17 files changed, 514 insertions, 129 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 6d6fb74f3b52..2fea3f4402a0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -123,8 +123,7 @@ DEFINE_RWLOCK(addrconf_lock);
 
 static void addrconf_verify(unsigned long);
 
-static struct timer_list addr_chk_timer =
-                        TIMER_INITIALIZER(addrconf_verify, 0, 0);
+static DEFINE_TIMER(addr_chk_timer, addrconf_verify, 0, 0);
 static DEFINE_SPINLOCK(addrconf_verify_lock);
 
 static void addrconf_join_anycast(struct inet6_ifaddr *ifp);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 01468fab3d3d..cc518405b3e1 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -175,10 +175,8 @@ ipv4_connected:
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
-                dst_release(dst);
+        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
                 goto out;
-        }
 
         /* source address lookup done in ip6_dst_lookup */
 
@@ -390,32 +388,101 @@ int datagram_recv_ctl(struct sock *sk, struct msghdr *msg, struct sk_buff *skb)
                 put_cmsg(msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim);
         }
 
+        if (np->rxopt.bits.rxtclass) {
+                int tclass = (ntohl(*(u32 *)skb->nh.ipv6h) >> 20) & 0xff;
+                put_cmsg(msg, SOL_IPV6, IPV6_TCLASS, sizeof(tclass), &tclass);
+        }
+
         if (np->rxopt.bits.rxflow && (*(u32*)skb->nh.raw & IPV6_FLOWINFO_MASK)) {
                 u32 flowinfo = *(u32*)skb->nh.raw & IPV6_FLOWINFO_MASK;
                 put_cmsg(msg, SOL_IPV6, IPV6_FLOWINFO, sizeof(flowinfo), &flowinfo);
         }
+
+        /* HbH is allowed only once */
         if (np->rxopt.bits.hopopts && opt->hop) {
                 u8 *ptr = skb->nh.raw + opt->hop;
                 put_cmsg(msg, SOL_IPV6, IPV6_HOPOPTS, (ptr[1]+1)<<3, ptr);
         }
-        if (np->rxopt.bits.dstopts && opt->dst0) {
+
+        if (opt->lastopt &&
+            (np->rxopt.bits.dstopts || np->rxopt.bits.srcrt)) {
+                /*
+                 * Silly enough, but we need to reparse in order to
+                 * report extension headers (except for HbH)
+                 * in order.
+                 *
+                 * Also note that IPV6_RECVRTHDRDSTOPTS is NOT 
+                 * (and WILL NOT be) defined because
+                 * IPV6_RECVDSTOPTS is more generic. --yoshfuji
+                 */
+                unsigned int off = sizeof(struct ipv6hdr);
+                u8 nexthdr = skb->nh.ipv6h->nexthdr;
+
+                while (off <= opt->lastopt) {
+                        unsigned len;
+                        u8 *ptr = skb->nh.raw + off;
+
+                        switch(nexthdr) {
+                        case IPPROTO_DSTOPTS:
+                                nexthdr = ptr[0];
+                                len = (ptr[1] + 1) << 3;
+                                if (np->rxopt.bits.dstopts)
+                                        put_cmsg(msg, SOL_IPV6, IPV6_DSTOPTS, len, ptr);
+                                break;
+                        case IPPROTO_ROUTING:
+                                nexthdr = ptr[0];
+                                len = (ptr[1] + 1) << 3;
+                                if (np->rxopt.bits.srcrt)
+                                        put_cmsg(msg, SOL_IPV6, IPV6_RTHDR, len, ptr);
+                                break;
+                        case IPPROTO_AH:
+                                nexthdr = ptr[0];
+                                len = (ptr[1] + 1) << 2;
+                                break;
+                        default:
+                                nexthdr = ptr[0];
+                                len = (ptr[1] + 1) << 3;
+                                break;
+                        }
+
+                        off += len;
+                }
+        }
+
+        /* socket options in old style */
+        if (np->rxopt.bits.rxoinfo) {
+                struct in6_pktinfo src_info;
+
+                src_info.ipi6_ifindex = opt->iif;
+                ipv6_addr_copy(&src_info.ipi6_addr, &skb->nh.ipv6h->daddr);
+                put_cmsg(msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
+        }
+        if (np->rxopt.bits.rxohlim) {
+                int hlim = skb->nh.ipv6h->hop_limit;
+                put_cmsg(msg, SOL_IPV6, IPV6_2292HOPLIMIT, sizeof(hlim), &hlim);
+        }
+        if (np->rxopt.bits.ohopopts && opt->hop) {
+                u8 *ptr = skb->nh.raw + opt->hop;
+                put_cmsg(msg, SOL_IPV6, IPV6_2292HOPOPTS, (ptr[1]+1)<<3, ptr);
+        }
+        if (np->rxopt.bits.odstopts && opt->dst0) {
                 u8 *ptr = skb->nh.raw + opt->dst0;
-                put_cmsg(msg, SOL_IPV6, IPV6_DSTOPTS, (ptr[1]+1)<<3, ptr);
+                put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
         }
-        if (np->rxopt.bits.srcrt && opt->srcrt) {
+        if (np->rxopt.bits.osrcrt && opt->srcrt) {
                 struct ipv6_rt_hdr *rthdr = (struct ipv6_rt_hdr *)(skb->nh.raw + opt->srcrt);
-                put_cmsg(msg, SOL_IPV6, IPV6_RTHDR, (rthdr->hdrlen+1) << 3, rthdr);
+                put_cmsg(msg, SOL_IPV6, IPV6_2292RTHDR, (rthdr->hdrlen+1) << 3, rthdr);
         }
-        if (np->rxopt.bits.dstopts && opt->dst1) {
+        if (np->rxopt.bits.odstopts && opt->dst1) {
                 u8 *ptr = skb->nh.raw + opt->dst1;
-                put_cmsg(msg, SOL_IPV6, IPV6_DSTOPTS, (ptr[1]+1)<<3, ptr);
+                put_cmsg(msg, SOL_IPV6, IPV6_2292DSTOPTS, (ptr[1]+1)<<3, ptr);
         }
         return 0;
 }
 
 int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                       struct ipv6_txoptions *opt,
-                      int *hlimit)
+                      int *hlimit, int *tclass)
 {
         struct in6_pktinfo *src_info;
         struct cmsghdr *cmsg;
@@ -438,6 +505,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
 
                 switch (cmsg->cmsg_type) {
                 case IPV6_PKTINFO:
+                case IPV6_2292PKTINFO:
                         if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct in6_pktinfo))) {
                                 err = -EINVAL;
                                 goto exit_f;
@@ -492,6 +560,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         fl->fl6_flowlabel = IPV6_FLOWINFO_MASK & *(u32 *)CMSG_DATA(cmsg);
                         break;
 
