From a28b1b90de8322ecc45d58f1c08da12197dad17f Mon Sep 17 00:00:00 2001 From: Florian Westphal Date: Sun, 23 Jul 2017 19:54:47 +0200 Subject: [PATCH] skbuff: re-add check for NULL skb->head in kfree_skb path A null check is needed after all. netlink skbs can have skb->head be backed by vmalloc. The netlink destructor vfree()s head, then sets it to NULL. We then panic in skb_release_data with a NULL dereference. Re-add such a test. Alternative would be to switch to kvfree to free skb->head memory and remove the special handling in netlink destructor. Reported-by: kernel test robot Fixes: 06dc75ab06943 ("net: Revert "net: add function to allocate sk_buff head without data area") Signed-off-by: Florian Westphal Signed-off-by: David S. Miller --- net/core/skbuff.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 84bdfa229b0d..c27da51d14e4 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -638,7 +638,8 @@ void skb_release_head_state(struct sk_buff *skb) static void skb_release_all(struct sk_buff *skb) { skb_release_head_state(skb); - skb_release_data(skb); + if (likely(skb->head)) + skb_release_data(skb); } /**