bridge: fix potential crash in __netdev_pick_tx()

edumazet · davem330 · commit a7d35f9d73e9 · 2015-07-09T22:48:42.000-07:00
Commit c29390c ("xps: must clear sender_cpu before forwarding") fixed an issue in normal forward path, caused by sender_cpu & napi_id skb fields being an union. Bridge is another point where skb can be forwarded, so we need the same cure. Bug triggers if packet was received on a NIC using skb_mark_napi_id() Fixes: 2bd8248 ("xps: fix xps for stacked devices") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Bob Liu <bob.liu@oracle.com> Tested-by: Bob Liu <bob.liu@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
@@ -42,6 +42,7 @@ int br_dev_queue_push_xmit(struct sock *sk, struct sk_buff *skb)
 	} else {
 		skb_push(skb, ETH_HLEN);
 		br_drop_fake_rtable(skb);
+		skb_sender_cpu_clear(skb);
 		dev_queue_xmit(skb);
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -42,6 +42,7 @@ int br_dev_queue_push_xmit(struct sock sk, struct sk_buff skb)`
`42`	`42`	`} else {`
`43`	`43`	`skb_push(skb, ETH_HLEN);`
`44`	`44`	`br_drop_fake_rtable(skb);`
	`45`	`+ skb_sender_cpu_clear(skb);`
`45`	`46`	`dev_queue_xmit(skb);`
`46`	`47`	`}`
`47`	`48`