Re: [PATCH net] udp: preserve skb->dst if required for IP options processing

On Mon, 2017-07-17 at 22:59 +0200, Paolo Abeni wrote:

Eric noticed that in udp_recvmsg() we still need to access
skb->dst while processing the IP options.
Since commit 0a463c78d25b ("udp: avoid a cache miss on dequeue")
skb->dst is no more available at recvmsg() time and bad things
will happen if we enter the relevant code path.

This commit address the issue, avoid clearing skb->dst if
any IP options are present into the relevant skb.
Since the IP CB is contained in the first skb cacheline, we can
test it to decide to leverage the consume_stateless_skb()
optimization, without measurable additional cost in the faster
path.

Also the problem was not skb->dst at all, but fact that 
skb->head can not be freed if IP options need later to be fetched.

( __ip_options_echo() -> 
   sptr = skb_network_header(skb);

... -> use after free