skb_release_head_state() inlines skb_orphan(). We need to clear skb->sk otherwise we can freeze TCP flows on a mostly idle host, because skb_fclone_busy() would return true as long as the packet is not yet processed by skb_defer_free_flush(). Fixes: 1fcf572211da ("net: allow skb_release_head_state() to be called multiple times") Fixes: e20dfbad8aab ("net: fix napi_consume_skb() with alien skbs") Signed-off-by: Eric Dumazet --- net/core/skbuff.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/core/skbuff.c b/net/core/skbuff.c index 4f4d7ab7057f16bcf88f29827a45a9f4a8f43d5c..f34372666e67cee5329d3ba1d3c86f8622facac3 100644 --- a/net/core/skbuff.c +++ b/net/core/skbuff.c @@ -1152,6 +1152,7 @@ void skb_release_head_state(struct sk_buff *skb) #endif skb->destructor = NULL; + skb->sk = NULL; } nf_reset_ct(skb); skb_ext_reset(skb); -- 2.52.0.rc1.455.g30608eb744-goog