diff options
| author | Patrick McHardy <kaber@trash.net> | 2007-04-03 04:03:55 +0200 |
|---|---|---|
| committer | Adrian Bunk <bunk@stusta.de> | 2007-04-03 04:03:55 +0200 |
| commit | 5f4a9d1b7a413d6aac382c51692ac0df785068c5 (patch) | |
| tree | 51067f1b0f341dcebc79e5c17e88d45189e613ee /drivers | |
| parent | cceec5186fce242e095dc5e9496841df5d4133b9 (diff) | |
[IFB]: Fix crash on input device removal
The input_device pointer is not refcounted, which means the device may
disappear while packets are queued, causing a crash when ifb passes packets
with a stale skb->dev pointer to netif_rx().
Fix by storing the interface index instead and do a lookup where neccessary.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/ifb.c | 35 |
1 files changed, 13 insertions, 22 deletions
diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c index 31fb2d75dc44..28280d9284cf 100644 --- a/drivers/net/ifb.c +++ b/drivers/net/ifb.c @@ -97,17 +97,24 @@ static void ri_tasklet(unsigned long dev) skb->tc_verd = SET_TC_NCLS(skb->tc_verd); stats->tx_packets++; stats->tx_bytes +=skb->len; + + skb->dev = __dev_get_by_index(skb->iif); + if (!skb->dev) { + dev_kfree_skb(skb); + stats->tx_dropped++; + break; + } + skb->iif = _dev->ifindex; + if (from & AT_EGRESS) { dp->st_rx_frm_egr++; dev_queue_xmit(skb); } else if (from & AT_INGRESS) { - dp->st_rx_frm_ing++; + skb_pull(skb, skb->dev->hard_header_len); netif_rx(skb); - } else { - dev_kfree_skb(skb); - stats->tx_dropped++; - } + } else + BUG(); } if (spin_trylock(&_dev->xmit_lock)) { @@ -158,26 +165,10 @@ static int ifb_xmit(struct sk_buff *skb, struct net_device *dev) stats->tx_packets++; stats->tx_bytes+=skb->len; - if (!from || !skb->input_dev) { -dropped: + if (!(from & (AT_INGRESS|AT_EGRESS)) || !skb->iif) { dev_kfree_skb(skb); stats->rx_dropped++; return ret; - } else { - /* - * note we could be going - * ingress -> egress or - * egress -> ingress - */ - skb->dev = skb->input_dev; - skb->input_dev = dev; - if (from & AT_INGRESS) { - skb_pull(skb, skb->dev->hard_header_len); - } else { - if (!(from & AT_EGRESS)) { - goto dropped; - } - } } if (skb_queue_len(&dp->rq) >= dev->tx_queue_len) { |