7 files changed, 33 insertions, 25 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 76ff9f4fe89d..4ea8cf7c0cc4 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -379,8 +379,8 @@ static struct inet6_dev * ipv6_add_dev(struct net_device *dev)
                     dev->type == ARPHRD_NONE ||
                     dev->type == ARPHRD_SIT) {
                         printk(KERN_INFO
-                                "Disabled Privacy Extensions on device %p(%s)\n",
-                                dev, dev->name);
+                               "%s: Disabled Privacy Extensions\n",
+                               dev->name);
                         ndev->cnf.use_tempaddr = -1;
                 } else {
                         in6_dev_hold(ndev);
@@ -1596,9 +1596,17 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
            not good.
          */
         if (valid_lft >= 0x7FFFFFFF/HZ)
-                rt_expires = 0;
+                rt_expires = 0x7FFFFFFF - (0x7FFFFFFF % HZ);
         else
-                rt_expires = jiffies + valid_lft * HZ;
+                rt_expires = valid_lft * HZ;
+
+        /*
+         * We convert this (in jiffies) to clock_t later.
+         * Avoid arithmetic overflow there as well.
+         * Overflow can happen only if HZ < USER_HZ.
+         */
+        if (HZ < USER_HZ && rt_expires > 0x7FFFFFFF / USER_HZ)
+                rt_expires = 0x7FFFFFFF / USER_HZ;
 
         if (pinfo->onlink) {
                 struct rt6_info *rt;
@@ -1610,12 +1618,12 @@ void addrconf_prefix_rcv(struct net_device *dev, u8 *opt, int len)
                                         ip6_del_rt(rt, NULL, NULL, NULL);
                                         rt = NULL;
                                 } else {
-                                        rt->rt6i_expires = rt_expires;
+                                        rt->rt6i_expires = jiffies + rt_expires;
                                 }
                         }
                 } else if (valid_lft) {
                         addrconf_prefix_route(&pinfo->prefix, pinfo->prefix_len,
-                                              dev, rt_expires, RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
+                                              dev, jiffies_to_clock_t(rt_expires), RTF_ADDRCONF|RTF_EXPIRES|RTF_PREFIX_RT);
                 }
                 if (rt)
                         dst_release(&rt->u.dst);
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 40d9a1935ab5..8bfbe9970793 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -248,7 +248,7 @@ static u32 esp6_get_max_size(struct xfrm_state *x, int mtu)
         if (esp->conf.padlen)
                 mtu = ALIGN(mtu, esp->conf.padlen);
 
-        return mtu + x->props.header_len + esp->auth.icv_full_len;
+        return mtu + x->props.header_len + esp->auth.icv_trunc_len;
 }
 
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 060d61202412..04912f9b35c3 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -211,7 +211,7 @@ config IP6_NF_TARGET_REJECT
 
 config IP6_NF_TARGET_NFQUEUE
         tristate "NFQUEUE Target Support"
-        depends on IP_NF_IPTABLES
+        depends on IP6_NF_IPTABLES
         help
           This Target replaced the old obsolete QUEUE target.
 
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index c0f1da5497a9..a7e03cfacd06 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -68,8 +68,8 @@ static int icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
                 [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_REPLY +1
         };
 
-        __u8 type = orig->dst.u.icmp.type - 128;
-        if (type >= sizeof(invmap) || !invmap[type])
+        int type = orig->dst.u.icmp.type - 128;
+        if (type < 0 || type >= sizeof(invmap) || !invmap[type])
                 return 0;
 
         tuple->src.u.icmp.id   = orig->src.u.icmp.id;
@@ -129,12 +129,12 @@ static int icmpv6_new(struct nf_conn *conntrack,
                 [ICMPV6_ECHO_REQUEST - 128] = 1,
                 [ICMPV6_NI_QUERY - 128] = 1
         };
+        int type = conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128;
 
-        if (conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128 >= sizeof(valid_new)
-            || !valid_new[conntrack->tuplehash[0].tuple.dst.u.icmp.type - 128]) {
+        if (type < 0 || type >= sizeof(valid_new) || !valid_new[type]) {
                 /* Can't create a new ICMPv6 `conn' with this. */
-                DEBUGP("icmp: can't create new conn with type %u\n",
-                       conntrack->tuplehash[0].tuple.dst.u.icmp.type);
+                DEBUGP("icmpv6: can't create new conn with type %u\n",
+                       type + 128);
                 NF_CT_DUMP_TUPLE(&conntrack->tuplehash[0].tuple);
                 return 0;
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index a7a537b50595..7c68bfbee361 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -829,7 +829,7 @@ int ip6_route_add(struct in6_rtmsg *rtmsg, struct nlmsghdr *nlh,
         }
 
         rt->u.dst.obsolete = -1;
-        rt->rt6i_expires = clock_t_to_jiffies(rtmsg->rtmsg_info);
+        rt->rt6i_expires = jiffies + clock_t_to_jiffies(rtmsg->rtmsg_info);
         if (nlh && (r = NLMSG_DATA(nlh))) {
                 rt->rt6i_protocol = r->rtm_protocol;
         } else {
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 62c0e5bd931c..8827389abaf7 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -992,13 +992,12 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
         /* sk = NULL, but it is safe for now. RST socket required. */
         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 
-                if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0)
+                if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
+                        ip6_xmit(NULL, buff, &fl, NULL, 0);
+                        TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
+                        TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
                         return;
-
-                ip6_xmit(NULL, buff, &fl, NULL, 0);
-                TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
-                TCP_INC_STATS_BH(TCP_MIB_OUTRSTS);
-                return;
+                }
         }
 
         kfree_skb(buff);
@@ -1057,11 +1056,11 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         fl.fl_ip_sport = t1->source;
 
         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
-                if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0)
+                if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
+                        ip6_xmit(NULL, buff, &fl, NULL, 0);
+                        TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
                         return;
-                ip6_xmit(NULL, buff, &fl, NULL, 0);
-                TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
-                return;
+                }
         }
 
         kfree_skb(buff);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index cf1d91e74c82..69bd957380e7 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -214,6 +214,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl)
                 case IPPROTO_UDP:
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
+                case IPPROTO_DCCP:
                         if (pskb_may_pull(skb, skb->nh.raw + offset + 4 - skb->data)) {
                                 u16 *ports = (u16 *)exthdr;