diff options
| author | Eric Dumazet <eric.dumazet@gmail.com> | 2010-04-11 21:18:17 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-04-15 01:27:11 -0700 |
| commit | 8728c544a9cbdcb0034aa5c45706c5f953f030ee (patch) | |
| tree | 81fa8933b6769983063db89da3242aabbf816135 /net/core/dev.c | |
| parent | 4eaa0e3c869acd5dbc7c2e3818a9ae9cbf221d27 (diff) | |
net: dev_pick_tx() fix
When dev_pick_tx() caches tx queue_index on a socket, we must check
socket dst_entry matches skb one, or risk a crash later, as reported by
Denys Fedorysychenko, if old packets are in flight during a route
change, involving devices with different number of queues.
Bug introduced by commit a4ee3ce3
(net: Use sk_tx_queue_mapping for connected sockets)
Reported-by: Denys Fedorysychenko <nuclearcat@nuclearcat.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core/dev.c')
| -rw-r--r-- | net/core/dev.c | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/net/core/dev.c b/net/core/dev.c index 1c8a0ce473a..92584bfef09 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1989,8 +1989,12 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev, if (dev->real_num_tx_queues > 1) queue_index = skb_tx_hash(dev, skb); - if (sk && sk->sk_dst_cache) - sk_tx_queue_set(sk, queue_index); + if (sk) { + struct dst_entry *dst = rcu_dereference(sk->sk_dst_cache); + + if (dst && skb_dst(skb) == dst) + sk_tx_queue_set(sk, queue_index); + } } } |