diff options
| author | Jesper Dangaard Brouer <[email protected]> | 2023-01-20 10:34:44 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2023-01-24 05:39:04 +0000 |
| commit | f72ff8b81ebc6a0a25e41b7e6c1dc42e3aa33e7e (patch) | |
| tree | 01ee397cacc792536ff11e16429b2694215adfa2 /drivers/net/dsa/microchip/lan937x_main.c | |
| parent | net: microchip: sparx5: Fix uninitialized variable in vcap_path_exist() (diff) | |
| download | kernel-f72ff8b81ebc6a0a25e41b7e6c1dc42e3aa33e7e.tar.gz kernel-f72ff8b81ebc6a0a25e41b7e6c1dc42e3aa33e7e.zip | |
net: fix kfree_skb_list use of skb_mark_not_on_list
A bug was introduced by commit eedade12f4cb ("net: kfree_skb_list use
kmem_cache_free_bulk"). It unconditionally unlinked the SKB list via
invoking skb_mark_not_on_list().
In this patch we choose to remove the skb_mark_not_on_list() call as it
isn't necessary. It would be possible and correct to call
skb_mark_not_on_list() only when __kfree_skb_reason() returns true,
meaning the SKB is ready to be free'ed, as it calls/check skb_unref().
This fix is needed as kfree_skb_list() is also invoked on skb_shared_info
frag_list (skb_drop_fraglist() calling kfree_skb_list()). A frag_list can
have SKBs with elevated refcnt due to cloning via skb_clone_fraglist(),
which takes a reference on all SKBs in the list. This implies the
invariant that all SKBs in the list must have the same refcnt, when using
kfree_skb_list().
Reported-by: [email protected]
Reported-and-tested-by: [email protected]
Fixes: eedade12f4cb ("net: kfree_skb_list use kmem_cache_free_bulk")
Signed-off-by: Jesper Dangaard Brouer <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Link: https://lore.kernel.org/r/167421088417.1125894.9761158218878962159.stgit@firesoul
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'drivers/net/dsa/microchip/lan937x_main.c')
0 files changed, 0 insertions, 0 deletions