From: Amerigo Wang <amwang@redhat.com>
Date: Fri, 18 Dec 2009 13:52:53 -0500
Subject: ipv6: fix ipv6_hop_jumbo remote system crash
[net] ipv6: fix ipv6_hop_jumbo remote system crash

Message-id: 20091218135558.3780.80552.sendpatchset@localhost.localdomain
O-Subject: [PATCH RHEL5] ipv6: fix ipv6_hop_jumbo remote system crash
Bugzilla: 548643
RH-Acked-by: Neil Horman <nhorman@redhat.com>
RH-Acked-by: Andy Gospodarek <gospo@redhat.com>
RH-Acked-by: Jarod Wilson <jarod@redhat.com>
RH-Acked-by: David Miller <davem@redhat.com>
CVE: CVE-2007-4567

CVE-2007-4567

BZ:
https://bugzilla.redhat.com/show_bug.cgi?id=548643

Description:
This is related to CVE-2007-4567. Originally discovered by
Victor Julien that there is a way to crash the Linux kernel
by sending a single IPv6 packet at it.

Because skb->dst is assigned in ip6_route_input(), it is really
bad to use it in hop-by-hop option handler(s).

Brew:
https://brewweb.devel.redhat.com/taskinfo?taskID=2159157

Upstream status:
Commit e76b2b2567b8.

Signed-off-by: WANG Cong <amwang@redhat.com>

diff --git a/net/ipv6/exthdrs.c b/net/ipv6/exthdrs.c
index baefe8e..5a024ca 100644
--- a/net/ipv6/exthdrs.c
+++ b/net/ipv6/exthdrs.c
@@ -431,6 +431,14 @@ EXPORT_SYMBOL_GPL(ipv6_invert_rthdr);
   Hop-by-hop options.
  **********************************/
 
+/*
+ * Note: we cannot rely on skb->dst before we assign it in ip6_route_input().
+ */
+static inline struct inet6_dev *ipv6_skb_idev(struct sk_buff *skb)
+{
+	return skb->dst ? ip6_dst_idev(skb->dst) : __in6_dev_get(skb->dev);
+}
+
 /* Router Alert as of RFC 2711 */
 
 static int ipv6_hop_ra(struct sk_buff *skb, int optoff)
@@ -454,25 +462,25 @@ static int ipv6_hop_jumbo(struct sk_buff *skb, int optoff)
 	if (skb->nh.raw[optoff+1] != 4 || (optoff&3) != 2) {
 		LIMIT_NETDEBUG(KERN_DEBUG "ipv6_hop_jumbo: wrong jumbo opt length/alignment %d\n",
 		               skb->nh.raw[optoff+1]);
-		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst),
+		IP6_INC_STATS_BH(ipv6_skb_idev(skb),
 				 IPSTATS_MIB_INHDRERRORS);
 		goto drop;
 	}
 
 	pkt_len = ntohl(*(u32*)(skb->nh.raw+optoff+2));
 	if (pkt_len <= IPV6_MAXPLEN) {
-		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
+		IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff+2);
 		return 0;
 	}
 	if (skb->nh.ipv6h->payload_len) {
-		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INHDRERRORS);
+		IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INHDRERRORS);
 		icmpv6_param_prob(skb, ICMPV6_HDR_FIELD, optoff);
 		return 0;
 	}
 
 	if (pkt_len > skb->len - sizeof(struct ipv6hdr)) {
-		IP6_INC_STATS_BH(ip6_dst_idev(skb->dst), IPSTATS_MIB_INTRUNCATEDPKTS);
+		IP6_INC_STATS_BH(ipv6_skb_idev(skb), IPSTATS_MIB_INTRUNCATEDPKTS);
 		goto drop;
 	}