Merge davem@nuts.davemloft.net:/disk1/BK/net-2.6

into kernel.bkbits.net:/home/davem/net-2.6

include/linux/netdevice.h

@@ -215,6 +215,8 @@ struct hh_cache
  */
 #define LL_RESERVED_SPACE(dev) \
 	(((dev)->hard_header_len&~(HH_DATA_MOD - 1)) + HH_DATA_MOD)
+#define LL_RESERVED_SPACE_EXTRA(dev,extra) \
+	((((dev)->hard_header_len+extra)&~(HH_DATA_MOD - 1)) + HH_DATA_MOD)
 
 /* These flag bits are private to the generic network queueing
  * layer, they may not be explicitly referenced by any other

net/ipv4/ip_output.c

@@ -567,7 +567,7 @@ int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
 #ifdef CONFIG_BRIDGE_NETFILTER
 	/* for bridged IP traffic encapsulated inside f.e. a vlan header,
 	 * we need to make room for the encapsulating header */
-	ll_rs = LL_RESERVED_SPACE(rt->u.dst.dev + nf_bridge_pad(skb));
+	ll_rs = LL_RESERVED_SPACE_EXTRA(rt->u.dst.dev, nf_bridge_pad(skb));
 	mtu -= nf_bridge_pad(skb);
 #else
 	ll_rs = LL_RESERVED_SPACE(rt->u.dst.dev);

net/ipv4/ipip.c

@@ -479,6 +479,7 @@ static int ipip_rcv(struct sk_buff *skb)
 	read_lock(&ipip_lock);
 	if ((tunnel = ipip_tunnel_lookup(iph->saddr, iph->daddr)) != NULL) {
 		if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+			read_unlock(&ipip_lock);
 			kfree_skb(skb);
 			return 0;
 		}

net/ipv6/raw.c

@@ -283,7 +283,8 @@ void rawv6_err(struct sock *sk, struct sk_buff *skb,
 
 static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
 {
-	if (sk->sk_filter && skb->ip_summed != CHECKSUM_UNNECESSARY) {
+	if ((raw6_sk(sk)->checksum || sk->sk_filter) && 
+	    skb->ip_summed != CHECKSUM_UNNECESSARY) {
 		if ((unsigned short)csum_fold(skb_checksum(skb, 0, skb->len, skb->csum))) {
 			/* FIXME: increment a raw6 drops counter here */
 			kfree_skb(skb);
@@ -452,6 +453,10 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct r
 	struct sk_buff *skb;
 	int err = 0;
 	u16 *csum;
+	u32 tmp_csum;
+
+	if (!opt->checksum)
+		goto send;
 
 	if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
 		goto out;
@@ -463,29 +468,32 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct r
 		goto out;
 	}
 
+	/* should be check HW csum miyazawa */
 	if (skb_queue_len(&sk->sk_write_queue) == 1) {
 		/*
 		 * Only one fragment on the socket.
 		 */
-		/* should be check HW csum miyazawa */
-		*csum = csum_ipv6_magic(&fl->fl6_src,
-					&fl->fl6_dst,
-					len, fl->proto, skb->csum);
+		tmp_csum = skb->csum;
 	} else {
-		u32 tmp_csum = 0;
+		tmp_csum = 0;
 
 		skb_queue_walk(&sk->sk_write_queue, skb) {
 			tmp_csum = csum_add(tmp_csum, skb->csum);
 		}
+	}
 
-		tmp_csum = csum_ipv6_magic(&fl->fl6_src,
+	/* in case cksum was not initialized */
+	if (unlikely(*csum))
+		tmp_csum = csum_sub(tmp_csum, *csum);
+
+	*csum = csum_ipv6_magic(&fl->fl6_src,
 				&fl->fl6_dst,
 				len, fl->proto, tmp_csum);
-		*csum = tmp_csum;
-	}
+
 	if (*csum == 0)
 		*csum = -1;
-	ip6_push_pending_frames(sk);
+send:
+	err = ip6_push_pending_frames(sk);
 out:
 	return err;
 }
@@ -702,13 +710,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
 
 		if (err)
 			ip6_flush_pending_frames(sk);
-		else if (!(msg->msg_flags & MSG_MORE)) {
-			if (raw_opt->checksum) {
+		else if (!(msg->msg_flags & MSG_MORE))
 			err = rawv6_push_pending_frames(sk, &fl, raw_opt, len);
-			} else {
-				err = ip6_push_pending_frames(sk);
-			}
-		}
 	}
 done:
 	ip6_dst_store(sk, dst,

net/xfrm/xfrm_state.c

@@ -489,15 +489,16 @@ int xfrm_state_update(struct xfrm_state *x)
 			memcpy(x1->encap, x->encap, sizeof(*x1->encap));
 		memcpy(&x1->lft, &x->lft, sizeof(x1->lft));
 		x1->km.dying = 0;
-		err = 0;
-	}
-	spin_unlock_bh(&x1->lock);
 
 		if (!mod_timer(&x1->timer, jiffies + HZ))
 			xfrm_state_hold(x1);
 		if (x1->curlft.use_time)
 			xfrm_state_check_expire(x1);
 
+		err = 0;
+	}
+	spin_unlock_bh(&x1->lock);
+
 	xfrm_state_put(x1);
 
 	return err;