Merge bk://kernel.bkbits.net/jgarzik/net-drivers-2.5

into home.transmeta.com:/home/torvalds/v2.5/linux

drivers/net/ppp_async.c

@@ -147,7 +147,6 @@ ppp_asynctty_open(struct tty_struct *tty)
 	struct asyncppp *ap;
 	int err;
 
-	MOD_INC_USE_COUNT;
 	err = -ENOMEM;
 	ap = kmalloc(sizeof(*ap), GFP_KERNEL);
 	if (ap == 0)
@@ -183,7 +182,6 @@ ppp_asynctty_open(struct tty_struct *tty)
  out_free:
 	kfree(ap);
  out:
-	MOD_DEC_USE_COUNT;
 	return err;
 }
 
@@ -223,7 +221,6 @@ ppp_asynctty_close(struct tty_struct *tty)
 	if (ap->tpkt != 0)
 		kfree_skb(ap->tpkt);
 	kfree(ap);
-	MOD_DEC_USE_COUNT;
 }
 
 /*
@@ -351,6 +348,7 @@ ppp_asynctty_wakeup(struct tty_struct *tty)
 
 
 static struct tty_ldisc ppp_ldisc = {
+	.owner  = THIS_MODULE,
 	.magic	= TTY_LDISC_MAGIC,
 	.name	= "ppp",
 	.open	= ppp_asynctty_open,

net/core/flow.c

@@ -388,11 +388,14 @@ static int __init flow_cache_init(void)
 	add_timer(&flow_hash_rnd_timer);
 
 	register_cpu_notifier(&flow_cache_cpu_nb);
-	for (i = 0; i < NR_CPUS; i++)
-		if (cpu_online(i)) {
-			flow_cache_cpu_prepare(i);
-			flow_cache_cpu_online(i);
-		}
+	for (i = 0; i < NR_CPUS; i++) {
+		if (!cpu_online(i))
+			continue;
+		if (flow_cache_cpu_prepare(i) == NOTIFY_OK &&
+		    flow_cache_cpu_online(i) == NOTIFY_OK)
+			continue;
+		panic("NET: failed to initialise flow cache hash table\n");
+	}
 
 	return 0;
 }

net/ipv4/arp.c

@@ -623,15 +623,20 @@ int arp_process(struct sk_buff *skb)
 	int addr_type;
 	struct neighbour *n;
 
-	/* arp_rcv below verifies the ARP header, verifies the device
-	 * is ARP'able, and linearizes the SKB (if needed).
+	/* arp_rcv below verifies the ARP header and verifies the device
+	 * is ARP'able.
 	 */
 
 	if (in_dev == NULL)
 		goto out;
 
+	/* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
+	if (!pskb_may_pull(skb, (sizeof(struct arphdr) +
+				 (2 * dev->addr_len) +
+				 (2 * sizeof(u32)))))
+		goto out;
+
 	arp = skb->nh.arph;
-	arp_ptr= (unsigned char *)(arp+1);
 
 	switch (dev_type) {
 	default:	
@@ -693,6 +698,7 @@ int arp_process(struct sk_buff *skb)
 /*
  *	Extract fields
  */
+	arp_ptr= (unsigned char *)(arp+1);
 	sha	= arp_ptr;
 	arp_ptr += dev->addr_len;
 	memcpy(&sip, arp_ptr, 4);
@@ -841,11 +847,6 @@ int arp_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt)
 	if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL)
 		goto out_of_mem;
 
-	if (skb_is_nonlinear(skb)) {
-		if (skb_linearize(skb, GFP_ATOMIC) != 0)
-			goto freeskb;
-	}
-
 	return NF_HOOK(NF_ARP, NF_ARP_IN, skb, dev, NULL, arp_process);
 
 freeskb:

net/ipv4/netfilter/arp_tables.c

@@ -247,14 +247,16 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
 {
 	static const char nulldevname[IFNAMSIZ] = { 0 };
 	unsigned int verdict = NF_DROP;
-	struct arphdr *arp = (*pskb)->nh.arph;
+	struct arphdr *arp;
 	int hotdrop = 0;
 	struct arpt_entry *e, *back;
 	const char *indev, *outdev;
 	void *table_base;
 
-	/* FIXME: Push down to extensions --RR */
-	if (skb_is_nonlinear(*pskb) && skb_linearize(*pskb, GFP_ATOMIC) != 0)
+	/* ARP header, plus 2 device addresses, plus 2 IP addresses.  */
+	if (!pskb_may_pull((*pskb), (sizeof(struct arphdr) +
+				     (2 * (*pskb)->dev->addr_len) +
+				     (2 * sizeof(u32)))))
 		return NF_DROP;
 
 	indev = in ? in->name : nulldevname;
@@ -267,6 +269,7 @@ unsigned int arpt_do_table(struct sk_buff **pskb,
 	e = get_entry(table_base, table->private->hook_entry[hook]);
 	back = get_entry(table_base, table->private->underflow[hook]);
 
+	arp = (*pskb)->nh.arph;
 	do {
 		if (arp_packet_match(arp, (*pskb)->dev, indev, outdev, &e->arp)) {
 			struct arpt_entry_target *t;

net/ipv6/icmp.c

@@ -613,12 +613,6 @@ static int icmpv6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
 	case NDISC_NEIGHBOUR_SOLICITATION:
 	case NDISC_NEIGHBOUR_ADVERTISEMENT:
 	case NDISC_REDIRECT:
-		if (skb_is_nonlinear(skb) &&
-		    skb_linearize(skb, GFP_ATOMIC) != 0) {
-			kfree_skb(skb);
-			return 0;
-		}
-
 		ndisc_rcv(skb);
 		break;
 

net/ipv6/ndisc.c

@@ -714,12 +714,6 @@ void ndisc_recv_ns(struct sk_buff *skb)
 	struct inet6_ifaddr *ifp;
 	struct neighbour *neigh;
 
-	if (skb->len < sizeof(struct nd_msg)) {
-		if (net_ratelimit())
-			printk(KERN_WARNING "ICMP NS: packet too short\n");
-		return;
-	}
-
 	if (ipv6_addr_type(&msg->target)&IPV6_ADDR_MULTICAST) {
 		if (net_ratelimit())
 			printk(KERN_WARNING "ICMP NS: target address is multicast\n");
@@ -1410,7 +1404,12 @@ static void pndisc_redo(struct sk_buff *skb)
 
 int ndisc_rcv(struct sk_buff *skb)
 {
-	struct nd_msg *msg = (struct nd_msg *) skb->h.raw;
+	struct nd_msg *msg;
+
+	if (!pskb_may_pull(skb, skb->len))
+		return 0;
+
+	msg = (struct nd_msg *) skb->h.raw;
 
 	__skb_push(skb, skb->data-skb->h.raw);