diff options
| author | Florian Westphal <fw@strlen.de> | 2020-03-30 19:51:29 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-03-30 20:41:58 +0300 |
| commit | cf673ed0e057a2dd68d930c6d7e30d53c70c5789 (patch) | |
| tree | e34bc055bc67c8fe53789f50b6b17ff1004b02ee /net/rfkill | |
| parent | bde1b56f898ca8112912d7b36e55e1543b3be0cf (diff) | |
| download | linux-cf673ed0e057a2dd68d930c6d7e30d53c70c5789.tar.xz | |
net: fix fraglist segmentation reference count leak
Xin Long says:
On udp rx path udp_rcv_segment() may do segment where the frag skbs
will get the header copied from the head skb in skb_segment_list()
by calling __copy_skb_header(), which could overwrite the frag skbs'
extensions by __skb_ext_copy() and cause a leak.
This issue was found after loading esp_offload where a sec path ext
is set in the skb.
Fix this by discarding head state of the fraglist skb before replacing
its contents.
Fixes: 3a1296a38d0cf62 ("net: Support GRO/GSO fraglist chaining.")
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Reported-by: Xiumei Mu <xmu@redhat.com>
Tested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/rfkill')
0 files changed, 0 insertions, 0 deletions