* [IPV4]: route: fix crash ip_route_input
@ 2008-02-06 13:36 Patrick McHardy
2008-02-08 1:58 ` David Miller
0 siblings, 1 reply; 2+ messages in thread
From: Patrick McHardy @ 2008-02-06 13:36 UTC (permalink / raw)
To: David S. Miller
Cc: Netfilter Development Mailinglist, Denis V. Lunev,
Linux Netdev List
[-- Attachment #1: Type: text/plain, Size: 0 bytes --]
[-- Attachment #2: 05.diff --]
[-- Type: text/x-patch, Size: 1015 bytes --]
commit dad61a4af7d23146ce67ec2f069f6ba9b75a578d
Author: Patrick McHardy <kaber@trash.net>
Date: Wed Feb 6 14:35:11 2008 +0100
[IPV4]: route: fix crash ip_route_input
ip_route_me_harder() may call ip_route_input() with skbs that don't
have skb->dev set for skbs rerouted in LOCAL_OUT and TCP resets
generated by the REJECT target, resulting in a crash when dereferencing
skb->dev->nd_net. Since ip_route_input() has an input device argument,
it seems correct to use that one anyway.
Bug introduced in b5921910a1 (Routing cache virtualization).
Signed-off-by: Patrick McHardy <kaber@trash.net>
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 8842ecb..525787b 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2041,7 +2041,7 @@ int ip_route_input(struct sk_buff *skb, __be32 daddr, __be32 saddr,
int iif = dev->ifindex;
struct net *net;
- net = skb->dev->nd_net;
+ net = dev->nd_net;
tos &= IPTOS_RT_MASK;
hash = rt_hash(daddr, saddr, iif);
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [IPV4]: route: fix crash ip_route_input
2008-02-06 13:36 [IPV4]: route: fix crash ip_route_input Patrick McHardy
@ 2008-02-08 1:58 ` David Miller
0 siblings, 0 replies; 2+ messages in thread
From: David Miller @ 2008-02-08 1:58 UTC (permalink / raw)
To: kaber; +Cc: netfilter-devel, den, netdev
From: Patrick McHardy <kaber@trash.net>
Date: Wed, 06 Feb 2008 14:36:57 +0100
> [IPV4]: route: fix crash ip_route_input
>
> ip_route_me_harder() may call ip_route_input() with skbs that don't
> have skb->dev set for skbs rerouted in LOCAL_OUT and TCP resets
> generated by the REJECT target, resulting in a crash when dereferencing
> skb->dev->nd_net. Since ip_route_input() has an input device argument,
> it seems correct to use that one anyway.
>
> Bug introduced in b5921910a1 (Routing cache virtualization).
>
> Signed-off-by: Patrick McHardy <kaber@trash.net>
Applied, thanks Patrick.
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2008-02-08 1:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2008-02-06 13:36 [IPV4]: route: fix crash ip_route_input Patrick McHardy
2008-02-08 1:58 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).