Commit 86e89718 authored by Julien Grall's avatar Julien Grall Committed by Pablo Neira Ayuso

netfilter: bridge: Use __in6_dev_get rather than in6_dev_get in br_validate_ipv6

The commit efb6de9b "netfilter: bridge:
forward IPv6 fragmented packets" introduced a new function
br_validate_ipv6 which take a reference on the inet6 device. Although,
the reference is not released at the end.

This will result to the impossibility to destroy any netdevice using
ipv6 and bridge.

It's possible to directly retrieve the inet6 device without taking a
reference as all netfilter hooks are protected by rcu_read_lock via
nf_hook_slow.

Spotted while trying to destroy a Xen guest on the upstream Linux:
"unregister_netdevice: waiting for vif1.0 to become free. Usage count = 1"
Signed-off-by: default avatarJulien Grall <julien.grall@citrix.com>
Cc: Bernhard Thaler <bernhard.thaler@wvnet.at>
Cc: Pablo Neira Ayuso <pablo@netfilter.org>
Cc: fw@strlen.de
Cc: ian.campbell@citrix.com
Cc: wei.liu2@citrix.com
Cc: Bob Liu <bob.liu@oracle.com>
Acked-by: default avatarStephen Hemminger <stephen@networkplumber.org>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 91c269a0
...@@ -104,7 +104,7 @@ int br_validate_ipv6(struct sk_buff *skb) ...@@ -104,7 +104,7 @@ int br_validate_ipv6(struct sk_buff *skb)
{ {
const struct ipv6hdr *hdr; const struct ipv6hdr *hdr;
struct net_device *dev = skb->dev; struct net_device *dev = skb->dev;
struct inet6_dev *idev = in6_dev_get(skb->dev); struct inet6_dev *idev = __in6_dev_get(skb->dev);
u32 pkt_len; u32 pkt_len;
u8 ip6h_len = sizeof(struct ipv6hdr); u8 ip6h_len = sizeof(struct ipv6hdr);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment