Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0cd6783d authored by Julian Wiedmann's avatar Julian Wiedmann Committed by David S. Miller
Browse files

s390/qeth: check dst entry before use 



While qeth_l3 uses netif_keep_dst() to hold onto the dst, a skb's dst
may still have been obsoleted (via dst_dev_put()) by the time that we
end up using it. The dst then points to the loopback interface, which
means the neighbour lookup in qeth_l3_get_cast_type() determines a bogus
cast type of RTN_BROADCAST.
For IQD interfaces this causes us to place such skbs on the wrong
HW queue, resulting in TX errors.

Fix-up the various call sites to first validate the dst entry with
dst_check(), and fall back accordingly.

Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 72c87976

drivers/s390/net/qeth_l3_main.c

+25 −5
Original line number Diff line number Diff line
@@ -1888,13 +1888,20 @@ static int qeth_l3_do_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) 


static int qeth_l3_get_cast_type(struct sk_buff *skb)

{

	int ipv = qeth_get_ip_version(skb);

	struct neighbour *n = NULL;

	struct dst_entry *dst;



	rcu_read_lock();

	dst = skb_dst(skb);

	if (dst) {

		struct rt6_info *rt = (struct rt6_info *) dst;



		dst = dst_check(dst, (ipv == 6) ? rt6_get_cookie(rt) : 0);

		if (dst)

			n = dst_neigh_lookup_skb(dst, skb);

	}



	if (n) {

		int cast_type = n->type;
@@ -1909,7 +1916,7 @@ static int qeth_l3_get_cast_type(struct sk_buff *skb) 
	rcu_read_unlock();



	/* no neighbour (eg AF_PACKET), fall back to target's IP address ... */

	switch (qeth_get_ip_version(skb)) {

	switch (ipv) {

	case 4:

		if (ipv4_is_lbcast(ip_hdr(skb)->daddr))

			return RTN_BROADCAST;
@@ -1942,6 +1949,7 @@ static void qeth_l3_fill_header(struct qeth_qdio_out_q *queue, 
	struct qeth_hdr_layer3 *l3_hdr = &hdr->hdr.l3;

	struct vlan_ethhdr *veth = vlan_eth_hdr(skb);

	struct qeth_card *card = queue->card;

	struct dst_entry *dst;



	hdr->hdr.l3.length = data_len;
@@ -1987,15 +1995,27 @@ static void qeth_l3_fill_header(struct qeth_qdio_out_q *queue, 
	}



	rcu_read_lock();

	dst = skb_dst(skb);



	if (ipv == 4) {

		struct rtable *rt = skb_rtable(skb);

		struct rtable *rt;



		if (dst)

			dst = dst_check(dst, 0);

		rt = (struct rtable *) dst;



		*((__be32 *) &hdr->hdr.l3.next_hop.ipv4.addr) = (rt) ?

				rt_nexthop(rt, ip_hdr(skb)->daddr) :

				ip_hdr(skb)->daddr;

	} else {

		/* IPv6 */

		const struct rt6_info *rt = skb_rt6_info(skb);

		struct rt6_info *rt;



		if (dst) {

			rt = (struct rt6_info *) dst;

			dst = dst_check(dst, rt6_get_cookie(rt));

		}

		rt = (struct rt6_info *) dst;



		if (rt && !ipv6_addr_any(&rt->rt6i_gateway))

			l3_hdr->next_hop.ipv6_addr = rt->rt6i_gateway;