15 files changed, 141 insertions, 54 deletions
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index e66ca9381c..ab7a9124f9 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -1,6 +1,26 @@
 #
 # IPv6 configuration
-# 
+#
+#   IPv6 as module will cause a CRASH if you try to unload it
+config IPV6
+        tristate "The IPv6 protocol"
+        default m
+        select CRYPTO if IPV6_PRIVACY
+        select CRYPTO_MD5 if IPV6_PRIVACY
+        ---help---
+          This is complemental support for the IP version 6.
+          You will still be able to do traditional IPv4 networking as well.
+          For general information about IPv6, see
+          <http://playground.sun.com/pub/ipng/html/ipng-main.html>.
+          For Linux IPv6 development information, see <http://www.linux-ipv6.org>.
+          For specific information about IPv6 under Linux, read the HOWTO at
+          <http://www.bieringer.de/linux/IPv6/>.
+          To compile this protocol support as a module, choose M here: the 
+          module will be called ipv6.
 config IPV6_PRIVACY
        bool "IPv6: Privacy Extensions (RFC 3041) support"
        depends on IPV6
@@ -71,7 +91,6 @@ config INET6_TUNNEL
 config IPV6_TUNNEL
        tristate "IPv6: IPv6-in-IPv6 tunnel"
        depends on IPV6
-        select INET6_TUNNEL
        ---help---
          Support for IPv6-in-IPv6 tunnels described in RFC 2473.
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 14f5c53235..77004b9456 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -57,6 +57,7 @@
 #endif
 #include <linux/delay.h>
 #include <linux/notifier.h>
+#include <linux/string.h>
 #include <net/sock.h>
 #include <net/snmp.h>
@@ -2776,7 +2777,7 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                read_lock_bh(&idev->lock);
                switch (type) {
                case UNICAST_ADDR:
-                        /* unicast address */
+                        /* unicast address incl. temp addr */
                        for (ifa = idev->addr_list; ifa;
                             ifa = ifa->if_next, ip_idx++) {
                                if (ip_idx < s_ip_idx)
@@ -2787,19 +2788,6 @@ static int inet6_dump_addr(struct sk_buff *skb, struct netlink_callback *cb,
                                    NLM_F_MULTI)) <= 0)
                                        goto done;
                        }
-                        /* temp addr */
-#ifdef CONFIG_IPV6_PRIVACY
-                        for (ifa = idev->tempaddr_list; ifa; 
-                             ifa = ifa->tmp_next, ip_idx++) {
-                                if (ip_idx < s_ip_idx)
-                                        continue;
-                                if ((err = inet6_fill_ifaddr(skb, ifa, 
-                                    NETLINK_CB(cb->skb).pid, 
-                                    cb->nlh->nlmsg_seq, RTM_NEWADDR,
-                                    NLM_F_MULTI)) <= 0) 
-                                        goto done;
-                        }
-#endif
                        break;
                case MULTICAST_ADDR:
                        /* multicast address */
@@ -2922,6 +2910,7 @@ static int inet6_fill_ifinfo(struct sk_buff *skb, struct inet6_dev *idev,
        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*r), flags);
        r = NLMSG_DATA(nlh);
        r->ifi_family = AF_INET6;
+        r->__ifi_pad = 0;
        r->ifi_type = dev->type;
        r->ifi_index = dev->ifindex;
        r->ifi_flags = dev_get_flags(dev);
@@ -3029,9 +3018,12 @@ static int inet6_fill_prefix(struct sk_buff *skb, struct inet6_dev *idev,
        nlh = NLMSG_NEW(skb, pid, seq, event, sizeof(*pmsg), flags);
        pmsg = NLMSG_DATA(nlh);
        pmsg->prefix_family = AF_INET6;
+        pmsg->prefix_pad1 = 0;
+        pmsg->prefix_pad2 = 0;
        pmsg->prefix_ifindex = idev->dev->ifindex;
        pmsg->prefix_len = pinfo->prefix_len;
        pmsg->prefix_type = pinfo->type;
+        pmsg->prefix_pad3 = 0;
        
        pmsg->prefix_flags = 0;
        if (pinfo->onlink)
@@ -3437,7 +3429,7 @@ static void addrconf_sysctl_register(struct inet6_dev *idev, struct ipv6_devconf
         * by sysctl and we wouldn't want anyone to change it under our feet
         * (see SIOCSIFNAME).
         */     
-        dev_name = net_sysctl_strdup(dev_name);
+        dev_name = kstrdup(dev_name, GFP_KERNEL);
        if (!dev_name)
            goto free;
diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 2b193e3df4..28d9bcab09 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -774,7 +774,6 @@ static int __init inet6_init(void)
        if (if6_proc_init())
                goto proc_if6_fail;
 #endif
-        ipv6_packet_init();
        ip6_route_init();
        ip6_flowlabel_init();
        err = addrconf_init();
@@ -791,6 +790,8 @@ static int __init inet6_init(void)
        /* Init v6 transport protocols. */
        udpv6_init();
        tcpv6_init();
+        ipv6_packet_init();
        err = 0;
 out:
        return err;
@@ -798,7 +799,6 @@ out:
 addrconf_fail:
        ip6_flowlabel_cleanup();
        ip6_route_cleanup();
-        ipv6_packet_cleanup();
 #ifdef CONFIG_PROC_FS
        if6_proc_exit();
 proc_if6_fail:
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index 0e5f7499de..b6c73da5ff 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -244,7 +244,6 @@ struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions * opt_space,
                opt_space->opt_nflen = 0;
        }
        opt_space->dst1opt = fopt->dst1opt;
-        opt_space->auth = fopt->auth;
        opt_space->opt_flen = fopt->opt_flen;
        return opt_space;
 }
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 866f10726c..10fbb50dae 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -198,12 +198,13 @@ resubmit:
                if (!raw_sk) {
                        if (xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) {
                                IP6_INC_STATS_BH(IPSTATS_MIB_INUNKNOWNPROTOS);
-                                icmpv6_param_prob(skb, ICMPV6_UNK_NEXTHDR, nhoff);
+                                icmpv6_send(skb, ICMPV6_PARAMPROB,
+                                            ICMPV6_UNK_NEXTHDR, nhoff,
+                                            skb->dev);
                        }
-                } else {
+                } else
                        IP6_INC_STATS_BH(IPSTATS_MIB_INDELIVERS);
-                        kfree_skb(skb);
+                kfree_skb(skb);
-                }
        }
        rcu_read_unlock();
        return 0;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 06e7cdaeed..ae652ca14b 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -465,7 +465,6 @@ static void ip6_copy_metadata(struct sk_buff *to, struct sk_buff *from)
        to->pkt_type = from->pkt_type;
        to->priority = from->priority;
        to->protocol = from->protocol;
-        to->security = from->security;
        dst_release(to->dst);
        to->dst = dst_clone(from->dst);
        to->dev = from->dev;
@@ -793,13 +792,8 @@ int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
        if (ipv6_addr_any(&fl->fl6_src)) {
                err = ipv6_get_saddr(*dst, &fl->fl6_dst, &fl->fl6_src);
-                if (err) {
+                if (err)
-#if IP6_DEBUG >= 2
-                        printk(KERN_DEBUG "ip6_dst_lookup: "
-                               "no available source address\n");
-#endif
                        goto out_err_release;
-                }
        }
        return 0;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index ba3b0c267f..0961372940 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -1110,11 +1110,39 @@ ip6ip6_fb_tnl_dev_init(struct net_device *dev)
        return 0;
 }
+#ifdef CONFIG_INET6_TUNNEL
 static struct xfrm6_tunnel ip6ip6_handler = {
-        .handler = ip6ip6_rcv,
+        .handler        = ip6ip6_rcv,
-        .err_handler = ip6ip6_err,
+        .err_handler    = ip6ip6_err,
 };
+static inline int ip6ip6_register(void)
+{
+        return xfrm6_tunnel_register(&ip6ip6_handler);
+}
+static inline int ip6ip6_unregister(void)
+{
+        return xfrm6_tunnel_deregister(&ip6ip6_handler);
+}
+#else
+static struct inet6_protocol xfrm6_tunnel_protocol = {
+        .handler        = ip6ip6_rcv,
+        .err_handler    = ip6ip6_err,
+        .flags          = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
+};
+static inline int ip6ip6_register(void)
+{
+        return inet6_add_protocol(&xfrm6_tunnel_protocol, IPPROTO_IPV6);
+}
+static inline int ip6ip6_unregister(void)
+{
+        return inet6_del_protocol(&xfrm6_tunnel_protocol, IPPROTO_IPV6);
+}
+#endif
 /**
 * ip6_tunnel_init - register protocol and reserve needed resources
 *
@@ -1125,7 +1153,7 @@ static int __init ip6_tunnel_init(void)
 {
        int  err;
-        if (xfrm6_tunnel_register(&ip6ip6_handler) < 0) {
+        if (ip6ip6_register() < 0) {
                printk(KERN_ERR "ip6ip6 init: can't register tunnel\n");
                return -EAGAIN;
        }
@@ -1144,7 +1172,7 @@ static int __init ip6_tunnel_init(void)
        }
        return 0;
 fail:
-        xfrm6_tunnel_deregister(&ip6ip6_handler);
+        ip6ip6_unregister();
        return err;
 }
@@ -1154,7 +1182,7 @@ fail:
 static void __exit ip6_tunnel_cleanup(void)
 {
-        if (xfrm6_tunnel_deregister(&ip6ip6_handler) < 0)
+        if (ip6ip6_unregister() < 0)
                printk(KERN_INFO "ip6ip6 close: can't deregister tunnel\n");
        unregister_netdev(ip6ip6_fb_tnl_dev);
diff --git a/net/ipv6/ipcomp6.c b/net/ipv6/ipcomp6.c
index 423feb46cc..135383ef53 100644
--- a/net/ipv6/ipcomp6.c
+++ b/net/ipv6/ipcomp6.c
@@ -354,7 +354,7 @@ static struct crypto_tfm **ipcomp6_alloc_tfms(const char *alg_name)
        int cpu;
        /* This can be any valid CPU ID so we don't need locking. */
-        cpu = smp_processor_id();
+        cpu = raw_smp_processor_id();
        list_for_each_entry(pos, &ipcomp6_tfms_list, list) {
                struct crypto_tfm *tfm;
diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index f3ef4c38d3..3bc144a79f 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -504,6 +504,9 @@ done:
                break;
        case IPV6_IPSEC_POLICY:
        case IPV6_XFRM_POLICY:
+                retv = -EPERM;
+                if (!capable(CAP_NET_ADMIN))
+                        break;
                retv = xfrm_user_policy(sk, optname, optval, optlen);
                break;
diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
index 562fcd14fd..29fed6e58d 100644
--- a/net/ipv6/mcast.c
+++ b/net/ipv6/mcast.c
@@ -281,7 +281,7 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, struct in6_addr *addr)
        }
        write_unlock_bh(&ipv6_sk_mc_lock);
-        return -ENOENT;
+        return -EADDRNOTAVAIL;
 }
 static struct inet6_dev *ip6_mc_find_dev(struct in6_addr *group, int ifindex)
@@ -386,12 +386,16 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
                if (ipv6_addr_equal(&pmc->addr, group))
                        break;
        }
-        if (!pmc)               /* must have a prior join */
+        if (!pmc) {             /* must have a prior join */
+                err = -EINVAL;
                goto done;
+        }
        /* if a source filter was set, must be the same mode as before */
        if (pmc->sflist) {
-                if (pmc->sfmode != omode)
+                if (pmc->sfmode != omode) {
+                        err = -EINVAL;
                        goto done;
+                }
        } else if (pmc->sfmode != omode) {
                /* allow mode switches for empty-set filters */
                ip6_mc_add_src(idev, group, omode, 0, NULL, 0);
@@ -402,7 +406,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
        psl = pmc->sflist;
        if (!add) {
                if (!psl)
-                        goto done;
+                        goto done;      /* err = -EADDRNOTAVAIL */
                rv = !0;
                for (i=0; i<psl->sl_count; i++) {
                        rv = memcmp(&psl->sl_addr[i], source,
@@ -411,7 +415,7 @@ int ip6_mc_source(int add, int omode, struct sock *sk,
                                break;
                }
                if (rv)         /* source not found */
-                        goto done;
+                        goto done;      /* err = -EADDRNOTAVAIL */
                /* special case - (INCLUDE, empty) == LEAVE_GROUP */
                if (psl->sl_count == 1 && omode == MCAST_INCLUDE) {
@@ -488,6 +492,7 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
        struct inet6_dev *idev;
        struct ipv6_pinfo *inet6 = inet6_sk(sk);
        struct ip6_sf_socklist *newpsl, *psl;
+        int leavegroup = 0;
        int i, err;
        group = &((struct sockaddr_in6 *)&gsf->gf_group)->sin6_addr;
@@ -503,7 +508,12 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
        if (!idev)
                return -ENODEV;
        dev = idev->dev;
-        err = -EADDRNOTAVAIL;
+        err = 0;
+        if (gsf->gf_fmode == MCAST_INCLUDE && gsf->gf_numsrc == 0) {
+                leavegroup = 1;
+                goto done;
+        }
        for (pmc=inet6->ipv6_mc_list; pmc; pmc=pmc->next) {
                if (pmc->ifindex != gsf->gf_interface)
@@ -511,8 +521,10 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
                if (ipv6_addr_equal(&pmc->addr, group))
                        break;
        }
-        if (!pmc)               /* must have a prior join */
+        if (!pmc) {             /* must have a prior join */
+                err = -EINVAL;
                goto done;
+        }
        if (gsf->gf_numsrc) {
                newpsl = (struct ip6_sf_socklist *)sock_kmalloc(sk,
                                IP6_SFLSIZE(gsf->gf_numsrc), GFP_ATOMIC);
@@ -544,10 +556,13 @@ int ip6_mc_msfilter(struct sock *sk, struct group_filter *gsf)
                (void) ip6_mc_del_src(idev, group, pmc->sfmode, 0, NULL, 0);
        pmc->sflist = newpsl;
        pmc->sfmode = gsf->gf_fmode;
+        err = 0;
 done:
        read_unlock_bh(&idev->lock);
        in6_dev_put(idev);
        dev_put(dev);
+        if (leavegroup)
+                err = ipv6_sock_mc_drop(sk, gsf->gf_interface, group);
        return err;
 }
diff --git a/net/ipv6/netfilter/ip6_queue.c b/net/ipv6/netfilter/ip6_queue.c
index 750943e2d3..a16df5b27c 100644
--- a/net/ipv6/netfilter/ip6_queue.c
+++ b/net/ipv6/netfilter/ip6_queue.c
@@ -76,7 +76,9 @@ static DECLARE_MUTEX(ipqnl_sem);
 static void
 ipq_issue_verdict(struct ipq_queue_entry *entry, int verdict)
 {
+        local_bh_disable();
        nf_reinject(entry->skb, entry->info, verdict);
+        local_bh_enable();
        kfree(entry);
 }
@@ -209,6 +211,12 @@ ipq_build_packet_message(struct ipq_queue_entry *entry, int *errp)
                break;
        
        case IPQ_COPY_PACKET:
+                if (entry->skb->ip_summed == CHECKSUM_HW &&
+                    (*errp = skb_checksum_help(entry->skb,
+                                               entry->info->outdev == NULL))) {
+                        read_unlock_bh(&queue_lock);
+                        return NULL;
+                }
                if (copy_range == 0 || copy_range > entry->skb->len)
                        data_len = entry->skb->len;
                else
@@ -379,6 +387,7 @@ ipq_mangle_ipv6(ipq_verdict_msg_t *v, struct ipq_queue_entry *e)
        if (!skb_ip_make_writable(&e->skb, v->data_len))
                return -ENOMEM;
        memcpy(e->skb->data, v->payload, v->data_len);
+        e->skb->ip_summed = CHECKSUM_NONE;
        e->skb->nfcache |= NFC_ALTERED;
        /*
diff --git a/net/ipv6/netfilter/ip6t_LOG.c b/net/ipv6/netfilter/ip6t_LOG.c
index c44685e391..a692e26a4f 100644
--- a/net/ipv6/netfilter/ip6t_LOG.c
+++ b/net/ipv6/netfilter/ip6t_LOG.c
@@ -373,9 +373,10 @@ ip6t_log_packet(unsigned int hooknum,
                in ? in->name : "",
                out ? out->name : "");
        if (in && !out) {
+                unsigned int len;
                /* MAC logging for input chain only. */
                printk("MAC=");
-                if (skb->dev && skb->dev->hard_header_len &&
+                if (skb->dev && (len = skb->dev->hard_header_len) &&
                    skb->mac.raw != skb->nh.raw) {
                        unsigned char *p = skb->mac.raw;
                        int i;
@@ -384,9 +385,11 @@ ip6t_log_packet(unsigned int hooknum,
                            (p -= ETH_HLEN) < skb->head)
                                p = NULL;
-                        if (p != NULL)
+                        if (p != NULL) {
-                                for (i = 0; i < skb->dev->hard_header_len; i++)
+                                for (i = 0; i < len; i++)
-                                        printk("%02x", p[i]);
+                                        printk("%02x%s", p[i],
+                                               i == len - 1 ? "" : ":");
+                        }
                        printk(" ");
                        if (skb->dev->type == ARPHRD_SIT) {
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index e2b848ec98..1d4d75b34d 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -328,6 +328,8 @@ int rawv6_rcv(struct sock *sk, struct sk_buff *skb)
        if (skb->ip_summed != CHECKSUM_UNNECESSARY) {
                if (skb->ip_summed == CHECKSUM_HW) {
+                        skb_postpull_rcsum(skb, skb->nh.raw,
+                                           skb->h.raw - skb->nh.raw);
                        skb->ip_summed = CHECKSUM_UNNECESSARY;
                        if (csum_ipv6_magic(&skb->nh.ipv6h->saddr,
                                            &skb->nh.ipv6h->daddr,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index b788f55e13..e553e5b80d 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -195,7 +195,6 @@ static struct ip_tunnel * ipip6_tunnel_locate(struct ip_tunnel_parm *parms, int
        dev_hold(dev);
        ipip6_tunnel_link(nt);
-        /* Do not decrement MOD_USE_COUNT here. */
        return nt;
 failed:
@@ -794,10 +793,28 @@ static struct net_protocol sit_protocol = {
        .err_handler    =       ipip6_err,
 };
+static void __exit sit_destroy_tunnels(void)
+{
+        int prio;
+        for (prio = 1; prio < 4; prio++) {
+                int h;
+                for (h = 0; h < HASH_SIZE; h++) {
+                        struct ip_tunnel *t;
+                        while ((t = tunnels[prio][h]) != NULL)
+                                unregister_netdevice(t->dev);
+                }
+        }
+}
 void __exit sit_cleanup(void)
 {
        inet_del_protocol(&sit_protocol, IPPROTO_IPV6);
-        unregister_netdev(ipip6_fb_tunnel_dev);
+        rtnl_lock();
+        sit_destroy_tunnels();
+        unregister_netdevice(ipip6_fb_tunnel_dev);
+        rtnl_unlock();
 }
 int __init sit_init(void)
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2414937f2a..ef29cfd936 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -158,9 +158,14 @@ static int tcp_v6_get_port(struct sock *sk, unsigned short snum)
                tcp_port_rover = rover;
                spin_unlock(&tcp_portalloc_lock);
-                /* Exhausted local port range during search? */
+                /* Exhausted local port range during search?  It is not
+                 * possible for us to be holding one of the bind hash
+                 * locks if this test triggers, because if 'remaining'
+                 * drops to zero, we broke out of the do/while loop at
+                 * the top level, not from the 'break;' statement.
+                 */
                ret = 1;
-                if (remaining <= 0)
+                if (unlikely(remaining <= 0))
                        goto fail;
                /* OK, here is the one we will use. */
@@ -2018,14 +2023,14 @@ static int tcp_v6_init_sock(struct sock *sk)
         */
        tp->snd_ssthresh = 0x7fffffff;
        tp->snd_cwnd_clamp = ~0;
-        tp->mss_cache_std = tp->mss_cache = 536;
+        tp->mss_cache = 536;
        tp->reordering = sysctl_tcp_reordering;
        sk->sk_state = TCP_CLOSE;
        tp->af_specific = &ipv6_specific;
+        tp->ca_ops = &tcp_init_congestion_ops;
        sk->sk_write_space = sk_stream_write_space;
        sock_set_flag(sk, SOCK_USE_WRITE_QUEUE);