Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  appletalk: Fix OOPS in atalk_release().
  mlx4: Fixing bad size of event queue buffer
  mlx4: Fixing use after free
  bonding:typo in comment
  sctp: Pass __GFP_NOWARN to hash table allocation attempts.
  connector: convert to synchronous netlink message processing
  fib: add rtnl locking in ip_fib_net_exit
  atm/solos-pci: Don't flap VCs when carrier state changes
  atm/solos-pci: Don't include frame pseudo-header on transmit hex-dump
  atm/solos-pci: Use VPI.VCI notation uniformly.
  Atheros, atl2: Fix mem leaks in error paths of atl2_set_eeprom
  netdev: fix mtu check when TSO is enabled
  net/usb: Ethernet quirks for the LG-VL600 4G modem
  phylib: phy_attach_direct: phy_init_hw can fail, add cleanup
  bridge: mcast snooping, fix length check of snooped MLDv1/2
  via-ircc: Pass PCI device pointer to dma_{alloc, free}_coherent()
  via-ircc: Use pci_{get, set}_drvdata() instead of static pointer variable
  net: gre: provide multicast mappings for ipv4 and ipv6
  bridge: Fix compilation warning in function br_stp_recalculate_bridge_id()
  net: Fix warnings caused by MAX_SKB_FRAGS change.

1 files changed, 12 insertions, 35 deletions

diff --git a/drivers/connector/connector.c b/drivers/connector/connector.c
index f7554de3be5e..d77005849af8 100644
--- a/drivers/connector/connector.c
+++ b/drivers/connector/connector.c
@@ -122,51 +122,28 @@ EXPORT_SYMBOL_GPL(cn_netlink_send);
  */
 static int cn_call_callback(struct sk_buff *skb)
 {
-        struct cn_callback_entry *__cbq, *__new_cbq;
+        struct cn_callback_entry *i, *cbq = NULL;
         struct cn_dev *dev = &cdev;
         struct cn_msg *msg = NLMSG_DATA(nlmsg_hdr(skb));
+        struct netlink_skb_parms *nsp = &NETLINK_CB(skb);
         int err = -ENODEV;
 
         spin_lock_bh(&dev->cbdev->queue_lock);
-        list_for_each_entry(__cbq, &dev->cbdev->queue_list, callback_entry) {
-                if (cn_cb_equal(&__cbq->id.id, &msg->id)) {
-                        if (likely(!work_pending(&__cbq->work) &&
-                                        __cbq->data.skb == NULL)) {
-                                __cbq->data.skb = skb;
-
-                                if (queue_work(dev->cbdev->cn_queue,
-                                               &__cbq->work))
-                                        err = 0;
-                                else
-                                        err = -EINVAL;
-                        } else {
-                                struct cn_callback_data *d;
-
-                                err = -ENOMEM;
-                                __new_cbq = kzalloc(sizeof(struct cn_callback_entry), GFP_ATOMIC);
-                                if (__new_cbq) {
-                                        d = &__new_cbq->data;
-                                        d->skb = skb;
-                                        d->callback = __cbq->data.callback;
-                                        d->free = __new_cbq;
-
-                                        INIT_WORK(&__new_cbq->work,
-                                                        &cn_queue_wrapper);
-
-                                        if (queue_work(dev->cbdev->cn_queue,
-                                                       &__new_cbq->work))
-                                                err = 0;
-                                        else {
-                                                kfree(__new_cbq);
-                                                err = -EINVAL;
-                                        }
-                                }
-                        }
+        list_for_each_entry(i, &dev->cbdev->queue_list, callback_entry) {
+                if (cn_cb_equal(&i->id.id, &msg->id)) {
+                        atomic_inc(&i->refcnt);
+                        cbq = i;
                         break;
                 }
         }
         spin_unlock_bh(&dev->cbdev->queue_lock);
 
+        if (cbq != NULL) {
+                cbq->callback(msg, nsp);
+                kfree_skb(skb);
+                cn_queue_release_callback(cbq);
+        }
+
         return err;
 }