Re: [PATCH net 2/4] gro: fix ownership transfer

[Willem de Bruijn <willemdebruijn.kernel@gmail.com>]

Antoine Tenart wrote:
> Issue was found while using rx-gro-list. If fragmented packets are GROed

Only if you need to respin: "If packets are GROed with fraglist"

A bit pedantic, but this is subtle stuff. These are not IP fragmented
packets. Or worse, UDP fragmentation offload.

> in skb_gro_receive_list, they might be segmented later on and continue
> their journey in the stack. In skb_segment_list those skbs can be reused
> as-is. This is an issue as their destructor was removed in
> skb_gro_receive_list but not the reference to their socket, and then
> they can't be orphaned. Fix this by also removing the reference to the
> socket.
> 
> For example this could be observed,
> 
>   kernel BUG at include/linux/skbuff.h:3131!  (skb_orphan)
>   RIP: 0010:ip6_rcv_core+0x11bc/0x19a0
>   Call Trace:
>    ipv6_list_rcv+0x250/0x3f0
>    __netif_receive_skb_list_core+0x49d/0x8f0
>    netif_receive_skb_list_internal+0x634/0xd40
>    napi_complete_done+0x1d2/0x7d0
>    gro_cell_poll+0x118/0x1f0
> 
> A similar construction is found in skb_gro_receive, apply the same
> change there.
> 
> Fixes: 5e10da5385d2 ("skbuff: allow 'slow_gro' for skb carring sock reference")
> Signed-off-by: Antoine Tenart <atenart@kernel.org>

Looks fine to me on the understanding that the only GSO packets that
arrive with skb->sk are are result of the referenced commit, and thus
had sock_wfree as destructor.