Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.16/0100-3.16.1-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-3.16/0100-3.16.1-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2497 - (show annotations) (download)
    Tue Sep 9 06:58:13 2014 UTC (9 years, 7 months ago) by niro
    File size: 17219 byte(s) 
    -linux-3.16.1
    1 diff --git a/Makefile b/Makefile
    2 index d0901b46b4bf..87663a2d1d10 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,8 +1,8 @@
    6 VERSION = 3
    7 PATCHLEVEL = 16
    8 -SUBLEVEL = 0
    9 +SUBLEVEL = 1
    10 EXTRAVERSION =
    11 -NAME = Shuffling Zombie Juror
    12 +NAME = Museum of Fishiegoodies
    13
    14 # *DOCUMENTATION*
    15 # To see a list of typical targets execute "make help"
    16 diff --git a/arch/sparc/include/asm/tlbflush_64.h b/arch/sparc/include/asm/tlbflush_64.h
    17 index 816d8202fa0a..dea1cfa2122b 100644
    18 --- a/arch/sparc/include/asm/tlbflush_64.h
    19 +++ b/arch/sparc/include/asm/tlbflush_64.h
    20 @@ -34,6 +34,8 @@ static inline void flush_tlb_range(struct vm_area_struct *vma,
    21 {
    22 }
    23
    24 +void flush_tlb_kernel_range(unsigned long start, unsigned long end);
    25 +
    26 #define __HAVE_ARCH_ENTER_LAZY_MMU_MODE
    27
    28 void flush_tlb_pending(void);
    29 @@ -48,11 +50,6 @@ void __flush_tlb_kernel_range(unsigned long start, unsigned long end);
    30
    31 #ifndef CONFIG_SMP
    32
    33 -#define flush_tlb_kernel_range(start,end) \
    34 -do { flush_tsb_kernel_range(start,end); \
    35 - __flush_tlb_kernel_range(start,end); \
    36 -} while (0)
    37 -
    38 static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr)
    39 {
    40 __flush_tlb_page(CTX_HWBITS(mm->context), vaddr);
    41 @@ -63,11 +60,6 @@ static inline void global_flush_tlb_page(struct mm_struct *mm, unsigned long vad
    42 void smp_flush_tlb_kernel_range(unsigned long start, unsigned long end);
    43 void smp_flush_tlb_page(struct mm_struct *mm, unsigned long vaddr);
    44
    45 -#define flush_tlb_kernel_range(start, end) \
    46 -do { flush_tsb_kernel_range(start,end); \
    47 - smp_flush_tlb_kernel_range(start, end); \
    48 -} while (0)
    49 -
    50 #define global_flush_tlb_page(mm, vaddr) \
    51 smp_flush_tlb_page(mm, vaddr)
    52
    53 diff --git a/arch/sparc/kernel/ldc.c b/arch/sparc/kernel/ldc.c
    54 index e01d75d40329..66dacd56bb10 100644
    55 --- a/arch/sparc/kernel/ldc.c
    56 +++ b/arch/sparc/kernel/ldc.c
    57 @@ -1336,7 +1336,7 @@ int ldc_connect(struct ldc_channel *lp)
    58 if (!(lp->flags & LDC_FLAG_ALLOCED_QUEUES) ||
    59 !(lp->flags & LDC_FLAG_REGISTERED_QUEUES) ||
    60 lp->hs_state != LDC_HS_OPEN)
    61 - err = -EINVAL;
    62 + err = ((lp->hs_state > LDC_HS_OPEN) ? 0 : -EINVAL);
    63 else
    64 err = start_handshake(lp);
    65
    66 diff --git a/arch/sparc/math-emu/math_32.c b/arch/sparc/math-emu/math_32.c
    67 index aa4d55b0bdf0..5ce8f2f64604 100644
    68 --- a/arch/sparc/math-emu/math_32.c
    69 +++ b/arch/sparc/math-emu/math_32.c
    70 @@ -499,7 +499,7 @@ static int do_one_mathemu(u32 insn, unsigned long *pfsr, unsigned long *fregs)
    71 case 0: fsr = *pfsr;
    72 if (IR == -1) IR = 2;
    73 /* fcc is always fcc0 */
    74 - fsr &= ~0xc00; fsr |= (IR << 10); break;
    75 + fsr &= ~0xc00; fsr |= (IR << 10);
    76 *pfsr = fsr;
    77 break;
    78 case 1: rd->s = IR; break;
    79 diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c
    80 index 16b58ff11e65..2cfb0f25e0ed 100644
    81 --- a/arch/sparc/mm/init_64.c
    82 +++ b/arch/sparc/mm/init_64.c
    83 @@ -351,6 +351,10 @@ void update_mmu_cache(struct vm_area_struct *vma, unsigned long address, pte_t *
    84
    85 mm = vma->vm_mm;
    86
    87 + /* Don't insert a non-valid PTE into the TSB, we'll deadlock. */
    88 + if (!pte_accessible(mm, pte))
    89 + return;
    90 +
    91 spin_lock_irqsave(&mm->context.lock, flags);
    92
    93 #if defined(CONFIG_HUGETLB_PAGE) || defined(CONFIG_TRANSPARENT_HUGEPAGE)
    94 @@ -2619,6 +2623,10 @@ void update_mmu_cache_pmd(struct vm_area_struct *vma, unsigned long addr,
    95
    96 pte = pmd_val(entry);
    97
    98 + /* Don't insert a non-valid PMD into the TSB, we'll deadlock. */
    99 + if (!(pte & _PAGE_VALID))
    100 + return;
    101 +
    102 /* We are fabricating 8MB pages using 4MB real hw pages. */
    103 pte |= (addr & (1UL << REAL_HPAGE_SHIFT));
    104
    105 @@ -2699,3 +2707,26 @@ void hugetlb_setup(struct pt_regs *regs)
    106 }
    107 }
    108 #endif
    109 +
    110 +#ifdef CONFIG_SMP
    111 +#define do_flush_tlb_kernel_range smp_flush_tlb_kernel_range
    112 +#else
    113 +#define do_flush_tlb_kernel_range __flush_tlb_kernel_range
    114 +#endif
    115 +
    116 +void flush_tlb_kernel_range(unsigned long start, unsigned long end)
    117 +{
    118 + if (start < HI_OBP_ADDRESS && end > LOW_OBP_ADDRESS) {
    119 + if (start < LOW_OBP_ADDRESS) {
    120 + flush_tsb_kernel_range(start, LOW_OBP_ADDRESS);
    121 + do_flush_tlb_kernel_range(start, LOW_OBP_ADDRESS);
    122 + }
    123 + if (end > HI_OBP_ADDRESS) {
    124 + flush_tsb_kernel_range(end, HI_OBP_ADDRESS);
    125 + do_flush_tlb_kernel_range(end, HI_OBP_ADDRESS);
    126 + }
    127 + } else {
    128 + flush_tsb_kernel_range(start, end);
    129 + do_flush_tlb_kernel_range(start, end);
    130 + }
    131 +}
    132 diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
    133 index 8afa579e7c40..a3dd5dc64f4c 100644
    134 --- a/drivers/net/ethernet/broadcom/tg3.c
    135 +++ b/drivers/net/ethernet/broadcom/tg3.c
    136 @@ -7830,17 +7830,18 @@ static int tigon3_dma_hwbug_workaround(struct tg3_napi *tnapi,
    137
    138 static netdev_tx_t tg3_start_xmit(struct sk_buff *, struct net_device *);
    139
    140 -/* Use GSO to workaround a rare TSO bug that may be triggered when the
    141 - * TSO header is greater than 80 bytes.
    142 +/* Use GSO to workaround all TSO packets that meet HW bug conditions
    143 + * indicated in tg3_tx_frag_set()
    144 */
    145 -static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
    146 +static int tg3_tso_bug(struct tg3 *tp, struct tg3_napi *tnapi,
    147 + struct netdev_queue *txq, struct sk_buff *skb)
    148 {
    149 struct sk_buff *segs, *nskb;
    150 u32 frag_cnt_est = skb_shinfo(skb)->gso_segs * 3;
    151
    152 /* Estimate the number of fragments in the worst case */
    153 - if (unlikely(tg3_tx_avail(&tp->napi[0]) <= frag_cnt_est)) {
    154 - netif_stop_queue(tp->dev);
    155 + if (unlikely(tg3_tx_avail(tnapi) <= frag_cnt_est)) {
    156 + netif_tx_stop_queue(txq);
    157
    158 /* netif_tx_stop_queue() must be done before checking
    159 * checking tx index in tg3_tx_avail() below, because in
    160 @@ -7848,13 +7849,14 @@ static int tg3_tso_bug(struct tg3 *tp, struct sk_buff *skb)
    161 * netif_tx_queue_stopped().
    162 */
    163 smp_mb();
    164 - if (tg3_tx_avail(&tp->napi[0]) <= frag_cnt_est)
    165 + if (tg3_tx_avail(tnapi) <= frag_cnt_est)
    166 return NETDEV_TX_BUSY;
    167
    168 - netif_wake_queue(tp->dev);
    169 + netif_tx_wake_queue(txq);
    170 }
    171
    172 - segs = skb_gso_segment(skb, tp->dev->features & ~(NETIF_F_TSO | NETIF_F_TSO6));
    173 + segs = skb_gso_segment(skb, tp->dev->features &
    174 + ~(NETIF_F_TSO | NETIF_F_TSO6));
    175 if (IS_ERR(segs) || !segs)
    176 goto tg3_tso_bug_end;
    177
    178 @@ -7930,7 +7932,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
    179 if (!skb_is_gso_v6(skb)) {
    180 if (unlikely((ETH_HLEN + hdr_len) > 80) &&
    181 tg3_flag(tp, TSO_BUG))
    182 - return tg3_tso_bug(tp, skb);
    183 + return tg3_tso_bug(tp, tnapi, txq, skb);
    184
    185 ip_csum = iph->check;
    186 ip_tot_len = iph->tot_len;
    187 @@ -8061,7 +8063,7 @@ static netdev_tx_t tg3_start_xmit(struct sk_buff *skb, struct net_device *dev)
    188 iph->tot_len = ip_tot_len;
    189 }
    190 tcph->check = tcp_csum;
    191 - return tg3_tso_bug(tp, skb);
    192 + return tg3_tso_bug(tp, tnapi, txq, skb);
    193 }
    194
    195 /* If the workaround fails due to memory/mapping
    196 diff --git a/drivers/net/ethernet/brocade/bna/bnad.c b/drivers/net/ethernet/brocade/bna/bnad.c
    197 index 3a77f9ead004..556aab75f490 100644
    198 --- a/drivers/net/ethernet/brocade/bna/bnad.c
    199 +++ b/drivers/net/ethernet/brocade/bna/bnad.c
    200 @@ -600,9 +600,9 @@ bnad_cq_process(struct bnad *bnad, struct bna_ccb *ccb, int budget)
    201 prefetch(bnad->netdev);
    202
    203 cq = ccb->sw_q;
    204 - cmpl = &cq[ccb->producer_index];
    205
    206 while (packets < budget) {
    207 + cmpl = &cq[ccb->producer_index];
    208 if (!cmpl->valid)
    209 break;
    210 /* The 'valid' field is set by the adapter, only after writing
    211 diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
    212 index 958df383068a..ef8a5c20236a 100644
    213 --- a/drivers/net/macvlan.c
    214 +++ b/drivers/net/macvlan.c
    215 @@ -646,6 +646,7 @@ static int macvlan_init(struct net_device *dev)
    216 (lowerdev->state & MACVLAN_STATE_MASK);
    217 dev->features = lowerdev->features & MACVLAN_FEATURES;
    218 dev->features |= ALWAYS_ON_FEATURES;
    219 + dev->vlan_features = lowerdev->vlan_features & MACVLAN_FEATURES;
    220 dev->gso_max_size = lowerdev->gso_max_size;
    221 dev->iflink = lowerdev->ifindex;
    222 dev->hard_header_len = lowerdev->hard_header_len;
    223 diff --git a/drivers/net/phy/mdio_bus.c b/drivers/net/phy/mdio_bus.c
    224 index 203651ebccb0..4eaadcfcb0fe 100644
    225 --- a/drivers/net/phy/mdio_bus.c
    226 +++ b/drivers/net/phy/mdio_bus.c
    227 @@ -255,7 +255,6 @@ int mdiobus_register(struct mii_bus *bus)
    228
    229 bus->dev.parent = bus->parent;
    230 bus->dev.class = &mdio_bus_class;
    231 - bus->dev.driver = bus->parent->driver;
    232 bus->dev.groups = NULL;
    233 dev_set_name(&bus->dev, "%s", bus->id);
    234
    235 diff --git a/drivers/sbus/char/bbc_envctrl.c b/drivers/sbus/char/bbc_envctrl.c
    236 index 160e7510aca6..0787b9756165 100644
    237 --- a/drivers/sbus/char/bbc_envctrl.c
    238 +++ b/drivers/sbus/char/bbc_envctrl.c
    239 @@ -452,6 +452,9 @@ static void attach_one_temp(struct bbc_i2c_bus *bp, struct platform_device *op,
    240 if (!tp)
    241 return;
    242
    243 + INIT_LIST_HEAD(&tp->bp_list);
    244 + INIT_LIST_HEAD(&tp->glob_list);
    245 +
    246 tp->client = bbc_i2c_attach(bp, op);
    247 if (!tp->client) {
    248 kfree(tp);
    249 @@ -497,6 +500,9 @@ static void attach_one_fan(struct bbc_i2c_bus *bp, struct platform_device *op,
    250 if (!fp)
    251 return;
    252
    253 + INIT_LIST_HEAD(&fp->bp_list);
    254 + INIT_LIST_HEAD(&fp->glob_list);
    255 +
    256 fp->client = bbc_i2c_attach(bp, op);
    257 if (!fp->client) {
    258 kfree(fp);
    259 diff --git a/drivers/sbus/char/bbc_i2c.c b/drivers/sbus/char/bbc_i2c.c
    260 index c7763e482eb2..812b5f0361b6 100644
    261 --- a/drivers/sbus/char/bbc_i2c.c
    262 +++ b/drivers/sbus/char/bbc_i2c.c
    263 @@ -300,13 +300,18 @@ static struct bbc_i2c_bus * attach_one_i2c(struct platform_device *op, int index
    264 if (!bp)
    265 return NULL;
    266
    267 + INIT_LIST_HEAD(&bp->temps);
    268 + INIT_LIST_HEAD(&bp->fans);
    269 +
    270 bp->i2c_control_regs = of_ioremap(&op->resource[0], 0, 0x2, "bbc_i2c_regs");
    271 if (!bp->i2c_control_regs)
    272 goto fail;
    273
    274 - bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel");
    275 - if (!bp->i2c_bussel_reg)
    276 - goto fail;
    277 + if (op->num_resources == 2) {
    278 + bp->i2c_bussel_reg = of_ioremap(&op->resource[1], 0, 0x1, "bbc_i2c_bussel");
    279 + if (!bp->i2c_bussel_reg)
    280 + goto fail;
    281 + }
    282
    283 bp->waiting = 0;
    284 init_waitqueue_head(&bp->wq);
    285 diff --git a/drivers/tty/serial/sunsab.c b/drivers/tty/serial/sunsab.c
    286 index 2f57df9a71d9..a1e09c0d46f2 100644
    287 --- a/drivers/tty/serial/sunsab.c
    288 +++ b/drivers/tty/serial/sunsab.c
    289 @@ -157,6 +157,15 @@ receive_chars(struct uart_sunsab_port *up,
    290 (up->port.line == up->port.cons->index))
    291 saw_console_brk = 1;
    292
    293 + if (count == 0) {
    294 + if (unlikely(stat->sreg.isr1 & SAB82532_ISR1_BRK)) {
    295 + stat->sreg.isr0 &= ~(SAB82532_ISR0_PERR |
    296 + SAB82532_ISR0_FERR);
    297 + up->port.icount.brk++;
    298 + uart_handle_break(&up->port);
    299 + }
    300 + }
    301 +
    302 for (i = 0; i < count; i++) {
    303 unsigned char ch = buf[i], flag;
    304
    305 diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
    306 index a4daf9eb8562..8dd8cab88b87 100644
    307 --- a/include/net/ip_tunnels.h
    308 +++ b/include/net/ip_tunnels.h
    309 @@ -40,6 +40,7 @@ struct ip_tunnel_prl_entry {
    310
    311 struct ip_tunnel_dst {
    312 struct dst_entry __rcu *dst;
    313 + __be32 saddr;
    314 };
    315
    316 struct ip_tunnel {
    317 diff --git a/lib/iovec.c b/lib/iovec.c
    318 index 7a7c2da4cddf..df3abd1eaa4a 100644
    319 --- a/lib/iovec.c
    320 +++ b/lib/iovec.c
    321 @@ -85,6 +85,10 @@ EXPORT_SYMBOL(memcpy_toiovecend);
    322 int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov,
    323 int offset, int len)
    324 {
    325 + /* No data? Done! */
    326 + if (len == 0)
    327 + return 0;
    328 +
    329 /* Skip over the finished iovecs */
    330 while (offset >= iov->iov_len) {
    331 offset -= iov->iov_len;
    332 diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
    333 index f14e54a05691..022d18ab27a6 100644
    334 --- a/net/batman-adv/fragmentation.c
    335 +++ b/net/batman-adv/fragmentation.c
    336 @@ -128,6 +128,7 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
    337 {
    338 struct batadv_frag_table_entry *chain;
    339 struct batadv_frag_list_entry *frag_entry_new = NULL, *frag_entry_curr;
    340 + struct batadv_frag_list_entry *frag_entry_last = NULL;
    341 struct batadv_frag_packet *frag_packet;
    342 uint8_t bucket;
    343 uint16_t seqno, hdr_size = sizeof(struct batadv_frag_packet);
    344 @@ -180,11 +181,14 @@ static bool batadv_frag_insert_packet(struct batadv_orig_node *orig_node,
    345 ret = true;
    346 goto out;
    347 }
    348 +
    349 + /* store current entry because it could be the last in list */
    350 + frag_entry_last = frag_entry_curr;
    351 }
    352
    353 - /* Reached the end of the list, so insert after 'frag_entry_curr'. */
    354 - if (likely(frag_entry_curr)) {
    355 - hlist_add_after(&frag_entry_curr->list, &frag_entry_new->list);
    356 + /* Reached the end of the list, so insert after 'frag_entry_last'. */
    357 + if (likely(frag_entry_last)) {
    358 + hlist_add_after(&frag_entry_last->list, &frag_entry_new->list);
    359 chain->size += skb->len - hdr_size;
    360 chain->timestamp = jiffies;
    361 ret = true;
    362 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
    363 index c1a33033cbe2..58ff88edbefd 100644
    364 --- a/net/core/skbuff.c
    365 +++ b/net/core/skbuff.c
    366 @@ -2976,9 +2976,9 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
    367 tail = nskb;
    368
    369 __copy_skb_header(nskb, head_skb);
    370 - nskb->mac_len = head_skb->mac_len;
    371
    372 skb_headers_offset_update(nskb, skb_headroom(nskb) - headroom);
    373 + skb_reset_mac_len(nskb);
    374
    375 skb_copy_from_linear_data_offset(head_skb, -tnl_hlen,
    376 nskb->data - tnl_hlen,
    377 diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
    378 index 6f9de61dce5f..45920d928341 100644
    379 --- a/net/ipv4/ip_tunnel.c
    380 +++ b/net/ipv4/ip_tunnel.c
    381 @@ -69,23 +69,25 @@ static unsigned int ip_tunnel_hash(__be32 key, __be32 remote)
    382 }
    383
    384 static void __tunnel_dst_set(struct ip_tunnel_dst *idst,
    385 - struct dst_entry *dst)
    386 + struct dst_entry *dst, __be32 saddr)
    387 {
    388 struct dst_entry *old_dst;
    389
    390 dst_clone(dst);
    391 old_dst = xchg((__force struct dst_entry **)&idst->dst, dst);
    392 dst_release(old_dst);
    393 + idst->saddr = saddr;
    394 }
    395
    396 -static void tunnel_dst_set(struct ip_tunnel *t, struct dst_entry *dst)
    397 +static void tunnel_dst_set(struct ip_tunnel *t,
    398 + struct dst_entry *dst, __be32 saddr)
    399 {
    400 - __tunnel_dst_set(this_cpu_ptr(t->dst_cache), dst);
    401 + __tunnel_dst_set(this_cpu_ptr(t->dst_cache), dst, saddr);
    402 }
    403
    404 static void tunnel_dst_reset(struct ip_tunnel *t)
    405 {
    406 - tunnel_dst_set(t, NULL);
    407 + tunnel_dst_set(t, NULL, 0);
    408 }
    409
    410 void ip_tunnel_dst_reset_all(struct ip_tunnel *t)
    411 @@ -93,20 +95,25 @@ void ip_tunnel_dst_reset_all(struct ip_tunnel *t)
    412 int i;
    413
    414 for_each_possible_cpu(i)
    415 - __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL);
    416 + __tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL, 0);
    417 }
    418 EXPORT_SYMBOL(ip_tunnel_dst_reset_all);
    419
    420 -static struct rtable *tunnel_rtable_get(struct ip_tunnel *t, u32 cookie)
    421 +static struct rtable *tunnel_rtable_get(struct ip_tunnel *t,
