Merge branch 'linux-2.6' into for-2.6.22

author: Paul Mackerras <paulus@samba.org> 2007-04-12 13:50:03 -0400
committer: Paul Mackerras <paulus@samba.org> 2007-04-12 13:50:03 -0400
commit: e049d1ca3094f3d1d94617f456a9961202f96e3a (patch)
tree: a30397ad22f2fbea268bd28fa69c60aad9dfa62a /net
parent: edfac96a92b88d3b0b53e3f8231b74beee9ecd1d (diff)
parent: 80584ff3b99c36ead7e130e453b3a48b18072d18 (diff)
74 files changed, 678 insertions, 3012 deletions
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 113c175f1715..c8b7dc2c3257 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -1417,10 +1417,13 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev,
        /*
         * Size check to see if ddp->deh_len was crap
         * (Otherwise we'll detonate most spectacularly
-         * in the middle of recvmsg()).
+         * in the middle of atalk_checksum() or recvmsg()).
         */
-        if (skb->len < sizeof(*ddp))
+        if (skb->len < sizeof(*ddp) || skb->len < (len_hops & 1023)) {
+                pr_debug("AppleTalk: dropping corrupted frame (deh_len=%u, "
+                         "skb->len=%u)\n", len_hops & 1023, skb->len);
                goto freeit;
+        }
        /*
         * Any checksums. Note we don't do htons() on this == is assumed to be
diff --git a/net/atm/clip.c b/net/atm/clip.c
index ebb5d0ce8b6f..8c3825816085 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -261,14 +261,6 @@ static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
        spin_unlock_irqrestore(&PRIV(dev)->xoff_lock, flags);
 }
-static void clip_neigh_destroy(struct neighbour *neigh)
-{
-        DPRINTK("clip_neigh_destroy (neigh %p)\n", neigh);
-        if (NEIGH2ENTRY(neigh)->vccs)
-                printk(KERN_CRIT "clip_neigh_destroy: vccs != NULL !!!\n");
-        NEIGH2ENTRY(neigh)->vccs = (void *) NEIGHBOR_DEAD;
-}
 static void clip_neigh_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
        DPRINTK("clip_neigh_solicit (neigh %p, skb %p)\n", neigh, skb);
@@ -342,7 +334,6 @@ static struct neigh_table clip_tbl = {
        /* parameters are copied from ARP ... */
        .parms = {
                .tbl                    = &clip_tbl,
-                .neigh_destructor       = clip_neigh_destroy,
                .base_reachable_time    = 30 * HZ,
                .retrans_time           = 1 * HZ,
                .gc_staletime           = 60 * HZ,
diff --git a/net/ax25/Kconfig b/net/ax25/Kconfig
index a8993a041724..43dd86fca4d3 100644
--- a/net/ax25/Kconfig
+++ b/net/ax25/Kconfig
@@ -1,30 +1,27 @@
 #
 # Amateur Radio protocols and AX.25 device configuration
 #
-# 19971130      Now in an own category to make correct compilation of the
-#               AX.25 stuff easier...
-#               Joerg Reuter DL1BKE <jreuter@yaina.de>
-# 19980129      Moved to net/ax25/Config.in, sourcing device drivers.
 menuconfig HAMRADIO
        depends on NET
        bool "Amateur Radio support"
        help
          If you want to connect your Linux box to an amateur radio, answer Y
-          here. You want to read <http://www.tapr.org/tapr/html/pkthome.html> and
+          here. You want to read <http://www.tapr.org/tapr/html/pkthome.html>
-          the AX25-HOWTO, available from <http://www.tldp.org/docs.html#howto>.
+          and more specifically about AX.25 on Linux
+          <http://www.linux-ax25.org/>.
          Note that the answer to this question won't directly affect the
          kernel: saying N will just cause the configurator to skip all
          the questions about amateur radio.
 comment "Packet Radio protocols"
-        depends on HAMRADIO && NET
+        depends on HAMRADIO
 config AX25
        tristate "Amateur Radio AX.25 Level 2 protocol"
-        depends on HAMRADIO && NET
+        depends on HAMRADIO
-        ---help---
+        help
          This is the protocol used for computer communication over amateur
          radio. It is either used by itself for point-to-point links, or to
          carry other protocols such as tcp/ip. To use it, you need a device
@@ -52,6 +49,7 @@ config AX25
 config AX25_DAMA_SLAVE
        bool "AX.25 DAMA Slave support"
+        default y
        depends on AX25
        help
          DAMA is a mechanism to prevent collisions when doing AX.25
@@ -59,23 +57,38 @@ config AX25_DAMA_SLAVE
          from clients (called "slaves") and redistributes it to other slaves.
          If you say Y here, your Linux box will act as a DAMA slave; this is
          transparent in that you don't have to do any special DAMA
-          configuration. (Linux cannot yet act as a DAMA server.) If unsure,
+          configuration. Linux cannot yet act as a DAMA server.  This option
-          say N.
+          only compiles DAMA slave support into the kernel.  It still needs to
+          be enabled at runtime.  For more about DAMA see
+          <http://www.linux-ax25.org>.  If unsure, say Y.
+# placeholder until implemented
+config AX25_DAMA_MASTER
+        bool 'AX.25 DAMA Master support'
+        depends on AX25_DAMA_SLAVE && BROKEN
+        help
+          DAMA is a mechanism to prevent collisions when doing AX.25
+          networking. A DAMA server (called "master") accepts incoming traffic
+          from clients (called "slaves") and redistributes it to other slaves.
+          If you say Y here, your Linux box will act as a DAMA master; this is
+          transparent in that you don't have to do any special DAMA
+          configuration. Linux cannot yet act as a DAMA server.  This option
+          only compiles DAMA slave support into the kernel.  It still needs to
+          be explicitly enabled, so if unsure, say Y.
-#        bool '    AX.25 DAMA Master support' CONFIG_AX25_DAMA_MASTER
 config NETROM
        tristate "Amateur Radio NET/ROM protocol"
        depends on AX25
-        ---help---
+        help
          NET/ROM is a network layer protocol on top of AX.25 useful for
          routing.
          A comprehensive listing of all the software for Linux amateur radio
          users as well as information about how to configure an AX.25 port is
-          contained in the AX25-HOWTO, available from
+          contained in the Linux Ham Wiki, available from
-          <http://www.tldp.org/docs.html#howto>. You also might want to
+          <http://www.linux-ax25.org>. You also might want to check out the
-          check out the file <file:Documentation/networking/ax25.txt>. More
+          file <file:Documentation/networking/ax25.txt>. More information about
-          information about digital amateur radio in general is on the WWW at
+          digital amateur radio in general is on the WWW at
          <http://www.tapr.org/tapr/html/pkthome.html>.
          To compile this driver as a module, choose M here: the
@@ -84,27 +97,25 @@ config NETROM
 config ROSE
        tristate "Amateur Radio X.25 PLP (Rose)"
        depends on AX25
-        ---help---
+        help
          The Packet Layer Protocol (PLP) is a way to route packets over X.25
          connections in general and amateur radio AX.25 connections in
          particular, essentially an alternative to NET/ROM.
          A comprehensive listing of all the software for Linux amateur radio
          users as well as information about how to configure an AX.25 port is
-          contained in the AX25-HOWTO, available from
+          contained in the Linux Ham Wiki, available from
-          <http://www.tldp.org/docs.html#howto>.  You also might want to
+          <http://www.linux-ax25.org>.  You also might want to check out the
-          check out the file <file:Documentation/networking/ax25.txt>. More
+          file <file:Documentation/networking/ax25.txt>. More information about
-          information about digital amateur radio in general is on the WWW at
+          digital amateur radio in general is on the WWW at
          <http://www.tapr.org/tapr/html/pkthome.html>.
          To compile this driver as a module, choose M here: the
          module will be called rose.
 menu "AX.25 network device drivers"
-        depends on HAMRADIO && NET && AX25!=n
+        depends on HAMRADIO && AX25
 source "drivers/net/hamradio/Kconfig"
 endmenu
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index f928d2b2a17d..71f5cfbbebb8 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -656,7 +656,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
                /* Detach sockets from device */
                read_lock(&hci_sk_list.lock);
                sk_for_each(sk, node, &hci_sk_list.head) {
-                        bh_lock_sock(sk);
+                        lock_sock(sk);
                        if (hci_pi(sk)->hdev == hdev) {
                                hci_pi(sk)->hdev = NULL;
                                sk->sk_err = EPIPE;
@@ -665,7 +665,7 @@ static int hci_sock_dev_event(struct notifier_block *this, unsigned long event,
                                hci_dev_put(hdev);
                        }
-                        bh_unlock_sock(sk);
+                        release_sock(sk);
                }
                read_unlock(&hci_sk_list.lock);
        }
diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 4c914df5fd06..d342e89b8bdd 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -319,7 +319,7 @@ static int __hidp_send_ctrl_message(struct hidp_session *session,
        return 0;
 }
-static int inline hidp_send_ctrl_message(struct hidp_session *session,
+static inline int hidp_send_ctrl_message(struct hidp_session *session,
                        unsigned char hdr, unsigned char *data, int size)
 {
        int err;
@@ -679,6 +679,27 @@ static void hidp_close(struct hid_device *hid)
 {
 }
+static const struct {
+        __u16 idVendor;
+        __u16 idProduct;
+        unsigned quirks;
+} hidp_blacklist[] = {
+        /* Apple wireless Mighty Mouse */
+        { 0x05ac, 0x030c, HID_QUIRK_MIGHTYMOUSE | HID_QUIRK_INVERT_HWHEEL },
+        { }     /* Terminating entry */
+};
+static void hidp_setup_quirks(struct hid_device *hid)
+{
+        unsigned int n;
+        for (n = 0; hidp_blacklist[n].idVendor; n++)
+                if (hidp_blacklist[n].idVendor == le16_to_cpu(hid->vendor) &&
+                                hidp_blacklist[n].idProduct == le16_to_cpu(hid->product))
+                        hid->quirks = hidp_blacklist[n].quirks;
+}
 static inline void hidp_setup_hid(struct hidp_session *session, struct hidp_connadd_req *req)
 {
        struct hid_device *hid = session->hid;
@@ -708,6 +729,8 @@ static inline void hidp_setup_hid(struct hidp_session *session, struct hidp_conn
        hid->hidinput_input_event = hidp_hidinput_event;
+        hidp_setup_quirks(hid);
        list_for_each_entry(report, &hid->report_enum[HID_INPUT_REPORT].report_list, list)
                hidp_send_report(session, report);
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index def2e403f932..8d566c13cc73 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -197,8 +197,8 @@ struct net_bridge_fdb_entry *br_fdb_get(struct net_bridge *br,
        rcu_read_lock();
        fdb = __br_fdb_get(br, addr);
-        if (fdb)
+        if (fdb && !atomic_inc_not_zero(&fdb->use_count))
-                atomic_inc(&fdb->use_count);
+                fdb = NULL;
        rcu_read_unlock();
        return fdb;
 }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 6845a258408f..f3a2e29be40c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -428,6 +428,10 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
        spin_lock_bh(&br->lock);
        br_stp_recalculate_bridge_id(br);
        br_features_recompute(br);
+        if ((dev->flags & IFF_UP) && netif_carrier_ok(dev) &&
+            (br->dev->flags & IFF_UP))
+                br_stp_enable_port(p);
        spin_unlock_bh(&br->lock);
        dev_set_mtu(br->dev, br_min_mtu(br));
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 7712d76f06ba..5439a3c46c3e 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -61,7 +61,7 @@ static int brnf_filter_vlan_tagged __read_mostly = 1;
 #define brnf_filter_vlan_tagged 1
 #endif
-static __be16 inline vlan_proto(const struct sk_buff *skb)
+static inline __be16 vlan_proto(const struct sk_buff *skb)
 {
        return vlan_eth_hdr(skb)->h_vlan_encapsulated_proto;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index cf71614dae93..4dc93cc4d5b7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -751,13 +751,10 @@ int dev_change_name(struct net_device *dev, char *newname)
        else
                strlcpy(dev->name, newname, IFNAMSIZ);
-        err = device_rename(&dev->dev, dev->name);
+        device_rename(&dev->dev, dev->name);
-        if (!err) {
+        hlist_del(&dev->name_hlist);
-                hlist_del(&dev->name_hlist);
+        hlist_add_head(&dev->name_hlist, dev_name_hash(dev->name));
-                hlist_add_head(&dev->name_hlist, dev_name_hash(dev->name));
+        raw_notifier_call_chain(&netdev_chain, NETDEV_CHANGENAME, dev);
-                raw_notifier_call_chain(&netdev_chain,
-                                NETDEV_CHANGENAME, dev);
-        }
        return err;
 }
@@ -1741,8 +1738,8 @@ static int ing_filter(struct sk_buff *skb)
        if (dev->qdisc_ingress) {
                __u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd);
                if (MAX_RED_LOOP < ttl++) {
-                        printk(KERN_WARNING "Redir loop detected Dropping packet (%s->%s)\n",
+                        printk(KERN_WARNING "Redir loop detected Dropping packet (%d->%d)\n",
-                                skb->input_dev->name, skb->dev->name);
+                                skb->iif, skb->dev->ifindex);
                        return TC_ACT_SHOT;
                }
@@ -1750,10 +1747,10 @@ static int ing_filter(struct sk_buff *skb)
                skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_INGRESS);
-                spin_lock(&dev->ingress_lock);
+                spin_lock(&dev->queue_lock);
                if ((q = dev->qdisc_ingress) != NULL)
                        result = q->enqueue(skb, q);
-                spin_unlock(&dev->ingress_lock);
+                spin_unlock(&dev->queue_lock);
        }
@@ -1775,8 +1772,8 @@ int netif_receive_skb(struct sk_buff *skb)
        if (!skb->tstamp.off_sec)
                net_timestamp(skb);
-        if (!skb->input_dev)
+        if (!skb->iif)
-                skb->input_dev = skb->dev;
+                skb->iif = skb->dev->ifindex;
        orig_dev = skb_bond(skb);
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 215f1bff048f..7174ced75efc 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -143,7 +143,7 @@ int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
                }
        }
-        err = -ENETUNREACH;
+        err = -ESRCH;
 out:
        rcu_read_unlock();
@@ -152,6 +152,28 @@ out:
 EXPORT_SYMBOL_GPL(fib_rules_lookup);
+static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
+                            struct fib_rules_ops *ops)
+{
+        int err = -EINVAL;
+        if (frh->src_len)
+                if (tb[FRA_SRC] == NULL ||
+                    frh->src_len > (ops->addr_size * 8) ||
+                    nla_len(tb[FRA_SRC]) != ops->addr_size)
+                        goto errout;
+        if (frh->dst_len)
+                if (tb[FRA_DST] == NULL ||
+                    frh->dst_len > (ops->addr_size * 8) ||
+                    nla_len(tb[FRA_DST]) != ops->addr_size)
+                        goto errout;
+        err = 0;
+errout:
+        return err;
+}
 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
        struct fib_rule_hdr *frh = nlmsg_data(nlh);
@@ -173,6 +195,10 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        if (err < 0)
                goto errout;
+        err = validate_rulemsg(frh, tb, ops);
+        if (err < 0)
+                goto errout;
        rule = kzalloc(ops->rule_size, GFP_KERNEL);
        if (rule == NULL) {
                err = -ENOMEM;
@@ -260,6 +286,10 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
        if (err < 0)
                goto errout;
+        err = validate_rulemsg(frh, tb, ops);
+        if (err < 0)
+                goto errout;
        list_for_each_entry(rule, ops->rules_list, list) {
                if (frh->action && (frh->action != rule->action))
                        continue;
@@ -374,7 +404,7 @@ int fib_rules_dump(struct sk_buff *skb, struct netlink_callback *cb, int family)
                return -EAFNOSUPPORT;
        rcu_read_lock();
-        list_for_each_entry(rule, ops->rules_list, list) {
+        list_for_each_entry_rcu(rule, ops->rules_list, list) {
                if (idx < cb->args[0])
                        goto skip;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 3183142c6044..cfc60019cf92 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -140,6 +140,8 @@ static int neigh_forced_gc(struct neigh_table *tbl)
                                n->dead = 1;
                                shrunk  = 1;
                                write_unlock(&n->lock);
+                                if (n->parms->neigh_cleanup)
+                                        n->parms->neigh_cleanup(n);
                                neigh_release(n);
                                continue;
                        }
@@ -211,6 +213,8 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
                                NEIGH_PRINTK2("neigh %p is stray.\n", n);
                        }
                        write_unlock(&n->lock);
+                        if (n->parms->neigh_cleanup)
+                                n->parms->neigh_cleanup(n);
                        neigh_release(n);
                }
        }
@@ -582,9 +586,6 @@ void neigh_destroy(struct neighbour *neigh)
                        kfree(hh);
        }
-        if (neigh->parms->neigh_destructor)
-                (neigh->parms->neigh_destructor)(neigh);
        skb_queue_purge(&neigh->arp_queue);
        dev_put(neigh->dev);
@@ -675,6 +676,8 @@ static void neigh_periodic_timer(unsigned long arg)
                        *np = n->next;
                        n->dead = 1;
                        write_unlock(&n->lock);
+                        if (n->parms->neigh_cleanup)
+                                n->parms->neigh_cleanup(n);
                        neigh_release(n);
                        continue;
                }
@@ -2088,8 +2091,11 @@ void __neigh_for_each_release(struct neigh_table *tbl,
                        } else
                                np = &n->next;
                        write_unlock(&n->lock);
-                        if (release)
+                        if (release) {
+                                if (n->parms->neigh_cleanup)
+                                        n->parms->neigh_cleanup(n);
                                neigh_release(n);
+                        }
                }
        }
 }
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 6055074c4b81..33ea8eac7fe0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -621,7 +621,8 @@ static int rtnl_getlink(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
                if (err < 0)
                        goto errout;
-                iw += IW_EV_POINT_OFF;
+                /* Payload is at an offset in buffer */
+                iw = iw_buf + IW_EV_POINT_OFF;
        }
 #endif  /* CONFIG_NET_WIRELESS_RTNETLINK */
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 820761f9eeef..87573ae35b02 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -463,6 +463,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
        memcpy(n->cb, skb->cb, sizeof(skb->cb));
        C(len);
        C(data_len);
+        C(mac_len);
        C(csum);
        C(local_df);
        n->cloned = 1;
@@ -495,7 +496,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
        n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
        n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
        n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
-        C(input_dev);
+        C(iif);
 #endif
        skb_copy_secmark(n, skb);
 #endif
diff --git a/net/core/sock.c b/net/core/sock.c
index 8d65d6478dcd..27c4f62382bd 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -808,7 +808,7 @@ lenout:
 *
 * (We also register the sk_lock with the lock validator.)
 */
-static void inline sock_lock_init(struct sock *sk)
+static inline void sock_lock_init(struct sock *sk)
 {
        sock_lock_init_class_and_name(sk,
                        af_family_slock_key_strings[sk->sk_family],
diff --git a/net/core/wireless.c b/net/core/wireless.c
index 9936ab11e6e0..b07fe270a508 100644
--- a/net/core/wireless.c
+++ b/net/core/wireless.c
@@ -2,7 +2,7 @@
 * This file implement the Wireless Extensions APIs.
 *
 * Authors :    Jean Tourrilhes - HPL - <jt@hpl.hp.com>
- * Copyright (c) 1997-2006 Jean Tourrilhes, All Rights Reserved.
+ * Copyright (c) 1997-2007 Jean Tourrilhes, All Rights Reserved.
 *
 * (As all part of the Linux kernel, this file is GPL)
 */
@@ -76,6 +76,9 @@
 *      o Change length in ESSID and NICK to strlen() instead of strlen()+1
 *      o Make standard_ioctl_num and standard_event_num unsigned
 *      o Remove (struct net_device *)->get_wireless_stats()
+ *
+ * v10 - 16.3.07 - Jean II
+ *      o Prevent leaking of kernel space in stream on 64 bits.
 */
 /***************************** INCLUDES *****************************/
@@ -427,6 +430,21 @@ static const int event_type_size[] = {
        IW_EV_QUAL_LEN,                 /* IW_HEADER_TYPE_QUAL */
 };
+/* Size (in bytes) of various events, as packed */
+static const int event_type_pk_size[] = {
+        IW_EV_LCP_PK_LEN,               /* IW_HEADER_TYPE_NULL */
+        0,
+        IW_EV_CHAR_PK_LEN,              /* IW_HEADER_TYPE_CHAR */
+        0,
+        IW_EV_UINT_PK_LEN,              /* IW_HEADER_TYPE_UINT */
+        IW_EV_FREQ_PK_LEN,              /* IW_HEADER_TYPE_FREQ */
+        IW_EV_ADDR_PK_LEN,              /* IW_HEADER_TYPE_ADDR */
+        0,
+        IW_EV_POINT_PK_LEN,             /* Without variable payload */
+        IW_EV_PARAM_PK_LEN,             /* IW_HEADER_TYPE_PARAM */
+        IW_EV_QUAL_PK_LEN,              /* IW_HEADER_TYPE_QUAL */
+};
 /************************ COMMON SUBROUTINES ************************/
 /*
 * Stuff that may be used in various place or doesn't fit in one
@@ -1217,7 +1235,7 @@ static int rtnetlink_standard_get(struct net_device *	dev,
                memcpy(buffer + IW_EV_POINT_OFF, request, request_len);
                /* Use our own copy of wrqu */
                wrqu = (union iwreq_data *) (buffer + IW_EV_POINT_OFF
-                                             + IW_EV_LCP_LEN);
+                                             + IW_EV_LCP_PK_LEN);
                /* No extra arguments. Trivial to handle */
                ret = handler(dev, &info, wrqu, NULL);
@@ -1229,8 +1247,8 @@ static int rtnetlink_standard_get(struct net_device *	dev,
                /* Get a temp copy of wrqu (skip pointer) */
                memcpy(((char *) &wrqu_point) + IW_EV_POINT_OFF,
-                       ((char *) request) + IW_EV_LCP_LEN,
+                       ((char *) request) + IW_EV_LCP_PK_LEN,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_LEN - IW_EV_LCP_PK_LEN);
                /* Calculate space needed by arguments. Always allocate
                 * for max space. Easier, and won't last long... */
@@ -1240,7 +1258,7 @@ static int rtnetlink_standard_get(struct net_device *	dev,
                   (wrqu_point.data.length > descr->max_tokens))
                        extra_size = (wrqu_point.data.length
                                      * descr->token_size);
-                buffer_size = extra_size + IW_EV_POINT_LEN + IW_EV_POINT_OFF;
+                buffer_size = extra_size + IW_EV_POINT_PK_LEN + IW_EV_POINT_OFF;
 #ifdef WE_RTNETLINK_DEBUG
                printk(KERN_DEBUG "%s (WE.r) : Malloc %d bytes (%d bytes)\n",
                       dev->name, extra_size, buffer_size);
@@ -1254,15 +1272,15 @@ static int rtnetlink_standard_get(struct net_device *	dev,
                /* Put wrqu in the right place (just before extra).
                 * Leave space for IWE header and dummy pointer...
-                 * Note that IW_EV_LCP_LEN==4 bytes, so it's still aligned...
+                 * Note that IW_EV_LCP_PK_LEN==4 bytes, so it's still aligned.
                 */
-                memcpy(buffer + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
+                memcpy(buffer + IW_EV_LCP_PK_LEN + IW_EV_POINT_OFF,
                       ((char *) &wrqu_point) + IW_EV_POINT_OFF,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
-                wrqu = (union iwreq_data *) (buffer + IW_EV_LCP_LEN);
+                wrqu = (union iwreq_data *) (buffer + IW_EV_LCP_PK_LEN);
                /* Extra comes logically after that. Offset +12 bytes. */
-                extra = buffer + IW_EV_POINT_OFF + IW_EV_POINT_LEN;
+                extra = buffer + IW_EV_POINT_OFF + IW_EV_POINT_PK_LEN;
                /* Call the handler */
                ret = handler(dev, &info, wrqu, extra);
@@ -1270,11 +1288,11 @@ static int rtnetlink_standard_get(struct net_device *	dev,
                /* Calculate real returned length */
                extra_size = (wrqu->data.length * descr->token_size);
                /* Re-adjust reply size */
-                request->len = extra_size + IW_EV_POINT_LEN;
+                request->len = extra_size + IW_EV_POINT_PK_LEN;
                /* Put the iwe header where it should, i.e. scrap the
                 * dummy pointer. */
-                memcpy(buffer + IW_EV_POINT_OFF, request, IW_EV_LCP_LEN);
+                memcpy(buffer + IW_EV_POINT_OFF, request, IW_EV_LCP_PK_LEN);
 #ifdef WE_RTNETLINK_DEBUG
                printk(KERN_DEBUG "%s (WE.r) : Reply 0x%04X, hdr_len %d, tokens %d, extra_size %d, buffer_size %d\n", dev->name, cmd, hdr_len, wrqu->data.length, extra_size, buffer_size);
@@ -1331,10 +1349,10 @@ static inline int rtnetlink_standard_set(struct net_device *	dev,
 #endif  /* WE_RTNETLINK_DEBUG */
        /* Extract fixed header from request. This is properly aligned. */
-        wrqu = &request->u;
+        wrqu = (union iwreq_data *) (((char *) request) + IW_EV_LCP_PK_LEN);
        /* Check if wrqu is complete */
-        hdr_len = event_type_size[descr->header_type];
+        hdr_len = event_type_pk_size[descr->header_type];
        if(request_len < hdr_len) {
 #ifdef WE_RTNETLINK_DEBUG
                printk(KERN_DEBUG
@@ -1359,7 +1377,7 @@ static inline int rtnetlink_standard_set(struct net_device *	dev,
                /* Put wrqu in the right place (skip pointer) */
                memcpy(((char *) &wrqu_point) + IW_EV_POINT_OFF,
-                       wrqu, IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       wrqu, IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                /* Don't forget about the event code... */
                wrqu = &wrqu_point;
@@ -1483,7 +1501,7 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                hdr_len = extra_size;
                extra_size = 0;
        } else {
-                hdr_len = IW_EV_POINT_LEN;
+                hdr_len = IW_EV_POINT_PK_LEN;
        }
        /* Check if wrqu is complete */
@@ -1514,7 +1532,7 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                memcpy(buffer + IW_EV_POINT_OFF, request, request_len);
                /* Use our own copy of wrqu */
                wrqu = (union iwreq_data *) (buffer + IW_EV_POINT_OFF
-                                             + IW_EV_LCP_LEN);
+                                             + IW_EV_LCP_PK_LEN);
                /* No extra arguments. Trivial to handle */
                ret = handler(dev, &info, wrqu, (char *) wrqu);
@@ -1523,7 +1541,7 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                char *  extra;
                /* Buffer for full reply */
-                buffer_size = extra_size + IW_EV_POINT_LEN + IW_EV_POINT_OFF;
+                buffer_size = extra_size + IW_EV_POINT_PK_LEN + IW_EV_POINT_OFF;
 #ifdef WE_RTNETLINK_DEBUG
                printk(KERN_DEBUG "%s (WE.r) : Malloc %d bytes (%d bytes)\n",
@@ -1538,15 +1556,15 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                /* Put wrqu in the right place (just before extra).
                 * Leave space for IWE header and dummy pointer...
-                 * Note that IW_EV_LCP_LEN==4 bytes, so it's still aligned...
+                 * Note that IW_EV_LCP_PK_LEN==4 bytes, so it's still aligned.
                 */
-                memcpy(buffer + IW_EV_LCP_LEN + IW_EV_POINT_OFF,
+                memcpy(buffer + IW_EV_LCP_PK_LEN + IW_EV_POINT_OFF,
-                       ((char *) request) + IW_EV_LCP_LEN,
+                       ((char *) request) + IW_EV_LCP_PK_LEN,
-                       IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
-                wrqu = (union iwreq_data *) (buffer + IW_EV_LCP_LEN);
+                wrqu = (union iwreq_data *) (buffer + IW_EV_LCP_PK_LEN);
                /* Extra comes logically after that. Offset +12 bytes. */
-                extra = buffer + IW_EV_POINT_OFF + IW_EV_POINT_LEN;
+                extra = buffer + IW_EV_POINT_OFF + IW_EV_POINT_PK_LEN;
                /* Call the handler */
                ret = handler(dev, &info, wrqu, extra);
@@ -1556,11 +1574,11 @@ static inline int rtnetlink_private_get(struct net_device *	dev,
                if (!(descr->get_args & IW_PRIV_SIZE_FIXED))
                        extra_size = adjust_priv_size(descr->get_args, wrqu);
                /* Re-adjust reply size */
-                request->len = extra_size + IW_EV_POINT_LEN;
+                request->len = extra_size + IW_EV_POINT_PK_LEN;
                /* Put the iwe header where it should, i.e. scrap the
                 * dummy pointer. */
-                memcpy(buffer + IW_EV_POINT_OFF, request, IW_EV_LCP_LEN);
+                memcpy(buffer + IW_EV_POINT_OFF, request, IW_EV_LCP_PK_LEN);
 #ifdef WE_RTNETLINK_DEBUG
                printk(KERN_DEBUG "%s (WE.r) : Reply 0x%04X, hdr_len %d, tokens %d, extra_size %d, buffer_size %d\n", dev->name, cmd, hdr_len, wrqu->data.length, extra_size, buffer_size);
@@ -1641,14 +1659,14 @@ static inline int rtnetlink_private_set(struct net_device *	dev,
        /* Does it fits in wrqu ? */
        if((descr->set_args & IW_PRIV_SIZE_FIXED) &&
           (extra_size <= IFNAMSIZ)) {
-                hdr_len = IW_EV_LCP_LEN + extra_size;
+                hdr_len = IW_EV_LCP_PK_LEN + extra_size;
                extra_size = 0;
        } else {
-                hdr_len = IW_EV_POINT_LEN;
+                hdr_len = IW_EV_POINT_PK_LEN;
        }
        /* Extract fixed header from request. This is properly aligned. */
-        wrqu = &request->u;
+        wrqu = (union iwreq_data *) (((char *) request) + IW_EV_LCP_PK_LEN);
        /* Check if wrqu is complete */
        if(request_len < hdr_len) {
@@ -1675,7 +1693,7 @@ static inline int rtnetlink_private_set(struct net_device *	dev,
                /* Put wrqu in the right place (skip pointer) */
                memcpy(((char *) &wrqu_point) + IW_EV_POINT_OFF,
-                       wrqu, IW_EV_POINT_LEN - IW_EV_LCP_LEN);
+                       wrqu, IW_EV_POINT_PK_LEN - IW_EV_LCP_PK_LEN);
                /* Does it fits within bounds ? */
                if(wrqu_point.data.length > (descr->set_args &
@@ -1738,7 +1756,7 @@ int wireless_rtnetlink_get(struct net_device *	dev,
        iw_handler              handler;
        /* Check length */
-        if(len < IW_EV_LCP_LEN) {
+        if(len < IW_EV_LCP_PK_LEN) {
                printk(KERN_DEBUG "%s (WE.r) : RtNetlink request too short (%d)\n",
                       dev->name, len);
                return -EINVAL;
@@ -1822,7 +1840,7 @@ int wireless_rtnetlink_set(struct net_device *	dev,
        iw_handler              handler;
        /* Check length */
-        if(len < IW_EV_LCP_LEN) {
+        if(len < IW_EV_LCP_PK_LEN) {
                printk(KERN_DEBUG "%s (WE.r) : RtNetlink request too short (%d)\n",
                       dev->name, len);
                return -EINVAL;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 5361a4d8e13b..746f79d104b3 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -545,12 +545,7 @@ static void ccid3_hc_tx_packet_recv(struct sock *sk, struct sk_buff *skb)
                /* set idle flag */
                hctx->ccid3hctx_idle = 1;
                break;
-        case TFRC_SSTATE_NO_SENT:
+        case TFRC_SSTATE_NO_SENT:       /* fall through */
-                /*
-                 * XXX when implementing bidirectional rx/tx check this again
-                 */
-                DCCP_WARN("Illegal ACK received - no packet sent\n");
-                /* fall through */
        case TFRC_SSTATE_TERM:          /* ignore feedback when closing */
                break;
        }
diff --git a/net/dccp/input.c b/net/dccp/input.c
index 287099f7f042..78b043c458bf 100644
--- a/net/dccp/input.c
+++ b/net/dccp/input.c
@@ -248,18 +248,8 @@ int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,
                            DCCP_ACKVEC_STATE_RECEIVED))
                goto discard;
-        /*
+        ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
-         * Deliver to the CCID module in charge.
+        ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-         * FIXME: Currently DCCP operates one-directional only, i.e. a listening
-         *        server is not at the same time a connecting client. There is
-         *        not much sense in delivering to both rx/tx sides at the moment
-         *        (only one is active at a time); when moving to bidirectional
-         *        service, this needs to be revised.
-         */
-        if (dccp_sk(sk)->dccps_role == DCCP_ROLE_CLIENT)
-                ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-        else    /* listening or connected server */
-                ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
        return __dccp_rcv_established(sk, skb, dh, len);
 discard:
@@ -494,11 +484,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb,
                                    DCCP_ACKVEC_STATE_RECEIVED))
                        goto discard;
-                /* XXX see the comments in dccp_rcv_established about this */
+                ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
-                if (dccp_sk(sk)->dccps_role == DCCP_ROLE_CLIENT)
+                ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-                        ccid_hc_tx_packet_recv(dp->dccps_hc_tx_ccid, sk, skb);
-                else
-                        ccid_hc_rx_packet_recv(dp->dccps_hc_rx_ccid, sk, skb);
        }
        /*
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 3282f2f2291b..aa21cc4de37f 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -213,19 +213,6 @@ do_interrupted:
        goto out;
 }
-static void dccp_write_xmit_timer(unsigned long data) {
-        struct sock *sk = (struct sock *)data;
-        struct dccp_sock *dp = dccp_sk(sk);
-        bh_lock_sock(sk);
-        if (sock_owned_by_user(sk))
-                sk_reset_timer(sk, &dp->dccps_xmit_timer, jiffies+1);
-        else
-                dccp_write_xmit(sk, 0);
-        bh_unlock_sock(sk);
-        sock_put(sk);
-}
 void dccp_write_xmit(struct sock *sk, int block)
 {
        struct dccp_sock *dp = dccp_sk(sk);
@@ -434,9 +421,6 @@ static inline void dccp_connect_init(struct sock *sk)
        dp->dccps_gar = dp->dccps_iss;
        icsk->icsk_retransmits = 0;
-        init_timer(&dp->dccps_xmit_timer);
-        dp->dccps_xmit_timer.data = (unsigned long)sk;
-        dp->dccps_xmit_timer.function = dccp_write_xmit_timer;
 }
 int dccp_connect(struct sock *sk)
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index cf28c53a389a..6607b7b14f34 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -575,7 +575,7 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
        if (get_user(len, optlen))
                return -EFAULT;
-        if (len < sizeof(int))
+        if (len < (int)sizeof(int))
                return -EINVAL;
        dp = dccp_sk(sk);
@@ -589,9 +589,11 @@ static int do_dccp_getsockopt(struct sock *sk, int level, int optname,
                                               (__be32 __user *)optval, optlen);
        case DCCP_SOCKOPT_SEND_CSCOV:
                val = dp->dccps_pcslen;
+                len = sizeof(val);
                break;
        case DCCP_SOCKOPT_RECV_CSCOV:
                val = dp->dccps_pcrlen;
+                len = sizeof(val);
                break;
        case 128 ... 191:
                return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname,
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index 41ea0f6594c4..0197a41c256a 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -261,8 +261,33 @@ out:
        sock_put(sk);
 }
+/* Transmit-delay timer: used by the CCIDs to delay actual send time */
+static void dccp_write_xmit_timer(unsigned long data)
+{
+        struct sock *sk = (struct sock *)data;
+        struct dccp_sock *dp = dccp_sk(sk);
+        bh_lock_sock(sk);
+        if (sock_owned_by_user(sk))
+                sk_reset_timer(sk, &dp->dccps_xmit_timer, jiffies+1);
+        else
+                dccp_write_xmit(sk, 0);
+        bh_unlock_sock(sk);
+        sock_put(sk);
+}
+static void dccp_init_write_xmit_timer(struct sock *sk)
+{
+        struct dccp_sock *dp = dccp_sk(sk);
+        init_timer(&dp->dccps_xmit_timer);
+        dp->dccps_xmit_timer.data = (unsigned long)sk;
+        dp->dccps_xmit_timer.function = dccp_write_xmit_timer;
+}
 void dccp_init_xmit_timers(struct sock *sk)
 {
+        dccp_init_write_xmit_timer(sk);
        inet_csk_init_xmit_timers(sk, &dccp_write_timer, &dccp_delack_timer,
                                  &dccp_keepalive_timer);
 }
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 3cbfddc98430..82d58a977e6f 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -63,7 +63,7 @@ static struct
 {
        int error;
        u8 scope;
-} dn_fib_props[RTA_MAX+1] = {
+} dn_fib_props[RTN_MAX+1] = {
        [RTN_UNSPEC] =      { .error = 0,       .scope = RT_SCOPE_NOWHERE },
        [RTN_UNICAST] =     { .error = 0,       .scope = RT_SCOPE_UNIVERSE },
        [RTN_LOCAL] =       { .error = 0,       .scope = RT_SCOPE_HOST },
@@ -276,6 +276,9 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct dn_kern_rta
        struct dn_fib_info *ofi;
        int nhs = 1;
+        if (r->rtm_type > RTN_MAX)
+                goto err_inval;
        if (dn_fib_props[r->rtm_type].scope > r->rtm_scope)
                goto err_inval;
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index b6c98ac93dc8..5e86dd542302 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -109,8 +109,6 @@ errout:
 static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = {
        FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .type = NLA_U16 },
-        [FRA_DST]       = { .type = NLA_U16 },
 };
 static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
@@ -133,7 +131,7 @@ static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
        int err = -EINVAL;
        struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
-        if (frh->src_len > 16 || frh->dst_len > 16 || frh->tos)
+        if (frh->tos)
                goto  errout;
        if (rule->table == RT_TABLE_UNSPEC) {
@@ -150,10 +148,10 @@ static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                }
        }
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                r->src = nla_get_le16(tb[FRA_SRC]);
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                r->dst = nla_get_le16(tb[FRA_DST]);
        r->src_len = frh->src_len;
@@ -176,10 +174,10 @@ static int dn_fib_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
        if (frh->dst_len && (r->dst_len != frh->dst_len))
                return 0;
-        if (tb[FRA_SRC] && (r->src != nla_get_le16(tb[FRA_SRC])))
+        if (frh->src_len && (r->src != nla_get_le16(tb[FRA_SRC])))
                return 0;
-        if (tb[FRA_DST] && (r->dst != nla_get_le16(tb[FRA_DST])))
+        if (frh->dst_len && (r->dst != nla_get_le16(tb[FRA_DST])))
                return 0;
        return 1;
@@ -249,6 +247,7 @@ int dn_fib_dump_rules(struct sk_buff *skb, struct netlink_callback *cb)
 static struct fib_rules_ops dn_fib_rules_ops = {
        .family         = AF_DECnet,
        .rule_size      = sizeof(struct dn_fib_rule),
+        .addr_size      = sizeof(u16),
        .action         = dn_fib_rule_action,
        .match          = dn_fib_rule_match,
        .configure      = dn_fib_rule_configure,
diff --git a/net/ieee80211/Kconfig b/net/ieee80211/Kconfig
index a64be6cdf078..6ef766ef9618 100644
--- a/net/ieee80211/Kconfig
+++ b/net/ieee80211/Kconfig
@@ -38,7 +38,7 @@ config IEEE80211_CRYPT_WEP
        Include software based cipher suites in support of IEEE
        802.11's WEP.  This is needed for WEP as well as 802.1x.
-        This can be compiled as a modules and it will be called
+        This can be compiled as a module and it will be called
        "ieee80211_crypt_wep".
 config IEEE80211_CRYPT_CCMP
@@ -51,7 +51,7 @@ config IEEE80211_CRYPT_CCMP
        (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with CCMP enabled
        networks.
-        This can be compiled as a modules and it will be called
+        This can be compiled as a module and it will be called
        "ieee80211_crypt_ccmp".
 config IEEE80211_CRYPT_TKIP
@@ -66,7 +66,7 @@ config IEEE80211_CRYPT_TKIP
        (aka TGi, WPA, WPA2, WPA-PSK, etc.) for use with TKIP enabled
        networks.
-        This can be compiled as a modules and it will be called
+        This can be compiled as a module and it will be called
        "ieee80211_crypt_tkip".
 source "net/ieee80211/softmac/Kconfig"
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index c976dd7e9758..2ce5b693a8bd 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1933,6 +1933,11 @@ int cipso_v4_skbuff_getattr(const struct sk_buff *skb,
                                                 &cipso_ptr[6],
                                                 secattr);
                break;
+        case CIPSO_V4_TAG_RANGE:
+                ret_val = cipso_v4_parsetag_rng(doi_def,
+                                                &cipso_ptr[6],
+                                                secattr);
+                break;
        }
 skbuff_getattr_return:
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index e10794dc5f64..98a00d0edc76 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -502,8 +502,10 @@ static struct in_ifaddr *rtm_to_ifaddr(struct nlmsghdr *nlh)
                goto errout;
        ifm = nlmsg_data(nlh);
-        if (ifm->ifa_prefixlen > 32 || tb[IFA_LOCAL] == NULL)
+        if (ifm->ifa_prefixlen > 32 || tb[IFA_LOCAL] == NULL) {
+                err = -EINVAL;
                goto errout;
+        }
        dev = __dev_get_by_index(ifm->ifa_index);
        if (dev == NULL) {
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 1fba6439fc57..fc920f63452b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -493,6 +493,11 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
        cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
        cfg->fc_nlinfo.nlh = nlh;
+        if (cfg->fc_type > RTN_MAX) {
+                err = -EINVAL;
+                goto errout;
+        }
        nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), remaining) {
                switch (attr->nla_type) {
                case RTA_DST:
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index b837c33e0404..c660c074c76c 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -171,8 +171,6 @@ static struct fib_table *fib_empty_table(void)
 static struct nla_policy fib4_rule_policy[FRA_MAX+1] __read_mostly = {
        FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .type = NLA_U32 },
-        [FRA_DST]       = { .type = NLA_U32 },
        [FRA_FLOW]      = { .type = NLA_U32 },
 };
@@ -183,8 +181,7 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
        int err = -EINVAL;
        struct fib4_rule *rule4 = (struct fib4_rule *) rule;
-        if (frh->src_len > 32 || frh->dst_len > 32 ||
+        if (frh->tos & ~IPTOS_TOS_MASK)
-            (frh->tos & ~IPTOS_TOS_MASK))
                goto errout;
        if (rule->table == RT_TABLE_UNSPEC) {
@@ -201,10 +198,10 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                }
        }
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                rule4->src = nla_get_be32(tb[FRA_SRC]);
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                rule4->dst = nla_get_be32(tb[FRA_DST]);
 #ifdef CONFIG_NET_CLS_ROUTE
@@ -242,10 +239,10 @@ static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
                return 0;
 #endif
-        if (tb[FRA_SRC] && (rule4->src != nla_get_be32(tb[FRA_SRC])))
+        if (frh->src_len && (rule4->src != nla_get_be32(tb[FRA_SRC])))
                return 0;
-        if (tb[FRA_DST] && (rule4->dst != nla_get_be32(tb[FRA_DST])))
+        if (frh->dst_len && (rule4->dst != nla_get_be32(tb[FRA_DST])))
                return 0;
        return 1;
@@ -309,6 +306,7 @@ static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib4_rules_ops = {
        .family         = AF_INET,
        .rule_size      = sizeof(struct fib4_rule),
+        .addr_size      = sizeof(u32),
        .action         = fib4_rule_action,
        .match          = fib4_rule_match,
        .configure      = fib4_rule_configure,
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 2f1fdae6efa6..3dad12ee76c3 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -89,7 +89,7 @@ static const struct
 {
        int     error;
        u8      scope;
-} fib_props[RTA_MAX + 1] = {
+} fib_props[RTN_MAX + 1] = {
        {
                .error  = 0,
                .scope  = RT_SCOPE_NOWHERE,
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 72b3036bbc09..214c34732e84 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1123,6 +1123,9 @@ err:
        return fa_head;
 }
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
 {
        struct trie *t = (struct trie *) tb->tb_data;
@@ -1527,7 +1530,6 @@ static int trie_leaf_remove(struct trie *t, t_key key)
        t->revision++;
        t->size--;
-        preempt_disable();
        tp = NODE_PARENT(n);
        tnode_free((struct tnode *) n);
@@ -1537,11 +1539,13 @@ static int trie_leaf_remove(struct trie *t, t_key key)
                rcu_assign_pointer(t->trie, trie_rebalance(t, tp));
        } else
                rcu_assign_pointer(t->trie, NULL);
-        preempt_enable();
        return 1;
 }
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
 {
        struct trie *t = (struct trie *) tb->tb_data;
@@ -1720,6 +1724,9 @@ up:
        return NULL; /* Ready. Root of trie */
 }
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_flush(struct fib_table *tb)
 {
        struct trie *t = (struct trie *) tb->tb_data;
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 1c6a084b5fb7..8cedb2a2c9df 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1255,9 +1255,9 @@ out:
 */
 void ip_mc_rejoin_group(struct ip_mc_list *im)
 {
+#ifdef CONFIG_IP_MULTICAST
        struct in_device *in_dev = im->interface;
-#ifdef CONFIG_IP_MULTICAST
        if (im->multiaddr == IGMP_ALL_HOSTS)
                return;
diff --git a/net/ipv4/netfilter/ip_nat_standalone.c b/net/ipv4/netfilter/ip_nat_standalone.c
index adf25f9f70e1..6bcfdf6dfcc9 100644
--- a/net/ipv4/netfilter/ip_nat_standalone.c
+++ b/net/ipv4/netfilter/ip_nat_standalone.c
@@ -253,14 +253,17 @@ ip_nat_local_fn(unsigned int hooknum,
                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
                if (ct->tuplehash[dir].tuple.dst.ip !=
-                    ct->tuplehash[!dir].tuple.src.ip
+                    ct->tuplehash[!dir].tuple.src.ip) {
-#ifdef CONFIG_XFRM
-                    || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[!dir].tuple.src.u.all
-#endif
-                    )
                        if (ip_route_me_harder(pskb, RTN_UNSPEC))
                                ret = NF_DROP;
+                }
+#ifdef CONFIG_XFRM
+                else if (ct->tuplehash[dir].tuple.dst.u.all !=
+                         ct->tuplehash[!dir].tuple.src.u.all)
+                        if (ip_xfrm_me_harder(pskb))
+                                ret = NF_DROP;
+#endif
        }
        return ret;
 }
diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
index e965b333c997..42b08029e867 100644
--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
+++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
@@ -411,12 +411,10 @@ checkentry(const char *tablename,
                                       "has invalid config pointer!\n");
                                return 0;
                        }
-                        clusterip_config_entry_get(cipinfo->config);
                } else {
                        /* Case B: This is a new rule referring to an existing
                         * clusterip config. */
                        cipinfo->config = config;
-                        clusterip_config_entry_get(cipinfo->config);
                }
        } else {
                /* Case C: This is a completely new clusterip config */
diff --git a/net/ipv4/netfilter/nf_nat_standalone.c b/net/ipv4/netfilter/nf_nat_standalone.c
index e4d3ef17d45b..15aa3db8cb33 100644
--- a/net/ipv4/netfilter/nf_nat_standalone.c
+++ b/net/ipv4/netfilter/nf_nat_standalone.c
@@ -245,14 +245,16 @@ nf_nat_local_fn(unsigned int hooknum,
                enum ip_conntrack_dir dir = CTINFO2DIR(ctinfo);
                if (ct->tuplehash[dir].tuple.dst.u3.ip !=
-                    ct->tuplehash[!dir].tuple.src.u3.ip
+                    ct->tuplehash[!dir].tuple.src.u3.ip) {
-#ifdef CONFIG_XFRM
-                    || ct->tuplehash[dir].tuple.dst.u.all !=
-                       ct->tuplehash[!dir].tuple.src.u.all
-#endif
-                    )
                        if (ip_route_me_harder(pskb, RTN_UNSPEC))
                                ret = NF_DROP;
+                }
+#ifdef CONFIG_XFRM
+                else if (ct->tuplehash[dir].tuple.dst.u.all !=
+                         ct->tuplehash[!dir].tuple.src.u.all)
+                        if (ip_xfrm_me_harder(pskb))
+                                ret = NF_DROP;
+#endif
        }
        return ret;
 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 74c4d103ebc2..3834b10b5115 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2458,11 +2458,18 @@ void __init tcp_init(void)
                sysctl_max_syn_backlog = 128;
        }
-        /* Allow no more than 3/4 kernel memory (usually less) allocated to TCP */
+        /* Set the pressure threshold to be a fraction of global memory that
-        sysctl_tcp_mem[0] = (1536 / sizeof (struct inet_bind_hashbucket)) << order;
+         * is up to 1/2 at 256 MB, decreasing toward zero with the amount of
-        sysctl_tcp_mem[1] = sysctl_tcp_mem[0] * 4 / 3;
+         * memory, with a floor of 128 pages.
