35 files changed, 1346 insertions, 730 deletions
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index ead6c7a42f44..a578096152ab 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -170,6 +170,25 @@ config IPV6_SIT
          Saying M here will produce a module called sit. If unsure, say Y.
+config IPV6_SIT_6RD
+        bool "IPv6: IPv6 Rapid Deployment (6RD) (EXPERIMENTAL)"
+        depends on IPV6_SIT && EXPERIMENTAL
+        default n
+        ---help---
+          IPv6 Rapid Deployment (6rd; draft-ietf-softwire-ipv6-6rd) builds upon
+          mechanisms of 6to4 (RFC3056) to enable a service provider to rapidly
+          deploy IPv6 unicast service to IPv4 sites to which it provides
+          customer premise equipment.  Like 6to4, it utilizes stateless IPv6 in
+          IPv4 encapsulation in order to transit IPv4-only network
+          infrastructure.  Unlike 6to4, a 6rd service provider uses an IPv6
+          prefix of its own in place of the fixed 6to4 prefix.
+          With this option enabled, the SIT driver offers 6rd functionality by
+          providing additional ioctl API to configure the IPv6 Prefix for in
+          stead of static 2002::/16 for 6to4.
+          If unsure, say N.
 config IPV6_NDISC_NODETYPE
        bool
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index f918399c985c..de7a194a64ab 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -481,9 +481,8 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
        struct net_device *dev;
        struct inet6_dev *idev;
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
-        for_each_netdev(net, dev) {
+        for_each_netdev_rcu(net, dev) {
-                rcu_read_lock();
                idev = __in6_dev_get(dev);
                if (idev) {
                        int changed = (!idev->cnf.forwarding) ^ (!newf);
@@ -491,9 +490,8 @@ static void addrconf_forward_change(struct net *net, __s32 newf)
                        if (changed)
                                dev_forward_change(idev);
                }
-                rcu_read_unlock();
        }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
@@ -1137,10 +1135,9 @@ int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
        hiscore->rule = -1;
        hiscore->ifa = NULL;
-        read_lock(&dev_base_lock);
        rcu_read_lock();
-        for_each_netdev(net, dev) {
+        for_each_netdev_rcu(net, dev) {
                struct inet6_dev *idev;
                /* Candidate Source Address (section 4)
@@ -1235,7 +1232,6 @@ try_nextdev:
                read_unlock_bh(&idev->lock);
        }
        rcu_read_unlock();
-        read_unlock(&dev_base_lock);
        if (!hiscore->ifa)
                return -EADDRNOTAVAIL;
@@ -3485,85 +3481,114 @@ enum addr_type_t
        ANYCAST_ADDR,
 };
+/* called with rcu_read_lock() */
+static int in6_dump_addrs(struct inet6_dev *idev, struct sk_buff *skb,
+                          struct netlink_callback *cb, enum addr_type_t type,
+                          int s_ip_idx, int *p_ip_idx)
+{
+        struct inet6_ifaddr *ifa;
+        struct ifmcaddr6 *ifmca;
+        struct ifacaddr6 *ifaca;
+        int err = 1;
+        int ip_idx = *p_ip_idx;
+        read_lock_bh(&idev->lock);
+        switch (type) {
+        case UNICAST_ADDR:
+                /* unicast address incl. temp addr */
+                for (ifa = idev->addr_list; ifa;
+                     ifa = ifa->if_next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifaddr(skb, ifa,
+                                                NETLINK_CB(cb->skb).pid,
+                                                cb->nlh->nlmsg_seq,
+                                                RTM_NEWADDR,
+                                                NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        case MULTICAST_ADDR:
+                /* multicast address */
+                for (ifmca = idev->mc_list; ifmca;
+                     ifmca = ifmca->next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifmcaddr(skb, ifmca,
+                                                  NETLINK_CB(cb->skb).pid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  RTM_GETMULTICAST,
+                                                  NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        case ANYCAST_ADDR:
+                /* anycast address */
+                for (ifaca = idev->ac_list; ifaca;
+                     ifaca = ifaca->aca_next, ip_idx++) {
+                        if (ip_idx < s_ip_idx)
+                                continue;
+                        err = inet6_fill_ifacaddr(skb, ifaca,
+                                                  NETLINK_CB(cb->skb).pid,
+                                                  cb->nlh->nlmsg_seq,
+                                                  RTM_GETANYCAST,
+                                                  NLM_F_MULTI);
+                        if (err <= 0)
+                                break;
+                }
+                break;
+        default:
+                break;
+        }
+        read_unlock_bh(&idev->lock);
+        *p_ip_idx = ip_idx;
+        return err;
+}
 static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                           enum addr_type_t type)
 {
+        struct net *net = sock_net(skb->sk);
+        int h, s_h;
        int idx, ip_idx;
        int s_idx, s_ip_idx;
-        int err = 1;
        struct net_device *dev;
-        struct inet6_dev *idev = NULL;
+        struct inet6_dev *idev;
-        struct inet6_ifaddr *ifa;
+        struct hlist_head *head;
-        struct ifmcaddr6 *ifmca;
+        struct hlist_node *node;
-        struct ifacaddr6 *ifaca;
-        struct net *net = sock_net(skb->sk);
-        s_idx = cb->args[0];
-        s_ip_idx = ip_idx = cb->args[1];
-        idx = 0;
+        s_h = cb->args[0];
-        for_each_netdev(net, dev) {
+        s_idx = idx = cb->args[1];
-                if (idx < s_idx)
+        s_ip_idx = ip_idx = cb->args[2];
-                        goto cont;
-                if (idx > s_idx)
-                        s_ip_idx = 0;
-                ip_idx = 0;
-                if ((idev = in6_dev_get(dev)) == NULL)
-                        goto cont;
-                read_lock_bh(&idev->lock);
-                switch (type) {
-                case UNICAST_ADDR:
-                        /* unicast address incl. temp addr */
-                        for (ifa = idev->addr_list; ifa;
-                             ifa = ifa->if_next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                err = inet6_fill_ifaddr(skb, ifa,
-                                                        NETLINK_CB(cb->skb).pid,
-                                                        cb->nlh->nlmsg_seq,
-                                                        RTM_NEWADDR,
-                                                        NLM_F_MULTI);
-                        }
-                        break;
-                case MULTICAST_ADDR:
-                        /* multicast address */
-                        for (ifmca = idev->mc_list; ifmca;
-                             ifmca = ifmca->next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                err = inet6_fill_ifmcaddr(skb, ifmca,
-                                                          NETLINK_CB(cb->skb).pid,
-                                                          cb->nlh->nlmsg_seq,
-                                                          RTM_GETMULTICAST,
-                                                          NLM_F_MULTI);
-                        }
-                        break;
-                case ANYCAST_ADDR:
-                        /* anycast address */
-                        for (ifaca = idev->ac_list; ifaca;
-                             ifaca = ifaca->aca_next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                err = inet6_fill_ifacaddr(skb, ifaca,
-                                                          NETLINK_CB(cb->skb).pid,
-                                                          cb->nlh->nlmsg_seq,
-                                                          RTM_GETANYCAST,
-                                                          NLM_F_MULTI);
-                        }
-                        break;
-                default:
-                        break;
-                }
-                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
-                if (err <= 0)
+        rcu_read_lock();
-                        break;
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
+                idx = 0;
+                head = &net->dev_index_head[h];
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+                        if (idx < s_idx)
+                                goto cont;
+                        if (idx > s_idx)
+                                s_ip_idx = 0;
+                        ip_idx = 0;
+                        if ((idev = __in6_dev_get(dev)) == NULL)
+                                goto cont;
+                        if (in6_dump_addrs(idev, skb, cb, type,
+                                           s_ip_idx, &ip_idx) <= 0)
+                                goto done;
 cont:
-                idx++;
+                        idx++;
+                }
        }
-        cb->args[0] = idx;
+done:
-        cb->args[1] = ip_idx;
+        rcu_read_unlock();
+        cb->args[0] = h;
+        cb->args[1] = idx;
+        cb->args[2] = ip_idx;
        return skb->len;
 }
@@ -3708,6 +3733,7 @@ static inline void ipv6_store_devconf(struct ipv6_devconf *cnf,
 #endif
        array[DEVCONF_DISABLE_IPV6] = cnf->disable_ipv6;
        array[DEVCONF_ACCEPT_DAD] = cnf->accept_dad;
+        array[DEVCONF_FORCE_TLLAO] = cnf->force_tllao;
 }
 static inline size_t inet6_if_nlmsg_size(void)
@@ -3826,28 +3852,39 @@ nla_put_failure:
 static int inet6_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
 {
        struct net *net = sock_net(skb->sk);
-        int idx, err;
+        int h, s_h;
-        int s_idx = cb->args[0];
+        int idx = 0, s_idx;
        struct net_device *dev;
        struct inet6_dev *idev;
+        struct hlist_head *head;
+        struct hlist_node *node;
-        read_lock(&dev_base_lock);
+        s_h = cb->args[0];
-        idx = 0;
+        s_idx = cb->args[1];
-        for_each_netdev(net, dev) {
-                if (idx < s_idx)
+        rcu_read_lock();
-                        goto cont;
+        for (h = s_h; h < NETDEV_HASHENTRIES; h++, s_idx = 0) {
-                if ((idev = in6_dev_get(dev)) == NULL)
+                idx = 0;
-                        goto cont;
+                head = &net->dev_index_head[h];
-                err = inet6_fill_ifinfo(skb, idev, NETLINK_CB(cb->skb).pid,
+                hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
-                                cb->nlh->nlmsg_seq, RTM_NEWLINK, NLM_F_MULTI);
+                        if (idx < s_idx)
-                in6_dev_put(idev);
+                                goto cont;
-                if (err <= 0)
+                        idev = __in6_dev_get(dev);
-                        break;
+                        if (!idev)
+                                goto cont;
+                        if (inet6_fill_ifinfo(skb, idev,
+                                              NETLINK_CB(cb->skb).pid,
+                                              cb->nlh->nlmsg_seq,
+                                              RTM_NEWLINK, NLM_F_MULTI) <= 0)
+                                goto out;
 cont:
-                idx++;
+                        idx++;
+                }
        }
-        read_unlock(&dev_base_lock);
+out:
-        cb->args[0] = idx;
+        rcu_read_unlock();
+        cb->args[1] = idx;
+        cb->args[0] = h;
        return skb->len;
 }
@@ -4016,9 +4053,8 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
        struct net_device *dev;
        struct inet6_dev *idev;
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
-        for_each_netdev(net, dev) {
+        for_each_netdev_rcu(net, dev) {
-                rcu_read_lock();
                idev = __in6_dev_get(dev);
                if (idev) {
                        int changed = (!idev->cnf.disable_ipv6) ^ (!newf);
@@ -4026,9 +4062,8 @@ static void addrconf_disable_change(struct net *net, __s32 newf)
                        if (changed)
                                dev_disable_change(idev);
                }
-                rcu_read_unlock();
        }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int old)
@@ -4285,6 +4320,13 @@ static struct addrconf_sysctl_table
                        .proc_handler   =       proc_dointvec,
                },
                {
+                        .procname       = "force_tllao",
+                        .data           = &ipv6_devconf.force_tllao,
+                        .maxlen         = sizeof(int),
+                        .mode           = 0644,
+                        .proc_handler   = proc_dointvec
+                },
+                {
                        /* sentinel */
                }
        },
@@ -4385,7 +4427,7 @@ static int addrconf_init_net(struct net *net)
        all = &ipv6_devconf;
        dflt = &ipv6_devconf_dflt;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                all = kmemdup(all, sizeof(ipv6_devconf), GFP_KERNEL);
                if (all == NULL)
                        goto err_alloc_all;
@@ -4431,7 +4473,7 @@ static void addrconf_exit_net(struct net *net)
        __addrconf_sysctl_unregister(net->ipv6.devconf_dflt);
        __addrconf_sysctl_unregister(net->ipv6.devconf_all);
 #endif
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                kfree(net->ipv6.devconf_dflt);
                kfree(net->ipv6.devconf_all);
        }
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index e127a32f9540..12e69d364dd5 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -95,7 +95,8 @@ static __inline__ struct ipv6_pinfo *inet6_sk_generic(struct sock *sk)
        return (struct ipv6_pinfo *)(((u8 *)sk) + offset);
 }
-static int inet6_create(struct net *net, struct socket *sock, int protocol)
+static int inet6_create(struct net *net, struct socket *sock, int protocol,
+                        int kern)
 {
        struct inet_sock *inet;
        struct ipv6_pinfo *np;
@@ -158,7 +159,7 @@ lookup_protocol:
        }
        err = -EPERM;
-        if (answer->capability > 0 && !capable(answer->capability))
+        if (sock->type == SOCK_RAW && !kern && !capable(CAP_NET_RAW))
                goto out_rcu_unlock;
        sock->ops = answer->ops;
@@ -185,7 +186,7 @@ lookup_protocol:
        inet->is_icsk = (INET_PROTOSW_ICSK & answer_flags) != 0;
        if (SOCK_RAW == sock->type) {
-                inet->num = protocol;
+                inet->inet_num = protocol;
                if (IPPROTO_RAW == protocol)
                        inet->hdrincl = 1;
        }
@@ -228,12 +229,12 @@ lookup_protocol:
         */
        sk_refcnt_debug_inc(sk);
-        if (inet->num) {
+        if (inet->inet_num) {
                /* It assumes that any protocol which allows
                 * the user to assign a number at socket
                 * creation time automatically shares.
                 */
-                inet->sport = htons(inet->num);
+                inet->inet_sport = htons(inet->inet_num);
                sk->sk_prot->hash(sk);
        }
        if (sk->sk_prot->init) {
@@ -281,7 +282,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        lock_sock(sk);
        /* Check these errors (active socket, double bind). */
-        if (sk->sk_state != TCP_CLOSE || inet->num) {
+        if (sk->sk_state != TCP_CLOSE || inet->inet_num) {
                err = -EINVAL;
                goto out;
        }
@@ -314,6 +315,7 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                if (addr_type != IPV6_ADDR_ANY) {
                        struct net_device *dev = NULL;
+                        rcu_read_lock();
                        if (addr_type & IPV6_ADDR_LINKLOCAL) {
                                if (addr_len >= sizeof(struct sockaddr_in6) &&
                                    addr->sin6_scope_id) {
@@ -326,12 +328,12 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                                /* Binding to link-local address requires an interface */
                                if (!sk->sk_bound_dev_if) {
                                        err = -EINVAL;
-                                        goto out;
+                                        goto out_unlock;
                                }
-                                dev = dev_get_by_index(net, sk->sk_bound_dev_if);
+                                dev = dev_get_by_index_rcu(net, sk->sk_bound_dev_if);
                                if (!dev) {
                                        err = -ENODEV;
-                                        goto out;
+                                        goto out_unlock;
                                }
                        }
@@ -342,19 +344,16 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
                        if (!(addr_type & IPV6_ADDR_MULTICAST)) {
                                if (!ipv6_chk_addr(net, &addr->sin6_addr,
                                                   dev, 0)) {
-                                        if (dev)
-                                                dev_put(dev);
                                        err = -EADDRNOTAVAIL;
-                                        goto out;
+                                        goto out_unlock;
                                }
                        }
-                        if (dev)
+                        rcu_read_unlock();
-                                dev_put(dev);
                }
        }
-        inet->rcv_saddr = v4addr;
+        inet->inet_rcv_saddr = v4addr;
-        inet->saddr = v4addr;
+        inet->inet_saddr = v4addr;
        ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
@@ -375,12 +374,15 @@ int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
        }
        if (snum)
                sk->sk_userlocks |= SOCK_BINDPORT_LOCK;
-        inet->sport = htons(inet->num);
+        inet->inet_sport = htons(inet->inet_num);
-        inet->dport = 0;
+        inet->inet_dport = 0;
-        inet->daddr = 0;
+        inet->inet_daddr = 0;
 out:
        release_sock(sk);
        return err;
+out_unlock:
+        rcu_read_unlock();
+        goto out;
 }
 EXPORT_SYMBOL(inet6_bind);
@@ -441,12 +443,12 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
        sin->sin6_flowinfo = 0;
        sin->sin6_scope_id = 0;
        if (peer) {
-                if (!inet->dport)
+                if (!inet->inet_dport)
                        return -ENOTCONN;
                if (((1 << sk->sk_state) & (TCPF_CLOSE | TCPF_SYN_SENT)) &&
                    peer == 1)
                        return -ENOTCONN;
-                sin->sin6_port = inet->dport;
+                sin->sin6_port = inet->inet_dport;
                ipv6_addr_copy(&sin->sin6_addr, &np->daddr);
                if (np->sndflow)
                        sin->sin6_flowinfo = np->flow_label;
@@ -456,7 +458,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
                else
                        ipv6_addr_copy(&sin->sin6_addr, &np->rcv_saddr);
-                sin->sin6_port = inet->sport;
+                sin->sin6_port = inet->inet_sport;
        }
        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                sin->sin6_scope_id = sk->sk_bound_dev_if;
@@ -552,7 +554,7 @@ const struct proto_ops inet6_dgram_ops = {
 #endif
 };
-static struct net_proto_family inet6_family_ops = {
+static const struct net_proto_family inet6_family_ops = {
        .family = PF_INET6,
        .create = inet6_create,
        .owner  = THIS_MODULE,
@@ -654,8 +656,9 @@ int inet6_sk_rebuild_header(struct sock *sk)
                ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                fl.fl6_flowlabel = np->flow_label;
                fl.oif = sk->sk_bound_dev_if;
-                fl.fl_ip_dport = inet->dport;
+                fl.mark = sk->sk_mark;
-                fl.fl_ip_sport = inet->sport;
+                fl.fl_ip_dport = inet->inet_dport;
+                fl.fl_ip_sport = inet->inet_sport;
                security_sk_classify_flow(sk, &fl);
                if (np->opt && np->opt->srcrt) {
diff --git a/net/ipv6/ah6.c b/net/ipv6/ah6.c
index c1589e2f1dc9..c2f300c314be 100644
--- a/net/ipv6/ah6.c
+++ b/net/ipv6/ah6.c
@@ -24,18 +24,92 @@
 *      This file is derived from net/ipv4/ah.c.
 */
+#include <crypto/hash.h>
 #include <linux/module.h>
 #include <net/ip.h>
 #include <net/ah.h>
 #include <linux/crypto.h>
 #include <linux/pfkeyv2.h>
-#include <linux/spinlock.h>
 #include <linux/string.h>
+#include <linux/scatterlist.h>
 #include <net/icmp.h>
 #include <net/ipv6.h>
 #include <net/protocol.h>
 #include <net/xfrm.h>
+#define IPV6HDR_BASELEN 8
+struct tmp_ext {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                struct in6_addr saddr;
+#endif
+                struct in6_addr daddr;
+                char hdrs[0];
+};
+struct ah_skb_cb {
+        struct xfrm_skb_cb xfrm;
+        void *tmp;
+};
+#define AH_SKB_CB(__skb) ((struct ah_skb_cb *)&((__skb)->cb[0]))
+static void *ah_alloc_tmp(struct crypto_ahash *ahash, int nfrags,
+                          unsigned int size)
+{
+        unsigned int len;
+        len = size + crypto_ahash_digestsize(ahash) +
+              (crypto_ahash_alignmask(ahash) &
+               ~(crypto_tfm_ctx_alignment() - 1));
+        len = ALIGN(len, crypto_tfm_ctx_alignment());
+        len += sizeof(struct ahash_request) + crypto_ahash_reqsize(ahash);
+        len = ALIGN(len, __alignof__(struct scatterlist));
+        len += sizeof(struct scatterlist) * nfrags;
+        return kmalloc(len, GFP_ATOMIC);
+}
+static inline struct tmp_ext *ah_tmp_ext(void *base)
+{
+        return base + IPV6HDR_BASELEN;
+}
+static inline u8 *ah_tmp_auth(u8 *tmp, unsigned int offset)
+{
+        return tmp + offset;
+}
+static inline u8 *ah_tmp_icv(struct crypto_ahash *ahash, void *tmp,
+                             unsigned int offset)
+{
+        return PTR_ALIGN((u8 *)tmp + offset, crypto_ahash_alignmask(ahash) + 1);
+}
+static inline struct ahash_request *ah_tmp_req(struct crypto_ahash *ahash,
+                                               u8 *icv)
+{
+        struct ahash_request *req;
+        req = (void *)PTR_ALIGN(icv + crypto_ahash_digestsize(ahash),
+                                crypto_tfm_ctx_alignment());
+        ahash_request_set_tfm(req, ahash);
+        return req;
+}
+static inline struct scatterlist *ah_req_sg(struct crypto_ahash *ahash,
+                                             struct ahash_request *req)
+{
+        return (void *)ALIGN((unsigned long)(req + 1) +
+                             crypto_ahash_reqsize(ahash),
+                             __alignof__(struct scatterlist));
+}
 static int zero_out_mutable_opts(struct ipv6_opt_hdr *opthdr)
 {
        u8 *opt = (u8 *)opthdr;
@@ -218,24 +292,85 @@ static int ipv6_clear_mutable_options(struct ipv6hdr *iph, int len, int dir)
        return 0;
 }
+static void ah6_output_done(struct crypto_async_request *base, int err)
+{
+        int extlen;
+        u8 *iph_base;
+        u8 *icv;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = skb_dst(skb)->xfrm;
+        struct ah_data *ahp = x->data;
+        struct ipv6hdr *top_iph = ipv6_hdr(skb);
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        struct tmp_ext *iph_ext;
+        extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr);
+        if (extlen)
+                extlen += sizeof(*iph_ext);
+        iph_base = AH_SKB_CB(skb)->tmp;
+        iph_ext = ah_tmp_ext(iph_base);
+        icv = ah_tmp_icv(ahp->ahash, iph_ext, extlen);
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+        memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+        if (extlen) {
+#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+                memcpy(&top_iph->saddr, iph_ext, extlen);
+#else
+                memcpy(&top_iph->daddr, iph_ext, extlen);
+#endif
+        }
+        err = ah->nexthdr;
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_output_resume(skb, err);
+}
 static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
 {
        int err;
+        int nfrags;
        int extlen;
+        u8 *iph_base;
+        u8 *icv;
+        u8 nexthdr;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
        struct ipv6hdr *top_iph;
        struct ip_auth_hdr *ah;
        struct ah_data *ahp;
-        u8 nexthdr;
+        struct tmp_ext *iph_ext;
-        char tmp_base[8];
-        struct {
+        ahp = x->data;
-#if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
+        ahash = ahp->ahash;
-                struct in6_addr saddr;
-#endif
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
-                struct in6_addr daddr;
+                goto out;
-                char hdrs[0];
+        nfrags = err;
-        } *tmp_ext;
        skb_push(skb, -skb_network_offset(skb));
+        extlen = skb_network_header_len(skb) - sizeof(struct ipv6hdr);
+        if (extlen)
+                extlen += sizeof(*iph_ext);
+        err = -ENOMEM;
+        iph_base = ah_alloc_tmp(ahash, nfrags, IPV6HDR_BASELEN + extlen);
+        if (!iph_base)
+                goto out;
+        iph_ext = ah_tmp_ext(iph_base);
+        icv = ah_tmp_icv(ahash, iph_ext, extlen);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+        ah = ip_auth_hdr(skb);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
        top_iph = ipv6_hdr(skb);
        top_iph->payload_len = htons(skb->len - sizeof(*top_iph));
@@ -245,31 +380,22 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        /* When there are no extension headers, we only need to save the first
         * 8 bytes of the base IP header.
         */
-        memcpy(tmp_base, top_iph, sizeof(tmp_base));
+        memcpy(iph_base, top_iph, IPV6HDR_BASELEN);
-        tmp_ext = NULL;
-        extlen = skb_transport_offset(skb) - sizeof(struct ipv6hdr);
        if (extlen) {
-                extlen += sizeof(*tmp_ext);
-                tmp_ext = kmalloc(extlen, GFP_ATOMIC);
-                if (!tmp_ext) {
-                        err = -ENOMEM;
-                        goto error;
-                }
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                memcpy(tmp_ext, &top_iph->saddr, extlen);
+                memcpy(iph_ext, &top_iph->saddr, extlen);
 #else
-                memcpy(tmp_ext, &top_iph->daddr, extlen);
+                memcpy(iph_ext, &top_iph->daddr, extlen);
 #endif
                err = ipv6_clear_mutable_options(top_iph,
-                                                 extlen - sizeof(*tmp_ext) +
+                                                 extlen - sizeof(*iph_ext) +
                                                 sizeof(*top_iph),
                                                 XFRM_POLICY_OUT);
                if (err)
-                        goto error_free_iph;
+                        goto out_free;
        }
-        ah = ip_auth_hdr(skb);
        ah->nexthdr = nexthdr;
        top_iph->priority    = 0;
@@ -278,36 +404,80 @@ static int ah6_output(struct xfrm_state *x, struct sk_buff *skb)
        top_iph->flow_lbl[2] = 0;
        top_iph->hop_limit   = 0;
-        ahp = x->data;
        ah->hdrlen  = (XFRM_ALIGN8(sizeof(*ah) + ahp->icv_trunc_len) >> 2) - 2;
        ah->reserved = 0;
        ah->spi = x->id.spi;
        ah->seq_no = htonl(XFRM_SKB_CB(skb)->seq.output);
-        spin_lock_bh(&x->lock);
+        sg_init_table(sg, nfrags);
-        err = ah_mac_digest(ahp, skb, ah->auth_data);
+        skb_to_sgvec(skb, sg, 0, skb->len);
-        memcpy(ah->auth_data, ahp->work_icv, ahp->icv_trunc_len);
-        spin_unlock_bh(&x->lock);
-        if (err)
+        ahash_request_set_crypt(req, sg, icv, skb->len);
-                goto error_free_iph;
+        ahash_request_set_callback(req, 0, ah6_output_done, skb);
+        AH_SKB_CB(skb)->tmp = iph_base;
-        memcpy(top_iph, tmp_base, sizeof(tmp_base));
+        err = crypto_ahash_digest(req);
-        if (tmp_ext) {
+        if (err) {
+                if (err == -EINPROGRESS)
+                        goto out;
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
+        }
+        memcpy(ah->auth_data, icv, ahp->icv_trunc_len);
+        memcpy(top_iph, iph_base, IPV6HDR_BASELEN);
+        if (extlen) {
 #if defined(CONFIG_IPV6_MIP6) || defined(CONFIG_IPV6_MIP6_MODULE)
-                memcpy(&top_iph->saddr, tmp_ext, extlen);
+                memcpy(&top_iph->saddr, iph_ext, extlen);
 #else
-                memcpy(&top_iph->daddr, tmp_ext, extlen);
+                memcpy(&top_iph->daddr, iph_ext, extlen);
 #endif
-error_free_iph:
-                kfree(tmp_ext);
        }
-error:
+out_free:
+        kfree(iph_base);
+out:
        return err;
 }
+static void ah6_input_done(struct crypto_async_request *base, int err)
+{
+        u8 *auth_data;
+        u8 *icv;
+        u8 *work_iph;
+        struct sk_buff *skb = base->data;
+        struct xfrm_state *x = xfrm_input_state(skb);
+        struct ah_data *ahp = x->data;
+        struct ip_auth_hdr *ah = ip_auth_hdr(skb);
+        int hdr_len = skb_network_header_len(skb);
+        int ah_hlen = (ah->hdrlen + 2) << 2;
+        work_iph = AH_SKB_CB(skb)->tmp;
+        auth_data = ah_tmp_auth(work_iph, hdr_len);
+        icv = ah_tmp_icv(ahp->ahash, auth_data, ahp->icv_trunc_len);
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
+        if (err)
+                goto out;
+        skb->network_header += ah_hlen;
+        memcpy(skb_network_header(skb), work_iph, hdr_len);
+        __skb_pull(skb, ah_hlen + hdr_len);
+        skb_set_transport_header(skb, -hdr_len);
+        err = ah->nexthdr;
+out:
+        kfree(AH_SKB_CB(skb)->tmp);
+        xfrm_input_resume(skb, err);
+}
 static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
 {
        /*
@@ -325,14 +495,21 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
         * There is offset of AH before IPv6 header after the process.
         */
+        u8 *auth_data;
+        u8 *icv;
+        u8 *work_iph;
+        struct sk_buff *trailer;
+        struct crypto_ahash *ahash;
+        struct ahash_request *req;
+        struct scatterlist *sg;
        struct ip_auth_hdr *ah;
        struct ipv6hdr *ip6h;
        struct ah_data *ahp;
-        unsigned char *tmp_hdr = NULL;
        u16 hdr_len;
        u16 ah_hlen;
        int nexthdr;
-        int err = -EINVAL;
+        int nfrags;
+        int err = -ENOMEM;
        if (!pskb_may_pull(skb, sizeof(struct ip_auth_hdr)))
                goto out;
@@ -345,9 +522,11 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        skb->ip_summed = CHECKSUM_NONE;
-        hdr_len = skb->data - skb_network_header(skb);
+        hdr_len = skb_network_header_len(skb);
        ah = (struct ip_auth_hdr *)skb->data;
        ahp = x->data;
+        ahash = ahp->ahash;
        nexthdr = ah->nexthdr;
        ah_hlen = (ah->hdrlen + 2) << 2;
@@ -358,48 +537,67 @@ static int ah6_input(struct xfrm_state *x, struct sk_buff *skb)
        if (!pskb_may_pull(skb, ah_hlen))
                goto out;
-        tmp_hdr = kmemdup(skb_network_header(skb), hdr_len, GFP_ATOMIC);
-        if (!tmp_hdr)
-                goto out;
        ip6h = ipv6_hdr(skb);
+        skb_push(skb, hdr_len);
+        if ((err = skb_cow_data(skb, 0, &trailer)) < 0)
+                goto out;
+        nfrags = err;
+        work_iph = ah_alloc_tmp(ahash, nfrags, hdr_len + ahp->icv_trunc_len);
+        if (!work_iph)
+                goto out;
+        auth_data = ah_tmp_auth(work_iph, hdr_len);
+        icv = ah_tmp_icv(ahash, auth_data, ahp->icv_trunc_len);
+        req = ah_tmp_req(ahash, icv);
+        sg = ah_req_sg(ahash, req);
+        memcpy(work_iph, ip6h, hdr_len);
+        memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        memset(ah->auth_data, 0, ahp->icv_trunc_len);
        if (ipv6_clear_mutable_options(ip6h, hdr_len, XFRM_POLICY_IN))
-                goto free_out;
+                goto out_free;
        ip6h->priority    = 0;
        ip6h->flow_lbl[0] = 0;
        ip6h->flow_lbl[1] = 0;
        ip6h->flow_lbl[2] = 0;
        ip6h->hop_limit   = 0;
-        spin_lock(&x->lock);
+        sg_init_table(sg, nfrags);
-        {
+        skb_to_sgvec(skb, sg, 0, skb->len);
-                u8 auth_data[MAX_AH_AUTH_LEN];
-                memcpy(auth_data, ah->auth_data, ahp->icv_trunc_len);
+        ahash_request_set_crypt(req, sg, icv, skb->len);
-                memset(ah->auth_data, 0, ahp->icv_trunc_len);
+        ahash_request_set_callback(req, 0, ah6_input_done, skb);
-                skb_push(skb, hdr_len);
-                err = ah_mac_digest(ahp, skb, ah->auth_data);
+        AH_SKB_CB(skb)->tmp = work_iph;
-                if (err)
-                        goto unlock;
+        err = crypto_ahash_digest(req);
-                if (memcmp(ahp->work_icv, auth_data, ahp->icv_trunc_len))
+        if (err) {
-                        err = -EBADMSG;
+                if (err == -EINPROGRESS)
+                        goto out;
+                if (err == -EBUSY)
+                        err = NET_XMIT_DROP;
+                goto out_free;
        }
-unlock:
-        spin_unlock(&x->lock);
+        err = memcmp(icv, auth_data, ahp->icv_trunc_len) ? -EBADMSG: 0;
        if (err)
-                goto free_out;
+                goto out_free;
        skb->network_header += ah_hlen;
-        memcpy(skb_network_header(skb), tmp_hdr, hdr_len);
+        memcpy(skb_network_header(skb), work_iph, hdr_len);
        skb->transport_header = skb->network_header;
        __skb_pull(skb, ah_hlen + hdr_len);
-        kfree(tmp_hdr);
+        err = nexthdr;
-        return nexthdr;
+out_free:
+        kfree(work_iph);
-free_out:
-        kfree(tmp_hdr);
 out:
        return err;
 }
@@ -430,7 +628,7 @@ static int ah6_init_state(struct xfrm_state *x)
 {
        struct ah_data *ahp = NULL;
        struct xfrm_algo_desc *aalg_desc;
-        struct crypto_hash *tfm;
+        struct crypto_ahash *ahash;
        if (!x->aalg)
                goto error;
@@ -442,12 +640,12 @@ static int ah6_init_state(struct xfrm_state *x)
        if (ahp == NULL)
                return -ENOMEM;
-        tfm = crypto_alloc_hash(x->aalg->alg_name, 0, CRYPTO_ALG_ASYNC);
+        ahash = crypto_alloc_ahash(x->aalg->alg_name, 0, 0);
-        if (IS_ERR(tfm))
+        if (IS_ERR(ahash))
                goto error;
-        ahp->tfm = tfm;
+        ahp->ahash = ahash;
-        if (crypto_hash_setkey(tfm, x->aalg->alg_key,
+        if (crypto_ahash_setkey(ahash, x->aalg->alg_key,
                               (x->aalg->alg_key_len + 7) / 8))
                goto error;
@@ -461,22 +659,18 @@ static int ah6_init_state(struct xfrm_state *x)
        BUG_ON(!aalg_desc);
        if (aalg_desc->uinfo.auth.icv_fullbits/8 !=
-            crypto_hash_digestsize(tfm)) {
+            crypto_ahash_digestsize(ahash)) {
                printk(KERN_INFO "AH: %s digestsize %u != %hu\n",
-                       x->aalg->alg_name, crypto_hash_digestsize(tfm),
+                       x->aalg->alg_name, crypto_ahash_digestsize(ahash),
                       aalg_desc->uinfo.auth.icv_fullbits/8);
                goto error;
        }
        ahp->icv_full_len = aalg_desc->uinfo.auth.icv_fullbits/8;
-        ahp->icv_trunc_len = aalg_desc->uinfo.auth.icv_truncbits/8;
+        ahp->icv_trunc_len = x->aalg->alg_trunc_len/8;
        BUG_ON(ahp->icv_trunc_len > MAX_AH_AUTH_LEN);
-        ahp->work_icv = kmalloc(ahp->icv_full_len, GFP_KERNEL);
-        if (!ahp->work_icv)
-                goto error;
        x->props.header_len = XFRM_ALIGN8(sizeof(struct ip_auth_hdr) +
                                          ahp->icv_trunc_len);
        switch (x->props.mode) {
@@ -495,8 +689,7 @@ static int ah6_init_state(struct xfrm_state *x)
 error:
        if (ahp) {
-                kfree(ahp->work_icv);
+                crypto_free_ahash(ahp->ahash);
-                crypto_free_hash(ahp->tfm);
                kfree(ahp);
        }
        return -EINVAL;
@@ -509,8 +702,7 @@ static void ah6_destroy(struct xfrm_state *x)
        if (!ahp)
                return;
-        kfree(ahp->work_icv);
+        crypto_free_ahash(ahp->ahash);
-        crypto_free_hash(ahp->tfm);
        kfree(ahp);
 }
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 1ae58bec1de0..f1c74c8ef9de 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -404,13 +404,13 @@ int ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
        if (dev)
                return ipv6_chk_acast_dev(dev, addr);
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
-        for_each_netdev(net, dev)
+        for_each_netdev_rcu(net, dev)
                if (ipv6_chk_acast_dev(dev, addr)) {
                        found = 1;
                        break;
                }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
        return found;
 }
@@ -431,9 +431,9 @@ static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)
        struct net *net = seq_file_net(seq);
        state->idev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                if (!idev)
                        continue;
                read_lock_bh(&idev->lock);
@@ -443,7 +443,6 @@ static inline struct ifacaddr6 *ac6_get_first(struct seq_file *seq)
                        break;
                }
                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
        }
        return im;
 }
@@ -454,16 +453,15 @@ static struct ifacaddr6 *ac6_get_next(struct seq_file *seq, struct ifacaddr6 *im
        im = im->aca_next;
        while (!im) {
-                if (likely(state->idev != NULL)) {
+                if (likely(state->idev != NULL))
                        read_unlock_bh(&state->idev->lock);
-                        in6_dev_put(state->idev);
-                }
+                state->dev = next_net_device_rcu(state->dev);
-                state->dev = next_net_device(state->dev);
                if (!state->dev) {
                        state->idev = NULL;
                        break;
                }
-                state->idev = in6_dev_get(state->dev);
+                state->idev = __in6_dev_get(state->dev);
                if (!state->idev)
                        continue;
                read_lock_bh(&state->idev->lock);
@@ -482,29 +480,30 @@ static struct ifacaddr6 *ac6_get_idx(struct seq_file *seq, loff_t pos)
 }
 static void *ac6_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
        return ac6_get_idx(seq, *pos);
 }
 static void *ac6_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ifacaddr6 *im;
+        struct ifacaddr6 *im = ac6_get_next(seq, v);
-        im = ac6_get_next(seq, v);
        ++*pos;
        return im;
 }
 static void ac6_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
        struct ac6_iter_state *state = ac6_seq_private(seq);
        if (likely(state->idev != NULL)) {
                read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
+                state->idev = NULL;
        }
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int ac6_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index e2bdc6d83a43..e6f9cdf780fe 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -98,17 +98,15 @@ ipv4_connected:
                if (err)
                        goto out;
-                ipv6_addr_set(&np->daddr, 0, 0, htonl(0x0000ffff), inet->daddr);
+                ipv6_addr_set_v4mapped(inet->inet_daddr, &np->daddr);
-                if (ipv6_addr_any(&np->saddr)) {
+                if (ipv6_addr_any(&np->saddr))
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000ffff),
+                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
-                                      inet->saddr);
-                }
+                if (ipv6_addr_any(&np->rcv_saddr))
+                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
+                                               &np->rcv_saddr);
-                if (ipv6_addr_any(&np->rcv_saddr)) {
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000ffff),
-                                      inet->rcv_saddr);
-                }
                goto out;
        }
@@ -136,7 +134,7 @@ ipv4_connected:
        ipv6_addr_copy(&np->daddr, daddr);
        np->flow_label = fl.fl6_flowlabel;
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
        /*
         *      Check for a route to destination an obtain the
@@ -147,8 +145,9 @@ ipv4_connected:
        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
        ipv6_addr_copy(&fl.fl6_src, &np->saddr);
        fl.oif = sk->sk_bound_dev_if;
-        fl.fl_ip_dport = inet->dport;
+        fl.mark = sk->sk_mark;
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_dport = inet->inet_dport;
+        fl.fl_ip_sport = inet->inet_sport;
        if (!fl.oif && (addr_type&IPV6_ADDR_MULTICAST))
                fl.oif = np->mcast_oif;
@@ -190,7 +189,7 @@ ipv4_connected:
        if (ipv6_addr_any(&np->rcv_saddr)) {
                ipv6_addr_copy(&np->rcv_saddr, &fl.fl6_src);
-                inet->rcv_saddr = LOOPBACK4_IPV6;
+                inet->inet_rcv_saddr = LOOPBACK4_IPV6;
        }
        ip6_dst_store(sk, dst,
@@ -329,9 +328,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                        if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                                sin->sin6_scope_id = IP6CB(skb)->iif;
                } else {
-                        ipv6_addr_set(&sin->sin6_addr, 0, 0,
+                        ipv6_addr_set_v4mapped(*(__be32 *)(nh + serr->addr_offset),
-                                      htonl(0xffff),
+                                               &sin->sin6_addr);
-                                      *(__be32 *)(nh + serr->addr_offset));
                }
        }
@@ -351,8 +349,8 @@ int ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
                } else {
                        struct inet_sock *inet = inet_sk(sk);
-                        ipv6_addr_set(&sin->sin6_addr, 0, 0,
+                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
-                                      htonl(0xffff), ip_hdr(skb)->saddr);
+                                               &sin->sin6_addr);
                        if (inet->cmsg_flags)
                                ip_cmsg_recv(msg, skb);
                }
@@ -539,12 +537,17 @@ int datagram_send_ctl(struct net *net,
                        addr_type = __ipv6_addr_type(&src_info->ipi6_addr);
+                        rcu_read_lock();
                        if (fl->oif) {
-                                dev = dev_get_by_index(net, fl->oif);
+                                dev = dev_get_by_index_rcu(net, fl->oif);
-                                if (!dev)
+                                if (!dev) {
+                                        rcu_read_unlock();
                                        return -ENODEV;
-                        } else if (addr_type & IPV6_ADDR_LINKLOCAL)
+                                }
+                        } else if (addr_type & IPV6_ADDR_LINKLOCAL) {
+                                rcu_read_unlock();
                                return -EINVAL;
+                        }
                        if (addr_type != IPV6_ADDR_ANY) {
                                int strict = __ipv6_addr_src_scope(addr_type) <= IPV6_ADDR_SCOPE_LINKLOCAL;
@@ -555,8 +558,7 @@ int datagram_send_ctl(struct net *net,
                                        ipv6_addr_copy(&fl->fl6_src, &src_info->ipi6_addr);
                        }
-                        if (dev)
+                        rcu_read_unlock();
-                                dev_put(dev);
                        if (err)
                                goto exit_f;
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index af597c73ebe9..668a46b655e6 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -473,7 +473,7 @@ static int esp_init_authenc(struct xfrm_state *x)
                }
                err = crypto_aead_setauthsize(
-                        aead, aalg_desc->uinfo.auth.icv_truncbits / 8);
+                        aead, x->aalg->alg_trunc_len / 8);
                if (err)
                        goto free_key;
        }
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 00a7a5e4ac97..b7aa7c64cc4a 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -264,44 +264,36 @@ static struct fib_rules_ops fib6_rules_ops_template = {
 static int fib6_rules_net_init(struct net *net)
 {
+        struct fib_rules_ops *ops;
        int err = -ENOMEM;
-        net->ipv6.fib6_rules_ops = kmemdup(&fib6_rules_ops_template,
+        ops = fib_rules_register(&fib6_rules_ops_template, net);
-                                           sizeof(*net->ipv6.fib6_rules_ops),
+        if (IS_ERR(ops))
-                                           GFP_KERNEL);
+                return PTR_ERR(ops);
-        if (!net->ipv6.fib6_rules_ops)
+        net->ipv6.fib6_rules_ops = ops;
-                goto out;
-        net->ipv6.fib6_rules_ops->fro_net = net;
-        INIT_LIST_HEAD(&net->ipv6.fib6_rules_ops->rules_list);
        err = fib_default_rule_add(net->ipv6.fib6_rules_ops, 0,
-                                   RT6_TABLE_LOCAL, FIB_RULE_PERMANENT);
+                                   RT6_TABLE_LOCAL, 0);
        if (err)
                goto out_fib6_rules_ops;
        err = fib_default_rule_add(net->ipv6.fib6_rules_ops,
                                   0x7FFE, RT6_TABLE_MAIN, 0);
        if (err)
-                goto out_fib6_default_rule_add;
+                goto out_fib6_rules_ops;
-        err = fib_rules_register(net->ipv6.fib6_rules_ops);
-        if (err)
-                goto out_fib6_default_rule_add;
 out:
        return err;
-out_fib6_default_rule_add:
-        fib_rules_cleanup_ops(net->ipv6.fib6_rules_ops);
 out_fib6_rules_ops:
-        kfree(net->ipv6.fib6_rules_ops);
+        fib_rules_unregister(ops);
        goto out;
 }
 static void fib6_rules_net_exit(struct net *net)
 {
        fib_rules_unregister(net->ipv6.fib6_rules_ops);
-        kfree(net->ipv6.fib6_rules_ops);
 }
 static struct pernet_operations fib6_rules_net_ops = {
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index cc4797dd8325..3516e6fe2e56 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -132,7 +132,7 @@ void inet6_csk_addr2sockaddr(struct sock *sk, struct sockaddr * uaddr)
        sin6->sin6_family = AF_INET6;
        ipv6_addr_copy(&sin6->sin6_addr, &np->daddr);
-        sin6->sin6_port = inet_sk(sk)->dport;
+        sin6->sin6_port = inet_sk(sk)->inet_dport;
        /* We do not store received flowlabel for TCP */
        sin6->sin6_flowinfo = 0;
        sin6->sin6_scope_id = 0;
@@ -168,8 +168,7 @@ struct dst_entry *__inet6_csk_dst_check(struct sock *sk, u32 cookie)
        if (dst) {
                struct rt6_info *rt = (struct rt6_info *)dst;
                if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
-                        sk->sk_dst_cache = NULL;
+                        __sk_dst_reset(sk);
-                        dst_release(dst);
                        dst = NULL;
                }
        }
@@ -194,8 +193,9 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
        fl.fl6_flowlabel = np->flow_label;
        IP6_ECN_flow_xmit(sk, fl.fl6_flowlabel);
        fl.oif = sk->sk_bound_dev_if;
-        fl.fl_ip_sport = inet->sport;
+        fl.mark = sk->sk_mark;
-        fl.fl_ip_dport = inet->dport;
+        fl.fl_ip_sport = inet->inet_sport;
+        fl.fl_ip_dport = inet->inet_dport;
        security_sk_classify_flow(sk, &fl);
        if (np->opt && np->opt->srcrt) {
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 1bcc3431859e..c813e294ec0c 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -73,7 +73,7 @@ struct sock *__inet6_lookup_established(struct net *net,
         * have wildcards anyways.
         */
        unsigned int hash = inet6_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
        struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
@@ -125,7 +125,7 @@ static int inline compute_score(struct sock *sk, struct net *net,
 {
        int score = -1;
-        if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet_sk(sk)->inet_num == hnum &&
            sk->sk_family == PF_INET6) {
                const struct ipv6_pinfo *np = inet6_sk(sk);
@@ -214,15 +214,16 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
        const struct in6_addr *daddr = &np->rcv_saddr;
        const struct in6_addr *saddr = &np->daddr;
        const int dif = sk->sk_bound_dev_if;
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
        struct net *net = sock_net(sk);
        const unsigned int hash = inet6_ehashfn(net, daddr, lport, saddr,
-                                                inet->dport);
+                                                inet->inet_dport);
        struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
        spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
        struct sock *sk2;
        const struct hlist_nulls_node *node;
        struct inet_timewait_sock *tw;
+        int twrefcnt = 0;
        spin_lock(lock);
@@ -248,21 +249,25 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 unique:
        /* Must record num and sport now. Otherwise we will see
         * in hash table socket with a funny identity. */
-        inet->num = lport;
+        inet->inet_num = lport;
-        inet->sport = htons(lport);
+        inet->inet_sport = htons(lport);
+        sk->sk_hash = hash;
        WARN_ON(!sk_unhashed(sk));
        __sk_nulls_add_node_rcu(sk, &head->chain);
-        sk->sk_hash = hash;
+        if (tw) {
+                twrefcnt = inet_twsk_unhash(tw);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        }
        spin_unlock(lock);
+        if (twrefcnt)
+                inet_twsk_put(tw);
        sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
-        if (twp != NULL) {
+        if (twp) {
                *twp = tw;
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        } else if (tw) {
-        } else if (tw != NULL) {
                /* Silly. Should hash-dance instead... */
                inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
                inet_twsk_put(tw);
        }
@@ -279,7 +284,7 @@ static inline u32 inet6_sk_port_offset(const struct sock *sk)
        const struct ipv6_pinfo *np = inet6_sk(sk);
        return secure_ipv6_port_ephemeral(np->rcv_saddr.s6_addr32,
                                          np->daddr.s6_addr32,
-                                          inet->dport);
+                                          inet->inet_dport);
 }
 int inet6_hash_connect(struct inet_timewait_death_row *death_row,
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 7712578bdc66..6e7bffa2205e 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -67,7 +67,7 @@ static inline struct ip6_flowlabel *__fl_lookup(struct net *net, __be32 label)
        struct ip6_flowlabel *fl;
        for (fl=fl_ht[FL_HASH(label)]; fl; fl = fl->next) {
-                if (fl->label == label && fl->fl_net == net)
+                if (fl->label == label && net_eq(fl->fl_net, net))
                        return fl;
        }
        return NULL;
@@ -163,7 +163,8 @@ static void ip6_fl_purge(struct net *net)
                struct ip6_flowlabel *fl, **flp;
                flp = &fl_ht[i];
                while ((fl = *flp) != NULL) {
-                        if (fl->fl_net == net && atomic_read(&fl->users) == 0) {
+                        if (net_eq(fl->fl_net, net) &&
+                            atomic_read(&fl->users) == 0) {
                                *flp = fl->next;
                                fl_free(fl);
                                atomic_dec(&fl_size);
@@ -377,8 +378,8 @@ fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
                goto done;
        fl->share = freq->flr_share;
        addr_type = ipv6_addr_type(&freq->flr_dst);
-        if ((addr_type&IPV6_ADDR_MAPPED)
+        if ((addr_type & IPV6_ADDR_MAPPED) ||
-            || addr_type == IPV6_ADDR_ANY) {
+            addr_type == IPV6_ADDR_ANY) {
                err = -EINVAL;
                goto done;
        }
@@ -421,8 +422,8 @@ static int mem_check(struct sock *sk)
        if (room <= 0 ||
            ((count >= FL_MAX_PER_SOCK ||
-             (count > 0 && room < FL_MAX_SIZE/2) || room < FL_MAX_SIZE/4)
+              (count > 0 && room < FL_MAX_SIZE/2) || room < FL_MAX_SIZE/4) &&
-             && !capable(CAP_NET_ADMIN)))
+             !capable(CAP_NET_ADMIN)))
                return -ENOBUFS;
        return 0;
@@ -630,7 +631,7 @@ static struct ip6_flowlabel *ip6fl_get_first(struct seq_file *seq)
        for (state->bucket = 0; state->bucket <= FL_HASH_MASK; ++state->bucket) {
                fl = fl_ht[state->bucket];
-                while (fl && fl->fl_net != net)
+                while (fl && !net_eq(fl->fl_net, net))
                        fl = fl->next;
                if (fl)
                        break;
@@ -645,7 +646,7 @@ static struct ip6_flowlabel *ip6fl_get_next(struct seq_file *seq, struct ip6_flo
        fl = fl->next;
 try_again:
-        while (fl && fl->fl_net != net)
+        while (fl && !net_eq(fl->fl_net, net))
                fl = fl->next;
        while (!fl) {
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index c595bbe1ed99..d453d07b0dfe 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -78,7 +78,7 @@ static void ip6_fb_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_init(struct net_device *dev);
 static void ip6_tnl_dev_setup(struct net_device *dev);
-static int ip6_tnl_net_id;
+static int ip6_tnl_net_id __read_mostly;
 struct ip6_tnl_net {
        /* the IPv6 tunnel fallback device */
        struct net_device *fb_tnl_dev;
@@ -88,8 +88,10 @@ struct ip6_tnl_net {
        struct ip6_tnl **tnls[2];
 };
-/* lock for the tunnel lists */
+/*
-static DEFINE_RWLOCK(ip6_tnl_lock);
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ip6_tnl_lock);
 static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
@@ -130,6 +132,9 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
 *   else %NULL
 **/
+#define for_each_ip6_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
 static struct ip6_tnl *
 ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
 {
@@ -138,13 +143,14 @@ ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
        struct ip6_tnl *t;
        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        for (t = ip6n->tnls_r_l[h0 ^ h1]; t; t = t->next) {
+        for_each_ip6_tunnel_rcu(ip6n->tnls_r_l[h0 ^ h1]) {
                if (ipv6_addr_equal(local, &t->parms.laddr) &&
                    ipv6_addr_equal(remote, &t->parms.raddr) &&
                    (t->dev->flags & IFF_UP))
                        return t;
        }
-        if ((t = ip6n->tnls_wc[0]) != NULL && (t->dev->flags & IFF_UP))
+        t = rcu_dereference(ip6n->tnls_wc[0]);
+        if (t && (t->dev->flags & IFF_UP))
                return t;
        return NULL;
@@ -186,10 +192,10 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
        struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
+        spin_lock_bh(&ip6_tnl_lock);
        t->next = *tp;
-        write_lock_bh(&ip6_tnl_lock);
+        rcu_assign_pointer(*tp, t);
-        *tp = t;
+        spin_unlock_bh(&ip6_tnl_lock);
-        write_unlock_bh(&ip6_tnl_lock);
 }
 /**
@@ -204,9 +210,9 @@ ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
        for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
                if (t == *tp) {
-                        write_lock_bh(&ip6_tnl_lock);
+                        spin_lock_bh(&ip6_tnl_lock);
                        *tp = t->next;
-                        write_unlock_bh(&ip6_tnl_lock);
+                        spin_unlock_bh(&ip6_tnl_lock);
                        break;
                }
        }
@@ -313,9 +319,9 @@ ip6_tnl_dev_uninit(struct net_device *dev)
        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
        if (dev == ip6n->fb_tnl_dev) {
-                write_lock_bh(&ip6_tnl_lock);
+                spin_lock_bh(&ip6_tnl_lock);
                ip6n->tnls_wc[0] = NULL;
-                write_unlock_bh(&ip6_tnl_lock);
+                spin_unlock_bh(&ip6_tnl_lock);
        } else {
                ip6_tnl_unlink(ip6n, t);
        }
@@ -409,7 +415,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
           in trouble since we might need the source address for further
           processing of the error. */
-        read_lock(&ip6_tnl_lock);
+        rcu_read_lock();
        if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->daddr,
                                        &ipv6h->saddr)) == NULL)
                goto out;
@@ -482,7 +488,7 @@ ip6_tnl_err(struct sk_buff *skb, __u8 ipproto, struct inet6_skb_parm *opt,
        *msg = rel_msg;
 out:
-        read_unlock(&ip6_tnl_lock);
+        rcu_read_unlock();
        return err;
 }
@@ -652,6 +658,7 @@ static void ip6ip6_dscp_ecn_decapsulate(struct ip6_tnl *t,
                IP6_ECN_set_ce(ipv6_hdr(skb));
 }
+/* called with rcu_read_lock() */
 static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
 {
        struct ip6_tnl_parm *p = &t->parms;
@@ -662,15 +669,13 @@ static inline int ip6_tnl_rcv_ctl(struct ip6_tnl *t)
                struct net_device *ldev = NULL;
                if (p->link)
-                        ldev = dev_get_by_index(net, p->link);
+                        ldev = dev_get_by_index_rcu(net, p->link);
                if ((ipv6_addr_is_multicast(&p->laddr) ||
                     likely(ipv6_chk_addr(net, &p->laddr, ldev, 0))) &&
                    likely(!ipv6_chk_addr(net, &p->raddr, NULL, 0)))
                        ret = 1;
-                if (ldev)
-                        dev_put(ldev);
        }
        return ret;
 }
@@ -693,23 +698,23 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
        struct ip6_tnl *t;
        struct ipv6hdr *ipv6h = ipv6_hdr(skb);
-        read_lock(&ip6_tnl_lock);
+        rcu_read_lock();
        if ((t = ip6_tnl_lookup(dev_net(skb->dev), &ipv6h->saddr,
                                        &ipv6h->daddr)) != NULL) {
                if (t->parms.proto != ipproto && t->parms.proto != 0) {
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                        goto discard;
                }
                if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                        goto discard;
                }
                if (!ip6_tnl_rcv_ctl(t)) {
                        t->dev->stats.rx_dropped++;
-                        read_unlock(&ip6_tnl_lock);
+                        rcu_read_unlock();
                        goto discard;
                }
                secpath_reset(skb);
@@ -727,10 +732,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                t->dev->stats.rx_packets++;
                t->dev->stats.rx_bytes += skb->len;
                netif_rx(skb);
-                read_unlock(&ip6_tnl_lock);
+                rcu_read_unlock();
                return 0;
        }
-        read_unlock(&ip6_tnl_lock);
+        rcu_read_unlock();
        return 1;
 discard:
@@ -798,8 +803,9 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
        if (p->flags & IP6_TNL_F_CAP_XMIT) {
                struct net_device *ldev = NULL;
+                rcu_read_lock();
                if (p->link)
-                        ldev = dev_get_by_index(net, p->link);
+                        ldev = dev_get_by_index_rcu(net, p->link);
                if (unlikely(!ipv6_chk_addr(net, &p->laddr, ldev, 0)))
                        printk(KERN_WARNING
@@ -813,8 +819,7 @@ static inline int ip6_tnl_xmit_ctl(struct ip6_tnl *t)
                               p->name);
                else
                        ret = 1;
-                if (ldev)
+                rcu_read_unlock();
-                        dev_put(ldev);
        }
        return ret;
 }
@@ -1387,29 +1392,25 @@ static void ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
 {
        int h;
        struct ip6_tnl *t;
+        LIST_HEAD(list);
        for (h = 0; h < HASH_SIZE; h++) {
-                while ((t = ip6n->tnls_r_l[h]) != NULL)
+                t = ip6n->tnls_r_l[h];
-                        unregister_netdevice(t->dev);
+                while (t != NULL) {
+                        unregister_netdevice_queue(t->dev, &list);
+                        t = t->next;
+                }
        }
        t = ip6n->tnls_wc[0];
-        unregister_netdevice(t->dev);
+        unregister_netdevice_queue(t->dev, &list);
+        unregister_netdevice_many(&list);
 }
 static int ip6_tnl_init_net(struct net *net)
 {
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
        int err;
-        struct ip6_tnl_net *ip6n;
-        err = -ENOMEM;
-        ip6n = kzalloc(sizeof(struct ip6_tnl_net), GFP_KERNEL);
-        if (ip6n == NULL)
-                goto err_alloc;
-        err = net_assign_generic(net, ip6_tnl_net_id, ip6n);
-        if (err < 0)
-                goto err_assign;
        ip6n->tnls[0] = ip6n->tnls_wc;
        ip6n->tnls[1] = ip6n->tnls_r_l;
@@ -1432,27 +1433,23 @@ static int ip6_tnl_init_net(struct net *net)
 err_register:
        free_netdev(ip6n->fb_tnl_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(ip6n);
-err_alloc:
        return err;
 }
 static void ip6_tnl_exit_net(struct net *net)
 {
-        struct ip6_tnl_net *ip6n;
+        struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
-        ip6n = net_generic(net, ip6_tnl_net_id);
        rtnl_lock();
        ip6_tnl_destroy_tunnels(ip6n);
        rtnl_unlock();
-        kfree(ip6n);
 }
 static struct pernet_operations ip6_tnl_net_ops = {
        .init = ip6_tnl_init_net,
        .exit = ip6_tnl_exit_net,
+        .id   = &ip6_tnl_net_id,
+        .size = sizeof(struct ip6_tnl_net),
 };
 /**
@@ -1477,7 +1474,7 @@ static int __init ip6_tunnel_init(void)
                goto unreg_ip4ip6;
        }
-        err = register_pernet_gen_device(&ip6_tnl_net_id, &ip6_tnl_net_ops);
+        err = register_pernet_device(&ip6_tnl_net_ops);
        if (err < 0)
                goto err_pernet;
        return 0;
@@ -1501,7 +1498,7 @@ static void __exit ip6_tunnel_cleanup(void)
        if (xfrm6_tunnel_deregister(&ip6ip6_handler, AF_INET6))
                printk(KERN_INFO "ip6_tunnel close: can't deregister ip6ip6\n");
-        unregister_pernet_gen_device(ip6_tnl_net_id, &ip6_tnl_net_ops);
+        unregister_pernet_device(&ip6_tnl_net_ops);
 }
 module_init(ip6_tunnel_init);
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 716153941fc4..52e0f74fdfe0 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -477,7 +477,7 @@ failure:
 *      Delete a VIF entry
 */
-static int mif6_delete(struct net *net, int vifi)
+static int mif6_delete(struct net *net, int vifi, struct list_head *head)
 {
        struct mif_device *v;
        struct net_device *dev;
@@ -519,7 +519,7 @@ static int mif6_delete(struct net *net, int vifi)
                in6_dev->cnf.mc_forwarding--;
        if (v->flags & MIFF_REGISTER)
-                unregister_netdevice(dev);
+                unregister_netdevice_queue(dev, head);
        dev_put(dev);
        return 0;
@@ -976,6 +976,7 @@ static int ip6mr_device_event(struct notifier_block *this,
        struct net *net = dev_net(dev);
        struct mif_device *v;
        int ct;
+        LIST_HEAD(list);
        if (event != NETDEV_UNREGISTER)
                return NOTIFY_DONE;
@@ -983,8 +984,10 @@ static int ip6mr_device_event(struct notifier_block *this,
        v = &net->ipv6.vif6_table[0];
        for (ct = 0; ct < net->ipv6.maxvif; ct++, v++) {
                if (v->dev == dev)
-                        mif6_delete(net, ct);
+                        mif6_delete(net, ct, &list);
        }
+        unregister_netdevice_many(&list);
        return NOTIFY_DONE;
 }
@@ -1188,14 +1191,16 @@ static int ip6mr_mfc_add(struct net *net, struct mf6cctl *mfc, int mrtsock)
 static void mroute_clean_tables(struct net *net)
 {
        int i;
+        LIST_HEAD(list);
        /*
         *      Shut down all active vif entries
         */
        for (i = 0; i < net->ipv6.maxvif; i++) {
                if (!(net->ipv6.vif6_table[i].flags & VIFF_STATIC))
-                        mif6_delete(net, i);
+                        mif6_delete(net, i, &list);
        }
+        unregister_netdevice_many(&list);
        /*
         *      Wipe the cache
@@ -1297,7 +1302,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
        switch (optname) {
        case MRT6_INIT:
                if (sk->sk_type != SOCK_RAW ||
-                    inet_sk(sk)->num != IPPROTO_ICMPV6)
+                    inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                        return -EOPNOTSUPP;
                if (optlen < sizeof(int))
                        return -EINVAL;
@@ -1325,7 +1330,7 @@ int ip6_mroute_setsockopt(struct sock *sk, int optname, char __user *optval, uns
                if (copy_from_user(&mifi, optval, sizeof(mifi_t)))
                        return -EFAULT;
                rtnl_lock();
-                ret = mif6_delete(net, mifi);
+                ret = mif6_delete(net, mifi, NULL);
                rtnl_unlock();
                return ret;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index 4f7aaf6996a3..430454ee5ead 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -64,7 +64,7 @@ int ip6_ra_control(struct sock *sk, int sel)
        struct ip6_ra_chain *ra, *new_ra, **rap;
        /* RA packet may be delivered ONLY to IPPROTO_RAW socket */
-        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->num != IPPROTO_RAW)
+        if (sk->sk_type != SOCK_RAW || inet_sk(sk)->inet_num != IPPROTO_RAW)
                return -ENOPROTOOPT;
        new_ra = (sel>=0) ? kmalloc(sizeof(*new_ra), GFP_KERNEL) : NULL;
@@ -106,7 +106,7 @@ struct ipv6_txoptions *ipv6_update_options(struct sock *sk,
        if (inet_sk(sk)->is_icsk) {
                if (opt &&
                    !((1 << sk->sk_state) & (TCPF_LISTEN | TCPF_CLOSE)) &&
-                    inet_sk(sk)->daddr != LOOPBACK4_IPV6) {
+                    inet_sk(sk)->inet_daddr != LOOPBACK4_IPV6) {
                        struct inet_connection_sock *icsk = inet_csk(sk);
                        icsk->icsk_ext_hdr_len = opt->opt_flen + opt->opt_nflen;
                        icsk->icsk_sync_mss(sk, icsk->icsk_pmtu_cookie);
@@ -234,7 +234,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
        case IPV6_V6ONLY:
                if (optlen < sizeof(int) ||
-                    inet_sk(sk)->num)
+                    inet_sk(sk)->inet_num)
                        goto e_inval;
                np->ipv6only = valbool;
                retv = 0;
@@ -424,6 +424,7 @@ sticky_done:
                fl.fl6_flowlabel = 0;
                fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                if (optlen == 0)
                        goto update;
@@ -665,7 +666,7 @@ done:
        case IPV6_MTU_DISCOVER:
                if (optlen < sizeof(int))
                        goto e_inval;
-                if (val<0 || val>3)
+                if (val < IP_PMTUDISC_DONT || val > IP_PMTUDISC_PROBE)
                        goto e_inval;
                np->pmtudisc = val;
                retv = 0;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index f9fcf690bd5d..1f9c44442e65 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -2375,9 +2375,9 @@ static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
        struct net *net = seq_file_net(seq);
        state->idev = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                if (!idev)
                        continue;
                read_lock_bh(&idev->lock);
@@ -2387,7 +2387,6 @@ static inline struct ifmcaddr6 *igmp6_mc_get_first(struct seq_file *seq)
                        break;
                }
                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
        }
        return im;
 }
@@ -2398,16 +2397,15 @@ static struct ifmcaddr6 *igmp6_mc_get_next(struct seq_file *seq, struct ifmcaddr
        im = im->next;
        while (!im) {
-                if (likely(state->idev != NULL)) {
+                if (likely(state->idev != NULL))
                        read_unlock_bh(&state->idev->lock);
-                        in6_dev_put(state->idev);
-                }
+                state->dev = next_net_device_rcu(state->dev);
-                state->dev = next_net_device(state->dev);
                if (!state->dev) {
                        state->idev = NULL;
                        break;
                }
-                state->idev = in6_dev_get(state->dev);
+                state->idev = __in6_dev_get(state->dev);
                if (!state->idev)
                        continue;
                read_lock_bh(&state->idev->lock);
@@ -2426,31 +2424,31 @@ static struct ifmcaddr6 *igmp6_mc_get_idx(struct seq_file *seq, loff_t pos)
 }
 static void *igmp6_mc_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
        return igmp6_mc_get_idx(seq, *pos);
 }
 static void *igmp6_mc_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 {
-        struct ifmcaddr6 *im;
+        struct ifmcaddr6 *im = igmp6_mc_get_next(seq, v);
-        im = igmp6_mc_get_next(seq, v);
        ++*pos;
        return im;
 }
 static void igmp6_mc_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
        struct igmp6_mc_iter_state *state = igmp6_mc_seq_private(seq);
        if (likely(state->idev != NULL)) {
                read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
                state->idev = NULL;
        }
        state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int igmp6_mc_seq_show(struct seq_file *seq, void *v)
@@ -2507,9 +2505,9 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
        state->idev = NULL;
        state->im = NULL;
-        for_each_netdev(net, state->dev) {
+        for_each_netdev_rcu(net, state->dev) {
                struct inet6_dev *idev;
-                idev = in6_dev_get(state->dev);
+                idev = __in6_dev_get(state->dev);
                if (unlikely(idev == NULL))
                        continue;
                read_lock_bh(&idev->lock);
@@ -2525,7 +2523,6 @@ static inline struct ip6_sf_list *igmp6_mcf_get_first(struct seq_file *seq)
                        spin_unlock_bh(&im->mca_lock);
                }
                read_unlock_bh(&idev->lock);
-                in6_dev_put(idev);
        }
        return psf;
 }
@@ -2539,16 +2536,15 @@ static struct ip6_sf_list *igmp6_mcf_get_next(struct seq_file *seq, struct ip6_s
                spin_unlock_bh(&state->im->mca_lock);
                state->im = state->im->next;
                while (!state->im) {
-                        if (likely(state->idev != NULL)) {
+                        if (likely(state->idev != NULL))
                                read_unlock_bh(&state->idev->lock);
-                                in6_dev_put(state->idev);
-                        }
+                        state->dev = next_net_device_rcu(state->dev);
-                        state->dev = next_net_device(state->dev);
                        if (!state->dev) {
                                state->idev = NULL;
                                goto out;
                        }
-                        state->idev = in6_dev_get(state->dev);
+                        state->idev = __in6_dev_get(state->dev);
                        if (!state->idev)
                                continue;
                        read_lock_bh(&state->idev->lock);
@@ -2573,9 +2569,9 @@ static struct ip6_sf_list *igmp6_mcf_get_idx(struct seq_file *seq, loff_t pos)
 }
 static void *igmp6_mcf_seq_start(struct seq_file *seq, loff_t *pos)
-        __acquires(dev_base_lock)
+        __acquires(RCU)
 {
-        read_lock(&dev_base_lock);
+        rcu_read_lock();
        return *pos ? igmp6_mcf_get_idx(seq, *pos - 1) : SEQ_START_TOKEN;
 }
@@ -2591,7 +2587,7 @@ static void *igmp6_mcf_seq_next(struct seq_file *seq, void *v, loff_t *pos)
 }
 static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
-        __releases(dev_base_lock)
+        __releases(RCU)
 {
        struct igmp6_mcf_iter_state *state = igmp6_mcf_seq_private(seq);
        if (likely(state->im != NULL)) {
@@ -2600,11 +2596,10 @@ static void igmp6_mcf_seq_stop(struct seq_file *seq, void *v)
        }
        if (likely(state->idev != NULL)) {
                read_unlock_bh(&state->idev->lock);
-                in6_dev_put(state->idev);
                state->idev = NULL;
        }
        state->dev = NULL;
-        read_unlock(&dev_base_lock);
+        rcu_read_unlock();
 }
 static int igmp6_mcf_seq_show(struct seq_file *seq, void *v)
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 3d0520e455d8..c45852798092 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -598,6 +598,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
        icmp6h.icmp6_solicited = solicited;
        icmp6h.icmp6_override = override;
+        inc_opt |= ifp->idev->cnf.force_tllao;
        __ndisc_send(dev, neigh, daddr, src_addr,
                     &icmp6h, solicited_addr,
                     inc_opt ? ND_OPT_TARGET_LL_ADDR : 0);
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 14e52aa624c2..7854052be60b 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -498,10 +498,9 @@ ipq_rcv_nl_event(struct notifier_block *this,
 {
        struct netlink_notify *n = ptr;
-        if (event == NETLINK_URELEASE &&
+        if (event == NETLINK_URELEASE && n->protocol == NETLINK_IP6_FW) {
-            n->protocol == NETLINK_IP6_FW && n->pid) {
                write_lock_bh(&queue_lock);
-                if ((n->net == &init_net) && (n->pid == peer_pid))
+                if ((net_eq(n->net, &init_net)) && (n->pid == peer_pid))
                        __ipq_reset();
                write_unlock_bh(&queue_lock);
        }
@@ -623,7 +622,7 @@ cleanup_netlink_notifier:
 static void __exit ip6_queue_fini(void)
 {
        nf_unregister_queue_handlers(&nfqh);
-        synchronize_net();
        ipq_flush(NULL, 0);
 #ifdef CONFIG_SYSCTL
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index cc9f8ef303fd..480d7f8c9802 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -105,9 +105,9 @@ ip6_packet_match(const struct sk_buff *skb,
 #define FWINV(bool, invflg) ((bool) ^ !!(ip6info->invflags & (invflg)))
        if (FWINV(ipv6_masked_addr_cmp(&ipv6->saddr, &ip6info->smsk,
-                                       &ip6info->src), IP6T_INV_SRCIP)
+                                       &ip6info->src), IP6T_INV_SRCIP) ||
-            || FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
+            FWINV(ipv6_masked_addr_cmp(&ipv6->daddr, &ip6info->dmsk,
-                                          &ip6info->dst), IP6T_INV_DSTIP)) {
+                                       &ip6info->dst), IP6T_INV_DSTIP)) {
                dprintf("Source or dest mismatch.\n");
 /*
                dprintf("SRC: %u. Mask: %u. Target: %u.%s\n", ip->saddr,
@@ -277,11 +277,11 @@ get_chainname_rulenum(struct ip6t_entry *s, struct ip6t_entry *e,
        } else if (s == e) {
                (*rulenum)++;
-                if (s->target_offset == sizeof(struct ip6t_entry)
+                if (s->target_offset == sizeof(struct ip6t_entry) &&
-                   && strcmp(t->target.u.kernel.target->name,
+                    strcmp(t->target.u.kernel.target->name,
-                             IP6T_STANDARD_TARGET) == 0
+                           IP6T_STANDARD_TARGET) == 0 &&
-                   && t->verdict < 0
+                    t->verdict < 0 &&
-                   && unconditional(&s->ipv6)) {
+                    unconditional(&s->ipv6)) {
                        /* Tail of chains: STANDARD target (return/policy) */
                        *comment = *chainname == hookname
                                ? comments[NF_IP6_TRACE_COMMENT_POLICY]
@@ -418,8 +418,8 @@ ip6t_do_table(struct sk_buff *skb,
                                back = get_entry(table_base, back->comefrom);
                                continue;
                        }
-                        if (table_base + v != ip6t_next_entry(e)
+                        if (table_base + v != ip6t_next_entry(e) &&
-                            && !(e->ipv6.flags & IP6T_F_GOTO)) {
+                            !(e->ipv6.flags & IP6T_F_GOTO)) {
                                /* Save old back ptr in next entry */
                                struct ip6t_entry *next = ip6t_next_entry(e);
                                next->comefrom = (void *)back - table_base;
@@ -505,11 +505,11 @@ mark_source_chains(struct xt_table_info *newinfo,
                        e->comefrom |= ((1 << hook) | (1 << NF_INET_NUMHOOKS));
                        /* Unconditional return/END. */
-                        if ((e->target_offset == sizeof(struct ip6t_entry)
+                        if ((e->target_offset == sizeof(struct ip6t_entry) &&
-                            && (strcmp(t->target.u.user.name,
+                             (strcmp(t->target.u.user.name,
-                                       IP6T_STANDARD_TARGET) == 0)
+                                     IP6T_STANDARD_TARGET) == 0) &&
-                            && t->verdict < 0
+                             t->verdict < 0 &&
-                            && unconditional(&e->ipv6)) || visited) {
+                             unconditional(&e->ipv6)) || visited) {
                                unsigned int oldpos, size;
                                if ((strcmp(t->target.u.user.name,
@@ -556,8 +556,8 @@ mark_source_chains(struct xt_table_info *newinfo,
                                int newpos = t->verdict;
                                if (strcmp(t->target.u.user.name,
-                                           IP6T_STANDARD_TARGET) == 0
+                                           IP6T_STANDARD_TARGET) == 0 &&
-                                    && newpos >= 0) {
+                                    newpos >= 0) {
                                        if (newpos > newinfo->size -
                                                sizeof(struct ip6t_entry)) {
                                                duprintf("mark_source_chains: "
@@ -767,8 +767,8 @@ check_entry_size_and_hooks(struct ip6t_entry *e,
 {
        unsigned int h;
-        if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0
+        if ((unsigned long)e % __alignof__(struct ip6t_entry) != 0 ||
-            || (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct ip6t_entry) >= limit) {
                duprintf("Bad offset %p\n", e);
                return -EINVAL;
        }
@@ -1584,8 +1584,8 @@ check_compat_entry_size_and_hooks(struct compat_ip6t_entry *e,
        int ret, off, h;
        duprintf("check_compat_entry_size_and_hooks %p\n", e);
-        if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0
+        if ((unsigned long)e % __alignof__(struct compat_ip6t_entry) != 0 ||
-            || (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
+            (unsigned char *)e + sizeof(struct compat_ip6t_entry) >= limit) {
                duprintf("Bad offset %p, limit = %p\n", e, limit);
                return -EINVAL;
        }
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index 7018cac4fddc..b285fdf19050 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -249,8 +249,8 @@ static void dump_packet(const struct nf_loginfo *info,
                /* Max length: 11 "URGP=65535 " */
                printk("URGP=%u ", ntohs(th->urg_ptr));
-                if ((logflags & IP6T_LOG_TCPOPT)
+                if ((logflags & IP6T_LOG_TCPOPT) &&
-                    && th->doff * 4 > sizeof(struct tcphdr)) {
+                    th->doff * 4 > sizeof(struct tcphdr)) {
                        u_int8_t _opt[60 - sizeof(struct tcphdr)];
                        const u_int8_t *op;
                        unsigned int i;
diff --git a/net/ipv6/netfilter/ip6t_REJECT.c b/net/ipv6/netfilter/ip6t_REJECT.c
index 5a7f00cd15ce..8311ca31816a 100644
--- a/net/ipv6/netfilter/ip6t_REJECT.c
+++ b/net/ipv6/netfilter/ip6t_REJECT.c
@@ -223,8 +223,8 @@ static bool reject_tg6_check(const struct xt_tgchk_param *par)
                return false;
        } else if (rejinfo->with == IP6T_TCP_RESET) {
                /* Must specify that it's a TCP packet */
-                if (e->ipv6.proto != IPPROTO_TCP
+                if (e->ipv6.proto != IPPROTO_TCP ||
-                    || (e->ipv6.invflags & XT_INV_PROTO)) {
+                    (e->ipv6.invflags & XT_INV_PROTO)) {
                        printk("ip6t_REJECT: TCP_RESET illegal for non-tcp\n");
                        return false;
                }
diff --git a/net/ipv6/netfilter/ip6t_ah.c b/net/ipv6/netfilter/ip6t_ah.c
index 3a82f24746b9..ac0b7c629d78 100644
--- a/net/ipv6/netfilter/ip6t_ah.c
+++ b/net/ipv6/netfilter/ip6t_ah.c
@@ -77,17 +77,14 @@ static bool ah_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                 ahinfo->hdrres, ah->reserved,
                 !(ahinfo->hdrres && ah->reserved));
-        return (ah != NULL)
+        return (ah != NULL) &&
-               &&
+                spi_match(ahinfo->spis[0], ahinfo->spis[1],
-               spi_match(ahinfo->spis[0], ahinfo->spis[1],
+                          ntohl(ah->spi),
-                         ntohl(ah->spi),
+                          !!(ahinfo->invflags & IP6T_AH_INV_SPI)) &&
-                         !!(ahinfo->invflags & IP6T_AH_INV_SPI))
+                (!ahinfo->hdrlen ||
-               &&
+                 (ahinfo->hdrlen == hdrlen) ^
-               (!ahinfo->hdrlen ||
+                 !!(ahinfo->invflags & IP6T_AH_INV_LEN)) &&
-                (ahinfo->hdrlen == hdrlen) ^
+                !(ahinfo->hdrres && ah->reserved);
-                !!(ahinfo->invflags & IP6T_AH_INV_LEN))
-               &&
-               !(ahinfo->hdrres && ah->reserved);
 }
 static bool ah_mt6_check(const struct xt_mtchk_param *par)
diff --git a/net/ipv6/netfilter/ip6t_frag.c b/net/ipv6/netfilter/ip6t_frag.c
index 673aa0a5084e..7b91c2598ed5 100644
--- a/net/ipv6/netfilter/ip6t_frag.c
+++ b/net/ipv6/netfilter/ip6t_frag.c
@@ -70,41 +70,36 @@ frag_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
        pr_debug("res %02X %02X%04X %02X ",
                 fraginfo->flags & IP6T_FRAG_RES, fh->reserved,
                 ntohs(fh->frag_off) & 0x6,
-                 !((fraginfo->flags & IP6T_FRAG_RES)
+                 !((fraginfo->flags & IP6T_FRAG_RES) &&
-                   && (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
+                   (fh->reserved || (ntohs(fh->frag_off) & 0x06))));
        pr_debug("first %02X %02X %02X ",
                 fraginfo->flags & IP6T_FRAG_FST,
                 ntohs(fh->frag_off) & ~0x7,
-                 !((fraginfo->flags & IP6T_FRAG_FST)
+                 !((fraginfo->flags & IP6T_FRAG_FST) &&
-                   && (ntohs(fh->frag_off) & ~0x7)));
+                   (ntohs(fh->frag_off) & ~0x7)));
        pr_debug("mf %02X %02X %02X ",
                 fraginfo->flags & IP6T_FRAG_MF,
                 ntohs(fh->frag_off) & IP6_MF,
-                 !((fraginfo->flags & IP6T_FRAG_MF)
+                 !((fraginfo->flags & IP6T_FRAG_MF) &&
-                   && !((ntohs(fh->frag_off) & IP6_MF))));
+                   !((ntohs(fh->frag_off) & IP6_MF))));
        pr_debug("last %02X %02X %02X\n",
                 fraginfo->flags & IP6T_FRAG_NMF,
                 ntohs(fh->frag_off) & IP6_MF,
-                 !((fraginfo->flags & IP6T_FRAG_NMF)
+                 !((fraginfo->flags & IP6T_FRAG_NMF) &&
-                   && (ntohs(fh->frag_off) & IP6_MF)));
+                   (ntohs(fh->frag_off) & IP6_MF)));
-        return (fh != NULL)
+        return (fh != NULL) &&
-               &&
+                id_match(fraginfo->ids[0], fraginfo->ids[1],
-               id_match(fraginfo->ids[0], fraginfo->ids[1],
+                         ntohl(fh->identification),
-                        ntohl(fh->identification),
+                         !!(fraginfo->invflags & IP6T_FRAG_INV_IDS)) &&
-                        !!(fraginfo->invflags & IP6T_FRAG_INV_IDS))
+                !((fraginfo->flags & IP6T_FRAG_RES) &&
-               &&
+                  (fh->reserved || (ntohs(fh->frag_off) & 0x6))) &&
-               !((fraginfo->flags & IP6T_FRAG_RES)
+                !((fraginfo->flags & IP6T_FRAG_FST) &&
-                 && (fh->reserved || (ntohs(fh->frag_off) & 0x6)))
+                  (ntohs(fh->frag_off) & ~0x7)) &&
-               &&
+                !((fraginfo->flags & IP6T_FRAG_MF) &&
-               !((fraginfo->flags & IP6T_FRAG_FST)
+                  !(ntohs(fh->frag_off) & IP6_MF)) &&
-                 && (ntohs(fh->frag_off) & ~0x7))
+                !((fraginfo->flags & IP6T_FRAG_NMF) &&
-               &&
+                  (ntohs(fh->frag_off) & IP6_MF));
-               !((fraginfo->flags & IP6T_FRAG_MF)
-                 && !(ntohs(fh->frag_off) & IP6_MF))
-               &&
-               !((fraginfo->flags & IP6T_FRAG_NMF)
-                 && (ntohs(fh->frag_off) & IP6_MF));
 }
 static bool frag_mt6_check(const struct xt_mtchk_param *par)
diff --git a/net/ipv6/netfilter/ip6t_rt.c b/net/ipv6/netfilter/ip6t_rt.c
index 356b8d6f6baa..b77307fc8743 100644
--- a/net/ipv6/netfilter/ip6t_rt.c
+++ b/net/ipv6/netfilter/ip6t_rt.c
@@ -92,16 +92,13 @@ static bool rt_mt6(const struct sk_buff *skb, const struct xt_match_param *par)
                 !((rtinfo->flags & IP6T_RT_RES) &&
                   (((const struct rt0_hdr *)rh)->reserved)));
-        ret = (rh != NULL)
+        ret = (rh != NULL) &&
-              &&
              (segsleft_match(rtinfo->segsleft[0], rtinfo->segsleft[1],
                              rh->segments_left,
-                              !!(rtinfo->invflags & IP6T_RT_INV_SGS)))
+                              !!(rtinfo->invflags & IP6T_RT_INV_SGS))) &&
-              &&
              (!(rtinfo->flags & IP6T_RT_LEN) ||
               ((rtinfo->hdrlen == hdrlen) ^
-                !!(rtinfo->invflags & IP6T_RT_INV_LEN)))
+                !!(rtinfo->invflags & IP6T_RT_INV_LEN))) &&
-              &&
              (!(rtinfo->flags & IP6T_RT_TYP) ||
               ((rtinfo->rt_type == rh->type) ^
                !!(rtinfo->invflags & IP6T_RT_INV_TYP)));
diff --git a/net/ipv6/netfilter/ip6table_filter.c b/net/ipv6/netfilter/ip6table_filter.c
index 6f4383ad86f9..ad378efd0eb8 100644
--- a/net/ipv6/netfilter/ip6table_filter.c
+++ b/net/ipv6/netfilter/ip6table_filter.c
@@ -79,8 +79,8 @@ ip6t_local_out_hook(unsigned int hook,
 {
 #if 0
        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
+        if (skb->len < sizeof(struct iphdr) ||
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("ip6t_hook: happy cracking.\n");
                return NF_ACCEPT;
diff --git a/net/ipv6/netfilter/ip6table_mangle.c b/net/ipv6/netfilter/ip6table_mangle.c
index 0ad91433ed61..a929c19d30e3 100644
--- a/net/ipv6/netfilter/ip6table_mangle.c
+++ b/net/ipv6/netfilter/ip6table_mangle.c
@@ -102,8 +102,8 @@ ip6t_local_out_hook(unsigned int hook,
 #if 0
        /* root is playing with raw sockets. */
-        if (skb->len < sizeof(struct iphdr)
+        if (skb->len < sizeof(struct iphdr) ||
-            || ip_hdrlen(skb) < sizeof(struct iphdr)) {
+            ip_hdrlen(skb) < sizeof(struct iphdr)) {
                if (net_ratelimit())
                        printk("ip6t_hook: happy cracking.\n");
                return NF_ACCEPT;
@@ -122,11 +122,11 @@ ip6t_local_out_hook(unsigned int hook,
        ret = ip6t_do_table(skb, hook, in, out,
                            dev_net(out)->ipv6.ip6table_mangle);
-        if (ret != NF_DROP && ret != NF_STOLEN
+        if (ret != NF_DROP && ret != NF_STOLEN &&
-                && (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr))
+            (memcmp(&ipv6_hdr(skb)->saddr, &saddr, sizeof(saddr)) ||
-                    || memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr))
+             memcmp(&ipv6_hdr(skb)->daddr, &daddr, sizeof(daddr)) ||
-                    || skb->mark != mark
+             skb->mark != mark ||
-                    || ipv6_hdr(skb)->hop_limit != hop_limit))
+             ipv6_hdr(skb)->hop_limit != hop_limit))
                return ip6_route_me_harder(skb) == 0 ? ret : NF_DROP;
        return ret;
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index 2acadc8c7883..c7b8bd1d7984 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -244,18 +244,18 @@ static const struct nla_policy icmpv6_nla_policy[CTA_PROTO_MAX+1] = {
 static int icmpv6_nlattr_to_tuple(struct nlattr *tb[],
                                struct nf_conntrack_tuple *tuple)
 {
-        if (!tb[CTA_PROTO_ICMPV6_TYPE]
+        if (!tb[CTA_PROTO_ICMPV6_TYPE] ||
-            || !tb[CTA_PROTO_ICMPV6_CODE]
+            !tb[CTA_PROTO_ICMPV6_CODE] ||
-            || !tb[CTA_PROTO_ICMPV6_ID])
+            !tb[CTA_PROTO_ICMPV6_ID])
                return -EINVAL;
        tuple->dst.u.icmp.type = nla_get_u8(tb[CTA_PROTO_ICMPV6_TYPE]);
        tuple->dst.u.icmp.code = nla_get_u8(tb[CTA_PROTO_ICMPV6_CODE]);
        tuple->src.u.icmp.id = nla_get_be16(tb[CTA_PROTO_ICMPV6_ID]);
-        if (tuple->dst.u.icmp.type < 128
+        if (tuple->dst.u.icmp.type < 128 ||
-            || tuple->dst.u.icmp.type - 128 >= sizeof(invmap)
+            tuple->dst.u.icmp.type - 128 >= sizeof(invmap) ||
-            || !invmap[tuple->dst.u.icmp.type - 128])
+            !invmap[tuple->dst.u.icmp.type - 128])
                return -EINVAL;
        return 0;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 4f24570b0869..926ce8eeffaf 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -72,7 +72,7 @@ static struct sock *__raw_v6_lookup(struct net *net, struct sock *sk,
        int is_multicast = ipv6_addr_is_multicast(loc_addr);
        sk_for_each_from(sk, node)
-                if (inet_sk(sk)->num == num) {
+                if (inet_sk(sk)->inet_num == num) {
                        struct ipv6_pinfo *np = inet6_sk(sk);
                        if (!net_eq(sock_net(sk), net))
@@ -249,7 +249,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        /* Raw sockets are IPv6 only */
        if (addr_type == IPV6_ADDR_MAPPED)
-                return(-EADDRNOTAVAIL);
+                return -EADDRNOTAVAIL;
        lock_sock(sk);
@@ -257,6 +257,7 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
        if (sk->sk_state != TCP_CLOSE)
                goto out;
+        rcu_read_lock();
        /* Check if the address belongs to the host. */
        if (addr_type != IPV6_ADDR_ANY) {
                struct net_device *dev = NULL;
@@ -272,13 +273,13 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                        /* Binding to link-local address requires an interface */
                        if (!sk->sk_bound_dev_if)
-                                goto out;
+                                goto out_unlock;
-                        dev = dev_get_by_index(sock_net(sk), sk->sk_bound_dev_if);
+                        err = -ENODEV;
-                        if (!dev) {
+                        dev = dev_get_by_index_rcu(sock_net(sk),
-                                err = -ENODEV;
+                                                   sk->sk_bound_dev_if);
-                                goto out;
+                        if (!dev)
-                        }
+                                goto out_unlock;
                }
                /* ipv4 addr of the socket is invalid.  Only the
@@ -289,20 +290,18 @@ static int rawv6_bind(struct sock *sk, struct sockaddr *uaddr, int addr_len)
                        err = -EADDRNOTAVAIL;
                        if (!ipv6_chk_addr(sock_net(sk), &addr->sin6_addr,
                                           dev, 0)) {
-                                if (dev)
+                                goto out_unlock;
-                                        dev_put(dev);
-                                goto out;
                        }
                }
-                if (dev)
-                        dev_put(dev);
        }
-        inet->rcv_saddr = inet->saddr = v4addr;
+        inet->inet_rcv_saddr = inet->inet_saddr = v4addr;
        ipv6_addr_copy(&np->rcv_saddr, &addr->sin6_addr);
        if (!(addr_type & IPV6_ADDR_MULTICAST))
                ipv6_addr_copy(&np->saddr, &addr->sin6_addr);
        err = 0;
+out_unlock:
+        rcu_read_unlock();
 out:
        release_sock(sk);
        return err;
@@ -381,8 +380,7 @@ static inline int rawv6_rcv_skb(struct sock * sk, struct sk_buff * skb)
        }
        /* Charge it to the socket. */
-        if (sock_queue_rcv_skb(sk,skb)<0) {
+        if (sock_queue_rcv_skb(sk, skb) < 0) {
-                atomic_inc(&sk->sk_drops);
                kfree_skb(skb);
                return NET_RX_DROP;
        }
@@ -416,14 +414,14 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
                                   skb_network_header_len(skb));
                if (!csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                     &ipv6_hdr(skb)->daddr,
-                                     skb->len, inet->num, skb->csum))
+                                     skb->len, inet->inet_num, skb->csum))
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
        }
        if (!skb_csum_unnecessary(skb))
                skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
                                                         &ipv6_hdr(skb)->daddr,
                                                         skb->len,
-                                                         inet->num, 0));
+                                                         inet->inet_num, 0));
        if (inet->hdrincl) {
                if (skb_checksum_complete(skb)) {
@@ -497,7 +495,7 @@ static int rawv6_recvmsg(struct kiocb *iocb, struct sock *sk,
                        sin6->sin6_scope_id = IP6CB(skb)->iif;
        }
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
        if (np->rxopt.all)
                datagram_recv_ctl(sk, msg, skb);
@@ -518,7 +516,6 @@ csum_copy_err:
           as some normal condition.
         */
        err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
-        atomic_inc(&sk->sk_drops);
        goto out;
 }
@@ -766,8 +763,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                proto = ntohs(sin6->sin6_port);
                if (!proto)
-                        proto = inet->num;
+                        proto = inet->inet_num;
-                else if (proto != inet->num)
+                else if (proto != inet->inet_num)
                        return(-EINVAL);
                if (proto > 255)
@@ -800,7 +797,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -EDESTADDRREQ;
-                proto = inet->num;
+                proto = inet->inet_num;
                daddr = &np->daddr;
                fl.fl6_flowlabel = np->flow_label;
        }
@@ -967,7 +964,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
        switch (optname) {
                case IPV6_CHECKSUM:
-                        if (inet_sk(sk)->num == IPPROTO_ICMPV6 &&
+                        if (inet_sk(sk)->inet_num == IPPROTO_ICMPV6 &&
                            level == IPPROTO_IPV6) {
                                /*
                                 * RFC3542 tells that IPV6_CHECKSUM socket
@@ -1007,7 +1004,7 @@ static int rawv6_setsockopt(struct sock *sk, int level, int optname,
                        break;
                case SOL_ICMPV6:
-                        if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                        if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                                return -EOPNOTSUPP;
                        return rawv6_seticmpfilter(sk, level, optname, optval,
                                                   optlen);
@@ -1030,7 +1027,7 @@ static int compat_rawv6_setsockopt(struct sock *sk, int level, int optname,
        case SOL_RAW:
                break;
        case SOL_ICMPV6:
-                if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                        return -EOPNOTSUPP;
                return rawv6_seticmpfilter(sk, level, optname, optval, optlen);
        case SOL_IPV6:
@@ -1087,7 +1084,7 @@ static int rawv6_getsockopt(struct sock *sk, int level, int optname,
                        break;
                case SOL_ICMPV6:
-                        if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                        if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                                return -EOPNOTSUPP;
                        return rawv6_geticmpfilter(sk, level, optname, optval,
                                                   optlen);
@@ -1110,7 +1107,7 @@ static int compat_rawv6_getsockopt(struct sock *sk, int level, int optname,
        case SOL_RAW:
                break;
        case SOL_ICMPV6:
-                if (inet_sk(sk)->num != IPPROTO_ICMPV6)
+                if (inet_sk(sk)->inet_num != IPPROTO_ICMPV6)
                        return -EOPNOTSUPP;
                return rawv6_geticmpfilter(sk, level, optname, optval, optlen);
        case SOL_IPV6:
@@ -1157,7 +1154,7 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
 static void rawv6_close(struct sock *sk, long timeout)
 {
-        if (inet_sk(sk)->num == IPPROTO_RAW)
+        if (inet_sk(sk)->inet_num == IPPROTO_RAW)
                ip6_ra_control(sk, -1);
        ip6mr_sk_done(sk);
        sk_common_release(sk);
@@ -1176,7 +1173,7 @@ static int rawv6_init_sk(struct sock *sk)
 {
        struct raw6_sock *rp = raw6_sk(sk);
-        switch (inet_sk(sk)->num) {
+        switch (inet_sk(sk)->inet_num) {
        case IPPROTO_ICMPV6:
                rp->checksum = 1;
                rp->offset   = 2;
@@ -1226,7 +1223,7 @@ static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
        dest  = &np->daddr;
        src   = &np->rcv_saddr;
        destp = 0;
-        srcp  = inet_sk(sp)->num;
+        srcp  = inet_sk(sp)->inet_num;
        seq_printf(seq,
                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
@@ -1338,7 +1335,6 @@ static struct inet_protosw rawv6_protosw = {
        .protocol       = IPPROTO_IP,   /* wild card */
        .prot           = &rawv6_prot,
        .ops            = &inet6_sockraw_ops,
-        .capability     = CAP_NET_RAW,
        .no_check       = UDP_CSUM_DEFAULT,
        .flags          = INET_PROTOSW_REUSE,
 };
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 2499e9712031..4d98549a6868 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -208,18 +208,17 @@ static void ip6_frag_expire(unsigned long data)
        fq_kill(fq);
        net = container_of(fq->q.net, struct net, ipv6.frags);
-        dev = dev_get_by_index(net, fq->iif);
+        rcu_read_lock();
+        dev = dev_get_by_index_rcu(net, fq->iif);
        if (!dev)
-                goto out;
+                goto out_rcu_unlock;
-        rcu_read_lock();
        IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMTIMEOUT);
        IP6_INC_STATS_BH(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
-        rcu_read_unlock();
        /* Don't send error if the first segment did not arrive. */
        if (!(fq->q.last_in & INET_FRAG_FIRST_IN) || !fq->q.fragments)
-                goto out;
+                goto out_rcu_unlock;
        /*
           But use as source device on which LAST ARRIVED
@@ -228,9 +227,9 @@ static void ip6_frag_expire(unsigned long data)
         */
        fq->q.fragments->dev = dev;
        icmpv6_send(fq->q.fragments, ICMPV6_TIME_EXCEED, ICMPV6_EXC_FRAGTIME, 0, dev);
+out_rcu_unlock:
+        rcu_read_unlock();
 out:
-        if (dev)
-                dev_put(dev);
        spin_unlock(&fq->q.lock);
        fq_put(fq);
 }
@@ -676,7 +675,7 @@ static int ip6_frags_ns_sysctl_register(struct net *net)
        struct ctl_table_header *hdr;
        table = ip6_frags_ns_ctl_table;
-        if (net != &init_net) {
+        if (!net_eq(net, &init_net)) {
                table = kmemdup(table, sizeof(ip6_frags_ns_ctl_table), GFP_KERNEL);
                if (table == NULL)
                        goto err_alloc;
@@ -694,7 +693,7 @@ static int ip6_frags_ns_sysctl_register(struct net *net)
        return 0;
 err_reg:
-        if (net != &init_net)
+        if (!net_eq(net, &init_net))
                kfree(table);
 err_alloc:
        return -ENOMEM;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6aa202e26f97..db3b27303890 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1471,9 +1471,10 @@ static struct rt6_info *ip6_route_redirect(struct in6_addr *dest,
                                },
                        },
                },
-                .gateway = *gateway,
        };
+        ipv6_addr_copy(&rdfl.gateway, gateway);
        if (rt6_need_strict(dest))
                flags |= RT6_LOOKUP_F_IFACE;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index dbd19a78ca73..976e68244b99 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -66,7 +66,7 @@ static void ipip6_fb_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_init(struct net_device *dev);
 static void ipip6_tunnel_setup(struct net_device *dev);
-static int sit_net_id;
+static int sit_net_id __read_mostly;
 struct sit_net {
        struct ip_tunnel *tunnels_r_l[HASH_SIZE];
        struct ip_tunnel *tunnels_r[HASH_SIZE];
@@ -77,8 +77,17 @@ struct sit_net {
        struct net_device *fb_tunnel_dev;
 };
-static DEFINE_RWLOCK(ipip6_lock);
+/*
+ * Locking : hash tables are protected by RCU and a spinlock
+ */
+static DEFINE_SPINLOCK(ipip6_lock);
+#define for_each_ip_tunnel_rcu(start) \
+        for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
+/*
+ * Must be invoked with rcu_read_lock
+ */
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                struct net_device *dev, __be32 remote, __be32 local)
 {
@@ -87,26 +96,26 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
        struct ip_tunnel *t;
        struct sit_net *sitn = net_generic(net, sit_net_id);
-        for (t = sitn->tunnels_r_l[h0^h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r_l[h0 ^ h1]) {
                if (local == t->parms.iph.saddr &&
                    remote == t->parms.iph.daddr &&
                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                    (t->dev->flags & IFF_UP))
                        return t;
        }
-        for (t = sitn->tunnels_r[h0]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_r[h0]) {
                if (remote == t->parms.iph.daddr &&
                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                    (t->dev->flags & IFF_UP))
                        return t;
        }
-        for (t = sitn->tunnels_l[h1]; t; t = t->next) {
+        for_each_ip_tunnel_rcu(sitn->tunnels_l[h1]) {
                if (local == t->parms.iph.saddr &&
                    (!dev || !t->parms.link || dev->iflink == t->parms.link) &&
                    (t->dev->flags & IFF_UP))
                        return t;
        }
-        t = sitn->tunnels_wc[0];
+        t = rcu_dereference(sitn->tunnels_wc[0]);
        if ((t != NULL) && (t->dev->flags & IFF_UP))
                return t;
        return NULL;
@@ -143,9 +152,9 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
        for (tp = ipip6_bucket(sitn, t); *tp; tp = &(*tp)->next) {
                if (t == *tp) {
-                        write_lock_bh(&ipip6_lock);
+                        spin_lock_bh(&ipip6_lock);
                        *tp = t->next;
-                        write_unlock_bh(&ipip6_lock);
+                        spin_unlock_bh(&ipip6_lock);
                        break;
                }
        }
@@ -155,10 +164,27 @@ static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
        struct ip_tunnel **tp = ipip6_bucket(sitn, t);
+        spin_lock_bh(&ipip6_lock);
        t->next = *tp;
-        write_lock_bh(&ipip6_lock);
+        rcu_assign_pointer(*tp, t);
-        *tp = t;
+        spin_unlock_bh(&ipip6_lock);
-        write_unlock_bh(&ipip6_lock);
+}
+static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
+{
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel *t = netdev_priv(dev);
+        if (t->dev == sitn->fb_tunnel_dev) {
+                ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
+                t->ip6rd.relay_prefix = 0;
+                t->ip6rd.prefixlen = 16;
+                t->ip6rd.relay_prefixlen = 0;
+        } else {
+                struct ip_tunnel *t0 = netdev_priv(sitn->fb_tunnel_dev);
+                memcpy(&t->ip6rd, &t0->ip6rd, sizeof(t->ip6rd));
+        }
+#endif
 }
 static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
@@ -204,6 +230,7 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
        nt->parms = *parms;
        ipip6_tunnel_init(dev);
+        ipip6_tunnel_clone_6rd(dev, sitn);
        if (parms->i_flags & SIT_ISATAP)
                dev->priv_flags |= IFF_ISATAP;
@@ -222,15 +249,22 @@ failed:
        return NULL;
 }
+static DEFINE_SPINLOCK(ipip6_prl_lock);
+#define for_each_prl_rcu(start)                 \
+        for (prl = rcu_dereference(start);      \
+             prl;                               \
+             prl = rcu_dereference(prl->next))
 static struct ip_tunnel_prl_entry *
 __ipip6_tunnel_locate_prl(struct ip_tunnel *t, __be32 addr)
 {
-        struct ip_tunnel_prl_entry *p = (struct ip_tunnel_prl_entry *)NULL;
+        struct ip_tunnel_prl_entry *prl;
-        for (p = t->prl; p; p = p->next)
+        for_each_prl_rcu(t->prl)
-                if (p->addr == addr)
+                if (prl->addr == addr)
                        break;
-        return p;
+        return prl;
 }
@@ -255,7 +289,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                kcalloc(cmax, sizeof(*kp), GFP_KERNEL) :
                NULL;
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
        ca = t->prl_count < cmax ? t->prl_count : cmax;
@@ -273,7 +307,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
        }
        c = 0;
-        for (prl = t->prl; prl; prl = prl->next) {
+        for_each_prl_rcu(t->prl) {
                if (c >= cmax)
                        break;
                if (kprl.addr != htonl(INADDR_ANY) && prl->addr != kprl.addr)
@@ -285,7 +319,7 @@ static int ipip6_tunnel_get_prl(struct ip_tunnel *t,
                        break;
        }
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
        len = sizeof(*kp) * c;
        ret = 0;
@@ -306,12 +340,14 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
        if (a->addr == htonl(INADDR_ANY))
                return -EINVAL;
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
        for (p = t->prl; p; p = p->next) {
                if (p->addr == a->addr) {
-                        if (chg)
+                        if (chg) {
-                                goto update;
+                                p->flags = a->flags;
+                                goto out;
+                        }
                        err = -EEXIST;
                        goto out;
                }
@@ -328,46 +364,63 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
                goto out;
        }
+        INIT_RCU_HEAD(&p->rcu_head);
        p->next = t->prl;
-        t->prl = p;
-        t->prl_count++;
-update:
        p->addr = a->addr;
        p->flags = a->flags;
+        t->prl_count++;
+        rcu_assign_pointer(t->prl, p);
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
        return err;
 }
+static void prl_entry_destroy_rcu(struct rcu_head *head)
+{
+        kfree(container_of(head, struct ip_tunnel_prl_entry, rcu_head));
+}
+static void prl_list_destroy_rcu(struct rcu_head *head)
+{
+        struct ip_tunnel_prl_entry *p, *n;
+        p = container_of(head, struct ip_tunnel_prl_entry, rcu_head);
+        do {
+                n = p->next;
+                kfree(p);
+                p = n;
+        } while (p);
+}
 static int
 ipip6_tunnel_del_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a)
 {
        struct ip_tunnel_prl_entry *x, **p;
        int err = 0;
-        write_lock(&ipip6_lock);
+        spin_lock(&ipip6_prl_lock);
        if (a && a->addr != htonl(INADDR_ANY)) {
                for (p = &t->prl; *p; p = &(*p)->next) {
                        if ((*p)->addr == a->addr) {
                                x = *p;
                                *p = x->next;
-                                kfree(x);
+                                call_rcu(&x->rcu_head, prl_entry_destroy_rcu);
                                t->prl_count--;
                                goto out;
                        }
                }
                err = -ENXIO;
        } else {
-                while (t->prl) {
+                if (t->prl) {
+                        t->prl_count = 0;
                        x = t->prl;
-                        t->prl = t->prl->next;
+                        call_rcu(&x->rcu_head, prl_list_destroy_rcu);
-                        kfree(x);
+                        t->prl = NULL;
-                        t->prl_count--;
                }
        }
 out:
-        write_unlock(&ipip6_lock);
+        spin_unlock(&ipip6_prl_lock);
        return err;
 }
@@ -377,7 +430,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
        struct ip_tunnel_prl_entry *p;
        int ok = 1;
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
        p = __ipip6_tunnel_locate_prl(t, iph->saddr);
        if (p) {
                if (p->flags & PRL_DEFAULT)
@@ -393,7 +446,7 @@ isatap_chksrc(struct sk_buff *skb, struct iphdr *iph, struct ip_tunnel *t)
                else
                        ok = 0;
        }
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
        return ok;
 }
@@ -403,9 +456,9 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
        struct sit_net *sitn = net_generic(net, sit_net_id);
        if (dev == sitn->fb_tunnel_dev) {
-                write_lock_bh(&ipip6_lock);
+                spin_lock_bh(&ipip6_lock);
                sitn->tunnels_wc[0] = NULL;
-                write_unlock_bh(&ipip6_lock);
+                spin_unlock_bh(&ipip6_lock);
                dev_put(dev);
        } else {
                ipip6_tunnel_unlink(sitn, netdev_priv(dev));
@@ -458,7 +511,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
        err = -ENOENT;
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
        t = ipip6_tunnel_lookup(dev_net(skb->dev),
                                skb->dev,
                                iph->daddr,
@@ -476,7 +529,7 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
                t->err_count = 1;
        t->err_time = jiffies;
 out:
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
        return err;
 }
@@ -496,7 +549,7 @@ static int ipip6_rcv(struct sk_buff *skb)
        iph = ip_hdr(skb);
-        read_lock(&ipip6_lock);
+        rcu_read_lock();
        tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
                                     iph->saddr, iph->daddr);
        if (tunnel != NULL) {
@@ -510,7 +563,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                if ((tunnel->dev->priv_flags & IFF_ISATAP) &&
                    !isatap_chksrc(skb, iph, tunnel)) {
                        tunnel->dev->stats.rx_errors++;
-                        read_unlock(&ipip6_lock);
+                        rcu_read_unlock();
                        kfree_skb(skb);
                        return 0;
                }
@@ -521,28 +574,52 @@ static int ipip6_rcv(struct sk_buff *skb)
                nf_reset(skb);
                ipip6_ecn_decapsulate(iph, skb);
                netif_rx(skb);
-                read_unlock(&ipip6_lock);
+                rcu_read_unlock();
                return 0;
        }
        icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
-        read_unlock(&ipip6_lock);
+        rcu_read_unlock();
 out:
        kfree_skb(skb);
        return 0;
 }
-/* Returns the embedded IPv4 address if the IPv6 address
+/*
-   comes from 6to4 (RFC 3056) addr space */
+ * Returns the embedded IPv4 address if the IPv6 address
+ * comes from 6rd / 6to4 (RFC 3056) addr space.
-static inline __be32 try_6to4(struct in6_addr *v6dst)
+ */
+static inline
+__be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 {
        __be32 dst = 0;
+#ifdef CONFIG_IPV6_SIT_6RD
+        if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
+                              tunnel->ip6rd.prefixlen)) {
+                unsigned pbw0, pbi0;
+                int pbi1;
+                u32 d;
+                pbw0 = tunnel->ip6rd.prefixlen >> 5;
+                pbi0 = tunnel->ip6rd.prefixlen & 0x1f;
+                d = (ntohl(v6dst->s6_addr32[pbw0]) << pbi0) >>
+                    tunnel->ip6rd.relay_prefixlen;
+                pbi1 = pbi0 - tunnel->ip6rd.relay_prefixlen;
+                if (pbi1 > 0)
+                        d |= ntohl(v6dst->s6_addr32[pbw0 + 1]) >>
+                             (32 - pbi1);
+                dst = tunnel->ip6rd.relay_prefix | htonl(d);
+        }
+#else
        if (v6dst->s6_addr16[0] == htons(0x2002)) {
                /* 6to4 v6 addr has 16 bits prefix, 32 v4addr, 16 SLA, ... */
                memcpy(&dst, &v6dst->s6_addr16[1], 4);
        }
+#endif
        return dst;
 }
@@ -555,10 +632,12 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                                     struct net_device *dev)
 {
        struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct net_device_stats *stats = &tunnel->dev->stats;
+        struct net_device_stats *stats = &dev->stats;
+        struct netdev_queue *txq = netdev_get_tx_queue(dev, 0);
        struct iphdr  *tiph = &tunnel->parms.iph;
        struct ipv6hdr *iph6 = ipv6_hdr(skb);
        u8     tos = tunnel->parms.iph.tos;
+        __be16 df = tiph->frag_off;
        struct rtable *rt;                      /* Route to the other host */
        struct net_device *tdev;                        /* Device to other host */
        struct iphdr  *iph;                     /* Our new IP header */
@@ -595,7 +674,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        }
        if (!dst)
-                dst = try_6to4(&iph6->daddr);
+                dst = try_6rd(&iph6->daddr, tunnel);
        if (!dst) {
                struct neighbour *neigh = NULL;
@@ -648,25 +727,28 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                goto tx_error;
        }
-        if (tiph->frag_off)
+        if (df) {
                mtu = dst_mtu(&rt->u.dst) - sizeof(struct iphdr);
-        else
-                mtu = skb_dst(skb) ? dst_mtu(skb_dst(skb)) : dev->mtu;
-        if (mtu < 68) {
+                if (mtu < 68) {
-                stats->collisions++;
+                        stats->collisions++;
-                ip_rt_put(rt);
+                        ip_rt_put(rt);
-                goto tx_error;
+                        goto tx_error;
-        }
+                }
-        if (mtu < IPV6_MIN_MTU)
-                mtu = IPV6_MIN_MTU;
-        if (tunnel->parms.iph.daddr && skb_dst(skb))
-                skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
-        if (skb->len > mtu) {
+                if (mtu < IPV6_MIN_MTU) {
-                icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        mtu = IPV6_MIN_MTU;
-                ip_rt_put(rt);
+                        df = 0;
-                goto tx_error;
+                }
+                if (tunnel->parms.iph.daddr && skb_dst(skb))
+                        skb_dst(skb)->ops->update_pmtu(skb_dst(skb), mtu);
+                if (skb->len > mtu) {
+                        icmpv6_send(skb, ICMPV6_PKT_TOOBIG, 0, mtu, dev);
+                        ip_rt_put(rt);
+                        goto tx_error;
+                }
        }
        if (tunnel->err_count > 0) {
@@ -688,7 +770,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                struct sk_buff *new_skb = skb_realloc_headroom(skb, max_headroom);
                if (!new_skb) {
                        ip_rt_put(rt);
-                        stats->tx_dropped++;
+                        txq->tx_dropped++;
                        dev_kfree_skb(skb);
                        return NETDEV_TX_OK;
                }
@@ -714,11 +796,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        iph                     =       ip_hdr(skb);
        iph->version            =       4;
        iph->ihl                =       sizeof(struct iphdr)>>2;
-        if (mtu > IPV6_MIN_MTU)
+        iph->frag_off           =       df;
-                iph->frag_off   =       tiph->frag_off;
-        else
-                iph->frag_off   =       0;
        iph->protocol           =       IPPROTO_IPV6;
        iph->tos                =       INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
        iph->daddr              =       rt->rt_dst;
@@ -785,9 +863,15 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
        struct ip_tunnel *t;
        struct net *net = dev_net(dev);
        struct sit_net *sitn = net_generic(net, sit_net_id);
+#ifdef CONFIG_IPV6_SIT_6RD
+        struct ip_tunnel_6rd ip6rd;
+#endif
        switch (cmd) {
        case SIOCGETTUNNEL:
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCGET6RD:
+#endif
                t = NULL;
                if (dev == sitn->fb_tunnel_dev) {
                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
@@ -798,9 +882,25 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                }
                if (t == NULL)
                        t = netdev_priv(dev);
-                memcpy(&p, &t->parms, sizeof(p));
-                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
+                err = -EFAULT;
-                        err = -EFAULT;
+                if (cmd == SIOCGETTUNNEL) {
+                        memcpy(&p, &t->parms, sizeof(p));
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &p,
+                                         sizeof(p)))
+                                goto done;
+#ifdef CONFIG_IPV6_SIT_6RD
+                } else {
+                        ipv6_addr_copy(&ip6rd.prefix, &t->ip6rd.prefix);
+                        ip6rd.relay_prefix = t->ip6rd.relay_prefix;
+                        ip6rd.prefixlen = t->ip6rd.prefixlen;
+                        ip6rd.relay_prefixlen = t->ip6rd.relay_prefixlen;
+                        if (copy_to_user(ifr->ifr_ifru.ifru_data, &ip6rd,
+                                         sizeof(ip6rd)))
+                                goto done;
+#endif
+                }
+                err = 0;
                break;
        case SIOCADDTUNNEL:
@@ -921,6 +1021,54 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                netdev_state_change(dev);
                break;
+#ifdef CONFIG_IPV6_SIT_6RD
+        case SIOCADD6RD:
+        case SIOCCHG6RD:
+        case SIOCDEL6RD:
+                err = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        goto done;
+                err = -EFAULT;
+                if (copy_from_user(&ip6rd, ifr->ifr_ifru.ifru_data,
+                                   sizeof(ip6rd)))
+                        goto done;
+                t = netdev_priv(dev);
+                if (cmd != SIOCDEL6RD) {
+                        struct in6_addr prefix;
+                        __be32 relay_prefix;
+                        err = -EINVAL;
+                        if (ip6rd.relay_prefixlen > 32 ||
+                            ip6rd.prefixlen + (32 - ip6rd.relay_prefixlen) > 64)
+                                goto done;
+                        ipv6_addr_prefix(&prefix, &ip6rd.prefix,
+                                         ip6rd.prefixlen);
+                        if (!ipv6_addr_equal(&prefix, &ip6rd.prefix))
+                                goto done;
+                        if (ip6rd.relay_prefixlen)
+                                relay_prefix = ip6rd.relay_prefix &
+                                               htonl(0xffffffffUL <<
+                                                     (32 - ip6rd.relay_prefixlen));
+                        else
+                                relay_prefix = 0;
+                        if (relay_prefix != ip6rd.relay_prefix)
+                                goto done;
+                        ipv6_addr_copy(&t->ip6rd.prefix, &prefix);
+                        t->ip6rd.relay_prefix = relay_prefix;
+                        t->ip6rd.prefixlen = ip6rd.prefixlen;
+                        t->ip6rd.relay_prefixlen = ip6rd.relay_prefixlen;
+                } else
+                        ipip6_tunnel_clone_6rd(dev, sitn);
+                err = 0;
+                break;
+#endif
        default:
                err = -EINVAL;
        }
@@ -997,33 +1145,27 @@ static struct xfrm_tunnel sit_handler = {
        .priority       =       1,
 };
-static void sit_destroy_tunnels(struct sit_net *sitn)
+static void sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
 {
        int prio;
        for (prio = 1; prio < 4; prio++) {
                int h;
                for (h = 0; h < HASH_SIZE; h++) {
-                        struct ip_tunnel *t;
+                        struct ip_tunnel *t = sitn->tunnels[prio][h];
-                        while ((t = sitn->tunnels[prio][h]) != NULL)
-                                unregister_netdevice(t->dev);
+                        while (t != NULL) {
+                                unregister_netdevice_queue(t->dev, head);
+                                t = t->next;
+                        }
                }
        }
 }
 static int sit_init_net(struct net *net)
 {
+        struct sit_net *sitn = net_generic(net, sit_net_id);
        int err;
-        struct sit_net *sitn;
-        err = -ENOMEM;
-        sitn = kzalloc(sizeof(struct sit_net), GFP_KERNEL);
-        if (sitn == NULL)
-                goto err_alloc;
-        err = net_assign_generic(net, sit_net_id, sitn);
-        if (err < 0)
-                goto err_assign;
        sitn->tunnels[0] = sitn->tunnels_wc;
        sitn->tunnels[1] = sitn->tunnels_l;
@@ -1039,6 +1181,7 @@ static int sit_init_net(struct net *net)
        dev_net_set(sitn->fb_tunnel_dev, net);
        ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
+        ipip6_tunnel_clone_6rd(sitn->fb_tunnel_dev, sitn);
        if ((err = register_netdev(sitn->fb_tunnel_dev)))
                goto err_reg_dev;
@@ -1049,35 +1192,34 @@ err_reg_dev:
        dev_put(sitn->fb_tunnel_dev);
        free_netdev(sitn->fb_tunnel_dev);
 err_alloc_dev:
-        /* nothing */
-err_assign:
-        kfree(sitn);
-err_alloc:
        return err;
 }
 static void sit_exit_net(struct net *net)
 {
-        struct sit_net *sitn;
+        struct sit_net *sitn = net_generic(net, sit_net_id);
+        LIST_HEAD(list);
-        sitn = net_generic(net, sit_net_id);
        rtnl_lock();
-        sit_destroy_tunnels(sitn);
+        sit_destroy_tunnels(sitn, &list);
-        unregister_netdevice(sitn->fb_tunnel_dev);
+        unregister_netdevice_queue(sitn->fb_tunnel_dev, &list);
+        unregister_netdevice_many(&list);
        rtnl_unlock();
-        kfree(sitn);
 }
 static struct pernet_operations sit_net_ops = {
        .init = sit_init_net,
        .exit = sit_exit_net,
+        .id   = &sit_net_id,
+        .size = sizeof(struct sit_net),
 };
 static void __exit sit_cleanup(void)
 {
        xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
-        unregister_pernet_gen_device(sit_net_id, &sit_net_ops);
+        unregister_pernet_device(&sit_net_ops);
+        rcu_barrier(); /* Wait for completion of call_rcu()'s */
 }
 static int __init sit_init(void)
@@ -1091,7 +1233,7 @@ static int __init sit_init(void)
                return -EAGAIN;
        }
-        err = register_pernet_gen_device(&sit_net_id, &sit_net_ops);
+        err = register_pernet_device(&sit_net_ops);
        if (err < 0)
                xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 6b6ae913b5d4..5b9af508b8f2 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -159,6 +159,8 @@ static inline int cookie_check(struct sk_buff *skb, __u32 cookie)
 struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 {
+        struct tcp_options_received tcp_opt;
+        u8 *hash_location;
        struct inet_request_sock *ireq;
        struct inet6_request_sock *ireq6;
        struct tcp_request_sock *treq;
@@ -171,7 +173,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        int mss;
        struct dst_entry *dst;
        __u8 rcv_wscale;
-        struct tcp_options_received tcp_opt;
        if (!sysctl_tcp_syncookies || !th->ack)
                goto out;
@@ -184,13 +185,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_SYNCOOKIESRECV);
-        /* check for timestamp cookie support */
-        memset(&tcp_opt, 0, sizeof(tcp_opt));
-        tcp_parse_options(skb, &tcp_opt, 0);
-        if (tcp_opt.saw_tstamp)
-                cookie_check_timestamp(&tcp_opt);
        ret = NULL;
        req = inet6_reqsk_alloc(&tcp6_request_sock_ops);
        if (!req)
@@ -224,12 +218,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        req->expires = 0UL;
        req->retrans = 0;
        ireq->ecn_ok            = 0;
-        ireq->snd_wscale        = tcp_opt.snd_wscale;
-        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
-        ireq->sack_ok           = tcp_opt.sack_ok;
-        ireq->wscale_ok         = tcp_opt.wscale_ok;
-        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
-        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
        treq->rcv_isn = ntohl(th->seq) - 1;
        treq->snt_isn = cookie;
@@ -252,8 +240,9 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                }
                ipv6_addr_copy(&fl.fl6_src, &ireq6->loc_addr);
                fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
-                fl.fl_ip_sport = inet_sk(sk)->sport;
+                fl.fl_ip_sport = inet_sk(sk)->inet_sport;
                security_req_classify_flow(req, &fl);
                if (ip6_dst_lookup(sk, &dst, &fl))
                        goto out_free;
@@ -264,6 +253,21 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                        goto out_free;
        }
+        /* check for timestamp cookie support */
+        memset(&tcp_opt, 0, sizeof(tcp_opt));
+        tcp_parse_options(skb, &tcp_opt, &hash_location, 0, dst);
+        if (tcp_opt.saw_tstamp)
+                cookie_check_timestamp(&tcp_opt);
+        req->ts_recent          = tcp_opt.saw_tstamp ? tcp_opt.rcv_tsval : 0;
+        ireq->snd_wscale        = tcp_opt.snd_wscale;
+        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
+        ireq->sack_ok           = tcp_opt.sack_ok;
+        ireq->wscale_ok         = tcp_opt.wscale_ok;
+        ireq->tstamp_ok         = tcp_opt.saw_tstamp;
        req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
        tcp_select_initial_window(tcp_full_space(sk), req->mss,
                                  &req->rcv_wnd, &req->window_clamp,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 21d100b68b19..aadd7cef73b3 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -226,10 +226,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
 #endif
                        goto failure;
                } else {
-                        ipv6_addr_set(&np->saddr, 0, 0, htonl(0x0000FFFF),
+                        ipv6_addr_set_v4mapped(inet->inet_saddr, &np->saddr);
-                                      inet->saddr);
+                        ipv6_addr_set_v4mapped(inet->inet_rcv_saddr,
-                        ipv6_addr_set(&np->rcv_saddr, 0, 0, htonl(0x0000FFFF),
+                                               &np->rcv_saddr);
-                                      inet->rcv_saddr);
                }
                return err;
@@ -243,8 +242,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        ipv6_addr_copy(&fl.fl6_src,
                       (saddr ? saddr : &np->saddr));
        fl.oif = sk->sk_bound_dev_if;
+        fl.mark = sk->sk_mark;
        fl.fl_ip_dport = usin->sin6_port;
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
        if (np->opt && np->opt->srcrt) {
                struct rt0_hdr *rt0 = (struct rt0_hdr *)np->opt->srcrt;
@@ -276,7 +276,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        /* set the source address */
        ipv6_addr_copy(&np->saddr, saddr);
-        inet->rcv_saddr = LOOPBACK4_IPV6;
+        inet->inet_rcv_saddr = LOOPBACK4_IPV6;
        sk->sk_gso_type = SKB_GSO_TCPV6;
        __ip6_dst_store(sk, dst, NULL, NULL);
@@ -288,7 +288,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
-        inet->dport = usin->sin6_port;
+        inet->inet_dport = usin->sin6_port;
        tcp_set_state(sk, TCP_SYN_SENT);
        err = inet6_hash_connect(&tcp_death_row, sk);
@@ -298,8 +298,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        if (!tp->write_seq)
                tp->write_seq = secure_tcpv6_sequence_number(np->saddr.s6_addr32,
                                                             np->daddr.s6_addr32,
-                                                             inet->sport,
+                                                             inet->inet_sport,
-                                                             inet->dport);
+                                                             inet->inet_dport);
        err = tcp_connect(sk);
        if (err)
@@ -311,7 +311,7 @@ late_failure:
        tcp_set_state(sk, TCP_CLOSE);
        __sk_dst_reset(sk);
 failure:
-        inet->dport = 0;
+        inet->inet_dport = 0;
        sk->sk_route_caps = 0;
        return err;
 }
@@ -383,8 +383,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                        ipv6_addr_copy(&fl.fl6_dst, &np->daddr);
                        ipv6_addr_copy(&fl.fl6_src, &np->saddr);
                        fl.oif = sk->sk_bound_dev_if;
-                        fl.fl_ip_dport = inet->dport;
+                        fl.mark = sk->sk_mark;
-                        fl.fl_ip_sport = inet->sport;
+                        fl.fl_ip_dport = inet->inet_dport;
+                        fl.fl_ip_sport = inet->inet_sport;
                        security_skb_classify_flow(skb, &fl);
                        if ((err = ip6_dst_lookup(sk, &dst, &fl))) {
@@ -460,7 +461,8 @@ out:
 }
-static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
+static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req,
+                              struct request_values *rvp)
 {
        struct inet6_request_sock *treq = inet6_rsk(req);
        struct ipv6_pinfo *np = inet6_sk(sk);
@@ -477,6 +479,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
        ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
        fl.fl6_flowlabel = 0;
        fl.oif = treq->iif;
+        fl.mark = sk->sk_mark;
        fl.fl_ip_dport = inet_rsk(req)->rmt_port;
        fl.fl_ip_sport = inet_rsk(req)->loc_port;
        security_req_classify_flow(req, &fl);
@@ -497,7 +500,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct request_sock *req)
        if ((err = xfrm_lookup(sock_net(sk), &dst, &fl, sk, 0)) < 0)
                goto done;
-        skb = tcp_make_synack(sk, dst, req);
+        skb = tcp_make_synack(sk, dst, req, rvp);
        if (skb) {
                struct tcphdr *th = tcp_hdr(skb);
@@ -1159,11 +1162,14 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk,struct sk_buff *skb)
 */
 static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
 {
+        struct tcp_extend_values tmp_ext;
+        struct tcp_options_received tmp_opt;
+        u8 *hash_location;
+        struct request_sock *req;
        struct inet6_request_sock *treq;
        struct ipv6_pinfo *np = inet6_sk(sk);
-        struct tcp_options_received tmp_opt;
        struct tcp_sock *tp = tcp_sk(sk);
-        struct request_sock *req = NULL;
+        struct dst_entry *dst = __sk_dst_get(sk);
        __u32 isn = TCP_SKB_CB(skb)->when;
 #ifdef CONFIG_SYN_COOKIES
        int want_cookie = 0;
@@ -1202,8 +1208,52 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        tcp_clear_options(&tmp_opt);
        tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
        tmp_opt.user_mss = tp->rx_opt.user_mss;
+        tcp_parse_options(skb, &tmp_opt, &hash_location, 0, dst);
+        if (tmp_opt.cookie_plus > 0 &&
+            tmp_opt.saw_tstamp &&
+            !tp->rx_opt.cookie_out_never &&
+            (sysctl_tcp_cookie_size > 0 ||
+             (tp->cookie_values != NULL &&
+              tp->cookie_values->cookie_desired > 0))) {
+                u8 *c;
+                u32 *d;
+                u32 *mess = &tmp_ext.cookie_bakery[COOKIE_DIGEST_WORDS];
+                int l = tmp_opt.cookie_plus - TCPOLEN_COOKIE_BASE;
+                if (tcp_cookie_generator(&tmp_ext.cookie_bakery[0]) != 0)
+                        goto drop_and_free;
+                /* Secret recipe starts with IP addresses */
+                d = &ipv6_hdr(skb)->daddr.s6_addr32[0];
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                d = &ipv6_hdr(skb)->saddr.s6_addr32[0];
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                *mess++ ^= *d++;
+                /* plus variable length Initiator Cookie */
+                c = (u8 *)mess;
+                while (l-- > 0)
+                        *c++ ^= *hash_location++;
-        tcp_parse_options(skb, &tmp_opt, 0);
+#ifdef CONFIG_SYN_COOKIES
+                want_cookie = 0;        /* not our kind of cookie */
+#endif
+                tmp_ext.cookie_out_never = 0; /* false */
+                tmp_ext.cookie_plus = tmp_opt.cookie_plus;
+        } else if (!tp->rx_opt.cookie_in_always) {
+                /* redundant indications, but ensure initialization. */
+                tmp_ext.cookie_out_never = 1; /* true */
+                tmp_ext.cookie_plus = 0;
+        } else {
+                goto drop_and_free;
+        }
+        tmp_ext.cookie_in_always = tp->rx_opt.cookie_in_always;
        if (want_cookie && !tmp_opt.saw_tstamp)
                tcp_clear_options(&tmp_opt);
@@ -1236,23 +1286,21 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                isn = tcp_v6_init_sequence(skb);
        }
        tcp_rsk(req)->snt_isn = isn;
        security_inet_conn_request(sk, skb, req);
-        if (tcp_v6_send_synack(sk, req))
+        if (tcp_v6_send_synack(sk, req,
-                goto drop;
+                               (struct request_values *)&tmp_ext) ||
+            want_cookie)
+                goto drop_and_free;
-        if (!want_cookie) {
+        inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
-                inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
+        return 0;
-                return 0;
-        }
+drop_and_free:
+        reqsk_free(req);
 drop:
-        if (req)
-                reqsk_free(req);
        return 0; /* don't send reset */
 }
@@ -1290,11 +1338,9 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                memcpy(newnp, np, sizeof(struct ipv6_pinfo));
-                ipv6_addr_set(&newnp->daddr, 0, 0, htonl(0x0000FFFF),
+                ipv6_addr_set_v4mapped(newinet->inet_daddr, &newnp->daddr);
-                              newinet->daddr);
-                ipv6_addr_set(&newnp->saddr, 0, 0, htonl(0x0000FFFF),
+                ipv6_addr_set_v4mapped(newinet->inet_saddr, &newnp->saddr);
-                              newinet->saddr);
                ipv6_addr_copy(&newnp->rcv_saddr, &newnp->saddr);
@@ -1345,6 +1391,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
                }
                ipv6_addr_copy(&fl.fl6_src, &treq->loc_addr);
                fl.oif = sk->sk_bound_dev_if;
+                fl.mark = sk->sk_mark;
                fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                fl.fl_ip_sport = inet_rsk(req)->loc_port;
                security_req_classify_flow(req, &fl);
@@ -1431,7 +1478,8 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
        newtp->advmss = dst_metric(dst, RTAX_ADVMSS);
        tcp_initialize_rcv_mss(newsk);
-        newinet->daddr = newinet->saddr = newinet->rcv_saddr = LOOPBACK4_IPV6;
+        newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
+        newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
 #ifdef CONFIG_TCP_MD5SIG
        /* Copy over the MD5 key from the original socket */
@@ -1848,7 +1896,7 @@ static int tcp_v6_init_sock(struct sock *sk)
         */
        tp->snd_ssthresh = TCP_INFINITE_SSTHRESH;
        tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache = 536;
+        tp->mss_cache = TCP_MSS_DEFAULT;
        tp->reordering = sysctl_tcp_reordering;
@@ -1864,6 +1912,19 @@ static int tcp_v6_init_sock(struct sock *sk)
        tp->af_specific = &tcp_sock_ipv6_specific;
 #endif
+        /* TCP Cookie Transactions */
+        if (sysctl_tcp_cookie_size > 0) {
+                /* Default, cookies without s_data_payload. */
+                tp->cookie_values =
+                        kzalloc(sizeof(*tp->cookie_values),
+                                sk->sk_allocation);
+                if (tp->cookie_values != NULL)
+                        kref_init(&tp->cookie_values->kref);
+        }
+        /* Presumed zeroed, in order of appearance:
+         *      cookie_in_always, cookie_out_never,
+         *      s_data_constant, s_data_in, s_data_out
+         */
        sk->sk_sndbuf = sysctl_tcp_wmem[1];
        sk->sk_rcvbuf = sysctl_tcp_rmem[1];
@@ -1931,8 +1992,8 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
        dest  = &np->daddr;
        src   = &np->rcv_saddr;
-        destp = ntohs(inet->dport);
+        destp = ntohs(inet->inet_dport);
-        srcp  = ntohs(inet->sport);
+        srcp  = ntohs(inet->inet_sport);
        if (icsk->icsk_pending == ICSK_TIME_RETRANS) {
                timer_active    = 1;
@@ -2109,7 +2170,6 @@ static struct inet_protosw tcpv6_protosw = {
        .protocol       =       IPPROTO_TCP,
        .prot           =       &tcpv6_prot,
        .ops            =       &inet6_stream_ops,
-        .capability     =       -1,
        .no_check       =       0,
        .flags          =       INET_PROTOSW_PERMANENT |
                                INET_PROTOSW_ICSK,
@@ -2124,12 +2184,17 @@ static int tcpv6_net_init(struct net *net)
 static void tcpv6_net_exit(struct net *net)
 {
        inet_ctl_sock_destroy(net->ipv6.tcp_sk);
-        inet_twsk_purge(net, &tcp_hashinfo, &tcp_death_row, AF_INET6);
+}
+static void tcpv6_net_exit_batch(struct list_head *net_exit_list)
+{
+        inet_twsk_purge(&tcp_hashinfo, &tcp_death_row, AF_INET6);
 }
 static struct pernet_operations tcpv6_net_ops = {
-        .init = tcpv6_net_init,
+        .init       = tcpv6_net_init,
-        .exit = tcpv6_net_exit,
+        .exit       = tcpv6_net_exit,
+        .exit_batch = tcpv6_net_exit_batch,
 };
 int __init tcpv6_init(void)
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index cf538ed5ef6a..69ebdbe78c47 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -53,7 +53,7 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
        const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
        const struct in6_addr *sk2_rcv_saddr6 = inet6_rcv_saddr(sk2);
-        __be32 sk_rcv_saddr = inet_sk(sk)->rcv_saddr;
+        __be32 sk1_rcv_saddr = inet_sk(sk)->inet_rcv_saddr;
        __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
        int sk_ipv6only = ipv6_only_sock(sk);
        int sk2_ipv6only = inet_v6_ipv6only(sk2);
@@ -63,8 +63,8 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
        /* if both are mapped, treat as IPv4 */
        if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED)
                return (!sk2_ipv6only &&
-                        (!sk_rcv_saddr || !sk2_rcv_saddr ||
+                        (!sk1_rcv_saddr || !sk2_rcv_saddr ||
-                          sk_rcv_saddr == sk2_rcv_saddr));
+                          sk1_rcv_saddr == sk2_rcv_saddr));
        if (addr_type2 == IPV6_ADDR_ANY &&
            !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
@@ -81,9 +81,33 @@ int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
        return 0;
 }
+static unsigned int udp6_portaddr_hash(struct net *net,
+                                       const struct in6_addr *addr6,
+                                       unsigned int port)
+{
+        unsigned int hash, mix = net_hash_mix(net);
+        if (ipv6_addr_any(addr6))
+                hash = jhash_1word(0, mix);
+        else if (ipv6_addr_v4mapped(addr6))
+                hash = jhash_1word(addr6->s6_addr32[3], mix);
+        else
+                hash = jhash2(addr6->s6_addr32, 4, mix);
+        return hash ^ port;
+}
 int udp_v6_get_port(struct sock *sk, unsigned short snum)
 {
-        return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal);
+        unsigned int hash2_nulladdr =
+                udp6_portaddr_hash(sock_net(sk), &in6addr_any, snum);
+        unsigned int hash2_partial = 
+                udp6_portaddr_hash(sock_net(sk), &inet6_sk(sk)->rcv_saddr, 0);
+        /* precompute partial secondary hash */
+        udp_sk(sk)->udp_portaddr_hash = hash2_partial;
+        return udp_lib_get_port(sk, snum, ipv6_rcv_saddr_equal, hash2_nulladdr);
 }
 static inline int compute_score(struct sock *sk, struct net *net,
@@ -94,14 +118,14 @@ static inline int compute_score(struct sock *sk, struct net *net,
 {
        int score = -1;
-        if (net_eq(sock_net(sk), net) && sk->sk_hash == hnum &&
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
                        sk->sk_family == PF_INET6) {
                struct ipv6_pinfo *np = inet6_sk(sk);
                struct inet_sock *inet = inet_sk(sk);
                score = 0;
-                if (inet->dport) {
+                if (inet->inet_dport) {
-                        if (inet->dport != sport)
+                        if (inet->inet_dport != sport)
                                return -1;
                        score++;
                }
@@ -124,6 +148,86 @@ static inline int compute_score(struct sock *sk, struct net *net,
        return score;
 }
+#define SCORE2_MAX (1 + 1 + 1)
+static inline int compute_score2(struct sock *sk, struct net *net,
+                                const struct in6_addr *saddr, __be16 sport,
+                                const struct in6_addr *daddr, unsigned short hnum,
+                                int dif)
+{
+        int score = -1;
+        if (net_eq(sock_net(sk), net) && udp_sk(sk)->udp_port_hash == hnum &&
+                        sk->sk_family == PF_INET6) {
+                struct ipv6_pinfo *np = inet6_sk(sk);
+                struct inet_sock *inet = inet_sk(sk);
+                if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
+                        return -1;
+                score = 0;
+                if (inet->inet_dport) {
+                        if (inet->inet_dport != sport)
+                                return -1;
+                        score++;
+                }
+                if (!ipv6_addr_any(&np->daddr)) {
+                        if (!ipv6_addr_equal(&np->daddr, saddr))
+                                return -1;
+                        score++;
+                }
+                if (sk->sk_bound_dev_if) {
+                        if (sk->sk_bound_dev_if != dif)
+                                return -1;
+                        score++;
+                }
+        }
+        return score;
+}
+/* called with read_rcu_lock() */
+static struct sock *udp6_lib_lookup2(struct net *net,
+                const struct in6_addr *saddr, __be16 sport,
+                const struct in6_addr *daddr, unsigned int hnum, int dif,
+                struct udp_hslot *hslot2, unsigned int slot2)
+{
+        struct sock *sk, *result;
+        struct hlist_nulls_node *node;
+        int score, badness;
+begin:
+        result = NULL;
+        badness = -1;
+        udp_portaddr_for_each_entry_rcu(sk, node, &hslot2->head) {
+                score = compute_score2(sk, net, saddr, sport,
+                                      daddr, hnum, dif);
+                if (score > badness) {
+                        result = sk;
+                        badness = score;
+                        if (score == SCORE2_MAX)
+                                goto exact_match;
+                }
+        }
+        /*
+         * if the nulls value we got at the end of this lookup is
+         * not the expected one, we must restart lookup.
