55 files changed, 2315 insertions, 1921 deletions
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index ead6c7a42f44..a578096152ab 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -170,6 +170,25 @@ config IPV6_SIT
          Saying M here will produce a module called sit. If unsure, say Y.
+config IPV6_SIT_6RD
+        bool "IPv6: IPv6 Rapid Deployment (6RD) (EXPERIMENTAL)"
+        depends on IPV6_SIT && EXPERIMENTAL
+        default n
+        ---help---
+          IPv6 Rapid Deployment (6rd; draft-ietf-softwire-ipv6-6rd) builds upon
+          mechanisms of 6to4 (RFC3056) to enable a service provider to rapidly
+          deploy IPv6 unicast service to IPv4 sites to which it provides
+          customer premise equipment.  Like 6to4, it utilizes stateless IPv6 in
+          IPv4 encapsulation in order to transit IPv4-only network
+          infrastructure.  Unlike 6to4, a 6rd service provider uses an IPv6
+          prefix of its own in place of the fixed 6to4 prefix.
+          With this option enabled, the SIT driver offers 6rd functionality by
+          providing additional ioctl API to configure the IPv6 Prefix for in
+          stead of static 2002::/16 for 6to4.
+          If unsure, say N.
 config IPV6_NDISC_NODETYPE
        bool
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 1fd0a3d775d2..413054f02aab 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -53,6 +53,7 @@
 #include <linux/route.h>
 #include <linux/inetdevice.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -278,31 +279,31 @@ static void addrconf_mod_timer(struct inet6_ifaddr *ifp,
 static int snmp6_alloc_dev(struct inet6_dev *idev)
 {
-        if (snmp_mib_init((void **)idev->stats.ipv6,
+        if (snmp_mib_init((void __percpu **)idev->stats.ipv6,
                          sizeof(struct ipstats_mib)) < 0)
                goto err_ip;
-        if (snmp_mib_init((void **)idev->stats.icmpv6,
+        if (snmp_mib_init((void __percpu **)idev->stats.icmpv6,
                          sizeof(struct icmpv6_mib)) < 0)
                goto err_icmp;
-        if (snmp_mib_init((void **)idev->stats.icmpv6msg,
+        if (snmp_mib_init((void __percpu **)idev->stats.icmpv6msg,
                          sizeof(struct icmpv6msg_mib)) < 0)
                goto err_icmpmsg;
        return 0;
 err_icmpmsg:
-        snmp_mib_free((void **)idev->stats.icmpv6);
+        snmp_mib_free((void __percpu **)idev->stats.icmpv6);
 err_icmp:
-        snmp_mib_free((void **)idev->stats.ipv6);
+        snmp_mib_free((void __percpu **)idev->stats.ipv6);
 err_ip:
        return -ENOMEM;
 }
 static void snmp6_free_dev(struct inet6_dev *idev)
 {
-        snmp_mib_free((void **)idev->stats.icmpv6msg);
+        snmp_mib_free((void __percpu **)idev->stats.icmpv6msg);
-        snmp_mib_free((void **)idev->stats.icmpv6);
+        snmp_mib_free((void __percpu **)idev->stats.icmpv6);
-        snmp_mib_free((void **)idev->stats.ipv6);
+        snmp_mib_free((void __percpu **)idev->stats.ipv6);
 }
 /* Nobody refers to this device, we may destroy it. */
@@ -481,9 +482,8 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
        struct net_device *dev;
        struct inet6_dev *idev;
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
-        for_each_netdev(net, dev) {
+        for_each_netdev_rcu(net, dev) {
-                rcu_read_lock();
                idev = __in6_dev_get(dev);
                if (idev) {
                        int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -491,9 +491,8 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
                        if (changed)
                                dev_forward_change(idev);
                }
-                rcu_read_unlock();
        }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
@@ -504,8 +503,11 @@ static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
        if (p == &net->ipv6.devconf_dflt->forwarding)
                return 0;
-        if (!rtnl_trylock())
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
                return restart_syscall();
+        }
        if (p == &net->ipv6.devconf_all->forwarding) {
                __s32 newf = net->ipv6.devconf_all->forwarding;
@@ -991,8 +993,7 @@ struct ipv6_saddr_dst {
 static inline int ipv6_saddr_preferred(int type)
 {
-        if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|
+        if (type & (IPV6_ADDR_MAPPED|IPV6_ADDR_COMPATv4|IPV6_ADDR_LOOPBACK))
-                    IPV6_ADDR_LOOPBACK|IPV6_ADDR_RESERVED))
                return 1;
        return 0;
 }
@@ -1137,10 +1138,9 @@ int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
        hiscore->rule = -1;
        hiscore->ifa = NULL;
-        read_lock(&dev_base_lock);
        rcu_read_lock();
-        for_each_netdev(net, dev) {
+        for_each_netdev_rcu(net, dev) {
                struct inet6_dev *idev;
                /* Candidate Source Address (section 4)
@@ -1235,7 +1235,6 @@ try_nextdev:
                read_unlock_bh(&idev->lock);
        }
        rcu_read_unlock();
-        read_unlock(&dev_base_lock);
        if (!hiscore->ifa)
                return -EADDRNOTAVAIL;
@@ -1382,6 +1381,8 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
                if (dad_failed)
                        ifp->flags |= IFA_F_DADFAILED;
                spin_unlock_bh(&ifp->lock);
+                if (dad_failed)
+                        ipv6_ifa_notify(0, ifp);
                in6_ifa_put(ifp);
 #ifdef CONFIG_IPV6_PRIVACY
        } else if (ifp->flags&IFA_F_TEMPORARY) {
@@ -2617,7 +2618,7 @@ static void addrconf_bonding_change(struct net_device *dev, unsigned long event)
 static int addrconf_ifdown(struct net_device *dev, int how)
 {
        struct inet6_dev *idev;
-        struct inet6_ifaddr *ifa, **bifa;
+        struct inet6_ifaddr *ifa, *keep_list, **bifa;
        struct net *net = dev_net(dev);
        int i;
@@ -2650,11 +2651,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                write_lock_bh(&addrconf_hash_lock);
                while ((ifa = *bifa) != NULL) {
-                        if (ifa->idev == idev) {
+                        if (ifa->idev == idev &&
+                            (how || !(ifa->flags&IFA_F_PERMANENT) ||
+                             ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
                                *bifa = ifa->lst_next;
                                ifa->lst_next = NULL;
-                                addrconf_del_timer(ifa);
+                                __in6_ifa_put(ifa);
-                                in6_ifa_put(ifa);
                                continue;
                        }
                        bifa = &ifa->lst_next;
@@ -2690,11 +2692,40 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                write_lock_bh(&idev->lock);
        }
 #endif
+        keep_list = NULL;
+        bifa = &keep_list;
        while ((ifa = idev->addr_list) != NULL) {
                idev->addr_list = ifa->if_next;
                ifa->if_next = NULL;
-                ifa->dead = 1;
                addrconf_del_timer(ifa);
+                /* If just doing link down, and address is permanent
+                   and not link-local, then retain it. */
+                if (how == 0 &&
+                    (ifa->flags&IFA_F_PERMANENT) &&
+                    !(ipv6_addr_type(&ifa->addr) & IPV6_ADDR_LINKLOCAL)) {
+                        /* Move to holding list */
+                        *bifa = ifa;
+                        bifa = &ifa->if_next;
+                        /* If not doing DAD on this address, just keep it. */
+                        if ((dev->flags&(IFF_NOARP|IFF_LOOPBACK)) ||
+                            idev->cnf.accept_dad <= 0 ||
+                            (ifa->flags & IFA_F_NODAD))
+                                continue;
+                        /* If it was tentative already, no need to notify */
+                        if (ifa->flags & IFA_F_TENTATIVE)
+                                continue;
+                        /* Flag it for later restoration when link comes up */
+                        ifa->flags |= IFA_F_TENTATIVE;
+                        in6_ifa_hold(ifa);
+                } else {
+                        ifa->dead = 1;
+                }
                write_unlock_bh(&idev->lock);
                __ipv6_ifa_notify(RTM_DELADDR, ifa);
@@ -2703,6 +2734,9 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                write_lock_bh(&idev->lock);
        }
+        idev->addr_list = keep_list;
        write_unlock_bh(&idev->lock);
        /* Step 5: Discard multicast list */
@@ -2728,28 +2762,29 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 static void addrconf_rs_timer(unsigned long data)
 {
        struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
+        struct inet6_dev *idev = ifp->idev;
-        if (ifp->idev->cnf.forwarding)
+        read_lock(&idev->lock);
+        if (idev->dead || !(idev->if_flags & IF_READY))
                goto out;
-        if (ifp->idev->if_flags & IF_RA_RCVD) {
+        if (idev->cnf.forwarding)
-                /*
+                goto out;
-                 *      Announcement received after solicitation
-                 *      was sent
+        /* Announcement received after solicitation was sent */
-                 */
+        if (idev->if_flags & IF_RA_RCVD)
                goto out;
-        }
        spin_lock(&ifp->lock);
-        if (ifp->probes++ < ifp->idev->cnf.rtr_solicits) {
+        if (ifp->probes++ < idev->cnf.rtr_solicits) {
                /* The wait after the last probe can be shorter */
                addrconf_mod_timer(ifp, AC_RS,
-                                   (ifp->probes == ifp->idev->cnf.rtr_solicits) ?
+                                   (ifp->probes == idev->cnf.rtr_solicits) ?
-                                   ifp->idev->cnf.rtr_solicit_delay :
+                                   idev->cnf.rtr_solicit_delay :
-                                   ifp->idev->cnf.rtr_solicit_interval);
+                                   idev->cnf.rtr_solicit_interval);
                spin_unlock(&ifp->lock);
-                ndisc_send_rs(ifp->idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
+                ndisc_send_rs(idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
        } else {
                spin_unlock(&ifp->lock);
                /*
@@ -2757,10 +2792,11 @@ static void addrconf_rs_timer(unsigned long data)
                 * assumption any longer.
                 */
                printk(KERN_DEBUG "%s: no IPv6 routers present\n",
-                       ifp->idev->dev->name);
+                       idev->dev->name);
        }
 out:
+        read_unlock(&idev->lock);
        in6_ifa_put(ifp);
 }
@@ -2793,14 +2829,14 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
        read_lock_bh(&idev->lock);
        if (ifp->dead)
                goto out;
-        spin_lock_bh(&ifp->lock);
+        spin_lock(&ifp->lock);
        if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
            idev->cnf.accept_dad < 1 ||
            !(ifp->flags&IFA_F_TENTATIVE) ||
            ifp->flags & IFA_F_NODAD) {
                ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                read_unlock_bh(&idev->lock);
                addrconf_dad_completed(ifp);
@@ -2808,7 +2844,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
        }
        if (!(idev->if_flags & IF_READY)) {
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                read_unlock_bh(&idev->lock);
                /*
                 * If the device is not ready:
@@ -2828,7 +2864,7 @@ static void addrconf_dad_start(struct inet6_ifaddr *ifp, u32 flags)
                ip6_ins_rt(ifp->rt);
        addrconf_dad_kick(ifp);
-        spin_unlock_bh(&ifp->lock);
+        spin_unlock(&ifp->lock);
 out:
        read_unlock_bh(&idev->lock);
 }
@@ -2839,20 +2875,21 @@ static void addrconf_dad_timer(unsigned long data)
        struct inet6_dev *idev = ifp->idev;
        struct in6_addr mcaddr;
-        read_lock_bh(&idev->lock);
+        read_lock(&idev->lock);
-        if (idev->dead) {
+        if (idev->dead || !(idev->if_flags & IF_READY)) {
-                read_unlock_bh(&idev->lock);
+                read_unlock(&idev->lock);
                goto out;
        }
-        spin_lock_bh(&ifp->lock);
+        spin_lock(&ifp->lock);
        if (ifp->probes == 0) {
                /*
                 * DAD was successful
                 */
                ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
-                read_unlock_bh(&idev->lock);
+                read_unlock(&idev->lock);
                addrconf_dad_completed(ifp);
@@ -2861,8 +2898,8 @@ static void addrconf_dad_timer(unsigned long data)
        ifp->probes--;
        addrconf_mod_timer(ifp, AC_DAD, ifp->idev->nd_parms->retrans_time);
-        spin_unlock_bh(&ifp->lock);
+        spin_unlock(&ifp->lock);
-        read_unlock_bh(&idev->lock);
+        read_unlock(&idev->lock);
        /* send a neighbour solicitation for our addr */
        addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
@@ -2909,12 +2946,12 @@ static void addrconf_dad_run(struct inet6_dev *idev) {
        read_lock_bh(&idev->lock);
        for (ifp = idev->addr_list; ifp; ifp = ifp->if_next) {
-                spin_lock_bh(&ifp->lock);
+                spin_lock(&ifp->lock);
                if (!(ifp->flags & IFA_F_TENTATIVE)) {
-                        spin_unlock_bh(&ifp->lock);
+                        spin_unlock(&ifp->lock);
                        continue;
                }
-                spin_unlock_bh(&ifp->lock);
+                spin_unlock(&ifp->lock);
                addrconf_dad_kick(ifp);
        }
        read_unlock_bh(&idev->lock);
@@ -3031,14 +3068,14 @@ static const struct file_operations if6_fops = {
        .release        = seq_release_net,
 };
-static int if6_proc_net_init(struct net *net)
+static int __net_init if6_proc_net_init(struct net *net)
 {
        if (!proc_net_fops_create(net, "if_inet6", S_IRUGO, &if6_fops))
                return -ENOMEM;
        return 0;
 }
-static void if6_proc_net_exit(struct net *net)
+static void __net_exit if6_proc_net_exit(struct net *net)
 {
       proc_net_remove(net, "if_inet6");
 }
@@ -3485,85 +3522,114 @@ enum addr_type_t
        ANYCAST_ADDR,
 };
+/* called with rcu_read_lock() */
+static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
+                          struct netlink_callback *cb, enum addr_type_t type,
+                          int s_ip_idx, int *p_ip_idx)
+{
+        struct inet6_ifaddr *ifa;
+        struct ifmcaddr6 *ifmca;
+        struct ifacaddr6 *ifaca;
+        int err = 1;
+        int ip_idx = *p_ip_idx;
+        read_lock_bh(&idev->lock);
+        switch (type) {
+        case UNICAST_ADDR:
+                /* unicast address incl. temp addr */
+                for (ifa = idev->addr_list; ifa;
+                     ifa = ifa->if_next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifaddr(skb, ifa,
+                                                NETLINK_CB(cb->skb).pid,
+                                                cb->nlh->nlmsg_seq,
+                                                RTM_NEWADDR,
+                                                NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        case MULTICAST_ADDR:
+                /* multicast address */
+                for (ifmca = idev->mc_list; ifmca;
+                     ifmca = ifmca->next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifmcaddr(skb, ifmca,
+                                                  NETLINK_CB(cb->skb).pid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  RTM_GETMULTICAST,
+                                                  NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        case ANYCAST_ADDR:
+                /* anycast address */
+                for (ifaca = idev->ac_list; ifaca;
+                     ifaca = ifaca->aca_next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifacaddr(skb, ifaca,
+                                                  NETLINK_CB(cb->skb).pid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  RTM_GETANYCAST,
+                                                  NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        default:
+                break;
+        }
+        read_unlock_bh(&idev->lock);
+        *p_ip_idx = ip_idx;
+        return err;
+}
 static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                           enum addr_type_t type)
 {
+        struct net *net = sock_net(skb->sk);
+        int h, s_h;
        int idx, ip_idx;
        int s_idx, s_ip_idx;
-        int err = 1;
        struct net_device *dev;
-        struct inet6_dev *idev = NULL;
+        struct inet6_dev *idev;
-        struct inet6_ifaddr *ifa;
+        struct hlist_head *head;
-        struct ifmcaddr6 *ifmca;
+        struct hlist_node *node;
-        struct ifacaddr6 *ifaca;
-        struct net *net = sock_net(skb->sk);
-        s_idx = cb->args[0];
+        s_h = cb->args[0];
-        s_ip_idx = ip_idx = cb->args[1];
+        s_idx = idx = cb->args[1];
+        s_ip_idx = ip_idx = cb->args[2];
-        idx = 0;
+        rcu_read_lock();
-        for_each_netdev(net, dev) {
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
-                if (idx < s_idx)
+                idx = 0;
-                        goto cont;
+                head = &net->dev_index_head[h];
-                if (idx > s_idx)
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
-                        s_ip_idx = 0;
+                        if (idx < s_idx)
-                ip_idx = 0;
+                                goto cont;
-                if ((idev = in6_dev_get(dev)) == NULL)
+                        if (h > s_h || idx > s_idx)
-                        goto cont;
+                                s_ip_idx = 0;
-                read_lock_bh(&idev->lock);
+                        ip_idx = 0;
-                switch (type) {
+                        if ((idev = __in6_dev_get(dev)) == NULL)
-                case UNICAST_ADDR:
+                                goto cont;
-                        /* unicast address incl. temp addr */
-                        for (ifa = idev->addr_list; ifa;
+                        if (in6_dump_addrs(idev, skb, cb, type,
-                             ifa = ifa->if_next, ip_idx++) {
+                                           s_ip_idx, &ip_idx) <= 0)
-                                if (ip_idx < s_ip_idx)
+                                goto done;
-                                        continue;
-                                err = inet6_fill_ifaddr(skb, ifa,
-                                                        NETLINK_CB(cb->skb).pid,
-                                                        cb->nlh->nlmsg_seq,
-                                                        RTM_NEWADDR,
-                                                        NLM_F_MULTI);
-                        }
-                        break;
-                case MULTICAST_ADDR:
-                        /* multicast address */
-                        for (ifmca = idev->mc_list; ifmca;
-                             ifmca = ifmca->next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                err = inet6_fill_ifmcaddr(skb, ifmca,
-                                                          NETLINK_CB(cb->skb).pid,
-                                                          cb->nlh->nlmsg_seq,
-                                                          RTM_GETMULTICAST,
-                                                          NLM_F_MULTI);
-                        }
-                        break;
-                case ANYCAST_ADDR:
-                        /* anycast address */
-                        for (ifaca = idev->ac_list; ifaca;
-                             ifaca = ifaca->aca_next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                err = inet6_fill_ifacaddr(skb, ifaca,
-                                                          NETLINK_CB(cb->skb).pid,
-                                                          cb->nlh->nlmsg_seq,
-                                                          RTM_GETANYCAST,
-                                                          NLM_F_MULTI);
-                        }
-                        break;
-                default:
-                        break;
-                }
-                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
-                if (err <= 0)
-                        break;
 cont:
-                idx++;
+                        idx++;
+                }
        }
-        cb->args[0] = idx;
+done:
-        cb->args[1] = ip_idx;
+        rcu_read_unlock();
+        cb->args[0] = h;
+        cb->args[1] = idx;
+        cb->args[2] = ip_idx;
        return skb->len;
 }
@@ -3708,6 +3774,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 #endif
        array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
        array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
+        array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
 }
 static inline size_t inet6_if_nlmsg_size(void)
@@ -3726,8 +3793,8 @@ static inline size_t inet6_if_nlmsg_size(void)
                 );
 }
-static inline void __snmp6_fill_stats(u64 *stats, void **mib, int items,
+static inline void __snmp6_fill_stats(u64 *stats, void __percpu **mib,
-                                      int bytes)
+                                      int items, int bytes)
 {
        int i;
        int pad = bytes - sizeof(u64) * items;
@@ -3746,10 +3813,10 @@ static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
 {
        switch(attrtype) {
        case IFLA_INET6_STATS:
-                __snmp6_fill_stats(stats, (void **)idev->stats.ipv6, IPSTATS_MIB_MAX, bytes);
+                __snmp6_fill_stats(stats, (void __percpu **)idev->stats.ipv6, IPSTATS_MIB_MAX, bytes);
                break;
        case IFLA_INET6_ICMP6STATS:
-                __snmp6_fill_stats(stats, (void **)idev->stats.icmpv6, ICMP6_MIB_MAX, bytes);
+                __snmp6_fill_stats(stats, (void __percpu **)idev->stats.icmpv6, ICMP6_MIB_MAX, bytes);
                break;
        }
 }
@@ -3826,28 +3893,39 @@ nla_put_failure:
 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 {
        struct net *net = sock_net(skb->sk);
-        int idx, err;
+        int h, s_h;
-        int s_idx = cb->args[0];
+        int idx = 0, s_idx;
        struct net_device *dev;
        struct inet6_dev *idev;
+        struct hlist_head *head;
+        struct hlist_node *node;
-        read_lock(&dev_base_lock);
+        s_h = cb->args[0];
-        idx = 0;
+        s_idx = cb->args[1];
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
+        rcu_read_lock();
-                        goto cont;
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
-                if ((idev = in6_dev_get(dev)) == NULL)
+                idx = 0;
-                        goto cont;
+                head = &net->dev_index_head[h];
-                err = inet6_fill_ifinfo(skb, idev, NETLINK_CB(cb->skb).pid,
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
-                                cb->nlh->nlmsg_seq, RTM_NEWLINK, NLM_F_MULTI);
+                        if (idx < s_idx)
-                in6_dev_put(idev);
+                                goto cont;
-                if (err <= 0)
+                        idev = __in6_dev_get(dev);
-                        break;
+                        if (!idev)
+                                goto cont;
+                        if (inet6_fill_ifinfo(skb, idev,
+                                              NETLINK_CB(cb->skb).pid,
+                                              cb->nlh->nlmsg_seq,
+                                              RTM_NEWLINK, NLM_F_MULTI) <= 0)
+                                goto out;
 cont:
-                idx++;
+                        idx++;
+                }
        }
-        read_unlock(&dev_base_lock);
+out:
-        cb->args[0] = idx;
+        rcu_read_unlock();
+        cb->args[1] = idx;
+        cb->args[0] = h;
        return skb->len;
 }
@@ -3991,50 +4069,18 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
 {
        int *valp = ctl->data;
        int val = *valp;
+        loff_t pos = *ppos;
        int ret;
        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write)
                ret = addrconf_fixup_forwarding(ctl, valp, val);
+        if (ret)
+                *ppos = pos;
        return ret;
 }
-static int addrconf_sysctl_forward_strategy(ctl_table *table,
-                                            void __user *oldval,
-                                            size_t __user *oldlenp,
-                                            void __user *newval, size_t newlen)
-{
-        int *valp = table->data;
-        int val = *valp;
-        int new;
-        if (!newval || !newlen)
-                return 0;
-        if (newlen != sizeof(int))
-                return -EINVAL;
-        if (get_user(new, (int __user *)newval))
-                return -EFAULT;
-        if (new == *valp)
-                return 0;
-        if (oldval && oldlenp) {
-                size_t len;
-                if (get_user(len, oldlenp))
-                        return -EFAULT;
-                if (len) {
-                        if (len > table->maxlen)
-                                len = table->maxlen;
-                        if (copy_to_user(oldval, valp, len))
-                                return -EFAULT;
-                        if (put_user(len, oldlenp))
-                                return -EFAULT;
-                }
-        }
-        *valp = new;
-        return addrconf_fixup_forwarding(table, valp, val);
-}
 static void dev_disable_change(struct inet6_dev *idev)
 {
        if (!idev || !idev->dev)
@@ -4051,9 +4097,8 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
        struct net_device *dev;
        struct inet6_dev *idev;
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
-        for_each_netdev(net, dev) {
+        for_each_netdev_rcu(net, dev) {
-                rcu_read_lock();
                idev = __in6_dev_get(dev);
                if (idev) {
                        int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
@@ -4061,9 +4106,8 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
                        if (changed)
                                dev_disable_change(idev);
                }
-                rcu_read_unlock();
        }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
@@ -4075,8 +4119,11 @@ static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
        if (p == &net->ipv6.devconf_dflt->disable_ipv6)
                return 0;
-        if (!rtnl_trylock())
+        if (!rtnl_trylock()) {
+                /* Restore the original values before restarting */
+                *p = old;
                return restart_syscall();
+        }
        if (p == &net->ipv6.devconf_all->disable_ipv6) {
                __s32 newf = net->ipv6.devconf_all->disable_ipv6;
@@ -4095,12 +4142,15 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
 {
        int *valp = ctl->data;
        int val = *valp;
+        loff_t pos = *ppos;
        int ret;
        ret = proc_dointvec(ctl, write, buffer, lenp, ppos);
        if (write)
                ret = addrconf_disable_ipv6(ctl, valp, val);
+        if (ret)
+                *ppos = pos;
        return ret;
 }
@@ -4113,16 +4163,13 @@ static struct addrconf_sysctl_table
        .sysctl_header = NULL,
        .addrconf_vars = {
                {
-                        .ctl_name       =       NET_IPV6_FORWARDING,
                        .procname       =       "forwarding",
                        .data           =       &ipv6_devconf.forwarding,
                        .maxlen         =       sizeof(int),
                        .mode           =       0644,
                        .proc_handler   =       addrconf_sysctl_forward,
-                        .strategy       =       addrconf_sysctl_forward_strategy,
                },
                {
-                        .ctl_name       =       NET_IPV6_HOP_LIMIT,
                        .procname       =       "hop_limit",
                        .data           =       &ipv6_devconf.hop_limit,
                        .maxlen         =       sizeof(int),
@@ -4130,7 +4177,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_MTU,
                        .procname       =       "mtu",
                        .data           =       &ipv6_devconf.mtu6,
                        .maxlen         =       sizeof(int),
@@ -4138,7 +4184,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA,
                        .procname       =       "accept_ra",
                        .data           =       &ipv6_devconf.accept_ra,
                        .maxlen         =       sizeof(int),
@@ -4146,7 +4191,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_ACCEPT_REDIRECTS,
                        .procname       =       "accept_redirects",
                        .data           =       &ipv6_devconf.accept_redirects,
                        .maxlen         =       sizeof(int),
@@ -4154,7 +4198,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_AUTOCONF,
                        .procname       =       "autoconf",
                        .data           =       &ipv6_devconf.autoconf,
                        .maxlen         =       sizeof(int),
@@ -4162,7 +4205,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_DAD_TRANSMITS,
                        .procname       =       "dad_transmits",
                        .data           =       &ipv6_devconf.dad_transmits,
                        .maxlen         =       sizeof(int),
@@ -4170,7 +4212,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_RTR_SOLICITS,
                        .procname       =       "router_solicitations",
                        .data           =       &ipv6_devconf.rtr_solicits,
                        .maxlen         =       sizeof(int),
@@ -4178,25 +4219,20 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_RTR_SOLICIT_INTERVAL,
                        .procname       =       "router_solicitation_interval",
                        .data           =       &ipv6_devconf.rtr_solicit_interval,
                        .maxlen         =       sizeof(int),
                        .mode           =       0644,
                        .proc_handler   =       proc_dointvec_jiffies,
-                        .strategy       =       sysctl_jiffies,
                },
                {
-                        .ctl_name       =       NET_IPV6_RTR_SOLICIT_DELAY,
                        .procname       =       "router_solicitation_delay",
                        .data           =       &ipv6_devconf.rtr_solicit_delay,
                        .maxlen         =       sizeof(int),
                        .mode           =       0644,
                        .proc_handler   =       proc_dointvec_jiffies,
-                        .strategy       =       sysctl_jiffies,
                },
                {
-                        .ctl_name       =       NET_IPV6_FORCE_MLD_VERSION,
                        .procname       =       "force_mld_version",
                        .data           =       &ipv6_devconf.force_mld_version,
                        .maxlen         =       sizeof(int),
@@ -4205,7 +4241,6 @@ static struct addrconf_sysctl_table
                },
 #ifdef CONFIG_IPV6_PRIVACY
                {
-                        .ctl_name       =       NET_IPV6_USE_TEMPADDR,
                        .procname       =       "use_tempaddr",
                        .data           =       &ipv6_devconf.use_tempaddr,
                        .maxlen         =       sizeof(int),
@@ -4213,7 +4248,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_TEMP_VALID_LFT,
                        .procname       =       "temp_valid_lft",
                        .data           =       &ipv6_devconf.temp_valid_lft,
                        .maxlen         =       sizeof(int),
@@ -4221,7 +4255,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_TEMP_PREFERED_LFT,
                        .procname       =       "temp_prefered_lft",
                        .data           =       &ipv6_devconf.temp_prefered_lft,
                        .maxlen         =       sizeof(int),
@@ -4229,7 +4262,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_REGEN_MAX_RETRY,
                        .procname       =       "regen_max_retry",
                        .data           =       &ipv6_devconf.regen_max_retry,
                        .maxlen         =       sizeof(int),
@@ -4237,7 +4269,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_MAX_DESYNC_FACTOR,
                        .procname       =       "max_desync_factor",
                        .data           =       &ipv6_devconf.max_desync_factor,
                        .maxlen         =       sizeof(int),
@@ -4246,7 +4277,6 @@ static struct addrconf_sysctl_table
                },
 #endif
                {
-                        .ctl_name       =       NET_IPV6_MAX_ADDRESSES,
                        .procname       =       "max_addresses",
                        .data           =       &ipv6_devconf.max_addresses,
                        .maxlen         =       sizeof(int),
@@ -4254,7 +4284,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA_DEFRTR,
                        .procname       =       "accept_ra_defrtr",
                        .data           =       &ipv6_devconf.accept_ra_defrtr,
                        .maxlen         =       sizeof(int),
@@ -4262,7 +4291,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA_PINFO,
                        .procname       =       "accept_ra_pinfo",
                        .data           =       &ipv6_devconf.accept_ra_pinfo,
                        .maxlen         =       sizeof(int),
@@ -4271,7 +4299,6 @@ static struct addrconf_sysctl_table
                },
 #ifdef CONFIG_IPV6_ROUTER_PREF
                {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA_RTR_PREF,
                        .procname       =       "accept_ra_rtr_pref",
                        .data           =       &ipv6_devconf.accept_ra_rtr_pref,
                        .maxlen         =       sizeof(int),
@@ -4279,17 +4306,14 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_RTR_PROBE_INTERVAL,
                        .procname       =       "router_probe_interval",
                        .data           =       &ipv6_devconf.rtr_probe_interval,
                        .maxlen         =       sizeof(int),
                        .mode           =       0644,
                        .proc_handler   =       proc_dointvec_jiffies,
-                        .strategy       =       sysctl_jiffies,
                },
 #ifdef CONFIG_IPV6_ROUTE_INFO
                {
-                        .ctl_name       =       NET_IPV6_ACCEPT_RA_RT_INFO_MAX_PLEN,
                        .procname       =       "accept_ra_rt_info_max_plen",
                        .data           =       &ipv6_devconf.accept_ra_rt_info_max_plen,
                        .maxlen         =       sizeof(int),
@@ -4299,7 +4323,6 @@ static struct addrconf_sysctl_table
 #endif
 #endif
                {
-                        .ctl_name       =       NET_IPV6_PROXY_NDP,
                        .procname       =       "proxy_ndp",
                        .data           =       &ipv6_devconf.proxy_ndp,
                        .maxlen         =       sizeof(int),
@@ -4307,7 +4330,6 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       NET_IPV6_ACCEPT_SOURCE_ROUTE,
                        .procname       =       "accept_source_route",
                        .data           =       &ipv6_devconf.accept_source_route,
                        .maxlen         =       sizeof(int),
@@ -4316,7 +4338,6 @@ static struct addrconf_sysctl_table
                },
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
                {
-                        .ctl_name       =       CTL_UNNUMBERED,
                        .procname       =       "optimistic_dad",
                        .data           =       &ipv6_devconf.optimistic_dad,
                        .maxlen         =       sizeof(int),
@@ -4327,7 +4348,6 @@ static struct addrconf_sysctl_table
 #endif
 #ifdef CONFIG_IPV6_MROUTE
                {
-                        .ctl_name       =       CTL_UNNUMBERED,
                        .procname       =       "mc_forwarding",
                        .data           =       &ipv6_devconf.mc_forwarding,
                        .maxlen         =       sizeof(int),
@@ -4336,16 +4356,13 @@ static struct addrconf_sysctl_table
                },
 #endif
                {
-                        .ctl_name       =       CTL_UNNUMBERED,
                        .procname       =       "disable_ipv6",
                        .data           =       &ipv6_devconf.disable_ipv6,
                        .maxlen         =       sizeof(int),
                        .mode           =       0644,
                        .proc_handler   =       addrconf_sysctl_disable,
-                        .strategy       =       sysctl_intvec,
                },
                {
-                        .ctl_name       =       CTL_UNNUMBERED,
                        .procname       =       "accept_dad",
                        .data           =       &ipv6_devconf.accept_dad,
                        .maxlen         =       sizeof(int),
@@ -4353,13 +4370,20 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
-                        .ctl_name       =       0,      /* sentinel */
+                        .procname       = "force_tllao",
+                        .data           = &ipv6_devconf.force_tllao,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec
+                },
+                {
+                        /* sentinel */
                }
        },
 };
 static int __addrconf_sysctl_register(struct net *net, char *dev_name,
-                int ctl_name, struct inet6_dev *idev, struct ipv6_devconf *p)
+                struct inet6_dev *idev, struct ipv6_devconf *p)
 {
        int i;
        struct addrconf_sysctl_table *t;
@@ -4367,9 +4391,9 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
 #define ADDRCONF_CTL_PATH_DEV   3
        struct ctl_path addrconf_ctl_path[] = {
-                { .procname = "net", .ctl_name = CTL_NET, },
+                { .procname = "net", },
-                { .procname = "ipv6", .ctl_name = NET_IPV6, },
+                { .procname = "ipv6", },
-                { .procname = "conf", .ctl_name = NET_IPV6_CONF, },
+                { .procname = "conf", },
                { /* to be set */ },
                { },
        };
@@ -4395,7 +4419,6 @@ static int __addrconf_sysctl_register(struct net *net, char *dev_name,
                goto free;
        addrconf_ctl_path[ADDRCONF_CTL_PATH_DEV].procname = t->dev_name;
-        addrconf_ctl_path[ADDRCONF_CTL_PATH_DEV].ctl_name = ctl_name;
        t->sysctl_header = register_net_sysctl_table(net, addrconf_ctl_path,
                        t->addrconf_vars);
@@ -4429,12 +4452,10 @@ static void __addrconf_sysctl_unregister(struct ipv6_devconf *p)
 static void addrconf_sysctl_register(struct inet6_dev *idev)
 {
-        neigh_sysctl_register(idev->dev, idev->nd_parms, NET_IPV6,
+        neigh_sysctl_register(idev->dev, idev->nd_parms, "ipv6",
-                              NET_IPV6_NEIGH, "ipv6",
+                              &ndisc_ifinfo_sysctl_change);
-                              &ndisc_ifinfo_sysctl_change,
-                              ndisc_ifinfo_sysctl_strategy);
        __addrconf_sysctl_register(dev_net(idev->dev), idev->dev->name,
-                        idev->dev->ifindex, idev, &idev->cnf);
+                                        idev, &idev->cnf);
 }
 static void addrconf_sysctl_unregister(struct inet6_dev *idev)
@@ -4446,7 +4467,7 @@ static void addrconf_sysctl_unregister(struct inet6_dev *idev)
 #endif
-static int addrconf_init_net(struct net *net)
+static int __net_init addrconf_init_net(struct net *net)
 {
        int err;
        struct ipv6_devconf *all, *dflt;
@@ -4455,7 +4476,7 @@ static int addrconf_init_net(struct net *net)
        all = &ipv6_devconf;
        dflt = &ipv6_devconf_dflt;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL);
                if (all == NULL)
                        goto err_alloc_all;
@@ -4473,13 +4494,11 @@ static int addrconf_init_net(struct net *net)
        net->ipv6.devconf_dflt = dflt;
 #ifdef CONFIG_SYSCTL
-        err = __addrconf_sysctl_register(net, "all", NET_PROTO_CONF_ALL,
+        err = __addrconf_sysctl_register(net, "all", NULL, all);
-                        NULL, all);
        if (err < 0)
                goto err_reg_all;
-        err = __addrconf_sysctl_register(net, "default", NET_PROTO_CONF_DEFAULT,
+        err = __addrconf_sysctl_register(net, "default", NULL, dflt);
-                        NULL, dflt);
        if (err < 0)
                goto err_reg_dflt;
 #endif
@@ -4497,13 +4516,13 @@ err_alloc_all:
        return err;
 }
-static void addrconf_exit_net(struct net *net)
+static void __net_exit addrconf_exit_net(struct net *net)
 {
 #ifdef CONFIG_SYSCTL
        __addrconf_sysctl_unregister(net->ipv6.devconf_dflt);
        __addrconf_sysctl_unregister(net->ipv6.devconf_all);
 #endif
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                kfree(net->ipv6.devconf_dflt);
                kfree(net->ipv6.devconf_all);
        }
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 3f82e9542eda..6b03826552e1 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -72,7 +72,7 @@ int __ipv6_addr_type(const struct in6_addr *addr)
                                IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.3 */
        }
-        return (IPV6_ADDR_RESERVED |
+        return (IPV6_ADDR_UNICAST |
                IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));  /* addr-select 3.4 */
 }
 EXPORT_SYMBOL(__ipv6_addr_type);
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 6ff73c4c126a..ae404c9a746c 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -13,6 +13,7 @@
 #include <linux/list.h>
 #include <linux/rcupdate.h>
 #include <linux/in6.h>
+#include <linux/slab.h>
 #include <net/addrconf.h>
 #include <linux/if_addrlabel.h>
 #include <linux/netlink.h>
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e127a32f9540..3f9e86b15e0d 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -36,6 +36,7 @@
 #include <linux/proc_fs.h>
 #include <linux/stat.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <linux/inet.h>
 #include <linux/netdevice.h>
@@ -95,7 +96,8 @@ static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
        return (struct ipv6_pinfo *)(((u8 *)sk) + offset);
 }
-static int inet6_create(struct net *net, struct socket *sock, int protocol)
+static int inet6_create(struct net *net, struct socket *sock, int protocol,
+                        int kern)
 {
        struct inet_sock *inet;
        struct ipv6_pinfo *np;
@@ -158,7 +160,7 @@ lookup_protocol:
        }
        err = -EPERM;
-        if (answer->capability > 0 && !capable(answer->capability))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                goto out_rcu_unlock;
        sock->ops = answer->ops;
@@ -185,7 +187,7 @@ lookup_protocol:
        inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
        if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                if (IPPROTO_RAW == protocol)
                        inet->hdrincl = 1;
        }
@@ -198,7 +200,7 @@ lookup_protocol:
        inet_sk(sk)->pinet6 = np = inet6_sk_generic(sk);
        np->hop_limit   = -1;
-        np->mcast_hops  = -1;
+        np->mcast_hops  = IPV6_DEFAULT_MCASTHOPS;
        np->mc_loop     = 1;
        np->pmtudisc    = IPV6_PMTUDISC_WANT;
        np->ipv6only    = net->ipv6.sysctl.bindv6only;
@@ -228,12 +230,12 @@ lookup_protocol:
         */
        sk_refcnt_debug_inc(sk);
-        if (inet->num) {
+        if (inet->inet_num) {
                /* It assumes that any protocol which allows
                 * the user to assign a number at socket
                 * creation time automatically shares.
                 */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                sk->sk_prot->hash(sk);
        }
        if (sk->sk_prot->init) {
@@ -281,7 +283,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        lock_sock(sk);
        /* Check these errors (active socket, double bind). */
-        if (sk->sk_state != TCP_CLOSE || inet->num) {
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num) {
                err = -EINVAL;
                goto out;
        }
@@ -314,6 +316,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                if (addr_type != IPV6_ADDR_ANY) {
                        struct net_device *dev = NULL;
+                        rcu_read_lock();
                        if (addr_type & IPV6_ADDR_LINKLOCAL) {
                                if (addr_len >= sizeof(struct sockaddr_in6) &&
                                    addr->sin6_scope_id) {
@@ -326,12 +329,12 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                                /* Binding to link-local address requires an interface */
                                if (!sk->sk_bound_dev_if) {
                                        err = -EINVAL;
-                                        goto out;
+                                        goto out_unlock;
                                }
-                                dev = dev_get_by_index(net, sk->sk_bound_dev_if);
+                                dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
                                if (!dev) {
                                        err = -ENODEV;
-                                        goto out;
+                                        goto out_unlock;
                                }
                        }
@@ -342,19 +345,16 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                        if (!(addr_type & IPV6_ADDR_MULTICAST)) {
                                if (!ipv6_chk_addr(net, &addr->sin6_addr,
                                                   dev, 0)) {
-                                        if (dev)
-                                                dev_put(dev);
                                        err = -EADDRNOTAVAIL;
-                                        goto out;
+                                        goto out_unlock;
                                }
                        }
-                        if (dev)
+                        rcu_read_unlock();
-                                dev_put(dev);
                }
        }
-        inet->rcv_saddr = v4addr;
+        inet->inet_rcv_saddr = v4addr;
-        inet->saddr = v4addr;
+        inet->inet_saddr = v4addr;
        ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
@@ -375,12 +375,15 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        }
        if (snum)
                sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
+        inet->inet_sport = htons(inet->inet_num);
-        inet->dport = 0;
+        inet->inet_dport = 0;
-        inet->daddr = 0;
+        inet->inet_daddr = 0;
 out:
        release_sock(sk);
        return err;
+out_unlock:
+        rcu_read_unlock();
+        goto out;
 }
 EXPORT_SYMBOL(inet6_bind);
@@ -441,12 +444,12 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
        sin->sin6_flowinfo = 0;
        sin->sin6_scope_id = 0;
        if (peer) {
-                if (!inet->dport)
+                if (!inet->inet_dport)
                        return -ENOTCONN;
                if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                    peer == 1)
                        return -ENOTCONN;
-                sin->sin6_port = inet->dport;
+                sin->sin6_port = inet->inet_dport;
                ipv6_addr_copy(&sin->sin6_addr, &np->daddr);
                if (np->sndflow)
                        sin->sin6_flowinfo = np->flow_label;
@@ -456,7 +459,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                else
                        ipv6_addr_copy(&sin->sin6_addr, &np->rcv_saddr);
-                sin->sin6_port = inet->sport;
+                sin->sin6_port = inet->inet_sport;
        }
        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                sin->sin6_scope_id = sk->sk_bound_dev_if;
@@ -552,7 +555,7 @@ const struct proto_ops inet6_dgram_ops = {
 #endif
 };
-static struct net_proto_family inet6_family_ops = {
+static const struct net_proto_family inet6_family_ops = {
        .family = PF_INET6,
        .create = inet6_create,
        .owner  = THIS_MODULE,
@@ -654,8 +657,9 @@ int inet6_sk_rebuild_header(struct sock *sk)
                ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                fl.fl6_flowlabel = np->flow_label;
                fl.oif = sk->sk_bound_dev_if;
-                fl.fl_ip_dport = inet->dport;
+                fl.mark = sk->sk_mark;
-                fl.fl_ip_sport = inet->sport;
+                fl.fl_ip_dport = inet->inet_dport;
+                fl.fl_ip_sport = inet->inet_sport;
                security_sk_classify_flow(sk, &fl);
                if (np->opt && np->opt->srcrt) {
@@ -968,41 +972,41 @@ static void ipv6_packet_cleanup(void)
 static int __net_init ipv6_init_mibs(struct net *net)
 {
-        if (snmp_mib_init((void **)net->mib.udp_stats_in6,
+        if (snmp_mib_init((void __percpu **)net->mib.udp_stats_in6,
                          sizeof (struct udp_mib)) < 0)
                return -ENOMEM;
-        if (snmp_mib_init((void **)net->mib.udplite_stats_in6,
+        if (snmp_mib_init((void __percpu **)net->mib.udplite_stats_in6,
                          sizeof (struct udp_mib)) < 0)
                goto err_udplite_mib;
-        if (snmp_mib_init((void **)net->mib.ipv6_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.ipv6_statistics,
                          sizeof(struct ipstats_mib)) < 0)
                goto err_ip_mib;
-        if (snmp_mib_init((void **)net->mib.icmpv6_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.icmpv6_statistics,
                          sizeof(struct icmpv6_mib)) < 0)
                goto err_icmp_mib;
-        if (snmp_mib_init((void **)net->mib.icmpv6msg_statistics,
+        if (snmp_mib_init((void __percpu **)net->mib.icmpv6msg_statistics,
                          sizeof(struct icmpv6msg_mib)) < 0)
                goto err_icmpmsg_mib;
        return 0;
 err_icmpmsg_mib:
-        snmp_mib_free((void **)net->mib.icmpv6_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpv6_statistics);
 err_icmp_mib:
-        snmp_mib_free((void **)net->mib.ipv6_statistics);
+        snmp_mib_free((void __percpu **)net->mib.ipv6_statistics);
 err_ip_mib:
-        snmp_mib_free((void **)net->mib.udplite_stats_in6);
+        snmp_mib_free((void __percpu **)net->mib.udplite_stats_in6);
 err_udplite_mib:
-        snmp_mib_free((void **)net->mib.udp_stats_in6);
+        snmp_mib_free((void __percpu **)net->mib.udp_stats_in6);
        return -ENOMEM;
 }
-static void __net_exit ipv6_cleanup_mibs(struct net *net)
+static void ipv6_cleanup_mibs(struct net *net)
 {
-        snmp_mib_free((void **)net->mib.udp_stats_in6);
+        snmp_mib_free((void __percpu **)net->mib.udp_stats_in6);
-        snmp_mib_free((void **)net->mib.udplite_stats_in6);
+        snmp_mib_free((void __percpu **)net->mib.udplite_stats_in6);
-        snmp_mib_free((void **)net->mib.ipv6_statistics);
+        snmp_mib_free((void __percpu **)net->mib.ipv6_statistics);
-        snmp_mib_free((void **)net->mib.icmpv6_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpv6_statistics);
-        snmp_mib_free((void **)net->mib.icmpv6msg_statistics);
+        snmp_mib_free((void __percpu **)net->mib.icmpv6msg_statistics);
 }
 static int __net_init inet6_net_init(struct net *net)
@@ -1039,7 +1043,7 @@ out:
 #endif
 }
-static void inet6_net_exit(struct net *net)
+static void __net_exit inet6_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
        udp6_proc_exit(net);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c1589e2f1dc9..ee82d4ef26ce 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -24,18 +24,93 @@
 *      This file is derived from net/ipv4/ah.c.
 */
+#include <crypto/hash.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <net/ip.h>
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
 #include <linux/string.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
+#define IPV6HDR_BASELEN 8
+struct tmp_ext {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                struct in6_addr saddr;
+#endif
+                struct in6_addr daddr;
+                char hdrs[0];
+};
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+        len += sizeof(struct scatterlist) * nfrags;
+        return kmalloc(len, GFP_ATOMIC);
+}
+static inline struct tmp_ext *ah_tmp_ext(void *base)
+{
+        return base + IPV6HDR_BASELEN;
+}
+static inline u8 *ah_tmp_auth(u8 *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+        ahash_request_set_tfm(req, ahash);
+        return req;
+}
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
 static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 {
        u8 *opt = (u8 *)opthdr;
@@ -218,24 +293,85 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
        return 0;
 }
+static void ah6_output_done(struct crypto_async_request *base, int err)
+{
+        int extlen;
+        u8 *iph_base;
+        u8 *icv;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct ipv6hdr *top_iph = ipv6_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        struct tmp_ext *iph_ext;
+        extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr);
+        if (extlen)
+                extlen += sizeof(*iph_ext);
+        iph_base = AH_SKB_CB(skb)->tmp;
+        iph_ext = ah_tmp_ext(iph_base);
+        icv = ah_tmp_icv(ahp->ahash, iph_ext, extlen);
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+        memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+        if (extlen) {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                memcpy(&top_iph->saddr, iph_ext, extlen);
+#else
+                memcpy(&top_iph->daddr, iph_ext, extlen);
+#endif
+        }
+        err = ah->nexthdr;
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
 static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
 {
        int err;
+        int nfrags;
        int extlen;
+        u8 *iph_base;
+        u8 *icv;
+        u8 nexthdr;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
        struct ipv6hdr *top_iph;
        struct ip_auth_hdr *ah;
        struct ah_data *ahp;
-        u8 nexthdr;
+        struct tmp_ext *iph_ext;
-        char tmp_base[8];
-        struct {
+        ahp = x->data;
-#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+        ahash = ahp->ahash;
-                struct in6_addr saddr;
-#endif
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
-                struct in6_addr daddr;
+                goto out;
-                char hdrs[0];
+        nfrags = err;
-        } *tmp_ext;
        skb_push(skb, -skb_network_offset(skb));
+        extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr);
+        if (extlen)
+                extlen += sizeof(*iph_ext);
+        err = -ENOMEM;
+        iph_base = ah_alloc_tmp(ahash, nfrags, IPV6HDR_BASELEN + extlen);
+        if (!iph_base)
+                goto out;
+        iph_ext = ah_tmp_ext(iph_base);
+        icv = ah_tmp_icv(ahash, iph_ext, extlen);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+        ah = ip_auth_hdr(skb);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
        top_iph = ipv6_hdr(skb);
        top_iph->payload_len = htons(skb->len - sizeof(*top_iph));
@@ -245,31 +381,22 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        /* When there are no extension headers, we only need to save the first
         * 8 bytes of the base IP header.
         */
-        memcpy(tmp_base, top_iph, sizeof(tmp_base));
+        memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
-        tmp_ext = NULL;
-        extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr);
        if (extlen) {
-                extlen += sizeof(*tmp_ext);
-                tmp_ext = kmalloc(extlen, GFP_ATOMIC);
-                if (!tmp_ext) {
-                        err = -ENOMEM;
-                        goto error;
-                }
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                memcpy(tmp_ext, &top_iph->saddr, extlen);
+                memcpy(iph_ext, &top_iph->saddr, extlen);
 #else
-                memcpy(tmp_ext, &top_iph->daddr, extlen);
+                memcpy(iph_ext, &top_iph->daddr, extlen);
 #endif
                err = ipv6_clear_mutable_options(top_iph,
-                                                 extlen - sizeof(*tmp_ext) +
+                                                 extlen - sizeof(*iph_ext) +
                                                 sizeof(*top_iph),
                                                 XFRM_POLICY_OUT);
                if (err)
-                        goto error_free_iph;
+                        goto out_free;
        }
-        ah = ip_auth_hdr(skb);
        ah->nexthdr = nexthdr;
        top_iph->priority    = 0;
@@ -278,36 +405,80 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        top_iph->flow_lbl[2] = 0;
        top_iph->hop_limit   = 0;
-        ahp = x->data;
        ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
        ah->reserved = 0;
        ah->spi = x->id.spi;
        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
-        spin_lock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
+        skb_to_sgvec(skb, sg, 0, skb->len);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
-        if (err)
+        ahash_request_set_crypt(req, sg, icv, skb->len);
-                goto error_free_iph;
+        ahash_request_set_callback(req, 0, ah6_output_done, skb);
+        AH_SKB_CB(skb)->tmp = iph_base;
-        memcpy(top_iph, tmp_base, sizeof(tmp_base));
+        err = crypto_ahash_digest(req);
-        if (tmp_ext) {
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+        memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+        if (extlen) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                memcpy(&top_iph->saddr, tmp_ext, extlen);
+                memcpy(&top_iph->saddr, iph_ext, extlen);
 #else
-                memcpy(&top_iph->daddr, tmp_ext, extlen);
+                memcpy(&top_iph->daddr, iph_ext, extlen);
 #endif
-error_free_iph:
-                kfree(tmp_ext);
        }
-error:
+out_free:
+        kfree(iph_base);
+out:
        return err;
 }
+static void ah6_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        u8 *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int hdr_len = skb_network_header_len(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, hdr_len);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, hdr_len);
+        __skb_pull(skb, ah_hlen + hdr_len);
+        skb_set_transport_header(skb, -hdr_len);
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
 static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
        /*
@@ -325,14 +496,21 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         * There is offset of AH before IPv6 header after the process.
         */
+        u8 *auth_data;
+        u8 *icv;
+        u8 *work_iph;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
        struct ip_auth_hdr *ah;
        struct ipv6hdr *ip6h;
        struct ah_data *ahp;
-        unsigned char *tmp_hdr = NULL;
        u16 hdr_len;
        u16 ah_hlen;
        int nexthdr;
-        int err = -EINVAL;
+        int nfrags;
+        int err = -ENOMEM;
        if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
                goto out;
@@ -345,9 +523,11 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        skb->ip_summed = CHECKSUM_NONE;
-        hdr_len = skb->data - skb_network_header(skb);
+        hdr_len = skb_network_header_len(skb);
        ah = (struct ip_auth_hdr *)skb->data;
        ahp = x->data;
+        ahash = ahp->ahash;
        nexthdr = ah->nexthdr;
        ah_hlen = (ah->hdrlen + 2) << 2;
@@ -358,48 +538,67 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        if (!pskb_may_pull(skb, ah_hlen))
                goto out;
-        tmp_hdr = kmemdup(skb_network_header(skb), hdr_len, GFP_ATOMIC);
-        if (!tmp_hdr)
-                goto out;
        ip6h = ipv6_hdr(skb);
+        skb_push(skb, hdr_len);
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+        auth_data = ah_tmp_auth(work_iph, hdr_len);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+        memcpy(work_iph, ip6h, hdr_len);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
        if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
-                goto free_out;
+                goto out_free;
        ip6h->priority    = 0;
        ip6h->flow_lbl[0] = 0;
        ip6h->flow_lbl[1] = 0;
        ip6h->flow_lbl[2] = 0;
        ip6h->hop_limit   = 0;
-        spin_lock(&x->lock);
+        sg_init_table(sg, nfrags);
-        {
+        skb_to_sgvec(skb, sg, 0, skb->len);
-                u8 auth_data[MAX_AH_AUTH_LEN];
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        ahash_request_set_crypt(req, sg, icv, skb->len);
-                memset(ah->auth_data, 0, ahp->icv_trunc_len);
+        ahash_request_set_callback(req, 0, ah6_input_done, skb);
-                skb_push(skb, hdr_len);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
+        AH_SKB_CB(skb)->tmp = work_iph;
-                if (err)
-                        goto unlock;
+        err = crypto_ahash_digest(req);
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
+        if (err) {
-                        err = -EBADMSG;
+                if (err == -EINPROGRESS)
+                        goto out;
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
        }
-unlock:
-        spin_unlock(&x->lock);
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
        if (err)
-                goto free_out;
+                goto out_free;
        skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), tmp_hdr, hdr_len);
+        memcpy(skb_network_header(skb), work_iph, hdr_len);
        skb->transport_header = skb->network_header;
        __skb_pull(skb, ah_hlen + hdr_len);
-        kfree(tmp_hdr);
+        err = nexthdr;
-        return nexthdr;
+out_free:
+        kfree(work_iph);
-free_out:
-        kfree(tmp_hdr);
 out:
        return err;
 }
@@ -416,7 +615,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
            type != ICMPV6_PKT_TOOBIG)
                return;
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
        if (!x)
                return;
@@ -430,7 +629,7 @@ static int ah6_init_state(struct xfrm_state *x)
 {
        struct ah_data *ahp = NULL;
        struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
        if (!x->aalg)
                goto error;
@@ -442,12 +641,12 @@ static int ah6_init_state(struct xfrm_state *x)
        if (ahp == NULL)
                return -ENOMEM;
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
-        if (IS_ERR(tfm))
+        if (IS_ERR(ahash))
                goto error;
-        ahp->tfm = tfm;
+        ahp->ahash = ahash;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
                               (x->aalg->alg_key_len + 7) / 8))
                goto error;
@@ -461,22 +660,18 @@ static int ah6_init_state(struct xfrm_state *x)
        BUG_ON(!aalg_desc);
        if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                       aalg_desc->uinfo.auth.icv_fullbits/8);
                goto error;
        }
        ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-        ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
+        ahp->icv_trunc_len = x->aalg->alg_trunc_len/8;
        BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
        x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                          ahp->icv_trunc_len);
        switch (x->props.mode) {
@@ -495,8 +690,7 @@ static int ah6_init_state(struct xfrm_state *x)
 error:
        if (ahp) {
-                kfree(ahp->work_icv);
+                crypto_free_ahash(ahp->ahash);
-                crypto_free_hash(ahp->tfm);
                kfree(ahp);
        }
        return -EINVAL;
@@ -509,8 +703,7 @@ static void ah6_destroy(struct xfrm_state *x)
        if (!ahp)
                return;
-        kfree(ahp->work_icv);
+        crypto_free_ahash(ahp->ahash);
-        crypto_free_hash(ahp->tfm);
        kfree(ahp);
 }
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 1ae58bec1de0..b5b07054508a 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -29,6 +29,7 @@
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -404,13 +405,13 @@ int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
        if (dev)
                return ipv6_chk_acast_dev(dev, addr);
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
-        for_each_netdev(net, dev)
+        for_each_netdev_rcu(net, dev)
                if (ipv6_chk_acast_dev(dev, addr)) {
                        found = 1;
                        break;
                }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
        return found;
 }
@@ -431,9 +432,9 @@ static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)
        struct net *net = seq_file_net(seq);
        state->idev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                if (!idev)
                        continue;
                read_lock_bh(&idev->lock);
@@ -443,7 +444,6 @@ static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)
                        break;
                }
                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
        }
        return im;
 }
@@ -454,16 +454,15 @@ static struct ifacaddr6 *ac6_get_next(struct seq_file *seq, struct ifacaddr6 *im
        im = im->aca_next;
        while (!im) {
-                if (likely(state->idev != NULL)) {
+                if (likely(state->idev != NULL))
                        read_unlock_bh(&state->idev->lock);
-                        in6_dev_put(state->idev);
-                }
+                state->dev = next_net_device_rcu(state->dev);
-                state->dev = next_net_device(state->dev);
                if (!state->dev) {
                        state->idev = NULL;
                        break;
                }
-                state->idev = in6_dev_get(state->dev);
+                state->idev = __in6_dev_get(state->dev);
                if (!state->idev)
                        continue;
                read_lock_bh(&state->idev->lock);
@@ -482,29 +481,30 @@ static struct ifacaddr6 *ac6_get_idx(struct seq_file *seq, loff_t pos)
 }
 static void *ac6_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
        return ac6_get_idx(seq, *pos);
 }
 static void *ac6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ifacaddr6 *im;
+        struct ifacaddr6 *im = ac6_get_next(seq, v);
-        im = ac6_get_next(seq, v);
        ++*pos;
        return im;
 }
 static void ac6_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
        struct ac6_iter_state *state = ac6_seq_private(seq);
        if (likely(state->idev != NULL)) {
                read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
+                state->idev = NULL;
        }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int ac6_seq_show(struct seq_file *seq, void *v)
@@ -539,7 +539,7 @@ static const struct file_operations ac6_seq_fops = {
        .release        =       seq_release_net,
 };
-int ac6_proc_init(struct net *net)
+int __net_init ac6_proc_init(struct net *net)
 {
        if (!proc_net_fops_create(net, "anycast6", S_IRUGO, &ac6_seq_fops))
                return -ENOMEM;
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index e2bdc6d83a43..61573885e451 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -21,6 +21,7 @@
 #include <linux/in6.h>
 #include <linux/ipv6.h>
 #include <linux/route.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <net/ndisc.h>
@@ -98,17 +99,15 @@ ipv4_connected:
                if (err)
                        goto out;
-                ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000ffff), inet->daddr);
+                ipv6_addr_set_v4mapped(inet->inet_daddr, &np->daddr);
-                if (ipv6_addr_any(&np->saddr)) {
+                if (ipv6_addr_any(&np->saddr))
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000ffff),
+                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
-                                      inet->saddr);
-                }
+                if (ipv6_addr_any(&np->rcv_saddr))
+                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
+                                               &np->rcv_saddr);
-                if (ipv6_addr_any(&np->rcv_saddr)) {
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000ffff),
-                                      inet->rcv_saddr);
-                }
                goto out;
        }
@@ -136,7 +135,7 @@ ipv4_connected:
        ipv6_addr_copy(&np->daddr, daddr);
        np->flow_label = fl.fl6_flowlabel;
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
        /*
         *      Check for a route to destination an obtain the
@@ -147,8 +146,9 @@ ipv4_connected:
        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
        ipv6_addr_copy(&fl.fl6_src, &np->saddr);
        fl.oif = sk->sk_bound_dev_if;
-        fl.fl_ip_dport = inet->dport;
+        fl.mark = sk->sk_mark;
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_dport = inet->inet_dport;
+        fl.fl_ip_sport = inet->inet_sport;
        if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
                fl.oif = np->mcast_oif;
@@ -190,7 +190,7 @@ ipv4_connected:
        if (ipv6_addr_any(&np->rcv_saddr)) {
                ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
-                inet->rcv_saddr = LOOPBACK4_IPV6;
+                inet->inet_rcv_saddr = LOOPBACK4_IPV6;
        }
        ip6_dst_store(sk, dst,
@@ -222,6 +222,8 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
        if (!skb)
                return;
+        skb->protocol = htons(ETH_P_IPV6);
        serr = SKB_EXT_ERR(skb);
        serr->ee.ee_errno = err;
        serr->ee.ee_origin = SO_EE_ORIGIN_ICMP6;
@@ -255,6 +257,8 @@ void ipv6_local_error(struct sock *sk, int err, struct flowi *fl, u32 info)
        if (!skb)
                return;
+        skb->protocol = htons(ETH_P_IPV6);
        skb_put(skb, sizeof(struct ipv6hdr));
        skb_reset_network_header(skb);
        iph = ipv6_hdr(skb);
@@ -319,7 +323,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_flowinfo = 0;
                sin->sin6_port = serr->port;
                sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                        ipv6_addr_copy(&sin->sin6_addr,
                                  (struct in6_addr *)(nh + serr->addr_offset));
                        if (np->sndflow)
@@ -329,9 +333,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                sin->sin6_scope_id = IP6CB(skb)->iif;
                } else {
-                        ipv6_addr_set(&sin->sin6_addr, 0, 0,
+                        ipv6_addr_set_v4mapped(*(__be32 *)(nh + serr->addr_offset),
-                                      htonl(0xffff),
+                                               &sin->sin6_addr);
-                                      *(__be32 *)(nh + serr->addr_offset));
                }
        }
@@ -342,7 +345,7 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                sin->sin6_family = AF_INET6;
                sin->sin6_flowinfo = 0;
                sin->sin6_scope_id = 0;
-                if (serr->ee.ee_origin == SO_EE_ORIGIN_ICMP6) {
+                if (skb->protocol == htons(ETH_P_IPV6)) {
                        ipv6_addr_copy(&sin->sin6_addr, &ipv6_hdr(skb)->saddr);
                        if (np->rxopt.all)
                                datagram_recv_ctl(sk, msg, skb);
@@ -351,8 +354,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                } else {
                        struct inet_sock *inet = inet_sk(sk);
-                        ipv6_addr_set(&sin->sin6_addr, 0, 0,
+                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
-                                      htonl(0xffff), ip_hdr(skb)->saddr);
+                                               &sin->sin6_addr);
                        if (inet->cmsg_flags)
                                ip_cmsg_recv(msg, skb);
                }
@@ -539,12 +542,17 @@ int datagram_send_ctl(struct net *net,
                        addr_type = __ipv6_addr_type(&src_info->ipi6_addr);
+                        rcu_read_lock();
                        if (fl->oif) {
-                                dev = dev_get_by_index(net, fl->oif);
+                                dev = dev_get_by_index_rcu(net, fl->oif);
-                                if (!dev)
+                                if (!dev) {
+                                        rcu_read_unlock();
                                        return -ENODEV;
-                        } else if (addr_type & IPV6_ADDR_LINKLOCAL)
+                                }
+                        } else if (addr_type & IPV6_ADDR_LINKLOCAL) {
+                                rcu_read_unlock();
                                return -EINVAL;
+                        }
                        if (addr_type != IPV6_ADDR_ANY) {
                                int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
@@ -555,8 +563,7 @@ int datagram_send_ctl(struct net *net,
                                        ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
                        }
-                        if (dev)
+                        rcu_read_unlock();
-                                dev_put(dev);
                        if (err)
                                goto exit_f;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index af597c73ebe9..ee9b93bdd6a2 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -365,7 +365,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
            type != ICMPV6_PKT_TOOBIG)
                return;
-        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
        if (!x)
                return;
        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
@@ -473,7 +473,7 @@ static int esp_init_authenc(struct xfrm_state *x)
                }
                err = crypto_aead_setauthsize(
-                        aead, aalg_desc->uinfo.auth.icv_truncbits / 8);
+                        aead, x->aalg->alg_trunc_len / 8);
                if (err)
                        goto free_key;
        }
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index df159fffe4bc..8a659f92d17a 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -29,6 +29,7 @@
 #include <linux/netdevice.h>
 #include <linux/in6.h>
 #include <linux/icmpv6.h>
+#include <linux/slab.h>
 #include <net/dst.h>
 #include <net/sock.h>
@@ -481,7 +482,7 @@ looped_back:
                        IP6_INC_STATS_BH(net, ip6_dst_idev(skb_dst(skb)),
                                         IPSTATS_MIB_INHDRERRORS);
                        icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
-                                    0, skb->dev);
+                                    0);
                        kfree_skb(skb);
                        return -1;
                }
@@ -559,6 +560,11 @@ static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
        return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
 }
+static inline struct net *ipv6_skb_net(struct sk_buff *skb)
+{
+        return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
+}
 /* Router Alert as of RFC 2711 */
 static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
@@ -580,8 +586,8 @@ static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
 static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 {
        const unsigned char *nh = skb_network_header(skb);
+        struct net *net = ipv6_skb_net(skb);
        u32 pkt_len;
-        struct net *net = dev_net(skb_dst(skb)->dev);
        if (nh[optoff + 1] != 4 || (optoff & 3) != 2) {
                LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 00a7a5e4ac97..5e463c43fcc2 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -84,18 +84,11 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                if ((rule->flags & FIB_RULE_FIND_SADDR) &&
                    r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
                        struct in6_addr saddr;
-                        unsigned int srcprefs = 0;
-                        if (flags & RT6_LOOKUP_F_SRCPREF_TMP)
-                                srcprefs |= IPV6_PREFER_SRC_TMP;
-                        if (flags & RT6_LOOKUP_F_SRCPREF_PUBLIC)
-                                srcprefs |= IPV6_PREFER_SRC_PUBLIC;
-                        if (flags & RT6_LOOKUP_F_SRCPREF_COA)
-                                srcprefs |= IPV6_PREFER_SRC_COA;
                        if (ipv6_dev_get_saddr(net,
                                               ip6_dst_idev(&rt->u.dst)->dev,
-                                               &flp->fl6_dst, srcprefs,
+                                               &flp->fl6_dst,
+                                               rt6_flags2srcprefs(flags),
                                               &saddr))
                                goto again;
                        if (!ipv6_prefix_equal(&saddr, &r->src.addr,
@@ -262,46 +255,38 @@ static struct fib_rules_ops fib6_rules_ops_template = {
        .fro_net                = &init_net,
 };
-static int fib6_rules_net_init(struct net *net)
+static int __net_init fib6_rules_net_init(struct net *net)
 {
+        struct fib_rules_ops *ops;
        int err = -ENOMEM;
-        net->ipv6.fib6_rules_ops = kmemdup(&fib6_rules_ops_template,
+        ops = fib_rules_register(&fib6_rules_ops_template, net);
-                                           sizeof(*net->ipv6.fib6_rules_ops),
+        if (IS_ERR(ops))
-                                           GFP_KERNEL);
+                return PTR_ERR(ops);
-        if (!net->ipv6.fib6_rules_ops)
+        net->ipv6.fib6_rules_ops = ops;
-                goto out;
-        net->ipv6.fib6_rules_ops->fro_net = net;
-        INIT_LIST_HEAD(&net->ipv6.fib6_rules_ops->rules_list);
        err = fib_default_rule_add(net->ipv6.fib6_rules_ops, 0,
-                                   RT6_TABLE_LOCAL, FIB_RULE_PERMANENT);
+                                   RT6_TABLE_LOCAL, 0);
        if (err)
                goto out_fib6_rules_ops;
        err = fib_default_rule_add(net->ipv6.fib6_rules_ops,
                                   0x7FFE, RT6_TABLE_MAIN, 0);
        if (err)
-                goto out_fib6_default_rule_add;
+                goto out_fib6_rules_ops;
-        err = fib_rules_register(net->ipv6.fib6_rules_ops);
-        if (err)
-                goto out_fib6_default_rule_add;
 out:
        return err;
-out_fib6_default_rule_add:
-        fib_rules_cleanup_ops(net->ipv6.fib6_rules_ops);
 out_fib6_rules_ops:
-        kfree(net->ipv6.fib6_rules_ops);
+        fib_rules_unregister(ops);
        goto out;
 }
-static void fib6_rules_net_exit(struct net *net)
+static void __net_exit fib6_rules_net_exit(struct net *net)
 {
        fib_rules_unregister(net->ipv6.fib6_rules_ops);
-        kfree(net->ipv6.fib6_rules_ops);
 }
 static struct pernet_operations fib6_rules_net_ops = {
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index f23ebbec0631..3330a4bd6157 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -40,6 +40,7 @@
 #include <linux/skbuff.h>
 #include <linux/init.h>
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
@@ -67,11 +68,6 @@
 #include <asm/uaccess.h>
 #include <asm/system.h>
-DEFINE_SNMP_STAT(struct icmpv6_mib, icmpv6_statistics) __read_mostly;
-EXPORT_SYMBOL(icmpv6_statistics);
-DEFINE_SNMP_STAT(struct icmpv6msg_mib, icmpv6msg_statistics) __read_mostly;
-EXPORT_SYMBOL(icmpv6msg_statistics);
 /*
 *      The ICMP socket(s). This is the most convenient way to flow control
 *      our ICMP output as well as maintain a clean interface throughout
@@ -119,7 +115,7 @@ static __inline__ void icmpv6_xmit_unlock(struct sock *sk)
 */
 void icmpv6_param_prob(struct sk_buff *skb, u8 code, int pos)
 {
-        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos, skb->dev);
+        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos);
        kfree_skb(skb);
 }
@@ -305,8 +301,7 @@ static inline void mip6_addr_swap(struct sk_buff *skb) {}
 /*
 *      Send an ICMP message in response to a packet in error
 */
-void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info,
+void icmpv6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
-                 struct net_device *dev)
 {
        struct net *net = dev_net(skb->dev);
        struct inet6_dev *idev = NULL;
@@ -942,18 +937,16 @@ EXPORT_SYMBOL(icmpv6_err_convert);
 #ifdef CONFIG_SYSCTL
 ctl_table ipv6_icmp_table_template[] = {
        {
-                .ctl_name       = NET_IPV6_ICMP_RATELIMIT,
                .procname       = "ratelimit",
                .data           = &init_net.ipv6.sysctl.icmpv6_time,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_ms_jiffies,
-                .strategy       = sysctl_ms_jiffies
        },
-        { .ctl_name = 0 },
+        { },
 };
-struct ctl_table *ipv6_icmp_sysctl_init(struct net *net)
+struct ctl_table * __net_init ipv6_icmp_sysctl_init(struct net *net)
 {
        struct ctl_table *table;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index cc4797dd8325..628db24bcf22 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -17,6 +17,7 @@
 #include <linux/in6.h>
 #include <linux/ipv6.h>
 #include <linux/jhash.h>
+#include <linux/slab.h>
 #include <net/addrconf.h>
 #include <net/inet_connection_sock.h>
@@ -132,7 +133,7 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
        sin6->sin6_family = AF_INET6;
        ipv6_addr_copy(&sin6->sin6_addr, &np->daddr);
-        sin6->sin6_port = inet_sk(sk)->dport;
+        sin6->sin6_port = inet_sk(sk)->inet_dport;
        /* We do not store received flowlabel for TCP */
        sin6->sin6_flowinfo = 0;
        sin6->sin6_scope_id = 0;
@@ -168,8 +169,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
        if (dst) {
                struct rt6_info *rt = (struct rt6_info *)dst;
                if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-                        sk->sk_dst_cache = NULL;
+                        __sk_dst_reset(sk);
-                        dst_release(dst);
                        dst = NULL;
                }
        }
@@ -194,8 +194,9 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
        fl.fl6_flowlabel = np->flow_label;
        IP6_ECN_flow_xmit(sk, fl.fl6_flowlabel);
        fl.oif = sk->sk_bound_dev_if;
-        fl.fl_ip_sport = inet->sport;
+        fl.mark = sk->sk_mark;
-        fl.fl_ip_dport = inet->dport;
+        fl.fl_ip_sport = inet->inet_sport;
+        fl.fl_ip_dport = inet->inet_dport;
        security_sk_classify_flow(sk, &fl);
        if (np->opt && np->opt->srcrt) {
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 1bcc3431859e..633a6c266136 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -22,9 +22,10 @@
 #include <net/inet6_hashtables.h>
 #include <net/ip.h>
-void __inet6_hash(struct sock *sk)
+int __inet6_hash(struct sock *sk, struct inet_timewait_sock *tw)
 {
        struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
+        int twrefcnt = 0;
        WARN_ON(!sk_unhashed(sk));
@@ -45,10 +46,15 @@ void __inet6_hash(struct sock *sk)
                lock = inet_ehash_lockp(hashinfo, hash);
                spin_lock(lock);
                __sk_nulls_add_node_rcu(sk, list);
+                if (tw) {
+                        WARN_ON(sk->sk_hash != tw->tw_hash);
+                        twrefcnt = inet_twsk_unhash(tw);
+                }
                spin_unlock(lock);
        }
        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+        return twrefcnt;
 }
 EXPORT_SYMBOL(__inet6_hash);
@@ -73,7 +79,7 @@ struct sock *__inet6_lookup_established(struct net *net,
         * have wildcards anyways.
         */
        unsigned int hash = inet6_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
        struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
@@ -125,7 +131,7 @@ static int inline compute_score(struct sock *sk, struct net *net,
 {
        int score = -1;
-        if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet_sk(sk)->inet_num == hnum &&
            sk->sk_family == PF_INET6) {
                const struct ipv6_pinfo *np = inet6_sk(sk);
@@ -214,15 +220,16 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
        const struct in6_addr *daddr = &np->rcv_saddr;
        const struct in6_addr *saddr = &np->daddr;
        const int dif = sk->sk_bound_dev_if;
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
        struct net *net = sock_net(sk);
        const unsigned int hash = inet6_ehashfn(net, daddr, lport, saddr,
-                                                inet->dport);
+                                                inet->inet_dport);
        struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
        spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
        struct sock *sk2;
        const struct hlist_nulls_node *node;
        struct inet_timewait_sock *tw;
+        int twrefcnt = 0;
        spin_lock(lock);
@@ -248,21 +255,25 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 unique:
        /* Must record num and sport now. Otherwise we will see
         * in hash table socket with a funny identity. */
-        inet->num = lport;
+        inet->inet_num = lport;
-        inet->sport = htons(lport);
+        inet->inet_sport = htons(lport);
+        sk->sk_hash = hash;
        WARN_ON(!sk_unhashed(sk));
        __sk_nulls_add_node_rcu(sk, &head->chain);
-        sk->sk_hash = hash;
+        if (tw) {
+                twrefcnt = inet_twsk_unhash(tw);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        }
        spin_unlock(lock);
+        if (twrefcnt)
+                inet_twsk_put(tw);
        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
-        if (twp != NULL) {
+        if (twp) {
                *twp = tw;
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        } else if (tw) {
-        } else if (tw != NULL) {
                /* Silly. Should hash-dance instead... */
                inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
                inet_twsk_put(tw);
        }
@@ -279,7 +290,7 @@ static inline u32 inet6_sk_port_offset(const struct sock *sk)
        const struct ipv6_pinfo *np = inet6_sk(sk);
        return secure_ipv6_port_ephemeral(np->rcv_saddr.s6_addr32,
                                          np->daddr.s6_addr32,
-                                          inet->dport);
+                                          inet->inet_dport);
 }
 int inet6_hash_connect(struct inet_timewait_death_row *death_row,
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 0e93ca56eb69..6b82e02158c6 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -26,6 +26,7 @@
 #include <linux/in6.h>
 #include <linux/init.h>
 #include <linux/list.h>
+#include <linux/slab.h>
 #ifdef  CONFIG_PROC_FS
 #include <linux/proc_fs.h>
@@ -93,29 +94,20 @@ static __u32 rt_sernum;
 static void fib6_gc_timer_cb(unsigned long arg);
-static struct fib6_walker_t fib6_walker_list = {
+static LIST_HEAD(fib6_walkers);
-        .prev   = &fib6_walker_list,
+#define FOR_WALKERS(w) list_for_each_entry(w, &fib6_walkers, lh)
-        .next   = &fib6_walker_list,
-};
-#define FOR_WALKERS(w) for ((w)=fib6_walker_list.next; (w) != &fib6_walker_list; (w)=(w)->next)
 static inline void fib6_walker_link(struct fib6_walker_t *w)
 {
        write_lock_bh(&fib6_walker_lock);
-        w->next = fib6_walker_list.next;
+        list_add(&w->lh, &fib6_walkers);
-        w->prev = &fib6_walker_list;
-        w->next->prev = w;
-        w->prev->next = w;
        write_unlock_bh(&fib6_walker_lock);
 }
 static inline void fib6_walker_unlink(struct fib6_walker_t *w)
 {
        write_lock_bh(&fib6_walker_lock);
-        w->next->prev = w->prev;
+        list_del(&w->lh);
-        w->prev->next = w->next;
-        w->prev = w->next = w;
        write_unlock_bh(&fib6_walker_lock);
 }
 static __inline__ u32 fib6_new_sernum(void)
@@ -239,7 +231,7 @@ struct fib6_table *fib6_get_table(struct net *net, u32 id)
        return NULL;
 }
-static void fib6_tables_init(struct net *net)
+static void __net_init fib6_tables_init(struct net *net)
 {
        fib6_link_table(net, net->ipv6.fib6_main_tbl);
        fib6_link_table(net, net->ipv6.fib6_local_tbl);
@@ -262,7 +254,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi *fl,
        return (struct dst_entry *) lookup(net, net->ipv6.fib6_main_tbl, fl, flags);
 }
-static void fib6_tables_init(struct net *net)
+static void __net_init fib6_tables_init(struct net *net)
 {
        fib6_link_table(net, net->ipv6.fib6_main_tbl);
 }
@@ -319,12 +311,26 @@ static int fib6_dump_table(struct fib6_table *table, struct sk_buff *skb,
        w->root = &table->tb6_root;
        if (cb->args[4] == 0) {
+                w->count = 0;
+                w->skip = 0;
                read_lock_bh(&table->tb6_lock);
                res = fib6_walk(w);
                read_unlock_bh(&table->tb6_lock);
-                if (res > 0)
+                if (res > 0) {
                        cb->args[4] = 1;
+                        cb->args[5] = w->root->fn_sernum;
+                }
        } else {
+                if (cb->args[5] != w->root->fn_sernum) {
+                        /* Begin at the root if the tree changed */
+                        cb->args[5] = w->root->fn_sernum;
+                        w->state = FWS_INIT;
+                        w->node = w->root;
+                        w->skip = w->count;
+                } else
+                        w->skip = 0;
                read_lock_bh(&table->tb6_lock);
                res = fib6_walk_continue(w);
                read_unlock_bh(&table->tb6_lock);
@@ -1250,9 +1256,18 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                        w->leaf = fn->leaf;
                case FWS_C:
                        if (w->leaf && fn->fn_flags&RTN_RTINFO) {
-                                int err = w->func(w);
+                                int err;
+                                if (w->count < w->skip) {
+                                        w->count++;
+                                        continue;
+                                }
+                                err = w->func(w);
                                if (err)
                                        return err;
+                                w->count++;
                                continue;
                        }
                        w->state = FWS_U;
@@ -1346,6 +1361,8 @@ static void fib6_clean_tree(struct net *net, struct fib6_node *root,
        c.w.root = root;
        c.w.func = fib6_clean_node;
        c.w.prune = prune;
+        c.w.count = 0;
+        c.w.skip = 0;
        c.func = func;
        c.arg = arg;
        c.net = net;
@@ -1469,7 +1486,7 @@ static void fib6_gc_timer_cb(unsigned long arg)
        fib6_run_gc(0, (struct net *)arg);
 }
-static int fib6_net_init(struct net *net)
+static int __net_init fib6_net_init(struct net *net)
 {
        setup_timer(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, (unsigned long)net);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 7712578bdc66..14e23216eb28 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -20,6 +20,7 @@
 #include <linux/route.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -67,7 +68,7 @@ static inline struct ip6_flowlabel *__fl_lookup(struct net *net, __be32 label)
        struct ip6_flowlabel *fl;
        for (fl=fl_ht[FL_HASH(label)]; fl; fl = fl->next) {
-                if (fl->label == label && fl->fl_net == net)
+                if (fl->label == label && net_eq(fl->fl_net, net))
                        return fl;
        }
        return NULL;
@@ -154,7 +155,7 @@ static void ip6_fl_gc(unsigned long dummy)
        write_unlock(&ip6_fl_lock);
 }
-static void ip6_fl_purge(struct net *net)
+static void __net_exit ip6_fl_purge(struct net *net)
 {
        int i;
@@ -163,7 +164,8 @@ static void ip6_fl_purge(struct net *net)
                struct ip6_flowlabel *fl, **flp;
                flp = &fl_ht[i];
                while ((fl = *flp) != NULL) {
-                        if (fl->fl_net == net && atomic_read(&fl->users) == 0) {
+                        if (net_eq(fl->fl_net, net) &&
+                            atomic_read(&fl->users) == 0) {
                                *flp = fl->next;
                                fl_free(fl);
                                atomic_dec(&fl_size);
@@ -377,8 +379,8 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                goto done;
        fl->share = freq->flr_share;
        addr_type = ipv6_addr_type(&freq->flr_dst);
-        if ((addr_type&IPV6_ADDR_MAPPED)
+        if ((addr_type & IPV6_ADDR_MAPPED) ||
-            || addr_type == IPV6_ADDR_ANY) {
+            addr_type == IPV6_ADDR_ANY) {
                err = -EINVAL;
                goto done;
        }
@@ -421,8 +423,8 @@ static int mem_check(struct sock *sk)
        if (room <= 0 ||
            ((count >= FL_MAX_PER_SOCK ||
-             (count > 0 && room < FL_MAX_SIZE/2) || room < FL_MAX_SIZE/4)
+              (count > 0 && room < FL_MAX_SIZE/2) || room < FL_MAX_SIZE/4) &&
-             && !capable(CAP_NET_ADMIN)))
+             !capable(CAP_NET_ADMIN)))
                return -ENOBUFS;
        return 0;
@@ -630,7 +632,7 @@ static struct ip6_flowlabel *ip6fl_get_first(struct seq_file *seq)
        for (state->bucket = 0; state->bucket <= FL_HASH_MASK; ++state->bucket) {
                fl = fl_ht[state->bucket];
-                while (fl && fl->fl_net != net)
+                while (fl && !net_eq(fl->fl_net, net))
                        fl = fl->next;
                if (fl)
                        break;
@@ -645,7 +647,7 @@ static struct ip6_flowlabel *ip6fl_get_next(struct seq_file *seq, struct ip6_flo
        fl = fl->next;
 try_again:
-        while (fl && fl->fl_net != net)
+        while (fl && !net_eq(fl->fl_net, net))
                fl = fl->next;
        while (!fl) {
@@ -734,7 +736,7 @@ static const struct file_operations ip6fl_seq_fops = {
        .release        =       seq_release_net,
 };
-static int ip6_flowlabel_proc_init(struct net *net)
+static int __net_init ip6_flowlabel_proc_init(struct net *net)
 {
        if (!proc_net_fops_create(net, "ip6_flowlabel",
                                  S_IRUGO, &ip6fl_seq_fops))
@@ -742,7 +744,7 @@ static int ip6_flowlabel_proc_init(struct net *net)
        return 0;
 }
-static void ip6_flowlabel_proc_fini(struct net *net)
+static void __net_exit ip6_flowlabel_proc_fini(struct net *net)
 {
        proc_net_remove(net, "ip6_flowlabel");
 }
@@ -753,11 +755,10 @@ static inline int ip6_flowlabel_proc_init(struct net *net)
 }
 static inline void ip6_flowlabel_proc_fini(struct net *net)
 {
-        return ;
 }
 #endif
-static inline void ip6_flowlabel_net_exit(struct net *net)
+static void __net_exit ip6_flowlabel_net_exit(struct net *net)
 {
        ip6_fl_purge(net);
        ip6_flowlabel_proc_fini(net);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 237e2dba6e94..6aa7ee1295c2 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -28,6 +28,7 @@
 #include <linux/in6.h>
 #include <linux/icmpv6.h>
 #include <linux/mroute6.h>
+#include <linux/slab.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -216,8 +217,7 @@ resubmit:
                                IP6_INC_STATS_BH(net, idev,
                                                 IPSTATS_MIB_INUNKNOWNPROTOS);
                                icmpv6_send(skb, ICMPV6_PARAMPROB,
-                                            ICMPV6_UNK_NEXTHDR, nhoff,
+                                            ICMPV6_UNK_NEXTHDR, nhoff);
-                                            skb->dev);
                        }
                } else
                        IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_INDELIVERS);
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index cd48801a8d6f..75d5ef830097 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -37,6 +37,7 @@
 #include <linux/tcp.h>
 #include <linux/route.h>
 #include <linux/module.h>
+#include <linux/slab.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -107,7 +108,7 @@ static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
        newskb->ip_summed = CHECKSUM_UNNECESSARY;
        WARN_ON(!skb_dst(newskb));
-        netif_rx(newskb);
+        netif_rx_ni(newskb);
        return 0;
 }
@@ -121,10 +122,9 @@ static int ip6_output2(struct sk_buff *skb)
        skb->dev = dev;
        if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {
-                struct ipv6_pinfo* np = skb->sk ? inet6_sk(skb->sk) : NULL;
                struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
-                if (!(dev->flags & IFF_LOOPBACK) && (!np || np->mc_loop) &&
+                if (!(dev->flags & IFF_LOOPBACK) && sk_mc_loop(skb->sk) &&
                    ((mroute6_socket(dev_net(dev)) &&
                     !(IP6CB(skb)->flags & IP6SKB_FORWARDED)) ||
                     ipv6_chk_mcast_addr(dev, &ipv6_hdr(skb)->daddr,
@@ -268,7 +268,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
        if (net_ratelimit())
                printk(KERN_DEBUG "IPv6: sending pkt_too_big to self\n");
        skb->dev = dst->dev;
-        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
        IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)), IPSTATS_MIB_FRAGFAILS);
        kfree_skb(skb);
        return -EMSGSIZE;
@@ -403,6 +403,7 @@ int ip6_forward(struct sk_buff *skb)
        struct ipv6hdr *hdr = ipv6_hdr(skb);
        struct inet6_skb_parm *opt = IP6CB(skb);
        struct net *net = dev_net(dst->dev);
+        u32 mtu;
        if (net->ipv6.devconf_all->forwarding == 0)
                goto error;
@@ -442,8 +443,7 @@ int ip6_forward(struct sk_buff *skb)
        if (hdr->hop_limit <= 1) {
                /* Force OUTPUT device used as source address */
                skb->dev = dst->dev;
-                icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT,
+                icmpv6_send(skb, ICMPV6_TIME_EXCEED, ICMPV6_EXC_HOPLIMIT, 0);
-                            0, skb->dev);
                IP6_INC_STATS_BH(net,
                                 ip6_dst_idev(dst), IPSTATS_MIB_INHDRERRORS);
@@ -505,15 +505,19 @@ int ip6_forward(struct sk_buff *skb)
                        goto error;
                if (addrtype & IPV6_ADDR_LINKLOCAL) {
                        icmpv6_send(skb, ICMPV6_DEST_UNREACH,
-                                ICMPV6_NOT_NEIGHBOUR, 0, skb->dev);
+                                    ICMPV6_NOT_NEIGHBOUR, 0);
                        goto error;
                }
        }
-        if (skb->len > dst_mtu(dst)) {
+        mtu = dst_mtu(dst);
+        if (mtu < IPV6_MIN_MTU)
+                mtu = IPV6_MIN_MTU;
+        if (skb->len > mtu) {
                /* Again, force OUTPUT device used as source address */
                skb->dev = dst->dev;
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, dst_mtu(dst), skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                IP6_INC_STATS_BH(net,
                                 ip6_dst_idev(dst), IPSTATS_MIB_INTOOBIGERRORS);
                IP6_INC_STATS_BH(net,
@@ -623,12 +627,11 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
        mtu = ip6_skb_dst_mtu(skb);
        /* We must not fragment if the socket is set to force MTU discovery
-         * or if the skb it not generated by a local socket.  (This last
+         * or if the skb it not generated by a local socket.
-         * check should be redundant, but it's free.)
         */
-        if (!skb->local_df) {
+        if (!skb->local_df && skb->len > mtu) {
                skb->dev = skb_dst(skb)->dev;
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
                              IPSTATS_MIB_FRAGFAILS);
                kfree_skb(skb);
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index c595bbe1ed99..2599870747ec 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -37,6 +37,7 @@
 #include <linux/route.h>
 #include <linux/rtnetlink.h>
 #include <linux/netfilter_ipv6.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <asm/atomic.h>
@@ -74,11 +75,10 @@ MODULE_LICENSE("GPL");
                     (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
                    (HASH_SIZE - 1))
-static void ip6_fb_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_setup(struct net_device *dev);
-static int ip6_tnl_net_id;
+static int ip6_tnl_net_id __read_mostly;
 struct ip6_tnl_net {
        /* the IPv6 tunnel fallback device */
        struct net_device *fb_tnl_dev;
@@ -88,8 +88,10 @@ struct ip6_tnl_net {
        struct ip6_tnl **tnls[2];
 };
-/* lock for the tunnel lists */
+/*
-static DEFINE_RWLOCK(ip6_tnl_lock);
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ip6_tnl_lock);
 static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
@@ -130,6 +132,9 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
 *   else %NULL
 **/
+#define for_each_ip6_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 static struct ip6_tnl *
 ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
 {
@@ -138,13 +143,14 @@ ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
        struct ip6_tnl *t;
        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        for (t = ip6n->tnls_r_l[h0 ^ h1]; t; t = t->next) {
+        for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[h0 ^ h1]) {
                if (ipv6_addr_equal(local, &t->parms.laddr) &&
                    ipv6_addr_equal(remote, &t->parms.raddr) &&
                    (t->dev->flags & IFF_UP))
                        return t;
        }
-        if ((t = ip6n->tnls_wc[0]) != NULL && (t->dev->flags & IFF_UP))
+        t = rcu_dereference(ip6n->tnls_wc[0]);
+        if (t && (t->dev->flags & IFF_UP))
                return t;
        return NULL;
@@ -186,10 +192,10 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
        struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
+        spin_lock_bh(&ip6_tnl_lock);
        t->next = *tp;
-        write_lock_bh(&ip6_tnl_lock);
+        rcu_assign_pointer(*tp, t);
-        *tp = t;
+        spin_unlock_bh(&ip6_tnl_lock);
-        write_unlock_bh(&ip6_tnl_lock);
 }
 /**
@@ -204,9 +210,9 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
        for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
                if (t == *tp) {
-                        write_lock_bh(&ip6_tnl_lock);
+                        spin_lock_bh(&ip6_tnl_lock);
                        *tp = t->next;
-                        write_unlock_bh(&ip6_tnl_lock);
+                        spin_unlock_bh(&ip6_tnl_lock);
                        break;
                }
        }
@@ -313,9 +319,9 @@ ip6_tnl_dev_uninit(struct net_device *dev)
        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
        if (dev == ip6n->fb_tnl_dev) {
-                write_lock_bh(&ip6_tnl_lock);
+                spin_lock_bh(&ip6_tnl_lock);
                ip6n->tnls_wc[0] = NULL;
-                write_unlock_bh(&ip6_tnl_lock);
+                spin_unlock_bh(&ip6_tnl_lock);
        } else {
                ip6_tnl_unlink(ip6n, t);
        }
@@ -409,7 +415,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
           in trouble since we might need the source address for further
           processing of the error. */
-        read_lock(&ip6_tnl_lock);
+        rcu_read_lock();
        if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
                                        &ipv6h->saddr)) == NULL)
                goto out;
@@ -482,7 +488,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
        *msg = rel_msg;
 out:
-        read_unlock(&ip6_tnl_lock);
+        rcu_read_unlock();
        return err;
 }
@@ -617,7 +623,7 @@ ip6ip6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                if (rt && rt->rt6i_dev)
                        skb2->dev = rt->rt6i_dev;
-                icmpv6_send(skb2, rel_type, rel_code, rel_info, skb2->dev);
+                icmpv6_send(skb2, rel_type, rel_code, rel_info);
                if (rt)
                        dst_release(&rt->u.dst);
@@ -652,6 +658,7 @@ static void ip6ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
                IP6_ECN_set_ce(ipv6_hdr(skb));
 }
+/* called with rcu_read_lock() */
 static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
 {
        struct ip6_tnl_parm *p = &t->parms;
@@ -662,15 +669,13 @@ static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
                struct net_device *ldev = NULL;
                if (p->link)
-                        ldev = dev_get_by_index(net, p->link);
+                        ldev = dev_get_by_index_rcu(net, p->link);
                if ((ipv6_addr_is_multicast(&p->laddr) ||
                     likely(ipv6_chk_addr(net, &p->laddr, ldev, 0))) &&
                    likely(!ipv6_chk_addr(net, &p->raddr, NULL, 0)))
                        ret = 1;
-                if (ldev)
-                        dev_put(ldev);
        }
        return ret;
 }
@@ -693,23 +698,23 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
        struct ip6_tnl *t;
        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
-        read_lock(&ip6_tnl_lock);
+        rcu_read_lock();
        if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
                                        &ipv6h->daddr)) != NULL) {
                if (t->parms.proto != ipproto && t->parms.proto != 0) {
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                        goto discard;
                }
                if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                        goto discard;
                }
                if (!ip6_tnl_rcv_ctl(t)) {
                        t->dev->stats.rx_dropped++;
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                        goto discard;
                }
                secpath_reset(skb);
@@ -727,10 +732,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                t->dev->stats.rx_packets++;
                t->dev->stats.rx_bytes += skb->len;
                netif_rx(skb);
-                read_unlock(&ip6_tnl_lock);
+                rcu_read_unlock();
                return 0;
        }
-        read_unlock(&ip6_tnl_lock);
+        rcu_read_unlock();
        return 1;
 discard:
@@ -798,8 +803,9 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
        if (p->flags & IP6_TNL_F_CAP_XMIT) {
                struct net_device *ldev = NULL;
+                rcu_read_lock();
                if (p->link)
-                        ldev = dev_get_by_index(net, p->link);
+                        ldev = dev_get_by_index_rcu(net, p->link);
                if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
                        printk(KERN_WARNING
@@ -813,8 +819,7 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
                               p->name);
                else
                        ret = 1;
-                if (ldev)
+                rcu_read_unlock();
-                        dev_put(ldev);
        }
        return ret;
 }
@@ -1010,7 +1015,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
                tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset];
                if (tel->encap_limit == 0) {
                        icmpv6_send(skb, ICMPV6_PARAMPROB,
-                                    ICMPV6_HDR_FIELD, offset + 2, skb->dev);
+                                    ICMPV6_HDR_FIELD, offset + 2);
                        return -1;
                }
                encap_limit = tel->encap_limit - 1;
@@ -1029,7 +1034,7 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
        err = ip6_tnl_xmit2(skb, dev, dsfield, &fl, encap_limit, &mtu);
        if (err != 0) {
                if (err == -EMSGSIZE)
-                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                return -1;
        }
@@ -1359,7 +1364,7 @@ static void ip6_tnl_dev_init(struct net_device *dev)
 * Return: 0
 **/
-static void ip6_fb_tnl_dev_init(struct net_device *dev)
+static void __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
 {
        struct ip6_tnl *t = netdev_priv(dev);
        struct net *net = dev_net(dev);
@@ -1383,33 +1388,29 @@ static struct xfrm6_tunnel ip6ip6_handler = {
        .priority       =       1,
 };
-static void ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
+static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 {
        int h;
        struct ip6_tnl *t;
+        LIST_HEAD(list);
        for (h = 0; h < HASH_SIZE; h++) {
-                while ((t = ip6n->tnls_r_l[h]) != NULL)
+                t = ip6n->tnls_r_l[h];
-                        unregister_netdevice(t->dev);
+                while (t != NULL) {
+                        unregister_netdevice_queue(t->dev, &list);
+                        t = t->next;
+                }
        }
        t = ip6n->tnls_wc[0];
-        unregister_netdevice(t->dev);
+        unregister_netdevice_queue(t->dev, &list);
+        unregister_netdevice_many(&list);
 }
-static int ip6_tnl_init_net(struct net *net)
+static int __net_init ip6_tnl_init_net(struct net *net)
 {
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
        int err;
-        struct ip6_tnl_net *ip6n;
-        err = -ENOMEM;
-        ip6n = kzalloc(sizeof(struct ip6_tnl_net), GFP_KERNEL);
-        if (ip6n == NULL)
-                goto err_alloc;
-        err = net_assign_generic(net, ip6_tnl_net_id, ip6n);
-        if (err < 0)
-                goto err_assign;
        ip6n->tnls[0] = ip6n->tnls_wc;
        ip6n->tnls[1] = ip6n->tnls_r_l;
@@ -1432,27 +1433,23 @@ static int ip6_tnl_init_net(struct net *net)
 err_register:
        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(ip6n);
-err_alloc:
        return err;
 }
-static void ip6_tnl_exit_net(struct net *net)
+static void __net_exit ip6_tnl_exit_net(struct net *net)
 {
-        struct ip6_tnl_net *ip6n;
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        ip6n = net_generic(net, ip6_tnl_net_id);
        rtnl_lock();
        ip6_tnl_destroy_tunnels(ip6n);
        rtnl_unlock();
-        kfree(ip6n);
 }
 static struct pernet_operations ip6_tnl_net_ops = {
        .init = ip6_tnl_init_net,
        .exit = ip6_tnl_exit_net,
+        .id   = &ip6_tnl_net_id,
+        .size = sizeof(struct ip6_tnl_net),
 };
 /**
@@ -1465,27 +1462,29 @@ static int __init ip6_tunnel_init(void)
 {
        int  err;
-        if (xfrm6_tunnel_register(&ip4ip6_handler, AF_INET)) {
+        err = register_pernet_device(&ip6_tnl_net_ops);
+        if (err < 0)
+                goto out_pernet;
+        err = xfrm6_tunnel_register(&ip4ip6_handler, AF_INET);
+        if (err < 0) {
                printk(KERN_ERR "ip6_tunnel init: can't register ip4ip6\n");
-                err = -EAGAIN;
+                goto out_ip4ip6;
-                goto out;
        }
-        if (xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6)) {
+        err = xfrm6_tunnel_register(&ip6ip6_handler, AF_INET6);
+        if (err < 0) {
                printk(KERN_ERR "ip6_tunnel init: can't register ip6ip6\n");
-                err = -EAGAIN;
+                goto out_ip6ip6;
-                goto unreg_ip4ip6;
        }
-        err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
-        if (err < 0)
-                goto err_pernet;
        return 0;
-err_pernet:
-        xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6);
+out_ip6ip6:
-unreg_ip4ip6:
        xfrm6_tunnel_deregister(&ip4ip6_handler, AF_INET);
-out:
+out_ip4ip6:
+        unregister_pernet_device(&ip6_tnl_net_ops);
+out_pernet:
        return err;
 }
@@ -1501,7 +1500,7 @@ static void __exit ip6_tunnel_cleanup(void)
        if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
                printk(KERN_INFO "ip6_tunnel close: can't deregister ip6ip6\n");
-        unregister_pernet_gen_device(ip6_tnl_net_id, &ip6_tnl_net_ops);
+        unregister_pernet_device(&ip6_tnl_net_ops);
 }
 module_init(ip6_tunnel_init);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 716153941fc4..3e333268db89 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -33,6 +33,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/init.h>
+#include <linux/slab.h>
 #include <net/protocol.h>
 #include <linux/skbuff.h>
 #include <net/sock.h>
@@ -477,7 +478,7 @@ failure:
 *      Delete a VIF entry
 */
-static int mif6_delete(struct net *net, int vifi)
+static int mif6_delete(struct net *net, int vifi, struct list_head *head)
 {
        struct mif_device *v;
        struct net_device *dev;
@@ -519,7 +520,7 @@ static int mif6_delete(struct net *net, int vifi)
                in6_dev->cnf.mc_forwarding--;
        if (v->flags & MIFF_REGISTER)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
        dev_put(dev);
        return 0;
@@ -976,6 +977,7 @@ static int ip6mr_device_event(struct notifier_block *this,
        struct net *net = dev_net(dev);
        struct mif_device *v;
        int ct;
+        LIST_HEAD(list);
        if (event != NETDEV_UNREGISTER)
                return NOTIFY_DONE;
@@ -983,8 +985,10 @@ static int ip6mr_device_event(struct notifier_block *this,
        v = &net->ipv6.vif6_table[0];
        for (ct = 0; ct < net->ipv6.maxvif; ct++, v++) {
                if (v->dev == dev)
-                        mif6_delete(net, ct);
+                        mif6_delete(net, ct, &list);
        }
+        unregister_netdevice_many(&list);
        return NOTIFY_DONE;
 }
@@ -1110,6 +1114,9 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
        unsigned char ttls[MAXMIFS];
        int i;
+        if (mfc->mf6cc_parent >= MAXMIFS)
+                return -ENFILE;
        memset(ttls, 255, MAXMIFS);
        for (i = 0; i < MAXMIFS; i++) {
                if (IF_ISSET(i, &mfc->mf6cc_ifset))
@@ -1188,14 +1195,16 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
        int i;
+        LIST_HEAD(list);
        /*
         *      Shut down all active vif entries
         */
        for (i = 0; i < net->ipv6.maxvif; i++) {
                if (!(net->ipv6.vif6_table[i].flags & VIFF_STATIC))
-                        mif6_delete(net, i);
+                        mif6_delete(net, i, &list);
        }
+        unregister_netdevice_many(&list);
        /*
         *      Wipe the cache
@@ -1297,7 +1306,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
        switch (optname) {
        case MRT6_INIT:
                if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_ICMPV6)
+                    inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                        return -EOPNOTSUPP;
                if (optlen < sizeof(int))
                        return -EINVAL;
@@ -1325,7 +1334,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
                        return -EFAULT;
                rtnl_lock();
-                ret = mif6_delete(net, mifi);
+                ret = mif6_delete(net, mifi, NULL);
                rtnl_unlock();
                return ret;
@@ -1687,17 +1696,20 @@ ip6mr_fill_mroute(struct sk_buff *skb, struct mfc6_cache *c, struct rtmsg *rtm)
        int ct;
        struct rtnexthop *nhp;
        struct net *net = mfc6_net(c);
-        struct net_device *dev = net->ipv6.vif6_table[c->mf6c_parent].dev;
        u8 *b = skb_tail_pointer(skb);
        struct rtattr *mp_head;
-        if (dev)
+        /* If cache is unresolved, don't try to parse IIF and OIF */
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        if (c->mf6c_parent > MAXMIFS)
+                return -ENOENT;
+        if (MIF_EXISTS(net, c->mf6c_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv6.vif6_table[c->mf6c_parent].dev->ifindex);
        mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
        for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (MIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                        if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                goto rtattr_failure;
                        nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 2f2a5ca2c878..85cccd6ed0b7 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -53,6 +53,7 @@
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                u8 type, u8 code, int offset, __be32 info)
 {
+        struct net *net = dev_net(skb->dev);
        __be32 spi;
        struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
        struct ip_comp_hdr *ipcomph =
@@ -63,7 +64,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                return;
        spi = htonl(ntohs(ipcomph->cpi));
-        x = xfrm_state_lookup(&init_net, (xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
+        x = xfrm_state_lookup(net, skb->mark, (xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
        if (!x)
                return;
@@ -74,14 +75,15 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
 {
+        struct net *net = xs_net(x);
        struct xfrm_state *t = NULL;
-        t = xfrm_state_alloc(&init_net);
+        t = xfrm_state_alloc(net);
        if (!t)
                goto out;
        t->id.proto = IPPROTO_IPV6;
-        t->id.spi = xfrm6_tunnel_alloc_spi((xfrm_address_t *)&x->props.saddr);
+        t->id.spi = xfrm6_tunnel_alloc_spi(net, (xfrm_address_t *)&x->props.saddr);
        if (!t->id.spi)
                goto error;
@@ -90,6 +92,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
        t->props.family = AF_INET6;
        t->props.mode = x->props.mode;
        memcpy(t->props.saddr.a6, x->props.saddr.a6, sizeof(struct in6_addr));
+        memcpy(&t->mark, &x->mark, sizeof(t->mark));
        if (xfrm_init_state(t))
                goto error;
@@ -108,13 +111,15 @@ error:
 static int ipcomp6_tunnel_attach(struct xfrm_state *x)
 {
+        struct net *net = xs_net(x);
        int err = 0;
        struct xfrm_state *t = NULL;
        __be32 spi;
+        u32 mark = x->mark.m & x->mark.v;
-        spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&x->props.saddr);
+        spi = xfrm6_tunnel_spi_lookup(net, (xfrm_address_t *)&x->props.saddr);
        if (spi)
-                t = xfrm_state_lookup(&init_net, (xfrm_address_t *)&x->id.daddr,
+                t = xfrm_state_lookup(net, mark, (xfrm_address_t *)&x->id.daddr,
                                              spi, IPPROTO_IPV6, AF_INET6);
        if (!t) {
                t = ipcomp6_tunnel_create(x);
@@ -154,16 +159,12 @@ static int ipcomp6_init_state(struct xfrm_state *x)
        if (x->props.mode == XFRM_MODE_TUNNEL) {
                err = ipcomp6_tunnel_attach(x);
                if (err)
-                        goto error_tunnel;
+                        goto out;
        }
        err = 0;
 out:
        return err;
-error_tunnel:
-        ipcomp_destroy(x);
-        goto out;
 }
 static const struct xfrm_type ipcomp6_type =
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4f7aaf6996a3..33f60fca7aa7 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -36,6 +36,7 @@
 #include <linux/init.h>
 #include <linux/sysctl.h>
 #include <linux/netfilter.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -64,7 +65,7 @@ int ip6_ra_control(struct sock *sk, int sel)
        struct ip6_ra_chain *ra, *new_ra, **rap;
        /* RA packet may be delivered ONLY to IPPROTO_RAW socket */
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num != IPPROTO_RAW)
                return -ENOPROTOOPT;
        new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -106,7 +107,7 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
        if (inet_sk(sk)->is_icsk) {
                if (opt &&
                    !((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) &&
-                    inet_sk(sk)->daddr != LOOPBACK4_IPV6) {
+                    inet_sk(sk)->inet_daddr != LOOPBACK4_IPV6) {
                        struct inet_connection_sock *icsk = inet_csk(sk);
                        icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
                        icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
@@ -234,7 +235,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
        case IPV6_V6ONLY:
                if (optlen < sizeof(int) ||
-                    inet_sk(sk)->num)
+                    inet_sk(sk)->inet_num)
                        goto e_inval;
                np->ipv6only = valbool;
                retv = 0;
@@ -424,6 +425,7 @@ sticky_done:
                fl.fl6_flowlabel = 0;
                fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                if (optlen == 0)
                        goto update;
@@ -665,7 +667,7 @@ done:
        case IPV6_MTU_DISCOVER:
                if (optlen < sizeof(int))
                        goto e_inval;
-                if (val<0 || val>3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                        goto e_inval;
                np->pmtudisc = val;
                retv = 0;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f9fcf690bd5d..c483ab9fd67b 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -43,6 +43,7 @@
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/slab.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
@@ -793,10 +794,10 @@ static void mld_add_delrec(struct inet6_dev *idev, struct ifmcaddr6 *im)
        }
        spin_unlock_bh(&im->mca_lock);
-        write_lock_bh(&idev->mc_lock);
+        spin_lock_bh(&idev->mc_lock);
        pmc->next = idev->mc_tomb;
        idev->mc_tomb = pmc;
-        write_unlock_bh(&idev->mc_lock);
+        spin_unlock_bh(&idev->mc_lock);
 }
 static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
@@ -804,7 +805,7 @@ static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
        struct ifmcaddr6 *pmc, *pmc_prev;
        struct ip6_sf_list *psf, *psf_next;
-        write_lock_bh(&idev->mc_lock);
+        spin_lock_bh(&idev->mc_lock);
        pmc_prev = NULL;
        for (pmc=idev->mc_tomb; pmc; pmc=pmc->next) {
                if (ipv6_addr_equal(&pmc->mca_addr, pmca))
@@ -817,7 +818,8 @@ static void mld_del_delrec(struct inet6_dev *idev, struct in6_addr *pmca)
                else
                        idev->mc_tomb = pmc->next;
        }
-        write_unlock_bh(&idev->mc_lock);
+        spin_unlock_bh(&idev->mc_lock);
        if (pmc) {
                for (psf=pmc->mca_tomb; psf; psf=psf_next) {
                        psf_next = psf->sf_next;
@@ -832,10 +834,10 @@ static void mld_clear_delrec(struct inet6_dev *idev)
 {
        struct ifmcaddr6 *pmc, *nextpmc;
-        write_lock_bh(&idev->mc_lock);
+        spin_lock_bh(&idev->mc_lock);
        pmc = idev->mc_tomb;
        idev->mc_tomb = NULL;
-        write_unlock_bh(&idev->mc_lock);
+        spin_unlock_bh(&idev->mc_lock);
        for (; pmc; pmc = nextpmc) {
                nextpmc = pmc->next;
@@ -1696,7 +1698,7 @@ static void mld_send_cr(struct inet6_dev *idev)
        int type, dtype;
        read_lock_bh(&idev->lock);
-        write_lock_bh(&idev->mc_lock);
+        spin_lock(&idev->mc_lock);
        /* deleted MCA's */
        pmc_prev = NULL;
@@ -1730,7 +1732,7 @@ static void mld_send_cr(struct inet6_dev *idev)
                } else
                        pmc_prev = pmc;
        }
-        write_unlock_bh(&idev->mc_lock);
+        spin_unlock(&idev->mc_lock);
        /* change recs */
        for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
@@ -2311,7 +2313,7 @@ void ipv6_mc_up(struct inet6_dev *idev)
 void ipv6_mc_init_dev(struct inet6_dev *idev)
 {
        write_lock_bh(&idev->lock);
-        rwlock_init(&idev->mc_lock);
+        spin_lock_init(&idev->mc_lock);
        idev->mc_gq_running = 0;
        setup_timer(&idev->mc_gq_timer, mld_gq_timer_expire,
                        (unsigned long)idev);
@@ -2375,9 +2377,9 @@ static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
        struct net *net = seq_file_net(seq);
        state->idev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                if (!idev)
                        continue;
                read_lock_bh(&idev->lock);
@@ -2387,7 +2389,6 @@ static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
                        break;
                }
                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
        }
        return im;
 }
@@ -2398,16 +2399,15 @@ static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr
        im = im->next;
        while (!im) {
-                if (likely(state->idev != NULL)) {
+                if (likely(state->idev != NULL))
                        read_unlock_bh(&state->idev->lock);
-                        in6_dev_put(state->idev);
-                }
+                state->dev = next_net_device_rcu(state->dev);
-                state->dev = next_net_device(state->dev);
                if (!state->dev) {
                        state->idev = NULL;
                        break;
                }
-                state->idev = in6_dev_get(state->dev);
+                state->idev = __in6_dev_get(state->dev);
                if (!state->idev)
                        continue;
                read_lock_bh(&state->idev->lock);
@@ -2426,31 +2426,31 @@ static struct ifmcaddr6 *igmp6_mc_get_idx(struct seq_file *seq, loff_t pos)
 }
 static void *igmp6_mc_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
        return igmp6_mc_get_idx(seq, *pos);
 }
 static void *igmp6_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ifmcaddr6 *im;
+        struct ifmcaddr6 *im = igmp6_mc_get_next(seq, v);
-        im = igmp6_mc_get_next(seq, v);
        ++*pos;
        return im;
 }
 static void igmp6_mc_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
        struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
        if (likely(state->idev != NULL)) {
                read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
                state->idev = NULL;
        }
        state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
@@ -2507,9 +2507,9 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
        state->idev = NULL;
        state->im = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                if (unlikely(idev == NULL))
                        continue;
                read_lock_bh(&idev->lock);
@@ -2525,7 +2525,6 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
                        spin_unlock_bh(&im->mca_lock);
                }
                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
        }
        return psf;
 }
@@ -2539,16 +2538,15 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
                spin_unlock_bh(&state->im->mca_lock);
                state->im = state->im->next;
                while (!state->im) {
-                        if (likely(state->idev != NULL)) {
+                        if (likely(state->idev != NULL))
                                read_unlock_bh(&state->idev->lock);
-                                in6_dev_put(state->idev);
-                        }
+                        state->dev = next_net_device_rcu(state->dev);
-                        state->dev = next_net_device(state->dev);
                        if (!state->dev) {
                                state->idev = NULL;
                                goto out;
                        }
-                        state->idev = in6_dev_get(state->dev);
+                        state->idev = __in6_dev_get(state->dev);
                        if (!state->idev)
                                continue;
                        read_lock_bh(&state->idev->lock);
@@ -2573,9 +2571,9 @@ static struct ip6_sf_list *igmp6_mcf_get_idx(struct seq_file *seq, loff_t pos)
 }
 static void *igmp6_mcf_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
        return *pos ? igmp6_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
@@ -2591,7 +2589,7 @@ static void *igmp6_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
        struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
        if (likely(state->im != NULL)) {
@@ -2600,11 +2598,10 @@ static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
        }
        if (likely(state->idev != NULL)) {
                read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
                state->idev = NULL;
        }
        state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
@@ -2651,7 +2648,7 @@ static const struct file_operations igmp6_mcf_seq_fops = {
        .release        =       seq_release_net,
 };
-static int igmp6_proc_init(struct net *net)
+static int __net_init igmp6_proc_init(struct net *net)
 {
        int err;
@@ -2671,23 +2668,22 @@ out_proc_net_igmp6:
        goto out;
 }
-static void igmp6_proc_exit(struct net *net)
+static void __net_exit igmp6_proc_exit(struct net *net)
 {
        proc_net_remove(net, "mcfilter6");
        proc_net_remove(net, "igmp6");
 }
 #else
-static int igmp6_proc_init(struct net *net)
+static inline int igmp6_proc_init(struct net *net)
 {
        return 0;
 }
-static void igmp6_proc_exit(struct net *net)
+static inline void igmp6_proc_exit(struct net *net)
 {
-        ;
 }
 #endif
-static int igmp6_net_init(struct net *net)
+static int __net_init igmp6_net_init(struct net *net)
 {
        int err;
@@ -2713,7 +2709,7 @@ out_sock_create:
        goto out;
 }
-static void igmp6_net_exit(struct net *net)
+static void __net_exit igmp6_net_exit(struct net *net)
 {
        inet_ctl_sock_destroy(net->ipv6.igmp_sk);
        igmp6_proc_exit(net);
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index f797e8c6f3b3..2794b6002836 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -56,7 +56,7 @@ static inline void *mip6_padn(__u8 *data, __u8 padlen)
 static inline void mip6_param_prob(struct sk_buff *skb, u8 code, int pos)
 {
-        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos, skb->dev);
+        icmpv6_send(skb, ICMPV6_PARAMPROB, code, pos);
 }
 static int mip6_mh_len(int type)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index f74e4e2cdd06..da0a4d2adc69 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -59,6 +59,7 @@
 #include <linux/route.h>
 #include <linux/init.h>
 #include <linux/rcupdate.h>
+#include <linux/slab.h>
 #ifdef CONFIG_SYSCTL
 #include <linux/sysctl.h>
 #endif
@@ -598,6 +599,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
        icmp6h.icmp6_solicited = solicited;
        icmp6h.icmp6_override = override;
+        inc_opt |= ifp->idev->cnf.force_tllao;
        __ndisc_send(dev, neigh, daddr, src_addr,
                     &icmp6h, solicited_addr,
                     inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
@@ -1768,46 +1770,10 @@ int ndisc_ifinfo_sysctl_change(struct ctl_table *ctl, int write, void __user *bu
        return ret;
 }
-int ndisc_ifinfo_sysctl_strategy(ctl_table *ctl,
-                                 void __user *oldval, size_t __user *oldlenp,
-                                 void __user *newval, size_t newlen)
-{
-        struct net_device *dev = ctl->extra1;
-        struct inet6_dev *idev;
-        int ret;
-        if (ctl->ctl_name == NET_NEIGH_RETRANS_TIME ||
-            ctl->ctl_name == NET_NEIGH_REACHABLE_TIME)
-                ndisc_warn_deprecated_sysctl(ctl, "procfs", dev ? dev->name : "default");
-        switch (ctl->ctl_name) {
-        case NET_NEIGH_REACHABLE_TIME:
-                ret = sysctl_jiffies(ctl, oldval, oldlenp, newval, newlen);
-                break;
-        case NET_NEIGH_RETRANS_TIME_MS:
-        case NET_NEIGH_REACHABLE_TIME_MS:
-                 ret = sysctl_ms_jiffies(ctl, oldval, oldlenp, newval, newlen);
-                 break;
-        default:
-                ret = 0;
-        }
-        if (newval && newlen && ret > 0 &&
-            dev && (idev = in6_dev_get(dev)) != NULL) {
-                if (ctl->ctl_name == NET_NEIGH_REACHABLE_TIME ||
-                    ctl->ctl_name == NET_NEIGH_REACHABLE_TIME_MS)
-                        idev->nd_parms->reachable_time = neigh_rand_reach_time(idev->nd_parms->base_reachable_time);
-                idev->tstamp = jiffies;
-                inet6_ifinfo_notify(RTM_NEWLINK, idev);
-                in6_dev_put(idev);
-        }
-        return ret;
-}
 #endif
-static int ndisc_net_init(struct net *net)
+static int __net_init ndisc_net_init(struct net *net)
 {
        struct ipv6_pinfo *np;
        struct sock *sk;
@@ -1832,7 +1798,7 @@ static int ndisc_net_init(struct net *net)
        return 0;
 }
-static void ndisc_net_exit(struct net *net)
+static void __net_exit ndisc_net_exit(struct net *net)
 {
        inet_ctl_sock_destroy(net->ipv6.ndisc_sk);
 }
@@ -1855,10 +1821,8 @@ int __init ndisc_init(void)
        neigh_table_init(&nd_tbl);
 #ifdef CONFIG_SYSCTL
-        err = neigh_sysctl_register(NULL, &nd_tbl.parms, NET_IPV6,
+        err = neigh_sysctl_register(NULL, &nd_tbl.parms, "ipv6",
-                                    NET_IPV6_NEIGH, "ipv6",
+                                    &ndisc_ifinfo_sysctl_change);
-                                    &ndisc_ifinfo_sysctl_change,
-                                    &ndisc_ifinfo_sysctl_strategy);
        if (err)
                goto out_unregister_pernet;
 #endif
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 1cf3f0c6a959..6a68a74d14a3 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -25,6 +25,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/mutex.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/sock.h>
 #include <net/ipv6.h>
@@ -36,7 +37,6 @@
 #define IPQ_QMAX_DEFAULT 1024
 #define IPQ_PROC_FS_NAME "ip6_queue"
-#define NET_IPQ_QMAX 2088
 #define NET_IPQ_QMAX_NAME "ip6_queue_maxlen"
 typedef int (*ipq_cmpfn)(struct nf_queue_entry *, unsigned long);
@@ -499,10 +499,9 @@ ipq_rcv_nl_event(struct notifier_block *this,
 {
        struct netlink_notify *n = ptr;
-        if (event == NETLINK_URELEASE &&
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_IP6_FW) {
-            n->protocol == NETLINK_IP6_FW && n->pid) {
                write_lock_bh(&queue_lock);
-                if ((n->net == &init_net) && (n->pid == peer_pid))
+                if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
                        __ipq_reset();
                write_unlock_bh(&queue_lock);
        }
@@ -518,14 +517,13 @@ static struct ctl_table_header *ipq_sysctl_header;
 static ctl_table ipq_table[] = {
        {
-                .ctl_name       = NET_IPQ_QMAX,
                .procname       = NET_IPQ_QMAX_NAME,
                .data           = &queue_maxlen,
                .maxlen         = sizeof(queue_maxlen),
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
-        { .ctl_name = 0 }
+        { }
 };
 #endif
@@ -625,7 +623,7 @@ cleanup_netlink_notifier:
 static void __exit ip6_queue_fini(void)
 {
        nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
        ipq_flush(NULL, 0);
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index cc9f8ef303fd..9210e312edf1 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -29,6 +29,7 @@
 #include <linux/netfilter_ipv6/ip6_tables.h>
 #include <linux/netfilter/x_tables.h>
 #include <net/netfilter/nf_log.h>
+#include "../../netfilter/xt_repldata.h"
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -67,6 +68,12 @@ do {								\
 #define inline
 #endif
+void *ip6t_alloc_initial_table(const struct xt_table *info)
+{
+        return xt_alloc_initial_table(ip6t, IP6T);
+}
+EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 /*
   We keep a set of rules for each CPU, so we can avoid write-locking
   them in the softirq when updating the counters and therefore
@@ -105,9 +112,9 @@ ip6_packet_match(const struct sk_buff *skb,
 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
        if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
-                                       &ip6info->src), IP6T_INV_SRCIP)
+                                       &ip6info->src), IP6T_INV_SRCIP) ||
-            || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
+            FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
-                                          &ip6info->dst), IP6T_INV_DSTIP)) {
+                                       &ip6info->dst), IP6T_INV_DSTIP)) {
                dprintf("Source or dest mismatch.\n");
 /*
                dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
@@ -201,7 +208,7 @@ ip6t_error(struct sk_buff *skb, const struct xt_target_param *par)
 /* Performance critical - called for every packet */
 static inline bool
-do_match(struct ip6t_entry_match *m, const struct sk_buff *skb,
+do_match(const struct ip6t_entry_match *m, const struct sk_buff *skb,
         struct xt_match_param *par)
 {
        par->match     = m->u.kernel.match;
@@ -215,7 +222,7 @@ do_match(struct ip6t_entry_match *m, const struct sk_buff *skb,
 }
 static inline struct ip6t_entry *
-get_entry(void *base, unsigned int offset)
+get_entry(const void *base, unsigned int offset)
 {
        return (struct ip6t_entry *)(base + offset);
 }
@@ -229,6 +236,12 @@ static inline bool unconditional(const struct ip6t_ip6 *ipv6)
        return memcmp(ipv6, &uncond, sizeof(uncond)) == 0;
 }
+static inline const struct ip6t_entry_target *
+ip6t_get_target_c(const struct ip6t_entry *e)
+{
+        return ip6t_get_target((struct ip6t_entry *)e);
+}
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
    defined(CONFIG_NETFILTER_XT_TARGET_TRACE_MODULE)
 /* This cries for unification! */
@@ -264,11 +277,11 @@ static struct nf_loginfo trace_loginfo = {
 /* Mildly perf critical (only if packet tracing is on) */
 static inline int
-get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
+get_chainname_rulenum(const struct ip6t_entry *s, const struct ip6t_entry *e,
                      const char *hookname, const char **chainname,
                      const char **comment, unsigned int *rulenum)
 {
-        struct ip6t_standard_target *t = (void *)ip6t_get_target(s);
+        const struct ip6t_standard_target *t = (void *)ip6t_get_target_c(s);
        if (strcmp(t->target.u.kernel.target->name, IP6T_ERROR_TARGET) == 0) {
                /* Head of user chain: ERROR target with chainname */
@@ -277,11 +290,11 @@ get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
        } else if (s == e) {
                (*rulenum)++;
-                if (s->target_offset == sizeof(struct ip6t_entry)
+                if (s->target_offset == sizeof(struct ip6t_entry) &&
-                   && strcmp(t->target.u.kernel.target->name,
+                    strcmp(t->target.u.kernel.target->name,
-                             IP6T_STANDARD_TARGET) == 0
+                           IP6T_STANDARD_TARGET) == 0 &&
-                   && t->verdict < 0
+                    t->verdict < 0 &&
-                   && unconditional(&s->ipv6)) {
+                    unconditional(&s->ipv6)) {
                        /* Tail of chains: STANDARD target (return/policy) */
                        *comment = *chainname == hookname
                                ? comments[NF_IP6_TRACE_COMMENT_POLICY]
@@ -294,17 +307,18 @@ get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
        return 0;
 }
-static void trace_packet(struct sk_buff *skb,
+static void trace_packet(const struct sk_buff *skb,
                         unsigned int hook,
                         const struct net_device *in,
                         const struct net_device *out,
                         const char *tablename,
-                         struct xt_table_info *private,
+                         const struct xt_table_info *private,
-                         struct ip6t_entry *e)
+                         const struct ip6t_entry *e)
 {
-        void *table_base;
+        const void *table_base;
        const struct ip6t_entry *root;
        const char *hookname, *chainname, *comment;
+        const struct ip6t_entry *iter;
        unsigned int rulenum = 0;
        table_base = private->entries[smp_processor_id()];
@@ -313,10 +327,10 @@ static void trace_packet(struct sk_buff *skb,
        hookname = chainname = hooknames[hook];
        comment = comments[NF_IP6_TRACE_COMMENT_RULE];
-        IP6T_ENTRY_ITERATE(root,
+        xt_entry_foreach(iter, root, private->size - private->hook_entry[hook])
-                           private->size - private->hook_entry[hook],
+                if (get_chainname_rulenum(iter, e, hookname,
-                           get_chainname_rulenum,
+                    &chainname, &comment, &rulenum) != 0)
-                           e, hookname, &chainname, &comment, &rulenum);
+                        break;
        nf_log_packet(AF_INET6, hook, skb, in, out, &trace_loginfo,
                      "TRACE: %s:%s:%s:%u ",
@@ -345,9 +359,9 @@ ip6t_do_table(struct sk_buff *skb,
        /* Initializing verdict to NF_DROP keeps gcc happy. */
        unsigned int verdict = NF_DROP;
        const char *indev, *outdev;
-        void *table_base;
+        const void *table_base;
        struct ip6t_entry *e, *back;
-        struct xt_table_info *private;
+        const struct xt_table_info *private;
        struct xt_match_param mtpar;
        struct xt_target_param tgpar;
@@ -378,22 +392,27 @@ ip6t_do_table(struct sk_buff *skb,
        back = get_entry(table_base, private->underflow[hook]);
        do {
-                struct ip6t_entry_target *t;
+                const struct ip6t_entry_target *t;
+                const struct xt_entry_match *ematch;
                IP_NF_ASSERT(e);
                IP_NF_ASSERT(back);
                if (!ip6_packet_match(skb, indev, outdev, &e->ipv6,
-                    &mtpar.thoff, &mtpar.fragoff, &hotdrop) ||
+                    &mtpar.thoff, &mtpar.fragoff, &hotdrop)) {
-                    IP6T_MATCH_ITERATE(e, do_match, skb, &mtpar) != 0) {
+ no_match:
                        e = ip6t_next_entry(e);
                        continue;
                }
+                xt_ematch_foreach(ematch, e)
+                        if (do_match(ematch, skb, &mtpar) != 0)
+                                goto no_match;
                ADD_COUNTER(e->counters,
                            ntohs(ipv6_hdr(skb)->payload_len) +
                            sizeof(struct ipv6hdr), 1);
-                t = ip6t_get_target(e);
+                t = ip6t_get_target_c(e);
                IP_NF_ASSERT(t->u.kernel.target);
 #if defined(CONFIG_NETFILTER_XT_TARGET_TRACE) || \
@@ -418,8 +437,8 @@ ip6t_do_table(struct sk_buff *skb,
                                back = get_entry(table_base, back->comefrom);
                                continue;
                        }
-                        if (table_base + v != ip6t_next_entry(e)
+                        if (table_base + v != ip6t_next_entry(e) &&
-                            && !(e->ipv6.flags & IP6T_F_GOTO)) {
+                            !(e->ipv6.flags & IP6T_F_GOTO)) {
                                /* Save old back ptr in next entry */
                                struct ip6t_entry *next = ip6t_next_entry(e);
                                next->comefrom = (void *)back - table_base;
@@ -475,7 +494,7 @@ ip6t_do_table(struct sk_buff *skb,
 /* Figures out from what hook each rule can be called: returns 0 if
   there are loops.  Puts hook bitmask in comefrom. */
 static int
-mark_source_chains(struct xt_table_info *newinfo,
+mark_source_chains(const struct xt_table_info *newinfo,
                   unsigned int valid_hooks, void *entry0)
 {
        unsigned int hook;
@@ -493,8 +512,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                e->counters.pcnt = pos;
                for (;;) {
-                        struct ip6t_standard_target *t
+                        const struct ip6t_standard_target *t
-                                = (void *)ip6t_get_target(e);
+                                = (void *)ip6t_get_target_c(e);
                        int visited = e->comefrom & (1 << hook);
                        if (e->comefrom & (1 << NF_INET_NUMHOOKS)) {
@@ -505,11 +524,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                        e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
                        /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ip6t_entry)
+                        if ((e->target_offset == sizeof(struct ip6t_entry) &&
-                            && (strcmp(t->target.u.user.name,
+                             (strcmp(t->target.u.user.name,
-                                       IP6T_STANDARD_TARGET) == 0)
+                                     IP6T_STANDARD_TARGET) == 0) &&
-                            && t->verdict < 0
+                             t->verdict < 0 &&
-                            && unconditional(&e->ipv6)) || visited) {
+                             unconditional(&e->ipv6)) || visited) {
                                unsigned int oldpos, size;
                                if ((strcmp(t->target.u.user.name,
@@ -556,8 +575,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                int newpos = t->verdict;
                                if (strcmp(t->target.u.user.name,
-                                           IP6T_STANDARD_TARGET) == 0
+                                           IP6T_STANDARD_TARGET) == 0 &&
-                                    && newpos >= 0) {
+                                    newpos >= 0) {
                                        if (newpos > newinfo->size -
                                                sizeof(struct ip6t_entry)) {
                                                duprintf("mark_source_chains: "
@@ -584,27 +603,23 @@ mark_source_chains(struct xt_table_info *newinfo,
        return 1;
 }
-static int
+static void cleanup_match(struct ip6t_entry_match *m, struct net *net)
-cleanup_match(struct ip6t_entry_match *m, unsigned int *i)
 {
        struct xt_mtdtor_param par;
-        if (i && (*i)-- == 0)
+        par.net       = net;
-                return 1;
        par.match     = m->u.kernel.match;
        par.matchinfo = m->data;
        par.family    = NFPROTO_IPV6;
        if (par.match->destroy != NULL)
                par.match->destroy(&par);
        module_put(par.match->me);
-        return 0;
 }
 static int
-check_entry(struct ip6t_entry *e, const char *name)
+check_entry(const struct ip6t_entry *e, const char *name)
 {
-        struct ip6t_entry_target *t;
+        const struct ip6t_entry_target *t;
        if (!ip6_checkentry(&e->ipv6)) {
                duprintf("ip_tables: ip check failed %p %s.\n", e, name);
@@ -615,15 +630,14 @@ check_entry(struct ip6t_entry *e, const char *name)
            e->next_offset)
                return -EINVAL;
-        t = ip6t_get_target(e);
+        t = ip6t_get_target_c(e);
        if (e->target_offset + t->u.target_size > e->next_offset)
                return -EINVAL;
        return 0;
 }
-static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
+static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par)
-                       unsigned int *i)
 {
        const struct ip6t_ip6 *ipv6 = par->entryinfo;
        int ret;
@@ -638,13 +652,11 @@ static int check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
                         par.match->name);
                return ret;
        }
-        ++*i;
        return 0;
 }
 static int
-find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
+find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par)
-                 unsigned int *i)
 {
        struct xt_match *match;
        int ret;
@@ -658,7 +670,7 @@ find_check_match(struct ip6t_entry_match *m, struct xt_mtchk_param *par,
        }
        m->u.kernel.match = match;
-        ret = check_match(m, par, i);
+        ret = check_match(m, par);
        if (ret)
                goto err;
@@ -668,10 +680,11 @@ err:
        return ret;
 }
-static int check_target(struct ip6t_entry *e, const char *name)
+static int check_target(struct ip6t_entry *e, struct net *net, const char *name)
 {
        struct ip6t_entry_target *t = ip6t_get_target(e);
        struct xt_tgchk_param par = {
+                .net       = net,
                .table     = name,
                .entryinfo = e,
                .target    = t->u.kernel.target,
@@ -693,27 +706,32 @@ static int check_target(struct ip6t_entry *e, const char *name)
 }
 static int
-find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
+find_check_entry(struct ip6t_entry *e, struct net *net, const char *name,
-                 unsigned int *i)
+                 unsigned int size)
 {
        struct ip6t_entry_target *t;
        struct xt_target *target;
        int ret;
        unsigned int j;
        struct xt_mtchk_param mtpar;
+        struct xt_entry_match *ematch;
        ret = check_entry(e, name);
        if (ret)
                return ret;
        j = 0;
+        mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ipv6;
        mtpar.hook_mask = e->comefrom;
        mtpar.family    = NFPROTO_IPV6;
-        ret = IP6T_MATCH_ITERATE(e, find_check_match, &mtpar, &j);
+        xt_ematch_foreach(ematch, e) {
-        if (ret != 0)
+                ret = find_check_match(ematch, &mtpar);
-                goto cleanup_matches;
+                if (ret != 0)
+                        goto cleanup_matches;
+                ++j;
+        }
        t = ip6t_get_target(e);
        target = try_then_request_module(xt_find_target(AF_INET6,
@@ -727,27 +745,29 @@ find_check_entry(struct ip6t_entry *e, const char *name, unsigned int size,
        }
        t->u.kernel.target = target;
-        ret = check_target(e, name);
+        ret = check_target(e, net, name);
        if (ret)
                goto err;
-        (*i)++;
        return 0;
 err:
        module_put(t->u.kernel.target->me);
 cleanup_matches:
-        IP6T_MATCH_ITERATE(e, cleanup_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                cleanup_match(ematch, net);
+        }
        return ret;
 }
-static bool check_underflow(struct ip6t_entry *e)
+static bool check_underflow(const struct ip6t_entry *e)
 {
        const struct ip6t_entry_target *t;
        unsigned int verdict;
        if (!unconditional(&e->ipv6))
                return false;
-        t = ip6t_get_target(e);
+        t = ip6t_get_target_c(e);
        if (strcmp(t->u.user.name, XT_STANDARD_TARGET) != 0)
                return false;
        verdict = ((struct ip6t_standard_target *)t)->verdict;
@@ -758,17 +778,16 @@ static bool check_underflow(struct ip6t_entry *e)
 static int
 check_entry_size_and_hooks(struct ip6t_entry *e,
                           struct xt_table_info *newinfo,
-                           unsigned char *base,
+                           const unsigned char *base,
-                           unsigned char *limit,
+                           const unsigned char *limit,
                           const unsigned int *hook_entries,
                           const unsigned int *underflows,
-                           unsigned int valid_hooks,
+                           unsigned int valid_hooks)
-                           unsigned int *i)
 {
        unsigned int h;
-        if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0
+        if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
-            || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
                duprintf("Bad offset %p\n", e);
                return -EINVAL;
        }
@@ -800,50 +819,41 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
        /* Clear counters and comefrom */
        e->counters = ((struct xt_counters) { 0, 0 });
        e->comefrom = 0;
-        (*i)++;
        return 0;
 }
-static int
+static void cleanup_entry(struct ip6t_entry *e, struct net *net)
-cleanup_entry(struct ip6t_entry *e, unsigned int *i)
 {
        struct xt_tgdtor_param par;
        struct ip6t_entry_target *t;
+        struct xt_entry_match *ematch;
-        if (i && (*i)-- == 0)
-                return 1;
        /* Cleanup all matches */
-        IP6T_MATCH_ITERATE(e, cleanup_match, NULL);
+        xt_ematch_foreach(ematch, e)
+                cleanup_match(ematch, net);
        t = ip6t_get_target(e);
+        par.net      = net;
        par.target   = t->u.kernel.target;
        par.targinfo = t->data;
        par.family   = NFPROTO_IPV6;
        if (par.target->destroy != NULL)
                par.target->destroy(&par);
        module_put(par.target->me);
-        return 0;
 }
 /* Checks and translates the user-supplied table segment (held in
   newinfo) */
 static int
-translate_table(const char *name,
+translate_table(struct net *net, struct xt_table_info *newinfo, void *entry0,
-                unsigned int valid_hooks,
+                const struct ip6t_replace *repl)
-                struct xt_table_info *newinfo,
-                void *entry0,
-                unsigned int size,
-                unsigned int number,
-                const unsigned int *hook_entries,
-                const unsigned int *underflows)
 {
+        struct ip6t_entry *iter;
        unsigned int i;
-        int ret;
+        int ret = 0;
-        newinfo->size = size;
+        newinfo->size = repl->size;
-        newinfo->number = number;
+        newinfo->number = repl->num_entries;
        /* Init all hooks to impossible value. */
        for (i = 0; i < NF_INET_NUMHOOKS; i++) {
@@ -854,49 +864,58 @@ translate_table(const char *name,
        duprintf("translate_table: size %u\n", newinfo->size);
        i = 0;
        /* Walk through entries, checking offsets. */
-        ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
+        xt_entry_foreach(iter, entry0, newinfo->size) {
-                                check_entry_size_and_hooks,
+                ret = check_entry_size_and_hooks(iter, newinfo, entry0,
-                                newinfo,
+                                                 entry0 + repl->size,
-                                entry0,
+                                                 repl->hook_entry,
-                                entry0 + size,
+                                                 repl->underflow,
-                                hook_entries, underflows, valid_hooks, &i);
+                                                 repl->valid_hooks);
-        if (ret != 0)
+                if (ret != 0)
-                return ret;
+                        return ret;
+                ++i;
+        }
-        if (i != number) {
+        if (i != repl->num_entries) {
                duprintf("translate_table: %u not %u entries\n",
-                         i, number);
+                         i, repl->num_entries);
                return -EINVAL;
        }
        /* Check hooks all assigned */
        for (i = 0; i < NF_INET_NUMHOOKS; i++) {
                /* Only hooks which are valid */
-                if (!(valid_hooks & (1 << i)))
+                if (!(repl->valid_hooks & (1 << i)))
                        continue;
                if (newinfo->hook_entry[i] == 0xFFFFFFFF) {
                        duprintf("Invalid hook entry %u %u\n",
-                                 i, hook_entries[i]);
+                                 i, repl->hook_entry[i]);
                        return -EINVAL;
                }
                if (newinfo->underflow[i] == 0xFFFFFFFF) {
                        duprintf("Invalid underflow %u %u\n",
-                                 i, underflows[i]);
+                                 i, repl->underflow[i]);
                        return -EINVAL;
                }
        }
-        if (!mark_source_chains(newinfo, valid_hooks, entry0))
+        if (!mark_source_chains(newinfo, repl->valid_hooks, entry0))
                return -ELOOP;
        /* Finally, each sanity check must pass */
        i = 0;
-        ret = IP6T_ENTRY_ITERATE(entry0, newinfo->size,
+        xt_entry_foreach(iter, entry0, newinfo->size) {
-                                find_check_entry, name, size, &i);
+                ret = find_check_entry(iter, net, repl->name, repl->size);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
        if (ret != 0) {
-                IP6T_ENTRY_ITERATE(entry0, newinfo->size,
+                xt_entry_foreach(iter, entry0, newinfo->size) {
-                                   cleanup_entry, &i);
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter, net);
+                }
                return ret;
        }
@@ -909,33 +928,11 @@ translate_table(const char *name,
        return ret;
 }
-/* Gets counters. */
-static inline int
-add_entry_to_counter(const struct ip6t_entry *e,
-                     struct xt_counters total[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-        (*i)++;
-        return 0;
-}
-static inline int
-set_entry_to_counter(const struct ip6t_entry *e,
-                     struct ip6t_counters total[],
-                     unsigned int *i)
-{
-        SET_COUNTER(total[*i], e->counters.bcnt, e->counters.pcnt);
-        (*i)++;
-        return 0;
-}
 static void
 get_counters(const struct xt_table_info *t,
             struct xt_counters counters[])
 {
+        struct ip6t_entry *iter;
        unsigned int cpu;
        unsigned int i;
        unsigned int curcpu;
@@ -951,32 +948,32 @@ get_counters(const struct xt_table_info *t,
        curcpu = smp_processor_id();
        i = 0;
-        IP6T_ENTRY_ITERATE(t->entries[curcpu],
+        xt_entry_foreach(iter, t->entries[curcpu], t->size) {
-                           t->size,
+                SET_COUNTER(counters[i], iter->counters.bcnt,
-                           set_entry_to_counter,
+                            iter->counters.pcnt);
-                           counters,
+                ++i;
-                           &i);
+        }
        for_each_possible_cpu(cpu) {
                if (cpu == curcpu)
                        continue;
                i = 0;
                xt_info_wrlock(cpu);
-                IP6T_ENTRY_ITERATE(t->entries[cpu],
+                xt_entry_foreach(iter, t->entries[cpu], t->size) {
-                                  t->size,
+                        ADD_COUNTER(counters[i], iter->counters.bcnt,
-                                  add_entry_to_counter,
+                                    iter->counters.pcnt);
-                                  counters,
+                        ++i;
-                                  &i);
+                }
                xt_info_wrunlock(cpu);
        }
        local_bh_enable();
 }
-static struct xt_counters *alloc_counters(struct xt_table *table)
+static struct xt_counters *alloc_counters(const struct xt_table *table)
 {
        unsigned int countersize;
        struct xt_counters *counters;
-        struct xt_table_info *private = table->private;
+        const struct xt_table_info *private = table->private;
        /* We need atomic snapshot of counters: rest doesn't change
           (other than comefrom, which userspace doesn't care
@@ -994,11 +991,11 @@ static struct xt_counters *alloc_counters(struct xt_table *table)
 static int
 copy_entries_to_user(unsigned int total_size,
-                     struct xt_table *table,
+                     const struct xt_table *table,
                     void __user *userptr)
 {
        unsigned int off, num;
-        struct ip6t_entry *e;
+        const struct ip6t_entry *e;
        struct xt_counters *counters;
        const struct xt_table_info *private = table->private;
        int ret = 0;
@@ -1050,7 +1047,7 @@ copy_entries_to_user(unsigned int total_size,
                        }
                }
-                t = ip6t_get_target(e);
+                t = ip6t_get_target_c(e);
                if (copy_to_user(userptr + off + e->target_offset
                                 + offsetof(struct ip6t_entry_target,
                                            u.user.name),
@@ -1067,7 +1064,7 @@ copy_entries_to_user(unsigned int total_size,
 }
 #ifdef CONFIG_COMPAT
-static void compat_standard_from_user(void *dst, void *src)
+static void compat_standard_from_user(void *dst, const void *src)
 {
        int v = *(compat_int_t *)src;
@@ -1076,7 +1073,7 @@ static void compat_standard_from_user(void *dst, void *src)
        memcpy(dst, &v, sizeof(v));
 }
-static int compat_standard_to_user(void __user *dst, void *src)
+static int compat_standard_to_user(void __user *dst, const void *src)
 {
        compat_int_t cv = *(int *)src;
@@ -1085,25 +1082,20 @@ static int compat_standard_to_user(void __user *dst, void *src)
        return copy_to_user(dst, &cv, sizeof(cv)) ? -EFAULT : 0;
 }
-static inline int
+static int compat_calc_entry(const struct ip6t_entry *e,
-compat_calc_match(struct ip6t_entry_match *m, int *size)
-{
-        *size += xt_compat_match_offset(m->u.kernel.match);
-        return 0;
-}
-static int compat_calc_entry(struct ip6t_entry *e,
                             const struct xt_table_info *info,
-                             void *base, struct xt_table_info *newinfo)
+                             const void *base, struct xt_table_info *newinfo)
 {
-        struct ip6t_entry_target *t;
+        const struct xt_entry_match *ematch;
+        const struct ip6t_entry_target *t;
        unsigned int entry_offset;
        int off, i, ret;
        off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
        entry_offset = (void *)e - base;
-        IP6T_MATCH_ITERATE(e, compat_calc_match, &off);
+        xt_ematch_foreach(ematch, e)
-        t = ip6t_get_target(e);
+                off += xt_compat_match_offset(ematch->u.kernel.match);
+        t = ip6t_get_target_c(e);
        off += xt_compat_target_offset(t->u.kernel.target);
        newinfo->size -= off;
        ret = xt_compat_add_offset(AF_INET6, entry_offset, off);
@@ -1124,7 +1116,9 @@ static int compat_calc_entry(struct ip6t_entry *e,
 static int compat_table_info(const struct xt_table_info *info,
                             struct xt_table_info *newinfo)
 {
+        struct ip6t_entry *iter;
        void *loc_cpu_entry;
+        int ret;
        if (!newinfo || !info)
                return -EINVAL;
@@ -1133,13 +1127,17 @@ static int compat_table_info(const struct xt_table_info *info,
        memcpy(newinfo, info, offsetof(struct xt_table_info, entries));
        newinfo->initial_entries = 0;
        loc_cpu_entry = info->entries[raw_smp_processor_id()];
-        return IP6T_ENTRY_ITERATE(loc_cpu_entry, info->size,
+        xt_entry_foreach(iter, loc_cpu_entry, info->size) {
-                                  compat_calc_entry, info, loc_cpu_entry,
+                ret = compat_calc_entry(iter, info, loc_cpu_entry, newinfo);
-                                  newinfo);
+                if (ret != 0)
+                        return ret;
+        }
+        return 0;
 }
 #endif
-static int get_info(struct net *net, void __user *user, int *len, int compat)
+static int get_info(struct net *net, void __user *user,
+                    const int *len, int compat)
 {
        char name[IP6T_TABLE_MAXNAMELEN];
        struct xt_table *t;
@@ -1164,10 +1162,10 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
        if (t && !IS_ERR(t)) {
                struct ip6t_getinfo info;
                const struct xt_table_info *private = t->private;
 #ifdef CONFIG_COMPAT
+                struct xt_table_info tmp;
                if (compat) {
-                        struct xt_table_info tmp;
                        ret = compat_table_info(private, &tmp);
                        xt_compat_flush_offsets(AF_INET6);
                        private = &tmp;
@@ -1199,7 +1197,8 @@ static int get_info(struct net *net, void __user *user, int *len, int compat)
 }
 static int
-get_entries(struct net *net, struct ip6t_get_entries __user *uptr, int *len)
+get_entries(struct net *net, struct ip6t_get_entries __user *uptr,
+            const int *len)
 {
        int ret;
        struct ip6t_get_entries get;
@@ -1247,6 +1246,7 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
        struct xt_table_info *oldinfo;
        struct xt_counters *counters;
        const void *loc_cpu_old_entry;
+        struct ip6t_entry *iter;
        ret = 0;
        counters = vmalloc_node(num_counters * sizeof(struct xt_counters),
@@ -1290,8 +1290,9 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
        /* Decrease module usage counts and free resource */
        loc_cpu_old_entry = oldinfo->entries[raw_smp_processor_id()];
-        IP6T_ENTRY_ITERATE(loc_cpu_old_entry, oldinfo->size, cleanup_entry,
+        xt_entry_foreach(iter, loc_cpu_old_entry, oldinfo->size)
-                           NULL);
+                cleanup_entry(iter, net);
        xt_free_table_info(oldinfo);
        if (copy_to_user(counters_ptr, counters,
                         sizeof(struct xt_counters) * num_counters) != 0)
@@ -1310,12 +1311,13 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
 }
 static int
-do_replace(struct net *net, void __user *user, unsigned int len)
+do_replace(struct net *net, const void __user *user, unsigned int len)
 {
        int ret;
        struct ip6t_replace tmp;
        struct xt_table_info *newinfo;
        void *loc_cpu_entry;
+        struct ip6t_entry *iter;
        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                return -EFAULT;
@@ -1336,9 +1338,7 @@ do_replace(struct net *net, void __user *user, unsigned int len)
                goto free_newinfo;
        }
-        ret = translate_table(tmp.name, tmp.valid_hooks,
+        ret = translate_table(net, newinfo, loc_cpu_entry, &tmp);
-                              newinfo, loc_cpu_entry, tmp.size, tmp.num_entries,
-                              tmp.hook_entry, tmp.underflow);
        if (ret != 0)
                goto free_newinfo;
@@ -1351,27 +1351,15 @@ do_replace(struct net *net, void __user *user, unsigned int len)
        return 0;
 free_newinfo_untrans:
-        IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter, net);
 free_newinfo:
        xt_free_table_info(newinfo);
        return ret;
 }
-/* We're lazy, and add to the first CPU; overflow works its fey magic
- * and everything is OK. */
 static int
-add_counter_to_entry(struct ip6t_entry *e,
+do_add_counters(struct net *net, const void __user *user, unsigned int len,
-                     const struct xt_counters addme[],
-                     unsigned int *i)
-{
-        ADD_COUNTER(e->counters, addme[*i].bcnt, addme[*i].pcnt);
-        (*i)++;
-        return 0;
-}
-static int
-do_add_counters(struct net *net, void __user *user, unsigned int len,
                int compat)
 {
        unsigned int i, curcpu;
@@ -1385,6 +1373,7 @@ do_add_counters(struct net *net, void __user *user, unsigned int len,
        const struct xt_table_info *private;
        int ret = 0;
        const void *loc_cpu_entry;
+        struct ip6t_entry *iter;
 #ifdef CONFIG_COMPAT
        struct compat_xt_counters_info compat_tmp;
@@ -1443,11 +1432,10 @@ do_add_counters(struct net *net, void __user *user, unsigned int len,
        curcpu = smp_processor_id();
        xt_info_wrlock(curcpu);
        loc_cpu_entry = private->entries[curcpu];
-        IP6T_ENTRY_ITERATE(loc_cpu_entry,
+        xt_entry_foreach(iter, loc_cpu_entry, private->size) {
-                          private->size,
+                ADD_COUNTER(iter->counters, paddc[i].bcnt, paddc[i].pcnt);
-                          add_counter_to_entry,
+                ++i;
-                          paddc,
+        }
-                          &i);
        xt_info_wrunlock(curcpu);
 unlock_up_free:
@@ -1476,45 +1464,40 @@ struct compat_ip6t_replace {
 static int
 compat_copy_entry_to_user(struct ip6t_entry *e, void __user **dstptr,
                          unsigned int *size, struct xt_counters *counters,
-                          unsigned int *i)
+                          unsigned int i)
 {
        struct ip6t_entry_target *t;
        struct compat_ip6t_entry __user *ce;
        u_int16_t target_offset, next_offset;
        compat_uint_t origsize;
-        int ret;
+        const struct xt_entry_match *ematch;
+        int ret = 0;
-        ret = -EFAULT;
        origsize = *size;
        ce = (struct compat_ip6t_entry __user *)*dstptr;
-        if (copy_to_user(ce, e, sizeof(struct ip6t_entry)))
+        if (copy_to_user(ce, e, sizeof(struct ip6t_entry)) != 0 ||
-                goto out;
+            copy_to_user(&ce->counters, &counters[i],
+            sizeof(counters[i])) != 0)
-        if (copy_to_user(&ce->counters, &counters[*i], sizeof(counters[*i])))
+                return -EFAULT;
-                goto out;
        *dstptr += sizeof(struct compat_ip6t_entry);
        *size -= sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
-        ret = IP6T_MATCH_ITERATE(e, xt_compat_match_to_user, dstptr, size);
+        xt_ematch_foreach(ematch, e) {
+                ret = xt_compat_match_to_user(ematch, dstptr, size);
+                if (ret != 0)
+                        return ret;
+        }
        target_offset = e->target_offset - (origsize - *size);
-        if (ret)
-                goto out;
        t = ip6t_get_target(e);
        ret = xt_compat_target_to_user(t, dstptr, size);
        if (ret)
-                goto out;
+                return ret;
-        ret = -EFAULT;
        next_offset = e->next_offset - (origsize - *size);
-        if (put_user(target_offset, &ce->target_offset))
+        if (put_user(target_offset, &ce->target_offset) != 0 ||
-                goto out;
+            put_user(next_offset, &ce->next_offset) != 0)
-        if (put_user(next_offset, &ce->next_offset))
+                return -EFAULT;
-                goto out;
-        (*i)++;
        return 0;
-out:
-        return ret;
 }
 static int
@@ -1522,7 +1505,7 @@ compat_find_calc_match(struct ip6t_entry_match *m,
                       const char *name,
                       const struct ip6t_ip6 *ipv6,
                       unsigned int hookmask,
-                       int *size, unsigned int *i)
+                       int *size)
 {
        struct xt_match *match;
@@ -1536,47 +1519,32 @@ compat_find_calc_match(struct ip6t_entry_match *m,
        }
        m->u.kernel.match = match;
        *size += xt_compat_match_offset(match);
-        (*i)++;
-        return 0;
-}
-static int
-compat_release_match(struct ip6t_entry_match *m, unsigned int *i)
-{
-        if (i && (*i)-- == 0)
-                return 1;
-        module_put(m->u.kernel.match->me);
        return 0;
 }
-static int
+static void compat_release_entry(struct compat_ip6t_entry *e)
-compat_release_entry(struct compat_ip6t_entry *e, unsigned int *i)
 {
        struct ip6t_entry_target *t;
+        struct xt_entry_match *ematch;
-        if (i && (*i)-- == 0)
-                return 1;
        /* Cleanup all matches */
-        COMPAT_IP6T_MATCH_ITERATE(e, compat_release_match, NULL);
+        xt_ematch_foreach(ematch, e)
+                module_put(ematch->u.kernel.match->me);
        t = compat_ip6t_get_target(e);
        module_put(t->u.kernel.target->me);
-        return 0;
 }
 static int
 check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
                                  struct xt_table_info *newinfo,
                                  unsigned int *size,
-                                  unsigned char *base,
+                                  const unsigned char *base,
-                                  unsigned char *limit,
+                                  const unsigned char *limit,
-                                  unsigned int *hook_entries,
+                                  const unsigned int *hook_entries,
-                                  unsigned int *underflows,
+                                  const unsigned int *underflows,
-                                  unsigned int *i,
                                  const char *name)
 {
+        struct xt_entry_match *ematch;
        struct ip6t_entry_target *t;
        struct xt_target *target;
        unsigned int entry_offset;
@@ -1584,8 +1552,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
        int ret, off, h;
        duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0
+        if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
-            || (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
                duprintf("Bad offset %p, limit = %p\n", e, limit);
                return -EINVAL;
        }
@@ -1605,10 +1573,13 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
        off = sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
        entry_offset = (void *)e - (void *)base;
        j = 0;
-        ret = COMPAT_IP6T_MATCH_ITERATE(e, compat_find_calc_match, name,
+        xt_ematch_foreach(ematch, e) {
-                                        &e->ipv6, e->comefrom, &off, &j);
+                ret = compat_find_calc_match(ematch, name,
-        if (ret != 0)
+                                             &e->ipv6, e->comefrom, &off);
-                goto release_matches;
+                if (ret != 0)
+                        goto release_matches;
+                ++j;
+        }
        t = compat_ip6t_get_target(e);
        target = try_then_request_module(xt_find_target(AF_INET6,
@@ -1640,14 +1611,16 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
        /* Clear counters and comefrom */
        memset(&e->counters, 0, sizeof(e->counters));
        e->comefrom = 0;
-        (*i)++;
        return 0;
 out:
        module_put(t->u.kernel.target->me);
 release_matches:
-        IP6T_MATCH_ITERATE(e, compat_release_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                module_put(ematch->u.kernel.match->me);
+        }
        return ret;
 }
@@ -1661,6 +1634,7 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
        struct ip6t_entry *de;
        unsigned int origsize;
        int ret, h;
+        struct xt_entry_match *ematch;
        ret = 0;
        origsize = *size;
@@ -1671,10 +1645,11 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
        *dstptr += sizeof(struct ip6t_entry);
        *size += sizeof(struct ip6t_entry) - sizeof(struct compat_ip6t_entry);
-        ret = COMPAT_IP6T_MATCH_ITERATE(e, xt_compat_match_from_user,
+        xt_ematch_foreach(ematch, e) {
-                                        dstptr, size);
+                ret = xt_compat_match_from_user(ematch, dstptr, size);
-        if (ret)
+                if (ret != 0)
-                return ret;
+                        return ret;
+        }
        de->target_offset = e->target_offset - (origsize - *size);
        t = compat_ip6t_get_target(e);
        target = t->u.kernel.target;
@@ -1690,36 +1665,44 @@ compat_copy_entry_from_user(struct compat_ip6t_entry *e, void **dstptr,
        return ret;
 }
-static int compat_check_entry(struct ip6t_entry *e, const char *name,
+static int compat_check_entry(struct ip6t_entry *e, struct net *net,
-                                     unsigned int *i)
+                              const char *name)
 {
        unsigned int j;
-        int ret;
+        int ret = 0;
        struct xt_mtchk_param mtpar;
+        struct xt_entry_match *ematch;
        j = 0;
+        mtpar.net       = net;
        mtpar.table     = name;
        mtpar.entryinfo = &e->ipv6;
        mtpar.hook_mask = e->comefrom;
        mtpar.family    = NFPROTO_IPV6;
-        ret = IP6T_MATCH_ITERATE(e, check_match, &mtpar, &j);
+        xt_ematch_foreach(ematch, e) {
-        if (ret)
+                ret = check_match(ematch, &mtpar);
-                goto cleanup_matches;
+                if (ret != 0)
+                        goto cleanup_matches;
+                ++j;
+        }
-        ret = check_target(e, name);
+        ret = check_target(e, net, name);
        if (ret)
                goto cleanup_matches;
-        (*i)++;
        return 0;
 cleanup_matches:
-        IP6T_MATCH_ITERATE(e, cleanup_match, &j);
+        xt_ematch_foreach(ematch, e) {
+                if (j-- == 0)
+                        break;
+                cleanup_match(ematch, net);
+        }
        return ret;
 }
 static int
-translate_compat_table(const char *name,
+translate_compat_table(struct net *net,
+                       const char *name,
                       unsigned int valid_hooks,
                       struct xt_table_info **pinfo,
                       void **pentry0,
@@ -1731,8 +1714,10 @@ translate_compat_table(const char *name,
        unsigned int i, j;
        struct xt_table_info *newinfo, *info;
        void *pos, *entry0, *entry1;
+        struct compat_ip6t_entry *iter0;
+        struct ip6t_entry *iter1;
        unsigned int size;
-        int ret;
+        int ret = 0;
        info = *pinfo;
        entry0 = *pentry0;
@@ -1749,13 +1734,17 @@ translate_compat_table(const char *name,
        j = 0;
        xt_compat_lock(AF_INET6);
        /* Walk through entries, checking offsets. */
-        ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
+        xt_entry_foreach(iter0, entry0, total_size) {
-                                        check_compat_entry_size_and_hooks,
+                ret = check_compat_entry_size_and_hooks(iter0, info, &size,
-                                        info, &size, entry0,
+                                                        entry0,
-                                        entry0 + total_size,
+                                                        entry0 + total_size,
-                                        hook_entries, underflows, &j, name);
+                                                        hook_entries,
-        if (ret != 0)
+                                                        underflows,
-                goto out_unlock;
+                                                        name);
+                if (ret != 0)
+                        goto out_unlock;
+                ++j;
+        }
        ret = -EINVAL;
        if (j != number) {
@@ -1794,9 +1783,12 @@ translate_compat_table(const char *name,
        entry1 = newinfo->entries[raw_smp_processor_id()];
        pos = entry1;
        size = total_size;
-        ret = COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size,
+        xt_entry_foreach(iter0, entry0, total_size) {
-                                        compat_copy_entry_from_user,
+                ret = compat_copy_entry_from_user(iter0, &pos, &size,
-                                        &pos, &size, name, newinfo, entry1);
+                                                  name, newinfo, entry1);
+                if (ret != 0)
+                        break;
+        }
        xt_compat_flush_offsets(AF_INET6);
        xt_compat_unlock(AF_INET6);
        if (ret)
@@ -1807,13 +1799,32 @@ translate_compat_table(const char *name,
                goto free_newinfo;
        i = 0;
-        ret = IP6T_ENTRY_ITERATE(entry1, newinfo->size, compat_check_entry,
+        xt_entry_foreach(iter1, entry1, newinfo->size) {
-                                 name, &i);
+                ret = compat_check_entry(iter1, net, name);
+                if (ret != 0)
+                        break;
+                ++i;
+        }
        if (ret) {
+                /*
+                 * The first i matches need cleanup_entry (calls ->destroy)
+                 * because they had called ->check already. The other j-i
+                 * entries need only release.
+                 */
+                int skip = i;
                j -= i;
-                COMPAT_IP6T_ENTRY_ITERATE_CONTINUE(entry0, newinfo->size, i,
+                xt_entry_foreach(iter0, entry0, newinfo->size) {
-                                                   compat_release_entry, &j);
+                        if (skip-- > 0)
-                IP6T_ENTRY_ITERATE(entry1, newinfo->size, cleanup_entry, &i);
+                                continue;
+                        if (j-- == 0)
+                                break;
+                        compat_release_entry(iter0);
+                }
+                xt_entry_foreach(iter1, entry1, newinfo->size) {
+                        if (i-- == 0)
+                                break;
+                        cleanup_entry(iter1, net);
+                }
                xt_free_table_info(newinfo);
                return ret;
        }
@@ -1831,7 +1842,11 @@ translate_compat_table(const char *name,
 free_newinfo:
        xt_free_table_info(newinfo);
 out:
-        COMPAT_IP6T_ENTRY_ITERATE(entry0, total_size, compat_release_entry, &j);
+        xt_entry_foreach(iter0, entry0, total_size) {
+                if (j-- == 0)
+                        break;
+                compat_release_entry(iter0);
+        }
        return ret;
 out_unlock:
        xt_compat_flush_offsets(AF_INET6);
@@ -1846,6 +1861,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
        struct compat_ip6t_replace tmp;
        struct xt_table_info *newinfo;
        void *loc_cpu_entry;
+        struct ip6t_entry *iter;
        if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
                return -EFAULT;
@@ -1868,7 +1884,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
                goto free_newinfo;
        }
-        ret = translate_compat_table(tmp.name, tmp.valid_hooks,
+        ret = translate_compat_table(net, tmp.name, tmp.valid_hooks,
                                     &newinfo, &loc_cpu_entry, tmp.size,
                                     tmp.num_entries, tmp.hook_entry,
                                     tmp.underflow);
@@ -1884,7 +1900,8 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len)
        return 0;
 free_newinfo_untrans:
-        IP6T_ENTRY_ITERATE(loc_cpu_entry, newinfo->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, newinfo->size)
+                cleanup_entry(iter, net);
 free_newinfo:
        xt_free_table_info(newinfo);
        return ret;
@@ -1933,6 +1950,7 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
        int ret = 0;
        const void *loc_cpu_entry;
        unsigned int i = 0;
+        struct ip6t_entry *iter;
        counters = alloc_counters(table);
        if (IS_ERR(counters))
@@ -1945,9 +1963,12 @@ compat_copy_entries_to_user(unsigned int total_size, struct xt_table *table,
        loc_cpu_entry = private->entries[raw_smp_processor_id()];
        pos = userptr;
        size = total_size;
-        ret = IP6T_ENTRY_ITERATE(loc_cpu_entry, total_size,
+        xt_entry_foreach(iter, loc_cpu_entry, total_size) {
-                                 compat_copy_entry_to_user,
+                ret = compat_copy_entry_to_user(iter, &pos,
-                                 &pos, &size, counters, &i);
+                                                &size, counters, i++);
+                if (ret != 0)
+                        break;
+        }
        vfree(counters);
        return ret;
@@ -2121,11 +2142,7 @@ struct xt_table *ip6t_register_table(struct net *net,
        loc_cpu_entry = newinfo->entries[raw_smp_processor_id()];
        memcpy(loc_cpu_entry, repl->entries, repl->size);
-        ret = translate_table(table->name, table->valid_hooks,
+        ret = translate_table(net, newinfo, loc_cpu_entry, repl);
-                              newinfo, loc_cpu_entry, repl->size,
-                              repl->num_entries,
-                              repl->hook_entry,
-                              repl->underflow);
        if (ret != 0)
                goto out_free;
@@ -2142,17 +2159,19 @@ out:
        return ERR_PTR(ret);
 }
-void ip6t_unregister_table(struct xt_table *table)
+void ip6t_unregister_table(struct net *net, struct xt_table *table)
 {
        struct xt_table_info *private;
        void *loc_cpu_entry;
        struct module *table_owner = table->me;
+        struct ip6t_entry *iter;
        private = xt_unregister_table(table);
        /* Decrease module usage counts and free resources */
        loc_cpu_entry = private->entries[raw_smp_processor_id()];
-        IP6T_ENTRY_ITERATE(loc_cpu_entry, private->size, cleanup_entry, NULL);
+        xt_entry_foreach(iter, loc_cpu_entry, private->size)
+                cleanup_entry(iter, net);
        if (private->number > private->initial_entries)
                module_put(table_owner);
        xt_free_table_info(private);
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 7018cac4fddc..b285fdf19050 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -249,8 +249,8 @@ static void dump_packet(const struct nf_loginfo *info,
                /* Max length: 11 "URGP=65535 " */
                printk("URGP=%u ", ntohs(th->urg_ptr));
-                if ((logflags & IP6T_LOG_TCPOPT)
+                if ((logflags & IP6T_LOG_TCPOPT) &&
-                    && th->doff * 4 > sizeof(struct tcphdr)) {
+                    th->doff * 4 > sizeof(struct tcphdr)) {
                        u_int8_t _opt[60 - sizeof(struct tcphdr)];
                        const u_int8_t *op;
                        unsigned int i;
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 5a7f00cd15ce..39b50c3768e8 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -15,6 +15,7 @@
 * 2 of the License, or (at your option) any later version.
 */
+#include <linux/gfp.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/icmpv6.h>
@@ -169,7 +170,7 @@ send_unreach(struct net *net, struct sk_buff *skb_in, unsigned char code,
        if (hooknum == NF_INET_LOCAL_OUT && skb_in->dev == NULL)
                skb_in->dev = net->loopback_dev;
-        icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0, NULL);
+        icmpv6_send(skb_in, ICMPV6_DEST_UNREACH, code, 0);
 }
 static unsigned int
@@ -223,8 +224,8 @@ static bool reject_tg6_check(const struct xt_tgchk_param *par)
                return false;
        } else if (rejinfo->with == IP6T_TCP_RESET) {
                /* Must specify that it's a TCP packet */
-                if (e->ipv6.proto != IPPROTO_TCP
+                if (e->ipv6.proto != IPPROTO_TCP ||
-                    || (e->ipv6.invflags & XT_INV_PROTO)) {
+                    (e->ipv6.invflags & XT_INV_PROTO)) {
                        printk("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
                        return false;
                }
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 3a82f24746b9..ac0b7c629d78 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -77,17 +77,14 @@ static bool ah_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                 ahinfo->hdrres, ah->reserved,
                 !(ahinfo->hdrres && ah->reserved));
-        return (ah != NULL)
+        return (ah != NULL) &&
-               &&
+                spi_match(ahinfo->spis[0], ahinfo->spis[1],
-               spi_match(ahinfo->spis[0], ahinfo->spis[1],
+                          ntohl(ah->spi),
-                         ntohl(ah->spi),
+                          !!(ahinfo->invflags & IP6T_AH_INV_SPI)) &&
-                         !!(ahinfo->invflags & IP6T_AH_INV_SPI))
+                (!ahinfo->hdrlen ||
-               &&
+                 (ahinfo->hdrlen == hdrlen) ^
-               (!ahinfo->hdrlen ||
+                 !!(ahinfo->invflags & IP6T_AH_INV_LEN)) &&
-                (ahinfo->hdrlen == hdrlen) ^
+                !(ahinfo->hdrres && ah->reserved);
-                !!(ahinfo->invflags & IP6T_AH_INV_LEN))
-               &&
-               !(ahinfo->hdrres && ah->reserved);
 }
 static bool ah_mt6_check(const struct xt_mtchk_param *par)
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 673aa0a5084e..7b91c2598ed5 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -70,41 +70,36 @@ frag_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
        pr_debug("res %02X %02X%04X %02X ",
                 fraginfo->flags & IP6T_FRAG_RES, fh->reserved,
                 ntohs(fh->frag_off) & 0x6,
-                 !((fraginfo->flags & IP6T_FRAG_RES)
+                 !((fraginfo->flags & IP6T_FRAG_RES) &&
-                   && (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
+                   (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
        pr_debug("first %02X %02X %02X ",
                 fraginfo->flags & IP6T_FRAG_FST,
                 ntohs(fh->frag_off) & ~0x7,
-                 !((fraginfo->flags & IP6T_FRAG_FST)
+                 !((fraginfo->flags & IP6T_FRAG_FST) &&
-                   && (ntohs(fh->frag_off) & ~0x7)));
+                   (ntohs(fh->frag_off) & ~0x7)));
        pr_debug("mf %02X %02X %02X ",
                 fraginfo->flags & IP6T_FRAG_MF,
                 ntohs(fh->frag_off) & IP6_MF,
-                 !((fraginfo->flags & IP6T_FRAG_MF)
+                 !((fraginfo->flags & IP6T_FRAG_MF) &&
-                   && !((ntohs(fh->frag_off) & IP6_MF))));
+                   !((ntohs(fh->frag_off) & IP6_MF))));
        pr_debug("last %02X %02X %02X\n",
                 fraginfo->flags & IP6T_FRAG_NMF,
                 ntohs(fh->frag_off) & IP6_MF,
-                 !((fraginfo->flags & IP6T_FRAG_NMF)
+                 !((fraginfo->flags & IP6T_FRAG_NMF) &&
-                   && (ntohs(fh->frag_off) & IP6_MF)));
+                   (ntohs(fh->frag_off) & IP6_MF)));
-        return (fh != NULL)
+        return (fh != NULL) &&
-               &&
+                id_match(fraginfo->ids[0], fraginfo->ids[1],
-               id_match(fraginfo->ids[0], fraginfo->ids[1],
+                         ntohl(fh->identification),
-                        ntohl(fh->identification),
+                         !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) &&
-                        !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))
+                !((fraginfo->flags & IP6T_FRAG_RES) &&
-               &&
+                  (fh->reserved || (ntohs(fh->frag_off) & 0x6))) &&
-               !((fraginfo->flags & IP6T_FRAG_RES)
+                !((fraginfo->flags & IP6T_FRAG_FST) &&
-                 && (fh->reserved || (ntohs(fh->frag_off) & 0x6)))
+                  (ntohs(fh->frag_off) & ~0x7)) &&
-               &&
+                !((fraginfo->flags & IP6T_FRAG_MF) &&
-               !((fraginfo->flags & IP6T_FRAG_FST)
+                  !(ntohs(fh->frag_off) & IP6_MF)) &&
-                 && (ntohs(fh->frag_off) & ~0x7))
+                !((fraginfo->flags & IP6T_FRAG_NMF) &&
-               &&
+                  (ntohs(fh->frag_off) & IP6_MF));
-               !((fraginfo->flags & IP6T_FRAG_MF)
-                 && !(ntohs(fh->frag_off) & IP6_MF))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_NMF)
-                 && (ntohs(fh->frag_off) & IP6_MF));
 }
 static bool frag_mt6_check(const struct xt_mtchk_param *par)
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 356b8d6f6baa..b77307fc8743 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -92,16 +92,13 @@ static bool rt_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                 !((rtinfo->flags & IP6T_RT_RES) &&
                   (((const struct rt0_hdr *)rh)->reserved)));
-        ret = (rh != NULL)
+        ret = (rh != NULL) &&
-              &&
              (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
                              rh->segments_left,
-                              !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
+                              !!(rtinfo->invflags & IP6T_RT_INV_SGS))) &&
-              &&
              (!(rtinfo->flags & IP6T_RT_LEN) ||
               ((rtinfo->hdrlen == hdrlen) ^
-                !!(rtinfo->invflags & IP6T_RT_INV_LEN)))
+                !!(rtinfo->invflags & IP6T_RT_INV_LEN))) &&
-              &&
              (!(rtinfo->flags & IP6T_RT_TYP) ||
               ((rtinfo->rt_type == rh->type) ^
                !!(rtinfo->invflags & IP6T_RT_INV_TYP)));
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 6f4383ad86f9..d6fc9aff3163 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -12,6 +12,7 @@
 #include <linux/module.h>
 #include <linux/moduleparam.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/slab.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -21,99 +22,26 @@ MODULE_DESCRIPTION("ip6tables filter table");
                            (1 << NF_INET_FORWARD) | \
                            (1 << NF_INET_LOCAL_OUT))
-static struct
-{
-        struct ip6t_replace repl;
-        struct ip6t_standard entries[3];
-        struct ip6t_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "filter",
-                .valid_hooks = FILTER_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
-                .hook_entry = {
-                        [NF_INET_LOCAL_IN] = 0,
-                        [NF_INET_FORWARD] = sizeof(struct ip6t_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2
-                },
-                .underflow = {
-                        [NF_INET_LOCAL_IN] = 0,
-                        [NF_INET_FORWARD] = sizeof(struct ip6t_standard),
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard) * 2
-                },
-        },
-        .entries = {
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
-        },
-        .term = IP6T_ERROR_INIT,                /* ERROR */
-};
 static const struct xt_table packet_filter = {
        .name           = "filter",
        .valid_hooks    = FILTER_VALID_HOOKS,
        .me             = THIS_MODULE,
        .af             = NFPROTO_IPV6,
+        .priority       = NF_IP6_PRI_FILTER,
 };
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ip6t_in_hook(unsigned int hook,
+ip6table_filter_hook(unsigned int hook, struct sk_buff *skb,
-                   struct sk_buff *skb,
+                     const struct net_device *in, const struct net_device *out,
-                   const struct net_device *in,
+                     int (*okfn)(struct sk_buff *))
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv6.ip6table_filter);
-}
-static unsigned int
-ip6t_local_out_hook(unsigned int hook,
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
 {
-#if 0
+        const struct net *net = dev_net((in != NULL) ? in : out);
-        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
-                if (net_ratelimit())
-                        printk("ip6t_hook: happy cracking.\n");
-                return NF_ACCEPT;
-        }
-#endif
-        return ip6t_do_table(skb, hook, in, out,
+        return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_filter);
-                             dev_net(out)->ipv6.ip6table_filter);
 }
-static struct nf_hook_ops ip6t_ops[] __read_mostly = {
+static struct nf_hook_ops *filter_ops __read_mostly;
-        {
-                .hook           = ip6t_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP6_PRI_FILTER,
-        },
-        {
-                .hook           = ip6t_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP6_PRI_FILTER,
-        },
-        {
-                .hook           = ip6t_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP6_PRI_FILTER,
-        },
-};
 /* Default to forward because I got too much mail already. */
 static int forward = NF_ACCEPT;
@@ -121,9 +49,18 @@ module_param(forward, bool, 0000);
 static int __net_init ip6table_filter_net_init(struct net *net)
 {
-        /* Register table */
+        struct ip6t_replace *repl;
+        repl = ip6t_alloc_initial_table(&packet_filter);
+        if (repl == NULL)
+                return -ENOMEM;
+        /* Entry 1 is the FORWARD hook */
+        ((struct ip6t_standard *)repl->entries)[1].target.verdict =
+                -forward - 1;
        net->ipv6.ip6table_filter =
-                ip6t_register_table(net, &packet_filter, &initial_table.repl);
+                ip6t_register_table(net, &packet_filter, repl);
+        kfree(repl);
        if (IS_ERR(net->ipv6.ip6table_filter))
                return PTR_ERR(net->ipv6.ip6table_filter);
        return 0;
@@ -131,7 +68,7 @@ static int __net_init ip6table_filter_net_init(struct net *net)
 static void __net_exit ip6table_filter_net_exit(struct net *net)
 {
-        ip6t_unregister_table(net->ipv6.ip6table_filter);
+        ip6t_unregister_table(net, net->ipv6.ip6table_filter);
 }
 static struct pernet_operations ip6table_filter_net_ops = {
@@ -148,17 +85,16 @@ static int __init ip6table_filter_init(void)
                return -EINVAL;
        }
-        /* Entry 1 is the FORWARD hook */
-        initial_table.entries[1].target.verdict = -forward - 1;
        ret = register_pernet_subsys(&ip6table_filter_net_ops);
        if (ret < 0)
                return ret;
        /* Register hooks */
-        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        filter_ops = xt_hook_link(&packet_filter, ip6table_filter_hook);
-        if (ret < 0)
+        if (IS_ERR(filter_ops)) {
+                ret = PTR_ERR(filter_ops);
                goto cleanup_table;
+        }
        return ret;
@@ -169,7 +105,7 @@ static int __init ip6table_filter_init(void)
 static void __exit ip6table_filter_fini(void)
 {
-        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        xt_hook_unlink(&packet_filter, filter_ops);
        unregister_pernet_subsys(&ip6table_filter_net_ops);
 }
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 0ad91433ed61..6a102b57f356 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -10,6 +10,7 @@
 */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/slab.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Netfilter Core Team <coreteam@netfilter.org>");
@@ -21,80 +22,17 @@ MODULE_DESCRIPTION("ip6tables mangle table");
                            (1 << NF_INET_LOCAL_OUT) | \
                            (1 << NF_INET_POST_ROUTING))
-static const struct
-{
-        struct ip6t_replace repl;
-        struct ip6t_standard entries[5];
-        struct ip6t_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "mangle",
-                .valid_hooks = MANGLE_VALID_HOOKS,
-                .num_entries = 6,
-                .size = sizeof(struct ip6t_standard) * 5 + sizeof(struct ip6t_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING]   = 0,
-                        [NF_INET_LOCAL_IN]      = sizeof(struct ip6t_standard),
-                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard) * 2,
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 3,
-                        [NF_INET_POST_ROUTING]  = sizeof(struct ip6t_standard) * 4,
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING]   = 0,
-                        [NF_INET_LOCAL_IN]      = sizeof(struct ip6t_standard),
-                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard) * 2,
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 3,
-                        [NF_INET_POST_ROUTING]  = sizeof(struct ip6t_standard) * 4,
-                },
-        },
-        .entries = {
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* PRE_ROUTING */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* POST_ROUTING */
-        },
-        .term = IP6T_ERROR_INIT,                /* ERROR */
-};
 static const struct xt_table packet_mangler = {
        .name           = "mangle",
        .valid_hooks    = MANGLE_VALID_HOOKS,
        .me             = THIS_MODULE,
        .af             = NFPROTO_IPV6,
+        .priority       = NF_IP6_PRI_MANGLE,
 };
-/* The work comes in here from netfilter.c. */
-static unsigned int
-ip6t_in_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv6.ip6table_mangle);
-}
-static unsigned int
-ip6t_post_routing_hook(unsigned int hook,
-                struct sk_buff *skb,
-                const struct net_device *in,
-                const struct net_device *out,
-                int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv6.ip6table_mangle);
-}
 static unsigned int
-ip6t_local_out_hook(unsigned int hook,
+ip6t_mangle_out(struct sk_buff *skb, const struct net_device *out)
-                   struct sk_buff *skb,
-                   const struct net_device *in,
-                   const struct net_device *out,
-                   int (*okfn)(struct sk_buff *))
 {
        unsigned int ret;
        struct in6_addr saddr, daddr;
        u_int8_t hop_limit;
@@ -102,8 +40,8 @@ ip6t_local_out_hook(unsigned int hook,
 #if 0
        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
+        if (skb->len < sizeof(struct iphdr) ||
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("ip6t_hook: happy cracking.\n");
                return NF_ACCEPT;
@@ -119,62 +57,46 @@ ip6t_local_out_hook(unsigned int hook,
        /* flowlabel and prio (includes version, which shouldn't change either */
        flowlabel = *((u_int32_t *)ipv6_hdr(skb));
-        ret = ip6t_do_table(skb, hook, in, out,
+        ret = ip6t_do_table(skb, NF_INET_LOCAL_OUT, NULL, out,
                            dev_net(out)->ipv6.ip6table_mangle);
-        if (ret != NF_DROP && ret != NF_STOLEN
+        if (ret != NF_DROP && ret != NF_STOLEN &&
-                && (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
+            (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
-                    || memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr))
+             memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
-                    || skb->mark != mark
+             skb->mark != mark ||
-                    || ipv6_hdr(skb)->hop_limit != hop_limit))
+             ipv6_hdr(skb)->hop_limit != hop_limit))
                return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
        return ret;
 }
-static struct nf_hook_ops ip6t_ops[] __read_mostly = {
+/* The work comes in here from netfilter.c. */
-        {
+static unsigned int
-                .hook           = ip6t_in_hook,
+ip6table_mangle_hook(unsigned int hook, struct sk_buff *skb,
-                .owner          = THIS_MODULE,
+                     const struct net_device *in, const struct net_device *out,
-                .pf             = NFPROTO_IPV6,
+                     int (*okfn)(struct sk_buff *))
-                .hooknum        = NF_INET_PRE_ROUTING,
+{
-                .priority       = NF_IP6_PRI_MANGLE,
+        if (hook == NF_INET_LOCAL_OUT)
-        },
+                return ip6t_mangle_out(skb, out);
-        {
+        if (hook == NF_INET_POST_ROUTING)
-                .hook           = ip6t_in_hook,
+                return ip6t_do_table(skb, hook, in, out,
-                .owner          = THIS_MODULE,
+                                     dev_net(out)->ipv6.ip6table_mangle);
-                .pf             = NFPROTO_IPV6,
+        /* INPUT/FORWARD */
-                .hooknum        = NF_INET_LOCAL_IN,
+        return ip6t_do_table(skb, hook, in, out,
-                .priority       = NF_IP6_PRI_MANGLE,
+                             dev_net(in)->ipv6.ip6table_mangle);
-        },
+}
-        {
-                .hook           = ip6t_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP6_PRI_MANGLE,
-        },
-        {
-                .hook           = ip6t_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP6_PRI_MANGLE,
-        },
-        {
-                .hook           = ip6t_post_routing_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_POST_ROUTING,
-                .priority       = NF_IP6_PRI_MANGLE,
-        },
-};
+static struct nf_hook_ops *mangle_ops __read_mostly;
 static int __net_init ip6table_mangle_net_init(struct net *net)
 {
-        /* Register table */
+        struct ip6t_replace *repl;
+        repl = ip6t_alloc_initial_table(&packet_mangler);
+        if (repl == NULL)
+                return -ENOMEM;
        net->ipv6.ip6table_mangle =
-                ip6t_register_table(net, &packet_mangler, &initial_table.repl);
+                ip6t_register_table(net, &packet_mangler, repl);
+        kfree(repl);
        if (IS_ERR(net->ipv6.ip6table_mangle))
                return PTR_ERR(net->ipv6.ip6table_mangle);
        return 0;
@@ -182,7 +104,7 @@ static int __net_init ip6table_mangle_net_init(struct net *net)
 static void __net_exit ip6table_mangle_net_exit(struct net *net)
 {
-        ip6t_unregister_table(net->ipv6.ip6table_mangle);
+        ip6t_unregister_table(net, net->ipv6.ip6table_mangle);
 }
 static struct pernet_operations ip6table_mangle_net_ops = {
@@ -199,9 +121,11 @@ static int __init ip6table_mangle_init(void)
                return ret;
        /* Register hooks */
-        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        mangle_ops = xt_hook_link(&packet_mangler, ip6table_mangle_hook);
-        if (ret < 0)
+        if (IS_ERR(mangle_ops)) {
+                ret = PTR_ERR(mangle_ops);
                goto cleanup_table;
+        }
        return ret;
@@ -212,7 +136,7 @@ static int __init ip6table_mangle_init(void)
 static void __exit ip6table_mangle_fini(void)
 {
-        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        xt_hook_unlink(&packet_mangler, mangle_ops);
        unregister_pernet_subsys(&ip6table_mangle_net_ops);
 }
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index ed1a1180f3b3..5b9926a011bd 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -5,88 +5,41 @@
 */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/slab.h>
 #define RAW_VALID_HOOKS ((1 << NF_INET_PRE_ROUTING) | (1 << NF_INET_LOCAL_OUT))
-static const struct
-{
-        struct ip6t_replace repl;
-        struct ip6t_standard entries[2];
-        struct ip6t_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "raw",
-                .valid_hooks = RAW_VALID_HOOKS,
-                .num_entries = 3,
-                .size = sizeof(struct ip6t_standard) * 2 + sizeof(struct ip6t_error),
-                .hook_entry = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
-                },
-                .underflow = {
-                        [NF_INET_PRE_ROUTING] = 0,
-                        [NF_INET_LOCAL_OUT] = sizeof(struct ip6t_standard)
-                },
-        },
-        .entries = {
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* PRE_ROUTING */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
-        },
-        .term = IP6T_ERROR_INIT,                /* ERROR */
-};
 static const struct xt_table packet_raw = {
        .name = "raw",
        .valid_hooks = RAW_VALID_HOOKS,
        .me = THIS_MODULE,
        .af = NFPROTO_IPV6,
+        .priority = NF_IP6_PRI_RAW,
 };
 /* The work comes in here from netfilter.c. */
 static unsigned int
-ip6t_pre_routing_hook(unsigned int hook,
+ip6table_raw_hook(unsigned int hook, struct sk_buff *skb,
-         struct sk_buff *skb,
+                  const struct net_device *in, const struct net_device *out,
-         const struct net_device *in,
+                  int (*okfn)(struct sk_buff *))
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out,
+        const struct net *net = dev_net((in != NULL) ? in : out);
-                             dev_net(in)->ipv6.ip6table_raw);
-}
-static unsigned int
+        return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_raw);
-ip6t_local_out_hook(unsigned int hook,
-         struct sk_buff *skb,
-         const struct net_device *in,
-         const struct net_device *out,
-         int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv6.ip6table_raw);
 }
-static struct nf_hook_ops ip6t_ops[] __read_mostly = {
+static struct nf_hook_ops *rawtable_ops __read_mostly;
-        {
-          .hook = ip6t_pre_routing_hook,
-          .pf = NFPROTO_IPV6,
-          .hooknum = NF_INET_PRE_ROUTING,
-          .priority = NF_IP6_PRI_FIRST,
-          .owner = THIS_MODULE,
-        },
-        {
-          .hook = ip6t_local_out_hook,
-          .pf = NFPROTO_IPV6,
-          .hooknum = NF_INET_LOCAL_OUT,
-          .priority = NF_IP6_PRI_FIRST,
-          .owner = THIS_MODULE,
-        },
-};
 static int __net_init ip6table_raw_net_init(struct net *net)
 {
-        /* Register table */
+        struct ip6t_replace *repl;
+        repl = ip6t_alloc_initial_table(&packet_raw);
+        if (repl == NULL)
+                return -ENOMEM;
        net->ipv6.ip6table_raw =
-                ip6t_register_table(net, &packet_raw, &initial_table.repl);
+                ip6t_register_table(net, &packet_raw, repl);
+        kfree(repl);
        if (IS_ERR(net->ipv6.ip6table_raw))
                return PTR_ERR(net->ipv6.ip6table_raw);
        return 0;
@@ -94,7 +47,7 @@ static int __net_init ip6table_raw_net_init(struct net *net)
 static void __net_exit ip6table_raw_net_exit(struct net *net)
 {
-        ip6t_unregister_table(net->ipv6.ip6table_raw);
+        ip6t_unregister_table(net, net->ipv6.ip6table_raw);
 }
 static struct pernet_operations ip6table_raw_net_ops = {
@@ -111,9 +64,11 @@ static int __init ip6table_raw_init(void)
                return ret;
        /* Register hooks */
-        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        rawtable_ops = xt_hook_link(&packet_raw, ip6table_raw_hook);
-        if (ret < 0)
+        if (IS_ERR(rawtable_ops)) {
+                ret = PTR_ERR(rawtable_ops);
                goto cleanup_table;
+        }
        return ret;
@@ -124,7 +79,7 @@ static int __init ip6table_raw_init(void)
 static void __exit ip6table_raw_fini(void)
 {
-        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        xt_hook_unlink(&packet_raw, rawtable_ops);
        unregister_pernet_subsys(&ip6table_raw_net_ops);
 }
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index 41b444c60934..91aa2b4d83c9 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -17,6 +17,7 @@
 */
 #include <linux/module.h>
 #include <linux/netfilter_ipv6/ip6_tables.h>
+#include <linux/slab.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("James Morris <jmorris <at> redhat.com>");
@@ -26,106 +27,37 @@ MODULE_DESCRIPTION("ip6tables security table, for MAC rules");
                                (1 << NF_INET_FORWARD) | \
                                (1 << NF_INET_LOCAL_OUT)
-static const struct
-{
-        struct ip6t_replace repl;
-        struct ip6t_standard entries[3];
-        struct ip6t_error term;
-} initial_table __net_initdata = {
-        .repl = {
-                .name = "security",
-                .valid_hooks = SECURITY_VALID_HOOKS,
-                .num_entries = 4,
-                .size = sizeof(struct ip6t_standard) * 3 + sizeof(struct ip6t_error),
-                .hook_entry = {
-                        [NF_INET_LOCAL_IN]      = 0,
