Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [TCP]: Do receiver-side SWS avoidance for rcvbuf < MSS.
  [BNX2]: Fix nvram write logic.
  [IPv6]: Fix incorrect length check in rawv6_sendmsg()
  [NET_SCHED]: cls_basic: fix memory leak in basic_destroy
  [NET]: Change "not found" return value for rule lookup

drivers/net/bnx2.c

@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME		"bnx2"
 #define PFX DRV_MODULE_NAME	": "
-#define DRV_MODULE_VERSION	"1.5.6"
-#define DRV_MODULE_RELDATE	"March 28, 2007"
+#define DRV_MODULE_VERSION	"1.5.7"
+#define DRV_MODULE_RELDATE	"March 29, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -3099,21 +3099,19 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
 
 	if ((align_start = (offset32 & 3))) {
 		offset32 &= ~3;
-		len32 += (4 - align_start);
+		len32 += align_start;
+		if (len32 < 4)
+			len32 = 4;
 		if ((rc = bnx2_nvram_read(bp, offset32, start, 4)))
 			return rc;
 	}
 
 	if (len32 & 3) {
-	       	if ((len32 > 4) || !align_start) {
 		align_end = 4 - (len32 & 3);
 		len32 += align_end;
-			if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4,
-				end, 4))) {
+		if ((rc = bnx2_nvram_read(bp, offset32 + len32 - 4, end, 4)))
 			return rc;
 	}
-		}
-	}
 
 	if (align_start || align_end) {
 		align_buf = kmalloc(len32, GFP_KERNEL);
@@ -3187,6 +3185,10 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
 		if ((rc = bnx2_enable_nvram_write(bp)) != 0)
 			goto nvram_write_end;
 
+		/* Loop to write back the buffer data from page_start to
+		 * data_start */
+		i = 0;
+		if (bp->flash_info->buffered == 0) {
 			/* Erase the page */
 			if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0)
 				goto nvram_write_end;
@@ -3194,10 +3196,6 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
 			/* Re-enable the write again for the actual write */
 			bnx2_enable_nvram_write(bp);
 
-		/* Loop to write back the buffer data from page_start to
-		 * data_start */
-		i = 0;
-		if (bp->flash_info->buffered == 0) {
 			for (addr = page_start; addr < data_start;
 				addr += 4, i += 4) {
 

net/core/fib_rules.c

@@ -143,7 +143,7 @@ int fib_rules_lookup(struct fib_rules_ops *ops, struct flowi *fl,
 		}
 	}
 
-	err = -ENETUNREACH;
+	err = -ESRCH;
 out:
 	rcu_read_unlock();
 

net/ipv4/tcp_output.c

@@ -1607,6 +1607,9 @@ u32 __tcp_select_window(struct sock *sk)
 		 */
 		if (window <= free_space - mss || window > free_space)
 			window = (free_space/mss)*mss;
+		else if (mss == full_space &&
+		         free_space > window + full_space/2)
+			window = free_space;
 	}
 
 	return window;

net/ipv6/raw.c

@@ -687,9 +687,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 	int err;
 
 	/* Rough check on arithmetic overflow,
-	   better check is made in ip6_build_xmit
+	   better check is made in ip6_append_data().
 	 */
-	if (len < 0)
+	if (len > INT_MAX)
 		return -EMSGSIZE;
 
 	/* Mirror BSD error message compatibility */

net/ipv6/udp.c

@@ -615,7 +615,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 		return udp_sendmsg(iocb, sk, msg, len);
 
 	/* Rough check on arithmetic overflow,
-	   better check is made in ip6_build_xmit
+	   better check is made in ip6_append_data().
 	   */
 	if (len > INT_MAX - sizeof(struct udphdr))
 		return -EMSGSIZE;

net/sched/cls_basic.c

@@ -109,6 +109,7 @@ static void basic_destroy(struct tcf_proto *tp)
 		list_del(&f->link);
 		basic_delete_filter(tp, f);
 	}
+	kfree(head);
 }
 
 static int basic_delete(struct tcf_proto *tp, unsigned long arg)