Commit 73c6f860 authored by Committed by Greg Kroah-Hartman
xfrm: Fix NULL pointer dereference when skb_dst_force clears the dst_entry.
[ Upstream commit 9e143793 ] Since commit 222d7dbd ("net: prevent dst uses after free") skb_dst_force() might clear the dst_entry attached to the skb. The xfrm code don't expect this to happen, so we crash with a NULL pointer dereference in this case. Fix it by checking skb_dst(skb) for NULL after skb_dst_force() and drop the packet in cast the dst_entry was cleared. Fixes: 222d7dbd ("net: prevent dst uses after free") Reported-by: Tobias Hommel <firstname.lastname@example.org> Reported-by: Kristian Evensen <email@example.com> Reported-by: Wolfgang Walter <firstname.lastname@example.org> Signed-off-by: Steffen Klassert <email@example.com> Signed-off-by: Sasha Levin <firstname.lastname@example.org>
Showing with 8 additions and 0 deletions