diff options
| author | Patrick McHardy <kaber@trash.net> | 2007-03-24 21:22:33 +0100 |
|---|---|---|
| committer | Adrian Bunk <bunk@stusta.de> | 2007-03-24 21:22:33 +0100 |
| commit | fbe2454a0d10bdbf27680d4bfc93cf0293bc6a6e (patch) | |
| tree | 4811b3452b977969bba49a62f8f8b953d68e3143 /fs/attr.c | |
| parent | ae686b6a075bc8a95e8b4cda3f3eb4e8d5ac270c (diff) | |
NETFILTER: nf_conntrack_ipv6: fix crash when handling fragments
When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.
Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: Adrian Bunk <bunk@stusta.de>
Diffstat (limited to 'fs/attr.c')
0 files changed, 0 insertions, 0 deletions