Gentoo Archives: gentoo-commits

From: Mike Pagano <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] proj/linux-patches:3.14 commit in: /
Date: Fri, 27 Feb 2015 14:34:48
Message-Id: 1425047672.139855393b70361c6cb1f083f88f25429cbb2b29.mpagano@gentoo
1 commit: 139855393b70361c6cb1f083f88f25429cbb2b29
2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org>
3 AuthorDate: Fri Feb 27 14:34:32 2015 +0000
4 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org>
5 CommitDate: Fri Feb 27 14:34:32 2015 +0000
6 URL: http://sources.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=13985539
7
8 Linux patch 3.14.34
9
10 ---
11 0000_README | 4 +
12 1033_linux-3.14.34.patch | 584 +++++++++++++++++++++++++++++++++++++++++++++++
13 2 files changed, 588 insertions(+)
14
15 diff --git a/0000_README b/0000_README
16 index 8edb1bc..d3da345 100644
17 --- a/0000_README
18 +++ b/0000_README
19 @@ -174,6 +174,10 @@ Patch: 1032_linux-3.14.33.patch
20 From: http://www.kernel.org
21 Desc: Linux 3.14.33
22
23 +Patch: 1033_linux-3.14.34.patch
24 +From: http://www.kernel.org
25 +Desc: Linux 3.14.34
26 +
27 Patch: 1500_XATTR_USER_PREFIX.patch
28 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
29 Desc: Support for namespace user.pax.* on tmpfs.
30
31 diff --git a/1033_linux-3.14.34.patch b/1033_linux-3.14.34.patch
32 new file mode 100644
33 index 0000000..6db62b2
34 --- /dev/null
35 +++ b/1033_linux-3.14.34.patch
36 @@ -0,0 +1,584 @@
37 +diff --git a/Makefile b/Makefile
38 +index b0963ca2895d..54434817f2a4 100644
39 +--- a/Makefile
40 ++++ b/Makefile
41 +@@ -1,6 +1,6 @@
42 + VERSION = 3
43 + PATCHLEVEL = 14
44 +-SUBLEVEL = 33
45 ++SUBLEVEL = 34
46 + EXTRAVERSION =
47 + NAME = Remembering Coco
48 +
49 +diff --git a/drivers/media/rc/ir-lirc-codec.c b/drivers/media/rc/ir-lirc-codec.c
50 +index ed2c8a1ed8ca..98893a8332c7 100644
51 +--- a/drivers/media/rc/ir-lirc-codec.c
52 ++++ b/drivers/media/rc/ir-lirc-codec.c
53 +@@ -42,11 +42,17 @@ static int ir_lirc_decode(struct rc_dev *dev, struct ir_raw_event ev)
54 + return -EINVAL;
55 +
56 + /* Packet start */
57 +- if (ev.reset)
58 +- return 0;
59 ++ if (ev.reset) {
60 ++ /* Userspace expects a long space event before the start of
61 ++ * the signal to use as a sync. This may be done with repeat
62 ++ * packets and normal samples. But if a reset has been sent
63 ++ * then we assume that a long time has passed, so we send a
64 ++ * space with the maximum time value. */
65 ++ sample = LIRC_SPACE(LIRC_VALUE_MASK);
66 ++ IR_dprintk(2, "delivering reset sync space to lirc_dev\n");
67 +
68 + /* Carrier reports */
69 +- if (ev.carrier_report) {
70 ++ } else if (ev.carrier_report) {
71 + sample = LIRC_FREQUENCY(ev.carrier);
72 + IR_dprintk(2, "carrier report (freq: %d)\n", sample);
73 +
74 +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
75 +index afa4a1f63270..a830d42e3d9b 100644
76 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
77 ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
78 +@@ -3131,7 +3131,7 @@ static int bnx2x_poll(struct napi_struct *napi, int budget)
79 + }
80 + #endif
81 + if (!bnx2x_fp_lock_napi(fp))
82 +- return work_done;
83 ++ return budget;
84 +
85 + for_each_cos_in_tx_queue(fp, cos)
86 + if (bnx2x_tx_queue_has_work(fp->txdata_ptr[cos]))
87 +diff --git a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
88 +index 70849dea32b1..5fa076fd439e 100644
89 +--- a/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
90 ++++ b/drivers/net/ethernet/qlogic/netxen/netxen_nic_main.c
91 +@@ -2390,7 +2390,10 @@ static int netxen_nic_poll(struct napi_struct *napi, int budget)
92 +
93 + work_done = netxen_process_rcv_ring(sds_ring, budget);
94 +
95 +- if ((work_done < budget) && tx_complete) {
96 ++ if (!tx_complete)
97 ++ work_done = budget;
98 ++
99 ++ if (work_done < budget) {
100 + napi_complete(&sds_ring->napi);
101 + if (test_bit(__NX_DEV_UP, &adapter->state))
102 + netxen_nic_enable_int(sds_ring);
103 +diff --git a/drivers/net/ppp/ppp_deflate.c b/drivers/net/ppp/ppp_deflate.c
104 +index 602c625d95d5..b5edc7f96a39 100644
105 +--- a/drivers/net/ppp/ppp_deflate.c
106 ++++ b/drivers/net/ppp/ppp_deflate.c
107 +@@ -246,7 +246,7 @@ static int z_compress(void *arg, unsigned char *rptr, unsigned char *obuf,
108 + /*
109 + * See if we managed to reduce the size of the packet.
110 + */
111 +- if (olen < isize) {
112 ++ if (olen < isize && olen <= osize) {
113 + state->stats.comp_bytes += olen;
114 + state->stats.comp_packets++;
115 + } else {
116 +diff --git a/include/net/ip.h b/include/net/ip.h
117 +index 937f19681426..3446cdd29608 100644
118 +--- a/include/net/ip.h
119 ++++ b/include/net/ip.h
120 +@@ -38,11 +38,12 @@ struct inet_skb_parm {
121 + struct ip_options opt; /* Compiled IP options */
122 + unsigned char flags;
123 +
124 +-#define IPSKB_FORWARDED 1
125 +-#define IPSKB_XFRM_TUNNEL_SIZE 2
126 +-#define IPSKB_XFRM_TRANSFORMED 4
127 +-#define IPSKB_FRAG_COMPLETE 8
128 +-#define IPSKB_REROUTED 16
129 ++#define IPSKB_FORWARDED BIT(0)
130 ++#define IPSKB_XFRM_TUNNEL_SIZE BIT(1)
131 ++#define IPSKB_XFRM_TRANSFORMED BIT(2)
132 ++#define IPSKB_FRAG_COMPLETE BIT(3)
133 ++#define IPSKB_REROUTED BIT(4)
134 ++#define IPSKB_DOREDIRECT BIT(5)
135 +
136 + u16 frag_max_size;
137 + };
138 +@@ -174,7 +175,7 @@ static inline __u8 ip_reply_arg_flowi_flags(const struct ip_reply_arg *arg)
139 + return (arg->flags & IP_REPLY_ARG_NOSRCCHECK) ? FLOWI_FLAG_ANYSRC : 0;
140 + }
141 +
142 +-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
143 ++void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
144 + __be32 saddr, const struct ip_reply_arg *arg,
145 + unsigned int len);
146 +
147 +diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
148 +index 80f500a29498..57c2da922952 100644
149 +--- a/include/net/netns/ipv4.h
150 ++++ b/include/net/netns/ipv4.h
151 +@@ -47,6 +47,7 @@ struct netns_ipv4 {
152 + struct inet_peer_base *peers;
153 + struct tcpm_hash_bucket *tcp_metrics_hash;
154 + unsigned int tcp_metrics_hash_log;
155 ++ struct sock * __percpu *tcp_sk;
156 + struct netns_frags frags;
157 + #ifdef CONFIG_NETFILTER
158 + struct xt_table *iptable_filter;
159 +diff --git a/net/core/dev.c b/net/core/dev.c
160 +index 86bb9cc81f02..4ed77d7245c0 100644
161 +--- a/net/core/dev.c
162 ++++ b/net/core/dev.c
163 +@@ -6812,10 +6812,20 @@ static int dev_cpu_callback(struct notifier_block *nfb,
164 + oldsd->output_queue = NULL;
165 + oldsd->output_queue_tailp = &oldsd->output_queue;
166 + }
167 +- /* Append NAPI poll list from offline CPU. */
168 +- if (!list_empty(&oldsd->poll_list)) {
169 +- list_splice_init(&oldsd->poll_list, &sd->poll_list);
170 +- raise_softirq_irqoff(NET_RX_SOFTIRQ);
171 ++ /* Append NAPI poll list from offline CPU, with one exception :
172 ++ * process_backlog() must be called by cpu owning percpu backlog.
173 ++ * We properly handle process_queue & input_pkt_queue later.
174 ++ */
175 ++ while (!list_empty(&oldsd->poll_list)) {
176 ++ struct napi_struct *napi = list_first_entry(&oldsd->poll_list,
177 ++ struct napi_struct,
178 ++ poll_list);
179 ++
180 ++ list_del_init(&napi->poll_list);
181 ++ if (napi->poll == process_backlog)
182 ++ napi->state = 0;
183 ++ else
184 ++ ____napi_schedule(sd, napi);
185 + }
186 +
187 + raise_softirq_irqoff(NET_TX_SOFTIRQ);
188 +@@ -6826,7 +6836,7 @@ static int dev_cpu_callback(struct notifier_block *nfb,
189 + netif_rx_internal(skb);
190 + input_queue_head_incr(oldsd);
191 + }
192 +- while ((skb = __skb_dequeue(&oldsd->input_pkt_queue))) {
193 ++ while ((skb = skb_dequeue(&oldsd->input_pkt_queue))) {
194 + netif_rx_internal(skb);
195 + input_queue_head_incr(oldsd);
196 + }
197 +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
198 +index 46175866851e..a6613ff972c1 100644
199 +--- a/net/core/rtnetlink.c
200 ++++ b/net/core/rtnetlink.c
201 +@@ -2649,12 +2649,16 @@ static int rtnl_bridge_notify(struct net_device *dev, u16 flags)
202 + goto errout;
203 + }
204 +
205 ++ if (!skb->len)
206 ++ goto errout;
207 ++
208 + rtnl_notify(skb, net, 0, RTNLGRP_LINK, NULL, GFP_ATOMIC);
209 + return 0;
210 + errout:
211 + WARN_ON(err == -EMSGSIZE);
212 + kfree_skb(skb);
213 +- rtnl_set_sk_err(net, RTNLGRP_LINK, err);
214 ++ if (err)
215 ++ rtnl_set_sk_err(net, RTNLGRP_LINK, err);
216 + return err;
217 + }
218 +
219 +diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
220 +index 1c6bd4359cbd..ecb34b5ea42f 100644
221 +--- a/net/ipv4/ip_forward.c
222 ++++ b/net/ipv4/ip_forward.c
223 +@@ -178,7 +178,8 @@ int ip_forward(struct sk_buff *skb)
224 + * We now generate an ICMP HOST REDIRECT giving the route
225 + * we calculated.
226 + */
227 +- if (rt->rt_flags&RTCF_DOREDIRECT && !opt->srr && !skb_sec_path(skb))
228 ++ if (IPCB(skb)->flags & IPSKB_DOREDIRECT && !opt->srr &&
229 ++ !skb_sec_path(skb))
230 + ip_rt_send_redirect(skb);
231 +
232 + skb->priority = rt_tos2priority(iph->tos);
233 +diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
234 +index 844323b6cfb9..dd637fc4b553 100644
235 +--- a/net/ipv4/ip_output.c
236 ++++ b/net/ipv4/ip_output.c
237 +@@ -1460,23 +1460,8 @@ static int ip_reply_glue_bits(void *dptr, char *to, int offset,
238 + /*
239 + * Generic function to send a packet as reply to another packet.
240 + * Used to send some TCP resets/acks so far.
241 +- *
242 +- * Use a fake percpu inet socket to avoid false sharing and contention.
243 + */
244 +-static DEFINE_PER_CPU(struct inet_sock, unicast_sock) = {
245 +- .sk = {
246 +- .__sk_common = {
247 +- .skc_refcnt = ATOMIC_INIT(1),
248 +- },
249 +- .sk_wmem_alloc = ATOMIC_INIT(1),
250 +- .sk_allocation = GFP_ATOMIC,
251 +- .sk_flags = (1UL << SOCK_USE_WRITE_QUEUE),
252 +- },
253 +- .pmtudisc = IP_PMTUDISC_WANT,
254 +- .uc_ttl = -1,
255 +-};
256 +-
257 +-void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
258 ++void ip_send_unicast_reply(struct sock *sk, struct sk_buff *skb, __be32 daddr,
259 + __be32 saddr, const struct ip_reply_arg *arg,
260 + unsigned int len)
261 + {
262 +@@ -1484,9 +1469,8 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
263 + struct ipcm_cookie ipc;
264 + struct flowi4 fl4;
265 + struct rtable *rt = skb_rtable(skb);
266 ++ struct net *net = sock_net(sk);
267 + struct sk_buff *nskb;
268 +- struct sock *sk;
269 +- struct inet_sock *inet;
270 + int err;
271 +
272 + if (ip_options_echo(&replyopts.opt.opt, skb))
273 +@@ -1516,15 +1500,11 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
274 + if (IS_ERR(rt))
275 + return;
276 +
277 +- inet = &get_cpu_var(unicast_sock);
278 ++ inet_sk(sk)->tos = arg->tos;
279 +
280 +- inet->tos = arg->tos;
281 +- sk = &inet->sk;
282 + sk->sk_priority = skb->priority;
283 + sk->sk_protocol = ip_hdr(skb)->protocol;
284 + sk->sk_bound_dev_if = arg->bound_dev_if;
285 +- sock_net_set(sk, net);
286 +- __skb_queue_head_init(&sk->sk_write_queue);
287 + sk->sk_sndbuf = sysctl_wmem_default;
288 + err = ip_append_data(sk, &fl4, ip_reply_glue_bits, arg->iov->iov_base,
289 + len, 0, &ipc, &rt, MSG_DONTWAIT);
290 +@@ -1540,13 +1520,10 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr,
291 + arg->csumoffset) = csum_fold(csum_add(nskb->csum,
292 + arg->csum));
293 + nskb->ip_summed = CHECKSUM_NONE;
294 +- skb_orphan(nskb);
295 + skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb));
296 + ip_push_pending_frames(sk, &fl4);
297 + }
298 + out:
299 +- put_cpu_var(unicast_sock);
300 +-
301 + ip_rt_put(rt);
302 + }
303 +
304 +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
305 +index 580dd96666e0..135045e0e125 100644
306 +--- a/net/ipv4/ip_sockglue.c
307 ++++ b/net/ipv4/ip_sockglue.c
308 +@@ -426,15 +426,11 @@ int ip_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
309 +
310 + memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
311 + sin = &errhdr.offender;
312 +- sin->sin_family = AF_UNSPEC;
313 ++ memset(sin, 0, sizeof(*sin));
314 + if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP) {
315 +- struct inet_sock *inet = inet_sk(sk);
316 +-
317 + sin->sin_family = AF_INET;
318 + sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
319 +- sin->sin_port = 0;
320 +- memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
321 +- if (inet->cmsg_flags)
322 ++ if (inet_sk(sk)->cmsg_flags)
323 + ip_cmsg_recv(msg, skb);
324 + }
325 +
326 +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
327 +index 0d33f947a87f..04ce671430cb 100644
328 +--- a/net/ipv4/ping.c
329 ++++ b/net/ipv4/ping.c
330 +@@ -973,8 +973,11 @@ void ping_rcv(struct sk_buff *skb)
331 +
332 + sk = ping_lookup(net, skb, ntohs(icmph->un.echo.id));
333 + if (sk != NULL) {
334 ++ struct sk_buff *skb2 = skb_clone(skb, GFP_ATOMIC);
335 ++
336 + pr_debug("rcv on socket %p\n", sk);
337 +- ping_queue_rcv_skb(sk, skb_get(skb));
338 ++ if (skb2)
339 ++ ping_queue_rcv_skb(sk, skb2);
340 + sock_put(sk);
341 + return;
342 + }
343 +diff --git a/net/ipv4/route.c b/net/ipv4/route.c
344 +index 487bb6252520..b64330f25fbe 100644
345 +--- a/net/ipv4/route.c
346 ++++ b/net/ipv4/route.c
347 +@@ -1554,11 +1554,10 @@ static int __mkroute_input(struct sk_buff *skb,
348 +
349 + do_cache = res->fi && !itag;
350 + if (out_dev == in_dev && err && IN_DEV_TX_REDIRECTS(out_dev) &&
351 ++ skb->protocol == htons(ETH_P_IP) &&
352 + (IN_DEV_SHARED_MEDIA(out_dev) ||
353 +- inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res)))) {
354 +- flags |= RTCF_DOREDIRECT;
355 +- do_cache = false;
356 +- }
357 ++ inet_addr_onlink(out_dev, saddr, FIB_RES_GW(*res))))
358 ++ IPCB(skb)->flags |= IPSKB_DOREDIRECT;
359 +
360 + if (skb->protocol != htons(ETH_P_IP)) {
361 + /* Not IP (i.e. ARP). Do not create route, if it is
362 +@@ -2305,6 +2304,8 @@ static int rt_fill_info(struct net *net, __be32 dst, __be32 src,
363 + r->rtm_flags = (rt->rt_flags & ~0xFFFF) | RTM_F_CLONED;
364 + if (rt->rt_flags & RTCF_NOTIFY)
365 + r->rtm_flags |= RTM_F_NOTIFY;
366 ++ if (IPCB(skb)->flags & IPSKB_DOREDIRECT)
367 ++ r->rtm_flags |= RTCF_DOREDIRECT;
368 +
369 + if (nla_put_be32(skb, RTA_DST, dst))
370 + goto nla_put_failure;
371 +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
372 +index a782d5be132e..b7effad5a58c 100644
373 +--- a/net/ipv4/tcp_ipv4.c
374 ++++ b/net/ipv4/tcp_ipv4.c
375 +@@ -691,7 +691,8 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb)
376 +
377 + net = dev_net(skb_dst(skb)->dev);
378 + arg.tos = ip_hdr(skb)->tos;
379 +- ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr,
380 ++ ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
381 ++ skb, ip_hdr(skb)->saddr,
382 + ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len);
383 +
384 + TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
385 +@@ -774,7 +775,8 @@ static void tcp_v4_send_ack(struct sk_buff *skb, u32 seq, u32 ack,
386 + if (oif)
387 + arg.bound_dev_if = oif;
388 + arg.tos = tos;
389 +- ip_send_unicast_reply(net, skb, ip_hdr(skb)->saddr,
390 ++ ip_send_unicast_reply(*this_cpu_ptr(net->ipv4.tcp_sk),
391 ++ skb, ip_hdr(skb)->saddr,
392 + ip_hdr(skb)->daddr, &arg, arg.iov[0].iov_len);
393 +
394 + TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
395 +@@ -2769,14 +2771,39 @@ struct proto tcp_prot = {
396 + };
397 + EXPORT_SYMBOL(tcp_prot);
398 +
399 ++static void __net_exit tcp_sk_exit(struct net *net)
400 ++{
401 ++ int cpu;
402 ++
403 ++ for_each_possible_cpu(cpu)
404 ++ inet_ctl_sock_destroy(*per_cpu_ptr(net->ipv4.tcp_sk, cpu));
405 ++ free_percpu(net->ipv4.tcp_sk);
406 ++}
407 ++
408 + static int __net_init tcp_sk_init(struct net *net)
409 + {
410 ++ int res, cpu;
411 ++
412 ++ net->ipv4.tcp_sk = alloc_percpu(struct sock *);
413 ++ if (!net->ipv4.tcp_sk)
414 ++ return -ENOMEM;
415 ++
416 ++ for_each_possible_cpu(cpu) {
417 ++ struct sock *sk;
418 ++
419 ++ res = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW,
420 ++ IPPROTO_TCP, net);
421 ++ if (res)
422 ++ goto fail;
423 ++ *per_cpu_ptr(net->ipv4.tcp_sk, cpu) = sk;
424 ++ }
425 + net->ipv4.sysctl_tcp_ecn = 2;
426 + return 0;
427 +-}
428 +
429 +-static void __net_exit tcp_sk_exit(struct net *net)
430 +-{
431 ++fail:
432 ++ tcp_sk_exit(net);
433 ++
434 ++ return res;
435 + }
436 +
437 + static void __net_exit tcp_sk_exit_batch(struct list_head *net_exit_list)
438 +diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
439 +index 7927db0a9279..4a000f1dd757 100644
440 +--- a/net/ipv4/udp_diag.c
441 ++++ b/net/ipv4/udp_diag.c
442 +@@ -99,11 +99,13 @@ static void udp_dump(struct udp_table *table, struct sk_buff *skb, struct netlin
443 + s_slot = cb->args[0];
444 + num = s_num = cb->args[1];
445 +
446 +- for (slot = s_slot; slot <= table->mask; num = s_num = 0, slot++) {
447 ++ for (slot = s_slot; slot <= table->mask; s_num = 0, slot++) {
448 + struct sock *sk;
449 + struct hlist_nulls_node *node;
450 + struct udp_hslot *hslot = &table->hash[slot];
451 +
452 ++ num = 0;
453 ++
454 + if (hlist_nulls_empty(&hslot->head))
455 + continue;
456 +
457 +diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
458 +index c3bf2d2e519e..841cfa2c4600 100644
459 +--- a/net/ipv6/datagram.c
460 ++++ b/net/ipv6/datagram.c
461 +@@ -382,11 +382,10 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
462 +
463 + memcpy(&errhdr.ee, &serr->ee, sizeof(struct sock_extended_err));
464 + sin = &errhdr.offender;
465 +- sin->sin6_family = AF_UNSPEC;
466 ++ memset(sin, 0, sizeof(*sin));
467 ++
468 + if (serr->ee.ee_origin != SO_EE_ORIGIN_LOCAL) {
469 + sin->sin6_family = AF_INET6;
470 +- sin->sin6_flowinfo = 0;
471 +- sin->sin6_port = 0;
472 + if (np->rxopt.all)
473 + ip6_datagram_recv_common_ctl(sk, msg, skb);
474 + if (skb->protocol == htons(ETH_P_IPV6)) {
475 +@@ -397,12 +396,9 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
476 + ipv6_iface_scope_id(&sin->sin6_addr,
477 + IP6CB(skb)->iif);
478 + } else {
479 +- struct inet_sock *inet = inet_sk(sk);
480 +-
481 + ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
482 + &sin->sin6_addr);
483 +- sin->sin6_scope_id = 0;
484 +- if (inet->cmsg_flags)
485 ++ if (inet_sk(sk)->cmsg_flags)
486 + ip_cmsg_recv(msg, skb);
487 + }
488 + }
489 +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
490 +index 1e55f5eba185..7daaeaf1bc1a 100644
491 +--- a/net/ipv6/ip6_fib.c
492 ++++ b/net/ipv6/ip6_fib.c
493 +@@ -638,6 +638,29 @@ static inline bool rt6_qualify_for_ecmp(struct rt6_info *rt)
494 + RTF_GATEWAY;
495 + }
496 +
497 ++static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
498 ++ struct net *net)
499 ++{
500 ++ if (atomic_read(&rt->rt6i_ref) != 1) {
501 ++ /* This route is used as dummy address holder in some split
502 ++ * nodes. It is not leaked, but it still holds other resources,
503 ++ * which must be released in time. So, scan ascendant nodes
504 ++ * and replace dummy references to this route with references
505 ++ * to still alive ones.
506 ++ */
507 ++ while (fn) {
508 ++ if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
509 ++ fn->leaf = fib6_find_prefix(net, fn);
510 ++ atomic_inc(&fn->leaf->rt6i_ref);
511 ++ rt6_release(rt);
512 ++ }
513 ++ fn = fn->parent;
514 ++ }
515 ++ /* No more references are possible at this point. */
516 ++ BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
517 ++ }
518 ++}
519 ++
520 + /*
521 + * Insert routing information in a node.
522 + */
523 +@@ -775,11 +798,12 @@ add:
524 + rt->dst.rt6_next = iter->dst.rt6_next;
525 + atomic_inc(&rt->rt6i_ref);
526 + inet6_rt_notify(RTM_NEWROUTE, rt, info);
527 +- rt6_release(iter);
528 + if (!(fn->fn_flags & RTN_RTINFO)) {
529 + info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
530 + fn->fn_flags |= RTN_RTINFO;
531 + }
532 ++ fib6_purge_rt(iter, fn, info->nl_net);
533 ++ rt6_release(iter);
534 + }
535 +
536 + return 0;
537 +@@ -1284,24 +1308,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
538 + fn = fib6_repair_tree(net, fn);
539 + }
540 +
541 +- if (atomic_read(&rt->rt6i_ref) != 1) {
542 +- /* This route is used as dummy address holder in some split
543 +- * nodes. It is not leaked, but it still holds other resources,
544 +- * which must be released in time. So, scan ascendant nodes
545 +- * and replace dummy references to this route with references
546 +- * to still alive ones.
547 +- */
548 +- while (fn) {
549 +- if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
550 +- fn->leaf = fib6_find_prefix(net, fn);
551 +- atomic_inc(&fn->leaf->rt6i_ref);
552 +- rt6_release(rt);
553 +- }
554 +- fn = fn->parent;
555 +- }
556 +- /* No more references are possible at this point. */
557 +- BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
558 +- }
559 ++ fib6_purge_rt(rt, fn, net);
560 +
561 + inet6_rt_notify(RTM_DELROUTE, rt, info);
562 + rt6_release(rt);
563 +diff --git a/net/ipv6/route.c b/net/ipv6/route.c
564 +index 7cc1102e298c..6f1b8503a431 100644
565 +--- a/net/ipv6/route.c
566 ++++ b/net/ipv6/route.c
567 +@@ -1160,12 +1160,9 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
568 + struct net *net = dev_net(dst->dev);
569 +
570 + rt6->rt6i_flags |= RTF_MODIFIED;
571 +- if (mtu < IPV6_MIN_MTU) {
572 +- u32 features = dst_metric(dst, RTAX_FEATURES);
573 ++ if (mtu < IPV6_MIN_MTU)
574 + mtu = IPV6_MIN_MTU;
575 +- features |= RTAX_FEATURE_ALLFRAG;
576 +- dst_metric_set(dst, RTAX_FEATURES, features);
577 +- }
578 ++
579 + dst_metric_set(dst, RTAX_MTU, mtu);
580 + rt6_update_expires(rt6, net->ipv6.sysctl.ip6_rt_mtu_expires);
581 + }
582 +diff --git a/net/sctp/associola.c b/net/sctp/associola.c
583 +index d477d476714d..abc0922d0e31 100644
584 +--- a/net/sctp/associola.c
585 ++++ b/net/sctp/associola.c
586 +@@ -1235,7 +1235,6 @@ void sctp_assoc_update(struct sctp_association *asoc,
587 + asoc->peer.peer_hmacs = new->peer.peer_hmacs;
588 + new->peer.peer_hmacs = NULL;
589 +
590 +- sctp_auth_key_put(asoc->asoc_shared_key);
591 + sctp_auth_asoc_init_active_key(asoc, GFP_ATOMIC);
592 + }
593 +
594 +diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
595 +index 43abb643f3a1..df06b13a50f6 100644
596 +--- a/net/sctp/sm_make_chunk.c
597 ++++ b/net/sctp/sm_make_chunk.c
598 +@@ -2608,7 +2608,7 @@ do_addr_param:
599 +
600 + addr_param = param.v + sizeof(sctp_addip_param_t);
601 +
602 +- af = sctp_get_af_specific(param_type2af(param.p->type));
603 ++ af = sctp_get_af_specific(param_type2af(addr_param->p.type));
604 + if (af == NULL)
605 + break;
606 +
607 +diff --git a/net/socket.c b/net/socket.c
608 +index a19ae1968d37..1b2c2d62ff20 100644
609 +--- a/net/socket.c
610 ++++ b/net/socket.c
611 +@@ -886,9 +886,6 @@ static ssize_t sock_splice_read(struct file *file, loff_t *ppos,
612 + static struct sock_iocb *alloc_sock_iocb(struct kiocb *iocb,
613 + struct sock_iocb *siocb)
614 + {
615 +- if (!is_sync_kiocb(iocb))
616 +- BUG();
617 +-
618 + siocb->kiocb = iocb;
619 + iocb->private = siocb;
620 + return siocb;