ipv6: Fix potential uninit-value access in __ip6_make_skb()
authorShigeru Yoshida <syoshida@redhat.com>
Mon, 6 May 2024 14:11:29 +0000 (23:11 +0900)
committerDavid S. Miller <davem@davemloft.net>
Wed, 8 May 2024 11:21:00 +0000 (12:21 +0100)
commit4e13d3a9c25b7080f8a619f961e943fe08c2672c
treeb2eb44f6fe3b652bbf2fea5cc6adc2f1d1c7c210
parentab0cde321adc96a755caf39eb0e90d61511ec6c4
ipv6: Fix potential uninit-value access in __ip6_make_skb()

As it was done in commit fc1092f51567 ("ipv4: Fix uninit-value access in
__ip_make_skb()") for IPv4, check FLOWI_FLAG_KNOWN_NH on fl6->flowi6_flags
instead of testing HDRINCL on the socket to avoid a race condition which
causes uninit-value access.

Fixes: ea30388baebc ("ipv6: Fix an uninit variable access bug in __ip6_make_skb()")
Signed-off-by: Shigeru Yoshida <syoshida@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv6/ip6_output.c