Commit 0cd6783d authored by Julian Wiedmann's avatar Julian Wiedmann Committed by David S. Miller

s390/qeth: check dst entry before use

While qeth_l3 uses netif_keep_dst() to hold onto the dst, a skb's dst
may still have been obsoleted (via dst_dev_put()) by the time that we
end up using it. The dst then points to the loopback interface, which
means the neighbour lookup in qeth_l3_get_cast_type() determines a bogus
cast type of RTN_BROADCAST.
For IQD interfaces this causes us to place such skbs on the wrong
HW queue, resulting in TX errors.

Fix-up the various call sites to first validate the dst entry with
dst_check(), and fall back accordingly.
Signed-off-by: default avatarJulian Wiedmann <jwi@linux.ibm.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 72c87976
...@@ -1888,13 +1888,20 @@ static int qeth_l3_do_ioctl(struct net_device *dev, struct ifreq *rq, int cmd) ...@@ -1888,13 +1888,20 @@ static int qeth_l3_do_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
static int qeth_l3_get_cast_type(struct sk_buff *skb) static int qeth_l3_get_cast_type(struct sk_buff *skb)
{ {
int ipv = qeth_get_ip_version(skb);
struct neighbour *n = NULL; struct neighbour *n = NULL;
struct dst_entry *dst; struct dst_entry *dst;
rcu_read_lock(); rcu_read_lock();
dst = skb_dst(skb); dst = skb_dst(skb);
if (dst) if (dst) {
n = dst_neigh_lookup_skb(dst, skb); struct rt6_info *rt = (struct rt6_info *) dst;
dst = dst_check(dst, (ipv == 6) ? rt6_get_cookie(rt) : 0);
if (dst)
n = dst_neigh_lookup_skb(dst, skb);
}
if (n) { if (n) {
int cast_type = n->type; int cast_type = n->type;
...@@ -1909,7 +1916,7 @@ static int qeth_l3_get_cast_type(struct sk_buff *skb) ...@@ -1909,7 +1916,7 @@ static int qeth_l3_get_cast_type(struct sk_buff *skb)
rcu_read_unlock(); rcu_read_unlock();
/* no neighbour (eg AF_PACKET), fall back to target's IP address ... */ /* no neighbour (eg AF_PACKET), fall back to target's IP address ... */
switch (qeth_get_ip_version(skb)) { switch (ipv) {
case 4: case 4:
if (ipv4_is_lbcast(ip_hdr(skb)->daddr)) if (ipv4_is_lbcast(ip_hdr(skb)->daddr))
return RTN_BROADCAST; return RTN_BROADCAST;
...@@ -1942,6 +1949,7 @@ static void qeth_l3_fill_header(struct qeth_qdio_out_q *queue, ...@@ -1942,6 +1949,7 @@ static void qeth_l3_fill_header(struct qeth_qdio_out_q *queue,
struct qeth_hdr_layer3 *l3_hdr = &hdr->hdr.l3; struct qeth_hdr_layer3 *l3_hdr = &hdr->hdr.l3;
struct vlan_ethhdr *veth = vlan_eth_hdr(skb); struct vlan_ethhdr *veth = vlan_eth_hdr(skb);
struct qeth_card *card = queue->card; struct qeth_card *card = queue->card;
struct dst_entry *dst;
hdr->hdr.l3.length = data_len; hdr->hdr.l3.length = data_len;
...@@ -1987,15 +1995,27 @@ static void qeth_l3_fill_header(struct qeth_qdio_out_q *queue, ...@@ -1987,15 +1995,27 @@ static void qeth_l3_fill_header(struct qeth_qdio_out_q *queue,
} }
rcu_read_lock(); rcu_read_lock();
dst = skb_dst(skb);
if (ipv == 4) { if (ipv == 4) {
struct rtable *rt = skb_rtable(skb); struct rtable *rt;
if (dst)
dst = dst_check(dst, 0);
rt = (struct rtable *) dst;
*((__be32 *) &hdr->hdr.l3.next_hop.ipv4.addr) = (rt) ? *((__be32 *) &hdr->hdr.l3.next_hop.ipv4.addr) = (rt) ?
rt_nexthop(rt, ip_hdr(skb)->daddr) : rt_nexthop(rt, ip_hdr(skb)->daddr) :
ip_hdr(skb)->daddr; ip_hdr(skb)->daddr;
} else { } else {
/* IPv6 */ /* IPv6 */
const struct rt6_info *rt = skb_rt6_info(skb); struct rt6_info *rt;
if (dst) {
rt = (struct rt6_info *) dst;
dst = dst_check(dst, rt6_get_cookie(rt));
}
rt = (struct rt6_info *) dst;
if (rt && !ipv6_addr_any(&rt->rt6i_gateway)) if (rt && !ipv6_addr_any(&rt->rt6i_gateway))
l3_hdr->next_hop.ipv6_addr = rt->rt6i_gateway; l3_hdr->next_hop.ipv6_addr = rt->rt6i_gateway;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment