20 files changed, 137 insertions, 131 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index eea9542728ca..ff7ae05f72e1 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2986,9 +2986,8 @@ static void if6_seq_stop(struct seq_file *seq, void *v)
 static int if6_seq_show(struct seq_file *seq, void *v)
 {
         struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
-        seq_printf(seq,
-                   NIP6_SEQFMT " %02x %02x %02x %02x %8s\n",
-                   NIP6(ifp->addr),
+        seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
+                   &ifp->addr,
                    ifp->idev->dev->ifindex,
                    ifp->prefix_len,
                    ifp->scope,
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 08909039d87b..6ff73c4c126a 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -186,10 +186,8 @@ u32 ipv6_addr_label(struct net *net,
         label = p ? p->label : IPV6_ADDR_LABEL_DEFAULT;
         rcu_read_unlock();
 
-        ADDRLABEL(KERN_DEBUG "%s(addr=" NIP6_FMT ", type=%d, ifindex=%d) => %08x\n",
-                        __func__,
-                        NIP6(*addr), type, ifindex,
-                        label);
+        ADDRLABEL(KERN_DEBUG "%s(addr=%pI6, type=%d, ifindex=%d) => %08x\n",
+                  __func__, addr, type, ifindex, label);
 
         return label;
 }
@@ -203,11 +201,8 @@ static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net,
         struct ip6addrlbl_entry *newp;
         int addrtype;
 
-        ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d, label=%u)\n",
-                        __func__,
-                        NIP6(*prefix), prefixlen,
-                        ifindex,
-                        (unsigned int)label);
+        ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d, label=%u)\n",
+                  __func__, prefix, prefixlen, ifindex, (unsigned int)label);
 
         addrtype = ipv6_addr_type(prefix) & (IPV6_ADDR_MAPPED | IPV6_ADDR_COMPATv4 | IPV6_ADDR_LOOPBACK);
 
@@ -294,12 +289,9 @@ static int ip6addrlbl_add(struct net *net,
         struct ip6addrlbl_entry *newp;
         int ret = 0;
 
-        ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d, label=%u, replace=%d)\n",
-                        __func__,
-                        NIP6(*prefix), prefixlen,
-                        ifindex,
-                        (unsigned int)label,
-                        replace);
+        ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d, label=%u, replace=%d)\n",
+                  __func__, prefix, prefixlen, ifindex, (unsigned int)label,
+                  replace);
 
         newp = ip6addrlbl_alloc(net, prefix, prefixlen, ifindex, label);
         if (IS_ERR(newp))
@@ -321,10 +313,8 @@ static int __ip6addrlbl_del(struct net *net,
         struct hlist_node *pos, *n;
         int ret = -ESRCH;
 
-        ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d)\n",
-                        __func__,
-                        NIP6(*prefix), prefixlen,
-                        ifindex);
+        ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
+                  __func__, prefix, prefixlen, ifindex);
 
         hlist_for_each_entry_safe(p, pos, n, &ip6addrlbl_table.head, list) {
                 if (p->prefixlen == prefixlen &&
@@ -347,10 +337,8 @@ static int ip6addrlbl_del(struct net *net,
         struct in6_addr prefix_buf;
         int ret;
 
-        ADDRLABEL(KERN_DEBUG "%s(prefix=" NIP6_FMT ", prefixlen=%d, ifindex=%d)\n",
-                        __func__,
-                        NIP6(*prefix), prefixlen,
-                        ifindex);
+        ADDRLABEL(KERN_DEBUG "%s(prefix=%pI6, prefixlen=%d, ifindex=%d)\n",
+                  __func__, prefix, prefixlen, ifindex);
 
         ipv6_addr_prefix(&prefix_buf, prefix, prefixlen);
         spin_lock(&ip6addrlbl_table.lock);
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index 2ff0c8233e47..7a8a01369e5c 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -419,8 +419,8 @@ static void ah6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (!x)
                 return;
 
-        NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/" NIP6_FMT "\n",
-                 ntohl(ah->spi), NIP6(iph->daddr));
+        NETDEBUG(KERN_DEBUG "pmtu discovery on SA AH/%08x/%pI6\n",
+                 ntohl(ah->spi), &iph->daddr);
 
         xfrm_state_put(x);
 }
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 8336cd81cb4f..1ae58bec1de0 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -512,11 +512,9 @@ static int ac6_seq_show(struct seq_file *seq, void *v)
         struct ifacaddr6 *im = (struct ifacaddr6 *)v;
         struct ac6_iter_state *state = ac6_seq_private(seq);
 
-        seq_printf(seq,
-                   "%-4d %-15s " NIP6_SEQFMT " %5d\n",
+        seq_printf(seq, "%-4d %-15s %pi6 %5d\n",
                    state->dev->ifindex, state->dev->name,
-                   NIP6(im->aca_addr),
-                   im->aca_users);
+                   &im->aca_addr, im->aca_users);
         return 0;
 }
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index b181b08fb761..c02a6308defe 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -367,8 +367,8 @@ static void esp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         x = xfrm_state_lookup((xfrm_address_t *)&iph->daddr, esph->spi, IPPROTO_ESP, AF_INET6);
         if (!x)
                 return;
-        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/" NIP6_FMT "\n",
-                        ntohl(esph->spi), NIP6(iph->daddr));
+        printk(KERN_DEBUG "pmtu discovery on SA ESP/%08x/%pI6\n",
+                        ntohl(esph->spi), &iph->daddr);
         xfrm_state_put(x);
 }
 
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 6bfffec2371c..1c7f400a3cfe 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -219,7 +219,7 @@ static int ipv6_dest_hao(struct sk_buff *skb, int optoff)
 
         if (!(ipv6_addr_type(&hao->addr) & IPV6_ADDR_UNICAST)) {
                 LIMIT_NETDEBUG(
-                        KERN_DEBUG "hao is not an unicast addr: " NIP6_FMT "\n", NIP6(hao->addr));
+                        KERN_DEBUG "hao is not an unicast addr: %pI6\n", &hao->addr);
                 goto discard;
         }
 
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 9b7d19ae5ced..3c2821f9b529 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -646,9 +646,10 @@ static int icmpv6_rcv(struct sk_buff *skb)
         int type;
 
         if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
+                struct sec_path *sp = skb_sec_path(skb);
                 int nh;
 
-                if (!(skb->sp && skb->sp->xvec[skb->sp->len - 1]->props.flags &
+                if (!(sp && sp->xvec[sp->len - 1]->props.flags &
                                  XFRM_STATE_ICMP))
                         goto drop_no_count;
 
@@ -680,8 +681,8 @@ static int icmpv6_rcv(struct sk_buff *skb)
                 skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
                                              IPPROTO_ICMPV6, 0));
                 if (__skb_checksum_complete(skb)) {
-                        LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [" NIP6_FMT " > " NIP6_FMT "]\n",
-                                       NIP6(*saddr), NIP6(*daddr));
+                        LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [%pI6 > %pI6]\n",
+                                       saddr, daddr);
                         goto discard_it;
                 }
         }
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 37a4e777e347..7927a8498d17 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -696,14 +696,14 @@ static int ip6fl_seq_show(struct seq_file *seq, void *v)
         else {
                 struct ip6_flowlabel *fl = v;
                 seq_printf(seq,
-                           "%05X %-1d %-6d %-6d %-6ld %-8ld " NIP6_SEQFMT " %-4d\n",
+                           "%05X %-1d %-6d %-6d %-6ld %-8ld %pi6 %-4d\n",
                            (unsigned)ntohl(fl->label),
                            fl->share,
                            (unsigned)fl->owner,
                            atomic_read(&fl->users),
                            fl->linger/HZ,
                            (long)(fl->expires - jiffies)/HZ,
-                           NIP6(fl->dst),
+                           &fl->dst,
                            fl->opt ? fl->opt->opt_nflen : 0);
         }
         return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index c77db0b95e26..7d92fd97cfb9 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -490,7 +490,7 @@ int ip6_forward(struct sk_buff *skb)
            We don't send redirects to frames decapsulated from IPsec.
          */
         if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
-            !skb->sp) {
+            !skb_sec_path(skb)) {
                 struct in6_addr *target = NULL;
                 struct rt6_info *rt;
                 struct neighbour *n = dst->neighbour;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 182f8a177e7f..c491fb98a5e3 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -297,9 +297,8 @@ static int ipmr_mfc_seq_show(struct seq_file *seq, void *v)
                 const struct mfc6_cache *mfc = v;
                 const struct ipmr_mfc_iter *it = seq->private;
 
-                seq_printf(seq,
-                           NIP6_FMT " " NIP6_FMT " %-3d %8ld %8ld %8ld",
-                           NIP6(mfc->mf6c_mcastgrp), NIP6(mfc->mf6c_origin),
+                seq_printf(seq, "%pI6 %pI6 %-3d %8ld %8ld %8ld",
+                           &mfc->mf6c_mcastgrp, &mfc->mf6c_origin,
                            mfc->mf6c_parent,
                            mfc->mfc_un.res.pkt,
                            mfc->mfc_un.res.bytes,
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 4545e4306862..d4576a9c154f 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -67,8 +67,8 @@ static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (!x)
                 return;
 
-        printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/" NIP6_FMT "\n",
-                        spi, NIP6(iph->daddr));
+        printk(KERN_DEBUG "pmtu discovery on SA IPCOMP/%08x/%pI6\n",
+                        spi, &iph->daddr);
         xfrm_state_put(x);
 }
 
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index d7b3c6d398ae..a76199ecad23 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2430,9 +2430,9 @@ static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
         struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
 
         seq_printf(seq,
-                   "%-4d %-15s " NIP6_SEQFMT " %5d %08X %ld\n",
+                   "%-4d %-15s %pi6 %5d %08X %ld\n",
                    state->dev->ifindex, state->dev->name,
-                   NIP6(im->mca_addr),
+                   &im->mca_addr,
                    im->mca_users, im->mca_flags,
                    (im->mca_flags&MAF_TIMER_RUNNING) ?
                    jiffies_to_clock_t(im->mca_timer.expires-jiffies) : 0);
@@ -2591,10 +2591,10 @@ static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
                            "Source Address", "INC", "EXC");
         } else {
                 seq_printf(seq,
-                           "%3d %6.6s " NIP6_SEQFMT " " NIP6_SEQFMT " %6lu %6lu\n",
+                           "%3d %6.6s %pi6 %pi6 %6lu %6lu\n",
                            state->dev->ifindex, state->dev->name,
-                           NIP6(state->im->mca_addr),
-                           NIP6(psf->sf_addr),
+                           &state->im->mca_addr,
+                           &psf->sf_addr,
                            psf->sf_count[MCAST_INCLUDE],
                            psf->sf_count[MCAST_EXCLUDE]);
         }
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 172438320eec..2a6752dae09d 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -647,11 +647,8 @@ static void ndisc_solicit(struct neighbour *neigh, struct sk_buff *skb)
 
         if ((probes -= neigh->parms->ucast_probes) < 0) {
                 if (!(neigh->nud_state & NUD_VALID)) {
-                        ND_PRINTK1(KERN_DEBUG
-                                   "%s(): trying to ucast probe in NUD_INVALID: "
-                                   NIP6_FMT "\n",
-                                   __func__,
-                                   NIP6(*target));
+                        ND_PRINTK1(KERN_DEBUG "%s(): trying to ucast probe in NUD_INVALID: %pI6\n",
+                                   __func__, target);
                 }
                 ndisc_send_ns(dev, neigh, target, target, saddr);
         } else if ((probes -= neigh->parms->app_probes) < 0) {
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index caa441d09567..02885e8bb69b 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -61,7 +61,7 @@ static void dump_packet(const struct nf_loginfo *info,
         }
 
         /* Max length: 88 "SRC=0000.0000.0000.0000.0000.0000.0000.0000 DST=0000.0000.0000.0000.0000.0000.0000.0000 " */
-        printk("SRC=" NIP6_FMT " DST=" NIP6_FMT " ", NIP6(ih->saddr), NIP6(ih->daddr));
+        printk("SRC=%pI6 DST=%pI6 ", &ih->saddr, &ih->daddr);
 
         /* Max length: 44 "LEN=65535 TC=255 HOPLIMIT=255 FLOWLBL=FFFFF " */
         printk("LEN=%Zu TC=%u HOPLIMIT=%u FLOWLBL=%u ",
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
index e91db16611d9..727b9530448a 100644
--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
@@ -56,9 +56,8 @@ static bool ipv6_invert_tuple(struct nf_conntrack_tuple *tuple,
 static int ipv6_print_tuple(struct seq_file *s,
                             const struct nf_conntrack_tuple *tuple)
 {
-        return seq_printf(s, "src=" NIP6_FMT " dst=" NIP6_FMT " ",
-                          NIP6(*((struct in6_addr *)tuple->src.u3.ip6)),
-                          NIP6(*((struct in6_addr *)tuple->dst.u3.ip6)));
+        return seq_printf(s, "src=%pI6 dst=%pI6 ",
+                          tuple->src.u3.ip6, tuple->dst.u3.ip6);
 }
 
 /*
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 89dc69924340..d69fa462d3f0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2408,19 +2408,16 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 {
         struct seq_file *m = p_arg;
 
-        seq_printf(m, NIP6_SEQFMT " %02x ", NIP6(rt->rt6i_dst.addr),
-                   rt->rt6i_dst.plen);
+        seq_printf(m, "%pi6 %02x ", &rt->rt6i_dst.addr, rt->rt6i_dst.plen);
 
 #ifdef CONFIG_IPV6_SUBTREES
-        seq_printf(m, NIP6_SEQFMT " %02x ", NIP6(rt->rt6i_src.addr),
-                   rt->rt6i_src.plen);
+        seq_printf(m, "%pi6 %02x ", &rt->rt6i_src.addr, rt->rt6i_src.plen);
 #else
         seq_puts(m, "00000000000000000000000000000000 00 ");
 #endif
 
         if (rt->rt6i_nexthop) {
-                seq_printf(m, NIP6_SEQFMT,
-                           NIP6(*((struct in6_addr *)rt->rt6i_nexthop->primary_key)));
+                seq_printf(m, "%pi6", rt->rt6i_nexthop->primary_key);
         } else {
                 seq_puts(m, "00000000000000000000000000000000");
         }
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index b6b356b7912a..984276463a8d 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -872,12 +872,10 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
 
         if (genhash || memcmp(hash_location, newhash, 16) != 0) {
                 if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash %s for "
-                               "(" NIP6_FMT ", %u)->"
-                               "(" NIP6_FMT ", %u)\n",
+                        printk(KERN_INFO "MD5 Hash %s for (%pI6, %u)->(%pI6, %u)\n",
                                genhash ? "failed" : "mismatch",
-                               NIP6(ip6h->saddr), ntohs(th->source),
-                               NIP6(ip6h->daddr), ntohs(th->dest));
+                               &ip6h->saddr, ntohs(th->source),
+                               &ip6h->daddr, ntohs(th->dest));
                 }
                 return 1;
         }
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index e51da8c092fa..32d914db6c4f 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -54,62 +54,89 @@ int udp_v6_get_port(struct sock *sk, unsigned short snum)
         return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal);
 }
 
+static inline int compute_score(struct sock *sk, struct net *net,
+                                unsigned short hnum,
+                                struct in6_addr *saddr, __be16 sport,
+                                struct in6_addr *daddr, __be16 dport,
+                                int dif)
+{
+        int score = -1;
+
+        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+                        sk->sk_family == PF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                struct inet_sock *inet = inet_sk(sk);
+
+                score = 0;
+                if (inet->dport) {
+                        if (inet->dport != sport)
+                                return -1;
+                        score++;
+                }
+                if (!ipv6_addr_any(&np->rcv_saddr)) {
+                        if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
+                                return -1;
+                        score++;
+                }
+                if (!ipv6_addr_any(&np->daddr)) {
+                        if (!ipv6_addr_equal(&np->daddr, saddr))
+                                return -1;
+                        score++;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score++;
+                }
+        }
+        return score;
+}
+
 static struct sock *__udp6_lib_lookup(struct net *net,
                                       struct in6_addr *saddr, __be16 sport,
                                       struct in6_addr *daddr, __be16 dport,
-                                      int dif, struct hlist_head udptable[])
+                                      int dif, struct udp_table *udptable)
 {
-        struct sock *sk, *result = NULL;
-        struct hlist_node *node;
+        struct sock *sk, *result;
+        struct hlist_node *node, *next;
         unsigned short hnum = ntohs(dport);
-        int badness = -1;
-
-        read_lock(&udp_hash_lock);
-        sk_for_each(sk, node, &udptable[udp_hashfn(net, hnum)]) {
-                struct inet_sock *inet = inet_sk(sk);
-
-                if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
-                                sk->sk_family == PF_INET6) {
-                        struct ipv6_pinfo *np = inet6_sk(sk);
-                        int score = 0;
-                        if (inet->dport) {
-                                if (inet->dport != sport)
-                                        continue;
-                                score++;
-                        }
-                        if (!ipv6_addr_any(&np->rcv_saddr)) {
-                                if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
-                                        continue;
-                                score++;
-                        }
-                        if (!ipv6_addr_any(&np->daddr)) {
-                                if (!ipv6_addr_equal(&np->daddr, saddr))
-                                        continue;
-                                score++;
-                        }
-                        if (sk->sk_bound_dev_if) {
-                                if (sk->sk_bound_dev_if != dif)
-                                        continue;
-                                score++;
-                        }
-                        if (score == 4) {
-                                result = sk;
-                                break;
-                        } else if (score > badness) {
-                                result = sk;
-                                badness = score;
-                        }
+        unsigned int hash = udp_hashfn(net, hnum);
+        struct udp_hslot *hslot = &udptable->hash[hash];
+        int score, badness;
+
+        rcu_read_lock();
+begin:
+        result = NULL;
+        badness = -1;
+        sk_for_each_rcu_safenext(sk, node, &hslot->head, next) {
+                /*
+                 * lockless reader, and SLAB_DESTROY_BY_RCU items:
+                 * We must check this item was not moved to another chain
+                 */
+                if (udp_hashfn(net, sk->sk_hash) != hash)
+                        goto begin;
+                score = compute_score(sk, net, hnum, saddr, sport, daddr, dport, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                }
+        }
+        if (result) {
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score(result, net, hnum, saddr, sport,
+                                        daddr, dport, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
                 }
         }
-        if (result)
-                sock_hold(result);
-        read_unlock(&udp_hash_lock);
+        rcu_read_unlock();
         return result;
 }
 
 static struct sock *__udp6_lib_lookup_skb(struct sk_buff *skb,
                                           __be16 sport, __be16 dport,
-                                          struct hlist_head udptable[])
+                                          struct udp_table *udptable)
 {
         struct sock *sk;
         struct ipv6hdr *iph = ipv6_hdr(skb);
@@ -239,7 +266,7 @@ csum_copy_err:
 
 void __udp6_lib_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                     int type, int code, int offset, __be32 info,
-                    struct hlist_head udptable[]                    )
+                    struct udp_table *udptable)
 {
         struct ipv6_pinfo *np;
         struct ipv6hdr *hdr = (struct ipv6hdr*)skb->data;
@@ -275,7 +302,7 @@ static __inline__ void udpv6_err(struct sk_buff *skb,
                                  struct inet6_skb_parm *opt, int type,
                                  int code, int offset, __be32 info     )
 {
-        __udp6_lib_err(skb, opt, type, code, offset, info, udp_hash);
+        __udp6_lib_err(skb, opt, type, code, offset, info, &udp_table);
 }
 
 int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
@@ -374,14 +401,15 @@ static struct sock *udp_v6_mcast_next(struct sock *sk,
  */
 static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                 struct in6_addr *saddr, struct in6_addr *daddr,
-                struct hlist_head udptable[])
+                struct udp_table *udptable)
 {
         struct sock *sk, *sk2;
         const struct udphdr *uh = udp_hdr(skb);
+        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
         int dif;
 
