From mboxrd@z Thu Jan 1 00:00:00 1970 From: David Miller Subject: Re: [PATCH net-next] net: gro: properly remove skb from list Date: Thu, 12 Jul 2018 17:02:28 -0700 (PDT) Message-ID: <20180712.170228.2165629850660879756.davem@davemloft.net> References: <20180712072459.8800-1-bhole_prashant_q7@lab.ntt.co.jp> Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit Cc: brouer@redhat.com, tyhicks@canonical.com, netdev@vger.kernel.org To: bhole_prashant_q7@lab.ntt.co.jp Return-path: Received: from shards.monkeyblade.net ([23.128.96.9]:45278 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2387744AbeGMAOY (ORCPT ); Thu, 12 Jul 2018 20:14:24 -0400 In-Reply-To: <20180712072459.8800-1-bhole_prashant_q7@lab.ntt.co.jp> Sender: netdev-owner@vger.kernel.org List-ID: From: Prashant Bhole Date: Thu, 12 Jul 2018 16:24:59 +0900 > Following crash occurs in validate_xmit_skb_list() when same skb is > iterated multiple times in the loop and consume_skb() is called. > > The root cause is calling list_del_init(&skb->list) and not clearing > skb->next in d4546c2509b1. list_del_init(&skb->list) sets skb->next > to point to skb itself. skb->next needs to be cleared because other > parts of network stack uses another kind of SKB lists. > validate_xmit_skb_list() uses such list. > > A similar type of bugfix was reported by Jesper Dangaard Brouer. > https://patchwork.ozlabs.org/patch/942541/ > > This patch clears skb->next and changes list_del_init() to list_del() > so that list->prev will maintain the list poison. ... > Fixes: d4546c2509b1 ("net: Convert GRO SKB handling to list_head.") > Signed-off-by: Prashant Bhole > Reported-by: Tyler Hicks Applied, thank you. Hopefully we can convert more layers to list_head SKB usage, and thus no longer need hacks like this. Thanks.