Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S965487AbdCWTAn (ORCPT ); Thu, 23 Mar 2017 15:00:43 -0400 Received: from shards.monkeyblade.net ([184.105.139.130]:56332 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932226AbdCWTAm (ORCPT ); Thu, 23 Mar 2017 15:00:42 -0400 Date: Thu, 23 Mar 2017 12:00:35 -0700 (PDT) Message-Id: <20170323.120035.1924712018254677829.davem@davemloft.net> To: eric.dumazet@gmail.com Cc: edumazet@google.com, dvyukov@google.com, xiyou.wangcong@gmail.com, herbert@gondor.apana.org.au, ast@kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller@googlegroups.com Subject: Re: netlink: NULL timer crash From: David Miller In-Reply-To: <1490284858.16816.205.camel@edumazet-glaptop3.roam.corp.google.com> References: <1490284858.16816.205.camel@edumazet-glaptop3.roam.corp.google.com> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Thu, 23 Mar 2017 12:00:36 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 596 Lines: 22 From: Eric Dumazet Date: Thu, 23 Mar 2017 09:00:58 -0700 > On Thu, 2017-03-23 at 07:53 -0700, Eric Dumazet wrote: > >> Nice ! >> >> Looks like neigh->ops->solicit is NULL > > Apparently we allow admins to do really stupid things with neighbours > on tunnels. > > Following patch should avoid the crash. > > Anyone has better ideas ? This is probably good enough for now, but you need to also handle dn_neigh_ops. Another way to solve this is to add a NULL method check to the one spot where we invoke this method. That clearly shows that the method is optional.