Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next-2.6: (1815 commits)
  mac80211: fix reorder buffer release
  iwmc3200wifi: Enable wimax core through module parameter
  iwmc3200wifi: Add wifi-wimax coexistence mode as a module parameter
  iwmc3200wifi: Coex table command does not expect a response
  iwmc3200wifi: Update wiwi priority table
  iwlwifi: driver version track kernel version
  iwlwifi: indicate uCode type when fail dump error/event log
  iwl3945: remove duplicated event logging code
  b43: fix two warnings
  ipw2100: fix rebooting hang with driver loaded
  cfg80211: indent regulatory messages with spaces
  iwmc3200wifi: fix NULL pointer dereference in pmkid update
  mac80211: Fix TX status reporting for injected data frames
  ath9k: enable 2GHz band only if the device supports it
  airo: Fix integer overflow warning
  rt2x00: Fix padding bug on L2PAD devices.
  WE: Fix set events not propagated
  b43legacy: avoid PPC fault during resume
  b43: avoid PPC fault during resume
  tcp: fix a timewait refcnt race
  ...

Fix up conflicts due to sysctl cleanups (dead sysctl_check code and
CTL_UNNUMBERED removed) in
	kernel/sysctl_check.c
	net/ipv4/sysctl_net_ipv4.c
	net/ipv6/addrconf.c
	net/sctp/sysctl.c

1 files changed, 240 insertions, 98 deletions

diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index dbd19a78ca73..976e68244b99 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -66,7 +66,7 @@ static void ipip6_fb_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_setup(struct net_device *dev);
 
-static int sit_net_id;
+static int sit_net_id __read_mostly;
 struct sit_net {
         struct ip_tunnel *tunnels_r_l[HASH_SIZE];
         struct ip_tunnel *tunnels_r[HASH_SIZE];
@@ -77,8 +77,17 @@ struct sit_net {
         struct net_device *fb_tunnel_dev;
 };
 
-static DEFINE_RWLOCK(ipip6_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip6_lock);
+
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 
+/*
+ * Must be invoked with rcu_read_lock
+ */
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                 struct net_device *dev, __be32 remote, __be32 local)
 {
@@ -87,26 +96,26 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
         struct ip_tunnel *t;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
-        for (t = sitn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r_l[h0 ^ h1]) {
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        for (t = sitn->tunnels_r[h0]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r[h0]) {
                 if (remote == t->parms.iph.daddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        for (t = sitn->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_l[h1]) {
                 if (local == t->parms.iph.saddr &&
                     (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                     (t->dev->flags & IFF_UP))
                         return t;
         }
-        t = sitn->tunnels_wc[0];
+        t = rcu_dereference(sitn->tunnels_wc[0]);
         if ((t != NULL) && (t->dev->flags & IFF_UP))
                 return t;
         return NULL;
@@ -143,9 +152,9 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 
         for (tp = ipip6_bucket(sitn, t); *tp; tp = &(*tp)->next) {
                 if (t == *tp) {
-                        write_lock_bh(&ipip6_lock);
+                        spin_lock_bh(&ipip6_lock);
                         *tp = t->next;
-                        write_unlock_bh(&ipip6_lock);
+                        spin_unlock_bh(&ipip6_lock);
                         break;
                 }
         }
@@ -155,10 +164,27 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
         struct ip_tunnel **tp = ipip6_bucket(sitn, t);
 
+        spin_lock_bh(&ipip6_lock);
         t->next = *tp;
-        write_lock_bh(&ipip6_lock);
-        *tp = t;
-        write_unlock_bh(&ipip6_lock);
+        rcu_assign_pointer(*tp, t);
+        spin_unlock_bh(&ipip6_lock);
+}
+
+static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
+{
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel *t = netdev_priv(dev);
+
+        if (t->dev == sitn->fb_tunnel_dev) {
+                ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
+                t->ip6rd.relay_prefix = 0;
+                t->ip6rd.prefixlen = 16;
+                t->ip6rd.relay_prefixlen = 0;
+        } else {
+                struct ip_tunnel *t0 = netdev_priv(sitn->fb_tunnel_dev);
+                memcpy(&t->ip6rd, &t0->ip6rd, sizeof(t->ip6rd));
+        }
+#endif
 }
 
 static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
@@ -204,6 +230,7 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
 
         nt->parms = *parms;
         ipip6_tunnel_init(dev);
+        ipip6_tunnel_clone_6rd(dev, sitn);
 
         if (parms->i_flags & SIT_ISATAP)
                 dev->priv_flags |= IFF_ISATAP;
@@ -222,15 +249,22 @@ failed:
         return NULL;
 }
 
+static DEFINE_SPINLOCK(ipip6_prl_lock);
+
+#define for_each_prl_rcu(start)                 \
+        for (prl = rcu_dereference(start);      \
+             prl;                               \
+             prl = rcu_dereference(prl->next))
+
 static struct ip_tunnel_prl_entry *
 __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 {
-        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *)NULL;
+        struct ip_tunnel_prl_entry *prl;
 
-        for (p = t->prl; p; p = p->next)
-                if (p->addr == addr)
+        for_each_prl_rcu(t->prl)
+                if (prl->addr == addr)
                         break;
-        return p;
+        return prl;
 
 }
 
@@ -255,7 +289,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                 kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
                 NULL;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
 
         ca = t->prl_count < cmax ? t->prl_count : cmax;
 
@@ -273,7 +307,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
         }
 
         c = 0;
-        for (prl = t->prl; prl; prl = prl->next) {
+        for_each_prl_rcu(t->prl) {
                 if (c >= cmax)
                         break;
                 if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
@@ -285,7 +319,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                         break;
         }
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
 
         len = sizeof(*kp) * c;
         ret = 0;
@@ -306,12 +340,14 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
         if (a->addr == htonl(INADDR_ANY))
                 return -EINVAL;
 
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
 
         for (p = t->prl; p; p = p->next) {
                 if (p->addr == a->addr) {
-                        if (chg)
-                                goto update;
+                        if (chg) {
+                                p->flags = a->flags;
+                                goto out;
+                        }
                         err = -EEXIST;
                         goto out;
                 }
@@ -328,46 +364,63 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
                 goto out;
         }
 
+        INIT_RCU_HEAD(&p->rcu_head);
         p->next = t->prl;
-        t->prl = p;
-        t->prl_count++;
-update:
         p->addr = a->addr;
         p->flags = a->flags;
+        t->prl_count++;
+        rcu_assign_pointer(t->prl, p);
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
         return err;
 }
 
+static void prl_entry_destroy_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_tunnel_prl_entry, rcu_head));
+}
+
+static void prl_list_destroy_rcu(struct rcu_head *head)
+{
+        struct ip_tunnel_prl_entry *p, *n;
+
+        p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
+        do {
+                n = p->next;
+                kfree(p);
+                p = n;
+        } while (p);
+}
+
 static int
 ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 {
         struct ip_tunnel_prl_entry *x, **p;
         int err = 0;
 
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
 
         if (a && a->addr != htonl(INADDR_ANY)) {
                 for (p = &t->prl; *p; p = &(*p)->next) {
                         if ((*p)->addr == a->addr) {
                                 x = *p;
                                 *p = x->next;
-                                kfree(x);
+                                call_rcu(&x->rcu_head, prl_entry_destroy_rcu);
                                 t->prl_count--;
                                 goto out;
                         }
                 }
                 err = -ENXIO;
         } else {
-                while (t->prl) {
+                if (t->prl) {
+                        t->prl_count = 0;
                         x = t->prl;
-                        t->prl = t->prl->next;
-                        kfree(x);
-                        t->prl_count--;
+                        call_rcu(&x->rcu_head, prl_list_destroy_rcu);
+                        t->prl = NULL;
                 }
         }
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
         return err;
 }
 
