Merge tag 'drm-intel-next-fixes-2015-09-02' into drm-intel-next-queued

Backmerge -fixes since there's more DDI-E related cleanups on top of
the pile of -fixes for skl that just landed for 4.3.

Conflicts:
	drivers/gpu/drm/i915/intel_display.c
	drivers/gpu/drm/i914/intel_dp.c
	drivers/gpu/drm/i915/intel_lrc.c

Conflicts are all fairly harmless adjacent line stuff.

Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>

5 files changed, 91 insertions, 50 deletions

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 55d19861ab20..548c6237b1e7 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -172,6 +172,8 @@ static void rt6_free_pcpu(struct rt6_info *non_pcpu_rt)
                         *ppcpu_rt = NULL;
                 }
         }
+
+        non_pcpu_rt->rt6i_pcpu = NULL;
 }
 
 static void rt6_release(struct rt6_info *rt)
diff --git a/net/ipv6/mcast_snoop.c b/net/ipv6/mcast_snoop.c
index df8afe5ab31e..9405b04eecc6 100644
--- a/net/ipv6/mcast_snoop.c
+++ b/net/ipv6/mcast_snoop.c
@@ -143,34 +143,36 @@ static int __ipv6_mc_check_mld(struct sk_buff *skb,
         struct sk_buff *skb_chk = NULL;
         unsigned int transport_len;
         unsigned int len = skb_transport_offset(skb) + sizeof(struct mld_msg);
-        int ret;
+        int ret = -EINVAL;
 
         transport_len = ntohs(ipv6_hdr(skb)->payload_len);
         transport_len -= skb_transport_offset(skb) - sizeof(struct ipv6hdr);
 
-        skb_get(skb);
         skb_chk = skb_checksum_trimmed(skb, transport_len,
                                        ipv6_mc_validate_checksum);
         if (!skb_chk)
-                return -EINVAL;
+                goto err;
 
-        if (!pskb_may_pull(skb_chk, len)) {
-                kfree_skb(skb_chk);
-                return -EINVAL;
-        }
+        if (!pskb_may_pull(skb_chk, len))
+                goto err;
 
         ret = ipv6_mc_check_mld_msg(skb_chk);
-        if (ret) {
-                kfree_skb(skb_chk);
-                return ret;
-        }
+        if (ret)
+                goto err;
 
         if (skb_trimmed)
                 *skb_trimmed = skb_chk;
-        else
+        /* free now unneeded clone */
+        else if (skb_chk != skb)
                 kfree_skb(skb_chk);
 
-        return 0;
+        ret = 0;
+
+err:
+        if (ret && skb_chk && skb_chk != skb)
+                kfree_skb(skb_chk);
+
+        return ret;
 }
 
 /**
@@ -179,7 +181,7 @@ static int __ipv6_mc_check_mld(struct sk_buff *skb,
  * @skb_trimmed: to store an skb pointer trimmed to IPv6 packet tail (optional)
  *
  * Checks whether an IPv6 packet is a valid MLD packet. If so sets
- * skb network and transport headers accordingly and returns zero.
+ * skb transport header accordingly and returns zero.
  *
  * -EINVAL: A broken packet was detected, i.e. it violates some internet
  *  standard
@@ -194,7 +196,8 @@ static int __ipv6_mc_check_mld(struct sk_buff *skb,
  * to leave the original skb and its full frame unchanged (which might be
  * desirable for layer 2 frame jugglers).
  *
- * The caller needs to release a reference count from any returned skb_trimmed.
+ * Caller needs to set the skb network header and free any returned skb if it
+ * differs from the provided skb.
  */
 int ipv6_mc_check_mld(struct sk_buff *skb, struct sk_buff **skb_trimmed)
 {
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index 6edb7b106de7..ebbb754c2111 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -37,12 +37,13 @@ synproxy_build_ip(struct sk_buff *skb, const struct in6_addr *saddr,
 }
 
 static void
-synproxy_send_tcp(const struct sk_buff *skb, struct sk_buff *nskb,
+synproxy_send_tcp(const struct synproxy_net *snet,
+                  const struct sk_buff *skb, struct sk_buff *nskb,
                   struct nf_conntrack *nfct, enum ip_conntrack_info ctinfo,
                   struct ipv6hdr *niph, struct tcphdr *nth,
                   unsigned int tcp_hdr_size)
 {
-        struct net *net = nf_ct_net((struct nf_conn *)nfct);
+        struct net *net = nf_ct_net(snet->tmpl);
         struct dst_entry *dst;
         struct flowi6 fl6;
 
@@ -83,7 +84,8 @@ free_nskb:
 }
 
 static void
-synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
+synproxy_send_client_synack(const struct synproxy_net *snet,
+                            const struct sk_buff *skb, const struct tcphdr *th,
                             const struct synproxy_options *opts)
 {
         struct sk_buff *nskb;
@@ -119,7 +121,7 @@ synproxy_send_client_synack(const struct sk_buff *skb, const struct tcphdr *th,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+        synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
                           niph, nth, tcp_hdr_size);
 }
 