+         */
+        limit = min(nr_all_pages, 1UL<<(28-PAGE_SHIFT)) >> (20-PAGE_SHIFT);
+        limit = (limit * (nr_all_pages >> (20-PAGE_SHIFT))) >> (PAGE_SHIFT-11);
+        limit = max(limit, 128UL);
+        sysctl_tcp_mem[0] = limit / 4 * 3;
+        sysctl_tcp_mem[1] = limit;
        sysctl_tcp_mem[2] = sysctl_tcp_mem[0] * 2;
+        /* Set per-socket limits to no more than 1/128 the pressure threshold */
        limit = ((unsigned long)sysctl_tcp_mem[1]) << (PAGE_SHIFT - 7);
        max_share = min(4UL*1024*1024, limit);
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index dc151139b5af..3c24881f2a65 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -943,7 +943,8 @@ static void tcp_cwnd_validate(struct sock *sk, struct tcp_sock *tp)
                if (tp->packets_out > tp->snd_cwnd_used)
                        tp->snd_cwnd_used = tp->packets_out;
-                if ((s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
+                if (sysctl_tcp_slow_start_after_idle &&
+                    (s32)(tcp_time_stamp - tp->snd_cwnd_stamp) >= inet_csk(sk)->icsk_rto)
                        tcp_cwnd_application_limited(sk);
        }
 }
@@ -1607,6 +1608,9 @@ u32 __tcp_select_window(struct sock *sk)
                 */
                if (window <= free_space - mss || window > free_space)
                        window = (free_space/mss)*mss;
+                else if (mss == full_space &&
+                         free_space > window + full_space/2)
+                        window = free_space;
        }
        return window;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index ce6c46034314..fc620a7c1db4 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1215,6 +1215,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
                if (ulen < sizeof(*uh) || pskb_trim_rcsum(skb, ulen))
                        goto short_packet;
+                uh = skb->h.uh;
                udp4_csum_init(skb, uh);
diff --git a/net/ipv4/xfrm4_mode_beet.c b/net/ipv4/xfrm4_mode_beet.c
index 89cf59ea7bbe..f68dfd8a0f5c 100644
--- a/net/ipv4/xfrm4_mode_beet.c
+++ b/net/ipv4/xfrm4_mode_beet.c
@@ -42,10 +42,9 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
        skb->nh.raw = skb_push(skb, x->props.header_len + hdrlen);
        top_iph = skb->nh.iph;
-        hdrlen = iph->ihl * 4 - optlen;
+        skb->h.raw += sizeof(*iph) - hdrlen;
-        skb->h.raw += hdrlen;
-        memmove(top_iph, iph, hdrlen);
+        memmove(top_iph, iph, sizeof(*iph));
        if (unlikely(optlen)) {
                struct ip_beet_phdr *ph;
@@ -55,6 +54,8 @@ static int xfrm4_beet_output(struct xfrm_state *x, struct sk_buff *skb)
                ph->padlen = 4 - (optlen & 4);
                ph->hdrlen = (optlen + ph->padlen + sizeof(*ph)) / 8;
                ph->nexthdr = top_iph->protocol;
+                if (ph->padlen)
+                        memset(ph + 1, IPOPT_NOP, ph->padlen);
                top_iph->protocol = IPPROTO_BEETPH;
                top_iph->ihl = sizeof(struct iphdr) / 4;
@@ -77,29 +78,32 @@ static int xfrm4_beet_input(struct xfrm_state *x, struct sk_buff *skb)
        protocol = iph->protocol;
        if (unlikely(iph->protocol == IPPROTO_BEETPH)) {
-                struct ip_beet_phdr *ph = (struct ip_beet_phdr*)(iph + 1);
+                struct ip_beet_phdr *ph;
                if (!pskb_may_pull(skb, sizeof(*ph)))
                        goto out;
+                ph = (struct ip_beet_phdr *)(skb->h.ipiph + 1);
-                phlen = ph->hdrlen * 8;
+                phlen = sizeof(*ph) + ph->padlen;
-                optlen = phlen - ph->padlen - sizeof(*ph);
+                optlen = ph->hdrlen * 8 - phlen;
                if (optlen < 0 || optlen & 3 || optlen > 250)
                        goto out;
-                if (!pskb_may_pull(skb, phlen))
+                if (!pskb_may_pull(skb, phlen + optlen))
                        goto out;
+                skb->len -= phlen + optlen;
                ph_nexthdr = ph->nexthdr;
        }
-        skb_push(skb, sizeof(*iph) - phlen + optlen);
+        skb->nh.raw = skb->data + (phlen - sizeof(*iph));
-        memmove(skb->data, skb->nh.raw, sizeof(*iph));
+        memmove(skb->nh.raw, iph, sizeof(*iph));
-        skb->nh.raw = skb->data;
+        skb->h.raw = skb->data + (phlen + optlen);
+        skb->data = skb->h.raw;
        iph = skb->nh.iph;
        iph->ihl = (sizeof(*iph) + optlen) / 4;
-        iph->tot_len = htons(skb->len);
+        iph->tot_len = htons(skb->len + iph->ihl * 4);
        iph->daddr = x->sel.daddr.a4;
        iph->saddr = x->sel.saddr.a4;
        if (ph_nexthdr)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e16f1bba5dff..7552663aa125 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -342,10 +342,9 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
        }
 #endif
-        if (netif_carrier_ok(dev))
+        if (netif_running(dev) && netif_carrier_ok(dev))
                ndev->if_flags |= IF_READY;
        ipv6_mc_init_dev(ndev);
        ndev->tstamp = jiffies;
 #ifdef CONFIG_SYSCTL
@@ -808,7 +807,7 @@ struct ipv6_saddr_score {
 #define IPV6_SADDR_SCORE_LABEL          0x0020
 #define IPV6_SADDR_SCORE_PRIVACY        0x0040
-static int inline ipv6_saddr_preferred(int type)
+static inline int ipv6_saddr_preferred(int type)
 {
        if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|
                    IPV6_ADDR_LOOPBACK|IPV6_ADDR_RESERVED))
@@ -817,7 +816,7 @@ static int inline ipv6_saddr_preferred(int type)
 }
 /* static matching label */
-static int inline ipv6_saddr_label(const struct in6_addr *addr, int type)
+static inline int ipv6_saddr_label(const struct in6_addr *addr, int type)
 {
 /*
  *     prefix (longest match)  label
@@ -3322,7 +3321,7 @@ errout:
                rtnl_set_sk_err(RTNLGRP_IPV6_IFADDR, err);
 }
-static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
+static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
                                __s32 *array, int bytes)
 {
        BUG_ON(bytes < (DEVCONF_MAX * 4));
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 0862809ffcf7..ea3035b4e3e8 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -131,8 +131,6 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
        FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .len = sizeof(struct in6_addr) },
-        [FRA_DST]       = { .len = sizeof(struct in6_addr) },
 };
 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
@@ -142,9 +140,6 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
        int err = -EINVAL;
        struct fib6_rule *rule6 = (struct fib6_rule *) rule;
-        if (frh->src_len > 128 || frh->dst_len > 128)
-                goto errout;
        if (rule->action == FR_ACT_TO_TBL) {
                if (rule->table == RT6_TABLE_UNSPEC)
                        goto errout;
@@ -155,11 +150,11 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                }
        }
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                nla_memcpy(&rule6->src.addr, tb[FRA_SRC],
                           sizeof(struct in6_addr));
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
                           sizeof(struct in6_addr));
@@ -186,11 +181,11 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
        if (frh->tos && (rule6->tclass != frh->tos))
                return 0;
-        if (tb[FRA_SRC] &&
+        if (frh->src_len &&
            nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
                return 0;
-        if (tb[FRA_DST] &&
+        if (frh->dst_len &&
            nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
                return 0;
@@ -240,6 +235,7 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib6_rules_ops = {
        .family                 = AF_INET6,
        .rule_size              = sizeof(struct fib6_rule),
+        .addr_size              = sizeof(struct in6_addr),
        .action                 = fib6_rule_action,
        .match                  = fib6_rule_match,
        .configure              = fib6_rule_configure,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f4d7be77eb0f..268f476ef3db 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -658,6 +658,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                ins = &iter->u.dst.rt6_next;
        }
+        /* Reset round-robin state, if necessary */
+        if (ins == &fn->leaf)
+                fn->rr_ptr = NULL;
        /*
         *      insert node
         */
@@ -1109,6 +1113,10 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
        rt6_stats.fib_rt_entries--;
        rt6_stats.fib_discarded_routes++;
+        /* Reset round-robin state, if necessary */
+        if (fn->rr_ptr == rt)
+                fn->rr_ptr = NULL;
        /* Adjust walkers */
        read_lock(&fib6_walker_lock);
        FOR_WALKERS(w) {
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 11bfc7c43182..61e7a6c8141d 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -108,8 +108,10 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
        /* pkt_len may be zero if Jumbo payload option is present */
        if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
-                if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
+                if (pkt_len + sizeof(struct ipv6hdr) > skb->len) {
-                        goto truncated;
+                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
+                        goto drop;
+                }
                if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) {
                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
                        goto drop;
@@ -128,8 +130,6 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
        rcu_read_unlock();
        return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
-truncated:
-        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 err:
        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
 drop:
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 286c86735aed..f5f9582a8d39 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -413,7 +413,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                }
                /* routing header option needs extra check */
-                if (optname == IPV6_RTHDR && opt->srcrt) {
+                if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                        struct ipv6_rt_hdr *rthdr = opt->srcrt;
                        switch (rthdr->type) {
                        case IPV6_SRCRT_TYPE_0:
@@ -795,12 +795,16 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(compat_ipv6_setsockopt);
 #endif
-static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
+static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
                                  char __user *optval, int len)
 {
-        if (!hdr)
+        struct ipv6_opt_hdr *hdr;
+        if (!opt || !opt->hopopt)
                return 0;
-        len = min_t(int, len, ipv6_optlen(hdr));
+        hdr = opt->hopopt;
+        len = min_t(unsigned int, len, ipv6_optlen(hdr));
        if (copy_to_user(optval, hdr, ipv6_optlen(hdr)))
                return -EFAULT;
        return len;
@@ -940,7 +944,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
        {
                lock_sock(sk);
-                len = ipv6_getsockopt_sticky(sk, np->opt->hopopt,
+                len = ipv6_getsockopt_sticky(sk, np->opt,
                                             optval, len);
                release_sock(sk);
                return put_user(len, optlen);
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 6f19c4a49560..d1102455668d 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -257,6 +257,7 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
                }
                nf_conntrack_get(reasm->nfct);
                (*pskb)->nfct = reasm->nfct;
+                (*pskb)->nfctinfo = reasm->nfctinfo;
                return NF_ACCEPT;
        }
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 306d5d83c068..203e069e7fe9 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -687,9 +687,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
        int err;
        /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
         */
-        if (len < 0)
+        if (len > INT_MAX)
                return -EMSGSIZE;
        /* Mirror BSD error message compatibility */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0e1f4b2cd3dd..ad9b285692ba 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -308,27 +308,18 @@ static inline void rt6_probe(struct rt6_info *rt)
 /*
 * Default Router Selection (RFC 2461 6.3.6)
 */
-static int inline rt6_check_dev(struct rt6_info *rt, int oif)
+static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 {
        struct net_device *dev = rt->rt6i_dev;
-        int ret = 0;
+        if (!oif || dev->ifindex == oif)
-        if (!oif)
-                return 2;
-        if (dev->flags & IFF_LOOPBACK) {
-                if (!WARN_ON(rt->rt6i_idev == NULL) &&
-                    rt->rt6i_idev->dev->ifindex == oif)
-                        ret = 1;
-                else
-                        return 0;
-        }
-        if (dev->ifindex == oif)
                return 2;
+        if ((dev->flags & IFF_LOOPBACK) &&
-        return ret;
+            rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
+                return 1;
+        return 0;
 }
-static int inline rt6_check_neigh(struct rt6_info *rt)
+static inline int rt6_check_neigh(struct rt6_info *rt)
 {
        struct neighbour *neigh = rt->rt6i_nexthop;
        int m = 0;
@@ -363,55 +354,76 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
        return m;
 }
-static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
+static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
-                                   int strict)
+                                   int *mpri, struct rt6_info *match)
+{
+        int m;
+        if (rt6_check_expired(rt))
+                goto out;
+        m = rt6_score_route(rt, oif, strict);
+        if (m < 0)
+                goto out;
+        if (m > *mpri) {
+                if (strict & RT6_LOOKUP_F_REACHABLE)
+                        rt6_probe(match);
+                *mpri = m;
+                match = rt;
+        } else if (strict & RT6_LOOKUP_F_REACHABLE) {
+                rt6_probe(rt);
+        }
+out:
+        return match;
+}
+static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+                                     struct rt6_info *rr_head,
+                                     u32 metric, int oif, int strict)
 {
-        struct rt6_info *match = NULL, *last = NULL;
+        struct rt6_info *rt, *match;
-        struct rt6_info *rt, *rt0 = *head;
-        u32 metric;
        int mpri = -1;
-        RT6_TRACE("%s(head=%p(*head=%p), oif=%d)\n",
+        match = NULL;
-                  __FUNCTION__, head, head ? *head : NULL, oif);
+        for (rt = rr_head; rt && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
+        for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
-        for (rt = rt0, metric = rt0->rt6i_metric;
+        return match;
-             rt && rt->rt6i_metric == metric && (!last || rt != rt0);
+}
-             rt = rt->u.dst.rt6_next) {
-                int m;
-                if (rt6_check_expired(rt))
+static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
-                        continue;
+{
+        struct rt6_info *match, *rt0;
-                last = rt;
+        RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n",
+                  __FUNCTION__, fn->leaf, oif);
-                m = rt6_score_route(rt, oif, strict);
+        rt0 = fn->rr_ptr;
-                if (m < 0)
+        if (!rt0)
-                        continue;
+                fn->rr_ptr = rt0 = fn->leaf;
-                if (m > mpri) {
+        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
-                        if (strict & RT6_LOOKUP_F_REACHABLE)
-                                rt6_probe(match);
-                        match = rt;
-                        mpri = m;
-                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
-                        rt6_probe(rt);
-                }
-        }
        if (!match &&
-            (strict & RT6_LOOKUP_F_REACHABLE) &&
+            (strict & RT6_LOOKUP_F_REACHABLE)) {
-            last && last != rt0) {
+                struct rt6_info *next = rt0->u.dst.rt6_next;
                /* no entries matched; do round-robin */
-                static DEFINE_SPINLOCK(lock);
+                if (!next || next->rt6i_metric != rt0->rt6i_metric)
-                spin_lock(&lock);
+                        next = fn->leaf;
-                *head = rt0->u.dst.rt6_next;
-                rt0->u.dst.rt6_next = last->u.dst.rt6_next;
+                if (next != rt0)
-                last->u.dst.rt6_next = rt0;
+                        fn->rr_ptr = next;
-                spin_unlock(&lock);
        }
-        RT6_TRACE("%s() => %p, score=%d\n",
+        RT6_TRACE("%s() => %p\n",
-                  __FUNCTION__, match, mpri);
+                  __FUNCTION__, match);
        return (match ? match : &ip6_null_entry);
 }
@@ -657,7 +669,7 @@ restart_2:
        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 restart:
-        rt = rt6_select(&fn->leaf, fl->iif, strict | reachable);
+        rt = rt6_select(fn, fl->iif, strict | reachable);
        BACKTRACK(&fl->fl6_src);
        if (rt == &ip6_null_entry ||
            rt->rt6i_flags & RTF_CACHE)
@@ -752,7 +764,7 @@ restart_2:
        fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 restart:
-        rt = rt6_select(&fn->leaf, fl->oif, strict | reachable);
+        rt = rt6_select(fn, fl->oif, strict | reachable);
        BACKTRACK(&fl->fl6_src);
        if (rt == &ip6_null_entry ||
            rt->rt6i_flags & RTF_CACHE)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f57a9baa6b27..92f99927d12d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
           First: no IPv4 options.
         */
        newinet->opt = NULL;
+        newnp->ipv6_fl_list = NULL;
        /* Clone RX bits */
        newnp->rxopt.all = np->rxopt.all;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 0ad471909881..f590db57a7c9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -615,7 +615,7 @@ do_udp_sendmsg:
                return udp_sendmsg(iocb, sk, msg, len);
        /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
           */
        if (len > INT_MAX - sizeof(struct udphdr))
                return -EMSGSIZE;
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index ee4b84a33ff4..93c42232aa39 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -58,7 +58,7 @@ static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
 static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
 static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
-static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
+static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
        unsigned h;
@@ -70,7 +70,7 @@ static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
        return h;
 }
-static unsigned inline xfrm6_tunnel_spi_hash_byspi(u32 spi)
+static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
 {
        return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index 873ae189e37a..bc2e15ce7004 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -419,7 +419,7 @@ typedef struct irnet_socket
  u32                   raccm;          /* to please pppd - dummy) */
  unsigned int          flags;          /* PPP flags (compression, ...) */
  unsigned int          rbits;          /* Unused receive flags ??? */
+  struct work_struct disconnect_work;   /* Process context disconnection */
  /* ------------------------ IrTTP part ------------------------ */
  /* We create a pseudo "socket" over the IrDA tranport */
  unsigned long         ttp_open;       /* Set when IrTTP is ready */
diff --git a/net/irda/irnet/irnet_irda.c b/net/irda/irnet/irnet_irda.c
index c378e668af0c..a4f1439ffdd8 100644
--- a/net/irda/irnet/irnet_irda.c
+++ b/net/irda/irnet/irnet_irda.c
@@ -10,6 +10,27 @@
 #include "irnet_irda.h"         /* Private header */
+/*
+ * PPP disconnect work: we need to make sure we're in
+ * process context when calling ppp_unregister_channel().
+ */
+static void irnet_ppp_disconnect(struct work_struct *work)
+{
+        irnet_socket * self =
+                container_of(work, irnet_socket, disconnect_work);
+        if (self == NULL)
+                return;
+        /*
+         * If we were connected, cleanup & close the PPP
+         * channel, which will kill pppd (hangup) and the rest.
+         */
+        if (self->ppp_open && !self->ttp_open && !self->ttp_connect) {
+                ppp_unregister_channel(&self->chan);
+                self->ppp_open = 0;
+        }
+}
 /************************* CONTROL CHANNEL *************************/
 /*
 * When ppp is not active, /dev/irnet act as a control channel.
@@ -499,6 +520,8 @@ irda_irnet_create(irnet_socket *	self)
 #endif /* DISCOVERY_NOMASK */
  self->tx_flow = FLOW_START;   /* Flow control from IrTTP */
+  INIT_WORK(&self->disconnect_work, irnet_ppp_disconnect);
  DEXIT(IRDA_SOCK_TRACE, "\n");
  return(0);
 }
@@ -1134,15 +1157,8 @@ irnet_disconnect_indication(void *	instance,
    {
      if(test_open)
        {
-#ifdef MISSING_PPP_API
+          /* ppp_unregister_channel() wants a user context. */
-          /* ppp_unregister_channel() wants a user context, which we
+          schedule_work(&self->disconnect_work);
-           * are guaranteed to NOT have here. What are we supposed
-           * to do here ? Jean II */
-          /* If we were connected, cleanup & close the PPP channel,
-           * which will kill pppd (hangup) and the rest */
-          ppp_unregister_channel(&self->chan);
-          self->ppp_open = 0;
-#endif
        }
      else
        {
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index a7486b3bddcb..da3f2bc1b6f6 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1455,6 +1455,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
        /* Not everything should be copied */
        new->notify.instance = instance;
+        spin_lock_init(&new->lock);
        init_timer(&new->todo_timer);
        skb_queue_head_init(&new->rx_queue);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 1c58204d767e..a4e7e2db0ff3 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -1467,9 +1467,6 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
        err = xfrm_state_delete(x);
-        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
-                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
        if (err < 0)
                goto out;
@@ -1478,6 +1475,8 @@ static int pfkey_delete(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
        c.event = XFRM_MSG_DELSA;
        km_state_notify(x, &c);
 out:
+        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
        xfrm_state_put(x);
        return err;
@@ -2294,14 +2293,12 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
        }
        xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN, pol->sadb_x_policy_dir-1,
-                                   &sel, tmp.security, 1);
+                                   &sel, tmp.security, 1, &err);
        security_xfrm_policy_free(&tmp);
        if (xp == NULL)
                return -ENOENT;
-        err = security_xfrm_policy_delete(xp);
        xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
                       AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
@@ -2539,7 +2536,7 @@ static int pfkey_migrate(struct sock *sk, struct sk_buff *skb,
 static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *hdr, void **ext_hdrs)
 {
        unsigned int dir;
-        int err;
+        int err = 0, delete;
        struct sadb_x_policy *pol;
        struct xfrm_policy *xp;
        struct km_event c;
@@ -2551,16 +2548,20 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
        if (dir >= XFRM_POLICY_MAX)
                return -EINVAL;
+        delete = (hdr->sadb_msg_type == SADB_X_SPDDELETE2);
        xp = xfrm_policy_byid(XFRM_POLICY_TYPE_MAIN, dir, pol->sadb_x_policy_id,
-                              hdr->sadb_msg_type == SADB_X_SPDDELETE2);
+                              delete, &err);
        if (xp == NULL)
                return -ENOENT;
-        err = 0;
+        if (delete) {
+                xfrm_audit_log(audit_get_loginuid(current->audit_context), 0,
+                               AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
-        c.seq = hdr->sadb_msg_seq;
+                if (err)
-        c.pid = hdr->sadb_msg_pid;
+                        goto out;
-        if (hdr->sadb_msg_type == SADB_X_SPDDELETE2) {
+                c.seq = hdr->sadb_msg_seq;
+                c.pid = hdr->sadb_msg_pid;
                c.data.byid = 1;
                c.event = XFRM_MSG_DELPOLICY;
                km_policy_notify(xp, dir, &c);
@@ -2568,6 +2569,7 @@ static int pfkey_spdget(struct sock *sk, struct sk_buff *skb, struct sadb_msg *h
                err = key_pol_get_resp(sk, xp, hdr, dir);
        }
+out:
        xfrm_pol_put(xp);
        return err;
 }
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 253fce3ad2d3..54698af6d0af 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -275,6 +275,7 @@ config NF_CT_NETLINK
        tristate 'Connection tracking netlink interface (EXPERIMENTAL)'
        depends on EXPERIMENTAL && NF_CONNTRACK && NETFILTER_NETLINK
        depends on NF_CONNTRACK!=y || NETFILTER_NETLINK!=m
+        depends on NF_NAT=n || NF_NAT
        help
          This option enables support for a netlink-based userspace interface
diff --git a/net/netfilter/nfnetlink_log.c b/net/netfilter/nfnetlink_log.c
index 91a0972ec117..5cb30ebba0f4 100644
--- a/net/netfilter/nfnetlink_log.c
+++ b/net/netfilter/nfnetlink_log.c
@@ -486,7 +486,7 @@ __build_packet_message(struct nfulnl_instance *inst,
                         * for physical device (when called from ipv4) */
                        NFA_PUT(inst->skb, NFULA_IFINDEX_OUTDEV,
                                sizeof(tmp_uint), &tmp_uint);
-                        if (skb->nf_bridge) {
+                        if (skb->nf_bridge && skb->nf_bridge->physoutdev) {
                                tmp_uint =
                                    htonl(skb->nf_bridge->physoutdev->ifindex);
                                NFA_PUT(inst->skb, NFULA_IFINDEX_PHYSOUTDEV,
@@ -615,7 +615,7 @@ nfulnl_log_packet(unsigned int pf,
        plen = 0;
        if (prefix)
-                plen = strlen(prefix);
+                plen = strlen(prefix) + 1;
        /* all macros expand to constant values at compile time */
        /* FIXME: do we want to make the size calculation conditional based on
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 8c34f1ca6c8c..f92d5310847b 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -700,23 +700,7 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
        unsigned char cause, diagnostic;
        struct net_device *dev;
        ax25_uid_assoc *user;
-        int n;
+        int n, err = 0;
-        if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
-                sock->state = SS_CONNECTED;
-                return 0;       /* Connect completed during a ERESTARTSYS event */
-        }
-        if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
-                sock->state = SS_UNCONNECTED;
-                return -ECONNREFUSED;
-        }
-        if (sk->sk_state == TCP_ESTABLISHED)
-                return -EISCONN;        /* No reconnect on a seqpacket socket */
-        sk->sk_state   = TCP_CLOSE;
-        sock->state = SS_UNCONNECTED;
        if (addr_len != sizeof(struct sockaddr_rose) && addr_len != sizeof(struct full_sockaddr_rose))
                return -EINVAL;
@@ -734,24 +718,53 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
        if ((rose->source_ndigis + addr->srose_ndigis) > ROSE_MAX_DIGIS)
                return -EINVAL;
+        lock_sock(sk);
+        if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
+                /* Connect completed during a ERESTARTSYS event */
+                sock->state = SS_CONNECTED;
+                goto out_release;
+        }
+        if (sk->sk_state == TCP_CLOSE && sock->state == SS_CONNECTING) {
+                sock->state = SS_UNCONNECTED;
+                err = -ECONNREFUSED;
+                goto out_release;
+        }
+        if (sk->sk_state == TCP_ESTABLISHED) {
+                /* No reconnect on a seqpacket socket */
+                err = -EISCONN;
+                goto out_release;
+        }
+        sk->sk_state   = TCP_CLOSE;
+        sock->state = SS_UNCONNECTED;
        rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause,
                                         &diagnostic);
        if (!rose->neighbour)
                return -ENETUNREACH;
        rose->lci = rose_new_lci(rose->neighbour);
-        if (!rose->lci)
+        if (!rose->lci) {
-                return -ENETUNREACH;
+                err = -ENETUNREACH;
+                goto out_release;
+        }
        if (sock_flag(sk, SOCK_ZAPPED)) {       /* Must bind first - autobinding in this may or may not work */
                sock_reset_flag(sk, SOCK_ZAPPED);
-                if ((dev = rose_dev_first()) == NULL)
+                if ((dev = rose_dev_first()) == NULL) {
-                        return -ENETUNREACH;
+                        err = -ENETUNREACH;
+                        goto out_release;
+                }
                user = ax25_findbyuid(current->euid);
-                if (!user)
+                if (!user) {
-                        return -EINVAL;
+                        err = -EINVAL;
+                        goto out_release;
+                }
                memcpy(&rose->source_addr, dev->dev_addr, ROSE_ADDR_LEN);
                rose->source_call = user->call;
@@ -789,8 +802,10 @@ rose_try_next_neigh:
        rose_start_t1timer(sk);
        /* Now the loop */
-        if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK))
+        if (sk->sk_state != TCP_ESTABLISHED && (flags & O_NONBLOCK)) {
-                return -EINPROGRESS;
+                err = -EINPROGRESS;
+                goto out_release;
+        }
        /*
         * A Connect Ack with Choke or timeout or failed routing will go to
@@ -805,8 +820,10 @@ rose_try_next_neigh:
                        set_current_state(TASK_INTERRUPTIBLE);
                        if (sk->sk_state != TCP_SYN_SENT)
                                break;
+                        release_sock(sk);
                        if (!signal_pending(tsk)) {
                                schedule();
+                                lock_sock(sk);
                                continue;
                        }
                        current->state = TASK_RUNNING;
@@ -822,14 +839,19 @@ rose_try_next_neigh:
                rose->neighbour = rose_get_neigh(&addr->srose_addr, &cause, &diagnostic);
                if (rose->neighbour)
                        goto rose_try_next_neigh;
-        /* No more neighbour */
+                /* No more neighbours */
                sock->state = SS_UNCONNECTED;
-                return sock_error(sk);  /* Always set at this point */
+                err = sock_error(sk);   /* Always set at this point */
+                goto out_release;
        }
        sock->state = SS_CONNECTED;
-        return 0;
+out_release:
+        release_sock(sk);
+        return err;
 }
 static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
@@ -877,6 +899,8 @@ static int rose_accept(struct socket *sock, struct socket *newsock, int flags)
                        lock_sock(sk);
                        continue;
                }
+                current->state = TASK_RUNNING;
+                remove_wait_queue(sk->sk_sleep, &wait);
                return -ERESTARTSYS;
        }
        current->state = TASK_RUNNING;
diff --git a/net/sched/Makefile b/net/sched/Makefile
index ff2d6e5e282c..020767a204d4 100644
--- a/net/sched/Makefile
+++ b/net/sched/Makefile
@@ -17,7 +17,6 @@ obj-$(CONFIG_NET_ACT_SIMP)	+= act_simple.o
 obj-$(CONFIG_NET_SCH_FIFO)      += sch_fifo.o
 obj-$(CONFIG_NET_SCH_CBQ)       += sch_cbq.o
 obj-$(CONFIG_NET_SCH_HTB)       += sch_htb.o
-obj-$(CONFIG_NET_SCH_HPFQ)      += sch_hpfq.o
 obj-$(CONFIG_NET_SCH_HFSC)      += sch_hfsc.o
 obj-$(CONFIG_NET_SCH_RED)       += sch_red.o
 obj-$(CONFIG_NET_SCH_GRED)      += sch_gred.o
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 68f26cb278f9..3e93683e9ab3 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -198,7 +198,7 @@ bad_mirred:
                skb2->tc_verd = SET_TC_FROM(skb2->tc_verd, at);
        skb2->dev = dev;
-        skb2->input_dev = skb->dev;
+        skb2->iif = skb->dev->ifindex;
        dev_queue_xmit(skb2);
        spin_unlock(&m->tcf_lock);
        return m->tcf_action;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index fad08e521c24..4a91f082a81d 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -81,6 +81,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f)
 static int basic_init(struct tcf_proto *tp)
 {
+        struct basic_head *head;
+        head = kzalloc(sizeof(*head), GFP_KERNEL);
+        if (head == NULL)
+                return -ENOBUFS;
+        INIT_LIST_HEAD(&head->flist);
+        tp->root = head;
        return 0;
 }
@@ -102,6 +109,7 @@ static void basic_destroy(struct tcf_proto *tp)
                list_del(&f->link);
                basic_delete_filter(tp, f);
        }
+        kfree(head);
 }
 static int basic_delete(struct tcf_proto *tp, unsigned long arg)
@@ -176,15 +184,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
        }
        err = -ENOBUFS;
-        if (head == NULL) {
-                head = kzalloc(sizeof(*head), GFP_KERNEL);
-                if (head == NULL)
-                        goto errout;
-                INIT_LIST_HEAD(&head->flist);
-                tp->root = head;
-        }
        f = kzalloc(sizeof(*f), GFP_KERNEL);
        if (f == NULL)
                goto errout;
diff --git a/net/sched/cls_route.c b/net/sched/cls_route.c
index e85df07d8ce7..abc47cc48ad0 100644
--- a/net/sched/cls_route.c
+++ b/net/sched/cls_route.c
@@ -93,7 +93,7 @@ void route4_reset_fastmap(struct net_device *dev, struct route4_head *head, u32
        spin_unlock_bh(&dev->queue_lock);
 }
-static void __inline__
+static inline void
 route4_set_fastmap(struct route4_head *head, u32 id, int iif,
                   struct route4_filter *f)
 {
diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
index 040e2d2d281a..7563fdcef4b7 100644
--- a/net/sched/cls_tcindex.c
+++ b/net/sched/cls_tcindex.c
@@ -245,9 +245,9 @@ tcindex_set_parms(struct tcf_proto *tp, unsigned long base, u32 handle,
        }
        if (tb[TCA_TCINDEX_SHIFT-1]) {
-                if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(u16))
+                if (RTA_PAYLOAD(tb[TCA_TCINDEX_SHIFT-1]) < sizeof(int))
                        goto errout;
-                cp.shift = *(u16 *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]);
+                cp.shift = *(int *) RTA_DATA(tb[TCA_TCINDEX_SHIFT-1]);
        }
        err = -EBUSY;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 396deb71480f..407c6fb1ba14 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1184,10 +1184,12 @@ hfsc_delete_class(struct Qdisc *sch, unsigned long arg)
        sch_tree_lock(sch);
-        list_del(&cl->hlist);
        list_del(&cl->siblings);
        hfsc_adjust_levels(cl->cl_parent);
        hfsc_purge_queue(sch, cl);
+        list_del(&cl->hlist);
        if (--cl->refcnt == 0)
                hfsc_destroy_class(sch, cl);
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 97cbb9aec946..3c3294d01041 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1380,15 +1380,15 @@ static int htb_delete(struct Qdisc *sch, unsigned long arg)
        sch_tree_lock(sch);
-        /* delete from hash and active; remainder in destroy_class */
-        hlist_del_init(&cl->hlist);
        if (!cl->level) {
                qlen = cl->un.leaf.q->q.qlen;
                qdisc_reset(cl->un.leaf.q);
                qdisc_tree_decrease_qlen(cl->un.leaf.q, qlen);
        }
+        /* delete from hash and active; remainder in destroy_class */
+        hlist_del_init(&cl->hlist);
        if (cl->prio_activity)
                htb_deactivate(q, cl);
diff --git a/net/sctp/associola.c b/net/sctp/associola.c
index fa82b73c965b..78d2ddb5ca18 100644
--- a/net/sctp/associola.c
+++ b/net/sctp/associola.c
@@ -1046,6 +1046,9 @@ void sctp_assoc_update(struct sctp_association *asoc,
                trans = list_entry(pos, struct sctp_transport, transports);
                if (!sctp_assoc_lookup_paddr(new, &trans->ipaddr))
                        sctp_assoc_del_peer(asoc, &trans->ipaddr);
+                if (asoc->state >= SCTP_STATE_ESTABLISHED)
+                        sctp_transport_reset(trans);
        }
        /* If the case is A (association restart), use
@@ -1063,6 +1066,18 @@ void sctp_assoc_update(struct sctp_association *asoc,
                 */
                sctp_ssnmap_clear(asoc->ssnmap);
+                /* Flush the ULP reassembly and ordered queue.
+                 * Any data there will now be stale and will
+                 * cause problems.
+                 */
+                sctp_ulpq_flush(&asoc->ulpq);
+                /* reset the overall association error count so
+                 * that the restarted association doesn't get torn
+                 * down on the next retransmission timer.
+                 */
+                asoc->overall_error_count = 0;
        } else {
                /* Add any peer addresses from the new association. */
                list_for_each(pos, &new->peer.transport_addr_list) {
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 63fe1093b616..0b9c49b3a100 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -360,7 +360,7 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
                return;
        }
-        read_lock(&in6_dev->lock);
+        read_lock_bh(&in6_dev->lock);
        for (ifp = in6_dev->addr_list; ifp; ifp = ifp->if_next) {
                /* Add the address to the local list.  */
                addr = t_new(struct sctp_sockaddr_entry, GFP_ATOMIC);
@@ -374,7 +374,7 @@ static void sctp_v6_copy_addrlist(struct list_head *addrlist,
                }
        }
-        read_unlock(&in6_dev->lock);
+        read_unlock_bh(&in6_dev->lock);
        rcu_read_unlock();
 }
diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
index 70c39eac0581..e9097cf614ba 100644
--- a/net/sctp/sm_statefuns.c
+++ b/net/sctp/sm_statefuns.c
@@ -4342,8 +4342,24 @@ sctp_disposition_t sctp_sf_do_prm_requestheartbeat(
                                        void *arg,
                                        sctp_cmd_seq_t *commands)
 {
-        return sctp_sf_heartbeat(ep, asoc, type, (struct sctp_transport *)arg,
+        if (SCTP_DISPOSITION_NOMEM == sctp_sf_heartbeat(ep, asoc, type,
-                                 commands);
+                                      (struct sctp_transport *)arg, commands))
+                return SCTP_DISPOSITION_NOMEM;
+        /*
+         * RFC 2960 (bis), section 8.3
+         *
+         *    D) Request an on-demand HEARTBEAT on a specific destination
+         *    transport address of a given association.
+         *
+         *    The endpoint should increment the respective error  counter of
+         *    the destination transport address each time a HEARTBEAT is sent
+         *    to that address and not acknowledged within one RTO.
+         *
+         */
+        sctp_add_cmd_sf(commands, SCTP_CMD_TRANSPORT_RESET,
+                        SCTP_TRANSPORT(arg));
+        return SCTP_DISPOSITION_CONSUME;
 }
 /*
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index a596f5308cb1..4d8c2ab864fc 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -526,3 +526,35 @@ unsigned long sctp_transport_timeout(struct sctp_transport *t)
        timeout += jiffies;
        return timeout;
 }
+/* Reset transport variables to their initial values */
+void sctp_transport_reset(struct sctp_transport *t)
+{
+        struct sctp_association *asoc = t->asoc;
+        /* RFC 2960 (bis), Section 5.2.4
+         * All the congestion control parameters (e.g., cwnd, ssthresh)
+         * related to this peer MUST be reset to their initial values
+         * (see Section 6.2.1)
+         */
+        t->cwnd = min(4*asoc->pathmtu, max_t(__u32, 2*asoc->pathmtu, 4380));
+        t->ssthresh = asoc->peer.i.a_rwnd;
+        t->rto = asoc->rto_initial;
+        t->rtt = 0;
+        t->srtt = 0;
+        t->rttvar = 0;
+        /* Reset these additional varibles so that we have a clean
+         * slate.
+         */
+        t->partial_bytes_acked = 0;
+        t->flight_size = 0;
+        t->error_count = 0;
+        t->rto_pending = 0;
+        /* Initialize the state information for SFR-CACC */
+        t->cacc.changeover_active = 0;
+        t->cacc.cycling_changeover = 0;
+        t->cacc.next_tsn_at_change = 0;
+        t->cacc.cacc_saw_newack = 0;
+}
diff --git a/net/sctp/ulpqueue.c b/net/sctp/ulpqueue.c
index f4759a9bdaee..bfb197e37da3 100644
--- a/net/sctp/ulpqueue.c
+++ b/net/sctp/ulpqueue.c
@@ -73,7 +73,7 @@ struct sctp_ulpq *sctp_ulpq_init(struct sctp_ulpq *ulpq,
 /* Flush the reassembly and ordering queues.  */
-static void sctp_ulpq_flush(struct sctp_ulpq *ulpq)
+void sctp_ulpq_flush(struct sctp_ulpq *ulpq)
 {
        struct sk_buff *skb;
        struct sctp_ulpevent *event;
diff --git a/net/socket.c b/net/socket.c
index 9566e57ac7f5..ea8f81abc45c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
        err = sock_attach_fd(newsock, newfile);
        if (err < 0)
-                goto out_fd;
+                goto out_fd_simple;
        err = security_socket_accept(sock, newsock);
        if (err)
@@ -1414,6 +1414,11 @@ out_put:
        fput_light(sock->file, fput_needed);
 out:
        return err;
+out_fd_simple:
+        sock_release(newsock);
+        put_filp(newfile);
+        put_unused_fd(newfd);
+        goto out_put;
 out_fd:
        fput(newfile);
        put_unused_fd(newfd);
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index f6e1eb1ea720..593f62ff8521 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -779,8 +779,8 @@ svc_udp_recvfrom(struct svc_rqst *rqstp)
        }
        clear_bit(SK_DATA, &svsk->sk_flags);
-        while ((err == kernel_recvmsg(svsk->sk_sock, &msg, NULL,
+        while ((err = kernel_recvmsg(svsk->sk_sock, &msg, NULL,
-                                      0, 0, MSG_PEEK | MSG_DONTWAIT)) < 0 ||
+                                     0, 0, MSG_PEEK | MSG_DONTWAIT)) < 0 ||
               (skb = skb_recv_datagram(svsk->sk_sk, 0, 1, &err)) == NULL) {
                if (err == -EAGAIN) {
                        svc_sock_received(svsk);
diff --git a/net/wanrouter/af_wanpipe.c b/net/wanrouter/af_wanpipe.c
deleted file mode 100644
index 41d7e32be70d..000000000000
--- a/net/wanrouter/af_wanpipe.c
+++ /dev/null
@@ -1,2600 +0,0 @@
-/*****************************************************************************
-* af_wanpipe.c  WANPIPE(tm) Secure Socket Layer.
-*
-* Author:       Nenad Corbic    <ncorbic@sangoma.com>
-*
-* Copyright:    (c) 2000 Sangoma Technologies Inc.
-*
-*               This program is free software; you can redistribute it and/or
-*               modify it under the terms of the GNU General Public License
-*               as published by the Free Software Foundation; either version
-*               2 of the License, or (at your option) any later version.
-* ============================================================================
-* Due Credit:
-*               Wanpipe socket layer is based on Packet and
-*               the X25 socket layers. The above sockets were
-*               used for the specific use of Sangoma Technologies
-*               API programs.
-*               Packet socket Authors: Ross Biro, Fred N. van Kempen and
-*                                      Alan Cox.
-*               X25 socket Author: Jonathan Naylor.
-* ============================================================================
-* Mar 15, 2002  Arnaldo C. Melo  o Use wp_sk()->num, as it isnt anymore in sock
-* Apr 25, 2000  Nenad Corbic     o Added the ability to send zero length packets.
-* Mar 13, 2000  Nenad Corbic     o Added a tx buffer check via ioctl call.
-* Mar 06, 2000  Nenad Corbic     o Fixed the corrupt sock lcn problem.
-*                                  Server and client application can run
-*                                  simultaneously without conflicts.
-* Feb 29, 2000  Nenad Corbic     o Added support for PVC protocols, such as
-*                                  CHDLC, Frame Relay and HDLC API.
-* Jan 17, 2000  Nenad Corbic     o Initial version, based on AF_PACKET socket.
-*                                  X25API support only.
-*
-******************************************************************************/
-#include <linux/types.h>
-#include <linux/sched.h>
-#include <linux/mm.h>
-#include <linux/capability.h>
-#include <linux/fcntl.h>
-#include <linux/socket.h>
-#include <linux/in.h>
-#include <linux/inet.h>
-#include <linux/netdevice.h>
-#include <linux/poll.h>
-#include <linux/wireless.h>
-#include <linux/kmod.h>
-#include <net/ip.h>
-#include <net/protocol.h>
-#include <linux/skbuff.h>
-#include <net/sock.h>
-#include <linux/errno.h>
-#include <linux/timer.h>
-#include <asm/system.h>
-#include <asm/uaccess.h>
-#include <linux/module.h>
-#include <linux/init.h>
-#include <linux/if_wanpipe.h>
-#include <linux/pkt_sched.h>
-#include <linux/tcp_states.h>
-#include <linux/if_wanpipe_common.h>
-#ifdef CONFIG_INET
-#include <net/inet_common.h>
-#endif
-#define SLOW_BACKOFF 0.1*HZ
-#define FAST_BACKOFF 0.01*HZ
-//#define PRINT_DEBUG
-#ifdef PRINT_DEBUG
-        #define DBG_PRINTK(format, a...) printk(format, ## a)
-#else
-        #define DBG_PRINTK(format, a...)
