On Tue, Dec 08, 2015 at 11:35:19PM +0100, Florian Westphal wrote: > Valdis reports NULL deref in nf_ct_frag6_gather. > Problem is bogus use of skb_queue_walk() -- we miss first skb in the list > since we start with head->next instead of head. > > In case the element we're looking for was head->next we won't find > a result and then trip over NULL iter. > > (defrag uses plain NULL-terminated list rather than one terminated by > head-of-list-pointer, which is what skb_queue_walk expects). Applied, thanks Florian. -- To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
