Lorenzo Bianconi 2a3cabae45 net: ip6_gre: fix possible use-after-free in ip6erspan_rcv
erspan_v6 tunnels run __iptunnel_pull_header on received skbs to remove
erspan header. This can determine a possible use-after-free accessing
pkt_md pointer in ip6erspan_rcv since the packet will be 'uncloned'
running pskb_expand_head if it is a cloned gso skb (e.g if the packet has
been sent though a veth device). Fix it resetting pkt_md pointer after
__iptunnel_pull_header

Fixes: 1d7e2ed22f8d ("net: erspan: refactor existing erspan code")
Signed-off-by: Lorenzo Bianconi <lorenzo.bianconi@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-04-08 16:16:47 -07:00
..
2019-01-23 11:18:00 -08:00
2018-11-10 16:55:11 -08:00
2018-10-22 19:59:20 -07:00
2019-03-19 16:00:22 -07:00
2019-01-27 10:38:04 -08:00
2019-02-21 16:23:56 -08:00
2019-03-08 14:48:40 -08:00
2018-07-24 14:10:42 -07:00
2019-03-11 15:40:14 -07:00
2019-03-16 01:27:51 +01:00
2019-03-15 15:29:47 -07:00