9 files changed, 46 insertions, 497 deletions

diff --git a/net/Kconfig b/net/Kconfig
index 93998a9c39c..ec93e7e38b3 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -4,6 +4,7 @@
 
 menuconfig NET
 	bool "Networking support"
+	select NLATTR
 	---help---
 	  Unless you really know what you are doing, you should say Y here.
 	  The reason is that some programs need kernel networking support even
diff --git a/net/bluetooth/hci_sysfs.c b/net/bluetooth/hci_sysfs.c
index 1a1f916be44..ed82796d4a0 100644
--- a/net/bluetooth/hci_sysfs.c
+++ b/net/bluetooth/hci_sysfs.c
@@ -140,7 +140,7 @@ static void del_conn(struct work_struct *work)
 		dev = device_find_child(&conn->dev, NULL, __match_tty);
 		if (!dev)
 			break;
-		device_move(dev, NULL);
+		device_move(dev, NULL, DPM_ORDER_DEV_LAST);
 		put_device(dev);
 	}
 
diff --git a/net/bluetooth/rfcomm/tty.c b/net/bluetooth/rfcomm/tty.c
index d030c69cb5a..abdc703a11d 100644
--- a/net/bluetooth/rfcomm/tty.c
+++ b/net/bluetooth/rfcomm/tty.c
@@ -731,7 +731,8 @@ static int rfcomm_tty_open(struct tty_struct *tty, struct file *filp)
 	remove_wait_queue(&dev->wait, &wait);
 
 	if (err == 0)
-		device_move(dev->tty_dev, rfcomm_get_device(dev));
+		device_move(dev->tty_dev, rfcomm_get_device(dev),
+			    DPM_ORDER_DEV_AFTER_PARENT);
 
 	rfcomm_tty_copy_pending(dev);
 
@@ -751,7 +752,7 @@ static void rfcomm_tty_close(struct tty_struct *tty, struct file *filp)
 
 	if (atomic_dec_and_test(&dev->opened)) {
 		if (dev->tty_dev->parent)
-			device_move(dev->tty_dev, NULL);
+			device_move(dev->tty_dev, NULL, DPM_ORDER_DEV_LAST);
 
 		/* Close DLC and dettach TTY */
 		rfcomm_dlc_close(dev->dlc, 0);
diff --git a/net/netfilter/nf_conntrack_pptp.c b/net/netfilter/nf_conntrack_pptp.c
index 72cca638a82..3807ac7faf4 100644
--- a/net/netfilter/nf_conntrack_pptp.c
+++ b/net/netfilter/nf_conntrack_pptp.c
@@ -66,7 +66,7 @@ void
 			     struct nf_conntrack_expect *exp) __read_mostly;
 EXPORT_SYMBOL_GPL(nf_nat_pptp_hook_expectfn);
 
-#if defined(DEBUG) || defined(CONFIG_DYNAMIC_PRINTK_DEBUG)
+#if defined(DEBUG) || defined(CONFIG_DYNAMIC_DEBUG)
 /* PptpControlMessageType names */
 const char *const pptp_msg_name[] = {
 	"UNKNOWN_MESSAGE",
diff --git a/net/netlink/Makefile b/net/netlink/Makefile
index e3589c2de49..bdd6ddf4e95 100644
--- a/net/netlink/Makefile
+++ b/net/netlink/Makefile
@@ -2,4 +2,4 @@
 # Makefile for the netlink driver.
 #
 
-obj-y  				:= af_netlink.o attr.o genetlink.o
+obj-y  				:= af_netlink.o genetlink.o
diff --git a/net/netlink/attr.c b/net/netlink/attr.c
deleted file mode 100644
index 56c3ce7fe29..00000000000
--- a/net/netlink/attr.c
+++ /dev/null
@@ -1,473 +0,0 @@
-/*
- * NETLINK      Netlink attributes
- *
- * 		Authors:	Thomas Graf <tgraf@suug.ch>
- * 				Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
- */
-
-#include <linux/module.h>
-#include <linux/kernel.h>
-#include <linux/errno.h>
-#include <linux/jiffies.h>
-#include <linux/netdevice.h>
-#include <linux/skbuff.h>
-#include <linux/string.h>
-#include <linux/types.h>
-#include <net/netlink.h>
-
-static u16 nla_attr_minlen[NLA_TYPE_MAX+1] __read_mostly = {
-	[NLA_U8]	= sizeof(u8),
-	[NLA_U16]	= sizeof(u16),
-	[NLA_U32]	= sizeof(u32),
-	[NLA_U64]	= sizeof(u64),
-	[NLA_NESTED]	= NLA_HDRLEN,
-};
-
-static int validate_nla(struct nlattr *nla, int maxtype,
-			const struct nla_policy *policy)
-{
-	const struct nla_policy *pt;
-	int minlen = 0, attrlen = nla_len(nla), type = nla_type(nla);
-
-	if (type <= 0 || type > maxtype)
-		return 0;
-
-	pt = &policy[type];
-
-	BUG_ON(pt->type > NLA_TYPE_MAX);
-
-	switch (pt->type) {
-	case NLA_FLAG:
-		if (attrlen > 0)
-			return -ERANGE;
-		break;
-
-	case NLA_NUL_STRING:
-		if (pt->len)
-			minlen = min_t(int, attrlen, pt->len + 1);
-		else
-			minlen = attrlen;
-
-		if (!minlen || memchr(nla_data(nla), '\0', minlen) == NULL)
-			return -EINVAL;
-		/* fall through */
-
-	case NLA_STRING:
-		if (attrlen < 1)
-			return -ERANGE;
-
-		if (pt->len) {
-			char *buf = nla_data(nla);
-
-			if (buf[attrlen - 1] == '\0')
-				attrlen--;
-
-			if (attrlen > pt->len)
-				return -ERANGE;
-		}
-		break;
-
-	case NLA_BINARY:
-		if (pt->len && attrlen > pt->len)
-			return -ERANGE;
-		break;
-
-	case NLA_NESTED_COMPAT:
-		if (attrlen < pt->len)
-			return -ERANGE;
-		if (attrlen < NLA_ALIGN(pt->len))
-			break;
-		if (attrlen < NLA_ALIGN(pt->len) + NLA_HDRLEN)
-			return -ERANGE;
-		nla = nla_data(nla) + NLA_ALIGN(pt->len);
-		if (attrlen < NLA_ALIGN(pt->len) + NLA_HDRLEN + nla_len(nla))
-			return -ERANGE;
-		break;
-	case NLA_NESTED:
-		/* a nested attributes is allowed to be empty; if its not,
-		 * it must have a size of at least NLA_HDRLEN.
-		 */
-		if (attrlen == 0)
-			break;
-	default:
-		if (pt->len)
-			minlen = pt->len;
-		else if (pt->type != NLA_UNSPEC)
-			minlen = nla_attr_minlen[pt->type];
-
-		if (attrlen < minlen)
-			return -ERANGE;
-	}
-
-	return 0;
-}
-
-/**
- * nla_validate - Validate a stream of attributes
- * @head: head of attribute stream
- * @len: length of attribute stream
- * @maxtype: maximum attribute type to be expected
- * @policy: validation policy
- *
- * Validates all attributes in the specified attribute stream against the
- * specified policy. Attributes with a type exceeding maxtype will be
- * ignored. See documenation of struct nla_policy for more details.
- *
- * Returns 0 on success or a negative error code.
- */
-int nla_validate(struct nlattr *head, int len, int maxtype,
-		 const struct nla_policy *policy)
-{
-	struct nlattr *nla;
-	int rem, err;
-
-	nla_for_each_attr(nla, head, len, rem) {
-		err = validate_nla(nla, maxtype, policy);
-		if (err < 0)
-			goto errout;
-	}
-
-	err = 0;
-errout:
-	return err;
-}
-
-/**
- * nla_parse - Parse a stream of attributes into a tb buffer
- * @tb: destination array with maxtype+1 elements
- * @maxtype: maximum attribute type to be expected
- * @head: head of attribute stream
- * @len: length of attribute stream
- * @policy: validation policy
- *
- * Parses a stream of attributes and stores a pointer to each attribute in
- * the tb array accessable via the attribute type. Attributes with a type
- * exceeding maxtype will be silently ignored for backwards compatibility
- * reasons. policy may be set to NULL if no validation is required.
- *
- * Returns 0 on success or a negative error code.
- */
-int nla_parse(struct nlattr *tb[], int maxtype, struct nlattr *head, int len,
-	      const struct nla_policy *policy)
-{
-	struct nlattr *nla;
-	int rem, err;
-
-	memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
-
-	nla_for_each_attr(nla, head, len, rem) {
-		u16 type = nla_type(nla);
-
-		if (type > 0 && type <= maxtype) {
-			if (policy) {
-				err = validate_nla(nla, maxtype, policy);
-				if (err < 0)
-					goto errout;
-			}
-
-			tb[type] = nla;
-		}
-	}
-
-	if (unlikely(rem > 0))
-		printk(KERN_WARNING "netlink: %d bytes leftover after parsing "
-		       "attributes.\n", rem);
-
-	err = 0;
-errout:
-	return err;
-}
-
-/**
- * nla_find - Find a specific attribute in a stream of attributes
- * @head: head of attribute stream
- * @len: length of attribute stream
- * @attrtype: type of attribute to look for
- *
- * Returns the first attribute in the stream matching the specified type.
- */
-struct nlattr *nla_find(struct nlattr *head, int len, int attrtype)
-{
-	struct nlattr *nla;
-	int rem;
-
-	nla_for_each_attr(nla, head, len, rem)
-		if (nla_type(nla) == attrtype)
-			return nla;
-
-	return NULL;
-}
-
-/**
- * nla_strlcpy - Copy string attribute payload into a sized buffer
- * @dst: where to copy the string to
- * @nla: attribute to copy the string from
- * @dstsize: size of destination buffer
- *
- * Copies at most dstsize - 1 bytes into the destination buffer.
- * The result is always a valid NUL-terminated string. Unlike
- * strlcpy the destination buffer is always padded out.
- *
- * Returns the length of the source buffer.
- */
-size_t nla_strlcpy(char *dst, const struct nlattr *nla, size_t dstsize)
-{
-	size_t srclen = nla_len(nla);
-	char *src = nla_data(nla);
-
-	if (srclen > 0 && src[srclen - 1] == '\0')
-		srclen--;
-
-	if (dstsize > 0) {
-		size_t len = (srclen >= dstsize) ? dstsize - 1 : srclen;
-
-		memset(dst, 0, dstsize);
-		memcpy(dst, src, len);
-	}
-
-	return srclen;
-}
-
-/**
- * nla_memcpy - Copy a netlink attribute into another memory area
- * @dest: where to copy to memcpy
- * @src: netlink attribute to copy from
- * @count: size of the destination area
- *
- * Note: The number of bytes copied is limited by the length of
- *       attribute's payload. memcpy
- *
- * Returns the number of bytes copied.
- */
-int nla_memcpy(void *dest, const struct nlattr *src, int count)
-{
-	int minlen = min_t(int, count, nla_len(src));
-
-	memcpy(dest, nla_data(src), minlen);
-
-	return minlen;
-}
-
-/**
- * nla_memcmp - Compare an attribute with sized memory area
- * @nla: netlink attribute
- * @data: memory area
- * @size: size of memory area
- */
-int nla_memcmp(const struct nlattr *nla, const void *data,
-			     size_t size)
-{
-	int d = nla_len(nla) - size;
-
-	if (d == 0)
-		d = memcmp(nla_data(nla), data, size);
-
-	return d;
-}
-
-/**
- * nla_strcmp - Compare a string attribute against a string
- * @nla: netlink string attribute
- * @str: another string
- */
-int nla_strcmp(const struct nlattr *nla, const char *str)
-{
-	int len = strlen(str) + 1;
-	int d = nla_len(nla) - len;
-
-	if (d == 0)
-		d = memcmp(nla_data(nla), str, len);
-
-	return d;
-}
-
-/**
- * __nla_reserve - reserve room for attribute on the skb
- * @skb: socket buffer to reserve room on
- * @attrtype: attribute type
- * @attrlen: length of attribute payload
- *
- * Adds a netlink attribute header to a socket buffer and reserves
- * room for the payload but does not copy it.
- *
- * The caller is responsible to ensure that the skb provides enough
- * tailroom for the attribute header and payload.
- */
-struct nlattr *__nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
-{
-	struct nlattr *nla;
-
-	nla = (struct nlattr *) skb_put(skb, nla_total_size(attrlen));
-	nla->nla_type = attrtype;
-	nla->nla_len = nla_attr_size(attrlen);
-
-	memset((unsigned char *) nla + nla->nla_len, 0, nla_padlen(attrlen));
-
-	return nla;
-}
-
-/**
- * __nla_reserve_nohdr - reserve room for attribute without header
- * @skb: socket buffer to reserve room on
- * @attrlen: length of attribute payload
- *
- * Reserves room for attribute payload without a header.
- *
- * The caller is responsible to ensure that the skb provides enough
- * tailroom for the payload.
- */
-void *__nla_reserve_nohdr(struct sk_buff *skb, int attrlen)
-{
-	void *start;
-
-	start = skb_put(skb, NLA_ALIGN(attrlen));
-	memset(start, 0, NLA_ALIGN(attrlen));
-
-	return start;
-}
-
-/**
- * nla_reserve - reserve room for attribute on the skb
- * @skb: socket buffer to reserve room on
- * @attrtype: attribute type
- * @attrlen: length of attribute payload
- *
- * Adds a netlink attribute header to a socket buffer and reserves
- * room for the payload but does not copy it.
- *
- * Returns NULL if the tailroom of the skb is insufficient to store
- * the attribute header and payload.
- */
-struct nlattr *nla_reserve(struct sk_buff *skb, int attrtype, int attrlen)
-{
-	if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
-		return NULL;
-
-	return __nla_reserve(skb, attrtype, attrlen);
-}
-
-/**
- * nla_reserve_nohdr - reserve room for attribute without header
- * @skb: socket buffer to reserve room on
- * @attrlen: length of attribute payload
- *
- * Reserves room for attribute payload without a header.
- *
- * Returns NULL if the tailroom of the skb is insufficient to store
- * the attribute payload.
- */
-void *nla_reserve_nohdr(struct sk_buff *skb, int attrlen)
-{
-	if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-		return NULL;
-
-	return __nla_reserve_nohdr(skb, attrlen);
-}
-
-/**
- * __nla_put - Add a netlink attribute to a socket buffer
- * @skb: socket buffer to add attribute to
- * @attrtype: attribute type
- * @attrlen: length of attribute payload
- * @data: head of attribute payload
- *
- * The caller is responsible to ensure that the skb provides enough
- * tailroom for the attribute header and payload.
- */
-void __nla_put(struct sk_buff *skb, int attrtype, int attrlen,
-			     const void *data)
-{
-	struct nlattr *nla;
-
-	nla = __nla_reserve(skb, attrtype, attrlen);
-	memcpy(nla_data(nla), data, attrlen);
-}
-
-/**
- * __nla_put_nohdr - Add a netlink attribute without header
- * @skb: socket buffer to add attribute to
- * @attrlen: length of attribute payload
- * @data: head of attribute payload
- *
- * The caller is responsible to ensure that the skb provides enough
- * tailroom for the attribute payload.
- */
-void __nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
-{
-	void *start;
-
-	start = __nla_reserve_nohdr(skb, attrlen);
-	memcpy(start, data, attrlen);
-}
-
-/**
- * nla_put - Add a netlink attribute to a socket buffer
- * @skb: socket buffer to add attribute to
- * @attrtype: attribute type
- * @attrlen: length of attribute payload
- * @data: head of attribute payload
- *
- * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
- * the attribute header and payload.
- */
-int nla_put(struct sk_buff *skb, int attrtype, int attrlen, const void *data)
-{
-	if (unlikely(skb_tailroom(skb) < nla_total_size(attrlen)))
-		return -EMSGSIZE;
-
-	__nla_put(skb, attrtype, attrlen, data);
-	return 0;
-}
-
-/**
- * nla_put_nohdr - Add a netlink attribute without header
- * @skb: socket buffer to add attribute to
- * @attrlen: length of attribute payload
- * @data: head of attribute payload
- *
- * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
- * the attribute payload.
- */
-int nla_put_nohdr(struct sk_buff *skb, int attrlen, const void *data)
-{
-	if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-		return -EMSGSIZE;
-
-	__nla_put_nohdr(skb, attrlen, data);
-	return 0;
-}
-
-/**
- * nla_append - Add a netlink attribute without header or padding
- * @skb: socket buffer to add attribute to
- * @attrlen: length of attribute payload
- * @data: head of attribute payload
- *
- * Returns -EMSGSIZE if the tailroom of the skb is insufficient to store
- * the attribute payload.
- */
-int nla_append(struct sk_buff *skb, int attrlen, const void *data)
-{
-	if (unlikely(skb_tailroom(skb) < NLA_ALIGN(attrlen)))
-		return -EMSGSIZE;
-
-	memcpy(skb_put(skb, attrlen), data, attrlen);
-	return 0;
-}
-
-EXPORT_SYMBOL(nla_validate);
-EXPORT_SYMBOL(nla_parse);
-EXPORT_SYMBOL(nla_find);
-EXPORT_SYMBOL(nla_strlcpy);
-EXPORT_SYMBOL(__nla_reserve);
-EXPORT_SYMBOL(__nla_reserve_nohdr);
-EXPORT_SYMBOL(nla_reserve);
-EXPORT_SYMBOL(nla_reserve_nohdr);
-EXPORT_SYMBOL(__nla_put);
-EXPORT_SYMBOL(__nla_put_nohdr);
-EXPORT_SYMBOL(nla_put);
-EXPORT_SYMBOL(nla_put_nohdr);
-EXPORT_SYMBOL(nla_memcpy);
-EXPORT_SYMBOL(nla_memcmp);
-EXPORT_SYMBOL(nla_strcmp);
-EXPORT_SYMBOL(nla_append);
diff --git a/net/sunrpc/sched.c b/net/sunrpc/sched.c
index 385f427beda..ff50a054686 100644
--- a/net/sunrpc/sched.c
+++ b/net/sunrpc/sched.c
@@ -293,11 +293,6 @@ static void rpc_make_runnable(struct rpc_task *task)
 	rpc_clear_queued(task);
 	if (rpc_test_and_set_running(task))
 		return;
-	/* We might have raced */
-	if (RPC_IS_QUEUED(task)) {
-		rpc_clear_running(task);
-		return;
-	}
 	if (RPC_IS_ASYNC(task)) {
 		int status;
 
@@ -607,7 +602,9 @@ void rpc_release_calldata(const struct rpc_call_ops *ops, void *calldata)
  */
 static void __rpc_execute(struct rpc_task *task)
 {
-	int		status = 0;
+	struct rpc_wait_queue *queue;
+	int task_is_async = RPC_IS_ASYNC(task);
+	int status = 0;
 
 	dprintk("RPC: %5u __rpc_execute flags=0x%x\n",
 			task->tk_pid, task->tk_flags);
@@ -647,15 +644,25 @@ static void __rpc_execute(struct rpc_task *task)
 		 */
 		if (!RPC_IS_QUEUED(task))
 			continue;
-		rpc_clear_running(task);
-		if (RPC_IS_ASYNC(task)) {
-			/* Careful! we may have raced... */
-			if (RPC_IS_QUEUED(task))
-				return;
-			if (rpc_test_and_set_running(task))
-				return;
+		/*
+		 * The queue->lock protects against races with
+		 * rpc_make_runnable().
+		 *
+		 * Note that once we clear RPC_TASK_RUNNING on an asynchronous
+		 * rpc_task, rpc_make_runnable() can assign it to a
+		 * different workqueue. We therefore cannot assume that the
+		 * rpc_task pointer may still be dereferenced.
+		 */
+		queue = task->tk_waitqueue;
+		spin_lock_bh(&queue->lock);
+		if (!RPC_IS_QUEUED(task)) {
+			spin_unlock_bh(&queue->lock);
 			continue;
 		}
+		rpc_clear_running(task);
+		spin_unlock_bh(&queue->lock);
+		if (task_is_async)
+			return;
 
 		/* sync task: sleep here */
 		dprintk("RPC: %5u sync task going to sleep\n", task->tk_pid);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 29e401bb612..62098d101a1 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -663,7 +663,7 @@ void xprt_connect(struct rpc_task *task)
 			xprt, (xprt_connected(xprt) ? "is" : "is not"));
 
 	if (!xprt_bound(xprt)) {
-		task->tk_status = -EIO;
+		task->tk_status = -EAGAIN;
 		return;
 	}
 	if (!xprt_lock_write(xprt, task))
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index b49e434c094..568330eebbf 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -467,7 +467,7 @@ static int xs_sendpages(struct socket *sock, struct sockaddr *addr, int addrlen,
 	int err, sent = 0;
 
 	if (unlikely(!sock))
-		return -ENOTCONN;
+		return -ENOTSOCK;
 
 	clear_bit(SOCK_ASYNC_NOSPACE, &sock->flags);
 	if (base != 0) {
@@ -577,6 +577,8 @@ static int xs_udp_send_request(struct rpc_task *task)
 				req->rq_svec->iov_base,
 				req->rq_svec->iov_len);
 
+	if (!xprt_bound(xprt))
+		return -ENOTCONN;
 	status = xs_sendpages(transport->sock,
 			      xs_addr(xprt),
 			      xprt->addrlen, xdr,
@@ -594,6 +596,10 @@ static int xs_udp_send_request(struct rpc_task *task)
 	}
 
 	switch (status) {
+	case -ENOTSOCK:
+		status = -ENOTCONN;
+		/* Should we call xs_close() here? */
+		break;
 	case -EAGAIN:
 		xs_nospace(task);
 		break;
@@ -693,6 +699,10 @@ static int xs_tcp_send_request(struct rpc_task *task)
 	}
 
 	switch (status) {
+	case -ENOTSOCK:
+		status = -ENOTCONN;
+		/* Should we call xs_close() here? */
+		break;
 	case -EAGAIN:
 		xs_nospace(task);
 		break;
@@ -1512,7 +1522,7 @@ static void xs_udp_connect_worker4(struct work_struct *work)
 	struct socket *sock = transport->sock;
 	int err, status = -EIO;
 
-	if (xprt->shutdown || !xprt_bound(xprt))
+	if (xprt->shutdown)
 		goto out;
 
 	/* Start by resetting any existing state */
@@ -1553,7 +1563,7 @@ static void xs_udp_connect_worker6(struct work_struct *work)
 	struct socket *sock = transport->sock;
 	int err, status = -EIO;
 
-	if (xprt->shutdown || !xprt_bound(xprt))
+	if (xprt->shutdown)
 		goto out;
 
 	/* Start by resetting any existing state */
@@ -1637,6 +1647,9 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock)
 		write_unlock_bh(&sk->sk_callback_lock);
 	}
 
+	if (!xprt_bound(xprt))
+		return -ENOTCONN;
+
 	/* Tell the socket layer to start connecting... */
 	xprt->stat.connect_count++;
 	xprt->stat.connect_start = jiffies;
@@ -1657,7 +1670,7 @@ static void xs_tcp_connect_worker4(struct work_struct *work)
 	struct socket *sock = transport->sock;
 	int err, status = -EIO;
 
-	if (xprt->shutdown || !xprt_bound(xprt))
+	if (xprt->shutdown)
 		goto out;
 
 	if (!sock) {
@@ -1717,7 +1730,7 @@ static void xs_tcp_connect_worker6(struct work_struct *work)
 	struct socket *sock = transport->sock;
 	int err, status = -EIO;
 
-	if (xprt->shutdown || !xprt_bound(xprt))
+	if (xprt->shutdown)
 		goto out;
 
 	if (!sock) {