SUNRPC: Fix xs_setup_bc_tcp()

[safe/jmp/linux-2.6] / net / ipv6 / udp.c

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index a7af9d6..9082485 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -34,6 +34,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 
 #include <net/ndisc.h>
@@ -258,8 +259,8 @@ static struct sock *__udp6_lib_lookup(struct net *net,
                        if (hslot->count < hslot2->count)
                                goto begin;
 
-                       result = udp6_lib_lookup2(net, &in6addr_any, sport,
-                                                 daddr, hnum, dif,
+                       result = udp6_lib_lookup2(net, saddr, sport,
+                                                 &in6addr_any, hnum, dif,
                                                  hslot2, slot2);
                }
                rcu_read_unlock();
@@ -583,16 +584,20 @@ static void flush_stack(struct sock **stack, unsigned int count,
                        bh_lock_sock(sk);
                        if (!sock_owned_by_user(sk))
                                udpv6_queue_rcv_skb(sk, skb1);
-                       else
-                               sk_add_backlog(sk, skb1);
+                       else if (sk_add_backlog(sk, skb1)) {
+                               kfree_skb(skb1);
+                               bh_unlock_sock(sk);
+                               goto drop;
+                       }
                        bh_unlock_sock(sk);
-               } else {
-                       atomic_inc(&sk->sk_drops);
-                       UDP6_INC_STATS_BH(sock_net(sk),
-                                       UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
-                       UDP6_INC_STATS_BH(sock_net(sk),
-                                       UDP_MIB_INERRORS, IS_UDPLITE(sk));
+                       continue;
                }
+drop:
+               atomic_inc(&sk->sk_drops);
+               UDP6_INC_STATS_BH(sock_net(sk),
+                               UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+               UDP6_INC_STATS_BH(sock_net(sk),
+                               UDP_MIB_INERRORS, IS_UDPLITE(sk));
        }
 }
 /*
@@ -680,12 +685,11 @@ static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh,
 int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                   int proto)
 {
+       struct net *net = dev_net(skb->dev);
        struct sock *sk;
        struct udphdr *uh;
-       struct net_device *dev = skb->dev;
        struct in6_addr *saddr, *daddr;
        u32 ulen = 0;
-       struct net *net = dev_net(skb->dev);
 
        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                goto short_packet;
@@ -744,7 +748,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
                                proto == IPPROTO_UDPLITE);
 
-               icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
+               icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
 
                kfree_skb(skb);
                return 0;
@@ -755,8 +759,12 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        bh_lock_sock(sk);
        if (!sock_owned_by_user(sk))
                udpv6_queue_rcv_skb(sk, skb);
-       else
-               sk_add_backlog(sk, skb);
+       else if (sk_add_backlog(sk, skb)) {
+               atomic_inc(&sk->sk_drops);
+               bh_unlock_sock(sk);
+               sock_put(sk);
+               goto discard;
+       }
        bh_unlock_sock(sk);
        sock_put(sk);
        return 0;