Commit 61792b67 authored by Florian Westphal's avatar Florian Westphal Committed by Pablo Neira Ayuso

netfilter: ipv6: fix oops when defragmenting locally generated fragments

Unlike ipv4 and normal ipv6 defrag, netfilter ipv6 defragmentation did
not save/restore skb->dst.

This causes oops when handling locally generated ipv6 fragments, as
output path needs a valid dst.
Reported-by: default avatarMaciej Żenczykowski <zenczykowski@gmail.com>
Fixes: 84379c9a ("netfilter: ipv6: nf_defrag: drop skb dst before queueing")
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarPablo Neira Ayuso <pablo@netfilter.org>
parent 4f3ebb04
...@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user) ...@@ -587,11 +587,16 @@ int nf_ct_frag6_gather(struct net *net, struct sk_buff *skb, u32 user)
*/ */
ret = -EINPROGRESS; ret = -EINPROGRESS;
if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
fq->q.meat == fq->q.len && fq->q.meat == fq->q.len) {
nf_ct_frag6_reasm(fq, skb, dev)) unsigned long orefdst = skb->_skb_refdst;
ret = 0;
else skb->_skb_refdst = 0UL;
if (nf_ct_frag6_reasm(fq, skb, dev))
ret = 0;
skb->_skb_refdst = orefdst;
} else {
skb_dst_drop(skb); skb_dst_drop(skb);
}
out_unlock: out_unlock:
spin_unlock_bh(&fq->q.lock); spin_unlock_bh(&fq->q.lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment