I've just released Linux 2.6.20.19.
It backports a fix present in 2.6.22 for a bug introduced in the IPv6
stack in 2.6.20, which could lead to crashes under certain circumstances.
I'll also be replying to this message with a copy of the patch between
2.6.20.18 and 2.6.20.19.
The patch and changelog will appear soon at the following locations:
ftp://ftp.all.kernel.org/pub/linux/kernel/v2.6/
ftp://ftp.all.kernel.org/pub/linux/kernel/v2.6/patch-2.6.20.19.bz2
ftp://ftp.all.kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.20.19
Git repository:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.20.y.git
http://www.kernel.org/pub/scm/linux/kernel/git/stable/linux-2.6.20.y.git
Git repository through the gitweb interface:
http://git.kernel.org/?p=linux/kernel/git/stable/linux-2.6.20.y.git
Willy
-------
Makefile | 2 +-
net/ipv6/exthdrs.c | 16 ++++++++++++----
2 files changed, 13 insertions(+), 5 deletions(-)
Summary of changes from 2.6.20.18 to 2.6.20.19
============================================
Willy Tarreau (1):
Linux 2.6.20.19
YOSHIFUJI Hideaki (1):
[IPV6]: Do no rely on skb->dst before it is assigned.
diff --git a/Makefile b/Makefile
index 48daec7..6bb9f2e 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
VERSION = 2
PATCHLEVEL = 6
SUBLEVEL = 20
-EXTRAVERSION = .18
+EXTRAVERSION = .19
NAME = Homicidal Dwarf Hamster
# *DOCUMENTATION*
diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index de96e1a..82a3444 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -653,6 +653,14 @@ EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);
Hop-by-hop options.
**********************************/
+/*
+ * Note: we cannot rely on skb->dst before we assign it in ip6_route_input().
+ */
+static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
+{
+ return skb->dst ? ip6_dst_idev(skb->dst) : __in6_dev_get(skb->dev);
+}
+
/* Router Alert as of RFC 2711 */
static int ipv6_hop_ra(struct sk_buff **skbp, int optoff)
@@ -679,25 +687,25 @@ static int ipv6_hop_jumbo(struct sk_buff **skbp, int optoff)
if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
skb->nh.raw[optoff+1]);
- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+ IP6_INC_STATS_BH(ipv6_skb_idev(skb),
IPSTATS_MIB_INHDRERRORS);
goto drop;
}
pkt_len = ntohl(*(__be32*)(skb->nh.raw+optoff+2));
if (pkt_len <= IPV6_MAXPLEN) {
- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
+ IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS);
icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
return 0;
}
if (skb->nh.ipv6h->payload_len) {
- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
+ IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS);
icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
return 0;
}
if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
- IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INTRUNCATEDPKTS);
+ IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INTRUNCATEDPKTS);
goto drop;
}