WSL2-Linux-Kernel/drivers/net
Paolo Abeni 22f0708a71 vxlan: fix oops in dev_fill_metadata_dst
Since the commit 0c1d70af92 ("net: use dst_cache for vxlan device")
vxlan_fill_metadata_dst() calls vxlan_get_route() passing a NULL
dst_cache pointer, so the latter should explicitly check for
valid dst_cache ptr. Unfortunately the commit d71785ffc7 ("net: add
dst_cache to ovs vxlan lwtunnel") removed said check.

As a result is possible to trigger a null pointer access calling
vxlan_fill_metadata_dst(), e.g. with:

ovs-vsctl add-br ovs-br0
ovs-vsctl add-port ovs-br0 vxlan0 -- set interface vxlan0 \
	type=vxlan options:remote_ip=192.168.1.1 \
	options:key=1234 options:dst_port=4789 ofport_request=10
ip address add dev ovs-br0 172.16.1.2/24
ovs-vsctl set Bridge ovs-br0 ipfix=@i -- --id=@i create IPFIX \
	targets=\"172.16.1.1:1234\" sampling=1
iperf -c 172.16.1.1 -u -l 1000 -b 10M -t 1 -p 1234

This commit addresses the issue passing to vxlan_get_route() the
dst_cache already available into the lwt info processed by
vxlan_fill_metadata_dst().

Fixes: d71785ffc7 ("net: add dst_cache to ovs vxlan lwtunnel")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-02-17 15:32:06 -05:00
..
appletalk
arcnet
bonding
caif
can
cris
dsa
ethernet dpaa_eth: small leak on error 2017-02-17 12:18:43 -05:00
fddi
fjes
hamradio NET: mkiss: Fix panic 2017-02-10 13:41:13 -05:00
hippi
hyperv
ieee802154
ipvlan
irda
phy net: phy: Initialize mdio clock at probe function 2017-02-09 17:10:23 -05:00
plip
ppp
slip
team
usb sierra_net: Skip validating irrelevant fields for IDLE LSIs 2017-02-09 16:41:43 -05:00
vmxnet3
wan
wimax
wireless
xen-netback xen-netback: vif counters from int/long to u64 2017-02-13 21:49:53 -05:00
Kconfig
LICENSE.SRC
Makefile
Space.c
dummy.c
eql.c
geneve.c
gtp.c
ifb.c
loopback.c net: introduce device min_header_len 2017-02-08 13:56:37 -05:00
macsec.c
macvlan.c
macvtap.c macvtap: read vnet_hdr_size once 2017-02-06 22:41:27 -05:00
mdio.c
mii.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
sungem_phy.c
tun.c tun: read vnet_hdr_sz once 2017-02-06 22:41:27 -05:00
veth.c
virtio_net.c
vrf.c
vxlan.c vxlan: fix oops in dev_fill_metadata_dst 2017-02-17 15:32:06 -05:00
xen-netfront.c xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend() 2017-02-10 13:44:49 -05:00