Merge master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6

* master.kernel.org:/pub/scm/linux/kernel/git/davem/net-2.6:
  [SUNGEM]: Fix MAC address setting when interface is up.
  [IPV4] fib_trie: Document locking.
  [NET]: Correct accept(2) recovery after sock_attach_fd()
  [PPP]: Don't leak an sk_buff on interface destruction.
  [NET_SCHED]: Fix ingress locking
  [NET_SCHED]: cls_basic: fix NULL pointer dereference
  [DCCP]: make dccp_write_xmit_timer() static again
  [TG3]: Update version and reldate.
  [TG3]: Exit irq handler during chip reset.
  [TG3]: Eliminate the unused TG3_FLAG_SPLIT_MODE flag.
  [IPV6]: Fix routing round-robin locking.
  [DECNet] fib: Fix out of bound access of dn_fib_props[]
  [IPv4] fib: Fix out of bound access of fib_props[]
  [NET] AX.25 Kconfig and docs updates and fixes
  [NET]: Fix neighbour destructor handling.
  [NET]: Fix fib_rules compatibility breakage
  [SCTP]: Update SCTP Maintainers entry
  [NET]: remove unused header file: drivers/net/wan/lmc/lmc_media.h

18 files changed, 195 insertions, 116 deletions

diff --git a/net/atm/clip.c b/net/atm/clip.c
index ebb5d0ce8b6f..8c3825816085 100644
--- a/net/atm/clip.c
+++ b/net/atm/clip.c
@@ -261,14 +261,6 @@ static void clip_pop(struct atm_vcc *vcc, struct sk_buff *skb)
         spin_unlock_irqrestore(&PRIV(dev)->xoff_lock, flags);
 }
 
-static void clip_neigh_destroy(struct neighbour *neigh)
-{
-        DPRINTK("clip_neigh_destroy (neigh %p)\n", neigh);
-        if (NEIGH2ENTRY(neigh)->vccs)
-                printk(KERN_CRIT "clip_neigh_destroy: vccs != NULL !!!\n");
-        NEIGH2ENTRY(neigh)->vccs = (void *) NEIGHBOR_DEAD;
-}
-
 static void clip_neigh_solicit(struct neighbour *neigh, struct sk_buff *skb)
 {
         DPRINTK("clip_neigh_solicit (neigh %p, skb %p)\n", neigh, skb);
@@ -342,7 +334,6 @@ static struct neigh_table clip_tbl = {
         /* parameters are copied from ARP ... */
         .parms = {
                 .tbl                    = &clip_tbl,
-                .neigh_destructor       = clip_neigh_destroy,
                 .base_reachable_time    = 30 * HZ,
                 .retrans_time           = 1 * HZ,
                 .gc_staletime           = 60 * HZ,
diff --git a/net/ax25/Kconfig b/net/ax25/Kconfig
index a8993a041724..43dd86fca4d3 100644
--- a/net/ax25/Kconfig
+++ b/net/ax25/Kconfig
@@ -1,30 +1,27 @@
 #
 # Amateur Radio protocols and AX.25 device configuration
 #
-# 19971130      Now in an own category to make correct compilation of the
-#               AX.25 stuff easier...
-#               Joerg Reuter DL1BKE <jreuter@yaina.de>
-# 19980129      Moved to net/ax25/Config.in, sourcing device drivers.
 
 menuconfig HAMRADIO
         depends on NET
         bool "Amateur Radio support"
         help
           If you want to connect your Linux box to an amateur radio, answer Y
-          here. You want to read <http://www.tapr.org/tapr/html/pkthome.html> and
-          the AX25-HOWTO, available from <http://www.tldp.org/docs.html#howto>.
+          here. You want to read <http://www.tapr.org/tapr/html/pkthome.html>
+          and more specifically about AX.25 on Linux
+          <http://www.linux-ax25.org/>.
 
