From: Patrick McHardy <kaber@trash.net>
Date: Tue, 9 Jan 2007 22:32:41 +0000 (-0800)
Subject: [NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments
X-Git-Tag: v2.6.20-rc5~29^2~6
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f9f02cca25acf33e5853c6b3cbb0c7146312783f;p=pandora-kernel.git

[NETFILTER]: nf_conntrack_ipv6: fix crash when handling fragments

When IPv6 connection tracking splits up a defragmented packet into
its original fragments, the packets are taken from a list and are
passed to the network stack with skb->next still set. This causes
dev_hard_start_xmit to treat them as GSO fragments, resulting in
a use after free when connection tracking handles the next fragment.

Signed-off-by: Patrick McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

Reading git-diff-tree failed