Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/wireless/iwlwifi/iwl-agn.c
	drivers/net/wireless/iwlwifi/iwl3945-base.c

8 files changed, 94 insertions, 47 deletions

diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index dcd7666824ba..fc70147c771e 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -29,6 +29,7 @@
 #include <linux/errno.h>
 #include <linux/uaccess.h>
 #include <linux/sched.h>
+#include <linux/types.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include "protocol.h"
@@ -160,29 +161,32 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                         break;
                 case 'w':{
                                 int16_t *val = va_arg(ap, int16_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le16 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le16(*val);
+                                *val = le16_to_cpu(le_val);
                         }
                         break;
                 case 'd':{
                                 int32_t *val = va_arg(ap, int32_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le32(*val);
+                                *val = le32_to_cpu(le_val);
                         }
                         break;
                 case 'q':{
                                 int64_t *val = va_arg(ap, int64_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le64 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le64(*val);
+                                *val = le64_to_cpu(le_val);
                         }
                         break;
                 case 's':{
@@ -362,19 +366,19 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                         }
                         break;
                 case 'w':{
-                                int16_t val = va_arg(ap, int);
+                                __le16 val = cpu_to_le16(va_arg(ap, int));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
                         break;
                 case 'd':{
-                                int32_t val = va_arg(ap, int32_t);
+                                __le32 val = cpu_to_le32(va_arg(ap, int32_t));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
                         break;
                 case 'q':{
-                                int64_t val = va_arg(ap, int64_t);
+                                __le64 val = cpu_to_le64(va_arg(ap, int64_t));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
diff --git a/net/core/dev.c b/net/core/dev.c
index 247f1614a796..709a9a922258 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1105,7 +1105,7 @@ int dev_open(struct net_device *dev)
                 /*
                  *      Enable NET_DMA
                  */
-                dmaengine_get();
+                net_dmaengine_get();
 
                 /*
                  *      Initialize multicasting status
@@ -1187,7 +1187,7 @@ int dev_close(struct net_device *dev)
         /*
          *      Shutdown NET_DMA
          */
-        dmaengine_put();
+        net_dmaengine_put();
 
         return 0;
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f66c58df8953..278a142d1047 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1994,8 +1994,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                         if (!net_eq(neigh_parms_net(p), net))
                                 continue;
 
-                        if (nidx++ < neigh_skip)
-                                continue;
+                        if (nidx < neigh_skip)
+                                goto next;
 
                         if (neightbl_fill_param_info(skb, tbl, p,
                                                      NETLINK_CB(cb->skb).pid,
@@ -2003,6 +2003,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                                                      RTM_NEWNEIGHTBL,
                                                      NLM_F_MULTI) <= 0)
                                 goto out;
+                next:
+                        nidx++;
                 }
 
                 neigh_skip = 0;
@@ -2082,12 +2084,10 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                 if (h > s_h)
                         s_idx = 0;
                 for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) {
-                        int lidx;
                         if (dev_net(n->dev) != net)
                                 continue;
-                        lidx = idx++;
-                        if (lidx < s_idx)
-                                continue;
+                        if (idx < s_idx)
+                                goto next;
                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
                                             cb->nlh->nlmsg_seq,
                                             RTM_NEWNEIGH,
@@ -2096,6 +2096,8 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                                 rc = -1;
                                 goto out;
                         }
+                next:
+                        idx++;
                 }
         }
         read_unlock_bh(&tbl->lock);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 557fe16cbfb0..dda42f0bd7a3 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -663,14 +663,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         th->urg_ptr             = 0;
 
         /* The urg_mode check is necessary during a below snd_una win probe */
-        if (unlikely(tcp_urg_mode(tp))) {
-                if (between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF)) {
-                        th->urg_ptr = htons(tp->snd_up - tcb->seq);
-                        th->urg = 1;
-                } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
-                        th->urg_ptr = 0xFFFF;
-                        th->urg = 1;
-                }
+        if (unlikely(tcp_urg_mode(tp) &&
+                     between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF))) {
+                th->urg_ptr             = htons(tp->snd_up - tcb->seq);
+                th->urg                 = 1;
         }
 
         tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1ab180bad72a..c47c989cb1fb 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1231,11 +1231,10 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                    int proto)
 {
         struct sock *sk;
-        struct udphdr *uh = udp_hdr(skb);
+        struct udphdr *uh;
         unsigned short ulen;
         struct rtable *rt = (struct rtable*)skb->dst;
-        __be32 saddr = ip_hdr(skb)->saddr;
-        __be32 daddr = ip_hdr(skb)->daddr;
+        __be32 saddr, daddr;
         struct net *net = dev_net(skb->dev);
 
         /*
@@ -1244,6 +1243,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                 goto drop;              /* No space for header. */
 
+        uh   = udp_hdr(skb);
         ulen = ntohs(uh->len);
         if (ulen > skb->len)
                 goto short_packet;
@@ -1258,6 +1258,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp4_csum_init(skb, uh, proto))
                 goto csum_error;
 
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
+
         if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                 return __udp4_lib_mcast_deliver(net, skb, uh,
                                 saddr, daddr, udptable);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index c62dd247774f..7712578bdc66 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -323,17 +323,21 @@ static struct ip6_flowlabel *
 fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
           int optlen, int *err_p)
 {
-        struct ip6_flowlabel *fl;
+        struct ip6_flowlabel *fl = NULL;
         int olen;
         int addr_type;
         int err;
 
+        olen = optlen - CMSG_ALIGN(sizeof(*freq));
+        err = -EINVAL;
+        if (olen > 64 * 1024)
+                goto done;
+
         err = -ENOMEM;
         fl = kzalloc(sizeof(*fl), GFP_KERNEL);
         if (fl == NULL)
                 goto done;
 
-        olen = optlen - CMSG_ALIGN(sizeof(*freq));
         if (olen > 0) {
                 struct msghdr msg;
                 struct flowi flowi;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4b15938bef4d..9fb49c3b518a 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1105,6 +1105,18 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         return err;
 }
 
+static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
+                                               gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+
+static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+                                                gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
@@ -1130,17 +1142,37 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                  * setup for corking
                  */
                 if (opt) {
-                        if (np->cork.opt == NULL) {
-                                np->cork.opt = kmalloc(opt->tot_len,
-                                                       sk->sk_allocation);
-                                if (unlikely(np->cork.opt == NULL))
-                                        return -ENOBUFS;
-                        } else if (np->cork.opt->tot_len < opt->tot_len) {
-                                printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
+                        if (WARN_ON(np->cork.opt))
                                 return -EINVAL;
-                        }
-                        memcpy(np->cork.opt, opt, opt->tot_len);
-                        inet->cork.flags |= IPCORK_OPT;
+
+                        np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
+                        if (unlikely(np->cork.opt == NULL))
+                                return -ENOBUFS;
+
+                        np->cork.opt->tot_len = opt->tot_len;
+                        np->cork.opt->opt_flen = opt->opt_flen;
+                        np->cork.opt->opt_nflen = opt->opt_nflen;
+
+                        np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst0opt && !np->cork.opt->dst0opt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst1opt && !np->cork.opt->dst1opt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
+                                                           sk->sk_allocation);
+                        if (opt->hopopt && !np->cork.opt->hopopt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
+                                                            sk->sk_allocation);
+                        if (opt->srcrt && !np->cork.opt->srcrt)
+                                return -ENOBUFS;
+
                         /* need source address above miyazawa*/
                 }
                 dst_hold(&rt->u.dst);
@@ -1167,8 +1199,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         } else {
                 rt = (struct rt6_info *)inet->cork.dst;
                 fl = &inet->cork.fl;
-                if (inet->cork.flags & IPCORK_OPT)
-                        opt = np->cork.opt;
+                opt = np->cork.opt;
                 transhdrlen = 0;
                 exthdrlen = 0;
                 mtu = inet->cork.fragsize;
@@ -1407,9 +1438,15 @@ error:
 
 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
 {
-        inet->cork.flags &= ~IPCORK_OPT;
-        kfree(np->cork.opt);
-        np->cork.opt = NULL;
+        if (np->cork.opt) {
+                kfree(np->cork.opt->dst0opt);
+                kfree(np->cork.opt->dst1opt);
+                kfree(np->cork.opt->hopopt);
+                kfree(np->cork.opt->srcrt);
+                kfree(np->cork.opt);
+                np->cork.opt = NULL;
+        }
+
         if (inet->cork.dst) {
                 dst_release(inet->cork.dst);
                 inet->cork.dst = NULL;
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d7d2bed7a699..eac5e7bb7365 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -284,13 +284,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
                 if (IS_ERR(trans)) {
                         call = ERR_CAST(trans);
                         trans = NULL;
-                        goto out;
+                        goto out_notrans;
                 }
         } else {
                 trans = rx->trans;
                 if (!trans) {
                         call = ERR_PTR(-ENOTCONN);
-                        goto out;
+                        goto out_notrans;
                 }
                 atomic_inc(&trans->usage);
         }
@@ -315,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
         rxrpc_put_bundle(trans, bundle);
 out:
         rxrpc_put_transport(trans);
+out_notrans:
         release_sock(&rx->sk);
         _leave(" = %p", call);
         return call;