Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit f9f02cca authored by Patrick McHardy's avatar Patrick McHardy Committed by David S. Miller
Browse files

[NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments 



When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.

Signed-off-by: default avatarPatrick McHardy <kaber@trash.net>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 656829e2

net/ipv6/netfilter/nf_conntrack_reasm.c

+2 −0
Original line number Diff line number Diff line
@@ -835,6 +835,8 @@ void nf_ct_frag6_output(unsigned int hooknum, struct sk_buff *skb, 
		s->nfct_reasm = skb;



		s2 = s->next;

		s->next = NULL;



		NF_HOOK_THRESH(PF_INET6, hooknum, s, in, out, okfn,

			       NF_IP6_PRI_CONNTRACK_DEFRAG + 1);

		s = s2;