ipv6: frags: Fix bogus skb->sk in reassembled packets
authorHerbert Xu <herbert@gondor.apana.org.au>
Thu, 20 Dec 2018 13:20:10 +0000 (21:20 +0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 9 Jan 2019 16:38:35 +0000 (17:38 +0100)
commit5ac4cc331bca6c759460fc948d19906f4f7f5831
tree127f9ed5f039b55c990dce00d35e672e47c0d52e
parent9ed77be31e9564381d5b5329d1a529cccd219a94
ipv6: frags: Fix bogus skb->sk in reassembled packets

[ Upstream commit d15f5ac8deea936d3adf629421a66a88b42b8a2f ]

It was reported that IPsec would crash when it encounters an IPv6
reassembled packet because skb->sk is non-zero and not a valid
pointer.

This is because skb->sk is now a union with ip_defrag_offset.

This patch fixes this by resetting skb->sk when exiting from
the reassembly code.

Reported-by: Xiumei Mu <xmu@redhat.com>
Fixes: 219badfaade9 ("ipv6: frags: get rid of ip6frag_skb_cb/...")
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
net/ipv6/reassembly.c