Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [NET]: Mark Paul Moore as maintainer of labelled networking.
  [VLAN/BRIDGE]: Fix "skb_pull_rcsum - Fatal exception in interrupt"
  [ISDN]: Get rid of some pointless allocation casts in common and bsd comp.
  [NET]: Avoid pointless allocation casts in BSD compression module
  [IRDA]: Do not do pointless kmalloc return value cast in KingSun driver
  [NET]: Fix crash in dev_mc_sync()/dev_mc_unsync()
  [PPPOL2TP]: Fix endianness annotations.
  [IOAT]: ioatdma needs to to play nice in a multi-dma-client world
  [SLIP]: trivial sparse warning fix
  [EQL]: sparse warning fix
  [NET]: is_power_of_2 in net/core/neighbour.c
  [TCP]: Describe tcp_init_cwnd() thoroughly in a comment.
  [NET]: Fix IP_ADD/DROP_MEMBERSHIP to handle only connectionless
  [KBUILD]: Sanitize tc_ematch headers.
  [IPSEC] AH4: Update IPv4 options handling to conform to RFC 4302.

8 files changed, 48 insertions, 13 deletions

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4bab322c9f8f..328759c32d61 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -116,12 +116,22 @@ int vlan_skb_recv(struct sk_buff *skb, struct net_device *dev,
                   struct packet_type* ptype, struct net_device *orig_dev)
 {
         unsigned char *rawp = NULL;
-        struct vlan_hdr *vhdr = (struct vlan_hdr *)(skb->data);
+        struct vlan_hdr *vhdr;
         unsigned short vid;
         struct net_device_stats *stats;
         unsigned short vlan_TCI;
         __be16 proto;
 
+        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+                return -1;
+
+        if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) {
+                kfree_skb(skb);
+                return -1;
+        }
+
+        vhdr = (struct vlan_hdr *)(skb->data);
+
         /* vlan_TCI = ntohs(get_unaligned(&vhdr->h_vlan_TCI)); */
         vlan_TCI = ntohs(vhdr->h_vlan_TCI);
 
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa779874b9dd..3ee2022928e3 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -509,8 +509,14 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
                                       int (*okfn)(struct sk_buff *))
 {
         struct iphdr *iph;
-        __u32 len;
         struct sk_buff *skb = *pskb;
+        __u32 len = nf_bridge_encap_header_len(skb);
+
+        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+                return NF_STOLEN;
+
+        if (unlikely(!pskb_may_pull(skb, len)))
+                goto out;
 
         if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
             IS_PPPOE_IPV6(skb)) {
@@ -518,8 +524,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
                 if (!brnf_call_ip6tables)
                         return NF_ACCEPT;
 #endif
-                if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
-                        goto out;
                 nf_bridge_pull_encap_header_rcsum(skb);
                 return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
         }
@@ -532,8 +536,6 @@ static unsigned int br_nf_pre_routing(unsigned int hook, struct sk_buff **pskb,
             !IS_PPPOE_IP(skb))
                 return NF_ACCEPT;
 
-        if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
-                goto out;
         nf_bridge_pull_encap_header_rcsum(skb);
 
         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index 99aece1aeccf..20330c572610 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -116,11 +116,13 @@ int dev_mc_add(struct net_device *dev, void *addr, int alen, int glbl)
  */
 int dev_mc_sync(struct net_device *to, struct net_device *from)
 {
-        struct dev_addr_list *da;
+        struct dev_addr_list *da, *next;
         int err = 0;
 
         netif_tx_lock_bh(to);
-        for (da = from->mc_list; da != NULL; da = da->next) {
+        da = from->mc_list;
+        while (da != NULL) {
+                next = da->next;
                 if (!da->da_synced) {
                         err = __dev_addr_add(&to->mc_list, &to->mc_count,
                                              da->da_addr, da->da_addrlen, 0);
@@ -134,6 +136,7 @@ int dev_mc_sync(struct net_device *to, struct net_device *from)
                         __dev_addr_delete(&from->mc_list, &from->mc_count,
                                           da->da_addr, da->da_addrlen, 0);
                 }
+                da = next;
         }
         if (!err)
                 __dev_set_rx_mode(to);
@@ -156,12 +159,14 @@ EXPORT_SYMBOL(dev_mc_sync);
  */
 void dev_mc_unsync(struct net_device *to, struct net_device *from)
 {
-        struct dev_addr_list *da;
+        struct dev_addr_list *da, *next;
 
         netif_tx_lock_bh(from);
         netif_tx_lock_bh(to);
 
-        for (da = from->mc_list; da != NULL; da = da->next) {
+        da = from->mc_list;
+        while (da != NULL) {
+                next = da->next;
                 if (!da->da_synced)
                         continue;
                 __dev_addr_delete(&to->mc_list, &to->mc_count,
@@ -169,6 +174,7 @@ void dev_mc_unsync(struct net_device *to, struct net_device *from)
                 da->da_synced = 0;
                 __dev_addr_delete(&from->mc_list, &from->mc_count,
                                   da->da_addr, da->da_addrlen, 0);
+                da = next;
         }
         __dev_set_rx_mode(to);
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index ca2a1533138a..f7de8f24d8dd 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -33,6 +33,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/random.h>
 #include <linux/string.h>
+#include <linux/log2.h>
 
 #define NEIGH_DEBUG 1
 
@@ -311,7 +312,7 @@ static void neigh_hash_grow(struct neigh_table *tbl, unsigned long new_entries)
 
         NEIGH_CACHE_STAT_INC(tbl, hash_grows);
 
-        BUG_ON(new_entries & (new_entries - 1));
+        BUG_ON(!is_power_of_2(new_entries));
         new_hash = neigh_hash_alloc(new_entries);
         if (!new_hash)
                 return;
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 7a23e59c374a..39f6211f1496 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -46,7 +46,7 @@ static int ip_clear_mutable_options(struct iphdr *iph, __be32 *daddr)
                         memcpy(daddr, optptr+optlen-4, 4);
                         /* Fall through */
                 default:
-                        memset(optptr+2, 0, optlen-2);
+                        memset(optptr, 0, optlen);
                 }
                 l -= optlen;
                 optptr += optlen;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 4d544573f48a..6b420aedcdcf 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -625,6 +625,10 @@ static int do_ip_setsockopt(struct sock *sk, int level,
         {
                 struct ip_mreqn mreq;
 
+                err = -EPROTO;
+                if (inet_sk(sk)->is_icsk)
+                        break;
+
                 if (optlen < sizeof(struct ip_mreq))
                         goto e_inval;
                 err = -EFAULT;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index f030435e0eb4..9785df37a65f 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -755,7 +755,15 @@ void tcp_update_metrics(struct sock *sk)
         }
 }
 
-/* Numbers are taken from RFC2414.  */
+/* Numbers are taken from RFC3390.
+ *
+ * John Heffner states:
+ *
+ *      The RFC specifies a window of no more than 4380 bytes
+ *      unless 2*MSS > 4380.  Reading the pseudocode in the RFC
+ *      is a bit misleading because they use a clamp at 4380 bytes
+ *      rather than use a multiplier in the relevant range.
+ */
 __u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst)
 {
         __u32 cwnd = (dst ? dst_metric(dst, RTAX_INITCWND) : 0);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 761a910f4f97..6b038aa72e88 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -554,6 +554,10 @@ done:
         {
                 struct ipv6_mreq mreq;
 
+                retv = -EPROTO;
+                if (inet_sk(sk)->is_icsk)
+                        break;
+
                 retv = -EFAULT;
                 if (copy_from_user(&mreq, optval, sizeof(struct ipv6_mreq)))
                         break;