3 files changed, 34 insertions, 32 deletions

diff --git a/net/phonet/af_phonet.c b/net/phonet/af_phonet.c
index b9d97effebe..9d211f12582 100644
--- a/net/phonet/af_phonet.c
+++ b/net/phonet/af_phonet.c
@@ -33,9 +33,30 @@
 #include <net/phonet/phonet.h>
 #include <net/phonet/pn_dev.h>
 
-static struct net_proto_family phonet_proto_family;
-static struct phonet_protocol *phonet_proto_get(int protocol);
-static inline void phonet_proto_put(struct phonet_protocol *pp);
+/* Transport protocol registration */
+static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
+static DEFINE_SPINLOCK(proto_tab_lock);
+
+static struct phonet_protocol *phonet_proto_get(int protocol)
+{
+	struct phonet_protocol *pp;
+
+	if (protocol >= PHONET_NPROTO)
+		return NULL;
+
+	spin_lock(&proto_tab_lock);
+	pp = proto_tab[protocol];
+	if (pp && !try_module_get(pp->prot->owner))
+		pp = NULL;
+	spin_unlock(&proto_tab_lock);
+
+	return pp;
+}
+
+static inline void phonet_proto_put(struct phonet_protocol *pp)
+{
+	module_put(pp->prot->owner);
+}
 
 /* protocol family functions */
 
@@ -144,8 +165,8 @@ static int pn_send(struct sk_buff *skb, struct net_device *dev,
 	struct phonethdr *ph;
 	int err;
 
-	if (skb->len + 2 > 0xffff) {
-		/* Phonet length field would overflow */
+	if (skb->len + 2 > 0xffff /* Phonet length field limit */ ||
+	    skb->len + sizeof(struct phonethdr) > dev->mtu) {
 		err = -EMSGSIZE;
 		goto drop;
 	}
@@ -261,6 +282,8 @@ static inline int can_respond(struct sk_buff *skb)
 		return 0; /* we are not the destination */
 	if (ph->pn_res == PN_PREFIX && !pskb_may_pull(skb, 5))
 		return 0;
+	if (ph->pn_res == PN_COMMGR) /* indications */
+		return 0;
 
 	ph = pn_hdr(skb); /* re-acquires the pointer */
 	pm = pn_msg(skb);
@@ -309,7 +332,8 @@ static int send_reset_indications(struct sk_buff *rskb)
 
 	return pn_raw_send(data, sizeof(data), rskb->dev,
 				pn_object(oph->pn_sdev, 0x00),
-				pn_object(oph->pn_rdev, oph->pn_robj), 0x10);
+				pn_object(oph->pn_rdev, oph->pn_robj),
+				PN_COMMGR);
 }
 
 
@@ -372,10 +396,6 @@ static struct packet_type phonet_packet_type = {
 	.func = phonet_rcv,
 };
 
-/* Transport protocol registration */
-static struct phonet_protocol *proto_tab[PHONET_NPROTO] __read_mostly;
-static DEFINE_SPINLOCK(proto_tab_lock);
-
 int __init_or_module phonet_proto_register(int protocol,
 						struct phonet_protocol *pp)
 {
@@ -409,27 +429,6 @@ void phonet_proto_unregister(int protocol, struct phonet_protocol *pp)
 }
 EXPORT_SYMBOL(phonet_proto_unregister);
 
-static struct phonet_protocol *phonet_proto_get(int protocol)
-{
-	struct phonet_protocol *pp;
-
-	if (protocol >= PHONET_NPROTO)
-		return NULL;
-
-	spin_lock(&proto_tab_lock);
-	pp = proto_tab[protocol];
-	if (pp && !try_module_get(pp->prot->owner))
-		pp = NULL;
-	spin_unlock(&proto_tab_lock);
-
-	return pp;
-}
-
-static inline void phonet_proto_put(struct phonet_protocol *pp)
-{
-	module_put(pp->prot->owner);
-}
-
 /* Module registration */
 static int __init phonet_init(void)
 {
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index 53be9fc82aa..f93ff8ef47d 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -115,7 +115,7 @@ int phonet_address_del(struct net_device *dev, u8 addr)
 	pnd = __phonet_get(dev);
 	if (!pnd || !test_and_clear_bit(addr >> 2, pnd->addrs))
 		err = -EADDRNOTAVAIL;
-	if (bitmap_empty(pnd->addrs, 64))
+	else if (bitmap_empty(pnd->addrs, 64))
 		__phonet_device_free(pnd);
 	spin_unlock_bh(&pndevs.lock);
 	return err;
diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index b1770d66bc8..242fe8f8c32 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c
@@ -123,6 +123,7 @@ nla_put_failure:
 
 static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 {
+	struct net *net = sock_net(skb->sk);
 	struct phonet_device *pnd;
 	int dev_idx = 0, dev_start_idx = cb->args[0];
 	int addr_idx = 0, addr_start_idx = cb->args[1];
@@ -131,6 +132,8 @@ static int getaddr_dumpit(struct sk_buff *skb, struct netlink_callback *cb)
 	list_for_each_entry(pnd, &pndevs.list, list) {
 		u8 addr;
 
+		if (!net_eq(dev_net(pnd->netdev), net))
+			continue;
 		if (dev_idx > dev_start_idx)
 			addr_start_idx = 0;
 		if (dev_idx++ < dev_start_idx)