[PATCH net v3 1/2] fix return of iptunnel_xmit

All users of iptunnel_xmit expect the return value to be the packet
length on success (>0), negative for a tx error and zero for a tx
dropped error. In cset 0e6fbc5b6c6218987c93b8c7ca60cf786062899d the
negative return case was lost.

This bug was introduced when the ip_tunnel_core code was refactored.

Fixes: 0e6fbc5b6c6218987c93b8c7ca60cf786062899d
Signed-off-by: Andreas Schultz <redacted>
---
Change in v2:
 - remove unused variable pkt_len

Change in v3:
 - reworked based on comment from Jiri Benc
---
 net/ipv4/ip_tunnel_core.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/ip_tunnel_core.c b/net/ipv4/ip_tunnel_core.c
index 84dce6a..5cced3b 100644
--- a/net/ipv4/ip_tunnel_core.c
+++ b/net/ipv4/ip_tunnel_core.c

@@ -80,9 +80,12 @@ int iptunnel_xmit(struct sock *sk, struct rtable *rt, struct sk_buff *skb,
 			  skb_shinfo(skb)->gso_segs ?: 1);
 
 	err = ip_local_out_sk(sk, skb);
-	if (unlikely(net_xmit_eval(err)))
-		pkt_len = 0;
-	return pkt_len;
+	if (likely(net_xmit_eval(err) == 0))
+		return pkt_len;
+	if (err < 0)
+		return err;
+
+	return 0;
 }
 EXPORT_SYMBOL_GPL(iptunnel_xmit);
 

-- 
2.1.4

udp_tunnel_xmit_skb() will free the skb and release the rt->dst
reference in the error case. There is no need (and it would actully
trigger a warning) when we did.
This problem was not visible before, as udp_tunnel_xmit_skb() would
never return a value < 0
---
 net/tipc/udp_media.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/net/tipc/udp_media.c b/net/tipc/udp_media.c
index c170d31..de8e110 100644
--- a/net/tipc/udp_media.c
+++ b/net/tipc/udp_media.c

@@ -181,10 +181,6 @@ static int tipc_udp_send_msg(struct net *net, struct sk_buff *skb,
 					  dst->ipv4.s_addr, 0, ttl, 0,
 					  src->udp_port, dst->udp_port,
 					  false, true);
-		if (err < 0) {
-			ip_rt_put(rt);
-			goto tx_error;
-		}
 #if IS_ENABLED(CONFIG_IPV6)
 	} else {
 		struct dst_entry *ndst;

-- 
2.1.4

On Thu,  8 Oct 2015 18:08:49 +0200, Andreas Schultz wrote:

All users of iptunnel_xmit expect the return value to be the packet
length on success (>0), negative for a tx error and zero for a tx
dropped error. In cset 0e6fbc5b6c6218987c93b8c7ca60cf786062899d the
negative return case was lost.

This bug was introduced when the ip_tunnel_core code was refactored.

Fixes: 0e6fbc5b6c6218987c93b8c7ca60cf786062899d
Signed-off-by: Andreas Schultz <redacted>

Acked-by: Jiri Benc <redacted>

-- 
Jiri Benc

On Thu,  8 Oct 2015 18:08:50 +0200, Andreas Schultz wrote:

udp_tunnel_xmit_skb() will free the skb and release the rt->dst
reference in the error case. There is no need (and it would actully
trigger a warning) when we did.
This problem was not visible before, as udp_tunnel_xmit_skb() would
never return a value < 0

You're missing s-o-b.

Not sure what the intended return value of struct tipc_media->send_msg
is but it seems to be completely ignored anyway.

Acked-by: Jiri Benc <redacted>

-- 
Jiri Benc

On Thu, Oct 8, 2015 at 9:08 AM, Andreas Schultz [off-list ref] wrote:

All users of iptunnel_xmit expect the return value to be the packet
length on success (>0), negative for a tx error and zero for a tx
dropped error. In cset 0e6fbc5b6c6218987c93b8c7ca60cf786062899d the
negative return case was lost.

This bug was introduced when the ip_tunnel_core code was refactored.

Fixes: 0e6fbc5b6c6218987c93b8c7ca60cf786062899d
Signed-off-by: Andreas Schultz <redacted>

Thanks for the fix.
Acked-by: Pravin B Shelar <redacted>