aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/9p/trans_fd.c4
-rw-r--r--net/bluetooth/l2cap.c20
-rw-r--r--net/bridge/br_fdb.c4
-rw-r--r--net/bridge/br_sysfs_br.c6
-rw-r--r--net/bridge/netfilter/ebt_stp.c4
-rw-r--r--net/can/af_can.c8
-rw-r--r--net/core/dev.c7
-rw-r--r--net/core/pktgen.c5
-rw-r--r--net/dcb/dcbnl.c4
-rw-r--r--net/decnet/dn_table.c5
-rw-r--r--net/ipv4/igmp.c5
-rw-r--r--net/ipv4/netfilter.c8
-rw-r--r--net/irda/irnet/irnet_irda.c4
-rw-r--r--net/mac80211/agg-rx.c6
-rw-r--r--net/mac80211/main.c4
-rw-r--r--net/mac80211/mesh.c4
-rw-r--r--net/mac80211/mesh_hwmp.c15
-rw-r--r--net/mac80211/rx.c4
-rw-r--r--net/mac80211/tx.c9
-rw-r--r--net/netfilter/nf_conntrack_expect.c6
-rw-r--r--net/netfilter/nf_conntrack_ftp.c8
-rw-r--r--net/packet/af_packet.c7
-rw-r--r--net/phonet/pep.c4
-rw-r--r--net/phonet/socket.c4
-rw-r--r--net/rds/af_rds.c8
-rw-r--r--net/rds/connection.c6
-rw-r--r--net/rds/ib_cm.c4
-rw-r--r--net/rds/ib_rdma.c4
-rw-r--r--net/rds/ib_recv.c12
-rw-r--r--net/rds/ib_send.c4
-rw-r--r--net/rds/iw_rdma.c4
-rw-r--r--net/rds/iw_recv.c12
-rw-r--r--net/rds/iw_send.c7
-rw-r--r--net/rds/message.c3
-rw-r--r--net/rds/rdma.c12
-rw-r--r--net/rds/recv.c11
-rw-r--r--net/rds/send.c27
-rw-r--r--net/rds/threads.c4
-rw-r--r--net/rose/rose_route.c10
-rw-r--r--net/sched/cls_rsvp.h28
-rw-r--r--net/sched/sch_htb.c4
-rw-r--r--net/sched/sch_netem.c12
-rw-r--r--net/sched/sch_teql.c11
-rw-r--r--net/sctp/outqueue.c4
-rw-r--r--net/sctp/socket.c4
-rw-r--r--net/sunrpc/auth.c6
-rw-r--r--net/sunrpc/auth_gss/gss_krb5_seqnum.c4
-rw-r--r--net/sunrpc/auth_gss/svcauth_gss.c4
-rw-r--r--net/sunrpc/cache.c5
-rw-r--r--net/sunrpc/svc.c5
-rw-r--r--net/sunrpc/svc_xprt.c8
-rw-r--r--net/sunrpc/svcauth.c4
-rw-r--r--net/sunrpc/svcauth_unix.c4
-rw-r--r--net/sunrpc/xprtrdma/svc_rdma_recvfrom.c7
-rw-r--r--net/sunrpc/xprtrdma/verbs.c4
-rw-r--r--net/tipc/cluster.c16
-rw-r--r--net/tipc/link.c12
-rw-r--r--net/tipc/socket.c12
-rw-r--r--net/tipc/subscr.c6
-rw-r--r--net/unix/af_unix.c8
-rw-r--r--net/wimax/op-rfkill.c8
-rw-r--r--net/wireless/scan.c4
-rw-r--r--net/wireless/wext-core.c5
63 files changed, 235 insertions, 233 deletions
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index 8d934dd7fd54..4dd873e3a1bb 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -633,8 +633,8 @@ static void p9_poll_mux(struct p9_conn *m)
633 if (n & POLLOUT) { 633 if (n & POLLOUT) {
634 set_bit(Wpending, &m->wsched); 634 set_bit(Wpending, &m->wsched);
635 P9_DPRINTK(P9_DEBUG_TRANS, "mux %p can write\n", m); 635 P9_DPRINTK(P9_DEBUG_TRANS, "mux %p can write\n", m);
636 if ((m->wsize || !list_empty(&m->unsent_req_list)) 636 if ((m->wsize || !list_empty(&m->unsent_req_list)) &&
637 && !test_and_set_bit(Wworksched, &m->wsched)) { 637 !test_and_set_bit(Wworksched, &m->wsched)) {
638 P9_DPRINTK(P9_DEBUG_TRANS, "sched write work %p\n", m); 638 P9_DPRINTK(P9_DEBUG_TRANS, "sched write work %p\n", m);
639 queue_work(p9_mux_wq, &m->wq); 639 queue_work(p9_mux_wq, &m->wq);
640 } 640 }
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 80d929842f04..54992f782301 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1362,8 +1362,8 @@ static int l2cap_ertm_send(struct sock *sk)
1362 if (pi->conn_state & L2CAP_CONN_WAIT_F) 1362 if (pi->conn_state & L2CAP_CONN_WAIT_F)
1363 return 0; 1363 return 0;
1364 1364
1365 while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) 1365 while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) &&
1366 && !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) { 1366 !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
1367 tx_skb = skb_clone(skb, GFP_ATOMIC); 1367 tx_skb = skb_clone(skb, GFP_ATOMIC);
1368 1368
1369 if (pi->remote_max_tx && 1369 if (pi->remote_max_tx &&
@@ -1604,8 +1604,8 @@ static int l2cap_sock_sendmsg(struct kiocb *iocb, struct socket *sock, struct ms
1604 return -EOPNOTSUPP; 1604 return -EOPNOTSUPP;
1605 1605
1606 /* Check outgoing MTU */ 1606 /* Check outgoing MTU */
1607 if (sk->sk_type == SOCK_SEQPACKET && pi->mode == L2CAP_MODE_BASIC 1607 if (sk->sk_type == SOCK_SEQPACKET && pi->mode == L2CAP_MODE_BASIC &&
1608 && len > pi->omtu) 1608 len > pi->omtu)
1609 return -EINVAL; 1609 return -EINVAL;
1610 1610
1611 lock_sock(sk); 1611 lock_sock(sk);
@@ -2756,8 +2756,8 @@ static inline int l2cap_config_req(struct l2cap_conn *conn, struct l2cap_cmd_hdr
2756 goto unlock; 2756 goto unlock;
2757 2757
2758 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) { 2758 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_INPUT_DONE) {
2759 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) 2759 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
2760 || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE) 2760 l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
2761 l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16; 2761 l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
2762 2762
2763 sk->sk_state = BT_CONNECTED; 2763 sk->sk_state = BT_CONNECTED;
@@ -2845,8 +2845,8 @@ static inline int l2cap_config_rsp(struct l2cap_conn *conn, struct l2cap_cmd_hdr
2845 l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE; 2845 l2cap_pi(sk)->conf_state |= L2CAP_CONF_INPUT_DONE;
2846 2846
2847 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) { 2847 if (l2cap_pi(sk)->conf_state & L2CAP_CONF_OUTPUT_DONE) {
2848 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) 2848 if (!(l2cap_pi(sk)->conf_state & L2CAP_CONF_NO_FCS_RECV) ||
2849 || l2cap_pi(sk)->fcs != L2CAP_FCS_NONE) 2849 l2cap_pi(sk)->fcs != L2CAP_FCS_NONE)
2850 l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16; 2850 l2cap_pi(sk)->fcs = L2CAP_FCS_CRC16;
2851 2851
2852 sk->sk_state = BT_CONNECTED; 2852 sk->sk_state = BT_CONNECTED;
@@ -3388,8 +3388,8 @@ static inline int l2cap_data_channel_sframe(struct sock *sk, u16 rx_control, str
3388 pi->expected_ack_seq = tx_seq; 3388 pi->expected_ack_seq = tx_seq;
3389 l2cap_drop_acked_frames(sk); 3389 l2cap_drop_acked_frames(sk);
3390 3390
3391 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) 3391 if ((pi->conn_state & L2CAP_CONN_REMOTE_BUSY) &&
3392 && (pi->unacked_frames > 0)) 3392 (pi->unacked_frames > 0))
3393 __mod_retrans_timer(); 3393 __mod_retrans_timer();
3394 3394
3395 l2cap_ertm_send(sk); 3395 l2cap_ertm_send(sk);
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 57bf05c353bc..3b8e038ab32c 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -60,8 +60,8 @@ static inline unsigned long hold_time(const struct net_bridge *br)
60static inline int has_expired(const struct net_bridge *br, 60static inline int has_expired(const struct net_bridge *br,
61 const struct net_bridge_fdb_entry *fdb) 61 const struct net_bridge_fdb_entry *fdb)
62{ 62{
63 return !fdb->is_static 63 return !fdb->is_static &&
64 && time_before_eq(fdb->ageing_timer + hold_time(br), jiffies); 64 time_before_eq(fdb->ageing_timer + hold_time(br), jiffies);
65} 65}
66 66
67static inline int br_mac_hash(const unsigned char *mac) 67static inline int br_mac_hash(const unsigned char *mac)
diff --git a/net/bridge/br_sysfs_br.c b/net/bridge/br_sysfs_br.c
index ee4820aa1843..bee4f300d0c8 100644
--- a/net/bridge/br_sysfs_br.c
+++ b/net/bridge/br_sysfs_br.c
@@ -316,9 +316,9 @@ static ssize_t store_group_addr(struct device *d,
316 if (new_addr[5] & ~0xf) 316 if (new_addr[5] & ~0xf)
317 return -EINVAL; 317 return -EINVAL;
318 318
319 if (new_addr[5] == 1 /* 802.3x Pause address */ 319 if (new_addr[5] == 1 || /* 802.3x Pause address */
320 || new_addr[5] == 2 /* 802.3ad Slow protocols */ 320 new_addr[5] == 2 || /* 802.3ad Slow protocols */
321 || new_addr[5] == 3) /* 802.1X PAE address */ 321 new_addr[5] == 3) /* 802.1X PAE address */
322 return -EINVAL; 322 return -EINVAL;
323 323
324 spin_lock_bh(&br->lock); 324 spin_lock_bh(&br->lock);
diff --git a/net/bridge/netfilter/ebt_stp.c b/net/bridge/netfilter/ebt_stp.c
index 48527e621626..75e29a9cebda 100644
--- a/net/bridge/netfilter/ebt_stp.c
+++ b/net/bridge/netfilter/ebt_stp.c
@@ -135,8 +135,8 @@ ebt_stp_mt(const struct sk_buff *skb, const struct xt_match_param *par)
135 if (memcmp(sp, header, sizeof(header))) 135 if (memcmp(sp, header, sizeof(header)))
136 return false; 136 return false;
137 137
138 if (info->bitmask & EBT_STP_TYPE 138 if (info->bitmask & EBT_STP_TYPE &&
139 && FWINV(info->type != sp->type, EBT_STP_TYPE)) 139 FWINV(info->type != sp->type, EBT_STP_TYPE))
140 return false; 140 return false;
141 141
142 if (sp->type == BPDU_TYPE_CONFIG && 142 if (sp->type == BPDU_TYPE_CONFIG &&
diff --git a/net/can/af_can.c b/net/can/af_can.c
index f30671728864..51adc4c2b860 100644
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -375,8 +375,8 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask,
375 return &d->rx[RX_ALL]; 375 return &d->rx[RX_ALL];
376 376
377 /* extra filterlists for the subscription of a single non-RTR can_id */ 377 /* extra filterlists for the subscription of a single non-RTR can_id */
378 if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS) 378 if (((*mask & CAN_EFF_RTR_FLAGS) == CAN_EFF_RTR_FLAGS) &&
379 && !(*can_id & CAN_RTR_FLAG)) { 379 !(*can_id & CAN_RTR_FLAG)) {
380 380
381 if (*can_id & CAN_EFF_FLAG) { 381 if (*can_id & CAN_EFF_FLAG) {
382 if (*mask == (CAN_EFF_MASK | CAN_EFF_RTR_FLAGS)) { 382 if (*mask == (CAN_EFF_MASK | CAN_EFF_RTR_FLAGS)) {
@@ -525,8 +525,8 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask,
525 */ 525 */
526 526
527 hlist_for_each_entry_rcu(r, next, rl, list) { 527 hlist_for_each_entry_rcu(r, next, rl, list) {
528 if (r->can_id == can_id && r->mask == mask 528 if (r->can_id == can_id && r->mask == mask &&
529 && r->func == func && r->data == data) 529 r->func == func && r->data == data)
530 break; 530 break;
531 } 531 }
532 532
diff --git a/net/core/dev.c b/net/core/dev.c
index 7775e8b48deb..5d131c2f84cc 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2677,9 +2677,10 @@ __napi_gro_receive(struct napi_struct *napi, struct sk_buff *skb)
2677 return GRO_NORMAL; 2677 return GRO_NORMAL;
2678 2678
2679 for (p = napi->gro_list; p; p = p->next) { 2679 for (p = napi->gro_list; p; p = p->next) {
2680 NAPI_GRO_CB(p)->same_flow = (p->dev == skb->dev) 2680 NAPI_GRO_CB(p)->same_flow =
2681 && !compare_ether_header(skb_mac_header(p), 2681 (p->dev == skb->dev) &&
2682 skb_gro_mac_header(skb)); 2682 !compare_ether_header(skb_mac_header(p),
2683 skb_gro_mac_header(skb));
2683 NAPI_GRO_CB(p)->flush = 0; 2684 NAPI_GRO_CB(p)->flush = 0;
2684 } 2685 }
2685 2686
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 19ee493ec178..a23b45f08ec9 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2052,9 +2052,8 @@ static void pktgen_setup_inject(struct pktgen_dev *pkt_dev)
2052 read_lock_bh(&idev->lock); 2052 read_lock_bh(&idev->lock);
2053 for (ifp = idev->addr_list; ifp; 2053 for (ifp = idev->addr_list; ifp;
2054 ifp = ifp->if_next) { 2054 ifp = ifp->if_next) {
2055 if (ifp->scope == IFA_LINK 2055 if (ifp->scope == IFA_LINK &&
2056 && !(ifp-> 2056 !(ifp->flags & IFA_F_TENTATIVE)) {
2057 flags & IFA_F_TENTATIVE)) {
2058 ipv6_addr_copy(&pkt_dev-> 2057 ipv6_addr_copy(&pkt_dev->
2059 cur_in6_saddr, 2058 cur_in6_saddr,
2060 &ifp->addr); 2059 &ifp->addr);
diff --git a/net/dcb/dcbnl.c b/net/dcb/dcbnl.c
index 2afd617104d2..db9f5b39388f 100644
--- a/net/dcb/dcbnl.c
+++ b/net/dcb/dcbnl.c
@@ -1085,8 +1085,8 @@ static int dcbnl_bcn_setcfg(struct net_device *netdev, struct nlattr **tb,
1085 u8 value_byte; 1085 u8 value_byte;
1086 u32 value_int; 1086 u32 value_int;
1087 1087
1088 if (!tb[DCB_ATTR_BCN] || !netdev->dcbnl_ops->setbcncfg 1088 if (!tb[DCB_ATTR_BCN] || !netdev->dcbnl_ops->setbcncfg ||
1089 || !netdev->dcbnl_ops->setbcnrp) 1089 !netdev->dcbnl_ops->setbcnrp)
1090 return ret; 1090 return ret;
1091 1091
1092 ret = nla_parse_nested(data, DCB_BCN_ATTR_MAX, 1092 ret = nla_parse_nested(data, DCB_BCN_ATTR_MAX,
diff --git a/net/decnet/dn_table.c b/net/decnet/dn_table.c
index f281e0f59b09..b9a33bb5e9cc 100644
--- a/net/decnet/dn_table.c
+++ b/net/decnet/dn_table.c
@@ -581,8 +581,9 @@ static int dn_fib_table_insert(struct dn_fib_table *tb, struct rtmsg *r, struct
581 DN_FIB_SCAN_KEY(f, fp, key) { 581 DN_FIB_SCAN_KEY(f, fp, key) {
582 if (fi->fib_priority != DN_FIB_INFO(f)->fib_priority) 582 if (fi->fib_priority != DN_FIB_INFO(f)->fib_priority)
583 break; 583 break;
584 if (f->fn_type == type && f->fn_scope == r->rtm_scope 584 if (f->fn_type == type &&
585 && DN_FIB_INFO(f) == fi) 585 f->fn_scope == r->rtm_scope &&
586 DN_FIB_INFO(f) == fi)
586 goto out; 587 goto out;
587 } 588 }
588 589
diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
index 6110c6d6e613..76c08402c933 100644
--- a/net/ipv4/igmp.c
+++ b/net/ipv4/igmp.c
@@ -1899,8 +1899,9 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
1899 err = -EADDRNOTAVAIL; 1899 err = -EADDRNOTAVAIL;
1900 1900
1901 for (pmc=inet->mc_list; pmc; pmc=pmc->next) { 1901 for (pmc=inet->mc_list; pmc; pmc=pmc->next) {
1902 if (pmc->multi.imr_multiaddr.s_addr == imr.imr_multiaddr.s_addr 1902 if ((pmc->multi.imr_multiaddr.s_addr ==
1903 && pmc->multi.imr_ifindex == imr.imr_ifindex) 1903 imr.imr_multiaddr.s_addr) &&
1904 (pmc->multi.imr_ifindex == imr.imr_ifindex))
1904 break; 1905 break;
1905 } 1906 }
1906 if (!pmc) { /* must have a prior join */ 1907 if (!pmc) { /* must have a prior join */
diff --git a/net/ipv4/netfilter.c b/net/ipv4/netfilter.c
index 1725dc0ef688..f53cb8df4182 100644
--- a/net/ipv4/netfilter.c
+++ b/net/ipv4/netfilter.c
@@ -155,10 +155,10 @@ static int nf_ip_reroute(struct sk_buff *skb,
155 if (entry->hook == NF_INET_LOCAL_OUT) { 155 if (entry->hook == NF_INET_LOCAL_OUT) {
156 const struct iphdr *iph = ip_hdr(skb); 156 const struct iphdr *iph = ip_hdr(skb);
157 157
158 if (!(iph->tos == rt_info->tos 158 if (!(iph->tos == rt_info->tos &&
159 && skb->mark == rt_info->mark 159 skb->mark == rt_info->mark &&
160 && iph->daddr == rt_info->daddr 160 iph->daddr == rt_info->daddr &&
161 && iph->saddr == rt_info->saddr)) 161 iph->saddr == rt_info->saddr))
162 return ip_route_me_harder(skb, RTN_UNSPEC); 162 return ip_route_me_harder(skb, RTN_UNSPEC);
163 } 163 }
164 return 0; 164 return 0;
diff --git a/net/irda/irnet/irnet_irda.c b/net/irda/irnet/irnet_irda.c
index cccc2e93234f..b26dee784aba 100644
--- a/net/irda/irnet/irnet_irda.c
+++ b/net/irda/irnet/irnet_irda.c
@@ -1403,8 +1403,8 @@ irnet_connect_indication(void * instance,
1403 /* Socket already connecting ? On primary ? */ 1403 /* Socket already connecting ? On primary ? */
1404 if(0 1404 if(0
1405#ifdef ALLOW_SIMULT_CONNECT 1405#ifdef ALLOW_SIMULT_CONNECT
1406 || ((irttp_is_primary(server->tsap) == 1) /* primary */ 1406 || ((irttp_is_primary(server->tsap) == 1) && /* primary */
1407 && (test_and_clear_bit(0, &new->ttp_connect))) 1407 (test_and_clear_bit(0, &new->ttp_connect)))
1408#endif /* ALLOW_SIMULT_CONNECT */ 1408#endif /* ALLOW_SIMULT_CONNECT */
1409 ) 1409 )
1410 { 1410 {
diff --git a/net/mac80211/agg-rx.c b/net/mac80211/agg-rx.c
index 7ed5fe664732..614c65d62ae4 100644
--- a/net/mac80211/agg-rx.c
+++ b/net/mac80211/agg-rx.c
@@ -211,9 +211,9 @@ void ieee80211_process_addba_request(struct ieee80211_local *local,
211 * check if configuration can support the BA policy 211 * check if configuration can support the BA policy
212 * and if buffer size does not exceeds max value */ 212 * and if buffer size does not exceeds max value */
213 /* XXX: check own ht delayed BA capability?? */ 213 /* XXX: check own ht delayed BA capability?? */
214 if (((ba_policy != 1) 214 if (((ba_policy != 1) &&
215 && (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA))) 215 (!(sta->sta.ht_cap.cap & IEEE80211_HT_CAP_DELAY_BA))) ||
216 || (buf_size > IEEE80211_MAX_AMPDU_BUF)) { 216 (buf_size > IEEE80211_MAX_AMPDU_BUF)) {
217 status = WLAN_STATUS_INVALID_QOS_PARAM; 217 status = WLAN_STATUS_INVALID_QOS_PARAM;
218#ifdef CONFIG_MAC80211_HT_DEBUG 218#ifdef CONFIG_MAC80211_HT_DEBUG
219 if (net_ratelimit()) 219 if (net_ratelimit())
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index dd8ec8d5e8b2..8116d1a96a4a 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -631,8 +631,8 @@ void ieee80211_unregister_hw(struct ieee80211_hw *hw)
631 sta_info_stop(local); 631 sta_info_stop(local);
632 rate_control_deinitialize(local); 632 rate_control_deinitialize(local);
633 633
634 if (skb_queue_len(&local->skb_queue) 634 if (skb_queue_len(&local->skb_queue) ||
635 || skb_queue_len(&local->skb_queue_unreliable)) 635 skb_queue_len(&local->skb_queue_unreliable))
636 printk(KERN_WARNING "%s: skb_queue not empty\n", 636 printk(KERN_WARNING "%s: skb_queue not empty\n",
637 wiphy_name(local->hw.wiphy)); 637 wiphy_name(local->hw.wiphy));
638 skb_queue_purge(&local->skb_queue); 638 skb_queue_purge(&local->skb_queue);
diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c
index 51adb1115215..c0fe46493f71 100644
--- a/net/mac80211/mesh.c
+++ b/net/mac80211/mesh.c
@@ -195,8 +195,8 @@ int mesh_rmc_check(u8 *sa, struct ieee80211s_hdr *mesh_hdr,
195 list_del(&p->list); 195 list_del(&p->list);
196 kmem_cache_free(rm_cache, p); 196 kmem_cache_free(rm_cache, p);
197 --entries; 197 --entries;
198 } else if ((seqnum == p->seqnum) 198 } else if ((seqnum == p->seqnum) &&
199 && (memcmp(sa, p->sa, ETH_ALEN) == 0)) 199 (memcmp(sa, p->sa, ETH_ALEN) == 0))
200 return -1; 200 return -1;
201 } 201 }
202 202
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 9aecf0207afc..833b2f3670c5 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -936,17 +936,16 @@ int mesh_nexthop_lookup(struct sk_buff *skb,
936 } 936 }
937 937
938 if (mpath->flags & MESH_PATH_ACTIVE) { 938 if (mpath->flags & MESH_PATH_ACTIVE) {
939 if (time_after(jiffies, mpath->exp_time + 939 if (time_after(jiffies,
940 msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) 940 mpath->exp_time +
941 && !memcmp(sdata->dev->dev_addr, hdr->addr4, 941 msecs_to_jiffies(sdata->u.mesh.mshcfg.path_refresh_time)) &&
942 ETH_ALEN) 942 !memcmp(sdata->dev->dev_addr, hdr->addr4, ETH_ALEN) &&
943 && !(mpath->flags & MESH_PATH_RESOLVING) 943 !(mpath->flags & MESH_PATH_RESOLVING) &&
944 && !(mpath->flags & MESH_PATH_FIXED)) { 944 !(mpath->flags & MESH_PATH_FIXED)) {
945 mesh_queue_preq(mpath, 945 mesh_queue_preq(mpath,
946 PREQ_Q_F_START | PREQ_Q_F_REFRESH); 946 PREQ_Q_F_START | PREQ_Q_F_REFRESH);
947 } 947 }
948 memcpy(hdr->addr1, mpath->next_hop->sta.addr, 948 memcpy(hdr->addr1, mpath->next_hop->sta.addr, ETH_ALEN);
949 ETH_ALEN);
950 } else { 949 } else {
951 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); 950 struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
952 if (!(mpath->flags & MESH_PATH_RESOLVING)) { 951 if (!(mpath->flags & MESH_PATH_RESOLVING)) {
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 96f13ad05d3c..beecf50fbd10 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1168,8 +1168,8 @@ ieee80211_drop_unencrypted(struct ieee80211_rx_data *rx, __le16 fc)
1168 rx->key)) 1168 rx->key))
1169 return -EACCES; 1169 return -EACCES;
1170 /* BIP does not use Protected field, so need to check MMIE */ 1170 /* BIP does not use Protected field, so need to check MMIE */
1171 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) 1171 if (unlikely(ieee80211_is_multicast_robust_mgmt_frame(rx->skb) &&
1172 && ieee80211_get_mmie_keyidx(rx->skb) < 0 && 1172 ieee80211_get_mmie_keyidx(rx->skb) < 0 &&
1173 rx->key)) 1173 rx->key))
1174 return -EACCES; 1174 return -EACCES;
1175 /* 1175 /*
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index 943def2b07df..8834cc93c716 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -366,10 +366,11 @@ ieee80211_tx_h_unicast_ps_buf(struct ieee80211_tx_data *tx)
366 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data; 366 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)tx->skb->data;
367 u32 staflags; 367 u32 staflags;
368 368
369 if (unlikely(!sta || ieee80211_is_probe_resp(hdr->frame_control) 369 if (unlikely(!sta ||
370 || ieee80211_is_auth(hdr->frame_control) 370 ieee80211_is_probe_resp(hdr->frame_control) ||
371 || ieee80211_is_assoc_resp(hdr->frame_control) 371 ieee80211_is_auth(hdr->frame_control) ||
372 || ieee80211_is_reassoc_resp(hdr->frame_control))) 372 ieee80211_is_assoc_resp(hdr->frame_control) ||
373 ieee80211_is_reassoc_resp(hdr->frame_control)))
373 return TX_CONTINUE; 374 return TX_CONTINUE;
374 375
375 staflags = get_sta_flags(sta); 376 staflags = get_sta_flags(sta);
diff --git a/net/netfilter/nf_conntrack_expect.c b/net/netfilter/nf_conntrack_expect.c
index 2032dfe25ca8..fdf5d2a1d9b4 100644
--- a/net/netfilter/nf_conntrack_expect.c
+++ b/net/netfilter/nf_conntrack_expect.c
@@ -202,9 +202,9 @@ static inline int expect_clash(const struct nf_conntrack_expect *a,
202static inline int expect_matches(const struct nf_conntrack_expect *a, 202static inline int expect_matches(const struct nf_conntrack_expect *a,
203 const struct nf_conntrack_expect *b) 203 const struct nf_conntrack_expect *b)
204{ 204{
205 return a->master == b->master && a->class == b->class 205 return a->master == b->master && a->class == b->class &&
206 && nf_ct_tuple_equal(&a->tuple, &b->tuple) 206 nf_ct_tuple_equal(&a->tuple, &b->tuple) &&
207 && nf_ct_tuple_mask_equal(&a->mask, &b->mask); 207 nf_ct_tuple_mask_equal(&a->mask, &b->mask);
208} 208}
209 209
210/* Generally a bad idea to call this: could have matched already. */ 210/* Generally a bad idea to call this: could have matched already. */
diff --git a/net/netfilter/nf_conntrack_ftp.c b/net/netfilter/nf_conntrack_ftp.c
index 5509dd1f14cf..38ea7ef3ccd2 100644
--- a/net/netfilter/nf_conntrack_ftp.c
+++ b/net/netfilter/nf_conntrack_ftp.c
@@ -243,8 +243,8 @@ static int try_epsv_response(const char *data, size_t dlen,
243 /* Three delimiters. */ 243 /* Three delimiters. */
244 if (dlen <= 3) return 0; 244 if (dlen <= 3) return 0;
245 delim = data[0]; 245 delim = data[0];
246 if (isdigit(delim) || delim < 33 || delim > 126 246 if (isdigit(delim) || delim < 33 || delim > 126 ||
247 || data[1] != delim || data[2] != delim) 247 data[1] != delim || data[2] != delim)
248 return 0; 248 return 0;
249 249
250 return get_port(data, 3, dlen, delim, &cmd->u.tcp.port); 250 return get_port(data, 3, dlen, delim, &cmd->u.tcp.port);
@@ -366,8 +366,8 @@ static int help(struct sk_buff *skb,
366 typeof(nf_nat_ftp_hook) nf_nat_ftp; 366 typeof(nf_nat_ftp_hook) nf_nat_ftp;
367 367
368 /* Until there's been traffic both ways, don't look in packets. */ 368 /* Until there's been traffic both ways, don't look in packets. */
369 if (ctinfo != IP_CT_ESTABLISHED 369 if (ctinfo != IP_CT_ESTABLISHED &&
370 && ctinfo != IP_CT_ESTABLISHED+IP_CT_IS_REPLY) { 370 ctinfo != IP_CT_ESTABLISHED + IP_CT_IS_REPLY) {
371 pr_debug("ftp: Conntrackinfo = %u\n", ctinfo); 371 pr_debug("ftp: Conntrackinfo = %u\n", ctinfo);
372 return NF_ACCEPT; 372 return NF_ACCEPT;
373 } 373 }
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 940fc20b2b50..020562164b56 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -1034,9 +1034,10 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg)
1034 goto out_xmit; 1034 goto out_xmit;
1035 packet_increment_head(&po->tx_ring); 1035 packet_increment_head(&po->tx_ring);
1036 len_sum += tp_len; 1036 len_sum += tp_len;
1037 } while (likely((ph != NULL) || ((!(msg->msg_flags & MSG_DONTWAIT)) 1037 } while (likely((ph != NULL) ||
1038 && (atomic_read(&po->tx_ring.pending)))) 1038 ((!(msg->msg_flags & MSG_DONTWAIT)) &&
1039 ); 1039 (atomic_read(&po->tx_ring.pending))))
1040 );
1040 1041
1041 err = len_sum; 1042 err = len_sum;
1042 goto out_put; 1043 goto out_put;
diff --git a/net/phonet/pep.c b/net/phonet/pep.c
index bdc17bdad366..b6356f3832f6 100644
--- a/net/phonet/pep.c
+++ b/net/phonet/pep.c
@@ -714,8 +714,8 @@ static int pep_ioctl(struct sock *sk, int cmd, unsigned long arg)
714 return -EINVAL; 714 return -EINVAL;
715 715
716 lock_sock(sk); 716 lock_sock(sk);
717 if (sock_flag(sk, SOCK_URGINLINE) 717 if (sock_flag(sk, SOCK_URGINLINE) &&
718 && !skb_queue_empty(&pn->ctrlreq_queue)) 718 !skb_queue_empty(&pn->ctrlreq_queue))
719 answ = skb_peek(&pn->ctrlreq_queue)->len; 719 answ = skb_peek(&pn->ctrlreq_queue)->len;
720 else if (!skb_queue_empty(&sk->sk_receive_queue)) 720 else if (!skb_queue_empty(&sk->sk_receive_queue))
721 answ = skb_peek(&sk->sk_receive_queue)->len; 721 answ = skb_peek(&sk->sk_receive_queue)->len;
diff --git a/net/phonet/socket.c b/net/phonet/socket.c
index 4112b6e1c48a..69c8b826a0ce 100644
--- a/net/phonet/socket.c
+++ b/net/phonet/socket.c
@@ -98,8 +98,8 @@ struct sock *pn_find_sock_by_sa(struct net *net, const struct sockaddr_pn *spn)
98 if (pn->resource != res) 98 if (pn->resource != res)
99 continue; 99 continue;
100 } 100 }
101 if (pn_addr(pn->sobject) 101 if (pn_addr(pn->sobject) &&
102 && pn_addr(pn->sobject) != pn_addr(obj)) 102 pn_addr(pn->sobject) != pn_addr(obj))
103 continue; 103 continue;
104 104
105 rval = sknode; 105 rval = sknode;
diff --git a/net/rds/af_rds.c b/net/rds/af_rds.c
index e25d8d5ce8df..853c52be781f 100644
--- a/net/rds/af_rds.c
+++ b/net/rds/af_rds.c
@@ -174,8 +174,8 @@ static unsigned int rds_poll(struct file *file, struct socket *sock,
174 mask |= (POLLIN | POLLRDNORM); 174 mask |= (POLLIN | POLLRDNORM);
175 spin_unlock(&rs->rs_lock); 175 spin_unlock(&rs->rs_lock);
176 } 176 }
177 if (!list_empty(&rs->rs_recv_queue) 177 if (!list_empty(&rs->rs_recv_queue) ||
178 || !list_empty(&rs->rs_notify_queue)) 178 !list_empty(&rs->rs_notify_queue))
179 mask |= (POLLIN | POLLRDNORM); 179 mask |= (POLLIN | POLLRDNORM);
180 if (rs->rs_snd_bytes < rds_sk_sndbuf(rs)) 180 if (rs->rs_snd_bytes < rds_sk_sndbuf(rs))
181 mask |= (POLLOUT | POLLWRNORM); 181 mask |= (POLLOUT | POLLWRNORM);
@@ -308,8 +308,8 @@ static int rds_getsockopt(struct socket *sock, int level, int optname,
308 if (len < sizeof(int)) 308 if (len < sizeof(int))
309 ret = -EINVAL; 309 ret = -EINVAL;
310 else 310 else
311 if (put_user(rs->rs_recverr, (int __user *) optval) 311 if (put_user(rs->rs_recverr, (int __user *) optval) ||
312 || put_user(sizeof(int), optlen)) 312 put_user(sizeof(int), optlen))
313 ret = -EFAULT; 313 ret = -EFAULT;
314 else 314 else
315 ret = 0; 315 ret = 0;
diff --git a/net/rds/connection.c b/net/rds/connection.c
index cc8b568c0c84..278f607ab603 100644
--- a/net/rds/connection.c
+++ b/net/rds/connection.c
@@ -133,10 +133,8 @@ static struct rds_connection *__rds_conn_create(__be32 laddr, __be32 faddr,
133 133
134 spin_lock_irqsave(&rds_conn_lock, flags); 134 spin_lock_irqsave(&rds_conn_lock, flags);
135 conn = rds_conn_lookup(head, laddr, faddr, trans); 135 conn = rds_conn_lookup(head, laddr, faddr, trans);
136 if (conn 136 if (conn && conn->c_loopback && conn->c_trans != &rds_loop_transport &&
137 && conn->c_loopback 137 !is_outgoing) {
138 && conn->c_trans != &rds_loop_transport
139 && !is_outgoing) {
140 /* This is a looped back IB connection, and we're 138 /* This is a looped back IB connection, and we're
141 * called by the code handling the incoming connect. 139 * called by the code handling the incoming connect.
