11 files changed, 241 insertions, 159 deletions

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 7fa9c7ad3d3b..36e84e13c6aa 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -47,6 +47,7 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/tcp_states.h>
 #include <asm/uaccess.h>
@@ -55,6 +56,7 @@
 #include <linux/notifier.h>
 #include <linux/init.h>
 #include <linux/compat.h>
+#include <linux/ctype.h>
 
 #include <net/x25.h>
 #include <net/compat.h>
@@ -81,6 +83,41 @@ struct compat_x25_subscrip_struct {
 };
 #endif
 
+
+int x25_parse_address_block(struct sk_buff *skb,
+                struct x25_address *called_addr,
+                struct x25_address *calling_addr)
+{
+        unsigned char len;
+        int needed;
+        int rc;
+
+        if (skb->len < 1) {
+                /* packet has no address block */
+                rc = 0;
+                goto empty;
+        }
+
+        len = *skb->data;
+        needed = 1 + (len >> 4) + (len & 0x0f);
+
+        if (skb->len < needed) {
+                /* packet is too short to hold the addresses it claims
+                   to hold */
+                rc = -1;
+                goto empty;
+        }
+
+        return x25_addr_ntoa(skb->data, called_addr, calling_addr);
+
+empty:
+        *called_addr->x25_addr = 0;
+        *calling_addr->x25_addr = 0;
+
+        return rc;
+}
+
+
 int x25_addr_ntoa(unsigned char *p, struct x25_address *called_addr,
                   struct x25_address *calling_addr)
 {
@@ -365,6 +402,7 @@ static void __x25_destroy_socket(struct sock *sk)
                         /*
                          * Queue the unaccepted socket for death
                          */
+                        skb->sk->sk_state = TCP_LISTEN;
                         sock_set_flag(skb->sk, SOCK_DEAD);
                         x25_start_heartbeat(skb->sk);
                         x25_sk(skb->sk)->state = X25_STATE_0;
@@ -415,6 +453,7 @@ static int x25_setsockopt(struct socket *sock, int level, int optname,
         struct sock *sk = sock->sk;
         int rc = -ENOPROTOOPT;
 
+        lock_kernel();
         if (level != SOL_X25 || optname != X25_QBITINCL)
                 goto out;
 
@@ -429,6 +468,7 @@ static int x25_setsockopt(struct socket *sock, int level, int optname,
         x25_sk(sk)->qbitincl = !!opt;
         rc = 0;
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -438,6 +478,7 @@ static int x25_getsockopt(struct socket *sock, int level, int optname,
         struct sock *sk = sock->sk;
         int val, len, rc = -ENOPROTOOPT;
 
+        lock_kernel();
         if (level != SOL_X25 || optname != X25_QBITINCL)
                 goto out;
 
@@ -458,6 +499,7 @@ static int x25_getsockopt(struct socket *sock, int level, int optname,
         val = x25_sk(sk)->qbitincl;
         rc = copy_to_user(optval, &val, len) ? -EFAULT : 0;
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -466,12 +508,14 @@ static int x25_listen(struct socket *sock, int backlog)
         struct sock *sk = sock->sk;
         int rc = -EOPNOTSUPP;
 
+        lock_kernel();
         if (sk->sk_state != TCP_LISTEN) {
                 memset(&x25_sk(sk)->dest_addr, 0, X25_ADDR_LEN);
                 sk->sk_max_ack_backlog = backlog;
                 sk->sk_state           = TCP_LISTEN;
                 rc = 0;
         }
+        unlock_kernel();
 
         return rc;
 }
@@ -501,19 +545,25 @@ out:
         return sk;
 }
 
-static int x25_create(struct net *net, struct socket *sock, int protocol)
+static int x25_create(struct net *net, struct socket *sock, int protocol,
+                      int kern)
 {
         struct sock *sk;
         struct x25_sock *x25;
-        int rc = -ESOCKTNOSUPPORT;
+        int rc = -EAFNOSUPPORT;
 
-        if (net != &init_net)
-                return -EAFNOSUPPORT;
+        if (!net_eq(net, &init_net))
+                goto out;
 
-        if (sock->type != SOCK_SEQPACKET || protocol)
+        rc = -ESOCKTNOSUPPORT;
+        if (sock->type != SOCK_SEQPACKET)
                 goto out;
 
-        rc = -ENOMEM;
+        rc = -EINVAL;
+        if (protocol)
+                goto out;
+
+        rc = -ENOBUFS;
         if ((sk = x25_alloc_socket(net)) == NULL)
                 goto out;
 
@@ -540,7 +590,8 @@ static int x25_create(struct net *net, struct socket *sock, int protocol)
         x25->facilities.winsize_out = X25_DEFAULT_WINDOW_SIZE;
         x25->facilities.pacsize_in  = X25_DEFAULT_PACKET_SIZE;
         x25->facilities.pacsize_out = X25_DEFAULT_PACKET_SIZE;
-        x25->facilities.throughput  = X25_DEFAULT_THROUGHPUT;
+        x25->facilities.throughput  = 0;        /* by default don't negotiate
+                                                   throughput */
         x25->facilities.reverse     = X25_DEFAULT_REVERSE;
         x25->dte_facilities.calling_len = 0;
         x25->dte_facilities.called_len = 0;
@@ -597,6 +648,7 @@ static int x25_release(struct socket *sock)
         struct sock *sk = sock->sk;
         struct x25_sock *x25;
 
+        lock_kernel();
         if (!sk)
                 goto out;
 
@@ -627,6 +679,7 @@ static int x25_release(struct socket *sock)
 
         sock_orphan(sk);
 out:
+        unlock_kernel();
         return 0;
 }
 
@@ -634,18 +687,31 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 {
         struct sock *sk = sock->sk;
         struct sockaddr_x25 *addr = (struct sockaddr_x25 *)uaddr;
+        int len, i, rc = 0;
 
+        lock_kernel();
         if (!sock_flag(sk, SOCK_ZAPPED) ||
             addr_len != sizeof(struct sockaddr_x25) ||
-            addr->sx25_family != AF_X25)
-                return -EINVAL;
+            addr->sx25_family != AF_X25) {
+                rc = -EINVAL;
+                goto out;
+        }
+
+        len = strlen(addr->sx25_addr.x25_addr);
+        for (i = 0; i < len; i++) {
+                if (!isdigit(addr->sx25_addr.x25_addr[i])) {
+                        rc = -EINVAL;
+                        goto out;
+                }
+        }
 
         x25_sk(sk)->source_addr = addr->sx25_addr;
         x25_insert_socket(sk);
         sock_reset_flag(sk, SOCK_ZAPPED);
         SOCK_DEBUG(sk, "x25_bind: socket is bound\n");
-
-        return 0;
+out:
+        unlock_kernel();
+        return rc;
 }
 
 static int x25_wait_for_connection_establishment(struct sock *sk)
@@ -686,6 +752,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
         struct x25_route *rt;
         int rc = 0;
 
+        lock_kernel();
         lock_sock(sk);
         if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
                 sock->state = SS_CONNECTED;
@@ -763,6 +830,7 @@ out_put_route:
         x25_route_put(rt);
 out:
         release_sock(sk);
+        unlock_kernel();
         return rc;
 }
 
@@ -802,6 +870,7 @@ static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
         struct sk_buff *skb;
         int rc = -EINVAL;
 
+        lock_kernel();
         if (!sk || sk->sk_state != TCP_LISTEN)
                 goto out;
 
@@ -829,6 +898,7 @@ static int x25_accept(struct socket *sock, struct socket *newsock, int flags)
 out2:
         release_sock(sk);
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -838,10 +908,14 @@ static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
         struct sockaddr_x25 *sx25 = (struct sockaddr_x25 *)uaddr;
         struct sock *sk = sock->sk;
         struct x25_sock *x25 = x25_sk(sk);
+        int rc = 0;
 
