Merge branch 'master' of master.kernel.org:/pub/scm/linux/kernel/git/davem/net-next-2.6

11 files changed, 126 insertions, 85 deletions

diff --git a/net/802/garp.c b/net/802/garp.c
index 5dbe8967bbd5..f8300a8b5fbc 100644
--- a/net/802/garp.c
+++ b/net/802/garp.c
@@ -603,6 +603,11 @@ err1:
 }
 EXPORT_SYMBOL_GPL(garp_init_applicant);
 
+static void garp_app_kfree_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct garp_applicant, rcu));
+}
+
 void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl)
 {
         struct garp_port *port = rtnl_dereference(dev->garp_port);
@@ -611,7 +616,6 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl
         ASSERT_RTNL();
 
         rcu_assign_pointer(port->applicants[appl->type], NULL);
-        synchronize_rcu();
 
         /* Delete timer and generate a final TRANSMIT_PDU event to flush out
          * all pending messages before the applicant is gone. */
@@ -621,7 +625,7 @@ void garp_uninit_applicant(struct net_device *dev, struct garp_application *appl
         garp_queue_xmit(app);
 
         dev_mc_del(dev, appl->proto.group_address);
-        kfree(app);
+        call_rcu(&app->rcu, garp_app_kfree_rcu);
         garp_release_port(dev);
 }
 EXPORT_SYMBOL_GPL(garp_uninit_applicant);
@@ -639,3 +643,9 @@ void garp_unregister_application(struct garp_application *appl)
         stp_proto_unregister(&appl->proto);
 }
 EXPORT_SYMBOL_GPL(garp_unregister_application);
+
+static void __exit garp_cleanup_module(void)
+{
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
+}
+module_exit(garp_cleanup_module);
diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index 58f8010e1aef..f247f5bff88d 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -528,7 +528,7 @@ static int vlan_dev_init(struct net_device *dev)
                                           (1<<__LINK_STATE_DORMANT))) |
                       (1<<__LINK_STATE_PRESENT);
 
-        dev->hw_features = real_dev->vlan_features & NETIF_F_ALL_TX_OFFLOADS;
+        dev->hw_features = NETIF_F_ALL_TX_OFFLOADS;
         dev->features |= real_dev->vlan_features | NETIF_F_LLTX;
         dev->gso_max_size = real_dev->gso_max_size;
 
@@ -587,9 +587,11 @@ static u32 vlan_dev_fix_features(struct net_device *dev, u32 features)
 {
         struct net_device *real_dev = vlan_dev_info(dev)->real_dev;
 
-        features &= (real_dev->features | NETIF_F_LLTX);
+        features &= real_dev->features;
+        features &= real_dev->vlan_features;
         if (dev_ethtool_get_rx_csum(real_dev))
                 features |= NETIF_F_RXCSUM;
+        features |= NETIF_F_LLTX;
 
         return features;
 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 75898a32c038..ea23353e6251 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5289,6 +5289,14 @@ int __netdev_update_features(struct net_device *dev)
         return 1;
 }
 
+/**
+ *      netdev_update_features - recalculate device features
+ *      @dev: the device to check
+ *
+ *      Recalculate dev->features set and send notifications if it
+ *      has changed. Should be called after driver or hardware dependent
+ *      conditions might have changed that influence the features.
+ */
 void netdev_update_features(struct net_device *dev)
 {
         if (__netdev_update_features(dev))
@@ -5297,6 +5305,23 @@ void netdev_update_features(struct net_device *dev)
 EXPORT_SYMBOL(netdev_update_features);
 
 /**
+ *      netdev_change_features - recalculate device features
+ *      @dev: the device to check
+ *
+ *      Recalculate dev->features set and send notifications even
+ *      if they have not changed. Should be called instead of
+ *      netdev_update_features() if also dev->vlan_features might
+ *      have changed to allow the changes to be propagated to stacked
+ *      VLAN devices.
+ */
+void netdev_change_features(struct net_device *dev)
+{
+        __netdev_update_features(dev);
+        netdev_features_change(dev);
+}
+EXPORT_SYMBOL(netdev_change_features);
+
+/**
  *      netif_stacked_transfer_operstate -      transfer operstate
  *      @rootdev: the root or lower level device to transfer state from
  *      @dev: the device to transfer operstate to
diff --git a/net/core/ethtool.c b/net/core/ethtool.c
index b6f405888538..b8c2b10f397a 100644
--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
@@ -361,7 +361,7 @@ static const char netdev_features_strings[ETHTOOL_DEV_FEATURE_WORDS * 32][ETH_GS
         /* NETIF_F_NTUPLE */          "rx-ntuple-filter",
         /* NETIF_F_RXHASH */          "rx-hashing",
         /* NETIF_F_RXCSUM */          "rx-checksum",
-        /* NETIF_F_NOCACHE_COPY */    "tx-nocache-copy"
+        /* NETIF_F_NOCACHE_COPY */    "tx-nocache-copy",
         /* NETIF_F_LOOPBACK */        "loopback",
 };
 
diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
index 99461f09320f..fcbc0c8f1261 100644
--- a/net/ipv4/ip_forward.c
+++ b/net/ipv4/ip_forward.c
@@ -84,7 +84,7 @@ int ip_forward(struct sk_buff *skb)
 
         rt = skb_rtable(skb);
 
-        if (opt->is_strictroute && rt->rt_dst != rt->rt_gateway)
+        if (opt->is_strictroute && iph->daddr != rt->rt_gateway)
                 goto sr_failed;
 
         if (unlikely(skb->len > dst_mtu(&rt->dst) && !skb_is_gso(skb) &&
diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 01fc40965848..c5c26192b057 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -601,7 +601,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
         unsigned long orefdst;
         int err;
 
-        if (!opt->srr || !rt)
+        if (!rt)
                 return 0;
 
         if (skb->pkt_type != PACKET_HOST)
@@ -635,7 +635,7 @@ int ip_options_rcv_srr(struct sk_buff *skb)
                 if (rt2->rt_type != RTN_LOCAL)
                         break;
                 /* Superfast 8) loopback forward */
-                memcpy(&iph->daddr, &optptr[srrptr-1], 4);
+                iph->daddr = nexthop;
                 opt->is_changed = 1;
         }
         if (srrptr <= srrspace) {
diff --git a/net/irda/ircomm/ircomm_tty.c b/net/irda/ircomm/ircomm_tty.c
index a39cca8331df..b3cc8b3989a9 100644
--- a/net/irda/ircomm/ircomm_tty.c
+++ b/net/irda/ircomm/ircomm_tty.c
@@ -38,6 +38,7 @@
 #include <linux/seq_file.h>
 #include <linux/termios.h>
 #include <linux/tty.h>
+#include <linux/tty_flip.h>
 #include <linux/interrupt.h>
 #include <linux/device.h>               /* for MODULE_ALIAS_CHARDEV_MAJOR */
 
@@ -1132,7 +1133,6 @@ static int ircomm_tty_data_indication(void *instance, void *sap,
                                       struct sk_buff *skb)
 {
         struct ircomm_tty_cb *self = (struct ircomm_tty_cb *) instance;
-        struct tty_ldisc *ld;
 
         IRDA_DEBUG(2, "%s()\n", __func__ );
 
@@ -1161,15 +1161,11 @@ static int ircomm_tty_data_indication(void *instance, void *sap,
         }
 
         /*
-         * Just give it over to the line discipline. There is no need to
-         * involve the flip buffers, since we are not running in an interrupt
-         * handler
+         * Use flip buffer functions since the code may be called from interrupt
+         * context
          */
-
-        ld = tty_ldisc_ref(self->tty);
-        if (ld)
-                ld->ops->receive_buf(self->tty, skb->data, NULL, skb->len);
-        tty_ldisc_deref(ld);
+        tty_insert_flip_string(self->tty, skb->data, skb->len);
+        tty_flip_buffer_push(self->tty);
 
         /* No need to kfree_skb - see ircomm_ttp_data_indication() */
 
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index 9be095e00450..ed8a2335442f 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1435,16 +1435,15 @@ int l2tp_tunnel_create(struct net *net, int fd, int version, u32 tunnel_id, u32
 
         /* Add tunnel to our list */
         INIT_LIST_HEAD(&tunnel->list);
-        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
-        list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
-        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
-        synchronize_rcu();
         atomic_inc(&l2tp_tunnel_count);
 
         /* Bump the reference count. The tunnel context is deleted
-         * only when this drops to zero.
+         * only when this drops to zero. Must be done before list insertion
          */
         l2tp_tunnel_inc_refcount(tunnel);
+        spin_lock_bh(&pn->l2tp_tunnel_list_lock);
+        list_add_rcu(&tunnel->list, &pn->l2tp_tunnel_list);
+        spin_unlock_bh(&pn->l2tp_tunnel_list_lock);
 
         err = 0;
 err:
@@ -1636,7 +1635,6 @@ struct l2tp_session *l2tp_session_create(int priv_size, struct l2tp_tunnel *tunn
                         hlist_add_head_rcu(&session->global_hlist,
                                            l2tp_session_id_hash_2(pn, session_id));
                         spin_unlock_bh(&pn->l2tp_session_hlist_lock);
-                        synchronize_rcu();
                 }
 
                 /* Ignore management session in session count value */
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index a74dae6c5dbc..bfa808f4da13 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1382,15 +1382,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
         ip_vs_in_stats(cp, skb);
         if (IPPROTO_TCP == cih->protocol || IPPROTO_UDP == cih->protocol)
                 offset += 2 * sizeof(__u16);
-        verdict = ip_vs_icmp_xmit(skb, cp, pp, offset);
-        /* LOCALNODE from FORWARD hook is not supported */
-        if (verdict == NF_ACCEPT && hooknum == NF_INET_FORWARD &&
-            skb_rtable(skb)->rt_flags & RTCF_LOCAL) {
-                IP_VS_DBG(1, "%s(): "
-                          "local delivery to %pI4 but in FORWARD\n",
-                          __func__, &skb_rtable(skb)->rt_dst);
-                verdict = NF_DROP;
-        }
+        verdict = ip_vs_icmp_xmit(skb, cp, pp, offset, hooknum);
 
   out:
         __ip_vs_conn_put(cp);
@@ -1412,7 +1404,6 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum)
         struct ip_vs_protocol *pp;
         struct ip_vs_proto_data *pd;
         unsigned int offset, verdict;
-        struct rt6_info *rt;
 
         *related = 1;
 
@@ -1474,23 +1465,12 @@ ip_vs_in_icmp_v6(struct sk_buff *skb, int *related, unsigned int hooknum)
         if (!cp)
                 return NF_ACCEPT;
 
-        verdict = NF_DROP;
-
         /* do the statistics and put it back */
         ip_vs_in_stats(cp, skb);
         if (IPPROTO_TCP == cih->nexthdr || IPPROTO_UDP == cih->nexthdr ||
             IPPROTO_SCTP == cih->nexthdr)
                 offset += 2 * sizeof(__u16);
-        verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, offset);
-        /* LOCALNODE from FORWARD hook is not supported */
-        if (verdict == NF_ACCEPT && hooknum == NF_INET_FORWARD &&
-            (rt = (struct rt6_info *) skb_dst(skb)) &&
-            rt->rt6i_dev && rt->rt6i_dev->flags & IFF_LOOPBACK) {
-                IP_VS_DBG(1, "%s(): "
-                          "local delivery to %pI6 but in FORWARD\n",
-                          __func__, &rt->rt6i_dst);
-                verdict = NF_DROP;
-        }
+        verdict = ip_vs_icmp_xmit_v6(skb, cp, pp, offset, hooknum);
 
         __ip_vs_conn_put(cp);
 
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 6132b213eddc..ee319a4338b0 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -87,7 +87,7 @@ __ip_vs_dst_check(struct ip_vs_dest *dest, u32 rtos)
 /* Get route to destination or remote server */
 static struct rtable *
 __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
-                   __be32 daddr, u32 rtos, int rt_mode)
+                   __be32 daddr, u32 rtos, int rt_mode, __be32 *ret_saddr)
 {
         struct net *net = dev_net(skb_dst(skb)->dev);
         struct rtable *rt;                      /* Route to the other host */
@@ -98,7 +98,12 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
                 spin_lock(&dest->dst_lock);
                 if (!(rt = (struct rtable *)
                       __ip_vs_dst_check(dest, rtos))) {
-                        rt = ip_route_output(net, dest->addr.ip, 0, rtos, 0);
+                        struct flowi4 fl4;
+
+                        memset(&fl4, 0, sizeof(fl4));
+                        fl4.daddr = dest->addr.ip;
+                        fl4.flowi4_tos = rtos;
+                        rt = ip_route_output_key(net, &fl4);
                         if (IS_ERR(rt)) {
                                 spin_unlock(&dest->dst_lock);
                                 IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
@@ -106,18 +111,30 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
                                 return NULL;
                         }
                         __ip_vs_dst_set(dest, rtos, dst_clone(&rt->dst), 0);
-                        IP_VS_DBG(10, "new dst %pI4, refcnt=%d, rtos=%X\n",
-                                  &dest->addr.ip,
+                        dest->dst_saddr.ip = fl4.saddr;
+                        IP_VS_DBG(10, "new dst %pI4, src %pI4, refcnt=%d, "
+                                  "rtos=%X\n",
+                                  &dest->addr.ip, &dest->dst_saddr.ip,
                                   atomic_read(&rt->dst.__refcnt), rtos);
                 }
+                daddr = dest->addr.ip;
+                if (ret_saddr)
+                        *ret_saddr = dest->dst_saddr.ip;
                 spin_unlock(&dest->dst_lock);
         } else {
-                rt = ip_route_output(net, daddr, 0, rtos, 0);
+                struct flowi4 fl4;
+
+                memset(&fl4, 0, sizeof(fl4));
+                fl4.daddr = daddr;
+                fl4.flowi4_tos = rtos;
+                rt = ip_route_output_key(net, &fl4);
                 if (IS_ERR(rt)) {
                         IP_VS_DBG_RL("ip_route_output error, dest: %pI4\n",
                                      &daddr);
                         return NULL;
                 }
+                if (ret_saddr)
+                        *ret_saddr = fl4.saddr;
         }
 
         local = rt->rt_flags & RTCF_LOCAL;
@@ -125,7 +142,7 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
               rt_mode)) {
                 IP_VS_DBG_RL("Stopping traffic to %s address, dest: %pI4\n",
                              (rt->rt_flags & RTCF_LOCAL) ?
-                             "local":"non-local", &rt->rt_dst);
+                             "local":"non-local", &daddr);
                 ip_rt_put(rt);
                 return NULL;
         }
@@ -133,14 +150,14 @@ __ip_vs_get_out_rt(struct sk_buff *skb, struct ip_vs_dest *dest,
             !((ort = skb_rtable(skb)) && ort->rt_flags & RTCF_LOCAL)) {
                 IP_VS_DBG_RL("Redirect from non-local address %pI4 to local "
                              "requires NAT method, dest: %pI4\n",
-                             &ip_hdr(skb)->daddr, &rt->rt_dst);
+                             &ip_hdr(skb)->daddr, &daddr);
                 ip_rt_put(rt);
                 return NULL;
         }
         if (unlikely(!local && ipv4_is_loopback(ip_hdr(skb)->saddr))) {
                 IP_VS_DBG_RL("Stopping traffic from loopback address %pI4 "
                              "to non-local address, dest: %pI4\n",
-                             &ip_hdr(skb)->saddr, &rt->rt_dst);
+                             &ip_hdr(skb)->saddr, &daddr);
                 ip_rt_put(rt);
                 return NULL;
         }
@@ -229,8 +246,6 @@ out_err:
 
 /*
  * Get route to destination or remote server
- * rt_mode: flags, &1=Allow local dest, &2=Allow non-local dest,
- *          &4=Allow redirect from remote daddr to local
  */
 static struct rt6_info *
 __ip_vs_get_out_rt_v6(struct sk_buff *skb, struct ip_vs_dest *dest,
@@ -250,7 +265,7 @@ __ip_vs_get_out_rt_v6(struct sk_buff *skb, struct ip_vs_dest *dest,
                         u32 cookie;
 
                         dst = __ip_vs_route_output_v6(net, &dest->addr.in6,
-                                                      &dest->dst_saddr,
+                                                      &dest->dst_saddr.in6,
                                                       do_xfrm);
                         if (!dst) {
                                 spin_unlock(&dest->dst_lock);
@@ -260,11 +275,11 @@ __ip_vs_get_out_rt_v6(struct sk_buff *skb, struct ip_vs_dest *dest,
                         cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
                         __ip_vs_dst_set(dest, 0, dst_clone(&rt->dst), cookie);
                         IP_VS_DBG(10, "new dst %pI6, src %pI6, refcnt=%d\n",
-                                  &dest->addr.in6, &dest->dst_saddr,
+                                  &dest->addr.in6, &dest->dst_saddr.in6,
                                   atomic_read(&rt->dst.__refcnt));
                 }
                 if (ret_saddr)
-                        ipv6_addr_copy(ret_saddr, &dest->dst_saddr);
+                        ipv6_addr_copy(ret_saddr, &dest->dst_saddr.in6);
                 spin_unlock(&dest->dst_lock);
         } else {
                 dst = __ip_vs_route_output_v6(net, daddr, ret_saddr, do_xfrm);
@@ -274,13 +289,14 @@ __ip_vs_get_out_rt_v6(struct sk_buff *skb, struct ip_vs_dest *dest,
         }
 
         local = __ip_vs_is_local_route6(rt);
-        if (!((local ? 1 : 2) & rt_mode)) {
+        if (!((local ? IP_VS_RT_MODE_LOCAL : IP_VS_RT_MODE_NON_LOCAL) &
+              rt_mode)) {
                 IP_VS_DBG_RL("Stopping traffic to %s address, dest: %pI6\n",
                              local ? "local":"non-local", daddr);
                 dst_release(&rt->dst);
                 return NULL;
         }
-        if (local && !(rt_mode & 4) &&
+        if (local && !(rt_mode & IP_VS_RT_MODE_RDR) &&
             !((ort = (struct rt6_info *) skb_dst(skb)) &&
               __ip_vs_is_local_route6(ort))) {
                 IP_VS_DBG_RL("Redirect from non-local address %pI6 to local "
@@ -386,7 +402,7 @@ ip_vs_bypass_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         EnterFunction(10);
 
         if (!(rt = __ip_vs_get_out_rt(skb, NULL, iph->daddr, RT_TOS(iph->tos),
-                                      IP_VS_RT_MODE_NON_LOCAL)))
+                                      IP_VS_RT_MODE_NON_LOCAL, NULL)))
                 goto tx_error_icmp;
 
         /* MTU checking */
@@ -440,7 +456,8 @@ ip_vs_bypass_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         EnterFunction(10);
 
-        if (!(rt = __ip_vs_get_out_rt_v6(skb, NULL, &iph->daddr, NULL, 0, 2)))
+        if (!(rt = __ip_vs_get_out_rt_v6(skb, NULL, &iph->daddr, NULL, 0,
+                                         IP_VS_RT_MODE_NON_LOCAL)))
                 goto tx_error_icmp;
 
         /* MTU checking */
@@ -517,7 +534,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                                       RT_TOS(iph->tos),
                                       IP_VS_RT_MODE_LOCAL |
                                         IP_VS_RT_MODE_NON_LOCAL |
-                                        IP_VS_RT_MODE_RDR)))
+                                        IP_VS_RT_MODE_RDR, NULL)))
                 goto tx_error_icmp;
         local = rt->rt_flags & RTCF_LOCAL;
         /*
@@ -539,7 +556,7 @@ ip_vs_nat_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 #endif
 
         /* From world but DNAT to loopback address? */
-        if (local && ipv4_is_loopback(rt->rt_dst) &&
+        if (local && ipv4_is_loopback(cp->daddr.ip) &&
             rt_is_input_route(skb_rtable(skb))) {
                 IP_VS_DBG_RL_PKT(1, AF_INET, pp, skb, 0, "ip_vs_nat_xmit(): "
                                  "stopping DNAT to loopback address");
@@ -632,7 +649,9 @@ ip_vs_nat_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         }
 
         if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
-                                         0, 1|2|4)))
+                                         0, (IP_VS_RT_MODE_LOCAL |
+                                             IP_VS_RT_MODE_NON_LOCAL |
+                                             IP_VS_RT_MODE_RDR))))
                 goto tx_error_icmp;
         local = __ip_vs_is_local_route6(rt);
         /*
@@ -748,6 +767,7 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
                   struct ip_vs_protocol *pp)
 {
         struct rtable *rt;                      /* Route to the other host */
+        __be32 saddr;                           /* Source for tunnel */
         struct net_device *tdev;                /* Device to other host */
         struct iphdr  *old_iph = ip_hdr(skb);
         u8     tos = old_iph->tos;
@@ -761,7 +781,8 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 
         if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
                                       RT_TOS(tos), IP_VS_RT_MODE_LOCAL |
-                                                   IP_VS_RT_MODE_NON_LOCAL)))
+                                                   IP_VS_RT_MODE_NON_LOCAL,
+                                                   &saddr)))
                 goto tx_error_icmp;
         if (rt->rt_flags & RTCF_LOCAL) {
                 ip_rt_put(rt);
@@ -829,8 +850,8 @@ ip_vs_tunnel_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         iph->frag_off           =       df;
         iph->protocol           =       IPPROTO_IPIP;
         iph->tos                =       tos;
-        iph->daddr              =       rt->rt_dst;
-        iph->saddr              =       rt->rt_src;
+        iph->daddr              =       cp->daddr.ip;
+        iph->saddr              =       saddr;
         iph->ttl                =       old_iph->ttl;
         ip_select_ident(iph, &rt->dst, NULL);
 
@@ -875,7 +896,8 @@ ip_vs_tunnel_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         EnterFunction(10);
 
         if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6,
-                                         &saddr, 1, 1|2)))
+                                         &saddr, 1, (IP_VS_RT_MODE_LOCAL |
+                                                     IP_VS_RT_MODE_NON_LOCAL))))
                 goto tx_error_icmp;
         if (__ip_vs_is_local_route6(rt)) {
                 dst_release(&rt->dst);
@@ -992,7 +1014,7 @@ ip_vs_dr_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
         if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
                                       RT_TOS(iph->tos),
                                       IP_VS_RT_MODE_LOCAL |
-                                        IP_VS_RT_MODE_NON_LOCAL)))
+                                        IP_VS_RT_MODE_NON_LOCAL, NULL)))
                 goto tx_error_icmp;
         if (rt->rt_flags & RTCF_LOCAL) {
                 ip_rt_put(rt);
@@ -1050,7 +1072,8 @@ ip_vs_dr_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
         EnterFunction(10);
 
         if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
-                                         0, 1|2)))
+                                         0, (IP_VS_RT_MODE_LOCAL |
+                                             IP_VS_RT_MODE_NON_LOCAL))))
                 goto tx_error_icmp;
         if (__ip_vs_is_local_route6(rt)) {
                 dst_release(&rt->dst);
@@ -1109,12 +1132,13 @@ tx_error:
  */
 int
 ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
-                struct ip_vs_protocol *pp, int offset)
+                struct ip_vs_protocol *pp, int offset, unsigned int hooknum)
 {
         struct rtable   *rt;    /* Route to the other host */
         int mtu;
         int rc;
         int local;
+        int rt_mode;
 
         EnterFunction(10);
 
@@ -1135,11 +1159,13 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
          * mangle and send the packet here (only for VS/NAT)
          */
 
+        /* LOCALNODE from FORWARD hook is not supported */
+        rt_mode = (hooknum != NF_INET_FORWARD) ?
+                  IP_VS_RT_MODE_LOCAL | IP_VS_RT_MODE_NON_LOCAL |
+                  IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL;
         if (!(rt = __ip_vs_get_out_rt(skb, cp->dest, cp->daddr.ip,
                                       RT_TOS(ip_hdr(skb)->tos),
-                                      IP_VS_RT_MODE_LOCAL |
-                                        IP_VS_RT_MODE_NON_LOCAL |
-                                        IP_VS_RT_MODE_RDR)))
+                                      rt_mode, NULL)))
                 goto tx_error_icmp;
         local = rt->rt_flags & RTCF_LOCAL;
 
@@ -1162,7 +1188,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 #endif
 
         /* From world but DNAT to loopback address? */
-        if (local && ipv4_is_loopback(rt->rt_dst) &&
+        if (local && ipv4_is_loopback(cp->daddr.ip) &&
             rt_is_input_route(skb_rtable(skb))) {
                 IP_VS_DBG(1, "%s(): "
                           "stopping DNAT to loopback %pI4\n",
@@ -1227,12 +1253,13 @@ ip_vs_icmp_xmit(struct sk_buff *skb, struct ip_vs_conn *cp,
 #ifdef CONFIG_IP_VS_IPV6
 int
 ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
-                struct ip_vs_protocol *pp, int offset)
+                struct ip_vs_protocol *pp, int offset, unsigned int hooknum)
 {
         struct rt6_info *rt;    /* Route to the other host */
         int mtu;
         int rc;
         int local;
+        int rt_mode;
 
         EnterFunction(10);
 
@@ -1253,8 +1280,12 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, struct ip_vs_conn *cp,
          * mangle and send the packet here (only for VS/NAT)
          */
 
+        /* LOCALNODE from FORWARD hook is not supported */
+        rt_mode = (hooknum != NF_INET_FORWARD) ?
+                  IP_VS_RT_MODE_LOCAL | IP_VS_RT_MODE_NON_LOCAL |
+                  IP_VS_RT_MODE_RDR : IP_VS_RT_MODE_NON_LOCAL;
         if (!(rt = __ip_vs_get_out_rt_v6(skb, cp->dest, &cp->daddr.in6, NULL,
-                                         0, 1|2|4)))
+                                         0, rt_mode)))
                 goto tx_error_icmp;
 
         local = __ip_vs_is_local_route6(rt);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 33d9ee629b4e..6766913a53e6 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1496,7 +1496,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
         struct sctp_chunk *chunk;
         union sctp_addr to;
         struct sockaddr *msg_name = NULL;
-        struct sctp_sndrcvinfo default_sinfo = { 0 };
+        struct sctp_sndrcvinfo default_sinfo;
         struct sctp_sndrcvinfo *sinfo;
         struct sctp_initmsg *sinit;
         sctp_assoc_t associd = 0;
@@ -1760,6 +1760,7 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 /* If the user didn't specify SNDRCVINFO, make up one with
                  * some defaults.
                  */
+                memset(&default_sinfo, 0, sizeof(default_sinfo));
                 default_sinfo.sinfo_stream = asoc->default_stream;
                 default_sinfo.sinfo_flags = asoc->default_flags;
                 default_sinfo.sinfo_ppid = asoc->default_ppid;
@@ -1790,12 +1791,10 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
                 goto out_free;
         }
 
-        if (sinfo) {
-                /* Check for invalid stream. */
-                if (sinfo->sinfo_stream >= asoc->c.sinit_num_ostreams) {
-                        err = -EINVAL;
-                        goto out_free;
-                }
+        /* Check for invalid stream. */
+        if (sinfo->sinfo_stream >= asoc->c.sinit_num_ostreams) {
+                err = -EINVAL;
+                goto out_free;
         }
 
         timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);