11 files changed, 90 insertions, 41 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 7bd3c29c5a7..c0130312911 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2627,9 +2627,9 @@ static int process_backlog(struct napi_struct *napi, int quota)
                 local_irq_disable();
                 skb = __skb_dequeue(&queue->input_pkt_queue);
                 if (!skb) {
-                        __napi_complete(napi);
                         local_irq_enable();
-                        break;
+                        napi_complete(napi);
+                        goto out;
                 }
                 local_irq_enable();
 
@@ -2638,6 +2638,7 @@ static int process_backlog(struct napi_struct *napi, int quota)
 
         napi_gro_flush(napi);
 
+out:
         return work;
 }
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3e2ddfaee81..fbf533cc9dc 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -1202,6 +1202,9 @@ module_init(inet6_init);
 
 static void __exit inet6_exit(void)
 {
+        if (disable_ipv6)
+                return;
+
         /* First of all disallow new sockets creation. */
         sock_unregister(PF_INET6);
         /* Disallow any further netlink messages */
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index ed4d79a9e4a..058a5e4a60c 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -528,14 +528,14 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
                 if (!ipv6_ext_hdr(nexthdr)) {
                         return -1;
                 }
-                if (len < (int)sizeof(struct ipv6_opt_hdr)) {
-                        pr_debug("too short\n");
-                        return -1;
-                }
                 if (nexthdr == NEXTHDR_NONE) {
                         pr_debug("next header is none\n");
                         return -1;
                 }
+                if (len < (int)sizeof(struct ipv6_opt_hdr)) {
+                        pr_debug("too short\n");
+                        return -1;
+                }
                 if (skb_copy_bits(skb, start, &hdr, sizeof(hdr)))
                         BUG();
                 if (nexthdr == NEXTHDR_AUTH)
diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c
index c3f0e950125..457238a2f3f 100644
--- a/net/mac80211/tx.c
+++ b/net/mac80211/tx.c
@@ -784,6 +784,8 @@ ieee80211_tx_h_fragment(struct ieee80211_tx_data *tx)
                 skb_copy_queue_mapping(frag, first);
 
                 frag->do_not_encrypt = first->do_not_encrypt;
+                frag->dev = first->dev;
+                frag->iif = first->iif;
 
                 pos += copylen;
                 left -= copylen;
diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
index 90ce9ddb945..f4935e344b6 100644
--- a/net/netfilter/nf_conntrack_core.c
+++ b/net/netfilter/nf_conntrack_core.c
@@ -726,7 +726,7 @@ nf_conntrack_in(struct net *net, u_int8_t pf, unsigned int hooknum,
         NF_CT_ASSERT(skb->nfct);
 
         ret = l4proto->packet(ct, skb, dataoff, ctinfo, pf, hooknum);
-        if (ret < 0) {
+        if (ret <= 0) {
                 /* Invalid: inverse of the return code tells
                  * the netfilter core what to do */
                 pr_debug("nf_conntrack_in: Can't track with proto module\n");
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index cb78aa00399..ed6d873ad38 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1780,6 +1780,7 @@ ctnetlink_create_expect(struct nlattr *cda[], u_int8_t u3, u32 pid, int report)
                 goto out;
         }
 
+        exp->class = 0;
         exp->expectfn = NULL;
         exp->flags = 0;
         exp->master = ct;
diff --git a/net/netfilter/nf_conntrack_proto_tcp.c b/net/netfilter/nf_conntrack_proto_tcp.c
index a1edb9c1ade..f3fd154d1dd 100644
--- a/net/netfilter/nf_conntrack_proto_tcp.c
+++ b/net/netfilter/nf_conntrack_proto_tcp.c
@@ -859,7 +859,7 @@ static int tcp_packet(struct nf_conn *ct,
                          */
                         if (nf_ct_kill(ct))
                                 return -NF_REPEAT;
-                        return -NF_DROP;
+                        return NF_DROP;
                 }
                 /* Fall through */
         case TCP_CONNTRACK_IGNORE:
@@ -892,7 +892,7 @@ static int tcp_packet(struct nf_conn *ct,
                                 nf_log_packet(pf, 0, skb, NULL, NULL, NULL,
                                           "nf_ct_tcp: killing out of sync session ");
                         nf_ct_kill(ct);
-                        return -NF_DROP;
+                        return NF_DROP;
                 }
                 ct->proto.tcp.last_index = index;
                 ct->proto.tcp.last_dir = dir;
diff --git a/net/wireless/Kconfig b/net/wireless/Kconfig
index e28e2b8fa43..092ae6faccc 100644
--- a/net/wireless/Kconfig
+++ b/net/wireless/Kconfig
@@ -102,3 +102,13 @@ config LIB80211_CRYPT_CCMP
 
 config LIB80211_CRYPT_TKIP
         tristate
+
+config LIB80211_DEBUG
+        bool "lib80211 debugging messages"
+        depends on LIB80211
+        default n
+        ---help---
+          You can enable this if you want verbose debugging messages
+          from lib80211.
+
+          If unsure, say N.
diff --git a/net/wireless/lib80211_crypt_ccmp.c b/net/wireless/lib80211_crypt_ccmp.c
index db428194c16..2301dc1edc4 100644
--- a/net/wireless/lib80211_crypt_ccmp.c
+++ b/net/wireless/lib80211_crypt_ccmp.c
@@ -337,6 +337,7 @@ static int lib80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         pos += 8;
 
         if (ccmp_replay_check(pn, key->rx_pn)) {
+#ifdef CONFIG_LIB80211_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "CCMP: replay detected: STA=%pM "
                                  "previous PN %02x%02x%02x%02x%02x%02x "
@@ -346,6 +347,7 @@ static int lib80211_ccmp_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
                                  key->rx_pn[3], key->rx_pn[4], key->rx_pn[5],
                                  pn[0], pn[1], pn[2], pn[3], pn[4], pn[5]);
                 }
+#endif
                 key->dot11RSNAStatsCCMPReplays++;
                 return -4;
         }
diff --git a/net/wireless/lib80211_crypt_tkip.c b/net/wireless/lib80211_crypt_tkip.c
index 7e8e22bfed9..c36287399d7 100644
--- a/net/wireless/lib80211_crypt_tkip.c
+++ b/net/wireless/lib80211_crypt_tkip.c
@@ -465,12 +465,14 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
         pos += 8;
 
         if (tkip_replay_check(iv32, iv16, tkey->rx_iv32, tkey->rx_iv16)) {
+#ifdef CONFIG_LIB80211_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "TKIP: replay detected: STA=%pM"
                                " previous TSC %08x%04x received TSC "
                                "%08x%04x\n", hdr->addr2,
                                tkey->rx_iv32, tkey->rx_iv16, iv32, iv16);
                 }
+#endif
                 tkey->dot11RSNAStatsTKIPReplays++;
                 return -4;
         }
@@ -505,10 +507,12 @@ static int lib80211_tkip_decrypt(struct sk_buff *skb, int hdr_len, void *priv)
                          * it needs to be recalculated for the next packet. */
                         tkey->rx_phase1_done = 0;
                 }
+#ifdef CONFIG_LIB80211_DEBUG
                 if (net_ratelimit()) {
                         printk(KERN_DEBUG "TKIP: ICV error detected: STA="
                                "%pM\n", hdr->addr2);
                 }
+#endif
                 tkey->dot11RSNAStatsTKIPICVErrors++;
                 return -5;
         }
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index e25ff62ab2a..62a5425cc6a 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -748,12 +748,51 @@ static void xfrm_hash_grow_check(struct net *net, int have_hash_collision)
                 schedule_work(&net->xfrm.state_hash_work);
 }
 
