Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

Conflicts:
	net/ipv4/fib_frontend.c

3 files changed, 14 insertions, 7 deletions

diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 9f8bb68911e4..1d2cdd43a878 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -159,13 +159,19 @@ struct net_device *__ip_dev_find(struct net *net, __be32 addr, bool devref)
 {
         struct flowi fl = {
                 .fl4_dst = addr,
-                .flags = FLOWI_FLAG_MATCH_ANY_IIF
         };
         struct fib_result res = { 0 };
         struct net_device *dev = NULL;
+        struct fib_table *local_table;
+
+#ifdef CONFIG_IP_MULTIPLE_TABLES
+        res.r = NULL;
+#endif
 
         rcu_read_lock();
-        if (fib_lookup(net, &fl, &res)) {
+        local_table = fib_get_table(net, RT_TABLE_LOCAL);
+        if (!local_table ||
+            fib_table_lookup(local_table, &fl, &res, FIB_LOOKUP_NOREF)) {
                 rcu_read_unlock();
                 return NULL;
         }
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index d8b4f4d0d66e..f1defb7d88e8 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2562,9 +2562,10 @@ static int ip_route_output_slow(struct net *net, struct rtable **rp,
                         goto out;
 
                 /* RACE: Check return value of inet_select_addr instead. */
-                if (rcu_dereference(dev_out->ip_ptr) == NULL)
-                        goto out;       /* Wrong error code */
-
+                if (!(dev_out->flags & IFF_UP) || !__in_dev_get_rcu(dev_out)) {
+                        err = -ENETUNREACH;
+                        goto out;
+                }
                 if (ipv4_is_local_multicast(oldflp->fl4_dst) ||
                     ipv4_is_lbcast(oldflp->fl4_dst)) {
                         if (!fl.fl4_src)
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index f4011027543d..856f68466d49 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -2000,7 +2000,7 @@ static void *listening_get_next(struct seq_file *seq, void *cur)
 get_req:
                         req = icsk->icsk_accept_queue.listen_opt->syn_table[st->sbucket];
                 }
-                sk        = sk_next(st->syn_wait_sk);
+                sk        = sk_nulls_next(st->syn_wait_sk);
                 st->state = TCP_SEQ_STATE_LISTENING;
                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
         } else {
@@ -2009,7 +2009,7 @@ get_req:
                 if (reqsk_queue_len(&icsk->icsk_accept_queue))
                         goto start_req;
                 read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
-                sk = sk_next(sk);
+                sk = sk_nulls_next(sk);
         }
 get_sk:
         sk_nulls_for_each_from(sk, node) {