Merge branch 'master' of /repos/git/net-next-2.6

Conflicts:
	net/bridge/br_device.c
	net/bridge/br_forward.c

Signed-off-by: Patrick McHardy <kaber@trash.net>

15 files changed, 312 insertions, 146 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7cba8845242f..3984f52181f4 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -588,7 +588,8 @@ static u32 ipv6_addr_hash(const struct in6_addr *addr)
          * We perform the hash function over the last 64 bits of the address
          * This will include the IEEE address token on links that support it.
          */
-        return jhash_2words(addr->s6_addr32[2],  addr->s6_addr32[3], 0)
+        return jhash_2words((__force u32)addr->s6_addr32[2],
+                            (__force u32)addr->s6_addr32[3], 0)
                 & (IN6_ADDR_HSIZE - 1);
 }
 
@@ -1345,7 +1346,7 @@ struct inet6_ifaddr *ipv6_get_ifaddr(struct net *net, const struct in6_addr *add
         struct hlist_node *node;
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(ifp, node, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu_bh(ifp, node, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr)) {
@@ -2958,7 +2959,7 @@ static struct inet6_ifaddr *if6_get_first(struct seq_file *seq)
 
         for (state->bucket = 0; state->bucket < IN6_ADDR_HSIZE; ++state->bucket) {
                 struct hlist_node *n;
-                hlist_for_each_entry_rcu(ifa, n, &inet6_addr_lst[state->bucket],
+                hlist_for_each_entry_rcu_bh(ifa, n, &inet6_addr_lst[state->bucket],
                                          addr_lst)
                         if (net_eq(dev_net(ifa->idev->dev), net))
                                 return ifa;
@@ -2973,12 +2974,12 @@ static struct inet6_ifaddr *if6_get_next(struct seq_file *seq,
         struct net *net = seq_file_net(seq);
         struct hlist_node *n = &ifa->addr_lst;
 
-        hlist_for_each_entry_continue_rcu(ifa, n, addr_lst)
+        hlist_for_each_entry_continue_rcu_bh(ifa, n, addr_lst)
                 if (net_eq(dev_net(ifa->idev->dev), net))
                         return ifa;
 
         while (++state->bucket < IN6_ADDR_HSIZE) {
-                hlist_for_each_entry(ifa, n,
+                hlist_for_each_entry_rcu_bh(ifa, n,
                                      &inet6_addr_lst[state->bucket], addr_lst) {
                         if (net_eq(dev_net(ifa->idev->dev), net))
                                 return ifa;
@@ -2999,7 +3000,7 @@ static struct inet6_ifaddr *if6_get_idx(struct seq_file *seq, loff_t pos)
 }
 
 static void *if6_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(rcu)
+        __acquires(rcu_bh)
 {
         rcu_read_lock_bh();
         return if6_get_idx(seq, *pos);
@@ -3015,7 +3016,7 @@ static void *if6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 
 static void if6_seq_stop(struct seq_file *seq, void *v)
-        __releases(rcu)
+        __releases(rcu_bh)
 {
         rcu_read_unlock_bh();
 }
@@ -3092,7 +3093,7 @@ int ipv6_chk_home_addr(struct net *net, struct in6_addr *addr)
         unsigned int hash = ipv6_addr_hash(addr);
 
         rcu_read_lock_bh();
-        hlist_for_each_entry_rcu(ifp, n, &inet6_addr_lst[hash], addr_lst) {
+        hlist_for_each_entry_rcu_bh(ifp, n, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
                 if (ipv6_addr_equal(&ifp->addr, addr) &&
@@ -3126,7 +3127,7 @@ static void addrconf_verify(unsigned long foo)
 
         for (i = 0; i < IN6_ADDR_HSIZE; i++) {
 restart:
-                hlist_for_each_entry_rcu(ifp, node,
+                hlist_for_each_entry_rcu_bh(ifp, node,
                                          &inet6_addr_lst[i], addr_lst) {
                         unsigned long age;
 
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3192aa02ba5d..d2df3144429b 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -417,6 +417,9 @@ void inet6_destroy_sock(struct sock *sk)
         if ((skb = xchg(&np->pktoptions, NULL)) != NULL)
                 kfree_skb(skb);
 
+        if ((skb = xchg(&np->rxpmtu, NULL)) != NULL)
+                kfree_skb(skb);
+
         /* Free flowlabels */
         fl6_free_socklist(sk);
 
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 622dc7939a1b..5959230bc6c1 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -278,6 +278,45 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
                 kfree_skb(skb);
 }
 
+void ipv6_local_rxpmtu(struct sock *sk, struct flowi *fl, u32 mtu)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct ipv6hdr *iph;
+        struct sk_buff *skb;
+        struct ip6_mtuinfo *mtu_info;
+
+        if (!np->rxopt.bits.rxpmtu)
+                return;
+
+        skb = alloc_skb(sizeof(struct ipv6hdr), GFP_ATOMIC);
+        if (!skb)
+                return;
+
+        skb_put(skb, sizeof(struct ipv6hdr));
+        skb_reset_network_header(skb);
+        iph = ipv6_hdr(skb);
+        ipv6_addr_copy(&iph->daddr, &fl->fl6_dst);
+
+        mtu_info = IP6CBMTU(skb);
+        if (!mtu_info) {
+                kfree_skb(skb);
+                return;
+        }
+
+        mtu_info->ip6m_mtu = mtu;
+        mtu_info->ip6m_addr.sin6_family = AF_INET6;
+        mtu_info->ip6m_addr.sin6_port = 0;
+        mtu_info->ip6m_addr.sin6_flowinfo = 0;
+        mtu_info->ip6m_addr.sin6_scope_id = fl->oif;
+        ipv6_addr_copy(&mtu_info->ip6m_addr.sin6_addr, &ipv6_hdr(skb)->daddr);
+
+        __skb_pull(skb, skb_tail_pointer(skb) - skb->data);
+        skb_reset_transport_header(skb);
+
+        skb = xchg(&np->rxpmtu, skb);
+        kfree_skb(skb);
+}
+
 /*
  *      Handle MSG_ERRQUEUE
  */
@@ -381,6 +420,54 @@ out:
         return err;
 }
 
+/*
+ *      Handle IPV6_RECVPATHMTU
+ */
+int ipv6_recv_rxpmtu(struct sock *sk, struct msghdr *msg, int len)
+{
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct sk_buff *skb;
+        struct sockaddr_in6 *sin;
+        struct ip6_mtuinfo mtu_info;
+        int err;
+        int copied;
+
+        err = -EAGAIN;
+        skb = xchg(&np->rxpmtu, NULL);
+        if (skb == NULL)
+                goto out;
+
+        copied = skb->len;
+        if (copied > len) {
+                msg->msg_flags |= MSG_TRUNC;
+                copied = len;
+        }
+        err = skb_copy_datagram_iovec(skb, 0, msg->msg_iov, copied);
+        if (err)
+                goto out_free_skb;
+
+        sock_recv_timestamp(msg, sk, skb);
+
+        memcpy(&mtu_info, IP6CBMTU(skb), sizeof(mtu_info));
+
+        sin = (struct sockaddr_in6 *)msg->msg_name;
+        if (sin) {
+                sin->sin6_family = AF_INET6;
+                sin->sin6_flowinfo = 0;
+                sin->sin6_port = 0;
+                sin->sin6_scope_id = mtu_info.ip6m_addr.sin6_scope_id;
+                ipv6_addr_copy(&sin->sin6_addr, &mtu_info.ip6m_addr.sin6_addr);
+        }
+
+        put_cmsg(msg, SOL_IPV6, IPV6_PATHMTU, sizeof(mtu_info), &mtu_info);
+
+        err = copied;
+
+out_free_skb:
+        kfree_skb(skb);
+out:
+        return err;
+}
 
 
 int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
@@ -497,7 +584,7 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
 int datagram_send_ctl(struct net *net,
                       struct msghdr *msg, struct flowi *fl,
                       struct ipv6_txoptions *opt,
-                      int *hlimit, int *tclass)
+                      int *hlimit, int *tclass, int *dontfrag)
 {
         struct in6_pktinfo *src_info;
         struct cmsghdr *cmsg;
@@ -737,6 +824,25 @@ int datagram_send_ctl(struct net *net,
 
                         break;
                     }
+
+                case IPV6_DONTFRAG:
+                    {
+                        int df;
+
+                        err = -EINVAL;
+                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
+                                goto exit_f;
+                        }
+
+                        df = *(int *)CMSG_DATA(cmsg);
+                        if (df < 0 || df > 1)
+                                goto exit_f;
+
+                        err = 0;
+                        *dontfrag = df;
+
+                        break;
+                    }
                 default:
                         LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
                                        cmsg->cmsg_type);
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 8124f16f2ac2..8e44f8f9c188 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -237,8 +237,8 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
                + nla_total_size(16); /* src */
 }
 
-static struct fib_rules_ops fib6_rules_ops_template = {
-        .family                 = FIB_RULES_IPV6,
+static const struct fib_rules_ops __net_initdata fib6_rules_ops_template = {
+        .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
         .addr_size              = sizeof(struct in6_addr),
         .action                 = fib6_rule_action,
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 12d2fa42657d..ce7992982557 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -481,7 +481,7 @@ route_done:
                               len + sizeof(struct icmp6hdr),
                               sizeof(struct icmp6hdr), hlimit,
                               np->tclass, NULL, &fl, (struct rt6_info*)dst,
-                              MSG_DONTWAIT);
+                              MSG_DONTWAIT, np->dontfrag);
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
                 ip6_flush_pending_frames(sk);
@@ -561,7 +561,8 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
                                 sizeof(struct icmp6hdr), hlimit, np->tclass, NULL, &fl,
-                                (struct rt6_info*)dst, MSG_DONTWAIT);
+                                (struct rt6_info*)dst, MSG_DONTWAIT,
+                                np->dontfrag);
 
         if (err) {
                 ICMP6_INC_STATS_BH(net, idev, ICMP6_MIB_OUTMSGS);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index dc6e0b8f260d..92a122b7795d 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -144,7 +144,8 @@ static __inline__ __be32 addr_bit_set(void *token, int fn_bit)
          *      htonl(1 << ((~fn_bit)&0x1F))
          * See include/asm-generic/bitops/le.h.
          */
-        return (1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)) & addr[fn_bit >> 5];
+        return (__force __be32)(1 << ((~fn_bit ^ BITOP_BE32_SWIZZLE) & 0x1f)) &
+               addr[fn_bit >> 5];
 }
 
 static __inline__ struct fib6_node * node_alloc(void)
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 14e23216eb28..13654686aeab 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -360,7 +360,8 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                 msg.msg_control = (void*)(fl->opt+1);
                 flowi.oif = 0;
 
-                err = datagram_send_ctl(net, &msg, &flowi, fl->opt, &junk, &junk);
+                err = datagram_send_ctl(net, &msg, &flowi, fl->opt, &junk,
+                                        &junk, &junk);
                 if (err)
                         goto done;
                 err = -EINVAL;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7f12e30cfa73..5173acaeb501 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -92,7 +92,7 @@ static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
         WARN_ON(!skb_dst(newskb));
 
-        netif_rx(newskb);
+        netif_rx_ni(newskb);
         return 0;
 }
 
@@ -216,8 +216,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
                         }
                         kfree_skb(skb);
                         skb = skb2;
-                        if (sk)
-                                skb_set_owner_w(skb, sk);
+                        skb_set_owner_w(skb, sk);
                 }
                 if (opt->opt_flen)
                         ipv6_push_frag_opts(skb, opt, &proto);
@@ -623,7 +622,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         /* We must not fragment if the socket is set to force MTU discovery
          * or if the skb it not generated by a local socket.
          */
-        if (!skb->local_df) {
+        if (!skb->local_df && skb->len > mtu) {
                 skb->dev = skb_dst(skb)->dev;
                 icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
@@ -1103,7 +1102,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
         int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl,
-        struct rt6_info *rt, unsigned int flags)
+        struct rt6_info *rt, unsigned int flags, int dontfrag)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -1217,15 +1216,23 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
          */
 
         inet->cork.length += length;
-        if (((length > mtu) && (sk->sk_protocol == IPPROTO_UDP)) &&
-            (rt->u.dst.dev->features & NETIF_F_UFO)) {
+        if (length > mtu) {
+                int proto = sk->sk_protocol;
+                if (dontfrag && (proto == IPPROTO_UDP || proto == IPPROTO_RAW)){
+                        ipv6_local_rxpmtu(sk, fl, mtu-exthdrlen);
+                        return -EMSGSIZE;
+                }
 
-                err = ip6_ufo_append_data(sk, getfrag, from, length, hh_len,
-                                          fragheaderlen, transhdrlen, mtu,
-                                          flags);
-                if (err)
-                        goto error;
-                return 0;
+                if (proto == IPPROTO_UDP &&
+                    (rt->u.dst.dev->features & NETIF_F_UFO)) {
+
+                        err = ip6_ufo_append_data(sk, getfrag, from, length,
+                                                  hh_len, fragheaderlen,
+                                                  transhdrlen, mtu, flags);
+                        if (err)
+                                goto error;
+                        return 0;
+                }
         }
 
         if ((skb = skb_peek_tail(&sk->sk_write_queue)) == NULL)
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 1160400e9dbd..bd43f0152c21 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -337,6 +337,13 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 retv = 0;
                 break;
 
+        case IPV6_RECVPATHMTU:
+                if (optlen < sizeof(int))
+                        goto e_inval;
+                np->rxopt.bits.rxpmtu = valbool;
+                retv = 0;
+                break;
+
         case IPV6_HOPOPTS:
         case IPV6_RTHDRDSTOPTS:
         case IPV6_RTHDR:
@@ -451,7 +458,8 @@ sticky_done:
                 msg.msg_controllen = optlen;
                 msg.msg_control = (void*)(opt+1);
 
