2 files changed, 12 insertions, 3 deletions

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 7bb6a9a1256d..a16cf1ec5e5e 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -834,12 +834,18 @@ static void neigh_timer_handler(unsigned long arg)
         }
         if (neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) {
                 struct sk_buff *skb = skb_peek(&neigh->arp_queue);
-
+                /* keep skb alive even if arp_queue overflows */
+                if (skb)
+                        skb_get(skb);
+                write_unlock(&neigh->lock);
                 neigh->ops->solicit(neigh, skb);
                 atomic_inc(&neigh->probes);
-        }
+                if (skb)
+                        kfree_skb(skb);
+        } else {
 out:
-        write_unlock(&neigh->lock);
+                write_unlock(&neigh->lock);
+        }
 
         if (notify)
                 neigh_update_notify(neigh);
diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
index c663fa5339ee..8e17f65f4002 100644
--- a/net/ipv4/arp.c
+++ b/net/ipv4/arp.c
@@ -368,6 +368,7 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
                 if (!(neigh->nud_state&NUD_VALID))
                         printk(KERN_DEBUG "trying to ucast probe in NUD_INVALID\n");
                 dst_ha = neigh->ha;
+                read_lock_bh(&neigh->lock);
         } else if ((probes -= neigh->parms->app_probes) < 0) {
 #ifdef CONFIG_ARPD
                 neigh_app_ns(neigh);
@@ -377,6 +378,8 @@ static void arp_solicit(struct neighbour *neigh, struct sk_buff *skb)
 
         arp_send(ARPOP_REQUEST, ETH_P_ARP, target, dev, saddr,
                  dst_ha, dev->dev_addr, NULL);
+        if (dst_ha)
+                read_unlock_bh(&neigh->lock);
 }
 
 static int arp_ignore(struct in_device *in_dev, __be32 sip, __be32 tip)