Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.10/0169-3.10.70-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-3.10/0169-3.10.70-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2657 - (hide annotations) (download)
    Tue Jul 21 16:20:22 2015 UTC (8 years, 10 months ago) by niro
    File size: 18737 byte(s) 
    -linux-3.10.70
    1 niro 2657 diff --git a/Makefile b/Makefile
    2     index 81ede20061cf..402cbb7c27f1 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 3
    7     PATCHLEVEL = 10
    8     -SUBLEVEL = 69
    9     +SUBLEVEL = 70
    10     EXTRAVERSION =
    11     NAME = TOSSUG Baby Fish
    12    
    13     diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
    14     index 9951e66b8502..7e3f45105f11 100644
    15     --- a/drivers/block/rbd.c
    16     +++ b/drivers/block/rbd.c
    17     @@ -2149,7 +2149,6 @@ static void rbd_img_obj_callback(struct rbd_obj_request *obj_request)
    18     rbd_assert(img_request->obj_request_count > 0);
    19     rbd_assert(which != BAD_WHICH);
    20     rbd_assert(which < img_request->obj_request_count);
    21     - rbd_assert(which >= img_request->next_completion);
    22    
    23     spin_lock_irq(&img_request->completion_lock);
    24     if (which != img_request->next_completion)
    25     diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
    26     index e4561264e124..a895ed02da86 100644
    27     --- a/drivers/media/rc/ir-lirc-codec.c
    28     +++ b/drivers/media/rc/ir-lirc-codec.c
    29     @@ -42,11 +42,17 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
    30     return -EINVAL;
    31    
    32     /* Packet start */
    33     - if (ev.reset)
    34     - return 0;
    35     + if (ev.reset) {
    36     + /* Userspace expects a long space event before the start of
    37     + * the signal to use as a sync. This may be done with repeat
    38     + * packets and normal samples. But if a reset has been sent
    39     + * then we assume that a long time has passed, so we send a
    40     + * space with the maximum time value. */
    41     + sample = LIRC_SPACE(LIRC_VALUE_MASK);
    42     + IR_dprintk(2, "delivering reset sync space to lirc_dev\n");
    43    
    44     /* Carrier reports */
    45     - if (ev.carrier_report) {
    46     + } else if (ev.carrier_report) {
    47     sample = LIRC_FREQUENCY(ev.carrier);
    48     IR_dprintk(2, "carrier report (freq: %d)\n", sample);
    49    
    50     diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
    51     index af951f343ff6..50104a7e963f 100644
    52     --- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
    53     +++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
    54     @@ -2315,7 +2315,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
    55    
    56     work_done = netxen_process_rcv_ring(sds_ring, budget);
    57    
    58     - if ((work_done < budget) && tx_complete) {
    59     + if (!tx_complete)
    60     + work_done = budget;
    61     +
    62     + if (work_done < budget) {
    63     napi_complete(&sds_ring->napi);
    64     if (test_bit(__NX_DEV_UP, &adapter->state))
    65     netxen_nic_enable_int(sds_ring);
    66     diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
    67     index 602c625d95d5..b5edc7f96a39 100644
    68     --- a/drivers/net/ppp/ppp_deflate.c
    69     +++ b/drivers/net/ppp/ppp_deflate.c
    70     @@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf,
    71     /*
    72     * See if we managed to reduce the size of the packet.
