git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From bbf31bf18d34caa87dd01f08bf713635593697f2 Mon Sep 17 00:00:00 2001
   2 From: David Ford <david@blue-labs.org>
   3 Date: Sun, 29 Nov 2009 23:02:22 -0800
   4 Subject: ipv4: additional update of dev_net(dev) to struct *net in ip_fragment.c, NULL ptr OOPS
   5
   6 From: David Ford <david@blue-labs.org>
   7
   8 commit bbf31bf18d34caa87dd01f08bf713635593697f2 upstream.
   9
  10 ipv4 ip_frag_reasm(), fully replace 'dev_net(dev)' with 'net', defined
  11 previously patched into 2.6.29.
  12
  13 Between 2.6.28.10 and 2.6.29, net/ipv4/ip_fragment.c was patched,
  14 changing from dev_net(dev) to container_of(...).  Unfortunately the goto
  15 section (out_fail) on oversized packets inside ip_frag_reasm() didn't
  16 get touched up as well.  Oversized IP packets cause a NULL pointer
  17 dereference and immediate hang.
  18
  19 I discovered this running openvasd and my previous email on this is
  20 titled:  NULL pointer dereference at 2.6.32-rc8:net/ipv4/ip_fragment.c:566
  21
  22 Signed-off-by: David Ford <david@blue-labs.org>
  23 Signed-off-by: David S. Miller <davem@davemloft.net>
  24 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  25
  26 ---
  27  net/ipv4/ip_fragment.c |    2 +-
  28  1 file changed, 1 insertion(+), 1 deletion(-)
  29
  30 --- a/net/ipv4/ip_fragment.c
  31 +++ b/net/ipv4/ip_fragment.c
  32 @@ -563,7 +563,7 @@ out_oversize:
  33                         "Oversized IP packet from " NIPQUAD_FMT ".\n",
  34                         NIPQUAD(qp->saddr));
  35  out_fail:
  36 -       IP_INC_STATS_BH(dev_net(dev), IPSTATS_MIB_REASMFAILS);
  37 +       IP_INC_STATS_BH(net, IPSTATS_MIB_REASMFAILS);
  38         return err;
  39  }
  40