Merge branch 'from-linus' into upstream

9 files changed, 37 insertions, 30 deletions

diff --git a/net/bridge/br.c b/net/bridge/br.c
index 22d806cf40ca..12da21afb9ca 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -55,7 +55,7 @@ static int __init br_init(void)
 
 static void __exit br_deinit(void)
 {
-        llc_sap_close(br_stp_sap);
+        rcu_assign_pointer(br_stp_sap->rcv_func, NULL);
 
 #ifdef CONFIG_BRIDGE_NETFILTER
         br_netfilter_fini();
@@ -67,6 +67,7 @@ static void __exit br_deinit(void)
 
         synchronize_net();
 
+        llc_sap_put(br_stp_sap);
         br_fdb_get_hook = NULL;
         br_fdb_put_hook = NULL;
 
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index cd810f41af1a..95278b22b669 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -210,7 +210,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
             skb->h.icmph->code != ICMP_FRAG_NEEDED)
                 return;
 
-        spi = ntohl(ntohs(ipch->cpi));
+        spi = htonl(ntohs(ipch->cpi));
         x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr,
                               spi, IPPROTO_COMP, AF_INET);
         if (!x)
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
index 355a53a5b6cd..26dfecadb335 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
@@ -528,14 +528,15 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
 
                         /* Decode */
                         if ((err = (Decoders[son->type]) (bs, son, base,
-                                                          level + 1)) >
-                            H323_ERROR_STOP)
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
                                 return err;
 
                         bs->cur = beg + len;
                         bs->bit = 0;
                 } else if ((err = (Decoders[son->type]) (bs, son, base,
-                                                         level + 1)))
+                                                         level + 1)) <
+                           H323_ERROR_NONE)
                         return err;
         }
 
@@ -554,7 +555,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
 
         /* Decode the extension components */
         for (opt = 0; opt < bmp2_len; opt++, i++, son++) {
-                if (son->attr & STOP) {
+                if (i < f->ub && son->attr & STOP) {
                         PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ",
                               son->name);
                         return H323_ERROR_STOP;
@@ -584,8 +585,8 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
                 beg = bs->cur;
 
                 if ((err = (Decoders[son->type]) (bs, son, base,
-                                                  level + 1)) >
-                    H323_ERROR_STOP)
+                                                  level + 1)) <
+                    H323_ERROR_NONE)
                         return err;
 
                 bs->cur = beg + len;
@@ -660,18 +661,20 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
                                                           i <
                                                           effective_count ?
                                                           base : NULL,
-                                                          level + 1)) >
-                            H323_ERROR_STOP)
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
                                 return err;
 
                         bs->cur = beg + len;
                         bs->bit = 0;
                 } else
-                    if ((err = (Decoders[son->type]) (bs, son,
-                                                      i < effective_count ?
-                                                      base : NULL,
-                                                      level + 1)))
-                        return err;
+                        if ((err = (Decoders[son->type]) (bs, son,
+                                                          i <
+                                                          effective_count ?
+                                                          base : NULL,
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
+                                return err;
 
                 if (base)
                         base += son->offset;
@@ -735,13 +738,14 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
                 }
                 beg = bs->cur;
 
-                if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) >
-                    H323_ERROR_STOP)
+                if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+                    H323_ERROR_NONE)
                         return err;
 
                 bs->cur = beg + len;
                 bs->bit = 0;
-        } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)))
+        } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+                   H323_ERROR_NONE)
                 return err;
 
         return H323_ERROR_NONE;
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index c62253845538..c33244263b90 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -768,6 +768,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                         len *= sizeof(unsigned long);
                         *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
                         if (*obj == NULL) {
+                                kfree(lp);
                                 kfree(id);
                                 if (net_ratelimit())
                                         printk("OOM in bsalg (%d)\n", __LINE__);
@@ -1003,12 +1004,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
                 
         return 1;
 
+err_addr_free:
+        kfree((unsigned long *)trap->ip_address);
+
 err_id_free:
         kfree(trap->id);
 
-err_addr_free:
-        kfree((unsigned long *)trap->ip_address);
-        
         return 0;
 }
 
@@ -1126,11 +1127,10 @@ static int snmp_parse_mangle(unsigned char *msg,
                 struct snmp_v1_trap trap;
                 unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
                 
-                /* Discard trap allocations regardless */
-                kfree(trap.id);
-                kfree((unsigned long *)trap.ip_address);
-                
-                if (!ret)
+                if (ret) {
+                        kfree(trap.id);
+                        kfree((unsigned long *)trap.ip_address);
+                } else 
                         return ret;
                 
         } else {
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index f285bbf296e2..8604c747bca5 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -221,7 +221,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
                         if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
                                 u16 *ipcomp_hdr = (u16 *)xprth;
 
-                                fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1]));
+                                fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
                         }
                         break;
                 default:
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 05eb67def39f..48636436028a 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -208,7 +208,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)
                 return;
 
-        spi = ntohl(ntohs(ipcomph->cpi));
+        spi = htonl(ntohs(ipcomph->cpi));
         x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
         if (!x)
                 return;
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 254f90746900..2d2e2b1919f4 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -544,7 +544,8 @@ static void iriap_getvaluebyclass_response(struct iriap_cb *self,
 {
         struct sk_buff *tx_skb;
         int n;
-        __u32 tmp_be32, tmp_be16;
+        __u32 tmp_be32;
+        __be16 tmp_be16;
         __u8 *fp;
 
         IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 3ac4193a78ed..7026b0866b7b 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -159,6 +159,7 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
                 detail->update(tmp, new);
         tmp->next = *head;
         *head = tmp;
+        detail->entries++;
         cache_get(tmp);
         is_new = cache_fresh_locked(tmp, new->expiry_time);
         cache_fresh_locked(old, 0);
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index b54971059f16..891a6090cc09 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -62,7 +62,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
         case IPPROTO_COMP:
                 if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
                         return -EINVAL;
-                *spi = ntohl(ntohs(*(u16*)(skb->h.raw + 2)));
+                *spi = htonl(ntohs(*(u16*)(skb->h.raw + 2)));
                 *seq = 0;
                 return 0;
         default: