6 files changed, 82 insertions, 40 deletions

diff --git a/net/9p/client.c b/net/9p/client.c
index 67717f69412e..4b529454616d 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -189,6 +189,9 @@ static struct p9_req_t *p9_tag_alloc(struct p9_client *c, u16 tag)
                         printk(KERN_ERR "Couldn't grow tag array\n");
                         kfree(req->tc);
                         kfree(req->rc);
+                        kfree(req->wq);
+                        req->tc = req->rc = NULL;
+                        req->wq = NULL;
                         return ERR_PTR(-ENOMEM);
                 }
                 req->tc->sdata = (char *) req->tc + sizeof(struct p9_fcall);
@@ -311,12 +314,6 @@ static void p9_free_req(struct p9_client *c, struct p9_req_t *r)
         r->status = REQ_STATUS_IDLE;
         if (tag != P9_NOTAG && p9_idpool_check(tag, c->tagpool))
                 p9_idpool_put(tag, c->tagpool);
-
-        /* if this was a flush request we have to free response fcall */
-        if (r->rc->id == P9_RFLUSH) {
-                kfree(r->tc);
-                kfree(r->rc);
-        }
 }
 
 /**
@@ -611,19 +608,21 @@ reterr:
 
 static struct p9_fid *p9_fid_create(struct p9_client *clnt)
 {
-        int err;
+        int ret;
         struct p9_fid *fid;
+        unsigned long flags;
 
         P9_DPRINTK(P9_DEBUG_FID, "clnt %p\n", clnt);
         fid = kmalloc(sizeof(struct p9_fid), GFP_KERNEL);
         if (!fid)
                 return ERR_PTR(-ENOMEM);
 
-        fid->fid = p9_idpool_get(clnt->fidpool);
+        ret = p9_idpool_get(clnt->fidpool);
         if (fid->fid < 0) {
-                err = -ENOSPC;
+                ret = -ENOSPC;
                 goto error;
         }
+        fid->fid = ret;
 
         memset(&fid->qid, 0, sizeof(struct p9_qid));
         fid->mode = -1;
@@ -632,27 +631,28 @@ static struct p9_fid *p9_fid_create(struct p9_client *clnt)
         fid->clnt = clnt;
         fid->aux = NULL;
 
-        spin_lock(&clnt->lock);
+        spin_lock_irqsave(&clnt->lock, flags);
         list_add(&fid->flist, &clnt->fidlist);
-        spin_unlock(&clnt->lock);
+        spin_unlock_irqrestore(&clnt->lock, flags);
 
         return fid;
 
 error:
         kfree(fid);
-        return ERR_PTR(err);
+        return ERR_PTR(ret);
 }
 
 static void p9_fid_destroy(struct p9_fid *fid)
 {
         struct p9_client *clnt;
+        unsigned long flags;
 
         P9_DPRINTK(P9_DEBUG_FID, "fid %d\n", fid->fid);
         clnt = fid->clnt;
         p9_idpool_put(fid->fid, clnt->fidpool);
-        spin_lock(&clnt->lock);
+        spin_lock_irqsave(&clnt->lock, flags);
         list_del(&fid->flist);
-        spin_unlock(&clnt->lock);
+        spin_unlock_irqrestore(&clnt->lock, flags);
         kfree(fid);
 }
 
@@ -818,7 +818,9 @@ struct p9_fid *p9_client_attach(struct p9_client *clnt, struct p9_fid *afid,
         }
 
         P9_DPRINTK(P9_DEBUG_9P, "<<< RATTACH qid %x.%llx.%x\n",
-                                        qid.type, qid.path, qid.version);
+                                        qid.type,
+                                        (unsigned long long)qid.path,
+                                        qid.version);
 
         memmove(&fid->qid, &qid, sizeof(struct p9_qid));
 
@@ -865,7 +867,9 @@ p9_client_auth(struct p9_client *clnt, char *uname, u32 n_uname, char *aname)
         }
 
         P9_DPRINTK(P9_DEBUG_9P, "<<< RAUTH qid %x.%llx.%x\n",
-                                        qid.type, qid.path, qid.version);
+                                        qid.type,
+                                        (unsigned long long)qid.path,
+                                        qid.version);
 
         memmove(&afid->qid, &qid, sizeof(struct p9_qid));
         p9_free_req(clnt, req);
@@ -930,7 +934,8 @@ struct p9_fid *p9_client_walk(struct p9_fid *oldfid, int nwname, char **wnames,
 
         for (count = 0; count < nwqids; count++)
                 P9_DPRINTK(P9_DEBUG_9P, "<<<     [%d] %x.%llx.%x\n",
-                        count, wqids[count].type, wqids[count].path,
+                        count, wqids[count].type,
+                        (unsigned long long)wqids[count].path,
                         wqids[count].version);
 
         if (nwname)
@@ -980,7 +985,9 @@ int p9_client_open(struct p9_fid *fid, int mode)
         }
 
