Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754571AbdCXE3C (ORCPT ); Fri, 24 Mar 2017 00:29:02 -0400 Received: from shards.monkeyblade.net ([184.105.139.130]:33714 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753503AbdCXE2x (ORCPT ); Fri, 24 Mar 2017 00:28:53 -0400 Date: Thu, 23 Mar 2017 21:28:49 -0700 (PDT) Message-Id: <20170323.212849.796880770292613157.davem@davemloft.net> To: eric.dumazet@gmail.com Cc: edumazet@google.com, dvyukov@google.com, xiyou.wangcong@gmail.com, herbert@gondor.apana.org.au, ast@kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, syzkaller@googlegroups.com Subject: Re: [PATCH net] net: neigh: guard against NULL solicit() method From: David Miller In-Reply-To: <1490297961.9687.6.camel@edumazet-glaptop3.roam.corp.google.com> References: <1490284858.16816.205.camel@edumazet-glaptop3.roam.corp.google.com> <20170323.120035.1924712018254677829.davem@davemloft.net> <1490297961.9687.6.camel@edumazet-glaptop3.roam.corp.google.com> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Thu, 23 Mar 2017 21:28:52 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 658 Lines: 17 From: Eric Dumazet Date: Thu, 23 Mar 2017 12:39:21 -0700 > From: Eric Dumazet > > Dmitry posted a nice reproducer of a bug triggering in neigh_probe() > when dereferencing a NULL neigh->ops->solicit method. > > This can happen for arp_direct_ops/ndisc_direct_ops and similar, > which can be used for NUD_NOARP neighbours (created when dev->header_ops > is NULL). Admin can then force changing nud_state to some other state > that would fire neigh timer. > > Signed-off-by: Eric Dumazet > Reported-by: Dmitry Vyukov Applied and queued up for -stable, thanks Eric.