-                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
-                },
-                .underflow = {
-                        [NF_INET_LOCAL_IN]      = 0,
-                        [NF_INET_FORWARD]       = sizeof(struct ip6t_standard),
-                        [NF_INET_LOCAL_OUT]     = sizeof(struct ip6t_standard) * 2,
-                },
-        },
-        .entries = {
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_IN */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* FORWARD */
-                IP6T_STANDARD_INIT(NF_ACCEPT),  /* LOCAL_OUT */
-        },
-        .term = IP6T_ERROR_INIT,                /* ERROR */
-};
 static const struct xt_table security_table = {
        .name           = "security",
        .valid_hooks    = SECURITY_VALID_HOOKS,
        .me             = THIS_MODULE,
        .af             = NFPROTO_IPV6,
+        .priority       = NF_IP6_PRI_SECURITY,
 };
 static unsigned int
-ip6t_local_in_hook(unsigned int hook,
+ip6table_security_hook(unsigned int hook, struct sk_buff *skb,
-                   struct sk_buff *skb,
+                       const struct net_device *in,
-                   const struct net_device *in,
+                       const struct net_device *out,
-                   const struct net_device *out,
+                       int (*okfn)(struct sk_buff *))
-                   int (*okfn)(struct sk_buff *))
-{
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(in)->ipv6.ip6table_security);
-}
-static unsigned int
-ip6t_forward_hook(unsigned int hook,
-                  struct sk_buff *skb,
-                  const struct net_device *in,
-                  const struct net_device *out,
-                  int (*okfn)(struct sk_buff *))
 {
-        return ip6t_do_table(skb, hook, in, out,
+        const struct net *net = dev_net((in != NULL) ? in : out);
-                             dev_net(in)->ipv6.ip6table_security);
-}
-static unsigned int
+        return ip6t_do_table(skb, hook, in, out, net->ipv6.ip6table_security);
-ip6t_local_out_hook(unsigned int hook,
-                    struct sk_buff *skb,
-                    const struct net_device *in,
-                    const struct net_device *out,
-                    int (*okfn)(struct sk_buff *))
-{
-        /* TBD: handle short packets via raw socket */
-        return ip6t_do_table(skb, hook, in, out,
-                             dev_net(out)->ipv6.ip6table_security);
 }
-static struct nf_hook_ops ip6t_ops[] __read_mostly = {
+static struct nf_hook_ops *sectbl_ops __read_mostly;
-        {
-                .hook           = ip6t_local_in_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_IN,
-                .priority       = NF_IP6_PRI_SECURITY,
-        },
-        {
-                .hook           = ip6t_forward_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_FORWARD,
-                .priority       = NF_IP6_PRI_SECURITY,
-        },
-        {
-                .hook           = ip6t_local_out_hook,
-                .owner          = THIS_MODULE,
-                .pf             = NFPROTO_IPV6,
-                .hooknum        = NF_INET_LOCAL_OUT,
-                .priority       = NF_IP6_PRI_SECURITY,
-        },
-};
 static int __net_init ip6table_security_net_init(struct net *net)
 {
-        net->ipv6.ip6table_security =
+        struct ip6t_replace *repl;
-                ip6t_register_table(net, &security_table, &initial_table.repl);
+        repl = ip6t_alloc_initial_table(&security_table);
+        if (repl == NULL)
+                return -ENOMEM;
+        net->ipv6.ip6table_security =
+                ip6t_register_table(net, &security_table, repl);
+        kfree(repl);
        if (IS_ERR(net->ipv6.ip6table_security))
                return PTR_ERR(net->ipv6.ip6table_security);
@@ -134,7 +66,7 @@ static int __net_init ip6table_security_net_init(struct net *net)
 static void __net_exit ip6table_security_net_exit(struct net *net)
 {
-        ip6t_unregister_table(net->ipv6.ip6table_security);
+        ip6t_unregister_table(net, net->ipv6.ip6table_security);
 }
 static struct pernet_operations ip6table_security_net_ops = {
@@ -150,9 +82,11 @@ static int __init ip6table_security_init(void)
        if (ret < 0)
                return ret;
-        ret = nf_register_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        sectbl_ops = xt_hook_link(&security_table, ip6table_security_hook);
-        if (ret < 0)
+        if (IS_ERR(sectbl_ops)) {
+                ret = PTR_ERR(sectbl_ops);
                goto cleanup_table;
+        }
        return ret;
@@ -163,7 +97,7 @@ cleanup_table:
 static void __exit ip6table_security_fini(void)
 {
-        nf_unregister_hooks(ip6t_ops, ARRAY_SIZE(ip6t_ops));
+        xt_hook_unlink(&security_table, sectbl_ops);
        unregister_pernet_subsys(&ip6table_security_net_ops);
 }
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index 5f2ec208a8c3..996c3f41fecd 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -20,12 +20,14 @@
 #include <net/ipv6.h>
 #include <net/inet_frag.h>
+#include <linux/netfilter_bridge.h>
 #include <linux/netfilter_ipv6.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_l3proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_ipv6.h>
 #include <net/netfilter/nf_log.h>
@@ -187,6 +189,26 @@ out:
        return nf_conntrack_confirm(skb);
 }
+static enum ip6_defrag_users nf_ct6_defrag_user(unsigned int hooknum,
+                                                struct sk_buff *skb)
+{
+        u16 zone = NF_CT_DEFAULT_ZONE;
+        if (skb->nfct)
+                zone = nf_ct_zone((struct nf_conn *)skb->nfct);
+#ifdef CONFIG_BRIDGE_NETFILTER
+        if (skb->nf_bridge &&
+            skb->nf_bridge->mask & BRNF_NF_BRIDGE_PREROUTING)
+                return IP6_DEFRAG_CONNTRACK_BRIDGE_IN + zone;
+#endif
+        if (hooknum == NF_INET_PRE_ROUTING)
+                return IP6_DEFRAG_CONNTRACK_IN + zone;
+        else
+                return IP6_DEFRAG_CONNTRACK_OUT + zone;
+}
 static unsigned int ipv6_defrag(unsigned int hooknum,
                                struct sk_buff *skb,
                                const struct net_device *in,
@@ -196,11 +218,10 @@ static unsigned int ipv6_defrag(unsigned int hooknum,
        struct sk_buff *reasm;
        /* Previously seen (loopback)?  */
-        if (skb->nfct)
+        if (skb->nfct && !nf_ct_is_template((struct nf_conn *)skb->nfct))
                return NF_ACCEPT;
-        reasm = nf_ct_frag6_gather(skb);
+        reasm = nf_ct_frag6_gather(skb, nf_ct6_defrag_user(hooknum, skb));
        /* queued */
        if (reasm == NULL)
                return NF_STOLEN;
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 642dcb127bab..9be81776415e 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -23,6 +23,7 @@
 #include <net/netfilter/nf_conntrack_tuple.h>
 #include <net/netfilter/nf_conntrack_l4proto.h>
 #include <net/netfilter/nf_conntrack_core.h>
+#include <net/netfilter/nf_conntrack_zones.h>
 #include <net/netfilter/ipv6/nf_conntrack_icmpv6.h>
 #include <net/netfilter/nf_log.h>
@@ -128,7 +129,7 @@ static bool icmpv6_new(struct nf_conn *ct, const struct sk_buff *skb,
 }
 static int
-icmpv6_error_message(struct net *net,
+icmpv6_error_message(struct net *net, struct nf_conn *tmpl,
                     struct sk_buff *skb,
                     unsigned int icmp6off,
                     enum ip_conntrack_info *ctinfo,
@@ -137,6 +138,7 @@ icmpv6_error_message(struct net *net,
        struct nf_conntrack_tuple intuple, origtuple;
        const struct nf_conntrack_tuple_hash *h;
        const struct nf_conntrack_l4proto *inproto;
+        u16 zone = tmpl ? nf_ct_zone(tmpl) : NF_CT_DEFAULT_ZONE;
        NF_CT_ASSERT(skb->nfct == NULL);
@@ -163,7 +165,7 @@ icmpv6_error_message(struct net *net,
        *ctinfo = IP_CT_RELATED;
-        h = nf_conntrack_find_get(net, &intuple);
+        h = nf_conntrack_find_get(net, zone, &intuple);
        if (!h) {
                pr_debug("icmpv6_error: no match\n");
                return -NF_ACCEPT;
@@ -179,7 +181,8 @@ icmpv6_error_message(struct net *net,
 }
 static int
-icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
+icmpv6_error(struct net *net, struct nf_conn *tmpl,
+             struct sk_buff *skb, unsigned int dataoff,
             enum ip_conntrack_info *ctinfo, u_int8_t pf, unsigned int hooknum)
 {
        const struct icmp6hdr *icmp6h;
@@ -215,7 +218,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
        if (icmp6h->icmp6_type >= 128)
                return NF_ACCEPT;
-        return icmpv6_error_message(net, skb, dataoff, ctinfo, hooknum);
+        return icmpv6_error_message(net, tmpl, skb, dataoff, ctinfo, hooknum);
 }
 #if defined(CONFIG_NF_CT_NETLINK) || defined(CONFIG_NF_CT_NETLINK_MODULE)
@@ -244,18 +247,18 @@ static const struct nla_policy icmpv6_nla_policy[CTA_PROTO_MAX+1] = {
 static int icmpv6_nlattr_to_tuple(struct nlattr *tb[],
                                struct nf_conntrack_tuple *tuple)
 {
-        if (!tb[CTA_PROTO_ICMPV6_TYPE]
+        if (!tb[CTA_PROTO_ICMPV6_TYPE] ||
-            || !tb[CTA_PROTO_ICMPV6_CODE]
+            !tb[CTA_PROTO_ICMPV6_CODE] ||
-            || !tb[CTA_PROTO_ICMPV6_ID])
+            !tb[CTA_PROTO_ICMPV6_ID])
                return -EINVAL;
        tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMPV6_TYPE]);
        tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMPV6_CODE]);
        tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMPV6_ID]);
-        if (tuple->dst.u.icmp.type < 128
+        if (tuple->dst.u.icmp.type < 128 ||
-            || tuple->dst.u.icmp.type - 128 >= sizeof(invmap)
+            tuple->dst.u.icmp.type - 128 >= sizeof(invmap) ||
-            || !invmap[tuple->dst.u.icmp.type - 128])
+            !invmap[tuple->dst.u.icmp.type - 128])
                return -EINVAL;
        return 0;
@@ -277,9 +280,7 @@ static struct ctl_table icmpv6_sysctl_table[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec_jiffies,
        },
-        {
+        { }
-                .ctl_name       = 0
-        }
 };
 #endif /* CONFIG_SYSCTL */
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index f3aba255ad9f..dd5b9bd61c62 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -27,6 +27,7 @@
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -45,9 +46,6 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
-#define NF_CT_FRAG6_HIGH_THRESH 262144 /* == 256*1024 */
-#define NF_CT_FRAG6_LOW_THRESH 196608  /* == 192*1024 */
-#define NF_CT_FRAG6_TIMEOUT IPV6_FRAG_TIMEOUT
 struct nf_ct_frag6_skb_cb
 {
@@ -63,6 +61,7 @@ struct nf_ct_frag6_queue
        struct inet_frag_queue  q;
        __be32                  id;             /* fragment id          */
+        u32                     user;
        struct in6_addr         saddr;
        struct in6_addr         daddr;
@@ -83,7 +82,6 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
                .proc_handler   = proc_dointvec_jiffies,
        },
        {
-                .ctl_name       = NET_NF_CONNTRACK_FRAG6_LOW_THRESH,
                .procname       = "nf_conntrack_frag6_low_thresh",
                .data           = &nf_init_frags.low_thresh,
                .maxlen         = sizeof(unsigned int),
@@ -91,14 +89,13 @@ struct ctl_table nf_ct_ipv6_sysctl_table[] = {
                .proc_handler   = proc_dointvec,
        },
        {
-                .ctl_name       = NET_NF_CONNTRACK_FRAG6_HIGH_THRESH,
                .procname       = "nf_conntrack_frag6_high_thresh",
                .data           = &nf_init_frags.high_thresh,
                .maxlen         = sizeof(unsigned int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec,
        },
-        { .ctl_name = 0 }
+        { }
 };
 #endif
@@ -170,13 +167,14 @@ out:
 /* Creation primitives. */
 static __inline__ struct nf_ct_frag6_queue *
-fq_find(__be32 id, struct in6_addr *src, struct in6_addr *dst)
+fq_find(__be32 id, u32 user, struct in6_addr *src, struct in6_addr *dst)
 {
        struct inet_frag_queue *q;
        struct ip6_create_arg arg;
        unsigned int hash;
        arg.id = id;
+        arg.user = user;
        arg.src = src;
        arg.dst = dst;
@@ -472,7 +470,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
        /* all original skbs are linked into the NFCT_FRAG6_CB(head).orig */
        fp = skb_shinfo(head)->frag_list;
-        if (NFCT_FRAG6_CB(fp)->orig == NULL)
+        if (fp && NFCT_FRAG6_CB(fp)->orig == NULL)
                /* at above code, head skb is divided into two skbs. */
                fp = fp->next;
@@ -561,7 +559,7 @@ find_prev_fhdr(struct sk_buff *skb, u8 *prevhdrp, int *prevhoff, int *fhoff)
        return 0;
 }
-struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
+struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb, u32 user)
 {
        struct sk_buff *clone;
        struct net_device *dev = skb->dev;
@@ -598,16 +596,10 @@ struct sk_buff *nf_ct_frag6_gather(struct sk_buff *skb)
        hdr = ipv6_hdr(clone);
        fhdr = (struct frag_hdr *)skb_transport_header(clone);
-        if (!(fhdr->frag_off & htons(0xFFF9))) {
-                pr_debug("Invalid fragment offset\n");
-                /* It is not a fragmented frame */
-                goto ret_orig;
-        }
        if (atomic_read(&nf_init_frags.mem) > nf_init_frags.high_thresh)
                nf_ct_frag6_evictor();
-        fq = fq_find(fhdr->identification, &hdr->saddr, &hdr->daddr);
+        fq = fq_find(fhdr->identification, user, &hdr->saddr, &hdr->daddr);
        if (fq == NULL) {
                pr_debug("Can't find and can't create new queue\n");
                goto ret_orig;
@@ -670,8 +662,8 @@ int nf_ct_frag6_init(void)
        nf_frags.frag_expire = nf_ct_frag6_expire;
        nf_frags.secret_interval = 10 * 60 * HZ;
        nf_init_frags.timeout = IPV6_FRAG_TIMEOUT;
-        nf_init_frags.high_thresh = 256 * 1024;
+        nf_init_frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
-        nf_init_frags.low_thresh = 192 * 1024;
+        nf_init_frags.low_thresh = IPV6_FRAG_LOW_THRESH;
        inet_frags_init_net(&nf_init_frags);
        inet_frags_init(&nf_frags);
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index c9605c3ad91f..58344c0fbd13 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -59,7 +59,7 @@ static const struct file_operations sockstat6_seq_fops = {
        .release = single_release_net,
 };
-static struct snmp_mib snmp6_ipstats_list[] = {
+static const struct snmp_mib snmp6_ipstats_list[] = {
 /* ipv6 mib according to RFC 2465 */
        SNMP_MIB_ITEM("Ip6InReceives", IPSTATS_MIB_INPKTS),
        SNMP_MIB_ITEM("Ip6InHdrErrors", IPSTATS_MIB_INHDRERRORS),
@@ -92,7 +92,7 @@ static struct snmp_mib snmp6_ipstats_list[] = {
        SNMP_MIB_SENTINEL
 };
-static struct snmp_mib snmp6_icmp6_list[] = {
+static const struct snmp_mib snmp6_icmp6_list[] = {
 /* icmpv6 mib according to RFC 2466 */
        SNMP_MIB_ITEM("Icmp6InMsgs", ICMP6_MIB_INMSGS),
        SNMP_MIB_ITEM("Icmp6InErrors", ICMP6_MIB_INERRORS),
@@ -120,7 +120,7 @@ static const char *const icmp6type2name[256] = {
 };
-static struct snmp_mib snmp6_udp6_list[] = {
+static const struct snmp_mib snmp6_udp6_list[] = {
        SNMP_MIB_ITEM("Udp6InDatagrams", UDP_MIB_INDATAGRAMS),
        SNMP_MIB_ITEM("Udp6NoPorts", UDP_MIB_NOPORTS),
        SNMP_MIB_ITEM("Udp6InErrors", UDP_MIB_INERRORS),
@@ -128,7 +128,7 @@ static struct snmp_mib snmp6_udp6_list[] = {
        SNMP_MIB_SENTINEL
 };
-static struct snmp_mib snmp6_udplite6_list[] = {
+static const struct snmp_mib snmp6_udplite6_list[] = {
        SNMP_MIB_ITEM("UdpLite6InDatagrams", UDP_MIB_INDATAGRAMS),
        SNMP_MIB_ITEM("UdpLite6NoPorts", UDP_MIB_NOPORTS),
        SNMP_MIB_ITEM("UdpLite6InErrors", UDP_MIB_INERRORS),
@@ -136,7 +136,7 @@ static struct snmp_mib snmp6_udplite6_list[] = {
        SNMP_MIB_SENTINEL
 };
-static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
+static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void __percpu **mib)
 {
        char name[32];
        int i;
@@ -170,8 +170,8 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
        return;
 }
-static inline void
+static void snmp6_seq_show_item(struct seq_file *seq, void __percpu **mib,
-snmp6_seq_show_item(struct seq_file *seq, void **mib, struct snmp_mib *itemlist)
+                                const struct snmp_mib *itemlist)
 {
        int i;
        for (i=0; itemlist[i].name; i++)
@@ -183,14 +183,15 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
 {
        struct net *net = (struct net *)seq->private;
-        snmp6_seq_show_item(seq, (void **)net->mib.ipv6_statistics,
+        snmp6_seq_show_item(seq, (void __percpu **)net->mib.ipv6_statistics,
                            snmp6_ipstats_list);
-        snmp6_seq_show_item(seq, (void **)net->mib.icmpv6_statistics,
+        snmp6_seq_show_item(seq, (void __percpu **)net->mib.icmpv6_statistics,
                            snmp6_icmp6_list);
-        snmp6_seq_show_icmpv6msg(seq, (void **)net->mib.icmpv6msg_statistics);
+        snmp6_seq_show_icmpv6msg(seq,
-        snmp6_seq_show_item(seq, (void **)net->mib.udp_stats_in6,
+                            (void __percpu **)net->mib.icmpv6msg_statistics);
+        snmp6_seq_show_item(seq, (void __percpu **)net->mib.udp_stats_in6,
                            snmp6_udp6_list);
-        snmp6_seq_show_item(seq, (void **)net->mib.udplite_stats_in6,
+        snmp6_seq_show_item(seq, (void __percpu **)net->mib.udplite_stats_in6,
                            snmp6_udplite6_list);
        return 0;
 }
@@ -213,9 +214,11 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
        struct inet6_dev *idev = (struct inet6_dev *)seq->private;
        seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
-        snmp6_seq_show_item(seq, (void **)idev->stats.ipv6, snmp6_ipstats_list);
+        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.ipv6,
-        snmp6_seq_show_item(seq, (void **)idev->stats.icmpv6, snmp6_icmp6_list);
+                            snmp6_ipstats_list);
-        snmp6_seq_show_icmpv6msg(seq, (void **)idev->stats.icmpv6msg);
+        snmp6_seq_show_item(seq, (void __percpu **)idev->stats.icmpv6,
+                            snmp6_icmp6_list);
+        snmp6_seq_show_icmpv6msg(seq, (void __percpu **)idev->stats.icmpv6msg);
        return 0;
 }
@@ -259,7 +262,7 @@ int snmp6_unregister_dev(struct inet6_dev *idev)
        struct net *net = dev_net(idev->dev);
        if (!net->mib.proc_net_devsnmp6)
                return -ENOENT;
-        if (!idev || !idev->stats.proc_dir_entry)
+        if (!idev->stats.proc_dir_entry)
                return -EINVAL;
        remove_proc_entry(idev->stats.proc_dir_entry->name,
                          net->mib.proc_net_devsnmp6);
@@ -267,7 +270,7 @@ int snmp6_unregister_dev(struct inet6_dev *idev)
        return 0;
 }
-static int ipv6_proc_init_net(struct net *net)
+static int __net_init ipv6_proc_init_net(struct net *net)
 {
        if (!proc_net_fops_create(net, "sockstat6", S_IRUGO,
                        &sockstat6_seq_fops))
@@ -288,7 +291,7 @@ proc_dev_snmp6_fail:
        return -ENOMEM;
 }
-static void ipv6_proc_exit_net(struct net *net)
+static void __net_exit ipv6_proc_exit_net(struct net *net)
 {
        proc_net_remove(net, "sockstat6");
        proc_net_remove(net, "dev_snmp6");
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4f24570b0869..8763b1a0814a 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -21,6 +21,7 @@
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/socket.h>
+#include <linux/slab.h>
 #include <linux/sockios.h>
 #include <linux/net.h>
 #include <linux/in6.h>
@@ -72,7 +73,7 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
        int is_multicast = ipv6_addr_is_multicast(loc_addr);
        sk_for_each_from(sk, node)
-                if (inet_sk(sk)->num == num) {
+                if (inet_sk(sk)->inet_num == num) {
                        struct ipv6_pinfo *np = inet6_sk(sk);
                        if (!net_eq(sock_net(sk), net))
@@ -249,7 +250,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        /* Raw sockets are IPv6 only */
        if (addr_type == IPV6_ADDR_MAPPED)
-                return(-EADDRNOTAVAIL);
+                return -EADDRNOTAVAIL;
        lock_sock(sk);
@@ -257,6 +258,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        if (sk->sk_state != TCP_CLOSE)
                goto out;
+        rcu_read_lock();
        /* Check if the address belongs to the host. */
        if (addr_type != IPV6_ADDR_ANY) {
                struct net_device *dev = NULL;
@@ -272,13 +274,13 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                        /* Binding to link-local address requires an interface */
                        if (!sk->sk_bound_dev_if)
-                                goto out;
+                                goto out_unlock;
-                        dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
+                        err = -ENODEV;
-                        if (!dev) {
+                        dev = dev_get_by_index_rcu(sock_net(sk),
-                                err = -ENODEV;
+                                                   sk->sk_bound_dev_if);
-                                goto out;
+                        if (!dev)
-                        }
+                                goto out_unlock;
                }
                /* ipv4 addr of the socket is invalid.  Only the
@@ -289,20 +291,18 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                        err = -EADDRNOTAVAIL;
                        if (!ipv6_chk_addr(sock_net(sk), &addr->sin6_addr,
                                           dev, 0)) {
-                                if (dev)
+                                goto out_unlock;
-                                        dev_put(dev);
-                                goto out;
                        }
                }
-                if (dev)
-                        dev_put(dev);
        }
-        inet->rcv_saddr = inet->saddr = v4addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
        ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
        if (!(addr_type & IPV6_ADDR_MULTICAST))
                ipv6_addr_copy(&np->saddr, &addr->sin6_addr);
        err = 0;
+out_unlock:
+        rcu_read_unlock();
 out:
        release_sock(sk);
        return err;
@@ -381,8 +381,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
        }
        /* Charge it to the socket. */
-        if (sock_queue_rcv_skb(sk,skb)<0) {
+        if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                kfree_skb(skb);
                return NET_RX_DROP;
        }
@@ -416,14 +415,14 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
                                   skb_network_header_len(skb));
                if (!csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                     &ipv6_hdr(skb)->daddr,
-                                     skb->len, inet->num, skb->csum))
+                                     skb->len, inet->inet_num, skb->csum))
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
        }
        if (!skb_csum_unnecessary(skb))
                skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                                         &ipv6_hdr(skb)->daddr,
                                                         skb->len,
-                                                         inet->num, 0));
+                                                         inet->inet_num, 0));
        if (inet->hdrincl) {
                if (skb_checksum_complete(skb)) {
@@ -497,7 +496,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                        sin6->sin6_scope_id = IP6CB(skb)->iif;
        }
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
        if (np->rxopt.all)
                datagram_recv_ctl(sk, msg, skb);
@@ -518,7 +517,6 @@ csum_copy_err:
           as some normal condition.
         */
        err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
-        atomic_inc(&sk->sk_drops);
        goto out;
 }
@@ -766,8 +764,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                proto = ntohs(sin6->sin6_port);
                if (!proto)
-                        proto = inet->num;
+                        proto = inet->inet_num;
-                else if (proto != inet->num)
+                else if (proto != inet->inet_num)
                        return(-EINVAL);
                if (proto > 255)
@@ -800,7 +798,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -EDESTADDRREQ;
-                proto = inet->num;
+                proto = inet->inet_num;
                daddr = &np->daddr;
                fl.fl6_flowlabel = np->flow_label;
        }
@@ -967,7 +965,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
        switch (optname) {
                case IPV6_CHECKSUM:
-                        if (inet_sk(sk)->num == IPPROTO_ICMPV6 &&
+                        if (inet_sk(sk)->inet_num == IPPROTO_ICMPV6 &&
                            level == IPPROTO_IPV6) {
                                /*
                                 * RFC3542 tells that IPV6_CHECKSUM socket
@@ -1007,7 +1005,7 @@ static int rawv6_setsockopt(struct sock *sk, int level, int optname,
                        break;
                case SOL_ICMPV6:
-                        if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                        if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                                return -EOPNOTSUPP;
                        return rawv6_seticmpfilter(sk, level, optname, optval,
                                                   optlen);
@@ -1030,7 +1028,7 @@ static int compat_rawv6_setsockopt(struct sock *sk, int level, int optname,
        case SOL_RAW:
                break;
        case SOL_ICMPV6:
-                if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                        return -EOPNOTSUPP;
                return rawv6_seticmpfilter(sk, level, optname, optval, optlen);
        case SOL_IPV6:
@@ -1087,7 +1085,7 @@ static int rawv6_getsockopt(struct sock *sk, int level, int optname,
                        break;
                case SOL_ICMPV6:
-                        if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                        if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                                return -EOPNOTSUPP;
                        return rawv6_geticmpfilter(sk, level, optname, optval,
                                                   optlen);
@@ -1110,7 +1108,7 @@ static int compat_rawv6_getsockopt(struct sock *sk, int level, int optname,
        case SOL_RAW:
                break;
        case SOL_ICMPV6:
-                if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                        return -EOPNOTSUPP;
                return rawv6_geticmpfilter(sk, level, optname, optval, optlen);
        case SOL_IPV6:
@@ -1157,7 +1155,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
 static void rawv6_close(struct sock *sk, long timeout)
 {
-        if (inet_sk(sk)->num == IPPROTO_RAW)
+        if (inet_sk(sk)->inet_num == IPPROTO_RAW)
                ip6_ra_control(sk, -1);
        ip6mr_sk_done(sk);
        sk_common_release(sk);
@@ -1176,7 +1174,7 @@ static int rawv6_init_sk(struct sock *sk)
 {
        struct raw6_sock *rp = raw6_sk(sk);
-        switch (inet_sk(sk)->num) {
+        switch (inet_sk(sk)->inet_num) {
        case IPPROTO_ICMPV6:
                rp->checksum = 1;
                rp->offset   = 2;
@@ -1226,7 +1224,7 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
        dest  = &np->daddr;
        src   = &np->rcv_saddr;
        destp = 0;
-        srcp  = inet_sk(sp)->num;
+        srcp  = inet_sk(sp)->inet_num;
        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
@@ -1278,7 +1276,7 @@ static const struct file_operations raw6_seq_fops = {
        .release =      seq_release_net,
 };
-static int raw6_init_net(struct net *net)
+static int __net_init raw6_init_net(struct net *net)
 {
        if (!proc_net_fops_create(net, "raw6", S_IRUGO, &raw6_seq_fops))
                return -ENOMEM;
@@ -1286,7 +1284,7 @@ static int raw6_init_net(struct net *net)
        return 0;
 }
-static void raw6_exit_net(struct net *net)
+static void __net_exit raw6_exit_net(struct net *net)
 {
        proc_net_remove(net, "raw6");
 }
@@ -1338,7 +1336,6 @@ static struct inet_protosw rawv6_protosw = {
        .protocol       = IPPROTO_IP,   /* wild card */
        .prot           = &rawv6_prot,
        .ops            = &inet6_sockraw_ops,
-        .capability     = CAP_NET_RAW,
        .no_check       = UDP_CSUM_DEFAULT,
        .flags          = INET_PROTOSW_REUSE,
 };
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index da5bd0ed83df..6d4292ff5854 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -41,6 +41,7 @@
 #include <linux/random.h>
 #include <linux/jhash.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -72,6 +73,7 @@ struct frag_queue
        struct inet_frag_queue  q;
        __be32                  id;             /* fragment id          */
+        u32                     user;
        struct in6_addr         saddr;
        struct in6_addr         daddr;
@@ -141,7 +143,7 @@ int ip6_frag_match(struct inet_frag_queue *q, void *a)
        struct ip6_create_arg *arg = a;
        fq = container_of(q, struct frag_queue, q);
-        return (fq->id == arg->id &&
+        return (fq->id == arg->id && fq->user == arg->user &&
                        ipv6_addr_equal(&fq->saddr, arg->src) &&
                        ipv6_addr_equal(&fq->daddr, arg->dst));
 }
@@ -163,6 +165,7 @@ void ip6_frag_init(struct inet_frag_queue *q, void *a)
        struct ip6_create_arg *arg = a;
        fq->id = arg->id;
+        fq->user = arg->user;
        ipv6_addr_copy(&fq->saddr, arg->src);
        ipv6_addr_copy(&fq->daddr, arg->dst);
 }
@@ -208,18 +211,17 @@ static void ip6_frag_expire(unsigned long data)
        fq_kill(fq);
        net = container_of(fq->q.net, struct net, ipv6.frags);
-        dev = dev_get_by_index(net, fq->iif);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, fq->iif);
        if (!dev)
-                goto out;
+                goto out_rcu_unlock;
-        rcu_read_lock();
        IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
        IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
-        rcu_read_unlock();
        /* Don't send error if the first segment did not arrive. */
        if (!(fq->q.last_in & INET_FRAG_FIRST_IN) || !fq->q.fragments)
-                goto out;
+                goto out_rcu_unlock;
        /*
           But use as source device on which LAST ARRIVED
@@ -227,23 +229,23 @@ static void ip6_frag_expire(unsigned long data)
           pointer directly, device might already disappeared.
         */
        fq->q.fragments->dev = dev;
-        icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
+        icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0);
+out_rcu_unlock:
+        rcu_read_unlock();
 out:
-        if (dev)
-                dev_put(dev);
        spin_unlock(&fq->q.lock);
        fq_put(fq);
 }
 static __inline__ struct frag_queue *
-fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
+fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst)
-        struct inet6_dev *idev)
 {
        struct inet_frag_queue *q;
        struct ip6_create_arg arg;
        unsigned int hash;
        arg.id = id;
+        arg.user = IP6_DEFRAG_LOCAL_DELIVER;
        arg.src = src;
        arg.dst = dst;
@@ -252,13 +254,9 @@ fq_find(struct net *net, __be32 id, struct in6_addr *src, struct in6_addr *dst,
        q = inet_frag_find(&net->ipv6.frags, &ip6_frags, &arg, hash);
        if (q == NULL)
-                goto oom;
+                return NULL;
        return container_of(q, struct frag_queue, q);
-oom:
-        IP6_INC_STATS_BH(net, idev, IPSTATS_MIB_REASMFAILS);
-        return NULL;
 }
 static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
@@ -604,8 +602,8 @@ static int ipv6_frag_rcv(struct sk_buff *skb)
        if (atomic_read(&net->ipv6.frags.mem) > net->ipv6.frags.high_thresh)
                ip6_evictor(net, ip6_dst_idev(skb_dst(skb)));
-        if ((fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
+        fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr);
-                          ip6_dst_idev(skb_dst(skb)))) != NULL) {
+        if (fq != NULL) {
                int ret;
                spin_lock(&fq->q.lock);
@@ -636,7 +634,6 @@ static const struct inet6_protocol frag_protocol =
 #ifdef CONFIG_SYSCTL
 static struct ctl_table ip6_frags_ns_ctl_table[] = {
        {
-                .ctl_name       = NET_IPV6_IP6FRAG_HIGH_THRESH,
                .procname       = "ip6frag_high_thresh",
                .data           = &init_net.ipv6.frags.high_thresh,
                .maxlen         = sizeof(int),
@@ -644,7 +641,6 @@ static struct ctl_table ip6_frags_ns_ctl_table[] = {
                .proc_handler   = proc_dointvec
        },
        {
-                .ctl_name       = NET_IPV6_IP6FRAG_LOW_THRESH,
                .procname       = "ip6frag_low_thresh",
                .data           = &init_net.ipv6.frags.low_thresh,
                .maxlen         = sizeof(int),
@@ -652,37 +648,33 @@ static struct ctl_table ip6_frags_ns_ctl_table[] = {
                .proc_handler   = proc_dointvec
        },
        {
-                .ctl_name       = NET_IPV6_IP6FRAG_TIME,
                .procname       = "ip6frag_time",
                .data           = &init_net.ipv6.frags.timeout,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies,
        },
        { }
 };
 static struct ctl_table ip6_frags_ctl_table[] = {
        {
-                .ctl_name       = NET_IPV6_IP6FRAG_SECRET_INTERVAL,
                .procname       = "ip6frag_secret_interval",
                .data           = &ip6_frags.secret_interval,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec_jiffies,
-                .strategy       = sysctl_jiffies
        },
        { }
 };
-static int ip6_frags_ns_sysctl_register(struct net *net)
+static int __net_init ip6_frags_ns_sysctl_register(struct net *net)
 {
        struct ctl_table *table;
        struct ctl_table_header *hdr;
        table = ip6_frags_ns_ctl_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
                if (table == NULL)
                        goto err_alloc;
@@ -700,19 +692,20 @@ static int ip6_frags_ns_sysctl_register(struct net *net)
        return 0;
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                kfree(table);
 err_alloc:
        return -ENOMEM;
 }
-static void ip6_frags_ns_sysctl_unregister(struct net *net)
+static void __net_exit ip6_frags_ns_sysctl_unregister(struct net *net)
 {
        struct ctl_table *table;
        table = net->ipv6.sysctl.frags_hdr->ctl_table_arg;
        unregister_net_sysctl_table(net->ipv6.sysctl.frags_hdr);
-        kfree(table);
+        if (!net_eq(net, &init_net))
+                kfree(table);
 }
 static struct ctl_table_header *ip6_ctl_header;
@@ -748,10 +741,10 @@ static inline void ip6_frags_sysctl_unregister(void)
 }
 #endif
-static int ipv6_frags_init_net(struct net *net)
+static int __net_init ipv6_frags_init_net(struct net *net)
 {
-        net->ipv6.frags.high_thresh = 256 * 1024;
+        net->ipv6.frags.high_thresh = IPV6_FRAG_HIGH_THRESH;
-        net->ipv6.frags.low_thresh = 192 * 1024;
+        net->ipv6.frags.low_thresh = IPV6_FRAG_LOW_THRESH;
        net->ipv6.frags.timeout = IPV6_FRAG_TIMEOUT;
        inet_frags_init_net(&net->ipv6.frags);
@@ -759,7 +752,7 @@ static int ipv6_frags_init_net(struct net *net)
        return ip6_frags_ns_sysctl_register(net);
 }
-static void ipv6_frags_exit_net(struct net *net)
+static void __net_exit ipv6_frags_exit_net(struct net *net)
 {
        ip6_frags_ns_sysctl_unregister(net);
        inet_frags_exit_net(&net->ipv6.frags, &ip6_frags);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d6fe7646a8ff..05ebd7833043 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -40,6 +40,7 @@
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
 #include <linux/nsproxy.h>
+#include <linux/slab.h>
 #include <net/net_namespace.h>
 #include <net/snmp.h>
 #include <net/ipv6.h>
@@ -814,20 +815,13 @@ struct dst_entry * ip6_route_output(struct net *net, struct sock *sk,
 {
        int flags = 0;
-        if (rt6_need_strict(&fl->fl6_dst))
+        if (fl->oif || rt6_need_strict(&fl->fl6_dst))
                flags |= RT6_LOOKUP_F_IFACE;
        if (!ipv6_addr_any(&fl->fl6_src))
                flags |= RT6_LOOKUP_F_HAS_SADDR;
-        else if (sk) {
+        else if (sk)
-                unsigned int prefs = inet6_sk(sk)->srcprefs;
+                flags |= rt6_srcprefs2flags(inet6_sk(sk)->srcprefs);
-                if (prefs & IPV6_PREFER_SRC_TMP)
-                        flags |= RT6_LOOKUP_F_SRCPREF_TMP;
-                if (prefs & IPV6_PREFER_SRC_PUBLIC)
-                        flags |= RT6_LOOKUP_F_SRCPREF_PUBLIC;
-                if (prefs & IPV6_PREFER_SRC_COA)
-                        flags |= RT6_LOOKUP_F_SRCPREF_COA;
-        }
        return fib6_rule_lookup(net, fl, flags, ip6_pol_route_output);
 }
@@ -886,7 +880,7 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
        rt = (struct rt6_info *) dst;
-        if (rt && rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
                return dst;
        return NULL;
@@ -897,19 +891,24 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
        struct rt6_info *rt = (struct rt6_info *) dst;
        if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE)
+                if (rt->rt6i_flags & RTF_CACHE) {
-                        ip6_del_rt(rt);
+                        if (rt6_check_expired(rt)) {
-                else
+                                ip6_del_rt(rt);
+                                dst = NULL;
+                        }
+                } else {
                        dst_release(dst);
+                        dst = NULL;
+                }
        }
-        return NULL;
+        return dst;
 }
 static void ip6_link_failure(struct sk_buff *skb)
 {
        struct rt6_info *rt;
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_ADDR_UNREACH, 0);
        rt = (struct rt6_info *) skb_dst(skb);
        if (rt) {
@@ -1471,9 +1470,10 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                },
                        },
                },
-                .gateway = *gateway,
        };
+        ipv6_addr_copy(&rdfl.gateway, gateway);
        if (rt6_need_strict(dest))
                flags |= RT6_LOOKUP_F_IFACE;
@@ -1872,7 +1872,7 @@ static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
        switch (ipstats_mib_noroutes) {
        case IPSTATS_MIB_INNOROUTES:
                type = ipv6_addr_type(&ipv6_hdr(skb)->daddr);
-                if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED) {
+                if (type == IPV6_ADDR_ANY) {
                        IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
                                      IPSTATS_MIB_INADDRERRORS);
                        break;
@@ -1883,7 +1883,7 @@ static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
                              ipstats_mib_noroutes);
                break;
        }
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0);
        kfree_skb(skb);
        return 0;
 }
@@ -2546,7 +2546,6 @@ ctl_table ipv6_route_table_template[] = {
                .proc_handler   =       ipv6_sysctl_rtcache_flush
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_THRESH,
                .procname       =       "gc_thresh",
                .data           =       &ip6_dst_ops_template.gc_thresh,
                .maxlen         =       sizeof(int),
@@ -2554,7 +2553,6 @@ ctl_table ipv6_route_table_template[] = {
                .proc_handler   =       proc_dointvec,
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_MAX_SIZE,
                .procname       =       "max_size",
                .data           =       &init_net.ipv6.sysctl.ip6_rt_max_size,
                .maxlen         =       sizeof(int),
@@ -2562,72 +2560,58 @@ ctl_table ipv6_route_table_template[] = {
                .proc_handler   =       proc_dointvec,
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_MIN_INTERVAL,
                .procname       =       "gc_min_interval",
                .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
                .maxlen         =       sizeof(int),
                .mode           =       0644,
                .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_TIMEOUT,
                .procname       =       "gc_timeout",
                .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_timeout,
                .maxlen         =       sizeof(int),
                .mode           =       0644,
                .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_INTERVAL,
                .procname       =       "gc_interval",
                .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_interval,
                .maxlen         =       sizeof(int),
                .mode           =       0644,
                .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_ELASTICITY,
                .procname       =       "gc_elasticity",
                .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_elasticity,
                .maxlen         =       sizeof(int),
                .mode           =       0644,
                .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_MTU_EXPIRES,
                .procname       =       "mtu_expires",
                .data           =       &init_net.ipv6.sysctl.ip6_rt_mtu_expires,
                .maxlen         =       sizeof(int),
                .mode           =       0644,
                .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_MIN_ADVMSS,
                .procname       =       "min_adv_mss",
                .data           =       &init_net.ipv6.sysctl.ip6_rt_min_advmss,
                .maxlen         =       sizeof(int),
                .mode           =       0644,
                .proc_handler   =       proc_dointvec_jiffies,
-                .strategy       =       sysctl_jiffies,
        },
        {
-                .ctl_name       =       NET_IPV6_ROUTE_GC_MIN_INTERVAL_MS,
                .procname       =       "gc_min_interval_ms",
                .data           =       &init_net.ipv6.sysctl.ip6_rt_gc_min_interval,
                .maxlen         =       sizeof(int),
                .mode           =       0644,
                .proc_handler   =       proc_dointvec_ms_jiffies,
-                .strategy       =       sysctl_ms_jiffies,
        },
-        { .ctl_name = 0 }
+        { }
 };
-struct ctl_table *ipv6_route_sysctl_init(struct net *net)
+struct ctl_table * __net_init ipv6_route_sysctl_init(struct net *net)
 {
        struct ctl_table *table;
@@ -2645,13 +2629,14 @@ struct ctl_table *ipv6_route_sysctl_init(struct net *net)
                table[6].data = &net->ipv6.sysctl.ip6_rt_gc_elasticity;
                table[7].data = &net->ipv6.sysctl.ip6_rt_mtu_expires;
                table[8].data = &net->ipv6.sysctl.ip6_rt_min_advmss;
+                table[9].data = &net->ipv6.sysctl.ip6_rt_gc_min_interval;
        }
        return table;
 }
 #endif
-static int ip6_route_net_init(struct net *net)
+static int __net_init ip6_route_net_init(struct net *net)
 {
        int ret = -ENOMEM;
@@ -2716,7 +2701,7 @@ out_ip6_dst_ops:
        goto out;
 }
-static void ip6_route_net_exit(struct net *net)
+static void __net_exit ip6_route_net_exit(struct net *net)
 {
 #ifdef CONFIG_PROC_FS
        proc_net_remove(net, "ipv6_route");
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index dbd19a78ca73..5abae10cd884 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -28,6 +28,7 @@
 #include <linux/netdevice.h>
 #include <linux/if_arp.h>
 #include <linux/icmp.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <linux/init.h>
 #include <linux/netfilter_ipv4.h>
@@ -62,11 +63,10 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
-static void ipip6_fb_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_setup(struct net_device *dev);
-static int sit_net_id;
+static int sit_net_id __read_mostly;
 struct sit_net {
        struct ip_tunnel *tunnels_r_l[HASH_SIZE];
        struct ip_tunnel *tunnels_r[HASH_SIZE];
@@ -77,8 +77,17 @@ struct sit_net {
        struct net_device *fb_tunnel_dev;
 };
-static DEFINE_RWLOCK(ipip6_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip6_lock);
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+/*
+ * Must be invoked with rcu_read_lock
+ */
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                struct net_device *dev, __be32 remote, __be32 local)
 {
@@ -87,26 +96,26 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
        struct ip_tunnel *t;
        struct sit_net *sitn = net_generic(net, sit_net_id);
-        for (t = sitn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r_l[h0 ^ h1]) {
                if (local == t->parms.iph.saddr &&
                    remote == t->parms.iph.daddr &&
                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                    (t->dev->flags & IFF_UP))
                        return t;
        }
-        for (t = sitn->tunnels_r[h0]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r[h0]) {
                if (remote == t->parms.iph.daddr &&
                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                    (t->dev->flags & IFF_UP))
                        return t;
        }
-        for (t = sitn->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_l[h1]) {
                if (local == t->parms.iph.saddr &&
                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                    (t->dev->flags & IFF_UP))
                        return t;
        }
-        t = sitn->tunnels_wc[0];
+        t = rcu_dereference(sitn->tunnels_wc[0]);
        if ((t != NULL) && (t->dev->flags & IFF_UP))
                return t;
        return NULL;
@@ -143,9 +152,9 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
        for (tp = ipip6_bucket(sitn, t); *tp; tp = &(*tp)->next) {
                if (t == *tp) {
-                        write_lock_bh(&ipip6_lock);
+                        spin_lock_bh(&ipip6_lock);
                        *tp = t->next;
-                        write_unlock_bh(&ipip6_lock);
+                        spin_unlock_bh(&ipip6_lock);
                        break;
                }
        }
@@ -155,10 +164,27 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
        struct ip_tunnel **tp = ipip6_bucket(sitn, t);
+        spin_lock_bh(&ipip6_lock);
        t->next = *tp;
-        write_lock_bh(&ipip6_lock);
+        rcu_assign_pointer(*tp, t);
-        *tp = t;
+        spin_unlock_bh(&ipip6_lock);
-        write_unlock_bh(&ipip6_lock);
+}
+static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
+{
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel *t = netdev_priv(dev);
+        if (t->dev == sitn->fb_tunnel_dev) {
+                ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
+                t->ip6rd.relay_prefix = 0;
+                t->ip6rd.prefixlen = 16;
+                t->ip6rd.relay_prefixlen = 0;
+        } else {
+                struct ip_tunnel *t0 = netdev_priv(sitn->fb_tunnel_dev);
+                memcpy(&t->ip6rd, &t0->ip6rd, sizeof(t->ip6rd));
+        }
+#endif
 }
 static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
@@ -204,6 +230,7 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
        nt->parms = *parms;
        ipip6_tunnel_init(dev);
+        ipip6_tunnel_clone_6rd(dev, sitn);
        if (parms->i_flags & SIT_ISATAP)
                dev->priv_flags |= IFF_ISATAP;
@@ -222,15 +249,22 @@ failed:
        return NULL;
 }
+static DEFINE_SPINLOCK(ipip6_prl_lock);
+#define for_each_prl_rcu(start)                 \
+        for (prl = rcu_dereference(start);      \
+             prl;                               \
+             prl = rcu_dereference(prl->next))
 static struct ip_tunnel_prl_entry *
 __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 {
-        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *)NULL;
+        struct ip_tunnel_prl_entry *prl;
-        for (p = t->prl; p; p = p->next)
+        for_each_prl_rcu(t->prl)
-                if (p->addr == addr)
+                if (prl->addr == addr)
                        break;
-        return p;
+        return prl;
 }
@@ -255,7 +289,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
                NULL;
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
        ca = t->prl_count < cmax ? t->prl_count : cmax;
@@ -273,7 +307,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
        }
        c = 0;
-        for (prl = t->prl; prl; prl = prl->next) {
+        for_each_prl_rcu(t->prl) {
                if (c >= cmax)
                        break;
                if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
@@ -285,7 +319,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                        break;
        }
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
        len = sizeof(*kp) * c;
        ret = 0;
@@ -306,12 +340,14 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
        if (a->addr == htonl(INADDR_ANY))
                return -EINVAL;
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
        for (p = t->prl; p; p = p->next) {
                if (p->addr == a->addr) {
-                        if (chg)
+                        if (chg) {
-                                goto update;
+                                p->flags = a->flags;
+                                goto out;
+                        }
                        err = -EEXIST;
                        goto out;
                }
@@ -329,45 +365,61 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
        }
        p->next = t->prl;
-        t->prl = p;
-        t->prl_count++;
-update:
        p->addr = a->addr;
        p->flags = a->flags;
+        t->prl_count++;
+        rcu_assign_pointer(t->prl, p);
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
        return err;
 }
+static void prl_entry_destroy_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_tunnel_prl_entry, rcu_head));
+}
+static void prl_list_destroy_rcu(struct rcu_head *head)
+{
+        struct ip_tunnel_prl_entry *p, *n;
+        p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
+        do {
+                n = p->next;
+                kfree(p);
+                p = n;
+        } while (p);
+}
 static int
 ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 {
        struct ip_tunnel_prl_entry *x, **p;
        int err = 0;
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
        if (a && a->addr != htonl(INADDR_ANY)) {
                for (p = &t->prl; *p; p = &(*p)->next) {
                        if ((*p)->addr == a->addr) {
                                x = *p;
                                *p = x->next;
-                                kfree(x);
+                                call_rcu(&x->rcu_head, prl_entry_destroy_rcu);
                                t->prl_count--;
                                goto out;
                        }
                }
                err = -ENXIO;
        } else {
-                while (t->prl) {
+                if (t->prl) {
+                        t->prl_count = 0;
                        x = t->prl;
-                        t->prl = t->prl->next;
+                        call_rcu(&x->rcu_head, prl_list_destroy_rcu);
-                        kfree(x);
+                        t->prl = NULL;
-                        t->prl_count--;
                }
        }
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
        return err;
 }
@@ -377,7 +429,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
        struct ip_tunnel_prl_entry *p;
        int ok = 1;
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
        p = __ipip6_tunnel_locate_prl(t, iph->saddr);
        if (p) {
                if (p->flags & PRL_DEFAULT)
@@ -393,7 +445,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
                else
                        ok = 0;
        }
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
        return ok;
 }
@@ -403,9 +455,9 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
        struct sit_net *sitn = net_generic(net, sit_net_id);
        if (dev == sitn->fb_tunnel_dev) {
-                write_lock_bh(&ipip6_lock);
+                spin_lock_bh(&ipip6_lock);
                sitn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip6_lock);
+                spin_unlock_bh(&ipip6_lock);
                dev_put(dev);
        } else {
                ipip6_tunnel_unlink(sitn, netdev_priv(dev));
@@ -458,7 +510,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
        err = -ENOENT;
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
        t = ipip6_tunnel_lookup(dev_net(skb->dev),
                                skb->dev,
                                iph->daddr,
@@ -476,7 +528,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                t->err_count = 1;
        t->err_time = jiffies;
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
        return err;
 }
@@ -496,7 +548,7 @@ static int ipip6_rcv(struct sk_buff *skb)
        iph = ip_hdr(skb);
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
        tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                     iph->saddr, iph->daddr);
        if (tunnel != NULL) {
@@ -510,7 +562,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
                    !isatap_chksrc(skb, iph, tunnel)) {
                        tunnel->dev->stats.rx_errors++;
-                        read_unlock(&ipip6_lock);
+                        rcu_read_unlock();
                        kfree_skb(skb);
                        return 0;
                }
@@ -521,28 +573,52 @@ static int ipip6_rcv(struct sk_buff *skb)
                nf_reset(skb);
                ipip6_ecn_decapsulate(iph, skb);
                netif_rx(skb);
-                read_unlock(&ipip6_lock);
+                rcu_read_unlock();
                return 0;
        }
        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
 out:
        kfree_skb(skb);
        return 0;
 }
-/* Returns the embedded IPv4 address if the IPv6 address
+/*
-   comes from 6to4 (RFC 3056) addr space */
+ * Returns the embedded IPv4 address if the IPv6 address
+ * comes from 6rd / 6to4 (RFC 3056) addr space.
-static inline __be32 try_6to4(struct in6_addr *v6dst)
+ */
+static inline
+__be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 {
        __be32 dst = 0;
+#ifdef CONFIG_IPV6_SIT_6RD
+        if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
+                              tunnel->ip6rd.prefixlen)) {
+                unsigned pbw0, pbi0;
+                int pbi1;
+                u32 d;
+                pbw0 = tunnel->ip6rd.prefixlen >> 5;
+                pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
+                d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
+                    tunnel->ip6rd.relay_prefixlen;
+                pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
+                if (pbi1 > 0)
+                        d |= ntohl(v6dst->s6_addr32[pbw0 + 1]) >>
+                             (32 - pbi1);
+                dst = tunnel->ip6rd.relay_prefix | htonl(d);
+        }
+#else
        if (v6dst->s6_addr16[0] == htons(0x2002)) {
                /* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
                memcpy(&dst, &v6dst->s6_addr16[1], 4);
        }
+#endif
        return dst;
 }
@@ -555,10 +631,12 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                     struct net_device *dev)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
        struct iphdr  *tiph = &tunnel->parms.iph;
        struct ipv6hdr *iph6 = ipv6_hdr(skb);
        u8     tos = tunnel->parms.iph.tos;
+        __be16 df = tiph->frag_off;
        struct rtable *rt;                      /* Route to the other host */
        struct net_device *tdev;                        /* Device to other host */
        struct iphdr  *iph;                     /* Our new IP header */
@@ -595,7 +673,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        }
        if (!dst)
-                dst = try_6to4(&iph6->daddr);
+                dst = try_6rd(&iph6->daddr, tunnel);
        if (!dst) {
                struct neighbour *neigh = NULL;
@@ -648,25 +726,28 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                goto tx_error;
        }
-        if (tiph->frag_off)
+        if (df) {
                mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
-        else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
-        if (mtu < 68) {
+                if (mtu < 68) {
-                stats->collisions++;
+                        stats->collisions++;
-                ip_rt_put(rt);
+                        ip_rt_put(rt);
-                goto tx_error;
+                        goto tx_error;
-        }
+                }
-        if (mtu < IPV6_MIN_MTU)
-                mtu = IPV6_MIN_MTU;
-        if (tunnel->parms.iph.daddr && skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
-        if (skb->len > mtu) {
+                if (mtu < IPV6_MIN_MTU) {
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        mtu = IPV6_MIN_MTU;
-                ip_rt_put(rt);
+                        df = 0;
-                goto tx_error;
+                }
+                if (tunnel->parms.iph.daddr && skb_dst(skb))
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+                if (skb->len > mtu) {
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
        }
        if (tunnel->err_count > 0) {
@@ -688,7 +769,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                if (!new_skb) {
                        ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                        dev_kfree_skb(skb);
                        return NETDEV_TX_OK;
                }
@@ -714,11 +795,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        iph                     =       ip_hdr(skb);
        iph->version            =       4;
        iph->ihl                =       sizeof(struct iphdr)>>2;
-        if (mtu > IPV6_MIN_MTU)
+        iph->frag_off           =       df;
-                iph->frag_off   =       tiph->frag_off;
-        else
-                iph->frag_off   =       0;
        iph->protocol           =       IPPROTO_IPV6;
        iph->tos                =       INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
        iph->daddr              =       rt->rt_dst;
@@ -785,9 +862,15 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
        struct ip_tunnel *t;
        struct net *net = dev_net(dev);
        struct sit_net *sitn = net_generic(net, sit_net_id);
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel_6rd ip6rd;
+#endif
        switch (cmd) {
        case SIOCGETTUNNEL:
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCGET6RD:
+#endif
                t = NULL;
                if (dev == sitn->fb_tunnel_dev) {
                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
@@ -798,9 +881,25 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                }
                if (t == NULL)
                        t = netdev_priv(dev);
-                memcpy(&p, &t->parms, sizeof(p));
-                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
+                err = -EFAULT;
-                        err = -EFAULT;
+                if (cmd == SIOCGETTUNNEL) {
+                        memcpy(&p, &t->parms, sizeof(p));
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p,
+                                         sizeof(p)))
+                                goto done;
+#ifdef CONFIG_IPV6_SIT_6RD
+                } else {
+                        ipv6_addr_copy(&ip6rd.prefix, &t->ip6rd.prefix);
+                        ip6rd.relay_prefix = t->ip6rd.relay_prefix;
+                        ip6rd.prefixlen = t->ip6rd.prefixlen;
+                        ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &ip6rd,
+                                         sizeof(ip6rd)))
+                                goto done;
+#endif
+                }
+                err = 0;
                break;
        case SIOCADDTUNNEL:
@@ -921,6 +1020,54 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                netdev_state_change(dev);
                break;
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCADD6RD:
+        case SIOCCHG6RD:
+        case SIOCDEL6RD:
+                err = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        goto done;
+                err = -EFAULT;
+                if (copy_from_user(&ip6rd, ifr->ifr_ifru.ifru_data,
+                                   sizeof(ip6rd)))
+                        goto done;
+                t = netdev_priv(dev);
+                if (cmd != SIOCDEL6RD) {
+                        struct in6_addr prefix;
+                        __be32 relay_prefix;
+                        err = -EINVAL;
+                        if (ip6rd.relay_prefixlen > 32 ||
+                            ip6rd.prefixlen + (32 - ip6rd.relay_prefixlen) > 64)
+                                goto done;
+                        ipv6_addr_prefix(&prefix, &ip6rd.prefix,
+                                         ip6rd.prefixlen);
+                        if (!ipv6_addr_equal(&prefix, &ip6rd.prefix))
+                                goto done;
+                        if (ip6rd.relay_prefixlen)
+                                relay_prefix = ip6rd.relay_prefix &
+                                               htonl(0xffffffffUL <<
+                                                     (32 - ip6rd.relay_prefixlen));
+                        else
+                                relay_prefix = 0;
+                        if (relay_prefix != ip6rd.relay_prefix)
+                                goto done;
+                        ipv6_addr_copy(&t->ip6rd.prefix, &prefix);
+                        t->ip6rd.relay_prefix = relay_prefix;
+                        t->ip6rd.prefixlen = ip6rd.prefixlen;
+                        t->ip6rd.relay_prefixlen = ip6rd.relay_prefixlen;
+                } else
+                        ipip6_tunnel_clone_6rd(dev, sitn);
+                err = 0;
+                break;
+#endif
        default:
                err = -EINVAL;
        }
@@ -972,7 +1119,7 @@ static void ipip6_tunnel_init(struct net_device *dev)
        ipip6_tunnel_bind_dev(dev);
 }
-static void ipip6_fb_tunnel_init(struct net_device *dev)
+static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
        struct iphdr *iph = &tunnel->parms.iph;
@@ -997,33 +1144,27 @@ static struct xfrm_tunnel sit_handler = {
        .priority       =       1,
 };
-static void sit_destroy_tunnels(struct sit_net *sitn)
+static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
 {
        int prio;
        for (prio = 1; prio < 4; prio++) {
                int h;
                for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
+                        struct ip_tunnel *t = sitn->tunnels[prio][h];
-                        while ((t = sitn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                }
        }
 }
-static int sit_init_net(struct net *net)
+static int __net_init sit_init_net(struct net *net)
 {
+        struct sit_net *sitn = net_generic(net, sit_net_id);
        int err;
-        struct sit_net *sitn;
-        err = -ENOMEM;
-        sitn = kzalloc(sizeof(struct sit_net), GFP_KERNEL);
-        if (sitn == NULL)
-                goto err_alloc;
-        err = net_assign_generic(net, sit_net_id, sitn);
-        if (err < 0)
-                goto err_assign;
        sitn->tunnels[0] = sitn->tunnels_wc;
        sitn->tunnels[1] = sitn->tunnels_l;
@@ -1039,6 +1180,7 @@ static int sit_init_net(struct net *net)
        dev_net_set(sitn->fb_tunnel_dev, net);
        ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+        ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
        if ((err = register_netdev(sitn->fb_tunnel_dev)))
                goto err_reg_dev;
@@ -1049,35 +1191,34 @@ err_reg_dev:
        dev_put(sitn->fb_tunnel_dev);
        free_netdev(sitn->fb_tunnel_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(sitn);
-err_alloc:
        return err;
 }
-static void sit_exit_net(struct net *net)
+static void __net_exit sit_exit_net(struct net *net)
 {
-        struct sit_net *sitn;
+        struct sit_net *sitn = net_generic(net, sit_net_id);
+        LIST_HEAD(list);
-        sitn = net_generic(net, sit_net_id);
        rtnl_lock();
-        sit_destroy_tunnels(sitn);
+        sit_destroy_tunnels(sitn, &list);
-        unregister_netdevice(sitn->fb_tunnel_dev);
+        unregister_netdevice_queue(sitn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
        rtnl_unlock();
-        kfree(sitn);
 }
 static struct pernet_operations sit_net_ops = {
        .init = sit_init_net,
        .exit = sit_exit_net,
+        .id   = &sit_net_id,
+        .size = sizeof(struct sit_net),
 };
 static void __exit sit_cleanup(void)
 {
        xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
-        unregister_pernet_gen_device(sit_net_id, &sit_net_ops);
+        unregister_pernet_device(&sit_net_ops);
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 static int __init sit_init(void)
@@ -1086,15 +1227,14 @@ static int __init sit_init(void)
        printk(KERN_INFO "IPv6 over IPv4 tunneling driver\n");
-        if (xfrm4_tunnel_register(&sit_handler, AF_INET6) < 0) {
+        err = register_pernet_device(&sit_net_ops);
+        if (err < 0)
+                return err;
+        err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
+        if (err < 0) {
+                unregister_pernet_device(&sit_net_ops);
                printk(KERN_INFO "sit init: Can't add protocol\n");
-                return -EAGAIN;
        }
-        err = register_pernet_gen_device(&sit_net_id, &sit_net_ops);
-        if (err < 0)
-                xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
        return err;
 }
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 6b6ae913b5d4..34d1f0690d7e 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -159,6 +159,8 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 {
+        struct tcp_options_received tcp_opt;
+        u8 *hash_location;
        struct inet_request_sock *ireq;
        struct inet6_request_sock *ireq6;
        struct tcp_request_sock *treq;
@@ -171,7 +173,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        int mss;
        struct dst_entry *dst;
        __u8 rcv_wscale;
-        struct tcp_options_received tcp_opt;
        if (!sysctl_tcp_syncookies || !th->ack)
                goto out;
@@ -186,7 +187,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        /* check for timestamp cookie support */
        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0);
        if (tcp_opt.saw_tstamp)
                cookie_check_timestamp(&tcp_opt);
@@ -252,8 +253,9 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                }
                ipv6_addr_copy(&fl.fl6_src, &ireq6->loc_addr);
                fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_sk(sk)->sport;
+                fl.fl_ip_sport = inet_sk(sk)->inet_sport;
                security_req_classify_flow(req, &fl);
                if (ip6_dst_lookup(sk, &dst, &fl))
                        goto out_free;
@@ -267,7 +269,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
        tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                  &req->rcv_wnd, &req->window_clamp,
-                                  ireq->wscale_ok, &rcv_wscale);
+                                  ireq->wscale_ok, &rcv_wscale,
+                                  dst_metric(dst, RTAX_INITRWND));
        ireq->rcv_wscale = rcv_wscale;
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 0dc6a4e5ed4a..fa1d8f4e0051 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -9,6 +9,7 @@
 #include <linux/sysctl.h>
 #include <linux/in6.h>
 #include <linux/ipv6.h>
+#include <linux/slab.h>
 #include <net/ndisc.h>
 #include <net/ipv6.h>
 #include <net/addrconf.h>
@@ -16,50 +17,46 @@
 static ctl_table ipv6_table_template[] = {
        {
-                .ctl_name       = NET_IPV6_ROUTE,
                .procname       = "route",
                .maxlen         = 0,
                .mode           = 0555,
                .child          = ipv6_route_table_template
        },
        {
-                .ctl_name       = NET_IPV6_ICMP,
                .procname       = "icmp",
                .maxlen         = 0,
                .mode           = 0555,
                .child          = ipv6_icmp_table_template
        },
        {
-                .ctl_name       = NET_IPV6_BINDV6ONLY,
                .procname       = "bindv6only",
                .data           = &init_net.ipv6.sysctl.bindv6only,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
-        { .ctl_name = 0 }
+        { }
 };
 static ctl_table ipv6_rotable[] = {
        {
-                .ctl_name       = NET_IPV6_MLD_MAX_MSF,
                .procname       = "mld_max_msf",
                .data           = &sysctl_mld_max_msf,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
-        { .ctl_name = 0 }
+        { }
 };
 struct ctl_path net_ipv6_ctl_path[] = {
-        { .procname = "net", .ctl_name = CTL_NET, },
+        { .procname = "net", },
-        { .procname = "ipv6", .ctl_name = NET_IPV6, },
+        { .procname = "ipv6", },
        { },
 };
 EXPORT_SYMBOL_GPL(net_ipv6_ctl_path);
-static int ipv6_sysctl_net_init(struct net *net)
+static int __net_init ipv6_sysctl_net_init(struct net *net)
 {
        struct ctl_table *ipv6_table;
        struct ctl_table *ipv6_route_table;
@@ -102,7 +99,7 @@ out_ipv6_table:
        goto out;
 }
-static void ipv6_sysctl_net_exit(struct net *net)
+static void __net_exit ipv6_sysctl_net_exit(struct net *net)
 {
        struct ctl_table *ipv6_table;
        struct ctl_table *ipv6_route_table;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 21d100b68b19..075f540ec197 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -38,6 +38,7 @@
 #include <linux/jhash.h>
 #include <linux/ipsec.h>
 #include <linux/times.h>
+#include <linux/slab.h>
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
@@ -96,7 +97,7 @@ static void tcp_v6_hash(struct sock *sk)
                        return;
                }
                local_bh_disable();
-                __inet6_hash(sk);
+                __inet6_hash(sk, NULL);
                local_bh_enable();
        }
 }
@@ -226,10 +227,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 #endif
                        goto failure;
                } else {
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
+                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
-                                      inet->saddr);
+                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
+                                               &np->rcv_saddr);
-                                      inet->rcv_saddr);
                }
                return err;
@@ -243,8 +243,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        ipv6_addr_copy(&fl.fl6_src,
                       (saddr ? saddr : &np->saddr));
        fl.oif = sk->sk_bound_dev_if;
+        fl.mark = sk->sk_mark;
        fl.fl_ip_dport = usin->sin6_port;
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
        if (np->opt && np->opt->srcrt) {
                struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
@@ -276,7 +277,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        /* set the source address */
        ipv6_addr_copy(&np->saddr, saddr);
-        inet->rcv_saddr = LOOPBACK4_IPV6;
+        inet->inet_rcv_saddr = LOOPBACK4_IPV6;
        sk->sk_gso_type = SKB_GSO_TCPV6;
        __ip6_dst_store(sk, dst, NULL, NULL);
@@ -288,7 +289,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
        tcp_set_state(sk, TCP_SYN_SENT);
        err = inet6_hash_connect(&tcp_death_row, sk);
@@ -298,8 +299,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        if (!tp->write_seq)
                tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
                                                             np->daddr.s6_addr32,
-                                                             inet->sport,
+                                                             inet->inet_sport,
-                                                             inet->dport);
+                                                             inet->inet_dport);
        err = tcp_connect(sk);
        if (err)
@@ -311,7 +312,7 @@ late_failure:
        tcp_set_state(sk, TCP_CLOSE);
        __sk_dst_reset(sk);
 failure:
-        inet->dport = 0;
+        inet->inet_dport = 0;
        sk->sk_route_caps = 0;
        return err;
 }
@@ -383,8 +384,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
                        ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                        fl.oif = sk->sk_bound_dev_if;
-                        fl.fl_ip_dport = inet->dport;
+                        fl.mark = sk->sk_mark;
-                        fl.fl_ip_sport = inet->sport;
+                        fl.fl_ip_dport = inet->inet_dport;
+                        fl.fl_ip_sport = inet->inet_sport;
                        security_skb_classify_flow(skb, &fl);
                        if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
@@ -460,7 +462,8 @@ out:
 }
-static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
+static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
+                              struct request_values *rvp)
 {
        struct inet6_request_sock *treq = inet6_rsk(req);
        struct ipv6_pinfo *np = inet6_sk(sk);
@@ -477,6 +480,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
        ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
        fl.fl6_flowlabel = 0;
        fl.oif = treq->iif;
+        fl.mark = sk->sk_mark;
        fl.fl_ip_dport = inet_rsk(req)->rmt_port;
        fl.fl_ip_sport = inet_rsk(req)->loc_port;
        security_req_classify_flow(req, &fl);
@@ -497,7 +501,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
        if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                goto done;
-        skb = tcp_make_synack(sk, dst, req);
+        skb = tcp_make_synack(sk, dst, req, rvp);
        if (skb) {
                struct tcphdr *th = tcp_hdr(skb);
@@ -517,6 +521,13 @@ done:
        return err;
 }
+static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req,
+                             struct request_values *rvp)
+{
+        TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
+        return tcp_v6_send_synack(sk, req, rvp);
+}
 static inline void syn_flood_warning(struct sk_buff *skb)
 {
 #ifdef CONFIG_SYN_COOKIES
@@ -873,7 +884,7 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
        if (genhash || memcmp(hash_location, newhash, 16) != 0) {
                if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash %s for (%pI6, %u)->(%pI6, %u)\n",
+                        printk(KERN_INFO "MD5 Hash %s for [%pI6c]:%u->[%pI6c]:%u\n",
                               genhash ? "failed" : "mismatch",
                               &ip6h->saddr, ntohs(th->source),
                               &ip6h->daddr, ntohs(th->dest));
@@ -887,10 +898,11 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 struct request_sock_ops tcp6_request_sock_ops __read_mostly = {
        .family         =       AF_INET6,
        .obj_size       =       sizeof(struct tcp6_request_sock),
-        .rtx_syn_ack    =       tcp_v6_send_synack,
+        .rtx_syn_ack    =       tcp_v6_rtx_synack,
        .send_ack       =       tcp_v6_reqsk_send_ack,
        .destructor     =       tcp_v6_reqsk_destructor,
-        .send_reset     =       tcp_v6_send_reset
+        .send_reset     =       tcp_v6_send_reset,
+        .syn_ack_timeout =      tcp_syn_ack_timeout,
 };
 #ifdef CONFIG_TCP_MD5SIG
@@ -1003,7 +1015,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
        skb_reserve(buff, MAX_HEADER + sizeof(struct ipv6hdr) + tot_len);
        t1 = (struct tcphdr *) skb_push(buff, tot_len);
-        skb_reset_transport_header(skb);
+        skb_reset_transport_header(buff);
        /* Swap the send and the receive. */
        memset(t1, 0, sizeof(*t1));
@@ -1159,11 +1171,13 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 */
 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 {
+        struct tcp_extend_values tmp_ext;
+        struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct request_sock *req;
        struct inet6_request_sock *treq;
        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct tcp_options_received tmp_opt;
        struct tcp_sock *tp = tcp_sk(sk);
-        struct request_sock *req = NULL;
        __u32 isn = TCP_SKB_CB(skb)->when;
 #ifdef CONFIG_SYN_COOKIES
        int want_cookie = 0;
@@ -1202,8 +1216,52 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        tcp_clear_options(&tmp_opt);
        tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
        tmp_opt.user_mss = tp->rx_opt.user_mss;
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0);
+        if (tmp_opt.cookie_plus > 0 &&
+            tmp_opt.saw_tstamp &&
+            !tp->rx_opt.cookie_out_never &&
+            (sysctl_tcp_cookie_size > 0 ||
+             (tp->cookie_values != NULL &&
+              tp->cookie_values->cookie_desired > 0))) {
+                u8 *c;
+                u32 *d;
+                u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
+                int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
+                if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
+                        goto drop_and_free;
+                /* Secret recipe starts with IP addresses */
+                d = &ipv6_hdr(skb)->daddr.s6_addr32[0];
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                d = &ipv6_hdr(skb)->saddr.s6_addr32[0];
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                /* plus variable length Initiator Cookie */
+                c = (u8 *)mess;
+                while (l-- > 0)
+                        *c++ ^= *hash_location++;
-        tcp_parse_options(skb, &tmp_opt, 0);
+#ifdef CONFIG_SYN_COOKIES
+                want_cookie = 0;        /* not our kind of cookie */
+#endif
+                tmp_ext.cookie_out_never = 0; /* false */
+                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
+        } else if (!tp->rx_opt.cookie_in_always) {
+                /* redundant indications, but ensure initialization. */
+                tmp_ext.cookie_out_never = 1; /* true */
+                tmp_ext.cookie_plus = 0;
+        } else {
+                goto drop_and_free;
+        }
+        tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
        if (want_cookie && !tmp_opt.saw_tstamp)
                tcp_clear_options(&tmp_opt);
@@ -1236,23 +1294,21 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                isn = tcp_v6_init_sequence(skb);
        }
        tcp_rsk(req)->snt_isn = isn;
        security_inet_conn_request(sk, skb, req);
-        if (tcp_v6_send_synack(sk, req))
+        if (tcp_v6_send_synack(sk, req,
-                goto drop;
+                               (struct request_values *)&tmp_ext) ||
+            want_cookie)
+                goto drop_and_free;
-        if (!want_cookie) {
+        inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
-                inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
+        return 0;
-                return 0;
-        }
+drop_and_free:
+        reqsk_free(req);
 drop:
-        if (req)
-                reqsk_free(req);
        return 0; /* don't send reset */
 }
@@ -1290,11 +1346,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                memcpy(newnp, np, sizeof(struct ipv6_pinfo));
-                ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
+                ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
-                              newinet->daddr);
-                ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
+                ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
-                              newinet->saddr);
                ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
@@ -1345,6 +1399,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                }
                ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
                fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                fl.fl_ip_sport = inet_rsk(req)->loc_port;
                security_req_classify_flow(req, &fl);
@@ -1431,7 +1486,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
        tcp_initialize_rcv_mss(newsk);
-        newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
+        newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
+        newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
 #ifdef CONFIG_TCP_MD5SIG
        /* Copy over the MD5 key from the original socket */
@@ -1448,7 +1504,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        }
 #endif
-        __inet6_hash(newsk);
+        __inet6_hash(newsk, NULL);
        __inet_inherit_port(sk, newsk);
        return newsk;
@@ -1685,8 +1741,11 @@ process:
                        if (!tcp_prequeue(sk, skb))
                                ret = tcp_v6_do_rcv(sk, skb);
                }
-        } else
+        } else if (unlikely(sk_add_backlog(sk, skb))) {
-                sk_add_backlog(sk, skb);
+                bh_unlock_sock(sk);
+                NET_INC_STATS_BH(net, LINUX_MIB_TCPBACKLOGDROP);
+                goto discard_and_relse;
+        }
        bh_unlock_sock(sk);
        sock_put(sk);
@@ -1848,7 +1907,7 @@ static int tcp_v6_init_sock(struct sock *sk)
         */
        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
        tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = 536;
+        tp->mss_cache = TCP_MSS_DEFAULT;
        tp->reordering = sysctl_tcp_reordering;
@@ -1864,6 +1923,19 @@ static int tcp_v6_init_sock(struct sock *sk)
        tp->af_specific = &tcp_sock_ipv6_specific;
 #endif
+        /* TCP Cookie Transactions */
+        if (sysctl_tcp_cookie_size > 0) {
+                /* Default, cookies without s_data_payload. */
+                tp->cookie_values =
+                        kzalloc(sizeof(*tp->cookie_values),
+                                sk->sk_allocation);
+                if (tp->cookie_values != NULL)
+                        kref_init(&tp->cookie_values->kref);
+        }
+        /* Presumed zeroed, in order of appearance:
+         *      cookie_in_always, cookie_out_never,
+         *      s_data_constant, s_data_in, s_data_out
+         */
        sk->sk_sndbuf = sysctl_tcp_wmem[1];
        sk->sk_rcvbuf = sysctl_tcp_rmem[1];
@@ -1931,8 +2003,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
        dest  = &np->daddr;
        src   = &np->rcv_saddr;
-        destp = ntohs(inet->dport);
+        destp = ntohs(inet->inet_dport);
-        srcp  = ntohs(inet->sport);
+        srcp  = ntohs(inet->inet_sport);
        if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                timer_active    = 1;
@@ -2045,7 +2117,7 @@ static struct tcp_seq_afinfo tcp6_seq_afinfo = {
        },
 };
-int tcp6_proc_init(struct net *net)
+int __net_init tcp6_proc_init(struct net *net)
 {
        return tcp_proc_register(net, &tcp6_seq_afinfo);
 }
@@ -2109,27 +2181,31 @@ static struct inet_protosw tcpv6_protosw = {
        .protocol       =       IPPROTO_TCP,
        .prot           =       &tcpv6_prot,
        .ops            =       &inet6_stream_ops,
-        .capability     =       -1,
        .no_check       =       0,
        .flags          =       INET_PROTOSW_PERMANENT |
                                INET_PROTOSW_ICSK,
 };
-static int tcpv6_net_init(struct net *net)
+static int __net_init tcpv6_net_init(struct net *net)
 {
        return inet_ctl_sock_create(&net->ipv6.tcp_sk, PF_INET6,
                                    SOCK_RAW, IPPROTO_TCP, net);
 }
-static void tcpv6_net_exit(struct net *net)
+static void __net_exit tcpv6_net_exit(struct net *net)
 {
        inet_ctl_sock_destroy(net->ipv6.tcp_sk);
-        inet_twsk_purge(net, &tcp_hashinfo, &tcp_death_row, AF_INET6);
+}
+static void __net_exit tcpv6_net_exit_batch(struct list_head *net_exit_list)
+{
+        inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
 }
 static struct pernet_operations tcpv6_net_ops = {
-        .init = tcpv6_net_init,
+        .init       = tcpv6_net_init,
-        .exit = tcpv6_net_exit,
+        .exit       = tcpv6_net_exit,
+        .exit_batch = tcpv6_net_exit_batch,
 };
 int __init tcpv6_init(void)
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index 51e2832d13a6..fc3c86a47452 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -25,6 +25,7 @@
 #include <linux/mutex.h>
 #include <linux/netdevice.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
@@ -98,7 +99,7 @@ static int tunnel6_rcv(struct sk_buff *skb)
                if (!handler->handler(skb))
                        return 0;
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
 drop:
        kfree_skb(skb);
@@ -116,7 +117,7 @@ static int tunnel46_rcv(struct sk_buff *skb)
                if (!handler->handler(skb))
                        return 0;
-        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, skb->dev);
+        icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
 drop:
        kfree_skb(skb);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index cf538ed5ef6a..90824852f598 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -34,6 +34,7 @@
 #include <linux/init.h>
 #include <linux/module.h>
 #include <linux/skbuff.h>
+#include <linux/slab.h>
 #include <asm/uaccess.h>
 #include <net/ndisc.h>
@@ -53,7 +54,7 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
        const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
        const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-        __be32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
+        __be32 sk1_rcv_saddr = inet_sk(sk)->inet_rcv_saddr;
        __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
        int sk_ipv6only = ipv6_only_sock(sk);
        int sk2_ipv6only = inet_v6_ipv6only(sk2);
@@ -63,8 +64,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
        /* if both are mapped, treat as IPv4 */
        if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED)
                return (!sk2_ipv6only &&
-                        (!sk_rcv_saddr || !sk2_rcv_saddr ||
+                        (!sk1_rcv_saddr || !sk2_rcv_saddr ||
-                          sk_rcv_saddr == sk2_rcv_saddr));
+                          sk1_rcv_saddr == sk2_rcv_saddr));
        if (addr_type2 == IPV6_ADDR_ANY &&
            !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
@@ -81,9 +82,33 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
        return 0;
 }
+static unsigned int udp6_portaddr_hash(struct net *net,
+                                       const struct in6_addr *addr6,
+                                       unsigned int port)
+{
+        unsigned int hash, mix = net_hash_mix(net);
+        if (ipv6_addr_any(addr6))
+                hash = jhash_1word(0, mix);
+        else if (ipv6_addr_v4mapped(addr6))
+                hash = jhash_1word(addr6->s6_addr32[3], mix);
+        else
+                hash = jhash2(addr6->s6_addr32, 4, mix);
+        return hash ^ port;
+}
 int udp_v6_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal);
+        unsigned int hash2_nulladdr =
+                udp6_portaddr_hash(sock_net(sk), &in6addr_any, snum);
+        unsigned int hash2_partial = 
+                udp6_portaddr_hash(sock_net(sk), &inet6_sk(sk)->rcv_saddr, 0);
+        /* precompute partial secondary hash */
+        udp_sk(sk)->udp_portaddr_hash = hash2_partial;
+        return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal, hash2_nulladdr);
 }
 static inline int compute_score(struct sock *sk, struct net *net,
@@ -94,14 +119,14 @@ static inline int compute_score(struct sock *sk, struct net *net,
 {
        int score = -1;
-        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
                        sk->sk_family == PF_INET6) {
                struct ipv6_pinfo *np = inet6_sk(sk);
                struct inet_sock *inet = inet_sk(sk);
                score = 0;
-                if (inet->dport) {
+                if (inet->inet_dport) {
-                        if (inet->dport != sport)
+                        if (inet->inet_dport != sport)
                                return -1;
                        score++;
                }
@@ -124,6 +149,86 @@ static inline int compute_score(struct sock *sk, struct net *net,
        return score;
 }
+#define SCORE2_MAX (1 + 1 + 1)
+static inline int compute_score2(struct sock *sk, struct net *net,
+                                const struct in6_addr *saddr, __be16 sport,
+                                const struct in6_addr *daddr, unsigned short hnum,
+                                int dif)
+{
+        int score = -1;
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
+                        sk->sk_family == PF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                struct inet_sock *inet = inet_sk(sk);
+                if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
+                        return -1;
+                score = 0;
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
+                                return -1;
+                        score++;
+                }
+                if (!ipv6_addr_any(&np->daddr)) {
+                        if (!ipv6_addr_equal(&np->daddr, saddr))
+                                return -1;
+                        score++;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score++;
+                }
+        }
+        return score;
+}
+/* called with read_rcu_lock() */
+static struct sock *udp6_lib_lookup2(struct net *net,
+                const struct in6_addr *saddr, __be16 sport,
+                const struct in6_addr *daddr, unsigned int hnum, int dif,
+                struct udp_hslot *hslot2, unsigned int slot2)
+{
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
+        int score, badness;
+begin:
+        result = NULL;
+        badness = -1;
+        udp_portaddr_for_each_entry_rcu(sk, node, &hslot2->head) {
+                score = compute_score2(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                        if (score == SCORE2_MAX)
+                                goto exact_match;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot2)
+                goto begin;
+        if (result) {
+exact_match:
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score2(result, net, saddr, sport,
+                                  daddr, hnum, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        return result;
+}
 static struct sock *__udp6_lib_lookup(struct net *net,
                                      struct in6_addr *saddr, __be16 sport,
                                      struct in6_addr *daddr, __be16 dport,
@@ -132,11 +237,35 @@ static struct sock *__udp6_lib_lookup(struct net *net,
        struct sock *sk, *result;
        struct hlist_nulls_node *node;
        unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
+        unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
-        struct udp_hslot *hslot = &udptable->hash[hash];
+        struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
        int score, badness;
        rcu_read_lock();
+        if (hslot->count > 10) {
+                hash2 = udp6_portaddr_hash(net, daddr, hnum);
+                slot2 = hash2 & udptable->mask;
+                hslot2 = &udptable->hash2[slot2];
+                if (hslot->count < hslot2->count)
+                        goto begin;
+                result = udp6_lib_lookup2(net, saddr, sport,
+                                          daddr, hnum, dif,
+                                          hslot2, slot2);
+                if (!result) {
+                        hash2 = udp6_portaddr_hash(net, &in6addr_any, hnum);
+                        slot2 = hash2 & udptable->mask;
+                        hslot2 = &udptable->hash2[slot2];
+                        if (hslot->count < hslot2->count)
+                                goto begin;
+                        result = udp6_lib_lookup2(net, saddr, sport,
+                                                  &in6addr_any, hnum, dif,
+                                                  hslot2, slot2);
+                }
+                rcu_read_unlock();
+                return result;
+        }
 begin:
        result = NULL;
        badness = -1;
@@ -152,7 +281,7 @@ begin:
         * not the expected one, we must restart lookup.
         * We probably met an item that was moved to another chain.
         */
-        if (get_nulls_value(node) != hash)
+        if (get_nulls_value(node) != slot)
                goto begin;
        if (result) {
@@ -194,7 +323,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct inet_sock *inet = inet_sk(sk);
        struct sk_buff *skb;
-        unsigned int ulen, copied;
+        unsigned int ulen;
        int peeked;
        int err;
        int is_udplite = IS_UDPLITE(sk);
@@ -213,10 +342,9 @@ try_again:
                goto out;
        ulen = skb->len - sizeof(struct udphdr);
-        copied = len;
+        if (len > ulen)
-        if (copied > ulen)
+                len = ulen;
-                copied = ulen;
+        else if (len < ulen)
-        else if (copied < ulen)
                msg->msg_flags |= MSG_TRUNC;
        is_udp4 = (skb->protocol == htons(ETH_P_IP));
@@ -227,14 +355,14 @@ try_again:
         * coverage checksum (UDP-Lite), do it before the copy.
         */
-        if (copied < ulen || UDP_SKB_CB(skb)->partial_cov) {
+        if (len < ulen || UDP_SKB_CB(skb)->partial_cov) {
                if (udp_lib_checksum_complete(skb))
                        goto csum_copy_err;
        }
        if (skb_csum_unnecessary(skb))
                err = skb_copy_datagram_iovec(skb, sizeof(struct udphdr),
-                                              msg->msg_iov, copied       );
+                                              msg->msg_iov,len);
        else {
                err = skb_copy_and_csum_datagram_iovec(skb, sizeof(struct udphdr), msg->msg_iov);
                if (err == -EINVAL)
@@ -252,7 +380,7 @@ try_again:
                                        UDP_MIB_INDATAGRAMS, is_udplite);
        }
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
        /* Copy the address. */
        if (msg->msg_name) {
@@ -265,8 +393,8 @@ try_again:
                sin6->sin6_scope_id = 0;
                if (is_udp4)
-                        ipv6_addr_set(&sin6->sin6_addr, 0, 0,
+                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
-                                      htonl(0xffff), ip_hdr(skb)->saddr);
+                                               &sin6->sin6_addr);
                else {
                        ipv6_addr_copy(&sin6->sin6_addr,
                                       &ipv6_hdr(skb)->saddr);
@@ -283,7 +411,7 @@ try_again:
                        datagram_recv_ctl(sk, msg, skb);
        }
-        err = copied;
+        err = len;
        if (flags & MSG_TRUNC)
                err = ulen;
@@ -383,18 +511,18 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                        goto drop;
        }
-        if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
+        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                        UDP6_INC_STATS_BH(sock_net(sk),
                                        UDP_MIB_RCVBUFERRORS, is_udplite);
-                        atomic_inc(&sk->sk_drops);
+                goto drop_no_sk_drops_inc;
-                }
-                goto drop;
        }
        return 0;
 drop:
+        atomic_inc(&sk->sk_drops);
+drop_no_sk_drops_inc:
        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
        kfree_skb(skb);
        return -1;
@@ -415,10 +543,11 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
                if (!net_eq(sock_net(s), net))
                        continue;
-                if (s->sk_hash == num && s->sk_family == PF_INET6) {
+                if (udp_sk(s)->udp_port_hash == num &&
+                    s->sk_family == PF_INET6) {
                        struct ipv6_pinfo *np = inet6_sk(s);
-                        if (inet->dport) {
+                        if (inet->inet_dport) {
-                                if (inet->dport != rmt_port)
+                                if (inet->inet_dport != rmt_port)
                                        continue;
                        }
                        if (!ipv6_addr_any(&np->daddr) &&
@@ -440,6 +569,37 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
        return NULL;
 }
+static void flush_stack(struct sock **stack, unsigned int count,
+                        struct sk_buff *skb, unsigned int final)
+{
+        unsigned int i;
+        struct sock *sk;
+        struct sk_buff *skb1;
+        for (i = 0; i < count; i++) {
+                skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+                sk = stack[i];
+                if (skb1) {
+                        bh_lock_sock(sk);
+                        if (!sock_owned_by_user(sk))
+                                udpv6_queue_rcv_skb(sk, skb1);
+                        else if (sk_add_backlog(sk, skb1)) {
+                                kfree_skb(skb1);
+                                bh_unlock_sock(sk);
+                                goto drop;
+                        }
+                        bh_unlock_sock(sk);
+                        continue;
+                }
+drop:
+                atomic_inc(&sk->sk_drops);
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+                UDP6_INC_STATS_BH(sock_net(sk),
+                                UDP_MIB_INERRORS, IS_UDPLITE(sk));
+        }
+}
 /*
 * Note: called only from the BH handler context,
 * so we don't need to lock the hashes.
@@ -448,41 +608,43 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                struct in6_addr *saddr, struct in6_addr *daddr,
                struct udp_table *udptable)
 {
-        struct sock *sk, *sk2;
+        struct sock *sk, *stack[256 / sizeof(struct sock *)];
        const struct udphdr *uh = udp_hdr(skb);
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
        int dif;
+        unsigned int i, count = 0;
        spin_lock(&hslot->lock);
        sk = sk_nulls_head(&hslot->head);
        dif = inet6_iif(skb);
        sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
-        if (!sk) {
+        while (sk) {
-                kfree_skb(skb);
+                stack[count++] = sk;
-                goto out;
+                sk = udp_v6_mcast_next(net, sk_nulls_next(sk), uh->dest, daddr,
-        }
+                                       uh->source, saddr, dif);
+                if (unlikely(count == ARRAY_SIZE(stack))) {
-        sk2 = sk;
+                        if (!sk)
-        while ((sk2 = udp_v6_mcast_next(net, sk_nulls_next(sk2), uh->dest, daddr,
+                                break;
-                                        uh->source, saddr, dif))) {
+                        flush_stack(stack, count, skb, ~0);
-                struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
+                        count = 0;
-                if (buff) {
-                        bh_lock_sock(sk2);
-                        if (!sock_owned_by_user(sk2))
-                                udpv6_queue_rcv_skb(sk2, buff);
-                        else
-                                sk_add_backlog(sk2, buff);
-                        bh_unlock_sock(sk2);
                }
        }
-        bh_lock_sock(sk);
+        /*
-        if (!sock_owned_by_user(sk))
+         * before releasing the lock, we must take reference on sockets
-                udpv6_queue_rcv_skb(sk, skb);
+         */
-        else
+        for (i = 0; i < count; i++)
-                sk_add_backlog(sk, skb);
+                sock_hold(stack[i]);
-        bh_unlock_sock(sk);
-out:
        spin_unlock(&hslot->lock);
+        if (count) {
+                flush_stack(stack, count, skb, count - 1);
+                for (i = 0; i < count; i++)
+                        sock_put(stack[i]);
+        } else {
+                kfree_skb(skb);
+        }
        return 0;
 }
@@ -523,12 +685,11 @@ static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh,
 int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                   int proto)
 {
+        struct net *net = dev_net(skb->dev);
        struct sock *sk;
        struct udphdr *uh;
-        struct net_device *dev = skb->dev;
        struct in6_addr *saddr, *daddr;
        u32 ulen = 0;
-        struct net *net = dev_net(skb->dev);
        if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                goto short_packet;
@@ -587,7 +748,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
                                proto == IPPROTO_UDPLITE);
-                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
+                icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
                kfree_skb(skb);
                return 0;
@@ -598,8 +759,12 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        bh_lock_sock(sk);
        if (!sock_owned_by_user(sk))
                udpv6_queue_rcv_skb(sk, skb);
-        else
+        else if (sk_add_backlog(sk, skb)) {
-                sk_add_backlog(sk, skb);
+                atomic_inc(&sk->sk_drops);
+                bh_unlock_sock(sk);
+                sock_put(sk);
+                goto discard;
+        }
        bh_unlock_sock(sk);
        sock_put(sk);
        return 0;
@@ -792,7 +957,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                if (ipv6_addr_v4mapped(daddr)) {
                        struct sockaddr_in sin;
                        sin.sin_family = AF_INET;
-                        sin.sin_port = sin6 ? sin6->sin6_port : inet->dport;
+                        sin.sin_port = sin6 ? sin6->sin6_port : inet->inet_dport;
                        sin.sin_addr.s_addr = daddr->s6_addr32[3];
                        msg->msg_name = &sin;
                        msg->msg_namelen = sizeof(sin);
@@ -865,7 +1030,7 @@ do_udp_sendmsg:
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -EDESTADDRREQ;
-                fl.fl_ip_dport = inet->dport;
+                fl.fl_ip_dport = inet->inet_dport;
                daddr = &np->daddr;
                fl.fl6_flowlabel = np->flow_label;
                connected = 1;
@@ -877,6 +1042,8 @@ do_udp_sendmsg:
        if (!fl.oif)
                fl.oif = np->sticky_pktinfo.ipi6_ifindex;
+        fl.mark = sk->sk_mark;
        if (msg->msg_controllen) {
                opt = &opt_space;
                memset(opt, 0, sizeof(struct ipv6_txoptions));
@@ -909,7 +1076,7 @@ do_udp_sendmsg:
                fl.fl6_dst.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
        if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
                ipv6_addr_copy(&fl.fl6_src, &np->saddr);
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
        /* merge ip6_build_xmit from ip6_output */
        if (opt && opt->srcrt) {
@@ -1190,10 +1357,10 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
        dest  = &np->daddr;
        src   = &np->rcv_saddr;
-        destp = ntohs(inet->dport);
+        destp = ntohs(inet->inet_dport);
-        srcp  = ntohs(inet->sport);
+        srcp  = ntohs(inet->inet_sport);
        seq_printf(seq,
-                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
                   bucket,
                   src->s6_addr32[0], src->s6_addr32[1],
@@ -1236,7 +1403,7 @@ static struct udp_seq_afinfo udp6_seq_afinfo = {
        },
 };
-int udp6_proc_init(struct net *net)
+int __net_init udp6_proc_init(struct net *net)
 {
        return udp_proc_register(net, &udp6_seq_afinfo);
 }
@@ -1282,7 +1449,6 @@ static struct inet_protosw udpv6_protosw = {
        .protocol =  IPPROTO_UDP,
        .prot =      &udpv6_prot,
        .ops =       &inet6_dgram_ops,
-        .capability =-1,
        .no_check =  UDP_CSUM_DEFAULT,
        .flags =     INET_PROTOSW_PERMANENT,
 };
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index d737a27ee010..5f48fadc27f7 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -62,7 +62,6 @@ static struct inet_protosw udplite6_protosw = {
        .protocol       = IPPROTO_UDPLITE,
        .prot           = &udplitev6_prot,
        .ops            = &inet6_dgram_ops,
-        .capability     = -1,
        .no_check       = 0,
        .flags          = INET_PROTOSW_PERMANENT,
 };
@@ -105,12 +104,12 @@ static struct udp_seq_afinfo udplite6_seq_afinfo = {
        },
 };
-static int udplite6_proc_init_net(struct net *net)
+static int __net_init udplite6_proc_init_net(struct net *net)
 {
        return udp_proc_register(net, &udplite6_seq_afinfo);
 }
-static void udplite6_proc_exit_net(struct net *net)
+static void __net_exit udplite6_proc_exit_net(struct net *net)
 {
        udp_proc_unregister(net, &udplite6_seq_afinfo);
 }
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index 9084582d236b..2bc98ede1235 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -101,7 +101,7 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                        break;
                }
-                x = xfrm_state_lookup_byaddr(net, dst, src, proto, AF_INET6);
+                x = xfrm_state_lookup_byaddr(net, skb->mark, dst, src, proto, AF_INET6);
                if (!x)
                        continue;
diff --git a/net/ipv6/xfrm6_mode_tunnel.c b/net/ipv6/xfrm6_mode_tunnel.c
index 3927832227b9..b809812c8d30 100644
--- a/net/ipv6/xfrm6_mode_tunnel.c
+++ b/net/ipv6/xfrm6_mode_tunnel.c
@@ -5,6 +5,7 @@
 * Copyright (c) 2004-2006 Herbert Xu <herbert@gondor.apana.org.au>
 */
+#include <linux/gfp.h>
 #include <linux/init.h>
 #include <linux/kernel.h>
 #include <linux/module.h>
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index c4f4eef032a3..0c92112dcba3 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -38,7 +38,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
        if (!skb->local_df && skb->len > mtu) {
                skb->dev = dst->dev;
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, skb->dev);
+                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                ret = -EMSGSIZE;
        }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8ec3d45cd1d9..00bf7c962b7e 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -24,7 +24,6 @@
 #include <net/mip6.h>
 #endif
-static struct dst_ops xfrm6_dst_ops;
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
@@ -117,14 +116,15 @@ static int xfrm6_init_path(struct xfrm_dst *path, struct dst_entry *dst,
        return 0;
 }
-static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev)
+static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+                          struct flowi *fl)
 {
        struct rt6_info *rt = (struct rt6_info*)xdst->route;
        xdst->u.dst.dev = dev;
        dev_hold(dev);
-        xdst->u.rt6.rt6i_idev = in6_dev_get(rt->u.dst.dev);
+        xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
        if (!xdst->u.rt6.rt6i_idev)
                return -ENODEV;
@@ -224,8 +224,10 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 static inline int xfrm6_garbage_collect(struct dst_ops *ops)
 {
-        xfrm6_policy_afinfo.garbage_collect(&init_net);
+        struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
-        return (atomic_read(&xfrm6_dst_ops.entries) > xfrm6_dst_ops.gc_thresh*2);
+        xfrm6_policy_afinfo.garbage_collect(net);
+        return (atomic_read(&ops->entries) > ops->gc_thresh * 2);
 }
 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
@@ -309,9 +311,8 @@ static void xfrm6_policy_fini(void)
 #ifdef CONFIG_SYSCTL
 static struct ctl_table xfrm6_policy_table[] = {
        {
-                .ctl_name       = CTL_UNNUMBERED,
                .procname       = "xfrm6_gc_thresh",
-                .data           = &xfrm6_dst_ops.gc_thresh,
+                .data           = &init_net.xfrm.xfrm6_dst_ops.gc_thresh,
                .maxlen         = sizeof(int),
                .mode           = 0644,
                .proc_handler   = proc_dointvec,
@@ -327,13 +328,6 @@ int __init xfrm6_init(void)
        int ret;
        unsigned int gc_thresh;
-        ret = xfrm6_policy_init();
-        if (ret)
-                goto out;
-        ret = xfrm6_state_init();
-        if (ret)
-                goto out_policy;
        /*
         * We need a good default value for the xfrm6 gc threshold.
         * In ipv4 we set it to the route hash table size * 8, which
@@ -347,6 +341,15 @@ int __init xfrm6_init(void)
         */
        gc_thresh = FIB6_TABLE_HASHSZ * 8;
        xfrm6_dst_ops.gc_thresh = (gc_thresh < 1024) ? 1024 : gc_thresh;
+        ret = xfrm6_policy_init();
+        if (ret)
+                goto out;
+        ret = xfrm6_state_init();
+        if (ret)
+                goto out_policy;
 #ifdef CONFIG_SYSCTL
        sysctl_hdr = register_net_sysctl_table(&init_net, net_ipv6_ctl_path,
                                                xfrm6_policy_table);
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 81a95c00e503..2ce3a8278f26 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -23,41 +23,51 @@
 */
 #include <linux/module.h>
 #include <linux/xfrm.h>
-#include <linux/list.h>
+#include <linux/slab.h>
+#include <linux/rculist.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ipv6.h>
 #include <linux/ipv6.h>
 #include <linux/icmpv6.h>
 #include <linux/mutex.h>
+#include <net/netns/generic.h>
+#define XFRM6_TUNNEL_SPI_BYADDR_HSIZE 256
+#define XFRM6_TUNNEL_SPI_BYSPI_HSIZE 256
+#define XFRM6_TUNNEL_SPI_MIN    1
+#define XFRM6_TUNNEL_SPI_MAX    0xffffffff
+struct xfrm6_tunnel_net {
+        struct hlist_head spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
+        struct hlist_head spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
+        u32 spi;
+};
+static int xfrm6_tunnel_net_id __read_mostly;
+static inline struct xfrm6_tunnel_net *xfrm6_tunnel_pernet(struct net *net)
+{
+        return net_generic(net, xfrm6_tunnel_net_id);
+}
 /*
 * xfrm_tunnel_spi things are for allocating unique id ("spi")
 * per xfrm_address_t.
 */
 struct xfrm6_tunnel_spi {
-        struct hlist_node list_byaddr;
+        struct hlist_node       list_byaddr;
-        struct hlist_node list_byspi;
+        struct hlist_node       list_byspi;
-        xfrm_address_t addr;
+        xfrm_address_t          addr;
-        u32 spi;
+        u32                     spi;
-        atomic_t refcnt;
+        atomic_t                refcnt;
+        struct rcu_head         rcu_head;
 };
-static DEFINE_RWLOCK(xfrm6_tunnel_spi_lock);
+static DEFINE_SPINLOCK(xfrm6_tunnel_spi_lock);
-static u32 xfrm6_tunnel_spi;
-#define XFRM6_TUNNEL_SPI_MIN    1
-#define XFRM6_TUNNEL_SPI_MAX    0xffffffff
 static struct kmem_cache *xfrm6_tunnel_spi_kmem __read_mostly;
-#define XFRM6_TUNNEL_SPI_BYADDR_HSIZE 256
-#define XFRM6_TUNNEL_SPI_BYSPI_HSIZE 256
-static struct hlist_head xfrm6_tunnel_spi_byaddr[XFRM6_TUNNEL_SPI_BYADDR_HSIZE];
-static struct hlist_head xfrm6_tunnel_spi_byspi[XFRM6_TUNNEL_SPI_BYSPI_HSIZE];
 static inline unsigned xfrm6_tunnel_spi_hash_byaddr(xfrm_address_t *addr)
 {
        unsigned h;
@@ -75,49 +85,14 @@ static inline unsigned xfrm6_tunnel_spi_hash_byspi(u32 spi)
        return spi % XFRM6_TUNNEL_SPI_BYSPI_HSIZE;
 }
+static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr)
-static int xfrm6_tunnel_spi_init(void)
-{
-        int i;
-        xfrm6_tunnel_spi = 0;
-        xfrm6_tunnel_spi_kmem = kmem_cache_create("xfrm6_tunnel_spi",
-                                                  sizeof(struct xfrm6_tunnel_spi),
-                                                  0, SLAB_HWCACHE_ALIGN,
-                                                  NULL);
-        if (!xfrm6_tunnel_spi_kmem)
-                return -ENOMEM;
-        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
-                INIT_HLIST_HEAD(&xfrm6_tunnel_spi_byaddr[i]);
-        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++)
-                INIT_HLIST_HEAD(&xfrm6_tunnel_spi_byspi[i]);
-        return 0;
-}
-static void xfrm6_tunnel_spi_fini(void)
-{
-        int i;
-        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++) {
-                if (!hlist_empty(&xfrm6_tunnel_spi_byaddr[i]))
-                        return;
-        }
-        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++) {
-                if (!hlist_empty(&xfrm6_tunnel_spi_byspi[i]))
-                        return;
-        }
-        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
-        xfrm6_tunnel_spi_kmem = NULL;
-}
-static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        struct xfrm6_tunnel_spi *x6spi;
        struct hlist_node *pos;
-        hlist_for_each_entry(x6spi, pos,
+        hlist_for_each_entry_rcu(x6spi, pos,
-                             &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
+                             &xfrm6_tn->spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                             list_byaddr) {
                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0)
                        return x6spi;
@@ -126,28 +101,29 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
        return NULL;
 }
-__be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
+__be32 xfrm6_tunnel_spi_lookup(struct net *net, xfrm_address_t *saddr)
 {
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
-        read_lock_bh(&xfrm6_tunnel_spi_lock);
+        rcu_read_lock_bh();
-        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
+        x6spi = __xfrm6_tunnel_spi_lookup(net, saddr);
        spi = x6spi ? x6spi->spi : 0;
-        read_unlock_bh(&xfrm6_tunnel_spi_lock);
+        rcu_read_unlock_bh();
        return htonl(spi);
 }
 EXPORT_SYMBOL(xfrm6_tunnel_spi_lookup);
-static int __xfrm6_tunnel_spi_check(u32 spi)
+static int __xfrm6_tunnel_spi_check(struct net *net, u32 spi)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        struct xfrm6_tunnel_spi *x6spi;
        int index = xfrm6_tunnel_spi_hash_byspi(spi);
        struct hlist_node *pos;
        hlist_for_each_entry(x6spi, pos,
-                             &xfrm6_tunnel_spi_byspi[index],
+                             &xfrm6_tn->spi_byspi[index],
                             list_byspi) {
                if (x6spi->spi == spi)
                        return -1;
@@ -155,32 +131,33 @@ static int __xfrm6_tunnel_spi_check(u32 spi)
        return index;
 }
-static u32 __xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
+static u32 __xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        u32 spi;
        struct xfrm6_tunnel_spi *x6spi;
        int index;
-        if (xfrm6_tunnel_spi < XFRM6_TUNNEL_SPI_MIN ||
+        if (xfrm6_tn->spi < XFRM6_TUNNEL_SPI_MIN ||
-            xfrm6_tunnel_spi >= XFRM6_TUNNEL_SPI_MAX)
+            xfrm6_tn->spi >= XFRM6_TUNNEL_SPI_MAX)
-                xfrm6_tunnel_spi = XFRM6_TUNNEL_SPI_MIN;
+                xfrm6_tn->spi = XFRM6_TUNNEL_SPI_MIN;
        else
-                xfrm6_tunnel_spi++;
+                xfrm6_tn->spi++;
-        for (spi = xfrm6_tunnel_spi; spi <= XFRM6_TUNNEL_SPI_MAX; spi++) {
+        for (spi = xfrm6_tn->spi; spi <= XFRM6_TUNNEL_SPI_MAX; spi++) {
-                index = __xfrm6_tunnel_spi_check(spi);
+                index = __xfrm6_tunnel_spi_check(net, spi);
                if (index >= 0)
                        goto alloc_spi;
        }
-        for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tunnel_spi; spi++) {
+        for (spi = XFRM6_TUNNEL_SPI_MIN; spi < xfrm6_tn->spi; spi++) {
-                index = __xfrm6_tunnel_spi_check(spi);
+                index = __xfrm6_tunnel_spi_check(net, spi);
                if (index >= 0)
                        goto alloc_spi;
        }
        spi = 0;
        goto out;
 alloc_spi:
-        xfrm6_tunnel_spi = spi;
+        xfrm6_tn->spi = spi;
        x6spi = kmem_cache_alloc(xfrm6_tunnel_spi_kmem, GFP_ATOMIC);
        if (!x6spi)
                goto out;
@@ -189,54 +166,61 @@ alloc_spi:
        x6spi->spi = spi;
        atomic_set(&x6spi->refcnt, 1);
-        hlist_add_head(&x6spi->list_byspi, &xfrm6_tunnel_spi_byspi[index]);
+        hlist_add_head_rcu(&x6spi->list_byspi, &xfrm6_tn->spi_byspi[index]);
        index = xfrm6_tunnel_spi_hash_byaddr(saddr);
-        hlist_add_head(&x6spi->list_byaddr, &xfrm6_tunnel_spi_byaddr[index]);
+        hlist_add_head_rcu(&x6spi->list_byaddr, &xfrm6_tn->spi_byaddr[index]);
 out:
        return spi;
 }
-__be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
+__be32 xfrm6_tunnel_alloc_spi(struct net *net, xfrm_address_t *saddr)
 {
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
-        write_lock_bh(&xfrm6_tunnel_spi_lock);
+        spin_lock_bh(&xfrm6_tunnel_spi_lock);
-        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
+        x6spi = __xfrm6_tunnel_spi_lookup(net, saddr);
        if (x6spi) {
                atomic_inc(&x6spi->refcnt);
                spi = x6spi->spi;
        } else
-                spi = __xfrm6_tunnel_alloc_spi(saddr);
+                spi = __xfrm6_tunnel_alloc_spi(net, saddr);
-        write_unlock_bh(&xfrm6_tunnel_spi_lock);
+        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
        return htonl(spi);
 }
 EXPORT_SYMBOL(xfrm6_tunnel_alloc_spi);
-void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
+static void x6spi_destroy_rcu(struct rcu_head *head)
+{
+        kmem_cache_free(xfrm6_tunnel_spi_kmem,
+                        container_of(head, struct xfrm6_tunnel_spi, rcu_head));
+}
+void xfrm6_tunnel_free_spi(struct net *net, xfrm_address_t *saddr)
 {
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
        struct xfrm6_tunnel_spi *x6spi;
        struct hlist_node *pos, *n;
-        write_lock_bh(&xfrm6_tunnel_spi_lock);
+        spin_lock_bh(&xfrm6_tunnel_spi_lock);
        hlist_for_each_entry_safe(x6spi, pos, n,
-                                  &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
+                                  &xfrm6_tn->spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                                  list_byaddr)
        {
                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0) {
                        if (atomic_dec_and_test(&x6spi->refcnt)) {
-                                hlist_del(&x6spi->list_byaddr);
+                                hlist_del_rcu(&x6spi->list_byaddr);
-                                hlist_del(&x6spi->list_byspi);
+                                hlist_del_rcu(&x6spi->list_byspi);
-                                kmem_cache_free(xfrm6_tunnel_spi_kmem, x6spi);
+                                call_rcu(&x6spi->rcu_head, x6spi_destroy_rcu);
                                break;
                        }
                }
        }
-        write_unlock_bh(&xfrm6_tunnel_spi_lock);
+        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
 }
 EXPORT_SYMBOL(xfrm6_tunnel_free_spi);
@@ -254,10 +238,11 @@ static int xfrm6_tunnel_input(struct xfrm_state *x, struct sk_buff *skb)
 static int xfrm6_tunnel_rcv(struct sk_buff *skb)
 {
+        struct net *net = dev_net(skb->dev);
        struct ipv6hdr *iph = ipv6_hdr(skb);
        __be32 spi;
-        spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&iph->saddr);
+        spi = xfrm6_tunnel_spi_lookup(net, (xfrm_address_t *)&iph->saddr);
        return xfrm6_rcv_spi(skb, IPPROTO_IPV6, spi) > 0 ? : 0;
 }
@@ -317,7 +302,9 @@ static int xfrm6_tunnel_init_state(struct xfrm_state *x)
 static void xfrm6_tunnel_destroy(struct xfrm_state *x)
 {
-        xfrm6_tunnel_free_spi((xfrm_address_t *)&x->props.saddr);
+        struct net *net = xs_net(x);
+        xfrm6_tunnel_free_spi(net, (xfrm_address_t *)&x->props.saddr);
 }
 static const struct xfrm_type xfrm6_tunnel_type = {
@@ -342,34 +329,73 @@ static struct xfrm6_tunnel xfrm46_tunnel_handler = {
        .priority       = 2,
 };
+static int __net_init xfrm6_tunnel_net_init(struct net *net)
+{
+        struct xfrm6_tunnel_net *xfrm6_tn = xfrm6_tunnel_pernet(net);
+        unsigned int i;
+        for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
+                INIT_HLIST_HEAD(&xfrm6_tn->spi_byaddr[i]);
+        for (i = 0; i < XFRM6_TUNNEL_SPI_BYSPI_HSIZE; i++)
+                INIT_HLIST_HEAD(&xfrm6_tn->spi_byspi[i]);
+        xfrm6_tn->spi = 0;
+        return 0;
+}
+static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
+{
+}
+static struct pernet_operations xfrm6_tunnel_net_ops = {
+        .init   = xfrm6_tunnel_net_init,
+        .exit   = xfrm6_tunnel_net_exit,
+        .id     = &xfrm6_tunnel_net_id,
+        .size   = sizeof(struct xfrm6_tunnel_net),
+};
 static int __init xfrm6_tunnel_init(void)
 {
-        if (xfrm_register_type(&xfrm6_tunnel_type, AF_INET6) < 0)
+        int rv;
-                goto err;
-        if (xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6))
+        xfrm6_tunnel_spi_kmem = kmem_cache_create("xfrm6_tunnel_spi",
-                goto unreg;
+                                                  sizeof(struct xfrm6_tunnel_spi),
-        if (xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET))
+                                                  0, SLAB_HWCACHE_ALIGN,
-                goto dereg6;
+                                                  NULL);
-        if (xfrm6_tunnel_spi_init() < 0)
+        if (!xfrm6_tunnel_spi_kmem)
-                goto dereg46;
+                return -ENOMEM;
+        rv = register_pernet_subsys(&xfrm6_tunnel_net_ops);
+        if (rv < 0)
+                goto out_pernet;
+        rv = xfrm_register_type(&xfrm6_tunnel_type, AF_INET6);
+        if (rv < 0)
+                goto out_type;
+        rv = xfrm6_tunnel_register(&xfrm6_tunnel_handler, AF_INET6);
+        if (rv < 0)
+                goto out_xfrm6;
+        rv = xfrm6_tunnel_register(&xfrm46_tunnel_handler, AF_INET);
+        if (rv < 0)
+                goto out_xfrm46;
        return 0;
-dereg46:
+out_xfrm46:
-        xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET);
-dereg6:
        xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
-unreg:
+out_xfrm6:
        xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
-err:
+out_type:
-        return -EAGAIN;
+        unregister_pernet_subsys(&xfrm6_tunnel_net_ops);
+out_pernet:
+        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
+        return rv;
 }
 static void __exit xfrm6_tunnel_fini(void)
 {
-        xfrm6_tunnel_spi_fini();
        xfrm6_tunnel_deregister(&xfrm46_tunnel_handler, AF_INET);
        xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
        xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
+        unregister_pernet_subsys(&xfrm6_tunnel_net_ops);
+        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
 }
 module_init(xfrm6_tunnel_init);