diff options
| author |   Patrick McHardy <kaber@trash.net> | 2007-01-09 14:32:41 -0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2007-01-09 14:32:41 -0800 |
| commit | f9f02cca25acf33e5853c6b3cbb0c7146312783f (patch) | |
| tree | 54bd83070a561f2c479196820e18cd097e9fcc40 /scripts/basic | |
| parent | Merge branch 'linus' of master.kernel.org:/pub/scm/linux/kernel/git/perex/alsa (diff) | |
[NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments
When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'scripts/basic')
0 files changed, 0 insertions, 0 deletions