On Tue, Apr 19, 2011 at 10:01:12AM -0700, Stephen Hemminger wrote: > On Tue, 19 Apr 2011 09:20:36 -0700 > Greg KH <[email protected]> wrote: > > > On Thu, Apr 14, 2011 at 05:12:04PM -0700, Stephen Hemminger wrote: > > > On Thu, 14 Apr 2011 16:41:20 -0700 > > > <[email protected]> wrote: > > > > > > > > > > > This is a note to let you know that I've just added the patch titled > > > > > > > > bridge: Reset IPCB when entering IP stack on NF_FORWARD > > > > > > > > to the 2.6.38-stable tree which can be found at: > > > > > > > > http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary > > > > > > > > The filename of the patch is: > > > > bridge-reset-ipcb-when-entering-ip-stack-on-nf_forward.patch > > > > and it can be found in the queue-2.6.38 subdirectory. > > > > > > > > If you, or anyone else, feels it should not be added to the stable tree, > > > > please let <[email protected]> know about it. > > > > > > > > > > > > From 0589d1f7a527e5f4c4c6d16b734cfed4e3608f1c Mon Sep 17 00:00:00 2001 > > > > From: Herbert Xu <[email protected]> > > > > Date: Fri, 18 Mar 2011 05:27:28 +0000 > > > > Subject: bridge: Reset IPCB when entering IP stack on NF_FORWARD > > > > > > > > > > > > From: Herbert Xu <[email protected]> > > > > > > > > [ Upstream commit 6b1e960fdbd75dcd9bcc3ba5ff8898ff1ad30b6e ] > > > > > > > > Whenever we enter the IP stack proper from bridge netfilter we > > > > need to ensure that the skb is in a form the IP stack expects > > > > it to be in. > > > > > > > > The entry point on NF_FORWARD did not meet the requirements of > > > > the IP stack, therefore leading to potential crashes/panics. > > > > > > > > This patch fixes the problem. > > > > > > > > Signed-off-by: Herbert Xu <[email protected]> > > > > Acked-by: Stephen Hemminger <[email protected]> > > > > Signed-off-by: David S. Miller <[email protected]> > > > > Signed-off-by: Greg Kroah-Hartman <[email protected]> > > > > > > There was recent followon patches to fix problems introduced > > > by this problems. The parse code would crash when handed record > > > route option but there was no route in this path. > > > > Any hint as to what the git commit ids were of the patches that fixed > > these issues that I should also queue up now? > > > > thanks, > > > > greg k-h > > Stable needs these two follow on patches. To prevent crash when > receiving packet with IP record route options. > > commit f8e9881c2aef1e982e5abc25c046820cd0b7cf64 > Author: Eric Dumazet <[email protected]> > Date: Tue Apr 12 13:39:14 2011 -0700 > > bridge: reset IPCB in br_parse_ip_options > > Commit 462fb2af9788a82 (bridge : Sanitize skb before it enters the IP > stack), missed one IPCB init before calling ip_options_compile() > > Thanks to Scot Doyle for his tests and bug reports. > > Reported-by: Scot Doyle <[email protected]> > Signed-off-by: Eric Dumazet <[email protected]> > Cc: Hiroaki SHIMODA <[email protected]> > Acked-by: Bandan Das <[email protected]> > Acked-by: Stephen Hemminger <[email protected]> > Cc: Jan Lübbe <[email protected]> > Signed-off-by: David S. Miller <[email protected]>
This isn't in Linus's tree yet :( > > Author: Eric Dumazet <[email protected]> > Date: Thu Apr 14 05:55:37 2011 +0000 > > ip: ip_options_compile() resilient to NULL skb route > > Scot Doyle demonstrated ip_options_compile() could be called with an skb > without an attached route, using a setup involving a bridge, netfilter, > and forged IP packets. > > Let's make ip_options_compile() and ip_options_rcv_srr() a bit more > robust, instead of changing bridge/netfilter code. > > With help from Hiroaki SHIMODA. > > Reported-by: Scot Doyle <[email protected]> > Tested-by: Scot Doyle <[email protected]> > Signed-off-by: Eric Dumazet <[email protected]> > Cc: Stephen Hemminger <[email protected]> > Acked-by: Hiroaki SHIMODA <[email protected]> > Signed-off-by: David S. Miller <[email protected]> What is the git commit id of this one? thanks, greg k-h _______________________________________________ stable mailing list [email protected] http://linux.kernel.org/mailman/listinfo/stable