-        read_lock(&udp_hash_lock);
-        sk = sk_head(&udptable[udp_hashfn(net, ntohs(uh->dest))]);
+        spin_lock(&hslot->lock);
+        sk = sk_head(&hslot->head);
         dif = inet6_iif(skb);
         sk = udp_v6_mcast_next(sk, uh->dest, daddr, uh->source, saddr, dif);
         if (!sk) {
@@ -409,7 +437,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                 sk_add_backlog(sk, skb);
         bh_unlock_sock(sk);
 out:
-        read_unlock(&udp_hash_lock);
+        spin_unlock(&hslot->lock);
         return 0;
 }
 
@@ -447,7 +475,7 @@ static inline int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh,
         return 0;
 }
 
-int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
+int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                    int proto)
 {
         struct sock *sk;
@@ -544,7 +572,7 @@ discard:
 
 static __inline__ int udpv6_rcv(struct sk_buff *skb)
 {
-        return __udp6_lib_rcv(skb, udp_hash, IPPROTO_UDP);
+        return __udp6_lib_rcv(skb, &udp_table, IPPROTO_UDP);
 }
 
 /*
@@ -1008,7 +1036,7 @@ int udp6_seq_show(struct seq_file *seq, void *v)
 static struct udp_seq_afinfo udp6_seq_afinfo = {
         .name           = "udp6",
         .family         = AF_INET6,
-        .hashtable      = udp_hash,
+        .udp_table      = &udp_table,
         .seq_fops       = {
                 .owner  =       THIS_MODULE,
         },
@@ -1050,7 +1078,8 @@ struct proto udpv6_prot = {
         .sysctl_wmem       = &sysctl_udp_wmem_min,
         .sysctl_rmem       = &sysctl_udp_rmem_min,
         .obj_size          = sizeof(struct udp6_sock),
-        .h.udp_hash        = udp_hash,
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
+        .h.udp_table       = &udp_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
         .compat_getsockopt = compat_udpv6_getsockopt,
diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
index 92dd7da766d8..23779208c334 100644
--- a/net/ipv6/udp_impl.h
+++ b/net/ipv6/udp_impl.h
@@ -7,9 +7,9 @@
 #include <net/inet_common.h>
 #include <net/transp_v6.h>
 
-extern int      __udp6_lib_rcv(struct sk_buff *, struct hlist_head [], int );
+extern int      __udp6_lib_rcv(struct sk_buff *, struct udp_table *, int );
 extern void     __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *,
-                               int , int , int , __be32 , struct hlist_head []);
+                               int , int , int , __be32 , struct udp_table *);
 
 extern int      udp_v6_get_port(struct sock *sk, unsigned short snum);
 
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index 3cd1a1ac3d6c..ba162a824585 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -15,14 +15,14 @@
 
 static int udplitev6_rcv(struct sk_buff *skb)
 {
-        return __udp6_lib_rcv(skb, udplite_hash, IPPROTO_UDPLITE);
+        return __udp6_lib_rcv(skb, &udplite_table, IPPROTO_UDPLITE);
 }
 
 static void udplitev6_err(struct sk_buff *skb,
                           struct inet6_skb_parm *opt,
                           int type, int code, int offset, __be32 info)
 {
-        __udp6_lib_err(skb, opt, type, code, offset, info, udplite_hash);
+        __udp6_lib_err(skb, opt, type, code, offset, info, &udplite_table);
 }
 
 static struct inet6_protocol udplitev6_protocol = {
@@ -49,7 +49,8 @@ struct proto udplitev6_prot = {
         .unhash            = udp_lib_unhash,
         .get_port          = udp_v6_get_port,
         .obj_size          = sizeof(struct udp6_sock),
-        .h.udp_hash        = udplite_hash,
+        .slab_flags        = SLAB_DESTROY_BY_RCU,
+        .h.udp_table       = &udplite_table,
 #ifdef CONFIG_COMPAT
         .compat_setsockopt = compat_udpv6_setsockopt,
         .compat_getsockopt = compat_udpv6_getsockopt,
@@ -95,7 +96,7 @@ void udplitev6_exit(void)
 static struct udp_seq_afinfo udplite6_seq_afinfo = {
         .name           = "udplite6",
         .family         = AF_INET6,
-        .hashtable      = udplite_hash,
+        .udp_table      = &udplite_table,
         .seq_fops       = {
                 .owner  =       THIS_MODULE,
         },