| Message ID | 20111213.173848.752183482333371118.davem@davemloft.net |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
diff --git a/net/ipv6/route.c b/net/ipv6/route.c index d98cf41..4bf362b 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -1089,8 +1089,10 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev, neigh_hold(neigh); else { neigh = __neigh_lookup_errno(&nd_tbl, &fl6->daddr, dev); - if (IS_ERR(neigh)) - neigh = NULL; + if (IS_ERR(neigh)) { + dst_free(&rt->dst); + return ERR_CAST(neigh); + } } rt->dst.flags |= DST_HOST;
Don't just succeed with a route that has a NULL neighbour attached. This follows the behavior of addrconf_dst_alloc(). Allowing this kind of route to end up with a NULL neigh attached will result in packet drops on output until the route is somehow invalidated, since nothing will meanwhile try to lookup the neigh again. A statistic is bumped for the case where we see a neigh-less route on output, but the resulting packet drop is otherwise silent in nature, and frankly it's a hard error for this to happen and ipv6 should do what ipv4 does which is say something in the kernel logs. Signed-off-by: David S. Miller <davem@davemloft.net> --- net/ipv6/route.c | 6 ++++-- 1 files changed, 4 insertions(+), 2 deletions(-)