4 files changed, 24 insertions, 4 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 5ab9973571ef..87f688857ade 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -776,6 +776,7 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
         struct inet6_dev *idev = ifp->idev;
         struct in6_addr addr, *tmpaddr;
         unsigned long tmp_prefered_lft, tmp_valid_lft, tmp_cstamp, tmp_tstamp;
+        unsigned long regen_advance;
         int tmp_plen;
         int ret = 0;
         int max_addresses;
@@ -836,8 +837,23 @@ retry:
         tmp_tstamp = ifp->tstamp;
         spin_unlock_bh(&ifp->lock);
 
+        regen_advance = idev->cnf.regen_max_retry *
+                        idev->cnf.dad_transmits *
+                        idev->nd_parms->retrans_time / HZ;
         write_unlock(&idev->lock);
 
+        /* A temporary address is created only if this calculated Preferred
+         * Lifetime is greater than REGEN_ADVANCE time units.  In particular,
+         * an implementation must not create a temporary address with a zero
+         * Preferred Lifetime.
+         */
+        if (tmp_prefered_lft <= regen_advance) {
+                in6_ifa_put(ifp);
+                in6_dev_put(idev);
+                ret = -1;
+                goto out;
+        }
+
         addr_flags = IFA_F_TEMPORARY;
         /* set in addrconf_prefix_rcv() */
         if (ifp->flags & IFA_F_OPTIMISTIC)
@@ -1834,6 +1850,9 @@ ok:
                                  * lifetimes of an existing temporary address
                                  * when processing a Prefix Information Option.
                                  */
+                                if (ifp != ift->ifpub)
+                                        continue;
+
                                 spin_lock(&ift->lock);
                                 flags = ift->flags;
                                 if (ift->valid_lft > valid_lft &&
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 63309d10df3a..227ce3d2339d 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -440,10 +440,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         }
 
         if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6))
-                goto out;
+                goto out_dst_release;
 
         if (ip6_dst_lookup(sk, &dst2, &fl))
-                goto out;
+                goto out_dst_release;
 
         err = xfrm_lookup(&dst2, &fl, sk, XFRM_LOOKUP_ICMP);
         if (err == -ENOENT) {
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 7e36269826ba..43a617e2268b 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -234,8 +234,7 @@ int ip6_mc_input(struct sk_buff *skb)
         IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INMCASTPKTS);
 
         hdr = ipv6_hdr(skb);
-        deliver = unlikely(skb->dev->flags & (IFF_PROMISC|IFF_ALLMULTI)) ||
-            ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL);
+        deliver = ipv6_chk_mcast_addr(skb->dev, &hdr->daddr, NULL);
 
         /*
          *      IPv6 multicast router mode isnt currently supported.
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index ad8066200f9d..9e5f305b2022 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -171,7 +171,9 @@ static __inline__ void fq_kill(struct nf_ct_frag6_queue *fq)
 
 static void nf_ct_frag6_evictor(void)
 {
+        local_bh_disable();
         inet_frag_evictor(&nf_init_frags, &nf_frags);
+        local_bh_enable();
 }
 
 static void nf_ct_frag6_expire(unsigned long data)