27 files changed, 56 insertions, 45 deletions

diff --git a/net/ax25/ax25_in.c b/net/ax25/ax25_in.c
index 3b7d1720c2ee..d1be080dcb25 100644
--- a/net/ax25/ax25_in.c
+++ b/net/ax25/ax25_in.c
@@ -124,7 +124,7 @@ int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
                 }
 
                 skb_pull(skb, 1);       /* Remove PID */
-                skb_reset_mac_header(skb);
+                skb->mac_header = skb->network_header;
                 skb_reset_network_header(skb);
                 skb->dev      = ax25->ax25_dev->dev;
                 skb->pkt_type = PACKET_HOST;
diff --git a/net/compat.c b/net/compat.c
index d74d82155d78..377e560ab5c9 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -254,6 +254,8 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
         if (copy_to_user(CMSG_COMPAT_DATA(cm), data, cmlen - sizeof(struct compat_cmsghdr)))
                 return -EFAULT;
         cmlen = CMSG_COMPAT_SPACE(len);
+        if (kmsg->msg_controllen < cmlen)
+                cmlen = kmsg->msg_controllen;
         kmsg->msg_control += cmlen;
         kmsg->msg_controllen -= cmlen;
         return 0;
diff --git a/net/core/dev.c b/net/core/dev.c
index 26a3a3a15be0..be9d3015beaa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2819,7 +2819,7 @@ void dev_set_allmulti(struct net_device *dev, int inc)
 /*
  *      Upload unicast and multicast address lists to device and
  *      configure RX filtering. When the device doesn't support unicast
- *      filtering it is put in promiscous mode while unicast addresses
+ *      filtering it is put in promiscuous mode while unicast addresses
  *      are present.
  */
 void __dev_set_rx_mode(struct net_device *dev)
diff --git a/net/core/scm.c b/net/core/scm.c
index 100ba6d9d478..10f5c65f6a47 100644
--- a/net/core/scm.c
+++ b/net/core/scm.c
@@ -196,6 +196,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
         if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
                 goto out;
         cmlen = CMSG_SPACE(len);
+        if (msg->msg_controllen < cmlen)
+                cmlen = msg->msg_controllen;
         msg->msg_control += cmlen;
         msg->msg_controllen -= cmlen;
         err = 0;
diff --git a/net/dccp/ackvec.h b/net/dccp/ackvec.h
index 9ef0737043ee..9671ecd17e00 100644
--- a/net/dccp/ackvec.h
+++ b/net/dccp/ackvec.h
@@ -71,7 +71,7 @@ struct dccp_ackvec {
  * @dccpavr_ack_ackno - sequence number being acknowledged
  * @dccpavr_ack_ptr - pointer into dccpav_buf where this record starts
  * @dccpavr_ack_nonce - dccpav_ack_nonce at the time this record was sent
- * @dccpavr_sent_len - lenght of the record in dccpav_buf
+ * @dccpavr_sent_len - length of the record in dccpav_buf
  */
 struct dccp_ackvec_record {
         struct list_head dccpavr_node;
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index 19b33586333d..d133416d3970 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -239,7 +239,7 @@ static void ccid3_hc_tx_no_feedback_timer(unsigned long data)
                                ccid3_tx_state_name(hctx->ccid3hctx_state),
                                (unsigned)(hctx->ccid3hctx_x >> 6));
                 /* The value of R is still undefined and so we can not recompute
-                 * the timout value. Keep initial value as per [RFC 4342, 5]. */
+                 * the timeout value. Keep initial value as per [RFC 4342, 5]. */
                 t_nfb = TFRC_INITIAL_TIMEOUT;
                 ccid3_update_send_interval(hctx);
                 break;
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index b3f366a33a5c..08174a2aa878 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -706,7 +706,7 @@ static int arp_process(struct sk_buff *skb)
         struct arphdr *arp;
         unsigned char *arp_ptr;
         struct rtable *rt;
-        unsigned char *sha, *tha;
+        unsigned char *sha;
         __be32 sip, tip;
         u16 dev_type = dev->type;
         int addr_type;
@@ -771,7 +771,6 @@ static int arp_process(struct sk_buff *skb)
         arp_ptr += dev->addr_len;
         memcpy(&sip, arp_ptr, 4);
         arp_ptr += 4;
-        tha     = arp_ptr;
         arp_ptr += dev->addr_len;
         memcpy(&tip, arp_ptr, 4);
 /*
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 732d8f088b13..97abf934d185 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -804,10 +804,13 @@ static void nl_fib_input(struct sk_buff *skb)
 
         nlh = nlmsg_hdr(skb);
         if (skb->len < NLMSG_SPACE(0) || skb->len < nlh->nlmsg_len ||
-            nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn))) {
-                kfree_skb(skb);
+            nlh->nlmsg_len < NLMSG_LENGTH(sizeof(*frn)))
                 return;
-        }
+
+        skb = skb_clone(skb, GFP_KERNEL);
+        if (skb == NULL)
+                return;
+        nlh = nlmsg_hdr(skb);
 
         frn = (struct fib_result_nl *) NLMSG_DATA(nlh);
         tb = fib_get_table(frn->tb_id_in);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 02b02a8d681c..4b93f32de10d 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -613,7 +613,7 @@ static int ipgre_rcv(struct sk_buff *skb)
                                 offset += 4;
                 }
 
-                skb_reset_mac_header(skb);
+                skb->mac_header = skb->network_header;
                 __pskb_pull(skb, offset);
                 skb_reset_network_header(skb);
                 skb_postpull_rcsum(skb, skb_transport_header(skb), offset);
diff --git a/net/ipv4/netfilter/nf_nat_sip.c b/net/ipv4/netfilter/nf_nat_sip.c
index 3ca98971a1e9..8996ccb757db 100644
--- a/net/ipv4/netfilter/nf_nat_sip.c
+++ b/net/ipv4/netfilter/nf_nat_sip.c
@@ -165,7 +165,7 @@ static int mangle_content_len(struct sk_buff *skb,
 
         dataoff = ip_hdrlen(skb) + sizeof(struct udphdr);
 
-        /* Get actual SDP lenght */
+        /* Get actual SDP length */
         if (ct_sip_get_info(ct, dptr, skb->len - dataoff, &matchoff,
                             &matchlen, POS_SDP_HEADER) > 0) {
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 67997a74ddce..777ed733b2d7 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -612,7 +612,7 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
          * optimistic addresses, but we may send the solicitation
          * if we don't include the sllao.  So here we check
          * if our address is optimistic, and if so, we
-         * supress the inclusion of the sllao.
+         * suppress the inclusion of the sllao.
          */
         if (send_sllao) {
                 struct inet6_ifaddr *ifp = ipv6_get_ifaddr(saddr, dev, 1);
diff --git a/net/irda/ircomm/ircomm_param.c b/net/irda/ircomm/ircomm_param.c
index e5e4792a0314..598dcbe4a501 100644
--- a/net/irda/ircomm/ircomm_param.c
+++ b/net/irda/ircomm/ircomm_param.c
@@ -496,7 +496,7 @@ static int ircomm_param_poll(void *instance, irda_param_t *param, int get)
         IRDA_ASSERT(self != NULL, return -1;);
         IRDA_ASSERT(self->magic == IRCOMM_TTY_MAGIC, return -1;);
 
-        /* Poll parameters are always of lenght 0 (just a signal) */
+        /* Poll parameters are always of length 0 (just a signal) */
         if (!get) {
                 /* Respond with DTE line settings */
                 ircomm_param_request(self, IRCOMM_DTE, TRUE);
diff --git a/net/irda/irlan/irlan_eth.c b/net/irda/irlan/irlan_eth.c
index c68220773d28..1ab91f787cc1 100644
--- a/net/irda/irlan/irlan_eth.c
+++ b/net/irda/irlan/irlan_eth.c
@@ -342,7 +342,7 @@ static void irlan_eth_set_multicast_list(struct net_device *dev)
 
         if (dev->flags & IFF_PROMISC) {
                 /* Enable promiscuous mode */
-                IRDA_WARNING("Promiscous mode not implemented by IrLAN!\n");
+                IRDA_WARNING("Promiscuous mode not implemented by IrLAN!\n");
         }
         else if ((dev->flags & IFF_ALLMULTI) || dev->mc_count > HW_MAX_ADDRS) {
                 /* Disable promiscuous mode, use normal mode. */
diff --git a/net/irda/irlap_frame.c b/net/irda/irlap_frame.c
index 4f3764546b2f..7c132d6342af 100644
--- a/net/irda/irlap_frame.c
+++ b/net/irda/irlap_frame.c
@@ -144,7 +144,7 @@ void irlap_send_snrm_frame(struct irlap_cb *self, struct qos_info *qos)
         frame->control = SNRM_CMD | PF_BIT;
 
