18 files changed, 129 insertions, 77 deletions

diff --git a/drivers/net/arcnet/com20020-pci.c b/drivers/net/arcnet/com20020-pci.c
index 6c99ff0b0bdd..945f532078e9 100644
--- a/drivers/net/arcnet/com20020-pci.c
+++ b/drivers/net/arcnet/com20020-pci.c
@@ -78,6 +78,9 @@ static int com20020pci_probe(struct pci_dev *pdev, const struct pci_device_id *i
 
         priv = devm_kzalloc(&pdev->dev, sizeof(struct com20020_priv),
                             GFP_KERNEL);
+        if (!priv)
+                return -ENOMEM;
+
         ci = (struct com20020_pci_card_info *)id->driver_data;
         priv->ci = ci;
 
diff --git a/drivers/net/dsa/mv88e6131.c b/drivers/net/dsa/mv88e6131.c
index 1230f52aa70e..2540ef0142af 100644
--- a/drivers/net/dsa/mv88e6131.c
+++ b/drivers/net/dsa/mv88e6131.c
@@ -139,7 +139,8 @@ static int mv88e6131_setup_global(struct dsa_switch *ds)
                 int nexthop;
 
                 nexthop = 0x1f;
-                if (i != ds->index && i < ds->dst->pd->nr_chips)
+                if (ds->pd->rtable &&
+                    i != ds->index && i < ds->dst->pd->nr_chips)
                         nexthop = ds->pd->rtable[i] & 0x1f;
 
                 REG_WRITE(REG_GLOBAL2, 0x06, 0x8000 | (i << 8) | nexthop);
diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
index d41f9f468688..b93d4404d975 100644
--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
+++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c
@@ -342,12 +342,13 @@ static irqreturn_t xgbe_isr(int irq, void *data)
                 dma_ch_isr = XGMAC_DMA_IOREAD(channel, DMA_CH_SR);
                 DBGPR("  DMA_CH%u_ISR = %08x\n", i, dma_ch_isr);
 
-                /* If we get a TI or RI interrupt that means per channel DMA
-                 * interrupts are not enabled, so we use the private data napi
-                 * structure, not the per channel napi structure
+                /* The TI or RI interrupt bits may still be set even if using
+                 * per channel DMA interrupts. Check to be sure those are not
+                 * enabled before using the private data napi structure.
                  */
-                if (XGMAC_GET_BITS(dma_ch_isr, DMA_CH_SR, TI) ||
-                    XGMAC_GET_BITS(dma_ch_isr, DMA_CH_SR, RI)) {
+                if (!pdata->per_channel_irq &&
+                    (XGMAC_GET_BITS(dma_ch_isr, DMA_CH_SR, TI) ||
+                     XGMAC_GET_BITS(dma_ch_isr, DMA_CH_SR, RI))) {
                         if (napi_schedule_prep(&pdata->napi)) {
                                 /* Disable Tx and Rx interrupts */
                                 xgbe_disable_rx_tx_ints(pdata);
diff --git a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
index 11288d4fc85f..c8a01ee4d25e 100644
--- a/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
+++ b/drivers/net/ethernet/samsung/sxgbe/sxgbe_main.c
@@ -364,6 +364,26 @@ static int sxgbe_init_rx_buffers(struct net_device *dev,
 
         return 0;
 }
+
+/**
+ * sxgbe_free_rx_buffers - free what sxgbe_init_rx_buffers() allocated
+ * @dev: net device structure
+ * @rx_ring: ring to be freed
+ * @rx_rsize: ring size
+ * Description:  this function initializes the DMA RX descriptor
+ */
+static void sxgbe_free_rx_buffers(struct net_device *dev,
+                                  struct sxgbe_rx_norm_desc *p, int i,
+                                  unsigned int dma_buf_sz,
+                                  struct sxgbe_rx_queue *rx_ring)
+{
+        struct sxgbe_priv_data *priv = netdev_priv(dev);
+
+        kfree_skb(rx_ring->rx_skbuff[i]);
+        dma_unmap_single(priv->device, rx_ring->rx_skbuff_dma[i],
+                         dma_buf_sz, DMA_FROM_DEVICE);
+}
+
 /**
  * init_tx_ring - init the TX descriptor ring
  * @dev: net device structure
@@ -456,7 +476,7 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no,
         /* RX ring is not allcoated */
         if (rx_ring == NULL) {
                 netdev_err(dev, "No memory for RX queue\n");
-                goto error;
+                return -ENOMEM;
         }
 
         /* assign queue number */
@@ -468,23 +488,21 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no,
                                               &rx_ring->dma_rx_phy, GFP_KERNEL);
 
         if (rx_ring->dma_rx == NULL)
-                goto error;
+                return -ENOMEM;
 
         /* allocate memory for RX skbuff array */
         rx_ring->rx_skbuff_dma = kmalloc_array(rx_rsize,
                                                sizeof(dma_addr_t), GFP_KERNEL);
         if (!rx_ring->rx_skbuff_dma) {
-                dma_free_coherent(priv->device,
-                                  rx_rsize * sizeof(struct sxgbe_rx_norm_desc),
-                                  rx_ring->dma_rx, rx_ring->dma_rx_phy);
-                goto error;
+                ret = -ENOMEM;
+                goto err_free_dma_rx;
         }
 
         rx_ring->rx_skbuff = kmalloc_array(rx_rsize,
                                            sizeof(struct sk_buff *), GFP_KERNEL);
         if (!rx_ring->rx_skbuff) {
-                kfree(rx_ring->rx_skbuff_dma);
-                goto error;
+                ret = -ENOMEM;
+                goto err_free_skbuff_dma;
         }
 
         /* initialise the buffers */
@@ -494,7 +512,7 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no,
                 ret = sxgbe_init_rx_buffers(dev, p, desc_index,
                                             bfsize, rx_ring);
                 if (ret)
-                        goto err_init_rx_buffers;
+                        goto err_free_rx_buffers;
         }
 
         /* initalise counters */
@@ -504,11 +522,22 @@ static int init_rx_ring(struct net_device *dev, u8 queue_no,
 
         return 0;
 
-err_init_rx_buffers:
-        while (--desc_index >= 0)
-                free_rx_ring(priv->device, rx_ring, desc_index);
-error:
-        return -ENOMEM;
+err_free_rx_buffers:
+        while (--desc_index >= 0) {
+                struct sxgbe_rx_norm_desc *p;
+
+                p = rx_ring->dma_rx + desc_index;
+                sxgbe_free_rx_buffers(dev, p, desc_index, bfsize, rx_ring);
+        }
+        kfree(rx_ring->rx_skbuff);
+err_free_skbuff_dma:
+        kfree(rx_ring->rx_skbuff_dma);
+err_free_dma_rx:
+        dma_free_coherent(priv->device,
+                          rx_rsize * sizeof(struct sxgbe_rx_norm_desc),
+                          rx_ring->dma_rx, rx_ring->dma_rx_phy);
+
+        return ret;
 }
 /**
  * free_tx_ring - free the TX descriptor ring
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index e6ed3e66964d..0e57e862c399 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -1009,7 +1009,7 @@ static bool vxlan_snoop(struct net_device *dev,
                 if (net_ratelimit())
                         netdev_info(dev,
                                     "%pM migrated from %pIS to %pIS\n",
-                                    src_mac, &rdst->remote_ip, &src_ip);
+                                    src_mac, &rdst->remote_ip.sa, &src_ip->sa);
 
                 rdst->remote_ip = *src_ip;
                 f->updated = jiffies;
diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index d13573bb879e..80456f72d70a 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h
@@ -62,6 +62,9 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg);
 
 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                   const struct net_device *dev, int strict);
+int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
+                            const struct net_device *dev, int strict,
+                            u32 banned_flags);
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
 int ipv6_chk_home_addr(struct net *net, const struct in6_addr *addr);
diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 8ae7c9edbd3c..4c9fe224d73b 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -671,8 +671,6 @@ static inline int ipv6_addr_diff(const struct in6_addr *a1, const struct in6_add
         return __ipv6_addr_diff(a1, a2, sizeof(struct in6_addr));
 }
 
-u32 __ipv6_select_ident(u32 hashrnd, struct in6_addr *dst,
-                        struct in6_addr *src);
 void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt);
 void ipv6_proxy_select_ident(struct sk_buff *skb);
 
diff --git a/net/bridge/br_fdb.c b/net/bridge/br_fdb.c
index 08bf04bdac58..e0670d7054f9 100644
--- a/net/bridge/br_fdb.c
+++ b/net/bridge/br_fdb.c
@@ -846,10 +846,9 @@ int br_fdb_add(struct ndmsg *ndm, struct nlattr *tb[],
                 /* VID was specified, so use it. */
                 err = __br_fdb_add(ndm, p, addr, nlh_flags, vid);
         } else {
-                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID)) {
-                        err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
+                err = __br_fdb_add(ndm, p, addr, nlh_flags, 0);
+                if (err || !pv)
                         goto out;
-                }
 
                 /* We have vlans configured on this port and user didn't
                  * specify a VLAN.  To be nice, add/update entry for every
@@ -917,16 +916,15 @@ int br_fdb_delete(struct ndmsg *ndm, struct nlattr *tb[],
 
                 err = __br_fdb_delete(p, addr, vid);
         } else {
-                if (!pv || bitmap_empty(pv->vlan_bitmap, VLAN_N_VID)) {
-                        err = __br_fdb_delete(p, addr, 0);
+                err = -ENOENT;
+                err &= __br_fdb_delete(p, addr, 0);
+                if (!pv)
                         goto out;
-                }
 
                 /* We have vlans configured on this port and user didn't
                  * specify a VLAN.  To be nice, add/update entry for every
                  * vlan on this port.
                  */
-                err = -ENOENT;
                 for_each_set_bit(vid, pv->vlan_bitmap, VLAN_N_VID) {
                         err &= __br_fdb_delete(p, addr, vid);
                 }
diff --git a/net/core/dev.c b/net/core/dev.c
index 8be38675e1a8..d030575532a2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -7129,11 +7129,11 @@ static int dev_cpu_callback(struct notifier_block *nfb,
 
         /* Process offline CPU's input_pkt_queue */
         while ((skb = __skb_dequeue(&oldsd->process_queue))) {
-                netif_rx_internal(skb);
+                netif_rx_ni(skb);
                 input_queue_head_incr(oldsd);
         }
         while ((skb = skb_dequeue(&oldsd->input_pkt_queue))) {
-                netif_rx_internal(skb);
+                netif_rx_ni(skb);
                 input_queue_head_incr(oldsd);
         }
 
diff --git a/net/core/flow.c b/net/core/flow.c
index a0348fde1fdf..1033725be40b 100644
--- a/net/core/flow.c
+++ b/net/core/flow.c
@@ -379,7 +379,7 @@ done:
 static void flow_cache_flush_task(struct work_struct *work)
 {
         struct netns_xfrm *xfrm = container_of(work, struct netns_xfrm,
-                                                flow_cache_gc_work);
+                                                flow_cache_flush_work);
         struct net *net = container_of(xfrm, struct net, xfrm);
 
         flow_cache_flush(net);
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index da934fc3faa8..9fa25b0ea145 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -2842,25 +2842,25 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
 
+        pktgen_finalize_skb(pkt_dev, skb, datalen);
+
         if (!(pkt_dev->flags & F_UDPCSUM)) {
                 skb->ip_summed = CHECKSUM_NONE;
         } else if (odev->features & NETIF_F_V4_CSUM) {
                 skb->ip_summed = CHECKSUM_PARTIAL;
                 skb->csum = 0;
-                udp4_hwcsum(skb, udph->source, udph->dest);
+                udp4_hwcsum(skb, iph->saddr, iph->daddr);
         } else {
-                __wsum csum = udp_csum(skb);
+                __wsum csum = skb_checksum(skb, skb_transport_offset(skb), datalen + 8, 0);
 
