diff options
| author | Tristan Madani <tristan@talencesecurity.com> | 2026-10-23 19:53:09 +0000 |
|---|---|---|
| committer | Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb> | 2026-10-28 09:52:22 +0000 |
| commit | 1e860f42f41c6fbf3304f6a52be38245b9394982 (patch) | |
| tree | cac0dbf2dca5261632f604aee9679fc761cc9f08 /scripts/basic | |
| parent | d6f81fd6abe209f9803d8f74ce9ec69b8126bad3 (diff) | |
ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek
ppp_ccp_peek() caches a pointer to skb->data in dp after the first
pskb_may_pull(), then uses dp after a second pskb_may_pull(skb, len + 2)
in the CCP_CONFACK handler. If the second pull triggers
pskb_expand_head() due to a cloned skb or frag linearization,
skb->head is freed and reallocated, leaving dp stale.
The stale dp is subsequently used in CCP_OPT_LENGTH() and passed to
decomp_init()/comp_init() which read from the freed memory.
Re-derive dp from skb->data after the second pskb_may_pull.
Fixes: 1da177e4c3f41 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Signed-off-by: Dave Miller <davem@davem-thinkpadp1gen8.ibmlond.csb>
Diffstat (limited to 'scripts/basic')
0 files changed, 0 insertions, 0 deletions