Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  netns: fix ip_rt_frag_needed rt_is_expired
  netfilter: nf_conntrack_extend: avoid unnecessary "ct->ext" dereferences
  netfilter: fix double-free and use-after free
  netfilter: arptables in netns for real
  netfilter: ip{,6}tables_security: fix future section mismatch
  selinux: use nf_register_hooks()
  netfilter: ebtables: use nf_register_hooks()
  Revert "pkt_sched: sch_sfq: dump a real number of flows"
  qeth: use dev->ml_priv instead of dev->priv
  syncookies: Make sure ECN is disabled
  net: drop unused BUG_TRAP()
  net: convert BUG_TRAP to generic WARN_ON
  drivers/net: convert BUG_TRAP to generic WARN_ON

16 files changed, 80 insertions, 58 deletions

diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f440a9f54924..d9f15ddac316 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -148,10 +148,10 @@ void inet_sock_destruct(struct sock *sk)
                 return;
         }
 
-        BUG_TRAP(!atomic_read(&sk->sk_rmem_alloc));
-        BUG_TRAP(!atomic_read(&sk->sk_wmem_alloc));
-        BUG_TRAP(!sk->sk_wmem_queued);
-        BUG_TRAP(!sk->sk_forward_alloc);
+        WARN_ON(atomic_read(&sk->sk_rmem_alloc));
+        WARN_ON(atomic_read(&sk->sk_wmem_alloc));
+        WARN_ON(sk->sk_wmem_queued);
+        WARN_ON(sk->sk_forward_alloc);
 
         kfree(inet->opt);
         dst_release(sk->sk_dst_cache);
@@ -338,7 +338,7 @@ lookup_protocol:
         answer_flags = answer->flags;
         rcu_read_unlock();
 
-        BUG_TRAP(answer_prot->slab != NULL);
+        WARN_ON(answer_prot->slab == NULL);
 
         err = -ENOBUFS;
         sk = sk_alloc(net, PF_INET, GFP_KERNEL, answer_prot);
@@ -658,8 +658,8 @@ int inet_accept(struct socket *sock, struct socket *newsock, int flags)
 
         lock_sock(sk2);
 
-        BUG_TRAP((1 << sk2->sk_state) &
-                 (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE));
+        WARN_ON(!((1 << sk2->sk_state) &
+                  (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT | TCPF_CLOSE)));
 
         sock_graft(sk2, newsock);
 
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 2e667e2f90df..91d3d96805d0 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -138,8 +138,8 @@ void in_dev_finish_destroy(struct in_device *idev)
 {
         struct net_device *dev = idev->dev;
 
-        BUG_TRAP(!idev->ifa_list);
-        BUG_TRAP(!idev->mc_list);
+        WARN_ON(idev->ifa_list);
+        WARN_ON(idev->mc_list);
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "in_dev_finish_destroy: %p=%s\n",
                idev, dev ? dev->name : "NIL");
@@ -399,7 +399,7 @@ static int inet_set_ifa(struct net_device *dev, struct in_ifaddr *ifa)
         }
         ipv4_devconf_setall(in_dev);
         if (ifa->ifa_dev != in_dev) {
-                BUG_TRAP(!ifa->ifa_dev);
+                WARN_ON(ifa->ifa_dev);
                 in_dev_hold(in_dev);
                 ifa->ifa_dev = in_dev;
         }
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index bb81c958b744..0c1ae68ee84b 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -167,7 +167,7 @@ tb_not_found:
 success:
         if (!inet_csk(sk)->icsk_bind_hash)
                 inet_bind_hash(sk, tb, snum);
-        BUG_TRAP(inet_csk(sk)->icsk_bind_hash == tb);
+        WARN_ON(inet_csk(sk)->icsk_bind_hash != tb);
         ret = 0;
 
 fail_unlock:
@@ -260,7 +260,7 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
         }
 
         newsk = reqsk_queue_get_child(&icsk->icsk_accept_queue, sk);
-        BUG_TRAP(newsk->sk_state != TCP_SYN_RECV);
+        WARN_ON(newsk->sk_state == TCP_SYN_RECV);
 out:
         release_sock(sk);
         return newsk;
@@ -386,7 +386,7 @@ struct request_sock *inet_csk_search_req(const struct sock *sk,
                     ireq->rmt_addr == raddr &&
                     ireq->loc_addr == laddr &&
                     AF_INET_FAMILY(req->rsk_ops->family)) {
-                        BUG_TRAP(!req->sk);
+                        WARN_ON(req->sk);
                         *prevp = prev;
                         break;
                 }
@@ -539,14 +539,14 @@ EXPORT_SYMBOL_GPL(inet_csk_clone);
  */
 void inet_csk_destroy_sock(struct sock *sk)
 {
-        BUG_TRAP(sk->sk_state == TCP_CLOSE);
-        BUG_TRAP(sock_flag(sk, SOCK_DEAD));
+        WARN_ON(sk->sk_state != TCP_CLOSE);
+        WARN_ON(!sock_flag(sk, SOCK_DEAD));
 
         /* It cannot be in hash table! */
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         /* If it has not 0 inet_sk(sk)->num, it must be bound */
-        BUG_TRAP(!inet_sk(sk)->num || inet_csk(sk)->icsk_bind_hash);
+        WARN_ON(inet_sk(sk)->num && !inet_csk(sk)->icsk_bind_hash);
 
         sk->sk_prot->destroy(sk);
 
@@ -629,7 +629,7 @@ void inet_csk_listen_stop(struct sock *sk)
 
                 local_bh_disable();
                 bh_lock_sock(child);
-                BUG_TRAP(!sock_owned_by_user(child));
+                WARN_ON(sock_owned_by_user(child));
                 sock_hold(child);
 
                 sk->sk_prot->disconnect(child, O_NONBLOCK);
@@ -647,7 +647,7 @@ void inet_csk_listen_stop(struct sock *sk)
                 sk_acceptq_removed(sk);
                 __reqsk_free(req);
         }
-        BUG_TRAP(!sk->sk_ack_backlog);
+        WARN_ON(sk->sk_ack_backlog);
 }
 
 EXPORT_SYMBOL_GPL(inet_csk_listen_stop);
diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index 0546a0bc97ea..6c52e08f786e 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c
@@ -134,8 +134,8 @@ void inet_frag_destroy(struct inet_frag_queue *q, struct inet_frags *f,
         struct sk_buff *fp;
         struct netns_frags *nf;
 
-        BUG_TRAP(q->last_in & INET_FRAG_COMPLETE);
-        BUG_TRAP(del_timer(&q->timer) == 0);
+        WARN_ON(!(q->last_in & INET_FRAG_COMPLETE));
+        WARN_ON(del_timer(&q->timer) != 0);
 
         /* Release all fragment data. */
         fp = q->fragments;
diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c
index 115f53722d20..44981906fb91 100644
--- a/net/ipv4/inet_hashtables.c
+++ b/net/ipv4/inet_hashtables.c
@@ -305,7 +305,7 @@ unique:
         inet->num = lport;
         inet->sport = htons(lport);
         sk->sk_hash = hash;
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
         write_unlock(lock);
@@ -342,7 +342,7 @@ void __inet_hash_nolisten(struct sock *sk)
         rwlock_t *lock;
         struct inet_ehash_bucket *head;
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         sk->sk_hash = inet_sk_ehashfn(sk);
         head = inet_ehash_bucket(hashinfo, sk->sk_hash);
@@ -367,7 +367,7 @@ static void __inet_hash(struct sock *sk)
                 return;
         }
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
         lock = &hashinfo->lhash_lock;
 
@@ -450,7 +450,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
                          */
                         inet_bind_bucket_for_each(tb, node, &head->chain) {
                                 if (tb->ib_net == net && tb->port == port) {
-                                        BUG_TRAP(!hlist_empty(&tb->owners));
+                                        WARN_ON(hlist_empty(&tb->owners));
                                         if (tb->fastreuse >= 0)
                                                 goto next_port;
                                         if (!check_established(death_row, sk,
diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c
index 75c2def8f9a0..d985bd613d25 100644
--- a/net/ipv4/inet_timewait_sock.c
+++ b/net/ipv4/inet_timewait_sock.c
@@ -86,7 +86,7 @@ void __inet_twsk_hashdance(struct inet_timewait_sock *tw, struct sock *sk,
                         hashinfo->bhash_size)];
         spin_lock(&bhead->lock);
         tw->tw_tb = icsk->icsk_bind_hash;
-        BUG_TRAP(icsk->icsk_bind_hash);
+        WARN_ON(!icsk->icsk_bind_hash);
         inet_twsk_add_bind_node(tw, &tw->tw_tb->owners);
         spin_unlock(&bhead->lock);
 
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 38d38f058018..2152d222b954 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -488,8 +488,8 @@ static int ip_frag_reasm(struct ipq *qp, struct sk_buff *prev,
                 qp->q.fragments = head;
         }
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(FRAG_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(FRAG_CB(head)->offset != 0);
 
