5 files changed, 62 insertions, 17 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7196ac2f2d16..7744a2592693 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3076,7 +3076,7 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
         netlink_broadcast(rtnl, skb, 0, RTMGRP_IPV6_PREFIX, GFP_ATOMIC);
 }
 
-static struct rtnetlink_link inet6_rtnetlink_table[RTM_MAX - RTM_BASE + 1] = {
+static struct rtnetlink_link inet6_rtnetlink_table[RTM_NR_MSGTYPES] = {
         [RTM_GETLINK - RTM_BASE] = { .dumpit    = inet6_dump_ifinfo, },
         [RTM_NEWADDR - RTM_BASE] = { .doit      = inet6_rtm_newaddr, },
         [RTM_DELADDR - RTM_BASE] = { .doit      = inet6_rtm_deladdr, },
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index c54830b89593..750943e2d34e 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -549,20 +549,18 @@ ipq_rcv_skb(struct sk_buff *skb)
 static void
 ipq_rcv_sk(struct sock *sk, int len)
 {
-        do {
-                struct sk_buff *skb;
+        struct sk_buff *skb;
+        unsigned int qlen;
 
-                if (down_trylock(&ipqnl_sem))
-                        return;
+        down(&ipqnl_sem);
                         
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                        ipq_rcv_skb(skb);
-                        kfree_skb(skb);
-                }
+        for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                ipq_rcv_skb(skb);
+                kfree_skb(skb);
+        }
                 
-                up(&ipqnl_sem);
-
-        } while (ipqnl && ipqnl->sk_receive_queue.qlen);
+        up(&ipqnl_sem);
 }
 
 static int
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1352c1d9bf4d..617645bc5ed6 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -455,11 +455,11 @@ csum_copy_err:
 static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                                      struct raw6_sock *rp)
 {
-        struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
         int err = 0;
         int offset;
         int len;
+        int total_len;
         u32 tmp_csum;
         u16 csum;
 
@@ -470,7 +470,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                 goto out;
 
         offset = rp->offset;
-        if (offset >= inet->cork.length - 1) {
+        total_len = inet_sk(sk)->cork.length - (skb->nh.raw - skb->data);
+        if (offset >= total_len - 1) {
                 err = -EINVAL;
                 ip6_flush_pending_frames(sk);
                 goto out;
@@ -514,7 +515,7 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
 
         tmp_csum = csum_ipv6_magic(&fl->fl6_src,
                                    &fl->fl6_dst,
-                                   inet->cork.length, fl->proto, tmp_csum);
+                                   total_len, fl->proto, tmp_csum);
 
         if (tmp_csum == 0)
                 tmp_csum = -1;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4760c85e19db..0f69e800a0ad 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -139,9 +139,12 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                 int rover;
 
                 spin_lock(&tcp_portalloc_lock);
-                rover = tcp_port_rover;
+                if (tcp_port_rover < low)
+                        rover = low;
+                else
+                        rover = tcp_port_rover;
                 do {    rover++;
-                        if ((rover < low) || (rover > high))
+                        if (rover > high)
                                 rover = low;
                         head = &tcp_bhash[tcp_bhashfn(rover)];
                         spin_lock(&head->lock);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8a4f37de4d2d..4429b1a1fe5f 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -11,7 +11,11 @@
  * 
  */
 
+#include <asm/bug.h>
+#include <linux/compiler.h>
 #include <linux/config.h>
+#include <linux/netdevice.h>
+#include <net/addrconf.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -166,6 +170,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway)); 
                 x->u.rt6.rt6i_dst      = rt0->rt6i_dst;
                 x->u.rt6.rt6i_src      = rt0->rt6i_src; 
+                x->u.rt6.rt6i_idev     = rt0->rt6i_idev;
+                in6_dev_hold(rt0->rt6i_idev);
                 header_len -= x->u.dst.xfrm->props.header_len;
                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
         }
@@ -251,11 +257,48 @@ static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
         path->ops->update_pmtu(path, mtu);
 }
 
+static void xfrm6_dst_destroy(struct dst_entry *dst)
+{
+        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+
+        if (likely(xdst->u.rt6.rt6i_idev))
+                in6_dev_put(xdst->u.rt6.rt6i_idev);
+        xfrm_dst_destroy(xdst);
+}
+
+static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+                             int unregister)
+{
+        struct xfrm_dst *xdst;
+
+        if (!unregister)
+                return;
+
+        xdst = (struct xfrm_dst *)dst;
+        if (xdst->u.rt6.rt6i_idev->dev == dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(&loopback_dev);
+                BUG_ON(!loopback_idev);
+
+                do {
+                        in6_dev_put(xdst->u.rt6.rt6i_idev);
+                        xdst->u.rt6.rt6i_idev = loopback_idev;
+                        in6_dev_hold(loopback_idev);
+                        xdst = (struct xfrm_dst *)xdst->u.dst.child;
+                } while (xdst->u.dst.xfrm);
+
+                __in6_dev_put(loopback_idev);
+        }
+
+        xfrm_dst_ifdown(dst, dev);
+}
+
 static struct dst_ops xfrm6_dst_ops = {
         .family =               AF_INET6,
         .protocol =             __constant_htons(ETH_P_IPV6),
         .gc =                   xfrm6_garbage_collect,
         .update_pmtu =          xfrm6_update_pmtu,
+        .destroy =              xfrm6_dst_destroy,
+        .ifdown =               xfrm6_dst_ifdown,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
 };