lkml.org 
[lkml]   [2008]   [Oct]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [patch 23/28] ipv6: Fix OOPS in ip6_dst_lookup_tail().
On Mon, Oct 06, 2008 at 04:17:50PM -0700, Greg KH wrote:
> 2.6.25-stable review patch. If anyone has any objections, please let us
> know.
>


Ack, Thanks Greg.
Neil

> ------------------
> From: Neil Horman <nhorman@tuxdriver.com>
>
> [ Upstream commit e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b ]
>
> This fixes kernel bugzilla 11469: "TUN with 1024 neighbours:
> ip6_dst_lookup_tail NULL crash"
>
> dst->neighbour is not necessarily hooked up at this point
> in the processing path, so blindly dereferencing it is
> the wrong thing to do. This NULL check exists in other
> similar paths and this case was just an oversight.
>
> Also fix the completely wrong and confusing indentation
> here while we're at it.
>
> Based upon a patch by Evgeniy Polyakov.
>
> Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
>
> ---
> net/ipv6/ip6_output.c | 64 +++++++++++++++++++++++++-------------------------
> 1 file changed, 32 insertions(+), 32 deletions(-)
>
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -930,39 +930,39 @@ static int ip6_dst_lookup_tail(struct so
> }
>
> #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
> - /*
> - * Here if the dst entry we've looked up
> - * has a neighbour entry that is in the INCOMPLETE
> - * state and the src address from the flow is
> - * marked as OPTIMISTIC, we release the found
> - * dst entry and replace it instead with the
> - * dst entry of the nexthop router
> - */
> - if (!((*dst)->neighbour->nud_state & NUD_VALID)) {
> - struct inet6_ifaddr *ifp;
> - struct flowi fl_gw;
> - int redirect;
> -
> - ifp = ipv6_get_ifaddr(&init_net, &fl->fl6_src,
> - (*dst)->dev, 1);
> -
> - redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
> - if (ifp)
> - in6_ifa_put(ifp);
> -
> - if (redirect) {
> - /*
> - * We need to get the dst entry for the
> - * default router instead
> - */
> - dst_release(*dst);
> - memcpy(&fl_gw, fl, sizeof(struct flowi));
> - memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
> - *dst = ip6_route_output(sk, &fl_gw);
> - if ((err = (*dst)->error))
> - goto out_err_release;
> - }
> + /*
> + * Here if the dst entry we've looked up
> + * has a neighbour entry that is in the INCOMPLETE
> + * state and the src address from the flow is
> + * marked as OPTIMISTIC, we release the found
> + * dst entry and replace it instead with the
> + * dst entry of the nexthop router
> + */
> + if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
> + struct inet6_ifaddr *ifp;
> + struct flowi fl_gw;
> + int redirect;
> +
> + ifp = ipv6_get_ifaddr(&init_net, &fl->fl6_src,
> + (*dst)->dev, 1);
> +
> + redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
> + if (ifp)
> + in6_ifa_put(ifp);
> +
> + if (redirect) {
> + /*
> + * We need to get the dst entry for the
> + * default router instead
> + */
> + dst_release(*dst);
> + memcpy(&fl_gw, fl, sizeof(struct flowi));
> + memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
> + *dst = ip6_route_output(sk, &fl_gw);
> + if ((err = (*dst)->error))
> + goto out_err_release;
> }
> + }
> #endif
>
> return 0;
>
> --
>

--
/****************************************************
* Neil Horman <nhorman@tuxdriver.com>
* Software Engineer, Red Hat
****************************************************/


\
 
 \ /
  Last update: 2008-10-07 01:55    [W:0.390 / U:0.304 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site