diff options
| author | Phil Oester <kernel@linuxace.com> | 2013-06-19 06:49:51 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-07-03 10:55:37 -0700 |
| commit | 491c1b809b64748ff579ae7efe4d1cd909463504 (patch) | |
| tree | bb088b1e614b82c149ca4cb09de100fa3bd28b49 /net | |
| parent | b1e1d6fc62a376b96170eee079d5560d1718bd55 (diff) | |
| download | linux-stable-491c1b809b64748ff579ae7efe4d1cd909463504.tar.gz linux-stable-491c1b809b64748ff579ae7efe4d1cd909463504.tar.bz2 linux-stable-491c1b809b64748ff579ae7efe4d1cd909463504.zip | |
netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling
commit 142dcdd3c25fc7a3866bb06980e8f93a2ed7e050 upstream.
In commit 4cdd3408 ("netfilter: nf_conntrack_ipv6: improve fragmentation
handling"), an sk_buff leak was introduced when dealing with reassembled
packets by grabbing a reference to the original skb instead of the
reassembled skb. At this point, the leak only impacted conntracks with an
associated helper.
In commit 58a317f1 ("netfilter: ipv6: add IPv6 NAT support"), the bug was
expanded to include all reassembled packets with unconfirmed conntracks.
Fix this by grabbing a reference to the proper reassembled skb. This
closes netfilter bugzilla #823.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c index 2b6c226f5198..a560ae0dd5ed 100644 --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c @@ -204,7 +204,7 @@ static unsigned int __ipv6_conntrack_in(struct net *net, if (ct != NULL && !nf_ct_is_untracked(ct)) { help = nfct_help(ct); if ((help && help->helper) || !nf_ct_is_confirmed(ct)) { - nf_conntrack_get_reasm(skb); + nf_conntrack_get_reasm(reasm); NF_HOOK_THRESH(NFPROTO_IPV6, hooknum, reasm, (struct net_device *)in, (struct net_device *)out, |