From: Herbert Xu herbert@gondor.apana.org.au
commit 260916dfb48c374f7840f3b86e69afd3afdb6e96 upstream.
When we postpone a broadcast packet we save the source port in the skb if it is local. However, the source port can disappear before we get a chance to process the packet.
This patch fixes this by holding a ref count on the netdev.
It also delays the skb->cb modification until after we allocate the new skb as you should not modify shared skbs.
Fixes: 412ca1550cbe ("macvlan: Move broadcasts into a work queue") Signed-off-by: Herbert Xu herbert@gondor.apana.org.au Signed-off-by: David S. Miller davem@davemloft.net Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org
--- drivers/net/macvlan.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
--- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -305,6 +305,8 @@ static void macvlan_process_broadcast(st
rcu_read_unlock();
+ if (src) + dev_put(src->dev); kfree_skb(skb);
cond_resched(); @@ -312,6 +314,7 @@ static void macvlan_process_broadcast(st }
static void macvlan_broadcast_enqueue(struct macvlan_port *port, + const struct macvlan_dev *src, struct sk_buff *skb) { struct sk_buff *nskb; @@ -321,8 +324,12 @@ static void macvlan_broadcast_enqueue(st if (!nskb) goto err;
+ MACVLAN_SKB_CB(nskb)->src = src; + spin_lock(&port->bc_queue.lock); if (skb_queue_len(&port->bc_queue) < MACVLAN_BC_QUEUE_LEN) { + if (src) + dev_hold(src->dev); __skb_queue_tail(&port->bc_queue, nskb); err = 0; } @@ -432,8 +439,7 @@ static rx_handler_result_t macvlan_handl goto out; }
- MACVLAN_SKB_CB(skb)->src = src; - macvlan_broadcast_enqueue(port, skb); + macvlan_broadcast_enqueue(port, src, skb);
return RX_HANDLER_PASS; }