Merge bk://kernel.bkbits.net/jmorris/net-2.5

into nuts.ninka.net:/home/davem/src/BK/net-2.5

include/linux/xfrm.h

@@ -203,6 +203,7 @@ struct xfrm_userpolicy_id {
 struct xfrm_user_acquire {
 	struct xfrm_id			id;
 	xfrm_address_t			saddr;
+	struct xfrm_selector		sel;
 	struct xfrm_userpolicy_info	policy;
 	__u32				aalgos;
 	__u32				ealgos;

net/ax25/sysctl_net_ax25.c

@@ -36,7 +36,6 @@ static ctl_table ax25_dir_table[] = {
 	{
 		.ctl_name	= NET_AX25,
 		.procname	= "ax25",
-		.maxlen		= 0,
 		.mode		= 0555,
 	},
 	{ .ctl_name = 0 }
@@ -46,7 +45,6 @@ static ctl_table ax25_root_table[] = {
 	{
 		.ctl_name	= CTL_NET,
 		.procname	= "net",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= ax25_dir_table
 	},

net/ipv6/ip6_output.c

@@ -939,7 +939,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
 	mtu = dst_pmtu(&rt->u.dst) - hlen - sizeof(struct frag_hdr);
 
 	if (skb_shinfo(skb)->frag_list) {
-		int first_len = 0;
+		int first_len = skb_pagelen(skb);
 
 		if (first_len - hlen > mtu ||
 		    ((first_len - hlen) & 7) ||

net/ipv6/sysctl_net_ipv6.c

@@ -86,7 +86,6 @@ static ctl_table ipv6_net_table[] = {
 	{
 		.ctl_name	= NET_IPV6,
 		.procname	= "ipv6",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= ipv6_table
 	},
@@ -97,7 +96,6 @@ static ctl_table ipv6_root_table[] = {
 	{
 		.ctl_name	= CTL_NET,
 		.procname	= "net",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= ipv6_net_table
 	},

net/netrom/sysctl_net_netrom.c

@@ -162,7 +162,6 @@ static ctl_table nr_dir_table[] = {
 	{
 		.ctl_name	= NET_NETROM,
 		.procname	= "netrom",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= nr_table
 	},
@@ -173,7 +172,6 @@ static ctl_table nr_root_table[] = {
 	{
 		.ctl_name	= CTL_NET,
 		.procname	= "net",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= nr_dir_table
 	},

net/rose/sysctl_net_rose.c

@@ -142,7 +142,6 @@ static ctl_table rose_dir_table[] = {
 	{
 		.ctl_name	= NET_ROSE,
 		.procname	= "rose",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= rose_table
 	},
@@ -153,7 +152,6 @@ static ctl_table rose_root_table[] = {
 	{
 		.ctl_name	= CTL_NET,
 		.procname	= "net",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= rose_dir_table
 	},

net/rxrpc/sysctl.c

@@ -68,7 +68,6 @@ static ctl_table rxrpc_dir_sysctl_table[] = {
 	{
 		.ctl_name	= 1,
 		.procname	= "rxrpc",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= rxrpc_sysctl_table
 	},

net/sctp/sysctl.c

@@ -152,7 +152,6 @@ static ctl_table sctp_net_table[] = {
 	{
 		.ctl_name	= NET_SCTP,
 		.procname	= "sctp",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= sctp_table
 	},
@@ -163,7 +162,6 @@ static ctl_table sctp_root_table[] = {
 	{
 		.ctl_name	= CTL_NET,
 		.procname	= "net",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= sctp_net_table
 	},

net/sunrpc/sysctl.c

@@ -155,7 +155,6 @@ static ctl_table sunrpc_table[] = {
 	{
 		.ctl_name	= CTL_SUNRPC,
 		.procname	= "sunrpc",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= debug_table
 	},

net/unix/sysctl_net_unix.c

@@ -30,7 +30,6 @@ static ctl_table unix_net_table[] = {
 	{
 		.ctl_name	= NET_UNIX,
 		.procname	= "unix",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= unix_table
 	},
@@ -41,7 +40,6 @@ static ctl_table unix_root_table[] = {
 	{
 		.ctl_name	= CTL_NET,
 		.procname	= "net",
-		.maxlen		= 0,
 		.mode		= 0555,
 		.child		= unix_net_table
 	},

net/xfrm/xfrm_user.c

@@ -560,7 +560,7 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,
 	}
 }
 
-static int copy_user_tmpl(struct xfrm_policy *pol, struct rtattr **xfrma)
+static int copy_from_user_tmpl(struct xfrm_policy *pol, struct rtattr **xfrma)
 {
 	struct rtattr *rt = xfrma[XFRMA_TMPL-1];
 	struct xfrm_user_tmpl *utmpl;
@@ -616,7 +616,7 @@ static struct xfrm_policy *xfrm_policy_construct(struct xfrm_userpolicy_info *p,
 	}
 
 	copy_from_user_policy(xp, p);
-	err = copy_user_tmpl(xp, xfrma);
+	err = copy_from_user_tmpl(xp, xfrma);
 	if (err) {
 		*errp = err;
 		kfree(xp);
@@ -653,6 +653,38 @@ static int xfrm_add_policy(struct sk_buff *skb, struct nlmsghdr *nlh, void **xfr
 	return 0;
 }
 
+static int copy_to_user_tmpl(struct xfrm_policy *xp, struct sk_buff *skb)
+{
+	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
+	int i;
+
+	if (xp->xfrm_nr == 0)
+		return 0;
+
+	for (i = 0; i < xp->xfrm_nr; i++) {
+		struct xfrm_user_tmpl *up = &vec[i];
+		struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
+
+		memcpy(&up->id, &kp->id, sizeof(up->id));
+		memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
+		up->reqid = kp->reqid;
+		up->mode = kp->mode;
+		up->share = kp->share;
+		up->optional = kp->optional;
+		up->aalgos = kp->aalgos;
+		up->ealgos = kp->ealgos;
+		up->calgos = kp->calgos;
+	}
+	RTA_PUT(skb, XFRMA_TMPL,
+		(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr),
+		vec);
+
+	return 0;
+
+rtattr_failure:
+	return -1;
+}
+
 static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr)
 {
 	struct xfrm_dump_info *sp = ptr;
@@ -672,29 +704,8 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
 	nlh->nlmsg_flags = 0;
 
 	copy_to_user_policy(xp, p, dir);
-
-	if (xp->xfrm_nr) {
-		struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
-		int i;
-
-		for (i = 0; i < xp->xfrm_nr; i++) {
-			struct xfrm_user_tmpl *up = &vec[i];
-			struct xfrm_tmpl *kp = &xp->xfrm_vec[i];
-
-			memcpy(&up->id, &kp->id, sizeof(up->id));
-			memcpy(&up->saddr, &kp->saddr, sizeof(up->saddr));
-			up->reqid = kp->reqid;
-			up->mode = kp->mode;
-			up->share = kp->share;
-			up->optional = kp->optional;
-			up->aalgos = kp->aalgos;
-			up->ealgos = kp->ealgos;
-			up->calgos = kp->calgos;
-		}
-		RTA_PUT(skb, XFRMA_TMPL,
-			(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr),
-			vec);
-	}
+	if (copy_to_user_tmpl(xp, skb) < 0)
+		goto nlmsg_failure;
 
 	nlh->nlmsg_len = skb->tail - b;
 out:
@@ -702,7 +713,6 @@ static int dump_one_policy(struct xfrm_policy *xp, int dir, int count, void *ptr
 	return 0;
 
 nlmsg_failure:
-rtattr_failure:
 	skb_trim(skb, b - skb->data);
 	return -1;
 }
@@ -1011,12 +1021,16 @@ static int build_acquire(struct sk_buff *skb, struct xfrm_state *x,
 
 	memcpy(&ua->id, &x->id, sizeof(ua->id));
 	memcpy(&ua->saddr, &x->props.saddr, sizeof(ua->saddr));
+	memcpy(&ua->sel, &x->sel, sizeof(ua->sel));
 	copy_to_user_policy(xp, &ua->policy, dir);
 	ua->aalgos = xt->aalgos;
 	ua->ealgos = xt->ealgos;
 	ua->calgos = xt->calgos;
 	ua->seq = x->km.seq = seq;
 
+	if (copy_to_user_tmpl(xp, skb) < 0)
+		goto nlmsg_failure;
+
 	nlh->nlmsg_len = skb->tail - b;
 	return skb->len;
 
@@ -1029,8 +1043,12 @@ static int xfrm_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *xt,
 			     struct xfrm_policy *xp, int dir)
 {
 	struct sk_buff *skb;
+	size_t len;
 
-	skb = alloc_skb(sizeof(struct xfrm_user_acquire) + 16, GFP_ATOMIC);
+	len = RTA_LENGTH(sizeof(struct xfrm_user_tmpl) * xp->xfrm_nr);
+	len = RTA_ALIGN(len);
+	len += NLMSG_ALIGN(NLMSG_LENGTH(sizeof(struct xfrm_user_acquire)));
+	skb = alloc_skb(len, GFP_ATOMIC);
 	if (skb == NULL)
 		return -ENOMEM;