Commit 7143b7d41218d4fc2ea33e6056c73609527ae687

Authored by David S. Miller

Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	drivers/net/tg3.c

Showing 28 changed files Side-by-side Diff

... ... @@ -6551,7 +6551,7 @@
6551 6551 F: drivers/usb/host/uhci*
6552 6552  
6553 6553 USB "USBNET" DRIVER FRAMEWORK
6554   -M: David Brownell <dbrownell@users.sourceforge.net>
  6554 +M: Oliver Neukum <oneukum@suse.de>
6555 6555 L: netdev@vger.kernel.org
6556 6556 W: http://www.linux-usb.org/usbnet
6557 6557 S: Maintained
drivers/net/amd8111e.c
... ... @@ -106,7 +106,7 @@
106 106 MODULE_LICENSE("GPL");
107 107 MODULE_DEVICE_TABLE(pci, amd8111e_pci_tbl);
108 108 module_param_array(speed_duplex, int, NULL, 0);
109   -MODULE_PARM_DESC(speed_duplex, "Set device speed and duplex modes, 0: Auto Negotitate, 1: 10Mbps Half Duplex, 2: 10Mbps Full Duplex, 3: 100Mbps Half Duplex, 4: 100Mbps Full Duplex");
  109 +MODULE_PARM_DESC(speed_duplex, "Set device speed and duplex modes, 0: Auto Negotiate, 1: 10Mbps Half Duplex, 2: 10Mbps Full Duplex, 3: 100Mbps Half Duplex, 4: 100Mbps Full Duplex");
110 110 module_param_array(coalesce, bool, NULL, 0);
111 111 MODULE_PARM_DESC(coalesce, "Enable or Disable interrupt coalescing, 1: Enable, 0: Disable");
112 112 module_param_array(dynamic_ipg, bool, NULL, 0);
... ... @@ -8357,6 +8357,8 @@
8357 8357  
8358 8358 unregister_netdev(dev);
8359 8359  
  8360 + del_timer_sync(&bp->timer);
  8361 +
8360 8362 if (bp->mips_firmware)
8361 8363 release_firmware(bp->mips_firmware);
8362 8364 if (bp->rv2p_firmware)
drivers/net/can/sja1000/sja1000.c
... ... @@ -346,10 +346,10 @@
346 346 | (priv->read_reg(priv, REG_ID2) >> 5);
347 347 }
348 348  
  349 + cf->can_dlc = get_can_dlc(fi & 0x0F);
349 350 if (fi & FI_RTR) {
350 351 id |= CAN_RTR_FLAG;
351 352 } else {
352   - cf->can_dlc = get_can_dlc(fi & 0x0F);
353 353 for (i = 0; i < cf->can_dlc; i++)
354 354 cf->data[i] = priv->read_reg(priv, dreg++);
355 355 }
drivers/net/ftmac100.c
... ... @@ -139,11 +139,11 @@
139 139 * that hardware reset completed (what the f*ck).
140 140 * We still need to wait for a while.
