Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (23 commits)
  [IPV4]: OOPS with NETLINK_FIB_LOOKUP netlink socket
  [NET]: Fix function put_cmsg() which may cause usr application memory overflow
  [ATM]: Spelling fixes
  [NETFILTER] ipv4: Spelling fixes
  [NETFILTER]: Spelling fixes
  [SCTP]: Spelling fixes
  [NETLABEL]: Spelling fixes
  [PKT_SCHED]: Spelling fixes
  [NET] net/core/: Spelling fixes
  [IPV6]: Spelling fixes
  [IRDA]: Spelling fixes
  [DCCP]: Spelling fixes
  [NET] include/net/: Spelling fixes
  [NET]: Correct two mistaken skb_reset_mac_header() conversions.
  [IPV4] ip_gre: set mac_header correctly in receive path
  [XFRM]: Audit function arguments misordered
  [IPSEC]: Avoid undefined shift operation when testing algorithm ID
  [IPV4] ARP: Remove not used code
  [TG3]: Endianness bugfix.
  [TG3]: Endianness annotations.
  ...

drivers/atm/firestream.c

@@ -171,8 +171,8 @@ static char *res_strings[] = {
 	"packet purged", 
 	"packet ageing timeout", 
 	"channel ageing timeout", 
-	"calculated lenght error", 
-	"programmed lenght limit error", 
+	"calculated length error", 
+	"programmed length limit error", 
 	"aal5 crc32 error", 
 	"oam transp or transpc crc10 error", 
 	"reserved 25", 

drivers/net/tg3.c

@@ -8189,14 +8189,16 @@ static int tg3_get_eeprom_len(struct net_device *dev)
 }
 
 static int tg3_nvram_read(struct tg3 *tp, u32 offset, u32 *val);
+static int tg3_nvram_read_le(struct tg3 *tp, u32 offset, __le32 *val);
 static int tg3_nvram_read_swab(struct tg3 *tp, u32 offset, u32 *val);
 
 static int tg3_get_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom, u8 *data)
 {
 	struct tg3 *tp = netdev_priv(dev);
 	int ret;
 	u8  *pd;
-	u32 i, offset, len, val, b_offset, b_count;
+	u32 i, offset, len, b_offset, b_count;
+	__le32 val;
 
 	if (tp->link_config.phy_is_low_power)
 		return -EAGAIN;
@@ -8215,10 +8217,9 @@ static int tg3_get_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
 			/* i.e. offset=1 len=2 */
 			b_count = len;
 		}
-		ret = tg3_nvram_read(tp, offset-b_offset, &val);
+		ret = tg3_nvram_read_le(tp, offset-b_offset, &val);
 		if (ret)
 			return ret;
-		val = cpu_to_le32(val);
 		memcpy(data, ((char*)&val) + b_offset, b_count);
 		len -= b_count;
 		offset += b_count;
@@ -8228,12 +8229,11 @@ static int tg3_get_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
 	/* read bytes upto the last 4 byte boundary */
 	pd = &data[eeprom->len];
 	for (i = 0; i < (len - (len & 3)); i += 4) {
-		ret = tg3_nvram_read(tp, offset + i, &val);
+		ret = tg3_nvram_read_le(tp, offset + i, &val);
 		if (ret) {
 			eeprom->len += i;
 			return ret;
 		}
-		val = cpu_to_le32(val);
 		memcpy(pd + i, &val, 4);
 	}
 	eeprom->len += i;
@@ -8243,11 +8243,10 @@ static int tg3_get_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
 		pd = &data[eeprom->len];
 		b_count = len & 3;
 		b_offset = offset + len - b_count;
-		ret = tg3_nvram_read(tp, b_offset, &val);
+		ret = tg3_nvram_read_le(tp, b_offset, &val);
 		if (ret)
 			return ret;
-		val = cpu_to_le32(val);
-		memcpy(pd, ((char*)&val), b_count);
+		memcpy(pd, &val, b_count);
 		eeprom->len += b_count;
 	}
 	return 0;
@@ -8259,8 +8258,9 @@ static int tg3_set_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
 {
 	struct tg3 *tp = netdev_priv(dev);
 	int ret;
-	u32 offset, len, b_offset, odd_len, start, end;
+	u32 offset, len, b_offset, odd_len;
 	u8 *buf;
+	__le32 start, end;
 
 	if (tp->link_config.phy_is_low_power)
 		return -EAGAIN;
@@ -8273,10 +8273,9 @@ static int tg3_set_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
 
 	if ((b_offset = (offset & 3))) {
 		/* adjustments to start on required 4 byte boundary */
-		ret = tg3_nvram_read(tp, offset-b_offset, &start);
+		ret = tg3_nvram_read_le(tp, offset-b_offset, &start);
 		if (ret)
 			return ret;
-		start = cpu_to_le32(start);
 		len += b_offset;
 		offset &= ~3;
 		if (len < 4)
@@ -8288,10 +8287,9 @@ static int tg3_set_eeprom(struct net_device *dev, struct ethtool_eeprom *eeprom,
 		/* adjustments to end on required 4 byte boundary */
 		odd_len = 1;
 		len = (len + 3) & ~3;
-		ret = tg3_nvram_read(tp, offset+len-4, &end);
+		ret = tg3_nvram_read_le(tp, offset+len-4, &end);
 		if (ret)
 			return ret;
-		end = cpu_to_le32(end);
 	}
 
 	buf = data;
@@ -8734,7 +8732,8 @@ static void tg3_get_ethtool_stats (struct net_device *dev,
 
 static int tg3_test_nvram(struct tg3 *tp)
 {
-	u32 *buf, csum, magic;
+	u32 csum, magic;
+	__le32 *buf;
 	int i, j, k, err = 0, size;
 
 	if (tg3_nvram_read_swab(tp, 0, &magic) != 0)
@@ -8771,21 +8770,19 @@ static int tg3_test_nvram(struct tg3 *tp)
 
 	err = -EIO;
 	for (i = 0, j = 0; i < size; i += 4, j++) {
-		u32 val;
-
-		if ((err = tg3_nvram_read(tp, i, &val)) != 0)
+		if ((err = tg3_nvram_read_le(tp, i, &buf[j])) != 0)
 			break;
-		buf[j] = cpu_to_le32(val);
 	}
 	if (i < size)
 		goto out;
 
 	/* Selfboot format */
-	if ((cpu_to_be32(buf[0]) & TG3_EEPROM_MAGIC_FW_MSK) ==
+	magic = swab32(le32_to_cpu(buf[0]));
+	if ((magic & TG3_EEPROM_MAGIC_FW_MSK) ==
 	    TG3_EEPROM_MAGIC_FW) {
 		u8 *buf8 = (u8 *) buf, csum8 = 0;
 
-		if ((cpu_to_be32(buf[0]) & TG3_EEPROM_SB_REVISION_MASK) ==
+		if ((magic & TG3_EEPROM_SB_REVISION_MASK) ==
 		    TG3_EEPROM_SB_REVISION_2) {
 			/* For rev 2, the csum doesn't include the MBA. */
 			for (i = 0; i < TG3_EEPROM_SB_F1R2_MBA_OFF; i++)
@@ -8806,7 +8803,7 @@ static int tg3_test_nvram(struct tg3 *tp)
 		goto out;
 	}
 
-	if ((cpu_to_be32(buf[0]) & TG3_EEPROM_MAGIC_HW_MSK) ==
+	if ((magic & TG3_EEPROM_MAGIC_HW_MSK) ==
 	    TG3_EEPROM_MAGIC_HW) {
 		u8 data[NVRAM_SELFBOOT_DATA_SIZE];
 	       	u8 parity[NVRAM_SELFBOOT_DATA_SIZE];
@@ -8852,12 +8849,12 @@ static int tg3_test_nvram(struct tg3 *tp)
 
 	/* Bootstrap checksum at offset 0x10 */
 	csum = calc_crc((unsigned char *) buf, 0x10);
-	if(csum != cpu_to_le32(buf[0x10/4]))
+	if(csum != le32_to_cpu(buf[0x10/4]))
 		goto out;
 
 	/* Manufacturing block starts at offset 0x74, checksum at 0xfc */
 	csum = calc_crc((unsigned char *) &buf[0x74/4], 0x88);
-	if (csum != cpu_to_le32(buf[0xfc/4]))
+	if (csum != le32_to_cpu(buf[0xfc/4]))
 		 goto out;
 
 	err = 0;
@@ -10171,6 +10168,15 @@ static int tg3_nvram_read(struct tg3 *tp, u32 offset, u32 *val)
 	return ret;
 }
 
+static int tg3_nvram_read_le(struct tg3 *tp, u32 offset, __le32 *val)
+{
+	u32 v;
+	int res = tg3_nvram_read(tp, offset, &v);
+	if (!res)
+		*val = cpu_to_le32(v);
+	return res;
+}
+
 static int tg3_nvram_read_swab(struct tg3 *tp, u32 offset, u32 *val)
 {
 	int err;
@@ -10188,13 +10194,14 @@ static int tg3_nvram_write_block_using_eeprom(struct tg3 *tp,
 	u32 val;
 
 	for (i = 0; i < len; i += 4) {
-		u32 addr, data;
+		u32 addr;
+		__le32 data;
 
 		addr = offset + i;
 
 		memcpy(&data, buf + i, 4);
 
-		tw32(GRC_EEPROM_DATA, cpu_to_le32(data));
+		tw32(GRC_EEPROM_DATA, le32_to_cpu(data));
 
 		val = tr32(GRC_EEPROM_ADDR);
 		tw32(GRC_EEPROM_ADDR, val | EEPROM_ADDR_COMPLETE);
@@ -10244,8 +10251,8 @@ static int tg3_nvram_write_block_unbuffered(struct tg3 *tp, u32 offset, u32 len,
 		phy_addr = offset & ~pagemask;
 
 		for (j = 0; j < pagesize; j += 4) {
-			if ((ret = tg3_nvram_read(tp, phy_addr + j,
-						(u32 *) (tmp + j))))
+			if ((ret = tg3_nvram_read_le(tp, phy_addr + j,
+						(__le32 *) (tmp + j))))
 				break;
 		}
 		if (ret)
@@ -10289,10 +10296,11 @@ static int tg3_nvram_write_block_unbuffered(struct tg3 *tp, u32 offset, u32 len,
 			break;
 
 		for (j = 0; j < pagesize; j += 4) {
-			u32 data;
+			__be32 data;
 
-	    		data = *((u32 *) (tmp + j));
-			tw32(NVRAM_WRDATA, cpu_to_be32(data));
+			data = *((__be32 *) (tmp + j));
+			/* swab32(le32_to_cpu(data)), actually */
+			tw32(NVRAM_WRDATA, be32_to_cpu(data));
 
 			tw32(NVRAM_ADDR, phy_addr + j);
 
@@ -10326,10 +10334,11 @@ static int tg3_nvram_write_block_buffered(struct tg3 *tp, u32 offset, u32 len,
 	int i, ret = 0;
 
 	for (i = 0; i < len; i += 4, offset += 4) {
-		u32 data, page_off, phy_addr, nvram_cmd;
+		u32 page_off, phy_addr, nvram_cmd;
+		__be32 data;
 
 		memcpy(&data, buf + i, 4);
-		tw32(NVRAM_WRDATA, cpu_to_be32(data));
+		tw32(NVRAM_WRDATA, be32_to_cpu(data));
 
 	        page_off = offset % tp->nvram_pagesize;
 
