From: Mathieu Xhonneux <[email protected]>
Date: Fri, 25 May 2018 13:29:41 +0100
> seg6_do_srh_encap and seg6_do_srh_inline can possibly do an
> out-of-bounds access when adding the SRH to the packet. This no longer
> happen when expanding the skb not only by the size of the SRH (+
> outer IPv6 header), but also by skb->mac_len.
...
> Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and
> injection with lwtunnels")
> Signed-off-by: David Lebrun <[email protected]>
> Signed-off-by: Mathieu Xhonneux <[email protected]>
Applied and queued up for -stable.
