route: release dst_entry.hh_cache when handling redirects

Stable-3.0 commit 42ab5316 (ipv4: fix redirect handling) was
backport of mainline commit 9cc20b26 from 3.2-rc3 where hh
member of struct dst_entry was already gone.

However, in 3.0 we still have it and we have to clean it as
well, otherwise it keeps pointing to the cleaned up (and
unusable) hh_cache entry and packets cannot be sent out.

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 6b95f74a91d3f87c5d6b4f2bcef7dc35b671882d..5ff2614706e73b52a4ac906343c7a9552c5113f1 100644 (file)
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1374,6 +1374,7 @@ static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
        struct rtable *rt = (struct rtable *) dst;
        __be32 orig_gw = rt->rt_gateway;
        struct neighbour *n, *old_n;
+       struct hh_cache *old_hh;
 
        dst_confirm(&rt->dst);
 
@@ -1381,6 +1382,9 @@ static int check_peer_redir(struct dst_entry *dst, struct inet_peer *peer)
        n = __arp_bind_neighbour(&rt->dst, rt->rt_gateway);
        if (IS_ERR(n))
                return PTR_ERR(n);
+       old_hh = xchg(&rt->dst.hh, NULL);
+       if (old_hh)
+               hh_cache_put(old_hh);
        old_n = xchg(&rt->dst._neighbour, n);
        if (old_n)
                neigh_release(old_n);