ipv6: Fix potential uninit-value access in __ip6_make_skb()
mainline inclusion from mainline-v6.9-rc7 commit 4e13d3a9c25b7080f8a619f961e943fe08c2672c category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9UAZH CVE: CVE-2024-36903 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4e13d3a9c25b7080f8a619f961e943fe08c2672c -------------------------------- As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in __ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags instead of testing HDRINCL on the socket to avoid a race condition which causes uninit-value access. Fixes: ea30388b ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()") Signed-off-by:Shigeru Yoshida <syoshida@redhat.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Conflicts: net/ipv6/ip6_output.c [The conflict occurs because commit cafbe182("inet: move inet->hdrincl to inet->inet_flags") is not merged] Signed-off-by:
Zhengchao Shao <shaozhengchao@huawei.com>
Loading
Please sign in to comment