ipv6: fix possible use-after-free in ip6_xmit()
[ Upstream commitpull/10/headbbd6528d28
] In the unlikely case ip6_xmit() has to call skb_realloc_headroom(), we need to call skb_set_owner_w() before consuming original skb, otherwise we risk a use-after-free. Bring IPv6 in line with what we do in IPv4 to fix this. Fixes:1da177e4c3
("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
13a47054f0
commit
bba90d3686
|
@ -219,12 +219,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
|
||||||
kfree_skb(skb);
|
kfree_skb(skb);
|
||||||
return -ENOBUFS;
|
return -ENOBUFS;
|
||||||
}
|
}
|
||||||
|
if (skb->sk)
|
||||||
|
skb_set_owner_w(skb2, skb->sk);
|
||||||
consume_skb(skb);
|
consume_skb(skb);
|
||||||
skb = skb2;
|
skb = skb2;
|
||||||
/* skb_set_owner_w() changes sk->sk_wmem_alloc atomically,
|
|
||||||
* it is safe to call in our context (socket lock not held)
|
|
||||||
*/
|
|
||||||
skb_set_owner_w(skb, (struct sock *)sk);
|
|
||||||
}
|
}
|
||||||
if (opt->opt_flen)
|
if (opt->opt_flen)
|
||||||
ipv6_push_frag_opts(skb, opt, &proto);
|
ipv6_push_frag_opts(skb, opt, &proto);
|
||||||
|
|
Loading…
Reference in New Issue