142 * We need a second connection object into which we 140 * We need a second connection object into which we
diff --git a/net/rds/ib_cm.c b/net/rds/ib_cm.c
index 9d320692a4fc..647cb8ffc39b 100644
--- a/net/rds/ib_cm.c
+++ b/net/rds/ib_cm.c
@@ -377,8 +377,8 @@ static u32 rds_ib_protocol_compatible(struct rdma_cm_event *event)
377 } 377 }
378 378
379 /* Even if len is crap *now* I still want to check it. -ASG */ 379 /* Even if len is crap *now* I still want to check it. -ASG */
380 if (event->param.conn.private_data_len < sizeof (*dp) 380 if (event->param.conn.private_data_len < sizeof (*dp) ||
381 || dp->dp_protocol_major == 0) 381 dp->dp_protocol_major == 0)
382 return RDS_PROTOCOL_3_0; 382 return RDS_PROTOCOL_3_0;
383 383
384 common = be16_to_cpu(dp->dp_protocol_minor_mask) & RDS_IB_SUPPORTED_PROTOCOLS; 384 common = be16_to_cpu(dp->dp_protocol_minor_mask) & RDS_IB_SUPPORTED_PROTOCOLS;
diff --git a/net/rds/ib_rdma.c b/net/rds/ib_rdma.c
index c5e916598c14..4b0da865a72c 100644
--- a/net/rds/ib_rdma.c
+++ b/net/rds/ib_rdma.c
@@ -570,8 +570,8 @@ void rds_ib_free_mr(void *trans_private, int invalidate)
570 spin_unlock_irqrestore(&pool->list_lock, flags); 570 spin_unlock_irqrestore(&pool->list_lock, flags);
571 571
572 /* If we've pinned too many pages, request a flush */ 572 /* If we've pinned too many pages, request a flush */
573 if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned 573 if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned ||
574 || atomic_read(&pool->dirty_count) >= pool->max_items / 10) 574 atomic_read(&pool->dirty_count) >= pool->max_items / 10)
575 queue_work(rds_wq, &pool->flush_worker); 575 queue_work(rds_wq, &pool->flush_worker);
576 576
577 if (invalidate) { 577 if (invalidate) {
diff --git a/net/rds/ib_recv.c b/net/rds/ib_recv.c
index fe5ab8c6b964..04dc0d3f3c95 100644
--- a/net/rds/ib_recv.c
+++ b/net/rds/ib_recv.c
@@ -230,8 +230,8 @@ int rds_ib_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
230 int ret = 0; 230 int ret = 0;
231 u32 pos; 231 u32 pos;
232 232
233 while ((prefill || rds_conn_up(conn)) 233 while ((prefill || rds_conn_up(conn)) &&
234 && rds_ib_ring_alloc(&ic->i_recv_ring, 1, &pos)) { 234 rds_ib_ring_alloc(&ic->i_recv_ring, 1, &pos)) {
235 if (pos >= ic->i_recv_ring.w_nr) { 235 if (pos >= ic->i_recv_ring.w_nr) {
236 printk(KERN_NOTICE "Argh - ring alloc returned pos=%u\n", 236 printk(KERN_NOTICE "Argh - ring alloc returned pos=%u\n",
237 pos); 237 pos);
@@ -771,10 +771,10 @@ static void rds_ib_process_recv(struct rds_connection *conn,
771 hdr = &ibinc->ii_inc.i_hdr; 771 hdr = &ibinc->ii_inc.i_hdr;
772 /* We can't just use memcmp here; fragments of a 772 /* We can't just use memcmp here; fragments of a
773 * single message may carry different ACKs */ 773 * single message may carry different ACKs */
774 if (hdr->h_sequence != ihdr->h_sequence 774 if (hdr->h_sequence != ihdr->h_sequence ||
775 || hdr->h_len != ihdr->h_len 775 hdr->h_len != ihdr->h_len ||
776 || hdr->h_sport != ihdr->h_sport 776 hdr->h_sport != ihdr->h_sport ||
777 || hdr->h_dport != ihdr->h_dport) { 777 hdr->h_dport != ihdr->h_dport) {
778 rds_ib_conn_error(conn, 778 rds_ib_conn_error(conn,
779 "fragment header mismatch; forcing reconnect\n"); 779 "fragment header mismatch; forcing reconnect\n");
780 return; 780 return;
diff --git a/net/rds/ib_send.c b/net/rds/ib_send.c
index 23bf830db2d5..a10fab6886d1 100644
--- a/net/rds/ib_send.c
+++ b/net/rds/ib_send.c
@@ -252,8 +252,8 @@ void rds_ib_send_cq_comp_handler(struct ib_cq *cq, void *context)
252 252
253 rds_ib_ring_free(&ic->i_send_ring, completed); 253 rds_ib_ring_free(&ic->i_send_ring, completed);
254 254
255 if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags) 255 if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags) ||
256 || test_bit(0, &conn->c_map_queued)) 256 test_bit(0, &conn->c_map_queued))
257 queue_delayed_work(rds_wq, &conn->c_send_w, 0); 257 queue_delayed_work(rds_wq, &conn->c_send_w, 0);
258 258
259 /* We expect errors as the qp is drained during shutdown */ 259 /* We expect errors as the qp is drained during shutdown */
diff --git a/net/rds/iw_rdma.c b/net/rds/iw_rdma.c
index b25d785e49fc..9eda11cca956 100644
--- a/net/rds/iw_rdma.c
+++ b/net/rds/iw_rdma.c
@@ -573,8 +573,8 @@ void rds_iw_free_mr(void *trans_private, int invalidate)
573 rds_iw_free_fastreg(pool, ibmr); 573 rds_iw_free_fastreg(pool, ibmr);
574 574
575 /* If we've pinned too many pages, request a flush */ 575 /* If we've pinned too many pages, request a flush */
576 if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned 576 if (atomic_read(&pool->free_pinned) >= pool->max_free_pinned ||
577 || atomic_read(&pool->dirty_count) >= pool->max_items / 10) 577 atomic_read(&pool->dirty_count) >= pool->max_items / 10)
578 queue_work(rds_wq, &pool->flush_worker); 578 queue_work(rds_wq, &pool->flush_worker);
579 579
580 if (invalidate) { 580 if (invalidate) {
diff --git a/net/rds/iw_recv.c b/net/rds/iw_recv.c
index 24fc53f03833..54af7d6b92da 100644
--- a/net/rds/iw_recv.c
+++ b/net/rds/iw_recv.c
@@ -230,8 +230,8 @@ int rds_iw_recv_refill(struct rds_connection *conn, gfp_t kptr_gfp,
230 int ret = 0; 230 int ret = 0;
231 u32 pos; 231 u32 pos;
232 232
233 while ((prefill || rds_conn_up(conn)) 233 while ((prefill || rds_conn_up(conn)) &&
234 && rds_iw_ring_alloc(&ic->i_recv_ring, 1, &pos)) { 234 rds_iw_ring_alloc(&ic->i_recv_ring, 1, &pos)) {
235 if (pos >= ic->i_recv_ring.w_nr) { 235 if (pos >= ic->i_recv_ring.w_nr) {
236 printk(KERN_NOTICE "Argh - ring alloc returned pos=%u\n", 236 printk(KERN_NOTICE "Argh - ring alloc returned pos=%u\n",
237 pos); 237 pos);
@@ -730,10 +730,10 @@ static void rds_iw_process_recv(struct rds_connection *conn,
730 hdr = &iwinc->ii_inc.i_hdr; 730 hdr = &iwinc->ii_inc.i_hdr;
731 /* We can't just use memcmp here; fragments of a 731 /* We can't just use memcmp here; fragments of a
732 * single message may carry different ACKs */ 732 * single message may carry different ACKs */
733 if (hdr->h_sequence != ihdr->h_sequence 733 if (hdr->h_sequence != ihdr->h_sequence ||
734 || hdr->h_len != ihdr->h_len 734 hdr->h_len != ihdr->h_len ||
735 || hdr->h_sport != ihdr->h_sport 735 hdr->h_sport != ihdr->h_sport ||
736 || hdr->h_dport != ihdr->h_dport) { 736 hdr->h_dport != ihdr->h_dport) {
737 rds_iw_conn_error(conn, 737 rds_iw_conn_error(conn,
738 "fragment header mismatch; forcing reconnect\n"); 738 "fragment header mismatch; forcing reconnect\n");
739 return; 739 return;
diff --git a/net/rds/iw_send.c b/net/rds/iw_send.c
index 1f5abe3cf2b4..1379e9d66a78 100644
--- a/net/rds/iw_send.c
+++ b/net/rds/iw_send.c
@@ -288,8 +288,8 @@ void rds_iw_send_cq_comp_handler(struct ib_cq *cq, void *context)
288 288
289 rds_iw_ring_free(&ic->i_send_ring, completed); 289 rds_iw_ring_free(&ic->i_send_ring, completed);
290 290
291 if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags) 291 if (test_and_clear_bit(RDS_LL_SEND_FULL, &conn->c_flags) ||
292 || test_bit(0, &conn->c_map_queued)) 292 test_bit(0, &conn->c_map_queued))
293 queue_delayed_work(rds_wq, &conn->c_send_w, 0); 293 queue_delayed_work(rds_wq, &conn->c_send_w, 0);
294 294
295 /* We expect errors as the qp is drained during shutdown */ 295 /* We expect errors as the qp is drained during shutdown */
@@ -519,8 +519,7 @@ int rds_iw_xmit(struct rds_connection *conn, struct rds_message *rm,
519 BUG_ON(hdr_off != 0 && hdr_off != sizeof(struct rds_header)); 519 BUG_ON(hdr_off != 0 && hdr_off != sizeof(struct rds_header));
520 520
521 /* Fastreg support */ 521 /* Fastreg support */
522 if (rds_rdma_cookie_key(rm->m_rdma_cookie) 522 if (rds_rdma_cookie_key(rm->m_rdma_cookie) && !ic->i_fastreg_posted) {
523 && !ic->i_fastreg_posted) {
524 ret = -EAGAIN; 523 ret = -EAGAIN;
525 goto out; 524 goto out;
526 } 525 }
diff --git a/net/rds/message.c b/net/rds/message.c
index ca50a8ec9742..73e600ffd87f 100644
--- a/net/rds/message.c
+++ b/net/rds/message.c
@@ -122,8 +122,7 @@ int rds_message_add_extension(struct rds_header *hdr,
122 if (hdr->h_exthdr[0] != RDS_EXTHDR_NONE) 122 if (hdr->h_exthdr[0] != RDS_EXTHDR_NONE)
123 return 0; 123 return 0;
124 124
125 if (type >= __RDS_EXTHDR_MAX 125 if (type >= __RDS_EXTHDR_MAX || len != rds_exthdr_size[type])
126 || len != rds_exthdr_size[type])
127 return 0; 126 return 0;
128 127
129 if (ext_len >= RDS_HEADER_EXT_SPACE) 128 if (ext_len >= RDS_HEADER_EXT_SPACE)
diff --git a/net/rds/rdma.c b/net/rds/rdma.c
index 971b5a668458..4c64daa1f5d5 100644
--- a/net/rds/rdma.c
+++ b/net/rds/rdma.c
@@ -631,8 +631,8 @@ int rds_cmsg_rdma_args(struct rds_sock *rs, struct rds_message *rm,
631{ 631{
632 struct rds_rdma_op *op; 632 struct rds_rdma_op *op;
633 633
634 if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args)) 634 if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_rdma_args)) ||
635 || rm->m_rdma_op != NULL) 635 rm->m_rdma_op != NULL)
636 return -EINVAL; 636 return -EINVAL;
637 637
638 op = rds_rdma_prepare(rs, CMSG_DATA(cmsg)); 638 op = rds_rdma_prepare(rs, CMSG_DATA(cmsg));
@@ -655,8 +655,8 @@ int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
655 u32 r_key; 655 u32 r_key;
656 int err = 0; 656 int err = 0;
657 657
658 if (cmsg->cmsg_len < CMSG_LEN(sizeof(rds_rdma_cookie_t)) 658 if (cmsg->cmsg_len < CMSG_LEN(sizeof(rds_rdma_cookie_t)) ||
659 || rm->m_rdma_cookie != 0) 659 rm->m_rdma_cookie != 0)
660 return -EINVAL; 660 return -EINVAL;
661 661
662 memcpy(&rm->m_rdma_cookie, CMSG_DATA(cmsg), sizeof(rm->m_rdma_cookie)); 662 memcpy(&rm->m_rdma_cookie, CMSG_DATA(cmsg), sizeof(rm->m_rdma_cookie));
@@ -692,8 +692,8 @@ int rds_cmsg_rdma_dest(struct rds_sock *rs, struct rds_message *rm,
692int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm, 692int rds_cmsg_rdma_map(struct rds_sock *rs, struct rds_message *rm,
693 struct cmsghdr *cmsg) 693 struct cmsghdr *cmsg)
694{ 694{
695 if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_get_mr_args)) 695 if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct rds_get_mr_args)) ||
696 || rm->m_rdma_cookie != 0) 696 rm->m_rdma_cookie != 0)
697 return -EINVAL; 697 return -EINVAL;
698 698
699 return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->m_rdma_mr); 699 return __rds_rdma_map(rs, CMSG_DATA(cmsg), &rm->m_rdma_cookie, &rm->m_rdma_mr);
diff --git a/net/rds/recv.c b/net/rds/recv.c
index fdff33c7b432..b426d67f760c 100644
--- a/net/rds/recv.c
+++ b/net/rds/recv.c
@@ -195,8 +195,8 @@ void rds_recv_incoming(struct rds_connection *conn, __be32 saddr, __be32 daddr,
195 * XXX we could spend more on the wire to get more robust failure 195 * XXX we could spend more on the wire to get more robust failure
196 * detection, arguably worth it to avoid data corruption. 196 * detection, arguably worth it to avoid data corruption.
197 */ 197 */
198 if (be64_to_cpu(inc->i_hdr.h_sequence) < conn->c_next_rx_seq 198 if (be64_to_cpu(inc->i_hdr.h_sequence) < conn->c_next_rx_seq &&
199 && (inc->i_hdr.h_flags & RDS_FLAG_RETRANSMITTED)) { 199 (inc->i_hdr.h_flags & RDS_FLAG_RETRANSMITTED)) {
200 rds_stats_inc(s_recv_drop_old_seq); 200 rds_stats_inc(s_recv_drop_old_seq);
201 goto out; 201 goto out;
202 } 202 }
@@ -432,10 +432,9 @@ int rds_recvmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
432 } 432 }
433 433
434 timeo = wait_event_interruptible_timeout(*sk->sk_sleep, 434 timeo = wait_event_interruptible_timeout(*sk->sk_sleep,
435 (!list_empty(&rs->rs_notify_queue) 435 (!list_empty(&rs->rs_notify_queue) ||
436 || rs->rs_cong_notify 436 rs->rs_cong_notify ||
437 || rds_next_incoming(rs, &inc)), 437 rds_next_incoming(rs, &inc)), timeo);
438 timeo);
439 rdsdebug("recvmsg woke inc %p timeo %ld\n", inc, 438 rdsdebug("recvmsg woke inc %p timeo %ld\n", inc,
440 timeo); 439 timeo);
441 if (timeo > 0 || timeo == MAX_SCHEDULE_TIMEOUT) 440 if (timeo > 0 || timeo == MAX_SCHEDULE_TIMEOUT)
diff --git a/net/rds/send.c b/net/rds/send.c
index 28c88ff3d038..b2fccfc20769 100644
--- a/net/rds/send.c
+++ b/net/rds/send.c
@@ -235,8 +235,8 @@ int rds_send_xmit(struct rds_connection *conn)
235 * connection. 235 * connection.
236 * Therefore, we never retransmit messages with RDMA ops. 236 * Therefore, we never retransmit messages with RDMA ops.
237 */ 237 */
238 if (rm->m_rdma_op 238 if (rm->m_rdma_op &&
239 && test_bit(RDS_MSG_RETRANSMITTED, &rm->m_flags)) { 239 test_bit(RDS_MSG_RETRANSMITTED, &rm->m_flags)) {
240 spin_lock_irqsave(&conn->c_lock, flags); 240 spin_lock_irqsave(&conn->c_lock, flags);
241 if (test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags)) 241 if (test_and_clear_bit(RDS_MSG_ON_CONN, &rm->m_flags))
242 list_move(&rm->m_conn_item, &to_be_dropped); 242 list_move(&rm->m_conn_item, &to_be_dropped);
@@ -247,8 +247,8 @@ int rds_send_xmit(struct rds_connection *conn)
247 247
248 /* Require an ACK every once in a while */ 248 /* Require an ACK every once in a while */
249 len = ntohl(rm->m_inc.i_hdr.h_len); 249 len = ntohl(rm->m_inc.i_hdr.h_len);
250 if (conn->c_unacked_packets == 0 250 if (conn->c_unacked_packets == 0 ||
251 || conn->c_unacked_bytes < len) { 251 conn->c_unacked_bytes < len) {
252 __set_bit(RDS_MSG_ACK_REQUIRED, &rm->m_flags); 252 __set_bit(RDS_MSG_ACK_REQUIRED, &rm->m_flags);
253 253
254 conn->c_unacked_packets = rds_sysctl_max_unacked_packets; 254 conn->c_unacked_packets = rds_sysctl_max_unacked_packets;
@@ -418,8 +418,8 @@ void rds_rdma_send_complete(struct rds_message *rm, int status)
418 spin_lock(&rm->m_rs_lock); 418 spin_lock(&rm->m_rs_lock);
419 419
420 ro = rm->m_rdma_op; 420 ro = rm->m_rdma_op;
421 if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags) 421 if (test_bit(RDS_MSG_ON_SOCK, &rm->m_flags) &&
422 && ro && ro->r_notify && ro->r_notifier) { 422 ro && ro->r_notify && ro->r_notifier) {
423 notifier = ro->r_notifier; 423 notifier = ro->r_notifier;
424 rs = rm->m_rs; 424 rs = rm->m_rs;
425 sock_hold(rds_rs_to_sk(rs)); 425 sock_hold(rds_rs_to_sk(rs));
@@ -549,8 +549,7 @@ void rds_send_remove_from_sock(struct list_head *messages, int status)
549 list_del_init(&rm->m_sock_item); 549 list_del_init(&rm->m_sock_item);
550 rds_send_sndbuf_remove(rs, rm); 550 rds_send_sndbuf_remove(rs, rm);
551 551
552 if (ro && ro->r_notifier 552 if (ro && ro->r_notifier && (status || ro->r_notify)) {
553 && (status || ro->r_notify)) {
554 notifier = ro->r_notifier; 553 notifier = ro->r_notifier;
555 list_add_tail(&notifier->n_list, 554 list_add_tail(&notifier->n_list,
556 &rs->rs_notify_queue); 555 &rs->rs_notify_queue);
@@ -877,8 +876,8 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
877 if (ret) 876 if (ret)
878 goto out; 877 goto out;
879 878
880 if ((rm->m_rdma_cookie || rm->m_rdma_op) 879 if ((rm->m_rdma_cookie || rm->m_rdma_op) &&
881 && conn->c_trans->xmit_rdma == NULL) { 880 conn->c_trans->xmit_rdma == NULL) {
882 if (printk_ratelimit()) 881 if (printk_ratelimit())
883 printk(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n", 882 printk(KERN_NOTICE "rdma_op %p conn xmit_rdma %p\n",
884 rm->m_rdma_op, conn->c_trans->xmit_rdma); 883 rm->m_rdma_op, conn->c_trans->xmit_rdma);
@@ -890,8 +889,8 @@ int rds_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg,
890 * have scheduled a delayed reconnect however - in this case 889 * have scheduled a delayed reconnect however - in this case
891 * we should not interfere. 890 * we should not interfere.
892 */ 891 */
893 if (rds_conn_state(conn) == RDS_CONN_DOWN 892 if (rds_conn_state(conn) == RDS_CONN_DOWN &&
894 && !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags)) 893 !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
895 queue_delayed_work(rds_wq, &conn->c_conn_w, 0); 894 queue_delayed_work(rds_wq, &conn->c_conn_w, 0);
896 895
897 ret = rds_cong_wait(conn->c_fcong, dport, nonblock, rs); 896 ret = rds_cong_wait(conn->c_fcong, dport, nonblock, rs);
@@ -973,8 +972,8 @@ rds_send_pong(struct rds_connection *conn, __be16 dport)
973 * have scheduled a delayed reconnect however - in this case 972 * have scheduled a delayed reconnect however - in this case
974 * we should not interfere. 973 * we should not interfere.
975 */ 974 */
976 if (rds_conn_state(conn) == RDS_CONN_DOWN 975 if (rds_conn_state(conn) == RDS_CONN_DOWN &&
977 && !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags)) 976 !test_and_set_bit(RDS_RECONNECT_PENDING, &conn->c_flags))
978 queue_delayed_work(rds_wq, &conn->c_conn_w, 0); 977 queue_delayed_work(rds_wq, &conn->c_conn_w, 0);
979 978
980 ret = rds_cong_wait(conn->c_fcong, dport, 1, NULL); 979 ret = rds_cong_wait(conn->c_fcong, dport, 1, NULL);
diff --git a/net/rds/threads.c b/net/rds/threads.c
index dd7e0cad1e7c..00fa10e59af8 100644
--- a/net/rds/threads.c
+++ b/net/rds/threads.c
@@ -170,8 +170,8 @@ void rds_shutdown_worker(struct work_struct *work)
170 * handler is supposed to check for state DISCONNECTING 170 * handler is supposed to check for state DISCONNECTING
171 */ 171 */
172 mutex_lock(&conn->c_cm_lock); 172 mutex_lock(&conn->c_cm_lock);
173 if (!rds_conn_transition(conn, RDS_CONN_UP, RDS_CONN_DISCONNECTING) 173 if (!rds_conn_transition(conn, RDS_CONN_UP, RDS_CONN_DISCONNECTING) &&
174 && !rds_conn_transition(conn, RDS_CONN_ERROR, RDS_CONN_DISCONNECTING)) { 174 !rds_conn_transition(conn, RDS_CONN_ERROR, RDS_CONN_DISCONNECTING)) {
175 rds_conn_error(conn, "shutdown called in state %d\n", 175 rds_conn_error(conn, "shutdown called in state %d\n",
176 atomic_read(&conn->c_state)); 176 atomic_read(&conn->c_state));
177 mutex_unlock(&conn->c_cm_lock); 177 mutex_unlock(&conn->c_cm_lock);
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index ea2e72337e2f..795c4b025e31 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -77,8 +77,9 @@ static int __must_check rose_add_node(struct rose_route_struct *rose_route,
77 77
78 rose_neigh = rose_neigh_list; 78 rose_neigh = rose_neigh_list;
79 while (rose_neigh != NULL) { 79 while (rose_neigh != NULL) {
80 if (ax25cmp(&rose_route->neighbour, &rose_neigh->callsign) == 0 80 if (ax25cmp(&rose_route->neighbour,
81 && rose_neigh->dev == dev) 81 &rose_neigh->callsign) == 0 &&
82 rose_neigh->dev == dev)
82 break; 83 break;
83 rose_neigh = rose_neigh->next; 84 rose_neigh = rose_neigh->next;
84 } 85 }
@@ -311,8 +312,9 @@ static int rose_del_node(struct rose_route_struct *rose_route,
311 312
312 rose_neigh = rose_neigh_list; 313 rose_neigh = rose_neigh_list;
313 while (rose_neigh != NULL) { 314 while (rose_neigh != NULL) {
314 if (ax25cmp(&rose_route->neighbour, &rose_neigh->callsign) == 0 315 if (ax25cmp(&rose_route->neighbour,
315 && rose_neigh->dev == dev) 316 &rose_neigh->callsign) == 0 &&
317 rose_neigh->dev == dev)
316 break; 318 break;
317 rose_neigh = rose_neigh->next; 319 rose_neigh = rose_neigh->next;
318 } 320 }
diff --git a/net/sched/cls_rsvp.h b/net/sched/cls_rsvp.h
index 7034ea4530e5..dd9414e44200 100644
--- a/net/sched/cls_rsvp.h
+++ b/net/sched/cls_rsvp.h
@@ -170,21 +170,23 @@ restart:
170 for (s = sht[h1]; s; s = s->next) { 170 for (s = sht[h1]; s; s = s->next) {
171 if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] && 171 if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] &&
172 protocol == s->protocol && 172 protocol == s->protocol &&
173 !(s->dpi.mask & (*(u32*)(xprt+s->dpi.offset)^s->dpi.key)) 173 !(s->dpi.mask &
174 (*(u32*)(xprt+s->dpi.offset)^s->dpi.key)) &&
174#if RSVP_DST_LEN == 4 175#if RSVP_DST_LEN == 4
175 && dst[0] == s->dst[0] 176 dst[0] == s->dst[0] &&
176 && dst[1] == s->dst[1] 177 dst[1] == s->dst[1] &&
177 && dst[2] == s->dst[2] 178 dst[2] == s->dst[2] &&
178#endif 179#endif
179 && tunnelid == s->tunnelid) { 180 tunnelid == s->tunnelid) {
180 181
181 for (f = s->ht[h2]; f; f = f->next) { 182 for (f = s->ht[h2]; f; f = f->next) {
182 if (src[RSVP_DST_LEN-1] == f->src[RSVP_DST_LEN-1] && 183 if (src[RSVP_DST_LEN-1] == f->src[RSVP_DST_LEN-1] &&
183 !(f->spi.mask & (*(u32*)(xprt+f->spi.offset)^f->spi.key)) 184 !(f->spi.mask & (*(u32*)(xprt+f->spi.offset)^f->spi.key))
184#if RSVP_DST_LEN == 4 185#if RSVP_DST_LEN == 4
185 && src[0] == f->src[0] 186 &&
186 && src[1] == f->src[1] 187 src[0] == f->src[0] &&
187 && src[2] == f->src[2] 188 src[1] == f->src[1] &&
189 src[2] == f->src[2]
188#endif 190#endif
189 ) { 191 ) {
190 *res = f->res; 192 *res = f->res;
@@ -493,13 +495,13 @@ static int rsvp_change(struct tcf_proto *tp, unsigned long base,
493 for (sp = &data->ht[h1]; (s=*sp) != NULL; sp = &s->next) { 495 for (sp = &data->ht[h1]; (s=*sp) != NULL; sp = &s->next) {
494 if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] && 496 if (dst[RSVP_DST_LEN-1] == s->dst[RSVP_DST_LEN-1] &&
495 pinfo && pinfo->protocol == s->protocol && 497 pinfo && pinfo->protocol == s->protocol &&
496 memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0 498 memcmp(&pinfo->dpi, &s->dpi, sizeof(s->dpi)) == 0 &&
497#if RSVP_DST_LEN == 4 499#if RSVP_DST_LEN == 4
498 && dst[0] == s->dst[0] 500 dst[0] == s->dst[0] &&
499 && dst[1] == s->dst[1] 501 dst[1] == s->dst[1] &&
500 && dst[2] == s->dst[2] 502 dst[2] == s->dst[2] &&
501#endif 503#endif
502 && pinfo->tunnelid == s->tunnelid) { 504 pinfo->tunnelid == s->tunnelid) {
503 505
504insert: 506insert:
505 /* OK, we found appropriate session */ 507 /* OK, we found appropriate session */
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 2e38d1abd830..508cf5f3a6d5 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1344,8 +1344,8 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
1344 }; 1344 };
1345 1345
1346 /* check for valid classid */ 1346 /* check for valid classid */
1347 if (!classid || TC_H_MAJ(classid ^ sch->handle) 1347 if (!classid || TC_H_MAJ(classid ^ sch->handle) ||
1348 || htb_find(classid, sch)) 1348 htb_find(classid, sch))
1349 goto failure; 1349 goto failure;
1350 1350
1351 /* check maximal depth */ 1351 /* check maximal depth */
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 2b88295cb7b7..d8b10e054627 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -199,9 +199,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
199 * do it now in software before we mangle it. 199 * do it now in software before we mangle it.
200 */ 200 */
201 if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) { 201 if (q->corrupt && q->corrupt >= get_crandom(&q->corrupt_cor)) {
202 if (!(skb = skb_unshare(skb, GFP_ATOMIC)) 202 if (!(skb = skb_unshare(skb, GFP_ATOMIC)) ||
203 || (skb->ip_summed == CHECKSUM_PARTIAL 203 (skb->ip_summed == CHECKSUM_PARTIAL &&
204 && skb_checksum_help(skb))) { 204 skb_checksum_help(skb))) {
205 sch->qstats.drops++; 205 sch->qstats.drops++;
206 return NET_XMIT_DROP; 206 return NET_XMIT_DROP;
207 } 207 }
@@ -210,9 +210,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
210 } 210 }
211 211
212 cb = netem_skb_cb(skb); 212 cb = netem_skb_cb(skb);
213 if (q->gap == 0 /* not doing reordering */ 213 if (q->gap == 0 || /* not doing reordering */
214 || q->counter < q->gap /* inside last reordering gap */ 214 q->counter < q->gap || /* inside last reordering gap */
215 || q->reorder < get_crandom(&q->reorder_cor)) { 215 q->reorder < get_crandom(&q->reorder_cor)) {
216 psched_time_t now; 216 psched_time_t now;
217 psched_tdiff_t delay; 217 psched_tdiff_t delay;
218 218
diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c
index 5a002c247231..db69637069c4 100644
--- a/net/sched/sch_teql.c
+++ b/net/sched/sch_teql.c
@@ -190,10 +190,13 @@ static int teql_qdisc_init(struct Qdisc *sch, struct nlattr *opt)
190 190
191 if (m->slaves) { 191 if (m->slaves) {
192 if (m->dev->flags & IFF_UP) { 192 if (m->dev->flags & IFF_UP) {
193 if ((m->dev->flags&IFF_POINTOPOINT && !(dev->flags&IFF_POINTOPOINT)) 193 if ((m->dev->flags & IFF_POINTOPOINT &&
194 || (m->dev->flags&IFF_BROADCAST && !(dev->flags&IFF_BROADCAST)) 194 !(dev->flags & IFF_POINTOPOINT)) ||
195 || (m->dev->flags&IFF_MULTICAST && !(dev->flags&IFF_MULTICAST)) 195 (m->dev->flags & IFF_BROADCAST &&
196 || dev->mtu < m->dev->mtu) 196 !(dev->flags & IFF_BROADCAST)) ||
197 (m->dev->flags & IFF_MULTICAST &&
198 !(dev->flags & IFF_MULTICAST)) ||
199 dev->mtu < m->dev->mtu)
197 return -EINVAL; 200 return -EINVAL;
198 } else { 201 } else {
199 if (!(dev->flags&IFF_POINTOPOINT)) 202 if (!(dev->flags&IFF_POINTOPOINT))
diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
index e231a9831016..229690f02a1d 100644
--- a/net/sctp/outqueue.c
+++ b/net/sctp/outqueue.c
@@ -191,8 +191,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
191 __u32 tsn) 191 __u32 tsn)
192{ 192{
193 if (primary->cacc.changeover_active && 193 if (primary->cacc.changeover_active &&
194 (sctp_cacc_skip_3_1(primary, transport, count_of_newacks) 194 (sctp_cacc_skip_3_1(primary, transport, count_of_newacks) ||
195 || sctp_cacc_skip_3_2(primary, tsn))) 195 sctp_cacc_skip_3_2(primary, tsn)))
196 return 1; 196 return 1;
197 return 0; 197 return 0;
198} 198}
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 71513b3926a5..5fa9ac52e137 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2356,8 +2356,8 @@ static int sctp_setsockopt_peer_addr_params(struct sock *sk,
2356 pmtud_change == SPP_PMTUD || 2356 pmtud_change == SPP_PMTUD ||
2357 sackdelay_change == SPP_SACKDELAY || 2357 sackdelay_change == SPP_SACKDELAY ||
2358 params.spp_sackdelay > 500 || 2358 params.spp_sackdelay > 500 ||
2359 (params.spp_pathmtu 2359 (params.spp_pathmtu &&
2360 && params.spp_pathmtu < SCTP_DEFAULT_MINSEGMENT)) 2360 params.spp_pathmtu < SCTP_DEFAULT_MINSEGMENT))
2361 return -EINVAL; 2361 return -EINVAL;
2362 2362
2363 /* If an address other than INADDR_ANY is specified, and 2363 /* If an address other than INADDR_ANY is specified, and
diff --git a/net/sunrpc/auth.c b/net/sunrpc/auth.c
index 54a4e042f104..7535a7bed2fa 100644
--- a/net/sunrpc/auth.c
+++ b/net/sunrpc/auth.c
@@ -332,9 +332,9 @@ rpcauth_lookup_credcache(struct rpc_auth *auth, struct auth_cred * acred,
332 list_add_tail(&new->cr_lru, &free); 332 list_add_tail(&new->cr_lru, &free);
333 spin_unlock(&cache->lock); 333 spin_unlock(&cache->lock);
334found: 334found:
335 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) 335 if (test_bit(RPCAUTH_CRED_NEW, &cred->cr_flags) &&
336 && cred->cr_ops->cr_init != NULL 336 cred->cr_ops->cr_init != NULL &&
337 && !(flags & RPCAUTH_LOOKUP_NEW)) { 337 !(flags & RPCAUTH_LOOKUP_NEW)) {
338 int res = cred->cr_ops->cr_init(auth, cred); 338 int res = cred->cr_ops->cr_init(auth, cred);
339 if (res < 0) { 339 if (res < 0) {
340 put_rpccred(cred); 340 put_rpccred(cred);
diff --git a/net/sunrpc/auth_gss/gss_krb5_seqnum.c b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
index f160be6c1a46..17562b4c35f6 100644
--- a/net/sunrpc/auth_gss/gss_krb5_seqnum.c
+++ b/net/sunrpc/auth_gss/gss_krb5_seqnum.c
@@ -75,8 +75,8 @@ krb5_get_seq_num(struct crypto_blkcipher *key,
75 if ((code = krb5_decrypt(key, cksum, buf, plain, 8))) 75 if ((code = krb5_decrypt(key, cksum, buf, plain, 8)))
76 return code; 76 return code;
77 77
78 if ((plain[4] != plain[5]) || (plain[4] != plain[6]) 78 if ((plain[4] != plain[5]) || (plain[4] != plain[6]) ||
79 || (plain[4] != plain[7])) 79 (plain[4] != plain[7]))
80 return (s32)KG_BAD_SEQ; 80 return (s32)KG_BAD_SEQ;
81 81
82 *direction = plain[4]; 82 *direction = plain[4];
diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c
index f6c51e562a02..e34bc531fcb9 100644
--- a/net/sunrpc/auth_gss/svcauth_gss.c
+++ b/net/sunrpc/auth_gss/svcauth_gss.c
@@ -105,8 +105,8 @@ static int rsi_match(struct cache_head *a, struct cache_head *b)
105{ 105{
106 struct rsi *item = container_of(a, struct rsi, h); 106 struct rsi *item = container_of(a, struct rsi, h);
107 struct rsi *tmp = container_of(b, struct rsi, h); 107 struct rsi *tmp = container_of(b, struct rsi, h);
108 return netobj_equal(&item->in_handle, &tmp->in_handle) 108 return netobj_equal(&item->in_handle, &tmp->in_handle) &&
109 && netobj_equal(&item->in_token, &tmp->in_token); 109 netobj_equal(&item->in_token, &tmp->in_token);
110} 110}
111 111
112static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len) 112static int dup_to_netobj(struct xdr_netobj *dst, char *src, int len)
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index d6eee291a0e2..39bddba53ba1 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -401,9 +401,8 @@ static int cache_clean(void)
401 for (; ch; cp= & ch->next, ch= *cp) { 401 for (; ch; cp= & ch->next, ch= *cp) {
402 if (current_detail->nextcheck > ch->expiry_time) 402 if (current_detail->nextcheck > ch->expiry_time)
403 current_detail->nextcheck = ch->expiry_time+1; 403 current_detail->nextcheck = ch->expiry_time+1;
404 if (ch->expiry_time >= get_seconds() 404 if (ch->expiry_time >= get_seconds() &&
405 && ch->last_refresh >= current_detail->flush_time 405 ch->last_refresh >= current_detail->flush_time)
406 )
407 continue; 406 continue;
408 if (test_and_clear_bit(CACHE_PENDING, &ch->flags)) 407 if (test_and_clear_bit(CACHE_PENDING, &ch->flags))
409 cache_dequeue(current_detail, ch); 408 cache_dequeue(current_detail, ch);
diff --git a/net/sunrpc/svc.c b/net/sunrpc/svc.c
index 952f206ff307..538ca433a56c 100644
--- a/net/sunrpc/svc.c
+++ b/net/sunrpc/svc.c
@@ -1103,8 +1103,9 @@ svc_process_common(struct svc_rqst *rqstp, struct kvec *argv, struct kvec *resv)
1103 procp->pc_release(rqstp, NULL, rqstp->rq_resp); 1103 procp->pc_release(rqstp, NULL, rqstp->rq_resp);
1104 goto dropit; 1104 goto dropit;
1105 } 1105 }
1106 if (*statp == rpc_success && (xdr = procp->pc_encode) 1106 if (*statp == rpc_success &&
1107 && !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) { 1107 (xdr = procp->pc_encode) &&
1108 !xdr(rqstp, resv->iov_base+resv->iov_len, rqstp->rq_resp)) {
1108 dprintk("svc: failed to encode reply\n"); 1109 dprintk("svc: failed to encode reply\n");
1109 /* serv->sv_stats->rpcsystemerr++; */ 1110 /* serv->sv_stats->rpcsystemerr++; */
1110 *statp = rpc_system_err; 1111 *statp = rpc_system_err;
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index df124f78ee48..b845e2293dfe 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -129,8 +129,8 @@ static void svc_xprt_free(struct kref *kref)
129 struct svc_xprt *xprt = 129 struct svc_xprt *xprt =
130 container_of(kref, struct svc_xprt, xpt_ref); 130 container_of(kref, struct svc_xprt, xpt_ref);
131 struct module *owner = xprt->xpt_class->xcl_owner; 131 struct module *owner = xprt->xpt_class->xcl_owner;
132 if (test_bit(XPT_CACHE_AUTH, &xprt->xpt_flags) 132 if (test_bit(XPT_CACHE_AUTH, &xprt->xpt_flags) &&
133 && xprt->xpt_auth_cache != NULL) 133 xprt->xpt_auth_cache != NULL)
134 svcauth_unix_info_release(xprt->xpt_auth_cache); 134 svcauth_unix_info_release(xprt->xpt_auth_cache);
135 xprt->xpt_ops->xpo_free(xprt); 135 xprt->xpt_ops->xpo_free(xprt);
136 module_put(owner); 136 module_put(owner);
@@ -846,8 +846,8 @@ static void svc_age_temp_xprts(unsigned long closure)
846 * through, close it. */ 846 * through, close it. */
847 if (!test_and_set_bit(XPT_OLD, &xprt->xpt_flags)) 847 if (!test_and_set_bit(XPT_OLD, &xprt->xpt_flags))
848 continue; 848 continue;
849 if (atomic_read(&xprt->xpt_ref.refcount) > 1 849 if (atomic_read(&xprt->xpt_ref.refcount) > 1 ||
850 || test_bit(XPT_BUSY, &xprt->xpt_flags)) 850 test_bit(XPT_BUSY, &xprt->xpt_flags))
851 continue; 851 continue;
852 svc_xprt_get(xprt); 852 svc_xprt_get(xprt);
853 list_move(le, &to_be_aged); 853 list_move(le, &to_be_aged);
diff --git a/net/sunrpc/svcauth.c b/net/sunrpc/svcauth.c
index e64109b02aee..4e9393c24687 100644
--- a/net/sunrpc/svcauth.c
+++ b/net/sunrpc/svcauth.c
@@ -46,8 +46,8 @@ svc_authenticate(struct svc_rqst *rqstp, __be32 *authp)
46 dprintk("svc: svc_authenticate (%d)\n", flavor); 46 dprintk("svc: svc_authenticate (%d)\n", flavor);
47 47
48 spin_lock(&authtab_lock); 48 spin_lock(&authtab_lock);
49 if (flavor >= RPC_AUTH_MAXFLAVOR || !(aops = authtab[flavor]) 49 if (flavor >= RPC_AUTH_MAXFLAVOR || !(aops = authtab[flavor]) ||
50 || !try_module_get(aops->owner)) { 50 !try_module_get(aops->owner)) {
51 spin_unlock(&authtab_lock); 51 spin_unlock(&authtab_lock);
52 *authp = rpc_autherr_badcred; 52 *authp = rpc_autherr_badcred;
53 return SVC_DENIED; 53 return SVC_DENIED;
diff --git a/net/sunrpc/svcauth_unix.c b/net/sunrpc/svcauth_unix.c
index f4c7ff3a53e6..4a8f6558718a 100644
--- a/net/sunrpc/svcauth_unix.c
+++ b/net/sunrpc/svcauth_unix.c
@@ -125,8 +125,8 @@ static int ip_map_match(struct cache_head *corig, struct cache_head *cnew)
125{ 125{
126 struct ip_map *orig = container_of(corig, struct ip_map, h); 126 struct ip_map *orig = container_of(corig, struct ip_map, h);
127 struct ip_map *new = container_of(cnew, struct ip_map, h); 127 struct ip_map *new = container_of(cnew, struct ip_map, h);
128 return strcmp(orig->m_class, new->m_class) == 0 128 return strcmp(orig->m_class, new->m_class) == 0 &&
129 && ipv6_addr_equal(&orig->m_addr, &new->m_addr); 129 ipv6_addr_equal(&orig->m_addr, &new->m_addr);
130} 130}
131static void ip_map_init(struct cache_head *cnew, struct cache_head *citem) 131static void ip_map_init(struct cache_head *cnew, struct cache_head *citem)
132{ 132{
diff --git a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
index 9e884383134f..f92e37eb413c 100644
--- a/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+++ b/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
@@ -337,10 +337,9 @@ static int rdma_set_ctxt_sge(struct svcxprt_rdma *xprt,
337 337
338static int rdma_read_max_sge(struct svcxprt_rdma *xprt, int sge_count) 338static int rdma_read_max_sge(struct svcxprt_rdma *xprt, int sge_count)
339{ 339{
340 if ((RDMA_TRANSPORT_IWARP == 340 if ((rdma_node_get_transport(xprt->sc_cm_id->device->node_type) ==
341 rdma_node_get_transport(xprt->sc_cm_id-> 341 RDMA_TRANSPORT_IWARP) &&
342 device->node_type)) 342 sge_count > 1)
343 && sge_count > 1)
344 return 1; 343 return 1;
345 else 344 else
346 return min_t(int, sge_count, xprt->sc_max_sge); 345 return min_t(int, sge_count, xprt->sc_max_sge);
diff --git a/net/sunrpc/xprtrdma/verbs.c b/net/sunrpc/xprtrdma/verbs.c
index 465aafc2007f..2209aa87d899 100644
--- a/net/sunrpc/xprtrdma/verbs.c
+++ b/net/sunrpc/xprtrdma/verbs.c
@@ -878,8 +878,8 @@ if (strnicmp(ia->ri_id->device->dma_device->bus->name, "pci", 3) == 0) {
878 * others indicate a transport condition which has already 878 * others indicate a transport condition which has already
879 * undergone a best-effort. 879 * undergone a best-effort.
880 */ 880 */
881 if (ep->rep_connected == -ECONNREFUSED 881 if (ep->rep_connected == -ECONNREFUSED &&
882 && ++retry_count <= RDMA_CONNECT_RETRY_MAX) { 882 ++retry_count <= RDMA_CONNECT_RETRY_MAX) {
883 dprintk("RPC: %s: non-peer_reject, retry\n", __func__); 883 dprintk("RPC: %s: non-peer_reject, retry\n", __func__);
884 goto retry; 884 goto retry;
885 } 885 }
diff --git a/net/tipc/cluster.c b/net/tipc/cluster.c
index 689fdefe9d04..a7eac00cd363 100644
--- a/net/tipc/cluster.c
+++ b/net/tipc/cluster.c
@@ -437,11 +437,11 @@ void tipc_cltr_recv_routing_table(struct sk_buff *buf)
437 break; 437 break;
438 case ROUTE_ADDITION: 438 case ROUTE_ADDITION:
439 if (!is_slave(tipc_own_addr)) { 439 if (!is_slave(tipc_own_addr)) {
440 assert(!in_own_cluster(c_ptr->addr) 440 assert(!in_own_cluster(c_ptr->addr) ||
441 || is_slave(rem_node)); 441 is_slave(rem_node));
442 } else { 442 } else {
443 assert(in_own_cluster(c_ptr->addr) 443 assert(in_own_cluster(c_ptr->addr) &&
444 && !is_slave(rem_node)); 444 !is_slave(rem_node));
445 } 445 }
446 n_ptr = c_ptr->nodes[tipc_node(rem_node)]; 446 n_ptr = c_ptr->nodes[tipc_node(rem_node)];
447 if (!n_ptr) 447 if (!n_ptr)
@@ -451,11 +451,11 @@ void tipc_cltr_recv_routing_table(struct sk_buff *buf)
451 break; 451 break;
452 case ROUTE_REMOVAL: 452 case ROUTE_REMOVAL:
453 if (!is_slave(tipc_own_addr)) { 453 if (!is_slave(tipc_own_addr)) {
454 assert(!in_own_cluster(c_ptr->addr) 454 assert(!in_own_cluster(c_ptr->addr) ||
455 || is_slave(rem_node)); 455 is_slave(rem_node));
456 } else { 456 } else {
457 assert(in_own_cluster(c_ptr->addr) 457 assert(in_own_cluster(c_ptr->addr) &&
458 && !is_slave(rem_node)); 458 !is_slave(rem_node));
459 } 459 }
460 n_ptr = c_ptr->nodes[tipc_node(rem_node)]; 460 n_ptr = c_ptr->nodes[tipc_node(rem_node)];
461 if (n_ptr) 461 if (n_ptr)
diff --git a/net/tipc/link.c b/net/tipc/link.c
index dd4c18b9a35b..6f50f6423f63 100644
--- a/net/tipc/link.c
+++ b/net/tipc/link.c
@@ -378,8 +378,8 @@ static void link_timeout(struct link *l_ptr)
378 struct tipc_msg *msg = buf_msg(l_ptr->first_out); 378 struct tipc_msg *msg = buf_msg(l_ptr->first_out);
379 u32 length = msg_size(msg); 379 u32 length = msg_size(msg);
380 380
381 if ((msg_user(msg) == MSG_FRAGMENTER) 381 if ((msg_user(msg) == MSG_FRAGMENTER) &&
382 && (msg_type(msg) == FIRST_FRAGMENT)) { 382 (msg_type(msg) == FIRST_FRAGMENT)) {
383 length = msg_size(msg_get_wrapped(msg)); 383 length = msg_size(msg_get_wrapped(msg));
384 } 384 }
385 if (length) { 385 if (length) {
@@ -2788,8 +2788,8 @@ int tipc_link_recv_fragment(struct sk_buff **pending, struct sk_buff **fb,
2788 2788
2789 /* Is there an incomplete message waiting for this fragment? */ 2789 /* Is there an incomplete message waiting for this fragment? */
2790 2790
2791 while (pbuf && ((msg_seqno(buf_msg(pbuf)) != long_msg_seq_no) 2791 while (pbuf && ((msg_seqno(buf_msg(pbuf)) != long_msg_seq_no) ||
2792 || (msg_orignode(fragm) != msg_orignode(buf_msg(pbuf))))) { 2792 (msg_orignode(fragm) != msg_orignode(buf_msg(pbuf))))) {
2793 prev = pbuf; 2793 prev = pbuf;
2794 pbuf = pbuf->next; 2794 pbuf = pbuf->next;
2795 } 2795 }
@@ -3325,8 +3325,8 @@ static void link_print(struct link *l_ptr, struct print_buf *buf,
3325 (l_ptr->last_out)), l_ptr->out_queue_size); 3325 (l_ptr->last_out)), l_ptr->out_queue_size);
3326 if ((mod(msg_seqno(buf_msg(l_ptr->last_out)) - 3326 if ((mod(msg_seqno(buf_msg(l_ptr->last_out)) -
3327 msg_seqno(buf_msg(l_ptr->first_out))) 3327 msg_seqno(buf_msg(l_ptr->first_out)))
3328 != (l_ptr->out_queue_size - 1)) 3328 != (l_ptr->out_queue_size - 1)) ||
3329 || (l_ptr->last_out->next != NULL)) { 3329 (l_ptr->last_out->next != NULL)) {
3330 tipc_printf(buf, "\nSend queue inconsistency\n"); 3330 tipc_printf(buf, "\nSend queue inconsistency\n");
3331 tipc_printf(buf, "first_out= %x ", l_ptr->first_out); 3331 tipc_printf(buf, "first_out= %x ", l_ptr->first_out);
3332 tipc_printf(buf, "next_out= %x ", l_ptr->next_out); 3332 tipc_printf(buf, "next_out= %x ", l_ptr->next_out);
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index eca5eb0dab08..1ea64f09cc45 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1136,13 +1136,11 @@ restart:
1136 1136
1137 /* Loop around if more data is required */ 1137 /* Loop around if more data is required */
1138 1138
1139 if ((sz_copied < buf_len) /* didn't get all requested data */ 1139 if ((sz_copied < buf_len) && /* didn't get all requested data */
1140 && (!skb_queue_empty(&sk->sk_receive_queue) || 1140 (!skb_queue_empty(&sk->sk_receive_queue) ||
1141 (flags & MSG_WAITALL)) 1141 (flags & MSG_WAITALL)) && /* and more is ready or required */
1142 /* ... and more is ready or required */ 1142 (!(flags & MSG_PEEK)) && /* and aren't just peeking at data */
1143 && (!(flags & MSG_PEEK)) /* ... and aren't just peeking at data */ 1143 (!err)) /* and haven't reached a FIN */
1144 && (!err) /* ... and haven't reached a FIN */
1145 )
1146 goto restart; 1144 goto restart;
1147 1145
1148exit: 1146exit:
diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
index 0747d8a9232f..ac91f0dfa144 100644
--- a/net/tipc/subscr.c
+++ b/net/tipc/subscr.c
@@ -364,9 +364,9 @@ static struct subscription *subscr_subscribe(struct tipc_subscr *s,
364 sub->seq.upper = htohl(s->seq.upper, swap); 364 sub->seq.upper = htohl(s->seq.upper, swap);
365 sub->timeout = htohl(s->timeout, swap); 365 sub->timeout = htohl(s->timeout, swap);
366 sub->filter = htohl(s->filter, swap); 366 sub->filter = htohl(s->filter, swap);
367 if ((!(sub->filter & TIPC_SUB_PORTS) 367 if ((!(sub->filter & TIPC_SUB_PORTS) ==
368 == !(sub->filter & TIPC_SUB_SERVICE)) 368 !(sub->filter & TIPC_SUB_SERVICE)) ||
369 || (sub->seq.lower > sub->seq.upper)) { 369 (sub->seq.lower > sub->seq.upper)) {
370 warn("Subscription rejected, illegal request\n"); 370 warn("Subscription rejected, illegal request\n");
371 kfree(sub); 371 kfree(sub);
372 subscr_terminate(subscriber); 372 subscr_terminate(subscriber);
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 7553ea6edd8f..f25511903115 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -1033,8 +1033,8 @@ static int unix_stream_connect(struct socket *sock, struct sockaddr *uaddr,
1033 goto out; 1033 goto out;
1034 addr_len = err; 1034 addr_len = err;
1035 1035
1036 if (test_bit(SOCK_PASSCRED, &sock->flags) 1036 if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr &&
1037 && !u->addr && (err = unix_autobind(sock)) != 0) 1037 (err = unix_autobind(sock)) != 0)
1038 goto out; 1038 goto out;
1039 1039
1040 timeo = sock_sndtimeo(sk, flags & O_NONBLOCK); 1040 timeo = sock_sndtimeo(sk, flags & O_NONBLOCK);
@@ -1378,8 +1378,8 @@ static int unix_dgram_sendmsg(struct kiocb *kiocb, struct socket *sock,
1378 goto out; 1378 goto out;
1379 } 1379 }
1380 1380
1381 if (test_bit(SOCK_PASSCRED, &sock->flags) 1381 if (test_bit(SOCK_PASSCRED, &sock->flags) && !u->addr
1382 && !u->addr && (err = unix_autobind(sock)) != 0) 1382 && (err = unix_autobind(sock)) != 0)
1383 goto out; 1383 goto out;
1384 1384
1385 err = -EMSGSIZE; 1385 err = -EMSGSIZE;
diff --git a/net/wimax/op-rfkill.c b/net/wimax/op-rfkill.c
index 94d339c345d2..ae752a64d920 100644
--- a/net/wimax/op-rfkill.c
+++ b/net/wimax/op-rfkill.c
@@ -107,8 +107,8 @@ void wimax_report_rfkill_hw(struct wimax_dev *wimax_dev,
107 107
108 if (state != wimax_dev->rf_hw) { 108 if (state != wimax_dev->rf_hw) {
109 wimax_dev->rf_hw = state; 109 wimax_dev->rf_hw = state;
110 if (wimax_dev->rf_hw == WIMAX_RF_ON 110 if (wimax_dev->rf_hw == WIMAX_RF_ON &&
111 && wimax_dev->rf_sw == WIMAX_RF_ON) 111 wimax_dev->rf_sw == WIMAX_RF_ON)
112 wimax_state = WIMAX_ST_READY; 112 wimax_state = WIMAX_ST_READY;
113 else 113 else
114 wimax_state = WIMAX_ST_RADIO_OFF; 114 wimax_state = WIMAX_ST_RADIO_OFF;
@@ -163,8 +163,8 @@ void wimax_report_rfkill_sw(struct wimax_dev *wimax_dev,
163 163
164 if (state != wimax_dev->rf_sw) { 164 if (state != wimax_dev->rf_sw) {
165 wimax_dev->rf_sw = state; 165 wimax_dev->rf_sw = state;
166 if (wimax_dev->rf_hw == WIMAX_RF_ON 166 if (wimax_dev->rf_hw == WIMAX_RF_ON &&
167 && wimax_dev->rf_sw == WIMAX_RF_ON) 167 wimax_dev->rf_sw == WIMAX_RF_ON)
168 wimax_state = WIMAX_ST_READY; 168 wimax_state = WIMAX_ST_READY;
169 else 169 else
170 wimax_state = WIMAX_ST_RADIO_OFF; 170 wimax_state = WIMAX_ST_RADIO_OFF;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 227d57b8dc41..96df34c3c6ee 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -937,8 +937,8 @@ ieee80211_bss(struct wiphy *wiphy, struct iw_request_info *info,
937 ie += ie[1] + 2; 937 ie += ie[1] + 2;
938 } 938 }
939 939
940 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) 940 if (bss->pub.capability & (WLAN_CAPABILITY_ESS | WLAN_CAPABILITY_IBSS) ||
941 || ismesh) { 941 ismesh) {
942 memset(&iwe, 0, sizeof(iwe)); 942 memset(&iwe, 0, sizeof(iwe));
943 iwe.cmd = SIOCGIWMODE; 943 iwe.cmd = SIOCGIWMODE;
944 if (ismesh) 944 if (ismesh)
diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c
index a4e5ddc8d4f5..58dfb954974a 100644
--- a/net/wireless/wext-core.c
+++ b/net/wireless/wext-core.c
@@ -911,8 +911,9 @@ static int wireless_process_ioctl(struct net *net, struct ifreq *ifr,
911 */ 911 */
912static int wext_permission_check(unsigned int cmd) 912static int wext_permission_check(unsigned int cmd)
913{ 913{
914 if ((IW_IS_SET(cmd) || cmd == SIOCGIWENCODE || cmd == SIOCGIWENCODEEXT) 914 if ((IW_IS_SET(cmd) || cmd == SIOCGIWENCODE ||
915 && !capable(CAP_NET_ADMIN)) 915 cmd == SIOCGIWENCODEEXT) &&
916 !capable(CAP_NET_ADMIN))
916 return -EPERM; 917 return -EPERM;
917 918
918 return 0; 919 return 0;