This is a follow-up to commit dc4b95b8fee9 ("net/sched: sch_teql: restore skb->dev on the slave failure path"), which restored skb->dev to the master after each slave iteration but left the master-vs-slave mismatch on the neighbour/ARP-queue path, and left the queued skb naming the master rather than the device whose neighbour took it. teql_master_xmit() sets skb->dev = slave only right before calling the slave's ndo_start_xmit(). When the slave has no resolved neighbour, teql_resolve() hands the skb to neigh_event_send(), which queues it on the slave's neighbour arp_queue while skb->dev still points at the teql* master. skb->dev takes no netdev reference, and the master is freed unconditionally on teql_exit() while the slave is still alive, so a queued skb that runs the ARP retransmit path can dereference a freed device. Move the assignment to before teql_resolve(), so a skb parked on the slave's arp_queue carries the slave's device and is flushed with it. There is a second issue: when the neighbour resolves, neigh_update_process_arp_queue() re-looks-up the top-level neighbour so shaper, eql and teql can be re-entered, but it calls n1->output() without restoring skb->dev. An skb that was parked with skb->dev set to the slave then leaves through the slave directly, skipping teql_master_xmit() and the dev_hard_header() call that builds the slave's link-layer header, and is transmitted headerless. Restore skb->dev = n1->dev at the reinjection point; this is the identity for every other parker (neigh_resolve_output() parks with skb->dev == neigh->dev, ndisc probes carry no skb) and the needed repair for teql. Conditions to recreate the bug: a teql master with a slave whose neighbour is unresolved; send one packet through the master so the skb parks on the slave's arp_queue. On the unfixed tree the parked skb names the master (kprobe on __neigh_event_send shows skb->dev=teql0); with only the first hunk applied, the parked packet is delivered to the slave's peer without a link-layer header when ARP completes. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: Sashiko (nipa) Closes: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824115928.4099988-1-victor@mojatatu.com Link: https://lore.kernel.org/netdev/20260824115928.4099988-1-victor@mojatatu.com/ Signed-off-by: Jamal Hadi Salim --- net/core/neighbour.c | 1 + net/sched/sch_teql.c | 2 +- 2 files changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/neighbour.c b/net/core/neighbour.c index 7448320f7ad5..5823f5007812 100644 --- a/net/core/neighbour.c +++ b/net/core/neighbour.c @@ -1336,6 +1336,7 @@ static void neigh_update_process_arp_queue(struct neighbour *neigh) if (n2) n1 = n2; } + skb->dev = n1->dev; READ_ONCE(n1->output)(n1, skb); if (n2) neigh_release(n2); diff --git a/net/sched/sch_teql.c b/net/sched/sch_teql.c index acd03f9afc6b..3fbd5af10028 100644 --- a/net/sched/sch_teql.c +++ b/net/sched/sch_teql.c @@ -348,12 +348,12 @@ static netdev_tx_t teql_master_xmit(struct sk_buff *skb, struct net_device *dev) continue; } + skb->dev = slave; switch (teql_resolve(skb, skb_res, slave, slave_txq, &hlen)) { case 0: if (__netif_tx_trylock(slave_txq)) { unsigned int length = qdisc_pkt_len(skb); - skb->dev = slave; if (!netif_xmit_frozen_or_stopped(slave_txq) && netdev_start_xmit(skb, slave, slave_txq, false) == NETDEV_TX_OK) { -- 2.43.0