6 files changed, 13 insertions, 9 deletions

diff --git a/drivers/bluetooth/btsdio.c b/drivers/bluetooth/btsdio.c
index 58630cc1eff2..cda6c7cc944b 100644
--- a/drivers/bluetooth/btsdio.c
+++ b/drivers/bluetooth/btsdio.c
@@ -152,7 +152,7 @@ static int btsdio_rx_packet(struct btsdio_data *data)
 
         err = sdio_readsb(data->func, skb->data, REG_RDAT, len - 4);
         if (err < 0) {
-                kfree(skb);
+                kfree_skb(skb);
                 return err;
         }
 
diff --git a/drivers/net/wireless/libertas/rx.c b/drivers/net/wireless/libertas/rx.c
index 5749f22b296f..079e6aa874dc 100644
--- a/drivers/net/wireless/libertas/rx.c
+++ b/drivers/net/wireless/libertas/rx.c
@@ -328,7 +328,7 @@ static int process_rxed_802_11_packet(struct lbs_private *priv,
                 lbs_deb_rx("rx err: frame received with bad length\n");
                 priv->stats.rx_length_errors++;
                 ret = -EINVAL;
-                kfree(skb);
+                kfree_skb(skb);
                 goto done;
         }
 
diff --git a/include/linux/phonet.h b/include/linux/phonet.h
index c9609f9aedac..4157faa857b6 100644
--- a/include/linux/phonet.h
+++ b/include/linux/phonet.h
@@ -72,6 +72,7 @@ struct phonetmsg {
         } pn_msg_u;
 };
 #define PN_COMMON_MESSAGE       0xF0
+#define PN_COMMGR               0x10
 #define PN_PREFIX               0xE0 /* resource for extended messages */
 #define pn_submsg_id            pn_msg_u.base.pn_submsg_id
 #define pn_e_submsg_id          pn_msg_u.ext.pn_e_submsg_id
diff --git a/include/net/phonet/phonet.h b/include/net/phonet/phonet.h
index d4e72508e145..c6a245184460 100644
--- a/include/net/phonet/phonet.h
+++ b/include/net/phonet/phonet.h
@@ -27,7 +27,7 @@
  * The lower layers may not require more space, ever. Make sure it's
  * enough.
  */
-#define MAX_PHONET_HEADER       8
+#define MAX_PHONET_HEADER       (8 + MAX_HEADER)
 
 /*
  * Every Phonet* socket has this structure first in its
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index e4c5ac9fe89b..ba85d8831893 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2279,6 +2279,11 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
         }
 
         memset(&opts, 0, sizeof(opts));
+#ifdef CONFIG_SYN_COOKIES
+        if (unlikely(req->cookie_ts))
+                TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
+        else
+#endif
         TCP_SKB_CB(skb)->when = tcp_time_stamp;
         tcp_header_size = tcp_synack_options(sk, req, mss,
                                              skb, &opts, &md5) +
@@ -2304,11 +2309,6 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
 
         /* RFC1323: The window in SYN & SYN/ACK segments is never scaled. */
         th->window = htons(min(req->rcv_wnd, 65535U));
-#ifdef CONFIG_SYN_COOKIES
-        if (unlikely(req->cookie_ts))
-                TCP_SKB_CB(skb)->when = cookie_init_timestamp(req);
-        else
-#endif
         tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
         th->doff = (tcp_header_size >> 2);
         TCP_INC_STATS(sock_net(sk), TCP_MIB_OUTSEGS);
diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index b9d97effebe3..defeb7a0d502 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -261,6 +261,8 @@ static inline int can_respond(struct sk_buff *skb)
                 return 0; /* we are not the destination */
         if (ph->pn_res == PN_PREFIX && !pskb_may_pull(skb, 5))
                 return 0;
+        if (ph->pn_res == PN_COMMGR) /* indications */
+                return 0;
 
         ph = pn_hdr(skb); /* re-acquires the pointer */
         pm = pn_msg(skb);
@@ -309,7 +311,8 @@ static int send_reset_indications(struct sk_buff *rskb)
 
         return pn_raw_send(data, sizeof(data), rskb->dev,
                                 pn_object(oph->pn_sdev, 0x00),
-                                pn_object(oph->pn_rdev, oph->pn_robj), 0x10);
+                                pn_object(oph->pn_rdev, oph->pn_robj),
+                                PN_COMMGR);
 }