Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [BUG] net: core: netif_receive_skb_list() crash on non-standard
 ptypes forwarding
To:     Alexander Lobakin <alobakin@dlink.ru>
CC:     "David S. Miller" <davem@davemloft.net>,
        Jiri Pirko <jiri@mellanox.com>,
        Ido Schimmel <idosch@mellanox.com>,
        Petr Machata <petrm@mellanox.com>,
        Alexander Duyck <alexander.h.duyck@intel.com>,
        Amritha Nambiar <amritha.nambiar@intel.com>,
        Li RongQing <lirongqing@baidu.com>, <netdev@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>
References: <1553767399.1271.1@dlink.ru>
 <61211987-2c8b-12b2-54cc-5ee23e2d0da9@solarflare.com>
 <5b3ef488e40c31dfa2e8d62b94e4df55@dlink.ru>
From:   Edward Cree <ecree@solarflare.com>
Message-ID: <3a31d5c9-6995-7078-1644-d170f70992f9@solarflare.com>
Date:   Thu, 28 Mar 2019 12:29:35 +0000
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
 Thunderbird/60.6.0
MIME-Version: 1.0
In-Reply-To: <5b3ef488e40c31dfa2e8d62b94e4df55@dlink.ru>
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: 8bit
Content-Language: en-GB
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 28/03/2019 11:56, Alexander Lobakin wrote:
> Edward Cree wrote 28.03.2019 14:37:
>> On 28/03/2019 10:03, Alexander Lobakin wrote:
>>> Here's a working possible fix for that, not sure if it can break anything
>>> though.
>>>
>>> diff --git a/net/core/dev.c b/net/core/dev.c
>>> index 2b67f2aa59dd..fdcff29df915 100644
>>> --- a/net/core/dev.c
>>> +++ b/net/core/dev.c
>>> @@ -5014,8 +5014,10 @@ static inline void __netif_receive_skb_list_ptype(struct list_head *head,
>>>     if (pt_prev->list_func != NULL)
>>>         pt_prev->list_func(head, pt_prev, orig_dev);
>>>     else
>>> -        list_for_each_entry_safe(skb, next, head, list)
>>> +        list_for_each_entry_safe(skb, next, head, list) {
>>> +            skb_list_del_init(skb);
>>>             pt_prev->func(skb, skb->dev, pt_prev, orig_dev);
>>> +        }
>>> }
>>>
>>> static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemalloc)
>>>
>>> Maybe you could look into this and find another/better solution (or I could
>>> submit this one if that's pretty enough).
>> That looks like the correct fix to me, go ahead and have a
>> Reviewed-by: Edward Cree <ecree@solarflare.com>
>
> Cool!
> Do we need a "stable" mark in this case to propose it to LTS backports (4.20+, I suppose)?
Probably add a
Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type lookup")
(then Dave will take care of sending it to -stable.)

-Ed