1 files changed, 18 insertions, 5 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index 0bc95f3977d2..ff302bde8890 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -206,7 +206,7 @@ static inline int ip_finish_output2(struct sk_buff *skb)
         }
 
         rcu_read_lock();
-        neigh = dst_get_neighbour(dst);
+        neigh = dst_get_neighbour_noref(dst);
         if (neigh) {
                 int res = neigh_output(neigh, skb);
 
@@ -319,6 +319,20 @@ int ip_output(struct sk_buff *skb)
                             !(IPCB(skb)->flags & IPSKB_REROUTED));
 }
 
+/*
+ * copy saddr and daddr, possibly using 64bit load/stores
+ * Equivalent to :
+ *   iph->saddr = fl4->saddr;
+ *   iph->daddr = fl4->daddr;
+ */
+static void ip_copy_addrs(struct iphdr *iph, const struct flowi4 *fl4)
+{
+        BUILD_BUG_ON(offsetof(typeof(*fl4), daddr) !=
+                     offsetof(typeof(*fl4), saddr) + sizeof(fl4->saddr));
+        memcpy(&iph->saddr, &fl4->saddr,
+               sizeof(fl4->saddr) + sizeof(fl4->daddr));
+}
+
 int ip_queue_xmit(struct sk_buff *skb, struct flowi *fl)
 {
         struct sock *sk = skb->sk;
@@ -381,8 +395,8 @@ packet_routed:
                 iph->frag_off = 0;
         iph->ttl      = ip_select_ttl(inet, &rt->dst);
         iph->protocol = sk->sk_protocol;
-        iph->saddr    = fl4->saddr;
-        iph->daddr    = fl4->daddr;
+        ip_copy_addrs(iph, fl4);
+
         /* Transport layer set skb->h.foo itself. */
 
         if (inet_opt && inet_opt->opt.optlen) {
@@ -1337,8 +1351,7 @@ struct sk_buff *__ip_make_skb(struct sock *sk,
         ip_select_ident(iph, &rt->dst, sk);
         iph->ttl = ttl;
         iph->protocol = sk->sk_protocol;
-        iph->saddr = fl4->saddr;
-        iph->daddr = fl4->daddr;
+        ip_copy_addrs(iph, fl4);
 
         if (opt) {
                 iph->ihl += opt->optlen>>2;