Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1674 commits)
  qlcnic: adding co maintainer
  ixgbe: add support for active DA cables
  ixgbe: dcb, do not tag tc_prio_control frames
  ixgbe: fix ixgbe_tx_is_paused logic
  ixgbe: always enable vlan strip/insert when DCB is enabled
  ixgbe: remove some redundant code in setting FCoE FIP filter
  ixgbe: fix wrong offset to fc_frame_header in ixgbe_fcoe_ddp
  ixgbe: fix header len when unsplit packet overflows to data buffer
  ipv6: Never schedule DAD timer on dead address
  ipv6: Use POSTDAD state
  ipv6: Use state_lock to protect ifa state
  ipv6: Replace inet6_ifaddr->dead with state
  cxgb4: notify upper drivers if the device is already up when they load
  cxgb4: keep interrupts available when the ports are brought down
  cxgb4: fix initial addition of MAC address
  cnic: Return SPQ credit to bnx2x after ring setup and shutdown.
  cnic: Convert cnic_local_flags to atomic ops.
  can: Fix SJA1000 command register writes on SMP systems
  bridge: fix build for CONFIG_SYSFS disabled
  ARCNET: Limit com20020 PCI ID matches for SOHARD cards
  ...

Fix up various conflicts with pcmcia tree drivers/net/
{pcmcia/3c589_cs.c, wireless/orinoco/orinoco_cs.c and
wireless/orinoco/spectrum_cs.c} and feature removal
(Documentation/feature-removal-schedule.txt).

Also fix a non-content conflict due to pm_qos_requirement getting
renamed in the PM tree (now pm_qos_request) in net/mac80211/scan.c

1 files changed, 18 insertions, 6 deletions

diff --git a/net/wireless/util.c b/net/wireless/util.c
index d3574a4eb3ba..3416373a9c0c 100644
--- a/net/wireless/util.c
+++ b/net/wireless/util.c
@@ -331,11 +331,18 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
                         struct ieee80211s_hdr *meshdr =
                                 (struct ieee80211s_hdr *) (skb->data + hdrlen);
-                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        /* make sure meshdr->flags is on the linear part */
+                        if (!pskb_may_pull(skb, hdrlen + 1))
+                                return -1;
                         if (meshdr->flags & MESH_FLAGS_AE_A5_A6) {
-                                memcpy(dst, meshdr->eaddr1, ETH_ALEN);
-                                memcpy(src, meshdr->eaddr2, ETH_ALEN);
+                                skb_copy_bits(skb, hdrlen +
+                                        offsetof(struct ieee80211s_hdr, eaddr1),
+                                        dst, ETH_ALEN);
+                                skb_copy_bits(skb, hdrlen +
+                                        offsetof(struct ieee80211s_hdr, eaddr2),
+                                        src, ETH_ALEN);
                         }
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
                 }
                 break;
         case cpu_to_le16(IEEE80211_FCTL_FROMDS):
@@ -347,9 +354,14 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 if (iftype == NL80211_IFTYPE_MESH_POINT) {
                         struct ieee80211s_hdr *meshdr =
                                 (struct ieee80211s_hdr *) (skb->data + hdrlen);
-                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
+                        /* make sure meshdr->flags is on the linear part */
+                        if (!pskb_may_pull(skb, hdrlen + 1))
+                                return -1;
                         if (meshdr->flags & MESH_FLAGS_AE_A4)
-                                memcpy(src, meshdr->eaddr1, ETH_ALEN);
+                                skb_copy_bits(skb, hdrlen +
+                                        offsetof(struct ieee80211s_hdr, eaddr1),
+                                        src, ETH_ALEN);
+                        hdrlen += ieee80211_get_mesh_hdrlen(meshdr);
                 }
                 break;
         case cpu_to_le16(0):
@@ -358,7 +370,7 @@ int ieee80211_data_to_8023(struct sk_buff *skb, const u8 *addr,
                 break;
         }
 
-        if (unlikely(skb->len - hdrlen < 8))
+        if (!pskb_may_pull(skb, hdrlen + 8))
                 return -1;
 
         payload = skb->data + hdrlen;