+                case IPV6_2292HOPOPTS:
                 case IPV6_HOPOPTS:
                         if (opt->hopopt || cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
                                 err = -EINVAL;
@@ -512,7 +581,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         opt->hopopt = hdr;
                         break;
 
-                case IPV6_DSTOPTS:
+                case IPV6_2292DSTOPTS:
                         if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
                                 err = -EINVAL;
                                 goto exit_f;
@@ -536,6 +605,33 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         opt->dst1opt = hdr;
                         break;
 
+                case IPV6_DSTOPTS:
+                case IPV6_RTHDRDSTOPTS:
+                        if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_opt_hdr))) {
+                                err = -EINVAL;
+                                goto exit_f;
+                        }
+
+                        hdr = (struct ipv6_opt_hdr *)CMSG_DATA(cmsg);
+                        len = ((hdr->hdrlen + 1) << 3);
+                        if (cmsg->cmsg_len < CMSG_LEN(len)) {
+                                err = -EINVAL;
+                                goto exit_f;
+                        }
+                        if (!capable(CAP_NET_RAW)) {
+                                err = -EPERM;
+                                goto exit_f;
+                        }
+                        if (cmsg->cmsg_type == IPV6_DSTOPTS) {
+                                opt->opt_flen += len;
+                                opt->dst1opt = hdr;
+                        } else {
+                                opt->opt_nflen += len;
+                                opt->dst0opt = hdr;
+                        }
+                        break;
+
+                case IPV6_2292RTHDR:
                 case IPV6_RTHDR:
                         if (cmsg->cmsg_len < CMSG_LEN(sizeof(struct ipv6_rt_hdr))) {
                                 err = -EINVAL;
@@ -568,7 +664,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         opt->opt_nflen += len;
                         opt->srcrt = rthdr;
 
-                        if (opt->dst1opt) {
+                        if (cmsg->cmsg_type == IPV6_2292RTHDR && opt->dst1opt) {
                                 int dsthdrlen = ((opt->dst1opt->hdrlen+1)<<3);
 
                                 opt->opt_nflen += dsthdrlen;
@@ -579,6 +675,7 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
 
                         break;
 
+                case IPV6_2292HOPLIMIT:
                 case IPV6_HOPLIMIT:
                         if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
                                 err = -EINVAL;
@@ -588,6 +685,24 @@ int datagram_send_ctl(struct msghdr *msg, struct flowi *fl,
                         *hlimit = *(int *)CMSG_DATA(cmsg);
                         break;
 
+                case IPV6_TCLASS:
+                    {
+                        int tc;
+
+                        err = -EINVAL;
+                        if (cmsg->cmsg_len != CMSG_LEN(sizeof(int))) {
+                                goto exit_f;
+                        }
+
+                        tc = *(int *)CMSG_DATA(cmsg);
+                        if (tc < 0 || tc > 0xff)
+                                goto exit_f;
+
+                        err = 0;
+                        *tclass = tc;
+
+                        break;
+                    }
                 default:
                         LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
                                        cmsg->cmsg_type);
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index 5be6da2584ee..922549581abc 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -164,6 +164,7 @@ static int ipv6_destopt_rcv(struct sk_buff **skbp, unsigned int *nhoffp)
                 return -1;
         }
 
+        opt->lastopt = skb->h.raw - skb->nh.raw;
         opt->dst1 = skb->h.raw - skb->nh.raw;
 
         if (ip6_parse_tlv(tlvprocdestopt_lst, skb)) {
@@ -243,6 +244,7 @@ static int ipv6_rthdr_rcv(struct sk_buff **skbp, unsigned int *nhoffp)
 
 looped_back:
         if (hdr->segments_left == 0) {
+                opt->lastopt = skb->h.raw - skb->nh.raw;
                 opt->srcrt = skb->h.raw - skb->nh.raw;
                 skb->h.raw += (hdr->hdrlen + 1) << 3;
                 opt->dst0 = opt->dst1;
@@ -404,8 +406,7 @@ ipv6_invert_rthdr(struct sock *sk, struct ipv6_rt_hdr *hdr)
 
         memcpy(opt->srcrt, hdr, sizeof(*hdr));
         irthdr = (struct rt0_hdr*)opt->srcrt;
-        /* Obsolete field, MBZ, when originated by us */
-        irthdr->bitmap = 0;
+        irthdr->reserved = 0;
         opt->srcrt->segments_left = n;
         for (i=0; i<n; i++)
                 memcpy(irthdr->addr+i, rthdr->addr+(n-1-i), 16);
@@ -459,11 +460,10 @@ static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
                 IP6_INC_STATS_BH(IPSTATS_MIB_INTRUNCATEDPKTS);
                 goto drop;
         }
-        if (pkt_len + sizeof(struct ipv6hdr) < skb->len) {
-                __pskb_trim(skb, pkt_len + sizeof(struct ipv6hdr));
-                if (skb->ip_summed == CHECKSUM_HW)
-                        skb->ip_summed = CHECKSUM_NONE;
-        }
+
+        if (pskb_trim_rcsum(skb, pkt_len + sizeof(struct ipv6hdr)))
+                goto drop;
+
         return 1;
 
 drop:
@@ -539,10 +539,15 @@ void ipv6_push_nfrag_opts(struct sk_buff *skb, struct ipv6_txoptions *opt,
                           u8 *proto,
                           struct in6_addr **daddr)
 {
-        if (opt->srcrt)
+        if (opt->srcrt) {
                 ipv6_push_rthdr(skb, proto, opt->srcrt, daddr);
-        if (opt->dst0opt)
-                ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
+                /*
+                 * IPV6_RTHDRDSTOPTS is ignored
+                 * unless IPV6_RTHDR is set (RFC3542).
+                 */
+                if (opt->dst0opt)
+                        ipv6_push_exthdr(skb, proto, NEXTHDR_DEST, opt->dst0opt);
+        }
         if (opt->hopopt)
                 ipv6_push_exthdr(skb, proto, NEXTHDR_HOP, opt->hopopt);
 }
@@ -573,3 +578,97 @@ ipv6_dup_options(struct sock *sk, struct ipv6_txoptions *opt)
         }
         return opt2;
 }
+
+static int ipv6_renew_option(void *ohdr,
+                             struct ipv6_opt_hdr __user *newopt, int newoptlen,
+                             int inherit,
+                             struct ipv6_opt_hdr **hdr,
+                             char **p)
+{
+        if (inherit) {
+                if (ohdr) {
+                        memcpy(*p, ohdr, ipv6_optlen((struct ipv6_opt_hdr *)ohdr));
+                        *hdr = (struct ipv6_opt_hdr *)*p;
+                        *p += CMSG_ALIGN(ipv6_optlen(*(struct ipv6_opt_hdr **)hdr));
+                }
+        } else {
+                if (newopt) {
+                        if (copy_from_user(*p, newopt, newoptlen))
+                                return -EFAULT;
+                        *hdr = (struct ipv6_opt_hdr *)*p;
+                        if (ipv6_optlen(*(struct ipv6_opt_hdr **)hdr) > newoptlen)
+                                return -EINVAL;
+                        *p += CMSG_ALIGN(newoptlen);
+                }
+        }
+        return 0;
+}
+
+struct ipv6_txoptions *
+ipv6_renew_options(struct sock *sk, struct ipv6_txoptions *opt,
+                   int newtype,
+                   struct ipv6_opt_hdr __user *newopt, int newoptlen)
+{
+        int tot_len = 0;
+        char *p;
+        struct ipv6_txoptions *opt2;
+        int err;
+
+        if (newtype != IPV6_HOPOPTS && opt->hopopt)
+                tot_len += CMSG_ALIGN(ipv6_optlen(opt->hopopt));
+        if (newtype != IPV6_RTHDRDSTOPTS && opt->dst0opt)
+                tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst0opt));
+        if (newtype != IPV6_RTHDR && opt->srcrt)
+                tot_len += CMSG_ALIGN(ipv6_optlen(opt->srcrt));
+        if (newtype != IPV6_DSTOPTS && opt->dst1opt)
+                tot_len += CMSG_ALIGN(ipv6_optlen(opt->dst1opt));
+        if (newopt && newoptlen)
+                tot_len += CMSG_ALIGN(newoptlen);
+
+        if (!tot_len)
+                return NULL;
+
+        opt2 = sock_kmalloc(sk, tot_len, GFP_ATOMIC);
+        if (!opt2)
+                return ERR_PTR(-ENOBUFS);
+
+        memset(opt2, 0, tot_len);
+
+        opt2->tot_len = tot_len;
+        p = (char *)(opt2 + 1);
+
+        err = ipv6_renew_option(opt->hopopt, newopt, newoptlen,
+                                newtype != IPV6_HOPOPTS,
+                                &opt2->hopopt, &p);
+        if (err)
+                goto out;
+
+        err = ipv6_renew_option(opt->dst0opt, newopt, newoptlen,
+                                newtype != IPV6_RTHDRDSTOPTS,
+                                &opt2->dst0opt, &p);
+        if (err)
+                goto out;
+
+        err = ipv6_renew_option(opt->srcrt, newopt, newoptlen,
+                                newtype != IPV6_RTHDR,
+                                (struct ipv6_opt_hdr **)opt2->srcrt, &p);
+        if (err)
+                goto out;
+
+        err = ipv6_renew_option(opt->dst1opt, newopt, newoptlen,
+                                newtype != IPV6_DSTOPTS,
+                                &opt2->dst1opt, &p);
+        if (err)
+                goto out;
+
+        opt2->opt_nflen = (opt2->hopopt ? ipv6_optlen(opt2->hopopt) : 0) +
+                          (opt2->dst0opt ? ipv6_optlen(opt2->dst0opt) : 0) +
+                          (opt2->srcrt ? ipv6_optlen(opt2->srcrt) : 0);
+        opt2->opt_flen = (opt2->dst1opt ? ipv6_optlen(opt2->dst1opt) : 0);
+
+        return opt2;
+out:
+        sock_kfree_s(sk, p, tot_len);
+        return ERR_PTR(err);
+}
+
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index fa8f1bb0aa52..b7185fb3377c 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -287,7 +287,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         int iif = 0;
         int addr_type = 0;
         int len;
-        int hlimit;
+        int hlimit, tclass;
         int err = 0;
 
         if ((u8*)hdr < skb->head || (u8*)(hdr+1) > skb->tail)
@@ -374,7 +374,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         if (err)
                 goto out;
         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
-                goto out_dst_release;
+                goto out;
 
         if (ipv6_addr_is_multicast(&fl.fl6_dst))
                 hlimit = np->mcast_hops;
@@ -385,6 +385,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         if (hlimit < 0)
                 hlimit = ipv6_get_hoplimit(dst->dev);
 
+        tclass = np->cork.tclass;
+        if (tclass < 0)
+                tclass = 0;
+
         msg.skb = skb;
         msg.offset = skb->nh.raw - skb->data;
 
@@ -400,7 +404,7 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         err = ip6_append_data(sk, icmpv6_getfrag, &msg,
                               len + sizeof(struct icmp6hdr),
                               sizeof(struct icmp6hdr),
-                              hlimit, NULL, &fl, (struct rt6_info*)dst,
+                              hlimit, tclass, NULL, &fl, (struct rt6_info*)dst,
                               MSG_DONTWAIT);
         if (err) {
                 ip6_flush_pending_frames(sk);
@@ -434,6 +438,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         struct dst_entry *dst;
         int err = 0;
         int hlimit;
+        int tclass;
 
         saddr = &skb->nh.ipv6h->daddr;
 
@@ -464,7 +469,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (err)
                 goto out;
         if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
-                goto out_dst_release;
+                goto out;
 
         if (ipv6_addr_is_multicast(&fl.fl6_dst))
                 hlimit = np->mcast_hops;
@@ -475,13 +480,17 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
         if (hlimit < 0)
                 hlimit = ipv6_get_hoplimit(dst->dev);
 
+        tclass = np->cork.tclass;
+        if (tclass < 0)
+                tclass = 0;
+
         idev = in6_dev_get(skb->dev);
 
         msg.skb = skb;
         msg.offset = 0;
 
         err = ip6_append_data(sk, icmpv6_getfrag, &msg, skb->len + sizeof(struct icmp6hdr),
-                                sizeof(struct icmp6hdr), hlimit, NULL, &fl,
+                                sizeof(struct icmp6hdr), hlimit, tclass, NULL, &fl,
                                 (struct rt6_info*)dst, MSG_DONTWAIT);
 
         if (err) {
@@ -496,7 +505,6 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
 out_put: 
         if (likely(idev != NULL))
                 in6_dev_put(idev);
-out_dst_release:
         dst_release(dst);
 out: 
         icmpv6_xmit_unlock();
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 16af874c9e8f..4fcc5a7acf6e 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -92,7 +92,7 @@ static struct fib6_node * fib6_repair_tree(struct fib6_node *fn);
 
 static __u32 rt_sernum;
 
-static struct timer_list ip6_fib_timer = TIMER_INITIALIZER(fib6_run_gc, 0, 0);
+static DEFINE_TIMER(ip6_fib_timer, fib6_run_gc, 0, 0);
 
 struct fib6_walker_t fib6_walker_list = {
         .prev   = &fib6_walker_list,
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index b6c73da5ff35..f841bde30c18 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -50,7 +50,7 @@ static atomic_t fl_size = ATOMIC_INIT(0);
 static struct ip6_flowlabel *fl_ht[FL_HASH_MASK+1];
 
 static void ip6_fl_gc(unsigned long dummy);
-static struct timer_list ip6_fl_gc_timer = TIMER_INITIALIZER(ip6_fl_gc, 0, 0);
+static DEFINE_TIMER(ip6_fl_gc_timer, ip6_fl_gc, 0, 0);
 
 /* FL hash table lock: it protects only of GC */
 
@@ -225,16 +225,20 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
                                          struct ip6_flowlabel * fl,
                                          struct ipv6_txoptions * fopt)
 {
-        struct ipv6_txoptions * fl_opt = fl->opt;
+        struct ipv6_txoptions * fl_opt = fl ? fl->opt : NULL;
 
-        if (fopt == NULL || fopt->opt_flen == 0)
-                return fl_opt;
+        if (fopt == NULL || fopt->opt_flen == 0) {
+                if (!fl_opt || !fl_opt->dst0opt || fl_opt->srcrt)
+                        return fl_opt;
+        }
 
         if (fl_opt != NULL) {
                 opt_space->hopopt = fl_opt->hopopt;
-                opt_space->dst0opt = fl_opt->dst0opt;
+                opt_space->dst0opt = fl_opt->srcrt ? fl_opt->dst0opt : NULL;
                 opt_space->srcrt = fl_opt->srcrt;
                 opt_space->opt_nflen = fl_opt->opt_nflen;
+                if (fl_opt->dst0opt && !fl_opt->srcrt)
+                        opt_space->opt_nflen -= ipv6_optlen(fl_opt->dst0opt);
         } else {
                 if (fopt->opt_nflen == 0)
                         return fopt;
@@ -310,7 +314,7 @@ fl_create(struct in6_flowlabel_req *freq, char __user *optval, int optlen, int *
                 msg.msg_control = (void*)(fl->opt+1);
                 flowi.oif = 0;
 
-                err = datagram_send_ctl(&msg, &flowi, fl->opt, &junk);
+                err = datagram_send_ctl(&msg, &flowi, fl->opt, &junk, &junk);
                 if (err)
                         goto done;
                 err = -EINVAL;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 01ef94f7c7f1..2f589f24c093 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -166,7 +166,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         struct ipv6hdr *hdr;
         u8  proto = fl->proto;
         int seg_len = skb->len;
-        int hlimit;
+        int hlimit, tclass;
         u32 mtu;
 
         if (opt) {
@@ -202,7 +202,6 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
          *      Fill in the IPv6 header
          */
 
-        *(u32*)hdr = htonl(0x60000000) | fl->fl6_flowlabel;
         hlimit = -1;
         if (np)
                 hlimit = np->hop_limit;
@@ -211,6 +210,14 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         if (hlimit < 0)
                 hlimit = ipv6_get_hoplimit(dst->dev);
 
+        tclass = -1;
+        if (np)
+                tclass = np->tclass;
+        if (tclass < 0)
+                tclass = 0;
+
+        *(u32 *)hdr = htonl(0x60000000 | (tclass << 20)) | fl->fl6_flowlabel;
+
         hdr->payload_len = htons(seg_len);
         hdr->nexthdr = proto;
         hdr->hop_limit = hlimit;
@@ -762,10 +769,11 @@ out_err_release:
         return err;
 }
 
-int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offset, int len, int odd, struct sk_buff *skb),
-                    void *from, int length, int transhdrlen,
-                    int hlimit, struct ipv6_txoptions *opt, struct flowi *fl, struct rt6_info *rt,
-                    unsigned int flags)
+int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+        int offset, int len, int odd, struct sk_buff *skb),
+        void *from, int length, int transhdrlen,
+        int hlimit, int tclass, struct ipv6_txoptions *opt, struct flowi *fl,
+        struct rt6_info *rt, unsigned int flags)
 {
         struct inet_sock *inet = inet_sk(sk);
         struct ipv6_pinfo *np = inet6_sk(sk);
@@ -803,6 +811,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to, int offse
                 np->cork.rt = rt;
                 inet->cork.fl = *fl;
                 np->cork.hop_limit = hlimit;
+                np->cork.tclass = tclass;
                 inet->cork.fragsize = mtu = dst_mtu(rt->u.dst.path);
                 if (dst_allfrag(rt->u.dst.path))
                         inet->cork.flags |= IPCORK_ALLFRAG;
@@ -1084,7 +1093,8 @@ int ip6_push_pending_frames(struct sock *sk)
 
         skb->nh.ipv6h = hdr = (struct ipv6hdr*) skb_push(skb, sizeof(struct ipv6hdr));
         
-        *(u32*)hdr = fl->fl6_flowlabel | htonl(0x60000000);
+        *(u32*)hdr = fl->fl6_flowlabel |
+                     htonl(0x60000000 | ((int)np->cork.tclass << 20));
 
         if (skb->len <= sizeof(struct ipv6hdr) + IPV6_MAXPLEN)
                 hdr->payload_len = htons(skb->len - sizeof(struct ipv6hdr));
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 09613729404c..cf94372d1af3 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -673,11 +673,12 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
 
         if ((dst = ip6_tnl_dst_check(t)) != NULL)
                 dst_hold(dst);
-        else
+        else {
                 dst = ip6_route_output(NULL, &fl);
 
-        if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0) < 0)
-                goto tx_err_link_failure;
+                if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0) < 0)
+                        goto tx_err_link_failure;
+        }
 
         tdev = dst->dev;
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 76466af8331e..8567873d0dd8 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -210,39 +210,139 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
                 retv = 0;
                 break;
 
-        case IPV6_PKTINFO:
+        case IPV6_RECVPKTINFO:
                 np->rxopt.bits.rxinfo = valbool;
                 retv = 0;
                 break;
+                
+        case IPV6_2292PKTINFO:
+                np->rxopt.bits.rxoinfo = valbool;
+                retv = 0;
+                break;
 
-        case IPV6_HOPLIMIT:
+        case IPV6_RECVHOPLIMIT:
                 np->rxopt.bits.rxhlim = valbool;
                 retv = 0;
                 break;
 
-        case IPV6_RTHDR:
+        case IPV6_2292HOPLIMIT:
+                np->rxopt.bits.rxohlim = valbool;
+                retv = 0;
+                break;
+
+        case IPV6_RECVRTHDR:
                 if (val < 0 || val > 2)
                         goto e_inval;
                 np->rxopt.bits.srcrt = val;
                 retv = 0;
                 break;
 
-        case IPV6_HOPOPTS:
+        case IPV6_2292RTHDR:
+                if (val < 0 || val > 2)
+                        goto e_inval;
+                np->rxopt.bits.osrcrt = val;
+                retv = 0;
+                break;
+
+        case IPV6_RECVHOPOPTS:
                 np->rxopt.bits.hopopts = valbool;
                 retv = 0;
                 break;
 
-        case IPV6_DSTOPTS:
+        case IPV6_2292HOPOPTS:
+                np->rxopt.bits.ohopopts = valbool;
+                retv = 0;
+                break;
+
+        case IPV6_RECVDSTOPTS:
                 np->rxopt.bits.dstopts = valbool;
                 retv = 0;
                 break;
 
+        case IPV6_2292DSTOPTS:
+                np->rxopt.bits.odstopts = valbool;
+                retv = 0;
+                break;
+
+        case IPV6_TCLASS:
+                if (val < 0 || val > 0xff)
+                        goto e_inval;
+                np->tclass = val;
+                retv = 0;
+                break;
+                
+        case IPV6_RECVTCLASS:
+                np->rxopt.bits.rxtclass = valbool;
+                retv = 0;
+                break;
+
         case IPV6_FLOWINFO:
                 np->rxopt.bits.rxflow = valbool;
                 retv = 0;
                 break;
 
-        case IPV6_PKTOPTIONS:
+        case IPV6_HOPOPTS:
+        case IPV6_RTHDRDSTOPTS:
+        case IPV6_RTHDR:
+        case IPV6_DSTOPTS:
+        {
+                struct ipv6_txoptions *opt;
+                if (optlen == 0)
+                        optval = 0;
+
+                /* hop-by-hop / destination options are privileged option */
+                retv = -EPERM;
+                if (optname != IPV6_RTHDR && !capable(CAP_NET_RAW))
+                        break;
+
+                retv = -EINVAL;
+                if (optlen & 0x7 || optlen > 8 * 255)
+                        break;
+
+                opt = ipv6_renew_options(sk, np->opt, optname,
+                                         (struct ipv6_opt_hdr __user *)optval,
+                                         optlen);
+                if (IS_ERR(opt)) {
+                        retv = PTR_ERR(opt);
+                        break;
+                }
+
+                /* routing header option needs extra check */
+                if (optname == IPV6_RTHDR && opt->srcrt) {
+                        struct ipv6_rt_hdr *rthdr = opt->srcrt;
+                        if (rthdr->type)
+                                goto sticky_done;
+                        if ((rthdr->hdrlen & 1) ||
+                            (rthdr->hdrlen >> 1) != rthdr->segments_left)
+                                goto sticky_done;
+                }
+
+                retv = 0;
+                if (sk->sk_type == SOCK_STREAM) {
+                        if (opt) {
+                                struct tcp_sock *tp = tcp_sk(sk);
+                                if (!((1 << sk->sk_state) &
+                                      (TCPF_LISTEN | TCPF_CLOSE))
+                                    && inet_sk(sk)->daddr != LOOPBACK4_IPV6) {
+                                        tp->ext_header_len = opt->opt_flen + opt->opt_nflen;
+                                        tcp_sync_mss(sk, tp->pmtu_cookie);
+                                }
+                        }
+                        opt = xchg(&np->opt, opt);
+                        sk_dst_reset(sk);
+                } else {
+                        write_lock(&sk->sk_dst_lock);
+                        opt = xchg(&np->opt, opt);
+                        write_unlock(&sk->sk_dst_lock);
+                        sk_dst_reset(sk);
+                }
+sticky_done:
+                if (opt)
+                        sock_kfree_s(sk, opt, opt->tot_len);
+                break;
+        }
+
+        case IPV6_2292PKTOPTIONS:
         {
                 struct ipv6_txoptions *opt = NULL;
                 struct msghdr msg;
@@ -276,7 +376,7 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
                 msg.msg_controllen = optlen;
                 msg.msg_control = (void*)(opt+1);
 
-                retv = datagram_send_ctl(&msg, &fl, opt, &junk);
+                retv = datagram_send_ctl(&msg, &fl, opt, &junk, &junk);
                 if (retv)
                         goto done;
 update:
@@ -529,6 +629,17 @@ e_inval:
         return -EINVAL;
 }
 
+int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_opt_hdr *hdr,
+                           char __user *optval, int len)
+{
+        if (!hdr)
+                return 0;
+        len = min_t(int, len, ipv6_optlen(hdr));
+        if (copy_to_user(optval, hdr, ipv6_optlen(hdr)))
+                return -EFAULT;
+        return len;
+}
+
 int ipv6_getsockopt(struct sock *sk, int level, int optname,
                     char __user *optval, int __user *optlen)
 {
@@ -567,7 +678,7 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
                 return err;
         }
 
-        case IPV6_PKTOPTIONS:
+        case IPV6_2292PKTOPTIONS:
         {
                 struct msghdr msg;
                 struct sk_buff *skb;
@@ -601,6 +712,16 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
                                 int hlim = np->mcast_hops;
                                 put_cmsg(&msg, SOL_IPV6, IPV6_HOPLIMIT, sizeof(hlim), &hlim);
                         }
+                        if (np->rxopt.bits.rxoinfo) {
+                                struct in6_pktinfo src_info;
+                                src_info.ipi6_ifindex = np->mcast_oif;
+                                ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
+                                put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
+                        }
+                        if (np->rxopt.bits.rxohlim) {
+                                int hlim = np->mcast_hops;
+                                put_cmsg(&msg, SOL_IPV6, IPV6_2292HOPLIMIT, sizeof(hlim), &hlim);
+                        }
                 }
                 len -= msg.msg_controllen;
                 return put_user(len, optlen);
@@ -625,26 +746,67 @@ int ipv6_getsockopt(struct sock *sk, int level, int optname,
                 val = np->ipv6only;
                 break;
 
-        case IPV6_PKTINFO:
+        case IPV6_RECVPKTINFO:
                 val = np->rxopt.bits.rxinfo;
                 break;
 
-        case IPV6_HOPLIMIT:
+        case IPV6_2292PKTINFO:
+                val = np->rxopt.bits.rxoinfo;
+                break;
+
+        case IPV6_RECVHOPLIMIT:
                 val = np->rxopt.bits.rxhlim;
                 break;
 
-        case IPV6_RTHDR:
+        case IPV6_2292HOPLIMIT:
+                val = np->rxopt.bits.rxohlim;
+                break;
+
+        case IPV6_RECVRTHDR:
                 val = np->rxopt.bits.srcrt;
                 break;
 
+        case IPV6_2292RTHDR:
+                val = np->rxopt.bits.osrcrt;
+                break;
+
         case IPV6_HOPOPTS:
+        case IPV6_RTHDRDSTOPTS:
+        case IPV6_RTHDR:
+        case IPV6_DSTOPTS:
+        {
+
+                lock_sock(sk);
+                len = ipv6_getsockopt_sticky(sk, np->opt->hopopt,
+                                             optval, len);
+                release_sock(sk);
+                return put_user(len, optlen);
+        }
+
+        case IPV6_RECVHOPOPTS:
                 val = np->rxopt.bits.hopopts;
                 break;
 
-        case IPV6_DSTOPTS:
+        case IPV6_2292HOPOPTS:
+                val = np->rxopt.bits.ohopopts;
+                break;
+
+        case IPV6_RECVDSTOPTS:
                 val = np->rxopt.bits.dstopts;
                 break;
 
+        case IPV6_2292DSTOPTS:
+                val = np->rxopt.bits.odstopts;
+                break;
+
+        case IPV6_TCLASS:
+                val = np->tclass;
+                break;
+
+        case IPV6_RECVTCLASS:
+                val = np->rxopt.bits.rxtclass;
+                break;
+
         case IPV6_FLOWINFO:
                 val = np->rxopt.bits.rxflow;
                 break;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index a7eae30f4554..555a31347eda 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -447,10 +447,8 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                 return;
 
         err = xfrm_lookup(&dst, &fl, NULL, 0);
-        if (err < 0) {
-                dst_release(dst);
+        if (err < 0)
                 return;
-        }
 
         if (inc_opt) {
                 if (dev->addr_len)
@@ -539,10 +537,8 @@ void ndisc_send_ns(struct net_device *dev, struct neighbour *neigh,
                 return;
 
         err = xfrm_lookup(&dst, &fl, NULL, 0);
-        if (err < 0) {
-                dst_release(dst);
+        if (err < 0)
                 return;
-        }
 
         len = sizeof(struct icmp6hdr) + sizeof(struct in6_addr);
         send_llinfo = dev->addr_len && !ipv6_addr_any(saddr);
@@ -616,10 +612,8 @@ void ndisc_send_rs(struct net_device *dev, struct in6_addr *saddr,
                 return;
 
         err = xfrm_lookup(&dst, &fl, NULL, 0);
-        if (err < 0) {
-                dst_release(dst);
+        if (err < 0)
                 return;
-        }
 
         len = sizeof(struct icmp6hdr);
         if (dev->addr_len)
@@ -1353,10 +1347,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
                 return;
 
         err = xfrm_lookup(&dst, &fl, NULL, 0);
-        if (err) {
-                dst_release(dst);
+        if (err)
                 return;
-        }
 
         rt = (struct rt6_info *) dst;
 
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 14316c3ebde4..b03e87adca93 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -100,11 +100,8 @@ static void send_reset(struct sk_buff *oldskb)
         dst = ip6_route_output(NULL, &fl);
         if (dst == NULL)
                 return;
-        if (dst->error ||
-            xfrm_lookup(&dst, &fl, NULL, 0)) {
-                dst_release(dst);
+        if (dst->error || xfrm_lookup(&dst, &fl, NULL, 0))
                 return;
-        }
 
         hh_len = (dst->dev->hard_header_len + 15)&~15;
         nskb = alloc_skb(hh_len + 15 + dst->header_len + sizeof(struct ipv6hdr)
diff --git a/net/ipv6/netfilter/ip6t_owner.c b/net/ipv6/netfilter/ip6t_owner.c
index 9b91decbfddb..4de4cdad4b7d 100644
--- a/net/ipv6/netfilter/ip6t_owner.c
+++ b/net/ipv6/netfilter/ip6t_owner.c
@@ -11,6 +11,7 @@
 #include <linux/module.h>
 #include <linux/skbuff.h>
 #include <linux/file.h>
+#include <linux/rcupdate.h>
 #include <net/sock.h>
 
 #include <linux/netfilter_ipv6/ip6t_owner.h>
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index a9526b773d28..2bb670037df3 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -161,8 +161,8 @@ match(const struct sk_buff *skb,
                            ((rtinfo->hdrlen == hdrlen) ^
                            !!(rtinfo->invflags & IP6T_RT_INV_LEN))));
        DEBUGP("res %02X %02X %02X ", 
-                (rtinfo->flags & IP6T_RT_RES), ((struct rt0_hdr *)rh)->bitmap,
-                !((rtinfo->flags & IP6T_RT_RES) && (((struct rt0_hdr *)rh)->bitmap)));
+                (rtinfo->flags & IP6T_RT_RES), ((struct rt0_hdr *)rh)->reserved,
+                !((rtinfo->flags & IP6T_RT_RES) && (((struct rt0_hdr *)rh)->reserved)));
 
        ret = (rh != NULL)
                 &&
@@ -179,12 +179,12 @@ match(const struct sk_buff *skb,
                            !!(rtinfo->invflags & IP6T_RT_INV_TYP)));
 
         if (ret && (rtinfo->flags & IP6T_RT_RES)) {
-                u_int32_t *bp, _bitmap;
-                bp = skb_header_pointer(skb,
-                                        ptr + offsetof(struct rt0_hdr, bitmap),
-                                        sizeof(_bitmap), &_bitmap);
+                u_int32_t *rp, _reserved;
+                rp = skb_header_pointer(skb,
+                                        ptr + offsetof(struct rt0_hdr, reserved),
+                                        sizeof(_reserved), &_reserved);
 
-                ret = (*bp == 0);
+                ret = (*rp == 0);
         }
 
         DEBUGP("#%d ",rtinfo->addrnr);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index ed3a76b30fd9..5aa3691c578d 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -655,6 +655,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         struct flowi fl;
         int addr_len = msg->msg_namelen;
         int hlimit = -1;
+        int tclass = -1;
         u16 proto;
         int err;
 
@@ -740,7 +741,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(struct ipv6_txoptions);
 
-                err = datagram_send_ctl(msg, &fl, opt, &hlimit);
+                err = datagram_send_ctl(msg, &fl, opt, &hlimit, &tclass);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -755,8 +756,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         }
         if (opt == NULL)
                 opt = np->opt;
-        if (flowlabel)
-                opt = fl6_merge_options(&opt_space, flowlabel, opt);
+        opt = fl6_merge_options(&opt_space, flowlabel, opt);
 
         fl.proto = proto;
         rawv6_probe_proto_opt(&fl, msg);
@@ -782,10 +782,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
-                dst_release(dst);
+        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
                 goto out;
-        }
 
         if (hlimit < 0) {
                 if (ipv6_addr_is_multicast(&fl.fl6_dst))
@@ -798,6 +796,12 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                         hlimit = ipv6_get_hoplimit(dst->dev);
         }
 
+        if (tclass < 0) {
+                tclass = np->cork.tclass;
+                if (tclass < 0)
+                        tclass = 0;
+        }
+
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
 
@@ -806,8 +810,9 @@ back_from_confirm:
                 err = rawv6_send_hdrinc(sk, msg->msg_iov, len, &fl, (struct rt6_info*)dst, msg->msg_flags);
         } else {
                 lock_sock(sk);
-                err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov, len, 0,
-                                        hlimit, opt, &fl, (struct rt6_info*)dst, msg->msg_flags);
+                err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov,
+                        len, 0, hlimit, tclass, opt, &fl, (struct rt6_info*)dst,
+                        msg->msg_flags);
 
                 if (err)
                         ip6_flush_pending_frames(sk);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 9d9e04344c77..e4fe9ee484dd 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -479,12 +479,9 @@ static void ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
         /* Point into the IP datagram 'data' part. */
         if (!pskb_pull(skb, (u8 *) (fhdr + 1) - skb->data))
                 goto err;
-        if (end-offset < skb->len) {
-                if (pskb_trim(skb, end - offset))
-                        goto err;
-                if (skb->ip_summed != CHECKSUM_UNNECESSARY)
-                        skb->ip_summed = CHECKSUM_NONE;
-        }
+        
+        if (pskb_trim_rcsum(skb, end - offset))
+                goto err;
 
         /* Find out which fragments are in front and at the back of us
          * in the chain of fragments so far.  We must know where to put
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 794734f1d230..80643e6b346b 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -632,10 +632,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         if (final_p)
                 ipv6_addr_copy(&fl.fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
-                dst_release(dst);
+        if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0)
                 goto failure;
-        }
 
         if (saddr == NULL) {
                 saddr = &fl.fl6_src;
@@ -849,7 +847,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         if (dst == NULL) {
                 opt = np->opt;
                 if (opt == NULL &&
-                    np->rxopt.bits.srcrt == 2 &&
+                    np->rxopt.bits.osrcrt == 2 &&
                     treq->pktopts) {
                         struct sk_buff *pktopts = treq->pktopts;
                         struct inet6_skb_parm *rxopt = IP6CB(pktopts);
@@ -888,7 +886,6 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
         }
 
 done:
-        dst_release(dst);
         if (opt && opt != np->opt)
                 sock_kfree_s(sk, opt, opt->tot_len);
         return err;
@@ -915,11 +912,10 @@ static int ipv6_opt_accepted(struct sock *sk, struct sk_buff *skb)
         struct inet6_skb_parm *opt = IP6CB(skb);
 
         if (np->rxopt.all) {
-                if ((opt->hop && np->rxopt.bits.hopopts) ||
-                    ((IPV6_FLOWINFO_MASK&*(u32*)skb->nh.raw) &&
-                     np->rxopt.bits.rxflow) ||
-                    (opt->srcrt && np->rxopt.bits.srcrt) ||
-                    ((opt->dst1 || opt->dst0) && np->rxopt.bits.dstopts))
+                if ((opt->hop && (np->rxopt.bits.hopopts || np->rxopt.bits.ohopopts)) ||
+                    ((IPV6_FLOWINFO_MASK & *(u32*)skb->nh.raw) && np->rxopt.bits.rxflow) ||
+                    (opt->srcrt && (np->rxopt.bits.srcrt || np->rxopt.bits.osrcrt)) ||
+                    ((opt->dst1 || opt->dst0) && (np->rxopt.bits.dstopts || np->rxopt.bits.odstopts)))
                         return 1;
         }
         return 0;
@@ -1001,10 +997,8 @@ static void tcp_v6_send_reset(struct sk_buff *skb)
         /* sk = NULL, but it is safe for now. RST socket required. */
         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
 
-                if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0) {
-                        dst_release(buff->dst);
+                if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0)
                         return;
-                }
 
                 ip6_xmit(NULL, buff, &fl, NULL, 0);
                 TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
@@ -1068,10 +1062,8 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
         fl.fl_ip_sport = t1->source;
 
         if (!ip6_dst_lookup(NULL, &buff->dst, &fl)) {
-                if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0) {
-                        dst_release(buff->dst);
+                if ((xfrm_lookup(&buff->dst, &fl, NULL, 0)) < 0)
                         return;
-                }
                 ip6_xmit(NULL, buff, &fl, NULL, 0);
                 TCP_INC_STATS_BH(TCP_MIB_OUTSEGS);
                 return;
@@ -1190,8 +1182,8 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         TCP_ECN_create_request(req, skb->h.th);
         treq->pktopts = NULL;
         if (ipv6_opt_accepted(sk, skb) ||
-            np->rxopt.bits.rxinfo ||
-            np->rxopt.bits.rxhlim) {
+            np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
+            np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim) {
                 atomic_inc(&skb->users);
                 treq->pktopts = skb;
         }
@@ -1288,7 +1280,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         if (sk_acceptq_is_full(sk))
                 goto out_overflow;
 
-        if (np->rxopt.bits.srcrt == 2 &&
+        if (np->rxopt.bits.osrcrt == 2 &&
             opt == NULL && treq->pktopts) {
                 struct inet6_skb_parm *rxopt = IP6CB(treq->pktopts);
                 if (rxopt->srcrt)
@@ -1544,9 +1536,9 @@ ipv6_pktoptions:
         tp = tcp_sk(sk);
         if (TCP_SKB_CB(opt_skb)->end_seq == tp->rcv_nxt &&
             !((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_LISTEN))) {
-                if (np->rxopt.bits.rxinfo)
+                if (np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo)
                         np->mcast_oif = inet6_iif(opt_skb);
-                if (np->rxopt.bits.rxhlim)
+                if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                         np->mcast_hops = opt_skb->nh.ipv6h->hop_limit;
                 if (ipv6_opt_accepted(sk, opt_skb)) {
                         skb_set_owner_r(opt_skb, sk);
@@ -1734,7 +1726,6 @@ static int tcp_v6_rebuild_header(struct sock *sk)
 
                 if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
                         sk->sk_err_soft = -err;
-                        dst_release(dst);
                         return err;
                 }
 
@@ -1787,7 +1778,6 @@ static int tcp_v6_xmit(struct sk_buff *skb, int ipfragok)
 
                 if ((err = xfrm_lookup(&dst, &fl, sk, 0)) < 0) {
                         sk->sk_route_caps = 0;
-                        dst_release(dst);
                         return err;
                 }
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 390d750449ce..69b146843a20 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -483,7 +483,7 @@ static int udpv6_rcv(struct sk_buff **pskb, unsigned int *nhoffp)
         }
 
         if (ulen < skb->len) {
-                if (__pskb_trim(skb, ulen))
+                if (pskb_trim_rcsum(skb, ulen))
                         goto discard;
                 saddr = &skb->nh.ipv6h->saddr;
                 daddr = &skb->nh.ipv6h->daddr;
@@ -637,6 +637,7 @@ static int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
         int addr_len = msg->msg_namelen;
         int ulen = len;
         int hlimit = -1;
+        int tclass = -1;
         int corkreq = up->corkflag || msg->msg_flags&MSG_MORE;
         int err;
 
@@ -758,7 +759,7 @@ do_udp_sendmsg:
                 memset(opt, 0, sizeof(struct ipv6_txoptions));
                 opt->tot_len = sizeof(*opt);
 
-                err = datagram_send_ctl(msg, fl, opt, &hlimit);
+                err = datagram_send_ctl(msg, fl, opt, &hlimit, &tclass);
                 if (err < 0) {
                         fl6_sock_release(flowlabel);
                         return err;
@@ -773,8 +774,7 @@ do_udp_sendmsg:
         }
         if (opt == NULL)
                 opt = np->opt;
-        if (flowlabel)
-                opt = fl6_merge_options(&opt_space, flowlabel, opt);
+        opt = fl6_merge_options(&opt_space, flowlabel, opt);
 
         fl->proto = IPPROTO_UDP;
         ipv6_addr_copy(&fl->fl6_dst, daddr);
@@ -799,10 +799,8 @@ do_udp_sendmsg:
         if (final_p)
                 ipv6_addr_copy(&fl->fl6_dst, final_p);
 
-        if ((err = xfrm_lookup(&dst, fl, sk, 0)) < 0) {
-                dst_release(dst);
+        if ((err = xfrm_lookup(&dst, fl, sk, 0)) < 0)
                 goto out;
-        }
 
         if (hlimit < 0) {
                 if (ipv6_addr_is_multicast(&fl->fl6_dst))
@@ -815,6 +813,12 @@ do_udp_sendmsg:
                         hlimit = ipv6_get_hoplimit(dst->dev);
         }
 
+        if (tclass < 0) {
+                tclass = np->tclass;
+                if (tclass < 0)
+                        tclass = 0;
+        }
+
         if (msg->msg_flags&MSG_CONFIRM)
                 goto do_confirm;
 back_from_confirm:
@@ -834,9 +838,10 @@ back_from_confirm:
 
 do_append_data:
         up->len += ulen;
-        err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov, ulen, sizeof(struct udphdr),
-                              hlimit, opt, fl, (struct rt6_info*)dst,
-                              corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
+        err = ip6_append_data(sk, ip_generic_getfrag, msg->msg_iov, ulen,
+                sizeof(struct udphdr), hlimit, tclass, opt, fl,
+                (struct rt6_info*)dst,
+                corkreq ? msg->msg_flags|MSG_MORE : msg->msg_flags);
         if (err)
                 udp_v6_flush_pending_frames(sk);
         else if (!corkreq)