Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6: (24 commits)
  [NETFILTER]: xt_connlimit needs to depend on nf_conntrack
  [NETFILTER]: ipt_iprange.h must #include <linux/types.h>
  [IrDA]: Fix IrDA build failure
  [ATM]: nicstar needs virt_to_bus
  [NET]: move __dev_addr_discard adjacent to dev_addr_discard for readability
  [NET]: merge dev_unicast_discard and dev_mc_discard into one
  [NET]: move dev_mc_discard from dev_mcast.c to dev.c
  [NETLINK]: negative groups in netlink_setsockopt
  [PPPOL2TP]: Reset meta-data in xmit function
  [PPPOL2TP]: Fix use-after-free
  [PKT_SCHED]: Some typo fixes in net/sched/Kconfig
  [XFRM]: Fix crash introduced by struct dst_entry reordering
  [TCP]: remove unused argument to cong_avoid op
  [ATM]: [idt77252] Rename CONFIG_ATM_IDT77252_SEND_IDLE to not resemble a Kconfig variable
  [ATM]: [drivers] ioremap balanced with iounmap
  [ATM]: [lanai] sram_test_word() must be __devinit
  [ATM]: [nicstar] Replace C code with call to ARRAY_SIZE() macro.
  [ATM]: Eliminate dead config variable CONFIG_BR2684_FAST_TRANS.
  [ATM]: Replacing kmalloc/memset combination with kzalloc.
  [NET]: gen_estimator deadlock fix
  ...

3 files changed, 87 insertions, 44 deletions

diff --git a/drivers/net/bnx2.c b/drivers/net/bnx2.c
index d23861c8658c..a729da061bbb 100644
--- a/drivers/net/bnx2.c
+++ b/drivers/net/bnx2.c
@@ -54,8 +54,8 @@
 
 #define DRV_MODULE_NAME         "bnx2"
 #define PFX DRV_MODULE_NAME     ": "
-#define DRV_MODULE_VERSION      "1.6.2"
-#define DRV_MODULE_RELDATE      "July 6, 2007"
+#define DRV_MODULE_VERSION      "1.6.3"
+#define DRV_MODULE_RELDATE      "July 16, 2007"
 
 #define RUN_AT(x) (jiffies + (x))
 
@@ -126,91 +126,102 @@ static struct pci_device_id bnx2_pci_tbl[] = {
 
 static struct flash_spec flash_table[] =
 {
+#define BUFFERED_FLAGS          (BNX2_NV_BUFFERED | BNX2_NV_TRANSLATE)
+#define NONBUFFERED_FLAGS       (BNX2_NV_WREN)
         /* Slow EEPROM */
         {0x00000000, 0x40830380, 0x009f0081, 0xa184a053, 0xaf000400,
-         1, SEEPROM_PAGE_BITS, SEEPROM_PAGE_SIZE,
+         BUFFERED_FLAGS, SEEPROM_PAGE_BITS, SEEPROM_PAGE_SIZE,
          SEEPROM_BYTE_ADDR_MASK, SEEPROM_TOTAL_SIZE,
          "EEPROM - slow"},
         /* Expansion entry 0001 */
         {0x08000002, 0x4b808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, 0,
          "Entry 0001"},
         /* Saifun SA25F010 (non-buffered flash) */
         /* strap, cfg1, & write1 need updates */
         {0x04000001, 0x47808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, SAIFUN_FLASH_BASE_TOTAL_SIZE*2,
          "Non-buffered flash (128kB)"},
         /* Saifun SA25F020 (non-buffered flash) */
         /* strap, cfg1, & write1 need updates */
         {0x0c000003, 0x4f808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, SAIFUN_FLASH_BASE_TOTAL_SIZE*4,
          "Non-buffered flash (256kB)"},
         /* Expansion entry 0100 */
         {0x11000000, 0x53808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, 0,
          "Entry 0100"},
         /* Entry 0101: ST M45PE10 (non-buffered flash, TetonII B0) */
         {0x19000002, 0x5b808201, 0x000500db, 0x03840253, 0xaf020406,
-         0, ST_MICRO_FLASH_PAGE_BITS, ST_MICRO_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, ST_MICRO_FLASH_PAGE_BITS, ST_MICRO_FLASH_PAGE_SIZE,
          ST_MICRO_FLASH_BYTE_ADDR_MASK, ST_MICRO_FLASH_BASE_TOTAL_SIZE*2,
          "Entry 0101: ST M45PE10 (128kB non-bufferred)"},
         /* Entry 0110: ST M45PE20 (non-buffered flash)*/
         {0x15000001, 0x57808201, 0x000500db, 0x03840253, 0xaf020406,
-         0, ST_MICRO_FLASH_PAGE_BITS, ST_MICRO_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, ST_MICRO_FLASH_PAGE_BITS, ST_MICRO_FLASH_PAGE_SIZE,
          ST_MICRO_FLASH_BYTE_ADDR_MASK, ST_MICRO_FLASH_BASE_TOTAL_SIZE*4,
          "Entry 0110: ST M45PE20 (256kB non-bufferred)"},
         /* Saifun SA25F005 (non-buffered flash) */
         /* strap, cfg1, & write1 need updates */
         {0x1d000003, 0x5f808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, SAIFUN_FLASH_BASE_TOTAL_SIZE,
          "Non-buffered flash (64kB)"},
         /* Fast EEPROM */
         {0x22000000, 0x62808380, 0x009f0081, 0xa184a053, 0xaf000400,
-         1, SEEPROM_PAGE_BITS, SEEPROM_PAGE_SIZE,
+         BUFFERED_FLAGS, SEEPROM_PAGE_BITS, SEEPROM_PAGE_SIZE,
          SEEPROM_BYTE_ADDR_MASK, SEEPROM_TOTAL_SIZE,
          "EEPROM - fast"},
         /* Expansion entry 1001 */
         {0x2a000002, 0x6b808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, 0,
          "Entry 1001"},
         /* Expansion entry 1010 */
         {0x26000001, 0x67808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, 0,
          "Entry 1010"},
         /* ATMEL AT45DB011B (buffered flash) */
         {0x2e000003, 0x6e808273, 0x00570081, 0x68848353, 0xaf000400,
-         1, BUFFERED_FLASH_PAGE_BITS, BUFFERED_FLASH_PAGE_SIZE,
+         BUFFERED_FLAGS, BUFFERED_FLASH_PAGE_BITS, BUFFERED_FLASH_PAGE_SIZE,
          BUFFERED_FLASH_BYTE_ADDR_MASK, BUFFERED_FLASH_TOTAL_SIZE,
          "Buffered flash (128kB)"},
         /* Expansion entry 1100 */
         {0x33000000, 0x73808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, 0,
          "Entry 1100"},
         /* Expansion entry 1101 */
         {0x3b000002, 0x7b808201, 0x00050081, 0x03840253, 0xaf020406,
-         0, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
+         NONBUFFERED_FLAGS, SAIFUN_FLASH_PAGE_BITS, SAIFUN_FLASH_PAGE_SIZE,
          SAIFUN_FLASH_BYTE_ADDR_MASK, 0,
          "Entry 1101"},
         /* Ateml Expansion entry 1110 */
         {0x37000001, 0x76808273, 0x00570081, 0x68848353, 0xaf000400,
-         1, BUFFERED_FLASH_PAGE_BITS, BUFFERED_FLASH_PAGE_SIZE,
+         BUFFERED_FLAGS, BUFFERED_FLASH_PAGE_BITS, BUFFERED_FLASH_PAGE_SIZE,
          BUFFERED_FLASH_BYTE_ADDR_MASK, 0,
          "Entry 1110 (Atmel)"},
         /* ATMEL AT45DB021B (buffered flash) */
         {0x3f000003, 0x7e808273, 0x00570081, 0x68848353, 0xaf000400,
-         1, BUFFERED_FLASH_PAGE_BITS, BUFFERED_FLASH_PAGE_SIZE,
+         BUFFERED_FLAGS, BUFFERED_FLASH_PAGE_BITS, BUFFERED_FLASH_PAGE_SIZE,
          BUFFERED_FLASH_BYTE_ADDR_MASK, BUFFERED_FLASH_TOTAL_SIZE*2,
          "Buffered flash (256kB)"},
 };
 
