18 files changed, 187 insertions, 67 deletions

diff --git a/net/can/raw.c b/net/can/raw.c
index 201cbfc6b9ec..69877b8e7e9c 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -435,15 +435,13 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                         if (!filter)
                                 return -ENOMEM;
 
-                        err = copy_from_user(filter, optval, optlen);
-                        if (err) {
+                        if (copy_from_user(filter, optval, optlen)) {
                                 kfree(filter);
-                                return err;
+                                return -EFAULT;
                         }
                 } else if (count == 1) {
-                        err = copy_from_user(&sfilter, optval, optlen);
-                        if (err)
-                                return err;
+                        if (copy_from_user(&sfilter, optval, optlen))
+                                return -EFAULT;
                 }
 
                 lock_sock(sk);
@@ -493,9 +491,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                 if (optlen != sizeof(err_mask))
                         return -EINVAL;
 
-                err = copy_from_user(&err_mask, optval, optlen);
-                if (err)
-                        return err;
+                if (copy_from_user(&err_mask, optval, optlen))
+                        return -EFAULT;
 
                 err_mask &= CAN_ERR_MASK;
 
@@ -531,7 +528,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                 if (optlen != sizeof(ro->loopback))
                         return -EINVAL;
 
-                err = copy_from_user(&ro->loopback, optval, optlen);
+                if (copy_from_user(&ro->loopback, optval, optlen))
+                        return -EFAULT;
 
                 break;
 
@@ -539,7 +537,8 @@ static int raw_setsockopt(struct socket *sock, int level, int optname,
                 if (optlen != sizeof(ro->recv_own_msgs))
                         return -EINVAL;
 
-                err = copy_from_user(&ro->recv_own_msgs, optval, optlen);
+                if (copy_from_user(&ro->recv_own_msgs, optval, optlen))
+                        return -EFAULT;
 
                 break;
 
diff --git a/net/compat.c b/net/compat.c
index 80013fb69a61..01bf95d0832e 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -24,6 +24,8 @@
 
 #include <net/scm.h>
 #include <net/sock.h>
+#include <net/ip.h>
+#include <net/ipv6.h>
 #include <asm/uaccess.h>
 #include <net/compat.h>
 
@@ -521,6 +523,121 @@ asmlinkage long compat_sys_getsockopt(int fd, int level, int optname,
         }
         return err;
 }
+
+struct compat_group_req {
+        __u32                            gr_interface;
+        struct __kernel_sockaddr_storage gr_group
+                __attribute__ ((aligned(4)));
+} __attribute__ ((packed));
+
+struct compat_group_source_req {
+        __u32                            gsr_interface;
+        struct __kernel_sockaddr_storage gsr_group
+                __attribute__ ((aligned(4)));
+        struct __kernel_sockaddr_storage gsr_source
+                __attribute__ ((aligned(4)));
+} __attribute__ ((packed));
+
+struct compat_group_filter {
+        __u32                            gf_interface;
+        struct __kernel_sockaddr_storage gf_group
+                __attribute__ ((aligned(4)));
+        __u32                            gf_fmode;
+        __u32                            gf_numsrc;
+        struct __kernel_sockaddr_storage gf_slist[1]
+                __attribute__ ((aligned(4)));
+} __attribute__ ((packed));
+
+
+int compat_mc_setsockopt(struct sock *sock, int level, int optname,
+        char __user *optval, int optlen,
+        int (*setsockopt)(struct sock *,int,int,char __user *,int))
+{
+        char __user     *koptval = optval;
+        int             koptlen = optlen;
+
+        switch (optname) {
+        case MCAST_JOIN_GROUP:
+        case MCAST_LEAVE_GROUP:
+        {
+                struct compat_group_req __user *gr32 = (void *)optval;
+                struct group_req __user *kgr =
+                        compat_alloc_user_space(sizeof(struct group_req));
+                u32 interface;
+
+                if (!access_ok(VERIFY_READ, gr32, sizeof(*gr32)) ||
+                    !access_ok(VERIFY_WRITE, kgr, sizeof(struct group_req)) ||
+                    __get_user(interface, &gr32->gr_interface) ||
+                    __put_user(interface, &kgr->gr_interface) ||
+                    copy_in_user(&kgr->gr_group, &gr32->gr_group,
+                                sizeof(kgr->gr_group)))
+                        return -EFAULT;
+                koptval = (char __user *)kgr;
+                koptlen = sizeof(struct group_req);
+                break;
+        }
+        case MCAST_JOIN_SOURCE_GROUP:
+        case MCAST_LEAVE_SOURCE_GROUP:
+        case MCAST_BLOCK_SOURCE:
+        case MCAST_UNBLOCK_SOURCE:
+        {
+                struct compat_group_source_req __user *gsr32 = (void *)optval;
+                struct group_source_req *kgsr = compat_alloc_user_space(
+                        sizeof(struct group_source_req));
+                u32 interface;
+
+                if (!access_ok(VERIFY_READ, gsr32, sizeof(*gsr32)) ||
+                    !access_ok(VERIFY_WRITE, kgsr,
+                        sizeof(struct group_source_req)) ||
+                    __get_user(interface, &gsr32->gsr_interface) ||
+                    __put_user(interface, &kgsr->gsr_interface) ||
+                    copy_in_user(&kgsr->gsr_group, &gsr32->gsr_group,
+                                sizeof(kgsr->gsr_group)) ||
+                    copy_in_user(&kgsr->gsr_source, &gsr32->gsr_source,
+                                sizeof(kgsr->gsr_source)))
+                        return -EFAULT;
+                koptval = (char __user *)kgsr;
+                koptlen = sizeof(struct group_source_req);
+                break;
+        }
+        case MCAST_MSFILTER:
+        {
+                struct compat_group_filter __user *gf32 = (void *)optval;
+                struct group_filter *kgf;
+                u32 interface, fmode, numsrc;
+
+                if (!access_ok(VERIFY_READ, gf32, sizeof(*gf32)) ||
+                    __get_user(interface, &gf32->gf_interface) ||
+                    __get_user(fmode, &gf32->gf_fmode) ||
+                    __get_user(numsrc, &gf32->gf_numsrc))
+                        return -EFAULT;
+                koptlen = optlen + sizeof(struct group_filter) -
+                                sizeof(struct compat_group_filter);
+                if (koptlen < GROUP_FILTER_SIZE(numsrc))
+                        return -EINVAL;
+                kgf = compat_alloc_user_space(koptlen);
+                if (!access_ok(VERIFY_WRITE, kgf, koptlen) ||
+                    __put_user(interface, &kgf->gf_interface) ||
+                    __put_user(fmode, &kgf->gf_fmode) ||
+                    __put_user(numsrc, &kgf->gf_numsrc) ||
+                    copy_in_user(&kgf->gf_group, &gf32->gf_group,
+                                sizeof(kgf->gf_group)) ||
+                    (numsrc && copy_in_user(&kgf->gf_slist, &gf32->gf_slist,
+                                numsrc * sizeof(kgf->gf_slist[0]))))
+                        return -EFAULT;
+                koptval = (char __user *)kgf;
+                break;
+        }
+
+        default:
+                break;
+        }
+        return setsockopt(sock, level, optname, koptval, koptlen);
+}
+
+EXPORT_SYMBOL(compat_mc_setsockopt);
+
+
 /* Argument list sizes for compat_sys_socketcall */
 #define AL(x) ((x) * sizeof(u32))
 static unsigned char nas[18]={AL(0),AL(3),AL(3),AL(3),AL(2),AL(3),
diff --git a/net/core/dev.c b/net/core/dev.c
index e1df1ab3e04a..ed49da592051 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1524,7 +1524,7 @@ static int dev_gso_segment(struct sk_buff *skb)
         if (!segs)
                 return 0;
 
-        if (unlikely(IS_ERR(segs)))
+        if (IS_ERR(segs))
                 return PTR_ERR(segs);
 
         skb->next = segs;
diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
index f2b5270efdaa..24eca23c2db3 100644
--- a/net/ipv4/af_inet.c
+++ b/net/ipv4/af_inet.c
@@ -1234,7 +1234,7 @@ static struct sk_buff *inet_gso_segment(struct sk_buff *skb, int features)
                 segs = ops->gso_segment(skb, features);
         rcu_read_unlock();
 
-        if (!segs || unlikely(IS_ERR(segs)))
+        if (!segs || IS_ERR(segs))
                 goto out;
 
         skb = segs;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index d8adfd4972e2..4d8d95404f45 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -36,6 +36,7 @@
 #include <linux/mroute.h>
 #include <net/route.h>
 #include <net/xfrm.h>
+#include <net/compat.h>
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 #include <net/transp_v6.h>
 #endif
@@ -923,6 +924,10 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname,
         if (level != SOL_IP)
                 return -ENOPROTOOPT;
 
+        if (optname >= MCAST_JOIN_GROUP && optname <= MCAST_MSFILTER)
+                return compat_mc_setsockopt(sk, level, optname, optval, optlen,
+                        ip_setsockopt);
+
         err = do_ip_setsockopt(sk, level, optname, optval, optlen);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index ac9b8482f702..0298f80681f2 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -4925,8 +4925,7 @@ step5:
         tcp_data_snd_check(sk);
         tcp_ack_snd_check(sk);
 
-        if (tcp_defer_accept_check(sk))
-                return -1;
+        tcp_defer_accept_check(sk);
         return 0;
 
 csum_error:
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index b2c9becc02e8..42814a2ec9d7 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -167,7 +167,7 @@ config IPV6_SIT
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
           encapsulating protocol. This driver implements encapsulation of IPv6
-          into IPv4 packets. This is useful if you want to connect to IPv6
+          into IPv4 packets. This is useful if you want to connect two IPv6
           networks over an IPv4-only path.
 
           Saying M here will produce a module called sit.ko. If unsure, say Y.
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c8c6e33d1163..2de3c464fe75 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -358,7 +358,7 @@ static int pim6_rcv(struct sk_buff *skb)
         if (pim->type != ((PIM_VERSION << 4) | PIM_REGISTER) ||
             (pim->flags & PIM_NULL_REGISTER) ||
             (ip_compute_csum((void *)pim, sizeof(*pim)) != 0 &&
-             (u16)csum_fold(skb_checksum(skb, 0, skb->len, 0))))
+             csum_fold(skb_checksum(skb, 0, skb->len, 0))))
                 goto drop;
 
         /* check if the inner packet is destined to mcast group */
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 06de9d0e1f6b..db6fdc1498aa 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -52,6 +52,7 @@
 #include <net/udp.h>
 #include <net/udplite.h>
 #include <net/xfrm.h>
+#include <net/compat.h>
 
 #include <asm/uaccess.h>
 
@@ -779,6 +780,10 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
         if (level != SOL_IPV6)
                 return -ENOPROTOOPT;
 
+        if (optname >= MCAST_JOIN_GROUP && optname <= MCAST_MSFILTER)
+                return compat_mc_setsockopt(sk, level, optname, optval, optlen,
+                        ipv6_setsockopt);
+
         err = do_ipv6_setsockopt(sk, level, optname, optval, optlen);
 #ifdef CONFIG_NETFILTER
         /* we need to exclude all possible ENOPROTOOPTs except default case */
diff --git a/net/irda/irnet/irnet_irda.c b/net/irda/irnet/irnet_irda.c
index a4f1439ffdd8..75497e55927d 100644
--- a/net/irda/irnet/irnet_irda.c
+++ b/net/irda/irnet/irnet_irda.c
@@ -9,6 +9,7 @@
  */
 
 #include "irnet_irda.h"         /* Private header */
+#include <linux/seq_file.h>
 
 /*
  * PPP disconnect work: we need to make sure we're in
@@ -1717,34 +1718,23 @@ irnet_expiry_indication(discinfo_t *	expiry,
  */
 
 #ifdef CONFIG_PROC_FS
-/*------------------------------------------------------------------*/
-/*
- * Function irnet_proc_read (buf, start, offset, len, unused)
- *
- *    Give some info to the /proc file system
- */
 static int
-irnet_proc_read(char *  buf,
-                char ** start,
-                off_t   offset,
-                int     len)
+irnet_proc_show(struct seq_file *m, void *v)
 {
   irnet_socket *        self;
   char *                state;
   int                   i = 0;
 
-  len = 0;
-
   /* Get the IrNET server information... */
-  len += sprintf(buf+len, "IrNET server - ");
-  len += sprintf(buf+len, "IrDA state: %s, ",
+  seq_printf(m, "IrNET server - ");
+  seq_printf(m, "IrDA state: %s, ",
                  (irnet_server.running ? "running" : "dead"));
-  len += sprintf(buf+len, "stsap_sel: %02x, ", irnet_server.s.stsap_sel);
-  len += sprintf(buf+len, "dtsap_sel: %02x\n", irnet_server.s.dtsap_sel);
+  seq_printf(m, "stsap_sel: %02x, ", irnet_server.s.stsap_sel);
+  seq_printf(m, "dtsap_sel: %02x\n", irnet_server.s.dtsap_sel);
 
   /* Do we need to continue ? */
   if(!irnet_server.running)
-    return len;
+    return 0;
 
   /* Protect access to the instance list */
   spin_lock_bh(&irnet_server.spinlock);
@@ -1754,23 +1744,23 @@ irnet_proc_read(char *	buf,
   while(self != NULL)
     {
       /* Start printing info about the socket. */
-      len += sprintf(buf+len, "\nIrNET socket %d - ", i++);
+      seq_printf(m, "\nIrNET socket %d - ", i++);
 
       /* First, get the requested configuration */
-      len += sprintf(buf+len, "Requested IrDA name: \"%s\", ", self->rname);
-      len += sprintf(buf+len, "daddr: %08x, ", self->rdaddr);
-      len += sprintf(buf+len, "saddr: %08x\n", self->rsaddr);
+      seq_printf(m, "Requested IrDA name: \"%s\", ", self->rname);
+      seq_printf(m, "daddr: %08x, ", self->rdaddr);
+      seq_printf(m, "saddr: %08x\n", self->rsaddr);
 
       /* Second, get all the PPP info */
-      len += sprintf(buf+len, " PPP state: %s",
+      seq_printf(m, "   PPP state: %s",
                  (self->ppp_open ? "registered" : "unregistered"));
       if(self->ppp_open)
         {
-          len += sprintf(buf+len, ", unit: ppp%d",
+          seq_printf(m, ", unit: ppp%d",
                          ppp_unit_number(&self->chan));
-          len += sprintf(buf+len, ", channel: %d",
+          seq_printf(m, ", channel: %d",
                          ppp_channel_index(&self->chan));
-          len += sprintf(buf+len, ", mru: %d",
+          seq_printf(m, ", mru: %d",
                          self->mru);
           /* Maybe add self->flags ? Later... */
         }
@@ -1789,10 +1779,10 @@ irnet_proc_read(char *	buf,
               state = "weird";
             else
               state = "idle";
-      len += sprintf(buf+len, "\n       IrDA state: %s, ", state);
-      len += sprintf(buf+len, "daddr: %08x, ", self->daddr);
-      len += sprintf(buf+len, "stsap_sel: %02x, ", self->stsap_sel);
-      len += sprintf(buf+len, "dtsap_sel: %02x\n", self->dtsap_sel);
+      seq_printf(m, "\n IrDA state: %s, ", state);
+      seq_printf(m, "daddr: %08x, ", self->daddr);
+      seq_printf(m, "stsap_sel: %02x, ", self->stsap_sel);
+      seq_printf(m, "dtsap_sel: %02x\n", self->dtsap_sel);
 
       /* Next socket, please... */
       self = (irnet_socket *) hashbin_get_next(irnet_server.list);
@@ -1801,8 +1791,21 @@ irnet_proc_read(char *	buf,
   /* Spin lock end */
   spin_unlock_bh(&irnet_server.spinlock);
 
-  return len;
+  return 0;
 }
+
+static int irnet_proc_open(struct inode *inode, struct file *file)
+{
+        return single_open(file, irnet_proc_show, NULL);
+}
+
+static const struct file_operations irnet_proc_fops = {
+        .owner          = THIS_MODULE,
+        .open           = irnet_proc_open,
+        .read           = seq_read,
+        .llseek         = seq_lseek,
+        .release        = single_release,
+};
 #endif /* PROC_FS */
 
 
@@ -1841,7 +1844,7 @@ irda_irnet_init(void)
 
 #ifdef CONFIG_PROC_FS
   /* Add a /proc file for irnet infos */
-  create_proc_info_entry("irnet", 0, proc_irda, irnet_proc_read);
+  proc_create("irnet", 0, proc_irda, &irnet_proc_fops);
 #endif /* CONFIG_PROC_FS */
 
   /* Setup the IrNET server */
diff --git a/net/irda/irnet/irnet_irda.h b/net/irda/irnet/irnet_irda.h
index 0ba92d0d5204..3e408952a3f1 100644
--- a/net/irda/irnet/irnet_irda.h
+++ b/net/irda/irnet/irnet_irda.h
@@ -159,14 +159,6 @@ static void
                                 DISCOVERY_MODE,
                                 void *);
 #endif
-/* -------------------------- PROC ENTRY -------------------------- */
-#ifdef CONFIG_PROC_FS
-static int
-        irnet_proc_read(char *,
-                        char **,
-                        off_t,
-                        int);
-#endif /* CONFIG_PROC_FS */
 
 /**************************** VARIABLES ****************************/
 
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index 520a5180a4f6..a24b459dd45a 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -73,7 +73,9 @@ config MAC80211_MESH
 
 config MAC80211_LEDS
         bool "Enable LED triggers"
-        depends on MAC80211 && LEDS_TRIGGERS
+        depends on MAC80211
+        select NEW_LEDS
+        select LEDS_TRIGGERS
         ---help---
           This option enables a few LED triggers for different
           packet receive/transmit events.
diff --git a/net/netfilter/nf_queue.c b/net/netfilter/nf_queue.c
index bbd26893c0c4..582ec3efc8a5 100644
--- a/net/netfilter/nf_queue.c
+++ b/net/netfilter/nf_queue.c
@@ -214,7 +214,7 @@ int nf_queue(struct sk_buff *skb,
 
         segs = skb_gso_segment(skb, 0);
         kfree_skb(skb);
-        if (unlikely(IS_ERR(segs)))
+        if (IS_ERR(segs))
                 return 1;
 
         do {
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 75d748eee0eb..e1770f7ba0b3 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -445,7 +445,7 @@ EXPORT_SYMBOL_GPL(xprt_wake_pending_tasks);
 /**
  * xprt_wait_for_buffer_space - wait for transport output buffer to clear
  * @task: task to be put to sleep
- *
+ * @action: function pointer to be executed after wait
  */
 void xprt_wait_for_buffer_space(struct rpc_task *task, rpc_action action)
 {
diff --git a/net/tipc/msg.h b/net/tipc/msg.h
index 6ad070d87702..ad487e8abcc2 100644
--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
@@ -70,10 +70,9 @@ static inline void msg_set_bits(struct tipc_msg *m, u32 w,
                                 u32 pos, u32 mask, u32 val)
 {
         val = (val & mask) << pos;
-        val = htonl(val);
-        mask = htonl(mask << pos);
-        m->hdr[w] &= ~mask;
-        m->hdr[w] |= val;
+        mask = mask << pos;
+        m->hdr[w] &= ~htonl(mask);
+        m->hdr[w] |= htonl(val);
 }
 
 /*
diff --git a/net/xfrm/xfrm_algo.c b/net/xfrm/xfrm_algo.c
index 8aa6440d689f..ac765dd9c7f5 100644
--- a/net/xfrm/xfrm_algo.c
+++ b/net/xfrm/xfrm_algo.c
@@ -129,8 +129,7 @@ static struct xfrm_algo_desc aead_list[] = {
 
 static struct xfrm_algo_desc aalg_list[] = {
 {
-        .name = "hmac(digest_null)",
-        .compat = "digest_null",
+        .name = "digest_null",
 
         .uinfo = {
                 .auth = {
diff --git a/net/xfrm/xfrm_output.c b/net/xfrm/xfrm_output.c
index 2519129c6d21..09cd9c0c2d80 100644
--- a/net/xfrm/xfrm_output.c
+++ b/net/xfrm/xfrm_output.c
@@ -150,7 +150,7 @@ static int xfrm_output_gso(struct sk_buff *skb)
 
         segs = skb_gso_segment(skb, 0);
         kfree_skb(skb);
-        if (unlikely(IS_ERR(segs)))
+        if (IS_ERR(segs))
                 return PTR_ERR(segs);
 
         do {
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index c3f5f70934ec..72fddafd891a 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -2115,7 +2115,7 @@ static void xfrm_audit_helper_pktinfo(struct sk_buff *skb, u16 family,
                 iph6 = ipv6_hdr(skb);
                 audit_log_format(audit_buf,
                                  " src=" NIP6_FMT " dst=" NIP6_FMT
-                                 " flowlbl=0x%x%x%x",
+                                 " flowlbl=0x%x%02x%02x",
                                  NIP6(iph6->saddr),
                                  NIP6(iph6->daddr),
                                  iph6->flow_lbl[0] & 0x0f,