-#endif
-/* SECURE SOCKET IMPLEMENTATION
- *
- *   TRANSMIT:
- *
- *      When the user sends a packet via send() system call
- *      the wanpipe_sendmsg() function is executed.
- *
- *      Each packet is enqueud into sk->sk_write_queue transmit
- *      queue. When the packet is enqueued, a delayed transmit
- *      timer is triggerd which acts as a Bottom Half hander.
- *
- *      wanpipe_delay_transmit() function (BH), dequeues packets
- *      from the sk->sk_write_queue transmit queue and sends it
- *      to the deriver via dev->hard_start_xmit(skb, dev) function.
- *      Note, this function is actual a function pointer of if_send()
- *      routine in the wanpipe driver.
- *
- *      X25API GUARANTEED DELIVERY:
- *
- *         In order to provide 100% guaranteed packet delivery,
- *         an atomic 'packet_sent' counter is implemented.  Counter
- *         is incremented for each packet enqueued
- *         into sk->sk_write_queue.  Counter is decremented each
- *         time wanpipe_delayed_transmit() function successfuly
- *         passes the packet to the driver. Before each send(), a poll
- *         routine checks the sock resources The maximum value of
- *         packet sent counter is 1, thus if one packet is queued, the
- *         application will block until that packet is passed to the
- *         driver.
- *
- *   RECEIVE:
- *
- *      Wanpipe device drivers call the socket bottom half
- *      function, wanpipe_rcv() to queue the incoming packets
- *      into an AF_WANPIPE socket queue.  Based on wanpipe_rcv()
- *      return code, the driver knows whether the packet was
- *      successfully queued.  If the socket queue is full,
- *      protocol flow control is used by the driver, if any,
- *      to slow down the traffic until the sock queue is free.
- *
- *      Every time a packet arrives into a socket queue the
- *      socket wakes up processes which are waiting to receive
- *      data.
- *
- *      If the socket queue is full, the driver sets a block
- *      bit which signals the socket to kick the wanpipe driver
- *      bottom half hander when the socket queue is partialy
- *      empty. wanpipe_recvmsg() function performs this action.
- *
- *      In case of x25api, packets will never be dropped, since
- *      flow control is available.
- *
- *      In case of streaming protocols like CHDLC, packets will
- *      be dropped but the statistics will be generated.
- */
-/* The code below is used to test memory leaks. It prints out
- * a message every time kmalloc and kfree system calls get executed.
- * If the calls match there is no leak :)
- */
-/***********FOR DEBUGGING PURPOSES*********************************************
-#define KMEM_SAFETYZONE 8
-static void * dbg_kmalloc(unsigned int size, int prio, int line) {
-        void * v = kmalloc(size,prio);
-        printk(KERN_INFO "line %d  kmalloc(%d,%d) = %p\n",line,size,prio,v);
-        return v;
-}
-static void dbg_kfree(void * v, int line) {
-        printk(KERN_INFO "line %d  kfree(%p)\n",line,v);
-        kfree(v);
-}
-#define kmalloc(x,y) dbg_kmalloc(x,y,__LINE__)
-#define kfree(x) dbg_kfree(x,__LINE__)
-******************************************************************************/
-/* List of all wanpipe sockets. */
-HLIST_HEAD(wanpipe_sklist);
-static DEFINE_RWLOCK(wanpipe_sklist_lock);
-atomic_t wanpipe_socks_nr;
-static unsigned long wanpipe_tx_critical;
-#if 0
-/* Private wanpipe socket structures. */
-struct wanpipe_opt
-{
-        void   *mbox;           /* Mail box  */
-        void   *card;           /* Card bouded to */
-        struct net_device *dev; /* Bounded device */
-        unsigned short lcn;     /* Binded LCN */
-        unsigned char  svc;     /* 0=pvc, 1=svc */
-        unsigned char  timer;   /* flag for delayed transmit*/
-        struct timer_list tx_timer;
-        unsigned poll_cnt;
-        unsigned char force;    /* Used to force sock release */
-        atomic_t packet_sent;
-};
-#endif
-static int sk_count;
-extern const struct proto_ops wanpipe_ops;
-static unsigned long find_free_critical;
-static void wanpipe_unlink_driver(struct sock *sk);
-static void wanpipe_link_driver(struct net_device *dev, struct sock *sk);
-static void wanpipe_wakeup_driver(struct sock *sk);
-static int execute_command(struct sock *, unsigned char, unsigned int);
-static int check_dev(struct net_device *dev, sdla_t *card);
-struct net_device *wanpipe_find_free_dev(sdla_t *card);
-static void wanpipe_unlink_card (struct sock *);
-static int wanpipe_link_card (struct sock *);
-static struct sock *wanpipe_make_new(struct sock *);
-static struct sock *wanpipe_alloc_socket(void);
-static inline int get_atomic_device(struct net_device *dev);
-static int wanpipe_exec_cmd(struct sock *, int, unsigned int);
-static int get_ioctl_cmd (struct sock *, void *);
-static int set_ioctl_cmd (struct sock *, void *);
-static void release_device(struct net_device *dev);
-static void wanpipe_kill_sock_timer (unsigned long data);
-static void wanpipe_kill_sock_irq (struct sock *);
-static void wanpipe_kill_sock_accept (struct sock *);
-static int wanpipe_do_bind(struct sock *sk, struct net_device *dev,
-                           int protocol);
-struct sock * get_newsk_from_skb (struct sk_buff *);
-static int wanpipe_debug (struct sock *, void *);
-static void wanpipe_delayed_transmit (unsigned long data);
-static void release_driver(struct sock *);
-static void start_cleanup_timer (struct sock *);
-static void check_write_queue(struct sock *);
-static int check_driver_busy (struct sock *);
-/*============================================================
- * wanpipe_rcv
- *
- *      Wanpipe socket bottom half handler.  This function
- *      is called by the WANPIPE device drivers to queue a
- *      incoming packet into the socket receive queue.
- *      Once the packet is queued, all processes waiting to
- *      read are woken up.
- *
- *      During socket bind, this function is bounded into
- *      WANPIPE driver private.
- *===========================================================*/
-static int wanpipe_rcv(struct sk_buff *skb, struct net_device *dev,
-                       struct sock *sk)
-{
-        struct wan_sockaddr_ll *sll = (struct wan_sockaddr_ll*)skb->cb;
-        wanpipe_common_t *chan = dev->priv;
-        /*
-         *      When we registered the protocol we saved the socket in the data
-         *      field for just this event.
-         */
-        skb->dev = dev;
-        sll->sll_family = AF_WANPIPE;
-        sll->sll_hatype = dev->type;
-        sll->sll_protocol = skb->protocol;
-        sll->sll_pkttype = skb->pkt_type;
-        sll->sll_ifindex = dev->ifindex;
-        sll->sll_halen = 0;
-        if (dev->hard_header_parse)
-                sll->sll_halen = dev->hard_header_parse(skb, sll->sll_addr);
-        /*
-         * WAN_PACKET_DATA : Data which should be passed up the receive queue.
-         * WAN_PACKET_ASYC : Asynchronous data like place call, which should
-         *                   be passed up the listening sock.
-         * WAN_PACKET_ERR  : Asynchronous data like clear call or restart
-         *                   which should go into an error queue.
-         */
-        switch (skb->pkt_type){
-                case WAN_PACKET_DATA:
-                        if (sock_queue_rcv_skb(sk,skb)<0){
-                                return -ENOMEM;
-                        }
-                        break;
-                case WAN_PACKET_CMD:
-                        sk->sk_state = chan->state;
-                        /* Bug fix: update Mar6.
-                         * Do not set the sock lcn number here, since
-                         * cmd is not guaranteed to be executed on the
-                         * board, thus Lcn could be wrong */
-                        sk->sk_data_ready(sk, skb->len);
-                        kfree_skb(skb);
-                        break;
-                case WAN_PACKET_ERR:
-                        sk->sk_state = chan->state;
-                        if (sock_queue_err_skb(sk,skb)<0){
-                                return -ENOMEM;
-                        }
-                        break;
-                default:
-                        printk(KERN_INFO "wansock: BH Illegal Packet Type Dropping\n");
-                        kfree_skb(skb);
-                        break;
-        }
-//??????????????????????
-//      if (sk->sk_state == WANSOCK_DISCONNECTED){
-//              if (sk->sk_zapped) {
-//                      //printk(KERN_INFO "wansock: Disconnected, killing early\n");
-//                      wanpipe_unlink_driver(sk);
-//                      sk->sk_bound_dev_if = 0;
-//              }
-//      }
-        return 0;
-}
-/*============================================================
- * wanpipe_listen_rcv
- *
- *      Wanpipe LISTEN socket bottom half handler.  This function
- *      is called by the WANPIPE device drivers to queue an
- *      incoming call into the socket listening queue.
- *      Once the packet is queued, the waiting accept() process
- *      is woken up.
- *
- *      During socket bind, this function is bounded into
- *      WANPIPE driver private.
- *
- *      IMPORTANT NOTE:
- *          The accept call() is waiting for an skb packet
- *          which contains a pointer to a device structure.
- *
- *          When we do a bind to a device structre, we
- *          bind a newly created socket into "chan->sk".  Thus,
- *          when accept receives the skb packet, it will know
- *          from which dev it came form, and in turn it will know
- *          the address of the new sock.
- *
- *      NOTE: This function gets called from driver ISR.
- *===========================================================*/
-static int wanpipe_listen_rcv (struct sk_buff *skb,  struct sock *sk)
-{
-        wanpipe_opt *wp = wp_sk(sk), *newwp;
-        struct wan_sockaddr_ll *sll = (struct wan_sockaddr_ll*)skb->cb;
-        struct sock *newsk;
-        struct net_device *dev;
-        sdla_t *card;
-        mbox_cmd_t *mbox_ptr;
-        wanpipe_common_t *chan;
-        /* Find a free device, if none found, all svc's are busy
-         */
-        card = (sdla_t*)wp->card;
-        if (!card){
-                printk(KERN_INFO "wansock: LISTEN ERROR, No Card\n");
-                return -ENODEV;
-        }
-        dev = wanpipe_find_free_dev(card);
-        if (!dev){
-                printk(KERN_INFO "wansock: LISTEN ERROR, No Free Device\n");
-                return -ENODEV;
-        }
-        chan=dev->priv;
-        chan->state = WANSOCK_CONNECTING;
-        /* Allocate a new sock, which accept will bind
-         * and pass up to the user
-         */
-        if ((newsk = wanpipe_make_new(sk)) == NULL){
-                release_device(dev);
-                return -ENOMEM;
-        }
-        /* Initialize the new sock structure
-         */
-        newsk->sk_bound_dev_if = dev->ifindex;
-        newwp = wp_sk(newsk);
-        newwp->card = wp->card;
-        /* Insert the sock into the main wanpipe
-         * sock list.
-         */
-        atomic_inc(&wanpipe_socks_nr);
-        /* Allocate and fill in the new Mail Box. Then
-         * bind the mail box to the sock. It will be
-         * used by the ioctl call to read call information
-         * and to execute commands.
-         */
-        if ((mbox_ptr = kzalloc(sizeof(mbox_cmd_t), GFP_ATOMIC)) == NULL) {
-                wanpipe_kill_sock_irq (newsk);
-                release_device(dev);
-                return -ENOMEM;
-        }
-        memcpy(mbox_ptr,skb->data,skb->len);
-        /* Register the lcn on which incoming call came
-         * from. Thus, if we have to clear it, we know
-         * which lcn to clear
-         */
-        newwp->lcn = mbox_ptr->cmd.lcn;
-        newwp->mbox = (void *)mbox_ptr;
-        DBG_PRINTK(KERN_INFO "NEWSOCK : Device %s, bind to lcn %i\n",
-                        dev->name,mbox_ptr->cmd.lcn);
-        chan->lcn = mbox_ptr->cmd.lcn;
-        card->u.x.svc_to_dev_map[(chan->lcn%MAX_X25_LCN)] = dev;
-        sock_reset_flag(newsk, SOCK_ZAPPED);
-        newwp->num = htons(X25_PROT);
-        if (wanpipe_do_bind(newsk, dev, newwp->num)) {
-                wanpipe_kill_sock_irq (newsk);
-                release_device(dev);
-                return -EINVAL;
-        }
-        newsk->sk_state = WANSOCK_CONNECTING;
-        /* Fill in the standard sock address info */
-        sll->sll_family = AF_WANPIPE;
-        sll->sll_hatype = dev->type;
-        sll->sll_protocol = skb->protocol;
-        sll->sll_pkttype = skb->pkt_type;
-        sll->sll_ifindex = dev->ifindex;
-        sll->sll_halen = 0;
-        skb->dev = dev;
-        sk->sk_ack_backlog++;
-        /* We must do this manually, since the sock_queue_rcv_skb()
-         * function sets the skb->dev to NULL.  However, we use
-         * the dev field in the accept function.*/
-        if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
-            (unsigned)sk->sk_rcvbuf) {
-                wanpipe_unlink_driver(newsk);
-                wanpipe_kill_sock_irq (newsk);
-                --sk->sk_ack_backlog;
-                return -ENOMEM;
-        }
-        skb_set_owner_r(skb, sk);
-        skb_queue_tail(&sk->sk_receive_queue, skb);
-        sk->sk_data_ready(sk, skb->len);
-        return 0;
-}
-/*============================================================
- * wanpipe_make_new
- *
- *      Create a new sock, and allocate a wanpipe private
- *      structure to it. Also, copy the important data
- *      from the original sock to the new sock.
- *
- *      This function is used by wanpipe_listen_rcv() listen
- *      bottom half handler.  A copy of the listening sock
- *      is created using this function.
- *
- *===========================================================*/
-static struct sock *wanpipe_make_new(struct sock *osk)
-{
-        struct sock *sk;
-        if (osk->sk_type != SOCK_RAW)
-                return NULL;
-        if ((sk = wanpipe_alloc_socket()) == NULL)
-                return NULL;
-        sk->sk_type     = osk->sk_type;
-        sk->sk_socket   = osk->sk_socket;
-        sk->sk_priority = osk->sk_priority;
-        sk->sk_protocol = osk->sk_protocol;
-        wp_sk(sk)->num  = wp_sk(osk)->num;
-        sk->sk_rcvbuf   = osk->sk_rcvbuf;
-        sk->sk_sndbuf   = osk->sk_sndbuf;
-        sk->sk_state    = WANSOCK_CONNECTING;
-        sk->sk_sleep    = osk->sk_sleep;
-        if (sock_flag(osk, SOCK_DBG))
-                sock_set_flag(sk, SOCK_DBG);
-        return sk;
-}
-/*
- * FIXME: wanpipe_opt has to include a sock in its definition and stop using
- * sk_protinfo, but this code is not even compilable now, so lets leave it for
- * later.
- */
-static struct proto wanpipe_proto = {
-        .name     = "WANPIPE",
-        .owner    = THIS_MODULE,
-        .obj_size = sizeof(struct sock),
-};
-/*============================================================
- * wanpipe_make_new
- *
- *      Allocate memory for the a new sock, and sock
- *      private data.
- *
- *      Increment the module use count.
- *
- *      This function is used by wanpipe_create() and
- *      wanpipe_make_new() functions.
- *
- *===========================================================*/
-static struct sock *wanpipe_alloc_socket(void)
-{
-        struct sock *sk;
-        struct wanpipe_opt *wan_opt;
-        if ((sk = sk_alloc(PF_WANPIPE, GFP_ATOMIC, &wanpipe_proto, 1)) == NULL)
-                return NULL;
-        if ((wan_opt = kzalloc(sizeof(struct wanpipe_opt), GFP_ATOMIC)) == NULL) {
-                sk_free(sk);
-                return NULL;
-        }
-        wp_sk(sk) = wan_opt;
-        /* Use timer to send data to the driver. This will act
-         * as a BH handler for sendmsg functions */
-        init_timer(&wan_opt->tx_timer);
-        wan_opt->tx_timer.data     = (unsigned long)sk;
-        wan_opt->tx_timer.function = wanpipe_delayed_transmit;
-        sock_init_data(NULL, sk);
-        return sk;
-}
-/*============================================================
- * wanpipe_sendmsg
- *
- *      This function implements a sendto() system call,
- *      for AF_WANPIPE socket family.
- *      During socket bind() sk->sk_bound_dev_if is initialized
- *      to a correct network device. This number is used
- *      to find a network device to which the packet should
- *      be passed to.
- *
- *      Each packet is queued into sk->sk_write_queue and
- *      delayed transmit bottom half handler is marked for
- *      execution.
- *
- *      A socket must be in WANSOCK_CONNECTED state before
- *      a packet is queued into sk->sk_write_queue.
- *===========================================================*/
-static int wanpipe_sendmsg(struct kiocb *iocb, struct socket *sock,
-                           struct msghdr *msg, int len)
-{
-        wanpipe_opt *wp;
-        struct sock *sk = sock->sk;
-        struct wan_sockaddr_ll *saddr=(struct wan_sockaddr_ll *)msg->msg_name;
-        struct sk_buff *skb;
-        struct net_device *dev;
-        unsigned short proto;
-        unsigned char *addr;
-        int ifindex, err, reserve = 0;
-        if (!sock_flag(sk, SOCK_ZAPPED))
-                return -ENETDOWN;
-        if (sk->sk_state != WANSOCK_CONNECTED)
-                return -ENOTCONN;
-        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_CMSG_COMPAT))
-                return(-EINVAL);
-        /* it was <=, now one can send
-         * zero length packets */
-        if (len < sizeof(x25api_hdr_t))
-                return -EINVAL;
-        wp = wp_sk(sk);
-        if (saddr == NULL) {
-                ifindex = sk->sk_bound_dev_if;
-                proto   = wp->num;
-                addr    = NULL;
-        }else{
-                if (msg->msg_namelen < sizeof(struct wan_sockaddr_ll)){
-                        return -EINVAL;
-                }
-                ifindex = sk->sk_bound_dev_if;
-                proto   = saddr->sll_protocol;
-                addr    = saddr->sll_addr;
-        }
-        dev = dev_get_by_index(ifindex);
-        if (dev == NULL){
-                printk(KERN_INFO "wansock: Send failed, dev index: %i\n",ifindex);
-                return -ENXIO;
-        }
-        dev_put(dev);
-        if (sock->type == SOCK_RAW)
-                reserve = dev->hard_header_len;
-        if (len > dev->mtu+reserve){
-                return -EMSGSIZE;
-        }
-        skb = sock_alloc_send_skb(sk, len + LL_RESERVED_SPACE(dev),
-                                msg->msg_flags & MSG_DONTWAIT, &err);
-        if (skb==NULL){
-                goto out_unlock;
-        }
-        skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        skb->nh.raw = skb->data;
-        /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb,len), msg->msg_iov, len);
-        if (err){
-                goto out_free;
-        }
-        if (dev->hard_header) {
-                int res;
-                err = -EINVAL;
-                res = dev->hard_header(skb, dev, ntohs(proto), addr, NULL, len);
-                if (res<0){
-                        goto out_free;
-                }
-        }
-        skb->protocol = proto;
-        skb->dev = dev;
-        skb->priority = sk->sk_priority;
-        skb->pkt_type = WAN_PACKET_DATA;
-        err = -ENETDOWN;
-        if (!(dev->flags & IFF_UP))
-                goto out_free;
-        if (atomic_read(&sk->sk_wmem_alloc) + skb->truesize >
-            (unsigned int)sk->sk_sndbuf){
-                kfree_skb(skb);
-                return -ENOBUFS;
-        }
-        skb_queue_tail(&sk->sk_write_queue,skb);
-        atomic_inc(&wp->packet_sent);
-        if (!(test_and_set_bit(0, &wp->timer)))
-                mod_timer(&wp->tx_timer, jiffies + 1);
-        return(len);
-out_free:
-        kfree_skb(skb);
-out_unlock:
-        return err;
-}
-/*============================================================
- * wanpipe_delayed_tarnsmit
- *
- *      Transmit bottom half handler. It dequeues packets
- *      from sk->sk_write_queue and passes them to the
- *      driver.  If the driver is busy, the packet is
- *      re-enqueued.
- *
- *      Packet Sent counter is decremented on successful
- *      transmission.
- *===========================================================*/
-static void wanpipe_delayed_transmit (unsigned long data)
-{
-        struct sock *sk=(struct sock *)data;
-        struct sk_buff *skb;
-        wanpipe_opt *wp = wp_sk(sk);
-        struct net_device *dev = wp->dev;
-        sdla_t *card = (sdla_t*)wp->card;
-        if (!card || !dev){
-                clear_bit(0, &wp->timer);
-                DBG_PRINTK(KERN_INFO "wansock: Transmit delay, no dev or card\n");
-                return;
-        }
-        if (sk->sk_state != WANSOCK_CONNECTED || !sock_flag(sk, SOCK_ZAPPED)) {
-                clear_bit(0, &wp->timer);
-                DBG_PRINTK(KERN_INFO "wansock: Tx Timer, State not CONNECTED\n");
-                return;
-        }
-        /* If driver is executing command, we must offload
-         * the board by not sending data. Otherwise a
-         * pending command will never get a free buffer
-         * to execute */
-        if (atomic_read(&card->u.x.command_busy)){
-                wp->tx_timer.expires = jiffies + SLOW_BACKOFF;
-                add_timer(&wp->tx_timer);
-                DBG_PRINTK(KERN_INFO "wansock: Tx Timer, command bys BACKOFF\n");
-                return;
-        }
-        if (test_and_set_bit(0,&wanpipe_tx_critical)){
-                printk(KERN_INFO "WanSock: Tx timer critical %s\n",dev->name);
-                wp->tx_timer.expires = jiffies + SLOW_BACKOFF;
-                add_timer(&wp->tx_timer);
-                return;
-        }
-        /* Check for a packet in the fifo and send */
-        if ((skb = skb_dequeue(&sk->sk_write_queue)) != NULL){
-                if (dev->hard_start_xmit(skb, dev) != 0){
-                        /* Driver failed to transmit, re-enqueue
-                         * the packet and retry again later */
-                        skb_queue_head(&sk->sk_write_queue,skb);
-                        clear_bit(0,&wanpipe_tx_critical);
-                        return;
-                }else{
-                        /* Packet Sent successful. Check for more packets
-                         * if more packets, re-trigger the transmit routine
-                         * other wise exit
-                         */
-                        atomic_dec(&wp->packet_sent);
-                        if (skb_peek(&sk->sk_write_queue) == NULL) {
-                                /* If there is nothing to send, kick
-                                 * the poll routine, which will trigger
-                                 * the application to send more data */
-                                sk->sk_data_ready(sk, 0);
-                                clear_bit(0, &wp->timer);
-                        }else{
-                                /* Reschedule as fast as possible */
-                                wp->tx_timer.expires = jiffies + 1;
-                                add_timer(&wp->tx_timer);
-                        }
-                }
-        }
-        clear_bit(0,&wanpipe_tx_critical);
-}
-/*============================================================
- * execute_command
- *
- *      Execute x25api commands.  The atomic variable
- *      chan->command is used to indicate to the driver that
- *      command is pending for execution.  The acutal command
- *      structure is placed into a sock mbox structure
- *      (wp_sk(sk)->mbox).
- *
- *      The sock private structure, mbox is
- *      used as shared memory between sock and the driver.
- *      Driver uses the sock mbox to execute the command
- *      and return the result.
- *
- *      For all command except PLACE CALL, the function
- *      waits for the result.  PLACE CALL can be ether
- *      blocking or nonblocking. The user sets this option
- *      via ioctl call.
- *===========================================================*/
-static int execute_command(struct sock *sk,  unsigned char cmd, unsigned int flags)
-{
-        wanpipe_opt *wp = wp_sk(sk);
-        struct net_device *dev;
-        wanpipe_common_t *chan=NULL;
-        int err=0;
-        DECLARE_WAITQUEUE(wait, current);
-        dev = dev_get_by_index(sk->sk_bound_dev_if);
-        if (dev == NULL){
-                printk(KERN_INFO "wansock: Exec failed no dev %i\n",
-                        sk->sk_bound_dev_if);
-                return -ENODEV;
-        }
-        dev_put(dev);
-        if ((chan=dev->priv) == NULL){
-                printk(KERN_INFO "wansock: Exec cmd failed no priv area\n");
-                return -ENODEV;
-        }
-        if (atomic_read(&chan->command)){
-                printk(KERN_INFO "wansock: ERROR: Command already running %x, %s\n",
-                        atomic_read(&chan->command),dev->name);
-                return -EINVAL;
-        }
-        if (!wp->mbox) {
-                printk(KERN_INFO "wansock: In execute without MBOX\n");
-                return -EINVAL;
-        }
-        ((mbox_cmd_t*)wp->mbox)->cmd.command = cmd;
-        ((mbox_cmd_t*)wp->mbox)->cmd.lcn     = wp->lcn;
-        ((mbox_cmd_t*)wp->mbox)->cmd.result  = 0x7F;
-        if (flags & O_NONBLOCK){
-                cmd |= 0x80;
-                atomic_set(&chan->command, cmd);
-        }else{
-                atomic_set(&chan->command, cmd);
-        }
-        add_wait_queue(sk->sk_sleep,&wait);
-        current->state = TASK_INTERRUPTIBLE;
-        for (;;){
-                if (((mbox_cmd_t*)wp->mbox)->cmd.result != 0x7F) {
-                        err = 0;
-                        break;
-                }
-                if (signal_pending(current)) {
-                        err = -ERESTARTSYS;
-                        break;
-                }
-                schedule();
-        }
-        current->state = TASK_RUNNING;
-        remove_wait_queue(sk->sk_sleep,&wait);
-        return err;
-}
-/*============================================================
- * wanpipe_destroy_timer
- *
- *      Used by wanpipe_release, to delay release of
- *      the socket.
- *===========================================================*/
-static void wanpipe_destroy_timer(unsigned long data)
-{
-        struct sock *sk=(struct sock *)data;
-        wanpipe_opt *wp = wp_sk(sk);
-        if ((!atomic_read(&sk->sk_wmem_alloc) &&
-             !atomic_read(&sk->sk_rmem_alloc)) ||
-            (++wp->force == 5)) {
-                if (atomic_read(&sk->sk_wmem_alloc) ||
-                    atomic_read(&sk->sk_rmem_alloc))
-                        printk(KERN_INFO "wansock: Warning, Packet Discarded due to sock shutdown!\n");
-                kfree(wp);
-                wp_sk(sk) = NULL;
-                if (atomic_read(&sk->sk_refcnt) != 1) {
-                        atomic_set(&sk->sk_refcnt, 1);
-                        DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i ! :delay.\n",
-                                        atomic_read(&sk->sk_refcnt));
-                }
-                sock_put(sk);
-                atomic_dec(&wanpipe_socks_nr);
-                return;
-        }
-        sk->sk_timer.expires = jiffies + 5 * HZ;
-        add_timer(&sk->sk_timer);
-        printk(KERN_INFO "wansock: packet sk destroy delayed\n");
-}
-/*============================================================
- * wanpipe_unlink_driver
- *
- *      When the socket is released, this function is
- *      used to remove links that bind the sock and the
- *      driver together.
- *===========================================================*/
-static void wanpipe_unlink_driver (struct sock *sk)
-{
-        struct net_device *dev;
-        wanpipe_common_t *chan=NULL;
-        sock_reset_flag(sk, SOCK_ZAPPED);
-        sk->sk_state = WANSOCK_DISCONNECTED;
-        wp_sk(sk)->dev = NULL;
-        dev = dev_get_by_index(sk->sk_bound_dev_if);
-        if (!dev){
-                printk(KERN_INFO "wansock: No dev on release\n");
-                return;
-        }
-        dev_put(dev);
-        if ((chan = dev->priv) == NULL){
-                printk(KERN_INFO "wansock: No Priv Area on release\n");
-                return;
-        }
-        set_bit(0,&chan->common_critical);
-        chan->sk=NULL;
-        chan->func=NULL;
-        chan->mbox=NULL;
-        chan->tx_timer=NULL;
-        clear_bit(0,&chan->common_critical);
-        release_device(dev);
-        return;
-}
-/*============================================================
- * wanpipe_link_driver
- *
- *      Upon successful bind(), sock is linked to a driver
- *      by binding in the wanpipe_rcv() bottom half handler
- *      to the driver function pointer, as well as sock and
- *      sock mailbox addresses.  This way driver can pass
- *      data up the socket.
- *===========================================================*/
-static void wanpipe_link_driver(struct net_device *dev, struct sock *sk)
-{
-        wanpipe_opt *wp = wp_sk(sk);
-        wanpipe_common_t *chan = dev->priv;
-        if (!chan)
-                return;
-        set_bit(0,&chan->common_critical);
-        chan->sk=sk;
-        chan->func=wanpipe_rcv;
-        chan->mbox = wp->mbox;
-        chan->tx_timer = &wp->tx_timer;
-        wp->dev = dev;
-        sock_set_flag(sk, SOCK_ZAPPED);
-        clear_bit(0,&chan->common_critical);
-}
-/*============================================================
- * release_device
- *
- *      During sock release, clear a critical bit, which
- *      marks the device a being taken.
- *===========================================================*/
-static void release_device(struct net_device *dev)
-{
-        wanpipe_common_t *chan=dev->priv;
-        clear_bit(0,(void*)&chan->rw_bind);
-}
-/*============================================================
- * wanpipe_release
- *
- *      Close a PACKET socket. This is fairly simple. We
- *      immediately go to 'closed' state and remove our
- *      protocol entry in the device list.
- *===========================================================*/
-static int wanpipe_release(struct socket *sock)
-{
-        wanpipe_opt *wp;
-        struct sock *sk = sock->sk;
-        if (!sk)
-                return 0;
-        wp = wp_sk(sk);
-        check_write_queue(sk);
-        /* Kill the tx timer, if we don't kill it now, the timer
-         * will run after we kill the sock.  Timer code will
-         * try to access the sock which has been killed and cause
-         * kernel panic */
-        del_timer(&wp->tx_timer);
-        /*
-         *      Unhook packet receive handler.
-         */
-        if (wp->num == htons(X25_PROT) &&
-            sk->sk_state != WANSOCK_DISCONNECTED && sock_flag(sk, SOCK_ZAPPED)) {
-                struct net_device *dev = dev_get_by_index(sk->sk_bound_dev_if);
-                wanpipe_common_t *chan;
-                if (dev){
-                        chan=dev->priv;
-                        atomic_set(&chan->disconnect,1);
-                        DBG_PRINTK(KERN_INFO "wansock: Sending Clear Indication %i\n",
-                                        sk->sk_state);
-                        dev_put(dev);
-                }
-        }
-        set_bit(1,&wanpipe_tx_critical);
-        write_lock(&wanpipe_sklist_lock);
-        sk_del_node_init(sk);
-        write_unlock(&wanpipe_sklist_lock);
-        clear_bit(1,&wanpipe_tx_critical);
-        release_driver(sk);
-        /*
-         *      Now the socket is dead. No more input will appear.
-         */
-        sk->sk_state_change(sk);        /* It is useless. Just for sanity. */
-        sock->sk = NULL;
-        sk->sk_socket = NULL;
-        sock_set_flag(sk, SOCK_DEAD);
-        /* Purge queues */
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
-        skb_queue_purge(&sk->sk_error_queue);
-        if (atomic_read(&sk->sk_rmem_alloc) ||
-            atomic_read(&sk->sk_wmem_alloc)) {
-                del_timer(&sk->sk_timer);
-                printk(KERN_INFO "wansock: Killing in Timer R %i , W %i\n",
-                        atomic_read(&sk->sk_rmem_alloc),
-                        atomic_read(&sk->sk_wmem_alloc));
-                sk->sk_timer.data       = (unsigned long)sk;
-                sk->sk_timer.expires    = jiffies + HZ;
-                sk->sk_timer.function   = wanpipe_destroy_timer;
-                add_timer(&sk->sk_timer);
-                return 0;
-        }
-        kfree(wp);
-        wp_sk(sk) = NULL;
-        if (atomic_read(&sk->sk_refcnt) != 1) {
-                DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i !:release.\n",
-                                        atomic_read(&sk->sk_refcnt));
-                atomic_set(&sk->sk_refcnt, 1);
-        }
-        sock_put(sk);
-        atomic_dec(&wanpipe_socks_nr);
-        return 0;
-}
-/*============================================================
- * check_write_queue
- *
- *      During sock shutdown, if the sock state is
- *      WANSOCK_CONNECTED and there is transmit data
- *      pending. Wait until data is released
- *      before proceeding.
- *===========================================================*/
-static void check_write_queue(struct sock *sk)
-{
-        if (sk->sk_state != WANSOCK_CONNECTED)
-                return;
-        if (!atomic_read(&sk->sk_wmem_alloc))
-                return;
-        printk(KERN_INFO "wansock: MAJOR ERROR, Data lost on sock release !!!\n");
-}
-/*============================================================
- * release_driver
- *
- *      This function is called during sock shutdown, to
- *      release any resources and links that bind the sock
- *      to the driver.  It also changes the state of the
- *      sock to WANSOCK_DISCONNECTED
- *===========================================================*/
-static void release_driver(struct sock *sk)
-{
-        wanpipe_opt *wp;
-        struct sk_buff *skb=NULL;
-        struct sock *deadsk=NULL;
-        if (sk->sk_state == WANSOCK_LISTEN ||
-            sk->sk_state == WANSOCK_BIND_LISTEN) {
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                        if ((deadsk = get_newsk_from_skb(skb))){
-                                DBG_PRINTK (KERN_INFO "wansock: RELEASE: FOUND DEAD SOCK\n");
-                                sock_set_flag(deadsk, SOCK_DEAD);
-                                start_cleanup_timer(deadsk);
-                        }
-                        kfree_skb(skb);
-                }
-                if (sock_flag(sk, SOCK_ZAPPED))
-                        wanpipe_unlink_card(sk);
-        }else{
-                if (sock_flag(sk, SOCK_ZAPPED))
-                        wanpipe_unlink_driver(sk);
-        }
-        sk->sk_state        = WANSOCK_DISCONNECTED;
-        sk->sk_bound_dev_if = 0;
-        sock_reset_flag(sk, SOCK_ZAPPED);
-        wp = wp_sk(sk);
-        if (wp) {
-                kfree(wp->mbox);
-                wp->mbox = NULL;
-        }
-}
-/*============================================================
- *  start_cleanup_timer
- *
- *      If new incoming call's are pending but the socket
- *      is being released, start the timer which will
- *      envoke the kill routines for pending socks.
- *===========================================================*/
-static void start_cleanup_timer (struct sock *sk)
-{
-        del_timer(&sk->sk_timer);
-        sk->sk_timer.data       = (unsigned long)sk;
-        sk->sk_timer.expires    = jiffies + HZ;
-        sk->sk_timer.function   = wanpipe_kill_sock_timer;
-        add_timer(&sk->sk_timer);
-}
-/*============================================================
- *  wanpipe_kill_sock
- *
- *      This is a function which performs actual killing
- *      of the sock.  It releases socket resources,
- *      and unlinks the sock from the driver.
- *===========================================================*/
-static void wanpipe_kill_sock_timer (unsigned long data)
-{
-        struct sock *sk = (struct sock *)data;
-        struct sock **skp;
-        if (!sk)
-                return;
-        /* This function can be called from interrupt. We must use
-         * appropriate locks */
-        if (test_bit(1,&wanpipe_tx_critical)){
-                sk->sk_timer.expires = jiffies + 10;
-                add_timer(&sk->sk_timer);
-                return;
-        }
-        write_lock(&wanpipe_sklist_lock);
-        sk_del_node_init(sk);
-        write_unlock(&wanpipe_sklist_lock);
-        if (wp_sk(sk)->num == htons(X25_PROT) &&
-            sk->sk_state != WANSOCK_DISCONNECTED) {
-                struct net_device *dev = dev_get_by_index(sk->sk_bound_dev_if);
-                wanpipe_common_t *chan;
-                if (dev){
-                        chan=dev->priv;
-                        atomic_set(&chan->disconnect,1);
-                        dev_put(dev);
-                }
-        }
-        release_driver(sk);
-        sk->sk_socket = NULL;
-        /* Purge queues */
-        skb_queue_purge(&sk->sk_receive_queue);
-        skb_queue_purge(&sk->sk_write_queue);
-        skb_queue_purge(&sk->sk_error_queue);
-        if (atomic_read(&sk->sk_rmem_alloc) ||
-            atomic_read(&sk->sk_wmem_alloc)) {
-                del_timer(&sk->sk_timer);
-                printk(KERN_INFO "wansock: Killing SOCK in Timer\n");
-                sk->sk_timer.data       = (unsigned long)sk;
-                sk->sk_timer.expires    = jiffies + HZ;
-                sk->sk_timer.function   = wanpipe_destroy_timer;
-                add_timer(&sk->sk_timer);
-                return;
-        }
-        kfree(wp_sk(sk));
-        wp_sk(sk) = NULL;
-        if (atomic_read(&sk->sk_refcnt) != 1) {
-                atomic_set(&sk->sk_refcnt, 1);
-                DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i ! :timer.\n",
-                                        atomic_read(&sk->sk_refcnt));
-        }
-        sock_put(sk);
-        atomic_dec(&wanpipe_socks_nr);
-        return;
-}
-static void wanpipe_kill_sock_accept (struct sock *sk)
-{
-        struct sock **skp;
-        if (!sk)
-                return;
-        /* This function can be called from interrupt. We must use
-         * appropriate locks */
-        write_lock(&wanpipe_sklist_lock);
-        sk_del_node_init(sk);
-        write_unlock(&wanpipe_sklist_lock);
-        sk->sk_socket = NULL;
-        kfree(wp_sk(sk));
-        wp_sk(sk) = NULL;
-        if (atomic_read(&sk->sk_refcnt) != 1) {
-                atomic_set(&sk->sk_refcnt, 1);
-                DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i ! :timer.\n",
-                                        atomic_read(&sk->sk_refcnt));
-        }
-        sock_put(sk);
-        atomic_dec(&wanpipe_socks_nr);
-        return;
-}
-static void wanpipe_kill_sock_irq (struct sock *sk)
-{
-        if (!sk)
-                return;
-        sk->sk_socket = NULL;
-        kfree(wp_sk(sk));
-        wp_sk(sk) = NULL;
-        if (atomic_read(&sk->sk_refcnt) != 1) {
-                atomic_set(&sk->sk_refcnt, 1);
-                DBG_PRINTK(KERN_INFO "wansock: Error, wrong reference count: %i !:listen.\n",
-                                        atomic_read(&sk->sk_refcnt));
-        }
-        sock_put(sk);
-        atomic_dec(&wanpipe_socks_nr);
-}
-/*============================================================
- *  wanpipe_do_bind
- *
- *      Bottom half of the binding system call.
- *      Once the wanpipe_bind() function checks  the
- *      legality of the call, this function binds the
- *      sock to the driver.
- *===========================================================*/
-static int wanpipe_do_bind(struct sock *sk, struct net_device *dev,
-                           int protocol)
-{
-        wanpipe_opt *wp = wp_sk(sk);
-        wanpipe_common_t *chan=NULL;
-        int err=0;
-        if (sock_flag(sk, SOCK_ZAPPED)) {
-                err = -EALREADY;
-                goto bind_unlock_exit;
-        }
-        wp->num = protocol;
-        if (protocol == 0){
-                release_device(dev);
-                err = -EINVAL;
-                goto bind_unlock_exit;
-        }
-        if (dev) {
-                if (dev->flags&IFF_UP) {
-                        chan=dev->priv;
-                        sk->sk_state = chan->state;
-                        if (wp->num == htons(X25_PROT) &&
-                            sk->sk_state != WANSOCK_DISCONNECTED &&
-                            sk->sk_state != WANSOCK_CONNECTING) {
-                                DBG_PRINTK(KERN_INFO
-                                        "wansock: Binding to Device not DISCONNECTED %i\n",
-                                                sk->sk_state);
-                                release_device(dev);
-                                err = -EAGAIN;
-                                goto bind_unlock_exit;
-                        }
-                        wanpipe_link_driver(dev,sk);
-                        sk->sk_bound_dev_if = dev->ifindex;
-                        /* X25 Specific option */
-                        if (wp->num == htons(X25_PROT))
-                                wp_sk(sk)->svc = chan->svc;
-                } else {
-                        sk->sk_err = ENETDOWN;
-                        sk->sk_error_report(sk);
-                        release_device(dev);
-                        err = -EINVAL;
-                }
-        } else {
-                err = -ENODEV;
-        }
-bind_unlock_exit:
-        /* FIXME where is this lock */
-        return err;
-}
-/*============================================================
- *  wanpipe_bind
- *
- *      BIND() System call, which is bound to the AF_WANPIPE
- *      operations structure.  It checks for correct wanpipe
- *      card name, and cross references interface names with
- *      the card names.  Thus, interface name must belong to
- *      the actual card.
- *===========================================================*/
-static int wanpipe_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
-{
-        struct wan_sockaddr_ll *sll = (struct wan_sockaddr_ll*)uaddr;
-        struct sock *sk=sock->sk;
-        wanpipe_opt *wp = wp_sk(sk);
-        struct net_device *dev = NULL;
-        sdla_t *card=NULL;
-        char name[15];
-        /*
-         *      Check legality
-         */
-        if (addr_len < sizeof(struct wan_sockaddr_ll)){
-                printk(KERN_INFO "wansock: Address length error\n");
-                return -EINVAL;
-        }
-        if (sll->sll_family != AF_WANPIPE){
-                printk(KERN_INFO "wansock: Illegal family name specified.\n");
-                return -EINVAL;
-        }
-        card = wanpipe_find_card (sll->sll_card);
-        if (!card){
-                printk(KERN_INFO "wansock: Wanpipe card not found: %s\n",sll->sll_card);
-                return -ENODEV;
-        }else{
-                wp_sk(sk)->card = (void *)card;
-        }
-        if (!strcmp(sll->sll_device,"svc_listen")){
-                /* Bind a sock to a card structure for listening
-                 */
-                int err=0;
-                /* This is x25 specific area if protocol doesn't
-                 * match, return error */
-                if (sll->sll_protocol != htons(X25_PROT))
-                        return -EINVAL;
-                err= wanpipe_link_card (sk);
-                if (err < 0)
-                        return err;
-                if (sll->sll_protocol)
-                        wp->num = sll->sll_protocol;
-                sk->sk_state = WANSOCK_BIND_LISTEN;
-                return 0;
-        }else if (!strcmp(sll->sll_device,"svc_connect")){
-                /* This is x25 specific area if protocol doesn't
-                 * match, return error */
-                if (sll->sll_protocol != htons(X25_PROT))
-                        return -EINVAL;
-                /* Find a free device
-                 */
-                dev = wanpipe_find_free_dev(card);
-                if (dev == NULL){
-                        DBG_PRINTK(KERN_INFO "wansock: No free network devices for card %s\n",
-                                card->devname);
-                        return -EINVAL;
-                }
-        }else{
-                /* Bind a socket to a interface name
-                 * This is used by PVC mostly
-                 */
-                strlcpy(name,sll->sll_device,sizeof(name));
-                dev = dev_get_by_name(name);
-                if (dev == NULL){
-                        printk(KERN_INFO "wansock: Failed to get Dev from name: %s,\n",
-                                        name);
-                        return -ENODEV;
-                }
-                dev_put(dev);
-                if (check_dev(dev, card)){
-                        printk(KERN_INFO "wansock: Device %s, doesn't belong to card %s\n",
-                                dev->name, card->devname);
-                        return -EINVAL;
-                }
-                if (get_atomic_device (dev))
-                        return -EINVAL;
-        }
-        return wanpipe_do_bind(sk, dev, sll->sll_protocol ? : wp->num);
-}
-/*============================================================
- * get_atomic_device
- *
- *      Sets a bit atomically which indicates that
- *      the interface is taken. This avoids race conditions.
- *===========================================================*/
-static inline int get_atomic_device(struct net_device *dev)
-{
-        wanpipe_common_t *chan = dev->priv;
-        if (!test_and_set_bit(0,(void *)&chan->rw_bind)){
-                return 0;
-        }
-        return 1;
-}
-/*============================================================
- * check_dev
- *
- *      Check that device name belongs to a particular card.
- *===========================================================*/
-static int check_dev(struct net_device *dev, sdla_t *card)
-{
-        struct net_device* tmp_dev;
-        for (tmp_dev = card->wandev.dev; tmp_dev;
-             tmp_dev = *((struct net_device **)tmp_dev->priv)) {
-                if (tmp_dev->ifindex == dev->ifindex){
-                        return 0;
-                }
-        }
-        return 1;
-}
-/*============================================================
- *  wanpipe_find_free_dev
- *
- *      Find a free network interface. If found set atomic
- *      bit indicating that the interface is taken.
- *      X25API Specific.
- *===========================================================*/
-struct net_device *wanpipe_find_free_dev(sdla_t *card)
-{
-        struct net_device* dev;
-        volatile wanpipe_common_t *chan;
-        if (test_and_set_bit(0,&find_free_critical)){
-                printk(KERN_INFO "CRITICAL in Find Free\n");
-        }
-        for (dev = card->wandev.dev; dev;
-             dev = *((struct net_device **)dev->priv)) {
-                chan = dev->priv;
-                if (!chan)
-                        continue;
-                if (chan->usedby == API && chan->svc){
-                        if (!get_atomic_device (dev)){
-                                if (chan->state != WANSOCK_DISCONNECTED){
-                                        release_device(dev);
-                                }else{
-                                        clear_bit(0,&find_free_critical);
-                                        return dev;
-                                }
-                        }
-                }
-        }
-        clear_bit(0,&find_free_critical);
-        return NULL;
-}
-/*============================================================
- *  wanpipe_create
- *
- *      SOCKET() System call.  It allocates a sock structure
- *      and adds the socket to the wanpipe_sk_list.
- *      Crates AF_WANPIPE socket.
- *===========================================================*/
-static int wanpipe_create(struct socket *sock, int protocol)
-{
-        struct sock *sk;
-        //FIXME: This checks for root user, SECURITY ?
-        //if (!capable(CAP_NET_RAW))
-        //      return -EPERM;
-        if (sock->type != SOCK_DGRAM && sock->type != SOCK_RAW)
-                return -ESOCKTNOSUPPORT;
-        sock->state = SS_UNCONNECTED;
-        if ((sk = wanpipe_alloc_socket()) == NULL)
-                return -ENOBUFS;
-        sk->sk_reuse = 1;
-        sock->ops = &wanpipe_ops;
-        sock_init_data(sock,sk);
-        sock_reset_flag(sk, SOCK_ZAPPED);
-        sk->sk_family       = PF_WANPIPE;
-        wp_sk(sk)->num      = protocol;
-        sk->sk_state        = WANSOCK_DISCONNECTED;
-        sk->sk_ack_backlog  = 0;
-        sk->sk_bound_dev_if = 0;
-        atomic_inc(&wanpipe_socks_nr);
-        /* We must disable interrupts because the ISR
-         * can also change the list */
-        set_bit(1,&wanpipe_tx_critical);
-        write_lock(&wanpipe_sklist_lock);
-        sk_add_node(sk, &wanpipe_sklist);
-        write_unlock(&wanpipe_sklist_lock);
-        clear_bit(1,&wanpipe_tx_critical);
-        return(0);
-}
-/*============================================================
- *  wanpipe_recvmsg
- *
- *      Pull a packet from our receive queue and hand it
- *      to the user. If necessary we block.
- *===========================================================*/
-static int wanpipe_recvmsg(struct kiocb *iocb, struct socket *sock,
-                           struct msghdr *msg, int len, int flags)
-{
-        struct sock *sk = sock->sk;
-        struct sk_buff *skb;
-        int copied, err=-ENOBUFS;
-        /*
-         *      If the address length field is there to be filled in, we fill
-         *      it in now.
-         */
-        msg->msg_namelen = sizeof(struct wan_sockaddr_ll);
-        /*
-         *      Call the generic datagram receiver. This handles all sorts
-         *      of horrible races and re-entrancy so we can forget about it
-         *      in the protocol layers.
-         *
-         *      Now it will return ENETDOWN, if device have just gone down,
-         *      but then it will block.
-         */
-        if (flags & MSG_OOB){
-                skb = skb_dequeue(&sk->sk_error_queue);
-        }else{
-                skb=skb_recv_datagram(sk,flags,1,&err);
-        }
-        /*
-         *      An error occurred so return it. Because skb_recv_datagram()
-         *      handles the blocking we don't see and worry about blocking
-         *      retries.
-         */
-        if(skb==NULL)
-                goto out;
-        /*
-         *      You lose any data beyond the buffer you gave. If it worries a
-         *      user program they can ask the device for its MTU anyway.
-         */
-        copied = skb->len;
-        if (copied > len)
-        {
-                copied=len;
-                msg->msg_flags|=MSG_TRUNC;
-        }
-        wanpipe_wakeup_driver(sk);
-        /* We can't use skb_copy_datagram here */
-        err = memcpy_toiovec(msg->msg_iov, skb->data, copied);
-        if (err)
-                goto out_free;
-        sock_recv_timestamp(msg, sk, skb);
-        if (msg->msg_name)
-                memcpy(msg->msg_name, skb->cb, msg->msg_namelen);
-        /*
-         *      Free or return the buffer as appropriate. Again this
-         *      hides all the races and re-entrancy issues from us.
-         */
-        err = (flags&MSG_TRUNC) ? skb->len : copied;
-out_free:
-        skb_free_datagram(sk, skb);
-out:
-        return err;
-}
-/*============================================================
- *  wanpipe_wakeup_driver
- *
- *      If socket receive buffer is full and driver cannot
- *      pass data up the sock, it sets a packet_block flag.
- *      This function check that flag and if sock receive
- *      queue has room it kicks the driver BH handler.
- *
- *      This way, driver doesn't have to poll the sock
- *      receive queue.
- *===========================================================*/
-static void wanpipe_wakeup_driver(struct sock *sk)
-{
-        struct net_device *dev = NULL;
-        wanpipe_common_t *chan=NULL;
-        dev = dev_get_by_index(sk->sk_bound_dev_if);
-        if (!dev)
-                return;
-        dev_put(dev);
-        if ((chan = dev->priv) == NULL)
-                return;
-        if (atomic_read(&chan->receive_block)){
-                if (atomic_read(&sk->sk_rmem_alloc) <
-                    ((unsigned)sk->sk_rcvbuf * 0.9)) {
-                        printk(KERN_INFO "wansock: Queuing task for wanpipe\n");
-                        atomic_set(&chan->receive_block,0);
-                        wanpipe_queue_tq(&chan->wanpipe_task);
-                        wanpipe_mark_bh();
-                }
-        }
-}
-/*============================================================
- *  wanpipe_getname
- *
- *      I don't know what to do with this yet.
- *      User can use this function to get sock address
- *      information. Not very useful for Sangoma's purposes.
- *===========================================================*/
-static int wanpipe_getname(struct socket *sock, struct sockaddr *uaddr,
-                          int *uaddr_len, int peer)
-{
-        struct net_device *dev;
-        struct sock *sk = sock->sk;
-        struct wan_sockaddr_ll *sll = (struct wan_sockaddr_ll*)uaddr;
-        sll->sll_family = AF_WANPIPE;
-        sll->sll_ifindex = sk->sk_bound_dev_if;
-        sll->sll_protocol = wp_sk(sk)->num;
-        dev = dev_get_by_index(sk->sk_bound_dev_if);
-        if (dev) {
-                sll->sll_hatype = dev->type;
-                sll->sll_halen = dev->addr_len;
-                memcpy(sll->sll_addr, dev->dev_addr, dev->addr_len);
-        } else {
-                sll->sll_hatype = 0;    /* Bad: we have no ARPHRD_UNSPEC */
-                sll->sll_halen = 0;
-        }
-        *uaddr_len = sizeof(*sll);
-        dev_put(dev);
-        return 0;
-}
-/*============================================================
- *  wanpipe_notifier
- *
- *      If driver turns off network interface, this function
- *      will be envoked. Currently I treate it as a
- *      call disconnect. More thought should go into this
- *      function.
- *
- * FIXME: More thought should go into this function.
- *
- *===========================================================*/
-static int wanpipe_notifier(struct notifier_block *this, unsigned long msg, void *data)
-{
-        struct sock *sk;
-        hlist_node *node;
-        struct net_device *dev = (struct net_device *)data;
-        sk_for_each(sk, node, &wanpipe_sklist) {
-                struct wanpipe_opt *po = wp_sk(sk);
-                if (!po)
-                        continue;
-                if (dev == NULL)
-                        continue;
-                switch (msg) {
-                case NETDEV_DOWN:
-                case NETDEV_UNREGISTER:
-                        if (dev->ifindex == sk->sk_bound_dev_if) {
-                                printk(KERN_INFO "wansock: Device down %s\n",dev->name);
-                                if (sock_flag(sk, SOCK_ZAPPED)) {
-                                        wanpipe_unlink_driver(sk);
-                                        sk->sk_err = ENETDOWN;
-                                        sk->sk_error_report(sk);
-                                }
-                                if (msg == NETDEV_UNREGISTER) {
-                                        printk(KERN_INFO "wansock: Unregistering Device: %s\n",
-                                                          dev->name);
-                                        wanpipe_unlink_driver(sk);
-                                        sk->sk_bound_dev_if = 0;
-                                }
-                        }
-                        break;
-                case NETDEV_UP:
-                        if (dev->ifindex == sk->sk_bound_dev_if &&
-                            po->num && !sock_flag(sk, SOCK_ZAPPED)) {
-                                printk(KERN_INFO "wansock: Registering Device: %s\n",
-                                                dev->name);
-                                wanpipe_link_driver(dev,sk);
-                        }
-                        break;
-                }
-        }
-        return NOTIFY_DONE;
-}
-/*============================================================
- *  wanpipe_ioctl
- *
- *      Execute a user commands, and set socket options.
- *
- * FIXME: More thought should go into this function.
- *
- *===========================================================*/
-static int wanpipe_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
-{
-        struct sock *sk = sock->sk;
-        int err;
-        switch(cmd)
-        {
-                case SIOCGSTAMP:
-                        return sock_get_timestamp(sk, (struct timeval __user *)arg);
-                case SIOC_WANPIPE_CHECK_TX:
-                        return atomic_read(&sk->sk_wmem_alloc);
-                case SIOC_WANPIPE_SOCK_STATE:
-                        if (sk->sk_state == WANSOCK_CONNECTED)
-                                return 0;
-                        return 1;
-                case SIOC_WANPIPE_GET_CALL_DATA:
-                        return get_ioctl_cmd (sk,(void*)arg);
-                case SIOC_WANPIPE_SET_CALL_DATA:
-                        return set_ioctl_cmd (sk,(void*)arg);
-                case SIOC_WANPIPE_ACCEPT_CALL:
-                case SIOC_WANPIPE_CLEAR_CALL:
-                case SIOC_WANPIPE_RESET_CALL:
-                        if ((err=set_ioctl_cmd(sk,(void*)arg)) < 0)
-                                return err;
-                        err=wanpipe_exec_cmd(sk,cmd,0);
-                        get_ioctl_cmd(sk,(void*)arg);
-                        return err;
-                case SIOC_WANPIPE_DEBUG:
-                        return wanpipe_debug(sk,(void*)arg);
-                case SIOC_WANPIPE_SET_NONBLOCK:
-                        if (sk->sk_state != WANSOCK_DISCONNECTED)
-                                return -EINVAL;
-                        sock->file->f_flags |= O_NONBLOCK;
-                        return 0;
-#ifdef CONFIG_INET
-                case SIOCADDRT:
-                case SIOCDELRT:
-                case SIOCDARP:
-                case SIOCGARP:
-                case SIOCSARP:
-                case SIOCDRARP:
-                case SIOCGRARP:
-                case SIOCSRARP:
-                case SIOCGIFADDR:
-                case SIOCSIFADDR:
-                case SIOCGIFBRDADDR:
-                case SIOCSIFBRDADDR:
-                case SIOCGIFNETMASK:
-                case SIOCSIFNETMASK:
-                case SIOCGIFDSTADDR:
-                case SIOCSIFDSTADDR:
-                case SIOCSIFFLAGS:
-                        return inet_dgram_ops.ioctl(sock, cmd, arg);
-#endif
-                default:
-                        return -ENOIOCTLCMD;
-        }
-        /*NOTREACHED*/
-}
-/*============================================================
- *  wanpipe_debug
- *
- *      This function will pass up information about all
- *      active sockets.
- *
- * FIXME: More thought should go into this function.
- *
- *===========================================================*/
-static int wanpipe_debug (struct sock *origsk, void *arg)
-{
-        struct sock *sk;
-        struct hlist_node *node;
-        struct net_device *dev = NULL;
-        wanpipe_common_t *chan=NULL;
-        int cnt=0, err=0;
-        wan_debug_t *dbg_data = (wan_debug_t *)arg;
-        sk_for_each(sk, node, &wanpipe_sklist) {
-                wanpipe_opt *wp = wp_sk(sk);
-                if (sk == origsk){
-                        continue;
-                }
-                if ((err=put_user(1, &dbg_data->debug[cnt].free)))
-                        return err;
-                if ((err = put_user(sk->sk_state,
-                                    &dbg_data->debug[cnt].state_sk)))
-                        return err;
-                if ((err = put_user(sk->sk_rcvbuf,
-                                    &dbg_data->debug[cnt].rcvbuf)))
-                        return err;
-                if ((err = put_user(atomic_read(&sk->sk_rmem_alloc),
-                                    &dbg_data->debug[cnt].rmem)))
-                        return err;
-                if ((err = put_user(atomic_read(&sk->sk_wmem_alloc),
-                                    &dbg_data->debug[cnt].wmem)))
-                        return err;
-                if ((err = put_user(sk->sk_sndbuf,
-                                    &dbg_data->debug[cnt].sndbuf)))
-                        return err;
-                if ((err=put_user(sk_count, &dbg_data->debug[cnt].sk_count)))
-                        return err;
-                if ((err=put_user(wp->poll_cnt, &dbg_data->debug[cnt].poll_cnt)))
-                        return err;
-                if ((err = put_user(sk->sk_bound_dev_if,
-                                    &dbg_data->debug[cnt].bound)))
-                        return err;
-                if (sk->sk_bound_dev_if) {
-                        dev = dev_get_by_index(sk->sk_bound_dev_if);
-                        if (!dev)
-                                continue;
-                        chan=dev->priv;
-                        dev_put(dev);
-                        if ((err=put_user(chan->state, &dbg_data->debug[cnt].d_state)))
-                                return err;
-                        if ((err=put_user(chan->svc, &dbg_data->debug[cnt].svc)))
-                                return err;
-                        if ((err=put_user(atomic_read(&chan->command),
-                                                &dbg_data->debug[cnt].command)))
-                                return err;
-                        if (wp){
-                                sdla_t *card = (sdla_t*)wp->card;
-                                if (card){
-                                        if ((err=put_user(atomic_read(&card->u.x.command_busy),
-                                                                &dbg_data->debug[cnt].cmd_busy)))
-                                                return err;
-                                }
-                                if ((err=put_user(wp->lcn,
-                                                  &dbg_data->debug[cnt].lcn)))
-                                        return err;
-                                if (wp->mbox) {
-                                        if ((err=put_user(1, &dbg_data->debug[cnt].mbox)))
-                                                return err;
-                                }
-                        }
-                        if ((err=put_user(atomic_read(&chan->receive_block),
-                                                                &dbg_data->debug[cnt].rblock)))
-                                return err;
-                        if (copy_to_user(dbg_data->debug[cnt].name, dev->name, strlen(dev->name)))
-                                return -EFAULT;
-                }
-                if (++cnt == MAX_NUM_DEBUG)
-                        break;
-        }
-        return 0;
-}
-/*============================================================
- *  get_ioctl_cmd
- *
- *      Pass up the contents of socket MBOX to the user.
- *===========================================================*/
-static int get_ioctl_cmd (struct sock *sk, void *arg)
-{
-        x25api_t *usr_data = (x25api_t *)arg;
-        mbox_cmd_t *mbox_ptr;
-        int err;
-        if (usr_data == NULL)
-                return -EINVAL;
-        if (!wp_sk(sk)->mbox) {
-                return -EINVAL;
-        }
-        mbox_ptr = (mbox_cmd_t *)wp_sk(sk)->mbox;
-        if ((err=put_user(mbox_ptr->cmd.qdm, &usr_data->hdr.qdm)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.cause, &usr_data->hdr.cause)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.diagn, &usr_data->hdr.diagn)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.length, &usr_data->hdr.length)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.result, &usr_data->hdr.result)))
-                return err;
-        if ((err=put_user(mbox_ptr->cmd.lcn, &usr_data->hdr.lcn)))
-                return err;
-        if (mbox_ptr->cmd.length > 0){
-                if (mbox_ptr->cmd.length > X25_MAX_DATA)
-                        return -EINVAL;
-                if (copy_to_user(usr_data->data, mbox_ptr->data, mbox_ptr->cmd.length)){
-                        printk(KERN_INFO "wansock: Copy failed !!!\n");
-                        return -EFAULT;
-                }
-        }
-        return 0;
-}
-/*============================================================
- *  set_ioctl_cmd
- *
- *      Before command can be execute, socket MBOX must
- *      be created, and initialized with user data.
- *===========================================================*/
-static int set_ioctl_cmd (struct sock *sk, void *arg)
-{
-        x25api_t *usr_data = (x25api_t *)arg;
-        mbox_cmd_t *mbox_ptr;
-        int err;
-        if (!wp_sk(sk)->mbox) {
-                void *mbox_ptr;
-                struct net_device *dev = dev_get_by_index(sk->sk_bound_dev_if);
-                if (!dev)
-                        return -ENODEV;
-                dev_put(dev);
-                if ((mbox_ptr = kzalloc(sizeof(mbox_cmd_t), GFP_ATOMIC)) == NULL)
-                        return -ENOMEM;
-                wp_sk(sk)->mbox = mbox_ptr;
-                wanpipe_link_driver(dev,sk);
-        }
-        mbox_ptr = (mbox_cmd_t*)wp_sk(sk)->mbox;
-        memset(mbox_ptr, 0, sizeof(mbox_cmd_t));
-        if (usr_data == NULL){
-                return 0;
-        }
-        if ((err=get_user(mbox_ptr->cmd.qdm, &usr_data->hdr.qdm)))
-                return err;
-        if ((err=get_user(mbox_ptr->cmd.cause, &usr_data->hdr.cause)))
-                return err;
-        if ((err=get_user(mbox_ptr->cmd.diagn, &usr_data->hdr.diagn)))
-                return err;
-        if ((err=get_user(mbox_ptr->cmd.length, &usr_data->hdr.length)))
-                return err;
-        if ((err=get_user(mbox_ptr->cmd.result, &usr_data->hdr.result)))
-                return err;
-        if (mbox_ptr->cmd.length > 0){
-                if (mbox_ptr->cmd.length > X25_MAX_DATA)
-                        return -EINVAL;
-                if (copy_from_user(mbox_ptr->data, usr_data->data, mbox_ptr->cmd.length)){
-                        printk(KERN_INFO "Copy failed\n");
-                        return -EFAULT;
-                }
-        }
-        return 0;
-}
-/*======================================================================
- * wanpipe_poll
- *
- *      Datagram poll: Again totally generic. This also handles
- *      sequenced packet sockets providing the socket receive queue
- *      is only ever holding data ready to receive.
- *
- *      Note: when you _don't_ use this routine for this protocol,
- *      and you use a different write policy from sock_writeable()
- *      then please supply your own write_space callback.
- *=====================================================================*/
-unsigned int wanpipe_poll(struct file * file, struct socket *sock, poll_table *wait)
-{
-        struct sock *sk = sock->sk;
-        unsigned int mask;
-        ++wp_sk(sk)->poll_cnt;
-        poll_wait(file, sk->sk_sleep, wait);
-        mask = 0;
-        /* exceptional events? */
-        if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue)) {
-                mask |= POLLPRI;
-                return mask;
-        }
-        if (sk->sk_shutdown & RCV_SHUTDOWN)
-                mask |= POLLHUP;
-        /* readable? */
-        if (!skb_queue_empty(&sk->sk_receive_queue)) {
-                mask |= POLLIN | POLLRDNORM;
-        }
-        /* connection hasn't started yet */
-        if (sk->sk_state == WANSOCK_CONNECTING) {
-                return mask;
-        }
-        if (sk->sk_state == WANSOCK_DISCONNECTED) {
-                mask = POLLPRI;
-                return mask;
-        }
-        /* This check blocks the user process if there is
-         * a packet already queued in the socket write queue.
-         * This option is only for X25API protocol, for other
-         * protocol like chdlc enable streaming mode,
-         * where multiple packets can be pending in the socket
-         * transmit queue */
-        if (wp_sk(sk)->num == htons(X25_PROT)) {
-                if (atomic_read(&wp_sk(sk)->packet_sent))
-                        return mask;
-        }
-        /* writable? */
-        if (sock_writeable(sk)){
-                mask |= POLLOUT | POLLWRNORM | POLLWRBAND;
-        }else{
-                set_bit(SOCK_ASYNC_NOSPACE, &sk->sk_socket->flags);
-        }
-        return mask;
-}
-/*======================================================================
- * wanpipe_listen
- *
- *      X25API Specific function. Set a socket into LISTENING  MODE.
- *=====================================================================*/
-static int wanpipe_listen(struct socket *sock, int backlog)
-{
-        struct sock *sk = sock->sk;
-        /* This is x25 specific area if protocol doesn't
-         * match, return error */
-        if (wp_sk(sk)->num != htons(X25_PROT))
-                return -EINVAL;
-        if (sk->sk_state == WANSOCK_BIND_LISTEN) {
-                sk->sk_max_ack_backlog = backlog;
-                sk->sk_state           = WANSOCK_LISTEN;
-                return 0;
-        }else{
-                printk(KERN_INFO "wansock: Listening sock was not binded\n");
-        }
-        return -EINVAL;
-}
-/*======================================================================
- * wanpipe_link_card
- *
- *      Connects the listening socket to the driver
- *=====================================================================*/
-static int wanpipe_link_card (struct sock *sk)
-{
-        sdla_t *card = (sdla_t*)wp_sk(sk)->card;
-        if (!card)
-                return -ENOMEM;
-        if ((card->sk != NULL) || (card->func != NULL)){
-                printk(KERN_INFO "wansock: Listening queue is already established\n");
-                return -EINVAL;
-        }
-        card->sk=sk;
-        card->func=wanpipe_listen_rcv;
-        sock_set_flag(sk, SOCK_ZAPPED);
-        return 0;
-}
-/*======================================================================
- * wanpipe_listen
- *
- *      X25API Specific function. Disconnect listening socket from
- *      the driver.
- *=====================================================================*/
-static void wanpipe_unlink_card (struct sock *sk)
-{
-        sdla_t *card = (sdla_t*)wp_sk(sk)->card;
-        if (card){
-                card->sk=NULL;
-                card->func=NULL;
-        }
-}
-/*======================================================================
- * wanpipe_exec_cmd
- *
- *      Ioctl function calls this function to execute user command.
- *      Connect() sytem call also calls this function to execute
- *      place call.  This function blocks until command is executed.
- *=====================================================================*/
-static int wanpipe_exec_cmd(struct sock *sk, int cmd, unsigned int flags)
-{
-        int err = -EINVAL;
-        wanpipe_opt *wp = wp_sk(sk);
-        mbox_cmd_t *mbox_ptr = (mbox_cmd_t*)wp->mbox;
-        if (!mbox_ptr){
-                printk(KERN_INFO "NO MBOX PTR !!!!!\n");
-                return -EINVAL;
-        }
-        /* This is x25 specific area if protocol doesn't
-         * match, return error */
-        if (wp->num != htons(X25_PROT))
-                return -EINVAL;
-        switch (cmd){
-                case SIOC_WANPIPE_ACCEPT_CALL:
-                        if (sk->sk_state != WANSOCK_CONNECTING) {
-                                err = -EHOSTDOWN;
-                                break;
-                        }
-                        err = execute_command(sk,X25_ACCEPT_CALL,0);
-                        if (err < 0)
-                                break;
-                        /* Update. Mar6 2000.
-                         * Do not set the sock lcn number here, since
-                         * it is done in wanpipe_listen_rcv().
