18 files changed, 167 insertions, 99 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8eeec6eb2bd3..72ffd3d760ff 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1165,7 +1165,8 @@ check_cleanup_prefix_route(struct inet6_ifaddr *ifp, unsigned long *expires)
        list_for_each_entry(ifa, &idev->addr_list, if_list) {
                if (ifa == ifp)
                        continue;
-                if (!ipv6_prefix_equal(&ifa->addr, &ifp->addr,
+                if (ifa->prefix_len != ifp->prefix_len ||
+                    !ipv6_prefix_equal(&ifa->addr, &ifp->addr,
                                       ifp->prefix_len))
                        continue;
                if (ifa->flags & (IFA_F_PERMANENT | IFA_F_NOPREFIXROUTE))
@@ -3495,8 +3496,8 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                        if (!addrconf_link_ready(dev)) {
                                /* device is not ready yet. */
-                                pr_info("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
+                                pr_debug("ADDRCONF(NETDEV_UP): %s: link is not ready\n",
-                                        dev->name);
+                                         dev->name);
                                break;
                        }
@@ -5120,6 +5121,8 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                        if (idev) {
                                err = in6_dump_addrs(idev, skb, cb, s_ip_idx,
                                                     &fillargs);
+                                if (err > 0)
+                                        err = 0;
                        }
                        goto put_tgt_net;
                }
@@ -5154,7 +5157,7 @@ put_tgt_net:
        if (fillargs.netnsid >= 0)
                put_net(tgt_net);
-        return err < 0 ? err : skb->len;
+        return skb->len ? : err;
 }
 static int inet6_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 0bfb6cc0a30a..d99753b5e39b 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -310,6 +310,7 @@ static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
        /* Check if the address belongs to the host. */
        if (addr_type == IPV6_ADDR_MAPPED) {
+                struct net_device *dev = NULL;
                int chk_addr_ret;
                /* Binding to v4-mapped address on a v6-only socket
@@ -320,9 +321,20 @@ static int __inet6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len,
                        goto out;
                }
+                rcu_read_lock();
+                if (sk->sk_bound_dev_if) {
+                        dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
+                        if (!dev) {
+                                err = -ENODEV;
+                                goto out_unlock;
+                        }
+                }
                /* Reproduce AF_INET checks to make the bindings consistent */
                v4addr = addr->sin6_addr.s6_addr32[3];
-                chk_addr_ret = inet_addr_type(net, v4addr);
+                chk_addr_ret = inet_addr_type_dev_table(net, dev, v4addr);
+                rcu_read_unlock();
                if (!inet_can_nonlocal_bind(net, inet) &&
                    v4addr != htonl(INADDR_ANY) &&
                    chk_addr_ret != RTN_LOCAL &&
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index bde08aa549f3..ee4a4e54d016 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -341,6 +341,7 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 info)
        skb_reset_network_header(skb);
        iph = ipv6_hdr(skb);
        iph->daddr = fl6->daddr;
+        ip6_flow_hdr(iph, 0, 0);
        serr = SKB_EXT_ERR(skb);
        serr->ee.ee_errno = err;
@@ -700,17 +701,15 @@ void ip6_datagram_recv_specific_ctl(struct sock *sk, struct msghdr *msg,
        }
        if (np->rxopt.bits.rxorigdstaddr) {
                struct sockaddr_in6 sin6;
-                __be16 *ports;
+                __be16 _ports[2], *ports;
-                int end;
-                end = skb_transport_offset(skb) + 4;
+                ports = skb_header_pointer(skb, skb_transport_offset(skb),
-                if (end <= 0 || pskb_may_pull(skb, end)) {
+                                           sizeof(_ports), &_ports);
+                if (ports) {
                        /* All current transport protocols have the port numbers in the
                         * first four bytes of the transport header and this function is
                         * written with this assumption in mind.
                         */
-                        ports = (__be16 *)skb_transport_header(skb);
                        sin6.sin6_family = AF_INET6;
                        sin6.sin6_addr = ipv6_hdr(skb)->daddr;
                        sin6.sin6_port = ports[1];
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 5afe9f83374d..239d4a65ad6e 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -296,7 +296,7 @@ int esp6_output_head(struct xfrm_state *x, struct sk_buff *skb, struct esp_info
                        skb->len += tailen;
                        skb->data_len += tailen;
                        skb->truesize += tailen;
-                        if (sk)
+                        if (sk && sk_fullsock(sk))
                                refcount_add(tailen, &sk->sk_wmem_alloc);
                        goto out;
diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index bd675c61deb1..867474abe269 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -72,7 +72,7 @@ static int gue6_build_header(struct sk_buff *skb, struct ip_tunnel_encap *e,
 static int gue6_err_proto_handler(int proto, struct sk_buff *skb,
                                  struct inet6_skb_parm *opt,
-                                  u8 type, u8 code, int offset, u32 info)
+                                  u8 type, u8 code, int offset, __be32 info)
 {
        const struct inet6_protocol *ipprot;
@@ -90,10 +90,11 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
        int transport_offset = skb_transport_offset(skb);
        struct guehdr *guehdr;
-        size_t optlen;
+        size_t len, optlen;
        int ret;
-        if (skb->len < sizeof(struct udphdr) + sizeof(struct guehdr))
+        len = sizeof(struct udphdr) + sizeof(struct guehdr);
+        if (!pskb_may_pull(skb, len))
                return -EINVAL;
        guehdr = (struct guehdr *)&udp_hdr(skb)[1];
@@ -128,9 +129,21 @@ static int gue6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        optlen = guehdr->hlen << 2;
+        if (!pskb_may_pull(skb, len + optlen))
+                return -EINVAL;
+        guehdr = (struct guehdr *)&udp_hdr(skb)[1];
        if (validate_gue_flags(guehdr, optlen))
                return -EINVAL;
+        /* Handling exceptions for direct UDP encapsulation in GUE would lead to
+         * recursion. Besides, this kind of encapsulation can't even be
+         * configured currently. Discard this.
+         */
+        if (guehdr->proto_ctype == IPPROTO_UDP ||
+            guehdr->proto_ctype == IPPROTO_UDPLITE)
+                return -EOPNOTSUPP;
        skb_set_transport_header(skb, -(int)sizeof(struct icmp6hdr));
        ret = gue6_err_proto_handler(guehdr->proto_ctype, skb,
                                     opt, type, code, offset, info);
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 5d7aa2c2770c..bbcdfd299692 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -423,10 +423,10 @@ static int icmp6_iif(const struct sk_buff *skb)
 static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
                       const struct in6_addr *force_saddr)
 {
-        struct net *net = dev_net(skb->dev);
        struct inet6_dev *idev = NULL;
        struct ipv6hdr *hdr = ipv6_hdr(skb);
        struct sock *sk;
+        struct net *net;
        struct ipv6_pinfo *np;
        const struct in6_addr *saddr = NULL;
        struct dst_entry *dst;
@@ -437,12 +437,16 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
        int iif = 0;
        int addr_type = 0;
        int len;
-        u32 mark = IP6_REPLY_MARK(net, skb->mark);
+        u32 mark;
        if ((u8 *)hdr < skb->head ||
            (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
                return;
+        if (!skb->dev)
+                return;
+        net = dev_net(skb->dev);
+        mark = IP6_REPLY_MARK(net, skb->mark);
        /*
         *      Make sure we respect the rules
         *      i.e. RFC 1885 2.4(e)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 09d0826742f8..26f25b6e2833 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -534,13 +534,9 @@ static int ip6erspan_rcv(struct sk_buff *skb, int gre_hdr_len,
        struct ip6_tnl *tunnel;
        u8 ver;
-        if (unlikely(!pskb_may_pull(skb, sizeof(*ershdr))))
-                return PACKET_REJECT;
        ipv6h = ipv6_hdr(skb);
        ershdr = (struct erspan_base_hdr *)skb->data;
        ver = ershdr->ver;
-        tpi->key = cpu_to_be32(get_session_id(ershdr));
        tunnel = ip6gre_tunnel_lookup(skb->dev,
                                      &ipv6h->saddr, &ipv6h->daddr, tpi->key,
@@ -922,6 +918,7 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
        __u8 dsfield = false;
        struct flowi6 fl6;
        int err = -EINVAL;
+        __be16 proto;
        __u32 mtu;
        int nhoff;
        int thoff;
@@ -1035,8 +1032,9 @@ static netdev_tx_t ip6erspan_tunnel_xmit(struct sk_buff *skb,
        }
        /* Push GRE header. */
-        gre_build_header(skb, 8, TUNNEL_SEQ,
+        proto = (t->parms.erspan_ver == 1) ? htons(ETH_P_ERSPAN)
-                         htons(ETH_P_ERSPAN), 0, htonl(t->o_seqno++));
+                                           : htons(ETH_P_ERSPAN2);
+        gre_build_header(skb, 8, TUNNEL_SEQ, proto, 0, htonl(t->o_seqno++));
        /* TooBig packet may have updated dst->dev's mtu */
        if (!t->parms.collect_md && dst && dst_mtu(dst) > dst->dev->mtu)
@@ -1169,6 +1167,10 @@ static void ip6gre_tnl_copy_tnl_parm(struct ip6_tnl *t,
        t->parms.i_flags = p->i_flags;
        t->parms.o_flags = p->o_flags;
        t->parms.fwmark = p->fwmark;
+        t->parms.erspan_ver = p->erspan_ver;
+        t->parms.index = p->index;
+        t->parms.dir = p->dir;
+        t->parms.hwid = p->hwid;
        dst_cache_reset(&t->dst_cache);
 }
@@ -1717,6 +1719,27 @@ static int ip6erspan_tap_validate(struct nlattr *tb[], struct nlattr *data[],
        return 0;
 }
+static void ip6erspan_set_version(struct nlattr *data[],
+                                  struct __ip6_tnl_parm *parms)
+{
+        if (!data)
+                return;
+        parms->erspan_ver = 1;
+        if (data[IFLA_GRE_ERSPAN_VER])
+                parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
+        if (parms->erspan_ver == 1) {
+                if (data[IFLA_GRE_ERSPAN_INDEX])
+                        parms->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
+        } else if (parms->erspan_ver == 2) {
+                if (data[IFLA_GRE_ERSPAN_DIR])
+                        parms->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
+                if (data[IFLA_GRE_ERSPAN_HWID])
+                        parms->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
+        }
+}
 static void ip6gre_netlink_parms(struct nlattr *data[],
                                struct __ip6_tnl_parm *parms)
 {
@@ -1765,20 +1788,6 @@ static void ip6gre_netlink_parms(struct nlattr *data[],
        if (data[IFLA_GRE_COLLECT_METADATA])
                parms->collect_md = true;
-        parms->erspan_ver = 1;
-        if (data[IFLA_GRE_ERSPAN_VER])
-                parms->erspan_ver = nla_get_u8(data[IFLA_GRE_ERSPAN_VER]);
-        if (parms->erspan_ver == 1) {
-                if (data[IFLA_GRE_ERSPAN_INDEX])
-                        parms->index = nla_get_u32(data[IFLA_GRE_ERSPAN_INDEX]);
-        } else if (parms->erspan_ver == 2) {
-                if (data[IFLA_GRE_ERSPAN_DIR])
-                        parms->dir = nla_get_u8(data[IFLA_GRE_ERSPAN_DIR]);
-                if (data[IFLA_GRE_ERSPAN_HWID])
-                        parms->hwid = nla_get_u16(data[IFLA_GRE_ERSPAN_HWID]);
-        }
 }
 static int ip6gre_tap_init(struct net_device *dev)
@@ -2025,9 +2034,9 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
                             struct nlattr *data[],
                             struct netlink_ext_ack *extack)
 {
-        struct ip6gre_net *ign = net_generic(dev_net(dev), ip6gre_net_id);
+        struct ip6_tnl *t = netdev_priv(dev);
+        struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
        struct __ip6_tnl_parm p;
-        struct ip6_tnl *t;
        t = ip6gre_changelink_common(dev, tb, data, &p, extack);
        if (IS_ERR(t))
@@ -2096,12 +2105,31 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
 {
        struct ip6_tnl *t = netdev_priv(dev);
        struct __ip6_tnl_parm *p = &t->parms;
+        __be16 o_flags = p->o_flags;
+        if (p->erspan_ver == 1 || p->erspan_ver == 2) {
+                if (!p->collect_md)
+                        o_flags |= TUNNEL_KEY;
+                if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
