ipv6: Do not depend on rt->n in ip6_dst_lookup_tail().

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 2 deletions

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 9250c696de9d..7c00edb343a0 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -913,8 +913,12 @@ static int ip6_dst_lookup_tail(struct sock *sk,
          * dst entry of the nexthop router
          */
         rt = (struct rt6_info *) *dst;
-        n = rt->n;
-        if (n && !(n->nud_state & NUD_VALID)) {
+        rcu_read_lock_bh();
+        n = __ipv6_neigh_lookup_noref(rt->dst.dev, rt6_nexthop(rt, &fl6->daddr));
+        err = n && !(n->nud_state & NUD_VALID) ? -EINVAL : 0;
+        rcu_read_unlock_bh();
+
+        if (err) {
                 struct inet6_ifaddr *ifp;
                 struct flowi6 fl_gw6;
                 int redirect;