Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net into net

Pull in 'net' to take in the bug fixes that didn't make it into
3.8-final.

Also, deal with the semantic conflict of the change made to
net/ipv6/xfrm6_policy.c   A missing rt6->n neighbour release
was added to 'net', but in 'net-next' we no longer cache the
neighbour entries in the ipv6 routes so that change is not
appropriate there.

Signed-off-by: David S. Miller <davem@davemloft.net>

7 files changed, 16 insertions, 9 deletions

diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
index ea0bd31d41c2..761a59002e34 100644
--- a/net/batman-adv/distributed-arp-table.c
+++ b/net/batman-adv/distributed-arp-table.c
@@ -440,7 +440,7 @@ static bool batadv_is_orig_node_eligible(struct batadv_dat_candidate *res,
         /* this is an hash collision with the temporary selected node. Choose
          * the one with the lowest address
          */
-        if ((tmp_max == max) &&
+        if ((tmp_max == max) && max_orig_node &&
             (batadv_compare_eth(candidate->orig, max_orig_node->orig) > 0))
                 goto out;
 
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index b89a8c3186cd..54087e96d7b8 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -97,9 +97,9 @@ static int nf_ct_frag6_sysctl_register(struct net *net)
                 if (table == NULL)
                         goto err_alloc;
 
-                table[0].data = &net->ipv6.frags.high_thresh;
-                table[1].data = &net->ipv6.frags.low_thresh;
-                table[2].data = &net->ipv6.frags.timeout;
+                table[0].data = &net->nf_frag.frags.timeout;
+                table[1].data = &net->nf_frag.frags.low_thresh;
+                table[2].data = &net->nf_frag.frags.high_thresh;
         }
 
         hdr = register_net_sysctl(net, "net/netfilter", table);
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index 2f380f73c4c0..1343a4bb4031 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -236,7 +236,9 @@ int __nf_ct_try_assign_helper(struct nf_conn *ct, struct nf_conn *tmpl,
                 /* We only allow helper re-assignment of the same sort since
                  * we cannot reallocate the helper extension area.
                  */
-                if (help->helper != helper) {
+                struct nf_conntrack_helper *tmp = rcu_dereference(help->helper);
+
+                if (tmp && tmp->help != helper->help) {
                         RCU_INIT_POINTER(help->helper, NULL);
                         goto out;
                 }
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index 2334cc5d2b16..79c2d507ac49 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -1782,6 +1782,9 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 if (nlh->nlmsg_flags & NLM_F_CREATE) {
                         enum ip_conntrack_events events;
 
+                        if (!cda[CTA_TUPLE_ORIG] || !cda[CTA_TUPLE_REPLY])
+                                return -EINVAL;
+
                         ct = ctnetlink_create_conntrack(net, zone, cda, &otuple,
                                                         &rtuple, u3);
                         if (IS_ERR(ct))
diff --git a/net/sctp/Kconfig b/net/sctp/Kconfig
index 7521d944c0fb..cf4852814e0c 100644
--- a/net/sctp/Kconfig
+++ b/net/sctp/Kconfig
@@ -3,8 +3,8 @@
 #
 
 menuconfig IP_SCTP
-        tristate "The SCTP Protocol (EXPERIMENTAL)"
-        depends on INET && EXPERIMENTAL
+        tristate "The SCTP Protocol"
+        depends on INET
         depends on IPV6 || IPV6=n
         select CRYPTO
         select CRYPTO_HMAC
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
index f3f0f4dc31dd..391a245d5203 100644
--- a/net/sctp/ipv6.c
+++ b/net/sctp/ipv6.c
@@ -326,9 +326,10 @@ static void sctp_v6_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
          */
         rcu_read_lock();
         list_for_each_entry_rcu(laddr, &bp->address_list, list) {
-                if (!laddr->valid && laddr->state != SCTP_ADDR_SRC)
+                if (!laddr->valid)
                         continue;
-                if ((laddr->a.sa.sa_family == AF_INET6) &&
+                if ((laddr->state == SCTP_ADDR_SRC) &&
+                    (laddr->a.sa.sa_family == AF_INET6) &&
                     (scope <= sctp_scope(&laddr->a))) {
                         bmatchlen = sctp_v6_addr_match_len(daddr, &laddr->a);
                         if (!baddr || (matchlen < bmatchlen)) {
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 54f89f90ac33..2655c9f4ecad 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -774,6 +774,7 @@ void tipc_bclink_init(void)
         bcl->owner = &bclink->node;
         bcl->max_pkt = MAX_PKT_DEFAULT_MCAST;
         tipc_link_set_queue_limits(bcl, BCLINK_WIN_DEFAULT);
+        spin_lock_init(&bcbearer->bearer.lock);
         bcl->b_ptr = &bcbearer->bearer;
         bcl->state = WORKING_WORKING;
         strlcpy(bcl->name, tipc_bclink_name, TIPC_MAX_LINK_NAME);