                 /* add protocol-dependent pseudo-header */
-                udph->check = csum_tcpudp_magic(udph->source, udph->dest,
+                udph->check = csum_tcpudp_magic(iph->saddr, iph->daddr,
                                                 datalen + 8, IPPROTO_UDP, csum);
 
                 if (udph->check == 0)
                         udph->check = CSUM_MANGLED_0;
         }
 
-        pktgen_finalize_skb(pkt_dev, skb, datalen);
-
 #ifdef CONFIG_XFRM
         if (!process_ipsec(pkt_dev, skb, protocol))
                 return NULL;
@@ -2976,6 +2976,8 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
         skb->dev = odev;
         skb->pkt_type = PACKET_HOST;
 
+        pktgen_finalize_skb(pkt_dev, skb, datalen);
+
         if (!(pkt_dev->flags & F_UDPCSUM)) {
                 skb->ip_summed = CHECKSUM_NONE;
         } else if (odev->features & NETIF_F_V6_CSUM) {
@@ -2984,7 +2986,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                 skb->csum_offset = offsetof(struct udphdr, check);
                 udph->check = ~csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, 0);
         } else {
-                __wsum csum = udp_csum(skb);
+                __wsum csum = skb_checksum(skb, skb_transport_offset(skb), udplen, 0);
 
                 /* add protocol-dependent pseudo-header */
                 udph->check = csum_ipv6_magic(&iph->saddr, &iph->daddr, udplen, IPPROTO_UDP, csum);
@@ -2993,8 +2995,6 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
                         udph->check = CSUM_MANGLED_0;
         }
 
-        pktgen_finalize_skb(pkt_dev, skb, datalen);
-
         return skb;
 }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 5dad4f782f03..5be499b6a2d2 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1263,18 +1263,12 @@ static const struct nla_policy ifla_vfinfo_policy[IFLA_VF_INFO_MAX+1] = {
 };
 
 static const struct nla_policy ifla_vf_policy[IFLA_VF_MAX+1] = {
-        [IFLA_VF_MAC]           = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_mac) },
-        [IFLA_VF_VLAN]          = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_vlan) },
-        [IFLA_VF_TX_RATE]       = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_tx_rate) },
-        [IFLA_VF_SPOOFCHK]      = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_spoofchk) },
-        [IFLA_VF_RATE]          = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_rate) },
-        [IFLA_VF_LINK_STATE]    = { .type = NLA_BINARY,
-                                    .len = sizeof(struct ifla_vf_link_state) },
+        [IFLA_VF_MAC]           = { .len = sizeof(struct ifla_vf_mac) },
+        [IFLA_VF_VLAN]          = { .len = sizeof(struct ifla_vf_vlan) },
+        [IFLA_VF_TX_RATE]       = { .len = sizeof(struct ifla_vf_tx_rate) },
+        [IFLA_VF_SPOOFCHK]      = { .len = sizeof(struct ifla_vf_spoofchk) },
+        [IFLA_VF_RATE]          = { .len = sizeof(struct ifla_vf_rate) },
+        [IFLA_VF_LINK_STATE]    = { .len = sizeof(struct ifla_vf_link_state) },
 };
 
 static const struct nla_policy ifla_port_policy[IFLA_PORT_MAX+1] = {
diff --git a/net/dsa/dsa.c b/net/dsa/dsa.c
index 37317149f918..2173402d87e0 100644
--- a/net/dsa/dsa.c
+++ b/net/dsa/dsa.c
@@ -603,7 +603,7 @@ static int dsa_of_probe(struct platform_device *pdev)
 
         pdev->dev.platform_data = pd;
         pd->netdev = &ethernet_dev->dev;
-        pd->nr_chips = of_get_child_count(np);
+        pd->nr_chips = of_get_available_child_count(np);
         if (pd->nr_chips > DSA_MAX_SWITCHES)
                 pd->nr_chips = DSA_MAX_SWITCHES;
 
diff --git a/net/dsa/slave.c b/net/dsa/slave.c
index 589aafd01fc5..d104ae15836f 100644
--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
@@ -676,18 +676,5 @@ dsa_slave_create(struct dsa_switch *ds, struct device *parent,
 
         netif_carrier_off(slave_dev);
 
