Re: [PATCH] net: fix skb use after free in netpoll_send_skb_on_dev

From: Feng Sun Date: Sat, 24 Aug 2019 00:32:00 +0800 > After commit baeababb5b85d5c4e6c917efe2a1504179438d3b > ("tun: return NET_XMIT_DROP for dropped packets"), > when tun_net_xmit drop packets, it will free skb and return NET_XMIT_DROP, > netpoll_send_skb_on_dev will run into two use after free

[PATCH] net: fix skb use after free in netpoll_send_skb_on_dev

After commit baeababb5b85d5c4e6c917efe2a1504179438d3b ("tun: return NET_XMIT_DROP for dropped packets"), when tun_net_xmit drop packets, it will free skb and return NET_XMIT_DROP, netpoll_send_skb_on_dev will run into two use after free cases: 1. retry netpoll_start_xmit with freed skb; 2. queue fr