Merge tag 'v3.11-rc7' into stable/for-linus-3.12

Linux 3.11-rc7

As we need the git commit 28817e9de4f039a1a8c1fe1df2fa2df524626b9e
Author: Chuck Anderson <chuck.anderson@oracle.com>
Date:   Tue Aug 6 15:12:19 2013 -0700

    xen/smp: initialize IPI vectors before marking CPU online

* tag 'v3.11-rc7': (443 commits)
  Linux 3.11-rc7
  ARC: [lib] strchr breakage in Big-endian configuration
  VFS: collect_mounts() should return an ERR_PTR
  bfs: iget_locked() doesn't return an ERR_PTR
  efs: iget_locked() doesn't return an ERR_PTR()
  proc: kill the extra proc_readfd_common()->dir_emit_dots()
  cope with potentially long ->d_dname() output for shmem/hugetlb
  usb: phy: fix build breakage
  USB: OHCI: add missing PCI PM callbacks to ohci-pci.c
  staging: comedi: bug-fix NULL pointer dereference on failed attach
  lib/lz4: correct the LZ4 license
  memcg: get rid of swapaccount leftovers
  nilfs2: fix issue with counting number of bio requests for BIO_EOPNOTSUPP error detection
  nilfs2: remove double bio_put() in nilfs_end_bio_write() for BIO_EOPNOTSUPP error
  drivers/platform/olpc/olpc-ec.c: initialise earlier
  ipv4: expose IPV4_DEVCONF
  ipv6: handle Redirect ICMP Message with no Redirected Header option
  be2net: fix disabling TX in be_close()
  Revert "ACPI / video: Always call acpi_video_init_brightness() on init"
  Revert "genetlink: fix family dump race"
  ...

Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>

6 files changed, 46 insertions, 12 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index da4241c8c7da..498ea99194af 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1126,12 +1126,10 @@ retry:
         if (ifp->flags & IFA_F_OPTIMISTIC)
                 addr_flags |= IFA_F_OPTIMISTIC;
 
-        ift = !max_addresses ||
-              ipv6_count_addresses(idev) < max_addresses ?
-                ipv6_add_addr(idev, &addr, NULL, tmp_plen,
-                              ipv6_addr_scope(&addr), addr_flags,
-                              tmp_valid_lft, tmp_prefered_lft) : NULL;
-        if (IS_ERR_OR_NULL(ift)) {
+        ift = ipv6_add_addr(idev, &addr, NULL, tmp_plen,
+                            ipv6_addr_scope(&addr), addr_flags,
+                            tmp_valid_lft, tmp_prefered_lft);
+        if (IS_ERR(ift)) {
                 in6_ifa_put(ifp);
                 in6_dev_put(idev);
                 pr_info("%s: retry temporary address regeneration\n", __func__);
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 40ffd72243a4..aeac0dc3635d 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -425,7 +425,7 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
                 net_adj = 0;
 
         return ((mtu - x->props.header_len - crypto_aead_authsize(esp->aead) -
-                 net_adj) & ~(align - 1)) + (net_adj - 2);
+                 net_adj) & ~(align - 1)) + net_adj - 2;
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index bff3d821c7eb..c4ff5bbb45c4 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -993,14 +993,22 @@ static struct fib6_node * fib6_lookup_1(struct fib6_node *root,
 
                         if (ipv6_prefix_equal(&key->addr, args->addr, key->plen)) {
 #ifdef CONFIG_IPV6_SUBTREES
-                                if (fn->subtree)
-                                        fn = fib6_lookup_1(fn->subtree, args + 1);
+                                if (fn->subtree) {
+                                        struct fib6_node *sfn;
+                                        sfn = fib6_lookup_1(fn->subtree,
+                                                            args + 1);
+                                        if (!sfn)
+                                                goto backtrack;
+                                        fn = sfn;
+                                }
 #endif
-                                if (!fn || fn->fn_flags & RTN_RTINFO)
+                                if (fn->fn_flags & RTN_RTINFO)
                                         return fn;
                         }
                 }
-
+#ifdef CONFIG_IPV6_SUBTREES
+backtrack:
+#endif
                 if (fn->fn_flags & RTN_ROOT)
                         break;
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 79aa9652ed86..04d31c2fbef1 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1369,8 +1369,10 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         if (!ndisc_parse_options(msg->opt, ndoptlen, &ndopts))
                 return;
 
-        if (!ndopts.nd_opts_rh)
+        if (!ndopts.nd_opts_rh) {
+                ip6_redirect_no_header(skb, dev_net(skb->dev), 0, 0);
                 return;
+        }
 
         hdr = (u8 *)ndopts.nd_opts_rh;
         hdr += 8;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 790d9f4b8b0b..1aeb473b2cc6 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -490,6 +490,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         ipv6_hdr(head)->payload_len = htons(payload_len);
         ipv6_change_dsfield(ipv6_hdr(head), 0xff, ecn);
         IP6CB(head)->nhoff = nhoff;
+        IP6CB(head)->flags |= IP6SKB_FRAGMENTED;
 
         /* Yes, and fold redundant checksum back. 8) */
         if (head->ip_summed == CHECKSUM_COMPLETE)
@@ -524,6 +525,9 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
         struct net *net = dev_net(skb_dst(skb)->dev);
         int evicted;
 
+        if (IP6CB(skb)->flags & IP6SKB_FRAGMENTED)
+                goto fail_hdr;
+
         IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMREQDS);
 
         /* Jumbo payload inhibits frag. header */
@@ -544,6 +548,7 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
                                  ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_REASMOKS);
 
                 IP6CB(skb)->nhoff = (u8 *)fhdr - skb_network_header(skb);
+                IP6CB(skb)->flags |= IP6SKB_FRAGMENTED;
                 return 1;
         }
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b70f8979003b..8d9a93ed9c59 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1178,6 +1178,27 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
 }
 EXPORT_SYMBOL_GPL(ip6_redirect);
 
+void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
+                            u32 mark)
+{
+        const struct ipv6hdr *iph = ipv6_hdr(skb);
+        const struct rd_msg *msg = (struct rd_msg *)icmp6_hdr(skb);
+        struct dst_entry *dst;
+        struct flowi6 fl6;
+
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_oif = oif;
+        fl6.flowi6_mark = mark;
+        fl6.flowi6_flags = 0;
+        fl6.daddr = msg->dest;
+        fl6.saddr = iph->daddr;
+
+        dst = ip6_route_output(net, NULL, &fl6);
+        if (!dst->error)
+                rt6_do_redirect(dst, NULL, skb);
+        dst_release(dst);
+}
+
 void ip6_sk_redirect(struct sk_buff *skb, struct sock *sk)
 {
         ip6_redirect(skb, sock_net(sk), sk->sk_bound_dev_if, sk->sk_mark);