diff options
| author | Phil Oester <kernel@linuxace.com> | 2013-06-19 06:49:51 -0400 |
|---|---|---|
| committer | Pablo Neira Ayuso <pablo@netfilter.org> | 2013-06-20 12:01:24 +0200 |
| commit | 142dcdd3c25fc7a3866bb06980e8f93a2ed7e050 (patch) | |
| tree | af92eb2328b0c4d1f8632ab0d1f26145b413c58f /net/netfilter/nf_conntrack_netlink.c | |
| parent | 06f3d7f973ec04290d86b7dd91b48d38d90433dc (diff) | |
netfilter: nf_conntrack_ipv6: Plug sk_buff leak in fragment handling
In commit 4cdd3408 ("netfilter: nf_conntrack_ipv6: improve fragmentation
handling"), an sk_buff leak was introduced when dealing with reassembled
packets by grabbing a reference to the original skb instead of the
reassembled skb. At this point, the leak only impacted conntracks with an
associated helper.
In commit 58a317f1 ("netfilter: ipv6: add IPv6 NAT support"), the bug was
expanded to include all reassembled packets with unconfirmed conntracks.
Fix this by grabbing a reference to the proper reassembled skb. This
closes netfilter bugzilla #823.
Signed-off-by: Phil Oester <kernel@linuxace.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Diffstat (limited to 'net/netfilter/nf_conntrack_netlink.c')
0 files changed, 0 insertions, 0 deletions