10 files changed, 66 insertions, 101 deletions

diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index bde8ccaa1531..e2077a3aa8c0 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -773,13 +773,15 @@ static int cipso_v4_map_cat_rbm_valid(const struct cipso_v4_doi *doi_def,
 {
         int cat = -1;
         u32 bitmap_len_bits = bitmap_len * 8;
-        u32 cipso_cat_size = doi_def->map.std->cat.cipso_size;
-        u32 *cipso_array = doi_def->map.std->cat.cipso;
+        u32 cipso_cat_size;
+        u32 *cipso_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
                 return 0;
         case CIPSO_V4_MAP_STD:
+                cipso_cat_size = doi_def->map.std->cat.cipso_size;
+                cipso_array = doi_def->map.std->cat.cipso;
                 for (;;) {
                         cat = cipso_v4_bitmap_walk(bitmap,
                                                    bitmap_len_bits,
@@ -825,19 +827,21 @@ static int cipso_v4_map_cat_rbm_hton(const struct cipso_v4_doi *doi_def,
         u32 net_spot_max = 0;
         u32 host_clen_bits = host_cat_len * 8;
         u32 net_clen_bits = net_cat_len * 8;
-        u32 host_cat_size = doi_def->map.std->cat.local_size;
-        u32 *host_cat_array = doi_def->map.std->cat.local;
+        u32 host_cat_size;
+        u32 *host_cat_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
-                net_spot_max = host_cat_len - 1;
-                while (net_spot_max > 0 && host_cat[net_spot_max] == 0)
+                net_spot_max = host_cat_len;
+                while (net_spot_max > 0 && host_cat[net_spot_max - 1] == 0)
                         net_spot_max--;
                 if (net_spot_max > net_cat_len)
                         return -EINVAL;
                 memcpy(net_cat, host_cat, net_spot_max);
                 return net_spot_max;
         case CIPSO_V4_MAP_STD:
+                host_cat_size = doi_def->map.std->cat.local_size;
+                host_cat_array = doi_def->map.std->cat.local;
                 for (;;) {
                         host_spot = cipso_v4_bitmap_walk(host_cat,
                                                          host_clen_bits,
@@ -893,8 +897,8 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
         int net_spot = -1;
         u32 net_clen_bits = net_cat_len * 8;
         u32 host_clen_bits = host_cat_len * 8;
-        u32 net_cat_size = doi_def->map.std->cat.cipso_size;
-        u32 *net_cat_array = doi_def->map.std->cat.cipso;
+        u32 net_cat_size;
+        u32 *net_cat_array;
 
         switch (doi_def->type) {
         case CIPSO_V4_MAP_PASS:
@@ -903,6 +907,8 @@ static int cipso_v4_map_cat_rbm_ntoh(const struct cipso_v4_doi *doi_def,
                 memcpy(host_cat, net_cat, net_cat_len);
                 return net_cat_len;
         case CIPSO_V4_MAP_STD:
+                net_cat_size = doi_def->map.std->cat.cipso_size;
+                net_cat_array = doi_def->map.std->cat.cipso;
                 for (;;) {
                         net_spot = cipso_v4_bitmap_walk(net_cat,
                                                         net_clen_bits,
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index 9c399a70dd5d..af0190d8b6c0 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -482,9 +482,7 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
         memset(cfg, 0, sizeof(*cfg));
 
         rtm = nlmsg_data(nlh);
-        cfg->fc_family = rtm->rtm_family;
         cfg->fc_dst_len = rtm->rtm_dst_len;
-        cfg->fc_src_len = rtm->rtm_src_len;
         cfg->fc_tos = rtm->rtm_tos;
         cfg->fc_table = rtm->rtm_table;
         cfg->fc_protocol = rtm->rtm_protocol;
@@ -501,9 +499,6 @@ static int rtm_to_fib_config(struct sk_buff *skb, struct nlmsghdr *nlh,
                 case RTA_DST:
                         cfg->fc_dst = nla_get_be32(attr);
                         break;
-                case RTA_SRC:
-                        cfg->fc_src = nla_get_be32(attr);
-                        break;
                 case RTA_OIF:
                         cfg->fc_oif = nla_get_u32(attr);
                         break;
diff --git a/net/ipv4/inetpeer.c b/net/ipv4/inetpeer.c
index 2b1a54b59c48..f072f3875af8 100644
--- a/net/ipv4/inetpeer.c
+++ b/net/ipv4/inetpeer.c
@@ -94,10 +94,8 @@ int inet_peer_minttl = 120 * HZ;	/* TTL under high load: 120 sec */
 int inet_peer_maxttl = 10 * 60 * HZ;    /* usual time to live: 10 min */
 
 static struct inet_peer *inet_peer_unused_head;
-/* Exported for inet_putpeer inline function.  */
-struct inet_peer **inet_peer_unused_tailp = &inet_peer_unused_head;
-DEFINE_SPINLOCK(inet_peer_unused_lock);
-#define PEER_MAX_CLEANUP_WORK 30
+static struct inet_peer **inet_peer_unused_tailp = &inet_peer_unused_head;
+static DEFINE_SPINLOCK(inet_peer_unused_lock);
 
 static void peer_check_expire(unsigned long dummy);
 static DEFINE_TIMER(peer_periodic_timer, peer_check_expire, 0, 0);
@@ -340,7 +338,8 @@ static int cleanup_once(unsigned long ttl)
         spin_lock_bh(&inet_peer_unused_lock);
         p = inet_peer_unused_head;
         if (p != NULL) {
-                if (time_after(p->dtime + ttl, jiffies)) {
+                __u32 delta = (__u32)jiffies - p->dtime;
+                if (delta < ttl) {
                         /* Do not prune fresh entries. */
                         spin_unlock_bh(&inet_peer_unused_lock);
                         return -1;
@@ -432,7 +431,7 @@ out_free:
 /* Called with local BH disabled. */
 static void peer_check_expire(unsigned long dummy)
 {
-        int i;
+        unsigned long now = jiffies;
         int ttl;
 
         if (peer_total >= inet_peer_threshold)
@@ -441,7 +440,10 @@ static void peer_check_expire(unsigned long dummy)
                 ttl = inet_peer_maxttl
                                 - (inet_peer_maxttl - inet_peer_minttl) / HZ *
                                         peer_total / inet_peer_threshold * HZ;
-        for (i = 0; i < PEER_MAX_CLEANUP_WORK && !cleanup_once(ttl); i++);
+        while (!cleanup_once(ttl)) {
+                if (jiffies != now)
+                        break;
+        }
 
         /* Trigger the timer after inet_peer_gc_mintime .. inet_peer_gc_maxtime
          * interval depending on the total number of entries (more entries,
@@ -455,3 +457,16 @@ static void peer_check_expire(unsigned long dummy)
                                 peer_total / inet_peer_threshold * HZ;
         add_timer(&peer_periodic_timer);
 }
+
+void inet_putpeer(struct inet_peer *p)
+{
+        spin_lock_bh(&inet_peer_unused_lock);
+        if (atomic_dec_and_test(&p->refcnt)) {
+                p->unused_prevp = inet_peer_unused_tailp;
+                p->unused_next = NULL;
+                *inet_peer_unused_tailp = p;
+                inet_peer_unused_tailp = &p->unused_next;
+                p->dtime = (__u32)jiffies;
+        }
+        spin_unlock_bh(&inet_peer_unused_lock);
+}
diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
index 17e1a687ab45..0849f1cced13 100644
--- a/net/ipv4/netfilter/arp_tables.c
+++ b/net/ipv4/netfilter/arp_tables.c
@@ -1196,6 +1196,8 @@ err1:
 static void __exit arp_tables_fini(void)
 {
         nf_unregister_sockopt(&arpt_sockopts);
+        xt_unregister_target(&arpt_error_target);
+        xt_unregister_target(&arpt_standard_target);
         xt_proto_fini(NF_ARP);
 }
 
diff --git a/net/ipv4/netfilter/ip_conntrack_netlink.c b/net/ipv4/netfilter/ip_conntrack_netlink.c
index 53b6dffea6c2..262d0d44ec1b 100644
--- a/net/ipv4/netfilter/ip_conntrack_netlink.c
+++ b/net/ipv4/netfilter/ip_conntrack_netlink.c
@@ -44,13 +44,6 @@ MODULE_LICENSE("GPL");
 
 static char __initdata version[] = "0.90";
 
-#if 0
-#define DEBUGP printk
-#else
-#define DEBUGP(format, args...)
-#endif
-
-
 static inline int
 ctnetlink_dump_tuples_proto(struct sk_buff *skb, 
                             const struct ip_conntrack_tuple *tuple,
@@ -398,7 +391,6 @@ nfattr_failure:
 
 static int ctnetlink_done(struct netlink_callback *cb)
 {
-        DEBUGP("entered %s\n", __FUNCTION__);
         if (cb->args[1])
                 ip_conntrack_put((struct ip_conntrack *)cb->args[1]);
         return 0;
@@ -411,9 +403,6 @@ ctnetlink_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct ip_conntrack_tuple_hash *h;
         struct list_head *i;
 
-        DEBUGP("entered %s, last bucket=%lu id=%u\n", __FUNCTION__, 
-                        cb->args[0], *id);
-
         read_lock_bh(&ip_conntrack_lock);
         last = (struct ip_conntrack *)cb->args[1];
         for (; cb->args[0] < ip_conntrack_htable_size; cb->args[0]++) {
@@ -452,7 +441,6 @@ out:
         if (last)
                 ip_conntrack_put(last);
 
-        DEBUGP("leaving, last bucket=%lu id=%u\n", cb->args[0], *id);
         return skb->len;
 }
 
@@ -466,8 +454,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
 {
         struct nfattr *tb[CTA_IP_MAX];
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_IP_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_IP_MAX, cta_min_ip))
@@ -481,8 +467,6 @@ ctnetlink_parse_tuple_ip(struct nfattr *attr, struct ip_conntrack_tuple *tuple)
                 return -EINVAL;
         tuple->dst.ip = *(__be32 *)NFA_DATA(tb[CTA_IP_V4_DST-1]);
 
-        DEBUGP("leaving\n");
-
         return 0;
 }
 
@@ -503,8 +487,6 @@ ctnetlink_parse_tuple_proto(struct nfattr *attr,
         struct ip_conntrack_protocol *proto;
         int ret = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTO_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTO_MAX, cta_min_proto))
@@ -531,8 +513,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
         struct nfattr *tb[CTA_TUPLE_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(tuple, 0, sizeof(*tuple));
 
         nfattr_parse_nested(tb, CTA_TUPLE_MAX, cda[type-1]);
@@ -557,10 +537,6 @@ ctnetlink_parse_tuple(struct nfattr *cda[], struct ip_conntrack_tuple *tuple,
         else
                 tuple->dst.dir = IP_CT_DIR_ORIGINAL;
 
-        DUMP_TUPLE(tuple);
-
-        DEBUGP("leaving\n");
-
         return 0;
 }
 
@@ -577,8 +553,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
         struct nfattr *tb[CTA_PROTONAT_MAX];
         struct ip_nat_protocol *npt;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_PROTONAT_MAX, attr);
 
         if (nfattr_bad_size(tb, CTA_PROTONAT_MAX, cta_min_protonat))
@@ -597,7 +571,6 @@ static int ctnetlink_parse_nat_proto(struct nfattr *attr,
 
         ip_nat_proto_put(npt);
 
-        DEBUGP("leaving\n");
         return 0;
 }
 
@@ -613,8 +586,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         struct nfattr *tb[CTA_NAT_MAX];
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         memset(range, 0, sizeof(*range));
         
         nfattr_parse_nested(tb, CTA_NAT_MAX, nat);
@@ -640,7 +611,6 @@ ctnetlink_parse_nat(struct nfattr *nat,
         if (err < 0)
                 return err;
 
-        DEBUGP("leaving\n");
         return 0;
 }
 #endif
@@ -650,8 +620,6 @@ ctnetlink_parse_help(struct nfattr *attr, char **helper_name)
 {
         struct nfattr *tb[CTA_HELP_MAX];
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         nfattr_parse_nested(tb, CTA_HELP_MAX, attr);
 
         if (!tb[CTA_HELP_NAME-1])
@@ -679,8 +647,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack *ct;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -698,10 +664,8 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = ip_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash\n");
+        if (!h)
                 return -ENOENT;
-        }
 
         ct = tuplehash_to_ctrack(h);
         
@@ -716,7 +680,6 @@ ctnetlink_del_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 ct->timeout.function((unsigned long)ct);
 
         ip_conntrack_put(ct);
-        DEBUGP("leaving\n");
 
         return 0;
 }
@@ -731,8 +694,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct sk_buff *skb2 = NULL;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nlh->nlmsg_flags & NLM_F_DUMP) {
                 struct nfgenmsg *msg = NLMSG_DATA(nlh);
                 u32 rlen;
@@ -770,11 +731,9 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
                 return err;
 
         h = ip_conntrack_find_get(&tuple, NULL);
-        if (!h) {
-                DEBUGP("tuple not found in conntrack hash");
+        if (!h)
                 return -ENOENT;
-        }
-        DEBUGP("tuple found\n");
+
         ct = tuplehash_to_ctrack(h);
 
         err = -ENOMEM;
@@ -795,7 +754,6 @@ ctnetlink_get_conntrack(struct sock *ctnl, struct sk_buff *skb,
         if (err < 0)
                 goto out;
 
-        DEBUGP("leaving\n");
         return 0;
 
 free:
@@ -866,8 +824,6 @@ ctnetlink_change_helper(struct ip_conntrack *ct, struct nfattr *cda[])
         char *helpname;
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         /* don't change helper of sibling connections */
         if (ct->master)
                 return -EINVAL;
@@ -938,8 +894,6 @@ ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
 {
         int err;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (cda[CTA_HELP-1]) {
                 err = ctnetlink_change_helper(ct, cda);
                 if (err < 0)
@@ -969,7 +923,6 @@ ctnetlink_change_conntrack(struct ip_conntrack *ct, struct nfattr *cda[])
                 ct->mark = ntohl(*(__be32 *)NFA_DATA(cda[CTA_MARK-1]));
 #endif
 
-        DEBUGP("all done\n");
         return 0;
 }
 
@@ -981,8 +934,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         struct ip_conntrack *ct;
         int err = -EINVAL;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         ct = ip_conntrack_alloc(otuple, rtuple);
         if (ct == NULL || IS_ERR(ct))
                 return -ENOMEM; 
@@ -1017,7 +968,6 @@ ctnetlink_create_conntrack(struct nfattr *cda[],
         if (ct->helper)
                 ip_conntrack_helper_put(ct->helper);
 
-        DEBUGP("conntrack with id %u inserted\n", ct->id);
         return 0;
 
 err:    
@@ -1033,8 +983,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack_tuple_hash *h = NULL;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_MAX, cta_min))
                 return -EINVAL;
 
@@ -1058,7 +1006,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         if (h == NULL) {
                 write_unlock_bh(&ip_conntrack_lock);
-                DEBUGP("no such conntrack, create new\n");
                 err = -ENOENT;
                 if (nlh->nlmsg_flags & NLM_F_CREATE)
                         err = ctnetlink_create_conntrack(cda, &otuple, &rtuple);
@@ -1074,7 +1021,6 @@ ctnetlink_new_conntrack(struct sock *ctnl, struct sk_buff *skb,
 
         /* We manipulate the conntrack inside the global conntrack table lock,
          * so there's no need to increase the refcount */
-        DEBUGP("conntrack found\n");
         err = -EEXIST;
         if (!(nlh->nlmsg_flags & NLM_F_EXCL))
                 err = ctnetlink_change_conntrack(tuplehash_to_ctrack(h), cda);
@@ -1249,8 +1195,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
         struct list_head *i;
         u_int32_t *id = (u_int32_t *) &cb->args[0];
 
-        DEBUGP("entered %s, last id=%llu\n", __FUNCTION__, *id);
-
         read_lock_bh(&ip_conntrack_lock);
         list_for_each_prev(i, &ip_conntrack_expect_list) {
                 exp = (struct ip_conntrack_expect *) i;
@@ -1266,8 +1210,6 @@ ctnetlink_exp_dump_table(struct sk_buff *skb, struct netlink_callback *cb)
 out:    
         read_unlock_bh(&ip_conntrack_lock);
 
-        DEBUGP("leaving, last id=%llu\n", *id);
-
         return skb->len;
 }
 
@@ -1285,8 +1227,6 @@ ctnetlink_get_expect(struct sock *ctnl, struct sk_buff *skb,
         struct sk_buff *skb2;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1437,8 +1377,6 @@ ctnetlink_create_expect(struct nfattr *cda[])
         struct ip_conntrack *ct;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);
-
         /* caller guarantees that those three CTA_EXPECT_* exist */
         err = ctnetlink_parse_tuple(cda, &tuple, CTA_EXPECT_TUPLE);
         if (err < 0)
@@ -1490,8 +1428,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
         struct ip_conntrack_expect *exp;
         int err = 0;
 
-        DEBUGP("entered %s\n", __FUNCTION__);   
-
         if (nfattr_bad_size(cda, CTA_EXPECT_MAX, cta_min_exp))
                 return -EINVAL;
 
@@ -1520,8 +1456,6 @@ ctnetlink_new_expect(struct sock *ctnl, struct sk_buff *skb,
                 err = ctnetlink_change_expect(exp, cda);
         write_unlock_bh(&ip_conntrack_lock);
 
-        DEBUGP("leaving\n");
-        
         return err;
 }
 
diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
index 78a44b01c035..4b90927619b8 100644
--- a/net/ipv4/netfilter/ip_tables.c
+++ b/net/ipv4/netfilter/ip_tables.c
@@ -1932,6 +1932,9 @@ compat_do_ipt_get_ctl(struct sock *sk, int cmd, void __user *user, int *len)
 {
         int ret;
 
+        if (!capable(CAP_NET_ADMIN))
+                return -EPERM;
+
         switch (cmd) {
         case IPT_SO_GET_INFO:
                 ret = get_info(user, len, 1);
diff --git a/net/ipv4/netfilter/ipt_ECN.c b/net/ipv4/netfilter/ipt_ECN.c
index 12a818a2462f..1aa4517fbcdb 100644
--- a/net/ipv4/netfilter/ipt_ECN.c
+++ b/net/ipv4/netfilter/ipt_ECN.c
@@ -28,7 +28,7 @@ static inline int
 set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
 {
         struct iphdr *iph = (*pskb)->nh.iph;
-        __be16 oldtos;
+        u_int16_t oldtos;
 
         if ((iph->tos & IPT_ECN_IP_MASK) != (einfo->ip_ect & IPT_ECN_IP_MASK)) {
                 if (!skb_make_writable(pskb, sizeof(struct iphdr)))
@@ -37,8 +37,8 @@ set_ect_ip(struct sk_buff **pskb, const struct ipt_ECN_info *einfo)
                 oldtos = iph->tos;
                 iph->tos &= ~IPT_ECN_IP_MASK;
                 iph->tos |= (einfo->ip_ect & IPT_ECN_IP_MASK);
-                iph->check = nf_csum_update(oldtos ^ htons(0xFFFF), iph->tos,
-                                            iph->check);
+                iph->check = nf_csum_update(htons(oldtos) ^ htons(0xFFFF),
+                                            htons(iph->tos), iph->check);
         } 
         return 1;
 }
diff --git a/net/ipv4/netfilter/ipt_TOS.c b/net/ipv4/netfilter/ipt_TOS.c
index 6b8b14ccc3d3..83b80b3a5d2f 100644
--- a/net/ipv4/netfilter/ipt_TOS.c
+++ b/net/ipv4/netfilter/ipt_TOS.c
@@ -30,7 +30,7 @@ target(struct sk_buff **pskb,
 {
         const struct ipt_tos_target_info *tosinfo = targinfo;
         struct iphdr *iph = (*pskb)->nh.iph;
-        __be16 oldtos;
+        u_int16_t oldtos;
 
         if ((iph->tos & IPTOS_TOS_MASK) != tosinfo->tos) {
                 if (!skb_make_writable(pskb, sizeof(struct iphdr)))
@@ -38,8 +38,8 @@ target(struct sk_buff **pskb,
                 iph = (*pskb)->nh.iph;
                 oldtos = iph->tos;
                 iph->tos = (iph->tos & IPTOS_PREC_MASK) | tosinfo->tos;
-                iph->check = nf_csum_update(oldtos ^ htons(0xFFFF), iph->tos,
-                                            iph->check);
+                iph->check = nf_csum_update(htons(oldtos) ^ htons(0xFFFF),
+                                            htons(iph->tos), iph->check);
         }
         return IPT_CONTINUE;
 }
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 6bbd98575172..22ef8bd26620 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -373,7 +373,7 @@ void tcp_v4_err(struct sk_buff *skb, u32 info)
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
             !between(seq, tp->snd_una, tp->snd_nxt)) {
-                NET_INC_STATS(LINUX_MIB_OUTOFWINDOWICMPS);
+                NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
                 goto out;
         }
 
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index f22536e32cb1..ca406157724c 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -1096,10 +1096,14 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
         u32 send_win, cong_win, limit, in_flight;
 
         if (TCP_SKB_CB(skb)->flags & TCPCB_FLAG_FIN)
-                return 0;
+                goto send_now;
 
         if (icsk->icsk_ca_state != TCP_CA_Open)
-                return 0;
+                goto send_now;
+
+        /* Defer for less than two clock ticks. */
+        if (!tp->tso_deferred && ((jiffies<<1)>>1) - (tp->tso_deferred>>1) > 1)
+                goto send_now;
 
         in_flight = tcp_packets_in_flight(tp);
 
@@ -1115,7 +1119,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
 
         /* If a full-sized TSO skb can be sent, do it. */
         if (limit >= 65536)
-                return 0;
+                goto send_now;
 
         if (sysctl_tcp_tso_win_divisor) {
                 u32 chunk = min(tp->snd_wnd, tp->snd_cwnd * tp->mss_cache);
@@ -1125,7 +1129,7 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
                  */
                 chunk /= sysctl_tcp_tso_win_divisor;
                 if (limit >= chunk)
-                        return 0;
+                        goto send_now;
         } else {
                 /* Different approach, try not to defer past a single
                  * ACK.  Receiver should ACK every other full sized
@@ -1133,11 +1137,17 @@ static int tcp_tso_should_defer(struct sock *sk, struct tcp_sock *tp, struct sk_
                  * then send now.
                  */
                 if (limit > tcp_max_burst(tp) * tp->mss_cache)
-                        return 0;
+                        goto send_now;
         }
 
         /* Ok, it looks like it is advisable to defer.  */
+        tp->tso_deferred = 1 | (jiffies<<1);
+
         return 1;
+
+send_now:
+        tp->tso_deferred = 0;
+        return 0;
 }
 
 /* Create a new MTU probe if we are ready.