16 files changed, 107 insertions, 65 deletions

diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index c9138189415a..d4ade34ab375 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -224,9 +224,8 @@ static struct dst_entry *inet6_csk_route_socket(struct sock *sk,
         return dst;
 }
 
-int inet6_csk_xmit(struct sk_buff *skb, struct flowi *fl_unused)
+int inet6_csk_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl_unused)
 {
-        struct sock *sk = skb->sk;
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct flowi6 fl6;
         struct dst_entry *dst;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 34e0ded5c14b..87891f5f57b5 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1459,7 +1459,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
 
                                 if (w->skip) {
                                         w->skip--;
-                                        continue;
+                                        goto skip;
                                 }
 
                                 err = w->func(w);
@@ -1469,6 +1469,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                                 w->count++;
                                 continue;
                         }
+skip:
                         w->state = FWS_U;
                 case FWS_U:
                         if (fn == w->root)
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index c98338b81d30..9d921462b57f 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1559,6 +1559,15 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
         return 0;
 }
 
+static void ip6gre_dellink(struct net_device *dev, struct list_head *head)
+{
+        struct net *net = dev_net(dev);
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+
+        if (dev != ign->fb_tunnel_dev)
+                unregister_netdevice_queue(dev, head);
+}
+
 static size_t ip6gre_get_size(const struct net_device *dev)
 {
         return
@@ -1636,6 +1645,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
         .validate       = ip6gre_tunnel_validate,
         .newlink        = ip6gre_newlink,
         .changelink     = ip6gre_changelink,
+        .dellink        = ip6gre_dellink,
         .get_size       = ip6gre_get_size,
         .fill_info      = ip6gre_fill_info,
 };
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 59f95affceb0..b2f091566f88 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -196,7 +196,6 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
         unsigned int off;
         u16 flush = 1;
         int proto;
-        __wsum csum;
 
         off = skb_gro_offset(skb);
         hlen = off + sizeof(*iph);
@@ -264,13 +263,10 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
 
         NAPI_GRO_CB(skb)->flush |= flush;
 
-        csum = skb->csum;
-        skb_postpull_rcsum(skb, iph, skb_network_header_len(skb));
+        skb_gro_postpull_rcsum(skb, iph, nlen);
 
         pp = ops->callbacks.gro_receive(head, skb);
 
-        skb->csum = csum;
-
 out_unlock:
         rcu_read_unlock();
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 3284d61577c0..fbf11562b54c 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -132,7 +132,7 @@ static int ip6_finish_output(struct sk_buff *skb)
                 return ip6_finish_output2(skb);
 }
 
-int ip6_output(struct sk_buff *skb)
+int ip6_output(struct sock *sk, struct sk_buff *skb)
 {
         struct net_device *dev = skb_dst(skb)->dev;
         struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
@@ -344,12 +344,16 @@ static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
 
 static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
 {
-        if (skb->len <= mtu || skb->local_df)
+        if (skb->len <= mtu)
                 return false;
 
+        /* ipv6 conntrack defrag sets max_frag_size + local_df */
         if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
                 return true;
 
+        if (skb->local_df)
+                return false;
+
         if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
                 return false;
 
@@ -1225,7 +1229,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                 unsigned int maxnonfragsize, headersize;
 
                 headersize = sizeof(struct ipv6hdr) +
-                             (opt ? opt->tot_len : 0) +
+                             (opt ? opt->opt_flen + opt->opt_nflen : 0) +
                              (dst_allfrag(&rt->dst) ?
                               sizeof(struct frag_hdr) : 0) +
                              rt->rt6i_nfheader_len;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index e1df691d78be..f6a66bb4114d 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1340,8 +1340,8 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
         int err = 0;
         struct ip6_tnl_parm p;
         struct __ip6_tnl_parm p1;
-        struct ip6_tnl *t = NULL;
-        struct net *net = dev_net(dev);
+        struct ip6_tnl *t = netdev_priv(dev);
+        struct net *net = t->net;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
         switch (cmd) {
@@ -1353,11 +1353,11 @@ ip6_tnl_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
                         }
                         ip6_tnl_parm_from_user(&p1, &p);
                         t = ip6_tnl_locate(net, &p1, 0);
+                        if (t == NULL)
+                                t = netdev_priv(dev);
                 } else {
                         memset(&p, 0, sizeof(p));
                 }
-                if (t == NULL)
-                        t = netdev_priv(dev);
                 ip6_tnl_parm_to_user(&p, &t->parms);
                 if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof (p))) {
                         err = -EFAULT;
@@ -1557,7 +1557,7 @@ static int ip6_tnl_validate(struct nlattr *tb[], struct nlattr *data[])
 {
         u8 proto;
 
-        if (!data)
+        if (!data || !data[IFLA_IPTUN_PROTO])
                 return 0;
 
         proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index b7c0f827140b..6cc9f9371cc5 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -511,6 +511,7 @@ static int vti6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                     u8 type, u8 code, int offset, __be32 info)
 {
         __be32 spi;
+        __u32 mark;
         struct xfrm_state *x;
         struct ip6_tnl *t;
         struct ip_esp_hdr *esph;
@@ -524,6 +525,8 @@ static int vti6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
         if (!t)
                 return -1;
 
+        mark = be32_to_cpu(t->parms.o_key);
+
         switch (protocol) {
         case IPPROTO_ESP:
                 esph = (struct ip_esp_hdr *)(skb->data + offset);
@@ -545,7 +548,7 @@ static int vti6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
             type != NDISC_REDIRECT)
                 return 0;
 
-        x = xfrm_state_lookup(net, skb->mark, (const xfrm_address_t *)&iph->daddr,
+        x = xfrm_state_lookup(net, mark, (const xfrm_address_t *)&iph->daddr,
                               spi, protocol, AF_INET6);
         if (!x)
                 return 0;
@@ -1097,7 +1100,6 @@ static int __init vti6_tunnel_init(void)
 
         err = xfrm6_protocol_register(&vti_esp6_protocol, IPPROTO_ESP);
         if (err < 0) {
-                unregister_pernet_device(&vti6_net_ops);
                 pr_err("%s: can't register vti6 protocol\n", __func__);
 
                 goto out;
@@ -1106,7 +1108,6 @@ static int __init vti6_tunnel_init(void)
         err = xfrm6_protocol_register(&vti_ah6_protocol, IPPROTO_AH);
         if (err < 0) {
                 xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
-                unregister_pernet_device(&vti6_net_ops);
                 pr_err("%s: can't register vti6 protocol\n", __func__);
 
                 goto out;
@@ -1116,7 +1117,6 @@ static int __init vti6_tunnel_init(void)
         if (err < 0) {
                 xfrm6_protocol_deregister(&vti_ah6_protocol, IPPROTO_AH);
                 xfrm6_protocol_deregister(&vti_esp6_protocol, IPPROTO_ESP);
-                unregister_pernet_device(&vti6_net_ops);
                 pr_err("%s: can't register vti6 protocol\n", __func__);
 
                 goto out;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 8737400af0a0..8250474ab7dc 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -700,7 +700,7 @@ static netdev_tx_t reg_vif_xmit(struct sk_buff *skb,
         struct mr6_table *mrt;
         struct flowi6 fl6 = {
                 .flowi6_oif     = dev->ifindex,
-                .flowi6_iif     = skb->skb_iif,
+                .flowi6_iif     = skb->skb_iif ? : LOOPBACK_IFINDEX,
                 .flowi6_mark    = skb->mark,
         };
         int err;
@@ -1633,7 +1633,7 @@ struct sock *mroute6_socket(struct net *net, struct sk_buff *skb)
 {
         struct mr6_table *mrt;
         struct flowi6 fl6 = {
-                .flowi6_iif     = skb->skb_iif,
+                .flowi6_iif     = skb->skb_iif ? : LOOPBACK_IFINDEX,
                 .flowi6_oif     = skb->dev->ifindex,
                 .flowi6_mark    = skb->mark,
         };
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 09a22f4f36c9..ca8d4ea48a5d 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -851,7 +851,7 @@ out:
 static void ndisc_recv_na(struct sk_buff *skb)
 {
         struct nd_msg *msg = (struct nd_msg *)skb_transport_header(skb);
-        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
+        struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
         const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
         u8 *lladdr = NULL;
         u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
@@ -944,10 +944,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
                         /*
                          * Change: router to host
                          */
-                        struct rt6_info *rt;
-                        rt = rt6_get_dflt_router(saddr, dev);
-                        if (rt)
-                                ip6_del_rt(rt);
+                        rt6_clean_tohost(dev_net(dev),  saddr);
                 }
 
 out:
diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
index 95f3f1da0d7f..d38e6a8d8b9f 100644
--- a/net/ipv6/netfilter.c
+++ b/net/ipv6/netfilter.c
@@ -30,13 +30,15 @@ int ip6_route_me_harder(struct sk_buff *skb)
                 .daddr = iph->daddr,
                 .saddr = iph->saddr,
         };
+        int err;
 
         dst = ip6_route_output(net, skb->sk, &fl6);
-        if (dst->error) {
+        err = dst->error;
+        if (err) {
                 IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
                 LIMIT_NETDEBUG(KERN_DEBUG "ip6_route_me_harder: No more route.\n");
                 dst_release(dst);
-                return dst->error;
+                return err;
         }
 
         /* Drop old route. */
diff --git a/net/ipv6/netfilter/ip6t_rpfilter.c b/net/ipv6/netfilter/ip6t_rpfilter.c
index e0983f3648a6..790e0c6b19e1 100644
--- a/net/ipv6/netfilter/ip6t_rpfilter.c
+++ b/net/ipv6/netfilter/ip6t_rpfilter.c
@@ -33,6 +33,7 @@ static bool rpfilter_lookup_reverse6(const struct sk_buff *skb,
         struct ipv6hdr *iph = ipv6_hdr(skb);
         bool ret = false;
         struct flowi6 fl6 = {
+                .flowi6_iif = LOOPBACK_IFINDEX,
                 .flowlabel = (* (__be32 *) iph) & IPV6_FLOWINFO_MASK,
                 .flowi6_proto = iph->nexthdr,
                 .daddr = iph->saddr,
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5015c50a5ba7..6ebdb7b6744c 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -84,9 +84,9 @@ static void		ip6_dst_ifdown(struct dst_entry *,
 static int               ip6_dst_gc(struct dst_ops *ops);
 
 static int              ip6_pkt_discard(struct sk_buff *skb);
-static int              ip6_pkt_discard_out(struct sk_buff *skb);
+static int              ip6_pkt_discard_out(struct sock *sk, struct sk_buff *skb);
 static int              ip6_pkt_prohibit(struct sk_buff *skb);
-static int              ip6_pkt_prohibit_out(struct sk_buff *skb);
+static int              ip6_pkt_prohibit_out(struct sock *sk, struct sk_buff *skb);
 static void             ip6_link_failure(struct sk_buff *skb);
 static void             ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                                            struct sk_buff *skb, u32 mtu);
@@ -290,7 +290,7 @@ static const struct rt6_info ip6_blk_hole_entry_template = {
                 .obsolete       = DST_OBSOLETE_FORCE_CHK,
                 .error          = -EINVAL,
                 .input          = dst_discard,
-                .output         = dst_discard,
+                .output         = dst_discard_sk,
         },
         .rt6i_flags     = (RTF_REJECT | RTF_NONEXTHOP),
         .rt6i_protocol  = RTPROT_KERNEL,
@@ -1058,7 +1058,7 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
 
                 new->__use = 1;
                 new->input = dst_discard;
-                new->output = dst_discard;
+                new->output = dst_discard_sk;
 
                 if (dst_metrics_read_only(&ort->dst))
                         new->_metrics = ort->dst._metrics;
@@ -1273,6 +1273,7 @@ void ip6_redirect(struct sk_buff *skb, struct net *net, int oif, u32 mark)
         struct flowi6 fl6;
 
         memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_iif = LOOPBACK_IFINDEX;
         fl6.flowi6_oif = oif;
         fl6.flowi6_mark = mark;
         fl6.daddr = iph->daddr;
@@ -1294,6 +1295,7 @@ void ip6_redirect_no_header(struct sk_buff *skb, struct net *net, int oif,
         struct flowi6 fl6;
 
         memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_iif = LOOPBACK_IFINDEX;
         fl6.flowi6_oif = oif;
         fl6.flowi6_mark = mark;
         fl6.daddr = msg->dest;
@@ -1338,7 +1340,7 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
         unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
 
         if (mtu)
-                return mtu;
+                goto out;
 
         mtu = IPV6_MIN_MTU;
 
@@ -1348,7 +1350,8 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
                 mtu = idev->cnf.mtu6;
         rcu_read_unlock();
 
-        return mtu;
+out:
+        return min_t(unsigned int, mtu, IP6_MAX_MTU);
 }
 
 static struct dst_entry *icmp6_dst_gc_list;
@@ -1576,7 +1579,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 switch (cfg->fc_type) {
                 case RTN_BLACKHOLE:
                         rt->dst.error = -EINVAL;
-                        rt->dst.output = dst_discard;
+                        rt->dst.output = dst_discard_sk;
                         rt->dst.input = dst_discard;
                         break;
                 case RTN_PROHIBIT:
@@ -2128,7 +2131,7 @@ static int ip6_pkt_discard(struct sk_buff *skb)
         return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_INNOROUTES);
 }
 
-static int ip6_pkt_discard_out(struct sk_buff *skb)
+static int ip6_pkt_discard_out(struct sock *sk, struct sk_buff *skb)
 {
         skb->dev = skb_dst(skb)->dev;
         return ip6_pkt_drop(skb, ICMPV6_NOROUTE, IPSTATS_MIB_OUTNOROUTES);
@@ -2139,7 +2142,7 @@ static int ip6_pkt_prohibit(struct sk_buff *skb)
         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_INNOROUTES);
 }
 
