10 files changed, 115 insertions, 76 deletions

diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index a0124eb7dbe..77e87aff419 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -827,7 +827,7 @@ static int arp_process(struct sk_buff *skb)
         }
 
         if (arp->ar_op == htons(ARPOP_REQUEST) &&
-            ip_route_input(skb, tip, sip, 0, dev) == 0) {
+            ip_route_input_noref(skb, tip, sip, 0, dev) == 0) {
 
                 rt = skb_rtable(skb);
                 addr_type = rt->rt_type;
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index e55171f184f..da0cc2e6b25 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -172,9 +172,9 @@ static void free_fib_info_rcu(struct rcu_head *head)
                 if (nexthop_nh->nh_exceptions)
                         free_nh_exceptions(nexthop_nh);
                 if (nexthop_nh->nh_rth_output)
-                        dst_release(&nexthop_nh->nh_rth_output->dst);
+                        dst_free(&nexthop_nh->nh_rth_output->dst);
                 if (nexthop_nh->nh_rth_input)
-                        dst_release(&nexthop_nh->nh_rth_input->dst);
+                        dst_free(&nexthop_nh->nh_rth_input->dst);
         } endfor_nexthops(fi);
 
         release_net(fi->fib_net);
diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index 7ad88e5e711..8d07c973409 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -258,8 +258,8 @@ static void ip_expire(unsigned long arg)
                 /* skb dst is stale, drop it, and perform route lookup again */
                 skb_dst_drop(head);
                 iph = ip_hdr(head);
-                err = ip_route_input(head, iph->daddr, iph->saddr,
-                                     iph->tos, head->dev);
+                err = ip_route_input_noref(head, iph->daddr, iph->saddr,
+                                           iph->tos, head->dev);
                 if (err)
                         goto out_rcu_unlock;
 
diff --git a/net/ipv4/ip_input.c b/net/ipv4/ip_input.c
index 4ebc6feee25..981ff1eef28 100644
--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -314,6 +314,7 @@ drop:
 }
 
 int sysctl_ip_early_demux __read_mostly = 1;
+EXPORT_SYMBOL(sysctl_ip_early_demux);
 
 static int ip_rcv_finish(struct sk_buff *skb)
 {
@@ -326,8 +327,11 @@ static int ip_rcv_finish(struct sk_buff *skb)
 
                 rcu_read_lock();
                 ipprot = rcu_dereference(inet_protos[protocol]);
-                if (ipprot && ipprot->early_demux)
+                if (ipprot && ipprot->early_demux) {
                         ipprot->early_demux(skb);
+                        /* must reload iph, skb->head might have changed */
+                        iph = ip_hdr(skb);
+                }
                 rcu_read_unlock();
         }
 
@@ -336,8 +340,8 @@ static int ip_rcv_finish(struct sk_buff *skb)
          *      how the packet travels inside Linux networking.
          */
         if (!skb_dst(skb)) {
-                int err = ip_route_input(skb, iph->daddr, iph->saddr,
-                                         iph->tos, skb->dev);
+                int err = ip_route_input_noref(skb, iph->daddr, iph->saddr,
+                                               iph->tos, skb->dev);
                 if (unlikely(err)) {
                         if (err == -EXDEV)
                                 NET_INC_STATS_BH(dev_net(skb->dev),
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6bcb8fc71cb..fc1a81ca79a 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -444,7 +444,7 @@ static inline int ip_rt_proc_init(void)
 }
 #endif /* CONFIG_PROC_FS */
 
-static inline int rt_is_expired(struct rtable *rth)
+static inline bool rt_is_expired(const struct rtable *rth)
 {
         return rth->rt_genid != rt_genid(dev_net(rth->dst.dev));
 }
@@ -1199,10 +1199,9 @@ restart:
         fnhe->fnhe_stamp = jiffies;
 }
 
-static inline void rt_release_rcu(struct rcu_head *head)
+static inline void rt_free(struct rtable *rt)
 {
-        struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
-        dst_release(dst);
+        call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free);
 }
 
 static void rt_cache_route(struct fib_nh *nh, struct rtable *rt)
@@ -1216,15 +1215,23 @@ static void rt_cache_route(struct fib_nh *nh, struct rtable *rt)
 
         prev = cmpxchg(p, orig, rt);
         if (prev == orig) {
-                dst_clone(&rt->dst);
                 if (orig)
-                        call_rcu_bh(&orig->dst.rcu_head, rt_release_rcu);
+                        rt_free(orig);
+        } else {
+                /* Routes we intend to cache in the FIB nexthop have
+                 * the DST_NOCACHE bit clear.  However, if we are
+                 * unsuccessful at storing this route into the cache
+                 * we really need to set it.
+                 */
+                rt->dst.flags |= DST_NOCACHE;
         }
 }
 
-static bool rt_cache_valid(struct rtable *rt)
+static bool rt_cache_valid(const struct rtable *rt)
 {
-        return (rt && rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK);
+        return  rt &&
+                rt->dst.obsolete == DST_OBSOLETE_FORCE_CHK &&
+                !rt_is_expired(rt);
 }
 
 static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
@@ -1243,7 +1250,7 @@ static void rt_set_nexthop(struct rtable *rt, __be32 daddr,
 #ifdef CONFIG_IP_ROUTE_CLASSID
                 rt->dst.tclassid = nh->nh_tclassid;
 #endif
-                if (!(rt->dst.flags & DST_HOST))
+                if (!(rt->dst.flags & DST_NOCACHE))
                         rt_cache_route(nh, rt);
         }
 
@@ -1259,7 +1266,7 @@ static struct rtable *rt_dst_alloc(struct net_device *dev,
                                    bool nopolicy, bool noxfrm, bool will_cache)
 {
         return dst_alloc(&ipv4_dst_ops, dev, 1, DST_OBSOLETE_FORCE_CHK,
-                         (will_cache ? 0 : DST_HOST) | DST_NOCACHE |
+                         (will_cache ? 0 : (DST_HOST | DST_NOCACHE)) |
                          (nopolicy ? DST_NOPOLICY : 0) |
                          (noxfrm ? DST_NOXFRM : 0));
 }
@@ -1364,8 +1371,7 @@ static void ip_handle_martian_source(struct net_device *dev,
 static int __mkroute_input(struct sk_buff *skb,
                            const struct fib_result *res,
                            struct in_device *in_dev,
-                           __be32 daddr, __be32 saddr, u32 tos,
-                           struct rtable **result)
+                           __be32 daddr, __be32 saddr, u32 tos)
 {
         struct rtable *rth;
         int err;
@@ -1416,7 +1422,7 @@ static int __mkroute_input(struct sk_buff *skb,
                 if (!itag) {
                         rth = FIB_RES_NH(*res).nh_rth_input;
                         if (rt_cache_valid(rth)) {
-                                dst_hold(&rth->dst);
+                                skb_dst_set_noref(skb, &rth->dst);
                                 goto out;
                         }
                         do_cache = true;
@@ -1443,8 +1449,8 @@ static int __mkroute_input(struct sk_buff *skb,
         rth->dst.output = ip_output;
 
         rt_set_nexthop(rth, daddr, res, NULL, res->fi, res->type, itag);
+        skb_dst_set(skb, &rth->dst);
 out:
-        *result = rth;
         err = 0;
  cleanup:
         return err;
@@ -1456,21 +1462,13 @@ static int ip_mkroute_input(struct sk_buff *skb,
                             struct in_device *in_dev,
                             __be32 daddr, __be32 saddr, u32 tos)
 {
-        struct rtable *rth = NULL;
-        int err;
-
 #ifdef CONFIG_IP_ROUTE_MULTIPATH
         if (res->fi && res->fi->fib_nhs > 1)
                 fib_select_multipath(res);
 #endif
 
         /* create a routing cache entry */
-        err = __mkroute_input(skb, res, in_dev, daddr, saddr, tos, &rth);
-        if (err)
-                return err;
-
-        skb_dst_set(skb, &rth->dst);
-        return 0;
+        return __mkroute_input(skb, res, in_dev, daddr, saddr, tos);
 }
 
 /*
@@ -1586,8 +1584,9 @@ local_input:
                 if (!itag) {
                         rth = FIB_RES_NH(res).nh_rth_input;
                         if (rt_cache_valid(rth)) {
-                                dst_hold(&rth->dst);
-                                goto set_and_out;
+                                skb_dst_set_noref(skb, &rth->dst);
+                                err = 0;
+                                goto out;
                         }
                         do_cache = true;
                 }
@@ -1618,7 +1617,6 @@ local_input:
         }
         if (do_cache)
                 rt_cache_route(&FIB_RES_NH(res), rth);
-set_and_out:
         skb_dst_set(skb, &rth->dst);
         err = 0;
         goto out;
@@ -1656,8 +1654,8 @@ martian_source_keep_err:
         goto out;
 }
 
-int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
-                   u8 tos, struct net_device *dev)
+int ip_route_input_noref(struct sk_buff *skb, __be32 daddr, __be32 saddr,
+                         u8 tos, struct net_device *dev)
 {
         int res;
 
@@ -1700,7 +1698,7 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
         rcu_read_unlock();
         return res;
 }
-EXPORT_SYMBOL(ip_route_input);
+EXPORT_SYMBOL(ip_route_input_noref);
 
 /* called with rcu_read_lock() */
 static struct rtable *__mkroute_output(const struct fib_result *res,
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 3e30548ac32..b6b07c93924 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1686,7 +1686,6 @@ void tcp_v4_early_demux(struct sk_buff *skb)
         struct net *net = dev_net(skb->dev);
         const struct iphdr *iph;
         const struct tcphdr *th;
-        struct net_device *dev;
         struct sock *sk;
 
         if (skb->pkt_type != PACKET_HOST)
@@ -1701,14 +1700,10 @@ void tcp_v4_early_demux(struct sk_buff *skb)
         if (th->doff < sizeof(struct tcphdr) / 4)
                 return;
 
-        if (!pskb_may_pull(skb, ip_hdrlen(skb) + th->doff * 4))
-                return;
-
-        dev = skb->dev;
         sk = __inet_lookup_established(net, &tcp_hashinfo,
                                        iph->saddr, th->source,
                                        iph->daddr, ntohs(th->dest),
-                                       dev->ifindex);
+                                       skb->skb_iif);
         if (sk) {
                 skb->sk = sk;
                 skb->destructor = sock_edemux;
@@ -1718,7 +1713,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
                         if (dst)
                                 dst = dst_check(dst, 0);
                         if (dst &&
-                            icsk->rx_dst_ifindex == dev->ifindex)
+                            icsk->rx_dst_ifindex == skb->skb_iif)
                                 skb_dst_set_noref(skb, dst);
                 }
         }
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c
index 58d23a57250..06814b6216d 100644
--- a/net/ipv4/xfrm4_input.c
+++ b/net/ipv4/xfrm4_input.c
@@ -27,8 +27,8 @@ static inline int xfrm4_rcv_encap_finish(struct sk_buff *skb)
         if (skb_dst(skb) == NULL) {
                 const struct iphdr *iph = ip_hdr(skb);
 
-                if (ip_route_input(skb, iph->daddr, iph->saddr,
-                                   iph->tos, skb->dev))
+                if (ip_route_input_noref(skb, iph->daddr, iph->saddr,
+                                         iph->tos, skb->dev))
                         goto drop;
         }
         return dst_input(skb);
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 5ab923e51af..47975e363fc 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -47,9 +47,18 @@
 
 
 
-inline int ip6_rcv_finish( struct sk_buff *skb)
+int ip6_rcv_finish(struct sk_buff *skb)
 {
-        if (skb_dst(skb) == NULL)
+        if (sysctl_ip_early_demux && !skb_dst(skb)) {
+                const struct inet6_protocol *ipprot;
+
+                rcu_read_lock();
+                ipprot = rcu_dereference(inet6_protos[ipv6_hdr(skb)->nexthdr]);
+                if (ipprot && ipprot->early_demux)
+                        ipprot->early_demux(skb);
+                rcu_read_unlock();
+        }
+        if (!skb_dst(skb))
                 ip6_route_input(skb);
 
         return dst_input(skb);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index f49476e2d88..221224e7250 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1674,6 +1674,43 @@ do_time_wait:
         goto discard_it;
 }
 
+static void tcp_v6_early_demux(struct sk_buff *skb)
+{
+        const struct ipv6hdr *hdr;
+        const struct tcphdr *th;
+        struct sock *sk;
+
+        if (skb->pkt_type != PACKET_HOST)
+                return;
+
+        if (!pskb_may_pull(skb, skb_transport_offset(skb) + sizeof(struct tcphdr)))
+                return;
+
+        hdr = ipv6_hdr(skb);
+        th = tcp_hdr(skb);
+
+        if (th->doff < sizeof(struct tcphdr) / 4)
+                return;
+
+        sk = __inet6_lookup_established(dev_net(skb->dev), &tcp_hashinfo,
+                                        &hdr->saddr, th->source,
+                                        &hdr->daddr, ntohs(th->dest),
+                                        inet6_iif(skb));
+        if (sk) {
+                skb->sk = sk;
+                skb->destructor = sock_edemux;
+                if (sk->sk_state != TCP_TIME_WAIT) {
+                        struct dst_entry *dst = sk->sk_rx_dst;
+                        struct inet_sock *icsk = inet_sk(sk);
+                        if (dst)
+                                dst = dst_check(dst, 0);
+                        if (dst &&
+                            icsk->rx_dst_ifindex == inet6_iif(skb))
+                                skb_dst_set_noref(skb, dst);
+                }
+        }
+}
+
 static struct timewait_sock_ops tcp6_timewait_sock_ops = {
         .twsk_obj_size  = sizeof(struct tcp6_timewait_sock),
         .twsk_unique    = tcp_twsk_unique,
@@ -1984,6 +2021,7 @@ struct proto tcpv6_prot = {
 };
 
 static const struct inet6_protocol tcpv6_protocol = {
+        .early_demux    =       tcp_v6_early_demux,
         .handler        =       tcp_v6_rcv,
         .err_handler    =       tcp_v6_err,
         .gso_send_check =       tcp_v6_gso_send_check,
diff --git a/net/wanrouter/wanmain.c b/net/wanrouter/wanmain.c
index 788a12c1eb5..2ab785064b7 100644
--- a/net/wanrouter/wanmain.c
+++ b/net/wanrouter/wanmain.c
@@ -602,36 +602,31 @@ static int wanrouter_device_new_if(struct wan_device *wandev,
                  * successfully, add it to the interface list.
                  */
 
-                if (dev->name == NULL) {
-                        err = -EINVAL;
-                } else {
+#ifdef WANDEBUG
+                printk(KERN_INFO "%s: registering interface %s...\n",
+                       wanrouter_modname, dev->name);
+#endif
 
-                        #ifdef WANDEBUG
-                        printk(KERN_INFO "%s: registering interface %s...\n",
-                                wanrouter_modname, dev->name);
-                        #endif
-
-                        err = register_netdev(dev);
-                        if (!err) {
-                                struct net_device *slave = NULL;
-                                unsigned long smp_flags=0;
-
-                                lock_adapter_irq(&wandev->lock, &smp_flags);
-
-                                if (wandev->dev == NULL) {
-                                        wandev->dev = dev;
-                                } else {
-                                        for (slave=wandev->dev;
-                                             DEV_TO_SLAVE(slave);
-                                             slave = DEV_TO_SLAVE(slave))
-                                                DEV_TO_SLAVE(slave) = dev;
-                                }
-                                ++wandev->ndev;
-
-                                unlock_adapter_irq(&wandev->lock, &smp_flags);
-                                err = 0;        /* done !!! */
-                                goto out;
+                err = register_netdev(dev);
+                if (!err) {
+                        struct net_device *slave = NULL;
+                        unsigned long smp_flags=0;
+
+                        lock_adapter_irq(&wandev->lock, &smp_flags);
+
+                        if (wandev->dev == NULL) {
+                                wandev->dev = dev;
+                        } else {
+                                for (slave=wandev->dev;
+                                     DEV_TO_SLAVE(slave);
+                                     slave = DEV_TO_SLAVE(slave))
+                                        DEV_TO_SLAVE(slave) = dev;
                         }
+                        ++wandev->ndev;
+
+                        unlock_adapter_irq(&wandev->lock, &smp_flags);
+                        err = 0;        /* done !!! */
+                        goto out;
                 }
                 if (wandev->del_if)
                         wandev->del_if(wandev, dev);