Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

diff --git a/include/net/ax25.h b/include/net/ax25.h
index 828a3a93dda10e07ce851476894296f5b7e4a68f..3696f988a9f109710f8f947880eda11283fe449d 100644 (file)
--- a/include/net/ax25.h
+++ b/include/net/ax25.h
@@ -139,11 +139,25 @@ enum {
 #define AX25_DEF_DS_TIMEOUT    (3 * 60 * HZ)           /* DAMA timeout 3 minutes */
 
 typedef struct ax25_uid_assoc {
-       struct ax25_uid_assoc   *next;
+       struct hlist_node       uid_node;
+       atomic_t                refcount;
        uid_t                   uid;
        ax25_address            call;
 } ax25_uid_assoc;
 
+#define ax25_uid_for_each(__ax25, node, list) \
+       hlist_for_each_entry(__ax25, node, list, uid_node)
+
+#define ax25_uid_hold(ax25) \
+       atomic_inc(&((ax25)->refcount))
+
+static inline void ax25_uid_put(ax25_uid_assoc *assoc)
+{
+       if (atomic_dec_and_test(&assoc->refcount)) {
+               kfree(assoc);
+       }
+}
+
 typedef struct {
        ax25_address            calls[AX25_MAX_DIGIS];
        unsigned char           repeated[AX25_MAX_DIGIS];
@@ -376,7 +390,7 @@ extern unsigned long ax25_display_timer(struct timer_list *);
 
 /* ax25_uid.c */
 extern int  ax25_uid_policy;
-extern ax25_address *ax25_findbyuid(uid_t);
+extern ax25_uid_assoc *ax25_findbyuid(uid_t);
 extern int  ax25_uid_ioctl(int, struct sockaddr_ax25 *);
 extern struct file_operations ax25_uid_fops;
 extern void ax25_uid_free(void);

diff --git a/include/net/sock.h b/include/net/sock.h
index a1042d08becd538c4bb330d32ee64cd550ca2f39..e9b1dbab90d007fec58e666d98205c1b8ca6a114 100644 (file)
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -384,6 +384,11 @@ enum sock_flags {
        SOCK_QUEUE_SHRUNK, /* write queue has been shrunk recently */
 };
 
+static inline void sock_copy_flags(struct sock *nsk, struct sock *osk)
+{
+       nsk->sk_flags = osk->sk_flags;
+}
+
 static inline void sock_set_flag(struct sock *sk, enum sock_flags flag)
 {
        __set_bit(flag, &sk->sk_flags);

diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 707097deac3deb4957741204c7944e01521f3c0f..a5c94f11547c8e5319086f64a894f76f98994cbd 100644 (file)
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -875,12 +875,7 @@ struct sock *ax25_make_new(struct sock *osk, struct ax25_dev *ax25_dev)
        sk->sk_sndbuf   = osk->sk_sndbuf;
        sk->sk_state    = TCP_ESTABLISHED;
        sk->sk_sleep    = osk->sk_sleep;
-
-       if (sock_flag(osk, SOCK_DBG))
-               sock_set_flag(sk, SOCK_DBG);
-
-       if (sock_flag(osk, SOCK_ZAPPED))
-               sock_set_flag(sk, SOCK_ZAPPED);
+       sock_copy_flags(sk, osk);
 
        oax25 = ax25_sk(osk);
 
@@ -1007,7 +1002,8 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct sock *sk = sock->sk;
        struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
        ax25_dev *ax25_dev = NULL;
-       ax25_address *call;
+       ax25_uid_assoc *user;
+       ax25_address call;
        ax25_cb *ax25;
        int err = 0;
 
@@ -1026,9 +1022,15 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        if (addr->fsa_ax25.sax25_family != AF_AX25)
                return -EINVAL;
 
