On Thu, Dec 01, 2016 at 06:34:07AM -0800, Eric Dumazet wrote: > On Thu, 2016-12-01 at 14:06 +0100, Artem Savkov wrote: > > segs needs to be checked for being NULL in ipv6_gso_segment() before calling > > skb_shinfo(segs), otherwise kernel can run into a NULL-pointer dereference: > > > > Signed-off-by: Artem Savkov <asav...@redhat.com> > > --- > > > > > diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c > > index 1fcf61f..89c59e6 100644 > > --- a/net/ipv6/ip6_offload.c > > +++ b/net/ipv6/ip6_offload.c > > @@ -99,7 +99,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff > > *skb, > > segs = ops->callbacks.gso_segment(skb, features); > > } > > > > - if (IS_ERR(segs)) > > + if (IS_ERR_OR_NULL(segs)) > > goto out; > > > > gso_partial = !!(skb_shinfo(segs)->gso_type & SKB_GSO_PARTIAL); > > Do you know when was this bug added ?
It started to show up with 4.9-rc4, from what I see the culprit is 07b26c9 gso: Support partial splitting at the frag_list pointer > Are you sure this is the right fix ? I am not, but this would have the same behavior as pre-07b26c9 code and IS_ERR_OR_NULL is used in ipv4's inet_gso_segment(). > Which gso_segment() is returning NULL exactly ? Unfortunatelly I don't know that and I don't have a good reproducer, the only way to reproduce this that I currently have is calling virt-install. -- Regards, Artem
