From 9a77a92b619745d3fc3f51b55dbb2a25f38d7596 Mon Sep 17 00:00:00 2001
From: "David S. Miller" <davem@davemloft.net>
Date: Fri, 27 Jan 2012 15:30:48 -0800
Subject: [PATCH] --- yaml --- r: 289781 b: refs/heads/master c:
 4991969a1027826c3db19dd3e600e145603e6928 h: refs/heads/master i:   289779:
 f734ebe1cb0a1ecb6642ac8b1e941cfc2f9216b3 v: v3

---
 [refs]                      |  2 +-
 trunk/include/net/ndisc.h   |  1 -
 trunk/net/ipv6/ip6_output.c |  2 +-
 trunk/net/ipv6/ndisc.c      | 12 ++++++++++--
 4 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/[refs] b/[refs]
index c9fc1a3ea5d9..03d57ac1475b 100644
--- a/[refs]
+++ b/[refs]
@@ -1,2 +1,2 @@
 ---
-refs/heads/master: 5339ab8b1dd82f14df168fb9bf59449f3e24b03d
+refs/heads/master: 4991969a1027826c3db19dd3e600e145603e6928
diff --git a/trunk/include/net/ndisc.h b/trunk/include/net/ndisc.h
index e3133c23980e..6f9c25a76cd1 100644
--- a/trunk/include/net/ndisc.h
+++ b/trunk/include/net/ndisc.h
@@ -133,7 +133,6 @@ extern void			ndisc_send_rs(struct net_device *dev,
 					      const struct in6_addr *daddr);
 
 extern void			ndisc_send_redirect(struct sk_buff *skb,
-						    struct neighbour *neigh,
 						    const struct in6_addr *target);
 
 extern int			ndisc_mc_map(const struct in6_addr *addr, char *buf,
diff --git a/trunk/net/ipv6/ip6_output.c b/trunk/net/ipv6/ip6_output.c
index d97e07183ce9..604809b89b67 100644
--- a/trunk/net/ipv6/ip6_output.c
+++ b/trunk/net/ipv6/ip6_output.c
@@ -486,7 +486,7 @@ int ip6_forward(struct sk_buff *skb)
 		   and by source (inside ndisc_send_redirect)
 		 */
 		if (inet_peer_xrlim_allow(rt->rt6i_peer, 1*HZ))
-			ndisc_send_redirect(skb, n, target);
+			ndisc_send_redirect(skb, target);
 	} else {
 		int addrtype = ipv6_addr_type(&hdr->saddr);
 
diff --git a/trunk/net/ipv6/ndisc.c b/trunk/net/ipv6/ndisc.c
index c574ebce3fb5..8d817018c188 100644
--- a/trunk/net/ipv6/ndisc.c
+++ b/trunk/net/ipv6/ndisc.c
@@ -1512,8 +1512,7 @@ static void ndisc_redirect_rcv(struct sk_buff *skb)
 	}
 }
 
-void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
-			 const struct in6_addr *target)
+void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target)
 {
 	struct net_device *dev = skb->dev;
 	struct net *net = dev_net(dev);
@@ -1571,6 +1570,13 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 		goto release;
 
 	if (dev->addr_len) {
+		struct neighbour *neigh = dst_neigh_lookup(skb_dst(skb), target);
+		if (!neigh) {
+			ND_PRINTK2(KERN_WARNING
+				   "ICMPv6 Redirect: no neigh for target address\n");
+			goto release;
+		}
+
 		read_lock_bh(&neigh->lock);
 		if (neigh->nud_state & NUD_VALID) {
 			memcpy(ha_buf, neigh->ha, dev->addr_len);
@@ -1579,6 +1585,8 @@ void ndisc_send_redirect(struct sk_buff *skb, struct neighbour *neigh,
 			len += ndisc_opt_addr_space(dev);
 		} else
 			read_unlock_bh(&neigh->lock);
+
+		neigh_release(neigh);
 	}
 
 	rd_len = min_t(unsigned int,