Re: [Bugme-new] [Bug 33842] New: NULL pointer dereference in ip_fragment

[David Miller <davem@davemloft.net>]

From: Bandan Das <bandan.das@stratus.com>
Date: Tue, 26 Apr 2011 16:31:54 -0400

> https://bugzilla.kernel.org/show_bug.cgi?id=33842
> 
> I believe  Eric's recent change to br_parse_ip_options() 
> didn't make it to 2.6.39-rc4:
> 
> bridge: reset IPCB in br_parse_ip_options
> commit f8e9881c2aef1e982e5abc25c046820cd0b7cf64
> 
> diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
> index 008ff6c..b353f7c 100644
> --- a/net/bridge/br_netfilter.c
> +++ b/net/bridge/br_netfilter.c
> @@ -249,11 +249,9 @@  static int br_parse_ip_options(struct sk_buff *skb)
>            goto drop;
>            }
>  
> -       /* Zero out the CB buffer if no options present */
> -       if (iph->ihl == 5) {
> -          memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
> +          memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
> +          if (iph->ihl == 5)
>               return 0;
> -             }
>  
>         opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
>         if (ip_options_compile(dev_net(dev), opt, skb))
> 
> 
> 
> Tomas, could you please try a kernel that has the above 
> mentioned change and see if the crash re-occurs ?

This patch is mangled by your email client, tab characters
have been turned into spaces, so it won't be usable by anyone.