4 files changed, 37 insertions, 19 deletions

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index b5e6cc1d4a73..a38d3ac0f18f 100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -1246,7 +1246,6 @@ static void ip6gre_tunnel_setup(struct net_device *dev)
 static int ip6gre_tunnel_init(struct net_device *dev)
 {
         struct ip6_tnl *tunnel;
-        int i;
 
         tunnel = netdev_priv(dev);
 
@@ -1260,16 +1259,10 @@ static int ip6gre_tunnel_init(struct net_device *dev)
         if (ipv6_addr_any(&tunnel->parms.raddr))
                 dev->header_ops = &ip6gre_header_ops;
 
-        dev->tstats = alloc_percpu(struct pcpu_sw_netstats);
+        dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
         if (!dev->tstats)
                 return -ENOMEM;
 
-        for_each_possible_cpu(i) {
-                struct pcpu_sw_netstats *ip6gre_tunnel_stats;
-                ip6gre_tunnel_stats = per_cpu_ptr(dev->tstats, i);
-                u64_stats_init(&ip6gre_tunnel_stats->syncp);
-        }
-
         return 0;
 }
 
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7fde1f265c90..c21777565c58 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -886,22 +886,45 @@ static int ip6_dst_lookup_tail(struct sock *sk,
 #endif
         int err;
 
-        if (!*dst)
-                *dst = ip6_route_output(net, sk, fl6);
-
-        err = (*dst)->error;
-        if (err)
-                goto out_err_release;
+        /* The correct way to handle this would be to do
+         * ip6_route_get_saddr, and then ip6_route_output; however,
+         * the route-specific preferred source forces the
+         * ip6_route_output call _before_ ip6_route_get_saddr.
+         *
+         * In source specific routing (no src=any default route),
+         * ip6_route_output will fail given src=any saddr, though, so
+         * that's why we try it again later.
+         */
+        if (ipv6_addr_any(&fl6->saddr) && (!*dst || !(*dst)->error)) {
+                struct rt6_info *rt;
+                bool had_dst = *dst != NULL;
 
-        if (ipv6_addr_any(&fl6->saddr)) {
-                struct rt6_info *rt = (struct rt6_info *) *dst;
+                if (!had_dst)
+                        *dst = ip6_route_output(net, sk, fl6);
+                rt = (*dst)->error ? NULL : (struct rt6_info *)*dst;
                 err = ip6_route_get_saddr(net, rt, &fl6->daddr,
                                           sk ? inet6_sk(sk)->srcprefs : 0,
                                           &fl6->saddr);
                 if (err)
                         goto out_err_release;
+
+                /* If we had an erroneous initial result, pretend it
+                 * never existed and let the SA-enabled version take
+                 * over.
+                 */
+                if (!had_dst && (*dst)->error) {
+                        dst_release(*dst);
+                        *dst = NULL;
+                }
         }
 
+        if (!*dst)
+                *dst = ip6_route_output(net, sk, fl6);
+
+        err = (*dst)->error;
+        if (err)
+                goto out_err_release;
+
 #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
         /*
          * Here if the dst entry we've looked up
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 5c48293ff062..d3588885f097 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2245,9 +2245,10 @@ int ip6_route_get_saddr(struct net *net,
                         unsigned int prefs,
                         struct in6_addr *saddr)
 {
-        struct inet6_dev *idev = ip6_dst_idev((struct dst_entry *)rt);
+        struct inet6_dev *idev =
+                rt ? ip6_dst_idev((struct dst_entry *)rt) : NULL;
         int err = 0;
-        if (rt->rt6i_prefsrc.plen)
+        if (rt && rt->rt6i_prefsrc.plen)
                 *saddr = rt->rt6i_prefsrc.addr;
         else
                 err = ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index ad51df85aa00..b6575d665568 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -946,7 +946,8 @@ static struct sock *tcp_v6_hnd_req(struct sock *sk, struct sk_buff *skb)
                                    &ipv6_hdr(skb)->daddr, tcp_v6_iif(skb));
         if (req) {
                 nsk = tcp_check_req(sk, skb, req, false);
-                reqsk_put(req);
+                if (!nsk)
+                        reqsk_put(req);
                 return nsk;
         }
         nsk = __inet6_lookup_established(sock_net(sk), &tcp_hashinfo,