Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NET]: Fully fix the memory leaks in sys_accept().
  [NETFILTER]: iptables 32bit compat layer
  [NETFILTER]: {ip,nf}_conntrack_netlink: fix expectation notifier unregistration
  [NETFILTER]: fix ifdef for connmark support in nf_conntrack_netlink
  [NETFILTER]: x_tables: unify IPv4/IPv6 multiport match
  [NETFILTER]: x_tables: unify IPv4/IPv6 esp match
  [NET]: Fix dentry leak in sys_accept().
  [IPSEC]: Kill unused decap state structure
  [IPSEC]: Kill unused decap state argument
  [NET]: com90xx kmalloc fix
  [TG3]: Update driver version and reldate.
  [TG3]: Revert "Speed up SRAM access"

9 files changed, 156 insertions, 74 deletions

diff --git a/include/linux/netfilter/x_tables.h b/include/linux/netfilter/x_tables.h
index 1350e47b0234..f6bdef82a322 100644
--- a/include/linux/netfilter/x_tables.h
+++ b/include/linux/netfilter/x_tables.h
@@ -142,6 +142,12 @@ struct xt_counters_info
 #define ASSERT_WRITE_LOCK(x)
 #include <linux/netfilter_ipv4/listhelp.h>
 
+#ifdef CONFIG_COMPAT
+#define COMPAT_TO_USER          1
+#define COMPAT_FROM_USER        -1
+#define COMPAT_CALC_SIZE        0
+#endif
+
 struct xt_match
 {
         struct list_head list;
@@ -175,6 +181,9 @@ struct xt_match
         void (*destroy)(const struct xt_match *match, void *matchinfo,
                         unsigned int matchinfosize);
 
+        /* Called when userspace align differs from kernel space one */
+        int (*compat)(void *match, void **dstptr, int *size, int convert);
+
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
 
@@ -220,6 +229,9 @@ struct xt_target
         void (*destroy)(const struct xt_target *target, void *targinfo,
                         unsigned int targinfosize);
 
+        /* Called when userspace align differs from kernel space one */
+        int (*compat)(void *target, void **dstptr, int *size, int convert);
+
         /* Set this to THIS_MODULE if you are a module, otherwise NULL */
         struct module *me;
 
@@ -314,6 +326,61 @@ extern void xt_proto_fini(int af);
 extern struct xt_table_info *xt_alloc_table_info(unsigned int size);
 extern void xt_free_table_info(struct xt_table_info *info);
 
+#ifdef CONFIG_COMPAT
+#include <net/compat.h>
+
+struct compat_xt_entry_match
+{
+        union {
+                struct {
+                        u_int16_t match_size;
+                        char name[XT_FUNCTION_MAXNAMELEN - 1];
+                        u_int8_t revision;
+                } user;
+                u_int16_t match_size;
+        } u;
+        unsigned char data[0];
+};
+
+struct compat_xt_entry_target
+{
+        union {
+                struct {
+                        u_int16_t target_size;
+                        char name[XT_FUNCTION_MAXNAMELEN - 1];
+                        u_int8_t revision;
+                } user;
+                u_int16_t target_size;
+        } u;
+        unsigned char data[0];
+};
+
+/* FIXME: this works only on 32 bit tasks
+ * need to change whole approach in order to calculate align as function of
+ * current task alignment */
+
+struct compat_xt_counters
+{
+        u_int32_t cnt[4];
+};
+
+struct compat_xt_counters_info
+{
+        char name[XT_TABLE_MAXNAMELEN];
+        compat_uint_t num_counters;
+        struct compat_xt_counters counters[0];
+};
+
+#define COMPAT_XT_ALIGN(s) (((s) + (__alignof__(struct compat_xt_counters)-1)) \
+                & ~(__alignof__(struct compat_xt_counters)-1))
+
+extern void xt_compat_lock(int af);
+extern void xt_compat_unlock(int af);
+extern int xt_compat_match(void *match, void **dstptr, int *size, int convert);
+extern int xt_compat_target(void *target, void **dstptr, int *size,
+                int convert);
+
+#endif /* CONFIG_COMPAT */
 #endif /* __KERNEL__ */
 
