mptcp: ensure listener is unhashed before updating the sk status

[platform/kernel/linux-starfive.git] / net / ipv6 / ip6_output.c

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index e195076..95a55c6 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -547,7 +547,20 @@ int ip6_forward(struct sk_buff *skb)
            pneigh_lookup(&nd_tbl, net, &hdr->daddr, skb->dev, 0)) {
                int proxied = ip6_forward_proxy_check(skb);
                if (proxied > 0) {
-                       hdr->hop_limit--;
+                       /* It's tempting to decrease the hop limit
+                        * here by 1, as we do at the end of the
+                        * function too.
+                        *
+                        * But that would be incorrect, as proxying is
+                        * not forwarding.  The ip6_input function
+                        * will handle this packet locally, and it
+                        * depends on the hop limit being unchanged.
+                        *
+                        * One example is the NDP hop limit, that
+                        * always has to stay 255, but other would be
+                        * similar checks around RA packets, where the
+                        * user can even change the desired limit.
+                        */
                        return ip6_input(skb);
                } else if (proxied < 0) {
                        __IP6_INC_STATS(net, idev, IPSTATS_MIB_INDISCARDS);
@@ -920,6 +933,9 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                if (err < 0)
                        goto fail;
 
+               /* We prevent @rt from being freed. */
+               rcu_read_lock();
+
                for (;;) {
                        /* Prepare header of the next frame,
                         * before previous one went down. */
@@ -943,6 +959,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
                if (err == 0) {
                        IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
                                      IPSTATS_MIB_FRAGOKS);
+                       rcu_read_unlock();
                        return 0;
                }
 
@@ -950,6 +967,7 @@ int ip6_fragment(struct net *net, struct sock *sk, struct sk_buff *skb,
 
                IP6_INC_STATS(net, ip6_dst_idev(&rt->dst),
                              IPSTATS_MIB_FRAGFAILS);
+               rcu_read_unlock();
                return err;
 
 slow_path_clean:
@@ -1947,8 +1965,13 @@ struct sk_buff *__ip6_make_skb(struct sock *sk,
        IP6_UPD_PO_STATS(net, rt->rt6i_idev, IPSTATS_MIB_OUT, skb->len);
        if (proto == IPPROTO_ICMPV6) {
                struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
+               u8 icmp6_type;
 
-               ICMP6MSGOUT_INC_STATS(net, idev, icmp6_hdr(skb)->icmp6_type);
+               if (sk->sk_socket->type == SOCK_RAW && !inet_sk(sk)->hdrincl)
+                       icmp6_type = fl6->fl6_icmp_type;
+               else
+                       icmp6_type = icmp6_hdr(skb)->icmp6_type;
+               ICMP6MSGOUT_INC_STATS(net, idev, icmp6_type);
                ICMP6_INC_STATS(net, idev, ICMP6_MIB_OUTMSGS);
        }