         P9_DPRINTK(P9_DEBUG_9P, "<<< ROPEN qid %x.%llx.%x iounit %x\n",
-                                qid.type, qid.path, qid.version, iounit);
+                                qid.type,
+                                (unsigned long long)qid.path,
+                                qid.version, iounit);
 
         fid->mode = mode;
         fid->iounit = iounit;
@@ -1023,7 +1030,9 @@ int p9_client_fcreate(struct p9_fid *fid, char *name, u32 perm, int mode,
         }
 
         P9_DPRINTK(P9_DEBUG_9P, "<<< RCREATE qid %x.%llx.%x iounit %x\n",
-                                qid.type, qid.path, qid.version, iounit);
+                                qid.type,
+                                (unsigned long long)qid.path,
+                                qid.version, iounit);
 
         fid->mode = mode;
         fid->iounit = iounit;
@@ -1230,9 +1239,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
                 "<<<    name=%s uid=%s gid=%s muid=%s extension=(%s)\n"
                 "<<<    uid=%d gid=%d n_muid=%d\n",
                 ret->size, ret->type, ret->dev, ret->qid.type,
-                ret->qid.path, ret->qid.version, ret->mode,
-                ret->atime, ret->mtime, ret->length, ret->name,
-                ret->uid, ret->gid, ret->muid, ret->extension,
+                (unsigned long long)ret->qid.path, ret->qid.version, ret->mode,
+                ret->atime, ret->mtime, (unsigned long long)ret->length,
+                ret->name, ret->uid, ret->gid, ret->muid, ret->extension,
                 ret->n_uid, ret->n_gid, ret->n_muid);
 
 free_and_error:
@@ -1255,9 +1264,9 @@ int p9_client_wstat(struct p9_fid *fid, struct p9_wstat *wst)
                 "     name=%s uid=%s gid=%s muid=%s extension=(%s)\n"
                 "     uid=%d gid=%d n_muid=%d\n",
                 wst->size, wst->type, wst->dev, wst->qid.type,
-                wst->qid.path, wst->qid.version, wst->mode,
-                wst->atime, wst->mtime, wst->length, wst->name,
-                wst->uid, wst->gid, wst->muid, wst->extension,
+                (unsigned long long)wst->qid.path, wst->qid.version, wst->mode,
+                wst->atime, wst->mtime, (unsigned long long)wst->length,
+                wst->name, wst->uid, wst->gid, wst->muid, wst->extension,
                 wst->n_uid, wst->n_gid, wst->n_muid);
         err = 0;
         clnt = fid->clnt;
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index 8d6cc4777aae..2f1fe5fc1228 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -45,7 +45,6 @@
 #include <net/9p/transport.h>
 #include <rdma/ib_verbs.h>
 #include <rdma/rdma_cm.h>
-#include <rdma/ib_verbs.h>
 
 #define P9_PORT                 5640
 #define P9_RDMA_SQ_DEPTH        32
@@ -589,6 +588,9 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)
         if (IS_ERR(rdma->cm_id))
                 goto error;
 
+        /* Associate the client with the transport */
+        client->trans = rdma;
+
         /* Resolve the server's address */
         rdma->addr.sin_family = AF_INET;
         rdma->addr.sin_addr.s_addr = in_aton(addr);
@@ -669,7 +671,6 @@ rdma_create_trans(struct p9_client *client, const char *addr, char *args)
         if (err || (rdma->state != P9_RDMA_CONNECTED))
                 goto error;
 
-        client->trans = rdma;
         client->status = Connected;
 
         return 0;
diff --git a/net/core/scm.c b/net/core/scm.c
index 10f5c65f6a47..ab242cc1acca 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -75,6 +75,7 @@ static int scm_fp_copy(struct cmsghdr *cmsg, struct scm_fp_list **fplp)
                 if (!fpl)
                         return -ENOMEM;
                 *fplp = fpl;
+                INIT_LIST_HEAD(&fpl->list);
                 fpl->count = 0;
         }
         fpp = &fpl->fp[fpl->count];
@@ -106,9 +107,25 @@ void __scm_destroy(struct scm_cookie *scm)
 
