Commit fbd02dd4 authored by Pravin B Shelar's avatar Pravin B Shelar Committed by David S. Miller
Browse files

ip_tunnel: Fix dst ref-count. 

Commit 10ddceb2 (ip_tunnel:multicast process cause panic due
to skb->_skb_refdst NULL pointer) removed dst-drop call from
ip-tunnel-recv.

Following commit reintroduce dst-drop and fix the original bug by
checking loopback packet before releasing dst.
Original bug: https://bugzilla.kernel.org/show_bug.cgi?id=70681



CC: Xin Long <lucien.xin@gmail.com>
Signed-off-by: default avatarPravin B Shelar <pshelar@nicira.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 632b06aa

net/ipv4/gre_demux.c

+8 −0
Original line number Diff line number Diff line
@@ -182,6 +182,14 @@ static int gre_cisco_rcv(struct sk_buff *skb) 
	int i;

	bool csum_err = false;



#ifdef CONFIG_NET_IPGRE_BROADCAST

	if (ipv4_is_multicast(ip_hdr(skb)->daddr)) {

		/* Looped back packet, drop it! */

		if (rt_is_output_route(skb_rtable(skb)))

			goto drop;

	}

#endif



	if (parse_gre_header(skb, &tpi, &csum_err) < 0)

		goto drop;

net/ipv4/ip_tunnel.c

+0 −3
Original line number Diff line number Diff line
@@ -416,9 +416,6 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb, 


#ifdef CONFIG_NET_IPGRE_BROADCAST

	if (ipv4_is_multicast(iph->daddr)) {

		/* Looped back packet, drop it! */

		if (rt_is_output_route(skb_rtable(skb)))

			goto drop;

		tunnel->dev->stats.multicast++;

		skb->pkt_type = PACKET_BROADCAST;

	}

net/ipv4/ip_tunnel_core.c

+1 −0
Original line number Diff line number Diff line
@@ -108,6 +108,7 @@ int iptunnel_pull_header(struct sk_buff *skb, int hdr_len, __be16 inner_proto) 
	nf_reset(skb);

	secpath_reset(skb);

	skb_clear_hash_if_not_l4(skb);

	skb_dst_drop(skb);

	skb->vlan_tci = 0;

	skb_set_queue_mapping(skb, 0);

	skb->pkt_type = PACKET_HOST;

CRA Git | Maintained and supported by SUSTech CRA and CCSE