mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 10:40:15 +02:00 
			
		
		
		
	netfilter: nfnetlink: use original skbuff when acking batches
Sincebd678e09dc("netfilter: nfnetlink: fix splat due to incorrect socket memory accounting in skbuff clones"), we don't manually attach the sk to the skbuff clone anymore, so we have to use the original skbuff from netlink_ack() which needs to access the sk pointer. Fixes:bd678e09dc("netfilter: nfnetlink: fix splat due to incorrect socket memory accounting in skbuff clones") Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
This commit is contained in:
		
							parent
							
								
									d93c6258ee
								
							
						
					
					
						commit
						7c7bdf3599
					
				
					 1 changed files with 3 additions and 3 deletions
				
			
		| 
						 | 
					@ -311,14 +311,14 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
 | 
				
			||||||
#endif
 | 
					#endif
 | 
				
			||||||
		{
 | 
							{
 | 
				
			||||||
			nfnl_unlock(subsys_id);
 | 
								nfnl_unlock(subsys_id);
 | 
				
			||||||
			netlink_ack(skb, nlh, -EOPNOTSUPP);
 | 
								netlink_ack(oskb, nlh, -EOPNOTSUPP);
 | 
				
			||||||
			return kfree_skb(skb);
 | 
								return kfree_skb(skb);
 | 
				
			||||||
		}
 | 
							}
 | 
				
			||||||
	}
 | 
						}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
	if (!ss->commit || !ss->abort) {
 | 
						if (!ss->commit || !ss->abort) {
 | 
				
			||||||
		nfnl_unlock(subsys_id);
 | 
							nfnl_unlock(subsys_id);
 | 
				
			||||||
		netlink_ack(skb, nlh, -EOPNOTSUPP);
 | 
							netlink_ack(oskb, nlh, -EOPNOTSUPP);
 | 
				
			||||||
		return kfree_skb(skb);
 | 
							return kfree_skb(skb);
 | 
				
			||||||
	}
 | 
						}
 | 
				
			||||||
 | 
					
 | 
				
			||||||
| 
						 | 
					@ -406,7 +406,7 @@ static void nfnetlink_rcv_batch(struct sk_buff *skb, struct nlmsghdr *nlh,
 | 
				
			||||||
				 * pointing to the batch header.
 | 
									 * pointing to the batch header.
 | 
				
			||||||
				 */
 | 
									 */
 | 
				
			||||||
				nfnl_err_reset(&err_list);
 | 
									nfnl_err_reset(&err_list);
 | 
				
			||||||
				netlink_ack(skb, nlmsg_hdr(oskb), -ENOMEM);
 | 
									netlink_ack(oskb, nlmsg_hdr(oskb), -ENOMEM);
 | 
				
			||||||
				status |= NFNL_BATCH_FAILURE;
 | 
									status |= NFNL_BATCH_FAILURE;
 | 
				
			||||||
				goto done;
 | 
									goto done;
 | 
				
			||||||
			}
 | 
								}
 | 
				
			||||||
| 
						 | 
					
 | 
				
			||||||
		Loading…
	
		Reference in a new issue