11 files changed, 135 insertions, 111 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 12368c58606..e39239e6426 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -428,7 +428,7 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         ndev->tstamp = jiffies;
         addrconf_sysctl_register(ndev);
         /* protected by rtnl_lock */
-        rcu_assign_pointer(dev->ip6_ptr, ndev);
+        RCU_INIT_POINTER(dev->ip6_ptr, ndev);
 
         /* Join all-node multicast group */
         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allnodes);
@@ -824,12 +824,13 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
 {
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr addr, *tmpaddr;
-        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_cstamp, tmp_tstamp, age;
+        unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_tstamp, age;
         unsigned long regen_advance;
         int tmp_plen;
         int ret = 0;
         int max_addresses;
         u32 addr_flags;
+        unsigned long now = jiffies;
 
         write_lock(&idev->lock);
         if (ift) {
@@ -874,7 +875,7 @@ retry:
                 goto out;
         }
         memcpy(&addr.s6_addr[8], idev->rndid, 8);
-        age = (jiffies - ifp->tstamp) / HZ;
+        age = (now - ifp->tstamp) / HZ;
         tmp_valid_lft = min_t(__u32,
                               ifp->valid_lft,
                               idev->cnf.temp_valid_lft + age);
@@ -884,7 +885,6 @@ retry:
                                  idev->cnf.max_desync_factor);
         tmp_plen = ifp->prefix_len;
         max_addresses = idev->cnf.max_addresses;
-        tmp_cstamp = ifp->cstamp;
         tmp_tstamp = ifp->tstamp;
         spin_unlock_bh(&ifp->lock);
 
@@ -929,7 +929,7 @@ retry:
         ift->ifpub = ifp;
         ift->valid_lft = tmp_valid_lft;
         ift->prefered_lft = tmp_prefered_lft;
-        ift->cstamp = tmp_cstamp;
+        ift->cstamp = now;
         ift->tstamp = tmp_tstamp;
         spin_unlock_bh(&ift->lock);
 
@@ -1999,25 +1999,50 @@ ok:
 #ifdef CONFIG_IPV6_PRIVACY
                         read_lock_bh(&in6_dev->lock);
                         /* update all temporary addresses in the list */
-                        list_for_each_entry(ift, &in6_dev->tempaddr_list, tmp_list) {
-                                /*
-                                 * When adjusting the lifetimes of an existing
-                                 * temporary address, only lower the lifetimes.
-                                 * Implementations must not increase the
-                                 * lifetimes of an existing temporary address
-                                 * when processing a Prefix Information Option.
-                                 */
+                        list_for_each_entry(ift, &in6_dev->tempaddr_list,
+                                            tmp_list) {
+                                int age, max_valid, max_prefered;
+
                                 if (ifp != ift->ifpub)
                                         continue;
 
+                                /*
+                                 * RFC 4941 section 3.3:
+                                 * If a received option will extend the lifetime
+                                 * of a public address, the lifetimes of
+                                 * temporary addresses should be extended,
+                                 * subject to the overall constraint that no
+                                 * temporary addresses should ever remain
+                                 * "valid" or "preferred" for a time longer than
+                                 * (TEMP_VALID_LIFETIME) or
+                                 * (TEMP_PREFERRED_LIFETIME - DESYNC_FACTOR),
+                                 * respectively.
+                                 */
+                                age = (now - ift->cstamp) / HZ;
+                                max_valid = in6_dev->cnf.temp_valid_lft - age;
+                                if (max_valid < 0)
+                                        max_valid = 0;
+
+                                max_prefered = in6_dev->cnf.temp_prefered_lft -
+                                               in6_dev->cnf.max_desync_factor -
+                                               age;
+                                if (max_prefered < 0)
+                                        max_prefered = 0;
+
+                                if (valid_lft > max_valid)
+                                        valid_lft = max_valid;
+
+                                if (prefered_lft > max_prefered)
+                                        prefered_lft = max_prefered;
+
                                 spin_lock(&ift->lock);
                                 flags = ift->flags;
-                                if (ift->valid_lft > valid_lft &&
-                                    ift->valid_lft - valid_lft > (jiffies - ift->tstamp) / HZ)
-                                        ift->valid_lft = valid_lft + (jiffies - ift->tstamp) / HZ;
-                                if (ift->prefered_lft > prefered_lft &&
-                                    ift->prefered_lft - prefered_lft > (jiffies - ift->tstamp) / HZ)
-                                        ift->prefered_lft = prefered_lft + (jiffies - ift->tstamp) / HZ;
+                                ift->valid_lft = valid_lft;
+                                ift->prefered_lft = prefered_lft;
+                                ift->tstamp = now;
+                                if (prefered_lft > 0)
+                                        ift->flags &= ~IFA_F_DEPRECATED;
+
                                 spin_unlock(&ift->lock);
                                 if (!(flags&IFA_F_TENTATIVE))
                                         ipv6_ifa_notify(0, ift);
@@ -2025,9 +2050,11 @@ ok:
 
                         if ((create || list_empty(&in6_dev->tempaddr_list)) && in6_dev->cnf.use_tempaddr > 0) {
                                 /*
-                                 * When a new public address is created as described in [ADDRCONF],
-                                 * also create a new temporary address. Also create a temporary
-                                 * address if it's enabled but no temporary address currently exists.
+                                 * When a new public address is created as
+                                 * described in [ADDRCONF], also create a new
+                                 * temporary address. Also create a temporary
+                                 * address if it's enabled but no temporary
+                                 * address currently exists.
                                  */
                                 read_unlock_bh(&in6_dev->lock);
                                 ipv6_create_tempaddr(ifp, NULL);
@@ -2706,7 +2733,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                 idev->dead = 1;
 
                 /* protected by rtnl_lock */
-                rcu_assign_pointer(dev->ip6_ptr, NULL);
+                RCU_INIT_POINTER(dev->ip6_ptr, NULL);
 
                 /* Step 1.5: remove snmp6 entry */
                 snmp6_unregister_dev(idev);
@@ -2969,12 +2996,12 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 
         ipv6_ifa_notify(RTM_NEWADDR, ifp);
 
-        /* If added prefix is link local and forwarding is off,
-           start sending router solicitations.
+        /* If added prefix is link local and we are prepared to process
+           router advertisements, start sending router solicitations.
          */
 
-        if ((ifp->idev->cnf.forwarding == 0 ||
-             ifp->idev->cnf.forwarding == 2) &&
+        if (((ifp->idev->cnf.accept_ra == 1 && !ifp->idev->cnf.forwarding) ||
+             ifp->idev->cnf.accept_ra == 2) &&
             ifp->idev->cnf.rtr_solicits > 0 &&
             (dev->flags&IFF_LOOPBACK) == 0 &&
             (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 79a485e8a70..1318de4c3e8 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -273,12 +273,12 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
         __u16 dstbuf;
 #endif
-        struct dst_entry *dst;
+        struct dst_entry *dst = skb_dst(skb);
 
         if (!pskb_may_pull(skb, skb_transport_offset(skb) + 8) ||
             !pskb_may_pull(skb, (skb_transport_offset(skb) +
                                  ((skb_transport_header(skb)[1] + 1) << 3)))) {
-                IP6_INC_STATS_BH(dev_net(skb_dst(skb)->dev), ip6_dst_idev(skb_dst(skb)),
+                IP6_INC_STATS_BH(dev_net(dst->dev), ip6_dst_idev(dst),
                                  IPSTATS_MIB_INHDRERRORS);
                 kfree_skb(skb);
                 return -1;
@@ -289,9 +289,7 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
         dstbuf = opt->dst1;
 #endif
 
-        dst = dst_clone(skb_dst(skb));
         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
-                dst_release(dst);
                 skb->transport_header += (skb_transport_header(skb)[1] + 1) << 3;
                 opt = IP6CB(skb);
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
@@ -304,7 +302,6 @@ static int ipv6_destopt_rcv(struct sk_buff *skb)
 
         IP6_INC_STATS_BH(dev_net(dst->dev),
                          ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
-        dst_release(dst);
         return -1;
 }
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 11900417b1c..2b59154c65d 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -490,7 +490,8 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
                 goto out_dst_release;
         }
 
-        idev = in6_dev_get(skb->dev);
+        rcu_read_lock();
+        idev = __in6_dev_get(skb->dev);
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
                               len + sizeof(struct icmp6hdr),
@@ -500,19 +501,16 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
-                goto out_put;
+        } else {
+                err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
+                                                 len + sizeof(struct icmp6hdr));
         }
-        err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, len + sizeof(struct icmp6hdr));
-
-out_put:
-        if (likely(idev != NULL))
-                in6_dev_put(idev);
+        rcu_read_unlock();
 out_dst_release:
         dst_release(dst);
 out:
         icmpv6_xmit_unlock(sk);
 }
-
 EXPORT_SYMBOL(icmpv6_send);
 
 static void icmpv6_echo_reply(struct sk_buff *skb)
@@ -569,7 +567,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (hlimit < 0)
                 hlimit = ip6_dst_hoplimit(dst);
 
