17 files changed, 149 insertions, 134 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 6fe7d739e59b..be9924f60ec3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -5035,6 +5035,11 @@ int register_netdevice(struct net_device *dev)
                 rollback_registered(dev);
                 dev->reg_state = NETREG_UNREGISTERED;
         }
+        /*
+         *      Prevent userspace races by waiting until the network
+         *      device is fully setup before sending notifications.
+         */
+        rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
 
 out:
         return ret;
@@ -5597,6 +5602,12 @@ int dev_change_net_namespace(struct net_device *dev, struct net *net, const char
         /* Notify protocols, that a new device appeared. */
         call_netdevice_notifiers(NETDEV_REGISTER, dev);
 
+        /*
+         *      Prevent userspace races by waiting until the network
+         *      device is fully setup before sending notifications.
+         */
+        rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
+
         synchronize_net();
         err = 0;
 out:
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 33148a568199..794bcb897ff0 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1364,15 +1364,15 @@ static int rtnetlink_event(struct notifier_block *this, unsigned long event, voi
         case NETDEV_UNREGISTER:
                 rtmsg_ifinfo(RTM_DELLINK, dev, ~0U);
                 break;
-        case NETDEV_REGISTER:
-                rtmsg_ifinfo(RTM_NEWLINK, dev, ~0U);
-                break;
         case NETDEV_UP:
         case NETDEV_DOWN:
                 rtmsg_ifinfo(RTM_NEWLINK, dev, IFF_UP|IFF_RUNNING);
                 break;
+        case NETDEV_POST_INIT:
+        case NETDEV_REGISTER:
         case NETDEV_CHANGE:
         case NETDEV_GOING_DOWN:
+        case NETDEV_UNREGISTER_BATCH:
                 break;
         default:
                 rtmsg_ifinfo(RTM_NEWLINK, dev, 0);
diff --git a/net/ipv4/netfilter/nf_defrag_ipv4.c b/net/ipv4/netfilter/nf_defrag_ipv4.c
index fa2d6b6fc3e5..331ead3ebd1b 100644
--- a/net/ipv4/netfilter/nf_defrag_ipv4.c
+++ b/net/ipv4/netfilter/nf_defrag_ipv4.c
@@ -14,6 +14,7 @@
 #include <net/route.h>
 #include <net/ip.h>
 
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv4.h>
 #include <net/netfilter/ipv4/nf_defrag_ipv4.h>
 
@@ -34,6 +35,20 @@ static int nf_ct_ipv4_gather_frags(struct sk_buff *skb, u_int32_t user)
         return err;
 }
 
+static enum ip_defrag_users nf_ct_defrag_user(unsigned int hooknum,
+                                              struct sk_buff *skb)
+{
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP_DEFRAG_CONNTRACK_BRIDGE_IN;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP_DEFRAG_CONNTRACK_IN;
+        else
+                return IP_DEFRAG_CONNTRACK_OUT;
+}
+
 static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
                                           struct sk_buff *skb,
                                           const struct net_device *in,
@@ -50,10 +65,8 @@ static unsigned int ipv4_conntrack_defrag(unsigned int hooknum,
 #endif
         /* Gather fragments. */
         if (ip_hdr(skb)->frag_off & htons(IP_MF | IP_OFFSET)) {
-                if (nf_ct_ipv4_gather_frags(skb,
-                                            hooknum == NF_INET_PRE_ROUTING ?
-                                            IP_DEFRAG_CONNTRACK_IN :
-                                            IP_DEFRAG_CONNTRACK_OUT))
+                enum ip_defrag_users user = nf_ct_defrag_user(hooknum, skb);
+                if (nf_ct_ipv4_gather_frags(skb, user))
                         return NF_STOLEN;
         }
         return NF_ACCEPT;
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 26399ad2a289..66fd80ef2473 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -277,6 +277,13 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
         ret = NULL;
         req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
@@ -292,6 +299,12 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
         ireq->ecn_ok            = 0;
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
 
         /* We throwed the options of the initial SYN away, so we hope
          * the ACK carries the same options again (see RFC1122 4.2.3.8)
@@ -340,20 +353,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 }
         }
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, &rt->u.dst);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
-
         /* Try to redo what tcp_v4_send_synack did. */
         req->window_clamp = tp->window_clamp ? :dst_metric(&rt->u.dst, RTAX_WINDOW);
 
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 12cab7d74dba..28e029632493 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -3727,7 +3727,7 @@ old_ack:
  * the fast version below fails.
  */
 void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
-                       u8 **hvpp, int estab,  struct dst_entry *dst)
+                       u8 **hvpp, int estab)
 {
         unsigned char *ptr;
         struct tcphdr *th = tcp_hdr(skb);
@@ -3766,8 +3766,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_WINDOW:
                                 if (opsize == TCPOLEN_WINDOW && th->syn &&
-                                    !estab && sysctl_tcp_window_scaling &&
-                                    !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)) {
+                                    !estab && sysctl_tcp_window_scaling) {
                                         __u8 snd_wscale = *(__u8 *)ptr;
                                         opt_rx->wscale_ok = 1;
                                         if (snd_wscale > 14) {
@@ -3783,8 +3782,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                         case TCPOPT_TIMESTAMP:
                                 if ((opsize == TCPOLEN_TIMESTAMP) &&
                                     ((estab && opt_rx->tstamp_ok) ||
-                                     (!estab && sysctl_tcp_timestamps &&
-                                      !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP)))) {
+                                     (!estab && sysctl_tcp_timestamps))) {
                                         opt_rx->saw_tstamp = 1;
                                         opt_rx->rcv_tsval = get_unaligned_be32(ptr);
                                         opt_rx->rcv_tsecr = get_unaligned_be32(ptr + 4);
@@ -3792,8 +3790,7 @@ void tcp_parse_options(struct sk_buff *skb, struct tcp_options_received *opt_rx,
                                 break;
                         case TCPOPT_SACK_PERM:
                                 if (opsize == TCPOLEN_SACK_PERM && th->syn &&
-                                    !estab && sysctl_tcp_sack &&
-                                    !dst_feature(dst, RTAX_FEATURE_NO_SACK)) {
+                                    !estab && sysctl_tcp_sack) {
                                         opt_rx->sack_ok = 1;
                                         tcp_sack_reset(opt_rx);
                                 }
@@ -3878,7 +3875,7 @@ static int tcp_fast_parse_options(struct sk_buff *skb, struct tcphdr *th,
                 if (tcp_parse_aligned_timestamp(tp, th))
                         return 1;
         }
-        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1, NULL);
+        tcp_parse_options(skb, &tp->rx_opt, hvpp, 1);
         return 1;
 }
 
@@ -4133,10 +4130,8 @@ static inline int tcp_sack_extend(struct tcp_sack_block *sp, u32 seq,
 static void tcp_dsack_set(struct sock *sk, u32 seq, u32 end_seq)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
 
-        if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
-            !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
+        if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
                 int mib_idx;
 
                 if (before(seq, tp->rcv_nxt))
@@ -4165,15 +4160,13 @@ static void tcp_dsack_extend(struct sock *sk, u32 seq, u32 end_seq)
 static void tcp_send_dupack(struct sock *sk, struct sk_buff *skb)
 {
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
 
         if (TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq &&
             before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
                 NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_DELAYEDACKLOST);
                 tcp_enter_quickack_mode(sk);
 
-                if (tcp_is_sack(tp) && sysctl_tcp_dsack &&
-                    !dst_feature(dst, RTAX_FEATURE_NO_DSACK)) {
+                if (tcp_is_sack(tp) && sysctl_tcp_dsack) {
                         u32 end_seq = TCP_SKB_CB(skb)->end_seq;
 
                         if (after(TCP_SKB_CB(skb)->end_seq, tp->rcv_nxt))
@@ -5428,11 +5421,10 @@ static int tcp_rcv_synsent_state_process(struct sock *sk, struct sk_buff *skb,
         u8 *hash_location;
         struct inet_connection_sock *icsk = inet_csk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
         struct tcp_cookie_values *cvp = tp->cookie_values;
         int saved_clamp = tp->rx_opt.mss_clamp;
 
-        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tp->rx_opt, &hash_location, 0);
 
         if (th->ack) {
                 /* rfc793:
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 15e96030ce47..65b8ebfd078a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1262,20 +1262,10 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_rsk(req)->af_specific = &tcp_request_sock_ipv4_ops;
 #endif
 
-        ireq = inet_rsk(req);
-        ireq->loc_addr = daddr;
-        ireq->rmt_addr = saddr;
-        ireq->no_srccheck = inet_sk(sk)->transparent;
-        ireq->opt = tcp_v4_save_options(sk, skb);
-
-        dst = inet_csk_route_req(sk, req);
-        if(!dst)
-                goto drop_and_free;
-
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = TCP_MSS_DEFAULT;
         tmp_opt.user_mss  = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
         if (tmp_opt.cookie_plus > 0 &&
             tmp_opt.saw_tstamp &&
@@ -1319,8 +1309,14 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         tmp_opt.tstamp_ok = tmp_opt.saw_tstamp;
         tcp_openreq_init(req, &tmp_opt, skb);
 
+        ireq = inet_rsk(req);
+        ireq->loc_addr = daddr;
+        ireq->rmt_addr = saddr;
+        ireq->no_srccheck = inet_sk(sk)->transparent;
+        ireq->opt = tcp_v4_save_options(sk, skb);
+
         if (security_inet_conn_request(sk, skb, req))
-                goto drop_and_release;
+                goto drop_and_free;
 
         if (!want_cookie)
                 TCP_ECN_create_request(req, tcp_hdr(skb));
@@ -1345,6 +1341,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
                  */
                 if (tmp_opt.saw_tstamp &&
                     tcp_death_row.sysctl_tw_recycle &&
+                    (dst = inet_csk_route_req(sk, req)) != NULL &&
                     (peer = rt_get_peer((struct rtable *)dst)) != NULL &&
                     peer->v4daddr == saddr) {
                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index 87accec8d097..f206ee5dda80 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -95,9 +95,9 @@ tcp_timewait_state_process(struct inet_timewait_sock *tw, struct sk_buff *skb,
         struct tcp_timewait_sock *tcptw = tcp_twsk((struct sock *)tw);
         int paws_reject = 0;
 
+        tmp_opt.saw_tstamp = 0;
         if (th->doff > (sizeof(*th) >> 2) && tcptw->tw_ts_recent_stamp) {
-                tmp_opt.tstamp_ok = 1;
-                tcp_parse_options(skb, &tmp_opt, &hash_location, 1, NULL);
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent       = tcptw->tw_ts_recent;
@@ -526,9 +526,9 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
         __be32 flg = tcp_flag_word(th) & (TCP_FLAG_RST|TCP_FLAG_SYN|TCP_FLAG_ACK);
         int paws_reject = 0;
 
-        if ((th->doff > (sizeof(*th) >> 2)) && (req->ts_recent)) {
-                tmp_opt.tstamp_ok = 1;
-                tcp_parse_options(skb, &tmp_opt, &hash_location, 1, NULL);
+        tmp_opt.saw_tstamp = 0;
+        if (th->doff > (sizeof(struct tcphdr)>>2)) {
+                tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
                 if (tmp_opt.saw_tstamp) {
                         tmp_opt.ts_recent = req->ts_recent;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 93316a96d820..383ce237640f 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -553,7 +553,6 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
                                 struct tcp_md5sig_key **md5) {
         struct tcp_sock *tp = tcp_sk(sk);
         struct tcp_cookie_values *cvp = tp->cookie_values;
-        struct dst_entry *dst = __sk_dst_get(sk);
         unsigned remaining = MAX_TCP_OPTION_SPACE;
         u8 cookie_size = (!tp->rx_opt.cookie_out_never && cvp != NULL) ?
                          tcp_cookie_size_check(cvp->cookie_desired) :
@@ -581,22 +580,18 @@ static unsigned tcp_syn_options(struct sock *sk, struct sk_buff *skb,
         opts->mss = tcp_advertise_mss(sk);
         remaining -= TCPOLEN_MSS_ALIGNED;
 
-        if (likely(sysctl_tcp_timestamps &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) &&
-                   *md5 == NULL)) {
+        if (likely(sysctl_tcp_timestamps && *md5 == NULL)) {
                 opts->options |= OPTION_TS;
                 opts->tsval = TCP_SKB_CB(skb)->when;
                 opts->tsecr = tp->rx_opt.ts_recent;
                 remaining -= TCPOLEN_TSTAMP_ALIGNED;
         }
-        if (likely(sysctl_tcp_window_scaling &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE))) {
+        if (likely(sysctl_tcp_window_scaling)) {
                 opts->ws = tp->rx_opt.rcv_wscale;
                 opts->options |= OPTION_WSCALE;
                 remaining -= TCPOLEN_WSCALE_ALIGNED;
         }
-        if (likely(sysctl_tcp_sack &&
-                   !dst_feature(dst, RTAX_FEATURE_NO_SACK))) {
+        if (likely(sysctl_tcp_sack)) {
                 opts->options |= OPTION_SACK_ADVERTISE;
                 if (unlikely(!(OPTION_TS & opts->options)))
                         remaining -= TCPOLEN_SACKPERM_ALIGNED;
@@ -2527,9 +2522,7 @@ static void tcp_connect_init(struct sock *sk)
          * See tcp_input.c:tcp_rcv_state_process case TCP_SYN_SENT.
          */
         tp->tcp_header_len = sizeof(struct tcphdr) +
-                (sysctl_tcp_timestamps &&
-                (!dst_feature(dst, RTAX_FEATURE_NO_TSTAMP) ?
-                  TCPOLEN_TSTAMP_ALIGNED : 0));
+                (sysctl_tcp_timestamps ? TCPOLEN_TSTAMP_ALIGNED : 0);
 
 #ifdef CONFIG_TCP_MD5SIG
         if (tp->af_specific->md5_lookup(sk, sk) != NULL)
@@ -2555,8 +2548,7 @@ static void tcp_connect_init(struct sock *sk)
                                   tp->advmss - (tp->rx_opt.ts_recent_stamp ? tp->tcp_header_len - sizeof(struct tcphdr) : 0),
                                   &tp->rcv_wnd,
                                   &tp->window_clamp,
-                                  (sysctl_tcp_window_scaling &&
-                                   !dst_feature(dst, RTAX_FEATURE_NO_WSCALE)),
+                                  sysctl_tcp_window_scaling,
                                   &rcv_wscale);
 
         tp->rx_opt.rcv_wscale = rcv_wscale;
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 1f9534846ca9..f0126fdd7e04 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -216,9 +216,8 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                  * force rand to be an odd multiple of UDP_HTABLE_SIZE
                  */
                 rand = (rand | 1) * (udptable->mask + 1);
-                for (last = first + udptable->mask + 1;
-                     first != last;
-                     first++) {
+                last = first + udptable->mask + 1;
+                do {
                         hslot = udp_hashslot(udptable, net, first);
                         bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
@@ -238,7 +237,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
                                 snum += rand;
                         } while (snum != first);
                         spin_unlock_bh(&hslot->lock);
-                }
+                } while (++first != last);
                 goto fail;
         } else {
                 hslot = udp_hashslot(udptable, net, snum);
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 5f2ec208a8c3..0956ebabbff2 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -20,6 +20,7 @@
 #include <net/ipv6.h>
 #include <net/inet_frag.h>
 
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
@@ -187,6 +188,21 @@ out:
         return nf_conntrack_confirm(skb);
 }
 
+static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
+                                                struct sk_buff *skb)
+{
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP6_DEFRAG_CONNTRACK_BRIDGE_IN;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP6_DEFRAG_CONNTRACK_IN;
+        else
+                return IP6_DEFRAG_CONNTRACK_OUT;
+
+}
+
 static unsigned int ipv6_defrag(unsigned int hooknum,
                                 struct sk_buff *skb,
                                 const struct net_device *in,
@@ -199,8 +215,7 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
         if (skb->nfct)
                 return NF_ACCEPT;
 
-        reasm = nf_ct_frag6_gather(skb);
-
+        reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
         /* queued */
         if (reasm == NULL)
                 return NF_STOLEN;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index e0b9424fa1b2..312c20adc83f 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -168,13 +168,14 @@ out:
 /* Creation primitives. */
 
 static __inline__ struct nf_ct_frag6_queue *
-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
 {
         struct inet_frag_queue *q;
         struct ip6_create_arg arg;
         unsigned int hash;
 
         arg.id = id;
+        arg.user = user;
         arg.src = src;
         arg.dst = dst;
 
@@ -559,7 +560,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
         return 0;
 }
 
-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
+struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
 {
         struct sk_buff *clone;
         struct net_device *dev = skb->dev;
@@ -605,7 +606,7 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
         if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
                 nf_ct_frag6_evictor();
 
-        fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
+        fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr);
         if (fq == NULL) {
                 pr_debug("Can't find and can't create new queue\n");
                 goto ret_orig;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 4d98549a6868..3b3a95607125 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -72,6 +72,7 @@ struct frag_queue
         struct inet_frag_queue  q;
 
         __be32                  id;             /* fragment id          */
+        u32                     user;
         struct in6_addr         saddr;
         struct in6_addr         daddr;
 
@@ -141,7 +142,7 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
         struct ip6_create_arg *arg = a;
 
         fq = container_of(q, struct frag_queue, q);
-        return (fq->id == arg->id &&
+        return (fq->id == arg->id && fq->user == arg->user &&
                         ipv6_addr_equal(&fq->saddr, arg->src) &&
                         ipv6_addr_equal(&fq->daddr, arg->dst));
 }
@@ -163,6 +164,7 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a)
         struct ip6_create_arg *arg = a;
 
         fq->id = arg->id;
+        fq->user = arg->user;
         ipv6_addr_copy(&fq->saddr, arg->src);
         ipv6_addr_copy(&fq->daddr, arg->dst);
 }
@@ -243,6 +245,7 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
         unsigned int hash;
 
         arg.id = id;
+        arg.user = IP6_DEFRAG_LOCAL_DELIVER;
         arg.src = src;
         arg.dst = dst;
 
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 5b9af508b8f2..7208a06576c6 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -185,6 +185,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
+
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+
         ret = NULL;
         req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
         if (!req)
@@ -218,6 +225,12 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         req->expires = 0UL;
         req->retrans = 0;
         ireq->ecn_ok            = 0;
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
         treq->rcv_isn = ntohl(th->seq) - 1;
         treq->snt_isn = cookie;
 
@@ -253,21 +266,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                         goto out_free;
         }
 
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, dst);
-
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
-
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
-
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
         tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                   &req->rcv_wnd, &req->window_clamp,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ee9cf62458d4..febfd595a40d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1169,7 +1169,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         struct inet6_request_sock *treq;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
-        struct dst_entry *dst = __sk_dst_get(sk);
         __u32 isn = TCP_SKB_CB(skb)->when;
 #ifdef CONFIG_SYN_COOKIES
         int want_cookie = 0;
@@ -1208,7 +1207,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         tcp_clear_options(&tmp_opt);
         tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
         tmp_opt.user_mss = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
 
         if (tmp_opt.cookie_plus > 0 &&
             tmp_opt.saw_tstamp &&
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index b95699f00545..847ffca40184 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -1366,6 +1366,7 @@ ip_vs_in(unsigned int hooknum, struct sk_buff *skb,
                == sysctl_ip_vs_sync_threshold[0])) ||
              ((cp->protocol == IPPROTO_TCP) && (cp->old_state != cp->state) &&
               ((cp->state == IP_VS_TCP_S_FIN_WAIT) ||
+               (cp->state == IP_VS_TCP_S_CLOSE) ||
                (cp->state == IP_VS_TCP_S_CLOSE_WAIT) ||
                (cp->state == IP_VS_TCP_S_TIME_WAIT)))))
                 ip_vs_sync_conn(cp);
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index e55a6861d26f..6bde12da2fe0 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -2714,6 +2714,8 @@ static int ip_vs_genl_parse_service(struct ip_vs_service_user_kern *usvc,
         if (!(nla_af && (nla_fwmark || (nla_port && nla_protocol && nla_addr))))
                 return -EINVAL;
 
+        memset(usvc, 0, sizeof(*usvc));
+
         usvc->af = nla_get_u16(nla_af);
 #ifdef CONFIG_IP_VS_IPV6
         if (usvc->af != AF_INET && usvc->af != AF_INET6)
@@ -2901,6 +2903,8 @@ static int ip_vs_genl_parse_dest(struct ip_vs_dest_user_kern *udest,
         if (!(nla_addr && nla_port))
                 return -EINVAL;
 
+        memset(udest, 0, sizeof(*udest));
+
         nla_memcpy(&udest->addr, nla_addr, sizeof(udest->addr));
         udest->port = nla_get_u16(nla_port);
 
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 020562164b56..e0516a22be2e 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -415,7 +415,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
 {
         struct sock *sk = sock->sk;
         struct sockaddr_pkt *saddr = (struct sockaddr_pkt *)msg->msg_name;
-        struct sk_buff *skb;
+        struct sk_buff *skb = NULL;
         struct net_device *dev;
         __be16 proto = 0;
         int err;
@@ -437,6 +437,7 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
          */
 
         saddr->spkt_device[13] = 0;
+retry:
         rcu_read_lock();
         dev = dev_get_by_name_rcu(sock_net(sk), saddr->spkt_device);
         err = -ENODEV;
@@ -456,58 +457,48 @@ static int packet_sendmsg_spkt(struct kiocb *iocb, struct socket *sock,
         if (len > dev->mtu + dev->hard_header_len)
                 goto out_unlock;
 
-        err = -ENOBUFS;
-        skb = sock_wmalloc(sk, len + LL_RESERVED_SPACE(dev), 0, GFP_KERNEL);
-
-        /*
-         * If the write buffer is full, then tough. At this level the user
-         * gets to deal with the problem - do your own algorithmic backoffs.
-         * That's far more flexible.
-         */
-
-        if (skb == NULL)
-                goto out_unlock;
-
-        /*
-         *      Fill it in
-         */
-
-        /* FIXME: Save some space for broken drivers that write a
-         * hard header at transmission time by themselves. PPP is the
-         * notable one here. This should really be fixed at the driver level.
-         */
-        skb_reserve(skb, LL_RESERVED_SPACE(dev));
-        skb_reset_network_header(skb);
-
-        /* Try to align data part correctly */
-        if (dev->header_ops) {
-                skb->data -= dev->hard_header_len;
-                skb->tail -= dev->hard_header_len;
-                if (len < dev->hard_header_len)
-                        skb_reset_network_header(skb);
+        if (!skb) {
+                size_t reserved = LL_RESERVED_SPACE(dev);
+                unsigned int hhlen = dev->header_ops ? dev->hard_header_len : 0;
+
+                rcu_read_unlock();
+                skb = sock_wmalloc(sk, len + reserved, 0, GFP_KERNEL);
+                if (skb == NULL)
+                        return -ENOBUFS;
+                /* FIXME: Save some space for broken drivers that write a hard
+                 * header at transmission time by themselves. PPP is the notable
+                 * one here. This should really be fixed at the driver level.
+                 */
+                skb_reserve(skb, reserved);
+                skb_reset_network_header(skb);
+
+                /* Try to align data part correctly */
+                if (hhlen) {
+                        skb->data -= hhlen;
+                        skb->tail -= hhlen;
+                        if (len < hhlen)
+                                skb_reset_network_header(skb);
+                }
+                err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+                if (err)
+                        goto out_free;
+                goto retry;
         }
 
-        /* Returns -EFAULT on error */
-        err = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
+
         skb->protocol = proto;
         skb->dev = dev;
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
-        if (err)
-                goto out_free;
-
-        /*
-         *      Now send it
-         */
 
         dev_queue_xmit(skb);
         rcu_read_unlock();
         return len;
 
-out_free:
-        kfree_skb(skb);
 out_unlock:
         rcu_read_unlock();
+out_free:
+        kfree_skb(skb);
         return err;
 }