From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:52502 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752479AbdGCL2f (ORCPT ); Mon, 3 Jul 2017 07:28:35 -0400 Subject: Patch "ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()" has been added to the 4.9-stable tree To: edumazet@google.com, alexander.levin@verizon.com, davem@davemloft.net, gregkh@linuxfoundation.org, xeb@mail.ru Cc: , From: Date: Mon, 03 Jul 2017 13:28:27 +0200 Message-ID: <149908130714620@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit() to the 4.9-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: ip6_tunnel-must-reload-ipv6h-in-ip6ip6_tnl_xmit.patch and it can be found in the queue-4.9 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Mon Jul 3 13:22:04 CEST 2017 From: Eric Dumazet Date: Mon, 23 Jan 2017 16:43:05 -0800 Subject: ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit() From: Eric Dumazet [ Upstream commit 21b995a9cb093fff33ec91d7cb3822b882a90a1e ] Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(), we must reload any pointer that was related to skb->head (or skb->data), or risk use after free. Fixes: c12b395a4664 ("gre: Support GRE over IPv6") Signed-off-by: Eric Dumazet Cc: Dmitry Kozlov Signed-off-by: David S. Miller Signed-off-by: Sasha Levin Signed-off-by: Greg Kroah-Hartman --- net/ipv6/ip6_gre.c | 3 +++ net/ipv6/ip6_tunnel.c | 2 ++ 2 files changed, 5 insertions(+) --- a/net/ipv6/ip6_gre.c +++ b/net/ipv6/ip6_gre.c @@ -582,6 +582,9 @@ static inline int ip6gre_xmit_ipv6(struc return -1; offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb)); + /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */ + ipv6h = ipv6_hdr(skb); + if (offset > 0) { struct ipv6_tlv_tnl_enc_lim *tel; tel = (struct ipv6_tlv_tnl_enc_lim *)&skb_network_header(skb)[offset]; --- a/net/ipv6/ip6_tunnel.c +++ b/net/ipv6/ip6_tunnel.c @@ -1313,6 +1313,8 @@ ip6ip6_tnl_xmit(struct sk_buff *skb, str fl6.flowlabel = key->label; } else { offset = ip6_tnl_parse_tlv_enc_lim(skb, skb_network_header(skb)); + /* ip6_tnl_parse_tlv_enc_lim() might have reallocated skb->head */ + ipv6h = ipv6_hdr(skb); if (offset > 0) { struct ipv6_tlv_tnl_enc_lim *tel; Patches currently in stable-queue which might be from edumazet@google.com are queue-4.9/ip6_tunnel-must-reload-ipv6h-in-ip6ip6_tnl_xmit.patch queue-4.9/gianfar-do-not-reuse-pages-from-emergency-reserve.patch queue-4.9/fix-an-intermittent-pr_emerg-warning-about-lo-becoming-free.patch queue-4.9/netfilter-xt_tcpmss-add-more-sanity-tests-on-tcph-doff.patch queue-4.9/ipv6-release-dst-on-error-in-ip6_dst_lookup_tail.patch queue-4.9/igmp-acquire-pmc-lock-for-ip_mc_clear_src.patch