Skip to contentSkip to conversation

Patch "ipv6: sr: fix double free of skb after handling invalid SRH" has been added to the 4.10-stable tree

PATCH [email protected] 1 participant 1 message Apr 29, 2017

Subsystems (3)
lore
Share & tools
lore

[email protected]

author maintainer Applied
#0 lore raw

This is a note to let you know that I've just added the patch titled

ipv6: sr: fix double free of skb after handling invalid SRH

to the 4.10-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
ipv6-sr-fix-double-free-of-skb-after-handling-invalid-srh.patch
and it can be found in the queue-4.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

Quoted 1 line

From foo@baz Sat Apr 29 08:22:40 CEST 2017

From: David Lebrun <[email protected]>
Date: Wed, 19 Apr 2017 16:10:19 +0200
Subject: ipv6: sr: fix double free of skb after handling invalid SRH

From: David Lebrun <[email protected]>

[ Upstream commit 95b9b88d2da5e43e025400afcb492643933bf858 ]

The icmpv6_param_prob() function already does a kfree_skb(), this patch removes the duplicate one.

Fixes 1ababeba4a21f3dba3da3523c670b207fb2feb62 ("ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)")
Cc Dan Carpenter <[email protected]>
---
 net/ipv6/exthdrs.c |    1 -
 1 file changed, 1 deletion(-)
net/ipv6/exthdrs.c +0 -1
@@ -388,7 +388,6 @@ looped_back:
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
 				  ((&hdr->segments_left) -
 				   skb_network_header(skb)));
-		kfree_skb(skb);
 		return -1;
 	}
 

Patches currently in stable-queue which might be from [email protected] are

queue-4.10/ipv6-sr-fix-double-free-of-skb-after-handling-invalid-srh.patch queue-4.10/ipv6-sr-fix-out-of-bounds-access-in-srh-validation.patch