Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [IRDA] irda_nl_get_mode: always results in failure
  [PPP]: Fix output buffer size in ppp_decompress_frame().
  [IRDA]: Avoid a label defined but not used warning in irda_init()
  [IPV6]: Fix kernel panic while send SCTP data with IP fragments
  [SNAP]: Check packet length before reading
  [DCCP]: Allocation in atomic context

diff --git a/drivers/net/ppp_generic.c b/drivers/net/ppp_generic.c
index ef3325b692335312f176aa3a86275ffcc5e6bad7..9293c82ef2af24a9e85a7fc6f0d26fc215797f1b 100644 (file)
--- a/drivers/net/ppp_generic.c
+++ b/drivers/net/ppp_generic.c
@@ -1726,7 +1726,7 @@ ppp_decompress_frame(struct ppp *ppp, struct sk_buff *skb)
                }
                /* the decompressor still expects the A/C bytes in the hdr */
                len = ppp->rcomp->decompress(ppp->rc_state, skb->data - 2,
-                               skb->len + 2, ns->data, ppp->mru + PPP_HDRLEN);
+                               skb->len + 2, ns->data, obuff_size);
                if (len < 0) {
                        /* Pass the compressed frame to pppd as an
                           error indication. */

diff --git a/net/802/psnap.c b/net/802/psnap.c
index 04ee43e7538f63af49529b31299747e7dac63f47..31128cb92a23fc9b3eba377b52705671a3c984c7 100644 (file)
--- a/net/802/psnap.c
+++ b/net/802/psnap.c
@@ -55,6 +55,9 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev,
                .type = __constant_htons(ETH_P_SNAP),
        };
 
+       if (unlikely(!pskb_may_pull(skb, 5)))
+               goto drop;
+
        rcu_read_lock();
        proto = find_snap_client(skb_transport_header(skb));
        if (proto) {
@@ -62,14 +65,18 @@ static int snap_rcv(struct sk_buff *skb, struct net_device *dev,
                skb->transport_header += 5;
                skb_pull_rcsum(skb, 5);
                rc = proto->rcvfunc(skb, dev, &snap_packet_type, orig_dev);
-       } else {
-               skb->sk = NULL;
-               kfree_skb(skb);
-               rc = 1;
        }
-
        rcu_read_unlock();
+
+       if (unlikely(!proto))
+               goto drop;
+
+out:
        return rc;
+
+drop:
+       kfree_skb(skb);
+       goto out;
 }
 
 /*

diff --git a/net/dccp/ccids/ccid2.c b/net/dccp/ccids/ccid2.c
index 248d20f4c7c4edb45d94715b244331b760e77775..d29b88fe723cad5f0dc07d7d2158fac7c214c1b5 100644 (file)
--- a/net/dccp/ccids/ccid2.c
+++ b/net/dccp/ccids/ccid2.c
@@ -298,7 +298,7 @@ static void ccid2_hc_tx_packet_sent(struct sock *sk, int more, unsigned int len)
                int rc;
 
                ccid2_pr_debug("allocating more space in history\n");
-               rc = ccid2_hc_tx_alloc_seq(hctx, CCID2_SEQBUF_LEN, GFP_KERNEL);
+               rc = ccid2_hc_tx_alloc_seq(hctx, CCID2_SEQBUF_LEN, gfp_any());
                BUG_ON(rc); /* XXX what do we do? */
 
                next = hctx->ccid2hctx_seqh->ccid2s_next;

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 50d86e94d9ed3358bf8bad71ca36599adea63527..5dead399fe64dc50366ccbe575db02021ff4d076 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -794,7 +794,7 @@ slow_path:
                /*
                 *      Copy a block of the IP datagram.
                 */
-               if (skb_copy_bits(skb, ptr, skb_transport_header(skb), len))
+               if (skb_copy_bits(skb, ptr, skb_transport_header(frag), len))
                        BUG();
                left -= len;
 

diff --git a/net/irda/irmod.c b/net/irda/irmod.c
index 1900937b332871b350e9ae539b417df8c3a1e446..8ba703da2797493be2e007fd23e9ca0a53fb1b11 100644 (file)
--- a/net/irda/irmod.c
+++ b/net/irda/irmod.c
@@ -128,8 +128,8 @@ static int __init irda_init(void)
  out_err_3:
 #ifdef CONFIG_SYSCTL
        irda_sysctl_unregister();
-#endif
  out_err_2:
+#endif
 #ifdef CONFIG_PROC_FS
        irda_proc_unregister();
 #endif

diff --git a/net/irda/irnetlink.c b/net/irda/irnetlink.c
index 694ea4d92fa8bd37924938e180a494dab9701bf6..1e429c92973960fe4be164a62ef4e578f2cdc520 100644 (file)
--- a/net/irda/irnetlink.c
+++ b/net/irda/irnetlink.c
@@ -106,7 +106,7 @@ static int irda_nl_get_mode(struct sk_buff *skb, struct genl_info *info)
        }
 
        if(nla_put_string(msg, IRDA_NL_ATTR_IFNAME,
-                         dev->name));
+                         dev->name))
                goto err_out;
 
        if(nla_put_u32(msg, IRDA_NL_ATTR_MODE, irlap->mode))