Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756404AbYJFXxi (ORCPT ); Mon, 6 Oct 2008 19:53:38 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1753557AbYJFXx3 (ORCPT ); Mon, 6 Oct 2008 19:53:29 -0400 Received: from charlotte.tuxdriver.com ([70.61.120.58]:47679 "EHLO smtp.tuxdriver.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752560AbYJFXx2 (ORCPT ); Mon, 6 Oct 2008 19:53:28 -0400 Date: Mon, 6 Oct 2008 19:51:13 -0400 From: Neil Horman To: Greg KH Cc: linux-kernel@vger.kernel.org, stable@kernel.org, Justin Forbes , Zwane Mwaikambo , "Theodore Ts'o" , Randy Dunlap , Dave Jones , Chuck Wolber , Chris Wedgwood , Michael Krufky , Chuck Ebbert , Domenico Andreoli , Willy Tarreau , Rodrigo Rubira Branco , Jake Edge , Eugene Teo , torvalds@linux-foundation.org, akpm@linux-foundation.org, alan@lxorguk.ukuu.org.uk, "David S. Miller" Subject: Re: [patch 23/28] ipv6: Fix OOPS in ip6_dst_lookup_tail(). Message-ID: <20081006235113.GB29794@hmsreliant.think-freely.org> References: <20081006225949.357365087@mini.kroah.org> <20081006231750.GX20567@suse.de> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20081006231750.GX20567@suse.de> User-Agent: Mutt/1.5.18 (2008-05-17) X-Spam-Score: -1.4 (-) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3735 Lines: 123 On Mon, Oct 06, 2008 at 04:17:50PM -0700, Greg KH wrote: > 2.6.25-stable review patch. If anyone has any objections, please let us > know. > Ack, Thanks Greg. Neil > ------------------ > From: Neil Horman > > [ Upstream commit e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b ] > > This fixes kernel bugzilla 11469: "TUN with 1024 neighbours: > ip6_dst_lookup_tail NULL crash" > > dst->neighbour is not necessarily hooked up at this point > in the processing path, so blindly dereferencing it is > the wrong thing to do. This NULL check exists in other > similar paths and this case was just an oversight. > > Also fix the completely wrong and confusing indentation > here while we're at it. > > Based upon a patch by Evgeniy Polyakov. > > Signed-off-by: Neil Horman > Signed-off-by: David S. Miller > Signed-off-by: Greg Kroah-Hartman > > --- > net/ipv6/ip6_output.c | 64 +++++++++++++++++++++++++------------------------- > 1 file changed, 32 insertions(+), 32 deletions(-) > > --- a/net/ipv6/ip6_output.c > +++ b/net/ipv6/ip6_output.c > @@ -930,39 +930,39 @@ static int ip6_dst_lookup_tail(struct so > } > > #ifdef CONFIG_IPV6_OPTIMISTIC_DAD > - /* > - * Here if the dst entry we've looked up > - * has a neighbour entry that is in the INCOMPLETE > - * state and the src address from the flow is > - * marked as OPTIMISTIC, we release the found > - * dst entry and replace it instead with the > - * dst entry of the nexthop router > - */ > - if (!((*dst)->neighbour->nud_state & NUD_VALID)) { > - struct inet6_ifaddr *ifp; > - struct flowi fl_gw; > - int redirect; > - > - ifp = ipv6_get_ifaddr(&init_net, &fl->fl6_src, > - (*dst)->dev, 1); > - > - redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC); > - if (ifp) > - in6_ifa_put(ifp); > - > - if (redirect) { > - /* > - * We need to get the dst entry for the > - * default router instead > - */ > - dst_release(*dst); > - memcpy(&fl_gw, fl, sizeof(struct flowi)); > - memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr)); > - *dst = ip6_route_output(sk, &fl_gw); > - if ((err = (*dst)->error)) > - goto out_err_release; > - } > + /* > + * Here if the dst entry we've looked up > + * has a neighbour entry that is in the INCOMPLETE > + * state and the src address from the flow is > + * marked as OPTIMISTIC, we release the found > + * dst entry and replace it instead with the > + * dst entry of the nexthop router > + */ > + if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) { > + struct inet6_ifaddr *ifp; > + struct flowi fl_gw; > + int redirect; > + > + ifp = ipv6_get_ifaddr(&init_net, &fl->fl6_src, > + (*dst)->dev, 1); > + > + redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC); > + if (ifp) > + in6_ifa_put(ifp); > + > + if (redirect) { > + /* > + * We need to get the dst entry for the > + * default router instead > + */ > + dst_release(*dst); > + memcpy(&fl_gw, fl, sizeof(struct flowi)); > + memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr)); > + *dst = ip6_route_output(sk, &fl_gw); > + if ((err = (*dst)->error)) > + goto out_err_release; > } > + } > #endif > > return 0; > > -- > -- /**************************************************** * Neil Horman * Software Engineer, Red Hat ****************************************************/ -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/