projects / linux.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: efedce3) | patch
xfrm Fix use after free in __xfrm6_udp_encap_rcv.
authorSteffen Klassert <steffen.klassert@secunet.com>
Fri, 20 Oct 2023 08:05:55 +0000 (10:05 +0200)
committerSteffen Klassert <steffen.klassert@secunet.com>
Mon, 23 Oct 2023 05:10:39 +0000 (07:10 +0200)
commit53a5b4f2ea858482a427878bca988a7fa9b2ebdc
tree71c0b126d64e2ef18f89796fdc56776d1f704f17tree | snapshot
parentefedce336d71e238fbbada0f54b2bff9bf0509e9commit | diff
xfrm Fix use after free in __xfrm6_udp_encap_rcv.

A recent patch changed xfrm6_udp_encap_rcv to not
free the skb itself anymore but fogot the case
where xfrm4_udp_encap_rcv is called subsequently.

Fix this by moving the call to xfrm4_udp_encap_rcv
from __xfrm6_udp_encap_rcv to xfrm6_udp_encap_rcv.

Fixes: 221ddb723d90 ("xfrm: Support GRO for IPv6 ESP in UDP encapsulation")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
net/ipv4/xfrm4_input.c diff | blob | history
net/ipv6/xfrm6_input.c diff | blob | history
ep93xx device tree rework repo: git://git.maquefel.me/linux.git