diff options
| author | Tejaswi Tanikella | 2017-10-23 08:16:03 +0200 |
|---|---|---|
| committer | Pablo Neira Ayuso | 2017-11-01 12:15:29 +0100 |
| commit | 7400bb4b5800831581a82f71700af6a5e815c3c8 (patch) | |
| tree | aabbc224b7f7d620573fd638431a26f0442eac59 /mm/swap_state.c | |
| parent | netfilter: nft_set_hash: disable fast_ops for 2-len keys (diff) | |
| download | kernel-qcow2-linux-7400bb4b5800831581a82f71700af6a5e815c3c8.tar.gz kernel-qcow2-linux-7400bb4b5800831581a82f71700af6a5e815c3c8.tar.xz kernel-qcow2-linux-7400bb4b5800831581a82f71700af6a5e815c3c8.zip | |
netfilter: nf_reject_ipv4: Fix use-after-free in send_reset
niph is not updated after pskb_expand_head changes the skb head. It
still points to the freed data, which is then used to update tot_len and
checksum. This could cause use-after-free poison crash.
Update niph, if ip_route_me_harder does not fail.
This only affects the interaction with REJECT targets and br_netfilter.
Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'mm/swap_state.c')
0 files changed, 0 insertions, 0 deletions