lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

[IFB]: Fix crash on input device removal

Browse Source 
The input_device pointer is not refcounted, which means the device may
disappear while packets are queued, causing a crash when ifb passes packets
with a stale skb->dev pointer to netif_rx().

Fix by storing the interface index instead and do a lookup where neccessary.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Patrick McHardy
2007-03-29 11:46:52 -07:00
committed by David S. Miller
parent db8b22550d
commit c01003c205
6 changed files with 27 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
net/core/dev.c
View File

@ -1741,8 +1741,8 @@ static int ing_filter(struct sk_buff *skb)
if (dev->qdisc_ingress) {
__u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd);
if (MAX_RED_LOOP < ttl++) {
printk(KERN_WARNING "Redir loop detected Dropping packet (%s->%s)\n",
skb->input_dev->name, skb->dev->name);
printk(KERN_WARNING "Redir loop detected Dropping packet (%d->%d)\n",
skb->iif, skb->dev->ifindex);
return TC_ACT_SHOT;
}
@ -1775,8 +1775,8 @@ int netif_receive_skb(struct sk_buff *skb)
if (!skb->tstamp.off_sec)
net_timestamp(skb);
if (!skb->input_dev)
skb->input_dev = skb->dev;
if (!skb->iif)
skb->iif = skb->dev->ifindex;
orig_dev = skb_bond(skb);