Merge branch 'master' into upstream

Documentation/feature-removal-schedule.txt

@@ -281,3 +281,16 @@ Why:	The deferred output hooks are a layering violation causing unusual
 Who:	Patrick McHardy <kaber@trash.net>
 
 ---------------------------
+
+What:	frame diverter
+When:	November 2006
+Why:	The frame diverter is included in most distribution kernels, but is
+	broken. It does not correctly handle many things:
+	- IPV6
+	- non-linear skb's
+	- network device RCU on removal
+	- input frames not correctly checked for protocol errors
+	It also adds allocation overhead even if not enabled.
+	It is not clear if anyone is still using it.
+Who:	Stephen Hemminger <shemminger@osdl.org>
+

Documentation/kernel-parameters.txt

@@ -697,6 +697,12 @@ running once the system is up.
 	ips=		[HW,SCSI] Adaptec / IBM ServeRAID controller
 			See header of drivers/scsi/ips.c.
 
+	ports=		[IP_VS_FTP] IPVS ftp helper module
+			Default is 21.
+			Up to 8 (IP_VS_APP_MAX_PORTS) ports
+			may be specified.
+			Format: <port>,<port>....
+
 	irqfixup	[HW]
 			When an interrupt is not handled search all handlers
 			for it. Intended to get systems with badly broken

Documentation/networking/ip-sysctl.txt

@@ -102,9 +102,15 @@ inet_peer_gc_maxtime - INTEGER
 TCP variables: 
 
 tcp_abc - INTEGER
-	Controls Appropriate Byte Count defined in RFC3465. If set to
-	0 then does congestion avoid once per ack. 1 is conservative
-	value, and 2 is more agressive.
+	Controls Appropriate Byte Count (ABC) defined in RFC3465.
+	ABC is a way of increasing congestion window (cwnd) more slowly
+	in response to partial acknowledgments.
+	Possible values are:
+		0 increase cwnd once per acknowledgment (no ABC)
+		1 increase cwnd once per acknowledgment of full sized segment
+		2 allow increase cwnd by two if acknowledgment is
+		  of two segments to compensate for delayed acknowledgments.
+	Default: 0 (off)
 
 tcp_syn_retries - INTEGER
 	Number of times initial SYNs for an active TCP connection attempt

MAINTAINERS

@@ -416,7 +416,7 @@ S:	Supported
 ATM
 P:	Chas Williams
 M:	chas@cmf.nrl.navy.mil
-L:	linux-atm-general@lists.sourceforge.net
+L:	linux-atm-general@lists.sourceforge.net (subscribers-only)
 W:	http://linux-atm.sourceforge.net
 S:	Maintained
 
@@ -2828,6 +2828,14 @@ M:	hadi@cyberus.ca
 L:	netdev@vger.kernel.org
 S:	Maintained
 
+TCP LOW PRIORITY MODULE
+P:	Wong Hoi Sing, Edison
+M:	hswong3i@gmail.com
+P:	Hung Hing Lun, Mike
+M:	hlhung3i@gmail.com
+W:	http://tcp-lp-mod.sourceforge.net/
+S:	Maintained
+
 TI OMAP RANDOM NUMBER GENERATOR SUPPORT
 P:	Deepak Saxena
 M:	dsaxena@plexity.net

arch/arm/mach-s3c2410/Kconfig

@@ -81,9 +81,17 @@ config SMDK2440_CPU2442
 	depends on ARCH_S3C2440
 	select CPU_S3C2442
 
+config MACH_S3C2413
+	bool
+	help
+	  Internal node for S3C2413 verison of SMDK2413, so that
+	  machine_is_s3c2413() will work when MACH_SMDK2413 is
+	  selected
+
 config MACH_SMDK2413
 	bool "SMDK2413"
 	select CPU_S3C2412
+	select MACH_S3C2413
 	select MACH_SMDK
 	help
 	  Say Y here if you are using an SMDK2413

arch/arm/mach-s3c2410/irq.h

@@ -100,5 +100,10 @@ s3c_irqsub_ack(unsigned int irqno, unsigned int parentmask, unsigned int group)
 
 /* exported for use in arch/arm/mach-s3c2410 */
 
+#ifdef CONFIG_PM
 extern int s3c_irq_wake(unsigned int irqno, unsigned int state);
+#else
+#define s3c_irq_wake NULL
+#endif
+
 extern int s3c_irqext_type(unsigned int irq, unsigned int type);

arch/arm/mach-s3c2410/s3c2412.c

@@ -35,11 +35,15 @@
 #include <asm/mach/irq.h>
 
 #include <asm/hardware.h>
+#include <asm/proc-fns.h>
 #include <asm/io.h>
 #include <asm/irq.h>
 
+#include <asm/arch/idle.h>
+
 #include <asm/arch/regs-clock.h>
 #include <asm/arch/regs-serial.h>
+#include <asm/arch/regs-power.h>
 #include <asm/arch/regs-gpio.h>
 #include <asm/arch/regs-gpioj.h>
 #include <asm/arch/regs-dsc.h>
@@ -75,6 +79,27 @@ void __init s3c2412_init_uarts(struct s3c2410_uartcfg *cfg, int no)
 	s3c_device_nand.name = "s3c2412-nand";
 }
 
+/* s3c2412_idle
+ *
+ * use the standard idle call by ensuring the idle mode
+ * in power config, then issuing the idle co-processor
+ * instruction
+*/
+
+static void s3c2412_idle(void)
+{
+	unsigned long tmp;
+
+	/* ensure our idle mode is to go to idle */
+
+	tmp = __raw_readl(S3C2412_PWRCFG);
+	tmp &= ~S3C2412_PWRCFG_STANDBYWFI_MASK;
+	tmp |= S3C2412_PWRCFG_STANDBYWFI_IDLE;
+	__raw_writel(tmp, S3C2412_PWRCFG);
+
+	cpu_do_idle();
+}
+
 /* s3c2412_map_io
  *
  * register the standard cpu IO areas, and any passed in from the
@@ -87,6 +112,10 @@ void __init s3c2412_map_io(struct map_desc *mach_desc, int mach_size)
 
 	s3c24xx_va_gpio2 = S3C24XX_VA_GPIO + 0x10;
 
+	/* set our idle function */
+
+	s3c24xx_idle = s3c2412_idle;
+
 	/* register our io-tables */
 
 	iotable_init(s3c2412_iodesc, ARRAY_SIZE(s3c2412_iodesc));

arch/arm/mm/proc-xscale.S

@@ -644,7 +644,7 @@ __80219_proc_info:
 	.type	__8032x_proc_info,#object
 __8032x_proc_info:
 	.long	0x69052420
-	.long	0xffffffe0
+	.long	0xfffff7e0
 	.long   PMD_TYPE_SECT | \
 		PMD_SECT_BUFFERABLE | \
 		PMD_SECT_CACHEABLE | \

arch/i386/kernel/entry.S

@@ -209,6 +209,10 @@ ENTRY(ret_from_fork)
 	GET_THREAD_INFO(%ebp)
 	popl %eax
 	CFI_ADJUST_CFA_OFFSET -4
+	pushl $0x0202			# Reset kernel eflags
+	CFI_ADJUST_CFA_OFFSET 4
+	popfl
+	CFI_ADJUST_CFA_OFFSET -4
 	jmp syscall_exit
 	CFI_ENDPROC
 

arch/sparc/kernel/sys_sparc.c

@@ -470,19 +470,21 @@ asmlinkage int sys_getdomainname(char __user *name, int len)
 {
  	int nlen, err;
  	
-	if (len < 0 || len > __NEW_UTS_LEN)
+	if (len < 0)
 		return -EINVAL;
 
  	down_read(&uts_sem);
  	
 	nlen = strlen(system_utsname.domainname) + 1;
-	if (nlen < len)
-		len = nlen;
+	err = -EINVAL;
+	if (nlen > len)
+		goto out;
 
 	err = -EFAULT;
-	if (!copy_to_user(name, system_utsname.domainname, len))
+	if (!copy_to_user(name, system_utsname.domainname, nlen))
 		err = 0;
 
