ipv6: Do not depend on rt->n in rt6_probe().

Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c7bcd777db230e8e46e2804eac1453353f8bd2a3..afc8386e3d9f4ddfc0cddaf3ebf97f167f04878c 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -498,28 +498,34 @@ static void rt6_probe(struct rt6_info *rt)
         * Router Reachability Probe MUST be rate-limited
         * to no more than one per minute.
         */
-       neigh = rt ? rt->n : NULL;
-       if (!neigh)
-               return;
-       write_lock_bh(&neigh->lock);
-       if (neigh->nud_state & NUD_VALID) {
-               write_unlock_bh(&neigh->lock);
+       if (!rt || !(rt->rt6i_flags & RTF_GATEWAY))
                return;
+       rcu_read_lock_bh();
+       neigh = __ipv6_neigh_lookup_noref(rt->dst.dev, &rt->rt6i_gateway);
+       if (neigh) {
+               write_lock(&neigh->lock);
+               if (neigh->nud_state & NUD_VALID)
+                       goto out;
        }
-       if (!(neigh->nud_state & NUD_VALID) &&
+
+       if (!neigh ||
            time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
                struct in6_addr mcaddr;
                struct in6_addr *target;
 
                neigh->updated = jiffies;
-               write_unlock_bh(&neigh->lock);
 
-               target = (struct in6_addr *)&neigh->primary_key;
+               if (neigh)
+                       write_unlock(&neigh->lock);
+
+               target = (struct in6_addr *)&rt->rt6i_gateway;
                addrconf_addr_solict_mult(target, &mcaddr);
                ndisc_send_ns(rt->dst.dev, NULL, target, &mcaddr, NULL);
        } else {
-               write_unlock_bh(&neigh->lock);
+out:
+               write_unlock(&neigh->lock);
        }
+       rcu_read_unlock_bh();
 }
 #else
 static inline void rt6_probe(struct rt6_info *rt)