ipv6: fix crash over flow-based vxlan device (48fb6b55) · Commits · 戴 / test

Similar check was added in ip_rcv but not in ipv6_rcv. BUG: unable to handle kernel NULL pointer dereference at (null) IP: [<ffffffff81734e0a>] ipv6_rcv+0xfa/0x500 Call Trace: [<ffffffff816c9786>] ? ip_rcv+0x296/0x400 [<ffffffff817732d2>] ? packet_rcv+0x52/0x410 [<ffffffff8168e99f>] __netif_receive_skb_core+0x63f/0x9a0 [<ffffffffc02b34a0>] ? br_handle_frame_finish+0x580/0x580 [bridge] [<ffffffff8109912c>] ? update_rq_clock.part.81+0x1c/0x40 [<ffffffff8168ed18>] __netif_receive_skb+0x18/0x60 [<ffffffff8168fa1f>] process_backlog+0x9f/0x150 Fixes: (vxlan: Flow based tunneling) Signed-off-by:

Wei-Chun Chao <weichunc@plumgrid.com> Acked-by:

Thomas Graf <tgraf@suug.ch> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv6/ip6_input.c

+3 −2

Original line number	Diff line number	Diff line
		@@ -45,6 +45,7 @@
		#include <net/addrconf.h>
		#include <net/xfrm.h>
		#include <net/inet_ecn.h>
		#include <net/dst_metadata.h>

		int ip6_rcv_finish(struct sock sk, struct sk_buff skb)
		{
		@@ -55,7 +56,7 @@ int ip6_rcv_finish(struct sock sk, struct sk_buff skb)
		if (ipprot && ipprot->early_demux)
		ipprot->early_demux(skb);
		}
		if (!skb_dst(skb))
		if (!skb_valid_dst(skb))
		ip6_route_input(skb);

		return dst_input(skb);
		@@ -98,7 +99,7 @@ int ipv6_rcv(struct sk_buff skb, struct net_device dev, struct packet_type *pt
		* arrived via the sending interface (ethX), because of the
		* nature of scoping architecture. --yoshfuji
		*/
		IP6CB(skb)->iif = skb_dst(skb) ? ip6_dst_idev(skb_dst(skb))->dev->ifindex : dev->ifindex;
		IP6CB(skb)->iif = skb_valid_dst(skb) ? ip6_dst_idev(skb_dst(skb))->dev->ifindex : dev->ifindex;

		if (unlikely(!pskb_may_pull(skb, sizeof(*hdr))))
		goto err;

Admin message