Re: 2.6.25-rc: Null dereference in ip_defrag

[Phil Oester <kernel@linuxace.com>]

[-- Attachment #1: Type: text/plain, Size: 356 bytes --]

On Thu, Mar 20, 2008 at 03:47:38PM +0100, Patrick McHardy wrote:
> >And it has survived 1.5 days without issue.  Patrick - will you be pushing
> >to David?
> 
> Could you send the patch you've been using?

Sure - attached below against current git.  I assume you will add your
signoff, but you can add

Tested-by: Phil Oester <kernel@linuxace.com>

Phil



[-- Attachment #2: patch-ipfrags --]
[-- Type: text/plain, Size: 480 bytes --]

diff --git a/net/ipv4/ip_fragment.c b/net/ipv4/ip_fragment.c
index a2e92f9..3b2e5ad 100644
--- a/net/ipv4/ip_fragment.c
+++ b/net/ipv4/ip_fragment.c
@@ -568,7 +568,7 @@ int ip_defrag(struct sk_buff *skb, u32 user)
 
 	IP_INC_STATS_BH(IPSTATS_MIB_REASMREQDS);
 
-	net = skb->dev->nd_net;
+	net = skb->dev ? skb->dev->nd_net : skb->dst->dev->nd_net;
 	/* Start by cleaning up the memory. */
 	if (atomic_read(&net->ipv4.frags.mem) > net->ipv4.frags.high_thresh)
 		ip_evictor(net);