aboutsummaryrefslogtreecommitdiffstats
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/9p/client.c34
-rw-r--r--net/9p/error.c2
-rw-r--r--net/9p/trans_fd.c22
-rw-r--r--net/9p/trans_rdma.c9
-rw-r--r--net/9p/trans_virtio.c11
-rw-r--r--net/appletalk/ddp.c2
-rw-r--r--net/atm/common.c6
-rw-r--r--net/bluetooth/rfcomm/core.c27
-rw-r--r--net/bluetooth/rfcomm/sock.c2
-rw-r--r--net/bridge/br_if.c2
-rw-r--r--net/can/bcm.c4
-rw-r--r--net/can/raw.c5
-rw-r--r--net/core/datagram.c2
-rw-r--r--net/core/dev.c25
-rw-r--r--net/core/gen_estimator.c12
-rw-r--r--net/core/gen_stats.c11
-rw-r--r--net/core/net_namespace.c2
-rw-r--r--net/core/netpoll.c7
-rw-r--r--net/core/sock.c51
-rw-r--r--net/dccp/output.c2
-rw-r--r--net/dccp/proto.c7
-rw-r--r--net/dsa/mv88e6xxx.c2
-rw-r--r--net/econet/af_econet.c1
-rw-r--r--net/ieee802154/af_ieee802154.c8
-rw-r--r--net/ieee802154/dgram.c14
-rw-r--r--net/ieee802154/raw.c14
-rw-r--r--net/ipv4/arp.c4
-rw-r--r--net/ipv4/fib_trie.c4
-rw-r--r--net/ipv4/ip_gre.c6
-rw-r--r--net/ipv4/ip_output.c3
-rw-r--r--net/ipv4/tcp.c2
-rw-r--r--net/ipv4/tcp_cong.c4
-rw-r--r--net/ipv4/tcp_ipv4.c3
-rw-r--r--net/ipv4/tcp_output.c2
-rw-r--r--net/ipv4/xfrm4_policy.c3
-rw-r--r--net/ipv6/addrconf.c30
-rw-r--r--net/ipv6/af_inet6.c4
-rw-r--r--net/ipv6/ip6_output.c1
-rw-r--r--net/ipv6/sit.c1
-rw-r--r--net/ipv6/tcp_ipv6.c3
-rw-r--r--net/ipv6/xfrm6_policy.c6
-rw-r--r--net/ipx/af_ipx.c1
-rw-r--r--net/irda/af_irda.c2
-rw-r--r--net/irda/irnet/irnet.h1
-rw-r--r--net/irda/irnet/irnet_ppp.c1
-rw-r--r--net/irda/irttp.c1
-rw-r--r--net/iucv/af_iucv.c4
-rw-r--r--net/llc/af_llc.c1
-rw-r--r--net/mac80211/Kconfig1
-rw-r--r--net/mac80211/agg-tx.c8
-rw-r--r--net/mac80211/key.c28
-rw-r--r--net/mac80211/mesh_hwmp.c2
-rw-r--r--net/mac80211/mesh_pathtbl.c11
-rw-r--r--net/mac80211/mlme.c2
-rw-r--r--net/mac80211/pm.c24
-rw-r--r--net/mac80211/rc80211_minstrel.c5
-rw-r--r--net/mac80211/rx.c12
-rw-r--r--net/mac80211/tx.c2
-rw-r--r--net/netfilter/nf_conntrack_core.c21
-rw-r--r--net/netfilter/xt_RATEEST.c2
-rw-r--r--net/netfilter/xt_osf.c5
-rw-r--r--net/netfilter/xt_quota.c2
-rw-r--r--net/netlabel/netlabel_kapi.c2
-rw-r--r--net/netrom/af_netrom.c1
-rw-r--r--net/netrom/nr_route.c21
-rw-r--r--net/phonet/pn_dev.c2
-rw-r--r--net/rfkill/core.c31
-rw-r--r--net/rose/af_rose.c19
-rw-r--r--net/rose/rose_route.c23
-rw-r--r--net/rxrpc/af_rxrpc.c4
-rw-r--r--net/sched/sch_api.c2
-rw-r--r--net/sched/sch_atm.c2
-rw-r--r--net/sched/sch_cbq.c2
-rw-r--r--net/sched/sch_drr.c2
-rw-r--r--net/sched/sch_hfsc.c2
-rw-r--r--net/sched/sch_htb.c2
-rw-r--r--net/sctp/protocol.c1
-rw-r--r--net/sctp/socket.c25
-rw-r--r--net/socket.c2
-rw-r--r--net/sunrpc/clnt.c2
-rw-r--r--net/sunrpc/sched.c1
-rw-r--r--net/sunrpc/svc_xprt.c1
-rw-r--r--net/unix/af_unix.c8
-rw-r--r--net/wanrouter/wanmain.c1
-rw-r--r--net/wireless/nl80211.c6
-rw-r--r--net/wireless/reg.c9
-rw-r--r--net/wireless/reg.h3
-rw-r--r--net/wireless/scan.c8
-rw-r--r--net/x25/af_x25.c1
-rw-r--r--net/xfrm/xfrm_hash.h2
90 files changed, 436 insertions, 245 deletions
diff --git a/net/9p/client.c b/net/9p/client.c
index dd43a8289b0d..5bf5f227dbe0 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c
@@ -60,9 +60,9 @@ static struct p9_req_t *
60p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...); 60p9_client_rpc(struct p9_client *c, int8_t type, const char *fmt, ...);
61 61
62/** 62/**
63 * v9fs_parse_options - parse mount options into session structure 63 * parse_options - parse mount options into client structure
64 * @options: options string passed from mount 64 * @opts: options string passed from mount
65 * @v9ses: existing v9fs session information 65 * @clnt: existing v9fs client information
66 * 66 *
67 * Return 0 upon success, -ERRNO upon failure 67 * Return 0 upon success, -ERRNO upon failure
68 */ 68 */
@@ -117,9 +117,6 @@ static int parse_opts(char *opts, struct p9_client *clnt)
117 } 117 }
118 } 118 }
119 119
120 if (!clnt->trans_mod)
121 clnt->trans_mod = v9fs_get_default_trans();
122
123 kfree(options); 120 kfree(options);
124 return ret; 121 return ret;
125} 122}
@@ -235,7 +232,7 @@ EXPORT_SYMBOL(p9_tag_lookup);
235 232
236/** 233/**
237 * p9_tag_init - setup tags structure and contents 234 * p9_tag_init - setup tags structure and contents
238 * @tags: tags structure from the client struct 235 * @c: v9fs client struct
239 * 236 *
240 * This initializes the tags structure for each client instance. 237 * This initializes the tags structure for each client instance.
241 * 238 *
@@ -261,7 +258,7 @@ error:
261 258
262/** 259/**
263 * p9_tag_cleanup - cleans up tags structure and reclaims resources 260 * p9_tag_cleanup - cleans up tags structure and reclaims resources
264 * @tags: tags structure from the client struct 261 * @c: v9fs client struct
265 * 262 *
266 * This frees resources associated with the tags structure 263 * This frees resources associated with the tags structure
267 * 264 *
@@ -414,14 +411,9 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
414 if (c->dotu) 411 if (c->dotu)
415 err = -ecode; 412 err = -ecode;
416 413
417 if (!err) { 414 if (!err || !IS_ERR_VALUE(err))
418 err = p9_errstr2errno(ename, strlen(ename)); 415 err = p9_errstr2errno(ename, strlen(ename));
419 416
420 /* string match failed */
421 if (!err)
422 err = -ESERVERFAULT;
423 }
424
425 P9_DPRINTK(P9_DEBUG_9P, "<<< RERROR (%d) %s\n", -ecode, ename); 417 P9_DPRINTK(P9_DEBUG_9P, "<<< RERROR (%d) %s\n", -ecode, ename);
426 418
427 kfree(ename); 419 kfree(ename);
@@ -433,8 +425,8 @@ static int p9_check_errors(struct p9_client *c, struct p9_req_t *req)
433 425
434/** 426/**
435 * p9_client_flush - flush (cancel) a request 427 * p9_client_flush - flush (cancel) a request
436 * c: client state 428 * @c: client state
437 * req: request to cancel 429 * @oldreq: request to cancel
438 * 430 *
439 * This sents a flush for a particular requests and links 431 * This sents a flush for a particular requests and links
440 * the flush request to the original request. The current 432 * the flush request to the original request. The current
@@ -689,6 +681,9 @@ struct p9_client *p9_client_create(const char *dev_name, char *options)
689 if (err < 0) 681 if (err < 0)
690 goto error; 682 goto error;
691 683
684 if (!clnt->trans_mod)
685 clnt->trans_mod = v9fs_get_default_trans();
686
692 if (clnt->trans_mod == NULL) { 687 if (clnt->trans_mod == NULL) {
693 err = -EPROTONOSUPPORT; 688 err = -EPROTONOSUPPORT;
694 P9_DPRINTK(P9_DEBUG_ERROR, 689 P9_DPRINTK(P9_DEBUG_ERROR,
@@ -1098,7 +1093,6 @@ p9_client_read(struct p9_fid *fid, char *data, char __user *udata, u64 offset,
1098 1093
1099 if (data) { 1094 if (data) {
1100 memmove(data, dataptr, count); 1095 memmove(data, dataptr, count);
1101 data += count;
1102 } 1096 }
1103 1097
1104 if (udata) { 1098 if (udata) {
@@ -1192,9 +1186,9 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
1192 1186
1193 err = p9pdu_readf(req->rc, clnt->dotu, "wS", &ignored, ret); 1187 err = p9pdu_readf(req->rc, clnt->dotu, "wS", &ignored, ret);
1194 if (err) { 1188 if (err) {
1195 ret = ERR_PTR(err);
1196 p9pdu_dump(1, req->rc); 1189 p9pdu_dump(1, req->rc);
1197 goto free_and_error; 1190 p9_free_req(clnt, req);
1191 goto error;
1198 } 1192 }
1199 1193
1200 P9_DPRINTK(P9_DEBUG_9P, 1194 P9_DPRINTK(P9_DEBUG_9P,
@@ -1211,8 +1205,6 @@ struct p9_wstat *p9_client_stat(struct p9_fid *fid)
1211 p9_free_req(clnt, req); 1205 p9_free_req(clnt, req);
1212 return ret; 1206 return ret;
1213 1207
1214free_and_error:
1215 p9_free_req(clnt, req);
1216error: 1208error:
1217 kfree(ret); 1209 kfree(ret);
1218 return ERR_PTR(err); 1210 return ERR_PTR(err);
diff --git a/net/9p/error.c b/net/9p/error.c
index fdebe4314062..52518512a93e 100644
--- a/net/9p/error.c
+++ b/net/9p/error.c
@@ -239,7 +239,7 @@ int p9_errstr2errno(char *errstr, int len)
239 errstr[len] = 0; 239 errstr[len] = 0;
240 printk(KERN_ERR "%s: server reported unknown error %s\n", 240 printk(KERN_ERR "%s: server reported unknown error %s\n",
241 __func__, errstr); 241 __func__, errstr);
242 errno = 1; 242 errno = ESERVERFAULT;
243 } 243 }
244 244
245 return -errno; 245 return -errno;
diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
index a2a1814c7a8d..8d934dd7fd54 100644
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@ -119,8 +119,8 @@ struct p9_poll_wait {
119 * @wpos: write position for current frame 119 * @wpos: write position for current frame
120 * @wsize: amount of data to write for current frame 120 * @wsize: amount of data to write for current frame
121 * @wbuf: current write buffer 121 * @wbuf: current write buffer
122 * @poll_pending_link: pending links to be polled per conn
122 * @poll_wait: array of wait_q's for various worker threads 123 * @poll_wait: array of wait_q's for various worker threads
123 * @poll_waddr: ????
124 * @pt: poll state 124 * @pt: poll state
125 * @rq: current read work 125 * @rq: current read work
126 * @wq: current write work 126 * @wq: current write work
@@ -700,9 +700,9 @@ static int p9_fd_cancel(struct p9_client *client, struct p9_req_t *req)
700} 700}
701 701
702/** 702/**
703 * parse_options - parse mount options into session structure 703 * parse_opts - parse mount options into p9_fd_opts structure
704 * @options: options string passed from mount 704 * @params: options string passed from mount
705 * @opts: transport-specific structure to parse options into 705 * @opts: fd transport-specific structure to parse options into
706 * 706 *
707 * Returns 0 upon success, -ERRNO upon failure 707 * Returns 0 upon success, -ERRNO upon failure
708 */ 708 */
@@ -735,12 +735,14 @@ static int parse_opts(char *params, struct p9_fd_opts *opts)
735 if (!*p) 735 if (!*p)
736 continue; 736 continue;
737 token = match_token(p, tokens, args); 737 token = match_token(p, tokens, args);
738 r = match_int(&args[0], &option); 738 if (token != Opt_err) {
739 if (r < 0) { 739 r = match_int(&args[0], &option);
740 P9_DPRINTK(P9_DEBUG_ERROR, 740 if (r < 0) {
741 "integer field, but no integer?\n"); 741 P9_DPRINTK(P9_DEBUG_ERROR,
742 ret = r; 742 "integer field, but no integer?\n");
743 continue; 743 ret = r;
744 continue;
745 }
744 } 746 }
745 switch (token) { 747 switch (token) {
746 case Opt_port: 748 case Opt_port:
diff --git a/net/9p/trans_rdma.c b/net/9p/trans_rdma.c
index ac4990041ebb..65cb29db03f8 100644
--- a/net/9p/trans_rdma.c
+++ b/net/9p/trans_rdma.c
@@ -67,14 +67,15 @@
67 * @pd: Protection Domain pointer 67 * @pd: Protection Domain pointer
68 * @qp: Queue Pair pointer 68 * @qp: Queue Pair pointer
69 * @cq: Completion Queue pointer 69 * @cq: Completion Queue pointer
70 * @dm_mr: DMA Memory Region pointer
70 * @lkey: The local access only memory region key 71 * @lkey: The local access only memory region key
71 * @timeout: Number of uSecs to wait for connection management events 72 * @timeout: Number of uSecs to wait for connection management events
72 * @sq_depth: The depth of the Send Queue 73 * @sq_depth: The depth of the Send Queue
73 * @sq_sem: Semaphore for the SQ 74 * @sq_sem: Semaphore for the SQ
74 * @rq_depth: The depth of the Receive Queue. 75 * @rq_depth: The depth of the Receive Queue.
76 * @rq_count: Count of requests in the Receive Queue.
75 * @addr: The remote peer's address 77 * @addr: The remote peer's address
76 * @req_lock: Protects the active request list 78 * @req_lock: Protects the active request list
77 * @send_wait: Wait list when the SQ fills up
78 * @cm_done: Completion event for connection management tracking 79 * @cm_done: Completion event for connection management tracking
79 */ 80 */
80struct p9_trans_rdma { 81struct p9_trans_rdma {
@@ -154,9 +155,9 @@ static match_table_t tokens = {
154}; 155};
155 156
156/** 157/**
157 * parse_options - parse mount options into session structure 158 * parse_opts - parse mount options into rdma options structure
158 * @options: options string passed from mount 159 * @params: options string passed from mount
159 * @opts: transport-specific structure to parse options into 160 * @opts: rdma transport-specific structure to parse options into
160 * 161 *
161 * Returns 0 upon success, -ERRNO upon failure 162 * Returns 0 upon success, -ERRNO upon failure
162 */ 163 */
diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
index a49484e67e1d..9bf0b737aa51 100644
--- a/net/9p/trans_virtio.c
+++ b/net/9p/trans_virtio.c
@@ -57,11 +57,9 @@ static int chan_index;
57 * @initialized: whether the channel is initialized 57 * @initialized: whether the channel is initialized
58 * @inuse: whether the channel is in use 58 * @inuse: whether the channel is in use
59 * @lock: protects multiple elements within this structure 59 * @lock: protects multiple elements within this structure
60 * @client: client instance
60 * @vdev: virtio dev associated with this channel 61 * @vdev: virtio dev associated with this channel
61 * @vq: virtio queue associated with this channel 62 * @vq: virtio queue associated with this channel
62 * @tagpool: accounting for tag ids (and request slots)
63 * @reqs: array of request slots
64 * @max_tag: current number of request_slots allocated
65 * @sg: scatter gather list which is used to pack a request (protected?) 63 * @sg: scatter gather list which is used to pack a request (protected?)
66 * 64 *
67 * We keep all per-channel information in a structure. 65 * We keep all per-channel information in a structure.
@@ -92,7 +90,7 @@ static unsigned int rest_of_page(void *data)
92 90
93/** 91/**
94 * p9_virtio_close - reclaim resources of a channel 92 * p9_virtio_close - reclaim resources of a channel
95 * @trans: transport state 93 * @client: client instance
96 * 94 *
97 * This reclaims a channel by freeing its resources and 95 * This reclaims a channel by freeing its resources and
98 * reseting its inuse flag. 96 * reseting its inuse flag.
@@ -181,9 +179,8 @@ static int p9_virtio_cancel(struct p9_client *client, struct p9_req_t *req)
181 179
182/** 180/**
183 * p9_virtio_request - issue a request 181 * p9_virtio_request - issue a request
184 * @t: transport state 182 * @client: client instance issuing the request
185 * @tc: &p9_fcall request to transmit 183 * @req: request to be issued
186 * @rc: &p9_fcall to put reponse into
187 * 184 *
188 */ 185 */
189 186
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c
index 590b83963622..875eda5dbad7 100644
--- a/net/appletalk/ddp.c
+++ b/net/appletalk/ddp.c
@@ -54,6 +54,7 @@
54#include <linux/capability.h> 54#include <linux/capability.h>
55#include <linux/module.h> 55#include <linux/module.h>
56#include <linux/if_arp.h> 56#include <linux/if_arp.h>
57#include <linux/smp_lock.h>
57#include <linux/termios.h> /* For TIOCOUTQ/INQ */ 58#include <linux/termios.h> /* For TIOCOUTQ/INQ */
58#include <net/datalink.h> 59#include <net/datalink.h>
59#include <net/psnap.h> 60#include <net/psnap.h>
@@ -1237,6 +1238,7 @@ static int atalk_getname(struct socket *sock, struct sockaddr *uaddr,
1237 return -ENOBUFS; 1238 return -ENOBUFS;
1238 1239
1239 *uaddr_len = sizeof(struct sockaddr_at); 1240 *uaddr_len = sizeof(struct sockaddr_at);
1241 memset(&sat.sat_zero, 0, sizeof(sat.sat_zero));
1240 1242
1241 if (peer) { 1243 if (peer) {
1242 if (sk->sk_state != TCP_ESTABLISHED) 1244 if (sk->sk_state != TCP_ESTABLISHED)
diff --git a/net/atm/common.c b/net/atm/common.c
index c1c97936192c..8c4d843eb17f 100644
--- a/net/atm/common.c
+++ b/net/atm/common.c
@@ -92,7 +92,7 @@ static void vcc_sock_destruct(struct sock *sk)
92static void vcc_def_wakeup(struct sock *sk) 92static void vcc_def_wakeup(struct sock *sk)
93{ 93{
94 read_lock(&sk->sk_callback_lock); 94 read_lock(&sk->sk_callback_lock);
95 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 95 if (sk_has_sleeper(sk))
96 wake_up(sk->sk_sleep); 96 wake_up(sk->sk_sleep);
97 read_unlock(&sk->sk_callback_lock); 97 read_unlock(&sk->sk_callback_lock);
98} 98}
@@ -110,7 +110,7 @@ static void vcc_write_space(struct sock *sk)
110 read_lock(&sk->sk_callback_lock); 110 read_lock(&sk->sk_callback_lock);
111 111
112 if (vcc_writable(sk)) { 112 if (vcc_writable(sk)) {
113 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 113 if (sk_has_sleeper(sk))
114 wake_up_interruptible(sk->sk_sleep); 114 wake_up_interruptible(sk->sk_sleep);
115 115
116 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT); 116 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
@@ -594,7 +594,7 @@ unsigned int vcc_poll(struct file *file, struct socket *sock, poll_table *wait)
594 struct atm_vcc *vcc; 594 struct atm_vcc *vcc;
595 unsigned int mask; 595 unsigned int mask;
596 596
597 poll_wait(file, sk->sk_sleep, wait); 597 sock_poll_wait(file, sk->sk_sleep, wait);
598 mask = 0; 598 mask = 0;
599 599
600 vcc = ATM_SD(sock); 600 vcc = ATM_SD(sock);
diff --git a/net/bluetooth/rfcomm/core.c b/net/bluetooth/rfcomm/core.c
index e50566ebf9f9..94b3388c188b 100644
--- a/net/bluetooth/rfcomm/core.c
+++ b/net/bluetooth/rfcomm/core.c
@@ -2080,28 +2080,41 @@ static CLASS_ATTR(rfcomm_dlc, S_IRUGO, rfcomm_dlc_sysfs_show, NULL);
2080/* ---- Initialization ---- */ 2080/* ---- Initialization ---- */
2081static int __init rfcomm_init(void) 2081static int __init rfcomm_init(void)
2082{ 2082{
2083 int ret;
2084
2083 l2cap_load(); 2085 l2cap_load();
2084 2086
2085 hci_register_cb(&rfcomm_cb); 2087 hci_register_cb(&rfcomm_cb);
2086 2088
2087 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd"); 2089 rfcomm_thread = kthread_run(rfcomm_run, NULL, "krfcommd");
2088 if (IS_ERR(rfcomm_thread)) { 2090 if (IS_ERR(rfcomm_thread)) {
2089 hci_unregister_cb(&rfcomm_cb); 2091 ret = PTR_ERR(rfcomm_thread);
2090 return PTR_ERR(rfcomm_thread); 2092 goto out_thread;
2091 } 2093 }
2092 2094
2093 if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0) 2095 if (class_create_file(bt_class, &class_attr_rfcomm_dlc) < 0)
2094 BT_ERR("Failed to create RFCOMM info file"); 2096 BT_ERR("Failed to create RFCOMM info file");
2095 2097
2096 rfcomm_init_sockets(); 2098 ret = rfcomm_init_ttys();
2099 if (ret)
2100 goto out_tty;
2097 2101
2098#ifdef CONFIG_BT_RFCOMM_TTY 2102 ret = rfcomm_init_sockets();
2099 rfcomm_init_ttys(); 2103 if (ret)
2100#endif 2104 goto out_sock;
2101 2105
2102 BT_INFO("RFCOMM ver %s", VERSION); 2106 BT_INFO("RFCOMM ver %s", VERSION);
2103 2107
2104 return 0; 2108 return 0;
2109
2110out_sock:
2111 rfcomm_cleanup_ttys();
2112out_tty:
2113 kthread_stop(rfcomm_thread);
2114out_thread:
2115 hci_unregister_cb(&rfcomm_cb);
2116
2117 return ret;
2105} 2118}
2106 2119
2107static void __exit rfcomm_exit(void) 2120static void __exit rfcomm_exit(void)
@@ -2112,9 +2125,7 @@ static void __exit rfcomm_exit(void)
2112 2125
2113 kthread_stop(rfcomm_thread); 2126 kthread_stop(rfcomm_thread);
2114 2127
2115#ifdef CONFIG_BT_RFCOMM_TTY
2116 rfcomm_cleanup_ttys(); 2128 rfcomm_cleanup_ttys();
2117#endif
2118 2129
2119 rfcomm_cleanup_sockets(); 2130 rfcomm_cleanup_sockets();
2120} 2131}
diff --git a/net/bluetooth/rfcomm/sock.c b/net/bluetooth/rfcomm/sock.c
index 7f482784e9f7..0b85e8116859 100644
--- a/net/bluetooth/rfcomm/sock.c
+++ b/net/bluetooth/rfcomm/sock.c
@@ -1132,7 +1132,7 @@ error:
1132 return err; 1132 return err;
1133} 1133}
1134 1134
1135void __exit rfcomm_cleanup_sockets(void) 1135void rfcomm_cleanup_sockets(void)
1136{ 1136{
1137 class_remove_file(bt_class, &class_attr_rfcomm); 1137 class_remove_file(bt_class, &class_attr_rfcomm);
1138 1138
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 8a96672e2c5c..eb404dc3ed6e 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -424,7 +424,7 @@ int br_add_if(struct net_bridge *br, struct net_device *dev)
424err2: 424err2:
425 br_fdb_delete_by_port(br, p, 1); 425 br_fdb_delete_by_port(br, p, 1);
426err1: 426err1:
427 kobject_del(&p->kobj); 427 kobject_put(&p->kobj);
428err0: 428err0:
429 dev_set_promiscuity(dev, -1); 429 dev_set_promiscuity(dev, -1);
430put_back: 430put_back:
diff --git a/net/can/bcm.c b/net/can/bcm.c
index 95d7f32643ae..72720c710351 100644
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -75,6 +75,7 @@ static __initdata const char banner[] = KERN_INFO
75MODULE_DESCRIPTION("PF_CAN broadcast manager protocol"); 75MODULE_DESCRIPTION("PF_CAN broadcast manager protocol");
76MODULE_LICENSE("Dual BSD/GPL"); 76MODULE_LICENSE("Dual BSD/GPL");
77MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>"); 77MODULE_AUTHOR("Oliver Hartkopp <oliver.hartkopp@volkswagen.de>");
78MODULE_ALIAS("can-proto-2");
78 79
79/* easy access to can_frame payload */ 80/* easy access to can_frame payload */
80static inline u64 GET_U64(const struct can_frame *cp) 81static inline u64 GET_U64(const struct can_frame *cp)
@@ -1469,6 +1470,9 @@ static int bcm_release(struct socket *sock)
1469 bo->ifindex = 0; 1470 bo->ifindex = 0;
1470 } 1471 }
1471 1472
1473 sock_orphan(sk);
1474 sock->sk = NULL;
1475
1472 release_sock(sk); 1476 release_sock(sk);
1473 sock_put(sk); 1477 sock_put(sk);
1474 1478
diff --git a/net/can/raw.c b/net/can/raw.c
index 6aa154e806ae..db3152df7d2b 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -62,6 +62,7 @@ static __initdata const char banner[] =
62MODULE_DESCRIPTION("PF_CAN raw protocol"); 62MODULE_DESCRIPTION("PF_CAN raw protocol");
63MODULE_LICENSE("Dual BSD/GPL"); 63MODULE_LICENSE("Dual BSD/GPL");
64MODULE_AUTHOR("Urs Thuermann <urs.thuermann@volkswagen.de>"); 64MODULE_AUTHOR("Urs Thuermann <urs.thuermann@volkswagen.de>");
65MODULE_ALIAS("can-proto-1");
65 66
66#define MASK_ALL 0 67#define MASK_ALL 0
67 68
@@ -306,6 +307,9 @@ static int raw_release(struct socket *sock)
306 ro->bound = 0; 307 ro->bound = 0;
307 ro->count = 0; 308 ro->count = 0;
308 309
310 sock_orphan(sk);
311 sock->sk = NULL;
312
309 release_sock(sk); 313 release_sock(sk);
310 sock_put(sk); 314 sock_put(sk);
311 315
@@ -397,6 +401,7 @@ static int raw_getname(struct socket *sock, struct sockaddr *uaddr,
397 if (peer) 401 if (peer)
398 return -EOPNOTSUPP; 402 return -EOPNOTSUPP;
399 403
404 memset(addr, 0, sizeof(*addr));
400 addr->can_family = AF_CAN; 405 addr->can_family = AF_CAN;
401 addr->can_ifindex = ro->ifindex; 406 addr->can_ifindex = ro->ifindex;
402 407
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 58abee1f1df1..b0fe69211eef 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -712,7 +712,7 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
712 struct sock *sk = sock->sk; 712 struct sock *sk = sock->sk;
713 unsigned int mask; 713 unsigned int mask;
714 714
715 poll_wait(file, sk->sk_sleep, wait); 715 sock_poll_wait(file, sk->sk_sleep, wait);
716 mask = 0; 716 mask = 0;
717 717
718 /* exceptional events? */ 718 /* exceptional events? */
diff --git a/net/core/dev.c b/net/core/dev.c
index 70c27e0c7c32..278d489aad3b 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1031,7 +1031,7 @@ void dev_load(struct net *net, const char *name)
1031 dev = __dev_get_by_name(net, name); 1031 dev = __dev_get_by_name(net, name);
1032 read_unlock(&dev_base_lock); 1032 read_unlock(&dev_base_lock);
1033 1033
1034 if (!dev && capable(CAP_SYS_MODULE)) 1034 if (!dev && capable(CAP_NET_ADMIN))
1035 request_module("%s", name); 1035 request_module("%s", name);
1036} 1036}
1037 1037
@@ -3865,10 +3865,12 @@ int dev_unicast_delete(struct net_device *dev, void *addr)
3865 3865
3866 ASSERT_RTNL(); 3866 ASSERT_RTNL();
3867 3867
3868 netif_addr_lock_bh(dev);
3868 err = __hw_addr_del(&dev->uc, addr, dev->addr_len, 3869 err = __hw_addr_del(&dev->uc, addr, dev->addr_len,
3869 NETDEV_HW_ADDR_T_UNICAST); 3870 NETDEV_HW_ADDR_T_UNICAST);
3870 if (!err) 3871 if (!err)
3871 __dev_set_rx_mode(dev); 3872 __dev_set_rx_mode(dev);
3873 netif_addr_unlock_bh(dev);
3872 return err; 3874 return err;
3873} 3875}
3874EXPORT_SYMBOL(dev_unicast_delete); 3876EXPORT_SYMBOL(dev_unicast_delete);
@@ -3889,10 +3891,12 @@ int dev_unicast_add(struct net_device *dev, void *addr)
3889 3891
3890 ASSERT_RTNL(); 3892 ASSERT_RTNL();
3891 3893
3894 netif_addr_lock_bh(dev);
3892 err = __hw_addr_add(&dev->uc, addr, dev->addr_len, 3895 err = __hw_addr_add(&dev->uc, addr, dev->addr_len,
3893 NETDEV_HW_ADDR_T_UNICAST); 3896 NETDEV_HW_ADDR_T_UNICAST);
3894 if (!err) 3897 if (!err)
3895 __dev_set_rx_mode(dev); 3898 __dev_set_rx_mode(dev);
3899 netif_addr_unlock_bh(dev);
3896 return err; 3900 return err;
3897} 3901}
3898EXPORT_SYMBOL(dev_unicast_add); 3902EXPORT_SYMBOL(dev_unicast_add);
@@ -3949,7 +3953,8 @@ void __dev_addr_unsync(struct dev_addr_list **to, int *to_count,
3949 * @from: source device 3953 * @from: source device
3950 * 3954 *
3951 * Add newly added addresses to the destination device and release 3955 * Add newly added addresses to the destination device and release
3952 * addresses that have no users left. 3956 * addresses that have no users left. The source device must be
3957 * locked by netif_tx_lock_bh.
3953 * 3958 *
3954 * This function is intended to be called from the dev->set_rx_mode 3959 * This function is intended to be called from the dev->set_rx_mode
3955 * function of layered software devices. 3960 * function of layered software devices.
@@ -3958,14 +3963,14 @@ int dev_unicast_sync(struct net_device *to, struct net_device *from)
3958{ 3963{
3959 int err = 0; 3964 int err = 0;
3960 3965
3961 ASSERT_RTNL();
3962
3963 if (to->addr_len != from->addr_len) 3966 if (to->addr_len != from->addr_len)
3964 return -EINVAL; 3967 return -EINVAL;
3965 3968
3969 netif_addr_lock_bh(to);
3966 err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len); 3970 err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
3967 if (!err) 3971 if (!err)
3968 __dev_set_rx_mode(to); 3972 __dev_set_rx_mode(to);
3973 netif_addr_unlock_bh(to);
3969 return err; 3974 return err;
3970} 3975}
3971EXPORT_SYMBOL(dev_unicast_sync); 3976EXPORT_SYMBOL(dev_unicast_sync);
@@ -3981,27 +3986,27 @@ EXPORT_SYMBOL(dev_unicast_sync);
3981 */ 3986 */
3982void dev_unicast_unsync(struct net_device *to, struct net_device *from) 3987void dev_unicast_unsync(struct net_device *to, struct net_device *from)
3983{ 3988{
3984 ASSERT_RTNL();
3985
3986 if (to->addr_len != from->addr_len) 3989 if (to->addr_len != from->addr_len)
3987 return; 3990 return;
3988 3991
3992 netif_addr_lock_bh(from);
3993 netif_addr_lock(to);
3989 __hw_addr_unsync(&to->uc, &from->uc, to->addr_len); 3994 __hw_addr_unsync(&to->uc, &from->uc, to->addr_len);
3990 __dev_set_rx_mode(to); 3995 __dev_set_rx_mode(to);
3996 netif_addr_unlock(to);
3997 netif_addr_unlock_bh(from);
3991} 3998}
3992EXPORT_SYMBOL(dev_unicast_unsync); 3999EXPORT_SYMBOL(dev_unicast_unsync);
3993 4000
3994static void dev_unicast_flush(struct net_device *dev) 4001static void dev_unicast_flush(struct net_device *dev)
3995{ 4002{
3996 /* rtnl_mutex must be held here */ 4003 netif_addr_lock_bh(dev);
3997
3998 __hw_addr_flush(&dev->uc); 4004 __hw_addr_flush(&dev->uc);
4005 netif_addr_unlock_bh(dev);
3999} 4006}
4000 4007
4001static void dev_unicast_init(struct net_device *dev) 4008static void dev_unicast_init(struct net_device *dev)
4002{ 4009{
4003 /* rtnl_mutex must be held here */
4004
4005 __hw_addr_init(&dev->uc); 4010 __hw_addr_init(&dev->uc);
4006} 4011}
4007 4012
diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
index 78e5bfc454ae..493775f4f2f1 100644
--- a/net/core/gen_estimator.c
+++ b/net/core/gen_estimator.c
@@ -81,7 +81,7 @@
81struct gen_estimator 81struct gen_estimator
82{ 82{
83 struct list_head list; 83 struct list_head list;
84 struct gnet_stats_basic *bstats; 84 struct gnet_stats_basic_packed *bstats;
85 struct gnet_stats_rate_est *rate_est; 85 struct gnet_stats_rate_est *rate_est;
86 spinlock_t *stats_lock; 86 spinlock_t *stats_lock;
87 int ewma_log; 87 int ewma_log;
@@ -165,7 +165,7 @@ static void gen_add_node(struct gen_estimator *est)
165} 165}
166 166
167static 167static
168struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats, 168struct gen_estimator *gen_find_node(const struct gnet_stats_basic_packed *bstats,
169 const struct gnet_stats_rate_est *rate_est) 169 const struct gnet_stats_rate_est *rate_est)
170{ 170{
171 struct rb_node *p = est_root.rb_node; 171 struct rb_node *p = est_root.rb_node;
@@ -202,7 +202,7 @@ struct gen_estimator *gen_find_node(const struct gnet_stats_basic *bstats,
202 * 202 *
203 * NOTE: Called under rtnl_mutex 203 * NOTE: Called under rtnl_mutex
204 */ 204 */
205int gen_new_estimator(struct gnet_stats_basic *bstats, 205int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
206 struct gnet_stats_rate_est *rate_est, 206 struct gnet_stats_rate_est *rate_est,
207 spinlock_t *stats_lock, 207 spinlock_t *stats_lock,
208 struct nlattr *opt) 208 struct nlattr *opt)
@@ -262,7 +262,7 @@ static void __gen_kill_estimator(struct rcu_head *head)
262 * 262 *
263 * NOTE: Called under rtnl_mutex 263 * NOTE: Called under rtnl_mutex
264 */ 264 */
265void gen_kill_estimator(struct gnet_stats_basic *bstats, 265void gen_kill_estimator(struct gnet_stats_basic_packed *bstats,
266 struct gnet_stats_rate_est *rate_est) 266 struct gnet_stats_rate_est *rate_est)
267{ 267{
268 struct gen_estimator *e; 268 struct gen_estimator *e;
@@ -292,7 +292,7 @@ EXPORT_SYMBOL(gen_kill_estimator);
292 * 292 *
293 * Returns 0 on success or a negative error code. 293 * Returns 0 on success or a negative error code.
294 */ 294 */
295int gen_replace_estimator(struct gnet_stats_basic *bstats, 295int gen_replace_estimator(struct gnet_stats_basic_packed *bstats,
296 struct gnet_stats_rate_est *rate_est, 296 struct gnet_stats_rate_est *rate_est,
297 spinlock_t *stats_lock, struct nlattr *opt) 297 spinlock_t *stats_lock, struct nlattr *opt)
298{ 298{
@@ -308,7 +308,7 @@ EXPORT_SYMBOL(gen_replace_estimator);
308 * 308 *
309 * Returns true if estimator is active, and false if not. 309 * Returns true if estimator is active, and false if not.
310 */ 310 */
311bool gen_estimator_active(const struct gnet_stats_basic *bstats, 311bool gen_estimator_active(const struct gnet_stats_basic_packed *bstats,
312 const struct gnet_stats_rate_est *rate_est) 312 const struct gnet_stats_rate_est *rate_est)
313{ 313{
314 ASSERT_RTNL(); 314 ASSERT_RTNL();
diff --git a/net/core/gen_stats.c b/net/core/gen_stats.c
index c3d0ffeac243..8569310268ab 100644
--- a/net/core/gen_stats.c
+++ b/net/core/gen_stats.c
@@ -106,16 +106,21 @@ gnet_stats_start_copy(struct sk_buff *skb, int type, spinlock_t *lock,
106 * if the room in the socket buffer was not sufficient. 106 * if the room in the socket buffer was not sufficient.
107 */ 107 */
108int 108int
109gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic *b) 109gnet_stats_copy_basic(struct gnet_dump *d, struct gnet_stats_basic_packed *b)
110{ 110{
111 if (d->compat_tc_stats) { 111 if (d->compat_tc_stats) {
112 d->tc_stats.bytes = b->bytes; 112 d->tc_stats.bytes = b->bytes;
113 d->tc_stats.packets = b->packets; 113 d->tc_stats.packets = b->packets;
114 } 114 }
115 115
116 if (d->tail) 116 if (d->tail) {
117 return gnet_stats_copy(d, TCA_STATS_BASIC, b, sizeof(*b)); 117 struct gnet_stats_basic sb;
118 118
119 memset(&sb, 0, sizeof(sb));
120 sb.bytes = b->bytes;
121 sb.packets = b->packets;
122 return gnet_stats_copy(d, TCA_STATS_BASIC, &sb, sizeof(sb));
123 }
119 return 0; 124 return 0;
120} 125}
121 126
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index b7292a2719dc..197283072cc8 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -488,7 +488,7 @@ int net_assign_generic(struct net *net, int id, void *data)
488 */ 488 */
489 489
490 ng->len = id; 490 ng->len = id;
491 memcpy(&ng->ptr, &old_ng->ptr, old_ng->len); 491 memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
492 492
493 rcu_assign_pointer(net->gen, ng); 493 rcu_assign_pointer(net->gen, ng);
494 call_rcu(&old_ng->rcu, net_generic_release); 494 call_rcu(&old_ng->rcu, net_generic_release);
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 9675f312830d..1b76eb11deb4 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -319,6 +319,11 @@ static void netpoll_send_skb(struct netpoll *np, struct sk_buff *skb)
319 319
320 udelay(USEC_PER_POLL); 320 udelay(USEC_PER_POLL);
321 } 321 }
322
323 WARN_ONCE(!irqs_disabled(),
324 "netpoll_send_skb(): %s enabled interrupts in poll (%pF)\n",
325 dev->name, ops->ndo_start_xmit);
326
322 local_irq_restore(flags); 327 local_irq_restore(flags);
323 } 328 }
324 329
@@ -740,7 +745,7 @@ int netpoll_setup(struct netpoll *np)
740 np->name); 745 np->name);
741 break; 746 break;
742 } 747 }
743 cond_resched(); 748 msleep(1);
744 } 749 }
745 750
746 /* If carrier appears to come up instantly, we don't 751 /* If carrier appears to come up instantly, we don't
diff --git a/net/core/sock.c b/net/core/sock.c
index b0ba569bc973..76334228ed1c 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -631,7 +631,7 @@ set_rcvbuf:
631 631
632 case SO_TIMESTAMPING: 632 case SO_TIMESTAMPING:
633 if (val & ~SOF_TIMESTAMPING_MASK) { 633 if (val & ~SOF_TIMESTAMPING_MASK) {
634 ret = EINVAL; 634 ret = -EINVAL;
635 break; 635 break;
636 } 636 }
637 sock_valbool_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE, 637 sock_valbool_flag(sk, SOCK_TIMESTAMPING_TX_HARDWARE,
@@ -919,13 +919,19 @@ static inline void sock_lock_init(struct sock *sk)
919 af_family_keys + sk->sk_family); 919 af_family_keys + sk->sk_family);
920} 920}
921 921
922/*
923 * Copy all fields from osk to nsk but nsk->sk_refcnt must not change yet,
924 * even temporarly, because of RCU lookups. sk_node should also be left as is.
925 */
922static void sock_copy(struct sock *nsk, const struct sock *osk) 926static void sock_copy(struct sock *nsk, const struct sock *osk)
923{ 927{
924#ifdef CONFIG_SECURITY_NETWORK 928#ifdef CONFIG_SECURITY_NETWORK
925 void *sptr = nsk->sk_security; 929 void *sptr = nsk->sk_security;
926#endif 930#endif
927 931 BUILD_BUG_ON(offsetof(struct sock, sk_copy_start) !=
928 memcpy(nsk, osk, osk->sk_prot->obj_size); 932 sizeof(osk->sk_node) + sizeof(osk->sk_refcnt));
933 memcpy(&nsk->sk_copy_start, &osk->sk_copy_start,
934 osk->sk_prot->obj_size - offsetof(struct sock, sk_copy_start));
929#ifdef CONFIG_SECURITY_NETWORK 935#ifdef CONFIG_SECURITY_NETWORK
930 nsk->sk_security = sptr; 936 nsk->sk_security = sptr;
931 security_sk_clone(osk, nsk); 937 security_sk_clone(osk, nsk);
@@ -939,8 +945,23 @@ static struct sock *sk_prot_alloc(struct proto *prot, gfp_t priority,
939 struct kmem_cache *slab; 945 struct kmem_cache *slab;
940 946
941 slab = prot->slab; 947 slab = prot->slab;
942 if (slab != NULL) 948 if (slab != NULL) {
943 sk = kmem_cache_alloc(slab, priority); 949 sk = kmem_cache_alloc(slab, priority & ~__GFP_ZERO);
950 if (!sk)
951 return sk;
952 if (priority & __GFP_ZERO) {
953 /*
954 * caches using SLAB_DESTROY_BY_RCU should let
955 * sk_node.next un-modified. Special care is taken
956 * when initializing object to zero.
957 */
958 if (offsetof(struct sock, sk_node.next) != 0)
959 memset(sk, 0, offsetof(struct sock, sk_node.next));
960 memset(&sk->sk_node.pprev, 0,
961 prot->obj_size - offsetof(struct sock,
962 sk_node.pprev));
963 }
964 }
944 else 965 else
945 sk = kmalloc(prot->obj_size, priority); 966 sk = kmalloc(prot->obj_size, priority);
946 967
@@ -1004,6 +1025,7 @@ struct sock *sk_alloc(struct net *net, int family, gfp_t priority,
1004 sk->sk_prot = sk->sk_prot_creator = prot; 1025 sk->sk_prot = sk->sk_prot_creator = prot;
1005 sock_lock_init(sk); 1026 sock_lock_init(sk);
1006 sock_net_set(sk, get_net(net)); 1027 sock_net_set(sk, get_net(net));
1028 atomic_set(&sk->sk_wmem_alloc, 1);
1007 } 1029 }
1008 1030
1009 return sk; 1031 return sk;
@@ -1125,6 +1147,11 @@ struct sock *sk_clone(const struct sock *sk, const gfp_t priority)
1125 1147
1126 newsk->sk_err = 0; 1148 newsk->sk_err = 0;
1127 newsk->sk_priority = 0; 1149 newsk->sk_priority = 0;
1150 /*
1151 * Before updating sk_refcnt, we must commit prior changes to memory
1152 * (Documentation/RCU/rculist_nulls.txt for details)
1153 */
1154 smp_wmb();
1128 atomic_set(&newsk->sk_refcnt, 2); 1155 atomic_set(&newsk->sk_refcnt, 2);
1129 1156
1130 /* 1157 /*
@@ -1715,7 +1742,7 @@ EXPORT_SYMBOL(sock_no_sendpage);
1715static void sock_def_wakeup(struct sock *sk) 1742static void sock_def_wakeup(struct sock *sk)
1716{ 1743{
1717 read_lock(&sk->sk_callback_lock); 1744 read_lock(&sk->sk_callback_lock);
1718 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 1745 if (sk_has_sleeper(sk))
1719 wake_up_interruptible_all(sk->sk_sleep); 1746 wake_up_interruptible_all(sk->sk_sleep);
1720 read_unlock(&sk->sk_callback_lock); 1747 read_unlock(&sk->sk_callback_lock);
1721} 1748}
@@ -1723,7 +1750,7 @@ static void sock_def_wakeup(struct sock *sk)
1723static void sock_def_error_report(struct sock *sk) 1750static void sock_def_error_report(struct sock *sk)
1724{ 1751{
1725 read_lock(&sk->sk_callback_lock); 1752 read_lock(&sk->sk_callback_lock);
1726 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 1753 if (sk_has_sleeper(sk))
1727 wake_up_interruptible_poll(sk->sk_sleep, POLLERR); 1754 wake_up_interruptible_poll(sk->sk_sleep, POLLERR);
1728 sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR); 1755 sk_wake_async(sk, SOCK_WAKE_IO, POLL_ERR);
1729 read_unlock(&sk->sk_callback_lock); 1756 read_unlock(&sk->sk_callback_lock);
@@ -1732,7 +1759,7 @@ static void sock_def_error_report(struct sock *sk)
1732static void sock_def_readable(struct sock *sk, int len) 1759static void sock_def_readable(struct sock *sk, int len)
1733{ 1760{
1734 read_lock(&sk->sk_callback_lock); 1761 read_lock(&sk->sk_callback_lock);
1735 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 1762 if (sk_has_sleeper(sk))
1736 wake_up_interruptible_sync_poll(sk->sk_sleep, POLLIN | 1763 wake_up_interruptible_sync_poll(sk->sk_sleep, POLLIN |
1737 POLLRDNORM | POLLRDBAND); 1764 POLLRDNORM | POLLRDBAND);
1738 sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN); 1765 sk_wake_async(sk, SOCK_WAKE_WAITD, POLL_IN);
@@ -1747,7 +1774,7 @@ static void sock_def_write_space(struct sock *sk)
1747 * progress. --DaveM 1774 * progress. --DaveM
1748 */ 1775 */
1749 if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf) { 1776 if ((atomic_read(&sk->sk_wmem_alloc) << 1) <= sk->sk_sndbuf) {
1750 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 1777 if (sk_has_sleeper(sk))
1751 wake_up_interruptible_sync_poll(sk->sk_sleep, POLLOUT | 1778 wake_up_interruptible_sync_poll(sk->sk_sleep, POLLOUT |
1752 POLLWRNORM | POLLWRBAND); 1779 POLLWRNORM | POLLWRBAND);
1753 1780
@@ -1840,8 +1867,12 @@ void sock_init_data(struct socket *sock, struct sock *sk)
1840 1867
1841 sk->sk_stamp = ktime_set(-1L, 0); 1868 sk->sk_stamp = ktime_set(-1L, 0);
1842 1869
1870 /*
1871 * Before updating sk_refcnt, we must commit prior changes to memory
1872 * (Documentation/RCU/rculist_nulls.txt for details)
1873 */
1874 smp_wmb();
1843 atomic_set(&sk->sk_refcnt, 1); 1875 atomic_set(&sk->sk_refcnt, 1);
1844 atomic_set(&sk->sk_wmem_alloc, 1);
1845 atomic_set(&sk->sk_drops, 0); 1876 atomic_set(&sk->sk_drops, 0);
1846} 1877}
1847EXPORT_SYMBOL(sock_init_data); 1878EXPORT_SYMBOL(sock_init_data);
diff --git a/net/dccp/output.c b/net/dccp/output.c
index c0e88c16d088..c96119fda688 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -196,7 +196,7 @@ void dccp_write_space(struct sock *sk)
196{ 196{
197 read_lock(&sk->sk_callback_lock); 197 read_lock(&sk->sk_callback_lock);
198 198
199 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 199 if (sk_has_sleeper(sk))
200 wake_up_interruptible(sk->sk_sleep); 200 wake_up_interruptible(sk->sk_sleep);
201 /* Should agree with poll, otherwise some programs break */ 201 /* Should agree with poll, otherwise some programs break */
202 if (sock_writeable(sk)) 202 if (sock_writeable(sk))
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index 314a1b5c033c..1bca9205104e 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -311,7 +311,7 @@ unsigned int dccp_poll(struct file *file, struct socket *sock,
311 unsigned int mask; 311 unsigned int mask;
312 struct sock *sk = sock->sk; 312 struct sock *sk = sock->sk;
313 313
314 poll_wait(file, sk->sk_sleep, wait); 314 sock_poll_wait(file, sk->sk_sleep, wait);
315 if (sk->sk_state == DCCP_LISTEN) 315 if (sk->sk_state == DCCP_LISTEN)
316 return inet_csk_listen_poll(sk); 316 return inet_csk_listen_poll(sk);
317 317
@@ -1066,7 +1066,7 @@ static int __init dccp_init(void)
1066 (dccp_hashinfo.ehash_size - 1)) 1066 (dccp_hashinfo.ehash_size - 1))
1067 dccp_hashinfo.ehash_size--; 1067 dccp_hashinfo.ehash_size--;
1068 dccp_hashinfo.ehash = (struct inet_ehash_bucket *) 1068 dccp_hashinfo.ehash = (struct inet_ehash_bucket *)
1069 __get_free_pages(GFP_ATOMIC, ehash_order); 1069 __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, ehash_order);
1070 } while (!dccp_hashinfo.ehash && --ehash_order > 0); 1070 } while (!dccp_hashinfo.ehash && --ehash_order > 0);
1071 1071
1072 if (!dccp_hashinfo.ehash) { 1072 if (!dccp_hashinfo.ehash) {
@@ -1091,7 +1091,7 @@ static int __init dccp_init(void)
1091 bhash_order > 0) 1091 bhash_order > 0)
1092 continue; 1092 continue;
1093 dccp_hashinfo.bhash = (struct inet_bind_hashbucket *) 1093 dccp_hashinfo.bhash = (struct inet_bind_hashbucket *)
1094 __get_free_pages(GFP_ATOMIC, bhash_order); 1094 __get_free_pages(GFP_ATOMIC|__GFP_NOWARN, bhash_order);
1095 } while (!dccp_hashinfo.bhash && --bhash_order >= 0); 1095 } while (!dccp_hashinfo.bhash && --bhash_order >= 0);
1096 1096
1097 if (!dccp_hashinfo.bhash) { 1097 if (!dccp_hashinfo.bhash) {
@@ -1159,6 +1159,7 @@ static void __exit dccp_fini(void)
1159 kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep); 1159 kmem_cache_destroy(dccp_hashinfo.bind_bucket_cachep);
1160 dccp_ackvec_exit(); 1160 dccp_ackvec_exit();
1161 dccp_sysctl_exit(); 1161 dccp_sysctl_exit();
1162 percpu_counter_destroy(&dccp_orphan_count);
1162} 1163}
1163 1164
1164module_init(dccp_init); 1165module_init(dccp_init);
diff --git a/net/dsa/mv88e6xxx.c b/net/dsa/mv88e6xxx.c
index 4e4d8b5ad03d..efe661a9def4 100644
--- a/net/dsa/mv88e6xxx.c
+++ b/net/dsa/mv88e6xxx.c
@@ -418,7 +418,7 @@ static int mv88e6xxx_stats_wait(struct dsa_switch *ds)
