diff options
| author | Steffen Klassert <steffen.klassert@secunet.com> | 2025-01-16 11:46:03 +0100 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2026-04-02 13:09:30 +0200 |
| commit | ddd2d7f20ab1c25b5a44244df230f5c39c25c24a (patch) | |
| tree | 92ced346b8fc3acc8e7aeddd7c48931ef847d0ef /net/ipv6 | |
| parent | 4092242a7347dfd8e124c8e781f5b8b11082ce67 (diff) | |
| download | linux-ddd2d7f20ab1c25b5a44244df230f5c39c25c24a.tar.gz linux-ddd2d7f20ab1c25b5a44244df230f5c39c25c24a.tar.bz2 linux-ddd2d7f20ab1c25b5a44244df230f5c39c25c24a.zip | |
xfrm: Fix the usage of skb->sk
[ Upstream commit 1620c88887b16940e00dbe57dd38c74eda9bad9e ]
xfrm assumed to always have a full socket at skb->sk.
This is not always true, so fix it by converting to a
full socket before it is used.
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Stable-dep-of: 0c0eef8ccd24 ("esp: fix skb leak with espintcp and async crypto")
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net/ipv6')
| -rw-r--r-- | net/ipv6/esp6.c | 2 | ||||
| -rw-r--r-- | net/ipv6/xfrm6_output.c | 4 |
2 files changed, 3 insertions, 3 deletions
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c index 62d17d7f6d9a..9c4c7b1f2955 100644 --- a/net/ipv6/esp6.c +++ b/net/ipv6/esp6.c @@ -274,7 +274,7 @@ static void esp_output_done(void *data, int err) x->encap && x->encap->encap_type == TCP_ENCAP_ESPINTCP) esp_output_tail_tcp(x, skb); else - xfrm_output_resume(skb->sk, skb, err); + xfrm_output_resume(skb_to_full_sk(skb), skb, err); } } diff --git a/net/ipv6/xfrm6_output.c b/net/ipv6/xfrm6_output.c index 5f7b1fdbffe6..b3d5d1f266ee 100644 --- a/net/ipv6/xfrm6_output.c +++ b/net/ipv6/xfrm6_output.c @@ -82,14 +82,14 @@ static int __xfrm6_output(struct net *net, struct sock *sk, struct sk_buff *skb) toobig = skb->len > mtu && !skb_is_gso(skb); - if (toobig && xfrm6_local_dontfrag(skb->sk)) { + if (toobig && xfrm6_local_dontfrag(sk)) { xfrm6_local_rxpmtu(skb, mtu); kfree_skb(skb); return -EMSGSIZE; } else if (toobig && xfrm6_noneed_fragment(skb)) { skb->ignore_df = 1; goto skip_frag; - } else if (!skb->ignore_df && toobig && skb->sk) { + } else if (!skb->ignore_df && toobig && sk) { xfrm_local_error(skb, mtu); kfree_skb(skb); return -EMSGSIZE; |