-                         */
-                        if (sk->sk_state == WANSOCK_CONNECTED) {
-                                wp->lcn = ((mbox_cmd_t*)wp->mbox)->cmd.lcn;
-                                DBG_PRINTK(KERN_INFO "\nwansock: Accept OK %i\n",
-                                        wp->lcn);
-                                err = 0;
-                        }else{
-                                DBG_PRINTK (KERN_INFO "\nwansock: Accept Failed %i\n",
-                                        wp->lcn);
-                                wp->lcn = 0;
-                                err = -ECONNREFUSED;
-                        }
-                        break;
-                case SIOC_WANPIPE_CLEAR_CALL:
-                        if (sk->sk_state == WANSOCK_DISCONNECTED) {
-                                err = -EINVAL;
-                                break;
-                        }
-                        /* Check if data buffers are pending for transmission,
-                         * if so, check whether user wants to wait until data
-                         * is transmitted, or clear a call and drop packets */
-                        if (atomic_read(&sk->sk_wmem_alloc) ||
-                            check_driver_busy(sk)) {
-                                mbox_cmd_t *mbox = wp->mbox;
-                                if (mbox->cmd.qdm & 0x80){
-                                        mbox->cmd.result = 0x35;
-                                        err = -EAGAIN;
-                                        break;
-                                }
-                        }
-                        sk->sk_state = WANSOCK_DISCONNECTING;
-                        err = execute_command(sk,X25_CLEAR_CALL,0);
-                        if (err < 0)
-                                break;
-                        err = -ECONNREFUSED;
-                        if (sk->sk_state == WANSOCK_DISCONNECTED) {
-                                DBG_PRINTK(KERN_INFO "\nwansock: CLEAR OK %i\n",
-                                           wp->lcn);
-                                wp->lcn = 0;
-                                err = 0;
-                        }
-                        break;
-                case SIOC_WANPIPE_RESET_CALL:
-                        if (sk->sk_state != WANSOCK_CONNECTED) {
-                                err = -EINVAL;
-                                break;
-                        }
-                        /* Check if data buffers are pending for transmission,
-                         * if so, check whether user wants to wait until data
-                         * is transmitted, or reset a call and drop packets */
-                        if (atomic_read(&sk->sk_wmem_alloc) ||
-                            check_driver_busy(sk)) {
-                                mbox_cmd_t *mbox = wp->mbox;
-                                if (mbox->cmd.qdm & 0x80){
-                                        mbox->cmd.result = 0x35;
-                                        err = -EAGAIN;
-                                        break;
-                                }
-                        }
-                        err = execute_command(sk, X25_RESET,0);
-                        if (err < 0)
-                                break;
-                        err = mbox_ptr->cmd.result;
-                        break;
-                case X25_PLACE_CALL:
-                        err=execute_command(sk,X25_PLACE_CALL,flags);
-                        if (err < 0)
-                                break;
-                        if (sk->sk_state == WANSOCK_CONNECTED) {
-                                wp->lcn = ((mbox_cmd_t*)wp->mbox)->cmd.lcn;
-                                DBG_PRINTK(KERN_INFO "\nwansock: PLACE CALL OK %i\n",
-                                        wp->lcn);
-                                err = 0;
-                        } else if (sk->sk_state == WANSOCK_CONNECTING &&
-                                   (flags & O_NONBLOCK)) {
-                                wp->lcn = ((mbox_cmd_t*)wp->mbox)->cmd.lcn;
-                                DBG_PRINTK(KERN_INFO "\nwansock: Place Call OK: Waiting %i\n",
-                                        wp->lcn);
-                                err = 0;
-                        }else{
-                                DBG_PRINTK(KERN_INFO "\nwansock: Place call Failed\n");
-                                err = -ECONNREFUSED;
-                        }
-                        break;
-                default:
-                        return -EINVAL;
-        }
-        return err;
-}
-static int check_driver_busy (struct sock *sk)
-{
-        struct net_device *dev = dev_get_by_index(sk->sk_bound_dev_if);
-        wanpipe_common_t *chan;
-        if (!dev)
-                return 0;
-        dev_put(dev);
-        if ((chan=dev->priv) == NULL)
-                return 0;
-        return atomic_read(&chan->driver_busy);
-}
-/*======================================================================
- * wanpipe_accept
- *
- *      ACCEPT() System call.   X25API Specific function.
- *      For each incoming call, create a new socket and
- *      return it to the user.
- *=====================================================================*/
-static int wanpipe_accept(struct socket *sock, struct socket *newsock, int flags)
-{
-        struct sock *sk;
-        struct sock *newsk;
-        struct sk_buff *skb;
-        DECLARE_WAITQUEUE(wait, current);
-        int err=0;
-        if (newsock->sk != NULL){
-                wanpipe_kill_sock_accept(newsock->sk);
-                newsock->sk=NULL;
-        }
-        if ((sk = sock->sk) == NULL)
-                return -EINVAL;
-        if (sk->sk_type != SOCK_RAW)
-                return -EOPNOTSUPP;
-        if (sk->sk_state != WANSOCK_LISTEN)
-                return -EINVAL;
-        if (wp_sk(sk)->num != htons(X25_PROT))
-                return -EINVAL;
-        add_wait_queue(sk->sk_sleep,&wait);
-        current->state = TASK_INTERRUPTIBLE;
-        for (;;){
-                skb = skb_dequeue(&sk->sk_receive_queue);
-                if (skb){
-                        err=0;
-                        break;
-                }
-                if (signal_pending(current)) {
-                        err = -ERESTARTSYS;
-                        break;
-                }
-                schedule();
-        }
-        current->state = TASK_RUNNING;
-        remove_wait_queue(sk->sk_sleep,&wait);
-        if (err != 0)
-                return err;
-        newsk = get_newsk_from_skb(skb);
-        if (!newsk){
-                return -EINVAL;
-        }
-        set_bit(1,&wanpipe_tx_critical);
-        write_lock(&wanpipe_sklist_lock);
-        sk_add_node(newsk, &wanpipe_sklist);
-        write_unlock(&wanpipe_sklist_lock);
-        clear_bit(1,&wanpipe_tx_critical);
-        newsk->sk_socket = newsock;
-        newsk->sk_sleep = &newsock->wait;
-        /* Now attach up the new socket */
-        sk->sk_ack_backlog--;
-        newsock->sk = newsk;
-        kfree_skb(skb);
-        DBG_PRINTK(KERN_INFO "\nwansock: ACCEPT Got LCN %i\n",
-                   wp_sk(newsk)->lcn);
-        return 0;
-}
-/*======================================================================
- *  get_newsk_from_skb
- *
- *      Accept() uses this function to get the address of the new
- *      socket structure.
- *=====================================================================*/
-struct sock * get_newsk_from_skb (struct sk_buff *skb)
-{
-        struct net_device *dev = skb->dev;
-        wanpipe_common_t *chan;
-        if (!dev){
-                return NULL;
-        }
-        if ((chan = dev->priv) == NULL){
-                return NULL;
-        }
-        if (!chan->sk){
-                return NULL;
-        }
-        return (struct sock *)chan->sk;
-}
-/*======================================================================
- *  wanpipe_connect
- *
- *      CONNECT() System Call. X25API specific function
- *      Check the state of the sock, and execute PLACE_CALL command.
- *      Connect can ether block or return without waiting for connection,
- *      if specified by user.
- *=====================================================================*/
-static int wanpipe_connect(struct socket *sock, struct sockaddr *uaddr, int addr_len, int flags)
-{
-        struct sock *sk = sock->sk;
-        struct wan_sockaddr_ll *addr = (struct wan_sockaddr_ll*)uaddr;
-        struct net_device *dev;
-        int err;
-        if (wp_sk(sk)->num != htons(X25_PROT))
-                return -EINVAL;
-        if (sk->sk_state == WANSOCK_CONNECTED)
-                return -EISCONN;        /* No reconnect on a seqpacket socket */
-        if (sk->sk_state != WAN_DISCONNECTED) {
-                printk(KERN_INFO "wansock: Trying to connect on channel NON DISCONNECT\n");
-                return -ECONNREFUSED;
-        }
-        sk->sk_state = WANSOCK_DISCONNECTED;
-        sock->state  = SS_UNCONNECTED;
-        if (addr_len != sizeof(struct wan_sockaddr_ll))
-                return -EINVAL;
-        if (addr->sll_family != AF_WANPIPE)
-                return -EINVAL;
-        if ((dev = dev_get_by_index(sk->sk_bound_dev_if)) == NULL)
-                return -ENETUNREACH;
-        dev_put(dev);
-        if (!sock_flag(sk, SOCK_ZAPPED)) /* Must bind first - autobinding does not work */
-                return -EINVAL;
-        sock->state   = SS_CONNECTING;
-        sk->sk_state  = WANSOCK_CONNECTING;
-        if (!wp_sk(sk)->mbox) {
-                if (wp_sk (sk)->svc)
-                        return -EINVAL;
-                else {
-                        int err;
-                        if ((err=set_ioctl_cmd(sk,NULL)) < 0)
-                                return err;
-                }
-        }
-        if ((err=wanpipe_exec_cmd(sk, X25_PLACE_CALL,flags)) != 0){
-                sock->state = SS_UNCONNECTED;
-                sk->sk_state = WANSOCK_CONNECTED;
-                return err;
-        }
-        if (sk->sk_state != WANSOCK_CONNECTED && (flags & O_NONBLOCK)) {
-                return 0;
-        }
-        if (sk->sk_state != WANSOCK_CONNECTED) {
-                sock->state = SS_UNCONNECTED;
-                return -ECONNREFUSED;
-        }
-        sock->state = SS_CONNECTED;
-        return 0;
-}
-const struct proto_ops wanpipe_ops = {
-        .family =       PF_WANPIPE,
-        .owner =        THIS_MODULE,
-        .release =      wanpipe_release,
-        .bind =         wanpipe_bind,
-        .connect =      wanpipe_connect,
-        .socketpair =   sock_no_socketpair,
-        .accept =       wanpipe_accept,
-        .getname =      wanpipe_getname,
-        .poll =         wanpipe_poll,
-        .ioctl =        wanpipe_ioctl,
-        .listen =       wanpipe_listen,
-        .shutdown =     sock_no_shutdown,
-        .setsockopt =   sock_no_setsockopt,
-        .getsockopt =   sock_no_getsockopt,
-        .sendmsg =      wanpipe_sendmsg,
-        .recvmsg =      wanpipe_recvmsg
-};
-static struct net_proto_family wanpipe_family_ops = {
-        .family = PF_WANPIPE,
-        .create = wanpipe_create,
-        .owner  = THIS_MODULE,
-};
-struct notifier_block wanpipe_netdev_notifier = {
-        .notifier_call = wanpipe_notifier,
-};
-#ifdef MODULE
-void cleanup_module(void)
-{
-        printk(KERN_INFO "wansock: Cleaning up \n");
-        unregister_netdevice_notifier(&wanpipe_netdev_notifier);
-        sock_unregister(PF_WANPIPE);
-        proto_unregister(&wanpipe_proto);
-}
-int init_module(void)
-{
-        int rc;
-        printk(KERN_INFO "wansock: Registering Socket \n");
-        rc = proto_register(&wanpipe_proto, 0);
-        if (rc != 0)
-                goto out;
-        sock_register(&wanpipe_family_ops);
-        register_netdevice_notifier(&wanpipe_netdev_notifier);
-out:
-        return rc;
-}
-#endif
-MODULE_LICENSE("GPL");
-MODULE_ALIAS_NETPROTO(PF_WANPIPE);
diff --git a/net/x25/x25_forward.c b/net/x25/x25_forward.c
index d339e0c810a8..8738ec7ce693 100644
--- a/net/x25/x25_forward.c
+++ b/net/x25/x25_forward.c
@@ -26,64 +26,66 @@ int x25_forward_call(struct x25_address *dest_addr, struct x25_neigh *from,
        short same_lci = 0;
        int rc = 0;
-        if ((rt = x25_get_route(dest_addr)) != NULL) {
+        if ((rt = x25_get_route(dest_addr)) == NULL)
+                goto out_no_route;
-                if ((neigh_new = x25_get_neigh(rt->dev)) == NULL) {
+        if ((neigh_new = x25_get_neigh(rt->dev)) == NULL) {
-                        /* This shouldnt happen, if it occurs somehow
+                /* This shouldnt happen, if it occurs somehow
-                         * do something sensible
+                 * do something sensible
-                         */
-                        goto out_put_route;
-                }
-                /* Avoid a loop. This is the normal exit path for a
-                 * system with only one x.25 iface and default route
                 */
-                if (rt->dev == from->dev) {
+                goto out_put_route;
-                        goto out_put_nb;
+        }
-                }
-                /* Remote end sending a call request on an already
+        /* Avoid a loop. This is the normal exit path for a
-                 * established LCI? It shouldnt happen, just in case..
+         * system with only one x.25 iface and default route
-                 */
+         */
-                read_lock_bh(&x25_forward_list_lock);
+        if (rt->dev == from->dev) {
-                list_for_each(entry, &x25_forward_list) {
+                goto out_put_nb;
-                        x25_frwd = list_entry(entry, struct x25_forward, node);
+        }
-                        if (x25_frwd->lci == lci) {
-                                printk(KERN_WARNING "X.25: call request for lci which is already registered!, transmitting but not registering new pair\n");
+        /* Remote end sending a call request on an already
-                                same_lci = 1;
+         * established LCI? It shouldnt happen, just in case..
-                        }
+         */
-                }
+        read_lock_bh(&x25_forward_list_lock);
-                read_unlock_bh(&x25_forward_list_lock);
+        list_for_each(entry, &x25_forward_list) {
+                x25_frwd = list_entry(entry, struct x25_forward, node);
-                /* Save the forwarding details for future traffic */
+                if (x25_frwd->lci == lci) {
-                if (!same_lci){
+                        printk(KERN_WARNING "X.25: call request for lci which is already registered!, transmitting but not registering new pair\n");
-                        if ((new_frwd = kmalloc(sizeof(struct x25_forward),
+                        same_lci = 1;
-                                                        GFP_ATOMIC)) == NULL){
-                                rc = -ENOMEM;
-                                goto out_put_nb;
-                        }
-                        new_frwd->lci = lci;
-                        new_frwd->dev1 = rt->dev;
-                        new_frwd->dev2 = from->dev;
-                        write_lock_bh(&x25_forward_list_lock);
-                        list_add(&new_frwd->node, &x25_forward_list);
-                        write_unlock_bh(&x25_forward_list_lock);
                }
+        }
+        read_unlock_bh(&x25_forward_list_lock);
-                /* Forward the call request */
+        /* Save the forwarding details for future traffic */
-                if ( (skbn = skb_clone(skb, GFP_ATOMIC)) == NULL){
+        if (!same_lci){
+                if ((new_frwd = kmalloc(sizeof(struct x25_forward),
+                                                GFP_ATOMIC)) == NULL){
+                        rc = -ENOMEM;
                        goto out_put_nb;
                }
-                x25_transmit_link(skbn, neigh_new);
+                new_frwd->lci = lci;
-                rc = 1;
+                new_frwd->dev1 = rt->dev;
+                new_frwd->dev2 = from->dev;
+                write_lock_bh(&x25_forward_list_lock);
+                list_add(&new_frwd->node, &x25_forward_list);
+                write_unlock_bh(&x25_forward_list_lock);
        }
+        /* Forward the call request */
+        if ( (skbn = skb_clone(skb, GFP_ATOMIC)) == NULL){
+                goto out_put_nb;
+        }
+        x25_transmit_link(skbn, neigh_new);
+        rc = 1;
 out_put_nb:
        x25_neigh_put(neigh_new);
 out_put_route:
        x25_route_put(rt);
+out_no_route:
        return rc;
 }
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 946b715db5ec..785c3e39f062 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -735,12 +735,14 @@ EXPORT_SYMBOL(xfrm_policy_insert);
 struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                                          struct xfrm_selector *sel,
-                                          struct xfrm_sec_ctx *ctx, int delete)
+                                          struct xfrm_sec_ctx *ctx, int delete,
+                                          int *err)
 {
        struct xfrm_policy *pol, *ret;
        struct hlist_head *chain;
        struct hlist_node *entry;
+        *err = 0;
        write_lock_bh(&xfrm_policy_lock);
        chain = policy_hash_bysel(sel, sel->family, dir);
        ret = NULL;
@@ -750,6 +752,11 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
                    xfrm_sec_ctx_match(ctx, pol->security)) {
                        xfrm_pol_hold(pol);
                        if (delete) {
+                                *err = security_xfrm_policy_delete(pol);
+                                if (*err) {
+                                        write_unlock_bh(&xfrm_policy_lock);
+                                        return pol;
+                                }
                                hlist_del(&pol->bydst);
                                hlist_del(&pol->byidx);
                                xfrm_policy_count[dir]--;
@@ -768,12 +775,14 @@ struct xfrm_policy *xfrm_policy_bysel_ctx(u8 type, int dir,
 }
 EXPORT_SYMBOL(xfrm_policy_bysel_ctx);
-struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete)
+struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete,
+                                     int *err)
 {
        struct xfrm_policy *pol, *ret;
        struct hlist_head *chain;
        struct hlist_node *entry;
+        *err = 0;
        write_lock_bh(&xfrm_policy_lock);
        chain = xfrm_policy_byidx + idx_hash(id);
        ret = NULL;
@@ -781,6 +790,11 @@ struct xfrm_policy *xfrm_policy_byid(u8 type, int dir, u32 id, int delete)
                if (pol->type == type && pol->index == id) {
                        xfrm_pol_hold(pol);
                        if (delete) {
+                                *err = security_xfrm_policy_delete(pol);
+                                if (*err) {
+                                        write_unlock_bh(&xfrm_policy_lock);
+                                        return pol;
+                                }
                                hlist_del(&pol->bydst);
                                hlist_del(&pol->byidx);
                                xfrm_policy_count[dir]--;
@@ -2075,7 +2089,7 @@ void xfrm_audit_log(uid_t auid, u32 sid, int type, int result,
                                        sizeof(struct in6_addr));
                        }
                        audit_log_format(audit_buf,
-                                         " src=" NIP6_FMT "dst=" NIP6_FMT,
+                                         " src=" NIP6_FMT " dst=" NIP6_FMT,
                                         NIP6(saddr6), NIP6(daddr6));
                }
                break;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index a35f9e4ede26..e3a0bcfa5df1 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -704,7 +704,8 @@ static struct xfrm_state *__find_acq_core(unsigned short family, u8 mode, u32 re
                    x->props.mode   != mode ||
                    x->props.family != family ||
                    x->km.state     != XFRM_STATE_ACQ ||
-                    x->id.spi       != 0)
+                    x->id.spi       != 0 ||
+                    x->id.proto     != proto)
                        continue;
                switch (family) {
@@ -801,7 +802,8 @@ int xfrm_state_add(struct xfrm_state *x)
        if (use_spi && x->km.seq) {
                x1 = __xfrm_find_acq_byseq(x->km.seq);
-                if (x1 && xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family)) {
+                if (x1 && ((x1->id.proto != x->id.proto) ||
+                    xfrm_addr_cmp(&x1->id.daddr, &x->id.daddr, family))) {
                        xfrm_state_put(x1);
                        x1 = NULL;
                }
@@ -1369,7 +1371,8 @@ int xfrm_replay_check(struct xfrm_state *x, __be32 net_seq)
                return 0;
        diff = x->replay.seq - seq;
-        if (diff >= x->props.replay_window) {
+        if (diff >= min_t(unsigned int, x->props.replay_window,
+                          sizeof(x->replay.bitmap) * 8)) {
                x->stats.replay_window++;
                return -EINVAL;
        }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 956cfe0ff7f8..e81e2fb3d429 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -530,9 +530,6 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
        err = xfrm_state_delete(x);
-        xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
-                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
        if (err < 0)
                goto out;
@@ -542,6 +539,8 @@ static int xfrm_del_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
        km_state_notify(x, &c);
 out:
+        xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
+                       AUDIT_MAC_IPSEC_DELSA, err ? 0 : 1, NULL, x);
        xfrm_state_put(x);
        return err;
 }
@@ -1254,7 +1253,7 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                return err;
        if (p->index)
-                xp = xfrm_policy_byid(type, p->dir, p->index, delete);
+                xp = xfrm_policy_byid(type, p->dir, p->index, delete, &err);
        else {
                struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
                struct xfrm_policy tmp;
@@ -1270,7 +1269,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                        if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
                                return err;
                }
-                xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, delete);
+                xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
+                                           delete, &err);
                security_xfrm_policy_free(&tmp);
        }
        if (xp == NULL)
@@ -1288,8 +1288,6 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                                              MSG_DONTWAIT);
                }
        } else {
-                err = security_xfrm_policy_delete(xp);
                xfrm_audit_log(NETLINK_CB(skb).loginuid, NETLINK_CB(skb).sid,
                               AUDIT_MAC_IPSEC_DELSPD, err ? 0 : 1, xp, NULL);
@@ -1303,9 +1301,8 @@ static int xfrm_get_policy(struct sk_buff *skb, struct nlmsghdr *nlh,
                km_policy_notify(xp, p->dir, &c);
        }
-        xfrm_pol_put(xp);
 out:
+        xfrm_pol_put(xp);
        return err;
 }
@@ -1502,7 +1499,7 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                return err;
        if (p->index)
-                xp = xfrm_policy_byid(type, p->dir, p->index, 0);
+                xp = xfrm_policy_byid(type, p->dir, p->index, 0, &err);
        else {
                struct rtattr *rt = xfrma[XFRMA_SEC_CTX-1];
                struct xfrm_policy tmp;
@@ -1518,13 +1515,14 @@ static int xfrm_add_pol_expire(struct sk_buff *skb, struct nlmsghdr *nlh,
                        if ((err = security_xfrm_policy_alloc(&tmp, uctx)))
                                return err;
                }
-                xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security, 0);
+                xp = xfrm_policy_bysel_ctx(type, p->dir, &p->sel, tmp.security,
+                                           0, &err);
                security_xfrm_policy_free(&tmp);
        }
        if (xp == NULL)
-                return err;
+                return -ENOENT;
-                                                                                        read_lock(&xp->lock);
+        read_lock(&xp->lock);
        if (xp->dead) {
                read_unlock(&xp->lock);
                goto out;
@@ -2027,7 +2025,7 @@ nlmsg_failure:
        return -1;
 }
-static int inline xfrm_sa_len(struct xfrm_state *x)
+static inline int xfrm_sa_len(struct xfrm_state *x)
 {
        int l = 0;
        if (x->aalg)
author	Paul Mackerras <paulus@samba.org>	2007-04-12 13:50:03 -0400
committer	Paul Mackerras <paulus@samba.org>	2007-04-12 13:50:03 -0400
commit	e049d1ca3094f3d1d94617f456a9961202f96e3a (patch)
tree	a30397ad22f2fbea268bd28fa69c60aad9dfa62a /net
parent	edfac96a92b88d3b0b53e3f8231b74beee9ecd1d (diff)
parent	80584ff3b99c36ead7e130e453b3a48b18072d18 (diff)