141 141 */
142   - usleep_range(500, 1000);
  142 + udelay(500);
143 143 return 0;
144 144 }
145 145  
146   - usleep_range(1000, 10000);
  146 + udelay(1000);
147 147 }
148 148  
149 149 netdev_err(netdev, "software reset failed\n");
... ... @@ -772,7 +772,7 @@
772 772 if ((phycr & FTMAC100_PHYCR_MIIRD) == 0)
773 773 return phycr & FTMAC100_PHYCR_MIIRDATA;
774 774  
775   - usleep_range(100, 1000);
  775 + udelay(100);
776 776 }
777 777  
778 778 netdev_err(netdev, "mdio read timed out\n");
... ... @@ -801,7 +801,7 @@
801 801 if ((phycr & FTMAC100_PHYCR_MIIWR) == 0)
802 802 return;
803 803  
804   - usleep_range(100, 1000);
  804 + udelay(100);
805 805 }
806 806  
807 807 netdev_err(netdev, "mdio write timed out\n");
... ... @@ -49,6 +49,10 @@
49 49 result |= ADVERTISED_100baseT_Half;
50 50 if (advert & ADVERTISE_100FULL)
51 51 result |= ADVERTISED_100baseT_Full;
  52 + if (advert & ADVERTISE_PAUSE_CAP)
  53 + result |= ADVERTISED_Pause;
  54 + if (advert & ADVERTISE_PAUSE_ASYM)
  55 + result |= ADVERTISED_Asym_Pause;
52 56  
53 57 return result;
54 58 }
... ... @@ -12747,8 +12747,10 @@
12747 12747 if (val & VCPU_CFGSHDW_ASPM_DBNC)
12748 12748 tg3_flag_set(tp, ASPM_WORKAROUND);
12749 12749 if ((val & VCPU_CFGSHDW_WOL_ENABLE) &&
12750   - (val & VCPU_CFGSHDW_WOL_MAGPKT))
  12750 + (val & VCPU_CFGSHDW_WOL_MAGPKT)) {
12751 12751 tg3_flag_set(tp, WOL_ENABLE);
  12752 + device_set_wakeup_enable(&tp->pdev->dev, true);
  12753 + }
12752 12754 goto done;
12753 12755 }
12754 12756  
12755 12757  
... ... @@ -12881,8 +12883,10 @@
12881 12883 tg3_flag_clear(tp, WOL_CAP);
12882 12884  
12883 12885 if (tg3_flag(tp, WOL_CAP) &&
12884   - (nic_cfg & NIC_SRAM_DATA_CFG_WOL_ENABLE))
  12886 + (nic_cfg & NIC_SRAM_DATA_CFG_WOL_ENABLE)) {
12885 12887 tg3_flag_set(tp, WOL_ENABLE);
  12888 + device_set_wakeup_enable(&tp->pdev->dev, true);
  12889 + }
12886 12890  
12887 12891 if (cfg2 & (1 << 17))
12888 12892 tp->phy_flags |= TG3_PHYFLG_CAPACITIVE_COUPLING;
drivers/net/usb/cdc_ether.c
... ... @@ -460,7 +460,7 @@
460 460 .manage_power = cdc_manage_power,
461 461 };
462 462  
463   -static const struct driver_info mbm_info = {
  463 +static const struct driver_info wwan_info = {
464 464 .description = "Mobile Broadband Network Device",
465 465 .flags = FLAG_WWAN,
466 466 .bind = usbnet_cdc_bind,
... ... @@ -471,6 +471,7 @@
471 471  
472 472 /*-------------------------------------------------------------------------*/
473 473  
  474 +#define HUAWEI_VENDOR_ID 0x12D1
474 475  
475 476 static const struct usb_device_id products [] = {
476 477 /*
477 478  
... ... @@ -587,8 +588,17 @@
587 588 }, {
588 589 USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
589 590 USB_CDC_PROTO_NONE),
590   - .driver_info = (unsigned long)&mbm_info,
  591 + .driver_info = (unsigned long)&wwan_info,
591 592  
  593 +}, {
  594 + /* Various Huawei modems with a network port like the UMG1831 */
  595 + .match_flags = USB_DEVICE_ID_MATCH_VENDOR
  596 + | USB_DEVICE_ID_MATCH_INT_INFO,
  597 + .idVendor = HUAWEI_VENDOR_ID,
  598 + .bInterfaceClass = USB_CLASS_COMM,
  599 + .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
  600 + .bInterfaceProtocol = 255,
  601 + .driver_info = (unsigned long)&wwan_info,
592 602 },
593 603 { }, // END
594 604 };
drivers/net/usb/smsc95xx.c
... ... @@ -690,7 +690,7 @@
690 690 msleep(10);
691 691 bmcr = smsc95xx_mdio_read(dev->net, dev->mii.phy_id, MII_BMCR);
692 692 timeout++;
693   - } while ((bmcr & MII_BMCR) && (timeout < 100));
  693 + } while ((bmcr & BMCR_RESET) && (timeout < 100));
694 694  
695 695 if (timeout >= 100) {
696 696 netdev_warn(dev->net, "timeout on PHY Reset");
drivers/net/usb/usbnet.c
... ... @@ -645,6 +645,7 @@
645 645 struct driver_info *info = dev->driver_info;
646 646 int retval;
647 647  
  648 + clear_bit(EVENT_DEV_OPEN, &dev->flags);
648 649 netif_stop_queue (net);
649 650  
650 651 netif_info(dev, ifdown, dev->net,
... ... @@ -736,6 +737,7 @@
736 737 }
737 738 }
738 739  
  740 + set_bit(EVENT_DEV_OPEN, &dev->flags);
739 741 netif_start_queue (net);
740 742 netif_info(dev, ifup, dev->net,
741 743 "open: enable queueing (rx %d, tx %d) mtu %d %s framing\n",
... ... @@ -1259,6 +1261,9 @@
1259 1261 if (dev->driver_info->unbind)
1260 1262 dev->driver_info->unbind (dev, intf);
1261 1263  
  1264 + usb_kill_urb(dev->interrupt);
  1265 + usb_free_urb(dev->interrupt);
  1266 +
1262 1267 free_netdev(net);
1263 1268 usb_put_dev (xdev);
1264 1269 }
... ... @@ -1498,6 +1503,10 @@
1498 1503 int retval;
1499 1504  
1500 1505 if (!--dev->suspend_count) {
  1506 + /* resume interrupt URBs */
  1507 + if (dev->interrupt && test_bit(EVENT_DEV_OPEN, &dev->flags))
  1508 + usb_submit_urb(dev->interrupt, GFP_NOIO);
  1509 +
1501 1510 spin_lock_irq(&dev->txq.lock);
1502 1511 while ((res = usb_get_from_anchor(&dev->deferred))) {
1503 1512  
... ... @@ -1516,9 +1525,12 @@
1516 1525 smp_mb();
1517 1526 clear_bit(EVENT_DEV_ASLEEP, &dev->flags);
1518 1527 spin_unlock_irq(&dev->txq.lock);
1519   - if (!(dev->txq.qlen >= TX_QLEN(dev)))
1520   - netif_start_queue(dev->net);
1521   - tasklet_schedule (&dev->bh);
  1528 +
  1529 + if (test_bit(EVENT_DEV_OPEN, &dev->flags)) {
  1530 + if (!(dev->txq.qlen >= TX_QLEN(dev)))
  1531 + netif_start_queue(dev->net);
  1532 + tasklet_schedule (&dev->bh);
  1533 + }
1522 1534 }
1523 1535 return 0;
1524 1536 }
... ... @@ -368,6 +368,17 @@
368 368 if (tb[IFLA_ADDRESS] == NULL)
369 369 random_ether_addr(dev->dev_addr);
370 370  
  371 + if (tb[IFLA_IFNAME])
  372 + nla_strlcpy(dev->name, tb[IFLA_IFNAME], IFNAMSIZ);
  373 + else
  374 + snprintf(dev->name, IFNAMSIZ, DRV_NAME "%%d");
  375 +
  376 + if (strchr(dev->name, '%')) {
  377 + err = dev_alloc_name(dev, dev->name);
  378 + if (err < 0)
  379 + goto err_alloc_name;
  380 + }
  381 +
371 382 err = register_netdevice(dev);
372 383 if (err < 0)
373 384 goto err_register_dev;
... ... @@ -387,6 +398,7 @@
387 398  
388 399 err_register_dev:
389 400 /* nothing to do */
  401 +err_alloc_name:
390 402 err_configure_peer:
391 403 unregister_netdevice(peer);
392 404 return err;
drivers/net/wireless/b43/main.c
... ... @@ -72,6 +72,7 @@
72 72 MODULE_FIRMWARE("b43/ucode13.fw");
73 73 MODULE_FIRMWARE("b43/ucode14.fw");
74 74 MODULE_FIRMWARE("b43/ucode15.fw");
  75 +MODULE_FIRMWARE("b43/ucode16_mimo.fw");
75 76 MODULE_FIRMWARE("b43/ucode5.fw");
76 77 MODULE_FIRMWARE("b43/ucode9.fw");
77 78  
drivers/net/wireless/iwlegacy/iwl-4965-tx.c
... ... @@ -316,12 +316,18 @@
316 316  
317 317 hdr_len = ieee80211_hdrlen(fc);
318 318  
319   - /* Find index into station table for destination station */
320   - sta_id = iwl_legacy_sta_id_or_broadcast(priv, ctx, info->control.sta);
321   - if (sta_id == IWL_INVALID_STATION) {
322   - IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
323   - hdr->addr1);
324   - goto drop_unlock;
  319 + /* For management frames use broadcast id to do not break aggregation */
  320 + if (!ieee80211_is_data(fc))
  321 + sta_id = ctx->bcast_sta_id;
  322 + else {
  323 + /* Find index into station table for destination station */
  324 + sta_id = iwl_legacy_sta_id_or_broadcast(priv, ctx, info->control.sta);
  325 +
  326 + if (sta_id == IWL_INVALID_STATION) {
  327 + IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
  328 + hdr->addr1);
  329 + goto drop_unlock;
  330 + }
325 331 }
326 332  
327 333 IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
drivers/net/wireless/iwlegacy/iwl-led.c
... ... @@ -48,8 +48,21 @@
48 48 MODULE_PARM_DESC(led_mode, "0=system default, "
49 49 "1=On(RF On)/Off(RF Off), 2=blinking");
50 50  
  51 +/* Throughput OFF time(ms) ON time (ms)
  52 + * >300 25 25
  53 + * >200 to 300 40 40
  54 + * >100 to 200 55 55
  55 + * >70 to 100 65 65
  56 + * >50 to 70 75 75
  57 + * >20 to 50 85 85
  58 + * >10 to 20 95 95
  59 + * >5 to 10 110 110
  60 + * >1 to 5 130 130
  61 + * >0 to 1 167 167
  62 + * <=0 SOLID ON
  63 + */
51 64 static const struct ieee80211_tpt_blink iwl_blink[] = {
52   - { .throughput = 0 * 1024 - 1, .blink_time = 334 },
  65 + { .throughput = 0, .blink_time = 334 },
53 66 { .throughput = 1 * 1024 - 1, .blink_time = 260 },
54 67 { .throughput = 5 * 1024 - 1, .blink_time = 220 },
55 68 { .throughput = 10 * 1024 - 1, .blink_time = 190 },
... ... @@ -100,6 +113,11 @@
100 113  
101 114 if (priv->blink_on == on && priv->blink_off == off)
102 115 return 0;
  116 +
  117 + if (off == 0) {
  118 + /* led is SOLID_ON */
  119 + on = IWL_LED_SOLID;
  120 + }
103 121  
104 122 IWL_DEBUG_LED(priv, "Led blink time compensation=%u\n",
105 123 priv->cfg->base_params->led_compensation);
drivers/net/wireless/iwlegacy/iwl4965-base.c
... ... @@ -2992,16 +2992,16 @@
2992 2992 struct iwl_priv *priv = container_of(work, struct iwl_priv,
2993 2993 txpower_work);
2994 2994  
  2995 + mutex_lock(&priv->mutex);
  2996 +
2995 2997 /* If a scan happened to start before we got here
2996 2998 * then just return; the statistics notification will
2997 2999 * kick off another scheduled work to compensate for
2998 3000 * any temperature delta we missed here. */
2999 3001 if (test_bit(STATUS_EXIT_PENDING, &priv->status) ||
3000 3002 test_bit(STATUS_SCANNING, &priv->status))
3001   - return;
  3003 + goto out;
3002 3004  
3003   - mutex_lock(&priv->mutex);
3004   -
3005 3005 /* Regardless of if we are associated, we must reconfigure the
3006 3006 * TX power since frames can be sent on non-radar channels while
3007 3007 * not associated */
... ... @@ -3010,7 +3010,7 @@
3010 3010 /* Update last_temperature to keep is_calib_needed from running
3011 3011 * when it isn't needed... */
3012 3012 priv->last_temperature = priv->temperature;
3013   -
  3013 +out:
3014 3014 mutex_unlock(&priv->mutex);
3015 3015 }
3016 3016  
drivers/net/wireless/iwlwifi/iwl-agn-tx.c
... ... @@ -582,12 +582,17 @@
582 582  
583 583 hdr_len = ieee80211_hdrlen(fc);
584 584  
585   - /* Find index into station table for destination station */
586   - sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
587   - if (sta_id == IWL_INVALID_STATION) {
588   - IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
589   - hdr->addr1);
590   - goto drop_unlock;
  585 + /* For management frames use broadcast id to do not break aggregation */
  586 + if (!ieee80211_is_data(fc))
  587 + sta_id = ctx->bcast_sta_id;
  588 + else {
  589 + /* Find index into station table for destination station */
  590 + sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
  591 + if (sta_id == IWL_INVALID_STATION) {
  592 + IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
  593 + hdr->addr1);
  594 + goto drop_unlock;
  595 + }
591 596 }
592 597  
593 598 IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
include/linux/usb/usbnet.h
... ... @@ -68,6 +68,7 @@
68 68 # define EVENT_RX_PAUSED 5
69 69 # define EVENT_DEV_WAKING 6
70 70 # define EVENT_DEV_ASLEEP 7
  71 +# define EVENT_DEV_OPEN 8
71 72 };
72 73  
73 74 static inline struct usb_driver *driver_of(struct usb_interface *intf)
... ... @@ -4783,7 +4783,7 @@
4783 4783 * is never reached
4784 4784 */
4785 4785 WARN_ON(1);
4786   - err = -EINVAL;
  4786 + err = -ENOTTY;
4787 4787 break;
4788 4788  
4789 4789 }
... ... @@ -5051,7 +5051,7 @@
5051 5051 /* Set the per device memory buffer space.
5052 5052 * Not applicable in our case */
5053 5053 case SIOCSIFLINK:
5054   - return -EINVAL;
  5054 + return -ENOTTY;
5055 5055  
5056 5056 /*
5057 5057 * Unknown or private ioctl.
... ... @@ -5072,7 +5072,7 @@
5072 5072 /* Take care of Wireless Extensions */
5073 5073 if (cmd >= SIOCIWFIRST && cmd <= SIOCIWLAST)
5074 5074 return wext_handle_ioctl(net, &ifr, cmd, arg);
5075   - return -EINVAL;
  5075 + return -ENOTTY;
5076 5076 }
5077 5077 }
5078 5078  
... ... @@ -41,12 +41,12 @@
41 41 default n
42 42  
43 43 config NET_DSA_MV88E6131
44   - bool "Marvell 88E6095/6095F/6131 ethernet switch chip support"
  44 + bool "Marvell 88E6085/6095/6095F/6131 ethernet switch chip support"
45 45 select NET_DSA_MV88E6XXX
46 46 select NET_DSA_MV88E6XXX_NEED_PPU
47 47 select NET_DSA_TAG_DSA
48 48 ---help---
49   - This enables support for the Marvell 88E6095/6095F/6131
  49 + This enables support for the Marvell 88E6085/6095/6095F/6131
50 50 ethernet switch chips.
