tree aabbc224b7f7d620573fd638431a26f0442eac59
parent 0414c78f14861cb704d6e6888efd53dd36e3bdde
author Tejaswi Tanikella <tejaswit@codeaurora.org> 1508739363 +0530
committer Pablo Neira Ayuso <pablo@netfilter.org> 1509534929 +0100

netfilter: nf_reject_ipv4: Fix use-after-free in send_reset

niph is not updated after pskb_expand_head changes the skb head. It
still points to the freed data, which is then used to update tot_len and
checksum. This could cause use-after-free poison crash.

Update niph, if ip_route_me_harder does not fail.

This only affects the interaction with REJECT targets and br_netfilter.

Signed-off-by: Tejaswi Tanikella <tejaswit@codeaurora.org>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>