23 files changed, 835 insertions, 287 deletions
diff --git a/net/ipv6/Makefile b/net/ipv6/Makefile
index 9af088d2cdaa..470a9c008e9b 100644
--- a/net/ipv6/Makefile
+++ b/net/ipv6/Makefile
@@ -7,7 +7,7 @@ obj-$(CONFIG_IPV6) += ipv6.o
 ipv6-objs :=    af_inet6.o anycast.o ip6_output.o ip6_input.o addrconf.o \
                addrlabel.o \
                route.o ip6_fib.o ipv6_sockglue.o ndisc.o udp.o udplite.o \
-                raw.o icmp.o mcast.o reassembly.o tcp_ipv6.o \
+                raw.o icmp.o mcast.o reassembly.o tcp_ipv6.o ping.o \
                exthdrs.o datagram.o ip6_flowlabel.o inet6_connection_sock.o
 ipv6-offload := ip6_offload.o tcpv6_offload.o udp_offload.o exthdrs_offload.o
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 4ab4c38958c6..cfdcf7b2daf6 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -253,37 +253,32 @@ static inline bool addrconf_qdisc_ok(const struct net_device *dev)
        return !qdisc_tx_is_noop(dev);
 }
-static void addrconf_del_timer(struct inet6_ifaddr *ifp)
+static void addrconf_del_rs_timer(struct inet6_dev *idev)
 {
-        if (del_timer(&ifp->timer))
+        if (del_timer(&idev->rs_timer))
+                __in6_dev_put(idev);
+}
+static void addrconf_del_dad_timer(struct inet6_ifaddr *ifp)
+{
+        if (del_timer(&ifp->dad_timer))
                __in6_ifa_put(ifp);
 }
-enum addrconf_timer_t {
+static void addrconf_mod_rs_timer(struct inet6_dev *idev,
-        AC_NONE,
+                                  unsigned long when)
-        AC_DAD,
+{
-        AC_RS,
+        if (!timer_pending(&idev->rs_timer))
-};
+                in6_dev_hold(idev);
+        mod_timer(&idev->rs_timer, jiffies + when);
+}
-static void addrconf_mod_timer(struct inet6_ifaddr *ifp,
+static void addrconf_mod_dad_timer(struct inet6_ifaddr *ifp,
-                               enum addrconf_timer_t what,
+                                   unsigned long when)
-                               unsigned long when)
 {
-        if (!del_timer(&ifp->timer))
+        if (!timer_pending(&ifp->dad_timer))
                in6_ifa_hold(ifp);
+        mod_timer(&ifp->dad_timer, jiffies + when);
-        switch (what) {
-        case AC_DAD:
-                ifp->timer.function = addrconf_dad_timer;
-                break;
-        case AC_RS:
-                ifp->timer.function = addrconf_rs_timer;
-                break;
-        default:
-                break;
-        }
-        ifp->timer.expires = jiffies + when;
-        add_timer(&ifp->timer);
 }
 static int snmp6_alloc_dev(struct inet6_dev *idev)
@@ -326,6 +321,7 @@ void in6_dev_finish_destroy(struct inet6_dev *idev)
        WARN_ON(!list_empty(&idev->addr_list));
        WARN_ON(idev->mc_list != NULL);
+        WARN_ON(timer_pending(&idev->rs_timer));
 #ifdef NET_REFCNT_DEBUG
        pr_debug("%s: %s\n", __func__, dev ? dev->name : "NIL");
@@ -357,7 +353,8 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
        rwlock_init(&ndev->lock);
        ndev->dev = dev;
        INIT_LIST_HEAD(&ndev->addr_list);
+        setup_timer(&ndev->rs_timer, addrconf_rs_timer,
+                    (unsigned long)ndev);
        memcpy(&ndev->cnf, dev_net(dev)->ipv6.devconf_dflt, sizeof(ndev->cnf));
        ndev->cnf.mtu6 = dev->mtu;
        ndev->cnf.sysctl = NULL;
@@ -776,7 +773,7 @@ void inet6_ifa_finish_destroy(struct inet6_ifaddr *ifp)
        in6_dev_put(ifp->idev);
-        if (del_timer(&ifp->timer))
+        if (del_timer(&ifp->dad_timer))
                pr_notice("Timer is still running, when freeing ifa=%p\n", ifp);
        if (ifp->state != INET6_IFADDR_STATE_DEAD) {
@@ -869,9 +866,9 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
        spin_lock_init(&ifa->lock);
        spin_lock_init(&ifa->state_lock);
-        init_timer(&ifa->timer);
+        setup_timer(&ifa->dad_timer, addrconf_dad_timer,
+                    (unsigned long)ifa);
        INIT_HLIST_NODE(&ifa->addr_lst);
-        ifa->timer.data = (unsigned long) ifa;
        ifa->scope = scope;
        ifa->prefix_len = pfxlen;
        ifa->flags = flags | IFA_F_TENTATIVE;
@@ -994,7 +991,7 @@ static void ipv6_del_addr(struct inet6_ifaddr *ifp)
        }
        write_unlock_bh(&idev->lock);
-        addrconf_del_timer(ifp);
+        addrconf_del_dad_timer(ifp);
        ipv6_ifa_notify(RTM_DELADDR, ifp);
@@ -1126,8 +1123,7 @@ retry:
        ift = !max_addresses ||
              ipv6_count_addresses(idev) < max_addresses ?
-                ipv6_add_addr(idev, &addr, tmp_plen,
+                ipv6_add_addr(idev, &addr, tmp_plen, ipv6_addr_scope(&addr),
-                              ipv6_addr_type(&addr)&IPV6_ADDR_SCOPE_MASK,
                              addr_flags) : NULL;
        if (IS_ERR_OR_NULL(ift)) {
                in6_ifa_put(ifp);
@@ -1448,6 +1444,23 @@ try_nextdev:
 }
 EXPORT_SYMBOL(ipv6_dev_get_saddr);
+int __ipv6_get_lladdr(struct inet6_dev *idev, struct in6_addr *addr,
+                      unsigned char banned_flags)
+{
+        struct inet6_ifaddr *ifp;
+        int err = -EADDRNOTAVAIL;
+        list_for_each_entry(ifp, &idev->addr_list, if_list) {
+                if (ifp->scope == IFA_LINK &&
+                    !(ifp->flags & banned_flags)) {
+                        *addr = ifp->addr;
+                        err = 0;
+                        break;
+                }
+        }
+        return err;
+}
 int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
                    unsigned char banned_flags)
 {
@@ -1457,17 +1470,8 @@ int ipv6_get_lladdr(struct net_device *dev, struct in6_addr *addr,
        rcu_read_lock();
        idev = __in6_dev_get(dev);
        if (idev) {
-                struct inet6_ifaddr *ifp;
                read_lock_bh(&idev->lock);
-                list_for_each_entry(ifp, &idev->addr_list, if_list) {
+                err = __ipv6_get_lladdr(idev, addr, banned_flags);
-                        if (ifp->scope == IFA_LINK &&
-                            !(ifp->flags & banned_flags)) {
-                                *addr = ifp->addr;
-                                err = 0;
-                                break;
-                        }
-                }
                read_unlock_bh(&idev->lock);
        }
        rcu_read_unlock();
@@ -1581,7 +1585,7 @@ static void addrconf_dad_stop(struct inet6_ifaddr *ifp, int dad_failed)
 {
        if (ifp->flags&IFA_F_PERMANENT) {
                spin_lock_bh(&ifp->lock);
-                addrconf_del_timer(ifp);
+                addrconf_del_dad_timer(ifp);
                ifp->flags |= IFA_F_TENTATIVE;
                if (dad_failed)
                        ifp->flags |= IFA_F_DADFAILED;
@@ -2402,6 +2406,7 @@ err_exit:
 *      Manual configuration of address on an interface
 */
 static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *pfx,
+                          const struct in6_addr *peer_pfx,
                          unsigned int plen, __u8 ifa_flags, __u32 prefered_lft,
                          __u32 valid_lft)
 {
@@ -2457,6 +2462,8 @@ static int inet6_addr_add(struct net *net, int ifindex, const struct in6_addr *p
                ifp->valid_lft = valid_lft;
                ifp->prefered_lft = prefered_lft;
                ifp->tstamp = jiffies;
+                if (peer_pfx)
+                        ifp->peer_addr = *peer_pfx;
                spin_unlock_bh(&ifp->lock);
                addrconf_prefix_route(&ifp->addr, ifp->prefix_len, dev,
@@ -2500,12 +2507,6 @@ static int inet6_addr_del(struct net *net, int ifindex, const struct in6_addr *p
                        read_unlock_bh(&idev->lock);
                        ipv6_del_addr(ifp);
-                        /* If the last address is deleted administratively,
-                           disable IPv6 on this interface.
-                         */
-                        if (list_empty(&idev->addr_list))
-                                addrconf_ifdown(idev->dev, 1);
                        return 0;
                }
        }
@@ -2526,7 +2527,7 @@ int addrconf_add_ifaddr(struct net *net, void __user *arg)
                return -EFAULT;
        rtnl_lock();
-        err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr,
+        err = inet6_addr_add(net, ireq.ifr6_ifindex, &ireq.ifr6_addr, NULL,
                             ireq.ifr6_prefixlen, IFA_F_PERMANENT,
                             INFINITY_LIFE_TIME, INFINITY_LIFE_TIME);
        rtnl_unlock();
@@ -2761,8 +2762,6 @@ static void addrconf_gre_config(struct net_device *dev)
        struct inet6_dev *idev;
        struct in6_addr addr;
-        pr_info("%s(%s)\n", __func__, dev->name);
        ASSERT_RTNL();
        if ((idev = ipv6_find_idev(dev)) == NULL) {
@@ -2829,9 +2828,9 @@ static void addrconf_ip6_tnl_config(struct net_device *dev)
 }
 static int addrconf_notify(struct notifier_block *this, unsigned long event,
-                           void *data)
+                           void *ptr)
 {
-        struct net_device *dev = (struct net_device *) data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct inet6_dev *idev = __in6_dev_get(dev);
        int run_pending = 0;
        int err;
@@ -3039,7 +3038,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
                hlist_for_each_entry_rcu(ifa, h, addr_lst) {
                        if (ifa->idev == idev) {
                                hlist_del_init_rcu(&ifa->addr_lst);
-                                addrconf_del_timer(ifa);
+                                addrconf_del_dad_timer(ifa);
                                goto restart;
                        }
                }
@@ -3048,6 +3047,8 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        write_lock_bh(&idev->lock);
+        addrconf_del_rs_timer(idev);
        /* Step 2: clear flags for stateless addrconf */
        if (!how)
                idev->if_flags &= ~(IF_RS_SENT|IF_RA_RCVD|IF_READY);
@@ -3077,7 +3078,7 @@ static int addrconf_ifdown(struct net_device *dev, int how)
        while (!list_empty(&idev->addr_list)) {
                ifa = list_first_entry(&idev->addr_list,
                                       struct inet6_ifaddr, if_list);
-                addrconf_del_timer(ifa);
+                addrconf_del_dad_timer(ifa);
                list_del(&ifa->if_list);
@@ -3119,10 +3120,10 @@ static int addrconf_ifdown(struct net_device *dev, int how)
 static void addrconf_rs_timer(unsigned long data)
 {
-        struct inet6_ifaddr *ifp = (struct inet6_ifaddr *) data;
+        struct inet6_dev *idev = (struct inet6_dev *)data;
-        struct inet6_dev *idev = ifp->idev;
+        struct in6_addr lladdr;
-        read_lock(&idev->lock);
+        write_lock(&idev->lock);
        if (idev->dead || !(idev->if_flags & IF_READY))
                goto out;
@@ -3133,18 +3134,19 @@ static void addrconf_rs_timer(unsigned long data)
        if (idev->if_flags & IF_RA_RCVD)
                goto out;
-        spin_lock(&ifp->lock);
+        if (idev->rs_probes++ < idev->cnf.rtr_solicits) {
-        if (ifp->probes++ < idev->cnf.rtr_solicits) {
+                if (!__ipv6_get_lladdr(idev, &lladdr, IFA_F_TENTATIVE))
-                /* The wait after the last probe can be shorter */
+                        ndisc_send_rs(idev->dev, &lladdr,
-                addrconf_mod_timer(ifp, AC_RS,
+                                      &in6addr_linklocal_allrouters);
-                                   (ifp->probes == idev->cnf.rtr_solicits) ?