-        if (p->phy != NULL) {
-                if (ds->drv->get_phy_flags)
-                        p->phy->dev_flags |= ds->drv->get_phy_flags(ds, port);
-
-                phy_attach(slave_dev, dev_name(&p->phy->dev),
-                           PHY_INTERFACE_MODE_GMII);
-
-                p->phy->autoneg = AUTONEG_ENABLE;
-                p->phy->speed = 0;
-                p->phy->duplex = 0;
-                p->phy->advertising = p->phy->supported | ADVERTISED_Autoneg;
-        }
-
         return slave_dev;
 }
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 815c85e3b1e0..53db2c309572 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -255,6 +255,9 @@ bool tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
         struct tcp_fastopen_cookie valid_foc = { .len = -1 };
         bool syn_data = TCP_SKB_CB(skb)->end_seq != TCP_SKB_CB(skb)->seq + 1;
 
+        if (foc->len == 0) /* Client requests a cookie */
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPFASTOPENCOOKIEREQD);
+
         if (!((sysctl_tcp_fastopen & TFO_SERVER_ENABLE) &&
               (syn_data || foc->len >= 0) &&
               tcp_fastopen_queue_check(sk))) {
@@ -265,7 +268,8 @@ bool tcp_try_fastopen(struct sock *sk, struct sk_buff *skb,
         if (syn_data && (sysctl_tcp_fastopen & TFO_SERVER_COOKIE_NOT_REQD))
                 goto fastopen;
 
-        if (tcp_fastopen_cookie_gen(req, skb, &valid_foc) &&
+        if (foc->len >= 0 &&  /* Client presents or requests a cookie */
+            tcp_fastopen_cookie_gen(req, skb, &valid_foc) &&
             foc->len == TCP_FASTOPEN_COOKIE_SIZE &&
             foc->len == valid_foc.len &&
             !memcmp(foc->val, valid_foc.val, foc->len)) {
@@ -284,11 +288,10 @@ fastopen:
                                          LINUX_MIB_TCPFASTOPENPASSIVE);
                         return true;
                 }
-        }
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVEFAIL);
+        } else if (foc->len > 0) /* Client presents an invalid cookie */
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPFASTOPENPASSIVEFAIL);
 
-        NET_INC_STATS_BH(sock_net(sk), foc->len ?
-                         LINUX_MIB_TCPFASTOPENPASSIVEFAIL :
-                         LINUX_MIB_TCPFASTOPENCOOKIEREQD);
         *foc = valid_foc;
         return false;
 }
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 8623118cb2bb..98e4a63d72bb 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1522,15 +1522,30 @@ static int ipv6_count_addresses(struct inet6_dev *idev)
 int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
                   const struct net_device *dev, int strict)
 {
+        return ipv6_chk_addr_and_flags(net, addr, dev, strict, IFA_F_TENTATIVE);
+}
+EXPORT_SYMBOL(ipv6_chk_addr);
+
+int ipv6_chk_addr_and_flags(struct net *net, const struct in6_addr *addr,
+                            const struct net_device *dev, int strict,
+                            u32 banned_flags)
+{
         struct inet6_ifaddr *ifp;
         unsigned int hash = inet6_addr_hash(addr);
+        u32 ifp_flags;
 
         rcu_read_lock_bh();
         hlist_for_each_entry_rcu(ifp, &inet6_addr_lst[hash], addr_lst) {
                 if (!net_eq(dev_net(ifp->idev->dev), net))
                         continue;
+                /* Decouple optimistic from tentative for evaluation here.
+                 * Ban optimistic addresses explicitly, when required.
+                 */
+                ifp_flags = (ifp->flags&IFA_F_OPTIMISTIC)
+                            ? (ifp->flags&~IFA_F_TENTATIVE)
+                            : ifp->flags;
                 if (ipv6_addr_equal(&ifp->addr, addr) &&
-                    !(ifp->flags&IFA_F_TENTATIVE) &&
+                    !(ifp_flags&banned_flags) &&
                     (dev == NULL || ifp->idev->dev == dev ||
                      !(ifp->scope&(IFA_LINK|IFA_HOST) || strict))) {
                         rcu_read_unlock_bh();
@@ -1541,7 +1556,7 @@ int ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
         rcu_read_unlock_bh();
         return 0;
 }
-EXPORT_SYMBOL(ipv6_chk_addr);
+EXPORT_SYMBOL(ipv6_chk_addr_and_flags);
 
 static bool ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
                                struct net_device *dev)
@@ -4579,6 +4594,22 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
         return 0;
 }
 
+static const struct nla_policy inet6_af_policy[IFLA_INET6_MAX + 1] = {
+        [IFLA_INET6_ADDR_GEN_MODE]      = { .type = NLA_U8 },
+        [IFLA_INET6_TOKEN]              = { .len = sizeof(struct in6_addr) },
+};
+
+static int inet6_validate_link_af(const struct net_device *dev,
+                                  const struct nlattr *nla)
+{
+        struct nlattr *tb[IFLA_INET6_MAX + 1];
+
+        if (dev && !__in6_dev_get(dev))
+                return -EAFNOSUPPORT;
+
+        return nla_parse_nested(tb, IFLA_INET6_MAX, nla, inet6_af_policy);
+}
+
 static int inet6_set_link_af(struct net_device *dev, const struct nlattr *nla)
 {
         int err = -EINVAL;
@@ -5409,6 +5440,7 @@ static struct rtnl_af_ops inet6_ops __read_mostly = {
         .family           = AF_INET6,
         .fill_link_af     = inet6_fill_link_af,
         .get_link_af_size = inet6_get_link_af_size,
+        .validate_link_af = inet6_validate_link_af,
         .set_link_af      = inet6_set_link_af,
 };
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 8a9d7c19e247..471ed24aabae 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -655,7 +655,9 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
         struct in6_addr *target = (struct in6_addr *)&neigh->primary_key;
         int probes = atomic_read(&neigh->probes);
 
-        if (skb && ipv6_chk_addr(dev_net(dev), &ipv6_hdr(skb)->saddr, dev, 1))
+        if (skb && ipv6_chk_addr_and_flags(dev_net(dev), &ipv6_hdr(skb)->saddr,
+                                           dev, 1,
+                                           IFA_F_TENTATIVE|IFA_F_OPTIMISTIC))
                 saddr = &ipv6_hdr(skb)->saddr;
         probes -= NEIGH_VAR(neigh->parms, UCAST_PROBES);
         if (probes < 0) {
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 54520a0bd5e3..74581f706c4d 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -9,7 +9,8 @@
 #include <net/addrconf.h>
 #include <net/secure_seq.h>
 
-u32 __ipv6_select_ident(u32 hashrnd, struct in6_addr *dst, struct in6_addr *src)
+static u32 __ipv6_select_ident(u32 hashrnd, struct in6_addr *dst,
+                               struct in6_addr *src)
 {
         u32 hash, id;
 
@@ -54,7 +55,7 @@ void ipv6_proxy_select_ident(struct sk_buff *skb)
 
         id = __ipv6_select_ident(ip6_proxy_idents_hashrnd,
                                  &addrs[1], &addrs[0]);
-        skb_shinfo(skb)->ip6_frag_id = id;
+        skb_shinfo(skb)->ip6_frag_id = htonl(id);
 }
 EXPORT_SYMBOL_GPL(ipv6_proxy_select_ident);