This is a note to let you know that I've just added the patch titled
icmp: Fix regression in nexthop resolution during replies.
to the 3.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
icmp-fix-regression-in-nexthop-resolution-during-replies.patch
and it can be found in the queue-3.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <sta...@kernel.org> know about it.
>From c867a9d829b436ca130d08c04d7c1e549e263366 Mon Sep 17 00:00:00 2001
From: "David S. Miller" <da...@davemloft.net>
Date: Fri, 22 Jul 2011 06:22:10 -0700
Subject: icmp: Fix regression in nexthop resolution during replies.
From: "David S. Miller" <da...@davemloft.net>
[ Upstream commit 415b3334a21aa67806c52d1acf4e72e14f7f402f ]
icmp_route_lookup() uses the wrong flow parameters if the reverse
session route lookup isn't used.
So do not commit to the re-decoded flow until we actually make a
final decision to use a real route saved in 'rt2'.
Reported-by: Florian Westphal <f...@strlen.de>
Signed-off-by: David S. Miller <da...@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gre...@suse.de>
---
net/ipv4/icmp.c | 14 ++++++++------
1 file changed, 8 insertions(+), 6 deletions(-)
--- a/net/ipv4/icmp.c
+++ b/net/ipv4/icmp.c
@@ -380,6 +380,7 @@ static struct rtable *icmp_route_lookup(
struct icmp_bxm *param)
{
struct rtable *rt, *rt2;
+ struct flowi4 fl4_dec;
int err;
memset(fl4, 0, sizeof(*fl4));
@@ -408,19 +409,19 @@ static struct rtable *icmp_route_lookup(
} else
return rt;
- err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(fl4),
AF_INET);
+ err = xfrm_decode_session_reverse(skb_in, flowi4_to_flowi(&fl4_dec),
AF_INET);
if (err)
goto relookup_failed;
- if (inet_addr_type(net, fl4->saddr) == RTN_LOCAL) {
- rt2 = __ip_route_output_key(net, fl4);
+ if (inet_addr_type(net, fl4_dec.saddr) == RTN_LOCAL) {
+ rt2 = __ip_route_output_key(net, &fl4_dec);
if (IS_ERR(rt2))
err = PTR_ERR(rt2);
} else {
struct flowi4 fl4_2 = {};
unsigned long orefdst;
- fl4_2.daddr = fl4->saddr;
+ fl4_2.daddr = fl4_dec.saddr;
rt2 = ip_route_output_key(net, &fl4_2);
if (IS_ERR(rt2)) {
err = PTR_ERR(rt2);
@@ -428,7 +429,7 @@ static struct rtable *icmp_route_lookup(
}
/* Ugh! */
orefdst = skb_in->_skb_refdst; /* save old refdst */
- err = ip_route_input(skb_in, fl4->daddr, fl4->saddr,
+ err = ip_route_input(skb_in, fl4_dec.daddr, fl4_dec.saddr,
RT_TOS(tos), rt2->dst.dev);
dst_release(&rt2->dst);
@@ -440,10 +441,11 @@ static struct rtable *icmp_route_lookup(
goto relookup_failed;
rt2 = (struct rtable *) xfrm_lookup(net, &rt2->dst,
- flowi4_to_flowi(fl4), NULL,
+ flowi4_to_flowi(&fl4_dec), NULL,
XFRM_LOOKUP_ICMP);
if (!IS_ERR(rt2)) {
dst_release(&rt->dst);
+ memcpy(fl4, &fl4_dec, sizeof(*fl4));
rt = rt2;
} else if (PTR_ERR(rt2) == -EPERM) {
if (rt)
Patches currently in stable-queue which might be from da...@davemloft.net are
queue-3.0/ipv4-send-gratuitous-arp-for-secondary-ip-addresses-also.patch
queue-3.0/ipv4-constrain-ufo-fragment-sizes-to-multiples-of-8-bytes.patch
queue-3.0/bonding-fix-string-comparison-errors.patch
queue-3.0/drivers-net-niu.c-adjust-array-index.patch
queue-3.0/net-audit-drivers-to-identify-those-needing-iff_tx_skb_sharing-cleared.patch
queue-3.0/ipv4-use-rt_tos-after-some-rt_tos-conversions.patch
queue-3.0/net-cap-number-of-elements-for-sendmmsg.patch
queue-3.0/sch_sfq-fix-sfq_enqueue.patch
queue-3.0/net-fix-security_socket_sendmsg-bypass-problem.patch
queue-3.0/0002-net-Compute-protocol-sequence-numbers-and-fragment-I.patch
queue-3.0/fix-cdc-phonet-build.patch
queue-3.0/ipv4-fix-the-reusing-of-routing-cache-entries.patch
queue-3.0/ipv6-make-fragment-identifications-less-predictable.patch
queue-3.0/sis190-rx-filter-init-is-needed-for-mac-address-change.patch
queue-3.0/net-adjust-array-index.patch
queue-3.0/net-allow-netif_carrier-to-be-called-safely-from-irq.patch
queue-3.0/icmp-fix-regression-in-nexthop-resolution-during-replies.patch
queue-3.0/xfrm-fix-key-lengths-for-rfc3686-ctr-aes.patch
queue-3.0/0001-crypto-Move-md5_transform-to-lib-md5.c.patch
queue-3.0/gre-fix-improper-error-handling.patch
queue-3.0/net-add-iff_skb_tx_shared-flag-to-priv_flags.patch
queue-3.0/r8169-add-support-for-d-link-530t-rev-c1-kernel-bug-38862.patch
queue-3.0/net-sendmmsg-should-only-return-an-error-if-no-messages-were-sent.patch
_______________________________________________
stable mailing list
stable@linux.kernel.org
http://linux.kernel.org/mailman/listinfo/stable
