Merge branches 'clockevents/4.4-fixes' and 'clockevents/4.5-fixes' of http://git.linaro.org/people/daniel.lezcano/linux into timers/urgent

Pull in fixes from Daniel Lezcano:

 - Fix the vt8500 timer leading to a system lock up when dealing with too
   small delta (Roman Volkov)

 - Select the CLKSRC_MMIO when the fsl_ftm_timer is enabled with COMPILE_TEST
   (Daniel Lezcano)

 - Prevent to compile timers using the 'iomem' API when the architecture has
   not HAS_IOMEM set (Richard Weinberger)

1 files changed, 20 insertions, 15 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index c5429a636f1a..6b8a8a9091fa 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -93,10 +93,9 @@ static void inet6_sk_rx_dst_set(struct sock *sk, const struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
 
-        if (dst) {
+        if (dst && dst_hold_safe(dst)) {
                 const struct rt6_info *rt = (const struct rt6_info *)dst;
 
-                dst_hold(dst);
                 sk->sk_rx_dst = dst;
                 inet_sk(sk)->rx_dst_ifindex = skb->skb_iif;
                 inet6_sk(sk)->rx_dst_cookie = rt6_get_cookie(rt);
@@ -120,6 +119,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         struct ipv6_pinfo *np = inet6_sk(sk);
         struct tcp_sock *tp = tcp_sk(sk);
         struct in6_addr *saddr = NULL, *final_p, final;
+        struct ipv6_txoptions *opt;
         struct flowi6 fl6;
         struct dst_entry *dst;
         int addr_type;
@@ -235,7 +235,8 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         fl6.fl6_dport = usin->sin6_port;
         fl6.fl6_sport = inet->inet_sport;
 
-        final_p = fl6_update_dst(&fl6, np->opt, &final);
+        opt = rcu_dereference_protected(np->opt, sock_owned_by_user(sk));
+        final_p = fl6_update_dst(&fl6, opt, &final);
 
         security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
 
@@ -255,7 +256,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
         inet->inet_rcv_saddr = LOOPBACK4_IPV6;
 
         sk->sk_gso_type = SKB_GSO_TCPV6;
-        __ip6_dst_store(sk, dst, NULL, NULL);
+        ip6_dst_store(sk, dst, NULL, NULL);
 
         if (tcp_death_row.sysctl_tw_recycle &&
             !tp->rx_opt.ts_recent_stamp &&
@@ -263,9 +264,9 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
                 tcp_fetch_timewait_stamp(sk, dst);
 
         icsk->icsk_ext_hdr_len = 0;
-        if (np->opt)
-                icsk->icsk_ext_hdr_len = (np->opt->opt_flen +
-                                          np->opt->opt_nflen);
+        if (opt)
+                icsk->icsk_ext_hdr_len = opt->opt_flen +
+                                         opt->opt_nflen;
 
         tp->rx_opt.mss_clamp = IPV6_MIN_MTU - sizeof(struct tcphdr) - sizeof(struct ipv6hdr);
 
@@ -461,7 +462,8 @@ static int tcp_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
                 if (np->repflow && ireq->pktopts)
                         fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));
 
-                err = ip6_xmit(sk, skb, fl6, np->opt, np->tclass);
+                err = ip6_xmit(sk, skb, fl6, rcu_dereference(np->opt),
+                               np->tclass);
                 err = net_xmit_eval(err);
         }
 
@@ -972,6 +974,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
         struct inet_request_sock *ireq;
         struct ipv6_pinfo *newnp;
         const struct ipv6_pinfo *np = inet6_sk(sk);
+        struct ipv6_txoptions *opt;
         struct tcp6_sock *newtcp6sk;
         struct inet_sock *newinet;
         struct tcp_sock *newtp;
@@ -1056,7 +1059,7 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
          */
 
         newsk->sk_gso_type = SKB_GSO_TCPV6;
-        __ip6_dst_store(newsk, dst, NULL, NULL);
+        ip6_dst_store(newsk, dst, NULL, NULL);
         inet6_sk_rx_dst_set(newsk, skb);
 
         newtcp6sk = (struct tcp6_sock *)newsk;
@@ -1098,13 +1101,15 @@ static struct sock *tcp_v6_syn_recv_sock(const struct sock *sk, struct sk_buff *
            but we make one more one thing there: reattach optmem
            to newsk.
          */
-        if (np->opt)
-                newnp->opt = ipv6_dup_options(newsk, np->opt);
-
+        opt = rcu_dereference(np->opt);
+        if (opt) {
+                opt = ipv6_dup_options(newsk, opt);
+                RCU_INIT_POINTER(newnp->opt, opt);
+        }
         inet_csk(newsk)->icsk_ext_hdr_len = 0;
-        if (newnp->opt)
-                inet_csk(newsk)->icsk_ext_hdr_len = (newnp->opt->opt_nflen +
-                                                     newnp->opt->opt_flen);
+        if (opt)
+                inet_csk(newsk)->icsk_ext_hdr_len = opt->opt_nflen +
+                                                    opt->opt_flen;
 
         tcp_ca_openreq_child(newsk, dst);