18 files changed, 115 insertions, 79 deletions

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 6e280a8a31e..6a9a6cd74b1 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -113,7 +113,7 @@ void br_netfilter_rtable_init(struct net_bridge *br)
         struct rtable *rt = &br->fake_rtable;
 
         atomic_set(&rt->u.dst.__refcnt, 1);
-        rt->u.dst.dev = &br->dev;
+        rt->u.dst.dev = br->dev;
         rt->u.dst.path = &rt->u.dst;
         rt->u.dst.metrics[RTAX_MTU - 1] = 1500;
         rt->u.dst.flags = DST_NOXFRM;
diff --git a/net/core/dev.c b/net/core/dev.c
index cbf80098980..01993ad74e7 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1805,7 +1805,6 @@ gso:
 
                 spin_unlock(root_lock);
 
-                rc = rc == NET_XMIT_BYPASS ? NET_XMIT_SUCCESS : rc;
                 goto out;
         }
 
@@ -1909,7 +1908,6 @@ int netif_rx(struct sk_buff *skb)
         if (queue->input_pkt_queue.qlen <= netdev_max_backlog) {
                 if (queue->input_pkt_queue.qlen) {
 enqueue:
-                        dev_hold(skb->dev);
                         __skb_queue_tail(&queue->input_pkt_queue, skb);
                         local_irq_restore(flags);
                         return NET_RX_SUCCESS;
@@ -2270,6 +2268,20 @@ out:
         return ret;
 }
 
+/* Network device is going away, flush any packets still pending  */
+static void flush_backlog(void *arg)
+{
+        struct net_device *dev = arg;
+        struct softnet_data *queue = &__get_cpu_var(softnet_data);
+        struct sk_buff *skb, *tmp;
+
+        skb_queue_walk_safe(&queue->input_pkt_queue, skb, tmp)
+                if (skb->dev == dev) {
+                        __skb_unlink(skb, &queue->input_pkt_queue);
+                        kfree_skb(skb);
+                }
+}
+
 static int process_backlog(struct napi_struct *napi, int quota)
 {
         int work = 0;
@@ -2279,7 +2291,6 @@ static int process_backlog(struct napi_struct *napi, int quota)
         napi->weight = weight_p;
         do {
                 struct sk_buff *skb;
-                struct net_device *dev;
 
                 local_irq_disable();
                 skb = __skb_dequeue(&queue->input_pkt_queue);
@@ -2288,14 +2299,9 @@ static int process_backlog(struct napi_struct *napi, int quota)
                         local_irq_enable();
                         break;
                 }
-
                 local_irq_enable();
 
-                dev = skb->dev;
-
                 netif_receive_skb(skb);
-
-                dev_put(dev);
         } while (++work < quota && jiffies == start_time);
 
         return work;
@@ -4169,6 +4175,8 @@ void netdev_run_todo(void)
 
                 dev->reg_state = NETREG_UNREGISTERED;
 
+                on_each_cpu(flush_backlog, dev, 1);
+
                 netdev_wait_allrefs(dev);
 
                 /* paranoia */
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index a027003d69a..a4402de425d 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -269,7 +269,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         skb->mark = sk->sk_mark;
 
         mtu = dst_mtu(dst);
-        if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
+        if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
                 IP6_INC_STATS(ip6_dst_idev(skb->dst),
                               IPSTATS_MIB_OUTREQUESTS);
                 return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ea33b26512c..741cfcd96f8 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -346,6 +346,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                  */
                 if (optlen == 0)
                         optval = NULL;
+                else if (optval == NULL)
+                        goto e_inval;
                 else if (optlen < sizeof(struct ipv6_opt_hdr) ||
                          optlen & 0x7 || optlen > 8 * 255)
                         goto e_inval;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index a46badd1082..ec394cf5a19 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -199,10 +199,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq6 = inet6_rsk(req);
         treq = tcp_rsk(req);
 
-        if (security_inet_conn_request(sk, skb, req)) {
-                reqsk_free(req);
-                goto out;
-        }
+        if (security_inet_conn_request(sk, skb, req))
+                goto out_free;
 
         req->mss = mss;
         ireq->rmt_port = th->source;
@@ -255,14 +253,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_sk(sk)->sport;
                 security_req_classify_flow(req, &fl);
-                if (ip6_dst_lookup(sk, &dst, &fl)) {
-                        reqsk_free(req);
-                        goto out;
-                }
+                if (ip6_dst_lookup(sk, &dst, &fl))
+                        goto out_free;
+
                 if (final_p)
                         ipv6_addr_copy(&fl.fl6_dst, final_p);
                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
-                        goto out;
+                        goto out_free;
         }
 
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
@@ -273,7 +270,10 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq->rcv_wscale = rcv_wscale;
 
         ret = get_cookie_sock(sk, skb, req, dst);
-
-out:    return ret;
+out:
+        return ret;
+out_free:
+        reqsk_free(req);
+        return NULL;
 }
 
diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
index 6b517b9dac5..43d37256c15 100644
--- a/net/sched/sch_atm.c
+++ b/net/sched/sch_atm.c
@@ -415,7 +415,7 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
                         kfree_skb(skb);
-                        return NET_XMIT_SUCCESS;
+                        return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         kfree_skb(skb);
                         goto drop;
@@ -432,9 +432,11 @@ static int atm_tc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         ret = qdisc_enqueue(skb, flow->q);
         if (ret != 0) {
 drop: __maybe_unused
-                sch->qstats.drops++;
-                if (flow)
-                        flow->qstats.drops++;
+                if (net_xmit_drop_count(ret)) {
+                        sch->qstats.drops++;
+                        if (flow)
+                                flow->qstats.drops++;
+                }
                 return ret;
         }
         sch->bstats.bytes += qdisc_pkt_len(skb);
@@ -455,7 +457,7 @@ drop: __maybe_unused
                 return 0;
         }
         tasklet_schedule(&p->task);
-        return NET_XMIT_BYPASS;
+        return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 
 /*
@@ -530,7 +532,7 @@ static int atm_tc_requeue(struct sk_buff *skb, struct Qdisc *sch)
         if (!ret) {
                 sch->q.qlen++;
                 sch->qstats.requeues++;
-        } else {
+        } else if (net_xmit_drop_count(ret)) {
                 sch->qstats.drops++;
                 p->link.qstats.drops++;
         }
diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
index 14954bf4a68..4e261ce62f4 100644
--- a/net/sched/sch_cbq.c
+++ b/net/sched/sch_cbq.c
@@ -230,7 +230,7 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
             (cl = cbq_class_lookup(q, prio)) != NULL)
                 return cl;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         for (;;) {
                 int result = 0;
                 defmap = head->defaults;
@@ -256,7 +256,7 @@ cbq_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                 switch (result) {
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return NULL;
                 case TC_ACT_RECLASSIFY:
@@ -377,7 +377,7 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         q->rx_class = cl;
 #endif
         if (cl == NULL) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
@@ -397,9 +397,11 @@ cbq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 return ret;
         }
 
-        sch->qstats.drops++;
-        cbq_mark_toplevel(q, cl);
-        cl->qstats.drops++;
+        if (net_xmit_drop_count(ret)) {
+                sch->qstats.drops++;
+                cbq_mark_toplevel(q, cl);
+                cl->qstats.drops++;
+        }
         return ret;
 }
 
@@ -430,8 +432,10 @@ cbq_requeue(struct sk_buff *skb, struct Qdisc *sch)
                         cbq_activate_class(cl);
                 return 0;
         }
-        sch->qstats.drops++;
-        cl->qstats.drops++;
+        if (net_xmit_drop_count(ret)) {
+                sch->qstats.drops++;
+                cl->qstats.drops++;
+        }
         return ret;
 }
 
@@ -664,13 +668,15 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
         q->rx_class = NULL;
 
         if (cl && (cl = cbq_reclassify(skb, cl)) != NULL) {
+                int ret;
 
                 cbq_mark_toplevel(q, cl);
 
                 q->rx_class = cl;
                 cl->q->__parent = sch;
 
-                if (qdisc_enqueue(skb, cl->q) == 0) {
+                ret = qdisc_enqueue(skb, cl->q);
+                if (ret == NET_XMIT_SUCCESS) {
                         sch->q.qlen++;
                         sch->bstats.packets++;
                         sch->bstats.bytes += qdisc_pkt_len(skb);
@@ -678,7 +684,8 @@ static int cbq_reshape_fail(struct sk_buff *skb, struct Qdisc *child)
                                 cbq_activate_class(cl);
                         return 0;
                 }
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret))
+                        sch->qstats.drops++;
                 return 0;
         }
 
diff --git a/net/sched/sch_dsmark.c b/net/sched/sch_dsmark.c
index a935676987e..edd1298f85f 100644
--- a/net/sched/sch_dsmark.c
+++ b/net/sched/sch_dsmark.c
@@ -236,7 +236,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
                         kfree_skb(skb);
-                        return NET_XMIT_SUCCESS;
+                        return NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
 
                 case TC_ACT_SHOT:
                         goto drop;
@@ -254,7 +254,8 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         err = qdisc_enqueue(skb, p->q);
         if (err != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(err))
+                        sch->qstats.drops++;
                 return err;
         }
 
@@ -267,7 +268,7 @@ static int dsmark_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 drop:
         kfree_skb(skb);
         sch->qstats.drops++;
-        return NET_XMIT_BYPASS;
+        return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
 }
 
 static struct sk_buff *dsmark_dequeue(struct Qdisc *sch)
@@ -321,7 +322,8 @@ static int dsmark_requeue(struct sk_buff *skb, struct Qdisc *sch)
 
         err = p->q->ops->requeue(skb, p->q);
         if (err != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(err))
+                        sch->qstats.drops++;
                 return err;
         }
 
diff --git a/net/sched/sch_hfsc.c b/net/sched/sch_hfsc.c
index 0ae7d19dcba..c2b8d9cce3d 100644
--- a/net/sched/sch_hfsc.c
+++ b/net/sched/sch_hfsc.c
@@ -1159,14 +1159,14 @@ hfsc_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
                 if (cl->level == 0)
                         return cl;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         tcf = q->root.filter_list;
         while (tcf && (result = tc_classify(skb, tcf, &res)) >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                 switch (result) {
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -1578,7 +1578,7 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         cl = hfsc_classify(skb, sch, &err);
         if (cl == NULL) {
-                if (err == NET_XMIT_BYPASS)
+                if (err & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return err;
@@ -1586,8 +1586,10 @@ hfsc_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         err = qdisc_enqueue(skb, cl->qdisc);
         if (unlikely(err != NET_XMIT_SUCCESS)) {
-                cl->qstats.drops++;
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(err)) {
+                        cl->qstats.drops++;
+                        sch->qstats.drops++;
+                }
                 return err;
         }
 
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index 75a40951c4f..be35422711a 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -214,14 +214,14 @@ static struct htb_class *htb_classify(struct sk_buff *skb, struct Qdisc *sch,
         if ((cl = htb_find(skb->priority, sch)) != NULL && cl->level == 0)
                 return cl;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         tcf = q->filter_list;
         while (tcf && (result = tc_classify(skb, tcf, &res)) >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                 switch (result) {
                 case TC_ACT_QUEUED:
                 case TC_ACT_STOLEN:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -567,14 +567,16 @@ static int htb_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 }
 #ifdef CONFIG_NET_CLS_ACT
         } else if (!cl) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
 #endif
-        } else if (qdisc_enqueue(skb, cl->un.leaf.q) != NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
-                cl->qstats.drops++;
+        } else if ((ret = qdisc_enqueue(skb, cl->un.leaf.q)) != NET_XMIT_SUCCESS) {
+                if (net_xmit_drop_count(ret)) {
+                        sch->qstats.drops++;
+                        cl->qstats.drops++;
+                }
                 return NET_XMIT_DROP;
         } else {
                 cl->bstats.packets +=
@@ -610,15 +612,17 @@ static int htb_requeue(struct sk_buff *skb, struct Qdisc *sch)
                 }
 #ifdef CONFIG_NET_CLS_ACT
         } else if (!cl) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
 #endif
-        } else if (cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q) !=
+        } else if ((ret = cl->un.leaf.q->ops->requeue(skb, cl->un.leaf.q)) !=
                    NET_XMIT_SUCCESS) {
-                sch->qstats.drops++;
-                cl->qstats.drops++;
+                if (net_xmit_drop_count(ret)) {
+                        sch->qstats.drops++;
+                        cl->qstats.drops++;
+                }
                 return NET_XMIT_DROP;
         } else
                 htb_activate(q, cl);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a5908570067..fb0294d0b55 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -176,7 +176,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
         if (count == 0) {
                 sch->qstats.drops++;
                 kfree_skb(skb);
-                return NET_XMIT_BYPASS;
+                return NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         }
 
         skb_orphan(skb);
@@ -240,8 +240,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 sch->q.qlen++;
                 sch->bstats.bytes += qdisc_pkt_len(skb);
                 sch->bstats.packets++;
-        } else
+        } else if (net_xmit_drop_count(ret)) {
                 sch->qstats.drops++;
+        }
 
         pr_debug("netem: enqueue ret %d\n", ret);
         return ret;
diff --git a/net/sched/sch_prio.c b/net/sched/sch_prio.c
index f849243eb09..eac197610ed 100644
--- a/net/sched/sch_prio.c
+++ b/net/sched/sch_prio.c
@@ -38,14 +38,14 @@ prio_classify(struct sk_buff *skb, struct Qdisc *sch, int *qerr)
         struct tcf_result res;
         int err;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         if (TC_H_MAJ(skb->priority) != sch->handle) {
                 err = tc_classify(skb, q->filter_list, &res);
 #ifdef CONFIG_NET_CLS_ACT
                 switch (err) {
                 case TC_ACT_STOLEN:
                 case TC_ACT_QUEUED:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return NULL;
                 }
@@ -74,7 +74,7 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 #ifdef CONFIG_NET_CLS_ACT
         if (qdisc == NULL) {
 
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
@@ -88,7 +88,8 @@ prio_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                 sch->q.qlen++;
                 return NET_XMIT_SUCCESS;
         }
-        sch->qstats.drops++;
+        if (net_xmit_drop_count(ret))
+                sch->qstats.drops++;
         return ret;
 }
 
@@ -102,7 +103,7 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
         qdisc = prio_classify(skb, sch, &ret);
 #ifdef CONFIG_NET_CLS_ACT
         if (qdisc == NULL) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
@@ -114,7 +115,8 @@ prio_requeue(struct sk_buff *skb, struct Qdisc* sch)
                 sch->qstats.requeues++;
                 return 0;
         }
-        sch->qstats.drops++;
+        if (net_xmit_drop_count(ret))
+                sch->qstats.drops++;
         return NET_XMIT_DROP;
 }
 
diff --git a/net/sched/sch_red.c b/net/sched/sch_red.c
index 3f2d1d7f3bb..5da05839e22 100644
--- a/net/sched/sch_red.c
+++ b/net/sched/sch_red.c
@@ -97,7 +97,7 @@ static int red_enqueue(struct sk_buff *skb, struct Qdisc* sch)
                 sch->bstats.bytes += qdisc_pkt_len(skb);
                 sch->bstats.packets++;
                 sch->q.qlen++;
-        } else {
+        } else if (net_xmit_drop_count(ret)) {
                 q->stats.pdrop++;
                 sch->qstats.drops++;
         }
diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
index 8589da66656..6e041d10dbd 100644
--- a/net/sched/sch_sfq.c
+++ b/net/sched/sch_sfq.c
@@ -171,14 +171,14 @@ static unsigned int sfq_classify(struct sk_buff *skb, struct Qdisc *sch,
         if (!q->filter_list)
                 return sfq_hash(q, skb) + 1;
 
