30 files changed, 101 insertions, 90 deletions

diff --git a/net/802/fddi.c b/net/802/fddi.c
index f9a31a9f70f1..ebcf4830d6f1 100644
--- a/net/802/fddi.c
+++ b/net/802/fddi.c
@@ -10,7 +10,7 @@
  * Authors:     Lawrence V. Stefani, <stefani@lkg.dec.com>
  *
  *              fddi.c is based on previous eth.c and tr.c work by
- *                      Ross Biro, <bir7@leland.Stanford.Edu>
+ *                      Ross Biro
  *                      Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                      Mark Evans, <evansmp@uhura.aston.ac.uk>
  *                      Florian La Roche, <rzsfl@rz.uni-sb.de>
diff --git a/net/802/hippi.c b/net/802/hippi.c
index 4eb135c0afbb..051e8af56a77 100644
--- a/net/802/hippi.c
+++ b/net/802/hippi.c
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)hippi.c     1.0.0   05/29/97
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Florian  La Roche, <rzsfl@rz.uni-sb.de>
diff --git a/net/appletalk/dev.c b/net/appletalk/dev.c
index 76598445d84b..1237e208e246 100644
--- a/net/appletalk/dev.c
+++ b/net/appletalk/dev.c
@@ -19,7 +19,7 @@ static int ltalk_mac_addr(struct net_device *dev, void *addr)
         return -EINVAL;
 }
 
-void ltalk_setup(struct net_device *dev)
+static void ltalk_setup(struct net_device *dev)
 {
         /* Fill in the fields of the device structure with localtalk-generic values. */
         
@@ -40,4 +40,22 @@ void ltalk_setup(struct net_device *dev)
 
         dev->flags              = IFF_BROADCAST|IFF_MULTICAST|IFF_NOARP;
 }
-EXPORT_SYMBOL(ltalk_setup);
+
+/**
+ * alloc_ltalkdev - Allocates and sets up an localtalk device
+ * @sizeof_priv: Size of additional driver-private structure to be allocated
+ *      for this localtalk device
+ *
+ * Fill in the fields of the device structure with localtalk-generic
+ * values. Basically does everything except registering the device.
+ *
+ * Constructs a new net device, complete with a private data area of
+ * size @sizeof_priv.  A 32-byte (not bit) alignment is enforced for
+ * this private data area.
+ */
+
+struct net_device *alloc_ltalkdev(int sizeof_priv)
+{
+        return alloc_netdev(sizeof_priv, "lt%d", ltalk_setup);
+}
+EXPORT_SYMBOL(alloc_ltalkdev);
diff --git a/net/core/dev.c b/net/core/dev.c
index f5f005846fe1..d4d9e2680adb 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7,7 +7,7 @@
  *              2 of the License, or (at your option) any later version.
  *
  *      Derived from the non IP parts of dev.c 1.0.19
- *              Authors:        Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Authors:        Ross Biro
  *                              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *
diff --git a/net/core/sock.c b/net/core/sock.c
index 98171ddd7e7d..96e00b08698f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -9,7 +9,7 @@
  *
  * Version:     $Id: sock.c,v 1.117 2002/02/01 22:01:03 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Florian La Roche, <flla@stud.uni-sb.de>
  *              Alan Cox, <A.Cox@swansea.ac.uk>
@@ -635,7 +635,11 @@ struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
                 if (zero_it) {
                         memset(sk, 0, prot->obj_size);
                         sk->sk_family = family;
-                        sk->sk_prot = prot;
+                        /*
+                         * See comment in struct sock definition to understand
+                         * why we need sk_prot_creator -acme
+                         */
+                        sk->sk_prot = sk->sk_prot_creator = prot;
                         sock_lock_init(sk);
                 }
                 
