Messages in this thread | | | From | Jason Xing <> | Date | Wed, 27 Oct 2021 15:23:31 +0800 | Subject | Re: [PATCH net] net: gro: set the last skb->next to NULL when it get merged |
| |
On Tue, Oct 26, 2021 at 9:19 PM <kerneljasonxing@gmail.com> wrote: > > From: Jason Xing <xingwanli@kuaishou.com> > > Setting the @next of the last skb to NULL to prevent the panic in future > when someone does something to the last of the gro list but its @next is > invalid. > > For example, without the fix (commit: ece23711dd95), a panic could happen > with the clsact loaded when skb is redirected and then validated in > validate_xmit_skb_list() which could access the error addr of the @next > of the last skb. Thus, "general protection fault" would appear after that. > > Signed-off-by: Jason Xing <xingwanli@kuaishou.com> > --- > net/core/skbuff.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/net/core/skbuff.c b/net/core/skbuff.c > index 2170bea..7b248f1 100644 > --- a/net/core/skbuff.c > +++ b/net/core/skbuff.c > @@ -4396,6 +4396,7 @@ int skb_gro_receive(struct sk_buff *p, struct sk_buff *skb) > skb_shinfo(p)->frag_list = skb; > else > NAPI_GRO_CB(p)->last->next = skb; > + skb->next = NULL; > NAPI_GRO_CB(p)->last = skb;
Besides, I'm a little bit confused that this operation inserts the newest skb into the tail of the flow, so the tail of flow is the newest, head oldest. The patch (commit: 600adc18) introduces the flush of the oldest when the flow is full to lower the latency, but actually it fetches the tail of the flow. Do I get something wrong here? I feel it is really odd.
Thanks, Jason
> __skb_header_release(skb); > lp = p; > -- > 1.8.3.1 >
| |