--- /dev/null
+From stable-bounces@linux.kernel.org Mon Nov 21 02:06:57 2005
+Date: Mon, 21 Nov 2005 19:07:33 +0900 (JST)
+Message-Id: <20051121.190733.72492452.yoshfuji@linux-ipv6.org>
+To: stable@kernel.org
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Cc: yoshfuji@linux-ipv6.org, netdev-core@vger.kernel.org
+Subject: [PATCH] [IPV6]: Fix calculation of AH length during filling ancillary data.
+
+From: Ville Nuorvala <vnuorval@tcs.hut.fi>
+
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Signed-off-by: Chris Wright <chrisw@osdl.org>
+---
+
+ net/ipv6/datagram.c | 2 +-
+ 1 files changed, 1 insertion(+), 1 deletion(-)
+
+Index: linux-2.6.14.y/net/ipv6/datagram.c
+===================================================================
+--- linux-2.6.14.y.orig/net/ipv6/datagram.c
++++ linux-2.6.14.y/net/ipv6/datagram.c
+@@ -437,7 +437,7 @@ int datagram_recv_ctl(struct sock *sk, s
+ break;
+ case IPPROTO_AH:
+ nexthdr = ptr[0];
+- len = (ptr[1] + 1) << 2;
++ len = (ptr[1] + 2) << 2;
+ break;
+ default:
+ nexthdr = ptr[0];
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Nov 21 02:06:49 2005
+Date: Mon, 21 Nov 2005 19:07:25 +0900 (JST)
+Message-Id: <20051121.190725.16741184.yoshfuji@linux-ipv6.org>
+To: stable@kernel.org
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Cc: yoshfuji@linux-ipv6.org
+Subject: [PATCH] [IPV6]: Fix memory management error during setting up new advapi sockopts.
+
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Signed-off-by: Chris Wright <chrisw@osdl.org>
+---
+
+ net/ipv6/exthdrs.c | 3 ++-
+ 1 files changed, 2 insertions(+), 1 deletion(-)
+
+Index: linux-2.6.14.y/net/ipv6/exthdrs.c
+===================================================================
+--- linux-2.6.14.y.orig/net/ipv6/exthdrs.c
++++ linux-2.6.14.y/net/ipv6/exthdrs.c
+@@ -628,6 +628,7 @@ ipv6_renew_options(struct sock *sk, stru
+ if (!tot_len)
+ return NULL;
+
++ tot_len += sizeof(*opt2);
+ opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
+ if (!opt2)
+ return ERR_PTR(-ENOBUFS);
+@@ -668,7 +669,7 @@ ipv6_renew_options(struct sock *sk, stru
+
+ return opt2;
+ out:
+- sock_kfree_s(sk, p, tot_len);
++ sock_kfree_s(sk, opt2, opt2->tot_len);
+ return ERR_PTR(err);
+ }
+
--- /dev/null
+From stable-bounces@linux.kernel.org Mon Nov 21 02:07:06 2005
+Date: Mon, 21 Nov 2005 19:07:40 +0900 (JST)
+Message-Id: <20051121.190740.64964243.yoshfuji@linux-ipv6.org>
+To: stable@kernel.org
+From: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Cc: yoshfuji@linux-ipv6.org
+Subject: [PATCH] [IPV6]: Fix sending extension headers before and including routing header.
+
+Based on suggestion from Masahide Nakamura <nakam@linux-ipv6.org>.
+
+Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
+Signed-off-by: Chris Wright <chrisw@osdl.org>
+---
+
+ include/net/ipv6.h | 2 ++
+ net/ipv6/exthdrs.c | 19 +++++++++++++++++++
+ net/ipv6/ip6_flowlabel.c | 16 ++++++----------
+ net/ipv6/raw.c | 4 +++-
+ net/ipv6/udp.c | 4 +++-
+ 5 files changed, 33 insertions(+), 12 deletions(-)
+
+Index: linux-2.6.14.y/include/net/ipv6.h
+===================================================================
+--- linux-2.6.14.y.orig/include/net/ipv6.h
++++ linux-2.6.14.y/include/net/ipv6.h
+@@ -237,6 +237,8 @@ extern struct ipv6_txoptions * ipv6_rene
+ int newtype,
+ struct ipv6_opt_hdr __user *newopt,
+ int newoptlen);
++struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
++ struct ipv6_txoptions *opt);
+
+ extern int ip6_frag_nqueues;
+ extern atomic_t ip6_frag_mem;
+Index: linux-2.6.14.y/net/ipv6/exthdrs.c
+===================================================================
+--- linux-2.6.14.y.orig/net/ipv6/exthdrs.c
++++ linux-2.6.14.y/net/ipv6/exthdrs.c
+@@ -673,3 +673,22 @@ out:
+ return ERR_PTR(err);
+ }
+
++struct ipv6_txoptions *ipv6_fixup_options(struct ipv6_txoptions *opt_space,
++ struct ipv6_txoptions *opt)
++{
++ /*
++ * ignore the dest before srcrt unless srcrt is being included.
