All of lore.kernel.org
 help / color / mirror / Atom feed
From: Florian Westphal <fw@strlen.de>
To: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Roy Keene <lkml@rkeene.org>,
	netdev@vger.kernel.org, netfilter-devel@vger.kernel.org
Subject: Re: ip_rcv_finish() NULL pointer kernel panic
Date: Thu, 26 Jan 2017 17:24:33 +0100	[thread overview]
Message-ID: <20170126162433.GB1778@breakpoint.cc> (raw)
In-Reply-To: <1485446279.5145.141.camel@edumazet-glaptop3.roam.corp.google.com>

Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > Though possibly with different things not setting the "input" function 
> > pointer in the "struct dst_entry".
> > 
> > include/net/dst.h:
> >   496 static inline int dst_input(struct sk_buff *skb) {
> >   498         return skb_dst(skb)->input(skb);
> >   499 }
> > 
> > Is there any reason not to check to see if this pointer is NULL before 
> > blindly calling it ?
> 
> Sure. It can not be NULL at this point.
> 
> Just look at the code in ip_rcv_finish() :
> 
> It first make sure to get a valid dst.
> 
> Something is broken, probably in bridge netfilter code.
> 
> I suspect the dst here points to &br->fake_rtable, and this is not
> expected.
> 
> br_drop_fake_rtable() should have been called somewhere ...

I think it makes sense to set dst->incoming
to a stub in br_netfilter_rtable_init() to just kfree_skb()+
WARN_ON_ONCE(), no need to add code to ip stack or crash kernel
due to brnf bug.

  parent reply	other threads:[~2017-01-26 16:24 UTC|newest]

Thread overview: 13+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2017-01-26 12:28 ip_rcv_finish() NULL pointer kernel panic Roy Keene
2017-01-26 15:32 ` Roy Keene
2017-01-26 15:57   ` Eric Dumazet
2017-01-26 16:02     ` Roy Keene
2017-01-26 16:24     ` Florian Westphal [this message]
2017-01-26 18:00       ` Eric Dumazet
2017-01-26 18:14         ` Eric Dumazet
2017-01-26 18:04       ` David Miller
2017-03-13 17:30         ` Dan Streetman
2017-03-13 17:39           ` Florian Westphal
  -- strict thread matches above, loose matches on Subject: below --
2017-01-25 22:21 Roy Keene
2017-01-25 22:02 Roy Keene
2017-01-25 22:02 Roy Keene

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20170126162433.GB1778@breakpoint.cc \
    --to=fw@strlen.de \
    --cc=eric.dumazet@gmail.com \
    --cc=lkml@rkeene.org \
    --cc=netdev@vger.kernel.org \
    --cc=netfilter-devel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.