> From: Lorenzo Bianconi <lorenzo.bianc...@redhat.com>
> Date: Thu, 4 Apr 2019 16:37:53 +0200
>
> > ipip6 tunnels run iptunnel_pull_header on received skbs. This can
> > determine the following use-after-free accessing iph pointer since
> > the packet will be 'uncloned' running pskb_expand_head if it is a
> > cloned gso skb (e.g if the packet has been sent though a veth device)
> ...
> > Fix it resetting iph pointer after iptunnel_pull_header
> >
> > Fixes: a09a4c8dd1ec ("tunnels: Remove encapsulation offloads on decap")
> > Tested-by: Jianlin Shi <ji...@redhat.com>
> > Signed-off-by: Lorenzo Bianconi <lorenzo.bianc...@redhat.com>
>
> Good catch, applied, thanks.
looking at the code it seems there is the same issue for erspan_v{4,6}.
I will post a fix soon.
Regards,
Lorenzo
signature.asc
Description: PGP signature
