Florian Westphal 79e49503ef ipv6: avoid write to a possibly cloned skb ... ip6_fragment, in case skb has a fraglist, checks if the skb is cloned. If it is, it will move to the 'slow path' and allocates new skbs for each fragment. However, right before entering the slowpath loop, it updates the nexthdr value of the last ipv6 extension header to NEXTHDR_FRAGMENT, to account for the fragment header that will be inserted in the new ipv6-fragment skbs. In case original skb is cloned this munges nexthdr value of another skb. Avoid this by doing the nexthdr update for each of the new fragment skbs separately. This was observed with tcpdump on a bridge device where netfilter ipv6 reassembly is active: tcpdump shows malformed fragment headers as the l4 header (icmpv6, tcp, etc). is decoded as a fragment header. Cc: Hannes Frederic Sowa <hannes@stressinduktion.org> Reported-by: Andreas Karis <akaris@redhat.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-03-13 12:53:35 -07:00
..
ila
netfilter
addrconf_core.c
addrconf.c
addrlabel.c
af_inet6.c
ah6.c
anycast.c
calipso.c
datagram.c
esp6_offload.c
esp6.c
exthdrs_core.c
exthdrs_offload.c
exthdrs.c
fib6_rules.c
fou6.c
icmp.c
inet6_connection_sock.c
inet6_hashtables.c
ip6_checksum.c
ip6_fib.c	ipv6: make ECMP route replacement less greedy	2017-03-13 12:16:17 -07:00
ip6_flowlabel.c
ip6_gre.c
ip6_icmp.c
ip6_input.c
ip6_offload.c	net/tunnel: set inner protocol in network gro hooks	2017-03-09 13:19:52 -08:00
ip6_offload.h
ip6_output.c	ipv6: avoid write to a possibly cloned skb	2017-03-13 12:53:35 -07:00
ip6_tunnel.c
ip6_udp_tunnel.c
ip6_vti.c
ip6mr.c
ipcomp6.c
ipv6_sockglue.c
Kconfig
Makefile
mcast_snoop.c
mcast.c
mip6.c
ndisc.c
netfilter.c
output_core.c
ping.c
proc.c
protocol.c
raw.c
reassembly.c
route.c	net: ipv6: Remove redundant RTA_OIF in multipath routes	2017-03-09 13:04:48 -08:00
seg6_hmac.c
seg6_iptunnel.c
seg6.c
sit.c
syncookies.c
sysctl_net_ipv6.c
tcp_ipv6.c
tcpv6_offload.c
tunnel6.c
udp_impl.h
udp_offload.c
udp.c
udplite.c
xfrm6_input.c
xfrm6_mode_beet.c
xfrm6_mode_ro.c
xfrm6_mode_transport.c
xfrm6_mode_tunnel.c
xfrm6_output.c
xfrm6_policy.c
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c