22 files changed, 73 insertions, 67 deletions

diff --git a/net/atm/signaling.c b/net/atm/signaling.c
index 93ad59a28ef5..31d98b57e1de 100644
--- a/net/atm/signaling.c
+++ b/net/atm/signaling.c
@@ -39,25 +39,19 @@ static DECLARE_WAIT_QUEUE_HEAD(sigd_sleep);
 static void sigd_put_skb(struct sk_buff *skb)
 {
 #ifdef WAIT_FOR_DEMON
-        static unsigned long silence;
         DECLARE_WAITQUEUE(wait,current);
 
         add_wait_queue(&sigd_sleep,&wait);
         while (!sigd) {
                 set_current_state(TASK_UNINTERRUPTIBLE);
-                if (time_after(jiffies, silence) || silence == 0) {
-                        printk(KERN_INFO "atmsvc: waiting for signaling demon "
-                            "...\n");
-                        silence = (jiffies+30*HZ)|1;
-                }
+                DPRINTK("atmsvc: waiting for signaling demon...\n");
                 schedule();
         }
         current->state = TASK_RUNNING;
         remove_wait_queue(&sigd_sleep,&wait);
 #else
         if (!sigd) {
-                if (net_ratelimit())
-                        printk(KERN_WARNING "atmsvc: no signaling demon\n");
+                DPRINTK("atmsvc: no signaling demon\n");
                 kfree_skb(skb);
                 return;
         }
diff --git a/net/bridge/br_if.c b/net/bridge/br_if.c
index 7fa3a5a9971f..f36b35edd60c 100644
--- a/net/bridge/br_if.c
+++ b/net/bridge/br_if.c
@@ -81,26 +81,27 @@ static void port_carrier_check(void *arg)
 {
         struct net_device *dev = arg;
         struct net_bridge_port *p;
+        struct net_bridge *br;
 
         rtnl_lock();
         p = dev->br_port;
         if (!p)
                 goto done;
-
-        if (netif_carrier_ok(p->dev)) {
-                u32 cost = port_cost(p->dev);
-
-                spin_lock_bh(&p->br->lock);
-                if (p->state == BR_STATE_DISABLED) {
-                        p->path_cost = cost;
-                        br_stp_enable_port(p);
+        br = p->br;
+
+        if (netif_carrier_ok(dev))
+                p->path_cost = port_cost(dev);
+
+        if (br->dev->flags & IFF_UP) {
+                spin_lock_bh(&br->lock);
+                if (netif_carrier_ok(dev)) {
+                        if (p->state == BR_STATE_DISABLED)
+                                br_stp_enable_port(p);
+                } else {
+                        if (p->state != BR_STATE_DISABLED)
+                                br_stp_disable_port(p);
                 }
-                spin_unlock_bh(&p->br->lock);
-        } else {
-                spin_lock_bh(&p->br->lock);
-                if (p->state != BR_STATE_DISABLED)
-                        br_stp_disable_port(p);
-                spin_unlock_bh(&p->br->lock);
+                spin_unlock_bh(&br->lock);
         }
 done:
         rtnl_unlock();
@@ -168,6 +169,7 @@ static void del_nbp(struct net_bridge_port *p)
 
         rcu_assign_pointer(dev->br_port, NULL);
 
+        kobject_uevent(&p->kobj, KOBJ_REMOVE);
         kobject_del(&p->kobj);
 
         call_rcu(&p->rcu, destroy_nbp_rcu);
@@ -276,8 +278,9 @@ static struct net_bridge_port *new_nbp(struct net_bridge *br,
         br_init_port(p);
         p->state = BR_STATE_DISABLED;
         INIT_WORK(&p->carrier_check, port_carrier_check, dev);
-        kobject_init(&p->kobj);
+        br_stp_port_timer_init(p);
 
+        kobject_init(&p->kobj);
         kobject_set_name(&p->kobj, SYSFS_BRIDGE_PORT_ATTR);
         p->kobj.ktype = &brport_ktype;
         p->kobj.parent = &(dev->class_dev.kobj);
diff --git a/net/bridge/br_stp_if.c b/net/bridge/br_stp_if.c
index 35cf3a074087..23dea1422c9a 100644
--- a/net/bridge/br_stp_if.c
+++ b/net/bridge/br_stp_if.c
@@ -39,8 +39,6 @@ void br_init_port(struct net_bridge_port *p)
         p->state = BR_STATE_BLOCKING;
         p->topology_change_ack = 0;
         p->config_pending = 0;
-
-        br_stp_port_timer_init(p);
 }
 
