net: ipv4: fix drop handling in ip_list_rcv() and ip_list_rcv_finish()
authorEdward Cree <ecree@solarflare.com>
Wed, 4 Jul 2018 18:23:50 +0000 (19:23 +0100)
committerDavid S. Miller <davem@davemloft.net>
Thu, 5 Jul 2018 02:25:41 +0000 (11:25 +0900)
commita4ca8b7df73c6d78b8b5aa8246a7d794b25c25ce
tree955d32553e5375fa5d23cd3aaea3a79d4fef6bec
parent0eaec62a91ed9d5694b7e2bff30a1b1ad7107be7
net: ipv4: fix drop handling in ip_list_rcv() and ip_list_rcv_finish()

Since callees (ip_rcv_core() and ip_rcv_finish_core()) might free or steal
 the skb, we can't use the list_cut_before() method; we can't even do a
 list_del(&skb->list) in the drop case, because skb might have already been
 freed and reused.
So instead, take each skb off the source list before processing, and add it
 to the sublist afterwards if it wasn't freed or stolen.

Fixes: 5fa12739a53d net: ipv4: listify ip_rcv_finish
Fixes: 17266ee93984 net: ipv4: listified version of ip_rcv
Signed-off-by: Edward Cree <ecree@solarflare.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/ip_input.c