@@ -377,7 +430,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
         struct ip_tunnel_prl_entry *p;
         int ok = 1;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         p = __ipip6_tunnel_locate_prl(t, iph->saddr);
         if (p) {
                 if (p->flags & PRL_DEFAULT)
@@ -393,7 +446,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
                 else
                         ok = 0;
         }
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
         return ok;
 }
 
@@ -403,9 +456,9 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         if (dev == sitn->fb_tunnel_dev) {
-                write_lock_bh(&ipip6_lock);
+                spin_lock_bh(&ipip6_lock);
                 sitn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip6_lock);
+                spin_unlock_bh(&ipip6_lock);
                 dev_put(dev);
         } else {
                 ipip6_tunnel_unlink(sitn, netdev_priv(dev));
@@ -458,7 +511,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
 
         err = -ENOENT;
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         t = ipip6_tunnel_lookup(dev_net(skb->dev),
                                 skb->dev,
                                 iph->daddr,
@@ -476,7 +529,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                 t->err_count = 1;
         t->err_time = jiffies;
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
         return err;
 }
 
@@ -496,7 +549,7 @@ static int ipip6_rcv(struct sk_buff *skb)
 
         iph = ip_hdr(skb);
 
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
         tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                      iph->saddr, iph->daddr);
         if (tunnel != NULL) {
@@ -510,7 +563,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                 if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
                     !isatap_chksrc(skb, iph, tunnel)) {
                         tunnel->dev->stats.rx_errors++;
-                        read_unlock(&ipip6_lock);
+                        rcu_read_unlock();
                         kfree_skb(skb);
                         return 0;
                 }
@@ -521,28 +574,52 @@ static int ipip6_rcv(struct sk_buff *skb)
                 nf_reset(skb);
                 ipip6_ecn_decapsulate(iph, skb);
                 netif_rx(skb);
-                read_unlock(&ipip6_lock);
+                rcu_read_unlock();
                 return 0;
         }
 
         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
 out:
         kfree_skb(skb);
         return 0;
 }
 
-/* Returns the embedded IPv4 address if the IPv6 address
-   comes from 6to4 (RFC 3056) addr space */
-
-static inline __be32 try_6to4(struct in6_addr *v6dst)
+/*
+ * Returns the embedded IPv4 address if the IPv6 address
+ * comes from 6rd / 6to4 (RFC 3056) addr space.
+ */
+static inline
+__be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 {
         __be32 dst = 0;
 
+#ifdef CONFIG_IPV6_SIT_6RD
+        if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
+                              tunnel->ip6rd.prefixlen)) {
+                unsigned pbw0, pbi0;
+                int pbi1;
+                u32 d;
+
+                pbw0 = tunnel->ip6rd.prefixlen >> 5;
+                pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
+
+                d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
+                    tunnel->ip6rd.relay_prefixlen;
+
+                pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
+                if (pbi1 > 0)
+                        d |= ntohl(v6dst->s6_addr32[pbw0 + 1]) >>
+                             (32 - pbi1);
+
+                dst = tunnel->ip6rd.relay_prefix | htonl(d);
+        }
+#else
         if (v6dst->s6_addr16[0] == htons(0x2002)) {
                 /* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
                 memcpy(&dst, &v6dst->s6_addr16[1], 4);
         }
+#endif
         return dst;
 }
 
@@ -555,10 +632,12 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                      struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
         struct iphdr  *tiph = &tunnel->parms.iph;
         struct ipv6hdr *iph6 = ipv6_hdr(skb);
         u8     tos = tunnel->parms.iph.tos;
+        __be16 df = tiph->frag_off;
         struct rtable *rt;                      /* Route to the other host */
         struct net_device *tdev;                        /* Device to other host */
         struct iphdr  *iph;                     /* Our new IP header */
@@ -595,7 +674,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         }
 
         if (!dst)
-                dst = try_6to4(&iph6->daddr);
+                dst = try_6rd(&iph6->daddr, tunnel);
 
         if (!dst) {
                 struct neighbour *neigh = NULL;
@@ -648,25 +727,28 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 goto tx_error;
         }
 
-        if (tiph->frag_off)
+        if (df) {
                 mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
-        else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
 
-        if (mtu < 68) {
-                stats->collisions++;
-                ip_rt_put(rt);
-                goto tx_error;
-        }
-        if (mtu < IPV6_MIN_MTU)
-                mtu = IPV6_MIN_MTU;
-        if (tunnel->parms.iph.daddr && skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+                if (mtu < 68) {
+                        stats->collisions++;
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
 
-        if (skb->len > mtu) {
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
-                ip_rt_put(rt);
-                goto tx_error;
+                if (mtu < IPV6_MIN_MTU) {
+                        mtu = IPV6_MIN_MTU;
+                        df = 0;
+                }
+
+                if (tunnel->parms.iph.daddr && skb_dst(skb))
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+
+                if (skb->len > mtu) {
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
         }
 
         if (tunnel->err_count > 0) {
@@ -688,7 +770,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                 if (!new_skb) {
                         ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                         dev_kfree_skb(skb);
                         return NETDEV_TX_OK;
                 }
@@ -714,11 +796,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
         iph                     =       ip_hdr(skb);
         iph->version            =       4;
         iph->ihl                =       sizeof(struct iphdr)>>2;
-        if (mtu > IPV6_MIN_MTU)
-                iph->frag_off   =       tiph->frag_off;
-        else
-                iph->frag_off   =       0;
-
+        iph->frag_off           =       df;
         iph->protocol           =       IPPROTO_IPV6;
         iph->tos                =       INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
         iph->daddr              =       rt->rt_dst;
@@ -785,9 +863,15 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
         struct ip_tunnel *t;
         struct net *net = dev_net(dev);
         struct sit_net *sitn = net_generic(net, sit_net_id);
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel_6rd ip6rd;
+#endif
 
         switch (cmd) {
         case SIOCGETTUNNEL:
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCGET6RD:
+#endif
                 t = NULL;
                 if (dev == sitn->fb_tunnel_dev) {
                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
@@ -798,9 +882,25 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 }
                 if (t == NULL)
                         t = netdev_priv(dev);
-                memcpy(&p, &t->parms, sizeof(p));
-                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
-                        err = -EFAULT;
+
+                err = -EFAULT;
+                if (cmd == SIOCGETTUNNEL) {
+                        memcpy(&p, &t->parms, sizeof(p));
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p,
+                                         sizeof(p)))
+                                goto done;
+#ifdef CONFIG_IPV6_SIT_6RD
+                } else {
+                        ipv6_addr_copy(&ip6rd.prefix, &t->ip6rd.prefix);
+                        ip6rd.relay_prefix = t->ip6rd.relay_prefix;
+                        ip6rd.prefixlen = t->ip6rd.prefixlen;
+                        ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &ip6rd,
+                                         sizeof(ip6rd)))
+                                goto done;
+#endif
+                }
+                err = 0;
                 break;
 
         case SIOCADDTUNNEL:
@@ -921,6 +1021,54 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 netdev_state_change(dev);
                 break;
 
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCADD6RD:
+        case SIOCCHG6RD:
+        case SIOCDEL6RD:
+                err = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        goto done;
+
+                err = -EFAULT;
+                if (copy_from_user(&ip6rd, ifr->ifr_ifru.ifru_data,
+                                   sizeof(ip6rd)))
+                        goto done;
+
+                t = netdev_priv(dev);
+
+                if (cmd != SIOCDEL6RD) {
+                        struct in6_addr prefix;
+                        __be32 relay_prefix;
+
+                        err = -EINVAL;
+                        if (ip6rd.relay_prefixlen > 32 ||
+                            ip6rd.prefixlen + (32 - ip6rd.relay_prefixlen) > 64)
+                                goto done;
+
+                        ipv6_addr_prefix(&prefix, &ip6rd.prefix,
+                                         ip6rd.prefixlen);
+                        if (!ipv6_addr_equal(&prefix, &ip6rd.prefix))
+                                goto done;
+                        if (ip6rd.relay_prefixlen)
+                                relay_prefix = ip6rd.relay_prefix &
+                                               htonl(0xffffffffUL <<
+                                                     (32 - ip6rd.relay_prefixlen));
+                        else
+                                relay_prefix = 0;
+                        if (relay_prefix != ip6rd.relay_prefix)
+                                goto done;
+
+                        ipv6_addr_copy(&t->ip6rd.prefix, &prefix);
+                        t->ip6rd.relay_prefix = relay_prefix;
+                        t->ip6rd.prefixlen = ip6rd.prefixlen;
+                        t->ip6rd.relay_prefixlen = ip6rd.relay_prefixlen;
+                } else
+                        ipip6_tunnel_clone_6rd(dev, sitn);
+
+                err = 0;
+                break;
+#endif
+
         default:
                 err = -EINVAL;
         }
@@ -997,33 +1145,27 @@ static struct xfrm_tunnel sit_handler = {
         .priority       =       1,
 };
 
-static void sit_destroy_tunnels(struct sit_net *sitn)
+static void sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
 {
         int prio;
 
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
-                        while ((t = sitn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        struct ip_tunnel *t = sitn->tunnels[prio][h];
+
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                 }
         }
 }
 
 static int sit_init_net(struct net *net)
 {
+        struct sit_net *sitn = net_generic(net, sit_net_id);
         int err;
-        struct sit_net *sitn;
-
-        err = -ENOMEM;
-        sitn = kzalloc(sizeof(struct sit_net), GFP_KERNEL);
-        if (sitn == NULL)
-                goto err_alloc;
-
-        err = net_assign_generic(net, sit_net_id, sitn);
-        if (err < 0)
-                goto err_assign;
 
         sitn->tunnels[0] = sitn->tunnels_wc;
         sitn->tunnels[1] = sitn->tunnels_l;
@@ -1039,6 +1181,7 @@ static int sit_init_net(struct net *net)
         dev_net_set(sitn->fb_tunnel_dev, net);
 
         ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+        ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
 
         if ((err = register_netdev(sitn->fb_tunnel_dev)))
                 goto err_reg_dev;
@@ -1049,35 +1192,34 @@ err_reg_dev:
         dev_put(sitn->fb_tunnel_dev);
         free_netdev(sitn->fb_tunnel_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(sitn);
-err_alloc:
         return err;
 }
 
 static void sit_exit_net(struct net *net)
 {
-        struct sit_net *sitn;
+        struct sit_net *sitn = net_generic(net, sit_net_id);
+        LIST_HEAD(list);
 
-        sitn = net_generic(net, sit_net_id);
         rtnl_lock();
-        sit_destroy_tunnels(sitn);
-        unregister_netdevice(sitn->fb_tunnel_dev);
+        sit_destroy_tunnels(sitn, &list);
+        unregister_netdevice_queue(sitn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
         rtnl_unlock();
-        kfree(sitn);
 }
 
 static struct pernet_operations sit_net_ops = {
         .init = sit_init_net,
         .exit = sit_exit_net,
+        .id   = &sit_net_id,
+        .size = sizeof(struct sit_net),
 };
 
 static void __exit sit_cleanup(void)
 {
         xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
 
-        unregister_pernet_gen_device(sit_net_id, &sit_net_ops);
+        unregister_pernet_device(&sit_net_ops);
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 
 static int __init sit_init(void)
@@ -1091,7 +1233,7 @@ static int __init sit_init(void)
                 return -EAGAIN;
         }
 
-        err = register_pernet_gen_device(&sit_net_id, &sit_net_ops);
+        err = register_pernet_device(&sit_net_ops);
         if (err < 0)
                 xfrm4_tunnel_deregister(&sit_handler, AF_INET6);