11 files changed, 35 insertions, 77 deletions

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index f45460730371..65c5801261f9 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -25,6 +25,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -369,6 +370,9 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
         if (ax25_ctl.digi_count > AX25_MAX_DIGIS)
                 return -EINVAL;
 
+        if (ax25_ctl.arg > ULONG_MAX / HZ && ax25_ctl.cmd != AX25_KILL)
+                return -EINVAL;
+
         digi.ndigi = ax25_ctl.digi_count;
         for (k = 0; k < digi.ndigi; k++)
                 digi.calls[k] = ax25_ctl.digi_addr[k];
@@ -418,14 +422,10 @@ static int ax25_ctl_ioctl(const unsigned int cmd, void __user *arg)
                 break;
 
         case AX25_T3:
-                if (ax25_ctl.arg < 0)
-                        goto einval_put;
                 ax25->t3 = ax25_ctl.arg * HZ;
                 break;
 
         case AX25_IDLE:
-                if (ax25_ctl.arg < 0)
-                        goto einval_put;
                 ax25->idle = ax25_ctl.arg * 60 * HZ;
                 break;
 
@@ -800,12 +800,13 @@ static struct proto ax25_proto = {
         .obj_size = sizeof(struct sock),
 };
 
-static int ax25_create(struct net *net, struct socket *sock, int protocol)
+static int ax25_create(struct net *net, struct socket *sock, int protocol,
+                       int kern)
 {
         struct sock *sk;
         ax25_cb *ax25;
 
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                 return -EAFNOSUPPORT;
 
         switch (sock->type) {
@@ -1863,25 +1864,13 @@ static int ax25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
 static void *ax25_info_start(struct seq_file *seq, loff_t *pos)
         __acquires(ax25_list_lock)
 {
-        struct ax25_cb *ax25;
-        struct hlist_node *node;
-        int i = 0;
-
         spin_lock_bh(&ax25_list_lock);
-        ax25_for_each(ax25, node, &ax25_list) {
-                if (i == *pos)
-                        return ax25;
-                ++i;
-        }
-        return NULL;
+        return seq_hlist_start(&ax25_list, *pos);
 }
 
 static void *ax25_info_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
-
-        return hlist_entry( ((struct ax25_cb *)v)->ax25_node.next,
-                            struct ax25_cb, ax25_node);
+        return seq_hlist_next(v, &ax25_list, pos);
 }
 
 static void ax25_info_stop(struct seq_file *seq, void *v)
@@ -1892,7 +1881,7 @@ static void ax25_info_stop(struct seq_file *seq, void *v)
 
 static int ax25_info_show(struct seq_file *seq, void *v)
 {
-        ax25_cb *ax25 = v;
+        ax25_cb *ax25 = hlist_entry(v, struct ax25_cb, ax25_node);
         char buf[11];
         int k;
 
@@ -1961,7 +1950,7 @@ static const struct file_operations ax25_info_fops = {
 
 #endif
 
-static struct net_proto_family ax25_family_ops = {
+static const struct net_proto_family ax25_family_ops = {
         .family =       PF_AX25,
         .create =       ax25_create,
         .owner  =       THIS_MODULE,
diff --git a/net/ax25/ax25_dev.c b/net/ax25/ax25_dev.c
index a7a0e0c9698b..c1cb982f6e86 100644
--- a/net/ax25/ax25_dev.c
+++ b/net/ax25/ax25_dev.c
@@ -9,6 +9,7 @@
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
+#include <linux/slab.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
 #include <linux/timer.h>
diff --git a/net/ax25/ax25_ds_subr.c b/net/ax25/ax25_ds_subr.c
index b5e59787be2f..85816e612dc0 100644
--- a/net/ax25/ax25_ds_subr.c
+++ b/net/ax25/ax25_ds_subr.c
@@ -17,6 +17,7 @@
 #include <linux/sockios.h>
 #include <linux/spinlock.h>
 #include <linux/net.h>
+#include <linux/gfp.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_iface.c b/net/ax25/ax25_iface.c
index 71338f112108..5a0dda8df492 100644
--- a/net/ax25/ax25_iface.c
+++ b/net/ax25/ax25_iface.c
@@ -17,6 +17,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index de56d3983de0..9bb776541203 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -18,6 +18,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
index f047a57aa95c..cf0c47a26530 100644
--- a/net/ax25/ax25_ip.c
+++ b/net/ax25/ax25_ip.c
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_out.c b/net/ax25/ax25_out.c
index bf706f83a5c9..37507d806f65 100644
--- a/net/ax25/ax25_out.c
+++ b/net/ax25/ax25_out.c
@@ -19,6 +19,7 @@
 #include <linux/sockios.h>
 #include <linux/spinlock.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -92,6 +93,12 @@ ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, ax25_address *src, ax2
 #endif
         }
 
