Commit b1227d01 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ipvlan: fix various issues in ipvlan_process_multicast() 



1) netif_rx() / dev_forward_skb() should not be called from process
context.

2) ipvlan_count_rx() should be called with preemption disabled.

3) We should check if ipvlan->dev is up before feeding packets
to netif_rx()

4) We need to prevent device from disappearing if some packets
are in the multicast backlog.

5) One kfree_skb() should be a consume_skb() eventually

Fixes: ba35f858 ("ipvlan: Defer multicast / broadcast processing to
a work-queue")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Mahesh Bandewar <maheshb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 50b17cfb

drivers/net/ipvlan/ipvlan_core.c

+25 −13
Original line number Diff line number Diff line
@@ -207,6 +207,9 @@ void ipvlan_process_multicast(struct work_struct *work) 
	spin_unlock_bh(&port->backlog.lock);



	while ((skb = __skb_dequeue(&list)) != NULL) {

		struct net_device *dev = skb->dev;

		bool consumed = false;



		ethh = eth_hdr(skb);

		hlocal = ether_addr_equal(ethh->h_source, port->dev->dev_addr);

		mac_hash = ipvlan_mac_hash(ethh->h_dest);
@@ -219,27 +222,29 @@ void ipvlan_process_multicast(struct work_struct *work) 
		dlocal = false;

		rcu_read_lock();

		list_for_each_entry_rcu(ipvlan, &port->ipvlans, pnode) {

			if (hlocal && (ipvlan->dev == skb->dev)) {

			if (hlocal && (ipvlan->dev == dev)) {

				dlocal = true;

				continue;

			}

			if (!test_bit(mac_hash, ipvlan->mac_filters))

				continue;



			if (!(ipvlan->dev->flags & IFF_UP))

				continue;

			ret = NET_RX_DROP;

			len = skb->len + ETH_HLEN;

			nskb = skb_clone(skb, GFP_ATOMIC);

			if (!nskb)

				goto acct;



			local_bh_disable();

			if (nskb) {

				consumed = true;

				nskb->pkt_type = pkt_type;

				nskb->dev = ipvlan->dev;

				if (hlocal)

					ret = dev_forward_skb(ipvlan->dev, nskb);

				else

					ret = netif_rx(nskb);

acct:

			}

			ipvlan_count_rx(ipvlan, len, ret == NET_RX_SUCCESS, true);

			local_bh_enable();

		}

		rcu_read_unlock();
@@ -249,8 +254,13 @@ acct: 
			skb->pkt_type = pkt_type;

			dev_queue_xmit(skb);

		} else {

			if (consumed)

				consume_skb(skb);

			else

				kfree_skb(skb);

		}

		if (dev)

			dev_put(dev);

	}

}
@@ -479,6 +489,8 @@ static void ipvlan_multicast_enqueue(struct ipvl_port *port, 


	spin_lock(&port->backlog.lock);

	if (skb_queue_len(&port->backlog) < IPVLAN_QBACKLOG_LIMIT) {

		if (skb->dev)

			dev_hold(skb->dev);

		__skb_queue_tail(&port->backlog, skb);

		spin_unlock(&port->backlog.lock);

		schedule_work(&port->wq);

drivers/net/ipvlan/ipvlan_main.c

+6 −1
Original line number Diff line number Diff line
@@ -135,6 +135,7 @@ err: 
static void ipvlan_port_destroy(struct net_device *dev)

{

	struct ipvl_port *port = ipvlan_port_get_rtnl(dev);

	struct sk_buff *skb;



	dev->priv_flags &= ~IFF_IPVLAN_MASTER;

	if (port->mode == IPVLAN_MODE_L3S) {
@@ -144,7 +145,11 @@ static void ipvlan_port_destroy(struct net_device *dev) 
	}

	netdev_rx_handler_unregister(dev);

	cancel_work_sync(&port->wq);

	__skb_queue_purge(&port->backlog);

	while ((skb = __skb_dequeue(&port->backlog)) != NULL) {

		if (skb->dev)

			dev_put(skb->dev);

		kfree_skb(skb);

	}

	kfree(port);

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE