4 files changed, 53 insertions, 88 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 7016e0c36b3d..ff9dc029233a 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1127,7 +1127,7 @@ static inline int illegal_highdma(struct net_device *dev, struct sk_buff *skb)
 extern void skb_release_data(struct sk_buff *);
 
 /* Keep head the same: replace data */
-int __skb_linearize(struct sk_buff *skb, int gfp_mask)
+int __skb_linearize(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
         unsigned int size;
         u8 *data;
@@ -2089,10 +2089,11 @@ void dev_set_promiscuity(struct net_device *dev, int inc)
 {
         unsigned short old_flags = dev->flags;
 
-        dev->flags |= IFF_PROMISC;
         if ((dev->promiscuity += inc) == 0)
                 dev->flags &= ~IFF_PROMISC;
-        if (dev->flags ^ old_flags) {
+        else
+                dev->flags |= IFF_PROMISC;
+        if (dev->flags != old_flags) {
                 dev_mc_upload(dev);
                 printk(KERN_INFO "device %s %s promiscuous mode\n",
                        dev->name, (dev->flags & IFF_PROMISC) ? "entered" :
diff --git a/net/core/filter.c b/net/core/filter.c
index f3b88205ace2..cd91a24f9720 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -36,7 +36,7 @@
 #include <linux/filter.h>
 
 /* No hurry in this branch */
-static u8 *load_pointer(struct sk_buff *skb, int k)
+static void *__load_pointer(struct sk_buff *skb, int k)
 {
         u8 *ptr = NULL;
 
@@ -50,6 +50,18 @@ static u8 *load_pointer(struct sk_buff *skb, int k)
         return NULL;
 }
 
+static inline void *load_pointer(struct sk_buff *skb, int k,
+                                 unsigned int size, void *buffer)
+{
+        if (k >= 0)
+                return skb_header_pointer(skb, k, size, buffer);
+        else {
+                if (k >= SKF_AD_OFF)
+                        return NULL;
+                return __load_pointer(skb, k);
+        }
+}
+
 /**
  *      sk_run_filter   -       run a filter on a socket
  *      @skb: buffer to run the filter on
@@ -64,15 +76,12 @@ static u8 *load_pointer(struct sk_buff *skb, int k)
  
 int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
 {
-        unsigned char *data = skb->data;
-        /* len is UNSIGNED. Byte wide insns relies only on implicit
-           type casts to prevent reading arbitrary memory locations.
-         */
-        unsigned int len = skb->len-skb->data_len;
         struct sock_filter *fentry;     /* We walk down these */
+        void *ptr;
         u32 A = 0;                      /* Accumulator */
         u32 X = 0;                      /* Index Register */
         u32 mem[BPF_MEMWORDS];          /* Scratch Memory Store */
+        u32 tmp;
         int k;
         int pc;
 
@@ -168,86 +177,35 @@ int sk_run_filter(struct sk_buff *skb, struct sock_filter *filter, int flen)
                 case BPF_LD|BPF_W|BPF_ABS:
                         k = fentry->k;
  load_w:
-                        if (k >= 0 && (unsigned int)(k+sizeof(u32)) <= len) {
-                                A = ntohl(*(u32*)&data[k]);
+                        ptr = load_pointer(skb, k, 4, &tmp);
+                        if (ptr != NULL) {
+                                A = ntohl(*(u32 *)ptr);
                                 continue;
                         }
-                        if (k < 0) {
-                                u8 *ptr;
-
-                                if (k >= SKF_AD_OFF)
-                                        break;
-                                ptr = load_pointer(skb, k);
-                                if (ptr) {
-                                        A = ntohl(*(u32*)ptr);
-                                        continue;
-                                }
-                        } else {
-                                u32 _tmp, *p;
-                                p = skb_header_pointer(skb, k, 4, &_tmp);
-                                if (p != NULL) {
-                                        A = ntohl(*p);
-                                        continue;
-                                }
-                        }
                         return 0;
                 case BPF_LD|BPF_H|BPF_ABS:
                         k = fentry->k;
  load_h:
-                        if (k >= 0 && (unsigned int)(k + sizeof(u16)) <= len) {
-                                A = ntohs(*(u16*)&data[k]);
+                        ptr = load_pointer(skb, k, 2, &tmp);
+                        if (ptr != NULL) {
+                                A = ntohs(*(u16 *)ptr);
                                 continue;
                         }
-                        if (k < 0) {
-                                u8 *ptr;
-
-                                if (k >= SKF_AD_OFF)
-                                        break;
-                                ptr = load_pointer(skb, k);
-                                if (ptr) {
-                                        A = ntohs(*(u16*)ptr);
-                                        continue;
-                                }
-                        } else {
-                                u16 _tmp, *p;
-                                p = skb_header_pointer(skb, k, 2, &_tmp);
-                                if (p != NULL) {
-                                        A = ntohs(*p);
-                                        continue;
-                                }
-                        }
                         return 0;
                 case BPF_LD|BPF_B|BPF_ABS:
                         k = fentry->k;
 load_b:
-                        if (k >= 0 && (unsigned int)k < len) {
-                                A = data[k];
+                        ptr = load_pointer(skb, k, 1, &tmp);
+                        if (ptr != NULL) {
+                                A = *(u8 *)ptr;
                                 continue;
                         }
-                        if (k < 0) {
-                                u8 *ptr;
-
-                                if (k >= SKF_AD_OFF)
-                                        break;
-                                ptr = load_pointer(skb, k);
-                                if (ptr) {
-                                        A = *ptr;
-                                        continue;
-                                }
-                        } else {
-                                u8 _tmp, *p;
-                                p = skb_header_pointer(skb, k, 1, &_tmp);
-                                if (p != NULL) {
-                                        A = *p;
-                                        continue;
-                                }
-                        }
                         return 0;
                 case BPF_LD|BPF_W|BPF_LEN:
-                        A = len;
+                        A = skb->len;
                         continue;
                 case BPF_LDX|BPF_W|BPF_LEN:
-                        X = len;
+                        X = skb->len;
                         continue;
                 case BPF_LD|BPF_W|BPF_IND:
                         k = X + fentry->k;
@@ -259,10 +217,12 @@ load_b:
                         k = X + fentry->k;
                         goto load_b;
                 case BPF_LDX|BPF_B|BPF_MSH:
-                        if (fentry->k >= len)
-                                return 0;
-                        X = (data[fentry->k] & 0xf) << 2;
-                        continue;
+                        ptr = load_pointer(skb, fentry->k, 1, &tmp);
+                        if (ptr != NULL) {
+                                X = (*(u8 *)ptr & 0xf) << 2;
+                                continue;
+                        }
+                        return 0;
                 case BPF_LD|BPF_IMM:
                         A = fentry->k;
                         continue;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index bb73b2190ec7..d9f7b06fe886 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -129,7 +129,7 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
  *      Buffers may only be allocated from interrupts using a @gfp_mask of
  *      %GFP_ATOMIC.
  */
-struct sk_buff *alloc_skb(unsigned int size, int gfp_mask)
+struct sk_buff *alloc_skb(unsigned int size, unsigned int __nocast gfp_mask)
 {
         struct sk_buff *skb;
         u8 *data;
@@ -182,7 +182,8 @@ nodata:
  *      %GFP_ATOMIC.
  */
 struct sk_buff *alloc_skb_from_cache(kmem_cache_t *cp,
-                                     unsigned int size, int gfp_mask)
+                                     unsigned int size,
+                                     unsigned int __nocast gfp_mask)
 {
         struct sk_buff *skb;
         u8 *data;
@@ -322,7 +323,7 @@ void __kfree_skb(struct sk_buff *skb)
  *      %GFP_ATOMIC.
  */
 
-struct sk_buff *skb_clone(struct sk_buff *skb, int gfp_mask)
+struct sk_buff *skb_clone(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
         struct sk_buff *n = kmem_cache_alloc(skbuff_head_cache, gfp_mask);
 
@@ -357,7 +358,6 @@ struct sk_buff *skb_clone(struct sk_buff *skb, int gfp_mask)
         C(ip_summed);
         C(priority);
         C(protocol);
-        C(security);
         n->destructor = NULL;
 #ifdef CONFIG_NETFILTER
         C(nfmark);
@@ -422,7 +422,6 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->pkt_type   = old->pkt_type;
         new->stamp      = old->stamp;
         new->destructor = NULL;
-        new->security   = old->security;
 #ifdef CONFIG_NETFILTER
         new->nfmark     = old->nfmark;
         new->nfcache    = old->nfcache;
@@ -462,7 +461,7 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
  *      header is going to be modified. Use pskb_copy() instead.
  */
 
-struct sk_buff *skb_copy(const struct sk_buff *skb, int gfp_mask)
+struct sk_buff *skb_copy(const struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
         int headerlen = skb->data - skb->head;
         /*
@@ -501,7 +500,7 @@ struct sk_buff *skb_copy(const struct sk_buff *skb, int gfp_mask)
  *      The returned buffer has a reference count of 1.
  */
 
-struct sk_buff *pskb_copy(struct sk_buff *skb, int gfp_mask)
+struct sk_buff *pskb_copy(struct sk_buff *skb, unsigned int __nocast gfp_mask)
 {
         /*
          *      Allocate the copy buffer
@@ -559,7 +558,8 @@ out:
  *      reloaded after call to this function.
  */
 
-int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail, int gfp_mask)
+int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+                     unsigned int __nocast gfp_mask)
 {
         int i;
         u8 *data;
@@ -649,7 +649,8 @@ struct sk_buff *skb_realloc_headroom(struct sk_buff *skb, unsigned int headroom)
  *      only by netfilter in the cases when checksum is recalculated? --ANK
  */
 struct sk_buff *skb_copy_expand(const struct sk_buff *skb,
-                                int newheadroom, int newtailroom, int gfp_mask)
+                                int newheadroom, int newtailroom,
+                                unsigned int __nocast gfp_mask)
 {
         /*
          *      Allocate the copy buffer
diff --git a/net/core/sock.c b/net/core/sock.c
index a6ec3ada7f9e..8b35ccdc2b3b 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -622,7 +622,8 @@ lenout:
  *      @prot: struct proto associated with this new sock instance
  *      @zero_it: if we should zero the newly allocated sock
  */
-struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
+struct sock *sk_alloc(int family, unsigned int __nocast priority,
+                      struct proto *prot, int zero_it)
 {
         struct sock *sk = NULL;
         kmem_cache_t *slab = prot->slab;
@@ -750,7 +751,8 @@ unsigned long sock_i_ino(struct sock *sk)
 /*
  * Allocate a skb from the socket's send buffer.
  */
-struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force, int priority)
+struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force,
+                             unsigned int __nocast priority)
 {
         if (force || atomic_read(&sk->sk_wmem_alloc) < sk->sk_sndbuf) {
                 struct sk_buff * skb = alloc_skb(size, priority);
@@ -765,7 +767,8 @@ struct sk_buff *sock_wmalloc(struct sock *sk, unsigned long size, int force, int
 /*
  * Allocate a skb from the socket's receive buffer.
  */ 
-struct sk_buff *sock_rmalloc(struct sock *sk, unsigned long size, int force, int priority)
+struct sk_buff *sock_rmalloc(struct sock *sk, unsigned long size, int force,
+                             unsigned int __nocast priority)
 {
         if (force || atomic_read(&sk->sk_rmem_alloc) < sk->sk_rcvbuf) {
                 struct sk_buff *skb = alloc_skb(size, priority);
@@ -780,7 +783,7 @@ struct sk_buff *sock_rmalloc(struct sock *sk, unsigned long size, int force, int
 /* 
  * Allocate a memory block from the socket's option memory buffer.
  */ 
-void *sock_kmalloc(struct sock *sk, int size, int priority)
+void *sock_kmalloc(struct sock *sk, int size, unsigned int __nocast priority)
 {
         if ((unsigned)size <= sysctl_optmem_max &&
             atomic_read(&sk->sk_omem_alloc) + size < sysctl_optmem_max) {