diff options
| author | Willem de Bruijn | 2019-01-07 22:47:33 +0100 |
|---|---|---|
| committer | David S. Miller | 2019-01-10 15:27:20 +0100 |
| commit | 4a06fa67c4da20148803525151845276cdb995c1 (patch) | |
| tree | fce2609c8420b949997d123cec8aacd178a0cd1d /drivers/net/LICENSE.SRC | |
| parent | tun: publish tfile after it's fully initialized (diff) | |
| download | kernel-qcow2-linux-4a06fa67c4da20148803525151845276cdb995c1.tar.gz kernel-qcow2-linux-4a06fa67c4da20148803525151845276cdb995c1.tar.xz kernel-qcow2-linux-4a06fa67c4da20148803525151845276cdb995c1.zip | |
ip: on queued skb use skb_header_pointer instead of pskb_may_pull
Commit 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call
pskb_may_pull") avoided a read beyond the end of the skb linear
segment by calling pskb_may_pull.
That function can trigger a BUG_ON in pskb_expand_head if the skb is
shared, which it is when when peeking. It can also return ENOMEM.
Avoid both by switching to safer skb_header_pointer.
Fixes: 2efd4fca703a ("ip: in cmsg IP(V6)_ORIGDSTADDR call pskb_may_pull")
Reported-by: syzbot <syzkaller@googlegroups.com>
Suggested-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/LICENSE.SRC')
0 files changed, 0 insertions, 0 deletions