Merge branch 'master' into next

8 files changed, 115 insertions, 82 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 88fd8c5877ee..7e567ae5eaab 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1380,6 +1380,8 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
                 if (dad_failed)
                         ifp->flags |= IFA_F_DADFAILED;
                 spin_unlock_bh(&ifp->lock);
+                if (dad_failed)
+                        ipv6_ifa_notify(0, ifp);
                 in6_ifa_put(ifp);
 #ifdef CONFIG_IPV6_PRIVACY
         } else if (ifp->flags&IFA_F_TEMPORARY) {
@@ -2615,7 +2617,7 @@ static void addrconf_bonding_change(struct net_device *dev, unsigned long event)
 static int addrconf_ifdown(struct net_device *dev, int how)
 {
         struct inet6_dev *idev;
-        struct inet6_ifaddr *ifa, **bifa;
+        struct inet6_ifaddr *ifa, *keep_list, **bifa;
         struct net *net = dev_net(dev);
         int i;
 
@@ -2649,11 +2651,11 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                 write_lock_bh(&addrconf_hash_lock);
                 while ((ifa = *bifa) != NULL) {
                         if (ifa->idev == idev &&
-                            (how || !(ifa->flags&IFA_F_PERMANENT))) {
+                            (how || !(ifa->flags&IFA_F_PERMANENT) ||
+                             ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
                                 *bifa = ifa->lst_next;
                                 ifa->lst_next = NULL;
-                                addrconf_del_timer(ifa);
-                                in6_ifa_put(ifa);
+                                __in6_ifa_put(ifa);
                                 continue;
                         }
                         bifa = &ifa->lst_next;
@@ -2689,31 +2691,51 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                 write_lock_bh(&idev->lock);
         }
 #endif
-        bifa = &idev->addr_list;
-        while ((ifa = *bifa) != NULL) {
-                if (how == 0 && (ifa->flags&IFA_F_PERMANENT)) {
-                        /* Retain permanent address on admin down */
+        keep_list = NULL;
+        bifa = &keep_list;
+        while ((ifa = idev->addr_list) != NULL) {
+                idev->addr_list = ifa->if_next;
+                ifa->if_next = NULL;
+
+                addrconf_del_timer(ifa);
+
+                /* If just doing link down, and address is permanent
+                   and not link-local, then retain it. */
+                if (how == 0 &&
+                    (ifa->flags&IFA_F_PERMANENT) &&
+                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
+
+                        /* Move to holding list */
+                        *bifa = ifa;
                         bifa = &ifa->if_next;
 
-                        /* Restart DAD if needed when link comes back up */
-                        if ( !((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
-                               idev->cnf.accept_dad <= 0 ||
-                               (ifa->flags & IFA_F_NODAD)))
-                                ifa->flags |= IFA_F_TENTATIVE;
-                } else {
-                        *bifa = ifa->if_next;
-                        ifa->if_next = NULL;
+                        /* If not doing DAD on this address, just keep it. */
+                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
+                            idev->cnf.accept_dad <= 0 ||
+                            (ifa->flags & IFA_F_NODAD))
+                                continue;
 
+                        /* If it was tentative already, no need to notify */
+                        if (ifa->flags & IFA_F_TENTATIVE)
+                                continue;
+
+                        /* Flag it for later restoration when link comes up */
+                        ifa->flags |= IFA_F_TENTATIVE;
+                        in6_ifa_hold(ifa);
+                } else {
                         ifa->dead = 1;
-                        write_unlock_bh(&idev->lock);
+                }
+                write_unlock_bh(&idev->lock);
 
-                        __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                        atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
-                        in6_ifa_put(ifa);
+                __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                atomic_notifier_call_chain(&inet6addr_chain, NETDEV_DOWN, ifa);
+                in6_ifa_put(ifa);
 
-                        write_lock_bh(&idev->lock);
-                }
+                write_lock_bh(&idev->lock);
         }
+
+        idev->addr_list = keep_list;
+
         write_unlock_bh(&idev->lock);
 
         /* Step 5: Discard multicast list */
@@ -2739,28 +2761,29 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 static void addrconf_rs_timer(unsigned long data)
 {
         struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
+        struct inet6_dev *idev = ifp->idev;
 
-        if (ifp->idev->cnf.forwarding)
+        read_lock(&idev->lock);
+        if (idev->dead || !(idev->if_flags & IF_READY))
                 goto out;
 
-        if (ifp->idev->if_flags & IF_RA_RCVD) {
-                /*
-                 *      Announcement received after solicitation
-                 *      was sent
-                 */
+        if (idev->cnf.forwarding)
+                goto out;
+
+        /* Announcement received after solicitation was sent */
+        if (idev->if_flags & IF_RA_RCVD)
                 goto out;
-        }
 
         spin_lock(&ifp->lock);
-        if (ifp->probes++ < ifp->idev->cnf.rtr_solicits) {
+        if (ifp->probes++ < idev->cnf.rtr_solicits) {
                 /* The wait after the last probe can be shorter */
                 addrconf_mod_timer(ifp, AC_RS,
-                                   (ifp->probes == ifp->idev->cnf.rtr_solicits) ?
-                                   ifp->idev->cnf.rtr_solicit_delay :
-                                   ifp->idev->cnf.rtr_solicit_interval);
+                                   (ifp->probes == idev->cnf.rtr_solicits) ?
+                                   idev->cnf.rtr_solicit_delay :
+                                   idev->cnf.rtr_solicit_interval);
                 spin_unlock(&ifp->lock);
 
-                ndisc_send_rs(ifp->idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
+                ndisc_send_rs(idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
         } else {
                 spin_unlock(&ifp->lock);
                 /*
@@ -2768,10 +2791,11 @@ static void addrconf_rs_timer(unsigned long data)
                  * assumption any longer.
                  */
                 printk(KERN_DEBUG "%s: no IPv6 routers present\n",
-                       ifp->idev->dev->name);
+                       idev->dev->name);
         }
 
 out:
+        read_unlock(&idev->lock);
         in6_ifa_put(ifp);
 }
 
@@ -2850,9 +2874,9 @@ static void addrconf_dad_timer(unsigned long data)
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr mcaddr;
 
-        read_lock_bh(&idev->lock);
-        if (idev->dead) {
-                read_unlock_bh(&idev->lock);
+        read_lock(&idev->lock);
+        if (idev->dead || !(idev->if_flags & IF_READY)) {
+                read_unlock(&idev->lock);
                 goto out;
         }
 
@@ -2864,7 +2888,7 @@ static void addrconf_dad_timer(unsigned long data)
 
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
                 spin_unlock(&ifp->lock);
-                read_unlock_bh(&idev->lock);
+                read_unlock(&idev->lock);
 
                 addrconf_dad_completed(ifp);
 
@@ -2874,7 +2898,7 @@ static void addrconf_dad_timer(unsigned long data)
         ifp->probes--;
         addrconf_mod_timer(ifp, AC_DAD, ifp->idev->nd_parms->retrans_time);
         spin_unlock(&ifp->lock);
-        read_unlock_bh(&idev->lock);
+        read_unlock(&idev->lock);
 
         /* send a neighbour solicitation for our addr */
         addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
@@ -3586,7 +3610,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                 hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
-                        if (idx > s_idx)
+                        if (h > s_h || idx > s_idx)
                                 s_ip_idx = 0;
                         ip_idx = 0;
                         if ((idev = __in6_dev_get(dev)) == NULL)
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 551882b9dfd6..5e463c43fcc2 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -84,18 +84,11 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                 if ((rule->flags & FIB_RULE_FIND_SADDR) &&
                     r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
                         struct in6_addr saddr;
-                        unsigned int srcprefs = 0;
-
-                        if (flags & RT6_LOOKUP_F_SRCPREF_TMP)
-                                srcprefs |= IPV6_PREFER_SRC_TMP;
-                        if (flags & RT6_LOOKUP_F_SRCPREF_PUBLIC)
-                                srcprefs |= IPV6_PREFER_SRC_PUBLIC;
-                        if (flags & RT6_LOOKUP_F_SRCPREF_COA)
-                                srcprefs |= IPV6_PREFER_SRC_COA;
 
                         if (ipv6_dev_get_saddr(net,
                                                ip6_dst_idev(&rt->u.dst)->dev,
-                                               &flp->fl6_dst, srcprefs,
+                                               &flp->fl6_dst,
+                                               rt6_flags2srcprefs(flags),
                                                &saddr))
                                 goto again;
                         if (!ipv6_prefix_equal(&saddr, &r->src.addr,
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 52e0f74fdfe0..27acfb58650a 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1113,6 +1113,9 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
         unsigned char ttls[MAXMIFS];
         int i;
 
