9 files changed, 37 insertions, 53 deletions

diff --git a/net/802/tr.c b/net/802/tr.c
index 1eaa3d19d8bf..afd8385c0c9c 100644
--- a/net/802/tr.c
+++ b/net/802/tr.c
@@ -340,9 +340,10 @@ static void tr_add_rif_info(struct trh_hdr *trh, struct net_device *dev)
         unsigned int hash, rii_p = 0;
         unsigned long flags;
         struct rif_cache *entry;
-
+        unsigned char saddr0;
 
         spin_lock_irqsave(&rif_lock, flags);
+        saddr0 = trh->saddr[0];
         
         /*
          *      Firstly see if the entry exists
@@ -395,7 +396,6 @@ printk("adding rif_entry: addr:%02X:%02X:%02X:%02X:%02X:%02X rcf:%04X\n",
                         entry->rcf = trh->rcf & htons((unsigned short)~TR_RCF_BROADCAST_MASK);
                         memcpy(&(entry->rseg[0]),&(trh->rseg[0]),8*sizeof(unsigned short));
                         entry->local_ring = 0;
-                        trh->saddr[0]|=TR_RII; /* put the routing indicator back for tcpdump */
                 }
                 else
                 {
@@ -422,6 +422,7 @@ printk("updating rif_entry: addr:%02X:%02X:%02X:%02X:%02X:%02X rcf:%04X\n",
                     }                                         
                 entry->last_used=jiffies;               
         }
+        trh->saddr[0]=saddr0; /* put the routing indicator back for tcpdump */
         spin_unlock_irqrestore(&rif_lock, flags);
 }
 
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 4128fc76ac3a..1dcf7fa1f0fe 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -175,39 +175,10 @@ static void pneigh_queue_purge(struct sk_buff_head *list)
         }
 }
 
-void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
+static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
 {
         int i;
 
-        write_lock_bh(&tbl->lock);
-
-        for (i=0; i <= tbl->hash_mask; i++) {
-                struct neighbour *n, **np;
-
-                np = &tbl->hash_buckets[i];
-                while ((n = *np) != NULL) {
-                        if (dev && n->dev != dev) {
-                                np = &n->next;
-                                continue;
-                        }
-                        *np = n->next;
-                        write_lock_bh(&n->lock);
-                        n->dead = 1;
-                        neigh_del_timer(n);
-                        write_unlock_bh(&n->lock);
-                        neigh_release(n);
-                }
-        }
-
-        write_unlock_bh(&tbl->lock);
-}
-
-int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
-{
-        int i;
-
-        write_lock_bh(&tbl->lock);
-
         for (i = 0; i <= tbl->hash_mask; i++) {
                 struct neighbour *n, **np = &tbl->hash_buckets[i];
 
@@ -243,7 +214,19 @@ int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
                         neigh_release(n);
                 }
         }
+}
 
+void neigh_changeaddr(struct neigh_table *tbl, struct net_device *dev)
+{
+        write_lock_bh(&tbl->lock);
+        neigh_flush_dev(tbl, dev);
+        write_unlock_bh(&tbl->lock);
+}
+
+int neigh_ifdown(struct neigh_table *tbl, struct net_device *dev)
+{
+        write_lock_bh(&tbl->lock);
+        neigh_flush_dev(tbl, dev);
         pneigh_ifdown(tbl, dev);
         write_unlock_bh(&tbl->lock);
 
@@ -732,6 +715,7 @@ static inline void neigh_add_timer(struct neighbour *n, unsigned long when)
         if (unlikely(mod_timer(&n->timer, when))) {
                 printk("NEIGH: BUG, double timer add, state is %x\n",
                        n->nud_state);
+                dump_stack();
         }
 }
 
@@ -815,10 +799,10 @@ static void neigh_timer_handler(unsigned long arg)
         }
 
         if (neigh->nud_state & NUD_IN_TIMER) {
-                neigh_hold(neigh);
                 if (time_before(next, jiffies + HZ/2))
                         next = jiffies + HZ/2;
-                neigh_add_timer(neigh, next);
+                if (!mod_timer(&neigh->timer, next))
+                        neigh_hold(neigh);
         }
         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
                 struct sk_buff *skb = skb_peek(&neigh->arp_queue);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index af9b1516e21f..02cd4cde2112 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -410,6 +410,9 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         C(nfct);
         nf_conntrack_get(skb->nfct);
         C(nfctinfo);
+#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
+        C(ipvs_property);
+#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         C(nf_bridge);
         nf_bridge_get(skb->nf_bridge);
@@ -467,6 +470,9 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
         new->nfct       = old->nfct;
         nf_conntrack_get(old->nfct);
         new->nfctinfo   = old->nfctinfo;
+#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
+        new->ipvs_property = old->ipvs_property;
+#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         new->nf_bridge  = old->nf_bridge;
         nf_bridge_get(old->nf_bridge);
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index ae088d1347af..6298cf58ff9e 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -463,6 +463,7 @@ static int dccp_v4_send_response(struct sock *sk, struct request_sock *req,
         if (skb != NULL) {
                 const struct inet_request_sock *ireq = inet_rsk(req);
 
+                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                 err = ip_build_and_send_pkt(skb, sk, ireq->loc_addr,
                                             ireq->rmt_addr,
                                             ireq->opt);
@@ -647,6 +648,7 @@ int dccp_v4_send_reset(struct sock *sk, enum dccp_reset_codes code)
         if (skb != NULL) {
                 const struct inet_sock *inet = inet_sk(sk);
 
+                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                 err = ip_build_and_send_pkt(skb, sk,
                                             inet->saddr, inet->daddr, NULL);
                 if (err == NET_XMIT_CN)
diff --git a/net/dccp/output.c b/net/dccp/output.c
index 4786bdcddcc9..29250749f16f 100644
--- a/net/dccp/output.c
+++ b/net/dccp/output.c
@@ -62,10 +62,8 @@ int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
                 
                 skb->h.raw = skb_push(skb, dccp_header_size);
                 dh = dccp_hdr(skb);
-                /*
-                 * Data packets are not cloned as they are never retransmitted
-                 */
-                if (skb_cloned(skb))
+
+                if (!skb->sk)
                         skb_set_owner_w(skb, sk);
 
                 /* Build DCCP header and checksum it. */
@@ -102,6 +100,7 @@ int dccp_transmit_skb(struct sock *sk, struct sk_buff *skb)
 
                 DCCP_INC_STATS(DCCP_MIB_OUTSEGS);
 
+                memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
                 err = ip_queue_xmit(skb, 0);
                 if (err <= 0)
                         return err;
@@ -243,7 +242,8 @@ int dccp_write_xmit(struct sock *sk, struct sk_buff *skb, long *timeo)
 
                 err = dccp_transmit_skb(sk, skb);
                 ccid_hc_tx_packet_sent(dp->dccps_hc_tx_ccid, sk, 0, len);
-        }
+        } else
+                kfree_skb(skb);
 
         return err;
 }
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
index a1cfd0e9e3bc..a021c3422f67 100644
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@ -402,8 +402,6 @@ int dccp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
          *     This bug was _quickly_ found & fixed by just looking at an OSTRA
          *     generated callgraph 8) -acme
          */
-        if (rc != 0)
-                goto out_discard;
 out_release:
         release_sock(sk);
         return rc ? : len;
diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 3f1a263e1249..1ad5202e556b 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -391,6 +391,9 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
         to->nfct = from->nfct;
         nf_conntrack_get(to->nfct);
         to->nfctinfo = from->nfctinfo;
+#if defined(CONFIG_IP_VS) || defined(CONFIG_IP_VS_MODULE)
+        to->ipvs_property = from->ipvs_property;
+#endif
 #ifdef CONFIG_BRIDGE_NETFILTER
         nf_bridge_put(to->nf_bridge);
         to->nf_bridge = from->nf_bridge;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 7114031fdc70..b907456a79f4 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -435,17 +435,7 @@ int tcp_fragment(struct sock *sk, struct sk_buff *skb, u32 len, unsigned int mss
         int nsize, old_factor;
         u16 flags;
 
-        if (unlikely(len >= skb->len)) {
-                if (net_ratelimit()) {
-                        printk(KERN_DEBUG "TCP: seg_size=%u, mss=%u, seq=%u, "
-                               "end_seq=%u, skb->len=%u.\n", len, mss_now,
-                               TCP_SKB_CB(skb)->seq, TCP_SKB_CB(skb)->end_seq,
-                               skb->len);
-                        WARN_ON(1);
-                }
-                return 0;
-        }
-
+        BUG_ON(len > skb->len);
         nsize = skb_headlen(skb) - len;
         if (nsize < 0)
                 nsize = 0;
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index f841bde30c18..bbbe80cdaf72 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -483,7 +483,7 @@ int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
                                                 goto done;
                                         }
                                         fl1 = sfl->fl;
-                                        atomic_inc(&fl->users);
+                                        atomic_inc(&fl1->users);
                                         break;
                                 }
                         }