12 files changed, 79 insertions, 45 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 2a66eaad047f..d6ff12617f36 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1022,7 +1022,6 @@ static int ipv6_create_tempaddr(struct inet6_ifaddr *ifp, struct inet6_ifaddr *i
         unsigned long regen_advance;
         int tmp_plen;
         int ret = 0;
-        int max_addresses;
         u32 addr_flags;
         unsigned long now = jiffies;
 
@@ -1068,7 +1067,6 @@ retry:
                                  idev->cnf.temp_prefered_lft + age -
                                  idev->cnf.max_desync_factor);
         tmp_plen = ifp->prefix_len;
-        max_addresses = idev->cnf.max_addresses;
         tmp_tstamp = ifp->tstamp;
         spin_unlock_bh(&ifp->lock);
 
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index f083a583a05c..b30ad3741b46 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -251,38 +251,36 @@ static struct ip6addrlbl_entry *ip6addrlbl_alloc(struct net *net,
 /* add a label */
 static int __ip6addrlbl_add(struct ip6addrlbl_entry *newp, int replace)
 {
+        struct hlist_node *n;
+        struct ip6addrlbl_entry *last = NULL, *p = NULL;
         int ret = 0;
 
-        ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n",
-                        __func__,
-                        newp, replace);
+        ADDRLABEL(KERN_DEBUG "%s(newp=%p, replace=%d)\n", __func__, newp,
+                  replace);
 
-        if (hlist_empty(&ip6addrlbl_table.head)) {
-                hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head);
-        } else {
-                struct hlist_node *n;
-                struct ip6addrlbl_entry *p = NULL;
-                hlist_for_each_entry_safe(p, n,
-                                          &ip6addrlbl_table.head, list) {
-                        if (p->prefixlen == newp->prefixlen &&
-                            net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
-                            p->ifindex == newp->ifindex &&
-                            ipv6_addr_equal(&p->prefix, &newp->prefix)) {
-                                if (!replace) {
-                                        ret = -EEXIST;
-                                        goto out;
-                                }
-                                hlist_replace_rcu(&p->list, &newp->list);
-                                ip6addrlbl_put(p);
-                                goto out;
-                        } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) ||
-                                   (p->prefixlen < newp->prefixlen)) {
-                                hlist_add_before_rcu(&newp->list, &p->list);
+        hlist_for_each_entry_safe(p, n, &ip6addrlbl_table.head, list) {
+                if (p->prefixlen == newp->prefixlen &&
+                    net_eq(ip6addrlbl_net(p), ip6addrlbl_net(newp)) &&
+                    p->ifindex == newp->ifindex &&
+                    ipv6_addr_equal(&p->prefix, &newp->prefix)) {
+                        if (!replace) {
+                                ret = -EEXIST;
                                 goto out;
                         }
+                        hlist_replace_rcu(&p->list, &newp->list);
+                        ip6addrlbl_put(p);
+                        goto out;
+                } else if ((p->prefixlen == newp->prefixlen && !p->ifindex) ||
+                           (p->prefixlen < newp->prefixlen)) {
+                        hlist_add_before_rcu(&newp->list, &p->list);
+                        goto out;
                 }
-                hlist_add_after_rcu(&p->list, &newp->list);
+                last = p;
         }
+        if (last)
+                hlist_add_after_rcu(&last->list, &newp->list);
+        else
+                hlist_add_head_rcu(&newp->list, &ip6addrlbl_table.head);
 out:
         if (!ret)
                 ip6addrlbl_table.seq++;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 73681c227453..eef8d945b362 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -940,6 +940,14 @@ static const struct icmp6_err {
                 .err    = ECONNREFUSED,
                 .fatal  = 1,
         },
+        {       /* POLICY_FAIL */
+                .err    = EACCES,
+                .fatal  = 1,
+        },
+        {       /* REJECT_ROUTE */
+                .err    = EACCES,
+                .fatal  = 1,
+        },
 };
 
 int icmpv6_err_convert(u8 type, u8 code, int *err)
@@ -951,7 +959,7 @@ int icmpv6_err_convert(u8 type, u8 code, int *err)
         switch (type) {
         case ICMPV6_DEST_UNREACH:
                 fatal = 1;
-                if (code <= ICMPV6_PORT_UNREACH) {
+                if (code < ARRAY_SIZE(tab_unreach)) {
                         *err  = tab_unreach[code].err;
                         fatal = tab_unreach[code].fatal;
                 }
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index db992a373011..6b26e9feafb9 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -722,6 +722,11 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                 ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
         }
 
