19 files changed, 97 insertions, 46 deletions

diff --git a/Documentation/feature-removal-schedule.txt b/Documentation/feature-removal-schedule.txt
index d1cd5f93e028..552507fe9a7e 100644
--- a/Documentation/feature-removal-schedule.txt
+++ b/Documentation/feature-removal-schedule.txt
@@ -281,3 +281,16 @@ Why:	The deferred output hooks are a layering violation causing unusual
 Who:    Patrick McHardy <kaber@trash.net>
 
 ---------------------------
+
+What:   frame diverter
+When:   November 2006
+Why:    The frame diverter is included in most distribution kernels, but is
+        broken. It does not correctly handle many things:
+        - IPV6
+        - non-linear skb's
+        - network device RCU on removal
+        - input frames not correctly checked for protocol errors
+        It also adds allocation overhead even if not enabled.
+        It is not clear if anyone is still using it.
+Who:    Stephen Hemminger <shemminger@osdl.org>
+
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index 7947cede8712..87a17337c7f6 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -697,6 +697,12 @@ running once the system is up.
         ips=            [HW,SCSI] Adaptec / IBM ServeRAID controller
                         See header of drivers/scsi/ips.c.
 
+        ports=          [IP_VS_FTP] IPVS ftp helper module
+                        Default is 21.
+                        Up to 8 (IP_VS_APP_MAX_PORTS) ports
+                        may be specified.
+                        Format: <port>,<port>....
+
         irqfixup        [HW]
                         When an interrupt is not handled search all handlers
                         for it. Intended to get systems with badly broken
diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 3e0c017e7877..90ed78110fd4 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -102,9 +102,15 @@ inet_peer_gc_maxtime - INTEGER
 TCP variables: 
 
 tcp_abc - INTEGER
-        Controls Appropriate Byte Count defined in RFC3465. If set to
-        0 then does congestion avoid once per ack. 1 is conservative
-        value, and 2 is more agressive.
+        Controls Appropriate Byte Count (ABC) defined in RFC3465.
+        ABC is a way of increasing congestion window (cwnd) more slowly
+        in response to partial acknowledgments.
+        Possible values are:
+                0 increase cwnd once per acknowledgment (no ABC)
+                1 increase cwnd once per acknowledgment of full sized segment
+                2 allow increase cwnd by two if acknowledgment is
+                  of two segments to compensate for delayed acknowledgments.
+        Default: 0 (off)
 
 tcp_syn_retries - INTEGER
         Number of times initial SYNs for an active TCP connection attempt
diff --git a/MAINTAINERS b/MAINTAINERS
index 25cd7073a20b..a34c53c08742 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -416,7 +416,7 @@ S:	Supported
 ATM
 P:      Chas Williams
 M:      chas@cmf.nrl.navy.mil
-L:      linux-atm-general@lists.sourceforge.net
+L:      linux-atm-general@lists.sourceforge.net (subscribers-only)
 W:      http://linux-atm.sourceforge.net
 S:      Maintained
 
@@ -2810,6 +2810,14 @@ M:	hadi@cyberus.ca
 L:      netdev@vger.kernel.org
 S:      Maintained
 
+TCP LOW PRIORITY MODULE
+P:      Wong Hoi Sing, Edison
+M:      hswong3i@gmail.com
+P:      Hung Hing Lun, Mike
+M:      hlhung3i@gmail.com
+W:      http://tcp-lp-mod.sourceforge.net/
+S:      Maintained
+
 TI OMAP RANDOM NUMBER GENERATOR SUPPORT
 P:      Deepak Saxena
 M:      dsaxena@plexity.net
diff --git a/drivers/atm/he.c b/drivers/atm/he.c
index d369130f4235..dd96123a2b7f 100644
--- a/drivers/atm/he.c
+++ b/drivers/atm/he.c
@@ -2282,6 +2282,8 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
                                 TPDRQ_MASK(he_readl(he_dev, TPDRQ_B_H)));
 
                 if (new_tail == he_dev->tpdrq_head) {
+                        int slot;
+
                         hprintk("tpdrq full (cid 0x%x)\n", cid);
                         /*
                          * FIXME
@@ -2289,6 +2291,13 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
                          * after service_tbrq, service the backlog
                          * for now, we just drop the pdu
                          */
+                        for (slot = 0; slot < TPD_MAXIOV; ++slot) {
+                                if (tpd->iovec[slot].addr)
+                                        pci_unmap_single(he_dev->pci_dev,
+                                                tpd->iovec[slot].addr,
+                                                tpd->iovec[slot].len & TPD_LEN_MASK,
+                                                                PCI_DMA_TODEVICE);
+                        }
                         if (tpd->skb) {
                                 if (tpd->vcc->pop)
                                         tpd->vcc->pop(tpd->vcc, tpd->skb);
diff --git a/include/linux/netfilter/Kbuild b/include/linux/netfilter/Kbuild
index d06311acd448..1d3a14e2da6e 100644
--- a/include/linux/netfilter/Kbuild
+++ b/include/linux/netfilter/Kbuild
@@ -5,7 +5,7 @@ header-y := nf_conntrack_sctp.h nf_conntrack_tuple_common.h		\
             xt_helper.h xt_length.h xt_limit.h xt_mac.h xt_mark.h       \
             xt_MARK.h xt_multiport.h xt_NFQUEUE.h xt_pkttype.h          \
             xt_policy.h xt_realm.h xt_sctp.h xt_state.h xt_string.h     \
-            xt_tcpmss.h xt_tcpudp.h
+            xt_tcpmss.h xt_tcpudp.h xt_SECMARK.h xt_CONNSECMARK.h
 
 unifdef-y := nf_conntrack_common.h nf_conntrack_ftp.h           \
         nf_conntrack_tcp.h nfnetlink.h x_tables.h xt_physdev.h
diff --git a/net/Kconfig b/net/Kconfig
index c6cec5aa5486..4959a4e1e0fe 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -177,7 +177,7 @@ source "net/lapb/Kconfig"
 
 config NET_DIVERT
         bool "Frame Diverter (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        depends on EXPERIMENTAL && BROKEN
         ---help---
           The Frame Diverter allows you to divert packets from the
           network, that are not aimed at the interface receiving it (in
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 7ce7bfe3fbad..7af2c411da82 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -500,9 +500,11 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
                 } else {
                         unsigned int len = skb->len;
 
+                        skb_get(skb);
                         clip_push(vcc, skb);
                         PRIV(skb->dev)->stats.rx_packets--;
                         PRIV(skb->dev)->stats.rx_bytes -= len;
+                        kfree_skb(skb);
                 }
         return 0;
 }
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index a7ba0cce0b46..068d8afbf0a7 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -121,7 +121,7 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
         buf[1] = 0;
         buf[2] = 0;
         buf[3] = BPDU_TYPE_TCN;
-        br_send_bpdu(p, buf, 7);
+        br_send_bpdu(p, buf, 4);
 }
 
 /*
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5130d2efdbbe..fe2113f54e2b 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1432,6 +1432,9 @@ int neigh_table_clear(struct neigh_table *tbl)
         kfree(tbl->phash_buckets);
         tbl->phash_buckets = NULL;
 
+        free_percpu(tbl->stats);
+        tbl->stats = NULL;
+
         return 0;
 }
 
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index a19a33ceb811..37fafb1fbcff 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -46,14 +46,7 @@
  */
 static int ports[IP_VS_APP_MAX_PORTS] = {21, 0};
 module_param_array(ports, int, NULL, 0);
-
-/*
- *      Debug level
- */
-#ifdef CONFIG_IP_VS_DEBUG
-static int debug=0;
-module_param(debug, int, 0);
-#endif
+MODULE_PARM_DESC(ports, "Ports to monitor for FTP control commands");
 
 
 /*      Dummy variable */
@@ -177,7 +170,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                                            &start, &end) != 1)
                         return 1;
 
-                IP_VS_DBG(1-debug, "PASV response (%u.%u.%u.%u:%d) -> "
+                IP_VS_DBG(7, "PASV response (%u.%u.%u.%u:%d) -> "
                           "%u.%u.%u.%u:%d detected\n",
                           NIPQUAD(from), ntohs(port), NIPQUAD(cp->caddr), 0);
 
@@ -280,7 +273,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         while (data <= data_limit - 6) {
                 if (strnicmp(data, "PASV\r\n", 6) == 0) {
                         /* Passive mode on */
-                        IP_VS_DBG(1-debug, "got PASV at %zd of %zd\n",
+                        IP_VS_DBG(7, "got PASV at %zd of %zd\n",
                                   data - data_start,
                                   data_limit - data_start);
                         cp->app_data = &ip_vs_ftp_pasv;
@@ -302,7 +295,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
                                    &start, &end) != 1)
                 return 1;
 
-        IP_VS_DBG(1-debug, "PORT %u.%u.%u.%u:%d detected\n",
+        IP_VS_DBG(7, "PORT %u.%u.%u.%u:%d detected\n",
                   NIPQUAD(to), ntohs(port));
 
         /* Passive mode off */
@@ -311,7 +304,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         /*
          * Now update or create a connection entry for it
          */
-        IP_VS_DBG(1-debug, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
+        IP_VS_DBG(7, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
                   ip_vs_proto_name(iph->protocol),
                   NIPQUAD(to), ntohs(port), NIPQUAD(cp->vaddr), 0);
 
@@ -372,11 +365,17 @@ static int __init ip_vs_ftp_init(void)
         for (i=0; i<IP_VS_APP_MAX_PORTS; i++) {
                 if (!ports[i])
                         continue;
+                if (ports[i] < 0 || ports[i] > 0xffff) {
+                        IP_VS_WARNING("ip_vs_ftp: Ignoring invalid "
+                                      "configuration port[%d] = %d\n",
+                                      i, ports[i]);
+                        continue;
+                }
                 ret = register_ip_vs_app_inc(app, app->protocol, ports[i]);
                 if (ret)
                         break;
-                IP_VS_DBG(1-debug, "%s: loaded support on port[%d] = %d\n",
-                          app->name, i, ports[i]);
+                IP_VS_INFO("%s: loaded support on port[%d] = %d\n",
+                           app->name, i, ports[i]);
         }
 
         if (ret)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 111ff39a08c5..159fa3f1ba67 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -89,7 +89,7 @@ int sysctl_tcp_frto;
 int sysctl_tcp_nometrics_save;
 
 int sysctl_tcp_moderate_rcvbuf = 1;
-int sysctl_tcp_abc = 1;
+int sysctl_tcp_abc;
 
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
 #define FLAG_WIN_UPDATE         0x02 /* Incoming ACK was a window update.       */
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index 1f977b6ee9a1..48f28d617ce6 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -3,13 +3,8 @@
  *
  * TCP Low Priority is a distributed algorithm whose goal is to utilize only
  *   the excess network bandwidth as compared to the ``fair share`` of
- *   bandwidth as targeted by TCP. Available from:
- *     http://www.ece.rice.edu/~akuzma/Doc/akuzma/TCP-LP.pdf
+ *   bandwidth as targeted by TCP.
  *
- * Original Author:
- *   Aleksandar Kuzmanovic <akuzma@northwestern.edu>
- *
- * See http://www-ece.rice.edu/networks/TCP-LP/ for their implementation.
  * As of 2.6.13, Linux supports pluggable congestion control algorithms.
  * Due to the limitation of the API, we take the following changes from
  * the original TCP-LP implementation:
@@ -24,11 +19,20 @@
  *   o OWD is handled in relative format, where local time stamp will in
  *     tcp_time_stamp format.
  *
- * Port from 2.4.19 to 2.6.16 as module by:
- *   Wong Hoi Sing Edison <hswong3i@gmail.com>
- *   Hung Hing Lun <hlhung3i@gmail.com>
+ * Original Author:
+ *   Aleksandar Kuzmanovic <akuzma@northwestern.edu>
+ * Available from:
+ *   http://www.ece.rice.edu/~akuzma/Doc/akuzma/TCP-LP.pdf
+ * Original implementation for 2.4.19:
+ *   http://www-ece.rice.edu/networks/TCP-LP/
  *
- * Version: $Id: tcp_lp.c,v 1.22 2006-05-02 18:18:19 hswong3i Exp $
+ * 2.6.x module Authors:
+ *   Wong Hoi Sing, Edison <hswong3i@gmail.com>
+ *   Hung Hing Lun, Mike <hlhung3i@gmail.com>
+ * SourceForge project page:
+ *   http://tcp-lp-mod.sourceforge.net/
+ *
+ * Version: $Id: tcp_lp.c,v 1.24 2006/09/05 20:22:53 hswong3i Exp $
  */
 
 #include <linux/config.h>
@@ -153,16 +157,19 @@ static u32 tcp_lp_remote_hz_estimator(struct sock *sk)
         if (m < 0)
                 m = -m;
 
-        if (rhz != 0) {
+        if (rhz > 0) {
                 m -= rhz >> 6;  /* m is now error in remote HZ est */
                 rhz += m;       /* 63/64 old + 1/64 new */
         } else
                 rhz = m << 6;
 
+ out:
         /* record time for successful remote HZ calc */
-        lp->flag |= LP_VALID_RHZ;
+        if (rhz > 0)
+                lp->flag |= LP_VALID_RHZ;
+        else
+                lp->flag &= ~LP_VALID_RHZ;
 
- out:
         /* record reference time stamp */
         lp->remote_ref_time = tp->rx_opt.rcv_tsval;
         lp->local_ref_time = tp->rx_opt.rcv_tsecr;
@@ -333,6 +340,6 @@ static void __exit tcp_lp_unregister(void)
 module_init(tcp_lp_register);
 module_exit(tcp_lp_unregister);
 
-MODULE_AUTHOR("Wong Hoi Sing Edison, Hung Hing Lun");
+MODULE_AUTHOR("Wong Hoi Sing Edison, Hung Hing Lun Mike");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("TCP Low Priority");
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 99a6eb23378b..3b55b4c8e2d1 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -696,7 +696,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         }
 
                         tc = *(int *)CMSG_DATA(cmsg);
-                        if (tc < 0 || tc > 0xff)
+                        if (tc < -1 || tc > 0xff)
                                 goto exit_f;
 
                         err = 0;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 3d6e9a351150..356a8a7ef22a 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -401,7 +401,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         if (hlimit < 0)
                 hlimit = ipv6_get_hoplimit(dst->dev);
 
-        tclass = np->cork.tclass;
+        tclass = np->tclass;
         if (tclass < 0)
                 tclass = 0;
 
@@ -497,7 +497,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (hlimit < 0)
                 hlimit = ipv6_get_hoplimit(dst->dev);
 
-        tclass = np->cork.tclass;
+        tclass = np->tclass;
         if (tclass < 0)
                 tclass = 0;
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 43327264e69c..a5eaaf693abf 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -362,7 +362,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 break;
 
         case IPV6_TCLASS:
-                if (val < 0 || val > 0xff)
+                if (val < -1 || val > 0xff)
                         goto e_inval;
                 np->tclass = val;
                 retv = 0;
@@ -947,6 +947,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
 
         case IPV6_TCLASS:
                 val = np->tclass;
+                if (val < 0)
+                        val = 0;
                 break;
 
         case IPV6_RECVTCLASS:
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d57e61ce4a7d..15b862d8acab 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -781,7 +781,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         }
 
         if (tclass < 0) {
-                tclass = np->cork.tclass;
+                tclass = np->tclass;
                 if (tclass < 0)
                         tclass = 0;
         }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f9cef3671593..4172a5235916 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -626,8 +626,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 if ((int)snaplen < 0)
                         snaplen = 0;
         }
-        if (snaplen > skb->len-skb->data_len)
-                snaplen = skb->len-skb->data_len;
 
         spin_lock(&sk->sk_receive_queue.lock);
         h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
@@ -644,7 +642,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 status &= ~TP_STATUS_LOSING;
         spin_unlock(&sk->sk_receive_queue.lock);
 
-        memcpy((u8*)h + macoff, skb->data, snaplen);
+        skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 
         h->tp_len = skb->len;
         h->tp_snaplen = snaplen;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 0834c2ee9174..6f9151899795 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -238,9 +238,7 @@ void __netdev_watchdog_up(struct net_device *dev)
 
 static void dev_watchdog_up(struct net_device *dev)
 {
-        netif_tx_lock_bh(dev);
         __netdev_watchdog_up(dev);
-        netif_tx_unlock_bh(dev);
 }
 
 static void dev_watchdog_down(struct net_device *dev)