diff options
author | Andrey Utkin <andrey.krieger.utkin@gmail.com> | 2014-07-07 16:22:50 -0400 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2014-07-08 22:39:43 -0400 |
commit | 36beddc272c111689f3042bf3d10a64d8a805f93 (patch) | |
tree | 22af97ed421e6e98645259a4f39b5787e909915c /net | |
parent | e0056593b61253f1a8a9941dacda22e73b963cdc (diff) |
appletalk: Fix socket referencing in skb
Setting just skb->sk without taking its reference and setting a
destructor is invalid. However, in the places where this was done, skb
is used in a way not requiring skb->sk setting. So dropping the setting
of skb->sk.
Thanks to Eric Dumazet <eric.dumazet@gmail.com> for correct solution.
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=79441
Reported-by: Ed Martin <edman007@edman007.com>
Signed-off-by: Andrey Utkin <andrey.krieger.utkin@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net')
-rw-r--r-- | net/appletalk/ddp.c | 3 |
1 files changed, 0 insertions, 3 deletions
diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c index 01a1082e02b3..bfcf6be1d665 100644 --- a/net/appletalk/ddp.c +++ b/net/appletalk/ddp.c | |||
@@ -1489,8 +1489,6 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev, | |||
1489 | goto drop; | 1489 | goto drop; |
1490 | 1490 | ||
1491 | /* Queue packet (standard) */ | 1491 | /* Queue packet (standard) */ |
1492 | skb->sk = sock; | ||
1493 | |||
1494 | if (sock_queue_rcv_skb(sock, skb) < 0) | 1492 | if (sock_queue_rcv_skb(sock, skb) < 0) |
1495 | goto drop; | 1493 | goto drop; |
1496 | 1494 | ||
@@ -1644,7 +1642,6 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr | |||
1644 | if (!skb) | 1642 | if (!skb) |
1645 | goto out; | 1643 | goto out; |
1646 | 1644 | ||
1647 | skb->sk = sk; | ||
1648 | skb_reserve(skb, ddp_dl->header_length); | 1645 | skb_reserve(skb, ddp_dl->header_length); |
1649 | skb_reserve(skb, dev->hard_header_len); | 1646 | skb_reserve(skb, dev->hard_header_len); |
1650 | skb->dev = dev; | 1647 | skb->dev = dev; |