6 files changed, 117 insertions, 88 deletions

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 7af9a13cb9be..f1e5af4be98e 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -46,6 +46,7 @@ struct prefix_info {
 #include <linux/in6.h>
 #include <linux/netdevice.h>
 #include <net/if_inet6.h>
+#include <net/ipv6.h>
 
 #define IN6_ADDR_HSIZE          16
 
diff --git a/include/net/pkt_sched.h b/include/net/pkt_sched.h
index 87496e3aa330..fcb05a387dbe 100644
--- a/include/net/pkt_sched.h
+++ b/include/net/pkt_sched.h
@@ -140,7 +140,7 @@ psched_tod_diff(int delta_sec, int bound)
         if (bound <= 1000000 || delta_sec > (0x7FFFFFFF/1000000)-1)
                 return bound;
         delta = delta_sec * 1000000;
-        if (delta > bound)
+        if (delta > bound || delta < 0)
                 delta = bound;
         return delta;
 }
@@ -156,7 +156,9 @@ psched_tod_diff(int delta_sec, int bound)
                    __delta += 1000000; \
            case 1: \
                    __delta += 1000000; \
-           case 0: ; \
+           case 0: \
+                   if (__delta > bound || __delta < 0) \
+                        __delta = bound; \
            } \
            __delta; \
 })
diff --git a/include/net/sctp/sm.h b/include/net/sctp/sm.h
index 5576db56324d..f4fcee104707 100644
--- a/include/net/sctp/sm.h
+++ b/include/net/sctp/sm.h
@@ -407,32 +407,38 @@ sctp_vtag_verify(const struct sctp_chunk *chunk,
         return 0;
 }
 
-/* Check VTAG of the packet matches the sender's own tag OR its peer's
- * tag and the T bit is set in the Chunk Flags.
+/* Check VTAG of the packet matches the sender's own tag and the T bit is
+ * not set, OR its peer's tag and the T bit is set in the Chunk Flags.
  */
 static inline int
 sctp_vtag_verify_either(const struct sctp_chunk *chunk,
                         const struct sctp_association *asoc)
 {
-        /* RFC 2960 Section 8.5.1, sctpimpguide-06 Section 2.13.2
+        /* RFC 2960 Section 8.5.1, sctpimpguide Section 2.41
          *
-         * B) The receiver of a ABORT shall accept the packet if the
-         * Verification Tag field of the packet matches its own tag OR it
-         * is set to its peer's tag and the T bit is set in the Chunk
-         * Flags. Otherwise, the receiver MUST silently discard the packet
-         * and take no further action.
-         *
-         * (C) The receiver of a SHUTDOWN COMPLETE shall accept the
-         * packet if the Verification Tag field of the packet
-         * matches its own tag OR it is set to its peer's tag and
-         * the T bit is set in the Chunk Flags.  Otherwise, the
-         * receiver MUST silently discard the packet and take no
-         * further action....
+         * B) The receiver of a ABORT MUST accept the packet
+         *    if the Verification Tag field of the packet matches its own tag
+         *    and the T bit is not set
+         *    OR
+         *    it is set to its peer's tag and the T bit is set in the Chunk
+         *    Flags.
+         *    Otherwise, the receiver MUST silently discard the packet
+         *    and take no further action.
          *
+         * C) The receiver of a SHUTDOWN COMPLETE shall accept the packet
+         *    if the Verification Tag field of the packet matches its own tag
+         *    and the T bit is not set
+         *    OR
+         *    it is set to its peer's tag and the T bit is set in the Chunk
+         *    Flags.
+         *    Otherwise, the receiver MUST silently discard the packet
+         *    and take no further action.  An endpoint MUST ignore the
+         *    SHUTDOWN COMPLETE if it is not in the SHUTDOWN-ACK-SENT state.
          */
-        if ((ntohl(chunk->sctp_hdr->vtag) == asoc->c.my_vtag) ||
-            (sctp_test_T_bit(chunk) && (ntohl(chunk->sctp_hdr->vtag)
-            == asoc->c.peer_vtag))) {
+        if ((!sctp_test_T_bit(chunk) &&
+             (ntohl(chunk->sctp_hdr->vtag) == asoc->c.my_vtag)) ||
+            (sctp_test_T_bit(chunk) &&
+             (ntohl(chunk->sctp_hdr->vtag) == asoc->c.peer_vtag))) {
                 return 1;
         }
 
diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
index 7e64cf6bda1e..6c24d9cd3d66 100644
--- a/include/net/sctp/structs.h
+++ b/include/net/sctp/structs.h
@@ -154,6 +154,13 @@ extern struct sctp_globals {
         int max_retrans_path;
         int max_retrans_init;
 
