Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  ipv4/route.c: respect prefsrc for local routes
  bridge: stp: ensure mac header is set
  bridge: fix br_multicast_ipv6_rcv for paged skbs
  atl1: fix oops when changing tx/rx ring params
  drivers/atm/atmtcp.c: add missing atm_dev_put
  starfire: Fix dma_addr_t size test for MIPS
  tg3: fix return value check in tg3_read_vpd()
  Broadcom CNIC core network driver: fix mem leak on allocation failures in cnic_alloc_uio_rings()
  ISDN, Gigaset: Fix memory leak in do_disconnect_req()
  CAN: Use inode instead of kernel address for /proc file
  skfp: testing the wrong variable in skfp_driver_init()
  ppp: allow disabling multilink protocol ID compression
  ehea: Avoid changing vlan flags
  ueagle-atm: fix PHY signal initialization race

4 files changed, 28 insertions, 14 deletions

diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
index f19e347f56f6..543b3262d002 100644
--- a/net/bridge/br_multicast.c
+++ b/net/bridge/br_multicast.c
@@ -1430,7 +1430,7 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                                  struct net_bridge_port *port,
                                  struct sk_buff *skb)
 {
-        struct sk_buff *skb2 = skb;
+        struct sk_buff *skb2;
         struct ipv6hdr *ip6h;
         struct icmp6hdr *icmp6h;
         u8 nexthdr;
@@ -1469,15 +1469,15 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         if (!skb2)
                 return -ENOMEM;
 
+        err = -EINVAL;
+        if (!pskb_may_pull(skb2, offset + sizeof(struct icmp6hdr)))
+                goto out;
+
         len -= offset - skb_network_offset(skb2);
 
         __skb_pull(skb2, offset);
         skb_reset_transport_header(skb2);
 
-        err = -EINVAL;
-        if (!pskb_may_pull(skb2, sizeof(*icmp6h)))
-                goto out;
-
         icmp6h = icmp6_hdr(skb2);
 
         switch (icmp6h->icmp6_type) {
@@ -1516,7 +1516,12 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
         switch (icmp6h->icmp6_type) {
         case ICMPV6_MGM_REPORT:
             {
-                struct mld_msg *mld = (struct mld_msg *)icmp6h;
+                struct mld_msg *mld;
+                if (!pskb_may_pull(skb2, sizeof(*mld))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                mld = (struct mld_msg *)skb_transport_header(skb2);
                 BR_INPUT_SKB_CB(skb2)->mrouters_only = 1;
                 err = br_ip6_multicast_add_group(br, port, &mld->mld_mca);
                 break;
@@ -1529,15 +1534,18 @@ static int br_multicast_ipv6_rcv(struct net_bridge *br,
                 break;
         case ICMPV6_MGM_REDUCTION:
             {
-                struct mld_msg *mld = (struct mld_msg *)icmp6h;
+                struct mld_msg *mld;
+                if (!pskb_may_pull(skb2, sizeof(*mld))) {
+                        err = -EINVAL;
+                        goto out;
+                }
+                mld = (struct mld_msg *)skb_transport_header(skb2);
                 br_ip6_multicast_leave_group(br, port, &mld->mld_mca);
             }
         }
 
 out:
-        __skb_push(skb2, offset);
-        if (skb2 != skb)
-                kfree_skb(skb2);
+        kfree_skb(skb2);
         return err;
 }
 #endif
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index 35cf27087b56..e3d7aefa9181 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -50,6 +50,8 @@ static void br_send_bpdu(struct net_bridge_port *p,
 
         llc_mac_hdr_init(skb, p->dev->dev_addr, p->br->group_addr);
 
+        skb_reset_mac_header(skb);
+
         NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_OUT, skb, NULL, skb->dev,
                 dev_queue_xmit);
 }
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 6faa8256e10c..9d5e8accfab1 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -125,7 +125,7 @@ struct bcm_sock {
         struct list_head tx_ops;
         unsigned long dropped_usr_msgs;
         struct proc_dir_entry *bcm_proc_read;
-        char procname [20]; /* pointer printed in ASCII with \0 */
+        char procname [32]; /* inode number in decimal with \0 */
 };
 
 static inline struct bcm_sock *bcm_sk(const struct sock *sk)
@@ -1521,7 +1521,7 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
 
         if (proc_dir) {
                 /* unique socket address as filename */
-                sprintf(bo->procname, "%p", sock);
+                sprintf(bo->procname, "%lu", sock_i_ino(sk));
                 bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
                                                      proc_dir,
                                                      &bcm_proc_fops, sk);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index df948b0f1ac9..93bfd95584f4 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2649,8 +2649,12 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
         }
 
         if (res.type == RTN_LOCAL) {
-                if (!fl.fl4_src)
-                        fl.fl4_src = fl.fl4_dst;
+                if (!fl.fl4_src) {
+                        if (res.fi->fib_prefsrc)
+                                fl.fl4_src = res.fi->fib_prefsrc;
+                        else
+                                fl.fl4_src = fl.fl4_dst;
+                }
                 dev_out = net->loopback_dev;
                 fl.oif = dev_out->ifindex;
                 res.fi = NULL;