Re: Kernel panic when using bridge

["Jan Lübbe" <jluebbe@debian.org>]

Hi! 

On Tue, 2011-04-12 at 13:49 +0200, Eric Dumazet wrote:
> Considering recent changes in ip_options_echo() I would suggest to add
> following patch and/or revert commit 8628bd8af7c4c14f40
> (ipv4: Fix IP timestamp option (IPOPT_TS_PRESPEC) handling in
> ip_options_echo())

I've read this thread, but I'm not sure why my patch is related to these
kernel panics. The behavior is only changed for packets with the
timestamp option in prespecified addresses mode. Even then, it shouldn't
cause ip_options_build to write to unallocated memory later.

> diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
> index 28a736f..35f2bf9 100644
> --- a/net/ipv4/ip_options.c
> +++ b/net/ipv4/ip_options.c
> @@ -200,6 +200,11 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
>                 *dptr++ = IPOPT_END;
>                 dopt->optlen++;
>         }
> +       if (unlikely(dopt->optlen > 40)) {
> +               pr_err("ip_options_echo() fatal error optlen=%u > 40\n", dopt->optlen);
> +               print_hex_dump(KERN_ERR, "ip options: ", DUMP_PREFIX_OFFSET,
> +                       16, 1, dopt->__data, dopt->optlen, false);
> +       }
>         return 0;
>  }

Here you check dopt->optlen, which certainly should be 40 at most. The
calculation of dopt->optlen wasn't changed by my patch, though.

Regards,
Jan