8 files changed, 35 insertions, 13 deletions

diff --git a/net/can/raw.c b/net/can/raw.c
index ead50c7c0d40..201cbfc6b9ec 100644
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -573,7 +573,8 @@ static int raw_getsockopt(struct socket *sock, int level, int optname,
                         int fsize = ro->count * sizeof(struct can_filter);
                         if (len > fsize)
                                 len = fsize;
-                        err = copy_to_user(optval, ro->filter, len);
+                        if (copy_to_user(optval, ro->filter, len))
+                                err = -EFAULT;
                 } else
                         len = 0;
                 release_sock(sk);
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index a29b43d0b450..0133b5ebd545 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -323,6 +323,11 @@ static int ethtool_get_eeprom(struct net_device *dev, void __user *useraddr)
                 bytes_remaining -= eeprom.len;
         }
 
+        eeprom.len = userbuf - (useraddr + sizeof(eeprom));
+        eeprom.offset -= eeprom.len;
+        if (copy_to_user(useraddr, &eeprom, sizeof(eeprom)))
+                ret = -EFAULT;
+
         kfree(data);
         return ret;
 }
diff --git a/net/dccp/probe.c b/net/dccp/probe.c
index 6e1df62bd7c9..0bcdc9250279 100644
--- a/net/dccp/probe.c
+++ b/net/dccp/probe.c
@@ -140,7 +140,7 @@ static ssize_t dccpprobe_read(struct file *file, char __user *buf,
                 goto out_free;
 
         cnt = kfifo_get(dccpw.fifo, tbuf, len);
-        error = copy_to_user(buf, tbuf, cnt);
+        error = copy_to_user(buf, tbuf, cnt) ? -EFAULT : 0;
 
 out_free:
         vfree(tbuf);
diff --git a/net/ipv4/tcp_probe.c b/net/ipv4/tcp_probe.c
index 1c509592574a..5ff0ce6e9d39 100644
--- a/net/ipv4/tcp_probe.c
+++ b/net/ipv4/tcp_probe.c
@@ -190,19 +190,18 @@ static ssize_t tcpprobe_read(struct file *file, char __user *buf,
 
                 width = tcpprobe_sprint(tbuf, sizeof(tbuf));
 
-                if (width < len)
+                if (cnt + width < len)
                         tcp_probe.tail = (tcp_probe.tail + 1) % bufsize;
 
                 spin_unlock_bh(&tcp_probe.lock);
 
                 /* if record greater than space available
                    return partial buffer (so far) */
-                if (width >= len)
+                if (cnt + width >= len)
                         break;
 
-                error = copy_to_user(buf + cnt, tbuf, width);
-                if (error)
-                        break;
+                if (copy_to_user(buf + cnt, tbuf, width))
+                        return -EFAULT;
                 cnt += width;
         }
 
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 42814a2ec9d7..b2c9becc02e8 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -167,7 +167,7 @@ config IPV6_SIT
           Tunneling means encapsulating data of one protocol type within
           another protocol and sending it over a channel that understands the
           encapsulating protocol. This driver implements encapsulation of IPv6
-          into IPv4 packets. This is useful if you want to connect two IPv6
+          into IPv4 packets. This is useful if you want to connect to IPv6
           networks over an IPv4-only path.
 
           Saying M here will produce a module called sit.ko. If unsure, say Y.
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 6193b124cbc7..396f0ea11090 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -971,6 +971,19 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
 
         switch (optname) {
                 case IPV6_CHECKSUM:
+                        if (inet_sk(sk)->num == IPPROTO_ICMPV6 &&
+                            level == IPPROTO_IPV6) {
+                                /*
+                                 * RFC3542 tells that IPV6_CHECKSUM socket
+                                 * option in the IPPROTO_IPV6 level is not
+                                 * allowed on ICMPv6 sockets.
+                                 * If you want to set it, use IPPROTO_RAW
+                                 * level IPV6_CHECKSUM socket option
+                                 * (Linux extension).
+                                 */
+                                return -EINVAL;
+                        }
+
                         /* You may get strange result with a positive odd offset;
                            RFC2292bis agrees with me. */
                         if (val > 0 && (val&1))
@@ -1046,6 +1059,11 @@ static int do_rawv6_getsockopt(struct sock *sk, int level, int optname,
 
         switch (optname) {
         case IPV6_CHECKSUM:
+                /*
+                 * We allow getsockopt() for IPPROTO_IPV6-level
+                 * IPV6_CHECKSUM socket option on ICMPv6 sockets
+                 * since RFC3542 is silent about it.
+                 */
                 if (rp->checksum == 0)
                         val = -1;
                 else
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 81a8e5297ad1..2403a31fe0f6 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -2356,7 +2356,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
         struct xfrm_selector sel;
         struct km_event c;
         struct sadb_x_sec_ctx *sec_ctx;
-        struct xfrm_sec_ctx *pol_ctx;
+        struct xfrm_sec_ctx *pol_ctx = NULL;
 
         if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC-1],
                                      ext_hdrs[SADB_EXT_ADDRESS_DST-1]) ||
@@ -2396,8 +2396,7 @@ static int pfkey_spddelete(struct sock *sk, struct sk_buff *skb, struct sadb_msg
                 kfree(uctx);
                 if (err)
                         return err;
-        } else
-                pol_ctx = NULL;
+        }
 
         xp = xfrm_policy_bysel_ctx(XFRM_POLICY_TYPE_MAIN,
                                    pol->sadb_x_policy_dir - 1, &sel, pol_ctx,
diff --git a/net/tipc/socket.c b/net/tipc/socket.c
index 05853159536a..230f9ca2ad6b 100644
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@ -1756,8 +1756,8 @@ static int getsockopt(struct socket *sock,
         else if (len < sizeof(value)) {
                 res = -EINVAL;
         }
-        else if ((res = copy_to_user(ov, &value, sizeof(value)))) {
-                /* couldn't return value */
+        else if (copy_to_user(ov, &value, sizeof(value))) {
+                res = -EFAULT;
         }
         else {
                 res = put_user(sizeof(value), ol);