-                retv = datagram_send_ctl(net, &msg, &fl, opt, &junk, &junk);
+                retv = datagram_send_ctl(net, &msg, &fl, opt, &junk, &junk,
+                                         &junk);
                 if (retv)
                         goto done;
 update:
@@ -767,6 +775,17 @@ pref_skip_coa:
 
                 break;
             }
+        case IPV6_MINHOPCOUNT:
+                if (optlen < sizeof(int))
+                        goto e_inval;
+                if (val < 0 || val > 255)
+                        goto e_inval;
+                np->min_hopcount = val;
+                break;
+        case IPV6_DONTFRAG:
+                np->dontfrag = valbool;
+                retv = 0;
+                break;
         }
 
         release_sock(sk);
@@ -1055,6 +1074,38 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 val = np->rxopt.bits.rxflow;
                 break;
 
+        case IPV6_RECVPATHMTU:
+                val = np->rxopt.bits.rxpmtu;
+                break;
+
+        case IPV6_PATHMTU:
+        {
+                struct dst_entry *dst;
+                struct ip6_mtuinfo mtuinfo;
+
+                if (len < sizeof(mtuinfo))
+                        return -EINVAL;
+
+                len = sizeof(mtuinfo);
+                memset(&mtuinfo, 0, sizeof(mtuinfo));
+
+                rcu_read_lock();
+                dst = __sk_dst_get(sk);
+                if (dst)
+                        mtuinfo.ip6m_mtu = dst_mtu(dst);
+                rcu_read_unlock();
+                if (!mtuinfo.ip6m_mtu)
+                        return -ENOTCONN;
+
+                if (put_user(len, optlen))
+                        return -EFAULT;
+                if (copy_to_user(optval, &mtuinfo, len))
+                        return -EFAULT;
+
+                return 0;
+                break;
+        }
+
         case IPV6_UNICAST_HOPS:
         case IPV6_MULTICAST_HOPS:
         {
@@ -1116,6 +1167,14 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                         val |= IPV6_PREFER_SRC_HOME;
                 break;
 
+        case IPV6_MINHOPCOUNT:
+                val = np->min_hopcount;
+                break;
+
+        case IPV6_DONTFRAG:
+                val = np->dontfrag;
+                break;
+
         default:
                 return -ENOPROTOOPT;
         }
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f9d05ce4e03a..59f1881968c7 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -44,6 +44,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/slab.h>
+#include <net/mld.h>
 
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -71,54 +72,11 @@
 #define MDBG(x)
 #endif
 
-/*
- *  These header formats should be in a separate include file, but icmpv6.h
- *  doesn't have in6_addr defined in all cases, there is no __u128, and no
- *  other files reference these.
- *
- *                      +-DLS 4/14/03
- */
-
-/* Multicast Listener Discovery version 2 headers */
-
-struct mld2_grec {
-        __u8            grec_type;
-        __u8            grec_auxwords;
-        __be16          grec_nsrcs;
-        struct in6_addr grec_mca;
-        struct in6_addr grec_src[0];
-};
-
-struct mld2_report {
-        __u8    type;
-        __u8    resv1;
-        __sum16 csum;
-        __be16  resv2;
-        __be16  ngrec;
-        struct mld2_grec grec[0];
-};
-
-struct mld2_query {
-        __u8 type;
-        __u8 code;
-        __sum16 csum;
-        __be16 mrc;
-        __be16 resv1;
-        struct in6_addr mca;
-#if defined(__LITTLE_ENDIAN_BITFIELD)
-        __u8 qrv:3,
-             suppress:1,
-             resv2:4;
-#elif defined(__BIG_ENDIAN_BITFIELD)
-        __u8 resv2:4,
-             suppress:1,
-             qrv:3;
-#else
-#error "Please fix <asm/byteorder.h>"
-#endif
-        __u8 qqic;
-        __be16 nsrcs;
-        struct in6_addr srcs[0];
+/* Ensure that we have struct in6_addr aligned on 32bit word. */
+static void *__mld2_query_bugs[] __attribute__((__unused__)) = {
+        BUILD_BUG_ON_NULL(offsetof(struct mld2_query, mld2q_srcs) % 4),
+        BUILD_BUG_ON_NULL(offsetof(struct mld2_report, mld2r_grec) % 4),
+        BUILD_BUG_ON_NULL(offsetof(struct mld2_grec, grec_mca) % 4)
 };
 
 static struct in6_addr mld2_all_mcr = MLD2_ALL_MCR_INIT;
@@ -157,14 +115,6 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
                 ((idev)->mc_v1_seen && \
                 time_before(jiffies, (idev)->mc_v1_seen)))
 
-#define MLDV2_MASK(value, nb) ((nb)>=32 ? (value) : ((1<<(nb))-1) & (value))
-#define MLDV2_EXP(thresh, nbmant, nbexp, value) \
-        ((value) < (thresh) ? (value) : \
-        ((MLDV2_MASK(value, nbmant) | (1<<(nbmant))) << \
-        (MLDV2_MASK((value) >> (nbmant), nbexp) + (nbexp))))
-
-#define MLDV2_MRC(value) MLDV2_EXP(0x8000, 12, 3, value)
-
 #define IPV6_MLD_MAX_MSF        64
 
 int sysctl_mld_max_msf __read_mostly = IPV6_MLD_MAX_MSF;
@@ -1161,7 +1111,7 @@ int igmp6_event_query(struct sk_buff *skb)
         struct in6_addr *group;
         unsigned long max_delay;
         struct inet6_dev *idev;
-        struct icmp6hdr *hdr;
+        struct mld_msg *mld;
         int group_type;
         int mark = 0;
         int len;
@@ -1182,8 +1132,8 @@ int igmp6_event_query(struct sk_buff *skb)
         if (idev == NULL)
                 return 0;
 
-        hdr = icmp6_hdr(skb);
-        group = (struct in6_addr *) (hdr + 1);
+        mld = (struct mld_msg *)icmp6_hdr(skb);
+        group = &mld->mld_mca;
         group_type = ipv6_addr_type(group);
 
         if (group_type != IPV6_ADDR_ANY &&
@@ -1197,7 +1147,7 @@ int igmp6_event_query(struct sk_buff *skb)
                 /* MLDv1 router present */
 
                 /* Translate milliseconds to jiffies */
-                max_delay = (ntohs(hdr->icmp6_maxdelay)*HZ)/1000;
+                max_delay = (ntohs(mld->mld_maxdelay)*HZ)/1000;
 
                 switchback = (idev->mc_qrv + 1) * max_delay;
                 idev->mc_v1_seen = jiffies + switchback;
@@ -1216,14 +1166,14 @@ int igmp6_event_query(struct sk_buff *skb)
                         return -EINVAL;
                 }
                 mlh2 = (struct mld2_query *)skb_transport_header(skb);
-                max_delay = (MLDV2_MRC(ntohs(mlh2->mrc))*HZ)/1000;
+                max_delay = (MLDV2_MRC(ntohs(mlh2->mld2q_mrc))*HZ)/1000;
                 if (!max_delay)
                         max_delay = 1;
                 idev->mc_maxdelay = max_delay;
-                if (mlh2->qrv)
-                        idev->mc_qrv = mlh2->qrv;
+                if (mlh2->mld2q_qrv)
+                        idev->mc_qrv = mlh2->mld2q_qrv;
                 if (group_type == IPV6_ADDR_ANY) { /* general query */
-                        if (mlh2->nsrcs) {
+                        if (mlh2->mld2q_nsrcs) {
                                 in6_dev_put(idev);
                                 return -EINVAL; /* no sources allowed */
                         }
@@ -1232,9 +1182,9 @@ int igmp6_event_query(struct sk_buff *skb)
                         return 0;
                 }
                 /* mark sources to include, if group & source-specific */
-                if (mlh2->nsrcs != 0) {
+                if (mlh2->mld2q_nsrcs != 0) {
                         if (!pskb_may_pull(skb, srcs_offset +
-                            ntohs(mlh2->nsrcs) * sizeof(struct in6_addr))) {
+                            ntohs(mlh2->mld2q_nsrcs) * sizeof(struct in6_addr))) {
                                 in6_dev_put(idev);
                                 return -EINVAL;
                         }
@@ -1270,7 +1220,7 @@ int igmp6_event_query(struct sk_buff *skb)
                                         ma->mca_flags &= ~MAF_GSQUERY;
                         }
                         if (!(ma->mca_flags & MAF_GSQUERY) ||
-                            mld_marksources(ma, ntohs(mlh2->nsrcs), mlh2->srcs))
+                            mld_marksources(ma, ntohs(mlh2->mld2q_nsrcs), mlh2->mld2q_srcs))
                                 igmp6_group_queried(ma, max_delay);
                         spin_unlock_bh(&ma->mca_lock);
                         break;
@@ -1286,9 +1236,8 @@ int igmp6_event_query(struct sk_buff *skb)
 int igmp6_event_report(struct sk_buff *skb)
 {
         struct ifmcaddr6 *ma;
-        struct in6_addr *addrp;
         struct inet6_dev *idev;
-        struct icmp6hdr *hdr;
+        struct mld_msg *mld;
         int addr_type;
 
         /* Our own report looped back. Ignore it. */
@@ -1300,10 +1249,10 @@ int igmp6_event_report(struct sk_buff *skb)
             skb->pkt_type != PACKET_BROADCAST)
                 return 0;
 
-        if (!pskb_may_pull(skb, sizeof(struct in6_addr)))
+        if (!pskb_may_pull(skb, sizeof(*mld) - sizeof(struct icmp6hdr)))
                 return -EINVAL;
 
-        hdr = icmp6_hdr(skb);
+        mld = (struct mld_msg *)icmp6_hdr(skb);
 
