Unverified Commit 4b403c99 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11517 ipv6: fix possible UAF in ip6_finish_output2() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Changzhong <zhangchangzhong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/INYWIIE3JFOYUQHBQMCQNRKOU4IP5ARW/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAOXZO 
 
Link:https://gitee.com/openeuler/kernel/pulls/11517

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents 5a8c3ded b38233dd

net/ipv6/ip6_output.c

+4 −0
Original line number Diff line number Diff line
@@ -81,6 +81,8 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * 
			}

			skb = nskb;

		}

		/* Make sure idev stays alive */

		rcu_read_lock();

		if (skb &&

		    pskb_expand_head(skb, SKB_DATA_ALIGN(delta), 0, GFP_ATOMIC)) {

			kfree_skb(skb);
@@ -88,8 +90,10 @@ static int ip6_finish_output2(struct net *net, struct sock *sk, struct sk_buff * 
		}

		if (!skb) {

			IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTDISCARDS);

			rcu_read_unlock();

			return -ENOMEM;

		}

		rcu_read_unlock();

	}



	if (ipv6_addr_is_multicast(&ipv6_hdr(skb)->daddr)) {