8 files changed, 55 insertions, 36 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index a225d5ee3c2f..6b8ebc5da0e1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -434,6 +434,10 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         /* Join all-node multicast group */
         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
 
+        /* Join all-router multicast group if forwarding is set */
+        if (ndev->cnf.forwarding && dev && (dev->flags & IFF_MULTICAST))
+                ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
+
         return ndev;
 }
 
@@ -502,29 +506,31 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
         rcu_read_unlock();
 }
 
-static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
+static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int newf)
 {
         struct net *net;
+        int old;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
 
         net = (struct net *)table->extra2;
-        if (p == &net->ipv6.devconf_dflt->forwarding)
-                return 0;
+        old = *p;
+        *p = newf;
 
-        if (!rtnl_trylock()) {
-                /* Restore the original values before restarting */
-                *p = old;
-                return restart_syscall();
+        if (p == &net->ipv6.devconf_dflt->forwarding) {
+                rtnl_unlock();
+                return 0;
         }
 
         if (p == &net->ipv6.devconf_all->forwarding) {
-                __s32 newf = net->ipv6.devconf_all->forwarding;
                 net->ipv6.devconf_dflt->forwarding = newf;
                 addrconf_forward_change(net, newf);
-        } else if ((!*p) ^ (!old))
+        } else if ((!newf) ^ (!old))
                 dev_forward_change((struct inet6_dev *)table->extra1);
         rtnl_unlock();
 
-        if (*p)
+        if (newf)
                 rt6_purge_dflt_routers(net);
         return 1;
 }
@@ -4260,9 +4266,17 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
+        ctl_table lctl;
         int ret;
 
-        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        /*
+         * ctl->data points to idev->cnf.forwarding, we should
+         * not modify it until we get the rtnl lock.
+         */
+        lctl = *ctl;
+        lctl.data = &val;
+
+        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_fixup_forwarding(ctl, valp, val);
@@ -4300,26 +4314,27 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
         rcu_read_unlock();
 }
 
-static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
+static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
 {
         struct net *net;
+        int old;
+
+        if (!rtnl_trylock())
+                return restart_syscall();
 
         net = (struct net *)table->extra2;
+        old = *p;
+        *p = newf;
 
-        if (p == &net->ipv6.devconf_dflt->disable_ipv6)
+        if (p == &net->ipv6.devconf_dflt->disable_ipv6) {
+                rtnl_unlock();
                 return 0;
-
-        if (!rtnl_trylock()) {
-                /* Restore the original values before restarting */
-                *p = old;
-                return restart_syscall();
         }
 
         if (p == &net->ipv6.devconf_all->disable_ipv6) {
-                __s32 newf = net->ipv6.devconf_all->disable_ipv6;
                 net->ipv6.devconf_dflt->disable_ipv6 = newf;
                 addrconf_disable_change(net, newf);
-        } else if ((!*p) ^ (!old))
+        } else if ((!newf) ^ (!old))
                 dev_disable_change((struct inet6_dev *)table->extra1);
 
         rtnl_unlock();
@@ -4333,9 +4348,17 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
         int *valp = ctl->data;
         int val = *valp;
         loff_t pos = *ppos;
+        ctl_table lctl;
         int ret;
 
-        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
+        /*
+         * ctl->data points to idev->cnf.disable_ipv6, we should
+         * not modify it until we get the rtnl lock.
+         */
+        lctl = *ctl;
+        lctl.data = &val;
+
+        ret = proc_dointvec(&lctl, write, buffer, lenp, ppos);
 
         if (write)
                 ret = addrconf_disable_ipv6(ctl, valp, val);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c7e95c8c579f..5aa3981a3922 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1926,8 +1926,10 @@ static int ip6mr_forward2(struct net *net, struct mr6_table *mrt,
         };
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (!dst)
+        if (dst->error) {
+                dst_release(dst);
                 goto out_free;
+        }
 
         skb_dst_drop(skb);
         skb_dst_set(skb, dst);
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index b853f06cc148..16c33e308121 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -257,7 +257,6 @@ static struct inet6_dev *ip6_mc_find_dev_rcu(struct net *net,
 
                 if (rt) {
                         dev = rt->dst.dev;
-                        dev_hold(dev);
                         dst_release(&rt->dst);
                 }
         } else
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index d8f02ef88e59..c964958ac470 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1545,9 +1545,10 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                          &saddr_buf, &ipv6_hdr(skb)->saddr, dev->ifindex);
 
         dst = ip6_route_output(net, NULL, &fl6);
-        if (dst == NULL)
+        if (dst->error) {
+                dst_release(dst);
                 return;
-
+        }
         dst = xfrm_lookup(net, dst, flowi6_to_flowi(&fl6), NULL, 0);
         if (IS_ERR(dst))
                 return;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8c2e3ab58f2a..22b766407de1 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1077,7 +1077,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         struct net *net = dev_net(dev);
 
         if (unlikely(!idev))
-                return NULL;
+                return ERR_PTR(-ENODEV);
 
         rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops, dev, 0);
         if (unlikely(!rt)) {
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 906c7ca43542..3edd05ae4388 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1083,7 +1083,7 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 
 #ifdef CONFIG_TCP_MD5SIG
         if (sk)
-                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr);
+                key = tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->saddr);
 #endif
 
         if (th->ack)
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index a81ce9450750..9949a356d62c 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -80,7 +80,6 @@ static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *ip6h;
-        const unsigned char *old_mac;
         int size = sizeof(struct ipv6hdr);
         int err;
 
@@ -90,10 +89,7 @@ static int xfrm6_beet_input(struct xfrm_state *x, struct sk_buff *skb)
 
         __skb_push(skb, size);
         skb_reset_network_header(skb);
-
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
+        skb_mac_header_rebuild(skb);
 
         xfrm6_beet_make_header(skb);
 
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 261e6e6f487e..9f2095b19ad0 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -63,7 +63,6 @@ static int xfrm6_mode_tunnel_output(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 {
         int err = -EINVAL;
-        const unsigned char *old_mac;
 
         if (XFRM_MODE_SKB_CB(skb)->protocol != IPPROTO_IPV6)
                 goto out;
@@ -80,10 +79,9 @@ static int xfrm6_mode_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
         if (!(x->props.flags & XFRM_STATE_NOECN))
                 ipip6_ecn_decapsulate(skb);
 
-        old_mac = skb_mac_header(skb);
-        skb_set_mac_header(skb, -skb->mac_len);
-        memmove(skb_mac_header(skb), old_mac, skb->mac_len);
         skb_reset_network_header(skb);
+        skb_mac_header_rebuild(skb);
+
         err = 0;
 
 out: