Re: [PATCH net] ipv6: fix possible use-after-free in ip6_xmit()

2018-09-17 Thread David Miller
From: Eric Dumazet Date: Fri, 14 Sep 2018 12:02:31 -0700 > In the unlikely case ip6_xmit() has to call skb_realloc_headroom(), > we need to call skb_set_owner_w() before consuming original skb, > otherwise we risk a use-after-free. > > Bring IPv6 in line with what we do in IPv4 to fix this. > >

[PATCH net] ipv6: fix possible use-after-free in ip6_xmit()

2018-09-14 Thread Eric Dumazet
In the unlikely case ip6_xmit() has to call skb_realloc_headroom(), we need to call skb_set_owner_w() before consuming original skb, otherwise we risk a use-after-free. Bring IPv6 in line with what we do in IPv4 to fix this. Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet R