[IFB]: Fix crash on input device removal

The input_device pointer is not refcounted, which means the device may
disappear while packets are queued, causing a crash when ifb passes packets
with a stale skb->dev pointer to netif_rx().

Fix by storing the interface index instead and do a lookup where neccessary.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Acked-by: Jamal Hadi Salim <hadi@cyberus.ca>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 5 insertions, 5 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 5984b55311a1..d44b8f1964fa 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1741,8 +1741,8 @@ static int ing_filter(struct sk_buff *skb)
         if (dev->qdisc_ingress) {
                 __u32 ttl = (__u32) G_TC_RTTL(skb->tc_verd);
                 if (MAX_RED_LOOP < ttl++) {
-                        printk(KERN_WARNING "Redir loop detected Dropping packet (%s->%s)\n",
-                                skb->input_dev->name, skb->dev->name);
+                        printk(KERN_WARNING "Redir loop detected Dropping packet (%d->%d)\n",
+                                skb->iif, skb->dev->ifindex);
                         return TC_ACT_SHOT;
                 }
 
@@ -1775,8 +1775,8 @@ int netif_receive_skb(struct sk_buff *skb)
         if (!skb->tstamp.off_sec)
                 net_timestamp(skb);
 
-        if (!skb->input_dev)
-                skb->input_dev = skb->dev;
+        if (!skb->iif)
+                skb->iif = skb->dev->ifindex;
 
         orig_dev = skb_bond(skb);
 
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 702fa8f08747..87573ae35b02 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -496,7 +496,7 @@ struct sk_buff *skb_clone(struct sk_buff *skb, gfp_t gfp_mask)
         n->tc_verd = SET_TC_VERD(skb->tc_verd,0);
         n->tc_verd = CLR_TC_OK2MUNGE(n->tc_verd);
         n->tc_verd = CLR_TC_MUNGED(n->tc_verd);
-        C(input_dev);
+        C(iif);
 #endif
         skb_copy_secmark(n, skb);
 #endif