From: Wei Wang <weiwan@google.com>
Date: Sat, 17 Jun 2017 10:42:30 -0700
Subject: ipv4: call dst_dev_put() properly
Patch-mainline: v4.13-rc1
Git-commit: 95c47f9cf5e028d1ae77dc6c767c1edc8a18025b
References: bsc#1061739

As the intend of this patch series is to completely remove dst gc,
we need to call dst_dev_put() to release the reference to dst->dev
when removing routes from fib because we won't keep the gc list anymore
and will lose the dst pointer right after removing the routes.
Without the gc list, there is no way to find all the dst's that have
dst->dev pointing to the going-down dev.
Hence, we are doing dst_dev_put() immediately before we lose the last
reference of the dst from the routing code. The next dst_check() will
trigger a route re-lookup to find another route (if there is any).

Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Michal Kubecek <mkubecek@suse.cz>

---
 net/ipv4/fib_semantics.c | 2 ++
 net/ipv4/route.c         | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index f62bd49b47ac..b7c0bf6c9d06 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -151,6 +151,7 @@ static void rt_fibinfo_free(struct rtable __rcu **rtp)
 	 * free_fib_info_rcu()
 	 */
 
+	dst_dev_put(&rt->dst);
 	dst_release(&rt->dst);
 	dst_free(&rt->dst);
 }
@@ -195,6 +196,7 @@ static void rt_fibinfo_free_cpus(struct rtable __rcu * __percpu *rtp)
 
 		rt = rcu_dereference_protected(*per_cpu_ptr(rtp, cpu), 1);
 		if (rt) {
+			dst_dev_put(&rt->dst);
 			dst_release(&rt->dst);
 			dst_free(&rt->dst);
 		}
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 473ec38ae2ba..8ecc8dd81839 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -601,12 +601,14 @@ static void fnhe_flush_routes(struct fib_nh_exception *fnhe)
 	rt = rcu_dereference(fnhe->fnhe_rth_input);
 	if (rt) {
 		RCU_INIT_POINTER(fnhe->fnhe_rth_input, NULL);
+		dst_dev_put(&rt->dst);
 		dst_release(&rt->dst);
 		rt_free(rt);
 	}
 	rt = rcu_dereference(fnhe->fnhe_rth_output);
 	if (rt) {
 		RCU_INIT_POINTER(fnhe->fnhe_rth_output, NULL);
+		dst_dev_put(&rt->dst);
 		dst_release(&rt->dst);
 		rt_free(rt);
 	}
@@ -1335,6 +1337,7 @@ static bool rt_bind_exception(struct rtable *rt, struct fib_nh_exception *fnhe,
 			dst_hold(&rt->dst);
 			rcu_assign_pointer(*porig, rt);
 			if (orig) {
+				dst_dev_put(&orig->dst);
 				dst_release(&orig->dst);
 				rt_free(orig);
 			}
@@ -1367,6 +1370,7 @@ static bool rt_cache_route(struct fib_nh *nh, struct rtable *rt)
 	prev = cmpxchg(p, orig, rt);
 	if (prev == orig) {
 		if (orig) {
+			dst_dev_put(&orig->dst);
 			dst_release(&orig->dst);
 			rt_free(orig);
 		}
-- 
2.14.2