@@ -10831,6 +10840,7 @@ static void __devinit tg3_read_partno(struct tg3 *tp)
 		vpd_cap = pci_find_capability(tp->pdev, PCI_CAP_ID_VPD);
 		for (i = 0; i < 256; i += 4) {
 			u32 tmp, j = 0;
+			__le32 v;
 			u16 tmp16;
 
 			pci_write_config_word(tp->pdev, vpd_cap + PCI_VPD_ADDR,
@@ -10847,8 +10857,8 @@ static void __devinit tg3_read_partno(struct tg3 *tp)
 
 			pci_read_config_dword(tp->pdev, vpd_cap + PCI_VPD_DATA,
 					      &tmp);
-			tmp = cpu_to_le32(tmp);
-			memcpy(&vpd_data[i], &tmp, 4);
+			v = cpu_to_le32(tmp);
+			memcpy(&vpd_data[i], &v, 4);
 		}
 	}
 
@@ -10941,11 +10951,11 @@ static void __devinit tg3_read_fw_ver(struct tg3 *tp)
 
 	offset = offset + ver_offset - start;
 	for (i = 0; i < 16; i += 4) {
-		if (tg3_nvram_read(tp, offset + i, &val))
+		__le32 v;
+		if (tg3_nvram_read_le(tp, offset + i, &v))
 			return;
 
-		val = le32_to_cpu(val);
-		memcpy(tp->fw_ver + i, &val, 4);
+		memcpy(tp->fw_ver + i, &v, 4);
 	}
 
 	if (!(tp->tg3_flags & TG3_FLAG_ENABLE_ASF) ||
@@ -10983,19 +10993,19 @@ static void __devinit tg3_read_fw_ver(struct tg3 *tp)
 	tp->fw_ver[bcnt++] = ' ';
 
 	for (i = 0; i < 4; i++) {
-		if (tg3_nvram_read(tp, offset, &val))
+		__le32 v;
+		if (tg3_nvram_read_le(tp, offset, &v))
 			return;
 
-		val = le32_to_cpu(val);
-		offset += sizeof(val);
+		offset += sizeof(v);
 
-		if (bcnt > TG3_VER_SIZE - sizeof(val)) {
-			memcpy(&tp->fw_ver[bcnt], &val, TG3_VER_SIZE - bcnt);
+		if (bcnt > TG3_VER_SIZE - sizeof(v)) {
+			memcpy(&tp->fw_ver[bcnt], &v, TG3_VER_SIZE - bcnt);
 			break;
 		}
 
-		memcpy(&tp->fw_ver[bcnt], &val, sizeof(val));
-		bcnt += sizeof(val);
+		memcpy(&tp->fw_ver[bcnt], &v, sizeof(v));
+		bcnt += sizeof(v);
 	}
 
 	tp->fw_ver[TG3_VER_SIZE - 1] = 0;

include/net/ax25.h

@@ -35,7 +35,7 @@
 #define AX25_P_ATALK			0xca	/* Appletalk                  */
 #define AX25_P_ATALK_ARP		0xcb	/* Appletalk ARP              */
 #define AX25_P_IP			0xcc	/* ARPA Internet Protocol     */
-#define AX25_P_ARP			0xcd	/* ARPA Adress Resolution     */
+#define AX25_P_ARP			0xcd	/* ARPA Address Resolution    */
 #define AX25_P_FLEXNET			0xce	/* FlexNet                    */
 #define AX25_P_NETROM 			0xcf	/* NET/ROM                    */
 #define AX25_P_TEXT 			0xF0	/* No layer 3 protocol impl.  */

include/net/ip6_tunnel.h

@@ -23,7 +23,7 @@ struct ip6_tnl {
 	struct net_device *dev;	/* virtual device associated with tunnel */
 	struct net_device_stats stat;	/* statistics for tunnel device */
 	int recursion;		/* depth of hard_start_xmit recursion */
-	struct ip6_tnl_parm parms;	/* tunnel configuration paramters */
+	struct ip6_tnl_parm parms;	/* tunnel configuration parameters */
 	struct flowi fl;	/* flowi template for xmit */
 	struct dst_entry *dst_cache;    /* cached dst */
 	u32 dst_cookie;

include/net/irda/discovery.h

@@ -80,7 +80,7 @@ typedef struct discovery_t {
 	irda_queue_t	q;		/* Must be first! */
 
 	discinfo_t	data;		/* Basic discovery information */
-	int		name_len;	/* Lenght of nickname */
+	int		name_len;	/* Length of nickname */
 
 	LAP_REASON	condition;	/* More info about the discovery */
 	int		gen_addr_bit;	/* Need to generate a new device

include/net/sctp/structs.h

@@ -301,7 +301,7 @@ struct sctp_sock {
 	/* The default SACK delay timeout for new associations. */
 	__u32 sackdelay;
 
-	/* Flags controling Heartbeat, SACK delay, and Path MTU Discovery. */
+	/* Flags controlling Heartbeat, SACK delay, and Path MTU Discovery. */
 	__u32 param_flags;
 
 	struct sctp_initmsg initmsg;
@@ -955,7 +955,7 @@ struct sctp_transport {
 	/* PMTU	      : The current known path MTU.  */
 	__u32 pathmtu;
 
-	/* Flags controling Heartbeat, SACK delay, and Path MTU Discovery. */
+	/* Flags controlling Heartbeat, SACK delay, and Path MTU Discovery. */
 	__u32 param_flags;
 
 	/* The number of times INIT has been sent on this transport. */
@@ -1638,7 +1638,7 @@ struct sctp_association {
 	 */
 	__u32 pathmtu;
 
-	/* Flags controling Heartbeat, SACK delay, and Path MTU Discovery. */
+	/* Flags controlling Heartbeat, SACK delay, and Path MTU Discovery. */
 	__u32 param_flags;
 
 	/* SACK delay timeout */

net/ax25/ax25_in.c

@@ -124,7 +124,7 @@ int ax25_rx_iframe(ax25_cb *ax25, struct sk_buff *skb)
 		}
 
 		skb_pull(skb, 1);	/* Remove PID */
-		skb_reset_mac_header(skb);
+		skb->mac_header = skb->network_header;
 		skb_reset_network_header(skb);
 		skb->dev      = ax25->ax25_dev->dev;
 		skb->pkt_type = PACKET_HOST;

net/compat.c

@@ -254,6 +254,8 @@ int put_cmsg_compat(struct msghdr *kmsg, int level, int type, int len, void *dat
 	if (copy_to_user(CMSG_COMPAT_DATA(cm), data, cmlen - sizeof(struct compat_cmsghdr)))
 		return -EFAULT;
 	cmlen = CMSG_COMPAT_SPACE(len);
+	if (kmsg->msg_controllen < cmlen)
+		cmlen = kmsg->msg_controllen;
 	kmsg->msg_control += cmlen;
 	kmsg->msg_controllen -= cmlen;
 	return 0;

net/core/dev.c

@@ -2819,7 +2819,7 @@ void dev_set_allmulti(struct net_device *dev, int inc)
 /*
  *	Upload unicast and multicast address lists to device and
  *	configure RX filtering. When the device doesn't support unicast
- *	filtering it is put in promiscous mode while unicast addresses
+ *	filtering it is put in promiscuous mode while unicast addresses
  *	are present.
  */
 void __dev_set_rx_mode(struct net_device *dev)

net/core/scm.c

@@ -196,6 +196,8 @@ int put_cmsg(struct msghdr * msg, int level, int type, int len, void *data)
 	if (copy_to_user(CMSG_DATA(cm), data, cmlen - sizeof(struct cmsghdr)))
 		goto out;
 	cmlen = CMSG_SPACE(len);
+	if (msg->msg_controllen < cmlen)
+		cmlen = msg->msg_controllen;
 	msg->msg_control += cmlen;
 	msg->msg_controllen -= cmlen;
 	err = 0;

net/dccp/ackvec.h

@@ -71,7 +71,7 @@ struct dccp_ackvec {
  * @dccpavr_ack_ackno - sequence number being acknowledged
  * @dccpavr_ack_ptr - pointer into dccpav_buf where this record starts
  * @dccpavr_ack_nonce - dccpav_ack_nonce at the time this record was sent
- * @dccpavr_sent_len - lenght of the record in dccpav_buf
+ * @dccpavr_sent_len - length of the record in dccpav_buf
  */
 struct dccp_ackvec_record {
 	struct list_head dccpavr_node;