Update to FreeBSD head 2017-01-09

Git mirror commit 1f8e4a995a6ede4bdb24e6d335ccda2bdb0175ab.

6 files changed, 369 insertions, 58 deletions

diff --git a/freebsd/sys/netinet6/in6_var.h b/freebsd/sys/netinet6/in6_var.h
index 77e5920b..d7c10384 100644
--- a/freebsd/sys/netinet6/in6_var.h
+++ b/freebsd/sys/netinet6/in6_var.h
@@ -819,6 +819,7 @@ void	in6_newaddrmsg(struct in6_ifaddr *, int);
 /*
  * Extended API for IPv6 FIB support.
  */
+struct mbuf *ip6_tryforward(struct mbuf *);
 void	in6_rtredirect(struct sockaddr *, struct sockaddr *, struct sockaddr *,
 	    int, struct sockaddr *, u_int);
 int	in6_rtrequest(int, struct sockaddr *, struct sockaddr *,
diff --git a/freebsd/sys/netinet6/ip6_fastfwd.c b/freebsd/sys/netinet6/ip6_fastfwd.c
new file mode 100644
index 00000000..8ce6a87e
--- /dev/null
+++ b/freebsd/sys/netinet6/ip6_fastfwd.c
@@ -0,0 +1,297 @@
+#include <machine/rtems-bsd-kernel-space.h>
+
+/*-
+ * Copyright (c) 2014-2016 Andrey V. Elsukov <ae@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
+ * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
+ * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
+ * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
+ * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <rtems/bsd/local/opt_inet6.h>
+#include <rtems/bsd/local/opt_ipstealth.h>
+
+#include <rtems/bsd/sys/param.h>
+#include <sys/systm.h>
+#include <sys/mbuf.h>
+#include <sys/socket.h>
+#include <sys/kernel.h>
+#include <sys/sysctl.h>
+
+#include <net/if.h>
+#include <net/if_var.h>
+#include <net/route.h>
+#include <net/pfil.h>
+#include <net/vnet.h>
+
+#include <netinet/in.h>
+#include <netinet/in_kdtrace.h>
+#include <netinet/in_var.h>
+#include <netinet/ip_var.h>
+#include <netinet/ip6.h>
+#include <netinet/icmp6.h>
+#include <netinet6/in6_var.h>
+#include <netinet6/in6_fib.h>
+#include <netinet6/ip6_var.h>
+#include <netinet6/nd6.h>
+
+static int
+ip6_findroute(struct nhop6_basic *pnh, const struct sockaddr_in6 *dst,
+    struct mbuf *m)
+{
+
+	if (fib6_lookup_nh_basic(M_GETFIB(m), &dst->sin6_addr,
+	    dst->sin6_scope_id, 0, dst->sin6_flowinfo, pnh) != 0) {
+		IP6STAT_INC(ip6s_noroute);
+		IP6STAT_INC(ip6s_cantforward);
+		icmp6_error(m, ICMP6_DST_UNREACH,
+		    ICMP6_DST_UNREACH_NOROUTE, 0);
+		return (EHOSTUNREACH);
+	}
+	if (pnh->nh_flags & NHF_BLACKHOLE) {
+		IP6STAT_INC(ip6s_cantforward);
+		m_freem(m);
+		return (EHOSTUNREACH);
+	}
+
+	if (pnh->nh_flags & NHF_REJECT) {
+		IP6STAT_INC(ip6s_cantforward);
+		icmp6_error(m, ICMP6_DST_UNREACH,
+		    ICMP6_DST_UNREACH_REJECT, 0);
+		return (EHOSTUNREACH);
+	}
+	return (0);
+}
+
+struct mbuf*
+ip6_tryforward(struct mbuf *m)
+{
+	struct sockaddr_in6 dst;
+	struct nhop6_basic nh;
+	struct m_tag *fwd_tag;
+	struct ip6_hdr *ip6;
+	struct ifnet *rcvif;
+	uint32_t plen;
+	int error;
+
+	/*
+	 * Fallback conditions to ip6_input for slow path processing.