-        idev = in6_dev_get(skb->dev);
+        idev = __in6_dev_get(skb->dev);
 
         msg.skb = skb;
         msg.offset = 0;
@@ -583,13 +581,10 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTERRORS);
                 ip6_flush_pending_frames(sk);
-                goto out_put;
+        } else {
+                err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr,
+                                                 skb->len + sizeof(struct icmp6hdr));
         }
-        err = icmpv6_push_pending_frames(sk, &fl6, &tmp_hdr, skb->len + sizeof(struct icmp6hdr));
-
-out_put:
-        if (likely(idev != NULL))
-                in6_dev_put(idev);
         dst_release(dst);
 out:
         icmpv6_xmit_unlock(sk);
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 8a58e8cf664..2916200f90c 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -211,6 +211,7 @@ int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl_unused)
         struct flowi6 fl6;
         struct dst_entry *dst;
         struct in6_addr *final_p, final;
+        int res;
 
         memset(&fl6, 0, sizeof(fl6));
         fl6.flowi6_proto = sk->sk_protocol;
@@ -241,12 +242,14 @@ int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl_unused)
                 __inet6_csk_dst_store(sk, dst, NULL, NULL);
         }
 
-        skb_dst_set(skb, dst_clone(dst));
+        rcu_read_lock();
+        skb_dst_set_noref(skb, dst);
 
         /* Restore final destination back after routing done */
         ipv6_addr_copy(&fl6.daddr, &np->daddr);
 
-        return ip6_xmit(sk, skb, &fl6, np->opt);
+        res = ip6_xmit(sk, skb, &fl6, np->opt);
+        rcu_read_unlock();
+        return res;
 }
-
 EXPORT_SYMBOL_GPL(inet6_csk_xmit);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4c882cf4e8a..835c04b5239 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1480,13 +1480,13 @@ alloc_new_skb:
                         if (page && (left = PAGE_SIZE - off) > 0) {
                                 if (copy >= left)
                                         copy = left;
-                                if (page != frag->page) {
+                                if (page != skb_frag_page(frag)) {
                                         if (i == MAX_SKB_FRAGS) {
                                                 err = -EMSGSIZE;
                                                 goto error;
                                         }
-                                        get_page(page);
                                         skb_fill_page_desc(skb, i, page, sk->sk_sndmsg_off, 0);
+                                        skb_frag_ref(skb, i);
                                         frag = &skb_shinfo(skb)->frags[i];
                                 }
                         } else if(i < MAX_SKB_FRAGS) {
@@ -1506,7 +1506,8 @@ alloc_new_skb:
                                 err = -EMSGSIZE;
                                 goto error;
                         }
-                        if (getfrag(from, page_address(frag->page)+frag->page_offset+frag->size, offset, copy, skb->len, skb) < 0) {
+                        if (getfrag(from, skb_frag_address(frag)+frag->size,
+                                    offset, copy, skb->len, skb) < 0) {
                                 err = -EFAULT;
                                 goto error;
                         }
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0bc98886c38..bdc15c9003d 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -218,8 +218,8 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
         struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
 
-        rcu_assign_pointer(t->next , rtnl_dereference(*tp));
-        rcu_assign_pointer(*tp, t);
+        RCU_INIT_POINTER(t->next , rtnl_dereference(*tp));
+        RCU_INIT_POINTER(*tp, t);
 }
 
 /**
@@ -237,7 +237,7 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
              (iter = rtnl_dereference(*tp)) != NULL;
              tp = &iter->next) {
                 if (t == iter) {
-                        rcu_assign_pointer(*tp, t->next);
+                        RCU_INIT_POINTER(*tp, t->next);
                         break;
                 }
         }
@@ -350,7 +350,7 @@ ip6_tnl_dev_uninit(struct net_device *dev)
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
         if (dev == ip6n->fb_tnl_dev)
-                rcu_assign_pointer(ip6n->tnls_wc[0], NULL);
+                RCU_INIT_POINTER(ip6n->tnls_wc[0], NULL);
         else
                 ip6_tnl_unlink(ip6n, t);
         ip6_tnl_dst_reset(t);
@@ -889,7 +889,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         struct net_device_stats *stats = &t->dev->stats;
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         struct ipv6_tel_txoption opt;
-        struct dst_entry *dst;
+        struct dst_entry *dst = NULL, *ndst = NULL;
         struct net_device *tdev;
         int mtu;
         unsigned int max_headroom = sizeof(struct ipv6hdr);
@@ -897,19 +897,20 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         int err = -1;
         int pkt_len;
 
