Re: [PATCH net 1/1] inet: frags: orphan non-wmem skbs before building frag_list

From: Zixuan Chai <redacted>

When a fragment skb cannot be coalesced, reassembly clears skb->sk
before linking it to frag_list. If the skb still has a non-wmem
destructor, the callback remains installed and may dereference the
cleared socket when the skb is freed, causing a NULL pointer
dereference.

Orphan non-wmem skbs that have a destructor before adding them to
frag_list. Keep the existing skb->sk clearing for skbs without a
destructor and for wmem skbs, preserving TX accounting.

Fixes: d15f5ac8deea ("ipv6: frags: Fix bogus skb->sk in reassembled packets")
Cc: <redacted>
Reported-by: Vega <redacted>
Assisted-by: LLM
Signed-off-by: Zixuan Chai <redacted>
Signed-off-by: Ren Wei <redacted>
---
 net/ipv4/inet_fragment.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/inet_fragment.c b/net/ipv4/inet_fragment.c
index b286ee429da8..cc6718f579fa 100644
--- a/net/ipv4/inet_fragment.c
+++ b/net/ipv4/inet_fragment.c

@@ -652,7 +652,10 @@ void inet_frag_reasm_finish(struct inet_frag_queue *q, struct sk_buff *head,
                        } else {
                                fp->prev = NULL;
                                memset(&fp->rbnode, 0, sizeof(fp->rbnode));
-                               fp->sk = NULL;
+                               if (fp->destructor && !is_skb_wmem(fp))
+                                       skb_orphan(fp);
+                               else
+                                       fp->sk = NULL;