+out:
 	up_read(&uts_sem);
 	return err;
 }

arch/sparc64/kernel/sys_sparc.c

@@ -707,19 +707,21 @@ asmlinkage long sys_getdomainname(char __user *name, int len)
 {
         int nlen, err;
 
-	if (len < 0 || len > __NEW_UTS_LEN)
+	if (len < 0)
 		return -EINVAL;
 
  	down_read(&uts_sem);
  	
 	nlen = strlen(system_utsname.domainname) + 1;
-        if (nlen < len)
-                len = nlen;
+	err = -EINVAL;
+	if (nlen > len)
+		goto out;
 
 	err = -EFAULT;
-	if (!copy_to_user(name, system_utsname.domainname, len))
+	if (!copy_to_user(name, system_utsname.domainname, nlen))
 		err = 0;
 
+out:
 	up_read(&uts_sem);
 	return err;
 }

drivers/atm/he.c

@@ -2282,6 +2282,8 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
 				TPDRQ_MASK(he_readl(he_dev, TPDRQ_B_H)));
 
 		if (new_tail == he_dev->tpdrq_head) {
+			int slot;
+
 			hprintk("tpdrq full (cid 0x%x)\n", cid);
 			/*
 			 * FIXME
@@ -2289,6 +2291,13 @@ __enqueue_tpd(struct he_dev *he_dev, struct he_tpd *tpd, unsigned cid)
 			 * after service_tbrq, service the backlog
 			 * for now, we just drop the pdu
 			 */
+			for (slot = 0; slot < TPD_MAXIOV; ++slot) {
+				if (tpd->iovec[slot].addr)
+					pci_unmap_single(he_dev->pci_dev,
+						tpd->iovec[slot].addr,
+						tpd->iovec[slot].len & TPD_LEN_MASK,
+								PCI_DMA_TODEVICE);
+			}
 			if (tpd->skb) {
 				if (tpd->vcc->pop)
 					tpd->vcc->pop(tpd->vcc, tpd->skb);

drivers/sbus/char/openprom.c

@@ -145,8 +145,9 @@ static int opromgetprop(void __user *argp, struct device_node *dp, struct openpr
 	void *pval;
 	int len;
 
-	pval = of_get_property(dp, op->oprom_array, &len);
-	if (!pval || len <= 0 || len > bufsize)
+	if (!dp ||
+	    !(pval = of_get_property(dp, op->oprom_array, &len)) ||
+	    len <= 0 || len > bufsize)
 		return copyout(argp, op, sizeof(int));
 
 	memcpy(op->oprom_array, pval, len);
@@ -161,6 +162,8 @@ static int opromnxtprop(void __user *argp, struct device_node *dp, struct openpr
 	struct property *prop;
 	int len;
 
+	if (!dp)
+		return copyout(argp, op, sizeof(int));
 	if (op->oprom_array[0] == '\0') {
 		prop = dp->properties;
 		if (!prop)
@@ -266,9 +269,13 @@ static int oprompci2node(void __user *argp, struct device_node *dp, struct openp
 
 static int oprompath2node(void __user *argp, struct device_node *dp, struct openpromio *op, int bufsize, DATA *data)
 {
+	phandle ph = 0;
+
 	dp = of_find_node_by_path(op->oprom_array);
+	if (dp)
+		ph = dp->node;
 	data->current_node = dp;
-	*((int *)op->oprom_array) = dp->node;
+	*((int *)op->oprom_array) = ph;
 	op->oprom_size = sizeof(int);
 
 	return copyout(argp, op, bufsize + sizeof(int));

drivers/serial/s3c2410.c

@@ -1621,7 +1621,7 @@ static struct s3c24xx_uart_info s3c2412_uart_inf = {
 static int s3c2412_serial_probe(struct platform_device *dev)
 {
 	dbg("s3c2440_serial_probe: dev=%p\n", dev);
-	return s3c24xx_serial_probe(dev, &s3c2440_uart_inf);
+	return s3c24xx_serial_probe(dev, &s3c2412_uart_inf);
 }
 
