ip_gre: fix possible use after free
Once skb_realloc_headroom() is called, tiph might point to freed memory. Cache tiph->ttl value before the reallocation, to avoid unexpected behavior. Signed-off-by:Eric Dumazet <edumazet@google.com> Cc: Isaku Yamahata <yamahata@valinux.co.jp> Signed-off-by:
David S. Miller <davem@davemloft.net>
parent
412ed947
Please register or sign in to comment