Automatic merge of /spare/repo/linux-2.6/.git branch HEAD

5 files changed, 19 insertions, 11 deletions

diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index a93f6dc51979..0e5f7499debb 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -535,10 +535,12 @@ release:
                 if (err)
                         goto done;
 
-                /* Do not check for fault */
-                if (!freq.flr_label)
-                        copy_to_user(&((struct in6_flowlabel_req __user *) optval)->flr_label,
-                                     &fl->label, sizeof(fl->label));
+                if (!freq.flr_label) {
+                        if (copy_to_user(&((struct in6_flowlabel_req __user *) optval)->flr_label,
+                                         &fl->label, sizeof(fl->label))) {
+                                /* Intentionally ignore fault. */
+                        }
+                }
 
                 sfl1->fl = fl;
                 sfl1->next = np->ipv6_fl_list;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0f0711417c9d..b78a53586804 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -552,13 +552,17 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                             skb_headroom(frag) < hlen)
                             goto slow_path;
 
-                        /* Correct socket ownership. */
-                        if (frag->sk == NULL)
-                                goto slow_path;
-
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
                                 goto slow_path;
+
+                        BUG_ON(frag->sk);
+                        if (skb->sk) {
+                                sock_hold(skb->sk);
+                                frag->sk = skb->sk;
+                                frag->destructor = sock_wfree;
+                                skb->truesize -= frag->truesize;
+                        }
                 }
 
                 err = 0;
@@ -1116,12 +1120,10 @@ int ip6_push_pending_frames(struct sock *sk)
                 tail_skb = &(tmp_skb->next);
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
-#if 0 /* Logically correct, but useless work, ip_fragment() will have to undo */
                 skb->truesize += tmp_skb->truesize;
                 __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
-#endif
         }
 
         ipv6_addr_copy(final_dst, &fl->fl6_dst);
diff --git a/net/ipv6/ipv6_syms.c b/net/ipv6/ipv6_syms.c
index 2f4c91ddc9a3..5ade5a5d1990 100644
--- a/net/ipv6/ipv6_syms.c
+++ b/net/ipv6/ipv6_syms.c
@@ -37,5 +37,4 @@ EXPORT_SYMBOL(in6_dev_finish_destroy);
 EXPORT_SYMBOL(xfrm6_rcv);
 #endif
 EXPORT_SYMBOL(rt6_lookup);
-EXPORT_SYMBOL(fl6_sock_lookup);
 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 601a148f60f3..6b9867717d11 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -84,6 +84,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
                 mtu = IPV6_MIN_MTU;
 
         if (skb->len > mtu) {
+                skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
                 ret = -EMSGSIZE;
         }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 4429b1a1fe5f..cf1d91e74c82 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -113,6 +113,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
                 xdst = (struct xfrm_dst *)dst1;
                 xdst->route = &rt->u.dst;
+                if (rt->rt6i_node)
+                        xdst->route_cookie = rt->rt6i_node->fn_sernum;
 
                 dst1->next = dst_prev;
                 dst_prev = dst1;
@@ -137,6 +139,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
         dst_prev->child = &rt->u.dst;
         dst->path = &rt->u.dst;
+        if (rt->rt6i_node)
+                ((struct xfrm_dst *)dst)->path_cookie = rt->rt6i_node->fn_sernum;
 
         *dst_p = dst;
         dst = dst_prev;