[lkml]   [2007]   [Feb]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[patch 07/59] NETFILTER: nf_conntrack_ipv6: fix crash when handling fragments
-stable review patch.  If anyone has any objections, please let us know.
From: Patrick McHardy <>

When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.

Signed-off-by: Patrick McHardy <>
Signed-off-by: Chris Wright <>
net/ipv6/netfilter/nf_conntrack_reasm.c | 2 ++
1 file changed, 2 insertions(+)
--- linux-
+++ linux-
@@ -835,6 +835,8 @@ void nf_ct_frag6_output(unsigned int hoo
s->nfct_reasm = skb;

s2 = s->next;
+ s->next = NULL;
NF_HOOK_THRESH(PF_INET6, hooknum, s, in, out, okfn,
s = s2;
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to
More majordomo info at
Please read the FAQ at

 \ /
  Last update: 2007-02-03 03:57    [from the cache]
©2003-2014 Jasper Spaans. hosted at Digital Ocean