summaryrefslogtreecommitdiff
path: root/net
diff options
context:
space:
mode:
authorEric Dumazet <eric.dumazet@gmail.com>2010-04-11 21:18:17 +0000
committerDavid S. Miller <davem@davemloft.net>2010-04-15 01:27:11 -0700
commit8728c544a9cbdcb0034aa5c45706c5f953f030ee (patch)
tree81fa8933b6769983063db89da3242aabbf816135 /net
parent4eaa0e3c869acd5dbc7c2e3818a9ae9cbf221d27 (diff)
downloadlinux-3.10-8728c544a9cbdcb0034aa5c45706c5f953f030ee.tar.gz
linux-3.10-8728c544a9cbdcb0034aa5c45706c5f953f030ee.tar.bz2
linux-3.10-8728c544a9cbdcb0034aa5c45706c5f953f030ee.zip
net: dev_pick_tx() fix
When dev_pick_tx() caches tx queue_index on a socket, we must check socket dst_entry matches skb one, or risk a crash later, as reported by Denys Fedorysychenko, if old packets are in flight during a route change, involving devices with different number of queues. Bug introduced by commit a4ee3ce3 (net: Use sk_tx_queue_mapping for connected sockets) Reported-by: Denys Fedorysychenko <nuclearcat@nuclearcat.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r--net/core/dev.c8
1 files changed, 6 insertions, 2 deletions
diff --git a/net/core/dev.c b/net/core/dev.c
index 1c8a0ce473a..92584bfef09 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1989,8 +1989,12 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
if (dev->real_num_tx_queues > 1)
queue_index = skb_tx_hash(dev, skb);
- if (sk && sk->sk_dst_cache)
- sk_tx_queue_set(sk, queue_index);
+ if (sk) {
+ struct dst_entry *dst = rcu_dereference(sk->sk_dst_cache);
+
+ if (dst && skb_dst(skb) == dst)
+ sk_tx_queue_set(sk, queue_index);
+ }
}
}