aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
authorLinus Torvalds <torvalds@woody.linux-foundation.org>2008-02-24 00:05:06 -0500
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2008-02-24 00:07:10 -0500
commitbdc08942897f6be33d00bb659761516f4652836d (patch)
tree238ec76128b8feb9da7e3ad8b85a3b15a318dd3f /net
parent85b80ebfa4384b8ea30cc1af9617db30319a9ccd (diff)
parent1b04ab4597725f75f94942da9aa40daa7b9a4bd9 (diff)
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6
* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (37 commits) [NETFILTER]: fix ebtable targets return [IP_TUNNEL]: Don't limit the number of tunnels with generic name explicitly. [NET]: Restore sanity wrt. print_mac(). [NEIGH]: Fix race between neighbor lookup and table's hash_rnd update. [RTNL]: Validate hardware and broadcast address attribute for RTM_NEWLINK tg3: ethtool phys_id default [BNX2]: Update version to 1.7.4. [BNX2]: Disable parallel detect on an HP blade. [BNX2]: More 5706S link down workaround. ssb: Fix support for PCI devices behind a SSB->PCI bridge zd1211rw: fix sparse warnings rtl818x: fix sparse warnings ssb: Fix pcicore cardbus mode ssb: Make the GPIO API reentrancy safe ssb: Fix the GPIO API ssb: Fix watchdog access for devices without a chipcommon ssb: Fix serial console on new bcm47xx devices ath5k: Fix build warnings on some 64-bit platforms. WDEV, ath5k, don't return int from bool function WDEV: ath5k, fix lock imbalance ...
Diffstat (limited to 'net')
-rw-r--r--net/8021q/vlan_dev.c10
-rw-r--r--net/9p/trans_virtio.c2
-rw-r--r--net/bridge/netfilter/ebt_dnat.c4
-rw-r--r--net/bridge/netfilter/ebt_redirect.c4
-rw-r--r--net/bridge/netfilter/ebt_snat.c4
-rw-r--r--net/core/dev.c2
-rw-r--r--net/core/neighbour.c7
-rw-r--r--net/core/rtnetlink.c27
-rw-r--r--net/ipv4/fib_hash.c10
-rw-r--r--net/ipv4/ip_gre.c12
-rw-r--r--net/ipv4/ipip.c12
-rw-r--r--net/ipv4/netfilter/arpt_mangle.c2
-rw-r--r--net/ipv4/netfilter/ip_queue.c12
-rw-r--r--net/ipv6/ip6_tunnel.c15
-rw-r--r--net/ipv6/netfilter/ip6_queue.c10
-rw-r--r--net/ipv6/sit.c12
-rw-r--r--net/netfilter/nfnetlink_queue.c10
-rw-r--r--net/netfilter/xt_hashlimit.c3
-rw-r--r--net/netfilter/xt_iprange.c2
-rw-r--r--net/netfilter/xt_u32.c11
-rw-r--r--net/sctp/socket.c2
21 files changed, 83 insertions, 90 deletions
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index fc60c6d096b9..77f04e49a1a0 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -366,8 +366,7 @@ static int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
366{ 366{
367 struct net_device_stats *stats = &dev->stats; 367 struct net_device_stats *stats = &dev->stats;
368 struct vlan_ethhdr *veth = (struct vlan_ethhdr *)(skb->data); 368 struct vlan_ethhdr *veth = (struct vlan_ethhdr *)(skb->data);
369 DECLARE_MAC_BUF(mac); 369
370 DECLARE_MAC_BUF(mac2);
371 /* Handle non-VLAN frames if they are sent to us, for example by DHCP. 370 /* Handle non-VLAN frames if they are sent to us, for example by DHCP.
372 * 371 *
373 * NOTE: THIS ASSUMES DIX ETHERNET, SPECIFICALLY NOT SUPPORTING 372 * NOTE: THIS ASSUMES DIX ETHERNET, SPECIFICALLY NOT SUPPORTING
@@ -405,8 +404,11 @@ static int vlan_dev_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
405 404
406 pr_debug("%s: about to send skb: %p to dev: %s\n", 405 pr_debug("%s: about to send skb: %p to dev: %s\n",
407 __FUNCTION__, skb, skb->dev->name); 406 __FUNCTION__, skb, skb->dev->name);
408 pr_debug(" %s %s %4hx %4hx %4hx\n", 407 pr_debug(" " MAC_FMT " " MAC_FMT " %4hx %4hx %4hx\n",
409 print_mac(mac, veth->h_dest), print_mac(mac2, veth->h_source), 408 veth->h_dest[0], veth->h_dest[1], veth->h_dest[2],
409 veth->h_dest[3], veth->h_dest[4], veth->h_dest[5],
410 veth->h_source[0], veth->h_source[1], veth->h_source[2],
411 veth->h_source[3], veth->h_source[4], veth->h_source[5],
410 veth->h_vlan_proto, veth->h_vlan_TCI, 412 veth->h_vlan_proto, veth->h_vlan_TCI,
411 veth->h_vlan_encapsulated_proto); 413 veth->h_vlan_encapsulated_proto);
412 414
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index 9e3d81cb9f08..de7a9f532edc 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -110,7 +110,7 @@ static struct p9_req_t *p9_lookup_tag(struct virtio_chan *c, u16 tag)
110 } 110 }
111 for (count = old_max; count < c->max_tag; count++) { 111 for (count = old_max; count < c->max_tag; count++) {
112 c->reqs[count].status = REQ_STATUS_IDLE; 112 c->reqs[count].status = REQ_STATUS_IDLE;
113 c->reqs[count].wq = kmalloc(sizeof(wait_queue_t), 113 c->reqs[count].wq = kmalloc(sizeof(wait_queue_head_t),
114 GFP_ATOMIC); 114 GFP_ATOMIC);
115 if (!c->reqs[count].wq) { 115 if (!c->reqs[count].wq) {
116 printk(KERN_ERR "Couldn't grow tag array\n"); 116 printk(KERN_ERR "Couldn't grow tag array\n");
diff --git a/net/bridge/netfilter/ebt_dnat.c b/net/bridge/netfilter/ebt_dnat.c
index e700cbf634c2..ca64c1cc1b47 100644
--- a/net/bridge/netfilter/ebt_dnat.c
+++ b/net/bridge/netfilter/ebt_dnat.c
@@ -20,8 +20,8 @@ static int ebt_target_dnat(struct sk_buff *skb, unsigned int hooknr,
20{ 20{
21 const struct ebt_nat_info *info = data; 21 const struct ebt_nat_info *info = data;
22 22
23 if (skb_make_writable(skb, 0)) 23 if (!skb_make_writable(skb, 0))
24 return NF_DROP; 24 return EBT_DROP;
25 25
26 memcpy(eth_hdr(skb)->h_dest, info->mac, ETH_ALEN); 26 memcpy(eth_hdr(skb)->h_dest, info->mac, ETH_ALEN);
27 return info->target; 27 return info->target;
diff --git a/net/bridge/netfilter/ebt_redirect.c b/net/bridge/netfilter/ebt_redirect.c
index bfdf2fb60b1f..b8afe850cf1e 100644
--- a/net/bridge/netfilter/ebt_redirect.c
+++ b/net/bridge/netfilter/ebt_redirect.c
@@ -21,8 +21,8 @@ static int ebt_target_redirect(struct sk_buff *skb, unsigned int hooknr,
21{ 21{
22 const struct ebt_redirect_info *info = data; 22 const struct ebt_redirect_info *info = data;
23 23
24 if (skb_make_writable(skb, 0)) 24 if (!skb_make_writable(skb, 0))
25 return NF_DROP; 25 return EBT_DROP;
26 26
27 if (hooknr != NF_BR_BROUTING) 27 if (hooknr != NF_BR_BROUTING)
28 memcpy(eth_hdr(skb)->h_dest, 28 memcpy(eth_hdr(skb)->h_dest,
diff --git a/net/bridge/netfilter/ebt_snat.c b/net/bridge/netfilter/ebt_snat.c
index e252dabbb143..5425333dda03 100644
--- a/net/bridge/netfilter/ebt_snat.c
+++ b/net/bridge/netfilter/ebt_snat.c
@@ -22,8 +22,8 @@ static int ebt_target_snat(struct sk_buff *skb, unsigned int hooknr,
22{ 22{
23 const struct ebt_nat_info *info = data; 23 const struct ebt_nat_info *info = data;
24 24
25 if (skb_make_writable(skb, 0)) 25 if (!skb_make_writable(skb, 0))
26 return NF_DROP; 26 return EBT_DROP;
27 27
28 memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN); 28 memcpy(eth_hdr(skb)->h_source, info->mac, ETH_ALEN);
29 if (!(info->target & NAT_ARP_BIT) && 29 if (!(info->target & NAT_ARP_BIT) &&
diff --git a/net/core/dev.c b/net/core/dev.c
index 908f07c3bd7d..fcdf03cf3b3f 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2900,7 +2900,7 @@ int __dev_addr_add(struct dev_addr_list **list, int *count,
2900 } 2900 }
2901 } 2901 }
2902 2902
2903 da = kmalloc(sizeof(*da), GFP_ATOMIC); 2903 da = kzalloc(sizeof(*da), GFP_ATOMIC);
2904 if (da == NULL) 2904 if (da == NULL)
2905 return -ENOMEM; 2905 return -ENOMEM;
2906 memcpy(da->da_addr, addr, alen); 2906 memcpy(da->da_addr, addr, alen);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index a16cf1ec5e5e..2328acbd16cd 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -358,11 +358,12 @@ struct neighbour *neigh_lookup(struct neigh_table *tbl, const void *pkey,
358{ 358{
359 struct neighbour *n; 359 struct neighbour *n;
360 int key_len = tbl->key_len; 360 int key_len = tbl->key_len;
361 u32 hash_val = tbl->hash(pkey, dev); 361 u32 hash_val;
362 362
363 NEIGH_CACHE_STAT_INC(tbl, lookups); 363 NEIGH_CACHE_STAT_INC(tbl, lookups);
364 364
365 read_lock_bh(&tbl->lock); 365 read_lock_bh(&tbl->lock);
366 hash_val = tbl->hash(pkey, dev);
366 for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) { 367 for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
367 if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) { 368 if (dev == n->dev && !memcmp(n->primary_key, pkey, key_len)) {
368 neigh_hold(n); 369 neigh_hold(n);
@@ -379,11 +380,12 @@ struct neighbour *neigh_lookup_nodev(struct neigh_table *tbl, struct net *net,
379{ 380{
380 struct neighbour *n; 381 struct neighbour *n;
381 int key_len = tbl->key_len; 382 int key_len = tbl->key_len;
382 u32 hash_val = tbl->hash(pkey, NULL); 383 u32 hash_val;
383 384
384 NEIGH_CACHE_STAT_INC(tbl, lookups); 385 NEIGH_CACHE_STAT_INC(tbl, lookups);
385 386
386 read_lock_bh(&tbl->lock); 387 read_lock_bh(&tbl->lock);
388 hash_val = tbl->hash(pkey, NULL);
387 for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) { 389 for (n = tbl->hash_buckets[hash_val & tbl->hash_mask]; n; n = n->next) {
388 if (!memcmp(n->primary_key, pkey, key_len) && 390 if (!memcmp(n->primary_key, pkey, key_len) &&
389 (net == n->dev->nd_net)) { 391 (net == n->dev->nd_net)) {
@@ -507,6 +509,7 @@ struct pneigh_entry * pneigh_lookup(struct neigh_table *tbl,
507 if (tbl->pconstructor && tbl->pconstructor(n)) { 509 if (tbl->pconstructor && tbl->pconstructor(n)) {
508 if (dev) 510 if (dev)
509 dev_put(dev); 511 dev_put(dev);
512 release_net(net);
510 kfree(n); 513 kfree(n);
511 n = NULL; 514 n = NULL;
512 goto out; 515 goto out;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 61ac8d06292c..2bd9c5f7627d 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -689,10 +689,12 @@ const struct nla_policy ifla_policy[IFLA_MAX+1] = {
689 [IFLA_BROADCAST] = { .type = NLA_BINARY, .len = MAX_ADDR_LEN }, 689 [IFLA_BROADCAST] = { .type = NLA_BINARY, .len = MAX_ADDR_LEN },
690 [IFLA_MAP] = { .len = sizeof(struct rtnl_link_ifmap) }, 690 [IFLA_MAP] = { .len = sizeof(struct rtnl_link_ifmap) },
691 [IFLA_MTU] = { .type = NLA_U32 }, 691 [IFLA_MTU] = { .type = NLA_U32 },
692 [IFLA_LINK] = { .type = NLA_U32 },
692 [IFLA_TXQLEN] = { .type = NLA_U32 }, 693 [IFLA_TXQLEN] = { .type = NLA_U32 },
693 [IFLA_WEIGHT] = { .type = NLA_U32 }, 694 [IFLA_WEIGHT] = { .type = NLA_U32 },
694 [IFLA_OPERSTATE] = { .type = NLA_U8 }, 695 [IFLA_OPERSTATE] = { .type = NLA_U8 },
695 [IFLA_LINKMODE] = { .type = NLA_U8 }, 696 [IFLA_LINKMODE] = { .type = NLA_U8 },
697 [IFLA_LINKINFO] = { .type = NLA_NESTED },
696 [IFLA_NET_NS_PID] = { .type = NLA_U32 }, 698 [IFLA_NET_NS_PID] = { .type = NLA_U32 },
697}; 699};
698 700
@@ -720,6 +722,21 @@ static struct net *get_net_ns_by_pid(pid_t pid)
720 return net; 722 return net;
721} 723}
722 724
725static int validate_linkmsg(struct net_device *dev, struct nlattr *tb[])
726{
727 if (dev) {
728 if (tb[IFLA_ADDRESS] &&
729 nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
730 return -EINVAL;
731
732 if (tb[IFLA_BROADCAST] &&
733 nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
734 return -EINVAL;
735 }
736
737 return 0;
738}
739
723static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm, 740static int do_setlink(struct net_device *dev, struct ifinfomsg *ifm,
724 struct nlattr **tb, char *ifname, int modified) 741 struct nlattr **tb, char *ifname, int modified)
725{ 742{
@@ -892,12 +909,7 @@ static int rtnl_setlink(struct sk_buff *skb, struct nlmsghdr *nlh, void *arg)
892 goto errout; 909 goto errout;
893 } 910 }
894 911
895 if (tb[IFLA_ADDRESS] && 912 if ((err = validate_linkmsg(dev, tb)) < 0)
896 nla_len(tb[IFLA_ADDRESS]) < dev->addr_len)
897 goto errout_dev;
898
899 if (tb[IFLA_BROADCAST] &&
900 nla_len(tb[IFLA_BROADCAST]) < dev->addr_len)
901 goto errout_dev; 913 goto errout_dev;
902 914
903 err = do_setlink(dev, ifm, tb, ifname, 0); 915 err = do_setlink(dev, ifm, tb, ifname, 0);
@@ -1018,6 +1030,9 @@ replay:
1018 else 1030 else
1019 dev = NULL; 1031 dev = NULL;
1020 1032
1033 if ((err = validate_linkmsg(dev, tb)) < 0)
1034 return err;
1035
1021 if (tb[IFLA_LINKINFO]) { 1036 if (tb[IFLA_LINKINFO]) {
1022 err = nla_parse_nested(linkinfo, IFLA_INFO_MAX, 1037 err = nla_parse_nested(linkinfo, IFLA_INFO_MAX,
1023 tb[IFLA_LINKINFO], ifla_info_policy); 1038 tb[IFLA_LINKINFO], ifla_info_policy);
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 76b9c684cccd..8d58d85dfac6 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -372,7 +372,8 @@ static struct fib_node *fib_find_node(struct fn_zone *fz, __be32 key)
372static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg) 372static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
373{ 373{
374 struct fn_hash *table = (struct fn_hash *) tb->tb_data; 374 struct fn_hash *table = (struct fn_hash *) tb->tb_data;
375 struct fib_node *new_f, *f; 375 struct fib_node *new_f = NULL;
376 struct fib_node *f;
376 struct fib_alias *fa, *new_fa; 377 struct fib_alias *fa, *new_fa;
377 struct fn_zone *fz; 378 struct fn_zone *fz;
378 struct fib_info *fi; 379 struct fib_info *fi;
@@ -496,7 +497,6 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
496 497
497 err = -ENOBUFS; 498 err = -ENOBUFS;
498 499
499 new_f = NULL;
500 if (!f) { 500 if (!f) {
501 new_f = kmem_cache_zalloc(fn_hash_kmem, GFP_KERNEL); 501 new_f = kmem_cache_zalloc(fn_hash_kmem, GFP_KERNEL);
502 if (new_f == NULL) 502 if (new_f == NULL)
@@ -512,7 +512,7 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
512 if (new_fa->fa_info != NULL) { 512 if (new_fa->fa_info != NULL) {
513 new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL); 513 new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL);
514 if (new_fa == NULL) 514 if (new_fa == NULL)
515 goto out_free_new_f; 515 goto out;
516 } 516 }
517 new_fa->fa_info = fi; 517 new_fa->fa_info = fi;
518 new_fa->fa_tos = tos; 518 new_fa->fa_tos = tos;
@@ -540,9 +540,9 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
540 &cfg->fc_nlinfo, 0); 540 &cfg->fc_nlinfo, 0);
541 return 0; 541 return 0;
542 542
543out_free_new_f:
544 kmem_cache_free(fn_hash_kmem, new_f);
545out: 543out:
544 if (new_f)
545 kmem_cache_free(fn_hash_kmem, new_f);
546 fib_release_info(fi); 546 fib_release_info(fi);
547 return err; 547 return err;
548} 548}
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 63f691719353..906cb1ada4c3 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -259,16 +259,8 @@ static struct ip_tunnel * ipgre_tunnel_locate(struct ip_tunnel_parm *parms, int
259 259
260 if (parms->name[0]) 260 if (parms->name[0])
261 strlcpy(name, parms->name, IFNAMSIZ); 261 strlcpy(name, parms->name, IFNAMSIZ);
262 else { 262 else
263 int i; 263 sprintf(name, "gre%%d");
264 for (i=1; i<100; i++) {
265 sprintf(name, "gre%d", i);
266 if (__dev_get_by_name(&init_net, name) == NULL)
267 break;
268 }
269 if (i==100)
270 goto failed;
271 }
272 264
273 dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup); 265 dev = alloc_netdev(sizeof(*t), name, ipgre_tunnel_setup);
274 if (!dev) 266 if (!dev)
diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
index da281581692c..e77e3b855834 100644
--- a/net/ipv4/ipip.c
+++ b/net/ipv4/ipip.c
@@ -221,16 +221,8 @@ static struct ip_tunnel * ipip_tunnel_locate(struct ip_tunnel_parm *parms, int c
221 221
222 if (parms->name[0]) 222 if (parms->name[0])
223 strlcpy(name, parms->name, IFNAMSIZ); 223 strlcpy(name, parms->name, IFNAMSIZ);
224 else { 224 else
225 int i; 225 sprintf(name, "tunl%%d");
226 for (i=1; i<100; i++) {
227 sprintf(name, "tunl%d", i);
228 if (__dev_get_by_name(&init_net, name) == NULL)
229 break;
230 }
231 if (i==100)
232 goto failed;
233 }
234 226
235 dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup); 227 dev = alloc_netdev(sizeof(*t), name, ipip_tunnel_setup);
236 if (dev == NULL) 228 if (dev == NULL)
diff --git a/net/ipv4/netfilter/arpt_mangle.c b/net/ipv4/netfilter/arpt_mangle.c
index 45fa4e20094a..3f4222b0a803 100644
--- a/net/ipv4/netfilter/arpt_mangle.c
+++ b/net/ipv4/netfilter/arpt_mangle.c
@@ -19,7 +19,7 @@ target(struct sk_buff *skb,
19 unsigned char *arpptr; 19 unsigned char *arpptr;
20 int pln, hln; 20 int pln, hln;
21 21
22 if (skb_make_writable(skb, skb->len)) 22 if (!skb_make_writable(skb, skb->len))
23 return NF_DROP; 23 return NF_DROP;
24 24
25 arp = arp_hdr(skb); 25 arp = arp_hdr(skb);
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 6bda1102851b..fe05da41d6ba 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -283,8 +283,8 @@ static int
283ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e) 283ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
284{ 284{
285 int diff; 285 int diff;
286 int err;
287 struct iphdr *user_iph = (struct iphdr *)v->payload; 286 struct iphdr *user_iph = (struct iphdr *)v->payload;
287 struct sk_buff *nskb;
288 288
289 if (v->data_len < sizeof(*user_iph)) 289 if (v->data_len < sizeof(*user_iph))
290 return 0; 290 return 0;
@@ -296,14 +296,16 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
296 if (v->data_len > 0xFFFF) 296 if (v->data_len > 0xFFFF)
297 return -EINVAL; 297 return -EINVAL;
298 if (diff > skb_tailroom(e->skb)) { 298 if (diff > skb_tailroom(e->skb)) {
299 err = pskb_expand_head(e->skb, 0, 299 nskb = skb_copy_expand(e->skb, 0,
300 diff - skb_tailroom(e->skb), 300 diff - skb_tailroom(e->skb),
301 GFP_ATOMIC); 301 GFP_ATOMIC);
302 if (err) { 302 if (!nskb) {
303 printk(KERN_WARNING "ip_queue: error " 303 printk(KERN_WARNING "ip_queue: error "
304 "in mangle, dropping packet: %d\n", -err); 304 "in mangle, dropping packet\n");
305 return err; 305 return -ENOMEM;
306 } 306 }
307 kfree_skb(e->skb);
308 e->skb = nskb;
307 } 309 }
308 skb_put(e->skb, diff); 310 skb_put(e->skb, diff);
309 } 311 }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index cd940647bd12..2a124e9a1b2d 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -229,18 +229,11 @@ static struct ip6_tnl *ip6_tnl_create(struct ip6_tnl_parm *p)
229 char name[IFNAMSIZ]; 229 char name[IFNAMSIZ];
230 int err; 230 int err;
231 231
232 if (p->name[0]) { 232 if (p->name[0])
233 strlcpy(name, p->name, IFNAMSIZ); 233 strlcpy(name, p->name, IFNAMSIZ);
234 } else { 234 else
235 int i; 235 sprintf(name, "ip6tnl%%d");
236 for (i = 1; i < IP6_TNL_MAX; i++) { 236
237 sprintf(name, "ip6tnl%d", i);
238 if (__dev_get_by_name(&init_net, name) == NULL)
239 break;
240 }
241 if (i == IP6_TNL_MAX)
242 goto failed;
243 }
244 dev = alloc_netdev(sizeof (*t), name, ip6_tnl_dev_setup); 237 dev = alloc_netdev(sizeof (*t), name, ip6_tnl_dev_setup);
245 if (dev == NULL) 238 if (dev == NULL)
246 goto failed; 239 goto failed;
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index e869916b05f1..cc2f9afcf808 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -285,8 +285,8 @@ static int
285ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e) 285ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
286{ 286{
287 int diff; 287 int diff;
288 int err;
289 struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload; 288 struct ipv6hdr *user_iph = (struct ipv6hdr *)v->payload;
289 struct sk_buff *nskb;
290 290
291 if (v->data_len < sizeof(*user_iph)) 291 if (v->data_len < sizeof(*user_iph))
292 return 0; 292 return 0;
@@ -298,14 +298,16 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct nf_queue_entry *e)
298 if (v->data_len > 0xFFFF) 298 if (v->data_len > 0xFFFF)
299 return -EINVAL; 299 return -EINVAL;
300 if (diff > skb_tailroom(e->skb)) { 300 if (diff > skb_tailroom(e->skb)) {
301 err = pskb_expand_head(e->skb, 0, 301 nskb = skb_copy_expand(e->skb, 0,
302 diff - skb_tailroom(e->skb), 302 diff - skb_tailroom(e->skb),
303 GFP_ATOMIC); 303 GFP_ATOMIC);
304 if (err) { 304 if (!nskb) {
305 printk(KERN_WARNING "ip6_queue: OOM " 305 printk(KERN_WARNING "ip6_queue: OOM "
306 "in mangle, dropping packet\n"); 306 "in mangle, dropping packet\n");
307 return err; 307 return -ENOMEM;
308 } 308 }
309 kfree_skb(e->skb);
310 e->skb = nskb;
309 } 311 }
310 skb_put(e->skb, diff); 312 skb_put(e->skb, diff);
311 } 313 }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index e77239d02bf5..dde7801abeff 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -164,16 +164,8 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int
164 164
165 if (parms->name[0]) 165 if (parms->name[0])
166 strlcpy(name, parms->name, IFNAMSIZ); 166 strlcpy(name, parms->name, IFNAMSIZ);
167 else { 167 else
168 int i; 168 sprintf(name, "sit%%d");
169 for (i=1; i<100; i++) {
170 sprintf(name, "sit%d", i);
171 if (__dev_get_by_name(&init_net, name) == NULL)
172 break;
173 }
174 if (i==100)
175 goto failed;
176 }
177 169
178 dev = alloc_netdev(sizeof(*t), name, ipip6_tunnel_setup); 170 dev = alloc_netdev(sizeof(*t), name, ipip6_tunnel_setup);
179 if (dev == NULL) 171 if (dev == NULL)
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index a48b20fe9cd6..0043d3a9f87e 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -443,8 +443,8 @@ err_out:
443static int 443static int
444nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e) 444nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e)
445{ 445{
446 struct sk_buff *nskb;
446 int diff; 447 int diff;
447 int err;
448 448
449 diff = data_len - e->skb->len; 449 diff = data_len - e->skb->len;
450 if (diff < 0) { 450 if (diff < 0) {
@@ -454,14 +454,16 @@ nfqnl_mangle(void *data, int data_len, struct nf_queue_entry *e)
454 if (data_len > 0xFFFF) 454 if (data_len > 0xFFFF)
455 return -EINVAL; 455 return -EINVAL;
456 if (diff > skb_tailroom(e->skb)) { 456 if (diff > skb_tailroom(e->skb)) {
457 err = pskb_expand_head(e->skb, 0, 457 nskb = skb_copy_expand(e->skb, 0,
458 diff - skb_tailroom(e->skb), 458 diff - skb_tailroom(e->skb),
459 GFP_ATOMIC); 459 GFP_ATOMIC);
460 if (err) { 460 if (!nskb) {
461 printk(KERN_WARNING "nf_queue: OOM " 461 printk(KERN_WARNING "nf_queue: OOM "
462 "in mangle, dropping packet\n"); 462 "in mangle, dropping packet\n");
463 return err; 463 return -ENOMEM;
464 } 464 }
465 kfree_skb(e->skb);
466 e->skb = nskb;
465 } 467 }
466 skb_put(e->skb, diff); 468 skb_put(e->skb, diff);
467 } 469 }
diff --git a/net/netfilter/xt_hashlimit.c b/net/netfilter/xt_hashlimit.c
index 744c7f2ab0b1..5418ce59ac3a 100644
--- a/net/netfilter/xt_hashlimit.c
+++ b/net/netfilter/xt_hashlimit.c
@@ -774,9 +774,6 @@ hashlimit_mt_check(const char *tablename, const void *inf,
774 return false; 774 return false;
775 } 775 }
776 mutex_unlock(&hlimit_mutex); 776 mutex_unlock(&hlimit_mutex);
777
778 /* Ugly hack: For SMP, we only want to use one set */
779 info->master = info;
780 return true; 777 return true;
781} 778}
782 779
diff --git a/net/netfilter/xt_iprange.c b/net/netfilter/xt_iprange.c
index 4f984dc60319..500528d60cd7 100644
--- a/net/netfilter/xt_iprange.c
+++ b/net/netfilter/xt_iprange.c
@@ -102,7 +102,7 @@ iprange_ipv6_sub(const struct in6_addr *a, const struct in6_addr *b)
102 int r; 102 int r;
103 103
104 for (i = 0; i < 4; ++i) { 104 for (i = 0; i < 4; ++i) {
105 r = (__force u32)a->s6_addr32[i] - (__force u32)b->s6_addr32[i]; 105 r = ntohl(a->s6_addr32[i]) - ntohl(b->s6_addr32[i]);
106 if (r != 0) 106 if (r != 0)
107 return r; 107 return r;
108 } 108 }
diff --git a/net/netfilter/xt_u32.c b/net/netfilter/xt_u32.c
index 9b8ed390a8e0..627e0f336d54 100644
--- a/net/netfilter/xt_u32.c
+++ b/net/netfilter/xt_u32.c
@@ -26,7 +26,6 @@ static bool u32_match_it(const struct xt_u32 *data,
26 u_int32_t pos; 26 u_int32_t pos;
27 u_int32_t val; 27 u_int32_t val;
28 u_int32_t at; 28 u_int32_t at;
29 int ret;
30 29
31 /* 30 /*
32 * Small example: "0 >> 28 == 4 && 8 & 0xFF0000 >> 16 = 6, 17" 31 * Small example: "0 >> 28 == 4 && 8 & 0xFF0000 >> 16 = 6, 17"
@@ -40,8 +39,8 @@ static bool u32_match_it(const struct xt_u32 *data,
40 if (skb->len < 4 || pos > skb->len - 4) 39 if (skb->len < 4 || pos > skb->len - 4)
41 return false; 40 return false;
42 41
43 ret = skb_copy_bits(skb, pos, &n, sizeof(n)); 42 if (skb_copy_bits(skb, pos, &n, sizeof(n)) < 0)
44 BUG_ON(ret < 0); 43 BUG();
45 val = ntohl(n); 44 val = ntohl(n);
46 nnums = ct->nnums; 45 nnums = ct->nnums;
47 46
@@ -67,9 +66,9 @@ static bool u32_match_it(const struct xt_u32 *data,
67 pos > skb->len - at - 4) 66 pos > skb->len - at - 4)
68 return false; 67 return false;
69 68
70 ret = skb_copy_bits(skb, at + pos, &n, 69 if (skb_copy_bits(skb, at + pos, &n,
71 sizeof(n)); 70 sizeof(n)) < 0)
72 BUG_ON(ret < 0); 71 BUG();
73 val = ntohl(n); 72 val = ntohl(n);
74 break; 73 break;
75 } 74 }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d47d5787e2e5..44797ad88a05 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6488,6 +6488,7 @@ struct proto sctp_prot = {
6488 .memory_pressure = &sctp_memory_pressure, 6488 .memory_pressure = &sctp_memory_pressure,
6489 .enter_memory_pressure = sctp_enter_memory_pressure, 6489 .enter_memory_pressure = sctp_enter_memory_pressure,
6490 .memory_allocated = &sctp_memory_allocated, 6490 .memory_allocated = &sctp_memory_allocated,
6491 .sockets_allocated = &sctp_sockets_allocated,
6491 REF_PROTO_INUSE(sctp) 6492 REF_PROTO_INUSE(sctp)
6492}; 6493};
6493 6494
@@ -6521,6 +6522,7 @@ struct proto sctpv6_prot = {
6521 .memory_pressure = &sctp_memory_pressure, 6522 .memory_pressure = &sctp_memory_pressure,
6522 .enter_memory_pressure = sctp_enter_memory_pressure, 6523 .enter_memory_pressure = sctp_enter_memory_pressure,
6523 .memory_allocated = &sctp_memory_allocated, 6524 .memory_allocated = &sctp_memory_allocated,
6525 .sockets_allocated = &sctp_sockets_allocated,
6524 REF_PROTO_INUSE(sctpv6) 6526 REF_PROTO_INUSE(sctpv6)
6525}; 6527};
6526#endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */ 6528#endif /* defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE) */