From: Eric Dumazet Date: Tue, 6 Jul 2010 05:12:53 +0000 (-0700) Subject: veth: Dont kfree_skb() after dev_forward_skb() X-Git-Tag: v2.6.33.7~130 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e5f98e5c9f479a909d8510d46bd4874161a1c0b3;p=thirdparty%2Fkernel%2Fstable.git veth: Dont kfree_skb() after dev_forward_skb() [ Upstream commit 6ec82562ffc6f297d0de36d65776cff8e5704867 ] In case of congestion, netif_rx() frees the skb, so we must assume dev_forward_skb() also consume skb. Bug introduced by commit 445409602c092 (veth: move loopback logic to common location) We must change dev_forward_skb() to always consume skb, and veth to not double free it. Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3 Reported-by: Martín Ferrari Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- diff --git a/drivers/net/veth.c b/drivers/net/veth.c index 3a15de56df9ca..baf0b514092dc 100644 --- a/drivers/net/veth.c +++ b/drivers/net/veth.c @@ -186,7 +186,6 @@ tx_drop: return NETDEV_TX_OK; rx_drop: - kfree_skb(skb); rcv_stats->rx_dropped++; return NETDEV_TX_OK; } diff --git a/net/core/dev.c b/net/core/dev.c index f51f940a077c1..cfd755705ee79 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1428,7 +1428,7 @@ static inline void net_timestamp(struct sk_buff *skb) * * return values: * NET_RX_SUCCESS (no congestion) - * NET_RX_DROP (packet was dropped) + * NET_RX_DROP (packet was dropped, but freed) * * dev_forward_skb can be used for injecting an skb from the * start_xmit function of one device into the receive queue @@ -1442,11 +1442,11 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb) { skb_orphan(skb); - if (!(dev->flags & IFF_UP)) - return NET_RX_DROP; - - if (skb->len > (dev->mtu + dev->hard_header_len)) + if (!(dev->flags & IFF_UP) || + (skb->len > (dev->mtu + dev->hard_header_len))) { + kfree_skb(skb); return NET_RX_DROP; + } skb_dst_drop(skb); skb->tstamp.tv64 = 0;