15 files changed, 93 insertions, 77 deletions

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index cca921ea8550..6ee5354c9aa1 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3116,14 +3116,23 @@ static ctl_table ipv4_route_table[] = {
         { .ctl_name = 0 }
 };
 
-static __net_initdata struct ctl_path ipv4_route_path[] = {
+static struct ctl_table empty[1];
+
+static struct ctl_table ipv4_skeleton[] =
+{
+        { .procname = "route", .ctl_name = NET_IPV4_ROUTE,
+          .mode = 0555, .child = ipv4_route_table},
+        { .procname = "neigh", .ctl_name = NET_IPV4_NEIGH,
+          .mode = 0555, .child = empty},
+        { }
+};
+
+static __net_initdata struct ctl_path ipv4_path[] = {
         { .procname = "net", .ctl_name = CTL_NET, },
         { .procname = "ipv4", .ctl_name = NET_IPV4, },
-        { .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
         { },
 };
 
-
 static struct ctl_table ipv4_route_flush_table[] = {
         {
                 .ctl_name       = NET_IPV4_ROUTE_FLUSH,
@@ -3136,6 +3145,13 @@ static struct ctl_table ipv4_route_flush_table[] = {
         { .ctl_name = 0 },
 };
 
+static __net_initdata struct ctl_path ipv4_route_path[] = {
+        { .procname = "net", .ctl_name = CTL_NET, },
+        { .procname = "ipv4", .ctl_name = NET_IPV4, },
+        { .procname = "route", .ctl_name = NET_IPV4_ROUTE, },
+        { },
+};
+
 static __net_init int sysctl_route_net_init(struct net *net)
 {
         struct ctl_table *tbl;
@@ -3287,7 +3303,7 @@ int __init ip_rt_init(void)
  */
 void __init ip_static_sysctl_init(void)
 {
-        register_sysctl_paths(ipv4_route_path, ipv4_route_table);
+        register_sysctl_paths(ipv4_path, ipv4_skeleton);
 }
 #endif
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a00532de2a8c..8165f5aa8c71 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -468,7 +468,8 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         }
         if (likely(sysctl_tcp_window_scaling)) {
                 opts->ws = tp->rx_opt.rcv_wscale;
-                size += TCPOLEN_WSCALE_ALIGNED;
+                if(likely(opts->ws))
+                        size += TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(sysctl_tcp_sack)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
@@ -509,7 +510,8 @@ static unsigned tcp_synack_options(struct sock *sk,
 
         if (likely(ireq->wscale_ok)) {
                 opts->ws = ireq->rcv_wscale;
-                size += TCPOLEN_WSCALE_ALIGNED;
+                if(likely(opts->ws))
+                        size += TCPOLEN_WSCALE_ALIGNED;
         }
         if (likely(doing_ts)) {
                 opts->options |= OPTION_TS;
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index e6dfaeac6be3..587f8f60c489 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -156,7 +156,7 @@ static struct ctl_table_header *ip6_base;
 int ipv6_static_sysctl_register(void)
 {
         static struct ctl_table empty[1];
-        ip6_base = register_net_sysctl_rotable(net_ipv6_ctl_path, empty);
+        ip6_base = register_sysctl_paths(net_ipv6_ctl_path, empty);
         if (ip6_base == NULL)
                 return -ENOMEM;
         return 0;
diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
index 475f89a8aee1..8165df578c92 100644
--- a/net/mac80211/debugfs_netdev.c
+++ b/net/mac80211/debugfs_netdev.c
@@ -248,8 +248,8 @@ IEEE80211_IF_WFILE(min_discovery_timeout,
 static void add_sta_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted, sta);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+        DEBUGFS_ADD(force_unicast_rateidx, sta);
+        DEBUGFS_ADD(max_ratectrl_rateidx, sta);
 
         DEBUGFS_ADD(state, sta);
         DEBUGFS_ADD(bssid, sta);
@@ -283,8 +283,8 @@ static void add_ap_files(struct ieee80211_sub_if_data *sdata)
 static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted, wds);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+        DEBUGFS_ADD(force_unicast_rateidx, wds);
+        DEBUGFS_ADD(max_ratectrl_rateidx, wds);
 
         DEBUGFS_ADD(peer, wds);
 }
@@ -292,8 +292,8 @@ static void add_wds_files(struct ieee80211_sub_if_data *sdata)
 static void add_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_ADD(drop_unencrypted, vlan);
-        DEBUGFS_ADD(force_unicast_rateidx, ap);
-        DEBUGFS_ADD(max_ratectrl_rateidx, ap);
+        DEBUGFS_ADD(force_unicast_rateidx, vlan);
+        DEBUGFS_ADD(max_ratectrl_rateidx, vlan);
 }
 
 static void add_monitor_files(struct ieee80211_sub_if_data *sdata)
@@ -381,8 +381,8 @@ static void add_files(struct ieee80211_sub_if_data *sdata)
 static void del_sta_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(drop_unencrypted, sta);
-        DEBUGFS_DEL(force_unicast_rateidx, ap);
-        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+        DEBUGFS_DEL(force_unicast_rateidx, sta);
+        DEBUGFS_DEL(max_ratectrl_rateidx, sta);
 
         DEBUGFS_DEL(state, sta);
         DEBUGFS_DEL(bssid, sta);
@@ -416,8 +416,8 @@ static void del_ap_files(struct ieee80211_sub_if_data *sdata)
 static void del_wds_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(drop_unencrypted, wds);
-        DEBUGFS_DEL(force_unicast_rateidx, ap);
-        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+        DEBUGFS_DEL(force_unicast_rateidx, wds);
+        DEBUGFS_DEL(max_ratectrl_rateidx, wds);
 
         DEBUGFS_DEL(peer, wds);
 }
@@ -425,8 +425,8 @@ static void del_wds_files(struct ieee80211_sub_if_data *sdata)
 static void del_vlan_files(struct ieee80211_sub_if_data *sdata)
 {
         DEBUGFS_DEL(drop_unencrypted, vlan);
-        DEBUGFS_DEL(force_unicast_rateidx, ap);
-        DEBUGFS_DEL(max_ratectrl_rateidx, ap);
+        DEBUGFS_DEL(force_unicast_rateidx, vlan);
+        DEBUGFS_DEL(max_ratectrl_rateidx, vlan);
 }
 
 static void del_monitor_files(struct ieee80211_sub_if_data *sdata)
diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index ec59345af65b..586a9b49b0fc 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h
@@ -470,6 +470,8 @@ struct ieee80211_sub_if_data {
                         struct dentry *auth_transaction;
                         struct dentry *flags;
                         struct dentry *num_beacons_sta;
+                        struct dentry *force_unicast_rateidx;
+                        struct dentry *max_ratectrl_rateidx;
                 } sta;
                 struct {
                         struct dentry *drop_unencrypted;
@@ -483,9 +485,13 @@ struct ieee80211_sub_if_data {
                 struct {
                         struct dentry *drop_unencrypted;
                         struct dentry *peer;
+                        struct dentry *force_unicast_rateidx;
+                        struct dentry *max_ratectrl_rateidx;
                 } wds;
                 struct {
                         struct dentry *drop_unencrypted;
+                        struct dentry *force_unicast_rateidx;
+                        struct dentry *max_ratectrl_rateidx;
                 } vlan;
                 struct {
                         struct dentry *mode;
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index b5933b271491..35f2f95f2fa7 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -383,7 +383,7 @@ errcopy:
                 hlist_for_each_safe(p, q, &newtbl->hash_buckets[i])
                         tbl->free_node(p, 0);
         }
-        __mesh_table_free(tbl);
+        __mesh_table_free(newtbl);
 endgrow:
         return NULL;
 }
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index 1e97fb9fb34b..9bb68c6a8f44 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -478,51 +478,21 @@ int ieee80211_ht_addt_info_ie_to_ht_bss_info(
 static void ieee80211_sta_send_associnfo(struct net_device *dev,
                                          struct ieee80211_if_sta *ifsta)
 {
-        char *buf;
-        size_t len;
-        int i;
         union iwreq_data wrqu;
 
-        if (!ifsta->assocreq_ies && !ifsta->assocresp_ies)
-                return;
-
-        buf = kmalloc(50 + 2 * (ifsta->assocreq_ies_len +
-                                ifsta->assocresp_ies_len), GFP_KERNEL);
-        if (!buf)
-                return;
-
-        len = sprintf(buf, "ASSOCINFO(");
         if (ifsta->assocreq_ies) {
-                len += sprintf(buf + len, "ReqIEs=");
-                for (i = 0; i < ifsta->assocreq_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocreq_ies[i]);
-                }
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = ifsta->assocreq_ies_len;
+                wireless_send_event(dev, IWEVASSOCREQIE, &wrqu,
+                                    ifsta->assocreq_ies);
         }
-        if (ifsta->assocresp_ies) {
-                if (ifsta->assocreq_ies)
-                        len += sprintf(buf + len, " ");
-                len += sprintf(buf + len, "RespIEs=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
-                }
-        }
-        len += sprintf(buf + len, ")");
 
-        if (len > IW_CUSTOM_MAX) {
-                len = sprintf(buf, "ASSOCRESPIE=");
-                for (i = 0; i < ifsta->assocresp_ies_len; i++) {
-                        len += sprintf(buf + len, "%02x",
-                                       ifsta->assocresp_ies[i]);
-                }
+        if (ifsta->assocresp_ies) {
+                memset(&wrqu, 0, sizeof(wrqu));
+                wrqu.data.length = ifsta->assocresp_ies_len;
+                wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu,
+                                    ifsta->assocresp_ies);
         }
-
-        memset(&wrqu, 0, sizeof(wrqu));
-        wrqu.data.length = len;
-        wireless_send_event(dev, IWEVCUSTOM, &wrqu, buf);
-
-        kfree(buf);
 }
 
 
@@ -813,7 +783,7 @@ static void ieee80211_send_assoc(struct net_device *dev,
                 }
         }
 
-        if (count == 8) {
+        if (rates_len > count) {
                 pos = skb_put(skb, rates_len - count + 2);
                 *pos++ = WLAN_EID_EXT_SUPP_RATES;
                 *pos++ = rates_len - count;
@@ -2868,7 +2838,7 @@ static void ieee80211_rx_bss_info(struct net_device *dev,
                        jiffies);
 #endif /* CONFIG_MAC80211_IBSS_DEBUG */
                 if (beacon_timestamp > rx_timestamp) {
-#ifndef CONFIG_MAC80211_IBSS_DEBUG
+#ifdef CONFIG_MAC80211_IBSS_DEBUG
                         printk(KERN_DEBUG "%s: beacon TSF higher than "
                                "local TSF - IBSS merge with BSSID %s\n",
                                dev->name, print_mac(mac, mgmt->bssid));
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 35a9994e2339..74aecc098bad 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -377,7 +377,7 @@ static ssize_t rfkill_claim_show(struct device *dev,
 {
         struct rfkill *rfkill = to_rfkill(dev);
 
-        return sprintf(buf, "%d", rfkill->user_claim);
+        return sprintf(buf, "%d\n", rfkill->user_claim);
 }
 
 static ssize_t rfkill_claim_store(struct device *dev,
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index e7fb9e0d21b4..506b709510b6 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -624,7 +624,7 @@ static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
         struct Qdisc *oqdisc = dev_queue->qdisc_sleeping;
         spinlock_t *root_lock;
 
-        root_lock = qdisc_root_lock(oqdisc);
+        root_lock = qdisc_lock(oqdisc);
         spin_lock_bh(root_lock);
 
         /* Prune old scheduler */
@@ -635,7 +635,7 @@ static struct Qdisc *dev_graft_qdisc(struct netdev_queue *dev_queue,
         if (qdisc == NULL)
                 qdisc = &noop_qdisc;
         dev_queue->qdisc_sleeping = qdisc;
-        dev_queue->qdisc = &noop_qdisc;
+        rcu_assign_pointer(dev_queue->qdisc, &noop_qdisc);
 
         spin_unlock_bh(root_lock);
 
@@ -830,9 +830,16 @@ qdisc_create(struct net_device *dev, struct netdev_queue *dev_queue,
                         sch->stab = stab;
                 }
                 if (tca[TCA_RATE]) {
+                        spinlock_t *root_lock;
+
+                        if ((sch->parent != TC_H_ROOT) &&
+                            !(sch->flags & TCQ_F_INGRESS))
+                                root_lock = qdisc_root_sleeping_lock(sch);
+                        else
+                                root_lock = qdisc_lock(sch);
+
                         err = gen_new_estimator(&sch->bstats, &sch->rate_est,
-                                                qdisc_root_lock(sch),
-                                                tca[TCA_RATE]);
+                                                root_lock, tca[TCA_RATE]);
                         if (err) {
                                 /*
                                  * Any broken qdiscs that would require
@@ -884,7 +891,8 @@ static int qdisc_change(struct Qdisc *sch, struct nlattr **tca)
 
         if (tca[TCA_RATE])
                 gen_replace_estimator(&sch->bstats, &sch->rate_est,
-                                      qdisc_root_lock(sch), tca[TCA_RATE]);
+                                      qdisc_root_sleeping_lock(sch),
+                                      tca[TCA_RATE]);
         return 0;
 }
 
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 8fa90d68ec6d..9b720adedead 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -1839,7 +1839,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
 
                 if (tca[TCA_RATE])
                         gen_replace_estimator(&cl->bstats, &cl->rate_est,
-                                              qdisc_root_lock(sch),
+                                              qdisc_root_sleeping_lock(sch),
                                               tca[TCA_RATE]);
                 return 0;
         }
@@ -1930,7 +1930,7 @@ cbq_change_class(struct Qdisc *sch, u32 classid, u32 parentid, struct nlattr **t
 
         if (tca[TCA_RATE])
                 gen_new_estimator(&cl->bstats, &cl->rate_est,
-                                  qdisc_root_lock(sch), tca[TCA_RATE]);
+                                  qdisc_root_sleeping_lock(sch), tca[TCA_RATE]);
 
         *arg = (unsigned long)cl;
         return 0;
diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 5f0ade7806a7..9634091ee2f0 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -634,7 +634,7 @@ static void dev_deactivate_queue(struct net_device *dev,
                 if (!(qdisc->flags & TCQ_F_BUILTIN))
                         set_bit(__QDISC_STATE_DEACTIVATED, &qdisc->state);
 
-                dev_queue->qdisc = qdisc_default;
+                rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
                 qdisc_reset(qdisc);
 
                 spin_unlock_bh(qdisc_lock(qdisc));
@@ -709,7 +709,7 @@ static void shutdown_scheduler_queue(struct net_device *dev,
         struct Qdisc *qdisc_default = _qdisc_default;
 
         if (qdisc) {
-                dev_queue->qdisc = qdisc_default;
+                rcu_assign_pointer(dev_queue->qdisc, qdisc_default);
                 dev_queue->qdisc_sleeping = qdisc_default;
 
                 qdisc_destroy(qdisc);
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index c2b8d9cce3d2..c1e77da8cd09 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1045,7 +1045,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 
                 if (tca[TCA_RATE])
                         gen_replace_estimator(&cl->bstats, &cl->rate_est,
-                                              qdisc_root_lock(sch),
+                                              qdisc_root_sleeping_lock(sch),
                                               tca[TCA_RATE]);
                 return 0;
         }
@@ -1104,7 +1104,7 @@ hfsc_change_class(struct Qdisc *sch, u32 classid, u32 parentid,
 
         if (tca[TCA_RATE])
                 gen_new_estimator(&cl->bstats, &cl->rate_est,
-                                  qdisc_root_lock(sch), tca[TCA_RATE]);
+                                  qdisc_root_sleeping_lock(sch), tca[TCA_RATE]);
         *arg = (unsigned long)cl;
         return 0;
 }
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 0df0df202ed0..97d4761cc31e 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1372,7 +1372,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
                         goto failure;
 
                 gen_new_estimator(&cl->bstats, &cl->rate_est,
-                                  qdisc_root_lock(sch),
+                                  qdisc_root_sleeping_lock(sch),
                                   tca[TCA_RATE] ? : &est.nla);
                 cl->refcnt = 1;
                 cl->children = 0;
@@ -1427,7 +1427,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
         } else {
                 if (tca[TCA_RATE])
                         gen_replace_estimator(&cl->bstats, &cl->rate_est,
-                                              qdisc_root_lock(sch),
+                                              qdisc_root_sleeping_lock(sch),
                                               tca[TCA_RATE]);
                 sch_tree_lock(sch);
         }
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 675a5c3e68a6..52db5f60daa0 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
 {
         struct sctp_auth_bytes *key;
 
+        /* Verify that we are not going to overflow INT_MAX */
+        if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
+                return NULL;
+
         /* Allocate the shared key */
         key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
         if (!key)
@@ -782,6 +786,9 @@ int sctp_auth_ep_set_hmacs(struct sctp_endpoint *ep,
         for (i = 0; i < hmacs->shmac_num_idents; i++) {
                 id = hmacs->shmac_idents[i];
 
+                if (id > SCTP_AUTH_HMAC_ID_MAX)
+                        return -EOPNOTSUPP;
+
                 if (SCTP_AUTH_HMAC_ID_SHA1 == id)
                         has_sha1 = 1;
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index bb5c9ef13046..5ffb9dec1c3f 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -3086,6 +3086,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                                     int optlen)
 {
         struct sctp_hmacalgo *hmacs;
+        u32 idents;
         int err;
 
         if (!sctp_auth_enable)
@@ -3103,8 +3104,9 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
                 goto out;
         }
 
-        if (hmacs->shmac_num_idents == 0 ||
-            hmacs->shmac_num_idents > SCTP_AUTH_NUM_HMACS) {
+        idents = hmacs->shmac_num_idents;
+        if (idents == 0 || idents > SCTP_AUTH_NUM_HMACS ||
+            (idents * sizeof(u16)) > (optlen - sizeof(struct sctp_hmacalgo))) {
                 err = -EINVAL;
                 goto out;
         }
@@ -3144,6 +3146,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
                 goto out;
         }
 
+        if (authkey->sca_keylength > optlen - sizeof(struct sctp_authkey)) {
+                ret = -EINVAL;
+                goto out;
+        }
+
         asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
         if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
                 ret = -EINVAL;