lkml.org 
[lkml]   [2010]   [Jul]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[011/140] veth: Dont kfree_skb() after dev_forward_skb()
    2.6.33-stable review patch.  If anyone has any objections, please let us know.

    ------------------


    From: Eric Dumazet <eric.dumazet@gmail.com>

    [ Upstream commit 6ec82562ffc6f297d0de36d65776cff8e5704867 ]

    In case of congestion, netif_rx() frees the skb, so we must assume
    dev_forward_skb() also consume skb.

    Bug introduced by commit 445409602c092
    (veth: move loopback logic to common location)

    We must change dev_forward_skb() to always consume skb, and veth to not
    double free it.

    Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3

    Reported-by: Martín Ferrari <martin.ferrari@gmail.com>
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
    ---
    drivers/net/veth.c | 1 -
    net/core/dev.c | 10 +++++-----
    2 files changed, 5 insertions(+), 6 deletions(-)

    --- a/drivers/net/veth.c
    +++ b/drivers/net/veth.c
    @@ -186,7 +186,6 @@ tx_drop:
    return NETDEV_TX_OK;

    rx_drop:
    - kfree_skb(skb);
    rcv_stats->rx_dropped++;
    return NETDEV_TX_OK;
    }
    --- a/net/core/dev.c
    +++ b/net/core/dev.c
    @@ -1428,7 +1428,7 @@ static inline void net_timestamp(struct
    *
    * return values:
    * NET_RX_SUCCESS (no congestion)
    - * NET_RX_DROP (packet was dropped)
    + * NET_RX_DROP (packet was dropped, but freed)
    *
    * dev_forward_skb can be used for injecting an skb from the
    * start_xmit function of one device into the receive queue
    @@ -1442,11 +1442,11 @@ int dev_forward_skb(struct net_device *d
    {
    skb_orphan(skb);

    - if (!(dev->flags & IFF_UP))
    - return NET_RX_DROP;
    -
    - if (skb->len > (dev->mtu + dev->hard_header_len))
    + if (!(dev->flags & IFF_UP) ||
    + (skb->len > (dev->mtu + dev->hard_header_len))) {
    + kfree_skb(skb);
    return NET_RX_DROP;
    + }

    skb_dst_drop(skb);
    skb->tstamp.tv64 = 0;

    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2010-07-30 20:53    [W:0.032 / U:1.432 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site