From: Eric Dumazet <eric.duma...@gmail.com>
Date: Sat, 04 Feb 2017 11:16:52 -0800
> From: Eric Dumazet <eduma...@google.com>
>
> Andrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst
> is accessed.
>
> ipv4_pktinfo_prepare() should not drop the dst if (evil) IP options
> are present.
>
> We could refine the test to the presence of ts_needtime or srr,
> but IP options are not often used, so let's be conservative.
>
> Thanks to syzkaller team for finding this bug.
>
> Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Reported-by: Andrey Konovalov <andreyk...@google.com>
Applied and queued up for -stable, thanks.
