Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [BRIDGE]: adding new device to bridge should enable if up
  [IPV6]: Do not set IF_READY if device is down
  [IPSEC]: xfrm audit hook misplaced in pfkey_delete and xfrm_del_sa
  [IPSEC]: Add xfrm policy change auditing to pfkey_spdget
  [IPSEC]: xfrm_policy delete security check misplaced
  [CONNECTOR]: Bugfix for cn_call_callback()
  [DCCP]: Revert patch which disables bidirectional mode
  [IPV6]: Handle np->opt being NULL in ipv6_getsockopt_sticky().
  [UDP]: Reread uh pointer after pskb_trim
  [NETFILTER]: nfnetlink_log: fix crash on bridged packet
  [NETFILTER]: nfnetlink_log: zero-terminate prefix
  [NETFILTER]: nf_conntrack_ipv6: fix incorrect classification of IPv6 fragments as ESTABLISHED

1 files changed, 16 insertions, 2 deletions

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 946b715db5ec..0c3a70ac5075 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -735,12 +735,14 @@ EXPORT_SYMBOL(xfrm_policy_insert);
 
 struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                                           struct xfrm_selector *sel,
-                                          struct xfrm_sec_ctx *ctx, int delete)
+                                          struct xfrm_sec_ctx *ctx, int delete,
+                                          int *err)
 {
         struct xfrm_policy *pol, *ret;
         struct hlist_head *chain;
         struct hlist_node *entry;
 
+        *err = 0;
         write_lock_bh(&xfrm_policy_lock);
         chain = policy_hash_bysel(sel, sel->family, dir);
         ret = NULL;
@@ -750,6 +752,11 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                     xfrm_sec_ctx_match(ctx, pol->security)) {
                         xfrm_pol_hold(pol);
                         if (delete) {
+                                *err = security_xfrm_policy_delete(pol);
+                                if (*err) {
+                                        write_unlock_bh(&xfrm_policy_lock);
+                                        return pol;
+                                }
                                 hlist_del(&pol->bydst);
                                 hlist_del(&pol->byidx);
                                 xfrm_policy_count[dir]--;
@@ -768,12 +775,14 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
 }
 EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
 
-struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete)
+struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
+                                     int *err)
 {
         struct xfrm_policy *pol, *ret;
         struct hlist_head *chain;
         struct hlist_node *entry;
 
+        *err = 0;
         write_lock_bh(&xfrm_policy_lock);
         chain = xfrm_policy_byidx + idx_hash(id);
         ret = NULL;
@@ -781,6 +790,11 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete)
                 if (pol->type == type && pol->index == id) {
                         xfrm_pol_hold(pol);
                         if (delete) {
+                                *err = security_xfrm_policy_delete(pol);
+                                if (*err) {
+                                        write_unlock_bh(&xfrm_policy_lock);
+                                        return pol;
+                                }
                                 hlist_del(&pol->bydst);
                                 hlist_del(&pol->byidx);
                                 xfrm_policy_count[dir]--;