Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (33 commits)
  sony-laptop: re-read the rfkill state when resuming from suspend
  sony-laptop: check for rfkill hard block at load time
  wext: add back wireless/ dir in sysfs for cfg80211 interfaces
  wext: Add bound checks for copy_from_user
  mac80211: improve/fix mlme messages
  cfg80211: always get BSS
  iwlwifi: fix 3945 ucode info retrieval after failure
  iwlwifi: fix memory leak in command queue handling
  iwlwifi: fix debugfs buffer handling
  cfg80211: don't set privacy w/o key
  cfg80211: wext: don't display BSSID unless associated
  net: Add explicit bound checks in net/socket.c
  bridge: Fix double-free in br_add_if.
  isdn: fix netjet/isdnhdlc build errors
  atm: dereference of he_dev->rbps_virt in he_init_group()
  ax25: Add missing dev_put in ax25_setsockopt
  Revert "sit: stateless autoconf for isatap"
  net: fix double skb free in dcbnl
  net: fix nlmsg len size for skb when error bit is set.
  net: fix vlan_get_size to include vlan_flags size
  ...

13 files changed, 52 insertions, 106 deletions

diff --git a/net/8021q/vlan_netlink.c b/net/8021q/vlan_netlink.c
index 343146e1bceb..a91504850195 100644
--- a/net/8021q/vlan_netlink.c
+++ b/net/8021q/vlan_netlink.c
@@ -169,6 +169,7 @@ static size_t vlan_get_size(const struct net_device *dev)
         struct vlan_dev_info *vlan = vlan_dev_info(dev);
 
         return nla_total_size(2) +      /* IFLA_VLAN_ID */
+               sizeof(struct ifla_vlan_flags) + /* IFLA_VLAN_FLAGS */
                vlan_qos_map_size(vlan->nr_ingress_mappings) +
                vlan_qos_map_size(vlan->nr_egress_mappings);
 }
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index fbcac76fdc0d..4102de1022ee 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -641,15 +641,10 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
 
         case SO_BINDTODEVICE:
                 if (optlen > IFNAMSIZ)
-                        optlen=IFNAMSIZ;
-                if (copy_from_user(devname, optval, optlen)) {
-                res = -EFAULT;
-                        break;
-                }
+                        optlen = IFNAMSIZ;
 
-                dev = dev_get_by_name(&init_net, devname);
-                if (dev == NULL) {
-                        res = -ENODEV;
+                if (copy_from_user(devname, optval, optlen)) {
+                        res = -EFAULT;
                         break;
                 }
 
@@ -657,12 +652,18 @@ static int ax25_setsockopt(struct socket *sock, int level, int optname,
                    (sock->state != SS_UNCONNECTED ||
                     sk->sk_state == TCP_LISTEN)) {
                         res = -EADDRNOTAVAIL;
-                        dev_put(dev);
+                        break;
+                }
+
+                dev = dev_get_by_name(&init_net, devname);
+                if (!dev) {
+                        res = -ENODEV;
                         break;
                 }
 
                 ax25->ax25_dev = ax25_dev_ax25dev(dev);
                 ax25_fillin_cb(ax25, ax25->ax25_dev);
+                dev_put(dev);
                 break;
 
         default:
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 142ebac14176..b1b3b0fbf41c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -432,6 +432,7 @@ err2:
         br_fdb_delete_by_port(br, p, 1);
 err1:
         kobject_put(&p->kobj);
+        p = NULL; /* kobject_put frees */
 err0:
         dev_set_promiscuity(dev, -1);
 put_back:
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index 7d4c57523b09..821d30918cfc 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -16,7 +16,7 @@
 #include <net/sock.h>
 #include <linux/rtnetlink.h>
 #include <linux/wireless.h>
-#include <net/iw_handler.h>
+#include <net/wext.h>
 
 #include "net-sysfs.h"
 
@@ -363,15 +363,13 @@ static ssize_t wireless_show(struct device *d, char *buf,
                                                char *))
 {
         struct net_device *dev = to_net_dev(d);
-        const struct iw_statistics *iw = NULL;
+        const struct iw_statistics *iw;
         ssize_t ret = -EINVAL;
 
         read_lock(&dev_base_lock);
         if (dev_isalive(dev)) {
-                if (dev->wireless_handlers &&
-                    dev->wireless_handlers->get_wireless_stats)
-                        iw = dev->wireless_handlers->get_wireless_stats(dev);
-                if (iw != NULL)
+                iw = get_wireless_stats(dev);
+                if (iw)
                         ret = (*format)(iw, buf);
         }
         read_unlock(&dev_base_lock);
@@ -505,7 +503,7 @@ int netdev_register_kobject(struct net_device *net)
         *groups++ = &netstat_group;
 
