4 files changed, 92 insertions, 10 deletions

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 3f4d61017a69..f0cd291034f0 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -1001,6 +1001,9 @@ static int __init inet6_init(void)
         err = ip6_flowlabel_init();
         if (err)
                 goto ip6_flowlabel_fail;
+        err = ipv6_anycast_init();
+        if (err)
+                goto ipv6_anycast_fail;
         err = addrconf_init();
         if (err)
                 goto addrconf_fail;
@@ -1091,6 +1094,8 @@ ipv6_frag_fail:
 ipv6_exthdrs_fail:
         addrconf_cleanup();
 addrconf_fail:
+        ipv6_anycast_cleanup();
+ipv6_anycast_fail:
         ip6_flowlabel_cleanup();
 ip6_flowlabel_fail:
         ndisc_late_cleanup();
diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
index 4e0ff7031edd..94999058e110 100644
--- a/net/ipv6/anycast.c
+++ b/net/ipv6/anycast.c
@@ -44,8 +44,22 @@
 
 #include <net/checksum.h>
 
+#define IN6_ADDR_HSIZE_SHIFT    8
+#define IN6_ADDR_HSIZE          BIT(IN6_ADDR_HSIZE_SHIFT)
+/*      anycast address hash table
+ */
+static struct hlist_head inet6_acaddr_lst[IN6_ADDR_HSIZE];
+static DEFINE_SPINLOCK(acaddr_hash_lock);
+
 static int ipv6_dev_ac_dec(struct net_device *dev, const struct in6_addr *addr);
 
+static u32 inet6_acaddr_hash(struct net *net, const struct in6_addr *addr)
+{
+        u32 val = ipv6_addr_hash(addr) ^ net_hash_mix(net);
+
+        return hash_32(val, IN6_ADDR_HSIZE_SHIFT);
+}
+
 /*
  *      socket join an anycast group
  */
@@ -204,16 +218,39 @@ void ipv6_sock_ac_close(struct sock *sk)
         rtnl_unlock();
 }
 
+static void ipv6_add_acaddr_hash(struct net *net, struct ifacaddr6 *aca)
+{
+        unsigned int hash = inet6_acaddr_hash(net, &aca->aca_addr);
+
+        spin_lock(&acaddr_hash_lock);
+        hlist_add_head_rcu(&aca->aca_addr_lst, &inet6_acaddr_lst[hash]);
+        spin_unlock(&acaddr_hash_lock);
+}
+
+static void ipv6_del_acaddr_hash(struct ifacaddr6 *aca)
+{
+        spin_lock(&acaddr_hash_lock);
+        hlist_del_init_rcu(&aca->aca_addr_lst);
+        spin_unlock(&acaddr_hash_lock);
+}
+
 static void aca_get(struct ifacaddr6 *aca)
 {
         refcount_inc(&aca->aca_refcnt);
 }
 
+static void aca_free_rcu(struct rcu_head *h)
+{
+        struct ifacaddr6 *aca = container_of(h, struct ifacaddr6, rcu);
+
+        fib6_info_release(aca->aca_rt);
+        kfree(aca);
+}
+
 static void aca_put(struct ifacaddr6 *ac)
 {
         if (refcount_dec_and_test(&ac->aca_refcnt)) {
-                fib6_info_release(ac->aca_rt);
-                kfree(ac);
+                call_rcu(&ac->rcu, aca_free_rcu);
         }
 }
 
@@ -229,6 +266,7 @@ static struct ifacaddr6 *aca_alloc(struct fib6_info *f6i,
         aca->aca_addr = *addr;
         fib6_info_hold(f6i);
         aca->aca_rt = f6i;
+        INIT_HLIST_NODE(&aca->aca_addr_lst);
         aca->aca_users = 1;
         /* aca_tstamp should be updated upon changes */
         aca->aca_cstamp = aca->aca_tstamp = jiffies;
@@ -285,6 +323,8 @@ int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr)
         aca_get(aca);
         write_unlock_bh(&idev->lock);
 
+        ipv6_add_acaddr_hash(net, aca);
+
         ip6_ins_rt(net, f6i);
 
         addrconf_join_solict(idev->dev, &aca->aca_addr);
@@ -325,6 +365,7 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr)
         else
                 idev->ac_list = aca->aca_next;
         write_unlock_bh(&idev->lock);
+        ipv6_del_acaddr_hash(aca);
         addrconf_leave_solict(idev, &aca->aca_addr);
 
         ip6_del_rt(dev_net(idev->dev), aca->aca_rt);
@@ -352,6 +393,8 @@ void ipv6_ac_destroy_dev(struct inet6_dev *idev)
                 idev->ac_list = aca->aca_next;
                 write_unlock_bh(&idev->lock);
 
+                ipv6_del_acaddr_hash(aca);
+
                 addrconf_leave_solict(idev, &aca->aca_addr);
 
                 ip6_del_rt(dev_net(idev->dev), aca->aca_rt);
@@ -390,17 +433,25 @@ static bool ipv6_chk_acast_dev(struct net_device *dev, const struct in6_addr *ad
 bool ipv6_chk_acast_addr(struct net *net, struct net_device *dev,
                          const struct in6_addr *addr)
 {
+        unsigned int hash = inet6_acaddr_hash(net, addr);
+        struct net_device *nh_dev;
+        struct ifacaddr6 *aca;
         bool found = false;
 
         rcu_read_lock();
         if (dev)
                 found = ipv6_chk_acast_dev(dev, addr);
         else
-                for_each_netdev_rcu(net, dev)
-                        if (ipv6_chk_acast_dev(dev, addr)) {
+                hlist_for_each_entry_rcu(aca, &inet6_acaddr_lst[hash],
+                                         aca_addr_lst) {
+                        nh_dev = fib6_info_nh_dev(aca->aca_rt);
+                        if (!nh_dev || !net_eq(dev_net(nh_dev), net))
+                                continue;
+                        if (ipv6_addr_equal(&aca->aca_addr, addr)) {
                                 found = true;
                                 break;
                         }
+                }
         rcu_read_unlock();
         return found;
 }
@@ -540,3 +591,24 @@ void ac6_proc_exit(struct net *net)
         remove_proc_entry("anycast6", net->proc_net);
 }
 #endif
+
+/*      Init / cleanup code
+ */
+int __init ipv6_anycast_init(void)
+{
+        int i;
+
+        for (i = 0; i < IN6_ADDR_HSIZE; i++)
+                INIT_HLIST_HEAD(&inet6_acaddr_lst[i]);
+        return 0;
+}
+
+void ipv6_anycast_cleanup(void)
+{
+        int i;
+
+        spin_lock(&acaddr_hash_lock);
+        for (i = 0; i < IN6_ADDR_HSIZE; i++)
+                WARN_ON(!hlist_empty(&inet6_acaddr_lst[i]));
+        spin_unlock(&acaddr_hash_lock);
+}
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 1b8bc008b53b..ae3786132c23 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -591,7 +591,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
 
         /* fib entries are never clones */
         if (arg.filter.flags & RTM_F_CLONED)
-                return skb->len;
+                goto out;
 
         w = (void *)cb->args[2];
         if (!w) {
@@ -621,7 +621,7 @@ static int inet6_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
                 tb = fib6_get_table(net, arg.filter.table_id);
                 if (!tb) {
                         if (arg.filter.dump_all_families)
-                                return skb->len;
+                                goto out;
 
                         NL_SET_ERR_MSG_MOD(cb->extack, "FIB table does not exist");
                         return -ENOENT;
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c
index b8ac369f98ad..d219979c3e52 100644
--- a/net/ipv6/netfilter/nf_conntrack_reasm.c
+++ b/net/ipv6/netfilter/nf_conntrack_reasm.c
@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
          */
         ret = -EINPROGRESS;
         if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
-            fq->q.meat == fq->q.len &&
-            nf_ct_frag6_reasm(fq, skb, dev))
-                ret = 0;
-        else
+            fq->q.meat == fq->q.len) {
+                unsigned long orefdst = skb->_skb_refdst;
+
+                skb->_skb_refdst = 0UL;
+                if (nf_ct_frag6_reasm(fq, skb, dev))
+                        ret = 0;
+                skb->_skb_refdst = orefdst;
+        } else {
                 skb_dst_drop(skb);
+        }
 
 out_unlock:
         spin_unlock_bh(&fq->q.lock);