4 files changed, 41 insertions, 1 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 26512250e095..a459c4f5b769 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -2529,6 +2529,9 @@ static void sit_add_v4_addrs(struct inet6_dev *idev)
 static void init_loopback(struct net_device *dev)
 {
         struct inet6_dev  *idev;
+        struct net_device *sp_dev;
+        struct inet6_ifaddr *sp_ifa;
+        struct rt6_info *sp_rt;
 
         /* ::1 */
 
@@ -2540,6 +2543,30 @@ static void init_loopback(struct net_device *dev)
         }
 
         add_addr(idev, &in6addr_loopback, 128, IFA_HOST);
+
+        /* Add routes to other interface's IPv6 addresses */
+        for_each_netdev(dev_net(dev), sp_dev) {
+                if (!strcmp(sp_dev->name, dev->name))
+                        continue;
+
+                idev = __in6_dev_get(sp_dev);
+                if (!idev)
+                        continue;
+
+                read_lock_bh(&idev->lock);
+                list_for_each_entry(sp_ifa, &idev->addr_list, if_list) {
+
+                        if (sp_ifa->flags & (IFA_F_DADFAILED | IFA_F_TENTATIVE))
+                                continue;
+
+                        sp_rt = addrconf_dst_alloc(idev, &sp_ifa->addr, 0);
+
+                        /* Failure cases are ignored */
+                        if (!IS_ERR(sp_rt))
+                                ip6_ins_rt(sp_rt);
+                }
+                read_unlock_bh(&idev->lock);
+        }
 }
 
 static void addrconf_add_linklocal(struct inet6_dev *idev, const struct in6_addr *addr)
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index e33fe0ab2568..2bab2aa59745 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -118,6 +118,18 @@ int ipv6_rcv(struct sk_buff *skb, struct net_device *dev, struct packet_type *pt
             ipv6_addr_loopback(&hdr->daddr))
                 goto err;
 
+        /* RFC4291 Errata ID: 3480
+         * Interface-Local scope spans only a single interface on a
+         * node and is useful only for loopback transmission of
+         * multicast.  Packets with interface-local scope received
+         * from another node must be discarded.
+         */
+        if (!(skb->pkt_type == PACKET_LOOPBACK ||
+              dev->flags & IFF_LOOPBACK) &&
+            ipv6_addr_is_multicast(&hdr->daddr) &&
+            IPV6_ADDR_MC_SCOPE(&hdr->daddr) == 1)
+                goto err;
+
         /* RFC4291 2.7
          * Nodes must not originate a packet to a multicast address whose scope
          * field contains the reserved value 0; if such a packet is received, it
diff --git a/net/ipv6/netfilter/ip6t_NPT.c b/net/ipv6/netfilter/ip6t_NPT.c
index 33608c610276..cb631143721c 100644
--- a/net/ipv6/netfilter/ip6t_NPT.c
+++ b/net/ipv6/netfilter/ip6t_NPT.c
@@ -57,7 +57,7 @@ static bool ip6t_npt_map_pfx(const struct ip6t_npt_tginfo *npt,
                 if (pfx_len - i >= 32)
                         mask = 0;
                 else
-                        mask = htonl(~((1 << (pfx_len - i)) - 1));
+                        mask = htonl((1 << (i - pfx_len + 32)) - 1);
 
                 idx = i / 32;
                 addr->s6_addr32[idx] &= mask;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f6d629fd6aee..46a5be85be87 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -386,6 +386,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
                 if (dst)
                         dst->ops->redirect(dst, sk, skb);
+                goto out;
         }
 
         if (type == ICMPV6_PKT_TOOBIG) {