 #ifdef CONFIG_WIRELESS_EXT_SYSFS
-        if (net->wireless_handlers && net->wireless_handlers->get_wireless_stats)
+        if (net->wireless_handlers || net->ieee80211_ptr)
                 *groups++ = &wireless_group;
 #endif
 #endif /* CONFIG_SYSFS */
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index e0879bfb7dd5..ac1205df6c86 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -194,7 +194,7 @@ static int dcbnl_reply(u8 value, u8 event, u8 cmd, u8 attr, u32 pid,
         nlmsg_end(dcbnl_skb, nlh);
         ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
         if (ret)
-                goto err;
+                return -EINVAL;
 
         return 0;
 nlmsg_failure:
@@ -275,7 +275,7 @@ static int dcbnl_getpfccfg(struct net_device *netdev, struct nlattr **tb,
 
         ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
         if (ret)
-                goto err;
+                goto err_out;
 
         return 0;
 nlmsg_failure:
@@ -316,12 +316,11 @@ static int dcbnl_getperm_hwaddr(struct net_device *netdev, struct nlattr **tb,
 
         ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
         if (ret)
-                goto err;
+                goto err_out;
 
         return 0;
 
 nlmsg_failure:
-err:
         kfree_skb(dcbnl_skb);
 err_out:
         return -EINVAL;
@@ -383,7 +382,7 @@ static int dcbnl_getcap(struct net_device *netdev, struct nlattr **tb,
 
         ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
         if (ret)
-                goto err;
+                goto err_out;
 
         return 0;
 nlmsg_failure:
@@ -460,7 +459,7 @@ static int dcbnl_getnumtcs(struct net_device *netdev, struct nlattr **tb,
         ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
         if (ret) {
                 ret = -EINVAL;
-                goto err;
+                goto err_out;
         }
 
         return 0;
@@ -799,7 +798,7 @@ static int __dcbnl_pg_getcfg(struct net_device *netdev, struct nlattr **tb,
 
         ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
         if (ret)
-                goto err;
+                goto err_out;
 
         return 0;
 
@@ -1063,7 +1062,7 @@ static int dcbnl_bcn_getcfg(struct net_device *netdev, struct nlattr **tb,
 
         ret = rtnl_unicast(dcbnl_skb, &init_net, pid);
         if (ret)
-                goto err;
+                goto err_out;
 
         return 0;
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 498b9b0b0fad..f74e4e2cdd06 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -658,7 +658,6 @@ void ndisc_send_rs(struct net_device *dev, const struct in6_addr *saddr,
                      &icmp6h, NULL,
                      send_sllao ? ND_OPT_SOURCE_LL_ADDR : 0);
 }
-EXPORT_SYMBOL(ndisc_send_rs);
 
 
 static void ndisc_error_report(struct neighbour *neigh, struct sk_buff *skb)
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index fcb539628847..d65e0c496cc0 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -15,7 +15,6 @@
  * Roger Venning <r.venning@telstra.com>:       6to4 support
  * Nate Thompson <nate@thebog.net>:             6to4 support
  * Fred Templin <fred.l.templin@boeing.com>:    isatap support
- * Sascha Hlusiak <mail@saschahlusiak.de>:      stateless autoconf for isatap
  */
 
 #include <linux/module.h>
@@ -223,44 +222,6 @@ failed:
         return NULL;
 }
 
-static void ipip6_tunnel_rs_timer(unsigned long data)
-{
-        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *) data;
-        struct inet6_dev *ifp;
-        struct inet6_ifaddr *addr;
-
-        spin_lock(&p->lock);
-        ifp = __in6_dev_get(p->tunnel->dev);
-
-        read_lock_bh(&ifp->lock);
-        for (addr = ifp->addr_list; addr; addr = addr->if_next) {
-                struct in6_addr rtr;
-
-                if (!(ipv6_addr_type(&addr->addr) & IPV6_ADDR_LINKLOCAL))
-                        continue;
-
-                /* Send RS to guessed linklocal address of router
-                 *
-                 * Better: send to ff02::2 encapsuled in unicast directly
-                 * to router-v4 instead of guessing the v6 address.
-                 *
-                 * Cisco/Windows seem to not set the u/l bit correctly,
-                 * so we won't guess right.
-                 */
-                ipv6_addr_set(&rtr,  htonl(0xFE800000), 0, 0, 0);
-                if (!__ipv6_isatap_ifid(rtr.s6_addr + 8,
-                                        p->addr)) {
-                        ndisc_send_rs(p->tunnel->dev, &addr->addr, &rtr);
-                }
-        }
-        read_unlock_bh(&ifp->lock);
-
-        mod_timer(&p->rs_timer, jiffies + HZ * p->rs_delay);
-        spin_unlock(&p->lock);
-
-        return;
-}
-
 static struct ip_tunnel_prl_entry *
 __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 {
@@ -319,7 +280,6 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                         continue;
                 kp[c].addr = prl->addr;
                 kp[c].flags = prl->flags;
-                kp[c].rs_delay = prl->rs_delay;
                 c++;
                 if (kprl.addr != htonl(INADDR_ANY))
                         break;
@@ -369,23 +329,11 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
         }
 