++ * --yoshfuji
++ */
++ if (opt && opt->dst0opt && !opt->srcrt) {
++ if (opt_space != opt) {
++ memcpy(opt_space, opt, sizeof(*opt_space));
++ opt = opt_space;
++ }
++ opt->opt_nflen -= ipv6_optlen(opt->dst0opt);
++ opt->dst0opt = NULL;
++ }
++
++ return opt;
++}
++
+Index: linux-2.6.14.y/net/ipv6/ip6_flowlabel.c
+===================================================================
+--- linux-2.6.14.y.orig/net/ipv6/ip6_flowlabel.c
++++ linux-2.6.14.y/net/ipv6/ip6_flowlabel.c
+@@ -225,20 +225,16 @@ struct ipv6_txoptions *fl6_merge_options
+ struct ip6_flowlabel * fl,
+ struct ipv6_txoptions * fopt)
+ {
+- struct ipv6_txoptions * fl_opt = fl ? fl->opt : NULL;
+-
+- if (fopt == NULL || fopt->opt_flen == 0) {
+- if (!fl_opt || !fl_opt->dst0opt || fl_opt->srcrt)
+- return fl_opt;
+- }
+-
++ struct ipv6_txoptions * fl_opt = fl->opt;
++
++ if (fopt == NULL || fopt->opt_flen == 0)
++ return fl_opt;
++
+ if (fl_opt != NULL) {
+ opt_space->hopopt = fl_opt->hopopt;
+- opt_space->dst0opt = fl_opt->srcrt ? fl_opt->dst0opt : NULL;
++ opt_space->dst0opt = fl_opt->dst0opt;
+ opt_space->srcrt = fl_opt->srcrt;
+ opt_space->opt_nflen = fl_opt->opt_nflen;
+- if (fl_opt->dst0opt && !fl_opt->srcrt)
+- opt_space->opt_nflen -= ipv6_optlen(fl_opt->dst0opt);
+ } else {
+ if (fopt->opt_nflen == 0)
+ return fopt;
+Index: linux-2.6.14.y/net/ipv6/raw.c
+===================================================================
+--- linux-2.6.14.y.orig/net/ipv6/raw.c
++++ linux-2.6.14.y/net/ipv6/raw.c
+@@ -756,7 +756,9 @@ static int rawv6_sendmsg(struct kiocb *i
+ }
+ if (opt == NULL)
+ opt = np->opt;
+- opt = fl6_merge_options(&opt_space, flowlabel, opt);
++ if (flowlabel)
++ opt = fl6_merge_options(&opt_space, flowlabel, opt);
++ opt = ipv6_fixup_options(&opt_space, opt);
+
+ fl.proto = proto;
+ rawv6_probe_proto_opt(&fl, msg);
+Index: linux-2.6.14.y/net/ipv6/udp.c
+===================================================================
+--- linux-2.6.14.y.orig/net/ipv6/udp.c
++++ linux-2.6.14.y/net/ipv6/udp.c
+@@ -778,7 +778,9 @@ do_udp_sendmsg:
+ }
+ if (opt == NULL)
+ opt = np->opt;
+- opt = fl6_merge_options(&opt_space, flowlabel, opt);
++ if (flowlabel)
++ opt = fl6_merge_options(&opt_space, flowlabel, opt);
++ opt = ipv6_fixup_options(&opt_space, opt);
+
+ fl->proto = IPPROTO_UDP;
+ ipv6_addr_copy(&fl->fl6_dst, daddr);