Re: [PATTCH net v5 6/8] net/sched: netem: null-terminate tfifo linear queue tail

[Eric Dumazet]

On Fri, Apr 10, 2026 at 10:17 PM Stephen Hemminger
<stephen@xxxxxxxxxxxxxxxxxx> wrote:
>
> When tfifo_enqueue() appends a packet to the linear queue tail,
> nskb->next is never set to NULL. The list terminates correctly
> only by accident if the skb arrived with next already NULL.
>
> Explicitly null-terminate the tail to prevent list corruption.
>
> Fixes: d66280b12bd7 ("net: netem: use a list in addition to rbtree")
> Signed-off-by: Stephen Hemminger <stephen@xxxxxxxxxxxxxxxxxx>
> Reviewed-by: Simon Horman <horms@xxxxxxxxxx>

Can you explain how skb->next could be not NULL ?

This would be a bug in the upper stack.

Only TCQ_F_NOLOCK qdiscs (pfifo_fast) can possibly get such skbs, and
it would not care.

Other qdiscs already get skbs with skb_mark_not_on_list(skb).