ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()

Browse source

[ Upstream commit 21b995a9cb ]

Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(),
we must reload any pointer that was related to skb->head
(or skb->data), or risk use after free.

Fixes: c12b395a46 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

...

This commit is contained in:

Eric Dumazet 2017-01-23 16:43:05 -08:00 • committed by Greg Kroah-Hartman

parent 7fdc81f6e1

commit b07bf23646

2 changed files with 5 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

3

net/ipv6/ip6_gre.c

View file

2

net/ipv6/ip6_tunnel.c

View file