diff options
| author | Jesper Dangaard Brouer <[email protected]> | 2023-01-20 11:34:44 +0100 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2023-01-23 21:39:04 -0800 |
| commit | f72ff8b81ebc6a0a25e41b7e6c1dc42e3aa33e7e (patch) | |
| tree | 01ee397cacc792536ff11e16429b2694215adfa2 /tools/testing/selftests/bpf/prog_tests/autoload.c | |
| parent | 3bee9b573af515a8f15db70e7875ac96f87d57b5 (diff) | |
net: fix kfree_skb_list use of skb_mark_not_on_list
A bug was introduced by commit eedade12f4cb ("net: kfree_skb_list use
kmem_cache_free_bulk"). It unconditionally unlinked the SKB list via
invoking skb_mark_not_on_list().
In this patch we choose to remove the skb_mark_not_on_list() call as it
isn't necessary. It would be possible and correct to call
skb_mark_not_on_list() only when __kfree_skb_reason() returns true,
meaning the SKB is ready to be free'ed, as it calls/check skb_unref().
This fix is needed as kfree_skb_list() is also invoked on skb_shared_info
frag_list (skb_drop_fraglist() calling kfree_skb_list()). A frag_list can
have SKBs with elevated refcnt due to cloning via skb_clone_fraglist(),
which takes a reference on all SKBs in the list. This implies the
invariant that all SKBs in the list must have the same refcnt, when using
kfree_skb_list().
Reported-by: [email protected]
Reported-and-tested-by: [email protected]
Fixes: eedade12f4cb ("net: kfree_skb_list use kmem_cache_free_bulk")
Signed-off-by: Jesper Dangaard Brouer <[email protected]>
Reviewed-by: Eric Dumazet <[email protected]>
Link: https://lore.kernel.org/r/167421088417.1125894.9761158218878962159.stgit@firesoul
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'tools/testing/selftests/bpf/prog_tests/autoload.c')
0 files changed, 0 insertions, 0 deletions