Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6
* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
[NET]: Mark Paul Moore as maintainer of labelled networking.
[VLAN/BRIDGE]: Fix "skb_pull_rcsum - Fatal exception in interrupt"
[ISDN]: Get rid of some pointless allocation casts in common and bsd comp.
[NET]: Avoid pointless allocation casts in BSD compression module
[IRDA]: Do not do pointless kmalloc return value cast in KingSun driver
[NET]: Fix crash in dev_mc_sync()/dev_mc_unsync()
[PPPOL2TP]: Fix endianness annotations.
[IOAT]: ioatdma needs to to play nice in a multi-dma-client world
[SLIP]: trivial sparse warning fix
[EQL]: sparse warning fix
[NET]: is_power_of_2 in net/core/neighbour.c
[TCP]: Describe tcp_init_cwnd() thoroughly in a comment.
[NET]: Fix IP_ADD/DROP_MEMBERSHIP to handle only connectionless
[KBUILD]: Sanitize tc_ematch headers.
[IPSEC] AH4: Update IPv4 options handling to conform to RFC 4302.
diff --git a/MAINTAINERS b/MAINTAINERS
index 10a6f57..48ca8b4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2661,6 +2661,12 @@
T: git kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6.git
S: Maintained
+NETWORKING [LABELED] (NetLabel, CIPSO, Labeled IPsec, SECMARK)
+P: Paul Moore
+M: paul.moore@hp.com
+L: netdev@vger.kernel.org
+S: Maintained
+
NETWORKING [WIRELESS]
P: John W. Linville
M: linville@tuxdriver.com
diff --git a/drivers/dma/ioatdma.c b/drivers/dma/ioatdma.c
index 2d1f178..41b18c5 100644
--- a/drivers/dma/ioatdma.c
+++ b/drivers/dma/ioatdma.c
@@ -191,17 +191,12 @@
int i;
LIST_HEAD(tmp_list);
- /*
- * In-use bit automatically set by reading chanctrl
- * If 0, we got it, if 1, someone else did
- */
- chanctrl = readw(ioat_chan->reg_base + IOAT_CHANCTRL_OFFSET);
- if (chanctrl & IOAT_CHANCTRL_CHANNEL_IN_USE)
- return -EBUSY;
+ /* have we already been set up? */
+ if (!list_empty(&ioat_chan->free_desc))
+ return INITIAL_IOAT_DESC_COUNT;
/* Setup register to interrupt and write completion status on error */
- chanctrl = IOAT_CHANCTRL_CHANNEL_IN_USE |
- IOAT_CHANCTRL_ERR_INT_EN |
+ chanctrl = IOAT_CHANCTRL_ERR_INT_EN |
IOAT_CHANCTRL_ANY_ERR_ABORT_EN |
IOAT_CHANCTRL_ERR_COMPLETION_EN;
writew(chanctrl, ioat_chan->reg_base + IOAT_CHANCTRL_OFFSET);
@@ -282,11 +277,6 @@
in_use_descs - 1);
ioat_chan->last_completion = ioat_chan->completion_addr = 0;
-
- /* Tell hw the chan is free */
- chanctrl = readw(ioat_chan->reg_base + IOAT_CHANCTRL_OFFSET);
- chanctrl &= ~IOAT_CHANCTRL_CHANNEL_IN_USE;
- writew(chanctrl, ioat_chan->reg_base + IOAT_CHANCTRL_OFFSET);
}
static struct dma_async_tx_descriptor *
diff --git a/drivers/isdn/i4l/isdn_bsdcomp.c b/drivers/isdn/i4l/isdn_bsdcomp.c
index 90a2379..02d9918 100644
--- a/drivers/isdn/i4l/isdn_bsdcomp.c
+++ b/drivers/isdn/i4l/isdn_bsdcomp.c
@@ -341,7 +341,7 @@
* Allocate space for the dictionary. This may be more than one page in
* length.
*/
- db->dict = (struct bsd_dict *) vmalloc (hsize * sizeof (struct bsd_dict));
+ db->dict = vmalloc(hsize * sizeof(struct bsd_dict));
if (!db->dict) {
bsd_free (db);
return NULL;
@@ -354,8 +354,7 @@
if (!decomp)
db->lens = NULL;
else {
- db->lens = (unsigned short *) vmalloc ((maxmaxcode + 1) *
- sizeof (db->lens[0]));
+ db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0]));
if (!db->lens) {
bsd_free (db);
return (NULL);
diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c
index c97330b..ec5f404 100644
--- a/drivers/isdn/i4l/isdn_common.c
+++ b/drivers/isdn/i4l/isdn_common.c
@@ -2291,7 +2291,7 @@
int i;
char tmprev[50];
- if (!(dev = (isdn_dev *) vmalloc(sizeof(isdn_dev)))) {
+ if (!(dev = vmalloc(sizeof(isdn_dev)))) {
printk(KERN_WARNING "isdn: Could not allocate device-struct.\n");
return -EIO;
}
diff --git a/drivers/net/bsd_comp.c b/drivers/net/bsd_comp.c
index 202d4a4..88edb98 100644
--- a/drivers/net/bsd_comp.c
+++ b/drivers/net/bsd_comp.c
@@ -406,8 +406,7 @@
* Allocate space for the dictionary. This may be more than one page in
* length.
*/
- db->dict = (struct bsd_dict *) vmalloc (hsize *
- sizeof (struct bsd_dict));
+ db->dict = vmalloc(hsize * sizeof(struct bsd_dict));
if (!db->dict)
{
bsd_free (db);
@@ -426,8 +425,7 @@
*/
else
{
- db->lens = (unsigned short *) vmalloc ((maxmaxcode + 1) *
- sizeof (db->lens[0]));
+ db->lens = vmalloc((maxmaxcode + 1) * sizeof(db->lens[0]));
if (!db->lens)
{
bsd_free (db);
diff --git a/drivers/net/eql.c b/drivers/net/eql.c
index a93700e..102218c 100644
--- a/drivers/net/eql.c
+++ b/drivers/net/eql.c
@@ -391,7 +391,7 @@
slave_t *duplicate_slave = NULL;
duplicate_slave = __eql_find_slave_dev(queue, slave->dev);
- if (duplicate_slave != 0)
+ if (duplicate_slave)
eql_kill_one_slave(queue, duplicate_slave);
list_add(&slave->list, &queue->all_slaves);
diff --git a/drivers/net/irda/kingsun-sir.c b/drivers/net/irda/kingsun-sir.c
index bdd5c97..4e5101a 100644
--- a/drivers/net/irda/kingsun-sir.c
+++ b/drivers/net/irda/kingsun-sir.c
@@ -509,12 +509,12 @@
spin_lock_init(&kingsun->lock);
/* Allocate input buffer */
- kingsun->in_buf = (__u8 *)kmalloc(kingsun->max_rx, GFP_KERNEL);
+ kingsun->in_buf = kmalloc(kingsun->max_rx, GFP_KERNEL);
if (!kingsun->in_buf)
goto free_mem;
/* Allocate output buffer */
- kingsun->out_buf = (__u8 *)kmalloc(KINGSUN_FIFO_SIZE, GFP_KERNEL);
+ kingsun->out_buf = kmalloc(KINGSUN_FIFO_SIZE, GFP_KERNEL);
if (!kingsun->out_buf)
goto free_mem;
diff --git a/drivers/net/slip.c b/drivers/net/slip.c
index 65bd20f..3fd4735 100644
--- a/drivers/net/slip.c
+++ b/drivers/net/slip.c
@@ -957,7 +957,7 @@
* STANDARD SLIP ENCAPSULATION *
************************************************************************/
-int
+static int
slip_esc(unsigned char *s, unsigned char *d, int len)
{
unsigned char *ptr = d;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index ad7f71a..818cc3a 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -7,6 +7,7 @@
header-y += spi/
header-y += sunrpc/
header-y += tc_act/
+header-y += tc_ematch/
header-y += netfilter/
header-y += netfilter_arp/
header-y += netfilter_bridge/
diff --git a/include/linux/if_pppol2tp.h b/include/linux/if_pppol2tp.h
index 516203b..a7d6a22 100644
--- a/include/linux/if_pppol2tp.h
+++ b/include/linux/if_pppol2tp.h
@@ -32,8 +32,8 @@
struct sockaddr_in addr; /* IP address and port to send to */
- __be16 s_tunnel, s_session; /* For matching incoming packets */
- __be16 d_tunnel, d_session; /* For sending outgoing packets */
+ __u16 s_tunnel, s_session; /* For matching incoming packets */
+ __u16 d_tunnel, d_session; /* For sending outgoing packets */
};
/* Socket options:
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 4bab322..328759c 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -116,12 +116,22 @@
struct packet_type* ptype, struct net_device *orig_dev)
{
unsigned char *rawp = NULL;
- struct vlan_hdr *vhdr = (struct vlan_hdr *)(skb->data);
+ struct vlan_hdr *vhdr;
unsigned short vid;
struct net_device_stats *stats;
unsigned short vlan_TCI;
__be16 proto;
+ if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+ return -1;
+
+ if (unlikely(!pskb_may_pull(skb, VLAN_HLEN))) {
+ kfree_skb(skb);
+ return -1;
+ }
+
+ vhdr = (struct vlan_hdr *)(skb->data);
+
/* vlan_TCI = ntohs(get_unaligned(&vhdr->h_vlan_TCI)); */
vlan_TCI = ntohs(vhdr->h_vlan_TCI);
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index fa77987..3ee2022 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -509,8 +509,14 @@
int (*okfn)(struct sk_buff *))
{
struct iphdr *iph;
- __u32 len;
struct sk_buff *skb = *pskb;
+ __u32 len = nf_bridge_encap_header_len(skb);
+
+ if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
+ return NF_STOLEN;
+
+ if (unlikely(!pskb_may_pull(skb, len)))
+ goto out;
if (skb->protocol == htons(ETH_P_IPV6) || IS_VLAN_IPV6(skb) ||