    73     */
    74     - if (olen < isize) {
    75     + if (olen < isize && olen <= osize) {
    76     state->stats.comp_bytes += olen;
    77     state->stats.comp_packets++;
    78     } else {
    79     diff --git a/include/net/ip.h b/include/net/ip.h
    80     index 8695359982d1..0a62365149e2 100644
    81     --- a/include/net/ip.h
    82     +++ b/include/net/ip.h
    83     @@ -37,11 +37,12 @@ struct inet_skb_parm {
    84     struct ip_options opt; /* Compiled IP options */
    85     unsigned char flags;
    86    
    87     -#define IPSKB_FORWARDED 1
    88     -#define IPSKB_XFRM_TUNNEL_SIZE 2
    89     -#define IPSKB_XFRM_TRANSFORMED 4
    90     -#define IPSKB_FRAG_COMPLETE 8
    91     -#define IPSKB_REROUTED 16
    92     +#define IPSKB_FORWARDED BIT(0)
    93     +#define IPSKB_XFRM_TUNNEL_SIZE BIT(1)
    94     +#define IPSKB_XFRM_TRANSFORMED BIT(2)
    95     +#define IPSKB_FRAG_COMPLETE BIT(3)
    96     +#define IPSKB_REROUTED BIT(4)
    97     +#define IPSKB_DOREDIRECT BIT(5)
    98    
    99     u16 frag_max_size;
    100     };
    101     @@ -162,7 +163,7 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
    102     return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
    103     }
    104    
    105     -void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
    106     +void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
    107     __be32 saddr, const struct ip_reply_arg *arg,
    108     unsigned int len);
    109    
    110     diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
    111     index 2ba9de89e8ec..03e6378d5353 100644
    112     --- a/include/net/netns/ipv4.h
    113     +++ b/include/net/netns/ipv4.h
    114     @@ -43,6 +43,7 @@ struct netns_ipv4 {
    115     struct inet_peer_base *peers;
    116     struct tcpm_hash_bucket *tcp_metrics_hash;
    117     unsigned int tcp_metrics_hash_log;
    118     + struct sock * __percpu *tcp_sk;
    119     struct netns_frags frags;
    120     #ifdef CONFIG_NETFILTER
    121     struct xt_table *iptable_filter;
    122     diff --git a/net/core/dev.c b/net/core/dev.c
    123     index cca7ae0ba915..c310440309bb 100644
    124     --- a/net/core/dev.c
    125     +++ b/net/core/dev.c
    126     @@ -6015,10 +6015,20 @@ static int dev_cpu_callback(struct notifier_block *nfb,
    127     oldsd->output_queue = NULL;
    128     oldsd->output_queue_tailp = &oldsd->output_queue;
    129     }
    130     - /* Append NAPI poll list from offline CPU. */
    131     - if (!list_empty(&oldsd->poll_list)) {
    132     - list_splice_init(&oldsd->poll_list, &sd->poll_list);
    133     - raise_softirq_irqoff(NET_RX_SOFTIRQ);
    134     + /* Append NAPI poll list from offline CPU, with one exception :
    135     + * process_backlog() must be called by cpu owning percpu backlog.
    136     + * We properly handle process_queue & input_pkt_queue later.
    137     + */
    138     + while (!list_empty(&oldsd->poll_list)) {
    139     + struct napi_struct *napi = list_first_entry(&oldsd->poll_list,
    140     + struct napi_struct,
    141     + poll_list);
    142     +
    143     + list_del_init(&napi->poll_list);
    144     + if (napi->poll == process_backlog)
    145     + napi->state = 0;
    146     + else
    147     + ____napi_schedule(sd, napi);
    148     }
    149    
    150     raise_softirq_irqoff(NET_TX_SOFTIRQ);
    151     @@ -6029,7 +6039,7 @@ static int dev_cpu_callback(struct notifier_block *nfb,
    152     netif_rx(skb);
    153     input_queue_head_incr(oldsd);
    154     }
    155     - while ((skb = __skb_dequeue(&oldsd->input_pkt_queue))) {
    156     + while ((skb = skb_dequeue(&oldsd->input_pkt_queue))) {
    157     netif_rx(skb);
    158     input_queue_head_incr(oldsd);
    159     }
    160     diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    161     index 25c4dd563a79..279b5dcf09ae 100644
    162     --- a/net/core/rtnetlink.c
    163     +++ b/net/core/rtnetlink.c
    164     @@ -2477,12 +2477,16 @@ static int rtnl_bridge_notify(struct net_device *dev, u16 flags)
    165     goto errout;
    166     }
    167    
    168     + if (!skb->len)
    169     + goto errout;
    170     +
    171     rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
    172     return 0;
    173     errout:
    174     WARN_ON(err == -EMSGSIZE);
    175     kfree_skb(skb);
    176     - rtnl_set_sk_err(net, RTNLGRP_LINK, err);
    177     + if (err)
    178     + rtnl_set_sk_err(net, RTNLGRP_LINK, err);
    179     return err;
    180     }
    181    
    182     diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
    183     index bd1c5baf69be..31ee5c6033df 100644
    184     --- a/net/ipv4/ip_forward.c
    185     +++ b/net/ipv4/ip_forward.c
    186     @@ -175,7 +175,8 @@ int ip_forward(struct sk_buff *skb)
    187     * We now generate an ICMP HOST REDIRECT giving the route
    188     * we calculated.
    189     */
    190     - if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
    191     + if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
    192     + !skb_sec_path(skb))
    193     ip_rt_send_redirect(skb);
    194    
    195     skb->priority = rt_tos2priority(iph->tos);
    196     diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
    197     index 22fa05e041ea..def18547748e 100644
    198     --- a/net/ipv4/ip_output.c
    199     +++ b/net/ipv4/ip_output.c
    200     @@ -1454,23 +1454,8 @@ static int ip_reply_glue_bits(void *dptr, char *to, int offset,
    201     /*
    202     * Generic function to send a packet as reply to another packet.
    203     * Used to send some TCP resets/acks so far.
    204     - *
    205     - * Use a fake percpu inet socket to avoid false sharing and contention.
    206     */
    207     -static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = {
    208     - .sk = {
    209     - .__sk_common = {
    210     - .skc_refcnt = ATOMIC_INIT(1),
    211     - },
    212     - .sk_wmem_alloc = ATOMIC_INIT(1),
    213     - .sk_allocation = GFP_ATOMIC,
    214     - .sk_flags = (1UL << SOCK_USE_WRITE_QUEUE),
    215     - },
    216     - .pmtudisc = IP_PMTUDISC_WANT,
    217     - .uc_ttl = -1,
    218     -};
    219     -
    220     -void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
    221     +void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
    222     __be32 saddr, const struct ip_reply_arg *arg,
    223     unsigned int len)
    224     {
    225     @@ -1478,9 +1463,8 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
    226     struct ipcm_cookie ipc;
    227     struct flowi4 fl4;
    228     struct rtable *rt = skb_rtable(skb);
    229     + struct net *net = sock_net(sk);
    230     struct sk_buff *nskb;
    231     - struct sock *sk;
    232     - struct inet_sock *inet;
    233     int err;
    234    
    235     if (ip_options_echo(&replyopts.opt.opt, skb))
    236     @@ -1508,15 +1492,11 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
    237     if (IS_ERR(rt))
    238     return;
    239    
    240     - inet = &get_cpu_var(unicast_sock);
    241     + inet_sk(sk)->tos = arg->tos;
    242    
    243     - inet->tos = arg->tos;
    244     - sk = &inet->sk;
    245     sk->sk_priority = skb->priority;
    246     sk->sk_protocol = ip_hdr(skb)->protocol;
    247     sk->sk_bound_dev_if = arg->bound_dev_if;
    248     - sock_net_set(sk, net);
    249     - __skb_queue_head_init(&sk->sk_write_queue);
    250     sk->sk_sndbuf = sysctl_wmem_default;
    251     err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
    252     len, 0, &ipc, &rt, MSG_DONTWAIT);
    253     @@ -1532,13 +1512,10 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
    254     arg->csumoffset) = csum_fold(csum_add(nskb->csum,
    255     arg->csum));
    256     nskb->ip_summed = CHECKSUM_NONE;
    257     - skb_orphan(nskb);
    258     skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));
    259     ip_push_pending_frames(sk, &fl4);
    260     }
    261     out:
    262     - put_cpu_var(unicast_sock);
    263     -
    264     ip_rt_put(rt);
    265     }
    266    
    267     diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
    268     index 23e6ab0a2dc0..f6603142cb33 100644
    269     --- a/net/ipv4/ip_sockglue.c
    270     +++ b/net/ipv4/ip_sockglue.c
    271     @@ -410,15 +410,11 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
    272    
    273     memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
    274     sin = &errhdr.offender;
    275     - sin->sin_family = AF_UNSPEC;
    276     + memset(sin, 0, sizeof(*sin));
    277     if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP) {
    278     - struct inet_sock *inet = inet_sk(sk);
    279     -
    280     sin->sin_family = AF_INET;
    281     sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
