> From: Lorenzo Bianconi
> Date: Thu, 4 Apr 2019 16:37:53 +0200
>
> > ipip6 tunnels run iptunnel_pull_header on received skbs. This can
> > determine the following use-after-free accessing iph pointer since
> > the packet will be 'uncloned' running pskb_expand_head if it is a
> > cloned gso skb
From: Lorenzo Bianconi
Date: Thu, 4 Apr 2019 16:37:53 +0200
> ipip6 tunnels run iptunnel_pull_header on received skbs. This can
> determine the following use-after-free accessing iph pointer since
> the packet will be 'uncloned' running pskb_expand_head if it is a
> cloned gso skb (e.g if the pa
ipip6 tunnels run iptunnel_pull_header on received skbs. This can
determine the following use-after-free accessing iph pointer since
the packet will be 'uncloned' running pskb_expand_head if it is a
cloned gso skb (e.g if the packet has been sent though a veth device)
[ 706.369655] BUG: KASAN: us
