tree fbf40c24c669b40f6a8bf029f7a643c84d976426
parent 7fdc81f6e1a9b3f520e40cfc4ebccc94858da62d
author Eric Dumazet <edumazet@google.com> 1485218585 -0800
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1499258423 +0200

ip6_tunnel: must reload ipv6h in ip6ip6_tnl_xmit()


[ Upstream commit 21b995a9cb093fff33ec91d7cb3822b882a90a1e ]

Since ip6_tnl_parse_tlv_enc_lim() can call pskb_may_pull(),
we must reload any pointer that was related to skb->head
(or skb->data), or risk use after free.

Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Kozlov <xeb@mail.ru>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>