           Note that the answer to this question won't directly affect the
           kernel: saying N will just cause the configurator to skip all
           the questions about amateur radio.
 
 comment "Packet Radio protocols"
-        depends on HAMRADIO && NET
+        depends on HAMRADIO
 
 config AX25
         tristate "Amateur Radio AX.25 Level 2 protocol"
-        depends on HAMRADIO && NET
-        ---help---
+        depends on HAMRADIO
+        help
           This is the protocol used for computer communication over amateur
           radio. It is either used by itself for point-to-point links, or to
           carry other protocols such as tcp/ip. To use it, you need a device
@@ -52,6 +49,7 @@ config AX25
 
 config AX25_DAMA_SLAVE
         bool "AX.25 DAMA Slave support"
+        default y
         depends on AX25
         help
           DAMA is a mechanism to prevent collisions when doing AX.25
@@ -59,23 +57,38 @@ config AX25_DAMA_SLAVE
           from clients (called "slaves") and redistributes it to other slaves.
           If you say Y here, your Linux box will act as a DAMA slave; this is
           transparent in that you don't have to do any special DAMA
-          configuration. (Linux cannot yet act as a DAMA server.) If unsure,
-          say N.
+          configuration. Linux cannot yet act as a DAMA server.  This option
+          only compiles DAMA slave support into the kernel.  It still needs to
+          be enabled at runtime.  For more about DAMA see
+          <http://www.linux-ax25.org>.  If unsure, say Y.
+
+# placeholder until implemented
+config AX25_DAMA_MASTER
+        bool 'AX.25 DAMA Master support'
+        depends on AX25_DAMA_SLAVE && BROKEN
+        help
+          DAMA is a mechanism to prevent collisions when doing AX.25
+          networking. A DAMA server (called "master") accepts incoming traffic
+          from clients (called "slaves") and redistributes it to other slaves.
+          If you say Y here, your Linux box will act as a DAMA master; this is
+          transparent in that you don't have to do any special DAMA
+          configuration. Linux cannot yet act as a DAMA server.  This option
+          only compiles DAMA slave support into the kernel.  It still needs to
+          be explicitly enabled, so if unsure, say Y.
 
-#        bool '    AX.25 DAMA Master support' CONFIG_AX25_DAMA_MASTER
 config NETROM
         tristate "Amateur Radio NET/ROM protocol"
         depends on AX25
-        ---help---
+        help
           NET/ROM is a network layer protocol on top of AX.25 useful for
           routing.
 
           A comprehensive listing of all the software for Linux amateur radio
           users as well as information about how to configure an AX.25 port is
-          contained in the AX25-HOWTO, available from
-          <http://www.tldp.org/docs.html#howto>. You also might want to
-          check out the file <file:Documentation/networking/ax25.txt>. More
-          information about digital amateur radio in general is on the WWW at
+          contained in the Linux Ham Wiki, available from
+          <http://www.linux-ax25.org>. You also might want to check out the
+          file <file:Documentation/networking/ax25.txt>. More information about
+          digital amateur radio in general is on the WWW at
           <http://www.tapr.org/tapr/html/pkthome.html>.
 
           To compile this driver as a module, choose M here: the
@@ -84,27 +97,25 @@ config NETROM
 config ROSE
         tristate "Amateur Radio X.25 PLP (Rose)"
         depends on AX25
-        ---help---
+        help
           The Packet Layer Protocol (PLP) is a way to route packets over X.25
           connections in general and amateur radio AX.25 connections in
           particular, essentially an alternative to NET/ROM.
 
           A comprehensive listing of all the software for Linux amateur radio
           users as well as information about how to configure an AX.25 port is
-          contained in the AX25-HOWTO, available from
-          <http://www.tldp.org/docs.html#howto>.  You also might want to
-          check out the file <file:Documentation/networking/ax25.txt>. More
-          information about digital amateur radio in general is on the WWW at
+          contained in the Linux Ham Wiki, available from
+          <http://www.linux-ax25.org>.  You also might want to check out the
+          file <file:Documentation/networking/ax25.txt>. More information about
+          digital amateur radio in general is on the WWW at
           <http://www.tapr.org/tapr/html/pkthome.html>.
 
           To compile this driver as a module, choose M here: the
           module will be called rose.
 
-
 menu "AX.25 network device drivers"
-        depends on HAMRADIO && NET && AX25!=n
+        depends on HAMRADIO && AX25
 
 source "drivers/net/hamradio/Kconfig"
 
 endmenu
-
diff --git a/net/core/dev.c b/net/core/dev.c
index cf71614dae93..5984b55311a1 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1750,10 +1750,10 @@ static int ing_filter(struct sk_buff *skb)
 
                 skb->tc_verd = SET_TC_AT(skb->tc_verd,AT_INGRESS);
 
-                spin_lock(&dev->ingress_lock);
+                spin_lock(&dev->queue_lock);
                 if ((q = dev->qdisc_ingress) != NULL)
                         result = q->enqueue(skb, q);
-                spin_unlock(&dev->ingress_lock);
+                spin_unlock(&dev->queue_lock);
 
         }
 
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 3aea4e87d3d7..d011819a8058 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -152,6 +152,28 @@ out:
 
 EXPORT_SYMBOL_GPL(fib_rules_lookup);
 
+static int validate_rulemsg(struct fib_rule_hdr *frh, struct nlattr **tb,
+                            struct fib_rules_ops *ops)
+{
+        int err = -EINVAL;
+
+        if (frh->src_len)
+                if (tb[FRA_SRC] == NULL ||
+                    frh->src_len > (ops->addr_size * 8) ||
+                    nla_len(tb[FRA_SRC]) != ops->addr_size)
+                        goto errout;
+
+        if (frh->dst_len)
+                if (tb[FRA_DST] == NULL ||
+                    frh->dst_len > (ops->addr_size * 8) ||
+                    nla_len(tb[FRA_DST]) != ops->addr_size)
+                        goto errout;
+
+        err = 0;
+errout:
+        return err;
+}
+
 int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
 {
         struct fib_rule_hdr *frh = nlmsg_data(nlh);
@@ -173,6 +195,10 @@ int fib_nl_newrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (err < 0)
                 goto errout;
 
+        err = validate_rulemsg(frh, tb, ops);
+        if (err < 0)
+                goto errout;
+
         rule = kzalloc(ops->rule_size, GFP_KERNEL);
         if (rule == NULL) {
                 err = -ENOMEM;
@@ -260,6 +286,10 @@ int fib_nl_delrule(struct sk_buff *skb, struct nlmsghdr* nlh, void *arg)
         if (err < 0)
                 goto errout;
 
+        err = validate_rulemsg(frh, tb, ops);
+        if (err < 0)
+                goto errout;
+
         list_for_each_entry(rule, ops->rules_list, list) {
                 if (frh->action && (frh->action != rule->action))
                         continue;
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 3183142c6044..cfc60019cf92 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -140,6 +140,8 @@ static int neigh_forced_gc(struct neigh_table *tbl)
                                 n->dead = 1;
                                 shrunk  = 1;
                                 write_unlock(&n->lock);
+                                if (n->parms->neigh_cleanup)
+                                        n->parms->neigh_cleanup(n);
                                 neigh_release(n);
                                 continue;
                         }
@@ -211,6 +213,8 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
                                 NEIGH_PRINTK2("neigh %p is stray.\n", n);
                         }
                         write_unlock(&n->lock);
+                        if (n->parms->neigh_cleanup)
+                                n->parms->neigh_cleanup(n);
                         neigh_release(n);
                 }
         }
@@ -582,9 +586,6 @@ void neigh_destroy(struct neighbour *neigh)
                         kfree(hh);
         }
 
-        if (neigh->parms->neigh_destructor)
-                (neigh->parms->neigh_destructor)(neigh);
-
         skb_queue_purge(&neigh->arp_queue);
 
         dev_put(neigh->dev);
@@ -675,6 +676,8 @@ static void neigh_periodic_timer(unsigned long arg)
                         *np = n->next;
                         n->dead = 1;
                         write_unlock(&n->lock);
+                        if (n->parms->neigh_cleanup)
+                                n->parms->neigh_cleanup(n);
                         neigh_release(n);
                         continue;
                 }
@@ -2088,8 +2091,11 @@ void __neigh_for_each_release(struct neigh_table *tbl,
                         } else
                                 np = &n->next;
                         write_unlock(&n->lock);
-                        if (release)
+                        if (release) {
+                                if (n->parms->neigh_cleanup)
+                                        n->parms->neigh_cleanup(n);
                                 neigh_release(n);
+                        }
                 }
         }
 }
diff --git a/net/dccp/dccp.h b/net/dccp/dccp.h
index a0e7cd183a5d..e33a9edb4036 100644
--- a/net/dccp/dccp.h
+++ b/net/dccp/dccp.h
@@ -191,7 +191,6 @@ extern void dccp_send_sync(struct sock *sk, const u64 seq,
                            const enum dccp_pkt_type pkt_type);
 
 extern void dccp_write_xmit(struct sock *sk, int block);
-extern void dccp_write_xmit_timer(unsigned long data);
 extern void dccp_write_space(struct sock *sk);
 
 extern void dccp_init_xmit_timers(struct sock *sk);
diff --git a/net/dccp/timer.c b/net/dccp/timer.c
index b038a0a3ad40..0197a41c256a 100644
--- a/net/dccp/timer.c
+++ b/net/dccp/timer.c
@@ -262,7 +262,7 @@ out:
 }
 
 /* Transmit-delay timer: used by the CCIDs to delay actual send time */
-void dccp_write_xmit_timer(unsigned long data)
+static void dccp_write_xmit_timer(unsigned long data)
 {
         struct sock *sk = (struct sock *)data;
         struct dccp_sock *dp = dccp_sk(sk);
diff --git a/net/decnet/dn_fib.c b/net/decnet/dn_fib.c
index 3cbfddc98430..82d58a977e6f 100644
--- a/net/decnet/dn_fib.c
+++ b/net/decnet/dn_fib.c
@@ -63,7 +63,7 @@ static struct
 {
         int error;
         u8 scope;
-} dn_fib_props[RTA_MAX+1] = {
+} dn_fib_props[RTN_MAX+1] = {
         [RTN_UNSPEC] =      { .error = 0,       .scope = RT_SCOPE_NOWHERE },
         [RTN_UNICAST] =     { .error = 0,       .scope = RT_SCOPE_UNIVERSE },
         [RTN_LOCAL] =       { .error = 0,       .scope = RT_SCOPE_HOST },
@@ -276,6 +276,9 @@ struct dn_fib_info *dn_fib_create_info(const struct rtmsg *r, struct dn_kern_rta
         struct dn_fib_info *ofi;
         int nhs = 1;
 
+        if (r->rtm_type > RTN_MAX)
+                goto err_inval;
+
         if (dn_fib_props[r->rtm_type].scope > r->rtm_scope)
                 goto err_inval;
 
diff --git a/net/decnet/dn_rules.c b/net/decnet/dn_rules.c
index b6c98ac93dc8..5e86dd542302 100644
--- a/net/decnet/dn_rules.c
+++ b/net/decnet/dn_rules.c
@@ -109,8 +109,6 @@ errout:
 
 static struct nla_policy dn_fib_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .type = NLA_U16 },
-        [FRA_DST]       = { .type = NLA_U16 },
 };
 
 static int dn_fib_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
@@ -133,7 +131,7 @@ static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct dn_fib_rule *r = (struct dn_fib_rule *)rule;
 
-        if (frh->src_len > 16 || frh->dst_len > 16 || frh->tos)
+        if (frh->tos)
                 goto  errout;
 
         if (rule->table == RT_TABLE_UNSPEC) {
@@ -150,10 +148,10 @@ static int dn_fib_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 r->src = nla_get_le16(tb[FRA_SRC]);
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 r->dst = nla_get_le16(tb[FRA_DST]);
 
         r->src_len = frh->src_len;
@@ -176,10 +174,10 @@ static int dn_fib_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         if (frh->dst_len && (r->dst_len != frh->dst_len))
                 return 0;
 
-        if (tb[FRA_SRC] && (r->src != nla_get_le16(tb[FRA_SRC])))
+        if (frh->src_len && (r->src != nla_get_le16(tb[FRA_SRC])))
                 return 0;
 
-        if (tb[FRA_DST] && (r->dst != nla_get_le16(tb[FRA_DST])))
+        if (frh->dst_len && (r->dst != nla_get_le16(tb[FRA_DST])))
                 return 0;
 
         return 1;
@@ -249,6 +247,7 @@ int dn_fib_dump_rules(struct sk_buff *skb, struct netlink_callback *cb)
 static struct fib_rules_ops dn_fib_rules_ops = {
         .family         = AF_DECnet,
         .rule_size      = sizeof(struct dn_fib_rule),
+        .addr_size      = sizeof(u16),
         .action         = dn_fib_rule_action,
         .match          = dn_fib_rule_match,
         .configure      = dn_fib_rule_configure,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 1fba6439fc57..fc920f63452b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -493,6 +493,11 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         cfg->fc_nlinfo.pid = NETLINK_CB(skb).pid;
         cfg->fc_nlinfo.nlh = nlh;
 
+        if (cfg->fc_type > RTN_MAX) {
+                err = -EINVAL;
+                goto errout;
+        }
+
         nlmsg_for_each_attr(attr, nlh, sizeof(struct rtmsg), remaining) {
                 switch (attr->nla_type) {
                 case RTA_DST:
diff --git a/net/ipv4/fib_rules.c b/net/ipv4/fib_rules.c
index b837c33e0404..c660c074c76c 100644
--- a/net/ipv4/fib_rules.c
+++ b/net/ipv4/fib_rules.c
@@ -171,8 +171,6 @@ static struct fib_table *fib_empty_table(void)
 
 static struct nla_policy fib4_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .type = NLA_U32 },
-        [FRA_DST]       = { .type = NLA_U32 },
         [FRA_FLOW]      = { .type = NLA_U32 },
 };
 
@@ -183,8 +181,7 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib4_rule *rule4 = (struct fib4_rule *) rule;
 
-        if (frh->src_len > 32 || frh->dst_len > 32 ||
-            (frh->tos & ~IPTOS_TOS_MASK))
+        if (frh->tos & ~IPTOS_TOS_MASK)
                 goto errout;
 
         if (rule->table == RT_TABLE_UNSPEC) {
@@ -201,10 +198,10 @@ static int fib4_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 rule4->src = nla_get_be32(tb[FRA_SRC]);
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 rule4->dst = nla_get_be32(tb[FRA_DST]);
 
 #ifdef CONFIG_NET_CLS_ROUTE
@@ -242,10 +239,10 @@ static int fib4_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
                 return 0;
 #endif
 
-        if (tb[FRA_SRC] && (rule4->src != nla_get_be32(tb[FRA_SRC])))
+        if (frh->src_len && (rule4->src != nla_get_be32(tb[FRA_SRC])))
                 return 0;
 
-        if (tb[FRA_DST] && (rule4->dst != nla_get_be32(tb[FRA_DST])))
+        if (frh->dst_len && (rule4->dst != nla_get_be32(tb[FRA_DST])))
                 return 0;
 
         return 1;
@@ -309,6 +306,7 @@ static size_t fib4_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib4_rules_ops = {
         .family         = AF_INET,
         .rule_size      = sizeof(struct fib4_rule),
+        .addr_size      = sizeof(u32),
         .action         = fib4_rule_action,
         .match          = fib4_rule_match,
         .configure      = fib4_rule_configure,
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index 2f1fdae6efa6..3dad12ee76c3 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -89,7 +89,7 @@ static const struct
 {
         int     error;
         u8      scope;
-} fib_props[RTA_MAX + 1] = {
+} fib_props[RTN_MAX + 1] = {
         {
                 .error  = 0,
                 .scope  = RT_SCOPE_NOWHERE,
diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
index ada9b3db507d..214c34732e84 100644
--- a/net/ipv4/fib_trie.c
+++ b/net/ipv4/fib_trie.c
@@ -1123,6 +1123,9 @@ err:
         return fa_head;
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_insert(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
@@ -1540,6 +1543,9 @@ static int trie_leaf_remove(struct trie *t, t_key key)
         return 1;
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_delete(struct fib_table *tb, struct fib_config *cfg)
 {
         struct trie *t = (struct trie *) tb->tb_data;
@@ -1718,6 +1724,9 @@ up:
         return NULL; /* Ready. Root of trie */
 }
 
+/*
+ * Caller must hold RTNL.
+ */
 static int fn_trie_flush(struct fib_table *tb)
 {
         struct trie *t = (struct trie *) tb->tb_data;
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 0862809ffcf7..ea3035b4e3e8 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -131,8 +131,6 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 
 static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .len = sizeof(struct in6_addr) },
-        [FRA_DST]       = { .len = sizeof(struct in6_addr) },
 };
 
 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
@@ -142,9 +140,6 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
-        if (frh->src_len > 128 || frh->dst_len > 128)
-                goto errout;
-
         if (rule->action == FR_ACT_TO_TBL) {
                 if (rule->table == RT6_TABLE_UNSPEC)
                         goto errout;
@@ -155,11 +150,11 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 nla_memcpy(&rule6->src.addr, tb[FRA_SRC],
                            sizeof(struct in6_addr));
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
                            sizeof(struct in6_addr));
 
@@ -186,11 +181,11 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         if (frh->tos && (rule6->tclass != frh->tos))
                 return 0;
 
-        if (tb[FRA_SRC] &&
+        if (frh->src_len &&
             nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
                 return 0;
 
-        if (tb[FRA_DST] &&
+        if (frh->dst_len &&
             nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
                 return 0;
 
@@ -240,6 +235,7 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib6_rules_ops = {
         .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
+        .addr_size              = sizeof(struct in6_addr),
         .action                 = fib6_rule_action,
         .match                  = fib6_rule_match,
         .configure              = fib6_rule_configure,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f4d7be77eb0f..268f476ef3db 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -658,6 +658,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                 ins = &iter->u.dst.rt6_next;
         }
 
+        /* Reset round-robin state, if necessary */
+        if (ins == &fn->leaf)
+                fn->rr_ptr = NULL;
+
         /*
          *      insert node
          */
@@ -1109,6 +1113,10 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         rt6_stats.fib_rt_entries--;
         rt6_stats.fib_discarded_routes++;
 
+        /* Reset round-robin state, if necessary */
+        if (fn->rr_ptr == rt)
+                fn->rr_ptr = NULL;
+
         /* Adjust walkers */
         read_lock(&fib6_walker_lock);
         FOR_WALKERS(w) {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a6b3117df546..3931b33b25e8 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -363,55 +363,76 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
         return m;
 }
 
-static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
-                                   int strict)
+static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
+                                   int *mpri, struct rt6_info *match)
 {
-        struct rt6_info *match = NULL, *last = NULL;
-        struct rt6_info *rt, *rt0 = *head;
-        u32 metric;
+        int m;
+
+        if (rt6_check_expired(rt))
+                goto out;
+
+        m = rt6_score_route(rt, oif, strict);
+        if (m < 0)
+                goto out;
+
+        if (m > *mpri) {
+                if (strict & RT6_LOOKUP_F_REACHABLE)
+                        rt6_probe(match);
+                *mpri = m;
+                match = rt;
+        } else if (strict & RT6_LOOKUP_F_REACHABLE) {
+                rt6_probe(rt);
+        }
+
+out:
+        return match;
+}
+
+static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+                                     struct rt6_info *rr_head,
+                                     u32 metric, int oif, int strict)
+{
+        struct rt6_info *rt, *match;
         int mpri = -1;
 
-        RT6_TRACE("%s(head=%p(*head=%p), oif=%d)\n",
-                  __FUNCTION__, head, head ? *head : NULL, oif);
+        match = NULL;
+        for (rt = rr_head; rt && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
+        for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
 
-        for (rt = rt0, metric = rt0->rt6i_metric;
-             rt && rt->rt6i_metric == metric && (!last || rt != rt0);
-             rt = rt->u.dst.rt6_next) {
-                int m;
+        return match;
+}
 
-                if (rt6_check_expired(rt))
-                        continue;
+static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
+{
+        struct rt6_info *match, *rt0;
 
-                last = rt;
+        RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n",
+                  __FUNCTION__, fn->leaf, oif);
 
-                m = rt6_score_route(rt, oif, strict);
-                if (m < 0)
-                        continue;
+        rt0 = fn->rr_ptr;
+        if (!rt0)
+                fn->rr_ptr = rt0 = fn->leaf;
 
-                if (m > mpri) {
-                        if (strict & RT6_LOOKUP_F_REACHABLE)
-                                rt6_probe(match);
-                        match = rt;
-                        mpri = m;
-                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
-                        rt6_probe(rt);
-                }
-        }
+        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
 
         if (!match &&
-            (strict & RT6_LOOKUP_F_REACHABLE) &&
-            last && last != rt0) {
+            (strict & RT6_LOOKUP_F_REACHABLE)) {
+                struct rt6_info *next = rt0->u.dst.rt6_next;
+
                 /* no entries matched; do round-robin */
-                static DEFINE_SPINLOCK(lock);
-                spin_lock(&lock);
-                *head = rt0->u.dst.rt6_next;
-                rt0->u.dst.rt6_next = last->u.dst.rt6_next;
-                last->u.dst.rt6_next = rt0;
-                spin_unlock(&lock);
+                if (!next || next->rt6i_metric != rt0->rt6i_metric)
+                        next = fn->leaf;
+
+                if (next != rt0)
+                        fn->rr_ptr = next;
         }
 
-        RT6_TRACE("%s() => %p, score=%d\n",
-                  __FUNCTION__, match, mpri);
+        RT6_TRACE("%s() => %p\n",
+                  __FUNCTION__, match);
 
         return (match ? match : &ip6_null_entry);
 }
@@ -657,7 +678,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->iif, strict | reachable);
+        rt = rt6_select(fn, fl->iif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -752,7 +773,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->oif, strict | reachable);
+        rt = rt6_select(fn, fl->oif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
diff --git a/net/sched/cls_basic.c b/net/sched/cls_basic.c
index fad08e521c24..70fe36eb66a2 100644
--- a/net/sched/cls_basic.c
+++ b/net/sched/cls_basic.c
@@ -81,6 +81,13 @@ static void basic_put(struct tcf_proto *tp, unsigned long f)
 
 static int basic_init(struct tcf_proto *tp)
 {
+        struct basic_head *head;
+
+        head = kzalloc(sizeof(*head), GFP_KERNEL);
+        if (head == NULL)
+                return -ENOBUFS;
+        INIT_LIST_HEAD(&head->flist);
+        tp->root = head;
         return 0;
 }
 
@@ -176,15 +183,6 @@ static int basic_change(struct tcf_proto *tp, unsigned long base, u32 handle,
         }
 
         err = -ENOBUFS;
-        if (head == NULL) {
-                head = kzalloc(sizeof(*head), GFP_KERNEL);
-                if (head == NULL)
-                        goto errout;
-
-                INIT_LIST_HEAD(&head->flist);
-                tp->root = head;
-        }
-
         f = kzalloc(sizeof(*f), GFP_KERNEL);
         if (f == NULL)
                 goto errout;
diff --git a/net/socket.c b/net/socket.c
index 9566e57ac7f5..ea8f81abc45c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1381,7 +1381,7 @@ asmlinkage long sys_accept(int fd, struct sockaddr __user *upeer_sockaddr,
 
         err = sock_attach_fd(newsock, newfile);
         if (err < 0)
-                goto out_fd;
+                goto out_fd_simple;
 
         err = security_socket_accept(sock, newsock);
         if (err)
@@ -1414,6 +1414,11 @@ out_put:
         fput_light(sock->file, fput_needed);
 out:
         return err;
+out_fd_simple:
+        sock_release(newsock);
+        put_filp(newfile);
+        put_unused_fd(newfd);
+        goto out_put;
 out_fd:
         fput(newfile);
         put_unused_fd(newfd);