 static struct platform_driver s3c2412_serial_drv = {

include/asm-arm/arch-s3c2410/regs-power.h

@@ -0,0 +1,34 @@
+/* linux/include/asm/arch-s3c2410/regs-power.h
+ *
+ * Copyright (c) 2003,2004,2005,2006 Simtec Electronics <linux@simtec.co.uk>
+ *		      http://armlinux.simtec.co.uk/
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * S3C24XX power control register definitions
+*/
+
+#ifndef __ASM_ARM_REGS_PWR
+#define __ASM_ARM_REGS_PWR __FILE__
+
+#define S3C24XX_PWRREG(x) ((x) + S3C24XX_VA_CLKPWR)
+
+#define S3C2412_PWRMODECON	S3C24XX_PWRREG(0x20)
+#define S3C2412_PWRCFG		S3C24XX_PWRREG(0x24)
+
+#define S3C2412_PWRCFG_BATF_IGNORE		(0<<0)
+#define S3C2412_PWRCFG_BATF_SLEEP		(3<<0)
+#define S3C2412_PWRCFG_BATF_MASK		(3<<0)
+
+#define S3C2412_PWRCFG_STANDBYWFI_IGNORE	(0<<6)
+#define S3C2412_PWRCFG_STANDBYWFI_IDLE		(1<<6)
+#define S3C2412_PWRCFG_STANDBYWFI_STOP		(2<<6)
+#define S3C2412_PWRCFG_STANDBYWFI_SLEEP		(3<<6)
+#define S3C2412_PWRCFG_STANDBYWFI_MASK		(3<<6)
+
+#define S3C2412_PWRCFG_RTC_MASKIRQ		(1<<8)
+#define S3C2412_PWRCFG_NAND_NORST		(1<<9)
+
+#endif /* __ASM_ARM_REGS_PWR */

include/asm-arm/elf.h

@@ -8,7 +8,9 @@
 
 #include <asm/ptrace.h>
 #include <asm/user.h>
+#ifdef __KERNEL
 #include <asm/procinfo.h>
+#endif
 
 typedef unsigned long elf_greg_t;
 typedef unsigned long elf_freg_t[3];

include/asm-arm/page.h

@@ -193,8 +193,8 @@ extern pmd_t *top_pmd;
 #define ARCH_SLAB_MINALIGN 8
 #endif
 
-#endif /* __KERNEL__ */
-
 #include <asm-generic/page.h>
 
+#endif /* __KERNEL__ */
+
 #endif

include/asm-i386/system.h

@@ -11,9 +11,14 @@
 struct task_struct;	/* one of the stranger aspects of C forward declarations.. */
 extern struct task_struct * FASTCALL(__switch_to(struct task_struct *prev, struct task_struct *next));
 
+/*
+ * Saving eflags is important. It switches not only IOPL between tasks,
+ * it also protects other tasks from NT leaking through sysenter etc.
+ */
 #define switch_to(prev,next,last) do {					\
 	unsigned long esi,edi;						\
-	asm volatile("pushl %%ebp\n\t"					\
+	asm volatile("pushfl\n\t"		/* Save flags */	\
+		     "pushl %%ebp\n\t"					\
 		     "movl %%esp,%0\n\t"	/* save ESP */		\
 		     "movl %5,%%esp\n\t"	/* restore ESP */	\
 		     "movl $1f,%1\n\t"		/* save EIP */		\
@@ -21,6 +26,7 @@ extern struct task_struct * FASTCALL(__switch_to(struct task_struct *prev, struc
 		     "jmp __switch_to\n"				\
 		     "1:\t"						\
 		     "popl %%ebp\n\t"					\
+		     "popfl"						\
 		     :"=m" (prev->thread.esp),"=m" (prev->thread.eip),	\
 		      "=a" (last),"=S" (esi),"=D" (edi)			\
 		     :"m" (next->thread.esp),"m" (next->thread.eip),	\

include/linux/netfilter/Kbuild

@@ -5,7 +5,7 @@ header-y := nf_conntrack_sctp.h nf_conntrack_tuple_common.h		\
 	    xt_helper.h xt_length.h xt_limit.h xt_mac.h xt_mark.h	\
 	    xt_MARK.h xt_multiport.h xt_NFQUEUE.h xt_pkttype.h		\
 	    xt_policy.h xt_realm.h xt_sctp.h xt_state.h xt_string.h	\
-	    xt_tcpmss.h xt_tcpudp.h
+	    xt_tcpmss.h xt_tcpudp.h xt_SECMARK.h xt_CONNSECMARK.h
 
 unifdef-y := nf_conntrack_common.h nf_conntrack_ftp.h		\
 	nf_conntrack_tcp.h nfnetlink.h x_tables.h xt_physdev.h

net/Kconfig

@@ -177,7 +177,7 @@ source "net/lapb/Kconfig"
 
 config NET_DIVERT
 	bool "Frame Diverter (EXPERIMENTAL)"
-	depends on EXPERIMENTAL
+	depends on EXPERIMENTAL && BROKEN
 	---help---
 	  The Frame Diverter allows you to divert packets from the
 	  network, that are not aimed at the interface receiving it (in

net/atm/clip.c

@@ -500,9 +500,11 @@ static int clip_mkip(struct atm_vcc *vcc, int timeout)
 		} else {
 			unsigned int len = skb->len;
 
+			skb_get(skb);
 			clip_push(vcc, skb);
 			PRIV(skb->dev)->stats.rx_packets--;
 			PRIV(skb->dev)->stats.rx_bytes -= len;
+			kfree_skb(skb);
 		}
 	return 0;
 }

net/bridge/br_stp_bpdu.c

@@ -121,7 +121,7 @@ void br_send_tcn_bpdu(struct net_bridge_port *p)
 	buf[1] = 0;
 	buf[2] = 0;
 	buf[3] = BPDU_TYPE_TCN;
-	br_send_bpdu(p, buf, 7);
+	br_send_bpdu(p, buf, 4);
 }
 
 /*

net/core/neighbour.c

@@ -1432,6 +1432,9 @@ int neigh_table_clear(struct neigh_table *tbl)
 	kfree(tbl->phash_buckets);
 	tbl->phash_buckets = NULL;
 
+	free_percpu(tbl->stats);
+	tbl->stats = NULL;
+
 	return 0;
 }
 

net/ipv4/ipvs/ip_vs_ftp.c

@@ -46,14 +46,7 @@
  */
 static int ports[IP_VS_APP_MAX_PORTS] = {21, 0};
 module_param_array(ports, int, NULL, 0);
-
-/*
- *	Debug level
- */
-#ifdef CONFIG_IP_VS_DEBUG
-static int debug=0;
-module_param(debug, int, 0);
-#endif
+MODULE_PARM_DESC(ports, "Ports to monitor for FTP control commands");
 
 
 /*	Dummy variable */
@@ -177,7 +170,7 @@ static int ip_vs_ftp_out(struct ip_vs_app *app, struct ip_vs_conn *cp,
 					   &start, &end) != 1)
 			return 1;
 
-		IP_VS_DBG(1-debug, "PASV response (%u.%u.%u.%u:%d) -> "
+		IP_VS_DBG(7, "PASV response (%u.%u.%u.%u:%d) -> "
 			  "%u.%u.%u.%u:%d detected\n",
 			  NIPQUAD(from), ntohs(port), NIPQUAD(cp->caddr), 0);
 
@@ -280,7 +273,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
 	while (data <= data_limit - 6) {
 		if (strnicmp(data, "PASV\r\n", 6) == 0) {
 			/* Passive mode on */
-			IP_VS_DBG(1-debug, "got PASV at %zd of %zd\n",
+			IP_VS_DBG(7, "got PASV at %zd of %zd\n",
 				  data - data_start,
 				  data_limit - data_start);
 			cp->app_data = &ip_vs_ftp_pasv;
@@ -302,7 +295,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
 				   &start, &end) != 1)
 		return 1;
 
-	IP_VS_DBG(1-debug, "PORT %u.%u.%u.%u:%d detected\n",
+	IP_VS_DBG(7, "PORT %u.%u.%u.%u:%d detected\n",
 		  NIPQUAD(to), ntohs(port));
 
