2 files changed, 31 insertions, 5 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3883b4036a74..43b3c9f89c12 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -1916,8 +1916,32 @@ ok:
                                         update_lft = 1;
                                 else if (stored_lft <= MIN_VALID_LIFETIME) {
                                         /* valid_lft <= stored_lft is always true */
-                                        /* XXX: IPsec */
-                                        update_lft = 0;
+                                        /*
+                                         * RFC 4862 Section 5.5.3e:
+                                         * "Note that the preferred lifetime of
+                                         *  the corresponding address is always
+                                         *  reset to the Preferred Lifetime in
+                                         *  the received Prefix Information
+                                         *  option, regardless of whether the
+                                         *  valid lifetime is also reset or
+                                         *  ignored."
+                                         *
+                                         *  So if the preferred lifetime in
+                                         *  this advertisement is different
+                                         *  than what we have stored, but the
+                                         *  valid lifetime is invalid, just
+                                         *  reset prefered_lft.
+                                         *
+                                         *  We must set the valid lifetime
+                                         *  to the stored lifetime since we'll
+                                         *  be updating the timestamp below,
+                                         *  else we'll set it back to the
+                                         *  minumum.
+                                         */
+                                        if (prefered_lft != ifp->prefered_lft) {
+                                                valid_lft = stored_lft;
+                                                update_lft = 1;
+                                        }
                                 } else {
                                         valid_lft = MIN_VALID_LIFETIME;
                                         if (valid_lft < prefered_lft)
@@ -3085,7 +3109,7 @@ restart:
                                 spin_unlock(&ifp->lock);
                                 continue;
                         } else if (age >= ifp->prefered_lft) {
-                                /* jiffies - ifp->tsamp > age >= ifp->prefered_lft */
+                                /* jiffies - ifp->tstamp > age >= ifp->prefered_lft */
                                 int deprecate = 0;
 
                                 if (!(ifp->flags&IFA_F_DEPRECATED)) {
diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
index b4b16a43f277..3a3c677bc0f2 100644
--- a/net/ipv6/xfrm6_policy.c
+++ b/net/ipv6/xfrm6_policy.c
@@ -157,7 +157,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
         ipv6_addr_copy(&fl->fl6_dst, reverse ? &hdr->saddr : &hdr->daddr);
         ipv6_addr_copy(&fl->fl6_src, reverse ? &hdr->daddr : &hdr->saddr);
 
-        while (pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
+        while (nh + offset + 1 < skb->data ||
+               pskb_may_pull(skb, nh + offset + 1 - skb->data)) {
                 nh = skb_network_header(skb);
                 exthdr = (struct ipv6_opt_hdr *)(nh + offset);
 
@@ -177,7 +178,8 @@ _decode_session6(struct sk_buff *skb, struct flowi *fl, int reverse)
                 case IPPROTO_TCP:
                 case IPPROTO_SCTP:
                 case IPPROTO_DCCP:
-                        if (!onlyproto && pskb_may_pull(skb, nh + offset + 4 - skb->data)) {
+                        if (!onlyproto && (nh + offset + 4 < skb->data ||
+                             pskb_may_pull(skb, nh + offset + 4 - skb->data))) {
                                 __be16 *ports = (__be16 *)exthdr;
 
                                 fl->fl_ip_sport = ports[!!reverse];