Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5e71d9d7 authored by Pablo Neira's avatar Pablo Neira Committed by David S. Miller
Browse files

net: fix sk_buff head without data area 



Eric Dumazet spotted that we have to check skb->head instead
of skb->data as skb->head points to the beginning of the
data area of the skbuff. Similarly, we have to initialize the
skb->head pointer, not skb->data in __alloc_skb_head.

After this fix, netlink crashes in the release path of the
sk_buff, so let's fix that as well.

This bug was introduced in (0ebd0ac5 net: add function to
allocate sk_buff head without data area).

Reported-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 9bc297ea

net/core/skbuff.c

+2 −2
Original line number Diff line number Diff line
@@ -195,7 +195,7 @@ struct sk_buff *__alloc_skb_head(gfp_t gfp_mask, int node) 
	 * the tail pointer in struct sk_buff!

	 */

	memset(skb, 0, offsetof(struct sk_buff, tail));

	skb->data = NULL;

	skb->head = NULL;

	skb->truesize = sizeof(struct sk_buff);

	atomic_set(&skb->users, 1);
@@ -611,7 +611,7 @@ static void skb_release_head_state(struct sk_buff *skb) 
static void skb_release_all(struct sk_buff *skb)

{

	skb_release_head_state(skb);

	if (likely(skb->data))

	if (likely(skb->head))

		skb_release_data(skb);

}

net/netlink/af_netlink.c

+1 −1
Original line number Diff line number Diff line
@@ -747,7 +747,7 @@ static void netlink_skb_destructor(struct sk_buff *skb) 
		atomic_dec(&ring->pending);

		sock_put(sk);



		skb->data = NULL;

		skb->head = NULL;

	}

#endif

	if (skb->sk != NULL)