]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
projects / thirdparty / kernel / stable.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: d0fa28f) | patch
ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()
authorEric Dumazet <edumazet@google.com>
Tue, 24 Jan 2017 00:43:05 +0000 (16:43 -0800)
committerDavid S. Miller <davem@davemloft.net>
Tue, 24 Jan 2017 19:53:24 +0000 (14:53 -0500)
commit21b995a9cb093fff33ec91d7cb3822b882a90a1e
treee7f434a5d9961bd65a461dffe8c7a010dd74eccatree | snapshot
parentd0fa28f00052391b5df328f502fbbdd4444938b7commit | diff
ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()

Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(),
we must reload any pointer that was related to skb->head
(or skb->data), or risk use after free.

Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ip6_gre.c diff | blob | blame | history
net/ipv6/ip6_tunnel.c diff | blob | blame | history
Mirror https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git