@@ -163,7 +165,7 @@ synproxy_send_server_syn(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
+        synproxy_send_tcp(snet, skb, nskb, &snet->tmpl->ct_general, IP_CT_NEW,
                           niph, nth, tcp_hdr_size);
 }
 
@@ -203,7 +205,7 @@ synproxy_send_server_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(snet, skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
 }
 
 static void
@@ -241,7 +243,8 @@ synproxy_send_client_ack(const struct synproxy_net *snet,
 
         synproxy_build_options(nth, opts);
 
-        synproxy_send_tcp(skb, nskb, NULL, 0, niph, nth, tcp_hdr_size);
+        synproxy_send_tcp(snet, skb, nskb, skb->nfct, IP_CT_ESTABLISHED_REPLY,
+                          niph, nth, tcp_hdr_size);
 }
 
 static bool
@@ -301,7 +304,7 @@ synproxy_tg6(struct sk_buff *skb, const struct xt_action_param *par)
                                           XT_SYNPROXY_OPT_SACK_PERM |
                                           XT_SYNPROXY_OPT_ECN);
 
-                synproxy_send_client_synack(skb, th, &opts);
+                synproxy_send_client_synack(snet, skb, th, &opts);
                 return NF_DROP;
 
         } else if (th->ack && !(th->fin || th->rst || th->syn)) {
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 6090969937f8..d15586490cec 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -318,8 +318,7 @@ static const struct rt6_info ip6_blk_hole_entry_template = {
 /* allocate dst with ip6_dst_ops */
 static struct rt6_info *__ip6_dst_alloc(struct net *net,
                                         struct net_device *dev,
-                                        int flags,
-                                        struct fib6_table *table)
+                                        int flags)
 {
         struct rt6_info *rt = dst_alloc(&net->ipv6.ip6_dst_ops, dev,
                                         0, DST_OBSOLETE_FORCE_CHK, flags);
@@ -336,10 +335,9 @@ static struct rt6_info *__ip6_dst_alloc(struct net *net,
 
 static struct rt6_info *ip6_dst_alloc(struct net *net,
                                       struct net_device *dev,
-                                      int flags,
-                                      struct fib6_table *table)
+                                      int flags)
 {
-        struct rt6_info *rt = __ip6_dst_alloc(net, dev, flags, table);
+        struct rt6_info *rt = __ip6_dst_alloc(net, dev, flags);
 
         if (rt) {
                 rt->rt6i_pcpu = alloc_percpu_gfp(struct rt6_info *, GFP_ATOMIC);
@@ -950,8 +948,7 @@ static struct rt6_info *ip6_rt_cache_alloc(struct rt6_info *ort,
         if (ort->rt6i_flags & (RTF_CACHE | RTF_PCPU))
                 ort = (struct rt6_info *)ort->dst.from;
 
-        rt = __ip6_dst_alloc(dev_net(ort->dst.dev), ort->dst.dev,
-                             0, ort->rt6i_table);
+        rt = __ip6_dst_alloc(dev_net(ort->dst.dev), ort->dst.dev, 0);
 
         if (!rt)
                 return NULL;
@@ -983,8 +980,7 @@ static struct rt6_info *ip6_rt_pcpu_alloc(struct rt6_info *rt)
         struct rt6_info *pcpu_rt;
 
         pcpu_rt = __ip6_dst_alloc(dev_net(rt->dst.dev),
-                                  rt->dst.dev, rt->dst.flags,
-                                  rt->rt6i_table);
+                                  rt->dst.dev, rt->dst.flags);
 
         if (!pcpu_rt)
                 return NULL;
@@ -997,32 +993,53 @@ static struct rt6_info *ip6_rt_pcpu_alloc(struct rt6_info *rt)
 /* It should be called with read_lock_bh(&tb6_lock) acquired */
 static struct rt6_info *rt6_get_pcpu_route(struct rt6_info *rt)
 {
-        struct rt6_info *pcpu_rt, *prev, **p;
+        struct rt6_info *pcpu_rt, **p;
 
         p = this_cpu_ptr(rt->rt6i_pcpu);
         pcpu_rt = *p;
 
-        if (pcpu_rt)
-                goto done;
+        if (pcpu_rt) {
+                dst_hold(&pcpu_rt->dst);
+                rt6_dst_from_metrics_check(pcpu_rt);
+        }
+        return pcpu_rt;
+}
+
+static struct rt6_info *rt6_make_pcpu_route(struct rt6_info *rt)
+{
+        struct fib6_table *table = rt->rt6i_table;
+        struct rt6_info *pcpu_rt, *prev, **p;
 
         pcpu_rt = ip6_rt_pcpu_alloc(rt);
         if (!pcpu_rt) {
                 struct net *net = dev_net(rt->dst.dev);
 
-                pcpu_rt = net->ipv6.ip6_null_entry;
-                goto done;
+                dst_hold(&net->ipv6.ip6_null_entry->dst);
+                return net->ipv6.ip6_null_entry;
         }
 
-        prev = cmpxchg(p, NULL, pcpu_rt);
-        if (prev) {
-                /* If someone did it before us, return prev instead */
+        read_lock_bh(&table->tb6_lock);
+        if (rt->rt6i_pcpu) {
+                p = this_cpu_ptr(rt->rt6i_pcpu);
+                prev = cmpxchg(p, NULL, pcpu_rt);
+                if (prev) {
+                        /* If someone did it before us, return prev instead */
+                        dst_destroy(&pcpu_rt->dst);
+                        pcpu_rt = prev;
+                }
+        } else {
+                /* rt has been removed from the fib6 tree
+                 * before we have a chance to acquire the read_lock.
+                 * In this case, don't brother to create a pcpu rt
+                 * since rt is going away anyway.  The next
+                 * dst_check() will trigger a re-lookup.
+                 */
                 dst_destroy(&pcpu_rt->dst);
-                pcpu_rt = prev;
+                pcpu_rt = rt;
         }
-
-done:
         dst_hold(&pcpu_rt->dst);
         rt6_dst_from_metrics_check(pcpu_rt);
+        read_unlock_bh(&table->tb6_lock);
         return pcpu_rt;
 }
 
@@ -1097,9 +1114,22 @@ redo_rt6_select:
                 rt->dst.lastuse = jiffies;
                 rt->dst.__use++;
                 pcpu_rt = rt6_get_pcpu_route(rt);
-                read_unlock_bh(&table->tb6_lock);
+
+                if (pcpu_rt) {
+                        read_unlock_bh(&table->tb6_lock);
+                } else {
+                        /* We have to do the read_unlock first
+                         * because rt6_make_pcpu_route() may trigger
+                         * ip6_dst_gc() which will take the write_lock.
+                         */
+                        dst_hold(&rt->dst);
+                        read_unlock_bh(&table->tb6_lock);
+                        pcpu_rt = rt6_make_pcpu_route(rt);
+                        dst_release(&rt->dst);
+                }
 
                 return pcpu_rt;
+
         }
 }
 
@@ -1555,7 +1585,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         if (unlikely(!idev))
                 return ERR_PTR(-ENODEV);
 
-        rt = ip6_dst_alloc(net, dev, 0, NULL);
+        rt = ip6_dst_alloc(net, dev, 0);
         if (unlikely(!rt)) {
                 in6_dev_put(idev);
                 dst = ERR_PTR(-ENOMEM);
@@ -1742,7 +1772,8 @@ int ip6_route_add(struct fib6_config *cfg)
         if (!table)
                 goto out;
 
-        rt = ip6_dst_alloc(net, NULL, (cfg->fc_flags & RTF_ADDRCONF) ? 0 : DST_NOCOUNT, table);
+        rt = ip6_dst_alloc(net, NULL,
+                           (cfg->fc_flags & RTF_ADDRCONF) ? 0 : DST_NOCOUNT);
 
         if (!rt) {
                 err = -ENOMEM;
@@ -1831,6 +1862,7 @@ int ip6_route_add(struct fib6_config *cfg)
                 int gwa_type;
 
                 gw_addr = &cfg->fc_gateway;
+                gwa_type = ipv6_addr_type(gw_addr);
 
                 /* if gw_addr is local we will fail to detect this in case
                  * address is still TENTATIVE (DAD in progress). rt6_lookup()
@@ -1838,11 +1870,12 @@ int ip6_route_add(struct fib6_config *cfg)
                  * prefix route was assigned to, which might be non-loopback.
                  */
                 err = -EINVAL;
-                if (ipv6_chk_addr_and_flags(net, gw_addr, NULL, 0, 0))
+                if (ipv6_chk_addr_and_flags(net, gw_addr,
+                                            gwa_type & IPV6_ADDR_LINKLOCAL ?
+                                            dev : NULL, 0, 0))
                         goto out;
 
                 rt->rt6i_gateway = *gw_addr;
-                gwa_type = ipv6_addr_type(gw_addr);
 
                 if (gwa_type != (IPV6_ADDR_LINKLOCAL|IPV6_ADDR_UNICAST)) {
                         struct rt6_info *grt;
@@ -2397,7 +2430,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 {
         struct net *net = dev_net(idev->dev);
         struct rt6_info *rt = ip6_dst_alloc(net, net->loopback_dev,
-                                            DST_NOCOUNT, NULL);
+                                            DST_NOCOUNT);
         if (!rt)
                 return ERR_PTR(-ENOMEM);
 
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 6748c4277aff..7a6cea5e4274 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -943,7 +943,7 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
                                    &ipv6_hdr(skb)->daddr, tcp_v6_iif(skb));
         if (req) {
                 nsk = tcp_check_req(sk, skb, req, false);
-                if (!nsk)
+                if (!nsk || nsk == sk)
                         reqsk_put(req);
                 return nsk;
         }