| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-Id: <1413624462-13106-1-git-send-email-roy.qing.li@gmail.com> Date: Sat, 18 Oct 2014 17:27:42 +0800 From: roy.qing.li@...il.com To: netdev@...r.kernel.org Subject: [PATCH] ipv6: fix a potential use after free in ip6_offload.c From: Li RongQing <roy.qing.li@...il.com> pskb_may_pull() maybe change skb->data and make opth pointer oboslete, so set the opth again Signed-off-by: Li RongQing <roy.qing.li@...il.com> --- net/ipv6/ip6_offload.c | 1 + 1 file changed, 1 insertion(+) diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c index 9034f76..91014d3 100644 --- a/net/ipv6/ip6_offload.c +++ b/net/ipv6/ip6_offload.c @@ -46,6 +46,7 @@ static int ipv6_gso_pull_exthdrs(struct sk_buff *skb, int proto) if (unlikely(!pskb_may_pull(skb, len))) break; + opth = (void *)skb->data; proto = opth->nexthdr; __skb_pull(skb, len); } -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists