Re: BUG: unable to handle kernel NULL pointer dereference in ipv6_select_ident

Eric Dumazet
2011-12-22T07:51:26Z

Le jeudi 22 décembre 2011 à 07:38 +0100, Steffen Klassert a écrit :
> On Thu, Dec 22, 2011 at 05:37:36AM +0100, Eric Dumazet wrote:
> > Le mercredi 21 décembre 2011 à 23:12 +0000, Chris Boot a écrit :
> > >
> > > (gdb) list *ip_fragment+0x9d
> > > 0xffffffff812a62e1 is in ip_fragment (include/net/dst.h:209).
> > > 204 return dst_metric(dst, RTAX_FEATURES) & feature;
> > > 205 }
> > > 206
> > > 207 static inline u32 dst_mtu(const struct dst_entry *dst)
> > > 208 {
> > > 209 return dst->ops->mtu(dst);
> > > 210 }
> > > 211
> > > 212 /* RTT metrics are stored in milliseconds for user ABI, but used as jiffies */
> >
> > This one is different, its not IPv6 related but IPv4 :
> >
> > fake_dst_ops lacks a .mtu() field
> >
> > Bug added in commit 618f9bc74a039da76 (net: Move mtu handling down to
> > the protocol depended handlers)
> >
>
> Before I did this patch, I changed the .default_mtu field of "struct dst_ops"
> to .mtu and converted all users of default_mtu to mtu. fake_dst_ops never
> had a default_mtu field, so I did not touch it. I guess this bug is arround
> since fake_dst_ops exists. It's now just much easier to trigger as commit
> 618f9bc74a039da76 changed dst_mtu() to call dst->ops->mtu() unconditionally.

I dont think so.

Prior to 618f9bc74a0, we were calling

static inline u32 dst_mtu(const struct dst_entry *dst)
{
u32 mtu = dst_metric_raw(dst, RTAX_MTU);

if (!mtu)
mtu = dst->ops->mtu(dst);

return mtu;
}

with dst = fake_rtable

and we did :

dst_init_metrics(&rt->dst, br_dst_default_metrics, true);

so dst_metric_raw(dst, RTAX_MTU) was returning 1500

So bug is new, we dont need to backport this fix.