On Wed, 2016-01-13 at 14:26 +0200, Rémi Denis-Courmont wrote:

Le 2016-01-12 18:58, Eric Dumazet a écrit :

quoted

From: Eric Dumazet <edumazet@google.com>

Ivaylo Dimitrov reported a regression caused by commit 7866a621043f
("dev: add per net_device packet type chains").

skb->dev becomes NULL and we crash in __netif_receive_skb_core().

Before above commit, different kind of bugs or corruptions could 
happen
without major crash.

Hmm... was that always a problem then, or did it get introduced 
earlier? I thought it was impossible for skb to be shared on PF-recv 
callback way back.

Always been a problem.

Use tcpdump and you risk use after free.

Or simply panics if skb->head needs to be expanded.

Other relevant commits to explain this :

044453b3efdc90bdd5feffe74b99d95dec70ac43 arp: fix possible crash in
arp_rcv()

b30532515f0a62bfe17207ab00883dd262497006 bonding: Ensure that we unshare
skbs prior to calling pskb_may_pull