Messages in this thread | | | Date | Wed, 08 Aug 2012 12:49:41 -0700 | From | John Stultz <> | Subject | Re: NULL pointer dereference in selinux_ip_postroute_compat |
| |
On 08/08/2012 12:38 PM, Eric Dumazet wrote: > On Wed, 2012-08-08 at 15:26 -0400, Paul Moore wrote: >> It looks the like there is a bug in ip_send_unicast_reply() which uses a >> inet_sock/sock struct which does not have the LSM data properly initialized. >> >> I'll put together a patch shortly. > Something like this ? > > diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c > index ba39a52..027a331 100644 > --- a/net/ipv4/ip_output.c > +++ b/net/ipv4/ip_output.c > @@ -1524,6 +1524,10 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, > sk->sk_priority = skb->priority; > sk->sk_protocol = ip_hdr(skb)->protocol; > sk->sk_bound_dev_if = arg->bound_dev_if; > +#ifdef CONFIG_SECURITY > + if (!sk->sk_security && security_sk_alloc(sk, PF_INET, GFP_ATOMIC)) > + goto out; > +#endif > sock_net_set(sk, net); > __skb_queue_head_init(&sk->sk_write_queue); > sk->sk_sndbuf = sysctl_wmem_default; > @@ -1539,7 +1543,7 @@ void ip_send_unicast_reply(struct net *net, struct sk_buff *skb, __be32 daddr, > skb_set_queue_mapping(nskb, skb_get_queue_mapping(skb)); > ip_push_pending_frames(sk, &fl4); > } > - > +out: > put_cpu_var(unicast_sock); > > ip_rt_put(rt);
I can't comment on the patch itself, but I tested it against Linus' HEAD and it seems to resolve the oops on shutdown for me.
thanks -john
| |