-        if ((dst = ip6_tnl_dst_check(t)) != NULL)
-                dst_hold(dst);
-        else {
-                dst = ip6_route_output(net, NULL, fl6);
+        if (!fl6->flowi6_mark)
+                dst = ip6_tnl_dst_check(t);
+        if (!dst) {
+                ndst = ip6_route_output(net, NULL, fl6);
 
-                if (dst->error)
+                if (ndst->error)
                         goto tx_err_link_failure;
-                dst = xfrm_lookup(net, dst, flowi6_to_flowi(fl6), NULL, 0);
-                if (IS_ERR(dst)) {
-                        err = PTR_ERR(dst);
-                        dst = NULL;
+                ndst = xfrm_lookup(net, ndst, flowi6_to_flowi(fl6), NULL, 0);
+                if (IS_ERR(ndst)) {
+                        err = PTR_ERR(ndst);
+                        ndst = NULL;
                         goto tx_err_link_failure;
                 }
+                dst = ndst;
         }
 
         tdev = dst->dev;
@@ -955,8 +956,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 skb = new_skb;
         }
         skb_dst_drop(skb);
-        skb_dst_set(skb, dst_clone(dst));
-
+        if (fl6->flowi6_mark) {
+                skb_dst_set(skb, dst);
+                ndst = NULL;
+        } else {
+                skb_dst_set_noref(skb, dst);
+        }
         skb->transport_header = skb->network_header;
 
         proto = fl6->flowi6_proto;
@@ -987,13 +992,14 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 stats->tx_errors++;
                 stats->tx_aborted_errors++;
         }
-        ip6_tnl_dst_store(t, dst);
+        if (ndst)
+                ip6_tnl_dst_store(t, ndst);
         return 0;
 tx_err_link_failure:
         stats->tx_carrier_errors++;
         dst_link_failure(skb);
 tx_err_dst_release:
-        dst_release(dst);
+        dst_release(ndst);
         return err;
 }
 
@@ -1020,9 +1026,11 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 
         dsfield = ipv4_get_dsfield(iph);
 
-        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
                 fl6.flowlabel |= htonl((__u32)iph->tos << IPV6_TCLASS_SHIFT)
                                           & IPV6_TCLASS_MASK;
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
+                fl6.flowi6_mark = skb->mark;
 
         err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
         if (err != 0) {
@@ -1069,10 +1077,12 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         fl6.flowi6_proto = IPPROTO_IPV6;
 
         dsfield = ipv6_get_dsfield(ipv6h);
-        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS))
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_TCLASS)
                 fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_TCLASS_MASK);
-        if ((t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL))
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FLOWLABEL)
                 fl6.flowlabel |= (*(__be32 *) ipv6h & IPV6_FLOWLABEL_MASK);
+        if (t->parms.flags & IP6_TNL_F_USE_ORIG_FWMARK)
+                fl6.flowi6_mark = skb->mark;
 
         err = ip6_tnl_xmit2(skb, dev, dsfield, &fl6, encap_limit, &mtu);
         if (err != 0) {
@@ -1439,7 +1449,7 @@ static int __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
 
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
-        rcu_assign_pointer(ip6n->tnls_wc[0], t);
+        RCU_INIT_POINTER(ip6n->tnls_wc[0], t);
         return 0;
 }
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 9da6e02eaae..1f52dd25763 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -533,7 +533,8 @@ void ndisc_send_skb(struct sk_buff *skb,
 
         skb_dst_set(skb, dst);
 
-        idev = in6_dev_get(dst->dev);
+        rcu_read_lock();
+        idev = __in6_dev_get(dst->dev);
         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
 
         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
@@ -543,8 +544,7 @@ void ndisc_send_skb(struct sk_buff *skb,
                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
         }
 
-        if (likely(idev != NULL))
-                in6_dev_put(idev);
+        rcu_read_unlock();
 }
 
 EXPORT_SYMBOL(ndisc_send_skb);
@@ -1039,7 +1039,7 @@ static void ndisc_recv_rs(struct sk_buff *skb)
         if (skb->len < sizeof(*rs_msg))
                 return;
 
-        idev = in6_dev_get(skb->dev);
+        idev = __in6_dev_get(skb->dev);
         if (!idev) {
                 if (net_ratelimit())
                         ND_PRINTK1("ICMP6 RS: can't find in6 device\n");
@@ -1080,7 +1080,7 @@ static void ndisc_recv_rs(struct sk_buff *skb)
                 neigh_release(neigh);
         }
 out:
-        in6_dev_put(idev);
+        return;
 }
 
 static void ndisc_ra_useropt(struct sk_buff *ra, struct nd_opt_hdr *opt)
@@ -1179,7 +1179,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
          *      set the RA_RECV flag in the interface
          */
 
-        in6_dev = in6_dev_get(skb->dev);
+        in6_dev = __in6_dev_get(skb->dev);
         if (in6_dev == NULL) {
                 ND_PRINTK0(KERN_ERR
                            "ICMPv6 RA: can't find inet6 device for %s.\n",
@@ -1188,7 +1188,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         }
 
         if (!ndisc_parse_options(opt, optlen, &ndopts)) {
-                in6_dev_put(in6_dev);
                 ND_PRINTK2(KERN_WARNING
                            "ICMP6 RA: invalid ND options\n");
                 return;
@@ -1255,7 +1254,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                         ND_PRINTK0(KERN_ERR
                                    "ICMPv6 RA: %s() failed to add default route.\n",
                                    __func__);
-                        in6_dev_put(in6_dev);
                         return;
                 }
 
@@ -1265,7 +1263,6 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                                    "ICMPv6 RA: %s() got default router without neighbour.\n",
                                    __func__);
                         dst_release(&rt->dst);
-                        in6_dev_put(in6_dev);
                         return;
                 }
                 neigh->flags |= NTF_ROUTER;
@@ -1422,7 +1419,6 @@ out:
                 dst_release(&rt->dst);
         else if (neigh)
                 neigh_release(neigh);
-        in6_dev_put(in6_dev);
 }
 
 static void ndisc_redirect_rcv(struct sk_buff *skb)
@@ -1481,13 +1477,11 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
                 return;
         }
 
-        in6_dev = in6_dev_get(skb->dev);
+        in6_dev = __in6_dev_get(skb->dev);
         if (!in6_dev)
                 return;
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects) {
-                in6_dev_put(in6_dev);
+        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_redirects)
                 return;
-        }
 
         /* RFC2461 8.1:
          *      The IP source address of the Redirect MUST be the same as the current
@@ -1497,7 +1491,6 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
         if (!ndisc_parse_options((u8*)(dest + 1), optlen, &ndopts)) {
                 ND_PRINTK2(KERN_WARNING
                            "ICMPv6 Redirect: invalid ND options\n");
-                in6_dev_put(in6_dev);
                 return;
         }
         if (ndopts.nd_opts_tgt_lladdr) {
@@ -1506,7 +1499,6 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
                 if (!lladdr) {
                         ND_PRINTK2(KERN_WARNING
                                    "ICMPv6 Redirect: invalid link-layer address length\n");
-                        in6_dev_put(in6_dev);
                         return;
                 }
         }
@@ -1518,7 +1510,6 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
                              on_link);
                 neigh_release(neigh);
         }
-        in6_dev_put(in6_dev);
 }
 
 void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
@@ -1651,7 +1642,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                                              csum_partial(icmph, len, 0));
 
         skb_dst_set(buff, dst);
-        idev = in6_dev_get(dst->dev);
+        rcu_read_lock();
+        idev = __in6_dev_get(dst->dev);
         IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, buff, NULL, dst->dev,
                       dst_output);
@@ -1660,8 +1652,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                 ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
         }
 
-        if (likely(idev != NULL))
-                in6_dev_put(idev);
+        rcu_read_unlock();
         return;
 
 release:
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 343852e5c70..3486f62befa 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -130,14 +130,14 @@ static mh_filter_t __rcu *mh_filter __read_mostly;
 
 int rawv6_mh_filter_register(mh_filter_t filter)
 {
-        rcu_assign_pointer(mh_filter, filter);
+        RCU_INIT_POINTER(mh_filter, filter);
         return 0;
 }
 EXPORT_SYMBOL(rawv6_mh_filter_register);
 
 int rawv6_mh_filter_unregister(mh_filter_t filter)
 {
-        rcu_assign_pointer(mh_filter, NULL);
+        RCU_INIT_POINTER(mh_filter, NULL);
         synchronize_rcu();
         return 0;
 }
@@ -372,9 +372,9 @@ void raw6_icmp_error(struct sk_buff *skb, int nexthdr,
         read_unlock(&raw_v6_hashinfo.lock);
 }
 
-static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
+static inline int rawv6_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
-        if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
+        if ((raw6_sk(sk)->checksum || rcu_access_pointer(sk->sk_filter)) &&
             skb_checksum_complete(skb)) {
                 atomic_inc(&sk->sk_drops);
                 kfree_skb(skb);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 00b15ac7a70..a7a18602a04 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -182,7 +182,7 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
              (iter = rtnl_dereference(*tp)) != NULL;
              tp = &iter->next) {
                 if (t == iter) {
-                        rcu_assign_pointer(*tp, t->next);
+                        RCU_INIT_POINTER(*tp, t->next);
                         break;
                 }
         }
@@ -192,8 +192,8 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
         struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
 
-        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
-        rcu_assign_pointer(*tp, t);
+        RCU_INIT_POINTER(t->next, rtnl_dereference(*tp));
+        RCU_INIT_POINTER(*tp, t);
 }
 
 static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
@@ -391,7 +391,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
         p->addr = a->addr;
         p->flags = a->flags;
         t->prl_count++;
-        rcu_assign_pointer(t->prl, p);
+        RCU_INIT_POINTER(t->prl, p);
 out:
         return err;
 }
@@ -474,7 +474,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         if (dev == sitn->fb_tunnel_dev) {
-                rcu_assign_pointer(sitn->tunnels_wc[0], NULL);
+                RCU_INIT_POINTER(sitn->tunnels_wc[0], NULL);
         } else {
                 ipip6_tunnel_unlink(sitn, netdev_priv(dev));
                 ipip6_tunnel_del_prl(netdev_priv(dev), NULL);
@@ -1176,7 +1176,7 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         if (!dev->tstats)
                 return -ENOMEM;
         dev_hold(dev);
-        rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
+        RCU_INIT_POINTER(sitn->tunnels_wc[0], tunnel);
         return 0;
 }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 7b8fc579435..5357902c797 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1608,7 +1608,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 opt_skb = skb_clone(skb, GFP_ATOMIC);
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
-                sock_rps_save_rxhash(sk, skb->rxhash);
+                sock_rps_save_rxhash(sk, skb);
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
                 if (opt_skb)
@@ -1630,7 +1630,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                  * the new socket..
                  */
                 if(nsk != sk) {
-                        sock_rps_save_rxhash(nsk, skb->rxhash);
+                        sock_rps_save_rxhash(nsk, skb);
                         if (tcp_child_process(sk, nsk, skb))
                                 goto reset;
                         if (opt_skb)
@@ -1638,7 +1638,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                         return 0;
                 }
         } else
-                sock_rps_save_rxhash(sk, skb->rxhash);
+                sock_rps_save_rxhash(sk, skb);
 
         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
                 goto reset;
@@ -1722,7 +1722,7 @@ static int tcp_v6_rcv(struct sk_buff *skb)
                                     skb->len - th->doff*4);
         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
         TCP_SKB_CB(skb)->when = 0;
-        TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
+        TCP_SKB_CB(skb)->ip_dsfield = ipv6_get_dsfield(hdr);
         TCP_SKB_CB(skb)->sacked = 0;
 
         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index bb95e8e1c6f..f4ca0a5b345 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -509,7 +509,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
         int is_udplite = IS_UDPLITE(sk);
 
         if (!ipv6_addr_any(&inet6_sk(sk)->daddr))
-                sock_rps_save_rxhash(sk, skb->rxhash);
+                sock_rps_save_rxhash(sk, skb);
 
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto drop;
@@ -533,7 +533,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                 }
         }
 
-        if (rcu_dereference_raw(sk->sk_filter)) {
+        if (rcu_access_pointer(sk->sk_filter)) {
                 if (udp_lib_checksum_complete(skb))
                         goto drop;
         }