summaryrefslogtreecommitdiff
path: root/net/core
diff options
context:
space:
mode:
authorPablo Neira <pablo@netfilter.org>2013-06-03 13:28:43 +0400
committerDavid S. Miller <davem@davemloft.net>2013-06-05 04:26:49 +0400
commit5e71d9d77c07fa7d4c42287a177f7b738d0cd4b9 (patch)
tree143f0f3ea5dbebf7bee5e326c73002f36d87dbb3 /net/core
parent9bc297ea0622bb2a6b3abfa2fa84f0a3b86ef8c8 (diff)
downloadlinux-5e71d9d77c07fa7d4c42287a177f7b738d0cd4b9.tar.xz
net: fix sk_buff head without data area
Eric Dumazet spotted that we have to check skb->head instead of skb->data as skb->head points to the beginning of the data area of the skbuff. Similarly, we have to initialize the skb->head pointer, not skb->data in __alloc_skb_head. After this fix, netlink crashes in the release path of the sk_buff, so let's fix that as well. This bug was introduced in (0ebd0ac net: add function to allocate sk_buff head without data area). Reported-by: Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
-rw-r--r--net/core/skbuff.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index af9185d0be6a..cfd777bd6bd0 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -195,7 +195,7 @@ struct sk_buff *__alloc_skb_head(gfp_t gfp_mask, int node)
* the tail pointer in struct sk_buff!
*/
memset(skb, 0, offsetof(struct sk_buff, tail));
- skb->data = NULL;
+ skb->head = NULL;
skb->truesize = sizeof(struct sk_buff);
atomic_set(&skb->users, 1);
@@ -611,7 +611,7 @@ static void skb_release_head_state(struct sk_buff *skb)
static void skb_release_all(struct sk_buff *skb)
{
skb_release_head_state(skb);
- if (likely(skb->data))
+ if (likely(skb->head))
skb_release_data(skb);
}