Re: [PATCH net] net: gro: set the last skb->next to NULL when it get merged
From: Eric Dumazet <hidden>
Date: 2021-10-27 19:20:09
Also in:
lkml
On 10/26/21 6:18 AM, kerneljasonxing@gmail.com wrote:
From: Jason Xing <redacted> Setting the @next of the last skb to NULL to prevent the panic in future when someone does something to the last of the gro list but its @next is invalid. For example, without the fix (commit: ece23711dd95), a panic could happen with the clsact loaded when skb is redirected and then validated in validate_xmit_skb_list() which could access the error addr of the @next of the last skb. Thus, "general protection fault" would appear after that.
If this a bug, please provide a Fixes: tag
quoted hunk ↗ jump to hunk
Signed-off-by: Jason Xing <redacted> --- net/core/skbuff.c | 1 + 1 file changed, 1 insertion(+)diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 2170bea..7b248f1 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c@@ -4396,6 +4396,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) skb_shinfo(p)->frag_list = skb; else NAPI_GRO_CB(p)->last->next = skb; + skb->next = NULL;
Really at this point skb->next must be already NULL. Please provide a stack trace so that we fix the caller instead of adding more code in GRO layer.
NAPI_GRO_CB(p)->last = skb; __skb_header_release(skb); lp = p;