diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2010-07-05 22:12:53 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2010-08-02 10:26:25 -0700 |
| commit | e5f98e5c9f479a909d8510d46bd4874161a1c0b3 (patch) | |
| tree | 7823f1560912420ccc7e4d51dad246bcbcc3032a /net/core/dev.c | |
| parent | e1d08ba9d511d0152eaa80c6a460fdbd48926e12 (diff) | |
veth: Dont kfree_skb() after dev_forward_skb()
[ Upstream commit 6ec82562ffc6f297d0de36d65776cff8e5704867 ]
In case of congestion, netif_rx() frees the skb, so we must assume
dev_forward_skb() also consume skb.
Bug introduced by commit 445409602c092
(veth: move loopback logic to common location)
We must change dev_forward_skb() to always consume skb, and veth to not
double free it.
Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3
Reported-by: MartÃn Ferrari <martin.ferrari@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Diffstat (limited to 'net/core/dev.c')
| -rw-r--r-- | net/core/dev.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index f51f940a077..cfd755705ee 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1428,7 +1428,7 @@ static inline void net_timestamp(struct sk_buff *skb) * * return values: * NET_RX_SUCCESS (no congestion) - * NET_RX_DROP (packet was dropped) + * NET_RX_DROP (packet was dropped, but freed) * * dev_forward_skb can be used for injecting an skb from the * start_xmit function of one device into the receive queue @@ -1442,11 +1442,11 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) { skb_orphan(skb); - if (!(dev->flags & IFF_UP)) - return NET_RX_DROP; - - if (skb->len > (dev->mtu + dev->hard_header_len)) + if (!(dev->flags & IFF_UP) || + (skb->len > (dev->mtu + dev->hard_header_len))) { + kfree_skb(skb); return NET_RX_DROP; + } skb_dst_drop(skb); skb->tstamp.tv64 = 0; |