418 int i; 418 int i;
419 419
420 for (i = 0; i < 10; i++) { 420 for (i = 0; i < 10; i++) {
421 ret = REG_READ(REG_GLOBAL2, 0x1d); 421 ret = REG_READ(REG_GLOBAL, 0x1d);
422 if ((ret & 0x8000) == 0) 422 if ((ret & 0x8000) == 0)
423 return 0; 423 return 0;
424 } 424 }
diff --git a/net/econet/af_econet.c b/net/econet/af_econet.c
index 2e1f836d4240..f0bbc57926cd 100644
--- a/net/econet/af_econet.c
+++ b/net/econet/af_econet.c
@@ -520,6 +520,7 @@ static int econet_getname(struct socket *sock, struct sockaddr *uaddr,
520 if (peer) 520 if (peer)
521 return -EOPNOTSUPP; 521 return -EOPNOTSUPP;
522 522
523 memset(sec, 0, sizeof(*sec));
523 mutex_lock(&econet_mutex); 524 mutex_lock(&econet_mutex);
524 525
525 sk = sock->sk; 526 sk = sock->sk;
diff --git a/net/ieee802154/af_ieee802154.c b/net/ieee802154/af_ieee802154.c
index 3bb6bdb1dac1..af661805b9fa 100644
--- a/net/ieee802154/af_ieee802154.c
+++ b/net/ieee802154/af_ieee802154.c
@@ -136,7 +136,7 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
136 unsigned int cmd) 136 unsigned int cmd)
137{ 137{
138 struct ifreq ifr; 138 struct ifreq ifr;
139 int ret = -EINVAL; 139 int ret = -ENOIOCTLCMD;
140 struct net_device *dev; 140 struct net_device *dev;
141 141
142 if (copy_from_user(&ifr, arg, sizeof(struct ifreq))) 142 if (copy_from_user(&ifr, arg, sizeof(struct ifreq)))
@@ -146,8 +146,10 @@ static int ieee802154_dev_ioctl(struct sock *sk, struct ifreq __user *arg,
146 146
147 dev_load(sock_net(sk), ifr.ifr_name); 147 dev_load(sock_net(sk), ifr.ifr_name);
148 dev = dev_get_by_name(sock_net(sk), ifr.ifr_name); 148 dev = dev_get_by_name(sock_net(sk), ifr.ifr_name);
149 if (dev->type == ARPHRD_IEEE802154 || 149
150 dev->type == ARPHRD_IEEE802154_PHY) 150 if ((dev->type == ARPHRD_IEEE802154 ||
151 dev->type == ARPHRD_IEEE802154_PHY) &&
152 dev->netdev_ops->ndo_do_ioctl)
151 ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd); 153 ret = dev->netdev_ops->ndo_do_ioctl(dev, &ifr, cmd);
152 154
153 if (!ret && copy_to_user(arg, &ifr, sizeof(struct ifreq))) 155 if (!ret && copy_to_user(arg, &ifr, sizeof(struct ifreq)))
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 14d39840dd62..ba8b214dda8f 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -377,6 +377,18 @@ int ieee802154_dgram_deliver(struct net_device *dev, struct sk_buff *skb)
377 return ret; 377 return ret;
378} 378}
379 379
380static int dgram_getsockopt(struct sock *sk, int level, int optname,
381 char __user *optval, int __user *optlen)
382{
383 return -EOPNOTSUPP;
384}
385
386static int dgram_setsockopt(struct sock *sk, int level, int optname,
387 char __user *optval, int __user optlen)
388{
389 return -EOPNOTSUPP;
390}
391
380struct proto ieee802154_dgram_prot = { 392struct proto ieee802154_dgram_prot = {
381 .name = "IEEE-802.15.4-MAC", 393 .name = "IEEE-802.15.4-MAC",
382 .owner = THIS_MODULE, 394 .owner = THIS_MODULE,
@@ -391,5 +403,7 @@ struct proto ieee802154_dgram_prot = {
391 .connect = dgram_connect, 403 .connect = dgram_connect,
392 .disconnect = dgram_disconnect, 404 .disconnect = dgram_disconnect,
393 .ioctl = dgram_ioctl, 405 .ioctl = dgram_ioctl,
406 .getsockopt = dgram_getsockopt,
407 .setsockopt = dgram_setsockopt,
394}; 408};
395 409
diff --git a/net/ieee802154/raw.c b/net/ieee802154/raw.c
index fca44d59f97e..9315977c4c61 100644
--- a/net/ieee802154/raw.c
+++ b/net/ieee802154/raw.c
@@ -238,6 +238,18 @@ void ieee802154_raw_deliver(struct net_device *dev, struct sk_buff *skb)
238 read_unlock(&raw_lock); 238 read_unlock(&raw_lock);
239} 239}
240 240
241static int raw_getsockopt(struct sock *sk, int level, int optname,
242 char __user *optval, int __user *optlen)
243{
244 return -EOPNOTSUPP;
245}
246
247static int raw_setsockopt(struct sock *sk, int level, int optname,
248 char __user *optval, int __user optlen)
249{
250 return -EOPNOTSUPP;
251}
252
241struct proto ieee802154_raw_prot = { 253struct proto ieee802154_raw_prot = {
242 .name = "IEEE-802.15.4-RAW", 254 .name = "IEEE-802.15.4-RAW",
243 .owner = THIS_MODULE, 255 .owner = THIS_MODULE,
@@ -250,5 +262,7 @@ struct proto ieee802154_raw_prot = {
250 .unhash = raw_unhash, 262 .unhash = raw_unhash,
251 .connect = raw_connect, 263 .connect = raw_connect,
252 .disconnect = raw_disconnect, 264 .disconnect = raw_disconnect,
265 .getsockopt = raw_getsockopt,
266 .setsockopt = raw_setsockopt,
253}; 267};
254 268
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c29d75d8f1b1..090e9991ac2a 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -1304,7 +1304,9 @@ static void arp_format_neigh_entry(struct seq_file *seq,
1304 hbuffer[k++] = hex_asc_lo(n->ha[j]); 1304 hbuffer[k++] = hex_asc_lo(n->ha[j]);
1305 hbuffer[k++] = ':'; 1305 hbuffer[k++] = ':';
1306 } 1306 }
1307 hbuffer[--k] = 0; 1307 if (k != 0)
1308 --k;
1309 hbuffer[k] = 0;
1308#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE) 1310#if defined(CONFIG_AX25) || defined(CONFIG_AX25_MODULE)
1309 } 1311 }
1310#endif 1312#endif
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 00a54b246dfe..63c2fa7b68c4 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -316,8 +316,8 @@ static inline void check_tnode(const struct tnode *tn)
316 316
317static const int halve_threshold = 25; 317static const int halve_threshold = 25;
318static const int inflate_threshold = 50; 318static const int inflate_threshold = 50;
319static const int halve_threshold_root = 8; 319static const int halve_threshold_root = 15;
320static const int inflate_threshold_root = 15; 320static const int inflate_threshold_root = 25;
321 321
322 322
323static void __alias_free_mem(struct rcu_head *head) 323static void __alias_free_mem(struct rcu_head *head)
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 44e2a3d2359a..82c11dd10a62 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -735,10 +735,10 @@ static int ipgre_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
735 } 735 }
736 736
737 tos = tiph->tos; 737 tos = tiph->tos;
738 if (tos&1) { 738 if (tos == 1) {
739 tos = 0;
739 if (skb->protocol == htons(ETH_P_IP)) 740 if (skb->protocol == htons(ETH_P_IP))
740 tos = old_iph->tos; 741 tos = old_iph->tos;
741 tos &= ~1;
742 } 742 }
743 743
744 { 744 {
@@ -951,7 +951,7 @@ static int ipgre_tunnel_bind_dev(struct net_device *dev)
951 addend += 4; 951 addend += 4;
952 } 952 }
953 dev->needed_headroom = addend + hlen; 953 dev->needed_headroom = addend + hlen;
954 mtu -= dev->hard_header_len - addend; 954 mtu -= dev->hard_header_len + addend;
955 955
956 if (mtu < 68) 956 if (mtu < 68)
957 mtu = 68; 957 mtu = 68;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 247026282669..7ffcd96fe591 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -813,6 +813,8 @@ int ip_append_data(struct sock *sk,
813 inet->cork.addr = ipc->addr; 813 inet->cork.addr = ipc->addr;
814 } 814 }
815 rt = *rtp; 815 rt = *rtp;
816 if (unlikely(!rt))
817 return -EFAULT;
816 /* 818 /*
817 * We steal reference to this route, caller should not release it 819 * We steal reference to this route, caller should not release it
818 */ 820 */
@@ -1243,7 +1245,6 @@ int ip_push_pending_frames(struct sock *sk)
1243 skb->len += tmp_skb->len; 1245 skb->len += tmp_skb->len;
1244 skb->data_len += tmp_skb->len; 1246 skb->data_len += tmp_skb->len;
1245 skb->truesize += tmp_skb->truesize; 1247 skb->truesize += tmp_skb->truesize;
1246 __sock_put(tmp_skb->sk);
1247 tmp_skb->destructor = NULL; 1248 tmp_skb->destructor = NULL;
1248 tmp_skb->sk = NULL; 1249 tmp_skb->sk = NULL;
1249 } 1250 }
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 7870a535dac6..91145244ea63 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -339,7 +339,7 @@ unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
339 struct sock *sk = sock->sk; 339 struct sock *sk = sock->sk;
340 struct tcp_sock *tp = tcp_sk(sk); 340 struct tcp_sock *tp = tcp_sk(sk);
341 341
342 poll_wait(file, sk->sk_sleep, wait); 342 sock_poll_wait(file, sk->sk_sleep, wait);
343 if (sk->sk_state == TCP_LISTEN) 343 if (sk->sk_state == TCP_LISTEN)
344 return inet_csk_listen_poll(sk); 344 return inet_csk_listen_poll(sk);
345 345
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index e92beb9e55e0..6428b342b164 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -116,7 +116,7 @@ int tcp_set_default_congestion_control(const char *name)
116 spin_lock(&tcp_cong_list_lock); 116 spin_lock(&tcp_cong_list_lock);
117 ca = tcp_ca_find(name); 117 ca = tcp_ca_find(name);
118#ifdef CONFIG_MODULES 118#ifdef CONFIG_MODULES
119 if (!ca && capable(CAP_SYS_MODULE)) { 119 if (!ca && capable(CAP_NET_ADMIN)) {
120 spin_unlock(&tcp_cong_list_lock); 120 spin_unlock(&tcp_cong_list_lock);
121 121
122 request_module("tcp_%s", name); 122 request_module("tcp_%s", name);
@@ -246,7 +246,7 @@ int tcp_set_congestion_control(struct sock *sk, const char *name)
246 246
247#ifdef CONFIG_MODULES 247#ifdef CONFIG_MODULES
248 /* not found attempt to autoload module */ 248 /* not found attempt to autoload module */
249 if (!ca && capable(CAP_SYS_MODULE)) { 249 if (!ca && capable(CAP_NET_ADMIN)) {
250 rcu_read_unlock(); 250 rcu_read_unlock();
251 request_module("tcp_%s", name); 251 request_module("tcp_%s", name);
252 rcu_read_lock(); 252 rcu_read_lock();
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5a1ca2698c88..6d88219c5e22 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1160,6 +1160,7 @@ struct request_sock_ops tcp_request_sock_ops __read_mostly = {
1160#ifdef CONFIG_TCP_MD5SIG 1160#ifdef CONFIG_TCP_MD5SIG
1161static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = { 1161static struct tcp_request_sock_ops tcp_request_sock_ipv4_ops = {
1162 .md5_lookup = tcp_v4_reqsk_md5_lookup, 1162 .md5_lookup = tcp_v4_reqsk_md5_lookup,
1163 .calc_md5_hash = tcp_v4_md5_hash_skb,
1163}; 1164};
1164#endif 1165#endif
1165 1166
@@ -1373,7 +1374,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1373 */ 1374 */
1374 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC); 1375 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1375 if (newkey != NULL) 1376 if (newkey != NULL)
1376 tcp_v4_md5_do_add(newsk, inet_sk(sk)->daddr, 1377 tcp_v4_md5_do_add(newsk, newinet->daddr,
1377 newkey, key->keylen); 1378 newkey, key->keylen);
1378 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK; 1379 newsk->sk_route_caps &= ~NETIF_F_GSO_MASK;
1379 } 1380 }
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 5bdf08d312d9..bd62712848fa 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -2261,7 +2261,7 @@ struct sk_buff *tcp_make_synack(struct sock *sk, struct dst_entry *dst,
2261#ifdef CONFIG_TCP_MD5SIG 2261#ifdef CONFIG_TCP_MD5SIG
2262 /* Okay, we have all we need - do the md5 hash if needed */ 2262 /* Okay, we have all we need - do the md5 hash if needed */
2263 if (md5) { 2263 if (md5) {
2264 tp->af_specific->calc_md5_hash(md5_hash_location, 2264 tcp_rsk(req)->af_specific->calc_md5_hash(md5_hash_location,
2265 md5, NULL, req, skb); 2265 md5, NULL, req, skb);
2266 } 2266 }
2267#endif 2267#endif
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index 60d918c96a4f..0071ee6f441f 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -136,7 +136,8 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl, int reverse)
136 case IPPROTO_TCP: 136 case IPPROTO_TCP:
137 case IPPROTO_SCTP: 137 case IPPROTO_SCTP:
138 case IPPROTO_DCCP: 138 case IPPROTO_DCCP:
139 if (pskb_may_pull(skb, xprth + 4 - skb->data)) { 139 if (xprth + 4 < skb->data ||
140 pskb_may_pull(skb, xprth + 4 - skb->data)) {
140 __be16 *ports = (__be16 *)xprth; 141 __be16 *ports = (__be16 *)xprth;
141 142
142 fl->fl_ip_sport = ports[!!reverse]; 143 fl->fl_ip_sport = ports[!!reverse];
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3883b4036a74..43b3c9f89c12 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1916,8 +1916,32 @@ ok:
1916 update_lft = 1; 1916 update_lft = 1;
1917 else if (stored_lft <= MIN_VALID_LIFETIME) { 1917 else if (stored_lft <= MIN_VALID_LIFETIME) {
1918 /* valid_lft <= stored_lft is always true */ 1918 /* valid_lft <= stored_lft is always true */
1919 /* XXX: IPsec */ 1919 /*
1920 update_lft = 0; 1920 * RFC 4862 Section 5.5.3e:
1921 * "Note that the preferred lifetime of
1922 * the corresponding address is always
1923 * reset to the Preferred Lifetime in
1924 * the received Prefix Information
1925 * option, regardless of whether the
1926 * valid lifetime is also reset or
1927 * ignored."
1928 *
1929 * So if the preferred lifetime in
1930 * this advertisement is different
1931 * than what we have stored, but the
1932 * valid lifetime is invalid, just
1933 * reset prefered_lft.
1934 *
1935 * We must set the valid lifetime
1936 * to the stored lifetime since we'll
1937 * be updating the timestamp below,
1938 * else we'll set it back to the
1939 * minumum.
1940 */
1941 if (prefered_lft != ifp->prefered_lft) {
1942 valid_lft = stored_lft;
1943 update_lft = 1;
1944 }
1921 } else { 1945 } else {
1922 valid_lft = MIN_VALID_LIFETIME; 1946 valid_lft = MIN_VALID_LIFETIME;
1923 if (valid_lft < prefered_lft) 1947 if (valid_lft < prefered_lft)
@@ -3085,7 +3109,7 @@ restart:
3085 spin_unlock(&ifp->lock); 3109 spin_unlock(&ifp->lock);
3086 continue; 3110 continue;
3087 } else if (age >= ifp->prefered_lft) { 3111 } else if (age >= ifp->prefered_lft) {
3088 /* jiffies - ifp->tsamp > age >= ifp->prefered_lft */ 3112 /* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
3089 int deprecate = 0; 3113 int deprecate = 0;
3090 3114
3091 if (!(ifp->flags&IFA_F_DEPRECATED)) { 3115 if (!(ifp->flags&IFA_F_DEPRECATED)) {
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index caa0278d30a9..45f9a2a42d56 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -306,8 +306,10 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
306 v4addr != htonl(INADDR_ANY) && 306 v4addr != htonl(INADDR_ANY) &&
307 chk_addr_ret != RTN_LOCAL && 307 chk_addr_ret != RTN_LOCAL &&
308 chk_addr_ret != RTN_MULTICAST && 308 chk_addr_ret != RTN_MULTICAST &&
309 chk_addr_ret != RTN_BROADCAST) 309 chk_addr_ret != RTN_BROADCAST) {
310 err = -EADDRNOTAVAIL;
310 goto out; 311 goto out;
312 }
311 } else { 313 } else {
312 if (addr_type != IPV6_ADDR_ANY) { 314 if (addr_type != IPV6_ADDR_ANY) {
313 struct net_device *dev = NULL; 315 struct net_device *dev = NULL;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7c76e3d18215..87f8419a68fd 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1484,7 +1484,6 @@ int ip6_push_pending_frames(struct sock *sk)
1484 skb->len += tmp_skb->len; 1484 skb->len += tmp_skb->len;
1485 skb->data_len += tmp_skb->len; 1485 skb->data_len += tmp_skb->len;
1486 skb->truesize += tmp_skb->truesize; 1486 skb->truesize += tmp_skb->truesize;
1487 __sock_put(tmp_skb->sk);
1488 tmp_skb->destructor = NULL; 1487 tmp_skb->destructor = NULL;
1489 tmp_skb->sk = NULL; 1488 tmp_skb->sk = NULL;
1490 } 1489 }
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 68e52308e552..98b7327d0949 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -1018,6 +1018,7 @@ static void ipip6_tunnel_setup(struct net_device *dev)
1018 dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr); 1018 dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr);
1019 dev->mtu = ETH_DATA_LEN - sizeof(struct iphdr); 1019 dev->mtu = ETH_DATA_LEN - sizeof(struct iphdr);
1020 dev->flags = IFF_NOARP; 1020 dev->flags = IFF_NOARP;
1021 dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
1021 dev->iflink = 0; 1022 dev->iflink = 0;
1022 dev->addr_len = 4; 1023 dev->addr_len = 4;
1023 dev->features |= NETIF_F_NETNS_LOCAL; 1024 dev->features |= NETIF_F_NETNS_LOCAL;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 58810c65b635..d849dd53b788 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -896,6 +896,7 @@ struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
896#ifdef CONFIG_TCP_MD5SIG 896#ifdef CONFIG_TCP_MD5SIG
897static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = { 897static struct tcp_request_sock_ops tcp_request_sock_ipv6_ops = {
898 .md5_lookup = tcp_v6_reqsk_md5_lookup, 898 .md5_lookup = tcp_v6_reqsk_md5_lookup,
899 .calc_md5_hash = tcp_v6_md5_hash_skb,
899}; 900};
900#endif 901#endif
901 902
@@ -1441,7 +1442,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
1441 */ 1442 */
1442 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC); 1443 char *newkey = kmemdup(key->key, key->keylen, GFP_ATOMIC);
1443 if (newkey != NULL) 1444 if (newkey != NULL)
1444 tcp_v6_md5_do_add(newsk, &inet6_sk(sk)->daddr, 1445 tcp_v6_md5_do_add(newsk, &newnp->daddr,
1445 newkey, key->keylen); 1446 newkey, key->keylen);
1446 } 1447 }
1447#endif 1448#endif
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index b4b16a43f277..3a3c677bc0f2 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
157 ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr); 157 ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
158 ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr); 158 ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
159 159
160 while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) { 160 while (nh + offset + 1 < skb->data ||
161 pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
161 nh = skb_network_header(skb); 162 nh = skb_network_header(skb);
162 exthdr = (struct ipv6_opt_hdr *)(nh + offset); 163 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
163 164
@@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
177 case IPPROTO_TCP: 178 case IPPROTO_TCP:
178 case IPPROTO_SCTP: 179 case IPPROTO_SCTP:
179 case IPPROTO_DCCP: 180 case IPPROTO_DCCP:
180 if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) { 181 if (!onlyproto && (nh + offset + 4 < skb->data ||
182 pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
181 __be16 *ports = (__be16 *)exthdr; 183 __be16 *ports = (__be16 *)exthdr;
182 184
183 fl->fl_ip_sport = ports[!!reverse]; 185 fl->fl_ip_sport = ports[!!reverse];
diff --git a/net/ipx/af_ipx.c b/net/ipx/af_ipx.c
index 417b0e309495..f1118d92a191 100644
--- a/net/ipx/af_ipx.c
+++ b/net/ipx/af_ipx.c
@@ -41,6 +41,7 @@
41#include <linux/netdevice.h> 41#include <linux/netdevice.h>
42#include <linux/uio.h> 42#include <linux/uio.h>
43#include <linux/skbuff.h> 43#include <linux/skbuff.h>
44#include <linux/smp_lock.h>
44#include <linux/socket.h> 45#include <linux/socket.h>
45#include <linux/sockios.h> 46#include <linux/sockios.h>
46#include <linux/string.h> 47#include <linux/string.h>
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index cb762c8723ea..50b43c57d5d8 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -45,6 +45,7 @@
45#include <linux/capability.h> 45#include <linux/capability.h>
46#include <linux/module.h> 46#include <linux/module.h>
47#include <linux/types.h> 47#include <linux/types.h>
48#include <linux/smp_lock.h>
48#include <linux/socket.h> 49#include <linux/socket.h>
49#include <linux/sockios.h> 50#include <linux/sockios.h>
50#include <linux/init.h> 51#include <linux/init.h>
@@ -714,6 +715,7 @@ static int irda_getname(struct socket *sock, struct sockaddr *uaddr,
714 struct sock *sk = sock->sk; 715 struct sock *sk = sock->sk;
715 struct irda_sock *self = irda_sk(sk); 716 struct irda_sock *self = irda_sk(sk);
716 717
718 memset(&saddr, 0, sizeof(saddr));
717 if (peer) { 719 if (peer) {
718 if (sk->sk_state != TCP_ESTABLISHED) 720 if (sk->sk_state != TCP_ESTABLISHED)
719 return -ENOTCONN; 721 return -ENOTCONN;
diff --git a/net/irda/irnet/irnet.h b/net/irda/irnet/irnet.h
index bccf4d0059f0..b001c361ad30 100644
--- a/net/irda/irnet/irnet.h
+++ b/net/irda/irnet/irnet.h
@@ -241,7 +241,6 @@
241#include <linux/module.h> 241#include <linux/module.h>
242 242
243#include <linux/kernel.h> 243#include <linux/kernel.h>
244#include <linux/smp_lock.h>
245#include <linux/skbuff.h> 244#include <linux/skbuff.h>
246#include <linux/tty.h> 245#include <linux/tty.h>
247#include <linux/proc_fs.h> 246#include <linux/proc_fs.h>
diff --git a/net/irda/irnet/irnet_ppp.c b/net/irda/irnet/irnet_ppp.c
index 6d8ae03c14f5..68cbcb19cbd8 100644
--- a/net/irda/irnet/irnet_ppp.c
+++ b/net/irda/irnet/irnet_ppp.c
@@ -13,6 +13,7 @@
13 * 2) as a control channel (write commands, read events) 13 * 2) as a control channel (write commands, read events)
14 */ 14 */
15 15
16#include <linux/smp_lock.h>
16#include "irnet_ppp.h" /* Private header */ 17#include "irnet_ppp.h" /* Private header */
17/* Please put other headers in irnet.h - Thanks */ 18/* Please put other headers in irnet.h - Thanks */
18 19
diff --git a/net/irda/irttp.c b/net/irda/irttp.c
index ecf4eb2717cb..9cb79f95bf63 100644
--- a/net/irda/irttp.c
+++ b/net/irda/irttp.c
@@ -1453,6 +1453,7 @@ struct tsap_cb *irttp_dup(struct tsap_cb *orig, void *instance)
1453 } 1453 }
1454 /* Dup */ 1454 /* Dup */
1455 memcpy(new, orig, sizeof(struct tsap_cb)); 1455 memcpy(new, orig, sizeof(struct tsap_cb));
1456 spin_lock_init(&new->lock);
1456 1457
1457 /* We don't need the old instance any more */ 1458 /* We don't need the old instance any more */
1458 spin_unlock_irqrestore(&irttp->tsaps->hb_spinlock, flags); 1459 spin_unlock_irqrestore(&irttp->tsaps->hb_spinlock, flags);
diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 6be5f92d1094..49c15b48408e 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -306,7 +306,7 @@ static inline int iucv_below_msglim(struct sock *sk)
306static void iucv_sock_wake_msglim(struct sock *sk) 306static void iucv_sock_wake_msglim(struct sock *sk)
307{ 307{
308 read_lock(&sk->sk_callback_lock); 308 read_lock(&sk->sk_callback_lock);
309 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 309 if (sk_has_sleeper(sk))
310 wake_up_interruptible_all(sk->sk_sleep); 310 wake_up_interruptible_all(sk->sk_sleep);
311 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT); 311 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
312 read_unlock(&sk->sk_callback_lock); 312 read_unlock(&sk->sk_callback_lock);
@@ -1256,7 +1256,7 @@ unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
1256 struct sock *sk = sock->sk; 1256 struct sock *sk = sock->sk;
1257 unsigned int mask = 0; 1257 unsigned int mask = 0;
1258 1258
1259 poll_wait(file, sk->sk_sleep, wait); 1259 sock_poll_wait(file, sk->sk_sleep, wait);
1260 1260
1261 if (sk->sk_state == IUCV_LISTEN) 1261 if (sk->sk_state == IUCV_LISTEN)
1262 return iucv_accept_poll(sk); 1262 return iucv_accept_poll(sk);
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
index 9208cf5f2bd5..c45eee1c0e8d 100644
--- a/net/llc/af_llc.c
+++ b/net/llc/af_llc.c
@@ -914,6 +914,7 @@ static int llc_ui_getname(struct socket *sock, struct sockaddr *uaddr,
914 struct llc_sock *llc = llc_sk(sk); 914 struct llc_sock *llc = llc_sk(sk);
915 int rc = 0; 915 int rc = 0;
916 916
917 memset(&sllc, 0, sizeof(sllc));
917 lock_sock(sk); 918 lock_sock(sk);
918 if (sock_flag(sk, SOCK_ZAPPED)) 919 if (sock_flag(sk, SOCK_ZAPPED))
919 goto out; 920 goto out;
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index ba2643a43c73..7836ee928983 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -83,6 +83,7 @@ endmenu
83config MAC80211_MESH 83config MAC80211_MESH
84 bool "Enable mac80211 mesh networking (pre-802.11s) support" 84 bool "Enable mac80211 mesh networking (pre-802.11s) support"
85 depends on MAC80211 && EXPERIMENTAL 85 depends on MAC80211 && EXPERIMENTAL
86 depends on BROKEN
86 ---help--- 87 ---help---
87 This options enables support of Draft 802.11s mesh networking. 88 This options enables support of Draft 802.11s mesh networking.
88 The implementation is based on Draft 1.08 of the Mesh Networking 89 The implementation is based on Draft 1.08 of the Mesh Networking
diff --git a/net/mac80211/agg-tx.c b/net/mac80211/agg-tx.c
index 9e5762ad307d..a24e59816b93 100644
--- a/net/mac80211/agg-tx.c
+++ b/net/mac80211/agg-tx.c
@@ -381,6 +381,14 @@ static void ieee80211_agg_splice_packets(struct ieee80211_local *local,
381 &local->hw, queue, 381 &local->hw, queue,
382 IEEE80211_QUEUE_STOP_REASON_AGGREGATION); 382 IEEE80211_QUEUE_STOP_REASON_AGGREGATION);
383 383
384 if (!(sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK))
385 return;
386
387 if (WARN(!sta->ampdu_mlme.tid_tx[tid],
388 "TID %d gone but expected when splicing aggregates from"
389 "the pending queue\n", tid))
390 return;
391
384 if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) { 392 if (!skb_queue_empty(&sta->ampdu_mlme.tid_tx[tid]->pending)) {
385 spin_lock_irqsave(&local->queue_stop_reason_lock, flags); 393 spin_lock_irqsave(&local->queue_stop_reason_lock, flags);
386 /* mark queue as pending, it is stopped already */ 394 /* mark queue as pending, it is stopped already */
diff --git a/net/mac80211/key.c b/net/mac80211/key.c
index ce267565e180..659a42d529e3 100644
--- a/net/mac80211/key.c
+++ b/net/mac80211/key.c
@@ -67,6 +67,8 @@ static DECLARE_WORK(todo_work, key_todo);
67 * 67 *
68 * @key: key to add to do item for 68 * @key: key to add to do item for
69 * @flag: todo flag(s) 69 * @flag: todo flag(s)
70 *
71 * Must be called with IRQs or softirqs disabled.
70 */ 72 */
71static void add_todo(struct ieee80211_key *key, u32 flag) 73static void add_todo(struct ieee80211_key *key, u32 flag)
72{ 74{
@@ -140,9 +142,9 @@ static void ieee80211_key_enable_hw_accel(struct ieee80211_key *key)
140 ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf); 142 ret = drv_set_key(key->local, SET_KEY, &sdata->vif, sta, &key->conf);
141 143
142 if (!ret) { 144 if (!ret) {
143 spin_lock(&todo_lock); 145 spin_lock_bh(&todo_lock);
144 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE; 146 key->flags |= KEY_FLAG_UPLOADED_TO_HARDWARE;
145 spin_unlock(&todo_lock); 147 spin_unlock_bh(&todo_lock);
146 } 148 }
147 149
148 if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP) 150 if (ret && ret != -ENOSPC && ret != -EOPNOTSUPP)
@@ -164,12 +166,12 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
164 if (!key || !key->local->ops->set_key) 166 if (!key || !key->local->ops->set_key)
165 return; 167 return;
166 168
167 spin_lock(&todo_lock); 169 spin_lock_bh(&todo_lock);
168 if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) { 170 if (!(key->flags & KEY_FLAG_UPLOADED_TO_HARDWARE)) {
169 spin_unlock(&todo_lock); 171 spin_unlock_bh(&todo_lock);
170 return; 172 return;
171 } 173 }
172 spin_unlock(&todo_lock); 174 spin_unlock_bh(&todo_lock);
173 175
174 sta = get_sta_for_key(key); 176 sta = get_sta_for_key(key);
175 sdata = key->sdata; 177 sdata = key->sdata;
@@ -188,9 +190,9 @@ static void ieee80211_key_disable_hw_accel(struct ieee80211_key *key)
188 wiphy_name(key->local->hw.wiphy), 190 wiphy_name(key->local->hw.wiphy),
189 key->conf.keyidx, sta ? sta->addr : bcast_addr, ret); 191 key->conf.keyidx, sta ? sta->addr : bcast_addr, ret);
190 192
191 spin_lock(&todo_lock); 193 spin_lock_bh(&todo_lock);
192 key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE; 194 key->flags &= ~KEY_FLAG_UPLOADED_TO_HARDWARE;
193 spin_unlock(&todo_lock); 195 spin_unlock_bh(&todo_lock);
194} 196}
195 197
196static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata, 198static void __ieee80211_set_default_key(struct ieee80211_sub_if_data *sdata,
@@ -437,14 +439,14 @@ void ieee80211_key_link(struct ieee80211_key *key,
437 439
438 __ieee80211_key_replace(sdata, sta, old_key, key); 440 __ieee80211_key_replace(sdata, sta, old_key, key);
439 441
440 spin_unlock_irqrestore(&sdata->local->key_lock, flags);
441
442 /* free old key later */ 442 /* free old key later */
443 add_todo(old_key, KEY_FLAG_TODO_DELETE); 443 add_todo(old_key, KEY_FLAG_TODO_DELETE);
444 444
445 add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS); 445 add_todo(key, KEY_FLAG_TODO_ADD_DEBUGFS);
446 if (netif_running(sdata->dev)) 446 if (netif_running(sdata->dev))
447 add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD); 447 add_todo(key, KEY_FLAG_TODO_HWACCEL_ADD);
448
449 spin_unlock_irqrestore(&sdata->local->key_lock, flags);
448} 450}
449 451
450static void __ieee80211_key_free(struct ieee80211_key *key) 452static void __ieee80211_key_free(struct ieee80211_key *key)
@@ -547,7 +549,7 @@ static void __ieee80211_key_todo(void)
547 */ 549 */
548 synchronize_rcu(); 550 synchronize_rcu();
549 551
550 spin_lock(&todo_lock); 552 spin_lock_bh(&todo_lock);
551 while (!list_empty(&todo_list)) { 553 while (!list_empty(&todo_list)) {
552 key = list_first_entry(&todo_list, struct ieee80211_key, todo); 554 key = list_first_entry(&todo_list, struct ieee80211_key, todo);
553 list_del_init(&key->todo); 555 list_del_init(&key->todo);
@@ -558,7 +560,7 @@ static void __ieee80211_key_todo(void)
558 KEY_FLAG_TODO_HWACCEL_REMOVE | 560 KEY_FLAG_TODO_HWACCEL_REMOVE |
559 KEY_FLAG_TODO_DELETE); 561 KEY_FLAG_TODO_DELETE);
560 key->flags &= ~todoflags; 562 key->flags &= ~todoflags;
561 spin_unlock(&todo_lock); 563 spin_unlock_bh(&todo_lock);
562 564
563 work_done = false; 565 work_done = false;
564 566
@@ -591,9 +593,9 @@ static void __ieee80211_key_todo(void)
591 593
592 WARN_ON(!work_done); 594 WARN_ON(!work_done);
593 595
594 spin_lock(&todo_lock); 596 spin_lock_bh(&todo_lock);
595 } 597 }
596 spin_unlock(&todo_lock); 598 spin_unlock_bh(&todo_lock);
597} 599}
598 600
599void ieee80211_key_todo(void) 601void ieee80211_key_todo(void)
diff --git a/net/mac80211/mesh_hwmp.c b/net/mac80211/mesh_hwmp.c
index 003cb470ac84..f49ef288e2e2 100644
--- a/net/mac80211/mesh_hwmp.c
+++ b/net/mac80211/mesh_hwmp.c
@@ -637,7 +637,7 @@ static void mesh_queue_preq(struct mesh_path *mpath, u8 flags)
637 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; 637 struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
638 struct mesh_preq_queue *preq_node; 638 struct mesh_preq_queue *preq_node;
639 639
640 preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_KERNEL); 640 preq_node = kmalloc(sizeof(struct mesh_preq_queue), GFP_ATOMIC);
641 if (!preq_node) { 641 if (!preq_node) {
642 printk(KERN_DEBUG "Mesh HWMP: could not allocate PREQ node\n"); 642 printk(KERN_DEBUG "Mesh HWMP: could not allocate PREQ node\n");
643 return; 643 return;
diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
index 3c72557df45a..479597e88583 100644
--- a/net/mac80211/mesh_pathtbl.c
+++ b/net/mac80211/mesh_pathtbl.c
@@ -175,6 +175,8 @@ int mesh_path_add(u8 *dst, struct ieee80211_sub_if_data *sdata)
175 int err = 0; 175 int err = 0;
176 u32 hash_idx; 176 u32 hash_idx;
177 177
178 might_sleep();
179
178 if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0) 180 if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
179 /* never add ourselves as neighbours */ 181 /* never add ourselves as neighbours */
180 return -ENOTSUPP; 182 return -ENOTSUPP;
@@ -265,6 +267,7 @@ int mpp_path_add(u8 *dst, u8 *mpp, struct ieee80211_sub_if_data *sdata)
265 int err = 0; 267 int err = 0;
266 u32 hash_idx; 268 u32 hash_idx;
267 269
270 might_sleep();
268 271
269 if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0) 272 if (memcmp(dst, sdata->dev->dev_addr, ETH_ALEN) == 0)
270 /* never add ourselves as neighbours */ 273 /* never add ourselves as neighbours */
@@ -491,8 +494,10 @@ void mesh_path_tx_pending(struct mesh_path *mpath)
491 * @skb: frame to discard 494 * @skb: frame to discard
492 * @sdata: network subif the frame was to be sent through 495 * @sdata: network subif the frame was to be sent through
493 * 496 *
494 * If the frame was beign forwarded from another MP, a PERR frame will be sent 497 * If the frame was being forwarded from another MP, a PERR frame will be sent
495 * to the precursor. 498 * to the precursor. The precursor's address (i.e. the previous hop) was saved
499 * in addr1 of the frame-to-be-forwarded, and would only be overwritten once
500 * the destination is successfully resolved.
496 * 501 *
497 * Locking: the function must me called within a rcu_read_lock region 502 * Locking: the function must me called within a rcu_read_lock region
498 */ 503 */
@@ -507,7 +512,7 @@ void mesh_path_discard_frame(struct sk_buff *skb,
507 u8 *ra, *da; 512 u8 *ra, *da;
508 513
509 da = hdr->addr3; 514 da = hdr->addr3;
510 ra = hdr->addr2; 515 ra = hdr->addr1;
511 mpath = mesh_path_lookup(da, sdata); 516 mpath = mesh_path_lookup(da, sdata);
512 if (mpath) 517 if (mpath)
513 dsn = ++mpath->dsn; 518 dsn = ++mpath->dsn;
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index aca22b00b6a3..07e7e41816be 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -721,7 +721,7 @@ void ieee80211_dynamic_ps_timer(unsigned long data)
721{ 721{
722 struct ieee80211_local *local = (void *) data; 722 struct ieee80211_local *local = (void *) data;
723 723
724 if (local->quiescing) 724 if (local->quiescing || local->suspended)
725 return; 725 return;
726 726
727 queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work); 727 queue_work(local->hw.workqueue, &local->dynamic_ps_enable_work);
diff --git a/net/mac80211/pm.c b/net/mac80211/pm.c
index 7a549f9deb96..5e3d476972f9 100644
--- a/net/mac80211/pm.c
+++ b/net/mac80211/pm.c
@@ -55,15 +55,6 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
55 55
56 rcu_read_unlock(); 56 rcu_read_unlock();
57 57
58 /* flush again, in case driver queued work */
59 flush_workqueue(local->hw.workqueue);
60
61 /* stop hardware - this must stop RX */
62 if (local->open_count) {
63 ieee80211_led_radio(local, false);
64 drv_stop(local);
65 }
66
67 /* remove STAs */ 58 /* remove STAs */
68 spin_lock_irqsave(&local->sta_lock, flags); 59 spin_lock_irqsave(&local->sta_lock, flags);
69 list_for_each_entry(sta, &local->sta_list, list) { 60 list_for_each_entry(sta, &local->sta_list, list) {
@@ -111,7 +102,22 @@ int __ieee80211_suspend(struct ieee80211_hw *hw)
111 drv_remove_interface(local, &conf); 102 drv_remove_interface(local, &conf);
112 } 103 }
113 104
105 /* stop hardware - this must stop RX */
106 if (local->open_count) {
107 ieee80211_led_radio(local, false);
108 drv_stop(local);
109 }
110
111 /*
112 * flush again, in case driver queued work -- it
113 * shouldn't be doing (or cancel everything in the
114 * stop callback) that but better safe than sorry.
115 */
116 flush_workqueue(local->hw.workqueue);
117
114 local->suspended = true; 118 local->suspended = true;
119 /* need suspended to be visible before quiescing is false */
120 barrier();
115 local->quiescing = false; 121 local->quiescing = false;
116 122
117 return 0; 123 return 0;
diff --git a/net/mac80211/rc80211_minstrel.c b/net/mac80211/rc80211_minstrel.c
index b218b98fba7f..37771abd8f5a 100644
--- a/net/mac80211/rc80211_minstrel.c
+++ b/net/mac80211/rc80211_minstrel.c
@@ -66,7 +66,7 @@ rix_to_ndx(struct minstrel_sta_info *mi, int rix)
66 for (i = rix; i >= 0; i--) 66 for (i = rix; i >= 0; i--)
67 if (mi->r[i].rix == rix) 67 if (mi->r[i].rix == rix)
68 break; 68 break;
69 WARN_ON(mi->r[i].rix != rix); 69 WARN_ON(i < 0);
70 return i; 70 return i;
71} 71}
72 72
@@ -181,6 +181,9 @@ minstrel_tx_status(void *priv, struct ieee80211_supported_band *sband,
181 break; 181 break;
182 182
183 ndx = rix_to_ndx(mi, ar[i].idx); 183 ndx = rix_to_ndx(mi, ar[i].idx);
184 if (ndx < 0)
185 continue;
186
184 mi->r[ndx].attempts += ar[i].count; 187 mi->r[ndx].attempts += ar[i].count;
185 188
186 if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0)) 189 if ((i != IEEE80211_TX_MAX_RATES - 1) && (ar[i + 1].idx < 0))
diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
index de5bba7f910a..0936fc24942d 100644
--- a/net/mac80211/rx.c
+++ b/net/mac80211/rx.c
@@ -2453,6 +2453,18 @@ void __ieee80211_rx(struct ieee80211_hw *hw, struct sk_buff *skb,
2453 return; 2453 return;
2454 } 2454 }
2455 2455
2456 /*
2457 * If we're suspending, it is possible although not too likely
2458 * that we'd be receiving frames after having already partially
2459 * quiesced the stack. We can't process such frames then since
2460 * that might, for example, cause stations to be added or other
2461 * driver callbacks be invoked.
2462 */
2463 if (unlikely(local->quiescing || local->suspended)) {
2464 kfree_skb(skb);
2465 return;
2466 }
2467
2456 if (status->flag & RX_FLAG_HT) { 2468 if (status->flag & RX_FLAG_HT) {
2457 /* rate_idx is MCS index */ 2469 /* rate_idx is MCS index */
2458 if (WARN_ON(status->rate_idx < 0 || 2470 if (WARN_ON(status->rate_idx < 0 ||
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index d238a8939a09..3a8922cd1038 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -1455,7 +1455,7 @@ int ieee80211_master_start_xmit(struct sk_buff *skb, struct net_device *dev)
1455 monitor_iface = UNKNOWN_ADDRESS; 1455 monitor_iface = UNKNOWN_ADDRESS;
1456 1456
1457 len_rthdr = ieee80211_get_radiotap_len(skb->data); 1457 len_rthdr = ieee80211_get_radiotap_len(skb->data);
1458 hdr = (struct ieee80211_hdr *)skb->data + len_rthdr; 1458 hdr = (struct ieee80211_hdr *)(skb->data + len_rthdr);
1459 hdrlen = ieee80211_hdrlen(hdr->frame_control); 1459 hdrlen = ieee80211_hdrlen(hdr->frame_control);
1460 1460
1461 /* check the header is complete in the frame */ 1461 /* check the header is complete in the frame */
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 7508f11c5b39..b5869b9574b0 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -561,23 +561,38 @@ struct nf_conn *nf_conntrack_alloc(struct net *net,
561 } 561 }
562 } 562 }
563 563
564 ct = kmem_cache_zalloc(nf_conntrack_cachep, gfp); 564 /*
565 * Do not use kmem_cache_zalloc(), as this cache uses
566 * SLAB_DESTROY_BY_RCU.
567 */
568 ct = kmem_cache_alloc(nf_conntrack_cachep, gfp);
565 if (ct == NULL) { 569 if (ct == NULL) {
566 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n"); 570 pr_debug("nf_conntrack_alloc: Can't alloc conntrack.\n");
567 atomic_dec(&net->ct.count); 571 atomic_dec(&net->ct.count);
568 return ERR_PTR(-ENOMEM); 572 return ERR_PTR(-ENOMEM);
569 } 573 }
570 574 /*
575 * Let ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.next
576 * and ct->tuplehash[IP_CT_DIR_REPLY].hnnode.next unchanged.
577 */
578 memset(&ct->tuplehash[IP_CT_DIR_MAX], 0,
579 sizeof(*ct) - offsetof(struct nf_conn, tuplehash[IP_CT_DIR_MAX]));
571 spin_lock_init(&ct->lock); 580 spin_lock_init(&ct->lock);
572 atomic_set(&ct->ct_general.use, 1);
573 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig; 581 ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple = *orig;
582 ct->tuplehash[IP_CT_DIR_ORIGINAL].hnnode.pprev = NULL;
574 ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl; 583 ct->tuplehash[IP_CT_DIR_REPLY].tuple = *repl;
584 ct->tuplehash[IP_CT_DIR_REPLY].hnnode.pprev = NULL;
575 /* Don't set timer yet: wait for confirmation */ 585 /* Don't set timer yet: wait for confirmation */
576 setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct); 586 setup_timer(&ct->timeout, death_by_timeout, (unsigned long)ct);
577#ifdef CONFIG_NET_NS 587#ifdef CONFIG_NET_NS
578 ct->ct_net = net; 588 ct->ct_net = net;
579#endif 589#endif
580 590
591 /*
592 * changes to lookup keys must be done before setting refcnt to 1
593 */
594 smp_wmb();
595 atomic_set(&ct->ct_general.use, 1);
581 return ct; 596 return ct;
582} 597}
583EXPORT_SYMBOL_GPL(nf_conntrack_alloc); 598EXPORT_SYMBOL_GPL(nf_conntrack_alloc);
diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
index 43f5676b1af4..d80b8192e0d4 100644
--- a/net/netfilter/xt_RATEEST.c
+++ b/net/netfilter/xt_RATEEST.c
@@ -74,7 +74,7 @@ static unsigned int
74xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par) 74xt_rateest_tg(struct sk_buff *skb, const struct xt_target_param *par)
75{ 75{
76 const struct xt_rateest_target_info *info = par->targinfo; 76 const struct xt_rateest_target_info *info = par->targinfo;
77 struct gnet_stats_basic *stats = &info->est->bstats; 77 struct gnet_stats_basic_packed *stats = &info->est->bstats;
78 78
79 spin_lock_bh(&info->est->lock); 79 spin_lock_bh(&info->est->lock);
80 stats->bytes += skb->len; 80 stats->bytes += skb->len;
diff --git a/net/netfilter/xt_osf.c b/net/netfilter/xt_osf.c
index 863e40977a4d..0f482e2440b4 100644
--- a/net/netfilter/xt_osf.c
+++ b/net/netfilter/xt_osf.c
@@ -330,7 +330,8 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
330 fcount++; 330 fcount++;
331 331
332 if (info->flags & XT_OSF_LOG) 332 if (info->flags & XT_OSF_LOG)
333 nf_log_packet(p->hooknum, 0, skb, p->in, p->out, NULL, 333 nf_log_packet(p->family, p->hooknum, skb,
334 p->in, p->out, NULL,
334 "%s [%s:%s] : %pi4:%d -> %pi4:%d hops=%d\n", 335 "%s [%s:%s] : %pi4:%d -> %pi4:%d hops=%d\n",
335 f->genre, f->version, f->subtype, 336 f->genre, f->version, f->subtype,
336 &ip->saddr, ntohs(tcp->source), 337 &ip->saddr, ntohs(tcp->source),
@@ -345,7 +346,7 @@ static bool xt_osf_match_packet(const struct sk_buff *skb,
345 rcu_read_unlock(); 346 rcu_read_unlock();
346 347
347 if (!fcount && (info->flags & XT_OSF_LOG)) 348 if (!fcount && (info->flags & XT_OSF_LOG))
348 nf_log_packet(p->hooknum, 0, skb, p->in, p->out, NULL, 349 nf_log_packet(p->family, p->hooknum, skb, p->in, p->out, NULL,
349 "Remote OS is not known: %pi4:%u -> %pi4:%u\n", 350 "Remote OS is not known: %pi4:%u -> %pi4:%u\n",
350 &ip->saddr, ntohs(tcp->source), 351 &ip->saddr, ntohs(tcp->source),
351 &ip->daddr, ntohs(tcp->dest)); 352 &ip->daddr, ntohs(tcp->dest));
diff --git a/net/netfilter/xt_quota.c b/net/netfilter/xt_quota.c
index 98fc190e8f0e..390b7d09fe51 100644
--- a/net/netfilter/xt_quota.c
+++ b/net/netfilter/xt_quota.c
@@ -52,7 +52,7 @@ static bool quota_mt_check(const struct xt_mtchk_param *par)
52 52
53 q->master = kmalloc(sizeof(*q->master), GFP_KERNEL); 53 q->master = kmalloc(sizeof(*q->master), GFP_KERNEL);
54 if (q->master == NULL) 54 if (q->master == NULL)
55 return -ENOMEM; 55 return false;
56 56
57 q->master->quota = q->quota; 57 q->master->quota = q->quota;
58 return true; 58 return true;
diff --git a/net/netlabel/netlabel_kapi.c b/net/netlabel/netlabel_kapi.c
index b0e582f2d37a..16e6c4378ff1 100644
--- a/net/netlabel/netlabel_kapi.c
+++ b/net/netlabel/netlabel_kapi.c
@@ -151,7 +151,7 @@ int netlbl_cfg_unlbl_map_add(const char *domain,
151 addr6 = addr; 151 addr6 = addr;
152 mask6 = mask; 152 mask6 = mask;
153 map6 = kzalloc(sizeof(*map6), GFP_ATOMIC); 153 map6 = kzalloc(sizeof(*map6), GFP_ATOMIC);
154 if (map4 == NULL) 154 if (map6 == NULL)
155 goto cfg_unlbl_map_add_failure; 155 goto cfg_unlbl_map_add_failure;
156 map6->type = NETLBL_NLTYPE_UNLABELED; 156 map6->type = NETLBL_NLTYPE_UNLABELED;
157 ipv6_addr_copy(&map6->list.addr, addr6); 157 ipv6_addr_copy(&map6->list.addr, addr6);
diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index ce51ce012cda..ce1a34b99c23 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -847,6 +847,7 @@ static int nr_getname(struct socket *sock, struct sockaddr *uaddr,
847 sax->fsa_ax25.sax25_family = AF_NETROM; 847 sax->fsa_ax25.sax25_family = AF_NETROM;
848 sax->fsa_ax25.sax25_ndigis = 1; 848 sax->fsa_ax25.sax25_ndigis = 1;
849 sax->fsa_ax25.sax25_call = nr->user_addr; 849 sax->fsa_ax25.sax25_call = nr->user_addr;
850 memset(sax->fsa_digipeater, 0, sizeof(sax->fsa_digipeater));
850 sax->fsa_digipeater[0] = nr->dest_addr; 851 sax->fsa_digipeater[0] = nr->dest_addr;
851 *uaddr_len = sizeof(struct full_sockaddr_ax25); 852 *uaddr_len = sizeof(struct full_sockaddr_ax25);
852 } else { 853 } else {
diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index e943c16552a2..4eb1ac9a7679 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c
@@ -630,23 +630,23 @@ out:
630 return dev; 630 return dev;
631} 631}
632 632
633static ax25_digi *nr_call_to_digi(int ndigis, ax25_address *digipeaters) 633static ax25_digi *nr_call_to_digi(ax25_digi *digi, int ndigis,
634 ax25_address *digipeaters)
634{ 635{
635 static ax25_digi ax25_digi;
636 int i; 636 int i;
637 637
638 if (ndigis == 0) 638 if (ndigis == 0)
639 return NULL; 639 return NULL;
640 640
641 for (i = 0; i < ndigis; i++) { 641 for (i = 0; i < ndigis; i++) {
642 ax25_digi.calls[i] = digipeaters[i]; 642 digi->calls[i] = digipeaters[i];
643 ax25_digi.repeated[i] = 0; 643 digi->repeated[i] = 0;
644 } 644 }
645 645
646 ax25_digi.ndigi = ndigis; 646 digi->ndigi = ndigis;
647 ax25_digi.lastrepeat = -1; 647 digi->lastrepeat = -1;
648 648
649 return &ax25_digi; 649 return digi;
650} 650}
651 651
652/* 652/*
@@ -656,6 +656,7 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
656{ 656{
657 struct nr_route_struct nr_route; 657 struct nr_route_struct nr_route;
658 struct net_device *dev; 658 struct net_device *dev;
659 ax25_digi digi;
659 int ret; 660 int ret;
660 661
661 switch (cmd) { 662 switch (cmd) {
@@ -673,13 +674,15 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
673 ret = nr_add_node(&nr_route.callsign, 674 ret = nr_add_node(&nr_route.callsign,
674 nr_route.mnemonic, 675 nr_route.mnemonic,
675 &nr_route.neighbour, 676 &nr_route.neighbour,
676 nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters), 677 nr_call_to_digi(&digi, nr_route.ndigis,
678 nr_route.digipeaters),
677 dev, nr_route.quality, 679 dev, nr_route.quality,
678 nr_route.obs_count); 680 nr_route.obs_count);
679 break; 681 break;
680 case NETROM_NEIGH: 682 case NETROM_NEIGH:
681 ret = nr_add_neigh(&nr_route.callsign, 683 ret = nr_add_neigh(&nr_route.callsign,
682 nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters), 684 nr_call_to_digi(&digi, nr_route.ndigis,
685 nr_route.digipeaters),
683 dev, nr_route.quality); 686 dev, nr_route.quality);
684 break; 687 break;
685 default: 688 default:
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index b0d6ddd82a9d..c2b77a698695 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -96,7 +96,7 @@ struct net_device *phonet_device_get(struct net *net)
96{ 96{
97 struct phonet_device_list *pndevs = phonet_device_list(net); 97 struct phonet_device_list *pndevs = phonet_device_list(net);
98 struct phonet_device *pnd; 98 struct phonet_device *pnd;
99 struct net_device *dev; 99 struct net_device *dev = NULL;
100 100
101 spin_lock_bh(&pndevs->lock); 101 spin_lock_bh(&pndevs->lock);
102 list_for_each_entry(pnd, &pndevs->list, list) { 102 list_for_each_entry(pnd, &pndevs->list, list) {
diff --git a/net/rfkill/core.c b/net/rfkill/core.c
index 79693fe2001e..2fc4a1724eb8 100644
--- a/net/rfkill/core.c
+++ b/net/rfkill/core.c
@@ -549,6 +549,10 @@ void rfkill_set_states(struct rfkill *rfkill, bool sw, bool hw)
549 swprev = !!(rfkill->state & RFKILL_BLOCK_SW); 549 swprev = !!(rfkill->state & RFKILL_BLOCK_SW);
550 hwprev = !!(rfkill->state & RFKILL_BLOCK_HW); 550 hwprev = !!(rfkill->state & RFKILL_BLOCK_HW);
551 __rfkill_set_sw_state(rfkill, sw); 551 __rfkill_set_sw_state(rfkill, sw);
552 if (hw)
553 rfkill->state |= RFKILL_BLOCK_HW;
554 else
555 rfkill->state &= ~RFKILL_BLOCK_HW;
552 556
553 spin_unlock_irqrestore(&rfkill->lock, flags); 557 spin_unlock_irqrestore(&rfkill->lock, flags);
554 558
@@ -648,15 +652,26 @@ static ssize_t rfkill_state_store(struct device *dev,
648 struct device_attribute *attr, 652 struct device_attribute *attr,
649 const char *buf, size_t count) 653 const char *buf, size_t count)
650{ 654{
651 /* 655 struct rfkill *rfkill = to_rfkill(dev);
652 * The intention was that userspace can only take control over 656 unsigned long state;
653 * a given device when/if rfkill-input doesn't control it due 657 int err;
654 * to user_claim. Since user_claim is currently unsupported, 658
655 * we never support changing the state from userspace -- this 659 if (!capable(CAP_NET_ADMIN))
656 * can be implemented again later. 660 return -EPERM;
657 */ 661
662 err = strict_strtoul(buf, 0, &state);
663 if (err)
664 return err;
665
666 if (state != RFKILL_USER_STATE_SOFT_BLOCKED &&
667 state != RFKILL_USER_STATE_UNBLOCKED)
668 return -EINVAL;
669
670 mutex_lock(&rfkill_global_mutex);
671 rfkill_set_block(rfkill, state == RFKILL_USER_STATE_SOFT_BLOCKED);
672 mutex_unlock(&rfkill_global_mutex);
658 673
659 return -EPERM; 674 return err ?: count;
660} 675}
661 676
662static ssize_t rfkill_claim_show(struct device *dev, 677static ssize_t rfkill_claim_show(struct device *dev,
diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 6bd8e93869ed..e5f478ca3d61 100644
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -92,23 +92,21 @@ static void rose_set_lockdep_key(struct net_device *dev)
92/* 92/*
93 * Convert a ROSE address into text. 93 * Convert a ROSE address into text.
94 */ 94 */
95const char *rose2asc(const rose_address *addr) 95char *rose2asc(char *buf, const rose_address *addr)
96{ 96{
97 static char buffer[11];
98
99 if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 && 97 if (addr->rose_addr[0] == 0x00 && addr->rose_addr[1] == 0x00 &&
100 addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 && 98 addr->rose_addr[2] == 0x00 && addr->rose_addr[3] == 0x00 &&
101 addr->rose_addr[4] == 0x00) { 99 addr->rose_addr[4] == 0x00) {
102 strcpy(buffer, "*"); 100 strcpy(buf, "*");
103 } else { 101 } else {
104 sprintf(buffer, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF, 102 sprintf(buf, "%02X%02X%02X%02X%02X", addr->rose_addr[0] & 0xFF,
105 addr->rose_addr[1] & 0xFF, 103 addr->rose_addr[1] & 0xFF,
106 addr->rose_addr[2] & 0xFF, 104 addr->rose_addr[2] & 0xFF,
107 addr->rose_addr[3] & 0xFF, 105 addr->rose_addr[3] & 0xFF,
108 addr->rose_addr[4] & 0xFF); 106 addr->rose_addr[4] & 0xFF);
109 } 107 }
110 108
111 return buffer; 109 return buf;
112} 110}
113 111
114/* 112/*
@@ -956,6 +954,7 @@ static int rose_getname(struct socket *sock, struct sockaddr *uaddr,
956 struct rose_sock *rose = rose_sk(sk); 954 struct rose_sock *rose = rose_sk(sk);
957 int n; 955 int n;
958 956
957 memset(srose, 0, sizeof(*srose));
959 if (peer != 0) { 958 if (peer != 0) {
960 if (sk->sk_state != TCP_ESTABLISHED) 959 if (sk->sk_state != TCP_ESTABLISHED)
961 return -ENOTCONN; 960 return -ENOTCONN;
@@ -1437,7 +1436,7 @@ static void rose_info_stop(struct seq_file *seq, void *v)
1437 1436
1438static int rose_info_show(struct seq_file *seq, void *v) 1437static int rose_info_show(struct seq_file *seq, void *v)
1439{ 1438{
1440 char buf[11]; 1439 char buf[11], rsbuf[11];
1441 1440
1442 if (v == SEQ_START_TOKEN) 1441 if (v == SEQ_START_TOKEN)
1443 seq_puts(seq, 1442 seq_puts(seq,
@@ -1455,8 +1454,8 @@ static int rose_info_show(struct seq_file *seq, void *v)
1455 devname = dev->name; 1454 devname = dev->name;
1456 1455
1457 seq_printf(seq, "%-10s %-9s ", 1456 seq_printf(seq, "%-10s %-9s ",
1458 rose2asc(&rose->dest_addr), 1457 rose2asc(rsbuf, &rose->dest_addr),
1459 ax2asc(buf, &rose->dest_call)); 1458 ax2asc(buf, &rose->dest_call));
1460 1459
1461 if (ax25cmp(&rose->source_call, &null_ax25_address) == 0) 1460 if (ax25cmp(&rose->source_call, &null_ax25_address) == 0)
1462 callsign = "??????-?"; 1461 callsign = "??????-?";
@@ -1465,7 +1464,7 @@ static int rose_info_show(struct seq_file *seq, void *v)
1465 1464
1466 seq_printf(seq, 1465 seq_printf(seq,
1467 "%-10s %-9s %-5s %3.3X %05d %d %d %d %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n", 1466 "%-10s %-9s %-5s %3.3X %05d %d %d %d %d %3lu %3lu %3lu %3lu %3lu %3lu/%03lu %5d %5d %ld\n",
1468 rose2asc(&rose->source_addr), 1467 rose2asc(rsbuf, &rose->source_addr),
1469 callsign, 1468 callsign,
1470 devname, 1469 devname,
1471 rose->lci & 0x0FFF, 1470 rose->lci & 0x0FFF,
diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index a81066a1010a..9478d9b3d977 100644
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -1104,6 +1104,7 @@ static void rose_node_stop(struct seq_file *seq, void *v)
1104 1104
1105static int rose_node_show(struct seq_file *seq, void *v) 1105static int rose_node_show(struct seq_file *seq, void *v)
1106{ 1106{
1107 char rsbuf[11];
1107 int i; 1108 int i;
1108 1109
1109 if (v == SEQ_START_TOKEN) 1110 if (v == SEQ_START_TOKEN)
@@ -1112,13 +1113,13 @@ static int rose_node_show(struct seq_file *seq, void *v)
1112 const struct rose_node *rose_node = v; 1113 const struct rose_node *rose_node = v;
1113 /* if (rose_node->loopback) { 1114 /* if (rose_node->loopback) {
1114 seq_printf(seq, "%-10s %04d 1 loopback\n", 1115 seq_printf(seq, "%-10s %04d 1 loopback\n",
1115 rose2asc(&rose_node->address), 1116 rose2asc(rsbuf, &rose_node->address),
1116 rose_node->mask); 1117 rose_node->mask);
1117 } else { */ 1118 } else { */
1118 seq_printf(seq, "%-10s %04d %d", 1119 seq_printf(seq, "%-10s %04d %d",
1119 rose2asc(&rose_node->address), 1120 rose2asc(rsbuf, &rose_node->address),
1120 rose_node->mask, 1121 rose_node->mask,
1121 rose_node->count); 1122 rose_node->count);
1122 1123
1123 for (i = 0; i < rose_node->count; i++) 1124 for (i = 0; i < rose_node->count; i++)
1124 seq_printf(seq, " %05d", 1125 seq_printf(seq, " %05d",
@@ -1267,7 +1268,7 @@ static void rose_route_stop(struct seq_file *seq, void *v)
1267 1268
1268static int rose_route_show(struct seq_file *seq, void *v) 1269static int rose_route_show(struct seq_file *seq, void *v)
1269{ 1270{
1270 char buf[11]; 1271 char buf[11], rsbuf[11];
1271 1272
1272 if (v == SEQ_START_TOKEN) 1273 if (v == SEQ_START_TOKEN)
1273 seq_puts(seq, 1274 seq_puts(seq,
@@ -1279,7 +1280,7 @@ static int rose_route_show(struct seq_file *seq, void *v)
1279 seq_printf(seq, 1280 seq_printf(seq,
1280 "%3.3X %-10s %-9s %05d ", 1281 "%3.3X %-10s %-9s %05d ",
1281 rose_route->lci1, 1282 rose_route->lci1,
1282 rose2asc(&rose_route->src_addr), 1283 rose2asc(rsbuf, &rose_route->src_addr),
1283 ax2asc(buf, &rose_route->src_call), 1284 ax2asc(buf, &rose_route->src_call),
1284 rose_route->neigh1->number); 1285 rose_route->neigh1->number);
1285 else 1286 else
@@ -1289,10 +1290,10 @@ static int rose_route_show(struct seq_file *seq, void *v)
1289 if (rose_route->neigh2) 1290 if (rose_route->neigh2)
1290 seq_printf(seq, 1291 seq_printf(seq,
1291 "%3.3X %-10s %-9s %05d\n", 1292 "%3.3X %-10s %-9s %05d\n",
1292 rose_route->lci2, 1293 rose_route->lci2,
1293 rose2asc(&rose_route->dest_addr), 1294 rose2asc(rsbuf, &rose_route->dest_addr),
1294 ax2asc(buf, &rose_route->dest_call), 1295 ax2asc(buf, &rose_route->dest_call),
1295 rose_route->neigh2->number); 1296 rose_route->neigh2->number);
1296 else 1297 else
1297 seq_puts(seq, 1298 seq_puts(seq,
1298 "000 * * 00000\n"); 1299 "000 * * 00000\n");
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index eac5e7bb7365..bfe493ebf27c 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -63,7 +63,7 @@ static void rxrpc_write_space(struct sock *sk)
63 _enter("%p", sk); 63 _enter("%p", sk);
64 read_lock(&sk->sk_callback_lock); 64 read_lock(&sk->sk_callback_lock);
65 if (rxrpc_writable(sk)) { 65 if (rxrpc_writable(sk)) {
66 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 66 if (sk_has_sleeper(sk))
67 wake_up_interruptible(sk->sk_sleep); 67 wake_up_interruptible(sk->sk_sleep);
68 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT); 68 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
69 } 69 }
@@ -588,7 +588,7 @@ static unsigned int rxrpc_poll(struct file *file, struct socket *sock,
588 unsigned int mask; 588 unsigned int mask;
589 struct sock *sk = sock->sk; 589 struct sock *sk = sock->sk;
590 590
591 poll_wait(file, sk->sk_sleep, wait); 591 sock_poll_wait(file, sk->sk_sleep, wait);
592 mask = 0; 592 mask = 0;
593 593
594 /* the socket is readable if there are any messages waiting on the Rx 594 /* the socket is readable if there are any messages waiting on the Rx
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 24d17ce9c294..fdb694e9f759 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1456,6 +1456,8 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
1456 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags); 1456 nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*tcm), flags);
1457 tcm = NLMSG_DATA(nlh); 1457 tcm = NLMSG_DATA(nlh);
1458 tcm->tcm_family = AF_UNSPEC; 1458 tcm->tcm_family = AF_UNSPEC;
1459 tcm->tcm__pad1 = 0;
1460 tcm->tcm__pad2 = 0;
1459 tcm->tcm_ifindex = qdisc_dev(q)->ifindex; 1461 tcm->tcm_ifindex = qdisc_dev(q)->ifindex;
1460 tcm->tcm_parent = q->handle; 1462 tcm->tcm_parent = q->handle;
1461 tcm->tcm_handle = q->handle; 1463 tcm->tcm_handle = q->handle;
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 2a8b83af7c47..ab82f145f689 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -49,7 +49,7 @@ struct atm_flow_data {
49 struct socket *sock; /* for closing */ 49 struct socket *sock; /* for closing */
50 u32 classid; /* x:y type ID */ 50 u32 classid; /* x:y type ID */
51 int ref; /* reference count */ 51 int ref; /* reference count */
52 struct gnet_stats_basic bstats; 52 struct gnet_stats_basic_packed bstats;
53 struct gnet_stats_queue qstats; 53 struct gnet_stats_queue qstats;
54 struct atm_flow_data *next; 54 struct atm_flow_data *next;
55 struct atm_flow_data *excess; /* flow for excess traffic; 55 struct atm_flow_data *excess; /* flow for excess traffic;
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 23a167670fd5..d5798e17a832 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -128,7 +128,7 @@ struct cbq_class
128 long avgidle; 128 long avgidle;
129 long deficit; /* Saved deficit for WRR */ 129 long deficit; /* Saved deficit for WRR */
130 psched_time_t penalized; 130 psched_time_t penalized;
131 struct gnet_stats_basic bstats; 131 struct gnet_stats_basic_packed bstats;
132 struct gnet_stats_queue qstats; 132 struct gnet_stats_queue qstats;
133 struct gnet_stats_rate_est rate_est; 133 struct gnet_stats_rate_est rate_est;
134 struct tc_cbq_xstats xstats; 134 struct tc_cbq_xstats xstats;
diff --git a/net/sched/sch_drr.c b/net/sched/sch_drr.c
index 7597fe146866..12b2fb04b29b 100644
--- a/net/sched/sch_drr.c
+++ b/net/sched/sch_drr.c
@@ -22,7 +22,7 @@ struct drr_class {
22 unsigned int refcnt; 22 unsigned int refcnt;
23 unsigned int filter_cnt; 23 unsigned int filter_cnt;
24 24
25 struct gnet_stats_basic bstats; 25 struct gnet_stats_basic_packed bstats;
26 struct gnet_stats_queue qstats; 26 struct gnet_stats_queue qstats;
27 struct gnet_stats_rate_est rate_est; 27 struct gnet_stats_rate_est rate_est;
28 struct list_head alist; 28 struct list_head alist;
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 362c2811b2df..dad0144423da 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -116,7 +116,7 @@ struct hfsc_class
116 struct Qdisc_class_common cl_common; 116 struct Qdisc_class_common cl_common;
117 unsigned int refcnt; /* usage count */ 117 unsigned int refcnt; /* usage count */
118 118
119 struct gnet_stats_basic bstats; 119 struct gnet_stats_basic_packed bstats;
120 struct gnet_stats_queue qstats; 120 struct gnet_stats_queue qstats;
121 struct gnet_stats_rate_est rate_est; 121 struct gnet_stats_rate_est rate_est;
122 unsigned int level; /* class level in hierarchy */ 122 unsigned int level; /* class level in hierarchy */
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 88cd02626621..ec4d46399d59 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -74,7 +74,7 @@ enum htb_cmode {
74struct htb_class { 74struct htb_class {
75 struct Qdisc_class_common common; 75 struct Qdisc_class_common common;
76 /* general class parameters */ 76 /* general class parameters */
77 struct gnet_stats_basic bstats; 77 struct gnet_stats_basic_packed bstats;
78 struct gnet_stats_queue qstats; 78 struct gnet_stats_queue qstats;
79 struct gnet_stats_rate_est rate_est; 79 struct gnet_stats_rate_est rate_est;
80 struct tc_htb_xstats xstats; /* our special stats */ 80 struct tc_htb_xstats xstats; /* our special stats */
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index 79cbd47f4df7..a76da657244a 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -160,6 +160,7 @@ static void sctp_proc_exit(void)
160 remove_proc_entry("sctp", init_net.proc_net); 160 remove_proc_entry("sctp", init_net.proc_net);
161 } 161 }
162#endif 162#endif
163 percpu_counter_destroy(&sctp_sockets_allocated);
163} 164}
164 165
165/* Private helper to extract ipv4 address and stash them in 166/* Private helper to extract ipv4 address and stash them in
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 35ba035970a2..971890dbfea0 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -6652,21 +6652,6 @@ static void sctp_wait_for_close(struct sock *sk, long timeout)
6652 finish_wait(sk->sk_sleep, &wait); 6652 finish_wait(sk->sk_sleep, &wait);
6653} 6653}
6654 6654
6655static void sctp_sock_rfree_frag(struct sk_buff *skb)
6656{
6657 struct sk_buff *frag;
6658
6659 if (!skb->data_len)
6660 goto done;
6661
6662 /* Don't forget the fragments. */
6663 skb_walk_frags(skb, frag)
6664 sctp_sock_rfree_frag(frag);
6665
6666done:
6667 sctp_sock_rfree(skb);
6668}
6669
6670static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk) 6655static void sctp_skb_set_owner_r_frag(struct sk_buff *skb, struct sock *sk)
6671{ 6656{
6672 struct sk_buff *frag; 6657 struct sk_buff *frag;
@@ -6776,7 +6761,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
6776 sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) { 6761 sctp_skb_for_each(skb, &oldsk->sk_receive_queue, tmp) {
6777 event = sctp_skb2event(skb); 6762 event = sctp_skb2event(skb);
6778 if (event->asoc == assoc) { 6763 if (event->asoc == assoc) {
6779 sctp_sock_rfree_frag(skb);
6780 __skb_unlink(skb, &oldsk->sk_receive_queue); 6764 __skb_unlink(skb, &oldsk->sk_receive_queue);
6781 __skb_queue_tail(&newsk->sk_receive_queue, skb); 6765 __skb_queue_tail(&newsk->sk_receive_queue, skb);
6782 sctp_skb_set_owner_r_frag(skb, newsk); 6766 sctp_skb_set_owner_r_frag(skb, newsk);
@@ -6807,7 +6791,6 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
