Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6
* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/selinux-2.6:
selinux: fix memory leak in netlabel code
diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig
index 3a75a0b..a04f507 100644
--- a/arch/arm/Kconfig
+++ b/arch/arm/Kconfig
@@ -1072,6 +1072,8 @@
source "drivers/dma/Kconfig"
+source "drivers/dca/Kconfig"
+
endmenu
source "fs/Kconfig"
diff --git a/arch/arm/mach-omap1/board-fsample.c b/arch/arm/mach-omap1/board-fsample.c
index f65baa9..d5f6ea1 100644
--- a/arch/arm/mach-omap1/board-fsample.c
+++ b/arch/arm/mach-omap1/board-fsample.c
@@ -40,31 +40,29 @@
KEY(0,1,KEY_RIGHT),
KEY(0,2,KEY_LEFT),
KEY(0,3,KEY_DOWN),
- KEY(0,4,KEY_CENTER),
- KEY(0,5,KEY_0_5),
- KEY(1,0,KEY_SOFT2),
+ KEY(0,4,KEY_ENTER),
+ KEY(1,0,KEY_F10),
KEY(1,1,KEY_SEND),
KEY(1,2,KEY_END),
KEY(1,3,KEY_VOLUMEDOWN),
KEY(1,4,KEY_VOLUMEUP),
KEY(1,5,KEY_RECORD),
- KEY(2,0,KEY_SOFT1),
+ KEY(2,0,KEY_F9),
KEY(2,1,KEY_3),
KEY(2,2,KEY_6),
KEY(2,3,KEY_9),
- KEY(2,4,KEY_SHARP),
- KEY(2,5,KEY_2_5),
+ KEY(2,4,KEY_KPDOT),
KEY(3,0,KEY_BACK),
KEY(3,1,KEY_2),
KEY(3,2,KEY_5),
KEY(3,3,KEY_8),
KEY(3,4,KEY_0),
- KEY(3,5,KEY_HEADSETHOOK),
+ KEY(3,5,KEY_KPSLASH),
KEY(4,0,KEY_HOME),
KEY(4,1,KEY_1),
KEY(4,2,KEY_4),
KEY(4,3,KEY_7),
- KEY(4,4,KEY_STAR),
+ KEY(4,4,KEY_KPASTERISK),
KEY(4,5,KEY_POWER),
0
};
diff --git a/arch/arm/mach-omap1/board-nokia770.c b/arch/arm/mach-omap1/board-nokia770.c
index 22db19a..182a98a 100644
--- a/arch/arm/mach-omap1/board-nokia770.c
+++ b/arch/arm/mach-omap1/board-nokia770.c
@@ -36,8 +36,6 @@
#include <asm/arch/omapfb.h>
#include <asm/arch/lcd_mipid.h>
-#include "../plat-omap/dsp/dsp_common.h"
-
#define ADS7846_PENDOWN_GPIO 15
static void __init omap_nokia770_init_irq(void)
@@ -318,6 +316,8 @@
out:
return ret;
}
+#else
+#define omap_dsp_init() do {} while (0)
#endif /* CONFIG_OMAP_DSP */
static void __init omap_nokia770_init(void)
diff --git a/arch/arm/mach-omap1/board-perseus2.c b/arch/arm/mach-omap1/board-perseus2.c
index 1d5c8d5..e44437e 100644
--- a/arch/arm/mach-omap1/board-perseus2.c
+++ b/arch/arm/mach-omap1/board-perseus2.c
@@ -39,31 +39,29 @@
KEY(0,1,KEY_RIGHT),
KEY(0,2,KEY_LEFT),
KEY(0,3,KEY_DOWN),
- KEY(0,4,KEY_CENTER),
- KEY(0,5,KEY_0_5),
- KEY(1,0,KEY_SOFT2),
+ KEY(0,4,KEY_ENTER),
+ KEY(1,0,KEY_F10),
KEY(1,1,KEY_SEND),
KEY(1,2,KEY_END),
KEY(1,3,KEY_VOLUMEDOWN),
KEY(1,4,KEY_VOLUMEUP),
KEY(1,5,KEY_RECORD),
- KEY(2,0,KEY_SOFT1),
+ KEY(2,0,KEY_F9),
KEY(2,1,KEY_3),
KEY(2,2,KEY_6),
KEY(2,3,KEY_9),
- KEY(2,4,KEY_SHARP),
- KEY(2,5,KEY_2_5),
+ KEY(2,4,KEY_KPDOT),
KEY(3,0,KEY_BACK),
KEY(3,1,KEY_2),
KEY(3,2,KEY_5),
KEY(3,3,KEY_8),
KEY(3,4,KEY_0),
- KEY(3,5,KEY_HEADSETHOOK),
+ KEY(3,5,KEY_KPSLASH),
KEY(4,0,KEY_HOME),
KEY(4,1,KEY_1),
KEY(4,2,KEY_4),
KEY(4,3,KEY_7),
- KEY(4,4,KEY_STAR),
+ KEY(4,4,KEY_KPASTERISK),
KEY(4,5,KEY_POWER),
0
};
diff --git a/arch/arm/mach-pxa/sleep.S b/arch/arm/mach-pxa/sleep.S
index aff71fe..d044772 100644
--- a/arch/arm/mach-pxa/sleep.S
+++ b/arch/arm/mach-pxa/sleep.S
@@ -43,11 +43,11 @@
pxa_cpu_save_sp:
@ preserve phys address of stack
mov r0, sp
- mov r2, lr
+ str lr, [sp, #-4]!
bl sleep_phys_sp
ldr r1, =sleep_save_sp
str r0, [r1]
- mov pc, r2
+ ldr pc, [sp], #4
/*
* pxa27x_cpu_suspend()
@@ -270,5 +270,3 @@
mar acc0, r2, r3
#endif
ldmfd sp!, {r4 - r12, pc} @ return to caller
-
-
diff --git a/arch/cris/arch-v10/kernel/io_interface_mux.c b/arch/cris/arch-v10/kernel/io_interface_mux.c
index 3a9114e..f3b327d 100644
--- a/arch/cris/arch-v10/kernel/io_interface_mux.c
+++ b/arch/cris/arch-v10/kernel/io_interface_mux.c
@@ -392,6 +392,7 @@
if (((interfaces[ioif].gpio_g_in & gpio_in_pins) != interfaces[ioif].gpio_g_in) ||
((interfaces[ioif].gpio_g_out & gpio_out_pins) != interfaces[ioif].gpio_g_out) ||
((interfaces[ioif].gpio_b & gpio_pb_pins) != interfaces[ioif].gpio_b)) {
+ local_irq_restore(flags);
printk(KERN_CRIT "cris_request_io_interface: Could not get required pins for interface %u\n",
ioif);
return -EBUSY;
diff --git a/arch/mips/mips-boards/malta/malta_setup.c b/arch/mips/mips-boards/malta/malta_setup.c
index 9a2636e..bc43a5c 100644
--- a/arch/mips/mips-boards/malta/malta_setup.c
+++ b/arch/mips/mips-boards/malta/malta_setup.c
@@ -149,7 +149,7 @@
/* Check PCI clock */
{
unsigned int __iomem *jmpr_p = (unsigned int *) ioremap(MALTA_JMPRS_REG, sizeof(unsigned int));
- int jmpr = (readw(jmpr_p) >> 2) & 0x07;
+ int jmpr = (__raw_readl(jmpr_p) >> 2) & 0x07;
static const int pciclocks[] __initdata = {
33, 20, 25, 30, 12, 16, 37, 10
};
diff --git a/arch/mips/tx4938/toshiba_rbtx4938/setup.c b/arch/mips/tx4938/toshiba_rbtx4938/setup.c
index 4a81523..632e5d2 100644
--- a/arch/mips/tx4938/toshiba_rbtx4938/setup.c
+++ b/arch/mips/tx4938/toshiba_rbtx4938/setup.c
@@ -598,8 +598,8 @@
printk(KERN_WARNING "seeprom: bad checksum.\n");
}
for (i = 0; i < 2; i++) {
- unsigned int slot = TX4938_PCIC_IDSEL_AD_TO_SLOT(31 - i);
- unsigned int id = (1 << 8) | PCI_DEVFN(slot, 0); /* bus 1 */
+ unsigned int id =
+ TXX9_IRQ_BASE + (i ? TX4938_IR_ETH1 : TX4938_IR_ETH0);
struct platform_device *pdev;
if (!(tx4938_ccfgptr->pcfg &
(i ? TX4938_PCFG_ETH1_SEL : TX4938_PCFG_ETH0_SEL)))
diff --git a/drivers/atm/idt77105.c b/drivers/atm/idt77105.c
index 0bd657f..84672dc 100644
--- a/drivers/atm/idt77105.c
+++ b/drivers/atm/idt77105.c
@@ -357,7 +357,7 @@
};
-int __devinit idt77105_init(struct atm_dev *dev)
+int idt77105_init(struct atm_dev *dev)
{
dev->phy = &idt77105_ops;
return 0;
diff --git a/drivers/atm/suni.c b/drivers/atm/suni.c
