From: Eric Dumazet <[email protected]> Date: Sat, 04 Feb 2017 11:16:52 -0800
> From: Eric Dumazet <[email protected]> > > Andrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst > is accessed. > > ipv4_pktinfo_prepare() should not drop the dst if (evil) IP options > are present. > > We could refine the test to the presence of ts_needtime or srr, > but IP options are not often used, so let's be conservative. > > Thanks to syzkaller team for finding this bug. > > Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference") > Signed-off-by: Eric Dumazet <[email protected]> > Reported-by: Andrey Konovalov <[email protected]> Applied and queued up for -stable, thanks.