+static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
+                               struct flowi *fl, unsigned short family,
+                               xfrm_address_t *daddr, xfrm_address_t *saddr,
+                               struct xfrm_state **best, int *acq_in_progress,
+                               int *error)
+{
+        /* Resolution logic:
+         * 1. There is a valid state with matching selector. Done.
+         * 2. Valid state with inappropriate selector. Skip.
+         *
+         * Entering area of "sysdeps".
+         *
+         * 3. If state is not valid, selector is temporary, it selects
+         *    only session which triggered previous resolution. Key
+         *    manager will do something to install a state with proper
+         *    selector.
+         */
+        if (x->km.state == XFRM_STATE_VALID) {
+                if ((x->sel.family &&
+                     !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
+                    !security_xfrm_state_pol_flow_match(x, pol, fl))
+                        return;
+
+                if (!*best ||
+                    (*best)->km.dying > x->km.dying ||
+                    ((*best)->km.dying == x->km.dying &&
+                     (*best)->curlft.add_time < x->curlft.add_time))
+                        *best = x;
+        } else if (x->km.state == XFRM_STATE_ACQ) {
+                *acq_in_progress = 1;
+        } else if (x->km.state == XFRM_STATE_ERROR ||
+                   x->km.state == XFRM_STATE_EXPIRED) {
+                if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
+                    security_xfrm_state_pol_flow_match(x, pol, fl))
+                        *error = -ESRCH;
+        }
+}
+
 struct xfrm_state *
 xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                 struct flowi *fl, struct xfrm_tmpl *tmpl,
                 struct xfrm_policy *pol, int *err,
                 unsigned short family)
 {
+        static xfrm_address_t saddr_wildcard = { };
         struct net *net = xp_net(pol);
         unsigned int h;
         struct hlist_node *entry;
@@ -773,40 +812,27 @@ xfrm_state_find(xfrm_address_t *daddr, xfrm_address_t *saddr,
                     xfrm_state_addr_check(x, daddr, saddr, family) &&
                     tmpl->mode == x->props.mode &&
                     tmpl->id.proto == x->id.proto &&
-                    (tmpl->id.spi == x->id.spi || !tmpl->id.spi)) {
-                        /* Resolution logic:
-                           1. There is a valid state with matching selector.
-                              Done.
-                           2. Valid state with inappropriate selector. Skip.
-
-                           Entering area of "sysdeps".
-
-                           3. If state is not valid, selector is temporary,
-                              it selects only session which triggered
-                              previous resolution. Key manager will do
-                              something to install a state with proper
-                              selector.
-                         */
-                        if (x->km.state == XFRM_STATE_VALID) {
-                                if ((x->sel.family && !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
-                                    !security_xfrm_state_pol_flow_match(x, pol, fl))
-                                        continue;
-                                if (!best ||
-                                    best->km.dying > x->km.dying ||
-                                    (best->km.dying == x->km.dying &&
-                                     best->curlft.add_time < x->curlft.add_time))
-                                        best = x;
-                        } else if (x->km.state == XFRM_STATE_ACQ) {
-                                acquire_in_progress = 1;
-                        } else if (x->km.state == XFRM_STATE_ERROR ||
-                                   x->km.state == XFRM_STATE_EXPIRED) {
-                                if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
-                                    security_xfrm_state_pol_flow_match(x, pol, fl))
-                                        error = -ESRCH;
-                        }
-                }
+                    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
+                        xfrm_state_look_at(pol, x, fl, family, daddr, saddr,
+                                           &best, &acquire_in_progress, &error);
+        }
+        if (best)
+                goto found;
+
+        h = xfrm_dst_hash(net, daddr, &saddr_wildcard, tmpl->reqid, family);
+        hlist_for_each_entry(x, entry, net->xfrm.state_bydst+h, bydst) {
+                if (x->props.family == family &&
+                    x->props.reqid == tmpl->reqid &&
+                    !(x->props.flags & XFRM_STATE_WILDRECV) &&
+                    xfrm_state_addr_check(x, daddr, saddr, family) &&
+                    tmpl->mode == x->props.mode &&
+                    tmpl->id.proto == x->id.proto &&
+                    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
+                        xfrm_state_look_at(pol, x, fl, family, daddr, saddr,
+                                           &best, &acquire_in_progress, &error);
         }
 
+found:
         x = best;
         if (!x && !error && !acquire_in_progress) {
                 if (tmpl->id.spi &&