index f04f39c..b1d063c 100644
--- a/drivers/atm/suni.c
+++ b/drivers/atm/suni.c
@@ -289,7 +289,7 @@
};
-int __devinit suni_init(struct atm_dev *dev)
+int suni_init(struct atm_dev *dev)
{
unsigned char mri;
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 0c9a6f7..76c0fa6 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -632,6 +632,7 @@
#ifdef CONFIG_E1000_NAPI
napi_disable(&adapter->napi);
+ atomic_set(&adapter->irq_sem, 0);
#endif
e1000_irq_disable(adapter);
diff --git a/drivers/net/e1000e/netdev.c b/drivers/net/e1000e/netdev.c
index 2ab3bfb..9cc5a6b 100644
--- a/drivers/net/e1000e/netdev.c
+++ b/drivers/net/e1000e/netdev.c
@@ -2183,6 +2183,7 @@
msleep(10);
napi_disable(&adapter->napi);
+ atomic_set(&adapter->irq_sem, 0);
e1000_irq_disable(adapter);
del_timer_sync(&adapter->watchdog_timer);
diff --git a/drivers/net/ixgb/ixgb_main.c b/drivers/net/ixgb/ixgb_main.c
index d2fb88d..4f63839 100644
--- a/drivers/net/ixgb/ixgb_main.c
+++ b/drivers/net/ixgb/ixgb_main.c
@@ -296,6 +296,11 @@
{
struct net_device *netdev = adapter->netdev;
+#ifdef CONFIG_IXGB_NAPI
+ napi_disable(&adapter->napi);
+ atomic_set(&adapter->irq_sem, 0);
+#endif
+
ixgb_irq_disable(adapter);
free_irq(adapter->pdev->irq, netdev);
@@ -304,9 +309,7 @@
if(kill_watchdog)
del_timer_sync(&adapter->watchdog_timer);
-#ifdef CONFIG_IXGB_NAPI
- napi_disable(&adapter->napi);
-#endif
+
adapter->link_speed = 0;
adapter->link_duplex = 0;
netif_carrier_off(netdev);
diff --git a/drivers/net/ixgbe/ixgbe_main.c b/drivers/net/ixgbe/ixgbe_main.c
index de3f45e..a4265bc 100644
--- a/drivers/net/ixgbe/ixgbe_main.c
+++ b/drivers/net/ixgbe/ixgbe_main.c
@@ -1409,9 +1409,11 @@
IXGBE_WRITE_FLUSH(&adapter->hw);
msleep(10);
+ napi_disable(&adapter->napi);
+ atomic_set(&adapter->irq_sem, 0);
+
ixgbe_irq_disable(adapter);
- napi_disable(&adapter->napi);
del_timer_sync(&adapter->watchdog_timer);
netif_carrier_off(netdev);
diff --git a/drivers/net/tc35815.c b/drivers/net/tc35815.c
index d887c05..370d329 100644
--- a/drivers/net/tc35815.c
+++ b/drivers/net/tc35815.c
@@ -611,7 +611,7 @@
{
struct platform_device *plat_dev = to_platform_device(dev);
struct pci_dev *pci_dev = data;
- unsigned int id = (pci_dev->bus->number << 8) | pci_dev->devfn;
+ unsigned int id = pci_dev->irq;
return !strcmp(plat_dev->name, "tc35815-mac") && plat_dev->id == id;
}
diff --git a/drivers/net/veth.c b/drivers/net/veth.c
index 43af9e9..3f67a29 100644
--- a/drivers/net/veth.c
+++ b/drivers/net/veth.c
@@ -459,19 +459,7 @@
static __exit void veth_exit(void)
{
- struct veth_priv *priv, *next;
-
- rtnl_lock();
- /*
- * cannot trust __rtnl_link_unregister() to unregister all
- * devices, as each ->dellink call will remove two devices
- * from the list at once.
