Merge with http://kernel.org/pub/scm/linux/kernel/git/torvalds/linux-2.6.git

11 files changed, 185 insertions, 118 deletions

diff --git a/net/core/datagram.c b/net/core/datagram.c
index 1bcfef51ac..f8d322e1ea 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -47,6 +47,7 @@
 #include <linux/rtnetlink.h>
 #include <linux/poll.h>
 #include <linux/highmem.h>
+#include <linux/spinlock.h>
 
 #include <net/protocol.h>
 #include <linux/skbuff.h>
@@ -200,6 +201,41 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
 }
 
 /**
+ *      skb_kill_datagram - Free a datagram skbuff forcibly
+ *      @sk: socket
+ *      @skb: datagram skbuff
+ *      @flags: MSG_ flags
+ *
+ *      This function frees a datagram skbuff that was received by
+ *      skb_recv_datagram.  The flags argument must match the one
+ *      used for skb_recv_datagram.
+ *
+ *      If the MSG_PEEK flag is set, and the packet is still on the
+ *      receive queue of the socket, it will be taken off the queue
+ *      before it is freed.
+ *
+ *      This function currently only disables BH when acquiring the
+ *      sk_receive_queue lock.  Therefore it must not be used in a
+ *      context where that lock is acquired in an IRQ context.
+ */
+
+void skb_kill_datagram(struct sock *sk, struct sk_buff *skb, unsigned int flags)
+{
+        if (flags & MSG_PEEK) {
+                spin_lock_bh(&sk->sk_receive_queue.lock);
+                if (skb == skb_peek(&sk->sk_receive_queue)) {
+                        __skb_unlink(skb, &sk->sk_receive_queue);
+                        atomic_dec(&skb->users);
+                }
+                spin_unlock_bh(&sk->sk_receive_queue.lock);
+        }
+
+        kfree_skb(skb);
+}
+
+EXPORT_SYMBOL(skb_kill_datagram);
+
+/**
  *      skb_copy_datagram_iovec - Copy a datagram to an iovec.
  *      @skb: buffer to copy
  *      @offset: offset in the buffer to start copying from
diff --git a/net/core/dev.c b/net/core/dev.c
index a5efc9ae01..5081287923 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -626,7 +626,7 @@ struct net_device * dev_get_by_flags(unsigned short if_flags, unsigned short mas
  *      Network device names need to be valid file names to
  *      to allow sysfs to work
  */
-static int dev_valid_name(const char *name)
+int dev_valid_name(const char *name)
 {
         return !(*name == '\0' 
                  || !strcmp(name, ".")
@@ -3270,13 +3270,13 @@ EXPORT_SYMBOL(__dev_get_by_index);
 EXPORT_SYMBOL(__dev_get_by_name);
 EXPORT_SYMBOL(__dev_remove_pack);
 EXPORT_SYMBOL(__skb_linearize);
+EXPORT_SYMBOL(dev_valid_name);
 EXPORT_SYMBOL(dev_add_pack);
 EXPORT_SYMBOL(dev_alloc_name);
 EXPORT_SYMBOL(dev_close);
 EXPORT_SYMBOL(dev_get_by_flags);
 EXPORT_SYMBOL(dev_get_by_index);
 EXPORT_SYMBOL(dev_get_by_name);
-EXPORT_SYMBOL(dev_ioctl);
 EXPORT_SYMBOL(dev_open);
 EXPORT_SYMBOL(dev_queue_xmit);
 EXPORT_SYMBOL(dev_remove_pack);
diff --git a/net/core/filter.c b/net/core/filter.c
index 3a10e0bc90..8964d34455 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -13,6 +13,7 @@
  * 2 of the License, or (at your option) any later version.
  *
  * Andi Kleen - Fix a few bad bugs and races.
+ * Kris Katterjohn - Added many additional checks in sk_chk_filter()
  */
 
 #include <linux/module.h>
@@ -250,7 +251,7 @@ load_b:
                         mem[fentry->k] = X;
                         continue;
                 default:
-                        /* Invalid instruction counts as RET */
+                        WARN_ON(1);
                         return 0;
                 }
 
@@ -283,8 +284,8 @@ load_b:
  *
  * Check the user's filter code. If we let some ugly
  * filter code slip through kaboom! The filter must contain
- * no references or jumps that are out of range, no illegal instructions
- * and no backward jumps. It must end with a RET instruction
+ * no references or jumps that are out of range, no illegal
+ * instructions, and must end with a RET instruction.
  *
  * Returns 0 if the rule set is legal or a negative errno code if not.
  */
@@ -300,38 +301,85 @@ int sk_chk_filter(struct sock_filter *filter, int flen)
         for (pc = 0; pc < flen; pc++) {
                 /* all jumps are forward as they are not signed */
                 ftest = &filter[pc];
-                if (BPF_CLASS(ftest->code) == BPF_JMP) {
-                        /* but they mustn't jump off the end */
-                        if (BPF_OP(ftest->code) == BPF_JA) {
-                                /*
-                                 * Note, the large ftest->k might cause loops.
-                                 * Compare this with conditional jumps below,
-                                 * where offsets are limited. --ANK (981016)
-                                 */
-                                if (ftest->k >= (unsigned)(flen-pc-1))
-                                        return -EINVAL;
-                        } else {
-                                /* for conditionals both must be safe */
-                                if (pc + ftest->jt +1 >= flen ||
-                                    pc + ftest->jf +1 >= flen)
-                                        return -EINVAL;
-                        }
-                }
 
-                /* check for division by zero   -Kris Katterjohn 2005-10-30 */
-                if (ftest->code == (BPF_ALU|BPF_DIV|BPF_K) && ftest->k == 0)
-                        return -EINVAL;
+                /* Only allow valid instructions */
+                switch (ftest->code) {
+                case BPF_ALU|BPF_ADD|BPF_K:
+                case BPF_ALU|BPF_ADD|BPF_X:
+                case BPF_ALU|BPF_SUB|BPF_K:
+                case BPF_ALU|BPF_SUB|BPF_X:
+                case BPF_ALU|BPF_MUL|BPF_K:
+                case BPF_ALU|BPF_MUL|BPF_X:
+                case BPF_ALU|BPF_DIV|BPF_X:
+                case BPF_ALU|BPF_AND|BPF_K:
+                case BPF_ALU|BPF_AND|BPF_X:
+                case BPF_ALU|BPF_OR|BPF_K:
+                case BPF_ALU|BPF_OR|BPF_X:
+                case BPF_ALU|BPF_LSH|BPF_K:
+                case BPF_ALU|BPF_LSH|BPF_X:
+                case BPF_ALU|BPF_RSH|BPF_K:
+                case BPF_ALU|BPF_RSH|BPF_X:
+                case BPF_ALU|BPF_NEG:
+                case BPF_LD|BPF_W|BPF_ABS:
+                case BPF_LD|BPF_H|BPF_ABS:
+                case BPF_LD|BPF_B|BPF_ABS:
+                case BPF_LD|BPF_W|BPF_LEN:
+                case BPF_LD|BPF_W|BPF_IND:
+                case BPF_LD|BPF_H|BPF_IND:
+                case BPF_LD|BPF_B|BPF_IND:
+                case BPF_LD|BPF_IMM:
+                case BPF_LDX|BPF_W|BPF_LEN:
+                case BPF_LDX|BPF_B|BPF_MSH:
+                case BPF_LDX|BPF_IMM:
+                case BPF_MISC|BPF_TAX:
+                case BPF_MISC|BPF_TXA:
+                case BPF_RET|BPF_K:
+                case BPF_RET|BPF_A:
+                        break;
+
+                /* Some instructions need special checks */
 
-                /* check that memory operations use valid addresses. */
-                if (ftest->k >= BPF_MEMWORDS) {
-                        /* but it might not be a memory operation... */
-                        switch (ftest->code) {
-                        case BPF_ST:    
-                        case BPF_STX:   
-                        case BPF_LD|BPF_MEM:    
-                        case BPF_LDX|BPF_MEM:   
+                case BPF_ALU|BPF_DIV|BPF_K:
+                        /* check for division by zero */
+                        if (ftest->k == 0)
                                 return -EINVAL;
-                        }
+                        break;
+
+                case BPF_LD|BPF_MEM:
+                case BPF_LDX|BPF_MEM:
+                case BPF_ST:
+                case BPF_STX:
+                        /* check for invalid memory addresses */
+                        if (ftest->k >= BPF_MEMWORDS)
+                                return -EINVAL;
+                        break;
+
+                case BPF_JMP|BPF_JA:
+                        /*
+                         * Note, the large ftest->k might cause loops.
+                         * Compare this with conditional jumps below,
+                         * where offsets are limited. --ANK (981016)
+                         */
+                        if (ftest->k >= (unsigned)(flen-pc-1))
+                                return -EINVAL;
+                        break;
+
+                case BPF_JMP|BPF_JEQ|BPF_K:
+                case BPF_JMP|BPF_JEQ|BPF_X:
+                case BPF_JMP|BPF_JGE|BPF_K:
+                case BPF_JMP|BPF_JGE|BPF_X:
+                case BPF_JMP|BPF_JGT|BPF_K:
+                case BPF_JMP|BPF_JGT|BPF_X:
+                case BPF_JMP|BPF_JSET|BPF_K:
+                case BPF_JMP|BPF_JSET|BPF_X:
+                        /* for conditionals both must be safe */
+                        if (pc + ftest->jt + 1 >= flen ||
+                            pc + ftest->jf + 1 >= flen)
+                                return -EINVAL;
+                        break;
+
+                default:
+                        return -EINVAL;
                 }
         }
 
diff --git a/net/core/flow.c b/net/core/flow.c
index 7e95b39de9..c4f2538502 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -23,6 +23,7 @@
 #include <net/flow.h>
 #include <asm/atomic.h>
 #include <asm/semaphore.h>
+#include <linux/security.h>
 
 struct flow_cache_entry {
         struct flow_cache_entry *next;
@@ -30,6 +31,7 @@ struct flow_cache_entry {
         u8                      dir;
         struct flowi            key;
         u32                     genid;
+        u32                     sk_sid;
         void                    *object;
         atomic_t                *object_ref;
 };
@@ -162,7 +164,7 @@ static int flow_key_compare(struct flowi *key1, struct flowi *key2)
         return 0;
 }
 
-void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
+void *flow_cache_lookup(struct flowi *key, u32 sk_sid, u16 family, u8 dir,
                         flow_resolve_t resolver)
 {
         struct flow_cache_entry *fle, **head;
@@ -186,6 +188,7 @@ void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
         for (fle = *head; fle; fle = fle->next) {
                 if (fle->family == family &&
                     fle->dir == dir &&
+                    fle->sk_sid == sk_sid &&
                     flow_key_compare(key, &fle->key) == 0) {
                         if (fle->genid == atomic_read(&flow_cache_genid)) {
                                 void *ret = fle->object;
@@ -210,6 +213,7 @@ void *flow_cache_lookup(struct flowi *key, u16 family, u8 dir,
                         *head = fle;
                         fle->family = family;
                         fle->dir = dir;
+                        fle->sk_sid = sk_sid;
                         memcpy(&fle->key, key, sizeof(*key));
                         fle->object = NULL;
                         flow_count(cpu)++;
@@ -221,7 +225,7 @@ nocache:
                 void *obj;
                 atomic_t *obj_ref;
 
-                resolver(key, family, dir, &obj, &obj_ref);
+                resolver(key, sk_sid, family, dir, &obj, &obj_ref);
 
                 if (fle) {
                         fle->genid = atomic_read(&flow_cache_genid);
diff --git a/net/core/net-sysfs.c b/net/core/net-sysfs.c
index e2137f3e48..e1da81d261 100644
--- a/net/core/net-sysfs.c
+++ b/net/core/net-sysfs.c
@@ -84,16 +84,11 @@ static ssize_t netdev_store(struct class_device *dev,
         return ret;
 }
 
-/* generate a read-only network device class attribute */
-#define NETDEVICE_ATTR(field, format_string)                            \
-NETDEVICE_SHOW(field, format_string)                                    \
-static CLASS_DEVICE_ATTR(field, S_IRUGO, show_##field, NULL)            \
-
-NETDEVICE_ATTR(addr_len, fmt_dec);
-NETDEVICE_ATTR(iflink, fmt_dec);
-NETDEVICE_ATTR(ifindex, fmt_dec);
-NETDEVICE_ATTR(features, fmt_long_hex);
-NETDEVICE_ATTR(type, fmt_dec);
+NETDEVICE_SHOW(addr_len, fmt_dec);
+NETDEVICE_SHOW(iflink, fmt_dec);
+NETDEVICE_SHOW(ifindex, fmt_dec);
+NETDEVICE_SHOW(features, fmt_long_hex);
+NETDEVICE_SHOW(type, fmt_dec);
 
 /* use same locking rules as GIFHWADDR ioctl's */
 static ssize_t format_addr(char *buf, const unsigned char *addr, int len)
@@ -136,10 +131,6 @@ static ssize_t show_carrier(struct class_device *dev, char *buf)
         return -EINVAL;
 }
 
