veth: Dont kfree_skb() after dev_forward_skb() (6ec82562) · Commits · 戴 / test

In case of congestion, netif_rx() frees the skb, so we must assume dev_forward_skb() also consume skb. Bug introduced by commit (veth: move loopback logic to common location) We must change dev_forward_skb() to always consume skb, and veth to not double free it. Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3 Reported-by:

Martín Ferrari <martin.ferrari@gmail.com> Signed-off-by:

Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/veth.c

+0 −1

Original line number	Diff line number	Diff line
		@@ -187,7 +187,6 @@ tx_drop:
		return NETDEV_TX_OK;

		rx_drop:
		kfree_skb(skb);
		rcv_stats->rx_dropped++;
		return NETDEV_TX_OK;
		}

net/core/dev.c

+5 −6

Original line number	Diff line number	Diff line
		@@ -1451,7 +1451,7 @@ static inline void net_timestamp(struct sk_buff *skb)
		*
		* return values:
		* NET_RX_SUCCESS (no congestion)
		* NET_RX_DROP (packet was dropped)
		* NET_RX_DROP (packet was dropped, but freed)
		*
		* dev_forward_skb can be used for injecting an skb from the
		* start_xmit function of one device into the receive queue
		@@ -1465,12 +1465,11 @@ int dev_forward_skb(struct net_device dev, struct sk_buff skb)
		{
		skb_orphan(skb);

		if (!(dev->flags & IFF_UP))
		return NET_RX_DROP;

		if (skb->len > (dev->mtu + dev->hard_header_len))
		if (!(dev->flags & IFF_UP) \|\|
		(skb->len > (dev->mtu + dev->hard_header_len))) {
		kfree_skb(skb);
		return NET_RX_DROP;

		}
		skb_set_dev(skb, dev);
		skb->tstamp.tv64 = 0;
		skb->pkt_type = PACKET_HOST;

Admin message