28 files changed, 348 insertions, 217 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 07ee758de9e1..e92ad8455c63 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2031,8 +2031,8 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
 
 #if defined(CONFIG_IPV6_SIT) || defined(CONFIG_IPV6_SIT_MODULE)
         if (dev->type == ARPHRD_SIT) {
+                const struct net_device_ops *ops = dev->netdev_ops;
                 struct ifreq ifr;
-                mm_segment_t    oldfs;
                 struct ip_tunnel_parm p;
 
                 err = -EADDRNOTAVAIL;
@@ -2048,9 +2048,14 @@ int addrconf_set_dstaddr(struct net *net, void __user *arg)
                 p.iph.ttl = 64;
                 ifr.ifr_ifru.ifru_data = (__force void __user *)&p;
 
-                oldfs = get_fs(); set_fs(KERNEL_DS);
-                err = dev->do_ioctl(dev, &ifr, SIOCADDTUNNEL);
-                set_fs(oldfs);
+                if (ops->ndo_do_ioctl) {
+                        mm_segment_t oldfs = get_fs();
+
+                        set_fs(KERNEL_DS);
+                        err = ops->ndo_do_ioctl(dev, &ifr, SIOCADDTUNNEL);
+                        set_fs(oldfs);
+                } else
+                        err = -EOPNOTSUPP;
 
                 if (err == 0) {
                         err = -ENOBUFS;
@@ -2483,8 +2488,10 @@ static int addrconf_notify(struct notifier_block *this, unsigned long event,
                         if (!idev && dev->mtu >= IPV6_MIN_MTU)
                                 idev = ipv6_add_dev(dev);
 
-                        if (idev)
+                        if (idev) {
                                 idev->if_flags |= IF_READY;
+                                run_pending = 1;
+                        }
                 } else {
                         if (!addrconf_qdisc_ok(dev)) {
                                 /* device is still not ready. */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 01edac888510..437b750b98fd 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -637,7 +637,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
                 if (final_p)
                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-                if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
+                if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0) {
                         sk->sk_err_soft = -err;
                         return err;
                 }
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 7a8a01369e5c..52449f7a1b71 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -407,6 +407,7 @@ out:
 static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                     int type, int code, int offset, __be32 info)
 {
+        struct net *net = dev_net(skb->dev);
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
         struct ip_auth_hdr *ah = (struct ip_auth_hdr*)(skb->data+offset);
         struct xfrm_state *x;
@@ -415,7 +416,7 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
             type != ICMPV6_PKT_TOOBIG)
                 return;
 
-        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
+        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, ah->spi, IPPROTO_AH, AF_INET6);
         if (!x)
                 return;
 
@@ -509,9 +510,7 @@ static void ah6_destroy(struct xfrm_state *x)
                 return;
 
         kfree(ahp->work_icv);
-        ahp->work_icv = NULL;
         crypto_free_hash(ahp->tfm);
-        ahp->tfm = NULL;
         kfree(ahp);
 }
 
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 410046a8cc91..e2bdc6d83a43 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -175,7 +175,8 @@ ipv4_connected:
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
+        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
+        if (err < 0) {
                 if (err == -EREMOTE)
                         err = ip6_dst_blackhole(sk, &dst, &fl);
                 if (err < 0)
@@ -661,6 +662,11 @@ int datagram_send_ctl(struct net *net,
                         switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1) {
+                                        err = -EINVAL;
+                                        goto exit_f;
+                                }
                                 break;
 #endif
                         default:
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index c02a6308defe..c2f250150db1 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -356,6 +356,7 @@ static u32 esp6_get_mtu(struct xfrm_state *x, int mtu)
 static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                      int type, int code, int offset, __be32 info)
 {
+        struct net *net = dev_net(skb->dev);
         struct ipv6hdr *iph = (struct ipv6hdr*)skb->data;
         struct ip_esp_hdr *esph = (struct ip_esp_hdr *)(skb->data + offset);
         struct xfrm_state *x;
@@ -364,7 +365,7 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
             type != ICMPV6_PKT_TOOBIG)
                 return;
 
-        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
+        x = xfrm_state_lookup(net, (xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
                 return;
         printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index be351009fd03..4f433847d95f 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -233,7 +233,7 @@ static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct
         icmp6h->icmp6_cksum = 0;
 
         if (skb_queue_len(&sk->sk_write_queue) == 1) {
-                skb->csum = csum_partial((char *)icmp6h,
+                skb->csum = csum_partial(icmp6h,
                                         sizeof(struct icmp6hdr), skb->csum);
                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl->fl6_src,
                                                       &fl->fl6_dst,
@@ -246,7 +246,7 @@ static int icmpv6_push_pending_frames(struct sock *sk, struct flowi *fl, struct
                         tmp_csum = csum_add(tmp_csum, skb->csum);
                 }
 
-                tmp_csum = csum_partial((char *)icmp6h,
+                tmp_csum = csum_partial(icmp6h,
                                         sizeof(struct icmp6hdr), tmp_csum);
                 icmp6h->icmp6_cksum = csum_ipv6_magic(&fl->fl6_src,
                                                       &fl->fl6_dst,
@@ -427,7 +427,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         /* No need to clone since we're just using its address. */
         dst2 = dst;
 
-        err = xfrm_lookup(&dst, &fl, sk, 0);
+        err = xfrm_lookup(net, &dst, &fl, sk, 0);
         switch (err) {
         case 0:
                 if (dst != dst2)
@@ -446,7 +446,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         if (ip6_dst_lookup(sk, &dst2, &fl))
                 goto relookup_failed;
 
-        err = xfrm_lookup(&dst2, &fl, sk, XFRM_LOOKUP_ICMP);
+        err = xfrm_lookup(net, &dst2, &fl, sk, XFRM_LOOKUP_ICMP);
         switch (err) {
         case 0:
                 dst_release(dst);
@@ -552,7 +552,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         err = ip6_dst_lookup(sk, &dst, &fl);
         if (err)
                 goto out;
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+        if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0)
                 goto out;
 
         if (ipv6_addr_is_multicast(&fl.fl6_dst))
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 16d43f20b32f..3c3732d50c1a 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -219,7 +219,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
                 if (final_p)
                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-                if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
+                if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0) {
                         sk->sk_route_caps = 0;
                         kfree_skb(skb);
                         return err;
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 1646a5658255..8fe267feb81e 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -25,26 +25,30 @@
 void __inet6_hash(struct sock *sk)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
-        struct hlist_head *list;
-        rwlock_t *lock;
 
         WARN_ON(!sk_unhashed(sk));
 
         if (sk->sk_state == TCP_LISTEN) {
-                list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
-                lock = &hashinfo->lhash_lock;
-                inet_listen_wlock(hashinfo);
+                struct inet_listen_hashbucket *ilb;
+
+                ilb = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
+                spin_lock(&ilb->lock);
+                __sk_nulls_add_node_rcu(sk, &ilb->head);
+                spin_unlock(&ilb->lock);
         } else {
                 unsigned int hash;
+                struct hlist_nulls_head *list;
+                spinlock_t *lock;
+
                 sk->sk_hash = hash = inet6_sk_ehashfn(sk);
                 list = &inet_ehash_bucket(hashinfo, hash)->chain;
                 lock = inet_ehash_lockp(hashinfo, hash);
-                write_lock(lock);
+                spin_lock(lock);
+                __sk_nulls_add_node_rcu(sk, list);
+                spin_unlock(lock);
         }
 
-        __sk_add_node(sk, list);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
-        write_unlock(lock);
 }
 EXPORT_SYMBOL(__inet6_hash);
 
@@ -63,77 +67,122 @@ struct sock *__inet6_lookup_established(struct net *net,
                                            const int dif)
 {
         struct sock *sk;
-        const struct hlist_node *node;
+        const struct hlist_nulls_node *node;
         const __portpair ports = INET_COMBINED_PORTS(sport, hnum);
         /* Optimize here for direct hit, only listening connections can
          * have wildcards anyways.
          */
         unsigned int hash = inet6_ehashfn(net, daddr, hnum, saddr, sport);
-        struct inet_ehash_bucket *head = inet_ehash_bucket(hashinfo, hash);
-        rwlock_t *lock = inet_ehash_lockp(hashinfo, hash);
+        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
-        prefetch(head->chain.first);
-        read_lock(lock);
-        sk_for_each(sk, node, &head->chain) {
+
+        rcu_read_lock();
+begin:
+        sk_nulls_for_each_rcu(sk, node, &head->chain) {
                 /* For IPV6 do the cheaper port and family tests first. */
-                if (INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif))
-                        goto hit; /* You sunk my battleship! */
+                if (INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
+                        if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt)))
+                                goto begintw;
+                        if (!INET6_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
+                                sock_put(sk);
+                                goto begin;
+                        }
+                goto out;
+                }
         }
+        if (get_nulls_value(node) != slot)
+                goto begin;
+
+begintw:
         /* Must check for a TIME_WAIT'er before going to listener hash. */
-        sk_for_each(sk, node, &head->twchain) {
-                if (INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif))
-                        goto hit;
+        sk_nulls_for_each_rcu(sk, node, &head->twchain) {
+                if (INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
+                        if (unlikely(!atomic_inc_not_zero(&sk->sk_refcnt))) {
+                                sk = NULL;
+                                goto out;
+                        }
+                        if (!INET6_TW_MATCH(sk, net, hash, saddr, daddr, ports, dif)) {
+                                sock_put(sk);
+                                goto begintw;
+                        }
+                        goto out;
+                }
         }
-        read_unlock(lock);
-        return NULL;
-
-hit:
-        sock_hold(sk);
-        read_unlock(lock);
+        if (get_nulls_value(node) != slot)
+                goto begintw;
+        sk = NULL;
+out:
+        rcu_read_unlock();
         return sk;
 }
 EXPORT_SYMBOL(__inet6_lookup_established);
 
+static int inline compute_score(struct sock *sk, struct net *net,
+                                const unsigned short hnum,
+                                const struct in6_addr *daddr,
+                                const int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
+            sk->sk_family == PF_INET6) {
+                const struct ipv6_pinfo *np = inet6_sk(sk);
+
+                score = 1;
+                if (!ipv6_addr_any(&np->rcv_saddr)) {
+                        if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
+                                return -1;
+                        score++;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score++;
+                }
+        }
+        return score;
+}
+
 struct sock *inet6_lookup_listener(struct net *net,
                 struct inet_hashinfo *hashinfo, const struct in6_addr *daddr,
                 const unsigned short hnum, const int dif)
 {
         struct sock *sk;
-        const struct hlist_node *node;
-        struct sock *result = NULL;
-        int score, hiscore = 0;
-
-        read_lock(&hashinfo->lhash_lock);
-        sk_for_each(sk, node,
-                        &hashinfo->listening_hash[inet_lhashfn(net, hnum)]) {
-                if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
-                                sk->sk_family == PF_INET6) {
-                        const struct ipv6_pinfo *np = inet6_sk(sk);
-
-                        score = 1;
-                        if (!ipv6_addr_any(&np->rcv_saddr)) {
-                                if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
-                                        continue;
-                                score++;
-                        }
-                        if (sk->sk_bound_dev_if) {
-                                if (sk->sk_bound_dev_if != dif)
-                                        continue;
-                                score++;
-                        }
-                        if (score == 3) {
-                                result = sk;
-                                break;
-                        }
-                        if (score > hiscore) {
-                                hiscore = score;
-                                result = sk;
-                        }
+        const struct hlist_nulls_node *node;
+        struct sock *result;
+        int score, hiscore;
+        unsigned int hash = inet_lhashfn(net, hnum);
+        struct inet_listen_hashbucket *ilb = &hashinfo->listening_hash[hash];
+
+        rcu_read_lock();
+begin:
+        result = NULL;
+        hiscore = -1;
+        sk_nulls_for_each(sk, node, &ilb->head) {
+                score = compute_score(sk, net, hnum, daddr, dif);
+                if (score > hiscore) {
+                        hiscore = score;
+                        result = sk;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != hash + LISTENING_NULLS_BASE)
+                goto begin;
+        if (result) {
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score(result, net, hnum, daddr,
+                                  dif) < hiscore)) {
+                        sock_put(result);
+                        goto begin;
                 }
         }
-        if (result)
-                sock_hold(result);
-        read_unlock(&hashinfo->lhash_lock);
+        rcu_read_unlock();
         return result;
 }
 
@@ -170,16 +219,15 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         const unsigned int hash = inet6_ehashfn(net, daddr, lport, saddr,
                                                 inet->dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
-        rwlock_t *lock = inet_ehash_lockp(hinfo, hash);
+        spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
-        const struct hlist_node *node;
+        const struct hlist_nulls_node *node;
         struct inet_timewait_sock *tw;
 
-        prefetch(head->chain.first);
-        write_lock(lock);
+        spin_lock(lock);
 
         /* Check TIME-WAIT sockets first. */
-        sk_for_each(sk2, node, &head->twchain) {
+        sk_nulls_for_each(sk2, node, &head->twchain) {
                 tw = inet_twsk(sk2);
 
                 if (INET6_TW_MATCH(sk2, net, hash, saddr, daddr, ports, dif)) {
@@ -192,7 +240,7 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         tw = NULL;
 
         /* And established part... */
-        sk_for_each(sk2, node, &head->chain) {
+        sk_nulls_for_each(sk2, node, &head->chain) {
                 if (INET6_MATCH(sk2, net, hash, saddr, daddr, ports, dif))
                         goto not_unique;
         }
@@ -203,10 +251,10 @@ unique:
         inet->num = lport;
         inet->sport = htons(lport);
         WARN_ON(!sk_unhashed(sk));
-        __sk_add_node(sk, &head->chain);
+        __sk_nulls_add_node_rcu(sk, &head->chain);
         sk->sk_hash = hash;
+        spin_unlock(lock);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
-        write_unlock(lock);
 
         if (twp != NULL) {
                 *twp = tw;
@@ -221,7 +269,7 @@ unique:
         return 0;
 
 not_unique:
-        write_unlock(lock);
+        spin_unlock(lock);
         return -EADDRNOTAVAIL;
 }
 
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 7927a8498d17..5656e8aa47d8 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -464,7 +464,7 @@ static inline void fl_link(struct ipv6_pinfo *np, struct ipv6_fl_socklist *sfl,
 
 int ipv6_flowlabel_opt(struct sock *sk, char __user *optval, int optlen)
 {
-        int err;
+        int uninitialized_var(err);
         struct net *net = sock_net(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct in6_flowlabel_req freq;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 64ce3d33d9c6..58e2b0d93758 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -74,8 +74,8 @@ MODULE_LICENSE("GPL");
                      (addr)->s6_addr32[2] ^ (addr)->s6_addr32[3]) & \
                     (HASH_SIZE - 1))
 
-static int ip6_fb_tnl_dev_init(struct net_device *dev);
-static int ip6_tnl_dev_init(struct net_device *dev);
+static void ip6_fb_tnl_dev_init(struct net_device *dev);
+static void ip6_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_setup(struct net_device *dev);
 
 static int ip6_tnl_net_id;
@@ -249,7 +249,7 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
         }
 
         t = netdev_priv(dev);
-        dev->init = ip6_tnl_dev_init;
+        ip6_tnl_dev_init(dev);
         t->parms = *p;
 
         if ((err = register_netdevice(dev)) < 0)
@@ -846,6 +846,7 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                          int encap_limit,
                          __u32 *pmtu)
 {
+        struct net *net = dev_net(dev);
         struct ip6_tnl *t = netdev_priv(dev);
         struct net_device_stats *stats = &t->dev->stats;
         struct ipv6hdr *ipv6h = ipv6_hdr(skb);
@@ -861,9 +862,9 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
         if ((dst = ip6_tnl_dst_check(t)) != NULL)
                 dst_hold(dst);
         else {
-                dst = ip6_route_output(dev_net(dev), NULL, fl);
+                dst = ip6_route_output(net, NULL, fl);
 
-                if (dst->error || xfrm_lookup(&dst, fl, NULL, 0) < 0)
+                if (dst->error || xfrm_lookup(net, &dst, fl, NULL, 0) < 0)
                         goto tx_err_link_failure;
         }
 
@@ -1150,7 +1151,6 @@ static void ip6_tnl_link_config(struct ip6_tnl *t)
  * ip6_tnl_change - update the tunnel parameters
  *   @t: tunnel to be changed
  *   @p: tunnel configuration parameters
- *   @active: != 0 if tunnel is ready for use
  *
  * Description:
  *   ip6_tnl_change() updates the tunnel parameters
@@ -1306,6 +1306,14 @@ ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
+
+static const struct net_device_ops ip6_tnl_netdev_ops = {
+        .ndo_uninit = ip6_tnl_dev_uninit,
+        .ndo_start_xmit = ip6_tnl_xmit,
+        .ndo_do_ioctl = ip6_tnl_ioctl,
+        .ndo_change_mtu = ip6_tnl_change_mtu,
+};
+
 /**
  * ip6_tnl_dev_setup - setup virtual tunnel device
  *   @dev: virtual device associated with tunnel
@@ -1316,11 +1324,8 @@ ip6_tnl_change_mtu(struct net_device *dev, int new_mtu)
 
 static void ip6_tnl_dev_setup(struct net_device *dev)
 {
-        dev->uninit = ip6_tnl_dev_uninit;
+        dev->netdev_ops = &ip6_tnl_netdev_ops;
         dev->destructor = free_netdev;
-        dev->hard_start_xmit = ip6_tnl_xmit;
-        dev->do_ioctl = ip6_tnl_ioctl;
-        dev->change_mtu = ip6_tnl_change_mtu;
 
         dev->type = ARPHRD_TUNNEL6;
         dev->hard_header_len = LL_MAX_HEADER + sizeof (struct ipv6hdr);
@@ -1349,13 +1354,11 @@ ip6_tnl_dev_init_gen(struct net_device *dev)
  *   @dev: virtual device associated with tunnel
  **/
 
-static int
-ip6_tnl_dev_init(struct net_device *dev)
+static void ip6_tnl_dev_init(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
         ip6_tnl_dev_init_gen(dev);
         ip6_tnl_link_config(t);
-        return 0;
 }
 
 /**
@@ -1365,8 +1368,7 @@ ip6_tnl_dev_init(struct net_device *dev)
  * Return: 0
  **/
 
-static int
-ip6_fb_tnl_dev_init(struct net_device *dev)
+static void ip6_fb_tnl_dev_init(struct net_device *dev)
 {
         struct ip6_tnl *t = netdev_priv(dev);
         struct net *net = dev_net(dev);
@@ -1376,7 +1378,6 @@ ip6_fb_tnl_dev_init(struct net_device *dev)
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
         ip6n->tnls_wc[0] = t;
-        return 0;
 }
 
 static struct xfrm6_tunnel ip4ip6_handler = {
@@ -1428,10 +1429,10 @@ static int ip6_tnl_init_net(struct net *net)
 
         if (!ip6n->fb_tnl_dev)
                 goto err_alloc_dev;
-
-        ip6n->fb_tnl_dev->init = ip6_fb_tnl_dev_init;
         dev_net_set(ip6n->fb_tnl_dev, net);
 
+        ip6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
+
         err = register_netdev(ip6n->fb_tnl_dev);
         if (err < 0)
                 goto err_register;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index c491fb98a5e3..dfba9fd0c248 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -224,7 +224,7 @@ static struct file_operations ip6mr_vif_fops = {
         .open    = ip6mr_vif_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 
 static void *ipmr_mfc_seq_start(struct seq_file *seq, loff_t *pos)
@@ -337,7 +337,7 @@ static struct file_operations ip6mr_mfc_fops = {
         .open    = ipmr_mfc_open,
         .read    = seq_read,
         .llseek  = seq_lseek,
-        .release = seq_release,
+        .release = seq_release_private,
 };
 #endif
 
@@ -416,12 +416,16 @@ static int reg_vif_xmit(struct sk_buff *skb, struct net_device *dev)
         return 0;
 }
 
+static const struct net_device_ops reg_vif_netdev_ops = {
+        .ndo_start_xmit = reg_vif_xmit,
+};
+
 static void reg_vif_setup(struct net_device *dev)
 {
         dev->type               = ARPHRD_PIMREG;
         dev->mtu                = 1500 - sizeof(struct ipv6hdr) - 8;
         dev->flags              = IFF_NOARP;
-        dev->hard_start_xmit    = reg_vif_xmit;
+        dev->netdev_ops         = &reg_vif_netdev_ops;
         dev->destructor         = free_netdev;
 }
 
@@ -980,14 +984,15 @@ int __init ip6_mr_init(void)
                 goto proc_cache_fail;
 #endif
         return 0;
-reg_notif_fail:
-        kmem_cache_destroy(mrt_cachep);
 #ifdef CONFIG_PROC_FS
-proc_vif_fail:
-        unregister_netdevice_notifier(&ip6_mr_notifier);
 proc_cache_fail:
         proc_net_remove(&init_net, "ip6_mr_vif");
+proc_vif_fail:
+        unregister_netdevice_notifier(&ip6_mr_notifier);
 #endif
+reg_notif_fail:
+        del_timer(&ipmr_expire_timer);
+        kmem_cache_destroy(mrt_cachep);
         return err;
 }
 
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index d4576a9c154f..3a0b3be7ece5 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -63,7 +63,7 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 return;
 
         spi = htonl(ntohs(ipcomph->cpi));
-        x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
+        x = xfrm_state_lookup(&init_net, (xfrm_address_t *)&iph->daddr, spi, IPPROTO_COMP, AF_INET6);
         if (!x)
                 return;
 
@@ -76,7 +76,7 @@ static struct xfrm_state *ipcomp6_tunnel_create(struct xfrm_state *x)
 {
         struct xfrm_state *t = NULL;
 
-        t = xfrm_state_alloc();
+        t = xfrm_state_alloc(&init_net);
         if (!t)
                 goto out;
 
@@ -114,7 +114,7 @@ static int ipcomp6_tunnel_attach(struct xfrm_state *x)
 
         spi = xfrm6_tunnel_spi_lookup((xfrm_address_t *)&x->props.saddr);
         if (spi)
-                t = xfrm_state_lookup((xfrm_address_t *)&x->id.daddr,
+                t = xfrm_state_lookup(&init_net, (xfrm_address_t *)&x->id.daddr,
                                               spi, IPPROTO_IPV6, AF_INET6);
         if (!t) {
                 t = ipcomp6_tunnel_create(x);
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4e5eac301f91..2aa294be0c79 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -366,11 +366,16 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                 }
 
                 /* routing header option needs extra check */
+                retv = -EINVAL;
                 if (optname == IPV6_RTHDR && opt && opt->srcrt) {
                         struct ipv6_rt_hdr *rthdr = opt->srcrt;
                         switch (rthdr->type) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
                         case IPV6_SRCRT_TYPE_2:
+                                if (rthdr->hdrlen != 2 ||
+                                    rthdr->segments_left != 1)
+                                        goto sticky_done;
+
                                 break;
 #endif
                         default:
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index a76199ecad23..0f3896032830 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -1466,7 +1466,7 @@ static void mld_sendpack(struct sk_buff *skb)
                          &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
                          skb->dev->ifindex);
 
-        err = xfrm_lookup(&skb->dst, &fl, NULL, 0);
+        err = xfrm_lookup(net, &skb->dst, &fl, NULL, 0);
         if (err)
                 goto err_out;
 
@@ -1817,7 +1817,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
 
         hdr->icmp6_cksum = csum_ipv6_magic(saddr, snd_addr, len,
                                            IPPROTO_ICMPV6,
-                                           csum_partial((__u8 *) hdr, len, 0));
+                                           csum_partial(hdr, len, 0));
 
         idev = in6_dev_get(skb->dev);
 
@@ -1831,7 +1831,7 @@ static void igmp6_send(struct in6_addr *addr, struct net_device *dev, int type)
                          &ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
                          skb->dev->ifindex);
 
-        err = xfrm_lookup(&skb->dst, &fl, NULL, 0);
+        err = xfrm_lookup(net, &skb->dst, &fl, NULL, 0);
         if (err)
                 goto err_out;
 
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 31295c8f6196..f995e19c87a9 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -205,6 +205,7 @@ static inline int mip6_report_rl_allow(struct timeval *stamp,
 
 static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, struct flowi *fl)
 {
+        struct net *net = xs_net(x);
         struct inet6_skb_parm *opt = (struct inet6_skb_parm *)skb->cb;
         struct ipv6_destopt_hao *hao = NULL;
         struct xfrm_selector sel;
@@ -247,7 +248,7 @@ static int mip6_destopt_reject(struct xfrm_state *x, struct sk_buff *skb, struct
                 sel.sport_mask = htons(~0);
         sel.ifindex = fl->oif;
 
-        err = km_report(IPPROTO_DSTOPTS, &sel,
+        err = km_report(net, IPPROTO_DSTOPTS, &sel,
                         (hao ? (xfrm_address_t *)&hao->addr : NULL));
 
  out:
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 2a6752dae09d..e4acc212345e 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -437,38 +437,20 @@ static void pndisc_destructor(struct pneigh_entry *n)
         ipv6_dev_mc_dec(dev, &maddr);
 }
 
-/*
- *      Send a Neighbour Advertisement
- */
-static void __ndisc_send(struct net_device *dev,
-                         struct neighbour *neigh,
-                         const struct in6_addr *daddr,
-                         const struct in6_addr *saddr,
-                         struct icmp6hdr *icmp6h, const struct in6_addr *target,
-                         int llinfo)
+struct sk_buff *ndisc_build_skb(struct net_device *dev,
+                                const struct in6_addr *daddr,
+                                const struct in6_addr *saddr,
+                                struct icmp6hdr *icmp6h,
+                                const struct in6_addr *target,
+                                int llinfo)
 {
-        struct flowi fl;
-        struct dst_entry *dst;
         struct net *net = dev_net(dev);
         struct sock *sk = net->ipv6.ndisc_sk;
         struct sk_buff *skb;
         struct icmp6hdr *hdr;
-        struct inet6_dev *idev;
         int len;
         int err;
-        u8 *opt, type;
-
-        type = icmp6h->icmp6_type;
-
-        icmpv6_flow_init(sk, &fl, type, saddr, daddr, dev->ifindex);
-
-        dst = icmp6_dst_alloc(dev, neigh, daddr);
-        if (!dst)
-                return;
-
-        err = xfrm_lookup(&dst, &fl, NULL, 0);
-        if (err < 0)
-                return;
+        u8 *opt;
 
         if (!dev->addr_len)
                 llinfo = 0;
@@ -485,8 +467,7 @@ static void __ndisc_send(struct net_device *dev,
                 ND_PRINTK0(KERN_ERR
                            "ICMPv6 ND: %s() failed to allocate an skb.\n",
                            __func__);
-                dst_release(dst);
-                return;
+                return NULL;
         }
 
         skb_reserve(skb, LL_RESERVED_SPACE(dev));
@@ -510,9 +491,45 @@ static void __ndisc_send(struct net_device *dev,
 
         hdr->icmp6_cksum = csum_ipv6_magic(saddr, daddr, len,
                                            IPPROTO_ICMPV6,
-                                           csum_partial((__u8 *) hdr,
+                                           csum_partial(hdr,
                                                         len, 0));
 
+        return skb;
+}
+
+EXPORT_SYMBOL(ndisc_build_skb);
+
+void ndisc_send_skb(struct sk_buff *skb,
+                    struct net_device *dev,
+                    struct neighbour *neigh,
+                    const struct in6_addr *daddr,
+                    const struct in6_addr *saddr,
+                    struct icmp6hdr *icmp6h)
+{
+        struct flowi fl;
+        struct dst_entry *dst;
+        struct net *net = dev_net(dev);
+        struct sock *sk = net->ipv6.ndisc_sk;
+        struct inet6_dev *idev;
+        int err;
+        u8 type;
+
+        type = icmp6h->icmp6_type;
+
+        icmpv6_flow_init(sk, &fl, type, saddr, daddr, dev->ifindex);
+
+        dst = icmp6_dst_alloc(dev, neigh, daddr);
+        if (!dst) {
+                kfree_skb(skb);
+                return;
+        }
+
+        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
+        if (err < 0) {
+                kfree_skb(skb);
+                return;
+        }
+
         skb->dst = dst;
 
         idev = in6_dev_get(dst->dev);
@@ -529,6 +546,27 @@ static void __ndisc_send(struct net_device *dev,
                 in6_dev_put(idev);
 }
 
+EXPORT_SYMBOL(ndisc_send_skb);
+
+/*
+ *      Send a Neighbour Discover packet
+ */
+static void __ndisc_send(struct net_device *dev,
+                         struct neighbour *neigh,
+                         const struct in6_addr *daddr,
+                         const struct in6_addr *saddr,
+                         struct icmp6hdr *icmp6h, const struct in6_addr *target,
+                         int llinfo)
+{
+        struct sk_buff *skb;
+
+        skb = ndisc_build_skb(dev, daddr, saddr, icmp6h, target, llinfo);
+        if (!skb)
+                return;
+
+        ndisc_send_skb(skb, dev, neigh, daddr, saddr, icmp6h);
+}
+
 static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                           const struct in6_addr *daddr,
                           const struct in6_addr *solicited_addr,
@@ -1486,7 +1524,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
         if (dst == NULL)
                 return;
 
-        err = xfrm_lookup(&dst, &fl, NULL, 0);
+        err = xfrm_lookup(net, &dst, &fl, NULL, 0);
         if (err)
                 return;
 
@@ -1574,7 +1612,7 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 
         icmph->icmp6_cksum = csum_ipv6_magic(&saddr_buf, &ipv6_hdr(skb)->saddr,
                                              len, IPPROTO_ICMPV6,
-                                             csum_partial((u8 *) icmph, len, 0));
+                                             csum_partial(icmph, len, 0));
 
         buff->dst = dst;
         idev = in6_dev_get(dst->dev);
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 0b88c5632793..834cea69fb53 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -29,7 +29,7 @@ int ip6_route_me_harder(struct sk_buff *skb)
 #ifdef CONFIG_XFRM
         if (!(IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) &&
             xfrm_decode_session(skb, &fl, AF_INET6) == 0)
-                if (xfrm_lookup(&skb->dst, &fl, skb->sk, 0))
+                if (xfrm_lookup(net, &skb->dst, &fl, skb->sk, 0))
                         return -1;
 #endif
 
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 0981b4ccb8b1..5a2d0a41694a 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -97,7 +97,7 @@ static void send_reset(struct net *net, struct sk_buff *oldskb)
         dst = ip6_route_output(net, NULL, &fl);
         if (dst == NULL)
                 return;
-        if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0))
+        if (dst->error || xfrm_lookup(net, &dst, &fl, NULL, 0))
                 return;
 
         hh_len = (dst->dev->hard_header_len + 15)&~15;
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 07f0b76e7427..97c17fdd6f75 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -132,7 +132,7 @@ static struct snmp_mib snmp6_udplite6_list[] = {
 
 static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
 {
-        static char name[32];
+        char name[32];
         int i;
 
         /* print by name -- deprecated items */
@@ -144,7 +144,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
                 p = icmp6type2name[icmptype];
                 if (!p) /* don't print un-named types here */
                         continue;
-                (void) snprintf(name, sizeof(name)-1, "Icmp6%s%s",
+                snprintf(name, sizeof(name), "Icmp6%s%s",
                         i & 0x100 ? "Out" : "In", p);
                 seq_printf(seq, "%-32s\t%lu\n", name,
                         snmp_fold_field(mib, i));
@@ -157,7 +157,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, void **mib)
                 val = snmp_fold_field(mib, i);
                 if (!val)
                         continue;
-                (void) snprintf(name, sizeof(name)-1, "Icmp6%sType%u",
+                snprintf(name, sizeof(name), "Icmp6%sType%u",
                         i & 0x100 ?  "Out" : "In", i & 0xff);
                 seq_printf(seq, "%-32s\t%lu\n", name, val);
         }
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 2ba04d41dc25..61f6827e5906 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -860,7 +860,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
+        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
+        if (err < 0) {
                 if (err == -EREMOTE)
                         err = ip6_dst_blackhole(sk, &dst, &fl);
                 if (err < 0)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 4d40dc214b2d..9da1ece466a2 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -108,7 +108,6 @@ static struct dst_ops ip6_dst_ops_template = {
         .link_failure           =       ip6_link_failure,
         .update_pmtu            =       ip6_rt_update_pmtu,
         .local_out              =       __ip6_local_out,
-        .entry_size             =       sizeof(struct rt6_info),
         .entries                =       ATOMIC_INIT(0),
 };
 
@@ -122,7 +121,6 @@ static struct dst_ops ip6_dst_blackhole_ops = {
         .destroy                =       ip6_dst_destroy,
         .check                  =       ip6_dst_check,
         .update_pmtu            =       ip6_rt_blackhole_update_pmtu,
-        .entry_size             =       sizeof(struct rt6_info),
         .entries                =       ATOMIC_INIT(0),
 };
 
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index b7a50e968506..d3467e563f02 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -62,8 +62,8 @@
 #define HASH_SIZE  16
 #define HASH(addr) (((__force u32)addr^((__force u32)addr>>4))&0xF)
 
-static int ipip6_fb_tunnel_init(struct net_device *dev);
-static int ipip6_tunnel_init(struct net_device *dev);
+static void ipip6_fb_tunnel_init(struct net_device *dev);
+static void ipip6_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_setup(struct net_device *dev);
 
 static int sit_net_id;
@@ -188,7 +188,8 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
         }
 
         nt = netdev_priv(dev);
-        dev->init = ipip6_tunnel_init;
+        ipip6_tunnel_init(dev);
+
         nt->parms = *parms;
 
         if (parms->i_flags & SIT_ISATAP)
@@ -926,13 +927,17 @@ static int ipip6_tunnel_change_mtu(struct net_device *dev, int new_mtu)
         return 0;
 }
 
+static const struct net_device_ops ipip6_netdev_ops = {
+        .ndo_uninit     = ipip6_tunnel_uninit,
+        .ndo_start_xmit = ipip6_tunnel_xmit,
+        .ndo_do_ioctl   = ipip6_tunnel_ioctl,
+        .ndo_change_mtu = ipip6_tunnel_change_mtu,
+};
+
 static void ipip6_tunnel_setup(struct net_device *dev)
 {
-        dev->uninit             = ipip6_tunnel_uninit;
+        dev->netdev_ops         = &ipip6_netdev_ops;
         dev->destructor         = free_netdev;
-        dev->hard_start_xmit    = ipip6_tunnel_xmit;
-        dev->do_ioctl           = ipip6_tunnel_ioctl;
-        dev->change_mtu         = ipip6_tunnel_change_mtu;
 
         dev->type               = ARPHRD_SIT;
         dev->hard_header_len    = LL_MAX_HEADER + sizeof(struct iphdr);
@@ -943,11 +948,9 @@ static void ipip6_tunnel_setup(struct net_device *dev)
         dev->features           |= NETIF_F_NETNS_LOCAL;
 }
 
-static int ipip6_tunnel_init(struct net_device *dev)
+static void ipip6_tunnel_init(struct net_device *dev)
 {
-        struct ip_tunnel *tunnel;
-
-        tunnel = netdev_priv(dev);
+        struct ip_tunnel *tunnel = netdev_priv(dev);
 
         tunnel->dev = dev;
         strcpy(tunnel->parms.name, dev->name);
@@ -956,11 +959,9 @@ static int ipip6_tunnel_init(struct net_device *dev)
         memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
 
         ipip6_tunnel_bind_dev(dev);
-
-        return 0;
 }
 
-static int ipip6_fb_tunnel_init(struct net_device *dev)
+static void ipip6_fb_tunnel_init(struct net_device *dev)
 {
         struct ip_tunnel *tunnel = netdev_priv(dev);
         struct iphdr *iph = &tunnel->parms.iph;
@@ -977,7 +978,6 @@ static int ipip6_fb_tunnel_init(struct net_device *dev)
 
         dev_hold(dev);
         sitn->tunnels_wc[0]     = tunnel;
-        return 0;
 }
 
 static struct xfrm_tunnel sit_handler = {
@@ -1025,16 +1025,17 @@ static int sit_init_net(struct net *net)
                 err = -ENOMEM;
                 goto err_alloc_dev;
         }
-
-        sitn->fb_tunnel_dev->init = ipip6_fb_tunnel_init;
         dev_net_set(sitn->fb_tunnel_dev, net);
 
+        ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+
         if ((err = register_netdev(sitn->fb_tunnel_dev)))
                 goto err_reg_dev;
 
         return 0;
 
 err_reg_dev:
+        dev_put(sitn->fb_tunnel_dev);
         free_netdev(sitn->fb_tunnel_dev);
 err_alloc_dev:
         /* nothing */
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 676c80b5b14b..711175e0571f 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -259,7 +259,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
                 if (final_p)
                         ipv6_addr_copy(&fl.fl6_dst, final_p);
-                if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+                if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                         goto out_free;
         }
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 984276463a8d..8702b06cb60a 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -260,7 +260,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
+        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
+        if (err < 0) {
                 if (err == -EREMOTE)
                         err = ip6_dst_blackhole(sk, &dst, &fl);
                 if (err < 0)
@@ -390,7 +391,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                 goto out;
                         }
 
-                        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
+                        if ((err = xfrm_lookup(net, &dst, &fl, sk, 0)) < 0) {
                                 sk->sk_err_soft = -err;
                                 goto out;
                         }
@@ -492,7 +493,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
                 goto done;
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+        if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                 goto done;
 
         skb = tcp_make_synack(sk, dst, req);
@@ -501,7 +502,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
 
                 th->check = tcp_v6_check(th, skb->len,
                                          &treq->loc_addr, &treq->rmt_addr,
-                                         csum_partial((char *)th, skb->len, skb->csum));
+                                         csum_partial(th, skb->len, skb->csum));
 
                 ipv6_addr_copy(&fl.fl6_dst, &treq->rmt_addr);
                 err = ip6_xmit(sk, skb, &fl, opt, 0);
@@ -915,7 +916,7 @@ static void tcp_v6_send_check(struct sock *sk, int len, struct sk_buff *skb)
                 skb->csum_offset = offsetof(struct tcphdr, check);
         } else {
                 th->check = csum_ipv6_magic(&np->saddr, &np->daddr, len, IPPROTO_TCP,
-                                            csum_partial((char *)th, th->doff<<2,
+                                            csum_partial(th, th->doff<<2,
                                                          skb->csum));
         }
 }
@@ -997,7 +998,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
         }
 #endif
 
-        buff->csum = csum_partial((char *)t1, tot_len, 0);
+        buff->csum = csum_partial(t1, tot_len, 0);
 
         memset(&fl, 0, sizeof(fl));
         ipv6_addr_copy(&fl.fl6_dst, &ipv6_hdr(skb)->saddr);
@@ -1018,7 +1019,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
          * namespace
          */
         if (!ip6_dst_lookup(ctl_sk, &buff->dst, &fl)) {
-                if (xfrm_lookup(&buff->dst, &fl, NULL, 0) >= 0) {
+                if (xfrm_lookup(net, &buff->dst, &fl, NULL, 0) >= 0) {
                         ip6_xmit(ctl_sk, buff, &fl, NULL, 0);
                         TCP_INC_STATS_BH(net, TCP_MIB_OUTSEGS);
                         if (rst)
@@ -1316,7 +1317,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                 if (final_p)
                         ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-                if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
+                if ((xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                         goto out;
         }
 
@@ -1829,7 +1830,7 @@ static int tcp_v6_init_sock(struct sock *sk)
         sk->sk_sndbuf = sysctl_tcp_wmem[1];
         sk->sk_rcvbuf = sysctl_tcp_rmem[1];
 
-        atomic_inc(&tcp_sockets_allocated);
+        percpu_counter_inc(&tcp_sockets_allocated);
 
         return 0;
 }
@@ -2043,6 +2044,7 @@ struct proto tcpv6_prot = {
         .sysctl_rmem            = sysctl_tcp_rmem,
         .max_header             = MAX_TCP_HEADER,
         .obj_size               = sizeof(struct tcp6_sock),
+        .slab_flags             = SLAB_DESTROY_BY_RCU,
         .twsk_prot              = &tcp6_timewait_sock_ops,
         .rsk_prot               = &tcp6_request_sock_ops,
         .h.hashinfo             = &tcp_hashinfo,
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 32d914db6c4f..38390dd19636 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -98,7 +98,7 @@ static struct sock *__udp6_lib_lookup(struct net *net,
                                       int dif, struct udp_table *udptable)
 {
         struct sock *sk, *result;
-        struct hlist_node *node, *next;
+        struct hlist_nulls_node *node;
         unsigned short hnum = ntohs(dport);
         unsigned int hash = udp_hashfn(net, hnum);
         struct udp_hslot *hslot = &udptable->hash[hash];
@@ -108,19 +108,21 @@ static struct sock *__udp6_lib_lookup(struct net *net,
 begin:
         result = NULL;
         badness = -1;
-        sk_for_each_rcu_safenext(sk, node, &hslot->head, next) {
-                /*
-                 * lockless reader, and SLAB_DESTROY_BY_RCU items:
-                 * We must check this item was not moved to another chain
-                 */
-                if (udp_hashfn(net, sk->sk_hash) != hash)
-                        goto begin;
+        sk_nulls_for_each_rcu(sk, node, &hslot->head) {
                 score = compute_score(sk, net, hnum, saddr, sport, daddr, dport, dif);
                 if (score > badness) {
                         result = sk;
                         badness = score;
                 }
         }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != hash)
+                goto begin;
+
         if (result) {
                 if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
                         result = NULL;
@@ -165,6 +167,7 @@ int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
         int peeked;
         int err;
         int is_udplite = IS_UDPLITE(sk);
+        int is_udp4;
 
         if (addr_len)
                 *addr_len=sizeof(struct sockaddr_in6);
@@ -185,6 +188,8 @@ try_again:
         else if (copied < ulen)
                 msg->msg_flags |= MSG_TRUNC;
 
+        is_udp4 = (skb->protocol == htons(ETH_P_IP));
+
         /*
          * If checksum is needed at all, try to do it while copying the
          * data.  If the data is truncated, or if we only want a partial
@@ -207,9 +212,14 @@ try_again:
         if (err)
                 goto out_free;
 
-        if (!peeked)
-                UDP6_INC_STATS_USER(sock_net(sk),
-                                UDP_MIB_INDATAGRAMS, is_udplite);
+        if (!peeked) {
+                if (is_udp4)
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INDATAGRAMS, is_udplite);
+                else
+                        UDP6_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INDATAGRAMS, is_udplite);
+        }
 
         sock_recv_timestamp(msg, sk, skb);
 
@@ -223,7 +233,7 @@ try_again:
                 sin6->sin6_flowinfo = 0;
                 sin6->sin6_scope_id = 0;
 
-                if (skb->protocol == htons(ETH_P_IP))
+                if (is_udp4)
                         ipv6_addr_set(&sin6->sin6_addr, 0, 0,
                                       htonl(0xffff), ip_hdr(skb)->saddr);
                 else {
@@ -234,7 +244,7 @@ try_again:
                 }
 
         }
-        if (skb->protocol == htons(ETH_P_IP)) {
+        if (is_udp4) {
                 if (inet->cmsg_flags)
                         ip_cmsg_recv(msg, skb);
         } else {
@@ -255,8 +265,14 @@ out:
 
 csum_copy_err:
         lock_sock(sk);
-        if (!skb_kill_datagram(sk, skb, flags))
-                UDP6_INC_STATS_USER(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+        if (!skb_kill_datagram(sk, skb, flags)) {
+                if (is_udp4)
+                        UDP_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INERRORS, is_udplite);
+                else
+                        UDP6_INC_STATS_USER(sock_net(sk),
+                                        UDP_MIB_INERRORS, is_udplite);
+        }
         release_sock(sk);
 
         if (flags & MSG_DONTWAIT)
@@ -355,19 +371,19 @@ drop:
         return -1;
 }
 
-static struct sock *udp_v6_mcast_next(struct sock *sk,
+static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
                                       __be16 loc_port, struct in6_addr *loc_addr,
                                       __be16 rmt_port, struct in6_addr *rmt_addr,
                                       int dif)
 {
-        struct hlist_node *node;
+        struct hlist_nulls_node *node;
         struct sock *s = sk;
         unsigned short num = ntohs(loc_port);
 
-        sk_for_each_from(s, node) {
+        sk_nulls_for_each_from(s, node) {
                 struct inet_sock *inet = inet_sk(s);
 
-                if (sock_net(s) != sock_net(sk))
+                if (!net_eq(sock_net(s), net))
                         continue;
 
                 if (s->sk_hash == num && s->sk_family == PF_INET6) {
@@ -409,16 +425,16 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
         int dif;
 
         spin_lock(&hslot->lock);
-        sk = sk_head(&hslot->head);
+        sk = sk_nulls_head(&hslot->head);
         dif = inet6_iif(skb);
-        sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
+        sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
         if (!sk) {
                 kfree_skb(skb);
                 goto out;
         }
 
         sk2 = sk;
-        while ((sk2 = udp_v6_mcast_next(sk_next(sk2), uh->dest, daddr,
+        while ((sk2 = udp_v6_mcast_next(net, sk_nulls_next(sk2), uh->dest, daddr,
                                         uh->source, saddr, dif))) {
                 struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
                 if (buff) {
@@ -833,7 +849,8 @@ do_udp_sendmsg:
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = __xfrm_lookup(&dst, &fl, sk, XFRM_LOOKUP_WAIT)) < 0) {
+        err = __xfrm_lookup(sock_net(sk), &dst, &fl, sk, XFRM_LOOKUP_WAIT);
+        if (err < 0) {
                 if (err == -EREMOTE)
                         err = ip6_dst_blackhole(sk, &dst, &fl);
                 if (err < 0)
diff --git a/net/ipv6/xfrm6_input.c b/net/ipv6/xfrm6_input.c
index a71c7ddcb41e..9084582d236b 100644
--- a/net/ipv6/xfrm6_input.c
+++ b/net/ipv6/xfrm6_input.c
@@ -58,6 +58,7 @@ EXPORT_SYMBOL(xfrm6_rcv);
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                      xfrm_address_t *saddr, u8 proto)
 {
+        struct net *net = dev_net(skb->dev);
         struct xfrm_state *x = NULL;
         int i = 0;
 
@@ -67,7 +68,7 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
 
                 sp = secpath_dup(skb->sp);
                 if (!sp) {
-                        XFRM_INC_STATS(LINUX_MIB_XFRMINERROR);
+                        XFRM_INC_STATS(net, LINUX_MIB_XFRMINERROR);
                         goto drop;
                 }
                 if (skb->sp)
@@ -76,7 +77,7 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
         }
 
         if (1 + skb->sp->len == XFRM_MAX_DEPTH) {
-                XFRM_INC_STATS(LINUX_MIB_XFRMINBUFFERERROR);
+                XFRM_INC_STATS(net, LINUX_MIB_XFRMINBUFFERERROR);
                 goto drop;
         }
 
@@ -100,7 +101,7 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
                         break;
                 }
 
-                x = xfrm_state_lookup_byaddr(dst, src, proto, AF_INET6);
+                x = xfrm_state_lookup_byaddr(net, dst, src, proto, AF_INET6);
                 if (!x)
                         continue;
 
@@ -122,7 +123,7 @@ int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
         }
 
         if (!x) {
-                XFRM_INC_STATS(LINUX_MIB_XFRMINNOSTATES);
+                XFRM_INC_STATS(net, LINUX_MIB_XFRMINNOSTATES);
                 xfrm_audit_state_notfound_simple(skb, AF_INET6);
                 goto drop;
         }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 604bc0a96c05..97ab068e8ccc 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -27,7 +27,8 @@
 static struct dst_ops xfrm6_dst_ops;
 static struct xfrm_policy_afinfo xfrm6_policy_afinfo;
 
-static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
+static struct dst_entry *xfrm6_dst_lookup(struct net *net, int tos,
+                                          xfrm_address_t *saddr,
                                           xfrm_address_t *daddr)
 {
         struct flowi fl = {};
@@ -38,7 +39,7 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
         if (saddr)
                 memcpy(&fl.fl6_src, saddr, sizeof(fl.fl6_src));
 
-        dst = ip6_route_output(&init_net, NULL, &fl);
+        dst = ip6_route_output(net, NULL, &fl);
 
         err = dst->error;
         if (dst->error) {
@@ -49,12 +50,13 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
         return dst;
 }
 
-static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
+static int xfrm6_get_saddr(struct net *net,
+                           xfrm_address_t *saddr, xfrm_address_t *daddr)
 {
         struct dst_entry *dst;
         struct net_device *dev;
 
-        dst = xfrm6_dst_lookup(0, NULL, daddr);
+        dst = xfrm6_dst_lookup(net, 0, NULL, daddr);
         if (IS_ERR(dst))
                 return -EHOSTUNREACH;
 
@@ -220,7 +222,7 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
 
 static inline int xfrm6_garbage_collect(struct dst_ops *ops)
 {
-        xfrm6_policy_afinfo.garbage_collect();
+        xfrm6_policy_afinfo.garbage_collect(&init_net);
         return (atomic_read(&xfrm6_dst_ops.entries) > xfrm6_dst_ops.gc_thresh*2);
 }
 
@@ -277,7 +279,6 @@ static struct dst_ops xfrm6_dst_ops = {
         .ifdown =               xfrm6_dst_ifdown,
         .local_out =            __ip6_local_out,
         .gc_thresh =            1024,
-        .entry_size =           sizeof(struct xfrm_dst),
         .entries =              ATOMIC_INIT(0),
 };
 
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index 89884a4f23aa..0e685b05496e 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -19,8 +19,6 @@
 #include <net/ipv6.h>
 #include <net/addrconf.h>
 
-static struct xfrm_state_afinfo xfrm6_state_afinfo;
-
 static void
 __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
                      struct xfrm_tmpl *tmpl,
@@ -34,6 +32,7 @@ __xfrm6_init_tempsel(struct xfrm_state *x, struct flowi *fl,
         x->sel.dport_mask = htons(0xffff);
         x->sel.sport = xfrm_flowi_sport(fl);
         x->sel.sport_mask = htons(0xffff);
+        x->sel.family = AF_INET6;
         x->sel.prefixlen_d = 128;
         x->sel.prefixlen_s = 128;
         x->sel.proto = fl->proto;