9 files changed, 46 insertions, 30 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 4c20f5546893..a2ede167e045 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -440,6 +440,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
         iph = skb->nh.iph;
 
         if (unlikely((iph->frag_off & htons(IP_DF)) && !skb->local_df)) {
+                IP_INC_STATS(IPSTATS_MIB_FRAGFAILS);
                 icmp_send(skb, ICMP_DEST_UNREACH, ICMP_FRAG_NEEDED,
                           htonl(dst_mtu(&rt->u.dst)));
                 kfree_skb(skb);
diff --git a/net/ipv4/tcp_cong.c b/net/ipv4/tcp_cong.c
index 5765f9d03174..7ff2e4273a7c 100644
--- a/net/ipv4/tcp_cong.c
+++ b/net/ipv4/tcp_cong.c
@@ -189,7 +189,7 @@ void tcp_slow_start(struct tcp_sock *tp)
                         return;
 
                 /* We MAY increase by 2 if discovered delayed ack */
-                if (sysctl_tcp_abc > 1 && tp->bytes_acked > 2*tp->mss_cache) {
+                if (sysctl_tcp_abc > 1 && tp->bytes_acked >= 2*tp->mss_cache) {
                         if (tp->snd_cwnd < tp->snd_cwnd_clamp)
                                 tp->snd_cwnd++;
                 }
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 104af5d5bcbc..111ff39a08c5 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -2505,8 +2505,13 @@ static int tcp_ack(struct sock *sk, struct sk_buff *skb, int flag)
         if (before(ack, prior_snd_una))
                 goto old_ack;
 
-        if (sysctl_tcp_abc && icsk->icsk_ca_state < TCP_CA_CWR)
-                tp->bytes_acked += ack - prior_snd_una;
+        if (sysctl_tcp_abc) {
+                if (icsk->icsk_ca_state < TCP_CA_CWR)
+                        tp->bytes_acked += ack - prior_snd_una;
+                else if (icsk->icsk_ca_state == TCP_CA_Loss)
+                        /* we assume just one segment left network */
+                        tp->bytes_acked += min(ack - prior_snd_una, tp->mss_cache);
+        }
 
         if (!(flag&FLAG_SLOWPATH) && after(ack, prior_snd_una)) {
                 /* Window is constant, pure forward advance.
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 0c5042e7380d..c7852b38e03e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -578,6 +578,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         ifa->flags = flags | IFA_F_TENTATIVE;
         ifa->cstamp = ifa->tstamp = jiffies;
 
+        ifa->rt = rt;
+
         ifa->idev = idev;
         in6_dev_hold(idev);
         /* For caller */
@@ -603,8 +605,6 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         }
 #endif
 
-        ifa->rt = rt;
-
         in6_ifa_hold(ifa);
         write_unlock(&idev->lock);
 out2:
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 9d0ee7f0eeb5..86dac106873b 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -635,14 +635,17 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
         struct ipv6_txoptions *opt2;
         int err;
 
-        if (newtype != IPV6_HOPOPTS && opt->hopopt)
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
-        if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
-        if (newtype != IPV6_RTHDR && opt->srcrt)
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
-        if (newtype != IPV6_DSTOPTS && opt->dst1opt)
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+        if (opt) {
+                if (newtype != IPV6_HOPOPTS && opt->hopopt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
+                if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
+                if (newtype != IPV6_RTHDR && opt->srcrt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
+                if (newtype != IPV6_DSTOPTS && opt->dst1opt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+        }
+
         if (newopt && newoptlen)
                 tot_len += CMSG_ALIGN(newoptlen);
 
@@ -659,25 +662,25 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
         opt2->tot_len = tot_len;
         p = (char *)(opt2 + 1);
 
-        err = ipv6_renew_option(opt->hopopt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
                                 newtype != IPV6_HOPOPTS,
                                 &opt2->hopopt, &p);
         if (err)
                 goto out;
 
-        err = ipv6_renew_option(opt->dst0opt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
                                 newtype != IPV6_RTHDRDSTOPTS,
                                 &opt2->dst0opt, &p);
         if (err)
                 goto out;
 
-        err = ipv6_renew_option(opt->srcrt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
                                 newtype != IPV6_RTHDR,
-                                (struct ipv6_opt_hdr **)opt2->srcrt, &p);
+                                (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
         if (err)
                 goto out;
 
-        err = ipv6_renew_option(opt->dst1opt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
                                 newtype != IPV6_DSTOPTS,
                                 &opt2->dst1opt, &p);
         if (err)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4b163711f3a8..d9baca062d24 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1532,6 +1532,10 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
 
 static int ip6_pkt_discard(struct sk_buff *skb)
 {
+        int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
+        if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
+                IP6_INC_STATS(IPSTATS_MIB_INADDRERRORS);
+
         IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
         icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
         kfree_skb(skb);
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index b85c1f9f1288..8b85036ba8e3 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1273,8 +1273,7 @@ netlink_kernel_create(int unit, unsigned int groups,
         struct netlink_sock *nlk;
         unsigned long *listeners = NULL;
 
-        if (!nl_table)
-                return NULL;
+        BUG_ON(!nl_table);
 
         if (unit<0 || unit>=MAX_LINKS)
                 return NULL;
@@ -1745,11 +1744,8 @@ static int __init netlink_proto_init(void)
                 netlink_skb_parms_too_large();
 
         nl_table = kcalloc(MAX_LINKS, sizeof(*nl_table), GFP_KERNEL);
-        if (!nl_table) {
-enomem:
-                printk(KERN_CRIT "netlink_init: Cannot allocate nl_table\n");
-                return -ENOMEM;
-        }
+        if (!nl_table)
+                goto panic;
 
         if (num_physpages >= (128 * 1024))
                 max = num_physpages >> (21 - PAGE_SHIFT);
@@ -1769,7 +1765,7 @@ enomem:
                                 nl_pid_hash_free(nl_table[i].hash.table,
                                                  1 * sizeof(*hash->table));
                         kfree(nl_table);
-                        goto enomem;
+                        goto panic;
                 }
                 memset(hash->table, 0, 1 * sizeof(*hash->table));
                 hash->max_shift = order;
@@ -1786,6 +1782,8 @@ enomem:
         rtnetlink_init();
 out:
         return err;
+panic:
+        panic("netlink_init: Cannot allocate nl_table\n");
 }
 
 core_initcall(netlink_proto_init);
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index fde3f55bfd4b..dab15949958e 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1289,9 +1289,13 @@ SCTP_STATIC void sctp_close(struct sock *sk, long timeout)
                         }
                 }
 
-                if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime)
-                        sctp_primitive_ABORT(asoc, NULL);
-                else
+                if (sock_flag(sk, SOCK_LINGER) && !sk->sk_lingertime) {
+                        struct sctp_chunk *chunk;
+
+                        chunk = sctp_make_abort_user(asoc, NULL, 0);
+                        if (chunk)
+                                sctp_primitive_ABORT(asoc, chunk);
+                } else
                         sctp_primitive_SHUTDOWN(asoc, NULL);
         }
 
diff --git a/net/socket.c b/net/socket.c
index b4848ce0d6ac..6d261bf206fc 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1178,7 +1178,8 @@ static int __sock_create(int family, int type, int protocol, struct socket **res
  */
 
         if (!(sock = sock_alloc())) {
-                printk(KERN_WARNING "socket: no more sockets\n");
+                if (net_ratelimit())
+                        printk(KERN_WARNING "socket: no more sockets\n");
                 err = -ENFILE;          /* Not exactly a match, but its the
                                            closest posix thing */
                 goto out;