Auto merge with /home/aegl/GIT/linus

8 files changed, 77 insertions, 48 deletions

diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 0671569ee6f0..b56e88edf1b3 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -43,7 +43,7 @@
  *              2 of the License, or (at your option) any later version.
  */
 
-#define VERSION "0.323"
+#define VERSION "0.324"
 
 #include <linux/config.h>
 #include <asm/uaccess.h>
@@ -341,8 +341,10 @@ static struct leaf *leaf_new(void)
 static struct leaf_info *leaf_info_new(int plen)
 {
         struct leaf_info *li = kmalloc(sizeof(struct leaf_info),  GFP_KERNEL);
-        li->plen = plen;
-        INIT_LIST_HEAD(&li->falh);
+        if(li) {
+                li->plen = plen;
+                INIT_LIST_HEAD(&li->falh);
+        }
         return li;
 }
 
@@ -879,8 +881,8 @@ static struct node *trie_rebalance(struct trie *t, struct tnode *tn)
         return (struct node*) tn;
 }
 
-static struct list_head *
-fib_insert_node(struct trie *t, u32 key, int plen)
+static  struct list_head *
+fib_insert_node(struct trie *t, int *err, u32 key, int plen)
 {
         int pos, newpos;
         struct tnode *tp = NULL, *tn = NULL;
@@ -940,7 +942,6 @@ fib_insert_node(struct trie *t, u32 key, int plen)
         if(tp && IS_LEAF(tp))
                 BUG();
 
-        t->revision++;
 
         /* Case 1: n is a leaf. Compare prefixes */
 
@@ -949,8 +950,10 @@ fib_insert_node(struct trie *t, u32 key, int plen)
                 
                 li = leaf_info_new(plen);
                 
-                if(! li) 
-                        BUG();
+                if(! li) {
+                        *err = -ENOMEM;
+                        goto err;
+                }
 
                 fa_head = &li->falh;
                 insert_leaf_info(&l->list, li);
@@ -959,14 +962,19 @@ fib_insert_node(struct trie *t, u32 key, int plen)
         t->size++;
         l = leaf_new();
 
-        if(! l) 
-                BUG();
+        if(! l) {
+                *err = -ENOMEM;
+                goto err;
+        }
 
         l->key = key;
         li = leaf_info_new(plen);
 
-        if(! li) 
-                BUG();
+        if(! li) {
+                tnode_free((struct tnode *) l);
+                *err = -ENOMEM;
+                goto err;
+        }
 
         fa_head = &li->falh;
         insert_leaf_info(&l->list, li);
@@ -1003,9 +1011,14 @@ fib_insert_node(struct trie *t, u32 key, int plen)
                         newpos = 0;
                         tn = tnode_new(key, newpos, 1); /* First tnode */ 
                 }
-                if(!tn) 
-                        trie_bug("tnode_pfx_new failed");
 
+                if(!tn) {
+                        free_leaf_info(li);
+                        tnode_free((struct tnode *) l);
+                        *err = -ENOMEM;
+                        goto err;
+                }                       
+                        
                 NODE_SET_PARENT(tn, tp);
 
                 missbit=tkey_extract_bits(key, newpos, 1);
@@ -1027,7 +1040,9 @@ fib_insert_node(struct trie *t, u32 key, int plen)
         }
         /* Rebalance the trie */
         t->trie = trie_rebalance(t, tp);
-done:;
+done:
+        t->revision++;
+err:;
         return fa_head;
 }
 
@@ -1156,8 +1171,12 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
          * Insert new entry to the list.
          */
 
-        if(!fa_head)
-                fa_head = fib_insert_node(t, key, plen);
+        if(!fa_head) {
+                fa_head = fib_insert_node(t, &err, key, plen);
+                err = 0;
+                if(err) 
+                        goto out_free_new_fa;
+        }
 
         write_lock_bh(&fib_lock);
 
@@ -1170,6 +1189,9 @@ fn_trie_insert(struct fib_table *tb, struct rtmsg *r, struct kern_rta *rta,
         rtmsg_fib(RTM_NEWROUTE, htonl(key), new_fa, plen, tb->tb_id, nlhdr, req);
 succeeded:
         return 0;
+
+out_free_new_fa:
+        kmem_cache_free(fn_alias_kmem, new_fa);
 out:
         fib_release_info(fi);
 err:;   
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index af2ec88bbb2f..c703528e0bcd 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -283,14 +283,18 @@ static inline int ip_rcv_finish(struct sk_buff *skb)
 {
         struct net_device *dev = skb->dev;
         struct iphdr *iph = skb->nh.iph;
+        int err;
 
         /*
          *      Initialise the virtual path cache for the packet. It describes
          *      how the packet travels inside Linux networking.
          */ 
         if (skb->dst == NULL) {
-                if (ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))
+                if ((err = ip_route_input(skb, iph->daddr, iph->saddr, iph->tos, dev))) {
+                        if (err == -EHOSTUNREACH)
+                                IP_INC_STATS_BH(IPSTATS_MIB_INADDRERRORS);
                         goto drop; 
+                }
         }
 
 #ifdef CONFIG_NET_CLS_ROUTE
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index ee07aec215a0..6ce5c3292f9f 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -188,7 +188,13 @@ static inline int ip_finish_output2(struct sk_buff *skb)
                 skb = skb2;
         }
 
-        nf_reset(skb);
+#ifdef CONFIG_BRIDGE_NETFILTER
+        /* bridge-netfilter defers calling some IP hooks to the bridge layer
+         * and still needs the conntrack reference.
+         */
+        if (skb->nf_bridge == NULL)
+#endif
+                nf_reset(skb);
 
         if (hh) {
                 int hh_alen;
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index f2509034ce72..d2bf8e1930a3 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1149,8 +1149,10 @@ static int __init ic_dynamic(void)
                 ic_rarp_cleanup();
 #endif
 
-        if (!ic_got_reply)
+        if (!ic_got_reply) {
+                ic_myaddr = INADDR_NONE;
                 return -1;
+        }
 
         printk("IP-Config: Got %s answer from %u.%u.%u.%u, ",
                 ((ic_got_reply & IC_RARP) ? "RARP" 
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index e4f809a93f47..7833d920bdba 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -297,6 +297,7 @@ static int vif_delete(int vifi)
 static void ipmr_destroy_unres(struct mfc_cache *c)
 {
         struct sk_buff *skb;
+        struct nlmsgerr *e;
 
         atomic_dec(&cache_resolve_queue_len);
 
@@ -306,7 +307,9 @@ static void ipmr_destroy_unres(struct mfc_cache *c)
                         nlh->nlmsg_type = NLMSG_ERROR;
                         nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
                         skb_trim(skb, nlh->nlmsg_len);
-                        ((struct nlmsgerr*)NLMSG_DATA(nlh))->error = -ETIMEDOUT;
+                        e = NLMSG_DATA(nlh);
+                        e->error = -ETIMEDOUT;
+                        memset(&e->msg, 0, sizeof(e->msg));
                         netlink_unicast(rtnl, skb, NETLINK_CB(skb).dst_pid, MSG_DONTWAIT);
                 } else
                         kfree_skb(skb);
@@ -499,6 +502,7 @@ static struct mfc_cache *ipmr_cache_alloc_unres(void)
 static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
 {
         struct sk_buff *skb;
+        struct nlmsgerr *e;
 
         /*
          *      Play the pending entries through our router
@@ -515,7 +519,9 @@ static void ipmr_cache_resolve(struct mfc_cache *uc, struct mfc_cache *c)
                                 nlh->nlmsg_type = NLMSG_ERROR;
                                 nlh->nlmsg_len = NLMSG_LENGTH(sizeof(struct nlmsgerr));
                                 skb_trim(skb, nlh->nlmsg_len);
-                                ((struct nlmsgerr*)NLMSG_DATA(nlh))->error = -EMSGSIZE;
+                                e = NLMSG_DATA(nlh);
+                                e->error = -EMSGSIZE;
+                                memset(&e->msg, 0, sizeof(e->msg));
                         }
                         err = netlink_unicast(rtnl, skb, NETLINK_CB(skb).dst_pid, MSG_DONTWAIT);
                 } else
diff --git a/net/ipv4/ipvs/ip_vs_conn.c b/net/ipv4/ipvs/ip_vs_conn.c
index fd6feb5499fe..9f16ab309106 100644
--- a/net/ipv4/ipvs/ip_vs_conn.c
+++ b/net/ipv4/ipvs/ip_vs_conn.c
@@ -548,7 +548,6 @@ void ip_vs_conn_expire_now(struct ip_vs_conn *cp)
 {
         if (del_timer(&cp->timer))
                 mod_timer(&cp->timer, jiffies);
-        __ip_vs_conn_put(cp);
 }
 
 
@@ -764,7 +763,6 @@ void ip_vs_random_dropentry(void)
 {
         int idx;
         struct ip_vs_conn *cp;
-        struct ip_vs_conn *ct;
 
         /*
          * Randomly scan 1/32 of the whole table every second
@@ -801,21 +799,12 @@ void ip_vs_random_dropentry(void)
                                         continue;
                         }
 
-                        /*
-                         * Drop the entry, and drop its ct if not referenced
-                         */
-                        atomic_inc(&cp->refcnt);
-                        ct_write_unlock(hash);
-
-                        if ((ct = cp->control))
-                                atomic_inc(&ct->refcnt);
                         IP_VS_DBG(4, "del connection\n");
                         ip_vs_conn_expire_now(cp);
-                        if (ct) {
+                        if (cp->control) {
                                 IP_VS_DBG(4, "del conn template\n");
-                                ip_vs_conn_expire_now(ct);
+                                ip_vs_conn_expire_now(cp->control);
                         }
-                        ct_write_lock(hash);
                 }
                 ct_write_unlock(hash);
         }
@@ -829,7 +818,6 @@ static void ip_vs_conn_flush(void)
 {
         int idx;
         struct ip_vs_conn *cp;
-        struct ip_vs_conn *ct;
 
   flush_again:
         for (idx=0; idx<IP_VS_CONN_TAB_SIZE; idx++) {
@@ -839,18 +827,13 @@ static void ip_vs_conn_flush(void)
                 ct_write_lock_bh(idx);
 
                 list_for_each_entry(cp, &ip_vs_conn_tab[idx], c_list) {
-                        atomic_inc(&cp->refcnt);
-                        ct_write_unlock(idx);
 
-                        if ((ct = cp->control))
-                                atomic_inc(&ct->refcnt);
                         IP_VS_DBG(4, "del connection\n");
                         ip_vs_conn_expire_now(cp);
-                        if (ct) {
+                        if (cp->control) {
                                 IP_VS_DBG(4, "del conn template\n");
-                                ip_vs_conn_expire_now(ct);
+                                ip_vs_conn_expire_now(cp->control);
                         }
-                        ct_write_lock(idx);
                 }
                 ct_write_unlock_bh(idx);
         }
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index 9cde8c61f525..6706d3a1bc4f 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -30,7 +30,7 @@
 #include <linux/netfilter_ipv4/ipt_CLUSTERIP.h>
 #include <linux/netfilter_ipv4/ip_conntrack.h>
 
-#define CLUSTERIP_VERSION "0.6"
+#define CLUSTERIP_VERSION "0.7"
 
 #define DEBUG_CLUSTERIP
 
@@ -524,8 +524,9 @@ arp_mangle(unsigned int hook,
             || arp->ar_pln != 4 || arp->ar_hln != ETH_ALEN)
                 return NF_ACCEPT;
 
-        /* we only want to mangle arp replies */
-        if (arp->ar_op != htons(ARPOP_REPLY))
+        /* we only want to mangle arp requests and replies */
+        if (arp->ar_op != htons(ARPOP_REPLY)
+            && arp->ar_op != htons(ARPOP_REQUEST))
                 return NF_ACCEPT;
 
         payload = (void *)(arp+1);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 80cf633d9f4a..12a1cf306f67 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1909,7 +1909,7 @@ static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
          */
         if ((err = fib_lookup(&fl, &res)) != 0) {
                 if (!IN_DEV_FORWARD(in_dev))
-                        goto e_inval;
+                        goto e_hostunreach;
                 goto no_route;
         }
         free_res = 1;
@@ -1933,7 +1933,7 @@ static int ip_route_input_slow(struct sk_buff *skb, u32 daddr, u32 saddr,
         }
 
         if (!IN_DEV_FORWARD(in_dev))
-                goto e_inval;
+                goto e_hostunreach;
         if (res.type != RTN_UNICAST)
                 goto martian_destination;
 
@@ -2025,6 +2025,11 @@ martian_destination:
                         "%u.%u.%u.%u, dev %s\n",
                         NIPQUAD(daddr), NIPQUAD(saddr), dev->name);
 #endif
+
+e_hostunreach:
+        err = -EHOSTUNREACH;
+        goto done;
+
 e_inval:
         err = -EINVAL;
         goto done;