Commit 2570a4f5 authored Jan 13, 2010 by David S. Miller

ipv6: skb_dst() can be NULL in ipv6_hop_jumbo().



This fixes CERT-FI FICORA #341748

Discovered by Olli Jarva and Tuomo Untinen from the CROSS
project at Codenomicon Ltd.

Just like in CVE-2007-4567, we can't rely upon skb_dst() being
non-NULL at this point.  We fixed that in commit
e76b2b25 ("[IPV6]: Do no rely on
skb->dst before it is assigned.")

However commit 483a47d2 ("ipv6: added
net argument to IP6_INC_STATS_BH") put a new version of the same bug
into this function.

Complicating analysis further, this bug can only trigger when network
namespaces are enabled in the build.  When namespaces are turned off,
the dev_net() does not evaluate it's argument, so the dereference
would not occur.

So, for a long time, namespaces couldn't be turned on unless SYSFS was
disabled.  Therefore, this code has largely been disabled except by
people turning it on explicitly for namespace development.

With help from Eugene Teo <eugene@redhat.com>

Signed-off-by: David S. Miller <davem@davemloft.net>

parent ba5b0bfa

net/ipv6/exthdrs.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -559,6 +559,11 @@ static inline struct inet6_dev ipv6_skb_idev(struct sk_buff skb)
		return skb_dst(skb) ? ip6_dst_idev(skb_dst(skb)) : __in6_dev_get(skb->dev);
		}

		static inline struct net ipv6_skb_net(struct sk_buff skb)
		{
		return skb_dst(skb) ? dev_net(skb_dst(skb)->dev) : dev_net(skb->dev);
		}

		/* Router Alert as of RFC 2711 */

		static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
		@@ -580,8 +585,8 @@ static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
		static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
		{
		const unsigned char *nh = skb_network_header(skb);
		struct net *net = ipv6_skb_net(skb);
		u32 pkt_len;
		struct net *net = dev_net(skb_dst(skb)->dev);

		if (nh[optoff + 1] != 4 \|\| (optoff & 3) != 2) {
		LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",

Admin message