+static struct flash_spec flash_5709 = {
+        .flags          = BNX2_NV_BUFFERED,
+        .page_bits      = BCM5709_FLASH_PAGE_BITS,
+        .page_size      = BCM5709_FLASH_PAGE_SIZE,
+        .addr_mask      = BCM5709_FLASH_BYTE_ADDR_MASK,
+        .total_size     = BUFFERED_FLASH_TOTAL_SIZE*2,
+        .name           = "5709 Buffered flash (256kB)",
+};
+
 MODULE_DEVICE_TABLE(pci, bnx2_pci_tbl);
 
 static inline u32 bnx2_tx_avail(struct bnx2 *bp)
@@ -3289,7 +3300,7 @@ bnx2_enable_nvram_write(struct bnx2 *bp)
         val = REG_RD(bp, BNX2_MISC_CFG);
         REG_WR(bp, BNX2_MISC_CFG, val | BNX2_MISC_CFG_NVM_WR_EN_PCI);
 
-        if (!bp->flash_info->buffered) {
+        if (bp->flash_info->flags & BNX2_NV_WREN) {
                 int j;
 
                 REG_WR(bp, BNX2_NVM_COMMAND, BNX2_NVM_COMMAND_DONE);
@@ -3349,7 +3360,7 @@ bnx2_nvram_erase_page(struct bnx2 *bp, u32 offset)
         u32 cmd;
         int j;
 
-        if (bp->flash_info->buffered)
+        if (bp->flash_info->flags & BNX2_NV_BUFFERED)
                 /* Buffered flash, no erase needed */
                 return 0;
 
@@ -3392,8 +3403,8 @@ bnx2_nvram_read_dword(struct bnx2 *bp, u32 offset, u8 *ret_val, u32 cmd_flags)
         /* Build the command word. */
         cmd = BNX2_NVM_COMMAND_DOIT | cmd_flags;
 
-        /* Calculate an offset of a buffered flash. */
-        if (bp->flash_info->buffered) {
+        /* Calculate an offset of a buffered flash, not needed for 5709. */
+        if (bp->flash_info->flags & BNX2_NV_TRANSLATE) {
                 offset = ((offset / bp->flash_info->page_size) <<
                            bp->flash_info->page_bits) +
                           (offset % bp->flash_info->page_size);
@@ -3439,8 +3450,8 @@ bnx2_nvram_write_dword(struct bnx2 *bp, u32 offset, u8 *val, u32 cmd_flags)
         /* Build the command word. */
         cmd = BNX2_NVM_COMMAND_DOIT | BNX2_NVM_COMMAND_WR | cmd_flags;
 
-        /* Calculate an offset of a buffered flash. */
-        if (bp->flash_info->buffered) {
+        /* Calculate an offset of a buffered flash, not needed for 5709. */
+        if (bp->flash_info->flags & BNX2_NV_TRANSLATE) {
                 offset = ((offset / bp->flash_info->page_size) <<
                           bp->flash_info->page_bits) +
                          (offset % bp->flash_info->page_size);
@@ -3478,15 +3489,19 @@ static int
 bnx2_init_nvram(struct bnx2 *bp)
 {
         u32 val;
-        int j, entry_count, rc;
+        int j, entry_count, rc = 0;
         struct flash_spec *flash;
 
+        if (CHIP_NUM(bp) == CHIP_NUM_5709) {
+                bp->flash_info = &flash_5709;
+                goto get_flash_size;
+        }
+
         /* Determine the selected interface. */
         val = REG_RD(bp, BNX2_NVM_CFG1);
 
         entry_count = sizeof(flash_table) / sizeof(struct flash_spec);
 
-        rc = 0;
         if (val & 0x40000000) {
 
                 /* Flash interface has been reconfigured */
@@ -3542,6 +3557,7 @@ bnx2_init_nvram(struct bnx2 *bp)
                 return -ENODEV;
         }
 
+get_flash_size:
         val = REG_RD_IND(bp, bp->shmem_base + BNX2_SHARED_HW_CFG_CONFIG2);
         val &= BNX2_SHARED_HW_CFG2_NVM_SIZE_MASK;
         if (val)
@@ -3706,7 +3722,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                 buf = align_buf;
         }
 
-        if (bp->flash_info->buffered == 0) {
+        if (!(bp->flash_info->flags & BNX2_NV_BUFFERED)) {
                 flash_buffer = kmalloc(264, GFP_KERNEL);
                 if (flash_buffer == NULL) {
                         rc = -ENOMEM;
@@ -3739,7 +3755,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                 bnx2_enable_nvram_access(bp);
 
                 cmd_flags = BNX2_NVM_COMMAND_FIRST;
-                if (bp->flash_info->buffered == 0) {
+                if (!(bp->flash_info->flags & BNX2_NV_BUFFERED)) {
                         int j;
 
                         /* Read the whole page into the buffer
@@ -3767,7 +3783,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                 /* Loop to write back the buffer data from page_start to
                  * data_start */
                 i = 0;
-                if (bp->flash_info->buffered == 0) {
+                if (!(bp->flash_info->flags & BNX2_NV_BUFFERED)) {
                         /* Erase the page */
                         if ((rc = bnx2_nvram_erase_page(bp, page_start)) != 0)
                                 goto nvram_write_end;
@@ -3791,7 +3807,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
                 /* Loop to write the new data from data_start to data_end */
                 for (addr = data_start; addr < data_end; addr += 4, i += 4) {
                         if ((addr == page_end - 4) ||
-                                ((bp->flash_info->buffered) &&
+                                ((bp->flash_info->flags & BNX2_NV_BUFFERED) &&
                                  (addr == data_end - 4))) {
 
                                 cmd_flags |= BNX2_NVM_COMMAND_LAST;
@@ -3808,7 +3824,7 @@ bnx2_nvram_write(struct bnx2 *bp, u32 offset, u8 *data_buf,
 
                 /* Loop to write back the buffer data from data_end
                  * to page_end */
-                if (bp->flash_info->buffered == 0) {
+                if (!(bp->flash_info->flags & BNX2_NV_BUFFERED)) {
                         for (addr = data_end; addr < page_end;
                                 addr += 4, i += 4) {
 
@@ -4107,7 +4123,7 @@ bnx2_init_chip(struct bnx2 *bp)
         if (CHIP_NUM(bp) == CHIP_NUM_5708)
                 REG_WR(bp, BNX2_HC_STATS_TICKS, 0);
         else
-                REG_WR(bp, BNX2_HC_STATS_TICKS, bp->stats_ticks & 0xffff00);
+                REG_WR(bp, BNX2_HC_STATS_TICKS, bp->stats_ticks);
         REG_WR(bp, BNX2_HC_STAT_COLLECT_TICKS, 0xbb8);  /* 3ms */
 
         if (CHIP_ID(bp) == CHIP_ID_5706_A1)
@@ -4127,10 +4143,6 @@ bnx2_init_chip(struct bnx2 *bp)
 
         REG_WR(bp, BNX2_HC_ATTN_BITS_ENABLE, STATUS_ATTN_EVENTS);
 
-        if (REG_RD_IND(bp, bp->shmem_base + BNX2_PORT_FEATURE) &
-            BNX2_PORT_FEATURE_ASF_ENABLED)
-                bp->flags |= ASF_ENABLE_FLAG;
-
         /* Initialize the receive filter. */
         bnx2_set_rx_mode(bp->dev);
 
@@ -5786,8 +5798,9 @@ bnx2_set_coalesce(struct net_device *dev, struct ethtool_coalesce *coal)
                 if (bp->stats_ticks != 0 && bp->stats_ticks != USEC_PER_SEC)
                         bp->stats_ticks = USEC_PER_SEC;
         }
-        if (bp->stats_ticks > 0xffff00) bp->stats_ticks = 0xffff00;
-        bp->stats_ticks &= 0xffff00;
+        if (bp->stats_ticks > BNX2_HC_STATS_TICKS_HC_STAT_TICKS)
+                bp->stats_ticks = BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
+        bp->stats_ticks &= BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
 
         if (netif_running(bp->dev)) {
                 bnx2_netif_stop(bp);
@@ -6629,6 +6642,18 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
                 if (i != 2)
                         bp->fw_version[j++] = '.';
         }
+        if (REG_RD_IND(bp, bp->shmem_base + BNX2_PORT_FEATURE) &
+            BNX2_PORT_FEATURE_ASF_ENABLED) {
+                bp->flags |= ASF_ENABLE_FLAG;
+
+                for (i = 0; i < 30; i++) {
+                        reg = REG_RD_IND(bp, bp->shmem_base +
+                                             BNX2_BC_STATE_CONDITION);
+                        if (reg & BNX2_CONDITION_MFW_RUN_MASK)
+                                break;
+                        msleep(10);
+                }
+        }
         reg = REG_RD_IND(bp, bp->shmem_base + BNX2_BC_STATE_CONDITION);
         reg &= BNX2_CONDITION_MFW_RUN_MASK;
         if (reg != BNX2_CONDITION_MFW_RUN_UNKNOWN &&
@@ -6672,7 +6697,7 @@ bnx2_init_board(struct pci_dev *pdev, struct net_device *dev)
         bp->rx_ticks_int = 18;
         bp->rx_ticks = 18;
 
-        bp->stats_ticks = 1000000 & 0xffff00;
+        bp->stats_ticks = USEC_PER_SEC & BNX2_HC_STATS_TICKS_HC_STAT_TICKS;
 
         bp->timer_interval =  HZ;
         bp->current_interval =  HZ;
diff --git a/drivers/net/bnx2.h b/drivers/net/bnx2.h
index d8cd1afeb23d..102adfe1e923 100644
--- a/drivers/net/bnx2.h
+++ b/drivers/net/bnx2.h
@@ -6433,6 +6433,11 @@ struct sw_bd {
 #define ST_MICRO_FLASH_PAGE_SIZE                256
 #define ST_MICRO_FLASH_BASE_TOTAL_SIZE          65536
 
+#define BCM5709_FLASH_PAGE_BITS                 8
+#define BCM5709_FLASH_PHY_PAGE_SIZE             (1 << BCM5709_FLASH_PAGE_BITS)
+#define BCM5709_FLASH_BYTE_ADDR_MASK            (BCM5709_FLASH_PHY_PAGE_SIZE-1)
+#define BCM5709_FLASH_PAGE_SIZE                 256
+
 #define NVRAM_TIMEOUT_COUNT                     30000
 
 
@@ -6449,7 +6454,10 @@ struct flash_spec {
         u32 config2;
         u32 config3;
         u32 write1;
-        u32 buffered;
+        u32 flags;
+#define BNX2_NV_BUFFERED        0x00000001
+#define BNX2_NV_TRANSLATE       0x00000002
+#define BNX2_NV_WREN            0x00000004
         u32 page_bits;
         u32 page_size;
         u32 addr_mask;
diff --git a/drivers/net/pppol2tp.c b/drivers/net/pppol2tp.c
index 5891a0fbdc8b..f87176055d0e 100644
--- a/drivers/net/pppol2tp.c
+++ b/drivers/net/pppol2tp.c
@@ -824,6 +824,7 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
         struct pppol2tp_session *session;
         struct pppol2tp_tunnel *tunnel;
         struct udphdr *uh;
+        unsigned int len;
 
         error = -ENOTCONN;
         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
@@ -912,14 +913,15 @@ static int pppol2tp_sendmsg(struct kiocb *iocb, struct socket *sock, struct msgh
         }
 
         /* Queue the packet to IP for output */
+        len = skb->len;
         error = ip_queue_xmit(skb, 1);
 
         /* Update stats */
         if (error >= 0) {
                 tunnel->stats.tx_packets++;
-                tunnel->stats.tx_bytes += skb->len;
+                tunnel->stats.tx_bytes += len;
                 session->stats.tx_packets++;
-                session->stats.tx_bytes += skb->len;
+                session->stats.tx_bytes += len;
         } else {
                 tunnel->stats.tx_errors++;
                 session->stats.tx_errors++;
@@ -958,6 +960,7 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         __wsum csum = 0;
         struct sk_buff *skb2 = NULL;
         struct udphdr *uh;
+        unsigned int len;
 
         if (sock_flag(sk, SOCK_DEAD) || !(sk->sk_state & PPPOX_CONNECTED))
                 goto abort;
@@ -1046,18 +1049,25 @@ static int pppol2tp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
                 printk("\n");
         }
 
+        memset(&(IPCB(skb2)->opt), 0, sizeof(IPCB(skb2)->opt));
+        IPCB(skb2)->flags &= ~(IPSKB_XFRM_TUNNEL_SIZE | IPSKB_XFRM_TRANSFORMED |
+                               IPSKB_REROUTED);
+        nf_reset(skb2);
+
         /* Get routing info from the tunnel socket */
+        dst_release(skb2->dst);
         skb2->dst = sk_dst_get(sk_tun);
 
         /* Queue the packet to IP for output */
+        len = skb2->len;
         rc = ip_queue_xmit(skb2, 1);
 
         /* Update stats */
         if (rc >= 0) {
                 tunnel->stats.tx_packets++;
-                tunnel->stats.tx_bytes += skb2->len;
+                tunnel->stats.tx_bytes += len;
                 session->stats.tx_packets++;
-                session->stats.tx_bytes += skb2->len;
+                session->stats.tx_bytes += len;
         } else {
                 tunnel->stats.tx_errors++;
                 session->stats.tx_errors++;