9 files changed, 27 insertions, 19 deletions

diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 0ff42f029ace..1929af87b260 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -352,7 +352,7 @@ u16 __netdev_pick_tx(struct net_device *dev, struct sk_buff *skb)
 
                 if (queue_index != new_index && sk &&
                     rcu_access_pointer(sk->sk_dst_cache))
-                        sk_tx_queue_set(sk, queue_index);
+                        sk_tx_queue_set(sk, new_index);
 
                 queue_index = new_index;
         }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 136fe55c1a47..7c96100b021e 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -915,6 +915,9 @@ static int __init inet6_init(void)
         err = ip6_route_init();
         if (err)
                 goto ip6_route_fail;
+        err = ndisc_late_init();
+        if (err)
+                goto ndisc_late_fail;
         err = ip6_flowlabel_init();
         if (err)
                 goto ip6_flowlabel_fail;
@@ -981,6 +984,8 @@ ipv6_exthdrs_fail:
 addrconf_fail:
         ip6_flowlabel_cleanup();
 ip6_flowlabel_fail:
+        ndisc_late_cleanup();
+ndisc_late_fail:
         ip6_route_cleanup();
 ip6_route_fail:
 #ifdef CONFIG_PROC_FS
@@ -1043,6 +1048,7 @@ static void __exit inet6_exit(void)
         ipv6_exthdrs_exit();
         addrconf_cleanup();
         ip6_flowlabel_cleanup();
+        ndisc_late_cleanup();
         ip6_route_cleanup();
 #ifdef CONFIG_PROC_FS
 
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 07a7d65a7cb6..8d67900aa003 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -162,12 +162,6 @@ static bool ip6_parse_tlv(const struct tlvtype_proc *procs, struct sk_buff *skb)
                 off += optlen;
                 len -= optlen;
         }
-        /* This case will not be caught by above check since its padding
-         * length is smaller than 7:
-         * 1 byte NH + 1 byte Length + 6 bytes Padding
-         */
-        if ((padlen == 6) && ((off - skb_network_header_len(skb)) == 8))
-                goto bad;
 
         if (len == 0)
                 return true;
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index a6c58ce43d34..e27591635f92 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -138,8 +138,8 @@ static bool fib6_rule_suppress(struct fib_rule *rule, struct fib_lookup_arg *arg
         return false;
 
 suppress_route:
-                ip6_rt_put(rt);
-                return true;
+        ip6_rt_put(rt);
+        return true;
 }
 
 static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 73db48eba1c4..5bec666aba61 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -825,9 +825,9 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info)
         fn = fib6_add_1(root, &rt->rt6i_dst.addr, rt->rt6i_dst.plen,
                         offsetof(struct rt6_info, rt6i_dst), allow_create,
                         replace_required);
-
         if (IS_ERR(fn)) {
                 err = PTR_ERR(fn);
+                fn = NULL;
                 goto out;
         }
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 12179457b2cd..f8a55ff1971b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1727,24 +1727,28 @@ int __init ndisc_init(void)
         if (err)
                 goto out_unregister_pernet;
 #endif
-        err = register_netdevice_notifier(&ndisc_netdev_notifier);
-        if (err)
-                goto out_unregister_sysctl;
 out:
         return err;
 
-out_unregister_sysctl:
 #ifdef CONFIG_SYSCTL
-        neigh_sysctl_unregister(&nd_tbl.parms);
 out_unregister_pernet:
-#endif
         unregister_pernet_subsys(&ndisc_net_ops);
         goto out;
+#endif
 }
 
-void ndisc_cleanup(void)
+int __init ndisc_late_init(void)
+{
+        return register_netdevice_notifier(&ndisc_netdev_notifier);
+}
+
+void ndisc_late_cleanup(void)
 {
         unregister_netdevice_notifier(&ndisc_netdev_notifier);
+}
+
+void ndisc_cleanup(void)
+{
 #ifdef CONFIG_SYSCTL
         neigh_sysctl_unregister(&nd_tbl.parms);
 #endif
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index fb36f8565161..410db90db73d 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -1178,6 +1178,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
                 if (type > OVS_KEY_ATTR_MAX) {
                         OVS_NLERR("Unknown key attribute (type=%d, max=%d).\n",
                                   type, OVS_KEY_ATTR_MAX);
+                        return -EINVAL;
                 }
 
                 if (attrs & (1 << type)) {
diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
index c2178b15ca6e..863846cc5513 100644
--- a/net/sched/sch_htb.c
+++ b/net/sched/sch_htb.c
@@ -1495,7 +1495,7 @@ static int htb_change_class(struct Qdisc *sch, u32 classid,
         psched_ratecfg_precompute(&cl->ceil, &hopt->ceil);
 
         cl->buffer = PSCHED_TICKS2NS(hopt->buffer);
-        cl->cbuffer = PSCHED_TICKS2NS(hopt->buffer);
+        cl->cbuffer = PSCHED_TICKS2NS(hopt->cbuffer);
 
         sch_tree_unlock(sch);
 
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index d5d5882a2891..911b71b26b0e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -806,6 +806,9 @@ static int sctp_send_asconf_del_ip(struct sock		*sk,
                         goto skip_mkasconf;
                 }
 
+                if (laddr == NULL)
+                        return -EINVAL;
+
                 /* We do not need RCU protection throughout this loop
                  * because this is done under a socket lock from the
                  * setsockopt call.
@@ -6176,7 +6179,7 @@ unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
         /* Is there any exceptional events?  */
         if (sk->sk_err || !skb_queue_empty(&sk->sk_error_queue))
                 mask |= POLLERR |
-                        sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0;
+                        (sock_flag(sk, SOCK_SELECT_ERR_QUEUE) ? POLLPRI : 0);
         if (sk->sk_shutdown & RCV_SHUTDOWN)
                 mask |= POLLRDHUP | POLLIN | POLLRDNORM;
         if (sk->sk_shutdown == SHUTDOWN_MASK)