From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Sun, 11 Apr 2010 21:18:17 +0000 (+0000)
Subject: net: dev_pick_tx() fix
X-Git-Tag: v2.6.34-rc5~5^2~5
X-Git-Url: https://bbs.cooldavid.org/git/?a=commitdiff_plain;h=8728c544a9cbdcb0034aa5c45706c5f953f030ee;p=net-next-2.6.git

net: dev_pick_tx() fix

When dev_pick_tx() caches tx queue_index on a socket, we must check
socket dst_entry matches skb one, or risk a crash later, as reported by
Denys Fedorysychenko, if old packets are in flight during a route
change, involving devices with different number of queues.

Bug introduced by commit a4ee3ce3
(net: Use sk_tx_queue_mapping for connected sockets)

Reported-by: Denys Fedorysychenko <nuclearcat@nuclearcat.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/net/core/dev.c b/net/core/dev.c
index 1c8a0ce473a..92584bfef09 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1989,8 +1989,12 @@ static struct netdev_queue *dev_pick_tx(struct net_device *dev,
 			if (dev->real_num_tx_queues > 1)
 				queue_index = skb_tx_hash(dev, skb);
 
-			if (sk && sk->sk_dst_cache)
-				sk_tx_queue_set(sk, queue_index);
+			if (sk) {
+				struct dst_entry *dst = rcu_dereference(sk->sk_dst_cache);
+
+				if (dst && skb_dst(skb) == dst)
+					sk_tx_queue_set(sk, queue_index);
+			}
 		}
 	}