Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0161-3.4.62-all-fixes.patch

    Contents of /trunk/kernel-lts/patches-3.4/0161-3.4.62-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2303 - (show annotations) (download)
    Mon Oct 14 07:15:13 2013 UTC (10 years, 6 months ago) by niro
    File size: 18199 byte(s) 
    -linux-3.4.62
    1 diff --git a/arch/m32r/boot/compressed/Makefile b/arch/m32r/boot/compressed/Makefile
    2 index 177716b..01729c2 100644
    3 --- a/arch/m32r/boot/compressed/Makefile
    4 +++ b/arch/m32r/boot/compressed/Makefile
    5 @@ -43,9 +43,9 @@ endif
    6
    7 OBJCOPYFLAGS += -R .empty_zero_page
    8
    9 -suffix_$(CONFIG_KERNEL_GZIP) = gz
    10 -suffix_$(CONFIG_KERNEL_BZIP2) = bz2
    11 -suffix_$(CONFIG_KERNEL_LZMA) = lzma
    12 +suffix-$(CONFIG_KERNEL_GZIP) = gz
    13 +suffix-$(CONFIG_KERNEL_BZIP2) = bz2
    14 +suffix-$(CONFIG_KERNEL_LZMA) = lzma
    15
    16 $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.$(suffix-y) FORCE
    17 $(call if_changed,ld)
    18 diff --git a/arch/m32r/boot/compressed/misc.c b/arch/m32r/boot/compressed/misc.c
    19 index 370d608..28a0952 100644
    20 --- a/arch/m32r/boot/compressed/misc.c
    21 +++ b/arch/m32r/boot/compressed/misc.c
    22 @@ -28,7 +28,7 @@ static unsigned long free_mem_ptr;
    23 static unsigned long free_mem_end_ptr;
    24
    25 #ifdef CONFIG_KERNEL_BZIP2
    26 -static void *memset(void *s, int c, size_t n)
    27 +void *memset(void *s, int c, size_t n)
    28 {
    29 char *ss = s;
    30
    31 @@ -39,6 +39,16 @@ static void *memset(void *s, int c, size_t n)
    32 #endif
    33
    34 #ifdef CONFIG_KERNEL_GZIP
    35 +void *memcpy(void *dest, const void *src, size_t n)
    36 +{
    37 + char *d = dest;
    38 + const char *s = src;
    39 + while (n--)
    40 + *d++ = *s++;
    41 +
    42 + return dest;
    43 +}
    44 +
    45 #define BOOT_HEAP_SIZE 0x10000
    46 #include "../../../../lib/decompress_inflate.c"
    47 #endif
    48 diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
    49 index 8c45818..8375622 100644
    50 --- a/arch/x86/kvm/emulate.c
    51 +++ b/arch/x86/kvm/emulate.c
    52 @@ -3737,10 +3737,6 @@ static int decode_operand(struct x86_emulate_ctxt *ctxt, struct operand *op,
    53 break;
    54 case OpMem8:
    55 ctxt->memop.bytes = 1;
    56 - if (ctxt->memop.type == OP_REG) {
    57 - ctxt->memop.addr.reg = decode_register(ctxt, ctxt->modrm_rm, 1);
    58 - fetch_register_operand(&ctxt->memop);
    59 - }
    60 goto mem_common;
    61 case OpMem16:
    62 ctxt->memop.bytes = 2;
    63 diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
    64 index d9f8358..80103bb 100644
    65 --- a/drivers/net/bonding/bond_main.c
    66 +++ b/drivers/net/bonding/bond_main.c
    67 @@ -3750,11 +3750,17 @@ static int bond_neigh_init(struct neighbour *n)
    68 * The bonding ndo_neigh_setup is called at init time beofre any
    69 * slave exists. So we must declare proxy setup function which will
    70 * be used at run time to resolve the actual slave neigh param setup.
    71 + *
    72 + * It's also called by master devices (such as vlans) to setup their
    73 + * underlying devices. In that case - do nothing, we're already set up from
    74 + * our init.
