diff options
| author | Pablo Neira <pablo@netfilter.org> | 2013-06-03 09:28:43 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-06-04 17:26:49 -0700 |
| commit | 5e71d9d77c07fa7d4c42287a177f7b738d0cd4b9 (patch) | |
| tree | 143f0f3ea5dbebf7bee5e326c73002f36d87dbb3 /net | |
| parent | 9bc297ea0622bb2a6b3abfa2fa84f0a3b86ef8c8 (diff) | |
net: fix sk_buff head without data area
Eric Dumazet spotted that we have to check skb->head instead
of skb->data as skb->head points to the beginning of the
data area of the skbuff. Similarly, we have to initialize the
skb->head pointer, not skb->data in __alloc_skb_head.
After this fix, netlink crashes in the release path of the
sk_buff, so let's fix that as well.
This bug was introduced in (0ebd0ac net: add function to
allocate sk_buff head without data area).
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
| -rw-r--r-- | net/core/skbuff.c | 4 | ||||
| -rw-r--r-- | net/netlink/af_netlink.c | 2 |
2 files changed, 3 insertions, 3 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c index af9185d0be6..cfd777bd6bd 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -195,7 +195,7 @@ struct sk_buff *__alloc_skb_head(gfp_t gfp_mask, int node) * the tail pointer in struct sk_buff! */ memset(skb, 0, offsetof(struct sk_buff, tail)); - skb->data = NULL; + skb->head = NULL; skb->truesize = sizeof(struct sk_buff); atomic_set(&skb->users, 1); @@ -611,7 +611,7 @@ static void skb_release_head_state(struct sk_buff *skb) static void skb_release_all(struct sk_buff *skb) { skb_release_head_state(skb); - if (likely(skb->data)) + if (likely(skb->head)) skb_release_data(skb); } diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index 12ac6b47a35..d0b3dd60d38 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -747,7 +747,7 @@ static void netlink_skb_destructor(struct sk_buff *skb) atomic_dec(&ring->pending); sock_put(sk); - skb->data = NULL; + skb->head = NULL; } #endif if (skb->sk != NULL) |