1 files changed, 37 insertions, 33 deletions

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b18e85cd7587..23a20d62daac 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -380,11 +380,8 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                 in6_dev_put(idev);
         }
 
-        rcu_read_lock();
-        from = rcu_dereference(rt->from);
-        rcu_assign_pointer(rt->from, NULL);
+        from = xchg((__force struct fib6_info **)&rt->from, NULL);
         fib6_info_release(from);
-        rcu_read_unlock();
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
@@ -1323,9 +1320,7 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
         /* purge completely the exception to allow releasing the held resources:
          * some [sk] cache may keep the dst around for unlimited time
          */
-        from = rcu_dereference_protected(rt6_ex->rt6i->from,
-                                         lockdep_is_held(&rt6_exception_lock));
-        rcu_assign_pointer(rt6_ex->rt6i->from, NULL);
+        from = xchg((__force struct fib6_info **)&rt6_ex->rt6i->from, NULL);
         fib6_info_release(from);
         dst_dev_put(&rt6_ex->rt6i->dst);
 
@@ -3495,11 +3490,8 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
 
         rcu_read_lock();
         res.f6i = rcu_dereference(rt->from);
-        /* This fib6_info_hold() is safe here because we hold reference to rt
-         * and rt already holds reference to fib6_info.
-         */
-        fib6_info_hold(res.f6i);
-        rcu_read_unlock();
+        if (!res.f6i)
+                goto out;
 
         res.nh = &res.f6i->fib6_nh;
         res.fib6_flags = res.f6i->fib6_flags;
@@ -3514,10 +3506,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
 
         nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
 
-        /* No need to remove rt from the exception table if rt is
-         * a cached route because rt6_insert_exception() will
-         * takes care of it
-         */
+        /* rt6_insert_exception() will take care of duplicated exceptions */
         if (rt6_insert_exception(nrt, &res)) {
                 dst_release_immediate(&nrt->dst);
                 goto out;
@@ -3530,7 +3519,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
         call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);
 
 out:
-        fib6_info_release(res.f6i);
+        rcu_read_unlock();
         neigh_release(neigh);
 }
 
@@ -3772,23 +3761,34 @@ int ipv6_route_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 
 static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
 {
-        int type;
         struct dst_entry *dst = skb_dst(skb);
+        struct net *net = dev_net(dst->dev);
+        struct inet6_dev *idev;
+        int type;
+
+        if (netif_is_l3_master(skb->dev) &&
+            dst->dev == net->loopback_dev)
+                idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif));
+        else
+                idev = ip6_dst_idev(dst);
+
         switch (ipstats_mib_noroutes) {
         case IPSTATS_MIB_INNOROUTES:
                 type = ipv6_addr_type(&ipv6_hdr(skb)->daddr);
                 if (type == IPV6_ADDR_ANY) {
-                        IP6_INC_STATS(dev_net(dst->dev),
-                                      __in6_dev_get_safely(skb->dev),
-                                      IPSTATS_MIB_INADDRERRORS);
+                        IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
                         break;
                 }
                 /* FALLTHROUGH */
         case IPSTATS_MIB_OUTNOROUTES:
-                IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
-                              ipstats_mib_noroutes);
+                IP6_INC_STATS(net, idev, ipstats_mib_noroutes);
                 break;
         }
+
+        /* Start over by dropping the dst for l3mdev case */
+        if (netif_is_l3_master(skb->dev))
+                skb_dst_drop(skb);
+
         icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0);
         kfree_skb(skb);
         return 0;
@@ -5056,16 +5056,20 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
 
         rcu_read_lock();
         from = rcu_dereference(rt->from);
-
-        if (fibmatch)
-                err = rt6_fill_node(net, skb, from, NULL, NULL, NULL, iif,
-                                    RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
-                                    nlh->nlmsg_seq, 0);
-        else
-                err = rt6_fill_node(net, skb, from, dst, &fl6.daddr,
-                                    &fl6.saddr, iif, RTM_NEWROUTE,
-                                    NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
-                                    0);
+        if (from) {
+                if (fibmatch)
+                        err = rt6_fill_node(net, skb, from, NULL, NULL, NULL,
+                                            iif, RTM_NEWROUTE,
+                                            NETLINK_CB(in_skb).portid,
+                                            nlh->nlmsg_seq, 0);
+                else
+                        err = rt6_fill_node(net, skb, from, dst, &fl6.daddr,
+                                            &fl6.saddr, iif, RTM_NEWROUTE,
+                                            NETLINK_CB(in_skb).portid,
+                                            nlh->nlmsg_seq, 0);
+        } else {
+                err = -ENETUNREACH;
+        }
         rcu_read_unlock();
 
         if (err < 0) {