Merge branch 'master' into upstream

3 files changed, 23 insertions, 17 deletions

diff --git a/net/bridge/br.c b/net/bridge/br.c
index 22d806cf40ca..12da21afb9ca 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -55,7 +55,7 @@ static int __init br_init(void)
 
 static void __exit br_deinit(void)
 {
-        llc_sap_close(br_stp_sap);
+        rcu_assign_pointer(br_stp_sap->rcv_func, NULL);
 
 #ifdef CONFIG_BRIDGE_NETFILTER
         br_netfilter_fini();
@@ -67,6 +67,7 @@ static void __exit br_deinit(void)
 
         synchronize_net();
 
+        llc_sap_put(br_stp_sap);
         br_fdb_get_hook = NULL;
         br_fdb_put_hook = NULL;
 
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
index 355a53a5b6cd..26dfecadb335 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
@@ -528,14 +528,15 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
 
                         /* Decode */
                         if ((err = (Decoders[son->type]) (bs, son, base,
-                                                          level + 1)) >
-                            H323_ERROR_STOP)
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
                                 return err;
 
                         bs->cur = beg + len;
                         bs->bit = 0;
                 } else if ((err = (Decoders[son->type]) (bs, son, base,
-                                                         level + 1)))
+                                                         level + 1)) <
+                           H323_ERROR_NONE)
                         return err;
         }
 
@@ -554,7 +555,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
 
         /* Decode the extension components */
         for (opt = 0; opt < bmp2_len; opt++, i++, son++) {
-                if (son->attr & STOP) {
+                if (i < f->ub && son->attr & STOP) {
                         PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ",
                               son->name);
                         return H323_ERROR_STOP;
@@ -584,8 +585,8 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
                 beg = bs->cur;
 
                 if ((err = (Decoders[son->type]) (bs, son, base,
-                                                  level + 1)) >
-                    H323_ERROR_STOP)
+                                                  level + 1)) <
+                    H323_ERROR_NONE)
                         return err;
 
                 bs->cur = beg + len;
@@ -660,18 +661,20 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
                                                           i <
                                                           effective_count ?
                                                           base : NULL,
-                                                          level + 1)) >
-                            H323_ERROR_STOP)
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
                                 return err;
 
                         bs->cur = beg + len;
                         bs->bit = 0;
                 } else
-                    if ((err = (Decoders[son->type]) (bs, son,
-                                                      i < effective_count ?
-                                                      base : NULL,
-                                                      level + 1)))
-                        return err;
+                        if ((err = (Decoders[son->type]) (bs, son,
+                                                          i <
+                                                          effective_count ?
+                                                          base : NULL,
+                                                          level + 1)) <
+                            H323_ERROR_NONE)
+                                return err;
 
                 if (base)
                         base += son->offset;
@@ -735,13 +738,14 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
                 }
                 beg = bs->cur;
 
-                if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) >
-                    H323_ERROR_STOP)
+                if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+                    H323_ERROR_NONE)
                         return err;
 
                 bs->cur = beg + len;
                 bs->bit = 0;
-        } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)))
+        } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+                   H323_ERROR_NONE)
                 return err;
 
         return H323_ERROR_NONE;
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index 688a2f29fadf..c33244263b90 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -768,6 +768,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
                         len *= sizeof(unsigned long);
                         *obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
                         if (*obj == NULL) {
+                                kfree(lp);
                                 kfree(id);
                                 if (net_ratelimit())
                                         printk("OOM in bsalg (%d)\n", __LINE__);