Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [ISDN]: Static overruns in drivers/isdn/i4l/isdn_ppp.c
  [WAN]: Remove broken and unmaintained Sangoma drivers.
  [BRIDGE] ebtables: fix allocation in net/bridge/netfilter/ebtables.c
  [DCCP]: Fix leak in net/dccp/ipv4.c
  [BRIDGE]: receive link-local on disabled ports.
  [IPv6] reassembly: Always compute hash under the fragment lock.

MAINTAINERS

@@ -3058,13 +3058,6 @@ M:	khali@linux-fr.org
 L:	lm-sensors@lm-sensors.org
 S:	Odd Fixes
 
-WAN ROUTER & SANGOMA WANPIPE DRIVERS & API (X.25, FRAME RELAY, PPP, CISCO HDLC)
-P:	Nenad Corbic
-M:	ncorbic@sangoma.com
-M:	dm@sangoma.com
-W:	http://www.sangoma.com
-S:	Supported
-
 WATCHDOG DEVICE DRIVERS
 P:	Wim Van Sebroeck
 M:	wim@iguana.be

drivers/isdn/i4l/isdn_ppp.c

@@ -109,7 +109,7 @@ isdn_ppp_free(isdn_net_local * lp)
 {
 	struct ippp_struct *is;
 
-	if (lp->ppp_slot < 0 || lp->ppp_slot > ISDN_MAX_CHANNELS) {
+	if (lp->ppp_slot < 0 || lp->ppp_slot >= ISDN_MAX_CHANNELS) {
 		printk(KERN_ERR "%s: ppp_slot(%d) out of range\n",
 			__FUNCTION__, lp->ppp_slot);
 		return 0;
@@ -126,7 +126,7 @@ isdn_ppp_free(isdn_net_local * lp)
 	lp->netdev->pb->ref_ct--;
 	spin_unlock(&lp->netdev->pb->lock);
 #endif /* CONFIG_ISDN_MPP */
-	if (lp->ppp_slot < 0 || lp->ppp_slot > ISDN_MAX_CHANNELS) {
+	if (lp->ppp_slot < 0 || lp->ppp_slot >= ISDN_MAX_CHANNELS) {
 		printk(KERN_ERR "%s: ppp_slot(%d) now invalid\n",
 			__FUNCTION__, lp->ppp_slot);
 		return 0;
@@ -279,7 +279,7 @@ isdn_ppp_open(int min, struct file *file)
 	int slot;
 	struct ippp_struct *is;
 
-	if (min < 0 || min > ISDN_MAX_CHANNELS)
+	if (min < 0 || min >= ISDN_MAX_CHANNELS)
 		return -ENODEV;
 
 	slot = isdn_ppp_get_slot();
@@ -1042,7 +1042,7 @@ isdn_ppp_push_higher(isdn_net_dev * net_dev, isdn_net_local * lp, struct sk_buff
  	if (lp->master) { // FIXME?
 		mlp = (isdn_net_local *) lp->master->priv;
  		slot = mlp->ppp_slot;
- 		if (slot < 0 || slot > ISDN_MAX_CHANNELS) {
+ 		if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
  			printk(KERN_ERR "isdn_ppp_push_higher: master->ppp_slot(%d)\n",
  				lp->ppp_slot);
 			goto drop_packet;
@@ -1264,7 +1264,7 @@ isdn_ppp_xmit(struct sk_buff *skb, struct net_device *netdev)
 	/* we have our lp locked from now on */
 
 	slot = lp->ppp_slot;
-	if (slot < 0 || slot > ISDN_MAX_CHANNELS) {
+	if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
 		printk(KERN_ERR "isdn_ppp_xmit: lp->ppp_slot(%d)\n",
 			lp->ppp_slot);
 		kfree_skb(skb);
@@ -1603,7 +1603,7 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
     	mp = net_dev->pb;
         stats = &mp->stats;
 	slot = lp->ppp_slot;
-	if (slot < 0 || slot > ISDN_MAX_CHANNELS) {
+	if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
 		printk(KERN_ERR "%s: lp->ppp_slot(%d)\n",
 			__FUNCTION__, lp->ppp_slot);
 		stats->frame_drops++;
@@ -1640,7 +1640,7 @@ static void isdn_ppp_mp_receive(isdn_net_dev * net_dev, isdn_net_local * lp,
 	is->last_link_seqno = minseq = newseq;
 	for (lpq = net_dev->queue;;) {
 		slot = lpq->ppp_slot;
-		if (slot < 0 || slot > ISDN_MAX_CHANNELS) {
+		if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
 			printk(KERN_ERR "%s: lpq->ppp_slot(%d)\n",
 				__FUNCTION__, lpq->ppp_slot);
 		} else {
@@ -2648,7 +2648,7 @@ static void isdn_ppp_receive_ccp(isdn_net_dev *net_dev, isdn_net_local *lp,
 
 	printk(KERN_DEBUG "Received CCP frame from peer slot(%d)\n",
 		lp->ppp_slot);
-	if (lp->ppp_slot < 0 || lp->ppp_slot > ISDN_MAX_CHANNELS) {
+	if (lp->ppp_slot < 0 || lp->ppp_slot >= ISDN_MAX_CHANNELS) {
 		printk(KERN_ERR "%s: lp->ppp_slot(%d) out of range\n",
 			__FUNCTION__, lp->ppp_slot);
 		return;
@@ -2658,7 +2658,7 @@ static void isdn_ppp_receive_ccp(isdn_net_dev *net_dev, isdn_net_local *lp,
 
 	if(lp->master) {
 		int slot = ((isdn_net_local *) (lp->master->priv))->ppp_slot;
-		if (slot < 0 || slot > ISDN_MAX_CHANNELS) {
+		if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
 			printk(KERN_ERR "%s: slot(%d) out of range\n",
 				__FUNCTION__, slot);
 			return;
@@ -2845,7 +2845,7 @@ static void isdn_ppp_send_ccp(isdn_net_dev *net_dev, isdn_net_local *lp, struct
 
 	if (lp->master) {
 		slot = ((isdn_net_local *) (lp->master->priv))->ppp_slot;
-		if (slot < 0 || slot > ISDN_MAX_CHANNELS) {
+		if (slot < 0 || slot >= ISDN_MAX_CHANNELS) {
 			printk(KERN_ERR "%s: slot(%d) out of range\n",
 				__FUNCTION__, slot);
 			return;

drivers/net/wan/Kconfig

@@ -410,103 +410,6 @@ config WAN_ROUTER_DRIVERS
 
 	  If unsure, say N.
 
-config VENDOR_SANGOMA
-	tristate "Sangoma WANPIPE(tm) multiprotocol cards"
-	depends on WAN_ROUTER_DRIVERS && WAN_ROUTER && (PCI || ISA) && BROKEN
-	---help---
-	  Driver for S514-PCI/ISA Synchronous Data Link Adapters (SDLA).
-
-	  WANPIPE from Sangoma Technologies Inc. <http://www.sangoma.com/>
-	  is a family of intelligent multiprotocol WAN adapters with data
-	  transfer rates up to 4Mbps. Cards support:
-
-	  - X.25, Frame Relay, PPP, Cisco HDLC protocols.
-
-	  - API for protocols like HDLC (LAPB), HDLC Streaming, X.25,
-	  Frame Relay and BiSync.
-
-	  - Ethernet Bridging over Frame Relay protocol.
-
-	  - MULTILINK PPP
-
-	  - Async PPP (Modem Dialup)
-
-	  The next questions will ask you about the protocols you want
-	  the driver to support.
-
-	  If you have one or more of these cards, say M to this option;
-	  and read <file:Documentation/networking/wan-router.txt>.
-
-	  To compile this driver as a module, choose M here: the
-	  module will be called wanpipe.
-
-config WANPIPE_CHDLC
-	bool "WANPIPE Cisco HDLC support"
-	depends on VENDOR_SANGOMA
-	---help---
-	  Connect a WANPIPE card to a leased line using the Cisco HDLC.
-
-	  - Supports Dual Port Cisco HDLC on the S514-PCI/S508-ISA cards
-	  which allows user to build applications using the HDLC streaming API.
-
-	  - CHDLC Streaming MULTILINK PPP that can bind multiple WANPIPE T1
-	  cards into a single logical channel.
-
-	  Say Y and the Cisco HDLC support, HDLC streaming API and
-	  MULTILINK PPP will be included in the driver.
-
-config WANPIPE_FR
-	bool "WANPIPE Frame Relay support"
-	depends on VENDOR_SANGOMA
-	help
-	  Connect a WANPIPE card to a Frame Relay network, or use Frame Relay
-	  API to develop custom applications.
-
-	  Contains the Ethernet Bridging over Frame Relay feature, where
-	  a WANPIPE frame relay link can be directly connected to the Linux
-	  kernel bridge. The Frame Relay option is supported on S514-PCI
-	  and S508-ISA cards.
-
-	  Say Y and the Frame Relay support will be included in the driver.
-
-config WANPIPE_X25
-	bool "WANPIPE X.25 support"
-	depends on VENDOR_SANGOMA
-	help
-	  Connect a WANPIPE card to an X.25 network.
-
-	  Includes the X.25 API support for custom applications over the
-	  X.25 protocol. The X.25 option is supported on S514-PCI and
-	  S508-ISA cards.
-
-	  Say Y and the X.25 support will be included in the driver.
-
-config WANPIPE_PPP
-	bool "WANPIPE PPP support"
-	depends on VENDOR_SANGOMA
-	help
-	  Connect a WANPIPE card to a leased line using Point-to-Point
-	  Protocol (PPP).
-
-	  The PPP option is supported on S514-PCI/S508-ISA cards.
-
-	  Say Y and the PPP support will be included in the driver.
-
-config WANPIPE_MULTPPP
-	bool "WANPIPE Multi-Port PPP support"
-	depends on VENDOR_SANGOMA
-	help
-	  Connect a WANPIPE card to a leased line using Point-to-Point
-	  Protocol (PPP).
-
-	  Uses in-kernel SyncPPP protocol over the Sangoma HDLC Streaming
-	  adapter. In this case each Sangoma adapter port can support an
-	  independent PPP connection. For example, a single Quad-Port PCI
-	  adapter can support up to four independent PPP links. The PPP
-	  option is supported on S514-PCI/S508-ISA cards.
-
-	  Say Y and the Multi-Port PPP support will be included in the driver.
-
 config CYCLADES_SYNC
 	tristate "Cyclom 2X(tm) cards (EXPERIMENTAL)"
 	depends on WAN_ROUTER_DRIVERS && (PCI || ISA)

drivers/net/wan/Makefile

@@ -5,14 +5,6 @@
 # Rewritten to use lists instead of if-statements.
 #
 
-wanpipe-y			:= sdlamain.o sdla_ft1.o
-wanpipe-$(CONFIG_WANPIPE_X25)	+= sdla_x25.o
-wanpipe-$(CONFIG_WANPIPE_FR)	+= sdla_fr.o
-wanpipe-$(CONFIG_WANPIPE_CHDLC)	+= sdla_chdlc.o
-wanpipe-$(CONFIG_WANPIPE_PPP)	+= sdla_ppp.o
-wanpipe-$(CONFIG_WANPIPE_MULTPPP) += wanpipe_multppp.o
-wanpipe-objs			:= $(wanpipe-y)
-
 cyclomx-y                       := cycx_main.o
 cyclomx-$(CONFIG_CYCLOMX_X25)	+= cycx_x25.o
 cyclomx-objs			:= $(cyclomx-y)  
@@ -43,11 +35,6 @@ obj-$(CONFIG_LANMEDIA)		+= lmc/
 
 obj-$(CONFIG_DLCI)		+= dlci.o 
 obj-$(CONFIG_SDLA)		+= sdla.o
-ifeq ($(CONFIG_WANPIPE_MULTPPP),y)
-  obj-$(CONFIG_VENDOR_SANGOMA) += sdladrv.o wanpipe.o syncppp.o	
-else
-  obj-$(CONFIG_VENDOR_SANGOMA) += sdladrv.o wanpipe.o
-endif
 obj-$(CONFIG_CYCLADES_SYNC)	+= cycx_drv.o cyclomx.o
 obj-$(CONFIG_LAPBETHER)		+= lapbether.o
 obj-$(CONFIG_SBNI)		+= sbni.o

include/linux/sdladrv.h

-/*****************************************************************************
-* sdladrv.h	SDLA Support Module.  Kernel API Definitions.
-*
-* Author: 	Gideon Hack	
-*
-* Copyright:	(c) 1995-2000 Sangoma Technologies Inc.
-*
-*		This program is free software; you can redistribute it and/or
-*		modify it under the terms of the GNU General Public License
-*		as published by the Free Software Foundation; either version
-*		2 of the License, or (at your option) any later version.
-* ============================================================================
-* Jun 02, 1999 	Gideon Hack	Added support for the S514 PCI adapter.
-* Dec 11, 1996	Gene Kozin	Complete overhaul.
-* Oct 17, 1996	Gene Kozin	Minor bug fixes.
-* Jun 12, 1996	Gene Kozin 	Added support for S503 card.
-* Dec 06, 1995	Gene Kozin	Initial version.
-*****************************************************************************/
-#ifndef	_SDLADRV_H
-#define	_SDLADRV_H
-
-
-#define	SDLA_MAXIORANGE	4	/* maximum I/O port range */
-#define	SDLA_WINDOWSIZE	0x2000	/* default dual-port memory window size */
-/****** Data Structures *****************************************************/
-
-/*----------------------------------------------------------------------------
- * Adapter hardware configuration. Pointer to this structure is passed to all
- * APIs.
- */
-typedef struct sdlahw
-{
-	unsigned type;			/* adapter type */
-	unsigned fwid;			/* firmware ID */
-	unsigned port;			/* adapter I/O port base */
-	int irq;			/* interrupt request level */
-	char S514_cpu_no[1];		/* PCI CPU Number */
-	unsigned char S514_slot_no;	/* PCI Slot Number */
-	char auto_pci_cfg;		/* Autodetect PCI Slot */
-	struct pci_dev *pci_dev;	/* PCI device */
-	void * dpmbase;			/* dual-port memory base */
-	unsigned dpmsize;		/* dual-port memory size */
-	unsigned pclk;			/* CPU clock rate, kHz */
-	unsigned long memory;		/* memory size */
-	unsigned long vector;		/* local offset of the DPM window */
-	unsigned io_range;		/* I/O port range */
-	unsigned char regs[SDLA_MAXIORANGE]; /* was written to registers */
-	unsigned reserved[5];
-} sdlahw_t;
-
-/****** Function Prototypes *************************************************/
-
-extern int sdla_setup	(sdlahw_t* hw, void* sfm, unsigned len);
-extern int sdla_down	(sdlahw_t* hw);
-extern void S514_intack  (sdlahw_t* hw, u32 int_status);
-extern void read_S514_int_stat (sdlahw_t* hw, u32* int_status);
-extern int sdla_mapmem	(sdlahw_t* hw, unsigned long addr);
-extern int sdla_peek	(sdlahw_t* hw, unsigned long addr, void* buf,
-			 unsigned len);
-extern int sdla_poke	(sdlahw_t* hw, unsigned long addr, void* buf,
-			 unsigned len);
-extern int sdla_exec	(void* opflag);
-
-extern unsigned wanpipe_hw_probe(void);
-
-#endif	/* _SDLADRV_H */

