Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [VLAN]: Fix net_device leak.
  [PPP] generic: Fix receive path data clobbering & non-linear handling
  [PPP] generic: Call skb_cow_head before scribbling over skb
  [NET] skbuff: Add skb_cow_head
  [BRIDGE]: Kill clone argument to br_flood_*
  [PPP] pppoe: Fill in header directly in __pppoe_xmit
  [PPP] pppoe: Fix data clobbering in __pppoe_xmit and return value
  [PPP] pppoe: Fix skb_unshare_check call position
  [SCTP]: Convert bind_addr_list locking to RCU
  [SCTP]: Add RCU synchronization around sctp_localaddr_list
  [PKT_SCHED]: sch_cbq.c: Shut up uninitialized variable warning
  [PKTGEN]: srcmac fix
  [IPV6]: Fix source address selection.
  [IPV4]: Just increment OutDatagrams once per a datagram.
  [IPV6]: Just increment OutDatagrams once per a datagram.
  [IPV6]: Fix unbalanced socket reference with MSG_CONFIRM.
  [NET_SCHED] protect action config/dump from irqs
  [NET]: Fix two issues wrt. SO_BINDTODEVICE.

3 files changed, 41 insertions, 13 deletions

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 93c27f71122a..a656cecd373c 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -1352,6 +1352,22 @@ static inline int skb_clone_writable(struct sk_buff *skb, int len)
                skb_headroom(skb) + len <= skb->hdr_len;
 }
 
+static inline int __skb_cow(struct sk_buff *skb, unsigned int headroom,
+                            int cloned)
+{
+        int delta = 0;
+
+        if (headroom < NET_SKB_PAD)
+                headroom = NET_SKB_PAD;
+        if (headroom > skb_headroom(skb))
+                delta = headroom - skb_headroom(skb);
+
+        if (delta || cloned)
+                return pskb_expand_head(skb, ALIGN(delta, NET_SKB_PAD), 0,
+                                        GFP_ATOMIC);
+        return 0;
+}
+
 /**
  *      skb_cow - copy header of skb when it is required
  *      @skb: buffer to cow
@@ -1366,16 +1382,22 @@ static inline int skb_clone_writable(struct sk_buff *skb, int len)
  */
 static inline int skb_cow(struct sk_buff *skb, unsigned int headroom)
 {
-        int delta = (headroom > NET_SKB_PAD ? headroom : NET_SKB_PAD) -
-                        skb_headroom(skb);
-
-        if (delta < 0)
-                delta = 0;
+        return __skb_cow(skb, headroom, skb_cloned(skb));
+}
 
-        if (delta || skb_cloned(skb))
-                return pskb_expand_head(skb, (delta + (NET_SKB_PAD-1)) &
-                                ~(NET_SKB_PAD-1), 0, GFP_ATOMIC);
-        return 0;
+/**
+ *      skb_cow_head - skb_cow but only making the head writable
+ *      @skb: buffer to cow
+ *      @headroom: needed headroom
+ *
+ *      This function is identical to skb_cow except that we replace the
+ *      skb_cloned check by skb_header_cloned.  It should be used when
+ *      you only need to push on some header and do not need to modify
+ *      the data.
+ */
+static inline int skb_cow_head(struct sk_buff *skb, unsigned int headroom)
+{
+        return __skb_cow(skb, headroom, skb_header_cloned(skb));
 }
 
 /**
diff --git a/include/net/sctp/sctp.h b/include/net/sctp/sctp.h
index d529045c1679..c9cc00c85782 100644
--- a/include/net/sctp/sctp.h
+++ b/include/net/sctp/sctp.h
@@ -123,6 +123,7 @@
  * sctp/protocol.c
  */
 extern struct sock *sctp_get_ctl_sock(void);
+extern void sctp_local_addr_free(struct rcu_head *head);
 extern int sctp_copy_local_addr_list(struct sctp_bind_addr *,
                                      sctp_scope_t, gfp_t gfp,
                                      int flags);
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index c0d5848c33dc..c2fe2dcc9afc 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -207,6 +207,9 @@ extern struct sctp_globals {
          * It is a list of sctp_sockaddr_entry.
          */
         struct list_head local_addr_list;
+
+        /* Lock that protects the local_addr_list writers */
+        spinlock_t addr_list_lock;
         
         /* Flag to indicate if addip is enabled. */
         int addip_enable;
@@ -242,6 +245,7 @@ extern struct sctp_globals {
 #define sctp_port_alloc_lock            (sctp_globals.port_alloc_lock)
 #define sctp_port_hashtable             (sctp_globals.port_hashtable)
 #define sctp_local_addr_list            (sctp_globals.local_addr_list)
+#define sctp_local_addr_lock            (sctp_globals.addr_list_lock)
 #define sctp_addip_enable               (sctp_globals.addip_enable)
 #define sctp_prsctp_enable              (sctp_globals.prsctp_enable)
 
@@ -737,8 +741,10 @@ const union sctp_addr *sctp_source(const struct sctp_chunk *chunk);
 /* This is a structure for holding either an IPv6 or an IPv4 address.  */
 struct sctp_sockaddr_entry {
         struct list_head list;
+        struct rcu_head rcu;
         union sctp_addr a;
         __u8 use_as_src;
+        __u8 valid;
 };
 
 typedef struct sctp_chunk *(sctp_packet_phandler_t)(struct sctp_association *);
@@ -1149,7 +1155,9 @@ int sctp_bind_addr_copy(struct sctp_bind_addr *dest,
                         int flags);
 int sctp_add_bind_addr(struct sctp_bind_addr *, union sctp_addr *,
                        __u8 use_as_src, gfp_t gfp);
-int sctp_del_bind_addr(struct sctp_bind_addr *, union sctp_addr *);
+int sctp_del_bind_addr(struct sctp_bind_addr *, union sctp_addr *,
+                        void (*rcu_call)(struct rcu_head *,
+                                          void (*func)(struct rcu_head *)));
 int sctp_bind_addr_match(struct sctp_bind_addr *, const union sctp_addr *,
                          struct sctp_sock *);
 union sctp_addr *sctp_find_unmatch_addr(struct sctp_bind_addr   *bp,
@@ -1220,9 +1228,6 @@ struct sctp_ep_common {
          * bind_addr.address_list is our set of local IP addresses.
          */
         struct sctp_bind_addr bind_addr;
-
-        /* Protection during address list comparisons. */
-        rwlock_t   addr_lock;
 };