net: neigh: guard against NULL solicit() method

[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / core / neighbour.c

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5c56b217b999d114ea7954a9e6060a77d906ceff..fb82e8a5b00611797ba8700e5ade4266723bbeec 100644 (file)
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -231,7 +231,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev)
                                   we must kill timers etc. and move
                                   it to safe state.
                                 */
-                               skb_queue_purge(&n->arp_queue);
+                               __skb_queue_purge(&n->arp_queue);
                                n->arp_queue_len_bytes = 0;
                                n->output = neigh_blackhole;
                                if (n->nud_state & NUD_VALID)
@@ -286,7 +286,7 @@ static struct neighbour *neigh_alloc(struct neigh_table *tbl, struct net_device
        if (!n)
                goto out_entries;
 
-       skb_queue_head_init(&n->arp_queue);
+       __skb_queue_head_init(&n->arp_queue);
        rwlock_init(&n->lock);
        seqlock_init(&n->ha_lock);
        n->updated        = n->used = now;
@@ -708,7 +708,9 @@ void neigh_destroy(struct neighbour *neigh)
        if (neigh_del_timer(neigh))
                pr_warn("Impossible event\n");
 
-       skb_queue_purge(&neigh->arp_queue);
+       write_lock_bh(&neigh->lock);
+       __skb_queue_purge(&neigh->arp_queue);
+       write_unlock_bh(&neigh->lock);
        neigh->arp_queue_len_bytes = 0;
 
        if (dev->netdev_ops->ndo_neigh_destroy)
@@ -762,9 +764,6 @@ static void neigh_periodic_work(struct work_struct *work)
        nht = rcu_dereference_protected(tbl->nht,
                                        lockdep_is_held(&tbl->lock));
 
-       if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
-               goto out;
-
        /*
         *      periodically recompute ReachableTime from random function
         */
@@ -777,6 +776,9 @@ static void neigh_periodic_work(struct work_struct *work)
                                neigh_rand_reach_time(p->base_reachable_time);
        }
 
+       if (atomic_read(&tbl->entries) < tbl->gc_thresh1)
+               goto out;
+
        for (i = 0 ; i < (1 << nht->hash_shift); i++) {
                np = &nht->hash_buckets[i];
 
@@ -858,7 +860,7 @@ static void neigh_invalidate(struct neighbour *neigh)
                neigh->ops->error_report(neigh, skb);
                write_lock(&neigh->lock);
        }
-       skb_queue_purge(&neigh->arp_queue);
+       __skb_queue_purge(&neigh->arp_queue);
        neigh->arp_queue_len_bytes = 0;
 }
 
@@ -870,7 +872,8 @@ static void neigh_probe(struct neighbour *neigh)
        if (skb)
                skb = skb_copy(skb, GFP_ATOMIC);
        write_unlock(&neigh->lock);
-       neigh->ops->solicit(neigh, skb);
+       if (neigh->ops->solicit)
+               neigh->ops->solicit(neigh, skb);
        atomic_inc(&neigh->probes);
        kfree_skb(skb);
 }
@@ -1210,7 +1213,7 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
 
                        write_lock_bh(&neigh->lock);
                }
-               skb_queue_purge(&neigh->arp_queue);
+               __skb_queue_purge(&neigh->arp_queue);
                neigh->arp_queue_len_bytes = 0;
        }
 out:
@@ -1272,7 +1275,7 @@ int neigh_compat_output(struct neighbour *neigh, struct sk_buff *skb)
 
        if (dev_hard_header(skb, dev, ntohs(skb->protocol), NULL, NULL,
                            skb->len) < 0 &&
-           dev->header_ops->rebuild(skb))
+           dev_rebuild_header(skb))
                return 0;
 
        return dev_queue_xmit(skb);
@@ -1443,16 +1446,18 @@ struct neigh_parms *neigh_parms_alloc(struct net_device *dev,
                atomic_set(&p->refcnt, 1);
                p->reachable_time =
                                neigh_rand_reach_time(p->base_reachable_time);
+               dev_hold(dev);
+               p->dev = dev;
+               write_pnet(&p->net, hold_net(net));
+               p->sysctl_table = NULL;
 
                if (ops->ndo_neigh_setup && ops->ndo_neigh_setup(dev, p)) {
+                       release_net(net);
+                       dev_put(dev);
                        kfree(p);
                        return NULL;
                }
 
-               dev_hold(dev);
-               p->dev = dev;
-               write_pnet(&p->net, hold_net(net));
-               p->sysctl_table = NULL;
                write_lock_bh(&tbl->lock);
                p->next         = tbl->parms.next;
                tbl->parms.next = p;