 	/* Passive mode off */
@@ -311,7 +304,7 @@ static int ip_vs_ftp_in(struct ip_vs_app *app, struct ip_vs_conn *cp,
 	/*
 	 * Now update or create a connection entry for it
 	 */
-	IP_VS_DBG(1-debug, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
+	IP_VS_DBG(7, "protocol %s %u.%u.%u.%u:%d %u.%u.%u.%u:%d\n",
 		  ip_vs_proto_name(iph->protocol),
 		  NIPQUAD(to), ntohs(port), NIPQUAD(cp->vaddr), 0);
 
@@ -372,11 +365,17 @@ static int __init ip_vs_ftp_init(void)
 	for (i=0; i<IP_VS_APP_MAX_PORTS; i++) {
 		if (!ports[i])
 			continue;
+		if (ports[i] < 0 || ports[i] > 0xffff) {
+			IP_VS_WARNING("ip_vs_ftp: Ignoring invalid "
+				      "configuration port[%d] = %d\n",
+				      i, ports[i]);
+			continue;
+		}
 		ret = register_ip_vs_app_inc(app, app->protocol, ports[i]);
 		if (ret)
 			break;
-		IP_VS_DBG(1-debug, "%s: loaded support on port[%d] = %d\n",
-			  app->name, i, ports[i]);
+		IP_VS_INFO("%s: loaded support on port[%d] = %d\n",
+		 	   app->name, i, ports[i]);
 	}
 
 	if (ret)

net/ipv4/tcp_input.c

@@ -89,7 +89,7 @@ int sysctl_tcp_frto;
 int sysctl_tcp_nometrics_save;
 
 int sysctl_tcp_moderate_rcvbuf = 1;
-int sysctl_tcp_abc = 1;
+int sysctl_tcp_abc;
 
 #define FLAG_DATA		0x01 /* Incoming frame contained data.		*/
 #define FLAG_WIN_UPDATE		0x02 /* Incoming ACK was a window update.	*/

net/ipv4/tcp_lp.c

@@ -3,13 +3,8 @@
  *
  * TCP Low Priority is a distributed algorithm whose goal is to utilize only
  *   the excess network bandwidth as compared to the ``fair share`` of
- *   bandwidth as targeted by TCP. Available from:
- *     http://www.ece.rice.edu/~akuzma/Doc/akuzma/TCP-LP.pdf
+ *   bandwidth as targeted by TCP.
  *
- * Original Author:
- *   Aleksandar Kuzmanovic <akuzma@northwestern.edu>
- *
- * See http://www-ece.rice.edu/networks/TCP-LP/ for their implementation.
  * As of 2.6.13, Linux supports pluggable congestion control algorithms.
  * Due to the limitation of the API, we take the following changes from
  * the original TCP-LP implementation:
@@ -24,11 +19,20 @@
  *   o OWD is handled in relative format, where local time stamp will in
  *     tcp_time_stamp format.
  *
- * Port from 2.4.19 to 2.6.16 as module by:
- *   Wong Hoi Sing Edison <hswong3i@gmail.com>
- *   Hung Hing Lun <hlhung3i@gmail.com>
+ * Original Author:
+ *   Aleksandar Kuzmanovic <akuzma@northwestern.edu>
+ * Available from:
+ *   http://www.ece.rice.edu/~akuzma/Doc/akuzma/TCP-LP.pdf
+ * Original implementation for 2.4.19:
+ *   http://www-ece.rice.edu/networks/TCP-LP/
  *
- * Version: $Id: tcp_lp.c,v 1.22 2006-05-02 18:18:19 hswong3i Exp $
+ * 2.6.x module Authors:
+ *   Wong Hoi Sing, Edison <hswong3i@gmail.com>
+ *   Hung Hing Lun, Mike <hlhung3i@gmail.com>
+ * SourceForge project page:
+ *   http://tcp-lp-mod.sourceforge.net/
+ *
+ * Version: $Id: tcp_lp.c,v 1.24 2006/09/05 20:22:53 hswong3i Exp $
  */
 
 #include <linux/config.h>
@@ -153,16 +157,19 @@ static u32 tcp_lp_remote_hz_estimator(struct sock *sk)
 	if (m < 0)
 		m = -m;
 
