aboutsummaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
Diffstat (limited to 'net')
-rw-r--r--net/bridge/br.c3
-rw-r--r--net/ipv4/ipcomp.c2
-rw-r--r--net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c36
-rw-r--r--net/ipv4/netfilter/ip_nat_snmp_basic.c16
-rw-r--r--net/ipv4/xfrm4_policy.c2
-rw-r--r--net/ipv6/ipcomp6.c2
-rw-r--r--net/irda/iriap.c3
-rw-r--r--net/sunrpc/cache.c1
-rw-r--r--net/xfrm/xfrm_input.c2
9 files changed, 37 insertions, 30 deletions
diff --git a/net/bridge/br.c b/net/bridge/br.c
index 22d806cf40c..12da21afb9c 100644
--- a/net/bridge/br.c
+++ b/net/bridge/br.c
@@ -55,7 +55,7 @@ static int __init br_init(void)
static void __exit br_deinit(void)
{
- llc_sap_close(br_stp_sap);
+ rcu_assign_pointer(br_stp_sap->rcv_func, NULL);
#ifdef CONFIG_BRIDGE_NETFILTER
br_netfilter_fini();
@@ -67,6 +67,7 @@ static void __exit br_deinit(void)
synchronize_net();
+ llc_sap_put(br_stp_sap);
br_fdb_get_hook = NULL;
br_fdb_put_hook = NULL;
diff --git a/net/ipv4/ipcomp.c b/net/ipv4/ipcomp.c
index cd810f41af1..95278b22b66 100644
--- a/net/ipv4/ipcomp.c
+++ b/net/ipv4/ipcomp.c
@@ -210,7 +210,7 @@ static void ipcomp4_err(struct sk_buff *skb, u32 info)
skb->h.icmph->code != ICMP_FRAG_NEEDED)
return;
- spi = ntohl(ntohs(ipch->cpi));
+ spi = htonl(ntohs(ipch->cpi));
x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr,
spi, IPPROTO_COMP, AF_INET);
if (!x)
diff --git a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
index 355a53a5b6c..26dfecadb33 100644
--- a/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
+++ b/net/ipv4/netfilter/ip_conntrack_helper_h323_asn1.c
@@ -528,14 +528,15 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
/* Decode */
if ((err = (Decoders[son->type]) (bs, son, base,
- level + 1)) >
- H323_ERROR_STOP)
+ level + 1)) <
+ H323_ERROR_NONE)
return err;
bs->cur = beg + len;
bs->bit = 0;
} else if ((err = (Decoders[son->type]) (bs, son, base,
- level + 1)))
+ level + 1)) <
+ H323_ERROR_NONE)
return err;
}
@@ -554,7 +555,7 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
/* Decode the extension components */
for (opt = 0; opt < bmp2_len; opt++, i++, son++) {
- if (son->attr & STOP) {
+ if (i < f->ub && son->attr & STOP) {
PRINT("%*.s%s\n", (level + 1) * TAB_SIZE, " ",
son->name);
return H323_ERROR_STOP;
@@ -584,8 +585,8 @@ int decode_seq(bitstr_t * bs, field_t * f, char *base, int level)
beg = bs->cur;
if ((err = (Decoders[son->type]) (bs, son, base,
- level + 1)) >
- H323_ERROR_STOP)
+ level + 1)) <
+ H323_ERROR_NONE)
return err;
bs->cur = beg + len;
@@ -660,18 +661,20 @@ int decode_seqof(bitstr_t * bs, field_t * f, char *base, int level)
i <
effective_count ?
base : NULL,
- level + 1)) >
- H323_ERROR_STOP)
+ level + 1)) <
+ H323_ERROR_NONE)
return err;
bs->cur = beg + len;
bs->bit = 0;
} else
- if ((err = (Decoders[son->type]) (bs, son,
- i < effective_count ?
- base : NULL,
- level + 1)))
- return err;
+ if ((err = (Decoders[son->type]) (bs, son,
+ i <
+ effective_count ?
+ base : NULL,
+ level + 1)) <
+ H323_ERROR_NONE)
+ return err;
if (base)
base += son->offset;
@@ -735,13 +738,14 @@ int decode_choice(bitstr_t * bs, field_t * f, char *base, int level)
}
beg = bs->cur;
- if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) >
- H323_ERROR_STOP)
+ if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+ H323_ERROR_NONE)
return err;
bs->cur = beg + len;
bs->bit = 0;
- } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)))
+ } else if ((err = (Decoders[son->type]) (bs, son, base, level + 1)) <
+ H323_ERROR_NONE)
return err;
return H323_ERROR_NONE;
diff --git a/net/ipv4/netfilter/ip_nat_snmp_basic.c b/net/ipv4/netfilter/ip_nat_snmp_basic.c
index c6225384553..c33244263b9 100644
--- a/net/ipv4/netfilter/ip_nat_snmp_basic.c
+++ b/net/ipv4/netfilter/ip_nat_snmp_basic.c
@@ -768,6 +768,7 @@ static unsigned char snmp_object_decode(struct asn1_ctx *ctx,
len *= sizeof(unsigned long);
*obj = kmalloc(sizeof(struct snmp_object) + len, GFP_ATOMIC);
if (*obj == NULL) {
+ kfree(lp);
kfree(id);
if (net_ratelimit())
printk("OOM in bsalg (%d)\n", __LINE__);
@@ -1003,12 +1004,12 @@ static unsigned char snmp_trap_decode(struct asn1_ctx *ctx,
return 1;
+err_addr_free:
+ kfree((unsigned long *)trap->ip_address);
+
err_id_free:
kfree(trap->id);
-err_addr_free:
- kfree((unsigned long *)trap->ip_address);
-
return 0;
}
@@ -1126,11 +1127,10 @@ static int snmp_parse_mangle(unsigned char *msg,
struct snmp_v1_trap trap;
unsigned char ret = snmp_trap_decode(&ctx, &trap, map, check);
- /* Discard trap allocations regardless */
- kfree(trap.id);
- kfree((unsigned long *)trap.ip_address);
-
- if (!ret)
+ if (ret) {
+ kfree(trap.id);
+ kfree((unsigned long *)trap.ip_address);
+ } else
return ret;
} else {
diff --git a/net/ipv4/xfrm4_policy.c b/net/ipv4/xfrm4_policy.c
index f285bbf296e..8604c747bca 100644
--- a/net/ipv4/xfrm4_policy.c
+++ b/net/ipv4/xfrm4_policy.c
@@ -221,7 +221,7 @@ _decode_session4(struct sk_buff *skb, struct flowi *fl)
if (pskb_may_pull(skb, xprth + 4 - skb->data)) {
u16 *ipcomp_hdr = (u16 *)xprth;
- fl->fl_ipsec_spi = ntohl(ntohs(ipcomp_hdr[1]));
+ fl->fl_ipsec_spi = htonl(ntohs(ipcomp_hdr[1]));
}
break;
default:
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 05eb67def39..48636436028 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -208,7 +208,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
if (type != ICMPV6_DEST_UNREACH && type != ICMPV6_PKT_TOOBIG)
return;
- spi = ntohl(ntohs(ipcomph->cpi));
+ spi = htonl(ntohs(ipcomph->cpi));
x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
if (!x)
return;
diff --git a/net/irda/iriap.c b/net/irda/iriap.c
index 254f9074690..2d2e2b1919f 100644
--- a/net/irda/iriap.c
+++ b/net/irda/iriap.c
@@ -544,7 +544,8 @@ static void iriap_getvaluebyclass_response(struct iriap_cb *self,
{
struct sk_buff *tx_skb;
int n;
- __u32 tmp_be32, tmp_be16;
+ __u32 tmp_be32;
+ __be16 tmp_be16;
__u8 *fp;
IRDA_DEBUG(4, "%s()\n", __FUNCTION__);
diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c
index 3ac4193a78e..7026b0866b7 100644
--- a/net/sunrpc/cache.c
+++ b/net/sunrpc/cache.c
@@ -159,6 +159,7 @@ struct cache_head *sunrpc_cache_update(struct cache_detail *detail,
detail->update(tmp, new);
tmp->next = *head;
*head = tmp;
+ detail->entries++;
cache_get(tmp);
is_new = cache_fresh_locked(tmp, new->expiry_time);
cache_fresh_locked(old, 0);
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index b54971059f1..891a6090cc0 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -62,7 +62,7 @@ int xfrm_parse_spi(struct sk_buff *skb, u8 nexthdr, u32 *spi, u32 *seq)
case IPPROTO_COMP:
if (!pskb_may_pull(skb, sizeof(struct ip_comp_hdr)))
return -EINVAL;
- *spi = ntohl(ntohs(*(u16*)(skb->h.raw + 2)));
+ *spi = htonl(ntohs(*(u16*)(skb->h.raw + 2)));
*seq = 0;
return 0;
default: