3 files changed, 32 insertions, 58 deletions

diff --git a/net/atm/br2684.c b/net/atm/br2684.c
index 3100a8940afc..2912665fc58c 100644
--- a/net/atm/br2684.c
+++ b/net/atm/br2684.c
@@ -228,7 +228,7 @@ static int br2684_start_xmit(struct sk_buff *skb, struct net_device *dev)
         struct br2684_dev *brdev = BRPRIV(dev);
         struct br2684_vcc *brvcc;
 
-        pr_debug("br2684_start_xmit, skb->dst=%p\n", skb->dst);
+        pr_debug("br2684_start_xmit, skb_dst(skb)=%p\n", skb_dst(skb));
         read_lock(&devs_lock);
         brvcc = pick_outgoing_vcc(skb, brdev);
         if (brvcc == NULL) {
@@ -445,9 +445,10 @@ free_skb:
  */
 static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
 {
+        struct sk_buff_head queue;
         int err;
         struct br2684_vcc *brvcc;
-        struct sk_buff *skb;
+        struct sk_buff *skb, *tmp;
         struct sk_buff_head *rq;
         struct br2684_dev *brdev;
         struct net_device *net_dev;
@@ -505,29 +506,20 @@ static int br2684_regvcc(struct atm_vcc *atmvcc, void __user * arg)
         barrier();
         atmvcc->push = br2684_push;
 
+        __skb_queue_head_init(&queue);
         rq = &sk_atm(atmvcc)->sk_receive_queue;
 
         spin_lock_irqsave(&rq->lock, flags);
-        if (skb_queue_empty(rq)) {
-                skb = NULL;
-        } else {
-                /* NULL terminate the list.  */
-                rq->prev->next = NULL;
-                skb = rq->next;
-        }
-        rq->prev = rq->next = (struct sk_buff *)rq;
-        rq->qlen = 0;
+        skb_queue_splice_init(rq, &queue);
         spin_unlock_irqrestore(&rq->lock, flags);
 
-        while (skb) {
-                struct sk_buff *next = skb->next;
+        skb_queue_walk_safe(&queue, skb, tmp) {
+                struct net_device *dev = skb->dev;
 
-                skb->next = skb->prev = NULL;
-                br2684_push(atmvcc, skb);
-                skb->dev->stats.rx_bytes -= skb->len;
-                skb->dev->stats.rx_packets--;
+                dev->stats.rx_bytes -= skb->len;
+                dev->stats.rx_packets--;
 
-                skb = next;
+                br2684_push(atmvcc, skb);
         }
         __module_get(THIS_MODULE);
         return 0;
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 3dc0a3a42a57..e65a3b1477f8 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -369,16 +369,16 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         unsigned long flags;
 
         pr_debug("clip_start_xmit (skb %p)\n", skb);
-        if (!skb->dst) {
-                printk(KERN_ERR "clip_start_xmit: skb->dst == NULL\n");
+        if (!skb_dst(skb)) {
+                printk(KERN_ERR "clip_start_xmit: skb_dst(skb) == NULL\n");
                 dev_kfree_skb(skb);
                 dev->stats.tx_dropped++;
                 return 0;
         }
-        if (!skb->dst->neighbour) {
+        if (!skb_dst(skb)->neighbour) {
 #if 0
-                skb->dst->neighbour = clip_find_neighbour(skb->dst, 1);
-                if (!skb->dst->neighbour) {
+                skb_dst(skb)->neighbour = clip_find_neighbour(skb_dst(skb), 1);
+                if (!skb_dst(skb)->neighbour) {
                         dev_kfree_skb(skb);     /* lost that one */
                         dev->stats.tx_dropped++;
                         return 0;
@@ -389,7 +389,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 dev->stats.tx_dropped++;
                 return 0;
         }
-        entry = NEIGH2ENTRY(skb->dst->neighbour);
+        entry = NEIGH2ENTRY(skb_dst(skb)->neighbour);
         if (!entry->vccs) {
                 if (time_after(jiffies, entry->expires)) {
                         /* should be resolved */
@@ -406,7 +406,7 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
         }
         pr_debug("neigh %p, vccs %p\n", entry, entry->vccs);
         ATM_SKB(skb)->vcc = vcc = entry->vccs->vcc;
-        pr_debug("using neighbour %p, vcc %p\n", skb->dst->neighbour, vcc);
+        pr_debug("using neighbour %p, vcc %p\n", skb_dst(skb)->neighbour, vcc);
         if (entry->vccs->encap) {
                 void *here;
 
@@ -445,9 +445,9 @@ static int clip_start_xmit(struct sk_buff *skb, struct net_device *dev)
 
 static int clip_mkip(struct atm_vcc *vcc, int timeout)
 {
+        struct sk_buff_head *rq, queue;
         struct clip_vcc *clip_vcc;
-        struct sk_buff *skb;
-        struct sk_buff_head *rq;
+        struct sk_buff *skb, *tmp;
         unsigned long flags;
 
         if (!vcc->push)
@@ -469,39 +469,28 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
         vcc->push = clip_push;
         vcc->pop = clip_pop;
 
+        __skb_queue_head_init(&queue);
         rq = &sk_atm(vcc)->sk_receive_queue;
 
         spin_lock_irqsave(&rq->lock, flags);
-        if (skb_queue_empty(rq)) {
-                skb = NULL;
-        } else {
-                /* NULL terminate the list.  */
-                rq->prev->next = NULL;
-                skb = rq->next;
-        }
-        rq->prev = rq->next = (struct sk_buff *)rq;
-        rq->qlen = 0;
+        skb_queue_splice_init(rq, &queue);
         spin_unlock_irqrestore(&rq->lock, flags);
 
         /* re-process everything received between connection setup and MKIP */
-        while (skb) {
-                struct sk_buff *next = skb->next;
-
-                skb->next = skb->prev = NULL;
+        skb_queue_walk_safe(&queue, skb, tmp) {
                 if (!clip_devs) {
                         atm_return(vcc, skb->truesize);
                         kfree_skb(skb);
                 } else {
+                        struct net_device *dev = skb->dev;
                         unsigned int len = skb->len;
 
                         skb_get(skb);
                         clip_push(vcc, skb);
-                        skb->dev->stats.rx_packets--;
-                        skb->dev->stats.rx_bytes -= len;
+                        dev->stats.rx_packets--;
+                        dev->stats.rx_bytes -= len;
                         kfree_skb(skb);
                 }
-
-                skb = next;
         }
         return 0;
 }
@@ -568,6 +557,7 @@ static void clip_setup(struct net_device *dev)
         /* without any more elaborate queuing. 100 is a reasonable */
         /* compromise between decent burst-tolerance and protection */
         /* against memory hogs. */
+        dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
 }
 
 static int clip_create(int number)
diff --git a/net/atm/lec.c b/net/atm/lec.c
index 199b6bb79f42..ff2e594dca9b 100644
--- a/net/atm/lec.c
+++ b/net/atm/lec.c
@@ -34,7 +34,6 @@
 
 /* Proxy LEC knows about bridging */
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
-#include <linux/if_bridge.h>
 #include "../bridge/br_private.h"
 
 static unsigned char bridge_ula_lec[] = { 0x01, 0x80, 0xc2, 0x00, 0x00 };
@@ -271,7 +270,8 @@ static int lec_start_xmit(struct sk_buff *skb, struct net_device *dev)
                 printk("%s:No lecd attached\n", dev->name);
                 dev->stats.tx_errors++;
                 netif_stop_queue(dev);
-                return -EUNATCH;
+                kfree_skb(skb);
+                return NETDEV_TX_OK;
         }
 
         pr_debug("skbuff head:%lx data:%lx tail:%lx end:%lx\n",
@@ -518,18 +518,14 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
         case l_should_bridge:
 #if defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE)
                 {
-                        struct net_bridge_fdb_entry *f;
-
                         pr_debug("%s: bridge zeppelin asks about %pM\n",
                                  dev->name, mesg->content.proxy.mac_addr);
 
-                        if (br_fdb_get_hook == NULL || dev->br_port == NULL)
+                        if (br_fdb_test_addr_hook == NULL)
                                 break;
 
-                        f = br_fdb_get_hook(dev->br_port->br,
-                                            mesg->content.proxy.mac_addr);
-                        if (f != NULL && f->dst->dev != dev
-                            && f->dst->state == BR_STATE_FORWARDING) {
+                        if (br_fdb_test_addr_hook(dev,
+                                        mesg->content.proxy.mac_addr)) {
                                 /* hit from bridge table, send LE_ARP_RESPONSE */
                                 struct sk_buff *skb2;
                                 struct sock *sk;
@@ -540,10 +536,8 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                                 skb2 =
                                     alloc_skb(sizeof(struct atmlec_msg),
                                               GFP_ATOMIC);
-                                if (skb2 == NULL) {
-                                        br_fdb_put_hook(f);
+                                if (skb2 == NULL)
                                         break;
-                                }
                                 skb2->len = sizeof(struct atmlec_msg);
                                 skb_copy_to_linear_data(skb2, mesg,
                                                         sizeof(*mesg));
@@ -552,8 +546,6 @@ static int lec_atm_send(struct atm_vcc *vcc, struct sk_buff *skb)
                                 skb_queue_tail(&sk->sk_receive_queue, skb2);
                                 sk->sk_data_ready(sk, skb2->len);
                         }
-                        if (f != NULL)
-                                br_fdb_put_hook(f);
                 }
 #endif /* defined(CONFIG_BRIDGE) || defined(CONFIG_BRIDGE_MODULE) */
                 break;