Merge commit 'v3.2-rc3' into stable/for-linus-3.3

* commit 'v3.2-rc3': (412 commits)
  Linux 3.2-rc3
  virtio-pci: make reset operation safer
  virtio-mmio: Correct the name of the guest features selector
  virtio: add HAS_IOMEM dependency to MMIO platform bus driver
  eCryptfs: Extend array bounds for all filename chars
  eCryptfs: Flush file in vma close
  eCryptfs: Prevent file create race condition
  regulator: TPS65910: Fix VDD1/2 voltage selector count
  i2c: Make i2cdev_notifier_call static
  i2c: Delete ANY_I2C_BUS
  i2c: Fix device name for 10-bit slave address
  i2c-algo-bit: Generate correct i2c address sequence for 10-bit target
  drm: integer overflow in drm_mode_dirtyfb_ioctl()
  Revert "of/irq: of_irq_find_parent: check for parent equal to child"
  drivers/gpu/vga/vgaarb.c: add missing kfree
  drm/radeon/kms/atom: unify i2c gpio table handling
  drm/radeon/kms: fix up gpio i2c mask bits for r4xx for real
  ttm: Don't return the bo reserved on error path
  mount_subtree() pointless use-after-free
  iio: fix a leak due to improper use of anon_inode_getfd()
  ...

3 files changed, 17 insertions, 7 deletions

diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 2195ae651923..4c0f894d0843 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -324,8 +324,6 @@ static void ah6_output_done(struct crypto_async_request *base, int err)
 #endif
         }
 
-        err = ah->nexthdr;
-
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_output_resume(skb, err);
 }
@@ -466,12 +464,12 @@ static void ah6_input_done(struct crypto_async_request *base, int err)
         if (err)
                 goto out;
 
+        err = ah->nexthdr;
+
         skb->network_header += ah_hlen;
         memcpy(skb_network_header(skb), work_iph, hdr_len);
         __skb_pull(skb, ah_hlen + hdr_len);
         skb_set_transport_header(skb, -hdr_len);
-
-        err = ah->nexthdr;
 out:
         kfree(AH_SKB_CB(skb)->tmp);
         xfrm_input_resume(skb, err);
@@ -583,8 +581,6 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
                 if (err == -EINPROGRESS)
                         goto out;
 
-                if (err == -EBUSY)
-                        err = NET_XMIT_DROP;
                 goto out_free;
         }
 
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 027c7ff6f1e5..a46c64eb0a66 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -111,6 +111,14 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
             ipv6_addr_loopback(&hdr->daddr))
                 goto err;
 
+        /*
+         * RFC4291 2.7
+         * Multicast addresses must not be used as source addresses in IPv6
+         * packets or appear in any Routing header.
+         */
+        if (ipv6_addr_is_multicast(&hdr->saddr))
+                goto err;
+
         skb->transport_header = skb->network_header + sizeof(*hdr);
         IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
 
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index bdc15c9003d7..4e2e9ff67ef2 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -289,6 +289,8 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
         if ((err = register_netdevice(dev)) < 0)
                 goto failed_free;
 
+        strcpy(t->parms.name, dev->name);
+
         dev_hold(dev);
         ip6_tnl_link(ip6n, t);
         return t;
@@ -1407,7 +1409,6 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
         struct ip6_tnl *t = netdev_priv(dev);
 
         t->dev = dev;
-        strcpy(t->parms.name, dev->name);
         dev->tstats = alloc_percpu(struct pcpu_tstats);
         if (!dev->tstats)
                 return -ENOMEM;
@@ -1487,6 +1488,7 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 static int __net_init ip6_tnl_init_net(struct net *net)
 {
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
+        struct ip6_tnl *t = NULL;
         int err;
 
         ip6n->tnls[0] = ip6n->tnls_wc;
@@ -1507,6 +1509,10 @@ static int __net_init ip6_tnl_init_net(struct net *net)
         err = register_netdev(ip6n->fb_tnl_dev);
         if (err < 0)
                 goto err_register;
+
+        t = netdev_priv(ip6n->fb_tnl_dev);
+
+        strcpy(t->parms.name, ip6n->fb_tnl_dev->name);
         return 0;
 
 err_register: