]> git.baikalelectronics.ru Git - kernel.git/commit
projects / kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: d3be086) | patch
ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()
authorEric Dumazet <edumazet@google.com>
Tue, 24 Jan 2017 00:43:05 +0000 (16:43 -0800)
committerDavid S. Miller <davem@davemloft.net>
Tue, 24 Jan 2017 19:53:24 +0000 (14:53 -0500)
commit53cde0ffedb8cd5549ada0b1c3f7e8d39bafef9e
treee7f434a5d9961bd65a461dffe8c7a010dd74eccatree | snapshot
parentd3be086ded6ecaaf363d3448c24af1f8b39e49ffcommit | diff
ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()

Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(),
we must reload any pointer that was related to skb->head
(or skb->data), or risk use after free.

Fixes: 3d8fd70921d8 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ip6_gre.c diff | blob | history
net/ipv6/ip6_tunnel.c diff | blob | history
Linux Kernel Source Tree.