         p->next = t->prl;
-        p->tunnel = t;
         t->prl = p;
         t->prl_count++;
-
-        spin_lock_init(&p->lock);
-        setup_timer(&p->rs_timer, ipip6_tunnel_rs_timer, (unsigned long) p);
 update:
         p->addr = a->addr;
         p->flags = a->flags;
-        p->rs_delay = a->rs_delay;
-        if (p->rs_delay == 0)
-                p->rs_delay = IPTUNNEL_RS_DEFAULT_DELAY;
-        spin_lock(&p->lock);
-        del_timer(&p->rs_timer);
-        if (p->flags & PRL_DEFAULT)
-                mod_timer(&p->rs_timer, jiffies + 1);
-        spin_unlock(&p->lock);
 out:
         write_unlock(&ipip6_lock);
         return err;
@@ -404,9 +352,6 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
                         if ((*p)->addr == a->addr) {
                                 x = *p;
                                 *p = x->next;
-                                spin_lock(&x->lock);
-                                del_timer(&x->rs_timer);
-                                spin_unlock(&x->lock);
                                 kfree(x);
                                 t->prl_count--;
                                 goto out;
@@ -417,9 +362,6 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
                 while (t->prl) {
                         x = t->prl;
                         t->prl = t->prl->next;
-                        spin_lock(&x->lock);
-                        del_timer(&x->rs_timer);
-                        spin_unlock(&x->lock);
                         kfree(x);
                         t->prl_count--;
                 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 97a278a2f48e..8d26e9bf8964 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -1388,8 +1388,8 @@ ieee80211_rx_mgmt_disassoc(struct ieee80211_sub_if_data *sdata,
 
         reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
-        printk(KERN_DEBUG "%s: disassociated (Reason: %u)\n",
-                        sdata->dev->name, reason_code);
+        printk(KERN_DEBUG "%s: disassociated from %pM (Reason: %u)\n",
+                        sdata->dev->name, mgmt->sa, reason_code);
 
         ieee80211_set_disassoc(sdata, false);
         return RX_MGMT_CFG80211_DISASSOC;
@@ -1675,7 +1675,7 @@ static void ieee80211_rx_mgmt_probe_resp(struct ieee80211_sub_if_data *sdata,
 
         /* direct probe may be part of the association flow */
         if (wk && wk->state == IEEE80211_MGD_STATE_PROBE) {
-                printk(KERN_DEBUG "%s direct probe responded\n",
+                printk(KERN_DEBUG "%s: direct probe responded\n",
                        sdata->dev->name);
                 wk->tries = 0;
                 wk->state = IEEE80211_MGD_STATE_AUTH;
@@ -2502,9 +2502,6 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
         struct ieee80211_mgd_work *wk;
         const u8 *bssid = NULL;
 
-        printk(KERN_DEBUG "%s: deauthenticating by local choice (reason=%d)\n",
-               sdata->dev->name, req->reason_code);
-
         mutex_lock(&ifmgd->mtx);
 
         if (ifmgd->associated && &ifmgd->associated->cbss == req->bss) {
@@ -2532,6 +2529,9 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
 
         mutex_unlock(&ifmgd->mtx);
 
+        printk(KERN_DEBUG "%s: deauthenticating from %pM by local choice (reason=%d)\n",
+               sdata->dev->name, bssid, req->reason_code);
+
         ieee80211_send_deauth_disassoc(sdata, bssid,
                         IEEE80211_STYPE_DEAUTH, req->reason_code,
                         cookie);
@@ -2545,9 +2545,6 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
 {
         struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 
-        printk(KERN_DEBUG "%s: disassociating by local choice (reason=%d)\n",
-               sdata->dev->name, req->reason_code);
-
         mutex_lock(&ifmgd->mtx);
 
         /*
@@ -2561,6 +2558,9 @@ int ieee80211_mgd_disassoc(struct ieee80211_sub_if_data *sdata,
                 return -ENOLINK;
         }
 
+        printk(KERN_DEBUG "%s: disassociating from %pM by local choice (reason=%d)\n",
+               sdata->dev->name, req->bss->bssid, req->reason_code);
+
         ieee80211_set_disassoc(sdata, false);
 
         mutex_unlock(&ifmgd->mtx);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index a4bafbf15097..dd85320907cb 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1788,7 +1788,7 @@ void netlink_ack(struct sk_buff *in_skb, struct nlmsghdr *nlh, int err)
         }
 
         rep = __nlmsg_put(skb, NETLINK_CB(in_skb).pid, nlh->nlmsg_seq,
-                          NLMSG_ERROR, sizeof(struct nlmsgerr), 0);
+                          NLMSG_ERROR, payload, 0);
         errmsg = nlmsg_data(rep);
         errmsg->error = err;
         memcpy(&errmsg->msg, nlh, err ? nlh->nlmsg_len : sizeof(*nlh));
diff --git a/net/socket.c b/net/socket.c
index 49917a1cac7d..41e8847508aa 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -2098,12 +2098,17 @@ SYSCALL_DEFINE2(socketcall, int, call, unsigned long __user *, args)
         unsigned long a[6];
         unsigned long a0, a1;
         int err;
+        unsigned int len;
 
         if (call < 1 || call > SYS_ACCEPT4)
                 return -EINVAL;
 
+        len = nargs[call];
+        if (len > sizeof(a))
+                return -EINVAL;
+
         /* copy_from_user should be SMP safe. */
-        if (copy_from_user(a, args, nargs[call]))
+        if (copy_from_user(a, args, len))
                 return -EFAULT;
 
         audit_socketcall(nargs[call] / sizeof(unsigned long), a);
diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 7fae7eee65de..93c3ed329204 100644
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -762,9 +762,8 @@ int __cfg80211_connect(struct cfg80211_registered_device *rdev,
                 wdev->conn->params.ssid = wdev->ssid;
                 wdev->conn->params.ssid_len = connect->ssid_len;
 
-                /* don't care about result -- but fill bssid & channel */
-                if (!wdev->conn->params.bssid || !wdev->conn->params.channel)
-                        bss = cfg80211_get_conn_bss(wdev);
+                /* see if we have the bss already */
+                bss = cfg80211_get_conn_bss(wdev);
 
                 wdev->sme_state = CFG80211_SME_CONNECTING;
                 wdev->connect_keys = connkeys;
diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
index bf725275eb8d..5615a8802536 100644
--- a/net/wireless/wext-sme.c
+++ b/net/wireless/wext-sme.c
@@ -30,7 +30,8 @@ int cfg80211_mgd_wext_connect(struct cfg80211_registered_device *rdev,
         if (wdev->wext.keys) {
                 wdev->wext.keys->def = wdev->wext.default_key;
                 wdev->wext.keys->defmgmt = wdev->wext.default_mgmt_key;
-                wdev->wext.connect.privacy = true;
+                if (wdev->wext.default_key != -1)
+                        wdev->wext.connect.privacy = true;
         }
 
         if (!wdev->wext.connect.ssid_len)
@@ -229,8 +230,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
                 data->flags = 1;
                 data->length = wdev->wext.connect.ssid_len;
                 memcpy(ssid, wdev->wext.connect.ssid, data->length);
-        } else
-                data->flags = 0;
+        }
         wdev_unlock(wdev);
 
         return 0;
@@ -306,8 +306,6 @@ int cfg80211_mgd_wext_giwap(struct net_device *dev,
         wdev_lock(wdev);
         if (wdev->current_bss)
                 memcpy(ap_addr->sa_data, wdev->current_bss->pub.bssid, ETH_ALEN);
-        else if (wdev->wext.connect.bssid)
-                memcpy(ap_addr->sa_data, wdev->wext.connect.bssid, ETH_ALEN);
         else
                 memset(ap_addr->sa_data, 0, ETH_ALEN);
         wdev_unlock(wdev);
diff --git a/net/wireless/wext.c b/net/wireless/wext.c
index 5b4a0cee4418..60fe57761ca9 100644
--- a/net/wireless/wext.c
+++ b/net/wireless/wext.c
@@ -470,7 +470,7 @@ static iw_handler get_handler(struct net_device *dev, unsigned int cmd)
 /*
  * Get statistics out of the driver
  */
-static struct iw_statistics *get_wireless_stats(struct net_device *dev)
+struct iw_statistics *get_wireless_stats(struct net_device *dev)
 {
         /* New location */
         if ((dev->wireless_handlers != NULL) &&
@@ -773,10 +773,13 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd,
                         essid_compat = 1;
                 else if (IW_IS_SET(cmd) && (iwp->length != 0)) {
                         char essid[IW_ESSID_MAX_SIZE + 1];
+                        unsigned int len;
+                        len = iwp->length * descr->token_size;
 
-                        err = copy_from_user(essid, iwp->pointer,
-                                             iwp->length *
-                                             descr->token_size);
+                        if (len > IW_ESSID_MAX_SIZE)
+                                return -EFAULT;
+
+                        err = copy_from_user(essid, iwp->pointer, len);
                         if (err)
                                 return -EFAULT;