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
+
         skb_push(skb, gre_hlen);
         skb_reset_network_header(skb);
         skb_set_transport_header(skb, sizeof(*ipv6h));
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index dd08cfd8999e..3a692d529163 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -213,6 +213,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
         hdr->saddr = fl6->saddr;
         hdr->daddr = *first_hop;
 
+        skb->protocol = htons(ETH_P_IPV6);
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
 
@@ -1032,6 +1033,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
                 /* initialize protocol header pointer */
                 skb->transport_header = skb->network_header + fragheaderlen;
 
+                skb->protocol = htons(ETH_P_IPV6);
                 skb->ip_summed = CHECKSUM_PARTIAL;
                 skb->csum = 0;
         }
@@ -1334,6 +1336,7 @@ alloc_new_skb:
                         /*
                          *      Fill in the control structures
                          */
+                        skb->protocol = htons(ETH_P_IPV6);
                         skb->ip_summed = CHECKSUM_NONE;
                         skb->csum = 0;
                         /* reserve for fragmentation and ipsec header */
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 55999d923f26..61355f7f4da5 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1028,6 +1028,12 @@ static int ip6_tnl_xmit2(struct sk_buff *skb,
                 init_tel_txopt(&opt, encap_limit);
                 ipv6_push_nfrag_opts(skb, &opt.ops, &proto, NULL);
         }
+
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
+
         skb_push(skb, sizeof(struct ipv6hdr));
         skb_reset_network_header(skb);
         ipv6h = ipv6_hdr(skb);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index c4bc7a35cd56..12179457b2cd 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -372,14 +372,11 @@ static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
         int tlen = dev->needed_tailroom;
         struct sock *sk = dev_net(dev)->ipv6.ndisc_sk;
         struct sk_buff *skb;
-        int err;
 
-        skb = sock_alloc_send_skb(sk,
-                                  hlen + sizeof(struct ipv6hdr) + len + tlen,
-                                  1, &err);
+        skb = alloc_skb(hlen + sizeof(struct ipv6hdr) + len + tlen, GFP_ATOMIC);
         if (!skb) {
-                ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb, err=%d\n",
-                          __func__, err);
+                ND_PRINTK(0, err, "ndisc: %s failed to allocate an skb\n",
+                          __func__);
                 return NULL;
         }
 
@@ -389,6 +386,11 @@ static struct sk_buff *ndisc_alloc_skb(struct net_device *dev,
         skb_reserve(skb, hlen + sizeof(struct ipv6hdr));
         skb_reset_transport_header(skb);
 
+        /* Manually assign socket ownership as we avoid calling
+         * sock_alloc_send_pskb() to bypass wmem buffer limits
+         */
+        skb_set_owner_w(skb, sk);
+
         return skb;
 }
 
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index c1e533498203..58916bbb1728 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -633,6 +633,7 @@ static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
                 goto error;
         skb_reserve(skb, hlen);
 
+        skb->protocol = htons(ETH_P_IPV6);
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
         skb_dst_set(skb, &rt->dst);
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 19abcc9d6a1a..7ee5cb96db34 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -641,11 +641,7 @@ static int ipip_rcv(struct sk_buff *skb)
         const struct iphdr *iph;
         struct ip_tunnel *tunnel;
 
-        if (iptunnel_pull_header(skb, 0, tpi.proto))
-                goto drop;
-
         iph = ip_hdr(skb);
-
         tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                      iph->saddr, iph->daddr);
         if (tunnel != NULL) {
@@ -655,6 +651,8 @@ static int ipip_rcv(struct sk_buff *skb)
 
                 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
                         goto drop;
+                if (iptunnel_pull_header(skb, 0, tpi.proto))
+                        goto drop;
                 return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
         }
 
@@ -881,6 +879,11 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 ttl = iph6->hop_limit;
         tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
 
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
+
         err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, IPPROTO_IPV6, tos,
                             ttl, df, !net_eq(tunnel->net, dev_net(dev)));
         iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 9acdcedf9a14..5c71501fc917 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1425,7 +1425,7 @@ ipv6_pktoptions:
                 if (np->rxopt.bits.rxhlim || np->rxopt.bits.rxohlim)
                         np->mcast_hops = ipv6_hdr(opt_skb)->hop_limit;
                 if (np->rxopt.bits.rxtclass)
-                        np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
+                        np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(opt_skb));
                 if (ipv6_opt_accepted(sk, opt_skb)) {
                         skb_set_owner_r(opt_skb, sk);
                         opt_skb = xchg(&np->pktoptions, opt_skb);
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 8755a3079d0f..6cd625e37706 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -34,8 +34,10 @@ static int xfrm6_local_dontfrag(struct sk_buff *skb)
         struct sock *sk = skb->sk;
 
         if (sk) {
-                proto = sk->sk_protocol;
+                if (sk->sk_family != AF_INET6)
+                        return 0;
 
+                proto = sk->sk_protocol;
                 if (proto == IPPROTO_UDP || proto == IPPROTO_RAW)
                         return inet6_sk(sk)->dontfrag;
         }
@@ -54,13 +56,15 @@ static void xfrm6_local_rxpmtu(struct sk_buff *skb, u32 mtu)
         ipv6_local_rxpmtu(sk, &fl6, mtu);
 }
 
-static void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
+void xfrm6_local_error(struct sk_buff *skb, u32 mtu)
 {
         struct flowi6 fl6;
+        const struct ipv6hdr *hdr;
         struct sock *sk = skb->sk;
 
+        hdr = skb->encapsulation ? inner_ipv6_hdr(skb) : ipv6_hdr(skb);
         fl6.fl6_dport = inet_sk(sk)->inet_dport;
-        fl6.daddr = ipv6_hdr(skb)->daddr;
+        fl6.daddr = hdr->daddr;
 
         ipv6_local_error(sk, EMSGSIZE, &fl6, mtu);
 }
@@ -80,7 +84,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
                 if (xfrm6_local_dontfrag(skb))
                         xfrm6_local_rxpmtu(skb, mtu);
                 else if (skb->sk)
-                        xfrm6_local_error(skb, mtu);
+                        xfrm_local_error(skb, mtu);
                 else
                         icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu);
                 ret = -EMSGSIZE;
@@ -136,13 +140,18 @@ static int __xfrm6_output(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct xfrm_state *x = dst->xfrm;
-        int mtu = ip6_skb_dst_mtu(skb);
+        int mtu;
+
+        if (skb->protocol == htons(ETH_P_IPV6))
+                mtu = ip6_skb_dst_mtu(skb);
+        else
+                mtu = dst_mtu(skb_dst(skb));
 
         if (skb->len > mtu && xfrm6_local_dontfrag(skb)) {
                 xfrm6_local_rxpmtu(skb, mtu);
                 return -EMSGSIZE;
         } else if (!skb->local_df && skb->len > mtu && skb->sk) {
-                xfrm6_local_error(skb, mtu);
+                xfrm_local_error(skb, mtu);
                 return -EMSGSIZE;
         }
 
diff --git a/net/ipv6/xfrm6_state.c b/net/ipv6/xfrm6_state.c
index d8c70b8efc24..3fc970135fc6 100644
--- a/net/ipv6/xfrm6_state.c
+++ b/net/ipv6/xfrm6_state.c
@@ -183,6 +183,7 @@ static struct xfrm_state_afinfo xfrm6_state_afinfo = {
         .extract_input          = xfrm6_extract_input,
         .extract_output         = xfrm6_extract_output,
         .transport_finish       = xfrm6_transport_finish,
+        .local_error            = xfrm6_local_error,
 };
 
 int __init xfrm6_state_init(void)