15 files changed, 56 insertions, 45 deletions

diff --git a/net/Kconfig b/net/Kconfig
index c6cec5aa5486..4959a4e1e0fe 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -177,7 +177,7 @@ source "net/lapb/Kconfig"
 
 config NET_DIVERT
         bool "Frame Diverter (EXPERIMENTAL)"
-        depends on EXPERIMENTAL
+        depends on EXPERIMENTAL && BROKEN
         ---help---
           The Frame Diverter allows you to divert packets from the
           network, that are not aimed at the interface receiving it (in
diff --git a/net/atm/clip.c b/net/atm/clip.c
index 7ce7bfe3fbad..7af2c411da82 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -500,9 +500,11 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
                 } else {
                         unsigned int len = skb->len;
 
+                        skb_get(skb);
                         clip_push(vcc, skb);
                         PRIV(skb->dev)->stats.rx_packets--;
                         PRIV(skb->dev)->stats.rx_bytes -= len;
+                        kfree_skb(skb);
                 }
         return 0;
 }
diff --git a/net/bridge/br_stp_bpdu.c b/net/bridge/br_stp_bpdu.c
index a7ba0cce0b46..068d8afbf0a7 100644
--- a/net/bridge/br_stp_bpdu.c
+++ b/net/bridge/br_stp_bpdu.c
@@ -121,7 +121,7 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
         buf[1] = 0;
         buf[2] = 0;
         buf[3] = BPDU_TYPE_TCN;
-        br_send_bpdu(p, buf, 7);
+        br_send_bpdu(p, buf, 4);
 }
 
 /*
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5130d2efdbbe..fe2113f54e2b 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1432,6 +1432,9 @@ int neigh_table_clear(struct neigh_table *tbl)
         kfree(tbl->phash_buckets);
         tbl->phash_buckets = NULL;
 
+        free_percpu(tbl->stats);
+        tbl->stats = NULL;
+
         return 0;
 }
 
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 23fb9d9768e3..01801c0f885d 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1281,18 +1281,18 @@ static inline int check_leaf(struct trie *t, struct leaf *l,
                              struct fib_result *res)
 {
         int err, i;
-        t_key mask;
+        __be32 mask;
         struct leaf_info *li;
         struct hlist_head *hhead = &l->list;
         struct hlist_node *node;
 
         hlist_for_each_entry_rcu(li, node, hhead, hlist) {
                 i = li->plen;
-                mask = ntohl(inet_make_mask(i));
-                if (l->key != (key & mask))
+                mask = inet_make_mask(i);
+                if (l->key != (key & ntohl(mask)))
                         continue;
 
-                if ((err = fib_semantic_match(&li->falh, flp, res, l->key, mask, i)) <= 0) {
+                if ((err = fib_semantic_match(&li->falh, flp, res, htonl(l->key), mask, i)) <= 0) {
                         *plen = i;
 #ifdef CONFIG_IP_FIB_TRIE_STATS
                         t->stats.semantic_match_passed++;
diff --git a/net/ipv4/ipvs/ip_vs_ftp.c b/net/ipv4/ipvs/ip_vs_ftp.c
index a19a33ceb811..37fafb1fbcff 100644
--- a/net/ipv4/ipvs/ip_vs_ftp.c
+++ b/net/ipv4/ipvs/ip_vs_ftp.c
@@ -46,14 +46,7 @@
  */
 static int ports[IP_VS_APP_MAX_PORTS] = {21, 0};
 module_param_array(ports, int, NULL, 0);
-
-/*
- *      Debug level
- */
-#ifdef CONFIG_IP_VS_DEBUG
-static int debug=0;
-module_param(debug, int, 0);
-#endif
+MODULE_PARM_DESC(ports, "Ports to monitor for FTP control commands");
 
 
 /*      Dummy variable */
@@ -177,7 +170,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
                                            &start, &end) != 1)
                         return 1;
 
-                IP_VS_DBG(1-debug, "PASV response (%u.%u.%u.%u:%d) -> "
+                IP_VS_DBG(7, "PASV response (%u.%u.%u.%u:%d) -> "
                           "%u.%u.%u.%u:%d detected\n",
                           NIPQUAD(from), ntohs(port), NIPQUAD(cp->caddr), 0);
 
