net/core/skbuff.c 的skb_segment() 函数中list_skb指针可能为空

【标题描述】 net/core/skbuff.c 的skb_segment() 函数中list_skb指针可能为空
【环境信息】
硬件信息：ALL
软件信息：内核3.10及以上所有版本
【问题复现步骤】

if (sg && csum && (mss != GSO_BY_FRAGS)) {
if (!(features & NETIF_F_GSO_PARTIAL)) {
struct sk_buff *iter;
unsigned int frag_len;

  if (!list_skb ||    //当list_skb为null时跳转到normal标签执行
    !net_gso_ok(features, skb_shinfo(head_skb)->gso_type))
    goto normal;

normal:
headroom = skb_headroom(head_skb);
pos = skb_headlen(head_skb);

do {
  struct sk_buff *nskb;
  skb_frag_t *nskb_frag;
  int hsize;
  int size;

  if (unlikely(mss == GSO_BY_FRAGS)) {
    len = list_skb->len;      //list_skb 为空
  } else {

其他没有走到list_skb判空流程，顺序执行到normal时同样有空指针风险

Hi far_beyond, welcome to the openEuler Community.
I'm the Bot here serving you. You can find the instructions on how to interact with me at Here.
If you have any questions, please contact the SIG: Kernel, and any of the maintainers: @YangYingliang , @pi3orama , @成坚 (CHENG Jian) , @jiaoff , @Xie XiuQi

yes,right!

个人认为不会有风险，原因如下：
1：涉及到skb_segment函数的函数包含udp_offload.c offload.c,tcp_offload.c这三个文件，而这三个文件都有对list_skb为空的判断，所以很难走到下面list的判读。
2：就算走到为空的判断，mss=GSO_BY_FRAGS这一判断条件也是不会进去的，因为这一条语句和list_skb内容强相关输入图片说明