26 files changed, 194 insertions, 443 deletions

diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index 42814a2ec9d7..ec992159b5f8 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -96,10 +96,8 @@ config INET6_ESP
 
 config INET6_IPCOMP
         tristate "IPv6: IPComp transformation"
-        select XFRM
         select INET6_XFRM_TUNNEL
-        select CRYPTO
-        select CRYPTO_DEFLATE
+        select XFRM_IPCOMP
         ---help---
           Support for IP Payload Compression Protocol (IPComp) (RFC3173),
           typically needed for IPsec.
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 9f4fcce6379b..e2d3b7580b76 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -153,7 +153,7 @@ static int ipv6_chk_same_addr(struct net *net, const struct in6_addr *addr,
 
 static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);
 
-struct ipv6_devconf ipv6_devconf __read_mostly = {
+static struct ipv6_devconf ipv6_devconf __read_mostly = {
         .forwarding             = 0,
         .hop_limit              = IPV6_DEFAULT_HOPLIMIT,
         .mtu6                   = IPV6_MIN_MTU,
@@ -313,8 +313,10 @@ static void in6_dev_finish_destroy_rcu(struct rcu_head *head)
 void in6_dev_finish_destroy(struct inet6_dev *idev)
 {
         struct net_device *dev = idev->dev;
-        BUG_TRAP(idev->addr_list==NULL);
-        BUG_TRAP(idev->mc_list==NULL);
+
+        WARN_ON(idev->addr_list != NULL);
+        WARN_ON(idev->mc_list != NULL);
+
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "in6_dev_finish_destroy: %s\n", dev ? dev->name : "NIL");
 #endif
@@ -517,8 +519,9 @@ static void addrconf_fixup_forwarding(struct ctl_table *table, int *p, int old)
 
 void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
 {
-        BUG_TRAP(ifp->if_next==NULL);
-        BUG_TRAP(ifp->lst_next==NULL);
+        WARN_ON(ifp->if_next != NULL);
+        WARN_ON(ifp->lst_next != NULL);
+
 #ifdef NET_REFCNT_DEBUG
         printk(KERN_DEBUG "inet6_ifa_finish_destroy\n");
 #endif
@@ -1103,13 +1106,12 @@ out:
         return ret;
 }
 
-int ipv6_dev_get_saddr(struct net_device *dst_dev,
+int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
                        const struct in6_addr *daddr, unsigned int prefs,
                        struct in6_addr *saddr)
 {
         struct ipv6_saddr_score scores[2],
                                 *score = &scores[0], *hiscore = &scores[1];
-        struct net *net = dev_net(dst_dev);
         struct ipv6_saddr_dst dst;
         struct net_device *dev;
         int dst_type;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3d828bc4b1cf..95055f8c3f35 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -83,7 +83,6 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol)
         struct inet_sock *inet;
         struct ipv6_pinfo *np;
         struct sock *sk;
-        struct list_head *p;
         struct inet_protosw *answer;
         struct proto *answer_prot;
         unsigned char answer_flags;
@@ -97,13 +96,12 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol)
                 build_ehash_secret();
 
         /* Look for the requested type/protocol pair. */
-        answer = NULL;
 lookup_protocol:
         err = -ESOCKTNOSUPPORT;
         rcu_read_lock();
-        list_for_each_rcu(p, &inetsw6[sock->type]) {
-                answer = list_entry(p, struct inet_protosw, list);
+        list_for_each_entry_rcu(answer, &inetsw6[sock->type], list) {
 
+                err = 0;
                 /* Check the non-wild match. */
                 if (protocol == answer->protocol) {
                         if (protocol != IPPROTO_IP)
@@ -118,10 +116,9 @@ lookup_protocol:
                                 break;
                 }
                 err = -EPROTONOSUPPORT;
-                answer = NULL;
         }
 
-        if (!answer) {
+        if (err) {
                 if (try_loading_module < 2) {
                         rcu_read_unlock();
                         /*
@@ -153,7 +150,7 @@ lookup_protocol:
         answer_flags = answer->flags;
         rcu_read_unlock();
 
-        BUG_TRAP(answer_prot->slab != NULL);
+        WARN_ON(answer_prot->slab == NULL);
 
         err = -ENOBUFS;
         sk = sk_alloc(net, PF_INET6, GFP_KERNEL, answer_prot);
@@ -937,6 +934,11 @@ static int __init inet6_init(void)
         if (err)
                 goto out_unregister_sock;
 
+#ifdef CONFIG_SYSCTL
+        err = ipv6_static_sysctl_register();
+        if (err)
+                goto static_sysctl_fail;
+#endif
         /*
          *      ipngwg API draft makes clear that the correct semantics
          *      for TCP and UDP is to consider one TCP and UDP instance
@@ -1061,6 +1063,10 @@ ipmr_fail:
 icmp_fail:
         unregister_pernet_subsys(&inet6_net_ops);
 register_pernet_fail:
+#ifdef CONFIG_SYSCTL
+        ipv6_static_sysctl_unregister();
+static_sysctl_fail:
+#endif
         cleanup_ipv6_mibs();
 out_unregister_sock:
         sock_unregister(PF_INET6);
@@ -1116,6 +1122,9 @@ static void __exit inet6_exit(void)
         rawv6_exit();
 
         unregister_pernet_subsys(&inet6_net_ops);
+#ifdef CONFIG_SYSCTL
+        ipv6_static_sysctl_unregister();
+#endif
         cleanup_ipv6_mibs();
         proto_unregister(&rawv6_prot);
         proto_unregister(&udplitev6_prot);
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index f7b535dec860..410046a8cc91 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -732,7 +732,7 @@ int datagram_send_ctl(struct net *net,
                         LIMIT_NETDEBUG(KERN_DEBUG "invalid cmsg type: %d\n",
                                        cmsg->cmsg_type);
                         err = -EINVAL;
-                        break;
+                        goto exit_f;
                 }
         }
 
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index c6bb4c6d24b3..b181b08fb761 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -521,6 +521,10 @@ static int esp6_init_state(struct xfrm_state *x)
                               crypto_aead_ivsize(aead);
         switch (x->props.mode) {
         case XFRM_MODE_BEET:
+                if (x->sel.family != AF_INET6)
+                        x->props.header_len += IPV4_BEET_PHMAXLEN +
+                                               (sizeof(struct ipv6hdr) - sizeof(struct iphdr));
+                break;
         case XFRM_MODE_TRANSPORT:
                 break;
         case XFRM_MODE_TUNNEL:
diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 8d05527524e3..f5de3f9dc692 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c
@@ -93,7 +93,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
                         if (flags & RT6_LOOKUP_F_SRCPREF_COA)
                                 srcprefs |= IPV6_PREFER_SRC_COA;
 
-                        if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
+                        if (ipv6_dev_get_saddr(net,
+                                               ip6_dst_idev(&rt->u.dst)->dev,
                                                &flp->fl6_dst, srcprefs,
                                                &saddr))
                                 goto again;
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 87801cc1b2f8..16d43f20b32f 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -98,7 +98,7 @@ struct request_sock *inet6_csk_search_req(const struct sock *sk,
                     ipv6_addr_equal(&treq->rmt_addr, raddr) &&
                     ipv6_addr_equal(&treq->loc_addr, laddr) &&
                     (!treq->iif || treq->iif == iif)) {
-                        BUG_TRAP(req->sk == NULL);
+                        WARN_ON(req->sk != NULL);
                         *prevp = prev;
                         return req;
                 }
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 00a8a5f9380c..1646a5658255 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -28,7 +28,7 @@ void __inet6_hash(struct sock *sk)
         struct hlist_head *list;
         rwlock_t *lock;
 
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
 
         if (sk->sk_state == TCP_LISTEN) {
                 list = &hashinfo->listening_hash[inet_sk_listen_hashfn(sk)];
@@ -202,7 +202,7 @@ unique:
          * in hash table socket with a funny identity. */
         inet->num = lport;
         inet->sport = htons(lport);
-        BUG_TRAP(sk_unhashed(sk));
+        WARN_ON(!sk_unhashed(sk));
         __sk_add_node(sk, &head->chain);
         sk->sk_hash = hash;
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 4de2b9efcacb..29c7c99e69f7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -287,7 +287,7 @@ static int fib6_dump_node(struct fib6_walker_t *w)
                         w->leaf = rt;
                         return 1;
                 }
-                BUG_TRAP(res!=0);
+                WARN_ON(res == 0);
         }
         w->leaf = NULL;
         return 0;
@@ -378,6 +378,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
 
         arg.skb = skb;
         arg.cb = cb;
+        arg.net = net;
         w->args = &arg;
 
         for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) {
@@ -661,17 +662,17 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct rt6_info *rt,
 
 static __inline__ void fib6_start_gc(struct net *net, struct rt6_info *rt)
 {
-        if (net->ipv6.ip6_fib_timer->expires == 0 &&
+        if (!timer_pending(&net->ipv6.ip6_fib_timer) &&
             (rt->rt6i_flags & (RTF_EXPIRES|RTF_CACHE)))
-                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
-                          net->ipv6.sysctl.ip6_rt_gc_interval);
+                mod_timer(&net->ipv6.ip6_fib_timer,
+                          jiffies + net->ipv6.sysctl.ip6_rt_gc_interval);
 }
 
 void fib6_force_start_gc(struct net *net)
 {
-        if (net->ipv6.ip6_fib_timer->expires == 0)
-                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
-                          net->ipv6.sysctl.ip6_rt_gc_interval);
+        if (!timer_pending(&net->ipv6.ip6_fib_timer))
+                mod_timer(&net->ipv6.ip6_fib_timer,
+                          jiffies + net->ipv6.sysctl.ip6_rt_gc_interval);
 }
 
 /*
@@ -778,7 +779,7 @@ out:
                         pn->leaf = fib6_find_prefix(info->nl_net, pn);
 #if RT6_DEBUG >= 2
                         if (!pn->leaf) {
-                                BUG_TRAP(pn->leaf != NULL);
+                                WARN_ON(pn->leaf == NULL);
                                 pn->leaf = info->nl_net->ipv6.ip6_null_entry;
                         }
 #endif
@@ -942,7 +943,7 @@ struct fib6_node * fib6_locate(struct fib6_node *root,
 
 #ifdef CONFIG_IPV6_SUBTREES
         if (src_len) {
-                BUG_TRAP(saddr!=NULL);
+                WARN_ON(saddr == NULL);
                 if (fn && fn->subtree)
                         fn = fib6_locate_1(fn->subtree, saddr, src_len,
                                            offsetof(struct rt6_info, rt6i_src));
@@ -996,9 +997,9 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 RT6_TRACE("fixing tree: plen=%d iter=%d\n", fn->fn_bit, iter);
                 iter++;
 
-                BUG_TRAP(!(fn->fn_flags&RTN_RTINFO));
-                BUG_TRAP(!(fn->fn_flags&RTN_TL_ROOT));
-                BUG_TRAP(fn->leaf==NULL);
+                WARN_ON(fn->fn_flags & RTN_RTINFO);
+                WARN_ON(fn->fn_flags & RTN_TL_ROOT);
+                WARN_ON(fn->leaf != NULL);
 
                 children = 0;
                 child = NULL;
@@ -1014,7 +1015,7 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                         fn->leaf = fib6_find_prefix(net, fn);
 #if RT6_DEBUG >= 2
                         if (fn->leaf==NULL) {
-                                BUG_TRAP(fn->leaf);
+                                WARN_ON(!fn->leaf);
                                 fn->leaf = net->ipv6.ip6_null_entry;
                         }
 #endif
@@ -1025,16 +1026,17 @@ static struct fib6_node *fib6_repair_tree(struct net *net,
                 pn = fn->parent;
 #ifdef CONFIG_IPV6_SUBTREES
                 if (FIB6_SUBTREE(pn) == fn) {
-                        BUG_TRAP(fn->fn_flags&RTN_ROOT);
+                        WARN_ON(!(fn->fn_flags & RTN_ROOT));
                         FIB6_SUBTREE(pn) = NULL;
                         nstate = FWS_L;
                 } else {
-                        BUG_TRAP(!(fn->fn_flags&RTN_ROOT));
+                        WARN_ON(fn->fn_flags & RTN_ROOT);
 #endif
                         if (pn->right == fn) pn->right = child;
                         else if (pn->left == fn) pn->left = child;
 #if RT6_DEBUG >= 2
-                        else BUG_TRAP(0);
+                        else
+                                WARN_ON(1);
 #endif
                         if (child)
                                 child->parent = pn;
@@ -1154,14 +1156,14 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
 
 #if RT6_DEBUG >= 2
         if (rt->u.dst.obsolete>0) {
-                BUG_TRAP(fn==NULL);
+                WARN_ON(fn != NULL);
                 return -ENOENT;
         }
 #endif
         if (fn == NULL || rt == net->ipv6.ip6_null_entry)
                 return -ENOENT;
 
-        BUG_TRAP(fn->fn_flags&RTN_RTINFO);
+        WARN_ON(!(fn->fn_flags & RTN_RTINFO));
 
         if (!(rt->rt6i_flags&RTF_CACHE)) {
                 struct fib6_node *pn = fn;
@@ -1266,7 +1268,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                         w->node = pn;
 #ifdef CONFIG_IPV6_SUBTREES
                         if (FIB6_SUBTREE(pn) == fn) {
-                                BUG_TRAP(fn->fn_flags&RTN_ROOT);
+                                WARN_ON(!(fn->fn_flags & RTN_ROOT));
                                 w->state = FWS_L;
                                 continue;
                         }
@@ -1281,7 +1283,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
                                 continue;
                         }
 #if RT6_DEBUG >= 2
-                        BUG_TRAP(0);
+                        WARN_ON(1);
 #endif
                 }
         }
@@ -1323,7 +1325,7 @@ static int fib6_clean_node(struct fib6_walker_t *w)
                         }
                         return 0;
                 }
-                BUG_TRAP(res==0);
+                WARN_ON(res != 0);
         }
         w->leaf = rt;
         return 0;
@@ -1447,27 +1449,23 @@ void fib6_run_gc(unsigned long expires, struct net *net)
                 gc_args.timeout = expires ? (int)expires :
                         net->ipv6.sysctl.ip6_rt_gc_interval;
         } else {
-                local_bh_disable();
-                if (!spin_trylock(&fib6_gc_lock)) {
-                        mod_timer(net->ipv6.ip6_fib_timer, jiffies + HZ);
-                        local_bh_enable();
+                if (!spin_trylock_bh(&fib6_gc_lock)) {
+                        mod_timer(&net->ipv6.ip6_fib_timer, jiffies + HZ);
                         return;
                 }
                 gc_args.timeout = net->ipv6.sysctl.ip6_rt_gc_interval;
         }
-        gc_args.more = 0;
 
-        icmp6_dst_gc(&gc_args.more);
+        gc_args.more = icmp6_dst_gc();
 
         fib6_clean_all(net, fib6_age, 0, NULL);
 
         if (gc_args.more)
-                mod_timer(net->ipv6.ip6_fib_timer, jiffies +
-                          net->ipv6.sysctl.ip6_rt_gc_interval);
-        else {
-                del_timer(net->ipv6.ip6_fib_timer);
-                net->ipv6.ip6_fib_timer->expires = 0;
-        }
+                mod_timer(&net->ipv6.ip6_fib_timer,
+                          round_jiffies(jiffies
+                                        + net->ipv6.sysctl.ip6_rt_gc_interval));
+        else
+                del_timer(&net->ipv6.ip6_fib_timer);
         spin_unlock_bh(&fib6_gc_lock);
 }
 
@@ -1478,24 +1476,15 @@ static void fib6_gc_timer_cb(unsigned long arg)
 
 static int fib6_net_init(struct net *net)
 {
-        int ret;
-        struct timer_list *timer;
-
-        ret = -ENOMEM;
-        timer = kzalloc(sizeof(*timer), GFP_KERNEL);
-        if (!timer)
-                goto out;
-
-        setup_timer(timer, fib6_gc_timer_cb, (unsigned long)net);
-        net->ipv6.ip6_fib_timer = timer;
+        setup_timer(&net->ipv6.ip6_fib_timer, fib6_gc_timer_cb, (unsigned long)net);
 
         net->ipv6.rt6_stats = kzalloc(sizeof(*net->ipv6.rt6_stats), GFP_KERNEL);
         if (!net->ipv6.rt6_stats)
                 goto out_timer;
 
-        net->ipv6.fib_table_hash =
-                kzalloc(sizeof(*net->ipv6.fib_table_hash)*FIB_TABLE_HASHSZ,
-                        GFP_KERNEL);
+        net->ipv6.fib_table_hash = kcalloc(FIB_TABLE_HASHSZ,
+                                           sizeof(*net->ipv6.fib_table_hash),
+                                           GFP_KERNEL);
         if (!net->ipv6.fib_table_hash)
                 goto out_rt6_stats;
 
@@ -1521,9 +1510,7 @@ static int fib6_net_init(struct net *net)
 #endif
         fib6_tables_init(net);
 
-        ret = 0;
-out:
-        return ret;
+        return 0;
 
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 out_fib6_main_tbl:
@@ -1534,15 +1521,14 @@ out_fib_table_hash:
 out_rt6_stats:
         kfree(net->ipv6.rt6_stats);
 out_timer:
-        kfree(timer);
-        goto out;
+        return -ENOMEM;
  }
 
 static void fib6_net_exit(struct net *net)
 {
         rt6_ifdown(net, NULL);
-        del_timer_sync(net->ipv6.ip6_fib_timer);
-        kfree(net->ipv6.ip6_fib_timer);
+        del_timer_sync(&net->ipv6.ip6_fib_timer);
+
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
         kfree(net->ipv6.fib6_local_tbl);
 #endif
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 6407c64ea4a5..0e844c2736a7 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -116,7 +116,7 @@ static int ip6_dev_loopback_xmit(struct sk_buff *newskb)
         __skb_pull(newskb, skb_network_offset(newskb));
         newskb->pkt_type = PACKET_LOOPBACK;
         newskb->ip_summed = CHECKSUM_UNNECESSARY;
-        BUG_TRAP(newskb->dst);
+        WARN_ON(!newskb->dst);
 
         netif_rx(newskb);
         return 0;
@@ -236,6 +236,10 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         skb_reset_network_header(skb);
         hdr = ipv6_hdr(skb);
 
+        /* Allow local fragmentation. */
+        if (ipfragok)
+                skb->local_df = 1;
+
         /*
          *      Fill in the IPv6 header
          */
@@ -265,7 +269,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi *fl,
         skb->mark = sk->sk_mark;
 
         mtu = dst_mtu(dst);
-        if ((skb->len <= mtu) || ipfragok || skb_is_gso(skb)) {
+        if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
                 IP6_INC_STATS(ip6_dst_idev(skb->dst),
                               IPSTATS_MIB_OUTREQUESTS);
                 return NF_HOOK(PF_INET6, NF_INET_LOCAL_OUT, skb, NULL, dst->dev,
@@ -930,7 +934,7 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                 goto out_err_release;
 
         if (ipv6_addr_any(&fl->fl6_src)) {
-                err = ipv6_dev_get_saddr(ip6_dst_idev(*dst)->dev,
+                err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
                                          &fl->fl6_dst,
                                          sk ? inet6_sk(sk)->srcprefs : 0,
                                          &fl->fl6_src);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index ee6de425ce6b..4545e4306862 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -50,125 +50,6 @@
 #include <linux/icmpv6.h>
 #include <linux/mutex.h>
 
-struct ipcomp6_tfms {
-        struct list_head list;
-        struct crypto_comp **tfms;
-        int users;
-};
-
-static DEFINE_MUTEX(ipcomp6_resource_mutex);
-static void **ipcomp6_scratches;
-static int ipcomp6_scratch_users;
-static LIST_HEAD(ipcomp6_tfms_list);
-
-static int ipcomp6_input(struct xfrm_state *x, struct sk_buff *skb)
-{
-        int nexthdr;
-        int err = -ENOMEM;
-        struct ip_comp_hdr *ipch;
-        int plen, dlen;
-        struct ipcomp_data *ipcd = x->data;
-        u8 *start, *scratch;
-        struct crypto_comp *tfm;
-        int cpu;
-
-        if (skb_linearize_cow(skb))
-                goto out;
-
-        skb->ip_summed = CHECKSUM_NONE;
-
-        /* Remove ipcomp header and decompress original payload */
-        ipch = (void *)skb->data;
-        nexthdr = ipch->nexthdr;
-
-        skb->transport_header = skb->network_header + sizeof(*ipch);
-        __skb_pull(skb, sizeof(*ipch));
-
-        /* decompression */
-        plen = skb->len;
-        dlen = IPCOMP_SCRATCH_SIZE;
-        start = skb->data;
-
-        cpu = get_cpu();
-        scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
-        tfm = *per_cpu_ptr(ipcd->tfms, cpu);
-
-        err = crypto_comp_decompress(tfm, start, plen, scratch, &dlen);
-        if (err)
-                goto out_put_cpu;
-
-        if (dlen < (plen + sizeof(*ipch))) {
-                err = -EINVAL;
-                goto out_put_cpu;
-        }
-
-        err = pskb_expand_head(skb, 0, dlen - plen, GFP_ATOMIC);
-        if (err) {
-                goto out_put_cpu;
-        }
-
-        skb->truesize += dlen - plen;
-        __skb_put(skb, dlen - plen);
-        skb_copy_to_linear_data(skb, scratch, dlen);
-        err = nexthdr;
-
-out_put_cpu:
-        put_cpu();
-out:
-        return err;
-}
-
-static int ipcomp6_output(struct xfrm_state *x, struct sk_buff *skb)
-{
-        int err;
-        struct ip_comp_hdr *ipch;
-        struct ipcomp_data *ipcd = x->data;
-        int plen, dlen;
-        u8 *start, *scratch;
-        struct crypto_comp *tfm;
-        int cpu;
-
-        /* check whether datagram len is larger than threshold */
-        if (skb->len < ipcd->threshold) {
-                goto out_ok;
-        }
-
-        if (skb_linearize_cow(skb))
-                goto out_ok;
-
-        /* compression */
-        plen = skb->len;
-        dlen = IPCOMP_SCRATCH_SIZE;
-        start = skb->data;
-
-        cpu = get_cpu();
-        scratch = *per_cpu_ptr(ipcomp6_scratches, cpu);
-        tfm = *per_cpu_ptr(ipcd->tfms, cpu);
-
-        local_bh_disable();
-        err = crypto_comp_compress(tfm, start, plen, scratch, &dlen);
-        local_bh_enable();
-        if (err || (dlen + sizeof(*ipch)) >= plen) {
-                put_cpu();
-                goto out_ok;
-        }
-        memcpy(start + sizeof(struct ip_comp_hdr), scratch, dlen);
-        put_cpu();
-        pskb_trim(skb, dlen + sizeof(struct ip_comp_hdr));
-
-        /* insert ipcomp header and replace datagram */
-        ipch = ip_comp_hdr(skb);
-        ipch->nexthdr = *skb_mac_header(skb);
-        ipch->flags = 0;
-        ipch->cpi = htons((u16 )ntohl(x->id.spi));
-        *skb_mac_header(skb) = IPPROTO_COMP;
-
-out_ok:
-        skb_push(skb, -skb_network_offset(skb));
-
-        return 0;
-}
-
 static void ipcomp6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                                 int type, int code, int offset, __be32 info)
 {
@@ -251,160 +132,9 @@ out:
         return err;
 }
 
-static void ipcomp6_free_scratches(void)
-{
-        int i;
-        void **scratches;
-
-        if (--ipcomp6_scratch_users)
-                return;
-
-        scratches = ipcomp6_scratches;
-        if (!scratches)
-                return;
-
-        for_each_possible_cpu(i) {
-                void *scratch = *per_cpu_ptr(scratches, i);
-
-                vfree(scratch);
-        }
-
-        free_percpu(scratches);
-}
-
-static void **ipcomp6_alloc_scratches(void)
-{
-        int i;
-        void **scratches;
-
-        if (ipcomp6_scratch_users++)
-                return ipcomp6_scratches;
-
-        scratches = alloc_percpu(void *);
-        if (!scratches)
-                return NULL;
-
-        ipcomp6_scratches = scratches;
-
-        for_each_possible_cpu(i) {
-                void *scratch = vmalloc(IPCOMP_SCRATCH_SIZE);
-                if (!scratch)
-                        return NULL;
-                *per_cpu_ptr(scratches, i) = scratch;
-        }
-
-        return scratches;
-}
-
-static void ipcomp6_free_tfms(struct crypto_comp **tfms)
-{
-        struct ipcomp6_tfms *pos;
-        int cpu;
-
-        list_for_each_entry(pos, &ipcomp6_tfms_list, list) {
-                if (pos->tfms == tfms)
-                        break;
-        }
-
-        BUG_TRAP(pos);
-
-        if (--pos->users)
-                return;
-
-        list_del(&pos->list);
-        kfree(pos);
-
-        if (!tfms)
-                return;
-
-        for_each_possible_cpu(cpu) {
-                struct crypto_comp *tfm = *per_cpu_ptr(tfms, cpu);
-                crypto_free_comp(tfm);
-        }
-        free_percpu(tfms);
-}
-
-static struct crypto_comp **ipcomp6_alloc_tfms(const char *alg_name)
-{
-        struct ipcomp6_tfms *pos;
-        struct crypto_comp **tfms;
-        int cpu;
-
-        /* This can be any valid CPU ID so we don't need locking. */
-        cpu = raw_smp_processor_id();
-
-        list_for_each_entry(pos, &ipcomp6_tfms_list, list) {
-                struct crypto_comp *tfm;
-
-                tfms = pos->tfms;
-                tfm = *per_cpu_ptr(tfms, cpu);
-
-                if (!strcmp(crypto_comp_name(tfm), alg_name)) {
-                        pos->users++;
-                        return tfms;
-                }
-        }
-
-        pos = kmalloc(sizeof(*pos), GFP_KERNEL);
-        if (!pos)
-                return NULL;
-
-        pos->users = 1;
-        INIT_LIST_HEAD(&pos->list);
-        list_add(&pos->list, &ipcomp6_tfms_list);
-
-        pos->tfms = tfms = alloc_percpu(struct crypto_comp *);
-        if (!tfms)
-                goto error;
-
-        for_each_possible_cpu(cpu) {
-                struct crypto_comp *tfm = crypto_alloc_comp(alg_name, 0,
-                                                            CRYPTO_ALG_ASYNC);
-                if (IS_ERR(tfm))
-                        goto error;
-                *per_cpu_ptr(tfms, cpu) = tfm;
-        }
-
-        return tfms;
-
-error:
-        ipcomp6_free_tfms(tfms);
-        return NULL;
-}
-
-static void ipcomp6_free_data(struct ipcomp_data *ipcd)
-{
-        if (ipcd->tfms)
-                ipcomp6_free_tfms(ipcd->tfms);
-        ipcomp6_free_scratches();
-}
-
-static void ipcomp6_destroy(struct xfrm_state *x)
-{
-        struct ipcomp_data *ipcd = x->data;
-        if (!ipcd)
-                return;
-        xfrm_state_delete_tunnel(x);
-        mutex_lock(&ipcomp6_resource_mutex);
-        ipcomp6_free_data(ipcd);
-        mutex_unlock(&ipcomp6_resource_mutex);
-        kfree(ipcd);
-
-        xfrm6_tunnel_free_spi((xfrm_address_t *)&x->props.saddr);
-}
-
 static int ipcomp6_init_state(struct xfrm_state *x)
 {
-        int err;
-        struct ipcomp_data *ipcd;
-        struct xfrm_algo_desc *calg_desc;
-
-        err = -EINVAL;
-        if (!x->calg)
-                goto out;
-
-        if (x->encap)
-                goto out;
+        int err = -EINVAL;
 
         x->props.header_len = 0;
         switch (x->props.mode) {
@@ -417,39 +147,21 @@ static int ipcomp6_init_state(struct xfrm_state *x)
                 goto out;
         }
 
-        err = -ENOMEM;
-        ipcd = kzalloc(sizeof(*ipcd), GFP_KERNEL);
-        if (!ipcd)
+        err = ipcomp_init_state(x);
+        if (err)
                 goto out;
 
-        mutex_lock(&ipcomp6_resource_mutex);
-        if (!ipcomp6_alloc_scratches())
-                goto error;
-
-        ipcd->tfms = ipcomp6_alloc_tfms(x->calg->alg_name);
-        if (!ipcd->tfms)
-                goto error;
-        mutex_unlock(&ipcomp6_resource_mutex);
-
         if (x->props.mode == XFRM_MODE_TUNNEL) {
                 err = ipcomp6_tunnel_attach(x);
                 if (err)
                         goto error_tunnel;
         }
 
-        calg_desc = xfrm_calg_get_byname(x->calg->alg_name, 0);
-        BUG_ON(!calg_desc);
-        ipcd->threshold = calg_desc->uinfo.comp.threshold;
-        x->data = ipcd;
         err = 0;
 out:
         return err;
 error_tunnel:
-        mutex_lock(&ipcomp6_resource_mutex);
-error:
-        ipcomp6_free_data(ipcd);
-        mutex_unlock(&ipcomp6_resource_mutex);
-        kfree(ipcd);
+        ipcomp_destroy(x);
 
         goto out;
 }
@@ -460,9 +172,9 @@ static const struct xfrm_type ipcomp6_type =
         .owner          = THIS_MODULE,
         .proto          = IPPROTO_COMP,
         .init_state     = ipcomp6_init_state,
-        .destructor     = ipcomp6_destroy,
-        .input          = ipcomp6_input,
-        .output         = ipcomp6_output,
+        .destructor     = ipcomp_destroy,
+        .input          = ipcomp_input,
+        .output         = ipcomp_output,
         .hdr_offset     = xfrm6_find_1stfragopt,
 };
 
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index ea33b26512c2..4e5eac301f91 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -346,6 +346,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
                  */
                 if (optlen == 0)
                         optval = NULL;
+                else if (optval == NULL)
+                        goto e_inval;
                 else if (optlen < sizeof(struct ipv6_opt_hdr) ||
                          optlen & 0x7 || optlen > 8 * 255)
                         goto e_inval;
@@ -909,7 +911,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                 } else {
                         if (np->rxopt.bits.rxinfo) {
                                 struct in6_pktinfo src_info;
-                                src_info.ipi6_ifindex = np->mcast_oif;
+                                src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
                                 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
                                 put_cmsg(&msg, SOL_IPV6, IPV6_PKTINFO, sizeof(src_info), &src_info);
                         }
@@ -919,7 +921,7 @@ static int do_ipv6_getsockopt(struct sock *sk, int level, int optname,
                         }
                         if (np->rxopt.bits.rxoinfo) {
                                 struct in6_pktinfo src_info;
-                                src_info.ipi6_ifindex = np->mcast_oif;
+                                src_info.ipi6_ifindex = np->mcast_oif ? np->mcast_oif : sk->sk_bound_dev_if;
                                 ipv6_addr_copy(&src_info.ipi6_addr, &np->daddr);
                                 put_cmsg(&msg, SOL_IPV6, IPV6_2292PKTINFO, sizeof(src_info), &src_info);
                         }
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index ad1cc5bbf977..31295c8f6196 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -164,8 +164,8 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
                         calc_padlen(sizeof(*dstopt), 6));
 
         hao->type = IPV6_TLV_HAO;
+        BUILD_BUG_ON(sizeof(*hao) != 18);
         hao->length = sizeof(*hao) - 2;
-        BUG_TRAP(hao->length == 16);
 
         len = ((char *)hao - (char *)dstopt) + sizeof(*hao);
 
@@ -174,7 +174,7 @@ static int mip6_destopt_output(struct xfrm_state *x, struct sk_buff *skb)
         memcpy(&iph->saddr, x->coaddr, sizeof(iph->saddr));
         spin_unlock_bh(&x->lock);
 
-        BUG_TRAP(len == x->props.header_len);
+        WARN_ON(len != x->props.header_len);
         dstopt->hdrlen = (x->props.header_len >> 3) - 1;
 
         return 0;
@@ -317,7 +317,7 @@ static int mip6_destopt_init_state(struct xfrm_state *x)
         x->props.header_len = sizeof(struct ipv6_destopt_hdr) +
                 calc_padlen(sizeof(struct ipv6_destopt_hdr), 6) +
                 sizeof(struct ipv6_destopt_hao);
-        BUG_TRAP(x->props.header_len == 24);
+        WARN_ON(x->props.header_len != 24);
 
         return 0;
 }
@@ -380,7 +380,7 @@ static int mip6_rthdr_output(struct xfrm_state *x, struct sk_buff *skb)
         rt2->rt_hdr.segments_left = 1;
         memset(&rt2->reserved, 0, sizeof(rt2->reserved));
 
-        BUG_TRAP(rt2->rt_hdr.hdrlen == 2);
+        WARN_ON(rt2->rt_hdr.hdrlen != 2);
 
         memcpy(&rt2->addr, &iph->daddr, sizeof(rt2->addr));
         spin_lock_bh(&x->lock);
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index beb48e3f038a..f1c62ba0f56b 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -549,7 +549,7 @@ static void ndisc_send_na(struct net_device *dev, struct neighbour *neigh,
                         override = 0;
                 in6_ifa_put(ifp);
         } else {
-                if (ipv6_dev_get_saddr(dev, daddr,
+                if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
                                        inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
                                        &tmpaddr))
                         return;
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 689dec899c57..0cfcce7b18d8 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -213,7 +213,7 @@ config IP6_NF_SECURITY
        tristate "Security table"
        depends on IP6_NF_IPTABLES
        depends on SECURITY
-       default m if NETFILTER_ADVANCED=n
+       depends on NETFILTER_ADVANCED
        help
          This option adds a `security' table to iptables, for use
          with Mandatory Access Control (MAC) policy.
diff --git a/net/ipv6/netfilter/ip6table_security.c b/net/ipv6/netfilter/ip6table_security.c
index a07abee30497..6e7131036bc6 100644
--- a/net/ipv6/netfilter/ip6table_security.c
+++ b/net/ipv6/netfilter/ip6table_security.c
@@ -31,7 +31,7 @@ static struct
         struct ip6t_replace repl;
         struct ip6t_standard entries[3];
         struct ip6t_error term;
-} initial_table __initdata = {
+} initial_table __net_initdata = {
         .repl = {
                 .name = "security",
                 .valid_hooks = SECURITY_VALID_HOOKS,
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index cf20bc4fd60d..52d06dd4b817 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -416,8 +416,8 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
 
         fq_kill(fq);
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(NFCT_FRAG6_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(NFCT_FRAG6_CB(head)->offset != 0);
 
         /* Unfragmented part is taken from the first segment. */
         payload_len = ((head->data - skb_network_header(head)) -
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index f82f6074cf85..0179b66864f1 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -286,7 +286,6 @@ proc_net_fail:
 
 void ipv6_misc_proc_exit(void)
 {
-        proc_net_remove(&init_net, "sockstat6");
         proc_net_remove(&init_net, "dev_snmp6");
         proc_net_remove(&init_net, "snmp6");
         unregister_pernet_subsys(&ipv6_proc_ops);
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 6ab957ec2dd6..89184b576e23 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -473,8 +473,8 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
                 fq->q.fragments = head;
         }
 
-        BUG_TRAP(head != NULL);
-        BUG_TRAP(FRAG6_CB(head)->offset == 0);
+        WARN_ON(head == NULL);
+        WARN_ON(FRAG6_CB(head)->offset != 0);
 
         /* Unfragmented part is taken from the first segment. */
         payload_len = ((head->data - skb_network_header(head)) -
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 615b328de251..9af6115f0f50 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -978,13 +978,12 @@ out:
         return &rt->u.dst;
 }
 
-int icmp6_dst_gc(int *more)
+int icmp6_dst_gc(void)
 {
         struct dst_entry *dst, *next, **pprev;
-        int freed;
+        int more = 0;
 
         next = NULL;
-        freed = 0;
 
         spin_lock_bh(&icmp6_dst_lock);
         pprev = &icmp6_dst_gc_list;
@@ -993,16 +992,15 @@ int icmp6_dst_gc(int *more)
                 if (!atomic_read(&dst->__refcnt)) {
                         *pprev = dst->next;
                         dst_free(dst);
-                        freed++;
                 } else {
                         pprev = &dst->next;
-                        (*more)++;
+                        ++more;
                 }
         }
 
         spin_unlock_bh(&icmp6_dst_lock);
 
-        return freed;
+        return more;
 }
 
 static int ip6_dst_gc(struct dst_ops *ops)
@@ -1251,7 +1249,7 @@ install_route:
 
         if (dst_metric(&rt->u.dst, RTAX_HOPLIMIT) == 0)
                 rt->u.dst.metrics[RTAX_HOPLIMIT-1] = -1;
-        if (!dst_metric(&rt->u.dst, RTAX_MTU))
+        if (!dst_mtu(&rt->u.dst))
                 rt->u.dst.metrics[RTAX_MTU-1] = ipv6_get_mtu(dev);
         if (!dst_metric(&rt->u.dst, RTAX_ADVMSS))
                 rt->u.dst.metrics[RTAX_ADVMSS-1] = ipv6_advmss(net, dst_mtu(&rt->u.dst));
@@ -2108,7 +2106,8 @@ static inline size_t rt6_nlmsg_size(void)
                + nla_total_size(sizeof(struct rta_cacheinfo));
 }
 
-static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
+static int rt6_fill_node(struct net *net,
+                         struct sk_buff *skb, struct rt6_info *rt,
                          struct in6_addr *dst, struct in6_addr *src,
                          int iif, int type, u32 pid, u32 seq,
                          int prefix, int nowait, unsigned int flags)
@@ -2189,8 +2188,9 @@ static int rt6_fill_node(struct sk_buff *skb, struct rt6_info *rt,
 #endif
                         NLA_PUT_U32(skb, RTA_IIF, iif);
         } else if (dst) {
+                struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
                 struct in6_addr saddr_buf;
-                if (ipv6_dev_get_saddr(ip6_dst_idev(&rt->u.dst)->dev,
+                if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
                                        dst, 0, &saddr_buf) == 0)
                         NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
         }
@@ -2235,7 +2235,8 @@ int rt6_dump_route(struct rt6_info *rt, void *p_arg)
         } else
                 prefix = 0;
 
-        return rt6_fill_node(arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
+        return rt6_fill_node(arg->net,
+                     arg->skb, rt, NULL, NULL, 0, RTM_NEWROUTE,
                      NETLINK_CB(arg->cb->skb).pid, arg->cb->nlh->nlmsg_seq,
                      prefix, 0, NLM_F_MULTI);
 }
@@ -2301,7 +2302,7 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr* nlh, void
         rt = (struct rt6_info*) ip6_route_output(net, NULL, &fl);
         skb->dst = &rt->u.dst;
 
-        err = rt6_fill_node(skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
+        err = rt6_fill_node(net, skb, rt, &fl.fl6_dst, &fl.fl6_src, iif,
                             RTM_NEWROUTE, NETLINK_CB(in_skb).pid,
                             nlh->nlmsg_seq, 0, 0, 0);
         if (err < 0) {
@@ -2328,7 +2329,7 @@ void inet6_rt_notify(int event, struct rt6_info *rt, struct nl_info *info)
         if (skb == NULL)
                 goto errout;
 
-        err = rt6_fill_node(skb, rt, NULL, NULL, 0,
+        err = rt6_fill_node(net, skb, rt, NULL, NULL, 0,
                                 event, info->pid, seq, 0, 0, 0);
         if (err < 0) {
                 /* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 6a68eeb7bbf8..ec394cf5a19b 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -199,10 +199,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq6 = inet6_rsk(req);
         treq = tcp_rsk(req);
 
-        if (security_inet_conn_request(sk, skb, req)) {
-                reqsk_free(req);
-                goto out;
-        }
+        if (security_inet_conn_request(sk, skb, req))
+                goto out_free;
 
         req->mss = mss;
         ireq->rmt_port = th->source;
@@ -223,6 +221,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
 
         req->expires = 0UL;
         req->retrans = 0;
+        ireq->ecn_ok            = 0;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
@@ -254,14 +253,13 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                 fl.fl_ip_dport = inet_rsk(req)->rmt_port;
                 fl.fl_ip_sport = inet_sk(sk)->sport;
                 security_req_classify_flow(req, &fl);
-                if (ip6_dst_lookup(sk, &dst, &fl)) {
-                        reqsk_free(req);
-                        goto out;
-                }
+                if (ip6_dst_lookup(sk, &dst, &fl))
+                        goto out_free;
+
                 if (final_p)
                         ipv6_addr_copy(&fl.fl6_dst, final_p);
                 if ((xfrm_lookup(&dst, &fl, sk, 0)) < 0)
-                        goto out;
+                        goto out_free;
         }
 
         req->window_clamp = tp->window_clamp ? :dst_metric(dst, RTAX_WINDOW);
@@ -272,7 +270,10 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq->rcv_wscale = rcv_wscale;
 
         ret = get_cookie_sock(sk, skb, req, dst);
-
-out:    return ret;
+out:
+        return ret;
+out_free:
+        reqsk_free(req);
+        return NULL;
 }
 
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 5c99274558bf..e6dfaeac6be3 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -150,3 +150,19 @@ void ipv6_sysctl_unregister(void)
         unregister_net_sysctl_table(ip6_header);
         unregister_pernet_subsys(&ipv6_sysctl_net_ops);
 }
+
+static struct ctl_table_header *ip6_base;
+
+int ipv6_static_sysctl_register(void)
+{
+        static struct ctl_table empty[1];
+        ip6_base = register_net_sysctl_rotable(net_ipv6_ctl_path, empty);
+        if (ip6_base == NULL)
+                return -ENOMEM;
+        return 0;
+}
+
+void ipv6_static_sysctl_unregister(void)
+{
+        unregister_net_sysctl_table(ip6_base);
+}
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ae45f9835014..5b90b369ccb2 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -69,7 +69,8 @@
 #include <linux/scatterlist.h>
 
 static void     tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
-static void     tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req);
+static void     tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                                      struct request_sock *req);
 
 static int      tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb);
 
@@ -421,7 +422,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                 /* ICMPs are not backlogged, hence we cannot get
                  * an established socket here.
                  */
-                BUG_TRAP(req->sk == NULL);
+                WARN_ON(req->sk != NULL);
 
                 if (seq != tcp_rsk(req)->snt_isn) {
                         NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
@@ -748,7 +749,7 @@ static int tcp_v6_md5_hash_pseudoheader(struct tcp_md5sig_pool *hp,
         ipv6_addr_copy(&bp->saddr, saddr);
         ipv6_addr_copy(&bp->daddr, daddr);
         bp->protocol = cpu_to_be32(IPPROTO_TCP);
-        bp->len = cpu_to_be16(nbytes);
+        bp->len = cpu_to_be32(nbytes);
 
         sg_init_one(&sg, bp, sizeof(*bp));
         return crypto_hash_update(&hp->md5_desc, &sg, sizeof(*bp));
@@ -849,28 +850,17 @@ static int tcp_v6_inbound_md5_hash (struct sock *sk, struct sk_buff *skb)
         hash_expected = tcp_v6_md5_do_lookup(sk, &ip6h->saddr);
         hash_location = tcp_parse_md5sig_option(th);
 
-        /* do we have a hash as expected? */
-        if (!hash_expected) {
-                if (!hash_location)
-                        return 0;
-                if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash NOT expected but found "
-                               "(" NIP6_FMT ", %u)->"
-                               "(" NIP6_FMT ", %u)\n",
-                               NIP6(ip6h->saddr), ntohs(th->source),
-                               NIP6(ip6h->daddr), ntohs(th->dest));
-                }
+        /* We've parsed the options - do we have a hash? */
+        if (!hash_expected && !hash_location)
+                return 0;
+
+        if (hash_expected && !hash_location) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5NOTFOUND);
                 return 1;
         }
 
-        if (!hash_location) {
-                if (net_ratelimit()) {
-                        printk(KERN_INFO "MD5 Hash expected but NOT found "
-                               "(" NIP6_FMT ", %u)->"
-                               "(" NIP6_FMT ", %u)\n",
-                               NIP6(ip6h->saddr), ntohs(th->source),
-                               NIP6(ip6h->daddr), ntohs(th->dest));
-                }
+        if (!hash_expected && hash_location) {
+                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPMD5UNEXPECTED);
                 return 1;
         }
 
@@ -1105,8 +1095,8 @@ static void tcp_v6_send_ack(struct sk_buff *skb, u32 seq, u32 ack, u32 win, u32
                 *topt++ = htonl((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) |
                                 (TCPOPT_MD5SIG << 8) | TCPOLEN_MD5SIG);
                 tcp_v6_md5_hash_hdr((__u8 *)topt, key,
-                                    &ipv6_hdr(skb)->daddr,
-                                    &ipv6_hdr(skb)->saddr, t1);
+                                    &ipv6_hdr(skb)->saddr,
+                                    &ipv6_hdr(skb)->daddr, t1);
         }
 #endif
 
@@ -1149,10 +1139,11 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
         inet_twsk_put(tw);
 }
 
-static void tcp_v6_reqsk_send_ack(struct sk_buff *skb, struct request_sock *req)
+static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
+                                  struct request_sock *req)
 {
         tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1, req->rcv_wnd, req->ts_recent,
-                        tcp_v6_md5_do_lookup(skb->sk, &ipv6_hdr(skb)->daddr));
+                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr));
 }
 
 
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d1477b350f76..a6aecf76a71b 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -379,7 +379,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                                         uh->source, saddr, dif))) {
                 struct sk_buff *buff = skb_clone(skb, GFP_ATOMIC);
                 if (buff) {
-                        bh_lock_sock_nested(sk2);
+                        bh_lock_sock(sk2);
                         if (!sock_owned_by_user(sk2))
                                 udpv6_queue_rcv_skb(sk2, buff);
                         else
@@ -387,7 +387,7 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
                         bh_unlock_sock(sk2);
                 }
         }
-        bh_lock_sock_nested(sk);
+        bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
         else
@@ -508,7 +508,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct hlist_head udptable[],
 
         /* deliver */
 
-        bh_lock_sock_nested(sk);
+        bh_lock_sock(sk);
         if (!sock_owned_by_user(sk))
                 udpv6_queue_rcv_skb(sk, skb);
         else
diff --git a/net/ipv6/xfrm6_mode_beet.c b/net/ipv6/xfrm6_mode_beet.c
index d6ce400f585f..bbd48b101bae 100644
--- a/net/ipv6/xfrm6_mode_beet.c
+++ b/net/ipv6/xfrm6_mode_beet.c
@@ -40,16 +40,39 @@ static void xfrm6_beet_make_header(struct sk_buff *skb)
 static int xfrm6_beet_output(struct xfrm_state *x, struct sk_buff *skb)
 {
         struct ipv6hdr *top_iph;
-
-        skb_set_network_header(skb, -x->props.header_len);
+        struct ip_beet_phdr *ph;
+        struct iphdr *iphv4;
+        int optlen, hdr_len;
+
+        iphv4 = ip_hdr(skb);
+        hdr_len = 0;
+        optlen = XFRM_MODE_SKB_CB(skb)->optlen;
+        if (unlikely(optlen))
+                hdr_len += IPV4_BEET_PHMAXLEN - (optlen & 4);
+
+        skb_set_network_header(skb, -x->props.header_len - hdr_len);
+        if (x->sel.family != AF_INET6)
+                skb->network_header += IPV4_BEET_PHMAXLEN;
         skb->mac_header = skb->network_header +
                           offsetof(struct ipv6hdr, nexthdr);
         skb->transport_header = skb->network_header + sizeof(*top_iph);
-        __skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl);
+        ph = (struct ip_beet_phdr *)__skb_pull(skb, XFRM_MODE_SKB_CB(skb)->ihl-hdr_len);
 
         xfrm6_beet_make_header(skb);
 
         top_iph = ipv6_hdr(skb);
+        if (unlikely(optlen)) {
+
+                BUG_ON(optlen < 0);
+
+                ph->padlen = 4 - (optlen & 4);
+                ph->hdrlen = optlen / 8;
+                ph->nexthdr = top_iph->nexthdr;
+                if (ph->padlen)
+                        memset(ph + 1, IPOPT_NOP, ph->padlen);
+
+                top_iph->nexthdr = IPPROTO_BEETPH;
+        }
 
         ipv6_addr_copy(&top_iph->saddr, (struct in6_addr *)&x->props.saddr);
         ipv6_addr_copy(&top_iph->daddr, (struct in6_addr *)&x->id.daddr);
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 8f1e0543b3c4..08e4cbbe3f04 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -52,12 +52,14 @@ static struct dst_entry *xfrm6_dst_lookup(int tos, xfrm_address_t *saddr,
 static int xfrm6_get_saddr(xfrm_address_t *saddr, xfrm_address_t *daddr)
 {
         struct dst_entry *dst;
+        struct net_device *dev;
 
         dst = xfrm6_dst_lookup(0, NULL, daddr);
         if (IS_ERR(dst))
                 return -EHOSTUNREACH;
 
-        ipv6_dev_get_saddr(ip6_dst_idev(dst)->dev,
+        dev = ip6_dst_idev(dst)->dev;
+        ipv6_dev_get_saddr(dev_net(dev), dev,
                            (struct in6_addr *)&daddr->a6, 0,
                            (struct in6_addr *)&saddr->a6);
         dst_release(dst);