@@ -280,7 +273,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         while (data <= data_limit - 6) {
                 if (strnicmp(data, "PASV\r\n", 6) == 0) {
                         /* Passive mode on */
-                        IP_VS_DBG(1-debug, "got PASV at %zd of %zd\n",
+                        IP_VS_DBG(7, "got PASV at %zd of %zd\n",
                                   data - data_start,
                                   data_limit - data_start);
                         cp->app_data = &ip_vs_ftp_pasv;
@@ -302,7 +295,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
                                    &start, &end) != 1)
                 return 1;
 
-        IP_VS_DBG(1-debug, "PORT %u.%u.%u.%u:%d detected\n",
+        IP_VS_DBG(7, "PORT %u.%u.%u.%u:%d detected\n",
                   NIPQUAD(to), ntohs(port));
 
         /* Passive mode off */
@@ -311,7 +304,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
         /*
          * Now update or create a connection entry for it
          */
-        IP_VS_DBG(1-debug, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
+        IP_VS_DBG(7, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
                   ip_vs_proto_name(iph->protocol),
                   NIPQUAD(to), ntohs(port), NIPQUAD(cp->vaddr), 0);
 
@@ -372,11 +365,17 @@ static int __init ip_vs_ftp_init(void)
         for (i=0; i<IP_VS_APP_MAX_PORTS; i++) {
                 if (!ports[i])
                         continue;
+                if (ports[i] < 0 || ports[i] > 0xffff) {
+                        IP_VS_WARNING("ip_vs_ftp: Ignoring invalid "
+                                      "configuration port[%d] = %d\n",
+                                      i, ports[i]);
+                        continue;
+                }
                 ret = register_ip_vs_app_inc(app, app->protocol, ports[i]);
                 if (ret)
                         break;
-                IP_VS_DBG(1-debug, "%s: loaded support on port[%d] = %d\n",
-                          app->name, i, ports[i]);
+                IP_VS_INFO("%s: loaded support on port[%d] = %d\n",
+                           app->name, i, ports[i]);
         }
 
         if (ret)
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 111ff39a08c5..159fa3f1ba67 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -89,7 +89,7 @@ int sysctl_tcp_frto;
 int sysctl_tcp_nometrics_save;
 
 int sysctl_tcp_moderate_rcvbuf = 1;
-int sysctl_tcp_abc = 1;
+int sysctl_tcp_abc;
 
 #define FLAG_DATA               0x01 /* Incoming frame contained data.          */
 #define FLAG_WIN_UPDATE         0x02 /* Incoming ACK was a window update.       */
diff --git a/net/ipv4/tcp_lp.c b/net/ipv4/tcp_lp.c
index 1f977b6ee9a1..48f28d617ce6 100644
--- a/net/ipv4/tcp_lp.c
+++ b/net/ipv4/tcp_lp.c
@@ -3,13 +3,8 @@
  *
  * TCP Low Priority is a distributed algorithm whose goal is to utilize only
  *   the excess network bandwidth as compared to the ``fair share`` of
- *   bandwidth as targeted by TCP. Available from:
- *     http://www.ece.rice.edu/~akuzma/Doc/akuzma/TCP-LP.pdf
+ *   bandwidth as targeted by TCP.
  *
- * Original Author:
- *   Aleksandar Kuzmanovic <akuzma@northwestern.edu>
- *
- * See http://www-ece.rice.edu/networks/TCP-LP/ for their implementation.
  * As of 2.6.13, Linux supports pluggable congestion control algorithms.
  * Due to the limitation of the API, we take the following changes from
  * the original TCP-LP implementation:
@@ -24,11 +19,20 @@
  *   o OWD is handled in relative format, where local time stamp will in
  *     tcp_time_stamp format.
  *
- * Port from 2.4.19 to 2.6.16 as module by:
- *   Wong Hoi Sing Edison <hswong3i@gmail.com>
- *   Hung Hing Lun <hlhung3i@gmail.com>
+ * Original Author:
+ *   Aleksandar Kuzmanovic <akuzma@northwestern.edu>
+ * Available from:
+ *   http://www.ece.rice.edu/~akuzma/Doc/akuzma/TCP-LP.pdf
+ * Original implementation for 2.4.19:
+ *   http://www-ece.rice.edu/networks/TCP-LP/
  *
- * Version: $Id: tcp_lp.c,v 1.22 2006-05-02 18:18:19 hswong3i Exp $
+ * 2.6.x module Authors:
+ *   Wong Hoi Sing, Edison <hswong3i@gmail.com>
+ *   Hung Hing Lun, Mike <hlhung3i@gmail.com>
+ * SourceForge project page:
+ *   http://tcp-lp-mod.sourceforge.net/
+ *
+ * Version: $Id: tcp_lp.c,v 1.24 2006/09/05 20:22:53 hswong3i Exp $
  */
 
 #include <linux/config.h>
@@ -153,16 +157,19 @@ static u32 tcp_lp_remote_hz_estimator(struct sock *sk)
         if (m < 0)
                 m = -m;
 
-        if (rhz != 0) {
+        if (rhz > 0) {
                 m -= rhz >> 6;  /* m is now error in remote HZ est */
                 rhz += m;       /* 63/64 old + 1/64 new */
         } else
                 rhz = m << 6;
 
+ out:
         /* record time for successful remote HZ calc */
-        lp->flag |= LP_VALID_RHZ;
+        if (rhz > 0)
+                lp->flag |= LP_VALID_RHZ;
+        else
+                lp->flag &= ~LP_VALID_RHZ;
 
- out:
         /* record reference time stamp */
         lp->remote_ref_time = tp->rx_opt.rcv_tsval;
         lp->local_ref_time = tp->rx_opt.rcv_tsecr;
@@ -333,6 +340,6 @@ static void __exit tcp_lp_unregister(void)
 module_init(tcp_lp_register);
 module_exit(tcp_lp_unregister);
 
-MODULE_AUTHOR("Wong Hoi Sing Edison, Hung Hing Lun");
+MODULE_AUTHOR("Wong Hoi Sing Edison, Hung Hing Lun Mike");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("TCP Low Priority");
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 99a6eb23378b..3b55b4c8e2d1 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -696,7 +696,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         }
 
                         tc = *(int *)CMSG_DATA(cmsg);
-                        if (tc < 0 || tc > 0xff)
+                        if (tc < -1 || tc > 0xff)
                                 goto exit_f;
 
                         err = 0;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 3d6e9a351150..356a8a7ef22a 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -401,7 +401,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         if (hlimit < 0)
                 hlimit = ipv6_get_hoplimit(dst->dev);
 
-        tclass = np->cork.tclass;
+        tclass = np->tclass;
         if (tclass < 0)
                 tclass = 0;
 
@@ -497,7 +497,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (hlimit < 0)
                 hlimit = ipv6_get_hoplimit(dst->dev);
 
-        tclass = np->cork.tclass;
+        tclass = np->tclass;
         if (tclass < 0)
                 tclass = 0;
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 43327264e69c..a5eaaf693abf 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -362,7 +362,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 break;
 
         case IPV6_TCLASS:
-                if (val < 0 || val > 0xff)
+                if (val < -1 || val > 0xff)
                         goto e_inval;
                 np->tclass = val;
                 retv = 0;
@@ -947,6 +947,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
 
         case IPV6_TCLASS:
                 val = np->tclass;
+                if (val < 0)
+                        val = 0;
                 break;
 
         case IPV6_RECVTCLASS:
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index d57e61ce4a7d..15b862d8acab 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -781,7 +781,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         }
 
         if (tclass < 0) {
-                tclass = np->cork.tclass;
+                tclass = np->tclass;
                 if (tclass < 0)
                         tclass = 0;
         }
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 4cdba7469dc4..be8d3c26b568 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -11,6 +11,8 @@
 
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Sam Johnston <samj@samj.net>");
+MODULE_ALIAS("ipt_quota");
+MODULE_ALIAS("ip6t_quota");
 
 static DEFINE_SPINLOCK(quota_lock);
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index f9cef3671593..4172a5235916 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -626,8 +626,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 if ((int)snaplen < 0)
                         snaplen = 0;
         }
-        if (snaplen > skb->len-skb->data_len)
-                snaplen = skb->len-skb->data_len;
 
         spin_lock(&sk->sk_receive_queue.lock);
         h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
@@ -644,7 +642,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
                 status &= ~TP_STATUS_LOSING;
         spin_unlock(&sk->sk_receive_queue.lock);
 
-        memcpy((u8*)h + macoff, skb->data, snaplen);
+        skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 
         h->tp_len = skb->len;
         h->tp_snaplen = snaplen;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 0834c2ee9174..6f9151899795 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -238,9 +238,7 @@ void __netdev_watchdog_up(struct net_device *dev)
 
 static void dev_watchdog_up(struct net_device *dev)
 {
-        netif_tx_lock_bh(dev);
         __netdev_watchdog_up(dev);
-        netif_tx_unlock_bh(dev);
 }
 
 static void dev_watchdog_down(struct net_device *dev)