diff options
| author | Jarek Poplawski <jarkao2@gmail.com> | 2010-01-10 22:04:19 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-01-11 15:39:42 -0800 |
| commit | eb70df13ee52dbc0f2c0ffd8ed34a8cd27440baf (patch) | |
| tree | 9026781435cdaf46b8414f4596903dd7d5f2e5ae /net | |
| parent | fa15e99b6bb44aa86b241a43ca8c509e91f80153 (diff) | |
| download | linux-3.10-eb70df13ee52dbc0f2c0ffd8ed34a8cd27440baf.tar.gz linux-3.10-eb70df13ee52dbc0f2c0ffd8ed34a8cd27440baf.tar.bz2 linux-3.10-eb70df13ee52dbc0f2c0ffd8ed34a8cd27440baf.zip | |
af_packet: Don't use skb after dev_queue_xmit()
tpacket_snd() can change and kfree an skb after dev_queue_xmit(),
which is illegal.
With debugging by: Stephen Hemminger <shemminger@vyatta.com>
Reported-by: Michael Breuer <mbreuer@majjas.com>
With help from: David S. Miller <davem@davemloft.net>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Tested-by: Michael Breuer<mbreuer@majjas.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/packet/af_packet.c | 19 |
1 files changed, 14 insertions, 5 deletions
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index e0516a22be2..f126d18dbdc 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1021,8 +1021,20 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) status = TP_STATUS_SEND_REQUEST; err = dev_queue_xmit(skb); - if (unlikely(err > 0 && (err = net_xmit_errno(err)) != 0)) - goto out_xmit; + if (unlikely(err > 0)) { + err = net_xmit_errno(err); + if (err && __packet_get_status(po, ph) == + TP_STATUS_AVAILABLE) { + /* skb was destructed already */ + skb = NULL; + goto out_status; + } + /* + * skb was dropped but not destructed yet; + * let's treat it like congestion or err < 0 + */ + err = 0; + } packet_increment_head(&po->tx_ring); len_sum += tp_len; } while (likely((ph != NULL) || @@ -1033,9 +1045,6 @@ static int tpacket_snd(struct packet_sock *po, struct msghdr *msg) err = len_sum; goto out_put; -out_xmit: - skb->destructor = sock_wfree; - atomic_dec(&po->tx_ring.pending); out_status: __packet_set_status(po, ph, status); kfree_skb(skb); |