3 files changed, 33 insertions, 22 deletions

diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 7302b0b7b642..83acc1405a18 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -9,6 +9,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/ipv6.h>
+#include <net/ipv6.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
 #include <linux/netfilter_ipv6/ip6t_NPT.h>
@@ -18,11 +19,20 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
 {
         struct ip6t_npt_tginfo *npt = par->targinfo;
         __wsum src_sum = 0, dst_sum = 0;
+        struct in6_addr pfx;
         unsigned int i;
 
         if (npt->src_pfx_len > 64 || npt->dst_pfx_len > 64)
                 return -EINVAL;
 
+        /* Ensure that LSB of prefix is zero */
+        ipv6_addr_prefix(&pfx, &npt->src_pfx.in6, npt->src_pfx_len);
+        if (!ipv6_addr_equal(&pfx, &npt->src_pfx.in6))
+                return -EINVAL;
+        ipv6_addr_prefix(&pfx, &npt->dst_pfx.in6, npt->dst_pfx_len);
+        if (!ipv6_addr_equal(&pfx, &npt->dst_pfx.in6))
+                return -EINVAL;
+
         for (i = 0; i < ARRAY_SIZE(npt->src_pfx.in6.s6_addr16); i++) {
                 src_sum = csum_add(src_sum,
                                 (__force __wsum)npt->src_pfx.in6.s6_addr16[i]);
@@ -30,7 +40,7 @@ static int ip6t_npt_checkentry(const struct xt_tgchk_param *par)
                                 (__force __wsum)npt->dst_pfx.in6.s6_addr16[i]);
         }
 
-        npt->adjustment = (__force __sum16) csum_sub(src_sum, dst_sum);
+        npt->adjustment = ~csum_fold(csum_sub(src_sum, dst_sum));
         return 0;
 }
 
@@ -51,7 +61,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
 
                 idx = i / 32;
                 addr->s6_addr32[idx] &= mask;
-                addr->s6_addr32[idx] |= npt->dst_pfx.in6.s6_addr32[idx];
+                addr->s6_addr32[idx] |= ~mask & npt->dst_pfx.in6.s6_addr32[idx];
         }
 
         if (pfx_len <= 48)
@@ -66,8 +76,8 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
                         return false;
         }
 
-        sum = (__force __sum16) csum_add((__force __wsum)addr->s6_addr16[idx],
-                         npt->adjustment);
+        sum = ~csum_fold(csum_add(csum_unfold((__force __sum16)addr->s6_addr16[idx]),
+                                  csum_unfold(npt->adjustment)));
         if (sum == CSUM_MANGLED_0)
                 sum = 0;
         *(__force __sum16 *)&addr->s6_addr16[idx] = sum;
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 746048b13ef3..ae8ec6f27688 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -61,14 +61,27 @@ sctp_conn_schedule(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
         return 1;
 }
 
+static void sctp_nat_csum(struct sk_buff *skb, sctp_sctphdr_t *sctph,
+                          unsigned int sctphoff)
+{
+        __u32 crc32;
+        struct sk_buff *iter;
+
+        crc32 = sctp_start_cksum((__u8 *)sctph, skb_headlen(skb) - sctphoff);
+        skb_walk_frags(skb, iter)
+                crc32 = sctp_update_cksum((u8 *) iter->data,
+                                          skb_headlen(iter), crc32);
+        sctph->checksum = sctp_end_cksum(crc32);
+
+        skb->ip_summed = CHECKSUM_UNNECESSARY;
+}
+
 static int
 sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
                   struct ip_vs_conn *cp, struct ip_vs_iphdr *iph)
 {
         sctp_sctphdr_t *sctph;
         unsigned int sctphoff = iph->len;
-        struct sk_buff *iter;
-        __be32 crc32;
 
 #ifdef CONFIG_IP_VS_IPV6
         if (cp->af == AF_INET6 && iph->fragoffs)
@@ -92,13 +105,7 @@ sctp_snat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
         sctph = (void *) skb_network_header(skb) + sctphoff;
         sctph->source = cp->vport;
 
-        /* Calculate the checksum */
-        crc32 = sctp_start_cksum((u8 *) sctph, skb_headlen(skb) - sctphoff);
-        skb_walk_frags(skb, iter)
-                crc32 = sctp_update_cksum((u8 *) iter->data, skb_headlen(iter),
-                                          crc32);
-        crc32 = sctp_end_cksum(crc32);
-        sctph->checksum = crc32;
+        sctp_nat_csum(skb, sctph, sctphoff);
 
         return 1;
 }
@@ -109,8 +116,6 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
 {
         sctp_sctphdr_t *sctph;
         unsigned int sctphoff = iph->len;
-        struct sk_buff *iter;
-        __be32 crc32;
 
 #ifdef CONFIG_IP_VS_IPV6
         if (cp->af == AF_INET6 && iph->fragoffs)
@@ -134,13 +139,7 @@ sctp_dnat_handler(struct sk_buff *skb, struct ip_vs_protocol *pp,
         sctph = (void *) skb_network_header(skb) + sctphoff;
         sctph->dest = cp->dport;
 
-        /* Calculate the checksum */
-        crc32 = sctp_start_cksum((u8 *) sctph, skb_headlen(skb) - sctphoff);
-        skb_walk_frags(skb, iter)
-                crc32 = sctp_update_cksum((u8 *) iter->data, skb_headlen(iter),
-                                          crc32);
-        crc32 = sctp_end_cksum(crc32);
-        sctph->checksum = crc32;
+        sctp_nat_csum(skb, sctph, sctphoff);
 
         return 1;
 }
diff --git a/net/netfilter/ipvs/ip_vs_sync.c b/net/netfilter/ipvs/ip_vs_sync.c
index effa10c9e4e3..44fd10c539ac 100644
--- a/net/netfilter/ipvs/ip_vs_sync.c
+++ b/net/netfilter/ipvs/ip_vs_sync.c
@@ -1795,6 +1795,8 @@ int start_sync_thread(struct net *net, int state, char *mcast_ifn, __u8 syncid)
                                              GFP_KERNEL);
                         if (!tinfo->buf)
                                 goto outtinfo;
+                } else {
+                        tinfo->buf = NULL;
                 }
                 tinfo->id = id;