- */
- list_for_each_entry_safe(priv, next, &veth_list, list)
- veth_dellink(priv->dev);
-
- __rtnl_link_unregister(&veth_link_ops);
- rtnl_unlock();
+ rtnl_link_unregister(&veth_link_ops);
}
module_init(veth_init);
diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index feba967..7c069a0 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -447,7 +447,7 @@
port = (struct usb_serial_port *) urb->context;
tty = port->tty;
- if (urb->actual_length) {
+ if (tty && urb->actual_length) {
/* 0x80 bit is error flag */
if ((data[0] & 0x80) == 0) {
/* no errors on individual bytes, only possible overrun err*/
diff --git a/drivers/video/s3c2410fb.c b/drivers/video/s3c2410fb.c
index ad35033..b3c31d9 100644
--- a/drivers/video/s3c2410fb.c
+++ b/drivers/video/s3c2410fb.c
@@ -488,7 +488,7 @@
break;
}
- info->fix.line_length = (var->width * var->bits_per_pixel) / 8;
+ info->fix.line_length = (var->xres_virtual * var->bits_per_pixel) / 8;
/* activate this new configuration */
diff --git a/include/asm-mips/smtc_ipi.h b/include/asm-mips/smtc_ipi.h
index e09131a..8ce5175 100644
--- a/include/asm-mips/smtc_ipi.h
+++ b/include/asm-mips/smtc_ipi.h
@@ -49,7 +49,7 @@
static inline void smtc_ipi_nq(struct smtc_ipi_q *q, struct smtc_ipi *p)
{
- long flags;
+ unsigned long flags;
spin_lock_irqsave(&q->lock, flags);
if (q->head == NULL)
@@ -98,7 +98,7 @@
static inline void smtc_ipi_req(struct smtc_ipi_q *q, struct smtc_ipi *p)
{
- long flags;
+ unsigned long flags;
spin_lock_irqsave(&q->lock, flags);
if (q->head == NULL) {
@@ -114,7 +114,7 @@
static inline int smtc_ipi_qdepth(struct smtc_ipi_q *q)
{
- long flags;
+ unsigned long flags;
int retval;
spin_lock_irqsave(&q->lock, flags);
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index e65dd0b..f994bb8 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -1378,7 +1378,7 @@
/*
* Functions related to boot-time initialization:
*/
-static void __devinit init_hrtimers_cpu(int cpu)
+static void __cpuinit init_hrtimers_cpu(int cpu)
{
struct hrtimer_cpu_base *cpu_base = &per_cpu(hrtimer_bases, cpu);
int i;
diff --git a/kernel/timer.c b/kernel/timer.c
index 26671f4..2a00c22 100644
--- a/kernel/timer.c
+++ b/kernel/timer.c
@@ -1289,7 +1289,7 @@
}
}
-static void __devinit migrate_timers(int cpu)
+static void __cpuinit migrate_timers(int cpu)
{
tvec_base_t *old_base;
tvec_base_t *new_base;
diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 5d8b939..9f78a69 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -142,6 +142,23 @@
return skb->nf_bridge;
}
+static inline struct nf_bridge_info *nf_bridge_unshare(struct sk_buff *skb)
+{
+ struct nf_bridge_info *nf_bridge = skb->nf_bridge;
+
+ if (atomic_read(&nf_bridge->use) > 1) {
+ struct nf_bridge_info *tmp = nf_bridge_alloc(skb);
+
+ if (tmp) {
+ memcpy(tmp, nf_bridge, sizeof(struct nf_bridge_info));
+ atomic_set(&tmp->use, 1);
+ nf_bridge_put(nf_bridge);
+ }
+ nf_bridge = tmp;
+ }
+ return nf_bridge;
+}
+
static inline void nf_bridge_push_encap_header(struct sk_buff *skb)
{
unsigned int len = nf_bridge_encap_header_len(skb);
@@ -637,6 +654,11 @@
if (!skb->nf_bridge)
return NF_ACCEPT;
+ /* Need exclusive nf_bridge_info since we might have multiple
+ * different physoutdevs. */
