Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6

Conflicts:

	include/asm-powerpc/unistd.h
	include/asm-sparc/unistd.h
	include/asm-sparc64/unistd.h

Signed-off-by: David Woodhouse <dwmw2@infradead.org>

11 files changed, 43 insertions, 37 deletions

diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 18d7fad474d7..c9026dbf4c93 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -337,7 +337,7 @@ static inline int ip_rcv_finish(struct sk_buff *skb)
          *      Initialise the virtual path cache for the packet. It describes
          *      how the packet travels inside Linux networking.
          */ 
-        if (likely(skb->dst == NULL)) {
+        if (skb->dst == NULL) {
                 int err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos,
                                          skb->dev);
                 if (unlikely(err)) {
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 9bebad07bf2e..cbcae6544622 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -209,7 +209,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
 
 void ip_options_fragment(struct sk_buff * skb) 
 {
-        unsigned char * optptr = skb->nh.raw;
+        unsigned char * optptr = skb->nh.raw + sizeof(struct iphdr);
         struct ip_options * opt = &(IPCB(skb)->opt);
         int  l = opt->optlen;
         int  optlen;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index cd810f41af1a..95278b22b669 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -210,7 +210,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
             skb->h.icmph->code != ICMP_FRAG_NEEDED)
                 return;
 
-        spi = ntohl(ntohs(ipch->cpi));
+        spi = htonl(ntohs(ipch->cpi));
         x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr,
                               spi, IPPROTO_COMP, AF_INET);
         if (!x)
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index c2d92f99a2b8..d0d19192026d 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -948,7 +948,7 @@ static int do_add_counters(void __user *user, unsigned int len)
 
         write_lock_bh(&t->lock);
         private = t->private;
-        if (private->number != paddc->num_counters) {
+        if (private->number != tmp.num_counters) {
                 ret = -EINVAL;
                 goto unlock_up_free;
         }
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
index 355a53a5b6cd..26dfecadb335 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
@@ -528,14 +528,15 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
 
                         /* Decode */
                         if ((err = (Decoders[son->type]) (bs, son, base,
-                                                          level + 1)) >
-                            H323_ERROR_STOP)
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
                                 return err;
 
                         bs->cur = beg + len;
                         bs->bit = 0;
                 } else if ((err = (Decoders[son->type]) (bs, son, base,
-                                                         level + 1)))
+                                                         level + 1)) <
+                           H323_ERROR_NONE)
                         return err;
         }
 
@@ -554,7 +555,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
 
         /* Decode the extension components */
         for (opt = 0; opt < bmp2_len; opt++, i++, son++) {
-                if (son->attr & STOP) {
+                if (i < f->ub && son->attr & STOP) {
                         PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ",
                               son->name);
                         return H323_ERROR_STOP;
@@ -584,8 +585,8 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
                 beg = bs->cur;
 
                 if ((err = (Decoders[son->type]) (bs, son, base,
-                                                  level + 1)) >
-                    H323_ERROR_STOP)
+                                                  level + 1)) <
+                    H323_ERROR_NONE)
                         return err;
 
                 bs->cur = beg + len;
@@ -660,18 +661,20 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
                                                           i <
                                                           effective_count ?
                                                           base : NULL,
-                                                          level + 1)) >
-                            H323_ERROR_STOP)
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
                                 return err;
 
                         bs->cur = beg + len;
                         bs->bit = 0;
                 } else
-                    if ((err = (Decoders[son->type]) (bs, son,
-                                                      i < effective_count ?
-                                                      base : NULL,
-                                                      level + 1)))
-                        return err;
+                        if ((err = (Decoders[son->type]) (bs, son,
+                                                          i <
+                                                          effective_count ?
+                                                          base : NULL,
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
+                                return err;
 
                 if (base)
                         base += son->offset;
@@ -735,13 +738,14 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
                 }
                 beg = bs->cur;
 
-                if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) >
-                    H323_ERROR_STOP)
+                if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+                    H323_ERROR_NONE)
                         return err;
 
                 bs->cur = beg + len;
                 bs->bit = 0;
-        } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)))
+        } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+                   H323_ERROR_NONE)
                 return err;
 
         return H323_ERROR_NONE;
diff --git a/net/ipv4/netfilter/ip_nat_proto_gre.c b/net/ipv4/netfilter/ip_nat_proto_gre.c
index 6c4899d8046a..96ceabaec402 100644
--- a/net/ipv4/netfilter/ip_nat_proto_gre.c
+++ b/net/ipv4/netfilter/ip_nat_proto_gre.c
@@ -49,15 +49,15 @@ gre_in_range(const struct ip_conntrack_tuple *tuple,
              const union ip_conntrack_manip_proto *min,
              const union ip_conntrack_manip_proto *max)
 {
-        u_int32_t key;
+        __be16 key;
 
         if (maniptype == IP_NAT_MANIP_SRC)
                 key = tuple->src.u.gre.key;
         else
                 key = tuple->dst.u.gre.key;
 