include/linux/sdlapci.h

-/*****************************************************************************
-* sdlapci.h	WANPIPE(tm) Multiprotocol WAN Link Driver.
-*		Definitions for the SDLA PCI adapter.
-*
-* Author:	Gideon Hack	<ghack@sangoma.com>
-*
-* Copyright:	(c) 1999-2000 Sangoma Technologies Inc.
-*
-*		This program is free software; you can redistribute it and/or
-*		modify it under the terms of the GNU General Public License
-*		as published by the Free Software Foundation; either version
-*		2 of the License, or (at your option) any later version.
-* ============================================================================
-* Jun 02, 1999	Gideon Hack	Initial version.
-*****************************************************************************/
-#ifndef	_SDLAPCI_H
-#define	_SDLAPCI_H
-
-/****** Defines *************************************************************/
-
-/* Definitions for identifying and finding S514 PCI adapters */
-#define V3_VENDOR_ID		0x11B0		/* V3 vendor ID number */
-#define V3_DEVICE_ID  		0x0002		/* V3 device ID number */
-#define SANGOMA_SUBSYS_VENDOR 	0x4753		/* ID for Sangoma */
-#define PCI_DEV_SLOT_MASK	0x1F		/* mask for slot numbering */
-#define PCI_IRQ_NOT_ALLOCATED	0xFF		/* interrupt line for no IRQ */
-
-/* Local PCI register offsets */ 
-#define PCI_VENDOR_ID_WORD	0x00		/* vendor ID */
-#define PCI_IO_BASE_DWORD	0x10		/* IO base */	
-#define PCI_MEM_BASE0_DWORD	0x14		/* memory base - apperture 0 */
-#define PCI_MEM_BASE1_DWORD     0x18		/* memory base - apperture 1 */
-#define PCI_SUBSYS_VENDOR_WORD 	0x2C		/* subsystem vendor ID */
-#define PCI_INT_LINE_BYTE	0x3C		/* interrupt line */
-#define PCI_INT_PIN_BYTE	0x3D		/* interrupt pin */
-#define PCI_MAP0_DWORD		0x40		/* PCI to local bus address 0 */
-#define PCI_MAP1_DWORD          0x44		/* PCI to local bus address 1 */
-#define PCI_INT_STATUS          0x48		/* interrupt status */
-#define PCI_INT_CONFIG		0x4C		/* interrupt configuration */
-  
-/* Local PCI register usage */
-#define PCI_MEMORY_ENABLE	0x00000003	/* enable PCI memory */
-#define PCI_CPU_A_MEM_DISABLE	0x00000002	/* disable CPU A memory */
-#define PCI_CPU_B_MEM_DISABLE  	0x00100002	/* disable CPU B memory */
-#define PCI_ENABLE_IRQ_CPU_A	0x005A0004	/* enable IRQ for CPU A */
-#define PCI_ENABLE_IRQ_CPU_B    0x005A0008	/* enable IRQ for CPU B */
-#define PCI_DISABLE_IRQ_CPU_A   0x00000004	/* disable IRQ for CPU A */
-#define PCI_DISABLE_IRQ_CPU_B   0x00000008	/* disable IRQ for CPU B */
- 
-/* Setting for the Interrupt Status register */  
-#define IRQ_CPU_A               0x04            /* IRQ for CPU A */
-#define IRQ_CPU_B               0x08		/* IRQ for CPU B */
-
-/* The maximum size of the S514 memory */
-#define MAX_SIZEOF_S514_MEMORY	(256 * 1024)
-
-/* S514 control register offsets within the memory address space */
-#define S514_CTRL_REG_BYTE	0x80000
- 
-/* S514 adapter control bytes */
-#define S514_CPU_HALT 		0x00
-#define S514_CPU_START		0x01
-
-/* The maximum number of S514 adapters supported */
-#define MAX_S514_CARDS		20	
-
-#define PCI_CARD_TYPE		0x2E
-#define S514_DUAL_CPU		0x12
-#define S514_SINGLE_CPU		0x11
-
-#endif	/* _SDLAPCI_H */
-

include/linux/sdlasfm.h

-/*****************************************************************************
-* sdlasfm.h	WANPIPE(tm) Multiprotocol WAN Link Driver.
-*		Definitions for the SDLA Firmware Module (SFM).
-*
-* Author: 	Gideon Hack 	
-*
-* Copyright:	(c) 1995-1999 Sangoma Technologies Inc.
-*
-*		This program is free software; you can redistribute it and/or
-*		modify it under the terms of the GNU General Public License
-*		as published by the Free Software Foundation; either version
-*		2 of the License, or (at your option) any later version.
-* ============================================================================
-* Jun 02, 1999  Gideon Hack	Added support for the S514 adapter.
-* Dec 11, 1996	Gene Kozin	Cosmetic changes
-* Apr 16, 1996	Gene Kozin	Changed adapter & firmware IDs. Version 2
-* Dec 15, 1995	Gene Kozin	Structures chaned
-* Nov 09, 1995	Gene Kozin	Initial version.
-*****************************************************************************/
-#ifndef	_SDLASFM_H
-#define	_SDLASFM_H
-
-/****** Defines *************************************************************/
-
-#define	SFM_VERSION	2
-#define	SFM_SIGNATURE	"SFM - Sangoma SDLA Firmware Module"
-
-/* min/max */
-#define	SFM_IMAGE_SIZE	0x8000	/* max size of SDLA code image file */
-#define	SFM_DESCR_LEN	256	/* max length of description string */
-#define	SFM_MAX_SDLA	16	/* max number of compatible adapters */
-
-/* Adapter types */
-#define SDLA_S502A	5020
-#define SDLA_S502E	5021
-#define SDLA_S503	5030
-#define SDLA_S508	5080
-#define SDLA_S507	5070
-#define SDLA_S509	5090
-#define SDLA_S514	5140
-
-/* S514 PCI adapter CPU numbers */
-#define S514_CPU_A	'A'
-#define S514_CPU_B	'B'
-
-
-/* Firmware identification numbers:
- *    0  ..  999	Test & Diagnostics
- *  1000 .. 1999	Streaming HDLC
- *  2000 .. 2999	Bisync
- *  3000 .. 3999	SDLC
- *  4000 .. 4999	HDLC
- *  5000 .. 5999	X.25
- *  6000 .. 6999	Frame Relay
- *  7000 .. 7999	PPP
- *  8000 .. 8999        Cisco HDLC
- */
-#define	SFID_CALIB502	 200
-#define	SFID_STRM502	1200
-#define	SFID_STRM508	1800
-#define	SFID_BSC502	2200
-#define	SFID_SDLC502	3200
-#define	SFID_HDLC502	4200
-#define	SFID_HDLC508	4800
-#define	SFID_X25_502	5200
-#define	SFID_X25_508	5800
-#define	SFID_FR502	6200
-#define	SFID_FR508	6800
-#define	SFID_PPP502	7200
-#define	SFID_PPP508	7800
-#define SFID_PPP514	7140
-#define	SFID_CHDLC508	8800
-#define SFID_CHDLC514	8140
-
-/****** Data Types **********************************************************/
-
-typedef struct	sfm_info		/* firmware module information */
-{
-	unsigned short	codeid;		/* firmware ID */
-	unsigned short	version;	/* firmaware version number */
-	unsigned short	adapter[SFM_MAX_SDLA]; /* compatible adapter types */
-	unsigned long	memsize;	/* minimum memory size */
-	unsigned short	reserved[2];	/* reserved */
-	unsigned short	startoffs;	/* entry point offset */
-	unsigned short	winoffs;	/* dual-port memory window offset */
-	unsigned short	codeoffs;	/* code load offset */
-	unsigned short	codesize;	/* code size */
-	unsigned short	dataoffs;	/* configuration data load offset */
-	unsigned short	datasize;	/* configuration data size */
-} sfm_info_t;
-
-typedef struct sfm			/* SDLA firmware file structire */
-{
-	char		signature[80];	/* SFM file signature */
-	unsigned short	version;	/* file format version */
-	unsigned short	checksum;	/* info + image */
-	unsigned short	reserved[6];	/* reserved */
-	char		descr[SFM_DESCR_LEN]; /* description string */
-	sfm_info_t	info;		/* firmware module info */
-	unsigned char	image[1];	/* code image (variable size) */
-} sfm_t;
-
-#endif	/* _SDLASFM_H */
-

net/bridge/br_input.c

@@ -125,9 +125,6 @@ int br_handle_frame(struct net_bridge_port *p, struct sk_buff **pskb)
 	struct sk_buff *skb = *pskb;
 	const unsigned char *dest = eth_hdr(skb)->h_dest;
 
-	if (p->state == BR_STATE_DISABLED)
-		goto err;
-
 	if (!is_valid_ether_addr(eth_hdr(skb)->h_source))
 		goto err;
 

net/bridge/netfilter/ebtables.c

@@ -824,9 +824,9 @@ static int translate_table(struct ebt_replace *repl,
 	if (udc_cnt) {
 		/* this will get free'd in do_replace()/ebt_register_table()
 		   if an error occurs */
-		newinfo->chainstack = (struct ebt_chainstack **)
+		newinfo->chainstack =
 			vmalloc((highest_possible_processor_id()+1)
-				   		* sizeof(struct ebt_chainstack));
+				   	* sizeof(*(newinfo->chainstack)));
 		if (!newinfo->chainstack)
 			return -ENOMEM;
 		for_each_possible_cpu(i) {

net/dccp/ipv4.c

@@ -498,7 +498,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
 		goto drop;
 
 	if (dccp_parse_options(sk, skb))
-		goto drop;
+		goto drop_and_free;
 
 	dccp_openreq_init(req, &dp, skb);
 

net/ipv6/reassembly.c

@@ -121,6 +121,10 @@ static __inline__ void fq_unlink(struct frag_queue *fq)
 	write_unlock(&ip6_frag_lock);
 }
 
+/*
+ * callers should be careful not to use the hash value outside the ipfrag_lock
+ * as doing so could race with ipfrag_hash_rnd being recalculated.
+ */
 static unsigned int ip6qhashfn(u32 id, struct in6_addr *saddr,
 			       struct in6_addr *daddr)
 {
@@ -324,15 +328,16 @@ static void ip6_frag_expire(unsigned long data)
 /* Creation primitives. */
 
 
-static struct frag_queue *ip6_frag_intern(unsigned int hash,
-					  struct frag_queue *fq_in)
+static struct frag_queue *ip6_frag_intern(struct frag_queue *fq_in)
 {
 	struct frag_queue *fq;
+	unsigned int hash;
 #ifdef CONFIG_SMP
 	struct hlist_node *n;
 #endif
 
 	write_lock(&ip6_frag_lock);
+	hash = ip6qhashfn(fq_in->id, &fq_in->saddr, &fq_in->daddr);
 #ifdef CONFIG_SMP
 	hlist_for_each_entry(fq, n, &ip6_frag_hash[hash], list) {
 		if (fq->id == fq_in->id && 
@@ -362,7 +367,7 @@ static struct frag_queue *ip6_frag_intern(unsigned int hash,
 
 
 static struct frag_queue *
-ip6_frag_create(unsigned int hash, u32 id, struct in6_addr *src, struct in6_addr *dst)
+ip6_frag_create(u32 id, struct in6_addr *src, struct in6_addr *dst)
 {
 	struct frag_queue *fq;
 
@@ -379,7 +384,7 @@ ip6_frag_create(unsigned int hash, u32 id, struct in6_addr *src, struct in6_addr
 	spin_lock_init(&fq->lock);
 	atomic_set(&fq->refcnt, 1);
 
-	return ip6_frag_intern(hash, fq);
+	return ip6_frag_intern(fq);
 
 oom:
 	IP6_INC_STATS_BH(IPSTATS_MIB_REASMFAILS);
@@ -391,9 +396,10 @@ fq_find(u32 id, struct in6_addr *src, struct in6_addr *dst)
 {
 	struct frag_queue *fq;
 	struct hlist_node *n;
-	unsigned int hash = ip6qhashfn(id, src, dst);
+	unsigned int hash;
 
 	read_lock(&ip6_frag_lock);
+	hash = ip6qhashfn(id, src, dst);
 	hlist_for_each_entry(fq, n, &ip6_frag_hash[hash], list) {
 		if (fq->id == id && 
 		    ipv6_addr_equal(src, &fq->saddr) &&
@@ -405,7 +411,7 @@ fq_find(u32 id, struct in6_addr *src, struct in6_addr *dst)
 	}
 	read_unlock(&ip6_frag_lock);
 
-	return ip6_frag_create(hash, id, src, dst);
+	return ip6_frag_create(id, src, dst);
 }
 
 

net/wanrouter/af_wanpipe.c

@@ -55,12 +55,10 @@
 #include <asm/uaccess.h>
 #include <linux/module.h>
 #include <linux/init.h>
-#include <linux/wanpipe.h>
 #include <linux/if_wanpipe.h>
 #include <linux/pkt_sched.h>
 #include <linux/tcp_states.h>
 #include <linux/if_wanpipe_common.h>
-#include <linux/sdla_x25.h>
 
 #ifdef CONFIG_INET
 #include <net/inet_common.h>