+ if (!nf_bridge_unshare(skb))
+ return NF_DROP;
+
parent = bridge_parent(out);
if (!parent)
return NF_DROP;
@@ -718,6 +740,11 @@
if (!skb->nf_bridge)
return NF_ACCEPT;
+ /* Need exclusive nf_bridge_info since we might have multiple
+ * different physoutdevs. */
+ if (!nf_bridge_unshare(skb))
+ return NF_DROP;
+
nf_bridge = skb->nf_bridge;
if (!(nf_bridge->mask & BRNF_BRIDGED_DNAT))
return NF_ACCEPT;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index cc8a2f1..29b8ee4 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1316,6 +1316,8 @@
*p = parms->next;
parms->dead = 1;
write_unlock_bh(&tbl->lock);
+ if (parms->dev)
+ dev_put(parms->dev);
call_rcu(&parms->rcu_head, neigh_rcu_free_parms);
return;
}
@@ -1326,8 +1328,6 @@
void neigh_parms_destroy(struct neigh_parms *parms)
{
- if (parms->dev)
- dev_put(parms->dev);
kfree(parms);
}
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index e1ba26f..fed95a3 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -308,9 +308,12 @@
struct net *net;
for_each_net(net) {
+restart:
for_each_netdev_safe(net, dev, n) {
- if (dev->rtnl_link_ops == ops)
+ if (dev->rtnl_link_ops == ops) {
ops->dellink(dev);
+ goto restart;
+ }
}
}
list_del(&ops->list);
diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 527a6e0..0dfee27 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -444,6 +444,9 @@
struct fib_info *fi_drop;
u8 state;
+ if (fi->fib_treeref > 1)
+ goto out;
+
write_lock_bh(&fib_hash_lock);
fi_drop = fa->fa_info;
fa->fa_info = fi;
@@ -718,19 +721,18 @@
{
int h, s_h;
+ if (fz->fz_hash == NULL)
+ return skb->len;
s_h = cb->args[3];
- for (h=0; h < fz->fz_divisor; h++) {
- if (h < s_h) continue;
- if (h > s_h)
- memset(&cb->args[4], 0,
- sizeof(cb->args) - 4*sizeof(cb->args[0]));
- if (fz->fz_hash == NULL ||
- hlist_empty(&fz->fz_hash[h]))
+ for (h = s_h; h < fz->fz_divisor; h++) {
+ if (hlist_empty(&fz->fz_hash[h]))
continue;
- if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h])<0) {
+ if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h]) < 0) {
cb->args[3] = h;
return -1;
}
+ memset(&cb->args[4], 0,
+ sizeof(cb->args) - 4*sizeof(cb->args[0]));
}
cb->args[3] = h;
return skb->len;
@@ -746,14 +748,13 @@
read_lock(&fib_hash_lock);
for (fz = table->fn_zone_list, m=0; fz; fz = fz->fz_next, m++) {
if (m < s_m) continue;
- if (m > s_m)
- memset(&cb->args[3], 0,
- sizeof(cb->args) - 3*sizeof(cb->args[0]));
if (fn_hash_dump_zone(skb, cb, tb, fz) < 0) {
cb->args[2] = m;
read_unlock(&fib_hash_lock);
return -1;
}
+ memset(&cb->args[3], 0,
+ sizeof(cb->args) - 3*sizeof(cb->args[0]));
}
read_unlock(&fib_hash_lock);
cb->args[2] = m;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 8d8c291..1010b46 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1214,6 +1214,9 @@
struct fib_info *fi_drop;
u8 state;
+ if (fi->fib_treeref > 1)
+ goto out;
+
err = -ENOBUFS;
new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL);
if (new_fa == NULL)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 233de06..82baea0 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -540,7 +540,6 @@
icmp_param.data.icmph.checksum = 0;
icmp_param.skb = skb_in;
icmp_param.offset = skb_network_offset(skb_in);
- icmp_out_count(icmp_param.data.icmph.type);
inet_sk(icmp_socket->sk)->tos = tos;
ipc.addr = iph->saddr;
ipc.opt = &icmp_param.replyopts;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 9bb031f..f124068 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -458,8 +458,6 @@
}
err = icmpv6_push_pending_frames(sk, &fl, &tmp_hdr, len + sizeof(struct icmp6hdr));
- ICMP6_INC_STATS_BH(idev, ICMP6_MIB_OUTMSGS);
-
out_put:
if (likely(idev != NULL))
in6_dev_put(idev);
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index adc73ad..0765d8b 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -193,7 +193,7 @@
sk2->sk_family == PF_INET6 &&
ipv6_addr_equal(&tw6->tw_v6_daddr, saddr) &&
ipv6_addr_equal(&tw6->tw_v6_rcv_saddr, daddr) &&
- sk2->sk_bound_dev_if == sk->sk_bound_dev_if) {
+ (!sk2->sk_bound_dev_if || sk2->sk_bound_dev_if == dif)) {
if (twsk_unique(sk, sk2, twp))
goto unique;
else
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 8631ed7..4493761 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -88,7 +88,7 @@
[ICMPV6_PKT_TOOBIG] = "PktTooBigs",
[ICMPV6_TIME_EXCEED] = "TimeExcds",
[ICMPV6_PARAMPROB] = "ParmProblems",
- [ICMPV6_ECHO_REQUEST] = "EchoRequest",
+ [ICMPV6_ECHO_REQUEST] = "Echos",
[ICMPV6_ECHO_REPLY] = "EchoReplies",
[ICMPV6_MGM_QUERY] = "GroupMembQueries",
[ICMPV6_MGM_REPORT] = "GroupMembResponses",
@@ -98,7 +98,7 @@
[NDISC_ROUTER_SOLICITATION] = "RouterSolicits",
[NDISC_NEIGHBOUR_ADVERTISEMENT] = "NeighborAdvertisements",
[NDISC_NEIGHBOUR_SOLICITATION] = "NeighborSolicits",
- [NDISC_REDIRECT] = "NeighborRedirects",
+ [NDISC_REDIRECT] = "Redirects",
};
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6ecb5e6..20083e0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -329,7 +329,7 @@
static inline int rt6_check_neigh(struct rt6_info *rt)
{
struct neighbour *neigh = rt->rt6i_nexthop;
- int m = 0;
+ int m;
if (rt->rt6i_flags & RTF_NONEXTHOP ||
!(rt->rt6i_flags & RTF_GATEWAY))
m = 1;
@@ -337,10 +337,15 @@
read_lock_bh(&neigh->lock);
if (neigh->nud_state & NUD_VALID)
m = 2;
- else if (!(neigh->nud_state & NUD_FAILED))
+#ifdef CONFIG_IPV6_ROUTER_PREF
+ else if (neigh->nud_state & NUD_FAILED)
+ m = 0;
+#endif
+ else
m = 1;
read_unlock_bh(&neigh->lock);
- }
+ } else
+ m = 0;
return m;
}
diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
index d5e4dd7..07dfa7f 100644
--- a/net/irda/af_irda.c
+++ b/net/irda/af_irda.c
@@ -802,12 +802,18 @@
}
#endif /* CONFIG_IRDA_ULTRA */
+ self->ias_obj = irias_new_object(addr->sir_name, jiffies);
+ if (self->ias_obj == NULL)
+ return -ENOMEM;
+
err = irda_open_tsap(self, addr->sir_lsap_sel, addr->sir_name);
- if (err < 0)
+ if (err < 0) {
+ kfree(self->ias_obj->name);
+ kfree(self->ias_obj);
return err;
+ }
/* Register with LM-IAS */
- self->ias_obj = irias_new_object(addr->sir_name, jiffies);
irias_add_integer_attrib(self->ias_obj, "IrDA:TinyTP:LsapSel",
self->stsap_sel, IAS_KERNEL_ATTR);
irias_insert_object(self->ias_obj);
@@ -1825,7 +1831,7 @@
struct irda_ias_set *ias_opt;
struct ias_object *ias_obj;
struct ias_attrib * ias_attr; /* Attribute in IAS object */
- int opt;
+ int opt, free_ias = 0;
IRDA_DEBUG(2, "%s(%p)\n", __FUNCTION__, self);
@@ -1881,11 +1887,20 @@
/* Create a new object */
