5 files changed, 62 insertions, 48 deletions

diff --git a/net/ipv6/esp6_offload.c b/net/ipv6/esp6_offload.c
index bff83279d76f..d453cf417b03 100644
--- a/net/ipv6/esp6_offload.c
+++ b/net/ipv6/esp6_offload.c
@@ -74,13 +74,13 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head,
                         goto out;
 
                 if (sp->len == XFRM_MAX_DEPTH)
-                        goto out;
+                        goto out_reset;
 
                 x = xfrm_state_lookup(dev_net(skb->dev), skb->mark,
                                       (xfrm_address_t *)&ipv6_hdr(skb)->daddr,
                                       spi, IPPROTO_ESP, AF_INET6);
                 if (!x)
-                        goto out;
+                        goto out_reset;
 
                 sp->xvec[sp->len++] = x;
                 sp->olen++;
@@ -88,7 +88,7 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head,
                 xo = xfrm_offload(skb);
                 if (!xo) {
                         xfrm_state_put(x);
-                        goto out;
+                        goto out_reset;
                 }
         }
 
@@ -109,6 +109,8 @@ static struct sk_buff *esp6_gro_receive(struct list_head *head,
         xfrm_input(skb, IPPROTO_ESP, spi, -2);
 
         return ERR_PTR(-EINPROGRESS);
+out_reset:
+        secpath_reset(skb);
 out:
         skb_push(skb, offset);
         NAPI_GRO_CB(skb)->same_flow = 0;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index a8919c217cc2..08e0390e001c 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -916,9 +916,7 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
                 if (pcpu_rt) {
                         struct fib6_info *from;
 
-                        from = rcu_dereference_protected(pcpu_rt->from,
-                                             lockdep_is_held(&table->tb6_lock));
-                        rcu_assign_pointer(pcpu_rt->from, NULL);
+                        from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
                         fib6_info_release(from);
                 }
         }
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index cb54a8a3c273..be5f3d7ceb96 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -94,15 +94,21 @@ static struct ip6_flowlabel *fl_lookup(struct net *net, __be32 label)
         return fl;
 }
 
+static void fl_free_rcu(struct rcu_head *head)
+{
+        struct ip6_flowlabel *fl = container_of(head, struct ip6_flowlabel, rcu);
+
+        if (fl->share == IPV6_FL_S_PROCESS)
+                put_pid(fl->owner.pid);
+        kfree(fl->opt);
+        kfree(fl);
+}
+
 
 static void fl_free(struct ip6_flowlabel *fl)
 {
-        if (fl) {
-                if (fl->share == IPV6_FL_S_PROCESS)
-                        put_pid(fl->owner.pid);
-                kfree(fl->opt);
-                kfree_rcu(fl, rcu);
-        }
+        if (fl)
+                call_rcu(&fl->rcu, fl_free_rcu);
 }
 
 static void fl_release(struct ip6_flowlabel *fl)
@@ -633,9 +639,9 @@ recheck:
                                 if (fl1->share == IPV6_FL_S_EXCL ||
                                     fl1->share != fl->share ||
                                     ((fl1->share == IPV6_FL_S_PROCESS) &&
-                                     (fl1->owner.pid == fl->owner.pid)) ||
+                                     (fl1->owner.pid != fl->owner.pid)) ||
                                     ((fl1->share == IPV6_FL_S_USER) &&
-                                     uid_eq(fl1->owner.uid, fl->owner.uid)))
+                                     !uid_eq(fl1->owner.uid, fl->owner.uid)))
                                         goto release;
 
                                 err = -ENOMEM;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b18e85cd7587..23a20d62daac 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -380,11 +380,8 @@ static void ip6_dst_destroy(struct dst_entry *dst)
                 in6_dev_put(idev);
         }
 
-        rcu_read_lock();
-        from = rcu_dereference(rt->from);
-        rcu_assign_pointer(rt->from, NULL);
+        from = xchg((__force struct fib6_info **)&rt->from, NULL);
         fib6_info_release(from);
-        rcu_read_unlock();
 }
 
 static void ip6_dst_ifdown(struct dst_entry *dst, struct net_device *dev,
@@ -1323,9 +1320,7 @@ static void rt6_remove_exception(struct rt6_exception_bucket *bucket,
         /* purge completely the exception to allow releasing the held resources:
          * some [sk] cache may keep the dst around for unlimited time
          */
-        from = rcu_dereference_protected(rt6_ex->rt6i->from,
-                                         lockdep_is_held(&rt6_exception_lock));
-        rcu_assign_pointer(rt6_ex->rt6i->from, NULL);
+        from = xchg((__force struct fib6_info **)&rt6_ex->rt6i->from, NULL);
         fib6_info_release(from);
         dst_dev_put(&rt6_ex->rt6i->dst);
 
@@ -3495,11 +3490,8 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
 
         rcu_read_lock();
         res.f6i = rcu_dereference(rt->from);
-        /* This fib6_info_hold() is safe here because we hold reference to rt
-         * and rt already holds reference to fib6_info.
-         */
-        fib6_info_hold(res.f6i);
-        rcu_read_unlock();
+        if (!res.f6i)
+                goto out;
 
         res.nh = &res.f6i->fib6_nh;
         res.fib6_flags = res.f6i->fib6_flags;
@@ -3514,10 +3506,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
 
         nrt->rt6i_gateway = *(struct in6_addr *)neigh->primary_key;
 
