8 files changed, 31 insertions, 15 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7744a2592693..2720899d516c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -372,6 +372,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                 ndev->regen_timer.data = (unsigned long) ndev;
                 if ((dev->flags&IFF_LOOPBACK) ||
                     dev->type == ARPHRD_TUNNEL ||
+                    dev->type == ARPHRD_NONE ||
                     dev->type == ARPHRD_SIT) {
                         printk(KERN_INFO
                                 "Disabled Privacy Extensions on device %p(%s)\n",
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 8e0f569b883e..ff3ec9822e36 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -277,8 +277,8 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
 {
         struct inet6_dev *idev = NULL;
         struct ipv6hdr *hdr = skb->nh.ipv6h;
-        struct sock *sk = icmpv6_socket->sk;
-        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct sock *sk;
+        struct ipv6_pinfo *np;
         struct in6_addr *saddr = NULL;
         struct dst_entry *dst;
         struct icmp6hdr tmp_hdr;
@@ -358,6 +358,9 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         if (icmpv6_xmit_lock())
                 return;
 
+        sk = icmpv6_socket->sk;
+        np = inet6_sk(sk);
+
         if (!icmpv6_xrlim_allow(sk, type, &fl))
                 goto out;
 
@@ -423,9 +426,9 @@ out:
 
 static void icmpv6_echo_reply(struct sk_buff *skb)
 {
-        struct sock *sk = icmpv6_socket->sk;
+        struct sock *sk;
         struct inet6_dev *idev;
-        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct ipv6_pinfo *np;
         struct in6_addr *saddr = NULL;
         struct icmp6hdr *icmph = (struct icmp6hdr *) skb->h.raw;
         struct icmp6hdr tmp_hdr;
@@ -454,6 +457,9 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (icmpv6_xmit_lock())
                 return;
 
+        sk = icmpv6_socket->sk;
+        np = inet6_sk(sk);
+
         if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
                 fl.oif = np->mcast_oif;
 
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index a93f6dc51979..0e5f7499debb 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -535,10 +535,12 @@ release:
                 if (err)
                         goto done;
 
-                /* Do not check for fault */
-                if (!freq.flr_label)
-                        copy_to_user(&((struct in6_flowlabel_req __user *) optval)->flr_label,
-                                     &fl->label, sizeof(fl->label));
+                if (!freq.flr_label) {
+                        if (copy_to_user(&((struct in6_flowlabel_req __user *) optval)->flr_label,
+                                         &fl->label, sizeof(fl->label))) {
+                                /* Intentionally ignore fault. */
+                        }
+                }
 
                 sfl1->fl = fl;
                 sfl1->next = np->ipv6_fl_list;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 0f0711417c9d..b78a53586804 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -552,13 +552,17 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                             skb_headroom(frag) < hlen)
                             goto slow_path;
 
-                        /* Correct socket ownership. */
-                        if (frag->sk == NULL)
-                                goto slow_path;
-
                         /* Partially cloned skb? */
                         if (skb_shared(frag))
                                 goto slow_path;
+
+                        BUG_ON(frag->sk);
+                        if (skb->sk) {
+                                sock_hold(skb->sk);
+                                frag->sk = skb->sk;
+                                frag->destructor = sock_wfree;
+                                skb->truesize -= frag->truesize;
+                        }
                 }
 
                 err = 0;
@@ -1116,12 +1120,10 @@ int ip6_push_pending_frames(struct sock *sk)
                 tail_skb = &(tmp_skb->next);
                 skb->len += tmp_skb->len;
                 skb->data_len += tmp_skb->len;
-#if 0 /* Logically correct, but useless work, ip_fragment() will have to undo */
                 skb->truesize += tmp_skb->truesize;
                 __sock_put(tmp_skb->sk);
                 tmp_skb->destructor = NULL;
                 tmp_skb->sk = NULL;
-#endif
         }
 
         ipv6_addr_copy(final_dst, &fl->fl6_dst);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 3b1c9fa184ae..ba3b0c267f75 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -882,6 +882,7 @@ ip6ip6_tnl_change(struct ip6_tnl *t, struct ip6_tnl_parm *p)
         t->parms.hop_limit = p->hop_limit;
         t->parms.encap_limit = p->encap_limit;
         t->parms.flowinfo = p->flowinfo;
+        t->parms.link = p->link;
         ip6ip6_tnl_link_config(t);
         return 0;
 }
diff --git a/net/ipv6/ipv6_syms.c b/net/ipv6/ipv6_syms.c
index 2f4c91ddc9a3..5ade5a5d1990 100644
--- a/net/ipv6/ipv6_syms.c
+++ b/net/ipv6/ipv6_syms.c
@@ -37,5 +37,4 @@ EXPORT_SYMBOL(in6_dev_finish_destroy);
 EXPORT_SYMBOL(xfrm6_rcv);
 #endif
 EXPORT_SYMBOL(rt6_lookup);
-EXPORT_SYMBOL(fl6_sock_lookup);
 EXPORT_SYMBOL(ipv6_push_nfrag_opts);
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 601a148f60f3..6b9867717d11 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -84,6 +84,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
                 mtu = IPV6_MIN_MTU;
 
         if (skb->len > mtu) {
+                skb->dev = dst->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
                 ret = -EMSGSIZE;
         }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 4429b1a1fe5f..cf1d91e74c82 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -113,6 +113,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
                 xdst = (struct xfrm_dst *)dst1;
                 xdst->route = &rt->u.dst;
+                if (rt->rt6i_node)
+                        xdst->route_cookie = rt->rt6i_node->fn_sernum;
 
                 dst1->next = dst_prev;
                 dst_prev = dst1;
@@ -137,6 +139,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
 
         dst_prev->child = &rt->u.dst;
         dst->path = &rt->u.dst;
+        if (rt->rt6i_node)
+                ((struct xfrm_dst *)dst)->path_cookie = rt->rt6i_node->fn_sernum;
 
         *dst_p = dst;
         dst = dst_prev;