4 files changed, 19 insertions, 15 deletions

diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index ed8a2335442..34b2ddeacb6 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -55,7 +55,7 @@
 #include <net/protocol.h>
 
 #include <asm/byteorder.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 
 #include "l2tp_core.h"
 
@@ -1045,8 +1045,10 @@ int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int hdr_len
         headroom = NET_SKB_PAD + sizeof(struct iphdr) +
                 uhlen + hdr_len;
         old_headroom = skb_headroom(skb);
-        if (skb_cow_head(skb, headroom))
+        if (skb_cow_head(skb, headroom)) {
+                dev_kfree_skb(skb);
                 goto abort;
+        }
 
         new_headroom = skb_headroom(skb);
         skb_orphan(skb);
diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index a8193f52c13..d2726a74597 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c
@@ -103,7 +103,7 @@ static struct net_device_ops l2tp_eth_netdev_ops = {
 static void l2tp_eth_dev_setup(struct net_device *dev)
 {
         ether_setup(dev);
-
+        dev->priv_flags &= ~IFF_TX_SKB_SHARING;
         dev->netdev_ops         = &l2tp_eth_netdev_ops;
         dev->destructor         = free_netdev;
 }
diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
index b6466e71f5e..55670ec3cd0 100644
--- a/net/l2tp/l2tp_ip.c
+++ b/net/l2tp/l2tp_ip.c
@@ -393,11 +393,6 @@ static int l2tp_ip_backlog_recv(struct sock *sk, struct sk_buff *skb)
 {
         int rc;
 
-        if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
-                goto drop;
-
-        nf_reset(skb);
-
         /* Charge it to the socket, dropping if the queue is full. */
         rc = sock_queue_rcv_skb(sk, skb);
         if (rc < 0)
@@ -480,18 +475,16 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
         if (connected)
                 rt = (struct rtable *) __sk_dst_check(sk, 0);
 
+        rcu_read_lock();
         if (rt == NULL) {
-                struct ip_options_rcu *inet_opt;
+                const struct ip_options_rcu *inet_opt;
 
-                rcu_read_lock();
                 inet_opt = rcu_dereference(inet->inet_opt);
 
                 /* Use correct destination address if we have options. */
                 if (inet_opt && inet_opt->opt.srr)
                         daddr = inet_opt->opt.faddr;
 
-                rcu_read_unlock();
-
                 /* If this fails, retransmit mechanism of transport layer will
                  * keep trying until route appears or the connection times
                  * itself out.
@@ -503,12 +496,20 @@ static int l2tp_ip_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *m
                                            sk->sk_bound_dev_if);
                 if (IS_ERR(rt))
                         goto no_route;
-                sk_setup_caps(sk, &rt->dst);
+                if (connected)
+                        sk_setup_caps(sk, &rt->dst);
+                else
+                        dst_release(&rt->dst); /* safe since we hold rcu_read_lock */
         }
-        skb_dst_set(skb, dst_clone(&rt->dst));
+
+        /* We dont need to clone dst here, it is guaranteed to not disappear.
+         *  __dev_xmit_skb() might force a refcount if needed.
+         */
+        skb_dst_set_noref(skb, &rt->dst);
 
         /* Queue the packet to IP for output */
         rc = ip_queue_xmit(skb, &inet->cork.fl);
+        rcu_read_unlock();
 
 error:
         /* Update stats */
@@ -525,6 +526,7 @@ out:
         return rc;
 
 no_route:
+        rcu_read_unlock();
         IP_INC_STATS(sock_net(sk), IPSTATS_MIB_OUTNOROUTES);
         kfree_skb(skb);
         rc = -EHOSTUNREACH;
diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
index 39a21d0c61c..f42cd091596 100644
--- a/net/l2tp/l2tp_ppp.c
+++ b/net/l2tp/l2tp_ppp.c
@@ -97,7 +97,7 @@
 #include <net/xfrm.h>
 
 #include <asm/byteorder.h>
-#include <asm/atomic.h>
+#include <linux/atomic.h>
 
 #include "l2tp_core.h"