On Fri, May 31, 2019 at 05:06:16PM -0600, David Ahern wrote:
> On 5/29/19 11:08 PM, Stephen Suryaputra wrote:
> > diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
> > index 1a832f5e190b..9b365c345c34 100644
> > --- a/net/ipv6/reassembly.c
> > +++ b/net/ipv6/reassembly.c
> > @@ -260,6 +260,9 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct 
> > sk_buff *skb,
> >     int payload_len;
> >     u8 ecn;
> >  
> > +   if (netif_is_l3_master(dev))
> > +           dev = dev_get_by_index_rcu(net, inet6_iif(skb));
> > +
> >     inet_frag_kill(&fq->q);
> >  
> >     ecn = ip_frag_ecn_table[fq->ecn];
> > 
> 
> this part changes skb->dev. Seems like it has an unintended effect if
> the packet is delivered locally.

Ah, right. How about this then?

+/**
+ * __in6_dev_stats_get - get inet6_dev pointer for stats
+ * @dev: network device
+ * @skb: skb for original incoming interface if neeeded
+ *
+ * Caller must hold rcu_read_lock or RTNL, because this function
+ * does not take a reference on the inet6_dev.
+ */
+static inline struct inet6_dev *__in6_dev_stats_get(const struct net_device 
*dev,
+                                                   const struct sk_buff *skb)
+{
+       if (netif_is_l3_master(dev))
+               dev = dev_get_by_index_rcu(dev_net(dev), inet6_iif(skb));
+       return __in6_dev_get(dev);
+}

@@ -260,9 +260,6 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct 
sk_buff *skb,
        int payload_len;
        u8 ecn;
 
-       if (netif_is_l3_master(dev))
-               dev = dev_get_by_index_rcu(net, inet6_iif(skb));
-
        inet_frag_kill(&fq->q);
 
        ecn = ip_frag_ecn_table[fq->ecn];
@@ -305,7 +302,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct 
sk_buff *skb,
                           skb_network_header_len(skb));
 
        rcu_read_lock();
-       __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
+       __IP6_INC_STATS(net, __in6_dev_stats_get(dev, skb), 
IPSTATS_MIB_REASMOKS);
        rcu_read_unlock();
        fq->q.rb_fragments = RB_ROOT;
        fq->q.fragments_tail = NULL;
@@ -319,7 +316,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct 
sk_buff *skb,
        net_dbg_ratelimited("ip6_frag_reasm: no memory for reassembly\n");
 out_fail:
        rcu_read_lock();
-       __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMFAILS);
+       __IP6_INC_STATS(net, __in6_dev_stats_get(dev, skb), 
IPSTATS_MIB_REASMFAILS);
        rcu_read_unlock();
        inet_frag_kill(&fq->q);
        return -1;

Thanks.

Reply via email to