diff options
| author | Jesper Dangaard Brouer <brouer@redhat.com> | 2023-02-03 15:59:29 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-02-06 12:56:38 +0300 |
| commit | 9dde0cd3b10f63bc4100ebadc7e32275baabfa68 (patch) | |
| tree | 08f48b41359f74ea3e8b1af884de2cc21d5aa9c4 /include/linux/skbuff.h | |
| parent | 149e8fb06cd925c38cfeb14458480be0cbe3a099 (diff) | |
| download | linux-9dde0cd3b10f63bc4100ebadc7e32275baabfa68.tar.xz | |
net: introduce skb_poison_list and use in kfree_skb_list
First user of skb_poison_list is in kfree_skb_list_reason, to catch bugs
earlier like introduced in commit eedade12f4cb ("net: kfree_skb_list use
kmem_cache_free_bulk"). For completeness mentioned bug have been fixed in
commit f72ff8b81ebc ("net: fix kfree_skb_list use of skb_mark_not_on_list").
In case of a bug like mentioned commit we would have seen OOPS with:
general protection fault, probably for non-canonical address 0xdead000000000870
And content of one the registers e.g. R13: dead000000000800
In this case skb->len is at offset 112 bytes (0x70) why fault happens at
0x800+0x70 = 0x870
Signed-off-by: Jesper Dangaard Brouer <brouer@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/linux/skbuff.h')
| -rw-r--r-- | include/linux/skbuff.h | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h index 5ba12185f43e..1fa95b916342 100644 --- a/include/linux/skbuff.h +++ b/include/linux/skbuff.h @@ -1738,6 +1738,13 @@ static inline void skb_mark_not_on_list(struct sk_buff *skb) skb->next = NULL; } +static inline void skb_poison_list(struct sk_buff *skb) +{ +#ifdef CONFIG_DEBUG_NET + skb->next = SKB_LIST_POISON_NEXT; +#endif +} + /* Iterate through singly-linked GSO fragments of an skb. */ #define skb_list_walk_safe(first, skb, next_skb) \ for ((skb) = (first), (next_skb) = (skb) ? (skb)->next : NULL; (skb); \ |