+        if (mfc->mf6cc_parent >= MAXMIFS)
+                return -ENFILE;
+
         memset(ttls, 255, MAXMIFS);
         for (i = 0; i < MAXMIFS; i++) {
                 if (IF_ISSET(i, &mfc->mf6cc_ifset))
@@ -1692,17 +1695,20 @@ ip6mr_fill_mroute(struct sk_buff *skb, struct mfc6_cache *c, struct rtmsg *rtm)
         int ct;
         struct rtnexthop *nhp;
         struct net *net = mfc6_net(c);
-        struct net_device *dev = net->ipv6.vif6_table[c->mf6c_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
-        if (dev)
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        /* If cache is unresolved, don't try to parse IIF and OIF */
+        if (c->mf6c_parent > MAXMIFS)
+                return -ENOENT;
+
+        if (MIF_EXISTS(net, c->mf6c_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv6.vif6_table[c->mf6c_parent].dev->ifindex);
 
         mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (MIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index aef31a29de9e..b9cf7cd61923 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -13,7 +13,7 @@ static const struct xt_table packet_raw = {
         .valid_hooks = RAW_VALID_HOOKS,
         .me = THIS_MODULE,
         .af = NFPROTO_IPV6,
-        .priority = NF_IP6_PRI_FIRST,
+        .priority = NF_IP6_PRI_RAW,
 };
 
 /* The work comes in here from netfilter.c. */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b08879e97f22..0d7713c5c206 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -819,15 +819,8 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 
         if (!ipv6_addr_any(&fl->fl6_src))
                 flags |= RT6_LOOKUP_F_HAS_SADDR;
-        else if (sk) {
-                unsigned int prefs = inet6_sk(sk)->srcprefs;
-                if (prefs & IPV6_PREFER_SRC_TMP)
-                        flags |= RT6_LOOKUP_F_SRCPREF_TMP;
-                if (prefs & IPV6_PREFER_SRC_PUBLIC)
-                        flags |= RT6_LOOKUP_F_SRCPREF_PUBLIC;
-                if (prefs & IPV6_PREFER_SRC_COA)
-                        flags |= RT6_LOOKUP_F_SRCPREF_COA;
-        }
+        else if (sk)
+                flags |= rt6_srcprefs2flags(inet6_sk(sk)->srcprefs);
 
         return fib6_rule_lookup(net, fl, flags, ip6_pol_route_output);
 }
@@ -886,7 +879,7 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
-        if (rt && rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
                 return dst;
 
         return NULL;
@@ -897,12 +890,17 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
         struct rt6_info *rt = (struct rt6_info *) dst;
 
         if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE)
-                        ip6_del_rt(rt);
-                else
+                if (rt->rt6i_flags & RTF_CACHE) {
+                        if (rt6_check_expired(rt)) {
+                                ip6_del_rt(rt);
+                                dst = NULL;
+                        }
+                } else {
                         dst_release(dst);
+                        dst = NULL;
+                }
         }
-        return NULL;
+        return dst;
 }
 
 static void ip6_link_failure(struct sk_buff *skb)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 6963a6b6763e..9b6dbba80d31 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1740,8 +1740,11 @@ process:
                         if (!tcp_prequeue(sk, skb))
                                 ret = tcp_v6_do_rcv(sk, skb);
                 }
-        } else
-                sk_add_backlog(sk, skb);
+        } else if (unlikely(sk_add_backlog(sk, skb))) {
+                bh_unlock_sock(sk);
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
+                goto discard_and_relse;
+        }
         bh_unlock_sock(sk);
 
         sock_put(sk);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 52b8347ae3b2..3c0c9c755c92 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -583,16 +583,20 @@ static void flush_stack(struct sock **stack, unsigned int count,
                         bh_lock_sock(sk);
                         if (!sock_owned_by_user(sk))
                                 udpv6_queue_rcv_skb(sk, skb1);
-                        else
-                                sk_add_backlog(sk, skb1);
+                        else if (sk_add_backlog(sk, skb1)) {
+                                kfree_skb(skb1);
+                                bh_unlock_sock(sk);
+                                goto drop;
+                        }
                         bh_unlock_sock(sk);
-                } else {
-                        atomic_inc(&sk->sk_drops);
-                        UDP6_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
-                        UDP6_INC_STATS_BH(sock_net(sk),
-                                        UDP_MIB_INERRORS, IS_UDPLITE(sk));
+                        continue;
                 }
+drop:
+                atomic_inc(&sk->sk_drops);
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_INERRORS, IS_UDPLITE(sk));
         }
 }
 /*
@@ -754,8 +758,12 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
-        else
-                sk_add_backlog(sk, skb);
+        else if (sk_add_backlog(sk, skb)) {
+                atomic_inc(&sk->sk_drops);
+                bh_unlock_sock(sk);
+                sock_put(sk);
+                goto discard;
+        }
         bh_unlock_sock(sk);
         sock_put(sk);
         return 0;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index dbdc696f5fc5..ae181651c75a 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -116,7 +116,8 @@ static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
         return 0;
 }
 
-static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
+static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+                          struct flowi *fl)
 {
         struct rt6_info *rt = (struct rt6_info*)xdst->route;