7 files changed, 32 insertions, 13 deletions

diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 86b3bb9bec2d..92420f007b97 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -914,7 +914,7 @@ static void decode_prio_command(struct sixpack *sp, unsigned char cmd)
                                         printk(KERN_DEBUG "6pack: protocol violation\n");
                                 else
                                         sp->status = 0;
-                                cmd &= !SIXP_RX_DCD_MASK;
+                                cmd &= ~SIXP_RX_DCD_MASK;
                 }
                 sp->status = cmd & SIXP_PRIO_DATA_MASK;
         } else { /* output watchdog char if idle */
diff --git a/include/net/sock.h b/include/net/sock.h
index ac286a353032..9cdbae2a53a3 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -883,18 +883,23 @@ static inline int sk_filter(struct sock *sk, struct sk_buff *skb)
 }
 
 /**
- *      sk_filter_release: Release a socket filter
- *      @rcu: rcu_head that contains the sk_filter info to remove
- *
- *      Remove a filter from a socket and release its resources.
+ *      sk_filter_rcu_free: Free a socket filter
+ *      @rcu: rcu_head that contains the sk_filter to free
  */
- 
 static inline void sk_filter_rcu_free(struct rcu_head *rcu)
 {
         struct sk_filter *fp = container_of(rcu, struct sk_filter, rcu);
         kfree(fp);
 }
 
+/**
+ *      sk_filter_release: Release a socket filter
+ *      @sk: socket
+ *      @fp: filter to remove
+ *
+ *      Remove a filter from a socket and release its resources.
+ */
+
 static inline void sk_filter_release(struct sock *sk, struct sk_filter *fp)
 {
         unsigned int size = sk_filter_len(fp);
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 146496fce2e2..fded1493c1dc 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -160,6 +160,8 @@ static __init int dccpprobe_init(void)
         init_waitqueue_head(&dccpw.wait);
         spin_lock_init(&dccpw.lock);
         dccpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &dccpw.lock);
+        if (IS_ERR(dccpw.fifo))
+                return PTR_ERR(dccpw.fifo);
 
         if (!proc_net_fops_create(procname, S_IRUSR, &dccpprobe_fops))
                 goto err0;
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323.c b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
index 7b7441202bfd..6cb9070cd0bc 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323.c
@@ -1417,7 +1417,7 @@ static int process_rcf(struct sk_buff **pskb, struct ip_conntrack *ct,
                 DEBUGP
                     ("ip_ct_ras: set RAS connection timeout to %u seconds\n",
                      info->timeout);
-                ip_ct_refresh_acct(ct, ctinfo, NULL, info->timeout * HZ);
+                ip_ct_refresh(ct, *pskb, info->timeout * HZ);
 
                 /* Set expect timeout */
                 read_lock_bh(&ip_conntrack_lock);
@@ -1465,7 +1465,7 @@ static int process_urq(struct sk_buff **pskb, struct ip_conntrack *ct,
         info->sig_port[!dir] = 0;
 
         /* Give it 30 seconds for UCF or URJ */
-        ip_ct_refresh_acct(ct, ctinfo, NULL, 30 * HZ);
+        ip_ct_refresh(ct, *pskb, 30 * HZ);
 
         return 0;
 }
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 4be336f17883..f230eeecf092 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -156,6 +156,8 @@ static __init int tcpprobe_init(void)
         init_waitqueue_head(&tcpw.wait);
         spin_lock_init(&tcpw.lock);
         tcpw.fifo = kfifo_alloc(bufsize, GFP_KERNEL, &tcpw.lock);
+        if (IS_ERR(tcpw.fifo))
+                return PTR_ERR(tcpw.fifo);
 
         if (!proc_net_fops_create(procname, S_IRUSR, &tcpprobe_fops))
                 goto err0;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 865d75214a9a..9e1bd374875e 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -928,23 +928,32 @@ static int udp_encap_rcv(struct sock * sk, struct sk_buff *skb)
         return 1; 
 #else
         struct udp_sock *up = udp_sk(sk);
-        struct udphdr *uh = skb->h.uh;
+        struct udphdr *uh;
         struct iphdr *iph;
         int iphlen, len;
   
-        __u8 *udpdata = (__u8 *)uh + sizeof(struct udphdr);
-        __be32 *udpdata32 = (__be32 *)udpdata;
+        __u8 *udpdata;
+        __be32 *udpdata32;
         __u16 encap_type = up->encap_type;
 
         /* if we're overly short, let UDP handle it */
-        if (udpdata > skb->tail)
+        len = skb->len - sizeof(struct udphdr);
+        if (len <= 0)
                 return 1;
 
         /* if this is not encapsulated socket, then just return now */
         if (!encap_type)
                 return 1;
 
-        len = skb->tail - udpdata;
+        /* If this is a paged skb, make sure we pull up
+         * whatever data we need to look at. */
+        if (!pskb_may_pull(skb, sizeof(struct udphdr) + min(len, 8)))
+                return 1;
+
+        /* Now we can get the pointers */
+        uh = skb->h.uh;
+        udpdata = (__u8 *)uh + sizeof(struct udphdr);
+        udpdata32 = (__be32 *)udpdata;
 
         switch (encap_type) {
         default:
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index c4cde57d9216..2ee14f8a1908 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -495,6 +495,7 @@ static struct xfrm_state *xfrm_user_state_lookup(struct xfrm_usersa_id *p,
                         goto out;
                 }
 
+                err = -ESRCH;
                 x = xfrm_state_lookup_byaddr(&p->daddr, saddr, p->proto,
                                              p->family);
         }