2 files changed, 17 insertions, 8 deletions

diff --git a/Documentation/networking/ip-sysctl.txt b/Documentation/networking/ip-sysctl.txt
index 7185e4c41e59..ec5de02f543f 100644
--- a/Documentation/networking/ip-sysctl.txt
+++ b/Documentation/networking/ip-sysctl.txt
@@ -1043,7 +1043,9 @@ max_addresses - INTEGER
         Default: 16
 
 disable_ipv6 - BOOLEAN
-        Disable IPv6 operation.
+        Disable IPv6 operation.  If accept_dad is set to 2, this value
+        will be dynamically set to TRUE if DAD fails for the link-local
+        address.
         Default: FALSE (enable IPv6 operation)
 
 accept_dad - INTEGER
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e83852ab4dc8..717584bad02e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -590,6 +590,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
 {
         struct inet6_ifaddr *ifa = NULL;
         struct rt6_info *rt;
+        struct net *net = dev_net(idev->dev);
         int hash;
         int err = 0;
         int addr_type = ipv6_addr_type(addr);
@@ -606,6 +607,11 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
                 goto out2;
         }
 
+        if (idev->cnf.disable_ipv6 || net->ipv6.devconf_all->disable_ipv6) {
+                err = -EACCES;
+                goto out2;
+        }
+
         write_lock(&addrconf_hash_lock);
 
         /* Ignore adding duplicate addresses on an interface */
@@ -1433,6 +1439,11 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp)
 void addrconf_dad_failure(struct inet6_ifaddr *ifp)
 {
         struct inet6_dev *idev = ifp->idev;
+
+        if (net_ratelimit())
+                printk(KERN_INFO "%s: IPv6 duplicate address detected!\n",
+                        ifp->idev->dev->name);
+
         if (idev->cnf.accept_dad > 1 && !idev->cnf.disable_ipv6) {
                 struct in6_addr addr;
 
@@ -1443,11 +1454,12 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp)
                     ipv6_addr_equal(&ifp->addr, &addr)) {
                         /* DAD failed for link-local based on MAC address */
                         idev->cnf.disable_ipv6 = 1;
+
+                        printk(KERN_INFO "%s: IPv6 being disabled!\n",
+                                ifp->idev->dev->name);
                 }
         }
 
-        if (net_ratelimit())
-                printk(KERN_INFO "%s: duplicate address detected!\n", ifp->idev->dev->name);
         addrconf_dad_stop(ifp);
 }
 
@@ -2823,11 +2835,6 @@ static void addrconf_dad_timer(unsigned long data)
                 read_unlock_bh(&idev->lock);
                 goto out;
         }
-        if (idev->cnf.accept_dad > 1 && idev->cnf.disable_ipv6) {
-                read_unlock_bh(&idev->lock);
-                addrconf_dad_failure(ifp);
-                return;
-        }
         spin_lock_bh(&ifp->lock);
         if (ifp->probes == 0) {
                 /*