diff options
| author | Daniel Borkmann <dborkman@redhat.com> | 2013-09-03 19:29:12 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2013-09-04 14:44:41 -0400 |
| commit | 3a1c756590633c0e86df606e5c618c190926a0df (patch) | |
| tree | 970ceb0f62cb1e9df1d710b69387374a2be0fae5 /arch/m32r/kernel/signal.c | |
| parent | 25a6e6b84fba601eff7c28d30da8ad7cfbef0d43 (diff) | |
net: ipv6: tcp: fix potential use after free in tcp_v6_do_rcv
In tcp_v6_do_rcv() code, when processing pkt options, we soley work
on our skb clone opt_skb that we've created earlier before entering
tcp_rcv_established() on our way. However, only in condition ...
if (np->rxopt.bits.rxtclass)
np->rcv_tclass = ipv6_get_dsfield(ipv6_hdr(skb));
... we work on skb itself. As we extract every other information out
of opt_skb in ipv6_pktoptions path, this seems wrong, since skb can
already be released by tcp_rcv_established() earlier on. When we try
to access it in ipv6_hdr(), we will dereference freed skb.
[ Bug added by commit 4c507d2897bd9b ("net: implement IP_RECVTOS for
IP_PKTOPTIONS") ]
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch/m32r/kernel/signal.c')
0 files changed, 0 insertions, 0 deletions