Subject: Re: [PATCH] Prevent crash on ip_conntrack removal

From: "David S. Miller" <[email-masked]>
Date: Sat, 21 Aug 2004 22:13:44 -0700

On Sat, 21 Aug 2004 17:10:20 +0200
Patrick McHardy <[email-masked]> wrote:

> David S. Miller wrote:
> 
> >I have a better idea.
> >
> >Instead of setting skb->dst to NULL, it should set it to some
> >NULL destination entry which just frees up the packets.  Then
> >no special case handling.  skb->dst==NULL packets should never
> >get into the fragment queue to begin with.
> >
> The problem is that conntrack unload can cause packets without a
> dst_entry to appear in ip_local_deliver, which is already after
> the call to dst_input.

How can it call ip_local_deliver() without a valid skb->dst?
That function is only invoked via skb->dst->input(skb) which
by implication means that skb->dst is non-NULL.

Actually there is a call via ip_mr_input() but that code also
has a precondition that skb->dst is non-NULL too.  I say this
due to the unchecked skb->dst accesses it makes early on.

Please explain.  I don't question that it happens, just show
me how :-)