[IFB]: Fix crash on input device removal

The input_device pointer is not refcounted, which means the device may
disappear while packets are queued, causing a crash when ifb passes packets
with a stale skb->dev pointer to netif_rx().

Fix by storing the interface index instead and do a lookup where neccessary.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>

diff --git a/drivers/net/ifb.c b/drivers/net/ifb.c
index 31fb2d75dc447a79bffa71f86d728425b68472a1..28280d9284cfa8548c1604286fdb1f63a3cbbffc 100644 (file)
--- a/drivers/net/ifb.c
+++ b/drivers/net/ifb.c
@@ -97,17 +97,24 @@ static void ri_tasklet(unsigned long dev)
                skb->tc_verd = SET_TC_NCLS(skb->tc_verd);
                stats->tx_packets++;
                stats->tx_bytes +=skb->len;
+
+               skb->dev = __dev_get_by_index(skb->iif);
+               if (!skb->dev) {
+                       dev_kfree_skb(skb);
+                       stats->tx_dropped++;
+                       break;
+               }
+               skb->iif = _dev->ifindex;
+
                if (from & AT_EGRESS) {
                        dp->st_rx_frm_egr++;
                        dev_queue_xmit(skb);
                } else if (from & AT_INGRESS) {
-
                        dp->st_rx_frm_ing++;
+                       skb_pull(skb, skb->dev->hard_header_len);
                        netif_rx(skb);
-               } else {
-                       dev_kfree_skb(skb);
-                       stats->tx_dropped++;
-               }
+               } else
+                       BUG();
        }
 
        if (spin_trylock(&_dev->xmit_lock)) {
@@ -158,26 +165,10 @@ static int ifb_xmit(struct sk_buff *skb, struct net_device *dev)
        stats->tx_packets++;
        stats->tx_bytes+=skb->len;
 
-       if (!from || !skb->input_dev) {
-dropped:
+       if (!(from & (AT_INGRESS|AT_EGRESS)) || !skb->iif) {
                dev_kfree_skb(skb);
                stats->rx_dropped++;
                return ret;
-       } else {
-               /* 
-                * note we could be going
-                * ingress -> egress or
-                * egress -> ingress
-               */
-               skb->dev = skb->input_dev;
-               skb->input_dev = dev;
-               if (from & AT_INGRESS) {
-                       skb_pull(skb, skb->dev->hard_header_len);
-               } else {
-                       if (!(from & AT_EGRESS)) {
-                               goto dropped;
-                       }
-               }
        }
 
        if (skb_queue_len(&dp->rq) >= dev->tx_queue_len) {

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 7e631a542577deac5830f72f223ff45825b08931..2e9eb624aaa98e6df89ac28c5ce1d0e4fce67cd4 100644 (file)
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -175,7 +175,7 @@ enum {
  *     @sk: Socket we are owned by
  *     @tstamp: Time we arrived
  *     @dev: Device we arrived on/are leaving by
- *     @input_dev: Device we arrived on
+ *     @iif: ifindex of device we arrived on
  *     @h: Transport layer header
  *     @nh: Network layer header
  *     @mac: Link layer header
@@ -219,7 +219,8 @@ struct sk_buff {
        struct sock             *sk;
        struct skb_timeval      tstamp;
        struct net_device       *dev;
-       struct net_device       *input_dev;
+       int                     iif;
+       /* 4 byte hole on 64 bit*/
 
        union {
                struct tcphdr   *th;

diff --git a/include/net/pkt_cls.h b/include/net/pkt_cls.h
index b902d24a32563f424d0934a6fb04d504a0b1e3ca..02647fe3d74bfc99ad7f3e836075dbf70a8d96bd 100644 (file)
--- a/include/net/pkt_cls.h
+++ b/include/net/pkt_cls.h
@@ -352,10 +352,13 @@ tcf_change_indev(struct tcf_proto *tp, char *indev, struct rtattr *indev_tlv)
 static inline int
 tcf_match_indev(struct sk_buff *skb, char *indev)
 {
+       struct net_device *dev;
+
        if (indev[0]) {
-               if  (!skb->input_dev)
+               if  (!skb->iif)
                        return 0;
-               if (strcmp(indev, skb->input_dev->name))
+               dev = __dev_get_by_index(skb->iif);
+               if (!dev || strcmp(indev, dev->name))
                        return 0;
        }
 

diff --git a/net/core/dev.c b/net/core/dev.c
index 23cdd8b0575137cb5535a5aef2fe42f840493411..57a4cebc045819c481e83b823dd2d575f7877662 100644 (file)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1557,8 +1557,8 @@ static int ing_filter(struct sk_buff *skb)
        if (dev->qdisc_ingress) {
                __u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd);
                if (MAX_RED_LOOP < ttl++) {
-                       printk("Redir loop detected Dropping packet (%s->%s)\n",
-                               skb->input_dev->name, skb->dev->name);
+                       printk("Redir loop detected Dropping packet (%d->%d)\n",
+                               skb->iif, skb->dev->ifindex);
                        return TC_ACT_SHOT;
                }
 
@@ -1591,8 +1591,8 @@ int netif_receive_skb(struct sk_buff *skb)
        if (!skb->tstamp.off_sec)
                net_timestamp(skb);
 
-       if (!skb->input_dev)
-               skb->input_dev = skb->dev;
+       if (!skb->iif)
+               skb->iif = skb->dev->ifindex;
 
        orig_dev = skb_bond(skb);
 

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 890512eb66ce1834824170a3bf74cf3b4e0ada94..41b737637a762d6b7b6b6d6ea8a5e5cc515ddc13 100644 (file)
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -443,7 +443,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
        n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
        n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
        n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
-       C(input_dev);
+       C(iif);
 #endif
 
 #endif

diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 4fcccbd5088590054847c338cd8e2c23d0b8d90e..6b2188b181453e8d005393db71ee80f7ebcd8694 100644 (file)
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -207,7 +207,7 @@ bad_mirred:
                skb2->tc_verd = SET_TC_FROM(skb2->tc_verd, at);
 
        skb2->dev = dev;
-       skb2->input_dev = skb->dev;
+       skb2->iif = skb->dev->ifindex;
        dev_queue_xmit(skb2);
        spin_unlock(&p->lock);
        return p->action;