Merge bk://gkernel.bkbits.net/net-drivers-2.5

into home.osdl.org:/home/torvalds/v2.5/linux

include/linux/skbuff.h

@@ -871,7 +871,7 @@ static inline unsigned char *skb_push(struct sk_buff *skb, unsigned int len)
 	return skb->data;
 }
 
-static inline char *__skb_pull(struct sk_buff *skb, unsigned int len)
+static inline unsigned char *__skb_pull(struct sk_buff *skb, unsigned int len)
 {
 	skb->len -= len;
 	BUG_ON(skb->len < skb->data_len);
@@ -895,7 +895,7 @@ static inline unsigned char *skb_pull(struct sk_buff *skb, unsigned int len)
 
 extern unsigned char *__pskb_pull_tail(struct sk_buff *skb, int delta);
 
-static inline char *__pskb_pull(struct sk_buff *skb, unsigned int len)
+static inline unsigned char *__pskb_pull(struct sk_buff *skb, unsigned int len)
 {
 	if (len > skb_headlen(skb) &&
 	    !__pskb_pull_tail(skb, len-skb_headlen(skb)))

include/net/ah.h

@@ -3,6 +3,9 @@
 
 #include <net/xfrm.h>
 
+/* This is the maximum truncated ICV length that we know of. */
+#define MAX_AH_AUTH_LEN	12
+
 struct ah_data
 {
 	u8			*key;

net/ipv4/ah4.c

@@ -199,7 +199,7 @@ int ah_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_buf
 			goto out;
 	}
         {
-		u8 auth_data[ahp->icv_trunc_len];
+		u8 auth_data[MAX_AH_AUTH_LEN];
 		
 		memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
 		skb_push(skb, skb->data - skb->nh.raw);
@@ -285,6 +285,8 @@ static int ah_init_state(struct xfrm_state *x, void *args)
 	ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
 	ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
 	
+	BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
+	
 	ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
 	if (!ahp->work_icv)
 		goto error;

net/ipv4/igmp.c

@@ -2084,16 +2084,19 @@ int ip_check_mc(struct in_device *in_dev, u32 mc_addr, u32 src_addr, u16 proto)
 	if (im && proto == IPPROTO_IGMP) {
 		rv = 1;
 	} else if (im) {
-		for (psf=im->sources; psf; psf=psf->sf_next) {
-			if (psf->sf_inaddr == src_addr)
-				break;
-		}
-		if (psf)
-			rv = psf->sf_count[MCAST_INCLUDE] ||
-				psf->sf_count[MCAST_EXCLUDE] !=
-				im->sfcount[MCAST_EXCLUDE];
-		else
-			rv = im->sfcount[MCAST_EXCLUDE] != 0;
+		if (src_addr) {
+			for (psf=im->sources; psf; psf=psf->sf_next) {
+				if (psf->sf_inaddr == src_addr)
+					break;
+			}
+			if (psf)
+				rv = psf->sf_count[MCAST_INCLUDE] ||
+					psf->sf_count[MCAST_EXCLUDE] !=
+					im->sfcount[MCAST_EXCLUDE];
+			else
+				rv = im->sfcount[MCAST_EXCLUDE] != 0;
+		} else
+			rv = 1; /* unspecified source; tentatively allow */
 	}
 	read_unlock(&in_dev->lock);
 	return rv;

net/ipv6/addrconf.c

@@ -1338,7 +1338,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
 	 *	2) Configure prefixes with the auto flag set
 	 */
 
-	/* Avoid arithemtic overflow. Really, we could
+	/* Avoid arithmetic overflow. Really, we could
 	   save rt_expires in seconds, likely valid_lft,
 	   but it would require division in fib gc, that it
 	   not good.

net/ipv6/ah6.c

@@ -315,7 +315,7 @@ int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struct sk_bu
 	skb->nh.ipv6h->hop_limit   = 0;
 
         {
-		u8 auth_data[ahp->icv_trunc_len];
+		u8 auth_data[MAX_AH_AUTH_LEN];
 
 		memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
 		memset(ah->auth_data, 0, ahp->icv_trunc_len);
@@ -420,6 +420,8 @@ static int ah6_init_state(struct xfrm_state *x, void *args)
 	ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
 	ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
 	
+	BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
+	
 	ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
 	if (!ahp->work_icv)
 		goto error;

net/ipv6/exthdrs.c

@@ -367,7 +367,7 @@ ipv6_invert_rthdr(struct sock *sk, struct ipv6_rt_hdr *hdr)
 	   Inverted result:
 	   [ H_prev -> ... -> H1 ] daddr =sender
 
-	   Note, that IP output engine will rewrire this rthdr
+	   Note, that IP output engine will rewrite this rthdr
 	   by rotating it left by one addr.
 	 */
 

net/ipv6/ip6_fib.c

@@ -942,7 +942,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
 			}
 			fn = fn->parent;
 		}
-		/* No more references are possiible at this point. */
+		/* No more references are possible at this point. */
 		if (atomic_read(&rt->rt6i_ref) != 1) BUG();
 	}
 

net/ipv6/mcast.c

@@ -918,20 +918,24 @@ int ipv6_chk_mcast_addr(struct net_device *dev, struct in6_addr *group,
 				break;
 		}
 		if (mc) {
-			struct ip6_sf_list *psf;
-
-			spin_lock_bh(&mc->mca_lock);
-			for (psf=mc->mca_sources; psf; psf=psf->sf_next) {
-				if (ipv6_addr_cmp(&psf->sf_addr, src_addr) == 0)
-					break;
-			}
-			if (psf)
-				rv = psf->sf_count[MCAST_INCLUDE] ||
-					psf->sf_count[MCAST_EXCLUDE] !=
-					mc->mca_sfcount[MCAST_EXCLUDE];
-			else
-				rv = mc->mca_sfcount[MCAST_EXCLUDE] != 0;
-			spin_unlock_bh(&mc->mca_lock);
+			if (!ipv6_addr_any(src_addr)) {
+				struct ip6_sf_list *psf;
+
+				spin_lock_bh(&mc->mca_lock);
+				for (psf=mc->mca_sources;psf;psf=psf->sf_next) {
+					if (ipv6_addr_cmp(&psf->sf_addr,
+					    src_addr) == 0)
+						break;
+				}
+				if (psf)
+					rv = psf->sf_count[MCAST_INCLUDE] ||
+						psf->sf_count[MCAST_EXCLUDE] !=
+						mc->mca_sfcount[MCAST_EXCLUDE];
+				else
+					rv = mc->mca_sfcount[MCAST_EXCLUDE] !=0;
+				spin_unlock_bh(&mc->mca_lock);
+			} else
+				rv = 1; /* don't filter unspecified source */
 		}
 		read_unlock_bh(&idev->lock);
 		in6_dev_put(idev);

net/ipv6/reassembly.c

@@ -526,7 +526,7 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
 		} else {
 			struct sk_buff *free_it = next;
 
-			/* Old fragmnet is completely overridden with
+			/* Old fragment is completely overridden with
 			 * new one drop it.
 			 */
 			next = next->next;

net/ipv6/route.c

@@ -785,7 +785,7 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh, void *_rtattr)
 			/* IPv6 strictly inhibits using not link-local
 			   addresses as nexthop address.
 			   Otherwise, router will not able to send redirects.
-			   It is very good, but in some (rare!) curcumstances
+			   It is very good, but in some (rare!) circumstances
 			   (SIT, PtP, NBMA NOARP links) it is handy to allow
 			   some exceptions. --ANK
 			 */
@@ -1365,10 +1365,10 @@ static int rt6_mtu_change_route(struct rt6_info *rt, void *p_arg)
 	 */
 	/*
 	   If new MTU is less than route PMTU, this new MTU will be the
-	   lowest MTU in the path, update the route PMTU to refect PMTU
+	   lowest MTU in the path, update the route PMTU to reflect PMTU
 	   decreases; if new MTU is greater than route PMTU, and the
 	   old MTU is the lowest MTU in the path, update the route PMTU
-	   to refect the increase. In this case if the other nodes' MTU
+	   to reflect the increase. In this case if the other nodes' MTU
 	   also have the lowest MTU, TOO BIG MESSAGE will be lead to
 	   PMTU discouvery.
 	 */