| Message ID | 1494212964-17861-1-git-send-email-liuhangbin@gmail.com |
|---|---|
| State | Rejected, archived |
| Delegated to: | David Miller |
| Headers | show |
On Mon, 2017-05-08 at 11:09 +0800, Hangbin Liu wrote: > Since ip6_frag_reasm() will call __in6_dev_get(dev), which will access > dev->ip6_ptr. We need to make sure dev is not NULL. > > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> > --- > net/ipv6/reassembly.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c > index e1da5b8..e3ebd62 100644 > --- a/net/ipv6/reassembly.c > +++ b/net/ipv6/reassembly.c > @@ -348,7 +348,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, > fq->q.flags |= INET_FRAG_FIRST_IN; > } > > - if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && > + if (dev && fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && > fq->q.meat == fq->q.len) { > int res; > unsigned long orefdst = skb->_skb_refdst; How dev could be possibly NULL here ?
On Mon, May 08, 2017 at 07:50:30AM -0700, Eric Dumazet wrote: > On Mon, 2017-05-08 at 11:09 +0800, Hangbin Liu wrote: > > Since ip6_frag_reasm() will call __in6_dev_get(dev), which will access > > dev->ip6_ptr. We need to make sure dev is not NULL. > > > > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> > > --- > > net/ipv6/reassembly.c | 2 +- > > 1 file changed, 1 insertion(+), 1 deletion(-) > > > > diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c > > index e1da5b8..e3ebd62 100644 > > --- a/net/ipv6/reassembly.c > > +++ b/net/ipv6/reassembly.c > > @@ -348,7 +348,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, > > fq->q.flags |= INET_FRAG_FIRST_IN; > > } > > > > - if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && > > + if (dev && fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && > > fq->q.meat == fq->q.len) { > > int res; > > unsigned long orefdst = skb->_skb_refdst; > > > How dev could be possibly NULL here ? I saw we checked the dev in this function dev = skb->dev; if (dev) { fq->iif = dev->ifindex; skb->dev = NULL; } and upper caller ipv6_frag_rcv() fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr, skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr)); Apologise that I did not do enough research to make sure whether skb->dev could be NULL or not. I will do the check recently and reply when got a confirmation. Regards Hangbin
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c index e1da5b8..e3ebd62 100644 --- a/net/ipv6/reassembly.c +++ b/net/ipv6/reassembly.c @@ -348,7 +348,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb, fq->q.flags |= INET_FRAG_FIRST_IN; } - if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && + if (dev && fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) && fq->q.meat == fq->q.len) { int res; unsigned long orefdst = skb->_skb_refdst;
Since ip6_frag_reasm() will call __in6_dev_get(dev), which will access dev->ip6_ptr. We need to make sure dev is not NULL. Signed-off-by: Hangbin Liu <liuhangbin@gmail.com> --- net/ipv6/reassembly.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)