upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-06-06 23:32:52 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

LinuxKPI: Queue skbuffs at tail in __skb_queue_tail

Browse source 
Correct skb_queue_tail to queue the buffer at the tail of the skbuff.
The skbuff is a circular doubly-linked list, and we call with a pointer
to the head of the list.  Thus queueing before the head gives us a
queueing at the tail.

As a motivating factor, the current behaviour (queueing at the head) was
causing frequent kernel panics from my RTL8822BE wireless card, which
uses the rtw88 driver.  Interrupts can cause buffers to be added to the
rtwdev c2h_queue while the queue is being drained in rtw_c2h_work.
Queueing at the head would leave the nascent entry in the linked list
pointing to the old, now freed, memory for the buffer being processed.
When rtw_c2h_work is next called, we try reading this and so panic.

Reviewed by:	emaste, bz
MFC after:	1 week
Differential Revision: https://reviews.freebsd.org/D44192
This commit is contained in:
Tom Coldrick 2024-03-02 14:22:55 -05:00 committed by Ed Maste
parent a725a7a24d
commit d3befb534b
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
sys/compat/linuxkpi/common/include/linux/skbuff.h
View file

@ -567,7 +567,7 @@ __skb_queue_tail(struct sk_buff_head *q, struct sk_buff *new)
{
SKB_TRACE2(q, new);
__skb_queue_after(q, (struct sk_buff *)q, new);
__skb_queue_before(q, (struct sk_buff *)q, new);
}
static inline void