net: Fix skb_set_peeked use-after-free bug
net: Fix skb_set_peeked use-after-free bug

The commit 738ac1ebb96d02e0d23bc320302a6ea94c612dec ("net: Clone
skb before setting peeked flag") introduced a use-after-free bug
in skb_recv_datagram.  This is because skb_set_peeked may create
a new skb and free the existing one.  As it stands the caller will
continue to use the old freed skb.

This patch fixes it by making skb_set_peeked return the new skb
(or the old one if unchanged).

Fixes: 738ac1ebb96d ("net: Clone skb before setting peeked flag")
Reported-by: Brenden Blanco <8e41c261aa8ddb01230a40c21c26a049c1f6d041@plumgrid.com>
Signed-off-by: Herbert Xu <ef65de1c7be0aa837fe7b25ba9a7739905af6a55@gondor.apana.org.au>
Tested-by: Brenden Blanco <8e41c261aa8ddb01230a40c21c26a049c1f6d041@plumgrid.com>
Reviewed-by: Konstantin Khlebnikov <3b96b99f19643d33e1bfa1caa535c041c3608549@yandex-team.ru>
Signed-off-by: David S. Miller <fe08d3c717adf2ae63592e4c9aec6e3e404d8e3e@davemloft.net>

KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs,KristFoundation/Programs