Commit fc6fb41c authored by Li RongQing's avatar Li RongQing Committed by David S. Miller

ipv6: fix a potential use after free in ip6_offload.c

pskb_may_pull() maybe change skb->data and make opth pointer oboslete,
so set the opth again
Signed-off-by: default avatarLi RongQing <roy.qing.li@gmail.com>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent b4e3cef7
...@@ -46,6 +46,7 @@ static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto) ...@@ -46,6 +46,7 @@ static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto)
if (unlikely(!pskb_may_pull(skb, len))) if (unlikely(!pskb_may_pull(skb, len)))
break; break;
opth = (void *)skb->data;
proto = opth->nexthdr; proto = opth->nexthdr;
__skb_pull(skb, len); __skb_pull(skb, len);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment