5 files changed, 18 insertions, 19 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e048ec62d109..b41ce0f0d514 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2740,10 +2740,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                         /* Flag it for later restoration when link comes up */
                         ifa->flags |= IFA_F_TENTATIVE;
                         ifa->state = INET6_IFADDR_STATE_DAD;
-
-                        write_unlock_bh(&idev->lock);
-
-                        in6_ifa_hold(ifa);
                 } else {
                         list_del(&ifa->if_list);
 
@@ -2758,19 +2754,15 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                         ifa->state = INET6_IFADDR_STATE_DEAD;
                         spin_unlock_bh(&ifa->state_lock);
 
-                        if (state == INET6_IFADDR_STATE_DEAD)
-                                goto put_ifa;
+                        if (state == INET6_IFADDR_STATE_DEAD) {
+                                in6_ifa_put(ifa);
+                        } else {
+                                __ipv6_ifa_notify(RTM_DELADDR, ifa);
+                                atomic_notifier_call_chain(&inet6addr_chain,
+                                                           NETDEV_DOWN, ifa);
+                        }
+                        write_lock_bh(&idev->lock);
                 }
-
-                __ipv6_ifa_notify(RTM_DELADDR, ifa);
-                if (ifa->state == INET6_IFADDR_STATE_DEAD)
-                        atomic_notifier_call_chain(&inet6addr_chain,
-                                                   NETDEV_DOWN, ifa);
-
-put_ifa:
-                in6_ifa_put(ifa);
-
-                write_lock_bh(&idev->lock);
         }
 
         list_splice(&keep_list, &idev->addr_list);
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 51df035897e7..455582384ece 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -1137,6 +1137,7 @@ static int get_info(struct net *net, void __user *user,
                         private = &tmp;
                 }
 #endif
+                memset(&info, 0, sizeof(info));
                 info.valid_hooks = t->valid_hooks;
                 memcpy(info.hook_entry, private->hook_entry,
                        sizeof(info.hook_entry));
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 3a3f129a44cb..79d43aa8fa8d 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -286,7 +286,7 @@ found:
 
         /* Check for overlap with preceding fragment. */
         if (prev &&
-            (NFCT_FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+            (NFCT_FRAG6_CB(prev)->offset + prev->len) > offset)
                 goto discard_fq;
 
         /* Look for overlap with succeeding segment. */
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index c7ba3149633f..0f2766453759 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -349,7 +349,7 @@ found:
 
         /* Check for overlap with preceding fragment. */
         if (prev &&
-            (FRAG6_CB(prev)->offset + prev->len) - offset > 0)
+            (FRAG6_CB(prev)->offset + prev->len) > offset)
                 goto discard_fq;
 
         /* Look for overlap with succeeding segment. */
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 25661f968f3f..96455ffb76fb 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1945,8 +1945,12 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
         struct rt6_info *rt = ip6_dst_alloc(&net->ipv6.ip6_dst_ops);
         struct neighbour *neigh;
 
-        if (rt == NULL)
+        if (rt == NULL) {
+                if (net_ratelimit())
+                        pr_warning("IPv6:  Maximum number of routes reached,"
+                                   " consider increasing route/max_size.\n");
                 return ERR_PTR(-ENOMEM);
+        }
 
         dev_hold(net->loopback_dev);
         in6_dev_hold(idev);
@@ -2741,6 +2745,7 @@ static void __net_exit ip6_route_net_exit(struct net *net)
         kfree(net->ipv6.ip6_prohibit_entry);
         kfree(net->ipv6.ip6_blk_hole_entry);
 #endif
+        dst_entries_destroy(&net->ipv6.ip6_dst_ops);
 }
 
 static struct pernet_operations ip6_route_net_ops = {
@@ -2832,5 +2837,6 @@ void ip6_route_cleanup(void)
         xfrm6_fini();
         fib6_gc_cleanup();
         unregister_pernet_subsys(&ip6_route_net_ops);
+        dst_entries_destroy(&ip6_dst_blackhole_ops);
         kmem_cache_destroy(ip6_dst_ops_template.kmem_cachep);
 }