Merge branch 'android-4.4@c71ad0f' into branch 'msm-4.4'

* refs/heads/tmp-c71ad0f:
  BACKPORT: arm64: dts: juno: fix cluster sleep state entry latency on all SoC versions
  staging: android: ashmem: lseek failed due to no FMODE_LSEEK.
  ANDROID: sdcardfs: update module info
  ANDROID: sdcardfs: use d_splice_alias
  ANDROID: sdcardfs: add read_iter/write_iter opeations
  ANDROID: sdcardfs: fix ->llseek to update upper and lower offset
  ANDROID: sdcardfs: copy lower inode attributes in ->ioctl
  ANDROID: sdcardfs: remove unnecessary call to do_munmap
  Merge 4.4.59 into android-4.4
  UPSTREAM: ipv6 addrconf: implement RFC7559 router solicitation backoff
  android: base-cfg: enable CONFIG_INET_DIAG_DESTROY
  ANDROID: android-base.cfg: add CONFIG_MODULES option
  ANDROID: android-base.cfg: add CONFIG_IKCONFIG option
  ANDROID: android-base.cfg: properly sort the file
  ANDROID: binder: add hwbinder,vndbinder to BINDER_DEVICES.
  ANDROID: sort android-recommended.cfg
  UPSTREAM: config/android: Remove CONFIG_IPV6_PRIVACY
  UPSTREAM: config: android: set SELinux as default security mode
  config: android: move device mapper options to recommended
  ANDROID: ARM64: Allow to choose appended kernel image
  UPSTREAM: arm64: vdso: constify vm_special_mapping used for aarch32 vectors page
  UPSTREAM: arm64: vdso: add __init section marker to alloc_vectors_page
  UPSTREAM: ARM: 8597/1: VDSO: put RO and RO after init objects into proper sections
  UPSTREAM: arm64: Add support for CLOCK_MONOTONIC_RAW in clock_gettime() vDSO
  UPSTREAM: arm64: Refactor vDSO time functions
  UPSTREAM: arm64: fix vdso-offsets.h dependency
  UPSTREAM: kbuild: drop FORCE from PHONY targets
  UPSTREAM: mm: add PHYS_PFN, use it in __phys_to_pfn()
  UPSTREAM: ARM: 8476/1: VDSO: use PTR_ERR_OR_ZERO for vma check
  Linux 4.4.58
  crypto: algif_hash - avoid zero-sized array
  fbcon: Fix vc attr at deinit
  serial: 8250_pci: Detach low-level driver during PCI error recovery
  ACPI / blacklist: Make Dell Latitude 3350 ethernet work
  ACPI / blacklist: add _REV quirks for Dell Precision 5520 and 3520
  uvcvideo: uvc_scan_fallback() for webcams with broken chain
  s390/zcrypt: Introduce CEX6 toleration
  block: allow WRITE_SAME commands with the SG_IO ioctl
  vfio/spapr: Postpone allocation of userspace version of TCE table
  PCI: Do any VF BAR updates before enabling the BARs
  PCI: Ignore BAR updates on virtual functions
  PCI: Update BARs using property bits appropriate for type
  PCI: Don't update VF BARs while VF memory space is enabled
  PCI: Decouple IORESOURCE_ROM_ENABLE and PCI_ROM_ADDRESS_ENABLE
  PCI: Add comments about ROM BAR updating
  PCI: Remove pci_resource_bar() and pci_iov_resource_bar()
  PCI: Separate VF BAR updates from standard BAR updates
  x86/hyperv: Handle unknown NMIs on one CPU when unknown_nmi_panic
  igb: add i211 to i210 PHY workaround
  igb: Workaround for igb i210 firmware issue
  xen: do not re-use pirq number cached in pci device msi msg data
  xfs: clear _XBF_PAGES from buffers when readahead page
  USB: usbtmc: add missing endpoint sanity check
  nl80211: fix dumpit error path RTNL deadlocks
  xfs: fix up xfs_swap_extent_forks inline extent handling
  xfs: don't allow di_size with high bit set
  libceph: don't set weight to IN when OSD is destroyed
  raid10: increment write counter after bio is split
  cpufreq: Restore policy min/max limits on CPU online
  ARM: dts: at91: sama5d2: add dma properties to UART nodes
  ARM: at91: pm: cpu_idle: switch DDR to power-down mode
  iommu/vt-d: Fix NULL pointer dereference in device_to_iommu
  xen/acpi: upload PM state from init-domain to Xen
  mmc: sdhci: Do not disable interrupts while waiting for clock
  ext4: mark inode dirty after converting inline directory
  parport: fix attempt to write duplicate procfiles
  iio: hid-sensor-trigger: Change get poll value function order to avoid sensor properties losing after resume from S3
  iio: adc: ti_am335x_adc: fix fifo overrun recovery
  mmc: ushc: fix NULL-deref at probe
  uwb: hwa-rc: fix NULL-deref at probe
  uwb: i1480-dfu: fix NULL-deref at probe
  usb: hub: Fix crash after failure to read BOS descriptor
  usb: musb: cppi41: don't check early-TX-interrupt for Isoch transfer
  USB: wusbcore: fix NULL-deref at probe
  USB: idmouse: fix NULL-deref at probe
  USB: lvtest: fix NULL-deref at probe
  USB: uss720: fix NULL-deref at probe
  usb-core: Add LINEAR_FRAME_INTR_BINTERVAL USB quirk
  usb: gadget: f_uvc: Fix SuperSpeed companion descriptor's wBytesPerInterval
  ACM gadget: fix endianness in notifications
  USB: serial: qcserial: add Dell DW5811e
  USB: serial: option: add Quectel UC15, UC20, EC21, and EC25 modems
  ALSA: hda - Adding a group of pin definition to fix headset problem
  ALSA: ctxfi: Fix the incorrect check of dma_set_mask() call
  ALSA: seq: Fix racy cell insertions during snd_seq_pool_done()
  Input: sur40 - validate number of endpoints before using them
  Input: kbtab - validate number of endpoints before using them
  Input: cm109 - validate number of endpoints before using them
  Input: yealink - validate number of endpoints before using them
  Input: hanwang - validate number of endpoints before using them
  Input: ims-pcu - validate number of endpoints before using them
  Input: iforce - validate number of endpoints before using them
  Input: i8042 - add noloop quirk for Dell Embedded Box PC 3000
  Input: elan_i2c - add ASUS EeeBook X205TA special touchpad fw
  tcp: initialize icsk_ack.lrcvtime at session start time
  socket, bpf: fix sk_filter use after free in sk_clone_lock
  ipv4: provide stronger user input validation in nl_fib_input()
  net: bcmgenet: remove bcmgenet_internal_phy_setup()
  net/mlx5e: Count LRO packets correctly
  net/mlx5: Increase number of max QPs in default profile
  net: unix: properly re-increment inflight counter of GC discarded candidates
  amd-xgbe: Fix jumbo MTU processing on newer hardware
  net: properly release sk_frag.page
  net: bcmgenet: Do not suspend PHY if Wake-on-LAN is enabled
  net/openvswitch: Set the ipv6 source tunnel key address attribute correctly
  Linux 4.4.57
  ext4: fix fencepost in s_first_meta_bg validation
  percpu: acquire pcpu_lock when updating pcpu_nr_empty_pop_pages
  gfs2: Avoid alignment hole in struct lm_lockname
  isdn/gigaset: fix NULL-deref at probe
  target: Fix VERIFY_16 handling in sbc_parse_cdb
  scsi: libiscsi: add lock around task lists to fix list corruption regression
  scsi: lpfc: Add shutdown method for kexec
  target/pscsi: Fix TYPE_TAPE + TYPE_MEDIMUM_CHANGER export
  md/raid1/10: fix potential deadlock
  powerpc/boot: Fix zImage TOC alignment
  cpufreq: Fix and clean up show_cpuinfo_cur_freq()
  perf/core: Fix event inheritance on fork()
  give up on gcc ilog2() constant optimizations
  kernek/fork.c: allocate idle task for a CPU always on its local node
  hv_netvsc: use skb_get_hash() instead of a homegrown implementation
  tpm_tis: Use devm_free_irq not free_irq
  drm/amdgpu: add missing irq.h include
  s390/pci: fix use after free in dma_init
  KVM: PPC: Book3S PR: Fix illegal opcode emulation
  xen/qspinlock: Don't kick CPU if IRQ is not initialized
  Drivers: hv: avoid vfree() on crash
  Drivers: hv: balloon: don't crash when memory is added in non-sorted order
  pinctrl: cherryview: Do not mask all interrupts in probe
  ACPI / video: skip evaluating _DOD when it does not exist
  cxlflash: Increase cmd_per_lun for better throughput
  crypto: mcryptd - Fix load failure
  crypto: cryptd - Assign statesize properly
  crypto: ghash-clmulni - Fix load failure
  USB: don't free bandwidth_mutex too early
  usb: core: hub: hub_port_init lock controller instead of bus
  ANDROID: sdcardfs: Fix style issues in macros
  ANDROID: sdcardfs: Use seq_puts over seq_printf
  ANDROID: sdcardfs: Use to kstrout
  ANDROID: sdcardfs: Use pr_[...] instead of printk
  ANDROID: sdcardfs: remove unneeded null check
  ANDROID: sdcardfs: Fix style issues with comments
  ANDROID: sdcardfs: Fix formatting
  ANDROID: sdcardfs: correct order of descriptors
  fix the deadlock in xt_qtaguid when enable DDEBUG
  net: ipv6: Add sysctl for minimum prefix len acceptable in RIOs.
  Linux 4.4.56
  futex: Add missing error handling to FUTEX_REQUEUE_PI
  futex: Fix potential use-after-free in FUTEX_REQUEUE_PI
  x86/perf: Fix CR4.PCE propagation to use active_mm instead of mm
  x86/kasan: Fix boot with KASAN=y and PROFILE_ANNOTATED_BRANCHES=y
  fscrypto: lock inode while setting encryption policy
  fscrypt: fix renaming and linking special files
  net sched actions: decrement module reference count after table flush.
  dccp: fix memory leak during tear-down of unsuccessful connection request
  dccp/tcp: fix routing redirect race
  bridge: drop netfilter fake rtable unconditionally
  ipv6: avoid write to a possibly cloned skb
  ipv6: make ECMP route replacement less greedy
  mpls: Send route delete notifications when router module is unloaded
  act_connmark: avoid crashing on malformed nlattrs with null parms
  uapi: fix linux/packet_diag.h userspace compilation error
  vrf: Fix use-after-free in vrf_xmit
  dccp: fix use-after-free in dccp_feat_activate_values
  net: fix socket refcounting in skb_complete_tx_timestamp()
  net: fix socket refcounting in skb_complete_wifi_ack()
  tcp: fix various issues for sockets morphing to listen state
  dccp: Unlock sock before calling sk_free()
  net: net_enable_timestamp() can be called from irq contexts
  net: don't call strlen() on the user buffer in packet_bind_spkt()
  l2tp: avoid use-after-free caused by l2tp_ip_backlog_recv
  ipv4: mask tos for input route
  vti6: return GRE_KEY for vti6
  vxlan: correctly validate VXLAN ID against VXLAN_N_VID
  netlink: remove mmapped netlink support
  ANDROID: mmc: core: export emmc revision
  BACKPORT: mmc: core: Export device lifetime information through sysfs
  ANDROID: android-verity: do not compile as independent module
  ANDROID: sched: fix duplicate sched_group_energy const specifiers
  config: disable CONFIG_USELIB and CONFIG_FHANDLE
  ANDROID: power: align wakeup_sources format
  ANDROID: dm: android-verity: allow disable dm-verity for Treble VTS
  uid_sys_stats: change to use rt_mutex
  ANDROID: vfs: user permission2 in notify_change2
  ANDROID: sdcardfs: Fix gid issue
  ANDROID: sdcardfs: Use tabs instead of spaces in multiuser.h
  ANDROID: sdcardfs: Remove uninformative prints
  ANDROID: sdcardfs: move path_put outside of spinlock
  ANDROID: sdcardfs: Use case insensitive hash function
  ANDROID: sdcardfs: declare MODULE_ALIAS_FS
  ANDROID: sdcardfs: Get the blocksize from the lower fs
  ANDROID: sdcardfs: Use d_invalidate instead of drop_recurisve
  ANDROID: sdcardfs: Switch to internal case insensitive compare
  ANDROID: sdcardfs: Use spin_lock_nested
  ANDROID: sdcardfs: Replace get/put with d_lock
  ANDROID: sdcardfs: rate limit warning print
  ANDROID: sdcardfs: Fix case insensitive lookup
  ANDROID: uid_sys_stats: account for fsync syscalls
  ANDROID: sched: add a counter to track fsync
  ANDROID: uid_sys_stats: fix negative write bytes.
  ANDROID: uid_sys_stats: allow writing same state
  ANDROID: uid_sys_stats: rename uid_cputime.c to uid_sys_stats.c
  ANDROID: uid_cputime: add per-uid IO usage accounting
  DTB: Add EAS compatible Juno Energy model to 'juno.dts'
  arm64: dts: juno: Add idle-states to device tree
  ANDROID: Replace spaces by '_' for some android filesystem tracepoints.
  usb: gadget: f_accessory: Fix for UsbAccessory clean unbind.
  android: binder: move global binder state into context struct.
  android: binder: add padding to binder_fd_array_object.
  binder: use group leader instead of open thread
  nf: IDLETIMER: Use fullsock when querying uid
  nf: IDLETIMER: Fix use after free condition during work
  ANDROID: dm: android-verity: fix table_make_digest() error handling
  ANDROID: usb: gadget: function: Fix commenting style
  cpufreq: interactive governor drops bits in time calculation
  ANDROID: sdcardfs: support direct-IO (DIO) operations
  ANDROID: sdcardfs: implement vm_ops->page_mkwrite
  ANDROID: sdcardfs: Don't bother deleting freelist
  ANDROID: sdcardfs: Add missing path_put
  ANDROID: sdcardfs: Fix incorrect hash
  ANDROID: ext4 crypto: Disables zeroing on truncation when there's no key
  ANDROID: ext4: add a non-reversible key derivation method
  ANDROID: ext4: allow encrypting filenames using HEH algorithm
  ANDROID: arm64/crypto: add ARMv8-CE optimized poly_hash algorithm
  ANDROID: crypto: heh - factor out poly_hash algorithm
  ANDROID: crypto: heh - Add Hash-Encrypt-Hash (HEH) algorithm
  ANDROID: crypto: gf128mul - Add ble multiplication functions
  ANDROID: crypto: gf128mul - Refactor gf128 overflow macros and tables
  UPSTREAM: crypto: gf128mul - Zero memory when freeing multiplication table
  ANDROID: crypto: shash - Add crypto_grab_shash() and crypto_spawn_shash_alg()
  ANDROID: crypto: allow blkcipher walks over ablkcipher data
  UPSTREAM: arm/arm64: crypto: assure that ECB modes don't require an IV
  ANDROID: Refactor fs readpage/write tracepoints.
  ANDROID: export security_path_chown
  Squashfs: optimize reading uncompressed data
  Squashfs: implement .readpages()
  Squashfs: replace buffer_head with BIO
  Squashfs: refactor page_actor
  Squashfs: remove the FILE_CACHE option
  ANDROID: android-recommended.cfg: CONFIG_CPU_SW_DOMAIN_PAN=y
  FROMLIST: 9p: fix a potential acl leak
  BACKPORT: posix_acl: Clear SGID bit when setting file permissions
  UPSTREAM: udp: properly support MSG_PEEK with truncated buffers
  UPSTREAM: arm64: Allow hw watchpoint of length 3,5,6 and 7
  BACKPORT: arm64: hw_breakpoint: Handle inexact watchpoint addresses
  UPSTREAM: arm64: Allow hw watchpoint at varied offset from base address
  BACKPORT: hw_breakpoint: Allow watchpoint of length 3,5,6 and 7
  ANDROID: sdcardfs: Switch strcasecmp for internal call