+         * We probably met an item that was moved to another chain.
+         */
+        if (get_nulls_value(node) != slot2)
+                goto begin;
+        if (result) {
+exact_match:
+                if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
+                        result = NULL;
+                else if (unlikely(compute_score2(result, net, saddr, sport,
+                                  daddr, hnum, dif) < badness)) {
+                        sock_put(result);
+                        goto begin;
+                }
+        }
+        return result;
+}
 static struct sock *__udp6_lib_lookup(struct net *net,
                                      struct in6_addr *saddr, __be16 sport,
                                      struct in6_addr *daddr, __be16 dport,
@@ -132,11 +236,35 @@ static struct sock *__udp6_lib_lookup(struct net *net,
        struct sock *sk, *result;
        struct hlist_nulls_node *node;
        unsigned short hnum = ntohs(dport);
-        unsigned int hash = udp_hashfn(net, hnum);
+        unsigned int hash2, slot2, slot = udp_hashfn(net, hnum, udptable->mask);
-        struct udp_hslot *hslot = &udptable->hash[hash];
+        struct udp_hslot *hslot2, *hslot = &udptable->hash[slot];
        int score, badness;
        rcu_read_lock();
+        if (hslot->count > 10) {
+                hash2 = udp6_portaddr_hash(net, daddr, hnum);
+                slot2 = hash2 & udptable->mask;
+                hslot2 = &udptable->hash2[slot2];
+                if (hslot->count < hslot2->count)
+                        goto begin;
+                result = udp6_lib_lookup2(net, saddr, sport,
+                                          daddr, hnum, dif,
+                                          hslot2, slot2);
+                if (!result) {
+                        hash2 = udp6_portaddr_hash(net, &in6addr_any, hnum);
+                        slot2 = hash2 & udptable->mask;
+                        hslot2 = &udptable->hash2[slot2];
+                        if (hslot->count < hslot2->count)
+                                goto begin;
+                        result = udp6_lib_lookup2(net, &in6addr_any, sport,
+                                                  daddr, hnum, dif,
+                                                  hslot2, slot2);
+                }
+                rcu_read_unlock();
+                return result;
+        }
 begin:
        result = NULL;
        badness = -1;
@@ -152,7 +280,7 @@ begin:
         * not the expected one, we must restart lookup.
         * We probably met an item that was moved to another chain.
         */
-        if (get_nulls_value(node) != hash)
+        if (get_nulls_value(node) != slot)
                goto begin;
        if (result) {
@@ -252,7 +380,7 @@ try_again:
                                        UDP_MIB_INDATAGRAMS, is_udplite);
        }
-        sock_recv_timestamp(msg, sk, skb);
+        sock_recv_ts_and_drops(msg, sk, skb);
        /* Copy the address. */
        if (msg->msg_name) {
@@ -265,8 +393,8 @@ try_again:
                sin6->sin6_scope_id = 0;
                if (is_udp4)
-                        ipv6_addr_set(&sin6->sin6_addr, 0, 0,
+                        ipv6_addr_set_v4mapped(ip_hdr(skb)->saddr,
-                                      htonl(0xffff), ip_hdr(skb)->saddr);
+                                               &sin6->sin6_addr);
                else {
                        ipv6_addr_copy(&sin6->sin6_addr,
                                       &ipv6_hdr(skb)->saddr);
@@ -383,18 +511,18 @@ int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb)
                        goto drop;
        }
-        if ((rc = sock_queue_rcv_skb(sk,skb)) < 0) {
+        if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM) {
+                if (rc == -ENOMEM)
                        UDP6_INC_STATS_BH(sock_net(sk),
                                        UDP_MIB_RCVBUFERRORS, is_udplite);
-                        atomic_inc(&sk->sk_drops);
+                goto drop_no_sk_drops_inc;
-                }
-                goto drop;
        }
        return 0;
 drop:
+        atomic_inc(&sk->sk_drops);
+drop_no_sk_drops_inc:
        UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
        kfree_skb(skb);
        return -1;
@@ -415,10 +543,11 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
                if (!net_eq(sock_net(s), net))
                        continue;
-                if (s->sk_hash == num && s->sk_family == PF_INET6) {
+                if (udp_sk(s)->udp_port_hash == num &&
+                    s->sk_family == PF_INET6) {
                        struct ipv6_pinfo *np = inet6_sk(s);
-                        if (inet->dport) {
+                        if (inet->inet_dport) {
-                                if (inet->dport != rmt_port)
+                                if (inet->inet_dport != rmt_port)
                                        continue;
                        }
                        if (!ipv6_addr_any(&np->daddr) &&
@@ -440,6 +569,33 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
        return NULL;
 }
+static void flush_stack(struct sock **stack, unsigned int count,
+                        struct sk_buff *skb, unsigned int final)
+{
+        unsigned int i;
+        struct sock *sk;
+        struct sk_buff *skb1;
+        for (i = 0; i < count; i++) {
+                skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+                sk = stack[i];
+                if (skb1) {
+                        bh_lock_sock(sk);
+                        if (!sock_owned_by_user(sk))
+                                udpv6_queue_rcv_skb(sk, skb1);
+                        else
+                                sk_add_backlog(sk, skb1);
+                        bh_unlock_sock(sk);
+                } else {
+                        atomic_inc(&sk->sk_drops);
+                        UDP6_INC_STATS_BH(sock_net(sk),
+                                        UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+                        UDP6_INC_STATS_BH(sock_net(sk),
+                                        UDP_MIB_INERRORS, IS_UDPLITE(sk));
+                }
+        }
+}
 /*
 * Note: called only from the BH handler context,
 * so we don't need to lock the hashes.
@@ -448,41 +604,43 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                struct in6_addr *saddr, struct in6_addr *daddr,
                struct udp_table *udptable)
 {
-        struct sock *sk, *sk2;
+        struct sock *sk, *stack[256 / sizeof(struct sock *)];
        const struct udphdr *uh = udp_hdr(skb);
-        struct udp_hslot *hslot = &udptable->hash[udp_hashfn(net, ntohs(uh->dest))];
+        struct udp_hslot *hslot = udp_hashslot(udptable, net, ntohs(uh->dest));
        int dif;
+        unsigned int i, count = 0;
        spin_lock(&hslot->lock);
        sk = sk_nulls_head(&hslot->head);
        dif = inet6_iif(skb);
        sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
-        if (!sk) {
+        while (sk) {
-                kfree_skb(skb);
+                stack[count++] = sk;
-                goto out;
+                sk = udp_v6_mcast_next(net, sk_nulls_next(sk), uh->dest, daddr,
-        }
+                                       uh->source, saddr, dif);
+                if (unlikely(count == ARRAY_SIZE(stack))) {
-        sk2 = sk;
+                        if (!sk)
-        while ((sk2 = udp_v6_mcast_next(net, sk_nulls_next(sk2), uh->dest, daddr,
+                                break;
-                                        uh->source, saddr, dif))) {
+                        flush_stack(stack, count, skb, ~0);
-                struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
+                        count = 0;
-                if (buff) {
-                        bh_lock_sock(sk2);
-                        if (!sock_owned_by_user(sk2))
-                                udpv6_queue_rcv_skb(sk2, buff);
-                        else
-                                sk_add_backlog(sk2, buff);
-                        bh_unlock_sock(sk2);
                }
        }
-        bh_lock_sock(sk);
+        /*
-        if (!sock_owned_by_user(sk))
+         * before releasing the lock, we must take reference on sockets
-                udpv6_queue_rcv_skb(sk, skb);
+         */
-        else
+        for (i = 0; i < count; i++)
-                sk_add_backlog(sk, skb);
+                sock_hold(stack[i]);
-        bh_unlock_sock(sk);
-out:
        spin_unlock(&hslot->lock);
+        if (count) {
+                flush_stack(stack, count, skb, count - 1);
+                for (i = 0; i < count; i++)
+                        sock_put(stack[i]);
+        } else {
+                kfree_skb(skb);
+        }
        return 0;
 }
@@ -792,7 +950,7 @@ int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                if (ipv6_addr_v4mapped(daddr)) {
                        struct sockaddr_in sin;
                        sin.sin_family = AF_INET;
-                        sin.sin_port = sin6 ? sin6->sin6_port : inet->dport;
+                        sin.sin_port = sin6 ? sin6->sin6_port : inet->inet_dport;
                        sin.sin_addr.s_addr = daddr->s6_addr32[3];
                        msg->msg_name = &sin;
                        msg->msg_namelen = sizeof(sin);
@@ -865,7 +1023,7 @@ do_udp_sendmsg:
                if (sk->sk_state != TCP_ESTABLISHED)
                        return -EDESTADDRREQ;
-                fl.fl_ip_dport = inet->dport;
+                fl.fl_ip_dport = inet->inet_dport;
                daddr = &np->daddr;
                fl.fl6_flowlabel = np->flow_label;
                connected = 1;
@@ -877,6 +1035,8 @@ do_udp_sendmsg:
        if (!fl.oif)
                fl.oif = np->sticky_pktinfo.ipi6_ifindex;
+        fl.mark = sk->sk_mark;
        if (msg->msg_controllen) {
                opt = &opt_space;
                memset(opt, 0, sizeof(struct ipv6_txoptions));
@@ -909,7 +1069,7 @@ do_udp_sendmsg:
                fl.fl6_dst.s6_addr[15] = 0x1; /* :: means loopback (BSD'ism) */
        if (ipv6_addr_any(&fl.fl6_src) && !ipv6_addr_any(&np->saddr))
                ipv6_addr_copy(&fl.fl6_src, &np->saddr);
-        fl.fl_ip_sport = inet->sport;
+        fl.fl_ip_sport = inet->inet_sport;
        /* merge ip6_build_xmit from ip6_output */
        if (opt && opt->srcrt) {
@@ -1190,10 +1350,10 @@ static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket
        dest  = &np->daddr;
        src   = &np->rcv_saddr;
-        destp = ntohs(inet->dport);
+        destp = ntohs(inet->inet_dport);
-        srcp  = ntohs(inet->sport);
+        srcp  = ntohs(inet->inet_sport);
        seq_printf(seq,
-                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
                   bucket,
                   src->s6_addr32[0], src->s6_addr32[1],
@@ -1282,7 +1442,6 @@ static struct inet_protosw udpv6_protosw = {
        .protocol =  IPPROTO_UDP,
        .prot =      &udpv6_prot,
        .ops =       &inet6_dgram_ops,
-        .capability =-1,
        .no_check =  UDP_CSUM_DEFAULT,
        .flags =     INET_PROTOSW_PERMANENT,
 };
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index d737a27ee010..6ea6938919e6 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -62,7 +62,6 @@ static struct inet_protosw udplite6_protosw = {
        .protocol       = IPPROTO_UDPLITE,
        .prot           = &udplitev6_prot,
        .ops            = &inet6_dgram_ops,
-        .capability     = -1,
        .no_check       = 0,
        .flags          = INET_PROTOSW_PERMANENT,
 };
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 81a95c00e503..438831d33593 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -23,7 +23,7 @@
 */
 #include <linux/module.h>
 #include <linux/xfrm.h>
-#include <linux/list.h>
+#include <linux/rculist.h>
 #include <net/ip.h>
 #include <net/xfrm.h>
 #include <net/ipv6.h>
@@ -36,14 +36,15 @@
 * per xfrm_address_t.
 */
 struct xfrm6_tunnel_spi {
-        struct hlist_node list_byaddr;
+        struct hlist_node       list_byaddr;
-        struct hlist_node list_byspi;
+        struct hlist_node       list_byspi;
-        xfrm_address_t addr;
+        xfrm_address_t          addr;
-        u32 spi;
+        u32                     spi;
-        atomic_t refcnt;
+        atomic_t                refcnt;
+        struct rcu_head         rcu_head;
 };
-static DEFINE_RWLOCK(xfrm6_tunnel_spi_lock);
+static DEFINE_SPINLOCK(xfrm6_tunnel_spi_lock);
 static u32 xfrm6_tunnel_spi;
@@ -107,6 +108,7 @@ static void xfrm6_tunnel_spi_fini(void)
                if (!hlist_empty(&xfrm6_tunnel_spi_byspi[i]))
                        return;
        }
+        rcu_barrier();
        kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
        xfrm6_tunnel_spi_kmem = NULL;
 }
@@ -116,7 +118,7 @@ static struct xfrm6_tunnel_spi *__xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        struct hlist_node *pos;
-        hlist_for_each_entry(x6spi, pos,
+        hlist_for_each_entry_rcu(x6spi, pos,
                             &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
                             list_byaddr) {
                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0)
@@ -131,10 +133,10 @@ __be32 xfrm6_tunnel_spi_lookup(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
-        read_lock_bh(&xfrm6_tunnel_spi_lock);
+        rcu_read_lock_bh();
        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
        spi = x6spi ? x6spi->spi : 0;
-        read_unlock_bh(&xfrm6_tunnel_spi_lock);
+        rcu_read_unlock_bh();
        return htonl(spi);
 }
@@ -185,14 +187,15 @@ alloc_spi:
        if (!x6spi)
                goto out;
+        INIT_RCU_HEAD(&x6spi->rcu_head);
        memcpy(&x6spi->addr, saddr, sizeof(x6spi->addr));
        x6spi->spi = spi;
        atomic_set(&x6spi->refcnt, 1);
-        hlist_add_head(&x6spi->list_byspi, &xfrm6_tunnel_spi_byspi[index]);
+        hlist_add_head_rcu(&x6spi->list_byspi, &xfrm6_tunnel_spi_byspi[index]);
        index = xfrm6_tunnel_spi_hash_byaddr(saddr);
-        hlist_add_head(&x6spi->list_byaddr, &xfrm6_tunnel_spi_byaddr[index]);
+        hlist_add_head_rcu(&x6spi->list_byaddr, &xfrm6_tunnel_spi_byaddr[index]);
 out:
        return spi;
 }
@@ -202,26 +205,32 @@ __be32 xfrm6_tunnel_alloc_spi(xfrm_address_t *saddr)
        struct xfrm6_tunnel_spi *x6spi;
        u32 spi;
-        write_lock_bh(&xfrm6_tunnel_spi_lock);
+        spin_lock_bh(&xfrm6_tunnel_spi_lock);
        x6spi = __xfrm6_tunnel_spi_lookup(saddr);
        if (x6spi) {
                atomic_inc(&x6spi->refcnt);
                spi = x6spi->spi;
        } else
                spi = __xfrm6_tunnel_alloc_spi(saddr);
-        write_unlock_bh(&xfrm6_tunnel_spi_lock);
+        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
        return htonl(spi);
 }
 EXPORT_SYMBOL(xfrm6_tunnel_alloc_spi);
+static void x6spi_destroy_rcu(struct rcu_head *head)
+{
+        kmem_cache_free(xfrm6_tunnel_spi_kmem,
+                        container_of(head, struct xfrm6_tunnel_spi, rcu_head));
+}
 void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
 {
        struct xfrm6_tunnel_spi *x6spi;
        struct hlist_node *pos, *n;
-        write_lock_bh(&xfrm6_tunnel_spi_lock);
+        spin_lock_bh(&xfrm6_tunnel_spi_lock);
        hlist_for_each_entry_safe(x6spi, pos, n,
                                  &xfrm6_tunnel_spi_byaddr[xfrm6_tunnel_spi_hash_byaddr(saddr)],
@@ -229,14 +238,14 @@ void xfrm6_tunnel_free_spi(xfrm_address_t *saddr)
        {
                if (memcmp(&x6spi->addr, saddr, sizeof(x6spi->addr)) == 0) {
                        if (atomic_dec_and_test(&x6spi->refcnt)) {
-                                hlist_del(&x6spi->list_byaddr);
+                                hlist_del_rcu(&x6spi->list_byaddr);
-                                hlist_del(&x6spi->list_byspi);
+                                hlist_del_rcu(&x6spi->list_byspi);
-                                kmem_cache_free(xfrm6_tunnel_spi_kmem, x6spi);
+                                call_rcu(&x6spi->rcu_head, x6spi_destroy_rcu);
                                break;
                        }
                }
        }
-        write_unlock_bh(&xfrm6_tunnel_spi_lock);
+        spin_unlock_bh(&xfrm6_tunnel_spi_lock);
 }
 EXPORT_SYMBOL(xfrm6_tunnel_free_spi);