-static int ip6_pkt_prohibit_out(struct sk_buff *skb)
+static int ip6_pkt_prohibit_out(struct sock *sk, struct sk_buff *skb)
 {
         skb->dev = skb_dst(skb)->dev;
         return ip6_pkt_drop(skb, ICMPV6_ADM_PROHIBITED, IPSTATS_MIB_OUTNOROUTES);
@@ -2231,6 +2234,27 @@ void rt6_remove_prefsrc(struct inet6_ifaddr *ifp)
         fib6_clean_all(net, fib6_remove_prefsrc, &adni);
 }
 
+#define RTF_RA_ROUTER           (RTF_ADDRCONF | RTF_DEFAULT | RTF_GATEWAY)
+#define RTF_CACHE_GATEWAY       (RTF_GATEWAY | RTF_CACHE)
+
+/* Remove routers and update dst entries when gateway turn into host. */
+static int fib6_clean_tohost(struct rt6_info *rt, void *arg)
+{
+        struct in6_addr *gateway = (struct in6_addr *)arg;
+
+        if ((((rt->rt6i_flags & RTF_RA_ROUTER) == RTF_RA_ROUTER) ||
+             ((rt->rt6i_flags & RTF_CACHE_GATEWAY) == RTF_CACHE_GATEWAY)) &&
+             ipv6_addr_equal(gateway, &rt->rt6i_gateway)) {
+                return -1;
+        }
+        return 0;
+}
+
+void rt6_clean_tohost(struct net *net, struct in6_addr *gateway)
+{
+        fib6_clean_all(net, fib6_clean_tohost, gateway);
+}
+
 struct arg_dev_net {
         struct net_device *dev;
         struct net *net;
@@ -2706,6 +2730,9 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh)
         if (tb[RTA_OIF])
                 oif = nla_get_u32(tb[RTA_OIF]);
 
+        if (tb[RTA_MARK])
+                fl6.flowi6_mark = nla_get_u32(tb[RTA_MARK]);
+
         if (iif) {
                 struct net_device *dev;
                 int flags = 0;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 1693c8d885f0..e5a453ca302e 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -974,8 +974,9 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 goto out;
         }
 
-        err = iptunnel_xmit(rt, skb, fl4.saddr, fl4.daddr, IPPROTO_IPV6, tos,
-                            ttl, df, !net_eq(tunnel->net, dev_net(dev)));
+        err = iptunnel_xmit(skb->sk, rt, skb, fl4.saddr, fl4.daddr,
+                            IPPROTO_IPV6, tos, ttl, df,
+                            !net_eq(tunnel->net, dev_net(dev)));
         iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
         return NETDEV_TX_OK;
 
@@ -1126,8 +1127,8 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
         int err = 0;
         struct ip_tunnel_parm p;
         struct ip_tunnel_prl prl;
-        struct ip_tunnel *t;
-        struct net *net = dev_net(dev);
+        struct ip_tunnel *t = netdev_priv(dev);
+        struct net *net = t->net;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 #ifdef CONFIG_IPV6_SIT_6RD
         struct ip_tunnel_6rd ip6rd;
@@ -1138,16 +1139,15 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
 #ifdef CONFIG_IPV6_SIT_6RD
         case SIOCGET6RD:
 #endif
-                t = NULL;
                 if (dev == sitn->fb_tunnel_dev) {
                         if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
                                 err = -EFAULT;
                                 break;
                         }
                         t = ipip6_tunnel_locate(net, &p, 0);
+                        if (t == NULL)
+                                t = netdev_priv(dev);
                 }
-                if (t == NULL)
-                        t = netdev_priv(dev);
 
                 err = -EFAULT;
                 if (cmd == SIOCGETTUNNEL) {
@@ -1243,9 +1243,6 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 err = -EINVAL;
                 if (dev == sitn->fb_tunnel_dev)
                         goto done;
-                err = -ENOENT;
-                if (!(t = netdev_priv(dev)))
-                        goto done;
                 err = ipip6_tunnel_get_prl(t, ifr->ifr_ifru.ifru_data);
                 break;
 
@@ -1261,9 +1258,6 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                 err = -EFAULT;
                 if (copy_from_user(&prl, ifr->ifr_ifru.ifru_data, sizeof(prl)))
                         goto done;
-                err = -ENOENT;
-                if (!(t = netdev_priv(dev)))
-                        goto done;
 
                 switch (cmd) {
                 case SIOCDELPRL:
@@ -1291,8 +1285,6 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                                    sizeof(ip6rd)))
                         goto done;
 
-                t = netdev_priv(dev);
-
                 if (cmd != SIOCDEL6RD) {
                         err = ipip6_tunnel_update_6rd(t, &ip6rd);
                         if (err < 0)
diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
index 0d78132ff18a..8517d3cd1aed 100644
--- a/net/ipv6/tcpv6_offload.c
+++ b/net/ipv6/tcpv6_offload.c
@@ -42,7 +42,7 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
         if (NAPI_GRO_CB(skb)->flush)
                 goto skip_csum;
 
-        wsum = skb->csum;
+        wsum = NAPI_GRO_CB(skb)->csum;
 
         switch (skb->ip_summed) {
         case CHECKSUM_NONE:
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index 6cd625e37706..b930d080c66f 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -114,12 +114,6 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
         if (err)
                 return err;
 
-        memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
-#ifdef CONFIG_NETFILTER
-        IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
-#endif
-
-        skb->protocol = htons(ETH_P_IPV6);
         skb->local_df = 1;
 
         return x->outer_mode->output2(x, skb);
@@ -128,11 +122,13 @@ EXPORT_SYMBOL(xfrm6_prepare_output);
 
 int xfrm6_output_finish(struct sk_buff *skb)
 {
+        memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
+        skb->protocol = htons(ETH_P_IPV6);
+
 #ifdef CONFIG_NETFILTER
         IP6CB(skb)->flags |= IP6SKB_XFRM_TRANSFORMED;
 #endif
 
-        skb->protocol = htons(ETH_P_IPV6);
         return xfrm_output(skb);
 }
 
@@ -142,6 +138,13 @@ static int __xfrm6_output(struct sk_buff *skb)
         struct xfrm_state *x = dst->xfrm;
         int mtu;
 
+#ifdef CONFIG_NETFILTER
+        if (!x) {
+                IP6CB(skb)->flags |= IP6SKB_REROUTED;
+                return dst_output(skb);
+        }
+#endif
+
         if (skb->protocol == htons(ETH_P_IPV6))
                 mtu = ip6_skb_dst_mtu(skb);
         else
@@ -163,8 +166,9 @@ static int __xfrm6_output(struct sk_buff *skb)
         return x->outer_mode->afinfo->output_finish(skb);
 }
 
-int xfrm6_output(struct sk_buff *skb)
+int xfrm6_output(struct sock *sk, struct sk_buff *skb)
 {
-        return NF_HOOK(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb, NULL,
-                       skb_dst(skb)->dev, __xfrm6_output);
+        return NF_HOOK_COND(NFPROTO_IPV6, NF_INET_POST_ROUTING, skb,
+                            NULL, skb_dst(skb)->dev, __xfrm6_output,
+                            !(IP6CB(skb)->flags & IP6SKB_REROUTED));
 }
diff --git a/net/ipv6/xfrm6_protocol.c b/net/ipv6/xfrm6_protocol.c
index 6ab989c486f7..54d13f8dbbae 100644
--- a/net/ipv6/xfrm6_protocol.c
+++ b/net/ipv6/xfrm6_protocol.c
@@ -50,6 +50,10 @@ int xfrm6_rcv_cb(struct sk_buff *skb, u8 protocol, int err)
 {
         int ret;
         struct xfrm6_protocol *handler;
+        struct xfrm6_protocol __rcu **head = proto_handlers(protocol);
+
+        if (!head)
+                return 0;
 
         for_each_protocol_rcu(*proto_handlers(protocol), handler)
                 if ((ret = handler->cb_handler(skb, err)) <= 0)
@@ -184,10 +188,12 @@ int xfrm6_protocol_register(struct xfrm6_protocol *handler,
         struct xfrm6_protocol __rcu **pprev;
         struct xfrm6_protocol *t;
         bool add_netproto = false;
-
         int ret = -EEXIST;
         int priority = handler->priority;
 
+        if (!proto_handlers(protocol) || !netproto(protocol))
+                return -EINVAL;
+
         mutex_lock(&xfrm6_protocol_mutex);
 
         if (!rcu_dereference_protected(*proto_handlers(protocol),
@@ -230,6 +236,9 @@ int xfrm6_protocol_deregister(struct xfrm6_protocol *handler,
         struct xfrm6_protocol *t;
         int ret = -ENOENT;
 
+        if (!proto_handlers(protocol) || !netproto(protocol))
+                return -EINVAL;
+
         mutex_lock(&xfrm6_protocol_mutex);
 
         for (pprev = proto_handlers(protocol);