-	if (rhz != 0) {
+	if (rhz > 0) {
 		m -= rhz >> 6;	/* m is now error in remote HZ est */
 		rhz += m;	/* 63/64 old + 1/64 new */
 	} else
 		rhz = m << 6;
 
+ out:
 	/* record time for successful remote HZ calc */
-	lp->flag |= LP_VALID_RHZ;
+	if (rhz > 0)
+		lp->flag |= LP_VALID_RHZ;
+	else
+		lp->flag &= ~LP_VALID_RHZ;
 
- out:
 	/* record reference time stamp */
 	lp->remote_ref_time = tp->rx_opt.rcv_tsval;
 	lp->local_ref_time = tp->rx_opt.rcv_tsecr;
@@ -333,6 +340,6 @@ static void __exit tcp_lp_unregister(void)
 module_init(tcp_lp_register);
 module_exit(tcp_lp_unregister);
 
-MODULE_AUTHOR("Wong Hoi Sing Edison, Hung Hing Lun");
+MODULE_AUTHOR("Wong Hoi Sing Edison, Hung Hing Lun Mike");
 MODULE_LICENSE("GPL");
 MODULE_DESCRIPTION("TCP Low Priority");

net/ipv6/datagram.c

@@ -696,7 +696,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
 			}
 
 			tc = *(int *)CMSG_DATA(cmsg);
-			if (tc < 0 || tc > 0xff)
+			if (tc < -1 || tc > 0xff)
 				goto exit_f;
 
 			err = 0;

net/ipv6/icmp.c

@@ -401,7 +401,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 	if (hlimit < 0)
 		hlimit = ipv6_get_hoplimit(dst->dev);
 
-	tclass = np->cork.tclass;
+	tclass = np->tclass;
 	if (tclass < 0)
 		tclass = 0;
 
@@ -497,7 +497,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 	if (hlimit < 0)
 		hlimit = ipv6_get_hoplimit(dst->dev);
 
-	tclass = np->cork.tclass;
+	tclass = np->tclass;
 	if (tclass < 0)
 		tclass = 0;
 

net/ipv6/ipv6_sockglue.c

@@ -362,7 +362,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
 		break;
 
 	case IPV6_TCLASS:
-		if (val < 0 || val > 0xff)
+		if (val < -1 || val > 0xff)
 			goto e_inval;
 		np->tclass = val;
 		retv = 0;
@@ -947,6 +947,8 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
 
 	case IPV6_TCLASS:
 		val = np->tclass;
+		if (val < 0)
+			val = 0;
 		break;
 
 	case IPV6_RECVTCLASS:

net/ipv6/raw.c

@@ -781,7 +781,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 	}
 
 	if (tclass < 0) {
-		tclass = np->cork.tclass;
+		tclass = np->tclass;
 		if (tclass < 0)
 			tclass = 0;
 	}

net/packet/af_packet.c

@@ -626,8 +626,6 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 		if ((int)snaplen < 0)
 			snaplen = 0;
 	}
-	if (snaplen > skb->len-skb->data_len)
-		snaplen = skb->len-skb->data_len;
 
 	spin_lock(&sk->sk_receive_queue.lock);
 	h = (struct tpacket_hdr *)packet_lookup_frame(po, po->head);
@@ -644,7 +642,7 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 		status &= ~TP_STATUS_LOSING;
 	spin_unlock(&sk->sk_receive_queue.lock);
 
-	memcpy((u8*)h + macoff, skb->data, snaplen);
+	skb_copy_bits(skb, 0, (u8*)h + macoff, snaplen);
 
 	h->tp_len = skb->len;
 	h->tp_snaplen = snaplen;

net/sched/sch_generic.c

@@ -238,9 +238,7 @@ void __netdev_watchdog_up(struct net_device *dev)
 
 static void dev_watchdog_up(struct net_device *dev)
 {
-	netif_tx_lock_bh(dev);
 	__netdev_watchdog_up(dev);
-	netif_tx_unlock_bh(dev);
 }
 
 static void dev_watchdog_down(struct net_device *dev)