-static CLASS_DEVICE_ATTR(address, S_IRUGO, show_address, NULL);
-static CLASS_DEVICE_ATTR(broadcast, S_IRUGO, show_broadcast, NULL);
-static CLASS_DEVICE_ATTR(carrier, S_IRUGO, show_carrier, NULL);
-
 /* read-write attributes */
 NETDEVICE_SHOW(mtu, fmt_dec);
 
@@ -153,8 +144,6 @@ static ssize_t store_mtu(struct class_device *dev, const char *buf, size_t len)
         return netdev_store(dev, buf, len, change_mtu);
 }
 
-static CLASS_DEVICE_ATTR(mtu, S_IRUGO | S_IWUSR, show_mtu, store_mtu);
-
 NETDEVICE_SHOW(flags, fmt_hex);
 
 static int change_flags(struct net_device *net, unsigned long new_flags)
@@ -167,8 +156,6 @@ static ssize_t store_flags(struct class_device *dev, const char *buf, size_t len
         return netdev_store(dev, buf, len, change_flags);
 }
 
-static CLASS_DEVICE_ATTR(flags, S_IRUGO | S_IWUSR, show_flags, store_flags);
-
 NETDEVICE_SHOW(tx_queue_len, fmt_ulong);
 
 static int change_tx_queue_len(struct net_device *net, unsigned long new_len)
@@ -182,9 +169,6 @@ static ssize_t store_tx_queue_len(struct class_device *dev, const char *buf, siz
         return netdev_store(dev, buf, len, change_tx_queue_len);
 }
 
-static CLASS_DEVICE_ATTR(tx_queue_len, S_IRUGO | S_IWUSR, show_tx_queue_len, 
-                         store_tx_queue_len);
-
 NETDEVICE_SHOW(weight, fmt_dec);
 
 static int change_weight(struct net_device *net, unsigned long new_weight)
@@ -198,24 +182,21 @@ static ssize_t store_weight(struct class_device *dev, const char *buf, size_t le
         return netdev_store(dev, buf, len, change_weight);
 }
 
-static CLASS_DEVICE_ATTR(weight, S_IRUGO | S_IWUSR, show_weight, 
-                         store_weight);
-
-
-static struct class_device_attribute *net_class_attributes[] = {
-        &class_device_attr_ifindex,
-        &class_device_attr_iflink,
-        &class_device_attr_addr_len,
-        &class_device_attr_tx_queue_len,
-        &class_device_attr_features,
-        &class_device_attr_mtu,
-        &class_device_attr_flags,
-        &class_device_attr_weight,
-        &class_device_attr_type,
-        &class_device_attr_address,
-        &class_device_attr_broadcast,
-        &class_device_attr_carrier,
-        NULL
+static struct class_device_attribute net_class_attributes[] = {
+        __ATTR(addr_len, S_IRUGO, show_addr_len, NULL),
+        __ATTR(iflink, S_IRUGO, show_iflink, NULL),
+        __ATTR(ifindex, S_IRUGO, show_ifindex, NULL),
+        __ATTR(features, S_IRUGO, show_features, NULL),
+        __ATTR(type, S_IRUGO, show_type, NULL),
+        __ATTR(address, S_IRUGO, show_address, NULL),
+        __ATTR(broadcast, S_IRUGO, show_broadcast, NULL),
+        __ATTR(carrier, S_IRUGO, show_carrier, NULL),
+        __ATTR(mtu, S_IRUGO | S_IWUSR, show_mtu, store_mtu),
+        __ATTR(flags, S_IRUGO | S_IWUSR, show_flags, store_flags),
+        __ATTR(tx_queue_len, S_IRUGO | S_IWUSR, show_tx_queue_len,
+               store_tx_queue_len),
+        __ATTR(weight, S_IRUGO | S_IWUSR, show_weight, store_weight),
+        {}
 };
 
 /* Show a given an attribute in the statistics group */
@@ -369,14 +350,14 @@ static struct attribute_group wireless_group = {
 #endif
 
 #ifdef CONFIG_HOTPLUG
-static int netdev_hotplug(struct class_device *cd, char **envp,
-                          int num_envp, char *buf, int size)
+static int netdev_uevent(struct class_device *cd, char **envp,
+                         int num_envp, char *buf, int size)
 {
         struct net_device *dev = to_net_dev(cd);
         int i = 0;
         int n;
 
