]> git.proxmox.com Git - mirror_ubuntu-eoan-kernel.git/commit
net: ip6_gre: fix possible use-after-free in ip6erspan_rcv
authorLorenzo Bianconi <lorenzo.bianconi@redhat.com>
Sat, 6 Apr 2019 15:16:53 +0000 (17:16 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 8 Apr 2019 23:16:47 +0000 (16:16 -0700)
commit2a3cabae4536edbcb21d344e7aa8be7a584d2afb
tree00ed4848635bab7f9a56eabc75776e4b4b82b495
parent492b67e28ee5f2a2522fb72e3d3bcb990e461514
net: ip6_gre: fix possible use-after-free in ip6erspan_rcv

erspan_v6 tunnels run __iptunnel_pull_header on received skbs to remove
erspan header. This can determine a possible use-after-free accessing
pkt_md pointer in ip6erspan_rcv since the packet will be 'uncloned'
running pskb_expand_head if it is a cloned gso skb (e.g if the packet has
been sent though a veth device). Fix it resetting pkt_md pointer after
__iptunnel_pull_header

Fixes: 1d7e2ed22f8d ("net: erspan: refactor existing erspan code")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ip6_gre.c