| commit | a7fe4e5d06338e1a82b1977eca37400951f99730 | |
| author | Eric Dumazet <edumazet@google.com> | |
| Tue, 24 Jan 2017 00:43:06 +0000 (23 16:43 -0800) | ||
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| Sat, 18 Feb 2017 14:11:41 +0000 (18 15:11 +0100) | ||
| tree | 65f31a7c27d60e1611b8451737c9cde1ba24ec9d | treesnapshot (tar.gz zip) |
| parent | 6c8556f6e11441c52f9593381c8be50f922f911f | commitdiff |
ipv6: fix ip6_tnl_parse_tlv_enc_lim()
[ Upstream commit fbfa743a9d2a0ffa24251764f10afc13eb21e739 ]
This function suffers from multiple issues.
First one is that pskb_may_pull() may reallocate skb->head,
so the 'raw' pointer needs either to be reloaded or not used at all.
Second issue is that NEXTHDR_DEST handling does not validate
that the options are present in skb->data, so we might read
garbage or access non existent memory.
With help from Willem de Bruijn.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
[ Upstream commit fbfa743a9d2a0ffa24251764f10afc13eb21e739 ]
This function suffers from multiple issues.
First one is that pskb_may_pull() may reallocate skb->head,
so the 'raw' pointer needs either to be reloaded or not used at all.
Second issue is that NEXTHDR_DEST handling does not validate
that the options are present in skb->data, so we might read
garbage or access non existent memory.
With help from Willem de Bruijn.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
| net/ipv6/ip6_tunnel.c | diffblobblamehistory |