-       call = ax25_findbyuid(current->euid);
-       if (call == NULL && ax25_uid_policy && !capable(CAP_NET_ADMIN)) {
-               return -EACCES;
+       user = ax25_findbyuid(current->euid);
+       if (user) {
+               call = user->call;
+               ax25_uid_put(user);
+       } else {
+               if (ax25_uid_policy && !capable(CAP_NET_ADMIN))
+                       return -EACCES;
+
+               call = addr->fsa_ax25.sax25_call;
        }
 
        lock_sock(sk);
@@ -1039,10 +1041,7 @@ static int ax25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                goto out;
        }
 
-       if (call == NULL)
-               ax25->source_addr = addr->fsa_ax25.sax25_call;
-       else
-               ax25->source_addr = *call;
+       ax25->source_addr = call;
 
        /*
         * User already set interface with SO_BINDTODEVICE

diff --git a/net/ax25/ax25_route.c b/net/ax25/ax25_route.c
index 44b99b1ff9f8c7c8a92568d0d4a665979288a268..c288526da4ce194c65f49878f40cd686cedd1216 100644 (file)
--- a/net/ax25/ax25_route.c
+++ b/net/ax25/ax25_route.c
@@ -422,8 +422,8 @@ static inline void ax25_adjust_path(ax25_address *addr, ax25_digi *digipeat)
  */
 int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
 {
+       ax25_uid_assoc *user;
        ax25_route *ax25_rt;
-       ax25_address *call;
        int err;
 
        if ((ax25_rt = ax25_get_route(addr, NULL)) == NULL)
@@ -434,16 +434,18 @@ int ax25_rt_autobind(ax25_cb *ax25, ax25_address *addr)
                goto put;
        }
 
-       if ((call = ax25_findbyuid(current->euid)) == NULL) {
+       user = ax25_findbyuid(current->euid);
+       if (user) {
+               ax25->source_addr = user->call;
+               ax25_uid_put(user);
+       } else {
                if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
                        err = -EPERM;
                        goto put;
                }
-               call = (ax25_address *)ax25->ax25_dev->dev->dev_addr;
+               ax25->source_addr = *(ax25_address *)ax25->ax25_dev->dev->dev_addr;
        }
 
-       ax25->source_addr = *call;
-
        if (ax25_rt->digipeat != NULL) {
                if ((ax25->digipeat = kmalloc(sizeof(ax25_digi), GFP_ATOMIC)) == NULL) {
                        err = -ENOMEM;

diff --git a/net/ax25/ax25_uid.c b/net/ax25/ax25_uid.c
index cea6b7d1972905ddeb17d3f5c6ab8b38b8b30c30..a8b3822f3ee42155032c914c31e80e1354b1fbfb 100644 (file)
--- a/net/ax25/ax25_uid.c
+++ b/net/ax25/ax25_uid.c
@@ -28,6 +28,7 @@
 #include <linux/fcntl.h>
 #include <linux/mm.h>
 #include <linux/interrupt.h>
+#include <linux/list.h>
 #include <linux/notifier.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -41,38 +42,41 @@
  *     Callsign/UID mapper. This is in kernel space for security on multi-amateur machines.
  */
 
-static ax25_uid_assoc *ax25_uid_list;
+HLIST_HEAD(ax25_uid_list);
 static DEFINE_RWLOCK(ax25_uid_lock);
 
 int ax25_uid_policy = 0;
 
-ax25_address *ax25_findbyuid(uid_t uid)
+ax25_uid_assoc *ax25_findbyuid(uid_t uid)
 {
-       ax25_uid_assoc *ax25_uid;
-       ax25_address *res = NULL;
+       ax25_uid_assoc *ax25_uid, *res = NULL;
+       struct hlist_node *node;
 
        read_lock(&ax25_uid_lock);
-       for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+       ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
                if (ax25_uid->uid == uid) {
-                       res = &ax25_uid->call;
+                       ax25_uid_hold(ax25_uid);
+                       res = ax25_uid;
                        break;
                }
        }
        read_unlock(&ax25_uid_lock);
 
-       return NULL;
+       return res;
 }
 
 int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 {
-       ax25_uid_assoc *s, *ax25_uid;
+       ax25_uid_assoc *ax25_uid;
+       struct hlist_node *node;
+       ax25_uid_assoc *user;
        unsigned long res;
 
        switch (cmd) {
        case SIOCAX25GETUID:
                res = -ENOENT;
                read_lock(&ax25_uid_lock);
-               for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
+               ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
                        if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
                                res = ax25_uid->uid;
                                break;
@@ -85,19 +89,22 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
        case SIOCAX25ADDUID:
                if (!capable(CAP_NET_ADMIN))
                        return -EPERM;
-               if (ax25_findbyuid(sax->sax25_uid))
+               user = ax25_findbyuid(sax->sax25_uid);
+               if (user) {
+                       ax25_uid_put(user);
                        return -EEXIST;
+               }
                if (sax->sax25_uid == 0)
                        return -EINVAL;
                if ((ax25_uid = kmalloc(sizeof(*ax25_uid), GFP_KERNEL)) == NULL)
                        return -ENOMEM;
 
+               atomic_set(&ax25_uid->refcount, 1);
                ax25_uid->uid  = sax->sax25_uid;
                ax25_uid->call = sax->sax25_call;
 
                write_lock(&ax25_uid_lock);
-               ax25_uid->next = ax25_uid_list;
-               ax25_uid_list  = ax25_uid;
+               hlist_add_head(&ax25_uid->uid_node, &ax25_uid_list);
                write_unlock(&ax25_uid_lock);
 
                return 0;
@@ -106,34 +113,21 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
                if (!capable(CAP_NET_ADMIN))
                        return -EPERM;
 
+               ax25_uid = NULL;
                write_lock(&ax25_uid_lock);
-               for (ax25_uid = ax25_uid_list; ax25_uid != NULL; ax25_uid = ax25_uid->next) {
-                       if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0) {
+               ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+                       if (ax25cmp(&sax->sax25_call, &ax25_uid->call) == 0)
                                break;
-                       }
                }
                if (ax25_uid == NULL) {
                        write_unlock(&ax25_uid_lock);
                        return -ENOENT;
                }
-               if ((s = ax25_uid_list) == ax25_uid) {
-                       ax25_uid_list = s->next;
-                       write_unlock(&ax25_uid_lock);
-                       kfree(ax25_uid);
-                       return 0;
-               }
-               while (s != NULL && s->next != NULL) {
-                       if (s->next == ax25_uid) {
-                               s->next = ax25_uid->next;
-                               write_unlock(&ax25_uid_lock);
-                               kfree(ax25_uid);
-                               return 0;
-                       }
-                       s = s->next;
-               }
+               hlist_del_init(&ax25_uid->uid_node);
+               ax25_uid_put(ax25_uid);
                write_unlock(&ax25_uid_lock);
 
-               return -ENOENT;
+               return 0;
 
        default:
                return -EINVAL;
@@ -147,13 +141,11 @@ int ax25_uid_ioctl(int cmd, struct sockaddr_ax25 *sax)
 static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
 {
        struct ax25_uid_assoc *pt;
-       int i = 1;
+       struct hlist_node *node;
+       int i = 0;
 
        read_lock(&ax25_uid_lock);
-       if (*pos == 0)
-               return SEQ_START_TOKEN;
-
-       for (pt = ax25_uid_list; pt != NULL; pt = pt->next) {
+       ax25_uid_for_each(pt, node, &ax25_uid_list) {
                if (i == *pos)
                        return pt;
                ++i;
@@ -164,8 +156,9 @@ static void *ax25_uid_seq_start(struct seq_file *seq, loff_t *pos)
 static void *ax25_uid_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
        ++*pos;
-       return (v == SEQ_START_TOKEN) ? ax25_uid_list : 
-               ((struct ax25_uid_assoc *) v)->next;
+
+       return hlist_entry(((ax25_uid_assoc *)v)->uid_node.next,
+                          ax25_uid_assoc, uid_node);
 }
 
 static void ax25_uid_seq_stop(struct seq_file *seq, void *v)
@@ -179,7 +172,6 @@ static int ax25_uid_seq_show(struct seq_file *seq, void *v)
                seq_printf(seq, "Policy: %d\n", ax25_uid_policy);
        else {
                struct ax25_uid_assoc *pt = v;
-               
 
                seq_printf(seq, "%6d %s\n", pt->uid, ax2asc(&pt->call));
        }
@@ -213,16 +205,13 @@ struct file_operations ax25_uid_fops = {
  */
 void __exit ax25_uid_free(void)
 {
-       ax25_uid_assoc *s, *ax25_uid;
+       ax25_uid_assoc *ax25_uid;
+       struct hlist_node *node;
 
        write_lock(&ax25_uid_lock);
-       ax25_uid = ax25_uid_list;
-       while (ax25_uid != NULL) {
-               s        = ax25_uid;
-               ax25_uid = ax25_uid->next;
-
-               kfree(s);
+       ax25_uid_for_each(ax25_uid, node, &ax25_uid_list) {
+               hlist_del_init(&ax25_uid->uid_node);
+               ax25_uid_put(ax25_uid);
        }
-       ax25_uid_list = NULL;
        write_unlock(&ax25_uid_lock);
 }

diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 95473953c406ebe2cc7217918381b5896f3ace66..ab18a853d7ce3ca5249606af7f5a1660de6e5182 100644 (file)
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -450,10 +450,13 @@ static void peer_check_expire(unsigned long dummy)
        /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
         * interval depending on the total number of entries (more entries,
         * less interval). */
-       peer_periodic_timer.expires = jiffies
-               + inet_peer_gc_maxtime
-               - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
-                       peer_total / inet_peer_threshold * HZ;
+       if (peer_total >= inet_peer_threshold)
+               peer_periodic_timer.expires = jiffies + inet_peer_gc_mintime;
+       else
+               peer_periodic_timer.expires = jiffies
+                       + inet_peer_gc_maxtime
+                       - (inet_peer_gc_maxtime - inet_peer_gc_mintime) / HZ *
+                               peer_total / inet_peer_threshold * HZ;
        add_timer(&peer_periodic_timer);
 }
 

diff --git a/net/ipv4/netfilter/ip_queue.c b/net/ipv4/netfilter/ip_queue.c
index eda1fba431a415cef7f9533c8fdbcaca03f4f4a1..c6baa8174389fd64d864100d3133759b797b82bd 100644 (file)
--- a/net/ipv4/netfilter/ip_queue.c
+++ b/net/ipv4/netfilter/ip_queue.c
@@ -214,6 +214,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                break;
        
        case IPQ_COPY_PACKET:
+               if (entry->skb->ip_summed == CHECKSUM_HW &&
+                   (*errp = skb_checksum_help(entry->skb,
+                                              entry->info->outdev == NULL))) {
+                       read_unlock_bh(&queue_lock);
+                       return NULL;
+               }
                if (copy_range == 0 || copy_range > entry->skb->len)
                        data_len = entry->skb->len;
                else
@@ -385,6 +391,7 @@ ipq_mangle_ipv4(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
        if (!skb_ip_make_writable(&e->skb, v->data_len))
                return -ENOMEM;
        memcpy(e->skb->data, v->payload, v->data_len);
+       e->skb->ip_summed = CHECKSUM_NONE;
        e->skb->nfcache |= NFC_ALTERED;
 
        /*

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index ddb6ce4ecff291e9ecec53e86a2781eefe61a3bb..69b1fcf70077262e39737ce5f87bb8effb1e85e9 100644 (file)
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -584,7 +584,7 @@ static inline void skb_entail(struct sock *sk, struct tcp_sock *tp,
        sk_charge_skb(sk, skb);
        if (!sk->sk_send_head)
                sk->sk_send_head = skb;
-       else if (tp->nonagle&TCP_NAGLE_PUSH)
+       if (tp->nonagle & TCP_NAGLE_PUSH)
                tp->nonagle &= ~TCP_NAGLE_PUSH; 
 }
 

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 5d91213d34c06c2f52a9a3217cb1dc9a2ef4c5cc..67c670886c1fda8f3f8beb156e4b23b36888eae1 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -242,9 +242,14 @@ static int tcp_v4_get_port(struct sock *sk, unsigned short snum)
                tcp_port_rover = rover;
                spin_unlock(&tcp_portalloc_lock);
 
-               /* Exhausted local port range during search? */
+               /* Exhausted local port range during search?  It is not
+                * possible for us to be holding one of the bind hash
+                * locks if this test triggers, because if 'remaining'
+                * drops to zero, we broke out of the do/while loop at
+                * the top level, not from the 'break;' statement.
+                */
                ret = 1;
-               if (remaining <= 0)
+               if (unlikely(remaining <= 0))
                        goto fail;
 
                /* OK, here is the one we will use.  HEAD is

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 566045e58437e21cfc8ebaefc9f9056b3c1c01ae..dd30dd137b74dd061d74af66500f3d3294be13cf 100644 (file)
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -925,10 +925,6 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
 
        limit = min(send_win, cong_win);
 
-       /* If sk_send_head can be sent fully now, just do it.  */
-       if (skb->len <= limit)
-               return 0;
-
        if (sysctl_tcp_tso_win_divisor) {
                u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
 

diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 5493180f0d441200675a5ecd0406617e5a7d7cf5..a16df5b27c84e8ab93dc5dc42be41c1c5662e591 100644 (file)
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -211,6 +211,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                break;
        
        case IPQ_COPY_PACKET:
+               if (entry->skb->ip_summed == CHECKSUM_HW &&
+                   (*errp = skb_checksum_help(entry->skb,
+                                              entry->info->outdev == NULL))) {
+                       read_unlock_bh(&queue_lock);
+                       return NULL;
+               }
                if (copy_range == 0 || copy_range > entry->skb->len)
                        data_len = entry->skb->len;
                else
@@ -381,6 +387,7 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
        if (!skb_ip_make_writable(&e->skb, v->data_len))
                return -ENOMEM;
        memcpy(e->skb->data, v->payload, v->data_len);
+       e->skb->ip_summed = CHECKSUM_NONE;
        e->skb->nfcache |= NFC_ALTERED;
 
        /*

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6e288dc116ede93c2f755075c641303ca4bca47..ef29cfd936d3bed8f094f89627e8e67932529886 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -158,9 +158,14 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                tcp_port_rover = rover;
                spin_unlock(&tcp_portalloc_lock);
 
-               /* Exhausted local port range during search? */
+               /* Exhausted local port range during search?  It is not
+                * possible for us to be holding one of the bind hash
+                * locks if this test triggers, because if 'remaining'
+                * drops to zero, we broke out of the do/while loop at
+                * the top level, not from the 'break;' statement.
+                */
                ret = 1;
-               if (remaining <= 0)
+               if (unlikely(remaining <= 0))
                        goto fail;
 
                /* OK, here is the one we will use. */

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index 31ed4a9a1d066c0cdef1c3e5b6371fa3678037d4..162a85fed150efd5a359da92a9524e6f3f3f4742 100644 (file)
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -459,12 +459,7 @@ static struct sock *nr_make_new(struct sock *osk)
        sk->sk_sndbuf   = osk->sk_sndbuf;
        sk->sk_state    = TCP_ESTABLISHED;
        sk->sk_sleep    = osk->sk_sleep;
-
-       if (sock_flag(osk, SOCK_ZAPPED))
-               sock_set_flag(sk, SOCK_ZAPPED);
-
-       if (sock_flag(osk, SOCK_DBG))
-               sock_set_flag(sk, SOCK_DBG);
+       sock_copy_flags(sk, osk);
 
        skb_queue_head_init(&nr->ack_queue);
        skb_queue_head_init(&nr->reseq_queue);
@@ -541,7 +536,8 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct nr_sock *nr = nr_sk(sk);
        struct full_sockaddr_ax25 *addr = (struct full_sockaddr_ax25 *)uaddr;
        struct net_device *dev;
-       ax25_address *user, *source;
+       ax25_uid_assoc *user;
+       ax25_address *source;
 
        lock_sock(sk);
        if (!sock_flag(sk, SOCK_ZAPPED)) {
@@ -580,16 +576,19 @@ static int nr_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        } else {
                source = &addr->fsa_ax25.sax25_call;
 
-               if ((user = ax25_findbyuid(current->euid)) == NULL) {
+               user = ax25_findbyuid(current->euid);
+               if (user) {
+                       nr->user_addr   = user->call;
+                       ax25_uid_put(user);
+               } else {
                        if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE)) {
                                release_sock(sk);
                                dev_put(dev);
                                return -EPERM;
                        }
-                       user = source;
+                       nr->user_addr   = *source;
                }
 
-               nr->user_addr   = *user;
                nr->source_addr = *source;
        }
 
@@ -609,7 +608,8 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
        struct sock *sk = sock->sk;
        struct nr_sock *nr = nr_sk(sk);
        struct sockaddr_ax25 *addr = (struct sockaddr_ax25 *)uaddr;
-       ax25_address *user, *source = NULL;
+       ax25_address *source = NULL;
+       ax25_uid_assoc *user;
        struct net_device *dev;
 
        lock_sock(sk);
@@ -650,16 +650,19 @@ static int nr_connect(struct socket *sock, struct sockaddr *uaddr,
                }
                source = (ax25_address *)dev->dev_addr;
 
-               if ((user = ax25_findbyuid(current->euid)) == NULL) {
+               user = ax25_findbyuid(current->euid);
+               if (user) {
+                       nr->user_addr   = user->call;
+                       ax25_uid_put(user);
+               } else {
                        if (ax25_uid_policy && !capable(CAP_NET_ADMIN)) {
                                dev_put(dev);
                                release_sock(sk);
                                return -EPERM;
                        }
-                       user = source;
+                       nr->user_addr   = *source;
                }
 
-               nr->user_addr   = *user;
                nr->source_addr = *source;
                nr->device      = dev;
 

diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
index 7eb6a5bf93ea1961bc0c35e70843a646c106596f..5480caf8ccc2e0dd2141c8058db5b37c05c14dcd 100644 (file)
--- a/net/rose/af_rose.c
+++ b/net/rose/af_rose.c
@@ -556,12 +556,7 @@ static struct sock *rose_make_new(struct sock *osk)
        sk->sk_sndbuf   = osk->sk_sndbuf;
        sk->sk_state    = TCP_ESTABLISHED;
        sk->sk_sleep    = osk->sk_sleep;
-
-       if (sock_flag(osk, SOCK_ZAPPED))
-               sock_set_flag(sk, SOCK_ZAPPED);
-
-       if (sock_flag(osk, SOCK_DBG))
-               sock_set_flag(sk, SOCK_DBG);
+       sock_copy_flags(sk, osk);
 
        init_timer(&rose->timer);
        init_timer(&rose->idletimer);
@@ -631,7 +626,8 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        struct rose_sock *rose = rose_sk(sk);
        struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
        struct net_device *dev;
-       ax25_address *user, *source;
+       ax25_address *source;
+       ax25_uid_assoc *user;
        int n;
 
        if (!sock_flag(sk, SOCK_ZAPPED))
@@ -656,14 +652,17 @@ static int rose_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 
        source = &addr->srose_call;
 
-       if ((user = ax25_findbyuid(current->euid)) == NULL) {
+       user = ax25_findbyuid(current->euid);
+       if (user) {
+               rose->source_call = user->call;
+               ax25_uid_put(user);
+       } else {
                if (ax25_uid_policy && !capable(CAP_NET_BIND_SERVICE))
                        return -EACCES;
-               user = source;
+               rose->source_call   = *source;
        }
 
        rose->source_addr   = addr->srose_addr;
-       rose->source_call   = *user;
        rose->device        = dev;
        rose->source_ndigis = addr->srose_ndigis;
 
@@ -690,8 +689,8 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
        struct rose_sock *rose = rose_sk(sk);
        struct sockaddr_rose *addr = (struct sockaddr_rose *)uaddr;
        unsigned char cause, diagnostic;
-       ax25_address *user;
        struct net_device *dev;
+       ax25_uid_assoc *user;
        int n;
 
        if (sk->sk_state == TCP_ESTABLISHED && sock->state == SS_CONNECTING) {
@@ -741,12 +740,14 @@ static int rose_connect(struct socket *sock, struct sockaddr *uaddr, int addr_le
                if ((dev = rose_dev_first()) == NULL)
                        return -ENETUNREACH;
 
-               if ((user = ax25_findbyuid(current->euid)) == NULL)
+               user = ax25_findbyuid(current->euid);
+               if (!user)
                        return -EINVAL;
 
                memcpy(&rose->source_addr, dev->dev_addr, ROSE_ADDR_LEN);
-               rose->source_call = *user;
+               rose->source_call = user->call;
                rose->device      = dev;
+               ax25_uid_put(user);
 
                rose_insert_socket(sk);         /* Finish the bind */
        }

diff --git a/net/rose/rose_route.c b/net/rose/rose_route.c
index ff73ebb912b8ebd0f6887bdb776caa25922d9b5a..46b23217a35309ac60e2ae33d5d054faef5dd1ef 100644 (file)
--- a/net/rose/rose_route.c
+++ b/net/rose/rose_route.c
@@ -994,8 +994,10 @@ int rose_route_frame(struct sk_buff *skb, ax25_cb *ax25)
         *      1. The frame isn't for us,
         *      2. It isn't "owned" by any existing route.
         */
-       if (frametype != ROSE_CALL_REQUEST)     /* XXX */
-               return 0;
+       if (frametype != ROSE_CALL_REQUEST) {   /* XXX */
+               ret = 0;
+               goto out;
+       }
 
        len  = (((skb->data[3] >> 4) & 0x0F) + 1) / 2;
        len += (((skb->data[3] >> 0) & 0x0F) + 1) / 2;

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 8edefd5d095d5019bae647ccc845314de65c5264..0d066c965342e5bbb93bcbe2a80cd4d39653028b 100644 (file)
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -438,6 +438,7 @@ struct Qdisc * qdisc_create_dflt(struct net_device *dev, struct Qdisc_ops *ops)
        if (!ops->init || ops->init(sch, NULL) == 0)
                return sch;
 
+       qdisc_destroy(sch);
 errout:
        return NULL;
 }

diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index 98d49ec9b74b93a4256f430e83838f2e911baf42..b74f7772b576b131b34b25c33fa544d4d6b84c8d 100644 (file)
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -57,6 +57,7 @@ static struct snmp_mib sctp_snmp_list[] = {
        SNMP_MIB_ITEM("SctpReasmUsrMsgs", SCTP_MIB_REASMUSRMSGS),
        SNMP_MIB_ITEM("SctpOutSCTPPacks", SCTP_MIB_OUTSCTPPACKS),
        SNMP_MIB_ITEM("SctpInSCTPPacks", SCTP_MIB_INSCTPPACKS),
+       SNMP_MIB_SENTINEL
 };
 
 /* Return the current value of a particular entry in the mib by adding its

diff --git a/net/sunrpc/auth_gss/gss_krb5_crypto.c b/net/sunrpc/auth_gss/gss_krb5_crypto.c
index 24c21f2a33a7b9bfa53d06de59455f0cca172579..5a7265aeaf839c160ee047d9f319b0763fdefe82 100644 (file)
--- a/net/sunrpc/auth_gss/gss_krb5_crypto.c
+++ b/net/sunrpc/auth_gss/gss_krb5_crypto.c
@@ -185,9 +185,7 @@ make_checksum(s32 cksumtype, char *header, int hdrlen, struct xdr_buf *body,
                        sg->page = body->pages[i];
                        sg->offset = offset;
                        sg->length = thislen;
-                       kmap(sg->page); /* XXX kmap_atomic? */
                        crypto_digest_update(tfm, sg, 1);
-                       kunmap(sg->page);
                        len -= thislen;
                        i++;
                        offset = 0;