19 files changed, 145 insertions, 150 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 324fac3b6c16..8c88340278f5 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -243,7 +243,7 @@ static inline bool addrconf_qdisc_ok(const struct net_device *dev)
 /* Check if a route is valid prefix route */
 static inline int addrconf_is_prefix_route(const struct rt6_info *rt)
 {
-        return ((rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0);
+        return (rt->rt6i_flags & (RTF_GATEWAY | RTF_DEFAULT)) == 0;
 }
 
 static void addrconf_del_timer(struct inet6_ifaddr *ifp)
@@ -2964,7 +2964,8 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
            start sending router solicitations.
          */
 
-        if (ifp->idev->cnf.forwarding == 0 &&
+        if ((ifp->idev->cnf.forwarding == 0 ||
+             ifp->idev->cnf.forwarding == 2) &&
             ifp->idev->cnf.rtr_solicits > 0 &&
             (dev->flags&IFF_LOOPBACK) == 0 &&
             (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
diff --git a/net/ipv6/addrlabel.c b/net/ipv6/addrlabel.c
index 8175f802651b..c8993e5a337c 100644
--- a/net/ipv6/addrlabel.c
+++ b/net/ipv6/addrlabel.c
@@ -518,10 +518,9 @@ static int ip6addrlbl_dump(struct sk_buff *skb, struct netlink_callback *cb)
 
 static inline int ip6addrlbl_msgsize(void)
 {
-        return (NLMSG_ALIGN(sizeof(struct ifaddrlblmsg))
+        return NLMSG_ALIGN(sizeof(struct ifaddrlblmsg))
                 + nla_total_size(16)    /* IFAL_ADDRESS */
-                + nla_total_size(4)     /* IFAL_LABEL */
-        );
+                + nla_total_size(4);    /* IFAL_LABEL */
 }
 
 static int ip6addrlbl_get(struct sk_buff *in_skb, struct nlmsghdr* nlh,
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 56b9bf2516f4..60220985bb80 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -467,7 +467,7 @@ int inet6_getname(struct socket *sock, struct sockaddr *uaddr,
         if (ipv6_addr_type(&sin->sin6_addr) & IPV6_ADDR_LINKLOCAL)
                 sin->sin6_scope_id = sk->sk_bound_dev_if;
         *uaddr_len = sizeof(*sin);
-        return(0);
+        return 0;
 }
 
 EXPORT_SYMBOL(inet6_getname);
@@ -488,7 +488,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
         case SIOCADDRT:
         case SIOCDELRT:
 
-                return(ipv6_route_ioctl(net, cmd, (void __user *)arg));
+                return ipv6_route_ioctl(net, cmd, (void __user *)arg);
 
         case SIOCSIFADDR:
                 return addrconf_add_ifaddr(net, (void __user *) arg);
@@ -502,7 +502,7 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg)
                 return sk->sk_prot->ioctl(sk, cmd, arg);
         }
         /*NOTREACHED*/
-        return(0);
+        return 0;
 }
 
 EXPORT_SYMBOL(inet6_ioctl);
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index e1caa5d526c2..14ed0a955b56 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -13,12 +13,12 @@ int ipv6_ext_hdr(u8 nexthdr)
         /*
          * find out if nexthdr is an extension header or a protocol
          */
-        return ( (nexthdr == NEXTHDR_HOP)       ||
+        return   (nexthdr == NEXTHDR_HOP)       ||
                  (nexthdr == NEXTHDR_ROUTING)   ||
                  (nexthdr == NEXTHDR_FRAGMENT)  ||
                  (nexthdr == NEXTHDR_AUTH)      ||
                  (nexthdr == NEXTHDR_NONE)      ||
-                 (nexthdr == NEXTHDR_DEST) );
+                 (nexthdr == NEXTHDR_DEST);
 }
 
 /*
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 980912ed7a38..99157b4cd56e 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -637,7 +637,7 @@ static int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
         }
         mtu -= hlen + sizeof(struct frag_hdr);
 
-        if (skb_has_frags(skb)) {
+        if (skb_has_frag_list(skb)) {
                 int first_len = skb_pagelen(skb);
                 struct sk_buff *frag2;
 
@@ -878,8 +878,8 @@ static inline int ip6_rt_check(struct rt6key *rt_key,
                                struct in6_addr *fl_addr,
                                struct in6_addr *addr_cache)
 {
-        return ((rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
-                (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache)));
+        return (rt_key->plen != 128 || !ipv6_addr_equal(fl_addr, &rt_key->addr)) &&
+                (addr_cache == NULL || !ipv6_addr_equal(fl_addr, addr_cache));
 }
 
 static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 0fd027f3f47e..f6d9f683543e 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -83,15 +83,14 @@ struct ip6_tnl_net {
         /* the IPv6 tunnel fallback device */
         struct net_device *fb_tnl_dev;
         /* lists for storing tunnels in use */
-        struct ip6_tnl *tnls_r_l[HASH_SIZE];
-        struct ip6_tnl *tnls_wc[1];
-        struct ip6_tnl **tnls[2];
+        struct ip6_tnl __rcu *tnls_r_l[HASH_SIZE];
+        struct ip6_tnl __rcu *tnls_wc[1];
+        struct ip6_tnl __rcu **tnls[2];
 };
 
 /*
- * Locking : hash tables are protected by RCU and a spinlock
+ * Locking : hash tables are protected by RCU and RTNL
  */
-static DEFINE_SPINLOCK(ip6_tnl_lock);
 
 static inline struct dst_entry *ip6_tnl_dst_check(struct ip6_tnl *t)
 {
@@ -138,8 +137,8 @@ static inline void ip6_tnl_dst_store(struct ip6_tnl *t, struct dst_entry *dst)
 static struct ip6_tnl *
 ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
 {
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(local);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(local);
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
@@ -167,7 +166,7 @@ ip6_tnl_lookup(struct net *net, struct in6_addr *remote, struct in6_addr *local)
  * Return: head of IPv6 tunnel list
  **/
 
-static struct ip6_tnl **
+static struct ip6_tnl __rcu **
 ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
 {
         struct in6_addr *remote = &p->raddr;
@@ -190,12 +189,10 @@ ip6_tnl_bucket(struct ip6_tnl_net *ip6n, struct ip6_tnl_parm *p)
 static void
 ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
-        struct ip6_tnl **tp = ip6_tnl_bucket(ip6n, &t->parms);
+        struct ip6_tnl __rcu **tp = ip6_tnl_bucket(ip6n, &t->parms);
 
-        spin_lock_bh(&ip6_tnl_lock);
-        t->next = *tp;
+        rcu_assign_pointer(t->next , rtnl_dereference(*tp));
         rcu_assign_pointer(*tp, t);
-        spin_unlock_bh(&ip6_tnl_lock);
 }
 
 /**
@@ -206,13 +203,14 @@ ip6_tnl_link(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 static void
 ip6_tnl_unlink(struct ip6_tnl_net *ip6n, struct ip6_tnl *t)
 {
-        struct ip6_tnl **tp;
-
-        for (tp = ip6_tnl_bucket(ip6n, &t->parms); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
-                        spin_lock_bh(&ip6_tnl_lock);
-                        *tp = t->next;
-                        spin_unlock_bh(&ip6_tnl_lock);
+        struct ip6_tnl __rcu **tp;
+        struct ip6_tnl *iter;
+
+        for (tp = ip6_tnl_bucket(ip6n, &t->parms);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                         break;
                 }
         }
@@ -290,10 +288,13 @@ static struct ip6_tnl *ip6_tnl_locate(struct net *net,
 {
         struct in6_addr *remote = &p->raddr;
         struct in6_addr *local = &p->laddr;
+        struct ip6_tnl __rcu **tp;
         struct ip6_tnl *t;
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
-        for (t = *ip6_tnl_bucket(ip6n, p); t; t = t->next) {
+        for (tp = ip6_tnl_bucket(ip6n, p);
+             (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next) {
                 if (ipv6_addr_equal(local, &t->parms.laddr) &&
                     ipv6_addr_equal(remote, &t->parms.raddr))
                         return t;
@@ -318,13 +319,10 @@ ip6_tnl_dev_uninit(struct net_device *dev)
         struct net *net = dev_net(dev);
         struct ip6_tnl_net *ip6n = net_generic(net, ip6_tnl_net_id);
 
-        if (dev == ip6n->fb_tnl_dev) {
-                spin_lock_bh(&ip6_tnl_lock);
-                ip6n->tnls_wc[0] = NULL;
-                spin_unlock_bh(&ip6_tnl_lock);
-        } else {
+        if (dev == ip6n->fb_tnl_dev)
+                rcu_assign_pointer(ip6n->tnls_wc[0], NULL);
+        else
                 ip6_tnl_unlink(ip6n, t);
-        }
         ip6_tnl_dst_reset(t);
         dev_put(dev);
 }
@@ -727,7 +725,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol,
                 skb_tunnel_rx(skb, t->dev);
 
                 dscp_ecn_decapsulate(t, ipv6h, skb);
-                netif_rx(skb);
+
+                if (netif_rx(skb) == NET_RX_DROP)
+                        t->dev->stats.rx_dropped++;
+
                 rcu_read_unlock();
                 return 0;
         }
@@ -1369,16 +1370,16 @@ static void __net_init ip6_fb_tnl_dev_init(struct net_device *dev)
         ip6_tnl_dev_init_gen(dev);
         t->parms.proto = IPPROTO_IPV6;
         dev_hold(dev);
-        ip6n->tnls_wc[0] = t;
+        rcu_assign_pointer(ip6n->tnls_wc[0], t);
 }
 
-static struct xfrm6_tunnel ip4ip6_handler = {
+static struct xfrm6_tunnel ip4ip6_handler __read_mostly = {
         .handler        = ip4ip6_rcv,
         .err_handler    = ip4ip6_err,
         .priority       =       1,
 };
 
-static struct xfrm6_tunnel ip6ip6_handler = {
+static struct xfrm6_tunnel ip6ip6_handler __read_mostly = {
         .handler        = ip6ip6_rcv,
         .err_handler    = ip6ip6_err,
         .priority       =       1,
@@ -1391,14 +1392,14 @@ static void __net_exit ip6_tnl_destroy_tunnels(struct ip6_tnl_net *ip6n)
         LIST_HEAD(list);
 
         for (h = 0; h < HASH_SIZE; h++) {
-                t = ip6n->tnls_r_l[h];
+                t = rtnl_dereference(ip6n->tnls_r_l[h]);
                 while (t != NULL) {
                         unregister_netdevice_queue(t->dev, &list);
-                        t = t->next;
+                        t = rtnl_dereference(t->next);
                 }
         }
 
-        t = ip6n->tnls_wc[0];
+        t = rtnl_dereference(ip6n->tnls_wc[0]);
         unregister_netdevice_queue(t->dev, &list);
         unregister_netdevice_many(&list);
 }
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 66078dad7fe8..2640c9be589d 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -666,7 +666,9 @@ static int pim6_rcv(struct sk_buff *skb)
 
         skb_tunnel_rx(skb, reg_dev);
 
-        netif_rx(skb);
+        if (netif_rx(skb) == NET_RX_DROP)
+                reg_dev->stats.rx_dropped++;
+
         dev_put(reg_dev);
         return 0;
  drop:
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 58841c4ae947..b3dd844cd34f 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -228,12 +228,12 @@ static struct nd_opt_hdr *ndisc_next_option(struct nd_opt_hdr *cur,
         do {
                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
         } while(cur < end && cur->nd_opt_type != type);
-        return (cur <= end && cur->nd_opt_type == type ? cur : NULL);
+        return cur <= end && cur->nd_opt_type == type ? cur : NULL;
 }
 
 static inline int ndisc_is_useropt(struct nd_opt_hdr *opt)
 {
-        return (opt->nd_opt_type == ND_OPT_RDNSS);
+        return opt->nd_opt_type == ND_OPT_RDNSS;
 }
 
 static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
@@ -244,7 +244,7 @@ static struct nd_opt_hdr *ndisc_next_useropt(struct nd_opt_hdr *cur,
         do {
                 cur = ((void *)cur) + (cur->nd_opt_len << 3);
         } while(cur < end && !ndisc_is_useropt(cur));
-        return (cur <= end && ndisc_is_useropt(cur) ? cur : NULL);
+        return cur <= end && ndisc_is_useropt(cur) ? cur : NULL;
 }
 
 static struct ndisc_options *ndisc_parse_options(u8 *opt, int opt_len,
@@ -319,7 +319,7 @@ static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
         int prepad = ndisc_addr_option_pad(dev->type);
         if (lladdrlen != NDISC_OPT_SPACE(dev->addr_len + prepad))
                 return NULL;
-        return (lladdr + prepad);
+        return lladdr + prepad;
 }
 
 int ndisc_mc_map(struct in6_addr *addr, char *buf, struct net_device *dev, int dir)
@@ -1105,6 +1105,18 @@ errout:
         rtnl_set_sk_err(net, RTNLGRP_ND_USEROPT, err);
 }
 
+static inline int accept_ra(struct inet6_dev *in6_dev)
+{
+        /*
+         * If forwarding is enabled, RA are not accepted unless the special
+         * hybrid mode (accept_ra=2) is enabled.
+         */
+        if (in6_dev->cnf.forwarding && in6_dev->cnf.accept_ra < 2)
+                return 0;
+
+        return in6_dev->cnf.accept_ra;
+}
+
 static void ndisc_router_discovery(struct sk_buff *skb)
 {
         struct ra_msg *ra_msg = (struct ra_msg *)skb_transport_header(skb);
@@ -1158,8 +1170,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                 return;
         }
 
-        /* skip route and link configuration on routers */
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
+        if (!accept_ra(in6_dev))
                 goto skip_linkparms;
 
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -1309,8 +1320,7 @@ skip_linkparms:
                              NEIGH_UPDATE_F_ISROUTER);
         }
 
-        /* skip route and link configuration on routers */
-        if (in6_dev->cnf.forwarding || !in6_dev->cnf.accept_ra)
+        if (!accept_ra(in6_dev))
                 goto out;
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
index 8e754be92c24..6b331e9b5706 100644
--- a/net/ipv6/netfilter/ip6_tables.c
+++ b/net/ipv6/netfilter/ip6_tables.c
@@ -82,13 +82,13 @@ EXPORT_SYMBOL_GPL(ip6t_alloc_initial_table);
 int
 ip6t_ext_hdr(u8 nexthdr)
 {
-        return ( (nexthdr == IPPROTO_HOPOPTS)   ||
-                 (nexthdr == IPPROTO_ROUTING)   ||
-                 (nexthdr == IPPROTO_FRAGMENT)  ||
-                 (nexthdr == IPPROTO_ESP)       ||
-                 (nexthdr == IPPROTO_AH)        ||
-                 (nexthdr == IPPROTO_NONE)      ||
-                 (nexthdr == IPPROTO_DSTOPTS) );
+        return  (nexthdr == IPPROTO_HOPOPTS)   ||
+                (nexthdr == IPPROTO_ROUTING)   ||
+                (nexthdr == IPPROTO_FRAGMENT)  ||
+                (nexthdr == IPPROTO_ESP)       ||
+                (nexthdr == IPPROTO_AH)        ||
+                (nexthdr == IPPROTO_NONE)      ||
+                (nexthdr == IPPROTO_DSTOPTS);
 }
 
 /* Returns whether matches rule or not. */
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 578f3c1a16db..138a8b362706 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -363,7 +363,7 @@ nf_ct_frag6_reasm(struct nf_ct_frag6_queue *fq, struct net_device *dev)
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                 struct sk_buff *clone;
                 int i, plen = 0;
 
diff --git a/net/ipv6/protocol.c b/net/ipv6/protocol.c
index 1fa3468f0f32..9bb936ae2452 100644
--- a/net/ipv6/protocol.c
+++ b/net/ipv6/protocol.c
@@ -25,28 +25,14 @@
 #include <linux/spinlock.h>
 #include <net/protocol.h>
 
-const struct inet6_protocol *inet6_protos[MAX_INET_PROTOS];
-static DEFINE_SPINLOCK(inet6_proto_lock);
-
+const struct inet6_protocol *inet6_protos[MAX_INET_PROTOS] __read_mostly;
 
 int inet6_add_protocol(const struct inet6_protocol *prot, unsigned char protocol)
 {
-        int ret, hash = protocol & (MAX_INET_PROTOS - 1);
-
-        spin_lock_bh(&inet6_proto_lock);
-
-        if (inet6_protos[hash]) {
-                ret = -1;
-        } else {
-                inet6_protos[hash] = prot;
-                ret = 0;
-        }
-
-        spin_unlock_bh(&inet6_proto_lock);
+        int hash = protocol & (MAX_INET_PROTOS - 1);
 
-        return ret;
+        return !cmpxchg(&inet6_protos[hash], NULL, prot) ? 0 : -1;
 }
-
 EXPORT_SYMBOL(inet6_add_protocol);
 
 /*
@@ -57,20 +43,10 @@ int inet6_del_protocol(const struct inet6_protocol *prot, unsigned char protocol
 {
         int ret, hash = protocol & (MAX_INET_PROTOS - 1);
 
-        spin_lock_bh(&inet6_proto_lock);
-
-        if (inet6_protos[hash] != prot) {
-                ret = -1;
-        } else {
-                inet6_protos[hash] = NULL;
-                ret = 0;
-        }
-
-        spin_unlock_bh(&inet6_proto_lock);
+        ret = (cmpxchg(&inet6_protos[hash], prot, NULL) == prot) ? 0 : -1;
 
         synchronize_net();
 
         return ret;
 }
-
 EXPORT_SYMBOL(inet6_del_protocol);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e677937a07fc..45e6efb7f171 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -764,7 +764,7 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                         return -EINVAL;
 
                 if (sin6->sin6_family && sin6->sin6_family != AF_INET6)
-                        return(-EAFNOSUPPORT);
+                        return -EAFNOSUPPORT;
 
                 /* port is the proto value [0..255] carried in nexthdr */
                 proto = ntohs(sin6->sin6_port);
@@ -772,10 +772,10 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                 if (!proto)
                         proto = inet->inet_num;
                 else if (proto != inet->inet_num)
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 if (proto > 255)
-                        return(-EINVAL);
+                        return -EINVAL;
 
                 daddr = &sin6->sin6_addr;
                 if (np->sndflow) {
@@ -985,7 +985,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
                         /* You may get strange result with a positive odd offset;
                            RFC2292bis agrees with me. */
                         if (val > 0 && (val&1))
-                                return(-EINVAL);
+                                return -EINVAL;
                         if (val < 0) {
                                 rp->checksum = 0;
                         } else {
@@ -997,7 +997,7 @@ static int do_rawv6_setsockopt(struct sock *sk, int level, int optname,
                         break;
 
                 default:
-                        return(-ENOPROTOOPT);
+                        return -ENOPROTOOPT;
         }
 }
 
@@ -1190,7 +1190,7 @@ static int rawv6_init_sk(struct sock *sk)
         default:
                 break;
         }
-        return(0);
+        return 0;
 }
 
 struct proto rawv6_prot = {
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index 64cfef1b0a4c..c7ba3149633f 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -458,7 +458,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
         /* If the first fragment is fragmented itself, we split
          * it to two chunks: the first with data and paged part
          * and the second, holding only fragments. */
-        if (skb_has_frags(head)) {
+        if (skb_has_frag_list(head)) {
                 struct sk_buff *clone;
                 int i, plen = 0;
 
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index d126365ac046..25b0beda4331 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -217,14 +217,14 @@ static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
 
 static __inline__ int rt6_check_expired(const struct rt6_info *rt)
 {
-        return (rt->rt6i_flags & RTF_EXPIRES &&
-                time_after(jiffies, rt->rt6i_expires));
+        return (rt->rt6i_flags & RTF_EXPIRES) &&
+                time_after(jiffies, rt->rt6i_expires);
 }
 
 static inline int rt6_need_strict(struct in6_addr *daddr)
 {
-        return (ipv6_addr_type(daddr) &
-                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK));
+        return ipv6_addr_type(daddr) &
+                (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL | IPV6_ADDR_LOOPBACK);
 }
 
 /*
@@ -440,7 +440,7 @@ static struct rt6_info *rt6_select(struct fib6_node *fn, int oif, int strict)
                   __func__, match);
 
         net = dev_net(rt0->rt6i_dev);
-        return (match ? match : net->ipv6.ip6_null_entry);
+        return match ? match : net->ipv6.ip6_null_entry;
 }
 
 #ifdef CONFIG_IPV6_ROUTE_INFO
@@ -859,7 +859,7 @@ int ip6_dst_blackhole(struct sock *sk, struct dst_entry **dstp, struct flowi *fl
 
         dst_release(*dstp);
         *dstp = new;
-        return (new ? 0 : -ENOMEM);
+        return new ? 0 : -ENOMEM;
 }
 EXPORT_SYMBOL_GPL(ip6_dst_blackhole);
 
@@ -1070,7 +1070,7 @@ static int ip6_dst_gc(struct dst_ops *ops)
                 net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
 out:
         net->ipv6.ip6_rt_gc_expire -= net->ipv6.ip6_rt_gc_expire>>rt_elasticity;
-        return (atomic_read(&ops->entries) > rt_max_size);
+        return atomic_read(&ops->entries) > rt_max_size;
 }
 
 /* Clean host part of a prefix. Not necessary in radix tree,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 4699cd3c3118..8a0399822230 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -68,19 +68,18 @@ static void ipip6_tunnel_setup(struct net_device *dev);
 
 static int sit_net_id __read_mostly;
 struct sit_net {
-        struct ip_tunnel *tunnels_r_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_r[HASH_SIZE];
-        struct ip_tunnel *tunnels_l[HASH_SIZE];
-        struct ip_tunnel *tunnels_wc[1];
-        struct ip_tunnel **tunnels[4];
+        struct ip_tunnel __rcu *tunnels_r_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_r[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_l[HASH_SIZE];
+        struct ip_tunnel __rcu *tunnels_wc[1];
+        struct ip_tunnel __rcu **tunnels[4];
 
         struct net_device *fb_tunnel_dev;
 };
 
 /*
- * Locking : hash tables are protected by RCU and a spinlock
+ * Locking : hash tables are protected by RCU and RTNL
  */
-static DEFINE_SPINLOCK(ipip6_lock);
 
 #define for_each_ip_tunnel_rcu(start) \
         for (t = rcu_dereference(start); t; t = rcu_dereference(t->next))
@@ -91,8 +90,8 @@ static DEFINE_SPINLOCK(ipip6_lock);
 static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
                 struct net_device *dev, __be32 remote, __be32 local)
 {
-        unsigned h0 = HASH(remote);
-        unsigned h1 = HASH(local);
+        unsigned int h0 = HASH(remote);
+        unsigned int h1 = HASH(local);
         struct ip_tunnel *t;
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
@@ -121,12 +120,12 @@ static struct ip_tunnel * ipip6_tunnel_lookup(struct net *net,
         return NULL;
 }
 
-static struct ip_tunnel **__ipip6_bucket(struct sit_net *sitn,
+static struct ip_tunnel __rcu **__ipip6_bucket(struct sit_net *sitn,
                 struct ip_tunnel_parm *parms)
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
-        unsigned h = 0;
+        unsigned int h = 0;
         int prio = 0;
 
         if (remote) {
@@ -140,7 +139,7 @@ static struct ip_tunnel **__ipip6_bucket(struct sit_net *sitn,
         return &sitn->tunnels[prio][h];
 }
 
-static inline struct ip_tunnel **ipip6_bucket(struct sit_net *sitn,
+static inline struct ip_tunnel __rcu **ipip6_bucket(struct sit_net *sitn,
                 struct ip_tunnel *t)
 {
         return __ipip6_bucket(sitn, &t->parms);
@@ -148,13 +147,14 @@ static inline struct ip_tunnel **ipip6_bucket(struct sit_net *sitn,
 
 static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp;
-
-        for (tp = ipip6_bucket(sitn, t); *tp; tp = &(*tp)->next) {
-                if (t == *tp) {
-                        spin_lock_bh(&ipip6_lock);
-                        *tp = t->next;
-                        spin_unlock_bh(&ipip6_lock);
+        struct ip_tunnel __rcu **tp;
+        struct ip_tunnel *iter;
+
+        for (tp = ipip6_bucket(sitn, t);
+             (iter = rtnl_dereference(*tp)) != NULL;
+             tp = &iter->next) {
+                if (t == iter) {
+                        rcu_assign_pointer(*tp, t->next);
                         break;
                 }
         }
@@ -162,12 +162,10 @@ static void ipip6_tunnel_unlink(struct sit_net *sitn, struct ip_tunnel *t)
 
 static void ipip6_tunnel_link(struct sit_net *sitn, struct ip_tunnel *t)
 {
-        struct ip_tunnel **tp = ipip6_bucket(sitn, t);
+        struct ip_tunnel __rcu **tp = ipip6_bucket(sitn, t);
 
-        spin_lock_bh(&ipip6_lock);
-        t->next = *tp;
+        rcu_assign_pointer(t->next, rtnl_dereference(*tp));
         rcu_assign_pointer(*tp, t);
-        spin_unlock_bh(&ipip6_lock);
 }
 
 static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
@@ -187,17 +185,20 @@ static void ipip6_tunnel_clone_6rd(struct net_device *dev, struct sit_net *sitn)
 #endif
 }
 
-static struct ip_tunnel * ipip6_tunnel_locate(struct net *net,
+static struct ip_tunnel *ipip6_tunnel_locate(struct net *net,
                 struct ip_tunnel_parm *parms, int create)
 {
         __be32 remote = parms->iph.daddr;
         __be32 local = parms->iph.saddr;
-        struct ip_tunnel *t, **tp, *nt;
+        struct ip_tunnel *t, *nt;
+        struct ip_tunnel __rcu **tp;
         struct net_device *dev;
         char name[IFNAMSIZ];
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
-        for (tp = __ipip6_bucket(sitn, parms); (t = *tp) != NULL; tp = &t->next) {
+        for (tp = __ipip6_bucket(sitn, parms);
+            (t = rtnl_dereference(*tp)) != NULL;
+             tp = &t->next) {
                 if (local == t->parms.iph.saddr &&
                     remote == t->parms.iph.daddr &&
                     parms->link == t->parms.link) {
@@ -340,7 +341,7 @@ ipip6_tunnel_add_prl(struct ip_tunnel *t, struct ip_tunnel_prl *a, int chg)
 
         ASSERT_RTNL();
 
-        for (p = t->prl; p; p = p->next) {
+        for (p = rtnl_dereference(t->prl); p; p = rtnl_dereference(p->next)) {
                 if (p->addr == a->addr) {
                         if (chg) {
                                 p->flags = a->flags;
@@ -451,15 +452,12 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
         struct sit_net *sitn = net_generic(net, sit_net_id);
 
         if (dev == sitn->fb_tunnel_dev) {
-                spin_lock_bh(&ipip6_lock);
-                sitn->tunnels_wc[0] = NULL;
-                spin_unlock_bh(&ipip6_lock);
-                dev_put(dev);
+                rcu_assign_pointer(sitn->tunnels_wc[0], NULL);
         } else {
                 ipip6_tunnel_unlink(sitn, netdev_priv(dev));
                 ipip6_tunnel_del_prl(netdev_priv(dev), NULL);
-                dev_put(dev);
         }
+        dev_put(dev);
 }
 
 
@@ -566,7 +564,10 @@ static int ipip6_rcv(struct sk_buff *skb)
                 skb_tunnel_rx(skb, tunnel->dev);
 
                 ipip6_ecn_decapsulate(iph, skb);
-                netif_rx(skb);
+
+                if (netif_rx(skb) == NET_RX_DROP)
+                        tunnel->dev->stats.rx_dropped++;
+
                 rcu_read_unlock();
                 return 0;
         }
@@ -590,7 +591,7 @@ __be32 try_6rd(struct in6_addr *v6dst, struct ip_tunnel *tunnel)
 #ifdef CONFIG_IPV6_SIT_6RD
         if (ipv6_prefix_equal(v6dst, &tunnel->ip6rd.prefix,
                               tunnel->ip6rd.prefixlen)) {
-                unsigned pbw0, pbi0;
+                unsigned int pbw0, pbi0;
                 int pbi1;
                 u32 d;
 
@@ -1132,7 +1133,7 @@ static void __net_init ipip6_fb_tunnel_init(struct net_device *dev)
         sitn->tunnels_wc[0]     = tunnel;
 }
 
-static struct xfrm_tunnel sit_handler = {
+static struct xfrm_tunnel sit_handler __read_mostly = {
         .handler        =       ipip6_rcv,
         .err_handler    =       ipip6_err,
         .priority       =       1,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index fe6d40418c0b..8d93f6d81979 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -139,7 +139,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 return -EINVAL;
 
         if (usin->sin6_family != AF_INET6)
-                return(-EAFNOSUPPORT);
+                return -EAFNOSUPPORT;
 
         memset(&fl, 0, sizeof(fl));
 
diff --git a/net/ipv6/tunnel6.c b/net/ipv6/tunnel6.c
index fc3c86a47452..d9864725d0c6 100644
--- a/net/ipv6/tunnel6.c
+++ b/net/ipv6/tunnel6.c
@@ -30,8 +30,8 @@
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
-static struct xfrm6_tunnel *tunnel6_handlers;
-static struct xfrm6_tunnel *tunnel46_handlers;
+static struct xfrm6_tunnel *tunnel6_handlers __read_mostly;
+static struct xfrm6_tunnel *tunnel46_handlers __read_mostly;
 static DEFINE_MUTEX(tunnel6_mutex);
 
 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family)
@@ -51,7 +51,7 @@ int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family)
         }
 
         handler->next = *pprev;
-        *pprev = handler;
+        rcu_assign_pointer(*pprev, handler);
 
         ret = 0;
 
@@ -88,6 +88,11 @@ int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family)
 
 EXPORT_SYMBOL(xfrm6_tunnel_deregister);
 
+#define for_each_tunnel_rcu(head, handler)              \
+        for (handler = rcu_dereference(head);           \
+             handler != NULL;                           \
+             handler = rcu_dereference(handler->next))  \
+
 static int tunnel6_rcv(struct sk_buff *skb)
 {
         struct xfrm6_tunnel *handler;
@@ -95,7 +100,7 @@ static int tunnel6_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct ipv6hdr)))
                 goto drop;
 
-        for (handler = tunnel6_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel6_handlers, handler)
                 if (!handler->handler(skb))
                         return 0;
 
@@ -113,7 +118,7 @@ static int tunnel46_rcv(struct sk_buff *skb)
         if (!pskb_may_pull(skb, sizeof(struct iphdr)))
                 goto drop;
 
-        for (handler = tunnel46_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel46_handlers, handler)
                 if (!handler->handler(skb))
                         return 0;
 
@@ -129,7 +134,7 @@ static void tunnel6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 {
         struct xfrm6_tunnel *handler;
 
-        for (handler = tunnel6_handlers; handler; handler = handler->next)
+        for_each_tunnel_rcu(tunnel6_handlers, handler)
                 if (!handler->err_handler(skb, opt, type, code, offset, info))
                         break;
 }
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index 6baeabbbca82..39676eac3a37 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -199,7 +199,7 @@ static inline int xfrm6_garbage_collect(struct dst_ops *ops)
         struct net *net = container_of(ops, struct net, xfrm.xfrm6_dst_ops);
 
         xfrm6_policy_afinfo.garbage_collect(net);
-        return (atomic_read(&ops->entries) > ops->gc_thresh * 2);
+        return atomic_read(&ops->entries) > ops->gc_thresh * 2;
 }
 
 static void xfrm6_update_pmtu(struct dst_entry *dst, u32 mtu)
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index 2ce3a8278f26..ac7584b946a5 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -317,13 +317,13 @@ static const struct xfrm_type xfrm6_tunnel_type = {
         .output         = xfrm6_tunnel_output,
 };
 
-static struct xfrm6_tunnel xfrm6_tunnel_handler = {
+static struct xfrm6_tunnel xfrm6_tunnel_handler __read_mostly = {
         .handler        = xfrm6_tunnel_rcv,
         .err_handler    = xfrm6_tunnel_err,
         .priority       = 2,
 };
 
-static struct xfrm6_tunnel xfrm46_tunnel_handler = {
+static struct xfrm6_tunnel xfrm46_tunnel_handler __read_mostly = {
         .handler        = xfrm6_tunnel_rcv,
         .err_handler    = xfrm6_tunnel_err,
         .priority       = 2,