skb_expand_head() adjust skb->truesize incorrectly

mainline inclusion
from mainline-v5.15
commit 7f678def
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9HVTH
CVE: CVE-2024-26921

--------------------------------

Christoph Paasch reports [1] about incorrect skb->truesize
after skb_expand_head() call in ip6_xmit.
This may happen because of two reasons:
- skb_set_owner_w() for newly cloned skb is called too early,
before pskb_expand_head() where truesize is adjusted for (!skb-sk) case.
- pskb_expand_head() does not adjust truesize in (skb->sk) case.
In this case sk->sk_wmem_alloc should be adjusted too.

[1] https://lkml.org/lkml/2021/8/20/1082



Fixes: f1260ff1 ("skbuff: introduce skb_expand_head()")
Fixes: 2d85a1b3 ("ipv6: ip6_finish_output2: set sk into newly allocated nskb")
Reported-by: Christoph Paasch <christoph.paasch@gmail.com>
Signed-off-by: Vasily Averin <vvs@virtuozzo.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://lore.kernel.org/r/644330dd-477e-0462-83bf-9f514c41edd1@virtuozzo.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Conflicts:
	net/core/skbuff.c
[The version does not include commit 7b7ed885 and commit 2544af03]
Signed-off-by: Ziyang Xuan <william.xuanziyang@huawei.com>