-        return ntohl(key) >= ntohl(min->gre.key)
-                && ntohl(key) <= ntohl(max->gre.key);
+        return ntohs(key) >= ntohs(min->gre.key)
+                && ntohs(key) <= ntohs(max->gre.key);
 }
 
 /* generate unique tuple ... */
@@ -81,14 +81,14 @@ gre_unique_tuple(struct ip_conntrack_tuple *tuple,
                 min = 1;
                 range_size = 0xffff;
         } else {
-                min = ntohl(range->min.gre.key);
-                range_size = ntohl(range->max.gre.key) - min + 1;
+                min = ntohs(range->min.gre.key);
+                range_size = ntohs(range->max.gre.key) - min + 1;
         }
 
         DEBUGP("min = %u, range_size = %u\n", min, range_size); 
 
         for (i = 0; i < range_size; i++, key++) {
-                *keyptr = htonl(min + key % range_size);
+                *keyptr = htons(min + key % range_size);
                 if (!ip_nat_used_tuple(tuple, conntrack))
                         return 1;
         }
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index c62253845538..c33244263b90 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -768,6 +768,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                         len *= sizeof(unsigned long);
                         *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
                         if (*obj == NULL) {
+                                kfree(lp);
                                 kfree(id);
                                 if (net_ratelimit())
                                         printk("OOM in bsalg (%d)\n", __LINE__);
@@ -1003,12 +1004,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
                 
         return 1;
 
+err_addr_free:
+        kfree((unsigned long *)trap->ip_address);
+
 err_id_free:
         kfree(trap->id);
 
-err_addr_free:
-        kfree((unsigned long *)trap->ip_address);
-        
         return 0;
 }
 
@@ -1126,11 +1127,10 @@ static int snmp_parse_mangle(unsigned char *msg,
                 struct snmp_v1_trap trap;
                 unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
                 
-                /* Discard trap allocations regardless */
-                kfree(trap.id);
-                kfree((unsigned long *)trap.ip_address);
-                
-                if (!ret)
+                if (ret) {
+                        kfree(trap.id);
+                        kfree((unsigned long *)trap.ip_address);
+                } else 
                         return ret;
                 
         } else {
diff --git a/net/ipv4/netfilter/ipt_LOG.c b/net/ipv4/netfilter/ipt_LOG.c
index 39fd4c2a2386..b98f7b08b084 100644
--- a/net/ipv4/netfilter/ipt_LOG.c
+++ b/net/ipv4/netfilter/ipt_LOG.c
@@ -428,7 +428,7 @@ ipt_log_target(struct sk_buff **pskb,
 
         if (loginfo->logflags & IPT_LOG_NFLOG)
                 nf_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
-                              loginfo->prefix);
+                              "%s", loginfo->prefix);
         else
                 ipt_log_packet(PF_INET, hooknum, *pskb, in, out, &li,
                                loginfo->prefix);
diff --git a/net/ipv4/netfilter/ipt_recent.c b/net/ipv4/netfilter/ipt_recent.c
index 143843285702..b847ee409efb 100644
--- a/net/ipv4/netfilter/ipt_recent.c
+++ b/net/ipv4/netfilter/ipt_recent.c
@@ -821,6 +821,7 @@ checkentry(const char *tablename,
         /* Create our proc 'status' entry. */
         curr_table->status_proc = create_proc_entry(curr_table->name, ip_list_perms, proc_net_ipt_recent);
         if (!curr_table->status_proc) {
+                vfree(hold);
                 printk(KERN_INFO RECENT_NAME ": checkentry: unable to allocate for /proc entry.\n");
                 /* Destroy the created table */
                 spin_lock_bh(&recent_lock);
@@ -845,7 +846,6 @@ checkentry(const char *tablename,
                 spin_unlock_bh(&recent_lock);
                 vfree(curr_table->time_info);
                 vfree(curr_table->hash_table);
-                vfree(hold);
                 vfree(curr_table->table);
                 vfree(curr_table);
                 return 0;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 9f0cca4c4fae..4a538bc1683d 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1662,6 +1662,8 @@ static void tcp_update_scoreboard(struct sock *sk, struct tcp_sock *tp)
                         if (!(TCP_SKB_CB(skb)->sacked&TCPCB_TAGBITS)) {
                                 TCP_SKB_CB(skb)->sacked |= TCPCB_LOST;
                                 tp->lost_out += tcp_skb_pcount(skb);
+                                if (IsReno(tp))
+                                        tcp_remove_reno_sacks(sk, tp, tcp_skb_pcount(skb) + 1);
 
                                 /* clear xmit_retrans hint */
                                 if (tp->retransmit_skb_hint &&
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index f285bbf296e2..8604c747bca5 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -221,7 +221,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                 u16 *ipcomp_hdr = (u16 *)xprth;
 
-                                fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1]));
+                                fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
                         }
                         break;
                 default: