Subject: Re: [PATCH 3/3] xfrm: Fix null pointer dereference when decoding sessions

From: Matthias Schiffer <[email-masked]>
Date: Sun, 24 Nov 2013 15:27:58 +0100

On 11/01/2013 09:21 AM, Steffen Klassert wrote:
> On some codepaths the skb does not have a dst entry
> when xfrm_decode_session() is called. So check for
> a valid skb_dst() before dereferencing the device
> interface index. We use 0 as the device index if
> there is no valid skb_dst(), or at reverse decoding
> we use skb_iif as device interface index.
> 
> Bug was introduced with git commit bafd4bd4dc
> ("xfrm: Decode sessions with output interface.").
> 
> Reported-by: Meelis Roos <[email-masked]>
> Tested-by: Meelis Roos <[email-masked]>
> Signed-off-by: Steffen Klassert <[email-masked]>

Please queue this for 3.12-stable, I've seen this bug trigger a panic
when heavily using Bittorrent (screenshot:
http://i.imgur.com/OIKVccM.jpg )

Thanks,
Matthias