --git a/fs/exec.c b/fs/exec.c
index 055378d2513e..0e1c95074d42 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1403,7 +1403,7 @@ static void zap_threads (struct mm_struct *mm)
                 do_each_thread(g,p) {
                         if (mm == p->mm && p != tsk &&
                             p->ptrace && p->parent->mm == mm) {
-                                __ptrace_unlink(p);
+                                __ptrace_detach(p, 0);
                         }
                 } while_each_thread(g,p);
                 write_unlock_irq(&tasklist_lock);
diff --git a/include/linux/netfilter_ipv4.h b/include/linux/netfilter_ipv4.h
index fdc4a9527343..43c09d790b83 100644
--- a/include/linux/netfilter_ipv4.h
+++ b/include/linux/netfilter_ipv4.h
@@ -79,7 +79,7 @@ enum nf_ip_hook_priorities {
 
 #ifdef __KERNEL__
 extern int ip_route_me_harder(struct sk_buff **pskb);
-
+extern int ip_xfrm_me_harder(struct sk_buff **pskb);
 #endif /*__KERNEL__*/
 
 #endif /*__LINUX_IP_NETFILTER_H*/
diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
index 9d5cd106b344..0d36750fc0f1 100644
--- a/include/linux/ptrace.h
+++ b/include/linux/ptrace.h
@@ -84,6 +84,7 @@ extern int ptrace_readdata(struct task_struct *tsk, unsigned long src, char __us
 extern int ptrace_writedata(struct task_struct *tsk, char __user *src, unsigned long dst, int len);
 extern int ptrace_attach(struct task_struct *tsk);
 extern int ptrace_detach(struct task_struct *, unsigned int);
+extern void __ptrace_detach(struct task_struct *, unsigned int);
 extern void ptrace_disable(struct task_struct *);
 extern int ptrace_check_attach(struct task_struct *task, int kill);
 extern int ptrace_request(struct task_struct *child, long request, long addr, long data);
diff --git a/kernel/fork.c b/kernel/fork.c
index 8e88b374cee9..fbea12d7a943 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -1123,8 +1123,8 @@ static task_t *copy_process(unsigned long clone_flags,
                 p->real_parent = current;
         p->parent = p->real_parent;
 
+        spin_lock(&current->sighand->siglock);
         if (clone_flags & CLONE_THREAD) {
-                spin_lock(&current->sighand->siglock);
                 /*
                  * Important: if an exit-all has been started then
                  * do not create this new thread - the whole thread
@@ -1162,8 +1162,6 @@ static task_t *copy_process(unsigned long clone_flags,
                          */
                         p->it_prof_expires = jiffies_to_cputime(1);
                 }
-
-                spin_unlock(&current->sighand->siglock);
         }
 
         /*
@@ -1175,8 +1173,6 @@ static task_t *copy_process(unsigned long clone_flags,
         if (unlikely(p->ptrace & PT_PTRACED))
                 __ptrace_link(p, current->parent);
 
-        attach_pid(p, PIDTYPE_PID, p->pid);
-        attach_pid(p, PIDTYPE_TGID, p->tgid);
         if (thread_group_leader(p)) {
                 p->signal->tty = current->signal->tty;
                 p->signal->pgrp = process_group(current);
@@ -1186,9 +1182,12 @@ static task_t *copy_process(unsigned long clone_flags,
                 if (p->pid)
                         __get_cpu_var(process_counts)++;
         }
+        attach_pid(p, PIDTYPE_TGID, p->tgid);
+        attach_pid(p, PIDTYPE_PID, p->pid);
 
         nr_threads++;
         total_forks++;
+        spin_unlock(&current->sighand->siglock);
         write_unlock_irq(&tasklist_lock);
         proc_fork_connector(p);
         return p;
diff --git a/kernel/ptrace.c b/kernel/ptrace.c
index d2cf144d0af5..d95a72c9279d 100644
--- a/kernel/ptrace.c
+++ b/kernel/ptrace.c
@@ -72,8 +72,8 @@ void ptrace_untrace(task_t *child)
  */
 void __ptrace_unlink(task_t *child)
 {
-        if (!child->ptrace)
-                BUG();
+        BUG_ON(!child->ptrace);
+
         child->ptrace = 0;
         if (!list_empty(&child->ptrace_list)) {
                 list_del_init(&child->ptrace_list);
@@ -184,22 +184,27 @@ bad:
         return retval;
 }
 
