| commit | c1e8b113af91786cba47b948dd470d8381972175 | |
| author | Patrick McHardy <kaber@trash.net> | |
| Wed, 10 Jan 2007 07:04:47 +0000 (10 08:04 +0100) | ||
| committer | Chris Wright <chrisw@sous-sol.org> | |
| Mon, 5 Feb 2007 16:31:40 +0000 (5 08:31 -0800) | ||
| tree | ce86c8e92ba615e07e600f7cb82bce4f6428f500 | treesnapshot (tar.gz zip) |
| parent | 8c10ebbf6838583183d2846b7d61742704b8b055 | commitdiff |
[PATCH] NETFILTER: nf_conntrack_ipv6: fix crash when handling fragments
When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
| net/ipv6/netfilter/nf_conntrack_reasm.c | diffblobblamehistory |