diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2018-12-20 16:20:10 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2019-01-09 19:38:35 +0300 |
| commit | 5ac4cc331bca6c759460fc948d19906f4f7f5831 (patch) | |
| tree | 127f9ed5f039b55c990dce00d35e672e47c0d52e /net/ipv6 | |
| parent | 9ed77be31e9564381d5b5329d1a529cccd219a94 (diff) | |
| download | linux-5ac4cc331bca6c759460fc948d19906f4f7f5831.tar.xz | |
ipv6: frags: Fix bogus skb->sk in reassembled packets
[ Upstream commit d15f5ac8deea936d3adf629421a66a88b42b8a2f ]
It was reported that IPsec would crash when it encounters an IPv6
reassembled packet because skb->sk is non-zero and not a valid
pointer.
This is because skb->sk is now a union with ip_defrag_offset.
This patch fixes this by resetting skb->sk when exiting from
the reassembly code.
Reported-by: Xiumei Mu <xmu@redhat.com>
Fixes: 219badfaade9 ("ipv6: frags: get rid of ip6frag_skb_cb/...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/reassembly.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index d3fd2d7e5aa4..7c943392c128 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -384,6 +384,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, if (skb_try_coalesce(head, fp, &headstolen, &delta)) { kfree_skb_partial(fp, headstolen); } else { + fp->sk = NULL; if (!skb_shinfo(head)->frag_list) skb_shinfo(head)->frag_list = fp; head->data_len += fp->len; |