Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (42 commits)
  [IOAT]: Do not dereference THIS_MODULE directly to set unsafe.
  [NETROM]: Fix possible null pointer dereference.
  [NET] netpoll: break recursive loop in netpoll rx path
  [NET] netpoll: don't spin forever sending to stopped queues
  [IRDA]: add some IBM think pads
  [ATM]: atm/mpc.c warning fix
  [NET]: skb_find_text ignores to argument
  [NET]: make net/core/dev.c:netdev_nit static
  [NET]: Fix GSO problems in dev_hard_start_xmit()
  [NET]: Fix CHECKSUM_HW GSO problems.
  [TIPC]: Fix incorrect correction to discovery timer frequency computation.
  [TIPC]: Get rid of dynamically allocated arrays in broadcast code.
  [TIPC]: Fixed link switchover bugs
  [TIPC]: Enhanced & cleaned up system messages; fixed 2 obscure memory leaks.
  [TIPC]: First phase of assert() cleanup
  [TIPC]: Disallow config operations that aren't supported in certain modes.
  [TIPC]: Fixed memory leak in tipc_link_send() when destination is unreachable
  [TIPC]: Added missing warning for out-of-memory condition
  [TIPC]: Withdrawing all names from nameless port now returns success, not error
  [TIPC]: Optimized argument validation done by connect().
  ...

1 files changed, 22 insertions, 19 deletions

diff --git a/net/tipc/port.c b/net/tipc/port.c
index 67e96cb1e825..47d97404e3ee 100644
--- a/net/tipc/port.c
+++ b/net/tipc/port.c
@@ -168,7 +168,6 @@ void tipc_port_recv_mcast(struct sk_buff *buf, struct port_list *dp)
         struct port_list *item = dp;
         int cnt = 0;
 
-        assert(buf);
         msg = buf_msg(buf);
 
         /* Create destination port list, if one wasn't supplied */
@@ -196,7 +195,7 @@ void tipc_port_recv_mcast(struct sk_buff *buf, struct port_list *dp)
                         struct sk_buff *b = skb_clone(buf, GFP_ATOMIC);
 
                         if (b == NULL) {
-                                warn("Buffer allocation failure\n");
+                                warn("Unable to deliver multicast message(s)\n");
                                 msg_dbg(msg, "LOST:");
                                 goto exit;
                         }
@@ -228,14 +227,14 @@ u32 tipc_createport_raw(void *usr_handle,
         u32 ref;
 
         p_ptr = kmalloc(sizeof(*p_ptr), GFP_ATOMIC);
-        if (p_ptr == NULL) {
-                warn("Memory squeeze; failed to create port\n");
+        if (!p_ptr) {
+                warn("Port creation failed, no memory\n");
                 return 0;
         }
         memset(p_ptr, 0, sizeof(*p_ptr));
         ref = tipc_ref_acquire(p_ptr, &p_ptr->publ.lock);
         if (!ref) {
-                warn("Reference Table Exhausted\n");
+                warn("Port creation failed, reference table exhausted\n");
                 kfree(p_ptr);
                 return 0;
         }
@@ -810,18 +809,20 @@ static void port_dispatcher_sigh(void *dummy)
                 void *usr_handle;
                 int connected;
                 int published;
+                u32 message_type;
 
                 struct sk_buff *next = buf->next;
                 struct tipc_msg *msg = buf_msg(buf);
                 u32 dref = msg_destport(msg);
                 
+                message_type = msg_type(msg);
+                if (message_type > TIPC_DIRECT_MSG)
+                        goto reject;    /* Unsupported message type */
+
                 p_ptr = tipc_port_lock(dref);
-                if (!p_ptr) {
-                        /* Port deleted while msg in queue */
-                        tipc_reject_msg(buf, TIPC_ERR_NO_PORT);
-                        buf = next;
-                        continue;
-                }
+                if (!p_ptr)
+                        goto reject;    /* Port deleted while msg in queue */
+
                 orig.ref = msg_origport(msg);
                 orig.node = msg_orignode(msg);
                 up_ptr = p_ptr->user_port;
@@ -832,7 +833,7 @@ static void port_dispatcher_sigh(void *dummy)
                 if (unlikely(msg_errcode(msg)))
                         goto err;
 
-                switch (msg_type(msg)) {
+                switch (message_type) {
                 
                 case TIPC_CONN_MSG:{
                                 tipc_conn_msg_event cb = up_ptr->conn_msg_cb;
@@ -874,6 +875,7 @@ static void port_dispatcher_sigh(void *dummy)
                                    &orig);
                                 break;
                         }
+                case TIPC_MCAST_MSG:
                 case TIPC_NAMED_MSG:{
                                 tipc_named_msg_event cb = up_ptr->named_msg_cb;
 
@@ -886,7 +888,8 @@ static void port_dispatcher_sigh(void *dummy)
                                         goto reject;
                                 dseq.type =  msg_nametype(msg);
                                 dseq.lower = msg_nameinst(msg);
-                                dseq.upper = dseq.lower;
+                                dseq.upper = (message_type == TIPC_NAMED_MSG)
+                                        ? dseq.lower : msg_nameupper(msg);
                                 skb_pull(buf, msg_hdr_sz(msg));
                                 cb(usr_handle, dref, &buf, msg_data(msg), 
                                    msg_data_sz(msg), msg_importance(msg),
@@ -899,7 +902,7 @@ static void port_dispatcher_sigh(void *dummy)
                 buf = next;
                 continue;
 err:
-                switch (msg_type(msg)) {
+                switch (message_type) {
                 
                 case TIPC_CONN_MSG:{
                                 tipc_conn_shutdown_event cb = 
@@ -931,6 +934,7 @@ err:
                                    msg_data_sz(msg), msg_errcode(msg), &orig);
                                 break;
                         }
+                case TIPC_MCAST_MSG:
                 case TIPC_NAMED_MSG:{
                                 tipc_named_msg_err_event cb = 
                                         up_ptr->named_err_cb;
@@ -940,7 +944,8 @@ err:
                                         break;
                                 dseq.type =  msg_nametype(msg);
                                 dseq.lower = msg_nameinst(msg);
-                                dseq.upper = dseq.lower;
+                                dseq.upper = (message_type == TIPC_NAMED_MSG)
+                                        ? dseq.lower : msg_nameupper(msg);
                                 skb_pull(buf, msg_hdr_sz(msg));
                                 cb(usr_handle, dref, &buf, msg_data(msg), 
                                    msg_data_sz(msg), msg_errcode(msg), &dseq);
@@ -1054,7 +1059,8 @@ int tipc_createport(u32 user_ref,
         u32 ref;
 
         up_ptr = (struct user_port *)kmalloc(sizeof(*up_ptr), GFP_ATOMIC);
-        if (up_ptr == NULL) {
+        if (!up_ptr) {
+                warn("Port creation failed, no memory\n");
                 return -ENOMEM;
         }
         ref = tipc_createport_raw(NULL, port_dispatcher, port_wakeup, importance);
@@ -1165,8 +1171,6 @@ int tipc_withdraw(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
         p_ptr = tipc_port_lock(ref);
         if (!p_ptr)
                 return -EINVAL;
-        if (!p_ptr->publ.published)
-                goto exit;
         if (!seq) {
                 list_for_each_entry_safe(publ, tpubl, 
                                          &p_ptr->publications, pport_list) {
@@ -1193,7 +1197,6 @@ int tipc_withdraw(u32 ref, unsigned int scope, struct tipc_name_seq const *seq)
         }
         if (list_empty(&p_ptr->publications))
                 p_ptr->publ.published = 0;
-exit:
         tipc_port_unlock(p_ptr);
         return res;
 }