7 files changed, 159 insertions, 25 deletions

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 91e412b0ab00..67465b65abe4 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -753,6 +753,8 @@ static int vlan_ioctl_handler(void __user *arg)
                 break;
         case GET_VLAN_REALDEV_NAME_CMD:
                 err = vlan_dev_get_realdev_name(args.device1, args.u.device2);
+                if (err)
+                        goto out;
                 if (copy_to_user(arg, &args,
                                  sizeof(struct vlan_ioctl_args))) {
                         err = -EFAULT;
@@ -761,6 +763,8 @@ static int vlan_ioctl_handler(void __user *arg)
 
         case GET_VLAN_VID_CMD:
                 err = vlan_dev_get_vid(args.device1, &vid);
+                if (err)
+                        goto out;
                 args.u.VID = vid;
                 if (copy_to_user(arg, &args,
                                  sizeof(struct vlan_ioctl_args))) {
@@ -774,7 +778,7 @@ static int vlan_ioctl_handler(void __user *arg)
                         __FUNCTION__, args.cmd);
                 return -EINVAL;
         };
-
+out:
         return err;
 }
 
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index ca03521112c5..656e13e38cfb 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -1251,7 +1251,7 @@ static int dccp_v4_destroy_sock(struct sock *sk)
         struct dccp_sock *dp = dccp_sk(sk);
 
         /*
-         * DCCP doesn't use sk_qrite_queue, just sk_send_head
+         * DCCP doesn't use sk_write_queue, just sk_send_head
          * for retransmissions
          */
         if (sk->sk_send_head != NULL) {
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 4ea8cf7c0cc4..510220f2ae8b 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -137,6 +137,7 @@ static int addrconf_ifdown(struct net_device *dev, int how);
 static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags);
 static void addrconf_dad_timer(unsigned long data);
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp);
+static void addrconf_dad_run(struct inet6_dev *idev);
 static void addrconf_rs_timer(unsigned long data);
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
 static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifa);
@@ -388,6 +389,9 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                 }
 #endif
 
+                if (netif_carrier_ok(dev))
+                        ndev->if_flags |= IF_READY;
+
                 write_lock_bh(&addrconf_lock);
                 dev->ip6_ptr = ndev;
                 write_unlock_bh(&addrconf_lock);
@@ -415,6 +419,7 @@ static struct inet6_dev * ipv6_find_idev(struct net_device *dev)
                 if ((idev = ipv6_add_dev(dev)) == NULL)
                         return NULL;
         }
+
         if (dev->flags&IFF_UP)
                 ipv6_mc_up(idev);
         return idev;
@@ -634,8 +639,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
         }
 #endif
 
-        for (ifap = &idev->addr_list; (ifa=*ifap) != NULL;
-             ifap = &ifa->if_next) {
+        for (ifap = &idev->addr_list; (ifa=*ifap) != NULL;) {
                 if (ifa == ifp) {
                         *ifap = ifa->if_next;
                         __in6_ifa_put(ifp);
@@ -643,6 +647,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                         if (!(ifp->flags & IFA_F_PERMANENT) || onlink > 0)
                                 break;
                         deleted = 1;
+                        continue;
                 } else if (ifp->flags & IFA_F_PERMANENT) {
                         if (ipv6_prefix_equal(&ifa->addr, &ifp->addr,
                                               ifp->prefix_len)) {
@@ -666,6 +671,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                                 }
                         }
                 }
+                ifap = &ifa->if_next;
         }
         write_unlock_bh(&idev->lock);
 
@@ -903,11 +909,18 @@ int ipv6_dev_get_saddr(struct net_device *daddr_dev,
 
                         score.addr_type = __ipv6_addr_type(&ifa->addr);
 
-                        /* Rule 0: Candidate Source Address (section 4)
+                        /* Rule 0:
+                         * - Tentative Address (RFC2462 section 5.4)
+                         *  - A tentative address is not considered
+                         *    "assigned to an interface" in the traditional
+                         *    sense.
+                         * - Candidate Source Address (section 4)
                          *  - In any case, anycast addresses, multicast
                          *    addresses, and the unspecified address MUST
                          *    NOT be included in a candidate set.
                          */
+                        if (ifa->flags & IFA_F_TENTATIVE)
+                                continue;
                         if (unlikely(score.addr_type == IPV6_ADDR_ANY ||
                                      score.addr_type & IPV6_ADDR_MULTICAST)) {
                                 LIMIT_NETDEBUG(KERN_DEBUG
@@ -1215,10 +1228,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 
 /* Gets referenced address, destroys ifaddr */
 
-void addrconf_dad_failure(struct inet6_ifaddr *ifp)
+void addrconf_dad_stop(struct inet6_ifaddr *ifp)
 {
-        if (net_ratelimit())
-                printk(KERN_INFO "%s: duplicate address detected!\n", ifp->idev->dev->name);
         if (ifp->flags&IFA_F_PERMANENT) {
                 spin_lock_bh(&ifp->lock);
                 addrconf_del_timer(ifp);
@@ -1244,6 +1255,12 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                 ipv6_del_addr(ifp);
 }
 
+void addrconf_dad_failure(struct inet6_ifaddr *ifp)
+{
+        if (net_ratelimit())
+                printk(KERN_INFO "%s: duplicate address detected!\n", ifp->idev->dev->name);
+        addrconf_dad_stop(ifp);
+}
 
 /* Join to solicited addr multicast group. */
 
@@ -2133,9 +2150,42 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
 {
         struct net_device *dev = (struct net_device *) data;
         struct inet6_dev *idev = __in6_dev_get(dev);
+        int run_pending = 0;
 
         switch(event) {
         case NETDEV_UP:
+        case NETDEV_CHANGE:
+                if (event == NETDEV_UP) {
+                        if (!netif_carrier_ok(dev)) {
+                                /* device is not ready yet. */
+                                printk(KERN_INFO
+                                        "ADDRCONF(NETDEV_UP): %s: "
+                                        "link is not ready\n",
+                                        dev->name);
+                                break;
+                        }
+                } else {
+                        if (!netif_carrier_ok(dev)) {
+                                /* device is still not ready. */
+                                break;
+                        }
+
+                        if (idev) {
+                                if (idev->if_flags & IF_READY) {
+                                        /* device is already configured. */
+                                        break;
+                                }
+                                idev->if_flags |= IF_READY;
+                        }
+
+                        printk(KERN_INFO
+                                        "ADDRCONF(NETDEV_CHANGE): %s: "
+                                        "link becomes ready\n",
+                                        dev->name);
+
+                        run_pending = 1;
+                }
+
                 switch(dev->type) {
                 case ARPHRD_SIT:
                         addrconf_sit_config(dev);
@@ -2152,6 +2202,9 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         break;
                 };
                 if (idev) {
+                        if (run_pending)
+                                addrconf_dad_run(idev);
+
                         /* If the MTU changed during the interface down, when the
                            interface up, the changed MTU must be reflected in the
                            idev as well as routers.
@@ -2186,8 +2239,7 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                  */
                 addrconf_ifdown(dev, event != NETDEV_DOWN);
                 break;
-        case NETDEV_CHANGE:
-                break;
+
         case NETDEV_CHANGENAME:
 #ifdef CONFIG_SYSCTL
                 if (idev) {
@@ -2268,7 +2320,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 
         /* Step 3: clear flags for stateless addrconf */
         if (how != 1)
-                idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD);
+                idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
 
         /* Step 4: clear address list */
 #ifdef CONFIG_IPV6_PRIVACY
@@ -2377,11 +2429,20 @@ out:
 /*
  *      Duplicate Address Detection
  */
+static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
+{
+        unsigned long rand_num;
+        struct inet6_dev *idev = ifp->idev;
+
+        rand_num = net_random() % (idev->cnf.rtr_solicit_delay ? : 1);
+        ifp->probes = idev->cnf.dad_transmits;
+        addrconf_mod_timer(ifp, AC_DAD, rand_num);
+}
+
 static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
 {
         struct inet6_dev *idev = ifp->idev;
         struct net_device *dev = idev->dev;
-        unsigned long rand_num;
 
         addrconf_join_solict(dev, &ifp->addr);
 
@@ -2390,7 +2451,6 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
                                         flags);
 
         net_srandom(ifp->addr.s6_addr32[3]);
-        rand_num = net_random() % (idev->cnf.rtr_solicit_delay ? : 1);
 
         read_lock_bh(&idev->lock);
         if (ifp->dead)
@@ -2407,8 +2467,17 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
                 return;
         }
 
-        ifp->probes = idev->cnf.dad_transmits;
-        addrconf_mod_timer(ifp, AC_DAD, rand_num);
+        if (idev->if_flags & IF_READY)
+                addrconf_dad_kick(ifp);
+        else {
+                /*
+                 * If the defice is not ready:
+                 * - keep it tentative if it is a permanent address.
+                 * - otherwise, kill it.
+                 */
+                in6_ifa_hold(ifp);
+                addrconf_dad_stop(ifp);
+        }
 
         spin_unlock_bh(&ifp->lock);
 out:
@@ -2492,6 +2561,22 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
         }
 }
 
+static void addrconf_dad_run(struct inet6_dev *idev) {
+        struct inet6_ifaddr *ifp;
+
+        read_lock_bh(&idev->lock);
+        for (ifp = idev->addr_list; ifp; ifp = ifp->if_next) {
+                spin_lock_bh(&ifp->lock);
+                if (!(ifp->flags & IFA_F_TENTATIVE)) {
+                        spin_unlock_bh(&ifp->lock);
+                        continue;
+                }
+                spin_unlock_bh(&ifp->lock);
+                addrconf_dad_kick(ifp);
+        }
+        read_unlock_bh(&idev->lock);
+}
+
 #ifdef CONFIG_PROC_FS
 struct if6_iter_state {
         int bucket;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 34a332225c17..6ec6a2b549bb 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -328,8 +328,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
                 iif = skb->dev->ifindex;
 
         /*
-         *      Must not send if we know that source is Anycast also.
-         *      for now we don't know that.
+         *      Must not send error if the source does not uniquely
+         *      identify a single node (RFC2463 Section 2.4).
+         *      We check unspecified / multicast addresses here,
+         *      and anycast addresses will be checked later.
          */
         if ((addr_type == IPV6_ADDR_ANY) || (addr_type & IPV6_ADDR_MULTICAST)) {
                 LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: addr_any/mcast source\n");
@@ -373,6 +375,16 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         err = ip6_dst_lookup(sk, &dst, &fl);
         if (err)
                 goto out;
+
+        /*
+         * We won't send icmp if the destination is known
+         * anycast.
+         */
+        if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
+                LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: acast source\n");
+                goto out_dst_release;
+        }
+
         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
                 goto out;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7c68bfbee361..66140f13d119 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -413,11 +413,14 @@ static struct rt6_info *rt6_cow(struct rt6_info *ort, struct in6_addr *daddr,
         rt = ip6_rt_copy(ort);
 
         if (rt) {
-                ipv6_addr_copy(&rt->rt6i_dst.addr, daddr);
-
-                if (!(rt->rt6i_flags&RTF_GATEWAY))
+                if (!(rt->rt6i_flags&RTF_GATEWAY)) {
+                        if (rt->rt6i_dst.plen != 128 &&
+                            ipv6_addr_equal(&rt->rt6i_dst.addr, daddr))
+                                rt->rt6i_flags |= RTF_ANYCAST;
                         ipv6_addr_copy(&rt->rt6i_gateway, daddr);
+                }
 
+                ipv6_addr_copy(&rt->rt6i_dst.addr, daddr);
                 rt->rt6i_dst.plen = 128;
                 rt->rt6i_flags |= RTF_CACHE;
                 rt->u.dst.flags |= DST_HOST;
@@ -1413,7 +1416,9 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         rt->u.dst.obsolete = -1;
 
         rt->rt6i_flags = RTF_UP | RTF_NONEXTHOP;
-        if (!anycast)
+        if (anycast)
+                rt->rt6i_flags |= RTF_ANYCAST;
+        else
                 rt->rt6i_flags |= RTF_LOCAL;
         rt->rt6i_nexthop = ndisc_get_neigh(rt->rt6i_dev, &rt->rt6i_gateway);
         if (rt->rt6i_nexthop == NULL) {
diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c
index 004e8599b8fe..a7d88b5ad756 100644
--- a/net/netrom/nr_in.c
+++ b/net/netrom/nr_in.c
@@ -99,7 +99,7 @@ static int nr_state1_machine(struct sock *sk, struct sk_buff *skb,
                 break;
 
         case NR_RESET:
-                if (sysctl_netrom_reset_circuit);
+                if (sysctl_netrom_reset_circuit)
                         nr_disconnect(sk, ECONNRESET);
                 break;
 
@@ -130,7 +130,7 @@ static int nr_state2_machine(struct sock *sk, struct sk_buff *skb,
                 break;
 
         case NR_RESET:
-                if (sysctl_netrom_reset_circuit);
+                if (sysctl_netrom_reset_circuit)
                         nr_disconnect(sk, ECONNRESET);
                 break;
 
@@ -265,7 +265,7 @@ static int nr_state3_machine(struct sock *sk, struct sk_buff *skb, int frametype
                 break;
 
         case NR_RESET:
-                if (sysctl_netrom_reset_circuit);
+                if (sysctl_netrom_reset_circuit)
                         nr_disconnect(sk, ECONNRESET);
                 break;
 
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index 54a4be6a7d26..d19e274b9c4a 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -346,6 +346,7 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
         struct xfrm_policy *pol, **p;
         struct xfrm_policy *delpol = NULL;
         struct xfrm_policy **newpos = NULL;
+        struct dst_entry *gc_list;
 
         write_lock_bh(&xfrm_policy_lock);
         for (p = &xfrm_policy_list[dir]; (pol=*p)!=NULL;) {
@@ -381,9 +382,36 @@ int xfrm_policy_insert(int dir, struct xfrm_policy *policy, int excl)
                 xfrm_pol_hold(policy);
         write_unlock_bh(&xfrm_policy_lock);
 
-        if (delpol) {
+        if (delpol)
                 xfrm_policy_kill(delpol);
+
+        read_lock_bh(&xfrm_policy_lock);
+        gc_list = NULL;
+        for (policy = policy->next; policy; policy = policy->next) {
+                struct dst_entry *dst;
+
+                write_lock(&policy->lock);
+                dst = policy->bundles;
+                if (dst) {
+                        struct dst_entry *tail = dst;
+                        while (tail->next)
+                                tail = tail->next;
+                        tail->next = gc_list;
+                        gc_list = dst;
+
+                        policy->bundles = NULL;
+                }
+                write_unlock(&policy->lock);
         }
+        read_unlock_bh(&xfrm_policy_lock);
+
+        while (gc_list) {
+                struct dst_entry *dst = gc_list;
+
+                gc_list = dst->next;
+                dst_free(dst);
+        }
+
         return 0;
 }
 EXPORT_SYMBOL(xfrm_policy_insert);