+        lock_kernel();
         if (peer) {
-                if (sk->sk_state != TCP_ESTABLISHED)
-                        return -ENOTCONN;
+                if (sk->sk_state != TCP_ESTABLISHED) {
+                        rc = -ENOTCONN;
+                        goto out;
+                }
                 sx25->sx25_addr = x25->dest_addr;
         } else
                 sx25->sx25_addr = x25->source_addr;
@@ -849,7 +923,21 @@ static int x25_getname(struct socket *sock, struct sockaddr *uaddr,
         sx25->sx25_family = AF_X25;
         *uaddr_len = sizeof(*sx25);
 
-        return 0;
+out:
+        unlock_kernel();
+        return rc;
+}
+
+static unsigned int x25_datagram_poll(struct file *file, struct socket *sock,
+                           poll_table *wait)
+{
+        int rc;
+
+        lock_kernel();
+        rc = datagram_poll(file, sock, wait);
+        unlock_kernel();
+
+        return rc;
 }
 
 int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
@@ -871,16 +959,26 @@ int x25_rx_call_request(struct sk_buff *skb, struct x25_neigh *nb,
         /*
          *      Extract the X.25 addresses and convert them to ASCII strings,
          *      and remove them.
+         *
+         *      Address block is mandatory in call request packets
          */
-        addr_len = x25_addr_ntoa(skb->data, &source_addr, &dest_addr);
+        addr_len = x25_parse_address_block(skb, &source_addr, &dest_addr);
+        if (addr_len <= 0)
+                goto out_clear_request;
         skb_pull(skb, addr_len);
 
         /*
          *      Get the length of the facilities, skip past them for the moment
          *      get the call user data because this is needed to determine
          *      the correct listener
+         *
+         *      Facilities length is mandatory in call request packets
          */
+        if (skb->len < 1)
+                goto out_clear_request;
         len = skb->data[0] + 1;
+        if (skb->len < len)
+                goto out_clear_request;
         skb_pull(skb,len);
 
         /*
@@ -1002,6 +1100,7 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
         size_t size;
         int qbit = 0, rc = -EINVAL;
 
+        lock_kernel();
         if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_OOB|MSG_EOR|MSG_CMSG_COMPAT))
                 goto out;
 
@@ -1166,6 +1265,7 @@ static int x25_sendmsg(struct kiocb *iocb, struct socket *sock,
         release_sock(sk);
         rc = len;
 out:
+        unlock_kernel();
         return rc;
 out_kfree_skb:
         kfree_skb(skb);
@@ -1186,6 +1286,7 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
         unsigned char *asmptr;
         int rc = -ENOTCONN;
 
+        lock_kernel();
         /*
          * This works for seqpacket too. The receiver has ordered the queue for
          * us! We do one quick check first though
@@ -1259,6 +1360,7 @@ static int x25_recvmsg(struct kiocb *iocb, struct socket *sock,
 out_free_dgram:
         skb_free_datagram(sk, skb);
 out:
+        unlock_kernel();
         return rc;
 }
 
@@ -1270,6 +1372,7 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         void __user *argp = (void __user *)arg;
         int rc;
 
+        lock_kernel();
         switch (cmd) {
                 case TIOCOUTQ: {
                         int amount = sk->sk_sndbuf - sk_wmem_alloc_get(sk);
@@ -1359,11 +1462,22 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         if (facilities.winsize_in < 1 ||
                             facilities.winsize_in > 127)
                                 break;
-                        if (facilities.throughput < 0x03 ||
-                            facilities.throughput > 0xDD)
-                                break;
+                        if (facilities.throughput) {
+                                int out = facilities.throughput & 0xf0;
+                                int in  = facilities.throughput & 0x0f;
+                                if (!out)
+                                        facilities.throughput |=
+                                                X25_DEFAULT_THROUGHPUT << 4;
+                                else if (out < 0x30 || out > 0xD0)
+                                        break;
+                                if (!in)
+                                        facilities.throughput |=
+                                                X25_DEFAULT_THROUGHPUT;
+                                else if (in < 0x03 || in > 0x0D)
+                                        break;
+                        }
                         if (facilities.reverse &&
-                                (facilities.reverse | 0x81)!= 0x81)
+                                (facilities.reverse & 0x81) != 0x81)
                                 break;
                         x25->facilities = facilities;
                         rc = 0;
@@ -1430,6 +1544,17 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         break;
                 }
 
+                case SIOCX25SCAUSEDIAG: {
+                        struct x25_causediag causediag;
+                        rc = -EFAULT;
+                        if (copy_from_user(&causediag, argp, sizeof(causediag)))
+                                break;
+                        x25->causediag = causediag;
+                        rc = 0;
+                        break;
+
+                }
+
                 case SIOCX25SCUDMATCHLEN: {
                         struct x25_subaddr sub_addr;
                         rc = -EINVAL;
@@ -1472,11 +1597,12 @@ static int x25_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                         rc = -ENOIOCTLCMD;
                         break;
         }
+        unlock_kernel();
 
         return rc;
 }
 
-static struct net_proto_family x25_family_ops = {
+static const struct net_proto_family x25_family_ops = {
         .family =       AF_X25,
         .create =       x25_create,
         .owner  =       THIS_MODULE,
@@ -1542,15 +1668,19 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
                 break;
         case SIOCGSTAMP:
                 rc = -EINVAL;
+                lock_kernel();
                 if (sk)
                         rc = compat_sock_get_timestamp(sk,
                                         (struct timeval __user*)argp);
+                unlock_kernel();
                 break;
         case SIOCGSTAMPNS:
                 rc = -EINVAL;
+                lock_kernel();
                 if (sk)
                         rc = compat_sock_get_timestampns(sk,
                                         (struct timespec __user*)argp);
+                unlock_kernel();
                 break;
         case SIOCGIFADDR:
         case SIOCSIFADDR:
@@ -1569,16 +1699,22 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
                 rc = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
+                lock_kernel();
                 rc = x25_route_ioctl(cmd, argp);
+                unlock_kernel();
                 break;
         case SIOCX25GSUBSCRIP:
+                lock_kernel();
                 rc = compat_x25_subscr_ioctl(cmd, argp);
+                unlock_kernel();
                 break;
         case SIOCX25SSUBSCRIP:
                 rc = -EPERM;
                 if (!capable(CAP_NET_ADMIN))
                         break;
+                lock_kernel();
                 rc = compat_x25_subscr_ioctl(cmd, argp);
+                unlock_kernel();
                 break;
         case SIOCX25GFACILITIES:
         case SIOCX25SFACILITIES:
@@ -1587,6 +1723,7 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
         case SIOCX25GCALLUSERDATA:
         case SIOCX25SCALLUSERDATA:
         case SIOCX25GCAUSEDIAG:
+        case SIOCX25SCAUSEDIAG:
         case SIOCX25SCUDMATCHLEN:
         case SIOCX25CALLACCPTAPPRV:
         case SIOCX25SENDCALLACCPT:
@@ -1600,7 +1737,7 @@ static int compat_x25_ioctl(struct socket *sock, unsigned int cmd,
 }
 #endif
 
-static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
+static const struct proto_ops x25_proto_ops = {
         .family =       AF_X25,
         .owner =        THIS_MODULE,
         .release =      x25_release,
@@ -1609,7 +1746,7 @@ static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
         .socketpair =   sock_no_socketpair,
         .accept =       x25_accept,
         .getname =      x25_getname,
-        .poll =         datagram_poll,
+        .poll =         x25_datagram_poll,
         .ioctl =        x25_ioctl,
 #ifdef CONFIG_COMPAT
         .compat_ioctl = compat_x25_ioctl,
@@ -1624,8 +1761,6 @@ static const struct proto_ops SOCKOPS_WRAPPED(x25_proto_ops) = {
         .sendpage =     sock_no_sendpage,
 };
 
-SOCKOPS_WRAP(x25_proto, AF_X25);
-
 static struct packet_type x25_packet_type __read_mostly = {
         .type = cpu_to_be16(ETH_P_X25),
         .func = x25_lapb_receive_frame,
@@ -1659,20 +1794,31 @@ static int __init x25_init(void)
         if (rc != 0)
                 goto out;
 
-        sock_register(&x25_family_ops);
+        rc = sock_register(&x25_family_ops);
+        if (rc != 0)
+                goto out_proto;
 
         dev_add_pack(&x25_packet_type);
 
-        register_netdevice_notifier(&x25_dev_notifier);
+        rc = register_netdevice_notifier(&x25_dev_notifier);
+        if (rc != 0)
+                goto out_sock;
 
         printk(KERN_INFO "X.25 for Linux Version 0.2\n");
 
-#ifdef CONFIG_SYSCTL
         x25_register_sysctl();
-#endif
-        x25_proc_init();
+        rc = x25_proc_init();
+        if (rc != 0)
+                goto out_dev;
 out:
         return rc;
+out_dev:
+        unregister_netdevice_notifier(&x25_dev_notifier);
+out_sock:
+        sock_unregister(AF_X25);
+out_proto:
+        proto_unregister(&x25_proto);
+        goto out;
 }
 module_init(x25_init);
 
@@ -1682,9 +1828,7 @@ static void __exit x25_exit(void)
         x25_link_free();
         x25_route_free();
 
-#ifdef CONFIG_SYSCTL
         x25_unregister_sysctl();
-#endif
 
         unregister_netdevice_notifier(&x25_dev_notifier);
 
diff --git a/net/x25/sysctl_net_x25.c b/net/x25/sysctl_net_x25.c
index a5d3416522de..d2efd29f434e 100644
--- a/net/x25/sysctl_net_x25.c
+++ b/net/x25/sysctl_net_x25.c
@@ -19,62 +19,51 @@ static struct ctl_table_header *x25_table_header;
 
 static struct ctl_table x25_table[] = {
         {
-                .ctl_name =     NET_X25_RESTART_REQUEST_TIMEOUT,
                 .procname =     "restart_request_timeout",
                 .data =         &sysctl_x25_restart_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_CALL_REQUEST_TIMEOUT,
                 .procname =     "call_request_timeout",
                 .data =         &sysctl_x25_call_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_RESET_REQUEST_TIMEOUT,
                 .procname =     "reset_request_timeout",
                 .data =         &sysctl_x25_reset_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_CLEAR_REQUEST_TIMEOUT,
                 .procname =     "clear_request_timeout",
                 .data =         &sysctl_x25_clear_request_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_ACK_HOLD_BACK_TIMEOUT,
                 .procname =     "acknowledgement_hold_back_timeout",
                 .data =         &sysctl_x25_ack_holdback_timeout,
                 .maxlen =       sizeof(int),
                 .mode =         0644,
                 .proc_handler = proc_dointvec_minmax,
-                .strategy =     sysctl_intvec,
                 .extra1 =       &min_timer,
                 .extra2 =       &max_timer,
         },
         {
-                .ctl_name =     NET_X25_FORWARD,
                 .procname =     "x25_forward",
                 .data =         &sysctl_x25_forward,
                 .maxlen =       sizeof(int),
@@ -85,8 +74,8 @@ static struct ctl_table x25_table[] = {
 };
 
 static struct ctl_path x25_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
-        { .procname = "x25", .ctl_name = NET_X25, },
+        { .procname = "net", },
+        { .procname = "x25", },
         { }
 };
 
diff --git a/net/x25/x25_dev.c b/net/x25/x25_dev.c
index 3e1efe534645..b9ef682230a0 100644
--- a/net/x25/x25_dev.c
+++ b/net/x25/x25_dev.c
@@ -20,6 +20,7 @@
 #include <linux/kernel.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <linux/if_arp.h>
 #include <net/x25.h>
@@ -53,7 +54,7 @@ static int x25_receive_data(struct sk_buff *skb, struct x25_neigh *nb)
                 if (!sock_owned_by_user(sk)) {
                         queued = x25_process_rx_frame(sk, skb);
                 } else {
-                        sk_add_backlog(sk, skb);
+                        queued = !sk_add_backlog(sk, skb);
                 }
                 bh_unlock_sock(sk);
                 sock_put(sk);
diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index a21f6646eb3a..771bab00754b 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -35,7 +35,7 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
                 struct x25_dte_facilities *dte_facs, unsigned long *vc_fac_mask)
 {
         unsigned char *p = skb->data;
-        unsigned int len = *p++;
+        unsigned int len;
 
         *vc_fac_mask = 0;
 
