tree ef32b318efe584f845f05eb7f65daca803abb6a1
parent 412ed94744d16806fbec3bd250fd94e71cde5a1f
author Eric Dumazet <edumazet@google.com> 1356019227 +0000
committer David S. Miller <davem@davemloft.net> 1356124441 -0800

ip_gre: fix possible use after free

Once skb_realloc_headroom() is called, tiph might point to freed memory.

Cache tiph->ttl value before the reallocation, to avoid unexpected
behavior.

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Isaku Yamahata <yamahata@valinux.co.jp>
Signed-off-by: David S. Miller <davem@davemloft.net>