Merge branch 'master'

8 files changed, 302 insertions, 229 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2c5f57299d63..b7a5f51238b3 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -35,6 +35,9 @@
  *      YOSHIFUJI Hideaki @USAGI        :       ARCnet support
  *      YOSHIFUJI Hideaki @USAGI        :       convert /proc/net/if_inet6 to
  *                                              seq_file.
+ *      YOSHIFUJI Hideaki @USAGI        :       improved source address
+ *                                              selection; consider scope,
+ *                                              status etc.
  */
 
 #include <linux/config.h>
@@ -193,46 +196,51 @@ const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
 #endif
 const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
 
-int ipv6_addr_type(const struct in6_addr *addr)
+#define IPV6_ADDR_SCOPE_TYPE(scope)     ((scope) << 16)
+
+static inline unsigned ipv6_addr_scope2type(unsigned scope)
+{
+        switch(scope) {
+        case IPV6_ADDR_SCOPE_NODELOCAL:
+                return (IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_NODELOCAL) |
+                        IPV6_ADDR_LOOPBACK);
+        case IPV6_ADDR_SCOPE_LINKLOCAL:
+                return (IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_LINKLOCAL) |
+                        IPV6_ADDR_LINKLOCAL);
+        case IPV6_ADDR_SCOPE_SITELOCAL:
+                return (IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_SITELOCAL) |
+                        IPV6_ADDR_SITELOCAL);
+        }
+        return IPV6_ADDR_SCOPE_TYPE(scope);
+}
+
+int __ipv6_addr_type(const struct in6_addr *addr)
 {
-        int type;
         u32 st;
 
         st = addr->s6_addr32[0];
 
-        if ((st & htonl(0xFF000000)) == htonl(0xFF000000)) {
-                type = IPV6_ADDR_MULTICAST;
-
-                switch((st & htonl(0x00FF0000))) {
-                        case __constant_htonl(0x00010000):
-                                type |= IPV6_ADDR_LOOPBACK;
-                                break;
-
-                        case __constant_htonl(0x00020000):
-                                type |= IPV6_ADDR_LINKLOCAL;
-                                break;
-
-                        case __constant_htonl(0x00050000):
-                                type |= IPV6_ADDR_SITELOCAL;
-                                break;
-                };
-                return type;
-        }
-
-        type = IPV6_ADDR_UNICAST;
-
         /* Consider all addresses with the first three bits different of
-           000 and 111 as finished.
+           000 and 111 as unicasts.
          */
         if ((st & htonl(0xE0000000)) != htonl(0x00000000) &&
             (st & htonl(0xE0000000)) != htonl(0xE0000000))
-                return type;
-        
-        if ((st & htonl(0xFFC00000)) == htonl(0xFE800000))
-                return (IPV6_ADDR_LINKLOCAL | type);
+                return (IPV6_ADDR_UNICAST | 
+                        IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));
+
+        if ((st & htonl(0xFF000000)) == htonl(0xFF000000)) {
+                /* multicast */
+                /* addr-select 3.1 */
+                return (IPV6_ADDR_MULTICAST |
+                        ipv6_addr_scope2type(IPV6_ADDR_MC_SCOPE(addr)));
+        }
 
+        if ((st & htonl(0xFFC00000)) == htonl(0xFE800000))
+                return (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_UNICAST | 
+                        IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_LINKLOCAL));               /* addr-select 3.1 */
         if ((st & htonl(0xFFC00000)) == htonl(0xFEC00000))
-                return (IPV6_ADDR_SITELOCAL | type);
+                return (IPV6_ADDR_SITELOCAL | IPV6_ADDR_UNICAST |
+                        IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_SITELOCAL));               /* addr-select 3.1 */
 
         if ((addr->s6_addr32[0] | addr->s6_addr32[1]) == 0) {
                 if (addr->s6_addr32[2] == 0) {
@@ -240,24 +248,20 @@ int ipv6_addr_type(const struct in6_addr *addr)
                                 return IPV6_ADDR_ANY;
 
                         if (addr->s6_addr32[3] == htonl(0x00000001))
-                                return (IPV6_ADDR_LOOPBACK | type);
+                                return (IPV6_ADDR_LOOPBACK | IPV6_ADDR_UNICAST |
+                                        IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_LINKLOCAL));       /* addr-select 3.4 */
 
-                        return (IPV6_ADDR_COMPATv4 | type);
+                        return (IPV6_ADDR_COMPATv4 | IPV6_ADDR_UNICAST |
+                                IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.3 */
                 }
 
                 if (addr->s6_addr32[2] == htonl(0x0000ffff))
-                        return IPV6_ADDR_MAPPED;
+                        return (IPV6_ADDR_MAPPED | 
+                                IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.3 */
         }
 
-        st &= htonl(0xFF000000);
-        if (st == 0)
-                return IPV6_ADDR_RESERVED;
-        st &= htonl(0xFE000000);
-        if (st == htonl(0x02000000))
-                return IPV6_ADDR_RESERVED;      /* for NSAP */
-        if (st == htonl(0x04000000))
-                return IPV6_ADDR_RESERVED;      /* for IPX */
-        return type;
+        return (IPV6_ADDR_RESERVED | 
+                IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.4 */
 }
 
 static void addrconf_del_timer(struct inet6_ifaddr *ifp)
@@ -805,138 +809,274 @@ out:
 #endif
 
 /*
- *      Choose an appropriate source address
- *      should do:
- *      i)      get an address with an appropriate scope
- *      ii)     see if there is a specific route for the destination and use
- *              an address of the attached interface 
- *      iii)    don't use deprecated addresses
+ *      Choose an appropriate source address (RFC3484)
  */
-static int inline ipv6_saddr_pref(const struct inet6_ifaddr *ifp, u8 invpref)
+struct ipv6_saddr_score {
+        int             addr_type;
+        unsigned int    attrs;
+        int             matchlen;
+        unsigned int    scope;
+        unsigned int    rule;
+};
+
+#define IPV6_SADDR_SCORE_LOCAL          0x0001
+#define IPV6_SADDR_SCORE_PREFERRED      0x0004
+#define IPV6_SADDR_SCORE_HOA            0x0008
+#define IPV6_SADDR_SCORE_OIF            0x0010
+#define IPV6_SADDR_SCORE_LABEL          0x0020
+#define IPV6_SADDR_SCORE_PRIVACY        0x0040
+
+static int inline ipv6_saddr_preferred(int type)
 {
-        int pref;
-        pref = ifp->flags&IFA_F_DEPRECATED ? 0 : 2;
-#ifdef CONFIG_IPV6_PRIVACY
-        pref |= (ifp->flags^invpref)&IFA_F_TEMPORARY ? 0 : 1;
-#endif
-        return pref;
+        if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|
+                    IPV6_ADDR_LOOPBACK|IPV6_ADDR_RESERVED))
+                return 1;
+        return 0;
 }
 
-#ifdef CONFIG_IPV6_PRIVACY
-#define IPV6_GET_SADDR_MAXSCORE(score)  ((score) == 3)
-#else
-#define IPV6_GET_SADDR_MAXSCORE(score)  (score)
-#endif
+/* static matching label */
+static int inline ipv6_saddr_label(const struct in6_addr *addr, int type)
+{
+ /*
+  *     prefix (longest match)  label
+  *     -----------------------------
+  *     ::1/128                 0
+  *     ::/0                    1
+  *     2002::/16               2
+  *     ::/96                   3
+  *     ::ffff:0:0/96           4
+  */
+        if (type & IPV6_ADDR_LOOPBACK)
+                return 0;
+        else if (type & IPV6_ADDR_COMPATv4)
+                return 3;
+        else if (type & IPV6_ADDR_MAPPED)
+                return 4;
+        else if (addr->s6_addr16[0] == htons(0x2002))
+                return 2;
+        return 1;
+}
 
-int ipv6_dev_get_saddr(struct net_device *dev,
+int ipv6_dev_get_saddr(struct net_device *daddr_dev,
                        struct in6_addr *daddr, struct in6_addr *saddr)
 {
-        struct inet6_ifaddr *ifp = NULL;
-        struct inet6_ifaddr *match = NULL;
-        struct inet6_dev *idev;
-        int scope;
-        int err;
-        int hiscore = -1, score;
+        struct ipv6_saddr_score hiscore;
+        struct inet6_ifaddr *ifa_result = NULL;
+        int daddr_type = __ipv6_addr_type(daddr);
+        int daddr_scope = __ipv6_addr_src_scope(daddr_type);
+        u32 daddr_label = ipv6_saddr_label(daddr, daddr_type);
+        struct net_device *dev;
 
-        scope = ipv6_addr_scope(daddr);
+        memset(&hiscore, 0, sizeof(hiscore));
 
-        /*
-         *      known dev
-         *      search dev and walk through dev addresses
-         */
+        read_lock(&dev_base_lock);
+        read_lock(&addrconf_lock);
 
-        if (dev) {
-                if (dev->flags & IFF_LOOPBACK)
-                        scope = IFA_HOST;
+        for (dev = dev_base; dev; dev=dev->next) {
+                struct inet6_dev *idev;
+                struct inet6_ifaddr *ifa;
+
+                /* Rule 0: Candidate Source Address (section 4)
+                 *  - multicast and link-local destination address,
+                 *    the set of candidate source address MUST only
+                 *    include addresses assigned to interfaces
+                 *    belonging to the same link as the outgoing
+                 *    interface.
+                 * (- For site-local destination addresses, the
+                 *    set of candidate source addresses MUST only
+                 *    include addresses assigned to interfaces
+                 *    belonging to the same site as the outgoing
+                 *    interface.)
+                 */
+                if ((daddr_type & IPV6_ADDR_MULTICAST ||
+                     daddr_scope <= IPV6_ADDR_SCOPE_LINKLOCAL) &&
+                    daddr_dev && dev != daddr_dev)
+                        continue;
 
-                read_lock(&addrconf_lock);
                 idev = __in6_dev_get(dev);
-                if (idev) {
-                        read_lock_bh(&idev->lock);
-                        for (ifp=idev->addr_list; ifp; ifp=ifp->if_next) {
-                                if (ifp->scope == scope) {
-                                        if (ifp->flags&IFA_F_TENTATIVE)
-                                                continue;
-#ifdef CONFIG_IPV6_PRIVACY
-                                        score = ipv6_saddr_pref(ifp, idev->cnf.use_tempaddr > 1 ? IFA_F_TEMPORARY : 0);
-#else
-                                        score = ipv6_saddr_pref(ifp, 0);
-#endif
-                                        if (score <= hiscore)
-                                                continue;
+                if (!idev)
+                        continue;
 
-                                        if (match)
-                                                in6_ifa_put(match);
-                                        match = ifp;
-                                        hiscore = score;
-                                        in6_ifa_hold(ifp);
+                read_lock_bh(&idev->lock);
+                for (ifa = idev->addr_list; ifa; ifa = ifa->if_next) {
+                        struct ipv6_saddr_score score;
 
-                                        if (IPV6_GET_SADDR_MAXSCORE(score)) {
-                                                read_unlock_bh(&idev->lock);
-                                                read_unlock(&addrconf_lock);
-                                                goto out;
-                                        }
+                        score.addr_type = __ipv6_addr_type(&ifa->addr);
+
+                        /* Rule 0: Candidate Source Address (section 4)
+                         *  - In any case, anycast addresses, multicast
+                         *    addresses, and the unspecified address MUST
+                         *    NOT be included in a candidate set.
+                         */
+                        if (unlikely(score.addr_type == IPV6_ADDR_ANY ||
+                                     score.addr_type & IPV6_ADDR_MULTICAST)) {
+                                LIMIT_NETDEBUG(KERN_DEBUG
+                                               "ADDRCONF: unspecified / multicast address"
+                                               "assigned as unicast address on %s",
+                                               dev->name);
+                                continue;
+                        }
+
+                        score.attrs = 0;
+                        score.matchlen = 0;
+                        score.scope = 0;
+                        score.rule = 0;
+
+                        if (ifa_result == NULL) {
+                                /* record it if the first available entry */
+                                goto record_it;
+                        }
+
+                        /* Rule 1: Prefer same address */
+                        if (hiscore.rule < 1) {
+                                if (ipv6_addr_equal(&ifa_result->addr, daddr))
+                                        hiscore.attrs |= IPV6_SADDR_SCORE_LOCAL;
+                                hiscore.rule++;
+                        }
+                        if (ipv6_addr_equal(&ifa->addr, daddr)) {
+                                score.attrs |= IPV6_SADDR_SCORE_LOCAL;
+                                if (!(hiscore.attrs & IPV6_SADDR_SCORE_LOCAL)) {
+                                        score.rule = 1;
+                                        goto record_it;
                                 }
+                        } else {
+                                if (hiscore.attrs & IPV6_SADDR_SCORE_LOCAL)
+                                        continue;
                         }
-                        read_unlock_bh(&idev->lock);
-                }
-                read_unlock(&addrconf_lock);
-        }
 
-        if (scope == IFA_LINK)
-                goto out;
+                        /* Rule 2: Prefer appropriate scope */
+                        if (hiscore.rule < 2) {
+                                hiscore.scope = __ipv6_addr_src_scope(hiscore.addr_type);
+                                hiscore.rule++;
+                        }
+                        score.scope = __ipv6_addr_src_scope(score.addr_type);
+                        if (hiscore.scope < score.scope) {
+                                if (hiscore.scope < daddr_scope) {
+                                        score.rule = 2;
+                                        goto record_it;
+                                } else
+                                        continue;
+                        } else if (score.scope < hiscore.scope) {
+                                if (score.scope < daddr_scope)
+                                        continue;
+                                else {
+                                        score.rule = 2;
+                                        goto record_it;
+                                }
+                        }
 
-        /*
-         *      dev == NULL or search failed for specified dev
-         */
+                        /* Rule 3: Avoid deprecated address */
+                        if (hiscore.rule < 3) {
+                                if (ipv6_saddr_preferred(hiscore.addr_type) ||
+                                    !(ifa_result->flags & IFA_F_DEPRECATED))
+                                        hiscore.attrs |= IPV6_SADDR_SCORE_PREFERRED;
+                                hiscore.rule++;
+                        }
+                        if (ipv6_saddr_preferred(score.addr_type) ||
+                            !(ifa->flags & IFA_F_DEPRECATED)) {
+                                score.attrs |= IPV6_SADDR_SCORE_PREFERRED;
+                                if (!(hiscore.attrs & IPV6_SADDR_SCORE_PREFERRED)) {
+                                        score.rule = 3;
+                                        goto record_it;
+                                }
+                        } else {
+                                if (hiscore.attrs & IPV6_SADDR_SCORE_PREFERRED)
+                                        continue;
+                        }
 
-        read_lock(&dev_base_lock);
-        read_lock(&addrconf_lock);
-        for (dev = dev_base; dev; dev=dev->next) {
-                idev = __in6_dev_get(dev);
-                if (idev) {
-                        read_lock_bh(&idev->lock);
-                        for (ifp=idev->addr_list; ifp; ifp=ifp->if_next) {
-                                if (ifp->scope == scope) {
-                                        if (ifp->flags&IFA_F_TENTATIVE)
-                                                continue;
-#ifdef CONFIG_IPV6_PRIVACY
-                                        score = ipv6_saddr_pref(ifp, idev->cnf.use_tempaddr > 1 ? IFA_F_TEMPORARY : 0);
-#else
-                                        score = ipv6_saddr_pref(ifp, 0);
-#endif
-                                        if (score <= hiscore)
-                                                continue;
+                        /* Rule 4: Prefer home address -- not implemented yet */
 
-                                        if (match)
-                                                in6_ifa_put(match);
-                                        match = ifp;
-                                        hiscore = score;
-                                        in6_ifa_hold(ifp);
+                        /* Rule 5: Prefer outgoing interface */
+                        if (hiscore.rule < 5) {
+                                if (daddr_dev == NULL ||
+                                    daddr_dev == ifa_result->idev->dev)
+                                        hiscore.attrs |= IPV6_SADDR_SCORE_OIF;
+                                hiscore.rule++;
+                        }
+                        if (daddr_dev == NULL ||
+                            daddr_dev == ifa->idev->dev) {
+                                score.attrs |= IPV6_SADDR_SCORE_OIF;
+                                if (!(hiscore.attrs & IPV6_SADDR_SCORE_OIF)) {
+                                        score.rule = 5;
+                                        goto record_it;
+                                }
+                        } else {
+                                if (hiscore.attrs & IPV6_SADDR_SCORE_OIF)
+                                        continue;
+                        }
 
-                                        if (IPV6_GET_SADDR_MAXSCORE(score)) {
-                                                read_unlock_bh(&idev->lock);
-                                                goto out_unlock_base;
-                                        }
+                        /* Rule 6: Prefer matching label */
+                        if (hiscore.rule < 6) {
+                                if (ipv6_saddr_label(&ifa_result->addr, hiscore.addr_type) == daddr_label)
+                                        hiscore.attrs |= IPV6_SADDR_SCORE_LABEL;
+                                hiscore.rule++;
+                        }
+                        if (ipv6_saddr_label(&ifa->addr, score.addr_type) == daddr_label) {
+                                score.attrs |= IPV6_SADDR_SCORE_LABEL;
+                                if (!(hiscore.attrs & IPV6_SADDR_SCORE_LABEL)) {
+                                        score.rule = 6;
+                                        goto record_it;
+                                }
+                        } else {
+                                if (hiscore.attrs & IPV6_SADDR_SCORE_LABEL)
+                                        continue;
+                        }
+
+                        /* Rule 7: Prefer public address
+                         * Note: prefer temprary address if use_tempaddr >= 2
+                         */
+                        if (hiscore.rule < 7) {
+                                if ((!(ifa_result->flags & IFA_F_TEMPORARY)) ^
+                                    (ifa_result->idev->cnf.use_tempaddr >= 2))
+                                        hiscore.attrs |= IPV6_SADDR_SCORE_PRIVACY;
+                                hiscore.rule++;
+                        }
+                        if ((!(ifa->flags & IFA_F_TEMPORARY)) ^
+                            (ifa->idev->cnf.use_tempaddr >= 2)) {
+                                score.attrs |= IPV6_SADDR_SCORE_PRIVACY;
+                                if (!(hiscore.attrs & IPV6_SADDR_SCORE_PRIVACY)) {
+                                        score.rule = 7;
+                                        goto record_it;
                                 }
+                        } else {
+                                if (hiscore.attrs & IPV6_SADDR_SCORE_PRIVACY)
+                                        continue;
                         }
-                        read_unlock_bh(&idev->lock);
+
+                        /* Rule 8: Use longest matching prefix */
+                        if (hiscore.rule < 8)
+                                hiscore.matchlen = ipv6_addr_diff(&ifa_result->addr, daddr);
+                        score.rule++;
+                        score.matchlen = ipv6_addr_diff(&ifa->addr, daddr);
+                        if (score.matchlen > hiscore.matchlen) {
+                                score.rule = 8;
+                                goto record_it;
+                        }
+#if 0
+                        else if (score.matchlen < hiscore.matchlen)
+                                continue;
+#endif
+
+                        /* Final Rule: choose first available one */
+                        continue;
+record_it:
+                        if (ifa_result)
+                                in6_ifa_put(ifa_result);
+                        in6_ifa_hold(ifa);
+                        ifa_result = ifa;
+                        hiscore = score;
                 }
+                read_unlock_bh(&idev->lock);
         }
-
-out_unlock_base:
         read_unlock(&addrconf_lock);
         read_unlock(&dev_base_lock);
 
-out:
-        err = -EADDRNOTAVAIL;
-        if (match) {
-                ipv6_addr_copy(saddr, &match->addr);
-                err = 0;
-                in6_ifa_put(match);
-        }
-
-        return err;
+        if (!ifa_result)
+                return -EADDRNOTAVAIL;
+        
+        ipv6_addr_copy(saddr, &ifa_result->addr);
+        in6_ifa_put(ifa_result);
+        return 0;
 }
 
 
@@ -2950,8 +3090,7 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
 
 nlmsg_failure:
 rtattr_failure:
-        if (array)
-                kfree(array);
+        kfree(array);
         skb_trim(skb, b - skb->data);
         return -1;
 }
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 4fcc5a7acf6e..1bf6d9a769e6 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -127,56 +127,6 @@ static __inline__ int addr_bit_set(void *token, int fn_bit)
         return htonl(1 << ((~fn_bit)&0x1F)) & addr[fn_bit>>5];
 }
 
-/*
- *      find the first different bit between two addresses
- *      length of address must be a multiple of 32bits
- */
-
-static __inline__ int addr_diff(void *token1, void *token2, int addrlen)
-{
-        __u32 *a1 = token1;
-        __u32 *a2 = token2;
-        int i;
-
-        addrlen >>= 2;
-
-        for (i = 0; i < addrlen; i++) {
-                __u32 xb;
-
-                xb = a1[i] ^ a2[i];
-
-                if (xb) {
-                        int j = 31;
-
-                        xb = ntohl(xb);
-
-                        while ((xb & (1 << j)) == 0)
-                                j--;
-
-                        return (i * 32 + 31 - j);
-                }
-        }
-
-        /*
-         *      we should *never* get to this point since that 
-         *      would mean the addrs are equal
-         *
-         *      However, we do get to it 8) And exacly, when
-         *      addresses are equal 8)
-         *
-         *      ip route add 1111::/128 via ...
-         *      ip route add 1111::/64 via ...
-         *      and we are here.
-         *
-         *      Ideally, this function should stop comparison
-         *      at prefix length. It does not, but it is still OK,
-         *      if returned value is greater than prefix length.
-         *                                      --ANK (980803)
-         */
-
-        return addrlen<<5;
-}
-
 static __inline__ struct fib6_node * node_alloc(void)
 {
         struct fib6_node *fn;
@@ -296,11 +246,11 @@ insert_above:
 
         /* find 1st bit in difference between the 2 addrs.
 
-           See comment in addr_diff: bit may be an invalid value,
+           See comment in __ipv6_addr_diff: bit may be an invalid value,
            but if it is >= plen, the value is ignored in any case.
          */
         
-        bit = addr_diff(addr, &key->addr, addrlen);
+        bit = __ipv6_addr_diff(addr, &key->addr, addrlen);
 
         /* 
          *              (intermediate)[in]      
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 614296a920c6..dbd9767b32e4 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -587,8 +587,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
                         skb->next = NULL;
                 }
 
-                if (tmp_hdr)
-                        kfree(tmp_hdr);
+                kfree(tmp_hdr);
 
                 if (err == 0) {
                         IP6_INC_STATS(IPSTATS_MIB_FRAGOKS);
@@ -1186,10 +1185,8 @@ int ip6_push_pending_frames(struct sock *sk)
 
 out:
         inet->cork.flags &= ~IPCORK_OPT;
-        if (np->cork.opt) {
-                kfree(np->cork.opt);
-                np->cork.opt = NULL;
-        }
+        kfree(np->cork.opt);
+        np->cork.opt = NULL;
         if (np->cork.rt) {
                 dst_release(&np->cork.rt->u.dst);
                 np->cork.rt = NULL;
@@ -1214,10 +1211,8 @@ void ip6_flush_pending_frames(struct sock *sk)
 
         inet->cork.flags &= ~IPCORK_OPT;
 
-        if (np->cork.opt) {
-                kfree(np->cork.opt);
-                np->cork.opt = NULL;
-        }
+        kfree(np->cork.opt);
+        np->cork.opt = NULL;
         if (np->cork.rt) {
                 dst_release(&np->cork.rt->u.dst);
                 np->cork.rt = NULL;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index cf94372d1af3..e6b0e3954c02 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -756,8 +756,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
         }
         ip6_tnl_dst_store(t, dst);
 
-        if (opt)
-                kfree(opt);
+        kfree(opt);
 
         t->recursion--;
         return 0;
@@ -766,8 +765,7 @@ tx_err_link_failure:
         dst_link_failure(skb);
 tx_err_dst_release:
         dst_release(dst);
-        if (opt)
-                kfree(opt);
+        kfree(opt);
 tx_err:
         stats->tx_errors++;
         stats->tx_dropped++;
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 85bfbc69b2c3..55917fb17094 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -130,8 +130,7 @@ static int ipcomp6_input(struct xfrm_state *x, struct xfrm_decap_state *decap, s
 out_put_cpu:
         put_cpu();
 out:
-        if (tmp_hdr)
-                kfree(tmp_hdr);
+        kfree(tmp_hdr);
         if (err)
                 goto error_out;
         return nexthdr;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 8567873d0dd8..003fd99ff597 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -80,8 +80,7 @@ int ip6_ra_control(struct sock *sk, int sel, void (*destructor)(struct sock *))
                 if (ra->sk == sk) {
                         if (sel>=0) {
                                 write_unlock_bh(&ip6_ra_lock);
-                                if (new_ra)
-                                        kfree(new_ra);
+                                kfree(new_ra);
                                 return -EADDRINUSE;
                         }
 
diff --git a/net/ipv6/ipv6_syms.c b/net/ipv6/ipv6_syms.c
index 37a4a99c9fe9..16482785bdfd 100644
--- a/net/ipv6/ipv6_syms.c
+++ b/net/ipv6/ipv6_syms.c
@@ -7,7 +7,7 @@
 #include <net/ip6_route.h>
 #include <net/xfrm.h>
 
-EXPORT_SYMBOL(ipv6_addr_type);
+EXPORT_SYMBOL(__ipv6_addr_type);
 EXPORT_SYMBOL(icmpv6_send);
 EXPORT_SYMBOL(icmpv6_statistics);
 EXPORT_SYMBOL(icmpv6_err_convert);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index d693cb988b78..d746d3b27efb 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -114,16 +114,9 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                 int low = sysctl_local_port_range[0];
                 int high = sysctl_local_port_range[1];
                 int remaining = (high - low) + 1;
-                int rover;
+                int rover = net_random() % (high - low) + low;
 
-                spin_lock(&tcp_hashinfo.portalloc_lock);
-                if (tcp_hashinfo.port_rover < low)
-                        rover = low;
-                else
-                        rover = tcp_hashinfo.port_rover;
-                do {    rover++;
-                        if (rover > high)
-                                rover = low;
+                do {
                         head = &tcp_hashinfo.bhash[inet_bhashfn(rover, tcp_hashinfo.bhash_size)];
                         spin_lock(&head->lock);
                         inet_bind_bucket_for_each(tb, node, &head->chain)
@@ -132,9 +125,9 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                         break;
                 next:
                         spin_unlock(&head->lock);
+                        if (++rover > high)
+                                rover = low;
                 } while (--remaining > 0);
-                tcp_hashinfo.port_rover = rover;
-                spin_unlock(&tcp_hashinfo.portalloc_lock);
 
                 /* Exhausted local port range during search?  It is not
                  * possible for us to be holding one of the bind hash