ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()
commit21b995a9cb093fff33ec91d7cb3822b882a90a1e
authorEric Dumazet <edumazet@google.com>
Tue, 24 Jan 2017 00:43:05 +0000 (23 16:43 -0800)
committerDavid S. Miller <davem@davemloft.net>
Tue, 24 Jan 2017 19:53:24 +0000 (24 14:53 -0500)
treee7f434a5d9961bd65a461dffe8c7a010dd74ecca
parentd0fa28f00052391b5df328f502fbbdd4444938b7
ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()

Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(),
we must reload any pointer that was related to skb->head
(or skb->data), or risk use after free.

Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ip6_gre.c
net/ipv6/ip6_tunnel.c