2 files changed, 16 insertions, 8 deletions

diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
index ccaaa851ab42..77d3eded665a 100644
--- a/net/ipv4/ip_output.c
+++ b/net/ipv4/ip_output.c
@@ -204,9 +204,15 @@ static inline int ip_finish_output2(struct sk_buff *skb)
                 skb = skb2;
         }
 
+        rcu_read_lock();
         neigh = dst_get_neighbour(dst);
-        if (neigh)
-                return neigh_output(neigh, skb);
+        if (neigh) {
+                int res = neigh_output(neigh, skb);
+
+                rcu_read_unlock();
+                return res;
+        }
+        rcu_read_unlock();
 
         if (net_ratelimit())
                 printk(KERN_DEBUG "ip_finish_output2: No header cache and no neighbour!\n");
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 1730689f560e..6afc4eb50591 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1628,16 +1628,18 @@ static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
 {
         struct rtable *rt = (struct rtable *) dst;
         __be32 orig_gw = rt->rt_gateway;
-        struct neighbour *n;
+        struct neighbour *n, *old_n;
 
         dst_confirm(&rt->dst);
 
-        neigh_release(dst_get_neighbour(&rt->dst));
-        dst_set_neighbour(&rt->dst, NULL);
-
         rt->rt_gateway = peer->redirect_learned.a4;
-        rt_bind_neighbour(rt);
-        n = dst_get_neighbour(&rt->dst);
+
+        n = ipv4_neigh_lookup(&rt->dst, &rt->rt_gateway);
+        if (IS_ERR(n))
+                return PTR_ERR(n);
+        old_n = xchg(&rt->dst._neighbour, n);
+        if (old_n)
+                neigh_release(old_n);
         if (!n || !(n->nud_state & NUD_VALID)) {
                 if (n)
                         neigh_event_send(n, NULL);