Merge commit 'v2.6.34-rc6'

Conflicts:
	fs/nfsd/nfs4callback.c

14 files changed, 63 insertions, 29 deletions

diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
index 19a6b9629c51..d115d5cea5b6 100644
--- a/net/bridge/Kconfig
+++ b/net/bridge/Kconfig
@@ -35,6 +35,7 @@ config BRIDGE
 config BRIDGE_IGMP_SNOOPING
         bool "IGMP snooping"
         depends on BRIDGE
+        depends on INET
         default y
         ---help---
           If you say Y here, then the Ethernet bridge will be able selectively
diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
index eb7062d2e9e5..90a9024e5c1e 100644
--- a/net/bridge/br_device.c
+++ b/net/bridge/br_device.c
@@ -40,7 +40,7 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
                         goto out;
 
                 mdst = br_mdb_get(br, skb);
-                if (mdst || BR_INPUT_SKB_CB(skb)->mrouters_only)
+                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb))
                         br_multicast_deliver(mdst, skb);
                 else
                         br_flood_deliver(br, skb);
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 3b8e038ab32c..9101a4e56201 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -20,6 +20,7 @@
 #include <linux/etherdevice.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <asm/atomic.h>
 #include <asm/unaligned.h>
 #include "br_private.h"
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index d61e6f741125..7a241c396981 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -12,6 +12,7 @@
  */
 
 #include <linux/err.h>
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
@@ -19,6 +20,11 @@
 #include <linux/netfilter_bridge.h>
 #include "br_private.h"
 
+static int deliver_clone(const struct net_bridge_port *prev,
+                         struct sk_buff *skb,
+                         void (*__packet_hook)(const struct net_bridge_port *p,
+                                               struct sk_buff *skb));
+
 /* Don't forward packets to originating port or forwarding diasabled */
 static inline int should_deliver(const struct net_bridge_port *p,
                                  const struct sk_buff *skb)
@@ -94,17 +100,22 @@ void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 }
 
 /* called with rcu_read_lock */
-void br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
+void br_forward(const struct net_bridge_port *to, struct sk_buff *skb, struct sk_buff *skb0)
 {
         if (should_deliver(to, skb)) {
-                __br_forward(to, skb);
+                if (skb0)
+                        deliver_clone(to, skb, __br_forward);
+                else
+                        __br_forward(to, skb);
                 return;
         }
 
-        kfree_skb(skb);
+        if (!skb0)
+                kfree_skb(skb);
 }
 
-static int deliver_clone(struct net_bridge_port *prev, struct sk_buff *skb,
+static int deliver_clone(const struct net_bridge_port *prev,
+                         struct sk_buff *skb,
                          void (*__packet_hook)(const struct net_bridge_port *p,
                                                struct sk_buff *skb))
 {
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index b6a3872f5681..0b6b1f2ff7ac 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -19,6 +19,7 @@
 #include <linux/init.h>
 #include <linux/rtnetlink.h>
 #include <linux/if_ether.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 
 #include "br_private.h"
diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 53b39851d87d..a82dde2d2ead 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c
@@ -11,6 +11,7 @@
  *      2 of the License, or (at your option) any later version.
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
@@ -70,7 +71,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
 
         if (is_multicast_ether_addr(dest)) {
                 mdst = br_mdb_get(br, skb);
-                if (mdst || BR_INPUT_SKB_CB(skb)->mrouters_only) {
+                if (mdst || BR_INPUT_SKB_CB_MROUTERS_ONLY(skb)) {
                         if ((mdst && !hlist_unhashed(&mdst->mglist)) ||
                             br_multicast_is_router(br))
                                 skb2 = skb;
@@ -90,7 +91,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
 
         if (skb) {
                 if (dst)
-                        br_forward(dst->dst, skb);
+                        br_forward(dst->dst, skb, skb2);
                 else
                         br_flood_forward(br, skb, skb2);
         }
diff --git a/net/bridge/br_ioctl.c b/net/bridge/br_ioctl.c
index 2af6e4a90262..995afc4b04dc 100644
--- a/net/bridge/br_ioctl.c
+++ b/net/bridge/br_ioctl.c
@@ -15,6 +15,7 @@
 #include <linux/kernel.h>
 #include <linux/if_bridge.h>
 #include <linux/netdevice.h>
+#include <linux/slab.h>
 #include <linux/times.h>
 #include <net/net_namespace.h>
 #include <asm/uaccess.h>
diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index 2559fb539836..eaa0e1bae49b 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -38,7 +38,7 @@ static struct net_bridge_mdb_entry *__br_mdb_ip_get(
         struct net_bridge_mdb_entry *mp;
         struct hlist_node *p;
 
-        hlist_for_each_entry(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
+        hlist_for_each_entry_rcu(mp, p, &mdb->mhash[hash], hlist[mdb->ver]) {
                 if (dst == mp->addr)
                         return mp;
         }
@@ -49,22 +49,23 @@ static struct net_bridge_mdb_entry *__br_mdb_ip_get(
 static struct net_bridge_mdb_entry *br_mdb_ip_get(
         struct net_bridge_mdb_htable *mdb, __be32 dst)
 {
+        if (!mdb)
+                return NULL;
+
         return __br_mdb_ip_get(mdb, dst, br_ip_hash(mdb, dst));
 }
 
 struct net_bridge_mdb_entry *br_mdb_get(struct net_bridge *br,
                                         struct sk_buff *skb)
 {
-        struct net_bridge_mdb_htable *mdb = br->mdb;
-
-        if (!mdb || br->multicast_disabled)
+        if (br->multicast_disabled)
                 return NULL;
 
         switch (skb->protocol) {
         case htons(ETH_P_IP):
                 if (BR_INPUT_SKB_CB(skb)->igmp)
                         break;
-                return br_mdb_ip_get(mdb, ip_hdr(skb)->daddr);
+                return br_mdb_ip_get(br->mdb, ip_hdr(skb)->daddr);
         }
 
         return NULL;
@@ -627,8 +628,8 @@ static void br_multicast_port_query_expired(unsigned long data)
         struct net_bridge *br = port->br;
 
         spin_lock(&br->multicast_lock);
-        if (port && (port->state == BR_STATE_DISABLED ||
-                     port->state == BR_STATE_BLOCKING))
+        if (port->state == BR_STATE_DISABLED ||
+            port->state == BR_STATE_BLOCKING)
                 goto out;
 
         if (port->multicast_startup_queries_sent <
@@ -722,11 +723,11 @@ static int br_multicast_igmp3_report(struct net_bridge *br,
                 if (!pskb_may_pull(skb, len))
                         return -EINVAL;
 
-                grec = (void *)(skb->data + len);
+                grec = (void *)(skb->data + len - sizeof(*grec));
                 group = grec->grec_mca;
                 type = grec->grec_type;
 
-                len += grec->grec_nsrcs * 4;
+                len += ntohs(grec->grec_nsrcs) * 4;
                 if (!pskb_may_pull(skb, len))
                         return -EINVAL;
 
@@ -823,6 +824,7 @@ static int br_multicast_query(struct net_bridge *br,
         unsigned long max_delay;
         unsigned long now = jiffies;
         __be32 group;
+        int err = 0;
 
         spin_lock(&br->multicast_lock);
         if (!netif_running(br->dev) ||
@@ -841,15 +843,17 @@ static int br_multicast_query(struct net_bridge *br,
                         group = 0;
                 }
         } else {
-                if (!pskb_may_pull(skb, sizeof(struct igmpv3_query)))
-                        return -EINVAL;
+                if (!pskb_may_pull(skb, sizeof(struct igmpv3_query))) {
+                        err = -EINVAL;
+                        goto out;
+                }
 
                 ih3 = igmpv3_query_hdr(skb);
                 if (ih3->nsrcs)
-                        return 0;
+                        goto out;
 
-                max_delay = ih3->code ? 1 :
-                            IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE);
+                max_delay = ih3->code ?
+                            IGMPV3_MRC(ih3->code) * (HZ / IGMP_TIMER_SCALE) : 1;
         }
 
         if (!group)
@@ -876,7 +880,7 @@ static int br_multicast_query(struct net_bridge *br,
 
 out:
         spin_unlock(&br->multicast_lock);
-        return 0;
+        return err;
 }
 
 static void br_multicast_leave_group(struct net_bridge *br,
@@ -953,9 +957,6 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         unsigned offset;
         int err;
 