-        /* pass interface in env to hotplug. */
+        /* pass interface to uevent. */
         envp[i++] = buf;
         n = snprintf(buf, size, "INTERFACE=%s", dev->name) + 1;
         buf += n;
@@ -407,8 +388,9 @@ static void netdev_release(struct class_device *cd)
 static struct class net_class = {
         .name = "net",
         .release = netdev_release,
+        .class_dev_attrs = net_class_attributes,
 #ifdef CONFIG_HOTPLUG
-        .hotplug = netdev_hotplug,
+        .uevent = netdev_uevent,
 #endif
 };
 
@@ -431,8 +413,6 @@ void netdev_unregister_sysfs(struct net_device * net)
 int netdev_register_sysfs(struct net_device *net)
 {
         struct class_device *class_dev = &(net->class_dev);
-        int i;
-        struct class_device_attribute *attr;
         int ret;
 
         class_dev->class = &net_class;
@@ -442,12 +422,6 @@ int netdev_register_sysfs(struct net_device *net)
         if ((ret = class_device_register(class_dev)))
                 goto out;
 
-        for (i = 0; (attr = net_class_attributes[i]) != NULL; i++) {
-                if ((ret = class_device_create_file(class_dev, attr)))
-                    goto out_unreg;
-        }
-
-
         if (net->get_stats &&
             (ret = sysfs_create_group(&class_dev->kobj, &netstat_group)))
                 goto out_unreg; 
diff --git a/net/core/netpoll.c b/net/core/netpoll.c
index 49424a42a2..281a632fa6 100644
--- a/net/core/netpoll.c
+++ b/net/core/netpoll.c
@@ -13,6 +13,7 @@
 #include <linux/netdevice.h>
 #include <linux/etherdevice.h>
 #include <linux/string.h>
+#include <linux/if_arp.h>
 #include <linux/inetdevice.h>
 #include <linux/inet.h>
 #include <linux/interrupt.h>
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 7fc3e9e28c..06cad2d63e 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -487,9 +487,9 @@ static unsigned int fmt_ip6(char *s,const char ip[16]);
 
 /* Module parameters, defaults. */
 static int pg_count_d = 1000; /* 1000 pkts by default */
-static int pg_delay_d = 0;
-static int pg_clone_skb_d = 0;
-static int debug = 0;
+static int pg_delay_d;
+static int pg_clone_skb_d;
+static int debug;
 
 static DECLARE_MUTEX(pktgen_sem);
 static struct pktgen_thread *pktgen_threads = NULL;
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 83fee37de3..070f91cfde 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -135,17 +135,13 @@ void skb_under_panic(struct sk_buff *skb, int sz, void *here)
 struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
                             int fclone)
 {
+        struct skb_shared_info *shinfo;
         struct sk_buff *skb;
         u8 *data;
 
         /* Get the HEAD */
-        if (fclone)
-                skb = kmem_cache_alloc(skbuff_fclone_cache,
-                                       gfp_mask & ~__GFP_DMA);
-        else
-                skb = kmem_cache_alloc(skbuff_head_cache,
-                                       gfp_mask & ~__GFP_DMA);
-
+        skb = kmem_cache_alloc(fclone ? skbuff_fclone_cache : skbuff_head_cache,
+                                gfp_mask & ~__GFP_DMA);
         if (!skb)
                 goto out;
 
@@ -162,6 +158,16 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
         skb->data = data;
         skb->tail = data;
         skb->end  = data + size;
+        /* make sure we initialize shinfo sequentially */
+        shinfo = skb_shinfo(skb);
+        atomic_set(&shinfo->dataref, 1);
+        shinfo->nr_frags  = 0;
+        shinfo->tso_size = 0;
+        shinfo->tso_segs = 0;
+        shinfo->ufo_size = 0;
+        shinfo->ip6_frag_id = 0;
+        shinfo->frag_list = NULL;
+
         if (fclone) {
                 struct sk_buff *child = skb + 1;
                 atomic_t *fclone_ref = (atomic_t *) (child + 1);
@@ -171,13 +177,6 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t gfp_mask,
 
                 child->fclone = SKB_FCLONE_UNAVAILABLE;
         }
-        atomic_set(&(skb_shinfo(skb)->dataref), 1);
-        skb_shinfo(skb)->nr_frags  = 0;
-        skb_shinfo(skb)->tso_size = 0;
-        skb_shinfo(skb)->tso_segs = 0;
-        skb_shinfo(skb)->frag_list = NULL;
-        skb_shinfo(skb)->ufo_size = 0;
-        skb_shinfo(skb)->ip6_frag_id = 0;
 out:
         return skb;
 nodata:
diff --git a/net/core/sock.c b/net/core/sock.c
index 13cc3be4f0..6465b0e4c8 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -1488,7 +1488,7 @@ int proto_register(struct proto *prot, int alloc_slab)
                         }
                 }
 
-                if (prot->twsk_obj_size) {
+                if (prot->twsk_prot != NULL) {
                         static const char mask[] = "tw_sock_%s";
 
                         timewait_sock_slab_name = kmalloc(strlen(prot->name) + sizeof(mask) - 1, GFP_KERNEL);
@@ -1497,11 +1497,12 @@ int proto_register(struct proto *prot, int alloc_slab)
                                 goto out_free_request_sock_slab;
 
                         sprintf(timewait_sock_slab_name, mask, prot->name);
-                        prot->twsk_slab = kmem_cache_create(timewait_sock_slab_name,
-                                                            prot->twsk_obj_size,
-                                                            0, SLAB_HWCACHE_ALIGN,
-                                                            NULL, NULL);
-                        if (prot->twsk_slab == NULL)
+                        prot->twsk_prot->twsk_slab =
+                                kmem_cache_create(timewait_sock_slab_name,
+                                                  prot->twsk_prot->twsk_obj_size,
+                                                  0, SLAB_HWCACHE_ALIGN,
+                                                  NULL, NULL);
+                        if (prot->twsk_prot->twsk_slab == NULL)
                                 goto out_free_timewait_sock_slab_name;
                 }
         }
@@ -1548,12 +1549,12 @@ void proto_unregister(struct proto *prot)
                 prot->rsk_prot->slab = NULL;
         }
 
-        if (prot->twsk_slab != NULL) {
-                const char *name = kmem_cache_name(prot->twsk_slab);
+        if (prot->twsk_prot != NULL && prot->twsk_prot->twsk_slab != NULL) {
+                const char *name = kmem_cache_name(prot->twsk_prot->twsk_slab);
 
-                kmem_cache_destroy(prot->twsk_slab);
+                kmem_cache_destroy(prot->twsk_prot->twsk_slab);
                 kfree(name);
-                prot->twsk_slab = NULL;
+                prot->twsk_prot->twsk_slab = NULL;
         }
 }
 
diff --git a/net/core/stream.c b/net/core/stream.c
index 15bfd03e80..35e25259fd 100644
--- a/net/core/stream.c
+++ b/net/core/stream.c
@@ -55,8 +55,9 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p)
         int done;
 
         do {
-                if (sk->sk_err)
-                        return sock_error(sk);
+                int err = sock_error(sk);
+                if (err)
+                        return err;
                 if ((1 << sk->sk_state) & ~(TCPF_SYN_SENT | TCPF_SYN_RECV))
                         return -EPIPE;
                 if (!*timeo_p)
@@ -67,6 +68,7 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p)
                 prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
                 sk->sk_write_pending++;
                 done = sk_wait_event(sk, timeo_p,
+                                     !sk->sk_err &&
                                      !((1 << sk->sk_state) & 
                                        ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)));
                 finish_wait(sk->sk_sleep, &wait);
@@ -137,7 +139,9 @@ int sk_stream_wait_memory(struct sock *sk, long *timeo_p)
 
                 set_bit(SOCK_NOSPACE, &sk->sk_socket->flags);
                 sk->sk_write_pending++;
-                sk_wait_event(sk, &current_timeo, sk_stream_memory_free(sk) &&
+                sk_wait_event(sk, &current_timeo, !sk->sk_err && 
+                                                  !(sk->sk_shutdown & SEND_SHUTDOWN) &&
+                                                  sk_stream_memory_free(sk) &&
                                                   vm_wait);
                 sk->sk_write_pending--;
 
diff --git a/net/core/utils.c b/net/core/utils.c
index 7b5970fc9e..587eb7787d 100644
--- a/net/core/utils.c
+++ b/net/core/utils.c
@@ -175,7 +175,7 @@ __u32 in_aton(const char *str)
                 if (*str != '\0')
                 {
                         val = 0;
-                        while (*str != '\0' && *str != '.')
+                        while (*str != '\0' && *str != '.' && *str != '\n')
                         {
                                 val *= 10;
                                 val += *str - '0';