Merge rsync://oss.sgi.com/git/xfs-2.6

[linux-2.6-omap-h63xx.git] / net / ipv6 / raw.c

diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1352c1d9bf4d35f6619d3dce4996b69578bdb2d2..e2b848ec98513ac9ababcc9f3d588c0fd93efc84 100644 (file)
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -434,12 +434,12 @@ csum_copy_err:
        /* Clear queue. */
        if (flags&MSG_PEEK) {
                int clear = 0;
-               spin_lock_irq(&sk->sk_receive_queue.lock);
+               spin_lock_bh(&sk->sk_receive_queue.lock);
                if (skb == skb_peek(&sk->sk_receive_queue)) {
                        __skb_unlink(skb, &sk->sk_receive_queue);
                        clear = 1;
                }
-               spin_unlock_irq(&sk->sk_receive_queue.lock);
+               spin_unlock_bh(&sk->sk_receive_queue.lock);
                if (clear)
                        kfree_skb(skb);
        }
@@ -455,11 +455,11 @@ csum_copy_err:
 static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                                     struct raw6_sock *rp)
 {
-       struct inet_sock *inet = inet_sk(sk);
        struct sk_buff *skb;
        int err = 0;
        int offset;
        int len;
+       int total_len;
        u32 tmp_csum;
        u16 csum;
 
@@ -470,7 +470,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                goto out;
 
        offset = rp->offset;
-       if (offset >= inet->cork.length - 1) {
+       total_len = inet_sk(sk)->cork.length - (skb->nh.raw - skb->data);
+       if (offset >= total_len - 1) {
                err = -EINVAL;
                ip6_flush_pending_frames(sk);
                goto out;
@@ -514,7 +515,7 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
 
        tmp_csum = csum_ipv6_magic(&fl->fl6_src,
                                   &fl->fl6_dst,
-                                  inet->cork.length, fl->proto, tmp_csum);
+                                  total_len, fl->proto, tmp_csum);
 
        if (tmp_csum == 0)
                tmp_csum = -1;
@@ -970,11 +971,11 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
                        struct sk_buff *skb;
                        int amount = 0;
 
-                       spin_lock_irq(&sk->sk_receive_queue.lock);
+                       spin_lock_bh(&sk->sk_receive_queue.lock);
                        skb = skb_peek(&sk->sk_receive_queue);
                        if (skb != NULL)
                                amount = skb->tail - skb->h.raw;
-                       spin_unlock_irq(&sk->sk_receive_queue.lock);
+                       spin_unlock_bh(&sk->sk_receive_queue.lock);
                        return put_user(amount, (int __user *)arg);
                }