Merge commit 'v3.6-rc5' into next

* commit 'v3.6-rc5': (1098 commits)
  Linux 3.6-rc5
  HID: tpkbd: work even if the new Lenovo Keyboard driver is not configured
  Remove user-triggerable BUG from mpol_to_str
  xen/pciback: Fix proper FLR steps.
  uml: fix compile error in deliver_alarm()
  dj: memory scribble in logi_dj
  Fix order of arguments to compat_put_time[spec|val]
  xen: Use correct masking in xen_swiotlb_alloc_coherent.
  xen: fix logical error in tlb flushing
  xen/p2m: Fix one-off error in checking the P2M tree directory.
  powerpc: Don't use __put_user() in patch_instruction
  powerpc: Make sure IPI handlers see data written by IPI senders
  powerpc: Restore correct DSCR in context switch
  powerpc: Fix DSCR inheritance in copy_thread()
  powerpc: Keep thread.dscr and thread.dscr_inherit in sync
  powerpc: Update DSCR on all CPUs when writing sysfs dscr_default
  powerpc/powernv: Always go into nap mode when CPU is offline
  powerpc: Give hypervisor decrementer interrupts their own handler
  powerpc/vphn: Fix arch_update_cpu_topology() return value
  ARM: gemini: fix the gemini build
  ...

Conflicts:
	drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
	drivers/rapidio/devices/tsi721.c

5 files changed, 41 insertions, 10 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 79181819a24f..6bc85f7c31e3 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -494,8 +494,7 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
         struct net_device *dev;
         struct inet6_dev *idev;
 
-        rcu_read_lock();
-        for_each_netdev_rcu(net, dev) {
+        for_each_netdev(net, dev) {
                 idev = __in6_dev_get(dev);
                 if (idev) {
                         int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -504,7 +503,6 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
                                 dev_forward_change(idev);
                 }
         }
-        rcu_read_unlock();
 }
 
 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 6dc7fd353ef5..282f3723ee19 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -167,8 +167,6 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         struct esp_data *esp = x->data;
 
         /* skb is pure payload to encrypt */
-        err = -ENOMEM;
-
         aead = esp->aead;
         alen = crypto_aead_authsize(aead);
 
@@ -203,8 +201,10 @@ static int esp6_output(struct xfrm_state *x, struct sk_buff *skb)
         }
 
         tmp = esp_alloc_tmp(aead, nfrags + sglists, seqhilen);
-        if (!tmp)
+        if (!tmp) {
+                err = -ENOMEM;
                 goto error;
+        }
 
         seqhi = esp_tmp_seqhi(tmp);
         iv = esp_tmp_iv(aead, tmp, seqhilen);
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index da2e92d05c15..745a32042950 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -307,10 +307,10 @@ static int __net_init ipv6_proc_init_net(struct net *net)
                 goto proc_dev_snmp6_fail;
         return 0;
 
+proc_dev_snmp6_fail:
+        proc_net_remove(net, "snmp6");
 proc_snmp6_fail:
         proc_net_remove(net, "sockstat6");
-proc_dev_snmp6_fail:
-        proc_net_remove(net, "dev_snmp6");
         return -ENOMEM;
 }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c66b90f71c9b..a3e60cc04a8a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -94,6 +94,18 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
 }
 #endif
 
+static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
+{
+        struct dst_entry *dst = skb_dst(skb);
+        const struct rt6_info *rt = (const struct rt6_info *)dst;
+
+        dst_hold(dst);
+        sk->sk_rx_dst = dst;
+        inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
+        if (rt->rt6i_node)
+                inet6_sk(sk)->rx_dst_cookie = rt->rt6i_node->fn_sernum;
+}
+
 static void tcp_v6_hash(struct sock *sk)
 {
         if (sk->sk_state != TCP_CLOSE) {
@@ -1270,6 +1282,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
 
         newsk->sk_gso_type = SKB_GSO_TCPV6;
         __ip6_dst_store(newsk, dst, NULL, NULL);
+        inet6_sk_rx_dst_set(newsk, skb);
 
         newtcp6sk = (struct tcp6_sock *)newsk;
         inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;
@@ -1447,7 +1460,17 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 opt_skb = skb_clone(skb, sk_gfp_atomic(sk, GFP_ATOMIC));
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
+                struct dst_entry *dst = sk->sk_rx_dst;
+
                 sock_rps_save_rxhash(sk, skb);
+                if (dst) {
+                        if (inet_sk(sk)->rx_dst_ifindex != skb->skb_iif ||
+                            dst->ops->check(dst, np->rx_dst_cookie) == NULL) {
+                                dst_release(dst);
+                                sk->sk_rx_dst = NULL;
+                        }
+                }
+
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
                 if (opt_skb)
@@ -1705,9 +1728,9 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
                         struct dst_entry *dst = sk->sk_rx_dst;
                         struct inet_sock *icsk = inet_sk(sk);
                         if (dst)
-                                dst = dst_check(dst, 0);
+                                dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
                         if (dst &&
-                            icsk->rx_dst_ifindex == inet6_iif(skb))
+                            icsk->rx_dst_ifindex == skb->skb_iif)
                                 skb_dst_set_noref(skb, dst);
                 }
         }
@@ -1723,6 +1746,7 @@ static const struct inet_connection_sock_af_ops ipv6_specific = {
         .queue_xmit        = inet6_csk_xmit,
         .send_check        = tcp_v6_send_check,
         .rebuild_header    = inet6_sk_rebuild_header,
+        .sk_rx_dst_set     = inet6_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
         .net_header_len    = sizeof(struct ipv6hdr),
@@ -1754,6 +1778,7 @@ static const struct inet_connection_sock_af_ops ipv6_mapped = {
         .queue_xmit        = ip_queue_xmit,
         .send_check        = tcp_v4_send_check,
         .rebuild_header    = inet_sk_rebuild_header,
+        .sk_rx_dst_set     = inet_sk_rx_dst_set,
         .conn_request      = tcp_v6_conn_request,
         .syn_recv_sock     = tcp_v6_syn_recv_sock,
         .net_header_len    = sizeof(struct iphdr),
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index ef39812107b1..f8c4c08ffb60 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -73,6 +73,13 @@ static int xfrm6_get_tos(const struct flowi *fl)
         return 0;
 }
 
+static void xfrm6_init_dst(struct net *net, struct xfrm_dst *xdst)
+{
+        struct rt6_info *rt = (struct rt6_info *)xdst;
+
+        rt6_init_peer(rt, net->ipv6.peers);
+}
+
 static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
                            int nfheader_len)
 {
@@ -286,6 +293,7 @@ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
         .get_saddr =            xfrm6_get_saddr,
         .decode_session =       _decode_session6,
         .get_tos =              xfrm6_get_tos,
+        .init_dst =             xfrm6_init_dst,
         .init_path =            xfrm6_init_path,
         .fill_dst =             xfrm6_fill_dst,
         .blackhole_route =      ip6_blackhole_route,