6 files changed, 49 insertions, 30 deletions

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 264c6b36931c..0fc00087ea8b 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -215,6 +215,7 @@ static void iucv_sock_close(struct sock *sk)
                         err = iucv_sock_wait_state(sk, IUCV_CLOSED, 0, timeo);
                 }
 
+        case IUCV_CLOSING:   /* fall through */
                 sk->sk_state = IUCV_CLOSED;
                 sk->sk_state_change(sk);
 
@@ -269,6 +270,8 @@ static struct sock *iucv_sock_alloc(struct socket *sock, int proto, gfp_t prio)
         iucv_sk(sk)->send_tag = 0;
         iucv_sk(sk)->flags = 0;
         iucv_sk(sk)->msglimit = IUCV_QUEUELEN_DEFAULT;
+        iucv_sk(sk)->path = NULL;
+        memset(&iucv_sk(sk)->src_user_id , 0, 32);
 
         sk->sk_destruct = iucv_sock_destruct;
         sk->sk_sndtimeo = IUCV_CONN_TIMEOUT;
@@ -979,6 +982,10 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
         if (flags & (MSG_OOB))
                 return -EOPNOTSUPP;
 
+        target = sock_rcvlowat(sk, flags & MSG_WAITALL, len);
+
+        /* receive/dequeue next skb:
+         * the function understands MSG_PEEK and, thus, does not dequeue skb */
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb) {
                 if (sk->sk_shutdown & RCV_SHUTDOWN)
@@ -1046,9 +1053,7 @@ static int iucv_sock_recvmsg(struct kiocb *iocb, struct socket *sock,
                                 iucv_process_message_q(sk);
                         spin_unlock_bh(&iucv->message_q.lock);
                 }
-
-        } else
-                skb_queue_head(&sk->sk_receive_queue, skb);
+        }
 
 done:
         /* SOCK_SEQPACKET: return real length if MSG_TRUNC is set */
@@ -1125,6 +1130,9 @@ static int iucv_sock_shutdown(struct socket *sock, int how)
 
         lock_sock(sk);
         switch (sk->sk_state) {
+        case IUCV_DISCONN:
+        case IUCV_CLOSING:
+        case IUCV_SEVERED:
         case IUCV_CLOSED:
                 err = -ENOTCONN;
                 goto fail;
@@ -1398,8 +1406,12 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg)
         struct sock_msg_q *save_msg;
         int len;
 
-        if (sk->sk_shutdown & RCV_SHUTDOWN)
+        if (sk->sk_shutdown & RCV_SHUTDOWN) {
+                iucv_message_reject(path, msg);
                 return;
+        }
+
+        spin_lock(&iucv->message_q.lock);
 
         if (!list_empty(&iucv->message_q.list) ||
             !skb_queue_empty(&iucv->backlog_skb_q))
@@ -1414,9 +1426,8 @@ static void iucv_callback_rx(struct iucv_path *path, struct iucv_message *msg)
         if (!skb)
                 goto save_message;
 
-        spin_lock(&iucv->message_q.lock);
         iucv_process_message(sk, skb, path, msg);
-        spin_unlock(&iucv->message_q.lock);
+        goto out_unlock;
 
         return;
 
@@ -1427,8 +1438,9 @@ save_message:
         save_msg->path = path;
         save_msg->msg = *msg;
 
-        spin_lock(&iucv->message_q.lock);
         list_add_tail(&save_msg->list, &iucv->message_q.list);
+
+out_unlock:
         spin_unlock(&iucv->message_q.lock);
 }
 
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 027302326498..81985d27cbda 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -156,8 +156,19 @@ int __ieee80211_resume(struct ieee80211_hw *hw)
                 case NL80211_IFTYPE_ADHOC:
                 case NL80211_IFTYPE_AP:
                 case NL80211_IFTYPE_MESH_POINT:
-                        WARN_ON(ieee80211_if_config(sdata, changed));
-                        ieee80211_bss_info_change_notify(sdata, ~0);
+                        /*
+                         * Driver's config_interface can fail if rfkill is
+                         * enabled. Accommodate this return code.
+                         * FIXME: When mac80211 has knowledge of rfkill
+                         * state the code below can change back to:
+                         *   WARN(ieee80211_if_config(sdata, changed));
+                         *   ieee80211_bss_info_change_notify(sdata, ~0);
+                         */
+                        if (ieee80211_if_config(sdata, changed))
+                                printk(KERN_DEBUG "%s: failed to configure interface during resume\n",
+                                       sdata->dev->name);
+                        else
+                                ieee80211_bss_info_change_notify(sdata, ~0);
                         break;
                 case NL80211_IFTYPE_WDS:
                         break;
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index 5fa7aedd90ed..9776f73c51ad 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -1397,7 +1397,7 @@ ieee80211_deliver_skb(struct ieee80211_rx_data *rx)
                  * mac80211. That also explains the __skb_push()
                  * below.
                  */
-                align = (unsigned long)skb->data & 4;
+                align = (unsigned long)skb->data & 3;
                 if (align) {
                         if (WARN_ON(skb_headroom(skb) < 3)) {
                                 dev_kfree_skb(skb);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 0ea36e0c8a0e..f13fc57e1ecb 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -988,7 +988,7 @@ ctnetlink_change_helper(struct nf_conn *ct, struct nlattr *cda[])
 {
         struct nf_conntrack_helper *helper;
         struct nf_conn_help *help = nfct_help(ct);
-        char *helpname;
+        char *helpname = NULL;
         int err;
 
         /* don't change helper of sibling connections */
@@ -1231,7 +1231,7 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
 
         rcu_read_lock();
         if (cda[CTA_HELP]) {
-                char *helpname;
+                char *helpname = NULL;
  
                 err = ctnetlink_parse_help(cda[CTA_HELP], &helpname);
                 if (err < 0)
diff --git a/net/netlabel/netlabel_addrlist.c b/net/netlabel/netlabel_addrlist.c
index 834c6eb7f484..c0519139679e 100644
--- a/net/netlabel/netlabel_addrlist.c
+++ b/net/netlabel/netlabel_addrlist.c
@@ -256,13 +256,11 @@ struct netlbl_af4list *netlbl_af4list_remove(__be32 addr, __be32 mask,
 {
         struct netlbl_af4list *entry;
 
-        entry = netlbl_af4list_search(addr, head);
-        if (entry != NULL && entry->addr == addr && entry->mask == mask) {
-                netlbl_af4list_remove_entry(entry);
-                return entry;
-        }
-
-        return NULL;
+        entry = netlbl_af4list_search_exact(addr, mask, head);
+        if (entry == NULL)
+                return NULL;
+        netlbl_af4list_remove_entry(entry);
+        return entry;
 }
 
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
@@ -299,15 +297,11 @@ struct netlbl_af6list *netlbl_af6list_remove(const struct in6_addr *addr,
 {
         struct netlbl_af6list *entry;
 
-        entry = netlbl_af6list_search(addr, head);
-        if (entry != NULL &&
-            ipv6_addr_equal(&entry->addr, addr) &&
-            ipv6_addr_equal(&entry->mask, mask)) {
-                netlbl_af6list_remove_entry(entry);
-                return entry;
-        }
-
-        return NULL;
+        entry = netlbl_af6list_search_exact(addr, mask, head);
+        if (entry == NULL)
+                return NULL;
+        netlbl_af6list_remove_entry(entry);
+        return entry;
 }
 #endif /* IPv6 */
 
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 4e705f87969f..3be0e016ab7d 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -1084,8 +1084,10 @@ static int nr_sendmsg(struct kiocb *iocb, struct socket *sock,
 
         /* Build a packet - the conventional user limit is 236 bytes. We can
            do ludicrously large NetROM frames but must not overflow */
-        if (len > 65536)
-                return -EMSGSIZE;
+        if (len > 65536) {
+                err = -EMSGSIZE;
+                goto out;
+        }
 
         SOCK_DEBUG(sk, "NET/ROM: sendto: building packet.\n");
         size = len + NR_NETWORK_LEN + NR_TRANSPORT_LEN;