Re: [PATTCH net v5 6/8] net/sched: netem: null-terminate tfifo linear queue tail

[Stephen Hemminger]

On Fri, 10 Apr 2026 23:38:08 -0700
Eric Dumazet <edumazet@xxxxxxxxxx> wrote:

> On Fri, Apr 10, 2026 at 10:17 PM Stephen Hemminger
> <stephen@xxxxxxxxxxxxxxxxxx> wrote:
> >
> > When tfifo_enqueue() appends a packet to the linear queue tail,
> > nskb->next is never set to NULL. The list terminates correctly
> > only by accident if the skb arrived with next already NULL.
> >
> > Explicitly null-terminate the tail to prevent list corruption.
> >
> > Fixes: d66280b12bd7 ("net: netem: use a list in addition to rbtree")
> > Signed-off-by: Stephen Hemminger <stephen@xxxxxxxxxxxxxxxxxx>
> > Reviewed-by: Simon Horman <horms@xxxxxxxxxx>  
> 
> Can you explain how skb->next could be not NULL ?
> 
> This would be a bug in the upper stack.
> 
> Only TCQ_F_NOLOCK qdiscs (pfifo_fast) can possibly get such skbs, and
> it would not care.
> 
> Other qdiscs already get skbs with skb_mark_not_on_list(skb).


Thanks, this patch came from a false positive from one of the
review prompts. Dropping it.