diff options
| author | Eric Dumazet | 2015-07-09 18:56:07 +0200 |
|---|---|---|
| committer | David S. Miller | 2015-07-09 22:48:42 -0700 |
| commit | a7d35f9d73e9ffa74a02304b817e579eec632f67 (patch) | |
| tree | f368109fccd33678d6fe881b17b74d1ef20c1114 | |
| parent | fcc028c106e5750aa66dc43595b3f29f88801ff0 (diff) | |
bridge: fix potential crash in __netdev_pick_tx()
Commit c29390c6dfee ("xps: must clear sender_cpu before forwarding")
fixed an issue in normal forward path, caused by sender_cpu & napi_id
skb fields being an union.
Bridge is another point where skb can be forwarded, so we need
the same cure.
Bug triggers if packet was received on a NIC using skb_mark_napi_id()
Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Bob Liu <bob.liu@oracle.com>
Tested-by: Bob Liu <bob.liu@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/bridge/br_forward.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c index e97572b5d2cc..0ff6e1bbca91 100644 --- a/net/bridge/br_forward.c +++ b/net/bridge/br_forward.c @@ -42,6 +42,7 @@ int br_dev_queue_push_xmit(struct sock *sk, struct sk_buff *skb) } else { skb_push(skb, ETH_HLEN); br_drop_fake_rtable(skb); + skb_sender_cpu_clear(skb); dev_queue_xmit(skb); } |