Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6:
  [ICMP]: ICMP_MIB_OUTMSGS increment duplicated
  [IPV6]: RFC 2011 compatibility broken
  [IPV6]: ICMP6_MIB_OUTMSGS increment duplicated
  [NET]: rtnl_link: fix use-after-free
  [AF_KEY]: Fix skb leak on pfkey_send_migrate() error
  [ATM] atm/suni.c: Fix section mismatch.
  [ATM] atm/idt77105.c: Fix section mismatch.
  [IrDA]: af_irda memory leak fixes
  [NEIGH]: Revert 'Fix race between neigh_parms_release and neightbl_fill_parms'
  [NETFILTER]: bridge-netfilter: fix net_device refcnt leaks
  [IPV6] ROUTE: Make sending algorithm more friendly with RFC 4861.
  [IPV4] FIB_HASH : Avoid unecessary loop in fn_hash_dump_zone()
  [NET]: Fix interrupt semaphore corruption in Intel drivers.
  [IPV4] fib_trie: fix duplicated route issue
  [IPV4] fib_hash: fix duplicated route issue
  [IPV6]: Mischecked tw match in __inet6_check_established.
  rfkill: call rfkill_led_trigger_unregister() on error

3 files changed, 15 insertions, 12 deletions

diff --git a/net/ipv4/fib_hash.c b/net/ipv4/fib_hash.c
index 527a6e0af5b6..0dfee27cfbcd 100644
--- a/net/ipv4/fib_hash.c
+++ b/net/ipv4/fib_hash.c
@@ -444,6 +444,9 @@ static int fn_hash_insert(struct fib_table *tb, struct fib_config *cfg)
                         struct fib_info *fi_drop;
                         u8 state;
 
+                        if (fi->fib_treeref > 1)
+                                goto out;
+
                         write_lock_bh(&fib_hash_lock);
                         fi_drop = fa->fa_info;
                         fa->fa_info = fi;
@@ -718,19 +721,18 @@ fn_hash_dump_zone(struct sk_buff *skb, struct netlink_callback *cb,
 {
         int h, s_h;
 
+        if (fz->fz_hash == NULL)
+                return skb->len;
         s_h = cb->args[3];
-        for (h=0; h < fz->fz_divisor; h++) {
-                if (h < s_h) continue;
-                if (h > s_h)
-                        memset(&cb->args[4], 0,
-                               sizeof(cb->args) - 4*sizeof(cb->args[0]));
-                if (fz->fz_hash == NULL ||
-                    hlist_empty(&fz->fz_hash[h]))
+        for (h = s_h; h < fz->fz_divisor; h++) {
+                if (hlist_empty(&fz->fz_hash[h]))
                         continue;
-                if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h])<0) {
+                if (fn_hash_dump_bucket(skb, cb, tb, fz, &fz->fz_hash[h]) < 0) {
                         cb->args[3] = h;
                         return -1;
                 }
+                memset(&cb->args[4], 0,
+                       sizeof(cb->args) - 4*sizeof(cb->args[0]));
         }
         cb->args[3] = h;
         return skb->len;
@@ -746,14 +748,13 @@ static int fn_hash_dump(struct fib_table *tb, struct sk_buff *skb, struct netlin
         read_lock(&fib_hash_lock);
         for (fz = table->fn_zone_list, m=0; fz; fz = fz->fz_next, m++) {
                 if (m < s_m) continue;
-                if (m > s_m)
-                        memset(&cb->args[3], 0,
-                               sizeof(cb->args) - 3*sizeof(cb->args[0]));
                 if (fn_hash_dump_zone(skb, cb, tb, fz) < 0) {
                         cb->args[2] = m;
                         read_unlock(&fib_hash_lock);
                         return -1;
                 }
+                memset(&cb->args[3], 0,
+                       sizeof(cb->args) - 3*sizeof(cb->args[0]));
         }
         read_unlock(&fib_hash_lock);
         cb->args[2] = m;
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index 8d8c2915e064..1010b469d7d3 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1214,6 +1214,9 @@ static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
                         struct fib_info *fi_drop;
                         u8 state;
 
+                        if (fi->fib_treeref > 1)
+                                goto out;
+
                         err = -ENOBUFS;
                         new_fa = kmem_cache_alloc(fn_alias_kmem, GFP_KERNEL);
                         if (new_fa == NULL)
diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c
index 233de0634298..82baea026484 100644
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -540,7 +540,6 @@ void icmp_send(struct sk_buff *skb_in, int type, int code, __be32 info)
         icmp_param.data.icmph.checksum   = 0;
         icmp_param.skb    = skb_in;
         icmp_param.offset = skb_network_offset(skb_in);
-        icmp_out_count(icmp_param.data.icmph.type);
         inet_sk(icmp_socket->sk)->tos = tos;
         ipc.addr = iph->saddr;
         ipc.opt = &icmp_param.replyopts;