    75 */
    76 static int bond_neigh_setup(struct net_device *dev,
    77 struct neigh_parms *parms)
    78 {
    79 - parms->neigh_setup = bond_neigh_init;
    80 + /* modify only our neigh_parms */
    81 + if (parms->dev == dev)
    82 + parms->neigh_setup = bond_neigh_init;
    83
    84 return 0;
    85 }
    86 diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
    87 index 2205db7..1b44047 100644
    88 --- a/drivers/net/ethernet/realtek/8139cp.c
    89 +++ b/drivers/net/ethernet/realtek/8139cp.c
    90 @@ -524,6 +524,7 @@ rx_status_loop:
    91 PCI_DMA_FROMDEVICE);
    92 if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
    93 dev->stats.rx_dropped++;
    94 + kfree_skb(new_skb);
    95 goto rx_next;
    96 }
    97
    98 diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
    99 index 5151f06..77ce8b2 100644
    100 --- a/drivers/net/macvtap.c
    101 +++ b/drivers/net/macvtap.c
    102 @@ -642,6 +642,28 @@ static int macvtap_skb_to_vnet_hdr(const struct sk_buff *skb,
    103 return 0;
    104 }
    105
    106 +static unsigned long iov_pages(const struct iovec *iv, int offset,
    107 + unsigned long nr_segs)
    108 +{
    109 + unsigned long seg, base;
    110 + int pages = 0, len, size;
    111 +
    112 + while (nr_segs && (offset >= iv->iov_len)) {
    113 + offset -= iv->iov_len;
    114 + ++iv;
    115 + --nr_segs;
    116 + }
    117 +
    118 + for (seg = 0; seg < nr_segs; seg++) {
    119 + base = (unsigned long)iv[seg].iov_base + offset;
    120 + len = iv[seg].iov_len - offset;
    121 + size = ((base & ~PAGE_MASK) + len + ~PAGE_MASK) >> PAGE_SHIFT;
    122 + pages += size;
    123 + offset = 0;
    124 + }
    125 +
    126 + return pages;
    127 +}
    128
    129 /* Get packet from user space buffer */
    130 static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
    131 @@ -688,31 +710,15 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
    132 if (unlikely(count > UIO_MAXIOV))
    133 goto err;
    134
    135 - if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY))
    136 - zerocopy = true;
    137 -
    138 - if (zerocopy) {
    139 - /* Userspace may produce vectors with count greater than
    140 - * MAX_SKB_FRAGS, so we need to linearize parts of the skb
    141 - * to let the rest of data to be fit in the frags.
    142 - */
    143 - if (count > MAX_SKB_FRAGS) {
    144 - copylen = iov_length(iv, count - MAX_SKB_FRAGS);
    145 - if (copylen < vnet_hdr_len)
    146 - copylen = 0;
    147 - else
    148 - copylen -= vnet_hdr_len;
    149 - }
    150 - /* There are 256 bytes to be copied in skb, so there is enough
    151 - * room for skb expand head in case it is used.
    152 - * The rest buffer is mapped from userspace.
    153 - */
    154 - if (copylen < vnet_hdr.hdr_len)
    155 - copylen = vnet_hdr.hdr_len;
    156 - if (!copylen)
    157 - copylen = GOODCOPY_LEN;
    158 + if (m && m->msg_control && sock_flag(&q->sk, SOCK_ZEROCOPY)) {
    159 + copylen = vnet_hdr.hdr_len ? vnet_hdr.hdr_len : GOODCOPY_LEN;
    160 linear = copylen;
    161 - } else {
    162 + if (iov_pages(iv, vnet_hdr_len + copylen, count)
    163 + <= MAX_SKB_FRAGS)
    164 + zerocopy = true;
    165 + }
    166 +
    167 + if (!zerocopy) {
    168 copylen = len;
    169 linear = vnet_hdr.hdr_len;
    170 }
    171 @@ -724,9 +730,15 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
    172
    173 if (zerocopy)
    174 err = zerocopy_sg_from_iovec(skb, iv, vnet_hdr_len, count);
    175 - else
    176 + else {
    177 err = skb_copy_datagram_from_iovec(skb, 0, iv, vnet_hdr_len,
    178 len);
    179 + if (!err && m && m->msg_control) {
    180 + struct ubuf_info *uarg = m->msg_control;
    181 + uarg->callback(uarg);
    182 + }
    183 + }
    184 +
    185 if (err)
    186 goto err_kfree;
    187
    188 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
    189 index c896b8f..194f879 100644
    190 --- a/drivers/net/tun.c
    191 +++ b/drivers/net/tun.c
    192 @@ -615,8 +615,9 @@ static ssize_t tun_get_user(struct tun_struct *tun,
    193 int offset = 0;
    194
    195 if (!(tun->flags & TUN_NO_PI)) {
    196 - if ((len -= sizeof(pi)) > count)
    197 + if (len < sizeof(pi))
    198 return -EINVAL;
    199 + len -= sizeof(pi);
    200
    201 if (memcpy_fromiovecend((void *)&pi, iv, 0, sizeof(pi)))
    202 return -EFAULT;
    203 @@ -624,8 +625,9 @@ static ssize_t tun_get_user(struct tun_struct *tun,
    204 }
    205
    206 if (tun->flags & TUN_VNET_HDR) {
    207 - if ((len -= tun->vnet_hdr_sz) > count)
    208 + if (len < tun->vnet_hdr_sz)
    209 return -EINVAL;
    210 + len -= tun->vnet_hdr_sz;
    211
    212 if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso)))
    213 return -EFAULT;
    214 diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
    215 index 1a9e2a9..a50cb9c 100644
    216 --- a/drivers/vhost/vhost.c
    217 +++ b/drivers/vhost/vhost.c
    218 @@ -1603,6 +1603,7 @@ void vhost_zerocopy_callback(struct ubuf_info *ubuf)
    219 struct vhost_ubuf_ref *ubufs = ubuf->ctx;
    220 struct vhost_virtqueue *vq = ubufs->vq;
    221
    222 + vhost_poll_queue(&vq->poll);
    223 /* set len = 1 to mark this desc buffers done DMA */
    224 vq->heads[ubuf->desc].len = VHOST_DMA_DONE_LEN;
    225 kref_put(&ubufs->kref, vhost_zerocopy_done_signal);
    226 diff --git a/include/linux/icmpv6.h b/include/linux/icmpv6.h
    227 index ba45e6b..f5a21d0 100644
    228 --- a/include/linux/icmpv6.h
    229 +++ b/include/linux/icmpv6.h
    230 @@ -123,6 +123,8 @@ static inline struct icmp6hdr *icmp6_hdr(const struct sk_buff *skb)
    231 #define ICMPV6_NOT_NEIGHBOUR 2
    232 #define ICMPV6_ADDR_UNREACH 3
    233 #define ICMPV6_PORT_UNREACH 4
    234 +#define ICMPV6_POLICY_FAIL 5
    235 +#define ICMPV6_REJECT_ROUTE 6
    236
    237 /*
    238 * Codes for Time Exceeded
    239 diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
    240 index 8260ef7..e6412ee 100644
    241 --- a/include/linux/ipv6.h
    242 +++ b/include/linux/ipv6.h
    243 @@ -260,6 +260,7 @@ struct inet6_skb_parm {
    244 #define IP6SKB_XFRM_TRANSFORMED 1
    245 #define IP6SKB_FORWARDED 2
    246 #define IP6SKB_REROUTED 4
    247 +#define IP6SKB_FRAGMENTED 16
    248 };
    249
    250 #define IP6CB(skb) ((struct inet6_skb_parm*)((skb)->cb))
    251 diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
    252 index 9069071..ca670d9 100644
    253 --- a/net/bridge/br_multicast.c
    254 +++ b/net/bridge/br_multicast.c
    255 @@ -1155,7 +1155,8 @@ static int br_ip6_multicast_query(struct net_bridge *br,
    256 mld2q = (struct mld2_query *)icmp6_hdr(skb);
    257 if (!mld2q->mld2q_nsrcs)
    258 group = &mld2q->mld2q_mca;
    259 - max_delay = mld2q->mld2q_mrc ? MLDV2_MRC(mld2q->mld2q_mrc) : 1;
    260 +
    261 + max_delay = max(msecs_to_jiffies(MLDV2_MRC(ntohs(mld2q->mld2q_mrc))), 1UL);
    262 }
    263
    264 if (!group)
    265 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    266 index 69b7ca3..ebd4b21 100644
    267 --- a/net/core/neighbour.c
    268 +++ b/net/core/neighbour.c
    269 @@ -1442,16 +1442,18 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
    270 atomic_set(&p->refcnt, 1);
    271 p->reachable_time =
    272 neigh_rand_reach_time(p->base_reachable_time);
    273 + dev_hold(dev);
    274 + p->dev = dev;
    275 + write_pnet(&p->net, hold_net(net));
    276 + p->sysctl_table = NULL;
    277
    278 if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
    279 + release_net(net);
    280 + dev_put(dev);
    281 kfree(p);
    282 return NULL;
    283 }
    284
    285 - dev_hold(dev);
    286 - p->dev = dev;
    287 - write_pnet(&p->net, hold_net(net));
    288 - p->sysctl_table = NULL;
    289 write_lock_bh(&tbl->lock);
    290 p->next = tbl->parms.next;
    291 tbl->parms.next = p;
    292 diff --git a/net/core/sysctl_net_core.c b/net/core/sysctl_net_core.c
    293 index 0c28508..77d1550 100644
    294 --- a/net/core/sysctl_net_core.c
    295 +++ b/net/core/sysctl_net_core.c
    296 @@ -19,6 +19,9 @@
    297 #include <net/sock.h>
    298 #include <net/net_ratelimit.h>
    299
    300 +static int zero = 0;
    301 +static int ushort_max = USHRT_MAX;
    302 +
    303 #ifdef CONFIG_RPS
    304 static int rps_sock_flow_sysctl(ctl_table *table, int write,
    305 void __user *buffer, size_t *lenp, loff_t *ppos)
    306 @@ -197,7 +200,9 @@ static struct ctl_table netns_core_table[] = {
    307 .data = &init_net.core.sysctl_somaxconn,
    308 .maxlen = sizeof(int),
    309 .mode = 0644,
    310 - .proc_handler = proc_dointvec
    311 + .extra1 = &zero,
    312 + .extra2 = &ushort_max,
    313 + .proc_handler = proc_dointvec_minmax
    314 },
    315 { }
    316 };
    317 diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
    318 index 30b88d7..424704a 100644
    319 --- a/net/ipv4/fib_trie.c
    320 +++ b/net/ipv4/fib_trie.c
    321 @@ -71,7 +71,6 @@
    322 #include <linux/init.h>
    323 #include <linux/list.h>
    324 #include <linux/slab.h>
    325 -#include <linux/prefetch.h>
    326 #include <linux/export.h>
    327 #include <net/net_namespace.h>
    328 #include <net/ip.h>
    329 @@ -1772,10 +1771,8 @@ static struct leaf *leaf_walk_rcu(struct tnode *p, struct rt_trie_node *c)
    330 if (!c)
    331 continue;
    332
    333 - if (IS_LEAF(c)) {
    334 - prefetch(rcu_dereference_rtnl(p->child[idx]));
    335 + if (IS_LEAF(c))
    336 return (struct leaf *) c;
    337 - }
    338
    339 /* Rescan start scanning in new node */
    340 p = (struct tnode *) c;
    341 diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
    342 index a9077f4..b6ae92a 100644
    343 --- a/net/ipv4/tcp_cubic.c
    344 +++ b/net/ipv4/tcp_cubic.c
    345 @@ -206,8 +206,8 @@ static u32 cubic_root(u64 a)
    346 */
    347 static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
    348 {
    349 - u64 offs;
    350 - u32 delta, t, bic_target, max_cnt;
    351 + u32 delta, bic_target, max_cnt;
    352 + u64 offs, t;
    353
    354 ca->ack_cnt++; /* count the number of ACKs */
    355
    356 @@ -250,9 +250,11 @@ static inline void bictcp_update(struct bictcp *ca, u32 cwnd)
    357 * if the cwnd < 1 million packets !!!
    358 */
    359
    360 + t = (s32)(tcp_time_stamp - ca->epoch_start);
    361 + t += msecs_to_jiffies(ca->delay_min >> 3);
    362 /* change the unit from HZ to bictcp_HZ */
    363 - t = ((tcp_time_stamp + msecs_to_jiffies(ca->delay_min>>3)
    364 - - ca->epoch_start) << BICTCP_HZ) / HZ;
    365 + t <<= BICTCP_HZ;
    366 + do_div(t, HZ);
    367
    368 if (t < ca->bic_K) /* t - K */
    369 offs = ca->bic_K - t;
    370 @@ -414,7 +416,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
    371 return;
    372
    373 /* Discard delay samples right after fast recovery */
    374 - if ((s32)(tcp_time_stamp - ca->epoch_start) < HZ)
    375 + if (ca->epoch_start && (s32)(tcp_time_stamp - ca->epoch_start) < HZ)
    376 return;
    377
    378 delay = (rtt_us << 3) / USEC_PER_MSEC;
    379 diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
    380 index d427f1b..abfa007 100644
    381 --- a/net/ipv6/addrconf.c
    382 +++ b/net/ipv6/addrconf.c
    383 @@ -910,12 +910,10 @@ retry:
    384 if (ifp->flags & IFA_F_OPTIMISTIC)
    385 addr_flags |= IFA_F_OPTIMISTIC;
    386
    387 - ift = !max_addresses ||
    388 - ipv6_count_addresses(idev) < max_addresses ?
    389 - ipv6_add_addr(idev, &addr, tmp_plen,
    390 - ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
    391 - addr_flags) : NULL;
    392 - if (!ift || IS_ERR(ift)) {
    393 + ift = ipv6_add_addr(idev, &addr, tmp_plen,
    394 + ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
    395 + addr_flags);
    396 + if (IS_ERR(ift)) {
    397 in6_ifa_put(ifp);
    398 in6_dev_put(idev);
    399 printk(KERN_INFO
    400 diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
    401 index 27ac95a..dbf20f6 100644
    402 --- a/net/ipv6/icmp.c
    403 +++ b/net/ipv6/icmp.c
    404 @@ -917,6 +917,14 @@ static const struct icmp6_err {
    405 .err = ECONNREFUSED,
    406 .fatal = 1,
    407 },
    408 + { /* POLICY_FAIL */
    409 + .err = EACCES,
    410 + .fatal = 1,
    411 + },
    412 + { /* REJECT_ROUTE */
    413 + .err = EACCES,
    414 + .fatal = 1,
    415 + },
    416 };
    417
    418 int icmpv6_err_convert(u8 type, u8 code, int *err)
    419 @@ -928,7 +936,7 @@ int icmpv6_err_convert(u8 type, u8 code, int *err)
    420 switch (type) {
    421 case ICMPV6_DEST_UNREACH:
    422 fatal = 1;
    423 - if (code <= ICMPV6_PORT_UNREACH) {
    424 + if (code < ARRAY_SIZE(tab_unreach)) {
    425 *err = tab_unreach[code].err;
    426 fatal = tab_unreach[code].fatal;
    427 }
    428 diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
    429 index c3a007d..5bb77a6 100644
    430 --- a/net/ipv6/ip6_fib.c
    431 +++ b/net/ipv6/ip6_fib.c
    432 @@ -949,14 +949,22 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
    433
    434 if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
    435 #ifdef CONFIG_IPV6_SUBTREES
    436 - if (fn->subtree)
    437 - fn = fib6_lookup_1(fn->subtree, args + 1);
    438 + if (fn->subtree) {
    439 + struct fib6_node *sfn;
    440 + sfn = fib6_lookup_1(fn->subtree,
    441 + args + 1);
    442 + if (!sfn)
    443 + goto backtrack;
    444 + fn = sfn;
    445 + }
    446 #endif
    447 - if (!fn || fn->fn_flags & RTN_RTINFO)
    448 + if (fn->fn_flags & RTN_RTINFO)
    449 return fn;
    450 }
    451 }
    452 -
    453 +#ifdef CONFIG_IPV6_SUBTREES
    454 +backtrack:
    455 +#endif
    456 if (fn->fn_flags & RTN_ROOT)
    457 break;
    458
    459 diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
    460 index 843d6eb..5cc78e6 100644
    461 --- a/net/ipv6/ndisc.c
    462 +++ b/net/ipv6/ndisc.c
    463 @@ -441,7 +441,6 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
    464 int hlen = LL_RESERVED_SPACE(dev);
    465 int tlen = dev->needed_tailroom;
    466 int len;
    467 - int err;
    468 u8 *opt;
    469
    470 if (!dev->addr_len)
    471 @@ -451,14 +450,12 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
    472 if (llinfo)
    473 len += ndisc_opt_addr_space(dev);
    474
    475 - skb = sock_alloc_send_skb(sk,
    476 - (MAX_HEADER + sizeof(struct ipv6hdr) +
    477 - len + hlen + tlen),
    478 - 1, &err);
    479 + skb = alloc_skb((MAX_HEADER + sizeof(struct ipv6hdr) +
    480 + len + hlen + tlen), GFP_ATOMIC);
    481 if (!skb) {
    482 ND_PRINTK0(KERN_ERR
    483 - "ICMPv6 ND: %s() failed to allocate an skb, err=%d.\n",
    484 - __func__, err);
    485 + "ICMPv6 ND: %s() failed to allocate an skb.\n",
    486 + __func__);
    487 return NULL;
    488 }
    489
    490 @@ -486,6 +483,11 @@ struct sk_buff *ndisc_build_skb(struct net_device *dev,
    491 csum_partial(hdr,
    492 len, 0));
    493
    494 + /* Manually assign socket ownership as we avoid calling
    495 + * sock_alloc_send_pskb() to bypass wmem buffer limits
    496 + */
    497 + skb_set_owner_w(skb, sk);
    498 +
    499 return skb;
    500 }
    501
    502 diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
    503 index 6bda7aa..ff900ac 100644
    504 --- a/net/ipv6/reassembly.c
    505 +++ b/net/ipv6/reassembly.c
    506 @@ -516,6 +516,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
    507 head->tstamp = fq->q.stamp;
    508 ipv6_hdr(head)->payload_len = htons(payload_len);
    509 IP6CB(head)->nhoff = nhoff;
    510 + IP6CB(head)->flags |= IP6SKB_FRAGMENTED;
    511
    512 /* Yes, and fold redundant checksum back. 8) */
    513 if (head->ip_summed == CHECKSUM_COMPLETE)
    514 @@ -551,6 +552,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
    515 const struct ipv6hdr *hdr = ipv6_hdr(skb);
    516 struct net *net = dev_net(skb_dst(skb)->dev);
    517
    518 + if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
    519 + goto fail_hdr;
    520 +
    521 IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
    522
    523 /* Jumbo payload inhibits frag. header */
    524 @@ -571,6 +575,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
    525 ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
    526
    527 IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
    528 + IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
    529 return 1;
    530 }
    531
    532 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    533 index 7ee7121..c4717e8 100644
    534 --- a/net/ipv6/tcp_ipv6.c
    535 +++ b/net/ipv6/tcp_ipv6.c
    536 @@ -1571,7 +1571,7 @@ ipv6_pktoptions:
    537 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
    538 np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
    539 if (np->rxopt.bits.rxtclass)
    540 - np->rcv_tclass = ipv6_tclass(ipv6_hdr(skb));
    541 + np->rcv_tclass = ipv6_tclass(ipv6_hdr(opt_skb));
    542 if (ipv6_opt_accepted(sk, opt_skb)) {
    543 skb_set_owner_r(opt_skb, sk);
    544 opt_skb = xchg(&np->pktoptions, opt_skb);
    545 diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
    546 index f08b9166..caa5aff 100644
    547 --- a/net/sched/sch_htb.c
    548 +++ b/net/sched/sch_htb.c
    549 @@ -86,7 +86,7 @@ struct htb_class {
    550 unsigned int children;
    551 struct htb_class *parent; /* parent class */
    552
    553 - int prio; /* these two are used only by leaves... */
    554 + u32 prio; /* these two are used only by leaves... */
    555 int quantum; /* but stored for parent-to-leaf return */
    556
    557 union {
    558 diff --git a/net/tipc/eth_media.c b/net/tipc/eth_media.c
    559 index 527e3f0..dd625af 100644
    560 --- a/net/tipc/eth_media.c
    561 +++ b/net/tipc/eth_media.c
    562 @@ -53,6 +53,7 @@ struct eth_bearer {
    563 struct tipc_bearer *bearer;
    564 struct net_device *dev;
    565 struct packet_type tipc_packet_type;
    566 + struct work_struct setup;
    567 struct work_struct cleanup;
    568 };
    569
    570 @@ -138,6 +139,17 @@ static int recv_msg(struct sk_buff *buf, struct net_device *dev,
    571 }
    572
    573 /**
    574 + * setup_bearer - setup association between Ethernet bearer and interface
    575 + */
    576 +static void setup_bearer(struct work_struct *work)
    577 +{
    578 + struct eth_bearer *eb_ptr =
    579 + container_of(work, struct eth_bearer, setup);
    580 +
    581 + dev_add_pack(&eb_ptr->tipc_packet_type);
    582 +}
    583 +
    584 +/**
    585 * enable_bearer - attach TIPC bearer to an Ethernet interface
    586 */
    587
    588 @@ -181,7 +193,8 @@ static int enable_bearer(struct tipc_bearer *tb_ptr)
    589 eb_ptr->tipc_packet_type.func = recv_msg;
    590 eb_ptr->tipc_packet_type.af_packet_priv = eb_ptr;
    591 INIT_LIST_HEAD(&(eb_ptr->tipc_packet_type.list));
    592 - dev_add_pack(&eb_ptr->tipc_packet_type);
    593 + INIT_WORK(&eb_ptr->setup, setup_bearer);
    594 + schedule_work(&eb_ptr->setup);
    595
    596 /* Associate TIPC bearer with Ethernet bearer */
    597