diff options
| author | Herbert Xu <herbert@gondor.apana.org.au> | 2018-12-20 16:20:10 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2018-12-21 03:31:36 +0300 |
| commit | d15f5ac8deea936d3adf629421a66a88b42b8a2f (patch) | |
| tree | 6c89a22e3a2f67a4a708c3e46ca97cdec686bfe3 | |
| parent | 8fd1a4affbdafda592f80cd01bf7a382a5ff2fe8 (diff) | |
| download | linux-d15f5ac8deea936d3adf629421a66a88b42b8a2f.tar.xz | |
ipv6: frags: Fix bogus skb->sk in reassembled packets
It was reported that IPsec would crash when it encounters an IPv6
reassembled packet because skb->sk is non-zero and not a valid
pointer.
This is because skb->sk is now a union with ip_defrag_offset.
This patch fixes this by resetting skb->sk when exiting from
the reassembly code.
Reported-by: Xiumei Mu <xmu@redhat.com>
Fixes: 219badfaade9 ("ipv6: frags: get rid of ip6frag_skb_cb/...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
| -rw-r--r-- | net/ipv6/reassembly.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index aa26c45486d9..a5bb59ee50ac 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -384,6 +384,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev, if (skb_try_coalesce(head, fp, &headstolen, &delta)) { kfree_skb_partial(fp, headstolen); } else { + fp->sk = NULL; if (!skb_shinfo(head)->frag_list) skb_shinfo(head)->frag_list = fp; head->data_len += fp->len; |