6 files changed, 24 insertions, 22 deletions

diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d43fe2863095..0b7aded8dcfd 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.5.6"
-#define DRV_MODULE_RELDATE      "March 28, 2007"
+#define DRV_MODULE_VERSION      "1.5.7"
+#define DRV_MODULE_RELDATE      "March 29, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -3099,20 +3099,18 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
 
         if ((align_start = (offset32 & 3))) {
                 offset32 &= ~3;
-                len32 += (4 - align_start);
+                len32 += align_start;
+                if (len32 < 4)
+                        len32 = 4;
                 if ((rc = bnx2_nvram_read(bp, offset32, start, 4)))
                         return rc;
         }
 
         if (len32 & 3) {
-                if ((len32 > 4) || !align_start) {
-                        align_end = 4 - (len32 & 3);
-                        len32 += align_end;
-                        if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4,
-                                end, 4))) {
-                                return rc;
-                        }
-                }
+                align_end = 4 - (len32 & 3);
+                len32 += align_end;
+                if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4, end, 4)))
+                        return rc;
         }
 
         if (align_start || align_end) {
@@ -3187,17 +3185,17 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                 if ((rc = bnx2_enable_nvram_write(bp)) != 0)
                         goto nvram_write_end;
 
-                /* Erase the page */
-                if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0)
-                        goto nvram_write_end;
-
-                /* Re-enable the write again for the actual write */
-                bnx2_enable_nvram_write(bp);
-
                 /* Loop to write back the buffer data from page_start to
                  * data_start */
                 i = 0;
                 if (bp->flash_info->buffered == 0) {
+                        /* Erase the page */
+                        if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0)
+                                goto nvram_write_end;
+
+                        /* Re-enable the write again for the actual write */
+                        bnx2_enable_nvram_write(bp);
+
                         for (addr = page_start; addr < data_start;
                                 addr += 4, i += 4) {
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index d011819a8058..7174ced75efc 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -143,7 +143,7 @@ int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
                 }
         }
 
-        err = -ENETUNREACH;
+        err = -ESRCH;
 out:
         rcu_read_unlock();
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index dc151139b5af..688b95594f2e 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1607,6 +1607,9 @@ u32 __tcp_select_window(struct sock *sk)
                  */
                 if (window <= free_space - mss || window > free_space)
                         window = (free_space/mss)*mss;
+                else if (mss == full_space &&
+                         free_space > window + full_space/2)
+                        window = free_space;
         }
 
         return window;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 306d5d83c068..203e069e7fe9 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -687,9 +687,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int err;
 
         /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
          */
-        if (len < 0)
+        if (len > INT_MAX)
                 return -EMSGSIZE;
 
         /* Mirror BSD error message compatibility */
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 0ad471909881..f590db57a7c9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -615,7 +615,7 @@ do_udp_sendmsg:
                 return udp_sendmsg(iocb, sk, msg, len);
 
         /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
            */
         if (len > INT_MAX - sizeof(struct udphdr))
                 return -EMSGSIZE;
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index 70fe36eb66a2..4a91f082a81d 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -109,6 +109,7 @@ static void basic_destroy(struct tcf_proto *tp)
                 list_del(&f->link);
                 basic_delete_filter(tp, f);
         }
+        kfree(head);
 }
 
 static int basic_delete(struct tcf_proto *tp, unsigned long arg)