Re: net/icmp: null-ptr-deref in icmp6_send

2016-11-22 Thread David Ahern
On 11/22/16 1:11 PM, Cong Wang wrote: > I have no idea what commit 5d41ce29e tried to fix, but we already > use skb->dev a few lines before l3mdev_master_ifindex(), so I don't > understand why skb->dev could be NULL, maybe just for vrf dev? skb->dev can be null depending on when icmp6_send / icmpv

Re: net/icmp: null-ptr-deref in icmp6_send

2016-11-22 Thread David Ahern
Sent from my iPhone > On Nov 22, 2016, at 1:11 PM, Cong Wang wrote: > >> On Tue, Nov 22, 2016 at 2:23 AM, Andrey Konovalov >> wrote: >> Hi, >> >> I've got the following error report while fuzzing the kernel with syzkaller. >> >> It seems that skb_dst(skb) may end up being NULL. >> >> As f

Re: net/icmp: null-ptr-deref in icmp6_send

2016-11-22 Thread Cong Wang
On Tue, Nov 22, 2016 at 2:23 AM, Andrey Konovalov wrote: > Hi, > > I've got the following error report while fuzzing the kernel with syzkaller. > > It seems that skb_dst(skb) may end up being NULL. > > As far as I can see the bug was introduced in commit 5d41ce29e ("net: > icmp6_send should use ds