| commit | 21b995a9cb093fff33ec91d7cb3822b882a90a1e | |
| author | Eric Dumazet <edumazet@google.com> | |
| Tue, 24 Jan 2017 00:43:05 +0000 (23 16:43 -0800) | ||
| committer | David S. Miller <davem@davemloft.net> | |
| Tue, 24 Jan 2017 19:53:24 +0000 (24 14:53 -0500) | ||
| tree | e7f434a5d9961bd65a461dffe8c7a010dd74ecca | treesnapshot (tar.gz zip) |
| parent | d0fa28f00052391b5df328f502fbbdd4444938b7 | commitdiff |
ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()
Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(),
we must reload any pointer that was related to skb->head
(or skb->data), or risk use after free.
Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(),
we must reload any pointer that was related to skb->head
(or skb->data), or risk use after free.
Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
| net/ipv6/ip6_gre.c | diffblobblamehistory | |
| net/ipv6/ip6_tunnel.c | diffblobblamehistory |