diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-05-05 13:00:56 +0000 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-05-06 17:29:23 -0700 |
| commit | 7aaa8f5e45a92678256c1e17f1fa2c2f45c61dd1 (patch) | |
| tree | a32967d41a88fefdc7f1694b3d5ed4b6f636dbc5 /scripts/dummy-tools/python3 | |
| parent | 0e1368a28dd5231ae0dbe240dfe0ff2657de5647 (diff) | |
ipv6: fix potential UAF caused by ip6_forward_proxy_check()
ip6_forward_proxy_check() calls pskb_may_pull() which might re-allocate
skb->head.
Reload ipv6_hdr() after the pskb_may_pull() call to avoid using
the freed memory.
Fixes: e21e0b5f19ac ("[IPV6] NDISC: Handle NDP messages to proxied addresses.")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: David Ahern <dsahern@kernel.org>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260505130056.2927197-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'scripts/dummy-tools/python3')
0 files changed, 0 insertions, 0 deletions