linux-kernel - Re: [patch 23/28] ipv6: Fix OOPS in ip6_dst_lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20081006235113.GB29794@hmsreliant.think-freely.org>
Date:	Mon, 6 Oct 2008 19:51:13 -0400
From:	Neil Horman <nhorman@...driver.com>
To:	Greg KH <gregkh@...e.de>
Cc:	linux-kernel@...r.kernel.org, stable@...nel.org,
	Justin Forbes <jmforbes@...uxtx.org>,
	Zwane Mwaikambo <zwane@....linux.org.uk>,
	Theodore Ts'o <tytso@....edu>,
	Randy Dunlap <rdunlap@...otime.net>,
	Dave Jones <davej@...hat.com>,
	Chuck Wolber <chuckw@...ntumlinux.com>,
	Chris Wedgwood <reviews@...cw.f00f.org>,
	Michael Krufky <mkrufky@...uxtv.org>,
	Chuck Ebbert <cebbert@...hat.com>,
	Domenico Andreoli <cavokz@...il.com>, Willy Tarreau <w@....eu>,
	Rodrigo Rubira Branco <rbranco@...checkpoint.com>,
	Jake Edge <jake@....net>, Eugene Teo <eteo@...hat.com>,
	torvalds@...ux-foundation.org, akpm@...ux-foundation.org,
	alan@...rguk.ukuu.org.uk, "David S. Miller" <davem@...emloft.net>
Subject: Re: [patch 23/28] ipv6: Fix OOPS in ip6_dst_lookup_tail().

On Mon, Oct 06, 2008 at 04:17:50PM -0700, Greg KH wrote:
> 2.6.25-stable review patch.  If anyone has any objections, please let us
> know.
> 


Ack, Thanks Greg.
Neil

> ------------------
> From: Neil Horman <nhorman@...driver.com>
> 
> [ Upstream commit e550dfb0c2c31b6363aa463a035fc9f8dcaa3c9b ]
> 
> This fixes kernel bugzilla 11469: "TUN with 1024 neighbours:
> ip6_dst_lookup_tail NULL crash"
> 
> dst->neighbour is not necessarily hooked up at this point
> in the processing path, so blindly dereferencing it is
> the wrong thing to do.  This NULL check exists in other
> similar paths and this case was just an oversight.
> 
> Also fix the completely wrong and confusing indentation
> here while we're at it.
> 
> Based upon a patch by Evgeniy Polyakov.
> 
> Signed-off-by: Neil Horman <nhorman@...driver.com>
> Signed-off-by: David S. Miller <davem@...emloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...e.de>
> 
> ---
>  net/ipv6/ip6_output.c |   64 +++++++++++++++++++++++++-------------------------
>  1 file changed, 32 insertions(+), 32 deletions(-)
> 
> --- a/net/ipv6/ip6_output.c
> +++ b/net/ipv6/ip6_output.c
> @@ -930,39 +930,39 @@ static int ip6_dst_lookup_tail(struct so
>  	}
>  
>  #ifdef CONFIG_IPV6_OPTIMISTIC_DAD
> -		/*
> -		 * Here if the dst entry we've looked up
> -		 * has a neighbour entry that is in the INCOMPLETE
> -		 * state and the src address from the flow is
> -		 * marked as OPTIMISTIC, we release the found
> -		 * dst entry and replace it instead with the
> -		 * dst entry of the nexthop router
> -		 */
> -		if (!((*dst)->neighbour->nud_state & NUD_VALID)) {
> -			struct inet6_ifaddr *ifp;
> -			struct flowi fl_gw;
> -			int redirect;
> -
> -			ifp = ipv6_get_ifaddr(&init_net, &fl->fl6_src,
> -					      (*dst)->dev, 1);
> -
> -			redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
> -			if (ifp)
> -				in6_ifa_put(ifp);
> -
> -			if (redirect) {
> -				/*
> -				 * We need to get the dst entry for the
> -				 * default router instead
> -				 */
> -				dst_release(*dst);
> -				memcpy(&fl_gw, fl, sizeof(struct flowi));
> -				memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
> -				*dst = ip6_route_output(sk, &fl_gw);
> -				if ((err = (*dst)->error))
> -					goto out_err_release;
> -			}
> +	/*
> +	 * Here if the dst entry we've looked up
> +	 * has a neighbour entry that is in the INCOMPLETE
> +	 * state and the src address from the flow is
> +	 * marked as OPTIMISTIC, we release the found
> +	 * dst entry and replace it instead with the
> +	 * dst entry of the nexthop router
> +	 */
> +	if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
> +		struct inet6_ifaddr *ifp;
> +		struct flowi fl_gw;
> +		int redirect;
> +
> +		ifp = ipv6_get_ifaddr(&init_net, &fl->fl6_src,
> +				      (*dst)->dev, 1);
> +
> +		redirect = (ifp && ifp->flags & IFA_F_OPTIMISTIC);
> +		if (ifp)
> +			in6_ifa_put(ifp);
> +
> +		if (redirect) {
> +			/*
> +			 * We need to get the dst entry for the
> +			 * default router instead
> +			 */
> +			dst_release(*dst);
> +			memcpy(&fl_gw, fl, sizeof(struct flowi));
> +			memset(&fl_gw.fl6_dst, 0, sizeof(struct in6_addr));
> +			*dst = ip6_route_output(sk, &fl_gw);
> +			if ((err = (*dst)->error))
> +				goto out_err_release;
>  		}
> +	}
>  #endif
>  
>  	return 0;
> 
> -- 
> 

-- 
/****************************************************
 * Neil Horman <nhorman@...driver.com>
 * Software Engineer, Red Hat
 ****************************************************/
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/