When tfifo_enqueue() appends a packet to the linear queue tail, nskb->next is never set to NULL. The list terminates correctly only by accident if the skb arrived with next already NULL. Explicitly null-terminate the tail to prevent list corruption. Fixes: d66280b12bd7 ("net: netem: use a list in addition to rbtree") Signed-off-by: Stephen Hemminger --- net/sched/sch_netem.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c index ce12b64603b2..4b27fab72fef 100644 --- a/net/sched/sch_netem.c +++ b/net/sched/sch_netem.c @@ -398,6 +398,7 @@ static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch) q->t_tail->next = nskb; else q->t_head = nskb; + nskb->next = NULL; q->t_tail = nskb; } else { struct rb_node **p = &q->t_root.rb_node, *parent = NULL; -- 2.53.0