net: fix sk_buff head without data area (5e71d9d7) · Commits · 戴 / test

Eric Dumazet spotted that we have to check skb->head instead of skb->data as skb->head points to the beginning of the data area of the skbuff. Similarly, we have to initialize the skb->head pointer, not skb->data in __alloc_skb_head. After this fix, netlink crashes in the release path of the sk_buff, so let's fix that as well. This bug was introduced in ( net: add function to allocate sk_buff head without data area). Reported-by:

Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:

Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/core/skbuff.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -195,7 +195,7 @@ struct sk_buff *__alloc_skb_head(gfp_t gfp_mask, int node)
		* the tail pointer in struct sk_buff!
		*/
		memset(skb, 0, offsetof(struct sk_buff, tail));
		skb->data = NULL;
		skb->head = NULL;
		skb->truesize = sizeof(struct sk_buff);
		atomic_set(&skb->users, 1);

		@@ -611,7 +611,7 @@ static void skb_release_head_state(struct sk_buff *skb)
		static void skb_release_all(struct sk_buff *skb)
		{
		skb_release_head_state(skb);
		if (likely(skb->data))
		if (likely(skb->head))
		skb_release_data(skb);
		}

net/netlink/af_netlink.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -747,7 +747,7 @@ static void netlink_skb_destructor(struct sk_buff *skb)
		atomic_dec(&ring->pending);
		sock_put(sk);

		skb->data = NULL;
		skb->head = NULL;
		}
		#endif
		if (skb->sk != NULL)

Admin message