Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	Documentation/feature-removal-schedule.txt
	drivers/net/wireless/ath/ar9170/usb.c
	drivers/scsi/iscsi_tcp.c
	net/ipv4/ipmr.c

12 files changed, 79 insertions, 23 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 32611c8f1219..3daee30a7c82 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1470,7 +1470,7 @@ static inline void net_timestamp(struct sk_buff *skb)
  *
  * return values:
  *      NET_RX_SUCCESS  (no congestion)
- *      NET_RX_DROP     (packet was dropped)
+ *      NET_RX_DROP     (packet was dropped, but freed)
  *
  * dev_forward_skb can be used for injecting an skb from the
  * start_xmit function of one device into the receive queue
@@ -1484,12 +1484,11 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 {
         skb_orphan(skb);
 
-        if (!(dev->flags & IFF_UP))
-                return NET_RX_DROP;
-
-        if (skb->len > (dev->mtu + dev->hard_header_len))
+        if (!(dev->flags & IFF_UP) ||
+            (skb->len > (dev->mtu + dev->hard_header_len))) {
+                kfree_skb(skb);
                 return NET_RX_DROP;
-
+        }
         skb_set_dev(skb, dev);
         skb->tstamp.tv64 = 0;
         skb->pkt_type = PACKET_HOST;
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index 6e747065c202..80769f1f9fab 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -661,13 +661,13 @@ struct sk_buff *arp_create(int type, int ptype, __be32 dest_ip,
 #endif
 #endif
 
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 arp->ar_hrd = htons(ARPHRD_ETHER);
                 arp->ar_pro = htons(ETH_P_IP);
                 break;
 #endif
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
         case ARPHRD_IEEE802_TR:
                 arp->ar_hrd = htons(ARPHRD_IEEE802);
                 arp->ar_pro = htons(ETH_P_IP);
@@ -1051,7 +1051,7 @@ static int arp_req_set(struct net *net, struct arpreq *r,
                         return -EINVAL;
         }
         switch (dev->type) {
-#ifdef CONFIG_FDDI
+#if defined(CONFIG_FDDI) || defined(CONFIG_FDDI_MODULE)
         case ARPHRD_FDDI:
                 /*
                  * According to RFC 1390, FDDI devices should accept ARP
diff --git a/net/ipv4/ipmr.c b/net/ipv4/ipmr.c
index f3f1c6b5c70c..7a7ee1cc3b5a 100644
--- a/net/ipv4/ipmr.c
+++ b/net/ipv4/ipmr.c
@@ -998,7 +998,8 @@ ipmr_cache_unresolved(struct mr_table *mrt, vifi_t vifi, struct sk_buff *skb)
                 atomic_inc(&mrt->cache_resolve_queue_len);
                 list_add(&c->list, &mrt->mfc_unres_queue);
 
-                mod_timer(&mrt->ipmr_expire_timer, c->mfc_un.unres.expires);
+                if (atomic_read(&mrt->cache_resolve_queue_len) == 1)
+                        mod_timer(&mrt->ipmr_expire_timer, c->mfc_un.unres.expires);
         }
 
         /*
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 4560b291180b..f3e00c5cd1ed 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1536,6 +1536,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
         uh   = udp_hdr(skb);
         ulen = ntohs(uh->len);
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
+
         if (ulen > skb->len)
                 goto short_packet;
 
@@ -1549,9 +1552,6 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp4_csum_init(skb, uh, proto))
                 goto csum_error;
 
-        saddr = ip_hdr(skb)->saddr;
-        daddr = ip_hdr(skb)->daddr;
-
         if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                 return __udp4_lib_mcast_deliver(net, skb, uh,
                                 saddr, daddr, udptable);
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index d2df3144429b..e733942dafe1 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -200,7 +200,7 @@ lookup_protocol:
 
         inet_sk(sk)->pinet6 = np = inet6_sk_generic(sk);
         np->hop_limit   = -1;
-        np->mcast_hops  = -1;
+        np->mcast_hops  = IPV6_DEFAULT_MCASTHOPS;
         np->mc_loop     = 1;
         np->pmtudisc    = IPV6_PMTUDISC_WANT;
         np->ipv6only    = net->ipv6.sysctl.bindv6only;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 5959230bc6c1..712684687c9a 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -222,6 +222,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
         if (!skb)
                 return;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         serr = SKB_EXT_ERR(skb);
         serr->ee.ee_errno = err;
         serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
@@ -255,6 +257,8 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
         if (!skb)
                 return;
 
+        skb->protocol = htons(ETH_P_IPV6);
+
         skb_put(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         iph = ipv6_hdr(skb);
@@ -358,7 +362,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_flowinfo = 0;
                 sin->sin6_port = serr->port;
                 sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                         ipv6_addr_copy(&sin->sin6_addr,
                                   (struct in6_addr *)(nh + serr->addr_offset));
                         if (np->sndflow)
@@ -380,7 +384,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                 sin->sin6_family = AF_INET6;
                 sin->sin6_flowinfo = 0;
                 sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                         ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr);
                         if (np->rxopt.all)
                                 datagram_recv_ctl(sk, msg, skb);
diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c
index a432f0ec051c..94e7fca75b85 100644
--- a/net/llc/llc_sap.c
+++ b/net/llc/llc_sap.c
@@ -31,7 +31,7 @@ static int llc_mac_header_len(unsigned short devtype)
         case ARPHRD_ETHER:
         case ARPHRD_LOOPBACK:
                 return sizeof(struct ethhdr);
-#ifdef CONFIG_TR
+#if defined(CONFIG_TR) || defined(CONFIG_TR_MODULE)
         case ARPHRD_IEEE802_TR:
                 return sizeof(struct trh_hdr);
 #endif
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 11783192a625..3093e46273c3 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2178,7 +2178,8 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata,
                                 continue;
 
