Kernel/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-01-09 23:00:21 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

veth: Dont kfree_skb() after dev_forward_skb()

Browse Source 
In case of congestion, netif_rx() frees the skb, so we must assume
dev_forward_skb() also consume skb.

Bug introduced by commit 445409602c092
(veth: move loopback logic to common location)

We must change dev_forward_skb() to always consume skb, and veth to not
double free it.

Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3

Reported-by: Martín Ferrari <martin.ferrari@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2010-05-06 00:53:53 -07:00 committed by David S. Miller
parent d40a4de0be
commit 6ec82562ff
2 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
drivers/net/veth.c
View File

@ -187,7 +187,6 @@ tx_drop:
return NETDEV_TX_OK; return NETDEV_TX_OK;
rx_drop: rx_drop:
kfree_skb(skb);
rcv_stats->rx_dropped++; rcv_stats->rx_dropped++;
return NETDEV_TX_OK; return NETDEV_TX_OK;
} }

11
net/core/dev.c
View File

@ -1451,7 +1451,7 @@ static inline void net_timestamp(struct sk_buff *skb)
* *
* return values: * return values:
* NET_RX_SUCCESS (no congestion) * NET_RX_SUCCESS (no congestion)
* NET_RX_DROP (packet was dropped) * NET_RX_DROP (packet was dropped, but freed)
* *
* dev_forward_skb can be used for injecting an skb from the * dev_forward_skb can be used for injecting an skb from the
* start_xmit function of one device into the receive queue * start_xmit function of one device into the receive queue
@ -1465,12 +1465,11 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
{ {
skb_orphan(skb); skb_orphan(skb);
if (!(dev->flags & IFF_UP)) if (!(dev->flags & IFF_UP) ||
(skb->len > (dev->mtu + dev->hard_header_len))) {
kfree_skb(skb);
return NET_RX_DROP; return NET_RX_DROP;
}
if (skb->len > (dev->mtu + dev->hard_header_len))
return NET_RX_DROP;
skb_set_dev(skb, dev); skb_set_dev(skb, dev);
skb->tstamp.tv64 = 0; skb->tstamp.tv64 = 0;
skb->pkt_type = PACKET_HOST; skb->pkt_type = PACKET_HOST;