pkt_sched: Fix handling of gso skbs on requeuing

Jay Cliburn noticed and diagnosed a bug triggered in
dev_gso_skb_destructor() after last change from qdisc->gso_skb
to qdisc->requeue list. Since gso_segmented skbs can't be queued
to another list this patch brings back qdisc->gso_skb for them.

Reported-by: Jay Cliburn <jcliburn@gmail.com>
Signed-off-by: Jarek Poplawski <jarkao2@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index 3b983e8a0555c00204bf1ef165155bec0f4c09fd..3fe49d808957309f29f1cb9532892fc06e936f2e 100644 (file)
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -52,6 +52,7 @@ struct Qdisc
        u32                     parent;
        atomic_t                refcnt;
        unsigned long           state;
+       struct sk_buff          *gso_skb;
        struct sk_buff_head     requeue;
        struct sk_buff_head     q;
        struct netdev_queue     *dev_queue;

diff --git a/net/sched/sch_generic.c b/net/sched/sch_generic.c
index 5e7e0bd38fe80a8e82829fad7ce6cccdbc4ba8a1..3db4cf1bd263b032a2ea03b1e39f44fcc6eaa20c 100644 (file)
--- a/net/sched/sch_generic.c
+++ b/net/sched/sch_generic.c
@@ -44,7 +44,10 @@ static inline int qdisc_qlen(struct Qdisc *q)
 
 static inline int dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 {
-       __skb_queue_head(&q->requeue, skb);
+       if (unlikely(skb->next))
+               q->gso_skb = skb;
+       else
+               __skb_queue_head(&q->requeue, skb);
 
        __netif_schedule(q);
        return 0;
@@ -52,7 +55,10 @@ static inline int dev_requeue_skb(struct sk_buff *skb, struct Qdisc *q)
 
 static inline struct sk_buff *dequeue_skb(struct Qdisc *q)
 {
-       struct sk_buff *skb = skb_peek(&q->requeue);
+       struct sk_buff *skb = q->gso_skb;
+
+       if (!skb)
+               skb = skb_peek(&q->requeue);
 
        if (unlikely(skb)) {
                struct net_device *dev = qdisc_dev(q);
@@ -60,10 +66,15 @@ static inline struct sk_buff *dequeue_skb(struct Qdisc *q)
 
                /* check the reason of requeuing without tx lock first */
                txq = netdev_get_tx_queue(dev, skb_get_queue_mapping(skb));
-               if (!netif_tx_queue_stopped(txq) && !netif_tx_queue_frozen(txq))
-                       __skb_unlink(skb, &q->requeue);
-               else
+               if (!netif_tx_queue_stopped(txq) &&
+                   !netif_tx_queue_frozen(txq)) {
+                       if (q->gso_skb)
+                               q->gso_skb = NULL;
+                       else
+                               __skb_unlink(skb, &q->requeue);
+               } else {
                        skb = NULL;
+               }
        } else {
                skb = q->dequeue(q);
        }
@@ -548,6 +559,7 @@ void qdisc_destroy(struct Qdisc *qdisc)
        module_put(ops->owner);
        dev_put(qdisc_dev(qdisc));
 
+       kfree_skb(qdisc->gso_skb);
        __skb_queue_purge(&qdisc->requeue);
 
        kfree((char *) qdisc - qdisc->padded);