4 files changed, 22 insertions, 11 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3381b4317c27..7e567ae5eaab 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3610,7 +3610,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                 hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
                         if (idx < s_idx)
                                 goto cont;
-                        if (idx > s_idx)
+                        if (h > s_h || idx > s_idx)
                                 s_ip_idx = 0;
                         ip_idx = 0;
                         if ((idev = __in6_dev_get(dev)) == NULL)
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 52e0f74fdfe0..27acfb58650a 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1113,6 +1113,9 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
         unsigned char ttls[MAXMIFS];
         int i;
 
+        if (mfc->mf6cc_parent >= MAXMIFS)
+                return -ENFILE;
+
         memset(ttls, 255, MAXMIFS);
         for (i = 0; i < MAXMIFS; i++) {
                 if (IF_ISSET(i, &mfc->mf6cc_ifset))
@@ -1692,17 +1695,20 @@ ip6mr_fill_mroute(struct sk_buff *skb, struct mfc6_cache *c, struct rtmsg *rtm)
         int ct;
         struct rtnexthop *nhp;
         struct net *net = mfc6_net(c);
-        struct net_device *dev = net->ipv6.vif6_table[c->mf6c_parent].dev;
         u8 *b = skb_tail_pointer(skb);
         struct rtattr *mp_head;
 
-        if (dev)
-                RTA_PUT(skb, RTA_IIF, 4, &dev->ifindex);
+        /* If cache is unresolved, don't try to parse IIF and OIF */
+        if (c->mf6c_parent > MAXMIFS)
+                return -ENOENT;
+
+        if (MIF_EXISTS(net, c->mf6c_parent))
+                RTA_PUT(skb, RTA_IIF, 4, &net->ipv6.vif6_table[c->mf6c_parent].dev->ifindex);
 
         mp_head = (struct rtattr *)skb_put(skb, RTA_LENGTH(0));
 
         for (ct = c->mfc_un.res.minvif; ct < c->mfc_un.res.maxvif; ct++) {
-                if (c->mfc_un.res.ttls[ct] < 255) {
+                if (MIF_EXISTS(net, ct) && c->mfc_un.res.ttls[ct] < 255) {
                         if (skb_tailroom(skb) < RTA_ALIGN(RTA_ALIGN(sizeof(*nhp)) + 4))
                                 goto rtattr_failure;
                         nhp = (struct rtnexthop *)skb_put(skb, RTA_ALIGN(sizeof(*nhp)));
diff --git a/net/ipv6/netfilter/ip6table_raw.c b/net/ipv6/netfilter/ip6table_raw.c
index aef31a29de9e..b9cf7cd61923 100644
--- a/net/ipv6/netfilter/ip6table_raw.c
+++ b/net/ipv6/netfilter/ip6table_raw.c
@@ -13,7 +13,7 @@ static const struct xt_table packet_raw = {
         .valid_hooks = RAW_VALID_HOOKS,
         .me = THIS_MODULE,
         .af = NFPROTO_IPV6,
-        .priority = NF_IP6_PRI_FIRST,
+        .priority = NF_IP6_PRI_RAW,
 };
 
 /* The work comes in here from netfilter.c. */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 52cd3eff31dc..0d7713c5c206 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -879,7 +879,7 @@ static struct dst_entry *ip6_dst_check(struct dst_entry *dst, u32 cookie)
 
         rt = (struct rt6_info *) dst;
 
-        if (rt && rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
+        if (rt->rt6i_node && (rt->rt6i_node->fn_sernum == cookie))
                 return dst;
 
         return NULL;
@@ -890,12 +890,17 @@ static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
         struct rt6_info *rt = (struct rt6_info *) dst;
 
         if (rt) {
-                if (rt->rt6i_flags & RTF_CACHE)
-                        ip6_del_rt(rt);
-                else
+                if (rt->rt6i_flags & RTF_CACHE) {
+                        if (rt6_check_expired(rt)) {
+                                ip6_del_rt(rt);
+                                dst = NULL;
+                        }
+                } else {
                         dst_release(dst);
+                        dst = NULL;
+                }
         }
-        return NULL;
+        return dst;
 }
 
 static void ip6_link_failure(struct sk_buff *skb)