Re: [PATCH] net: core: netif_receive_skb_list: unlist skb before passing to pt->func

From: David Miller
Date: Thu Mar 28 2019 - 20:28:33 EST


From: Alexander Lobakin <alobakin@xxxxxxxx>
Date: Thu, 28 Mar 2019 18:23:04 +0300

> __netif_receive_skb_list_ptype() leaves skb->next poisoned before passing
> it to pt_prev->func handler, what may produce (in certain cases, e.g. DSA
> setup) crashes like:
...
> Fix this by pulling skb off the sublist and zeroing skb->next pointer
> before calling ptype callback.
>
> Fixes: 88eb1944e18c ("net: core: propagate SKB lists through packet_type lookup")
> Reviewed-by: Edward Cree <ecree@xxxxxxxxxxxxxx>
> Signed-off-by: Alexander Lobakin <alobakin@xxxxxxxx>

Applied and queued up for -stable, thanks.