@@ -50,6 +50,14 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
         memset(dte_facs->called_ae, '\0', sizeof(dte_facs->called_ae));
         memset(dte_facs->calling_ae, '\0', sizeof(dte_facs->calling_ae));
 
+        if (skb->len < 1)
+                return 0;
+
+        len = *p++;
+
+        if (len >= skb->len)
+                return -1;
+
         while (len > 0) {
                 switch (*p & X25_FAC_CLASS_MASK) {
                 case X25_FAC_CLASS_A:
@@ -247,6 +255,8 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
         memcpy(new, ours, sizeof(*new));
 
         len = x25_parse_facilities(skb, &theirs, dte, &x25->vc_facil_mask);
+        if (len < 0)
+                return len;
 
         /*
          *      They want reverse charging, we won't accept it.
@@ -259,9 +269,18 @@ int x25_negotiate_facilities(struct sk_buff *skb, struct sock *sk,
         new->reverse = theirs.reverse;
 
         if (theirs.throughput) {
-                if (theirs.throughput < ours->throughput) {
-                        SOCK_DEBUG(sk, "X.25: throughput negotiated down\n");
-                        new->throughput = theirs.throughput;
+                int theirs_in =  theirs.throughput & 0x0f;
+                int theirs_out = theirs.throughput & 0xf0;
+                int ours_in  = ours->throughput & 0x0f;
+                int ours_out = ours->throughput & 0xf0;
+                if (!ours_in || theirs_in < ours_in) {
+                        SOCK_DEBUG(sk, "X.25: inbound throughput negotiated\n");
+                        new->throughput = (new->throughput & 0xf0) | theirs_in;
+                }
+                if (!ours_out || theirs_out < ours_out) {
+                        SOCK_DEBUG(sk,
+                                "X.25: outbound throughput negotiated\n");
+                        new->throughput = (new->throughput & 0x0f) | theirs_out;
                 }
         }
 
diff --git a/net/x25/x25_forward.c b/net/x25/x25_forward.c
index 056a55f3a871..25a810793968 100644
--- a/net/x25/x25_forward.c
+++ b/net/x25/x25_forward.c
@@ -10,6 +10,7 @@
  */
 #include <linux/if_arp.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/x25.h>
 
 LIST_HEAD(x25_forward_list);
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 7d7c3abf38b5..372ac226e648 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -23,6 +23,7 @@
  *                                        i-frames.
  */
 
+#include <linux/slab.h>
 #include <linux/errno.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
@@ -89,6 +90,7 @@ static int x25_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
 static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametype)
 {
         struct x25_address source_addr, dest_addr;
+        int len;
 
         switch (frametype) {
                 case X25_CALL_ACCEPTED: {
@@ -106,15 +108,21 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
                          *      Parse the data in the frame.
                          */
                         skb_pull(skb, X25_STD_MIN_LEN);
-                        skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
-                        skb_pull(skb,
-                                 x25_parse_facilities(skb, &x25->facilities,
+
+                        len = x25_parse_address_block(skb, &source_addr,
+                                                &dest_addr);
+                        if (len > 0)
+                                skb_pull(skb, len);
+
+                        len = x25_parse_facilities(skb, &x25->facilities,
                                                 &x25->dte_facilities,
-                                                &x25->vc_facil_mask));
+                                                &x25->vc_facil_mask);
+                        if (len > 0)
+                                skb_pull(skb, len);
                         /*
                          *      Copy any Call User Data.
                          */
-                        if (skb->len >= 0) {
+                        if (skb->len > 0) {
                                 skb_copy_from_linear_data(skb,
                                               x25->calluserdata.cuddata,
                                               skb->len);
diff --git a/net/x25/x25_link.c b/net/x25/x25_link.c
index e4e1b6e49538..73e7b954ad28 100644
--- a/net/x25/x25_link.c
+++ b/net/x25/x25_link.c
@@ -24,6 +24,7 @@
 #include <linux/kernel.h>
 #include <linux/jiffies.h>
 #include <linux/timer.h>
+#include <linux/slab.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
 #include <asm/uaccess.h>
diff --git a/net/x25/x25_out.c b/net/x25/x25_out.c
index 2b96b52114d6..52351a26b6fc 100644
--- a/net/x25/x25_out.c
+++ b/net/x25/x25_out.c
@@ -22,6 +22,7 @@
  *                                      needed cleaned seq-number fields.
  */
 
