net: fix kfree_skb_list use of skb_mark_not_on_list From: Jesper Dangaard Brouer A bug was introduced by commit eedade12f4cb ("net: kfree_skb_list use kmem_cache_free_bulk"). It unconditionally unlinked the SKB list via invoking skb_mark_not_on_list(). The skb_mark_not_on_list() should only be called if __kfree_skb_reason() returns true, meaning the SKB is ready to be free'ed (as it calls/check skb_unref()). Reported-by: syzbot+c8a2e66e37eee553c4fd@syzkaller.appspotmail.com Fixes: eedade12f4cb ("net: kfree_skb_list use kmem_cache_free_bulk") Signed-off-by: Jesper Dangaard Brouer --- net/core/skbuff.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 4e73ab3482b8..1bffbcbe6087 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -999,10 +999,10 @@ kfree_skb_list_reason(struct sk_buff *segs, enum skb_drop_reason reason) while (segs) { struct sk_buff *next = segs->next; - skb_mark_not_on_list(segs); - - if (__kfree_skb_reason(segs, reason)) + if (__kfree_skb_reason(segs, reason)) { + skb_mark_not_on_list(segs); kfree_skb_add_bulk(segs, &sa, reason); + } segs = next; }