From: Boris Sukholitko <[email protected]>
Date: Tue, 19 May 2020 10:32:37 +0300
> __netif_receive_skb_core may change the skb pointer passed into it (e.g.
> in rx_handler). The original skb may be freed as a result of this
> operation.
>
> The callers of __netif_receive_skb_core may further process original skb
> by using pt_prev pointer returned by __netif_receive_skb_core thus
> leading to unpleasant effects.
>
> The solution is to pass skb by reference into __netif_receive_skb_core.
>
> v2: Added Fixes tag and comment regarding ppt_prev and skb invariant.
>
> Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type
> lookup")
> Signed-off-by: Boris Sukholitko <[email protected]>
Applied and queued up for -stable.
> @@ -4997,6 +4997,7 @@ static int __netif_receive_skb_core(struct sk_buff
> *skb, bool pfmemalloc,
> bool deliver_exact = false;
> int ret = NET_RX_DROP;
> __be16 type;
> + struct sk_buff *skb = *pskb;
I fixed up the reverse christmas tree variable ordering here, please take
care in this area next time.
Thank you.