+        /*
+         * Policy for preforming sctp/socket accounting
+         * 0   - do socket level accounting, all assocs share sk_sndbuf
+         * 1   - do sctp accounting, each asoc may use sk_sndbuf bytes
+         */
+        int sndbuf_policy;
+
         /* HB.interval              - 30 seconds  */
         int hb_interval;
 
@@ -207,6 +214,7 @@ extern struct sctp_globals {
 #define sctp_valid_cookie_life          (sctp_globals.valid_cookie_life)
 #define sctp_cookie_preserve_enable     (sctp_globals.cookie_preserve_enable)
 #define sctp_max_retrans_association    (sctp_globals.max_retrans_association)
+#define sctp_sndbuf_policy              (sctp_globals.sndbuf_policy)
 #define sctp_max_retrans_path           (sctp_globals.max_retrans_path)
 #define sctp_max_retrans_init           (sctp_globals.max_retrans_init)
 #define sctp_hb_interval                (sctp_globals.hb_interval)
@@ -1212,7 +1220,8 @@ struct sctp_endpoint {
         /* Default timeouts.  */
         int timeouts[SCTP_NUM_TIMEOUT_TYPES];
 
-        /* Various thresholds.  */
+        /* sendbuf acct. policy.        */
+        __u32 sndbuf_policy;
 
         /* Name for debugging output... */
         char *debug_name;
diff --git a/include/net/sock.h b/include/net/sock.h
index be81cabd0da3..cc4c9190b7fd 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -90,17 +90,17 @@ do {	spin_lock_init(&((__sk)->sk_lock.slock)); \
 struct sock;
 
 /**
-  *     struct sock_common - minimal network layer representation of sockets
-  *     @skc_family - network address family
-  *     @skc_state - Connection state
-  *     @skc_reuse - %SO_REUSEADDR setting
-  *     @skc_bound_dev_if - bound device index if != 0
-  *     @skc_node - main hash linkage for various protocol lookup tables
-  *     @skc_bind_node - bind hash linkage for various protocol lookup tables
-  *     @skc_refcnt - reference count
-  *
-  *     This is the minimal network layer representation of sockets, the header
-  *     for struct sock and struct tcp_tw_bucket.
+ *      struct sock_common - minimal network layer representation of sockets
+ *      @skc_family: network address family
+ *      @skc_state: Connection state
+ *      @skc_reuse: %SO_REUSEADDR setting
+ *      @skc_bound_dev_if: bound device index if != 0
+ *      @skc_node: main hash linkage for various protocol lookup tables
+ *      @skc_bind_node: bind hash linkage for various protocol lookup tables
+ *      @skc_refcnt: reference count
+ *
+ *      This is the minimal network layer representation of sockets, the header
+ *      for struct sock and struct tcp_tw_bucket.
   */
 struct sock_common {
         unsigned short          skc_family;
@@ -114,60 +114,61 @@ struct sock_common {
 
 /**
   *     struct sock - network layer representation of sockets
-  *     @__sk_common - shared layout with tcp_tw_bucket
-  *     @sk_shutdown - mask of %SEND_SHUTDOWN and/or %RCV_SHUTDOWN
-  *     @sk_userlocks - %SO_SNDBUF and %SO_RCVBUF settings
-  *     @sk_lock -      synchronizer
-  *     @sk_rcvbuf - size of receive buffer in bytes
-  *     @sk_sleep - sock wait queue
-  *     @sk_dst_cache - destination cache
-  *     @sk_dst_lock - destination cache lock
-  *     @sk_policy - flow policy
-  *     @sk_rmem_alloc - receive queue bytes committed
-  *     @sk_receive_queue - incoming packets
-  *     @sk_wmem_alloc - transmit queue bytes committed
-  *     @sk_write_queue - Packet sending queue
-  *     @sk_omem_alloc - "o" is "option" or "other"
-  *     @sk_wmem_queued - persistent queue size
-  *     @sk_forward_alloc - space allocated forward
-  *     @sk_allocation - allocation mode
-  *     @sk_sndbuf - size of send buffer in bytes
-  *     @sk_flags - %SO_LINGER (l_onoff), %SO_BROADCAST, %SO_KEEPALIVE, %SO_OOBINLINE settings
-  *     @sk_no_check - %SO_NO_CHECK setting, wether or not checkup packets
-  *     @sk_route_caps - route capabilities (e.g. %NETIF_F_TSO)
-  *     @sk_lingertime - %SO_LINGER l_linger setting
-  *     @sk_hashent - hash entry in several tables (e.g. tcp_ehash)
-  *     @sk_backlog - always used with the per-socket spinlock held
-  *     @sk_callback_lock - used with the callbacks in the end of this struct
-  *     @sk_error_queue - rarely used
-  *     @sk_prot - protocol handlers inside a network family
-  *     @sk_err - last error
-  *     @sk_err_soft - errors that don't cause failure but are the cause of a persistent failure not just 'timed out'
-  *     @sk_ack_backlog - current listen backlog
-  *     @sk_max_ack_backlog - listen backlog set in listen()
-  *     @sk_priority - %SO_PRIORITY setting
-  *     @sk_type - socket type (%SOCK_STREAM, etc)
-  *     @sk_protocol - which protocol this socket belongs in this network family
-  *     @sk_peercred - %SO_PEERCRED setting
-  *     @sk_rcvlowat - %SO_RCVLOWAT setting
-  *     @sk_rcvtimeo - %SO_RCVTIMEO setting
-  *     @sk_sndtimeo - %SO_SNDTIMEO setting
-  *     @sk_filter - socket filtering instructions
-  *     @sk_protinfo - private area, net family specific, when not using slab
-  *     @sk_timer - sock cleanup timer
-  *     @sk_stamp - time stamp of last packet received
-  *     @sk_socket - Identd and reporting IO signals
-  *     @sk_user_data - RPC layer private data
-  *     @sk_sndmsg_page - cached page for sendmsg
-  *     @sk_sndmsg_off - cached offset for sendmsg
-  *     @sk_send_head - front of stuff to transmit
-  *     @sk_write_pending - a write to stream socket waits to start
-  *     @sk_state_change - callback to indicate change in the state of the sock
-  *     @sk_data_ready - callback to indicate there is data to be processed
-  *     @sk_write_space - callback to indicate there is bf sending space available
-  *     @sk_error_report - callback to indicate errors (e.g. %MSG_ERRQUEUE)
-  *     @sk_backlog_rcv - callback to process the backlog
-  *     @sk_destruct - called at sock freeing time, i.e. when all refcnt == 0
+  *     @__sk_common: shared layout with tcp_tw_bucket
+  *     @sk_shutdown: mask of %SEND_SHUTDOWN and/or %RCV_SHUTDOWN
+  *     @sk_userlocks: %SO_SNDBUF and %SO_RCVBUF settings
+  *     @sk_lock:       synchronizer
+  *     @sk_rcvbuf: size of receive buffer in bytes
+  *     @sk_sleep: sock wait queue
+  *     @sk_dst_cache: destination cache
+  *     @sk_dst_lock: destination cache lock
+  *     @sk_policy: flow policy
+  *     @sk_rmem_alloc: receive queue bytes committed
+  *     @sk_receive_queue: incoming packets
+  *     @sk_wmem_alloc: transmit queue bytes committed
+  *     @sk_write_queue: Packet sending queue
+  *     @sk_omem_alloc: "o" is "option" or "other"
+  *     @sk_wmem_queued: persistent queue size
+  *     @sk_forward_alloc: space allocated forward
+  *     @sk_allocation: allocation mode
+  *     @sk_sndbuf: size of send buffer in bytes
+  *     @sk_flags: %SO_LINGER (l_onoff), %SO_BROADCAST, %SO_KEEPALIVE, %SO_OOBINLINE settings
+  *     @sk_no_check: %SO_NO_CHECK setting, wether or not checkup packets
+  *     @sk_route_caps: route capabilities (e.g. %NETIF_F_TSO)
+  *     @sk_lingertime: %SO_LINGER l_linger setting
+  *     @sk_hashent: hash entry in several tables (e.g. tcp_ehash)
+  *     @sk_backlog: always used with the per-socket spinlock held
+  *     @sk_callback_lock: used with the callbacks in the end of this struct
+  *     @sk_error_queue: rarely used
+  *     @sk_prot: protocol handlers inside a network family
+  *     @sk_err: last error
+  *     @sk_err_soft: errors that don't cause failure but are the cause of a persistent failure not just 'timed out'
+  *     @sk_ack_backlog: current listen backlog
+  *     @sk_max_ack_backlog: listen backlog set in listen()
+  *     @sk_priority: %SO_PRIORITY setting
+  *     @sk_type: socket type (%SOCK_STREAM, etc)
+  *     @sk_protocol: which protocol this socket belongs in this network family
+  *     @sk_peercred: %SO_PEERCRED setting
+  *     @sk_rcvlowat: %SO_RCVLOWAT setting
+  *     @sk_rcvtimeo: %SO_RCVTIMEO setting
+  *     @sk_sndtimeo: %SO_SNDTIMEO setting
+  *     @sk_filter: socket filtering instructions
+  *     @sk_protinfo: private area, net family specific, when not using slab
+  *     @sk_timer: sock cleanup timer
+  *     @sk_stamp: time stamp of last packet received
+  *     @sk_socket: Identd and reporting IO signals
+  *     @sk_user_data: RPC layer private data
+  *     @sk_sndmsg_page: cached page for sendmsg
+  *     @sk_sndmsg_off: cached offset for sendmsg
+  *     @sk_send_head: front of stuff to transmit
+  *     @sk_security: used by security modules
+  *     @sk_write_pending: a write to stream socket waits to start
+  *     @sk_state_change: callback to indicate change in the state of the sock
+  *     @sk_data_ready: callback to indicate there is data to be processed
+  *     @sk_write_space: callback to indicate there is bf sending space available
+  *     @sk_error_report: callback to indicate errors (e.g. %MSG_ERRQUEUE)
+  *     @sk_backlog_rcv: callback to process the backlog
+  *     @sk_destruct: called at sock freeing time, i.e. when all refcnt == 0
  */
 struct sock {
         /*
@@ -1223,8 +1224,8 @@ sock_recv_timestamp(struct msghdr *msg, struct sock *sk, struct sk_buff *skb)
 
 /**
  * sk_eat_skb - Release a skb if it is no longer needed
- * @sk - socket to eat this skb from
- * @skb - socket buffer to eat
+ * @sk: socket to eat this skb from
+ * @skb: socket buffer to eat
  *
  * This routine must be called with interrupts disabled or with the socket
  * locked so that the sk_buff queue operation is ok.
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index 73e9a8ca3d3b..e142a256d5dc 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1,6 +1,7 @@
 #ifndef _NET_XFRM_H
 #define _NET_XFRM_H
 
+#include <linux/compiler.h>
 #include <linux/xfrm.h>
 #include <linux/spinlock.h>
 #include <linux/list.h>
@@ -516,6 +517,15 @@ struct xfrm_dst
         u32 child_mtu_cached;
 };
 
+static inline void xfrm_dst_destroy(struct xfrm_dst *xdst)
+{
+        dst_release(xdst->route);
+        if (likely(xdst->u.dst.xfrm))
+                xfrm_state_put(xdst->u.dst.xfrm);
+}
+
+extern void xfrm_dst_ifdown(struct dst_entry *dst, struct net_device *dev);
+
 /* Decapsulation state, used by the input to store data during
  * decapsulation procedure, to be used later (during the policy
  * check