-        BR_INPUT_SKB_CB(skb)->igmp = 0;
-        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
-
         /* We treat OOM as packet loss for now. */
         if (!pskb_may_pull(skb, sizeof(*iph)))
                 return -EINVAL;
@@ -987,7 +988,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
 
                 err = pskb_trim_rcsum(skb2, len);
                 if (err)
-                        return err;
+                        goto err_out;
         }
 
         len -= ip_hdrlen(skb2);
@@ -1009,7 +1010,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
         case CHECKSUM_NONE:
                 skb2->csum = 0;
                 if (skb_checksum_complete(skb2))
-                        return -EINVAL;
+                        goto out;
         }
 
         err = 0;
@@ -1036,6 +1037,7 @@ static int br_multicast_ipv4_rcv(struct net_bridge *br,
 
 out:
         __skb_push(skb2, offset);
+err_out:
         if (skb2 != skb)
                 kfree_skb(skb2);
         return err;
@@ -1044,6 +1046,9 @@ out:
 int br_multicast_rcv(struct net_bridge *br, struct net_bridge_port *port,
                      struct sk_buff *skb)
 {
+        BR_INPUT_SKB_CB(skb)->igmp = 0;
+        BR_INPUT_SKB_CB(skb)->mrouters_only = 0;
+
         if (br->multicast_disabled)
                 return 0;
 
@@ -1135,7 +1140,7 @@ void br_multicast_stop(struct net_bridge *br)
 
         if (mdb->old) {
                 spin_unlock_bh(&br->multicast_lock);
-                synchronize_rcu_bh();
+                rcu_barrier_bh();
                 spin_lock_bh(&br->multicast_lock);
                 WARN_ON(mdb->old);
         }
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 268e2e725888..4c4977d12fd6 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -23,6 +23,7 @@
 
 #include <linux/module.h>
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <linux/ip.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
index fcffb3fb1177..aa56ac2c8829 100644
--- a/net/bridge/br_netlink.c
+++ b/net/bridge/br_netlink.c
@@ -11,6 +11,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/slab.h>
 #include <net/rtnetlink.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
diff --git a/net/bridge/br_private.h b/net/bridge/br_private.h
index fef0384e3c0b..846d7d1e2075 100644
--- a/net/bridge/br_private.h
+++ b/net/bridge/br_private.h
@@ -206,12 +206,20 @@ struct net_bridge
 
 struct br_input_skb_cb {
         struct net_device *brdev;
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
         int igmp;
         int mrouters_only;
+#endif
 };
 
 #define BR_INPUT_SKB_CB(__skb)  ((struct br_input_skb_cb *)(__skb)->cb)
 
+#ifdef CONFIG_BRIDGE_IGMP_SNOOPING
+# define BR_INPUT_SKB_CB_MROUTERS_ONLY(__skb)   (BR_INPUT_SKB_CB(__skb)->mrouters_only)
+#else
+# define BR_INPUT_SKB_CB_MROUTERS_ONLY(__skb)   (0)
+#endif
+
 extern struct notifier_block br_device_notifier;
 extern const u8 br_group_address[ETH_ALEN];
 
@@ -252,7 +260,7 @@ extern void br_deliver(const struct net_bridge_port *to,
                 struct sk_buff *skb);
 extern int br_dev_queue_push_xmit(struct sk_buff *skb);
 extern void br_forward(const struct net_bridge_port *to,
-                struct sk_buff *skb);
+                struct sk_buff *skb, struct sk_buff *skb0);
 extern int br_forward_finish(struct sk_buff *skb);
 extern void br_flood_deliver(struct net_bridge *br, struct sk_buff *skb);
 extern void br_flood_forward(struct net_bridge *br, struct sk_buff *skb,
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 81ae40b3f655..d66cce11f3bf 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -15,6 +15,7 @@
 #include <linux/netfilter_bridge.h>
 #include <linux/etherdevice.h>
 #include <linux/llc.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/llc.h>
 #include <net/llc_pdu.h>
diff --git a/net/bridge/netfilter/ebt_ulog.c b/net/bridge/netfilter/ebt_ulog.c
index c6ac657074a6..f9560f3dbdc7 100644
--- a/net/bridge/netfilter/ebt_ulog.c
+++ b/net/bridge/netfilter/ebt_ulog.c
@@ -29,6 +29,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/spinlock.h>
 #include <linux/socket.h>
 #include <linux/skbuff.h>
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index dfb58056a89a..f0865fd1e3ec 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -23,6 +23,7 @@
 #include <linux/netfilter_bridge/ebtables.h>
 #include <linux/spinlock.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/smp.h>
 #include <linux/cpumask.h>