1 files changed, 15 insertions, 8 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 84f26e8e6c6..8c6563361ab 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -122,6 +122,7 @@ static int ip_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
+        skb_dst_force(newskb);
         netif_rx_ni(newskb);
         return 0;
 }
@@ -182,6 +183,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         struct rtable *rt = (struct rtable *)dst;
         struct net_device *dev = dst->dev;
         unsigned int hh_len = LL_RESERVED_SPACE(dev);
+        struct neighbour *neigh;
 
         if (rt->rt_type == RTN_MULTICAST) {
                 IP_UPD_PO_STATS(dev_net(dev), IPSTATS_MIB_OUTMCAST, skb->len);
@@ -203,10 +205,15 @@ static inline int ip_finish_output2(struct sk_buff *skb)
                 skb = skb2;
         }
 
-        if (dst->hh)
-                return neigh_hh_output(dst->hh, skb);
-        else if (dst->neighbour)
-                return dst->neighbour->output(skb);
+        rcu_read_lock();
+        neigh = dst_get_neighbour(dst);
+        if (neigh) {
+                int res = neigh_output(neigh, skb);
+
+                rcu_read_unlock();
+                return res;
+        }
+        rcu_read_unlock();
 
         if (net_ratelimit())
                 printk(KERN_DEBUG "ip_finish_output2: No header cache and no neighbour!\n");
@@ -489,7 +496,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 
                 if (first_len - hlen > mtu ||
                     ((first_len - hlen) & 7) ||
-                    (iph->frag_off & htons(IP_MF|IP_OFFSET)) ||
+                    ip_is_fragment(iph) ||
                     skb_cloned(skb))
                         goto slow_path;
 
@@ -734,7 +741,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                         int getfrag(void *from, char *to, int offset, int len,
                                int odd, struct sk_buff *skb),
                         void *from, int length, int hh_len, int fragheaderlen,
-                        int transhdrlen, int mtu, unsigned int flags)
+                        int transhdrlen, int maxfraglen, unsigned int flags)
 {
         struct sk_buff *skb;
         int err;
@@ -767,7 +774,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                 skb->csum = 0;
 
                 /* specify the length of each IP datagram fragment */
-                skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
+                skb_shinfo(skb)->gso_size = maxfraglen - fragheaderlen;
                 skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
                 __skb_queue_tail(queue, skb);
         }
@@ -831,7 +838,7 @@ static int __ip_append_data(struct sock *sk,
             (rt->dst.dev->features & NETIF_F_UFO) && !rt->dst.header_len) {
                 err = ip_ufo_append_data(sk, queue, getfrag, from, length,
                                          hh_len, fragheaderlen, transhdrlen,
-                                         mtu, flags);
+                                         maxfraglen, flags);
                 if (err)
                         goto error;
                 return 0;