[GIT PULL nf] IPVS Fixes for v3.18

[GIT PULL nf] IPVS Fixes for v3.18

[Simon Horman]

Hi Pablo,

please consider this fix for v3.18.

It fixes a null-pointer dereference that may occur when logging
errors.

This problem was introduced by 4a4739d56b0 ("ipvs: Pull out
crosses_local_route_boundary logic") in v3.17-rc5. As such I would
also like it considered for 3.17-stable.


The following changes since commit 7965ee93719921ea5978f331da653dfa2d7b99f5:

  netfilter: nft_compat: fix wrong target lookup in nft_target_select_ops() (2014-10-27 22:17:46 +0100)

are available in the git repository at:

  https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git tags/ipvs-fixes-for-v3.18

for you to fetch changes up to 3d53666b40007b55204ee8890618da79a20c9940:

  ipvs: Avoid null-pointer deref in debug code (2014-10-28 09:48:31 +0900)

----------------------------------------------------------------
Alex Gartrell (1):
      ipvs: Avoid null-pointer deref in debug code

 net/netfilter/ipvs/ip_vs_xmit.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

[PATCH nf] ipvs: Avoid null-pointer deref in debug code

[Simon Horman]

From: Alex Gartrell <agartrell@fb.com>

Use daddr instead of reaching into dest.

Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alex Gartrell <agartrell@fb.com>
Signed-off-by: Simon Horman <horms@verge.net.au>
---
 net/netfilter/ipvs/ip_vs_xmit.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 91f17c1..437a366 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -316,7 +316,7 @@ __ip_vs_get_out_rt(int skb_af, struct sk_buff *skb, struct ip_vs_dest *dest,
 	if (unlikely(crosses_local_route_boundary(skb_af, skb, rt_mode,
 						  local))) {
 		IP_VS_DBG_RL("We are crossing local and non-local addresses"
-			     " daddr=%pI4\n", &dest->addr.ip);
+			     " daddr=%pI4\n", &daddr);
 		goto err_put;
 	}
 
@@ -458,7 +458,7 @@ __ip_vs_get_out_rt_v6(int skb_af, struct sk_buff *skb, struct ip_vs_dest *dest,
 	if (unlikely(crosses_local_route_boundary(skb_af, skb, rt_mode,
 						  local))) {
 		IP_VS_DBG_RL("We are crossing local and non-local addresses"
-			     " daddr=%pI6\n", &dest->addr.in6);
+			     " daddr=%pI6\n", daddr);
 		goto err_put;
 	}
 
-- 
2.1.1

Re: [GIT PULL nf] IPVS Fixes for v3.18

[Pablo Neira Ayuso]

On Tue, Oct 28, 2014 at 10:05:33AM +0900, Simon Horman wrote:
> Hi Pablo,
> 
> please consider this fix for v3.18.
> 
> It fixes a null-pointer dereference that may occur when logging
> errors.
> 
> This problem was introduced by 4a4739d56b0 ("ipvs: Pull out
> crosses_local_route_boundary logic") in v3.17-rc5. As such I would
> also like it considered for 3.17-stable.
> 
> 
> The following changes since commit 7965ee93719921ea5978f331da653dfa2d7b99f5:
> 
>   netfilter: nft_compat: fix wrong target lookup in nft_target_select_ops() (2014-10-27 22:17:46 +0100)
> 
> are available in the git repository at:
> 
>   https://git.kernel.org/pub/scm/linux/kernel/git/horms/ipvs.git tags/ipvs-fixes-for-v3.18

Pulled, thanks Simon.

Re: [GIT PULL nf] IPVS Fixes for v3.18

[Pablo Neira Ayuso]

Hi Simon,

On Tue, Oct 28, 2014 at 10:05:33AM +0900, Simon Horman wrote:
> Hi Pablo,
> 
> please consider this fix for v3.18.
> 
> It fixes a null-pointer dereference that may occur when logging
> errors.
> 
> This problem was introduced by 4a4739d56b0 ("ipvs: Pull out
> crosses_local_route_boundary logic") in v3.17-rc5. As such I would
> also like it considered for 3.17-stable.

Regarding your request to pass this to 3.17-stable. According to git
am and my scripts:

3d53666 ipvs: Avoid null-pointer deref in debug code

doesn't apply cleanly 3.17.x. Please re-check and send me a backport if
you want to see this in 3.17.x. Let me know, sorry.

Re: [GIT PULL nf] IPVS Fixes for v3.18

[Simon Horman]

On Tue, Nov 04, 2014 at 06:57:17PM +0100, Pablo Neira Ayuso wrote:
> Hi Simon,
> 
> On Tue, Oct 28, 2014 at 10:05:33AM +0900, Simon Horman wrote:
> > Hi Pablo,
> > 
> > please consider this fix for v3.18.
> > 
> > It fixes a null-pointer dereference that may occur when logging
> > errors.
> > 
> > This problem was introduced by 4a4739d56b0 ("ipvs: Pull out
> > crosses_local_route_boundary logic") in v3.17-rc5. As such I would
> > also like it considered for 3.17-stable.
> 
> Regarding your request to pass this to 3.17-stable. According to git
> am and my scripts:
> 
> 3d53666 ipvs: Avoid null-pointer deref in debug code
> 
> doesn't apply cleanly 3.17.x. Please re-check and send me a backport if
> you want to see this in 3.17.x. Let me know, sorry.

Sorry for creating some confusion here and sorry for not
cleaning it up earlier.

On further inspection I believe that 4a4739d56b0 was included
in v3.18-rc1 rather than v3.17. So this fix is not relevant to
v3.17 after all.