From: Stephen Hemminger <stephen@networkplumber.org>
To: Eric Dumazet <edumazet@google.com>
Cc: netdev@vger.kernel.org, Simon Horman <horms@kernel.org>,
Jamal Hadi Salim <jhs@mojatatu.com>,
Jiri Pirko <jiri@resnulli.us>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Peter Oskolkov <posk@google.com>,
open list <linux-kernel@vger.kernel.org>
Subject: Re: [PATTCH net v5 6/8] net/sched: netem: null-terminate tfifo linear queue tail
Date: Sat, 11 Apr 2026 07:51:01 -0700 [thread overview]
Message-ID: <20260411075101.05c2d8b3@phoenix.local> (raw)
In-Reply-To: <CANn89iJeS-Hw7NNouSWYw6BZvTUG=-grVxAiYzg8a8pEO_LJXQ@mail.gmail.com>
On Fri, 10 Apr 2026 23:38:08 -0700
Eric Dumazet <edumazet@google.com> wrote:
> On Fri, Apr 10, 2026 at 10:17 PM Stephen Hemminger
> <stephen@networkplumber.org> wrote:
> >
> > When tfifo_enqueue() appends a packet to the linear queue tail,
> > nskb->next is never set to NULL. The list terminates correctly
> > only by accident if the skb arrived with next already NULL.
> >
> > Explicitly null-terminate the tail to prevent list corruption.
> >
> > Fixes: d66280b12bd7 ("net: netem: use a list in addition to rbtree")
> > Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> > Reviewed-by: Simon Horman <horms@kernel.org>
>
> Can you explain how skb->next could be not NULL ?
>
> This would be a bug in the upper stack.
>
> Only TCQ_F_NOLOCK qdiscs (pfifo_fast) can possibly get such skbs, and
> it would not care.
>
> Other qdiscs already get skbs with skb_mark_not_on_list(skb).
Thanks, this patch came from a false positive from one of the
review prompts. Dropping it.
next prev parent reply other threads:[~2026-04-11 14:51 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-04-11 5:15 [PATTCH net v5 0/8] net/sched: netem bug fixes Stephen Hemminger
2026-04-11 5:15 ` [PATTCH net v5 1/8] net/sched: netem: fix probability gaps in 4-state loss model Stephen Hemminger
2026-04-11 5:15 ` [PATTCH net v5 2/8] net/sched: netem: fix queue limit check to include reordered packets Stephen Hemminger
2026-04-11 5:15 ` [PATTCH net v5 3/8] net/sched: netem: only reseed PRNG when seed is explicitly provided Stephen Hemminger
2026-04-11 5:15 ` [PATTCH net v5 4/8] net/sched: netem: refactor dequeue into helper functions Stephen Hemminger
2026-04-11 5:15 ` [PATTCH net v5 5/8] net/sched: netem: batch-transfer ready packets to avoid child re-entrancy Stephen Hemminger
2026-04-11 5:15 ` [PATTCH net v5 6/8] net/sched: netem: null-terminate tfifo linear queue tail Stephen Hemminger
2026-04-11 6:38 ` Eric Dumazet
2026-04-11 14:51 ` Stephen Hemminger [this message]
2026-04-11 5:15 ` [PATTCH net v5 7/8] net/sched: netem: check for invalid slot range Stephen Hemminger
2026-04-11 5:15 ` [PATTCH net v5 8/8] net/sched: netem: fix slot delay calculation overflow Stephen Hemminger
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260411075101.05c2d8b3@phoenix.local \
--to=stephen@networkplumber.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=jhs@mojatatu.com \
--cc=jiri@resnulli.us \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=posk@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.