24 files changed, 340 insertions, 264 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index fd6782e3a038..3daaf3c7703c 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -718,12 +718,9 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
         struct inet6_ifaddr *ifa, *ifn;
         struct inet6_dev *idev = ifp->idev;
         int state;
-        int hash;
         int deleted = 0, onlink = 0;
         unsigned long expires = jiffies;
 
-        hash = ipv6_addr_hash(&ifp->addr);
-
         spin_lock_bh(&ifp->state_lock);
         state = ifp->state;
         ifp->state = INET6_IFADDR_STATE_DEAD;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 978e80e2c4a8..a88b2e9d25f1 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -644,9 +644,8 @@ EXPORT_SYMBOL(inet6_unregister_protosw);
 
 int inet6_sk_rebuild_header(struct sock *sk)
 {
-        int err;
-        struct dst_entry *dst;
         struct ipv6_pinfo *np = inet6_sk(sk);
+        struct dst_entry *dst;
 
         dst = __sk_dst_check(sk, np->dst_cookie);
 
@@ -668,17 +667,11 @@ int inet6_sk_rebuild_header(struct sock *sk)
 
                 final_p = fl6_update_dst(&fl, np->opt, &final);
 
-                err = ip6_dst_lookup(sk, &dst, &fl);
-                if (err) {
+                dst = ip6_dst_lookup_flow(sk, &fl, final_p, false);
+                if (IS_ERR(dst)) {
                         sk->sk_route_caps = 0;
-                        return err;
-                }
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-                if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0) {
-                        sk->sk_err_soft = -err;
-                        return err;
+                        sk->sk_err_soft = -PTR_ERR(dst);
+                        return PTR_ERR(dst);
                 }
 
                 __ip6_dst_store(sk, dst, NULL, NULL);
@@ -772,7 +765,7 @@ out:
         return err;
 }
 
-static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, int features)
+static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, u32 features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         struct ipv6hdr *ipv6h;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 320bdb877eed..be3a781c0085 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -162,18 +162,11 @@ ipv4_connected:
         opt = flowlabel ? flowlabel->opt : np->opt;
         final_p = fl6_update_dst(&fl, opt, &final);
 
-        err = ip6_dst_lookup(sk, &dst, &fl);
-        if (err)
+        dst = ip6_dst_lookup_flow(sk, &fl, final_p, true);
+        err = 0;
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                 goto out;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto out;
         }
 
         /* source address lookup done in ip6_dst_lookup */
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 03e62f94ff8e..55665956b3a8 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -157,20 +157,20 @@ static int is_ineligible(struct sk_buff *skb)
 /*
  * Check the ICMP output rate limit
  */
-static inline int icmpv6_xrlim_allow(struct sock *sk, u8 type,
-                                     struct flowi *fl)
+static inline bool icmpv6_xrlim_allow(struct sock *sk, u8 type,
+                                      struct flowi *fl)
 {
         struct dst_entry *dst;
         struct net *net = sock_net(sk);
-        int res = 0;
+        bool res = false;
 
         /* Informational messages are not limited. */
         if (type & ICMPV6_INFOMSG_MASK)
-                return 1;
+                return true;
 
         /* Do not limit pmtu discovery, it would break it. */
         if (type == ICMPV6_PKT_TOOBIG)
-                return 1;
+                return true;
 
         /*
          * Look up the output route.
@@ -182,7 +182,7 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, u8 type,
                 IP6_INC_STATS(net, ip6_dst_idev(dst),
                               IPSTATS_MIB_OUTNOROUTES);
         } else if (dst->dev && (dst->dev->flags&IFF_LOOPBACK)) {
-                res = 1;
+                res = true;
         } else {
                 struct rt6_info *rt = (struct rt6_info *)dst;
                 int tmo = net->ipv6.sysctl.icmpv6_time;
@@ -191,7 +191,9 @@ static inline int icmpv6_xrlim_allow(struct sock *sk, u8 type,
                 if (rt->rt6i_dst.plen < 128)
                         tmo >>= ((128 - rt->rt6i_dst.plen)>>5);
 
-                res = xrlim_allow(dst, tmo);
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+                res = inet_peer_xrlim_allow(rt->rt6i_peer, tmo);
         }
         dst_release(dst);
         return res;
@@ -298,6 +300,68 @@ static void mip6_addr_swap(struct sk_buff *skb)
 static inline void mip6_addr_swap(struct sk_buff *skb) {}
 #endif
 
+static struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
+                                             struct sock *sk, struct flowi *fl)
+{
+        struct dst_entry *dst, *dst2;
+        struct flowi fl2;
+        int err;
+
+        err = ip6_dst_lookup(sk, &dst, fl);
+        if (err)
+                return ERR_PTR(err);
+
+        /*
+         * We won't send icmp if the destination is known
+         * anycast.
+         */
+        if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
+                LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: acast source\n");
+                dst_release(dst);
+                return ERR_PTR(-EINVAL);
+        }
+
+        /* No need to clone since we're just using its address. */
+        dst2 = dst;
+
+        dst = xfrm_lookup(net, dst, fl, sk, 0);
+        if (!IS_ERR(dst)) {
+                if (dst != dst2)
+                        return dst;
+        } else {
+                if (PTR_ERR(dst) == -EPERM)
+                        dst = NULL;
+                else
+                        return dst;
+        }
+
+        err = xfrm_decode_session_reverse(skb, &fl2, AF_INET6);
+        if (err)
+                goto relookup_failed;
+
+        err = ip6_dst_lookup(sk, &dst2, &fl2);
+        if (err)
+                goto relookup_failed;
+
+        dst2 = xfrm_lookup(net, dst2, &fl2, sk, XFRM_LOOKUP_ICMP);
+        if (!IS_ERR(dst2)) {
+                dst_release(dst);
+                dst = dst2;
+        } else {
+                err = PTR_ERR(dst2);
+                if (err == -EPERM) {
+                        dst_release(dst);
+                        return dst2;
+                } else
+                        goto relookup_failed;
+        }
+
+relookup_failed:
+        if (dst)
+                return dst;
+        return ERR_PTR(err);
+}
+
 /*
  *      Send an ICMP message in response to a packet in error
  */
@@ -310,10 +374,8 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         struct ipv6_pinfo *np;
         struct in6_addr *saddr = NULL;
         struct dst_entry *dst;
-        struct dst_entry *dst2;
         struct icmp6hdr tmp_hdr;
         struct flowi fl;
-        struct flowi fl2;
         struct icmpv6_msg msg;
         int iif = 0;
         int addr_type = 0;
@@ -406,57 +468,10 @@ void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
         if (!fl.oif && ipv6_addr_is_multicast(&fl.fl6_dst))
                 fl.oif = np->mcast_oif;
 