         if (fpl) {
                 scm->fp = NULL;
-                for (i=fpl->count-1; i>=0; i--)
-                        fput(fpl->fp[i]);
-                kfree(fpl);
+                if (current->scm_work_list) {
+                        list_add_tail(&fpl->list, current->scm_work_list);
+                } else {
+                        LIST_HEAD(work_list);
+
+                        current->scm_work_list = &work_list;
+
+                        list_add(&fpl->list, &work_list);
+                        while (!list_empty(&work_list)) {
+                                fpl = list_first_entry(&work_list, struct scm_fp_list, list);
+
+                                list_del(&fpl->list);
+                                for (i=fpl->count-1; i>=0; i--)
+                                        fput(fpl->fp[i]);
+                                kfree(fpl);
+                        }
+
+                        current->scm_work_list = NULL;
+                }
         }
 }
 
@@ -284,6 +301,7 @@ struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl)
 
         new_fpl = kmalloc(sizeof(*fpl), GFP_KERNEL);
         if (new_fpl) {
+                INIT_LIST_HEAD(&new_fpl->list);
                 for (i=fpl->count-1; i>=0; i--)
                         get_file(fpl->fp[i]);
                 memcpy(new_fpl, fpl, sizeof(*fpl));
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 71e259e866a1..8b48512ebf6a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -138,6 +138,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         int peeked;
         int err;
         int is_udplite = IS_UDPLITE(sk);
+        int is_udp4;
 
         if (addr_len)
                 *addr_len=sizeof(struct sockaddr_in6);
@@ -158,6 +159,8 @@ try_again:
         else if (copied < ulen)
                 msg->msg_flags |= MSG_TRUNC;
 
+        is_udp4 = (skb->protocol == htons(ETH_P_IP));
+
         /*
          * If checksum is needed at all, try to do it while copying the
          * data.  If the data is truncated, or if we only want a partial
@@ -180,9 +183,14 @@ try_again:
         if (err)
                 goto out_free;
 
-        if (!peeked)
-                UDP6_INC_STATS_USER(sock_net(sk),
-                                UDP_MIB_INDATAGRAMS, is_udplite);
+        if (!peeked) {
+                if (is_udp4)
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INDATAGRAMS, is_udplite);
+                else
+                        UDP6_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INDATAGRAMS, is_udplite);
+        }
 
         sock_recv_timestamp(msg, sk, skb);
 
@@ -196,7 +204,7 @@ try_again:
                 sin6->sin6_flowinfo = 0;
                 sin6->sin6_scope_id = 0;
 
-                if (skb->protocol == htons(ETH_P_IP))
+                if (is_udp4)
                         ipv6_addr_set(&sin6->sin6_addr, 0, 0,
                                       htonl(0xffff), ip_hdr(skb)->saddr);
                 else {
@@ -207,7 +215,7 @@ try_again:
                 }
 
         }
-        if (skb->protocol == htons(ETH_P_IP)) {
+        if (is_udp4) {
                 if (inet->cmsg_flags)
                         ip_cmsg_recv(msg, skb);
         } else {
@@ -228,8 +236,14 @@ out:
 
 csum_copy_err:
         lock_sock(sk);
-        if (!skb_kill_datagram(sk, skb, flags))
-                UDP6_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        if (!skb_kill_datagram(sk, skb, flags)) {
+                if (is_udp4)
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INERRORS, is_udplite);
+                else
+                        UDP6_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INERRORS, is_udplite);
+        }
         release_sock(sk);
 
         if (flags & MSG_DONTWAIT)
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 25872747762c..058f04f54b90 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -315,9 +315,9 @@ static void xfrm_policy_kill(struct xfrm_policy *policy)
                 return;
         }
 
-        spin_lock(&xfrm_policy_gc_lock);
+        spin_lock_bh(&xfrm_policy_gc_lock);
         hlist_add_head(&policy->bydst, &xfrm_policy_gc_list);
-        spin_unlock(&xfrm_policy_gc_lock);
+        spin_unlock_bh(&xfrm_policy_gc_lock);
 
         schedule_work(&xfrm_policy_gc_work);
 }
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 4a8a1abb59ee..a278a6f3b991 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1816,7 +1816,7 @@ static int copy_to_user_kmaddress(struct xfrm_kmaddress *k, struct sk_buff *skb)
         uk.family = k->family;
         uk.reserved = k->reserved;
         memcpy(&uk.local, &k->local, sizeof(uk.local));
-        memcpy(&uk.remote, &k->local, sizeof(uk.remote));
+        memcpy(&uk.remote, &k->remote, sizeof(uk.remote));
 
         return nla_put(skb, XFRMA_KMADDRESS, sizeof(uk), &uk);
 }