Merge with /pub/scm/linux/kernel/git/torvalds/linux-2.6.git

Signed-off-by: Steve French <sfrench@us.ibm.com>

5 files changed, 12 insertions, 7 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index b7d8822c1be4..19727d941962 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -822,7 +822,7 @@ struct ipv6_saddr_score {
         int             addr_type;
         unsigned int    attrs;
         int             matchlen;
-        unsigned int    scope;
+        int             scope;
         unsigned int    rule;
 };
 
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c7932cb420a5..84963749ab77 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -279,7 +279,7 @@ static int ah6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, struc
                 goto out;
         memcpy(tmp_hdr, skb->nh.raw, hdr_len);
         if (ipv6_clear_mutable_options(skb->nh.ipv6h, hdr_len))
-                goto out;
+                goto free_out;
         skb->nh.ipv6h->priority    = 0;
         skb->nh.ipv6h->flow_lbl[0] = 0;
         skb->nh.ipv6h->flow_lbl[1] = 0;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 4154f3a8b6cf..bb8ffb8a14c5 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -87,7 +87,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
                                      struct inet_timewait_sock **twp)
 {
         struct inet_hashinfo *hinfo = death_row->hashinfo;
-        const struct inet_sock *inet = inet_sk(sk);
+        struct inet_sock *inet = inet_sk(sk);
         const struct ipv6_pinfo *np = inet6_sk(sk);
         const struct in6_addr *daddr = &np->rcv_saddr;
         const struct in6_addr *saddr = &np->daddr;
@@ -129,6 +129,10 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         }
 
 unique:
+        /* Must record num and sport now. Otherwise we will see
+         * in hash table socket with a funny identity. */
+        inet->num = lport;
+        inet->sport = htons(lport);
         BUG_TRAP(sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sk->sk_hash = hash;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index f999edd846a9..5bf70b1442ea 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -944,10 +944,11 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
             (rt->u.dst.dev->features & NETIF_F_UFO)) {
 
-                if(ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
-                                fragheaderlen, transhdrlen, mtu, flags))
+                err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
+                                          fragheaderlen, transhdrlen, mtu,
+                                          flags);
+                if (err)
                         goto error;
-
                 return 0;
         }
 
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 5027bbe6415e..af0635084df8 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -522,7 +522,7 @@ ipq_rcv_skb(struct sk_buff *skb)
         write_unlock_bh(&queue_lock);
         
         status = ipq_receive_peer(NLMSG_DATA(nlh), type,
-                                  skblen - NLMSG_LENGTH(0));
+                                  nlmsglen - NLMSG_LENGTH(0));
         if (status < 0)
                 RCV_SKB_FAIL(status);