11 files changed, 103 insertions, 82 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e16f1bba5dff..7552663aa125 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -342,10 +342,9 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
         }
 #endif
 
-        if (netif_carrier_ok(dev))
+        if (netif_running(dev) && netif_carrier_ok(dev))
                 ndev->if_flags |= IF_READY;
 
-
         ipv6_mc_init_dev(ndev);
         ndev->tstamp = jiffies;
 #ifdef CONFIG_SYSCTL
@@ -808,7 +807,7 @@ struct ipv6_saddr_score {
 #define IPV6_SADDR_SCORE_LABEL          0x0020
 #define IPV6_SADDR_SCORE_PRIVACY        0x0040
 
-static int inline ipv6_saddr_preferred(int type)
+static inline int ipv6_saddr_preferred(int type)
 {
         if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|
                     IPV6_ADDR_LOOPBACK|IPV6_ADDR_RESERVED))
@@ -817,7 +816,7 @@ static int inline ipv6_saddr_preferred(int type)
 }
 
 /* static matching label */
-static int inline ipv6_saddr_label(const struct in6_addr *addr, int type)
+static inline int ipv6_saddr_label(const struct in6_addr *addr, int type)
 {
  /*
   *     prefix (longest match)  label
@@ -3322,7 +3321,7 @@ errout:
                 rtnl_set_sk_err(RTNLGRP_IPV6_IFADDR, err);
 }
 
-static void inline ipv6_store_devconf(struct ipv6_devconf *cnf,
+static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
                                 __s32 *array, int bytes)
 {
         BUG_ON(bytes < (DEVCONF_MAX * 4));
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 0862809ffcf7..ea3035b4e3e8 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -131,8 +131,6 @@ static int fib6_rule_match(struct fib_rule *rule, struct flowi *fl, int flags)
 
 static struct nla_policy fib6_rule_policy[FRA_MAX+1] __read_mostly = {
         FRA_GENERIC_POLICY,
-        [FRA_SRC]       = { .len = sizeof(struct in6_addr) },
-        [FRA_DST]       = { .len = sizeof(struct in6_addr) },
 };
 
 static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
@@ -142,9 +140,6 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
         int err = -EINVAL;
         struct fib6_rule *rule6 = (struct fib6_rule *) rule;
 
-        if (frh->src_len > 128 || frh->dst_len > 128)
-                goto errout;
-
         if (rule->action == FR_ACT_TO_TBL) {
                 if (rule->table == RT6_TABLE_UNSPEC)
                         goto errout;
@@ -155,11 +150,11 @@ static int fib6_rule_configure(struct fib_rule *rule, struct sk_buff *skb,
                 }
         }
 
-        if (tb[FRA_SRC])
+        if (frh->src_len)
                 nla_memcpy(&rule6->src.addr, tb[FRA_SRC],
                            sizeof(struct in6_addr));
 
-        if (tb[FRA_DST])
+        if (frh->dst_len)
                 nla_memcpy(&rule6->dst.addr, tb[FRA_DST],
                            sizeof(struct in6_addr));
 
@@ -186,11 +181,11 @@ static int fib6_rule_compare(struct fib_rule *rule, struct fib_rule_hdr *frh,
         if (frh->tos && (rule6->tclass != frh->tos))
                 return 0;
 
-        if (tb[FRA_SRC] &&
+        if (frh->src_len &&
             nla_memcmp(tb[FRA_SRC], &rule6->src.addr, sizeof(struct in6_addr)))
                 return 0;
 
-        if (tb[FRA_DST] &&
+        if (frh->dst_len &&
             nla_memcmp(tb[FRA_DST], &rule6->dst.addr, sizeof(struct in6_addr)))
                 return 0;
 
@@ -240,6 +235,7 @@ static size_t fib6_rule_nlmsg_payload(struct fib_rule *rule)
 static struct fib_rules_ops fib6_rules_ops = {
         .family                 = AF_INET6,
         .rule_size              = sizeof(struct fib6_rule),
+        .addr_size              = sizeof(struct in6_addr),
         .action                 = fib6_rule_action,
         .match                  = fib6_rule_match,
         .configure              = fib6_rule_configure,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index f4d7be77eb0f..268f476ef3db 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -658,6 +658,10 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
                 ins = &iter->u.dst.rt6_next;
         }
 
+        /* Reset round-robin state, if necessary */
+        if (ins == &fn->leaf)
+                fn->rr_ptr = NULL;
+
         /*
          *      insert node
          */
@@ -1109,6 +1113,10 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
         rt6_stats.fib_rt_entries--;
         rt6_stats.fib_discarded_routes++;
 
+        /* Reset round-robin state, if necessary */
+        if (fn->rr_ptr == rt)
+                fn->rr_ptr = NULL;
+
         /* Adjust walkers */
         read_lock(&fib6_walker_lock);
         FOR_WALKERS(w) {
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 11bfc7c43182..61e7a6c8141d 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -108,8 +108,10 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
 
         /* pkt_len may be zero if Jumbo payload option is present */
         if (pkt_len || hdr->nexthdr != NEXTHDR_HOP) {
-                if (pkt_len + sizeof(struct ipv6hdr) > skb->len)
-                        goto truncated;
+                if (pkt_len + sizeof(struct ipv6hdr) > skb->len) {
+                        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
+                        goto drop;
+                }
                 if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr))) {
                         IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
                         goto drop;
@@ -128,8 +130,6 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
         rcu_read_unlock();
 
         return NF_HOOK(PF_INET6,NF_IP6_PRE_ROUTING, skb, dev, NULL, ip6_rcv_finish);
-truncated:
-        IP6_INC_STATS_BH(idev, IPSTATS_MIB_INTRUNCATEDPKTS);
 err:
         IP6_INC_STATS_BH(idev, IPSTATS_MIB_INHDRERRORS);
 drop:
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 286c86735aed..f5f9582a8d39 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -413,7 +413,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 }
 
                 /* routing header option needs extra check */
-                if (optname == IPV6_RTHDR && opt->srcrt) {
+                if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                         struct ipv6_rt_hdr *rthdr = opt->srcrt;
                         switch (rthdr->type) {
                         case IPV6_SRCRT_TYPE_0:
@@ -795,12 +795,16 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
 EXPORT_SYMBOL(compat_ipv6_setsockopt);
 #endif
 
-static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
+static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
                                   char __user *optval, int len)
 {
-        if (!hdr)
+        struct ipv6_opt_hdr *hdr;
+
+        if (!opt || !opt->hopopt)
                 return 0;
-        len = min_t(int, len, ipv6_optlen(hdr));
+        hdr = opt->hopopt;
+
+        len = min_t(unsigned int, len, ipv6_optlen(hdr));
         if (copy_to_user(optval, hdr, ipv6_optlen(hdr)))
                 return -EFAULT;
         return len;
@@ -940,7 +944,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
         {
 
                 lock_sock(sk);
-                len = ipv6_getsockopt_sticky(sk, np->opt->hopopt,
+                len = ipv6_getsockopt_sticky(sk, np->opt,
                                              optval, len);
                 release_sock(sk);
                 return put_user(len, optlen);
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 6f19c4a49560..d1102455668d 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -257,6 +257,7 @@ static unsigned int ipv6_conntrack_in(unsigned int hooknum,
                 }
                 nf_conntrack_get(reasm->nfct);
                 (*pskb)->nfct = reasm->nfct;
+                (*pskb)->nfctinfo = reasm->nfctinfo;
                 return NF_ACCEPT;
         }
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 306d5d83c068..203e069e7fe9 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -687,9 +687,9 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int err;
 
         /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
          */
-        if (len < 0)
+        if (len > INT_MAX)
                 return -EMSGSIZE;
 
         /* Mirror BSD error message compatibility */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0e1f4b2cd3dd..ad9b285692ba 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -308,27 +308,18 @@ static inline void rt6_probe(struct rt6_info *rt)
 /*
  * Default Router Selection (RFC 2461 6.3.6)
  */
-static int inline rt6_check_dev(struct rt6_info *rt, int oif)
+static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 {
         struct net_device *dev = rt->rt6i_dev;
-        int ret = 0;
-
-        if (!oif)
-                return 2;
-        if (dev->flags & IFF_LOOPBACK) {
-                if (!WARN_ON(rt->rt6i_idev == NULL) &&
-                    rt->rt6i_idev->dev->ifindex == oif)
-                        ret = 1;
-                else
-                        return 0;
-        }
-        if (dev->ifindex == oif)
+        if (!oif || dev->ifindex == oif)
                 return 2;
-
-        return ret;
+        if ((dev->flags & IFF_LOOPBACK) &&
+            rt->rt6i_idev && rt->rt6i_idev->dev->ifindex == oif)
+                return 1;
+        return 0;
 }
 
-static int inline rt6_check_neigh(struct rt6_info *rt)
+static inline int rt6_check_neigh(struct rt6_info *rt)
 {
         struct neighbour *neigh = rt->rt6i_nexthop;
         int m = 0;
@@ -363,55 +354,76 @@ static int rt6_score_route(struct rt6_info *rt, int oif,
         return m;
 }
 
-static struct rt6_info *rt6_select(struct rt6_info **head, int oif,
-                                   int strict)
+static struct rt6_info *find_match(struct rt6_info *rt, int oif, int strict,
+                                   int *mpri, struct rt6_info *match)
+{
+        int m;
+
+        if (rt6_check_expired(rt))
+                goto out;
+
+        m = rt6_score_route(rt, oif, strict);
+        if (m < 0)
+                goto out;
+
+        if (m > *mpri) {
+                if (strict & RT6_LOOKUP_F_REACHABLE)
+                        rt6_probe(match);
+                *mpri = m;
+                match = rt;
+        } else if (strict & RT6_LOOKUP_F_REACHABLE) {
+                rt6_probe(rt);
+        }
+
+out:
+        return match;
+}
+
+static struct rt6_info *find_rr_leaf(struct fib6_node *fn,
+                                     struct rt6_info *rr_head,
+                                     u32 metric, int oif, int strict)
 {
-        struct rt6_info *match = NULL, *last = NULL;
-        struct rt6_info *rt, *rt0 = *head;
-        u32 metric;
+        struct rt6_info *rt, *match;
         int mpri = -1;
 
-        RT6_TRACE("%s(head=%p(*head=%p), oif=%d)\n",
-                  __FUNCTION__, head, head ? *head : NULL, oif);
+        match = NULL;
+        for (rt = rr_head; rt && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
+        for (rt = fn->leaf; rt && rt != rr_head && rt->rt6i_metric == metric;
+             rt = rt->u.dst.rt6_next)
+                match = find_match(rt, oif, strict, &mpri, match);
 
-        for (rt = rt0, metric = rt0->rt6i_metric;
-             rt && rt->rt6i_metric == metric && (!last || rt != rt0);
-             rt = rt->u.dst.rt6_next) {
-                int m;
+        return match;
+}
 
-                if (rt6_check_expired(rt))
-                        continue;
+static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
+{
+        struct rt6_info *match, *rt0;
 
-                last = rt;
+        RT6_TRACE("%s(fn->leaf=%p, oif=%d)\n",
+                  __FUNCTION__, fn->leaf, oif);
 
-                m = rt6_score_route(rt, oif, strict);
-                if (m < 0)
-                        continue;
+        rt0 = fn->rr_ptr;
+        if (!rt0)
+                fn->rr_ptr = rt0 = fn->leaf;
 
-                if (m > mpri) {
-                        if (strict & RT6_LOOKUP_F_REACHABLE)
-                                rt6_probe(match);
-                        match = rt;
-                        mpri = m;
-                } else if (strict & RT6_LOOKUP_F_REACHABLE) {
-                        rt6_probe(rt);
-                }
-        }
+        match = find_rr_leaf(fn, rt0, rt0->rt6i_metric, oif, strict);
 
         if (!match &&
-            (strict & RT6_LOOKUP_F_REACHABLE) &&
-            last && last != rt0) {
+            (strict & RT6_LOOKUP_F_REACHABLE)) {
+                struct rt6_info *next = rt0->u.dst.rt6_next;
+
                 /* no entries matched; do round-robin */
-                static DEFINE_SPINLOCK(lock);
-                spin_lock(&lock);
-                *head = rt0->u.dst.rt6_next;
-                rt0->u.dst.rt6_next = last->u.dst.rt6_next;
-                last->u.dst.rt6_next = rt0;
-                spin_unlock(&lock);
+                if (!next || next->rt6i_metric != rt0->rt6i_metric)
+                        next = fn->leaf;
+
+                if (next != rt0)
+                        fn->rr_ptr = next;
         }
 
-        RT6_TRACE("%s() => %p, score=%d\n",
-                  __FUNCTION__, match, mpri);
+        RT6_TRACE("%s() => %p\n",
+                  __FUNCTION__, match);
 
         return (match ? match : &ip6_null_entry);
 }
@@ -657,7 +669,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->iif, strict | reachable);
+        rt = rt6_select(fn, fl->iif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
@@ -752,7 +764,7 @@ restart_2:
         fn = fib6_lookup(&table->tb6_root, &fl->fl6_dst, &fl->fl6_src);
 
 restart:
-        rt = rt6_select(&fn->leaf, fl->oif, strict | reachable);
+        rt = rt6_select(fn, fl->oif, strict | reachable);
         BACKTRACK(&fl->fl6_src);
         if (rt == &ip6_null_entry ||
             rt->rt6i_flags & RTF_CACHE)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f57a9baa6b27..92f99927d12d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1453,6 +1453,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
            First: no IPv4 options.
          */
         newinet->opt = NULL;
+        newnp->ipv6_fl_list = NULL;
 
         /* Clone RX bits */
         newnp->rxopt.all = np->rxopt.all;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 0ad471909881..f590db57a7c9 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -615,7 +615,7 @@ do_udp_sendmsg:
                 return udp_sendmsg(iocb, sk, msg, len);
 
         /* Rough check on arithmetic overflow,
-           better check is made in ip6_build_xmit
+           better check is made in ip6_append_data().
            */
         if (len > INT_MAX - sizeof(struct udphdr))
                 return -EMSGSIZE;
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index ee4b84a33ff4..93c42232aa39 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -58,7 +58,7 @@ static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
 static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
 static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
 
-static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
+static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
         unsigned h;
 
@@ -70,7 +70,7 @@ static unsigned inline xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
         return h;
 }
 
-static unsigned inline xfrm6_tunnel_spi_hash_byspi(u32 spi)
+static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
 {
         return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }