Merge nuts.ninka.net:/home/davem/src/BK/network-2.5

into nuts.ninka.net:/home/davem/src/BK/net-2.5

drivers/net/hamachi.c

@@ -1470,64 +1470,6 @@ static void hamachi_interrupt(int irq, void *dev_instance, struct pt_regs *rgs)
 	spin_unlock(&hmp->lock);
 }
 
-#ifdef TX_CHECKSUM
-/*
- * Copied from eth_type_trans(), with reduced header, since we don't
- * get it on RX, only on TX.
- */
-static unsigned short hamachi_eth_type_trans(struct sk_buff *skb,
-  struct net_device *dev)
-{
-	struct ethhdr *eth;
-	unsigned char *rawp;
-	
-	skb->mac.raw=skb->data;
-	skb_pull(skb,dev->hard_header_len-8);  /* artificially enlarged on tx */
-	eth= skb->mac.ethernet;
-	
-	if(*eth->h_dest&1)
-	{
-		if(memcmp(eth->h_dest,dev->broadcast, ETH_ALEN)==0)
-			skb->pkt_type=PACKET_BROADCAST;
-		else
-			skb->pkt_type=PACKET_MULTICAST;
-	}
-	
-	/*
-	 *	This ALLMULTI check should be redundant by 1.4
-	 *	so don't forget to remove it.
-	 *
-	 *	Seems, you forgot to remove it. All silly devices
-	 *	seems to set IFF_PROMISC.
-	 */
-	 
-	else if(dev->flags&(IFF_PROMISC/*|IFF_ALLMULTI*/))
-	{
-		if(memcmp(eth->h_dest,dev->dev_addr, ETH_ALEN))
-			skb->pkt_type=PACKET_OTHERHOST;
-	}
-	
-	if (ntohs(eth->h_proto) >= 1536)
-		return eth->h_proto;
-		
-	rawp = skb->data;
-	
-	/*
-	 *	This is a magic hack to spot IPX packets. Older Novell breaks
-	 *	the protocol design and runs IPX over 802.3 without an 802.2 LLC
-	 *	layer. We look for FFFF which isn't a used 802.2 SSAP/DSAP. This
-	 *	won't work for fault tolerant netware but does for the rest.
-	 */
-	if (*(unsigned short *)rawp == 0xFFFF)
-		return htons(ETH_P_802_3);
-		
-	/*
-	 *	Real 802.2 LLC
-	 */
-	return htons(ETH_P_802_2);
-}
-#endif  /* TX_CHECKSUM */
-
 /* This routine is logically part of the interrupt handler, but seperated
    for clarity and better register allocation. */
 static int hamachi_rx(struct net_device *dev)
@@ -1632,12 +1574,7 @@ static int hamachi_rx(struct net_device *dev)
 				skb_put(skb = hmp->rx_skbuff[entry], pkt_len);
 				hmp->rx_skbuff[entry] = NULL;
 			}
-#ifdef TX_CHECKSUM
-			/* account for extra TX hard_header bytes */
-			skb->protocol = hamachi_eth_type_trans(skb, dev);
-#else
 			skb->protocol = eth_type_trans(skb, dev);
-#endif
 
 
 #ifdef RX_CHECKSUM

include/net/llc_conn.h

@@ -79,7 +79,6 @@ extern int llc_sk_init(struct sock *sk);
 extern int llc_conn_state_process(struct sock *sk, struct sk_buff *skb);
 extern void llc_conn_send_pdu(struct sock *sk, struct sk_buff *skb);
 extern void llc_conn_rtn_pdu(struct sock *sk, struct sk_buff *skb);
-extern void llc_conn_free_ev(struct sk_buff *skb);
 extern void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr,
 					 u8 first_p_bit);
 extern void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr,

include/net/llc_mac.h

@@ -13,8 +13,6 @@
  */
 extern int llc_rcv(struct sk_buff *skb, struct net_device *dev,
 		   struct packet_type *pt);
-extern struct net_device *mac_dev_peer(struct net_device *current_dev,
-				       int type, u8 *mac);
 extern u16 lan_hdrs_init(struct sk_buff *skb, u8 *sa, u8 *da);
 extern int llc_conn_rcv(struct sock *sk, struct sk_buff *skb);
 

net/ethernet/eth.c

@@ -103,16 +103,16 @@ int eth_header(struct sk_buff *skb, struct net_device *dev, unsigned short type,
 	if (dev->flags & (IFF_LOOPBACK|IFF_NOARP)) 
 	{
 		memset(eth->h_dest, 0, dev->addr_len);
-		return(dev->hard_header_len);
+		return ETH_HLEN;
 	}
 	
 	if(daddr)
 	{
 		memcpy(eth->h_dest,daddr,dev->addr_len);
-		return dev->hard_header_len;
+		return ETH_HLEN;
 	}
 	
-	return -dev->hard_header_len;
+	return -ETH_HLEN;
 }
 
 
@@ -161,7 +161,7 @@ unsigned short eth_type_trans(struct sk_buff *skb, struct net_device *dev)
 	unsigned char *rawp;
 	
 	skb->mac.raw=skb->data;
-	skb_pull(skb,dev->hard_header_len);
+	skb_pull(skb,ETH_HLEN);
 	eth= skb->mac.ethernet;
 	
 	if(*eth->h_dest&1)

net/ipv6/mcast.c

@@ -141,14 +141,14 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, struct in6_addr *addr)
 
 	write_lock_bh(&ipv6_sk_mc_lock);
 	for (lnk = &np->ipv6_mc_list; (mc_lst = *lnk) !=NULL ; lnk = &mc_lst->next) {
-		if (mc_lst->ifindex == ifindex &&
+		if ((ifindex == 0 || mc_lst->ifindex == ifindex) &&
 		    ipv6_addr_cmp(&mc_lst->addr, addr) == 0) {
 			struct net_device *dev;
 
 			*lnk = mc_lst->next;
 			write_unlock_bh(&ipv6_sk_mc_lock);
 
-			if ((dev = dev_get_by_index(ifindex)) != NULL) {
+			if ((dev = dev_get_by_index(mc_lst->ifindex)) != NULL) {
 				ipv6_dev_mc_dec(dev, &mc_lst->addr);
 				dev_put(dev);
 			}

net/llc/af_llc.c

@@ -569,6 +569,13 @@ static int llc_ui_wait_for_data(struct sock *sk, int timeout)
 		rc = -EAGAIN;
 		if (!timeout)
 			break;
+		/*
+		 * Well, if we have backlog, try to process it now.
+		 */
+                if (sk->backlog.tail) {
+			release_sock(sk);
+			lock_sock(sk);
+		}
 		rc = 0;
 		if (skb_queue_empty(&sk->receive_queue)) {
 			release_sock(sk);

net/llc/llc_c_ac.c

@@ -1487,7 +1487,7 @@ static void llc_process_tmr_ev(struct sock *sk, struct sk_buff *skb)
 	if (llc_sk(sk)->state == LLC_CONN_OUT_OF_SVC) {
 		printk(KERN_WARNING "%s: timer called on closed connection\n",
 		       __FUNCTION__);
-		llc_conn_free_ev(skb);
+		kfree_skb(skb);
 	} else {
 		if (!sk->lock.users)
 			llc_conn_state_process(sk, skb);

net/llc/llc_conn.c

@@ -71,6 +71,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 	struct llc_opt *llc = llc_sk(sk);
 	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
 
+	/*
+	 * We have to hold the skb, because llc_conn_service will kfree it in
+	 * the sending path and we need to look at the skb->cb, where we encode
+	 * llc_conn_state_ev.
+	 */
+	skb_get(skb);
 	ev->ind_prim = ev->cfm_prim = 0;
 	rc = llc_conn_service(sk, skb); /* sending event to state machine */
 	if (rc) {
@@ -81,10 +87,10 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 	if (!ev->ind_prim && !ev->cfm_prim) {   /* indicate or confirm not required */
 		if (!skb->list)
 			goto out_kfree_skb;
-		goto out;
+		goto out_skb_put;
 	}
 
-	if (ev->ind_prim && ev->cfm_prim)
+	if (ev->ind_prim && ev->cfm_prim) /* Paranoia */
 		skb_get(skb);
 
 	switch (ev->ind_prim) {
@@ -180,11 +186,12 @@ int llc_conn_state_process(struct sock *sk, struct sk_buff *skb)
 					__FUNCTION__, ev->cfm_prim);
 			break;
 		}
-		goto out; /* No confirmation */
+		goto out_skb_put; /* No confirmation */
 	}
 out_kfree_skb:
 	kfree_skb(skb);
-out:
+out_skb_put:
+	kfree_skb(skb);
 	return rc;
 }
 
@@ -226,25 +233,29 @@ void llc_conn_resend_i_pdu_as_cmd(struct sock *sk, u8 nr, u8 first_p_bit)
 	struct sk_buff *skb;
 	struct llc_pdu_sn *pdu;
 	u16 nbr_unack_pdus;
+	struct llc_opt *llc;
 	u8 howmany_resend = 0;
 
 	llc_conn_remove_acked_pdus(sk, nr, &nbr_unack_pdus);
 	if (!nbr_unack_pdus)
 		goto out;
-	/* process unack PDUs only if unack queue is not empty; remove
+	/*
+	 * Process unack PDUs only if unack queue is not empty; remove
 	 * appropriate PDUs, fix them up, and put them on mac_pdu_q.
 	 */
-	while ((skb = skb_dequeue(&llc_sk(sk)->pdu_unack_q)) != NULL) {
-		pdu = (struct llc_pdu_sn *)skb->nh.raw;
+	llc = llc_sk(sk);
+
+	while ((skb = skb_dequeue(&llc->pdu_unack_q)) != NULL) {
+		pdu = llc_pdu_sn_hdr(skb);
 		llc_pdu_set_cmd_rsp(skb, LLC_PDU_CMD);
 		llc_pdu_set_pf_bit(skb, first_p_bit);
 		skb_queue_tail(&sk->write_queue, skb);
 		first_p_bit = 0;
-		llc_sk(sk)->vS = LLC_I_GET_NS(pdu);
+		llc->vS = LLC_I_GET_NS(pdu);
 		howmany_resend++;
 	}
 	if (howmany_resend > 0)
-		llc_sk(sk)->vS = (llc_sk(sk)->vS + 1) % LLC_2_SEQ_NBR_MODULO;
+		llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
 	/* any PDUs to re-send are queued up; start sending to MAC */
 	llc_conn_send_pdus(sk);
 out:;
@@ -263,27 +274,29 @@ out:;
 void llc_conn_resend_i_pdu_as_rsp(struct sock *sk, u8 nr, u8 first_f_bit)
 {
 	struct sk_buff *skb;
-	struct llc_pdu_sn *pdu;
 	u16 nbr_unack_pdus;
+	struct llc_opt *llc = llc_sk(sk);
 	u8 howmany_resend = 0;
 
 	llc_conn_remove_acked_pdus(sk, nr, &nbr_unack_pdus);
 	if (!nbr_unack_pdus)
 		goto out;
-	/* process unack PDUs only if unack queue is not empty; remove
+	/*
+	 * Process unack PDUs only if unack queue is not empty; remove
 	 * appropriate PDUs, fix them up, and put them on mac_pdu_q
 	 */
-	while ((skb = skb_dequeue(&llc_sk(sk)->pdu_unack_q)) != NULL) {
-		pdu = (struct llc_pdu_sn *)skb->nh.raw;
+	while ((skb = skb_dequeue(&llc->pdu_unack_q)) != NULL) {
+		struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
+
 		llc_pdu_set_cmd_rsp(skb, LLC_PDU_RSP);
 		llc_pdu_set_pf_bit(skb, first_f_bit);
 		skb_queue_tail(&sk->write_queue, skb);
 		first_f_bit = 0;
-		llc_sk(sk)->vS = LLC_I_GET_NS(pdu);
+		llc->vS = LLC_I_GET_NS(pdu);
 		howmany_resend++;
 	}
 	if (howmany_resend > 0)
-		llc_sk(sk)->vS = (llc_sk(sk)->vS + 1) % LLC_2_SEQ_NBR_MODULO;
+		llc->vS = (llc->vS + 1) % LLC_2_SEQ_NBR_MODULO;
 	/* any PDUs to re-send are queued up; start sending to MAC */
 	llc_conn_send_pdus(sk);
 out:;
@@ -304,25 +317,26 @@ int llc_conn_remove_acked_pdus(struct sock *sk, u8 nr, u16 *how_many_unacked)
 	struct sk_buff *skb;
 	struct llc_pdu_sn *pdu;
 	int nbr_acked = 0;
-	int q_len = skb_queue_len(&llc_sk(sk)->pdu_unack_q);
+	struct llc_opt *llc = llc_sk(sk);
+	int q_len = skb_queue_len(&llc->pdu_unack_q);
 
 	if (!q_len)
 		goto out;
-	skb = skb_peek(&llc_sk(sk)->pdu_unack_q);
-	pdu = (struct llc_pdu_sn *)skb->nh.raw;
+	skb = skb_peek(&llc->pdu_unack_q);
+	pdu = llc_pdu_sn_hdr(skb);
 
 	/* finding position of last acked pdu in queue */
 	pdu_pos = ((int)LLC_2_SEQ_NBR_MODULO + (int)nr -
 			(int)LLC_I_GET_NS(pdu)) % LLC_2_SEQ_NBR_MODULO;
 
 	for (i = 0; i < pdu_pos && i < q_len; i++) {
-		skb = skb_dequeue(&llc_sk(sk)->pdu_unack_q);
+		skb = skb_dequeue(&llc->pdu_unack_q);
 		if (skb)
 			kfree_skb(skb);
 		nbr_acked++;
 	}
 out:
-	*how_many_unacked = skb_queue_len(&llc_sk(sk)->pdu_unack_q);
+	*how_many_unacked = skb_queue_len(&llc->pdu_unack_q);
 	return nbr_acked;
 }
 
@@ -337,7 +351,7 @@ static void llc_conn_send_pdus(struct sock *sk)
 	struct sk_buff *skb;
 
 	while ((skb = skb_dequeue(&sk->write_queue)) != NULL) {
-		struct llc_pdu_sn *pdu = (struct llc_pdu_sn *)skb->nh.raw;
+		struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
 
 		if (!LLC_PDU_TYPE_IS_I(pdu) &&
 		    !(skb->dev->flags & IFF_LOOPBACK)) {
@@ -352,31 +366,6 @@ static void llc_conn_send_pdus(struct sock *sk)
 	}
 }
 
-/**
- *	llc_conn_free_ev - free event
- *	@skb: event to free
- *
- *	Free allocated event.
- */
-void llc_conn_free_ev(struct sk_buff *skb)
-{
-	struct llc_conn_state_ev *ev = llc_conn_ev(skb);
-
-	if (ev->type == LLC_CONN_EV_TYPE_PDU) {
-		/* free the frame that is bound to this event */
-		struct llc_pdu_sn *pdu = llc_pdu_sn_hdr(skb);
-
-		if (LLC_PDU_TYPE_IS_I(pdu) || !ev->ind_prim)
-			kfree_skb(skb);
-	} else if (ev->type == LLC_CONN_EV_TYPE_PRIM &&
-		   ev->prim != LLC_DATA_PRIM)
-		kfree_skb(skb);
-	else if (ev->type == LLC_CONN_EV_TYPE_P_TMR ||
-		 ev->type == LLC_CONN_EV_TYPE_BUSY_TMR ||
-		 ev->type == LLC_CONN_EV_TYPE_REJ_TMR)
-		kfree_skb(skb);
-}
-
 /**
  *	llc_conn_service - finds transition and changes state of connection
  *	@sk: connection

net/llc/llc_if.c

@@ -26,7 +26,6 @@
 #include <net/llc_c_ac.h>
 #include <net/llc_c_st.h>
 #include <net/llc_main.h>
-#include <net/llc_mac.h>
 
 /**
  *	llc_sap_open - open interface to the upper layers.

net/llc/llc_mac.c

@@ -294,27 +294,3 @@ u16 lan_hdrs_init(struct sk_buff *skb, u8 *sa, u8 *da)
 	}
 	return rc;
 }
-
-/**
- *	mac_dev_peer - search the appropriate dev to send packets to peer
- *	@current_dev - Current device suggested by upper layer
- *	@type - hardware type
- *	@mac - mac address
- *
- *	Check if the we should use loopback to send packets, i.e., if the
- *	dmac belongs to one of the local interfaces, returning the pointer
- *	to the loopback &net_device struct or the current_dev if it is not
- *	local.
- */
-struct net_device *mac_dev_peer(struct net_device *current_dev, int type,
-				u8 *mac)
-{
-	struct net_device *dev;
-
-        rtnl_lock();
-        dev = dev_getbyhwaddr(type, mac);
-        if (dev)
-                dev = __dev_get_by_name("lo");
-        rtnl_unlock();
-	return dev ? : current_dev;
-}

net/llc/llc_main.c

@@ -147,20 +147,22 @@ static int llc_backlog_rcv(struct sock *sk, struct sk_buff *skb)
 		if (llc->state > 1) /* not closed */
 			rc = llc_conn_rcv(sk, skb);
 		else
-			kfree_skb(skb);
+			goto out_kfree_skb;
 	} else if (llc_backlog_type(skb) == LLC_EVENT) {
 		/* timer expiration event */
 		if (llc->state > 1)  /* not closed */
 			rc = llc_conn_state_process(sk, skb);
 		else
-			llc_conn_free_ev(skb);
-		kfree_skb(skb);
+			goto out_kfree_skb;
 	} else {
 		printk(KERN_ERR "%s: invalid skb in backlog\n", __FUNCTION__);
-		kfree_skb(skb);
+		goto out_kfree_skb;
 	}
-
+out:
 	return rc;
+out_kfree_skb:
+	kfree_skb(skb);
+	goto out;
 }
 
 /**

net/llc/llc_pdu.c

@@ -15,7 +15,6 @@
 #include <linux/if_tr.h>
 #include <net/llc_pdu.h>
 #include <net/llc_if.h>
-#include <net/llc_mac.h>
 #include <net/llc_main.h>
 
 static void llc_pdu_decode_pdu_type(struct sk_buff *skb, u8 *type);

net/llc/llc_sap.c

@@ -20,17 +20,9 @@
 #include <net/sock.h>
 #include <linux/tcp.h>
 #include <net/llc_main.h>
-#include <net/llc_mac.h>
 #include <net/llc_pdu.h>
 #include <linux/if_tr.h>
 
-static int llc_sap_next_state(struct llc_sap *sap, struct sk_buff *skb);
-static int llc_exec_sap_trans_actions(struct llc_sap *sap,
-				      struct llc_sap_state_trans *trans,
-				      struct sk_buff *skb);
-static struct llc_sap_state_trans *llc_find_sap_trans(struct llc_sap *sap,
-						      struct sk_buff *skb);
-
 /**
  *	llc_sap_assign_sock - adds a connection to a SAP
  *	@sap: pointer to SAP.
@@ -75,41 +67,6 @@ void llc_sap_unassign_sock(struct llc_sap *sap, struct sock *sk)
 	write_unlock_bh(&sap->sk_list.lock);
 }
 
-/**
- *	llc_sap_state_process - sends event to SAP state machine
- *	@sap: sap to use
- *	@skb: pointer to occurred event
- *
- *	After executing actions of the event, upper layer will be indicated
- *	if needed(on receiving an UI frame). sk can be null for the
- *	datalink_proto case.
- */
-void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
-{
-	struct llc_sap_state_ev *ev = llc_sap_ev(skb);
-
-	/*
-	 * We have to hold the skb, because llc_sap_next_state
-	 * will kfree it in the sending path and we need to
-	 * look at the skb->cb, where we encode llc_sap_state_ev.
-	 */
-	skb_get(skb);
-	ev->ind_cfm_flag = 0;
-	llc_sap_next_state(sap, skb);
-	if (ev->ind_cfm_flag == LLC_IND) {
-		if (skb->sk->state == TCP_LISTEN)
-			kfree_skb(skb);
-		else {
-			llc_save_primitive(skb, ev->prim);
-
-			/* queue skb to the user. */
-			if (sock_queue_rcv_skb(skb->sk, skb))
-				kfree_skb(skb);
-		}
-	} 
-	kfree_skb(skb);
-}
-
 /**
  *	llc_sap_rtn_pdu - Informs upper layer on rx of an UI, XID or TEST pdu.
  *	@sap: pointer to SAP
@@ -117,10 +74,9 @@ void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
  */
 void llc_sap_rtn_pdu(struct llc_sap *sap, struct sk_buff *skb)
 {
-	struct llc_pdu_un *pdu;
 	struct llc_sap_state_ev *ev = llc_sap_ev(skb);
+	struct llc_pdu_un *pdu = llc_pdu_un_hdr(skb);
 
-	pdu = llc_pdu_un_hdr(skb);
 	switch (LLC_U_PDU_RSP(pdu)) {
 	case LLC_1_PDU_CMD_TEST:
 		ev->prim = LLC_TEST_PRIM;	break;
@@ -132,38 +88,6 @@ void llc_sap_rtn_pdu(struct llc_sap *sap, struct sk_buff *skb)
 	ev->ind_cfm_flag = LLC_IND;
 }
 
-/**
- *	llc_sap_next_state - finds transition, execs actions & change SAP state
- *	@sap: pointer to SAP
- *	@skb: happened event
- *
- *	This function finds transition that matches with happened event, then
- *	executes related actions and finally changes state of SAP. It returns
- *	0 on success and 1 for failure.
- */
-static int llc_sap_next_state(struct llc_sap *sap, struct sk_buff *skb)
-{
-	int rc = 1;
-	struct llc_sap_state_trans *trans;
-
-	if (sap->state <= LLC_NR_SAP_STATES) {
-		trans = llc_find_sap_trans(sap, skb);
-		if (trans) {
-			/* got the state to which we next transition; perform
-			 * the actions associated with this transition before
-			 * actually transitioning to the next state
-			 */
-			rc = llc_exec_sap_trans_actions(sap, trans, skb);
-			if (!rc)
-				/* transition SAP to next state if all actions
-				 * execute successfully
-				 */
-				sap->state = trans->next_state;
-		}
-	}
-	return rc;
-}
-
 /**
  *	llc_find_sap_trans - finds transition for event
  *	@sap: pointer to SAP
@@ -180,13 +104,13 @@ static struct llc_sap_state_trans *llc_find_sap_trans(struct llc_sap *sap,
 	struct llc_sap_state_trans *rc = NULL;
 	struct llc_sap_state_trans **next_trans;
 	struct llc_sap_state *curr_state = &llc_sap_state_table[sap->state - 1];
-	/* search thru events for this state until list exhausted or until
+	/*
+	 * Search thru events for this state until list exhausted or until
 	 * its obvious the event is not valid for the current state
 	 */
 	for (next_trans = curr_state->transitions; next_trans[i]->ev; i++)
 		if (!next_trans[i]->ev(sap, skb)) {
-			/* got event match; return it */
-			rc = next_trans[i];
+			rc = next_trans[i]; /* got event match; return it */
 			break;
 		}
 	return rc;
@@ -213,3 +137,73 @@ static int llc_exec_sap_trans_actions(struct llc_sap *sap,
 			rc = 1;
 	return rc;
 }
+
+/**
+ *	llc_sap_next_state - finds transition, execs actions & change SAP state
+ *	@sap: pointer to SAP
+ *	@skb: happened event
+ *
+ *	This function finds transition that matches with happened event, then
+ *	executes related actions and finally changes state of SAP. It returns
+ *	0 on success and 1 for failure.
+ */
+static int llc_sap_next_state(struct llc_sap *sap, struct sk_buff *skb)
+{
+	int rc = 1;
+	struct llc_sap_state_trans *trans;
+
+	if (sap->state > LLC_NR_SAP_STATES)
+		goto out;
+	trans = llc_find_sap_trans(sap, skb);
+	if (!trans)
+		goto out;
+	/*
+	 * Got the state to which we next transition; perform the actions
+	 * associated with this transition before actually transitioning to the
+	 * next state
+	 */
+	rc = llc_exec_sap_trans_actions(sap, trans, skb);
+	if (rc)
+		goto out;
+	/*
+	 * Transition SAP to next state if all actions execute successfully
+	 */
+	sap->state = trans->next_state;
+out:
+	return rc;
+}
+
+/**
+ *	llc_sap_state_process - sends event to SAP state machine
+ *	@sap: sap to use
+ *	@skb: pointer to occurred event
+ *
+ *	After executing actions of the event, upper layer will be indicated
+ *	if needed(on receiving an UI frame). sk can be null for the
+ *	datalink_proto case.
+ */
+void llc_sap_state_process(struct llc_sap *sap, struct sk_buff *skb)
+{
+	struct llc_sap_state_ev *ev = llc_sap_ev(skb);
+
+	/*
+	 * We have to hold the skb, because llc_sap_next_state
+	 * will kfree it in the sending path and we need to
+	 * look at the skb->cb, where we encode llc_sap_state_ev.
+	 */
+	skb_get(skb);
+	ev->ind_cfm_flag = 0;
+	llc_sap_next_state(sap, skb);
+	if (ev->ind_cfm_flag == LLC_IND) {
+		if (skb->sk->state == TCP_LISTEN)
+			kfree_skb(skb);
+		else {
+			llc_save_primitive(skb, ev->prim);
+
+			/* queue skb to the user. */
+			if (sock_queue_rcv_skb(skb->sk, skb))
+				kfree_skb(skb);
+		}
+	} 
+	kfree_skb(skb);
+}

net/sctp/protocol.c

@@ -119,8 +119,7 @@ static inline void sctp_v4_get_local_addr_list(sctp_protocol_t *proto,
 
 	for (ifa = in_dev->ifa_list; ifa; ifa = ifa->ifa_next) {
 		/* Add the address to the local list.  */
-		/* XXX BUG: sleeping allocation with lock held -DaveM */
-		addr = t_new(struct sockaddr_storage_list, GFP_KERNEL);
+		addr = t_new(struct sockaddr_storage_list, GFP_ATOMIC);
 		if (addr) {
 			INIT_LIST_HEAD(&addr->list);
 			addr->a.v4.sin_family = AF_INET;
@@ -157,8 +156,7 @@ static inline void sctp_v6_get_local_addr_list(sctp_protocol_t *proto,
 	read_lock_bh(&in6_dev->lock);
 	for (ifp = in6_dev->addr_list; ifp; ifp = ifp->if_next) {
 		/* Add the address to the local list.  */
-		/* XXX BUG: sleeping allocation with lock held -DaveM */
-		addr = t_new(struct sockaddr_storage_list, GFP_KERNEL);
+		addr = t_new(struct sockaddr_storage_list, GFP_ATOMIC);
 		if (addr) {
 			addr->a.v6.sin6_family = AF_INET6;
 			addr->a.v6.sin6_port = 0;