p71924506
/
linux_old1
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

ipv6: frags: Fix bogus skb->sk in reassembled packets 

It was reported that IPsec would crash when it encounters an IPv6
reassembled packet because skb->sk is non-zero and not a valid
pointer.

This is because skb->sk is now a union with ip_defrag_offset.

This patch fixes this by resetting skb->sk when exiting from
the reassembly code.

Reported-by: Xiumei Mu <xmu@redhat.com>
Fixes: 219badfaad ("ipv6: frags: get rid of ip6frag_skb_cb/...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Herbert Xu 2018-12-20 21:20:10 +08:00 committed by David S. Miller
parent 8fd1a4affb
commit d15f5ac8de
1 changed files with 1 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
net/ipv6/reassembly.c
View File

@ -384,6 +384,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
if (skb_try_coalesce(head, fp, &headstolen, &delta)) { if (skb_try_coalesce(head, fp, &headstolen, &delta)) {
kfree_skb_partial(fp, headstolen); kfree_skb_partial(fp, headstolen);
} else { } else {
fp->sk = NULL;
if (!skb_shinfo(head)->frag_list) if (!skb_shinfo(head)->frag_list)
skb_shinfo(head)->frag_list = fp; skb_shinfo(head)->frag_list = fp;
head->data_len += fp->len; head->data_len += fp->len;