1 files changed, 33 insertions, 24 deletions

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index a1cbce7fdae5..163b4f5b0365 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -771,6 +771,28 @@ static __inline__ int neigh_max_probes(struct neighbour *n)
                 p->ucast_probes + p->app_probes + p->mcast_probes);
 }
 
+static void neigh_invalidate(struct neighbour *neigh)
+{
+        struct sk_buff *skb;
+
+        NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
+        NEIGH_PRINTK2("neigh %p is failed.\n", neigh);
+        neigh->updated = jiffies;
+
+        /* It is very thin place. report_unreachable is very complicated
+           routine. Particularly, it can hit the same neighbour entry!
+
+           So that, we try to be accurate and avoid dead loop. --ANK
+         */
+        while (neigh->nud_state == NUD_FAILED &&
+               (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
+                write_unlock(&neigh->lock);
+                neigh->ops->error_report(neigh, skb);
+                write_lock(&neigh->lock);
+        }
+        skb_queue_purge(&neigh->arp_queue);
+}
+
 /* Called when a timer expires for a neighbour entry. */
 
 static void neigh_timer_handler(unsigned long arg)
@@ -835,26 +857,9 @@ static void neigh_timer_handler(unsigned long arg)
 
         if ((neigh->nud_state & (NUD_INCOMPLETE | NUD_PROBE)) &&
             atomic_read(&neigh->probes) >= neigh_max_probes(neigh)) {
-                struct sk_buff *skb;
-
                 neigh->nud_state = NUD_FAILED;
-                neigh->updated = jiffies;
                 notify = 1;
-                NEIGH_CACHE_STAT_INC(neigh->tbl, res_failed);
-                NEIGH_PRINTK2("neigh %p is failed.\n", neigh);
-
-                /* It is very thin place. report_unreachable is very complicated
-                   routine. Particularly, it can hit the same neighbour entry!
-
-                   So that, we try to be accurate and avoid dead loop. --ANK
-                 */
-                while (neigh->nud_state == NUD_FAILED &&
-                       (skb = __skb_dequeue(&neigh->arp_queue)) != NULL) {
-                        write_unlock(&neigh->lock);
-                        neigh->ops->error_report(neigh, skb);
-                        write_lock(&neigh->lock);
-                }
-                skb_queue_purge(&neigh->arp_queue);
+                neigh_invalidate(neigh);
         }
 
         if (neigh->nud_state & NUD_IN_TIMER) {
@@ -1001,6 +1006,11 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                 neigh->nud_state = new;
                 err = 0;
                 notify = old & NUD_VALID;
+                if ((old & (NUD_INCOMPLETE | NUD_PROBE)) &&
+                    (new & NUD_FAILED)) {
+                        neigh_invalidate(neigh);
+                        notify = 1;
+                }
                 goto out;
         }
 
@@ -1088,8 +1098,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
                         struct neighbour *n1 = neigh;
                         write_unlock_bh(&neigh->lock);
                         /* On shaper/eql skb->dst->neighbour != neigh :( */
-                        if (skb->dst && skb->dst->neighbour)
-                                n1 = skb->dst->neighbour;
+                        if (skb_dst(skb) && skb_dst(skb)->neighbour)
+                                n1 = skb_dst(skb)->neighbour;
                         n1->output(skb);
                         write_lock_bh(&neigh->lock);
                 }
@@ -1182,7 +1192,7 @@ EXPORT_SYMBOL(neigh_compat_output);
 
 int neigh_resolve_output(struct sk_buff *skb)
 {
-        struct dst_entry *dst = skb->dst;
+        struct dst_entry *dst = skb_dst(skb);
         struct neighbour *neigh;
         int rc = 0;
 
@@ -1229,7 +1239,7 @@ EXPORT_SYMBOL(neigh_resolve_output);
 int neigh_connected_output(struct sk_buff *skb)
 {
         int err;
-        struct dst_entry *dst = skb->dst;
+        struct dst_entry *dst = skb_dst(skb);
         struct neighbour *neigh = dst->neighbour;
         struct net_device *dev = neigh->dev;
 
@@ -1298,8 +1308,7 @@ void pneigh_enqueue(struct neigh_table *tbl, struct neigh_parms *p,
                 if (time_before(tbl->proxy_timer.expires, sched_next))
                         sched_next = tbl->proxy_timer.expires;
         }
-        dst_release(skb->dst);
-        skb->dst = NULL;
+        skb_dst_drop(skb);
         dev_hold(skb->dev);
         __skb_queue_tail(&tbl->proxy_queue, skb);
         mod_timer(&tbl->proxy_timer, sched_next);