Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-2.6: (1232 commits)
  iucv: Fix bad merging.
  net_sched: Add size table for qdiscs
  net_sched: Add accessor function for packet length for qdiscs
  net_sched: Add qdisc_enqueue wrapper
  highmem: Export totalhigh_pages.
  ipv6 mcast: Omit redundant address family checks in ip6_mc_source().
  net: Use standard structures for generic socket address structures.
  ipv6 netns: Make several "global" sysctl variables namespace aware.
  netns: Use net_eq() to compare net-namespaces for optimization.
  ipv6: remove unused macros from net/ipv6.h
  ipv6: remove unused parameter from ip6_ra_control
  tcp: fix kernel panic with listening_get_next
  tcp: Remove redundant checks when setting eff_sacks
  tcp: options clean up
  tcp: Fix MD5 signatures for non-linear skbs
  sctp: Update sctp global memory limit allocations.
  sctp: remove unnecessary byteshifting, calculate directly in big-endian
  sctp: Allow only 1 listening socket with SO_REUSEADDR
  sctp: Do not leak memory on multiple listen() calls
  sctp: Support ipv6only AF_INET6 sockets.
  ...

34 files changed, 728 insertions, 479 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index ff61a5cdb0b3..580ae506c399 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -6,8 +6,6 @@
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  *
- *      $Id: addrconf.c,v 1.69 2001/10/31 21:55:54 davem Exp $
- *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
@@ -121,6 +119,7 @@ static void ipv6_regen_rndid(unsigned long data);
 static int desync_factor = MAX_DESYNC_FACTOR * HZ;
 #endif
 
+static int ipv6_generate_eui64(u8 *eui, struct net_device *dev);
 static int ipv6_count_addresses(struct inet6_dev *idev);
 
 /*
@@ -185,6 +184,8 @@ struct ipv6_devconf ipv6_devconf __read_mostly = {
 #endif
         .proxy_ndp              = 0,
         .accept_source_route    = 0,    /* we do not accept RH0 by default. */
+        .disable_ipv6           = 0,
+        .accept_dad             = 1,
 };
 
 static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
@@ -217,6 +218,8 @@ static struct ipv6_devconf ipv6_devconf_dflt __read_mostly = {
 #endif
         .proxy_ndp              = 0,
         .accept_source_route    = 0,    /* we do not accept RH0 by default. */
+        .disable_ipv6           = 0,
+        .accept_dad             = 1,
 };
 
 /* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
@@ -226,9 +229,15 @@ const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_IN
 const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
 
 /* Check if a valid qdisc is available */
-static inline int addrconf_qdisc_ok(struct net_device *dev)
+static inline bool addrconf_qdisc_ok(const struct net_device *dev)
+{
+        return !qdisc_tx_is_noop(dev);
+}
+
+/* Check if a route is valid prefix route */
+static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
 {
-        return (dev->qdisc != &noop_qdisc);
+        return ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0);
 }
 
 static void addrconf_del_timer(struct inet6_ifaddr *ifp)
@@ -344,6 +353,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                 kfree(ndev);
                 return NULL;
         }
+        if (ndev->cnf.forwarding)
+                dev_disable_lro(dev);
         /* We refer to the device */
         dev_hold(dev);
 
@@ -372,6 +383,9 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
          */
         in6_dev_hold(ndev);
 
+        if (dev->flags & (IFF_NOARP | IFF_LOOPBACK))
+                ndev->cnf.accept_dad = -1;
+
 #if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT && (dev->priv_flags & IFF_ISATAP)) {
                 printk(KERN_INFO
@@ -438,6 +452,8 @@ static void dev_forward_change(struct inet6_dev *idev)
         if (!idev)
                 return;
         dev = idev->dev;
+        if (idev->cnf.forwarding)
+                dev_disable_lro(dev);
         if (dev && (dev->flags & IFF_MULTICAST)) {
                 if (idev->cnf.forwarding)
                         ipv6_dev_mc_inc(dev, &in6addr_linklocal_allrouters);
@@ -483,12 +499,14 @@ static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
         if (p == &net->ipv6.devconf_dflt->forwarding)
                 return;
 
+        rtnl_lock();
         if (p == &net->ipv6.devconf_all->forwarding) {
                 __s32 newf = net->ipv6.devconf_all->forwarding;
                 net->ipv6.devconf_dflt->forwarding = newf;
                 addrconf_forward_change(net, newf);
         } else if ((!*p) ^ (!old))
                 dev_forward_change((struct inet6_dev *)table->extra1);
+        rtnl_unlock();
 
         if (*p)
                 rt6_purge_dflt_routers(net);
@@ -568,6 +586,13 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         struct rt6_info *rt;
         int hash;
         int err = 0;
+        int addr_type = ipv6_addr_type(addr);
+
+        if (addr_type == IPV6_ADDR_ANY ||
+            addr_type & IPV6_ADDR_MULTICAST ||
+            (!(idev->dev->flags & IFF_LOOPBACK) &&
+             addr_type & IPV6_ADDR_LOOPBACK))
+                return ERR_PTR(-EADDRNOTAVAIL);
 
         rcu_read_lock_bh();
         if (idev->dead) {
@@ -777,7 +802,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
                 ipv6_addr_prefix(&prefix, &ifp->addr, ifp->prefix_len);
                 rt = rt6_lookup(net, &prefix, NULL, ifp->idev->dev->ifindex, 1);
 
-                if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
+                if (rt && addrconf_is_prefix_route(rt)) {
                         if (onlink == 0) {
                                 ip6_del_rt(rt);
                                 rt = NULL;
@@ -958,7 +983,8 @@ static inline int ipv6_saddr_preferred(int type)
         return 0;
 }
 
-static int ipv6_get_saddr_eval(struct ipv6_saddr_score *score,
+static int ipv6_get_saddr_eval(struct net *net,
+                               struct ipv6_saddr_score *score,
                                struct ipv6_saddr_dst *dst,
                                int i)
 {
@@ -1037,7 +1063,8 @@ static int ipv6_get_saddr_eval(struct ipv6_saddr_score *score,
                 break;
         case IPV6_SADDR_RULE_LABEL:
                 /* Rule 6: Prefer matching label */
-                ret = ipv6_addr_label(&score->ifa->addr, score->addr_type,
+                ret = ipv6_addr_label(net,
+                                      &score->ifa->addr, score->addr_type,
                                       score->ifa->idev->dev->ifindex) == dst->label;
                 break;
 #ifdef CONFIG_IPV6_PRIVACY
@@ -1091,7 +1118,7 @@ int ipv6_dev_get_saddr(struct net_device *dst_dev,
         dst.addr = daddr;
         dst.ifindex = dst_dev ? dst_dev->ifindex : 0;
         dst.scope = __ipv6_addr_src_scope(dst_type);
-        dst.label = ipv6_addr_label(daddr, dst_type, dst.ifindex);
+        dst.label = ipv6_addr_label(net, daddr, dst_type, dst.ifindex);
         dst.prefs = prefs;
 
         hiscore->rule = -1;
@@ -1159,8 +1186,8 @@ int ipv6_dev_get_saddr(struct net_device *dst_dev,
                         for (i = 0; i < IPV6_SADDR_RULE_MAX; i++) {
                                 int minihiscore, miniscore;
 
-                                minihiscore = ipv6_get_saddr_eval(hiscore, &dst, i);
-                                miniscore = ipv6_get_saddr_eval(score, &dst, i);
+                                minihiscore = ipv6_get_saddr_eval(net, hiscore, &dst, i);
+                                miniscore = ipv6_get_saddr_eval(net, score, &dst, i);
 
                                 if (minihiscore > miniscore) {
                                         if (i == IPV6_SADDR_RULE_SCOPE &&
@@ -1400,6 +1427,20 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp)
 
 void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 {
+        struct inet6_dev *idev = ifp->idev;
+        if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
+                struct in6_addr addr;
+
+                addr.s6_addr32[0] = htonl(0xfe800000);
+                addr.s6_addr32[1] = 0;
+
+                if (!ipv6_generate_eui64(addr.s6_addr + 8, idev->dev) &&
+                    ipv6_addr_equal(&ifp->addr, &addr)) {
+                        /* DAD failed for link-local based on MAC address */
+                        idev->cnf.disable_ipv6 = 1;
+                }
+        }
+
         if (net_ratelimit())
                 printk(KERN_INFO "%s: duplicate address detected!\n", ifp->idev->dev->name);
         addrconf_dad_stop(ifp);
@@ -1788,7 +1829,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                 rt = rt6_lookup(dev_net(dev), &pinfo->prefix, NULL,
                                 dev->ifindex, 1);
 
-                if (rt && ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0)) {
+                if (rt && addrconf_is_prefix_route(rt)) {
                         /* Autoconf prefix route */
                         if (valid_lft == 0) {
                                 ip6_del_rt(rt);
@@ -1822,6 +1863,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                 struct inet6_ifaddr * ifp;
                 struct in6_addr addr;
                 int create = 0, update_lft = 0;
+                struct net *net = dev_net(dev);
 
                 if (pinfo->prefix_len == 64) {
                         memcpy(&addr, &pinfo->prefix, 8);
@@ -1840,7 +1882,7 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
 
 ok:
 
-                ifp = ipv6_get_ifaddr(dev_net(dev), &addr, dev, 1);
+                ifp = ipv6_get_ifaddr(net, &addr, dev, 1);
 
                 if (ifp == NULL && valid_lft) {
                         int max_addresses = in6_dev->cnf.max_addresses;
@@ -1848,7 +1890,7 @@ ok:
 
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
                         if (in6_dev->cnf.optimistic_dad &&
-                            !ipv6_devconf.forwarding)
+                            !net->ipv6.devconf_all->forwarding)
                                 addr_flags = IFA_F_OPTIMISTIC;
 #endif
 
@@ -2273,11 +2315,12 @@ static void init_loopback(struct net_device *dev)
 static void addrconf_add_linklocal(struct inet6_dev *idev, struct in6_addr *addr)
 {
         struct inet6_ifaddr * ifp;
+        struct net *net = dev_net(idev->dev);
         u32 addr_flags = IFA_F_PERMANENT;
 
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
         if (idev->cnf.optimistic_dad &&
-            !ipv6_devconf.forwarding)
+            !net->ipv6.devconf_all->forwarding)
                 addr_flags |= IFA_F_OPTIMISTIC;
 #endif
 
@@ -2732,6 +2775,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
         spin_lock_bh(&ifp->lock);
 
         if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
+            idev->cnf.accept_dad < 1 ||
             !(ifp->flags&IFA_F_TENTATIVE) ||
             ifp->flags & IFA_F_NODAD) {
                 ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC);
@@ -2779,6 +2823,11 @@ static void addrconf_dad_timer(unsigned long data)
                 read_unlock_bh(&idev->lock);
                 goto out;
         }
+        if (idev->cnf.accept_dad > 1 && idev->cnf.disable_ipv6) {
+                read_unlock_bh(&idev->lock);
+                addrconf_dad_failure(ifp);
+                return;
+        }
         spin_lock_bh(&ifp->lock);
         if (ifp->probes == 0) {
                 /*
@@ -3638,6 +3687,8 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 #ifdef CONFIG_IPV6_MROUTE
         array[DEVCONF_MC_FORWARDING] = cnf->mc_forwarding;
 #endif
+        array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
+        array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
 }
 
 static inline size_t inet6_if_nlmsg_size(void)
@@ -4197,6 +4248,22 @@ static struct addrconf_sysctl_table
                 },
 #endif
                 {
+                        .ctl_name       =       CTL_UNNUMBERED,
+                        .procname       =       "disable_ipv6",
+                        .data           =       &ipv6_devconf.disable_ipv6,
+                        .maxlen         =       sizeof(int),
+                        .mode           =       0644,
+                        .proc_handler   =       &proc_dointvec,
+                },
+                {
+                        .ctl_name       =       CTL_UNNUMBERED,
+                        .procname       =       "accept_dad",
+                        .data           =       &ipv6_devconf.accept_dad,
+                        .maxlen         =       sizeof(int),
+                        .mode           =       0644,
+                        .proc_handler   =       &proc_dointvec,
+                },
+                {
                         .ctl_name       =       0,      /* sentinel */
                 }
         },
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 9bfa8846f262..08909039d87b 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -29,6 +29,9 @@
  */
 struct ip6addrlbl_entry
 {
+#ifdef CONFIG_NET_NS
+        struct net *lbl_net;
+#endif
         struct in6_addr prefix;
         int prefixlen;
         int ifindex;
@@ -46,6 +49,16 @@ static struct ip6addrlbl_table
         u32 seq;
 } ip6addrlbl_table;
 
+static inline
+struct net *ip6addrlbl_net(const struct ip6addrlbl_entry *lbl)
+{
+#ifdef CONFIG_NET_NS
+        return lbl->lbl_net;
+#else
+        return &init_net;
+#endif
+}
+
 /*
  * Default policy table (RFC3484 + extensions)
  *
@@ -65,7 +78,7 @@ static struct ip6addrlbl_table
 
 #define IPV6_ADDR_LABEL_DEFAULT 0xffffffffUL
 
-static const __initdata struct ip6addrlbl_init_table
+static const __net_initdata struct ip6addrlbl_init_table
 {
         const struct in6_addr *prefix;
         int prefixlen;
@@ -108,6 +121,9 @@ static const __initdata struct ip6addrlbl_init_table
 /* Object management */
 static inline void ip6addrlbl_free(struct ip6addrlbl_entry *p)
 {
+#ifdef CONFIG_NET_NS
+        release_net(p->lbl_net);
+#endif
         kfree(p);
 }
 
@@ -128,10 +144,13 @@ static inline void ip6addrlbl_put(struct ip6addrlbl_entry *p)
 }
 
 /* Find label */
-static int __ip6addrlbl_match(struct ip6addrlbl_entry *p,
+static int __ip6addrlbl_match(struct net *net,
+                              struct ip6addrlbl_entry *p,
                               const struct in6_addr *addr,
                               int addrtype, int ifindex)
 {
+        if (!net_eq(ip6addrlbl_net(p), net))
+                return 0;
         if (p->ifindex && p->ifindex != ifindex)
                 return 0;
         if (p->addrtype && p->addrtype != addrtype)
@@ -141,19 +160,21 @@ static int __ip6addrlbl_match(struct ip6addrlbl_entry *p,
         return 1;
 }
 
-static struct ip6addrlbl_entry *__ipv6_addr_label(const struct in6_addr *addr,
+static struct ip6addrlbl_entry *__ipv6_addr_label(struct net *net,
+                                                  const struct in6_addr *addr,
                                                   int type, int ifindex)
 {
         struct hlist_node *pos;
         struct ip6addrlbl_entry *p;
         hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) {
-                if (__ip6addrlbl_match(p, addr, type, ifindex))
+                if (__ip6addrlbl_match(net, p, addr, type, ifindex))
                         return p;
         }
         return NULL;
 }
 
-u32 ipv6_addr_label(const struct in6_addr *addr, int type, int ifindex)
+u32 ipv6_addr_label(struct net *net,
+                    const struct in6_addr *addr, int type, int ifindex)
 {
         u32 label;
         struct ip6addrlbl_entry *p;
@@ -161,7 +182,7 @@ u32 ipv6_addr_label(const struct in6_addr *addr, int type, int ifindex)
         type &= IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK;
 
         rcu_read_lock();
-        p = __ipv6_addr_label(addr, type, ifindex);
+        p = __ipv6_addr_label(net, addr, type, ifindex);
         label = p ? p->label : IPV6_ADDR_LABEL_DEFAULT;
         rcu_read_unlock();
 
@@ -174,7 +195,8 @@ u32 ipv6_addr_label(const struct in6_addr *addr, int type, int ifindex)
 }
 
 /* allocate one entry */
-static struct ip6addrlbl_entry *ip6addrlbl_alloc(const struct in6_addr *prefix,
+static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net,
+                                                 const struct in6_addr *prefix,
                                                  int prefixlen, int ifindex,
                                                  u32 label)
 {
@@ -216,6 +238,9 @@ static struct ip6addrlbl_entry *ip6addrlbl_alloc(const struct in6_addr *prefix,
         newp->addrtype = addrtype;
         newp->label = label;
         INIT_HLIST_NODE(&newp->list);
+#ifdef CONFIG_NET_NS
+        newp->lbl_net = hold_net(net);
+#endif
         atomic_set(&newp->refcnt, 1);
         return newp;
 }
@@ -237,6 +262,7 @@ static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
                 hlist_for_each_entry_safe(p, pos, n,
                                           &ip6addrlbl_table.head, list) {
                         if (p->prefixlen == newp->prefixlen &&
+                            net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
                             p->ifindex == newp->ifindex &&
                             ipv6_addr_equal(&p->prefix, &newp->prefix)) {
                                 if (!replace) {
@@ -261,7 +287,8 @@ out:
 }
 
 /* add a label */
-static int ip6addrlbl_add(const struct in6_addr *prefix, int prefixlen,
+static int ip6addrlbl_add(struct net *net,
+                          const struct in6_addr *prefix, int prefixlen,
                           int ifindex, u32 label, int replace)
 {
         struct ip6addrlbl_entry *newp;
@@ -274,7 +301,7 @@ static int ip6addrlbl_add(const struct in6_addr *prefix, int prefixlen,
                         (unsigned int)label,
                         replace);
 
-        newp = ip6addrlbl_alloc(prefix, prefixlen, ifindex, label);
+        newp = ip6addrlbl_alloc(net, prefix, prefixlen, ifindex, label);
         if (IS_ERR(newp))
                 return PTR_ERR(newp);
         spin_lock(&ip6addrlbl_table.lock);
@@ -286,7 +313,8 @@ static int ip6addrlbl_add(const struct in6_addr *prefix, int prefixlen,
 }
 
 /* remove a label */
-static int __ip6addrlbl_del(const struct in6_addr *prefix, int prefixlen,
+static int __ip6addrlbl_del(struct net *net,
+                            const struct in6_addr *prefix, int prefixlen,
                             int ifindex)
 {
         struct ip6addrlbl_entry *p = NULL;
@@ -300,6 +328,7 @@ static int __ip6addrlbl_del(const struct in6_addr *prefix, int prefixlen,
 
         hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) {
                 if (p->prefixlen == prefixlen &&
+                    net_eq(ip6addrlbl_net(p), net) &&
                     p->ifindex == ifindex &&
                     ipv6_addr_equal(&p->prefix, prefix)) {
                         hlist_del_rcu(&p->list);
@@ -311,7 +340,8 @@ static int __ip6addrlbl_del(const struct in6_addr *prefix, int prefixlen,
         return ret;
 }
 
-static int ip6addrlbl_del(const struct in6_addr *prefix, int prefixlen,
+static int ip6addrlbl_del(struct net *net,
+                          const struct in6_addr *prefix, int prefixlen,
                           int ifindex)
 {
         struct in6_addr prefix_buf;
@@ -324,13 +354,13 @@ static int ip6addrlbl_del(const struct in6_addr *prefix, int prefixlen,
 
         ipv6_addr_prefix(&prefix_buf, prefix, prefixlen);
         spin_lock(&ip6addrlbl_table.lock);
-        ret = __ip6addrlbl_del(&prefix_buf, prefixlen, ifindex);
+        ret = __ip6addrlbl_del(net, &prefix_buf, prefixlen, ifindex);
         spin_unlock(&ip6addrlbl_table.lock);
         return ret;
 }
 
 /* add default label */
-static __init int ip6addrlbl_init(void)
+static int __net_init ip6addrlbl_net_init(struct net *net)
 {
         int err = 0;
         int i;
@@ -338,7 +368,8 @@ static __init int ip6addrlbl_init(void)
         ADDRLABEL(KERN_DEBUG "%s()\n", __func__);
 
         for (i = 0; i < ARRAY_SIZE(ip6addrlbl_init_table); i++) {
-                int ret = ip6addrlbl_add(ip6addrlbl_init_table[i].prefix,
+                int ret = ip6addrlbl_add(net,
+                                         ip6addrlbl_init_table[i].prefix,
                                          ip6addrlbl_init_table[i].prefixlen,
                                          0,
                                          ip6addrlbl_init_table[i].label, 0);
@@ -349,11 +380,32 @@ static __init int ip6addrlbl_init(void)
         return err;
 }
 
+static void __net_exit ip6addrlbl_net_exit(struct net *net)
+{
+        struct ip6addrlbl_entry *p = NULL;
+        struct hlist_node *pos, *n;
+
+        /* Remove all labels belonging to the exiting net */
+        spin_lock(&ip6addrlbl_table.lock);
+        hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) {
+                if (net_eq(ip6addrlbl_net(p), net)) {
+                        hlist_del_rcu(&p->list);
+                        ip6addrlbl_put(p);
+                }
+        }
+        spin_unlock(&ip6addrlbl_table.lock);
+}
+
+static struct pernet_operations ipv6_addr_label_ops = {
+        .init = ip6addrlbl_net_init,
+        .exit = ip6addrlbl_net_exit,
+};
+
 int __init ipv6_addr_label_init(void)
 {
         spin_lock_init(&ip6addrlbl_table.lock);
 
-        return ip6addrlbl_init();
+        return register_pernet_subsys(&ipv6_addr_label_ops);
 }
 
 static const struct nla_policy ifal_policy[IFAL_MAX+1] = {
@@ -371,9 +423,6 @@ static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh,
         u32 label;
         int err = 0;
 
-        if (net != &init_net)
-                return 0;
-
         err = nlmsg_parse(nlh, sizeof(*ifal), tb, IFAL_MAX, ifal_policy);
         if (err < 0)
                 return err;
@@ -385,7 +434,7 @@ static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh,
                 return -EINVAL;
 
         if (ifal->ifal_index &&
-            !__dev_get_by_index(&init_net, ifal->ifal_index))
+            !__dev_get_by_index(net, ifal->ifal_index))
                 return -EINVAL;
 
         if (!tb[IFAL_ADDRESS])
@@ -403,12 +452,12 @@ static int ip6addrlbl_newdel(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         switch(nlh->nlmsg_type) {
         case RTM_NEWADDRLABEL:
-                err = ip6addrlbl_add(pfx, ifal->ifal_prefixlen,
+                err = ip6addrlbl_add(net, pfx, ifal->ifal_prefixlen,
                                      ifal->ifal_index, label,
                                      nlh->nlmsg_flags & NLM_F_REPLACE);
                 break;
         case RTM_DELADDRLABEL:
-                err = ip6addrlbl_del(pfx, ifal->ifal_prefixlen,
+                err = ip6addrlbl_del(net, pfx, ifal->ifal_prefixlen,
                                      ifal->ifal_index);
                 break;
         default:
@@ -458,12 +507,10 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
         int idx = 0, s_idx = cb->args[0];
         int err;
 
-        if (net != &init_net)
-                return 0;
-
         rcu_read_lock();
         hlist_for_each_entry_rcu(p, pos, &ip6addrlbl_table.head, list) {
-                if (idx >= s_idx) {
+                if (idx >= s_idx &&
+                    net_eq(ip6addrlbl_net(p), net)) {
                         if ((err = ip6addrlbl_fill(skb, p,
                                                    ip6addrlbl_table.seq,
                                                    NETLINK_CB(cb->skb).pid,
@@ -499,9 +546,6 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
         struct ip6addrlbl_entry *p;
         struct sk_buff *skb;
 
-        if (net != &init_net)
-                return 0;
-
         err = nlmsg_parse(nlh, sizeof(*ifal), tb, IFAL_MAX, ifal_policy);
         if (err < 0)
                 return err;
@@ -513,7 +557,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
                 return -EINVAL;
 
         if (ifal->ifal_index &&
-            !__dev_get_by_index(&init_net, ifal->ifal_index))
+            !__dev_get_by_index(net, ifal->ifal_index))
                 return -EINVAL;
 
         if (!tb[IFAL_ADDRESS])
@@ -524,7 +568,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
                 return -EINVAL;
 
         rcu_read_lock();
-        p = __ipv6_addr_label(addr, ipv6_addr_type(addr), ifal->ifal_index);
+        p = __ipv6_addr_label(net, addr, ipv6_addr_type(addr), ifal->ifal_index);
         if (p && ip6addrlbl_hold(p))
                 p = NULL;
         lseq = ip6addrlbl_table.seq;
@@ -552,7 +596,7 @@ static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
                 goto out;
         }
 
-        err = rtnl_unicast(skb, &init_net, NETLINK_CB(in_skb).pid);
+        err = rtnl_unicast(skb, net, NETLINK_CB(in_skb).pid);
 out:
         return err;
 }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e84b3fd17fb4..3d828bc4b1cf 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -7,8 +7,6 @@
  *
  *      Adapted from linux/net/ipv4/af_inet.c
  *
- *      $Id: af_inet6.c,v 1.66 2002/02/01 22:01:04 davem Exp $
- *
  *      Fixes:
  *      piggy, Karl Knutson     :       Socket protocol table
  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
@@ -61,9 +59,7 @@
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
-#ifdef CONFIG_IPV6_MROUTE
 #include <linux/mroute6.h>
-#endif
 
 MODULE_AUTHOR("Cast of dozens");
 MODULE_DESCRIPTION("IPv6 protocol stack for Linux");
@@ -373,7 +369,7 @@ int inet6_release(struct socket *sock)
 
 EXPORT_SYMBOL(inet6_release);
 
-int inet6_destroy_sock(struct sock *sk)
+void inet6_destroy_sock(struct sock *sk)
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct sk_buff *skb;
@@ -391,8 +387,6 @@ int inet6_destroy_sock(struct sock *sk)
 
         if ((opt = xchg(&np->opt, NULL)) != NULL)
                 sock_kfree_s(sk, opt, opt->tot_len);
-
-        return 0;
 }
 
 EXPORT_SYMBOL_GPL(inet6_destroy_sock);
@@ -956,9 +950,9 @@ static int __init inet6_init(void)
         err = icmpv6_init();
         if (err)
                 goto icmp_fail;
-#ifdef CONFIG_IPV6_MROUTE
-        ip6_mr_init();
-#endif
+        err = ip6_mr_init();
+        if (err)
+                goto ipmr_fail;
         err = ndisc_init();
         if (err)
                 goto ndisc_fail;
@@ -1061,6 +1055,8 @@ netfilter_fail:
 igmp_fail:
         ndisc_cleanup();
 ndisc_fail:
+        ip6_mr_cleanup();
+ipmr_fail:
         icmpv6_cleanup();
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
@@ -1115,6 +1111,7 @@ static void __exit inet6_exit(void)
         ipv6_netfilter_fini();
         igmp6_cleanup();
         ndisc_cleanup();
+        ip6_mr_cleanup();
         icmpv6_cleanup();
         rawv6_exit();
 
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 4e1b29fabdf0..8336cd81cb4f 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -60,7 +60,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, struct in6_addr *addr)
         struct inet6_dev *idev;
         struct ipv6_ac_socklist *pac;
         struct net *net = sock_net(sk);
-        int     ishost = !ipv6_devconf.forwarding;
+        int     ishost = !net->ipv6.devconf_all->forwarding;
         int     err = 0;
 
         if (!capable(CAP_NET_ADMIN))
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 0f0f94a40335..f7b535dec860 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -5,8 +5,6 @@
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *
- *      $Id: datagram.c,v 1.24 2002/02/01 22:01:04 davem Exp $
- *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index dcf94fdfb863..837c830d6d8e 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -7,8 +7,6 @@
  *      Andi Kleen              <ak@muc.de>
  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  *
- *      $Id: exthdrs.c,v 1.13 2001/06/19 15:58:56 davem Exp $
- *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
@@ -321,7 +319,7 @@ static int ipv6_rthdr_rcv(struct sk_buff *skb)
         int n, i;
         struct ipv6_rt_hdr *hdr;
         struct rt0_hdr *rthdr;
-        int accept_source_route = ipv6_devconf.accept_source_route;
+        int accept_source_route = dev_net(skb->dev)->ipv6.devconf_all->accept_source_route;
 
         idev = in6_dev_get(skb->dev);
         if (idev) {
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index d42dd16d3487..abedf95fdf2d 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -5,8 +5,6 @@
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *
- *      $Id: icmp.c,v 1.38 2002/02/08 03:57:19 davem Exp $
- *
  *      Based on net/ipv4/icmp.c
  *
  *      RFC 1885
@@ -956,7 +954,8 @@ ctl_table ipv6_icmp_table_template[] = {
                 .data           = &init_net.ipv6.sysctl.icmpv6_time,
                 .maxlen         = sizeof(int),
                 .mode           = 0644,
-                .proc_handler   = &proc_dointvec
+                .proc_handler   = &proc_dointvec_ms_jiffies,
+                .strategy       = &sysctl_ms_jiffies
         },
         { .ctl_name = 0 },
 };
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 580014aea4d6..00a8a5f9380c 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -68,7 +68,7 @@ struct sock *__inet6_lookup_established(struct net *net,
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
-        unsigned int hash = inet6_ehashfn(daddr, hnum, saddr, sport);
+        unsigned int hash = inet6_ehashfn(net, daddr, hnum, saddr, sport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
         rwlock_t *lock = inet_ehash_lockp(hashinfo, hash);
 
@@ -104,7 +104,8 @@ struct sock *inet6_lookup_listener(struct net *net,
         int score, hiscore = 0;
 
         read_lock(&hashinfo->lhash_lock);
-        sk_for_each(sk, node, &hashinfo->listening_hash[inet_lhashfn(hnum)]) {
+        sk_for_each(sk, node,
+                        &hashinfo->listening_hash[inet_lhashfn(net, hnum)]) {
                 if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
                                 sk->sk_family == PF_INET6) {
                         const struct ipv6_pinfo *np = inet6_sk(sk);
@@ -165,14 +166,14 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         const struct in6_addr *saddr = &np->daddr;
         const int dif = sk->sk_bound_dev_if;
         const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
-        const unsigned int hash = inet6_ehashfn(daddr, lport, saddr,
+        struct net *net = sock_net(sk);
+        const unsigned int hash = inet6_ehashfn(net, daddr, lport, saddr,
                                                 inet->dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         rwlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
         const struct hlist_node *node;
         struct inet_timewait_sock *tw;
-        struct net *net = sock_net(sk);
 
         prefetch(head->chain.first);
         write_lock(lock);
@@ -209,11 +210,11 @@ unique:
 
         if (twp != NULL) {
                 *twp = tw;
-                NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
         } else if (tw != NULL) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(LINUX_MIB_TIMEWAITRECYCLED);
+                NET_INC_STATS_BH(twsk_net(tw), LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 1ee4fa17c129..4de2b9efcacb 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -5,8 +5,6 @@
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *
- *      $Id: ip6_fib.c,v 1.25 2001/10/31 21:55:55 davem Exp $
- *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 17eb48b8e329..7e14cccd0561 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -6,8 +6,6 @@
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *      Ian P. Morris           <I.P.Morris@soton.ac.uk>
  *
- *      $Id: ip6_input.c,v 1.19 2000/12/13 18:31:50 davem Exp $
- *
  *      Based in linux/net/ipv4/ip_input.c
  *
  *      This program is free software; you can redistribute it and/or
@@ -73,7 +71,8 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         IP6_INC_STATS_BH(idev, IPSTATS_MIB_INRECEIVES);
 
-        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL) {
+        if ((skb = skb_share_check(skb, GFP_ATOMIC)) == NULL ||
+            !idev || unlikely(idev->cnf.disable_ipv6)) {
                 IP6_INC_STATS_BH(idev, IPSTATS_MIB_INDISCARDS);
                 rcu_read_unlock();
                 goto out;
@@ -250,7 +249,7 @@ int ip6_mc_input(struct sk_buff *skb)
         /*
          *      IPv6 multicast router mode is now supported ;)
          */
-        if (ipv6_devconf.mc_forwarding &&
+        if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding &&
             likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) {
                 /*
                  * Okay, we try to forward - split and duplicate
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 48cdce9c696c..6407c64ea4a5 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -5,8 +5,6 @@
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *
- *      $Id: ip6_output.c,v 1.34 2002/02/01 22:01:04 davem Exp $
- *
  *      Based on linux/net/ipv4/ip_output.c
  *
  *      This program is free software; you can redistribute it and/or
@@ -175,6 +173,13 @@ static inline int ip6_skb_dst_mtu(struct sk_buff *skb)
 
 int ip6_output(struct sk_buff *skb)
 {
+        struct inet6_dev *idev = ip6_dst_idev(skb->dst);
+        if (unlikely(idev->cnf.disable_ipv6)) {
+                IP6_INC_STATS(idev, IPSTATS_MIB_OUTDISCARDS);
+                kfree_skb(skb);
+                return 0;
+        }
+
         if ((skb->len > ip6_skb_dst_mtu(skb) && !skb_is_gso(skb)) ||
                                 dst_allfrag(skb->dst))
                 return ip6_fragment(skb, ip6_output2);
@@ -406,9 +411,12 @@ int ip6_forward(struct sk_buff *skb)
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct net *net = dev_net(dst->dev);
 
-        if (ipv6_devconf.forwarding == 0)
+        if (net->ipv6.devconf_all->forwarding == 0)
                 goto error;
 
+        if (skb_warn_if_lro(skb))
+                goto drop;
+
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_FWD, skb)) {
                 IP6_INC_STATS(ip6_dst_idev(dst), IPSTATS_MIB_INDISCARDS);
                 goto drop;
@@ -450,7 +458,7 @@ int ip6_forward(struct sk_buff *skb)
         }
 
         /* XXX: idev->cnf.proxy_ndp? */
-        if (ipv6_devconf.proxy_ndp &&
+        if (net->ipv6.devconf_all->proxy_ndp &&
             pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
                 int proxied = ip6_forward_proxy_check(skb);
                 if (proxied > 0)
@@ -497,7 +505,8 @@ int ip6_forward(struct sk_buff *skb)
                 int addrtype = ipv6_addr_type(&hdr->saddr);
 
                 /* This check is security critical. */
-                if (addrtype & (IPV6_ADDR_MULTICAST|IPV6_ADDR_LOOPBACK))
+                if (addrtype == IPV6_ADDR_ANY ||
+                    addrtype & (IPV6_ADDR_MULTICAST | IPV6_ADDR_LOOPBACK))
                         goto error;
                 if (addrtype & IPV6_ADDR_LINKLOCAL) {
                         icmpv6_send(skb, ICMPV6_DEST_UNREACH,
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 2bda3ba100b1..17c7b098cdb0 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -6,8 +6,6 @@
  *      Ville Nuorvala          <vnuorval@tcs.hut.fi>
  *      Yasuyuki Kozakai        <kozakai@linux-ipv6.org>
  *
- *      $Id$
- *
  *      Based on:
  *      linux/net/ipv6/sit.c and linux/net/ipv4/ipip.c
  *
@@ -711,7 +709,7 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                 }
 
                 if (!ip6_tnl_rcv_ctl(t)) {
-                        t->stat.rx_dropped++;
+                        t->dev->stats.rx_dropped++;
                         read_unlock(&ip6_tnl_lock);
                         goto discard;
                 }
@@ -728,8 +726,8 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
 
                 dscp_ecn_decapsulate(t, ipv6h, skb);
 
-                t->stat.rx_packets++;
-                t->stat.rx_bytes += skb->len;
+                t->dev->stats.rx_packets++;
+                t->dev->stats.rx_bytes += skb->len;
                 netif_rx(skb);
                 read_unlock(&ip6_tnl_lock);
                 return 0;
@@ -849,7 +847,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                          __u32 *pmtu)
 {
         struct ip6_tnl *t = netdev_priv(dev);
-        struct net_device_stats *stats = &t->stat;
+        struct net_device_stats *stats = &t->dev->stats;
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
         struct ipv6_tel_txoption opt;
         struct dst_entry *dst;
@@ -1043,11 +1041,11 @@ static int
 ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
-        struct net_device_stats *stats = &t->stat;
+        struct net_device_stats *stats = &t->dev->stats;
         int ret;
 
         if (t->recursion++) {
-                t->stat.collisions++;
+                stats->collisions++;
                 goto tx_err;
         }
 
@@ -1289,19 +1287,6 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
 }
 
 /**
- * ip6_tnl_get_stats - return the stats for tunnel device
- *   @dev: virtual device associated with tunnel
- *
- * Return: stats for device
- **/
-
-static struct net_device_stats *
-ip6_tnl_get_stats(struct net_device *dev)
-{
-        return &(((struct ip6_tnl *)netdev_priv(dev))->stat);
-}
-
-/**
  * ip6_tnl_change_mtu - change mtu manually for tunnel device
  *   @dev: virtual device associated with tunnel
  *   @new_mtu: the new mtu
@@ -1334,7 +1319,6 @@ static void ip6_tnl_dev_setup(struct net_device *dev)
         dev->uninit = ip6_tnl_dev_uninit;
         dev->destructor = free_netdev;
         dev->hard_start_xmit = ip6_tnl_xmit;
-        dev->get_stats = ip6_tnl_get_stats;
         dev->do_ioctl = ip6_tnl_ioctl;
         dev->change_mtu = ip6_tnl_change_mtu;
 
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 14796181e8b5..095bc453ff4c 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -388,8 +388,8 @@ static int pim6_rcv(struct sk_buff *skb)
         skb->ip_summed = 0;
         skb->pkt_type = PACKET_HOST;
         dst_release(skb->dst);
-        ((struct net_device_stats *)netdev_priv(reg_dev))->rx_bytes += skb->len;
-        ((struct net_device_stats *)netdev_priv(reg_dev))->rx_packets++;
+        reg_dev->stats.rx_bytes += skb->len;
+        reg_dev->stats.rx_packets++;
         skb->dst = NULL;
         nf_reset(skb);
         netif_rx(skb);
@@ -409,26 +409,20 @@ static struct inet6_protocol pim6_protocol = {
 static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         read_lock(&mrt_lock);
-        ((struct net_device_stats *)netdev_priv(dev))->tx_bytes += skb->len;
-        ((struct net_device_stats *)netdev_priv(dev))->tx_packets++;
+        dev->stats.tx_bytes += skb->len;
+        dev->stats.tx_packets++;
         ip6mr_cache_report(skb, reg_vif_num, MRT6MSG_WHOLEPKT);
         read_unlock(&mrt_lock);
         kfree_skb(skb);
         return 0;
 }
 
-static struct net_device_stats *reg_vif_get_stats(struct net_device *dev)
-{
-        return (struct net_device_stats *)netdev_priv(dev);
-}
-
 static void reg_vif_setup(struct net_device *dev)
 {
         dev->type               = ARPHRD_PIMREG;
         dev->mtu                = 1500 - sizeof(struct ipv6hdr) - 8;
         dev->flags              = IFF_NOARP;
         dev->hard_start_xmit    = reg_vif_xmit;
-        dev->get_stats          = reg_vif_get_stats;
         dev->destructor         = free_netdev;
 }
 
@@ -436,9 +430,7 @@ static struct net_device *ip6mr_reg_vif(void)
 {
         struct net_device *dev;
 
-        dev = alloc_netdev(sizeof(struct net_device_stats), "pim6reg",
-                           reg_vif_setup);
-
+        dev = alloc_netdev(0, "pim6reg", reg_vif_setup);
         if (dev == NULL)
                 return NULL;
 
@@ -451,6 +443,7 @@ static struct net_device *ip6mr_reg_vif(void)
         if (dev_open(dev))
                 goto failure;
 
+        dev_hold(dev);
         return dev;
 
 failure:
@@ -603,6 +596,7 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
         int vifi = vifc->mif6c_mifi;
         struct mif_device *v = &vif6_table[vifi];
         struct net_device *dev;
+        int err;
 
         /* Is vif busy ? */
         if (MIF_EXISTS(vifi))
@@ -620,20 +614,28 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
                 dev = ip6mr_reg_vif();
                 if (!dev)
                         return -ENOBUFS;
+                err = dev_set_allmulti(dev, 1);
+                if (err) {
+                        unregister_netdevice(dev);
+                        dev_put(dev);
+                        return err;
+                }
                 break;
 #endif
         case 0:
                 dev = dev_get_by_index(&init_net, vifc->mif6c_pifi);
                 if (!dev)
                         return -EADDRNOTAVAIL;
-                dev_put(dev);
+                err = dev_set_allmulti(dev, 1);
+                if (err) {
+                        dev_put(dev);
+                        return err;
+                }
                 break;
         default:
                 return -EINVAL;
         }
 
-        dev_set_allmulti(dev, 1);
-
         /*
          *      Fill in the VIF structures
          */
@@ -652,7 +654,6 @@ static int mif6_add(struct mif6ctl *vifc, int mrtsock)
 
         /* And finish update writing critical data */
         write_lock_bh(&mrt_lock);
-        dev_hold(dev);
         v->dev = dev;
 #ifdef CONFIG_IPV6_PIMSM_V2
         if (v->flags & MIFF_REGISTER)
@@ -934,7 +935,7 @@ static int ip6mr_device_event(struct notifier_block *this,
         struct mif_device *v;
         int ct;
 
-        if (dev_net(dev) != &init_net)
+        if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
 
         if (event != NETDEV_UNREGISTER)
@@ -956,23 +957,51 @@ static struct notifier_block ip6_mr_notifier = {
  *      Setup for IP multicast routing
  */
 
-void __init ip6_mr_init(void)
+int __init ip6_mr_init(void)
 {
+        int err;
+
         mrt_cachep = kmem_cache_create("ip6_mrt_cache",
                                        sizeof(struct mfc6_cache),
                                        0, SLAB_HWCACHE_ALIGN,
                                        NULL);
         if (!mrt_cachep)
-                panic("cannot allocate ip6_mrt_cache");
+                return -ENOMEM;
 
         setup_timer(&ipmr_expire_timer, ipmr_expire_process, 0);
-        register_netdevice_notifier(&ip6_mr_notifier);
+        err = register_netdevice_notifier(&ip6_mr_notifier);
+        if (err)
+                goto reg_notif_fail;
+#ifdef CONFIG_PROC_FS
+        err = -ENOMEM;
+        if (!proc_net_fops_create(&init_net, "ip6_mr_vif", 0, &ip6mr_vif_fops))
+                goto proc_vif_fail;
+        if (!proc_net_fops_create(&init_net, "ip6_mr_cache",
+                                     0, &ip6mr_mfc_fops))
+                goto proc_cache_fail;
+#endif
+        return 0;
+reg_notif_fail:
+        kmem_cache_destroy(mrt_cachep);
 #ifdef CONFIG_PROC_FS
-        proc_net_fops_create(&init_net, "ip6_mr_vif", 0, &ip6mr_vif_fops);
-        proc_net_fops_create(&init_net, "ip6_mr_cache", 0, &ip6mr_mfc_fops);
+proc_vif_fail:
+        unregister_netdevice_notifier(&ip6_mr_notifier);
+proc_cache_fail:
+        proc_net_remove(&init_net, "ip6_mr_vif");
 #endif
+        return err;
 }
 
+void ip6_mr_cleanup(void)
+{
+#ifdef CONFIG_PROC_FS
+        proc_net_remove(&init_net, "ip6_mr_cache");
+        proc_net_remove(&init_net, "ip6_mr_vif");
+#endif
+        unregister_netdevice_notifier(&ip6_mr_notifier);
+        del_timer(&ipmr_expire_timer);
+        kmem_cache_destroy(mrt_cachep);
+}
 
 static int ip6mr_mfc_add(struct mf6cctl *mfc, int mrtsock)
 {
@@ -1248,7 +1277,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, int
 
 #endif
         /*
-         *      Spurious command, or MRT_VERSION which you cannot
+         *      Spurious command, or MRT6_VERSION which you cannot
          *      set.
          */
         default:
@@ -1377,8 +1406,8 @@ static int ip6mr_forward2(struct sk_buff *skb, struct mfc6_cache *c, int vifi)
         if (vif->flags & MIFF_REGISTER) {
                 vif->pkt_out++;
                 vif->bytes_out += skb->len;
-                ((struct net_device_stats *)netdev_priv(vif->dev))->tx_bytes += skb->len;
-                ((struct net_device_stats *)netdev_priv(vif->dev))->tx_packets++;
+                vif->dev->stats.tx_bytes += skb->len;
+                vif->dev->stats.tx_packets++;
                 ip6mr_cache_report(skb, vifi, MRT6MSG_WHOLEPKT);
                 kfree_skb(skb);
                 return 0;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 86e28a75267f..ea33b26512c2 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -7,8 +7,6 @@
  *
  *      Based on linux/net/ipv4/ip_sockglue.c
  *
- *      $Id: ipv6_sockglue.c,v 1.41 2002/02/01 22:01:04 davem Exp $
- *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
@@ -61,7 +59,7 @@ DEFINE_SNMP_STAT(struct ipstats_mib, ipv6_statistics) __read_mostly;
 struct ip6_ra_chain *ip6_ra_chain;
 DEFINE_RWLOCK(ip6_ra_lock);
 
-int ip6_ra_control(struct sock *sk, int sel, void (*destructor)(struct sock *))
+int ip6_ra_control(struct sock *sk, int sel)
 {
         struct ip6_ra_chain *ra, *new_ra, **rap;
 
@@ -83,8 +81,6 @@ int ip6_ra_control(struct sock *sk, int sel, void (*destructor)(struct sock *))
                         *rap = ra->next;
                         write_unlock_bh(&ip6_ra_lock);
 
-                        if (ra->destructor)
-                                ra->destructor(sk);
                         sock_put(sk);
                         kfree(ra);
                         return 0;
@@ -96,7 +92,6 @@ int ip6_ra_control(struct sock *sk, int sel, void (*destructor)(struct sock *))
         }
         new_ra->sk = sk;
         new_ra->sel = sel;
-        new_ra->destructor = destructor;
         new_ra->next = ra;
         *rap = new_ra;
         sock_hold(sk);
@@ -634,7 +629,7 @@ done:
         case IPV6_ROUTER_ALERT:
                 if (optlen < sizeof(int))
                         goto e_inval;
-                retv = ip6_ra_control(sk, val, NULL);
+                retv = ip6_ra_control(sk, val);
                 break;
         case IPV6_MTU_DISCOVER:
                 if (optlen < sizeof(int))
@@ -1043,7 +1038,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                         dst_release(dst);
                 }
                 if (val < 0)
-                        val = ipv6_devconf.hop_limit;
+                        val = sock_net(sk)->ipv6.devconf_all->hop_limit;
                 break;
         }
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index fd632dd7f98d..e7c03bcc2788 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -5,8 +5,6 @@
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *
- *      $Id: mcast.c,v 1.40 2002/02/08 03:57:19 davem Exp $
- *
  *      Based on linux/ipv4/igmp.c and linux/ipv4/ip_sockglue.c
  *
  *      This program is free software; you can redistribute it and/or
@@ -153,7 +151,7 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
 #define IGMP6_UNSOLICITED_IVAL  (10*HZ)
 #define MLD_QRV_DEFAULT         2
 
-#define MLD_V1_SEEN(idev) (ipv6_devconf.force_mld_version == 1 || \
+#define MLD_V1_SEEN(idev) (dev_net((idev)->dev)->ipv6.devconf_all->force_mld_version == 1 || \
                 (idev)->cnf.force_mld_version == 1 || \
                 ((idev)->mc_v1_seen && \
                 time_before(jiffies, (idev)->mc_v1_seen)))
@@ -164,7 +162,6 @@ static int ip6_mc_leave_src(struct sock *sk, struct ipv6_mc_socklist *iml,
         ((MLDV2_MASK(value, nbmant) | (1<<(nbmant))) << \
         (MLDV2_MASK((value) >> (nbmant), nbexp) + (nbexp))))
 
-#define MLDV2_QQIC(value) MLDV2_EXP(0x80, 4, 3, value)
 #define MLDV2_MRC(value) MLDV2_EXP(0x8000, 12, 3, value)
 
 #define IPV6_MLD_MAX_MSF        64
@@ -370,10 +367,6 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
         int pmclocked = 0;
         int err;
 
-        if (pgsr->gsr_group.ss_family != AF_INET6 ||
-            pgsr->gsr_source.ss_family != AF_INET6)
-                return -EINVAL;
-
         source = &((struct sockaddr_in6 *)&pgsr->gsr_source)->sin6_addr;
         group = &((struct sockaddr_in6 *)&pgsr->gsr_group)->sin6_addr;
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 282fdb31f8ed..beb48e3f038a 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -784,15 +784,17 @@ static void ndisc_recv_ns(struct sk_buff *skb)
 
                 idev = ifp->idev;
         } else {
+                struct net *net = dev_net(dev);
+
                 idev = in6_dev_get(dev);
                 if (!idev) {
                         /* XXX: count this drop? */
                         return;
                 }
 
-                if (ipv6_chk_acast_addr(dev_net(dev), dev, &msg->target) ||
+                if (ipv6_chk_acast_addr(net, dev, &msg->target) ||
                     (idev->cnf.forwarding &&
-                     (ipv6_devconf.proxy_ndp || idev->cnf.proxy_ndp) &&
+                     (net->ipv6.devconf_all->proxy_ndp || idev->cnf.proxy_ndp) &&
                      (is_router = pndisc_is_router(&msg->target, dev)) >= 0)) {
                         if (!(NEIGH_CB(skb)->flags & LOCALLY_ENQUEUED) &&
                             skb->pkt_type != PACKET_HOST &&
@@ -921,6 +923,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
 
         if (neigh) {
                 u8 old_flags = neigh->flags;
+                struct net *net = dev_net(dev);
 
                 if (neigh->nud_state & NUD_FAILED)
                         goto out;
@@ -931,8 +934,8 @@ static void ndisc_recv_na(struct sk_buff *skb)
                  * has already sent a NA to us.
                  */
                 if (lladdr && !memcmp(lladdr, dev->dev_addr, dev->addr_len) &&
-                    ipv6_devconf.forwarding && ipv6_devconf.proxy_ndp &&
-                    pneigh_lookup(&nd_tbl, dev_net(dev), &msg->target, dev, 0)) {
+                    net->ipv6.devconf_all->forwarding && net->ipv6.devconf_all->proxy_ndp &&
+                    pneigh_lookup(&nd_tbl, net, &msg->target, dev, 0)) {
                         /* XXX: idev->cnf.prixy_ndp */
                         goto out;
                 }
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 6cae5475737e..689dec899c57 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -208,5 +208,17 @@ config IP6_NF_RAW
           If you want to compile it as a module, say M here and read
           <file:Documentation/kbuild/modules.txt>.  If unsure, say `N'.
 
+# security table for MAC policy
+config IP6_NF_SECURITY
+       tristate "Security table"
+       depends on IP6_NF_IPTABLES
+       depends on SECURITY
+       default m if NETFILTER_ADVANCED=n
+       help
+         This option adds a `security' table to iptables, for use
+         with Mandatory Access Control (MAC) policy.
+        
+         If unsure, say N.
+
 endmenu
 
diff --git a/net/ipv6/netfilter/Makefile b/net/ipv6/netfilter/Makefile
index fbf2c14ed887..3f17c948eefb 100644
--- a/net/ipv6/netfilter/Makefile
+++ b/net/ipv6/netfilter/Makefile
@@ -8,6 +8,7 @@ obj-$(CONFIG_IP6_NF_FILTER) += ip6table_filter.o
 obj-$(CONFIG_IP6_NF_MANGLE) += ip6table_mangle.o
 obj-$(CONFIG_IP6_NF_QUEUE) += ip6_queue.o
 obj-$(CONFIG_IP6_NF_RAW) += ip6table_raw.o
+obj-$(CONFIG_IP6_NF_SECURITY) += ip6table_security.o
 
 # objects for l3 independent conntrack
 nf_conntrack_ipv6-objs  :=  nf_conntrack_l3proto_ipv6.o nf_conntrack_proto_icmpv6.o nf_conntrack_reasm.o
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 2eff3ae8977d..5859c046cbc4 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -159,7 +159,6 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
         case IPQ_COPY_META:
         case IPQ_COPY_NONE:
                 size = NLMSG_SPACE(sizeof(*pmsg));
-                data_len = 0;
                 break;
 
         case IPQ_COPY_PACKET:
@@ -226,8 +225,6 @@ ipq_build_packet_message(struct nf_queue_entry *entry, int *errp)
         return skb;
 
 nlmsg_failure:
-        if (skb)
-                kfree_skb(skb);
         *errp = -EINVAL;
         printk(KERN_ERR "ip6_queue: error creating packet message\n");
         return NULL;
@@ -483,7 +480,7 @@ ipq_rcv_dev_event(struct notifier_block *this,
 {
         struct net_device *dev = ptr;
 
-        if (dev_net(dev) != &init_net)
+        if (!net_eq(dev_net(dev), &init_net))
                 return NOTIFY_DONE;
 
         /* Drop any packets associated with the downed device */
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index f979e48b469b..55a2c290bad4 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -61,13 +61,25 @@ static struct xt_table packet_filter = {
 
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ip6t_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
+ip6t_local_in_hook(unsigned int hook,
+                   struct sk_buff *skb,
+                   const struct net_device *in,
+                   const struct net_device *out,
+                   int (*okfn)(struct sk_buff *))
+{
+        return ip6t_do_table(skb, hook, in, out,
+                             nf_local_in_net(in, out)->ipv6.ip6table_filter);
+}
+
+static unsigned int
+ip6t_forward_hook(unsigned int hook,
+                  struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_filter);
+        return ip6t_do_table(skb, hook, in, out,
+                             nf_forward_net(in, out)->ipv6.ip6table_filter);
 }
 
 static unsigned int
@@ -87,19 +99,20 @@ ip6t_local_out_hook(unsigned int hook,
         }
 #endif
 
-        return ip6t_do_table(skb, hook, in, out, init_net.ipv6.ip6table_filter);
+        return ip6t_do_table(skb, hook, in, out,
+                             nf_local_out_net(in, out)->ipv6.ip6table_filter);
 }
 
 static struct nf_hook_ops ip6t_ops[] __read_mostly = {
         {
-                .hook           = ip6t_hook,
+                .hook           = ip6t_local_in_hook,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_LOCAL_IN,
                 .priority       = NF_IP6_PRI_FILTER,
         },
         {
-                .hook           = ip6t_hook,
+                .hook           = ip6t_forward_hook,
                 .owner          = THIS_MODULE,
                 .pf             = PF_INET6,
                 .hooknum        = NF_INET_FORWARD,
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
new file mode 100644
index 000000000000..a07abee30497
--- /dev/null
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -0,0 +1,172 @@
+/*
+ * "security" table for IPv6
+ *
+ * This is for use by Mandatory Access Control (MAC) security models,
+ * which need to be able to manage security policy in separate context
+ * to DAC.
+ *
+ * Based on iptable_mangle.c
+ *
+ * Copyright (C) 1999 Paul `Rusty' Russell & Michael J. Neuling
+ * Copyright (C) 2000-2004 Netfilter Core Team <coreteam <at> netfilter.org>
+ * Copyright (C) 2008 Red Hat, Inc., James Morris <jmorris <at> redhat.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/netfilter_ipv6/ip6_tables.h>
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
+MODULE_DESCRIPTION("ip6tables security table, for MAC rules");
+
+#define SECURITY_VALID_HOOKS    (1 << NF_INET_LOCAL_IN) | \
+                                (1 << NF_INET_FORWARD) | \
+                                (1 << NF_INET_LOCAL_OUT)
+
+static struct
+{
+        struct ip6t_replace repl;
+        struct ip6t_standard entries[3];
+        struct ip6t_error term;
+} initial_table __initdata = {
+        .repl = {
+                .name = "security",
+                .valid_hooks = SECURITY_VALID_HOOKS,
+                .num_entries = 4,
+                .size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
+                .hook_entry = {
+                        [NF_INET_LOCAL_IN]      = 0,
+                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
+                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
+                },
+                .underflow = {
+                        [NF_INET_LOCAL_IN]      = 0,
+                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
+                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
+                },
+        },
+        .entries = {
+                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
+                IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
+                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
+        },
+        .term = IP6T_ERROR_INIT,                /* ERROR */
+};
+
+static struct xt_table security_table = {
+        .name           = "security",
+        .valid_hooks    = SECURITY_VALID_HOOKS,
+        .lock           = __RW_LOCK_UNLOCKED(security_table.lock),
+        .me             = THIS_MODULE,
+        .af             = AF_INET6,
+};
+
+static unsigned int
+ip6t_local_in_hook(unsigned int hook,
+                   struct sk_buff *skb,
+                   const struct net_device *in,
+                   const struct net_device *out,
+                   int (*okfn)(struct sk_buff *))
+{
+        return ip6t_do_table(skb, hook, in, out,
+                             nf_local_in_net(in, out)->ipv6.ip6table_security);
+}
+
+static unsigned int
+ip6t_forward_hook(unsigned int hook,
+                  struct sk_buff *skb,
+                  const struct net_device *in,
+                  const struct net_device *out,
+                  int (*okfn)(struct sk_buff *))
+{
+        return ip6t_do_table(skb, hook, in, out,
+                             nf_forward_net(in, out)->ipv6.ip6table_security);
+}
+
+static unsigned int
+ip6t_local_out_hook(unsigned int hook,
+                    struct sk_buff *skb,
+                    const struct net_device *in,
+                    const struct net_device *out,
+                    int (*okfn)(struct sk_buff *))
+{
+        /* TBD: handle short packets via raw socket */
+        return ip6t_do_table(skb, hook, in, out,
+                             nf_local_out_net(in, out)->ipv6.ip6table_security);
+}
+
+static struct nf_hook_ops ip6t_ops[] __read_mostly = {
+        {
+                .hook           = ip6t_local_in_hook,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_INET_LOCAL_IN,
+                .priority       = NF_IP6_PRI_SECURITY,
+        },
+        {
+                .hook           = ip6t_forward_hook,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_INET_FORWARD,
+                .priority       = NF_IP6_PRI_SECURITY,
+        },
+        {
+                .hook           = ip6t_local_out_hook,
+                .owner          = THIS_MODULE,
+                .pf             = PF_INET6,
+                .hooknum        = NF_INET_LOCAL_OUT,
+                .priority       = NF_IP6_PRI_SECURITY,
+        },
+};
+
+static int __net_init ip6table_security_net_init(struct net *net)
+{
+        net->ipv6.ip6table_security =
+                ip6t_register_table(net, &security_table, &initial_table.repl);
+
+        if (IS_ERR(net->ipv6.ip6table_security))
+                return PTR_ERR(net->ipv6.ip6table_security);
+
+        return 0;
+}
+
+static void __net_exit ip6table_security_net_exit(struct net *net)
+{
+        ip6t_unregister_table(net->ipv6.ip6table_security);
+}
+
+static struct pernet_operations ip6table_security_net_ops = {
+        .init = ip6table_security_net_init,
+        .exit = ip6table_security_net_exit,
+};
+
+static int __init ip6table_security_init(void)
+{
+        int ret;
+
+        ret = register_pernet_subsys(&ip6table_security_net_ops);
+        if (ret < 0)
+                return ret;
+
+        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        if (ret < 0)
+                goto cleanup_table;
+
+        return ret;
+
+cleanup_table:
+        unregister_pernet_subsys(&ip6table_security_net_ops);
+        return ret;
+}
+
+static void __exit ip6table_security_fini(void)
+{
+        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        unregister_pernet_subsys(&ip6table_security_net_ops);
+}
+
+module_init(ip6table_security_init);
+module_exit(ip6table_security_fini);
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index ee713b03e9ec..14d47d833545 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -89,9 +89,8 @@ static int icmpv6_packet(struct nf_conn *ct,
            means this will only run once even if count hits zero twice
            (theoretically possible with SMP) */
         if (CTINFO2DIR(ctinfo) == IP_CT_DIR_REPLY) {
-                if (atomic_dec_and_test(&ct->proto.icmp.count)
-                    && del_timer(&ct->timeout))
-                        ct->timeout.function((unsigned long)ct);
+                if (atomic_dec_and_test(&ct->proto.icmp.count))
+                        nf_ct_kill_acct(ct, ctinfo, skb);
         } else {
                 atomic_inc(&ct->proto.icmp.count);
                 nf_conntrack_event_cache(IPCT_PROTOINFO_VOLATILE, skb);
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index df0736a4cafa..f82f6074cf85 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -7,8 +7,6 @@
  *              PROC file system.  This is very similar to the IPv4 version,
  *              except it reports the sockets in the INET6 address family.
  *
- * Version:     $Id: proc.c,v 1.17 2002/02/01 22:01:04 davem Exp $
- *
  * Authors:     David S. Miller (davem@caip.rutgers.edu)
  *              YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
  *
@@ -185,32 +183,7 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
 
 static int sockstat6_seq_open(struct inode *inode, struct file *file)
 {
-        int err;
-        struct net *net;
-
-        err = -ENXIO;
-        net = get_proc_net(inode);
-        if (net == NULL)
-                goto err_net;
-
-        err = single_open(file, sockstat6_seq_show, net);
-        if (err < 0)
-                goto err_open;
-
-        return 0;
-
-err_open:
-        put_net(net);
-err_net:
-        return err;
-}
-
-static int sockstat6_seq_release(struct inode *inode, struct file *file)
-{
-        struct net *net = ((struct seq_file *)file->private_data)->private;
-
-        put_net(net);
-        return single_release(inode, file);
+        return single_open_net(inode, file, sockstat6_seq_show);
 }
 
 static const struct file_operations sockstat6_seq_fops = {
@@ -218,7 +191,7 @@ static const struct file_operations sockstat6_seq_fops = {
         .open    = sockstat6_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = sockstat6_seq_release,
+        .release = single_release_net,
 };
 
 static int snmp6_seq_open(struct inode *inode, struct file *file)
@@ -241,7 +214,7 @@ int snmp6_register_dev(struct inet6_dev *idev)
         if (!idev || !idev->dev)
                 return -EINVAL;
 
-        if (dev_net(idev->dev) != &init_net)
+        if (!net_eq(dev_net(idev->dev), &init_net))
                 return 0;
 
         if (!proc_net_devsnmp6)
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index f929f47b925e..9ab789159913 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -5,8 +5,6 @@
  *
  *              PF_INET6 protocol dispatch tables.
  *
- * Version:     $Id: protocol.c,v 1.10 2001/05/18 02:25:49 davem Exp $
- *
  * Authors:     Pedro Roque     <roque@di.fc.ul.pt>
  *
  *              This program is free software; you can redistribute it and/or
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 3aee12310d94..01d47674f7e5 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -7,8 +7,6 @@
  *
  *      Adapted from linux/net/ipv4/raw.c
  *
- *      $Id: raw.c,v 1.51 2002/02/01 22:01:04 davem Exp $
- *
  *      Fixes:
  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  *      YOSHIFUJI,H.@USAGI      :       raw checksum (RFC2292(bis) compliance)
@@ -1159,18 +1157,18 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
 static void rawv6_close(struct sock *sk, long timeout)
 {
         if (inet_sk(sk)->num == IPPROTO_RAW)
-                ip6_ra_control(sk, -1, NULL);
+                ip6_ra_control(sk, -1);
         ip6mr_sk_done(sk);
         sk_common_release(sk);
 }
 
-static int raw6_destroy(struct sock *sk)
+static void raw6_destroy(struct sock *sk)
 {
         lock_sock(sk);
         ip6_flush_pending_frames(sk);
         release_sock(sk);
 
-        return inet6_destroy_sock(sk);
+        inet6_destroy_sock(sk);
 }
 
 static int rawv6_init_sk(struct sock *sk)
@@ -1253,7 +1251,7 @@ static int raw6_seq_show(struct seq_file *seq, void *v)
                            "local_address                         "
                            "remote_address                        "
                            "st tx_queue rx_queue tr tm->when retrnsmt"
-                           "   uid  timeout inode  drops\n");
+                           "   uid  timeout inode ref pointer drops\n");
         else
                 raw6_sock_seq_show(seq, v, raw_seq_private(seq)->bucket);
         return 0;
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index a60d7d129713..6ab957ec2dd6 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -5,8 +5,6 @@
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *
- *      $Id: reassembly.c,v 1.26 2001/03/07 22:00:57 davem Exp $
- *
  *      Based on: net/ipv4/ip_fragment.c
  *
  *      This program is free software; you can redistribute it and/or
@@ -634,7 +632,7 @@ static struct inet6_protocol frag_protocol =
 };
 
 #ifdef CONFIG_SYSCTL
-static struct ctl_table ip6_frags_ctl_table[] = {
+static struct ctl_table ip6_frags_ns_ctl_table[] = {
         {
                 .ctl_name       = NET_IPV6_IP6FRAG_HIGH_THRESH,
                 .procname       = "ip6frag_high_thresh",
@@ -660,6 +658,10 @@ static struct ctl_table ip6_frags_ctl_table[] = {
                 .proc_handler   = &proc_dointvec_jiffies,
                 .strategy       = &sysctl_jiffies,
         },
+        { }
+};
+
+static struct ctl_table ip6_frags_ctl_table[] = {
         {
                 .ctl_name       = NET_IPV6_IP6FRAG_SECRET_INTERVAL,
                 .procname       = "ip6frag_secret_interval",
@@ -672,21 +674,20 @@ static struct ctl_table ip6_frags_ctl_table[] = {
         { }
 };
 
-static int ip6_frags_sysctl_register(struct net *net)
+static int ip6_frags_ns_sysctl_register(struct net *net)
 {
         struct ctl_table *table;
         struct ctl_table_header *hdr;
 
-        table = ip6_frags_ctl_table;
+        table = ip6_frags_ns_ctl_table;
         if (net != &init_net) {
-                table = kmemdup(table, sizeof(ip6_frags_ctl_table), GFP_KERNEL);
+                table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
                 if (table == NULL)
                         goto err_alloc;
 
                 table[0].data = &net->ipv6.frags.high_thresh;
                 table[1].data = &net->ipv6.frags.low_thresh;
                 table[2].data = &net->ipv6.frags.timeout;
-                table[3].mode &= ~0222;
         }
 
         hdr = register_net_sysctl_table(net, net_ipv6_ctl_path, table);
@@ -703,7 +704,7 @@ err_alloc:
         return -ENOMEM;
 }
 
-static void ip6_frags_sysctl_unregister(struct net *net)
+static void ip6_frags_ns_sysctl_unregister(struct net *net)
 {
         struct ctl_table *table;
 
@@ -711,13 +712,36 @@ static void ip6_frags_sysctl_unregister(struct net *net)
         unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr);
         kfree(table);
 }
+
+static struct ctl_table_header *ip6_ctl_header;
+
+static int ip6_frags_sysctl_register(void)
+{
+        ip6_ctl_header = register_net_sysctl_rotable(net_ipv6_ctl_path,
+                        ip6_frags_ctl_table);
+        return ip6_ctl_header == NULL ? -ENOMEM : 0;
+}
+
+static void ip6_frags_sysctl_unregister(void)
+{
+        unregister_net_sysctl_table(ip6_ctl_header);
+}
 #else
-static inline int ip6_frags_sysctl_register(struct net *net)
+static inline int ip6_frags_ns_sysctl_register(struct net *net)
 {
         return 0;
 }
 
-static inline void ip6_frags_sysctl_unregister(struct net *net)
+static inline void ip6_frags_ns_sysctl_unregister(struct net *net)
+{
+}
+
+static inline int ip6_frags_sysctl_register(void)
+{
+        return 0;
+}
+
+static inline void ip6_frags_sysctl_unregister(void)
 {
 }
 #endif
@@ -730,12 +754,12 @@ static int ipv6_frags_init_net(struct net *net)
 
         inet_frags_init_net(&net->ipv6.frags);
 
-        return ip6_frags_sysctl_register(net);
+        return ip6_frags_ns_sysctl_register(net);
 }
 
 static void ipv6_frags_exit_net(struct net *net)
 {
-        ip6_frags_sysctl_unregister(net);
+        ip6_frags_ns_sysctl_unregister(net);
         inet_frags_exit_net(&net->ipv6.frags, &ip6_frags);
 }
 
@@ -752,7 +776,13 @@ int __init ipv6_frag_init(void)
         if (ret)
                 goto out;
 
-        register_pernet_subsys(&ip6_frags_ops);
+        ret = ip6_frags_sysctl_register();
+        if (ret)
+                goto err_sysctl;
+
+        ret = register_pernet_subsys(&ip6_frags_ops);
+        if (ret)
+                goto err_pernet;
 
         ip6_frags.hashfn = ip6_hashfn;
         ip6_frags.constructor = ip6_frag_init;
@@ -765,11 +795,18 @@ int __init ipv6_frag_init(void)
         inet_frags_init(&ip6_frags);
 out:
         return ret;
+
+err_pernet:
+        ip6_frags_sysctl_unregister();
+err_sysctl:
+        inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
+        goto out;
 }
 
 void ipv6_frag_exit(void)
 {
         inet_frags_fini(&ip6_frags);
+        ip6_frags_sysctl_unregister();
         unregister_pernet_subsys(&ip6_frags_ops);
         inet6_del_protocol(&frag_protocol, IPPROTO_FRAGMENT);
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7ff687020fa9..615b328de251 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5,8 +5,6 @@
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *
- *      $Id: route.c,v 1.56 2001/10/31 21:55:55 davem Exp $
- *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
@@ -230,7 +228,7 @@ static __inline__ int rt6_check_expired(const struct rt6_info *rt)
 static inline int rt6_need_strict(struct in6_addr *daddr)
 {
         return (ipv6_addr_type(daddr) &
-                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
+                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK));
 }
 
 /*
@@ -239,15 +237,20 @@ static inline int rt6_need_strict(struct in6_addr *daddr)
 
 static inline struct rt6_info *rt6_device_match(struct net *net,
                                                     struct rt6_info *rt,
+                                                    struct in6_addr *saddr,
                                                     int oif,
                                                     int flags)
 {
         struct rt6_info *local = NULL;
         struct rt6_info *sprt;
 
-        if (oif) {
-                for (sprt = rt; sprt; sprt = sprt->u.dst.rt6_next) {
-                        struct net_device *dev = sprt->rt6i_dev;
+        if (!oif && ipv6_addr_any(saddr))
+                goto out;
+
+        for (sprt = rt; sprt; sprt = sprt->u.dst.rt6_next) {
+                struct net_device *dev = sprt->rt6i_dev;
+
+                if (oif) {
                         if (dev->ifindex == oif)
                                 return sprt;
                         if (dev->flags & IFF_LOOPBACK) {
@@ -261,14 +264,21 @@ static inline struct rt6_info *rt6_device_match(struct net *net,
                                 }
                                 local = sprt;
                         }
+                } else {
+                        if (ipv6_chk_addr(net, saddr, dev,
+                                          flags & RT6_LOOKUP_F_IFACE))
+                                return sprt;
                 }
+        }
 
+        if (oif) {
                 if (local)
                         return local;
 
                 if (flags & RT6_LOOKUP_F_IFACE)
                         return net->ipv6.ip6_null_entry;
         }
+out:
         return rt;
 }
 
@@ -541,7 +551,7 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net,
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 restart:
         rt = fn->leaf;
-        rt = rt6_device_match(net, rt, fl->oif, flags);
+        rt = rt6_device_match(net, rt, &fl->fl6_src, fl->oif, flags);
         BACKTRACK(net, &fl->fl6_src);
 out:
         dst_use(&rt->u.dst, jiffies);
@@ -666,7 +676,7 @@ static struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
         int strict = 0;
         int attempts = 3;
         int err;
-        int reachable = ipv6_devconf.forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
+        int reachable = net->ipv6.devconf_all->forwarding ? 0 : RT6_LOOKUP_F_REACHABLE;
 
         strict |= flags & RT6_LOOKUP_F_IFACE;
 
@@ -1048,7 +1058,7 @@ int ip6_dst_hoplimit(struct dst_entry *dst)
                         hoplimit = idev->cnf.hop_limit;
                         in6_dev_put(idev);
                 } else
-                        hoplimit = ipv6_devconf.hop_limit;
+                        hoplimit = dev_net(dev)->ipv6.devconf_all->hop_limit;
         }
         return hoplimit;
 }
@@ -2406,26 +2416,7 @@ static int ipv6_route_show(struct seq_file *m, void *v)
 
 static int ipv6_route_open(struct inode *inode, struct file *file)
 {
-        int err;
-        struct net *net = get_proc_net(inode);
-        if (!net)
-                return -ENXIO;
-
-        err = single_open(file, ipv6_route_show, net);
-        if (err < 0) {
-                put_net(net);
-                return err;
-        }
-
-        return 0;
-}
-
-static int ipv6_route_release(struct inode *inode, struct file *file)
-{
-        struct seq_file *seq = file->private_data;
-        struct net *net = seq->private;
-        put_net(net);
-        return single_release(inode, file);
+        return single_open_net(inode, file, ipv6_route_show);
 }
 
 static const struct file_operations ipv6_route_proc_fops = {
@@ -2433,7 +2424,7 @@ static const struct file_operations ipv6_route_proc_fops = {
         .open           = ipv6_route_open,
         .read           = seq_read,
         .llseek         = seq_lseek,
-        .release        = ipv6_route_release,
+        .release        = single_release_net,
 };
 
 static int rt6_stats_seq_show(struct seq_file *seq, void *v)
@@ -2453,26 +2444,7 @@ static int rt6_stats_seq_show(struct seq_file *seq, void *v)
 
 static int rt6_stats_seq_open(struct inode *inode, struct file *file)
 {
-        int err;
-        struct net *net = get_proc_net(inode);
-        if (!net)
-                return -ENXIO;
-
-        err = single_open(file, rt6_stats_seq_show, net);
-        if (err < 0) {
-                put_net(net);
-                return err;
-        }
-
-        return 0;
-}
-
-static int rt6_stats_seq_release(struct inode *inode, struct file *file)
-{
-        struct seq_file *seq = file->private_data;
-        struct net *net = (struct net *)seq->private;
-        put_net(net);
-        return single_release(inode, file);
+        return single_open_net(inode, file, rt6_stats_seq_show);
 }
 
 static const struct file_operations rt6_stats_seq_fops = {
@@ -2480,7 +2452,7 @@ static const struct file_operations rt6_stats_seq_fops = {
         .open    = rt6_stats_seq_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = rt6_stats_seq_release,
+        .release = single_release_net,
 };
 #endif  /* CONFIG_PROC_FS */
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 32e871a6c25a..b7a50e968506 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -6,8 +6,6 @@
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *      Alexey Kuznetsov        <kuznet@ms2.inr.ac.ru>
  *
- *      $Id: sit.c,v 1.53 2001/09/25 05:09:53 davem Exp $
- *
  *      This program is free software; you can redistribute it and/or
  *      modify it under the terms of the GNU General Public License
  *      as published by the Free Software Foundation; either version
@@ -493,13 +491,13 @@ static int ipip6_rcv(struct sk_buff *skb)
 
                 if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
                     !isatap_chksrc(skb, iph, tunnel)) {
-                        tunnel->stat.rx_errors++;
+                        tunnel->dev->stats.rx_errors++;
                         read_unlock(&ipip6_lock);
                         kfree_skb(skb);
                         return 0;
                 }
-                tunnel->stat.rx_packets++;
-                tunnel->stat.rx_bytes += skb->len;
+                tunnel->dev->stats.rx_packets++;
+                tunnel->dev->stats.rx_bytes += skb->len;
                 skb->dev = tunnel->dev;
                 dst_release(skb->dst);
                 skb->dst = NULL;
@@ -539,7 +537,7 @@ static inline __be32 try_6to4(struct in6_addr *v6dst)
 static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->stat;
+        struct net_device_stats *stats = &tunnel->dev->stats;
         struct iphdr  *tiph = &tunnel->parms.iph;
         struct ipv6hdr *iph6 = ipv6_hdr(skb);
         u8     tos = tunnel->parms.iph.tos;
@@ -553,7 +551,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
         int addr_type;
 
         if (tunnel->recursion++) {
-                tunnel->stat.collisions++;
+                stats->collisions++;
                 goto tx_error;
         }
 
@@ -620,20 +618,20 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                                     .oif = tunnel->parms.link,
                                     .proto = IPPROTO_IPV6 };
                 if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
-                        tunnel->stat.tx_carrier_errors++;
+                        stats->tx_carrier_errors++;
                         goto tx_error_icmp;
                 }
         }
         if (rt->rt_type != RTN_UNICAST) {
                 ip_rt_put(rt);
-                tunnel->stat.tx_carrier_errors++;
+                stats->tx_carrier_errors++;
                 goto tx_error_icmp;
         }
         tdev = rt->u.dst.dev;
 
         if (tdev == dev) {
                 ip_rt_put(rt);
-                tunnel->stat.collisions++;
+                stats->collisions++;
                 goto tx_error;
         }
 
@@ -643,7 +641,7 @@ static int ipip6_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
                 mtu = skb->dst ? dst_mtu(skb->dst) : dev->mtu;
 
         if (mtu < 68) {
-                tunnel->stat.collisions++;
+                stats->collisions++;
                 ip_rt_put(rt);
                 goto tx_error;
         }
@@ -920,11 +918,6 @@ done:
         return err;
 }
 
-static struct net_device_stats *ipip6_tunnel_get_stats(struct net_device *dev)
-{
-        return &(((struct ip_tunnel*)netdev_priv(dev))->stat);
-}
-
 static int ipip6_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 {
         if (new_mtu < IPV6_MIN_MTU || new_mtu > 0xFFF8 - sizeof(struct iphdr))
@@ -938,7 +931,6 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         dev->uninit             = ipip6_tunnel_uninit;
         dev->destructor         = free_netdev;
         dev->hard_start_xmit    = ipip6_tunnel_xmit;
-        dev->get_stats          = ipip6_tunnel_get_stats;
         dev->do_ioctl           = ipip6_tunnel_ioctl;
         dev->change_mtu         = ipip6_tunnel_change_mtu;
 
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 3ecc1157994e..6a68eeb7bbf8 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -137,7 +137,7 @@ __u32 cookie_v6_init_sequence(struct sock *sk, struct sk_buff *skb, __u16 *mssp)
                 ;
         *mssp = msstab[mssind] + 1;
 
-        NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESSENT);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESSENT);
 
         return secure_tcp_syn_cookie(&iph->saddr, &iph->daddr, th->source,
                                      th->dest, ntohl(th->seq),
@@ -177,11 +177,11 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         if (time_after(jiffies, tp->last_synq_overflow + TCP_TIMEOUT_INIT) ||
                 (mss = cookie_check(skb, cookie)) == 0) {
-                NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESFAILED);
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESFAILED);
                 goto out;
         }
 
-        NET_INC_STATS_BH(LINUX_MIB_SYNCOOKIESRECV);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
 
         /* check for timestamp cookie support */
         memset(&tcp_opt, 0, sizeof(tcp_opt));
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 3804dcbbfab0..5c99274558bf 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -37,6 +37,10 @@ static ctl_table ipv6_table_template[] = {
                 .mode           = 0644,
                 .proc_handler   = &proc_dointvec
         },
+        { .ctl_name = 0 }
+};
+
+static ctl_table ipv6_table[] = {
         {
                 .ctl_name       = NET_IPV6_MLD_MAX_MSF,
                 .procname       = "mld_max_msf",
@@ -80,12 +84,6 @@ static int ipv6_sysctl_net_init(struct net *net)
 
         ipv6_table[2].data = &net->ipv6.sysctl.bindv6only;
 
-        /* We don't want this value to be per namespace, it should be global
-           to all namespaces, so make it read-only when we are not in the
-           init network namespace */
-        if (net != &init_net)
-                ipv6_table[3].mode = 0444;
-
         net->ipv6.sysctl.table = register_net_sysctl_table(net, net_ipv6_ctl_path,
                                                            ipv6_table);
         if (!net->ipv6.sysctl.table)
@@ -126,12 +124,29 @@ static struct pernet_operations ipv6_sysctl_net_ops = {
         .exit = ipv6_sysctl_net_exit,
 };
 
+static struct ctl_table_header *ip6_header;
+
 int ipv6_sysctl_register(void)
 {
-        return register_pernet_subsys(&ipv6_sysctl_net_ops);
+        int err = -ENOMEM;;
+
+        ip6_header = register_net_sysctl_rotable(net_ipv6_ctl_path, ipv6_table);
+        if (ip6_header == NULL)
+                goto out;
+
+        err = register_pernet_subsys(&ipv6_sysctl_net_ops);
+        if (err)
+                goto err_pernet;
+out:
+        return err;
+
+err_pernet:
+        unregister_net_sysctl_table(ip6_header);
+        goto out;
 }
 
 void ipv6_sysctl_unregister(void)
 {
+        unregister_net_sysctl_table(ip6_header);
         unregister_pernet_subsys(&ipv6_sysctl_net_ops);
 }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 40ea9c36d24b..ae45f9835014 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -5,8 +5,6 @@
  *      Authors:
  *      Pedro Roque             <roque@di.fc.ul.pt>
  *
- *      $Id: tcp_ipv6.c,v 1.144 2002/02/01 22:01:04 davem Exp $
- *
  *      Based on:
  *      linux/net/ipv4/tcp.c
  *      linux/net/ipv4/tcp_input.c
@@ -72,8 +70,6 @@
 
 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
 static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
-static void     tcp_v6_send_check(struct sock *sk, int len,
-                                  struct sk_buff *skb);
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
 
@@ -82,6 +78,12 @@ static struct inet_connection_sock_af_ops ipv6_specific;
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_sock_af_ops tcp_sock_ipv6_specific;
 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific;
+#else
+static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk,
+                                                   struct in6_addr *addr)
+{
+        return NULL;
+}
 #endif
 
 static void tcp_v6_hash(struct sock *sk)
@@ -321,8 +323,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         int err;
         struct tcp_sock *tp;
         __u32 seq;
+        struct net *net = dev_net(skb->dev);
 
-        sk = inet6_lookup(dev_net(skb->dev), &tcp_hashinfo, &hdr->daddr,
+        sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
                         th->dest, &hdr->saddr, th->source, skb->dev->ifindex);
 
         if (sk == NULL) {
@@ -337,7 +340,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
         bh_lock_sock(sk);
         if (sock_owned_by_user(sk))
-                NET_INC_STATS_BH(LINUX_MIB_LOCKDROPPEDICMPS);
+                NET_INC_STATS_BH(net, LINUX_MIB_LOCKDROPPEDICMPS);
 
         if (sk->sk_state == TCP_CLOSE)
                 goto out;
@@ -346,7 +349,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         seq = ntohl(th->seq);
         if (sk->sk_state != TCP_LISTEN &&
             !between(seq, tp->snd_una, tp->snd_nxt)) {
-                NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
+                NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
                 goto out;
         }
 
@@ -421,7 +424,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 BUG_TRAP(req->sk == NULL);
 
                 if (seq != tcp_rsk(req)->snt_isn) {
-                        NET_INC_STATS_BH(LINUX_MIB_OUTOFWINDOWICMPS);
+                        NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
                         goto out;
                 }
 
@@ -733,109 +736,105 @@ static int tcp_v6_parse_md5_keys (struct sock *sk, char __user *optval,
         return tcp_v6_md5_do_add(sk, &sin6->sin6_addr, newkey, cmd.tcpm_keylen);
 }
 
-static int tcp_v6_do_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
-                                   struct in6_addr *saddr,
-                                   struct in6_addr *daddr,
-                                   struct tcphdr *th, int protocol,
-                                   unsigned int tcplen)
+static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
+                                        struct in6_addr *daddr,
+                                        struct in6_addr *saddr, int nbytes)
 {
-        struct scatterlist sg[4];
-        __u16 data_len;
-        int block = 0;
-        __sum16 cksum;
-        struct tcp_md5sig_pool *hp;
         struct tcp6_pseudohdr *bp;
-        struct hash_desc *desc;
-        int err;
-        unsigned int nbytes = 0;
+        struct scatterlist sg;
 
-        hp = tcp_get_md5sig_pool();
-        if (!hp) {
-                printk(KERN_WARNING "%s(): hash pool not found...\n", __func__);
-                goto clear_hash_noput;
-        }
         bp = &hp->md5_blk.ip6;
-        desc = &hp->md5_desc;
-
         /* 1. TCP pseudo-header (RFC2460) */
         ipv6_addr_copy(&bp->saddr, saddr);
         ipv6_addr_copy(&bp->daddr, daddr);
-        bp->len = htonl(tcplen);
-        bp->protocol = htonl(protocol);
-
-        sg_init_table(sg, 4);
-
-        sg_set_buf(&sg[block++], bp, sizeof(*bp));
-        nbytes += sizeof(*bp);
+        bp->protocol = cpu_to_be32(IPPROTO_TCP);
+        bp->len = cpu_to_be16(nbytes);
 
-        /* 2. TCP header, excluding options */
-        cksum = th->check;
-        th->check = 0;
-        sg_set_buf(&sg[block++], th, sizeof(*th));
-        nbytes += sizeof(*th);
-
-        /* 3. TCP segment data (if any) */
-        data_len = tcplen - (th->doff << 2);
-        if (data_len > 0) {
-                u8 *data = (u8 *)th + (th->doff << 2);
-                sg_set_buf(&sg[block++], data, data_len);
-                nbytes += data_len;
-        }
+        sg_init_one(&sg, bp, sizeof(*bp));
+        return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
+}
 
-        /* 4. shared key */
-        sg_set_buf(&sg[block++], key->key, key->keylen);
-        nbytes += key->keylen;
+static int tcp_v6_md5_hash_hdr(char *md5_hash, struct tcp_md5sig_key *key,
+                               struct in6_addr *daddr, struct in6_addr *saddr,
+                               struct tcphdr *th)
+{
+        struct tcp_md5sig_pool *hp;
+        struct hash_desc *desc;
 
-        sg_mark_end(&sg[block - 1]);
+        hp = tcp_get_md5sig_pool();
+        if (!hp)
+                goto clear_hash_noput;
+        desc = &hp->md5_desc;
 
-        /* Now store the hash into the packet */
-        err = crypto_hash_init(desc);
-        if (err) {
-                printk(KERN_WARNING "%s(): hash_init failed\n", __func__);
+        if (crypto_hash_init(desc))
                 goto clear_hash;
-        }
-        err = crypto_hash_update(desc, sg, nbytes);
-        if (err) {
-                printk(KERN_WARNING "%s(): hash_update failed\n", __func__);
+        if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, th->doff << 2))
                 goto clear_hash;
-        }
-        err = crypto_hash_final(desc, md5_hash);
-        if (err) {
-                printk(KERN_WARNING "%s(): hash_final failed\n", __func__);
+        if (tcp_md5_hash_header(hp, th))
+                goto clear_hash;
+        if (tcp_md5_hash_key(hp, key))
+                goto clear_hash;
+        if (crypto_hash_final(desc, md5_hash))
                 goto clear_hash;
-        }
 
-        /* Reset header, and free up the crypto */
         tcp_put_md5sig_pool();
-        th->check = cksum;
-out:
         return 0;
+
 clear_hash:
         tcp_put_md5sig_pool();
 clear_hash_noput:
         memset(md5_hash, 0, 16);
-        goto out;
+        return 1;
 }
 
-static int tcp_v6_calc_md5_hash(char *md5_hash, struct tcp_md5sig_key *key,
-                                struct sock *sk,
-                                struct dst_entry *dst,
-                                struct request_sock *req,
-                                struct tcphdr *th, int protocol,
-                                unsigned int tcplen)
+static int tcp_v6_md5_hash_skb(char *md5_hash, struct tcp_md5sig_key *key,
+                               struct sock *sk, struct request_sock *req,
+                               struct sk_buff *skb)
 {
         struct in6_addr *saddr, *daddr;
+        struct tcp_md5sig_pool *hp;
+        struct hash_desc *desc;
+        struct tcphdr *th = tcp_hdr(skb);
 
         if (sk) {
                 saddr = &inet6_sk(sk)->saddr;
                 daddr = &inet6_sk(sk)->daddr;
-        } else {
+        } else if (req) {
                 saddr = &inet6_rsk(req)->loc_addr;
                 daddr = &inet6_rsk(req)->rmt_addr;
+        } else {
+                struct ipv6hdr *ip6h = ipv6_hdr(skb);
+                saddr = &ip6h->saddr;
+                daddr = &ip6h->daddr;
         }
-        return tcp_v6_do_calc_md5_hash(md5_hash, key,
-                                       saddr, daddr,
-                                       th, protocol, tcplen);
+
+        hp = tcp_get_md5sig_pool();
+        if (!hp)
+                goto clear_hash_noput;
+        desc = &hp->md5_desc;
+
+        if (crypto_hash_init(desc))
+                goto clear_hash;
+
+        if (tcp_v6_md5_hash_pseudoheader(hp, daddr, saddr, skb->len))
+                goto clear_hash;
+        if (tcp_md5_hash_header(hp, th))
+                goto clear_hash;
+        if (tcp_md5_hash_skb_data(hp, skb, th->doff << 2))
+                goto clear_hash;
+        if (tcp_md5_hash_key(hp, key))
+                goto clear_hash;
+        if (crypto_hash_final(desc, md5_hash))
+                goto clear_hash;
+
+        tcp_put_md5sig_pool();
+        return 0;
+
+clear_hash:
+        tcp_put_md5sig_pool();
+clear_hash_noput:
+        memset(md5_hash, 0, 16);
+        return 1;
 }
 
 static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
@@ -844,43 +843,12 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
         struct tcp_md5sig_key *hash_expected;
         struct ipv6hdr *ip6h = ipv6_hdr(skb);
         struct tcphdr *th = tcp_hdr(skb);
-        int length = (th->doff << 2) - sizeof (*th);
         int genhash;
-        u8 *ptr;
         u8 newhash[16];
 
         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
+        hash_location = tcp_parse_md5sig_option(th);
 
-        /* If the TCP option is too short, we can short cut */
-        if (length < TCPOLEN_MD5SIG)
-                return hash_expected ? 1 : 0;
-
-        /* parse options */
-        ptr = (u8*)(th + 1);
-        while (length > 0) {
-                int opcode = *ptr++;
-                int opsize;
-
-                switch(opcode) {
-                case TCPOPT_EOL:
-                        goto done_opts;
-                case TCPOPT_NOP:
-                        length--;
-                        continue;
-                default:
-                        opsize = *ptr++;
-                        if (opsize < 2 || opsize > length)
-                                goto done_opts;
-                        if (opcode == TCPOPT_MD5SIG) {
-                                hash_location = ptr;
-                                goto done_opts;
-                        }
-                }
-                ptr += opsize - 2;
-                length -= opsize;
-        }
-
-done_opts:
         /* do we have a hash as expected? */
         if (!hash_expected) {
                 if (!hash_location)
@@ -907,11 +875,10 @@ done_opts:
         }
 
         /* check the signature */
-        genhash = tcp_v6_do_calc_md5_hash(newhash,
-                                          hash_expected,
-                                          &ip6h->saddr, &ip6h->daddr,
-                                          th, sk->sk_protocol,
-                                          skb->len);
+        genhash = tcp_v6_md5_hash_skb(newhash,
+                                      hash_expected,
+                                      NULL, NULL, skb);
+
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
                 if (net_ratelimit()) {
                         printk(KERN_INFO "MD5 Hash %s for "
@@ -1048,10 +1015,9 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
                                (TCPOPT_NOP << 16) |
                                (TCPOPT_MD5SIG << 8) |
                                TCPOLEN_MD5SIG);
-                tcp_v6_do_calc_md5_hash((__u8 *)&opt[1], key,
-                                        &ipv6_hdr(skb)->daddr,
-                                        &ipv6_hdr(skb)->saddr,
-                                        t1, IPPROTO_TCP, tot_len);
+                tcp_v6_md5_hash_hdr((__u8 *)&opt[1], key,
+                                    &ipv6_hdr(skb)->daddr,
+                                    &ipv6_hdr(skb)->saddr, t1);
         }
 #endif
 
@@ -1079,8 +1045,8 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
 
                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
                         ip6_xmit(ctl_sk, buff, &fl, NULL, 0);
-                        TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
-                        TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
+                        TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
+                        TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
                         return;
                 }
         }
@@ -1088,8 +1054,8 @@ static void tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb)
         kfree_skb(buff);
 }
 
-static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
-                            struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts)
+static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32 ts,
+                            struct tcp_md5sig_key *key)
 {
         struct tcphdr *th = tcp_hdr(skb), *t1;
         struct sk_buff *buff;
@@ -1098,22 +1064,6 @@ static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
         struct sock *ctl_sk = net->ipv6.tcp_sk;
         unsigned int tot_len = sizeof(struct tcphdr);
         __be32 *topt;
-#ifdef CONFIG_TCP_MD5SIG
-        struct tcp_md5sig_key *key;
-        struct tcp_md5sig_key tw_key;
-#endif
-
-#ifdef CONFIG_TCP_MD5SIG
-        if (!tw && skb->sk) {
-                key = tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr);
-        } else if (tw && tw->tw_md5_keylen) {
-                tw_key.key = tw->tw_md5_key;
-                tw_key.keylen = tw->tw_md5_keylen;
-                key = &tw_key;
-        } else {
-                key = NULL;
-        }
-#endif
 
         if (ts)
                 tot_len += TCPOLEN_TSTAMP_ALIGNED;
@@ -1154,10 +1104,9 @@ static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
         if (key) {
                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
-                tcp_v6_do_calc_md5_hash((__u8 *)topt, key,
-                                        &ipv6_hdr(skb)->daddr,
-                                        &ipv6_hdr(skb)->saddr,
-                                        t1, IPPROTO_TCP, tot_len);
+                tcp_v6_md5_hash_hdr((__u8 *)topt, key,
+                                    &ipv6_hdr(skb)->daddr,
+                                    &ipv6_hdr(skb)->saddr, t1);
         }
 #endif
 
@@ -1180,7 +1129,7 @@ static void tcp_v6_send_ack(struct tcp_timewait_sock *tw,
         if (!ip6_dst_lookup(ctl_sk, &buff->dst, &fl)) {
                 if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
                         ip6_xmit(ctl_sk, buff, &fl, NULL, 0);
-                        TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
+                        TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
                         return;
                 }
         }
@@ -1193,16 +1142,17 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
         struct inet_timewait_sock *tw = inet_twsk(sk);
         struct tcp_timewait_sock *tcptw = tcp_twsk(sk);
 
-        tcp_v6_send_ack(tcptw, skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
+        tcp_v6_send_ack(skb, tcptw->tw_snd_nxt, tcptw->tw_rcv_nxt,
                         tcptw->tw_rcv_wnd >> tw->tw_rcv_wscale,
-                        tcptw->tw_ts_recent);
+                        tcptw->tw_ts_recent, tcp_twsk_md5_key(tcptw));
 
         inet_twsk_put(tw);
 }
 
 static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
 {
-        tcp_v6_send_ack(NULL, skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent);
+        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
+                        tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr));
 }
 
 
@@ -1538,9 +1488,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         return newsk;
 
 out_overflow:
-        NET_INC_STATS_BH(LINUX_MIB_LISTENOVERFLOWS);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENOVERFLOWS);
 out:
-        NET_INC_STATS_BH(LINUX_MIB_LISTENDROPS);
+        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_LISTENDROPS);
         if (opt && opt != np->opt)
                 sock_kfree_s(sk, opt, opt->tot_len);
         dst_release(dst);
@@ -1669,7 +1619,7 @@ discard:
         kfree_skb(skb);
         return 0;
 csum_err:
-        TCP_INC_STATS_BH(TCP_MIB_INERRS);
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_INERRS);
         goto discard;
 
 
@@ -1707,6 +1657,7 @@ static int tcp_v6_rcv(struct sk_buff *skb)
         struct tcphdr *th;
         struct sock *sk;
         int ret;
+        struct net *net = dev_net(skb->dev);
 
         if (skb->pkt_type != PACKET_HOST)
                 goto discard_it;
@@ -1714,7 +1665,7 @@ static int tcp_v6_rcv(struct sk_buff *skb)
         /*
          *      Count it even if it's bad.
          */
-        TCP_INC_STATS_BH(TCP_MIB_INSEGS);
+        TCP_INC_STATS_BH(net, TCP_MIB_INSEGS);
 
         if (!pskb_may_pull(skb, sizeof(struct tcphdr)))
                 goto discard_it;
@@ -1738,7 +1689,7 @@ static int tcp_v6_rcv(struct sk_buff *skb)
         TCP_SKB_CB(skb)->flags = ipv6_get_dsfield(ipv6_hdr(skb));
         TCP_SKB_CB(skb)->sacked = 0;
 
-        sk = __inet6_lookup(dev_net(skb->dev), &tcp_hashinfo,
+        sk = __inet6_lookup(net, &tcp_hashinfo,
                         &ipv6_hdr(skb)->saddr, th->source,
                         &ipv6_hdr(skb)->daddr, ntohs(th->dest),
                         inet6_iif(skb));
@@ -1786,7 +1737,7 @@ no_tcp_socket:
 
         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
 bad_packet:
-                TCP_INC_STATS_BH(TCP_MIB_INERRS);
+                TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
         } else {
                 tcp_v6_send_reset(NULL, skb);
         }
@@ -1811,7 +1762,7 @@ do_time_wait:
         }
 
         if (skb->len < (th->doff<<2) || tcp_checksum_complete(skb)) {
-                TCP_INC_STATS_BH(TCP_MIB_INERRS);
+                TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
                 inet_twsk_put(inet_twsk(sk));
                 goto discard_it;
         }
@@ -1871,7 +1822,7 @@ static struct inet_connection_sock_af_ops ipv6_specific = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_sock_af_ops tcp_sock_ipv6_specific = {
         .md5_lookup     =       tcp_v6_md5_lookup,
-        .calc_md5_hash  =       tcp_v6_calc_md5_hash,
+        .calc_md5_hash  =       tcp_v6_md5_hash_skb,
         .md5_add        =       tcp_v6_md5_add_func,
         .md5_parse      =       tcp_v6_parse_md5_keys,
 };
@@ -1903,7 +1854,7 @@ static struct inet_connection_sock_af_ops ipv6_mapped = {
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_sock_af_ops tcp_sock_ipv6_mapped_specific = {
         .md5_lookup     =       tcp_v4_md5_lookup,
-        .calc_md5_hash  =       tcp_v4_calc_md5_hash,
+        .calc_md5_hash  =       tcp_v4_md5_hash_skb,
         .md5_add        =       tcp_v6_md5_add_func,
         .md5_parse      =       tcp_v6_parse_md5_keys,
 };
@@ -1960,7 +1911,7 @@ static int tcp_v6_init_sock(struct sock *sk)
         return 0;
 }
 
-static int tcp_v6_destroy_sock(struct sock *sk)
+static void tcp_v6_destroy_sock(struct sock *sk)
 {
 #ifdef CONFIG_TCP_MD5SIG
         /* Clean up the MD5 key list */
@@ -1968,7 +1919,7 @@ static int tcp_v6_destroy_sock(struct sock *sk)
                 tcp_v6_clear_md5_list(sk);
 #endif
         tcp_v4_destroy_sock(sk);
-        return inet6_destroy_sock(sk);
+        inet6_destroy_sock(sk);
 }
 
 #ifdef CONFIG_PROC_FS
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index dd309626ae9a..d1477b350f76 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -7,8 +7,6 @@
  *
  *      Based on linux/ipv4/udp.c
  *
- *      $Id: udp.c,v 1.65 2002/02/01 22:01:04 davem Exp $
- *
  *      Fixes:
  *      Hideaki YOSHIFUJI       :       sin6_scope_id support
  *      YOSHIFUJI Hideaki @USAGI and:   Support IPV6_V6ONLY socket option, which
@@ -67,7 +65,7 @@ static struct sock *__udp6_lib_lookup(struct net *net,
         int badness = -1;
 
         read_lock(&udp_hash_lock);
-        sk_for_each(sk, node, &udptable[hnum & (UDP_HTABLE_SIZE - 1)]) {
+        sk_for_each(sk, node, &udptable[udp_hashfn(net, hnum)]) {
                 struct inet_sock *inet = inet_sk(sk);
 
                 if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
@@ -168,7 +166,8 @@ try_again:
                 goto out_free;
 
         if (!peeked)
-                UDP6_INC_STATS_USER(UDP_MIB_INDATAGRAMS, is_udplite);
+                UDP6_INC_STATS_USER(sock_net(sk),
+                                UDP_MIB_INDATAGRAMS, is_udplite);
 
         sock_recv_timestamp(msg, sk, skb);
 
@@ -215,7 +214,7 @@ out:
 csum_copy_err:
         lock_sock(sk);
         if (!skb_kill_datagram(sk, skb, flags))
-                UDP6_INC_STATS_USER(UDP_MIB_INERRORS, is_udplite);
+                UDP6_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
         release_sock(sk);
 
         if (flags & MSG_DONTWAIT)
@@ -299,14 +298,17 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
 
         if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM)
-                        UDP6_INC_STATS_BH(UDP_MIB_RCVBUFERRORS, is_udplite);
+                if (rc == -ENOMEM) {
+                        UDP6_INC_STATS_BH(sock_net(sk),
+                                        UDP_MIB_RCVBUFERRORS, is_udplite);
+                        atomic_inc(&sk->sk_drops);
+                }
                 goto drop;
         }
 
         return 0;
 drop:
-        UDP6_INC_STATS_BH(UDP_MIB_INERRORS, is_udplite);
+        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
         kfree_skb(skb);
         return -1;
 }
@@ -355,15 +357,16 @@ static struct sock *udp_v6_mcast_next(struct sock *sk,
  * Note: called only from the BH handler context,
  * so we don't need to lock the hashes.
  */
-static int __udp6_lib_mcast_deliver(struct sk_buff *skb, struct in6_addr *saddr,
-                           struct in6_addr *daddr, struct hlist_head udptable[])
+static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
+                struct in6_addr *saddr, struct in6_addr *daddr,
+                struct hlist_head udptable[])
 {
         struct sock *sk, *sk2;
         const struct udphdr *uh = udp_hdr(skb);
         int dif;
 
         read_lock(&udp_hash_lock);
-        sk = sk_head(&udptable[ntohs(uh->dest) & (UDP_HTABLE_SIZE - 1)]);
+        sk = sk_head(&udptable[udp_hashfn(net, ntohs(uh->dest))]);
         dif = inet6_iif(skb);
         sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
         if (!sk) {
@@ -437,6 +440,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
         struct net_device *dev = skb->dev;
         struct in6_addr *saddr, *daddr;
         u32 ulen = 0;
+        struct net *net = dev_net(skb->dev);
 
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                 goto short_packet;
@@ -475,7 +479,8 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
          *      Multicast receive code
          */
         if (ipv6_addr_is_multicast(daddr))
-                return __udp6_lib_mcast_deliver(skb, saddr, daddr, udptable);
+                return __udp6_lib_mcast_deliver(net, skb,
+                                saddr, daddr, udptable);
 
         /* Unicast */
 
@@ -483,7 +488,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
          * check socket cache ... must talk to Alan about his plans
          * for sock caches... i'll skip this for now.
          */
-        sk = __udp6_lib_lookup(dev_net(skb->dev), saddr, uh->source,
+        sk = __udp6_lib_lookup(net, saddr, uh->source,
                                daddr, uh->dest, inet6_iif(skb), udptable);
 
         if (sk == NULL) {
@@ -492,7 +497,8 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
 
                 if (udp_lib_checksum_complete(skb))
                         goto discard;
-                UDP6_INC_STATS_BH(UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
+                UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
+                                proto == IPPROTO_UDPLITE);
 
                 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
 
@@ -517,7 +523,7 @@ short_packet:
                        ulen, skb->len);
 
 discard:
-        UDP6_INC_STATS_BH(UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
+        UDP6_INC_STATS_BH(net, UDP_MIB_INERRORS, proto == IPPROTO_UDPLITE);
         kfree_skb(skb);
         return 0;
 }
@@ -587,7 +593,8 @@ out:
         up->len = 0;
         up->pending = 0;
         if (!err)
-                UDP6_INC_STATS_USER(UDP_MIB_OUTDATAGRAMS, is_udplite);
+                UDP6_INC_STATS_USER(sock_net(sk),
+                                UDP_MIB_OUTDATAGRAMS, is_udplite);
         return err;
 }
 
@@ -869,7 +876,8 @@ out:
          * seems like overkill.
          */
         if (err == -ENOBUFS || test_bit(SOCK_NOSPACE, &sk->sk_socket->flags)) {
-                UDP6_INC_STATS_USER(UDP_MIB_SNDBUFERRORS, is_udplite);
+                UDP6_INC_STATS_USER(sock_net(sk),
+                                UDP_MIB_SNDBUFERRORS, is_udplite);
         }
         return err;
 
@@ -881,15 +889,13 @@ do_confirm:
         goto out;
 }
 
-int udpv6_destroy_sock(struct sock *sk)
+void udpv6_destroy_sock(struct sock *sk)
 {
         lock_sock(sk);
         udp_v6_flush_pending_frames(sk);
         release_sock(sk);
 
         inet6_destroy_sock(sk);
-
-        return 0;
 }
 
 /*
@@ -955,7 +961,7 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
         srcp  = ntohs(inet->sport);
         seq_printf(seq,
                    "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p\n",
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
                    bucket,
                    src->s6_addr32[0], src->s6_addr32[1],
                    src->s6_addr32[2], src->s6_addr32[3], srcp,
@@ -967,7 +973,8 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
                    0, 0L, 0,
                    sock_i_uid(sp), 0,
                    sock_i_ino(sp),
-                   atomic_read(&sp->sk_refcnt), sp);
+                   atomic_read(&sp->sk_refcnt), sp,
+                   atomic_read(&sp->sk_drops));
 }
 
 int udp6_seq_show(struct seq_file *seq, void *v)
@@ -978,7 +985,7 @@ int udp6_seq_show(struct seq_file *seq, void *v)
                            "local_address                         "
                            "remote_address                        "
                            "st tx_queue rx_queue tr tm->when retrnsmt"
-                           "   uid  timeout inode\n");
+                           "   uid  timeout inode ref pointer drops\n");
         else
                 udp6_sock_seq_show(seq, v, ((struct udp_iter_state *)seq->private)->bucket);
         return 0;
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index 321b81a4d418..92dd7da766d8 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -29,7 +29,7 @@ extern int	udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                               struct msghdr *msg, size_t len,
                               int noblock, int flags, int *addr_len);
 extern int      udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
-extern int      udpv6_destroy_sock(struct sock *sk);
+extern void     udpv6_destroy_sock(struct sock *sk);
 
 #ifdef CONFIG_PROC_FS
 extern int      udp6_seq_show(struct seq_file *seq, void *v);
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 491efd00a866..f6cdcb348e05 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -2,8 +2,6 @@
  *  UDPLITEv6   An implementation of the UDP-Lite protocol over IPv6.
  *              See also net/ipv4/udplite.c
  *
- *  Version:    $Id: udplite.c,v 1.9 2006/10/19 08:28:10 gerrit Exp $
- *
  *  Authors:    Gerrit Renker       <gerrit@erg.abdn.ac.uk>
  *
  *  Changes: