| commit | f7e75ba1772bc712af0070655ffd8b09906993b5 | [log] [tgz] |
|---|---|---|
| author | Eric Dumazet <edumazet@google.com> | Thu Dec 20 16:00:27 2012 +0000 |
| committer | David S. Miller <davem@davemloft.net> | Fri Dec 21 13:14:01 2012 -0800 |
| tree | ef32b318efe584f845f05eb7f65daca803abb6a1 | |
| parent | 412ed94744d16806fbec3bd250fd94e71cde5a1f [diff] |
ip_gre: fix possible use after free Once skb_realloc_headroom() is called, tiph might point to freed memory. Cache tiph->ttl value before the reallocation, to avoid unexpected behavior. Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: Isaku Yamahata <yamahata@valinux.co.jp> Signed-off-by: David S. Miller <davem@davemloft.net>