From: Wei Wang <weiwan@google.com>
Date: Sat, 17 Jun 2017 10:42:35 -0700
Subject: ipv6: call dst_hold_safe() properly
Patch-mainline: v4.13-rc1
Git-commit: ad65a2f05695aced349e308193c6e2a6b1d87112
References: bsc#1061739

Similar as ipv4, ipv6 path also needs to call dst_hold_safe() when
necessary to avoid double free issue on the dst.

Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Acked-by: Michal Kubecek <mkubecek@suse.cz>

---
 net/ipv6/addrconf.c | 4 ++--
 net/ipv6/route.c    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index d16d642ea322..7d62985d0d12 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -5562,8 +5562,8 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp)
 				ip6_del_rt(rt);
 		}
 		if (ifp->rt) {
-			dst_hold(&ifp->rt->dst);
-			ip6_del_rt(ifp->rt);
+			if (dst_hold_safe(&ifp->rt->dst))
+				ip6_del_rt(ifp->rt);
 		}
 		rt_genid_bump_ipv6(net);
 		break;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index cb40ec109363..504b1cd9bd1b 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1368,8 +1368,8 @@ static void ip6_link_failure(struct sk_buff *skb)
 	rt = (struct rt6_info *) skb_dst(skb);
 	if (rt) {
 		if (rt->rt6i_flags & RTF_CACHE) {
-			dst_hold(&rt->dst);
-			ip6_del_rt(rt);
+			if (dst_hold_safe(&rt->dst))
+				ip6_del_rt(rt);
 		} else {
 			struct fib6_node *fn;
 
-- 
2.14.2