Subject: Re: [PATCH 3/3] xfrm: Fix null pointer dereference when decoding sessions

From: Matthias Schiffer <[email-masked]>
Date: Sun, 01 Dec 2013 05:19:53 +0100

On 11/24/2013 03:27 PM, Matthias Schiffer wrote:
> On 11/01/2013 09:21 AM, Steffen Klassert wrote:
>> On some codepaths the skb does not have a dst entry
>> when xfrm_decode_session() is called. So check for
>> a valid skb_dst() before dereferencing the device
>> interface index. We use 0 as the device index if
>> there is no valid skb_dst(), or at reverse decoding
>> we use skb_iif as device interface index.
>>
>> Bug was introduced with git commit bafd4bd4dc
>> ("xfrm: Decode sessions with output interface.").
>>
>> Reported-by: Meelis Roos <[email-masked]>
>> Tested-by: Meelis Roos <[email-masked]>
>> Signed-off-by: Steffen Klassert <[email-masked]>
> 
> Please queue this for 3.12-stable, I've seen this bug trigger a panic
> when heavily using Bittorrent (screenshot:
> http://i.imgur.com/OIKVccM.jpg )
> 
> Thanks,
> Matthias
> 

Ping? Several people I know have hit this panic with 3.12.x at least
once or twice by now during heavy IPv6 usage.