Re: [PATCH] io_uring/cmd_net: fix wrong argument types for skb_queue_splice()

["Günther Noack" <gnoack@google.com>]

On Thu, Nov 20, 2025 at 01:24:14PM -0700, Jens Axboe wrote:
> If timestamp retriving needs to be retried and the local list of
> SKB's already has entries, then it's spliced back into the socket
> queue. However, the arguments for the splice helper are transposed,
> causing exactly the wrong direction of splicing into the on-stack
> list. Fix that up.
> 
> Cc: stable@vger.kernel.org
> Reported-by: Google Big Sleep <big-sleep-vuln-reports+bigsleep-462435176@google.com>
> Fixes: 9e4ed359b8ef ("io_uring/netcmd: add tx timestamping cmd support")
> Signed-off-by: Jens Axboe <axboe@kernel.dk>
> 
> ---
> 
> diff --git a/io_uring/cmd_net.c b/io_uring/cmd_net.c
> index 27a09aa4c9d0..3b75931bd569 100644
> --- a/io_uring/cmd_net.c
> +++ b/io_uring/cmd_net.c
> @@ -127,7 +127,7 @@ static int io_uring_cmd_timestamp(struct socket *sock,
>  
>  	if (!unlikely(skb_queue_empty(&list))) {
>  		scoped_guard(spinlock_irqsave, &q->lock)
> -			skb_queue_splice(q, &list);
> +			skb_queue_splice(&list, q);
>  	}
>  	return -EAGAIN;
>  }
> 
> -- 

Thanks for the quick patch!

Reviewed-by: Günther Noack <gnoack@google.com>
Tested-by: Günther Noack <gnoack@google.com>

—Günther