  ANDROID: sdcardfs: switch to full_name_hash and qstr
  ANDROID: sdcardfs: Add GID Derivation to sdcardfs
  ANDROID: sdcardfs: Remove redundant operation
  ANDROID: sdcardfs: add support for user permission isolation
  ANDROID: sdcardfs: Refactor configfs interface
  ANDROID: sdcardfs: Allow non-owners to touch
  ANDROID: binder: fix format specifier for type binder_size_t
  ANDROID: fs: Export vfs_rmdir2
  ANDROID: fs: Export free_fs_struct and set_fs_pwd
  BACKPORT: Input: xpad - validate USB endpoint count during probe
  BACKPORT: Input: xpad - fix oops when attaching an unknown Xbox One gamepad
  ANDROID: mnt: remount should propagate to slaves of slaves
  ANDROID: sdcardfs: Switch ->d_inode to d_inode()
  ANDROID: sdcardfs: Fix locking issue with permision fix up
  ANDROID: sdcardfs: Change magic value
  ANDROID: sdcardfs: Use per mount permissions
  ANDROID: sdcardfs: Add gid and mask to private mount data
  ANDROID: sdcardfs: User new permission2 functions
  ANDROID: vfs: Add setattr2 for filesystems with per mount permissions
  ANDROID: vfs: Add permission2 for filesystems with per mount permissions
  ANDROID: vfs: Allow filesystems to access their private mount data
  ANDROID: mnt: Add filesystem private data to mount points
  ANDROID: sdcardfs: Move directory unlock before touch
  ANDROID: sdcardfs: fix external storage exporting incorrect uid
  ANDROID: sdcardfs: Added top to sdcardfs_inode_info
  ANDROID: sdcardfs: Switch package list to RCU
  ANDROID: sdcardfs: Fix locking for permission fix up
  ANDROID: sdcardfs: Check for other cases on path lookup
  ANDROID: sdcardfs: override umask on mkdir and create
  arm64: kernel: Fix build warning
  DEBUG: sched/fair: Fix sched_load_avg_cpu events for task_groups
  DEBUG: sched/fair: Fix missing sched_load_avg_cpu events
  UPSTREAM: l2tp: fix racy SOCK_ZAPPED flag check in l2tp_ip{,6}_bind()
  UPSTREAM: packet: fix race condition in packet_set_ring
  UPSTREAM: netlink: Fix dump skb leak/double free
  UPSTREAM: net: avoid signed overflows for SO_{SND|RCV}BUFFORCE
  MIPS: Prevent "restoration" of MSA context in non-MSA kernels
  net: socket: don't set sk_uid to garbage value in ->setattr()
  ANDROID: configs: CONFIG_ARM64_SW_TTBR0_PAN=y
  UPSTREAM: arm64: Disable PAN on uaccess_enable()
  UPSTREAM: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN
  UPSTREAM: arm64: xen: Enable user access before a privcmd hvc call
  UPSTREAM: arm64: Handle faults caused by inadvertent user access with PAN enabled
  BACKPORT: arm64: Disable TTBR0_EL1 during normal kernel execution
  BACKPORT: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1
  BACKPORT: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro
  BACKPORT: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros
  UPSTREAM: arm64: alternative: add auto-nop infrastructure
  UPSTREAM: arm64: barriers: introduce nops and __nops macros for NOP sequences
  Revert "FROMLIST: arm64: Factor out PAN enabling/disabling into separate uaccess_* macros"
  Revert "FROMLIST: arm64: Factor out TTBR0_EL1 post-update workaround into a specific asm macro"
  Revert "FROMLIST: arm64: Introduce uaccess_{disable,enable} functionality based on TTBR0_EL1"
  Revert "FROMLIST: arm64: Disable TTBR0_EL1 during normal kernel execution"
  Revert "FROMLIST: arm64: Handle faults caused by inadvertent user access with PAN enabled"
  Revert "FROMLIST: arm64: xen: Enable user access before a privcmd hvc call"
  Revert "FROMLIST: arm64: Enable CONFIG_ARM64_SW_TTBR0_PAN"
  ANDROID: sched/walt: fix build failure if FAIR_GROUP_SCHED=n
  ANDROID: trace: net: use %pK for kernel pointers
  ANDROID: android-base: Enable QUOTA related configs
  net: ipv4: Don't crash if passing a null sk to ip_rt_update_pmtu.
  net: inet: Support UID-based routing in IP protocols.
  net: core: add UID to flows, rules, and routes
  net: core: Add a UID field to struct sock.
  Revert "net: core: Support UID-based routing."
  UPSTREAM: efi/arm64: Don't apply MEMBLOCK_NOMAP to UEFI memory map mapping
  UPSTREAM: arm64: mm: always take dirty state from new pte in ptep_set_access_flags
  UPSTREAM: arm64: Implement pmdp_set_access_flags() for hardware AF/DBM
  UPSTREAM: arm64: Fix typo in the pmdp_huge_get_and_clear() definition
  UPSTREAM: arm64: enable CONFIG_DEBUG_RODATA by default
  goldfish: enable CONFIG_INET_DIAG_DESTROY
  sched/walt: kill {min,max}_capacity
  sched: fix wrong truncation of walt_avg
  build: fix build config kernel_dir
  ANDROID: dm verity: add minimum prefetch size
  build: add build server configs for goldfish
  usb: gadget: Fix compilation problem with tx_qlen field