                         if (wk->type != IEEE80211_WORK_DIRECT_PROBE &&
-                            wk->type != IEEE80211_WORK_AUTH)
+                            wk->type != IEEE80211_WORK_AUTH &&
+                            wk->type != IEEE80211_WORK_ASSOC)
                                 continue;
 
                         if (memcmp(req->bss->bssid, wk->filter_ta, ETH_ALEN))
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 2a570184e5a9..ea2192444ce6 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -440,11 +440,25 @@ void sctp_icmp_proto_unreachable(struct sock *sk,
 {
         SCTP_DEBUG_PRINTK("%s\n",  __func__);
 
-        sctp_do_sm(SCTP_EVENT_T_OTHER,
-                   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
-                   asoc->state, asoc->ep, asoc, t,
-                   GFP_ATOMIC);
+        if (sock_owned_by_user(sk)) {
+                if (timer_pending(&t->proto_unreach_timer))
+                        return;
+                else {
+                        if (!mod_timer(&t->proto_unreach_timer,
+                                                jiffies + (HZ/20)))
+                                sctp_association_hold(asoc);
+                }
+                        
+        } else {
+                if (timer_pending(&t->proto_unreach_timer) &&
+                    del_timer(&t->proto_unreach_timer))
+                        sctp_association_put(asoc);
 
+                sctp_do_sm(SCTP_EVENT_T_OTHER,
+                           SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                           asoc->state, asoc->ep, asoc, t,
+                           GFP_ATOMIC);
+        }
 }
 
 /* Common lookup code for icmp/icmpv6 error handler. */
diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
index 3b7230ef77c2..22e670200449 100644
--- a/net/sctp/sm_sideeffect.c
+++ b/net/sctp/sm_sideeffect.c
@@ -397,6 +397,41 @@ out_unlock:
         sctp_transport_put(transport);
 }
 
+/* Handle the timeout of the ICMP protocol unreachable timer.  Trigger
+ * the correct state machine transition that will close the association.
+ */
+void sctp_generate_proto_unreach_event(unsigned long data)
+{
+        struct sctp_transport *transport = (struct sctp_transport *) data;
+        struct sctp_association *asoc = transport->asoc;
+        
+        sctp_bh_lock_sock(asoc->base.sk);
+        if (sock_owned_by_user(asoc->base.sk)) {
+                SCTP_DEBUG_PRINTK("%s:Sock is busy.\n", __func__);
+
+                /* Try again later.  */
+                if (!mod_timer(&transport->proto_unreach_timer,
+                                jiffies + (HZ/20)))
+                        sctp_association_hold(asoc);
+                goto out_unlock;
+        }
+
+        /* Is this structure just waiting around for us to actually
+         * get destroyed?
+         */
+        if (asoc->base.dead)
+                goto out_unlock;
+
+        sctp_do_sm(SCTP_EVENT_T_OTHER,
+                   SCTP_ST_OTHER(SCTP_EVENT_ICMP_PROTO_UNREACH),
+                   asoc->state, asoc->ep, asoc, transport, GFP_ATOMIC);
+
+out_unlock:
+        sctp_bh_unlock_sock(asoc->base.sk);
+        sctp_association_put(asoc);
+}
+
+
 /* Inject a SACK Timeout event into the state machine.  */
 static void sctp_generate_sack_event(unsigned long data)
 {
diff --git a/net/sctp/transport.c b/net/sctp/transport.c
index fccf4947aff1..d67501f92ca3 100644
--- a/net/sctp/transport.c
+++ b/net/sctp/transport.c
@@ -92,6 +92,8 @@ static struct sctp_transport *sctp_transport_init(struct sctp_transport *peer,
                         (unsigned long)peer);
         setup_timer(&peer->hb_timer, sctp_generate_heartbeat_event,
                         (unsigned long)peer);
+        setup_timer(&peer->proto_unreach_timer,
+                    sctp_generate_proto_unreach_event, (unsigned long)peer);
 
         /* Initialize the 64-bit random nonce sent with heartbeat. */
         get_random_bytes(&peer->hb_nonce, sizeof(peer->hb_nonce));
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index f394fc190a49..95afe79dd9d7 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -237,7 +237,7 @@ rpcauth_prune_expired(struct list_head *free, int nr_to_scan)
         list_for_each_entry_safe(cred, next, &cred_unused, cr_lru) {
 
                 /* Enforce a 60 second garbage collection moratorium */
-                if (time_in_range_open(cred->cr_expire, expired, jiffies) &&
+                if (time_in_range(cred->cr_expire, expired, jiffies) &&
                     test_bit(RPCAUTH_CRED_HASHED, &cred->cr_flags) != 0)
                         continue;