diff options
| author | Steffen Klassert <steffen.klassert@secunet.com> | 2023-10-20 10:05:55 +0200 |
|---|---|---|
| committer | Steffen Klassert <steffen.klassert@secunet.com> | 2023-10-23 07:10:39 +0200 |
| commit | 53a5b4f2ea858482a427878bca988a7fa9b2ebdc (patch) | |
| tree | 71c0b126d64e2ef18f89796fdc56776d1f704f17 /net/ipv4 | |
| parent | efedce336d71e238fbbada0f54b2bff9bf0509e9 (diff) | |
xfrm Fix use after free in __xfrm6_udp_encap_rcv.
A recent patch changed xfrm6_udp_encap_rcv to not
free the skb itself anymore but fogot the case
where xfrm4_udp_encap_rcv is called subsequently.
Fix this by moving the call to xfrm4_udp_encap_rcv
from __xfrm6_udp_encap_rcv to xfrm6_udp_encap_rcv.
Fixes: 221ddb723d90 ("xfrm: Support GRO for IPv6 ESP in UDP encapsulation")
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Diffstat (limited to 'net/ipv4')
| -rw-r--r-- | net/ipv4/xfrm4_input.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/net/ipv4/xfrm4_input.c b/net/ipv4/xfrm4_input.c index 42879c5e026a..c54676998eb6 100644 --- a/net/ipv4/xfrm4_input.c +++ b/net/ipv4/xfrm4_input.c @@ -159,7 +159,6 @@ static int __xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb, bool pull /* process ESP */ return 0; } -EXPORT_SYMBOL(xfrm4_udp_encap_rcv); /* If it's a keepalive packet, then just eat it. * If it's an encapsulated packet, then pass it to the @@ -184,6 +183,7 @@ int xfrm4_udp_encap_rcv(struct sock *sk, struct sk_buff *skb) return ret; } +EXPORT_SYMBOL(xfrm4_udp_encap_rcv); struct sk_buff *xfrm4_gro_udp_encap_rcv(struct sock *sk, struct list_head *head, struct sk_buff *skb) @@ -223,6 +223,7 @@ out: return NULL; } +EXPORT_SYMBOL(xfrm4_gro_udp_encap_rcv); int xfrm4_rcv(struct sk_buff *skb) { |