+void __ptrace_detach(struct task_struct *child, unsigned int data)
+{
+        child->exit_code = data;
+        /* .. re-parent .. */
+        __ptrace_unlink(child);
+        /* .. and wake it up. */
+        if (child->exit_state != EXIT_ZOMBIE)
+                wake_up_process(child);
+}
+
 int ptrace_detach(struct task_struct *child, unsigned int data)
 {
         if (!valid_signal(data))
-                return  -EIO;
+                return -EIO;
 
         /* Architecture-specific hardware disable .. */
         ptrace_disable(child);
 
-        /* .. re-parent .. */
-        child->exit_code = data;
-
         write_lock_irq(&tasklist_lock);
-        __ptrace_unlink(child);
-        /* .. and wake it up. */
-        if (child->exit_state != EXIT_ZOMBIE)
-                wake_up_process(child);
+        if (child->ptrace)
+                __ptrace_detach(child, data);
         write_unlock_irq(&tasklist_lock);
 
         return 0;
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index cc047f7fb6ef..35cf3a074087 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -67,7 +67,7 @@ void br_stp_disable_bridge(struct net_bridge *br)
 {
         struct net_bridge_port *p;
 
-        spin_lock(&br->lock);
+        spin_lock_bh(&br->lock);
         list_for_each_entry(p, &br->port_list, list) {
                 if (p->state != BR_STATE_DISABLED)
                         br_stp_disable_port(p);
@@ -76,7 +76,7 @@ void br_stp_disable_bridge(struct net_bridge *br)
 
         br->topology_change = 0;
         br->topology_change_detected = 0;
-        spin_unlock(&br->lock);
+        spin_unlock_bh(&br->lock);
 
         del_timer_sync(&br->hello_timer);
         del_timer_sync(&br->topology_change_timer);
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 52a3d7c57907..ed42cdc57cd9 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -78,6 +78,47 @@ int ip_route_me_harder(struct sk_buff **pskb)
 }
 EXPORT_SYMBOL(ip_route_me_harder);
 
+#ifdef CONFIG_XFRM
+int ip_xfrm_me_harder(struct sk_buff **pskb)
+{
+        struct flowi fl;
+        unsigned int hh_len;
+        struct dst_entry *dst;
+
+        if (IPCB(*pskb)->flags & IPSKB_XFRM_TRANSFORMED)
+                return 0;
+        if (xfrm_decode_session(*pskb, &fl, AF_INET) < 0)
+                return -1;
+
+        dst = (*pskb)->dst;
+        if (dst->xfrm)
+                dst = ((struct xfrm_dst *)dst)->route;
+        dst_hold(dst);
+
+        if (xfrm_lookup(&dst, &fl, (*pskb)->sk, 0) < 0)
+                return -1;
+
+        dst_release((*pskb)->dst);
+        (*pskb)->dst = dst;
+
+        /* Change in oif may mean change in hh_len. */
+        hh_len = (*pskb)->dst->dev->hard_header_len;
+        if (skb_headroom(*pskb) < hh_len) {
+                struct sk_buff *nskb;
+
+                nskb = skb_realloc_headroom(*pskb, hh_len);
+                if (!nskb)
+                        return -1;
+                if ((*pskb)->sk)
+                        skb_set_owner_w(nskb, (*pskb)->sk);
+                kfree_skb(*pskb);
+                *pskb = nskb;
+        }
+        return 0;
+}
+EXPORT_SYMBOL(ip_xfrm_me_harder);
+#endif
+
 void (*ip_nat_decode_session)(struct sk_buff *, struct flowi *);
 EXPORT_SYMBOL(ip_nat_decode_session);
 
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index 92c54999a19d..7c3f7d380240 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -235,19 +235,19 @@ ip_nat_out(unsigned int hooknum,
                 return NF_ACCEPT;
 
         ret = ip_nat_fn(hooknum, pskb, in, out, okfn);
+#ifdef CONFIG_XFRM
         if (ret != NF_DROP && ret != NF_STOLEN
             && (ct = ip_conntrack_get(*pskb, &ctinfo)) != NULL) {
                 enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
 
                 if (ct->tuplehash[dir].tuple.src.ip !=
                     ct->tuplehash[!dir].tuple.dst.ip
-#ifdef CONFIG_XFRM
                     || ct->tuplehash[dir].tuple.src.u.all !=
                        ct->tuplehash[!dir].tuple.dst.u.all
-#endif
                     )
-                        return ip_route_me_harder(pskb) == 0 ? ret : NF_DROP;
+                        return ip_xfrm_me_harder(pskb) == 0 ? ret : NF_DROP;
         }
+#endif
         return ret;
 }