diff options
| author |   Eric Dumazet <edumazet@google.com> | 2026-05-25 20:13:35 +0000 |
|---|---|---|
| committer |   Jakub Kicinski <kuba@kernel.org> | 2026-05-26 18:10:25 -0700 |
| commit | b4bc94353050b1fa7b702bd4c6600710dd926cff (patch) | |
| tree | 733ca2ad2496f37626eda800456268b2067cfc5a /include/linux/bcma/ssh:/git@git.zx2c4.com | |
| parent | net: phy: air_en8811h: add AN8811HB MCU assert/deassert support (diff) | |
tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]()
Sashiko found that iptunnel_pmtud_build_icmp() and
iptunnel_pmtud_build_icmpv6() were caching ip_hdr() and ipv6_hdr()
before an skb_cow() call which can reallocate skb->head.
Fix this possible UAF by initializing the local variables
after the skb_cow() call.
Remove skb_reset_network_header() calls which were not needed.
Fixes: 4cb47a8644cc ("tunnels: PMTU discovery support for directly bridged IP packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Stefano Brivio <sbrivio@redhat.com>
Link: https://patch.msgid.link/20260525201335.2361845-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'include/linux/bcma/ssh:/git@git.zx2c4.com')
0 files changed, 0 insertions, 0 deletions