51 51  
52 52 config NET_DSA_MV88E6123_61_65
... ... @@ -207,8 +207,15 @@
207 207 * mode, but do not enable forwarding of unknown unicasts.
208 208 */
209 209 val = 0x0433;
210   - if (p == dsa_upstream_port(ds))
  210 + if (p == dsa_upstream_port(ds)) {
211 211 val |= 0x0104;
  212 + /*
  213 + * On 6085, unknown multicast forward is controlled
  214 + * here rather than in Port Control 2 register.
  215 + */
  216 + if (ps->id == ID_6085)
  217 + val |= 0x0008;
  218 + }
212 219 if (ds->dsa_port_mask & (1 << p))
213 220 val |= 0x0100;
214 221 REG_WRITE(addr, 0x04, val);
... ... @@ -251,10 +258,19 @@
251 258 * If this is the upstream port for this switch, enable
252 259 * forwarding of unknown multicast addresses.
253 260 */
254   - val = 0x0080 | dsa_upstream_port(ds);
255   - if (p == dsa_upstream_port(ds))
256   - val |= 0x0040;
257   - REG_WRITE(addr, 0x08, val);
  261 + if (ps->id == ID_6085)
  262 + /*
  263 + * on 6085, bits 3:0 are reserved, bit 6 control ARP
  264 + * mirroring, and multicast forward is handled in
  265 + * Port Control register.
  266 + */
  267 + REG_WRITE(addr, 0x08, 0x0080);
  268 + else {
  269 + val = 0x0080 | dsa_upstream_port(ds);
  270 + if (p == dsa_upstream_port(ds))
  271 + val |= 0x0040;
  272 + REG_WRITE(addr, 0x08, val);
  273 + }
258 274  
259 275 /*
260 276 * Rate Control: disable ingress rate limiting.
... ... @@ -1680,7 +1680,7 @@
1680 1680 return;
1681 1681  
1682 1682 cnf->sysctl = NULL;
1683   - unregister_sysctl_table(t->sysctl_header);
  1683 + unregister_net_sysctl_table(t->sysctl_header);
1684 1684 kfree(t->dev_name);
1685 1685 kfree(t);
1686 1686 }
... ... @@ -1998,9 +1998,6 @@
1998 1998 t = (struct trie *) tb->tb_data;
1999 1999 memset(t, 0, sizeof(*t));
2000 2000  
2001   - if (id == RT_TABLE_LOCAL)
2002   - pr_info("IPv4 FIB: Using LC-trie version %s\n", VERSION);
2003   -
2004 2001 return tb;
2005 2002 }
2006 2003  
net/ipv4/ip_fragment.c
... ... @@ -223,31 +223,30 @@
223 223  
224 224 if ((qp->q.last_in & INET_FRAG_FIRST_IN) && qp->q.fragments != NULL) {
225 225 struct sk_buff *head = qp->q.fragments;
  226 + const struct iphdr *iph;
  227 + int err;
226 228  
227 229 rcu_read_lock();
228 230 head->dev = dev_get_by_index_rcu(net, qp->iif);
229 231 if (!head->dev)
230 232 goto out_rcu_unlock;
231 233  
  234 + /* skb dst is stale, drop it, and perform route lookup again */
  235 + skb_dst_drop(head);
  236 + iph = ip_hdr(head);
  237 + err = ip_route_input_noref(head, iph->daddr, iph->saddr,
  238 + iph->tos, head->dev);
  239 + if (err)
  240 + goto out_rcu_unlock;
  241 +
232 242 /*
233   - * Only search router table for the head fragment,
234   - * when defraging timeout at PRE_ROUTING HOOK.
  243 + * Only an end host needs to send an ICMP
  244 + * "Fragment Reassembly Timeout" message, per RFC792.
235 245 */
236   - if (qp->user == IP_DEFRAG_CONNTRACK_IN && !skb_dst(head)) {
237   - const struct iphdr *iph = ip_hdr(head);
238   - int err = ip_route_input(head, iph->daddr, iph->saddr,
239   - iph->tos, head->dev);
240   - if (unlikely(err))
241   - goto out_rcu_unlock;
  246 + if (qp->user == IP_DEFRAG_CONNTRACK_IN &&
  247 + skb_rtable(head)->rt_type != RTN_LOCAL)
  248 + goto out_rcu_unlock;
242 249  
243   - /*
244   - * Only an end host needs to send an ICMP
245   - * "Fragment Reassembly Timeout" message, per RFC792.
246   - */
247   - if (skb_rtable(head)->rt_type != RTN_LOCAL)
248   - goto out_rcu_unlock;
249   -
250   - }
251 250  
252 251 /* Send an ICMP "Fragment Reassembly Timeout" message. */
253 252 icmp_send(head, ICMP_TIME_EXCEEDED, ICMP_EXC_FRAGTIME, 0);
... ... @@ -4539,7 +4539,7 @@
4539 4539  
4540 4540 t = p->sysctl;
4541 4541 p->sysctl = NULL;
4542   - unregister_sysctl_table(t->sysctl_header);
  4542 + unregister_net_sysctl_table(t->sysctl_header);
4543 4543 kfree(t->dev_name);
4544 4544 kfree(t);
4545 4545 }
... ... @@ -371,7 +371,7 @@
371 371 iv = esp_tmp_iv(aead, tmp, seqhilen);
372 372 req = esp_tmp_req(aead, iv);
373 373 asg = esp_req_sg(aead, req);
374   - sg = asg + 1;
  374 + sg = asg + sglists;
375 375  
376 376 skb->ip_summed = CHECKSUM_NONE;
377 377  
... ... @@ -524,6 +524,8 @@
524 524 int, int);
525 525 static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
526 526 struct msghdr *, size_t);
  527 +static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
  528 + struct msghdr *, size_t, int);
527 529  
528 530 static const struct proto_ops unix_stream_ops = {
529 531 .family = PF_UNIX,
... ... @@ -583,7 +585,7 @@
583 585 .setsockopt = sock_no_setsockopt,
584 586 .getsockopt = sock_no_getsockopt,
585 587 .sendmsg = unix_seqpacket_sendmsg,
586   - .recvmsg = unix_dgram_recvmsg,
  588 + .recvmsg = unix_seqpacket_recvmsg,
587 589 .mmap = sock_no_mmap,
588 590 .sendpage = sock_no_sendpage,
589 591 };
... ... @@ -1697,6 +1699,18 @@
1697 1699 msg->msg_namelen = 0;
1698 1700  
1699 1701 return unix_dgram_sendmsg(kiocb, sock, msg, len);
  1702 +}
  1703 +
  1704 +static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
  1705 + struct msghdr *msg, size_t size,
  1706 + int flags)
  1707 +{
  1708 + struct sock *sk = sock->sk;
  1709 +
  1710 + if (sk->sk_state != TCP_ESTABLISHED)
  1711 + return -ENOTCONN;
  1712 +
  1713 + return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
1700 1714 }
1701 1715  
1702 1716 static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
net/xfrm/xfrm_replay.c
... ... @@ -532,7 +532,7 @@
532 532  
533 533 if (replay_esn) {
534 534 if (replay_esn->replay_window >
535   - replay_esn->bmp_len * sizeof(__u32))
  535 + replay_esn->bmp_len * sizeof(__u32) * 8)
536 536 return -EINVAL;
537 537  
538 538 if ((x->props.flags & XFRM_STATE_ESN) && x->replay_esn)
net/xfrm/xfrm_user.c
... ... @@ -124,6 +124,9 @@
124 124 {
125 125 struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
126 126  
  127 + if ((p->flags & XFRM_STATE_ESN) && !rt)
  128 + return -EINVAL;
  129 +
127 130 if (!rt)
128 131 return 0;
129 132