1 files changed, 17 insertions, 7 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index d2a8f8bb78a6..8ebe86dd72af 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -430,7 +430,7 @@ static void ip_copy_metadata(struct sk_buff *to, struct sk_buff *from)
  *      single device frame, and queue such a frame for sending.
  */
 
-int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff*))
+int ip_fragment(struct sk_buff *skb, int (*output)(struct sk_buff *))
 {
         struct iphdr *iph;
         int raw = 0;
@@ -720,7 +720,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                         int getfrag(void *from, char *to, int offset, int len,
                                int odd, struct sk_buff *skb),
                         void *from, int length, int hh_len, int fragheaderlen,
-                        int transhdrlen, int mtu,unsigned int flags)
+                        int transhdrlen, int mtu, unsigned int flags)
 {
         struct sk_buff *skb;
         int err;
@@ -741,7 +741,7 @@ static inline int ip_ufo_append_data(struct sock *sk,
                 skb_reserve(skb, hh_len);
 
                 /* create space for UDP/IP header */
-                skb_put(skb,fragheaderlen + transhdrlen);
+                skb_put(skb, fragheaderlen + transhdrlen);
 
                 /* initialize network header pointer */
                 skb_reset_network_header(skb);
@@ -778,7 +778,7 @@ int ip_append_data(struct sock *sk,
                    int getfrag(void *from, char *to, int offset, int len,
                                int odd, struct sk_buff *skb),
                    void *from, int length, int transhdrlen,
-                   struct ipcm_cookie *ipc, struct rtable *rt,
+                   struct ipcm_cookie *ipc, struct rtable **rtp,
                    unsigned int flags)
 {
         struct inet_sock *inet = inet_sk(sk);
@@ -793,6 +793,7 @@ int ip_append_data(struct sock *sk,
         int offset = 0;
         unsigned int maxfraglen, fragheaderlen;
         int csummode = CHECKSUM_NONE;
+        struct rtable *rt;
 
         if (flags&MSG_PROBE)
                 return 0;
@@ -812,7 +813,11 @@ int ip_append_data(struct sock *sk,
                         inet->cork.flags |= IPCORK_OPT;
                         inet->cork.addr = ipc->addr;
                 }
-                dst_hold(&rt->u.dst);
+                rt = *rtp;
+                /*
+                 * We steal reference to this route, caller should not release it
+                 */
+                *rtp = NULL;
                 inet->cork.fragsize = mtu = inet->pmtudisc == IP_PMTUDISC_PROBE ?
                                             rt->u.dst.dev->mtu :
                                             dst_mtu(rt->u.dst.path);
@@ -1279,7 +1284,12 @@ int ip_push_pending_frames(struct sock *sk)
 
         skb->priority = sk->sk_priority;
         skb->mark = sk->sk_mark;
-        skb->dst = dst_clone(&rt->u.dst);
+        /*
+         * Steal rt from cork.dst to avoid a pair of atomic_inc/atomic_dec
+         * on dst refcount
+         */
+        inet->cork.dst = NULL;
+        skb->dst = &rt->u.dst;
 
         if (iph->protocol == IPPROTO_ICMP)
                 icmp_out_count(net, ((struct icmphdr *)
@@ -1391,7 +1401,7 @@ void ip_send_reply(struct sock *sk, struct sk_buff *skb, struct ip_reply_arg *ar
         sk->sk_protocol = ip_hdr(skb)->protocol;
         sk->sk_bound_dev_if = arg->bound_dev_if;
         ip_append_data(sk, ip_reply_glue_bits, arg->iov->iov_base, len, 0,
-                       &ipc, rt, MSG_DONTWAIT);
+                       &ipc, &rt, MSG_DONTWAIT);
         if ((skb = skb_peek(&sk->sk_write_queue)) != NULL) {
                 if (arg->csumoffset >= 0)
                         *((__sum16 *)skb_transport_header(skb) +