3 files changed, 22 insertions, 15 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 0c5042e7380d..c7852b38e03e 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -578,6 +578,8 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         ifa->flags = flags | IFA_F_TENTATIVE;
         ifa->cstamp = ifa->tstamp = jiffies;
 
+        ifa->rt = rt;
+
         ifa->idev = idev;
         in6_dev_hold(idev);
         /* For caller */
@@ -603,8 +605,6 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
         }
 #endif
 
-        ifa->rt = rt;
-
         in6_ifa_hold(ifa);
         write_unlock(&idev->lock);
 out2:
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 9d0ee7f0eeb5..86dac106873b 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -635,14 +635,17 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
         struct ipv6_txoptions *opt2;
         int err;
 
-        if (newtype != IPV6_HOPOPTS && opt->hopopt)
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
-        if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
-        if (newtype != IPV6_RTHDR && opt->srcrt)
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
-        if (newtype != IPV6_DSTOPTS && opt->dst1opt)
-                tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+        if (opt) {
+                if (newtype != IPV6_HOPOPTS && opt->hopopt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
+                if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
+                if (newtype != IPV6_RTHDR && opt->srcrt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
+                if (newtype != IPV6_DSTOPTS && opt->dst1opt)
+                        tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+        }
+
         if (newopt && newoptlen)
                 tot_len += CMSG_ALIGN(newoptlen);
 
@@ -659,25 +662,25 @@ ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
         opt2->tot_len = tot_len;
         p = (char *)(opt2 + 1);
 
-        err = ipv6_renew_option(opt->hopopt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->hopopt : NULL, newopt, newoptlen,
                                 newtype != IPV6_HOPOPTS,
                                 &opt2->hopopt, &p);
         if (err)
                 goto out;
 
-        err = ipv6_renew_option(opt->dst0opt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->dst0opt : NULL, newopt, newoptlen,
                                 newtype != IPV6_RTHDRDSTOPTS,
                                 &opt2->dst0opt, &p);
         if (err)
                 goto out;
 
-        err = ipv6_renew_option(opt->srcrt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->srcrt : NULL, newopt, newoptlen,
                                 newtype != IPV6_RTHDR,
-                                (struct ipv6_opt_hdr **)opt2->srcrt, &p);
+                                (struct ipv6_opt_hdr **)&opt2->srcrt, &p);
         if (err)
                 goto out;
 
-        err = ipv6_renew_option(opt->dst1opt, newopt, newoptlen,
+        err = ipv6_renew_option(opt ? opt->dst1opt : NULL, newopt, newoptlen,
                                 newtype != IPV6_DSTOPTS,
                                 &opt2->dst1opt, &p);
         if (err)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4b163711f3a8..d9baca062d24 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1532,6 +1532,10 @@ int ipv6_route_ioctl(unsigned int cmd, void __user *arg)
 
 static int ip6_pkt_discard(struct sk_buff *skb)
 {
+        int type = ipv6_addr_type(&skb->nh.ipv6h->daddr);
+        if (type == IPV6_ADDR_ANY || type == IPV6_ADDR_RESERVED)
+                IP6_INC_STATS(IPSTATS_MIB_INADDRERRORS);
+
         IP6_INC_STATS(IPSTATS_MIB_OUTNOROUTES);
         icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_NOROUTE, 0, skb->dev);
         kfree_skb(skb);