Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

Conflicts:
	drivers/net/ethernet/broadcom/genet/bcmgenet.c
	net/core/sock.c

Conflicts were overlapping changes in bcmgenet and the
lockdep handling of sockets.

Signed-off-by: David S. Miller <davem@davemloft.net>

7 files changed, 34 insertions, 18 deletions

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 04db40620ea6..a9a9553ee63d 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -920,12 +920,12 @@ static int __init inet6_init(void)
         err = register_pernet_subsys(&inet6_net_ops);
         if (err)
                 goto register_pernet_fail;
-        err = icmpv6_init();
-        if (err)
-                goto icmp_fail;
         err = ip6_mr_init();
         if (err)
                 goto ipmr_fail;
+        err = icmpv6_init();
+        if (err)
+                goto icmp_fail;
         err = ndisc_init();
         if (err)
                 goto ndisc_fail;
@@ -1061,10 +1061,10 @@ igmp_fail:
         ndisc_cleanup();
 ndisc_fail:
         ip6_mr_cleanup();
-ipmr_fail:
-        icmpv6_cleanup();
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
+ipmr_fail:
+        icmpv6_cleanup();
 register_pernet_fail:
         sock_unregister(PF_INET6);
         rtnl_unregister_all(PF_INET6);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index e4266746e4a2..d4bf2c68a545 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -923,6 +923,8 @@ add:
                         ins = &rt->dst.rt6_next;
                         iter = *ins;
                         while (iter) {
+                                if (iter->rt6i_metric > rt->rt6i_metric)
+                                        break;
                                 if (rt6_qualify_for_ecmp(iter)) {
                                         *ins = iter->dst.rt6_next;
                                         fib6_purge_rt(iter, fn, info->nl_net);
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 0838e6d01d2e..93e58a5e1837 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -294,8 +294,10 @@ static int ipv6_gro_complete(struct sk_buff *skb, int nhoff)
         struct ipv6hdr *iph = (struct ipv6hdr *)(skb->data + nhoff);
         int err = -ENOSYS;
 
-        if (skb->encapsulation)
+        if (skb->encapsulation) {
+                skb_set_inner_protocol(skb, cpu_to_be16(ETH_P_IPV6));
                 skb_set_inner_network_header(skb, nhoff);
+        }
 
         iph->payload_len = htons(skb->len - nhoff - sizeof(*iph));
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 528b3c1f3fde..58f6288e9ba5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -768,13 +768,14 @@ slow_path:
          *      Fragment the datagram.
          */
 
-        *prevhdr = NEXTHDR_FRAGMENT;
         troom = rt->dst.dev->needed_tailroom;
 
         /*
          *      Keep copying data until we run out.
          */
         while (left > 0)        {
+                u8 *fragnexthdr_offset;
+
                 len = left;
                 /* IF: it doesn't fit, use 'mtu' - the data space left */
                 if (len > mtu)
@@ -819,6 +820,10 @@ slow_path:
                  */
                 skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 
+                fragnexthdr_offset = skb_network_header(frag);
+                fragnexthdr_offset += prevhdr - skb_network_header(skb);
+                *fragnexthdr_offset = NEXTHDR_FRAGMENT;
+
                 /*
                  *      Build fragment header.
                  */
@@ -1385,7 +1390,7 @@ emsgsize:
         if ((((length + fragheaderlen) > mtu) ||
              (skb && skb_is_gso(skb))) &&
             (sk->sk_protocol == IPPROTO_UDP) &&
-            (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len &&
+            (rt->dst.dev->features & NETIF_F_UFO) && !dst_xfrm(&rt->dst) &&
             (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
                 err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
                                           hh_len, fragheaderlen, exthdrlen,
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 644ba59fbd9d..3d8a3b63b4fd 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -485,11 +485,15 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
         if (!skb->ignore_df && skb->len > mtu) {
                 skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu);
 
-                if (skb->protocol == htons(ETH_P_IPV6))
+                if (skb->protocol == htons(ETH_P_IPV6)) {
+                        if (mtu < IPV6_MIN_MTU)
+                                mtu = IPV6_MIN_MTU;
+
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
-                else
+                } else {
                         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                                   htonl(mtu));
+                }
 
                 return -EMSGSIZE;
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 229bfcc451ef..35c58b669ebd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3299,7 +3299,6 @@ static size_t rt6_nlmsg_size(struct rt6_info *rt)
                 nexthop_len = nla_total_size(0)  /* RTA_MULTIPATH */
                             + NLA_ALIGN(sizeof(struct rtnexthop))
                             + nla_total_size(16) /* RTA_GATEWAY */
-                            + nla_total_size(4)  /* RTA_OIF */
                             + lwtunnel_get_encap_size(rt->dst.lwtstate);
 
                 nexthop_len *= rt->rt6i_nsiblings;
@@ -3323,7 +3322,7 @@ static size_t rt6_nlmsg_size(struct rt6_info *rt)
 }
 
 static int rt6_nexthop_info(struct sk_buff *skb, struct rt6_info *rt,
-                            unsigned int *flags)
+                            unsigned int *flags, bool skip_oif)
 {
         if (!netif_running(rt->dst.dev) || !netif_carrier_ok(rt->dst.dev)) {
                 *flags |= RTNH_F_LINKDOWN;
@@ -3336,7 +3335,8 @@ static int rt6_nexthop_info(struct sk_buff *skb, struct rt6_info *rt,
                         goto nla_put_failure;
         }
 
-        if (rt->dst.dev &&
+        /* not needed for multipath encoding b/c it has a rtnexthop struct */
+        if (!skip_oif && rt->dst.dev &&
             nla_put_u32(skb, RTA_OIF, rt->dst.dev->ifindex))
                 goto nla_put_failure;
 
@@ -3350,6 +3350,7 @@ nla_put_failure:
         return -EMSGSIZE;
 }
 
+/* add multipath next hop */
 static int rt6_add_nexthop(struct sk_buff *skb, struct rt6_info *rt)
 {
         struct rtnexthop *rtnh;
@@ -3362,7 +3363,7 @@ static int rt6_add_nexthop(struct sk_buff *skb, struct rt6_info *rt)
         rtnh->rtnh_hops = 0;
         rtnh->rtnh_ifindex = rt->dst.dev ? rt->dst.dev->ifindex : 0;
 
-        if (rt6_nexthop_info(skb, rt, &flags) < 0)
+        if (rt6_nexthop_info(skb, rt, &flags, true) < 0)
                 goto nla_put_failure;
 
         rtnh->rtnh_flags = flags;
@@ -3515,7 +3516,7 @@ static int rt6_fill_node(struct net *net,
 
                 nla_nest_end(skb, mp);
         } else {
-                if (rt6_nexthop_info(skb, rt, &rtm->rtm_flags) < 0)
+                if (rt6_nexthop_info(skb, rt, &rtm->rtm_flags, false) < 0)
                         goto nla_put_failure;
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 56f742fff967..c73a431fd06f 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -391,10 +391,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         np = inet6_sk(sk);
 
         if (type == NDISC_REDIRECT) {
-                struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+                if (!sock_owned_by_user(sk)) {
+                        struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 
-                if (dst)
-                        dst->ops->redirect(dst, sk, skb);
+                        if (dst)
+                                dst->ops->redirect(dst, sk, skb);
+                }
                 goto out;
         }