4.19-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Ahern <dsah...@gmail.com>

[ Upstream commit a1fd1ad2552fad9e649eeb85fd79301e2880a886 ]

ip_route_input_rcu expects the original ingress device (e.g., for
proper multicast handling). The skb->dev can be changed by l3mdev_ip_rcv,
so dev needs to be saved prior to calling it. This was the behavior prior
to the listify changes.

Fixes: 5fa12739a53d0 ("net: ipv4: listify ip_rcv_finish")
Cc: Edward Cree <ec...@solarflare.com>
Signed-off-by: David Ahern <dsah...@gmail.com>
Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@linuxfoundation.org>
---
 net/ipv4/ip_input.c |    9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

--- a/net/ipv4/ip_input.c
+++ b/net/ipv4/ip_input.c
@@ -308,11 +308,10 @@ drop:
 }
 
 static int ip_rcv_finish_core(struct net *net, struct sock *sk,
-                             struct sk_buff *skb)
+                             struct sk_buff *skb, struct net_device *dev)
 {
        const struct iphdr *iph = ip_hdr(skb);
        int (*edemux)(struct sk_buff *skb);
-       struct net_device *dev = skb->dev;
        struct rtable *rt;
        int err;
 
@@ -401,6 +400,7 @@ drop_error:
 
 static int ip_rcv_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
 {
+       struct net_device *dev = skb->dev;
        int ret;
 
        /* if ingress device is enslaved to an L3 master device pass the
@@ -410,7 +410,7 @@ static int ip_rcv_finish(struct net *net
        if (!skb)
                return NET_RX_SUCCESS;
 
-       ret = ip_rcv_finish_core(net, sk, skb);
+       ret = ip_rcv_finish_core(net, sk, skb, dev);
        if (ret != NET_RX_DROP)
                ret = dst_input(skb);
        return ret;
@@ -550,6 +550,7 @@ static void ip_list_rcv_finish(struct ne
 
        INIT_LIST_HEAD(&sublist);
        list_for_each_entry_safe(skb, next, head, list) {
+               struct net_device *dev = skb->dev;
                struct dst_entry *dst;
 
                skb_list_del_init(skb);
@@ -559,7 +560,7 @@ static void ip_list_rcv_finish(struct ne
                skb = l3mdev_ip_rcv(skb);
                if (!skb)
                        continue;
-               if (ip_rcv_finish_core(net, sk, skb) == NET_RX_DROP)
+               if (ip_rcv_finish_core(net, sk, skb, dev) == NET_RX_DROP)
                        continue;
 
                dst = skb_dst(skb);


Reply via email to