• A
    xfrm: fix xfrm_input/xfrm_tunnel_check oops · 68c11e98
    Alexey Dobriyan 提交于
    https://bugzilla.kernel.org/show_bug.cgi?id=95211
    
    Commit 70be6c91
    ("xfrm: Add xfrm_tunnel_skb_cb to the skb common buffer") added check
    which dereferences ->outer_mode too early but larval SAs don't have
    this pointer set (yet). So check for tunnel stuff later.
    
    Mike Noordermeer reported this bug and patiently applied all the debugging.
    
    Technically this is remote-oops-in-interrupt-context type of thing.
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000034
    IP: [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0
    	...
    [<ffffffff81500fc6>] ? xfrm4_esp_rcv+0x36/0x70
    [<ffffffff814acc9a>] ? ip_local_deliver_finish+0x9a/0x200
    [<ffffffff81471b83>] ? __netif_receive_skb_core+0x6f3/0x8f0
    	...
    
    RIP  [<ffffffff8150dca2>] xfrm_input+0x3c2/0x5a0
    Kernel panic - not syncing: Fatal exception in interrupt
    Signed-off-by: NAlexey Dobriyan <adobriyan@gmail.com>
    Signed-off-by: NSteffen Klassert <steffen.klassert@secunet.com>
    68c11e98
xfrm_input.c 8.5 KB