https://github.com/torvalds/linux
Revision 747a713502e1dfdf0e93bc81ee0f5ec7510975e5 authored by Gao Feng on 23 November 2017, 03:47:12 UTC, committed by David S. Miller on 23 November 2017, 18:37:02 UTC
In the function ipvlan_get_L3_hdr, current codes use pskb_may_pull to
make sure the skb header has enough linear room for ipv6 header. But it
would use the latter memory directly without linear check when it is icmp.
So it still may access the unepxected memory in ipvlan_addr_lookup.

Now invoke the pskb_may_pull again if it is ipv6 icmp.

Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 5fc9220
Raw File
Tip revision: 747a713502e1dfdf0e93bc81ee0f5ec7510975e5 authored by Gao Feng on 23 November 2017, 03:47:12 UTC
ipvlan: Fix insufficient skb linear check for ipv6 icmp
Tip revision: 747a713
.cocciconfig
[spatch]
	options = --timeout 200
	options = --use-gitgrep
back to top