Unverified Commit 37a13bc5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11513 ipv6: prevent possible UAF in ip6_xmit() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Changzhong <zhangchangzhong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/GQEEI5KKC3IUUGR2TSBN3LXBPWVXD5IF/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAOXZA 
 
Link:https://gitee.com/openeuler/kernel/pulls/11513

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 13706c95 7406300a

net/ipv6/ip6_output.c

+4 −0
Original line number Diff line number Diff line
@@ -277,11 +277,15 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, 
		head_room += opt->opt_nflen + opt->opt_flen;



	if (unlikely(head_room > skb_headroom(skb))) {

		/* Make sure idev stays alive */

		rcu_read_lock();

		skb = skb_expand_head(skb, head_room);

		if (!skb) {

			IP6_INC_STATS(net, idev, IPSTATS_MIB_OUTDISCARDS);

			rcu_read_unlock();

			return -ENOBUFS;

		}

		rcu_read_unlock();

	}



	if (opt) {