Received: by 2002:a25:5b86:0:0:0:0:0 with SMTP id p128csp1014008ybb; Thu, 28 Mar 2019 17:29:30 -0700 (PDT) X-Google-Smtp-Source: APXvYqwEBRxmJw4tIaaZ29FBIRdkjRlKC+hG5sqGrBqTYdxor1RSZeLSSLGH9phg385c9f0a+TDy X-Received: by 2002:a65:63d9:: with SMTP id n25mr43643423pgv.243.1553819370495; Thu, 28 Mar 2019 17:29:30 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1553819370; cv=none; d=google.com; s=arc-20160816; b=TOyPVqNmFMgnbQOAepAIz90wntJLQnaSgezGjegj77/5wJJy3RJ3TNOA1eW7tAT8w4 KzF2LPLBYYO6sZ50OTB89Y/pq9cfWpqu18YuyPyNytGPHSUyfQS08BVMy2mpbXL/kJlk ZKQuF7HMFryjbJWJX7pCyhjaG8BarOPvV3uhsTlVZ7Gcro74ohT3QoO/hcMuMglJ3u/v Zg9tdFqO8qLPEd1DpBkqAkJh58Dzn1/FBPoHmE0KDexzEKeHqvljYstO028RCYoFLrOM UbKk/iX51PYhdR7fjfnDOMwsasKTjVfv3SASgr7mXd2LKvXVzjtcZpAxXFx2JNTYPMTW GwTg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :references:in-reply-to:from:subject:cc:to:message-id:date; bh=MIiDSZpXWJ+XOfvr6gR3zbmUTdrjahCqyJkpSLocgpE=; b=0ScahDcL+OjgKOdcUnpa+DHjqYGBQ7PBFrgdYrBH6dU5+GruH3XlyNMubFSWsYfh76 kpiwa6DJUEQUwrJkG7ARqNY2GNcrakcoJkVa6jPcnMJOlrBPXa3GYx26FZ+lB3Il8kI1 5MtPNnYVddRhOVBI10RYIqrJKsxU0SZ1Kh3sF+Ji7XleRamxs89xXB5hH9BWjOvSR734 NNJsgKBORoQ+7f/Tzxxj4NvFCIWwZYAIY5RTIX5gwKqByMFVaKv/YHGTmTgAd2Jr5MF9 j6069qpelpCXA6D/WH0xys3HWB4Koz8JyFEXBSJGVXDVTHRRkbOX4AEn1s9OWEobJlCW XPCQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id f7si512744pgs.316.2019.03.28.17.29.14; Thu, 28 Mar 2019 17:29:30 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728656AbfC2A2a (ORCPT + 99 others); Thu, 28 Mar 2019 20:28:30 -0400 Received: from shards.monkeyblade.net ([23.128.96.9]:59478 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727938AbfC2A23 (ORCPT ); Thu, 28 Mar 2019 20:28:29 -0400 Received: from localhost (unknown [IPv6:2601:601:9f80:35cd::d71]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) (Authenticated sender: davem-davemloft) by shards.monkeyblade.net (Postfix) with ESMTPSA id E2CB514D69449; Thu, 28 Mar 2019 17:28:28 -0700 (PDT) Date: Thu, 28 Mar 2019 17:28:28 -0700 (PDT) Message-Id: <20190328.172828.880898031515380835.davem@davemloft.net> To: alobakin@dlink.ru Cc: ecree@solarflare.com, jiri@mellanox.com, idosch@mellanox.com, petrm@mellanox.com, alexander.h.duyck@intel.com, amritha.nambiar@intel.com, lirongqing@baidu.com, netdev@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] net: core: netif_receive_skb_list: unlist skb before passing to pt->func From: David Miller In-Reply-To: <20190328152304.8297-1-alobakin@dlink.ru> References: <20190328152304.8297-1-alobakin@dlink.ru> X-Mailer: Mew version 6.8 on Emacs 26.1 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Thu, 28 Mar 2019 17:28:29 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Alexander Lobakin Date: Thu, 28 Mar 2019 18:23:04 +0300 > __netif_receive_skb_list_ptype() leaves skb->next poisoned before passing > it to pt_prev->func handler, what may produce (in certain cases, e.g. DSA > setup) crashes like: ... > Fix this by pulling skb off the sublist and zeroing skb->next pointer > before calling ptype callback. > > Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type lookup") > Reviewed-by: Edward Cree > Signed-off-by: Alexander Lobakin Applied and queued up for -stable, thanks.