veth: Dont kfree_skb() after dev_forward_skb()

In case of congestion, netif_rx() frees the skb, so we must assume
dev_forward_skb() also consume skb.

Bug introduced by commit 445409602c092
(veth: move loopback logic to common location)

We must change dev_forward_skb() to always consume skb, and veth to not
double free it.

Bug report : http://marc.info/?l=linux-netdev&m=127310770900442&w=3

Reported-by: Martín Ferrari <martin.ferrari@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 5 insertions, 6 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index f769098774b7..264137fce3a2 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1451,7 +1451,7 @@ static inline void net_timestamp(struct sk_buff *skb)
  *
  * return values:
  *      NET_RX_SUCCESS  (no congestion)
- *      NET_RX_DROP     (packet was dropped)
+ *      NET_RX_DROP     (packet was dropped, but freed)
  *
  * dev_forward_skb can be used for injecting an skb from the
  * start_xmit function of one device into the receive queue
@@ -1465,12 +1465,11 @@ int dev_forward_skb(struct net_device *dev, struct sk_buff *skb)
 {
         skb_orphan(skb);
 
-        if (!(dev->flags & IFF_UP))
-                return NET_RX_DROP;
-
-        if (skb->len > (dev->mtu + dev->hard_header_len))
+        if (!(dev->flags & IFF_UP) ||
+            (skb->len > (dev->mtu + dev->hard_header_len))) {
+                kfree_skb(skb);
                 return NET_RX_DROP;
-
+        }
         skb_set_dev(skb, dev);
         skb->tstamp.tv64 = 0;
         skb->pkt_type = PACKET_HOST;