         /*
-         *  If we are establishing a connection then insert QoS paramerters
+         *  If we are establishing a connection then insert QoS parameters
          */
         if (qos) {
                 skb_put(tx_skb, 9); /* 25 left */
diff --git a/net/irda/parameters.c b/net/irda/parameters.c
index 7183e9ef7996..722bbe044d9c 100644
--- a/net/irda/parameters.c
+++ b/net/irda/parameters.c
@@ -133,7 +133,7 @@ static int irda_insert_integer(void *self, __u8 *buf, int len, __u8 pi,
         int err;
 
         p.pi = pi;             /* In case handler needs to know */
-        p.pl = type & PV_MASK; /* The integer type codes the lenght as well */
+        p.pl = type & PV_MASK; /* The integer type codes the length as well */
         p.pv.i = 0;            /* Clear value */
 
         /* Call handler for this parameter */
@@ -142,7 +142,7 @@ static int irda_insert_integer(void *self, __u8 *buf, int len, __u8 pi,
                 return err;
 
         /*
-         * If parameter lenght is still 0, then (1) this is an any length
+         * If parameter length is still 0, then (1) this is an any length
          * integer, and (2) the handler function does not care which length
          * we choose to use, so we pick the one the gives the fewest bytes.
          */
@@ -206,11 +206,11 @@ static int irda_extract_integer(void *self, __u8 *buf, int len, __u8 pi,
 {
         irda_param_t p;
         int n = 0;
-        int extract_len;        /* Real lenght we extract */
+        int extract_len;        /* Real length we extract */
         int err;
 
         p.pi = pi;     /* In case handler needs to know */
-        p.pl = buf[1]; /* Extract lenght of value */
+        p.pl = buf[1]; /* Extract length of value */
         p.pv.i = 0;    /* Clear value */
         extract_len = p.pl;     /* Default : extract all */
 
@@ -297,7 +297,7 @@ static int irda_extract_string(void *self, __u8 *buf, int len, __u8 pi,
         IRDA_DEBUG(2, "%s()\n", __FUNCTION__);
 
         p.pi = pi;     /* In case handler needs to know */
-        p.pl = buf[1]; /* Extract lenght of value */
+        p.pl = buf[1]; /* Extract length of value */
 
         IRDA_DEBUG(2, "%s(), pi=%#x, pl=%d\n", __FUNCTION__,
                    p.pi, p.pl);
@@ -339,7 +339,7 @@ static int irda_extract_octseq(void *self, __u8 *buf, int len, __u8 pi,
         irda_param_t p;
 
         p.pi = pi;     /* In case handler needs to know */
-        p.pl = buf[1]; /* Extract lenght of value */
+        p.pl = buf[1]; /* Extract length of value */
 
         /* Check if buffer is long enough for parsing */
         if (len < (2+p.pl)) {
diff --git a/net/irda/wrapper.c b/net/irda/wrapper.c
index e71286768a48..c246983308b8 100644
--- a/net/irda/wrapper.c
+++ b/net/irda/wrapper.c
@@ -238,7 +238,7 @@ async_bump(struct net_device *dev,
         skb_reserve(newskb, 1);
 
         if(docopy) {
-                /* Copy data without CRC (lenght already checked) */
+                /* Copy data without CRC (length already checked) */
                 skb_copy_to_linear_data(newskb, rx_buff->data,
                                         rx_buff->len - 2);
                 /* Deliver this skb */
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 878039b9557d..26d5e63c4cc5 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2784,12 +2784,22 @@ static struct sadb_msg *pfkey_get_base_msg(struct sk_buff *skb, int *errp)
 
 static inline int aalg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
 {
-        return t->aalgos & (1 << d->desc.sadb_alg_id);
+        unsigned int id = d->desc.sadb_alg_id;
+
+        if (id >= sizeof(t->aalgos) * 8)
+                return 0;
+
+        return (t->aalgos >> id) & 1;
 }
 
 static inline int ealg_tmpl_set(struct xfrm_tmpl *t, struct xfrm_algo_desc *d)
 {
-        return t->ealgos & (1 << d->desc.sadb_alg_id);
+        unsigned int id = d->desc.sadb_alg_id;
+
+        if (id >= sizeof(t->ealgos) * 8)
+                return 0;
+
+        return (t->ealgos >> id) & 1;
 }
 
 static int count_ah_combs(struct xfrm_tmpl *t)
diff --git a/net/mac80211/ieee80211.c b/net/mac80211/ieee80211.c
index 505af1f067ab..6378850d8580 100644
--- a/net/mac80211/ieee80211.c
+++ b/net/mac80211/ieee80211.c
@@ -427,7 +427,6 @@ static const struct header_ops ieee80211_header_ops = {
 void ieee80211_if_setup(struct net_device *dev)
 {
         ether_setup(dev);
-        dev->header_ops = &ieee80211_header_ops;
         dev->hard_start_xmit = ieee80211_subif_start_xmit;
         dev->wireless_handlers = &ieee80211_iw_handler_def;
         dev->set_multicast_list = ieee80211_set_multicast_list;
diff --git a/net/mac80211/ieee80211_rate.c b/net/mac80211/ieee80211_rate.c
index 3260a4a0ecc5..c3f278393741 100644
--- a/net/mac80211/ieee80211_rate.c
+++ b/net/mac80211/ieee80211_rate.c
@@ -60,11 +60,11 @@ void ieee80211_rate_control_unregister(struct rate_control_ops *ops)
         list_for_each_entry(alg, &rate_ctrl_algs, list) {
                 if (alg->ops == ops) {
                         list_del(&alg->list);
+                        kfree(alg);
                         break;
                 }
         }
         mutex_unlock(&rate_ctrl_mutex);
-        kfree(alg);
 }
 EXPORT_SYMBOL(ieee80211_rate_control_unregister);
 
diff --git a/net/mac80211/ieee80211_sta.c b/net/mac80211/ieee80211_sta.c
index 16afd24d4f6b..bee8080f2249 100644
--- a/net/mac80211/ieee80211_sta.c
+++ b/net/mac80211/ieee80211_sta.c
@@ -808,12 +808,8 @@ static void ieee80211_associated(struct net_device *dev,
                 sta_info_put(sta);
         }
         if (disassoc) {
-                union iwreq_data wrqu;
-                memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
-                wrqu.ap_addr.sa_family = ARPHRD_ETHER;
-                wireless_send_event(dev, SIOCGIWAP, &wrqu, NULL);
-                mod_timer(&ifsta->timer, jiffies +
-                                      IEEE80211_MONITORING_INTERVAL + 30 * HZ);
+                ifsta->state = IEEE80211_DISABLED;
+                ieee80211_set_associated(dev, ifsta, 0);
         } else {
                 mod_timer(&ifsta->timer, jiffies +
                                       IEEE80211_MONITORING_INTERVAL);
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 8f8b5a48df38..515abffc4a09 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -187,7 +187,7 @@ static const struct sip_header_nfo ct_sip_hdrs[] = {
         }
 };
 
-/* get line lenght until first CR or LF seen. */
+/* get line length until first CR or LF seen. */
 int ct_sip_lnlen(const char *line, const char *limit)
 {
         const char *k = line;
@@ -236,7 +236,7 @@ static int digits_len(struct nf_conn *ct, const char *dptr,
         return len;
 }
 
-/* get digits lenght, skiping blank spaces. */
+/* get digits length, skipping blank spaces. */
 static int skp_digits_len(struct nf_conn *ct, const char *dptr,
                           const char *limit, int *shift)
 {
diff --git a/net/netlabel/netlabel_mgmt.c b/net/netlabel/netlabel_mgmt.c
index 56483377997a..9c41464d58d1 100644
--- a/net/netlabel/netlabel_mgmt.c
+++ b/net/netlabel/netlabel_mgmt.c
@@ -71,7 +71,7 @@ static const struct nla_policy netlbl_mgmt_genl_policy[NLBL_MGMT_A_MAX + 1] = {
 };
 
 /*
- * NetLabel Misc Managment Functions
+ * NetLabel Misc Management Functions
  */
 
 /**
diff --git a/net/netrom/nr_dev.c b/net/netrom/nr_dev.c
index 8c68da5ef0a1..6caf459665f2 100644
--- a/net/netrom/nr_dev.c
+++ b/net/netrom/nr_dev.c
@@ -56,7 +56,7 @@ int nr_rx_ip(struct sk_buff *skb, struct net_device *dev)
 
         /* Spoof incoming device */
         skb->dev      = dev;
-        skb_reset_mac_header(skb);
+        skb->mac_header = skb->network_header;
         skb_reset_network_header(skb);
         skb->pkt_type = PACKET_HOST;
 
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 55e7e4530f43..a6ad491e434b 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -160,7 +160,7 @@ struct hfsc_class
         u64     cl_vtoff;               /* inter-period cumulative vt offset */
         u64     cl_cvtmax;              /* max child's vt in the last period */
         u64     cl_cvtoff;              /* cumulative cvtmax of all periods */
-        u64     cl_pcvtoff;             /* parent's cvtoff at initalization
+        u64     cl_pcvtoff;             /* parent's cvtoff at initialization
                                            time */
 
         struct internal_sc cl_rsc;      /* internal real-time service curve */
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index f4876291bb5e..ed7c9e30ebc9 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -286,7 +286,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
 
         sctp_addto_chunk(retval, sizeof(ecap_param), &ecap_param);
 
-        /* Add the supported extensions paramter.  Be nice and add this
+        /* Add the supported extensions parameter.  Be nice and add this
          * fist before addiding the parameters for the extensions themselves
          */
         if (num_ext) {
@@ -2859,7 +2859,7 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
         chunk_len -= length;
 
         /* Skip the address parameter and store a pointer to the first
-         * asconf paramter.
+         * asconf parameter.
          */
         length = ntohs(addr_param->v4.param_hdr.length);
         asconf_param = (sctp_addip_param_t *)((void *)addr_param + length);
@@ -2868,7 +2868,7 @@ struct sctp_chunk *sctp_process_asconf(struct sctp_association *asoc,
         /* create an ASCONF_ACK chunk.
          * Based on the definitions of parameters, we know that the size of
          * ASCONF_ACK parameters are less than or equal to the twice of ASCONF
-         * paramters.
+         * parameters.
          */
         asconf_ack = sctp_make_asconf_ack(asoc, serial, chunk_len * 2);
         if (!asconf_ack)
@@ -3062,7 +3062,7 @@ int sctp_process_asconf_ack(struct sctp_association *asoc,
         asconf_len -= length;
 
         /* Skip the address parameter in the last asconf sent and store a
-         * pointer to the first asconf paramter.
+         * pointer to the first asconf parameter.
          */
         length = ntohs(addr_param->v4.param_hdr.length);
         asconf_param = (sctp_addip_param_t *)((void *)addr_param + length);
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index b91b16671c1e..26b846e11bfb 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -2162,7 +2162,7 @@ xfrm_audit_policy_add(struct xfrm_policy *xp, int result, u32 auid, u32 sid)
 
         if (audit_enabled == 0)
                 return;
-        audit_buf = xfrm_audit_start(sid, auid);
+        audit_buf = xfrm_audit_start(auid, sid);
         if (audit_buf == NULL)
                 return;
         audit_log_format(audit_buf, " op=SPD-add res=%u", result);
@@ -2179,7 +2179,7 @@ xfrm_audit_policy_delete(struct xfrm_policy *xp, int result, u32 auid, u32 sid)
 
         if (audit_enabled == 0)
                 return;
-        audit_buf = xfrm_audit_start(sid, auid);
+        audit_buf = xfrm_audit_start(auid, sid);
         if (audit_buf == NULL)
                 return;
         audit_log_format(audit_buf, " op=SPD-delete res=%u", result);
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 1af522bf12ca..ee1e69753932 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2033,7 +2033,7 @@ xfrm_audit_state_add(struct xfrm_state *x, int result, u32 auid, u32 sid)
 
         if (audit_enabled == 0)
                 return;
-        audit_buf = xfrm_audit_start(sid, auid);
+        audit_buf = xfrm_audit_start(auid, sid);
         if (audit_buf == NULL)
                 return;
         audit_log_format(audit_buf, " op=SAD-add res=%u",result);
@@ -2053,7 +2053,7 @@ xfrm_audit_state_delete(struct xfrm_state *x, int result, u32 auid, u32 sid)
 
         if (audit_enabled == 0)
                 return;
-        audit_buf = xfrm_audit_start(sid, auid);
+        audit_buf = xfrm_audit_start(auid, sid);
         if (audit_buf == NULL)
                 return;
         audit_log_format(audit_buf, " op=SAD-delete res=%u",result);