Skip to content

Commit 9af86f9

Browse files
ecree-solarflaredavem330
authored andcommitted
net: core: fix use-after-free in __netif_receive_skb_list_core
__netif_receive_skb_core can free the skb, so we have to use the dequeue- enqueue model when calling it from __netif_receive_skb_list_core. Fixes: 88eb194 ("net: core: propagate SKB lists through packet_type lookup") Signed-off-by: Edward Cree <ecree@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 9f17dbf commit 9af86f9

File tree

1 file changed

+7
-2
lines changed

1 file changed

+7
-2
lines changed

net/core/dev.c

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4830,23 +4830,28 @@ static void __netif_receive_skb_list_core(struct list_head *head, bool pfmemallo
48304830
struct list_head sublist;
48314831
struct sk_buff *skb, *next;
48324832

4833+
INIT_LIST_HEAD(&sublist);
48334834
list_for_each_entry_safe(skb, next, head, list) {
48344835
struct net_device *orig_dev = skb->dev;
48354836
struct packet_type *pt_prev = NULL;
48364837

4838+
list_del(&skb->list);
48374839
__netif_receive_skb_core(skb, pfmemalloc, &pt_prev);
4840+
if (!pt_prev)
4841+
continue;
48384842
if (pt_curr != pt_prev || od_curr != orig_dev) {
48394843
/* dispatch old sublist */
4840-
list_cut_before(&sublist, head, &skb->list);
48414844
__netif_receive_skb_list_ptype(&sublist, pt_curr, od_curr);
48424845
/* start new sublist */
4846+
INIT_LIST_HEAD(&sublist);
48434847
pt_curr = pt_prev;
48444848
od_curr = orig_dev;
48454849
}
4850+
list_add_tail(&skb->list, &sublist);
48464851
}
48474852

48484853
/* dispatch final sublist */
4849-
__netif_receive_skb_list_ptype(head, pt_curr, od_curr);
4854+
__netif_receive_skb_list_ptype(&sublist, pt_curr, od_curr);
48504855
}
48514856

48524857
static int __netif_receive_skb(struct sk_buff *skb)

0 commit comments

Comments
 (0)