ipv6: ip6_finish_output2: set sk into newly allocated nskb

[ Upstream commit 2d85a1b31dde84038ea07ad825c3d8d3e71f4344 ]

skb_set_owner_w() should set sk not to old skb but to new nskb.

Fixes: 5796015fa968 ("ipv6: allocate enough headroom in ip6_finish_output2()")
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Link: https://lore.kernel.org/r/70c0744f-89ae-1869-7e3e-4fa292158f4b@virtuozzo.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index f26ef5606d8af87ce576ea94a1bd17ccb25dc192..fc913f09606db374850d1b7d635fd6ff089dd30b 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -73,7 +73,7 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff *
 
                        if (likely(nskb)) {
                                if (skb->sk)
-                                       skb_set_owner_w(skb, skb->sk);
+                                       skb_set_owner_w(nskb, skb->sk);
                                consume_skb(skb);
                        } else {
                                kfree_skb(skb);