Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [STRIP]: Fix neighbour table refcount leak.
  [IPV6]: ipv6_add_addr should install dstentry earlier
  [NETLINK]: Call panic if nl_table allocation fails
  [TCP]: Two RFC3465 Appropriate Byte Count fixes.
  [IPV6]: SNMPv2 "ipv6IfStatsInAddrErrors" counter error
  [E100]: Add module option to ignore bad EEPROM checksums.
  [SCTP]: Fix sctp_primitive_ABORT() call in sctp_close().

8 files changed, 36 insertions, 19 deletions

diff --git a/drivers/net/e100.c b/drivers/net/e100.c
index 91ef5f2fd768..ce850f1078b5 100644
--- a/drivers/net/e100.c
+++ b/drivers/net/e100.c
@@ -173,8 +173,11 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
 static int debug = 3;
+static int eeprom_bad_csum_allow = 0;
 module_param(debug, int, 0);
+module_param(eeprom_bad_csum_allow, int, 0);
 MODULE_PARM_DESC(debug, "Debug level (0=none,...,16=all)");
+MODULE_PARM_DESC(eeprom_bad_csum_allow, "Allow bad eeprom checksums");
 #define DPRINTK(nlevel, klevel, fmt, args...) \
         (void)((NETIF_MSG_##nlevel & nic->msg_enable) && \
         printk(KERN_##klevel PFX "%s: %s: " fmt, nic->netdev->name, \
@@ -756,7 +759,8 @@ static int e100_eeprom_load(struct nic *nic)
         checksum = le16_to_cpu(0xBABA - checksum);
         if(checksum != nic->eeprom[nic->eeprom_wc - 1]) {
                 DPRINTK(PROBE, ERR, "EEPROM corrupted\n");
-                return -EAGAIN;
+                if (!eeprom_bad_csum_allow)
+                        return -EAGAIN;
         }
 
         return 0;
diff --git a/drivers/net/wireless/strip.c b/drivers/net/wireless/strip.c
index fd31885c6844..ccaf28e8db0a 100644
--- a/drivers/net/wireless/strip.c
+++ b/drivers/net/wireless/strip.c
@@ -467,6 +467,7 @@ static int arp_query(unsigned char *haddr, u32 paddr,
                      struct net_device *dev)
 {
         struct neighbour *neighbor_entry;
+        int ret = 0;
 
         neighbor_entry = neigh_lookup(&arp_tbl, &paddr, dev);
 
@@ -474,10 +475,11 @@ static int arp_query(unsigned char *haddr, u32 paddr,
                 neighbor_entry->used = jiffies;
                 if (neighbor_entry->nud_state & NUD_VALID) {
                         memcpy(haddr, neighbor_entry->ha, dev->addr_len);
-                        return 1;
+                        ret = 1;
                 }
+                neigh_release(neighbor_entry);
         }
-        return 0;
+        return ret;
 }
 
 static void DumpData(char *msg, struct strip *strip_info, __u8 * ptr,
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 5765f9d03174..7ff2e4273a7c 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -189,7 +189,7 @@ void tcp_slow_start(struct tcp_sock *tp)
                         return;
 
                 /* We MAY increase by 2 if discovered delayed ack */
-                if (sysctl_tcp_abc > 1 && tp->bytes_acked > 2*tp->mss_cache) {
+                if (sysctl_tcp_abc > 1 && tp->bytes_acked >= 2*tp->mss_cache) {
                         if (tp->snd_cwnd < tp->snd_cwnd_clamp)
                                 tp->snd_cwnd++;
                 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 104af5d5bcbc..111ff39a08c5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2505,8 +2505,13 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
         if (before(ack, prior_snd_una))
                 goto old_ack;
 
-        if (sysctl_tcp_abc && icsk->icsk_ca_state < TCP_CA_CWR)
-                tp->bytes_acked += ack - prior_snd_una;
+        if (sysctl_tcp_abc) {
+                if (icsk->icsk_ca_state < TCP_CA_CWR)
+                        tp->bytes_acked += ack - prior_snd_una;
+                else if (icsk->icsk_ca_state == TCP_CA_Loss)
+                        /* we assume just one segment left network */
+                        tp->bytes_acked += min(ack - prior_snd_una, tp->mss_cache);
+        }
 
         if (!(flag&FLAG_SLOWPATH) && after(ack, prior_snd_una)) {
                 /* Window is constant, pure forward advance.
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 0c5042e7380d..c7852b38e03e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -578,6 +578,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         ifa->flags = flags | IFA_F_TENTATIVE;
         ifa->cstamp = ifa->tstamp = jiffies;
 
+        ifa->rt = rt;
+
         ifa->idev = idev;
         in6_dev_hold(idev);
         /* For caller */
@@ -603,8 +605,6 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         }
 #endif
 
-        ifa->rt = rt;
-
         in6_ifa_hold(ifa);
         write_unlock(&idev->lock);
 out2:
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4b163711f3a8..d9baca062d24 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1532,6 +1532,10 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
 
 static int ip6_pkt_discard(struct sk_buff *skb)
 {
+        int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
+        if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
+                IP6_INC_STATS(IPSTATS_MIB_INADDRERRORS);
+
         IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
         icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
         kfree_skb(skb);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index b85c1f9f1288..8b85036ba8e3 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1273,8 +1273,7 @@ netlink_kernel_create(int unit, unsigned int groups,
         struct netlink_sock *nlk;
         unsigned long *listeners = NULL;
 
-        if (!nl_table)
-                return NULL;
+        BUG_ON(!nl_table);
 
         if (unit<0 || unit>=MAX_LINKS)
                 return NULL;
@@ -1745,11 +1744,8 @@ static int __init netlink_proto_init(void)
                 netlink_skb_parms_too_large();
 
         nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
-        if (!nl_table) {
-enomem:
-                printk(KERN_CRIT "netlink_init: Cannot allocate nl_table\n");
-                return -ENOMEM;
-        }
+        if (!nl_table)
+                goto panic;
 
         if (num_physpages >= (128 * 1024))
                 max = num_physpages >> (21 - PAGE_SHIFT);
@@ -1769,7 +1765,7 @@ enomem:
                                 nl_pid_hash_free(nl_table[i].hash.table,
                                                  1 * sizeof(*hash->table));
                         kfree(nl_table);
-                        goto enomem;
+                        goto panic;
                 }
                 memset(hash->table, 0, 1 * sizeof(*hash->table));
                 hash->max_shift = order;
@@ -1786,6 +1782,8 @@ enomem:
         rtnetlink_init();
 out:
         return err;
+panic:
+        panic("netlink_init: Cannot allocate nl_table\n");
 }
 
 core_initcall(netlink_proto_init);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index fde3f55bfd4b..dab15949958e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1289,9 +1289,13 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
                         }
                 }
 
-                if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)
-                        sctp_primitive_ABORT(asoc, NULL);
-                else
+                if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
+                        struct sctp_chunk *chunk;
+
+                        chunk = sctp_make_abort_user(asoc, NULL, 0);
+                        if (chunk)
+                                sctp_primitive_ABORT(asoc, chunk);
+                } else
                         sctp_primitive_SHUTDOWN(asoc, NULL);
         }