6 files changed, 20 insertions, 8 deletions

diff --git a/net/core/netevent.c b/net/core/netevent.c
index 35d02c38554e..95f81de87502 100644
--- a/net/core/netevent.c
+++ b/net/core/netevent.c
@@ -15,6 +15,7 @@
 
 #include <linux/rtnetlink.h>
 #include <linux/notifier.h>
+#include <net/netevent.h>
 
 static ATOMIC_NOTIFIER_HEAD(netevent_notif_chain);
 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index cf40ff91ac01..a0efdd7a6b37 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -72,8 +72,7 @@ static void queue_process(struct work_struct *work)
                         netif_tx_unlock(dev);
                         local_irq_restore(flags);
 
-                        if (atomic_read(&npinfo->refcnt))
-                                schedule_delayed_work(&npinfo->tx_work, HZ/10);
+                        schedule_delayed_work(&npinfo->tx_work, HZ/10);
                         return;
                 }
                 netif_tx_unlock(dev);
@@ -786,8 +785,7 @@ void netpoll_cleanup(struct netpoll *np)
                         if (atomic_dec_and_test(&npinfo->refcnt)) {
                                 skb_queue_purge(&npinfo->arp_tx);
                                 skb_queue_purge(&npinfo->txq);
-                                cancel_delayed_work(&npinfo->tx_work);
-                                flush_scheduled_work();
+                                cancel_rearming_delayed_work(&npinfo->tx_work);
 
                                 /* clean after last, unfinished work */
                                 if (!skb_queue_empty(&npinfo->txq)) {
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 27cfe5fe4bb9..3943c3ad9145 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2211,7 +2211,6 @@ EXPORT_SYMBOL(pskb_copy);
 EXPORT_SYMBOL(pskb_expand_head);
 EXPORT_SYMBOL(skb_checksum);
 EXPORT_SYMBOL(skb_clone);
-EXPORT_SYMBOL(skb_clone_fraglist);
 EXPORT_SYMBOL(skb_copy);
 EXPORT_SYMBOL(skb_copy_and_csum_bits);
 EXPORT_SYMBOL(skb_copy_and_csum_dev);
diff --git a/net/netfilter/nf_conntrack_h323_asn1.c b/net/netfilter/nf_conntrack_h323_asn1.c
index f6fad713d484..6b7eaa019d4c 100644
--- a/net/netfilter/nf_conntrack_h323_asn1.c
+++ b/net/netfilter/nf_conntrack_h323_asn1.c
@@ -518,7 +518,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
                         CHECK_BOUND(bs, 2);
                         len = get_len(bs);
                         CHECK_BOUND(bs, len);
-                        if (!base) {
+                        if (!base || !(son->attr & DECODE)) {
                                 PRINT("%*.s%s\n", (level + 1) * TAB_SIZE,
                                       " ", son->name);
                                 bs->cur += len;
@@ -704,6 +704,8 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
         } else {
                 ext = 0;
                 type = get_bits(bs, f->sz);
+                if (type >= f->lb)
+                        return H323_ERROR_RANGE;
         }
 
         /* Write Type */
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index 84cd53635fe8..2c29394fd92e 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -844,6 +844,10 @@ static int sctp_inet6_bind_verify(struct sctp_sock *opt, union sctp_addr *addr)
                         dev = dev_get_by_index(addr->v6.sin6_scope_id);
                         if (!dev)
                                 return 0;
+                        if (!ipv6_chk_addr(&addr->v6.sin6_addr, dev, 0)) {
+                                dev_put(dev);
+                                return 0;
+                        }
                         dev_put(dev);
                 }
                 af = opt->pf->af;
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 67861a8f00cb..b1917f68723c 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -980,6 +980,7 @@ static int __sctp_connect(struct sock* sk,
         union sctp_addr *sa_addr;
         void *addr_buf;
         unsigned short port;
+        unsigned int f_flags = 0;
 
         sp = sctp_sk(sk);
         ep = sp->ep;
@@ -1106,7 +1107,14 @@ static int __sctp_connect(struct sock* sk,
         af->to_sk_daddr(&to, sk);
         sk->sk_err = 0;
 
-        timeo = sock_sndtimeo(sk, sk->sk_socket->file->f_flags & O_NONBLOCK);
+        /* in-kernel sockets don't generally have a file allocated to them
+         * if all they do is call sock_create_kern().
+         */
+        if (sk->sk_socket->file)
+                f_flags = sk->sk_socket->file->f_flags;
+
+        timeo = sock_sndtimeo(sk, f_flags & O_NONBLOCK);
+
         err = sctp_wait_for_connect(asoc, &timeo);
 
         /* Don't free association on exit. */
@@ -4170,7 +4178,7 @@ static int sctp_copy_laddrs(struct sock *sk, __u16 port, void *to,
                 to += addrlen;
                 cnt ++;
                 space_left -= addrlen;
-                bytes_copied += addrlen;
+                *bytes_copied += addrlen;
         }
 
         return cnt;