+                        goto nla_put_failure;
+                if (p->erspan_ver == 1) {
+                        if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
+                                goto nla_put_failure;
+                } else {
+                        if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
+                                goto nla_put_failure;
+                        if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
+                                goto nla_put_failure;
+                }
+        }
        if (nla_put_u32(skb, IFLA_GRE_LINK, p->link) ||
            nla_put_be16(skb, IFLA_GRE_IFLAGS,
                         gre_tnl_flags_to_gre_flags(p->i_flags)) ||
            nla_put_be16(skb, IFLA_GRE_OFLAGS,
-                         gre_tnl_flags_to_gre_flags(p->o_flags)) ||
+                         gre_tnl_flags_to_gre_flags(o_flags)) ||
            nla_put_be32(skb, IFLA_GRE_IKEY, p->i_key) ||
            nla_put_be32(skb, IFLA_GRE_OKEY, p->o_key) ||
            nla_put_in6_addr(skb, IFLA_GRE_LOCAL, &p->laddr) ||
@@ -2110,8 +2138,7 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
            nla_put_u8(skb, IFLA_GRE_ENCAP_LIMIT, p->encap_limit) ||
            nla_put_be32(skb, IFLA_GRE_FLOWINFO, p->flowinfo) ||
            nla_put_u32(skb, IFLA_GRE_FLAGS, p->flags) ||
-            nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark) ||
+            nla_put_u32(skb, IFLA_GRE_FWMARK, p->fwmark))
-            nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
                goto nla_put_failure;
        if (nla_put_u16(skb, IFLA_GRE_ENCAP_TYPE,
@@ -2129,19 +2156,6 @@ static int ip6gre_fill_info(struct sk_buff *skb, const struct net_device *dev)
                        goto nla_put_failure;
        }
-        if (nla_put_u8(skb, IFLA_GRE_ERSPAN_VER, p->erspan_ver))
-                goto nla_put_failure;
-        if (p->erspan_ver == 1) {
-                if (nla_put_u32(skb, IFLA_GRE_ERSPAN_INDEX, p->index))
-                        goto nla_put_failure;
-        } else if (p->erspan_ver == 2) {
-                if (nla_put_u8(skb, IFLA_GRE_ERSPAN_DIR, p->dir))
-                        goto nla_put_failure;
-                if (nla_put_u16(skb, IFLA_GRE_ERSPAN_HWID, p->hwid))
-                        goto nla_put_failure;
-        }
        return 0;
 nla_put_failure:
@@ -2196,6 +2210,7 @@ static int ip6erspan_newlink(struct net *src_net, struct net_device *dev,
        int err;
        ip6gre_netlink_parms(data, &nt->parms);
+        ip6erspan_set_version(data, &nt->parms);
        ign = net_generic(net, ip6gre_net_id);
        if (nt->parms.collect_md) {
@@ -2241,6 +2256,7 @@ static int ip6erspan_changelink(struct net_device *dev, struct nlattr *tb[],
        if (IS_ERR(t))
                return PTR_ERR(t);
+        ip6erspan_set_version(data, &p);
        ip6gre_tunnel_unlink_md(ign, t);
        ip6gre_tunnel_unlink(ign, t);
        ip6erspan_tnl_change(t, &p, !tb[IFLA_MTU]);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 30337b38274b..cc01aa3f2b5e 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1516,6 +1516,9 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                        continue;
                rhltable_remove(&mrt->mfc_hash, &c->mnode, ip6mr_rht_params);
                list_del_rcu(&c->list);
+                call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
+                                               FIB_EVENT_ENTRY_DEL,
+                                               (struct mfc6_cache *)c, mrt->id);
                mr6_netlink_event(mrt, (struct mfc6_cache *)c, RTM_DELROUTE);
                mr_cache_put(c);
        }
@@ -1524,10 +1527,6 @@ static void mroute_clean_tables(struct mr_table *mrt, bool all)
                spin_lock_bh(&mfc_unres_lock);
                list_for_each_entry_safe(c, tmp, &mrt->mfc_unres_queue, list) {
                        list_del(&c->list);
-                        call_ip6mr_mfc_entry_notifiers(read_pnet(&mrt->net),
-                                                       FIB_EVENT_ENTRY_DEL,
-                                                       (struct mfc6_cache *)c,
-                                                       mrt->id);
                        mr6_netlink_event(mrt, (struct mfc6_cache *)c,
                                          RTM_DELROUTE);
                        ip6mr_destroy_unres(mrt, (struct mfc6_cache *)c);
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 8b075f0bc351..6d0b1f3e927b 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -23,9 +23,11 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
        struct sock *sk = sk_to_full_sk(skb->sk);
        unsigned int hh_len;
        struct dst_entry *dst;
+        int strict = (ipv6_addr_type(&iph->daddr) &
+                      (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
        struct flowi6 fl6 = {
                .flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
-                        rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
+                        strict ? skb_dst(skb)->dev->ifindex : 0,
                .flowi6_mark = skb->mark,
                .flowi6_uid = sock_net_uid(net, sk),
                .daddr = iph->daddr,
diff --git a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
index 23022447eb49..7a41ee3c11b4 100644
--- a/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
@@ -226,6 +226,7 @@ int nf_nat_icmpv6_reply_translation(struct sk_buff *skb,
        }
        nf_ct_invert_tuplepr(&target, &ct->tuplehash[!dir].tuple);
+        target.dst.protonum = IPPROTO_ICMPV6;
        if (!nf_nat_ipv6_manip_pkt(skb, 0, &target, manip))
                return 0;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 40b225f87d5e..ce15dc4ccbfa 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1274,18 +1274,29 @@ static DEFINE_SPINLOCK(rt6_exception_lock);
 static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
                                 struct rt6_exception *rt6_ex)
 {
+        struct fib6_info *from;
        struct net *net;
        if (!bucket || !rt6_ex)
                return;
        net = dev_net(rt6_ex->rt6i->dst.dev);
+        net->ipv6.rt6_stats->fib_rt_cache--;
+        /* purge completely the exception to allow releasing the held resources:
+         * some [sk] cache may keep the dst around for unlimited time
+         */
+        from = rcu_dereference_protected(rt6_ex->rt6i->from,
+                                         lockdep_is_held(&rt6_exception_lock));
+        rcu_assign_pointer(rt6_ex->rt6i->from, NULL);
+        fib6_info_release(from);
+        dst_dev_put(&rt6_ex->rt6i->dst);
        hlist_del_rcu(&rt6_ex->hlist);
        dst_release(&rt6_ex->rt6i->dst);
        kfree_rcu(rt6_ex, rcu);
        WARN_ON_ONCE(!bucket->depth);
        bucket->depth--;
-        net->ipv6.rt6_stats->fib_rt_cache--;
 }
 /* Remove oldest rt6_ex in bucket and free the memory
@@ -1599,15 +1610,15 @@ static int rt6_remove_exception_rt(struct rt6_info *rt)
 static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
 {
        struct rt6_exception_bucket *bucket;
-        struct fib6_info *from = rt->from;
        struct in6_addr *src_key = NULL;
        struct rt6_exception *rt6_ex;
+        struct fib6_info *from;
-        if (!from ||
-            !(rt->rt6i_flags & RTF_CACHE))
-                return;
        rcu_read_lock();
+        from = rcu_dereference(rt->from);
+        if (!from || !(rt->rt6i_flags & RTF_CACHE))
+                goto unlock;
        bucket = rcu_dereference(from->rt6i_exception_bucket);
 #ifdef CONFIG_IPV6_SUBTREES
@@ -1626,6 +1637,7 @@ static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
        if (rt6_ex)
                rt6_ex->stamp = jiffies;
+unlock:
        rcu_read_unlock();
 }
@@ -2742,20 +2754,24 @@ static int ip6_route_check_nh_onlink(struct net *net,
        u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
        const struct in6_addr *gw_addr = &cfg->fc_gateway;
        u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT;
+        struct fib6_info *from;
        struct rt6_info *grt;
        int err;
        err = 0;
        grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
        if (grt) {
+                rcu_read_lock();
+                from = rcu_dereference(grt->from);
                if (!grt->dst.error &&
                    /* ignore match if it is the default route */
-                    grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) &&
+                    from && !ipv6_addr_any(&from->fib6_dst.addr) &&
                    (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
                        NL_SET_ERR_MSG(extack,
                                       "Nexthop has invalid gateway or device mismatch");
                        err = -EINVAL;
                }
+                rcu_read_unlock();
                ip6_rt_put(grt);
        }
@@ -4251,17 +4267,6 @@ struct rt6_nh {
        struct list_head next;
 };
-static void ip6_print_replace_route_err(struct list_head *rt6_nh_list)
-{
-        struct rt6_nh *nh;
-        list_for_each_entry(nh, rt6_nh_list, next) {
-                pr_warn("IPV6: multipath route replace failed (check consistency of installed routes): %pI6c nexthop %pI6c ifi %d\n",
-                        &nh->r_cfg.fc_dst, &nh->r_cfg.fc_gateway,
-                        nh->r_cfg.fc_ifindex);
-        }
-}
 static int ip6_route_info_append(struct net *net,
                                 struct list_head *rt6_nh_list,
                                 struct fib6_info *rt,
@@ -4407,7 +4412,8 @@ static int ip6_route_multipath_add(struct fib6_config *cfg,
                nh->fib6_info = NULL;
                if (err) {
                        if (replace && nhn)
-                                ip6_print_replace_route_err(&rt6_nh_list);
+                                NL_SET_ERR_MSG_MOD(extack,
+                                                   "multipath route replace failed (check consistency of installed routes)");
                        err_nh = nh;
                        goto add_errout;
                }
@@ -4659,7 +4665,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
                table = rt->fib6_table->tb6_id;
        else
                table = RT6_TABLE_UNSPEC;
-        rtm->rtm_table = table;
+        rtm->rtm_table = table < 256 ? table : RT_TABLE_COMPAT;
        if (nla_put_u32(skb, RTA_TABLE, table))
                goto nla_put_failure;
diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index 8d0ba757a46c..9b2f272ca164 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c
@@ -221,9 +221,7 @@ static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info)
        rcu_read_unlock();
        genlmsg_end(msg, hdr);
-        genlmsg_reply(msg, info);
+        return genlmsg_reply(msg, info);
-        return 0;
 nla_put_failure:
        rcu_read_unlock();
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 8181ee7e1e27..ee5403cbe655 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -146,6 +146,8 @@ int seg6_do_srh_encap(struct sk_buff *skb, struct ipv6_sr_hdr *osrh, int proto)
        } else {
                ip6_flow_hdr(hdr, 0, flowlabel);
                hdr->hop_limit = ip6_dst_hoplimit(skb_dst(skb));
+                memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
        }
        hdr->nexthdr = NEXTHDR_ROUTING;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1e03305c0549..e8a1dabef803 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -546,7 +546,8 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
        }
        err = 0;
-        if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
+        if (__in6_dev_get(skb->dev) &&
+            !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
                goto out;
        if (t->parms.iph.daddr == 0)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 9cbf363172bd..b444483cdb2b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -102,7 +102,7 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
        return udp_lib_get_port(sk, snum, hash2_nulladdr);
 }
-static void udp_v6_rehash(struct sock *sk)
+void udp_v6_rehash(struct sock *sk)
 {
        u16 new_hash = ipv6_portaddr_hash(sock_net(sk),
                                          &sk->sk_v6_rcv_saddr,
@@ -288,8 +288,8 @@ int udpv6_recvmsg(struct sock *sk, struct msghdr *msg, size_t len,
        int peeked, peeking, off;
        int err;
        int is_udplite = IS_UDPLITE(sk);
+        struct udp_mib __percpu *mib;
        bool checksum_valid = false;
-        struct udp_mib *mib;
        int is_udp4;
        if (flags & MSG_ERRQUEUE)
@@ -420,17 +420,19 @@ EXPORT_SYMBOL(udpv6_encap_enable);
 */
 static int __udp6_lib_err_encap_no_sk(struct sk_buff *skb,
                                      struct inet6_skb_parm *opt,
-                                      u8 type, u8 code, int offset, u32 info)
+                                      u8 type, u8 code, int offset, __be32 info)
 {
        int i;
        for (i = 0; i < MAX_IPTUN_ENCAP_OPS; i++) {
                int (*handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
-                               u8 type, u8 code, int offset, u32 info);
+                               u8 type, u8 code, int offset, __be32 info);
+                const struct ip6_tnl_encap_ops *encap;
-                if (!ip6tun_encaps[i])
+                encap = rcu_dereference(ip6tun_encaps[i]);
+                if (!encap)
                        continue;
-                handler = rcu_dereference(ip6tun_encaps[i]->err_handler);
+                handler = encap->err_handler;
                if (handler && !handler(skb, opt, type, code, offset, info))
                        return 0;
        }
@@ -1132,15 +1134,23 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
                const int hlen = skb_network_header_len(skb) +
                                 sizeof(struct udphdr);
-                if (hlen + cork->gso_size > cork->fragsize)
+                if (hlen + cork->gso_size > cork->fragsize) {
+                        kfree_skb(skb);
                        return -EINVAL;
-                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS)
+                }
+                if (skb->len > cork->gso_size * UDP_MAX_SEGMENTS) {
+                        kfree_skb(skb);
                        return -EINVAL;
-                if (udp_sk(sk)->no_check6_tx)
+                }
+                if (udp_sk(sk)->no_check6_tx) {
+                        kfree_skb(skb);
                        return -EINVAL;
+                }
                if (skb->ip_summed != CHECKSUM_PARTIAL || is_udplite ||
-                    dst_xfrm(skb_dst(skb)))
+                    dst_xfrm(skb_dst(skb))) {
+                        kfree_skb(skb);
                        return -EIO;
+                }
                skb_shinfo(skb)->gso_size = cork->gso_size;
                skb_shinfo(skb)->gso_type = SKB_GSO_UDP_L4;
@@ -1390,10 +1400,7 @@ do_udp_sendmsg:
        ipc6.opt = opt;
        fl6.flowi6_proto = sk->sk_protocol;
-        if (!ipv6_addr_any(daddr))
+        fl6.daddr = *daddr;
-                fl6.daddr = *daddr;
-        else
-                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
        if (ipv6_addr_any(&fl6.saddr) && !ipv6_addr_any(&np->saddr))
                fl6.saddr = np->saddr;
        fl6.fl6_sport = inet->inet_sport;
@@ -1421,6 +1428,9 @@ do_udp_sendmsg:
                }
        }
+        if (ipv6_addr_any(&fl6.daddr))
+                fl6.daddr.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
        final_p = fl6_update_dst(&fl6, opt, &final);
        if (final_p)
                connected = false;
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index 5730e6503cb4..20e324b6f358 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -13,6 +13,7 @@ int __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *, u8, u8, int,
                   __be32, struct udp_table *);
 int udp_v6_get_port(struct sock *sk, unsigned short snum);
+void udp_v6_rehash(struct sock *sk);
 int udpv6_getsockopt(struct sock *sk, int level, int optname,
                     char __user *optval, int __user *optlen);
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index a125aebc29e5..f35907836444 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -49,6 +49,7 @@ struct proto udplitev6_prot = {
        .recvmsg           = udpv6_recvmsg,
        .hash              = udp_lib_hash,
        .unhash            = udp_lib_unhash,
+        .rehash            = udp_v6_rehash,
        .get_port          = udp_v6_get_port,
        .memory_allocated  = &udp_memory_allocated,
        .sysctl_mem        = sysctl_udp_mem,
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index f5b4febeaa25..bc65db782bfb 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -344,8 +344,8 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        unsigned int i;
-        xfrm_state_flush(net, IPSEC_PROTO_ANY, false);
        xfrm_flush_gc();
+        xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true);
        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
                WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));