Commit e5c8eda3 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

udp: call skb_orphan() before skb_attempt_defer_free() 



Standard UDP receive path does not use skb->destructor.

But skmsg layer does use it, since it calls skb_set_owner_sk_safe()
from udp_read_skb().

This then triggers this warning in skb_attempt_defer_free():

    DEBUG_NET_WARN_ON_ONCE(skb->destructor);

We must call skb_orphan() to fix this issue.

Fixes: 6471658d ("udp: use skb_attempt_defer_free()")
Reported-by: default avatar <syzbot+3e68572cf2286ce5ebe9@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/netdev/695b83bd.050a0220.1c9965.002b.GAE@google.com/T/#u


Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260105093630.1976085-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 7801edc9

net/ipv4/udp.c

+1 −0
Original line number Diff line number Diff line
@@ -1851,6 +1851,7 @@ void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len) 
		sk_peek_offset_bwd(sk, len);



	if (!skb_shared(skb)) {

		skb_orphan(skb);

		skb_attempt_defer_free(skb);

		return;

	}