On Mon, 2017-05-08 at 11:09 +0800, Hangbin Liu wrote:
> Since ip6_frag_reasm() will call __in6_dev_get(dev), which will access
> dev->ip6_ptr. We need to make sure dev is not NULL.
>
> Signed-off-by: Hangbin Liu <liuhang...@gmail.com>
> ---
> net/ipv6/reassembly.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv6/reassembly.c b/net/ipv6/reassembly.c
> index e1da5b8..e3ebd62 100644
> --- a/net/ipv6/reassembly.c
> +++ b/net/ipv6/reassembly.c
> @@ -348,7 +348,7 @@ static int ip6_frag_queue(struct frag_queue *fq, struct
> sk_buff *skb,
> fq->q.flags |= INET_FRAG_FIRST_IN;
> }
>
> - if (fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> + if (dev && fq->q.flags == (INET_FRAG_FIRST_IN | INET_FRAG_LAST_IN) &&
> fq->q.meat == fq->q.len) {
> int res;
> unsigned long orefdst = skb->_skb_refdst;
How dev could be possibly NULL here ?