-        *qerr = NET_XMIT_BYPASS;
+        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_BYPASS;
         result = tc_classify(skb, q->filter_list, &res);
         if (result >= 0) {
 #ifdef CONFIG_NET_CLS_ACT
                 switch (result) {
                 case TC_ACT_STOLEN:
                 case TC_ACT_QUEUED:
-                        *qerr = NET_XMIT_SUCCESS;
+                        *qerr = NET_XMIT_SUCCESS | __NET_XMIT_STOLEN;
                 case TC_ACT_SHOT:
                         return 0;
                 }
@@ -285,7 +285,7 @@ sfq_enqueue(struct sk_buff *skb, struct Qdisc *sch)
 
         hash = sfq_classify(skb, sch, &ret);
         if (hash == 0) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
@@ -339,7 +339,7 @@ sfq_requeue(struct sk_buff *skb, struct Qdisc *sch)
 
         hash = sfq_classify(skb, sch, &ret);
         if (hash == 0) {
-                if (ret == NET_XMIT_BYPASS)
+                if (ret & __NET_XMIT_BYPASS)
                         sch->qstats.drops++;
                 kfree_skb(skb);
                 return ret;
diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
index b296672f763..7d3b7ff3bf0 100644
--- a/net/sched/sch_tbf.c
+++ b/net/sched/sch_tbf.c
@@ -135,7 +135,8 @@ static int tbf_enqueue(struct sk_buff *skb, struct Qdisc* sch)
 
         ret = qdisc_enqueue(skb, q->qdisc);
         if (ret != 0) {
-                sch->qstats.drops++;
+                if (net_xmit_drop_count(ret))
+                        sch->qstats.drops++;
                 return ret;
         }
 
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index a238d6834b3..483a01d0740 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -195,8 +195,7 @@ out:
 }
 
 /* Based on tcp_v6_xmit() in tcp_ipv6.c. */
-static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport,
-                        int ipfragok)
+static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport)
 {
         struct sock *sk = skb->sk;
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -231,7 +230,10 @@ static int sctp_v6_xmit(struct sk_buff *skb, struct sctp_transport *transport,
 
         SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
 
-        return ip6_xmit(sk, skb, &fl, np->opt, ipfragok);
+        if (!(transport->param_flags & SPP_PMTUD_ENABLE))
+                skb->local_df = 1;
+
+        return ip6_xmit(sk, skb, &fl, np->opt, 0);
 }
 
 /* Returns the dst cache entry for the given source and destination ip
diff --git a/net/sctp/output.c b/net/sctp/output.c
index 45684646b1d..0dc4a7dfb23 100644
--- a/net/sctp/output.c
+++ b/net/sctp/output.c
@@ -586,10 +586,8 @@ int sctp_packet_transmit(struct sctp_packet *packet)
         SCTP_DEBUG_PRINTK("***sctp_transmit_packet*** skb len %d\n",
                           nskb->len);
 
-        if (tp->param_flags & SPP_PMTUD_ENABLE)
-                (*tp->af_specific->sctp_xmit)(nskb, tp, packet->ipfragok);
-        else
-                (*tp->af_specific->sctp_xmit)(nskb, tp, 1);
+        nskb->local_df = packet->ipfragok;
+        (*tp->af_specific->sctp_xmit)(nskb, tp);
 
 out:
         packet->size = packet->overhead;
diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
index a6e0818bcff..0b65354aaf6 100644
--- a/net/sctp/protocol.c
+++ b/net/sctp/protocol.c
@@ -862,16 +862,21 @@ static int sctp_inet_supported_addrs(const struct sctp_sock *opt,
 
 /* Wrapper routine that calls the ip transmit routine. */
 static inline int sctp_v4_xmit(struct sk_buff *skb,
-                               struct sctp_transport *transport, int ipfragok)
+                               struct sctp_transport *transport)
 {
+        struct inet_sock *inet = inet_sk(skb->sk);
+
         SCTP_DEBUG_PRINTK("%s: skb:%p, len:%d, "
                           "src:%u.%u.%u.%u, dst:%u.%u.%u.%u\n",
                           __func__, skb, skb->len,
                           NIPQUAD(skb->rtable->rt_src),
                           NIPQUAD(skb->rtable->rt_dst));
 
+        inet->pmtudisc = transport->param_flags & SPP_PMTUD_ENABLE ?
+                         IP_PMTUDISC_DO : IP_PMTUDISC_DONT;
+
         SCTP_INC_STATS(SCTP_MIB_OUTSCTPPACKS);
-        return ip_queue_xmit(skb, ipfragok);
+        return ip_queue_xmit(skb, 0);
 }
 
 static struct sctp_af sctp_af_inet;