summaryrefslogtreecommitdiffstats
path: root/net/core
diff options
context:
space:
mode:
authorPaolo Abeni <pabeni@redhat.com>2017-09-06 14:44:36 +0200
committerDavid S. Miller <davem@davemloft.net>2017-09-07 20:02:39 -0700
commitca2c1418efe9f7fe37aa1f355efdf4eb293673ce (patch)
treee7a5bc57ec2c26469e03fb850b4aa61af43bbe38 /net/core
parent5c25f30c93fdc5bf25e62101aeaae7a4f9b421b3 (diff)
downloadlinux-ca2c1418efe9f7fe37aa1f355efdf4eb293673ce.tar.bz2
udp: drop head states only when all skb references are gone
After commit 0ddf3fb2c43d ("udp: preserve skb->dst if required for IP options processing") we clear the skb head state as soon as the skb carrying them is first processed. Since the same skb can be processed several times when MSG_PEEK is used, we can end up lacking the required head states, and eventually oopsing. Fix this clearing the skb head state only when processing the last skb reference. Reported-by: Eric Dumazet <edumazet@google.com> Fixes: 0ddf3fb2c43d ("udp: preserve skb->dst if required for IP options processing") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/skbuff.c9
1 files changed, 3 insertions, 6 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 68065d7d383f..16982de649b9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -710,14 +710,11 @@ EXPORT_SYMBOL(consume_skb);
* consume_stateless_skb - free an skbuff, assuming it is stateless
* @skb: buffer to free
*
- * Works like consume_skb(), but this variant assumes that all the head
- * states have been already dropped.
+ * Alike consume_skb(), but this variant assumes that this is the last
+ * skb reference and all the head states have been already dropped
*/
-void consume_stateless_skb(struct sk_buff *skb)
+void __consume_stateless_skb(struct sk_buff *skb)
{
- if (!skb_unref(skb))
- return;
-
trace_consume_skb(skb);
skb_release_data(skb);
kfree_skbmem(skb);