From: Prashant Bhole <bhole_prashant...@lab.ntt.co.jp> Date: Thu, 12 Jul 2018 16:24:59 +0900
> Following crash occurs in validate_xmit_skb_list() when same skb is > iterated multiple times in the loop and consume_skb() is called. > > The root cause is calling list_del_init(&skb->list) and not clearing > skb->next in d4546c2509b1. list_del_init(&skb->list) sets skb->next > to point to skb itself. skb->next needs to be cleared because other > parts of network stack uses another kind of SKB lists. > validate_xmit_skb_list() uses such list. > > A similar type of bugfix was reported by Jesper Dangaard Brouer. > https://patchwork.ozlabs.org/patch/942541/ > > This patch clears skb->next and changes list_del_init() to list_del() > so that list->prev will maintain the list poison. ... > Fixes: d4546c2509b1 ("net: Convert GRO SKB handling to list_head.") > Signed-off-by: Prashant Bhole <bhole_prashant...@lab.ntt.co.jp> > Reported-by: Tyler Hicks <tyhi...@canonical.com> Applied, thank you. Hopefully we can convert more layers to list_head SKB usage, and thus no longer need hacks like this. Thanks.
