diff options
author | Patrick McHardy <kaber@trash.net> | 2007-01-09 17:32:41 -0500 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2007-01-09 17:32:41 -0500 |
commit | f9f02cca25acf33e5853c6b3cbb0c7146312783f (patch) | |
tree | 54bd83070a561f2c479196820e18cd097e9fcc40 | |
parent | 656829e2d052b1da4a72aa2ac39ad733a78530ce (diff) |
[NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments
When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r-- | net/ipv6/netfilter/nf_conntrack_reasm.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/ipv6/netfilter/nf_conntrack_reasm.c b/net/ipv6/netfilter/nf_conntrack_reasm.c index 37e5fca923aa..d9c15402ba66 100644 --- a/net/ipv6/netfilter/nf_conntrack_reasm.c +++ b/net/ipv6/netfilter/nf_conntrack_reasm.c | |||
@@ -835,6 +835,8 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb, | |||
835 | s->nfct_reasm = skb; | 835 | s->nfct_reasm = skb; |
836 | 836 | ||
837 | s2 = s->next; | 837 | s2 = s->next; |
838 | s->next = NULL; | ||
839 | |||
838 | NF_HOOK_THRESH(PF_INET6, hooknum, s, in, out, okfn, | 840 | NF_HOOK_THRESH(PF_INET6, hooknum, s, in, out, okfn, |
839 | NF_IP6_PRI_CONNTRACK_DEFRAG + 1); | 841 | NF_IP6_PRI_CONNTRACK_DEFRAG + 1); |
840 | s = s2; | 842 | s = s2; |