From 1e3769dc9ac7559010cfad5400896f24f1d33ad3 Mon Sep 17 00:00:00 2001 From: Patrick McHardy Date: Tue, 10 Apr 2007 13:29:44 -0700 Subject: Fix IFB net driver input device crashes [IFB]: Fix crash on input device removal The input_device pointer is not refcounted, which means the device may disappear while packets are queued, causing a crash when ifb passes packets with a stale skb->dev pointer to netif_rx(). Fix by storing the interface index instead and do a lookup where neccessary. Signed-off-by: Patrick McHardy Acked-by: Jamal Hadi Salim Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/sched/act_mirred.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'net/sched') diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c index 483897271f15..7263a2e91db1 100644 --- a/net/sched/act_mirred.c +++ b/net/sched/act_mirred.c @@ -199,7 +199,7 @@ bad_mirred: skb2->tc_verd = SET_TC_FROM(skb2->tc_verd, at); skb2->dev = dev; - skb2->input_dev = skb->dev; + skb2->iif = skb->dev->ifindex; dev_queue_xmit(skb2); spin_unlock(&m->tcf_lock); return m->tcf_action; -- cgit v1.2.3