Merge bk://kernel.bkbits.net/davem/net-2.5

into home.osdl.org:/home/torvalds/v2.5/linux

Documentation/crypto/api-intro.txt

@@ -186,7 +186,6 @@ Original developers of the crypto algorithms:
   Dag Arne Osvik (Serpent)
   Brian Gladman (AES)
 
-
 SHA1 algorithm contributors:
   Jean-Francois Dive
   
@@ -214,6 +213,9 @@ AES algorithm contributors:
   Kyle McMartin
   Adam J. Richter
 
+CAST5 algorithm contributors:
+  Kartikey Mahendra Bhatt (original developers unknown, FSF copyright).
+
 Generic scatterwalk code by Adam J. Richter <adam@yggdrasil.com>
 
 Please send any credits updates or corrections to:

crypto/Kconfig

@@ -126,6 +126,13 @@ config CRYPTO_AES
 
 	  See http://csrc.nist.gov/encryption/aes/ for more information.
 
+config CRYPTO_CAST5
+	tristate "CAST5 (CAST-128) cipher algorithm"
+	depends on CRYPTO
+	help
+	  The CAST5 encryption algorithm (synonymous with CAST-128) is
+	  described in RFC2144.
+
 config CRYPTO_DEFLATE
 	tristate "Deflate compression algorithm"
 	depends on CRYPTO

crypto/Makefile

@@ -20,6 +20,7 @@ obj-$(CONFIG_CRYPTO_BLOWFISH) += blowfish.o
 obj-$(CONFIG_CRYPTO_TWOFISH) += twofish.o
 obj-$(CONFIG_CRYPTO_SERPENT) += serpent.o
 obj-$(CONFIG_CRYPTO_AES) += aes.o
+obj-$(CONFIG_CRYPTO_CAST5) += cast5.o
 obj-$(CONFIG_CRYPTO_DEFLATE) += deflate.o
 
 obj-$(CONFIG_CRYPTO_TEST) += tcrypt.o

crypto/tcrypt.c

@@ -2192,6 +2192,102 @@ test_aes(void)
 	crypto_free_tfm(tfm);
 }
 
+void
+test_cast5(void)
+{
+	unsigned int ret, i, tsize;
+	u8 *p, *q, *key;
+	struct crypto_tfm *tfm;
+	struct cast5_tv *c5_tv;
+	struct scatterlist sg[1];
+
+	printk("\ntesting cast5 encryption\n");
+
+	tfm = crypto_alloc_tfm("cast5", 0);
+	if (tfm == NULL) {
+		printk("failed to load transform for cast5 (default ecb)\n");
+		return;
+	}
+
+	tsize = sizeof (cast5_enc_tv_template);
+	if (tsize > TVMEMSIZE) {
+		printk("template (%u) too big for tvmem (%u)\n", tsize,
+		       TVMEMSIZE);
+		return;
+	}
+
+	memcpy(tvmem, cast5_enc_tv_template, tsize);
+	c5_tv = (void *) tvmem;
+	for (i = 0; i < CAST5_ENC_TEST_VECTORS; i++) {
+		printk("test %u (%d bit key):\n", i + 1, c5_tv[i].keylen * 8);
+		key = c5_tv[i].key;
+
+		ret = crypto_cipher_setkey(tfm, key, c5_tv[i].keylen);
+		if (ret) {
+			printk("setkey() failed flags=%x\n", tfm->crt_flags);
+
+			if (!c5_tv[i].fail)
+				goto out;
+		}
+
+		p = c5_tv[i].plaintext;
+		sg[0].page = virt_to_page(p);
+		sg[0].offset = ((long) p & ~PAGE_MASK);
+		sg[0].length = sizeof(c5_tv[i].plaintext);
+		ret = crypto_cipher_encrypt(tfm, sg, sg, sg[0].length);
+		if (ret) {
+			printk("encrypt() failed flags=%x\n", tfm->crt_flags);
+			goto out;
+		}
+
+		q = kmap(sg[0].page) + sg[0].offset;
+		hexdump(q, sizeof(c5_tv[i].ciphertext));
+
+		printk("%s\n", memcmp(q, c5_tv[i].ciphertext,
+			sizeof(c5_tv[i].ciphertext)) ? "fail" : "pass");
+	}
+	
+	tsize = sizeof (cast5_dec_tv_template);
+	if (tsize > TVMEMSIZE) {
+		printk("template (%u) too big for tvmem (%u)\n", tsize,
+		       TVMEMSIZE);
+		return;
+	}
+
+	memcpy(tvmem, cast5_dec_tv_template, tsize);
+	c5_tv = (void *) tvmem;
+	for (i = 0; i < CAST5_DEC_TEST_VECTORS; i++) {
+		printk("test %u (%d bit key):\n", i + 1, c5_tv[i].keylen * 8);
+		key = c5_tv[i].key;
+
+		ret = crypto_cipher_setkey(tfm, key, c5_tv[i].keylen);
+		if (ret) {
+			printk("setkey() failed flags=%x\n", tfm->crt_flags);
+
+			if (!c5_tv[i].fail)
+				goto out;
+		}
+
+		p = c5_tv[i].plaintext;
+		sg[0].page = virt_to_page(p);
+		sg[0].offset = ((long) p & ~PAGE_MASK);
+		sg[0].length = sizeof(c5_tv[i].plaintext);
+		ret = crypto_cipher_decrypt(tfm, sg, sg, sg[0].length);
+		if (ret) {
+			printk("decrypt() failed flags=%x\n", tfm->crt_flags);
+			goto out;
+		}
+
+		q = kmap(sg[0].page) + sg[0].offset;
+		hexdump(q, sizeof(c5_tv[i].ciphertext));
+
+		printk("%s\n", memcmp(q, c5_tv[i].ciphertext,
+			sizeof(c5_tv[i].ciphertext)) ? "fail" : "pass");
+	}
+out:
+	crypto_free_tfm (tfm);
+}
+
 static void
 test_deflate(void)
 {
@@ -2304,6 +2400,7 @@ do_test(void)
 		test_sha384();
 		test_sha512();
 		test_deflate();
+		test_cast5();
 #ifdef CONFIG_CRYPTO_HMAC
 		test_hmac_md5();
 		test_hmac_sha1();
@@ -2363,6 +2460,10 @@ do_test(void)
 		test_deflate();
 		break;
 
+	case 14:
+		test_cast5();
+		break;
+
 #ifdef CONFIG_CRYPTO_HMAC
 	case 100:
 		test_hmac_md5();

crypto/tcrypt.h

@@ -1682,6 +1682,74 @@ struct aes_tv aes_dec_tv_template[] = {
 	},
 };
 
+/* Cast5 test vectors from RFC 2144 */
+#define CAST5_ENC_TEST_VECTORS	3
+#define CAST5_DEC_TEST_VECTORS	3
+
+struct cast5_tv {
+	unsigned keylen;
+	unsigned fail;
+	u8 key[16];
+	u8 plaintext[8];
+	u8 ciphertext[8];
+};
+
+struct cast5_tv cast5_enc_tv_template[] =
+{
+	{
+		16,
+		0,
+		{ 0x01, 0x23, 0x45, 0x67, 0x12, 0x34, 0x56, 0x78,
+		  0x23, 0x45, 0x67, 0x89, 0x34, 0x56, 0x78, 0x9A },
+		{ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef },
+		{ 0x23, 0x8b, 0x4f, 0xe5, 0x84, 0x7e, 0x44, 0xb2 },
+
+	},
+	{
+		10,
+		0,
+		{ 0x01, 0x23, 0x45, 0x67, 0x12, 0x34, 0x56, 0x78,
+		  0x23, 0x45 },
+		{ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef },
+		{ 0xeb, 0x6a, 0x71, 0x1a, 0x2c, 0x02, 0x27, 0x1b },
+	},
+	{
+		5,
+		0,
+		{ 0x01, 0x23, 0x45, 0x67, 0x12 },
+		{ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef },
+		{ 0x7a, 0xc8, 0x16, 0xd1, 0x6e, 0x9b, 0x30, 0x2e },
+	}
+};
+
+struct cast5_tv cast5_dec_tv_template[] =
+{
+	{
+		16,
+		0,
+		{ 0x01, 0x23, 0x45, 0x67, 0x12, 0x34, 0x56, 0x78,
+		  0x23, 0x45, 0x67, 0x89, 0x34, 0x56, 0x78, 0x9A },
+		{ 0x23, 0x8b, 0x4f, 0xe5, 0x84, 0x7e, 0x44, 0xb2 },
+		{ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef },
+
+	},
+	{
+		10,
+		0,
+		{ 0x01, 0x23, 0x45, 0x67, 0x12, 0x34, 0x56, 0x78,
+		  0x23, 0x45 },
+		{ 0xeb, 0x6a, 0x71, 0x1a, 0x2c, 0x02, 0x27, 0x1b },
+		{ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef },
+	},
+	{
+		5,
+		0,
+		{ 0x01, 0x23, 0x45, 0x67, 0x12 },
+		{ 0x7a, 0xc8, 0x16, 0xd1, 0x6e, 0x9b, 0x30, 0x2e },
+		{ 0x01, 0x23, 0x45, 0x67, 0x89, 0xab, 0xcd, 0xef },
+	}
+};
+
 /*
  * Compression stuff.
  */

drivers/net/hamradio/yam.c

@@ -72,6 +72,7 @@
 
 #include <linux/kernel.h>
 #include <linux/proc_fs.h>
+#include <linux/seq_file.h>
 
 #include <linux/version.h>
 #include <asm/uaccess.h>
@@ -120,7 +121,7 @@ struct yam_port {
 	int irq;
 	int dupmode;
 
-	struct net_device dev;
+	struct net_device *dev;
 
 	/* Stats section */
 
@@ -161,7 +162,7 @@ struct yam_mcs {
 	struct yam_mcs *next;
 };
 
-static struct yam_port yam_ports[NR_PORTS];
+static struct net_device *yam_devs[NR_PORTS];
 
 static struct yam_mcs *yam_data;
 
@@ -628,8 +629,8 @@ static void yam_dotimer(unsigned long dummy)
 	int i;
 
 	for (i = 0; i < NR_PORTS; i++) {
-		struct net_device *dev = &yam_ports[i].dev;
-		if (netif_running(dev))
+		struct net_device *dev = yam_devs[i];
+		if (dev && netif_running(dev))
 			yam_arbitrate(dev);
 	}
 	yam_timer.expires = jiffies + HZ / 100;
@@ -724,8 +725,8 @@ static irqreturn_t yam_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 	int handled = 0;
 
 	for (i = 0; i < NR_PORTS; i++) {
-		yp = &yam_ports[i];
-		dev = &yp->dev;
+		dev = yam_devs[i];
+		yp = dev->priv;
 
 		if (!netif_running(dev))
 			continue;
@@ -765,56 +766,73 @@ static irqreturn_t yam_interrupt(int irq, void *dev_id, struct pt_regs *regs)
 	return IRQ_RETVAL(handled);
 }
 
-static int yam_net_get_info(char *buffer, char **start, off_t offset, int length)
+#ifdef CONFIG_PROC_FS
+
+static void *yam_seq_start(struct seq_file *seq, loff_t *pos)
 {
-	int len = 0;
-	int i;
-	off_t pos = 0;
-	off_t begin = 0;
+	return (*pos < NR_PORTS) ? yam_devs[*pos] : NULL;
+}
 
+static void *yam_seq_next(struct seq_file *seq, void *v, loff_t *pos)
+{
+	++*pos;
+	return (*pos < NR_PORTS) ? yam_devs[*pos] : NULL;
+}
 
-	for (i = 0; i < NR_PORTS; i++) {
-		if (yam_ports[i].iobase == 0 || yam_ports[i].irq == 0)
-			continue;
-		len += sprintf(buffer + len, "Device yam%d\n", i);
-		len += sprintf(buffer + len, "  Up       %d\n", netif_running(&yam_ports[i].dev));
-		len += sprintf(buffer + len, "  Speed    %u\n", yam_ports[i].bitrate);
-		len += sprintf(buffer + len, "  IoBase   0x%x\n", yam_ports[i].iobase);
-		len += sprintf(buffer + len, "  BaudRate %u\n", yam_ports[i].baudrate);
-		len += sprintf(buffer + len, "  IRQ      %u\n", yam_ports[i].irq);
-		len += sprintf(buffer + len, "  TxState  %u\n", yam_ports[i].tx_state);
-		len += sprintf(buffer + len, "  Duplex   %u\n", yam_ports[i].dupmode);
-		len += sprintf(buffer + len, "  HoldDly  %u\n", yam_ports[i].holdd);
-		len += sprintf(buffer + len, "  TxDelay  %u\n", yam_ports[i].txd);
-		len += sprintf(buffer + len, "  TxTail   %u\n", yam_ports[i].txtail);
-		len += sprintf(buffer + len, "  SlotTime %u\n", yam_ports[i].slot);
-		len += sprintf(buffer + len, "  Persist  %u\n", yam_ports[i].pers);
-		len += sprintf(buffer + len, "  TxFrames %lu\n", yam_ports[i].stats.tx_packets);
-		len += sprintf(buffer + len, "  RxFrames %lu\n", yam_ports[i].stats.rx_packets);
-		len += sprintf(buffer + len, "  TxInt    %u\n", yam_ports[i].nb_mdint);
-		len += sprintf(buffer + len, "  RxInt    %u\n", yam_ports[i].nb_rxint);
-		len += sprintf(buffer + len, "  RxOver   %lu\n", yam_ports[i].stats.rx_fifo_errors);
-		len += sprintf(buffer + len, "\n");
-
-		pos = begin + len;
-
-		if (pos < offset) {
-			len = 0;
-			begin = pos;
-		}
-		if (pos > offset + length)
-			break;
-	}
+static void yam_seq_stop(struct seq_file *seq, void *v)
+{
+}
 
-	*start = buffer + (offset - begin);
-	len -= (offset - begin);
+static int yam_seq_show(struct seq_file *seq, void *v)
+{
+	const struct net_device *dev = v;
+	const struct yam_port *yp = dev->priv;
+
+	seq_printf(seq, "Device %s\n", dev->name);
+	seq_printf(seq, "  Up       %d\n", netif_running(dev));
+	seq_printf(seq, "  Speed    %u\n", yp->bitrate);
+	seq_printf(seq, "  IoBase   0x%x\n", yp->iobase);
+	seq_printf(seq, "  BaudRate %u\n", yp->baudrate);
+	seq_printf(seq, "  IRQ      %u\n", yp->irq);
+	seq_printf(seq, "  TxState  %u\n", yp->tx_state);
+	seq_printf(seq, "  Duplex   %u\n", yp->dupmode);
+	seq_printf(seq, "  HoldDly  %u\n", yp->holdd);
+	seq_printf(seq, "  TxDelay  %u\n", yp->txd);
+	seq_printf(seq, "  TxTail   %u\n", yp->txtail);
+	seq_printf(seq, "  SlotTime %u\n", yp->slot);
+	seq_printf(seq, "  Persist  %u\n", yp->pers);
+	seq_printf(seq, "  TxFrames %lu\n", yp->stats.tx_packets);
+	seq_printf(seq, "  RxFrames %lu\n", yp->stats.rx_packets);
+	seq_printf(seq, "  TxInt    %u\n", yp->nb_mdint);
+	seq_printf(seq, "  RxInt    %u\n", yp->nb_rxint);
+	seq_printf(seq, "  RxOver   %lu\n", yp->stats.rx_fifo_errors);
+	seq_printf(seq, "\n");
 
-	if (len > length)
-		len = length;
+}
 
-	return len;
+static struct seq_operations yam_seqops = {
+	.start = yam_seq_start,
+	.next = yam_seq_next,
+	.stop = yam_seq_stop,
+	.show = yam_seq_show,
+};
+
+static int yam_info_open(struct inode *inode, struct file *file)
+{
+	return seq_open(file, &yam_seqops);
 }
 
+static struct file_operations yam_info_fops = {
+	.owner = THIS_MODULE,
+	.open = yam_info_open,
+	.read = seq_read,
+	.llseek = seq_lseek,
+	.release = seq_release,
+};
+
+#endif
+
+
 /* --------------------------------------------------------------------- */
 
 static struct net_device_stats *yam_get_stats(struct net_device *dev)
@@ -882,8 +900,10 @@ static int yam_open(struct net_device *dev)
 
 	/* Reset overruns for all ports - FPGA programming makes overruns */
 	for (i = 0; i < NR_PORTS; i++) {
-		inb(LSR(yam_ports[i].dev.base_addr));
-		yam_ports[i].stats.rx_fifo_errors = 0;
+		struct net_device *dev = yam_devs[i];
+		struct yam_port *yp = dev->priv;
+		inb(LSR(dev->base_addr));
+		yp->stats.rx_fifo_errors = 0;
 	}
 
 	printk(KERN_INFO "%s at iobase 0x%lx irq %u uart %s\n", dev->name, dev->base_addr, dev->irq,
@@ -1070,14 +1090,26 @@ static int yam_set_mac_address(struct net_device *dev, void *addr)
 
 /* --------------------------------------------------------------------- */
 
-static int yam_probe(struct net_device *dev)
+static void yam_setup(struct net_device *dev)
 {
-	struct yam_port *yp;
-
-	if (!dev)
-		return -ENXIO;
+	struct yam_port *yp = dev->priv;
 
-	yp = (struct yam_port *) dev->priv;
+	yp->magic = YAM_MAGIC;
+	yp->bitrate = DEFAULT_BITRATE;
+	yp->baudrate = DEFAULT_BITRATE * 2;
+	yp->iobase = 0;
+	yp->irq = 0;
+	yp->dupmode = 0;
+	yp->holdd = DEFAULT_HOLDD;
+	yp->txd = DEFAULT_TXD;
+	yp->txtail = DEFAULT_TXTAIL;
+	yp->slot = DEFAULT_SLOT;
+	yp->pers = DEFAULT_PERS;
+	yp->dev = dev;
+
+	dev->base_addr = yp->iobase;
+	dev->irq = yp->irq;
+	SET_MODULE_OWNER(dev);
 
 	dev->open = yam_open;
 	dev->stop = yam_close;
@@ -1104,58 +1136,49 @@ static int yam_probe(struct net_device *dev)
 	memcpy(dev->broadcast, ax25_bcast, 7);
 	memcpy(dev->dev_addr, ax25_test, 7);
 
-	/* New style flags */
-	dev->flags = 0;
-
-	return 0;
 }
 
-/* --------------------------------------------------------------------- */
-
 static int __init yam_init_driver(void)
 {
 	struct net_device *dev;
-	int i;
+	int i, err;
+	char name[IFNAMSIZ];
 
 	printk(yam_drvinfo);
 
 	for (i = 0; i < NR_PORTS; i++) {
-		sprintf(yam_ports[i].dev.name, "yam%d", i);
-		yam_ports[i].magic = YAM_MAGIC;
-		yam_ports[i].bitrate = DEFAULT_BITRATE;
-		yam_ports[i].baudrate = DEFAULT_BITRATE * 2;
-		yam_ports[i].iobase = 0;
-		yam_ports[i].irq = 0;
-		yam_ports[i].dupmode = 0;
-		yam_ports[i].holdd = DEFAULT_HOLDD;
-		yam_ports[i].txd = DEFAULT_TXD;
-		yam_ports[i].txtail = DEFAULT_TXTAIL;
-		yam_ports[i].slot = DEFAULT_SLOT;
-		yam_ports[i].pers = DEFAULT_PERS;
-
-		dev = &yam_ports[i].dev;
-
-		dev->priv = &yam_ports[i];
-		dev->base_addr = yam_ports[i].iobase;
-		dev->irq = yam_ports[i].irq;
-		dev->init = yam_probe;
-		dev->if_port = 0;
-
-		if (register_netdev(dev)) {
+		sprintf(name, "yam%d", i);
+		
+		dev = alloc_netdev(sizeof(struct yam_port), name,
+				   yam_setup);
+		if (!dev) {
+			printk(KERN_ERR "yam: cannot allocate net device %s\n",
+			       dev->name);
+			err = -ENOMEM;
+			goto error;
+		}
+		
+		err = register_netdev(dev);
+		if (err) {
 			printk(KERN_WARNING "yam: cannot register net device %s\n", dev->name);
-			dev->priv = NULL;
-			return -ENXIO;
+			goto error;
 		}
+		yam_devs[i] = dev;
 
-		SET_MODULE_OWNER(dev);
 	}
 
 	yam_timer.function = yam_dotimer;
 	yam_timer.expires = jiffies + HZ / 100;
 	add_timer(&yam_timer);
 
-	proc_net_create("yam", 0, yam_net_get_info);
+	proc_net_fops_create("yam", S_IRUGO, &yam_info_fops);
 	return 0;
+ error:
+	while (--i >= 0) {
+		unregister_netdev(yam_devs[i]);
+		kfree(yam_devs[i]);
+	}
+	return err;
 }
 
 /* --------------------------------------------------------------------- */
@@ -1167,12 +1190,11 @@ static void __exit yam_cleanup_driver(void)
 
 	del_timer(&yam_timer);
 	for (i = 0; i < NR_PORTS; i++) {
-		struct net_device *dev = &yam_ports[i].dev;
-		if (!dev->priv)
-			continue;
-		if (netif_running(dev))
-			yam_close(dev);
+		struct net_device *dev = yam_devs[i];
+		if (dev) {
 			unregister_netdev(dev);
+			kfree(dev);
+		}
 	}
 
 	while (yam_data) {

drivers/net/slip.c

@@ -1369,6 +1369,7 @@ static int __init slip_init(void)
 	/* Fill in our line protocol discipline, and register it */
 	if ((status = tty_register_ldisc(N_SLIP, &sl_ldisc)) != 0)  {
 		printk(KERN_ERR "SLIP: can't register line discipline (err = %d)\n", status);
+		kfree(slip_devs);
 	}
 	return status;
 }

include/net/netrom.h

@@ -7,6 +7,7 @@
 #ifndef _NETROM_H
 #define _NETROM_H 
 #include <linux/netrom.h>
+#include <linux/list.h>
 
 #define	NR_NETWORK_LEN			15
 #define	NR_TRANSPORT_LEN		5
@@ -77,7 +78,7 @@ typedef struct {
 #define nr_sk(__sk) ((nr_cb *)(__sk)->sk_protinfo)
 
 struct nr_neigh {
-	struct nr_neigh *next;
+	struct hlist_node	neigh_node;
 	ax25_address		callsign;
 	ax25_digi		*digipeat;
 	ax25_cb			*ax25;
@@ -87,6 +88,7 @@ struct nr_neigh {
 	unsigned short		count;
 	unsigned int		number;
 	unsigned char		failed;
+	atomic_t		refcount;
 };
 
 struct nr_route {
@@ -96,14 +98,74 @@ struct nr_route {
 };
 
 struct nr_node {
-	struct nr_node  *next;
+	struct hlist_node	node_node;
 	ax25_address		callsign;
 	char			mnemonic[7];
 	unsigned char		which;
 	unsigned char		count;
 	struct nr_route		routes[3];
+	atomic_t		refcount;
+	spinlock_t		node_lock;
 };
 
+/*********************************************************************
+ *	nr_node & nr_neigh lists, refcounting and locking
+ *********************************************************************/
+
+extern struct hlist_head nr_node_list;
+extern struct hlist_head nr_neigh_list;
+
+#define nr_node_hold(__nr_node) \
+	atomic_inc(&((__nr_node)->refcount))
+
+static __inline__ void nr_node_put(struct nr_node *nr_node)
+{
+	if (atomic_dec_and_test(&nr_node->refcount)) {
+		kfree(nr_node);
+	}
+}
+
+#define nr_neigh_hold(__nr_neigh) \
+	atomic_inc(&((__nr_neigh)->refcount))
+
+static __inline__ void nr_neigh_put(struct nr_neigh *nr_neigh)
+{
+	if (atomic_dec_and_test(&nr_neigh->refcount)) {
+		if (nr_neigh->digipeat != NULL)
+			kfree(nr_neigh->digipeat);
+		kfree(nr_neigh);
+	}
+}
+
+/* nr_node_lock and nr_node_unlock also hold/put the node's refcounter.
+ */
+static __inline__ void nr_node_lock(struct nr_node *nr_node)
+{
+	nr_node_hold(nr_node);
+	spin_lock_bh(&nr_node->node_lock);
+}
+
+static __inline__ void nr_node_unlock(struct nr_node *nr_node)
+{
+	spin_unlock_bh(&nr_node->node_lock);
+	nr_node_put(nr_node);
+}
+
+#define nr_neigh_for_each(__nr_neigh, node, list) \
+	hlist_for_each_entry(__nr_neigh, node, list, neigh_node)
+
+#define nr_neigh_for_each_safe(__nr_neigh, node, node2, list) \
+	hlist_for_each_entry_safe(__nr_neigh, node, node2, list, neigh_node)
+
+#define nr_node_for_each(__nr_node, node, list) \
+	hlist_for_each_entry(__nr_node, node, list, node_node)
+
+#define nr_node_for_each_safe(__nr_node, node, node2, list) \
+	hlist_for_each_entry_safe(__nr_node, node, node2, list, node_node)
+
+
+/*********************************************************************/
+
 /* af_netrom.c */
 extern int  sysctl_netrom_default_path_quality;
 extern int  sysctl_netrom_obsolescence_count_initialiser;
@@ -121,7 +183,7 @@ extern void nr_destroy_socket(struct sock *);
 
 /* nr_dev.c */
 extern int  nr_rx_ip(struct sk_buff *, struct net_device *);
-extern int  nr_init(struct net_device *);
+extern void nr_setup(struct net_device *);
 
 /* nr_in.c */
 extern int  nr_process_rx_frame(struct sock *, struct sk_buff *);
@@ -147,8 +209,8 @@ extern struct net_device *nr_dev_get(ax25_address *);
 extern int  nr_rt_ioctl(unsigned int, void *);
 extern void nr_link_failed(ax25_cb *, int);
 extern int  nr_route_frame(struct sk_buff *, ax25_cb *);
-extern int  nr_nodes_get_info(char *, char **, off_t, int);
-extern int  nr_neigh_get_info(char *, char **, off_t, int);
+extern struct file_operations nr_nodes_fops;
+extern struct file_operations nr_neigh_fops;
 extern void nr_rt_free(void);
 
 /* nr_subr.c */

net/bridge/br_stp_bpdu.c

@@ -201,6 +201,6 @@ int br_stp_handle_bpdu(struct sk_buff *skb)
  out:
 	spin_unlock_bh(&br->lock);
  err:
-	kfree(skb);
+	kfree_skb(skb);
 	return 0;
 }

net/ipv4/devinet.c

@@ -922,6 +922,7 @@ static int inet_fill_ifaddr(struct sk_buff *skb, struct in_ifaddr *ifa,
 	unsigned char	 *b = skb->tail;
 
 	nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*ifm));
+	if (pid) nlh->nlmsg_flags |= NLM_F_MULTI;
 	ifm = NLMSG_DATA(nlh);
 	ifm->ifa_family = AF_INET;
 	ifm->ifa_prefixlen = ifa->ifa_prefixlen;

net/ipv4/netfilter/ipt_MASQUERADE.c

@@ -91,11 +91,18 @@ masquerade_target(struct sk_buff **pskb,
 #ifdef CONFIG_IP_ROUTE_FWMARK
 						.fwmark = (*pskb)->nfmark
 #endif
-					      } },
-				    .oif = out->ifindex };
+					      } } };
 		if (ip_route_output_key(&rt, &fl) != 0) {
-			/* Shouldn't happen */
-			printk("MASQUERADE: No route: Rusty's brain broke!\n");
+			/* Funky routing can do this. */
+			if (net_ratelimit())
+				printk("MASQUERADE:"
+				       " No route: Rusty's brain broke!\n");
+			return NF_DROP;
+		}
+		if (rt->u.dst.dev != out) {
+			if (net_ratelimit())
+				printk("MASQUERADE:"
+				       " Route sent us somewhere else.\n");
 			return NF_DROP;
 		}
 	}

net/ipv6/addrconf.c

@@ -2443,6 +2443,7 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
 	unsigned char	 *b = skb->tail;
 
 	nlh = NLMSG_PUT(skb, pid, seq, event, sizeof(*ifm));
+	if (pid) nlh->nlmsg_flags |= NLM_F_MULTI;
 	ifm = NLMSG_DATA(nlh);
 	ifm->ifa_family = AF_INET6;
 	ifm->ifa_prefixlen = ifa->prefix_len;

net/ipv6/raw.c

@@ -833,6 +833,7 @@ static int rawv6_getsockopt(struct sock *sk, int level, int optname,
 			val = -1;
 		else
 			val = opt->offset;
+		break;
 
 	default:
 		return -ENOPROTOOPT;

net/netrom/nr_dev.c

@@ -159,10 +159,12 @@ static int nr_set_mac_address(struct net_device *dev, void *addr)
 {
 	struct sockaddr *sa = addr;
 
+	if (dev->flags & IFF_UP)
 		ax25_listen_release((ax25_address *)dev->dev_addr, NULL);
 
 	memcpy(dev->dev_addr, sa->sa_data, dev->addr_len);
 
+	if (dev->flags & IFF_UP)
 		ax25_listen_register((ax25_address *)dev->dev_addr, NULL);
 
 	return 0;
@@ -177,8 +179,8 @@ static int nr_open(struct net_device *dev)
 
 static int nr_close(struct net_device *dev)
 {
-	netif_stop_queue(dev);
 	ax25_listen_release((ax25_address *)dev->dev_addr, NULL);
+	netif_stop_queue(dev);
 	return 0;
 }
 
@@ -195,30 +197,25 @@ static struct net_device_stats *nr_get_stats(struct net_device *dev)
 	return (struct net_device_stats *)dev->priv;
 }
 
-int nr_init(struct net_device *dev)
+void nr_setup(struct net_device *dev)
 {
 	SET_MODULE_OWNER(dev);
 	dev->mtu		= NR_MAX_PACKET_SIZE;
 	dev->hard_start_xmit	= nr_xmit;
 	dev->open		= nr_open;
 	dev->stop		= nr_close;
+	dev->destructor		= (void (*)(struct net_device *))kfree;
 
 	dev->hard_header	= nr_header;
-	dev->hard_header_len	= AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
+	dev->hard_header_len	= NR_NETWORK_LEN + NR_TRANSPORT_LEN;
 	dev->addr_len		= AX25_ADDR_LEN;
 	dev->type		= ARPHRD_NETROM;
+	dev->tx_queue_len	= 40;
 	dev->rebuild_header	= nr_rebuild_header;
 	dev->set_mac_address    = nr_set_mac_address;
 
 	/* New-style flags. */
 	dev->flags		= 0;
 
-	if ((dev->priv = kmalloc(sizeof(struct net_device_stats), GFP_KERNEL)) == NULL)
-		return -ENOMEM;
-
-	memset(dev->priv, 0, sizeof(struct net_device_stats));
-
 	dev->get_stats 		= nr_get_stats;
-
-	return 0;
-};
+}

net/netrom/nr_in.c

@@ -74,6 +74,7 @@ static int nr_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
 static int nr_state1_machine(struct sock *sk, struct sk_buff *skb,
 	int frametype)
 {
+	bh_lock_sock(sk);
 	switch (frametype) {
 	case NR_CONNACK: {
 		nr_cb *nr = nr_sk(sk);
@@ -102,6 +103,7 @@ static int nr_state1_machine(struct sock *sk, struct sk_buff *skb,
 	default:
 		break;
 	}
+	bh_unlock_sock(sk);
 
 	return 0;
 }
@@ -114,6 +116,7 @@ static int nr_state1_machine(struct sock *sk, struct sk_buff *skb,
 static int nr_state2_machine(struct sock *sk, struct sk_buff *skb,
 	int frametype)
 {
+	bh_lock_sock(sk);
 	switch (frametype) {
 	case NR_CONNACK | NR_CHOKE_FLAG:
 		nr_disconnect(sk, ECONNRESET);
@@ -129,6 +132,7 @@ static int nr_state2_machine(struct sock *sk, struct sk_buff *skb,
 	default:
 		break;
 	}
+	bh_unlock_sock(sk);
 
 	return 0;
 }
@@ -150,6 +154,7 @@ static int nr_state3_machine(struct sock *sk, struct sk_buff *skb, int frametype
 	nr = skb->data[18];
 	ns = skb->data[17];
 
+	bh_lock_sock(sk);
 	switch (frametype) {
 	case NR_CONNREQ:
 		nr_write_internal(sk, NR_CONNACK);
@@ -260,6 +265,7 @@ static int nr_state3_machine(struct sock *sk, struct sk_buff *skb, int frametype
 	default:
 		break;
 	}
+	bh_unlock_sock(sk);
 
 	return queued;
 }

net/netrom/nr_subr.c

@@ -127,7 +127,7 @@ void nr_write_internal(struct sock *sk, int frametype)
 	unsigned char  *dptr;
 	int len, timeout;
 
-	len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + NR_NETWORK_LEN + NR_TRANSPORT_LEN;
+	len = NR_NETWORK_LEN + NR_TRANSPORT_LEN;
 
 	switch (frametype & 0x0F) {
 	case NR_CONNREQ:
@@ -151,7 +151,7 @@ void nr_write_internal(struct sock *sk, int frametype)
 	/*
 	 *	Space for AX.25 and NET/ROM network header
 	 */
-	skb_reserve(skb, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + NR_NETWORK_LEN);
+	skb_reserve(skb, NR_NETWORK_LEN);
 
 	dptr = skb_put(skb, skb_tailroom(skb));
 
@@ -219,12 +219,12 @@ void nr_transmit_refusal(struct sk_buff *skb, int mine)
 	unsigned char *dptr;
 	int len;
 
-	len = AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN + NR_NETWORK_LEN + NR_TRANSPORT_LEN + 1;
+	len = NR_NETWORK_LEN + NR_TRANSPORT_LEN + 1;
 
 	if ((skbn = alloc_skb(len, GFP_ATOMIC)) == NULL)
 		return;
 
-	skb_reserve(skbn, AX25_BPQ_HEADER_LEN + AX25_MAX_HEADER_LEN);
+	skb_reserve(skbn, 0);
 
 	dptr = skb_put(skbn, NR_NETWORK_LEN + NR_TRANSPORT_LEN);
 

net/netrom/nr_timer.c

@@ -143,7 +143,10 @@ static void nr_heartbeat_expiry(unsigned long param)
 		   is accepted() it isn't 'dead' so doesn't get removed. */
 		if (sock_flag(sk, SOCK_DESTROY) ||
 		    (sk->sk_state == TCP_LISTEN && sock_flag(sk, SOCK_DEAD))) {
+			sock_hold(sk);
 			nr_destroy_socket(sk);
+			bh_unlock_sock(sk);
+			sock_put(sk);
 			return;
 		}
 		break;
@@ -227,6 +230,7 @@ static void nr_t1timer_expiry(unsigned long param)
 	case NR_STATE_1:
 		if (nr->n2count == nr->n2) {
 			nr_disconnect(sk, ETIMEDOUT);
+			bh_unlock_sock(sk);
 			return;
 		} else {
 			nr->n2count++;
@@ -237,6 +241,7 @@ static void nr_t1timer_expiry(unsigned long param)
 	case NR_STATE_2:
 		if (nr->n2count == nr->n2) {
 			nr_disconnect(sk, ETIMEDOUT);
+			bh_unlock_sock(sk);
 			return;
 		} else {
 			nr->n2count++;
@@ -247,6 +252,7 @@ static void nr_t1timer_expiry(unsigned long param)
 	case NR_STATE_3:
 		if (nr->n2count == nr->n2) {
 			nr_disconnect(sk, ETIMEDOUT);
+			bh_unlock_sock(sk);
 			return;
 		} else {
 			nr->n2count++;

net/netrom/sysctl_net_netrom.c

@@ -15,9 +15,9 @@
 /*
  *	Values taken from NET/ROM documentation.
  */
-static int min_quality[1],       max_quality[] = {255};
-static int min_obs[1],           max_obs[]     = {255};
-static int min_ttl[1],           max_ttl[]     = {255};
+static int min_quality[] = {0}, max_quality[] = {255};
+static int min_obs[]     = {0}, max_obs[]     = {255};
+static int min_ttl[]     = {0}, max_ttl[]     = {255};
 static int min_t1[]      = {5 * HZ};
 static int max_t1[]      = {600 * HZ};
 static int min_n2[]      = {2}, max_n2[]      = {127};
@@ -28,7 +28,7 @@ static int max_t4[]      = {1000 * HZ};
 static int min_window[]  = {1}, max_window[]  = {127};
 static int min_idle[]    = {0 * HZ};
 static int max_idle[]    = {65535 * HZ};
-static int min_route[1],        max_route[]   = {1};
+static int min_route[]   = {0}, max_route[]   = {1};
 static int min_fails[]   = {1}, max_fails[]   = {10};
 
 static struct ctl_table_header *nr_table_header;

net/sunrpc/sysctl.c

@@ -102,7 +102,7 @@ proc_dodebug(ctl_table *table, int write, struct file *file,
 		len = sprintf(tmpbuf, "%d", *(unsigned int *) table->data);
 		if (len > left)
 			len = left;
-		copy_to_user(buffer, tmpbuf, len);
+		__copy_to_user(buffer, tmpbuf, len);
 		if ((left -= len) > 0) {
 			put_user('\n', (char *)buffer + len);
 			left--;