Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2e421bf4 authored by Eric Dumazet's avatar Eric Dumazet Committed by Greg Kroah-Hartman
Browse files

ipv6: fix possible use-after-free in ip6_xmit() 



[ Upstream commit bbd6528d28c1b8e80832b3b018ec402b6f5c3215 ]

In the unlikely case ip6_xmit() has to call skb_realloc_headroom(),
we need to call skb_set_owner_w() before consuming original skb,
otherwise we risk a use-after-free.

Bring IPv6 in line with what we do in IPv4 to fix this.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 3f0d9d15

net/ipv6/ip6_output.c

+2 −1
Original line number Diff line number Diff line
@@ -183,9 +183,10 @@ int ip6_xmit(struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, 
				kfree_skb(skb);

				return -ENOBUFS;

			}

			if (skb->sk)

				skb_set_owner_w(skb2, skb->sk);

			consume_skb(skb);

			skb = skb2;

			skb_set_owner_w(skb, sk);

		}

		if (opt->opt_flen)

			ipv6_push_frag_opts(skb, opt, &proto);