29 files changed, 291 insertions, 290 deletions
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 6c7fa0853fc7..5667b3003af9 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -275,19 +275,14 @@ static int snmp6_alloc_dev(struct inet6_dev *idev)
 {
        int i;
-        if (snmp_mib_init((void __percpu **)idev->stats.ipv6,
+        idev->stats.ipv6 = alloc_percpu(struct ipstats_mib);
-                          sizeof(struct ipstats_mib),
+        if (!idev->stats.ipv6)
-                          __alignof__(struct ipstats_mib)) < 0)
                goto err_ip;
        for_each_possible_cpu(i) {
                struct ipstats_mib *addrconf_stats;
-                addrconf_stats = per_cpu_ptr(idev->stats.ipv6[0], i);
+                addrconf_stats = per_cpu_ptr(idev->stats.ipv6, i);
                u64_stats_init(&addrconf_stats->syncp);
-#if SNMP_ARRAY_SZ == 2
-                addrconf_stats = per_cpu_ptr(idev->stats.ipv6[1], i);
-                u64_stats_init(&addrconf_stats->syncp);
-#endif
        }
@@ -305,7 +300,7 @@ static int snmp6_alloc_dev(struct inet6_dev *idev)
 err_icmpmsg:
        kfree(idev->stats.icmpv6dev);
 err_icmp:
-        snmp_mib_free((void __percpu **)idev->stats.ipv6);
+        free_percpu(idev->stats.ipv6);
 err_ip:
        return -ENOMEM;
 }
@@ -2504,8 +2499,8 @@ static int inet6_addr_add(struct net *net, int ifindex,
        return PTR_ERR(ifp);
 }
-static int inet6_addr_del(struct net *net, int ifindex, const struct in6_addr *pfx,
+static int inet6_addr_del(struct net *net, int ifindex, u32 ifa_flags,
-                          unsigned int plen)
+                          const struct in6_addr *pfx, unsigned int plen)
 {
        struct inet6_ifaddr *ifp;
        struct inet6_dev *idev;
@@ -2528,7 +2523,12 @@ static int inet6_addr_del(struct net *net, int ifindex, const struct in6_addr *p
                        in6_ifa_hold(ifp);
                        read_unlock_bh(&idev->lock);
+                        if (!(ifp->flags & IFA_F_TEMPORARY) &&
+                            (ifa_flags & IFA_F_MANAGETEMPADDR))
+                                manage_tempaddrs(idev, ifp, 0, 0, false,
+                                                 jiffies);
                        ipv6_del_addr(ifp);
+                        addrconf_verify_rtnl();
                        return 0;
                }
        }
@@ -2568,7 +2568,7 @@ int addrconf_del_ifaddr(struct net *net, void __user *arg)
                return -EFAULT;
        rtnl_lock();
-        err = inet6_addr_del(net, ireq.ifr6_ifindex, &ireq.ifr6_addr,
+        err = inet6_addr_del(net, ireq.ifr6_ifindex, 0, &ireq.ifr6_addr,
                             ireq.ifr6_prefixlen);
        rtnl_unlock();
        return err;
@@ -2813,18 +2813,6 @@ static void addrconf_gre_config(struct net_device *dev)
 }
 #endif
-static inline int
-ipv6_inherit_linklocal(struct inet6_dev *idev, struct net_device *link_dev)
-{
-        struct in6_addr lladdr;
-        if (!ipv6_get_lladdr(link_dev, &lladdr, IFA_F_TENTATIVE)) {
-                addrconf_add_linklocal(idev, &lladdr);
-                return 0;
-        }
-        return -1;
-}
 static int addrconf_notify(struct notifier_block *this, unsigned long event,
                           void *ptr)
 {
@@ -3743,6 +3731,7 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
        struct ifaddrmsg *ifm;
        struct nlattr *tb[IFA_MAX+1];
        struct in6_addr *pfx, *peer_pfx;
+        u32 ifa_flags;
        int err;
        err = nlmsg_parse(nlh, sizeof(*ifm), tb, IFA_MAX, ifa_ipv6_policy);
@@ -3754,7 +3743,13 @@ inet6_rtm_deladdr(struct sk_buff *skb, struct nlmsghdr *nlh)
        if (pfx == NULL)
                return -EINVAL;
-        return inet6_addr_del(net, ifm->ifa_index, pfx, ifm->ifa_prefixlen);
+        ifa_flags = tb[IFA_FLAGS] ? nla_get_u32(tb[IFA_FLAGS]) : ifm->ifa_flags;
+        /* We ignore other flags so far. */
+        ifa_flags &= IFA_F_MANAGETEMPADDR;
+        return inet6_addr_del(net, ifm->ifa_index, ifa_flags, pfx,
+                              ifm->ifa_prefixlen);
 }
 static int inet6_addr_modify(struct inet6_ifaddr *ifp, u32 ifa_flags,
@@ -4363,7 +4358,7 @@ static inline void __snmp6_fill_statsdev(u64 *stats, atomic_long_t *mib,
        memset(&stats[items], 0, pad);
 }
-static inline void __snmp6_fill_stats64(u64 *stats, void __percpu **mib,
+static inline void __snmp6_fill_stats64(u64 *stats, void __percpu *mib,
                                      int items, int bytes, size_t syncpoff)
 {
        int i;
@@ -4383,7 +4378,7 @@ static void snmp6_fill_stats(u64 *stats, struct inet6_dev *idev, int attrtype,
 {
        switch (attrtype) {
        case IFLA_INET6_STATS:
-                __snmp6_fill_stats64(stats, (void __percpu **)idev->stats.ipv6,
+                __snmp6_fill_stats64(stats, idev->stats.ipv6,
                                     IPSTATS_MIB_MAX, bytes, offsetof(struct ipstats_mib, syncp));
                break;
        case IFLA_INET6_ICMP6STATS:
diff --git a/net/ipv6/addrconf_core.c b/net/ipv6/addrconf_core.c
index 4c11cbcf8308..e6960457f625 100644
--- a/net/ipv6/addrconf_core.c
+++ b/net/ipv6/addrconf_core.c
@@ -123,7 +123,7 @@ static void snmp6_free_dev(struct inet6_dev *idev)
 {
        kfree(idev->stats.icmpv6msgdev);
        kfree(idev->stats.icmpv6dev);
-        snmp_mib_free((void __percpu **)idev->stats.ipv6);
+        free_percpu(idev->stats.ipv6);
 }
 /* Nobody refers to this device, we may destroy it. */
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index d935889f1008..7cb4392690dd 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -106,7 +106,6 @@ static int inet6_create(struct net *net, struct socket *sock, int protocol,
        struct inet_protosw *answer;
        struct proto *answer_prot;
        unsigned char answer_flags;
-        char answer_no_check;
        int try_loading_module = 0;
        int err;
@@ -162,7 +161,6 @@ lookup_protocol:
        sock->ops = answer->ops;
        answer_prot = answer->prot;
-        answer_no_check = answer->no_check;
        answer_flags = answer->flags;
        rcu_read_unlock();
@@ -176,7 +174,6 @@ lookup_protocol:
        sock_init_data(sock, sk);
        err = 0;
-        sk->sk_no_check = answer_no_check;
        if (INET_PROTOSW_REUSE & answer_flags)
                sk->sk_reuse = SK_CAN_REUSE;
@@ -715,33 +712,25 @@ static int __net_init ipv6_init_mibs(struct net *net)
 {
        int i;
-        if (snmp_mib_init((void __percpu **)net->mib.udp_stats_in6,
+        net->mib.udp_stats_in6 = alloc_percpu(struct udp_mib);
-                          sizeof(struct udp_mib),
+        if (!net->mib.udp_stats_in6)
-                          __alignof__(struct udp_mib)) < 0)
                return -ENOMEM;
-        if (snmp_mib_init((void __percpu **)net->mib.udplite_stats_in6,
+        net->mib.udplite_stats_in6 = alloc_percpu(struct udp_mib);
-                          sizeof(struct udp_mib),
+        if (!net->mib.udplite_stats_in6)
-                          __alignof__(struct udp_mib)) < 0)
                goto err_udplite_mib;
-        if (snmp_mib_init((void __percpu **)net->mib.ipv6_statistics,
+        net->mib.ipv6_statistics = alloc_percpu(struct ipstats_mib);
-                          sizeof(struct ipstats_mib),
+        if (!net->mib.ipv6_statistics)
-                          __alignof__(struct ipstats_mib)) < 0)
                goto err_ip_mib;
        for_each_possible_cpu(i) {
                struct ipstats_mib *af_inet6_stats;
-                af_inet6_stats = per_cpu_ptr(net->mib.ipv6_statistics[0], i);
+                af_inet6_stats = per_cpu_ptr(net->mib.ipv6_statistics, i);
                u64_stats_init(&af_inet6_stats->syncp);
-#if SNMP_ARRAY_SZ == 2
-                af_inet6_stats = per_cpu_ptr(net->mib.ipv6_statistics[1], i);
-                u64_stats_init(&af_inet6_stats->syncp);
-#endif
        }
-        if (snmp_mib_init((void __percpu **)net->mib.icmpv6_statistics,
+        net->mib.icmpv6_statistics = alloc_percpu(struct icmpv6_mib);
-                          sizeof(struct icmpv6_mib),
+        if (!net->mib.icmpv6_statistics)
-                          __alignof__(struct icmpv6_mib)) < 0)
                goto err_icmp_mib;
        net->mib.icmpv6msg_statistics = kzalloc(sizeof(struct icmpv6msg_mib),
                                                GFP_KERNEL);
@@ -750,22 +739,22 @@ static int __net_init ipv6_init_mibs(struct net *net)
        return 0;
 err_icmpmsg_mib:
-        snmp_mib_free((void __percpu **)net->mib.icmpv6_statistics);
+        free_percpu(net->mib.icmpv6_statistics);
 err_icmp_mib:
-        snmp_mib_free((void __percpu **)net->mib.ipv6_statistics);
+        free_percpu(net->mib.ipv6_statistics);
 err_ip_mib:
-        snmp_mib_free((void __percpu **)net->mib.udplite_stats_in6);
+        free_percpu(net->mib.udplite_stats_in6);
 err_udplite_mib:
-        snmp_mib_free((void __percpu **)net->mib.udp_stats_in6);
+        free_percpu(net->mib.udp_stats_in6);
        return -ENOMEM;
 }
 static void ipv6_cleanup_mibs(struct net *net)
 {
-        snmp_mib_free((void __percpu **)net->mib.udp_stats_in6);
+        free_percpu(net->mib.udp_stats_in6);
-        snmp_mib_free((void __percpu **)net->mib.udplite_stats_in6);
+        free_percpu(net->mib.udplite_stats_in6);
-        snmp_mib_free((void __percpu **)net->mib.ipv6_statistics);
+        free_percpu(net->mib.ipv6_statistics);
-        snmp_mib_free((void __percpu **)net->mib.icmpv6_statistics);
+        free_percpu(net->mib.icmpv6_statistics);
        kfree(net->mib.icmpv6msg_statistics);
 }
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 7b326529e6a2..f6c84a6eb238 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -400,6 +400,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        int len;
        int hlimit;
        int err = 0;
+        u32 mark = IP6_REPLY_MARK(net, skb->mark);
        if ((u8 *)hdr < skb->head ||
            (skb_network_header(skb) + sizeof(*hdr)) > skb_tail_pointer(skb))
@@ -466,6 +467,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        fl6.daddr = hdr->saddr;
        if (saddr)
                fl6.saddr = *saddr;
+        fl6.flowi6_mark = mark;
        fl6.flowi6_oif = iif;
        fl6.fl6_icmp_type = type;
        fl6.fl6_icmp_code = code;
@@ -474,6 +476,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        sk = icmpv6_xmit_lock(net);
        if (sk == NULL)
                return;
+        sk->sk_mark = mark;
        np = inet6_sk(sk);
        if (!icmpv6_xrlim_allow(sk, type, &fl6))
@@ -493,12 +496,7 @@ static void icmp6_send(struct sk_buff *skb, u8 type, u8 code, __u32 info)
        if (IS_ERR(dst))
                goto out;
-        if (ipv6_addr_is_multicast(&fl6.daddr))
+        hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
-                hlimit = np->mcast_hops;
-        else
-                hlimit = np->hop_limit;
-        if (hlimit < 0)
-                hlimit = ip6_dst_hoplimit(dst);
        msg.skb = skb;
        msg.offset = skb_network_offset(skb);
@@ -556,6 +554,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        int err = 0;
        int hlimit;
        u8 tclass;
+        u32 mark = IP6_REPLY_MARK(net, skb->mark);
        saddr = &ipv6_hdr(skb)->daddr;
@@ -574,11 +573,13 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
                fl6.saddr = *saddr;
        fl6.flowi6_oif = skb->dev->ifindex;
        fl6.fl6_icmp_type = ICMPV6_ECHO_REPLY;
+        fl6.flowi6_mark = mark;
        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
        sk = icmpv6_xmit_lock(net);
        if (sk == NULL)
                return;
+        sk->sk_mark = mark;
        np = inet6_sk(sk);
        if (!fl6.flowi6_oif && ipv6_addr_is_multicast(&fl6.daddr))
@@ -593,12 +594,7 @@ static void icmpv6_echo_reply(struct sk_buff *skb)
        if (IS_ERR(dst))
                goto out;
-        if (ipv6_addr_is_multicast(&fl6.daddr))
+        hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
-                hlimit = np->mcast_hops;
-        else
-                hlimit = np->hop_limit;
-        if (hlimit < 0)
-                hlimit = ip6_dst_hoplimit(dst);
        idev = __in6_dev_get(skb->dev);
@@ -702,22 +698,11 @@ static int icmpv6_rcv(struct sk_buff *skb)
        saddr = &ipv6_hdr(skb)->saddr;
        daddr = &ipv6_hdr(skb)->daddr;
-        /* Perform checksum. */
+        if (skb_checksum_validate(skb, IPPROTO_ICMPV6, ip6_compute_pseudo)) {
-        switch (skb->ip_summed) {
+                LIMIT_NETDEBUG(KERN_DEBUG
-        case CHECKSUM_COMPLETE:
+                               "ICMPv6 checksum failed [%pI6c > %pI6c]\n",
-                if (!csum_ipv6_magic(saddr, daddr, skb->len, IPPROTO_ICMPV6,
+                               saddr, daddr);
-                                     skb->csum))
+                goto csum_error;
-                        break;
-                /* fall through */
-        case CHECKSUM_NONE:
-                skb->csum = ~csum_unfold(csum_ipv6_magic(saddr, daddr, skb->len,
-                                             IPPROTO_ICMPV6, 0));
-                if (__skb_checksum_complete(skb)) {
-                        LIMIT_NETDEBUG(KERN_DEBUG
-                                       "ICMPv6 checksum failed [%pI6c > %pI6c]\n",
-                                       saddr, daddr);
-                        goto csum_error;
-                }
        }
        if (!pskb_pull(skb, sizeof(*hdr)))
diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index d4ade34ab375..a245e5ddffbd 100644
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -81,7 +81,7 @@ struct dst_entry *inet6_csk_route_req(struct sock *sk,
        final_p = fl6_update_dst(fl6, np->opt, &final);
        fl6->saddr = ireq->ir_v6_loc_addr;
        fl6->flowi6_oif = ireq->ir_iif;
-        fl6->flowi6_mark = sk->sk_mark;
+        fl6->flowi6_mark = ireq->ir_mark;
        fl6->fl6_dport = ireq->ir_rmt_port;
        fl6->fl6_sport = htons(ireq->ir_num);
        security_req_classify_flow(req, flowi6_to_flowi(fl6));
diff --git a/net/ipv6/ip6_checksum.c b/net/ipv6/ip6_checksum.c
index ee7a97f510cb..9a4d7322fb22 100644
--- a/net/ipv6/ip6_checksum.c
+++ b/net/ipv6/ip6_checksum.c
@@ -75,25 +75,50 @@ int udp6_csum_init(struct sk_buff *skb, struct udphdr *uh, int proto)
                        return err;
        }
-        if (uh->check == 0) {
+        /* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels)
-                /* RFC 2460 section 8.1 says that we SHOULD log
+         * we accept a checksum of zero here. When we find the socket
-                   this error. Well, it is reasonable.
+         * for the UDP packet we'll check if that socket allows zero checksum
-                 */
+         * for IPv6 (set by socket option).
-                LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0 for [%pI6c]:%u->[%pI6c]:%u\n",
+         */
-                               &ipv6_hdr(skb)->saddr, ntohs(uh->source),
+        return skb_checksum_init_zero_check(skb, proto, uh->check,
-                               &ipv6_hdr(skb)->daddr, ntohs(uh->dest));
+                                           ip6_compute_pseudo);
-                return 1;
+}
-        }
+EXPORT_SYMBOL(udp6_csum_init);
-        if (skb->ip_summed == CHECKSUM_COMPLETE &&
-            !csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
+/* Function to set UDP checksum for an IPv6 UDP packet. This is intended
-                             skb->len, proto, skb->csum))
+ * for the simple case like when setting the checksum for a UDP tunnel.
-                skb->ip_summed = CHECKSUM_UNNECESSARY;
+ */
+void udp6_set_csum(bool nocheck, struct sk_buff *skb,
+                   const struct in6_addr *saddr,
+                   const struct in6_addr *daddr, int len)
+{
+        struct udphdr *uh = udp_hdr(skb);
+        if (nocheck)
+                uh->check = 0;
+        else if (skb_is_gso(skb))
+                uh->check = ~udp_v6_check(len, saddr, daddr, 0);
+        else if (skb_dst(skb) && skb_dst(skb)->dev &&
+                 (skb_dst(skb)->dev->features & NETIF_F_IPV6_CSUM)) {
-        if (!skb_csum_unnecessary(skb))
+                BUG_ON(skb->ip_summed == CHECKSUM_PARTIAL);
-                skb->csum = ~csum_unfold(csum_ipv6_magic(&ipv6_hdr(skb)->saddr,
-                                                         &ipv6_hdr(skb)->daddr,
-                                                         skb->len, proto, 0));
-        return 0;
+                skb->ip_summed = CHECKSUM_PARTIAL;
+                skb->csum_start = skb_transport_header(skb) - skb->head;
+                skb->csum_offset = offsetof(struct udphdr, check);
+                uh->check = ~udp_v6_check(len, saddr, daddr, 0);
+        } else {
+                __wsum csum;
+                BUG_ON(skb->ip_summed == CHECKSUM_PARTIAL);
+                uh->check = 0;
+                csum = skb_checksum(skb, 0, len, 0);
+                uh->check = udp_v6_check(len, saddr, daddr, csum);
+                if (uh->check == 0)
+                        uh->check = CSUM_MANGLED_0;
+                skb->ip_summed = CHECKSUM_UNNECESSARY;
+        }
 }
-EXPORT_SYMBOL(udp6_csum_init);
+EXPORT_SYMBOL(udp6_set_csum);
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 87891f5f57b5..cb4459bd1d29 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -71,8 +71,7 @@ static DEFINE_RWLOCK(fib6_walker_lock);
 #define FWS_INIT FWS_L
 #endif
-static void fib6_prune_clones(struct net *net, struct fib6_node *fn,
+static void fib6_prune_clones(struct net *net, struct fib6_node *fn);
-                              struct rt6_info *rt);
 static struct rt6_info *fib6_find_prefix(struct net *net, struct fib6_node *fn);
 static struct fib6_node *fib6_repair_tree(struct net *net, struct fib6_node *fn);
 static int fib6_walk(struct fib6_walker_t *w);
@@ -941,7 +940,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt, struct nl_info *info,
        if (!err) {
                fib6_start_gc(info->nl_net, rt);
                if (!(rt->rt6i_flags & RTF_CACHE))
-                        fib6_prune_clones(info->nl_net, pn, rt);
+                        fib6_prune_clones(info->nl_net, pn);
        }
 out:
@@ -1375,7 +1374,7 @@ int fib6_del(struct rt6_info *rt, struct nl_info *info)
                        pn = pn->parent;
                }
 #endif
-                fib6_prune_clones(info->nl_net, pn, rt);
+                fib6_prune_clones(info->nl_net, pn);
        }
        /*
@@ -1601,10 +1600,9 @@ static int fib6_prune_clone(struct rt6_info *rt, void *arg)
        return 0;
 }
-static void fib6_prune_clones(struct net *net, struct fib6_node *fn,
+static void fib6_prune_clones(struct net *net, struct fib6_node *fn)
-                              struct rt6_info *rt)
 {
-        fib6_clean_tree(net, fn, fib6_prune_clone, 1, rt);
+        fib6_clean_tree(net, fn, fib6_prune_clone, 1, NULL);
 }
 /*
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 0961b5ef866d..4052694c6f2c 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -26,7 +26,6 @@
 #include <net/sock.h>
 #include <net/ipv6.h>
-#include <net/addrconf.h>
 #include <net/rawv6.h>
 #include <net/transp_v6.h>
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 9d921462b57f..3873181ed856 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -72,6 +72,7 @@ struct ip6gre_net {
 };
 static struct rtnl_link_ops ip6gre_link_ops __read_mostly;
+static struct rtnl_link_ops ip6gre_tap_ops __read_mostly;
 static int ip6gre_tunnel_init(struct net_device *dev);
 static void ip6gre_tunnel_setup(struct net_device *dev);
 static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t);
@@ -353,10 +354,10 @@ failed_free:
 static void ip6gre_tunnel_uninit(struct net_device *dev)
 {
-        struct net *net = dev_net(dev);
+        struct ip6_tnl *t = netdev_priv(dev);
-        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+        struct ip6gre_net *ign = net_generic(t->net, ip6gre_net_id);
-        ip6gre_tunnel_unlink(ign, netdev_priv(dev));
+        ip6gre_tunnel_unlink(ign, t);
        dev_put(dev);
 }
@@ -467,17 +468,7 @@ static int ip6gre_rcv(struct sk_buff *skb)
                        goto drop;
                if (flags&GRE_CSUM) {
-                        switch (skb->ip_summed) {
+                        csum = skb_checksum_simple_validate(skb);
-                        case CHECKSUM_COMPLETE:
-                                csum = csum_fold(skb->csum);
-                                if (!csum)
-                                        break;
-                                /* fall through */
-                        case CHECKSUM_NONE:
-                                skb->csum = 0;
-                                csum = __skb_checksum_complete(skb);
-                                skb->ip_summed = CHECKSUM_COMPLETE;
-                        }
                        offset += 4;
                }
                if (flags&GRE_KEY) {
@@ -611,8 +602,8 @@ static netdev_tx_t ip6gre_xmit2(struct sk_buff *skb,
                         int encap_limit,
                         __u32 *pmtu)
 {
-        struct net *net = dev_net(dev);
        struct ip6_tnl *tunnel = netdev_priv(dev);
+        struct net *net = tunnel->net;
        struct net_device *tdev;    /* Device to other host */
        struct ipv6hdr  *ipv6h;     /* Our new IP header */
        unsigned int max_headroom = 0; /* The extra header space needed */
@@ -979,7 +970,7 @@ static void ip6gre_tnl_link_config(struct ip6_tnl *t, int set_mtu)
                int strict = (ipv6_addr_type(&p->raddr) &
                              (IPV6_ADDR_MULTICAST|IPV6_ADDR_LINKLOCAL));
-                struct rt6_info *rt = rt6_lookup(dev_net(dev),
+                struct rt6_info *rt = rt6_lookup(t->net,
                                                 &p->raddr, &p->laddr,
