Message ID | 20190328152304.8297-1-alobakin@dlink.ru |
---|---|
State | Accepted |
Delegated to: | David Miller |
Headers | show |
Series | net: core: netif_receive_skb_list: unlist skb before passing to pt->func | expand |
From: Alexander Lobakin <alobakin@dlink.ru> Date: Thu, 28 Mar 2019 18:23:04 +0300 > __netif_receive_skb_list_ptype() leaves skb->next poisoned before passing > it to pt_prev->func handler, what may produce (in certain cases, e.g. DSA > setup) crashes like: ... > Fix this by pulling skb off the sublist and zeroing skb->next pointer > before calling ptype callback. > > Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type lookup") > Reviewed-by: Edward Cree <ecree@solarflare.com> > Signed-off-by: Alexander Lobakin <alobakin@dlink.ru> Applied and queued up for -stable, thanks.
diff --git a/net/core/dev.c b/net/core/dev.c index 2b67f2aa59dd..fdcff29df915 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5014,8 +5014,10 @@ static inline void __netif_receive_skb_list_ptype(struct list_head *head, if (pt_prev->list_func != NULL) pt_prev->list_func(head, pt_prev, orig_dev); else - list_for_each_entry_safe(skb, next, head, list) + list_for_each_entry_safe(skb, next, head, list) { + skb_list_del_init(skb); pt_prev->func(skb, skb->dev, pt_prev, orig_dev); + } } static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemalloc)