* [PATCH net] ipv6: make sure dev is not NULL before call ip6_frag_reasm
@ 2017-05-08 3:09 Hangbin Liu
2017-05-08 14:50 ` Eric Dumazet
0 siblings, 1 reply; 4+ messages in thread
From: Hangbin Liu @ 2017-05-08 3:09 UTC (permalink / raw)
To: netdev; +Cc: Hangbin Liu
Since ip6_frag_reasm() will call __in6_dev_get(dev), which will access
dev->ip6_ptr. We need to make sure dev is not NULL.
Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
---
net/ipv6/reassembly.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index e1da5b8..e3ebd62 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -348,7 +348,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
fq->q.flags |= INET_FRAG_FIRST_IN;
}
- if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
+ if (dev && fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
fq->q.meat == fq->q.len) {
int res;
unsigned long orefdst = skb->_skb_refdst;
--
2.5.5
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: make sure dev is not NULL before call ip6_frag_reasm
2017-05-08 3:09 [PATCH net] ipv6: make sure dev is not NULL before call ip6_frag_reasm Hangbin Liu
@ 2017-05-08 14:50 ` Eric Dumazet
2017-05-09 13:40 ` Hangbin Liu
0 siblings, 1 reply; 4+ messages in thread
From: Eric Dumazet @ 2017-05-08 14:50 UTC (permalink / raw)
To: Hangbin Liu; +Cc: netdev
On Mon, 2017-05-08 at 11:09 +0800, Hangbin Liu wrote:
> Since ip6_frag_reasm() will call __in6_dev_get(dev), which will access
> dev->ip6_ptr. We need to make sure dev is not NULL.
>
> Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> ---
> net/ipv6/reassembly.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
> index e1da5b8..e3ebd62 100644
> --- a/net/ipv6/reassembly.c
> +++ b/net/ipv6/reassembly.c
> @@ -348,7 +348,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
> fq->q.flags |= INET_FRAG_FIRST_IN;
> }
>
> - if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> + if (dev && fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> fq->q.meat == fq->q.len) {
> int res;
> unsigned long orefdst = skb->_skb_refdst;
How dev could be possibly NULL here ?
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: make sure dev is not NULL before call ip6_frag_reasm
2017-05-08 14:50 ` Eric Dumazet
@ 2017-05-09 13:40 ` Hangbin Liu
2017-05-09 15:11 ` Eric Dumazet
0 siblings, 1 reply; 4+ messages in thread
From: Hangbin Liu @ 2017-05-09 13:40 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev
On Mon, May 08, 2017 at 07:50:30AM -0700, Eric Dumazet wrote:
> On Mon, 2017-05-08 at 11:09 +0800, Hangbin Liu wrote:
> > Since ip6_frag_reasm() will call __in6_dev_get(dev), which will access
> > dev->ip6_ptr. We need to make sure dev is not NULL.
> >
> > Signed-off-by: Hangbin Liu <liuhangbin@gmail.com>
> > ---
> > net/ipv6/reassembly.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
> > index e1da5b8..e3ebd62 100644
> > --- a/net/ipv6/reassembly.c
> > +++ b/net/ipv6/reassembly.c
> > @@ -348,7 +348,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
> > fq->q.flags |= INET_FRAG_FIRST_IN;
> > }
> >
> > - if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> > + if (dev && fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> > fq->q.meat == fq->q.len) {
> > int res;
> > unsigned long orefdst = skb->_skb_refdst;
>
>
> How dev could be possibly NULL here ?
I saw we checked the dev in this function
dev = skb->dev;
if (dev) {
fq->iif = dev->ifindex;
skb->dev = NULL;
}
and upper caller ipv6_frag_rcv()
fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr));
Apologise that I did not do enough research to make sure whether skb->dev
could be NULL or not. I will do the check recently and reply when got a
confirmation.
Regards
Hangbin
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH net] ipv6: make sure dev is not NULL before call ip6_frag_reasm
2017-05-09 13:40 ` Hangbin Liu
@ 2017-05-09 15:11 ` Eric Dumazet
0 siblings, 0 replies; 4+ messages in thread
From: Eric Dumazet @ 2017-05-09 15:11 UTC (permalink / raw)
To: Hangbin Liu; +Cc: netdev
On Tue, 2017-05-09 at 21:40 +0800, Hangbin Liu wrote:
>
> I saw we checked the dev in this function
>
> dev = skb->dev;
> if (dev) {
> fq->iif = dev->ifindex;
> skb->dev = NULL;
> }
>
> and upper caller ipv6_frag_rcv()
>
> fq = fq_find(net, fhdr->identification, &hdr->saddr, &hdr->daddr,
> skb->dev ? skb->dev->ifindex : 0, ip6_frag_ecn(hdr));
>
>
> Apologise that I did not do enough research to make sure whether skb->dev
> could be NULL or not. I will do the check recently and reply when got a
> confirmation.
If really having a NULL dev is possible, I would rather change things
this way, as your fix has side effects.
diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
index e1da5b888cc4901711d573075f8ae4eada7f086e..6c0a2b74ba705cbe13b4e7522d958a9c3d395c29 100644
--- a/net/ipv6/reassembly.c
+++ b/net/ipv6/reassembly.c
@@ -77,7 +77,7 @@ static u8 ip6_frag_ecn(const struct ipv6hdr *ipv6h)
static struct inet_frags ip6_frags;
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
- struct net_device *dev);
+ struct net_device *dev, struct inet6_dev *idev);
/*
* callers should be careful not to use the hash value outside the ipfrag_lock
@@ -209,6 +209,7 @@ fq_find(struct net *net, __be32 id, const struct in6_addr *src,
static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
struct frag_hdr *fhdr, int nhoff)
{
+ struct inet6_dev *idev = ip6_dst_idev(skb_dst(skb));
struct sk_buff *prev, *next;
struct net_device *dev;
int offset, end, fragsize;
@@ -223,8 +224,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
((u8 *)(fhdr + 1) - (u8 *)(ipv6_hdr(skb) + 1)));
if ((unsigned int)end > IPV6_MAXPLEN) {
- __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
- IPSTATS_MIB_INHDRERRORS);
+ __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
((u8 *)&fhdr->frag_off -
skb_network_header(skb)));
@@ -258,8 +258,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
/* RFC2460 says always send parameter problem in
* this case. -DaveM
*/
- __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
- IPSTATS_MIB_INHDRERRORS);
+ __IP6_INC_STATS(net, idev, IPSTATS_MIB_INHDRERRORS);
icmpv6_param_prob(skb, ICMPV6_HDR_FIELD,
offsetof(struct ipv6hdr, payload_len));
return -1;
@@ -354,7 +353,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
unsigned long orefdst = skb->_skb_refdst;
skb->_skb_refdst = 0UL;
- res = ip6_frag_reasm(fq, prev, dev);
+ res = ip6_frag_reasm(fq, prev, dev, idev);
skb->_skb_refdst = orefdst;
return res;
}
@@ -365,8 +364,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
discard_fq:
inet_frag_kill(&fq->q, &ip6_frags);
err:
- __IP6_INC_STATS(net, ip6_dst_idev(skb_dst(skb)),
- IPSTATS_MIB_REASMFAILS);
+ __IP6_INC_STATS(net, idev, IPSTATS_MIB_REASMFAILS);
kfree_skb(skb);
return -1;
}
@@ -381,7 +379,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct sk_buff *skb,
* the last and the first frames arrived and all the bits are here.
*/
static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
- struct net_device *dev)
+ struct net_device *dev, struct inet6_dev *idev)
{
struct net *net = container_of(fq->q.net, struct net, ipv6.frags);
struct sk_buff *fp, *head = fq->q.fragments;
@@ -505,9 +503,7 @@ static int ip6_frag_reasm(struct frag_queue *fq, struct sk_buff *prev,
skb_postpush_rcsum(head, skb_network_header(head),
skb_network_header_len(head));
- rcu_read_lock();
- __IP6_INC_STATS(net, __in6_dev_get(dev), IPSTATS_MIB_REASMOKS);
- rcu_read_unlock();
+ __IP6_INC_STATS(net, idev, IPSTATS_MIB_REASMOKS);
fq->q.fragments = NULL;
fq->q.fragments_tail = NULL;
return 1;
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2017-05-09 15:11 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-05-08 3:09 [PATCH net] ipv6: make sure dev is not NULL before call ip6_frag_reasm Hangbin Liu
2017-05-08 14:50 ` Eric Dumazet
2017-05-09 13:40 ` Hangbin Liu
2017-05-09 15:11 ` Eric Dumazet
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.