Merge branch 'for-airlied' of git://people.freedesktop.org/~danvet/drm-intel into drm-next

Last pile of stuff for 3.7, essentially just a bunch of bigger fixes and a
few less intrusive features:

- cpu freq interface in sysfs from Ben
- cpu edp fixes and some related cleanups
- write-combining ptes for pre-gen6 (Chris)
- basic CADL support (Peter Wu), this fixes quite a few issues with
  backlights ...
- rework of the gem backing pages handling (preps for stolen mem handling)
  from Chris
- some more cleanup-fallout from the modeset-rework

On top of that I've done a backmerge of -rc7(since the conflicts got too
messy and I've pushed out broken merged trees too often). I've also
included 3 fixes on top of what QA beat on:

- Fix for a infoframe handling regression in 3.5 - infoframe blows up too
  often and 3.6 is pretty much done, so I'd like to merge that through
  -next and the stable process and give it more exposure before it lands
  in a stable tree.
- ioctl cosmetics^Wspelling fix in the structs (userspace won't be
  affected, since all existing userspace uses private copies of the ioctl
  struct definitions, and the struct layout itself is abi compatible).
- Bugfix for a regression introduced in this pull's testing cycle.

* 'for-airlied' of git://people.freedesktop.org/~danvet/drm-intel: (695 commits)
  drm/i915: Wrap external callers to IPS state with appropriate locks
  drm/i915: s/cacheing/caching/
  drm/i915: make sure we write all the DIP data bytes
  drm/i915: BUG() on unexpected HDMI register
  ...

1 files changed, 3 insertions, 2 deletions

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index a3e60cc04a8..acd32e3f1b6 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -403,8 +403,9 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 		tp->mtu_info = ntohl(info);
 		if (!sock_owned_by_user(sk))
 			tcp_v6_mtu_reduced(sk);
-		else
-			set_bit(TCP_MTU_REDUCED_DEFERRED, &tp->tsq_flags);
+		else if (!test_and_set_bit(TCP_MTU_REDUCED_DEFERRED,
+					   &tp->tsq_flags))
+			sock_hold(sk);
 		goto out;
 	}