Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (56 commits)
  l2tp: Fix possible oops if transmitting or receiving when tunnel goes down
  tcp: Fix for race due to temporary drop of the socket lock in skb_splice_bits.
  tcp: Increment OUTRSTS in tcp_send_active_reset()
  raw: Raw socket leak.
  lt2p: Fix possible WARN_ON from socket code when UDP socket is closed
  USB ID for Philips CPWUA054/00 Wireless USB Adapter 11g
  ssb: Fix context assertion in ssb_pcicore_dev_irqvecs_enable
  libertas: fix command size for CMD_802_11_SUBSCRIBE_EVENT
  ipw2200: expire and use oldest BSS on adhoc create
  airo warning fix
  b43legacy: Fix controller restart crash
  sctp: Fix ECN markings for IPv6
  sctp: Flush the queue only once during fast retransmit.
  sctp: Start T3-RTX timer when fast retransmitting lowest TSN
  sctp: Correctly implement Fast Recovery cwnd manipulations.
  sctp: Move sctp_v4_dst_saddr out of loop
  sctp: retran_path update bug fix
  tcp: fix skb vs fack_count out-of-sync condition
  sunhme: Cleanup use of deprecated calls to save_and_cli and restore_flags.
  xfrm: xfrm_algo: correct usage of RIPEMD-160
  ...

1 files changed, 6 insertions, 2 deletions

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1fd784f3e2ec..dd309626ae9a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -534,7 +534,9 @@ static void udp_v6_flush_pending_frames(struct sock *sk)
 {
         struct udp_sock *up = udp_sk(sk);
 
-        if (up->pending) {
+        if (up->pending == AF_INET)
+                udp_flush_pending_frames(sk);
+        else if (up->pending) {
                 up->len = 0;
                 up->pending = 0;
                 ip6_flush_pending_frames(sk);
@@ -731,7 +733,7 @@ do_udp_sendmsg:
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(*opt);
 
-                err = datagram_send_ctl(msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -848,12 +850,14 @@ do_append_data:
                 } else {
                         dst_release(dst);
                 }
+                dst = NULL;
         }
 
         if (err > 0)
                 err = np->recverr ? net_xmit_errno(err) : 0;
         release_sock(sk);
 out:
+        dst_release(dst);
         fl6_sock_release(flowlabel);
         if (!err)
                 return len;