ias_obj = irias_new_object(ias_opt->irda_class_name,
jiffies);
+ if (ias_obj == NULL) {
+ kfree(ias_opt);
+ return -ENOMEM;
+ }
+ free_ias = 1;
}
/* Do we have the attribute already ? */
if(irias_find_attrib(ias_obj, ias_opt->irda_attrib_name)) {
kfree(ias_opt);
+ if (free_ias) {
+ kfree(ias_obj->name);
+ kfree(ias_obj);
+ }
return -EINVAL;
}
@@ -1904,6 +1919,11 @@
if(ias_opt->attribute.irda_attrib_octet_seq.len >
IAS_MAX_OCTET_STRING) {
kfree(ias_opt);
+ if (free_ias) {
+ kfree(ias_obj->name);
+ kfree(ias_obj);
+ }
+
return -EINVAL;
}
/* Add an octet sequence attribute */
@@ -1932,6 +1952,10 @@
break;
default :
kfree(ias_opt);
+ if (free_ias) {
+ kfree(ias_obj->name);
+ kfree(ias_obj);
+ }
return -EINVAL;
}
irias_insert_object(ias_obj);
diff --git a/net/key/af_key.c b/net/key/af_key.c
index 26d5e63..76dcd88 100644
--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3593,27 +3593,29 @@
/* old ipsecrequest */
int mode = pfkey_mode_from_xfrm(mp->mode);
if (mode < 0)
- return -EINVAL;
+ goto err;
if (set_ipsecrequest(skb, mp->proto, mode,
(mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
mp->reqid, mp->old_family,
- &mp->old_saddr, &mp->old_daddr) < 0) {
- return -EINVAL;
- }
+ &mp->old_saddr, &mp->old_daddr) < 0)
+ goto err;
/* new ipsecrequest */
if (set_ipsecrequest(skb, mp->proto, mode,
(mp->reqid ? IPSEC_LEVEL_UNIQUE : IPSEC_LEVEL_REQUIRE),
mp->reqid, mp->new_family,
- &mp->new_saddr, &mp->new_daddr) < 0) {
- return -EINVAL;
- }
+ &mp->new_saddr, &mp->new_daddr) < 0)
+ goto err;
}
/* broadcast migrate message to sockets */
pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL);
return 0;
+
+err:
+ kfree_skb(skb);
+ return -EINVAL;
}
#else
static int pfkey_send_migrate(struct xfrm_selector *sel, u8 dir, u8 type,
diff --git a/net/rfkill/rfkill.c b/net/rfkill/rfkill.c
index 4469a7b..d06d338 100644
--- a/net/rfkill/rfkill.c
+++ b/net/rfkill/rfkill.c
@@ -392,11 +392,14 @@
rfkill_led_trigger_register(rfkill);
error = rfkill_add_switch(rfkill);
- if (error)
+ if (error) {
+ rfkill_led_trigger_unregister(rfkill);
return error;
+ }
error = device_add(dev);
if (error) {
+ rfkill_led_trigger_unregister(rfkill);
rfkill_remove_switch(rfkill);
return error;
}
diff --git a/security/commoncap.c b/security/commoncap.c
index 5bc1895..ea61bc7 100644
--- a/security/commoncap.c
+++ b/security/commoncap.c
@@ -59,6 +59,12 @@
EXPORT_SYMBOL(cap_netlink_recv);
+/*
+ * NOTE WELL: cap_capable() cannot be used like the kernel's capable()
+ * function. That is, it has the reverse semantics: cap_capable()
+ * returns 0 when a task has a capability, but the kernel's capable()
+ * returns 1 for this case.
+ */
int cap_capable (struct task_struct *tsk, int cap)
{
/* Derived from include/linux/sched.h:capable. */
@@ -107,10 +113,11 @@
static inline int cap_inh_is_capped(void)
{
/*
- * return 1 if changes to the inheritable set are limited
- * to the old permitted set.
+ * Return 1 if changes to the inheritable set are limited
+ * to the old permitted set. That is, if the current task
+ * does *not* possess the CAP_SETPCAP capability.
*/
- return !cap_capable(current, CAP_SETPCAP);
+ return (cap_capable(current, CAP_SETPCAP) != 0);
}
#else /* ie., ndef CONFIG_SECURITY_FILE_CAPABILITIES */