+#include <linux/slab.h>
 #include <linux/socket.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
diff --git a/net/x25/x25_proc.c b/net/x25/x25_proc.c
index 0a04e62e0e18..7ff373792324 100644
--- a/net/x25/x25_proc.c
+++ b/net/x25/x25_proc.c
@@ -25,49 +25,17 @@
 #include <net/x25.h>
 
 #ifdef CONFIG_PROC_FS
-static __inline__ struct x25_route *x25_get_route_idx(loff_t pos)
-{
-        struct list_head *route_entry;
-        struct x25_route *rt = NULL;
-
-        list_for_each(route_entry, &x25_route_list) {
-                rt = list_entry(route_entry, struct x25_route, node);
-                if (!pos--)
-                        goto found;
-        }
-        rt = NULL;
-found:
-        return rt;
-}
 
 static void *x25_seq_route_start(struct seq_file *seq, loff_t *pos)
         __acquires(x25_route_list_lock)
 {
-        loff_t l = *pos;
-
         read_lock_bh(&x25_route_list_lock);
-        return l ? x25_get_route_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&x25_route_list, *pos);
 }
 
 static void *x25_seq_route_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct x25_route *rt;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                rt = NULL;
-                if (!list_empty(&x25_route_list))
-                        rt = list_entry(x25_route_list.next,
-                                        struct x25_route, node);
-                goto out;
-        }
-        rt = v;
-        if (rt->node.next != &x25_route_list)
-                rt = list_entry(rt->node.next, struct x25_route, node);
-        else
-                rt = NULL;
-out:
-        return rt;
+        return seq_list_next(v, &x25_route_list, pos);
 }
 
 static void x25_seq_route_stop(struct seq_file *seq, void *v)
@@ -78,9 +46,9 @@ static void x25_seq_route_stop(struct seq_file *seq, void *v)
 
 static int x25_seq_route_show(struct seq_file *seq, void *v)
 {
-        struct x25_route *rt;
+        struct x25_route *rt = list_entry(v, struct x25_route, node);
 
-        if (v == SEQ_START_TOKEN) {
+        if (v == &x25_route_list) {
                 seq_puts(seq, "Address          Digits  Device\n");
                 goto out;
         }
@@ -93,40 +61,16 @@ out:
         return 0;
 }
 
-static __inline__ struct sock *x25_get_socket_idx(loff_t pos)
-{
-        struct sock *s;
-        struct hlist_node *node;
-
-        sk_for_each(s, node, &x25_list)
-                if (!pos--)
-                        goto found;
-        s = NULL;
-found:
-        return s;
-}
-
 static void *x25_seq_socket_start(struct seq_file *seq, loff_t *pos)
         __acquires(x25_list_lock)
 {
-        loff_t l = *pos;
-
         read_lock_bh(&x25_list_lock);
-        return l ? x25_get_socket_idx(--l) : SEQ_START_TOKEN;
+        return seq_hlist_start_head(&x25_list, *pos);
 }
 
 static void *x25_seq_socket_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct sock *s;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                s = sk_head(&x25_list);
-                goto out;
-        }
-        s = sk_next(v);
-out:
-        return s;
+        return seq_hlist_next(v, &x25_list, pos);
 }
 
 static void x25_seq_socket_stop(struct seq_file *seq, void *v)
@@ -148,7 +92,7 @@ static int x25_seq_socket_show(struct seq_file *seq, void *v)
                 goto out;
         }
 
-        s = v;
+        s = sk_entry(v);
         x25 = x25_sk(s);
 
         if (!x25->neighbour || (dev = x25->neighbour->dev) == NULL)
@@ -170,51 +114,16 @@ out:
         return 0;
 }
 
-static __inline__ struct x25_forward *x25_get_forward_idx(loff_t pos)
-{
-        struct x25_forward *f;
-        struct list_head *entry;
-
-        list_for_each(entry, &x25_forward_list) {
-                f = list_entry(entry, struct x25_forward, node);
-                if (!pos--)
-                        goto found;
-        }
-
-        f = NULL;
-found:
-        return f;
-}
-
 static void *x25_seq_forward_start(struct seq_file *seq, loff_t *pos)
         __acquires(x25_forward_list_lock)
 {
-        loff_t l = *pos;
-
         read_lock_bh(&x25_forward_list_lock);
-        return l ? x25_get_forward_idx(--l) : SEQ_START_TOKEN;
+        return seq_list_start_head(&x25_forward_list, *pos);
 }
 
 static void *x25_seq_forward_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct x25_forward *f;
-
-        ++*pos;
-        if (v == SEQ_START_TOKEN) {
-                f = NULL;
-                if (!list_empty(&x25_forward_list))
-                        f = list_entry(x25_forward_list.next,
-                                        struct x25_forward, node);
-                goto out;
-        }
-        f = v;
-        if (f->node.next != &x25_forward_list)
-                f = list_entry(f->node.next, struct x25_forward, node);
-        else
-                f = NULL;
-out:
-        return f;
-
+        return seq_list_next(v, &x25_forward_list, pos);
 }
 
 static void x25_seq_forward_stop(struct seq_file *seq, void *v)
@@ -225,9 +134,9 @@ static void x25_seq_forward_stop(struct seq_file *seq, void *v)
 
 static int x25_seq_forward_show(struct seq_file *seq, void *v)
 {
-        struct x25_forward *f;
+        struct x25_forward *f = list_entry(v, struct x25_forward, node);
 
-        if (v == SEQ_START_TOKEN) {
+        if (v == &x25_forward_list) {
                 seq_printf(seq, "lci dev1       dev2\n");
                 goto out;
         }
@@ -236,7 +145,6 @@ static int x25_seq_forward_show(struct seq_file *seq, void *v)
 
         seq_printf(seq, "%d %-10s %-10s\n",
                         f->lci, f->dev1->name, f->dev2->name);
-
 out:
         return 0;
 }
diff --git a/net/x25/x25_route.c b/net/x25/x25_route.c
index 2c999ccf504a..97d77c532d8c 100644
--- a/net/x25/x25_route.c
+++ b/net/x25/x25_route.c
@@ -19,6 +19,7 @@
 
 #include <linux/if_arp.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/x25.h>
 
 LIST_HEAD(x25_route_list);
@@ -136,8 +137,10 @@ struct net_device *x25_dev_get(char *devname)
 #if defined(CONFIG_LLC) || defined(CONFIG_LLC_MODULE)
                                         && dev->type != ARPHRD_ETHER
 #endif
-                                        )))
+                                        ))){
                 dev_put(dev);
+                dev = NULL;
+        }
 
         return dev;
 }
@@ -190,7 +193,7 @@ int x25_route_ioctl(unsigned int cmd, void __user *arg)
                 goto out;
 
         rc = -EINVAL;
-        if (rt.sigdigits < 0 || rt.sigdigits > 15)
+        if (rt.sigdigits > 15)
                 goto out;
 
         dev = x25_dev_get(rt.device);
diff --git a/net/x25/x25_subr.c b/net/x25/x25_subr.c
index 511a5986af3e..dc20cf12f39b 100644
--- a/net/x25/x25_subr.c
+++ b/net/x25/x25_subr.c
@@ -23,6 +23,7 @@
  *                                              restriction on response.
  */
 
+#include <linux/slab.h>
 #include <linux/kernel.h>
 #include <linux/string.h>
 #include <linux/skbuff.h>
@@ -225,6 +226,12 @@ void x25_write_internal(struct sock *sk, int frametype)
                         break;
 
                 case X25_CLEAR_REQUEST:
+                        dptr    = skb_put(skb, 3);
+                        *dptr++ = frametype;
+                        *dptr++ = x25->causediag.cause;
+                        *dptr++ = x25->causediag.diagnostic;
+                        break;
+
                 case X25_RESET_REQUEST:
                         dptr    = skb_put(skb, 3);
                         *dptr++ = frametype;