 #endif /* _X_TABLES_H */
diff --git a/include/linux/netfilter/xt_esp.h b/include/linux/netfilter/xt_esp.h
new file mode 100644
index 000000000000..9380fb1c27da
--- /dev/null
+++ b/include/linux/netfilter/xt_esp.h
@@ -0,0 +1,14 @@
+#ifndef _XT_ESP_H
+#define _XT_ESP_H
+
+struct xt_esp
+{
+        u_int32_t spis[2];      /* Security Parameter Index */
+        u_int8_t  invflags;     /* Inverse flags */
+};
+
+/* Values for "invflags" field in struct xt_esp. */
+#define XT_ESP_INV_SPI  0x01    /* Invert the sense of spi. */
+#define XT_ESP_INV_MASK 0x01    /* All possible flags. */
+
+#endif /*_XT_ESP_H*/
diff --git a/include/linux/netfilter/xt_multiport.h b/include/linux/netfilter/xt_multiport.h
new file mode 100644
index 000000000000..d49ee4183710
--- /dev/null
+++ b/include/linux/netfilter/xt_multiport.h
@@ -0,0 +1,30 @@
+#ifndef _XT_MULTIPORT_H
+#define _XT_MULTIPORT_H
+
+enum xt_multiport_flags
+{
+        XT_MULTIPORT_SOURCE,
+        XT_MULTIPORT_DESTINATION,
+        XT_MULTIPORT_EITHER
+};
+
+#define XT_MULTI_PORTS  15
+
+/* Must fit inside union xt_matchinfo: 16 bytes */
+struct xt_multiport
+{
+        u_int8_t flags;                         /* Type of comparison */
+        u_int8_t count;                         /* Number of ports */
+        u_int16_t ports[XT_MULTI_PORTS];        /* Ports */
+};
+
+struct xt_multiport_v1
+{
+        u_int8_t flags;                         /* Type of comparison */
+        u_int8_t count;                         /* Number of ports */
+        u_int16_t ports[XT_MULTI_PORTS];        /* Ports */
+        u_int8_t pflags[XT_MULTI_PORTS];        /* Port flags */
+        u_int8_t invert;                        /* Invert flag */
+};
+
+#endif /*_XT_MULTIPORT_H*/
diff --git a/include/linux/netfilter_ipv4/ip_tables.h b/include/linux/netfilter_ipv4/ip_tables.h
index d5b8c0d6a12b..c0dac16e1902 100644
--- a/include/linux/netfilter_ipv4/ip_tables.h
+++ b/include/linux/netfilter_ipv4/ip_tables.h
@@ -316,5 +316,23 @@ extern unsigned int ipt_do_table(struct sk_buff **pskb,
                                  void *userdata);
 
 #define IPT_ALIGN(s) XT_ALIGN(s)
+
+#ifdef CONFIG_COMPAT
+#include <net/compat.h>
+
+struct compat_ipt_entry
+{
+        struct ipt_ip ip;
+        compat_uint_t nfcache;
+        u_int16_t target_offset;
+        u_int16_t next_offset;
+        compat_uint_t comefrom;
+        struct compat_xt_counters counters;
+        unsigned char elems[0];
+};
+
+#define COMPAT_IPT_ALIGN(s)     COMPAT_XT_ALIGN(s)
+
+#endif /* CONFIG_COMPAT */
 #endif /*__KERNEL__*/
 #endif /* _IPTABLES_H */
diff --git a/include/linux/netfilter_ipv4/ipt_esp.h b/include/linux/netfilter_ipv4/ipt_esp.h
index c782a83e53e0..78296e7eeff9 100644
--- a/include/linux/netfilter_ipv4/ipt_esp.h
+++ b/include/linux/netfilter_ipv4/ipt_esp.h
@@ -1,16 +1,10 @@
 #ifndef _IPT_ESP_H
 #define _IPT_ESP_H
 
-struct ipt_esp
-{
-        u_int32_t spis[2];                      /* Security Parameter Index */
-        u_int8_t  invflags;                     /* Inverse flags */
-};
+#include <linux/netfilter/xt_esp.h>
 
-
-
-/* Values for "invflags" field in struct ipt_esp. */
-#define IPT_ESP_INV_SPI         0x01    /* Invert the sense of spi. */
-#define IPT_ESP_INV_MASK        0x01    /* All possible flags. */
+#define ipt_esp xt_esp
+#define IPT_ESP_INV_SPI         XT_ESP_INV_SPI
+#define IPT_ESP_INV_MASK        XT_ESP_INV_MASK
 
 #endif /*_IPT_ESP_H*/
diff --git a/include/linux/netfilter_ipv4/ipt_multiport.h b/include/linux/netfilter_ipv4/ipt_multiport.h
index e6b6fff811df..55fe85eca88c 100644
--- a/include/linux/netfilter_ipv4/ipt_multiport.h
+++ b/include/linux/netfilter_ipv4/ipt_multiport.h
@@ -1,30 +1,15 @@
 #ifndef _IPT_MULTIPORT_H
 #define _IPT_MULTIPORT_H
-#include <linux/netfilter_ipv4/ip_tables.h>
 
-enum ipt_multiport_flags
-{
-        IPT_MULTIPORT_SOURCE,
-        IPT_MULTIPORT_DESTINATION,
-        IPT_MULTIPORT_EITHER
-};
+#include <linux/netfilter/xt_multiport.h>
 
-#define IPT_MULTI_PORTS 15
+#define IPT_MULTIPORT_SOURCE            XT_MULTIPORT_SOURCE
+#define IPT_MULTIPORT_DESTINATION       XT_MULTIPORT_DESTINATION
+#define IPT_MULTIPORT_EITHER            XT_MULTIPORT_EITHER
 
-/* Must fit inside union ipt_matchinfo: 16 bytes */
-struct ipt_multiport
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
-};
+#define IPT_MULTI_PORTS                 XT_MULTI_PORTS
+
+#define ipt_multiport                   xt_multiport
+#define ipt_multiport_v1                xt_multiport_v1
 
