Mike Kazantsev found 3.5 kernels and beyond were leaking memory,
and tracked the faulty commit to a1c7fff7 ("net:
netdev_alloc_skb() use build_skb()")

While this commit seems fine, it uncovered a bug introduced
in commit bad43ca8 ("net: introduce skb_try_coalesce()), in function
kfree_skb_partial()"):

If head is stolen, we free the sk_buff,
without removing references on secpath (skb->sp).

So IPsec + IP defrag/reassembly (using skb coalescing), or
TCP coalescing could leak secpath objects.

Fix this bug by calling skb_release_head_state(skb) to properly
release all possible references to linked objects.
Reported-by: Mike Kazantsev <mk.fraggod@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Bisected-by: Mike Kazantsev <mk.fraggod@gmail.com>
Tested-by: Mike Kazantsev <mk.fraggod@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Before use the request and response queue addr, make sure it has wrote
to the registers.
Signed-off-by: Joe Jin <joe.jin@oracle.com>
Cc: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>
Cc: Ron Mercer <ron.mercer@qlogic.com>
Acked-by: Jitendra Kalsaria <jitendra.kalsaria@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Add a bit TCPI_OPT_SYN_DATA (32) to the socket option TCP_INFO:tcpi_options.
It's set if the data in SYN (sent or received) is acked by SYN-ACK. Server or
client application can use this information to check Fast Open success rate.
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

John W. Linville says:

====================
This is a batch of fixes intended for the 3.7 stream.

Dan Carpenter brings a fix for a simple signedness bug that could
prevent the proper termination of a loop.

Felix Fietkau found a few more places that need to use
ieee80211_free_txskb for properly releasing SKBs used by mac80211.

Franky Lin offers a pair of brcmfmac fixes, both fixing simple state
reporting errors.

Hante Meuleman corrects an error reporting case that wasn't handling
all types of errors properly.

Johan Hedberg offers a fix for an issue discovered at the Bluetooth
UnPlug Fest.  Gustavo says "the patch fixes a failure to pair with
devices that support the LE Secure Connections feature."

Johannes Berg sends an iwlwifi fix to handle a message type that
is too large for the normal command mechanism.  He also provides a
mac80211 fix to use HT20 channels when HT40 channels are not permitted.

Jouni Malinen offers a mac80211 fix for a masking error that was
incorrectly marking some frames.

Piotr Haber provides a fix to make sure bcma devices are unregistered
properly.

Stanislav Yakovlev gives us a fix for a panic in the ipw2200 driver.

Stanislaw Gruszka sends a pair of fixes: one prevents a mismatch on
connection states between cfg80211 and mac80211; the other prevents
some frame corruption related to handling encryption.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

This patch also fixes the build failure caused due to removal of #ifdef
CONFIG_CHELSIO_T4_OFFLOAD condition
Signed-off-by: Vipul Pandya <vipul@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

Included fixes:
- Fix broadcast packet CRC calculation which can lead to ~80% broadcast packet
  loss
- Fix a race condition in duplicate broadcast packet check
Signed-off-by: David S. Miller <davem@davemloft.net>

tcp_ioctl() tries to take into account if tcp socket received a FIN
to report correct number bytes in receive queue.

But its flaky because if the application ate the last skb,
we return 1 instead of 0.

Correct way to detect that FIN was received is to test SOCK_DONE.
Reported-by: Elliot Hughes <enh@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Neal Cardwell <ncardwell@google.com>
Cc: Tom Herbert <therbert@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Analyzed a few Windows driver description files, supporting
this long list of devices:

%ztewwan.DeviceDesc0002%    = ztewwan.ndi, USB\VID_19D2&PID_0002&MI_01
%ztewwan.DeviceDesc0012%    = ztewwan.ndi, USB\VID_19D2&PID_0012&MI_01
%ztewwan.DeviceDesc0017%    = ztewwan.ndi, USB\VID_19D2&PID_0017&MI_03
%ztewwan.DeviceDesc0021%    = ztewwan.ndi, USB\VID_19D2&PID_0021&MI_04
%ztewwan.DeviceDesc0025%    = ztewwan.ndi, USB\VID_19D2&PID_0025&MI_01
%ztewwan.DeviceDesc0031%    = ztewwan.ndi, USB\VID_19D2&PID_0031&MI_04
%ztewwan.DeviceDesc0042%    = ztewwan.ndi, USB\VID_19D2&PID_0042&MI_04
%ztewwan.DeviceDesc0049%    = ztewwan.ndi, USB\VID_19D2&PID_0049&MI_05
%ztewwan.DeviceDesc0052%    = ztewwan.ndi, USB\VID_19D2&PID_0052&MI_04
%ztewwan.DeviceDesc0055%    = ztewwan.ndi, USB\VID_19D2&PID_0055&MI_01
%ztewwan.DeviceDesc0058%    = ztewwan.ndi, USB\VID_19D2&PID_0058&MI_04
%ztewwan.DeviceDesc0063%    = ztewwan.ndi, USB\VID_19D2&PID_0063&MI_04
%ztewwan.DeviceDesc2002%    = ztewwan.ndi, USB\VID_19D2&PID_2002&MI_04
%ztewwan.DeviceDesc0104%    = ztewwan.ndi, USB\VID_19D2&PID_0104&MI_04
%ztewwan.DeviceDesc0113%    = ztewwan.ndi, USB\VID_19D2&PID_0113&MI_05
%ztewwan.DeviceDesc0118%    = ztewwan.ndi, USB\VID_19D2&PID_0118&MI_05
%ztewwan.DeviceDesc0121%    = ztewwan.ndi, USB\VID_19D2&PID_0121&MI_05
%ztewwan.DeviceDesc0123%    = ztewwan.ndi, USB\VID_19D2&PID_0123&MI_04
%ztewwan.DeviceDesc0124%    = ztewwan.ndi, USB\VID_19D2&PID_0124&MI_05
%ztewwan.DeviceDesc0125%    = ztewwan.ndi, USB\VID_19D2&PID_0125&MI_06
%ztewwan.DeviceDesc0126%    = ztewwan.ndi, USB\VID_19D2&PID_0126&MI_05
%ztewwan.DeviceDesc1008%    = ztewwan.ndi, USB\VID_19D2&PID_1008&MI_04
%ztewwan.DeviceDesc1010%    = ztewwan.ndi, USB\VID_19D2&PID_1010&MI_04
%ztewwan.DeviceDesc1012%    = ztewwan.ndi, USB\VID_19D2&PID_1012&MI_04
%ztewwan.DeviceDesc1402%    = ztewwan.ndi, USB\VID_19D2&PID_1402&MI_02
%ztewwan.DeviceDesc0157%    = ztewwan.ndi, USB\VID_19D2&PID_0157&MI_05
%ztewwan.DeviceDesc0158%    = ztewwan.ndi, USB\VID_19D2&PID_0158&MI_03
%ztewwan.DeviceDesc1401%    = ztewwan.ndi, USB\VID_19D2&PID_1401&MI_02
%ztewwan.DeviceDesc0130%    = ztewwan.ndi, USB\VID_19D2&PID_0130&MI_01
%ztewwan.DeviceDesc0133%    = ztewwan.ndi, USB\VID_19D2&PID_0133&MI_03
%ztewwan.DeviceDesc0176%    = ztewwan.ndi, USB\VID_19D2&PID_0176&MI_03
%ztewwan.DeviceDesc0178%    = ztewwan.ndi, USB\VID_19D2&PID_0178&MI_03
%ztewwan.DeviceDesc0168%    = ztewwan.ndi, USB\VID_19D2&PID_0168&MI_04
;EuFi890
%ztewwan.DeviceDesc0191%    = ztewwan.ndi, USB\VID_19D2&PID_0191&MI_04
;AL621
%ztewwan.DeviceDesc0167%    = ztewwan.ndi, USB\VID_19D2&PID_0167&MI_04
;MF821
%ztewwan.DeviceDesc0199%    = ztewwan.ndi, USB\VID_19D2&PID_0199&MI_01
%ztewwan.DeviceDesc0200%    = ztewwan.ndi, USB\VID_19D2&PID_0200&MI_01
%ztewwan.DeviceDesc0257%    = ztewwan.ndi, USB\VID_19D2&PID_0257&MI_03
;MF821V
%ztewwan.DeviceDesc1018%    = ztewwan.ndi, USB\VID_19D2&PID_1018&MI_03
;MF91
%ztewwan.DeviceDesc1426%    = ztewwan.ndi, USB\VID_19D2&PID_1426&MI_02
;0141
%ztewwan.DeviceDesc1247%    = ztewwan.ndi, USB\VID_19D2&PID_1247&MI_04
%ztewwan.DeviceDesc1425%    = ztewwan.ndi, USB\VID_19D2&PID_1425&MI_02
%ztewwan.DeviceDesc1424%    = ztewwan.ndi, USB\VID_19D2&PID_1424&MI_02
%ztewwan.DeviceDesc1252%    = ztewwan.ndi, USB\VID_19D2&PID_1252&MI_04
%ztewwan.DeviceDesc1254%    = ztewwan.ndi, USB\VID_19D2&PID_1254&MI_04
%ztewwan.DeviceDesc1255A%   = ztewwan.ndi, USB\VID_19D2&PID_1255&MI_03
%ztewwan.DeviceDesc1255B%   = ztewwan.ndi, USB\VID_19D2&PID_1255&MI_04
%ztewwan.DeviceDesc1256%    = ztewwan.ndi, USB\VID_19D2&PID_1256&MI_04
%ztewwan.DeviceDesc1245%    = ztewwanCombB.ndi, USB\VID_19D2&PID_1245&MI_04
%ztewwan.DeviceDesc1021%    = ztewwan.ndi, USB\VID_19D2&PID_1021&MI_02

Adding the ones we were missing.
Signed-off-by: Bjørn Mork <bjorn@mork.no>
Signed-off-by: David S. Miller <davem@davemloft.net>

On some suspend/resume operations involving wimax device, we have
noticed some intermittent memory corruptions in netlink code.

Stéphane Marchesin tracked this corruption in netlink_update_listeners()
and suggested a patch.

It appears netlink_release() should use kfree_rcu() instead of kfree()
for the listeners structure as it may be used by other cpus using RCU
protection.

netlink_release() must set to NULL the listeners pointer when
it is about to be freed.

Also have to protect netlink_update_listeners() and
netlink_has_listeners() if listeners is NULL.

Add a nl_deref_protected() lockdep helper to properly document which
locks protects us.
Reported-by: Jonathan Kliegman <kliegs@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Stéphane Marchesin <marcheu@google.com>
Cc: Sam Leffler <sleffler@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Currently we can not flush cached pmtu/redirect informations via
the ipv4_sysctl_rtcache_flush sysctl. We need to check the rt_genid
of the old route and reset the nh exeption if the old route is
expired when we bind a new route to a nh exeption.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

vlan_info might be present but still no vlan devices might be there.
That is in case of vlan0 automatically added.

So in that case, allow to change netdev type.
Reported-by: Jon Stanley <jstanley@rmrf.net>
Signed-off-by: Jiri Pirko <jiri@resnulli.us>
Signed-off-by: David S. Miller <davem@davemloft.net>

This driver add support for wake over lan on AT803x phys.
Signed-off-by: Matus Ujhelyi <ujhelyi.m@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

I noticed that the iPhone ethernet driver did not support
iPhone 5. I quickly added support to it in my kernel, here's
a patch.
Signed-off-by: Jay Purohit <jspurohit@velocitylimitless.com>
Acked-by: Valdis Kletnieks <valdis.kletnieks@vt.edu>
Signed-off-by: Jan Ceuleers <jan.ceuleers@computer.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pablo Neira Ayuso Says:

====================
The following patchset contains Netfilter/IPVS updates for your
net tree, they are:

* Fix incorrect hooks for SNAT and DNAT (bug introduced in recent IPv6
  NAT changes), from Elison Niven.

* Fix xt_TEE (got broken with recent rt_gateway semantic change),
  from Eric Dumazet.

* Fix custom conntrack timeout policy attachment for IPv6, from myself.

* Always initialize ip_vs_timeout_user in case that TCP or UDP protocols
  is disabled, from Arnd Bergmann.

Note that I had to pull from your tree to obtain:

(c92b9655 ipv4: Add FLOWI_FLAG_KNOWN_NH)

which was required for the xt_TEE fix.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Threads in the bottom half of batadv_bla_check_bcast_duplist() might
otherwise for instance overwrite variables which other threads might
be using/reading at the same time in the top half, potentially
leading to messing up the bcast_duplist, possibly resulting in false
bridge loop avoidance duplicate check decisions.
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Acked-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

So far the crc16 checksum for a batman-adv broadcast data packet, received
on a batman-adv hard interface, was calculated over zero bytes of its
content leading to many incoming broadcast data packets wrongly being
dropped (60-80% packet loss).

This patch fixes this issue by calculating the crc16 over the actual,
complete broadcast payload.

The issue is a regression introduced by
("batman-adv: add broadcast duplicate check").
Signed-off-by: Linus Lüssing <linus.luessing@web.de>
Acked-by: Simon Wunderlich <siwu@hrz.tu-chemnitz.de>
Signed-off-by: Marek Lindner <lindner_marek@yahoo.de>

The capability defines have moved causing the auto generated names
of capabilities that apparmor uses in logging to be incorrect.

Fix the autogenerated table source to uapi/linux/capability.h
Reported-by: YanHong <clouds.yan@gmail.com>
Reported-by: Krzysztof Kolasa <kkolasa@winsoft.pl>
Analyzed-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: John Johansen <john.johansen@canonical.com>
Acked-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull misc UAPI fixes from David Howells:
 "They do a number of things:

  (1) Import a patch from Catalin Marinas to extend the generic-y in
      Kbuild facility to uapi directories.

  (2) Make arch/tile's ucontext.h file use (1) and remove the header-y
      line from the kernel internal side of things.

  (3) Remove some now-empty conditional bits from include/linux/Kbuild.
      The contents got moved to the UAPI side of things along with new
      conditionals.

  (4) Deal with now-empty files:

     (a) Empty Kbuild files under include/ get removed.

     (b) Empty Kbuild files under arch/ get comments to hold them as
         they are likely to end up with generic-y or genhdr-y lines.
         Deleting them appears to work if we want to go that route.

     (c) Put a comment into uapi/asm-generic/kvm_para.h to prevent the
         patch program from deleting that, and made the arches with
         empty kvm_para.h uapi files use that instead of having their
         own files.

     (d) Put comments into four other empty uapi/ headers to prevent the
         patch program from deleting them.

  A question: Is this the right way to deal with the now-empty Kbuild
  files?

  The ones under include/ are unlikely to be used - even for generated
  files, I think - so getting rid of them is probably okay.  Once all
  the bits are in, we can probably remove all the Kbuild files under
  include/ that aren't also under include/uapi/.

  The ones under arch/ are more of an issue because of the potential for
  generic-y and genhdr-y."

* tag 'uapi-fixes-20121017' of git://git.infradead.org/users/dhowells/linux-headers:
  UAPI: Make arch/sparc/include/uapi/asm/sigcontext.h non-empty
  UAPI: Make arch/sh/include/uapi/asm/hw_breakpoint.h non-empty
  UAPI: Make arch/mn10300/include/uapi/asm/setup.h non-empty
  UAPI: Put a comment into uapi/asm-generic/kvm_para.h and use it from arches
  UAPI: The tile arch uses the generic ucontext.h file
  UAPI: Place comments in empty arch Kbuilds to make them non-empty
  UAPI: Remove empty non-UAPI Kbuild files
  UAPI: Remove empty conditionals from include/linux/Kbuild
  UAPI: Make uapi/linux/irqnr.h non-empty
  uapi: Allow automatic generation of uapi/asm/ header files

Pull networking fixes from David Miller:

 1) Fix regression in /proc/net/if_inet6, sometimes devices do not get
    listed.  From Eric Dumazet.

 2) Add IPSEC networking sub-section to MAINTAINERS.

 3) S390 networking fixes from Hendrik Brueckner and Stefan Raspl.

 4) Fix enslavement of devices that can't do VLAN properly, from Jiri
    Pirko.

 5) SCTP sack handling fix from Zijie Pan.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  ipv6: addrconf: fix /proc/net/if_inet6
  bnx2x: fix handling mf storage modes
  qeth: fix deadlock between recovery and bonding driver
  smsgiucv: reestablish IUCV path after resume
  sctp: fix call to SCTP_CMD_PROCESS_SACK in sctp_cmd_interpreter()
  vlan: fix bond/team enslave of vlan challenged slave/port
  MAINTAINERS: Add explicit section for IPSEC networking.

Pull sparc fixes from David Miller:
 "Two sparc64 perf bug fixes and add a sysrq facility so I can diagnose
  these kinds of problems more quickly in the future."

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
  sparc64: Fix bit twiddling in sparc_pmu_enable_event().
  sparc64: Add global PMU register dumping via sysrq.
  sparc64: Like x86 we should check current->mm during perf backtrace generation.

Some changes to fix issues with HT40 APs in Korea
and follow-up changes to allow using HT40 even if
the local regulatory database disallows it caused
issues with iwlwifi (and could cause issues with
other devices); iwlwifi firmware would assert if
you tried to connect to an AP that has an invalid
configuration (e.g. using HT40- on channel 140.)

Fix this, while avoiding the "Korean AP" issue by
disabling HT40 and advertising HT20 to the AP
when connecting.

Cc: stable@vger.kernel.org [3.6]
Reported-by: Florian Reitmeir <florian@reitmeir.org>
Tested-by: Florian Reitmeir <florian@reitmeir.org>
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

arch/sparc/include/uapi/asm/sigcontext.h was emitted by the UAPI disintegration
script as an empty file because the parent file had no UAPI stuff in it,
despite being marked with "header-y".

Unfortunately, the patch program deletes resultant empty files when applying a
kernel patch.

So just stick a comment in there as a placeholder.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: David S. Miller <davem@davemloft.net>
cc: sparclinux@vger.kernel.org

arch/sh/include/uapi/asm/hw_breakpoint.h was emitted by the UAPI disintegration
script as an empty file because the parent file had no UAPI stuff in it,
despite being marked with "header-y".

Unfortunately, the patch program deletes resultant empty files when applying a
kernel patch.

So just stick a comment in there as a placeholder.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Paul Mundt <lethal@linux-sh.org>
cc: linux-sh@vger.kernel.org

arch/mn10300/include/uapi/asm/setup.h was emitted by the UAPI disintegration
script as an empty file because the parent file had no UAPI stuff in it,
despite being marked with "header-y".

Unfortunately, the patch program deletes resultant empty files when applying a
kernel patch.

So just stick a comment in there as a placeholder.
Signed-off-by: David Howells <dhowells@redhat.com>

Make uapi/asm-generic/kvm_para.h non-empty by addition of a comment to stop
the patch program from deleting it when it creates it.

Then delete empty arch-specific uapi/asm/kvm_para.h files and tell the Kbuild
files to use the generic instead.

Should this perhaps instead be a #warning or #error that the facility is
unsupported on this arch?
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Arnd Bergmann <arnd@arndb.de>
cc: Avi Kivity <avi@redhat.com>
cc: Marcelo Tosatti <mtosatti@redhat.com>
cc: kvm@vger.kernel.org

Move the header-y and generic-y lines for ucontext.h from
arch/tile/include/asm/Kbuild to the uapi/ Kbuild as the asm-generic variant is
used.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Chris Metcalf <cmetcalf@tilera.com>

Place comments in:

	arch/mips/include/asm/Kbuild
	arch/tile/include/arch/Kbuild

to make them non-empty so that the patch program doesn't remove them when it
reduces them to nothing.

Possibly they should be just deleted, but it's possible that they'll acquire
generic-y or genhdr-y lines in future, so I'm keeping them around for the
moment.

Note that MIPS will compile happily if the file is deleted instead.  I haven't
tested TILE, but I suspect it will be the same there.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Ralf Baechle <ralf@linux-mips.org>
cc: Chris Metcalf <cmetcalf@tilera.com>

Remove non-UAPI Kbuild files that have become empty as a result of UAPI
disintegration.  They used to have only header-y lines in them and those have
now moved to the Kbuild files in the corresponding uapi/ directories.

Possibly these should not be removed but rather have a comment inserted to say
they are intentionally left blank.  This would make it easier to add generated
header lines in future without having to restore the infrastructure.

Note that at this point not all the UAPI disintegration parts have been merged,
so it is likely that more empty Kbuild files will turn up.

It is probably necessary to make the files non-empty to prevent the patch
program from automatically deleting them when it reduces them to nothing.
Signed-off-by: David Howells <dhowells@redhat.com>

Remove empty conditionals from include/linux/Kbuild as the contents, with new
conditionals, have moved to include/uapi/linux/Kbuild.
Signed-off-by: David Howells <dhowells@redhat.com>

uapi/linux/irqnr.h was emitted by the UAPI disintegration script as an empty
file because the parent linux/irqnr.h had no UAPI stuff in it, despite being
marked with "header-y".

Unfortunately, the patch program deletes the empty file when applying a kernel
patch.

It's not clear why this file is part of the UAPI at all.  Looking in:

	/usr/include/linux/irqnr.h

there's nothing there but a header reinclusion guard and a comment.

So just stick a comment in there as a placeholder.

Without this, if the kernel is fabricated from, say, a tarball and a patch, you
can get this error when building x86_64 or usermode Linux (and probably
others):

include/linux/irqnr.h:4:30: fatal error: uapi/linux/irqnr.h: No such file or directory
Reported-by: Randy Dunlap <rdunlap@xenotime.net>
Reported-by: Alessandro Suardi <alessandro.suardi@gmail.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Randy Dunlap <rdunlap@xenotime.net>
cc: Alessandro Suardi <alessandro.suardi@gmail.com>

Several arch/*/include/uapi/asm/* header simply include the
corresponding <asm-generic/*> file. This patch allows such files to be
specified in uapi/asm/Kbuild via "generic-y += ..." to be automatically
generated (similar to asm/Kbuild).
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Cc: Michal Marek <mmarek@suse.cz>
Cc: Arnd Bergmann <arnd@arndb.de>

Torsten Luettgert bisected TEE regression starting with commit
f8126f1d (ipv4: Adjust semantics of rt->rt_gateway.)

The problem is that it tries to ARP-lookup the original destination
address of the forwarded packet, not the address of the gateway.

Fix this using FLOWI_FLAG_KNOWN_NH Julian added in commit
c92b9655 (ipv4: Add FLOWI_FLAG_KNOWN_NH), so that known
nexthop (info->gw.ip) has preference on resolving.
Reported-by: Torsten Luettgert <ml-netfilter@enda.eu>
Bisected-by: Torsten Luettgert <ml-netfilter@enda.eu>
Tested-by: Torsten Luettgert <ml-netfilter@enda.eu>
Cc: Julian Anastasov <ja@ssi.bg>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

To obtain new flag FLOWI_FLAG_KNOWN_NH to fix netfilter's xt_TEE target.

Pull SuperH updates from Paul Mundt.

The bulk of this is the UAPI disintegration for SH.

* tag 'sh-for-linus' of git://github.com/pmundt/linux-sh:
  sh: Fix up more fallout from pointless ARM __iomem churn.
  sh: Wire up kcmp syscall.
  UAPI: (Scripted) Disintegrate arch/sh/include/asm

Merge emailed FRV fixes from David Howells.

* frv:
  FRV: Fix linux/elf-fdpic.h
  FRV: Fix const sections change
  FRV: Fix incorrect symbol in copy_thread()
  FRV: Fix VLIW packing constraint violation in entry.S

It seems I accidentally switched the guard on linux/elf-fdpic.h from #ifdef
__KERNEL__ to #ifndef __KERNEL__ when attempting to expand the guarded region
to cover the elf_fdpic_params struct when doing the UAPI split - with the
result that the struct became unavailable to kernel code.

Move incorrectly guarded bits back to the kernelspace header.

Whilst we're at it, the __KERNEL__ guards can be deleted as they're no longer
necessary.
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Reported-by: Lars-Peter Clausen <lars@metafoo.de>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Fengguang Wu <fengguang.wu@intel.com>
cc: Lars-Peter Clausen <lars@metafoo.de>
cc: uclinux-dev@uclinux.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Add __pminitconst to fix the build, otherwise the following error can occur:

  arch/frv/kernel/setup.c:187:47: error: expected '=', ',', ';', 'asm' or '__attribute__' before '*' token
  arch/frv/kernel/setup.c:386:2: error: 'clock_cmodes' undeclared (first use in this function)
  arch/frv/kernel/setup.c:571:6: error: 'clock_cmodes' undeclared (first use in this function)
  make[2]: *** [arch/frv/kernel/setup.o] Error 1

http://kisskb.ellerman.id.au/kisskb/buildresult/7344691/Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Andi Kleen <ak@linux.intel.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix an incorrect symbol in copy_thread():

  arch/frv/kernel/process.c: In function 'copy_thread':
  arch/frv/kernel/process.c:197: error: 'chilregs' undeclared (first use in this function)
  arch/frv/kernel/process.c:197: error: (Each undeclared identifier is reported only once
  arch/frv/kernel/process.c:197: error: for each function it appears in.)
Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Al Viro <viro@ZenIV.linux.org.uk>
cc: Geert Uytterhoeven <geert@linux-m68k.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>