6807 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) { 6791 sctp_skb_for_each(skb, &oldsp->pd_lobby, tmp) {
6808 event = sctp_skb2event(skb); 6792 event = sctp_skb2event(skb);
6809 if (event->asoc == assoc) { 6793 if (event->asoc == assoc) {
6810 sctp_sock_rfree_frag(skb);
6811 __skb_unlink(skb, &oldsp->pd_lobby); 6794 __skb_unlink(skb, &oldsp->pd_lobby);
6812 __skb_queue_tail(queue, skb); 6795 __skb_queue_tail(queue, skb);
6813 sctp_skb_set_owner_r_frag(skb, newsk); 6796 sctp_skb_set_owner_r_frag(skb, newsk);
@@ -6822,15 +6805,11 @@ static void sctp_sock_migrate(struct sock *oldsk, struct sock *newsk,
6822 6805
6823 } 6806 }
6824 6807
6825 sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp) { 6808 sctp_skb_for_each(skb, &assoc->ulpq.reasm, tmp)
6826 sctp_sock_rfree_frag(skb);
6827 sctp_skb_set_owner_r_frag(skb, newsk); 6809 sctp_skb_set_owner_r_frag(skb, newsk);
6828 }
6829 6810
6830 sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp) { 6811 sctp_skb_for_each(skb, &assoc->ulpq.lobby, tmp)
6831 sctp_sock_rfree_frag(skb);
6832 sctp_skb_set_owner_r_frag(skb, newsk); 6812 sctp_skb_set_owner_r_frag(skb, newsk);
6833 }
6834 6813
6835 /* Set the type of socket to indicate that it is peeled off from the 6814 /* Set the type of socket to indicate that it is peeled off from the
6836 * original UDP-style socket or created with the accept() call on a 6815 * original UDP-style socket or created with the accept() call on a
diff --git a/net/socket.c b/net/socket.c
index 791d71a36a93..6d4716559047 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -736,7 +736,7 @@ static ssize_t sock_sendpage(struct file *file, struct page *page,
736 if (more) 736 if (more)
737 flags |= MSG_MORE; 737 flags |= MSG_MORE;
738 738
739 return sock->ops->sendpage(sock, page, offset, size, flags); 739 return kernel_sendpage(sock, page, offset, size, flags);
740} 740}
741 741
742static ssize_t sock_splice_read(struct file *file, loff_t *ppos, 742static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index 5bc2f45bddf0..df1039f077c2 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -28,7 +28,6 @@
28#include <linux/kallsyms.h> 28#include <linux/kallsyms.h>
29#include <linux/mm.h> 29#include <linux/mm.h>
30#include <linux/slab.h> 30#include <linux/slab.h>
31#include <linux/smp_lock.h>
32#include <linux/utsname.h> 31#include <linux/utsname.h>
33#include <linux/workqueue.h> 32#include <linux/workqueue.h>
34#include <linux/in6.h> 33#include <linux/in6.h>
@@ -938,6 +937,7 @@ static inline void
938rpc_task_force_reencode(struct rpc_task *task) 937rpc_task_force_reencode(struct rpc_task *task)
939{ 938{
940 task->tk_rqstp->rq_snd_buf.len = 0; 939 task->tk_rqstp->rq_snd_buf.len = 0;
940 task->tk_rqstp->rq_bytes_sent = 0;
941} 941}
942 942
943static inline void 943static inline void
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 1102ce1251f7..8f459abe97cf 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -16,7 +16,6 @@
16#include <linux/slab.h> 16#include <linux/slab.h>
17#include <linux/mempool.h> 17#include <linux/mempool.h>
18#include <linux/smp.h> 18#include <linux/smp.h>
19#include <linux/smp_lock.h>
20#include <linux/spinlock.h> 19#include <linux/spinlock.h>
21#include <linux/mutex.h> 20#include <linux/mutex.h>
22 21
diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
index 6f33d33cc064..27d44332f017 100644
--- a/net/sunrpc/svc_xprt.c
+++ b/net/sunrpc/svc_xprt.c
@@ -5,6 +5,7 @@
5 */ 5 */
6 6
7#include <linux/sched.h> 7#include <linux/sched.h>
8#include <linux/smp_lock.h>
8#include <linux/errno.h> 9#include <linux/errno.h>
9#include <linux/freezer.h> 10#include <linux/freezer.h>
10#include <linux/kthread.h> 11#include <linux/kthread.h>
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 36d4e44d6233..fc3ebb906911 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -315,7 +315,7 @@ static void unix_write_space(struct sock *sk)
315{ 315{
316 read_lock(&sk->sk_callback_lock); 316 read_lock(&sk->sk_callback_lock);
317 if (unix_writable(sk)) { 317 if (unix_writable(sk)) {
318 if (sk->sk_sleep && waitqueue_active(sk->sk_sleep)) 318 if (sk_has_sleeper(sk))
319 wake_up_interruptible_sync(sk->sk_sleep); 319 wake_up_interruptible_sync(sk->sk_sleep);
320 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT); 320 sk_wake_async(sk, SOCK_WAKE_SPACE, POLL_OUT);
321 } 321 }
@@ -1985,7 +1985,7 @@ static unsigned int unix_poll(struct file *file, struct socket *sock, poll_table
1985 struct sock *sk = sock->sk; 1985 struct sock *sk = sock->sk;
1986 unsigned int mask; 1986 unsigned int mask;
1987 1987
1988 poll_wait(file, sk->sk_sleep, wait); 1988 sock_poll_wait(file, sk->sk_sleep, wait);
1989 mask = 0; 1989 mask = 0;
1990 1990
1991 /* exceptional events? */ 1991 /* exceptional events? */
@@ -2022,7 +2022,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
2022 struct sock *sk = sock->sk, *other; 2022 struct sock *sk = sock->sk, *other;
2023 unsigned int mask, writable; 2023 unsigned int mask, writable;
2024 2024
2025 poll_wait(file, sk->sk_sleep, wait); 2025 sock_poll_wait(file, sk->sk_sleep, wait);
2026 mask = 0; 2026 mask = 0;
2027 2027
2028 /* exceptional events? */ 2028 /* exceptional events? */
@@ -2053,7 +2053,7 @@ static unsigned int unix_dgram_poll(struct file *file, struct socket *sock,
2053 other = unix_peer_get(sk); 2053 other = unix_peer_get(sk);
2054 if (other) { 2054 if (other) {
2055 if (unix_peer(other) != sk) { 2055 if (unix_peer(other) != sk) {
2056 poll_wait(file, &unix_sk(other)->peer_wait, 2056 sock_poll_wait(file, &unix_sk(other)->peer_wait,
2057 wait); 2057 wait);
2058 if (unix_recvq_full(other)) 2058 if (unix_recvq_full(other))
2059 writable = 0; 2059 writable = 0;
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 466e2d22d256..258daa80ad92 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -48,6 +48,7 @@
48#include <linux/kernel.h> 48#include <linux/kernel.h>
49#include <linux/module.h> /* support for loadable modules */ 49#include <linux/module.h> /* support for loadable modules */
50#include <linux/slab.h> /* kmalloc(), kfree() */ 50#include <linux/slab.h> /* kmalloc(), kfree() */
51#include <linux/smp_lock.h>
51#include <linux/mm.h> 52#include <linux/mm.h>
52#include <linux/string.h> /* inline mem*, str* functions */ 53#include <linux/string.h> /* inline mem*, str* functions */
53 54
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 241bddd0b4f1..634496b3ed77 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -447,6 +447,7 @@ static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
447 447
448 rdev = __cfg80211_drv_from_info(info); 448 rdev = __cfg80211_drv_from_info(info);
449 if (IS_ERR(rdev)) { 449 if (IS_ERR(rdev)) {
450 mutex_unlock(&cfg80211_mutex);
450 result = PTR_ERR(rdev); 451 result = PTR_ERR(rdev);
451 goto unlock; 452 goto unlock;
452 } 453 }
@@ -996,7 +997,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
996 997
997 if (IS_ERR(hdr)) { 998 if (IS_ERR(hdr)) {
998 err = PTR_ERR(hdr); 999 err = PTR_ERR(hdr);
999 goto out; 1000 goto free_msg;
1000 } 1001 }
1001 1002
1002 cookie.msg = msg; 1003 cookie.msg = msg;
@@ -1010,7 +1011,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1010 &cookie, get_key_callback); 1011 &cookie, get_key_callback);
1011 1012
1012 if (err) 1013 if (err)
1013 goto out; 1014 goto free_msg;
1014 1015
1015 if (cookie.error) 1016 if (cookie.error)
1016 goto nla_put_failure; 1017 goto nla_put_failure;
@@ -1021,6 +1022,7 @@ static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
1021 1022
1022 nla_put_failure: 1023 nla_put_failure:
1023 err = -ENOBUFS; 1024 err = -ENOBUFS;
1025 free_msg:
1024 nlmsg_free(msg); 1026 nlmsg_free(msg);
1025 out: 1027 out:
1026 cfg80211_put_dev(drv); 1028 cfg80211_put_dev(drv);
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index 5e14371cda70..75a406d33619 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -1089,17 +1089,18 @@ static void handle_reg_beacon(struct wiphy *wiphy,
1089 1089
1090 chan->beacon_found = true; 1090 chan->beacon_found = true;
1091 1091
1092 if (wiphy->disable_beacon_hints)
1093 return;
1094
1092 chan_before.center_freq = chan->center_freq; 1095 chan_before.center_freq = chan->center_freq;
1093 chan_before.flags = chan->flags; 1096 chan_before.flags = chan->flags;
1094 1097
1095 if ((chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) && 1098 if (chan->flags & IEEE80211_CHAN_PASSIVE_SCAN) {
1096 !(chan->orig_flags & IEEE80211_CHAN_PASSIVE_SCAN)) {
1097 chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN; 1099 chan->flags &= ~IEEE80211_CHAN_PASSIVE_SCAN;
1098 channel_changed = true; 1100 channel_changed = true;
1099 } 1101 }
1100 1102
1101 if ((chan->flags & IEEE80211_CHAN_NO_IBSS) && 1103 if (chan->flags & IEEE80211_CHAN_NO_IBSS) {
1102 !(chan->orig_flags & IEEE80211_CHAN_NO_IBSS)) {
1103 chan->flags &= ~IEEE80211_CHAN_NO_IBSS; 1104 chan->flags &= ~IEEE80211_CHAN_NO_IBSS;
1104 channel_changed = true; 1105 channel_changed = true;
1105 } 1106 }
diff --git a/net/wireless/reg.h b/net/wireless/reg.h
index e37829a49dc4..4e167a8e11be 100644
--- a/net/wireless/reg.h
+++ b/net/wireless/reg.h
@@ -30,7 +30,8 @@ int set_regdom(const struct ieee80211_regdomain *rd);
30 * non-radar 5 GHz channels. 30 * non-radar 5 GHz channels.
31 * 31 *
32 * Drivers do not need to call this, cfg80211 will do it for after a scan 32 * Drivers do not need to call this, cfg80211 will do it for after a scan
33 * on a newly found BSS. 33 * on a newly found BSS. If you cannot make use of this feature you can
34 * set the wiphy->disable_beacon_hints to true.
34 */ 35 */
35int regulatory_hint_found_beacon(struct wiphy *wiphy, 36int regulatory_hint_found_beacon(struct wiphy *wiphy,
36 struct ieee80211_channel *beacon_chan, 37 struct ieee80211_channel *beacon_chan,
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index e95b638b919f..7e595ce24eeb 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -35,8 +35,6 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
35 else 35 else
36 nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev); 36 nl80211_send_scan_done(wiphy_to_dev(request->wiphy), dev);
37 37
38 wiphy_to_dev(request->wiphy)->scan_req = NULL;
39
40#ifdef CONFIG_WIRELESS_EXT 38#ifdef CONFIG_WIRELESS_EXT
41 if (!aborted) { 39 if (!aborted) {
42 memset(&wrqu, 0, sizeof(wrqu)); 40 memset(&wrqu, 0, sizeof(wrqu));
@@ -48,6 +46,7 @@ void cfg80211_scan_done(struct cfg80211_scan_request *request, bool aborted)
48 dev_put(dev); 46 dev_put(dev);
49 47
50 out: 48 out:
49 wiphy_to_dev(request->wiphy)->scan_req = NULL;
51 kfree(request); 50 kfree(request);
52} 51}
53EXPORT_SYMBOL(cfg80211_scan_done); 52EXPORT_SYMBOL(cfg80211_scan_done);
@@ -119,7 +118,7 @@ static int cmp_ies(u8 num, u8 *ies1, size_t len1, u8 *ies2, size_t len2)
119 118
120 if (!ie1 && !ie2) 119 if (!ie1 && !ie2)
121 return 0; 120 return 0;
122 if (!ie1) 121 if (!ie1 || !ie2)
123 return -1; 122 return -1;
124 123
125 r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1])); 124 r = memcmp(ie1 + 2, ie2 + 2, min(ie1[1], ie2[1]));
@@ -172,6 +171,8 @@ static bool is_mesh(struct cfg80211_bss *a,
172 ie = find_ie(WLAN_EID_MESH_CONFIG, 171 ie = find_ie(WLAN_EID_MESH_CONFIG,
173 a->information_elements, 172 a->information_elements,
174 a->len_information_elements); 173 a->len_information_elements);
174 if (!ie)
175 return false;
175 if (ie[1] != IEEE80211_MESH_CONFIG_LEN) 176 if (ie[1] != IEEE80211_MESH_CONFIG_LEN)
176 return false; 177 return false;
177 178
@@ -366,7 +367,6 @@ cfg80211_bss_update(struct cfg80211_registered_device *dev,
366 found = rb_find_bss(dev, res); 367 found = rb_find_bss(dev, res);
367 368
368 if (found) { 369 if (found) {
369 kref_get(&found->ref);
370 found->pub.beacon_interval = res->pub.beacon_interval; 370 found->pub.beacon_interval = res->pub.beacon_interval;
371 found->pub.tsf = res->pub.tsf; 371 found->pub.tsf = res->pub.tsf;
372 found->pub.signal = res->pub.signal; 372 found->pub.signal = res->pub.signal;
diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 21cdc872004e..5e6c072c64d3 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -40,6 +40,7 @@
40#include <linux/errno.h> 40#include <linux/errno.h>
41#include <linux/kernel.h> 41#include <linux/kernel.h>
42#include <linux/sched.h> 42#include <linux/sched.h>
43#include <linux/smp_lock.h>
43#include <linux/timer.h> 44#include <linux/timer.h>
44#include <linux/string.h> 45#include <linux/string.h>
45#include <linux/net.h> 46#include <linux/net.h>
diff --git a/net/xfrm/xfrm_hash.h b/net/xfrm/xfrm_hash.h
index d401dc8f05ed..e5195c99f71e 100644
--- a/net/xfrm/xfrm_hash.h
+++ b/net/xfrm/xfrm_hash.h
@@ -16,7 +16,7 @@ static inline unsigned int __xfrm6_addr_hash(xfrm_address_t *addr)
16 16
17static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr) 17static inline unsigned int __xfrm4_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
18{ 18{
19 return ntohl(daddr->a4 ^ saddr->a4); 19 return ntohl(daddr->a4 + saddr->a4);
20} 20}
21 21
22static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr) 22static inline unsigned int __xfrm6_daddr_saddr_hash(xfrm_address_t *daddr, xfrm_address_t *saddr)
generated by cgit v1.2.2 (git 2.25.0) at 2026-01-08 14:12:33 -0500