int (*handler)(struct sk_buff *skb);
        int (*err_handler)(struct sk_buff *skb, struct inet6_skb_parm *opt,
                           u8 type, u8 code, int offset, __be32 info);
-       struct xfrm6_tunnel *next;
+       struct xfrm6_tunnel __rcu *next;
        int priority;
 };
 
 
 #include <net/gre.h>
 
 
-static const struct gre_protocol *gre_proto[GREPROTO_MAX] __read_mostly;
+static const struct gre_protocol __rcu *gre_proto[GREPROTO_MAX] __read_mostly;
 static DEFINE_SPINLOCK(gre_proto_lock);
 
 int gre_add_protocol(const struct gre_protocol *proto, u8 version)
                goto err_out;
 
        spin_lock(&gre_proto_lock);
-       if (gre_proto[version] != proto)
+       if (rcu_dereference_protected(gre_proto[version],
+                       lockdep_is_held(&gre_proto_lock)) != proto)
                goto err_out_unlock;
        rcu_assign_pointer(gre_proto[version], NULL);
        spin_unlock(&gre_proto_lock);
 
 #include <net/protocol.h>
 #include <net/xfrm.h>
 
-static struct xfrm6_tunnel *tunnel6_handlers __read_mostly;
-static struct xfrm6_tunnel *tunnel46_handlers __read_mostly;
+static struct xfrm6_tunnel __rcu *tunnel6_handlers __read_mostly;
+static struct xfrm6_tunnel __rcu *tunnel46_handlers __read_mostly;
 static DEFINE_MUTEX(tunnel6_mutex);
 
 int xfrm6_tunnel_register(struct xfrm6_tunnel *handler, unsigned short family)
 {
-       struct xfrm6_tunnel **pprev;
+       struct xfrm6_tunnel __rcu **pprev;
+       struct xfrm6_tunnel *t;
        int ret = -EEXIST;
        int priority = handler->priority;
 
        mutex_lock(&tunnel6_mutex);
 
        for (pprev = (family == AF_INET6) ? &tunnel6_handlers : &tunnel46_handlers;
-            *pprev; pprev = &(*pprev)->next) {
-               if ((*pprev)->priority > priority)
+            (t = rcu_dereference_protected(*pprev,
+                       lockdep_is_held(&tunnel6_mutex))) != NULL;
+            pprev = &t->next) {
+               if (t->priority > priority)
                        break;
-               if ((*pprev)->priority == priority)
+               if (t->priority == priority)
                        goto err;
        }
 
 
 int xfrm6_tunnel_deregister(struct xfrm6_tunnel *handler, unsigned short family)
 {
-       struct xfrm6_tunnel **pprev;
+       struct xfrm6_tunnel __rcu **pprev;
+       struct xfrm6_tunnel *t;
        int ret = -ENOENT;
 
        mutex_lock(&tunnel6_mutex);
 
        for (pprev = (family == AF_INET6) ? &tunnel6_handlers : &tunnel46_handlers;
-            *pprev; pprev = &(*pprev)->next) {
-               if (*pprev == handler) {
+            (t = rcu_dereference_protected(*pprev,
+                       lockdep_is_held(&tunnel6_mutex))) != NULL;
+            pprev = &t->next) {
+               if (t == handler) {
                        *pprev = handler->next;
                        ret = 0;
                        break;