         /* Drop reports with not link local source */
         addr_type = ipv6_addr_type(&ipv6_hdr(skb)->saddr);
@@ -1311,8 +1260,6 @@ int igmp6_event_report(struct sk_buff *skb)
             !(addr_type&IPV6_ADDR_LINKLOCAL))
                 return -EINVAL;
 
-        addrp = (struct in6_addr *) (hdr + 1);
-
         idev = in6_dev_get(skb->dev);
         if (idev == NULL)
                 return -ENODEV;
@@ -1323,7 +1270,7 @@ int igmp6_event_report(struct sk_buff *skb)
 
         read_lock_bh(&idev->lock);
         for (ma = idev->mc_list; ma; ma=ma->next) {
-                if (ipv6_addr_equal(&ma->mca_addr, addrp)) {
+                if (ipv6_addr_equal(&ma->mca_addr, &mld->mld_mca)) {
                         spin_lock(&ma->mca_lock);
                         if (del_timer(&ma->mca_timer))
                                 atomic_dec(&ma->mca_refcnt);
@@ -1432,11 +1379,11 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
         skb_set_transport_header(skb, skb_tail_pointer(skb) - skb->data);
         skb_put(skb, sizeof(*pmr));
         pmr = (struct mld2_report *)skb_transport_header(skb);
-        pmr->type = ICMPV6_MLD2_REPORT;
-        pmr->resv1 = 0;
-        pmr->csum = 0;
-        pmr->resv2 = 0;
-        pmr->ngrec = 0;
+        pmr->mld2r_type = ICMPV6_MLD2_REPORT;
+        pmr->mld2r_resv1 = 0;
+        pmr->mld2r_cksum = 0;
+        pmr->mld2r_resv2 = 0;
+        pmr->mld2r_ngrec = 0;
         return skb;
 }
 
@@ -1458,9 +1405,10 @@ static void mld_sendpack(struct sk_buff *skb)
         mldlen = skb->tail - skb->transport_header;
         pip6->payload_len = htons(payload_len);
 
-        pmr->csum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
-                IPPROTO_ICMPV6, csum_partial(skb_transport_header(skb),
-                                             mldlen, 0));
+        pmr->mld2r_cksum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
+                                           IPPROTO_ICMPV6,
+                                           csum_partial(skb_transport_header(skb),
+                                                        mldlen, 0));
 
         dst = icmp6_dst_alloc(skb->dev, NULL, &ipv6_hdr(skb)->daddr);
 
@@ -1521,7 +1469,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
         pgr->grec_nsrcs = 0;
         pgr->grec_mca = pmc->mca_addr;  /* structure copy */
         pmr = (struct mld2_report *)skb_transport_header(skb);
-        pmr->ngrec = htons(ntohs(pmr->ngrec)+1);
+        pmr->mld2r_ngrec = htons(ntohs(pmr->mld2r_ngrec)+1);
         *ppgr = pgr;
         return skb;
 }
@@ -1557,7 +1505,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
 
         /* EX and TO_EX get a fresh packet, if needed */
         if (truncate) {
-                if (pmr && pmr->ngrec &&
+                if (pmr && pmr->mld2r_ngrec &&
                     AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
                         if (skb)
                                 mld_sendpack(skb);
@@ -1770,9 +1718,8 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
         struct sock *sk = net->ipv6.igmp_sk;
         struct inet6_dev *idev;
         struct sk_buff *skb;
-        struct icmp6hdr *hdr;
+        struct mld_msg *hdr;
         const struct in6_addr *snd_addr, *saddr;
-        struct in6_addr *addrp;
         struct in6_addr addr_buf;
         int err, len, payload_len, full_len;
         u8 ra[8] = { IPPROTO_ICMPV6, 0,
@@ -1820,16 +1767,14 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 
         memcpy(skb_put(skb, sizeof(ra)), ra, sizeof(ra));
 
-        hdr = (struct icmp6hdr *) skb_put(skb, sizeof(struct icmp6hdr));
-        memset(hdr, 0, sizeof(struct icmp6hdr));
-        hdr->icmp6_type = type;
+        hdr = (struct mld_msg *) skb_put(skb, sizeof(struct mld_msg));
+        memset(hdr, 0, sizeof(struct mld_msg));
+        hdr->mld_type = type;
+        ipv6_addr_copy(&hdr->mld_mca, addr);
 
-        addrp = (struct in6_addr *) skb_put(skb, sizeof(struct in6_addr));
-        ipv6_addr_copy(addrp, addr);
-
-        hdr->icmp6_cksum = csum_ipv6_magic(saddr, snd_addr, len,
-                                           IPPROTO_ICMPV6,
-                                           csum_partial(hdr, len, 0));
+        hdr->mld_cksum = csum_ipv6_magic(saddr, snd_addr, len,
+                                         IPPROTO_ICMPV6,
+                                         csum_partial(hdr, len, 0));
 
         idev = in6_dev_get(skb->dev);
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 554b48b6e993..4a4dcbe4f8b2 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -381,7 +381,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
         }
 
         /* Charge it to the socket. */
-        if (sock_queue_rcv_skb(sk, skb) < 0) {
+        if (ip_queue_rcv_skb(sk, skb) < 0) {
                 kfree_skb(skb);
                 return NET_RX_DROP;
         }
@@ -461,6 +461,9 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (flags & MSG_ERRQUEUE)
                 return ipv6_recv_error(sk, msg, len);
 
+        if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+                return ipv6_recv_rxpmtu(sk, msg, len);
+
         skb = skb_recv_datagram(sk, flags, noblock, &err);
         if (!skb)
                 goto out;
@@ -733,6 +736,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int addr_len = msg->msg_namelen;
         int hlimit = -1;
         int tclass = -1;
+        int dontfrag = -1;
         u16 proto;
         int err;
 
@@ -811,7 +815,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
 
-                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit,
+                                        &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -880,6 +885,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         if (tclass < 0)
                 tclass = np->tclass;
 
+        if (dontfrag < 0)
+                dontfrag = np->dontfrag;
+
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
 
@@ -890,7 +898,7 @@ back_from_confirm:
                 lock_sock(sk);
                 err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov,
                         len, 0, hlimit, tclass, opt, &fl, (struct rt6_info*)dst,
-                        msg->msg_flags);
+                        msg->msg_flags, dontfrag);
 
                 if (err)
                         ip6_flush_pending_frames(sk);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c2438e8cb9d0..05ebd7833043 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -815,7 +815,7 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 {
         int flags = 0;
 
-        if (rt6_need_strict(&fl->fl6_dst))
+        if (fl->oif || rt6_need_strict(&fl->fl6_dst))
                 flags |= RT6_LOOKUP_F_IFACE;
 
         if (!ipv6_addr_any(&fl->fl6_src))
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index bd5ef7b6e48e..6603511e3673 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -353,6 +353,11 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
 
+        if (ipv6_hdr(skb)->hop_limit < inet6_sk(sk)->min_hopcount) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto out;
+        }
+
         tp = tcp_sk(sk);
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
@@ -1018,7 +1023,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
 
         t1 = (struct tcphdr *) skb_push(buff, tot_len);
-        skb_reset_transport_header(skb);
+        skb_reset_transport_header(buff);
 
         /* Swap the send and the receive. */
         memset(t1, 0, sizeof(*t1));
@@ -1050,12 +1055,13 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         }
 #endif
 
-        buff->csum = csum_partial(t1, tot_len, 0);
-
         memset(&fl, 0, sizeof(fl));
         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&fl.fl6_src, &ipv6_hdr(skb)->daddr);
 
+        buff->ip_summed = CHECKSUM_PARTIAL;
+        buff->csum = 0;
+
         __tcp_v6_send_check(buff, &fl.fl6_src, &fl.fl6_dst);
 
         fl.proto = IPPROTO_TCP;
@@ -1234,12 +1240,12 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                         goto drop_and_free;
 
                 /* Secret recipe starts with IP addresses */
-                d = &ipv6_hdr(skb)->daddr.s6_addr32[0];
+                d = (__force u32 *)&ipv6_hdr(skb)->daddr.s6_addr32[0];
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
-                d = &ipv6_hdr(skb)->saddr.s6_addr32[0];
+                d = (__force u32 *)&ipv6_hdr(skb)->saddr.s6_addr32[0];
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
                 *mess++ ^= *d++;
@@ -1677,6 +1683,7 @@ ipv6_pktoptions:
 static int tcp_v6_rcv(struct sk_buff *skb)
 {
         struct tcphdr *th;
+        struct ipv6hdr *hdr;
         struct sock *sk;
         int ret;
         struct net *net = dev_net(skb->dev);
@@ -1703,12 +1710,13 @@ static int tcp_v6_rcv(struct sk_buff *skb)
                 goto bad_packet;
 
         th = tcp_hdr(skb);
+        hdr = ipv6_hdr(skb);
         TCP_SKB_CB(skb)->seq = ntohl(th->seq);
         TCP_SKB_CB(skb)->end_seq = (TCP_SKB_CB(skb)->seq + th->syn + th->fin +
                                     skb->len - th->doff*4);
         TCP_SKB_CB(skb)->ack_seq = ntohl(th->ack_seq);
         TCP_SKB_CB(skb)->when = 0;
-        TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
+        TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(hdr);
         TCP_SKB_CB(skb)->sacked = 0;
 
         sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -1719,6 +1727,11 @@ process:
         if (sk->sk_state == TCP_TIME_WAIT)
                 goto do_time_wait;
 
+        if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) {
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP);
+                goto discard_and_relse;
+        }
+
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 90824852f598..3d7a2c0b836a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -91,9 +91,9 @@ static unsigned int udp6_portaddr_hash(struct net *net,
         if (ipv6_addr_any(addr6))
                 hash = jhash_1word(0, mix);
         else if (ipv6_addr_v4mapped(addr6))
-                hash = jhash_1word(addr6->s6_addr32[3], mix);
+                hash = jhash_1word((__force u32)addr6->s6_addr32[3], mix);
         else
-                hash = jhash2(addr6->s6_addr32, 4, mix);
+                hash = jhash2((__force u32 *)addr6->s6_addr32, 4, mix);
 
         return hash ^ port;
 }
@@ -335,6 +335,9 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         if (flags & MSG_ERRQUEUE)
                 return ipv6_recv_error(sk, msg, len);
 
+        if (np->rxpmtu && np->rxopt.bits.rxpmtu)
+                return ipv6_recv_rxpmtu(sk, msg, len);
+
 try_again:
         skb = __skb_recv_datagram(sk, flags | (noblock ? MSG_DONTWAIT : 0),
                                   &peeked, &err);
@@ -421,7 +424,7 @@ out:
         return err;
 
 csum_copy_err:
-        lock_sock(sk);
+        lock_sock_bh(sk);
         if (!skb_kill_datagram(sk, skb, flags)) {
                 if (is_udp4)
                         UDP_INC_STATS_USER(sock_net(sk),
@@ -430,7 +433,7 @@ csum_copy_err:
                         UDP6_INC_STATS_USER(sock_net(sk),
                                         UDP_MIB_INERRORS, is_udplite);
         }
-        release_sock(sk);
+        unlock_sock_bh(sk);
 
         if (flags & MSG_DONTWAIT)
                 return -EAGAIN;
@@ -511,7 +514,7 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                         goto drop;
         }
 
-        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
+        if ((rc = ip_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
                 if (rc == -ENOMEM)
                         UDP6_INC_STATS_BH(sock_net(sk),
@@ -581,6 +584,10 @@ static void flush_stack(struct sock **stack, unsigned int count,
 
                 sk = stack[i];
                 if (skb1) {
+                        if (sk_rcvqueues_full(sk, skb)) {
+                                kfree_skb(skb1);
+                                goto drop;
+                        }
                         bh_lock_sock(sk);
                         if (!sock_owned_by_user(sk))
                                 udpv6_queue_rcv_skb(sk, skb1);
@@ -692,7 +699,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         u32 ulen = 0;
 
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
-                goto short_packet;
+                goto discard;
 
         saddr = &ipv6_hdr(skb)->saddr;
         daddr = &ipv6_hdr(skb)->daddr;
@@ -756,6 +763,10 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
 
         /* deliver */
 
+        if (sk_rcvqueues_full(sk, skb)) {
+                sock_put(sk);
+                goto discard;
+        }
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
@@ -770,9 +781,14 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         return 0;
 
 short_packet:
-        LIMIT_NETDEBUG(KERN_DEBUG "UDP%sv6: short packet: %d/%u\n",
+        LIMIT_NETDEBUG(KERN_DEBUG "UDP%sv6: short packet: From [%pI6c]:%u %d/%d to [%pI6c]:%u\n",
                        proto == IPPROTO_UDPLITE ? "-Lite" : "",
-                       ulen, skb->len);
+                       saddr,
+                       ntohs(uh->source),
+                       ulen,
+                       skb->len,
+                       daddr,
+                       ntohs(uh->dest));
 
 discard:
         UDP6_INC_STATS_BH(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
@@ -919,6 +935,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int ulen = len;
         int hlimit = -1;
         int tclass = -1;
+        int dontfrag = -1;
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int err;
         int connected = 0;
@@ -1049,7 +1066,8 @@ do_udp_sendmsg:
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(*opt);
 
-                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit, &tclass);
+                err = datagram_send_ctl(sock_net(sk), msg, &fl, opt, &hlimit,
+                                        &tclass, &dontfrag);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -1120,6 +1138,9 @@ do_udp_sendmsg:
         if (tclass < 0)
                 tclass = np->tclass;
 
+        if (dontfrag < 0)
+                dontfrag = np->dontfrag;
+
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
 back_from_confirm:
@@ -1143,7 +1164,7 @@ do_append_data:
         err = ip6_append_data(sk, getfrag, msg->msg_iov, ulen,
                 sizeof(struct udphdr), hlimit, tclass, opt, &fl,
                 (struct rt6_info*)dst,
-                corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
+                corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags, dontfrag);
         if (err)
                 udp_v6_flush_pending_frames(sk);
         else if (!corkreq)
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8c452fd5ceae..4a0e77e14468 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -94,7 +94,7 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
         xdst->u.dst.dev = dev;
         dev_hold(dev);
 
-        xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev);
+        xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
         if (!xdst->u.rt6.rt6i_idev)
                 return -ENODEV;