IS_PPPOE_IPV6(skb)) {
@@ -518,8 +524,6 @@
if (!brnf_call_ip6tables)
return NF_ACCEPT;
#endif
- if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
- goto out;
nf_bridge_pull_encap_header_rcsum(skb);
return br_nf_pre_routing_ipv6(hook, skb, in, out, okfn);
}
@@ -532,8 +536,6 @@
!IS_PPPOE_IP(skb))
return NF_ACCEPT;
- if ((skb = skb_share_check(*pskb, GFP_ATOMIC)) == NULL)
- goto out;
nf_bridge_pull_encap_header_rcsum(skb);
if (!pskb_may_pull(skb, sizeof(struct iphdr)))
diff --git a/net/core/dev_mcast.c b/net/core/dev_mcast.c
index 99aece1..20330c5 100644
--- a/net/core/dev_mcast.c
+++ b/net/core/dev_mcast.c
@@ -116,11 +116,13 @@
*/
int dev_mc_sync(struct net_device *to, struct net_device *from)
{
- struct dev_addr_list *da;
+ struct dev_addr_list *da, *next;
int err = 0;
netif_tx_lock_bh(to);
- for (da = from->mc_list; da != NULL; da = da->next) {
+ da = from->mc_list;
+ while (da != NULL) {
+ next = da->next;
if (!da->da_synced) {
err = __dev_addr_add(&to->mc_list, &to->mc_count,
da->da_addr, da->da_addrlen, 0);
@@ -134,6 +136,7 @@
__dev_addr_delete(&from->mc_list, &from->mc_count,
da->da_addr, da->da_addrlen, 0);
}
+ da = next;
}
if (!err)
__dev_set_rx_mode(to);
@@ -156,12 +159,14 @@
*/
void dev_mc_unsync(struct net_device *to, struct net_device *from)
{
- struct dev_addr_list *da;
+ struct dev_addr_list *da, *next;
netif_tx_lock_bh(from);
netif_tx_lock_bh(to);
- for (da = from->mc_list; da != NULL; da = da->next) {
+ da = from->mc_list;
+ while (da != NULL) {
+ next = da->next;
if (!da->da_synced)
continue;
__dev_addr_delete(&to->mc_list, &to->mc_count,
@@ -169,6 +174,7 @@
da->da_synced = 0;
__dev_addr_delete(&from->mc_list, &from->mc_count,
da->da_addr, da->da_addrlen, 0);
+ da = next;
}
__dev_set_rx_mode(to);
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index ca2a153..f7de8f2 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -33,6 +33,7 @@
#include <linux/rtnetlink.h>
#include <linux/random.h>
#include <linux/string.h>
+#include <linux/log2.h>
#define NEIGH_DEBUG 1
@@ -311,7 +312,7 @@
NEIGH_CACHE_STAT_INC(tbl, hash_grows);
- BUG_ON(new_entries & (new_entries - 1));
+ BUG_ON(!is_power_of_2(new_entries));
new_hash = neigh_hash_alloc(new_entries);
if (!new_hash)
return;
diff --git a/net/ipv4/ah4.c b/net/ipv4/ah4.c
index 7a23e59..39f6211 100644
--- a/net/ipv4/ah4.c
+++ b/net/ipv4/ah4.c
@@ -46,7 +46,7 @@
memcpy(daddr, optptr+optlen-4, 4);
/* Fall through */
default:
- memset(optptr+2, 0, optlen-2);
+ memset(optptr, 0, optlen);
}
l -= optlen;
optptr += optlen;
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
index 4d54457..6b420ae 100644
--- a/net/ipv4/ip_sockglue.c
+++ b/net/ipv4/ip_sockglue.c
@@ -625,6 +625,10 @@
{
struct ip_mreqn mreq;
+ err = -EPROTO;
+ if (inet_sk(sk)->is_icsk)
+ break;
+
if (optlen < sizeof(struct ip_mreq))
goto e_inval;
err = -EFAULT;
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index f030435..9785df3 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -755,7 +755,15 @@
}
}
-/* Numbers are taken from RFC2414. */
+/* Numbers are taken from RFC3390.
+ *
+ * John Heffner states:
+ *
+ * The RFC specifies a window of no more than 4380 bytes
+ * unless 2*MSS > 4380. Reading the pseudocode in the RFC
+ * is a bit misleading because they use a clamp at 4380 bytes
+ * rather than use a multiplier in the relevant range.
+ */
__u32 tcp_init_cwnd(struct tcp_sock *tp, struct dst_entry *dst)
{
__u32 cwnd = (dst ? dst_metric(dst, RTAX_INITCWND) : 0);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 761a910..6b038aa 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -554,6 +554,10 @@
{
struct ipv6_mreq mreq;
+ retv = -EPROTO;
+ if (inet_sk(sk)->is_icsk)
+ break;
+
retv = -EFAULT;
if (copy_from_user(&mreq, optval, sizeof(struct ipv6_mreq)))
break;