public inbox for netdev@vger.kernel.org 
 help / color / mirror / Atom feed
From: Bandan Das <bandan.das@stratus•com>
To: NetDev <netdev@vger•kernel.org>
Cc: akpm@linux-foundation•org, tom@dbservice•com,
	Eric Dumazet <eric.dumazet@gmail•com>
Subject: Re: [Bugme-new] [Bug 33842] New: NULL pointer dereference in ip_fragment
Date: Tue, 26 Apr 2011 16:31:54 -0400	[thread overview]
Message-ID: <20110426203154.GM15903@stratus.com> (raw)

https://bugzilla.kernel.org/show_bug.cgi?id=33842

I believe  Eric's recent change to br_parse_ip_options() 
didn't make it to 2.6.39-rc4:

bridge: reset IPCB in br_parse_ip_options
commit f8e9881c2aef1e982e5abc25c046820cd0b7cf64

diff --git a/net/bridge/br_netfilter.c b/net/bridge/br_netfilter.c
index 008ff6c..b353f7c 100644
--- a/net/bridge/br_netfilter.c
+++ b/net/bridge/br_netfilter.c
@@ -249,11 +249,9 @@  static int br_parse_ip_options(struct sk_buff *skb)
           goto drop;
           }
 
-       /* Zero out the CB buffer if no options present */
-       if (iph->ihl == 5) {
-          memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+          memset(IPCB(skb), 0, sizeof(struct inet_skb_parm));
+          if (iph->ihl == 5)
              return 0;
-             }
 
        opt->optlen = iph->ihl*4 - sizeof(struct iphdr);
        if (ip_options_compile(dev_net(dev), opt, skb))



Tomas, could you please try a kernel that has the above 
mentioned change and see if the crash re-occurs ?

Thanks,
Bandan

             reply	other threads:[~2011-04-26 20:32 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-04-26 20:31 Bandan Das [this message]
2011-04-26 20:46 ` [Bugme-new] [Bug 33842] New: NULL pointer dereference in ip_fragment David Miller
2011-04-26 20:53   ` Eric Dumazet
2011-04-26 20:59     ` Bandan Das
2011-04-26 21:01       ` Eric Dumazet
2011-04-26 21:19         ` Bandan Das
2011-04-26 21:24           ` Eric Dumazet
2011-04-27  7:22             ` Tomas Carnecky
2011-04-27  7:41               ` Eric Dumazet
2011-04-27 11:52                 ` Tomas Carnecky
2011-04-27 12:17                   ` Eric Dumazet
     [not found] <bug-33842-10286@https.bugzilla.kernel.org/>
2011-04-26  4:29 ` Andrew Morton

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20110426203154.GM15903@stratus.com \
    --to=bandan.das@stratus$(echo .)com \
    --cc=akpm@linux-foundation$(echo .)org \
    --cc=eric.dumazet@gmail$(echo .)com \
    --cc=netdev@vger$(echo .)kernel.org \
    --cc=tom@dbservice$(echo .)com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox