10 files changed, 37 insertions, 14 deletions

diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index 541168713f1f..3ef0092dc09c 100644
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1708,7 +1708,18 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
                 goto err;
 
         if (proto == PPP_COMP) {
-                ns = dev_alloc_skb(ppp->mru + PPP_HDRLEN);
+                int obuff_size;
+
+                switch(ppp->rcomp->compress_proto) {
+                case CI_MPPE:
+                        obuff_size = ppp->mru + PPP_HDRLEN + 1;
+                        break;
+                default:
+                        obuff_size = ppp->mru + PPP_HDRLEN;
+                        break;
+                }
+
+                ns = dev_alloc_skb(obuff_size);
                 if (ns == 0) {
                         printk(KERN_ERR "ppp_decompress_frame: no memory\n");
                         goto err;
diff --git a/drivers/net/ppp_mppe.c b/drivers/net/ppp_mppe.c
index 5ae80bbe2edc..d5bdd2574659 100644
--- a/drivers/net/ppp_mppe.c
+++ b/drivers/net/ppp_mppe.c
@@ -493,14 +493,14 @@ mppe_decompress(void *arg, unsigned char *ibuf, int isize, unsigned char *obuf,
 
         /*
          * Make sure we have enough room to decrypt the packet.
-         * To account for possible PFC we should only subtract 1
-         * byte whereas in mppe_compress() we added 2 bytes (+MPPE_OVHD);
-         * However, we assume no PFC, thus subtracting 2 bytes.
+         * Note that for our test we only subtract 1 byte whereas in
+         * mppe_compress() we added 2 bytes (+MPPE_OVHD);
+         * this is to account for possible PFC.
          */
-        if (osize < isize - MPPE_OVHD - 2) {
+        if (osize < isize - MPPE_OVHD - 1) {
                 printk(KERN_DEBUG "mppe_decompress[%d]: osize too small! "
                        "(have: %d need: %d)\n", state->unit,
-                       osize, isize - MPPE_OVHD - 2);
+                       osize, isize - MPPE_OVHD - 1);
                 return DECOMP_ERROR;
         }
         osize = isize - MPPE_OVHD - 2;  /* assume no PFC */
diff --git a/include/linux/inetdevice.h b/include/linux/inetdevice.h
index ae04901aa09a..d83fee2dc643 100644
--- a/include/linux/inetdevice.h
+++ b/include/linux/inetdevice.h
@@ -8,6 +8,7 @@
 #include <linux/netdevice.h>
 #include <linux/rcupdate.h>
 #include <linux/timer.h>
+#include <linux/sysctl.h>
 
 struct ipv4_devconf
 {
diff --git a/net/core/dev.c b/net/core/dev.c
index 26090621ea6b..ee051bb398a0 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2009,6 +2009,7 @@ static void net_rx_action(struct softirq_action *h)
                 }
         }
 out:
+        local_irq_enable();
 #ifdef CONFIG_NET_DMA
         /*
          * There may not be any more sk_buffs coming right now, so push
@@ -2022,7 +2023,6 @@ out:
                 rcu_read_unlock();
         }
 #endif
-        local_irq_enable();
         return;
 
 softnet_break:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 7c6a34e21eee..27cfe5fe4bb9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -434,8 +434,8 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
         C(iif);
 #endif
-        skb_copy_secmark(n, skb);
 #endif
+        skb_copy_secmark(n, skb);
         C(truesize);
         atomic_set(&n->users, 1);
         C(head);
@@ -1706,6 +1706,11 @@ next_skb:
                 st->stepped_offset += frag->size;
         }
 
+        if (st->frag_data) {
+                kunmap_skb_frag(st->frag_data);
+                st->frag_data = NULL;
+        }
+
         if (st->cur_skb->next) {
                 st->cur_skb = st->cur_skb->next;
                 st->frag_idx = 0;
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index cd3c7e95de9e..450f44bb2c8e 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1064,7 +1064,11 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
                                         break;
                         }
                         used = recv_actor(desc, skb, offset, len);
-                        if (used <= len) {
+                        if (used < 0) {
+                                if (!copied)
+                                        copied = used;
+                                break;
+                        } else if (used <= len) {
                                 seq += used;
                                 copied += used;
                                 offset += used;
@@ -1086,7 +1090,7 @@ int tcp_read_sock(struct sock *sk, read_descriptor_t *desc,
         tcp_rcv_space_adjust(sk);
 
         /* Clean up data we have read: This will do ACK frames. */
-        if (copied)
+        if (copied > 0)
                 tcp_cleanup_rbuf(sk, copied);
         return copied;
 }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d8b36451bada..0358e6066a4e 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1062,7 +1062,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         pref = ra_msg->icmph.icmp6_router_pref;
         /* 10b is handled as if it were 00b (medium) */
         if (pref == ICMPV6_ROUTER_PREF_INVALID ||
-            in6_dev->cnf.accept_ra_rtr_pref)
+            !in6_dev->cnf.accept_ra_rtr_pref)
                 pref = ICMPV6_ROUTER_PREF_MEDIUM;
 #endif
 
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 3f73327794ab..d0fe3d769828 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -869,8 +869,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nfattr *cda[])
                 return 0;
 
         if (help->helper)
-                /* we had a helper before ... */
-                nf_ct_remove_expectations(ct);
+                return -EBUSY;
 
         /* need to zero data of old helper */
         memset(&help->help, 0, sizeof(help->help));
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 7aaa8c91b293..1b5c6c1055f7 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -442,6 +442,9 @@ static int sip_help(struct sk_buff **pskb,
 
         /* RTP info only in some SDP pkts */
         if (memcmp(dptr, "INVITE", sizeof("INVITE") - 1) != 0 &&
+            memcmp(dptr, "UPDATE", sizeof("UPDATE") - 1) != 0 &&
+            memcmp(dptr, "SIP/2.0 180", sizeof("SIP/2.0 180") - 1) != 0 &&
+            memcmp(dptr, "SIP/2.0 183", sizeof("SIP/2.0 183") - 1) != 0 &&
             memcmp(dptr, "SIP/2.0 200", sizeof("SIP/2.0 200") - 1) != 0) {
                 goto out;
         }
diff --git a/net/tipc/netlink.c b/net/tipc/netlink.c
index 4cdafa2d1d4d..6a7f7b4c2595 100644
--- a/net/tipc/netlink.c
+++ b/net/tipc/netlink.c
@@ -60,7 +60,7 @@ static int handle_cmd(struct sk_buff *skb, struct genl_info *info)
                 rep_nlh = nlmsg_hdr(rep_buf);
                 memcpy(rep_nlh, req_nlh, hdr_space);
                 rep_nlh->nlmsg_len = rep_buf->len;
-                genlmsg_unicast(rep_buf, req_nlh->nlmsg_pid);
+                genlmsg_unicast(rep_buf, NETLINK_CB(skb).pid);
         }
 
         return 0;