Messages in this thread | | | Subject | Re: [PATCH net] net: gro: set the last skb->next to NULL when it get merged | From | Eric Dumazet <> | Date | Wed, 27 Oct 2021 12:20:04 -0700 |
| |
On 10/26/21 6:18 AM, kerneljasonxing@gmail.com wrote: > From: Jason Xing <xingwanli@kuaishou.com> > > Setting the @next of the last skb to NULL to prevent the panic in future > when someone does something to the last of the gro list but its @next is > invalid. > > For example, without the fix (commit: ece23711dd95), a panic could happen > with the clsact loaded when skb is redirected and then validated in > validate_xmit_skb_list() which could access the error addr of the @next > of the last skb. Thus, "general protection fault" would appear after that. >
If this a bug, please provide a Fixes: tag
> Signed-off-by: Jason Xing <xingwanli@kuaishou.com> > --- > net/core/skbuff.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/core/skbuff.c b/net/core/skbuff.c > index 2170bea..7b248f1 100644 > --- a/net/core/skbuff.c > +++ b/net/core/skbuff.c > @@ -4396,6 +4396,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) > skb_shinfo(p)->frag_list = skb; > else > NAPI_GRO_CB(p)->last->next = skb; > + skb->next = NULL;
Really at this point skb->next must be already NULL.
Please provide a stack trace so that we fix the caller instead of adding more code in GRO layer.
> NAPI_GRO_CB(p)->last = skb; > __skb_header_release(skb); > lp = p; >
| |