Skip to content
Commit 230b889a authored by Shigeru Yoshida's avatar Shigeru Yoshida Committed by Zhengchao Shao
Browse files

ipv6: Fix potential uninit-value access in __ip6_make_skb()

mainline inclusion
from mainline-v6.9-rc7
commit 4e13d3a9c25b7080f8a619f961e943fe08c2672c
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9UAZH
CVE: CVE-2024-36903

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4e13d3a9c25b7080f8a619f961e943fe08c2672c



--------------------------------

As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in
__ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags
instead of testing HDRINCL on the socket to avoid a race condition which
causes uninit-value access.

Fixes: ea30388b ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()")
Signed-off-by: default avatarShigeru Yoshida <syoshida@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>

Conflicts:
	net/ipv6/ip6_output.c
[The conflict occurs because commit cafbe182("inet: move inet->hdrincl to
inet->inet_flags") is not merged]
Signed-off-by: default avatarZhengchao Shao <shaozhengchao@huawei.com>
parent 0a378cfa
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please to comment