On 19/05/2020 08:32, Boris Sukholitko wrote:
> __netif_receive_skb_core may change the skb pointer passed into it (e.g.
> in rx_handler). The original skb may be freed as a result of this
> operation.
>
> The callers of __netif_receive_skb_core may further process original skb
> by using pt_prev pointer returned by __netif_receive_skb_core thus
> leading to unpleasant effects.
>
> The solution is to pass skb by reference into __netif_receive_skb_core.
>
> v2: Added Fixes tag and comment regarding ppt_prev and skb invariant.
>
> Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type
> lookup")
> Signed-off-by: Boris Sukholitko <boris.sukholi...@broadcom.com>
> ---
> net/core/dev.c | 20 +++++++++++++++-----
> 1 file changed, 15 insertions(+), 5 deletions(-)
>
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 6d327b7aa813..38adb56624f7 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -4988,7 +4988,7 @@ static inline int nf_ingress(struct sk_buff *skb,
> struct packet_type **pt_prev,
> return 0;
> }
>
> -static int __netif_receive_skb_core(struct sk_buff *skb, bool pfmemalloc,
> +static int __netif_receive_skb_core(struct sk_buff **pskb, bool pfmemalloc,
> struct packet_type **ppt_prev)
> {
> struct packet_type *ptype, *pt_prev;
> @@ -4997,6 +4997,7 @@ static int __netif_receive_skb_core(struct sk_buff
> *skb, bool pfmemalloc,
> bool deliver_exact = false;
> int ret = NET_RX_DROP;
> __be16 type;
> + struct sk_buff *skb = *pskb;
Reverse christmas tree here, or else David will complain ;-)
Apart from that,
Acked-by: Edward Cree <ec...@solarflare.com>