Conflicts:
	android/configs/android-base.cfg
	arch/arm64/Makefile
	arch/arm64/include/asm/cpufeature.h
	arch/arm64/kernel/vdso/gettimeofday.S
	arch/arm64/mm/cache.S
	drivers/md/Kconfig
	drivers/misc/Makefile
	drivers/mmc/host/sdhci.c
	drivers/usb/core/hcd.c
	drivers/usb/gadget/function/u_ether.c
	fs/sdcardfs/derived_perm.c
	fs/sdcardfs/file.c
	fs/sdcardfs/inode.c
	fs/sdcardfs/lookup.c
	fs/sdcardfs/main.c
	fs/sdcardfs/multiuser.h
	fs/sdcardfs/packagelist.c
	fs/sdcardfs/sdcardfs.h
	fs/sdcardfs/super.c
	include/linux/mmc/card.h
	include/linux/mmc/mmc.h
	include/trace/events/android_fs.h
	include/trace/events/android_fs_template.h
	drivers/android/binder.c
	fs/exec.c
	fs/ext4/crypto_key.c
	fs/ext4/ext4.h
	fs/ext4/inline.c
	fs/ext4/inode.c
	fs/ext4/readpage.c
	fs/f2fs/data.c
	fs/f2fs/inline.c
	fs/mpage.c
	include/linux/dcache.h
	include/trace/events/sched.h
	include/uapi/linux/ipv6.h
	net/ipv4/tcp_ipv4.c
	net/netfilter/xt_IDLETIMER.c

Change-Id: Ie345db6a14869fe0aa794aef4b71b5d0d503690b
Signed-off-by: Blagovest Kolenichev <bkolenichev@codeaurora.org>

6 files changed, 73 insertions, 11 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 01455f492e17..3d72aeffa3f1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -112,6 +112,27 @@ static inline u32 cstamp_delta(unsigned long cstamp)
 	return (cstamp - INITIAL_JIFFIES) * 100UL / HZ;
 }
 
+static inline s32 rfc3315_s14_backoff_init(s32 irt)
+{
+	/* multiply 'initial retransmission time' by 0.9 .. 1.1 */
+	u64 tmp = (900000 + prandom_u32() % 200001) * (u64)irt;
+	do_div(tmp, 1000000);
+	return (s32)tmp;
+}
+
+static inline s32 rfc3315_s14_backoff_update(s32 rt, s32 mrt)
+{
+	/* multiply 'retransmission timeout' by 1.9 .. 2.1 */
+	u64 tmp = (1900000 + prandom_u32() % 200001) * (u64)rt;
+	do_div(tmp, 1000000);
+	if ((s32)tmp > mrt) {
+		/* multiply 'maximum retransmission time' by 0.9 .. 1.1 */
+		tmp = (900000 + prandom_u32() % 200001) * (u64)mrt;
+		do_div(tmp, 1000000);
+	}
+	return (s32)tmp;
+}
+
 #ifdef CONFIG_SYSCTL
 static int addrconf_sysctl_register(struct inet6_dev *idev);
 static void addrconf_sysctl_unregister(struct inet6_dev *idev);
@@ -187,6 +208,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.dad_transmits		= 1,
 	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
 	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
+	.rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
 	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
 	.use_tempaddr		= 0,
 	.temp_valid_lft		= TEMP_VALID_LIFETIME,
@@ -202,6 +224,7 @@ static struct ipv6_devconf ipv6_devconf __read_mostly = {
 	.accept_ra_rtr_pref	= 1,
 	.rtr_probe_interval	= 60 * HZ,
 #ifdef CONFIG_IPV6_ROUTE_INFO
+	.accept_ra_rt_info_min_plen = 0,
 	.accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
@@ -233,6 +256,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.dad_transmits		= 1,
 	.rtr_solicits		= MAX_RTR_SOLICITATIONS,
 	.rtr_solicit_interval	= RTR_SOLICITATION_INTERVAL,
+	.rtr_solicit_max_interval = RTR_SOLICITATION_MAX_INTERVAL,
 	.rtr_solicit_delay	= MAX_RTR_SOLICITATION_DELAY,
 	.use_tempaddr		= 0,
 	.temp_valid_lft		= TEMP_VALID_LIFETIME,
@@ -248,6 +272,7 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 	.accept_ra_rtr_pref	= 1,
 	.rtr_probe_interval	= 60 * HZ,
 #ifdef CONFIG_IPV6_ROUTE_INFO
+	.accept_ra_rt_info_min_plen = 0,
 	.accept_ra_rt_info_max_plen = 0,
 #endif
 #endif
@@ -3502,7 +3527,7 @@ static void addrconf_rs_timer(unsigned long data)
 	if (idev->if_flags & IF_RA_RCVD)
 		goto out;
 
-	if (idev->rs_probes++ < idev->cnf.rtr_solicits) {
+	if (idev->rs_probes++ < idev->cnf.rtr_solicits || idev->cnf.rtr_solicits < 0) {
 		write_unlock(&idev->lock);
 		if (!ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
 			ndisc_send_rs(dev, &lladdr,
@@ -3511,11 +3536,13 @@ static void addrconf_rs_timer(unsigned long data)
 			goto put;
 
 		write_lock(&idev->lock);
+		idev->rs_interval = rfc3315_s14_backoff_update(
+			idev->rs_interval, idev->cnf.rtr_solicit_max_interval);
 		/* The wait after the last probe can be shorter */
 		addrconf_mod_rs_timer(idev, (idev->rs_probes ==
 					     idev->cnf.rtr_solicits) ?
 				      idev->cnf.rtr_solicit_delay :
-				      idev->cnf.rtr_solicit_interval);
+				      idev->rs_interval);
 	} else {
 		/*
 		 * Note: we do not support deprecated "all on-link"
@@ -3743,7 +3770,7 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 	send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp);
 	send_rs = send_mld &&
 		  ipv6_accept_ra(ifp->idev) &&
-		  ifp->idev->cnf.rtr_solicits > 0 &&
+		  ifp->idev->cnf.rtr_solicits != 0 &&
 		  (dev->flags&IFF_LOOPBACK) == 0;
 	read_unlock_bh(&ifp->idev->lock);
 
@@ -3765,10 +3792,11 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 
 		write_lock_bh(&ifp->idev->lock);
 		spin_lock(&ifp->lock);
+		ifp->idev->rs_interval = rfc3315_s14_backoff_init(
+			ifp->idev->cnf.rtr_solicit_interval);
 		ifp->idev->rs_probes = 1;
 		ifp->idev->if_flags |= IF_RS_SENT;
-		addrconf_mod_rs_timer(ifp->idev,
-				      ifp->idev->cnf.rtr_solicit_interval);
+		addrconf_mod_rs_timer(ifp->idev, ifp->idev->rs_interval);
 		spin_unlock(&ifp->lock);
 		write_unlock_bh(&ifp->idev->lock);
 	}
@@ -4685,6 +4713,8 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_RTR_SOLICITS] = cnf->rtr_solicits;
 	array[DEVCONF_RTR_SOLICIT_INTERVAL] =
 		jiffies_to_msecs(cnf->rtr_solicit_interval);
+	array[DEVCONF_RTR_SOLICIT_MAX_INTERVAL] =
+		jiffies_to_msecs(cnf->rtr_solicit_max_interval);
 	array[DEVCONF_RTR_SOLICIT_DELAY] =
 		jiffies_to_msecs(cnf->rtr_solicit_delay);
 	array[DEVCONF_FORCE_MLD_VERSION] = cnf->force_mld_version;
@@ -4706,6 +4736,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 	array[DEVCONF_RTR_PROBE_INTERVAL] =
 		jiffies_to_msecs(cnf->rtr_probe_interval);
 #ifdef CONFIG_IPV6_ROUTE_INFO
+	array[DEVCONF_ACCEPT_RA_RT_INFO_MIN_PLEN] = cnf->accept_ra_rt_info_min_plen;
 	array[DEVCONF_ACCEPT_RA_RT_INFO_MAX_PLEN] = cnf->accept_ra_rt_info_max_plen;
 #endif
 #endif
@@ -4893,7 +4924,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
 		return -EINVAL;
 	if (!ipv6_accept_ra(idev))
 		return -EINVAL;
-	if (idev->cnf.rtr_solicits <= 0)
+	if (idev->cnf.rtr_solicits == 0)
 		return -EINVAL;
 
 	write_lock_bh(&idev->lock);
@@ -4918,8 +4949,10 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
 
 	if (update_rs) {
 		idev->if_flags |= IF_RS_SENT;
+		idev->rs_interval = rfc3315_s14_backoff_init(
+			idev->cnf.rtr_solicit_interval);
 		idev->rs_probes = 1;
-		addrconf_mod_rs_timer(idev, idev->cnf.rtr_solicit_interval);
+		addrconf_mod_rs_timer(idev, idev->rs_interval);
 	}
 
 	/* Well, that's kinda nasty ... */
@@ -5557,6 +5590,13 @@ static struct addrconf_sysctl_table
 			.proc_handler	= proc_dointvec_jiffies,
 		},
 		{
+			.procname	= "router_solicitation_max_interval",
+			.data		= &ipv6_devconf.rtr_solicit_max_interval,
+			.maxlen		= sizeof(int),
+			.mode		= 0644,
+			.proc_handler	= proc_dointvec_jiffies,
+		},
+		{
 			.procname	= "router_solicitation_delay",
 			.data		= &ipv6_devconf.rtr_solicit_delay,
 			.maxlen		= sizeof(int),
@@ -5666,6 +5706,13 @@ static struct addrconf_sysctl_table
 		},
 #ifdef CONFIG_IPV6_ROUTE_INFO
 		{
+			.procname	= "accept_ra_rt_info_min_plen",
+			.data		= &ipv6_devconf.accept_ra_rt_info_min_plen,
+			.maxlen		= sizeof(int),
+			.mode		= 0644,
+			.proc_handler	= proc_dointvec,
+		},
+		{
 			.procname	= "accept_ra_rt_info_max_plen",
 			.data		= &ipv6_devconf.accept_ra_rt_info_max_plen,
 			.maxlen		= sizeof(int),
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 34cf46d74554..85bf86458706 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -903,6 +903,8 @@ add:
 			ins = &rt->dst.rt6_next;
 			iter = *ins;
 			while (iter) {
+				if (iter->rt6i_metric > rt->rt6i_metric)
+					break;
 				if (rt6_qualify_for_ecmp(iter)) {
 					*ins = iter->dst.rt6_next;
 					fib6_purge_rt(iter, fn, info->nl_net);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index cd96a01032a2..cf90a9bf26a3 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -742,13 +742,14 @@ slow_path:
 	 *	Fragment the datagram.
 	 */
 
-	*prevhdr = NEXTHDR_FRAGMENT;
 	troom = rt->dst.dev->needed_tailroom;
 
 	/*
 	 *	Keep copying data until we run out.
 	 */
 	while (left > 0)	{
+		u8 *fragnexthdr_offset;
+
 		len = left;
 		/* IF: it doesn't fit, use 'mtu' - the data space left */
 		if (len > mtu)
@@ -793,6 +794,10 @@ slow_path:
 		 */
 		skb_copy_from_linear_data(skb, skb_network_header(frag), hlen);
 
+		fragnexthdr_offset = skb_network_header(frag);
+		fragnexthdr_offset += prevhdr - skb_network_header(skb);
+		*fragnexthdr_offset = NEXTHDR_FRAGMENT;
+
 		/*
 		 *	Build fragment header.
 		 */
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 24fb9c0efd00..5b7433887eda 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -681,6 +681,10 @@ vti6_parm_to_user(struct ip6_tnl_parm2 *u, const struct __ip6_tnl_parm *p)
 	u->link = p->link;
 	u->i_key = p->i_key;
 	u->o_key = p->o_key;
+	if (u->i_key)
+		u->i_flags |= GRE_KEY;
+	if (u->o_key)
+		u->o_flags |= GRE_KEY;
 	u->proto = p->proto;
 
 	memcpy(u->name, p->name, sizeof(u->name));
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 84afb9a77278..3452f9037ad4 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1358,6 +1358,8 @@ skip_linkparms:
 			if (ri->prefix_len == 0 &&
 			    !in6_dev->cnf.accept_ra_defrtr)
 				continue;
+			if (ri->prefix_len < in6_dev->cnf.accept_ra_rt_info_min_plen)
+				continue;
 			if (ri->prefix_len > in6_dev->cnf.accept_ra_rt_info_max_plen)
 				continue;
 			rt6_route_rcv(skb->dev, (u8 *)p, (p->nd_opt_len) << 3,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 108b39967694..8532768b4eaa 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -377,10 +377,12 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	np = inet6_sk(sk);
 
 	if (type == NDISC_REDIRECT) {
-		struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
+		if (!sock_owned_by_user(sk)) {
+			struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 
-		if (dst)
-			dst->ops->redirect(dst, sk, skb);
+			if (dst)
+				dst->ops->redirect(dst, sk, skb);
+		}
 		goto out;
 	}