Skip to contentSkip to conversation

Fix null dereference in ip_defrag

PATCH In review Phil Oester 2 participants 2 messages Mar 21, 2008

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Phil Oester

author
#0 lore raw

PATCH 1/1 Fix null dereference in ip_defrag

Been seeing occasional panics in my testing of 2.6.25-rc in ip_defrag. Offending line in ip_defrag is here:

	net = skb->dev->nd_net

where dev is NULL. Bisected the problem down to commit ac18e7509e7df327e30d6e073a787d922eaf211d ([NETNS][FRAGS]: Make the inet_frag_queue lookup work in namespaces).

Below patch (idea from Patrick McHardy) fixes the problem for me.

Signed-off-by Phil Oester <[email protected]>
Acked-by Patrick McHardy <[email protected]>

Phil

net/ipv4/ip_fragment.c +1 -1
index a2e92f9..3b2e5ad 100644
@@ -568,7 +568,7 @@ int ip_defrag(struct sk_buff *skb, u32 user)
 
 	IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
 
-	net = skb->dev->nd_net;
+	net = skb->dev ? skb->dev->nd_net : skb->dst->dev->nd_net;
 	/* Start by cleaning up the memory. */
 	if (atomic_read(&net->ipv4.frags.mem) > net->ipv4.frags.high_thresh)
 		ip_evictor(net);
maintainer
#1 lore raw

From: Phil Oester <[email protected]>
Date: Fri, 21 Mar 2008 12:09:30 -0700

Quoted 5 lines

Been seeing occasional panics in my testing of 2.6.25-rc in ip_defrag. Offending line in ip_defrag is here:

	net = skb->dev->nd_net
Quoted 8 lines

where dev is NULL. Bisected the problem down to commit ac18e7509e7df327e30d6e073a787d922eaf211d ([NETNS][FRAGS]: Make the inet_frag_queue lookup work in namespaces).

Below patch (idea from Patrick McHardy) fixes the problem for me.

Signed-off-by Phil Oester <[email protected]>
Acked-by Patrick McHardy <[email protected]>

Thanks, I had this in my queue and will apply this now.