Re: [PATCH net] net: dlink: fix null dereference in receive_packet()

["Yeounsu Moon" <yyyynoom@gmail.com>]

On Fri Oct 10, 2025 at 4:18 PM KST, Simon Horman wrote:
> On Fri, Oct 10, 2025 at 04:02:22AM +0900, Yeounsu Moon wrote:
>> If `np->rx_skbuff[entry]` was not allocated before
>> reuse, `receive_packet()` will cause null dereference.
>> 
>> This patch fixes the issue by breaking out of the loop when
>> `np->rx_skbuff[entry]` is `NULL`.
>
> I see that if np->rx_skbuff[entry] there will be a dereference.
> But I'm less clear on how this situation can occur.
When it failed to reallocate `skb`, and then a lot of packets come in at
that time, `skb_put()` in `receive_packet()` will cause a null dereference
and the kernel will panic.

> So I think it would be worth adding some explanation of that
> to the commit message.
Sorry, I'll make sure to describe the scenario more clearly in the commit
message next time.
>
> Also, I do see that break will result in np->rx_skbuff[entry],
> and other empty entries in that array, being refilled.
> This is due to the refill loop that towards the end of receive_packet().
Exactly, that is correct.
> But perhaps it is worth mentioning that in the commit message too?
You are right. I should mention the effect of the break in the commit
message as well. Sorry for making you point it out twice.