2 files changed, 3 insertions, 10 deletions

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 6613d8dbb0e5..91247a6fc67f 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -921,9 +921,7 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
                 if (pcpu_rt) {
                         struct fib6_info *from;
 
-                        from = rcu_dereference_protected(pcpu_rt->from,
-                                             lockdep_is_held(&table->tb6_lock));
-                        rcu_assign_pointer(pcpu_rt->from, NULL);
+                        from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
                         fib6_info_release(from);
                 }
         }
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b4899f0de0d0..2cc166bc978d 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -379,11 +379,8 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                 in6_dev_put(idev);
         }
 
-        rcu_read_lock();
-        from = rcu_dereference(rt->from);
-        rcu_assign_pointer(rt->from, NULL);
+        from = xchg((__force struct fib6_info **)&rt->from, NULL);
         fib6_info_release(from);
-        rcu_read_unlock();
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
@@ -1288,9 +1285,7 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
         /* purge completely the exception to allow releasing the held resources:
          * some [sk] cache may keep the dst around for unlimited time
          */
-        from = rcu_dereference_protected(rt6_ex->rt6i->from,
-                                         lockdep_is_held(&rt6_exception_lock));
-        rcu_assign_pointer(rt6_ex->rt6i->from, NULL);
+        from = xchg((__force struct fib6_info **)&rt6_ex->rt6i->from, NULL);
         fib6_info_release(from);
         dst_dev_put(&rt6_ex->rt6i->dst);