6 files changed, 59 insertions, 46 deletions

diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
index 18e7f5a43dc4..37ba153c4cd4 100644
--- a/net/bluetooth/hidp/core.c
+++ b/net/bluetooth/hidp/core.c
@@ -243,6 +243,39 @@ static void hidp_input_report(struct hidp_session *session, struct sk_buff *skb)
         input_sync(dev);
 }
 
+static int __hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        struct sk_buff *skb;
+
+        BT_DBG("session %p data %p size %d", session, data, size);
+
+        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
+                BT_ERR("Can't allocate memory for new frame");
+                return -ENOMEM;
+        }
+
+        *skb_put(skb, 1) = hdr;
+        if (data && size > 0)
+                memcpy(skb_put(skb, size), data, size);
+
+        skb_queue_tail(&session->ctrl_transmit, skb);
+
+        return 0;
+}
+
+static inline int hidp_send_ctrl_message(struct hidp_session *session,
+                        unsigned char hdr, unsigned char *data, int size)
+{
+        int err;
+
+        err = __hidp_send_ctrl_message(session, hdr, data, size);
+
+        hidp_schedule(session);
+
+        return err;
+}
+
 static int hidp_queue_report(struct hidp_session *session,
                                 unsigned char *data, int size)
 {
@@ -280,9 +313,22 @@ static int hidp_send_report(struct hidp_session *session, struct hid_report *rep
         return hidp_queue_report(session, buf, rsize);
 }
 
-static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count)
+static int hidp_output_raw_report(struct hid_device *hid, unsigned char *data, size_t count,
+                unsigned char report_type)
 {
-        if (hidp_queue_report(hid->driver_data, data, count))
+        switch (report_type) {
+        case HID_FEATURE_REPORT:
+                report_type = HIDP_TRANS_SET_REPORT | HIDP_DATA_RTYPE_FEATURE;
+                break;
+        case HID_OUTPUT_REPORT:
+                report_type = HIDP_TRANS_DATA | HIDP_DATA_RTYPE_OUPUT;
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        if (hidp_send_ctrl_message(hid->driver_data, report_type,
+                        data, count))
                 return -ENOMEM;
         return count;
 }
@@ -307,39 +353,6 @@ static inline void hidp_del_timer(struct hidp_session *session)
                 del_timer(&session->timer);
 }
 
-static int __hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        struct sk_buff *skb;
-
-        BT_DBG("session %p data %p size %d", session, data, size);
-
-        if (!(skb = alloc_skb(size + 1, GFP_ATOMIC))) {
-                BT_ERR("Can't allocate memory for new frame");
-                return -ENOMEM;
-        }
-
-        *skb_put(skb, 1) = hdr;
-        if (data && size > 0)
-                memcpy(skb_put(skb, size), data, size);
-
-        skb_queue_tail(&session->ctrl_transmit, skb);
-
-        return 0;
-}
-
-static inline int hidp_send_ctrl_message(struct hidp_session *session,
-                        unsigned char hdr, unsigned char *data, int size)
-{
-        int err;
-
-        err = __hidp_send_ctrl_message(session, hdr, data, size);
-
-        hidp_schedule(session);
-
-        return err;
-}
-
 static void hidp_process_handshake(struct hidp_session *session,
                                         unsigned char param)
 {
diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index 1120cf14a548..400efa26ddba 100644
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -1368,7 +1368,6 @@ static int l2cap_ertm_send(struct sock *sk)
 
         while ((skb = sk->sk_send_head) && (!l2cap_tx_window_full(sk)) &&
                !(pi->conn_state & L2CAP_CONN_REMOTE_BUSY)) {
-                tx_skb = skb_clone(skb, GFP_ATOMIC);
 
                 if (pi->remote_max_tx &&
                                 bt_cb(skb)->retries == pi->remote_max_tx) {
@@ -1376,6 +1375,8 @@ static int l2cap_ertm_send(struct sock *sk)
                         break;
                 }
 
+                tx_skb = skb_clone(skb, GFP_ATOMIC);
+
                 bt_cb(skb)->retries++;
 
                 control = get_unaligned_le16(tx_skb->data + L2CAP_HDR_SIZE);
@@ -3518,7 +3519,6 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
         struct l2cap_pinfo *pi;
         u16 control, len;
         u8 tx_seq;
-        int err;
 
         sk = l2cap_get_chan_by_scid(&conn->chan_list, cid);
         if (!sk) {
@@ -3570,13 +3570,11 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                         goto drop;
 
                 if (__is_iframe(control))
-                        err = l2cap_data_channel_iframe(sk, control, skb);
+                        l2cap_data_channel_iframe(sk, control, skb);
                 else
-                        err = l2cap_data_channel_sframe(sk, control, skb);
+                        l2cap_data_channel_sframe(sk, control, skb);
 
-                if (!err)
-                        goto done;
-                break;
+                goto done;
 
         case L2CAP_MODE_STREAMING:
                 control = get_unaligned_le16(skb->data);
@@ -3602,7 +3600,7 @@ static inline int l2cap_data_channel(struct l2cap_conn *conn, u16 cid, struct sk
                 else
                         pi->expected_tx_seq = tx_seq + 1;
 
-                err = l2cap_sar_reassembly_sdu(sk, skb, control);
+                l2cap_sar_reassembly_sdu(sk, skb, control);
 
                 goto done;
 
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 312c20adc83f..624a54832a7c 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -63,6 +63,7 @@ struct nf_ct_frag6_queue
         struct inet_frag_queue  q;
 
         __be32                  id;             /* fragment id          */
+        u32                     user;
         struct in6_addr         saddr;
         struct in6_addr         daddr;
 
diff --git a/net/mac80211/driver-trace.h b/net/mac80211/driver-trace.h
index ee94ea0c67e9..da8497ef7063 100644
--- a/net/mac80211/driver-trace.h
+++ b/net/mac80211/driver-trace.h
@@ -680,7 +680,7 @@ TRACE_EVENT(drv_ampdu_action,
                 __entry->ret = ret;
                 __entry->action = action;
                 __entry->tid = tid;
-                __entry->ssn = *ssn;
+                __entry->ssn = ssn ? *ssn : 0;
         ),
 
         TP_printk(
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 59d8064eb522..42f21c01a93e 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1437,8 +1437,9 @@ ctnetlink_exp_dump_mask(struct sk_buff *skb,
         struct nlattr *nest_parms;
 
         memset(&m, 0xFF, sizeof(m));
-        m.src.u.all = mask->src.u.all;
         memcpy(&m.src.u3, &mask->src.u3, sizeof(m.src.u3));
+        m.src.u.all = mask->src.u.all;
+        m.dst.protonum = tuple->dst.protonum;
 
         nest_parms = nla_nest_start(skb, CTA_EXPECT_MASK | NLA_F_NESTED);
         if (!nest_parms)
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index 4b572163784b..023966b569bf 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -376,7 +376,7 @@ int ct_sip_get_header(const struct nf_conn *ct, const char *dptr,
                         dptr += hdr->len;
                 else if (hdr->cname && limit - dptr >= hdr->clen + 1 &&
                          strnicmp(dptr, hdr->cname, hdr->clen) == 0 &&
-                         !isalpha(*(dptr + hdr->clen + 1)))
+                         !isalpha(*(dptr + hdr->clen)))
                         dptr += hdr->clen;
                 else
                         continue;