                                                 p->link, strict);
@@ -1063,13 +1054,12 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev,
        int err = 0;
        struct ip6_tnl_parm2 p;
        struct __ip6_tnl_parm p1;
-        struct ip6_tnl *t;
+        struct ip6_tnl *t = netdev_priv(dev);
-        struct net *net = dev_net(dev);
+        struct net *net = t->net;
        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
        switch (cmd) {
        case SIOCGETTUNNEL:
-                t = NULL;
                if (dev == ign->fb_tunnel_dev) {
                        if (copy_from_user(&p, ifr->ifr_ifru.ifru_data, sizeof(p))) {
                                err = -EFAULT;
@@ -1077,9 +1067,9 @@ static int ip6gre_tunnel_ioctl(struct net_device *dev,
                        }
                        ip6gre_tnl_parm_from_user(&p1, &p);
                        t = ip6gre_tunnel_locate(net, &p1, 0);
+                        if (t == NULL)
+                                t = netdev_priv(dev);
                }
-                if (t == NULL)
-                        t = netdev_priv(dev);
                memset(&p, 0, sizeof(p));
                ip6gre_tnl_parm_to_user(&p, &t->parms);
                if (copy_to_user(ifr->ifr_ifru.ifru_data, &p, sizeof(p)))
@@ -1242,7 +1232,6 @@ static void ip6gre_tunnel_setup(struct net_device *dev)
        dev->flags |= IFF_NOARP;
        dev->iflink = 0;
        dev->addr_len = sizeof(struct in6_addr);
-        dev->features |= NETIF_F_NETNS_LOCAL;
        dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
 }
@@ -1297,11 +1286,17 @@ static struct inet6_protocol ip6gre_protocol __read_mostly = {
        .flags       = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
 };
-static void ip6gre_destroy_tunnels(struct ip6gre_net *ign,
+static void ip6gre_destroy_tunnels(struct net *net, struct list_head *head)
-        struct list_head *head)
 {
+        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
+        struct net_device *dev, *aux;
        int prio;
+        for_each_netdev_safe(net, dev, aux)
+                if (dev->rtnl_link_ops == &ip6gre_link_ops ||
+                    dev->rtnl_link_ops == &ip6gre_tap_ops)
+                        unregister_netdevice_queue(dev, head);
        for (prio = 0; prio < 4; prio++) {
                int h;
                for (h = 0; h < HASH_SIZE; h++) {
@@ -1310,7 +1305,12 @@ static void ip6gre_destroy_tunnels(struct ip6gre_net *ign,
                        t = rtnl_dereference(ign->tunnels[prio][h]);
                        while (t != NULL) {
-                                unregister_netdevice_queue(t->dev, head);
+                                /* If dev is in the same netns, it has already
+                                 * been added to the list by the previous loop.
+                                 */
+                                if (!net_eq(dev_net(t->dev), net))
+                                        unregister_netdevice_queue(t->dev,
+                                                                   head);
                                t = rtnl_dereference(t->next);
                        }
                }
@@ -1329,6 +1329,11 @@ static int __net_init ip6gre_init_net(struct net *net)
                goto err_alloc_dev;
        }
        dev_net_set(ign->fb_tunnel_dev, net);
+        /* FB netdevice is special: we have one, and only one per netns.
+         * Allowing to move it to another netns is clearly unsafe.
+         */
+        ign->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
        ip6gre_fb_tunnel_init(ign->fb_tunnel_dev);
        ign->fb_tunnel_dev->rtnl_link_ops = &ip6gre_link_ops;
@@ -1349,12 +1354,10 @@ err_alloc_dev:
 static void __net_exit ip6gre_exit_net(struct net *net)
 {
-        struct ip6gre_net *ign;
        LIST_HEAD(list);
-        ign = net_generic(net, ip6gre_net_id);
        rtnl_lock();
-        ip6gre_destroy_tunnels(ign, &list);
+        ip6gre_destroy_tunnels(net, &list);
        unregister_netdevice_many(&list);
        rtnl_unlock();
 }
@@ -1531,15 +1534,14 @@ out:
 static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
                            struct nlattr *data[])
 {
-        struct ip6_tnl *t, *nt;
+        struct ip6_tnl *t, *nt = netdev_priv(dev);
-        struct net *net = dev_net(dev);
+        struct net *net = nt->net;
        struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
        struct __ip6_tnl_parm p;
        if (dev == ign->fb_tunnel_dev)
                return -EINVAL;
-        nt = netdev_priv(dev);
        ip6gre_netlink_parms(data, &p);
        t = ip6gre_tunnel_locate(net, &p, 0);
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index b2f091566f88..65eda2a8af48 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -97,9 +97,11 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
                       SKB_GSO_DODGY |
                       SKB_GSO_TCP_ECN |
                       SKB_GSO_GRE |
+                       SKB_GSO_GRE_CSUM |
                       SKB_GSO_IPIP |
                       SKB_GSO_SIT |
                       SKB_GSO_UDP_TUNNEL |
+                       SKB_GSO_UDP_TUNNEL_CSUM |
                       SKB_GSO_MPLS |
                       SKB_GSO_TCPV6 |
                       0)))
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index fbf11562b54c..cb9df0eb4023 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -219,7 +219,7 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
        skb->mark = sk->sk_mark;
        mtu = dst_mtu(dst);
-        if ((skb->len <= mtu) || skb->local_df || skb_is_gso(skb)) {
+        if ((skb->len <= mtu) || skb->ignore_df || skb_is_gso(skb)) {
                IP6_UPD_PO_STATS(net, ip6_dst_idev(skb_dst(skb)),
                              IPSTATS_MIB_OUT, skb->len);
                return NF_HOOK(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
@@ -347,11 +347,11 @@ static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
        if (skb->len <= mtu)
                return false;
-        /* ipv6 conntrack defrag sets max_frag_size + local_df */
+        /* ipv6 conntrack defrag sets max_frag_size + ignore_df */
        if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
                return true;
-        if (skb->local_df)
+        if (skb->ignore_df)
                return false;
        if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
@@ -537,6 +537,18 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
        skb_copy_secmark(to, from);
 }
+static void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
+{
+        static u32 ip6_idents_hashrnd __read_mostly;
+        u32 hash, id;
+        net_get_random_once(&ip6_idents_hashrnd, sizeof(ip6_idents_hashrnd));
+        hash = __ipv6_addr_jhash(&rt->rt6i_dst.addr, ip6_idents_hashrnd);
+        id = ip_idents_reserve(hash, 1);
+        fhdr->identification = htonl(id);
+}
 int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
        struct sk_buff *frag;
@@ -559,7 +571,7 @@ int ip6_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
        /* We must not fragment if the socket is set to force MTU discovery
         * or if the skb it not generated by a local socket.
         */
-        if (unlikely(!skb->local_df && skb->len > mtu) ||
+        if (unlikely(!skb->ignore_df && skb->len > mtu) ||
                     (IP6CB(skb)->frag_max_size &&
                      IP6CB(skb)->frag_max_size > mtu)) {
                if (skb->sk && dst_allfrag(skb_dst(skb)))
@@ -1234,7 +1246,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                              sizeof(struct frag_hdr) : 0) +
                             rt->rt6i_nfheader_len;
-                if (ip6_sk_local_df(sk))
+                if (ip6_sk_ignore_df(sk))
                        maxnonfragsize = sizeof(struct ipv6hdr) + IPV6_MAXPLEN;
                else
                        maxnonfragsize = mtu;
@@ -1544,7 +1556,7 @@ int ip6_push_pending_frames(struct sock *sk)
        }
        /* Allow local fragmentation. */
-        skb->local_df = ip6_sk_local_df(sk);
+        skb->ignore_df = ip6_sk_ignore_df(sk);
        *final_dst = fl6->daddr;
        __skb_pull(skb, skb_network_header_len(skb));
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index f6a66bb4114d..afa082458360 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -61,6 +61,7 @@
 MODULE_AUTHOR("Ville Nuorvala");
 MODULE_DESCRIPTION("IPv6 tunneling device");
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("ip6tnl");
 MODULE_ALIAS_NETDEV("ip6tnl0");
 #ifdef IP6_TNL_DEBUG
diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
index 6cc9f9371cc5..9aaa6bb229e4 100644
--- a/net/ipv6/ip6_vti.c
+++ b/net/ipv6/ip6_vti.c
@@ -795,15 +795,12 @@ static const struct net_device_ops vti6_netdev_ops = {
 **/
 static void vti6_dev_setup(struct net_device *dev)
 {
-        struct ip6_tnl *t;
        dev->netdev_ops = &vti6_netdev_ops;
        dev->destructor = vti6_dev_free;
        dev->type = ARPHRD_TUNNEL6;
        dev->hard_header_len = LL_MAX_HEADER + sizeof(struct ipv6hdr);
        dev->mtu = ETH_DATA_LEN;
-        t = netdev_priv(dev);
        dev->flags |= IFF_NOARP;
        dev->addr_len = sizeof(struct in6_addr);
        dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
diff --git a/net/ipv6/netfilter/ip6table_nat.c b/net/ipv6/netfilter/ip6table_nat.c
index 84c7f33d0cf8..387d8b8fc18d 100644
--- a/net/ipv6/netfilter/ip6table_nat.c
+++ b/net/ipv6/netfilter/ip6table_nat.c
@@ -90,17 +90,9 @@ nf_nat_ipv6_fn(const struct nf_hook_ops *ops,
        if (nf_ct_is_untracked(ct))
                return NF_ACCEPT;
-        nat = nfct_nat(ct);
+        nat = nf_ct_nat_ext_add(ct);
-        if (!nat) {
+        if (nat == NULL)
-                /* NAT module was loaded late. */
+                return NF_ACCEPT;
-                if (nf_ct_is_confirmed(ct))
-                        return NF_ACCEPT;
-                nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
-                if (nat == NULL) {
-                        pr_debug("failed to add NAT extension\n");
-                        return NF_ACCEPT;
-                }
-        }
        switch (ctinfo) {
        case IP_CT_RELATED:
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index 767ab8da8218..0d5279fd852a 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -451,7 +451,7 @@ nf_ct_frag6_reasm(struct frag_queue *fq, struct net_device *dev)
        }
        sub_frag_mem_limit(&fq->q, head->truesize);
-        head->local_df = 1;
+        head->ignore_df = 1;
        head->next = NULL;
        head->dev = dev;
        head->tstamp = fq->q.stamp;
diff --git a/net/ipv6/netfilter/nft_chain_nat_ipv6.c b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
index 9c3297a768fd..d189fcb437fe 100644
--- a/net/ipv6/netfilter/nft_chain_nat_ipv6.c
+++ b/net/ipv6/netfilter/nft_chain_nat_ipv6.c
@@ -47,15 +47,9 @@ static unsigned int nf_nat_ipv6_fn(const struct nf_hook_ops *ops,
        if (ct == NULL || nf_ct_is_untracked(ct))
                return NF_ACCEPT;
-        nat = nfct_nat(ct);
+        nat = nf_ct_nat_ext_add(ct);
-        if (nat == NULL) {
+        if (nat == NULL)
-                /* Conntrack module was loaded late, can't add extension. */
+                return NF_ACCEPT;
-                if (nf_ct_is_confirmed(ct))
-                        return NF_ACCEPT;
-                nat = nf_ct_ext_add(ct, NF_CT_EXT_NAT, GFP_ATOMIC);
-                if (nat == NULL)
-                        return NF_ACCEPT;
-        }
        switch (ctinfo) {
        case IP_CT_RELATED:
diff --git a/net/ipv6/output_core.c b/net/ipv6/output_core.c
index 56596ce390a1..5ec867e4a8b7 100644
--- a/net/ipv6/output_core.c
+++ b/net/ipv6/output_core.c
@@ -8,32 +8,6 @@
 #include <net/addrconf.h>
 #include <net/secure_seq.h>
-void ipv6_select_ident(struct frag_hdr *fhdr, struct rt6_info *rt)
-{
-        static atomic_t ipv6_fragmentation_id;
-        struct in6_addr addr;
-        int ident;
-#if IS_ENABLED(CONFIG_IPV6)
-        struct inet_peer *peer;
-        struct net *net;
-        net = dev_net(rt->dst.dev);
-        peer = inet_getpeer_v6(net->ipv6.peers, &rt->rt6i_dst.addr, 1);
-        if (peer) {
-                fhdr->identification = htonl(inet_getid(peer, 0));
-                inet_putpeer(peer);
-                return;
-        }
-#endif
-        ident = atomic_inc_return(&ipv6_fragmentation_id);
-        addr = rt->rt6i_dst.addr;
-        addr.s6_addr32[0] ^= (__force __be32)ident;
-        fhdr->identification = htonl(secure_ipv6_id(addr.s6_addr32));
-}
-EXPORT_SYMBOL(ipv6_select_ident);
 int ip6_find_1stfragopt(struct sk_buff *skb, u8 **nexthdr)
 {
        u16 offset = sizeof(struct ipv6hdr);
@@ -104,6 +78,7 @@ int __ip6_local_out(struct sk_buff *skb)
        if (len > IPV6_MAXPLEN)
                len = 0;
        ipv6_hdr(skb)->payload_len = htons(len);
+        IP6CB(skb)->nhoff = offsetof(struct ipv6hdr, nexthdr);
        return nf_hook(NFPROTO_IPV6, NF_INET_LOCAL_OUT, skb, NULL,
                       skb_dst(skb)->dev, dst_output);
diff --git a/net/ipv6/ping.c b/net/ipv6/ping.c
index bda74291c3e0..5b7a1ed2aba9 100644
--- a/net/ipv6/ping.c
+++ b/net/ipv6/ping.c
@@ -51,7 +51,6 @@ static struct inet_protosw pingv6_protosw = {
        .protocol =  IPPROTO_ICMPV6,
        .prot =      &pingv6_prot,
        .ops =       &inet6_dgram_ops,
-        .no_check =  UDP_CSUM_DEFAULT,
        .flags =     INET_PROTOSW_REUSE,
 };
@@ -168,12 +167,7 @@ int ping_v6_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
        pfh.wcheck = 0;
        pfh.family = AF_INET6;
-        if (ipv6_addr_is_multicast(&fl6.daddr))
+        hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
-                hlimit = np->mcast_hops;
-        else
-                hlimit = np->hop_limit;
-        if (hlimit < 0)
-                hlimit = ip6_dst_hoplimit(dst);
        lock_sock(sk);
        err = ip6_append_data(sk, ping_getfrag, &pfh, len,
diff --git a/net/ipv6/proc.c b/net/ipv6/proc.c
index 091d066a57b3..3317440ea341 100644
--- a/net/ipv6/proc.c
+++ b/net/ipv6/proc.c
@@ -186,7 +186,7 @@ static void snmp6_seq_show_icmpv6msg(struct seq_file *seq, atomic_long_t *smib)
 /* can be called either with percpu mib (pcpumib != NULL),
 * or shared one (smib != NULL)
 */
-static void snmp6_seq_show_item(struct seq_file *seq, void __percpu **pcpumib,
+static void snmp6_seq_show_item(struct seq_file *seq, void __percpu *pcpumib,
                                atomic_long_t *smib,
                                const struct snmp_mib *itemlist)
 {
@@ -201,7 +201,7 @@ static void snmp6_seq_show_item(struct seq_file *seq, void __percpu **pcpumib,
        }
 }
-static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu **mib,
+static void snmp6_seq_show_item64(struct seq_file *seq, void __percpu *mib,
                                  const struct snmp_mib *itemlist, size_t syncpoff)
 {
        int i;
@@ -215,14 +215,14 @@ static int snmp6_seq_show(struct seq_file *seq, void *v)
 {
        struct net *net = (struct net *)seq->private;
-        snmp6_seq_show_item64(seq, (void __percpu **)net->mib.ipv6_statistics,
+        snmp6_seq_show_item64(seq, net->mib.ipv6_statistics,
                            snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
-        snmp6_seq_show_item(seq, (void __percpu **)net->mib.icmpv6_statistics,
+        snmp6_seq_show_item(seq, net->mib.icmpv6_statistics,
                            NULL, snmp6_icmp6_list);
        snmp6_seq_show_icmpv6msg(seq, net->mib.icmpv6msg_statistics->mibs);
-        snmp6_seq_show_item(seq, (void __percpu **)net->mib.udp_stats_in6,
+        snmp6_seq_show_item(seq, net->mib.udp_stats_in6,
                            NULL, snmp6_udp6_list);
-        snmp6_seq_show_item(seq, (void __percpu **)net->mib.udplite_stats_in6,
+        snmp6_seq_show_item(seq, net->mib.udplite_stats_in6,
                            NULL, snmp6_udplite6_list);
        return 0;
 }
@@ -245,7 +245,7 @@ static int snmp6_dev_seq_show(struct seq_file *seq, void *v)
        struct inet6_dev *idev = (struct inet6_dev *)seq->private;
        seq_printf(seq, "%-32s\t%u\n", "ifIndex", idev->dev->ifindex);
-        snmp6_seq_show_item64(seq, (void __percpu **)idev->stats.ipv6,
+        snmp6_seq_show_item64(seq, idev->stats.ipv6,
                            snmp6_ipstats_list, offsetof(struct ipstats_mib, syncp));
        snmp6_seq_show_item(seq, NULL, idev->stats.icmpv6dev->mibs,
                            snmp6_icmp6_list);
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 1f29996e368a..b2dc60b0c764 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -873,14 +873,8 @@ static int rawv6_sendmsg(struct kiocb *iocb, struct sock *sk,
                err = PTR_ERR(dst);
                goto out;
        }
-        if (hlimit < 0) {
+        if (hlimit < 0)
-                if (ipv6_addr_is_multicast(&fl6.daddr))
+                hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
-                        hlimit = np->mcast_hops;
-                else
-                        hlimit = np->hop_limit;
-                if (hlimit < 0)
-                        hlimit = ip6_dst_hoplimit(dst);
-        }
        if (tclass < 0)
                tclass = np->tclass;
@@ -1328,7 +1322,6 @@ static struct inet_protosw rawv6_protosw = {
        .protocol       = IPPROTO_IP,   /* wild card */
        .prot           = &rawv6_prot,
        .ops            = &inet6_sockraw_ops,
-        .no_check       = UDP_CSUM_DEFAULT,
        .flags          = INET_PROTOSW_REUSE,
 };
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6ebdb7b6744c..f23fbd28a501 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1176,7 +1176,7 @@ void ip6_update_pmtu(struct sk_buff *skb, struct net *net, __be32 mtu,
        memset(&fl6, 0, sizeof(fl6));
        fl6.flowi6_oif = oif;
-        fl6.flowi6_mark = mark;
+        fl6.flowi6_mark = mark ? mark : IP6_REPLY_MARK(net, skb->mark);
        fl6.daddr = iph->daddr;
        fl6.saddr = iph->saddr;
        fl6.flowlabel = ip6_flowinfo(iph);
@@ -1455,7 +1455,7 @@ static int ip6_dst_gc(struct dst_ops *ops)
                goto out;
        net->ipv6.ip6_rt_gc_expire++;
-        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, entries > rt_max_size);
+        fib6_run_gc(net->ipv6.ip6_rt_gc_expire, net, true);
        entries = dst_entries_get_slow(ops);
        if (entries < ops->gc_thresh)
                net->ipv6.ip6_rt_gc_expire = rt_gc_timeout>>1;
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index e5a453ca302e..4f408176dc64 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
        if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
                ipv4_update_pmtu(skb, dev_net(skb->dev), info,
-                                 t->dev->ifindex, 0, IPPROTO_IPV6, 0);
+                                 t->parms.link, 0, IPPROTO_IPV6, 0);
                err = 0;
                goto out;
        }
        if (type == ICMP_REDIRECT) {
-                ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
+                ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
                              IPPROTO_IPV6, 0);
                err = 0;
                goto out;
@@ -1828,4 +1828,5 @@ xfrm_tunnel_failed:
 module_init(sit_init);
 module_exit(sit_cleanup);
 MODULE_LICENSE("GPL");
+MODULE_ALIAS_RTNL_LINK("sit");
 MODULE_ALIAS_NETDEV("sit0");
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index bb53a5e73c1a..a822b880689b 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -216,6 +216,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
            ipv6_addr_type(&ireq->ir_v6_rmt_addr) & IPV6_ADDR_LINKLOCAL)
                ireq->ir_iif = inet6_iif(skb);
+        ireq->ir_mark = inet_request_mark(sk, skb);
        req->expires = 0UL;
        req->num_retrans = 0;
        ireq->ecn_ok            = ecn_ok;
@@ -242,7 +244,7 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
                final_p = fl6_update_dst(&fl6, np->opt, &final);
                fl6.saddr = ireq->ir_v6_loc_addr;
                fl6.flowi6_oif = sk->sk_bound_dev_if;
-                fl6.flowi6_mark = sk->sk_mark;
+                fl6.flowi6_mark = ireq->ir_mark;
                fl6.fl6_dport = ireq->ir_rmt_port;
                fl6.fl6_sport = inet_sk(sk)->inet_sport;
                security_req_classify_flow(req, flowi6_to_flowi(&fl6));
diff --git a/net/ipv6/sysctl_net_ipv6.c b/net/ipv6/sysctl_net_ipv6.c
index 7f405a168822..058f3eca2e53 100644
--- a/net/ipv6/sysctl_net_ipv6.c
+++ b/net/ipv6/sysctl_net_ipv6.c
@@ -38,6 +38,13 @@ static struct ctl_table ipv6_table_template[] = {
                .mode           = 0644,
                .proc_handler   = proc_dointvec
        },
+        {
+                .procname       = "fwmark_reflect",
+                .data           = &init_net.ipv6.sysctl.fwmark_reflect,
+                .maxlen         = sizeof(int),
+                .mode           = 0644,
+                .proc_handler   = proc_dointvec
+        },
        { }
 };
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index e289830ed6e3..229239ad96b1 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -340,7 +340,8 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        struct sock *sk;
        int err;
        struct tcp_sock *tp;
-        __u32 seq;
+        struct request_sock *fastopen;
+        __u32 seq, snd_una;
        struct net *net = dev_net(skb->dev);
        sk = inet6_lookup(net, &tcp_hashinfo, &hdr->daddr,
@@ -371,8 +372,11 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
        tp = tcp_sk(sk);
        seq = ntohl(th->seq);
+        /* XXX (TFO) - tp->snd_una should be ISN (tcp_create_openreq_child() */
+        fastopen = tp->fastopen_rsk;
+        snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
        if (sk->sk_state != TCP_LISTEN &&
-            !between(seq, tp->snd_una, tp->snd_nxt)) {
+            !between(seq, snd_una, tp->snd_nxt)) {
                NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
                goto out;
        }
@@ -436,8 +440,13 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
                goto out;
        case TCP_SYN_SENT:
-        case TCP_SYN_RECV:  /* Cannot happen.
+        case TCP_SYN_RECV:
-                               It can, it SYNs are crossed. --ANK */
+                /* Only in fast or simultaneous open. If a fast open socket is
+                 * is already accepted it is treated as a connected one below.
+                 */
+                if (fastopen && fastopen->sk == NULL)
+                        break;
                if (!sock_owned_by_user(sk)) {
                        sk->sk_err = err;
                        sk->sk_error_report(sk);                /* Wake people up to see the error (see connect in sock.c) */
@@ -463,7 +472,8 @@ out:
 static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
                              struct flowi6 *fl6,
                              struct request_sock *req,
-                              u16 queue_mapping)
+                              u16 queue_mapping,
+                              struct tcp_fastopen_cookie *foc)
 {
        struct inet_request_sock *ireq = inet_rsk(req);
        struct ipv6_pinfo *np = inet6_sk(sk);
@@ -474,7 +484,7 @@ static int tcp_v6_send_synack(struct sock *sk, struct dst_entry *dst,
        if (!dst && (dst = inet6_csk_route_req(sk, fl6, req)) == NULL)
                goto done;
-        skb = tcp_make_synack(sk, dst, req, NULL);
+        skb = tcp_make_synack(sk, dst, req, foc);
        if (skb) {
                __tcp_v6_send_check(skb, &ireq->ir_v6_loc_addr,
@@ -498,7 +508,7 @@ static int tcp_v6_rtx_synack(struct sock *sk, struct request_sock *req)
        struct flowi6 fl6;
        int res;
-        res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0);
+        res = tcp_v6_send_synack(sk, NULL, &fl6, req, 0, NULL);
        if (!res) {
                TCP_INC_STATS_BH(sock_net(sk), TCP_MIB_RETRANSSEGS);
                NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPSYNRETRANS);
@@ -802,6 +812,7 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win,
                fl6.flowi6_oif = inet6_iif(skb);
        else
                fl6.flowi6_oif = oif;
+        fl6.flowi6_mark = IP6_REPLY_MARK(net, skb->mark);
        fl6.fl6_dport = t1->dest;
        fl6.fl6_sport = t1->source;
        security_skb_classify_flow(skb, flowi6_to_flowi(&fl6));
@@ -917,7 +928,12 @@ static void tcp_v6_timewait_ack(struct sock *sk, struct sk_buff *skb)
 static void tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
                                  struct request_sock *req)
 {
-        tcp_v6_send_ack(skb, tcp_rsk(req)->snt_isn + 1, tcp_rsk(req)->rcv_isn + 1,
+        /* sk->sk_state == TCP_LISTEN -> for regular TCP_SYN_RECV
+         * sk->sk_state == TCP_SYN_RECV -> for Fast Open.
+         */
+        tcp_v6_send_ack(skb, (sk->sk_state == TCP_LISTEN) ?
+                        tcp_rsk(req)->snt_isn + 1 : tcp_sk(sk)->snd_nxt,
+                        tcp_rsk(req)->rcv_nxt,
                        req->rcv_wnd, tcp_time_stamp, req->ts_recent, sk->sk_bound_dev_if,
                        tcp_v6_md5_do_lookup(sk, &ipv6_hdr(skb)->daddr),
                        0, 0);
@@ -969,8 +985,10 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        struct tcp_sock *tp = tcp_sk(sk);
        __u32 isn = TCP_SKB_CB(skb)->when;
        struct dst_entry *dst = NULL;
+        struct tcp_fastopen_cookie foc = { .len = -1 };
+        bool want_cookie = false, fastopen;
        struct flowi6 fl6;
-        bool want_cookie = false;
+        int err;
        if (skb->protocol == htons(ETH_P_IP))
                return tcp_v4_conn_request(sk, skb);
@@ -1001,7 +1019,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        tcp_clear_options(&tmp_opt);
        tmp_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
        tmp_opt.user_mss = tp->rx_opt.user_mss;
-        tcp_parse_options(skb, &tmp_opt, 0, NULL);
+        tcp_parse_options(skb, &tmp_opt, 0, want_cookie ? NULL : &foc);
        if (want_cookie && !tmp_opt.saw_tstamp)
                tcp_clear_options(&tmp_opt);
@@ -1016,6 +1034,7 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                TCP_ECN_create_request(req, skb, sock_net(sk));
        ireq->ir_iif = sk->sk_bound_dev_if;
+        ireq->ir_mark = inet_request_mark(sk, skb);
        /* So that link locals have meaning */
        if (!sk->sk_bound_dev_if &&
@@ -1074,19 +1093,27 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
                isn = tcp_v6_init_sequence(skb);
        }
 have_isn:
-        tcp_rsk(req)->snt_isn = isn;
        if (security_inet_conn_request(sk, skb, req))
                goto drop_and_release;
-        if (tcp_v6_send_synack(sk, dst, &fl6, req,
+        if (!dst && (dst = inet6_csk_route_req(sk, &fl6, req)) == NULL)
-                               skb_get_queue_mapping(skb)) ||
-            want_cookie)
                goto drop_and_free;
+        tcp_rsk(req)->snt_isn = isn;
        tcp_rsk(req)->snt_synack = tcp_time_stamp;
-        tcp_rsk(req)->listener = NULL;
+        tcp_openreq_init_rwin(req, sk, dst);
-        inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
+        fastopen = !want_cookie &&
+                   tcp_try_fastopen(sk, skb, req, &foc, dst);
+        err = tcp_v6_send_synack(sk, dst, &fl6, req,
+                                 skb_get_queue_mapping(skb), &foc);
+        if (!fastopen) {
+                if (err || want_cookie)
+                        goto drop_and_free;
+                tcp_rsk(req)->listener = NULL;
+                inet6_csk_reqsk_queue_hash_add(sk, req, TCP_TIMEOUT_INIT);
+        }
        return 0;
 drop_and_release:
@@ -1294,25 +1321,6 @@ out:
        return NULL;
 }
-static __sum16 tcp_v6_checksum_init(struct sk_buff *skb)
-{
-        if (skb->ip_summed == CHECKSUM_COMPLETE) {
-                if (!tcp_v6_check(skb->len, &ipv6_hdr(skb)->saddr,
-                                  &ipv6_hdr(skb)->daddr, skb->csum)) {
-                        skb->ip_summed = CHECKSUM_UNNECESSARY;
-                        return 0;
-                }
-        }
-        skb->csum = ~csum_unfold(tcp_v6_check(skb->len,
-                                              &ipv6_hdr(skb)->saddr,
-                                              &ipv6_hdr(skb)->daddr, 0));
-        if (skb->len <= 76)
-                return __skb_checksum_complete(skb);
-        return 0;
-}
 /* The socket must have it's spinlock held when we get
 * here.
 *
@@ -1486,7 +1494,7 @@ static int tcp_v6_rcv(struct sk_buff *skb)
        if (!pskb_may_pull(skb, th->doff*4))
                goto discard_it;
-        if (!skb_csum_unnecessary(skb) && tcp_v6_checksum_init(skb))
+        if (skb_checksum_init(skb, IPPROTO_TCP, ip6_compute_pseudo))
                goto csum_error;
        th = tcp_hdr(skb);
@@ -1779,6 +1787,7 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
        const struct inet_sock *inet = inet_sk(sp);
        const struct tcp_sock *tp = tcp_sk(sp);
        const struct inet_connection_sock *icsk = inet_csk(sp);
+        struct fastopen_queue *fastopenq = icsk->icsk_accept_queue.fastopenq;
        dest  = &sp->sk_v6_daddr;
        src   = &sp->sk_v6_rcv_saddr;
@@ -1821,7 +1830,9 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
                   jiffies_to_clock_t(icsk->icsk_ack.ato),
                   (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
                   tp->snd_cwnd,
-                   tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh
+                   sp->sk_state == TCP_LISTEN ?
+                        (fastopenq ? fastopenq->max_qlen : 0) :
+                        (tcp_in_initial_slowstart(tp) ? -1 : tp->snd_ssthresh)
                   );
 }
@@ -1981,7 +1992,6 @@ static struct inet_protosw tcpv6_protosw = {
        .protocol       =       IPPROTO_TCP,
        .prot           =       &tcpv6_prot,
        .ops            =       &inet6_stream_ops,
-        .no_check       =       0,
        .flags          =       INET_PROTOSW_PERMANENT |
                                INET_PROTOSW_ICSK,
 };
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 1e586d92260e..95c834799288 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -634,6 +634,10 @@ int udpv6_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                if (skb->len > sizeof(struct udphdr) && encap_rcv != NULL) {
                        int ret;
+                        /* Verify checksum before giving to encap */
+                        if (udp_lib_checksum_complete(skb))
+                                goto csum_error;
                        ret = encap_rcv(sk, skb);
                        if (ret <= 0) {
                                UDP_INC_STATS_BH(sock_net(sk),
@@ -701,17 +705,16 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
                                      int dif)
 {
        struct hlist_nulls_node *node;
-        struct sock *s = sk;
        unsigned short num = ntohs(loc_port);
-        sk_nulls_for_each_from(s, node) {
+        sk_nulls_for_each_from(sk, node) {
-                struct inet_sock *inet = inet_sk(s);
+                struct inet_sock *inet = inet_sk(sk);
-                if (!net_eq(sock_net(s), net))
+                if (!net_eq(sock_net(sk), net))
                        continue;
-                if (udp_sk(s)->udp_port_hash == num &&
+                if (udp_sk(sk)->udp_port_hash == num &&
-                    s->sk_family == PF_INET6) {
+                    sk->sk_family == PF_INET6) {
                        if (inet->inet_dport) {
                                if (inet->inet_dport != rmt_port)
                                        continue;
@@ -720,16 +723,16 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
                            !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr))
                                continue;
-                        if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif)
+                        if (sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif)
                                continue;
                        if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
                                if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr))
                                        continue;
                        }
-                        if (!inet6_mc_check(s, loc_addr, rmt_addr))
+                        if (!inet6_mc_check(sk, loc_addr, rmt_addr))
                                continue;
-                        return s;
+                        return sk;
                }
        }
        return NULL;
@@ -760,6 +763,17 @@ static void flush_stack(struct sock **stack, unsigned int count,
        if (unlikely(skb1))
                kfree_skb(skb1);
 }
+static void udp6_csum_zero_error(struct sk_buff *skb)
+{
+        /* RFC 2460 section 8.1 says that we SHOULD log
+         * this error. Well, it is reasonable.
+         */
+        LIMIT_NETDEBUG(KERN_INFO "IPv6: udp checksum is 0 for [%pI6c]:%u->[%pI6c]:%u\n",
+                       &ipv6_hdr(skb)->saddr, ntohs(udp_hdr(skb)->source),
+                       &ipv6_hdr(skb)->daddr, ntohs(udp_hdr(skb)->dest));
+}
 /*
 * Note: called only from the BH handler context,
 * so we don't need to lock the hashes.
@@ -779,7 +793,12 @@ static int __udp6_lib_mcast_deliver(struct net *net, struct sk_buff *skb,
        dif = inet6_iif(skb);
        sk = udp_v6_mcast_next(net, sk, uh->dest, daddr, uh->source, saddr, dif);
        while (sk) {
-                stack[count++] = sk;
+                /* If zero checksum and no_check is not on for
+                 * the socket then skip it.
+                 */
+                if (uh->check || udp_sk(sk)->no_check6_rx)
+                        stack[count++] = sk;
                sk = udp_v6_mcast_next(net, sk_nulls_next(sk), uh->dest, daddr,
                                       uh->source, saddr, dif);
                if (unlikely(count == ARRAY_SIZE(stack))) {
@@ -867,6 +886,12 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
        if (sk != NULL) {
                int ret;
+                if (!uh->check && !udp_sk(sk)->no_check6_rx) {
+                        sock_put(sk);
+                        udp6_csum_zero_error(skb);
+                        goto csum_error;
+                }
                ret = udpv6_queue_rcv_skb(sk, skb);
                sock_put(sk);
@@ -879,6 +904,11 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                return 0;
        }
+        if (!uh->check) {
+                udp6_csum_zero_error(skb);
+                goto csum_error;
+        }
        if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
                goto discard;
@@ -1006,7 +1036,10 @@ static int udp_v6_push_pending_frames(struct sock *sk)
        if (is_udplite)
                csum = udplite_csum_outgoing(sk, skb);
-        else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
+        else if (up->no_check6_tx) {   /* UDP csum disabled */
+                skb->ip_summed = CHECKSUM_NONE;
+                goto send;
+        } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */
                udp6_hwcsum_outgoing(sk, skb, &fl6->saddr, &fl6->daddr,
                                     up->len);
                goto send;
@@ -1232,14 +1265,8 @@ do_udp_sendmsg:
                goto out;
        }
-        if (hlimit < 0) {
+        if (hlimit < 0)
-                if (ipv6_addr_is_multicast(&fl6.daddr))
+                hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
-                        hlimit = np->mcast_hops;
-                else
-                        hlimit = np->hop_limit;
-                if (hlimit < 0)
-                        hlimit = ip6_dst_hoplimit(dst);
-        }
        if (tclass < 0)
                tclass = np->tclass;
@@ -1479,7 +1506,6 @@ static struct inet_protosw udpv6_protosw = {
        .protocol =  IPPROTO_UDP,
        .prot =      &udpv6_prot,
        .ops =       &inet6_dgram_ops,
-        .no_check =  UDP_CSUM_DEFAULT,
        .flags =     INET_PROTOSW_PERMANENT,
 };
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index b261ee8b83fc..0ae3d98f83e0 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -63,7 +63,9 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                if (unlikely(type & ~(SKB_GSO_UDP |
                                      SKB_GSO_DODGY |
                                      SKB_GSO_UDP_TUNNEL |
+                                      SKB_GSO_UDP_TUNNEL_CSUM |
                                      SKB_GSO_GRE |
+                                      SKB_GSO_GRE_CSUM |
                                      SKB_GSO_IPIP |
                                      SKB_GSO_SIT |
                                      SKB_GSO_MPLS) ||
@@ -76,7 +78,8 @@ static struct sk_buff *udp6_ufo_fragment(struct sk_buff *skb,
                goto out;
        }
-        if (skb->encapsulation && skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL)
+        if (skb->encapsulation && skb_shinfo(skb)->gso_type &
+            (SKB_GSO_UDP_TUNNEL|SKB_GSO_UDP_TUNNEL_CSUM))
                segs = skb_udp_tunnel_segment(skb, features);
        else {
                /* Do software UFO. Complete and fill in the UDP checksum as HW cannot
diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
index dfcc4be46898..9cf097e206e9 100644
--- a/net/ipv6/udplite.c
+++ b/net/ipv6/udplite.c
@@ -64,7 +64,6 @@ static struct inet_protosw udplite6_protosw = {
        .protocol       = IPPROTO_UDPLITE,
        .prot           = &udplitev6_prot,
        .ops            = &inet6_dgram_ops,
-        .no_check       = 0,
        .flags          = INET_PROTOSW_PERMANENT,
 };
diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c
index b930d080c66f..433672d07d0b 100644
--- a/net/ipv6/xfrm6_output.c
+++ b/net/ipv6/xfrm6_output.c
@@ -78,7 +78,7 @@ static int xfrm6_tunnel_check_size(struct sk_buff *skb)
        if (mtu < IPV6_MIN_MTU)
                mtu = IPV6_MIN_MTU;
-        if (!skb->local_df && skb->len > mtu) {
+        if (!skb->ignore_df && skb->len > mtu) {
                skb->dev = dst->dev;
                if (xfrm6_local_dontfrag(skb))
@@ -114,7 +114,7 @@ int xfrm6_prepare_output(struct xfrm_state *x, struct sk_buff *skb)
        if (err)
                return err;
-        skb->local_df = 1;
+        skb->ignore_df = 1;
        return x->outer_mode->output2(x, skb);
 }
@@ -153,7 +153,7 @@ static int __xfrm6_output(struct sk_buff *skb)
        if (skb->len > mtu && xfrm6_local_dontfrag(skb)) {
                xfrm6_local_rxpmtu(skb, mtu);
                return -EMSGSIZE;
-        } else if (!skb->local_df && skb->len > mtu && skb->sk) {
+        } else if (!skb->ignore_df && skb->len > mtu && skb->sk) {
                xfrm_local_error(skb, mtu);
                return -EMSGSIZE;
        }