 /* called under bridge lock */
diff --git a/net/bridge/netfilter/Makefile b/net/bridge/netfilter/Makefile
index 8bf6d9f6e9d3..905087e0d485 100644
--- a/net/bridge/netfilter/Makefile
+++ b/net/bridge/netfilter/Makefile
@@ -29,4 +29,4 @@ obj-$(CONFIG_BRIDGE_EBT_SNAT) += ebt_snat.o
 
 # watchers
 obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_log.o
-obj-$(CONFIG_BRIDGE_EBT_LOG) += ebt_ulog.o
+obj-$(CONFIG_BRIDGE_EBT_ULOG) += ebt_ulog.o
diff --git a/net/dccp/ccids/ccid3.c b/net/dccp/ccids/ccid3.c
index aa68e0ab274d..35d1d347541c 100644
--- a/net/dccp/ccids/ccid3.c
+++ b/net/dccp/ccids/ccid3.c
@@ -2,7 +2,7 @@
  *  net/dccp/ccids/ccid3.c
  *
  *  Copyright (c) 2005 The University of Waikato, Hamilton, New Zealand.
- *  Copyright (c) 2005 Ian McDonald <iam4@cs.waikato.ac.nz>
+ *  Copyright (c) 2005-6 Ian McDonald <imcdnzl@gmail.com>
  *
  *  An implementation of the DCCP protocol
  *
@@ -1033,9 +1033,13 @@ static void ccid3_hc_rx_packet_recv(struct sock *sk, struct sk_buff *skb)
         p_prev = hcrx->ccid3hcrx_p;
         
         /* Calculate loss event rate */
-        if (!list_empty(&hcrx->ccid3hcrx_li_hist))
+        if (!list_empty(&hcrx->ccid3hcrx_li_hist)) {
+                u32 i_mean = dccp_li_hist_calc_i_mean(&hcrx->ccid3hcrx_li_hist);
+
                 /* Scaling up by 1000000 as fixed decimal */
-                hcrx->ccid3hcrx_p = 1000000 / dccp_li_hist_calc_i_mean(&hcrx->ccid3hcrx_li_hist);
+                if (i_mean != 0)
+                        hcrx->ccid3hcrx_p = 1000000 / i_mean;
+        }
 
         if (hcrx->ccid3hcrx_p > p_prev) {
                 ccid3_hc_rx_send_feedback(sk);
diff --git a/net/ieee80211/ieee80211_rx.c b/net/ieee80211/ieee80211_rx.c
index 960aa78cdb97..b410ab8bcf7a 100644
--- a/net/ieee80211/ieee80211_rx.c
+++ b/net/ieee80211/ieee80211_rx.c
@@ -1301,7 +1301,7 @@ static void update_network(struct ieee80211_network *dst,
         /* dst->last_associate is not overwritten */
 }
 
-static inline int is_beacon(int fc)
+static inline int is_beacon(__le16 fc)
 {
         return (WLAN_FC_GET_STYPE(le16_to_cpu(fc)) == IEEE80211_STYPE_BEACON);
 }
@@ -1348,9 +1348,7 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                                      escape_essid(info_element->data,
                                                   info_element->len),
                                      MAC_ARG(beacon->header.addr3),
-                                     is_beacon(le16_to_cpu
-                                               (beacon->header.
-                                                frame_ctl)) ?
+                                     is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
                 return;
         }
@@ -1400,9 +1398,7 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                                      escape_essid(network.ssid,
                                                   network.ssid_len),
                                      MAC_ARG(network.bssid),
-                                     is_beacon(le16_to_cpu
-                                               (beacon->header.
-                                                frame_ctl)) ?
+                                     is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
 #endif
                 memcpy(target, &network, sizeof(*target));
@@ -1412,16 +1408,14 @@ static void ieee80211_process_probe_response(struct ieee80211_device
                                      escape_essid(target->ssid,
                                                   target->ssid_len),
                                      MAC_ARG(target->bssid),
-                                     is_beacon(le16_to_cpu
-                                               (beacon->header.
-                                                frame_ctl)) ?
+                                     is_beacon(beacon->header.frame_ctl) ?
                                      "BEACON" : "PROBE RESPONSE");
                 update_network(target, &network);
         }
 
         spin_unlock_irqrestore(&ieee->lock, flags);
 
-        if (is_beacon(le16_to_cpu(beacon->header.frame_ctl))) {
+        if (is_beacon(beacon->header.frame_ctl)) {
                 if (ieee->handle_beacon != NULL)
                         ieee->handle_beacon(dev, beacon, &network);
         } else {
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 57d290d89ec2..8ee4d016740d 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -847,10 +847,11 @@ int ip_append_data(struct sock *sk,
         if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
                         (rt->u.dst.dev->features & NETIF_F_UFO)) {
 
-                if(ip_ufo_append_data(sk, getfrag, from, length, hh_len,
-                               fragheaderlen, transhdrlen, mtu, flags))
+                err = ip_ufo_append_data(sk, getfrag, from, length, hh_len,
+                                         fragheaderlen, transhdrlen, mtu,
+                                         flags);
+                if (err)
                         goto error;
-
                 return 0;
         }
 
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index dd1048be8a01..7d7ab94a7a2e 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -771,7 +771,7 @@ static int get_entries(const struct arpt_get_entries *entries,
         struct arpt_table *t;
 
         t = xt_find_table_lock(NF_ARP, entries->name);
-        if (t || !IS_ERR(t)) {
+        if (t && !IS_ERR(t)) {
                 struct xt_table_info *private = t->private;
                 duprintf("t->private->number = %u\n",
                          private->number);
diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index 36339eb39e17..08f80e2ea2aa 100644
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -524,7 +524,7 @@ ipq_rcv_skb(struct sk_buff *skb)
         write_unlock_bh(&queue_lock);
         
         status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                  skblen - NLMSG_LENGTH(0));
+                                  nlmsglen - NLMSG_LENGTH(0));
         if (status < 0)
                 RCV_SKB_FAIL(status);
                 
diff --git a/net/ipv4/tcp_highspeed.c b/net/ipv4/tcp_highspeed.c
index 63cf7e540847..e0e9d1383c7c 100644
--- a/net/ipv4/tcp_highspeed.c
+++ b/net/ipv4/tcp_highspeed.c
@@ -125,7 +125,7 @@ static void hstcp_cong_avoid(struct sock *sk, u32 adk, u32 rtt,
                 /* Update AIMD parameters */
                 if (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
-                               ca->ai < HSTCP_AIMD_MAX)
+                               ca->ai < HSTCP_AIMD_MAX - 1)
                                 ca->ai++;
                 } else if (tp->snd_cwnd < hstcp_aimd_vals[ca->ai].cwnd) {
                         while (tp->snd_cwnd > hstcp_aimd_vals[ca->ai].cwnd &&
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index a7623ead39a8..9f498a6c8895 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1036,6 +1036,10 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
 
         limit = min(send_win, cong_win);
 
+        /* If a full-sized TSO skb can be sent, do it. */
+        if (limit >= 65536)
+                return 0;
+
         if (sysctl_tcp_tso_win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index b7d8822c1be4..19727d941962 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -822,7 +822,7 @@ struct ipv6_saddr_score {
         int             addr_type;
         unsigned int    attrs;
         int             matchlen;
-        unsigned int    scope;
+        int             scope;
         unsigned int    rule;
 };
 
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c7932cb420a5..84963749ab77 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -279,7 +279,7 @@ static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
                 goto out;
         memcpy(tmp_hdr, skb->nh.raw, hdr_len);
         if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))
-                goto out;
+                goto free_out;
         skb->nh.ipv6h->priority    = 0;
         skb->nh.ipv6h->flow_lbl[0] = 0;
         skb->nh.ipv6h->flow_lbl[1] = 0;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 4154f3a8b6cf..bb8ffb8a14c5 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -87,7 +87,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
                                      struct inet_timewait_sock **twp)
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const struct inet_sock *inet = inet_sk(sk);
+        struct inet_sock *inet = inet_sk(sk);
         const struct ipv6_pinfo *np = inet6_sk(sk);
         const struct in6_addr *daddr = &np->rcv_saddr;
         const struct in6_addr *saddr = &np->daddr;
@@ -129,6 +129,10 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         }
 
 unique:
+        /* Must record num and sport now. Otherwise we will see
+         * in hash table socket with a funny identity. */
+        inet->num = lport;
+        inet->sport = htons(lport);
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sk->sk_hash = hash;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index f999edd846a9..5bf70b1442ea 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -944,10 +944,11 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
             (rt->u.dst.dev->features & NETIF_F_UFO)) {
 
-                if(ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
-                                fragheaderlen, transhdrlen, mtu, flags))
+                err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
+                                          fragheaderlen, transhdrlen, mtu,
+                                          flags);
+                if (err)
                         goto error;
-
                 return 0;
         }
 
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 5027bbe6415e..af0635084df8 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -522,7 +522,7 @@ ipq_rcv_skb(struct sk_buff *skb)
         write_unlock_bh(&queue_lock);
         
         status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                  skblen - NLMSG_LENGTH(0));
+                                  nlmsglen - NLMSG_LENGTH(0));
         if (status < 0)
                 RCV_SKB_FAIL(status);
                 
diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index cac38b2e147a..2cf5fb8322c4 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c
@@ -928,8 +928,12 @@ nfqnl_recv_config(struct sock *ctnl, struct sk_buff *skb,
 
         if (nfqa[NFQA_CFG_PARAMS-1]) {
                 struct nfqnl_msg_config_params *params;
-                params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
 
+                if (!queue) {
+                        ret = -ENOENT;
+                        goto out_put;
+                }
+                params = NFA_DATA(nfqa[NFQA_CFG_PARAMS-1]);
                 nfqnl_set_mode(queue, params->copy_mode,
                                 ntohl(params->copy_range));
         }
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 6b9772d95872..59dc7d140600 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1194,6 +1194,9 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
                 msg->msg_namelen = sizeof(*addr);
         }
 
+        if (nlk->flags & NETLINK_RECV_PKTINFO)
+                netlink_cmsg_recv_pktinfo(msg, skb);
+
         if (NULL == siocb->scm) {
                 memset(&scm, 0, sizeof(scm));
                 siocb->scm = &scm;
@@ -1205,8 +1208,6 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock,
                 netlink_dump(sk);
 
         scm_recv(sock, msg, siocb->scm, flags);
-        if (nlk->flags & NETLINK_RECV_PKTINFO)
-                netlink_cmsg_recv_pktinfo(msg, skb);
 
 out:
         netlink_rcv_wake(sk);
diff --git a/net/sched/act_api.c b/net/sched/act_api.c
index 792ce59940ec..2ffa11c6e8de 100644
--- a/net/sched/act_api.c
+++ b/net/sched/act_api.c
@@ -707,7 +707,7 @@ static int tcf_add_notify(struct tc_action *a, u32 pid, u32 seq, int event,
 
 rtattr_failure:
 nlmsg_failure:
-        skb_trim(skb, b - skb->data);
+        kfree_skb(skb);
         return -1;
 }
 
diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c
index d2f0550c4ba0..d78479782045 100644
--- a/net/sunrpc/clnt.c
+++ b/net/sunrpc/clnt.c
@@ -113,7 +113,7 @@ rpc_new_client(struct rpc_xprt *xprt, char *servname,
 
         err = -EINVAL;
         if (!xprt)
-                goto out_err;
+                goto out_no_xprt;
         if (vers >= program->nrvers || !(version = program->version[vers]))
                 goto out_err;
 
@@ -182,6 +182,7 @@ out_no_path:
         kfree(clnt);
 out_err:
         xprt_destroy(xprt);
+out_no_xprt:
         return ERR_PTR(err);
 }
 
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 802d4fe0f55c..e838d042f7f5 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -515,16 +515,14 @@ struct rpc_task * rpc_wake_up_next(struct rpc_wait_queue *queue)
  */
 void rpc_wake_up(struct rpc_wait_queue *queue)
 {
-        struct rpc_task *task;
-
+        struct rpc_task *task, *next;
         struct list_head *head;
+
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                while (!list_empty(head)) {
-                        task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
+                list_for_each_entry_safe(task, next, head, u.tk_wait.list)
                         __rpc_wake_up_task(task);
-                }
                 if (head == &queue->tasks[0])
                         break;
                 head--;
@@ -541,14 +539,13 @@ void rpc_wake_up(struct rpc_wait_queue *queue)
  */
 void rpc_wake_up_status(struct rpc_wait_queue *queue, int status)
 {
+        struct rpc_task *task, *next;
         struct list_head *head;
-        struct rpc_task *task;
 
         spin_lock_bh(&queue->lock);
         head = &queue->tasks[queue->maxpriority];
         for (;;) {
-                while (!list_empty(head)) {
-                        task = list_entry(head->next, struct rpc_task, u.tk_wait.list);
+                list_for_each_entry_safe(task, next, head, u.tk_wait.list) {
                         task->tk_status = status;
                         __rpc_wake_up_task(task);
                 }
diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index 1b5989b1b670..c323cc6a28b0 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
@@ -547,7 +547,7 @@ static struct sock * unix_create1(struct socket *sock)
         struct sock *sk = NULL;
         struct unix_sock *u;
 
-        if (atomic_read(&unix_nr_socks) >= 2*files_stat.max_files)
+        if (atomic_read(&unix_nr_socks) >= 2*get_max_files())
                 goto out;
 
         sk = sk_alloc(PF_UNIX, GFP_KERNEL, &unix_proto, 1);