-struct ipt_multiport_v1
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IPT_MULTI_PORTS];       /* Ports */
-        u_int8_t pflags[IPT_MULTI_PORTS];       /* Port flags */
-        u_int8_t invert;                        /* Invert flag */
-};
 #endif /*_IPT_MULTIPORT_H*/
diff --git a/include/linux/netfilter_ipv6/ip6t_esp.h b/include/linux/netfilter_ipv6/ip6t_esp.h
index a91b6abc8079..f62eaf53c16c 100644
--- a/include/linux/netfilter_ipv6/ip6t_esp.h
+++ b/include/linux/netfilter_ipv6/ip6t_esp.h
@@ -1,14 +1,10 @@
 #ifndef _IP6T_ESP_H
 #define _IP6T_ESP_H
 
-struct ip6t_esp
-{
-        u_int32_t spis[2];                      /* Security Parameter Index */
-        u_int8_t  invflags;                     /* Inverse flags */
-};
+#include <linux/netfilter/xt_esp.h>
 
-/* Values for "invflags" field in struct ip6t_esp. */
-#define IP6T_ESP_INV_SPI                0x01    /* Invert the sense of spi. */
-#define IP6T_ESP_INV_MASK       0x01    /* All possible flags. */
+#define ip6t_esp xt_esp
+#define IP6T_ESP_INV_SPI        XT_ESP_INV_SPI
+#define IP6T_ESP_INV_MASK       XT_ESP_INV_MASK
 
 #endif /*_IP6T_ESP_H*/
diff --git a/include/linux/netfilter_ipv6/ip6t_multiport.h b/include/linux/netfilter_ipv6/ip6t_multiport.h
index efe4954a8681..042c92661cee 100644
--- a/include/linux/netfilter_ipv6/ip6t_multiport.h
+++ b/include/linux/netfilter_ipv6/ip6t_multiport.h
@@ -1,21 +1,14 @@
 #ifndef _IP6T_MULTIPORT_H
 #define _IP6T_MULTIPORT_H
-#include <linux/netfilter_ipv6/ip6_tables.h>
 
-enum ip6t_multiport_flags
-{
-        IP6T_MULTIPORT_SOURCE,
-        IP6T_MULTIPORT_DESTINATION,
-        IP6T_MULTIPORT_EITHER
-};
+#include <linux/netfilter/xt_multiport.h>
 
-#define IP6T_MULTI_PORTS        15
+#define IP6T_MULTIPORT_SOURCE           XT_MULTIPORT_SOURCE
+#define IP6T_MULTIPORT_DESTINATION      XT_MULTIPORT_DESTINATION
+#define IP6T_MULTIPORT_EITHER           XT_MULTIPORT_EITHER
 
-/* Must fit inside union ip6t_matchinfo: 16 bytes */
-struct ip6t_multiport
-{
-        u_int8_t flags;                         /* Type of comparison */
-        u_int8_t count;                         /* Number of ports */
-        u_int16_t ports[IP6T_MULTI_PORTS];      /* Ports */
-};
-#endif /*_IPT_MULTIPORT_H*/
+#define IP6T_MULTI_PORTS                XT_MULTI_PORTS
+
+#define ip6t_multiport                  xt_multiport
+
+#endif /*_IP6T_MULTIPORT_H*/
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index e100291e43f4..0d5529c382e8 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -242,7 +242,6 @@ extern int xfrm_state_unregister_afinfo(struct xfrm_state_afinfo *afinfo);
 
 extern void xfrm_state_delete_tunnel(struct xfrm_state *x);
 
-struct xfrm_decap_state;
 struct xfrm_type
 {
         char                    *description;
@@ -251,7 +250,7 @@ struct xfrm_type
 
         int                     (*init_state)(struct xfrm_state *x);
         void                    (*destructor)(struct xfrm_state *);
-        int                     (*input)(struct xfrm_state *, struct xfrm_decap_state *, struct sk_buff *skb);
+        int                     (*input)(struct xfrm_state *, struct sk_buff *skb);
         int                     (*output)(struct xfrm_state *, struct sk_buff *pskb);
         /* Estimate maximal size of result of transformation of a dgram */
         u32                     (*get_max_size)(struct xfrm_state *, int size);
@@ -606,25 +605,11 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
 
 extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
 
-/* Decapsulation state, used by the input to store data during
- * decapsulation procedure, to be used later (during the policy
- * check
- */
-struct xfrm_decap_state {
-        char    decap_data[20];
-        __u16   decap_type;
-};   
-
-struct sec_decap_state {
-        struct xfrm_state       *xvec;
-        struct xfrm_decap_state decap;
-};
-
 struct sec_path
 {
         atomic_t                refcnt;
         int                     len;
-        struct sec_decap_state  x[XFRM_MAX_DEPTH];
+        struct xfrm_state       *xvec[XFRM_MAX_DEPTH];
 };
 
 static inline struct sec_path *