5 files changed, 32 insertions, 24 deletions
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 1c6cf3a1a4f6..4ade3011bb3c 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -224,6 +224,15 @@ void skb_free_datagram(struct sock *sk, struct sk_buff *skb)
        consume_skb(skb);
        sk_mem_reclaim_partial(sk);
 }
+EXPORT_SYMBOL(skb_free_datagram);
+void skb_free_datagram_locked(struct sock *sk, struct sk_buff *skb)
+{
+        lock_sock(sk);
+        skb_free_datagram(sk, skb);
+        release_sock(sk);
+}
+EXPORT_SYMBOL(skb_free_datagram_locked);
 /**
 *      skb_kill_datagram - Free a datagram skbuff forcibly
@@ -752,5 +761,4 @@ unsigned int datagram_poll(struct file *file, struct socket *sock,
 EXPORT_SYMBOL(datagram_poll);
 EXPORT_SYMBOL(skb_copy_and_csum_datagram_iovec);
 EXPORT_SYMBOL(skb_copy_datagram_iovec);
-EXPORT_SYMBOL(skb_free_datagram);
 EXPORT_SYMBOL(skb_recv_datagram);
diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
index 41ada9904d31..143333852624 100644
--- a/net/ipv4/ip_gre.c
+++ b/net/ipv4/ip_gre.c
@@ -1464,7 +1464,7 @@ static void ipgre_tap_setup(struct net_device *dev)
        ether_setup(dev);
-        dev->netdev_ops         = &ipgre_netdev_ops;
+        dev->netdev_ops         = &ipgre_tap_netdev_ops;
        dev->destructor         = free_netdev;
        dev->iflink             = 0;
@@ -1525,25 +1525,29 @@ static int ipgre_changelink(struct net_device *dev, struct nlattr *tb[],
                if (t->dev != dev)
                        return -EEXIST;
        } else {
-                unsigned nflags = 0;
                t = nt;
-                if (ipv4_is_multicast(p.iph.daddr))
+                if (dev->type != ARPHRD_ETHER) {
-                        nflags = IFF_BROADCAST;
+                        unsigned nflags = 0;
-                else if (p.iph.daddr)
-                        nflags = IFF_POINTOPOINT;
-                if ((dev->flags ^ nflags) &
+                        if (ipv4_is_multicast(p.iph.daddr))
-                    (IFF_POINTOPOINT | IFF_BROADCAST))
+                                nflags = IFF_BROADCAST;
-                        return -EINVAL;
+                        else if (p.iph.daddr)
+                                nflags = IFF_POINTOPOINT;
+                        if ((dev->flags ^ nflags) &
+                            (IFF_POINTOPOINT | IFF_BROADCAST))
+                                return -EINVAL;
+                }
                ipgre_tunnel_unlink(ign, t);
                t->parms.iph.saddr = p.iph.saddr;
                t->parms.iph.daddr = p.iph.daddr;
                t->parms.i_key = p.i_key;
-                memcpy(dev->dev_addr, &p.iph.saddr, 4);
+                if (dev->type != ARPHRD_ETHER) {
-                memcpy(dev->broadcast, &p.iph.daddr, 4);
+                        memcpy(dev->dev_addr, &p.iph.saddr, 4);
+                        memcpy(dev->broadcast, &p.iph.daddr, 4);
+                }
                ipgre_tunnel_link(ign, t);
                netdev_state_change(dev);
        }
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index d0d436d6216c..0fa9f70e4b19 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -999,9 +999,7 @@ try_again:
                err = ulen;
 out_free:
-        lock_sock(sk);
+        skb_free_datagram_locked(sk, skb);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
 out:
        return err;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 3a60f12b34ed..cf538ed5ef6a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -288,9 +288,7 @@ try_again:
                err = ulen;
 out_free:
-        lock_sock(sk);
+        skb_free_datagram_locked(sk, skb);
-        skb_free_datagram(sk, skb);
-        release_sock(sk);
 out:
        return err;
diff --git a/net/sunrpc/svcsock.c b/net/sunrpc/svcsock.c
index ccc5e83cae5d..1c246a4f491e 100644
--- a/net/sunrpc/svcsock.c
+++ b/net/sunrpc/svcsock.c
@@ -111,7 +111,7 @@ static void svc_release_skb(struct svc_rqst *rqstp)
                rqstp->rq_xprt_ctxt = NULL;
                dprintk("svc: service %p, releasing skb %p\n", rqstp, skb);
-                skb_free_datagram(svsk->sk_sk, skb);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
        }
 }
@@ -578,7 +578,7 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                                "svc: received unknown control message %d/%d; "
                                "dropping RPC reply datagram\n",
                                        cmh->cmsg_level, cmh->cmsg_type);
-                skb_free_datagram(svsk->sk_sk, skb);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
                return 0;
        }
@@ -588,18 +588,18 @@ static int svc_udp_recvfrom(struct svc_rqst *rqstp)
                if (csum_partial_copy_to_xdr(&rqstp->rq_arg, skb)) {
                        local_bh_enable();
                        /* checksum error */
-                        skb_free_datagram(svsk->sk_sk, skb);
+                        skb_free_datagram_locked(svsk->sk_sk, skb);
                        return 0;
                }
                local_bh_enable();
-                skb_free_datagram(svsk->sk_sk, skb);
+                skb_free_datagram_locked(svsk->sk_sk, skb);
        } else {
                /* we can use it in-place */
                rqstp->rq_arg.head[0].iov_base = skb->data +
                        sizeof(struct udphdr);
                rqstp->rq_arg.head[0].iov_len = len;
                if (skb_checksum_complete(skb)) {
-                        skb_free_datagram(svsk->sk_sk, skb);
+                        skb_free_datagram_locked(svsk->sk_sk, skb);
                        return 0;
                }
                rqstp->rq_xprt_ctxt = skb;