From c112a93ae0bf3906150d3c7badd8ccc2708ad031 Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Sun, 12 Feb 2017 14:03:52 -0800 Subject: net/llc: avoid BUG_ON() in skb_orphan() [ Upstream commit 8b74d439e1697110c5e5c600643e823eb1dd0762 ] It seems nobody used LLC since linux-3.12. Fortunately fuzzers like syzkaller still know how to run this code, otherwise it would be no fun. Setting skb->sk without skb->destructor leads to all kinds of bugs, we now prefer to be very strict about it. Ideally here we would use skb_set_owner() but this helper does not exist yet, only CAN seems to have a private helper for that. [js] take sock_efree from 62bccb8cdb6905 Fixes: 376c7311bdb6 ("net: add a temporary sanity check in skb_orphan()") Signed-off-by: Eric Dumazet Reported-by: Andrey Konovalov Signed-off-by: David S. Miller Signed-off-by: Jiri Slaby --- include/net/sock.h | 1 + 1 file changed, 1 insertion(+) (limited to 'include/net') diff --git a/include/net/sock.h b/include/net/sock.h index 238e934dd3c3..467d2f810fb3 100644 --- a/include/net/sock.h +++ b/include/net/sock.h @@ -1554,6 +1554,7 @@ extern struct sk_buff *sock_rmalloc(struct sock *sk, extern void sock_wfree(struct sk_buff *skb); extern void skb_orphan_partial(struct sk_buff *skb); extern void sock_rfree(struct sk_buff *skb); +void sock_efree(struct sk_buff *skb); extern void sock_edemux(struct sk_buff *skb); extern int sock_setsockopt(struct socket *sock, int level, -- cgit v1.2.3