Merge nuts.ninka.net:/home/davem/src/BK/network-2.5

into nuts.ninka.net:/home/davem/src/BK/net-2.5

crypto/deflate.c

@@ -32,6 +32,7 @@
 #include <linux/interrupt.h>
 #include <linux/mm.h>
 #include <linux/net.h>
+#include <linux/slab.h>
 
 #define DEFLATE_DEF_LEVEL		Z_DEFAULT_COMPRESSION
 #define DEFLATE_DEF_WINBITS		11
@@ -181,7 +182,18 @@ static int deflate_decompress(void *ctx, const u8 *src, unsigned int slen,
 	stream->next_out = (u8 *)dst;
 	stream->avail_out = *dlen;
 
-	ret = zlib_inflate(stream, Z_FINISH);
+	ret = zlib_inflate(stream, Z_SYNC_FLUSH);
+	/*
+	 * Work around a bug in zlib, which sometimes wants to taste an extra
+	 * byte when being used in the (undocumented) raw deflate mode.
+	 * (From USAGI).
+	 */
+	if (ret == Z_OK && !stream->avail_in && stream->avail_out) {
+		u8 zerostuff = 0;
+		stream->next_in = &zerostuff;
+		stream->avail_in = 1; 
+		ret = zlib_inflate(stream, Z_FINISH);
+	}
 	if (ret != Z_STREAM_END) {
 		ret = -EINVAL;
 		goto out;

include/net/icmp.h

@@ -39,15 +39,15 @@ DECLARE_SNMP_STAT(struct icmp_mib, icmp_statistics);
 #define ICMP_INC_STATS_FIELD(offt)					\
 	(*((unsigned long *) ((void *)					\
 			     per_cpu_ptr(icmp_statistics[!in_softirq()],\
-					 smp_processor_id())) + offt))++;
+					 smp_processor_id()) + offt)))++
 #define ICMP_INC_STATS_BH_FIELD(offt)					\
 	(*((unsigned long *) ((void *)					\
 			     per_cpu_ptr(icmp_statistics[0],		\
-					 smp_processor_id())) + offt))++;
+					 smp_processor_id()) + offt)))++
 #define ICMP_INC_STATS_USER_FIELD(offt)					\
 	(*((unsigned long *) ((void *)					\
 			     per_cpu_ptr(icmp_statistics[1],		\
-					 smp_processor_id())) + offt))++;
+					 smp_processor_id()) + offt)))++
 
 extern void	icmp_send(struct sk_buff *skb_in,  int type, int code, u32 info);
 extern int	icmp_rcv(struct sk_buff *skb);

net/ipv6/tcp_ipv6.c

@@ -1639,10 +1639,10 @@ static int tcp_v6_rcv(struct sk_buff **pskb)
 	if(sk->state == TCP_TIME_WAIT)
 		goto do_time_wait;
 
-	if (sk_filter(sk, skb, 0))
+	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_and_relse;
 
-	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
+	if (sk_filter(sk, skb, 0))
 		goto discard_and_relse;
 
 	skb->dev = NULL;

net/xfrm/xfrm_state.c

@@ -14,6 +14,7 @@
 #include <net/xfrm.h>
 #include <linux/pfkeyv2.h>
 #include <linux/ipsec.h>
+#include <asm/uaccess.h>
 
 /* Each xfrm_state may be linked to two tables:
 
@@ -176,10 +177,27 @@ static void __xfrm_state_delete(struct xfrm_state *x)
 		spin_unlock(&xfrm_state_lock);
 		if (del_timer(&x->timer))
 			atomic_dec(&x->refcnt);
-		if (atomic_read(&x->refcnt) != 1)
+
+		/* The number two in this test is the reference
+		 * mentioned in the comment below plus the reference
+		 * our caller holds.  A larger value means that
+		 * there are DSTs attached to this xfrm_state.
+		 */
+		if (atomic_read(&x->refcnt) > 2)
 			xfrm_flush_bundles(x);
 	}
 
+	/* All xfrm_state objects are created by one of two possible
+	 * paths:
+	 *
+	 * 1) xfrm_state_alloc --> xfrm_state_insert
+	 * 2) xfrm_state_lookup --> xfrm_state_insert
+	 *
+	 * The xfrm_state_lookup or xfrm_state_alloc call gives a
+	 * reference, and that is what we are dropping here.
+	 */
+	atomic_dec(&x->refcnt);
+
 	if (kill && x->type)
 		x->type->destructor(x);
 	wake_up(&km_waitq);

net/xfrm/xfrm_user.c

@@ -26,6 +26,7 @@
 #include <linux/security.h>
 #include <net/sock.h>
 #include <net/xfrm.h>
+#include <asm/uaccess.h>
 
 static struct sock *xfrm_nl;