         /* Allocate a new buffer for the datagram. */
         ihlen = ip_hdrlen(head);
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 465544f6281a..d533a89e08de 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -118,7 +118,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         __skb_pull(newskb, skb_network_offset(newskb));
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
-        BUG_TRAP(newskb->dst);
+        WARN_ON(!newskb->dst);
         netif_rx(newskb);
         return 0;
 }
diff --git a/net/ipv4/netfilter/arptable_filter.c b/net/ipv4/netfilter/arptable_filter.c
index 3be4d07e7ed9..082f5dd3156c 100644
--- a/net/ipv4/netfilter/arptable_filter.c
+++ b/net/ipv4/netfilter/arptable_filter.c
@@ -55,32 +55,53 @@ static struct xt_table packet_filter = {
 };
 
 /* The work comes in here from netfilter.c */
-static unsigned int arpt_hook(unsigned int hook,
-                              struct sk_buff *skb,
-                              const struct net_device *in,
-                              const struct net_device *out,
-                              int (*okfn)(struct sk_buff *))
+static unsigned int arpt_in_hook(unsigned int hook,
+                                 struct sk_buff *skb,
+                                 const struct net_device *in,
+                                 const struct net_device *out,
+                                 int (*okfn)(struct sk_buff *))
 {
-        return arpt_do_table(skb, hook, in, out, init_net.ipv4.arptable_filter);
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv4.arptable_filter);
+}
+
+static unsigned int arpt_out_hook(unsigned int hook,
+                                  struct sk_buff *skb,
+                                  const struct net_device *in,
+                                  const struct net_device *out,
+                                  int (*okfn)(struct sk_buff *))
+{
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(out)->ipv4.arptable_filter);
+}
+
+static unsigned int arpt_forward_hook(unsigned int hook,
+                                      struct sk_buff *skb,
+                                      const struct net_device *in,
+                                      const struct net_device *out,
+                                      int (*okfn)(struct sk_buff *))
+{
+        return arpt_do_table(skb, hook, in, out,
+                             dev_net(in)->ipv4.arptable_filter);
 }
 
 static struct nf_hook_ops arpt_ops[] __read_mostly = {
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_in_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_IN,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_out_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_OUT,
                 .priority       = NF_IP_PRI_FILTER,
         },
         {
-                .hook           = arpt_hook,
+                .hook           = arpt_forward_hook,
                 .owner          = THIS_MODULE,
                 .pf             = NF_ARP,
                 .hooknum        = NF_ARP_FORWARD,
diff --git a/net/ipv4/netfilter/iptable_security.c b/net/ipv4/netfilter/iptable_security.c
index 2b472ac2263a..db6d312128e1 100644
--- a/net/ipv4/netfilter/iptable_security.c
+++ b/net/ipv4/netfilter/iptable_security.c
@@ -32,7 +32,7 @@ static struct
         struct ipt_replace repl;
         struct ipt_standard entries[3];
         struct ipt_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "security",
                 .valid_hooks = SECURITY_VALID_HOOKS,
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index e4ab0ac94f92..a507c5e27d0e 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1502,7 +1502,7 @@ unsigned short ip_rt_frag_needed(struct net *net, struct iphdr *iph,
                                     rth->fl.iif != 0 ||
                                     dst_metric_locked(&rth->u.dst, RTAX_MTU) ||
                                     !net_eq(dev_net(rth->u.dst.dev), net) ||
-                                    !rt_is_expired(rth))
+                                    rt_is_expired(rth))
                                         continue;
 
                                 if (new_mtu < 68 || new_mtu >= old_mtu) {
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 51bc24d3b8a7..9d38005abbac 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -299,6 +299,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->rmt_port          = th->source;
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
+        ireq->ecn_ok            = 0;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0b491bf03db4..1ab341e5d3e0 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1096,7 +1096,7 @@ void tcp_cleanup_rbuf(struct sock *sk, int copied)
 #if TCP_DEBUG
         struct sk_buff *skb = skb_peek(&sk->sk_receive_queue);
 
-        BUG_TRAP(!skb || before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
+        WARN_ON(skb && !before(tp->copied_seq, TCP_SKB_CB(skb)->end_seq));
 #endif
 
         if (inet_csk_ack_scheduled(sk)) {
@@ -1358,7 +1358,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
                                 goto found_ok_skb;
                         if (tcp_hdr(skb)->fin)
                                 goto found_fin_ok;
-                        BUG_TRAP(flags & MSG_PEEK);
+                        WARN_ON(!(flags & MSG_PEEK));
                         skb = skb->next;
                 } while (skb != (struct sk_buff *)&sk->sk_receive_queue);
 
@@ -1421,8 +1421,8 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
 
                         tp->ucopy.len = len;
 
-                        BUG_TRAP(tp->copied_seq == tp->rcv_nxt ||
-                                 (flags & (MSG_PEEK | MSG_TRUNC)));
+                        WARN_ON(tp->copied_seq != tp->rcv_nxt &&
+                                !(flags & (MSG_PEEK | MSG_TRUNC)));
 
                         /* Ugly... If prequeue is not empty, we have to
                          * process it before releasing socket, otherwise
@@ -1844,7 +1844,7 @@ adjudge_to_death:
          */
         local_bh_disable();
         bh_lock_sock(sk);
-        BUG_TRAP(!sock_owned_by_user(sk));
+        WARN_ON(sock_owned_by_user(sk));
 
         /* Have we already been destroyed by a softirq or backlog? */
         if (state != TCP_CLOSE && sk->sk_state == TCP_CLOSE)
@@ -1973,7 +1973,7 @@ int tcp_disconnect(struct sock *sk, int flags)
         memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
         __sk_dst_reset(sk);
 
-        BUG_TRAP(!inet->num || icsk->icsk_bind_hash);
+        WARN_ON(inet->num && !icsk->icsk_bind_hash);
 
         sk->sk_error_report(sk);
         return err;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 75efd244f2af..67ccce2a96bd 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -1629,10 +1629,10 @@ advance_sp:
 out:
 
 #if FASTRETRANS_DEBUG > 0
-        BUG_TRAP((int)tp->sacked_out >= 0);
-        BUG_TRAP((int)tp->lost_out >= 0);
-        BUG_TRAP((int)tp->retrans_out >= 0);
-        BUG_TRAP((int)tcp_packets_in_flight(tp) >= 0);
+        WARN_ON((int)tp->sacked_out < 0);
+        WARN_ON((int)tp->lost_out < 0);
+        WARN_ON((int)tp->retrans_out < 0);
+        WARN_ON((int)tcp_packets_in_flight(tp) < 0);
 #endif
         return flag;
 }
@@ -2181,7 +2181,7 @@ static void tcp_mark_head_lost(struct sock *sk, int packets)
         int err;
         unsigned int mss;
 
-        BUG_TRAP(packets <= tp->packets_out);
+        WARN_ON(packets > tp->packets_out);
         if (tp->lost_skb_hint) {
                 skb = tp->lost_skb_hint;
                 cnt = tp->lost_cnt_hint;
@@ -2610,7 +2610,7 @@ static void tcp_fastretrans_alert(struct sock *sk, int pkts_acked, int flag)
         /* E. Check state exit conditions. State can be terminated
          *    when high_seq is ACKed. */
         if (icsk->icsk_ca_state == TCP_CA_Open) {
-                BUG_TRAP(tp->retrans_out == 0);
+                WARN_ON(tp->retrans_out != 0);
                 tp->retrans_stamp = 0;
         } else if (!before(tp->snd_una, tp->high_seq)) {
                 switch (icsk->icsk_ca_state) {
@@ -2972,9 +2972,9 @@ static int tcp_clean_rtx_queue(struct sock *sk, int prior_fackets)
         }
 
 #if FASTRETRANS_DEBUG > 0
-        BUG_TRAP((int)tp->sacked_out >= 0);
-        BUG_TRAP((int)tp->lost_out >= 0);
-        BUG_TRAP((int)tp->retrans_out >= 0);
+        WARN_ON((int)tp->sacked_out < 0);
+        WARN_ON((int)tp->lost_out < 0);
+        WARN_ON((int)tp->retrans_out < 0);
         if (!tp->packets_out && tcp_is_sack(tp)) {
                 icsk = inet_csk(sk);
                 if (tp->lost_out) {
@@ -3877,7 +3877,7 @@ static void tcp_sack_remove(struct tcp_sock *tp)
                         int i;
 
                         /* RCV.NXT must cover all the block! */
-                        BUG_TRAP(!before(tp->rcv_nxt, sp->end_seq));
+                        WARN_ON(before(tp->rcv_nxt, sp->end_seq));
 
                         /* Zap this SACK, by moving forward any other SACKS. */
                         for (i=this_sack+1; i < num_sacks; i++)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index a82df6307567..a2b06d0cc26b 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -418,7 +418,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
                 /* ICMPs are not backlogged, hence we cannot get
                    an established socket here.
                  */
-                BUG_TRAP(!req->sk);
+                WARN_ON(req->sk);
 
                 if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 328e0cf42b3c..5ab6ba19c3ce 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -287,7 +287,7 @@ static void tcp_retransmit_timer(struct sock *sk)
         if (!tp->packets_out)
                 goto out;
 
-        BUG_TRAP(!tcp_write_queue_empty(sk));
+        WARN_ON(tcp_write_queue_empty(sk));
 
         if (!tp->snd_wnd && !sock_flag(sk, SOCK_DEAD) &&
             !((1 << sk->sk_state) & (TCPF_SYN_SENT | TCPF_SYN_RECV))) {