From nobody Fri Mar 22 13:38:06 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4V1Ngg1Wmgz5DxxF; Fri, 22 Mar 2024 13:38:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4V1Ngg0dB8z49bf; Fri, 22 Mar 2024 13:38:07 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1711114687; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cSyPfexTNpu/tT/UyfBoG83h3eBJdS1Kv5gfBcbe4dY=; b=DZoEEFzpaCtlBw4AYyBZyOMrcLBL7kl8g/Kr/XBc2RrH0+/bLK5Whc+DrBbJ6upOOVW83P AwbvItPks50bx/055tDKo539MxGEuww+07DGPZ0CT90HsPAvLSFeqzYRcXcF3xHgG6IP2J z1LlBIHs7V3ql4YVSD9wuiOvjVLh4DV2hC5IFt6q2t5glLiXPNx2aE4+LR7IXN3yJBVBuI JeYvv5PvW7uBJhXzXjMQMPV6xKwCBgMo+Zrb7oVbM5G/1JAFMTtdvEsdKuXiyw+PqvgFkX Shs+hr27tbgjaNoiz+sAP/9sw86w7rofIb2BP2A28byBNopAN0vMezHRCKc3MA== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1711114687; a=rsa-sha256; cv=none; b=uESCZtGaimYnS84Tf/CjX9vcyTzd+/j22xsGJAuqW/02/56+UBi4BmNYPoy/dGZSmAmF5r 3LLPC3tnQs3mvUIsIGvRQX447mS97Pv1oixUT/M3E6tTerJe6DJR73JuIhttot40Kr9ci3 zJoRXAWDwNwjAIpPkaBVNdXx6YQSUv5SHJANkyB6+0j4qxF8X0r3MGcHQXG9PvW4Xiq6Z4 GwgkY1iOq1JjHgOiO854bGfemBlItk1Yo28hIsR9B16J9h2HT6JWjZX1yParDlXpHa4eyO 1GblIKoILnZfAYMRpiMRJSx54wMx1ihWY8/U6GvYOv8MnMdNOkYqcno6evb8Tw== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1711114687; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=cSyPfexTNpu/tT/UyfBoG83h3eBJdS1Kv5gfBcbe4dY=; b=gzBw/0AVgpnu6wv0sLH10uyrLsfmLasMX5R1ECdgDt6MuzRfFoHFYdXuqdKcUe4MAzdfh+ m68NOCxrTyYwkPMlUuX0oEnI0SD1lVC5GZcxJU2JPBh8KST/cIw3v+nzRE2Qoo9fAw9hyH INHaBHMFun5HaXn5FKolo0ZQ6qbhh4hucgDteY06THTdzBZ7tEqLaFVClArwX7JfcEPDYc 4xFb9ytgaz6xPRRA4S4x5895ul0AIGuUll+68Uz4wSbvBn9uHUPBAOErc4MiAOTUxDDYH4 pDF3hqiadU/diNz27ou6D8Du3TyIxPlEcREUeX3Ol0ynPkHxuIkK1V8JC24HNQ== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4V1Ngg0Dkcz1Ky0; Fri, 22 Mar 2024 13:38:07 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 42MDc6Dk004384; Fri, 22 Mar 2024 13:38:06 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 42MDc6bM004381; Fri, 22 Mar 2024 13:38:06 GMT (envelope-from git) Date: Fri, 22 Mar 2024 13:38:06 GMT Message-Id: <202403221338.42MDc6bM004381@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: 95a7c6f18a6a - stable/14 - LinuxKPI: Queue skbuffs at tail in __skb_queue_tail List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/14 X-Git-Reftype: branch X-Git-Commit: 95a7c6f18a6a28cf866384ff60b587ec30be1cd1 Auto-Submitted: auto-generated The branch stable/14 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=95a7c6f18a6a28cf866384ff60b587ec30be1cd1 commit 95a7c6f18a6a28cf866384ff60b587ec30be1cd1 Author: Tom Coldrick AuthorDate: 2024-03-02 19:22:55 +0000 Commit: Ed Maste CommitDate: 2024-03-22 13:30:33 +0000 LinuxKPI: Queue skbuffs at tail in __skb_queue_tail Correct skb_queue_tail to queue the buffer at the tail of the skbuff. The skbuff is a circular doubly-linked list, and we call with a pointer to the head of the list. Thus queueing before the head gives us a queueing at the tail. As a motivating factor, the current behaviour (queueing at the head) was causing frequent kernel panics from my RTL8822BE wireless card, which uses the rtw88 driver. Interrupts can cause buffers to be added to the rtwdev c2h_queue while the queue is being drained in rtw_c2h_work. Queueing at the head would leave the nascent entry in the linked list pointing to the old, now freed, memory for the buffer being processed. When rtw_c2h_work is next called, we try reading this and so panic. Reviewed by: emaste, bz MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D44192 (cherry picked from commit d3befb534b9c8cd80f1b8d75ce6451e3f62b8ba9) --- sys/compat/linuxkpi/common/include/linux/skbuff.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/include/linux/skbuff.h b/sys/compat/linuxkpi/common/include/linux/skbuff.h index f8ce212e7853..02190a29e241 100644 --- a/sys/compat/linuxkpi/common/include/linux/skbuff.h +++ b/sys/compat/linuxkpi/common/include/linux/skbuff.h @@ -567,7 +567,7 @@ __skb_queue_tail(struct sk_buff_head *q, struct sk_buff *new) { SKB_TRACE2(q, new); - __skb_queue_after(q, (struct sk_buff *)q, new); + __skb_queue_before(q, (struct sk_buff *)q, new); } static inline void