+        /*
+         * There is one ref for the state machine; a caller needs
+         * one more to put it back, just like with the existing one.
+         */
+        ax25_cb_hold(ax25);
+
         ax25_cb_add(ax25);
 
         ax25->state = AX25_STATE_1;
diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index c833ba4c45a5..7805945a5fd6 100644
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -23,6 +23,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_subr.c b/net/ax25/ax25_subr.c
index 034aa10a5198..c6715ee4ab8f 100644
--- a/net/ax25/ax25_subr.c
+++ b/net/ax25/ax25_subr.c
@@ -18,6 +18,7 @@
 #include <linux/string.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index 832bcf092a01..d349be9578f5 100644
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -18,6 +18,7 @@
 #include <linux/sockios.h>
 #include <linux/net.h>
 #include <linux/spinlock.h>
+#include <linux/slab.h>
 #include <net/ax25.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -146,31 +147,13 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
         __acquires(ax25_uid_lock)
 {
-        struct ax25_uid_assoc *pt;
-        struct hlist_node *node;
-        int i = 1;
-
         read_lock(&ax25_uid_lock);
-
-        if (*pos == 0)
-                return SEQ_START_TOKEN;
-
-        ax25_uid_for_each(pt, node, &ax25_uid_list) {
-                if (i == *pos)
-                        return pt;
-                ++i;
-        }
-        return NULL;
+        return seq_hlist_start_head(&ax25_uid_list, *pos);
 }
 
 static void *ax25_uid_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        ++*pos;
-        if (v == SEQ_START_TOKEN)
-                return ax25_uid_list.first;
-        else
-                return hlist_entry(((ax25_uid_assoc *)v)->uid_node.next,
-                           ax25_uid_assoc, uid_node);
+        return seq_hlist_next(v, &ax25_uid_list, pos);
 }
 
 static void ax25_uid_seq_stop(struct seq_file *seq, void *v)
@@ -186,8 +169,9 @@ static int ax25_uid_seq_show(struct seq_file *seq, void *v)
         if (v == SEQ_START_TOKEN)
                 seq_printf(seq, "Policy: %d\n", ax25_uid_policy);
         else {
-                struct ax25_uid_assoc *pt = v;
+                struct ax25_uid_assoc *pt;
 
+                pt = hlist_entry(v, struct ax25_uid_assoc, uid_node);
                 seq_printf(seq, "%6d %s\n", pt->uid, ax2asc(buf, &pt->call));
         }
         return 0;
diff --git a/net/ax25/sysctl_net_ax25.c b/net/ax25/sysctl_net_ax25.c
index 62ee3fb34732..ebe0ef3f1d83 100644
--- a/net/ax25/sysctl_net_ax25.c
+++ b/net/ax25/sysctl_net_ax25.c
@@ -7,6 +7,7 @@
  * Copyright (C) 1996 Mike Shaver (shaver@zeroknowledge.com)
  */
 #include <linux/mm.h>
+#include <linux/slab.h>
 #include <linux/sysctl.h>
 #include <linux/spinlock.h>
 #include <net/ax25.h>
@@ -34,156 +35,128 @@ static ctl_table *ax25_table;
 static int ax25_table_size;
 
 static struct ctl_path ax25_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "ax25", .ctl_name = NET_AX25, },
+        { .procname = "net", },
+        { .procname = "ax25", },
         { }
 };
 
 static const ctl_table ax25_param_table[] = {
         {
-                .ctl_name       = NET_AX25_IP_DEFAULT_MODE,
                 .procname       = "ip_default_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_ipdefmode,
                 .extra2         = &max_ipdefmode
         },
         {
-                .ctl_name       = NET_AX25_DEFAULT_MODE,
                 .procname       = "ax25_default_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_axdefmode,
                 .extra2         = &max_axdefmode
         },
         {
-                .ctl_name       = NET_AX25_BACKOFF_TYPE,
                 .procname       = "backoff_type",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_backoff,
                 .extra2         = &max_backoff
         },
         {
-                .ctl_name       = NET_AX25_CONNECT_MODE,
                 .procname       = "connect_mode",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_conmode,
                 .extra2         = &max_conmode
         },
         {
-                .ctl_name       = NET_AX25_STANDARD_WINDOW,
                 .procname       = "standard_window_size",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_window,
                 .extra2         = &max_window
         },
         {
-                .ctl_name       = NET_AX25_EXTENDED_WINDOW,
                 .procname       = "extended_window_size",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_ewindow,
                 .extra2         = &max_ewindow
         },
         {
-                .ctl_name       = NET_AX25_T1_TIMEOUT,
                 .procname       = "t1_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t1,
                 .extra2         = &max_t1
         },
         {
-                .ctl_name       = NET_AX25_T2_TIMEOUT,
                 .procname       = "t2_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t2,
                 .extra2         = &max_t2
         },
         {
-                .ctl_name       = NET_AX25_T3_TIMEOUT,
                 .procname       = "t3_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_t3,
                 .extra2         = &max_t3
         },
         {
-                .ctl_name       = NET_AX25_IDLE_TIMEOUT,
                 .procname       = "idle_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_idle,
                 .extra2         = &max_idle
         },
         {
-                .ctl_name       = NET_AX25_N2,
                 .procname       = "maximum_retry_count",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_n2,
                 .extra2         = &max_n2
         },
         {
-                .ctl_name       = NET_AX25_PACLEN,
                 .procname       = "maximum_packet_length",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_paclen,
                 .extra2         = &max_paclen
         },
         {
-                .ctl_name       = NET_AX25_PROTOCOL,
                 .procname       = "protocol",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_proto,
                 .extra2         = &max_proto
         },
 #ifdef CONFIG_AX25_DAMA_SLAVE
         {
-                .ctl_name       = NET_AX25_DAMA_SLAVE_TIMEOUT,
                 .procname       = "dama_slave_timeout",
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
                 .proc_handler   = proc_dointvec_minmax,
-                .strategy       = sysctl_intvec,
                 .extra1         = &min_ds_timeout,
                 .extra2         = &max_ds_timeout
         },
 #endif
 
-        { .ctl_name = 0 }       /* that's all, folks! */
+        { }     /* that's all, folks! */
 };
 
 void ax25_register_sysctl(void)
@@ -212,11 +185,9 @@ void ax25_register_sysctl(void)
                         return;
                 }
                 ax25_table[n].child = ax25_dev->systable = child;
-                ax25_table[n].ctl_name     = n + 1;
                 ax25_table[n].procname     = ax25_dev->dev->name;
                 ax25_table[n].mode         = 0555;
 
-                child[AX25_MAX_VALUES].ctl_name = 0;    /* just in case... */
 
                 for (k = 0; k < AX25_MAX_VALUES; k++)
                         child[k].data = &ax25_dev->values[k];
@@ -233,7 +204,7 @@ void ax25_unregister_sysctl(void)
         ctl_table *p;
         unregister_sysctl_table(ax25_table_header);
 
-        for (p = ax25_table; p->ctl_name; p++)
+        for (p = ax25_table; p->procname; p++)
                 kfree(p->child);
         kfree(ax25_table);
 }