@@ -654,7 +658,7 @@ struct sock *sk_alloc(int family, int priority, struct proto *prot, int zero_it)
 void sk_free(struct sock *sk)
 {
         struct sk_filter *filter;
-        struct module *owner = sk->sk_prot->owner;
+        struct module *owner = sk->sk_prot_creator->owner;
 
         if (sk->sk_destruct)
                 sk->sk_destruct(sk);
@@ -672,8 +676,8 @@ void sk_free(struct sock *sk)
                        __FUNCTION__, atomic_read(&sk->sk_omem_alloc));
 
         security_sk_free(sk);
-        if (sk->sk_prot->slab != NULL)
-                kmem_cache_free(sk->sk_prot->slab, sk);
+        if (sk->sk_prot_creator->slab != NULL)
+                kmem_cache_free(sk->sk_prot_creator->slab, sk);
         else
                 kfree(sk);
         module_put(owner);
diff --git a/net/decnet/dn_dev.c b/net/decnet/dn_dev.c
index e6e23eb14428..ee7bf46eb78a 100644
--- a/net/decnet/dn_dev.c
+++ b/net/decnet/dn_dev.c
@@ -1426,7 +1426,7 @@ static struct rtnetlink_link dnet_rtnetlink_table[RTM_NR_MSGTYPES] =
         [RTM_GETRULE  - RTM_BASE] = { .dumpit   = dn_fib_dump_rules,    },
 #else
         [RTM_GETROUTE - RTM_BASE] = { .doit     = dn_cache_getroute,
-                                      .dumpit   = dn_cache_dump,        
+                                      .dumpit   = dn_cache_dump,        },
 #endif
 
 };
diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 16c4234cbe12..6617ea47d365 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c
@@ -7,7 +7,7 @@
  *
  * Version:     @(#)eth.c       1.0.7   05/25/93
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Florian  La Roche, <rzsfl@rz.uni-sb.de>
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index cdad47642ae7..b3cb49ce5fad 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: af_inet.c,v 1.137 2002/02/01 22:01:03 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Florian La Roche, <flla@stud.uni-sb.de>
  *              Alan Cox, <A.Cox@swansea.ac.uk>
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index abbc6d5c183e..3cc96730c4ed 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -9,7 +9,7 @@
  *              2 of the License, or (at your option) any later version.
  *
  *      Derived from the IP parts of dev.c 1.0.19
- *              Authors:        Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Authors:        Ross Biro
  *                              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *                              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index a0d0833034be..4e47a2658c7c 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: ip_input.c,v 1.55 2002/01/12 07:39:45 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Donald Becker, <becker@super.org>
  *              Alan Cox, <Alan.Cox@linux.org>
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 24fe3e00b42b..760dc8238d65 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: ip_output.c,v 1.100 2002/02/01 22:01:03 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Donald Becker, <becker@super.org>
  *              Alan Cox, <Alan.Cox@linux.org>
@@ -490,6 +490,14 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
                                 goto slow_path;
+
+                        BUG_ON(frag->sk);
+                        if (skb->sk) {
+                                sock_hold(skb->sk);
+                                frag->sk = skb->sk;
+                                frag->destructor = sock_wfree;
+                                skb->truesize -= frag->truesize;
+                        }
                 }
 
                 /* Everything is OK. Generate! */
diff --git a/net/ipv4/ipvs/ip_vs_xmit.c b/net/ipv4/ipvs/ip_vs_xmit.c
index faa6176bbeb1..de21da00057f 100644
--- a/net/ipv4/ipvs/ip_vs_xmit.c
+++ b/net/ipv4/ipvs/ip_vs_xmit.c
@@ -508,7 +508,6 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                         rc = NF_ACCEPT;
                 /* do not touch skb anymore */
                 atomic_inc(&cp->in_pkts);
-                __ip_vs_conn_put(cp);
                 goto out;
         }
 
diff --git a/net/ipv4/multipath_wrandom.c b/net/ipv4/multipath_wrandom.c
index 10b23e1bece6..c3d2ca1a6781 100644
--- a/net/ipv4/multipath_wrandom.c
+++ b/net/ipv4/multipath_wrandom.c
@@ -172,7 +172,7 @@ static void wrandom_select_route(const struct flowi *flp,
                     multipath_comparekeys(&rt->fl, flp)) {
                         struct multipath_candidate* mpc =
                                 (struct multipath_candidate*)
-                                kmalloc(size_mpc, GFP_KERNEL);
+                                kmalloc(size_mpc, GFP_ATOMIC);
 
                         if (!mpc)
                                 return;
@@ -244,7 +244,7 @@ static void wrandom_set_nhinfo(__u32 network,
         if (!target_route) {
                 const size_t size_rt = sizeof(struct multipath_route);
                 target_route = (struct multipath_route *)
-                        kmalloc(size_rt, GFP_KERNEL);
+                        kmalloc(size_rt, GFP_ATOMIC);
 
                 target_route->gw = nh->nh_gw;
                 target_route->oif = nh->nh_oif;
@@ -265,7 +265,7 @@ static void wrandom_set_nhinfo(__u32 network,
         if (!target_dest) {
                 const size_t size_dst = sizeof(struct multipath_dest);
                 target_dest = (struct multipath_dest*)
-                        kmalloc(size_dst, GFP_KERNEL);
+                        kmalloc(size_dst, GFP_ATOMIC);
 
                 target_dest->nh_info = nh;
                 target_dest->network = network;
diff --git a/net/ipv4/netfilter/ip_conntrack_core.c b/net/ipv4/netfilter/ip_conntrack_core.c
index 28d9425d5c39..09e824622977 100644
--- a/net/ipv4/netfilter/ip_conntrack_core.c
+++ b/net/ipv4/netfilter/ip_conntrack_core.c
@@ -940,37 +940,25 @@ void ip_ct_refresh_acct(struct ip_conntrack *ct,
 struct sk_buff *
 ip_ct_gather_frags(struct sk_buff *skb, u_int32_t user)
 {
-        struct sock *sk = skb->sk;
 #ifdef CONFIG_NETFILTER_DEBUG
         unsigned int olddebug = skb->nf_debug;
 #endif
 
-        if (sk) {
-                sock_hold(sk);
-                skb_orphan(skb);
-        }
+        skb_orphan(skb);
 
         local_bh_disable(); 
         skb = ip_defrag(skb, user);
         local_bh_enable();
 
-        if (!skb) {
-                if (sk)
-                        sock_put(sk);
-                return skb;
-        }
-
-        if (sk) {
-                skb_set_owner_w(skb, sk);
-                sock_put(sk);
-        }
-
-        ip_send_check(skb->nh.iph);
-        skb->nfcache |= NFC_ALTERED;
+        if (skb) {
+                ip_send_check(skb->nh.iph);
+                skb->nfcache |= NFC_ALTERED;
 #ifdef CONFIG_NETFILTER_DEBUG
-        /* Packet path as if nothing had happened. */
-        skb->nf_debug = olddebug;
+                /* Packet path as if nothing had happened. */
+                skb->nf_debug = olddebug;
 #endif
+        }
+
         return skb;
 }
 
diff --git a/net/ipv4/protocol.c b/net/ipv4/protocol.c
index 90a587cacaa4..0db405a869f2 100644
--- a/net/ipv4/protocol.c
+++ b/net/ipv4/protocol.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: protocol.c,v 1.14 2001/05/18 02:25:49 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  * Fixes:
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 93624a32eb9a..5b1ec586bae6 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: raw.c,v 1.64 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  * Fixes:
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 199311746932..a682d28e247b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: route.c,v 1.103 2002/01/12 07:44:09 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  *              Linus Torvalds, <Linus.Torvalds@helsinki.fi>
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 5cff56af7855..a037bafcba3c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp.c,v 1.216 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 6984042c0927..79835a67a274 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp_input.c,v 1.243 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index fd70509f0d53..eea1a17a9ac2 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp_minisocks.c,v 1.15 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a12df6979ffd..fa24e7ae1f40 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp_output.c,v 1.146 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 85b279f1e935..799ebe061e2c 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: tcp_timer.c,v 1.88 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Mark Evans, <evansmp@uhura.aston.ac.uk>
  *              Corey Minyard <wf-rch!minyard@relay.EU.net>
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 8a213238f287..4a6952e3fee9 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: udp.c,v 1.102 2002/02/01 22:01:04 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Arnt Gulbrandsen, <agulbra@nvg.unit.no>
  *              Alan Cox, <Alan.Cox@linux.org>
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0f0711417c9d..b78a53586804 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -552,13 +552,17 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                             skb_headroom(frag) < hlen)
                             goto slow_path;
 
-                        /* Correct socket ownership. */
-                        if (frag->sk == NULL)
-                                goto slow_path;
-
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
                                 goto slow_path;
+
+                        BUG_ON(frag->sk);
+                        if (skb->sk) {
+                                sock_hold(skb->sk);
+                                frag->sk = skb->sk;
+                                frag->destructor = sock_wfree;
+                                skb->truesize -= frag->truesize;
+                        }
                 }
 
                 err = 0;
@@ -1116,12 +1120,10 @@ int ip6_push_pending_frames(struct sock *sk)
                 tail_skb = &(tmp_skb->next);
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
-#if 0 /* Logically correct, but useless work, ip_fragment() will have to undo */
                 skb->truesize += tmp_skb->truesize;
                 __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
-#endif
         }
 
         ipv6_addr_copy(final_dst, &fl->fl6_dst);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 733bf52cef3e..e41ce458c2a9 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -735,11 +735,15 @@ static inline int do_one_broadcast(struct sock *sk,
 
         sock_hold(sk);
         if (p->skb2 == NULL) {
-                if (atomic_read(&p->skb->users) != 1) {
+                if (skb_shared(p->skb)) {
                         p->skb2 = skb_clone(p->skb, p->allocation);
                 } else {
-                        p->skb2 = p->skb;
-                        atomic_inc(&p->skb->users);
+                        p->skb2 = skb_get(p->skb);
+                        /*
+                         * skb ownership may have been set when
+                         * delivered to a previous socket.
+                         */
+                        skb_orphan(p->skb2);
                 }
         }
         if (p->skb2 == NULL) {
@@ -785,11 +789,12 @@ int netlink_broadcast(struct sock *ssk, struct sk_buff *skb, u32 pid,
         sk_for_each_bound(sk, node, &nl_table[ssk->sk_protocol].mc_list)
                 do_one_broadcast(sk, &info);
 
+        kfree_skb(skb);
+
         netlink_unlock_table();
 
         if (info.skb2)
                 kfree_skb(info.skb2);
-        kfree_skb(skb);
 
         if (info.delivered) {
                 if (info.congested && (allocation & __GFP_WAIT))
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 64acea0adaae..0269616e75a1 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -7,7 +7,7 @@
  *
  * Version:     $Id: af_packet.c,v 1.61 2002/02/08 03:57:19 davem Exp $
  *
- * Authors:     Ross Biro, <bir7@leland.Stanford.Edu>
+ * Authors:     Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *              Alan Cox, <gw4pts@gw4pts.ampr.org>
  *
diff --git a/net/socket.c b/net/socket.c
index 2cd44990d8d3..cec0cb38b9ce 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -4,7 +4,7 @@
  * Version:     @(#)socket.c    1.1.93  18/02/95
  *
  * Authors:     Orest Zborowski, <obz@Kodak.COM>
- *              Ross Biro, <bir7@leland.Stanford.Edu>
+ *              Ross Biro
  *              Fred N. van Kempen, <waltje@uWalt.NL.Mugnet.ORG>
  *
  * Fixes:
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index c478fc8db776..c420eba4876b 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -770,33 +770,12 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                 err = path_lookup(sunaddr->sun_path, LOOKUP_PARENT, &nd);
                 if (err)
                         goto out_mknod_parent;
-                /*
-                 * Yucky last component or no last component at all?
-                 * (foo/., foo/.., /////)
-                 */
-                err = -EEXIST;
-                if (nd.last_type != LAST_NORM)
-                        goto out_mknod;
-                /*
-                 * Lock the directory.
-                 */
-                down(&nd.dentry->d_inode->i_sem);
-                /*
-                 * Do the final lookup.
-                 */
-                dentry = lookup_hash(&nd.last, nd.dentry);
+
+                dentry = lookup_create(&nd, 0);
                 err = PTR_ERR(dentry);
                 if (IS_ERR(dentry))
                         goto out_mknod_unlock;
-                err = -ENOENT;
-                /*
-                 * Special case - lookup gave negative, but... we had foo/bar/
-                 * From the vfs_mknod() POV we just have a negative dentry -
-                 * all is fine. Let's be bastards - you had / on the end, you've
-                 * been asking for (non-existent) directory. -ENOENT for you.
-                 */
-                if (nd.last.name[nd.last.len] && !dentry->d_inode)
-                        goto out_mknod_dput;
+
                 /*
                  * All right, let's create it.
                  */
@@ -845,7 +824,6 @@ out_mknod_dput:
         dput(dentry);
 out_mknod_unlock:
         up(&nd.dentry->d_inode->i_sem);
-out_mknod:
         path_release(&nd);
 out_mknod_parent:
         if (err==-EEXIST)
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 080aae243ce0..2f4531fcaca2 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -698,7 +698,7 @@ int skb_cow_data(struct sk_buff *skb, int tailbits, struct sk_buff **trailer)
                                 return -ENOMEM;
 
                         if (skb1->sk)
-                                skb_set_owner_w(skb, skb1->sk);
+                                skb_set_owner_w(skb2, skb1->sk);
 
                         /* Looking around. Are we still alive?
                          * OK, link new skb, drop old one */
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 5ddda2c98af9..97509011c274 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -34,14 +34,21 @@ static int verify_one_alg(struct rtattr **xfrma, enum xfrm_attr_type_t type)
 {
         struct rtattr *rt = xfrma[type - 1];
         struct xfrm_algo *algp;
+        int len;
 
         if (!rt)
                 return 0;
 
-        if ((rt->rta_len - sizeof(*rt)) < sizeof(*algp))
+        len = (rt->rta_len - sizeof(*rt)) - sizeof(*algp);
+        if (len < 0)
                 return -EINVAL;
 
         algp = RTA_DATA(rt);
+
+        len -= (algp->alg_key_len + 7U) / 8; 
+        if (len < 0)
+                return -EINVAL;
+
         switch (type) {
         case XFRMA_ALG_AUTH:
                 if (!algp->alg_key_len &&
@@ -162,6 +169,7 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
         struct rtattr *rta = u_arg;
         struct xfrm_algo *p, *ualg;
         struct xfrm_algo_desc *algo;
+        int len;
 
         if (!rta)
                 return 0;
@@ -173,11 +181,12 @@ static int attach_one_algo(struct xfrm_algo **algpp, u8 *props,
                 return -ENOSYS;
         *props = algo->desc.sadb_alg_id;
 
-        p = kmalloc(sizeof(*ualg) + ualg->alg_key_len, GFP_KERNEL);
+        len = sizeof(*ualg) + (ualg->alg_key_len + 7U) / 8;
+        p = kmalloc(len, GFP_KERNEL);
         if (!p)
                 return -ENOMEM;
 
-        memcpy(p, ualg, sizeof(*ualg) + ualg->alg_key_len);
+        memcpy(p, ualg, len);
         *algpp = p;
         return 0;
 }