ipv6: Do not depend on rt->n in ip6_finish_output2().

If neigh is not found, create new one.

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 13 insertions, 5 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 7c00edb343a0..b0895f5d5fc6 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -88,7 +88,8 @@ static int ip6_finish_output2(struct sk_buff *skb)
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *dev = dst->dev;
         struct neighbour *neigh;
-        struct rt6_info *rt;
+        struct in6_addr *nexthop;
+        int ret;
 
         skb->protocol = htons(ETH_P_IPV6);
         skb->dev = dev;
@@ -123,10 +124,17 @@ static int ip6_finish_output2(struct sk_buff *skb)
                                 skb->len);
         }
 
-        rt = (struct rt6_info *) dst;
-        neigh = rt->n;
-        if (neigh)
-                return dst_neigh_output(dst, neigh, skb);
+        rcu_read_lock_bh();
+        nexthop = rt6_nexthop((struct rt6_info *)dst, &ipv6_hdr(skb)->daddr);
+        neigh = __ipv6_neigh_lookup_noref(dst->dev, nexthop);
+        if (unlikely(!neigh))
+                neigh = __neigh_create(&nd_tbl, nexthop, dst->dev, false);
+        if (!IS_ERR(neigh)) {
+                ret = dst_neigh_output(dst, neigh, skb);
+                rcu_read_unlock_bh();
+                return ret;
+        }
+        rcu_read_unlock_bh();
 
         IP6_INC_STATS_BH(dev_net(dst->dev),
                          ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);