+	 */
+	ip6 = mtod(m, struct ip6_hdr *);
+	if (ip6->ip6_nxt == IPPROTO_HOPOPTS ||
+	    IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
+	    IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst) ||
+	    IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src) ||
+	    IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) ||
+	    in6_localip(&ip6->ip6_dst))
+		return (m);
+	/*
+	 * Check that the amount of data in the buffers
+	 * is as at least much as the IPv6 header would have us expect.
+	 * Trim mbufs if longer than we expect.
+	 * Drop packet if shorter than we expect.
+	 */
+	rcvif = m->m_pkthdr.rcvif;
+	plen = ntohs(ip6->ip6_plen);
+	if (plen == 0) {
+		/*
+		 * Jumbograms must have hop-by-hop header and go via
+		 * slow path.
+		 */
+		IP6STAT_INC(ip6s_badoptions);
+		goto dropin;
+	}
+	if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
+		IP6STAT_INC(ip6s_tooshort);
+		in6_ifstat_inc(rcvif, ifs6_in_truncated);
+		goto dropin;
+	}
+	if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
+		if (m->m_len == m->m_pkthdr.len) {
+			m->m_len = sizeof(struct ip6_hdr) + plen;
+			m->m_pkthdr.len = sizeof(struct ip6_hdr) + plen;
+		} else
+			m_adj(m, sizeof(struct ip6_hdr) + plen -
+			    m->m_pkthdr.len);
+	}
+
+	/*
+	 * Hop limit.
+	 */
+#ifdef IPSTEALTH
+	if (!V_ip6stealth)
+#endif
+	if (ip6->ip6_hlim <= IPV6_HLIMDEC) {
+		icmp6_error(m, ICMP6_TIME_EXCEEDED,
+		    ICMP6_TIME_EXCEED_TRANSIT, 0);
+		m = NULL;
+		goto dropin;
+	}
+
+	bzero(&dst, sizeof(dst));
+	dst.sin6_family = AF_INET6;
+	dst.sin6_len = sizeof(dst);
+	dst.sin6_addr = ip6->ip6_dst;
+
+	/*
+	 * Incoming packet firewall processing.
+	 */
+	if (!PFIL_HOOKED(&V_inet6_pfil_hook))
+		goto passin;
+	if (pfil_run_hooks(&V_inet6_pfil_hook, &m, rcvif, PFIL_IN,
+	    NULL) != 0 || m == NULL)
+		goto dropin;
+	/*
+	 * If packet filter sets the M_FASTFWD_OURS flag, this means
+	 * that new destination or next hop is our local address.
+	 * So, we can just go back to ip6_input.
+	 * XXX: should we decrement ip6_hlim in such case?
+	 *
+	 * Also it can forward packet to another destination, e.g.
+	 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
+	 */
+	if (m->m_flags & M_FASTFWD_OURS)
+		return (m);
+
+	ip6 = mtod(m, struct ip6_hdr *);
+	if ((m->m_flags & M_IP6_NEXTHOP) &&
+	    (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
+		/*
+		 * Now we will find route to forwarded by pfil destination.
+		 */
+		bcopy((fwd_tag + 1), &dst, sizeof(dst));
+		m->m_flags &= ~M_IP6_NEXTHOP;
+		m_tag_delete(m, fwd_tag);
+	} else {
+		/* Update dst since pfil could change it */
+		dst.sin6_addr = ip6->ip6_dst;
+	}
+passin:
+	/*
+	 * Find route to destination.
+	 */
+	if (ip6_findroute(&nh, &dst, m) != 0) {
+		m = NULL;
+		in6_ifstat_inc(rcvif, ifs6_in_noroute);
+		goto dropin;
+	}
+	/*
+	 * We used slow path processing for packets with scoped addresses.
+	 * So, scope checks aren't needed here.
+	 */
+	if (m->m_pkthdr.len > nh.nh_mtu) {
+		in6_ifstat_inc(nh.nh_ifp, ifs6_in_toobig);
+		icmp6_error(m, ICMP6_PACKET_TOO_BIG, 0, nh.nh_mtu);
+		m = NULL;
+		goto dropout;
+	}
+
+	/*
+	 * Outgoing packet firewall processing.
+	 */
+	if (!PFIL_HOOKED(&V_inet6_pfil_hook))
+		goto passout;
+	if (pfil_run_hooks(&V_inet6_pfil_hook, &m, nh.nh_ifp, PFIL_OUT,
+	    NULL) != 0 || m == NULL)
+		goto dropout;
+	/*
+	 * If packet filter sets the M_FASTFWD_OURS flag, this means
+	 * that new destination or next hop is our local address.
+	 * So, we can just go back to ip6_input.
+	 *
+	 * Also it can forward packet to another destination, e.g.
+	 * M_IP6_NEXTHOP flag is set and fwd_tag is attached to mbuf.
+	 */
+	if (m->m_flags & M_FASTFWD_OURS) {
+		/*
+		 * XXX: we did one hop and should decrement hop limit. But
+		 * now we are the destination and just don't pay attention.
+		 */
+		return (m);
+	}
+	/*
+	 * Again. A packet filter could change the destination address.
+	 */
+	ip6 = mtod(m, struct ip6_hdr *);
+	if (m->m_flags & M_IP6_NEXTHOP)
+		fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
+	else
+		fwd_tag = NULL;
+
+	if (fwd_tag != NULL ||
+	    !IN6_ARE_ADDR_EQUAL(&dst.sin6_addr, &ip6->ip6_dst)) {
+		if (fwd_tag != NULL) {
+			bcopy((fwd_tag + 1), &dst, sizeof(dst));
+			m->m_flags &= ~M_IP6_NEXTHOP;
+			m_tag_delete(m, fwd_tag);
+		} else
+			dst.sin6_addr = ip6->ip6_dst;
+		/*
+		 * Redo route lookup with new destination address
+		 */
+		if (ip6_findroute(&nh, &dst, m) != 0) {
+			m = NULL;
+			goto dropout;
+		}
+	}
+passout:
+#ifdef IPSTEALTH
+	if (!V_ip6stealth)
+#endif
+	{
+		ip6->ip6_hlim -= IPV6_HLIMDEC;
+	}
+
+	m_clrprotoflags(m);	/* Avoid confusing lower layers. */
+	IP_PROBE(send, NULL, NULL, ip6, nh.nh_ifp, NULL, ip6);
+
+	/*
+	 * XXX: we need to use destination address with embedded scope
+	 * zone id, because LLTABLE uses such form of addresses for lookup.
+	 */
+	dst.sin6_addr = nh.nh_addr;
+	if (IN6_IS_SCOPE_LINKLOCAL(&dst.sin6_addr))
+		dst.sin6_addr.s6_addr16[1] = htons(nh.nh_ifp->if_index & 0xffff);
+
+	error = (*nh.nh_ifp->if_output)(nh.nh_ifp, m,
+	    (struct sockaddr *)&dst, NULL);
+	if (error != 0) {
+		in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard);
+		IP6STAT_INC(ip6s_cantforward);
+	} else {
+		in6_ifstat_inc(nh.nh_ifp, ifs6_out_forward);
+		IP6STAT_INC(ip6s_forward);
+	}
+	return (NULL);
+dropin:
+	in6_ifstat_inc(rcvif, ifs6_in_discard);
+	goto drop;
+dropout:
+	in6_ifstat_inc(nh.nh_ifp, ifs6_out_discard);
+drop:
+	if (m != NULL)
+		m_freem(m);
+	return (NULL);
+}
+
diff --git a/freebsd/sys/netinet6/ip6_input.c b/freebsd/sys/netinet6/ip6_input.c
index 6af5acd7..e34ac0e6 100644
--- a/freebsd/sys/netinet6/ip6_input.c
+++ b/freebsd/sys/netinet6/ip6_input.c
@@ -121,6 +121,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet6/in6_rss.h>
 
 #ifdef IPSEC
+#include <netipsec/key.h>
 #include <netipsec/ipsec.h>
 #include <netinet6/ip6_ipsec.h>
 #include <netipsec/ipsec6.h>
@@ -550,12 +551,20 @@ ip6_input(struct mbuf *m)
 	struct in6_addr odst;
 	struct ip6_hdr *ip6;
 	struct in6_ifaddr *ia;
+	struct ifnet *rcvif;
 	u_int32_t plen;
 	u_int32_t rtalert = ~0;
 	int off = sizeof(struct ip6_hdr), nest;
 	int nxt, ours = 0;
 	int srcrt = 0;
 
+	/*
+	 * Drop the packet if IPv6 operation is disabled on the interface.
+	 */
+	rcvif = m->m_pkthdr.rcvif;
+	if ((ND_IFINFO(rcvif)->flags & ND6_IFF_IFDISABLED))
+		goto bad;
+
 #ifdef IPSEC
 	/*
 	 * should the inner packet be considered authentic?
@@ -590,20 +599,15 @@ ip6_input(struct mbuf *m)
 		if (m->m_next) {
 			if (m->m_flags & M_LOOP) {
 				IP6STAT_INC(ip6s_m2m[V_loif->if_index]);
-			} else if (m->m_pkthdr.rcvif->if_index < IP6S_M2MMAX)
-				IP6STAT_INC(
-				    ip6s_m2m[m->m_pkthdr.rcvif->if_index]);
+			} else if (rcvif->if_index < IP6S_M2MMAX)
+				IP6STAT_INC(ip6s_m2m[rcvif->if_index]);
 			else
 				IP6STAT_INC(ip6s_m2m[0]);
 		} else
 			IP6STAT_INC(ip6s_m1);
 	}
 
-	/* drop the packet if IPv6 operation is disabled on the IF */
-	if ((ND_IFINFO(m->m_pkthdr.rcvif)->flags & ND6_IFF_IFDISABLED))
-		goto bad;
-
-	in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_receive);
+	in6_ifstat_inc(rcvif, ifs6_in_receive);
 	IP6STAT_INC(ip6s_total);
 
 #ifndef PULLDOWN_TEST
@@ -619,10 +623,8 @@ ip6_input(struct mbuf *m)
 			n = m_getcl(M_NOWAIT, MT_DATA, M_PKTHDR);
 		else
 			n = m_gethdr(M_NOWAIT, MT_DATA);
-		if (n == NULL) {
-			m_freem(m);
-			return;	/* ENOBUFS */
-		}
+		if (n == NULL)
+			goto bad;
 
 		m_move_pkthdr(n, m);
 		m_copydata(m, 0, n->m_pkthdr.len, mtod(n, caddr_t));
@@ -634,26 +636,22 @@ ip6_input(struct mbuf *m)
 #endif
 
 	if (m->m_len < sizeof(struct ip6_hdr)) {
-		struct ifnet *inifp;
-		inifp = m->m_pkthdr.rcvif;
 		if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
 			IP6STAT_INC(ip6s_toosmall);
-			in6_ifstat_inc(inifp, ifs6_in_hdrerr);
-			return;
+			in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
+			goto bad;
 		}
 	}
 
 	ip6 = mtod(m, struct ip6_hdr *);
-
 	if ((ip6->ip6_vfc & IPV6_VERSION_MASK) != IPV6_VERSION) {
 		IP6STAT_INC(ip6s_badvers);
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_hdrerr);
+		in6_ifstat_inc(rcvif, ifs6_in_hdrerr);
 		goto bad;
 	}
 
 	IP6STAT_INC(ip6s_nxthist[ip6->ip6_nxt]);
-
-	IP_PROBE(receive, NULL, NULL, ip6, m->m_pkthdr.rcvif, NULL, ip6);
+	IP_PROBE(receive, NULL, NULL, ip6, rcvif, NULL, ip6);
 
 	/*
 	 * Check against address spoofing/corruption.
@@ -664,7 +662,7 @@ ip6_input(struct mbuf *m)
 		 * XXX: "badscope" is not very suitable for a multicast source.
 		 */
 		IP6STAT_INC(ip6s_badscope);
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
+		in6_ifstat_inc(rcvif, ifs6_in_addrerr);
 		goto bad;
 	}
 	if (IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst) &&
@@ -676,7 +674,7 @@ ip6_input(struct mbuf *m)
 		 * as the outgoing/incoming interface.
 		 */
 		IP6STAT_INC(ip6s_badscope);
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
+		in6_ifstat_inc(rcvif, ifs6_in_addrerr);
 		goto bad;
 	}
 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
@@ -688,7 +686,7 @@ ip6_input(struct mbuf *m)
 		 * a packet is received, it must be silently dropped.
 		 */
 		IP6STAT_INC(ip6s_badscope);
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
+		in6_ifstat_inc(rcvif, ifs6_in_addrerr);
 		goto bad;
 	}
 #ifdef ALTQ
@@ -712,7 +710,7 @@ ip6_input(struct mbuf *m)
 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
 		IP6STAT_INC(ip6s_badscope);
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
+		in6_ifstat_inc(rcvif, ifs6_in_addrerr);
 		goto bad;
 	}
 #if 0
@@ -730,14 +728,36 @@ ip6_input(struct mbuf *m)
 		goto bad;
 	}
 #endif
+	/*
+	 * Try to forward the packet, but if we fail continue.
+	 * ip6_tryforward() does inbound and outbound packet firewall
+	 * processing. If firewall has decided that destination becomes
+	 * our local address, it sets M_FASTFWD_OURS flag. In this
+	 * case skip another inbound firewall processing and update
+	 * ip6 pointer.
+	 */
+	if (V_ip6_forwarding != 0
+#ifdef IPSEC
+	    && !key_havesp(IPSEC_DIR_INBOUND)
+	    && !key_havesp(IPSEC_DIR_OUTBOUND)
+#endif
+	    ) {
+		if ((m = ip6_tryforward(m)) == NULL)
+			return;
+		if (m->m_flags & M_FASTFWD_OURS) {
+			m->m_flags &= ~M_FASTFWD_OURS;
+			ours = 1;
+			ip6 = mtod(m, struct ip6_hdr *);
+			goto hbhcheck;
+		}
+	}
 #ifdef IPSEC
 	/*
 	 * Bypass packet filtering for packets previously handled by IPsec.
 	 */
 	if (ip6_ipsec_filtertunnel(m))
 		goto passin;
-#endif /* IPSEC */
-
+#endif
 	/*
 	 * Run through list of hooks for input packets.
 	 *
@@ -745,12 +765,12 @@ ip6_input(struct mbuf *m)
 	 *     (e.g. by NAT rewriting).  When this happens,
 	 *     tell ip6_forward to do the right thing.
 	 */
-	odst = ip6->ip6_dst;
 
 	/* Jump over all PFIL processing if hooks are not active. */
 	if (!PFIL_HOOKED(&V_inet6_pfil_hook))
 		goto passin;
 
+	odst = ip6->ip6_dst;
 	if (pfil_run_hooks(&V_inet6_pfil_hook, &m,
 	    m->m_pkthdr.rcvif, PFIL_IN, NULL))
 		return;
@@ -790,8 +810,8 @@ passin:
 		IP6STAT_INC(ip6s_badscope); /* XXX */
 		goto bad;
 	}
-	if (in6_setscope(&ip6->ip6_src, m->m_pkthdr.rcvif, NULL) ||
-	    in6_setscope(&ip6->ip6_dst, m->m_pkthdr.rcvif, NULL)) {
+	if (in6_setscope(&ip6->ip6_src, rcvif, NULL) ||
+	    in6_setscope(&ip6->ip6_dst, rcvif, NULL)) {
 		IP6STAT_INC(ip6s_badscope);
 		goto bad;
 	}
@@ -801,7 +821,7 @@ passin:
 	 */
 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
 		ours = 1;
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mcast);
+		in6_ifstat_inc(rcvif, ifs6_in_mcast);
 		goto hbhcheck;
 	}
 	/*
@@ -836,7 +856,6 @@ passin:
 	 */
 	if (!V_ip6_forwarding) {
 		IP6STAT_INC(ip6s_cantforward);
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
 		goto bad;
 	}
 
@@ -868,7 +887,7 @@ passin:
 	 */
 	if (m->m_pkthdr.len - sizeof(struct ip6_hdr) < plen) {
 		IP6STAT_INC(ip6s_tooshort);
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
+		in6_ifstat_inc(rcvif, ifs6_in_truncated);
 		goto bad;
 	}
 	if (m->m_pkthdr.len > sizeof(struct ip6_hdr) + plen) {
@@ -895,10 +914,8 @@ passin:
 		 * XXX TODO: Check hlim and multicast scope here to avoid
 		 * unnecessarily calling into ip6_mforward().
 		 */
-		if (ip6_mforward &&
-		    ip6_mforward(ip6, m->m_pkthdr.rcvif, m)) {
+		if (ip6_mforward && ip6_mforward(ip6, rcvif, m)) {
 			IP6STAT_INC(ip6s_cantforward);
-			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_discard);
 			goto bad;
 		}
 	} else if (!ours) {
@@ -920,7 +937,7 @@ passin:
 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
 		IP6STAT_INC(ip6s_badscope);
-		in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_addrerr);
+		in6_ifstat_inc(rcvif, ifs6_in_addrerr);
 		goto bad;
 	}
 
@@ -928,7 +945,7 @@ passin:
 	 * Tell launch routine the next header
 	 */
 	IP6STAT_INC(ip6s_delivered);
-	in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_deliver);
+	in6_ifstat_inc(rcvif, ifs6_in_deliver);
 	nest = 0;
 
 	while (nxt != IPPROTO_DONE) {
@@ -943,7 +960,7 @@ passin:
 		 */
 		if (m->m_pkthdr.len < off) {
 			IP6STAT_INC(ip6s_tooshort);
-			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_truncated);
+			in6_ifstat_inc(rcvif, ifs6_in_truncated);
 			goto bad;
 		}
 
@@ -961,7 +978,9 @@ passin:
 	}
 	return;
 bad:
-	m_freem(m);
+	in6_ifstat_inc(rcvif, ifs6_in_discard);
+	if (m != NULL)
+		m_freem(m);
 }
 
 /*
diff --git a/freebsd/sys/netinet6/nd6.c b/freebsd/sys/netinet6/nd6.c
index 3e019a62..757130b8 100644
--- a/freebsd/sys/netinet6/nd6.c
+++ b/freebsd/sys/netinet6/nd6.c
@@ -912,7 +912,7 @@ nd6_timer(void *arg)
 	struct nd_defrouter *dr, *ndr;
 	struct nd_prefix *pr, *npr;
 	struct in6_ifaddr *ia6, *nia6;
-	bool onlink_locked;
+	uint64_t genid;
 
 	TAILQ_INIT(&drq);
 	LIST_INIT(&prl);
@@ -1024,7 +1024,6 @@ nd6_timer(void *arg)
 	}
 
 	ND6_WLOCK();
-	onlink_locked = false;
 restart:
 	LIST_FOREACH_SAFE(pr, &V_nd_prefix, ndpr_entry, npr) {
 		/*
@@ -1047,22 +1046,19 @@ restart:
 			continue;
 		}
 		if ((pr->ndpr_stateflags & NDPRF_ONLINK) != 0) {
-			if (!onlink_locked) {
-				onlink_locked = ND6_ONLINK_TRYLOCK();
-				if (!onlink_locked) {
-					ND6_WUNLOCK();
-					ND6_ONLINK_LOCK();
-					onlink_locked = true;
-					ND6_WLOCK();
-					goto restart;
-				}
-			}
+			genid = V_nd6_list_genid;
+			nd6_prefix_ref(pr);
+			ND6_WUNLOCK();
+			ND6_ONLINK_LOCK();
 			(void)nd6_prefix_offlink(pr);
+			ND6_ONLINK_UNLOCK();
+			ND6_WLOCK();
+			nd6_prefix_rele(pr);
+			if (genid != V_nd6_list_genid)
+				goto restart;
 		}
 	}
 	ND6_WUNLOCK();
-	if (onlink_locked)
-		ND6_ONLINK_UNLOCK();
 
 	while ((pr = LIST_FIRST(&prl)) != NULL) {
 		LIST_REMOVE(pr, ndpr_entry);
diff --git a/freebsd/sys/netinet6/nd6_rtr.c b/freebsd/sys/netinet6/nd6_rtr.c
index 33d8fa2a..f1ef143e 100644
--- a/freebsd/sys/netinet6/nd6_rtr.c
+++ b/freebsd/sys/netinet6/nd6_rtr.c
@@ -1124,8 +1124,6 @@ void
 nd6_prefix_unlink(struct nd_prefix *pr, struct nd_prhead *list)
 {
 
-	KASSERT(pr->ndpr_addrcnt == 0,
-	    ("prefix %p has referencing addresses", pr));
 	ND6_WLOCK_ASSERT();
 
 	LIST_REMOVE(pr, ndpr_entry);
diff --git a/freebsd/sys/netinet6/sctp6_usrreq.c b/freebsd/sys/netinet6/sctp6_usrreq.c
index 735de62a..751c18fd 100644
--- a/freebsd/sys/netinet6/sctp6_usrreq.c
+++ b/freebsd/sys/netinet6/sctp6_usrreq.c
@@ -308,7 +308,7 @@ sctp6_ctlinput(int cmd, struct sockaddr *pktdst, void *d)
 		 * verification tag of the SCTP common header.
 		 */
 		if (ip6cp->ip6c_m->m_pkthdr.len <
-		    (int32_t) (ip6cp->ip6c_off + offsetof(struct sctphdr, checksum))) {
+		    (int32_t)(ip6cp->ip6c_off + offsetof(struct sctphdr, checksum))) {
 			return;
 		}
 		/* Copy out the port numbers and the verification tag. */
@@ -390,7 +390,7 @@ sctp6_ctlinput(int cmd, struct sockaddr *pktdst, void *d)
 			sctp6_notify(inp, stcb, net,
 			    ip6cp->ip6c_icmp6->icmp6_type,
 			    ip6cp->ip6c_icmp6->icmp6_code,
-			    (uint16_t) ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
+			    (uint16_t)ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
 		} else {
 			if ((stcb == NULL) && (inp != NULL)) {
 				/* reduce inp's ref-count */
@@ -1003,7 +1003,7 @@ sctp6_getaddr(struct socket *so, struct sockaddr **addr)
 				return (ENOENT);
 			}
 			vrf_id = inp->def_vrf_id;
-			sctp_ifa = sctp_source_address_selection(inp, stcb, (sctp_route_t *) & net->ro, net, 0, vrf_id);
+			sctp_ifa = sctp_source_address_selection(inp, stcb, (sctp_route_t *)&net->ro, net, 0, vrf_id);
 			if (sctp_ifa) {
 				sin6->sin6_addr = sctp_ifa->address.sin6.sin6_addr;
 			}