From nobody Fri Mar 22 14:00:28 2024 X-Original-To: dev-commits-src-all@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4V1P9T1DsNz5F10N; Fri, 22 Mar 2024 14:00:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4V1P9T0RTPz4FTb; Fri, 22 Mar 2024 14:00:29 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1711116029; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FjwFzXZxPP/0Znsis/EG3zCWsrFN6xp5Eh9qfzgKv6g=; b=dA2Oo9BJ3YpPCGtd6GsrEg8uILhdt4ArKFrq5FLRHuaqjtE/HmvljKcblWPDYfF6rEf110 KuLWV2cSfaMS9ZmEuqIw/B6iuE8geCNoISif0at5PsHdgn1oBKRAP/baC4Q11d+V92VdMi Dcj1KoYQxv5knJ5MTiS7KsZqWr2PHamUeKvCthJ2Hn5E47umC+VHE/gXnn3o+Gwvt3NVHc lD+oa15tHG1Lo3eHiAl0ijWIL+ptIwDBLZyGm6vTjo+uvZSawI2V59ClWYZLbMks8deQ+T l7r5xf87lb+30mkjw8PsA5cmYN1oEyZ2fTh1FM6n+cmtWG7Vs2cqWmAlk5FEwg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1711116029; a=rsa-sha256; cv=none; b=cB4paAxuTfk3vXJ2X8jWCvZ56ZvgPdFhp1CDifI5DKrLNuPIqMd89lJLiEjwpBXKw0F3NW nq+x3yVVPXSdvxmR2Znuhhj+tlXml86XMJUy06MkNPJi9Qs56C5nMmVgan0a0MU7f7of19 Yad8Mr7Ee2Y7tAP/Z8uHD6/wnad9tqX1rOawWcC9Jh4SJcmT92OsAKqxpW989zAioTmXHe NJKlcMo4UzHQAth9nhFVwj19CULW1Y3woubhPaydRoxE02Zg2+fWQs9I2yJcOvgfOhAF4L 5MX9OQS4ElPxrE5qoLFLmdOTlVDw6JRgQG5P+TXWe91ZIuwjoiWsYhTSdiWM1w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1711116029; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=FjwFzXZxPP/0Znsis/EG3zCWsrFN6xp5Eh9qfzgKv6g=; b=ap0Aq1B62bTPTWglnDrEvYgYg87AUbj7liQAB34POg4FhKcl+15AosAznXof0Pwa5kFqhq 5jh2kES6204zD60PxhbqmeSrurKb6CR4P369PeTrhxvNBiV9Q8/jqaRPEsmBs3ZbE64uTC Hx3NgM5fcf0YlOfGHXj1hbC4+xhQzKWalEsO20GgF8jceiXKnOBh0IbHbZ1p9cjLaP16OI 1Xg9xoySnuke/FUvxI7vZwXGHcNa6HOuDsPRJjomtQFgdG5RF76tcs6iGLJVwsGE/HBG+W MJfClb9zgrB0a/pVd2PFFTOmrBSauaJlsX7uUBx5Ki+fqaTaPqlxvDrfQPl6Jg== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4V1P9T02x9z1LhC; Fri, 22 Mar 2024 14:00:29 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.17.1/8.17.1) with ESMTP id 42ME0Sdw048232; Fri, 22 Mar 2024 14:00:28 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.17.1/8.17.1/Submit) id 42ME0Sm3048229; Fri, 22 Mar 2024 14:00:28 GMT (envelope-from git) Date: Fri, 22 Mar 2024 14:00:28 GMT Message-Id: <202403221400.42ME0Sm3048229@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Ed Maste Subject: git: 163286a86176 - stable/13 - LinuxKPI: Queue skbuffs at tail in __skb_queue_tail List-Id: Commit messages for all branches of the src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-all List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-src-all@freebsd.org X-BeenThere: dev-commits-src-all@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: emaste X-Git-Repository: src X-Git-Refname: refs/heads/stable/13 X-Git-Reftype: branch X-Git-Commit: 163286a861761d54ad0943de70d87cb544200f45 Auto-Submitted: auto-generated The branch stable/13 has been updated by emaste: URL: https://cgit.FreeBSD.org/src/commit/?id=163286a861761d54ad0943de70d87cb544200f45 commit 163286a861761d54ad0943de70d87cb544200f45 Author: Tom Coldrick AuthorDate: 2024-03-02 19:22:55 +0000 Commit: Ed Maste CommitDate: 2024-03-22 14:00:02 +0000 LinuxKPI: Queue skbuffs at tail in __skb_queue_tail Correct skb_queue_tail to queue the buffer at the tail of the skbuff. The skbuff is a circular doubly-linked list, and we call with a pointer to the head of the list. Thus queueing before the head gives us a queueing at the tail. As a motivating factor, the current behaviour (queueing at the head) was causing frequent kernel panics from my RTL8822BE wireless card, which uses the rtw88 driver. Interrupts can cause buffers to be added to the rtwdev c2h_queue while the queue is being drained in rtw_c2h_work. Queueing at the head would leave the nascent entry in the linked list pointing to the old, now freed, memory for the buffer being processed. When rtw_c2h_work is next called, we try reading this and so panic. Reviewed by: emaste, bz MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D44192 (cherry picked from commit d3befb534b9c8cd80f1b8d75ce6451e3f62b8ba9) (cherry picked from commit 95a7c6f18a6a28cf866384ff60b587ec30be1cd1) --- sys/compat/linuxkpi/common/include/linux/skbuff.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/include/linux/skbuff.h b/sys/compat/linuxkpi/common/include/linux/skbuff.h index f8ce212e7853..02190a29e241 100644 --- a/sys/compat/linuxkpi/common/include/linux/skbuff.h +++ b/sys/compat/linuxkpi/common/include/linux/skbuff.h @@ -567,7 +567,7 @@ __skb_queue_tail(struct sk_buff_head *q, struct sk_buff *new) { SKB_TRACE2(q, new); - __skb_queue_after(q, (struct sk_buff *)q, new); + __skb_queue_before(q, (struct sk_buff *)q, new); } static inline void