2 files changed, 31 insertions, 11 deletions

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 4ec4b2ca6ab1..04a6fe3e95a2 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -234,7 +234,10 @@ static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
                          int destroy)
 {
         struct in_ifaddr *promote = NULL;
-        struct in_ifaddr *ifa1 = *ifap;
+        struct in_ifaddr *ifa, *ifa1 = *ifap;
+        struct in_ifaddr *last_prim = in_dev->ifa_list;
+        struct in_ifaddr *prev_prom = NULL;
+        int do_promote = IN_DEV_PROMOTE_SECONDARIES(in_dev);
 
         ASSERT_RTNL();
 
@@ -243,18 +246,22 @@ static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
          **/
 
         if (!(ifa1->ifa_flags & IFA_F_SECONDARY)) {
-                struct in_ifaddr *ifa;
                 struct in_ifaddr **ifap1 = &ifa1->ifa_next;
 
                 while ((ifa = *ifap1) != NULL) {
+                        if (!(ifa->ifa_flags & IFA_F_SECONDARY) && 
+                            ifa1->ifa_scope <= ifa->ifa_scope)
+                                last_prim = ifa;
+
                         if (!(ifa->ifa_flags & IFA_F_SECONDARY) ||
                             ifa1->ifa_mask != ifa->ifa_mask ||
                             !inet_ifa_match(ifa1->ifa_address, ifa)) {
                                 ifap1 = &ifa->ifa_next;
+                                prev_prom = ifa;
                                 continue;
                         }
 
-                        if (!IN_DEV_PROMOTE_SECONDARIES(in_dev)) {
+                        if (!do_promote) {
                                 *ifap1 = ifa->ifa_next;
 
                                 rtmsg_ifa(RTM_DELADDR, ifa);
@@ -283,18 +290,31 @@ static void inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
          */
         rtmsg_ifa(RTM_DELADDR, ifa1);
         notifier_call_chain(&inetaddr_chain, NETDEV_DOWN, ifa1);
-        if (destroy) {
-                inet_free_ifa(ifa1);
 
-                if (!in_dev->ifa_list)
-                        inetdev_destroy(in_dev);
-        }
+        if (promote) {
+
+                if (prev_prom) {
+                        prev_prom->ifa_next = promote->ifa_next;
+                        promote->ifa_next = last_prim->ifa_next;
+                        last_prim->ifa_next = promote;
+                }
 
-        if (promote && IN_DEV_PROMOTE_SECONDARIES(in_dev)) {
-                /* not sure if we should send a delete notify first? */
                 promote->ifa_flags &= ~IFA_F_SECONDARY;
                 rtmsg_ifa(RTM_NEWADDR, promote);
                 notifier_call_chain(&inetaddr_chain, NETDEV_UP, promote);
+                for (ifa = promote->ifa_next; ifa; ifa = ifa->ifa_next) {
+                        if (ifa1->ifa_mask != ifa->ifa_mask ||
+                            !inet_ifa_match(ifa1->ifa_address, ifa))
+                                        continue;
+                        fib_add_ifaddr(ifa);
+                }
+
+        }
+        if (destroy) {
+                inet_free_ifa(ifa1);
+
+                if (!in_dev->ifa_list)
+                        inetdev_destroy(in_dev);
         }
 }
 
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 2267c1fad879..882f88f6d13b 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -407,7 +407,7 @@ static void fib_magic(int cmd, int type, u32 dst, int dst_len, struct in_ifaddr
                 tb->tb_delete(tb, &req.rtm, &rta, &req.nlh, NULL);
 }
 
-static void fib_add_ifaddr(struct in_ifaddr *ifa)
+void fib_add_ifaddr(struct in_ifaddr *ifa)
 {
         struct in_device *in_dev = ifa->ifa_dev;
         struct net_device *dev = in_dev->dev;