-        err = ip6_dst_lookup(sk, &dst, &fl);
-        if (err)
-                goto out;
-
-        /*
-         * We won't send icmp if the destination is known
-         * anycast.
-         */
-        if (((struct rt6_info *)dst)->rt6i_flags & RTF_ANYCAST) {
-                LIMIT_NETDEBUG(KERN_DEBUG "icmpv6_send: acast source\n");
-                goto out_dst_release;
-        }
-
-        /* No need to clone since we're just using its address. */
-        dst2 = dst;
-
-        err = xfrm_lookup(net, &dst, &fl, sk, 0);
-        switch (err) {
-        case 0:
-                if (dst != dst2)
-                        goto route_done;
-                break;
-        case -EPERM:
-                dst = NULL;
-                break;
-        default:
+        dst = icmpv6_route_lookup(net, skb, sk, &fl);
+        if (IS_ERR(dst))
                 goto out;
-        }
-
-        if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6))
-                goto relookup_failed;
-
-        if (ip6_dst_lookup(sk, &dst2, &fl2))
-                goto relookup_failed;
-
-        err = xfrm_lookup(net, &dst2, &fl2, sk, XFRM_LOOKUP_ICMP);
-        switch (err) {
-        case 0:
-                dst_release(dst);
-                dst = dst2;
-                break;
-        case -EPERM:
-                goto out_dst_release;
-        default:
-relookup_failed:
-                if (!dst)
-                        goto out;
-                break;
-        }
 
-route_done:
         if (ipv6_addr_is_multicast(&fl.fl6_dst))
                 hlimit = np->mcast_hops;
         else
@@ -543,7 +558,8 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         err = ip6_dst_lookup(sk, &dst, &fl);
         if (err)
                 goto out;
-        if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0)
+        dst = xfrm_lookup(net, dst, &fl, sk, 0);
+        if (IS_ERR(dst))
                 goto out;
 
         if (ipv6_addr_is_multicast(&fl.fl6_dst))
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index d144e629d2b4..d687e1397333 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -74,13 +74,8 @@ struct dst_entry *inet6_csk_route_req(struct sock *sk,
         fl.fl_ip_sport = inet_rsk(req)->loc_port;
         security_req_classify_flow(req, &fl);
 
-        if (ip6_dst_lookup(sk, &dst, &fl))
-                return NULL;
-
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-        if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
+        dst = ip6_dst_lookup_flow(sk, &fl, final_p, false);
+        if (IS_ERR(dst))
                 return NULL;
 
         return dst;
@@ -234,21 +229,13 @@ int inet6_csk_xmit(struct sk_buff *skb)
         dst = __inet6_csk_dst_check(sk, np->dst_cookie);
 
         if (dst == NULL) {
-                int err = ip6_dst_lookup(sk, &dst, &fl);
-
-                if (err) {
-                        sk->sk_err_soft = -err;
-                        kfree_skb(skb);
-                        return err;
-                }
-
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
+                dst = ip6_dst_lookup_flow(sk, &fl, final_p, false);
 
-                if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0) {
+                if (IS_ERR(dst)) {
+                        sk->sk_err_soft = -PTR_ERR(dst);
                         sk->sk_route_caps = 0;
                         kfree_skb(skb);
-                        return err;
+                        return PTR_ERR(dst);
                 }
 
                 __inet6_csk_dst_store(sk, dst, NULL, NULL);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 5f8d242be3f3..adaffaf84555 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -274,13 +274,10 @@ int ip6_nd_hdr(struct sock *sk, struct sk_buff *skb, struct net_device *dev,
 {
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct ipv6hdr *hdr;
-        int totlen;
 
         skb->protocol = htons(ETH_P_IPV6);
         skb->dev = dev;
 
-        totlen = len + sizeof(struct ipv6hdr);
-
         skb_reset_network_header(skb);
         skb_put(skb, sizeof(struct ipv6hdr));
         hdr = ipv6_hdr(skb);
@@ -479,10 +476,13 @@ int ip6_forward(struct sk_buff *skb)
                 else
                         target = &hdr->daddr;
 
+                if (!rt->rt6i_peer)
+                        rt6_bind_peer(rt, 1);
+
                 /* Limit redirects both by destination (here)
                    and by source (inside ndisc_send_redirect)
                  */
-                if (xrlim_allow(dst, 1*HZ))
+                if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
                         ndisc_send_redirect(skb, n, target);
         } else {
                 int addrtype = ipv6_addr_type(&hdr->saddr);
@@ -1002,29 +1002,71 @@ int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
 
 /**
- *      ip6_sk_dst_lookup - perform socket cached route lookup on flow
+ *      ip6_dst_lookup_flow - perform route lookup on flow with ipsec
+ *      @sk: socket which provides route info
+ *      @fl: flow to lookup
+ *      @final_dst: final destination address for ipsec lookup
+ *      @can_sleep: we are in a sleepable context
+ *
+ *      This function performs a route lookup on the given flow.
+ *
+ *      It returns a valid dst pointer on success, or a pointer encoded
+ *      error code.
+ */
+struct dst_entry *ip6_dst_lookup_flow(struct sock *sk, struct flowi *fl,
+                                      const struct in6_addr *final_dst,
+                                      bool can_sleep)
+{
+        struct dst_entry *dst = NULL;
+        int err;
+
+        err = ip6_dst_lookup_tail(sk, &dst, fl);
+        if (err)
+                return ERR_PTR(err);
+        if (final_dst)
+                ipv6_addr_copy(&fl->fl6_dst, final_dst);
+        if (can_sleep)
+                fl->flags |= FLOWI_FLAG_CAN_SLEEP;
+
+        return xfrm_lookup(sock_net(sk), dst, fl, sk, 0);
+}
+EXPORT_SYMBOL_GPL(ip6_dst_lookup_flow);
+
+/**
+ *      ip6_sk_dst_lookup_flow - perform socket cached route lookup on flow
  *      @sk: socket which provides the dst cache and route info
- *      @dst: pointer to dst_entry * for result
  *      @fl: flow to lookup
+ *      @final_dst: final destination address for ipsec lookup
+ *      @can_sleep: we are in a sleepable context
  *
  *      This function performs a route lookup on the given flow with the
  *      possibility of using the cached route in the socket if it is valid.
  *      It will take the socket dst lock when operating on the dst cache.
  *      As a result, this function can only be used in process context.
  *
- *      It returns zero on success, or a standard errno code on error.
+ *      It returns a valid dst pointer on success, or a pointer encoded
+ *      error code.
  */
-int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+struct dst_entry *ip6_sk_dst_lookup_flow(struct sock *sk, struct flowi *fl,
+                                         const struct in6_addr *final_dst,
+                                         bool can_sleep)
 {
-        *dst = NULL;
-        if (sk) {
-                *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
-                *dst = ip6_sk_dst_check(sk, *dst, fl);
-        }
+        struct dst_entry *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
+        int err;
 
-        return ip6_dst_lookup_tail(sk, dst, fl);
+        dst = ip6_sk_dst_check(sk, dst, fl);
+
+        err = ip6_dst_lookup_tail(sk, &dst, fl);
+        if (err)
+                return ERR_PTR(err);
+        if (final_dst)
+                ipv6_addr_copy(&fl->fl6_dst, final_dst);
+        if (can_sleep)
+                fl->flags |= FLOWI_FLAG_CAN_SLEEP;
+
+        return xfrm_lookup(sock_net(sk), dst, fl, sk, 0);
 }
-EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);
+EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup_flow);
 
 static inline int ip6_ufo_append_data(struct sock *sk,
                         int getfrag(void *from, char *to, int offset, int len,
@@ -1061,7 +1103,6 @@ static inline int ip6_ufo_append_data(struct sock *sk,
 
                 skb->ip_summed = CHECKSUM_PARTIAL;
                 skb->csum = 0;
-                sk->sk_sndmsg_off = 0;
         }
 
         err = skb_append_datato_frags(sk,skb, getfrag, from,
@@ -1118,6 +1159,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int err;
         int offset = 0;
         int csummode = CHECKSUM_NONE;
+        __u8 tx_flags = 0;
 
         if (flags&MSG_PROBE)
                 return 0;
@@ -1202,6 +1244,13 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 }
         }
 
+        /* For UDP, check if TX timestamp is enabled */
+        if (sk->sk_type == SOCK_DGRAM) {
+                err = sock_tx_timestamp(sk, &tx_flags);
+                if (err)
+                        goto error;
+        }
+
         /*
          * Let's try using as much space as possible.
          * Use MTU if total length of the message fits into the MTU.
@@ -1306,6 +1355,12 @@ alloc_new_skb:
                                                            sk->sk_allocation);
                                 if (unlikely(skb == NULL))
                                         err = -ENOBUFS;
+                                else {
+                                        /* Only the initial fragment
+                                         * is time stamped.
+                                         */
+                                        tx_flags = 0;
+                                }
                         }
                         if (skb == NULL)
                                 goto error;
@@ -1317,6 +1372,9 @@ alloc_new_skb:
                         /* reserve for fragmentation */
                         skb_reserve(skb, hh_len+sizeof(struct frag_hdr));
 
+                        if (sk->sk_type == SOCK_DGRAM)
+                                skb_shinfo(skb)->tx_flags = tx_flags;
+
                         /*
                          *      Find where to start putting bytes
                          */
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 4f4483e697bd..02730ef26b0f 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -581,7 +581,8 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         fl.fl4_dst = eiph->saddr;
         fl.fl4_tos = RT_TOS(eiph->tos);
         fl.proto = IPPROTO_IPIP;
-        if (ip_route_output_key(dev_net(skb->dev), &rt, &fl))
+        rt = ip_route_output_key(dev_net(skb->dev), &fl);
+        if (IS_ERR(rt))
                 goto out;
 
         skb2->dev = rt->dst.dev;
@@ -593,12 +594,14 @@ ip4ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 fl.fl4_dst = eiph->daddr;
                 fl.fl4_src = eiph->saddr;
                 fl.fl4_tos = eiph->tos;
-                if (ip_route_output_key(dev_net(skb->dev), &rt, &fl) ||
+                rt = ip_route_output_key(dev_net(skb->dev), &fl);
+                if (IS_ERR(rt) ||
                     rt->dst.dev->type != ARPHRD_TUNNEL) {
-                        ip_rt_put(rt);
+                        if (!IS_ERR(rt))
+                                ip_rt_put(rt);
                         goto out;
                 }
-                skb_dst_set(skb2, (struct dst_entry *)rt);
+                skb_dst_set(skb2, &rt->dst);
         } else {
                 ip_rt_put(rt);
                 if (ip_route_input(skb2, eiph->daddr, eiph->saddr, eiph->tos,
@@ -903,8 +906,14 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         else {
                 dst = ip6_route_output(net, NULL, fl);
 
-                if (dst->error || xfrm_lookup(net, &dst, fl, NULL, 0) < 0)
+                if (dst->error)
                         goto tx_err_link_failure;
+                dst = xfrm_lookup(net, dst, fl, NULL, 0);
+                if (IS_ERR(dst)) {
+                        err = PTR_ERR(dst);
+                        dst = NULL;
+                        goto tx_err_link_failure;
+                }
         }
 
         tdev = dst->dev;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 0e1d53bcf1e0..618f67ccda31 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1039,7 +1039,6 @@ static void ip6mr_cache_resolve(struct net *net, struct mr6_table *mrt,
 
         while((skb = __skb_dequeue(&uc->mfc_un.unres.unresolved))) {
                 if (ipv6_hdr(skb)->version == 0) {
-                        int err;
                         struct nlmsghdr *nlh = (struct nlmsghdr *)skb_pull(skb, sizeof(struct ipv6hdr));
 
                         if (__ip6mr_fill_mroute(mrt, skb, c, NLMSG_DATA(nlh)) > 0) {
@@ -1050,7 +1049,7 @@ static void ip6mr_cache_resolve(struct net *net, struct mr6_table *mrt,
                                 skb_trim(skb, nlh->nlmsg_len);
                                 ((struct nlmsgerr *)NLMSG_DATA(nlh))->error = -EMSGSIZE;
                         }
-                        err = rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
+                        rtnl_unicast(skb, net, NETLINK_CB(skb).pid);
                 } else
                         ip6_mr_forward(net, mrt, skb, c);
         }
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 49f986d626a0..7b27d08ee281 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1429,7 +1429,12 @@ static void mld_sendpack(struct sk_buff *skb)
                          &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
                          skb->dev->ifindex);
 
-        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
+        dst = xfrm_lookup(net, dst, &fl, NULL, 0);
+        err = 0;
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                dst = NULL;
+        }
         skb_dst_set(skb, dst);
         if (err)
                 goto err_out;
@@ -1796,9 +1801,11 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                          &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
                          skb->dev->ifindex);
 
-        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
-        if (err)
+        dst = xfrm_lookup(net, dst, &fl, NULL, 0);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                 goto err_out;
+        }
 
         skb_dst_set(skb, dst);
         err = NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL, skb->dev,
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index d6e9599d0705..f3e3ca938a54 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -203,7 +203,8 @@ static inline int mip6_report_rl_allow(struct timeval *stamp,
         return allow;
 }
 
-static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, struct flowi *fl)
+static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb,
+                               const struct flowi *fl)
 {
         struct net *net = xs_net(x);
         struct inet6_skb_parm *opt = (struct inet6_skb_parm *)skb->cb;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 2342545a5ee9..9360d3be94f0 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -529,8 +529,8 @@ void ndisc_send_skb(struct sk_buff *skb,
                 return;
         }
 
-        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
-        if (err < 0) {
+        dst = xfrm_lookup(net, dst, &fl, NULL, 0);
+        if (IS_ERR(dst)) {
                 kfree_skb(skb);
                 return;
         }
@@ -1542,8 +1542,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         if (dst == NULL)
                 return;
 
-        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
-        if (err)
+        dst = xfrm_lookup(net, dst, &fl, NULL, 0);
+        if (IS_ERR(dst))
                 return;
 
         rt = (struct rt6_info *) dst;
@@ -1553,7 +1553,9 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                            "ICMPv6 Redirect: destination is not a neighbour.\n");
                 goto release;
         }
-        if (!xrlim_allow(dst, 1*HZ))
+        if (!rt->rt6i_peer)
+                rt6_bind_peer(rt, 1);
+        if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
                 goto release;
 
         if (dev->addr_len) {
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 35915e8617f0..8d74116ae27d 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -39,7 +39,8 @@ int ip6_route_me_harder(struct sk_buff *skb)
         if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
             xfrm_decode_session(skb, &fl, AF_INET6) == 0) {
                 skb_dst_set(skb, NULL);
-                if (xfrm_lookup(net, &dst, &fl, skb->sk, 0))
+                dst = xfrm_lookup(net, dst, &fl, skb->sk, 0);
+                if (IS_ERR(dst))
                         return -1;
                 skb_dst_set(skb, dst);
         }
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 7d227c644f72..47b7b8df7fac 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1076,6 +1076,7 @@ static int compat_table_info(const struct xt_table_info *info,
         memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
         newinfo->initial_entries = 0;
         loc_cpu_entry = info->entries[raw_smp_processor_id()];
+        xt_compat_init_offsets(AF_INET6, info->number);
         xt_entry_foreach(iter, loc_cpu_entry, info->size) {
                 ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
                 if (ret != 0)
@@ -1679,6 +1680,7 @@ translate_compat_table(struct net *net,
         duprintf("translate_compat_table: size %u\n", info->size);
         j = 0;
         xt_compat_lock(AF_INET6);
+        xt_compat_init_offsets(AF_INET6, number);
         /* Walk through entries, checking offsets. */
         xt_entry_foreach(iter0, entry0, total_size) {
                 ret = check_compat_entry_size_and_hooks(iter0, info, &size,
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index de338037a736..e6af8d72f26b 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -452,8 +452,7 @@ ip6t_log_packet(u_int8_t pf,
                in ? in->name : "",
                out ? out->name : "");
 
-        /* MAC logging for input path only. */
-        if (in && !out)
+        if (in != NULL)
                 dump_mac_header(m, loginfo, skb);
 
         dump_packet(m, loginfo, skb, skb_network_offset(skb), 1);
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index bf998feac14e..91f6a61cefab 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -101,7 +101,8 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
                 dst_release(dst);
                 return;
         }
-        if (xfrm_lookup(net, &dst, &fl, NULL, 0))
+        dst = xfrm_lookup(net, dst, &fl, NULL, 0);
+        if (IS_ERR(dst))
                 return;
 
         hh_len = (dst->dev->hard_header_len + 15)&~15;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 79d43aa8fa8d..085727263812 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -45,6 +45,7 @@
 #include <linux/netfilter_ipv6.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
+#include <net/netfilter/ipv6/nf_defrag_ipv6.h>
 
 
 struct nf_ct_frag6_skb_cb
@@ -73,7 +74,7 @@ static struct inet_frags nf_frags;
 static struct netns_frags nf_init_frags;
 
 #ifdef CONFIG_SYSCTL
-struct ctl_table nf_ct_frag6_sysctl_table[] = {
+static struct ctl_table nf_ct_frag6_sysctl_table[] = {
         {
                 .procname       = "nf_conntrack_frag6_timeout",
                 .data           = &nf_init_frags.timeout,
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index c5b0915d106b..dc29b07caf42 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -124,18 +124,18 @@ static __inline__ int icmpv6_filter(struct sock *sk, struct sk_buff *skb)
 }
 
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-static int (*mh_filter)(struct sock *sock, struct sk_buff *skb);
+typedef int mh_filter_t(struct sock *sock, struct sk_buff *skb);
 
-int rawv6_mh_filter_register(int (*filter)(struct sock *sock,
-                                           struct sk_buff *skb))
+static mh_filter_t __rcu *mh_filter __read_mostly;
+
+int rawv6_mh_filter_register(mh_filter_t filter)
 {
         rcu_assign_pointer(mh_filter, filter);
         return 0;
 }
 EXPORT_SYMBOL(rawv6_mh_filter_register);
 
-int rawv6_mh_filter_unregister(int (*filter)(struct sock *sock,
-                                             struct sk_buff *skb))
+int rawv6_mh_filter_unregister(mh_filter_t filter)
 {
         rcu_assign_pointer(mh_filter, NULL);
         synchronize_rcu();
@@ -193,10 +193,10 @@ static int ipv6_raw_deliver(struct sk_buff *skb, int nexthdr)
                          * policy is placed in rawv6_rcv() because it is
                          * required for each socket.
                          */
-                        int (*filter)(struct sock *sock, struct sk_buff *skb);
+                        mh_filter_t *filter;
 
                         filter = rcu_dereference(mh_filter);
-                        filtered = filter ? filter(sk, skb) : 0;
+                        filtered = filter ? (*filter)(sk, skb) : 0;
                         break;
                 }
 #endif
@@ -856,20 +856,11 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 fl.oif = np->mcast_oif;
         security_sk_classify_flow(sk, &fl);
 
-        err = ip6_dst_lookup(sk, &dst, &fl);
-        if (err)
+        dst = ip6_dst_lookup_flow(sk, &fl, final_p, true);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                 goto out;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto out;
         }
-
         if (hlimit < 0) {
                 if (ipv6_addr_is_multicast(&fl.fl6_dst))
                         hlimit = np->mcast_hops;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 904312e25a3c..d55d00c2a824 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -97,6 +97,36 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
                                            struct in6_addr *gwaddr, int ifindex);
 #endif
 
+static u32 *ipv6_cow_metrics(struct dst_entry *dst, unsigned long old)
+{
+        struct rt6_info *rt = (struct rt6_info *) dst;
+        struct inet_peer *peer;
+        u32 *p = NULL;
+
+        if (!rt->rt6i_peer)
+                rt6_bind_peer(rt, 1);
+
+        peer = rt->rt6i_peer;
+        if (peer) {
+                u32 *old_p = __DST_METRICS_PTR(old);
+                unsigned long prev, new;
+
+                p = peer->metrics;
+                if (inet_metrics_new(peer))
+                        memcpy(p, old_p, sizeof(u32) * RTAX_MAX);
+
+                new = (unsigned long) p;
+                prev = cmpxchg(&dst->_metrics, old, new);
+
+                if (prev != old) {
+                        p = __DST_METRICS_PTR(prev);
+                        if (prev & DST_METRICS_READ_ONLY)
+                                p = NULL;
+                }
+        }
+        return p;
+}
+
 static struct dst_ops ip6_dst_ops_template = {
         .family                 =       AF_INET6,
         .protocol               =       cpu_to_be16(ETH_P_IPV6),
@@ -105,6 +135,7 @@ static struct dst_ops ip6_dst_ops_template = {
         .check                  =       ip6_dst_check,
         .default_advmss         =       ip6_default_advmss,
         .default_mtu            =       ip6_default_mtu,
+        .cow_metrics            =       ipv6_cow_metrics,
         .destroy                =       ip6_dst_destroy,
         .ifdown                 =       ip6_dst_ifdown,
         .negative_advice        =       ip6_negative_advice,
@@ -132,6 +163,10 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
 };
 
+static const u32 ip6_template_metrics[RTAX_MAX] = {
+        [RTAX_HOPLIMIT - 1] = 255,
+};
+
 static struct rt6_info ip6_null_entry_template = {
         .dst = {
                 .__refcnt       = ATOMIC_INIT(1),
@@ -187,7 +222,7 @@ static struct rt6_info ip6_blk_hole_entry_template = {
 /* allocate dst with ip6_dst_ops */
 static inline struct rt6_info *ip6_dst_alloc(struct dst_ops *ops)
 {
-        return (struct rt6_info *)dst_alloc(ops);
+        return (struct rt6_info *)dst_alloc(ops, 0);
 }
 
 static void ip6_dst_destroy(struct dst_entry *dst)
@@ -206,6 +241,13 @@ static void ip6_dst_destroy(struct dst_entry *dst)
         }
 }
 
+static atomic_t __rt6_peer_genid = ATOMIC_INIT(0);
+
+static u32 rt6_peer_genid(void)
+{
+        return atomic_read(&__rt6_peer_genid);
+}
+
 void rt6_bind_peer(struct rt6_info *rt, int create)
 {
         struct inet_peer *peer;
@@ -213,6 +255,8 @@ void rt6_bind_peer(struct rt6_info *rt, int create)
         peer = inet_getpeer_v6(&rt->rt6i_dst.addr, create);
         if (peer && cmpxchg(&rt->rt6i_peer, NULL, peer) != NULL)
                 inet_putpeer(peer);
+        else
+                rt->rt6i_peer_genid = rt6_peer_genid();
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
@@ -826,17 +870,15 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 
 EXPORT_SYMBOL(ip6_route_output);
 
-int ip6_dst_blackhole(struct sock *sk, struct dst_entry **dstp, struct flowi *fl)
+struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_orig)
 {
-        struct rt6_info *ort = (struct rt6_info *) *dstp;
-        struct rt6_info *rt = (struct rt6_info *)
-                dst_alloc(&ip6_dst_blackhole_ops);
+        struct rt6_info *rt = dst_alloc(&ip6_dst_blackhole_ops, 1);
+        struct rt6_info *ort = (struct rt6_info *) dst_orig;
         struct dst_entry *new = NULL;
 
         if (rt) {
                 new = &rt->dst;
 
-                atomic_set(&new->__refcnt, 1);
                 new->__use = 1;
                 new->input = dst_discard;
                 new->output = dst_discard;
@@ -862,11 +904,9 @@ int ip6_dst_blackhole(struct sock *sk, struct dst_entry **dstp, struct flowi *fl
                 dst_free(new);
         }
 
-        dst_release(*dstp);
-        *dstp = new;
-        return new ? 0 : -ENOMEM;
+        dst_release(dst_orig);
+        return new ? new : ERR_PTR(-ENOMEM);
 }
-EXPORT_SYMBOL_GPL(ip6_dst_blackhole);
 
 /*
  *      Destination cache support functions
@@ -878,9 +918,14 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
-        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie)) {
+                if (rt->rt6i_peer_genid != rt6_peer_genid()) {
+                        if (!rt->rt6i_peer)
+                                rt6_bind_peer(rt, 0);
+                        rt->rt6i_peer_genid = rt6_peer_genid();
+                }
                 return dst;
-
+        }
         return NULL;
 }
 
@@ -931,7 +976,6 @@ static void ip6_rt_update_pmtu(struct dst_entry *dst, u32 mtu)
                         dst_metric_set(dst, RTAX_FEATURES, features);
                 }
                 dst_metric_set(dst, RTAX_MTU, mtu);
-                call_netevent_notifiers(NETEVENT_PMTU_UPDATE, dst);
         }
 }
 
@@ -1028,11 +1072,9 @@ out:
 
 int icmp6_dst_gc(void)
 {
-        struct dst_entry *dst, *next, **pprev;
+        struct dst_entry *dst, **pprev;
         int more = 0;
 
-        next = NULL;
-
         spin_lock_bh(&icmp6_dst_lock);
         pprev = &icmp6_dst_gc_list;
 
@@ -1980,12 +2022,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         if (IS_ERR(neigh)) {
                 dst_free(&rt->dst);
 
-                /* We are casting this because that is the return
-                 * value type.  But an errno encoded pointer is the
-                 * same regardless of the underlying pointer type,
-                 * and that's what we are returning.  So this is OK.
-                 */
-                return (struct rt6_info *) neigh;
+                return ERR_CAST(neigh);
         }
         rt->rt6i_nexthop = neigh;
 
@@ -2687,7 +2724,8 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.ip6_null_entry->dst.path =
                 (struct dst_entry *)net->ipv6.ip6_null_entry;
         net->ipv6.ip6_null_entry->dst.ops = &net->ipv6.ip6_dst_ops;
-        dst_metric_set(&net->ipv6.ip6_null_entry->dst, RTAX_HOPLIMIT, 255);
+        dst_init_metrics(&net->ipv6.ip6_null_entry->dst,
+                         ip6_template_metrics, true);
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         net->ipv6.ip6_prohibit_entry = kmemdup(&ip6_prohibit_entry_template,
@@ -2698,7 +2736,8 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.ip6_prohibit_entry->dst.path =
                 (struct dst_entry *)net->ipv6.ip6_prohibit_entry;
         net->ipv6.ip6_prohibit_entry->dst.ops = &net->ipv6.ip6_dst_ops;
-        dst_metric_set(&net->ipv6.ip6_prohibit_entry->dst, RTAX_HOPLIMIT, 255);
+        dst_init_metrics(&net->ipv6.ip6_prohibit_entry->dst,
+                         ip6_template_metrics, true);
 
         net->ipv6.ip6_blk_hole_entry = kmemdup(&ip6_blk_hole_entry_template,
                                                sizeof(*net->ipv6.ip6_blk_hole_entry),
@@ -2708,7 +2747,8 @@ static int __net_init ip6_route_net_init(struct net *net)
         net->ipv6.ip6_blk_hole_entry->dst.path =
                 (struct dst_entry *)net->ipv6.ip6_blk_hole_entry;
         net->ipv6.ip6_blk_hole_entry->dst.ops = &net->ipv6.ip6_dst_ops;
-        dst_metric_set(&net->ipv6.ip6_blk_hole_entry->dst, RTAX_HOPLIMIT, 255);
+        dst_init_metrics(&net->ipv6.ip6_blk_hole_entry->dst,
+                         ip6_template_metrics, true);
 #endif
 
         net->ipv6.sysctl.flush_delay = 0;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 8ce38f10a547..b8c8adbd7cf6 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -412,7 +412,7 @@ static void prl_list_destroy_rcu(struct rcu_head *head)
 
         p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
         do {
-                n = p->next;
+                n = rcu_dereference_protected(p->next, 1);
                 kfree(p);
                 p = n;
         } while (p);
@@ -421,15 +421,17 @@ static void prl_list_destroy_rcu(struct rcu_head *head)
 static int
 ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 {
-        struct ip_tunnel_prl_entry *x, **p;
+        struct ip_tunnel_prl_entry *x;
+        struct ip_tunnel_prl_entry __rcu **p;
         int err = 0;
 
         ASSERT_RTNL();
 
         if (a && a->addr != htonl(INADDR_ANY)) {
-                for (p = &t->prl; *p; p = &(*p)->next) {
-                        if ((*p)->addr == a->addr) {
-                                x = *p;
+                for (p = &t->prl;
+                     (x = rtnl_dereference(*p)) != NULL;
+                     p = &x->next) {
+                        if (x->addr == a->addr) {
                                 *p = x->next;
                                 call_rcu(&x->rcu_head, prl_entry_destroy_rcu);
                                 t->prl_count--;
@@ -438,9 +440,9 @@ ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
                 }
                 err = -ENXIO;
         } else {
-                if (t->prl) {
+                x = rtnl_dereference(t->prl);
+                if (x) {
                         t->prl_count = 0;
-                        x = t->prl;
                         call_rcu(&x->rcu_head, prl_list_destroy_rcu);
                         t->prl = NULL;
                 }
@@ -736,7 +738,8 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                     .fl4_tos = RT_TOS(tos),
                                     .oif = tunnel->parms.link,
                                     .proto = IPPROTO_IPV6 };
-                if (ip_route_output_key(dev_net(dev), &rt, &fl)) {
+                rt = ip_route_output_key(dev_net(dev), &fl);
+                if (IS_ERR(rt)) {
                         dev->stats.tx_carrier_errors++;
                         goto tx_error_icmp;
                 }
@@ -860,8 +863,9 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
                                     .fl4_tos = RT_TOS(iph->tos),
                                     .oif = tunnel->parms.link,
                                     .proto = IPPROTO_IPV6 };
-                struct rtable *rt;
-                if (!ip_route_output_key(dev_net(dev), &rt, &fl)) {
+                struct rtable *rt = ip_route_output_key(dev_net(dev), &fl);
+
+                if (!IS_ERR(rt)) {
                         tdev = rt->dst.dev;
                         ip_rt_put(rt);
                 }
@@ -1179,7 +1183,7 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         if (!dev->tstats)
                 return -ENOMEM;
         dev_hold(dev);
-        sitn->tunnels_wc[0]     = tunnel;
+        rcu_assign_pointer(sitn->tunnels_wc[0], tunnel);
         return 0;
 }
 
@@ -1196,11 +1200,12 @@ static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_hea
         for (prio = 1; prio < 4; prio++) {
                 int h;
                 for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t = sitn->tunnels[prio][h];
+                        struct ip_tunnel *t;
 
+                        t = rtnl_dereference(sitn->tunnels[prio][h]);
                         while (t != NULL) {
                                 unregister_netdevice_queue(t->dev, head);
-                                t = t->next;
+                                t = rtnl_dereference(t->next);
                         }
                 }
         }
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 09fd34f0dbf2..0b4cf350631b 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -243,12 +243,9 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_sk(sk)->inet_sport;
                 security_req_classify_flow(req, &fl);
-                if (ip6_dst_lookup(sk, &dst, &fl))
-                        goto out_free;
 
-                if (final_p)
-                        ipv6_addr_copy(&fl.fl6_dst, final_p);
-                if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
+                dst = ip6_dst_lookup_flow(sk, &fl, final_p, false);
+                if (IS_ERR(dst))
                         goto out_free;
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 20aa95e37359..e59a31c48baf 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -255,18 +255,10 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 
         security_sk_classify_flow(sk, &fl);
 
-        err = ip6_dst_lookup(sk, &dst, &fl);
-        if (err)
+        dst = ip6_dst_lookup_flow(sk, &fl, final_p, true);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                 goto failure;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto failure;
         }
 
         if (saddr == NULL) {
@@ -385,7 +377,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         np = inet6_sk(sk);
 
         if (type == ICMPV6_PKT_TOOBIG) {
-                struct dst_entry *dst = NULL;
+                struct dst_entry *dst;
 
                 if (sock_owned_by_user(sk))
                         goto out;
@@ -413,13 +405,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                         fl.fl_ip_sport = inet->inet_sport;
                         security_skb_classify_flow(skb, &fl);
 
-                        if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
-                                sk->sk_err_soft = -err;
-                                goto out;
-                        }
-
-                        if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
-                                sk->sk_err_soft = -err;
+                        dst = ip6_dst_lookup_flow(sk, &fl, NULL, false);
+                        if (IS_ERR(dst)) {
+                                sk->sk_err_soft = -PTR_ERR(dst);
                                 goto out;
                         }
 
@@ -496,7 +484,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         struct in6_addr * final_p, final;
         struct flowi fl;
         struct dst_entry *dst;
-        int err = -1;
+        int err;
 
         memset(&fl, 0, sizeof(fl));
         fl.proto = IPPROTO_TCP;
@@ -512,15 +500,13 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         opt = np->opt;
         final_p = fl6_update_dst(&fl, opt, &final);
 
-        err = ip6_dst_lookup(sk, &dst, &fl);
-        if (err)
+        dst = ip6_dst_lookup_flow(sk, &fl, final_p, false);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
                 goto done;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-        if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
-                goto done;
-
+        }
         skb = tcp_make_synack(sk, dst, req, rvp);
+        err = -ENOMEM;
         if (skb) {
                 __tcp_v6_send_check(skb, &treq->loc_addr, &treq->rmt_addr);
 
@@ -1079,15 +1065,14 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
          * Underlying function will use this to retrieve the network
          * namespace
          */
-        if (!ip6_dst_lookup(ctl_sk, &dst, &fl)) {
-                if (xfrm_lookup(net, &dst, &fl, NULL, 0) >= 0) {
-                        skb_dst_set(buff, dst);
-                        ip6_xmit(ctl_sk, buff, &fl, NULL);
-                        TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
-                        if (rst)
-                                TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
-                        return;
-                }
+        dst = ip6_dst_lookup_flow(ctl_sk, &fl, NULL, false);
+        if (!IS_ERR(dst)) {
+                skb_dst_set(buff, dst);
+                ip6_xmit(ctl_sk, buff, &fl, NULL);
+                TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
+                if (rst)
+                        TCP_INC_STATS_BH(net, TCP_MIB_OUTRSTS);
+                return;
         }
 
         kfree_skb(buff);
@@ -1323,7 +1308,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                     tcp_death_row.sysctl_tw_recycle &&
                     (dst = inet6_csk_route_req(sk, req)) != NULL &&
                     (peer = rt6_get_peer((struct rt6_info *)dst)) != NULL &&
-                    ipv6_addr_equal((struct in6_addr *)peer->daddr.a6,
+                    ipv6_addr_equal((struct in6_addr *)peer->daddr.addr.a6,
                                     &treq->rmt_addr)) {
                         inet_peer_refcheck(peer);
                         if ((u32)get_seconds() - peer->tcp_ts_stamp < TCP_PAWS_MSL &&
@@ -1636,10 +1621,8 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 opt_skb = skb_clone(skb, GFP_ATOMIC);
 
         if (sk->sk_state == TCP_ESTABLISHED) { /* Fast path */
-                TCP_CHECK_TIMER(sk);
                 if (tcp_rcv_established(sk, skb, tcp_hdr(skb), skb->len))
                         goto reset;
-                TCP_CHECK_TIMER(sk);
                 if (opt_skb)
                         goto ipv6_pktoptions;
                 return 0;
@@ -1667,10 +1650,8 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
                 }
         }
 
-        TCP_CHECK_TIMER(sk);
         if (tcp_rcv_state_process(sk, skb, tcp_hdr(skb), skb->len))
                 goto reset;
-        TCP_CHECK_TIMER(sk);
         if (opt_skb)
                 goto ipv6_pktoptions;
         return 0;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 9a009c66c8a3..d86d7f67a597 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1125,18 +1125,11 @@ do_udp_sendmsg:
 
         security_sk_classify_flow(sk, &fl);
 
-        err = ip6_sk_dst_lookup(sk, &dst, &fl);
-        if (err)
+        dst = ip6_sk_dst_lookup_flow(sk, &fl, final_p, true);
+        if (IS_ERR(dst)) {
+                err = PTR_ERR(dst);
+                dst = NULL;
                 goto out;
-        if (final_p)
-                ipv6_addr_copy(&fl.fl6_dst, final_p);
-
-        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
-        if (err < 0) {
-                if (err == -EREMOTE)
-                        err = ip6_dst_blackhole(sk, &dst, &fl);
-                if (err < 0)
-                        goto out;
         }
 
         if (hlimit < 0) {
@@ -1299,7 +1292,7 @@ static int udp6_ufo_send_check(struct sk_buff *skb)
         return 0;
 }
 
-static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, int features)
+static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb, u32 features)
 {
         struct sk_buff *segs = ERR_PTR(-EINVAL);
         unsigned int mss;
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index da87428681cc..48ce496802fd 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -27,8 +27,8 @@
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 
 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
-                                          xfrm_address_t *saddr,
-                                          xfrm_address_t *daddr)
+                                          const xfrm_address_t *saddr,
+                                          const xfrm_address_t *daddr)
 {
         struct flowi fl = {};
         struct dst_entry *dst;
@@ -67,7 +67,7 @@ static int xfrm6_get_saddr(struct net *net,
         return 0;
 }
 
-static int xfrm6_get_tos(struct flowi *fl)
+static int xfrm6_get_tos(const struct flowi *fl)
 {
         return 0;
 }
@@ -87,7 +87,7 @@ static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
 }
 
 static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
-                          struct flowi *fl)
+                          const struct flowi *fl)
 {
         struct rt6_info *rt = (struct rt6_info*)xdst->route;
 
@@ -220,6 +220,7 @@ static void xfrm6_dst_destroy(struct dst_entry *dst)
 
         if (likely(xdst->u.rt6.rt6i_idev))
                 in6_dev_put(xdst->u.rt6.rt6i_idev);
+        dst_destroy_metrics_generic(dst);
         if (likely(xdst->u.rt6.rt6i_peer))
                 inet_putpeer(xdst->u.rt6.rt6i_peer);
         xfrm_dst_destroy(xdst);
@@ -257,6 +258,7 @@ static struct dst_ops xfrm6_dst_ops = {
         .protocol =             cpu_to_be16(ETH_P_IPV6),
         .gc =                   xfrm6_garbage_collect,
         .update_pmtu =          xfrm6_update_pmtu,
+        .cow_metrics =          dst_cow_metrics_generic,
         .destroy =              xfrm6_dst_destroy,
         .ifdown =               xfrm6_dst_ifdown,
         .local_out =            __ip6_local_out,
@@ -272,6 +274,7 @@ static struct xfrm_policy_afinfo xfrm6_policy_afinfo = {
         .get_tos =              xfrm6_get_tos,
         .init_path =            xfrm6_init_path,
         .fill_dst =             xfrm6_fill_dst,
+        .blackhole_route =      ip6_blackhole_route,
 };
 
 static int __init xfrm6_policy_init(void)
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index a67575d472a3..a02598e0079a 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -20,7 +20,7 @@
 #include <net/addrconf.h>
 
 static void
-__xfrm6_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
+__xfrm6_init_tempsel(struct xfrm_selector *sel, const struct flowi *fl)
 {
         /* Initialize temporary selector matching only
          * to current session. */
@@ -38,8 +38,8 @@ __xfrm6_init_tempsel(struct xfrm_selector *sel, struct flowi *fl)
 }
 
 static void
-xfrm6_init_temprop(struct xfrm_state *x, struct xfrm_tmpl *tmpl,
-                   xfrm_address_t *daddr, xfrm_address_t *saddr)
+xfrm6_init_temprop(struct xfrm_state *x, const struct xfrm_tmpl *tmpl,
+                   const xfrm_address_t *daddr, const xfrm_address_t *saddr)
 {
         x->id = tmpl->id;
         if (ipv6_addr_any((struct in6_addr*)&x->id.daddr))