9 files changed, 70 insertions, 28 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 7196ac2f2d16..7744a2592693 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3076,7 +3076,7 @@ static void inet6_prefix_notify(int event, struct inet6_dev *idev,
         netlink_broadcast(rtnl, skb, 0, RTMGRP_IPV6_PREFIX, GFP_ATOMIC);
 }
 
-static struct rtnetlink_link inet6_rtnetlink_table[RTM_MAX - RTM_BASE + 1] = {
+static struct rtnetlink_link inet6_rtnetlink_table[RTM_NR_MSGTYPES] = {
         [RTM_GETLINK - RTM_BASE] = { .dumpit    = inet6_dump_ifinfo, },
         [RTM_NEWADDR - RTM_BASE] = { .doit      = inet6_rtm_newaddr, },
         [RTM_DELADDR - RTM_BASE] = { .doit      = inet6_rtm_deladdr, },
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 768b11703daf..2b193e3df49a 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -28,7 +28,6 @@
 #include <linux/socket.h>
 #include <linux/in.h>
 #include <linux/kernel.h>
-#include <linux/major.h>
 #include <linux/sched.h>
 #include <linux/timer.h>
 #include <linux/string.h>
@@ -88,6 +87,7 @@ int sysctl_ipv6_bindv6only;
 
 #ifdef INET_REFCNT_DEBUG
 atomic_t inet6_sock_nr;
+EXPORT_SYMBOL(inet6_sock_nr);
 #endif
 
 /* The inetsw table contains everything that inet_create needs to
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index 6dda815c013f..315bc1fbec3f 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -41,8 +41,8 @@ int ipv6_ext_hdr(u8 nexthdr)
  * when Linux implements ESP (and maybe AUTH) headers.
  * --AK
  *
- * This function parses (probably truncated) exthdr set "hdr"
- * of length "len". "nexthdrp" initially points to some place,
+ * This function parses (probably truncated) exthdr set "hdr".
+ * "nexthdrp" initially points to some place,
  * where type of the first header can be found.
  *
  * It skips all well-known exthdrs, and returns pointer to the start
@@ -63,7 +63,7 @@ int ipv6_ext_hdr(u8 nexthdr)
  * --ANK (980726)
  */
 
-int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp, int len)
+int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp)
 {
         u8 nexthdr = *nexthdrp;
 
@@ -71,13 +71,11 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp, int len
                 struct ipv6_opt_hdr _hdr, *hp;
                 int hdrlen;
 
-                if (len < (int)sizeof(struct ipv6_opt_hdr))
-                        return -1;
                 if (nexthdr == NEXTHDR_NONE)
                         return -1;
                 hp = skb_header_pointer(skb, start, sizeof(_hdr), &_hdr);
                 if (hp == NULL)
-                        BUG();
+                        return -1;
                 if (nexthdr == NEXTHDR_FRAGMENT) {
                         unsigned short _frag_off, *fp;
                         fp = skb_header_pointer(skb,
@@ -97,7 +95,6 @@ int ipv6_skip_exthdr(const struct sk_buff *skb, int start, u8 *nexthdrp, int len
                         hdrlen = ipv6_optlen(hp); 
 
                 nexthdr = hp->nexthdr;
-                len -= hdrlen;
                 start += hdrlen;
         }
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 87b9082ceab2..8e0f569b883e 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -135,7 +135,7 @@ static int is_ineligible(struct sk_buff *skb)
         if (len < 0)
                 return 1;
 
-        ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr, len);
+        ptr = ipv6_skip_exthdr(skb, ptr, &nexthdr);
         if (ptr < 0)
                 return 0;
         if (nexthdr == IPPROTO_ICMPV6) {
@@ -514,7 +514,7 @@ static void icmpv6_notify(struct sk_buff *skb, int type, int code, u32 info)
         nexthdr = ((struct ipv6hdr *)skb->data)->nexthdr;
         if (ipv6_ext_hdr(nexthdr)) {
                 /* now skip over extension headers */
-                inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr, skb->len - sizeof(struct ipv6hdr));
+                inner_offset = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr);
                 if (inner_offset<0)
                         return;
         } else {
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index c54830b89593..750943e2d34e 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -549,20 +549,18 @@ ipq_rcv_skb(struct sk_buff *skb)
 static void
 ipq_rcv_sk(struct sock *sk, int len)
 {
-        do {
-                struct sk_buff *skb;
+        struct sk_buff *skb;
+        unsigned int qlen;
 
-                if (down_trylock(&ipqnl_sem))
-                        return;
+        down(&ipqnl_sem);
                         
-                while ((skb = skb_dequeue(&sk->sk_receive_queue)) != NULL) {
-                        ipq_rcv_skb(skb);
-                        kfree_skb(skb);
-                }
+        for (qlen = skb_queue_len(&sk->sk_receive_queue); qlen; qlen--) {
+                skb = skb_dequeue(&sk->sk_receive_queue);
+                ipq_rcv_skb(skb);
+                kfree_skb(skb);
+        }
                 
-                up(&ipqnl_sem);
-
-        } while (ipqnl && ipqnl->sk_receive_queue.qlen);
+        up(&ipqnl_sem);
 }
 
 static int
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1352c1d9bf4d..617645bc5ed6 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -455,11 +455,11 @@ csum_copy_err:
 static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                                      struct raw6_sock *rp)
 {
-        struct inet_sock *inet = inet_sk(sk);
         struct sk_buff *skb;
         int err = 0;
         int offset;
         int len;
+        int total_len;
         u32 tmp_csum;
         u16 csum;
 
@@ -470,7 +470,8 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
                 goto out;
 
         offset = rp->offset;
-        if (offset >= inet->cork.length - 1) {
+        total_len = inet_sk(sk)->cork.length - (skb->nh.raw - skb->data);
+        if (offset >= total_len - 1) {
                 err = -EINVAL;
                 ip6_flush_pending_frames(sk);
                 goto out;
@@ -514,7 +515,7 @@ static int rawv6_push_pending_frames(struct sock *sk, struct flowi *fl,
 
         tmp_csum = csum_ipv6_magic(&fl->fl6_src,
                                    &fl->fl6_dst,
-                                   inet->cork.length, fl->proto, tmp_csum);
+                                   total_len, fl->proto, tmp_csum);
 
         if (tmp_csum == 0)
                 tmp_csum = -1;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 183802902c02..3bf8a0254f81 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2005,7 +2005,7 @@ ctl_table ipv6_route_table[] = {
                 .procname       =       "flush",
                 .data           =       &flush_delay,
                 .maxlen         =       sizeof(int),
-                .mode           =       0644,
+                .mode           =       0200,
                 .proc_handler   =       &ipv6_sysctl_rtcache_flush
         },
         {
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4760c85e19db..0f69e800a0ad 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -139,9 +139,12 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                 int rover;
 
                 spin_lock(&tcp_portalloc_lock);
-                rover = tcp_port_rover;
+                if (tcp_port_rover < low)
+                        rover = low;
+                else
+                        rover = tcp_port_rover;
                 do {    rover++;
-                        if ((rover < low) || (rover > high))
+                        if (rover > high)
                                 rover = low;
                         head = &tcp_bhash[tcp_bhashfn(rover)];
                         spin_lock(&head->lock);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8a4f37de4d2d..4429b1a1fe5f 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -11,7 +11,11 @@
  * 
  */
 
+#include <asm/bug.h>
+#include <linux/compiler.h>
 #include <linux/config.h>
+#include <linux/netdevice.h>
+#include <net/addrconf.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -166,6 +170,8 @@ __xfrm6_bundle_create(struct xfrm_policy *policy, struct xfrm_state **xfrm, int
                 memcpy(&x->u.rt6.rt6i_gateway, &rt0->rt6i_gateway, sizeof(x->u.rt6.rt6i_gateway)); 
                 x->u.rt6.rt6i_dst      = rt0->rt6i_dst;
                 x->u.rt6.rt6i_src      = rt0->rt6i_src; 
+                x->u.rt6.rt6i_idev     = rt0->rt6i_idev;
+                in6_dev_hold(rt0->rt6i_idev);
                 header_len -= x->u.dst.xfrm->props.header_len;
                 trailer_len -= x->u.dst.xfrm->props.trailer_len;
         }
@@ -251,11 +257,48 @@ static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
         path->ops->update_pmtu(path, mtu);
 }
 
+static void xfrm6_dst_destroy(struct dst_entry *dst)
+{
+        struct xfrm_dst *xdst = (struct xfrm_dst *)dst;
+
+        if (likely(xdst->u.rt6.rt6i_idev))
+                in6_dev_put(xdst->u.rt6.rt6i_idev);
+        xfrm_dst_destroy(xdst);
+}
+
+static void xfrm6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
+                             int unregister)
+{
+        struct xfrm_dst *xdst;
+
+        if (!unregister)
+                return;
+
+        xdst = (struct xfrm_dst *)dst;
+        if (xdst->u.rt6.rt6i_idev->dev == dev) {
+                struct inet6_dev *loopback_idev = in6_dev_get(&loopback_dev);
+                BUG_ON(!loopback_idev);
+
+                do {
+                        in6_dev_put(xdst->u.rt6.rt6i_idev);
+                        xdst->u.rt6.rt6i_idev = loopback_idev;
+                        in6_dev_hold(loopback_idev);
+                        xdst = (struct xfrm_dst *)xdst->u.dst.child;
+                } while (xdst->u.dst.xfrm);
+
+                __in6_dev_put(loopback_idev);
+        }
+
+        xfrm_dst_ifdown(dst, dev);
+}
+
 static struct dst_ops xfrm6_dst_ops = {
         .family =               AF_INET6,
         .protocol =             __constant_htons(ETH_P_IPV6),
         .gc =                   xfrm6_garbage_collect,
         .update_pmtu =          xfrm6_update_pmtu,
+        .destroy =              xfrm6_dst_destroy,
+        .ifdown =               xfrm6_dst_ifdown,
         .gc_thresh =            1024,
         .entry_size =           sizeof(struct xfrm_dst),
 };