-        /* No need to remove rt from the exception table if rt is
-         * a cached route because rt6_insert_exception() will
-         * takes care of it
-         */
+        /* rt6_insert_exception() will take care of duplicated exceptions */
         if (rt6_insert_exception(nrt, &res)) {
                 dst_release_immediate(&nrt->dst);
                 goto out;
@@ -3530,7 +3519,7 @@ static void rt6_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_bu
         call_netevent_notifiers(NETEVENT_REDIRECT, &netevent);
 
 out:
-        fib6_info_release(res.f6i);
+        rcu_read_unlock();
         neigh_release(neigh);
 }
 
@@ -3772,23 +3761,34 @@ int ipv6_route_ioctl(struct net *net, unsigned int cmd, void __user *arg)
 
 static int ip6_pkt_drop(struct sk_buff *skb, u8 code, int ipstats_mib_noroutes)
 {
-        int type;
         struct dst_entry *dst = skb_dst(skb);
+        struct net *net = dev_net(dst->dev);
+        struct inet6_dev *idev;
+        int type;
+
+        if (netif_is_l3_master(skb->dev) &&
+            dst->dev == net->loopback_dev)
+                idev = __in6_dev_get_safely(dev_get_by_index_rcu(net, IP6CB(skb)->iif));
+        else
+                idev = ip6_dst_idev(dst);
+
         switch (ipstats_mib_noroutes) {
         case IPSTATS_MIB_INNOROUTES:
                 type = ipv6_addr_type(&ipv6_hdr(skb)->daddr);
                 if (type == IPV6_ADDR_ANY) {
-                        IP6_INC_STATS(dev_net(dst->dev),
-                                      __in6_dev_get_safely(skb->dev),
-                                      IPSTATS_MIB_INADDRERRORS);
+                        IP6_INC_STATS(net, idev, IPSTATS_MIB_INADDRERRORS);
                         break;
                 }
                 /* FALLTHROUGH */
         case IPSTATS_MIB_OUTNOROUTES:
-                IP6_INC_STATS(dev_net(dst->dev), ip6_dst_idev(dst),
-                              ipstats_mib_noroutes);
+                IP6_INC_STATS(net, idev, ipstats_mib_noroutes);
                 break;
         }
+
+        /* Start over by dropping the dst for l3mdev case */
+        if (netif_is_l3_master(skb->dev))
+                skb_dst_drop(skb);
+
         icmpv6_send(skb, ICMPV6_DEST_UNREACH, code, 0);
         kfree_skb(skb);
         return 0;
@@ -5056,16 +5056,20 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
 
         rcu_read_lock();
         from = rcu_dereference(rt->from);
-
-        if (fibmatch)
-                err = rt6_fill_node(net, skb, from, NULL, NULL, NULL, iif,
-                                    RTM_NEWROUTE, NETLINK_CB(in_skb).portid,
-                                    nlh->nlmsg_seq, 0);
-        else
-                err = rt6_fill_node(net, skb, from, dst, &fl6.daddr,
-                                    &fl6.saddr, iif, RTM_NEWROUTE,
-                                    NETLINK_CB(in_skb).portid, nlh->nlmsg_seq,
-                                    0);
+        if (from) {
+                if (fibmatch)
+                        err = rt6_fill_node(net, skb, from, NULL, NULL, NULL,
+                                            iif, RTM_NEWROUTE,
+                                            NETLINK_CB(in_skb).portid,
+                                            nlh->nlmsg_seq, 0);
+                else
+                        err = rt6_fill_node(net, skb, from, dst, &fl6.daddr,
+                                            &fl6.saddr, iif, RTM_NEWROUTE,
+                                            NETLINK_CB(in_skb).portid,
+                                            nlh->nlmsg_seq, 0);
+        } else {
+                err = -ENETUNREACH;
+        }
         rcu_read_unlock();
 
         if (err < 0) {
diff --git a/net/ipv6/xfrm6_tunnel.c b/net/ipv6/xfrm6_tunnel.c
index bc65db782bfb..d9e5f6808811 100644
--- a/net/ipv6/xfrm6_tunnel.c
+++ b/net/ipv6/xfrm6_tunnel.c
@@ -345,7 +345,7 @@ static void __net_exit xfrm6_tunnel_net_exit(struct net *net)
         unsigned int i;
 
         xfrm_flush_gc();
-        xfrm_state_flush(net, IPSEC_PROTO_ANY, false, true);
+        xfrm_state_flush(net, 0, false, true);
 
         for (i = 0; i < XFRM6_TUNNEL_SPI_BYADDR_HSIZE; i++)
                 WARN_ON_ONCE(!hlist_empty(&xfrm6_tn->spi_byaddr[i]));
@@ -402,6 +402,10 @@ static void __exit xfrm6_tunnel_fini(void)
         xfrm6_tunnel_deregister(&xfrm6_tunnel_handler, AF_INET6);
         xfrm_unregister_type(&xfrm6_tunnel_type, AF_INET6);
         unregister_pernet_subsys(&xfrm6_tunnel_net_ops);
+        /* Someone maybe has gotten the xfrm6_tunnel_spi.
+         * So need to wait it.
+         */
+        rcu_barrier();
         kmem_cache_destroy(xfrm6_tunnel_spi_kmem);
 }