Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (30 commits)
  [TIPC]: Initial activation message now includes TIPC version number
  [TIPC]: Improve response to requests for node/link information
  [TIPC]: Fixed skb_under_panic caused by tipc_link_bundle_buf
  [IrDA]: Fix the AU1000 FIR dependencies
  [IrDA]: Fix RCU lock pairing on error path
  [XFRM]: unexport xfrm_state_mtu
  [NET]: make skb_release_data() static
  [NETFILTE] ipv4: Fix typo (Bugzilla #6753)
  [IrDA]: MCS7780 usb_driver struct should be static
  [BNX2]: Turn off link during shutdown
  [BNX2]: Use dev_kfree_skb() instead of the _irq version
  [ATM]: basic sysfs support for ATM devices
  [ATM]: [suni] change suni_init to __devinit
  [ATM]: [iphase] should be __devinit not __init
  [ATM]: [idt77105] should be __devinit not __init
  [BNX2]: Add NETIF_F_TSO_ECN
  [NET]: Add ECN support for TSO
  [AF_UNIX]: Datagram getpeersec
  [NET]: Fix logical error in skb_gso_ok
  [PKT_SCHED]: PSCHED_TADD() and PSCHED_TADD2() can result,tv_usec >= 1000000
  ...

1 files changed, 6 insertions, 5 deletions

diff --git a/net/tipc/link.c b/net/tipc/link.c
index d64658053746..c6831c75cfa4 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -2,7 +2,7 @@
  * net/tipc/link.c: TIPC link code
  * 
  * Copyright (c) 1996-2006, Ericsson AB
- * Copyright (c) 2004-2005, Wind River Systems
+ * Copyright (c) 2004-2006, Wind River Systems
  * All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -988,17 +988,18 @@ static int link_bundle_buf(struct link *l_ptr,
         struct tipc_msg *bundler_msg = buf_msg(bundler);
         struct tipc_msg *msg = buf_msg(buf);
         u32 size = msg_size(msg);
-        u32 to_pos = align(msg_size(bundler_msg));
-        u32 rest = link_max_pkt(l_ptr) - to_pos;
+        u32 bundle_size = msg_size(bundler_msg);
+        u32 to_pos = align(bundle_size);
+        u32 pad = to_pos - bundle_size;
 
         if (msg_user(bundler_msg) != MSG_BUNDLER)
                 return 0;
         if (msg_type(bundler_msg) != OPEN_MSG)
                 return 0;
-        if (rest < align(size))
+        if (skb_tailroom(bundler) < (pad + size))
                 return 0;
 
-        skb_put(bundler, (to_pos - msg_size(bundler_msg)) + size);
+        skb_put(bundler, pad + size);
         memcpy(bundler->data + to_pos, buf->data, size);
         msg_set_size(bundler_msg, to_pos + size);
         msg_set_msgcnt(bundler_msg, msg_msgcnt(bundler_msg) + 1);