net: avoid prefetching NULL pointers

Aditya Gupta reported PowerPC crashes bisected to the blamed commit.

Apparently some platforms do not allow prefetch() on arbitrary pointers.

  prefetch(next);
  prefetch(&next->priority); // CRASH when next == NULL

Only NULL seems to be supported, with specific handling in prefetch().

Add a conditional to avoid the two prefetches and the skb->next clearing
for the last skb in the list.

Fixes: b2e9821cff6c ("net: prefech skb->priority in __dev_xmit_skb()")
Reported-by: Aditya Gupta <adityag@linux.ibm.com>
Closes: https://lore.kernel.org/netdev/e9f4abee-b132-440f-a50e-bced0868b5a7@linux.ibm.com/T/#mddc372b64ec5a3b181acc9ee3909110c391cc18a
Signed-off-by: Eric Dumazet <edumazet@google.com>
Tested-by: Aditya Gupta <adityag@linux.ibm.com>
Link: https://patch.msgid.link/20251218081844.809008-1-edumazet@google.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/core/dev.c b/net/core/dev.c
index 9094c0fb8c689cd5252274d839638839bfb7642e..36dc5199037edb1506e67f6ab5e977ff41efef59 100644 (file)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -4241,9 +4241,11 @@ static inline int __dev_xmit_skb(struct sk_buff *skb, struct Qdisc *q,
                int count = 0;
 
                llist_for_each_entry_safe(skb, next, ll_list, ll_node) {
-                       prefetch(next);
-                       prefetch(&next->priority);
-                       skb_mark_not_on_list(skb);
+                       if (next) {
+                               prefetch(next);
+                               prefetch(&next->priority);
+                               skb_mark_not_on_list(skb);
+                       }
                        rc = dev_qdisc_enqueue(skb, q, &to_free, txq);
                        count++;
                }