[NET]: Fix dev->qdisc race for NETDEV_TX_LOCKED case

When transmit fails with NETDEV_TX_LOCKED the skb is requeued
to dev->qdisc again. The dev->qdisc pointer is protected by
the queue lock which needs to be dropped when attempting to
transmit and acquired again before requeing. The problem is
that qdisc_restart() fetches the dev->qdisc pointer once and
stores it in the `q' variable which is invalidated when
dropping the queue_lock, therefore the variable needs to be
refreshed before requeueing.

Signed-off-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 1 insertions, 0 deletions

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 3385ee592541..a8240c578772 100644
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -139,6 +139,7 @@ static inline int qdisc_restart(struct net_device *dev)
                                 }
                                 if (ret == NETDEV_TX_LOCKED && nolock) {
                                         spin_lock(&dev->queue_lock);
+                                        q = dev->qdisc;
                                         goto collision;
                                 }
                         }