1 files changed, 24 insertions, 13 deletions

diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 1bcc3431859e..633a6c266136 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -22,9 +22,10 @@
 #include <net/inet6_hashtables.h>
 #include <net/ip.h>
 
-void __inet6_hash(struct sock *sk)
+int __inet6_hash(struct sock *sk, struct inet_timewait_sock *tw)
 {
         struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
+        int twrefcnt = 0;
 
         WARN_ON(!sk_unhashed(sk));
 
@@ -45,10 +46,15 @@ void __inet6_hash(struct sock *sk)
                 lock = inet_ehash_lockp(hashinfo, hash);
                 spin_lock(lock);
                 __sk_nulls_add_node_rcu(sk, list);
+                if (tw) {
+                        WARN_ON(sk->sk_hash != tw->tw_hash);
+                        twrefcnt = inet_twsk_unhash(tw);
+                }
                 spin_unlock(lock);
         }
 
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
+        return twrefcnt;
 }
 EXPORT_SYMBOL(__inet6_hash);
 
@@ -73,7 +79,7 @@ struct sock *__inet6_lookup_established(struct net *net,
          * have wildcards anyways.
          */
         unsigned int hash = inet6_ehashfn(net, daddr, hnum, saddr, sport);
-        unsigned int slot = hash & (hashinfo->ehash_size - 1);
+        unsigned int slot = hash & hashinfo->ehash_mask;
         struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
 
@@ -125,7 +131,7 @@ static int inline compute_score(struct sock *sk, struct net *net,
 {
         int score = -1;
 
-        if (net_eq(sock_net(sk), net) && inet_sk(sk)->num == hnum &&
+        if (net_eq(sock_net(sk), net) && inet_sk(sk)->inet_num == hnum &&
             sk->sk_family == PF_INET6) {
                 const struct ipv6_pinfo *np = inet6_sk(sk);
 
@@ -214,15 +220,16 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
         const struct in6_addr *daddr = &np->rcv_saddr;
         const struct in6_addr *saddr = &np->daddr;
         const int dif = sk->sk_bound_dev_if;
-        const __portpair ports = INET_COMBINED_PORTS(inet->dport, lport);
+        const __portpair ports = INET_COMBINED_PORTS(inet->inet_dport, lport);
         struct net *net = sock_net(sk);
         const unsigned int hash = inet6_ehashfn(net, daddr, lport, saddr,
-                                                inet->dport);
+                                                inet->inet_dport);
         struct inet_ehash_bucket *head = inet_ehash_bucket(hinfo, hash);
         spinlock_t *lock = inet_ehash_lockp(hinfo, hash);
         struct sock *sk2;
         const struct hlist_nulls_node *node;
         struct inet_timewait_sock *tw;
+        int twrefcnt = 0;
 
         spin_lock(lock);
 
@@ -248,21 +255,25 @@ static int __inet6_check_established(struct inet_timewait_death_row *death_row,
 unique:
         /* Must record num and sport now. Otherwise we will see
          * in hash table socket with a funny identity. */
-        inet->num = lport;
-        inet->sport = htons(lport);
+        inet->inet_num = lport;
+        inet->inet_sport = htons(lport);
+        sk->sk_hash = hash;
         WARN_ON(!sk_unhashed(sk));
         __sk_nulls_add_node_rcu(sk, &head->chain);
-        sk->sk_hash = hash;
+        if (tw) {
+                twrefcnt = inet_twsk_unhash(tw);
+                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
+        }
         spin_unlock(lock);
+        if (twrefcnt)
+                inet_twsk_put(tw);
         sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
 
-        if (twp != NULL) {
+        if (twp) {
                 *twp = tw;
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
-        } else if (tw != NULL) {
+        } else if (tw) {
                 /* Silly. Should hash-dance instead... */
                 inet_twsk_deschedule(tw, death_row);
-                NET_INC_STATS_BH(net, LINUX_MIB_TIMEWAITRECYCLED);
 
                 inet_twsk_put(tw);
         }
@@ -279,7 +290,7 @@ static inline u32 inet6_sk_port_offset(const struct sock *sk)
         const struct ipv6_pinfo *np = inet6_sk(sk);
         return secure_ipv6_port_ephemeral(np->rcv_saddr.s6_addr32,
                                           np->daddr.s6_addr32,
-                                          inet->dport);
+                                          inet->inet_dport);
 }
 
 int inet6_hash_connect(struct inet_timewait_death_row *death_row,