    282     - sin->sin_port = 0;
    283     - memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
    284     - if (inet->cmsg_flags)
    285     + if (inet_sk(sk)->cmsg_flags)
    286     ip_cmsg_recv(msg, skb);
    287     }
    288    
    289     diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
    290     index aa857a4a06a8..698f3a2ac5ae 100644
    291     --- a/net/ipv4/ping.c
    292     +++ b/net/ipv4/ping.c
    293     @@ -720,8 +720,11 @@ void ping_rcv(struct sk_buff *skb)
    294     sk = ping_v4_lookup(net, saddr, daddr, ntohs(icmph->un.echo.id),
    295     skb->dev->ifindex);
    296     if (sk != NULL) {
    297     + struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
    298     +
    299     pr_debug("rcv on socket %p\n", sk);
    300     - ping_queue_rcv_skb(sk, skb_get(skb));
    301     + if (skb2)
    302     + ping_queue_rcv_skb(sk, skb2);
    303     sock_put(sk);
    304     return;
    305     }
    306     diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    307     index d4d162eac4df..e23c5f64286b 100644
    308     --- a/net/ipv4/route.c
    309     +++ b/net/ipv4/route.c
    310     @@ -1514,11 +1514,10 @@ static int __mkroute_input(struct sk_buff *skb,
    311    
    312     do_cache = res->fi && !itag;
    313     if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
    314     + skb->protocol == htons(ETH_P_IP) &&
    315     (IN_DEV_SHARED_MEDIA(out_dev) ||
    316     - inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
    317     - flags |= RTCF_DOREDIRECT;
    318     - do_cache = false;
    319     - }
    320     + inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
    321     + IPCB(skb)->flags |= IPSKB_DOREDIRECT;
    322    
    323     if (skb->protocol != htons(ETH_P_IP)) {
    324     /* Not IP (i.e. ARP). Do not create route, if it is
    325     @@ -2255,6 +2254,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
    326     r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
    327     if (rt->rt_flags & RTCF_NOTIFY)
    328     r->rtm_flags |= RTM_F_NOTIFY;
    329     + if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
    330     + r->rtm_flags |= RTCF_DOREDIRECT;
    331    
    332     if (nla_put_be32(skb, RTA_DST, dst))
    333     goto nla_put_failure;
    334     diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
    335     index e025c1c788a1..cce35e5a7ee6 100644
    336     --- a/net/ipv4/tcp_ipv4.c
    337     +++ b/net/ipv4/tcp_ipv4.c
    338     @@ -707,7 +707,8 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
    339    
    340     net = dev_net(skb_dst(skb)->dev);
    341     arg.tos = ip_hdr(skb)->tos;
    342     - ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr,
    343     + ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
    344     + skb, ip_hdr(skb)->saddr,
    345     ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len);
    346    
    347     TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
    348     @@ -790,7 +791,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
    349     if (oif)
    350     arg.bound_dev_if = oif;
    351     arg.tos = tos;
    352     - ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr,
    353     + ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
    354     + skb, ip_hdr(skb)->saddr,
    355     ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len);
    356    
    357     TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
    358     @@ -2898,14 +2900,39 @@ struct proto tcp_prot = {
    359     };
    360     EXPORT_SYMBOL(tcp_prot);
    361    
    362     +static void __net_exit tcp_sk_exit(struct net *net)
    363     +{
    364     + int cpu;
    365     +
    366     + for_each_possible_cpu(cpu)
    367     + inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
    368     + free_percpu(net->ipv4.tcp_sk);
    369     +}
    370     +
    371     static int __net_init tcp_sk_init(struct net *net)
    372     {
    373     + int res, cpu;
    374     +
    375     + net->ipv4.tcp_sk = alloc_percpu(struct sock *);
    376     + if (!net->ipv4.tcp_sk)
    377     + return -ENOMEM;
    378     +
    379     + for_each_possible_cpu(cpu) {
    380     + struct sock *sk;
    381     +
    382     + res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW,
    383     + IPPROTO_TCP, net);
    384     + if (res)
    385     + goto fail;
    386     + *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk;
    387     + }
    388     net->ipv4.sysctl_tcp_ecn = 2;
    389     return 0;
    390     -}
    391    
    392     -static void __net_exit tcp_sk_exit(struct net *net)
    393     -{
    394     +fail:
    395     + tcp_sk_exit(net);
    396     +
    397     + return res;
    398     }
    399    
    400     static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
    401     diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
    402     index 7927db0a9279..4a000f1dd757 100644
    403     --- a/net/ipv4/udp_diag.c
    404     +++ b/net/ipv4/udp_diag.c
    405     @@ -99,11 +99,13 @@ static void udp_dump(struct udp_table *table, struct sk_buff *skb, struct netlin
    406     s_slot = cb->args[0];
    407     num = s_num = cb->args[1];
    408    
    409     - for (slot = s_slot; slot <= table->mask; num = s_num = 0, slot++) {
    410     + for (slot = s_slot; slot <= table->mask; s_num = 0, slot++) {
    411     struct sock *sk;
    412     struct hlist_nulls_node *node;
    413     struct udp_hslot *hslot = &table->hash[slot];
    414    
    415     + num = 0;
    416     +
    417     if (hlist_nulls_empty(&hslot->head))
    418     continue;
    419    
    420     diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
    421     index 8997340e3742..ce17d3da9b2b 100644
    422     --- a/net/ipv6/datagram.c
    423     +++ b/net/ipv6/datagram.c
    424     @@ -374,11 +374,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
    425    
    426     memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
    427     sin = &errhdr.offender;
    428     - sin->sin6_family = AF_UNSPEC;
    429     + memset(sin, 0, sizeof(*sin));
    430     +
    431     if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
    432     sin->sin6_family = AF_INET6;
    433     - sin->sin6_flowinfo = 0;
    434     - sin->sin6_port = 0;
    435     if (skb->protocol == htons(ETH_P_IPV6)) {
    436     sin->sin6_addr = ipv6_hdr(skb)->saddr;
    437     if (np->rxopt.all)
    438     @@ -387,12 +386,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
    439     ipv6_iface_scope_id(&sin->sin6_addr,
    440     IP6CB(skb)->iif);
    441     } else {
    442     - struct inet_sock *inet = inet_sk(sk);
    443     -
    444     ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
    445     &sin->sin6_addr);
    446     - sin->sin6_scope_id = 0;
    447     - if (inet->cmsg_flags)
    448     + if (inet_sk(sk)->cmsg_flags)
    449     ip_cmsg_recv(msg, skb);
    450     }
    451     }
    452     diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
    453     index 009c9620f442..ceeb9458bb60 100644
    454     --- a/net/ipv6/ip6_fib.c
    455     +++ b/net/ipv6/ip6_fib.c
    456     @@ -638,6 +638,29 @@ static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt)
    457     RTF_GATEWAY;
    458     }
    459    
    460     +static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
    461     + struct net *net)
    462     +{
    463     + if (atomic_read(&rt->rt6i_ref) != 1) {
    464     + /* This route is used as dummy address holder in some split
    465     + * nodes. It is not leaked, but it still holds other resources,
    466     + * which must be released in time. So, scan ascendant nodes
    467     + * and replace dummy references to this route with references
    468     + * to still alive ones.
    469     + */
    470     + while (fn) {
    471     + if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
    472     + fn->leaf = fib6_find_prefix(net, fn);
    473     + atomic_inc(&fn->leaf->rt6i_ref);
    474     + rt6_release(rt);
    475     + }
    476     + fn = fn->parent;
    477     + }
    478     + /* No more references are possible at this point. */
    479     + BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
    480     + }
    481     +}
    482     +
    483     /*
    484     * Insert routing information in a node.
    485     */
    486     @@ -775,11 +798,12 @@ add:
    487     rt->dst.rt6_next = iter->dst.rt6_next;
    488     atomic_inc(&rt->rt6i_ref);
    489     inet6_rt_notify(RTM_NEWROUTE, rt, info);
    490     - rt6_release(iter);
    491     if (!(fn->fn_flags & RTN_RTINFO)) {
    492     info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
    493     fn->fn_flags |= RTN_RTINFO;
    494     }
    495     + fib6_purge_rt(iter, fn, info->nl_net);
    496     + rt6_release(iter);
    497     }
    498    
    499     return 0;
    500     @@ -1284,24 +1308,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
    501     fn = fib6_repair_tree(net, fn);
    502     }
    503    
    504     - if (atomic_read(&rt->rt6i_ref) != 1) {
    505     - /* This route is used as dummy address holder in some split
    506     - * nodes. It is not leaked, but it still holds other resources,
    507     - * which must be released in time. So, scan ascendant nodes
    508     - * and replace dummy references to this route with references
    509     - * to still alive ones.
    510     - */
    511     - while (fn) {
    512     - if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
    513     - fn->leaf = fib6_find_prefix(net, fn);
    514     - atomic_inc(&fn->leaf->rt6i_ref);
    515     - rt6_release(rt);
    516     - }
    517     - fn = fn->parent;
    518     - }
    519     - /* No more references are possible at this point. */
    520     - BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
    521     - }
    522     + fib6_purge_rt(rt, fn, net);
    523    
    524     inet6_rt_notify(RTM_DELROUTE, rt, info);
    525     rt6_release(rt);
    526     diff --git a/net/ipv6/route.c b/net/ipv6/route.c
    527     index b2614b22622b..92274796eb71 100644
    528     --- a/net/ipv6/route.c
    529     +++ b/net/ipv6/route.c
    530     @@ -1141,12 +1141,9 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
    531     struct net *net = dev_net(dst->dev);
    532    
    533     rt6->rt6i_flags |= RTF_MODIFIED;
    534     - if (mtu < IPV6_MIN_MTU) {
    535     - u32 features = dst_metric(dst, RTAX_FEATURES);
    536     + if (mtu < IPV6_MIN_MTU)
    537     mtu = IPV6_MIN_MTU;
    538     - features |= RTAX_FEATURE_ALLFRAG;
    539     - dst_metric_set(dst, RTAX_FEATURES, features);
    540     - }
    541     +
    542     dst_metric_set(dst, RTAX_MTU, mtu);
    543     rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires);
    544     }
    545     diff --git a/net/sctp/associola.c b/net/sctp/associola.c
    546     index ca4a1a1b8e69..6360a14edeab 100644
    547     --- a/net/sctp/associola.c
    548     +++ b/net/sctp/associola.c
    549     @@ -1297,7 +1297,6 @@ void sctp_assoc_update(struct sctp_association *asoc,
    550     asoc->peer.peer_hmacs = new->peer.peer_hmacs;
    551     new->peer.peer_hmacs = NULL;
    552    
    553     - sctp_auth_key_put(asoc->asoc_shared_key);
    554     sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
    555     }
    556    
    557     diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
    558     index 29fc16f3633f..beedadf62f6c 100644
    559     --- a/net/sctp/sm_make_chunk.c
    560     +++ b/net/sctp/sm_make_chunk.c
    561     @@ -2595,7 +2595,7 @@ do_addr_param:
    562    
    563     addr_param = param.v + sizeof(sctp_addip_param_t);
    564    
    565     - af = sctp_get_af_specific(param_type2af(param.p->type));
    566     + af = sctp_get_af_specific(param_type2af(addr_param->p.type));
    567     if (af == NULL)
    568     break;
    569