+                else
-                                   idev->cnf.rtr_solicit_delay :
+                        goto out;
-                                   idev->cnf.rtr_solicit_interval);
-                spin_unlock(&ifp->lock);
-                ndisc_send_rs(idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
+                /* The wait after the last probe can be shorter */
+                addrconf_mod_rs_timer(idev, (idev->rs_probes ==
+                                             idev->cnf.rtr_solicits) ?
+                                      idev->cnf.rtr_solicit_delay :
+                                      idev->cnf.rtr_solicit_interval);
        } else {
-                spin_unlock(&ifp->lock);
                /*
                 * Note: we do not support deprecated "all on-link"
                 * assumption any longer.
@@ -3153,8 +3155,8 @@ static void addrconf_rs_timer(unsigned long data)
        }
 out:
-        read_unlock(&idev->lock);
+        write_unlock(&idev->lock);
-        in6_ifa_put(ifp);
+        in6_dev_put(idev);
 }
 /*
@@ -3170,8 +3172,8 @@ static void addrconf_dad_kick(struct inet6_ifaddr *ifp)
        else
                rand_num = net_random() % (idev->cnf.rtr_solicit_delay ? : 1);
-        ifp->probes = idev->cnf.dad_transmits;
+        ifp->dad_probes = idev->cnf.dad_transmits;
-        addrconf_mod_timer(ifp, AC_DAD, rand_num);
+        addrconf_mod_dad_timer(ifp, rand_num);
 }
 static void addrconf_dad_start(struct inet6_ifaddr *ifp)
@@ -3232,40 +3234,40 @@ static void addrconf_dad_timer(unsigned long data)
        struct inet6_dev *idev = ifp->idev;
        struct in6_addr mcaddr;
-        if (!ifp->probes && addrconf_dad_end(ifp))
+        if (!ifp->dad_probes && addrconf_dad_end(ifp))
                goto out;
-        read_lock(&idev->lock);
+        write_lock(&idev->lock);
        if (idev->dead || !(idev->if_flags & IF_READY)) {
-                read_unlock(&idev->lock);
+                write_unlock(&idev->lock);
                goto out;
        }
        spin_lock(&ifp->lock);
        if (ifp->state == INET6_IFADDR_STATE_DEAD) {
                spin_unlock(&ifp->lock);
-                read_unlock(&idev->lock);
+                write_unlock(&idev->lock);
                goto out;
        }
-        if (ifp->probes == 0) {
+        if (ifp->dad_probes == 0) {
                /*
                 * DAD was successful
                 */
                ifp->flags &= ~(IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|IFA_F_DADFAILED);
                spin_unlock(&ifp->lock);
-                read_unlock(&idev->lock);
+                write_unlock(&idev->lock);
                addrconf_dad_completed(ifp);
                goto out;
        }
-        ifp->probes--;
+        ifp->dad_probes--;
-        addrconf_mod_timer(ifp, AC_DAD, ifp->idev->nd_parms->retrans_time);
+        addrconf_mod_dad_timer(ifp, ifp->idev->nd_parms->retrans_time);
        spin_unlock(&ifp->lock);
-        read_unlock(&idev->lock);
+        write_unlock(&idev->lock);
        /* send a neighbour solicitation for our addr */
        addrconf_addr_solict_mult(&ifp->addr, &mcaddr);
@@ -3277,6 +3279,10 @@ out:
 static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
 {
        struct net_device *dev = ifp->idev->dev;
+        struct in6_addr lladdr;
+        bool send_rs, send_mld;
+        addrconf_del_dad_timer(ifp);
        /*
         *      Configure the address for reception. Now it is valid.
@@ -3288,22 +3294,41 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp)
           router advertisements, start sending router solicitations.
         */
-        if (ipv6_accept_ra(ifp->idev) &&
+        read_lock_bh(&ifp->idev->lock);
-            ifp->idev->cnf.rtr_solicits > 0 &&
+        spin_lock(&ifp->lock);
-            (dev->flags&IFF_LOOPBACK) == 0 &&
+        send_mld = ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL &&
-            (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) {
+                   ifp->idev->valid_ll_addr_cnt == 1;
+        send_rs = send_mld &&
+                  ipv6_accept_ra(ifp->idev) &&
+                  ifp->idev->cnf.rtr_solicits > 0 &&
+                  (dev->flags&IFF_LOOPBACK) == 0;
+        spin_unlock(&ifp->lock);
+        read_unlock_bh(&ifp->idev->lock);
+        /* While dad is in progress mld report's source address is in6_addrany.
+         * Resend with proper ll now.
+         */
+        if (send_mld)
+                ipv6_mc_dad_complete(ifp->idev);
+        if (send_rs) {
                /*
                 *      If a host as already performed a random delay
                 *      [...] as part of DAD [...] there is no need
                 *      to delay again before sending the first RS
                 */
-                ndisc_send_rs(ifp->idev->dev, &ifp->addr, &in6addr_linklocal_allrouters);
+                if (ipv6_get_lladdr(dev, &lladdr, IFA_F_TENTATIVE))
+                        return;
+                ndisc_send_rs(dev, &lladdr, &in6addr_linklocal_allrouters);
-                spin_lock_bh(&ifp->lock);
+                write_lock_bh(&ifp->idev->lock);
-                ifp->probes = 1;
+                spin_lock(&ifp->lock);
+                ifp->idev->rs_probes = 1;
                ifp->idev->if_flags |= IF_RS_SENT;
-                addrconf_mod_timer(ifp, AC_RS, ifp->idev->cnf.rtr_solicit_interval);
+                addrconf_mod_rs_timer(ifp->idev,
-                spin_unlock_bh(&ifp->lock);
+                                      ifp->idev->cnf.rtr_solicit_interval);
+                spin_unlock(&ifp->lock);
+                write_unlock_bh(&ifp->idev->lock);
        }
 }
@@ -3615,18 +3640,20 @@ restart:
        rcu_read_unlock_bh();
 }
-static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local)
+static struct in6_addr *extract_addr(struct nlattr *addr, struct nlattr *local,
+                                     struct in6_addr **peer_pfx)
 {
        struct in6_addr *pfx = NULL;
+        *peer_pfx = NULL;
        if (addr)
                pfx = nla_data(addr);
        if (local) {
                if (pfx && nla_memcmp(local, pfx, sizeof(*pfx)))
-                        pfx = NULL;
+                        *peer_pfx = pfx;
-                else
+                pfx = nla_data(local);
-                        pfx = nla_data(local);
        }
        return pfx;
@@ -3644,7 +3671,7 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct net *net = sock_net(skb->sk);
        struct ifaddrmsg *ifm;
        struct nlattr *tb[IFA_MAX+1];
-        struct in6_addr *pfx;
+        struct in6_addr *pfx, *peer_pfx;
        int err;
        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
@@ -3652,7 +3679,7 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
                return err;
        ifm = nlmsg_data(nlh);
-        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
+        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
        if (pfx == NULL)
                return -EINVAL;
@@ -3710,7 +3737,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct net *net = sock_net(skb->sk);
        struct ifaddrmsg *ifm;
        struct nlattr *tb[IFA_MAX+1];
-        struct in6_addr *pfx;
+        struct in6_addr *pfx, *peer_pfx;
        struct inet6_ifaddr *ifa;
        struct net_device *dev;
        u32 valid_lft = INFINITY_LIFE_TIME, preferred_lft = INFINITY_LIFE_TIME;
@@ -3722,7 +3749,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
                return err;
        ifm = nlmsg_data(nlh);
-        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
+        pfx = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer_pfx);
        if (pfx == NULL)
                return -EINVAL;
@@ -3750,7 +3777,7 @@ inet6_rtm_newaddr(struct sk_buff *skb, struct nlmsghdr *nlh)
                 * It would be best to check for !NLM_F_CREATE here but
                 * userspace alreay relies on not having to provide this.
                 */
-                return inet6_addr_add(net, ifm->ifa_index, pfx,
+                return inet6_addr_add(net, ifm->ifa_index, pfx, peer_pfx,
                                      ifm->ifa_prefixlen, ifa_flags,
                                      preferred_lft, valid_lft);
        }
@@ -3807,6 +3834,7 @@ static inline int rt_scope(int ifa_scope)
 static inline int inet6_ifaddr_msgsize(void)
 {
        return NLMSG_ALIGN(sizeof(struct ifaddrmsg))
+               + nla_total_size(16) /* IFA_LOCAL */
               + nla_total_size(16) /* IFA_ADDRESS */
               + nla_total_size(sizeof(struct ifa_cacheinfo));
 }
@@ -3845,13 +3873,22 @@ static int inet6_fill_ifaddr(struct sk_buff *skb, struct inet6_ifaddr *ifa,
                valid = INFINITY_LIFE_TIME;
        }
-        if (nla_put(skb, IFA_ADDRESS, 16, &ifa->addr) < 0 ||
+        if (!ipv6_addr_any(&ifa->peer_addr)) {
-            put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0) {
+                if (nla_put(skb, IFA_LOCAL, 16, &ifa->addr) < 0 ||
-                nlmsg_cancel(skb, nlh);
+                    nla_put(skb, IFA_ADDRESS, 16, &ifa->peer_addr) < 0)
-                return -EMSGSIZE;
+                        goto error;
-        }
+        } else
+                if (nla_put(skb, IFA_ADDRESS, 16, &ifa->addr) < 0)
+                        goto error;
+        if (put_cacheinfo(skb, ifa->cstamp, ifa->tstamp, preferred, valid) < 0)
+                goto error;
        return nlmsg_end(skb, nlh);
+error:
+        nlmsg_cancel(skb, nlh);
+        return -EMSGSIZE;
 }
 static int inet6_fill_ifmcaddr(struct sk_buff *skb, struct ifmcaddr6 *ifmca,
@@ -4051,7 +4088,7 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh)
        struct net *net = sock_net(in_skb->sk);
        struct ifaddrmsg *ifm;
        struct nlattr *tb[IFA_MAX+1];
-        struct in6_addr *addr = NULL;
+        struct in6_addr *addr = NULL, *peer;
        struct net_device *dev = NULL;
        struct inet6_ifaddr *ifa;
        struct sk_buff *skb;
@@ -4061,7 +4098,7 @@ static int inet6_rtm_getaddr(struct sk_buff *in_skb, struct nlmsghdr *nlh)
        if (err < 0)
                goto errout;
-        addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL]);
+        addr = extract_addr(tb[IFA_ADDRESS], tb[IFA_LOCAL], &peer);
        if (addr == NULL) {
                err = -EINVAL;
                goto errout;
@@ -4339,8 +4376,11 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
        write_lock_bh(&idev->lock);
-        if (update_rs)
+        if (update_rs) {
                idev->if_flags |= IF_RS_SENT;
+                idev->rs_probes = 1;
+                addrconf_mod_rs_timer(idev, idev->cnf.rtr_solicit_interval);
+        }
        /* Well, that's kinda nasty ... */
        list_for_each_entry(ifp, &idev->addr_list, if_list) {
@@ -4353,6 +4393,7 @@ static int inet6_set_iftoken(struct inet6_dev *idev, struct in6_addr *token)
        }
        write_unlock_bh(&idev->lock);
+        addrconf_verify(0);
        return 0;
 }
@@ -4550,6 +4591,19 @@ errout:
                rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err);
 }
+static void update_valid_ll_addr_cnt(struct inet6_ifaddr *ifp, int count)
+{
+        write_lock_bh(&ifp->idev->lock);
+        spin_lock(&ifp->lock);
+        if (((ifp->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|IFA_F_OPTIMISTIC|
+                            IFA_F_DADFAILED)) == IFA_F_PERMANENT) &&
+            (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL))
+                ifp->idev->valid_ll_addr_cnt += count;
+        WARN_ON(ifp->idev->valid_ll_addr_cnt < 0);
+        spin_unlock(&ifp->lock);
+        write_unlock_bh(&ifp->idev->lock);
+}
 static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 {
        struct net *net = dev_net(ifp->idev->dev);
@@ -4558,6 +4612,8 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
        switch (event) {
        case RTM_NEWADDR:
+                update_valid_ll_addr_cnt(ifp, 1);
                /*
                 * If the address was optimistic
                 * we inserted the route at the start of
@@ -4568,11 +4624,28 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
                        ip6_ins_rt(ifp->rt);
                if (ifp->idev->cnf.forwarding)
                        addrconf_join_anycast(ifp);
+                if (!ipv6_addr_any(&ifp->peer_addr))
+                        addrconf_prefix_route(&ifp->peer_addr, 128,
+                                              ifp->idev->dev, 0, 0);
                break;
        case RTM_DELADDR:
+                update_valid_ll_addr_cnt(ifp, -1);
                if (ifp->idev->cnf.forwarding)
                        addrconf_leave_anycast(ifp);
                addrconf_leave_solict(ifp->idev, &ifp->addr);
+                if (!ipv6_addr_any(&ifp->peer_addr)) {
+                        struct rt6_info *rt;
+                        struct net_device *dev = ifp->idev->dev;
+                        rt = rt6_lookup(dev_net(dev), &ifp->peer_addr, NULL,
+                                        dev->ifindex, 1);
+                        if (rt) {
+                                dst_hold(&rt->dst);
+                                if (ip6_del_rt(rt))
+                                        dst_free(&rt->dst);
+                        }
+                }
                dst_hold(&ifp->rt->dst);
                if (ip6_del_rt(ifp->rt))
@@ -4593,13 +4666,13 @@ static void ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 #ifdef CONFIG_SYSCTL
 static
-int addrconf_sysctl_forward(ctl_table *ctl, int write,
+int addrconf_sysctl_forward(struct ctl_table *ctl, int write,
                           void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int *valp = ctl->data;
        int val = *valp;
        loff_t pos = *ppos;
-        ctl_table lctl;
+        struct ctl_table lctl;
        int ret;
        /*
@@ -4620,13 +4693,16 @@ int addrconf_sysctl_forward(ctl_table *ctl, int write,
 static void dev_disable_change(struct inet6_dev *idev)
 {
+        struct netdev_notifier_info info;
        if (!idev || !idev->dev)
                return;
+        netdev_notifier_info_init(&info, idev->dev);
        if (idev->cnf.disable_ipv6)
-                addrconf_notify(NULL, NETDEV_DOWN, idev->dev);
+                addrconf_notify(NULL, NETDEV_DOWN, &info);
        else
-                addrconf_notify(NULL, NETDEV_UP, idev->dev);
+                addrconf_notify(NULL, NETDEV_UP, &info);
 }
 static void addrconf_disable_change(struct net *net, __s32 newf)
@@ -4675,13 +4751,13 @@ static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf)
 }
 static
-int addrconf_sysctl_disable(ctl_table *ctl, int write,
+int addrconf_sysctl_disable(struct ctl_table *ctl, int write,
                            void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        int *valp = ctl->data;
        int val = *valp;
        loff_t pos = *ppos;
-        ctl_table lctl;
+        struct ctl_table lctl;
        int ret;
        /*
@@ -4703,7 +4779,7 @@ int addrconf_sysctl_disable(ctl_table *ctl, int write,
 static struct addrconf_sysctl_table
 {
        struct ctl_table_header *sysctl_header;
-        ctl_table addrconf_vars[DEVCONF_MAX+1];
+        struct ctl_table addrconf_vars[DEVCONF_MAX+1];
 } addrconf_sysctl __read_mostly = {
        .sysctl_header = NULL,
        .addrconf_vars = {
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 72104562c864..d2f87427244b 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -5,6 +5,7 @@
 #include <linux/export.h>
 #include <net/ipv6.h>
+#include <net/addrconf.h>
 #define IPV6_ADDR_SCOPE_TYPE(scope)     ((scope) << 16)
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index ab5c7ad482cd..a5ac969aeefe 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -49,6 +49,7 @@
 #include <net/udp.h>
 #include <net/udplite.h>
 #include <net/tcp.h>
+#include <net/ping.h>
 #include <net/protocol.h>
 #include <net/inet_common.h>
 #include <net/route.h>
@@ -840,6 +841,9 @@ static int __init inet6_init(void)
        if (err)
                goto out_unregister_udplite_proto;
+        err = proto_register(&pingv6_prot, 1);
+        if (err)
+                goto out_unregister_ping_proto;
        /* We MUST register RAW sockets before we create the ICMP6,
         * IGMP6, or NDISC control sockets.
@@ -930,6 +934,10 @@ static int __init inet6_init(void)
        if (err)
                goto ipv6_packet_fail;
+        err = pingv6_init();
+        if (err)
+                goto pingv6_fail;
 #ifdef CONFIG_SYSCTL
        err = ipv6_sysctl_register();
        if (err)
@@ -942,6 +950,8 @@ out:
 sysctl_fail:
        ipv6_packet_cleanup();
 #endif
+pingv6_fail:
+        pingv6_exit();
 ipv6_packet_fail:
        tcpv6_exit();
 tcpv6_fail:
@@ -985,6 +995,8 @@ register_pernet_fail:
        rtnl_unregister_all(PF_INET6);
 out_sock_register_fail:
        rawv6_exit();
+out_unregister_ping_proto:
+        proto_unregister(&pingv6_prot);
 out_unregister_raw_proto:
        proto_unregister(&rawv6_prot);
 out_unregister_udplite_proto:
diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c
index 4b56cbbc7890..197e6f4a2b74 100644
--- a/net/ipv6/datagram.c
+++ b/net/ipv6/datagram.c
@@ -879,3 +879,30 @@ exit_f:
        return err;
 }
 EXPORT_SYMBOL_GPL(ip6_datagram_send_ctl);
+void ip6_dgram_sock_seq_show(struct seq_file *seq, struct sock *sp,
+                             __u16 srcp, __u16 destp, int bucket)
+{
+        struct ipv6_pinfo *np = inet6_sk(sp);
+        const struct in6_addr *dest, *src;
+        dest  = &np->daddr;
+        src   = &np->rcv_saddr;
+        seq_printf(seq,
+                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
+                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
+                   bucket,
+                   src->s6_addr32[0], src->s6_addr32[1],
+                   src->s6_addr32[2], src->s6_addr32[3], srcp,
+                   dest->s6_addr32[0], dest->s6_addr32[1],
+                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
+                   sp->sk_state,
+                   sk_wmem_alloc_get(sp),
+                   sk_rmem_alloc_get(sp),
+                   0, 0L, 0,
+                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
+                   0,
+                   sock_i_ino(sp),
+                   atomic_read(&sp->sk_refcnt), sp,
+                   atomic_read(&sp->sk_drops));
+}
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
index c5e83fae4df4..140748debc4a 100644
--- a/net/ipv6/exthdrs_core.c
+++ b/net/ipv6/exthdrs_core.c
@@ -115,7 +115,7 @@ EXPORT_SYMBOL(ipv6_skip_exthdr);
 int ipv6_find_tlv(struct sk_buff *skb, int offset, int type)
 {
        const unsigned char *nh = skb_network_header(skb);
-        int packet_len = skb->tail - skb->network_header;
+        int packet_len = skb_tail_pointer(skb) - skb_network_header(skb);
        struct ipv6_opt_hdr *hdr;
        int len;
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index b4ff0a42b8c7..7cfc8d284870 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -57,6 +57,7 @@
 #include <net/ipv6.h>
 #include <net/ip6_checksum.h>
+#include <net/ping.h>
 #include <net/protocol.h>
 #include <net/raw.h>
 #include <net/rawv6.h>
@@ -84,12 +85,18 @@ static inline struct sock *icmpv6_sk(struct net *net)
 static void icmpv6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                       u8 type, u8 code, int offset, __be32 info)
 {
+        /* icmpv6_notify checks 8 bytes can be pulled, icmp6hdr is 8 bytes */
+        struct icmp6hdr *icmp6 = (struct icmp6hdr *) (skb->data + offset);
        struct net *net = dev_net(skb->dev);
        if (type == ICMPV6_PKT_TOOBIG)
                ip6_update_pmtu(skb, net, info, 0, 0);
        else if (type == NDISC_REDIRECT)
                ip6_redirect(skb, net, 0, 0);
+        if (!(type & ICMPV6_INFOMSG_MASK))
+                if (icmp6->icmp6_type == ICMPV6_ECHO_REQUEST)
+                        ping_err(skb, offset, info);
 }
 static int icmpv6_rcv(struct sk_buff *skb);
@@ -224,7 +231,8 @@ static bool opt_unrec(struct sk_buff *skb, __u32 offset)
        return (*op & 0xC0) == 0x80;
 }
-static int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6, struct icmp6hdr *thdr, int len)
+int icmpv6_push_pending_frames(struct sock *sk, struct flowi6 *fl6,
+                               struct icmp6hdr *thdr, int len)
 {
        struct sk_buff *skb;
        struct icmp6hdr *icmp6h;
@@ -307,8 +315,8 @@ static void mip6_addr_swap(struct sk_buff *skb)
 static inline void mip6_addr_swap(struct sk_buff *skb) {}
 #endif
-static struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
+struct dst_entry *icmpv6_route_lookup(struct net *net, struct sk_buff *skb,
-                                             struct sock *sk, struct flowi6 *fl6)
+                                      struct sock *sk, struct flowi6 *fl6)
 {
        struct dst_entry *dst, *dst2;
        struct flowi6 fl2;
@@ -391,7 +399,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        int err = 0;
        if ((u8 *)hdr < skb->head ||
-            (skb->network_header + sizeof(*hdr)) > skb->tail)
+            (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
                return;
        /*
@@ -697,7 +705,8 @@ static int icmpv6_rcv(struct sk_buff *skb)
                skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
                                             IPPROTO_ICMPV6, 0));
                if (__skb_checksum_complete(skb)) {
-                        LIMIT_NETDEBUG(KERN_DEBUG "ICMPv6 checksum failed [%pI6 > %pI6]\n",
+                        LIMIT_NETDEBUG(KERN_DEBUG
+                                       "ICMPv6 checksum failed [%pI6c > %pI6c]\n",
                                       saddr, daddr);
                        goto csum_error;
                }
@@ -718,7 +727,7 @@ static int icmpv6_rcv(struct sk_buff *skb)
                break;
        case ICMPV6_ECHO_REPLY:
-                /* we couldn't care less */
+                ping_rcv(skb);
                break;
        case ICMPV6_PKT_TOOBIG:
@@ -967,7 +976,7 @@ int icmpv6_err_convert(u8 type, u8 code, int *err)
 EXPORT_SYMBOL(icmpv6_err_convert);
 #ifdef CONFIG_SYSCTL
-ctl_table ipv6_icmp_table_template[] = {
+struct ctl_table ipv6_icmp_table_template[] = {
        {
                .procname       = "ratelimit",
                .data           = &init_net.ipv6.sysctl.icmpv6_time,
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index 71b766ee821d..a263b990ee11 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -98,6 +98,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                       SKB_GSO_TCP_ECN |
                       SKB_GSO_GRE |
                       SKB_GSO_UDP_TUNNEL |
+                       SKB_GSO_MPLS |
                       SKB_GSO_TCPV6 |
                       0)))
                goto out;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index d5d20cde8d92..6e3ddf806ec2 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1098,11 +1098,12 @@ static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
 }
-static void ip6_append_data_mtu(int *mtu,
+static void ip6_append_data_mtu(unsigned int *mtu,
                                int *maxfraglen,
                                unsigned int fragheaderlen,
                                struct sk_buff *skb,
-                                struct rt6_info *rt)
+                                struct rt6_info *rt,
+                                bool pmtuprobe)
 {
        if (!(rt->dst.flags & DST_XFRM_TUNNEL)) {
                if (skb == NULL) {
@@ -1114,7 +1115,9 @@ static void ip6_append_data_mtu(int *mtu,
                         * this fragment is not first, the headers
                         * space is regarded as data space.
                         */
-                        *mtu = dst_mtu(rt->dst.path);
+                        *mtu = min(*mtu, pmtuprobe ?
+                                   rt->dst.dev->mtu :
+                                   dst_mtu(rt->dst.path));
                }
                *maxfraglen = ((*mtu - fragheaderlen) & ~7)
                              + fragheaderlen - sizeof(struct frag_hdr);
@@ -1131,11 +1134,10 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct inet_cork *cork;
        struct sk_buff *skb, *skb_prev = NULL;
-        unsigned int maxfraglen, fragheaderlen;
+        unsigned int maxfraglen, fragheaderlen, mtu;
        int exthdrlen;
        int dst_exthdrlen;
        int hh_len;
-        int mtu;
        int copy;
        int err;
        int offset = 0;
@@ -1292,7 +1294,9 @@ alloc_new_skb:
                        /* update mtu and maxfraglen if necessary */
                        if (skb == NULL || skb_prev == NULL)
                                ip6_append_data_mtu(&mtu, &maxfraglen,
-                                                    fragheaderlen, skb, rt);
+                                                    fragheaderlen, skb, rt,
+                                                    np->pmtudisc ==
+                                                    IPV6_PMTUDISC_PROBE);
                        skb_prev = skb;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 241fb8ad9fcf..583e8d435f9a 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -1319,7 +1319,7 @@ static int ip6mr_mfc_delete(struct mr6_table *mrt, struct mf6cctl *mfc,
 static int ip6mr_device_event(struct notifier_block *this,
                              unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct net *net = dev_net(dev);
        struct mr6_table *mrt;
        struct mif_device *v;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index bfa6cc36ef2a..99cd65c715cd 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -999,6 +999,14 @@ static void mld_ifc_start_timer(struct inet6_dev *idev, int delay)
                in6_dev_hold(idev);
 }
+static void mld_dad_start_timer(struct inet6_dev *idev, int delay)
+{
+        int tv = net_random() % delay;
+        if (!mod_timer(&idev->mc_dad_timer, jiffies+tv+2))
+                in6_dev_hold(idev);
+}
 /*
 *      IGMP handling (alias multicast ICMPv6 messages)
 */
@@ -1343,8 +1351,9 @@ static void ip6_mc_hdr(struct sock *sk, struct sk_buff *skb,
        hdr->daddr = *daddr;
 }
-static struct sk_buff *mld_newpack(struct net_device *dev, int size)
+static struct sk_buff *mld_newpack(struct inet6_dev *idev, int size)
 {
+        struct net_device *dev = idev->dev;
        struct net *net = dev_net(dev);
        struct sock *sk = net->ipv6.igmp_sk;
        struct sk_buff *skb;
@@ -1369,7 +1378,7 @@ static struct sk_buff *mld_newpack(struct net_device *dev, int size)
        skb_reserve(skb, hlen);
-        if (ipv6_get_lladdr(dev, &addr_buf, IFA_F_TENTATIVE)) {
+        if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
                /* <draft-ietf-magma-mld-source-05.txt>:
                 * use unspecified address as the source address
                 * when a valid link-local address is not available.
@@ -1409,8 +1418,9 @@ static void mld_sendpack(struct sk_buff *skb)
        idev = __in6_dev_get(skb->dev);
        IP6_UPD_PO_STATS(net, idev, IPSTATS_MIB_OUT, skb->len);
-        payload_len = (skb->tail - skb->network_header) - sizeof(*pip6);
+        payload_len = (skb_tail_pointer(skb) - skb_network_header(skb)) -
-        mldlen = skb->tail - skb->transport_header;
+                sizeof(*pip6);
+        mldlen = skb_tail_pointer(skb) - skb_transport_header(skb);
        pip6->payload_len = htons(payload_len);
        pmr->mld2r_cksum = csum_ipv6_magic(&pip6->saddr, &pip6->daddr, mldlen,
@@ -1465,7 +1475,7 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
        struct mld2_grec *pgr;
        if (!skb)
-                skb = mld_newpack(dev, dev->mtu);
+                skb = mld_newpack(pmc->idev, dev->mtu);
        if (!skb)
                return NULL;
        pgr = (struct mld2_grec *)skb_put(skb, sizeof(struct mld2_grec));
@@ -1485,7 +1495,8 @@ static struct sk_buff *add_grhead(struct sk_buff *skb, struct ifmcaddr6 *pmc,
 static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
        int type, int gdeleted, int sdeleted)
 {
-        struct net_device *dev = pmc->idev->dev;
+        struct inet6_dev *idev = pmc->idev;
+        struct net_device *dev = idev->dev;
        struct mld2_report *pmr;
        struct mld2_grec *pgr = NULL;
        struct ip6_sf_list *psf, *psf_next, *psf_prev, **psf_list;
@@ -1514,7 +1525,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                    AVAILABLE(skb) < grec_size(pmc, type, gdeleted, sdeleted)) {
                        if (skb)
                                mld_sendpack(skb);
-                        skb = mld_newpack(dev, dev->mtu);
+                        skb = mld_newpack(idev, dev->mtu);
                }
        }
        first = 1;
@@ -1541,7 +1552,7 @@ static struct sk_buff *add_grec(struct sk_buff *skb, struct ifmcaddr6 *pmc,
                                pgr->grec_nsrcs = htons(scount);
                        if (skb)
                                mld_sendpack(skb);
-                        skb = mld_newpack(dev, dev->mtu);
+                        skb = mld_newpack(idev, dev->mtu);
                        first = 1;
                        scount = 0;
                }
@@ -1596,8 +1607,8 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
        struct sk_buff *skb = NULL;
        int type;
+        read_lock_bh(&idev->lock);
        if (!pmc) {
-                read_lock_bh(&idev->lock);
                for (pmc=idev->mc_list; pmc; pmc=pmc->next) {
                        if (pmc->mca_flags & MAF_NOREPORT)
                                continue;
@@ -1609,7 +1620,6 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
                        skb = add_grec(skb, pmc, type, 0, 0);
                        spin_unlock_bh(&pmc->mca_lock);
                }
-                read_unlock_bh(&idev->lock);
        } else {
                spin_lock_bh(&pmc->mca_lock);
                if (pmc->mca_sfcount[MCAST_EXCLUDE])
@@ -1619,6 +1629,7 @@ static void mld_send_report(struct inet6_dev *idev, struct ifmcaddr6 *pmc)
                skb = add_grec(skb, pmc, type, 0, 0);
                spin_unlock_bh(&pmc->mca_lock);
        }
+        read_unlock_bh(&idev->lock);
        if (skb)
                mld_sendpack(skb);
 }
@@ -1814,6 +1825,46 @@ err_out:
        goto out;
 }
+static void mld_resend_report(struct inet6_dev *idev)
+{
+        if (MLD_V1_SEEN(idev)) {
+                struct ifmcaddr6 *mcaddr;
+                read_lock_bh(&idev->lock);
+                for (mcaddr = idev->mc_list; mcaddr; mcaddr = mcaddr->next) {
+                        if (!(mcaddr->mca_flags & MAF_NOREPORT))
+                                igmp6_send(&mcaddr->mca_addr, idev->dev,
+                                           ICMPV6_MGM_REPORT);
+                }
+                read_unlock_bh(&idev->lock);
+        } else {
+                mld_send_report(idev, NULL);
+        }
+}
+void ipv6_mc_dad_complete(struct inet6_dev *idev)
+{
+        idev->mc_dad_count = idev->mc_qrv;
+        if (idev->mc_dad_count) {
+                mld_resend_report(idev);
+                idev->mc_dad_count--;
+                if (idev->mc_dad_count)
+                        mld_dad_start_timer(idev, idev->mc_maxdelay);
+        }
+}
+static void mld_dad_timer_expire(unsigned long data)
+{
+        struct inet6_dev *idev = (struct inet6_dev *)data;
+        mld_resend_report(idev);
+        if (idev->mc_dad_count) {
+                idev->mc_dad_count--;
+                if (idev->mc_dad_count)
+                        mld_dad_start_timer(idev, idev->mc_maxdelay);
+        }
+        __in6_dev_put(idev);
+}
 static int ip6_mc_del1_src(struct ifmcaddr6 *pmc, int sfmode,
        const struct in6_addr *psfsrc)
 {
@@ -2231,6 +2282,8 @@ void ipv6_mc_down(struct inet6_dev *idev)
        idev->mc_gq_running = 0;
        if (del_timer(&idev->mc_gq_timer))
                __in6_dev_put(idev);
+        if (del_timer(&idev->mc_dad_timer))
+                __in6_dev_put(idev);
        for (i = idev->mc_list; i; i=i->next)
                igmp6_group_dropped(i);
@@ -2267,6 +2320,8 @@ void ipv6_mc_init_dev(struct inet6_dev *idev)
        idev->mc_ifc_count = 0;
        setup_timer(&idev->mc_ifc_timer, mld_ifc_timer_expire,
                        (unsigned long)idev);
+        setup_timer(&idev->mc_dad_timer, mld_dad_timer_expire,
+                    (unsigned long)idev);
        idev->mc_qrv = MLD_QRV_DEFAULT;
        idev->mc_maxdelay = IGMP6_UNSOLICITED_IVAL;
        idev->mc_v1_seen = 0;
diff --git a/net/ipv6/mip6.c b/net/ipv6/mip6.c
index 0f9bdc5ee9f3..9ac01dc9402e 100644
--- a/net/ipv6/mip6.c
+++ b/net/ipv6/mip6.c
@@ -268,7 +268,8 @@ static int mip6_destopt_offset(struct xfrm_state *x, struct sk_buff *skb,
        struct ipv6_opt_hdr *exthdr =
                                   (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
        const unsigned char *nh = skb_network_header(skb);
-        unsigned int packet_len = skb->tail - skb->network_header;
+        unsigned int packet_len = skb_tail_pointer(skb) -
+                skb_network_header(skb);
        int found_rhdr = 0;
        *nexthdr = &ipv6_hdr(skb)->nexthdr;
@@ -404,7 +405,8 @@ static int mip6_rthdr_offset(struct xfrm_state *x, struct sk_buff *skb,
        struct ipv6_opt_hdr *exthdr =
                                   (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
        const unsigned char *nh = skb_network_header(skb);
-        unsigned int packet_len = skb->tail - skb->network_header;
+        unsigned int packet_len = skb_tail_pointer(skb) -
+                skb_network_header(skb);
        int found_rhdr = 0;
        *nexthdr = &ipv6_hdr(skb)->nexthdr;
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index ca4ffcc287f1..b3b5730b48c5 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -693,7 +693,7 @@ static void ndisc_recv_ns(struct sk_buff *skb)
        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
        const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
        u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                    offsetof(struct nd_msg, opt));
        struct ndisc_options ndopts;
        struct net_device *dev = skb->dev;
@@ -853,7 +853,7 @@ static void ndisc_recv_na(struct sk_buff *skb)
        const struct in6_addr *saddr = &ipv6_hdr(skb)->saddr;
        const struct in6_addr *daddr = &ipv6_hdr(skb)->daddr;
        u8 *lladdr = NULL;
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                    offsetof(struct nd_msg, opt));
        struct ndisc_options ndopts;
        struct net_device *dev = skb->dev;
@@ -1069,7 +1069,8 @@ static void ndisc_router_discovery(struct sk_buff *skb)
        __u8 * opt = (__u8 *)(ra_msg + 1);
-        optlen = (skb->tail - skb->transport_header) - sizeof(struct ra_msg);
+        optlen = (skb_tail_pointer(skb) - skb_transport_header(skb)) -
+                sizeof(struct ra_msg);
        if (!(ipv6_addr_type(&ipv6_hdr(skb)->saddr) & IPV6_ADDR_LINKLOCAL)) {
                ND_PRINTK(2, warn, "RA: source address is not link-local\n");
@@ -1346,7 +1347,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
        u8 *hdr;
        struct ndisc_options ndopts;
        struct rd_msg *msg = (struct rd_msg *)skb_transport_header(skb);
-        u32 ndoptlen = skb->tail - (skb->transport_header +
+        u32 ndoptlen = skb_tail_pointer(skb) - (skb_transport_header(skb) +
                                    offsetof(struct rd_msg, opt));
 #ifdef CONFIG_IPV6_NDISC_NODETYPE
@@ -1568,7 +1569,7 @@ int ndisc_rcv(struct sk_buff *skb)
 static int ndisc_netdev_event(struct notifier_block *this, unsigned long event, void *ptr)
 {
-        struct net_device *dev = ptr;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct net *net = dev_net(dev);
        struct inet6_dev *idev;
diff --git a/net/ipv6/netfilter/ip6t_MASQUERADE.c b/net/ipv6/netfilter/ip6t_MASQUERADE.c
index 60e9053bab05..47bff6107519 100644
--- a/net/ipv6/netfilter/ip6t_MASQUERADE.c
+++ b/net/ipv6/netfilter/ip6t_MASQUERADE.c
@@ -71,7 +71,7 @@ static int device_cmp(struct nf_conn *ct, void *ifindex)
 static int masq_device_event(struct notifier_block *this,
                             unsigned long event, void *ptr)
 {
-        const struct net_device *dev = ptr;
+        const struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct net *net = dev_net(dev);
        if (event == NETDEV_DOWN)
@@ -89,8 +89,10 @@ static int masq_inet_event(struct notifier_block *this,
                           unsigned long event, void *ptr)
 {
        struct inet6_ifaddr *ifa = ptr;
+        struct netdev_notifier_info info;
-        return masq_device_event(this, event, ifa->idev->dev);
+        netdev_notifier_info_init(&info, ifa->idev->dev);
+        return masq_device_event(this, event, &info);
 }
 static struct notifier_block masq_inet_notifier = {
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index c2e73e647e44..ab92a3673fbb 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -40,7 +40,8 @@ int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
        u16 offset = sizeof(struct ipv6hdr);
        struct ipv6_opt_hdr *exthdr =
                                (struct ipv6_opt_hdr *)(ipv6_hdr(skb) + 1);
-        unsigned int packet_len = skb->tail - skb->network_header;
+        unsigned int packet_len = skb_tail_pointer(skb) -
+                skb_network_header(skb);
        int found_rhdr = 0;
        *nexthdr = &ipv6_hdr(skb)->nexthdr;
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
new file mode 100644
index 000000000000..18f19df4189f
--- /dev/null
+++ b/net/ipv6/ping.c
@@ -0,0 +1,277 @@
+/*
+ * INET         An implementation of the TCP/IP protocol suite for the LINUX
+ *              operating system.  INET is implemented using the  BSD Socket
+ *              interface as the means of communication with the user level.
+ *
+ *              "Ping" sockets
+ *
+ *              This program is free software; you can redistribute it and/or
+ *              modify it under the terms of the GNU General Public License
+ *              as published by the Free Software Foundation; either version
+ *              2 of the License, or (at your option) any later version.
+ *
+ * Based on ipv4/ping.c code.
+ *
+ * Authors:     Lorenzo Colitti (IPv6 support)
+ *              Vasiliy Kulikov / Openwall (IPv4 implementation, for Linux 2.6),
+ *              Pavel Kankovsky (IPv4 implementation, for Linux 2.4.32)
+ *
+ */
+#include <net/addrconf.h>
+#include <net/ipv6.h>
+#include <net/ip6_route.h>
+#include <net/protocol.h>
+#include <net/udp.h>
+#include <net/transp_v6.h>
+#include <net/ping.h>
+struct proto pingv6_prot = {
+        .name =         "PINGv6",
+        .owner =        THIS_MODULE,
+        .init =         ping_init_sock,
+        .close =        ping_close,
+        .connect =      ip6_datagram_connect,
+        .disconnect =   udp_disconnect,
+        .setsockopt =   ipv6_setsockopt,
+        .getsockopt =   ipv6_getsockopt,
+        .sendmsg =      ping_v6_sendmsg,
+        .recvmsg =      ping_recvmsg,
+        .bind =         ping_bind,
+        .backlog_rcv =  ping_queue_rcv_skb,
+        .hash =         ping_hash,
+        .unhash =       ping_unhash,
+        .get_port =     ping_get_port,
+        .obj_size =     sizeof(struct raw6_sock),
+};
+EXPORT_SYMBOL_GPL(pingv6_prot);
+static struct inet_protosw pingv6_protosw = {
+        .type =      SOCK_DGRAM,
+        .protocol =  IPPROTO_ICMPV6,
+        .prot =      &pingv6_prot,
+        .ops =       &inet6_dgram_ops,
+        .no_check =  UDP_CSUM_DEFAULT,
+        .flags =     INET_PROTOSW_REUSE,
+};
+/* Compatibility glue so we can support IPv6 when it's compiled as a module */
+static int dummy_ipv6_recv_error(struct sock *sk, struct msghdr *msg, int len)
+{
+        return -EAFNOSUPPORT;
+}
+static int dummy_ip6_datagram_recv_ctl(struct sock *sk, struct msghdr *msg,
+                                       struct sk_buff *skb)
+{
+        return -EAFNOSUPPORT;
+}
+static int dummy_icmpv6_err_convert(u8 type, u8 code, int *err)
+{
+        return -EAFNOSUPPORT;
+}
+static void dummy_ipv6_icmp_error(struct sock *sk, struct sk_buff *skb, int err,
+                                  __be16 port, u32 info, u8 *payload) {}
+static int dummy_ipv6_chk_addr(struct net *net, const struct in6_addr *addr,
+                               const struct net_device *dev, int strict)
+{
+        return 0;
+}
+int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
+                    size_t len)
+{
+        struct inet_sock *inet = inet_sk(sk);
+        struct ipv6_pinfo *np = inet6_sk(sk);
+        struct icmp6hdr user_icmph;
+        int addr_type;
+        struct in6_addr *daddr;
+        int iif = 0;
+        struct flowi6 fl6;
+        int err;
+        int hlimit;
+        struct dst_entry *dst;
+        struct rt6_info *rt;
+        struct pingfakehdr pfh;
+        pr_debug("ping_v6_sendmsg(sk=%p,sk->num=%u)\n", inet, inet->inet_num);
+        err = ping_common_sendmsg(AF_INET6, msg, len, &user_icmph,
+                                  sizeof(user_icmph));
+        if (err)
+                return err;
+        if (msg->msg_name) {
+                struct sockaddr_in6 *u = (struct sockaddr_in6 *) msg->msg_name;
+                if (msg->msg_namelen < sizeof(struct sockaddr_in6) ||
+                    u->sin6_family != AF_INET6) {
+                        return -EINVAL;
+                }
+                if (sk->sk_bound_dev_if &&
+                    sk->sk_bound_dev_if != u->sin6_scope_id) {
+                        return -EINVAL;
+                }
+                daddr = &(u->sin6_addr);
+                iif = u->sin6_scope_id;
+        } else {
+                if (sk->sk_state != TCP_ESTABLISHED)
+                        return -EDESTADDRREQ;
+                daddr = &np->daddr;
+        }
+        if (!iif)
+                iif = sk->sk_bound_dev_if;
+        addr_type = ipv6_addr_type(daddr);
+        if (__ipv6_addr_needs_scope_id(addr_type) && !iif)
+                return -EINVAL;
+        if (addr_type & IPV6_ADDR_MAPPED)
+                return -EINVAL;
+        /* TODO: use ip6_datagram_send_ctl to get options from cmsg */
+        memset(&fl6, 0, sizeof(fl6));
+        fl6.flowi6_proto = IPPROTO_ICMPV6;
+        fl6.saddr = np->saddr;
+        fl6.daddr = *daddr;
+        fl6.fl6_icmp_type = user_icmph.icmp6_type;
+        fl6.fl6_icmp_code = user_icmph.icmp6_code;
+        security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
+                fl6.flowi6_oif = np->mcast_oif;
+        else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
+        dst = ip6_sk_dst_lookup_flow(sk, &fl6,  daddr, 1);
+        if (IS_ERR(dst))
+                return PTR_ERR(dst);
+        rt = (struct rt6_info *) dst;
+        np = inet6_sk(sk);
+        if (!np)
+                return -EBADF;
+        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
+                fl6.flowi6_oif = np->mcast_oif;
+        else if (!fl6.flowi6_oif)
+                fl6.flowi6_oif = np->ucast_oif;
+        pfh.icmph.type = user_icmph.icmp6_type;
+        pfh.icmph.code = user_icmph.icmp6_code;
+        pfh.icmph.checksum = 0;
+        pfh.icmph.un.echo.id = inet->inet_sport;
+        pfh.icmph.un.echo.sequence = user_icmph.icmp6_sequence;
+        pfh.iov = msg->msg_iov;
+        pfh.wcheck = 0;
+        pfh.family = AF_INET6;
+        if (ipv6_addr_is_multicast(&fl6.daddr))
+                hlimit = np->mcast_hops;
+        else
+                hlimit = np->hop_limit;
+        if (hlimit < 0)
+                hlimit = ip6_dst_hoplimit(dst);
+        lock_sock(sk);
+        err = ip6_append_data(sk, ping_getfrag, &pfh, len,
+                              0, hlimit,
+                              np->tclass, NULL, &fl6, rt,
+                              MSG_DONTWAIT, np->dontfrag);
+        if (err) {
+                ICMP6_INC_STATS_BH(sock_net(sk), rt->rt6i_idev,
+                                   ICMP6_MIB_OUTERRORS);
+                ip6_flush_pending_frames(sk);
+        } else {
+                err = icmpv6_push_pending_frames(sk, &fl6,
+                                                 (struct icmp6hdr *) &pfh.icmph,
+                                                 len);
+        }
+        release_sock(sk);
+        if (err)
+                return err;
+        return len;
+}
+#ifdef CONFIG_PROC_FS
+static void *ping_v6_seq_start(struct seq_file *seq, loff_t *pos)
+{
+        return ping_seq_start(seq, pos, AF_INET6);
+}
+static int ping_v6_seq_show(struct seq_file *seq, void *v)
+{
+        if (v == SEQ_START_TOKEN) {
+                seq_puts(seq, IPV6_SEQ_DGRAM_HEADER);
+        } else {
+                int bucket = ((struct ping_iter_state *) seq->private)->bucket;
+                struct inet_sock *inet = inet_sk(v);
+                __u16 srcp = ntohs(inet->inet_sport);
+                __u16 destp = ntohs(inet->inet_dport);
+                ip6_dgram_sock_seq_show(seq, v, srcp, destp, bucket);
+        }
+        return 0;
+}
+static struct ping_seq_afinfo ping_v6_seq_afinfo = {
+        .name           = "icmp6",
+        .family         = AF_INET6,
+        .seq_fops       = &ping_seq_fops,
+        .seq_ops        = {
+                .start          = ping_v6_seq_start,
+                .show           = ping_v6_seq_show,
+                .next           = ping_seq_next,
+                .stop           = ping_seq_stop,
+        },
+};
+static int __net_init ping_v6_proc_init_net(struct net *net)
+{
+        return ping_proc_register(net, &ping_v6_seq_afinfo);
+}
+static void __net_init ping_v6_proc_exit_net(struct net *net)
+{
+        return ping_proc_unregister(net, &ping_v6_seq_afinfo);
+}
+static struct pernet_operations ping_v6_net_ops = {
+        .init = ping_v6_proc_init_net,
+        .exit = ping_v6_proc_exit_net,
+};
+#endif
+int __init pingv6_init(void)
+{
+#ifdef CONFIG_PROC_FS
+        int ret = register_pernet_subsys(&ping_v6_net_ops);
+        if (ret)
+                return ret;
+#endif
+        pingv6_ops.ipv6_recv_error = ipv6_recv_error;
+        pingv6_ops.ip6_datagram_recv_ctl = ip6_datagram_recv_ctl;
+        pingv6_ops.icmpv6_err_convert = icmpv6_err_convert;
+        pingv6_ops.ipv6_icmp_error = ipv6_icmp_error;
+        pingv6_ops.ipv6_chk_addr = ipv6_chk_addr;
+        return inet6_register_protosw(&pingv6_protosw);
+}
+/* This never gets called because it's not possible to unload the ipv6 module,
+ * but just in case.
+ */
+void pingv6_exit(void)
+{
+        pingv6_ops.ipv6_recv_error = dummy_ipv6_recv_error;
+        pingv6_ops.ip6_datagram_recv_ctl = dummy_ip6_datagram_recv_ctl;
+        pingv6_ops.icmpv6_err_convert = dummy_icmpv6_err_convert;
+        pingv6_ops.ipv6_icmp_error = dummy_ipv6_icmp_error;
+        pingv6_ops.ipv6_chk_addr = dummy_ipv6_chk_addr;
+#ifdef CONFIG_PROC_FS
+        unregister_pernet_subsys(&ping_v6_net_ops);
+#endif
+        inet6_unregister_protosw(&pingv6_protosw);
+}
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index eedff8ccded5..c45f7a5c36e9 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -1132,7 +1132,8 @@ static int rawv6_ioctl(struct sock *sk, int cmd, unsigned long arg)
                spin_lock_bh(&sk->sk_receive_queue.lock);
                skb = skb_peek(&sk->sk_receive_queue);
                if (skb != NULL)
-                        amount = skb->tail - skb->transport_header;
+                        amount = skb_tail_pointer(skb) -
+                                skb_transport_header(skb);
                spin_unlock_bh(&sk->sk_receive_queue.lock);
                return put_user(amount, (int __user *)arg);
        }
@@ -1226,45 +1227,16 @@ struct proto rawv6_prot = {
 };
 #ifdef CONFIG_PROC_FS
-static void raw6_sock_seq_show(struct seq_file *seq, struct sock *sp, int i)
-{
-        struct ipv6_pinfo *np = inet6_sk(sp);
-        const struct in6_addr *dest, *src;
-        __u16 destp, srcp;
-        dest  = &np->daddr;
-        src   = &np->rcv_saddr;
-        destp = 0;
-        srcp  = inet_sk(sp)->inet_num;
-        seq_printf(seq,
-                   "%4d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
-                   i,
-                   src->s6_addr32[0], src->s6_addr32[1],
-                   src->s6_addr32[2], src->s6_addr32[3], srcp,
-                   dest->s6_addr32[0], dest->s6_addr32[1],
-                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
-                   sp->sk_state,
-                   sk_wmem_alloc_get(sp),
-                   sk_rmem_alloc_get(sp),
-                   0, 0L, 0,
-                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
-                   0,
-                   sock_i_ino(sp),
-                   atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
-}
 static int raw6_seq_show(struct seq_file *seq, void *v)
 {
-        if (v == SEQ_START_TOKEN)
+        if (v == SEQ_START_TOKEN) {
-                seq_printf(seq,
+                seq_puts(seq, IPV6_SEQ_DGRAM_HEADER);
-                           "  sl  "
+        } else {
-                           "local_address                         "
+                struct sock *sp = v;
-                           "remote_address                        "
+                __u16 srcp  = inet_sk(sp)->inet_num;
-                           "st tx_queue rx_queue tr tm->when retrnsmt"
+                ip6_dgram_sock_seq_show(seq, v, srcp, 0,
-                           "   uid  timeout inode ref pointer drops\n");
+                                        raw_seq_private(seq)->bucket);
-        else
+        }
-                raw6_sock_seq_show(seq, v, raw_seq_private(seq)->bucket);
        return 0;
 }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index ad0aa6b0b86a..bd5fd7054031 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -83,6 +83,7 @@ static void		ip6_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
                                           struct sk_buff *skb, u32 mtu);
 static void             rt6_do_redirect(struct dst_entry *dst, struct sock *sk,
                                        struct sk_buff *skb);
+static int rt6_score_route(struct rt6_info *rt, int oif, int strict);
 #ifdef CONFIG_IPV6_ROUTE_INFO
 static struct rt6_info *rt6_add_route_info(struct net *net,
@@ -394,7 +395,8 @@ static int rt6_info_hash_nhsfn(unsigned int candidate_count,
 }
 static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
-                                             struct flowi6 *fl6)
+                                             struct flowi6 *fl6, int oif,
+                                             int strict)
 {
        struct rt6_info *sibling, *next_sibling;
        int route_choosen;
@@ -408,6 +410,8 @@ static struct rt6_info *rt6_multipath_select(struct rt6_info *match,
                                &match->rt6i_siblings, rt6i_siblings) {
                        route_choosen--;
                        if (route_choosen == 0) {
+                                if (rt6_score_route(sibling, oif, strict) < 0)
+                                        break;
                                match = sibling;
                                break;
                        }
@@ -547,6 +551,8 @@ static inline bool rt6_check_neigh(struct rt6_info *rt)
                        ret = true;
 #endif
                read_unlock(&neigh->lock);
+        } else if (IS_ENABLED(CONFIG_IPV6_ROUTER_PREF)) {
+                ret = true;
        }
        rcu_read_unlock_bh();
@@ -743,7 +749,7 @@ restart:
        rt = fn->leaf;
        rt = rt6_device_match(net, rt, &fl6->saddr, fl6->flowi6_oif, flags);
        if (rt->rt6i_nsiblings && fl6->flowi6_oif == 0)
-                rt = rt6_multipath_select(rt, fl6);
+                rt = rt6_multipath_select(rt, fl6, fl6->flowi6_oif, flags);
        BACKTRACK(net, &fl6->saddr);
 out:
        dst_use(&rt->dst, jiffies);
@@ -875,8 +881,8 @@ restart_2:
 restart:
        rt = rt6_select(fn, oif, strict | reachable);
-        if (rt->rt6i_nsiblings && oif == 0)
+        if (rt->rt6i_nsiblings)
-                rt = rt6_multipath_select(rt, fl6);
+                rt = rt6_multipath_select(rt, fl6, oif, strict | reachable);
        BACKTRACK(net, &fl6->saddr);
        if (rt == net->ipv6.ip6_null_entry ||
            rt->rt6i_flags & RTF_CACHE)
@@ -1649,7 +1655,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
        int optlen, on_link;
        u8 *lladdr;
-        optlen = skb->tail - skb->transport_header;
+        optlen = skb_tail_pointer(skb) - skb_transport_header(skb);
        optlen -= sizeof(*msg);
        if (optlen < 0) {
@@ -2681,9 +2687,9 @@ errout:
 }
 static int ip6_route_dev_notify(struct notifier_block *this,
-                                unsigned long event, void *data)
+                                unsigned long event, void *ptr)
 {
-        struct net_device *dev = (struct net_device *)data;
+        struct net_device *dev = netdev_notifier_info_to_dev(ptr);
        struct net *net = dev_net(dev);
        if (event == NETDEV_REGISTER && (dev->flags & IFF_LOOPBACK)) {
@@ -2790,7 +2796,7 @@ static const struct file_operations rt6_stats_seq_fops = {
 #ifdef CONFIG_SYSCTL
 static
-int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
+int ipv6_sysctl_rtcache_flush(struct ctl_table *ctl, int write,
                              void __user *buffer, size_t *lenp, loff_t *ppos)
 {
        struct net *net;
@@ -2805,7 +2811,7 @@ int ipv6_sysctl_rtcache_flush(ctl_table *ctl, int write,
        return 0;
 }
-ctl_table ipv6_route_table_template[] = {
+struct ctl_table ipv6_route_table_template[] = {
        {
                .procname       =       "flush",
                .data           =       &init_net.ipv6.sysctl.flush_delay,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 335363478bbf..a3437a4cd07e 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -466,14 +466,14 @@ isatap_chksrc(struct sk_buff *skb, const struct iphdr *iph, struct ip_tunnel *t)
 static void ipip6_tunnel_uninit(struct net_device *dev)
 {
-        struct net *net = dev_net(dev);
+        struct ip_tunnel *tunnel = netdev_priv(dev);
-        struct sit_net *sitn = net_generic(net, sit_net_id);
+        struct sit_net *sitn = net_generic(tunnel->net, sit_net_id);
        if (dev == sitn->fb_tunnel_dev) {
                RCU_INIT_POINTER(sitn->tunnels_wc[0], NULL);
        } else {
-                ipip6_tunnel_unlink(sitn, netdev_priv(dev));
+                ipip6_tunnel_unlink(sitn, tunnel);
-                ipip6_tunnel_del_prl(netdev_priv(dev), NULL);
+                ipip6_tunnel_del_prl(tunnel, NULL);
        }
        dev_put(dev);
 }
@@ -577,6 +577,10 @@ static int ipip6_rcv(struct sk_buff *skb)
        if (tunnel != NULL) {
                struct pcpu_tstats *tstats;
+                if (tunnel->parms.iph.protocol != IPPROTO_IPV6 &&
+                    tunnel->parms.iph.protocol != 0)
+                        goto out;
                secpath_reset(skb);
                skb->mac_header = skb->network_header;
                skb_reset_network_header(skb);
@@ -589,7 +593,7 @@ static int ipip6_rcv(struct sk_buff *skb)
                                tunnel->dev->stats.rx_errors++;
                                goto out;
                        }
-                } else {
+                } else if (!(tunnel->dev->flags&IFF_POINTOPOINT)) {
                        if (is_spoofed_6rd(tunnel, iph->saddr,
                                           &ipv6_hdr(skb)->saddr) ||
                            is_spoofed_6rd(tunnel, iph->daddr,
@@ -617,6 +621,8 @@ static int ipip6_rcv(struct sk_buff *skb)
                tstats->rx_packets++;
                tstats->rx_bytes += skb->len;
+                if (tunnel->net != dev_net(tunnel->dev))
+                        skb_scrub_packet(skb);
                netif_rx(skb);
                return 0;
@@ -629,6 +635,40 @@ out:
        return 0;
 }
+static const struct tnl_ptk_info tpi = {
+        /* no tunnel info required for ipip. */
+        .proto = htons(ETH_P_IP),
+};
+static int ipip_rcv(struct sk_buff *skb)
+{
+        const struct iphdr *iph;
+        struct ip_tunnel *tunnel;
+        if (iptunnel_pull_header(skb, 0, tpi.proto))
+                goto drop;
+        iph = ip_hdr(skb);
+        tunnel = ipip6_tunnel_lookup(dev_net(skb->dev), skb->dev,
+                                     iph->saddr, iph->daddr);
+        if (tunnel != NULL) {
+                if (tunnel->parms.iph.protocol != IPPROTO_IPIP &&
+                    tunnel->parms.iph.protocol != 0)
+                        goto drop;
+                if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+                        goto drop;
+                return ip_tunnel_rcv(tunnel, skb, &tpi, log_ecn_error);
+        }
+        return 1;
+drop:
+        kfree_skb(skb);
+        return 0;
+}
 /*
 * If the IPv6 address comes from 6rd / 6to4 (RFC 3056) addr space this function
 * stores the embedded IPv4 address in v4dst and returns true.
@@ -690,13 +730,14 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
        __be16 df = tiph->frag_off;
        struct rtable *rt;                      /* Route to the other host */
        struct net_device *tdev;                /* Device to other host */
-        struct iphdr  *iph;                     /* Our new IP header */
        unsigned int max_headroom;              /* The extra header space needed */
        __be32 dst = tiph->daddr;
        struct flowi4 fl4;
        int    mtu;
        const struct in6_addr *addr6;
        int addr_type;
+        u8 ttl;
+        int err;
        if (skb->protocol != htons(ETH_P_IPV6))
                goto tx_error;
@@ -764,7 +805,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                        goto tx_error;
        }
-        rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
+        rt = ip_route_output_ports(tunnel->net, &fl4, NULL,
                                   dst, tiph->saddr,
                                   0, 0,
                                   IPPROTO_IPV6, RT_TOS(tos),
@@ -819,6 +860,9 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                        tunnel->err_count = 0;
        }
+        if (tunnel->net != dev_net(dev))
+                skb_scrub_packet(skb);
        /*
         * Okay, now see if we can stuff it in the buffer as-is.
         */
@@ -839,34 +883,14 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                skb = new_skb;
                iph6 = ipv6_hdr(skb);
        }
+        ttl = tiph->ttl;
-        skb->transport_header = skb->network_header;
+        if (ttl == 0)
-        skb_push(skb, sizeof(struct iphdr));
+                ttl = iph6->hop_limit;
-        skb_reset_network_header(skb);
+        tos = INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
-        memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
-        IPCB(skb)->flags = 0;
+        err = iptunnel_xmit(dev_net(dev), rt, skb, fl4.saddr, fl4.daddr,
-        skb_dst_drop(skb);
+                            IPPROTO_IPV6, tos, ttl, df);
-        skb_dst_set(skb, &rt->dst);
+        iptunnel_xmit_stats(err, &dev->stats, dev->tstats);
-        /*
-         *      Push down and install the IPIP header.
-         */
-        iph                     =       ip_hdr(skb);
-        iph->version            =       4;
-        iph->ihl                =       sizeof(struct iphdr)>>2;
-        iph->frag_off           =       df;
-        iph->protocol           =       IPPROTO_IPV6;
-        iph->tos                =       INET_ECN_encapsulate(tos, ipv6_get_dsfield(iph6));
-        iph->daddr              =       fl4.daddr;
-        iph->saddr              =       fl4.saddr;
-        if ((iph->ttl = tiph->ttl) == 0)
-                iph->ttl        =       iph6->hop_limit;
-        skb->ip_summed = CHECKSUM_NONE;
-        ip_select_ident(iph, skb_dst(skb), NULL);
-        iptunnel_xmit(skb, dev);
        return NETDEV_TX_OK;
 tx_error_icmp:
@@ -877,6 +901,43 @@ tx_error:
        return NETDEV_TX_OK;
 }
+static netdev_tx_t ipip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev)
+{
+        struct ip_tunnel *tunnel = netdev_priv(dev);
+        const struct iphdr  *tiph = &tunnel->parms.iph;
+        if (likely(!skb->encapsulation)) {
+                skb_reset_inner_headers(skb);
+                skb->encapsulation = 1;
+        }
+        ip_tunnel_xmit(skb, dev, tiph, IPPROTO_IPIP);
+        return NETDEV_TX_OK;
+}
+static netdev_tx_t sit_tunnel_xmit(struct sk_buff *skb,
+                                   struct net_device *dev)
+{
+        switch (skb->protocol) {
+        case htons(ETH_P_IP):
+                ipip_tunnel_xmit(skb, dev);
+                break;
+        case htons(ETH_P_IPV6):
+                ipip6_tunnel_xmit(skb, dev);
+                break;
+        default:
+                goto tx_err;
+        }
+        return NETDEV_TX_OK;
+tx_err:
+        dev->stats.tx_errors++;
+        dev_kfree_skb(skb);
+        return NETDEV_TX_OK;
+}
 static void ipip6_tunnel_bind_dev(struct net_device *dev)
 {
        struct net_device *tdev = NULL;
@@ -888,7 +949,8 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
        iph = &tunnel->parms.iph;
        if (iph->daddr) {
-                struct rtable *rt = ip_route_output_ports(dev_net(dev), &fl4, NULL,
+                struct rtable *rt = ip_route_output_ports(tunnel->net, &fl4,
+                                                          NULL,
                                                          iph->daddr, iph->saddr,
                                                          0, 0,
                                                          IPPROTO_IPV6,
@@ -903,7 +965,7 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
        }
        if (!tdev && tunnel->parms.link)
-                tdev = __dev_get_by_index(dev_net(dev), tunnel->parms.link);
+                tdev = __dev_get_by_index(tunnel->net, tunnel->parms.link);
        if (tdev) {
                dev->hard_header_len = tdev->hard_header_len + sizeof(struct iphdr);
@@ -916,7 +978,7 @@ static void ipip6_tunnel_bind_dev(struct net_device *dev)
 static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p)
 {
-        struct net *net = dev_net(t->dev);
+        struct net *net = t->net;
        struct sit_net *sitn = net_generic(net, sit_net_id);
        ipip6_tunnel_unlink(sitn, t);
@@ -1027,7 +1089,11 @@ ipip6_tunnel_ioctl (struct net_device *dev, struct ifreq *ifr, int cmd)
                        goto done;
                err = -EINVAL;
-                if (p.iph.version != 4 || p.iph.protocol != IPPROTO_IPV6 ||
+                if (p.iph.protocol != IPPROTO_IPV6 &&
+                    p.iph.protocol != IPPROTO_IPIP &&
+                    p.iph.protocol != 0)
+                        goto done;
+                if (p.iph.version != 4 ||
                    p.iph.ihl != 5 || (p.iph.frag_off&htons(~IP_DF)))
                        goto done;
                if (p.iph.ttl)
@@ -1164,7 +1230,7 @@ static int ipip6_tunnel_change_mtu(struct net_device *dev, int new_mtu)
 static const struct net_device_ops ipip6_netdev_ops = {
        .ndo_uninit     = ipip6_tunnel_uninit,
-        .ndo_start_xmit = ipip6_tunnel_xmit,
+        .ndo_start_xmit = sit_tunnel_xmit,
        .ndo_do_ioctl   = ipip6_tunnel_ioctl,
        .ndo_change_mtu = ipip6_tunnel_change_mtu,
        .ndo_get_stats64 = ip_tunnel_get_stats64,
@@ -1188,7 +1254,6 @@ static void ipip6_tunnel_setup(struct net_device *dev)
        dev->priv_flags        &= ~IFF_XMIT_DST_RELEASE;
        dev->iflink             = 0;
        dev->addr_len           = 4;
-        dev->features           |= NETIF_F_NETNS_LOCAL;
        dev->features           |= NETIF_F_LLTX;
 }
@@ -1197,6 +1262,7 @@ static int ipip6_tunnel_init(struct net_device *dev)
        struct ip_tunnel *tunnel = netdev_priv(dev);
        tunnel->dev = dev;
+        tunnel->net = dev_net(dev);
        memcpy(dev->dev_addr, &tunnel->parms.iph.saddr, 4);
        memcpy(dev->broadcast, &tunnel->parms.iph.daddr, 4);
@@ -1217,6 +1283,7 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
        struct sit_net *sitn = net_generic(net, sit_net_id);
        tunnel->dev = dev;
+        tunnel->net = dev_net(dev);
        strcpy(tunnel->parms.name, dev->name);
        iph->version            = 4;
@@ -1232,6 +1299,22 @@ static int __net_init ipip6_fb_tunnel_init(struct net_device *dev)
        return 0;
 }
+static int ipip6_validate(struct nlattr *tb[], struct nlattr *data[])
+{
+        u8 proto;
+        if (!data || !data[IFLA_IPTUN_PROTO])
+                return 0;
+        proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
+        if (proto != IPPROTO_IPV6 &&
+            proto != IPPROTO_IPIP &&
+            proto != 0)
+                return -EINVAL;
+        return 0;
+}
 static void ipip6_netlink_parms(struct nlattr *data[],
                                struct ip_tunnel_parm *parms)
 {
@@ -1268,6 +1351,10 @@ static void ipip6_netlink_parms(struct nlattr *data[],
        if (data[IFLA_IPTUN_FLAGS])
                parms->i_flags = nla_get_be16(data[IFLA_IPTUN_FLAGS]);
+        if (data[IFLA_IPTUN_PROTO])
+                parms->iph.protocol = nla_get_u8(data[IFLA_IPTUN_PROTO]);
 }
 #ifdef CONFIG_IPV6_SIT_6RD
@@ -1339,9 +1426,9 @@ static int ipip6_newlink(struct net *src_net, struct net_device *dev,
 static int ipip6_changelink(struct net_device *dev, struct nlattr *tb[],
                          struct nlattr *data[])
 {
-        struct ip_tunnel *t;
+        struct ip_tunnel *t = netdev_priv(dev);
        struct ip_tunnel_parm p;
-        struct net *net = dev_net(dev);
+        struct net *net = t->net;
        struct sit_net *sitn = net_generic(net, sit_net_id);
 #ifdef CONFIG_IPV6_SIT_6RD
        struct ip_tunnel_6rd ip6rd;
@@ -1391,6 +1478,8 @@ static size_t ipip6_get_size(const struct net_device *dev)
                nla_total_size(1) +
                /* IFLA_IPTUN_FLAGS */
                nla_total_size(2) +
+                /* IFLA_IPTUN_PROTO */
+                nla_total_size(1) +
 #ifdef CONFIG_IPV6_SIT_6RD
                /* IFLA_IPTUN_6RD_PREFIX */
                nla_total_size(sizeof(struct in6_addr)) +
@@ -1416,6 +1505,7 @@ static int ipip6_fill_info(struct sk_buff *skb, const struct net_device *dev)
            nla_put_u8(skb, IFLA_IPTUN_TOS, parm->iph.tos) ||
            nla_put_u8(skb, IFLA_IPTUN_PMTUDISC,
                       !!(parm->iph.frag_off & htons(IP_DF))) ||
+            nla_put_u8(skb, IFLA_IPTUN_PROTO, parm->iph.protocol) ||
            nla_put_be16(skb, IFLA_IPTUN_FLAGS, parm->i_flags))
                goto nla_put_failure;
@@ -1445,6 +1535,7 @@ static const struct nla_policy ipip6_policy[IFLA_IPTUN_MAX + 1] = {
        [IFLA_IPTUN_TOS]                = { .type = NLA_U8 },
        [IFLA_IPTUN_PMTUDISC]           = { .type = NLA_U8 },
        [IFLA_IPTUN_FLAGS]              = { .type = NLA_U16 },
+        [IFLA_IPTUN_PROTO]              = { .type = NLA_U8 },
 #ifdef CONFIG_IPV6_SIT_6RD
        [IFLA_IPTUN_6RD_PREFIX]         = { .len = sizeof(struct in6_addr) },
        [IFLA_IPTUN_6RD_RELAY_PREFIX]   = { .type = NLA_U32 },
@@ -1459,6 +1550,7 @@ static struct rtnl_link_ops sit_link_ops __read_mostly = {
        .policy         = ipip6_policy,
        .priv_size      = sizeof(struct ip_tunnel),
        .setup          = ipip6_tunnel_setup,
+        .validate       = ipip6_validate,
        .newlink        = ipip6_newlink,
        .changelink     = ipip6_changelink,
        .get_size       = ipip6_get_size,
@@ -1471,10 +1563,22 @@ static struct xfrm_tunnel sit_handler __read_mostly = {
        .priority       =       1,
 };
+static struct xfrm_tunnel ipip_handler __read_mostly = {
+        .handler        =       ipip_rcv,
+        .err_handler    =       ipip6_err,
+        .priority       =       2,
+};
 static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_head *head)
 {
+        struct net *net = dev_net(sitn->fb_tunnel_dev);
+        struct net_device *dev, *aux;
        int prio;
+        for_each_netdev_safe(net, dev, aux)
+                if (dev->rtnl_link_ops == &sit_link_ops)
+                        unregister_netdevice_queue(dev, head);
        for (prio = 1; prio < 4; prio++) {
                int h;
                for (h = 0; h < HASH_SIZE; h++) {
@@ -1482,7 +1586,12 @@ static void __net_exit sit_destroy_tunnels(struct sit_net *sitn, struct list_hea
                        t = rtnl_dereference(sitn->tunnels[prio][h]);
                        while (t != NULL) {
-                                unregister_netdevice_queue(t->dev, head);
+                                /* If dev is in the same netns, it has already
+                                 * been added to the list by the previous loop.
+                                 */
+                                if (dev_net(t->dev) != net)
+                                        unregister_netdevice_queue(t->dev,
+                                                                   head);
                                t = rtnl_dereference(t->next);
                        }
                }
@@ -1507,6 +1616,10 @@ static int __net_init sit_init_net(struct net *net)
                goto err_alloc_dev;
        }
        dev_net_set(sitn->fb_tunnel_dev, net);
+        /* FB netdevice is special: we have one, and only one per netns.
+         * Allowing to move it to another netns is clearly unsafe.
+         */
+        sitn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
        err = ipip6_fb_tunnel_init(sitn->fb_tunnel_dev);
        if (err)
@@ -1553,6 +1666,7 @@ static void __exit sit_cleanup(void)
 {
        rtnl_link_unregister(&sit_link_ops);
        xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
+        xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
        unregister_pernet_device(&sit_net_ops);
        rcu_barrier(); /* Wait for completion of call_rcu()'s */
@@ -1569,9 +1683,14 @@ static int __init sit_init(void)
                return err;
        err = xfrm4_tunnel_register(&sit_handler, AF_INET6);
        if (err < 0) {
-                pr_info("%s: can't add protocol\n", __func__);
+                pr_info("%s: can't register ip6ip4\n", __func__);
                goto xfrm_tunnel_failed;
        }
+        err = xfrm4_tunnel_register(&ipip_handler, AF_INET);
+        if (err < 0) {
+                pr_info("%s: can't register ip4ip4\n", __func__);
+                goto xfrm_tunnel4_failed;
+        }
        err = rtnl_link_register(&sit_link_ops);
        if (err < 0)
                goto rtnl_link_failed;
@@ -1580,6 +1699,8 @@ out:
        return err;
 rtnl_link_failed:
+        xfrm4_tunnel_deregister(&ipip_handler, AF_INET);
+xfrm_tunnel4_failed:
        xfrm4_tunnel_deregister(&sit_handler, AF_INET6);
 xfrm_tunnel_failed:
        unregister_pernet_device(&sit_net_ops);
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index e85c48bd404f..107b2f1d90ae 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -16,7 +16,7 @@
 #include <net/addrconf.h>
 #include <net/inet_frag.h>
-static ctl_table ipv6_table_template[] = {
+static struct ctl_table ipv6_table_template[] = {
        {
                .procname       = "bindv6only",
                .data           = &init_net.ipv6.sysctl.bindv6only,
@@ -27,7 +27,7 @@ static ctl_table ipv6_table_template[] = {
        { }
 };
-static ctl_table ipv6_rotable[] = {
+static struct ctl_table ipv6_rotable[] = {
        {
                .procname       = "mld_max_msf",
                .data           = &sysctl_mld_max_msf,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 0a17ed9eaf39..5cffa5c3e6b8 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -63,6 +63,7 @@
 #include <net/inet_common.h>
 #include <net/secure_seq.h>
 #include <net/tcp_memcontrol.h>
+#include <net/ll_poll.h>
 #include <asm/uaccess.h>
@@ -1498,6 +1499,7 @@ process:
        if (sk_filter(sk, skb))
                goto discard_and_relse;
+        sk_mark_ll(sk, skb);
        skb->dev = NULL;
        bh_lock_sock_nested(sk);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 42923b14dfa6..b6f31437a1f8 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -46,6 +46,7 @@
 #include <net/ip6_checksum.h>
 #include <net/xfrm.h>
 #include <net/inet6_hashtables.h>
+#include <net/ll_poll.h>
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
@@ -841,7 +842,10 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         */
        sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
        if (sk != NULL) {
-                int ret = udpv6_queue_rcv_skb(sk, skb);
+                int ret;
+                sk_mark_ll(sk, skb);
+                ret = udpv6_queue_rcv_skb(sk, skb);
                sock_put(sk);
                /* a return value > 0 means to resubmit the input, but
@@ -955,11 +959,16 @@ static int udp_v6_push_pending_frames(struct sock *sk)
        struct udphdr *uh;
        struct udp_sock  *up = udp_sk(sk);
        struct inet_sock *inet = inet_sk(sk);
-        struct flowi6 *fl6 = &inet->cork.fl.u.ip6;
+        struct flowi6 *fl6;
        int err = 0;
        int is_udplite = IS_UDPLITE(sk);
        __wsum csum = 0;
+        if (up->pending == AF_INET)
+                return udp_push_pending_frames(sk);
+        fl6 = &inet->cork.fl.u.ip6;
        /* Grab the skbuff where UDP header space exists. */
        if ((skb = skb_peek(&sk->sk_write_queue)) == NULL)
                goto out;
@@ -1359,48 +1368,17 @@ static const struct inet6_protocol udpv6_protocol = {
 /* ------------------------------------------------------------------------ */
 #ifdef CONFIG_PROC_FS
-static void udp6_sock_seq_show(struct seq_file *seq, struct sock *sp, int bucket)
-{
-        struct inet_sock *inet = inet_sk(sp);
-        struct ipv6_pinfo *np = inet6_sk(sp);
-        const struct in6_addr *dest, *src;
-        __u16 destp, srcp;
-        dest  = &np->daddr;
-        src   = &np->rcv_saddr;
-        destp = ntohs(inet->inet_dport);
-        srcp  = ntohs(inet->inet_sport);
-        seq_printf(seq,
-                   "%5d: %08X%08X%08X%08X:%04X %08X%08X%08X%08X:%04X "
-                   "%02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %pK %d\n",
-                   bucket,
-                   src->s6_addr32[0], src->s6_addr32[1],
-                   src->s6_addr32[2], src->s6_addr32[3], srcp,
-                   dest->s6_addr32[0], dest->s6_addr32[1],
-                   dest->s6_addr32[2], dest->s6_addr32[3], destp,
-                   sp->sk_state,
-                   sk_wmem_alloc_get(sp),
-                   sk_rmem_alloc_get(sp),
-                   0, 0L, 0,
-                   from_kuid_munged(seq_user_ns(seq), sock_i_uid(sp)),
-                   0,
-                   sock_i_ino(sp),
-                   atomic_read(&sp->sk_refcnt), sp,
-                   atomic_read(&sp->sk_drops));
-}
 int udp6_seq_show(struct seq_file *seq, void *v)
 {
-        if (v == SEQ_START_TOKEN)
+        if (v == SEQ_START_TOKEN) {
-                seq_printf(seq,
+                seq_puts(seq, IPV6_SEQ_DGRAM_HEADER);
-                           "  sl  "
+        } else {
-                           "local_address                         "
+                int bucket = ((struct udp_iter_state *)seq->private)->bucket;
-                           "remote_address                        "
+                struct inet_sock *inet = inet_sk(v);
-                           "st tx_queue rx_queue tr tm->when retrnsmt"
+                __u16 srcp = ntohs(inet->inet_sport);
-                           "   uid  timeout inode ref pointer drops\n");
+                __u16 destp = ntohs(inet->inet_dport);
-        else
+                ip6_dgram_sock_seq_show(seq, v, srcp, destp, bucket);
-                udp6_sock_seq_show(seq, v, ((struct udp_iter_state *)seq->private)->bucket);
+        }
        return 0;
 }
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index d3cfaf9c7a08..5d1b8d7ac993 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -64,7 +64,8 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                if (unlikely(type & ~(SKB_GSO_UDP |
                                      SKB_GSO_DODGY |
                                      SKB_GSO_UDP_TUNNEL |
-                                      SKB_GSO_GRE) ||
+                                      SKB_GSO_GRE |
+                                      SKB_GSO_MPLS) ||
                             !(type & (SKB_GSO_UDP))))
                        goto out;