    422 + u32 cookie, __be32 *saddr)
    423 {
    424 + struct ip_tunnel_dst *idst;
    425 struct dst_entry *dst;
    426
    427 rcu_read_lock();
    428 - dst = rcu_dereference(this_cpu_ptr(t->dst_cache)->dst);
    429 + idst = this_cpu_ptr(t->dst_cache);
    430 + dst = rcu_dereference(idst->dst);
    431 if (dst && !atomic_inc_not_zero(&dst->__refcnt))
    432 dst = NULL;
    433 if (dst) {
    434 - if (dst->obsolete && dst->ops->check(dst, cookie) == NULL) {
    435 + if (!dst->obsolete || dst->ops->check(dst, cookie)) {
    436 + *saddr = idst->saddr;
    437 + } else {
    438 tunnel_dst_reset(t);
    439 dst_release(dst);
    440 dst = NULL;
    441 @@ -367,7 +374,7 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
    442
    443 if (!IS_ERR(rt)) {
    444 tdev = rt->dst.dev;
    445 - tunnel_dst_set(tunnel, &rt->dst);
    446 + tunnel_dst_set(tunnel, &rt->dst, fl4.saddr);
    447 ip_rt_put(rt);
    448 }
    449 if (dev->type != ARPHRD_ETHER)
    450 @@ -610,7 +617,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
    451 init_tunnel_flow(&fl4, protocol, dst, tnl_params->saddr,
    452 tunnel->parms.o_key, RT_TOS(tos), tunnel->parms.link);
    453
    454 - rt = connected ? tunnel_rtable_get(tunnel, 0) : NULL;
    455 + rt = connected ? tunnel_rtable_get(tunnel, 0, &fl4.saddr) : NULL;
    456
    457 if (!rt) {
    458 rt = ip_route_output_key(tunnel->net, &fl4);
    459 @@ -620,7 +627,7 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
    460 goto tx_error;
    461 }
    462 if (connected)
    463 - tunnel_dst_set(tunnel, &rt->dst);
    464 + tunnel_dst_set(tunnel, &rt->dst, fl4.saddr);
    465 }
    466
    467 if (rt->dst.dev == dev) {
    468 diff --git a/net/ipv4/tcp_vegas.c b/net/ipv4/tcp_vegas.c
    469 index 9a5e05f27f4f..b40ad897f945 100644
    470 --- a/net/ipv4/tcp_vegas.c
    471 +++ b/net/ipv4/tcp_vegas.c
    472 @@ -218,7 +218,8 @@ static void tcp_vegas_cong_avoid(struct sock *sk, u32 ack, u32 acked)
    473 * This is:
    474 * (actual rate in segments) * baseRTT
    475 */
    476 - target_cwnd = tp->snd_cwnd * vegas->baseRTT / rtt;
    477 + target_cwnd = (u64)tp->snd_cwnd * vegas->baseRTT;
    478 + do_div(target_cwnd, rtt);
    479
    480 /* Calculate the difference between the window we had,
    481 * and the window we would like to have. This quantity
    482 diff --git a/net/ipv4/tcp_veno.c b/net/ipv4/tcp_veno.c
    483 index 27b9825753d1..8276977d2c85 100644
    484 --- a/net/ipv4/tcp_veno.c
    485 +++ b/net/ipv4/tcp_veno.c
    486 @@ -144,7 +144,7 @@ static void tcp_veno_cong_avoid(struct sock *sk, u32 ack, u32 acked)
    487
    488 rtt = veno->minrtt;
    489
    490 - target_cwnd = (tp->snd_cwnd * veno->basertt);
    491 + target_cwnd = (u64)tp->snd_cwnd * veno->basertt;
    492 target_cwnd <<= V_PARAM_SHIFT;
    493 do_div(target_cwnd, rtt);
    494
    495 diff --git a/net/sctp/output.c b/net/sctp/output.c
    496 index 01ab8e0723f0..407ae2bf97b0 100644
    497 --- a/net/sctp/output.c
    498 +++ b/net/sctp/output.c
    499 @@ -599,7 +599,7 @@ out:
    500 return err;
    501 no_route:
    502 kfree_skb(nskb);
    503 - IP_INC_STATS_BH(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
    504 + IP_INC_STATS(sock_net(asoc->base.sk), IPSTATS_MIB_OUTNOROUTES);
    505
    506 /* FIXME: Returning the 'err' will effect all the associations
    507 * associated with a socket, although only one of the paths of the